* refactor(plugin-sdk): delete the heavy runtime-doctor barrel
Nothing may pull the state-db/kysely graph through a doctor barrel anymore.
The barrel's remaining heavy exports move to two narrow private-local
subpaths, each with a single purpose:
- doctor-repair-runtime: install-path diagnosis, plugin config removal, and
state-database schema detect/repair (matrix doctor, voice-call lazy import)
- plugin-state-store-runtime: the sync keyed-store factory. It stays out of
plugin-state-runtime because hot channel entrypoints import that at module
load and opening a store pulls the state-database graph.
Doctor closures also stop pulling ssrf-runtime (fetch-guard + gateway net)
for two legacy private-network helpers that live in the lighter ssrf-policy
subpath: mattermost, nextcloud-talk, tlon, matrix.
The closure guard now forbids the two new heavy subpaths instead of the
deleted barrel, so the invariant keeps being enforced where it still applies.
* perf(doctor): keep heavy graphs out of every doctor closure
Doctor enumeration cold-loads each declaring plugin's contract closure, so
one heavy import in a closure is paid by the whole sweep. Four barrels were
still dragging unrelated graphs in for trivial helpers; each is repaired at
the leaf rather than by caching downstream:
- Legacy private-network config migration moves to a config leaf. It only
reshapes records, but lived beside the SSRF runtime (DNS, proxy, logging),
costing mattermost ~2.7s. ssrf-policy re-exports it, surface unchanged.
- Streaming config readers move to a leaf. They read two config keys, but
streaming.ts also formats tool aggregates, pulling tool-display/logging/
acp-core; that cost slack ~2.3s.
- signal took the channel-secret barrel for isRecord; the canonical plugin
record guard is string-coerce-runtime (root AGENTS.md).
- llm-task took the provider-model barrel for parseModelRef, now a narrow
model-ref-parse subpath.
Full doctor enumeration of all 42 declaring plugins, built mode:
legacy config rules 6668ms -> 1265ms, state migrations 184ms -> 127ms.
No plugin remains an outlier; the slowest is now ~380ms against a ~200ms floor.
Public export surfaces of every touched SDK subpath are byte-identical
(verified by diffing built module exports before/after); the API baseline
hashes move only because re-exported declarations emit differently.
The closure guard gains rules for each repaired barrel so the invariant
holds for future closures.
* fix(release): exclude new private-local declarations from the published package
Same pack-path rule as c41da3759f: private-local subpaths ship without d.ts.
* fix(doctor): repair the closure guard violations that break main
The landed guard fails on main: three closures import heavy barrels for one
symbol each. Two more surfaced once the guard learned about the provider-model
barrel. Each gets a narrow subpath at the leaf:
- telegram sent-message-cache + state-migrations took the session-store barrel
(session accessor + state-db) for resolveStorePath -> session-store-paths
- discord thread-bindings.state took the channel-outbound barrel (reply
pipeline + channel registry) for one identity write -> outbound-echo-runtime
- discord model-picker took the provider-model barrel for normalizeProviderId,
which model-ref-parse now exposes beside parseModelRef
The guard also stops walking artifacts of plugins whose manifest declares no
doctor surface. Such a declaration gates the artifact off every enumeration
path exactly as resolvePluginDoctorContracts does, so its closure cost is never
paid; anthropic ("doctorContract": {}) was being held to a cost it cannot
incur. Absent declarations still load eagerly and stay enforced.
Side effect worth naming: discord's built doctor contract now loads again.
On main both discord and telegram fail to require in packaged builds (an
ESM-only transitive dep) and silently lose their repairs; this restores
discord and takes enumerated legacy config rules from 87 to 99. Telegram's
built artifact still pulls execa through dist chunking - a build-level defect
with a different owner, filed as follow-up.
Make timeout paths cancel or release every pending test continuation before cleanup, so failures cannot poison the remaining Swift suite. Inject the retry sleeper to preserve invalidation-before-backoff ordering without real-time polling.
* fix(telegram): prioritize configured commands under menu pressure
* fix(telegram): preserve custom commands under localized menu pressure
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Co-authored-by: ayeshakhalid192007-dev <ayeshakhalid192007@gmail.com>
* feat(agents): record run-end worktree cleanup outcome
Persist removed, retained, and failed run-end cleanup outcomes on managed worktree records. Operators and QA can inspect the durable fact through worktrees.list and openclaw worktrees list --json.
Release note: Managed worktree run-end cleanup now records why a checkout was removed or retained in worktree list JSON.
* test(qa): prove dirty worktree retention outcome
* chore(protocol): regenerate swift gateway models
* fix(agents): harden worktree cleanup recovery
Register run_end_cleanup_json as a lazy compatible column so same-version v6 index repair and read-only doctor migration can recover databases created before the column existed.
Type removal contention at the registry boundary; unexpected claim failures now best-effort record a bounded failed outcome and rethrow the original error.
* fix(ci): clear repo-wide lint debt blocking merge gates
The red-main landing rule requires this PR to repair repository-wide merge-gate debt instead of bypassing it. Apply the current lint contracts mechanically and split turn-transition coverage into a concept-named sibling with per-file-safe test state.
Exact line delta: +676/-574 (net +102) across 44 test/support files.
* fix(ci): preserve cached health refresh proof
Require the public refresh call to exist before accepting that sensitive fields were omitted, so the boundary proof cannot pass on a missing call.
* fix(ci): correct test typing left by the lint sweep
Literal-widened totalTokensVersion fixtures, a WebSocket RawData overload
mismatch, and the protocol schema document cast broke check-test-types
after the repo-wide lint repair. Aligns the fixtures with SessionEntry,
narrows Buffer handling per RawData, and keeps the JSON-shaped undefined
omission under structuredClone.
* test(agents): reuse upstream resource-loader test support
The session-loop split and #120463's helper extraction landed the same
createResourceLoader/createCompactionHandlers twice; the rebase kept both,
orphaning main's agent-session-loop-resource-loader.test-support.ts and
failing the dead-code gate. Import the upstream helpers and delete the
duplicates.
* fix(agents): reject finalized rows at the worktree removal claim
Address the accepted ClawSweeper late-claim finding by rereading and rejecting missing or finalized worktree rows inside the synchronous removal-claim transaction.
Preserve the authoritative cleanup invariant: finalized contenders record nothing, while retained-busy is written only while the row remains live.
* refactor(agents): reuse registry update for busy outcomes
Keep the live-row conditional write in the canonical registry update path so the finalized-claim repair stays below the registry max-lines ratchet without weakening the authoritative-outcome invariant.
* test(agents): drop session test duplicates after rebase
Keep current main as the canonical owner of next-turn lifecycle coverage and correctness test support after replaying the older lint-debt split.
* fix(agents): guard post-abort cleanup outcomes against finalization
After abortWorktreeRemoval releases a stale remover's claim, its retained or
failed write raced a finalizing remover and could overwrite the authoritative
removed-lossless fact. Route every retained/failed write through the live-row
condition; only the finalizing remover's own removed-lossless write stays
unconditional.
* fix(agents): persist the removal outcome atomically with finalization
A delayed removed-lossless write after remove() finalized could race a
restore plus newer cleanup and overwrite the newer operator-visible fact.
The run-end outcome now rides remove()'s finalization update; every other
cleanup write stays live-row conditional, so no post-finalize write path
remains.
* test(qa): restore strict cached-health contract assertions
The lint sweep's Boolean() coercions let truthy non-booleans satisfy the
wire-typed cached-meta contract. Assert the literal boolean for unknown-typed
fields and use nullish-coalesced strict equivalents for boolean chains.
* fix(agents): clear the stale cleanup outcome when restoring a worktree
A restored checkout begins a new lifecycle; leaving the removed-lossless
fact on the live row showed operators a stale result until the next
cleanup. Restore clears the recorded outcome and the regression asserts
the cleared state before the next cleanup records fresh truth.
* fix(agents): scope stale cleanup outcomes to their observed lifecycle
A stale remover's retained/failed write raced a concurrent remove-plus-
restore: the revived row is live again, so the live-row condition alone
could stamp a prior-lifecycle outcome. Condition those writes on the
activity stamp the remover observed; restore bumps lastActiveAt, making
any prior-lifecycle write a no-op.
* fix(agents): advance the restore activity stamp within one millisecond
Stale cleanup writes fence on the activity stamp they observed; a restore
completing in the same millisecond could revive the row with an identical
stamp and let the fence match. Restore now always advances past the
stored value, and the ABA regression pins the clock to prove the
same-millisecond case.
* perf(doctor): slim remaining heavy doctor contract closures
Follow-up to #120698: several doctor closures still cold-loaded multi-second
kysely-bearing graphs through other broad barrels (session-store-runtime,
realtime-voice, channel-outbound, logging-core, memory-host-core/-events,
sqlite-runtime, persistent-dedupe, and plugin-local barrels).
- lazy-import heavy helpers inside async migration bodies (codex, msteams,
zalouser, workboard, matrix inbound-dedupe, memory-core migrations)
- bypass plugin-local barrels to defining modules (reef protocol,
memory-core short-term-promotion)
- move to lighter existing subpaths (slack -> channel-streaming, matrix
logger -> security-runtime, memory-wiki -> agent-scope-runtime, which now
also exports resolveSessionAgentId)
- add narrow openclaw/plugin-sdk/realtime-voice-activation for discord's
sync wake-name doctor rules
- split src/infra/kysely-sync-cache-state.ts so sqlite-transaction clears
Kysely caches without value-loading kysely; split the memory-host-sdk
kysely bridge off the schema/transaction bridge
- guard: forbid the heavy barrels in doctor closures with per-kind scoping
Cold enumeration per plugin: discord 52.6s->0.3s, msteams 30.9s->0.5s,
codex 29.6s->2.6s, zalouser 28.8s->2.3s, matrix 27.2s->3.2s,
slack 17.5s->1.5s, reef 9.9s->0.7s, memory-core 6.4s->3.6s,
workboard 3.4s->0.25s; all kysely-free except llm-task (named follow-up).
* fix(plugins): route slack streaming compat through a focused streaming-config subpath
The channel-streaming compat barrel is deprecated for extension production
code (deprecated-api-usage guard + SDK package contract). Add the narrow
non-deprecated openclaw/plugin-sdk/channel-streaming-config subpath for the
pure streaming config readers, and drop the now consumer-less
short-term-promotion barrel re-exports knip flagged.
* test(plugins): register memory-host-sdk kysely bridge in package boundary inventory
* fix(plugins): classify realtime-voice-activation as private-local
ClawSweeper P2: the subpath exports only a default target, which is the
private-local shape; register it in plugin-sdk-private-local-only-subpaths,
the package-boundary d.ts alias maps, and correct the public surface budgets
(realtime-voice-activation no longer counts as public).
* fix(release): exclude realtime-voice-activation declarations from the published package
Private-local subpaths ship without d.ts; register the files negation the
release pack-path check requires.
Prewarm process-stable config-driven reply runtimes before Gateway readiness and skip ambient resource discovery when embedded sessions disable every ambient resource class. Isolated mock Gateway runs reduced median cold pre-model latency from 3.513s in the matched pre-fix control to 2.394s, while warm turns remained sub-450ms. Related: #119895.
Replace the artifact-store-first guidance with the direct
uploads.github.com/user-attachments endpoint (same CDN as drag-and-drop,
works with gh auth token); Crabbox artifact publishing stays as the
fallback for non-media artifacts or endpoint failure.
* fix(hooks): allow scoped hook wakes for unscheduled targets; keep announce wake aligned with queued session
- heartbeat-wake-policy: add isTargetedImmediateHookWake so a scoped hook
wake (source=hook, reason=hook:*) counts as an immediate targeted wake;
a known agent without a recurring heartbeat schedule can now be woken
once so its queued hook event gets consumed instead of sitting unread.
- scheduler + execution: accept the hook wake in the allowsUnscheduledTarget
gate alongside notifications-event wakes; unconfigured agents stay rejected.
- hooks announce path: only pass agentId when the hook explicitly named an
agent; an unnamed hook resolves its event session from fresh config at
announce time, so pairing the dispatch-time default agent with that
session could wake a stale agent after a default-agent reload.
- regression tests: targeted hook wake for an unscheduled agent runs once;
unconfigured hook targets rejected; announce wake omits default agentId
for unnamed hooks.
* test(infra): split hook-wake heartbeat tests out of scheduler test file
Keep heartbeat-runner.scheduler.test.ts inside the oxlint max-lines budget
(1045 -> 995 effective lines) by moving the two hook-source wake targeting
tests into heartbeat-runner.hook-wake.test.ts. No production code changes.
* fix(gateway): target global-scope hook wakes at the fresh default agent
Global session scope resolves hook event keys to the unscoped "global"
sentinel, which carries no agent identity. The scheduler refuses to
resolve a target from it, so announce and failure wakes for unnamed
hooks left the queued event unread.
Carry the fresh default agent alongside the global key on both paths
(announce and failure), mirroring the enqueue-wake path. Non-global
unnamed-hook wakes are unchanged: their session key embeds the agent,
and pairing a frozen default agent could wake a stale agent after a
default-agent reload.
* fix(gateway): target recovered global failure wakes at the explicit or fresh default agent
The failure-wake agent selection gated both branches on hookEventSessionKey.
When initial event-key resolution fails (early config failure), that key is
absent even though recovery still yields the unscoped "global" sentinel; the
wake then carried no agentId and the queued failure event sat unread.
Use the recovered session key for the sentinel check and attach the explicit
agent, or the fresh default agent, so the global failure event is consumed.
Non-global unnamed-hook wakes are unchanged: their session key embeds the
agent, and pairing a frozen default agent could wake a stale agent after a
default-agent reload.
* fix(gateway): preserve agent identity for global hook wakes
Signed-off-by: sallyom <somalley@redhat.com>
* test(infra): allow seeding a heartbeat session without delivery fields
The new hook-wake test seeds an empty session for the hooks agent, which
has no real delivery context. Relax seedSessionStore's seed type to
Partial so empty seeds typecheck.
* fix(gateway): keep global hook wakes on the dispatch-time agent
The announce and failure wake paths resolved the default agent from
fresh config at queue-execution time. If a default-agent reload happened
between dispatch and execution, a global-scope wake retargeted at the new
default while the isolated run used the accepted agent, so the event
produced under one agent was consumed by another. Freeze the accepted
agent at dispatch (acceptedHookAgentId) and prefer it in both wake paths;
fresh resolution remains the fallback for pre-acceptance failures. Adds
announce + failure reload regressions (default main -> work mid-queue).
* test(hooks): annotate reload fixtures as OpenClawConfig
The default-agent reload fixtures widened session.scope to string and
fixed agents.entries to the first assignment's shape, breaking
check-test-types. Annotate both fixtures so each reload conforms to the
config contract.
* fix(hooks): partition global-scope hook events by owning agent
Global-scope hook announce and failure events all land in the shared
literal `global` system-event queue while each wake targets a single
agent, so concurrent hook completions can cross-consume each other's
events: the first targeted wake drains every agent's queued result or
failure into one prompt.
Give transient system events an ownerAgentId set by the hook dispatch
paths (announce, failure, and wake-only enqueues) whenever the event
lands on the unscoped sentinel queue, and filter the heartbeat preflight
peek to the running agent's owned events. The store's literal global
session row stays shared; unowned events remain visible to every agent,
so non-hook global events are unchanged.
Add a two-agent concurrent regression proving the first targeted wake
leaves the other agent's event queued for its owner.
* fix(hooks): isolate global events by agent
Signed-off-by: sallyom <somalley@redhat.com>
* fix(infra): unexport internal targeted-wake helpers
isTargetedImmediateSystemEventWake and isTargetedImmediateHookWake are
only consumed by isTargetedImmediateUnscheduledWake within the same
module; keep them module-private so knip deadcode stops flagging the
unused exports.
---------
Signed-off-by: sallyom <somalley@redhat.com>
Co-authored-by: sallyom <somalley@redhat.com>
* fix(ui): prevent dark widget loading flashes
Dashboard Canvas and MCP App frames now paint their theme-derived widget surface while sandbox content loads, avoiding white flashes in dark mode.
* test(ui): avoid shadowing widget fixture
* fix(worker): preserve Responses replay across handoff
Long OpenAI Responses cloud-worker sessions retain authoritative compaction replay through windowing and fail visibly when it cannot be preserved.
* test(worker): align replay fixture with frame limit
* [AI] fix(sessions): archive cron-run transcripts pruned by tasks maintenance
openclaw tasks maintenance --apply pruned stale cron-run session entries and
hard-deleted their SQLite transcript rows without writing the compressed
.deleted archive every other removal path writes (cron reaper, cleanup
service, heartbeat, doctor). The removal list built in
pruneSessionRegistryStore never set archiveRemovedTranscript, so the
downstream projection archived nothing while the rows were reclaimed
unconditionally.
Set archiveRemovedTranscript: true on the removal, matching the cron session
reaper. The existing archive machinery then writes and verifies the
.deleted.<ts>.zst cold copy before rows are reclaimed, so operators keep the
automation transcript under the archive retention policy.
Fixes#119269
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* [AI] test(sessions): recognize plain transcript archives in maintenance regression
ClawSweeper P2 on #119485: the archive-discovery helper only matched
.deleted.*.zst, but encodeSessionArchiveContent emits a plain JSONL
deleted archive when zstd is unavailable (e.g. Bun). Use the shared
isRetainedSessionTranscriptArchiveName classifier so the apply regression
accepts both supported archive encodings.
Related to #119269
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* test(sessions): strengthen maintenance archive proof
Co-authored-by: SunnyShu0925 <shu.zongyu@xydigit.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Peter Steinberger