* refactor(sdk): collapse plan updates to typed steps
Per owner decision, remove the shipped steps: string[] SDK field and its unreleased planSteps replacement early. Collapse onPlanUpdate to one typed steps field. Retain wire-level string normalization for external Codex plugin version skew.
* chore(sdk): tighten rebased surface budget
* fix(file-transfer): deny listing the directory a denyPaths rule names
A denyPaths entry like "**/.ssh/**" did not deny dir.list on the denied
directory itself, so listing /home/me/.ssh returned its full contents,
including filenames such as id_rsa and authorized_keys. Only paths strictly
under the directory were denied.
The deny gate matched the requested path against the globs as a plain string,
and a trailing /** requires something after the separator, so the bare
directory never matched. Every command routes its path through
evaluateFilePolicy, but dir.list is where it is observable, since its payload
is the directory's own contents. dir.fetch was incidentally safe because it
rechecks each returned entry, and those entries do match; dir.list has no
such recheck.
Match the deny globs against the directory form of the path at that one gate.
The check stays deny-side only, so it can fail closed but never open.
* test(file-transfer): cover denied directory path forms
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(googlechat): cancel non-OK cert fetch response body before throwing
When fetchChatCerts receives a non-OK response from the Google Chat
cert endpoint, it throws without cancelling the response body.
Cancel the body before throwing, matching the pattern established
in reef guard adapters (#109196) and fetchOpenRouterModels.
* test(googlechat): cover cert response cancellation
Co-authored-by: 毛宇豪0668001457 <mao.yuhao@xydigit.com>
* test(googlechat): satisfy strict call-order types
Co-authored-by: 毛宇豪0668001457 <mao.yuhao@xydigit.com>
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Transport proof for the migrated ingress path: offset-after-spool-ack,
webhook redelivery on write failure, update_id/lane mapping, and the
authorization-gated supersede suite including paired-DM, owner, topic-override
and other-bot-command cases (#108656).
Both transports now enqueue durably and pump the shared drain: polling keeps
offset-after-committed-enqueue, webhook keeps 200-after-spool-write. Deletes
the reply fence, private claim-owner, retry policy, and per-transport
claim/replay/watchdog loops. Dispatch outcomes propagate: failed-retryable
releases for replay instead of tombstoning. Supersede policy stays
Telegram-owned, authorization-gated with pairing-store and owner identities
via the same resolver as normal ingress; room_event ambient pending remains
supersedable by a later user turn (#108656).
Replace the bare onTurnAdopted callback and queuedFollowupLifecycle with one
turnAdoptionLifecycle surface (onSettled guaranteed via finally; adoption-loss
aborts queued steering turns without transcript replay), threaded through the
turn kernel and agent runner, exposed to plugins via
runtime.state.openChannelIngressDrain and the channel-outbound SDK barrel,
with surface budgets re-measured against the narrowed baselines (#108656).
* refactor(channels): shared supplemental sender gating, allowlist-match adoption, outbound mop-ups
* fix(plugin-sdk): skip-aware media sequence with text fallback for empty URLs
* chore(plugin-sdk): align surface budgets after rebase
* test(qqbot): type media sender mock calls
* fix(plugin-sdk): distinguish empty media sequences
* fix(plugin-sdk): track void media sends
* fix(acpx): keep leaked non-openai model out of the Codex ACP thinking slot
Codex ACP spawn mis-routed an inherited non-OpenAI fleet default into the
reasoning-effort slot and aborted (#95780). Replace the splitter with a closed
classifier and make the spawn path provenance-aware: drop an inherited leaked
default so Codex starts on its own default, but fail closed with
ACP_INVALID_RUNTIME_OPTION when a caller explicitly selects an unsupported or
malformed model. Thread a modelExplicit flag from resolveAcpSpawnRuntimeOptions
through the ACP runtime ensure contract; strip it before the acpx delegate.
Dropping the inherited default only at ensureSession was not enough: the manager
still persisted the leaked model in runtimeOptions, and the first turn replayed
it through applyRuntimeControls -> setConfigOption(model), which the new
fail-closed Codex control path then rejected. ensureSession now reports the
effective model it applied on the returned handle (applied | dropped), and the
manager persists that effective model, so a dropped inherited default is never
saved or replayed as a model control before the first turn. Explicit unsupported
selections still fail closed at spawn and never persist.
* test(acp): split runtime config validation tests
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
`taskkill.exe` can hang when the target process is stuck in a kernel wait
state (e.g. a pending I/O request). Add a 5-second timeout so QA scenario
cleanup fails closed instead of hanging the test runner indefinitely.
Co-authored-by: Peter Steinberger <steipete@gmail.com>
`taskkill.exe` can hang when the target process is stuck in a kernel wait
state. Add a 5-second timeout to both taskkill invocations in the gateway
child process tree cleanup so stalled termination fails closed instead of
hanging the QA runner.
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* feat(llama-cpp): add in-process text inference
* test(llama-cpp): narrow setup provider fixture
* fix(llama-cpp): trim public surface and refresh docs map
* fix(llama-cpp): import Context type in inference test
* refactor(google-meet): merge host and node realtime engines behind one audio transport
* refactor(google-meet): internalize engine helpers left test-only after realtime-node removal
Peter Steinberger