From e672b61417af5c45b0431df6d9109a1f4b618ef5 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 09:51:41 -0700 Subject: [PATCH 001/418] fix(whatsapp): stop reconnecting quiet sockets Fixes #70678.\n\nKeeps quiet but healthy WhatsApp linked-device sessions connected by tracking WhatsApp Web transport activity, while retaining a longer app-silence cap so frame activity cannot mask a stuck session forever. Also cleans up transport activity listeners on failed connection-open paths.\n\nCarries forward the focused #71466 approach and keeps #63939 as related configurable-timeout follow-up. Thanks @vincentkoc and @oromeis.\n\nValidation:\n- pnpm test:serial extensions/whatsapp/src/auto-reply.web-auto-reply.connection-and-logging.e2e.test.ts extensions/whatsapp/src/connection-controller.test.ts\n- pnpm check:changed\n- codex review --base origin/main --- CHANGELOG.md | 1 + docs/channels/whatsapp.md | 5 ++ .../whatsapp/src/auto-reply.test-harness.ts | 50 +++++++++-- ...o-reply.connection-and-logging.e2e.test.ts | 87 +++++++++++++++++++ extensions/whatsapp/src/auto-reply/monitor.ts | 19 ++-- .../whatsapp/src/connection-controller.ts | 54 +++++++++++- 6 files changed, 200 insertions(+), 16 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index de08cba1708..52bd60a09f7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -16,6 +16,7 @@ Docs: https://docs.openclaw.ai - Plugins: fail `plugins update` when tracked plugin or hook updates error, keep bundled runtime-dependency repair behind restrictive allowlists, and reject package installs with unloadable extension entries. Thanks @codex. - Gateway/chat: keep duplicate attachment-backed `chat.send` retries with the same idempotency key on the documented in-flight path so aborts still target the real active run. Fixes #70139. Thanks @Feelw00. - Plugins: share package entrypoint resolution between install and discovery, reject mismatched `runtimeExtensions`, and cache bundled runtime-dependency manifest reads during scans. Thanks @codex. +- WhatsApp/Web: keep quiet but healthy linked-device sessions connected by basing the watchdog on WhatsApp Web transport activity, while retaining a longer app-silence cap so frame activity cannot mask a stuck session forever. Fixes #70678; carries forward the focused #71466 approach and keeps #63939 as related configurable-timeout follow-up. Thanks @vincentkoc and @oromeis. ## 2026.4.26 diff --git a/docs/channels/whatsapp.md b/docs/channels/whatsapp.md index 13092af45c8..194f15b1e74 100644 --- a/docs/channels/whatsapp.md +++ b/docs/channels/whatsapp.md @@ -146,6 +146,7 @@ OpenClaw recommends running WhatsApp on a separate number when possible. (The ch ## Runtime model - Gateway owns the WhatsApp socket and reconnect loop. +- The reconnect watchdog uses WhatsApp Web transport activity, not only inbound app-message volume, so a quiet linked-device session is not restarted solely because nobody has sent a message recently. A longer application-silence cap still forces a reconnect if transport frames keep arriving but no application messages are handled for the watchdog window. - Outbound sends require an active WhatsApp listener for the target account. - Status and broadcast chats are ignored (`@status`, `@broadcast`). - Direct chats use DM session rules (`session.dmScope`; default `main` collapses DMs to the agent main session). @@ -510,6 +511,10 @@ Behavior notes: Symptom: linked account with repeated disconnects or reconnect attempts. + Quiet accounts can stay connected past the normal message timeout; the watchdog + restarts when WhatsApp Web transport activity stops, the socket closes, or + application-level activity stays silent beyond the longer safety window. + Fix: ```bash diff --git a/extensions/whatsapp/src/auto-reply.test-harness.ts b/extensions/whatsapp/src/auto-reply.test-harness.ts index 3dd8b9c646a..efa957d8396 100644 --- a/extensions/whatsapp/src/auto-reply.test-harness.ts +++ b/extensions/whatsapp/src/auto-reply.test-harness.ts @@ -1,4 +1,5 @@ import "./test-helpers.js"; +import { EventEmitter } from "node:events"; import fs from "node:fs/promises"; import os from "node:os"; import path from "node:path"; @@ -42,25 +43,57 @@ type WebAutoReplyMonitorHarness = { controller: AbortController; run: Promise; }; +type MockSessionSocket = { + ev: { on: ReturnType; off: ReturnType }; + ws: EventEmitter & { close: ReturnType }; + user: { id: string }; +}; export const TEST_NET_IP = "93.184.216.34"; +const WEB_AUTO_REPLY_SOCKETS_KEY = Symbol.for("openclaw:webAutoReplySessionSockets"); + +function getSessionSockets(): MockSessionSocket[] { + const store = globalThis as Record; + if (!Array.isArray(store[WEB_AUTO_REPLY_SOCKETS_KEY])) { + store[WEB_AUTO_REPLY_SOCKETS_KEY] = []; + } + return store[WEB_AUTO_REPLY_SOCKETS_KEY] as MockSessionSocket[]; +} vi.mock("./session.js", async () => { const actual = await vi.importActual("./session.js"); return { ...actual, - createWaSocket: vi.fn(async () => ({ - ev: { - on: vi.fn(), - off: vi.fn(), - }, - ws: { close: vi.fn() }, - user: { id: "123@s.whatsapp.net" }, - })), + createWaSocket: vi.fn(async () => { + const ws = new EventEmitter() as MockSessionSocket["ws"]; + ws.close = vi.fn(); + const sock: MockSessionSocket = { + ev: { + on: vi.fn(), + off: vi.fn(), + }, + ws, + user: { id: "123@s.whatsapp.net" }, + }; + getSessionSockets().push(sock); + return sock; + }), waitForWaConnection: vi.fn().mockResolvedValue(undefined), }; }); +export function getLastWebAutoReplySessionSocket(): MockSessionSocket { + const last = getSessionSockets().at(-1); + if (!last) { + throw new Error("No WhatsApp Web auto-reply test socket created"); + } + return last; +} + +export function resetWebAutoReplySessionSockets() { + getSessionSockets().length = 0; +} + vi.mock("openclaw/plugin-sdk/agent-runtime", () => ({ abortEmbeddedPiRun: vi.fn().mockReturnValue(false), appendCronStyleCurrentTimeLine: (text: string) => text, @@ -166,6 +199,7 @@ export function installWebAutoReplyUnitTestHooks(opts?: { pinDns?: boolean }) { beforeEach(async () => { vi.clearAllMocks(); + resetWebAutoReplySessionSockets(); _resetBaileysMocks(); _resetLoadConfigMock(); if (opts?.pinDns) { diff --git a/extensions/whatsapp/src/auto-reply.web-auto-reply.connection-and-logging.e2e.test.ts b/extensions/whatsapp/src/auto-reply.web-auto-reply.connection-and-logging.e2e.test.ts index ce97327b6bc..6585de0c481 100644 --- a/extensions/whatsapp/src/auto-reply.web-auto-reply.connection-and-logging.e2e.test.ts +++ b/extensions/whatsapp/src/auto-reply.web-auto-reply.connection-and-logging.e2e.test.ts @@ -12,6 +12,7 @@ import { createMockWebListener, createScriptedWebListenerFactory, createWebListenerFactoryCapture, + getLastWebAutoReplySessionSocket, installWebAutoReplyTestHomeHooks, installWebAutoReplyUnitTestHooks, makeSessionStore, @@ -255,6 +256,92 @@ describe("web auto-reply connection", () => { } }); + it("keeps quiet linked-device sessions open when transport frames keep arriving", async () => { + vi.useFakeTimers(); + try { + const sleep = vi.fn(async () => {}); + const scripted = createScriptedWebListenerFactory(); + const { controller, run } = startWebAutoReplyMonitor({ + monitorWebChannelFn: monitorWebChannel as never, + listenerFactory: scripted.listenerFactory, + sleep, + heartbeatSeconds: 60, + messageTimeoutMs: 30, + watchdogCheckMs: 5, + }); + + await vi.waitFor( + () => { + expect(scripted.getListenerCount()).toBe(1); + }, + { timeout: 250, interval: 2 }, + ); + + const socket = getLastWebAutoReplySessionSocket(); + await vi.advanceTimersByTimeAsync(20); + socket.ws.emit("frame"); + await vi.advanceTimersByTimeAsync(20); + socket.ws.emit("frame"); + await vi.advanceTimersByTimeAsync(20); + + expect(scripted.getListenerCount()).toBe(1); + + controller.abort(); + scripted.resolveClose(0, { status: 499, isLoggedOut: false }); + await Promise.resolve(); + await run; + } finally { + vi.useRealTimers(); + } + }); + + it("does not let transport frames mask application silence forever", async () => { + vi.useFakeTimers(); + try { + const sleep = vi.fn(async () => {}); + const scripted = createScriptedWebListenerFactory(); + const { controller, run } = startWebAutoReplyMonitor({ + monitorWebChannelFn: monitorWebChannel as never, + listenerFactory: scripted.listenerFactory, + sleep, + heartbeatSeconds: 60, + messageTimeoutMs: 30, + watchdogCheckMs: 5, + }); + + await vi.waitFor( + () => { + expect(scripted.getListenerCount()).toBe(1); + }, + { timeout: 250, interval: 2 }, + ); + + const socket = getLastWebAutoReplySessionSocket(); + for (let elapsedMs = 0; elapsedMs < 140; elapsedMs += 20) { + socket.ws.emit("frame"); + await vi.advanceTimersByTimeAsync(20); + } + + await vi.waitFor( + () => { + expect(scripted.getListenerCount()).toBeGreaterThanOrEqual(2); + }, + { timeout: 250, interval: 2 }, + ); + + controller.abort(); + scripted.resolveClose(scripted.getListenerCount() - 1, { + status: 499, + isLoggedOut: false, + error: "aborted", + }); + await Promise.resolve(); + await run; + } finally { + vi.useRealTimers(); + } + }); + it("gives a reconnected listener a fresh watchdog window", async () => { vi.useFakeTimers(); try { diff --git a/extensions/whatsapp/src/auto-reply/monitor.ts b/extensions/whatsapp/src/auto-reply/monitor.ts index 44135be09c4..9980fdf02b1 100644 --- a/extensions/whatsapp/src/auto-reply/monitor.ts +++ b/extensions/whatsapp/src/auto-reply/monitor.ts @@ -280,6 +280,7 @@ export async function monitorWebChannel( reconnectAttempts: snapshot.reconnectAttempts, messagesHandled: snapshot.handledMessages, lastInboundAt: snapshot.lastInboundAt, + lastTransportActivityAt: snapshot.lastTransportActivityAt, authAgeMs, uptimeMs: snapshot.uptimeMs, ...(minutesSinceLastMessage !== null && minutesSinceLastMessage > 30 @@ -297,20 +298,28 @@ export async function monitorWebChannel( } }, onWatchdogTimeout: (snapshot) => { - const watchdogBaselineAt = snapshot.lastInboundAt ?? snapshot.startedAt; - const minutesSinceLastMessage = Math.floor((Date.now() - watchdogBaselineAt) / 60000); + const now = Date.now(); + const transportSilentMs = now - snapshot.lastTransportActivityAt; + const appBaselineAt = snapshot.lastInboundAt ?? snapshot.startedAt; + const minutesSinceTransportActivity = Math.floor(transportSilentMs / 60000); + const minutesSinceAppActivity = Math.floor((now - appBaselineAt) / 60000); + const watchdogReason = + transportSilentMs > messageTimeoutMs ? "transport-inactive" : "app-silent"; statusController.noteWatchdogStale(); heartbeatLogger.warn( { connectionId: snapshot.connectionId, - minutesSinceLastMessage, + watchdogReason, + minutesSinceTransportActivity, + minutesSinceAppActivity, lastInboundAt: snapshot.lastInboundAt ? new Date(snapshot.lastInboundAt) : null, + lastTransportActivityAt: new Date(snapshot.lastTransportActivityAt), messagesHandled: snapshot.handledMessages, }, - "Message timeout detected - forcing reconnect", + "WhatsApp watchdog timeout detected - forcing reconnect", ); whatsappHeartbeatLog.warn( - `No messages received in ${minutesSinceLastMessage}m - restarting connection`, + `WhatsApp watchdog timeout (${watchdogReason}) - restarting connection`, ); }, }); diff --git a/extensions/whatsapp/src/connection-controller.ts b/extensions/whatsapp/src/connection-controller.ts index 6142dacfc6e..a0fc5f04b28 100644 --- a/extensions/whatsapp/src/connection-controller.ts +++ b/extensions/whatsapp/src/connection-controller.ts @@ -40,8 +40,10 @@ export type WhatsAppLiveConnection = { heartbeat: TimerHandle | null; watchdogTimer: TimerHandle | null; lastInboundAt: number | null; + lastTransportActivityAt: number; handledMessages: number; unregisterUnhandled: (() => void) | null; + unregisterTransportActivity: (() => void) | null; backgroundTasks: Set>; closePromise: Promise; resolveClose: (reason: WebListenerCloseReason) => void; @@ -51,6 +53,7 @@ export type WhatsAppConnectionSnapshot = { connectionId: string; startedAt: number; lastInboundAt: number | null; + lastTransportActivityAt: number; handledMessages: number; reconnectAttempts: number; uptimeMs: number; @@ -83,6 +86,12 @@ function createNeverResolvePromise(): Promise { return new Promise(() => {}); } +type SocketActivityEmitter = { + on?: (event: string, listener: (...args: unknown[]) => void) => void; + off?: (event: string, listener: (...args: unknown[]) => void) => void; + removeListener?: (event: string, listener: (...args: unknown[]) => void) => void; +}; + function createLiveConnection(params: { connectionId: string; sock: WASocket; @@ -108,8 +117,10 @@ function createLiveConnection(params: { heartbeat: null, watchdogTimer: null, lastInboundAt: null, + lastTransportActivityAt: Date.now(), handledMessages: 0, unregisterUnhandled: null, + unregisterTransportActivity: null, backgroundTasks: new Set>(), closePromise, resolveClose: resolveClosePromise, @@ -232,6 +243,7 @@ export class WhatsAppConnectionController { private readonly heartbeatSeconds: number; private readonly keepAlive: boolean; private readonly messageTimeoutMs: number; + private readonly appSilenceTimeoutMs: number; private readonly watchdogCheckMs: number; private readonly verbose: boolean; private readonly abortSignal?: AbortSignal; @@ -262,6 +274,7 @@ export class WhatsAppConnectionController { this.keepAlive = params.keepAlive; this.heartbeatSeconds = params.heartbeatSeconds; this.messageTimeoutMs = params.messageTimeoutMs; + this.appSilenceTimeoutMs = Math.max(params.messageTimeoutMs, params.messageTimeoutMs * 4); this.watchdogCheckMs = params.watchdogCheckMs; this.reconnectPolicy = params.reconnectPolicy; this.abortSignal = params.abortSignal; @@ -311,6 +324,14 @@ export class WhatsAppConnectionController { } this.current.handledMessages += 1; this.current.lastInboundAt = timestamp; + this.current.lastTransportActivityAt = timestamp; + } + + noteTransportActivity(timestamp = Date.now()): void { + if (!this.current) { + return; + } + this.current.lastTransportActivityAt = timestamp; } getCurrentSnapshot( @@ -323,6 +344,7 @@ export class WhatsAppConnectionController { connectionId: connection.connectionId, startedAt: connection.startedAt, lastInboundAt: connection.lastInboundAt, + lastTransportActivityAt: connection.lastTransportActivityAt, handledMessages: connection.handledMessages, reconnectAttempts: this.reconnectAttempts, uptimeMs: Date.now() - connection.startedAt, @@ -369,6 +391,7 @@ export class WhatsAppConnectionController { const listener = await params.createListener({ sock, connection }); connection.listener = listener; this.current = connection; + connection.unregisterTransportActivity = this.attachTransportActivityListener(sock); registerWhatsAppConnectionController(this.accountId, this); this.startTimers(connection, { onHeartbeat: params.onHeartbeat, @@ -383,6 +406,7 @@ export class WhatsAppConnectionController { if (connection?.unregisterUnhandled) { connection.unregisterUnhandled(); } + connection?.unregisterTransportActivity?.(); throw err; } } @@ -515,6 +539,7 @@ export class WhatsAppConnectionController { this.socketRef.current = null; } connection.unregisterUnhandled?.(); + connection.unregisterTransportActivity?.(); if (connection.heartbeat) { clearInterval(connection.heartbeat); } @@ -563,9 +588,14 @@ export class WhatsAppConnectionController { }, this.heartbeatSeconds * 1000); connection.watchdogTimer = setInterval(() => { - const baselineAt = connection.lastInboundAt ?? connection.startedAt; - const staleForMs = Date.now() - baselineAt; - if (staleForMs <= this.messageTimeoutMs) { + const now = Date.now(); + const transportStaleForMs = now - connection.lastTransportActivityAt; + const appBaselineAt = connection.lastInboundAt ?? connection.startedAt; + const appSilentForMs = now - appBaselineAt; + if ( + transportStaleForMs <= this.messageTimeoutMs && + appSilentForMs <= this.appSilenceTimeoutMs + ) { return; } const snapshot = this.getCurrentSnapshot(connection); @@ -581,6 +611,24 @@ export class WhatsAppConnectionController { }, this.watchdogCheckMs); } + private attachTransportActivityListener(sock: WASocket): (() => void) | null { + const ws = sock.ws as SocketActivityEmitter | undefined; + if (!ws || typeof ws.on !== "function") { + return null; + } + + const noteActivity = () => this.noteTransportActivity(); + ws.on("frame", noteActivity); + + return () => { + if (typeof ws.off === "function") { + ws.off("frame", noteActivity); + return; + } + ws.removeListener?.("frame", noteActivity); + }; + } + private stopDisconnectRetries(): void { if (!this.disconnectRetryController.signal.aborted) { this.disconnectRetryController.abort(); From 303cde8f6087f0b4859b26313df5cdc5cd0e4952 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 10:58:19 -0700 Subject: [PATCH 002/418] fix(auto-reply): poison inbound dedupe after partial turn failure * fix(auto-reply): poison inbound dedupe after replay-unsafe failures * fix(clownfish): address review for ghcrawl-165980-agentic-merge (1) --- CHANGELOG.md | 1 + .../reply/dispatch-from-config.test.ts | 89 +++++++++++++++++++ src/auto-reply/reply/dispatch-from-config.ts | 32 ++++++- src/auto-reply/reply/inbound-dedupe.test.ts | 29 ++++++ 4 files changed, 150 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 52bd60a09f7..75a8c6579ce 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,7 @@ Docs: https://docs.openclaw.ai ### Fixes +- Auto-reply: poison inbound message dedupe after replay-unsafe provider/runtime failures so retries stay safe before visible progress but cannot duplicate messages after block output, tool side effects, or session progress. Fixes #69303; keeps #58549 and #64606 as duplicate validation. Thanks @martingarramon, @NikolaFC, and @zeroth-blip. - Gateway/Bonjour: keep @homebridge/ciao cancellation handlers registered across advertiser restarts so late probing cancellations cannot crash Linux and other mDNS-churned gateways. Thanks @codex. - Plugins/startup: load the default `memory-core` slot during Gateway startup when permitted so active-memory recall can call `memory_search` and `memory_get` without requiring an explicit `plugins.slots.memory` entry, while preserving `plugins.slots.memory: "none"`. Thanks @codex. - Plugins/CLI: prefer native require for compiled bundled plugin JavaScript before jiti so read-only config, status, device, and node commands avoid unnecessary transform overhead on slow hosts. Fixes #62842. Thanks @Effet. diff --git a/src/auto-reply/reply/dispatch-from-config.test.ts b/src/auto-reply/reply/dispatch-from-config.test.ts index 22cc2cc944a..9645d912024 100644 --- a/src/auto-reply/reply/dispatch-from-config.test.ts +++ b/src/auto-reply/reply/dispatch-from-config.test.ts @@ -3392,6 +3392,95 @@ describe("dispatchReplyFromConfig", () => { ); }); + it("poisons inbound dedupe when dispatch fails after a block reply", async () => { + setNoAbort(); + const ctx = buildTestCtx({ + Provider: "whatsapp", + OriginatingChannel: "whatsapp", + OriginatingTo: "whatsapp:+15555550125", + To: "whatsapp:+15555550125", + AccountId: "default", + MessageSid: "msg-dup-block-error", + SessionKey: "agent:main:whatsapp:direct:+15555550125", + CommandBody: "hello", + RawBody: "hello", + Body: "hello", + }); + const firstDispatcher = createDispatcher(); + const replyResolver = vi.fn( + async (_ctx: MsgContext, opts?: GetReplyOptions): Promise => { + await opts?.onBlockReply?.({ text: "partial answer" }); + throw new Error("provider failed after block"); + }, + ); + + await expect( + dispatchReplyFromConfig({ + ctx, + cfg: emptyConfig, + dispatcher: firstDispatcher, + replyResolver, + }), + ).rejects.toThrow("provider failed after block"); + + await dispatchReplyFromConfig({ + ctx, + cfg: emptyConfig, + dispatcher: createDispatcher(), + replyResolver, + }); + + expect(firstDispatcher.sendBlockReply).toHaveBeenCalledWith({ text: "partial answer" }); + expect(replyResolver).toHaveBeenCalledTimes(1); + }); + + it("poisons inbound dedupe when dispatch fails after a suppressed tool result", async () => { + setNoAbort(); + sessionStoreMocks.currentEntry = { + sessionId: "s1", + updatedAt: 0, + sendPolicy: "deny", + }; + const ctx = buildTestCtx({ + Provider: "whatsapp", + OriginatingChannel: "whatsapp", + OriginatingTo: "whatsapp:+15555550126", + To: "whatsapp:+15555550126", + AccountId: "default", + MessageSid: "msg-dup-tool-error", + SessionKey: "agent:main:whatsapp:direct:+15555550126", + CommandBody: "hello", + RawBody: "hello", + Body: "hello", + }); + const firstDispatcher = createDispatcher(); + const replyResolver = vi.fn( + async (_ctx: MsgContext, opts?: GetReplyOptions): Promise => { + await opts?.onToolResult?.({ text: "tool touched external state" }); + throw new Error("provider failed after tool"); + }, + ); + + await expect( + dispatchReplyFromConfig({ + ctx, + cfg: emptyConfig, + dispatcher: firstDispatcher, + replyResolver, + }), + ).rejects.toThrow("provider failed after tool"); + + await dispatchReplyFromConfig({ + ctx, + cfg: emptyConfig, + dispatcher: createDispatcher(), + replyResolver, + }); + + expect(firstDispatcher.sendToolResult).not.toHaveBeenCalled(); + expect(replyResolver).toHaveBeenCalledTimes(1); + }); + it("passes configOverride to replyResolver when provided", async () => { setNoAbort(); const cfg = emptyConfig; diff --git a/src/auto-reply/reply/dispatch-from-config.ts b/src/auto-reply/reply/dispatch-from-config.ts index 9e48a73367d..ccd05fb9c1f 100644 --- a/src/auto-reply/reply/dispatch-from-config.ts +++ b/src/auto-reply/reply/dispatch-from-config.ts @@ -343,6 +343,10 @@ export async function dispatchReplyFromConfig( recordProcessed("skipped", { reason: "duplicate" }); return { queuedFinal: false, counts: dispatcher.getQueuedCounts() }; } + let inboundDedupeReplayUnsafe = false; + const markInboundDedupeReplayUnsafe = () => { + inboundDedupeReplayUnsafe = true; + }; const initialSessionStoreEntry = resolveSessionStoreLookup(ctx, cfg); const boundAcpDispatchSessionKey = resolveBoundAcpDispatchSessionKey({ ctx, cfg }); @@ -473,6 +477,7 @@ export async function dispatchReplyFromConfig( if (!shouldRouteToOriginating || !routeReplyChannel || !routeReplyTo || !routeReplyRuntime) { return null; } + markInboundDedupeReplayUnsafe(); return await routeReplyRuntime.routeReply({ payload, channel: routeReplyChannel, @@ -538,6 +543,7 @@ export async function dispatchReplyFromConfig( } return result.ok; } + markInboundDedupeReplayUnsafe(); return mode === "additive" ? dispatcher.sendToolResult(payload) : dispatcher.sendFinalReply(payload); @@ -721,6 +727,7 @@ export async function dispatchReplyFromConfig( ); } } else { + markInboundDedupeReplayUnsafe(); queuedFinal = dispatcher.sendFinalReply(payload); } } else { @@ -744,6 +751,9 @@ export async function dispatchReplyFromConfig( const sendFinalPayload = async ( payload: ReplyPayload, ): Promise<{ queuedFinal: boolean; routedFinalCount: number }> => { + if (resolveSendableOutboundReplyParts(payload).hasContent) { + markInboundDedupeReplayUnsafe(); + } const ttsPayload = await maybeApplyTtsToReplyPayload({ payload, cfg, @@ -767,6 +777,7 @@ export async function dispatchReplyFromConfig( routedFinalCount: result.ok ? 1 : 0, }; } + markInboundDedupeReplayUnsafe(); return { queuedFinal: dispatcher.sendFinalReply(normalizedPayload), routedFinalCount: 0, @@ -898,6 +909,7 @@ export async function dispatchReplyFromConfig( await sendPayloadAsync(payload, undefined, false); return; } + markInboundDedupeReplayUnsafe(); dispatcher.sendToolResult(payload); }; const sendPlanUpdate = async (payload: { @@ -914,6 +926,7 @@ export async function dispatchReplyFromConfig( await sendPayloadAsync(replyPayload, undefined, false); return; } + markInboundDedupeReplayUnsafe(); dispatcher.sendToolResult(replyPayload); }; const summarizeApprovalLabel = (payload: { @@ -1019,6 +1032,7 @@ export async function dispatchReplyFromConfig( suppressTyping: typing.suppressTyping, onToolResult: (payload: ReplyPayload) => { const run = async () => { + markInboundDedupeReplayUnsafe(); await onToolResultFromReplyOptions?.(payload); if (suppressDelivery) { return; @@ -1055,12 +1069,14 @@ export async function dispatchReplyFromConfig( if (shouldRouteToOriginating) { await sendPayloadAsync(deliveryPayload, undefined, false); } else { + markInboundDedupeReplayUnsafe(); dispatcher.sendToolResult(deliveryPayload); } }; return run(); }, onPlanUpdate: async (payload) => { + markInboundDedupeReplayUnsafe(); await onPlanUpdateFromReplyOptions?.(payload); if (payload.phase !== "update" || suppressDefaultToolProgressMessages) { return; @@ -1068,6 +1084,7 @@ export async function dispatchReplyFromConfig( await sendPlanUpdate({ explanation: payload.explanation, steps: payload.steps }); }, onApprovalEvent: async (payload) => { + markInboundDedupeReplayUnsafe(); await onApprovalEventFromReplyOptions?.(payload); if (payload.phase !== "requested" || suppressDefaultToolProgressMessages) { return; @@ -1083,6 +1100,7 @@ export async function dispatchReplyFromConfig( await maybeSendWorkingStatus(label); }, onPatchSummary: async (payload) => { + markInboundDedupeReplayUnsafe(); await onPatchSummaryFromReplyOptions?.(payload); if (payload.phase !== "end" || suppressDefaultToolProgressMessages) { return; @@ -1095,6 +1113,12 @@ export async function dispatchReplyFromConfig( }, onBlockReply: (payload: ReplyPayload, context?: BlockReplyContext) => { const run = async () => { + if ( + payload.isReasoning !== true && + resolveSendableOutboundReplyParts(payload).hasContent + ) { + markInboundDedupeReplayUnsafe(); + } if (suppressDelivery) { return; } @@ -1156,6 +1180,7 @@ export async function dispatchReplyFromConfig( if (shouldRouteToOriginating) { await sendPayloadAsync(normalizedPayload, context?.abortSignal, false); } else { + markInboundDedupeReplayUnsafe(); dispatcher.sendBlockReply(normalizedPayload); } }; @@ -1268,6 +1293,7 @@ export async function dispatchReplyFromConfig( ); } } else { + markInboundDedupeReplayUnsafe(); const didQueue = dispatcher.sendFinalReply(normalizedTtsOnlyPayload); queuedFinal = didQueue || queuedFinal; } @@ -1293,7 +1319,11 @@ export async function dispatchReplyFromConfig( return { queuedFinal, counts }; } catch (err) { if (inboundDedupeClaim.status === "claimed") { - releaseInboundDedupe(inboundDedupeClaim.key); + if (inboundDedupeReplayUnsafe) { + commitInboundDedupe(inboundDedupeClaim.key); + } else { + releaseInboundDedupe(inboundDedupeClaim.key); + } } recordProcessed("error", { error: String(err) }); markIdle("message_error"); diff --git a/src/auto-reply/reply/inbound-dedupe.test.ts b/src/auto-reply/reply/inbound-dedupe.test.ts index f73a8a9edb6..ba6d029a0aa 100644 --- a/src/auto-reply/reply/inbound-dedupe.test.ts +++ b/src/auto-reply/reply/inbound-dedupe.test.ts @@ -72,4 +72,33 @@ describe("inbound dedupe", () => { inboundB.resetInboundDedupe(); } }); + + it("shares claim/commit state across distinct module instances", async () => { + const inboundA = await importFreshModule( + import.meta.url, + "./inbound-dedupe.js?scope=commit-a", + ); + const inboundB = await importFreshModule( + import.meta.url, + "./inbound-dedupe.js?scope=commit-b", + ); + + inboundA.resetInboundDedupe(); + inboundB.resetInboundDedupe(); + + try { + const firstClaim = inboundA.claimInboundDedupe(sharedInboundContext); + expect(firstClaim).toMatchObject({ status: "claimed" }); + if (firstClaim.status !== "claimed") { + throw new Error("expected claimed inbound dedupe result"); + } + inboundA.commitInboundDedupe(firstClaim.key); + expect(inboundB.claimInboundDedupe(sharedInboundContext)).toMatchObject({ + status: "duplicate", + }); + } finally { + inboundA.resetInboundDedupe(); + inboundB.resetInboundDedupe(); + } + }); }); From 6b6dcafcee9ca86385b7c1ee2442752314d50257 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 10:58:24 -0700 Subject: [PATCH 003/418] fix(webchat): support non-image file attachments --- CHANGELOG.md | 1 + docs/web/control-ui.md | 1 + src/gateway/chat-attachments.test.ts | 60 ++++++++++- src/gateway/chat-attachments.ts | 66 +++++++++++- .../chat.directive-tags.test.ts | 65 +++++++++++ src/media/store.test.ts | 25 ++++- src/media/store.ts | 11 +- ui/src/styles/chat/layout.css | 31 +++++- ui/src/ui/chat/attachment-support.ts | 13 ++- ui/src/ui/chat/grouped-render.test.ts | 7 +- ui/src/ui/chat/grouped-render.ts | 102 ++++++++++++++---- ui/src/ui/controllers/chat.test.ts | 47 ++++++++ ui/src/ui/controllers/chat.ts | 31 +++++- ui/src/ui/ui-types.ts | 1 + ui/src/ui/views/chat.test.ts | 47 ++++++++ ui/src/ui/views/chat.ts | 57 ++++++---- 16 files changed, 505 insertions(+), 60 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 75a8c6579ce..4678b085f7e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,6 +15,7 @@ Docs: https://docs.openclaw.ai - Plugins/CLI: refresh the persisted registry after managed plugin files are removed so ClawHub uninstall cannot leave stale `plugins list` entries. Thanks @codex. - Plugins/CLI: make plugin install and uninstall config writes conflict-aware, clear stale denylist entries on explicit reinstall/removal, and delete managed plugin files only after config/index commit succeeds. Thanks @codex. - Plugins: fail `plugins update` when tracked plugin or hook updates error, keep bundled runtime-dependency repair behind restrictive allowlists, and reject package installs with unloadable extension entries. Thanks @codex. +- WebChat/Control UI: support non-video file attachments in chat uploads while preserving the existing image attachment path and MIME-sniff fallback for generic image uploads. (#70947) Thanks @IAMSamuelRodda. - Gateway/chat: keep duplicate attachment-backed `chat.send` retries with the same idempotency key on the documented in-flight path so aborts still target the real active run. Fixes #70139. Thanks @Feelw00. - Plugins: share package entrypoint resolution between install and discovery, reject mismatched `runtimeExtensions`, and cache bundled runtime-dependency manifest reads during scans. Thanks @codex. - WhatsApp/Web: keep quiet but healthy linked-device sessions connected by basing the watchdog on WhatsApp Web transport activity, while retaining a longer app-silence cap so frame activity cannot mask a stuck session forever. Fixes #70678; carries forward the focused #71466 approach and keeps #63939 as related configurable-timeout follow-up. Thanks @vincentkoc and @oromeis. diff --git a/docs/web/control-ui.md b/docs/web/control-ui.md index aa2e6609c67..2964d318c34 100644 --- a/docs/web/control-ui.md +++ b/docs/web/control-ui.md @@ -134,6 +134,7 @@ The Control UI can localize itself on first load based on your browser locale. T - `chat.send` is **non-blocking**: it acks immediately with `{ runId, status: "started" }` and the response streams via `chat` events. + - Chat uploads accept images plus non-video files. Images keep the native image path; other files are stored as managed media and shown in history as attachment links. - Re-sending with the same `idempotencyKey` returns `{ status: "in_flight" }` while running, and `{ status: "ok" }` after completion. - `chat.history` responses are size-bounded for UI safety. When transcript entries are too large, Gateway may truncate long text fields, omit heavy metadata blocks, and replace oversized messages with a placeholder (`[chat.history omitted: message too large]`). - Assistant/generated images are persisted as managed media references and served back through authenticated Gateway media URLs, so reloads do not depend on raw base64 image payloads staying in the chat history response. diff --git a/src/gateway/chat-attachments.test.ts b/src/gateway/chat-attachments.test.ts index 2af2fa040d9..c7920754ab8 100644 --- a/src/gateway/chat-attachments.test.ts +++ b/src/gateway/chat-attachments.test.ts @@ -111,14 +111,23 @@ describe("parseMessageWithAttachments", () => { expect(logs[0]).toMatch(/mime mismatch/i); }); - it("drops unknown mime when sniff fails and logs", async () => { + it("persists unknown non-image files when sniff fails", async () => { const unknown = Buffer.from("not an image").toString("base64"); const { parsed, logs } = await parseWithWarnings("x", [ { type: "file", fileName: "unknown.bin", content: unknown }, ]); - expect(parsed.images).toHaveLength(0); - expect(logs).toHaveLength(1); - expect(logs[0]).toMatch(/unable to detect image mime type/i); + try { + expect(parsed.images).toHaveLength(0); + expect(parsed.offloadedRefs).toHaveLength(1); + expect(parsed.offloadedRefs[0]).toMatchObject({ + label: "unknown.bin", + mimeType: "application/octet-stream", + }); + expect(parsed.message).toMatch(/^x\n\[media attached: media:\/\/inbound\//); + expect(logs).toHaveLength(0); + } finally { + await cleanupOffloadedRefs(parsed.offloadedRefs); + } }); it("keeps valid images and drops invalid ones", async () => { @@ -143,6 +152,49 @@ describe("parseMessageWithAttachments", () => { expect(logs.some((l) => /non-image/i.test(l))).toBe(true); }); + it("persists non-image file attachments as media refs", async () => { + const parsed = await parseMessageWithAttachments( + "read this", + [ + { + type: "file", + mimeType: "application/pdf", + fileName: "brief.pdf", + content: Buffer.from("%PDF-1.4\n").toString("base64"), + }, + ], + { log: { warn: () => {} } }, + ); + + try { + expect(parsed.images).toHaveLength(0); + expect(parsed.imageOrder).toEqual(["offloaded"]); + expect(parsed.offloadedRefs).toHaveLength(1); + expect(parsed.offloadedRefs[0]).toMatchObject({ + mimeType: "application/pdf", + label: "brief.pdf", + }); + expect(parsed.message).toMatch(/^read this\n\[media attached: media:\/\/inbound\//); + } finally { + await cleanupOffloadedRefs(parsed.offloadedRefs); + } + }); + + it("keeps image sniff fallback for generic image attachments", async () => { + const { parsed, logs } = await parseWithWarnings("see this", [ + { + type: "file", + mimeType: "application/octet-stream", + fileName: "dot", + content: PNG_1x1, + }, + ]); + expect(parsed.images).toHaveLength(1); + expect(parsed.images[0]?.mimeType).toBe("image/png"); + expect(parsed.offloadedRefs).toHaveLength(0); + expect(logs).toHaveLength(0); + }); + it("offloads images for text-only models instead of dropping them", async () => { const logs: string[] = []; const infos: string[] = []; diff --git a/src/gateway/chat-attachments.ts b/src/gateway/chat-attachments.ts index 79b86f09851..6a90d1e1798 100644 --- a/src/gateway/chat-attachments.ts +++ b/src/gateway/chat-attachments.ts @@ -142,6 +142,19 @@ function isImageMime(mime?: string): boolean { return typeof mime === "string" && mime.startsWith("image/"); } +function isVideoMime(mime?: string): boolean { + return typeof mime === "string" && mime.startsWith("video/"); +} + +function isGenericMime(mime?: string): boolean { + return ( + !mime || + mime === "application/octet-stream" || + mime === "binary/octet-stream" || + mime === "application/unknown" + ); +} + function isValidBase64(value: string): boolean { if (value.length === 0 || value.length % 4 !== 0) { return false; @@ -307,6 +320,7 @@ export async function parseMessageWithAttachments( const offloadedRefs: OffloadedRef[] = []; let updatedMessage = message; const shouldForceOffload = opts?.supportsImages === false; + let textOnlyImageOffloadCount = 0; // Track IDs of files saved during this request for cleanup if a later // attachment fails validation and the entire parse is aborted. @@ -344,15 +358,54 @@ export async function parseMessageWithAttachments( const providedMime = normalizeMime(mime); const sniffedMime = normalizeMime(await sniffMimeFromBase64(b64)); - if (sniffedMime && !isImageMime(sniffedMime)) { + if (sniffedMime && !isImageMime(sniffedMime) && isImageMime(providedMime)) { log?.warn(`attachment ${label}: detected non-image (${sniffedMime}), dropping`); continue; } - if (!sniffedMime && !isImageMime(providedMime)) { - log?.warn(`attachment ${label}: unable to detect image mime type, dropping`); + + const shouldHandleAsImage = + isImageMime(sniffedMime) || (isImageMime(providedMime) && !sniffedMime); + if (!shouldHandleAsImage) { + const finalMime = sniffedMime ?? providedMime ?? "application/octet-stream"; + if (isVideoMime(finalMime)) { + log?.warn(`attachment ${label}: video attachments are not supported, dropping`); + continue; + } + + const buffer = Buffer.from(b64, "base64"); + verifyDecodedSize(buffer, sizeBytes, label); + + try { + const rawResult = await saveMediaBuffer(buffer, finalMime, "inbound", maxBytes, label); + const savedMedia = assertSavedMedia(rawResult, label); + savedMediaIds.push(savedMedia.id); + + const mediaRef = `media://inbound/${savedMedia.id}`; + updatedMessage += `\n[media attached: ${mediaRef}]`; + log?.info?.(`[Gateway] Saved file attachment. Saved: ${mediaRef}`); + offloadedRefs.push({ + mediaRef, + id: savedMedia.id, + path: savedMedia.path ?? "", + mimeType: finalMime, + label, + }); + imageOrder.push("offloaded"); + } catch (err) { + const errorMessage = formatErrorMessage(err); + throw new MediaOffloadError( + `[Gateway Error] Failed to save intercepted media to disk: ${errorMessage}`, + { cause: err }, + ); + } continue; } - if (sniffedMime && providedMime && sniffedMime !== providedMime) { + if ( + sniffedMime && + providedMime && + !isGenericMime(providedMime) && + sniffedMime !== providedMime + ) { log?.warn( `attachment ${label}: mime mismatch (${providedMime} -> ${sniffedMime}), using sniffed`, ); @@ -364,7 +417,7 @@ export async function parseMessageWithAttachments( let isOffloaded = false; - if (shouldForceOffload && offloadedRefs.length >= TEXT_ONLY_OFFLOAD_LIMIT) { + if (shouldForceOffload && textOnlyImageOffloadCount >= TEXT_ONLY_OFFLOAD_LIMIT) { log?.warn( `attachment ${label}: dropping image because text-only offload limit ` + `${TEXT_ONLY_OFFLOAD_LIMIT} was reached`, @@ -437,6 +490,9 @@ export async function parseMessageWithAttachments( label, }); imageOrder.push("offloaded"); + if (shouldForceOffload) { + textOnlyImageOffloadCount++; + } isOffloaded = true; } catch (err) { diff --git a/src/gateway/server-methods/chat.directive-tags.test.ts b/src/gateway/server-methods/chat.directive-tags.test.ts index ed78955c645..e7dacc03d0a 100644 --- a/src/gateway/server-methods/chat.directive-tags.test.ts +++ b/src/gateway/server-methods/chat.directive-tags.test.ts @@ -1789,6 +1789,71 @@ describe("chat directive tag stripping for non-streaming final payloads", () => }); }); + it("persists non-image chat.send attachments as media refs without dispatch images", async () => { + createTranscriptFixture("openclaw-chat-send-user-transcript-file-"); + mockState.finalText = "ok"; + mockState.triggerAgentRunStart = true; + mockState.savedMediaResults = [ + { path: "/tmp/chat-send-brief.pdf", contentType: "application/pdf" }, + ]; + const respond = vi.fn(); + const context = createChatContext(); + + await runNonStreamingChatSend({ + context, + respond, + idempotencyKey: "idem-user-transcript-file", + message: "summarize this", + requestParams: { + attachments: [ + { + type: "file", + mimeType: "application/pdf", + fileName: "brief.pdf", + content: Buffer.from("%PDF-1.4\n").toString("base64"), + }, + ], + }, + expectBroadcast: false, + waitForCompletion: false, + }); + + await waitForAssertion(() => { + const userUpdate = mockState.emittedTranscriptUpdates.find( + (update) => + typeof update.message === "object" && + update.message !== null && + (update.message as { role?: unknown }).role === "user", + ); + const message = userUpdate?.message as + | { + content?: unknown; + MediaPath?: string; + MediaPaths?: string[]; + MediaType?: string; + MediaTypes?: string[]; + } + | undefined; + expect(mockState.lastDispatchImages).toBeUndefined(); + expect(mockState.lastDispatchImageOrder).toEqual(["offloaded"]); + expect(mockState.lastDispatchCtx?.Body).toMatch( + /^summarize this\n\[media attached: media:\/\/inbound\//, + ); + expect(mockState.savedMediaCalls).toEqual([ + expect.objectContaining({ + contentType: "application/pdf", + subdir: "inbound", + size: expect.any(Number), + }), + ]); + expect(message?.content).toMatch(/^summarize this\n\[media attached: media:\/\/inbound\//); + expect(message?.MediaPath).toBe("/tmp/chat-send-brief.pdf"); + expect(message?.MediaPaths).toEqual(["/tmp/chat-send-brief.pdf"]); + expect(message?.MediaType).toBe("application/pdf"); + expect(message?.MediaTypes).toEqual(["application/pdf"]); + }); + }); + it("preserves offloaded attachment media paths in transcript order", async () => { createTranscriptFixture("openclaw-chat-send-user-transcript-offloaded-"); mockState.finalText = "ok"; diff --git a/src/media/store.test.ts b/src/media/store.test.ts index 9c70f208c9e..9334a74c500 100644 --- a/src/media/store.test.ts +++ b/src/media/store.test.ts @@ -157,6 +157,7 @@ describe("media store", () => { async function expectSavedBufferCase(params: { buffer: Buffer; contentType?: string; + originalFilename?: string; expectedContentType: string; expectedExtension: string; assertSaved?: ( @@ -165,7 +166,13 @@ describe("media store", () => { ) => Promise | void; }) { await withTempStore(async (store) => { - const saved = await store.saveMediaBuffer(params.buffer, params.contentType); + const saved = await store.saveMediaBuffer( + params.buffer, + params.contentType, + "inbound", + 5 * 1024 * 1024, + params.originalFilename, + ); expect(saved.contentType).toBe(params.expectedContentType); expect(saved.path.endsWith(params.expectedExtension)).toBe(true); await params.assertSaved?.(saved, params.buffer); @@ -371,6 +378,14 @@ describe("media store", () => { expectedContentType: "image/jpeg", expectedExtension: ".jpg", }, + { + name: "preserves original extension for generic file buffers", + buffer: Buffer.from("custom binary"), + contentType: "application/octet-stream", + originalFilename: "report.custom", + expectedContentType: "application/octet-stream", + expectedExtension: ".custom", + }, ] as const)("$name", async (testCase) => { const buffer = "bufferFactory" in testCase && testCase.bufferFactory @@ -379,8 +394,16 @@ describe("media store", () => { await expectSavedBufferCase({ buffer, contentType: testCase.contentType, + ...("originalFilename" in testCase ? { originalFilename: testCase.originalFilename } : {}), expectedContentType: testCase.expectedContentType, expectedExtension: testCase.expectedExtension, + ...("originalFilename" in testCase + ? { + assertSaved: async (saved: Awaited>) => { + expect(path.basename(saved.path)).toMatch(/^report---.+\.custom$/); + }, + } + : {}), ...("assertSaved" in testCase ? { assertSaved: testCase.assertSaved } : {}), }); }); diff --git a/src/media/store.ts b/src/media/store.ts index f643e51f0b8..4c6a66a4b4a 100644 --- a/src/media/store.ts +++ b/src/media/store.ts @@ -284,6 +284,14 @@ function buildSavedMediaId(params: { : `${params.baseId}${params.ext}`; } +function safeOriginalFilenameExtension(originalFilename?: string): string | undefined { + if (!originalFilename) { + return undefined; + } + const ext = path.extname(originalFilename).toLowerCase(); + return /^\.[a-z0-9]{1,16}$/.test(ext) ? ext : undefined; +} + function buildSavedMediaResult(params: { dir: string; id: string; @@ -419,7 +427,8 @@ export async function saveMediaBuffer( const uuid = crypto.randomUUID(); const headerExt = extensionForMime(normalizeOptionalString(contentType?.split(";")[0])); const mime = await detectMime({ buffer, headerMime: contentType }); - const ext = headerExt ?? extensionForMime(mime) ?? ""; + const ext = + headerExt ?? extensionForMime(mime) ?? safeOriginalFilenameExtension(originalFilename) ?? ""; const id = buildSavedMediaId({ baseId: uuid, ext, originalFilename }); await writeSavedMediaBuffer({ dir, id, buffer }); return buildSavedMediaResult({ dir, id, size: buffer.byteLength, contentType: mime }); diff --git a/ui/src/styles/chat/layout.css b/ui/src/styles/chat/layout.css index aa272cc7579..0ab920ec8fc 100644 --- a/ui/src/styles/chat/layout.css +++ b/ui/src/styles/chat/layout.css @@ -947,6 +947,10 @@ border: 1px solid var(--border); } +.chat-attachment-thumb--file { + width: 180px; +} + .chat-attachment-thumb img { width: 100%; height: 100%; @@ -974,13 +978,32 @@ .chat-attachment-file { display: flex; align-items: center; - gap: 4px; - padding: 4px; + gap: 8px; + width: 100%; + height: 100%; + padding: 8px 34px 8px 10px; + overflow: hidden; + font-size: 0.72rem; + color: var(--text); + background: var(--panel); +} + +.chat-attachment-file__icon { + display: inline-flex; + flex: 0 0 auto; + color: var(--muted); +} + +.chat-attachment-file__icon svg { + width: 16px; + height: 16px; +} + +.chat-attachment-file__name { + min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; - font-size: 0.72rem; - color: var(--muted); } .agent-chat__file-input { diff --git a/ui/src/ui/chat/attachment-support.ts b/ui/src/ui/chat/attachment-support.ts index 70deb1b4743..21b9ba951da 100644 --- a/ui/src/ui/chat/attachment-support.ts +++ b/ui/src/ui/chat/attachment-support.ts @@ -1,5 +1,14 @@ -export const CHAT_ATTACHMENT_ACCEPT = "image/*"; +export const CHAT_ATTACHMENT_ACCEPT = + "image/*,audio/*,application/pdf,text/*,.csv,.json,.md,.txt,.zip," + + ".doc,.docx,.xls,.xlsx,.ppt,.pptx"; export function isSupportedChatAttachmentMimeType(mimeType: string | null | undefined): boolean { - return typeof mimeType === "string" && mimeType.startsWith("image/"); + return typeof mimeType === "string" && !mimeType.startsWith("video/"); +} + +export function isSupportedChatAttachmentFile(file: Pick): boolean { + if (file.type.startsWith("video/")) { + return false; + } + return !/\.(?:avi|m4v|mov|mp4|mpeg|mpg|webm)$/i.test(file.name); } diff --git a/ui/src/ui/chat/grouped-render.test.ts b/ui/src/ui/chat/grouped-render.test.ts index 28c962f6560..67a116707ba 100644 --- a/ui/src/ui/chat/grouped-render.test.ts +++ b/ui/src/ui/chat/grouped-render.test.ts @@ -722,11 +722,16 @@ describe("grouped chat rendering", () => { id: "user-history-document", role: "user", content: "", - MediaPath: "/tmp/openclaw/user-upload.pdf", + MediaPath: "/__openclaw__/media/user-upload.pdf", MediaType: "application/pdf", timestamp: Date.now(), }); expect(container.querySelector(".chat-message-image")).toBeNull(); + const documentLink = container.querySelector( + ".chat-assistant-attachment-card__link", + ); + expect(documentLink?.textContent).toContain("user-upload.pdf"); + expect(documentLink?.getAttribute("href")).toBe("/__openclaw__/media/user-upload.pdf"); }); it("fetches managed chat images with auth and renders blob previews", async () => { diff --git a/ui/src/ui/chat/grouped-render.ts b/ui/src/ui/chat/grouped-render.ts index 4e9e59309eb..0630558b68b 100644 --- a/ui/src/ui/chat/grouped-render.ts +++ b/ui/src/ui/chat/grouped-render.ts @@ -118,6 +118,8 @@ type RenderableImageBlock = ImageBlock & { displayUrl: string; }; +type AttachmentItem = Extract; + const managedImageBlobUrlCache = new Map>(); const managedImageBlobUrlResolvedCache = new Map(); const managedImageBlobUrlMissCache = new Map(); @@ -169,6 +171,56 @@ function isImageTranscriptMediaPath(path: string, mediaType: unknown): boolean { ); } +function isAudioTranscriptMediaPath(path: string, mediaType: unknown): boolean { + if (typeof mediaType === "string" && mediaType.trim().toLowerCase().startsWith("audio/")) { + return true; + } + const ext = getFileExtension(path); + return ( + ext !== undefined && ["aac", "flac", "m4a", "mp3", "oga", "ogg", "opus", "wav"].includes(ext) + ); +} + +function isVideoTranscriptMediaPath(path: string, mediaType: unknown): boolean { + if (typeof mediaType === "string" && mediaType.trim().toLowerCase().startsWith("video/")) { + return true; + } + const ext = getFileExtension(path); + return ext !== undefined && ["m4v", "mov", "mp4", "webm"].includes(ext); +} + +function labelForMediaPath(mediaPath: string): string { + const trimmed = mediaPath.trim(); + try { + if (/^https?:\/\//i.test(trimmed)) { + const parsed = new URL(trimmed); + return parsed.pathname.split("/").pop()?.trim() || parsed.hostname || trimmed; + } + } catch {} + return trimmed.split(/[\\/]/).pop()?.trim() || trimmed; +} + +function extractTranscriptMediaEntries(message: unknown): Array<{ + path: string; + mediaType: unknown; +}> { + const m = message as Record; + const transcriptMediaPaths = Array.isArray(m.MediaPaths) + ? m.MediaPaths.filter((value): value is string => typeof value === "string") + : typeof m.MediaPath === "string" + ? [m.MediaPath] + : []; + const transcriptMediaTypes = Array.isArray(m.MediaTypes) + ? m.MediaTypes + : typeof m.MediaType === "string" + ? [m.MediaType] + : []; + return transcriptMediaPaths.map((mediaPath, index) => ({ + path: mediaPath, + mediaType: transcriptMediaTypes[index], + })); +} + function extractImages(message: unknown): ImageBlock[] { const m = message as Record; const content = m.content; @@ -232,18 +284,8 @@ function extractImages(message: unknown): ImageBlock[] { } } - const transcriptMediaPaths = Array.isArray(m.MediaPaths) - ? m.MediaPaths.filter((value): value is string => typeof value === "string") - : typeof m.MediaPath === "string" - ? [m.MediaPath] - : []; - const transcriptMediaTypes = Array.isArray(m.MediaTypes) - ? m.MediaTypes - : typeof m.MediaType === "string" - ? [m.MediaType] - : []; - for (const [index, mediaPath] of transcriptMediaPaths.entries()) { - if (!isImageTranscriptMediaPath(mediaPath, transcriptMediaTypes[index])) { + for (const { path: mediaPath, mediaType } of extractTranscriptMediaEntries(message)) { + if (!isImageTranscriptMediaPath(mediaPath, mediaType)) { continue; } appendImageBlock(images, { url: mediaPath }); @@ -252,6 +294,30 @@ function extractImages(message: unknown): ImageBlock[] { return images; } +function extractTranscriptAttachments(message: unknown): AttachmentItem[] { + const attachments: AttachmentItem[] = []; + for (const { path: mediaPath, mediaType } of extractTranscriptMediaEntries(message)) { + if (isImageTranscriptMediaPath(mediaPath, mediaType)) { + continue; + } + const kind = isAudioTranscriptMediaPath(mediaPath, mediaType) + ? "audio" + : isVideoTranscriptMediaPath(mediaPath, mediaType) + ? "video" + : "document"; + attachments.push({ + type: "attachment", + attachment: { + url: mediaPath, + kind, + label: labelForMediaPath(mediaPath), + ...(typeof mediaType === "string" ? { mimeType: mediaType } : {}), + }, + }); + } + return attachments; +} + export function renderReadingIndicatorGroup( assistant?: AssistantIdentity, basePath?: string, @@ -1042,7 +1108,7 @@ function renderAssistantAttachmentStatusCard(params: { } function renderAssistantAttachments( - attachments: Array>, + attachments: AttachmentItem[], localMediaPreviewRoots: readonly string[], basePath?: string, authToken?: string | null, @@ -1296,9 +1362,9 @@ function renderGroupedMessage( .join("\n") .trim(); const assistantAttachments = normalizedMessage.content.filter( - (item): item is Extract => - item.type === "attachment", + (item): item is AttachmentItem => item.type === "attachment", ); + const visibleAttachments = [...assistantAttachments, ...extractTranscriptAttachments(message)]; const assistantViewBlocks = normalizedMessage.content.filter( (item): item is Extract => item.type === "canvas", ); @@ -1329,7 +1395,7 @@ function renderGroupedMessage( !markdown && !visibleToolCards && !hasImages && - assistantAttachments.length === 0 && + visibleAttachments.length === 0 && assistantViewBlocks.length === 0 && !normalizedMessage.replyTarget ) { @@ -1390,7 +1456,7 @@ function renderGroupedMessage(
${renderMessageImages(images, imageRenderOptions)} ${renderAssistantAttachments( - assistantAttachments, + visibleAttachments, opts.localMediaPreviewRoots ?? [], opts.basePath, opts.assistantAttachmentAuthToken, @@ -1446,7 +1512,7 @@ function renderGroupedMessage( : html` ${renderMessageImages(images, imageRenderOptions)} ${renderAssistantAttachments( - assistantAttachments, + visibleAttachments, opts.localMediaPreviewRoots ?? [], opts.basePath, opts.assistantAttachmentAuthToken, diff --git a/ui/src/ui/controllers/chat.test.ts b/ui/src/ui/controllers/chat.test.ts index beb2fe1d745..3c0017cb4fd 100644 --- a/ui/src/ui/controllers/chat.test.ts +++ b/ui/src/ui/controllers/chat.test.ts @@ -624,6 +624,53 @@ describe("loadChatHistory", () => { }); describe("sendChatMessage", () => { + it("serializes non-image chat attachments as files", async () => { + const request = vi.fn().mockResolvedValue({ runId: "run-1", status: "started" }); + const state = createState({ + connected: true, + client: { request } as unknown as ChatState["client"], + }); + + const result = await sendChatMessage(state, "summarize", [ + { + id: "att-1", + dataUrl: `data:application/pdf;base64,${Buffer.from("%PDF-1.4\n").toString("base64")}`, + mimeType: "application/pdf", + fileName: "brief.pdf", + }, + ]); + + expect(result).toEqual(expect.any(String)); + expect(request).toHaveBeenCalledWith( + "chat.send", + expect.objectContaining({ + message: "summarize", + attachments: [ + { + type: "file", + mimeType: "application/pdf", + fileName: "brief.pdf", + content: Buffer.from("%PDF-1.4\n").toString("base64"), + }, + ], + }), + ); + expect(state.chatMessages[0]).toMatchObject({ + role: "user", + content: [ + { type: "text", text: "summarize" }, + { + type: "attachment", + attachment: { + kind: "document", + label: "brief.pdf", + mimeType: "application/pdf", + }, + }, + ], + }); + }); + it("formats structured non-auth connect failures for chat send", async () => { const request = vi.fn().mockRejectedValue( new GatewayRequestError({ diff --git a/ui/src/ui/controllers/chat.ts b/ui/src/ui/controllers/chat.ts index 5c29ae51944..862183d3abf 100644 --- a/ui/src/ui/controllers/chat.ts +++ b/ui/src/ui/controllers/chat.ts @@ -456,8 +456,9 @@ function buildApiAttachments(attachments?: ChatAttachment[]) { return null; } return { - type: "image", + type: parsed.mimeType.startsWith("image/") ? "image" : "file", mimeType: parsed.mimeType, + fileName: att.fileName, content: parsed.content, }; }) @@ -544,16 +545,38 @@ export async function sendChatMessage( const now = Date.now(); // Build user message content blocks - const contentBlocks: Array<{ type: string; text?: string; source?: unknown }> = []; + const contentBlocks: Array<{ + type: string; + text?: string; + source?: unknown; + attachment?: { + url: string; + kind: "audio" | "document"; + label: string; + mimeType?: string; + }; + }> = []; if (msg) { contentBlocks.push({ type: "text", text: msg }); } // Add image previews to the message for display if (hasAttachments) { for (const att of attachments) { + if (att.mimeType.startsWith("image/")) { + contentBlocks.push({ + type: "image", + source: { type: "base64", media_type: att.mimeType, data: att.dataUrl }, + }); + continue; + } contentBlocks.push({ - type: "image", - source: { type: "base64", media_type: att.mimeType, data: att.dataUrl }, + type: "attachment", + attachment: { + url: att.dataUrl, + kind: att.mimeType.startsWith("audio/") ? "audio" : "document", + label: att.fileName?.trim() || "Attached file", + mimeType: att.mimeType, + }, }); } } diff --git a/ui/src/ui/ui-types.ts b/ui/src/ui/ui-types.ts index 9fe1ce33fb9..c13f0123b0e 100644 --- a/ui/src/ui/ui-types.ts +++ b/ui/src/ui/ui-types.ts @@ -2,6 +2,7 @@ export type ChatAttachment = { id: string; dataUrl: string; mimeType: string; + fileName?: string; }; export type ChatQueueItem = { diff --git a/ui/src/ui/views/chat.test.ts b/ui/src/ui/views/chat.test.ts index 8bcc1564813..3a62433f1cd 100644 --- a/ui/src/ui/views/chat.test.ts +++ b/ui/src/ui/views/chat.test.ts @@ -432,6 +432,53 @@ describe("chat loading skeleton", () => { }); }); +describe("chat attachment picker", () => { + it("accepts and previews non-video file attachments", async () => { + const onAttachmentsChange = vi.fn(); + const container = renderChatView({ onAttachmentsChange }); + const input = container.querySelector(".agent-chat__file-input"); + const file = new File(["%PDF-1.4\n"], "brief.pdf", { type: "application/pdf" }); + + expect(input).not.toBeNull(); + Object.defineProperty(input!, "files", { + configurable: true, + value: [file], + }); + input?.dispatchEvent(new Event("change", { bubbles: true })); + + await vi.waitFor(() => { + expect(onAttachmentsChange).toHaveBeenCalledWith([ + expect.objectContaining({ + dataUrl: expect.stringMatching(/^data:application\/pdf;base64,/), + fileName: "brief.pdf", + mimeType: "application/pdf", + }), + ]); + }); + + const nextAttachments = onAttachmentsChange.mock.calls[0]?.[0] ?? []; + const preview = renderChatView({ attachments: nextAttachments }); + expect(preview.querySelector(".chat-attachment-thumb--file")).not.toBeNull(); + expect(preview.textContent).toContain("brief.pdf"); + }); + + it("filters video file attachments", () => { + const onAttachmentsChange = vi.fn(); + const container = renderChatView({ onAttachmentsChange }); + const input = container.querySelector(".agent-chat__file-input"); + const file = new File(["video"], "clip.mp4", { type: "video/mp4" }); + + expect(input).not.toBeNull(); + Object.defineProperty(input!, "files", { + configurable: true, + value: [file], + }); + input?.dispatchEvent(new Event("change", { bubbles: true })); + + expect(onAttachmentsChange).not.toHaveBeenCalled(); + }); +}); + describe("chat queue", () => { it("renders Steer only for queued messages during an active run", () => { const onQueueSteer = vi.fn(); diff --git a/ui/src/ui/views/chat.ts b/ui/src/ui/views/chat.ts index 5580edf509c..625fa8df636 100644 --- a/ui/src/ui/views/chat.ts +++ b/ui/src/ui/views/chat.ts @@ -4,7 +4,7 @@ import { repeat } from "lit/directives/repeat.js"; import type { CompactionStatus, FallbackStatus } from "../app-tool-stream.ts"; import { CHAT_ATTACHMENT_ACCEPT, - isSupportedChatAttachmentMimeType, + isSupportedChatAttachmentFile, } from "../chat/attachment-support.ts"; import { buildChatItems } from "../chat/build-chat-items.ts"; import { renderChatQueue } from "../chat/chat-queue.ts"; @@ -205,6 +205,19 @@ function generateAttachmentId(): string { return `att-${Date.now()}-${Math.random().toString(36).slice(2, 9)}`; } +function chatAttachmentFromFile(file: File, dataUrl: string): ChatAttachment { + return { + id: generateAttachmentId(), + dataUrl, + mimeType: file.type || "application/octet-stream", + fileName: file.name || undefined, + }; +} + +function isImageAttachment(att: ChatAttachment): boolean { + return att.mimeType.startsWith("image/"); +} + function handlePaste(e: ClipboardEvent, props: ChatProps) { const items = e.clipboardData?.items; if (!items || !props.onAttachmentsChange) { @@ -229,11 +242,7 @@ function handlePaste(e: ClipboardEvent, props: ChatProps) { const reader = new FileReader(); reader.addEventListener("load", () => { const dataUrl = reader.result as string; - const newAttachment: ChatAttachment = { - id: generateAttachmentId(), - dataUrl, - mimeType: file.type, - }; + const newAttachment = chatAttachmentFromFile(file, dataUrl); const current = props.attachments ?? []; props.onAttachmentsChange?.([...current, newAttachment]); }); @@ -250,17 +259,13 @@ function handleFileSelect(e: Event, props: ChatProps) { const additions: ChatAttachment[] = []; let pending = 0; for (const file of input.files) { - if (!isSupportedChatAttachmentMimeType(file.type)) { + if (!isSupportedChatAttachmentFile(file)) { continue; } pending++; const reader = new FileReader(); reader.addEventListener("load", () => { - additions.push({ - id: generateAttachmentId(), - dataUrl: reader.result as string, - mimeType: file.type, - }); + additions.push(chatAttachmentFromFile(file, reader.result as string)); pending--; if (pending === 0) { props.onAttachmentsChange?.([...current, ...additions]); @@ -281,17 +286,13 @@ function handleDrop(e: DragEvent, props: ChatProps) { const additions: ChatAttachment[] = []; let pending = 0; for (const file of files) { - if (!isSupportedChatAttachmentMimeType(file.type)) { + if (!isSupportedChatAttachmentFile(file)) { continue; } pending++; const reader = new FileReader(); reader.addEventListener("load", () => { - additions.push({ - id: generateAttachmentId(), - dataUrl: reader.result as string, - mimeType: file.type, - }); + additions.push(chatAttachmentFromFile(file, reader.result as string)); pending--; if (pending === 0) { props.onAttachmentsChange?.([...current, ...additions]); @@ -310,8 +311,24 @@ function renderAttachmentPreview(props: ChatProps): TemplateResult | typeof noth
${attachments.map( (att) => html` -
- Attachment preview +
+ ${isImageAttachment(att) + ? html`Attachment preview` + : html` +
+ ${icons.paperclip} + ${att.fileName ?? "Attached file"} +
+ `}
` : grouped.map( ([category, groupedItems]) => html` -
- ${CATEGORY_LABELS[category] ?? category} -
+
${getCategoryLabel(category)}
${groupedItems.map((item) => { const globalIndex = items.indexOf(item); const isActive = globalIndex === props.activeIndex; @@ -273,9 +282,9 @@ export function renderCommandPalette(props: CommandPaletteProps) { )}
- ↑↓ navigate - ↵ select - esc close + ↑↓ ${t("overview.palette.footer.navigate")} + ↵ ${t("overview.palette.footer.select")} + esc ${t("overview.palette.footer.close")}
diff --git a/ui/src/ui/views/connect-command.ts b/ui/src/ui/views/connect-command.ts index a609577072e..bf4e27b77eb 100644 --- a/ui/src/ui/views/connect-command.ts +++ b/ui/src/ui/views/connect-command.ts @@ -1,4 +1,5 @@ import { html } from "lit"; +import { t } from "../../i18n/index.ts"; import { renderCopyButton } from "../chat/copy-as-markdown.ts"; async function copyCommand(command: string) { @@ -10,13 +11,14 @@ async function copyCommand(command: string) { } export function renderConnectCommand(command: string) { + const copyLabel = t("overview.connection.copyCommand"); return html` `; } From 5c4c33c7ded3afe04ed9a710ac13bb9a486ea008 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sun, 26 Apr 2026 22:01:03 +0000 Subject: [PATCH 053/418] chore(ui): refresh th control ui locale --- ui/src/i18n/locales/th.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ui/src/i18n/locales/th.ts b/ui/src/i18n/locales/th.ts index 0eee24989fe..6541c3d9391 100644 --- a/ui/src/i18n/locales/th.ts +++ b/ui/src/i18n/locales/th.ts @@ -580,7 +580,7 @@ export const th: TranslationMap = { total: "ทั้งหมด {count}", avg: "เฉลี่ย", all: "ทั้งหมด", - recent: "ดูล่าสุด", + recent: "ดูล่า��ุด", recentShort: "ล่าสุด", sort: "เรียงลำดับ", ascending: "น้อยไปมาก", From e8df081a1f1d8b7bd204072225b5262a7f724486 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 14:51:35 -0700 Subject: [PATCH 054/418] feat(logging): add file log correlation fields --- src/logging/logger-redaction-behavior.test.ts | 33 +++++++ src/logging/logger.ts | 97 ++++++++++++++++++- 2 files changed, 129 insertions(+), 1 deletion(-) diff --git a/src/logging/logger-redaction-behavior.test.ts b/src/logging/logger-redaction-behavior.test.ts index 47ba0acbfd2..794b4d0092a 100644 --- a/src/logging/logger-redaction-behavior.test.ts +++ b/src/logging/logger-redaction-behavior.test.ts @@ -123,4 +123,37 @@ describe("file log redaction", () => { spanId: SPAN_ID, }); }); + + it("writes hostname and flattened message as top-level JSONL fields", () => { + const logPath = logPathTracker.nextPath(); + setLoggerOverride({ level: "info", file: logPath }); + + getLogger().info({ route: "/api/health" }, "request completed"); + + const [line] = fs.readFileSync(logPath, "utf8").trim().split("\n"); + const record = JSON.parse(line ?? "{}") as Record; + expect(record.hostname).toEqual(expect.any(String)); + expect(record.hostname).not.toBe(""); + expect(record.message).toBe("request completed"); + }); + + it("promotes agent, session, and channel context to top-level JSONL fields", () => { + const logPath = logPathTracker.nextPath(); + setLoggerOverride({ level: "info", file: logPath }); + const logger = getChildLogger({ + agentId: "agent-main", + messageProvider: "discord", + }); + + logger.info({ sessionKey: "agent:main:discord:channel:c1" }, "session routed"); + + const [line] = fs.readFileSync(logPath, "utf8").trim().split("\n"); + const record = JSON.parse(line ?? "{}") as Record; + expect(record).toMatchObject({ + agent_id: "agent-main", + session_id: "agent:main:discord:channel:c1", + channel: "discord", + message: "session routed", + }); + }); }); diff --git a/src/logging/logger.ts b/src/logging/logger.ts index 481ac95512f..ccd3de3c5b5 100644 --- a/src/logging/logger.ts +++ b/src/logging/logger.ts @@ -1,4 +1,5 @@ import fs from "node:fs"; +import os from "node:os"; import path from "node:path"; import { Logger as TsLogger } from "tslog"; import type { OpenClawConfig } from "../config/types.js"; @@ -79,7 +80,10 @@ const MAX_DIAGNOSTIC_LOG_MESSAGE_CHARS = 4 * 1024; const MAX_DIAGNOSTIC_LOG_ATTRIBUTE_COUNT = 32; const MAX_DIAGNOSTIC_LOG_ATTRIBUTE_VALUE_CHARS = 2 * 1024; const MAX_DIAGNOSTIC_LOG_NAME_CHARS = 120; +const MAX_FILE_LOG_MESSAGE_CHARS = 4 * 1024; +const MAX_FILE_LOG_CONTEXT_VALUE_CHARS = 512; const DIAGNOSTIC_LOG_ATTRIBUTE_KEY_RE = /^[A-Za-z0-9_.:-]{1,64}$/u; +const HOSTNAME = os.hostname() || "unknown"; type DiagnosticLogAttributes = Record; @@ -210,6 +214,75 @@ function getSortedNumericLogArgs(logObj: TsLogRecord): unknown[] { .map(([, value]) => value); } +function clampFileLogText(value: string, maxChars: number): string { + return value.length > maxChars ? `${value.slice(0, maxChars)}...(truncated)` : value; +} + +function normalizeFileLogContextValue(value: unknown): string | undefined { + if (typeof value === "string") { + const normalized = value.trim(); + return normalized ? clampFileLogText(normalized, MAX_FILE_LOG_CONTEXT_VALUE_CHARS) : undefined; + } + if (typeof value === "number" && Number.isFinite(value)) { + return String(value); + } + if (typeof value === "boolean") { + return String(value); + } + return undefined; +} + +function readFirstContextString( + sources: Array | undefined>, + keys: readonly string[], +): string | undefined { + for (const source of sources) { + if (!source) { + continue; + } + for (const key of keys) { + const value = normalizeFileLogContextValue(source[key]); + if (value) { + return value; + } + } + } + return undefined; +} + +function stringifyFileLogMessagePart(value: unknown): string | undefined { + if (typeof value === "string") { + return value; + } + if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") { + return String(value); + } + if (value instanceof Error) { + return value.message || value.name; + } + if (isPlainLogRecordObject(value) && typeof value.message === "string") { + return value.message; + } + if (value === null || value === undefined) { + return undefined; + } + try { + return JSON.stringify(value); + } catch { + return String(value); + } +} + +function buildFileLogMessage(numericArgs: readonly unknown[]): string | undefined { + const parts = numericArgs + .map(stringifyFileLogMessagePart) + .filter((part): part is string => Boolean(part && part.trim())); + if (parts.length === 0) { + return undefined; + } + return clampFileLogText(parts.join(" "), MAX_FILE_LOG_MESSAGE_CHARS); +} + function extractLogBindingPrefix(numericArgs: unknown[]): { bindings?: Record; args: unknown[]; @@ -265,6 +338,25 @@ function buildTraceFileLogFields(logObj: TsLogRecord): Record | }; } +function buildStructuredFileLogFields(logObj: TsLogRecord): Record { + const { bindings, args } = extractLogBindingPrefix(getSortedNumericLogArgs(logObj)); + const structuredArg = isPlainLogRecordObject(args[0]) ? args[0] : undefined; + const sources = [structuredArg, bindings, logObj]; + const messageArgs = + structuredArg && typeof structuredArg.message !== "string" ? args.slice(1) : args; + const message = buildFileLogMessage(messageArgs); + const agentId = readFirstContextString(sources, ["agent_id", "agentId"]); + const sessionId = readFirstContextString(sources, ["session_id", "sessionId", "sessionKey"]); + const channel = readFirstContextString(sources, ["channel", "messageProvider"]); + return { + hostname: HOSTNAME, + ...(message ? { message } : {}), + ...(agentId ? { agent_id: agentId } : {}), + ...(sessionId ? { session_id: sessionId } : {}), + ...(channel ? { channel } : {}), + }; +} + function buildDiagnosticLogRecord(logObj: TsLogRecord) { const meta = logObj._meta as | { @@ -447,7 +539,10 @@ function buildLogger(settings: ResolvedSettings): TsLogger { } const time = formatTimestamp(logObj.date ?? new Date(), { style: "long" }); const traceFields = buildTraceFileLogFields(logObj as TsLogRecord); - const line = redactSensitiveText(JSON.stringify({ ...logObj, time, ...traceFields })); + const structuredFields = buildStructuredFileLogFields(logObj as TsLogRecord); + const line = redactSensitiveText( + JSON.stringify({ ...logObj, time, ...structuredFields, ...traceFields }), + ); const payload = `${line}\n`; const payloadBytes = Buffer.byteLength(payload, "utf8"); const nextBytes = currentFileBytes + payloadBytes; From fc0e6e4650b57119a32a611b01340d690c353e79 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 14:51:47 -0700 Subject: [PATCH 055/418] docs(logging): document structured file fields --- CHANGELOG.md | 1 + docs/logging.md | 12 ++++++++++++ 2 files changed, 13 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4c852645601..d8d9efbfeea 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,7 @@ Docs: https://docs.openclaw.ai ### Fixes - Exec approvals: accept a symlinked `OPENCLAW_HOME` as the trusted approvals root while still rejecting symlinked `.openclaw` path components below it. (#64663) Thanks @FunJim. +- Logging: add top-level `hostname`, flattened `message`, and available `agent_id`, `session_id`, and `channel` fields to file-log JSONL records for multi-agent filtering without removing existing structured log arguments. Fixes #51075. Thanks @stevengonsalvez. - ACP: route server logs to stderr before Gateway config/bootstrap work so ACP stdout remains JSON-RPC only for IDE integrations. Fixes #49060. Thanks @Hollychou924. - Logging: propagate internal request trace scopes through Gateway HTTP requests and WebSocket frames so file logs, diagnostic events, agent run traces, model-call traces, OTEL spans, and trusted provider `traceparent` headers share a correlatable `traceId` without logging raw request or model content. Fixes #40353. Thanks @liangruochong44-ui. - Diagnostics/OTEL: capture privacy-safe model-call request payload bytes, streamed response bytes, first-response latency, and total duration in diagnostic events, plugin hooks, stability snapshots, and OTEL model-call spans/metrics without logging raw model content. Fixes #33832. Thanks @wwh830. diff --git a/docs/logging.md b/docs/logging.md index 6941aaf0781..68f44e3d8e7 100644 --- a/docs/logging.md +++ b/docs/logging.md @@ -103,6 +103,18 @@ openclaw channels logs --channel whatsapp Each line in the log file is a JSON object. The CLI and Control UI parse these entries to render structured output (time, level, subsystem, message). +File-log JSONL records also include machine-filterable top-level fields when +available: + +- `hostname`: gateway host name. +- `message`: flattened log message text for full-text search. +- `agent_id`: active agent id when the log call carries agent context. +- `session_id`: active session id/key when the log call carries session context. +- `channel`: active channel when the log call carries channel context. + +OpenClaw preserves the original structured log arguments alongside these fields +so existing parsers that read numbered tslog argument keys keep working. + ### Console output Console logs are **TTY-aware** and formatted for readability: From d9e9e61e77bc7d32d22feaa6e4c40fcf0b1bdc71 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 14:53:17 -0700 Subject: [PATCH 056/418] fix(logging): skip unserializable file log message parts --- src/logging/logger.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/logging/logger.ts b/src/logging/logger.ts index ccd3de3c5b5..bf26b748eae 100644 --- a/src/logging/logger.ts +++ b/src/logging/logger.ts @@ -269,7 +269,7 @@ function stringifyFileLogMessagePart(value: unknown): string | undefined { try { return JSON.stringify(value); } catch { - return String(value); + return undefined; } } From 1b1eea238c85e9260cea88dcc2e8c32dd5973202 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Sun, 26 Apr 2026 23:04:18 +0100 Subject: [PATCH 057/418] ci: preserve docker test runner path --- scripts/test-docker-all.mjs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/test-docker-all.mjs b/scripts/test-docker-all.mjs index 4a4cd96df1b..4d43b59c51f 100644 --- a/scripts/test-docker-all.mjs +++ b/scripts/test-docker-all.mjs @@ -823,7 +823,7 @@ function dockerPreflightContainerNames(raw) { function runShellCommand({ command, env, label, logFile, timeoutMs }) { return new Promise((resolve) => { - const child = spawn("bash", ["-lc", command], { + const child = spawn("bash", ["-c", command], { cwd: ROOT_DIR, detached: process.platform !== "win32", env, @@ -875,7 +875,7 @@ function runShellCommand({ command, env, label, logFile, timeoutMs }) { function runShellCaptureCommand({ command, env, label, timeoutMs }) { return new Promise((resolve) => { - const child = spawn("bash", ["-lc", command], { + const child = spawn("bash", ["-c", command], { cwd: ROOT_DIR, detached: process.platform !== "win32", env, From d108110a894b48d4e867988f4fd2b2d736df7922 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Sun, 26 Apr 2026 23:10:23 +0100 Subject: [PATCH 058/418] ci: use packaged tarball for docker e2e --- .agents/skills/openclaw-testing/SKILL.md | 10 +- .../openclaw-live-and-e2e-checks-reusable.yml | 98 ++++++++++++++++++- docs/ci.md | 2 +- docs/help/testing.md | 8 +- docs/reference/test.md | 2 +- scripts/e2e/Dockerfile | 61 ++++-------- .../bundled-channel-runtime-deps-docker.sh | 32 ++---- .../e2e/crestodian-first-run-docker-client.ts | 13 ++- scripts/e2e/crestodian-first-run-docker.sh | 4 + .../e2e/crestodian-planner-docker-client.ts | 11 ++- scripts/e2e/crestodian-planner-docker.sh | 4 + .../e2e/crestodian-rescue-docker-client.ts | 11 ++- scripts/e2e/crestodian-rescue-docker.sh | 4 + scripts/e2e/cron-mcp-cleanup-docker.sh | 4 + scripts/e2e/docker-openai-seed.ts | 4 +- scripts/e2e/doctor-install-switch-docker.sh | 46 ++++++--- scripts/e2e/mcp-channels-docker.sh | 4 + scripts/e2e/mcp-channels-harness.ts | 11 ++- .../e2e/npm-onboard-channel-agent-docker.sh | 31 ++---- scripts/e2e/npm-telegram-live-docker.sh | 9 ++ scripts/e2e/npm-telegram-live-runner.ts | 4 +- scripts/e2e/openai-image-auth-docker.sh | 4 + scripts/e2e/openwebui-docker.sh | 4 + .../e2e/pi-bundle-mcp-tools-docker-client.ts | 13 ++- scripts/e2e/pi-bundle-mcp-tools-docker.sh | 4 + scripts/e2e/plugin-update-unchanged-docker.sh | 16 ++- .../session-runtime-context-docker-client.ts | 5 +- scripts/e2e/session-runtime-context-docker.sh | 4 + scripts/e2e/update-channel-switch-docker.sh | 47 ++++----- scripts/lib/docker-e2e-image.sh | 19 ++++ scripts/lib/docker-e2e-package.sh | 63 ++++++++++++ scripts/test-docker-all.mjs | 82 +++++++++------- 32 files changed, 432 insertions(+), 202 deletions(-) create mode 100644 scripts/lib/docker-e2e-package.sh diff --git a/.agents/skills/openclaw-testing/SKILL.md b/.agents/skills/openclaw-testing/SKILL.md index 61bd39c2441..483e063e6ea 100644 --- a/.agents/skills/openclaw-testing/SKILL.md +++ b/.agents/skills/openclaw-testing/SKILL.md @@ -100,14 +100,18 @@ docker_lanes: install-e2e bundled-channel-update-acpx ``` That skips the three chunk matrix and runs one targeted Docker job against the -prepared GHCR images. Release-path normal mode remains max three Docker chunk -jobs: +prepared GHCR images and the prepared OpenClaw npm tarball. Live-only targeted +reruns skip the E2E images and build only the live-test image. Release-path +normal mode remains max three Docker chunk jobs: - `core` - `package-update` - `plugins-integrations` -Every scheduler run writes `.artifacts/docker-tests/**/summary.json`. Read it +Docker E2E images never copy repo sources as the app under test: the bare image +is a Node/Git runner, and the functional image installs the same prebuilt npm +tarball that bare lanes mount. Every scheduler run writes +`.artifacts/docker-tests/**/summary.json`. Read it before rerunning. Lane entries include `command`, `rerunCommand`, status, timing, timeout state, image kind, and log file path. The summary also includes top-level phase timings for preflight, image build, package prep, lane pools, diff --git a/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml b/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml index 6eb385ab8e8..6c29fa97330 100644 --- a/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml +++ b/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml @@ -438,6 +438,7 @@ jobs: OPENCLAW_DOCKER_E2E_IMAGE: ${{ needs.prepare_docker_e2e_image.outputs.image }} OPENCLAW_DOCKER_E2E_BARE_IMAGE: ${{ needs.prepare_docker_e2e_image.outputs.bare_image }} OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE: ${{ needs.prepare_docker_e2e_image.outputs.functional_image }} + OPENCLAW_CURRENT_PACKAGE_TGZ: .artifacts/docker-e2e-package/openclaw-current.tgz OPENCLAW_SKIP_DOCKER_BUILD: "1" INCLUDE_OPENWEBUI: ${{ inputs.include_openwebui }} DOCKER_E2E_CHUNK: ${{ matrix.chunk_id }} @@ -465,6 +466,12 @@ jobs: - name: Hydrate live auth/profile inputs run: bash scripts/ci-hydrate-live-auth.sh + - name: Download OpenClaw Docker E2E package + uses: actions/download-artifact@v8 + with: + name: docker-e2e-package + path: .artifacts/docker-e2e-package + - name: Pull shared Docker E2E image shell: bash run: | @@ -623,6 +630,7 @@ jobs: OPENCLAW_DOCKER_E2E_IMAGE: ${{ needs.prepare_docker_e2e_image.outputs.image }} OPENCLAW_DOCKER_E2E_BARE_IMAGE: ${{ needs.prepare_docker_e2e_image.outputs.bare_image }} OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE: ${{ needs.prepare_docker_e2e_image.outputs.functional_image }} + OPENCLAW_CURRENT_PACKAGE_TGZ: .artifacts/docker-e2e-package/openclaw-current.tgz OPENCLAW_SKIP_DOCKER_BUILD: "1" INCLUDE_OPENWEBUI: ${{ inputs.include_openwebui }} DOCKER_E2E_LANES: ${{ inputs.docker_lanes }} @@ -650,7 +658,31 @@ jobs: - name: Hydrate live auth/profile inputs run: bash scripts/ci-hydrate-live-auth.sh + - name: Detect targeted Docker lane image needs + id: lane_class + shell: bash + run: | + set -euo pipefail + needs_e2e=0 + IFS=', ' read -r -a lanes <<< "${DOCKER_E2E_LANES}" + for lane in "${lanes[@]}"; do + [[ -z "$lane" ]] && continue + if [[ "$lane" != live-* ]]; then + needs_e2e=1 + break + fi + done + echo "needs_e2e=${needs_e2e}" >> "$GITHUB_OUTPUT" + + - name: Download OpenClaw Docker E2E package + if: steps.lane_class.outputs.needs_e2e == '1' + uses: actions/download-artifact@v8 + with: + name: docker-e2e-package + path: .artifacts/docker-e2e-package + - name: Pull shared Docker E2E images + if: steps.lane_class.outputs.needs_e2e == '1' shell: bash run: | set -euo pipefail @@ -691,10 +723,9 @@ jobs: export OPENCLAW_DOCKER_ALL_LOG_DIR=".artifacts/docker-tests/targeted" export OPENCLAW_DOCKER_ALL_TIMINGS_FILE=".artifacts/docker-tests/targeted-timings.json" if [[ "$lanes" == *" live-"* ]]; then - export OPENCLAW_DOCKER_ALL_BUILD=1 - else - export OPENCLAW_DOCKER_ALL_BUILD=0 + pnpm test:docker:live-build fi + export OPENCLAW_DOCKER_ALL_BUILD=0 pnpm test:docker:all @@ -825,7 +856,60 @@ jobs: echo "Shared Docker E2E bare image: \`$bare_image\`" >> "$GITHUB_STEP_SUMMARY" echo "Shared Docker E2E functional image: \`$functional_image\`" >> "$GITHUB_STEP_SUMMARY" + - name: Classify selected Docker lanes + id: lane_class + shell: bash + env: + DOCKER_E2E_LANES: ${{ inputs.docker_lanes }} + INCLUDE_RELEASE_PATH_SUITES: ${{ inputs.include_release_path_suites }} + INCLUDE_OPENWEBUI: ${{ inputs.include_openwebui }} + run: | + set -euo pipefail + needs_e2e=0 + if [[ "${INCLUDE_RELEASE_PATH_SUITES}" == "true" || "${INCLUDE_OPENWEBUI}" == "true" ]]; then + needs_e2e=1 + elif [[ -n "${DOCKER_E2E_LANES}" ]]; then + IFS=', ' read -r -a lanes <<< "${DOCKER_E2E_LANES}" + for lane in "${lanes[@]}"; do + [[ -z "$lane" ]] && continue + if [[ "$lane" != live-* ]]; then + needs_e2e=1 + break + fi + done + fi + echo "needs_e2e=${needs_e2e}" >> "$GITHUB_OUTPUT" + + - name: Setup Node environment + if: steps.lane_class.outputs.needs_e2e == '1' + uses: ./.github/actions/setup-node-env + with: + node-version: ${{ env.NODE_VERSION }} + pnpm-version: ${{ env.PNPM_VERSION }} + install-bun: "true" + + - name: Pack OpenClaw package for Docker E2E + if: steps.lane_class.outputs.needs_e2e == '1' + shell: bash + run: | + set -euo pipefail + mkdir -p .artifacts/docker-e2e-package + pnpm build + node --import tsx --input-type=module -e 'const { writePackageDistInventory } = await import("./src/infra/package-dist-inventory.ts"); await writePackageDistInventory(process.cwd());' + npm pack --silent --ignore-scripts --pack-destination .artifacts/docker-e2e-package >/tmp/openclaw-docker-e2e-pack.out + packed="$(tail -n 1 /tmp/openclaw-docker-e2e-pack.out | tr -d '\r')" + mv ".artifacts/docker-e2e-package/$packed" .artifacts/docker-e2e-package/openclaw-current.tgz + + - name: Upload OpenClaw Docker E2E package + if: steps.lane_class.outputs.needs_e2e == '1' + uses: actions/upload-artifact@v7 + with: + name: docker-e2e-package + path: .artifacts/docker-e2e-package/openclaw-current.tgz + if-no-files-found: error + - name: Log in to GHCR + if: steps.lane_class.outputs.needs_e2e == '1' uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4 with: registry: ghcr.io @@ -833,15 +917,16 @@ jobs: password: ${{ github.token }} - name: Setup Docker builder + if: steps.lane_class.outputs.needs_e2e == '1' uses: useblacksmith/setup-docker-builder@ac083cc84672d01c60d5e8561d0a939b697de542 # v1 - name: Build and push bare Docker E2E image - if: inputs.include_release_path_suites || inputs.docker_lanes != '' + if: steps.lane_class.outputs.needs_e2e == '1' && (inputs.include_release_path_suites || inputs.docker_lanes != '') uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0 with: context: . file: ./scripts/e2e/Dockerfile - target: build + target: bare platforms: linux/amd64 cache-from: type=gha,scope=docker-e2e-bare cache-to: type=gha,mode=max,scope=docker-e2e-bare @@ -851,11 +936,14 @@ jobs: push: true - name: Build and push functional Docker E2E image + if: steps.lane_class.outputs.needs_e2e == '1' uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0 with: context: . file: ./scripts/e2e/Dockerfile target: functional + build-contexts: | + openclaw_package=.artifacts/docker-e2e-package platforms: linux/amd64 cache-from: | type=gha,scope=docker-e2e-bare diff --git a/docs/ci.md b/docs/ci.md index 6f584d02980..2f5bf0d94f6 100644 --- a/docs/ci.md +++ b/docs/ci.md @@ -92,7 +92,7 @@ Scope logic lives in `scripts/ci-changed-scope.mjs` and is covered by unit tests CI workflow edits validate the Node CI graph plus workflow linting, but do not force Windows, Android, or macOS native builds by themselves; those platform lanes stay scoped to platform source changes. CI routing-only edits, selected cheap core-test fixture edits, and narrow plugin contract helper/test-routing edits use a fast Node-only manifest path: preflight, security, and a single `checks-fast-core` task. That path avoids build artifacts, Node 22 compatibility, channel contracts, full core shards, bundled-plugin shards, and additional guard matrices when the changed files are limited to the routing or helper surfaces that the fast task exercises directly. Windows Node checks are scoped to Windows-specific process/path wrappers, npm/pnpm/UI runner helpers, package manager config, and the CI workflow surfaces that execute that lane; unrelated source, plugin, install-smoke, and test-only changes stay on the Linux Node lanes so they do not reserve a 16-vCPU Windows worker for coverage that is already exercised by the normal test shards. -The separate `install-smoke` workflow reuses the same scope script through its own `preflight` job. It splits smoke coverage into `run_fast_install_smoke` and `run_full_install_smoke`. Pull requests run the fast path for Docker/package surfaces, bundled plugin package/manifest changes, and core plugin/channel/gateway/Plugin SDK surfaces that the Docker smoke jobs exercise. Source-only bundled plugin changes, test-only edits, and docs-only edits do not reserve Docker workers. The fast path builds the root Dockerfile image once, checks the CLI, runs the agents delete shared-workspace CLI smoke, runs the container gateway-network e2e, verifies a bundled extension build arg, and runs the bounded bundled-plugin Docker profile under a 240-second aggregate command timeout with each scenario's Docker run capped separately. The full path keeps QR package install and installer Docker/update coverage for nightly scheduled runs, manual dispatches, workflow-call release checks, and pull requests that truly touch installer/package/Docker surfaces. `main` pushes, including merge commits, do not force the full path; when changed-scope logic would request full coverage on a push, the workflow keeps the fast Docker smoke and leaves the full install smoke to nightly or release validation. The slow Bun global install image-provider smoke is separately gated by `run_bun_global_install_smoke`; it runs on the nightly schedule and from the release checks workflow, and manual `install-smoke` dispatches can opt into it, but pull requests and `main` pushes do not run it. QR and installer Docker tests keep their own install-focused Dockerfiles. Local `test:docker:all` prebuilds one shared live-test image plus two shared `scripts/e2e/Dockerfile` built-app images: a bare image for installer/update/plugin-dependency lanes and a functional image that pre-stages bundled plugin runtime dependencies for normal functionality lanes. The scheduler selects the image per lane with `OPENCLAW_DOCKER_E2E_BARE_IMAGE` and `OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE`, then runs lanes with `OPENCLAW_SKIP_DOCKER_BUILD=1`; tune the default main-pool slot count of 10 with `OPENCLAW_DOCKER_ALL_PARALLELISM` and the provider-sensitive tail-pool slot count of 10 with `OPENCLAW_DOCKER_ALL_TAIL_PARALLELISM`. Heavy lane caps default to `OPENCLAW_DOCKER_ALL_LIVE_LIMIT=6`, `OPENCLAW_DOCKER_ALL_NPM_LIMIT=8`, and `OPENCLAW_DOCKER_ALL_SERVICE_LIMIT=7` so npm install and multi-service lanes do not overcommit Docker while lighter lanes still fill available slots. Lane starts are staggered by 2 seconds by default to avoid local Docker daemon create storms; override with `OPENCLAW_DOCKER_ALL_START_STAGGER_MS=0` or another millisecond value. The local aggregate preflights Docker, removes stale OpenClaw E2E containers, emits active-lane status, persists lane timings for longest-first ordering, and supports `OPENCLAW_DOCKER_ALL_DRY_RUN=1` for scheduler inspection. It stops scheduling new pooled lanes after the first failure by default, and each lane has a 120-minute fallback timeout overrideable with `OPENCLAW_DOCKER_ALL_LANE_TIMEOUT_MS`; selected live/tail lanes use tighter per-lane caps. `OPENCLAW_DOCKER_ALL_LANES=` runs exact scheduler lanes, including release-only lanes such as `install-e2e` and split bundled update lanes such as `bundled-channel-update-acpx`, while skipping the cleanup smoke so agents can reproduce one failed lane. The reusable live/E2E workflow builds and pushes one SHA-tagged bare GHCR Docker E2E image and one SHA-tagged functional GHCR Docker E2E image, then runs the release-path Docker suite as at most three chunked jobs with `OPENCLAW_SKIP_DOCKER_BUILD=1` so each chunk pulls the image kind it needs and executes multiple lanes through the same weighted scheduler (`OPENCLAW_DOCKER_ALL_PROFILE=release-path`, `OPENCLAW_DOCKER_ALL_CHUNK=core|package-update|plugins-integrations`). Each chunk uploads `.artifacts/docker-tests/` with lane logs, timings, `summary.json`, phase timings, and per-lane rerun commands. The workflow `docker_lanes` input runs selected lanes against the prepared images instead of the three chunk jobs, which keeps failed-lane debugging bounded to one targeted Docker job; if a selected lane is a live Docker lane, the targeted job builds the live-test image locally for that rerun. When Open WebUI is requested with the release-path suite, it runs inside the plugins/integrations chunk instead of reserving a fourth Docker worker; Open WebUI keeps a standalone job only for openwebui-only dispatches. The scheduled live/E2E workflow runs the full release-path Docker suite daily. The bundled update matrix is split by update target so repeated npm update and doctor repair passes can shard with other bundled checks. +The separate `install-smoke` workflow reuses the same scope script through its own `preflight` job. It splits smoke coverage into `run_fast_install_smoke` and `run_full_install_smoke`. Pull requests run the fast path for Docker/package surfaces, bundled plugin package/manifest changes, and core plugin/channel/gateway/Plugin SDK surfaces that the Docker smoke jobs exercise. Source-only bundled plugin changes, test-only edits, and docs-only edits do not reserve Docker workers. The fast path builds the root Dockerfile image once, checks the CLI, runs the agents delete shared-workspace CLI smoke, runs the container gateway-network e2e, verifies a bundled extension build arg, and runs the bounded bundled-plugin Docker profile under a 240-second aggregate command timeout with each scenario's Docker run capped separately. The full path keeps QR package install and installer Docker/update coverage for nightly scheduled runs, manual dispatches, workflow-call release checks, and pull requests that truly touch installer/package/Docker surfaces. `main` pushes, including merge commits, do not force the full path; when changed-scope logic would request full coverage on a push, the workflow keeps the fast Docker smoke and leaves the full install smoke to nightly or release validation. The slow Bun global install image-provider smoke is separately gated by `run_bun_global_install_smoke`; it runs on the nightly schedule and from the release checks workflow, and manual `install-smoke` dispatches can opt into it, but pull requests and `main` pushes do not run it. QR and installer Docker tests keep their own install-focused Dockerfiles. Local `test:docker:all` prebuilds one shared live-test image, packs OpenClaw once as an npm tarball, and builds two shared `scripts/e2e/Dockerfile` images: a bare Node/Git runner for installer/update/plugin-dependency lanes and a functional image that installs the same tarball into `/app` for normal functionality lanes. The scheduler selects the image per lane with `OPENCLAW_DOCKER_E2E_BARE_IMAGE` and `OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE`, then runs lanes with `OPENCLAW_SKIP_DOCKER_BUILD=1`; tune the default main-pool slot count of 10 with `OPENCLAW_DOCKER_ALL_PARALLELISM` and the provider-sensitive tail-pool slot count of 10 with `OPENCLAW_DOCKER_ALL_TAIL_PARALLELISM`. Heavy lane caps default to `OPENCLAW_DOCKER_ALL_LIVE_LIMIT=6`, `OPENCLAW_DOCKER_ALL_NPM_LIMIT=8`, and `OPENCLAW_DOCKER_ALL_SERVICE_LIMIT=7` so npm install and multi-service lanes do not overcommit Docker while lighter lanes still fill available slots. Lane starts are staggered by 2 seconds by default to avoid local Docker daemon create storms; override with `OPENCLAW_DOCKER_ALL_START_STAGGER_MS=0` or another millisecond value. The local aggregate preflights Docker, removes stale OpenClaw E2E containers, emits active-lane status, persists lane timings for longest-first ordering, and supports `OPENCLAW_DOCKER_ALL_DRY_RUN=1` for scheduler inspection. It stops scheduling new pooled lanes after the first failure by default, and each lane has a 120-minute fallback timeout overrideable with `OPENCLAW_DOCKER_ALL_LANE_TIMEOUT_MS`; selected live/tail lanes use tighter per-lane caps. `OPENCLAW_DOCKER_ALL_LANES=` runs exact scheduler lanes, including release-only lanes such as `install-e2e` and split bundled update lanes such as `bundled-channel-update-acpx`, while skipping the cleanup smoke so agents can reproduce one failed lane. The reusable live/E2E workflow builds and pushes one SHA-tagged bare GHCR Docker E2E image and one SHA-tagged functional GHCR Docker E2E image, then runs the release-path Docker suite as at most three chunked jobs with `OPENCLAW_SKIP_DOCKER_BUILD=1` so each chunk pulls the image kind it needs and executes multiple lanes through the same weighted scheduler (`OPENCLAW_DOCKER_ALL_PROFILE=release-path`, `OPENCLAW_DOCKER_ALL_CHUNK=core|package-update|plugins-integrations`). Each chunk uploads `.artifacts/docker-tests/` with lane logs, timings, `summary.json`, phase timings, and per-lane rerun commands. The workflow `docker_lanes` input runs selected lanes against the prepared images instead of the three chunk jobs, which keeps failed-lane debugging bounded to one targeted Docker job; if a selected lane is a live Docker lane, the targeted job builds the live-test image locally for that rerun. When Open WebUI is requested with the release-path suite, it runs inside the plugins/integrations chunk instead of reserving a fourth Docker worker; Open WebUI keeps a standalone job only for openwebui-only dispatches. The scheduled live/E2E workflow runs the full release-path Docker suite daily. The bundled update matrix is split by update target so repeated npm update and doctor repair passes can shard with other bundled checks. Local changed-lane logic lives in `scripts/changed-lanes.mjs` and is executed by `scripts/check-changed.mjs`. That local gate is stricter about architecture boundaries than the broad CI platform scope: core production changes run core prod typecheck plus core tests, core test-only changes run only core test typecheck/tests, extension production changes run extension prod typecheck plus extension tests, and extension test-only changes run only extension test typecheck/tests. Public Plugin SDK or plugin-contract changes expand to extension validation because extensions depend on those core contracts. Release metadata-only version bumps run targeted version/config/root-dependency checks. Unknown root/config changes fail safe to all lanes. diff --git a/docs/help/testing.md b/docs/help/testing.md index 33b8728efb6..ea02a059a42 100644 --- a/docs/help/testing.md +++ b/docs/help/testing.md @@ -606,7 +606,7 @@ These Docker runners split into two buckets: `OPENCLAW_LIVE_GATEWAY_STEP_TIMEOUT_MS=45000`, and `OPENCLAW_LIVE_GATEWAY_MODEL_TIMEOUT_MS=90000`. Override those env vars when you explicitly want the larger exhaustive scan. -- `test:docker:all` builds the live Docker image once via `test:docker:live-build`, then reuses it for the live Docker lanes. It also builds one shared `scripts/e2e/Dockerfile` image via `test:docker:e2e-build` and reuses it for the E2E container smoke runners that exercise the built app. The aggregate uses a weighted local scheduler: `OPENCLAW_DOCKER_ALL_PARALLELISM` controls process slots, while resource caps keep heavy live, npm-install, and multi-service lanes from all starting at once. Defaults are 10 slots, `OPENCLAW_DOCKER_ALL_LIVE_LIMIT=6`, `OPENCLAW_DOCKER_ALL_NPM_LIMIT=8`, and `OPENCLAW_DOCKER_ALL_SERVICE_LIMIT=7`; tune `OPENCLAW_DOCKER_ALL_WEIGHT_LIMIT` or `OPENCLAW_DOCKER_ALL_DOCKER_LIMIT` only when the Docker host has more headroom. The runner performs a Docker preflight by default, removes stale OpenClaw E2E containers, prints status every 30 seconds, stores successful lane timings in `.artifacts/docker-tests/lane-timings.json`, and uses those timings to start longer lanes first on later runs. Use `OPENCLAW_DOCKER_ALL_DRY_RUN=1` to print the weighted lane manifest without building or running Docker. +- `test:docker:all` builds the live Docker image once via `test:docker:live-build`, packs OpenClaw once as an npm tarball, then builds/reuses two `scripts/e2e/Dockerfile` images. The bare image is only the Node/Git runner for install/update/plugin-dependency lanes; those lanes mount the prebuilt tarball. The functional image installs the same tarball into `/app` for built-app functionality lanes. The aggregate uses a weighted local scheduler: `OPENCLAW_DOCKER_ALL_PARALLELISM` controls process slots, while resource caps keep heavy live, npm-install, and multi-service lanes from all starting at once. Defaults are 10 slots, `OPENCLAW_DOCKER_ALL_LIVE_LIMIT=6`, `OPENCLAW_DOCKER_ALL_NPM_LIMIT=8`, and `OPENCLAW_DOCKER_ALL_SERVICE_LIMIT=7`; tune `OPENCLAW_DOCKER_ALL_WEIGHT_LIMIT` or `OPENCLAW_DOCKER_ALL_DOCKER_LIMIT` only when the Docker host has more headroom. The runner performs a Docker preflight by default, removes stale OpenClaw E2E containers, prints status every 30 seconds, stores successful lane timings in `.artifacts/docker-tests/lane-timings.json`, and uses those timings to start longer lanes first on later runs. Use `OPENCLAW_DOCKER_ALL_DRY_RUN=1` to print the weighted lane manifest without building or running Docker. - Container smoke runners: `test:docker:openwebui`, `test:docker:onboard`, `test:docker:npm-onboard-channel-agent`, `test:docker:update-channel-switch`, `test:docker:session-runtime-context`, `test:docker:agents-delete-shared-workspace`, `test:docker:gateway-network`, `test:docker:browser-cdp-snapshot`, `test:docker:mcp-channels`, `test:docker:pi-bundle-mcp-tools`, `test:docker:cron-mcp-cleanup`, `test:docker:plugins`, `test:docker:plugin-update`, and `test:docker:config-reload` boot one or more real containers and verify higher-level integration paths. The live-model Docker runners also bind-mount only the needed CLI auth homes (or all supported ones when the run is not narrowed), then copy them into the container home before the run so external-CLI OAuth can refresh tokens without mutating the host auth store: @@ -639,11 +639,11 @@ The live-model Docker runners also bind-mount only the needed CLI auth homes (or - Narrow bundled plugin runtime deps while iterating by disabling unrelated scenarios, for example: `OPENCLAW_BUNDLED_CHANNEL_SCENARIOS=0 OPENCLAW_BUNDLED_CHANNEL_UPDATE_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_ROOT_OWNED_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_SETUP_ENTRY_SCENARIO=0 pnpm test:docker:bundled-channel-deps`. -To prebuild and reuse the shared built-app image manually: +To prebuild and reuse the shared functional image manually: ```bash -OPENCLAW_DOCKER_E2E_IMAGE=openclaw-docker-e2e:local pnpm test:docker:e2e-build -OPENCLAW_DOCKER_E2E_IMAGE=openclaw-docker-e2e:local OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:mcp-channels +OPENCLAW_DOCKER_E2E_IMAGE=openclaw-docker-e2e-functional:local pnpm test:docker:e2e-build +OPENCLAW_DOCKER_E2E_IMAGE=openclaw-docker-e2e-functional:local OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:mcp-channels ``` Suite-specific image overrides such as `OPENCLAW_GATEWAY_NETWORK_E2E_IMAGE` still win when set. When `OPENCLAW_SKIP_DOCKER_BUILD=1` points at a remote shared image, the scripts pull it if it is not already local. The QR and installer Docker tests keep their own Dockerfiles because they validate package/install behavior rather than the shared built-app runtime. diff --git a/docs/reference/test.md b/docs/reference/test.md index d4219d21e36..5cbf738108d 100644 --- a/docs/reference/test.md +++ b/docs/reference/test.md @@ -33,7 +33,7 @@ title: "Tests" - Gateway integration: opt-in via `OPENCLAW_TEST_INCLUDE_GATEWAY=1 pnpm test` or `pnpm test:gateway`. - `pnpm test:e2e`: Runs gateway end-to-end smoke tests (multi-instance WS/HTTP/node pairing). Defaults to `threads` + `isolate: false` with adaptive workers in `vitest.e2e.config.ts`; tune with `OPENCLAW_E2E_WORKERS=` and set `OPENCLAW_E2E_VERBOSE=1` for verbose logs. - `pnpm test:live`: Runs provider live tests (minimax/zai). Requires API keys and `LIVE=1` (or provider-specific `*_LIVE_TEST=1`) to unskip. -- `pnpm test:docker:all`: Builds the shared live-test image plus two Docker E2E images once, then runs the Docker smoke lanes with `OPENCLAW_SKIP_DOCKER_BUILD=1` through a weighted scheduler. The bare image (`OPENCLAW_DOCKER_E2E_BARE_IMAGE`) is used for installer/update/plugin-dependency lanes; the functional image (`OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE`) pre-stages bundled plugin runtime dependencies for normal functionality lanes. `OPENCLAW_DOCKER_ALL_PARALLELISM=` controls process slots and defaults to 10; `OPENCLAW_DOCKER_ALL_TAIL_PARALLELISM=` controls the provider-sensitive tail pool and defaults to 10. Heavy lane caps default to `OPENCLAW_DOCKER_ALL_LIVE_LIMIT=9`, `OPENCLAW_DOCKER_ALL_NPM_LIMIT=10`, and `OPENCLAW_DOCKER_ALL_SERVICE_LIMIT=7`; provider caps default to one heavy lane per provider via `OPENCLAW_DOCKER_ALL_LIVE_CLAUDE_LIMIT=4`, `OPENCLAW_DOCKER_ALL_LIVE_CODEX_LIMIT=4`, and `OPENCLAW_DOCKER_ALL_LIVE_GEMINI_LIMIT=4`. Use `OPENCLAW_DOCKER_ALL_WEIGHT_LIMIT` or `OPENCLAW_DOCKER_ALL_DOCKER_LIMIT` for larger hosts. Lane starts are staggered by 2 seconds by default to avoid local Docker daemon create storms; override with `OPENCLAW_DOCKER_ALL_START_STAGGER_MS=`. The runner preflights Docker by default, cleans stale OpenClaw E2E containers, emits active-lane status every 30 seconds, shares provider CLI tool caches between compatible lanes, retries transient live-provider failures once by default (`OPENCLAW_DOCKER_ALL_LIVE_RETRIES=`), and stores lane timings in `.artifacts/docker-tests/lane-timings.json` for longest-first ordering on later runs. Use `OPENCLAW_DOCKER_ALL_DRY_RUN=1` to print the lane manifest without running Docker, `OPENCLAW_DOCKER_ALL_STATUS_INTERVAL_MS=` to tune status output, or `OPENCLAW_DOCKER_ALL_TIMINGS=0` to disable timing reuse. Use `OPENCLAW_DOCKER_ALL_LIVE_MODE=skip` for deterministic/local lanes only or `OPENCLAW_DOCKER_ALL_LIVE_MODE=only` for live-provider lanes only; package aliases are `pnpm test:docker:local:all` and `pnpm test:docker:live:all`. Live-only mode merges main and tail live lanes into one longest-first pool so provider buckets can pack Claude, Codex, and Gemini work together. The runner stops scheduling new pooled lanes after the first failure unless `OPENCLAW_DOCKER_ALL_FAIL_FAST=0` is set, and each lane has a 120-minute fallback timeout overrideable with `OPENCLAW_DOCKER_ALL_LANE_TIMEOUT_MS`; selected live/tail lanes use tighter per-lane caps. CLI backend Docker setup commands have their own timeout via `OPENCLAW_LIVE_CLI_BACKEND_SETUP_TIMEOUT_SECONDS` (default 180). Per-lane logs and `summary.json` phase timings are written under `.artifacts/docker-tests//`. +- `pnpm test:docker:all`: Builds the shared live-test image, packs OpenClaw once as an npm tarball, builds/reuses a bare Node/Git runner image plus a functional image that installs that tarball into `/app`, then runs Docker smoke lanes with `OPENCLAW_SKIP_DOCKER_BUILD=1` through a weighted scheduler. The bare image (`OPENCLAW_DOCKER_E2E_BARE_IMAGE`) is used for installer/update/plugin-dependency lanes; those lanes mount the prebuilt tarball instead of using copied repo sources. The functional image (`OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE`) is used for normal built-app functionality lanes. `OPENCLAW_DOCKER_ALL_PARALLELISM=` controls process slots and defaults to 10; `OPENCLAW_DOCKER_ALL_TAIL_PARALLELISM=` controls the provider-sensitive tail pool and defaults to 10. Heavy lane caps default to `OPENCLAW_DOCKER_ALL_LIVE_LIMIT=9`, `OPENCLAW_DOCKER_ALL_NPM_LIMIT=10`, and `OPENCLAW_DOCKER_ALL_SERVICE_LIMIT=7`; provider caps default to one heavy lane per provider via `OPENCLAW_DOCKER_ALL_LIVE_CLAUDE_LIMIT=4`, `OPENCLAW_DOCKER_ALL_LIVE_CODEX_LIMIT=4`, and `OPENCLAW_DOCKER_ALL_LIVE_GEMINI_LIMIT=4`. Use `OPENCLAW_DOCKER_ALL_WEIGHT_LIMIT` or `OPENCLAW_DOCKER_ALL_DOCKER_LIMIT` for larger hosts. Lane starts are staggered by 2 seconds by default to avoid local Docker daemon create storms; override with `OPENCLAW_DOCKER_ALL_START_STAGGER_MS=`. The runner preflights Docker by default, cleans stale OpenClaw E2E containers, emits active-lane status every 30 seconds, shares provider CLI tool caches between compatible lanes, retries transient live-provider failures once by default (`OPENCLAW_DOCKER_ALL_LIVE_RETRIES=`), and stores lane timings in `.artifacts/docker-tests/lane-timings.json` for longest-first ordering on later runs. Use `OPENCLAW_DOCKER_ALL_DRY_RUN=1` to print the lane manifest without running Docker, `OPENCLAW_DOCKER_ALL_STATUS_INTERVAL_MS=` to tune status output, or `OPENCLAW_DOCKER_ALL_TIMINGS=0` to disable timing reuse. Use `OPENCLAW_DOCKER_ALL_LIVE_MODE=skip` for deterministic/local lanes only or `OPENCLAW_DOCKER_ALL_LIVE_MODE=only` for live-provider lanes only; package aliases are `pnpm test:docker:local:all` and `pnpm test:docker:live:all`. Live-only mode merges main and tail live lanes into one longest-first pool so provider buckets can pack Claude, Codex, and Gemini work together. The runner stops scheduling new pooled lanes after the first failure unless `OPENCLAW_DOCKER_ALL_FAIL_FAST=0` is set, and each lane has a 120-minute fallback timeout overrideable with `OPENCLAW_DOCKER_ALL_LANE_TIMEOUT_MS`; selected live/tail lanes use tighter per-lane caps. CLI backend Docker setup commands have their own timeout via `OPENCLAW_LIVE_CLI_BACKEND_SETUP_TIMEOUT_SECONDS` (default 180). Per-lane logs and `summary.json` phase timings are written under `.artifacts/docker-tests//`. - `pnpm test:docker:browser-cdp-snapshot`: Builds a Chromium-backed source E2E container, starts raw CDP plus an isolated Gateway, runs `browser doctor --deep`, and verifies CDP role snapshots include link URLs, cursor-promoted clickables, iframe refs, and frame metadata. - CLI backend live Docker probes can be run as focused lanes, for example `pnpm test:docker:live-cli-backend:codex`, `pnpm test:docker:live-cli-backend:codex:resume`, or `pnpm test:docker:live-cli-backend:codex:mcp`. Claude and Gemini have matching `:resume` and `:mcp` aliases. - `pnpm test:docker:openwebui`: Starts Dockerized OpenClaw + Open WebUI, signs in through Open WebUI, checks `/api/models`, then runs a real proxied chat through `/api/chat/completions`. Requires a usable live model key (for example OpenAI in `~/.profile`), pulls an external Open WebUI image, and is not expected to be CI-stable like the normal unit/e2e suites. diff --git a/scripts/e2e/Dockerfile b/scripts/e2e/Dockerfile index b3edbfd79a1..dbda16a418f 100644 --- a/scripts/e2e/Dockerfile +++ b/scripts/e2e/Dockerfile @@ -1,4 +1,8 @@ # syntax=docker/dockerfile:1.7 +# +# Shared Docker E2E image. +# `bare` is a clean Node/Git runner for install/update lanes. `functional` +# installs the prepared OpenClaw npm tarball into /app for built-app lanes. FROM node:24-bookworm-slim@sha256:e8e2e91b1378f83c5b2dd15f0247f34110e2fe895f6ca7719dbb780f929368eb AS e2e-runner @@ -7,12 +11,14 @@ RUN apt-get update \ && rm -rf /var/lib/apt/lists/* RUN corepack enable +RUN npm install -g tsx@4.21.0 --no-fund --no-audit RUN useradd --create-home --shell /bin/bash appuser \ && mkdir -p /app \ && chown appuser:appuser /app ENV HOME="/home/appuser" +ENV PATH="/home/appuser/.local/bin:${PATH}" ENV NODE_OPTIONS="--disable-warning=ExperimentalWarning" # Docker E2E lanes start many loopback gateways concurrently; mDNS advertising # is unrelated to those checks and can flap under container CPU/network load. @@ -21,48 +27,23 @@ ENV OPENCLAW_DISABLE_BONJOUR="1" USER appuser WORKDIR /app -FROM e2e-runner AS deps - -COPY --chown=appuser:appuser package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./ -COPY --chown=appuser:appuser ui/package.json ./ui/package.json -COPY --chown=appuser:appuser patches ./patches -COPY --chown=appuser:appuser scripts/postinstall-bundled-plugins.mjs scripts/preinstall-package-manager-warning.mjs scripts/npm-runner.mjs scripts/windows-cmd-helpers.mjs ./scripts/ -RUN --mount=type=bind,source=extensions,target=/tmp/extensions,readonly \ - find /tmp/extensions -mindepth 2 -maxdepth 2 -name package.json -print | \ - while IFS= read -r manifest; do \ - dest="${manifest#/tmp/}"; \ - mkdir -p "$(dirname "$dest")"; \ - cp "$manifest" "$dest"; \ - done - -RUN --mount=type=cache,id=openclaw-pnpm-store,target=/home/appuser/.local/share/pnpm/store,sharing=locked \ - pnpm install --frozen-lockfile - -FROM deps AS build - -COPY --chown=appuser:appuser .oxlintrc.json tsconfig.json tsconfig.plugin-sdk.dts.json tsconfig.oxlint*.json tsdown.config.ts vitest.config.ts openclaw.mjs ./ -COPY --chown=appuser:appuser src ./src -COPY --chown=appuser:appuser test ./test -COPY --chown=appuser:appuser scripts ./scripts -COPY --chown=appuser:appuser docs ./docs -COPY --chown=appuser:appuser packages ./packages -COPY --chown=appuser:appuser skills ./skills -COPY --chown=appuser:appuser ui ./ui -COPY --chown=appuser:appuser extensions ./extensions -COPY --chown=appuser:appuser vendor/a2ui/renderers/lit ./vendor/a2ui/renderers/lit -COPY --chown=appuser:appuser apps/shared/OpenClawKit/Sources/OpenClawKit/Resources ./apps/shared/OpenClawKit/Sources/OpenClawKit/Resources -COPY --chown=appuser:appuser apps/shared/OpenClawKit/Tools/CanvasA2UI ./apps/shared/OpenClawKit/Tools/CanvasA2UI - -RUN pnpm build -# Onboard Docker E2E does not exercise the Control UI itself; it only needs the -# asset-existence check to pass so configure/onboard can continue. -RUN mkdir -p dist/control-ui \ - && printf '%s\n' 'OpenClaw Control UI' > dist/control-ui/index.html +FROM e2e-runner AS bare CMD ["bash"] -FROM build AS functional - -RUN node scripts/stage-bundled-plugin-runtime-deps.mjs +FROM bare AS build + +CMD ["bash"] + +FROM bare AS functional + +# The app under test enters through the named BuildKit context, not by copying +# checkout sources into the image. +COPY --from=openclaw_package --chown=appuser:appuser openclaw-current.tgz /tmp/openclaw-current.tgz +RUN npm install -g --prefix /tmp/openclaw-prefix /tmp/openclaw-current.tgz --no-fund --no-audit \ + && cp -a /tmp/openclaw-prefix/lib/node_modules/openclaw/. /app/ \ + && mkdir -p "$HOME/.local/bin" \ + && ln -sf /app/openclaw.mjs "$HOME/.local/bin/openclaw" \ + && rm -rf /tmp/openclaw-prefix /tmp/openclaw-current.tgz CMD ["bash"] diff --git a/scripts/e2e/bundled-channel-runtime-deps-docker.sh b/scripts/e2e/bundled-channel-runtime-deps-docker.sh index 978b6922e15..3eff712ab98 100644 --- a/scripts/e2e/bundled-channel-runtime-deps-docker.sh +++ b/scripts/e2e/bundled-channel-runtime-deps-docker.sh @@ -1,12 +1,16 @@ #!/usr/bin/env bash +# Runs bundled plugin runtime-dependency Docker scenarios from a mounted OpenClaw +# npm tarball. The default image is a clean runner; each scenario installs the +# tarball so package install behavior is what gets tested. set -euo pipefail ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" source "$ROOT_DIR/scripts/lib/docker-e2e-image.sh" +source "$ROOT_DIR/scripts/lib/docker-e2e-package.sh" IMAGE_NAME="$(docker_e2e_resolve_image "openclaw-bundled-channel-deps-e2e" OPENCLAW_BUNDLED_CHANNEL_DEPS_E2E_IMAGE)" UPDATE_BASELINE_VERSION="${OPENCLAW_BUNDLED_CHANNEL_UPDATE_BASELINE_VERSION:-2026.4.20}" -DOCKER_TARGET="${OPENCLAW_BUNDLED_CHANNEL_DOCKER_TARGET:-e2e-runner}" +DOCKER_TARGET="${OPENCLAW_BUNDLED_CHANNEL_DOCKER_TARGET:-bare}" HOST_BUILD="${OPENCLAW_BUNDLED_CHANNEL_HOST_BUILD:-1}" PACKAGE_TGZ="${OPENCLAW_BUNDLED_CHANNEL_PACKAGE_TGZ:-}" RUN_CHANNEL_SCENARIOS="${OPENCLAW_BUNDLED_CHANNEL_SCENARIOS:-1}" @@ -22,32 +26,14 @@ docker_e2e_build_or_reuse "$IMAGE_NAME" bundled-channel-deps "$ROOT_DIR/scripts/ prepare_package_tgz() { if [ -n "$PACKAGE_TGZ" ]; then - if [ ! -f "$PACKAGE_TGZ" ]; then - echo "OPENCLAW_BUNDLED_CHANNEL_PACKAGE_TGZ does not exist: $PACKAGE_TGZ" >&2 - exit 1 - fi - PACKAGE_TGZ="$(cd "$(dirname "$PACKAGE_TGZ")" && pwd)/$(basename "$PACKAGE_TGZ")" + PACKAGE_TGZ="$(docker_e2e_prepare_package_tgz bundled-channel-deps "$PACKAGE_TGZ")" return 0 fi - - if [ "$HOST_BUILD" != "0" ]; then - echo "Building host package artifacts..." - run_logged bundled-channel-deps-host-build pnpm build - else - echo "Skipping host build (OPENCLAW_BUNDLED_CHANNEL_HOST_BUILD=0)" - fi - - echo "Writing package inventory and packing once..." - run_logged bundled-channel-deps-inventory node --import tsx --input-type=module -e 'const { writePackageDistInventory } = await import("./src/infra/package-dist-inventory.ts"); await writePackageDistInventory(process.cwd());' - local pack_dir - pack_dir="$(mktemp -d "${TMPDIR:-/tmp}/openclaw-bundled-channel-pack.XXXXXX")" - run_logged bundled-channel-deps-pack npm pack --ignore-scripts --pack-destination "$pack_dir" - PACKAGE_TGZ="$(find "$pack_dir" -maxdepth 1 -name 'openclaw-*.tgz' -print -quit)" - if [ -z "$PACKAGE_TGZ" ]; then - echo "missing packed OpenClaw tarball" >&2 + if [ "$HOST_BUILD" = "0" ] && [ -z "${OPENCLAW_CURRENT_PACKAGE_TGZ:-}" ]; then + echo "OPENCLAW_BUNDLED_CHANNEL_HOST_BUILD=0 requires OPENCLAW_CURRENT_PACKAGE_TGZ or OPENCLAW_BUNDLED_CHANNEL_PACKAGE_TGZ" >&2 exit 1 fi - PACKAGE_TGZ="$(cd "$(dirname "$PACKAGE_TGZ")" && pwd)/$(basename "$PACKAGE_TGZ")" + PACKAGE_TGZ="$(docker_e2e_prepare_package_tgz bundled-channel-deps)" } prepare_package_tgz diff --git a/scripts/e2e/crestodian-first-run-docker-client.ts b/scripts/e2e/crestodian-first-run-docker-client.ts index 1dd6a3f4f04..a8772d14c42 100644 --- a/scripts/e2e/crestodian-first-run-docker-client.ts +++ b/scripts/e2e/crestodian-first-run-docker-client.ts @@ -1,11 +1,14 @@ +// Crestodian first-run Docker harness. +// Imports packaged dist modules so the Docker lane verifies the npm tarball, +// while this small test driver stays mounted from the checkout. import fs from "node:fs/promises"; import os from "node:os"; import path from "node:path"; -import { runCli, shouldStartCrestodianForBareRoot } from "../../src/cli/run-main.js"; -import { clearConfigCache } from "../../src/config/config.js"; -import type { OpenClawConfig } from "../../src/config/types.openclaw.js"; -import { runCrestodian } from "../../src/crestodian/crestodian.js"; -import type { RuntimeEnv } from "../../src/runtime.js"; +import { runCli, shouldStartCrestodianForBareRoot } from "../../dist/cli/run-main.js"; +import { clearConfigCache } from "../../dist/config/config.js"; +import type { OpenClawConfig } from "../../dist/config/types.openclaw.js"; +import { runCrestodian } from "../../dist/crestodian/crestodian.js"; +import type { RuntimeEnv } from "../../dist/runtime.js"; type CrestodianFirstRunCommand = { id: string; diff --git a/scripts/e2e/crestodian-first-run-docker.sh b/scripts/e2e/crestodian-first-run-docker.sh index 473f907b1d8..eb1709e5991 100644 --- a/scripts/e2e/crestodian-first-run-docker.sh +++ b/scripts/e2e/crestodian-first-run-docker.sh @@ -1,4 +1,6 @@ #!/usr/bin/env bash +# Runs the Crestodian first-run Docker smoke against the package-installed +# functional E2E image, with only the test harness mounted from the checkout. set -euo pipefail ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" @@ -16,11 +18,13 @@ trap cleanup EXIT docker_e2e_build_or_reuse "$IMAGE_NAME" crestodian-first-run echo "Running in-container Crestodian first-run smoke..." +# Harness files are mounted read-only; the app under test comes from /app/dist. set +e docker run --rm \ --name "$CONTAINER_NAME" \ -e "OPENCLAW_STATE_DIR=/tmp/openclaw-state" \ -e "OPENCLAW_CONFIG_PATH=/tmp/openclaw-state/openclaw.json" \ + -v "$ROOT_DIR/scripts/e2e:/app/scripts/e2e:ro" \ "$IMAGE_NAME" \ bash -lc "set -euo pipefail node --import tsx scripts/e2e/crestodian-first-run-docker-client.ts diff --git a/scripts/e2e/crestodian-planner-docker-client.ts b/scripts/e2e/crestodian-planner-docker-client.ts index bdf420ab25b..5c604b24678 100644 --- a/scripts/e2e/crestodian-planner-docker-client.ts +++ b/scripts/e2e/crestodian-planner-docker-client.ts @@ -1,10 +1,13 @@ +// Crestodian planner Docker harness. +// Imports packaged dist modules so the Docker lane verifies the npm tarball, +// while this small test driver stays mounted from the checkout. import fs from "node:fs/promises"; import os from "node:os"; import path from "node:path"; -import { clearConfigCache } from "../../src/config/config.js"; -import type { OpenClawConfig } from "../../src/config/types.openclaw.js"; -import { runCrestodian } from "../../src/crestodian/crestodian.js"; -import type { RuntimeEnv } from "../../src/runtime.js"; +import { clearConfigCache } from "../../dist/config/config.js"; +import type { OpenClawConfig } from "../../dist/config/types.openclaw.js"; +import { runCrestodian } from "../../dist/crestodian/crestodian.js"; +import type { RuntimeEnv } from "../../dist/runtime.js"; function assert(condition: unknown, message: string): asserts condition { if (!condition) { diff --git a/scripts/e2e/crestodian-planner-docker.sh b/scripts/e2e/crestodian-planner-docker.sh index debc99a0e7f..a3a9352ee5a 100755 --- a/scripts/e2e/crestodian-planner-docker.sh +++ b/scripts/e2e/crestodian-planner-docker.sh @@ -1,4 +1,6 @@ #!/usr/bin/env bash +# Runs the Crestodian planner fallback Docker smoke against the package-installed +# functional E2E image, with only the test harness mounted from the checkout. set -euo pipefail ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" @@ -16,11 +18,13 @@ trap cleanup EXIT docker_e2e_build_or_reuse "$IMAGE_NAME" crestodian-planner echo "Running in-container Crestodian planner fallback smoke..." +# Harness files are mounted read-only; the app under test comes from /app/dist. set +e docker run --rm \ --name "$CONTAINER_NAME" \ -e "OPENCLAW_STATE_DIR=/tmp/openclaw-state" \ -e "OPENCLAW_CONFIG_PATH=/tmp/openclaw-state/openclaw.json" \ + -v "$ROOT_DIR/scripts/e2e:/app/scripts/e2e:ro" \ "$IMAGE_NAME" \ bash -lc "set -euo pipefail node --import tsx scripts/e2e/crestodian-planner-docker-client.ts diff --git a/scripts/e2e/crestodian-rescue-docker-client.ts b/scripts/e2e/crestodian-rescue-docker-client.ts index 98ca2c83b99..11e9ae5d713 100644 --- a/scripts/e2e/crestodian-rescue-docker-client.ts +++ b/scripts/e2e/crestodian-rescue-docker-client.ts @@ -1,10 +1,13 @@ +// Crestodian rescue-message Docker harness. +// Imports packaged dist modules so the Docker lane verifies the npm tarball, +// while this small test driver stays mounted from the checkout. import fs from "node:fs/promises"; import os from "node:os"; import path from "node:path"; -import { handleCrestodianCommand } from "../../src/auto-reply/reply/commands-crestodian.js"; -import { clearConfigCache } from "../../src/config/config.js"; -import type { OpenClawConfig } from "../../src/config/types.openclaw.js"; -import { runCrestodianRescueMessage } from "../../src/crestodian/rescue-message.js"; +import { handleCrestodianCommand } from "../../dist/auto-reply/reply/commands-crestodian.js"; +import { clearConfigCache } from "../../dist/config/config.js"; +import type { OpenClawConfig } from "../../dist/config/types.openclaw.js"; +import { runCrestodianRescueMessage } from "../../dist/crestodian/rescue-message.js"; type CommandResult = Awaited>; diff --git a/scripts/e2e/crestodian-rescue-docker.sh b/scripts/e2e/crestodian-rescue-docker.sh index 4ba9c96ac75..c45b1274937 100755 --- a/scripts/e2e/crestodian-rescue-docker.sh +++ b/scripts/e2e/crestodian-rescue-docker.sh @@ -1,4 +1,6 @@ #!/usr/bin/env bash +# Runs the Crestodian rescue-message Docker smoke against the package-installed +# functional E2E image, with only the test harness mounted from the checkout. set -euo pipefail ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" @@ -16,11 +18,13 @@ trap cleanup EXIT docker_e2e_build_or_reuse "$IMAGE_NAME" crestodian-rescue echo "Running in-container Crestodian rescue smoke..." +# Harness files are mounted read-only; the app under test comes from /app/dist. set +e docker run --rm \ --name "$CONTAINER_NAME" \ -e "OPENCLAW_STATE_DIR=/tmp/openclaw-state" \ -e "OPENCLAW_CONFIG_PATH=/tmp/openclaw-state/openclaw.json" \ + -v "$ROOT_DIR/scripts/e2e:/app/scripts/e2e:ro" \ "$IMAGE_NAME" \ bash -lc "set -euo pipefail node --import tsx scripts/e2e/crestodian-rescue-docker-client.ts diff --git a/scripts/e2e/cron-mcp-cleanup-docker.sh b/scripts/e2e/cron-mcp-cleanup-docker.sh index d91b41abdfc..7ae872451e6 100644 --- a/scripts/e2e/cron-mcp-cleanup-docker.sh +++ b/scripts/e2e/cron-mcp-cleanup-docker.sh @@ -1,4 +1,6 @@ #!/usr/bin/env bash +# Starts Gateway plus seeded cron/subagent MCP work in Docker, then verifies MCP +# child-process cleanup through a mounted test harness. set -euo pipefail ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" @@ -18,6 +20,7 @@ trap cleanup EXIT docker_e2e_build_or_reuse "$IMAGE_NAME" cron-mcp-cleanup echo "Running in-container cron/subagent MCP cleanup smoke..." +# Harness files are mounted read-only; the app under test comes from /app/dist. set +e docker run --rm \ --name "$CONTAINER_NAME" \ @@ -33,6 +36,7 @@ docker run --rm \ -e "GW_URL=ws://127.0.0.1:$PORT" \ -e "GW_TOKEN=$TOKEN" \ -e "OPENCLAW_ALLOW_INSECURE_PRIVATE_WS=1" \ + -v "$ROOT_DIR/scripts/e2e:/app/scripts/e2e:ro" \ "$IMAGE_NAME" \ bash -lc "set -euo pipefail entry=dist/index.mjs diff --git a/scripts/e2e/docker-openai-seed.ts b/scripts/e2e/docker-openai-seed.ts index bc2b5ef7e93..e876f0be3f5 100644 --- a/scripts/e2e/docker-openai-seed.ts +++ b/scripts/e2e/docker-openai-seed.ts @@ -1,8 +1,10 @@ +// Shared Docker E2E OpenAI provider config seed helper. +// Uses packaged plugin-sdk runtime modules so seeded configs match the npm tarball. import { applyProviderConfigWithDefaultModelPreset, type ModelDefinitionConfig, type OpenClawConfig, -} from "../../src/plugin-sdk/provider-onboard.ts"; +} from "../../dist/plugin-sdk/provider-onboard.js"; export type { OpenClawConfig }; diff --git a/scripts/e2e/doctor-install-switch-docker.sh b/scripts/e2e/doctor-install-switch-docker.sh index 12a30fb7938..5f5b1bc3a6c 100755 --- a/scripts/e2e/doctor-install-switch-docker.sh +++ b/scripts/e2e/doctor-install-switch-docker.sh @@ -1,14 +1,24 @@ #!/usr/bin/env bash +# Verifies doctor/daemon repair switches service entrypoints between package and +# git installs. Both fixtures come from the same prepared OpenClaw npm tarball. set -euo pipefail ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" source "$ROOT_DIR/scripts/lib/docker-e2e-image.sh" +source "$ROOT_DIR/scripts/lib/docker-e2e-package.sh" IMAGE_NAME="$(docker_e2e_resolve_image "openclaw-doctor-install-switch-e2e" OPENCLAW_DOCTOR_INSTALL_SWITCH_E2E_IMAGE)" +PACKAGE_TGZ="$(docker_e2e_prepare_package_tgz doctor-switch "${OPENCLAW_CURRENT_PACKAGE_TGZ:-}")" +# Bare lanes mount the package artifact instead of baking app sources into the image. +docker_e2e_package_mount_args "$PACKAGE_TGZ" -docker_e2e_build_or_reuse "$IMAGE_NAME" doctor-switch +docker_e2e_build_or_reuse "$IMAGE_NAME" doctor-switch "$ROOT_DIR/scripts/e2e/Dockerfile" "$ROOT_DIR" "bare" echo "Running doctor install switch E2E..." -docker run --rm -e COREPACK_ENABLE_DOWNLOAD_PROMPT=0 "$IMAGE_NAME" bash -lc ' +docker run --rm \ + -e COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \ + "${DOCKER_E2E_PACKAGE_ARGS[@]}" \ + "$IMAGE_NAME" \ + bash -lc ' set -euo pipefail # Keep logs focused; the npm global install step can emit noisy deprecation warnings. @@ -74,15 +84,23 @@ exit 0 LOGINCTL chmod +x /tmp/openclaw-bin/loginctl - # Install the npm-global variant from the local /app source. - # `npm pack` can emit script output; keep only the tarball name. - pkg_tgz="$(npm pack --ignore-scripts --silent /app | tail -n 1 | tr -d '\r')" - if [ ! -f "/app/$pkg_tgz" ]; then - echo "npm pack failed (expected /app/$pkg_tgz)" - exit 1 - fi + package_tgz="${OPENCLAW_CURRENT_PACKAGE_TGZ:?missing OPENCLAW_CURRENT_PACKAGE_TGZ}" + git_root="/tmp/openclaw-git" + mkdir -p "$git_root" + # The git-style install fixture is unpacked from the tarball so this lane does + # not depend on checkout source files being present in the Docker image. + tar -xzf "$package_tgz" -C "$git_root" --strip-components=1 + ( + cd "$git_root" + npm install --omit=optional --no-fund --no-audit >/tmp/openclaw-git-install.log 2>&1 + git init -q + git config user.email "docker-e2e@openclaw.local" + git config user.name "OpenClaw Docker E2E" + git add -A + git commit -qm "test fixture" + ) npm_log="/tmp/openclaw-doctor-switch-npm-install.log" - if ! npm install -g --prefix /tmp/npm-prefix "/app/$pkg_tgz" >"$npm_log" 2>&1; then + if ! npm install -g --prefix /tmp/npm-prefix "$package_tgz" >"$npm_log" 2>&1; then cat "$npm_log" exit 1 fi @@ -95,12 +113,12 @@ LOGINCTL npm_entry="$npm_root/dist/index.js" fi - if [ -f "/app/dist/index.mjs" ]; then - git_entry="/app/dist/index.mjs" + if [ -f "$git_root/dist/index.mjs" ]; then + git_entry="$git_root/dist/index.mjs" else - git_entry="/app/dist/index.js" + git_entry="$git_root/dist/index.js" fi - git_cli="/app/openclaw.mjs" + git_cli="$git_root/openclaw.mjs" assert_entrypoint() { local unit_path="$1" diff --git a/scripts/e2e/mcp-channels-docker.sh b/scripts/e2e/mcp-channels-docker.sh index bf20b92f58b..4b8f2db490b 100644 --- a/scripts/e2e/mcp-channels-docker.sh +++ b/scripts/e2e/mcp-channels-docker.sh @@ -1,4 +1,6 @@ #!/usr/bin/env bash +# Runs a Docker Gateway plus MCP stdio bridge smoke with seeded conversations and +# raw Claude notification-frame assertions. set -euo pipefail ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" @@ -18,6 +20,7 @@ trap cleanup EXIT docker_e2e_build_or_reuse "$IMAGE_NAME" mcp-channels echo "Running in-container gateway + MCP smoke..." +# Harness files are mounted read-only; the app under test comes from /app/dist. set +e docker run --rm \ --name "$CONTAINER_NAME" \ @@ -33,6 +36,7 @@ docker run --rm \ -e "GW_URL=ws://127.0.0.1:$PORT" \ -e "GW_TOKEN=$TOKEN" \ -e "OPENCLAW_ALLOW_INSECURE_PRIVATE_WS=1" \ + -v "$ROOT_DIR/scripts/e2e:/app/scripts/e2e:ro" \ "$IMAGE_NAME" \ bash -lc "set -euo pipefail entry=dist/index.mjs diff --git a/scripts/e2e/mcp-channels-harness.ts b/scripts/e2e/mcp-channels-harness.ts index 48c186dcdff..f44e6c34fc7 100644 --- a/scripts/e2e/mcp-channels-harness.ts +++ b/scripts/e2e/mcp-channels-harness.ts @@ -1,3 +1,6 @@ +// Shared MCP-channel Docker E2E harness helpers. +// The mounted test harness imports packaged dist modules so bridge assertions run +// against the OpenClaw npm tarball installed in the functional image. import { randomUUID } from "node:crypto"; import { mkdirSync, writeFileSync } from "node:fs"; import process from "node:process"; @@ -6,10 +9,10 @@ import { Client } from "@modelcontextprotocol/sdk/client/index.js"; import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js"; import { WebSocket } from "ws"; import { z } from "zod"; -import { PROTOCOL_VERSION } from "../../src/gateway/protocol/index.ts"; -import { formatErrorMessage } from "../../src/infra/errors.ts"; -import { rawDataToString } from "../../src/infra/ws.ts"; -import { readStringValue } from "../../src/shared/string-coerce.ts"; +import { PROTOCOL_VERSION } from "../../dist/gateway/protocol/index.js"; +import { formatErrorMessage } from "../../dist/infra/errors.js"; +import { rawDataToString } from "../../dist/infra/ws.js"; +import { readStringValue } from "../../dist/shared/string-coerce.js"; export const ClaudeChannelNotificationSchema = z.object({ method: z.literal("notifications/claude/channel"), diff --git a/scripts/e2e/npm-onboard-channel-agent-docker.sh b/scripts/e2e/npm-onboard-channel-agent-docker.sh index ddacdca359c..8e95d2467f0 100644 --- a/scripts/e2e/npm-onboard-channel-agent-docker.sh +++ b/scripts/e2e/npm-onboard-channel-agent-docker.sh @@ -1,11 +1,14 @@ #!/usr/bin/env bash +# Installs a prepared OpenClaw npm tarball in Docker, runs non-interactive +# onboarding for a channel, and verifies one mocked model turn through Gateway. set -euo pipefail ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" source "$ROOT_DIR/scripts/lib/docker-e2e-image.sh" +source "$ROOT_DIR/scripts/lib/docker-e2e-package.sh" IMAGE_NAME="$(docker_e2e_resolve_image "openclaw-npm-onboard-channel-agent-e2e" OPENCLAW_NPM_ONBOARD_E2E_IMAGE)" -DOCKER_TARGET="${OPENCLAW_NPM_ONBOARD_DOCKER_TARGET:-e2e-runner}" +DOCKER_TARGET="${OPENCLAW_NPM_ONBOARD_DOCKER_TARGET:-bare}" HOST_BUILD="${OPENCLAW_NPM_ONBOARD_HOST_BUILD:-1}" PACKAGE_TGZ="${OPENCLAW_NPM_ONBOARD_PACKAGE_TGZ:-}" CHANNEL="${OPENCLAW_NPM_ONBOARD_CHANNEL:-telegram}" @@ -22,32 +25,14 @@ docker_e2e_build_or_reuse "$IMAGE_NAME" npm-onboard-channel-agent "$ROOT_DIR/scr prepare_package_tgz() { if [ -n "$PACKAGE_TGZ" ]; then - if [ ! -f "$PACKAGE_TGZ" ]; then - echo "OPENCLAW_NPM_ONBOARD_PACKAGE_TGZ does not exist: $PACKAGE_TGZ" >&2 - exit 1 - fi - PACKAGE_TGZ="$(cd "$(dirname "$PACKAGE_TGZ")" && pwd)/$(basename "$PACKAGE_TGZ")" + PACKAGE_TGZ="$(docker_e2e_prepare_package_tgz npm-onboard-channel-agent "$PACKAGE_TGZ")" return 0 fi - - if [ "$HOST_BUILD" != "0" ]; then - echo "Building host package artifacts..." - run_logged npm-onboard-channel-agent-host-build pnpm build - else - echo "Skipping host build (OPENCLAW_NPM_ONBOARD_HOST_BUILD=0)" - fi - - echo "Writing package inventory and packing once..." - run_logged npm-onboard-channel-agent-inventory node --import tsx --input-type=module -e 'const { writePackageDistInventory } = await import("./src/infra/package-dist-inventory.ts"); await writePackageDistInventory(process.cwd());' - local pack_dir - pack_dir="$(mktemp -d "${TMPDIR:-/tmp}/openclaw-npm-onboard-pack.XXXXXX")" - run_logged npm-onboard-channel-agent-pack npm pack --ignore-scripts --pack-destination "$pack_dir" - PACKAGE_TGZ="$(find "$pack_dir" -maxdepth 1 -name 'openclaw-*.tgz' -print -quit)" - if [ -z "$PACKAGE_TGZ" ]; then - echo "missing packed OpenClaw tarball" >&2 + if [ "$HOST_BUILD" = "0" ] && [ -z "${OPENCLAW_CURRENT_PACKAGE_TGZ:-}" ]; then + echo "OPENCLAW_NPM_ONBOARD_HOST_BUILD=0 requires OPENCLAW_CURRENT_PACKAGE_TGZ or OPENCLAW_NPM_ONBOARD_PACKAGE_TGZ" >&2 exit 1 fi - PACKAGE_TGZ="$(cd "$(dirname "$PACKAGE_TGZ")" && pwd)/$(basename "$PACKAGE_TGZ")" + PACKAGE_TGZ="$(docker_e2e_prepare_package_tgz npm-onboard-channel-agent)" } prepare_package_tgz diff --git a/scripts/e2e/npm-telegram-live-docker.sh b/scripts/e2e/npm-telegram-live-docker.sh index 58e662cb13f..62b263f1a03 100755 --- a/scripts/e2e/npm-telegram-live-docker.sh +++ b/scripts/e2e/npm-telegram-live-docker.sh @@ -1,4 +1,6 @@ #!/usr/bin/env bash +# Installs a published OpenClaw npm package in Docker, performs Telegram +# onboarding/doctor recovery, then runs the Telegram QA live harness. set -euo pipefail ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" @@ -141,9 +143,12 @@ command -v openclaw openclaw --version EOF +# Mount only test harness/plugin QA sources; the SUT itself is the npm install. run_logged docker run --rm \ "${docker_env[@]}" \ -v "$ROOT_DIR/.artifacts:/app/.artifacts" \ + -v "$ROOT_DIR/scripts/e2e:/app/scripts/e2e:ro" \ + -v "$ROOT_DIR/extensions:/app/extensions:ro" \ -v "$npm_prefix_host:/npm-global" \ -i "$IMAGE_NAME" bash -s <<'EOF' set -euo pipefail @@ -171,6 +176,10 @@ trap 'status=$?; dump_hotpath_logs "$status"; exit "$status"' ERR command -v openclaw openclaw --version +# The mounted QA harness imports openclaw/plugin-sdk; point that package import +# at the installed npm package without copying source into the test image. +mkdir -p /app/node_modules +ln -sfn /npm-global/lib/node_modules/openclaw /app/node_modules/openclaw echo "Running installed npm onboarding recovery hot path..." OPENAI_API_KEY="${OPENAI_API_KEY:-sk-openclaw-npm-telegram-hotpath}" openclaw onboard --non-interactive --accept-risk \ diff --git a/scripts/e2e/npm-telegram-live-runner.ts b/scripts/e2e/npm-telegram-live-runner.ts index 4c0e02dce4b..51ca2930bf7 100644 --- a/scripts/e2e/npm-telegram-live-runner.ts +++ b/scripts/e2e/npm-telegram-live-runner.ts @@ -1,10 +1,12 @@ #!/usr/bin/env -S node --import tsx +// Telegram npm-live Docker harness. +// Runs QA live transport code against the published package installed in Docker. import fs from "node:fs/promises"; import path from "node:path"; import { pathToFileURL } from "node:url"; +import { formatErrorMessage } from "../../dist/infra/errors.js"; import { runTelegramQaLive } from "../../extensions/qa-lab/src/live-transports/telegram/telegram-live.runtime.ts"; -import { formatErrorMessage } from "../../src/infra/errors.ts"; function parseBoolean(value: string | undefined) { const normalized = value?.trim().toLowerCase(); diff --git a/scripts/e2e/openai-image-auth-docker.sh b/scripts/e2e/openai-image-auth-docker.sh index b8566e3c091..26479598225 100644 --- a/scripts/e2e/openai-image-auth-docker.sh +++ b/scripts/e2e/openai-image-auth-docker.sh @@ -1,4 +1,6 @@ #!/usr/bin/env bash +# Runs a mocked OpenAI image-generation auth smoke inside Docker against the +# package-installed functional E2E image. set -euo pipefail ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" @@ -10,9 +12,11 @@ SKIP_BUILD="${OPENCLAW_OPENAI_IMAGE_AUTH_E2E_SKIP_BUILD:-0}" docker_e2e_build_or_reuse "$IMAGE_NAME" openai-image-auth "$ROOT_DIR/scripts/e2e/Dockerfile" "$ROOT_DIR" "" "$SKIP_BUILD" echo "Running OpenAI image auth Docker E2E..." +# Harness files are mounted read-only; the app under test comes from /app/dist. run_logged openai-image-auth docker run --rm \ -e "OPENAI_API_KEY=sk-openclaw-image-auth-e2e" \ -e "OPENCLAW_QA_ALLOW_LOCAL_IMAGE_PROVIDER=1" \ + -v "$ROOT_DIR/scripts/e2e:/app/scripts/e2e:ro" \ -i "$IMAGE_NAME" bash -lc ' set -euo pipefail export HOME="$(mktemp -d "/tmp/openclaw-openai-image-auth.XXXXXX")" diff --git a/scripts/e2e/openwebui-docker.sh b/scripts/e2e/openwebui-docker.sh index 33a4e5a0a56..6c440f37426 100755 --- a/scripts/e2e/openwebui-docker.sh +++ b/scripts/e2e/openwebui-docker.sh @@ -1,4 +1,6 @@ #!/usr/bin/env bash +# Runs Open WebUI against a Dockerized OpenClaw Gateway and verifies the proxied +# chat path with a real OpenAI-compatible request. set -euo pipefail ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" @@ -55,6 +57,7 @@ echo "Creating Docker network..." docker_cmd docker network create "$NET_NAME" >/dev/null echo "Starting gateway container..." +# Harness files are mounted read-only; the app under test comes from /app/dist. docker_cmd docker run -d \ --name "$GW_NAME" \ --network "$NET_NAME" \ @@ -66,6 +69,7 @@ docker_cmd docker run -d \ -e "OPENCLAW_SKIP_CANVAS_HOST=1" \ -e OPENAI_API_KEY \ ${OPENAI_BASE_URL_VALUE:+-e OPENAI_BASE_URL} \ + -v "$ROOT_DIR/scripts/e2e:/app/scripts/e2e:ro" \ "$IMAGE_NAME" \ bash -lc ' set -euo pipefail diff --git a/scripts/e2e/pi-bundle-mcp-tools-docker-client.ts b/scripts/e2e/pi-bundle-mcp-tools-docker-client.ts index dd908764406..8a845b3438f 100644 --- a/scripts/e2e/pi-bundle-mcp-tools-docker-client.ts +++ b/scripts/e2e/pi-bundle-mcp-tools-docker-client.ts @@ -1,16 +1,19 @@ +// Pi bundle MCP tools Docker harness. +// Imports packaged dist modules so tool materialization is verified against the +// npm tarball installed in the functional image. import { randomUUID } from "node:crypto"; import fs from "node:fs/promises"; import { createRequire } from "node:module"; import os from "node:os"; import path from "node:path"; -import { materializeBundleMcpToolsForRun } from "../../src/agents/pi-bundle-mcp-materialize.ts"; +import { materializeBundleMcpToolsForRun } from "../../dist/agents/pi-bundle-mcp-materialize.js"; import { disposeAllSessionMcpRuntimes, getOrCreateSessionMcpRuntime, -} from "../../src/agents/pi-bundle-mcp-runtime.ts"; -import { applyFinalEffectiveToolPolicy } from "../../src/agents/pi-embedded-runner/effective-tool-policy.ts"; -import type { OpenClawConfig } from "../../src/config/types.openclaw.ts"; -import { getPluginToolMeta } from "../../src/plugins/tools.ts"; +} from "../../dist/agents/pi-bundle-mcp-runtime.js"; +import { applyFinalEffectiveToolPolicy } from "../../dist/agents/pi-embedded-runner/effective-tool-policy.js"; +import type { OpenClawConfig } from "../../dist/config/types.openclaw.js"; +import { getPluginToolMeta } from "../../dist/plugins/tools.js"; const require = createRequire(import.meta.url); diff --git a/scripts/e2e/pi-bundle-mcp-tools-docker.sh b/scripts/e2e/pi-bundle-mcp-tools-docker.sh index e17294cb619..8eced1626ea 100755 --- a/scripts/e2e/pi-bundle-mcp-tools-docker.sh +++ b/scripts/e2e/pi-bundle-mcp-tools-docker.sh @@ -1,4 +1,6 @@ #!/usr/bin/env bash +# Verifies embedded Pi bundle MCP tool materialization and tool-policy behavior +# inside the package-installed functional E2E image. set -euo pipefail ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" @@ -16,10 +18,12 @@ trap cleanup EXIT docker_e2e_build_or_reuse "$IMAGE_NAME" pi-bundle-mcp-tools echo "Running in-container Pi bundle MCP tool availability smoke..." +# Harness files are mounted read-only; the app under test comes from /app/dist. set +e docker run --rm \ --name "$CONTAINER_NAME" \ -e "OPENCLAW_STATE_DIR=/tmp/openclaw-state" \ + -v "$ROOT_DIR/scripts/e2e:/app/scripts/e2e:ro" \ "$IMAGE_NAME" \ bash -lc "set -euo pipefail node --import tsx scripts/e2e/pi-bundle-mcp-tools-docker-client.ts diff --git a/scripts/e2e/plugin-update-unchanged-docker.sh b/scripts/e2e/plugin-update-unchanged-docker.sh index ab9f3308c1c..3121a1340c9 100755 --- a/scripts/e2e/plugin-update-unchanged-docker.sh +++ b/scripts/e2e/plugin-update-unchanged-docker.sh @@ -1,24 +1,34 @@ #!/usr/bin/env bash +# Verifies `openclaw plugins update` is a no-op for an already-current plugin. +# The CLI under test is installed from the prepared npm tarball in a bare runner. set -euo pipefail ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" source "$ROOT_DIR/scripts/lib/docker-e2e-image.sh" +source "$ROOT_DIR/scripts/lib/docker-e2e-package.sh" IMAGE_NAME="$(docker_e2e_resolve_image "openclaw-plugin-update-e2e" OPENCLAW_PLUGIN_UPDATE_E2E_IMAGE)" SKIP_BUILD="${OPENCLAW_PLUGIN_UPDATE_E2E_SKIP_BUILD:-0}" +PACKAGE_TGZ="$(docker_e2e_prepare_package_tgz plugin-update "${OPENCLAW_CURRENT_PACKAGE_TGZ:-}")" +# Bare lanes mount the package artifact instead of baking app sources into the image. +docker_e2e_package_mount_args "$PACKAGE_TGZ" -docker_e2e_build_or_reuse "$IMAGE_NAME" plugin-update "$ROOT_DIR/scripts/e2e/Dockerfile" "$ROOT_DIR" "" "$SKIP_BUILD" +docker_e2e_build_or_reuse "$IMAGE_NAME" plugin-update "$ROOT_DIR/scripts/e2e/Dockerfile" "$ROOT_DIR" "bare" "$SKIP_BUILD" echo "Running unchanged plugin update smoke..." docker run --rm \ -e COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \ -e OPENCLAW_SKIP_CHANNELS=1 \ -e OPENCLAW_SKIP_PROVIDERS=1 \ + "${DOCKER_E2E_PACKAGE_ARGS[@]}" \ "$IMAGE_NAME" \ bash -lc "set -euo pipefail -entry=dist/index.mjs -[ -f \"\$entry\" ] || entry=dist/index.js +package_tgz=\"\${OPENCLAW_CURRENT_PACKAGE_TGZ:?missing OPENCLAW_CURRENT_PACKAGE_TGZ}\" +npm install -g --prefix /tmp/npm-prefix \"\$package_tgz\" --no-fund --no-audit >/tmp/openclaw-install.log 2>&1 +entry=\"/tmp/npm-prefix/lib/node_modules/openclaw/dist/index.mjs\" +[ -f \"\$entry\" ] || entry=/tmp/npm-prefix/lib/node_modules/openclaw/dist/index.js export NPM_CONFIG_REGISTRY=http://127.0.0.1:4873 +export PATH=\"/tmp/npm-prefix/bin:\$PATH\" mkdir -p \"\$HOME/.openclaw/extensions/lossless-claw\" cat > \"\$HOME/.openclaw/extensions/lossless-claw/package.json\" <<'JSON' diff --git a/scripts/e2e/session-runtime-context-docker-client.ts b/scripts/e2e/session-runtime-context-docker-client.ts index a8cd145363e..753c6e36c77 100644 --- a/scripts/e2e/session-runtime-context-docker-client.ts +++ b/scripts/e2e/session-runtime-context-docker-client.ts @@ -1,3 +1,6 @@ +// Session runtime-context Docker harness. +// Imports packaged dist modules so transcript behavior is verified against the +// npm tarball installed in the functional image. import { spawnSync } from "node:child_process"; import fs from "node:fs/promises"; import os from "node:os"; @@ -6,7 +9,7 @@ import { SessionManager } from "@mariozechner/pi-coding-agent"; import { queueRuntimeContextForNextTurn, resolveRuntimeContextPromptParts, -} from "../../src/agents/pi-embedded-runner/run/runtime-context-prompt.js"; +} from "../../dist/agents/pi-embedded-runner/run/runtime-context-prompt.js"; type TranscriptEntry = { type?: string; diff --git a/scripts/e2e/session-runtime-context-docker.sh b/scripts/e2e/session-runtime-context-docker.sh index a057c14b175..205c9ce058e 100644 --- a/scripts/e2e/session-runtime-context-docker.sh +++ b/scripts/e2e/session-runtime-context-docker.sh @@ -1,4 +1,6 @@ #!/usr/bin/env bash +# Verifies hidden runtime context transcript persistence in Docker using the +# package-installed functional E2E image. set -euo pipefail ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" @@ -17,10 +19,12 @@ trap cleanup EXIT docker_e2e_build_or_reuse "$IMAGE_NAME" session-runtime-context echo "Running session runtime context Docker E2E..." +# Harness files are mounted read-only; the app under test comes from /app/dist. set +e docker run --rm \ --name "$CONTAINER_NAME" \ -e COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \ + -v "$ROOT_DIR/scripts/e2e:/app/scripts/e2e:ro" \ "$IMAGE_NAME" \ bash -lc 'set -euo pipefail; node --import tsx scripts/e2e/session-runtime-context-docker-client.ts' \ >"$RUN_LOG" 2>&1 diff --git a/scripts/e2e/update-channel-switch-docker.sh b/scripts/e2e/update-channel-switch-docker.sh index 203c211db4e..c9bca848fb8 100755 --- a/scripts/e2e/update-channel-switch-docker.sh +++ b/scripts/e2e/update-channel-switch-docker.sh @@ -1,19 +1,26 @@ #!/usr/bin/env bash +# Exercises package-to-git and git-to-package update channel switching in Docker. +# Both package and git fixtures are derived from the same prepared npm tarball. set -euo pipefail ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" source "$ROOT_DIR/scripts/lib/docker-e2e-image.sh" +source "$ROOT_DIR/scripts/lib/docker-e2e-package.sh" IMAGE_NAME="$(docker_e2e_resolve_image "openclaw-update-channel-switch-e2e" OPENCLAW_UPDATE_CHANNEL_SWITCH_E2E_IMAGE)" SKIP_BUILD="${OPENCLAW_UPDATE_CHANNEL_SWITCH_E2E_SKIP_BUILD:-0}" +PACKAGE_TGZ="$(docker_e2e_prepare_package_tgz update-channel-switch "${OPENCLAW_CURRENT_PACKAGE_TGZ:-}")" +# Bare lanes mount the package artifact instead of baking app sources into the image. +docker_e2e_package_mount_args "$PACKAGE_TGZ" -docker_e2e_build_or_reuse "$IMAGE_NAME" update-channel-switch "$ROOT_DIR/scripts/e2e/Dockerfile" "$ROOT_DIR" "" "$SKIP_BUILD" +docker_e2e_build_or_reuse "$IMAGE_NAME" update-channel-switch "$ROOT_DIR/scripts/e2e/Dockerfile" "$ROOT_DIR" "bare" "$SKIP_BUILD" echo "Running update channel switch E2E..." docker run --rm \ -e COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \ -e OPENCLAW_SKIP_CHANNELS=1 \ -e OPENCLAW_SKIP_PROVIDERS=1 \ + "${DOCKER_E2E_PACKAGE_ARGS[@]}" \ "$IMAGE_NAME" \ bash -lc 'set -euo pipefail @@ -29,32 +36,26 @@ export OPENCLAW_DISABLE_BUNDLED_PLUGINS=1 export OPENCLAW_NO_ONBOARD=1 export OPENCLAW_NO_PROMPT=1 -cat > /app/.gitignore <<'"'"'GITIGNORE'"'"' -node_modules -**/node_modules/ -dist -dist-runtime -.turbo -coverage -GITIGNORE - -node --import tsx scripts/write-package-dist-inventory.ts +package_tgz="${OPENCLAW_CURRENT_PACKAGE_TGZ:?missing OPENCLAW_CURRENT_PACKAGE_TGZ}" +git_root="/tmp/openclaw-git" +mkdir -p "$git_root" +# Build the fake git install from the packed package contents, not the checkout. +tar -xzf "$package_tgz" -C "$git_root" --strip-components=1 +( + cd "$git_root" + npm install --omit=optional --no-fund --no-audit >/tmp/openclaw-git-install.log 2>&1 +) git config --global user.email "docker-e2e@openclaw.local" git config --global user.name "OpenClaw Docker E2E" git config --global gc.auto 0 -git -C /app init -q -git -C /app config gc.auto 0 -git -C /app add -A -git -C /app commit -qm "test fixture" -fixture_sha="$(git -C /app rev-parse HEAD)" +git -C "$git_root" init -q +git -C "$git_root" config gc.auto 0 +git -C "$git_root" add -A +git -C "$git_root" commit -qm "test fixture" +fixture_sha="$(git -C "$git_root" rev-parse HEAD)" -pkg_tgz="$(npm pack --ignore-scripts --silent --pack-destination /tmp /app | tail -n 1 | tr -d "\r")" -pkg_tgz_path="/tmp/$pkg_tgz" -if [ ! -f "$pkg_tgz_path" ]; then - echo "npm pack failed (expected $pkg_tgz_path)" - exit 1 -fi +pkg_tgz_path="$package_tgz" npm install -g --prefix /tmp/npm-prefix --omit=optional "$pkg_tgz_path" @@ -70,7 +71,7 @@ cat > "$HOME/.openclaw/openclaw.json" <<'"'"'JSON'"'"' } JSON -export OPENCLAW_GIT_DIR=/app +export OPENCLAW_GIT_DIR="$git_root" export OPENCLAW_UPDATE_DEV_TARGET_REF="$fixture_sha" echo "==> package -> git dev channel" diff --git a/scripts/lib/docker-e2e-image.sh b/scripts/lib/docker-e2e-image.sh index c4cf8383b43..7e1fe576ee6 100644 --- a/scripts/lib/docker-e2e-image.sh +++ b/scripts/lib/docker-e2e-image.sh @@ -1,10 +1,15 @@ #!/usr/bin/env bash +# +# Shared Docker E2E image resolver/builder. +# Suite-specific scripts call this to resolve overrides, reuse pulled images, or +# build the runner/functional images with the prepared OpenClaw package tarball. DOCKER_E2E_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" ROOT_DIR="${ROOT_DIR:-$(cd "$DOCKER_E2E_LIB_DIR/../.." && pwd)}" source "$DOCKER_E2E_LIB_DIR/docker-e2e-logs.sh" source "$DOCKER_E2E_LIB_DIR/docker-build.sh" +source "$DOCKER_E2E_LIB_DIR/docker-e2e-package.sh" docker_e2e_resolve_image() { local default_image="$1" @@ -34,6 +39,11 @@ docker_e2e_build_or_reuse() { local context="${4:-$ROOT_DIR}" local target="${5:-}" local skip_build="${6:-0}" + if [ -z "$target" ] && [ "$dockerfile" = "$ROOT_DIR/scripts/e2e/Dockerfile" ]; then + # The generic E2E image defaults to the package-installed app image; tests + # that need a clean install runner pass target=bare explicitly. + target="functional" + fi if [ "${OPENCLAW_SKIP_DOCKER_BUILD:-0}" = "1" ] || [ "$skip_build" = "1" ]; then echo "Reusing Docker image: $image_name" @@ -53,6 +63,15 @@ docker_e2e_build_or_reuse() { if [ -n "$target" ]; then build_args+=(--target "$target") fi + if [ "$target" = "functional" ]; then + local package_tgz + local package_context + package_tgz="$(docker_e2e_prepare_package_tgz "$label")" + package_context="$(docker_e2e_prepare_package_context "$package_tgz")" + # The Dockerfile never sees repo sources as app input; functional installs + # exactly this tarball through a named BuildKit context. + build_args+=(--build-context "openclaw_package=$package_context") + fi build_args+=(-t "$image_name" -f "$dockerfile" "$context") docker_build_run "$label-build" "${build_args[@]}" } diff --git a/scripts/lib/docker-e2e-package.sh b/scripts/lib/docker-e2e-package.sh new file mode 100644 index 00000000000..418905caf52 --- /dev/null +++ b/scripts/lib/docker-e2e-package.sh @@ -0,0 +1,63 @@ +#!/usr/bin/env bash +# +# Shared package helpers for Docker E2E scripts. +# Builds or resolves one OpenClaw npm tarball and exposes mount/build-context +# helpers so Docker lanes test the package artifact instead of repo sources. + +DOCKER_E2E_PACKAGE_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +ROOT_DIR="${ROOT_DIR:-$(cd "$DOCKER_E2E_PACKAGE_LIB_DIR/../.." && pwd)}" + +if ! declare -F run_logged >/dev/null 2>&1; then + source "$DOCKER_E2E_PACKAGE_LIB_DIR/docker-e2e-logs.sh" +fi + +docker_e2e_abs_path() { + local file="$1" + (cd "$(dirname "$file")" && printf '%s/%s\n' "$(pwd)" "$(basename "$file")") +} + +docker_e2e_prepare_package_tgz() { + local label="$1" + local package_tgz="${2:-${OPENCLAW_CURRENT_PACKAGE_TGZ:-}}" + + if [ -n "$package_tgz" ]; then + if [ ! -f "$package_tgz" ]; then + echo "OpenClaw package tarball does not exist: $package_tgz" >&2 + return 1 + fi + docker_e2e_abs_path "$package_tgz" + return 0 + fi + + echo "Building OpenClaw package artifacts..." + run_logged "$label-host-build" pnpm build + echo "Writing package inventory and packing OpenClaw once..." + run_logged "$label-inventory" node --import tsx --input-type=module -e 'const { writePackageDistInventory } = await import("./src/infra/package-dist-inventory.ts"); await writePackageDistInventory(process.cwd());' + + local pack_dir + pack_dir="$(mktemp -d "${TMPDIR:-/tmp}/openclaw-docker-e2e-pack.XXXXXX")" + run_logged "$label-pack" npm pack --ignore-scripts --pack-destination "$pack_dir" + + package_tgz="$(find "$pack_dir" -maxdepth 1 -name 'openclaw-*.tgz' -print -quit)" + if [ -z "$package_tgz" ]; then + echo "missing packed OpenClaw tarball" >&2 + return 1 + fi + docker_e2e_abs_path "$package_tgz" +} + +docker_e2e_prepare_package_context() { + local package_tgz="$1" + local context_dir + context_dir="$(mktemp -d "${TMPDIR:-/tmp}/openclaw-docker-e2e-package-context.XXXXXX")" + # BuildKit named contexts must be directories, so expose the tarball as a + # stable filename inside a tiny temporary context. + cp "$package_tgz" "$context_dir/openclaw-current.tgz" + printf '%s\n' "$context_dir" +} + +docker_e2e_package_mount_args() { + local package_tgz="$1" + local target="${2:-/tmp/openclaw-current.tgz}" + DOCKER_E2E_PACKAGE_ARGS=(-v "$package_tgz:$target:ro" -e "OPENCLAW_CURRENT_PACKAGE_TGZ=$target") +} diff --git a/scripts/test-docker-all.mjs b/scripts/test-docker-all.mjs index 4d43b59c51f..b3d769022ee 100644 --- a/scripts/test-docker-all.mjs +++ b/scripts/test-docker-all.mjs @@ -1,3 +1,6 @@ +// Docker E2E aggregate scheduler. +// Builds shared Docker images, prepares one OpenClaw npm tarball, assigns lanes +// to bare/functional images, and runs lanes through weighted resource pools. import { spawn } from "node:child_process"; import fs from "node:fs"; import { mkdir, readFile } from "node:fs/promises"; @@ -661,8 +664,12 @@ function buildLaneRerunCommand(name, baseEnv) { ["OPENCLAW_DOCKER_E2E_IMAGE", image || DEFAULT_E2E_IMAGE], ["OPENCLAW_DOCKER_E2E_BARE_IMAGE", baseEnv.OPENCLAW_DOCKER_E2E_BARE_IMAGE], ["OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE", baseEnv.OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE], + ["OPENCLAW_CURRENT_PACKAGE_TGZ", baseEnv.OPENCLAW_CURRENT_PACKAGE_TGZ], ]; - return `${env.map(([key, value]) => `${key}=${shellQuote(value)}`).join(" ")} pnpm test:docker:all`; + return `${env + .filter(([, value]) => value !== undefined && value !== "") + .map(([key, value]) => `${key}=${shellQuote(value)}`) + .join(" ")} pnpm test:docker:all`; } function findLaneByName(name) { @@ -805,11 +812,8 @@ function printLaneManifest(label, poolLanes, timingStore) { } } -function lanesNeedBundledPackage(poolLanes) { - return poolLanes.some( - (poolLane) => - poolLane.name === "npm-onboard-channel-agent" || poolLane.name.startsWith("bundled-channel"), - ); +function lanesNeedOpenClawPackage(poolLanes) { + return poolLanes.some((poolLane) => poolLane.e2eImageKind); } function dockerPreflightContainerNames(raw) { @@ -1011,30 +1015,33 @@ async function runDockerPreflight(baseEnv, options) { console.log(`==> Docker preflight run: ${elapsedSeconds}s`); } -async function prepareBundledChannelPackage(baseEnv, logDir) { - if (baseEnv.OPENCLAW_BUNDLED_CHANNEL_PACKAGE_TGZ) { - console.log(`==> Bundled channel package: ${baseEnv.OPENCLAW_BUNDLED_CHANNEL_PACKAGE_TGZ}`); +async function prepareOpenClawPackage(baseEnv, logDir) { + const existing = + baseEnv.OPENCLAW_CURRENT_PACKAGE_TGZ || + baseEnv.OPENCLAW_BUNDLED_CHANNEL_PACKAGE_TGZ || + baseEnv.OPENCLAW_NPM_ONBOARD_PACKAGE_TGZ; + if (existing) { + const packageTgz = path.resolve(existing); + baseEnv.OPENCLAW_CURRENT_PACKAGE_TGZ = packageTgz; + baseEnv.OPENCLAW_BUNDLED_CHANNEL_PACKAGE_TGZ ||= packageTgz; + baseEnv.OPENCLAW_NPM_ONBOARD_PACKAGE_TGZ ||= packageTgz; + baseEnv.OPENCLAW_BUNDLED_CHANNEL_HOST_BUILD = "0"; + baseEnv.OPENCLAW_NPM_ONBOARD_HOST_BUILD = "0"; + console.log(`==> OpenClaw package: ${packageTgz}`); return; } - const packDir = path.join(logDir, "bundled-channel-package"); + const packDir = path.join(logDir, "openclaw-package"); await mkdir(packDir, { recursive: true }); - const packScript = [ - "set -euo pipefail", - "node --import tsx --input-type=module -e \"const { writePackageDistInventory } = await import('./src/infra/package-dist-inventory.ts'); await writePackageDistInventory(process.cwd());\"", - "npm pack --silent --ignore-scripts --pack-destination /tmp/openclaw-pack >/tmp/openclaw-pack.out", - "cat /tmp/openclaw-pack.out", - ].join("\n"); + await runForeground("Build OpenClaw package artifacts once", "pnpm build", baseEnv); await runForeground( - "Pack bundled channel package once from bare Docker E2E image", - [ - "docker run --rm", - "-e COREPACK_ENABLE_DOWNLOAD_PROMPT=0", - `-v ${shellQuote(packDir)}:/tmp/openclaw-pack`, - shellQuote(baseEnv.OPENCLAW_DOCKER_E2E_BARE_IMAGE), - "bash -lc", - shellQuote(packScript), - ].join(" "), + "Write OpenClaw package inventory", + "node --import tsx --input-type=module -e \"const { writePackageDistInventory } = await import('./src/infra/package-dist-inventory.ts'); await writePackageDistInventory(process.cwd());\"", + baseEnv, + ); + await runForeground( + "Pack OpenClaw package once", + `npm pack --silent --ignore-scripts --pack-destination ${shellQuote(packDir)}`, baseEnv, ); @@ -1045,11 +1052,12 @@ async function prepareBundledChannelPackage(baseEnv, logDir) { if (!packed) { throw new Error(`missing packed OpenClaw tarball in ${packDir}`); } - baseEnv.OPENCLAW_BUNDLED_CHANNEL_PACKAGE_TGZ = path.join(packDir, packed); + baseEnv.OPENCLAW_CURRENT_PACKAGE_TGZ = path.join(packDir, packed); + baseEnv.OPENCLAW_BUNDLED_CHANNEL_PACKAGE_TGZ = baseEnv.OPENCLAW_CURRENT_PACKAGE_TGZ; baseEnv.OPENCLAW_BUNDLED_CHANNEL_HOST_BUILD = "0"; - baseEnv.OPENCLAW_NPM_ONBOARD_PACKAGE_TGZ = baseEnv.OPENCLAW_BUNDLED_CHANNEL_PACKAGE_TGZ; + baseEnv.OPENCLAW_NPM_ONBOARD_PACKAGE_TGZ = baseEnv.OPENCLAW_CURRENT_PACKAGE_TGZ; baseEnv.OPENCLAW_NPM_ONBOARD_HOST_BUILD = "0"; - console.log(`==> Bundled channel package: ${baseEnv.OPENCLAW_BUNDLED_CHANNEL_PACKAGE_TGZ}`); + console.log(`==> OpenClaw package: ${baseEnv.OPENCLAW_CURRENT_PACKAGE_TGZ}`); } function laneEnv(poolLane, baseEnv, logDir, cacheKey) { @@ -1530,10 +1538,17 @@ async function main() { }); }, ); + const scheduledLanes = [...orderedLanes, ...orderedTailLanes]; + if (lanesNeedOpenClawPackage(scheduledLanes)) { + await runPhase(phases, "prepare-openclaw-package", {}, async () => { + await prepareOpenClawPackage(baseEnv, logDir); + }); + } else { + console.log("==> OpenClaw package: not needed for selected lanes"); + } if (buildEnabled) { const buildEntries = []; - const scheduledLanes = [...orderedLanes, ...orderedTailLanes]; if (scheduledLanes.some((poolLane) => poolLane.live)) { buildEntries.push({ command: "pnpm test:docker:live-build", @@ -1547,7 +1562,7 @@ async function main() { command: "pnpm test:docker:e2e-build", env: { OPENCLAW_DOCKER_E2E_IMAGE: baseEnv.OPENCLAW_DOCKER_E2E_BARE_IMAGE, - OPENCLAW_DOCKER_E2E_TARGET: "build", + OPENCLAW_DOCKER_E2E_TARGET: "bare", }, label: `shared bare Docker E2E image once: ${baseEnv.OPENCLAW_DOCKER_E2E_BARE_IMAGE}`, phaseDetails: { image: baseEnv.OPENCLAW_DOCKER_E2E_BARE_IMAGE, imageKind: "bare" }, @@ -1573,13 +1588,6 @@ async function main() { } else { console.log(`==> Shared Docker image builds: skipped`); } - if (lanesNeedBundledPackage([...orderedLanes, ...orderedTailLanes])) { - await runPhase(phases, "prepare-bundled-channel-package", { imageKind: "bare" }, async () => { - await prepareBundledChannelPackage(baseEnv, logDir); - }); - } else { - console.log("==> Bundled channel package: not needed for selected lanes"); - } const options = { ...schedulerOptions, From 9f5bc5465c0ef9811cd487b5891113d013fedd1c Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Sun, 26 Apr 2026 23:10:27 +0100 Subject: [PATCH 059/418] style: format codex and loader tests --- extensions/codex/src/app-server/computer-use.ts | 2 +- extensions/codex/src/command-formatters.ts | 2 +- src/plugins/jiti-loader-cache.test.ts | 6 +----- 3 files changed, 3 insertions(+), 7 deletions(-) diff --git a/extensions/codex/src/app-server/computer-use.ts b/extensions/codex/src/app-server/computer-use.ts index 204111dfc82..b0138e88d18 100644 --- a/extensions/codex/src/app-server/computer-use.ts +++ b/extensions/codex/src/app-server/computer-use.ts @@ -6,9 +6,9 @@ import { type CodexComputerUseConfig, type ResolvedCodexComputerUseConfig, } from "./config.js"; +import type { v2 } from "./protocol-generated/typescript/index.js"; import type { JsonValue } from "./protocol.js"; import { requestCodexAppServerJson } from "./request.js"; -import type { v2 } from "./protocol-generated/typescript/index.js"; export type CodexComputerUseRequest = ( method: string, diff --git a/extensions/codex/src/command-formatters.ts b/extensions/codex/src/command-formatters.ts index 7ad43c15604..6346c0e83fe 100644 --- a/extensions/codex/src/command-formatters.ts +++ b/extensions/codex/src/command-formatters.ts @@ -1,5 +1,5 @@ -import type { CodexAppServerModelListResult } from "./app-server/models.js"; import type { CodexComputerUseStatus } from "./app-server/computer-use.js"; +import type { CodexAppServerModelListResult } from "./app-server/models.js"; import { isJsonObject, type JsonObject, type JsonValue } from "./app-server/protocol.js"; import type { SafeValue } from "./command-rpc.js"; diff --git a/src/plugins/jiti-loader-cache.test.ts b/src/plugins/jiti-loader-cache.test.ts index 81422f737dc..44c5f3ada79 100644 --- a/src/plugins/jiti-loader-cache.test.ts +++ b/src/plugins/jiti-loader-cache.test.ts @@ -312,10 +312,6 @@ describe("getCachedPluginJitiLoader", () => { const loose = loader as unknown as (t: string, ...a: unknown[]) => unknown; loose("/repo/dist/extensions/demo/api.js", { hint: "x" }, 42); - expect(jitiLoader).toHaveBeenCalledWith( - "/repo/dist/extensions/demo/api.js", - { hint: "x" }, - 42, - ); + expect(jitiLoader).toHaveBeenCalledWith("/repo/dist/extensions/demo/api.js", { hint: "x" }, 42); }); }); From 3746e5b969d74ecdc91796ca932c31fdc41a11ac Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Sun, 26 Apr 2026 23:11:18 +0100 Subject: [PATCH 060/418] ci: cap Telegram E2E build cache --- .github/workflows/npm-telegram-beta-e2e.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/npm-telegram-beta-e2e.yml b/.github/workflows/npm-telegram-beta-e2e.yml index d69c0f5e9dd..394513f9fcc 100644 --- a/.github/workflows/npm-telegram-beta-e2e.yml +++ b/.github/workflows/npm-telegram-beta-e2e.yml @@ -79,6 +79,8 @@ jobs: - name: Set up Blacksmith Docker Builder uses: useblacksmith/setup-docker-builder@ac083cc84672d01c60d5e8561d0a939b697de542 # v1 + with: + max-cache-size-mb: 800000 - name: Build Docker E2E image uses: useblacksmith/build-push-action@cbd1f60d194a98cb3be5523b15134501eaf0fbf3 # v2 From ff9fefb79beac75e9a257aa43fce39db36fa828e Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Sun, 26 Apr 2026 23:16:00 +0100 Subject: [PATCH 061/418] fix(agents): validate thinking with model catalog --- src/agents/agent-command.ts | 14 +++++++++++-- src/auto-reply/thinking.test.ts | 35 +++++++++++++++++++++++++++++++++ src/auto-reply/thinking.ts | 19 ++++++++++++++---- 3 files changed, 62 insertions(+), 6 deletions(-) diff --git a/src/agents/agent-command.ts b/src/agents/agent-command.ts index d9e57648577..af28a3d17dd 100644 --- a/src/agents/agent-command.ts +++ b/src/agents/agent-command.ts @@ -813,17 +813,27 @@ async function agentCommandInternal( catalog: catalogForThinking.length > 0 ? catalogForThinking : undefined, }); } - if (!isThinkingLevelSupported({ provider, model, level: resolvedThinkLevel })) { + const catalogForThinking = modelCatalog ?? allowedModelCatalog; + const thinkingCatalog = catalogForThinking.length > 0 ? catalogForThinking : undefined; + if ( + !isThinkingLevelSupported({ + provider, + model, + level: resolvedThinkLevel, + catalog: thinkingCatalog, + }) + ) { const explicitThink = Boolean(thinkOnce || thinkOverride); if (explicitThink) { throw new Error( - `Thinking level "${resolvedThinkLevel}" is not supported for ${provider}/${model}. Use one of: ${formatThinkingLevels(provider, model)}.`, + `Thinking level "${resolvedThinkLevel}" is not supported for ${provider}/${model}. Use one of: ${formatThinkingLevels(provider, model, ", ", thinkingCatalog)}.`, ); } const fallbackThinkLevel = resolveSupportedThinkingLevel({ provider, model, level: resolvedThinkLevel, + catalog: thinkingCatalog, }); if (fallbackThinkLevel !== resolvedThinkLevel) { const previousThinkLevel = resolvedThinkLevel; diff --git a/src/auto-reply/thinking.test.ts b/src/auto-reply/thinking.test.ts index 7ab99adf885..ed32e6de8e8 100644 --- a/src/auto-reply/thinking.test.ts +++ b/src/auto-reply/thinking.test.ts @@ -12,6 +12,8 @@ let listThinkingLevelOptions: typeof import("./thinking.js").listThinkingLevelOp let listThinkingLevels: typeof import("./thinking.js").listThinkingLevels; let normalizeReasoningLevel: typeof import("./thinking.js").normalizeReasoningLevel; let normalizeThinkLevel: typeof import("./thinking.js").normalizeThinkLevel; +let isThinkingLevelSupported: typeof import("./thinking.js").isThinkingLevelSupported; +let formatThinkingLevels: typeof import("./thinking.js").formatThinkingLevels; let resolveSupportedThinkingLevel: typeof import("./thinking.js").resolveSupportedThinkingLevel; let resolveThinkingDefaultForModel: typeof import("./thinking.js").resolveThinkingDefaultForModel; @@ -42,6 +44,8 @@ beforeEach(async () => { listThinkingLevels, normalizeReasoningLevel, normalizeThinkLevel, + isThinkingLevelSupported, + formatThinkingLevels, resolveSupportedThinkingLevel, resolveThinkingDefaultForModel, } = await loadFreshThinkingModuleForTest()); @@ -170,6 +174,37 @@ describe("listThinkingLevels", () => { expect(listThinkingLevelLabels("demo", "demo-model")).toEqual(["off", "on"]); }); + it("passes catalog reasoning into provider thinking profiles for support checks", () => { + providerRuntimeMocks.resolveProviderThinkingProfile.mockImplementation(({ context }) => ({ + levels: + context.reasoning === true + ? [{ id: "off" }, { id: "low" }, { id: "medium" }, { id: "high" }, { id: "max" }] + : [{ id: "off" }], + defaultLevel: "off", + })); + const catalog = [{ provider: "ollama", id: "gpt-oss:20b", name: "gpt-oss", reasoning: true }]; + + expect( + isThinkingLevelSupported({ + provider: "ollama", + model: "gpt-oss:20b", + level: "max", + catalog, + }), + ).toBe(true); + expect(formatThinkingLevels("ollama", "gpt-oss:20b", ", ", catalog)).toBe( + "off, low, medium, high, max", + ); + expect( + resolveSupportedThinkingLevel({ + provider: "ollama", + model: "gpt-oss:20b", + level: "max", + catalog, + }), + ).toBe("max"); + }); + it("maps stale unsupported levels to the largest profile level", () => { providerRuntimeMocks.resolveProviderThinkingProfile.mockReturnValue({ levels: [{ id: "off" }, { id: "high" }], diff --git a/src/auto-reply/thinking.ts b/src/auto-reply/thinking.ts index e0abe1bac52..7d1aec14951 100644 --- a/src/auto-reply/thinking.ts +++ b/src/auto-reply/thinking.ts @@ -194,8 +194,11 @@ function supportsThinkingLevel( provider: string | null | undefined, model: string | null | undefined, level: ThinkLevel, + catalog?: ThinkingCatalogEntry[], ): boolean { - return resolveThinkingProfile({ provider, model }).levels.some((entry) => entry.id === level); + return resolveThinkingProfile({ provider, model, catalog }).levels.some( + (entry) => entry.id === level, + ); } export function supportsXHighThinking(provider?: string | null, model?: string | null): boolean { @@ -223,8 +226,10 @@ export function formatThinkingLevels( provider?: string | null, model?: string | null, separator = ", ", + catalog?: ThinkingCatalogEntry[], ): string { - return listThinkingLevelLabels(provider, model).join(separator); + const profile = resolveThinkingProfile({ provider, model, catalog }); + return profile.levels.map(({ label }) => label).join(separator); } export function resolveThinkingDefaultForModel(params: { @@ -262,8 +267,9 @@ export function isThinkingLevelSupported(params: { provider?: string | null; model?: string | null; level: ThinkLevel; + catalog?: ThinkingCatalogEntry[]; }): boolean { - return supportsThinkingLevel(params.provider, params.model, params.level); + return supportsThinkingLevel(params.provider, params.model, params.level, params.catalog); } function resolveSupportedThinkingLevelFromProfile( @@ -286,7 +292,12 @@ export function resolveSupportedThinkingLevel(params: { provider?: string | null; model?: string | null; level: ThinkLevel; + catalog?: ThinkingCatalogEntry[]; }): ThinkLevel { - const profile = resolveThinkingProfile({ provider: params.provider, model: params.model }); + const profile = resolveThinkingProfile({ + provider: params.provider, + model: params.model, + catalog: params.catalog, + }); return resolveSupportedThinkingLevelFromProfile(profile, params.level); } From 5aa3779d8c5e1ad7e13580e395f442115d4a8188 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Sun, 26 Apr 2026 23:20:06 +0100 Subject: [PATCH 062/418] ci: disable bonjour in install e2e docker --- scripts/docker/install-sh-e2e/run.sh | 1 + test/scripts/test-install-sh-docker.test.ts | 9 +++++++++ 2 files changed, 10 insertions(+) diff --git a/scripts/docker/install-sh-e2e/run.sh b/scripts/docker/install-sh-e2e/run.sh index ecc8af74cc5..81aa51cb182 100755 --- a/scripts/docker/install-sh-e2e/run.sh +++ b/scripts/docker/install-sh-e2e/run.sh @@ -24,6 +24,7 @@ AGENT_TURN_TIMEOUT_SECONDS="${OPENCLAW_INSTALL_E2E_AGENT_TURN_TIMEOUT_SECONDS:-6 export NPM_CONFIG_PREFIX="${NPM_CONFIG_PREFIX:-$HOME/.npm-global}" mkdir -p "$NPM_CONFIG_PREFIX" export PATH="$NPM_CONFIG_PREFIX/bin:$PATH" +export OPENCLAW_DISABLE_BONJOUR="${OPENCLAW_DISABLE_BONJOUR:-1}" if [[ "$MODELS_MODE" != "both" && "$MODELS_MODE" != "openai" && "$MODELS_MODE" != "anthropic" ]]; then echo "ERROR: OPENCLAW_E2E_MODELS must be one of: both|openai|anthropic" >&2 diff --git a/test/scripts/test-install-sh-docker.test.ts b/test/scripts/test-install-sh-docker.test.ts index 288a7b4a547..1f5b42f4cfb 100644 --- a/test/scripts/test-install-sh-docker.test.ts +++ b/test/scripts/test-install-sh-docker.test.ts @@ -3,6 +3,7 @@ import { describe, expect, it } from "vitest"; const SCRIPT_PATH = "scripts/test-install-sh-docker.sh"; const SMOKE_RUNNER_PATH = "scripts/docker/install-sh-smoke/run.sh"; +const E2E_RUNNER_PATH = "scripts/docker/install-sh-e2e/run.sh"; const BUN_GLOBAL_SMOKE_PATH = "scripts/e2e/bun-global-install-smoke.sh"; const INSTALL_SMOKE_WORKFLOW_PATH = ".github/workflows/install-smoke.yml"; const RELEASE_CHECKS_WORKFLOW_PATH = ".github/workflows/openclaw-release-checks.yml"; @@ -128,6 +129,14 @@ describe("install-sh smoke runner", () => { }); }); +describe("install-sh e2e runner", () => { + it("disables Bonjour for Docker loopback gateway checks", () => { + const script = readFileSync(E2E_RUNNER_PATH, "utf8"); + + expect(script).toContain('export OPENCLAW_DISABLE_BONJOUR="${OPENCLAW_DISABLE_BONJOUR:-1}"'); + }); +}); + describe("bun global install smoke", () => { it("packs the current tree and verifies image-provider discovery through Bun", () => { const script = readFileSync(BUN_GLOBAL_SMOKE_PATH, "utf8"); From ff6044f4411d3e720940d60990e624bd7be29d46 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Sun, 26 Apr 2026 23:25:01 +0100 Subject: [PATCH 063/418] docs(changelog): note Ollama thinking validation fix --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index d8d9efbfeea..fa35dd36768 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,6 +15,7 @@ Docs: https://docs.openclaw.ai - Logging/sessions: apply configured redaction patterns to persisted session transcript text and accept escaped character classes in safe custom redaction regexes, so transcript JSONL no longer keeps matching sensitive text in the clear. Fixes #42982. Thanks @panpan0000. - Providers/Ollama: honor `/api/show` capabilities when registering local models so non-tool Ollama models no longer receive the agent tool surface, and keep native Ollama thinking opt-in instead of enabling it by default. Fixes #64710 and duplicate #65343. Thanks @yuan-b, @netherby, @xilopaint, and @Diyforfun2026. - Providers/Ollama: expose native Ollama thinking effort levels so `/think max` is accepted for reasoning-capable Ollama models and maps to Ollama's highest supported `think` effort. Fixes #71584. Thanks @g0st1n. +- Agents/Ollama: validate explicit `--thinking max` against catalog-discovered Ollama reasoning metadata so local agent runs accept the same native thinking levels shown in the model catalog. Fixes #71584. Thanks @g0st1n. - Auto-reply: poison inbound message dedupe after replay-unsafe provider/runtime failures so retries stay safe before visible progress but cannot duplicate messages after block output, tool side effects, or session progress. Fixes #69303; keeps #58549 and #64606 as duplicate validation. Thanks @martingarramon, @NikolaFC, and @zeroth-blip. - Agents/model fallback: jump directly to a known later live-session model redirect instead of walking unrelated fallback candidates, while preserving the already-landed live-session/fallback loop guard. Fixes #57471; related loop family already closed via #58496. Thanks @yuxiaoyang2007-prog. - Gateway/Bonjour: keep @homebridge/ciao cancellation handlers registered across advertiser restarts so late probing cancellations cannot crash Linux and other mDNS-churned gateways. Thanks @codex. From c6cf37068cae6524e119697ad94780ea1fff11f3 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 15:26:53 -0700 Subject: [PATCH 064/418] fix(feishu): repair interactive card content extraction (#72397) --- CHANGELOG.md | 1 + extensions/feishu/src/post.ts | 3 + extensions/feishu/src/send.test.ts | 89 ++++++++++++++++++ extensions/feishu/src/send.ts | 142 +++++++++++++++++++++++------ 4 files changed, 207 insertions(+), 28 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index fa35dd36768..81e1a04fcb9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,7 @@ Docs: https://docs.openclaw.ai ### Fixes +- Feishu: extract quoted/replied interactive-card text across schema 1.0, schema 2.0, i18n, template-variable, and post-format fallback shapes without carrying broad generated/config churn from related parser experiments. (#38776, #60383, #42218, #45936) Thanks @lishuaigit, @lskun, @just2gooo, and @Br1an67. - Exec approvals: accept a symlinked `OPENCLAW_HOME` as the trusted approvals root while still rejecting symlinked `.openclaw` path components below it. (#64663) Thanks @FunJim. - Logging: add top-level `hostname`, flattened `message`, and available `agent_id`, `session_id`, and `channel` fields to file-log JSONL records for multi-agent filtering without removing existing structured log arguments. Fixes #51075. Thanks @stevengonsalvez. - ACP: route server logs to stderr before Gateway config/bootstrap work so ACP stdout remains JSON-RPC only for IDE integrations. Fixes #49060. Thanks @Hollychou924. diff --git a/extensions/feishu/src/post.ts b/extensions/feishu/src/post.ts index 448e9b0f719..a56ed4f300c 100644 --- a/extensions/feishu/src/post.ts +++ b/extensions/feishu/src/post.ts @@ -166,6 +166,9 @@ function renderElement( } case "emotion": return renderEmotionElement(element); + case "md": + case "lark_md": + return toStringOrEmpty(element.text) || toStringOrEmpty(element.content); case "br": return "\n"; case "hr": diff --git a/extensions/feishu/src/send.test.ts b/extensions/feishu/src/send.test.ts index bc461e7d824..87bb596bdb8 100644 --- a/extensions/feishu/src/send.test.ts +++ b/extensions/feishu/src/send.test.ts @@ -168,6 +168,95 @@ describe("getMessageFeishu", () => { ); }); + it("falls through empty interactive card element arrays and locale variants", async () => { + mockClientGet.mockResolvedValueOnce({ + code: 0, + data: { + items: [ + { + message_id: "om_i18n_card", + chat_id: "oc_i18n_card", + msg_type: "interactive", + body: { + content: JSON.stringify({ + elements: [], + body: { elements: [] }, + i18n_elements: { + zh_cn: [], + en_us: [ + { + tag: "markdown", + content: "hello ${count} {{label}} {{metadata}}", + }, + ], + }, + template_variable: { + count: 2, + label: "tasks", + metadata: { ignored: true }, + }, + }), + }, + }, + ], + }, + }); + + const result = await getMessageFeishu({ + cfg: {} as ClawdbotConfig, + messageId: "om_i18n_card", + }); + + expect(result).toEqual( + expect.objectContaining({ + messageId: "om_i18n_card", + chatId: "oc_i18n_card", + contentType: "interactive", + content: "hello 2 tasks {{metadata}}", + }), + ); + }); + + it("falls back to post-format content when interactive card elements are empty", async () => { + mockClientGet.mockResolvedValueOnce({ + code: 0, + data: { + items: [ + { + message_id: "om_post_card", + chat_id: "oc_post_card", + msg_type: "interactive", + body: { + content: JSON.stringify({ + elements: [], + post: { + zh_cn: { + title: "Card summary", + content: [[{ tag: "md", text: "**fallback** body" }]], + }, + }, + }), + }, + }, + ], + }, + }); + + const result = await getMessageFeishu({ + cfg: {} as ClawdbotConfig, + messageId: "om_post_card", + }); + + expect(result).toEqual( + expect.objectContaining({ + messageId: "om_post_card", + chatId: "oc_post_card", + contentType: "interactive", + content: "Card summary\n\n**fallback** body", + }), + ); + }); + it("extracts text content from post messages", async () => { mockClientGet.mockResolvedValueOnce({ code: 0, diff --git a/extensions/feishu/src/send.ts b/extensions/feishu/src/send.ts index 338565167d0..ccaeb908c00 100644 --- a/extensions/feishu/src/send.ts +++ b/extensions/feishu/src/send.ts @@ -15,6 +15,8 @@ import { resolveFeishuSendTarget } from "./send-target.js"; import type { FeishuChatType, FeishuMessageInfo, FeishuSendResult } from "./types.js"; const WITHDRAWN_REPLY_ERROR_CODES = new Set([230011, 231003]); +const INTERACTIVE_CARD_FALLBACK_TEXT = "[Interactive Card]"; +const POST_FALLBACK_TEXT = "[Rich text message]"; const FEISHU_CARD_TEMPLATES = new Set([ "blue", "green", @@ -60,6 +62,10 @@ function isWithdrawnReplyError(err: unknown): boolean { return false; } +function isRecord(value: unknown): value is Record { + return Boolean(value && typeof value === "object" && !Array.isArray(value)); +} + type FeishuCreateMessageClient = { im: { message: { @@ -179,41 +185,121 @@ async function sendReplyOrFallbackDirect( return toFeishuSendResult(response, params.directParams.receiveId); } -function parseInteractiveCardContent(parsed: unknown): string { - if (!parsed || typeof parsed !== "object") { - return "[Interactive Card]"; +function normalizeCardTemplateVariable(value: unknown): string | undefined { + if (typeof value === "string") { + return value; } - - // Support both schema 1.0 (top-level `elements`) and 2.0 (`body.elements`). - const candidate = parsed as { elements?: unknown; body?: { elements?: unknown } }; - const elements = Array.isArray(candidate.elements) - ? candidate.elements - : Array.isArray(candidate.body?.elements) - ? candidate.body.elements - : null; - if (!elements) { - return "[Interactive Card]"; + if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") { + return String(value); } + return undefined; +} +function readCardTemplateVariables(parsed: Record): Map { + const variables = new Map(); + for (const source of [parsed.template_variable, parsed.template_variables]) { + if (!isRecord(source)) { + continue; + } + for (const [key, value] of Object.entries(source)) { + const normalized = normalizeCardTemplateVariable(value); + if (normalized !== undefined) { + variables.set(key, normalized); + } + } + } + return variables; +} + +function applyCardTemplateVariables(text: string, variables: Map): string { + if (variables.size === 0) { + return text; + } + return text.replace(/\$\{([A-Za-z0-9_.-]+)\}|\{\{\s*([A-Za-z0-9_.-]+)\s*\}\}/g, (match, a, b) => { + const variableName = typeof a === "string" ? a : b; + return variables.get(variableName) ?? match; + }); +} + +function extractInteractiveElementText( + element: unknown, + variables: Map, +): string | undefined { + if (!isRecord(element)) { + return undefined; + } + const tag = typeof element.tag === "string" ? element.tag : ""; + const text = isRecord(element.text) ? element.text : undefined; + + if (tag === "div" && typeof text?.content === "string") { + return applyCardTemplateVariables(text.content, variables); + } + if ((tag === "markdown" || tag === "lark_md") && typeof element.content === "string") { + return applyCardTemplateVariables(element.content, variables); + } + if (tag === "plain_text" && typeof element.content === "string") { + return applyCardTemplateVariables(element.content, variables); + } + return undefined; +} + +function extractInteractiveElementsText( + elements: unknown[], + variables: Map, +): string { const texts: string[] = []; for (const element of elements) { - if (!element || typeof element !== "object") { - continue; - } - const item = element as { - tag?: string; - content?: string; - text?: { content?: string }; - }; - if (item.tag === "div" && typeof item.text?.content === "string") { - texts.push(item.text.content); - continue; - } - if (item.tag === "markdown" && typeof item.content === "string") { - texts.push(item.content); + const text = extractInteractiveElementText(element, variables); + if (text !== undefined) { + texts.push(text); } } - return texts.join("\n").trim() || "[Interactive Card]"; + return texts.join("\n").trim(); +} + +function readInteractiveElementArrays(parsed: Record): unknown[][] { + const body = isRecord(parsed.body) ? parsed.body : undefined; + const elementArrays: unknown[][] = []; + + for (const candidate of [parsed.elements, body?.elements]) { + if (Array.isArray(candidate)) { + elementArrays.push(candidate); + } + } + + for (const candidate of [parsed.i18n_elements, body?.i18n_elements]) { + if (!isRecord(candidate)) { + continue; + } + for (const localeElements of Object.values(candidate)) { + if (Array.isArray(localeElements)) { + elementArrays.push(localeElements); + } + } + } + + return elementArrays; +} + +function parseInteractivePostFallback(parsed: unknown): string | undefined { + const textContent = parsePostContent(JSON.stringify(parsed)).textContent.trim(); + return textContent && textContent !== POST_FALLBACK_TEXT ? textContent : undefined; +} + +function parseInteractiveCardContent(parsed: unknown): string { + if (!isRecord(parsed)) { + return INTERACTIVE_CARD_FALLBACK_TEXT; + } + + const variables = readCardTemplateVariables(parsed); + for (const elements of readInteractiveElementArrays(parsed)) { + const text = extractInteractiveElementsText(elements, variables); + if (text) { + return text; + } + } + + return parseInteractivePostFallback(parsed) ?? INTERACTIVE_CARD_FALLBACK_TEXT; } function parseFeishuMessageContent(rawContent: string, msgType: string): string { From 8a60e57846ce7b68b4e4ef3656d8420d2d705b90 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Sun, 26 Apr 2026 23:27:02 +0100 Subject: [PATCH 065/418] fix: keep bonjour failures non-fatal --- scripts/docker/install-sh-e2e/run.sh | 1 - ...handled-rejections.fatal-detection.test.ts | 26 +++++++++++ src/infra/unhandled-rejections.ts | 46 ++++++++++++++++++- test/scripts/test-install-sh-docker.test.ts | 9 ---- 4 files changed, 71 insertions(+), 11 deletions(-) diff --git a/scripts/docker/install-sh-e2e/run.sh b/scripts/docker/install-sh-e2e/run.sh index 81aa51cb182..ecc8af74cc5 100755 --- a/scripts/docker/install-sh-e2e/run.sh +++ b/scripts/docker/install-sh-e2e/run.sh @@ -24,7 +24,6 @@ AGENT_TURN_TIMEOUT_SECONDS="${OPENCLAW_INSTALL_E2E_AGENT_TURN_TIMEOUT_SECONDS:-6 export NPM_CONFIG_PREFIX="${NPM_CONFIG_PREFIX:-$HOME/.npm-global}" mkdir -p "$NPM_CONFIG_PREFIX" export PATH="$NPM_CONFIG_PREFIX/bin:$PATH" -export OPENCLAW_DISABLE_BONJOUR="${OPENCLAW_DISABLE_BONJOUR:-1}" if [[ "$MODELS_MODE" != "both" && "$MODELS_MODE" != "openai" && "$MODELS_MODE" != "anthropic" ]]; then echo "ERROR: OPENCLAW_E2E_MODELS must be one of: both|openai|anthropic" >&2 diff --git a/src/infra/unhandled-rejections.fatal-detection.test.ts b/src/infra/unhandled-rejections.fatal-detection.test.ts index f010dfbbd52..6ee3a604010 100644 --- a/src/infra/unhandled-rejections.fatal-detection.test.ts +++ b/src/infra/unhandled-rejections.fatal-detection.test.ts @@ -196,6 +196,32 @@ describe("installUnhandledRejectionHandler - fatal detection", () => { ); }); + it("does not exit on known Bonjour dependency failures", () => { + const bonjourCases: unknown[] = [ + new Error("CIAO ANNOUNCEMENT CANCELLED"), + new Error("CIAO PROBING CANCELLED"), + Object.assign( + new Error("Reached illegal state! IPV4 address change from defined to undefined!"), + { name: "AssertionError" }, + ), + Object.assign( + new Error( + "IP address version must match. Netmask cannot have a version different from the address!", + ), + { name: "AssertionError" }, + ), + ]; + + for (const bonjourErr of bonjourCases) { + expectExitCodeFromUnhandled(bonjourErr, []); + } + + expect(consoleWarnSpy).toHaveBeenCalledWith( + "[openclaw] Non-fatal unhandled rejection (continuing):", + expect.stringContaining("CIAO ANNOUNCEMENT CANCELLED"), + ); + }); + it("exits on generic errors without code", () => { const genericErr = new Error("Something went wrong"); diff --git a/src/infra/unhandled-rejections.ts b/src/infra/unhandled-rejections.ts index 219fda7a10f..c2c89702c80 100644 --- a/src/infra/unhandled-rejections.ts +++ b/src/infra/unhandled-rejections.ts @@ -116,6 +116,12 @@ const TRANSIENT_SQLITE_MESSAGE_SNIPPETS = [ "disk i/o error", ]; +const CIAO_CANCELLATION_MESSAGE_RE = /^CIAO (?:ANNOUNCEMENT|PROBING) CANCELLED\b/u; +const CIAO_INTERFACE_ASSERTION_MESSAGE_RE = + /REACHED ILLEGAL STATE!?\s+IPV4 ADDRESS CHANGE FROM (?:DEFINED TO UNDEFINED|UNDEFINED TO DEFINED)!?/u; +const CIAO_NETMASK_ASSERTION_MESSAGE_RE = + /IP ADDRESS VERSION MUST MATCH\.\s+NETMASK CANNOT HAVE A VERSION DIFFERENT FROM THE ADDRESS!?/u; + function hasSqliteSignal(err: unknown): boolean { if (!err || typeof err !== "object") { return false; @@ -335,8 +341,46 @@ export function isTransientSqliteError(err: unknown): boolean { return false; } +export function isKnownBonjourDependencyError(err: unknown): boolean { + if (!err) { + return false; + } + + for (const candidate of collectNestedUnhandledErrorCandidates(err)) { + const rawMessage = + candidate && typeof candidate === "object" + ? (candidate as { message?: unknown }).message + : undefined; + const message = + typeof candidate === "string" + ? candidate + : candidate && typeof candidate === "object" + ? typeof rawMessage === "string" + ? rawMessage + : "" + : ""; + const normalized = message.trim().toUpperCase(); + if (!normalized) { + continue; + } + if ( + CIAO_CANCELLATION_MESSAGE_RE.test(normalized) || + CIAO_INTERFACE_ASSERTION_MESSAGE_RE.test(normalized) || + CIAO_NETMASK_ASSERTION_MESSAGE_RE.test(normalized) + ) { + return true; + } + } + + return false; +} + export function isTransientUnhandledRejectionError(err: unknown): boolean { - return isTransientNetworkError(err) || isTransientSqliteError(err); + return ( + isTransientNetworkError(err) || + isTransientSqliteError(err) || + isKnownBonjourDependencyError(err) + ); } export function registerUnhandledRejectionHandler(handler: UnhandledRejectionHandler): () => void { diff --git a/test/scripts/test-install-sh-docker.test.ts b/test/scripts/test-install-sh-docker.test.ts index 1f5b42f4cfb..288a7b4a547 100644 --- a/test/scripts/test-install-sh-docker.test.ts +++ b/test/scripts/test-install-sh-docker.test.ts @@ -3,7 +3,6 @@ import { describe, expect, it } from "vitest"; const SCRIPT_PATH = "scripts/test-install-sh-docker.sh"; const SMOKE_RUNNER_PATH = "scripts/docker/install-sh-smoke/run.sh"; -const E2E_RUNNER_PATH = "scripts/docker/install-sh-e2e/run.sh"; const BUN_GLOBAL_SMOKE_PATH = "scripts/e2e/bun-global-install-smoke.sh"; const INSTALL_SMOKE_WORKFLOW_PATH = ".github/workflows/install-smoke.yml"; const RELEASE_CHECKS_WORKFLOW_PATH = ".github/workflows/openclaw-release-checks.yml"; @@ -129,14 +128,6 @@ describe("install-sh smoke runner", () => { }); }); -describe("install-sh e2e runner", () => { - it("disables Bonjour for Docker loopback gateway checks", () => { - const script = readFileSync(E2E_RUNNER_PATH, "utf8"); - - expect(script).toContain('export OPENCLAW_DISABLE_BONJOUR="${OPENCLAW_DISABLE_BONJOUR:-1}"'); - }); -}); - describe("bun global install smoke", () => { it("packs the current tree and verifies image-provider discovery through Bun", () => { const script = readFileSync(BUN_GLOBAL_SMOKE_PATH, "utf8"); From 0472b6197ab2a62f39ce9e685b54299f4a921742 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Sun, 26 Apr 2026 23:27:35 +0100 Subject: [PATCH 066/418] chore: clarify bonjour fatal guard naming --- src/infra/unhandled-rejections.fatal-detection.test.ts | 2 +- src/infra/unhandled-rejections.ts | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/infra/unhandled-rejections.fatal-detection.test.ts b/src/infra/unhandled-rejections.fatal-detection.test.ts index 6ee3a604010..a868487bf5d 100644 --- a/src/infra/unhandled-rejections.fatal-detection.test.ts +++ b/src/infra/unhandled-rejections.fatal-detection.test.ts @@ -196,7 +196,7 @@ describe("installUnhandledRejectionHandler - fatal detection", () => { ); }); - it("does not exit on known Bonjour dependency failures", () => { + it("does not exit on known Bonjour advertiser failures", () => { const bonjourCases: unknown[] = [ new Error("CIAO ANNOUNCEMENT CANCELLED"), new Error("CIAO PROBING CANCELLED"), diff --git a/src/infra/unhandled-rejections.ts b/src/infra/unhandled-rejections.ts index c2c89702c80..6d9e569d190 100644 --- a/src/infra/unhandled-rejections.ts +++ b/src/infra/unhandled-rejections.ts @@ -341,7 +341,7 @@ export function isTransientSqliteError(err: unknown): boolean { return false; } -export function isKnownBonjourDependencyError(err: unknown): boolean { +export function isNonFatalBonjourAdvertiserError(err: unknown): boolean { if (!err) { return false; } @@ -379,7 +379,7 @@ export function isTransientUnhandledRejectionError(err: unknown): boolean { return ( isTransientNetworkError(err) || isTransientSqliteError(err) || - isKnownBonjourDependencyError(err) + isNonFatalBonjourAdvertiserError(err) ); } From c9c0ab3a44904a2d2bc815799c1deabb270c5fdb Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Sun, 26 Apr 2026 23:29:40 +0100 Subject: [PATCH 067/418] fix(bonjour): keep ciao failure handling extension-owned --- extensions/bonjour/src/ciao.test.ts | 28 +++++++++ extensions/bonjour/src/ciao.ts | 62 ++++++++++++++++--- ...handled-rejections.fatal-detection.test.ts | 26 -------- src/infra/unhandled-rejections.ts | 46 +------------- 4 files changed, 81 insertions(+), 81 deletions(-) diff --git a/extensions/bonjour/src/ciao.test.ts b/extensions/bonjour/src/ciao.test.ts index 6d40787331c..dacd7d7a1f0 100644 --- a/extensions/bonjour/src/ciao.test.ts +++ b/extensions/bonjour/src/ciao.test.ts @@ -48,6 +48,34 @@ describe("bonjour-ciao", () => { expect(ignoreCiaoUnhandledRejection(new Error("CIAO PROBING CANCELLED"))).toBe(true); }); + it("suppresses wrapped ciao cancellation rejections", () => { + expect( + classifyCiaoUnhandledRejection({ + reason: new Error("CIAO ANNOUNCEMENT CANCELLED"), + }), + ).toEqual({ + kind: "cancellation", + formatted: "CIAO ANNOUNCEMENT CANCELLED", + }); + }); + + it("suppresses aggregate ciao assertion rejections", () => { + expect( + classifyCiaoUnhandledRejection( + new AggregateError([ + Object.assign( + new Error("Reached illegal state! IPV4 address change from defined to undefined!"), + { name: "AssertionError" }, + ), + ]), + ), + ).toEqual({ + kind: "interface-assertion", + formatted: + "AssertionError: Reached illegal state! IPV4 address change from defined to undefined!", + }); + }); + it("suppresses lower-case string cancellation reasons too", () => { expect(ignoreCiaoUnhandledRejection("ciao announcement cancelled during cleanup")).toBe(true); }); diff --git a/extensions/bonjour/src/ciao.ts b/extensions/bonjour/src/ciao.ts index d8a9a4a5c0c..7f129c968b5 100644 --- a/extensions/bonjour/src/ciao.ts +++ b/extensions/bonjour/src/ciao.ts @@ -11,17 +11,59 @@ export type CiaoProcessErrorClassification = | { kind: "interface-assertion"; formatted: string } | { kind: "netmask-assertion"; formatted: string }; +function collectCiaoProcessErrorCandidates(reason: unknown): unknown[] { + const queue: unknown[] = [reason]; + const seen = new Set(); + const candidates: unknown[] = []; + + while (queue.length > 0) { + const current = queue.shift(); + if (current == null || seen.has(current)) { + continue; + } + seen.add(current); + candidates.push(current); + + if (!current || typeof current !== "object") { + continue; + } + const record = current as Record; + for (const nested of [ + record.cause, + record.reason, + record.original, + record.error, + record.data, + ]) { + if (nested != null && !seen.has(nested)) { + queue.push(nested); + } + } + if (Array.isArray(record.errors)) { + for (const nested of record.errors) { + if (nested != null && !seen.has(nested)) { + queue.push(nested); + } + } + } + } + + return candidates; +} + export function classifyCiaoProcessError(reason: unknown): CiaoProcessErrorClassification | null { - const formatted = formatBonjourError(reason); - const message = formatted.toUpperCase(); - if (CIAO_CANCELLATION_MESSAGE_RE.test(message)) { - return { kind: "cancellation", formatted }; - } - if (CIAO_INTERFACE_ASSERTION_MESSAGE_RE.test(message)) { - return { kind: "interface-assertion", formatted }; - } - if (CIAO_NETMASK_ASSERTION_MESSAGE_RE.test(message)) { - return { kind: "netmask-assertion", formatted }; + for (const candidate of collectCiaoProcessErrorCandidates(reason)) { + const formatted = formatBonjourError(candidate); + const message = formatted.toUpperCase(); + if (CIAO_CANCELLATION_MESSAGE_RE.test(message)) { + return { kind: "cancellation", formatted }; + } + if (CIAO_INTERFACE_ASSERTION_MESSAGE_RE.test(message)) { + return { kind: "interface-assertion", formatted }; + } + if (CIAO_NETMASK_ASSERTION_MESSAGE_RE.test(message)) { + return { kind: "netmask-assertion", formatted }; + } } return null; } diff --git a/src/infra/unhandled-rejections.fatal-detection.test.ts b/src/infra/unhandled-rejections.fatal-detection.test.ts index a868487bf5d..f010dfbbd52 100644 --- a/src/infra/unhandled-rejections.fatal-detection.test.ts +++ b/src/infra/unhandled-rejections.fatal-detection.test.ts @@ -196,32 +196,6 @@ describe("installUnhandledRejectionHandler - fatal detection", () => { ); }); - it("does not exit on known Bonjour advertiser failures", () => { - const bonjourCases: unknown[] = [ - new Error("CIAO ANNOUNCEMENT CANCELLED"), - new Error("CIAO PROBING CANCELLED"), - Object.assign( - new Error("Reached illegal state! IPV4 address change from defined to undefined!"), - { name: "AssertionError" }, - ), - Object.assign( - new Error( - "IP address version must match. Netmask cannot have a version different from the address!", - ), - { name: "AssertionError" }, - ), - ]; - - for (const bonjourErr of bonjourCases) { - expectExitCodeFromUnhandled(bonjourErr, []); - } - - expect(consoleWarnSpy).toHaveBeenCalledWith( - "[openclaw] Non-fatal unhandled rejection (continuing):", - expect.stringContaining("CIAO ANNOUNCEMENT CANCELLED"), - ); - }); - it("exits on generic errors without code", () => { const genericErr = new Error("Something went wrong"); diff --git a/src/infra/unhandled-rejections.ts b/src/infra/unhandled-rejections.ts index 6d9e569d190..219fda7a10f 100644 --- a/src/infra/unhandled-rejections.ts +++ b/src/infra/unhandled-rejections.ts @@ -116,12 +116,6 @@ const TRANSIENT_SQLITE_MESSAGE_SNIPPETS = [ "disk i/o error", ]; -const CIAO_CANCELLATION_MESSAGE_RE = /^CIAO (?:ANNOUNCEMENT|PROBING) CANCELLED\b/u; -const CIAO_INTERFACE_ASSERTION_MESSAGE_RE = - /REACHED ILLEGAL STATE!?\s+IPV4 ADDRESS CHANGE FROM (?:DEFINED TO UNDEFINED|UNDEFINED TO DEFINED)!?/u; -const CIAO_NETMASK_ASSERTION_MESSAGE_RE = - /IP ADDRESS VERSION MUST MATCH\.\s+NETMASK CANNOT HAVE A VERSION DIFFERENT FROM THE ADDRESS!?/u; - function hasSqliteSignal(err: unknown): boolean { if (!err || typeof err !== "object") { return false; @@ -341,46 +335,8 @@ export function isTransientSqliteError(err: unknown): boolean { return false; } -export function isNonFatalBonjourAdvertiserError(err: unknown): boolean { - if (!err) { - return false; - } - - for (const candidate of collectNestedUnhandledErrorCandidates(err)) { - const rawMessage = - candidate && typeof candidate === "object" - ? (candidate as { message?: unknown }).message - : undefined; - const message = - typeof candidate === "string" - ? candidate - : candidate && typeof candidate === "object" - ? typeof rawMessage === "string" - ? rawMessage - : "" - : ""; - const normalized = message.trim().toUpperCase(); - if (!normalized) { - continue; - } - if ( - CIAO_CANCELLATION_MESSAGE_RE.test(normalized) || - CIAO_INTERFACE_ASSERTION_MESSAGE_RE.test(normalized) || - CIAO_NETMASK_ASSERTION_MESSAGE_RE.test(normalized) - ) { - return true; - } - } - - return false; -} - export function isTransientUnhandledRejectionError(err: unknown): boolean { - return ( - isTransientNetworkError(err) || - isTransientSqliteError(err) || - isNonFatalBonjourAdvertiserError(err) - ); + return isTransientNetworkError(err) || isTransientSqliteError(err); } export function registerUnhandledRejectionHandler(handler: UnhandledRejectionHandler): () => void { From a2adb05f746def87813fde47eaf39e681dc74565 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Sun, 26 Apr 2026 23:36:19 +0100 Subject: [PATCH 068/418] refactor(test): split docker e2e planner --- package.json | 3 +- scripts/check-docker-e2e-boundaries.mjs | 51 ++ scripts/docker-e2e.mjs | 86 +++ .../bundled-channel-runtime-deps-docker.sh | 19 +- scripts/e2e/crestodian-first-run-docker.sh | 3 +- scripts/e2e/crestodian-planner-docker.sh | 3 +- scripts/e2e/crestodian-rescue-docker.sh | 3 +- scripts/e2e/cron-mcp-cleanup-docker.sh | 3 +- scripts/e2e/mcp-channels-docker.sh | 3 +- .../e2e/npm-onboard-channel-agent-docker.sh | 12 +- scripts/e2e/npm-telegram-live-docker.sh | 3 +- scripts/e2e/openai-image-auth-docker.sh | 3 +- scripts/e2e/openwebui-docker.sh | 3 +- scripts/e2e/pi-bundle-mcp-tools-docker.sh | 3 +- scripts/e2e/session-runtime-context-docker.sh | 3 +- scripts/lib/docker-e2e-package.sh | 17 +- scripts/lib/docker-e2e-plan.mjs | 236 ++++++ scripts/lib/docker-e2e-scenarios.mjs | 417 ++++++++++ scripts/package-openclaw-for-docker.mjs | 148 ++++ scripts/test-docker-all.mjs | 714 ++---------------- 20 files changed, 1056 insertions(+), 677 deletions(-) create mode 100644 scripts/check-docker-e2e-boundaries.mjs create mode 100644 scripts/docker-e2e.mjs create mode 100644 scripts/lib/docker-e2e-plan.mjs create mode 100644 scripts/lib/docker-e2e-scenarios.mjs create mode 100644 scripts/package-openclaw-for-docker.mjs diff --git a/package.json b/package.json index ba3f9def3e5..c62824334d5 100644 --- a/package.json +++ b/package.json @@ -1400,6 +1400,7 @@ "lint:auth:no-pairing-store-group": "node scripts/check-no-pairing-store-group-auth.mjs", "lint:auth:pairing-account-scope": "node scripts/check-pairing-account-scope.mjs", "lint:core": "node scripts/run-oxlint.mjs --tsconfig tsconfig.oxlint.core.json src ui packages", + "lint:docker-e2e": "node scripts/check-docker-e2e-boundaries.mjs", "lint:docs": "pnpm dlx markdownlint-cli2", "lint:docs:fix": "pnpm dlx markdownlint-cli2 --fix", "lint:extensions": "node scripts/run-oxlint.mjs --tsconfig tsconfig.oxlint.extensions.json extensions", @@ -1415,7 +1416,7 @@ "lint:plugins:no-monolithic-plugin-sdk-entry-imports": "node --import tsx scripts/check-no-monolithic-plugin-sdk-entry-imports.ts", "lint:plugins:no-register-http-handler": "node scripts/check-no-register-http-handler.mjs", "lint:plugins:plugin-sdk-subpaths-exported": "node scripts/check-plugin-sdk-subpath-exports.mjs", - "lint:scripts": "node scripts/run-oxlint.mjs --tsconfig tsconfig.oxlint.scripts.json scripts", + "lint:scripts": "pnpm lint:docker-e2e && node scripts/run-oxlint.mjs --tsconfig tsconfig.oxlint.scripts.json scripts", "lint:swift": "swiftlint lint --config .swiftlint.yml && (cd apps/ios && swiftlint lint --config .swiftlint.yml)", "lint:tmp:channel-agnostic-boundaries": "node scripts/check-channel-agnostic-boundaries.mjs", "lint:tmp:dynamic-import-warts": "node scripts/check-dynamic-import-warts.mjs", diff --git a/scripts/check-docker-e2e-boundaries.mjs b/scripts/check-docker-e2e-boundaries.mjs new file mode 100644 index 00000000000..885b248de14 --- /dev/null +++ b/scripts/check-docker-e2e-boundaries.mjs @@ -0,0 +1,51 @@ +#!/usr/bin/env node +// Cheap guard for Docker E2E test boundaries. +// Docker E2E must test packaged npm tarballs and package-installed images, not +// the source checkout copied or mounted as the app under test. +import fs from "node:fs"; +import path from "node:path"; +import { fileURLToPath } from "node:url"; + +const ROOT_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), ".."); +const errors = []; + +function readText(relativePath) { + return fs.readFileSync(path.join(ROOT_DIR, relativePath), "utf8"); +} + +function walk(dir, out = []) { + for (const entry of fs.readdirSync(path.join(ROOT_DIR, dir), { withFileTypes: true })) { + const relativePath = path.join(dir, entry.name); + if (entry.isDirectory()) { + walk(relativePath, out); + } else { + out.push(relativePath); + } + } + return out; +} + +for (const relativePath of walk("scripts/e2e")) { + if (!/\.(?:sh|ts|mjs|js)$/u.test(relativePath)) { + continue; + } + const text = readText(relativePath); + if (/from\s+["']\.\.\/\.\.\/src\//u.test(text) || /import\(["']\.\.\/\.\.\/src\//u.test(text)) { + errors.push(`${relativePath}: Docker E2E harness must import built dist, not ../../src`); + } + if (/-v\s+["']?\$ROOT_DIR:\/app(?::|["'\s]|$)/u.test(text)) { + errors.push(`${relativePath}: do not mount the repo root as /app in Docker E2E`); + } +} + +const dockerfile = readText("scripts/e2e/Dockerfile"); +if (/^\s*(?:COPY|ADD)\s+\.\s+\/app(?:\s|$)/imu.test(dockerfile)) { + errors.push("scripts/e2e/Dockerfile: do not copy the source checkout into /app"); +} + +if (errors.length > 0) { + console.error(errors.join("\n")); + process.exit(1); +} + +console.log("Docker E2E package boundary guard passed."); diff --git a/scripts/docker-e2e.mjs b/scripts/docker-e2e.mjs new file mode 100644 index 00000000000..753e720b56d --- /dev/null +++ b/scripts/docker-e2e.mjs @@ -0,0 +1,86 @@ +// Docker E2E CI helper. +// Converts scheduler JSON into GitHub Actions outputs and compact markdown +// summaries so the workflow does not duplicate Docker E2E planning logic. +import fs from "node:fs"; + +function usage() { + return [ + "Usage:", + " node scripts/docker-e2e.mjs github-outputs ", + " node scripts/docker-e2e.mjs summary ", + ].join("\n"); +} + +function readJson(file) { + return JSON.parse(fs.readFileSync(file, "utf8")); +} + +function boolOutput(value) { + return value ? "1" : "0"; +} + +function githubOutputs(plan) { + const needs = plan.needs ?? {}; + return [ + `credentials=${(plan.credentials ?? []).join(",")}`, + `needs_bare_image=${boolOutput(needs.bareImage)}`, + `needs_e2e_image=${boolOutput(needs.e2eImage)}`, + `needs_functional_image=${boolOutput(needs.functionalImage)}`, + `needs_live_image=${boolOutput(needs.liveImage)}`, + `needs_package=${boolOutput(needs.package)}`, + ]; +} + +function markdownCell(value) { + return String(value ?? "").replaceAll("|", "\\|"); +} + +function inlineCode(value) { + return `\`${String(value ?? "").replaceAll("`", "\\`")}\``; +} + +function summaryMarkdown(summary, title) { + const lanes = Array.isArray(summary.lanes) ? summary.lanes : []; + const lines = [ + `### ${title}`, + "", + `Status: ${inlineCode(summary.status)}`, + "", + "| Lane | Status | Seconds | Timed out | Rerun |", + "| --- | ---: | ---: | --- | --- |", + ]; + for (const lane of lanes) { + const status = lane.status === 0 ? "pass" : `fail ${lane.status}`; + lines.push( + `| ${inlineCode(lane.name)} | ${markdownCell(status)} | ${markdownCell(lane.elapsedSeconds)} | ${lane.timedOut ? "yes" : "no"} | ${inlineCode(lane.rerunCommand)} |`, + ); + } + + const phases = Array.isArray(summary.phases) ? summary.phases : []; + if (phases.length > 0) { + lines.push("", "| Phase | Seconds | Status | Image kind |", "| --- | ---: | --- | --- |"); + for (const phase of phases) { + lines.push( + `| ${inlineCode(phase.name)} | ${markdownCell(phase.elapsedSeconds)} | ${markdownCell(phase.status)} | ${markdownCell(phase.imageKind)} |`, + ); + } + } + return lines.join("\n"); +} + +const [command, file, ...args] = process.argv.slice(2); +if (!command || !file) { + throw new Error(usage()); +} + +if (command === "github-outputs") { + process.stdout.write(`${githubOutputs(readJson(file)).join("\n")}\n`); +} else if (command === "summary") { + const title = args.join(" ").trim(); + if (!title) { + throw new Error(usage()); + } + process.stdout.write(`${summaryMarkdown(readJson(file), title)}\n`); +} else { + throw new Error(`unknown command: ${command}\n${usage()}`); +} diff --git a/scripts/e2e/bundled-channel-runtime-deps-docker.sh b/scripts/e2e/bundled-channel-runtime-deps-docker.sh index 3eff712ab98..706104a13ec 100644 --- a/scripts/e2e/bundled-channel-runtime-deps-docker.sh +++ b/scripts/e2e/bundled-channel-runtime-deps-docker.sh @@ -12,7 +12,7 @@ IMAGE_NAME="$(docker_e2e_resolve_image "openclaw-bundled-channel-deps-e2e" OPENC UPDATE_BASELINE_VERSION="${OPENCLAW_BUNDLED_CHANNEL_UPDATE_BASELINE_VERSION:-2026.4.20}" DOCKER_TARGET="${OPENCLAW_BUNDLED_CHANNEL_DOCKER_TARGET:-bare}" HOST_BUILD="${OPENCLAW_BUNDLED_CHANNEL_HOST_BUILD:-1}" -PACKAGE_TGZ="${OPENCLAW_BUNDLED_CHANNEL_PACKAGE_TGZ:-}" +PACKAGE_TGZ="${OPENCLAW_CURRENT_PACKAGE_TGZ:-}" RUN_CHANNEL_SCENARIOS="${OPENCLAW_BUNDLED_CHANNEL_SCENARIOS:-1}" RUN_UPDATE_SCENARIO="${OPENCLAW_BUNDLED_CHANNEL_UPDATE_SCENARIO:-1}" RUN_ROOT_OWNED_SCENARIO="${OPENCLAW_BUNDLED_CHANNEL_ROOT_OWNED_SCENARIO:-1}" @@ -30,15 +30,14 @@ prepare_package_tgz() { return 0 fi if [ "$HOST_BUILD" = "0" ] && [ -z "${OPENCLAW_CURRENT_PACKAGE_TGZ:-}" ]; then - echo "OPENCLAW_BUNDLED_CHANNEL_HOST_BUILD=0 requires OPENCLAW_CURRENT_PACKAGE_TGZ or OPENCLAW_BUNDLED_CHANNEL_PACKAGE_TGZ" >&2 + echo "OPENCLAW_BUNDLED_CHANNEL_HOST_BUILD=0 requires OPENCLAW_CURRENT_PACKAGE_TGZ" >&2 exit 1 fi PACKAGE_TGZ="$(docker_e2e_prepare_package_tgz bundled-channel-deps)" } prepare_package_tgz -DOCKER_PACKAGE_TGZ="/tmp/openclaw-current.tgz" -PACKAGE_DOCKER_ARGS=(-v "$PACKAGE_TGZ:$DOCKER_PACKAGE_TGZ:ro" -e "OPENCLAW_CURRENT_PACKAGE_TGZ=$DOCKER_PACKAGE_TGZ") +docker_e2e_package_mount_args "$PACKAGE_TGZ" run_channel_scenario() { local channel="$1" @@ -51,7 +50,7 @@ run_channel_scenario() { -e COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \ -e OPENCLAW_CHANNEL_UNDER_TEST="$channel" \ -e OPENCLAW_DEP_SENTINEL="$dep_sentinel" \ - "${PACKAGE_DOCKER_ARGS[@]}" \ + "${DOCKER_E2E_PACKAGE_ARGS[@]}" \ -i "$IMAGE_NAME" bash -s >"$run_log" 2>&1 <<'EOF' set -euo pipefail @@ -463,7 +462,7 @@ run_root_owned_global_scenario() { echo "Running bundled channel root-owned global install Docker E2E..." if ! timeout "$DOCKER_RUN_TIMEOUT" docker run --rm --user root \ -e COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \ - "${PACKAGE_DOCKER_ARGS[@]}" \ + "${DOCKER_E2E_PACKAGE_ARGS[@]}" \ -i "$IMAGE_NAME" bash -s >"$run_log" 2>&1 <<'EOF' set -euo pipefail @@ -640,7 +639,7 @@ run_setup_entry_scenario() { echo "Running bundled channel setup-entry runtime deps Docker E2E..." if ! timeout "$DOCKER_RUN_TIMEOUT" docker run --rm \ -e COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \ - "${PACKAGE_DOCKER_ARGS[@]}" \ + "${DOCKER_E2E_PACKAGE_ARGS[@]}" \ -i "$IMAGE_NAME" bash -s >"$run_log" 2>&1 <<'EOF' set -euo pipefail @@ -897,7 +896,7 @@ run_disabled_config_scenario() { echo "Running bundled channel disabled-config runtime deps Docker E2E..." if ! timeout "$DOCKER_RUN_TIMEOUT" docker run --rm \ -e COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \ - "${PACKAGE_DOCKER_ARGS[@]}" \ + "${DOCKER_E2E_PACKAGE_ARGS[@]}" \ -i "$IMAGE_NAME" bash -s >"$run_log" 2>&1 <<'EOF' set -euo pipefail @@ -1064,7 +1063,7 @@ run_update_scenario() { -e COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \ -e OPENCLAW_BUNDLED_CHANNEL_UPDATE_BASELINE_VERSION="$UPDATE_BASELINE_VERSION" \ -e "OPENCLAW_BUNDLED_CHANNEL_UPDATE_TARGETS=${OPENCLAW_BUNDLED_CHANNEL_UPDATE_TARGETS:-telegram,discord,slack,feishu,memory-lancedb,acpx}" \ - "${PACKAGE_DOCKER_ARGS[@]}" \ + "${DOCKER_E2E_PACKAGE_ARGS[@]}" \ -i "$IMAGE_NAME" bash -s >"$run_log" 2>&1 <<'EOF' set -euo pipefail @@ -1496,7 +1495,7 @@ run_load_failure_scenario() { echo "Running bundled channel load-failure isolation Docker E2E..." if ! timeout "$DOCKER_RUN_TIMEOUT" docker run --rm \ -e COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \ - "${PACKAGE_DOCKER_ARGS[@]}" \ + "${DOCKER_E2E_PACKAGE_ARGS[@]}" \ -i "$IMAGE_NAME" bash -s >"$run_log" 2>&1 <<'EOF' set -euo pipefail diff --git a/scripts/e2e/crestodian-first-run-docker.sh b/scripts/e2e/crestodian-first-run-docker.sh index eb1709e5991..f9292c3b17a 100644 --- a/scripts/e2e/crestodian-first-run-docker.sh +++ b/scripts/e2e/crestodian-first-run-docker.sh @@ -16,6 +16,7 @@ cleanup() { trap cleanup EXIT docker_e2e_build_or_reuse "$IMAGE_NAME" crestodian-first-run +docker_e2e_harness_mount_args echo "Running in-container Crestodian first-run smoke..." # Harness files are mounted read-only; the app under test comes from /app/dist. @@ -24,7 +25,7 @@ docker run --rm \ --name "$CONTAINER_NAME" \ -e "OPENCLAW_STATE_DIR=/tmp/openclaw-state" \ -e "OPENCLAW_CONFIG_PATH=/tmp/openclaw-state/openclaw.json" \ - -v "$ROOT_DIR/scripts/e2e:/app/scripts/e2e:ro" \ + "${DOCKER_E2E_HARNESS_ARGS[@]}" \ "$IMAGE_NAME" \ bash -lc "set -euo pipefail node --import tsx scripts/e2e/crestodian-first-run-docker-client.ts diff --git a/scripts/e2e/crestodian-planner-docker.sh b/scripts/e2e/crestodian-planner-docker.sh index a3a9352ee5a..cad3272ad48 100755 --- a/scripts/e2e/crestodian-planner-docker.sh +++ b/scripts/e2e/crestodian-planner-docker.sh @@ -16,6 +16,7 @@ cleanup() { trap cleanup EXIT docker_e2e_build_or_reuse "$IMAGE_NAME" crestodian-planner +docker_e2e_harness_mount_args echo "Running in-container Crestodian planner fallback smoke..." # Harness files are mounted read-only; the app under test comes from /app/dist. @@ -24,7 +25,7 @@ docker run --rm \ --name "$CONTAINER_NAME" \ -e "OPENCLAW_STATE_DIR=/tmp/openclaw-state" \ -e "OPENCLAW_CONFIG_PATH=/tmp/openclaw-state/openclaw.json" \ - -v "$ROOT_DIR/scripts/e2e:/app/scripts/e2e:ro" \ + "${DOCKER_E2E_HARNESS_ARGS[@]}" \ "$IMAGE_NAME" \ bash -lc "set -euo pipefail node --import tsx scripts/e2e/crestodian-planner-docker-client.ts diff --git a/scripts/e2e/crestodian-rescue-docker.sh b/scripts/e2e/crestodian-rescue-docker.sh index c45b1274937..4db23f4be82 100755 --- a/scripts/e2e/crestodian-rescue-docker.sh +++ b/scripts/e2e/crestodian-rescue-docker.sh @@ -16,6 +16,7 @@ cleanup() { trap cleanup EXIT docker_e2e_build_or_reuse "$IMAGE_NAME" crestodian-rescue +docker_e2e_harness_mount_args echo "Running in-container Crestodian rescue smoke..." # Harness files are mounted read-only; the app under test comes from /app/dist. @@ -24,7 +25,7 @@ docker run --rm \ --name "$CONTAINER_NAME" \ -e "OPENCLAW_STATE_DIR=/tmp/openclaw-state" \ -e "OPENCLAW_CONFIG_PATH=/tmp/openclaw-state/openclaw.json" \ - -v "$ROOT_DIR/scripts/e2e:/app/scripts/e2e:ro" \ + "${DOCKER_E2E_HARNESS_ARGS[@]}" \ "$IMAGE_NAME" \ bash -lc "set -euo pipefail node --import tsx scripts/e2e/crestodian-rescue-docker-client.ts diff --git a/scripts/e2e/cron-mcp-cleanup-docker.sh b/scripts/e2e/cron-mcp-cleanup-docker.sh index 7ae872451e6..eca96a8f175 100644 --- a/scripts/e2e/cron-mcp-cleanup-docker.sh +++ b/scripts/e2e/cron-mcp-cleanup-docker.sh @@ -18,6 +18,7 @@ cleanup() { trap cleanup EXIT docker_e2e_build_or_reuse "$IMAGE_NAME" cron-mcp-cleanup +docker_e2e_harness_mount_args echo "Running in-container cron/subagent MCP cleanup smoke..." # Harness files are mounted read-only; the app under test comes from /app/dist. @@ -36,7 +37,7 @@ docker run --rm \ -e "GW_URL=ws://127.0.0.1:$PORT" \ -e "GW_TOKEN=$TOKEN" \ -e "OPENCLAW_ALLOW_INSECURE_PRIVATE_WS=1" \ - -v "$ROOT_DIR/scripts/e2e:/app/scripts/e2e:ro" \ + "${DOCKER_E2E_HARNESS_ARGS[@]}" \ "$IMAGE_NAME" \ bash -lc "set -euo pipefail entry=dist/index.mjs diff --git a/scripts/e2e/mcp-channels-docker.sh b/scripts/e2e/mcp-channels-docker.sh index 4b8f2db490b..d8d214ef2c2 100644 --- a/scripts/e2e/mcp-channels-docker.sh +++ b/scripts/e2e/mcp-channels-docker.sh @@ -18,6 +18,7 @@ cleanup() { trap cleanup EXIT docker_e2e_build_or_reuse "$IMAGE_NAME" mcp-channels +docker_e2e_harness_mount_args echo "Running in-container gateway + MCP smoke..." # Harness files are mounted read-only; the app under test comes from /app/dist. @@ -36,7 +37,7 @@ docker run --rm \ -e "GW_URL=ws://127.0.0.1:$PORT" \ -e "GW_TOKEN=$TOKEN" \ -e "OPENCLAW_ALLOW_INSECURE_PRIVATE_WS=1" \ - -v "$ROOT_DIR/scripts/e2e:/app/scripts/e2e:ro" \ + "${DOCKER_E2E_HARNESS_ARGS[@]}" \ "$IMAGE_NAME" \ bash -lc "set -euo pipefail entry=dist/index.mjs diff --git a/scripts/e2e/npm-onboard-channel-agent-docker.sh b/scripts/e2e/npm-onboard-channel-agent-docker.sh index 8e95d2467f0..891d840eed7 100644 --- a/scripts/e2e/npm-onboard-channel-agent-docker.sh +++ b/scripts/e2e/npm-onboard-channel-agent-docker.sh @@ -10,7 +10,7 @@ source "$ROOT_DIR/scripts/lib/docker-e2e-package.sh" IMAGE_NAME="$(docker_e2e_resolve_image "openclaw-npm-onboard-channel-agent-e2e" OPENCLAW_NPM_ONBOARD_E2E_IMAGE)" DOCKER_TARGET="${OPENCLAW_NPM_ONBOARD_DOCKER_TARGET:-bare}" HOST_BUILD="${OPENCLAW_NPM_ONBOARD_HOST_BUILD:-1}" -PACKAGE_TGZ="${OPENCLAW_NPM_ONBOARD_PACKAGE_TGZ:-}" +PACKAGE_TGZ="${OPENCLAW_CURRENT_PACKAGE_TGZ:-}" CHANNEL="${OPENCLAW_NPM_ONBOARD_CHANNEL:-telegram}" case "$CHANNEL" in @@ -29,7 +29,7 @@ prepare_package_tgz() { return 0 fi if [ "$HOST_BUILD" = "0" ] && [ -z "${OPENCLAW_CURRENT_PACKAGE_TGZ:-}" ]; then - echo "OPENCLAW_NPM_ONBOARD_HOST_BUILD=0 requires OPENCLAW_CURRENT_PACKAGE_TGZ or OPENCLAW_NPM_ONBOARD_PACKAGE_TGZ" >&2 + echo "OPENCLAW_NPM_ONBOARD_HOST_BUILD=0 requires OPENCLAW_CURRENT_PACKAGE_TGZ" >&2 exit 1 fi PACKAGE_TGZ="$(docker_e2e_prepare_package_tgz npm-onboard-channel-agent)" @@ -37,16 +37,16 @@ prepare_package_tgz() { prepare_package_tgz -DOCKER_PACKAGE_TGZ="/tmp/openclaw-current.tgz" +docker_e2e_package_mount_args "$PACKAGE_TGZ" +docker_e2e_harness_mount_args run_log="$(mktemp "${TMPDIR:-/tmp}/openclaw-npm-onboard-channel-agent.XXXXXX")" echo "Running npm tarball onboard/channel/agent Docker E2E ($CHANNEL)..." if ! docker run --rm \ -e COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \ -e OPENCLAW_NPM_ONBOARD_CHANNEL="$CHANNEL" \ - -e OPENCLAW_CURRENT_PACKAGE_TGZ="$DOCKER_PACKAGE_TGZ" \ - -v "$PACKAGE_TGZ:$DOCKER_PACKAGE_TGZ:ro" \ - -v "$ROOT_DIR/scripts/e2e:/app/scripts/e2e:ro" \ + "${DOCKER_E2E_PACKAGE_ARGS[@]}" \ + "${DOCKER_E2E_HARNESS_ARGS[@]}" \ -i "$IMAGE_NAME" bash -s >"$run_log" 2>&1 <<'EOF' set -euo pipefail diff --git a/scripts/e2e/npm-telegram-live-docker.sh b/scripts/e2e/npm-telegram-live-docker.sh index 62b263f1a03..9fdb21b9432 100755 --- a/scripts/e2e/npm-telegram-live-docker.sh +++ b/scripts/e2e/npm-telegram-live-docker.sh @@ -49,6 +49,7 @@ validate_openclaw_package_spec() { validate_openclaw_package_spec "$PACKAGE_SPEC" docker_e2e_build_or_reuse "$IMAGE_NAME" npm-telegram-live "$ROOT_DIR/scripts/e2e/Dockerfile" "$ROOT_DIR" "$DOCKER_TARGET" +docker_e2e_harness_mount_args mkdir -p "$ROOT_DIR/.artifacts/qa-e2e" run_log="$(mktemp "${TMPDIR:-/tmp}/openclaw-npm-telegram-live.XXXXXX")" @@ -147,7 +148,7 @@ EOF run_logged docker run --rm \ "${docker_env[@]}" \ -v "$ROOT_DIR/.artifacts:/app/.artifacts" \ - -v "$ROOT_DIR/scripts/e2e:/app/scripts/e2e:ro" \ + "${DOCKER_E2E_HARNESS_ARGS[@]}" \ -v "$ROOT_DIR/extensions:/app/extensions:ro" \ -v "$npm_prefix_host:/npm-global" \ -i "$IMAGE_NAME" bash -s <<'EOF' diff --git a/scripts/e2e/openai-image-auth-docker.sh b/scripts/e2e/openai-image-auth-docker.sh index 26479598225..059c78aa60a 100644 --- a/scripts/e2e/openai-image-auth-docker.sh +++ b/scripts/e2e/openai-image-auth-docker.sh @@ -10,13 +10,14 @@ IMAGE_NAME="$(docker_e2e_resolve_image "openclaw-openai-image-auth-e2e" OPENCLAW SKIP_BUILD="${OPENCLAW_OPENAI_IMAGE_AUTH_E2E_SKIP_BUILD:-0}" docker_e2e_build_or_reuse "$IMAGE_NAME" openai-image-auth "$ROOT_DIR/scripts/e2e/Dockerfile" "$ROOT_DIR" "" "$SKIP_BUILD" +docker_e2e_harness_mount_args echo "Running OpenAI image auth Docker E2E..." # Harness files are mounted read-only; the app under test comes from /app/dist. run_logged openai-image-auth docker run --rm \ -e "OPENAI_API_KEY=sk-openclaw-image-auth-e2e" \ -e "OPENCLAW_QA_ALLOW_LOCAL_IMAGE_PROVIDER=1" \ - -v "$ROOT_DIR/scripts/e2e:/app/scripts/e2e:ro" \ + "${DOCKER_E2E_HARNESS_ARGS[@]}" \ -i "$IMAGE_NAME" bash -lc ' set -euo pipefail export HOME="$(mktemp -d "/tmp/openclaw-openai-image-auth.XXXXXX")" diff --git a/scripts/e2e/openwebui-docker.sh b/scripts/e2e/openwebui-docker.sh index 6c440f37426..54f080e8774 100755 --- a/scripts/e2e/openwebui-docker.sh +++ b/scripts/e2e/openwebui-docker.sh @@ -49,6 +49,7 @@ cleanup() { trap cleanup EXIT docker_e2e_build_or_reuse "$IMAGE_NAME" openwebui +docker_e2e_harness_mount_args echo "Pulling Open WebUI image: $OPENWEBUI_IMAGE" timeout "$DOCKER_PULL_TIMEOUT" docker pull "$OPENWEBUI_IMAGE" >/dev/null @@ -69,7 +70,7 @@ docker_cmd docker run -d \ -e "OPENCLAW_SKIP_CANVAS_HOST=1" \ -e OPENAI_API_KEY \ ${OPENAI_BASE_URL_VALUE:+-e OPENAI_BASE_URL} \ - -v "$ROOT_DIR/scripts/e2e:/app/scripts/e2e:ro" \ + "${DOCKER_E2E_HARNESS_ARGS[@]}" \ "$IMAGE_NAME" \ bash -lc ' set -euo pipefail diff --git a/scripts/e2e/pi-bundle-mcp-tools-docker.sh b/scripts/e2e/pi-bundle-mcp-tools-docker.sh index 8eced1626ea..20f9c7ad699 100755 --- a/scripts/e2e/pi-bundle-mcp-tools-docker.sh +++ b/scripts/e2e/pi-bundle-mcp-tools-docker.sh @@ -16,6 +16,7 @@ cleanup() { trap cleanup EXIT docker_e2e_build_or_reuse "$IMAGE_NAME" pi-bundle-mcp-tools +docker_e2e_harness_mount_args echo "Running in-container Pi bundle MCP tool availability smoke..." # Harness files are mounted read-only; the app under test comes from /app/dist. @@ -23,7 +24,7 @@ set +e docker run --rm \ --name "$CONTAINER_NAME" \ -e "OPENCLAW_STATE_DIR=/tmp/openclaw-state" \ - -v "$ROOT_DIR/scripts/e2e:/app/scripts/e2e:ro" \ + "${DOCKER_E2E_HARNESS_ARGS[@]}" \ "$IMAGE_NAME" \ bash -lc "set -euo pipefail node --import tsx scripts/e2e/pi-bundle-mcp-tools-docker-client.ts diff --git a/scripts/e2e/session-runtime-context-docker.sh b/scripts/e2e/session-runtime-context-docker.sh index 205c9ce058e..27a97814564 100644 --- a/scripts/e2e/session-runtime-context-docker.sh +++ b/scripts/e2e/session-runtime-context-docker.sh @@ -17,6 +17,7 @@ cleanup() { trap cleanup EXIT docker_e2e_build_or_reuse "$IMAGE_NAME" session-runtime-context +docker_e2e_harness_mount_args echo "Running session runtime context Docker E2E..." # Harness files are mounted read-only; the app under test comes from /app/dist. @@ -24,7 +25,7 @@ set +e docker run --rm \ --name "$CONTAINER_NAME" \ -e COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \ - -v "$ROOT_DIR/scripts/e2e:/app/scripts/e2e:ro" \ + "${DOCKER_E2E_HARNESS_ARGS[@]}" \ "$IMAGE_NAME" \ bash -lc 'set -euo pipefail; node --import tsx scripts/e2e/session-runtime-context-docker-client.ts' \ >"$RUN_LOG" 2>&1 diff --git a/scripts/lib/docker-e2e-package.sh b/scripts/lib/docker-e2e-package.sh index 418905caf52..6b25f25a564 100644 --- a/scripts/lib/docker-e2e-package.sh +++ b/scripts/lib/docker-e2e-package.sh @@ -29,16 +29,13 @@ docker_e2e_prepare_package_tgz() { return 0 fi - echo "Building OpenClaw package artifacts..." - run_logged "$label-host-build" pnpm build - echo "Writing package inventory and packing OpenClaw once..." - run_logged "$label-inventory" node --import tsx --input-type=module -e 'const { writePackageDistInventory } = await import("./src/infra/package-dist-inventory.ts"); await writePackageDistInventory(process.cwd());' - local pack_dir pack_dir="$(mktemp -d "${TMPDIR:-/tmp}/openclaw-docker-e2e-pack.XXXXXX")" - run_logged "$label-pack" npm pack --ignore-scripts --pack-destination "$pack_dir" - - package_tgz="$(find "$pack_dir" -maxdepth 1 -name 'openclaw-*.tgz' -print -quit)" + package_tgz="$( + node "$ROOT_DIR/scripts/package-openclaw-for-docker.mjs" \ + --output-dir "$pack_dir" \ + --output-name openclaw-current.tgz + )" if [ -z "$package_tgz" ]; then echo "missing packed OpenClaw tarball" >&2 return 1 @@ -61,3 +58,7 @@ docker_e2e_package_mount_args() { local target="${2:-/tmp/openclaw-current.tgz}" DOCKER_E2E_PACKAGE_ARGS=(-v "$package_tgz:$target:ro" -e "OPENCLAW_CURRENT_PACKAGE_TGZ=$target") } + +docker_e2e_harness_mount_args() { + DOCKER_E2E_HARNESS_ARGS=(-v "$ROOT_DIR/scripts/e2e:/app/scripts/e2e:ro") +} diff --git a/scripts/lib/docker-e2e-plan.mjs b/scripts/lib/docker-e2e-plan.mjs new file mode 100644 index 00000000000..0e2483f7470 --- /dev/null +++ b/scripts/lib/docker-e2e-plan.mjs @@ -0,0 +1,236 @@ +// Docker E2E scheduler planning helpers. +// This module turns the scenario catalog plus env-driven inputs into a concrete +// lane plan. It intentionally does not define scenario commands. +import { + DEFAULT_LIVE_RETRIES, + allReleasePathLanes, + mainLanes, + releasePathChunkLanes, + tailLanes, +} from "./docker-e2e-scenarios.mjs"; + +export { DEFAULT_LIVE_RETRIES }; + +export const DEFAULT_E2E_BARE_IMAGE = "openclaw-docker-e2e-bare:local"; +export const DEFAULT_E2E_FUNCTIONAL_IMAGE = "openclaw-docker-e2e-functional:local"; +export const DEFAULT_E2E_IMAGE = DEFAULT_E2E_FUNCTIONAL_IMAGE; +export const DEFAULT_PARALLELISM = 10; +export const DEFAULT_PROFILE = "all"; +export const DEFAULT_RESOURCE_LIMITS = { + docker: DEFAULT_PARALLELISM, + live: 9, + "live:claude": 4, + "live:codex": 4, + "live:droid": 4, + "live:gemini": 4, + "live:opencode": 4, + npm: 10, + service: 7, +}; +export const DEFAULT_TAIL_PARALLELISM = 10; +export const RELEASE_PATH_PROFILE = "release-path"; + +export function parseLaneSelection(raw) { + if (!raw) { + return []; + } + return [ + ...new Set( + String(raw) + .split(/[,\s]+/u) + .map((token) => token.trim()) + .filter(Boolean), + ), + ]; +} + +export function dedupeLanes(poolLanes) { + const byName = new Map(); + for (const poolLane of poolLanes) { + if (!byName.has(poolLane.name)) { + byName.set(poolLane.name, poolLane); + } + } + return [...byName.values()]; +} + +export function selectNamedLanes(poolLanes, selectedNames, label) { + const byName = new Map(poolLanes.map((poolLane) => [poolLane.name, poolLane])); + const missing = selectedNames.filter((name) => !byName.has(name)); + if (missing.length > 0) { + throw new Error( + `${label} unknown lane(s): ${missing.join(", ")}. Available lanes: ${[...byName.keys()] + .toSorted((a, b) => a.localeCompare(b)) + .join(", ")}`, + ); + } + return selectedNames.map((name) => byName.get(name)); +} + +export function parseLiveMode(raw) { + const mode = raw || "all"; + if (mode === "all" || mode === "skip" || mode === "only") { + return mode; + } + throw new Error( + `OPENCLAW_DOCKER_ALL_LIVE_MODE must be one of: all, skip, only. Got: ${JSON.stringify(raw)}`, + ); +} + +export function parseProfile(raw) { + const profile = raw || DEFAULT_PROFILE; + if (profile === DEFAULT_PROFILE || profile === RELEASE_PATH_PROFILE) { + return profile; + } + throw new Error( + `OPENCLAW_DOCKER_ALL_PROFILE must be one of: ${DEFAULT_PROFILE}, ${RELEASE_PATH_PROFILE}. Got: ${JSON.stringify(raw)}`, + ); +} + +export function applyLiveMode(poolLanes, mode) { + if (mode === "all") { + return poolLanes; + } + return poolLanes.filter((poolLane) => (mode === "only" ? poolLane.live : !poolLane.live)); +} + +export function applyLiveRetries(poolLanes, retries) { + return poolLanes.map((poolLane) => (poolLane.live ? { ...poolLane, retries } : poolLane)); +} + +export function laneWeight(poolLane) { + return Math.max(1, poolLane.weight ?? 1); +} + +export function laneResources(poolLane) { + return ["docker", ...(poolLane.resources ?? [])]; +} + +export function laneSummary(poolLane) { + const resources = laneResources(poolLane).join(","); + const timeout = poolLane.timeoutMs ? ` timeout=${Math.round(poolLane.timeoutMs / 1000)}s` : ""; + const retries = poolLane.retries > 0 ? ` retries=${poolLane.retries}` : ""; + const cache = poolLane.cacheKey ? ` cache=${poolLane.cacheKey}` : ""; + const image = poolLane.e2eImageKind ? ` image=${poolLane.e2eImageKind}` : ""; + return `${poolLane.name}(w=${laneWeight(poolLane)} r=${resources}${timeout}${retries}${cache}${image})`; +} + +export function lanesNeedE2eImageKind(poolLanes, kind) { + return poolLanes.some((poolLane) => poolLane.e2eImageKind === kind); +} + +export function lanesNeedOpenClawPackage(poolLanes) { + return poolLanes.some((poolLane) => poolLane.e2eImageKind); +} + +export function findLaneByName(name) { + return dedupeLanes([ + ...allReleasePathLanes({ includeOpenWebUI: true }), + ...mainLanes, + ...tailLanes, + ]).find((poolLane) => poolLane.name === name); +} + +export function laneCredentialRequirements(poolLane) { + const credentials = []; + if (poolLane.name === "install-e2e") { + credentials.push("openai", "anthropic"); + } + if (poolLane.name === "openwebui" || poolLane.name === "openai-web-search-minimal") { + credentials.push("openai"); + } + return credentials; +} + +function unique(values) { + return [...new Set(values.filter(Boolean))]; +} + +export function buildPlanJson(params) { + const scheduledLanes = [...params.orderedLanes, ...params.orderedTailLanes]; + const imageKinds = unique(scheduledLanes.map((poolLane) => poolLane.e2eImageKind)).toSorted( + (a, b) => a.localeCompare(b), + ); + return { + chunk: params.releaseChunk || undefined, + credentials: unique(scheduledLanes.flatMap(laneCredentialRequirements)).toSorted((a, b) => + a.localeCompare(b), + ), + imageKinds, + includeOpenWebUI: params.includeOpenWebUI, + lanes: scheduledLanes.map((poolLane) => ({ + command: poolLane.command, + imageKind: poolLane.e2eImageKind, + live: poolLane.live, + name: poolLane.name, + resources: laneResources(poolLane), + timeoutMs: poolLane.timeoutMs, + weight: laneWeight(poolLane), + })), + mainLanes: params.orderedLanes.map((poolLane) => poolLane.name), + needs: { + bareImage: imageKinds.includes("bare"), + e2eImage: imageKinds.length > 0, + functionalImage: imageKinds.includes("functional"), + liveImage: scheduledLanes.some((poolLane) => poolLane.live), + package: lanesNeedOpenClawPackage(scheduledLanes), + }, + profile: params.profile, + selectedLanes: params.selectedLaneNames, + tailLanes: params.orderedTailLanes.map((poolLane) => poolLane.name), + version: 1, + }; +} + +export function resolveDockerE2ePlan(options) { + const retriedMainLanes = applyLiveRetries(mainLanes, options.liveRetries); + const retriedTailLanes = applyLiveRetries(tailLanes, options.liveRetries); + const releaseLanes = + options.selectedLaneNames.length === 0 && options.profile === RELEASE_PATH_PROFILE + ? options.planReleaseAll + ? allReleasePathLanes({ includeOpenWebUI: options.includeOpenWebUI }) + : releasePathChunkLanes(options.releaseChunk, { + includeOpenWebUI: options.includeOpenWebUI, + }) + : undefined; + const selectedLanes = + options.selectedLaneNames.length > 0 + ? selectNamedLanes( + dedupeLanes([ + ...allReleasePathLanes({ includeOpenWebUI: options.includeOpenWebUI }), + ...retriedMainLanes, + ...retriedTailLanes, + ]), + options.selectedLaneNames, + "OPENCLAW_DOCKER_ALL_LANES", + ) + : undefined; + const configuredLanes = selectedLanes + ? selectedLanes + : releaseLanes + ? releaseLanes + : options.liveMode === "only" + ? applyLiveMode([...retriedMainLanes, ...retriedTailLanes], options.liveMode) + : applyLiveMode(retriedMainLanes, options.liveMode); + const configuredTailLanes = + selectedLanes || releaseLanes + ? [] + : options.liveMode === "only" + ? [] + : applyLiveMode(retriedTailLanes, options.liveMode); + const orderedLanes = options.orderLanes(configuredLanes, options.timingStore); + const orderedTailLanes = options.orderLanes(configuredTailLanes, options.timingStore); + return { + orderedLanes, + orderedTailLanes, + plan: buildPlanJson({ + includeOpenWebUI: options.includeOpenWebUI, + orderedLanes, + orderedTailLanes, + profile: options.profile, + releaseChunk: options.releaseChunk, + selectedLaneNames: options.selectedLaneNames, + }), + scheduledLanes: [...orderedLanes, ...orderedTailLanes], + }; +} diff --git a/scripts/lib/docker-e2e-scenarios.mjs b/scripts/lib/docker-e2e-scenarios.mjs new file mode 100644 index 00000000000..9696f8a6184 --- /dev/null +++ b/scripts/lib/docker-e2e-scenarios.mjs @@ -0,0 +1,417 @@ +// Docker E2E scenario catalog. +// Keep lane names, commands, image kind, timeout, resources, and release chunks +// here. Planning and execution live in separate modules. + +const BUNDLED_UPDATE_TIMEOUT_MS = 20 * 60 * 1000; +export const DEFAULT_LIVE_RETRIES = 1; +const LIVE_ACP_TIMEOUT_MS = 20 * 60 * 1000; +const LIVE_CLI_TIMEOUT_MS = 20 * 60 * 1000; +const LIVE_PROFILE_TIMEOUT_MS = 20 * 60 * 1000; +const OPENWEBUI_TIMEOUT_MS = 20 * 60 * 1000; + +export const LIVE_RETRY_PATTERNS = [ + /529\b/i, + /overloaded/i, + /capacity/i, + /rate.?limit/i, + /gateway closed \(1000 normal closure\)/i, + /ECONNRESET|ETIMEDOUT|ENOTFOUND/i, +]; + +const bundledChannelLaneCommand = + "OPENCLAW_SKIP_DOCKER_BUILD=1 OPENCLAW_BUNDLED_CHANNEL_UPDATE_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_ROOT_OWNED_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_SETUP_ENTRY_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_LOAD_FAILURE_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_DISABLED_CONFIG_SCENARIO=0 pnpm test:docker:bundled-channel-deps"; + +function lane(name, command, options = {}) { + return { + cacheKey: options.cacheKey, + command, + e2eImageKind: options.e2eImageKind ?? (options.live ? undefined : "functional"), + estimateSeconds: options.estimateSeconds, + live: options.live === true, + name, + retryPatterns: options.retryPatterns ?? [], + retries: options.retries ?? 0, + resources: options.resources ?? [], + timeoutMs: options.timeoutMs, + weight: options.weight ?? 1, + }; +} + +function liveProviderResource(provider) { + if (!provider) { + return undefined; + } + if (provider === "claude-cli" || provider === "claude") { + return "live:claude"; + } + if (provider === "codex-cli" || provider === "codex") { + return "live:codex"; + } + if (provider === "droid") { + return "live:droid"; + } + if (provider === "google-gemini-cli" || provider === "gemini") { + return "live:gemini"; + } + if (provider === "opencode") { + return "live:opencode"; + } + if (provider === "openai") { + return "live:openai"; + } + return `live:${provider}`; +} + +function liveProviderResources(options) { + const providers = options.providers ?? (options.provider ? [options.provider] : []); + return providers.map(liveProviderResource).filter(Boolean); +} + +function liveLane(name, command, options = {}) { + return lane(name, command, { + ...options, + live: true, + resources: ["live", ...liveProviderResources(options), ...(options.resources ?? [])], + retryPatterns: options.retryPatterns ?? LIVE_RETRY_PATTERNS, + retries: options.retries ?? DEFAULT_LIVE_RETRIES, + weight: options.weight ?? 3, + }); +} + +function npmLane(name, command, options = {}) { + return lane(name, command, { + ...options, + e2eImageKind: options.e2eImageKind ?? "bare", + resources: ["npm", ...(options.resources ?? [])], + weight: options.weight ?? 2, + }); +} + +function serviceLane(name, command, options = {}) { + return lane(name, command, { + ...options, + resources: ["service", ...(options.resources ?? [])], + weight: options.weight ?? 2, + }); +} + +function bundledChannelScenarioLane(name, env, options = {}) { + return npmLane( + name, + `${env} OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:bundled-channel-deps`, + options, + ); +} + +const bundledScenarioLanes = [ + ...["telegram", "discord", "slack", "feishu", "memory-lancedb"].map((channel) => + npmLane( + `bundled-channel-${channel}`, + `OPENCLAW_BUNDLED_CHANNELS=${channel} ${bundledChannelLaneCommand}`, + ), + ), + ...["telegram", "discord", "slack", "feishu", "memory-lancedb", "acpx"].map((target) => + bundledChannelScenarioLane( + `bundled-channel-update-${target}`, + `OPENCLAW_BUNDLED_CHANNEL_SCENARIOS=0 OPENCLAW_BUNDLED_CHANNEL_UPDATE_SCENARIO=1 OPENCLAW_BUNDLED_CHANNEL_UPDATE_TARGETS=${target} OPENCLAW_BUNDLED_CHANNEL_ROOT_OWNED_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_SETUP_ENTRY_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_LOAD_FAILURE_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_DISABLED_CONFIG_SCENARIO=0`, + { timeoutMs: BUNDLED_UPDATE_TIMEOUT_MS }, + ), + ), + bundledChannelScenarioLane( + "bundled-channel-root-owned", + "OPENCLAW_BUNDLED_CHANNEL_SCENARIOS=0 OPENCLAW_BUNDLED_CHANNEL_UPDATE_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_ROOT_OWNED_SCENARIO=1 OPENCLAW_BUNDLED_CHANNEL_SETUP_ENTRY_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_LOAD_FAILURE_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_DISABLED_CONFIG_SCENARIO=0", + ), + bundledChannelScenarioLane( + "bundled-channel-setup-entry", + "OPENCLAW_BUNDLED_CHANNEL_SCENARIOS=0 OPENCLAW_BUNDLED_CHANNEL_UPDATE_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_ROOT_OWNED_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_SETUP_ENTRY_SCENARIO=1 OPENCLAW_BUNDLED_CHANNEL_LOAD_FAILURE_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_DISABLED_CONFIG_SCENARIO=0", + ), + bundledChannelScenarioLane( + "bundled-channel-load-failure", + "OPENCLAW_BUNDLED_CHANNEL_SCENARIOS=0 OPENCLAW_BUNDLED_CHANNEL_UPDATE_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_ROOT_OWNED_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_SETUP_ENTRY_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_LOAD_FAILURE_SCENARIO=1 OPENCLAW_BUNDLED_CHANNEL_DISABLED_CONFIG_SCENARIO=0", + ), + bundledChannelScenarioLane( + "bundled-channel-disabled-config", + "OPENCLAW_BUNDLED_CHANNEL_SCENARIOS=0 OPENCLAW_BUNDLED_CHANNEL_UPDATE_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_ROOT_OWNED_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_SETUP_ENTRY_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_LOAD_FAILURE_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_DISABLED_CONFIG_SCENARIO=1", + ), +]; + +export const mainLanes = [ + liveLane("live-models", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:live-models", { + providers: ["claude-cli", "codex-cli", "google-gemini-cli"], + timeoutMs: LIVE_PROFILE_TIMEOUT_MS, + weight: 4, + }), + liveLane("live-gateway", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:live-gateway", { + providers: ["claude-cli", "codex-cli", "google-gemini-cli"], + timeoutMs: LIVE_PROFILE_TIMEOUT_MS, + weight: 4, + }), + liveLane( + "live-cli-backend-claude", + "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:live-cli-backend:claude", + { + cacheKey: "cli-backend-claude", + provider: "claude-cli", + resources: ["npm"], + timeoutMs: LIVE_CLI_TIMEOUT_MS, + weight: 3, + }, + ), + liveLane( + "live-cli-backend-gemini", + "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:live-cli-backend:gemini", + { + cacheKey: "cli-backend-gemini", + provider: "google-gemini-cli", + resources: ["npm"], + timeoutMs: LIVE_CLI_TIMEOUT_MS, + weight: 3, + }, + ), + serviceLane("openwebui", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:openwebui", { + timeoutMs: OPENWEBUI_TIMEOUT_MS, + weight: 5, + }), + serviceLane("onboard", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:onboard", { + weight: 2, + }), + npmLane( + "npm-onboard-channel-agent", + "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:npm-onboard-channel-agent", + { resources: ["service"], weight: 3 }, + ), + serviceLane("gateway-network", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:gateway-network"), + serviceLane( + "agents-delete-shared-workspace", + "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:agents-delete-shared-workspace", + ), + serviceLane("mcp-channels", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:mcp-channels", { + resources: ["npm"], + weight: 3, + }), + lane("pi-bundle-mcp-tools", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:pi-bundle-mcp-tools"), + lane("crestodian-rescue", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:crestodian-rescue"), + lane("crestodian-planner", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:crestodian-planner"), + serviceLane( + "cron-mcp-cleanup", + "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:cron-mcp-cleanup", + { resources: ["npm"], weight: 3 }, + ), + npmLane("doctor-switch", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:doctor-switch", { + weight: 3, + }), + npmLane( + "update-channel-switch", + "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:update-channel-switch", + { + timeoutMs: 30 * 60 * 1000, + weight: 3, + }, + ), + lane("plugins", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:plugins", { + resources: ["npm", "service"], + weight: 6, + }), + npmLane("plugin-update", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:plugin-update"), + serviceLane("config-reload", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:config-reload"), + ...bundledScenarioLanes, + lane("openai-image-auth", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:openai-image-auth"), + lane( + "crestodian-first-run", + "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:crestodian-first-run", + ), + lane( + "session-runtime-context", + "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:session-runtime-context", + ), + lane("qr", "pnpm test:docker:qr"), +]; + +export const tailLanes = [ + serviceLane( + "openai-web-search-minimal", + "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:openai-web-search-minimal", + { timeoutMs: 8 * 60 * 1000 }, + ), + liveLane( + "live-codex-harness", + "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:live-codex-harness", + { + cacheKey: "codex-harness", + provider: "codex-cli", + resources: ["npm"], + timeoutMs: LIVE_ACP_TIMEOUT_MS, + weight: 3, + }, + ), + liveLane("live-codex-bind", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:live-codex-bind", { + cacheKey: "codex-harness", + provider: "codex-cli", + resources: ["npm"], + timeoutMs: LIVE_ACP_TIMEOUT_MS, + weight: 3, + }), + liveLane( + "live-cli-backend-codex", + "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:live-cli-backend:codex", + { + cacheKey: "cli-backend-codex", + provider: "codex-cli", + resources: ["npm"], + timeoutMs: LIVE_CLI_TIMEOUT_MS, + weight: 3, + }, + ), + liveLane( + "live-acp-bind-claude", + "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:live-acp-bind:claude", + { + cacheKey: "acp-bind-claude", + provider: "claude-cli", + resources: ["npm"], + timeoutMs: LIVE_ACP_TIMEOUT_MS, + weight: 3, + }, + ), + liveLane( + "live-acp-bind-codex", + "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:live-acp-bind:codex", + { + cacheKey: "acp-bind-codex", + provider: "codex-cli", + resources: ["npm"], + timeoutMs: LIVE_ACP_TIMEOUT_MS, + weight: 3, + }, + ), + liveLane( + "live-acp-bind-droid", + "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:live-acp-bind:droid", + { + cacheKey: "acp-bind-droid", + provider: "droid", + resources: ["npm"], + timeoutMs: LIVE_ACP_TIMEOUT_MS, + weight: 3, + }, + ), + liveLane( + "live-acp-bind-gemini", + "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:live-acp-bind:gemini", + { + cacheKey: "acp-bind-gemini", + provider: "google-gemini-cli", + resources: ["npm"], + timeoutMs: LIVE_ACP_TIMEOUT_MS, + weight: 3, + }, + ), + liveLane( + "live-acp-bind-opencode", + "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:live-acp-bind:opencode", + { + cacheKey: "acp-bind-opencode", + provider: "opencode", + resources: ["npm"], + timeoutMs: LIVE_ACP_TIMEOUT_MS, + weight: 3, + }, + ), +]; + +const releasePathChunks = { + core: [ + lane("qr", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:qr"), + serviceLane("onboard", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:onboard", { + weight: 2, + }), + serviceLane("gateway-network", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:gateway-network"), + serviceLane("config-reload", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:config-reload"), + lane( + "session-runtime-context", + "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:session-runtime-context", + ), + lane( + "pi-bundle-mcp-tools", + "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:pi-bundle-mcp-tools", + ), + serviceLane("mcp-channels", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:mcp-channels", { + resources: ["npm"], + weight: 3, + }), + ], + "package-update": [ + npmLane("install-e2e", "OPENCLAW_E2E_MODELS=both pnpm test:install:e2e", { + resources: ["service"], + weight: 4, + }), + npmLane( + "npm-onboard-channel-agent", + "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:npm-onboard-channel-agent", + { resources: ["service"], weight: 3 }, + ), + npmLane("doctor-switch", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:doctor-switch", { + weight: 3, + }), + npmLane( + "update-channel-switch", + "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:update-channel-switch", + { + timeoutMs: 30 * 60 * 1000, + weight: 3, + }, + ), + ], + "plugins-integrations": [ + lane("plugins", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:plugins", { + resources: ["npm", "service"], + weight: 6, + }), + npmLane("plugin-update", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:plugin-update"), + npmLane( + "bundled-channel-deps", + "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:bundled-channel-deps", + { resources: ["service"], weight: 3 }, + ), + serviceLane( + "cron-mcp-cleanup", + "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:cron-mcp-cleanup", + { + resources: ["npm"], + weight: 3, + }, + ), + serviceLane( + "openai-web-search-minimal", + "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:openai-web-search-minimal", + { timeoutMs: 8 * 60 * 1000 }, + ), + ], +}; + +export function releasePathChunkLanes(chunk, options = {}) { + const base = releasePathChunks[chunk]; + if (!base) { + throw new Error( + `OPENCLAW_DOCKER_ALL_CHUNK must be one of: ${Object.keys(releasePathChunks).join(", ")}. Got: ${JSON.stringify(chunk)}`, + ); + } + if (chunk !== "plugins-integrations" || !options.includeOpenWebUI) { + return base; + } + return [ + ...base, + serviceLane("openwebui", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:openwebui", { + timeoutMs: OPENWEBUI_TIMEOUT_MS, + weight: 5, + }), + ]; +} + +export function allReleasePathLanes(options = {}) { + return Object.keys(releasePathChunks).flatMap((chunk) => + releasePathChunkLanes(chunk, { + includeOpenWebUI: chunk === "plugins-integrations" && options.includeOpenWebUI, + }), + ); +} diff --git a/scripts/package-openclaw-for-docker.mjs b/scripts/package-openclaw-for-docker.mjs new file mode 100644 index 00000000000..80c5afbeba2 --- /dev/null +++ b/scripts/package-openclaw-for-docker.mjs @@ -0,0 +1,148 @@ +#!/usr/bin/env node +// Builds the OpenClaw package artifact used by Docker E2E. +// The script owns the build/inventory/pack sequence so local scheduler, shell +// helpers, and GitHub Actions all prepare the exact same npm tarball. +import { spawn } from "node:child_process"; +import fs from "node:fs/promises"; +import path from "node:path"; +import { fileURLToPath } from "node:url"; + +const ROOT_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), ".."); + +function parseArgs(argv) { + const options = { + outputDir: "", + outputName: "", + skipBuild: false, + }; + for (let index = 0; index < argv.length; index += 1) { + const arg = argv[index]; + if (arg === "--output-dir") { + options.outputDir = argv[(index += 1)] ?? ""; + } else if (arg?.startsWith("--output-dir=")) { + options.outputDir = arg.slice("--output-dir=".length); + } else if (arg === "--output-name") { + options.outputName = argv[(index += 1)] ?? ""; + } else if (arg?.startsWith("--output-name=")) { + options.outputName = arg.slice("--output-name=".length); + } else if (arg === "--skip-build") { + options.skipBuild = true; + } else { + throw new Error(`unknown argument: ${arg}`); + } + } + return options; +} + +function run(command, args) { + return new Promise((resolve, reject) => { + const child = spawn(command, args, { + cwd: ROOT_DIR, + stdio: ["ignore", "pipe", "pipe"], + }); + child.stdout.pipe(process.stderr, { end: false }); + child.stderr.pipe(process.stderr, { end: false }); + child.on("error", reject); + child.on("close", (status, signal) => { + if (status === 0) { + resolve(); + return; + } + reject(new Error(`${command} ${args.join(" ")} failed with ${status ?? signal}`)); + }); + }); +} + +async function runCapture(command, args) { + return await new Promise((resolve, reject) => { + const child = spawn(command, args, { + cwd: ROOT_DIR, + stdio: ["ignore", "pipe", "pipe"], + }); + let stdout = ""; + child.stdout.on("data", (chunk) => { + stdout += String(chunk); + }); + child.stderr.pipe(process.stderr, { end: false }); + child.on("error", reject); + child.on("close", (status, signal) => { + if (status === 0) { + resolve(stdout); + return; + } + reject(new Error(`${command} ${args.join(" ")} failed with ${status ?? signal}`)); + }); + }); +} + +async function newestOpenClawTarball(outputDir, packOutput) { + let fromOutput = ""; + for (const line of packOutput.split(/\r?\n/u)) { + const trimmed = line.trim(); + if (/^openclaw-.*\.tgz$/u.test(trimmed)) { + fromOutput = trimmed; + } + } + if (fromOutput) { + return path.join(outputDir, fromOutput); + } + + const entries = await fs.readdir(outputDir); + const packed = entries + .filter((entry) => /^openclaw-.*\.tgz$/u.test(entry)) + .toSorted() + .at(-1); + if (!packed) { + throw new Error(`missing packed OpenClaw tarball in ${outputDir}`); + } + return path.join(outputDir, packed); +} + +async function main() { + const options = parseArgs(process.argv.slice(2)); + const outputDir = path.resolve( + ROOT_DIR, + options.outputDir || path.join(".artifacts", "docker-e2e-package"), + ); + await fs.mkdir(outputDir, { recursive: true }); + + if (!options.skipBuild) { + console.error("==> Building OpenClaw package artifacts"); + await run("pnpm", ["build"]); + } + + console.error("==> Writing OpenClaw package inventory"); + await run("node", [ + "--import", + "tsx", + "--input-type=module", + "-e", + "const { writePackageDistInventory } = await import('./src/infra/package-dist-inventory.ts'); await writePackageDistInventory(process.cwd());", + ]); + + console.error("==> Packing OpenClaw package"); + const packOutput = await runCapture("npm", [ + "pack", + "--silent", + "--ignore-scripts", + "--pack-destination", + outputDir, + ]); + let tarball = await newestOpenClawTarball(outputDir, packOutput); + + if (options.outputName) { + const target = path.join(outputDir, options.outputName); + if (target !== tarball) { + await fs.rm(target, { force: true }); + await fs.rename(tarball, target); + tarball = target; + } + } + + process.stdout.write(`${tarball}\n`); +} + +await main().catch((error) => { + console.error(error instanceof Error ? error.message : String(error)); + process.exit(1); +}); diff --git a/scripts/test-docker-all.mjs b/scripts/test-docker-all.mjs index b3d769022ee..4ef804a43e2 100644 --- a/scripts/test-docker-all.mjs +++ b/scripts/test-docker-all.mjs @@ -6,508 +6,40 @@ import fs from "node:fs"; import { mkdir, readFile } from "node:fs/promises"; import path from "node:path"; import { fileURLToPath } from "node:url"; +import { + DEFAULT_E2E_BARE_IMAGE, + DEFAULT_E2E_FUNCTIONAL_IMAGE, + DEFAULT_E2E_IMAGE, + DEFAULT_LIVE_RETRIES, + DEFAULT_PARALLELISM, + DEFAULT_PROFILE, + DEFAULT_RESOURCE_LIMITS, + DEFAULT_TAIL_PARALLELISM, + RELEASE_PATH_PROFILE, + findLaneByName, + laneResources, + laneSummary, + laneWeight, + lanesNeedE2eImageKind, + lanesNeedOpenClawPackage, + parseLaneSelection, + parseLiveMode, + parseProfile, + resolveDockerE2ePlan, +} from "./lib/docker-e2e-plan.mjs"; const ROOT_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), ".."); -const DEFAULT_E2E_BARE_IMAGE = "openclaw-docker-e2e-bare:local"; -const DEFAULT_E2E_FUNCTIONAL_IMAGE = "openclaw-docker-e2e-functional:local"; -const DEFAULT_E2E_IMAGE = DEFAULT_E2E_FUNCTIONAL_IMAGE; -const DEFAULT_PARALLELISM = 10; -const DEFAULT_TAIL_PARALLELISM = 10; const DEFAULT_FAILURE_TAIL_LINES = 80; const DEFAULT_LANE_TIMEOUT_MS = 120 * 60 * 1000; const DEFAULT_LANE_START_STAGGER_MS = 2_000; -const DEFAULT_LIVE_RETRIES = 1; const DEFAULT_STATUS_INTERVAL_MS = 30_000; const DEFAULT_PREFLIGHT_RUN_TIMEOUT_MS = 60_000; const DEFAULT_TIMINGS_FILE = path.join(ROOT_DIR, ".artifacts/docker-tests/lane-timings.json"); -const DEFAULT_PROFILE = "all"; -const RELEASE_PATH_PROFILE = "release-path"; -const LIVE_PROFILE_TIMEOUT_MS = 20 * 60 * 1000; -const LIVE_CLI_TIMEOUT_MS = 20 * 60 * 1000; -const LIVE_ACP_TIMEOUT_MS = 20 * 60 * 1000; -const OPENWEBUI_TIMEOUT_MS = 20 * 60 * 1000; -const BUNDLED_UPDATE_TIMEOUT_MS = 20 * 60 * 1000; -const DEFAULT_RESOURCE_LIMITS = { - docker: DEFAULT_PARALLELISM, - live: 9, - "live:claude": 4, - "live:codex": 4, - "live:droid": 4, - "live:gemini": 4, - "live:opencode": 4, - npm: 10, - service: 7, -}; -const LIVE_RETRY_PATTERNS = [ - /529\b/i, - /overloaded/i, - /capacity/i, - /rate.?limit/i, - /gateway closed \(1000 normal closure\)/i, - /ECONNRESET|ETIMEDOUT|ENOTFOUND/i, -]; - -const bundledChannelLaneCommand = - "OPENCLAW_SKIP_DOCKER_BUILD=1 OPENCLAW_BUNDLED_CHANNEL_UPDATE_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_ROOT_OWNED_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_SETUP_ENTRY_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_LOAD_FAILURE_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_DISABLED_CONFIG_SCENARIO=0 pnpm test:docker:bundled-channel-deps"; - -function lane(name, command, options = {}) { - return { - cacheKey: options.cacheKey, - command, - e2eImageKind: options.e2eImageKind ?? (options.live ? undefined : "functional"), - estimateSeconds: options.estimateSeconds, - live: options.live === true, - name, - retryPatterns: options.retryPatterns ?? [], - retries: options.retries ?? 0, - resources: options.resources ?? [], - timeoutMs: options.timeoutMs, - weight: options.weight ?? 1, - }; -} - -function liveProviderResource(provider) { - if (!provider) { - return undefined; +const cliArgs = new Set(process.argv.slice(2)); +for (const arg of cliArgs) { + if (arg !== "--plan-json") { + throw new Error(`unknown argument: ${arg}`); } - if (provider === "claude-cli" || provider === "claude") { - return "live:claude"; - } - if (provider === "codex-cli" || provider === "codex") { - return "live:codex"; - } - if (provider === "droid") { - return "live:droid"; - } - if (provider === "google-gemini-cli" || provider === "gemini") { - return "live:gemini"; - } - if (provider === "opencode") { - return "live:opencode"; - } - if (provider === "openai") { - return "live:openai"; - } - return `live:${provider}`; -} - -function liveProviderResources(options) { - const providers = options.providers ?? (options.provider ? [options.provider] : []); - return providers.map(liveProviderResource).filter(Boolean); -} - -function liveLane(name, command, options = {}) { - return lane(name, command, { - ...options, - live: true, - resources: ["live", ...liveProviderResources(options), ...(options.resources ?? [])], - retryPatterns: options.retryPatterns ?? LIVE_RETRY_PATTERNS, - retries: options.retries ?? DEFAULT_LIVE_RETRIES, - weight: options.weight ?? 3, - }); -} - -function npmLane(name, command, options = {}) { - return lane(name, command, { - ...options, - e2eImageKind: options.e2eImageKind ?? "bare", - resources: ["npm", ...(options.resources ?? [])], - weight: options.weight ?? 2, - }); -} - -function serviceLane(name, command, options = {}) { - return lane(name, command, { - ...options, - resources: ["service", ...(options.resources ?? [])], - weight: options.weight ?? 2, - }); -} - -const bundledScenarioLanes = [ - npmLane( - "bundled-channel-telegram", - `OPENCLAW_BUNDLED_CHANNELS=telegram ${bundledChannelLaneCommand}`, - ), - npmLane( - "bundled-channel-discord", - `OPENCLAW_BUNDLED_CHANNELS=discord ${bundledChannelLaneCommand}`, - ), - npmLane("bundled-channel-slack", `OPENCLAW_BUNDLED_CHANNELS=slack ${bundledChannelLaneCommand}`), - npmLane( - "bundled-channel-feishu", - `OPENCLAW_BUNDLED_CHANNELS=feishu ${bundledChannelLaneCommand}`, - ), - npmLane( - "bundled-channel-memory-lancedb", - `OPENCLAW_BUNDLED_CHANNELS=memory-lancedb ${bundledChannelLaneCommand}`, - ), - npmLane( - "bundled-channel-update-telegram", - "OPENCLAW_SKIP_DOCKER_BUILD=1 OPENCLAW_BUNDLED_CHANNEL_SCENARIOS=0 OPENCLAW_BUNDLED_CHANNEL_UPDATE_SCENARIO=1 OPENCLAW_BUNDLED_CHANNEL_UPDATE_TARGETS=telegram OPENCLAW_BUNDLED_CHANNEL_ROOT_OWNED_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_SETUP_ENTRY_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_LOAD_FAILURE_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_DISABLED_CONFIG_SCENARIO=0 pnpm test:docker:bundled-channel-deps", - { timeoutMs: BUNDLED_UPDATE_TIMEOUT_MS }, - ), - npmLane( - "bundled-channel-update-discord", - "OPENCLAW_SKIP_DOCKER_BUILD=1 OPENCLAW_BUNDLED_CHANNEL_SCENARIOS=0 OPENCLAW_BUNDLED_CHANNEL_UPDATE_SCENARIO=1 OPENCLAW_BUNDLED_CHANNEL_UPDATE_TARGETS=discord OPENCLAW_BUNDLED_CHANNEL_ROOT_OWNED_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_SETUP_ENTRY_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_LOAD_FAILURE_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_DISABLED_CONFIG_SCENARIO=0 pnpm test:docker:bundled-channel-deps", - { timeoutMs: BUNDLED_UPDATE_TIMEOUT_MS }, - ), - npmLane( - "bundled-channel-update-slack", - "OPENCLAW_SKIP_DOCKER_BUILD=1 OPENCLAW_BUNDLED_CHANNEL_SCENARIOS=0 OPENCLAW_BUNDLED_CHANNEL_UPDATE_SCENARIO=1 OPENCLAW_BUNDLED_CHANNEL_UPDATE_TARGETS=slack OPENCLAW_BUNDLED_CHANNEL_ROOT_OWNED_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_SETUP_ENTRY_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_LOAD_FAILURE_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_DISABLED_CONFIG_SCENARIO=0 pnpm test:docker:bundled-channel-deps", - { timeoutMs: BUNDLED_UPDATE_TIMEOUT_MS }, - ), - npmLane( - "bundled-channel-update-feishu", - "OPENCLAW_SKIP_DOCKER_BUILD=1 OPENCLAW_BUNDLED_CHANNEL_SCENARIOS=0 OPENCLAW_BUNDLED_CHANNEL_UPDATE_SCENARIO=1 OPENCLAW_BUNDLED_CHANNEL_UPDATE_TARGETS=feishu OPENCLAW_BUNDLED_CHANNEL_ROOT_OWNED_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_SETUP_ENTRY_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_LOAD_FAILURE_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_DISABLED_CONFIG_SCENARIO=0 pnpm test:docker:bundled-channel-deps", - { timeoutMs: BUNDLED_UPDATE_TIMEOUT_MS }, - ), - npmLane( - "bundled-channel-update-memory-lancedb", - "OPENCLAW_SKIP_DOCKER_BUILD=1 OPENCLAW_BUNDLED_CHANNEL_SCENARIOS=0 OPENCLAW_BUNDLED_CHANNEL_UPDATE_SCENARIO=1 OPENCLAW_BUNDLED_CHANNEL_UPDATE_TARGETS=memory-lancedb OPENCLAW_BUNDLED_CHANNEL_ROOT_OWNED_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_SETUP_ENTRY_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_LOAD_FAILURE_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_DISABLED_CONFIG_SCENARIO=0 pnpm test:docker:bundled-channel-deps", - { timeoutMs: BUNDLED_UPDATE_TIMEOUT_MS }, - ), - npmLane( - "bundled-channel-update-acpx", - "OPENCLAW_SKIP_DOCKER_BUILD=1 OPENCLAW_BUNDLED_CHANNEL_SCENARIOS=0 OPENCLAW_BUNDLED_CHANNEL_UPDATE_SCENARIO=1 OPENCLAW_BUNDLED_CHANNEL_UPDATE_TARGETS=acpx OPENCLAW_BUNDLED_CHANNEL_ROOT_OWNED_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_SETUP_ENTRY_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_LOAD_FAILURE_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_DISABLED_CONFIG_SCENARIO=0 pnpm test:docker:bundled-channel-deps", - { timeoutMs: BUNDLED_UPDATE_TIMEOUT_MS }, - ), - npmLane( - "bundled-channel-root-owned", - "OPENCLAW_SKIP_DOCKER_BUILD=1 OPENCLAW_BUNDLED_CHANNEL_SCENARIOS=0 OPENCLAW_BUNDLED_CHANNEL_UPDATE_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_ROOT_OWNED_SCENARIO=1 OPENCLAW_BUNDLED_CHANNEL_SETUP_ENTRY_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_LOAD_FAILURE_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_DISABLED_CONFIG_SCENARIO=0 pnpm test:docker:bundled-channel-deps", - ), - npmLane( - "bundled-channel-setup-entry", - "OPENCLAW_SKIP_DOCKER_BUILD=1 OPENCLAW_BUNDLED_CHANNEL_SCENARIOS=0 OPENCLAW_BUNDLED_CHANNEL_UPDATE_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_ROOT_OWNED_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_SETUP_ENTRY_SCENARIO=1 OPENCLAW_BUNDLED_CHANNEL_LOAD_FAILURE_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_DISABLED_CONFIG_SCENARIO=0 pnpm test:docker:bundled-channel-deps", - ), - npmLane( - "bundled-channel-load-failure", - "OPENCLAW_SKIP_DOCKER_BUILD=1 OPENCLAW_BUNDLED_CHANNEL_SCENARIOS=0 OPENCLAW_BUNDLED_CHANNEL_UPDATE_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_ROOT_OWNED_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_SETUP_ENTRY_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_LOAD_FAILURE_SCENARIO=1 OPENCLAW_BUNDLED_CHANNEL_DISABLED_CONFIG_SCENARIO=0 pnpm test:docker:bundled-channel-deps", - ), - npmLane( - "bundled-channel-disabled-config", - "OPENCLAW_SKIP_DOCKER_BUILD=1 OPENCLAW_BUNDLED_CHANNEL_SCENARIOS=0 OPENCLAW_BUNDLED_CHANNEL_UPDATE_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_ROOT_OWNED_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_SETUP_ENTRY_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_LOAD_FAILURE_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_DISABLED_CONFIG_SCENARIO=1 pnpm test:docker:bundled-channel-deps", - ), -]; - -const lanes = [ - liveLane("live-models", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:live-models", { - providers: ["claude-cli", "codex-cli", "google-gemini-cli"], - timeoutMs: LIVE_PROFILE_TIMEOUT_MS, - weight: 4, - }), - liveLane("live-gateway", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:live-gateway", { - providers: ["claude-cli", "codex-cli", "google-gemini-cli"], - timeoutMs: LIVE_PROFILE_TIMEOUT_MS, - weight: 4, - }), - liveLane( - "live-cli-backend-claude", - "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:live-cli-backend:claude", - { - cacheKey: "cli-backend-claude", - provider: "claude-cli", - resources: ["npm"], - timeoutMs: LIVE_CLI_TIMEOUT_MS, - weight: 3, - }, - ), - liveLane( - "live-cli-backend-gemini", - "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:live-cli-backend:gemini", - { - cacheKey: "cli-backend-gemini", - provider: "google-gemini-cli", - resources: ["npm"], - timeoutMs: LIVE_CLI_TIMEOUT_MS, - weight: 3, - }, - ), - serviceLane("openwebui", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:openwebui", { - timeoutMs: OPENWEBUI_TIMEOUT_MS, - weight: 5, - }), - serviceLane("onboard", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:onboard", { - weight: 2, - }), - npmLane( - "npm-onboard-channel-agent", - "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:npm-onboard-channel-agent", - { resources: ["service"], weight: 3 }, - ), - serviceLane("gateway-network", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:gateway-network"), - serviceLane( - "agents-delete-shared-workspace", - "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:agents-delete-shared-workspace", - ), - serviceLane("mcp-channels", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:mcp-channels", { - resources: ["npm"], - weight: 3, - }), - lane("pi-bundle-mcp-tools", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:pi-bundle-mcp-tools"), - lane("crestodian-rescue", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:crestodian-rescue"), - lane("crestodian-planner", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:crestodian-planner"), - serviceLane( - "cron-mcp-cleanup", - "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:cron-mcp-cleanup", - { resources: ["npm"], weight: 3 }, - ), - npmLane("doctor-switch", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:doctor-switch", { - weight: 3, - }), - npmLane( - "update-channel-switch", - "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:update-channel-switch", - { - timeoutMs: 30 * 60 * 1000, - weight: 3, - }, - ), - lane("plugins", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:plugins", { - resources: ["npm", "service"], - weight: 6, - }), - npmLane("plugin-update", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:plugin-update"), - serviceLane("config-reload", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:config-reload"), - ...bundledScenarioLanes, - lane("openai-image-auth", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:openai-image-auth"), - lane( - "crestodian-first-run", - "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:crestodian-first-run", - ), - lane( - "session-runtime-context", - "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:session-runtime-context", - ), - lane("qr", "pnpm test:docker:qr"), -]; - -const exclusiveLanes = [ - serviceLane( - "openai-web-search-minimal", - "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:openai-web-search-minimal", - { timeoutMs: 8 * 60 * 1000 }, - ), - liveLane( - "live-codex-harness", - "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:live-codex-harness", - { - cacheKey: "codex-harness", - provider: "codex-cli", - resources: ["npm"], - timeoutMs: LIVE_ACP_TIMEOUT_MS, - weight: 3, - }, - ), - liveLane("live-codex-bind", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:live-codex-bind", { - cacheKey: "codex-harness", - provider: "codex-cli", - resources: ["npm"], - timeoutMs: LIVE_ACP_TIMEOUT_MS, - weight: 3, - }), - liveLane( - "live-cli-backend-codex", - "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:live-cli-backend:codex", - { - cacheKey: "cli-backend-codex", - provider: "codex-cli", - resources: ["npm"], - timeoutMs: LIVE_CLI_TIMEOUT_MS, - weight: 3, - }, - ), - liveLane( - "live-acp-bind-claude", - "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:live-acp-bind:claude", - { - cacheKey: "acp-bind-claude", - provider: "claude-cli", - resources: ["npm"], - timeoutMs: LIVE_ACP_TIMEOUT_MS, - weight: 3, - }, - ), - liveLane( - "live-acp-bind-codex", - "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:live-acp-bind:codex", - { - cacheKey: "acp-bind-codex", - provider: "codex-cli", - resources: ["npm"], - timeoutMs: LIVE_ACP_TIMEOUT_MS, - weight: 3, - }, - ), - liveLane( - "live-acp-bind-droid", - "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:live-acp-bind:droid", - { - cacheKey: "acp-bind-droid", - provider: "droid", - resources: ["npm"], - timeoutMs: LIVE_ACP_TIMEOUT_MS, - weight: 3, - }, - ), - liveLane( - "live-acp-bind-gemini", - "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:live-acp-bind:gemini", - { - cacheKey: "acp-bind-gemini", - provider: "google-gemini-cli", - resources: ["npm"], - timeoutMs: LIVE_ACP_TIMEOUT_MS, - weight: 3, - }, - ), - liveLane( - "live-acp-bind-opencode", - "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:live-acp-bind:opencode", - { - cacheKey: "acp-bind-opencode", - provider: "opencode", - resources: ["npm"], - timeoutMs: LIVE_ACP_TIMEOUT_MS, - weight: 3, - }, - ), -]; - -const tailLanes = exclusiveLanes; - -const releasePathChunks = { - core: [ - lane("qr", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:qr"), - serviceLane("onboard", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:onboard", { - weight: 2, - }), - serviceLane("gateway-network", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:gateway-network"), - serviceLane("config-reload", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:config-reload"), - lane( - "session-runtime-context", - "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:session-runtime-context", - ), - lane( - "pi-bundle-mcp-tools", - "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:pi-bundle-mcp-tools", - ), - serviceLane("mcp-channels", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:mcp-channels", { - resources: ["npm"], - weight: 3, - }), - ], - "package-update": [ - npmLane("install-e2e", "OPENCLAW_E2E_MODELS=both pnpm test:install:e2e", { - resources: ["service"], - weight: 4, - }), - npmLane( - "npm-onboard-channel-agent", - "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:npm-onboard-channel-agent", - { resources: ["service"], weight: 3 }, - ), - npmLane("doctor-switch", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:doctor-switch", { - weight: 3, - }), - npmLane( - "update-channel-switch", - "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:update-channel-switch", - { - timeoutMs: 30 * 60 * 1000, - weight: 3, - }, - ), - ], - "plugins-integrations": [ - lane("plugins", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:plugins", { - resources: ["npm", "service"], - weight: 6, - }), - npmLane("plugin-update", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:plugin-update"), - npmLane( - "bundled-channel-deps", - "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:bundled-channel-deps", - { resources: ["service"], weight: 3 }, - ), - serviceLane( - "cron-mcp-cleanup", - "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:cron-mcp-cleanup", - { - resources: ["npm"], - weight: 3, - }, - ), - serviceLane( - "openai-web-search-minimal", - "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:openai-web-search-minimal", - { timeoutMs: 8 * 60 * 1000 }, - ), - ], -}; - -function releasePathChunkLanes(chunk, options = {}) { - const base = releasePathChunks[chunk]; - if (!base) { - throw new Error( - `OPENCLAW_DOCKER_ALL_CHUNK must be one of: ${Object.keys(releasePathChunks).join(", ")}. Got: ${JSON.stringify(chunk)}`, - ); - } - if (chunk !== "plugins-integrations" || !options.includeOpenWebUI) { - return base; - } - return [ - ...base, - serviceLane("openwebui", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:openwebui", { - timeoutMs: OPENWEBUI_TIMEOUT_MS, - weight: 5, - }), - ]; -} - -function allReleasePathLanes(options = {}) { - return Object.keys(releasePathChunks).flatMap((chunk) => - releasePathChunkLanes(chunk, { - includeOpenWebUI: chunk === "plugins-integrations" && options.includeOpenWebUI, - }), - ); -} - -function parseLaneSelection(raw) { - if (!raw) { - return []; - } - return [ - ...new Set( - String(raw) - .split(/[,\s]+/u) - .map((token) => token.trim()) - .filter(Boolean), - ), - ]; -} - -function dedupeLanes(poolLanes) { - const byName = new Map(); - for (const poolLane of poolLanes) { - if (!byName.has(poolLane.name)) { - byName.set(poolLane.name, poolLane); - } - } - return [...byName.values()]; -} - -function selectNamedLanes(poolLanes, selectedNames, label) { - const byName = new Map(poolLanes.map((poolLane) => [poolLane.name, poolLane])); - const missing = selectedNames.filter((name) => !byName.has(name)); - if (missing.length > 0) { - throw new Error( - `${label} unknown lane(s): ${missing.join(", ")}. Available lanes: ${[...byName.keys()] - .toSorted((a, b) => a.localeCompare(b)) - .join(", ")}`, - ); - } - return selectedNames.map((name) => byName.get(name)); } function parsePositiveInt(raw, fallback, label) { @@ -539,37 +71,6 @@ function parseBool(raw, fallback) { return !/^(?:0|false|no)$/i.test(raw); } -function parseLiveMode(raw) { - const mode = raw || "all"; - if (mode === "all" || mode === "skip" || mode === "only") { - return mode; - } - throw new Error( - `OPENCLAW_DOCKER_ALL_LIVE_MODE must be one of: all, skip, only. Got: ${JSON.stringify(raw)}`, - ); -} - -function parseProfile(raw) { - const profile = raw || DEFAULT_PROFILE; - if (profile === DEFAULT_PROFILE || profile === RELEASE_PATH_PROFILE) { - return profile; - } - throw new Error( - `OPENCLAW_DOCKER_ALL_PROFILE must be one of: ${DEFAULT_PROFILE}, ${RELEASE_PATH_PROFILE}. Got: ${JSON.stringify(raw)}`, - ); -} - -function applyLiveMode(poolLanes, mode) { - if (mode === "all") { - return poolLanes; - } - return poolLanes.filter((poolLane) => (mode === "only" ? poolLane.live : !poolLane.live)); -} - -function applyLiveRetries(poolLanes, retries) { - return poolLanes.map((poolLane) => (poolLane.live ? { ...poolLane, retries } : poolLane)); -} - function resourceLimitsSummary(resourceLimits) { return Object.entries(resourceLimits) .map(([resource, limit]) => `${resource}=${String(limit)}`) @@ -601,21 +102,19 @@ function parseSchedulerOptions(env, parallelism) { }; } -function laneWeight(poolLane) { - return Math.max(1, poolLane.weight ?? 1); +function timingSeconds(timingStore, poolLane) { + const fromStore = timingStore?.lanes?.[poolLane.name]?.durationSeconds; + if (typeof fromStore === "number" && Number.isFinite(fromStore) && fromStore > 0) { + return fromStore; + } + return poolLane.estimateSeconds ?? 0; } -function laneResources(poolLane) { - return ["docker", ...(poolLane.resources ?? [])]; -} - -function laneSummary(poolLane) { - const resources = laneResources(poolLane).join(","); - const timeout = poolLane.timeoutMs ? ` timeout=${Math.round(poolLane.timeoutMs / 1000)}s` : ""; - const retries = poolLane.retries > 0 ? ` retries=${poolLane.retries}` : ""; - const cache = poolLane.cacheKey ? ` cache=${poolLane.cacheKey}` : ""; - const image = poolLane.e2eImageKind ? ` image=${poolLane.e2eImageKind}` : ""; - return `${poolLane.name}(w=${laneWeight(poolLane)} r=${resources}${timeout}${retries}${cache}${image})`; +function orderLanes(poolLanes, timingStore) { + return poolLanes + .map((poolLane, index) => ({ index, poolLane, seconds: timingSeconds(timingStore, poolLane) })) + .toSorted((a, b) => b.seconds - a.seconds || a.index - b.index) + .map(({ poolLane }) => poolLane); } function sleep(ms) { @@ -672,47 +171,6 @@ function buildLaneRerunCommand(name, baseEnv) { .join(" ")} pnpm test:docker:all`; } -function findLaneByName(name) { - return dedupeLanes([ - ...allReleasePathLanes({ includeOpenWebUI: true }), - ...lanes, - ...tailLanes, - ]).find((poolLane) => poolLane.name === name); -} - -function e2eImageForKind(kind, baseEnv) { - if (kind === "bare") { - return baseEnv.OPENCLAW_DOCKER_E2E_BARE_IMAGE || baseEnv.OPENCLAW_DOCKER_E2E_IMAGE; - } - if (kind === "functional") { - return baseEnv.OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE || baseEnv.OPENCLAW_DOCKER_E2E_IMAGE; - } - return baseEnv.OPENCLAW_DOCKER_E2E_IMAGE; -} - -function e2eImageForLane(poolLane, baseEnv) { - return e2eImageForKind(poolLane.e2eImageKind, baseEnv); -} - -function lanesNeedE2eImageKind(poolLanes, kind) { - return poolLanes.some((poolLane) => poolLane.e2eImageKind === kind); -} - -function timingSeconds(timingStore, poolLane) { - const fromStore = timingStore?.lanes?.[poolLane.name]?.durationSeconds; - if (typeof fromStore === "number" && Number.isFinite(fromStore) && fromStore > 0) { - return fromStore; - } - return poolLane.estimateSeconds ?? 0; -} - -function orderLanes(poolLanes, timingStore) { - return poolLanes - .map((poolLane, index) => ({ index, poolLane, seconds: timingSeconds(timingStore, poolLane) })) - .toSorted((a, b) => b.seconds - a.seconds || a.index - b.index) - .map(({ poolLane }) => poolLane); -} - async function loadTimingStore(file, enabled) { if (!enabled) { return { enabled: false, file, lanes: {}, version: 1 }; @@ -812,10 +270,6 @@ function printLaneManifest(label, poolLanes, timingStore) { } } -function lanesNeedOpenClawPackage(poolLanes) { - return poolLanes.some((poolLane) => poolLane.e2eImageKind); -} - function dockerPreflightContainerNames(raw) { return raw .split(/\r?\n/) @@ -1016,15 +470,10 @@ async function runDockerPreflight(baseEnv, options) { } async function prepareOpenClawPackage(baseEnv, logDir) { - const existing = - baseEnv.OPENCLAW_CURRENT_PACKAGE_TGZ || - baseEnv.OPENCLAW_BUNDLED_CHANNEL_PACKAGE_TGZ || - baseEnv.OPENCLAW_NPM_ONBOARD_PACKAGE_TGZ; + const existing = baseEnv.OPENCLAW_CURRENT_PACKAGE_TGZ; if (existing) { const packageTgz = path.resolve(existing); baseEnv.OPENCLAW_CURRENT_PACKAGE_TGZ = packageTgz; - baseEnv.OPENCLAW_BUNDLED_CHANNEL_PACKAGE_TGZ ||= packageTgz; - baseEnv.OPENCLAW_NPM_ONBOARD_PACKAGE_TGZ ||= packageTgz; baseEnv.OPENCLAW_BUNDLED_CHANNEL_HOST_BUILD = "0"; baseEnv.OPENCLAW_NPM_ONBOARD_HOST_BUILD = "0"; console.log(`==> OpenClaw package: ${packageTgz}`); @@ -1033,33 +482,29 @@ async function prepareOpenClawPackage(baseEnv, logDir) { const packDir = path.join(logDir, "openclaw-package"); await mkdir(packDir, { recursive: true }); - await runForeground("Build OpenClaw package artifacts once", "pnpm build", baseEnv); + const packageTgz = path.join(packDir, "openclaw-current.tgz"); await runForeground( - "Write OpenClaw package inventory", - "node --import tsx --input-type=module -e \"const { writePackageDistInventory } = await import('./src/infra/package-dist-inventory.ts'); await writePackageDistInventory(process.cwd());\"", + "Prepare OpenClaw package once", + `node scripts/package-openclaw-for-docker.mjs --output-dir ${shellQuote(packDir)} --output-name openclaw-current.tgz`, baseEnv, ); - await runForeground( - "Pack OpenClaw package once", - `npm pack --silent --ignore-scripts --pack-destination ${shellQuote(packDir)}`, - baseEnv, - ); - - const packed = (await fs.promises.readdir(packDir)) - .filter((entry) => /^openclaw-.*\.tgz$/.test(entry)) - .toSorted() - .at(-1); - if (!packed) { - throw new Error(`missing packed OpenClaw tarball in ${packDir}`); - } - baseEnv.OPENCLAW_CURRENT_PACKAGE_TGZ = path.join(packDir, packed); - baseEnv.OPENCLAW_BUNDLED_CHANNEL_PACKAGE_TGZ = baseEnv.OPENCLAW_CURRENT_PACKAGE_TGZ; + await fs.promises.access(packageTgz); + baseEnv.OPENCLAW_CURRENT_PACKAGE_TGZ = packageTgz; baseEnv.OPENCLAW_BUNDLED_CHANNEL_HOST_BUILD = "0"; - baseEnv.OPENCLAW_NPM_ONBOARD_PACKAGE_TGZ = baseEnv.OPENCLAW_CURRENT_PACKAGE_TGZ; baseEnv.OPENCLAW_NPM_ONBOARD_HOST_BUILD = "0"; console.log(`==> OpenClaw package: ${baseEnv.OPENCLAW_CURRENT_PACKAGE_TGZ}`); } +function e2eImageForLane(poolLane, baseEnv) { + if (poolLane.e2eImageKind === "bare") { + return baseEnv.OPENCLAW_DOCKER_E2E_BARE_IMAGE; + } + if (poolLane.e2eImageKind === "functional") { + return baseEnv.OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE; + } + return undefined; +} + function laneEnv(poolLane, baseEnv, logDir, cacheKey) { const env = { ...baseEnv, @@ -1405,6 +850,9 @@ async function main() { const preflightCleanup = parseBool(process.env.OPENCLAW_DOCKER_ALL_PREFLIGHT_CLEANUP, true); const timingsEnabled = parseBool(process.env.OPENCLAW_DOCKER_ALL_TIMINGS, true); const buildEnabled = parseBool(process.env.OPENCLAW_DOCKER_ALL_BUILD, true); + const planJson = + cliArgs.has("--plan-json") || parseBool(process.env.OPENCLAW_DOCKER_ALL_PLAN_JSON, false); + const planReleaseAll = parseBool(process.env.OPENCLAW_DOCKER_ALL_PLAN_RELEASE_ALL, false); const profile = parseProfile(process.env.OPENCLAW_DOCKER_ALL_PROFILE); const releaseChunk = process.env.OPENCLAW_DOCKER_ALL_CHUNK || process.env.DOCKER_E2E_CHUNK || ""; const includeOpenWebUI = parseBool( @@ -1431,7 +879,6 @@ async function main() { process.env.OPENCLAW_DOCKER_ALL_LOG_DIR || path.join(ROOT_DIR, ".artifacts/docker-tests", runId), ); - await mkdir(logDir, { recursive: true }); const baseEnv = commandEnv({ OPENCLAW_DOCKER_E2E_BARE_IMAGE: @@ -1450,40 +897,24 @@ async function main() { appendExtension(baseEnv, "codex"); const timingStore = await loadTimingStore(timingsFile, timingsEnabled); - const retriedMainLanes = applyLiveRetries(lanes, liveRetries); - const retriedTailLanes = applyLiveRetries(tailLanes, liveRetries); - const releaseLanes = - selectedLaneNames.length === 0 && profile === RELEASE_PATH_PROFILE - ? releasePathChunkLanes(releaseChunk, { includeOpenWebUI }) - : undefined; - const selectedLanes = - selectedLaneNames.length > 0 - ? selectNamedLanes( - dedupeLanes([ - ...allReleasePathLanes({ includeOpenWebUI }), - ...retriedMainLanes, - ...retriedTailLanes, - ]), - selectedLaneNames, - "OPENCLAW_DOCKER_ALL_LANES", - ) - : undefined; - const configuredLanes = selectedLanes - ? selectedLanes - : releaseLanes - ? releaseLanes - : liveMode === "only" - ? applyLiveMode([...retriedMainLanes, ...retriedTailLanes], liveMode) - : applyLiveMode(retriedMainLanes, liveMode); - const configuredTailLanes = - selectedLanes || releaseLanes - ? [] - : liveMode === "only" - ? [] - : applyLiveMode(retriedTailLanes, liveMode); - const orderedLanes = orderLanes(configuredLanes, timingStore); - const orderedTailLanes = orderLanes(configuredTailLanes, timingStore); + const { orderedLanes, orderedTailLanes, plan, scheduledLanes } = resolveDockerE2ePlan({ + includeOpenWebUI, + liveMode, + liveRetries, + orderLanes, + planReleaseAll: planJson && planReleaseAll, + profile, + releaseChunk, + selectedLaneNames, + timingStore, + }); + if (planJson) { + process.stdout.write(`${JSON.stringify(plan, null, 2)}\n`); + return; + } + + await mkdir(logDir, { recursive: true }); console.log(`==> Docker test logs: ${logDir}`); console.log(`==> Profile: ${profile}${releaseChunk ? ` chunk=${releaseChunk}` : ""}`); console.log(`==> Parallelism: ${parallelism}`); @@ -1538,7 +969,6 @@ async function main() { }); }, ); - const scheduledLanes = [...orderedLanes, ...orderedTailLanes]; if (lanesNeedOpenClawPackage(scheduledLanes)) { await runPhase(phases, "prepare-openclaw-package", {}, async () => { await prepareOpenClawPackage(baseEnv, logDir); From cd417f3b68854bc430bcb97b2bb24d58f453d6ed Mon Sep 17 00:00:00 2001 From: Peter Steinberger <steipete@gmail.com> Date: Sun, 26 Apr 2026 23:36:22 +0100 Subject: [PATCH 069/418] ci: derive docker e2e artifacts from plan --- .../openclaw-live-and-e2e-checks-reusable.yml | 227 +++++++----------- 1 file changed, 86 insertions(+), 141 deletions(-) diff --git a/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml b/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml index 6c29fa97330..1a0c9bcf160 100644 --- a/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml +++ b/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml @@ -466,56 +466,54 @@ jobs: - name: Hydrate live auth/profile inputs run: bash scripts/ci-hydrate-live-auth.sh + - name: Plan Docker E2E chunk + id: plan + shell: bash + run: | + set -euo pipefail + mkdir -p .artifacts/docker-tests + export OPENCLAW_DOCKER_ALL_PROFILE=release-path + export OPENCLAW_DOCKER_ALL_CHUNK="${DOCKER_E2E_CHUNK}" + export OPENCLAW_DOCKER_ALL_INCLUDE_OPENWEBUI="${INCLUDE_OPENWEBUI}" + node scripts/test-docker-all.mjs --plan-json > ".artifacts/docker-tests/release-${DOCKER_E2E_CHUNK}-plan.json" + node scripts/docker-e2e.mjs github-outputs ".artifacts/docker-tests/release-${DOCKER_E2E_CHUNK}-plan.json" >> "$GITHUB_OUTPUT" + - name: Download OpenClaw Docker E2E package + if: steps.plan.outputs.needs_package == '1' uses: actions/download-artifact@v8 with: name: docker-e2e-package path: .artifacts/docker-e2e-package - - name: Pull shared Docker E2E image + - name: Pull shared bare Docker E2E image + if: steps.plan.outputs.needs_bare_image == '1' shell: bash run: | set -euo pipefail - case "${DOCKER_E2E_CHUNK}" in - core) - docker pull "${OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE}" - ;; - package-update) - docker pull "${OPENCLAW_DOCKER_E2E_BARE_IMAGE}" - ;; - plugins-integrations) - docker pull "${OPENCLAW_DOCKER_E2E_BARE_IMAGE}" - docker pull "${OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE}" - ;; - *) - docker pull "${OPENCLAW_DOCKER_E2E_IMAGE}" - ;; - esac + docker pull "${OPENCLAW_DOCKER_E2E_BARE_IMAGE}" + + - name: Pull shared functional Docker E2E image + if: steps.plan.outputs.needs_functional_image == '1' + shell: bash + run: | + set -euo pipefail + docker pull "${OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE}" - name: Validate chunk credentials shell: bash run: | set -euo pipefail - case "${DOCKER_E2E_CHUNK}" in - package-update) - [[ -n "${OPENAI_API_KEY:-}" ]] || { - echo "OPENAI_API_KEY is required for installer Docker E2E." >&2 - exit 1 - } - if [[ -z "${ANTHROPIC_API_TOKEN:-}" && -z "${ANTHROPIC_API_KEY:-}" ]]; then - echo "ANTHROPIC_API_TOKEN or ANTHROPIC_API_KEY is required for installer Docker E2E." >&2 - exit 1 - fi - ;; - plugins-integrations) - if [[ "${INCLUDE_OPENWEBUI}" == "true" ]]; then - [[ -n "${OPENAI_API_KEY:-}" ]] || { - echo "OPENAI_API_KEY is required for the Open WebUI Docker smoke." >&2 - exit 1 - } - fi - ;; - esac + credentials=",${{ steps.plan.outputs.credentials }}," + if [[ "$credentials" == *",openai,"* ]]; then + [[ -n "${OPENAI_API_KEY:-}" ]] || { + echo "OPENAI_API_KEY is required for selected Docker E2E lanes." >&2 + exit 1 + } + fi + if [[ "$credentials" == *",anthropic,"* && -z "${ANTHROPIC_API_TOKEN:-}" && -z "${ANTHROPIC_API_KEY:-}" ]]; then + echo "ANTHROPIC_API_TOKEN or ANTHROPIC_API_KEY is required for selected Docker E2E lanes." >&2 + exit 1 + fi - name: Run Docker E2E chunk shell: bash @@ -542,31 +540,7 @@ jobs: echo "Docker chunk summary missing: \`$summary\`" >> "$GITHUB_STEP_SUMMARY" exit 0 fi - node --input-type=module - "$summary" <<'NODE' >> "$GITHUB_STEP_SUMMARY" - import fs from "node:fs"; - const summary = JSON.parse(fs.readFileSync(process.argv[2], "utf8")); - const lanes = Array.isArray(summary.lanes) ? summary.lanes : []; - console.log(`### Docker E2E chunk: ${summary.chunk ?? "unknown"}`); - console.log(""); - console.log(`Status: \`${summary.status}\``); - console.log(""); - console.log("| Lane | Status | Seconds | Timed out | Rerun |"); - console.log("| --- | ---: | ---: | --- | --- |"); - for (const lane of lanes) { - const status = lane.status === 0 ? "pass" : `fail ${lane.status}`; - const rerun = String(lane.rerunCommand ?? "").replaceAll("`", "\\`"); - console.log(`| \`${lane.name}\` | ${status} | ${lane.elapsedSeconds ?? ""} | ${lane.timedOut ? "yes" : "no"} | \`${rerun}\` |`); - } - const phases = Array.isArray(summary.phases) ? summary.phases : []; - if (phases.length > 0) { - console.log(""); - console.log("| Phase | Seconds | Status | Image kind |"); - console.log("| --- | ---: | --- | --- |"); - for (const phase of phases) { - console.log(`| \`${phase.name}\` | ${phase.elapsedSeconds ?? ""} | ${phase.status ?? ""} | ${phase.imageKind ?? ""} |`); - } - } - NODE + node scripts/docker-e2e.mjs summary "$summary" "Docker E2E chunk: ${DOCKER_E2E_CHUNK:-unknown}" >> "$GITHUB_STEP_SUMMARY" - name: Upload Docker E2E chunk artifacts if: always() @@ -658,71 +632,65 @@ jobs: - name: Hydrate live auth/profile inputs run: bash scripts/ci-hydrate-live-auth.sh - - name: Detect targeted Docker lane image needs - id: lane_class + - name: Plan targeted Docker E2E lanes + id: plan shell: bash run: | set -euo pipefail - needs_e2e=0 - IFS=', ' read -r -a lanes <<< "${DOCKER_E2E_LANES}" - for lane in "${lanes[@]}"; do - [[ -z "$lane" ]] && continue - if [[ "$lane" != live-* ]]; then - needs_e2e=1 - break - fi - done - echo "needs_e2e=${needs_e2e}" >> "$GITHUB_OUTPUT" + mkdir -p .artifacts/docker-tests + export OPENCLAW_DOCKER_ALL_LANES="${DOCKER_E2E_LANES}" + export OPENCLAW_DOCKER_ALL_INCLUDE_OPENWEBUI="${INCLUDE_OPENWEBUI}" + node scripts/test-docker-all.mjs --plan-json > .artifacts/docker-tests/targeted-plan.json + node scripts/docker-e2e.mjs github-outputs .artifacts/docker-tests/targeted-plan.json >> "$GITHUB_OUTPUT" - name: Download OpenClaw Docker E2E package - if: steps.lane_class.outputs.needs_e2e == '1' + if: steps.plan.outputs.needs_package == '1' uses: actions/download-artifact@v8 with: name: docker-e2e-package path: .artifacts/docker-e2e-package - - name: Pull shared Docker E2E images - if: steps.lane_class.outputs.needs_e2e == '1' + - name: Pull shared bare Docker E2E image + if: steps.plan.outputs.needs_bare_image == '1' shell: bash run: | set -euo pipefail docker pull "${OPENCLAW_DOCKER_E2E_BARE_IMAGE}" + + - name: Pull shared functional Docker E2E image + if: steps.plan.outputs.needs_functional_image == '1' + shell: bash + run: | + set -euo pipefail docker pull "${OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE}" - name: Validate targeted lane credentials shell: bash run: | set -euo pipefail - lanes=" ${DOCKER_E2E_LANES//,/ } " - if [[ "$lanes" == *" install-e2e "* ]]; then + credentials=",${{ steps.plan.outputs.credentials }}," + if [[ "$credentials" == *",openai,"* ]]; then [[ -n "${OPENAI_API_KEY:-}" ]] || { - echo "OPENAI_API_KEY is required for installer Docker E2E." >&2 + echo "OPENAI_API_KEY is required for selected Docker E2E lanes." >&2 exit 1 } - if [[ -z "${ANTHROPIC_API_TOKEN:-}" && -z "${ANTHROPIC_API_KEY:-}" ]]; then - echo "ANTHROPIC_API_TOKEN or ANTHROPIC_API_KEY is required for installer Docker E2E." >&2 - exit 1 - fi fi - if [[ "$lanes" == *" openwebui "* || "$lanes" == *" openai-web-search-minimal "* ]]; then - [[ -n "${OPENAI_API_KEY:-}" ]] || { - echo "OPENAI_API_KEY is required for selected OpenAI Docker lanes." >&2 - exit 1 - } + if [[ "$credentials" == *",anthropic,"* && -z "${ANTHROPIC_API_TOKEN:-}" && -z "${ANTHROPIC_API_KEY:-}" ]]; then + echo "ANTHROPIC_API_TOKEN or ANTHROPIC_API_KEY is required for selected Docker E2E lanes." >&2 + exit 1 fi - name: Run targeted Docker E2E lanes shell: bash run: | set -euo pipefail - lanes=" ${DOCKER_E2E_LANES//,/ } " export OPENCLAW_DOCKER_ALL_LANES="${DOCKER_E2E_LANES}" export OPENCLAW_DOCKER_ALL_PREFLIGHT=0 export OPENCLAW_DOCKER_ALL_FAIL_FAST=0 export OPENCLAW_DOCKER_ALL_INCLUDE_OPENWEBUI="${INCLUDE_OPENWEBUI}" export OPENCLAW_DOCKER_ALL_LOG_DIR=".artifacts/docker-tests/targeted" export OPENCLAW_DOCKER_ALL_TIMINGS_FILE=".artifacts/docker-tests/targeted-timings.json" - if [[ "$lanes" == *" live-"* ]]; then + if [[ "${{ steps.plan.outputs.needs_live_image }}" == "1" ]]; then pnpm test:docker:live-build fi export OPENCLAW_DOCKER_ALL_BUILD=0 @@ -739,31 +707,7 @@ jobs: echo "Docker targeted summary missing: \`$summary\`" >> "$GITHUB_STEP_SUMMARY" exit 0 fi - node --input-type=module - "$summary" <<'NODE' >> "$GITHUB_STEP_SUMMARY" - import fs from "node:fs"; - const summary = JSON.parse(fs.readFileSync(process.argv[2], "utf8")); - const lanes = Array.isArray(summary.lanes) ? summary.lanes : []; - console.log("### Docker E2E targeted lanes"); - console.log(""); - console.log(`Status: \`${summary.status}\``); - console.log(""); - console.log("| Lane | Status | Seconds | Timed out | Rerun |"); - console.log("| --- | ---: | ---: | --- | --- |"); - for (const lane of lanes) { - const status = lane.status === 0 ? "pass" : `fail ${lane.status}`; - const rerun = String(lane.rerunCommand ?? "").replaceAll("`", "\\`"); - console.log(`| \`${lane.name}\` | ${status} | ${lane.elapsedSeconds ?? ""} | ${lane.timedOut ? "yes" : "no"} | \`${rerun}\` |`); - } - const phases = Array.isArray(summary.phases) ? summary.phases : []; - if (phases.length > 0) { - console.log(""); - console.log("| Phase | Seconds | Status | Image kind |"); - console.log("| --- | ---: | --- | --- |"); - for (const phase of phases) { - console.log(`| \`${phase.name}\` | ${phase.elapsedSeconds ?? ""} | ${phase.status ?? ""} | ${phase.imageKind ?? ""} |`); - } - } - NODE + node scripts/docker-e2e.mjs summary "$summary" "Docker E2E targeted lanes" >> "$GITHUB_STEP_SUMMARY" - name: Upload targeted Docker E2E artifacts if: always() @@ -829,6 +773,11 @@ jobs: image: ${{ steps.image.outputs.image }} bare_image: ${{ steps.image.outputs.bare_image }} functional_image: ${{ steps.image.outputs.functional_image }} + needs_bare_image: ${{ steps.plan.outputs.needs_bare_image }} + needs_e2e_image: ${{ steps.plan.outputs.needs_e2e_image }} + needs_functional_image: ${{ steps.plan.outputs.needs_functional_image }} + needs_live_image: ${{ steps.plan.outputs.needs_live_image }} + needs_package: ${{ steps.plan.outputs.needs_package }} env: DOCKER_BUILD_SUMMARY: "false" DOCKER_BUILD_RECORD_UPLOAD: "false" @@ -856,8 +805,8 @@ jobs: echo "Shared Docker E2E bare image: \`$bare_image\`" >> "$GITHUB_STEP_SUMMARY" echo "Shared Docker E2E functional image: \`$functional_image\`" >> "$GITHUB_STEP_SUMMARY" - - name: Classify selected Docker lanes - id: lane_class + - name: Plan Docker E2E images + id: plan shell: bash env: DOCKER_E2E_LANES: ${{ inputs.docker_lanes }} @@ -865,23 +814,21 @@ jobs: INCLUDE_OPENWEBUI: ${{ inputs.include_openwebui }} run: | set -euo pipefail - needs_e2e=0 - if [[ "${INCLUDE_RELEASE_PATH_SUITES}" == "true" || "${INCLUDE_OPENWEBUI}" == "true" ]]; then - needs_e2e=1 + mkdir -p .artifacts/docker-tests + if [[ "${INCLUDE_RELEASE_PATH_SUITES}" == "true" ]]; then + export OPENCLAW_DOCKER_ALL_PROFILE=release-path + export OPENCLAW_DOCKER_ALL_PLAN_RELEASE_ALL=1 elif [[ -n "${DOCKER_E2E_LANES}" ]]; then - IFS=', ' read -r -a lanes <<< "${DOCKER_E2E_LANES}" - for lane in "${lanes[@]}"; do - [[ -z "$lane" ]] && continue - if [[ "$lane" != live-* ]]; then - needs_e2e=1 - break - fi - done + export OPENCLAW_DOCKER_ALL_LANES="${DOCKER_E2E_LANES}" + elif [[ "${INCLUDE_OPENWEBUI}" == "true" ]]; then + export OPENCLAW_DOCKER_ALL_LANES=openwebui fi - echo "needs_e2e=${needs_e2e}" >> "$GITHUB_OUTPUT" + export OPENCLAW_DOCKER_ALL_INCLUDE_OPENWEBUI="${INCLUDE_OPENWEBUI}" + node scripts/test-docker-all.mjs --plan-json > .artifacts/docker-tests/plan.json + node scripts/docker-e2e.mjs github-outputs .artifacts/docker-tests/plan.json >> "$GITHUB_OUTPUT" - name: Setup Node environment - if: steps.lane_class.outputs.needs_e2e == '1' + if: steps.plan.outputs.needs_package == '1' uses: ./.github/actions/setup-node-env with: node-version: ${{ env.NODE_VERSION }} @@ -889,19 +836,17 @@ jobs: install-bun: "true" - name: Pack OpenClaw package for Docker E2E - if: steps.lane_class.outputs.needs_e2e == '1' + if: steps.plan.outputs.needs_package == '1' shell: bash run: | set -euo pipefail mkdir -p .artifacts/docker-e2e-package - pnpm build - node --import tsx --input-type=module -e 'const { writePackageDistInventory } = await import("./src/infra/package-dist-inventory.ts"); await writePackageDistInventory(process.cwd());' - npm pack --silent --ignore-scripts --pack-destination .artifacts/docker-e2e-package >/tmp/openclaw-docker-e2e-pack.out - packed="$(tail -n 1 /tmp/openclaw-docker-e2e-pack.out | tr -d '\r')" - mv ".artifacts/docker-e2e-package/$packed" .artifacts/docker-e2e-package/openclaw-current.tgz + node scripts/package-openclaw-for-docker.mjs \ + --output-dir .artifacts/docker-e2e-package \ + --output-name openclaw-current.tgz - name: Upload OpenClaw Docker E2E package - if: steps.lane_class.outputs.needs_e2e == '1' + if: steps.plan.outputs.needs_package == '1' uses: actions/upload-artifact@v7 with: name: docker-e2e-package @@ -909,7 +854,7 @@ jobs: if-no-files-found: error - name: Log in to GHCR - if: steps.lane_class.outputs.needs_e2e == '1' + if: steps.plan.outputs.needs_e2e_image == '1' uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4 with: registry: ghcr.io @@ -917,11 +862,11 @@ jobs: password: ${{ github.token }} - name: Setup Docker builder - if: steps.lane_class.outputs.needs_e2e == '1' + if: steps.plan.outputs.needs_e2e_image == '1' uses: useblacksmith/setup-docker-builder@ac083cc84672d01c60d5e8561d0a939b697de542 # v1 - name: Build and push bare Docker E2E image - if: steps.lane_class.outputs.needs_e2e == '1' && (inputs.include_release_path_suites || inputs.docker_lanes != '') + if: steps.plan.outputs.needs_bare_image == '1' uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0 with: context: . @@ -936,7 +881,7 @@ jobs: push: true - name: Build and push functional Docker E2E image - if: steps.lane_class.outputs.needs_e2e == '1' + if: steps.plan.outputs.needs_functional_image == '1' uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0 with: context: . From 2efc4a8233197793b12ea044af1fad7c16445021 Mon Sep 17 00:00:00 2001 From: Peter Steinberger <steipete@gmail.com> Date: Sun, 26 Apr 2026 23:36:25 +0100 Subject: [PATCH 070/418] docs(test): document docker e2e layout --- .agents/skills/openclaw-testing/SKILL.md | 9 ++++++++- docs/ci.md | 2 +- docs/help/testing.md | 6 +++--- docs/reference/test.md | 2 +- 4 files changed, 13 insertions(+), 6 deletions(-) diff --git a/.agents/skills/openclaw-testing/SKILL.md b/.agents/skills/openclaw-testing/SKILL.md index 483e063e6ea..8c7c66e2bf4 100644 --- a/.agents/skills/openclaw-testing/SKILL.md +++ b/.agents/skills/openclaw-testing/SKILL.md @@ -72,6 +72,7 @@ Docker is expensive. First inspect the scheduler without running Docker: ```bash OPENCLAW_DOCKER_ALL_DRY_RUN=1 pnpm test:docker:all OPENCLAW_DOCKER_ALL_DRY_RUN=1 OPENCLAW_DOCKER_ALL_LANES=install-e2e pnpm test:docker:all +OPENCLAW_DOCKER_ALL_LANES=install-e2e node scripts/test-docker-all.mjs --plan-json ``` Run one failed lane locally only when explicitly asked or when GitHub is not @@ -110,7 +111,13 @@ normal mode remains max three Docker chunk jobs: Docker E2E images never copy repo sources as the app under test: the bare image is a Node/Git runner, and the functional image installs the same prebuilt npm -tarball that bare lanes mount. Every scheduler run writes +tarball that bare lanes mount. `scripts/package-openclaw-for-docker.mjs` is the +single packer for local scripts and CI. `scripts/test-docker-all.mjs +--plan-json` is the scheduler-owned CI plan for image kind, package, live image, +lane, and credential needs. Docker lane definitions live in the single scenario +catalog `scripts/lib/docker-e2e-scenarios.mjs`; planner logic lives in +`scripts/lib/docker-e2e-plan.mjs`. `scripts/docker-e2e.mjs` converts plan and +summary JSON into GitHub outputs and step summaries. Every scheduler run writes `.artifacts/docker-tests/**/summary.json`. Read it before rerunning. Lane entries include `command`, `rerunCommand`, status, timing, timeout state, image kind, and log file path. The summary also includes diff --git a/docs/ci.md b/docs/ci.md index 2f5bf0d94f6..02b8358107a 100644 --- a/docs/ci.md +++ b/docs/ci.md @@ -92,7 +92,7 @@ Scope logic lives in `scripts/ci-changed-scope.mjs` and is covered by unit tests CI workflow edits validate the Node CI graph plus workflow linting, but do not force Windows, Android, or macOS native builds by themselves; those platform lanes stay scoped to platform source changes. CI routing-only edits, selected cheap core-test fixture edits, and narrow plugin contract helper/test-routing edits use a fast Node-only manifest path: preflight, security, and a single `checks-fast-core` task. That path avoids build artifacts, Node 22 compatibility, channel contracts, full core shards, bundled-plugin shards, and additional guard matrices when the changed files are limited to the routing or helper surfaces that the fast task exercises directly. Windows Node checks are scoped to Windows-specific process/path wrappers, npm/pnpm/UI runner helpers, package manager config, and the CI workflow surfaces that execute that lane; unrelated source, plugin, install-smoke, and test-only changes stay on the Linux Node lanes so they do not reserve a 16-vCPU Windows worker for coverage that is already exercised by the normal test shards. -The separate `install-smoke` workflow reuses the same scope script through its own `preflight` job. It splits smoke coverage into `run_fast_install_smoke` and `run_full_install_smoke`. Pull requests run the fast path for Docker/package surfaces, bundled plugin package/manifest changes, and core plugin/channel/gateway/Plugin SDK surfaces that the Docker smoke jobs exercise. Source-only bundled plugin changes, test-only edits, and docs-only edits do not reserve Docker workers. The fast path builds the root Dockerfile image once, checks the CLI, runs the agents delete shared-workspace CLI smoke, runs the container gateway-network e2e, verifies a bundled extension build arg, and runs the bounded bundled-plugin Docker profile under a 240-second aggregate command timeout with each scenario's Docker run capped separately. The full path keeps QR package install and installer Docker/update coverage for nightly scheduled runs, manual dispatches, workflow-call release checks, and pull requests that truly touch installer/package/Docker surfaces. `main` pushes, including merge commits, do not force the full path; when changed-scope logic would request full coverage on a push, the workflow keeps the fast Docker smoke and leaves the full install smoke to nightly or release validation. The slow Bun global install image-provider smoke is separately gated by `run_bun_global_install_smoke`; it runs on the nightly schedule and from the release checks workflow, and manual `install-smoke` dispatches can opt into it, but pull requests and `main` pushes do not run it. QR and installer Docker tests keep their own install-focused Dockerfiles. Local `test:docker:all` prebuilds one shared live-test image, packs OpenClaw once as an npm tarball, and builds two shared `scripts/e2e/Dockerfile` images: a bare Node/Git runner for installer/update/plugin-dependency lanes and a functional image that installs the same tarball into `/app` for normal functionality lanes. The scheduler selects the image per lane with `OPENCLAW_DOCKER_E2E_BARE_IMAGE` and `OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE`, then runs lanes with `OPENCLAW_SKIP_DOCKER_BUILD=1`; tune the default main-pool slot count of 10 with `OPENCLAW_DOCKER_ALL_PARALLELISM` and the provider-sensitive tail-pool slot count of 10 with `OPENCLAW_DOCKER_ALL_TAIL_PARALLELISM`. Heavy lane caps default to `OPENCLAW_DOCKER_ALL_LIVE_LIMIT=6`, `OPENCLAW_DOCKER_ALL_NPM_LIMIT=8`, and `OPENCLAW_DOCKER_ALL_SERVICE_LIMIT=7` so npm install and multi-service lanes do not overcommit Docker while lighter lanes still fill available slots. Lane starts are staggered by 2 seconds by default to avoid local Docker daemon create storms; override with `OPENCLAW_DOCKER_ALL_START_STAGGER_MS=0` or another millisecond value. The local aggregate preflights Docker, removes stale OpenClaw E2E containers, emits active-lane status, persists lane timings for longest-first ordering, and supports `OPENCLAW_DOCKER_ALL_DRY_RUN=1` for scheduler inspection. It stops scheduling new pooled lanes after the first failure by default, and each lane has a 120-minute fallback timeout overrideable with `OPENCLAW_DOCKER_ALL_LANE_TIMEOUT_MS`; selected live/tail lanes use tighter per-lane caps. `OPENCLAW_DOCKER_ALL_LANES=<lane[,lane]>` runs exact scheduler lanes, including release-only lanes such as `install-e2e` and split bundled update lanes such as `bundled-channel-update-acpx`, while skipping the cleanup smoke so agents can reproduce one failed lane. The reusable live/E2E workflow builds and pushes one SHA-tagged bare GHCR Docker E2E image and one SHA-tagged functional GHCR Docker E2E image, then runs the release-path Docker suite as at most three chunked jobs with `OPENCLAW_SKIP_DOCKER_BUILD=1` so each chunk pulls the image kind it needs and executes multiple lanes through the same weighted scheduler (`OPENCLAW_DOCKER_ALL_PROFILE=release-path`, `OPENCLAW_DOCKER_ALL_CHUNK=core|package-update|plugins-integrations`). Each chunk uploads `.artifacts/docker-tests/` with lane logs, timings, `summary.json`, phase timings, and per-lane rerun commands. The workflow `docker_lanes` input runs selected lanes against the prepared images instead of the three chunk jobs, which keeps failed-lane debugging bounded to one targeted Docker job; if a selected lane is a live Docker lane, the targeted job builds the live-test image locally for that rerun. When Open WebUI is requested with the release-path suite, it runs inside the plugins/integrations chunk instead of reserving a fourth Docker worker; Open WebUI keeps a standalone job only for openwebui-only dispatches. The scheduled live/E2E workflow runs the full release-path Docker suite daily. The bundled update matrix is split by update target so repeated npm update and doctor repair passes can shard with other bundled checks. +The separate `install-smoke` workflow reuses the same scope script through its own `preflight` job. It splits smoke coverage into `run_fast_install_smoke` and `run_full_install_smoke`. Pull requests run the fast path for Docker/package surfaces, bundled plugin package/manifest changes, and core plugin/channel/gateway/Plugin SDK surfaces that the Docker smoke jobs exercise. Source-only bundled plugin changes, test-only edits, and docs-only edits do not reserve Docker workers. The fast path builds the root Dockerfile image once, checks the CLI, runs the agents delete shared-workspace CLI smoke, runs the container gateway-network e2e, verifies a bundled extension build arg, and runs the bounded bundled-plugin Docker profile under a 240-second aggregate command timeout with each scenario's Docker run capped separately. The full path keeps QR package install and installer Docker/update coverage for nightly scheduled runs, manual dispatches, workflow-call release checks, and pull requests that truly touch installer/package/Docker surfaces. `main` pushes, including merge commits, do not force the full path; when changed-scope logic would request full coverage on a push, the workflow keeps the fast Docker smoke and leaves the full install smoke to nightly or release validation. The slow Bun global install image-provider smoke is separately gated by `run_bun_global_install_smoke`; it runs on the nightly schedule and from the release checks workflow, and manual `install-smoke` dispatches can opt into it, but pull requests and `main` pushes do not run it. QR and installer Docker tests keep their own install-focused Dockerfiles. Local `test:docker:all` prebuilds one shared live-test image, packs OpenClaw once as an npm tarball, and builds two shared `scripts/e2e/Dockerfile` images: a bare Node/Git runner for installer/update/plugin-dependency lanes and a functional image that installs the same tarball into `/app` for normal functionality lanes. Docker lane definitions live in `scripts/lib/docker-e2e-scenarios.mjs`, planner logic lives in `scripts/lib/docker-e2e-plan.mjs`, and the runner only executes the selected plan. The scheduler selects the image per lane with `OPENCLAW_DOCKER_E2E_BARE_IMAGE` and `OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE`, then runs lanes with `OPENCLAW_SKIP_DOCKER_BUILD=1`; tune the default main-pool slot count of 10 with `OPENCLAW_DOCKER_ALL_PARALLELISM` and the provider-sensitive tail-pool slot count of 10 with `OPENCLAW_DOCKER_ALL_TAIL_PARALLELISM`. Heavy lane caps default to `OPENCLAW_DOCKER_ALL_LIVE_LIMIT=9`, `OPENCLAW_DOCKER_ALL_NPM_LIMIT=10`, and `OPENCLAW_DOCKER_ALL_SERVICE_LIMIT=7` so npm install and multi-service lanes do not overcommit Docker while lighter lanes still fill available slots. Lane starts are staggered by 2 seconds by default to avoid local Docker daemon create storms; override with `OPENCLAW_DOCKER_ALL_START_STAGGER_MS=0` or another millisecond value. The local aggregate preflights Docker, removes stale OpenClaw E2E containers, emits active-lane status, persists lane timings for longest-first ordering, and supports `OPENCLAW_DOCKER_ALL_DRY_RUN=1` for scheduler inspection. It stops scheduling new pooled lanes after the first failure by default, and each lane has a 120-minute fallback timeout overrideable with `OPENCLAW_DOCKER_ALL_LANE_TIMEOUT_MS`; selected live/tail lanes use tighter per-lane caps. `OPENCLAW_DOCKER_ALL_LANES=<lane[,lane]>` runs exact scheduler lanes, including release-only lanes such as `install-e2e` and split bundled update lanes such as `bundled-channel-update-acpx`, while skipping the cleanup smoke so agents can reproduce one failed lane. The reusable live/E2E workflow asks `scripts/test-docker-all.mjs --plan-json` which package, image kind, live image, lane, and credential coverage is required, then `scripts/docker-e2e.mjs` converts that plan into GitHub outputs and summaries. It packs OpenClaw through `scripts/package-openclaw-for-docker.mjs`, builds and pushes one SHA-tagged bare GHCR Docker E2E image when the plan needs install/update/plugin-dependency lanes, and builds one SHA-tagged functional GHCR Docker E2E image when the plan needs package-installed functionality lanes. The release-path Docker suite runs as at most three chunked jobs with `OPENCLAW_SKIP_DOCKER_BUILD=1` so each chunk pulls only the image kind it needs and executes multiple lanes through the same weighted scheduler (`OPENCLAW_DOCKER_ALL_PROFILE=release-path`, `OPENCLAW_DOCKER_ALL_CHUNK=core|package-update|plugins-integrations`). Each chunk uploads `.artifacts/docker-tests/` with lane logs, timings, `summary.json`, phase timings, scheduler plan JSON, and per-lane rerun commands. The workflow `docker_lanes` input runs selected lanes against the prepared images instead of the three chunk jobs, which keeps failed-lane debugging bounded to one targeted Docker job; if a selected lane is a live Docker lane, the targeted job builds the live-test image locally for that rerun. When Open WebUI is requested with the release-path suite, it runs inside the plugins/integrations chunk instead of reserving a fourth Docker worker; Open WebUI keeps a standalone job only for openwebui-only dispatches. The scheduled live/E2E workflow runs the full release-path Docker suite daily. The bundled update matrix is split by update target so repeated npm update and doctor repair passes can shard with other bundled checks. Local changed-lane logic lives in `scripts/changed-lanes.mjs` and is executed by `scripts/check-changed.mjs`. That local gate is stricter about architecture boundaries than the broad CI platform scope: core production changes run core prod typecheck plus core tests, core test-only changes run only core test typecheck/tests, extension production changes run extension prod typecheck plus extension tests, and extension test-only changes run only extension test typecheck/tests. Public Plugin SDK or plugin-contract changes expand to extension validation because extensions depend on those core contracts. Release metadata-only version bumps run targeted version/config/root-dependency checks. Unknown root/config changes fail safe to all lanes. diff --git a/docs/help/testing.md b/docs/help/testing.md index ea02a059a42..05374017e9c 100644 --- a/docs/help/testing.md +++ b/docs/help/testing.md @@ -606,7 +606,7 @@ These Docker runners split into two buckets: `OPENCLAW_LIVE_GATEWAY_STEP_TIMEOUT_MS=45000`, and `OPENCLAW_LIVE_GATEWAY_MODEL_TIMEOUT_MS=90000`. Override those env vars when you explicitly want the larger exhaustive scan. -- `test:docker:all` builds the live Docker image once via `test:docker:live-build`, packs OpenClaw once as an npm tarball, then builds/reuses two `scripts/e2e/Dockerfile` images. The bare image is only the Node/Git runner for install/update/plugin-dependency lanes; those lanes mount the prebuilt tarball. The functional image installs the same tarball into `/app` for built-app functionality lanes. The aggregate uses a weighted local scheduler: `OPENCLAW_DOCKER_ALL_PARALLELISM` controls process slots, while resource caps keep heavy live, npm-install, and multi-service lanes from all starting at once. Defaults are 10 slots, `OPENCLAW_DOCKER_ALL_LIVE_LIMIT=6`, `OPENCLAW_DOCKER_ALL_NPM_LIMIT=8`, and `OPENCLAW_DOCKER_ALL_SERVICE_LIMIT=7`; tune `OPENCLAW_DOCKER_ALL_WEIGHT_LIMIT` or `OPENCLAW_DOCKER_ALL_DOCKER_LIMIT` only when the Docker host has more headroom. The runner performs a Docker preflight by default, removes stale OpenClaw E2E containers, prints status every 30 seconds, stores successful lane timings in `.artifacts/docker-tests/lane-timings.json`, and uses those timings to start longer lanes first on later runs. Use `OPENCLAW_DOCKER_ALL_DRY_RUN=1` to print the weighted lane manifest without building or running Docker. +- `test:docker:all` builds the live Docker image once via `test:docker:live-build`, packs OpenClaw once as an npm tarball through `scripts/package-openclaw-for-docker.mjs`, then builds/reuses two `scripts/e2e/Dockerfile` images. The bare image is only the Node/Git runner for install/update/plugin-dependency lanes; those lanes mount the prebuilt tarball. The functional image installs the same tarball into `/app` for built-app functionality lanes. Docker lane definitions live in `scripts/lib/docker-e2e-scenarios.mjs`; planner logic lives in `scripts/lib/docker-e2e-plan.mjs`; `scripts/test-docker-all.mjs` executes the selected plan. The aggregate uses a weighted local scheduler: `OPENCLAW_DOCKER_ALL_PARALLELISM` controls process slots, while resource caps keep heavy live, npm-install, and multi-service lanes from all starting at once. Defaults are 10 slots, `OPENCLAW_DOCKER_ALL_LIVE_LIMIT=9`, `OPENCLAW_DOCKER_ALL_NPM_LIMIT=10`, and `OPENCLAW_DOCKER_ALL_SERVICE_LIMIT=7`; tune `OPENCLAW_DOCKER_ALL_WEIGHT_LIMIT` or `OPENCLAW_DOCKER_ALL_DOCKER_LIMIT` only when the Docker host has more headroom. The runner performs a Docker preflight by default, removes stale OpenClaw E2E containers, prints status every 30 seconds, stores successful lane timings in `.artifacts/docker-tests/lane-timings.json`, and uses those timings to start longer lanes first on later runs. Use `OPENCLAW_DOCKER_ALL_DRY_RUN=1` to print the weighted lane manifest without building or running Docker, or `node scripts/test-docker-all.mjs --plan-json` to print the CI plan for selected lanes, package/image needs, and credentials. - Container smoke runners: `test:docker:openwebui`, `test:docker:onboard`, `test:docker:npm-onboard-channel-agent`, `test:docker:update-channel-switch`, `test:docker:session-runtime-context`, `test:docker:agents-delete-shared-workspace`, `test:docker:gateway-network`, `test:docker:browser-cdp-snapshot`, `test:docker:mcp-channels`, `test:docker:pi-bundle-mcp-tools`, `test:docker:cron-mcp-cleanup`, `test:docker:plugins`, `test:docker:plugin-update`, and `test:docker:config-reload` boot one or more real containers and verify higher-level integration paths. The live-model Docker runners also bind-mount only the needed CLI auth homes (or all supported ones when the run is not narrowed), then copy them into the container home before the run so external-CLI OAuth can refresh tokens without mutating the host auth store: @@ -618,7 +618,7 @@ The live-model Docker runners also bind-mount only the needed CLI auth homes (or - Gateway + dev agent: `pnpm test:docker:live-gateway` (script: `scripts/test-live-gateway-models-docker.sh`) - Open WebUI live smoke: `pnpm test:docker:openwebui` (script: `scripts/e2e/openwebui-docker.sh`) - Onboarding wizard (TTY, full scaffolding): `pnpm test:docker:onboard` (script: `scripts/e2e/onboard-docker.sh`) -- Npm tarball onboarding/channel/agent smoke: `pnpm test:docker:npm-onboard-channel-agent` installs the packed OpenClaw tarball globally in Docker, configures OpenAI via env-ref onboarding plus Telegram by default, verifies doctor repairs activated plugin runtime deps, and runs one mocked OpenAI agent turn. Reuse a prebuilt tarball with `OPENCLAW_NPM_ONBOARD_PACKAGE_TGZ=/path/to/openclaw-*.tgz`, skip the host rebuild with `OPENCLAW_NPM_ONBOARD_HOST_BUILD=0`, or switch channel with `OPENCLAW_NPM_ONBOARD_CHANNEL=discord`. +- Npm tarball onboarding/channel/agent smoke: `pnpm test:docker:npm-onboard-channel-agent` installs the packed OpenClaw tarball globally in Docker, configures OpenAI via env-ref onboarding plus Telegram by default, verifies doctor repairs activated plugin runtime deps, and runs one mocked OpenAI agent turn. Reuse a prebuilt tarball with `OPENCLAW_CURRENT_PACKAGE_TGZ=/path/to/openclaw-*.tgz`, skip the host rebuild with `OPENCLAW_NPM_ONBOARD_HOST_BUILD=0`, or switch channel with `OPENCLAW_NPM_ONBOARD_CHANNEL=discord`. - Update channel switch smoke: `pnpm test:docker:update-channel-switch` installs the packed OpenClaw tarball globally in Docker, switches from package `stable` to git `dev`, verifies the persisted channel and plugin post-update work, then switches back to package `stable` and checks update status. - Session runtime context smoke: `pnpm test:docker:session-runtime-context` verifies hidden runtime context transcript persistence plus doctor repair of affected duplicated prompt-rewrite branches. - Bun global install smoke: `bash scripts/e2e/bun-global-install-smoke.sh` packs the current tree, installs it with `bun install -g` in an isolated home, and verifies `openclaw infer image providers --json` returns bundled image providers instead of hanging. Reuse a prebuilt tarball with `OPENCLAW_BUN_GLOBAL_SMOKE_PACKAGE_TGZ=/path/to/openclaw-*.tgz`, skip the host build with `OPENCLAW_BUN_GLOBAL_SMOKE_HOST_BUILD=0`, or copy `dist/` from a built Docker image with `OPENCLAW_BUN_GLOBAL_SMOKE_DIST_IMAGE=openclaw-dockerfile-smoke:local`. @@ -635,7 +635,7 @@ The live-model Docker runners also bind-mount only the needed CLI auth homes (or Set `OPENCLAW_PLUGINS_E2E_CLAWHUB=0` to skip the live ClawHub block, or override the default package with `OPENCLAW_PLUGINS_E2E_CLAWHUB_SPEC` and `OPENCLAW_PLUGINS_E2E_CLAWHUB_ID`. - Plugin update unchanged smoke: `pnpm test:docker:plugin-update` (script: `scripts/e2e/plugin-update-unchanged-docker.sh`) - Config reload metadata smoke: `pnpm test:docker:config-reload` (script: `scripts/e2e/config-reload-source-docker.sh`) -- Bundled plugin runtime deps: `pnpm test:docker:bundled-channel-deps` builds a small Docker runner image by default, builds and packs OpenClaw once on the host, then mounts that tarball into each Linux install scenario. Reuse the image with `OPENCLAW_SKIP_DOCKER_BUILD=1`, skip the host rebuild after a fresh local build with `OPENCLAW_BUNDLED_CHANNEL_HOST_BUILD=0`, or point at an existing tarball with `OPENCLAW_BUNDLED_CHANNEL_PACKAGE_TGZ=/path/to/openclaw-*.tgz`. The full Docker aggregate pre-packs this tarball once, then shards bundled channel checks into independent lanes, including separate update lanes for Telegram, Discord, Slack, Feishu, memory-lancedb, and ACPX. Use `OPENCLAW_BUNDLED_CHANNELS=telegram,slack` to narrow the channel matrix when running the bundled lane directly, or `OPENCLAW_BUNDLED_CHANNEL_UPDATE_TARGETS=telegram,acpx` to narrow the update scenario. The lane also verifies that `channels.<id>.enabled=false` and `plugins.entries.<id>.enabled=false` suppress doctor/runtime-dependency repair. +- Bundled plugin runtime deps: `pnpm test:docker:bundled-channel-deps` builds a small Docker runner image by default, builds and packs OpenClaw once on the host, then mounts that tarball into each Linux install scenario. Reuse the image with `OPENCLAW_SKIP_DOCKER_BUILD=1`, skip the host rebuild after a fresh local build with `OPENCLAW_BUNDLED_CHANNEL_HOST_BUILD=0`, or point at an existing tarball with `OPENCLAW_CURRENT_PACKAGE_TGZ=/path/to/openclaw-*.tgz`. The full Docker aggregate pre-packs this tarball once, then shards bundled channel checks into independent lanes, including separate update lanes for Telegram, Discord, Slack, Feishu, memory-lancedb, and ACPX. Use `OPENCLAW_BUNDLED_CHANNELS=telegram,slack` to narrow the channel matrix when running the bundled lane directly, or `OPENCLAW_BUNDLED_CHANNEL_UPDATE_TARGETS=telegram,acpx` to narrow the update scenario. The lane also verifies that `channels.<id>.enabled=false` and `plugins.entries.<id>.enabled=false` suppress doctor/runtime-dependency repair. - Narrow bundled plugin runtime deps while iterating by disabling unrelated scenarios, for example: `OPENCLAW_BUNDLED_CHANNEL_SCENARIOS=0 OPENCLAW_BUNDLED_CHANNEL_UPDATE_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_ROOT_OWNED_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_SETUP_ENTRY_SCENARIO=0 pnpm test:docker:bundled-channel-deps`. diff --git a/docs/reference/test.md b/docs/reference/test.md index 5cbf738108d..a5aa8673e71 100644 --- a/docs/reference/test.md +++ b/docs/reference/test.md @@ -33,7 +33,7 @@ title: "Tests" - Gateway integration: opt-in via `OPENCLAW_TEST_INCLUDE_GATEWAY=1 pnpm test` or `pnpm test:gateway`. - `pnpm test:e2e`: Runs gateway end-to-end smoke tests (multi-instance WS/HTTP/node pairing). Defaults to `threads` + `isolate: false` with adaptive workers in `vitest.e2e.config.ts`; tune with `OPENCLAW_E2E_WORKERS=<n>` and set `OPENCLAW_E2E_VERBOSE=1` for verbose logs. - `pnpm test:live`: Runs provider live tests (minimax/zai). Requires API keys and `LIVE=1` (or provider-specific `*_LIVE_TEST=1`) to unskip. -- `pnpm test:docker:all`: Builds the shared live-test image, packs OpenClaw once as an npm tarball, builds/reuses a bare Node/Git runner image plus a functional image that installs that tarball into `/app`, then runs Docker smoke lanes with `OPENCLAW_SKIP_DOCKER_BUILD=1` through a weighted scheduler. The bare image (`OPENCLAW_DOCKER_E2E_BARE_IMAGE`) is used for installer/update/plugin-dependency lanes; those lanes mount the prebuilt tarball instead of using copied repo sources. The functional image (`OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE`) is used for normal built-app functionality lanes. `OPENCLAW_DOCKER_ALL_PARALLELISM=<n>` controls process slots and defaults to 10; `OPENCLAW_DOCKER_ALL_TAIL_PARALLELISM=<n>` controls the provider-sensitive tail pool and defaults to 10. Heavy lane caps default to `OPENCLAW_DOCKER_ALL_LIVE_LIMIT=9`, `OPENCLAW_DOCKER_ALL_NPM_LIMIT=10`, and `OPENCLAW_DOCKER_ALL_SERVICE_LIMIT=7`; provider caps default to one heavy lane per provider via `OPENCLAW_DOCKER_ALL_LIVE_CLAUDE_LIMIT=4`, `OPENCLAW_DOCKER_ALL_LIVE_CODEX_LIMIT=4`, and `OPENCLAW_DOCKER_ALL_LIVE_GEMINI_LIMIT=4`. Use `OPENCLAW_DOCKER_ALL_WEIGHT_LIMIT` or `OPENCLAW_DOCKER_ALL_DOCKER_LIMIT` for larger hosts. Lane starts are staggered by 2 seconds by default to avoid local Docker daemon create storms; override with `OPENCLAW_DOCKER_ALL_START_STAGGER_MS=<ms>`. The runner preflights Docker by default, cleans stale OpenClaw E2E containers, emits active-lane status every 30 seconds, shares provider CLI tool caches between compatible lanes, retries transient live-provider failures once by default (`OPENCLAW_DOCKER_ALL_LIVE_RETRIES=<n>`), and stores lane timings in `.artifacts/docker-tests/lane-timings.json` for longest-first ordering on later runs. Use `OPENCLAW_DOCKER_ALL_DRY_RUN=1` to print the lane manifest without running Docker, `OPENCLAW_DOCKER_ALL_STATUS_INTERVAL_MS=<ms>` to tune status output, or `OPENCLAW_DOCKER_ALL_TIMINGS=0` to disable timing reuse. Use `OPENCLAW_DOCKER_ALL_LIVE_MODE=skip` for deterministic/local lanes only or `OPENCLAW_DOCKER_ALL_LIVE_MODE=only` for live-provider lanes only; package aliases are `pnpm test:docker:local:all` and `pnpm test:docker:live:all`. Live-only mode merges main and tail live lanes into one longest-first pool so provider buckets can pack Claude, Codex, and Gemini work together. The runner stops scheduling new pooled lanes after the first failure unless `OPENCLAW_DOCKER_ALL_FAIL_FAST=0` is set, and each lane has a 120-minute fallback timeout overrideable with `OPENCLAW_DOCKER_ALL_LANE_TIMEOUT_MS`; selected live/tail lanes use tighter per-lane caps. CLI backend Docker setup commands have their own timeout via `OPENCLAW_LIVE_CLI_BACKEND_SETUP_TIMEOUT_SECONDS` (default 180). Per-lane logs and `summary.json` phase timings are written under `.artifacts/docker-tests/<run-id>/`. +- `pnpm test:docker:all`: Builds the shared live-test image, packs OpenClaw once as an npm tarball, builds/reuses a bare Node/Git runner image plus a functional image that installs that tarball into `/app`, then runs Docker smoke lanes with `OPENCLAW_SKIP_DOCKER_BUILD=1` through a weighted scheduler. The bare image (`OPENCLAW_DOCKER_E2E_BARE_IMAGE`) is used for installer/update/plugin-dependency lanes; those lanes mount the prebuilt tarball instead of using copied repo sources. The functional image (`OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE`) is used for normal built-app functionality lanes. `scripts/package-openclaw-for-docker.mjs` is the single local/CI package packer. Docker lane definitions live in `scripts/lib/docker-e2e-scenarios.mjs`; planner logic lives in `scripts/lib/docker-e2e-plan.mjs`; `scripts/test-docker-all.mjs` executes the selected plan. `node scripts/test-docker-all.mjs --plan-json` emits the scheduler-owned CI plan for selected lanes, image kinds, package/live-image needs, and credential checks without building or running Docker. `OPENCLAW_DOCKER_ALL_PARALLELISM=<n>` controls process slots and defaults to 10; `OPENCLAW_DOCKER_ALL_TAIL_PARALLELISM=<n>` controls the provider-sensitive tail pool and defaults to 10. Heavy lane caps default to `OPENCLAW_DOCKER_ALL_LIVE_LIMIT=9`, `OPENCLAW_DOCKER_ALL_NPM_LIMIT=10`, and `OPENCLAW_DOCKER_ALL_SERVICE_LIMIT=7`; provider caps default to one heavy lane per provider via `OPENCLAW_DOCKER_ALL_LIVE_CLAUDE_LIMIT=4`, `OPENCLAW_DOCKER_ALL_LIVE_CODEX_LIMIT=4`, and `OPENCLAW_DOCKER_ALL_LIVE_GEMINI_LIMIT=4`. Use `OPENCLAW_DOCKER_ALL_WEIGHT_LIMIT` or `OPENCLAW_DOCKER_ALL_DOCKER_LIMIT` for larger hosts. Lane starts are staggered by 2 seconds by default to avoid local Docker daemon create storms; override with `OPENCLAW_DOCKER_ALL_START_STAGGER_MS=<ms>`. The runner preflights Docker by default, cleans stale OpenClaw E2E containers, emits active-lane status every 30 seconds, shares provider CLI tool caches between compatible lanes, retries transient live-provider failures once by default (`OPENCLAW_DOCKER_ALL_LIVE_RETRIES=<n>`), and stores lane timings in `.artifacts/docker-tests/lane-timings.json` for longest-first ordering on later runs. Use `OPENCLAW_DOCKER_ALL_DRY_RUN=1` to print the lane manifest without running Docker, `OPENCLAW_DOCKER_ALL_STATUS_INTERVAL_MS=<ms>` to tune status output, or `OPENCLAW_DOCKER_ALL_TIMINGS=0` to disable timing reuse. Use `OPENCLAW_DOCKER_ALL_LIVE_MODE=skip` for deterministic/local lanes only or `OPENCLAW_DOCKER_ALL_LIVE_MODE=only` for live-provider lanes only; package aliases are `pnpm test:docker:local:all` and `pnpm test:docker:live:all`. Live-only mode merges main and tail live lanes into one longest-first pool so provider buckets can pack Claude, Codex, and Gemini work together. The runner stops scheduling new pooled lanes after the first failure unless `OPENCLAW_DOCKER_ALL_FAIL_FAST=0` is set, and each lane has a 120-minute fallback timeout overrideable with `OPENCLAW_DOCKER_ALL_LANE_TIMEOUT_MS`; selected live/tail lanes use tighter per-lane caps. CLI backend Docker setup commands have their own timeout via `OPENCLAW_LIVE_CLI_BACKEND_SETUP_TIMEOUT_SECONDS` (default 180). Per-lane logs and `summary.json` phase timings are written under `.artifacts/docker-tests/<run-id>/`. - `pnpm test:docker:browser-cdp-snapshot`: Builds a Chromium-backed source E2E container, starts raw CDP plus an isolated Gateway, runs `browser doctor --deep`, and verifies CDP role snapshots include link URLs, cursor-promoted clickables, iframe refs, and frame metadata. - CLI backend live Docker probes can be run as focused lanes, for example `pnpm test:docker:live-cli-backend:codex`, `pnpm test:docker:live-cli-backend:codex:resume`, or `pnpm test:docker:live-cli-backend:codex:mcp`. Claude and Gemini have matching `:resume` and `:mcp` aliases. - `pnpm test:docker:openwebui`: Starts Dockerized OpenClaw + Open WebUI, signs in through Open WebUI, checks `/api/models`, then runs a real proxied chat through `/api/chat/completions`. Requires a usable live model key (for example OpenAI in `~/.profile`), pulls an external Open WebUI image, and is not expected to be CI-stable like the normal unit/e2e suites. From 084dde89fd966f7a4ced4d30cf28325607da85ba Mon Sep 17 00:00:00 2001 From: Peter Steinberger <steipete@gmail.com> Date: Sun, 26 Apr 2026 23:39:14 +0100 Subject: [PATCH 071/418] docs: clarify extension ownership boundaries --- AGENTS.md | 1 + 1 file changed, 1 insertion(+) diff --git a/AGENTS.md b/AGENTS.md index 5f72c558db8..d32e8688587 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -29,6 +29,7 @@ Telegraph style. Root rules only. Read scoped `AGENTS.md` before subtree work. - Extension prod code: no core `src/**`, `src/plugin-sdk-internal/**`, other extension `src/**`, or relative outside package. - Core/tests: no deep plugin internals (`extensions/*/src/**`, `onboard.js`). Use `api.ts`, SDK facade, generic contracts. - Extension-owned behavior stays extension-owned: repair, detection, onboarding, auth/provider defaults, provider tools/settings. +- Owner boundary: fix owner-specific behavior in the owner module. Shared/core gets generic seams only; no owner ids, dependency strings, defaults, migrations, or recovery policy. If a bug names an extension or its dependency, start in that extension and add a generic core seam only when multiple owners need it. - Legacy config repair: doctor/fix paths, not startup/load-time core migrations. - Core test asserting extension-specific behavior: move to owner extension or generic contract test. - New seams: backwards-compatible, documented, versioned. Third-party plugins exist. From a08b65a90a454fbfe2ea4025f5bcdab08640d983 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rub=C3=A9n=20Cuevas?= <hi@rubencu.com> Date: Sun, 26 Apr 2026 18:44:30 -0400 Subject: [PATCH 072/418] fix(telegram): send fresh finals for stale previews (#72038) * fix(telegram): send fresh finals for stale previews * test(telegram): cover stale preview send fallback * fix(telegram): keep stale archived preview fallback * fix(telegram): clear stale active previews * fix(telegram): reset preview state after fresh finals --- CHANGELOG.md | 1 + docs/channels/telegram.md | 4 +- docs/concepts/streaming.md | 1 + .../telegram/src/bot-message-dispatch.ts | 2 + .../telegram/src/draft-stream.test-helpers.ts | 11 ++ extensions/telegram/src/draft-stream.test.ts | 40 ++++++ extensions/telegram/src/draft-stream.ts | 11 ++ .../src/lane-delivery-text-deliverer.ts | 48 +++++++ extensions/telegram/src/lane-delivery.test.ts | 126 +++++++++++++++++- 9 files changed, 236 insertions(+), 8 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 81e1a04fcb9..b2184f65875 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -47,6 +47,7 @@ Docs: https://docs.openclaw.ai - Onboarding/models: keep skip-auth and provider-scoped model picker prompts off the full global model catalog path, and cache provider catalog hook resolution so setup no longer stalls after auth on large plugin registries. Thanks @shakkernerd. - Gateway/Bonjour: suppress known @homebridge/ciao cancellation and network assertion failures through scoped process handlers so malformed mDNS packets or restricted VPS networking disable/restart Bonjour instead of crashing the gateway. Fixes #67578. Thanks @zenassist26-create. - Discord: keep late clicks on already-resolved exec approval buttons quiet when elevated mode auto-resolved the request, while still surfacing real approval submission failures. Fixes #66906. Thanks @rlerikse. +- Telegram: send a fresh final message for long-lived preview-streamed replies so the visible Telegram timestamp reflects completion time instead of the preview creation time. Thanks @rubencu. ## 2026.4.25 diff --git a/docs/channels/telegram.md b/docs/channels/telegram.md index 065ce72d8ec..13564b36db1 100644 --- a/docs/channels/telegram.md +++ b/docs/channels/telegram.md @@ -298,8 +298,8 @@ curl "https://api.telegram.org/bot<bot_token>/getUpdates" For text-only replies: - - DM: OpenClaw keeps the same preview message and performs a final edit in place (no second message) - - group/topic: OpenClaw keeps the same preview message and performs a final edit in place (no second message) + - short DM/group/topic previews: OpenClaw keeps the same preview message and performs a final edit in place + - previews older than about one minute: OpenClaw sends the completed reply as a fresh final message and then cleans up the preview, so Telegram's visible timestamp reflects completion time instead of the preview creation time For complex replies (for example media payloads), OpenClaw falls back to normal final delivery and then cleans up the preview message. diff --git a/docs/concepts/streaming.md b/docs/concepts/streaming.md index 91c9fe65b8c..f7db2cc0de0 100644 --- a/docs/concepts/streaming.md +++ b/docs/concepts/streaming.md @@ -152,6 +152,7 @@ Legacy key migration: Telegram: - Uses `sendMessage` + `editMessageText` preview updates across DMs and group/topics. +- Sends a fresh final message instead of editing in place when a preview has been visible for about one minute, then cleans up the preview so Telegram's timestamp reflects reply completion. - Preview streaming is skipped when Telegram block streaming is explicitly enabled (to avoid double-streaming). - `/reasoning stream` can write reasoning to preview. diff --git a/extensions/telegram/src/bot-message-dispatch.ts b/extensions/telegram/src/bot-message-dispatch.ts index 44c2d95e858..25be7ba3ff4 100644 --- a/extensions/telegram/src/bot-message-dispatch.ts +++ b/extensions/telegram/src/bot-message-dispatch.ts @@ -433,6 +433,7 @@ export const dispatchTelegramMessage = async ({ archivedAnswerPreviews.push({ messageId: preview.messageId, textSnapshot: preview.textSnapshot, + visibleSinceMs: preview.visibleSinceMs, deleteIfUnused: true, }); } @@ -539,6 +540,7 @@ export const dispatchTelegramMessage = async ({ archivedAnswerPreviews.push({ messageId: previewMessageId, textSnapshot: answerLane.lastPartialText, + visibleSinceMs: answerLane.stream?.visibleSinceMs?.(), deleteIfUnused: false, }); } diff --git a/extensions/telegram/src/draft-stream.test-helpers.ts b/extensions/telegram/src/draft-stream.test-helpers.ts index 428b296efc9..9ef026fa2ee 100644 --- a/extensions/telegram/src/draft-stream.test-helpers.ts +++ b/extensions/telegram/src/draft-stream.test-helpers.ts @@ -6,6 +6,7 @@ export type TestDraftStream = { update: ReturnType<typeof vi.fn<(text: string) => void>>; flush: ReturnType<typeof vi.fn<() => Promise<void>>>; messageId: ReturnType<typeof vi.fn<() => number | undefined>>; + visibleSinceMs: ReturnType<typeof vi.fn<() => number | undefined>>; previewMode: ReturnType<typeof vi.fn<() => DraftPreviewMode>>; previewRevision: ReturnType<typeof vi.fn<() => number>>; lastDeliveredText: ReturnType<typeof vi.fn<() => string>>; @@ -25,8 +26,10 @@ export function createTestDraftStream(params?: { onStop?: () => void | Promise<void>; onDiscard?: () => void | Promise<void>; clearMessageIdOnForceNew?: boolean; + visibleSinceMs?: number; }): TestDraftStream { let messageId = params?.messageId; + let visibleSinceMs = params?.visibleSinceMs; let previewRevision = 0; let lastDeliveredText = ""; return { @@ -37,6 +40,7 @@ export function createTestDraftStream(params?: { }), flush: vi.fn().mockResolvedValue(undefined), messageId: vi.fn().mockImplementation(() => messageId), + visibleSinceMs: vi.fn().mockImplementation(() => visibleSinceMs), previewMode: vi.fn().mockReturnValue(params?.previewMode ?? "message"), previewRevision: vi.fn().mockImplementation(() => previewRevision), lastDeliveredText: vi.fn().mockImplementation(() => lastDeliveredText), @@ -52,16 +56,19 @@ export function createTestDraftStream(params?: { if (params?.clearMessageIdOnForceNew) { messageId = undefined; } + visibleSinceMs = undefined; }), sendMayHaveLanded: vi.fn().mockReturnValue(false), setMessageId: (value: number | undefined) => { messageId = value; + visibleSinceMs = value == null ? undefined : Date.now(); }, }; } export function createSequencedTestDraftStream(startMessageId = 1001): TestDraftStream { let activeMessageId: number | undefined; + let visibleSinceMs: number | undefined; let nextMessageId = startMessageId; let previewRevision = 0; let lastDeliveredText = ""; @@ -69,12 +76,14 @@ export function createSequencedTestDraftStream(startMessageId = 1001): TestDraft update: vi.fn().mockImplementation((text: string) => { if (activeMessageId == null) { activeMessageId = nextMessageId++; + visibleSinceMs = Date.now(); } previewRevision += 1; lastDeliveredText = text.trimEnd(); }), flush: vi.fn().mockResolvedValue(undefined), messageId: vi.fn().mockImplementation(() => activeMessageId), + visibleSinceMs: vi.fn().mockImplementation(() => visibleSinceMs), previewMode: vi.fn().mockReturnValue("message"), previewRevision: vi.fn().mockImplementation(() => previewRevision), lastDeliveredText: vi.fn().mockImplementation(() => lastDeliveredText), @@ -84,10 +93,12 @@ export function createSequencedTestDraftStream(startMessageId = 1001): TestDraft materialize: vi.fn().mockImplementation(async () => activeMessageId), forceNewMessage: vi.fn().mockImplementation(() => { activeMessageId = undefined; + visibleSinceMs = undefined; }), sendMayHaveLanded: vi.fn().mockReturnValue(false), setMessageId: (value: number | undefined) => { activeMessageId = value; + visibleSinceMs = value == null ? undefined : Date.now(); }, }; } diff --git a/extensions/telegram/src/draft-stream.test.ts b/extensions/telegram/src/draft-stream.test.ts index 64d7245fe4e..cd82809cffe 100644 --- a/extensions/telegram/src/draft-stream.test.ts +++ b/extensions/telegram/src/draft-stream.test.ts @@ -161,6 +161,28 @@ describe("createTelegramDraftStream", () => { expect(api.sendMessageDraft).not.toHaveBeenCalled(); }); + it("tracks when a message preview first became visible", async () => { + vi.useFakeTimers(); + try { + vi.setSystemTime(new Date("2026-04-26T01:00:00.000Z")); + const api = createMockDraftApi(); + const stream = createDraftStream(api, { previewTransport: "message" }); + + stream.update("Hello"); + await stream.flush(); + + expect(stream.visibleSinceMs?.()).toBe(Date.parse("2026-04-26T01:00:00.000Z")); + + vi.setSystemTime(new Date("2026-04-26T01:01:00.000Z")); + stream.update("Hello again"); + await stream.flush(); + + expect(stream.visibleSinceMs?.()).toBe(Date.parse("2026-04-26T01:00:00.000Z")); + } finally { + vi.useRealTimers(); + } + }); + it("falls back to message transport when sendMessageDraft is unavailable", async () => { const api = createMockDraftApi(); delete (api as { sendMessageDraft?: unknown }).sendMessageDraft; @@ -436,6 +458,23 @@ describe("createTelegramDraftStream", () => { expect(api.sendMessage).toHaveBeenLastCalledWith(123, "After thinking", undefined); }); + it("creates new message after cleanup and forceNewMessage", async () => { + const { api, stream } = createForceNewMessageHarness(); + + stream.update("Stale preview"); + await stream.flush(); + + await stream.clear(); + expect(api.deleteMessage).toHaveBeenCalledWith(123, 17); + + stream.forceNewMessage(); + stream.update("Next preview"); + await stream.flush(); + + expect(api.sendMessage).toHaveBeenCalledTimes(2); + expect(api.sendMessage).toHaveBeenLastCalledWith(123, "Next preview", undefined); + }); + it("sends first update immediately after forceNewMessage within throttle window", async () => { vi.useFakeTimers(); try { @@ -487,6 +526,7 @@ describe("createTelegramDraftStream", () => { messageId: 17, textSnapshot: "Message A partial", parseMode: undefined, + visibleSinceMs: expect.any(Number), }); expect(api.sendMessage).toHaveBeenCalledTimes(2); expect(api.sendMessage).toHaveBeenNthCalledWith(2, 123, "Message B partial", undefined); diff --git a/extensions/telegram/src/draft-stream.ts b/extensions/telegram/src/draft-stream.ts index a2f88aae216..802442f74ba 100644 --- a/extensions/telegram/src/draft-stream.ts +++ b/extensions/telegram/src/draft-stream.ts @@ -94,6 +94,7 @@ export type TelegramDraftStream = { update: (text: string) => void; flush: () => Promise<void>; messageId: () => number | undefined; + visibleSinceMs?: () => number | undefined; previewMode?: () => "message" | "draft"; previewRevision?: () => number; lastDeliveredText?: () => string; @@ -118,6 +119,7 @@ type SupersededTelegramPreview = { messageId: number; textSnapshot: string; parseMode?: "HTML"; + visibleSinceMs?: number; }; export function createTelegramDraftStream(params: { @@ -174,6 +176,7 @@ export function createTelegramDraftStream(params: { const streamState = { stopped: false, final: false }; let messageSendAttempted = false; let streamMessageId: number | undefined; + let streamVisibleSinceMs: number | undefined; let streamDraftId = usesDraftTransport ? allocateTelegramDraftId() : undefined; let previewTransport: "message" | "draft" = usesDraftTransport ? "draft" : "message"; let lastSentText = ""; @@ -226,6 +229,7 @@ export function createTelegramDraftStream(params: { sendGeneration, }: PreviewSendParams): Promise<boolean> => { if (typeof streamMessageId === "number") { + streamVisibleSinceMs ??= Date.now(); if (renderedParseMode) { await params.api.editMessageText(chatId, streamMessageId, renderedText, { parse_mode: renderedParseMode, @@ -257,15 +261,18 @@ export function createTelegramDraftStream(params: { return false; } const normalizedMessageId = Math.trunc(sentMessageId); + const visibleSinceMs = Date.now(); if (sendGeneration !== generation) { params.onSupersededPreview?.({ messageId: normalizedMessageId, textSnapshot: renderedText, parseMode: renderedParseMode, + visibleSinceMs, }); return true; } streamMessageId = normalizedMessageId; + streamVisibleSinceMs = visibleSinceMs; return true; }; const sendDraftTransportPreview = async ({ @@ -397,10 +404,12 @@ export function createTelegramDraftStream(params: { }; const forceNewMessage = () => { + streamState.stopped = false; streamState.final = false; generation += 1; messageSendAttempted = false; streamMessageId = undefined; + streamVisibleSinceMs = undefined; if (previewTransport === "draft") { streamDraftId = allocateTelegramDraftId(); } @@ -430,6 +439,7 @@ export function createTelegramDraftStream(params: { const sentId = sent?.message_id; if (typeof sentId === "number" && Number.isFinite(sentId)) { streamMessageId = Math.trunc(sentId); + streamVisibleSinceMs = Date.now(); if (resolvedDraftApi != null && streamDraftId != null) { const clearDraftId = streamDraftId; const clearThreadParams = @@ -454,6 +464,7 @@ export function createTelegramDraftStream(params: { update, flush: loop.flush, messageId: () => streamMessageId, + visibleSinceMs: () => streamVisibleSinceMs, previewMode: () => previewTransport, previewRevision: () => previewRevision, lastDeliveredText: () => lastDeliveredText, diff --git a/extensions/telegram/src/lane-delivery-text-deliverer.ts b/extensions/telegram/src/lane-delivery-text-deliverer.ts index 72ca2d51edc..ae1d83c065f 100644 --- a/extensions/telegram/src/lane-delivery-text-deliverer.ts +++ b/extensions/telegram/src/lane-delivery-text-deliverer.ts @@ -12,6 +12,7 @@ const MESSAGE_NOT_MODIFIED_RE = /400:\s*Bad Request:\s*message is not modified|MESSAGE_NOT_MODIFIED/i; const MESSAGE_NOT_FOUND_RE = /400:\s*Bad Request:\s*message to edit not found|MESSAGE_ID_INVALID|message can't be edited/i; +const LONG_LIVED_PREVIEW_FRESH_FINAL_AFTER_MS = 60_000; function extractErrorText(err: unknown): string { return typeof err === "string" @@ -55,6 +56,7 @@ export type DraftLaneState = { export type ArchivedPreview = { messageId: number; textSnapshot: string; + visibleSinceMs?: number; // Boundary-finalized previews should remain visible even if no matching // final edit arrives; superseded previews can be safely deleted. deleteIfUnused?: boolean; @@ -92,6 +94,7 @@ type CreateLaneTextDelivererParams = { deletePreviewMessage: (messageId: number) => Promise<void>; log: (message: string) => void; markDelivered: () => void; + now?: () => number; }; type DeliverLaneTextParams = { @@ -169,6 +172,14 @@ function shouldSkipRegressivePreviewUpdate(args: { ); } +function isLongLivedPreview(visibleSinceMs: number | undefined, nowMs: number): boolean { + return ( + typeof visibleSinceMs === "number" && + Number.isFinite(visibleSinceMs) && + nowMs - visibleSinceMs >= LONG_LIVED_PREVIEW_FRESH_FINAL_AFTER_MS + ); +} + function resolvePreviewTarget(params: ResolvePreviewTargetParams): PreviewTargetResolution { const lanePreviewMessageId = params.lane.stream?.messageId(); const previewMessageId = @@ -187,11 +198,27 @@ function resolvePreviewTarget(params: ResolvePreviewTargetParams): PreviewTarget export function createLaneTextDeliverer(params: CreateLaneTextDelivererParams) { const getLanePreviewText = (lane: DraftLaneState) => lane.lastPartialText; + const readNow = () => params.now?.() ?? Date.now(); const markActivePreviewComplete = (laneName: LaneName) => { params.activePreviewLifecycleByLane[laneName] = "complete"; params.retainPreviewOnCleanupByLane[laneName] = true; }; const isDraftPreviewLane = (lane: DraftLaneState) => lane.stream?.previewMode?.() === "draft"; + const isMessagePreviewLane = (lane: DraftLaneState) => !isDraftPreviewLane(lane); + const shouldUseFreshFinalForLane = (lane: DraftLaneState) => + isMessagePreviewLane(lane) && isLongLivedPreview(lane.stream?.visibleSinceMs?.(), readNow()); + const shouldUseFreshFinalForPreview = (lane: DraftLaneState, visibleSinceMs?: number) => + isMessagePreviewLane(lane) && isLongLivedPreview(visibleSinceMs, readNow()); + const clearActivePreviewAfterFreshFinal = async (lane: DraftLaneState, laneName: LaneName) => { + try { + await lane.stream?.clear(); + } catch (err) { + params.log(`telegram: ${laneName} fresh final preview cleanup failed: ${String(err)}`); + } + lane.lastPartialText = ""; + lane.hasStreamedMessage = false; + lane.stream?.forceNewMessage(); + }; const canMaterializeDraftFinal = ( lane: DraftLaneState, previewButtons?: TelegramInlineButtons, @@ -444,6 +471,19 @@ export function createLaneTextDeliverer(params: CreateLaneTextDelivererParams) { if (!archivedPreview) { return undefined; } + if (canEditViaPreview && shouldUseFreshFinalForPreview(lane, archivedPreview.visibleSinceMs)) { + const delivered = await params.sendPayload(params.applyTextToPayload(payload, text)); + if (delivered) { + try { + await params.deletePreviewMessage(archivedPreview.messageId); + } catch (err) { + params.log( + `telegram: archived answer preview cleanup failed (${archivedPreview.messageId}): ${String(err)}`, + ); + } + return result("sent"); + } + } if (canEditViaPreview) { const finalized = await tryUpdatePreviewForLane({ lane, @@ -551,6 +591,14 @@ export function createLaneTextDeliverer(params: CreateLaneTextDelivererParams) { }); } } + if (shouldUseFreshFinalForLane(lane)) { + await params.stopDraftLane(lane); + const delivered = await params.sendPayload(params.applyTextToPayload(payload, text)); + if (delivered) { + await clearActivePreviewAfterFreshFinal(lane, laneName); + return result("sent"); + } + } const previewMessageId = lane.stream?.messageId(); const finalized = await tryUpdatePreviewForLane({ lane, diff --git a/extensions/telegram/src/lane-delivery.test.ts b/extensions/telegram/src/lane-delivery.test.ts index 36d62786e9a..174c73c9ddd 100644 --- a/extensions/telegram/src/lane-delivery.test.ts +++ b/extensions/telegram/src/lane-delivery.test.ts @@ -2,6 +2,7 @@ import type { ReplyPayload } from "openclaw/plugin-sdk/reply-runtime"; import { describe, expect, it, vi } from "vitest"; import { createTestDraftStream } from "./draft-stream.test-helpers.js"; import { + type ArchivedPreview, createLaneTextDeliverer, type DraftLaneState, type LaneDeliveryResult, @@ -17,9 +18,15 @@ function createHarness(params?: { answerStream?: DraftLaneState["stream"]; answerHasStreamedMessage?: boolean; answerLastPartialText?: string; + answerPreviewVisibleSinceMs?: number; + nowMs?: number; }) { const answer = - params?.answerStream ?? createTestDraftStream({ messageId: params?.answerMessageId }); + params?.answerStream ?? + createTestDraftStream({ + messageId: params?.answerMessageId, + visibleSinceMs: params?.answerPreviewVisibleSinceMs, + }); const reasoning = createTestDraftStream(); const lanes: Record<LaneName, DraftLaneState> = { answer: { @@ -51,11 +58,7 @@ function createHarness(params?: { const markDelivered = vi.fn(); const activePreviewLifecycleByLane = { answer: "transient", reasoning: "transient" } as const; const retainPreviewOnCleanupByLane = { answer: false, reasoning: false } as const; - const archivedAnswerPreviews: Array<{ - messageId: number; - textSnapshot: string; - deleteIfUnused?: boolean; - }> = []; + const archivedAnswerPreviews: ArchivedPreview[] = []; const deliverLaneText = createLaneTextDeliverer({ lanes, @@ -71,6 +74,7 @@ function createHarness(params?: { deletePreviewMessage, log, markDelivered, + now: params?.nowMs != null ? () => params.nowMs! : undefined, }); return { @@ -347,6 +351,116 @@ describe("createLaneTextDeliverer", () => { expect(harness.log).toHaveBeenCalledWith(expect.stringContaining("preview final too long")); }); + it("sends a fresh final when a message preview is long lived", async () => { + const visibleSinceMs = 10_000; + const harness = createHarness({ + answerMessageId: 999, + answerHasStreamedMessage: true, + answerLastPartialText: "Working...", + answerPreviewVisibleSinceMs: visibleSinceMs, + nowMs: visibleSinceMs + 60_000, + }); + + const result = await deliverFinalAnswer(harness, HELLO_FINAL); + + expect(result.kind).toBe("sent"); + expect(harness.stopDraftLane).toHaveBeenCalledTimes(1); + expect(harness.sendPayload).toHaveBeenCalledWith( + expect.objectContaining({ text: HELLO_FINAL }), + ); + expect(harness.editPreview).not.toHaveBeenCalled(); + expect(harness.answer.stream?.clear).toHaveBeenCalledTimes(1); + expect(harness.answer.stream?.forceNewMessage).toHaveBeenCalledTimes(1); + expect(harness.lanes.answer.hasStreamedMessage).toBe(false); + expect(harness.lanes.answer.lastPartialText).toBe(""); + expect(harness.markDelivered).not.toHaveBeenCalled(); + }); + + it("falls back to editing a long-lived preview when fresh final send returns false", async () => { + const visibleSinceMs = 10_000; + const harness = createHarness({ + answerMessageId: 999, + answerHasStreamedMessage: true, + answerLastPartialText: "Working...", + answerPreviewVisibleSinceMs: visibleSinceMs, + nowMs: visibleSinceMs + 60_000, + }); + harness.sendPayload.mockResolvedValueOnce(false); + + const result = await deliverFinalAnswer(harness, HELLO_FINAL); + + expect(expectPreviewFinalized(result)).toEqual({ + content: HELLO_FINAL, + messageId: 999, + }); + expect(harness.stopDraftLane).toHaveBeenCalledTimes(2); + expect(harness.sendPayload).toHaveBeenCalledTimes(1); + expect(harness.editPreview).toHaveBeenCalledWith( + expect.objectContaining({ + messageId: 999, + text: HELLO_FINAL, + }), + ); + expect(harness.answer.stream?.clear).not.toHaveBeenCalled(); + expect(harness.markDelivered).toHaveBeenCalledTimes(1); + }); + + it("sends a fresh final for stale archived previews", async () => { + const visibleSinceMs = 10_000; + const harness = createHarness({ + answerMessageId: 1001, + answerPreviewVisibleSinceMs: visibleSinceMs, + nowMs: visibleSinceMs + 60_000, + }); + harness.archivedAnswerPreviews.push({ + messageId: 222, + textSnapshot: "Working...", + visibleSinceMs, + deleteIfUnused: true, + }); + + const result = await deliverFinalAnswer(harness, HELLO_FINAL); + + expect(result.kind).toBe("sent"); + expect(harness.sendPayload).toHaveBeenCalledWith( + expect.objectContaining({ text: HELLO_FINAL }), + ); + expect(harness.editPreview).not.toHaveBeenCalled(); + expect(harness.deletePreviewMessage).toHaveBeenCalledWith(222); + }); + + it("falls back to editing a stale archived preview when fresh final send returns false", async () => { + const visibleSinceMs = 10_000; + const harness = createHarness({ + answerMessageId: 1001, + answerPreviewVisibleSinceMs: visibleSinceMs, + nowMs: visibleSinceMs + 60_000, + }); + harness.archivedAnswerPreviews.push({ + messageId: 222, + textSnapshot: "Working...", + visibleSinceMs, + deleteIfUnused: true, + }); + harness.sendPayload.mockResolvedValueOnce(false); + + const result = await deliverFinalAnswer(harness, HELLO_FINAL); + + expect(expectPreviewFinalized(result)).toEqual({ + content: HELLO_FINAL, + messageId: 222, + }); + expect(harness.sendPayload).toHaveBeenCalledTimes(1); + expect(harness.editPreview).toHaveBeenCalledWith( + expect.objectContaining({ + messageId: 222, + text: HELLO_FINAL, + }), + ); + expect(harness.deletePreviewMessage).not.toHaveBeenCalled(); + expect(harness.markDelivered).toHaveBeenCalledTimes(1); + }); + it("materializes DM draft streaming final even when text is unchanged", async () => { const answerStream = createTestDraftStream({ previewMode: "draft", messageId: 321 }); answerStream.materialize.mockResolvedValue(321); From 6cba12caaec02b03033ac3b3612791dfffdbd14d Mon Sep 17 00:00:00 2001 From: Peter Steinberger <steipete@gmail.com> Date: Sun, 26 Apr 2026 23:48:18 +0100 Subject: [PATCH 073/418] test: add docker e2e planner guards --- scripts/check-docker-e2e-boundaries.mjs | 64 +++++++++++++++- scripts/check-openclaw-package-tarball.mjs | 61 +++++++++++++++ scripts/docker-e2e.mjs | 17 +++++ scripts/package-openclaw-for-docker.mjs | 3 + test/scripts/docker-e2e-plan.test.ts | 86 ++++++++++++++++++++++ 5 files changed, 230 insertions(+), 1 deletion(-) create mode 100644 scripts/check-openclaw-package-tarball.mjs create mode 100644 test/scripts/docker-e2e-plan.test.ts diff --git a/scripts/check-docker-e2e-boundaries.mjs b/scripts/check-docker-e2e-boundaries.mjs index 885b248de14..99ef52d0d06 100644 --- a/scripts/check-docker-e2e-boundaries.mjs +++ b/scripts/check-docker-e2e-boundaries.mjs @@ -5,9 +5,13 @@ import fs from "node:fs"; import path from "node:path"; import { fileURLToPath } from "node:url"; +import { laneResources, laneWeight } from "./lib/docker-e2e-plan.mjs"; +import { allReleasePathLanes, mainLanes, tailLanes } from "./lib/docker-e2e-scenarios.mjs"; const ROOT_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), ".."); const errors = []; +const packageJson = JSON.parse(readText("package.json")); +const packageScripts = new Set(Object.keys(packageJson.scripts ?? {})); function readText(relativePath) { return fs.readFileSync(path.join(ROOT_DIR, relativePath), "utf8"); @@ -43,9 +47,67 @@ if (/^\s*(?:COPY|ADD)\s+\.\s+\/app(?:\s|$)/imu.test(dockerfile)) { errors.push("scripts/e2e/Dockerfile: do not copy the source checkout into /app"); } +function validateUniqueLanes(label, lanes) { + const seen = new Set(); + for (const lane of lanes) { + if (seen.has(lane.name)) { + errors.push(`${label}: duplicate Docker E2E lane '${lane.name}'`); + } + seen.add(lane.name); + } +} + +function validateLane(label, lane) { + if (!lane.name || typeof lane.name !== "string") { + errors.push(`${label}: Docker E2E lane is missing a string name`); + } + if (!lane.command || typeof lane.command !== "string") { + errors.push(`${label}: Docker E2E lane '${lane.name}' is missing a string command`); + return; + } + if (lane.e2eImageKind && lane.e2eImageKind !== "bare" && lane.e2eImageKind !== "functional") { + errors.push( + `${label}: Docker E2E lane '${lane.name}' has invalid image kind '${lane.e2eImageKind}'`, + ); + } + if (lane.live && lane.e2eImageKind) { + errors.push(`${label}: live Docker E2E lane '${lane.name}' must not require a package image`); + } + if (!lane.live && !lane.e2eImageKind) { + errors.push(`${label}: package Docker E2E lane '${lane.name}' must declare an e2e image kind`); + } + if (laneWeight(lane) < 1) { + errors.push(`${label}: Docker E2E lane '${lane.name}' must have positive weight`); + } + if (!laneResources(lane).includes("docker")) { + errors.push(`${label}: Docker E2E lane '${lane.name}' must include the docker resource`); + } + + for (const match of lane.command.matchAll(/\bpnpm\s+([^\s]+)/gu)) { + const script = match[1]; + if (!packageScripts.has(script)) { + errors.push( + `${label}: Docker E2E lane '${lane.name}' references missing package script '${script}'`, + ); + } + } +} + +const releasePathLanes = allReleasePathLanes({ includeOpenWebUI: true }); +for (const [label, lanes] of [ + ["release-path", releasePathLanes], + ["main", mainLanes], + ["tail", tailLanes], +]) { + validateUniqueLanes(label, lanes); + for (const lane of lanes) { + validateLane(label, lane); + } +} + if (errors.length > 0) { console.error(errors.join("\n")); process.exit(1); } -console.log("Docker E2E package boundary guard passed."); +console.log("Docker E2E package boundary/catalog guard passed."); diff --git a/scripts/check-openclaw-package-tarball.mjs b/scripts/check-openclaw-package-tarball.mjs new file mode 100644 index 00000000000..e7275e1e61c --- /dev/null +++ b/scripts/check-openclaw-package-tarball.mjs @@ -0,0 +1,61 @@ +#!/usr/bin/env node +// Validates the npm tarball Docker E2E lanes install. +// This is intentionally tarball-only: the check proves Docker lanes consume the +// prebuilt package artifact with dist inventory, not a source checkout. +import { spawnSync } from "node:child_process"; +import fs from "node:fs"; + +function usage() { + return "Usage: node scripts/check-openclaw-package-tarball.mjs <openclaw.tgz>"; +} + +function fail(message) { + console.error(message); + process.exit(1); +} + +const tarball = process.argv[2]; +if (!tarball || process.argv.length > 3) { + fail(usage()); +} +if (!fs.existsSync(tarball)) { + fail(`OpenClaw package tarball does not exist: ${tarball}`); +} + +const list = spawnSync("tar", ["-tf", tarball], { + encoding: "utf8", + stdio: ["ignore", "pipe", "pipe"], +}); +if (list.status !== 0) { + fail(`tar -tf failed for ${tarball}: ${list.stderr || list.status}`); +} + +const entries = list.stdout + .split(/\r?\n/u) + .map((entry) => entry.trim()) + .filter(Boolean); +const normalized = entries.map((entry) => entry.replace(/^package\//u, "")); +const entrySet = new Set(normalized); +const errors = []; + +for (const entry of normalized) { + if (entry.startsWith("/") || entry.split("/").includes("..")) { + errors.push(`unsafe tar entry: ${entry}`); + } +} + +if (!entrySet.has("package.json")) { + errors.push("missing package.json"); +} +if (!normalized.some((entry) => entry.startsWith("dist/"))) { + errors.push("missing dist/ entries"); +} +if (!entrySet.has("dist/postinstall-inventory.json")) { + errors.push("missing dist/postinstall-inventory.json"); +} + +if (errors.length > 0) { + fail(`OpenClaw package tarball integrity failed:\n${errors.join("\n")}`); +} + +console.log("OpenClaw package tarball integrity passed."); diff --git a/scripts/docker-e2e.mjs b/scripts/docker-e2e.mjs index 753e720b56d..13ff391f1d6 100644 --- a/scripts/docker-e2e.mjs +++ b/scripts/docker-e2e.mjs @@ -8,6 +8,7 @@ function usage() { "Usage:", " node scripts/docker-e2e.mjs github-outputs <plan.json>", " node scripts/docker-e2e.mjs summary <summary.json> <title>", + " node scripts/docker-e2e.mjs failed-reruns <summary.json>", ].join("\n"); } @@ -65,9 +66,23 @@ function summaryMarkdown(summary, title) { ); } } + const failedReruns = failedRerunCommands(summary); + if (failedReruns.length > 0) { + lines.push("", "Failed lane reruns:", ""); + for (const command of failedReruns) { + lines.push(`- ${inlineCode(command)}`); + } + } return lines.join("\n"); } +function failedRerunCommands(summary) { + const lanes = Array.isArray(summary.lanes) ? summary.lanes : []; + return lanes + .filter((lane) => lane.status !== 0 && lane.rerunCommand) + .map((lane) => lane.rerunCommand); +} + const [command, file, ...args] = process.argv.slice(2); if (!command || !file) { throw new Error(usage()); @@ -81,6 +96,8 @@ if (command === "github-outputs") { throw new Error(usage()); } process.stdout.write(`${summaryMarkdown(readJson(file), title)}\n`); +} else if (command === "failed-reruns") { + process.stdout.write(`${failedRerunCommands(readJson(file)).join("\n")}\n`); } else { throw new Error(`unknown command: ${command}\n${usage()}`); } diff --git a/scripts/package-openclaw-for-docker.mjs b/scripts/package-openclaw-for-docker.mjs index 80c5afbeba2..0d7003b4ff4 100644 --- a/scripts/package-openclaw-for-docker.mjs +++ b/scripts/package-openclaw-for-docker.mjs @@ -139,6 +139,9 @@ async function main() { } } + console.error("==> Checking OpenClaw package tarball"); + await run("node", ["scripts/check-openclaw-package-tarball.mjs", tarball]); + process.stdout.write(`${tarball}\n`); } diff --git a/test/scripts/docker-e2e-plan.test.ts b/test/scripts/docker-e2e-plan.test.ts new file mode 100644 index 00000000000..a762809c445 --- /dev/null +++ b/test/scripts/docker-e2e-plan.test.ts @@ -0,0 +1,86 @@ +import { describe, expect, it } from "vitest"; +import { + DEFAULT_LIVE_RETRIES, + RELEASE_PATH_PROFILE, + resolveDockerE2ePlan, +} from "../../scripts/lib/docker-e2e-plan.mjs"; + +const orderLanes = <T>(lanes: T[]) => lanes; + +function planFor( + overrides: Partial<Parameters<typeof resolveDockerE2ePlan>[0]> = {}, +): ReturnType<typeof resolveDockerE2ePlan>["plan"] { + return resolveDockerE2ePlan({ + includeOpenWebUI: false, + liveMode: "all", + liveRetries: DEFAULT_LIVE_RETRIES, + orderLanes, + planReleaseAll: false, + profile: "all", + releaseChunk: "core", + selectedLaneNames: [], + timingStore: undefined, + ...overrides, + }).plan; +} + +describe("scripts/lib/docker-e2e-plan", () => { + it("plans the full release path against package-backed e2e images", () => { + const plan = planFor({ + includeOpenWebUI: false, + planReleaseAll: true, + profile: RELEASE_PATH_PROFILE, + }); + + expect(plan.needs).toMatchObject({ + bareImage: true, + e2eImage: true, + functionalImage: true, + liveImage: false, + package: true, + }); + expect(plan.credentials).toEqual(["anthropic", "openai"]); + expect(plan.lanes.map((lane) => lane.name)).toContain("install-e2e"); + expect(plan.lanes.map((lane) => lane.name)).toContain("mcp-channels"); + expect(plan.lanes.map((lane) => lane.name)).not.toContain("openwebui"); + }); + + it("plans a live-only selected lane without package e2e images", () => { + const plan = planFor({ selectedLaneNames: ["live-models"] }); + + expect(plan.lanes.map((lane) => lane.name)).toEqual(["live-models"]); + expect(plan.needs).toMatchObject({ + bareImage: false, + e2eImage: false, + functionalImage: false, + liveImage: true, + package: false, + }); + }); + + it("plans Open WebUI as a functional-image lane with OpenAI credentials", () => { + const plan = planFor({ + includeOpenWebUI: true, + selectedLaneNames: ["openwebui"], + }); + + expect(plan.credentials).toEqual(["openai"]); + expect(plan.lanes).toEqual([ + expect.objectContaining({ + imageKind: "functional", + live: false, + name: "openwebui", + }), + ]); + expect(plan.needs).toMatchObject({ + functionalImage: true, + package: true, + }); + }); + + it("rejects unknown selected lanes with the available lane names", () => { + expect(() => planFor({ selectedLaneNames: ["missing-lane"] })).toThrow( + /OPENCLAW_DOCKER_ALL_LANES unknown lane\(s\): missing-lane/u, + ); + }); +}); From 7a86448a6eea1de1d7eb2726efbf705f470607c5 Mon Sep 17 00:00:00 2001 From: Peter Steinberger <steipete@gmail.com> Date: Sun, 26 Apr 2026 23:48:23 +0100 Subject: [PATCH 074/418] ci: reuse docker e2e plan action --- .github/actions/docker-e2e-plan/action.yml | 145 ++++++++++++++++++ .../openclaw-live-and-e2e-checks-reusable.yml | 127 ++------------- 2 files changed, 162 insertions(+), 110 deletions(-) create mode 100644 .github/actions/docker-e2e-plan/action.yml diff --git a/.github/actions/docker-e2e-plan/action.yml b/.github/actions/docker-e2e-plan/action.yml new file mode 100644 index 00000000000..4dbb354157d --- /dev/null +++ b/.github/actions/docker-e2e-plan/action.yml @@ -0,0 +1,145 @@ +name: Docker E2E plan and hydrate +description: > + Create a Docker E2E lane plan, expose GitHub outputs, and optionally hydrate + the prebuilt package artifact plus shared Docker images needed by the plan. +inputs: + mode: + description: prepare, chunk, or targeted. + required: true + chunk: + description: Release-path chunk for mode=chunk. + required: false + default: "" + lanes: + description: Comma/space separated lane names for targeted or prepare mode. + required: false + default: "" + include-openwebui: + description: Whether Open WebUI is included when planning release/prepare coverage. + required: false + default: "true" + include-release-path-suites: + description: Whether prepare mode should plan all release-path suites. + required: false + default: "false" + hydrate-artifacts: + description: Whether to download/pull artifacts required by the plan. + required: false + default: "true" +outputs: + credentials: + description: Comma-separated credential groups required by selected lanes. + value: ${{ steps.plan.outputs.credentials }} + needs_bare_image: + description: "1 when selected lanes require the bare Docker E2E image." + value: ${{ steps.plan.outputs.needs_bare_image }} + needs_e2e_image: + description: "1 when selected lanes require any Docker E2E image." + value: ${{ steps.plan.outputs.needs_e2e_image }} + needs_functional_image: + description: "1 when selected lanes require the functional Docker E2E image." + value: ${{ steps.plan.outputs.needs_functional_image }} + needs_live_image: + description: "1 when selected lanes require building the live Docker image." + value: ${{ steps.plan.outputs.needs_live_image }} + needs_package: + description: "1 when selected lanes require the OpenClaw package tarball." + value: ${{ steps.plan.outputs.needs_package }} + plan_json: + description: Path to the generated plan JSON. + value: ${{ steps.plan.outputs.plan_json }} +runs: + using: composite + steps: + - name: Plan Docker E2E lanes + id: plan + shell: bash + env: + MODE: ${{ inputs.mode }} + CHUNK: ${{ inputs.chunk }} + LANES: ${{ inputs.lanes }} + INCLUDE_OPENWEBUI: ${{ inputs.include-openwebui }} + INCLUDE_RELEASE_PATH_SUITES: ${{ inputs.include-release-path-suites }} + run: | + set -euo pipefail + mkdir -p .artifacts/docker-tests + + case "$MODE" in + prepare) + plan_path=".artifacts/docker-tests/plan.json" + if [[ "$INCLUDE_RELEASE_PATH_SUITES" == "true" ]]; then + export OPENCLAW_DOCKER_ALL_PROFILE=release-path + export OPENCLAW_DOCKER_ALL_PLAN_RELEASE_ALL=1 + elif [[ -n "$LANES" ]]; then + export OPENCLAW_DOCKER_ALL_LANES="$LANES" + elif [[ "$INCLUDE_OPENWEBUI" == "true" ]]; then + export OPENCLAW_DOCKER_ALL_LANES=openwebui + fi + ;; + chunk) + if [[ -z "$CHUNK" ]]; then + echo "chunk input is required for Docker E2E chunk planning." >&2 + exit 1 + fi + export OPENCLAW_DOCKER_ALL_PROFILE=release-path + export OPENCLAW_DOCKER_ALL_CHUNK="$CHUNK" + plan_path=".artifacts/docker-tests/release-${CHUNK}-plan.json" + ;; + targeted) + if [[ -z "$LANES" ]]; then + echo "lanes input is required for Docker E2E targeted planning." >&2 + exit 1 + fi + export OPENCLAW_DOCKER_ALL_LANES="$LANES" + plan_path=".artifacts/docker-tests/targeted-plan.json" + ;; + *) + echo "mode must be prepare, chunk, or targeted. Got: $MODE" >&2 + exit 1 + ;; + esac + + export OPENCLAW_DOCKER_ALL_INCLUDE_OPENWEBUI="$INCLUDE_OPENWEBUI" + node scripts/test-docker-all.mjs --plan-json > "$plan_path" + node scripts/docker-e2e.mjs github-outputs "$plan_path" >> "$GITHUB_OUTPUT" + echo "plan_json=$plan_path" >> "$GITHUB_OUTPUT" + + - name: Download OpenClaw Docker E2E package + if: inputs.hydrate-artifacts == 'true' && steps.plan.outputs.needs_package == '1' + uses: actions/download-artifact@v8 + with: + name: docker-e2e-package + path: .artifacts/docker-e2e-package + + - name: Pull shared bare Docker E2E image + if: inputs.hydrate-artifacts == 'true' && steps.plan.outputs.needs_bare_image == '1' + shell: bash + run: | + set -euo pipefail + docker pull "${OPENCLAW_DOCKER_E2E_BARE_IMAGE}" + + - name: Pull shared functional Docker E2E image + if: inputs.hydrate-artifacts == 'true' && steps.plan.outputs.needs_functional_image == '1' + shell: bash + run: | + set -euo pipefail + docker pull "${OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE}" + + - name: Validate Docker E2E credentials + if: inputs.hydrate-artifacts == 'true' + shell: bash + env: + CREDENTIALS: ${{ steps.plan.outputs.credentials }} + run: | + set -euo pipefail + credentials=",$CREDENTIALS," + if [[ "$credentials" == *",openai,"* ]]; then + [[ -n "${OPENAI_API_KEY:-}" ]] || { + echo "OPENAI_API_KEY is required for selected Docker E2E lanes." >&2 + exit 1 + } + fi + if [[ "$credentials" == *",anthropic,"* && -z "${ANTHROPIC_API_TOKEN:-}" && -z "${ANTHROPIC_API_KEY:-}" ]]; then + echo "ANTHROPIC_API_TOKEN or ANTHROPIC_API_KEY is required for selected Docker E2E lanes." >&2 + exit 1 + fi diff --git a/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml b/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml index 1a0c9bcf160..46e953cd2de 100644 --- a/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml +++ b/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml @@ -466,54 +466,13 @@ jobs: - name: Hydrate live auth/profile inputs run: bash scripts/ci-hydrate-live-auth.sh - - name: Plan Docker E2E chunk + - name: Plan and hydrate Docker E2E chunk id: plan - shell: bash - run: | - set -euo pipefail - mkdir -p .artifacts/docker-tests - export OPENCLAW_DOCKER_ALL_PROFILE=release-path - export OPENCLAW_DOCKER_ALL_CHUNK="${DOCKER_E2E_CHUNK}" - export OPENCLAW_DOCKER_ALL_INCLUDE_OPENWEBUI="${INCLUDE_OPENWEBUI}" - node scripts/test-docker-all.mjs --plan-json > ".artifacts/docker-tests/release-${DOCKER_E2E_CHUNK}-plan.json" - node scripts/docker-e2e.mjs github-outputs ".artifacts/docker-tests/release-${DOCKER_E2E_CHUNK}-plan.json" >> "$GITHUB_OUTPUT" - - - name: Download OpenClaw Docker E2E package - if: steps.plan.outputs.needs_package == '1' - uses: actions/download-artifact@v8 + uses: ./.github/actions/docker-e2e-plan with: - name: docker-e2e-package - path: .artifacts/docker-e2e-package - - - name: Pull shared bare Docker E2E image - if: steps.plan.outputs.needs_bare_image == '1' - shell: bash - run: | - set -euo pipefail - docker pull "${OPENCLAW_DOCKER_E2E_BARE_IMAGE}" - - - name: Pull shared functional Docker E2E image - if: steps.plan.outputs.needs_functional_image == '1' - shell: bash - run: | - set -euo pipefail - docker pull "${OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE}" - - - name: Validate chunk credentials - shell: bash - run: | - set -euo pipefail - credentials=",${{ steps.plan.outputs.credentials }}," - if [[ "$credentials" == *",openai,"* ]]; then - [[ -n "${OPENAI_API_KEY:-}" ]] || { - echo "OPENAI_API_KEY is required for selected Docker E2E lanes." >&2 - exit 1 - } - fi - if [[ "$credentials" == *",anthropic,"* && -z "${ANTHROPIC_API_TOKEN:-}" && -z "${ANTHROPIC_API_KEY:-}" ]]; then - echo "ANTHROPIC_API_TOKEN or ANTHROPIC_API_KEY is required for selected Docker E2E lanes." >&2 - exit 1 - fi + mode: chunk + chunk: ${{ matrix.chunk_id }} + include-openwebui: ${{ inputs.include_openwebui }} - name: Run Docker E2E chunk shell: bash @@ -632,53 +591,13 @@ jobs: - name: Hydrate live auth/profile inputs run: bash scripts/ci-hydrate-live-auth.sh - - name: Plan targeted Docker E2E lanes + - name: Plan and hydrate targeted Docker E2E lanes id: plan - shell: bash - run: | - set -euo pipefail - mkdir -p .artifacts/docker-tests - export OPENCLAW_DOCKER_ALL_LANES="${DOCKER_E2E_LANES}" - export OPENCLAW_DOCKER_ALL_INCLUDE_OPENWEBUI="${INCLUDE_OPENWEBUI}" - node scripts/test-docker-all.mjs --plan-json > .artifacts/docker-tests/targeted-plan.json - node scripts/docker-e2e.mjs github-outputs .artifacts/docker-tests/targeted-plan.json >> "$GITHUB_OUTPUT" - - - name: Download OpenClaw Docker E2E package - if: steps.plan.outputs.needs_package == '1' - uses: actions/download-artifact@v8 + uses: ./.github/actions/docker-e2e-plan with: - name: docker-e2e-package - path: .artifacts/docker-e2e-package - - - name: Pull shared bare Docker E2E image - if: steps.plan.outputs.needs_bare_image == '1' - shell: bash - run: | - set -euo pipefail - docker pull "${OPENCLAW_DOCKER_E2E_BARE_IMAGE}" - - - name: Pull shared functional Docker E2E image - if: steps.plan.outputs.needs_functional_image == '1' - shell: bash - run: | - set -euo pipefail - docker pull "${OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE}" - - - name: Validate targeted lane credentials - shell: bash - run: | - set -euo pipefail - credentials=",${{ steps.plan.outputs.credentials }}," - if [[ "$credentials" == *",openai,"* ]]; then - [[ -n "${OPENAI_API_KEY:-}" ]] || { - echo "OPENAI_API_KEY is required for selected Docker E2E lanes." >&2 - exit 1 - } - fi - if [[ "$credentials" == *",anthropic,"* && -z "${ANTHROPIC_API_TOKEN:-}" && -z "${ANTHROPIC_API_KEY:-}" ]]; then - echo "ANTHROPIC_API_TOKEN or ANTHROPIC_API_KEY is required for selected Docker E2E lanes." >&2 - exit 1 - fi + mode: targeted + lanes: ${{ inputs.docker_lanes }} + include-openwebui: ${{ inputs.include_openwebui }} - name: Run targeted Docker E2E lanes shell: bash @@ -807,25 +726,13 @@ jobs: - name: Plan Docker E2E images id: plan - shell: bash - env: - DOCKER_E2E_LANES: ${{ inputs.docker_lanes }} - INCLUDE_RELEASE_PATH_SUITES: ${{ inputs.include_release_path_suites }} - INCLUDE_OPENWEBUI: ${{ inputs.include_openwebui }} - run: | - set -euo pipefail - mkdir -p .artifacts/docker-tests - if [[ "${INCLUDE_RELEASE_PATH_SUITES}" == "true" ]]; then - export OPENCLAW_DOCKER_ALL_PROFILE=release-path - export OPENCLAW_DOCKER_ALL_PLAN_RELEASE_ALL=1 - elif [[ -n "${DOCKER_E2E_LANES}" ]]; then - export OPENCLAW_DOCKER_ALL_LANES="${DOCKER_E2E_LANES}" - elif [[ "${INCLUDE_OPENWEBUI}" == "true" ]]; then - export OPENCLAW_DOCKER_ALL_LANES=openwebui - fi - export OPENCLAW_DOCKER_ALL_INCLUDE_OPENWEBUI="${INCLUDE_OPENWEBUI}" - node scripts/test-docker-all.mjs --plan-json > .artifacts/docker-tests/plan.json - node scripts/docker-e2e.mjs github-outputs .artifacts/docker-tests/plan.json >> "$GITHUB_OUTPUT" + uses: ./.github/actions/docker-e2e-plan + with: + mode: prepare + lanes: ${{ inputs.docker_lanes }} + include-release-path-suites: ${{ inputs.include_release_path_suites }} + include-openwebui: ${{ inputs.include_openwebui }} + hydrate-artifacts: "false" - name: Setup Node environment if: steps.plan.outputs.needs_package == '1' From b5714b90edbe62819b333f95201f8d9b222c4be3 Mon Sep 17 00:00:00 2001 From: Peter Steinberger <steipete@gmail.com> Date: Sun, 26 Apr 2026 23:48:27 +0100 Subject: [PATCH 075/418] refactor(test): share docker e2e shell helpers --- .../bundled-channel-runtime-deps-docker.sh | 71 ++++++------------- .../bundled-channel-runtime-deps-runner.sh | 42 +++++++++++ .../e2e/npm-onboard-channel-agent-docker.sh | 4 +- scripts/lib/docker-e2e-logs.sh | 22 ++++-- 4 files changed, 82 insertions(+), 57 deletions(-) create mode 100644 scripts/e2e/lib/bundled-channel-runtime-deps-runner.sh diff --git a/scripts/e2e/bundled-channel-runtime-deps-docker.sh b/scripts/e2e/bundled-channel-runtime-deps-docker.sh index 706104a13ec..c9a08951dbf 100644 --- a/scripts/e2e/bundled-channel-runtime-deps-docker.sh +++ b/scripts/e2e/bundled-channel-runtime-deps-docker.sh @@ -7,6 +7,7 @@ set -euo pipefail ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" source "$ROOT_DIR/scripts/lib/docker-e2e-image.sh" source "$ROOT_DIR/scripts/lib/docker-e2e-package.sh" +source "$ROOT_DIR/scripts/e2e/lib/bundled-channel-runtime-deps-runner.sh" IMAGE_NAME="$(docker_e2e_resolve_image "openclaw-bundled-channel-deps-e2e" OPENCLAW_BUNDLED_CHANNEL_DEPS_E2E_IMAGE)" UPDATE_BASELINE_VERSION="${OPENCLAW_BUNDLED_CHANNEL_UPDATE_BASELINE_VERSION:-2026.4.20}" @@ -43,7 +44,7 @@ run_channel_scenario() { local channel="$1" local dep_sentinel="$2" local run_log - run_log="$(mktemp "${TMPDIR:-/tmp}/openclaw-bundled-channel-deps-$channel.XXXXXX")" + run_log="$(docker_e2e_run_log "bundled-channel-deps-$channel")" echo "Running bundled $channel runtime deps Docker E2E..." if ! timeout "$DOCKER_RUN_TIMEOUT" docker run --rm \ @@ -446,18 +447,18 @@ stop_gateway echo "bundled $CHANNEL runtime deps Docker E2E passed" EOF then - cat "$run_log" + docker_e2e_print_log "$run_log" rm -f "$run_log" exit 1 fi - cat "$run_log" + docker_e2e_print_log "$run_log" rm -f "$run_log" } run_root_owned_global_scenario() { local run_log - run_log="$(mktemp "${TMPDIR:-/tmp}/openclaw-bundled-channel-root-owned.XXXXXX")" + run_log="$(docker_e2e_run_log bundled-channel-root-owned)" echo "Running bundled channel root-owned global install Docker E2E..." if ! timeout "$DOCKER_RUN_TIMEOUT" docker run --rm --user root \ @@ -623,18 +624,18 @@ fi echo "root-owned global install Docker E2E passed" EOF then - cat "$run_log" + docker_e2e_print_log "$run_log" rm -f "$run_log" exit 1 fi - cat "$run_log" + docker_e2e_print_log "$run_log" rm -f "$run_log" } run_setup_entry_scenario() { local run_log - run_log="$(mktemp "${TMPDIR:-/tmp}/openclaw-bundled-channel-setup-entry.XXXXXX")" + run_log="$(docker_e2e_run_log bundled-channel-setup-entry)" echo "Running bundled channel setup-entry runtime deps Docker E2E..." if ! timeout "$DOCKER_RUN_TIMEOUT" docker run --rm \ @@ -880,18 +881,18 @@ done echo "bundled channel setup-entry runtime deps Docker E2E passed" EOF then - cat "$run_log" + docker_e2e_print_log "$run_log" rm -f "$run_log" exit 1 fi - cat "$run_log" + docker_e2e_print_log "$run_log" rm -f "$run_log" } run_disabled_config_scenario() { local run_log - run_log="$(mktemp "${TMPDIR:-/tmp}/openclaw-bundled-channel-disabled-config.XXXXXX")" + run_log="$(docker_e2e_run_log bundled-channel-disabled-config)" echo "Running bundled channel disabled-config runtime deps Docker E2E..." if ! timeout "$DOCKER_RUN_TIMEOUT" docker run --rm \ @@ -1045,18 +1046,18 @@ fi echo "bundled channel disabled-config runtime deps Docker E2E passed" EOF then - cat "$run_log" + docker_e2e_print_log "$run_log" rm -f "$run_log" exit 1 fi - cat "$run_log" + docker_e2e_print_log "$run_log" rm -f "$run_log" } run_update_scenario() { local run_log - run_log="$(mktemp "${TMPDIR:-/tmp}/openclaw-bundled-channel-update.XXXXXX")" + run_log="$(docker_e2e_run_log bundled-channel-update)" echo "Running bundled channel runtime deps Docker update E2E..." if ! timeout "$DOCKER_RUN_TIMEOUT" docker run --rm \ @@ -1479,18 +1480,18 @@ fi echo "bundled channel runtime deps Docker update E2E passed" EOF then - cat "$run_log" + docker_e2e_print_log "$run_log" rm -f "$run_log" exit 1 fi - cat "$run_log" + docker_e2e_print_log "$run_log" rm -f "$run_log" } run_load_failure_scenario() { local run_log - run_log="$(mktemp "${TMPDIR:-/tmp}/openclaw-bundled-channel-load-failure.XXXXXX")" + run_log="$(docker_e2e_run_log bundled-channel-load-failure)" echo "Running bundled channel load-failure isolation Docker E2E..." if ! timeout "$DOCKER_RUN_TIMEOUT" docker run --rm \ @@ -1634,45 +1635,13 @@ NODE echo "bundled channel load-failure isolation Docker E2E passed" EOF then - cat "$run_log" + docker_e2e_print_log "$run_log" rm -f "$run_log" exit 1 fi - cat "$run_log" + docker_e2e_print_log "$run_log" rm -f "$run_log" } -if [ "$RUN_CHANNEL_SCENARIOS" != "0" ]; then - IFS=',' read -r -a CHANNEL_SCENARIOS <<<"${OPENCLAW_BUNDLED_CHANNELS:-${CHANNEL_ONLY:-telegram,discord,slack,feishu,memory-lancedb}}" - for channel_scenario in "${CHANNEL_SCENARIOS[@]}"; do - channel_scenario="${channel_scenario//[[:space:]]/}" - [ -n "$channel_scenario" ] || continue - case "$channel_scenario" in - telegram) run_channel_scenario telegram grammy ;; - discord) run_channel_scenario discord discord-api-types ;; - slack) run_channel_scenario slack @slack/web-api ;; - feishu) run_channel_scenario feishu @larksuiteoapi/node-sdk ;; - memory-lancedb) run_channel_scenario memory-lancedb @lancedb/lancedb ;; - *) - echo "Unsupported OPENCLAW_BUNDLED_CHANNELS entry: $channel_scenario" >&2 - exit 1 - ;; - esac - done -fi -if [ "$RUN_UPDATE_SCENARIO" != "0" ]; then - run_update_scenario -fi -if [ "$RUN_ROOT_OWNED_SCENARIO" != "0" ]; then - run_root_owned_global_scenario -fi -if [ "$RUN_SETUP_ENTRY_SCENARIO" != "0" ]; then - run_setup_entry_scenario -fi -if [ "$RUN_DISABLED_CONFIG_SCENARIO" != "0" ]; then - run_disabled_config_scenario -fi -if [ "$RUN_LOAD_FAILURE_SCENARIO" != "0" ]; then - run_load_failure_scenario -fi +run_bundled_channel_runtime_dep_scenarios diff --git a/scripts/e2e/lib/bundled-channel-runtime-deps-runner.sh b/scripts/e2e/lib/bundled-channel-runtime-deps-runner.sh new file mode 100644 index 00000000000..c5d2ccce18e --- /dev/null +++ b/scripts/e2e/lib/bundled-channel-runtime-deps-runner.sh @@ -0,0 +1,42 @@ +#!/usr/bin/env bash +# +# Scenario selection for bundled plugin runtime-dependency Docker tests. +# The large scenario bodies stay in the owning test script; this helper keeps +# env flag parsing and dispatch in one small, reviewable place. + +run_bundled_channel_runtime_dep_scenarios() { + if [ "$RUN_CHANNEL_SCENARIOS" != "0" ]; then + IFS=',' read -r -a CHANNEL_SCENARIOS <<<"${OPENCLAW_BUNDLED_CHANNELS:-${CHANNEL_ONLY:-telegram,discord,slack,feishu,memory-lancedb}}" + for channel_scenario in "${CHANNEL_SCENARIOS[@]}"; do + channel_scenario="${channel_scenario//[[:space:]]/}" + [ -n "$channel_scenario" ] || continue + case "$channel_scenario" in + telegram) run_channel_scenario telegram grammy ;; + discord) run_channel_scenario discord discord-api-types ;; + slack) run_channel_scenario slack @slack/web-api ;; + feishu) run_channel_scenario feishu @larksuiteoapi/node-sdk ;; + memory-lancedb) run_channel_scenario memory-lancedb @lancedb/lancedb ;; + *) + echo "Unsupported OPENCLAW_BUNDLED_CHANNELS entry: $channel_scenario" >&2 + exit 1 + ;; + esac + done + fi + + if [ "$RUN_UPDATE_SCENARIO" != "0" ]; then + run_update_scenario + fi + if [ "$RUN_ROOT_OWNED_SCENARIO" != "0" ]; then + run_root_owned_global_scenario + fi + if [ "$RUN_SETUP_ENTRY_SCENARIO" != "0" ]; then + run_setup_entry_scenario + fi + if [ "$RUN_DISABLED_CONFIG_SCENARIO" != "0" ]; then + run_disabled_config_scenario + fi + if [ "$RUN_LOAD_FAILURE_SCENARIO" != "0" ]; then + run_load_failure_scenario + fi +} diff --git a/scripts/e2e/npm-onboard-channel-agent-docker.sh b/scripts/e2e/npm-onboard-channel-agent-docker.sh index 891d840eed7..c8f35e5f233 100644 --- a/scripts/e2e/npm-onboard-channel-agent-docker.sh +++ b/scripts/e2e/npm-onboard-channel-agent-docker.sh @@ -39,7 +39,7 @@ prepare_package_tgz docker_e2e_package_mount_args "$PACKAGE_TGZ" docker_e2e_harness_mount_args -run_log="$(mktemp "${TMPDIR:-/tmp}/openclaw-npm-onboard-channel-agent.XXXXXX")" +run_log="$(docker_e2e_run_log npm-onboard-channel-agent)" echo "Running npm tarball onboard/channel/agent Docker E2E ($CHANNEL)..." if ! docker run --rm \ @@ -289,7 +289,7 @@ NODE echo "npm tarball onboard/channel/agent Docker E2E passed for $CHANNEL" EOF then - cat "$run_log" + docker_e2e_print_log "$run_log" rm -f "$run_log" exit 1 fi diff --git a/scripts/lib/docker-e2e-logs.sh b/scripts/lib/docker-e2e-logs.sh index a6944df24dd..de0cb1f2773 100644 --- a/scripts/lib/docker-e2e-logs.sh +++ b/scripts/lib/docker-e2e-logs.sh @@ -1,16 +1,30 @@ #!/usr/bin/env bash +# +# Shared logging helpers for shell-based Docker E2E lanes. +# They centralize temporary log naming and the small success/failure print +# pattern used by Docker scenario scripts. run_logged() { local label="$1" shift local log_file - local tmp_dir="${TMPDIR:-/tmp}" - tmp_dir="${tmp_dir%/}" - log_file="$(mktemp "$tmp_dir/openclaw-${label}.XXXXXX")" + log_file="$(docker_e2e_run_log "$label")" if ! "$@" >"$log_file" 2>&1; then - cat "$log_file" + docker_e2e_print_log "$log_file" rm -f "$log_file" return 1 fi rm -f "$log_file" } + +docker_e2e_run_log() { + local label="$1" + local tmp_dir="${TMPDIR:-/tmp}" + tmp_dir="${tmp_dir%/}" + mktemp "$tmp_dir/openclaw-${label}.XXXXXX" +} + +docker_e2e_print_log() { + local log_file="$1" + cat "$log_file" +} From 6077941d0bd73625e18f159fe3758859d9c1496c Mon Sep 17 00:00:00 2001 From: Peter Steinberger <steipete@gmail.com> Date: Sun, 26 Apr 2026 23:51:44 +0100 Subject: [PATCH 076/418] fix: restart package updates through updated install --- src/cli/update-cli/update-command.test.ts | 56 +++++++++++ src/cli/update-cli/update-command.ts | 111 ++++++++++++++++++++-- 2 files changed, 159 insertions(+), 8 deletions(-) diff --git a/src/cli/update-cli/update-command.test.ts b/src/cli/update-cli/update-command.test.ts index 19de7151d7e..f642463f599 100644 --- a/src/cli/update-cli/update-command.test.ts +++ b/src/cli/update-cli/update-command.test.ts @@ -4,6 +4,10 @@ import { buildGatewayInstallEntrypointCandidates as resolveGatewayInstallEntrypointCandidates, resolveGatewayInstallEntrypoint, } from "../../daemon/gateway-entrypoint.js"; +import { + shouldPrepareUpdatedInstallRestart, + shouldUseLegacyProcessRestartAfterUpdate, +} from "./update-command.js"; describe("resolveGatewayInstallEntrypointCandidates", () => { it("prefers index.js before legacy entry.js", () => { @@ -39,3 +43,55 @@ describe("resolveGatewayInstallEntrypoint", () => { ).resolves.toBe(entryPath); }); }); + +describe("shouldPrepareUpdatedInstallRestart", () => { + it("prepares package update restarts when the service is installed but stopped", () => { + expect( + shouldPrepareUpdatedInstallRestart({ + updateMode: "npm", + serviceInstalled: true, + serviceLoaded: false, + }), + ).toBe(true); + }); + + it("does not install a new service for package updates when no service exists", () => { + expect( + shouldPrepareUpdatedInstallRestart({ + updateMode: "npm", + serviceInstalled: false, + serviceLoaded: false, + }), + ).toBe(false); + }); + + it("keeps non-package updates tied to the loaded service state", () => { + expect( + shouldPrepareUpdatedInstallRestart({ + updateMode: "git", + serviceInstalled: true, + serviceLoaded: false, + }), + ).toBe(false); + expect( + shouldPrepareUpdatedInstallRestart({ + updateMode: "git", + serviceInstalled: true, + serviceLoaded: true, + }), + ).toBe(true); + }); +}); + +describe("shouldUseLegacyProcessRestartAfterUpdate", () => { + it("never restarts package updates through the pre-update process", () => { + expect(shouldUseLegacyProcessRestartAfterUpdate({ updateMode: "npm" })).toBe(false); + expect(shouldUseLegacyProcessRestartAfterUpdate({ updateMode: "pnpm" })).toBe(false); + expect(shouldUseLegacyProcessRestartAfterUpdate({ updateMode: "bun" })).toBe(false); + }); + + it("keeps the in-process restart path for non-package updates", () => { + expect(shouldUseLegacyProcessRestartAfterUpdate({ updateMode: "git" })).toBe(true); + expect(shouldUseLegacyProcessRestartAfterUpdate({ updateMode: "unknown" })).toBe(true); + }); +}); diff --git a/src/cli/update-cli/update-command.ts b/src/cli/update-cli/update-command.ts index 78c243d9c9c..24e5cc4f0ca 100644 --- a/src/cli/update-cli/update-command.ts +++ b/src/cli/update-cli/update-command.ts @@ -17,7 +17,7 @@ import { formatConfigIssueLines } from "../../config/issue-format.js"; import { asResolvedSourceConfig, asRuntimeConfig } from "../../config/materialize.js"; import { resolveGatewayInstallEntrypoint } from "../../daemon/gateway-entrypoint.js"; import { resolveGatewayRestartLogPath } from "../../daemon/restart-logs.js"; -import { resolveGatewayService } from "../../daemon/service.js"; +import { readGatewayServiceState, resolveGatewayService } from "../../daemon/service.js"; import { createLowDiskSpaceWarning } from "../../infra/disk-space.js"; import { runGlobalPackageUpdateSteps } from "../../infra/package-update-steps.js"; import { nodeVersionSatisfiesEngine } from "../../infra/runtime-guard.js"; @@ -133,6 +133,24 @@ function pickUpdateQuip(): string { function isPackageManagerUpdateMode(mode: UpdateRunResult["mode"]): mode is "npm" | "pnpm" | "bun" { return mode === "npm" || mode === "pnpm" || mode === "bun"; } + +export function shouldPrepareUpdatedInstallRestart(params: { + updateMode: UpdateRunResult["mode"]; + serviceInstalled: boolean; + serviceLoaded: boolean; +}): boolean { + if (isPackageManagerUpdateMode(params.updateMode)) { + return params.serviceInstalled; + } + return params.serviceLoaded; +} + +export function shouldUseLegacyProcessRestartAfterUpdate(params: { + updateMode: UpdateRunResult["mode"]; +}): boolean { + return !isPackageManagerUpdateMode(params.updateMode); +} + function formatCommandFailure(stdout: string, stderr: string): string { const detail = (stderr || stdout).trim(); if (!detail) { @@ -267,6 +285,7 @@ async function refreshGatewayServiceEnv(params: { result: UpdateRunResult; jsonMode: boolean; invocationCwd?: string; + env?: NodeJS.ProcessEnv; }): Promise<void> { const args = ["gateway", "install", "--force"]; if (params.jsonMode) { @@ -277,7 +296,7 @@ async function refreshGatewayServiceEnv(params: { if (entrypoint) { const res = await runCommandWithTimeout([resolveNodeRunner(), entrypoint, ...args], { cwd: params.result.root, - env: resolveServiceRefreshEnv(process.env, params.invocationCwd), + env: resolveServiceRefreshEnv(params.env ?? process.env, params.invocationCwd), timeoutMs: SERVICE_REFRESH_TIMEOUT_MS, }); if (res.code === 0) { @@ -288,9 +307,45 @@ async function refreshGatewayServiceEnv(params: { ); } + if (isPackageManagerUpdateMode(params.result.mode)) { + throw new Error( + `updated install entrypoint not found under ${params.result.root ?? "unknown"}`, + ); + } + await runDaemonInstall({ force: true, json: params.jsonMode || undefined }); } +async function runUpdatedInstallGatewayRestart(params: { + result: UpdateRunResult; + jsonMode: boolean; + invocationCwd?: string; + env?: NodeJS.ProcessEnv; +}): Promise<boolean> { + const entrypoint = await resolveGatewayInstallEntrypoint(params.result.root); + if (!entrypoint) { + throw new Error( + `updated install entrypoint not found under ${params.result.root ?? "unknown"}`, + ); + } + + const args = ["gateway", "restart"]; + if (params.jsonMode) { + args.push("--json"); + } + const res = await runCommandWithTimeout([resolveNodeRunner(), entrypoint, ...args], { + cwd: params.result.root, + env: resolveServiceRefreshEnv(params.env ?? process.env, params.invocationCwd), + timeoutMs: SERVICE_REFRESH_TIMEOUT_MS, + }); + if (res.code === 0) { + return true; + } + throw new Error( + `updated install restart failed (${entrypoint}): ${formatCommandFailure(res.stdout, res.stderr)}`, + ); +} + async function tryInstallShellCompletion(opts: { jsonMode: boolean; skipPrompt: boolean; @@ -739,11 +794,26 @@ async function maybeRestartService(params: { result: UpdateRunResult; opts: UpdateCommandOptions; refreshServiceEnv: boolean; + serviceEnv?: NodeJS.ProcessEnv; gatewayPort: number; restartScriptPath?: string | null; invocationCwd?: string; }): Promise<boolean> { const verifyRestartedGateway = async (expectedGatewayVersion: string | undefined) => { + const restartAfterStaleCleanup = async () => { + if (params.refreshServiceEnv && isPackageManagerUpdateMode(params.result.mode)) { + await runUpdatedInstallGatewayRestart({ + result: params.result, + jsonMode: Boolean(params.opts.json), + invocationCwd: params.invocationCwd, + env: params.serviceEnv, + }); + return; + } + if (shouldUseLegacyProcessRestartAfterUpdate({ updateMode: params.result.mode })) { + await runDaemonRestart(); + } + }; const service = resolveGatewayService(); let health = await waitForGatewayHealthyRestart({ service, @@ -759,7 +829,7 @@ async function maybeRestartService(params: { ); } await terminateStaleGatewayPids(health.staleGatewayPids); - await runDaemonRestart(); + await restartAfterStaleCleanup(); health = await waitForGatewayHealthyRestart({ service, port: params.gatewayPort, @@ -799,6 +869,7 @@ async function maybeRestartService(params: { const expectedGatewayVersion = isPackageManagerUpdateMode(params.result.mode) ? normalizeOptionalString(params.result.after?.version) : undefined; + const isPackageUpdate = isPackageManagerUpdateMode(params.result.mode); let restarted = false; let restartInitiated = false; if (params.refreshServiceEnv) { @@ -807,6 +878,7 @@ async function maybeRestartService(params: { result: params.result, jsonMode: Boolean(params.opts.json), invocationCwd: params.invocationCwd, + env: params.serviceEnv, }); } catch (err) { // Always log the refresh failure so callers can detect it (issue #56772). @@ -818,7 +890,7 @@ async function maybeRestartService(params: { } else { defaultRuntime.log(theme.warn(message)); } - if (isPackageManagerUpdateMode(params.result.mode)) { + if (isPackageUpdate) { return false; } } @@ -826,8 +898,17 @@ async function maybeRestartService(params: { if (params.restartScriptPath) { await runRestartScript(params.restartScriptPath); restartInitiated = true; - } else { + } else if (params.refreshServiceEnv && isPackageUpdate) { + restarted = await runUpdatedInstallGatewayRestart({ + result: params.result, + jsonMode: Boolean(params.opts.json), + invocationCwd: params.invocationCwd, + env: params.serviceEnv, + }); + } else if (shouldUseLegacyProcessRestartAfterUpdate({ updateMode: params.result.mode })) { restarted = await runDaemonRestart(); + } else if (!params.opts.json) { + defaultRuntime.log(theme.muted("No installed gateway service found; skipped restart.")); } const shouldVerifyRestart = @@ -871,6 +952,9 @@ async function maybeRestartService(params: { ), ); } + if (isPackageManagerUpdateMode(params.result.mode)) { + return false; + } } return true; } @@ -1419,15 +1503,25 @@ export async function updateCommand(opts: UpdateCommandOptions): Promise<void> { let restartScriptPath: string | null = null; let refreshGatewayServiceEnv = false; + let gatewayServiceEnv: NodeJS.ProcessEnv | undefined; const gatewayPort = resolveGatewayPort( postUpdateConfigSnapshot.valid ? postUpdateConfigSnapshot.config : undefined, process.env, ); if (shouldRestart) { try { - const loaded = await resolveGatewayService().isLoaded({ env: process.env }); - if (loaded) { - restartScriptPath = await prepareRestartScript(process.env, gatewayPort); + const serviceState = await readGatewayServiceState(resolveGatewayService(), { + env: process.env, + }); + if ( + shouldPrepareUpdatedInstallRestart({ + updateMode: resultWithPostUpdate.mode, + serviceInstalled: serviceState.installed, + serviceLoaded: serviceState.loaded, + }) + ) { + gatewayServiceEnv = serviceState.env; + restartScriptPath = await prepareRestartScript(serviceState.env, gatewayPort); refreshGatewayServiceEnv = true; } } catch { @@ -1446,6 +1540,7 @@ export async function updateCommand(opts: UpdateCommandOptions): Promise<void> { result: resultWithPostUpdate, opts, refreshServiceEnv: refreshGatewayServiceEnv, + serviceEnv: gatewayServiceEnv, gatewayPort, restartScriptPath, invocationCwd, From cfe58387a7f574b1c766b458a045d1c98ef10f12 Mon Sep 17 00:00:00 2001 From: Peter Steinberger <steipete@gmail.com> Date: Sun, 26 Apr 2026 23:51:47 +0100 Subject: [PATCH 077/418] docs: update changelog attribution guidance --- AGENTS.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AGENTS.md b/AGENTS.md index d32e8688587..8e1e0d7ab53 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -135,7 +135,7 @@ Telegraph style. Root rules only. Read scoped `AGENTS.md` before subtree work. - Docs change with behavior/API. Use docs list/read_when hints; docs links per `docs/AGENTS.md`. - Changelog user-facing only; pure test/internal usually no entry. -- Changelog placement: active version `### Changes`/`### Fixes`; every added entry must include at least one `Thanks @author` attribution, using credited GitHub username(s). Never add `Thanks @steipete`. +- Changelog placement: active version `### Changes`/`### Fixes`; every added entry must include at least one `Thanks @author` attribution, using credited GitHub username(s). Never add `Thanks @steipete` or `Thanks @codex`. - Changelog bullets are always single-line. No wrapping/continuation across multiple lines. Long entries stay on one long line so dedupe, PR-ref, and credit-audit tooling work and so the visual style stays uniform. ## Git From 1a02d00eb4501cc00218f123d7d125a27f747dc4 Mon Sep 17 00:00:00 2001 From: Peter Steinberger <steipete@gmail.com> Date: Sun, 26 Apr 2026 23:55:57 +0100 Subject: [PATCH 078/418] test: add docker e2e rerun helpers --- package.json | 3 + scripts/check-openclaw-package-tarball.mjs | 35 +++ scripts/check-workflows.mjs | 27 +++ scripts/docker-e2e-rerun.mjs | 259 +++++++++++++++++++++ scripts/docker-e2e-timings.mjs | 130 +++++++++++ scripts/test-docker-all.mjs | 73 ++++++ 6 files changed, 527 insertions(+) create mode 100644 scripts/check-workflows.mjs create mode 100644 scripts/docker-e2e-rerun.mjs create mode 100644 scripts/docker-e2e-timings.mjs diff --git a/package.json b/package.json index c62824334d5..607c298b14d 100644 --- a/package.json +++ b/package.json @@ -1335,6 +1335,7 @@ "check:timed": "node scripts/check-timed.mjs", "check:timed:all-types": "node scripts/check-timed.mjs --include-test-types", "check:timed:architecture": "node scripts/check-timed.mjs --include-architecture", + "check:workflows": "node scripts/check-workflows.mjs", "ci:timings": "node scripts/ci-run-timings.mjs --latest-main", "ci:timings:recent": "node scripts/ci-run-timings.mjs --recent 10", "codex-app-server:protocol:check": "node --import tsx scripts/check-codex-app-server-protocol.ts", @@ -1542,7 +1543,9 @@ "test:docker:plugin-update": "bash scripts/e2e/plugin-update-unchanged-docker.sh", "test:docker:plugins": "bash scripts/e2e/plugins-docker.sh", "test:docker:qr": "bash scripts/e2e/qr-import-docker.sh", + "test:docker:rerun": "node scripts/docker-e2e-rerun.mjs", "test:docker:session-runtime-context": "bash scripts/e2e/session-runtime-context-docker.sh", + "test:docker:timings": "node scripts/docker-e2e-timings.mjs", "test:docker:update-channel-switch": "bash scripts/e2e/update-channel-switch-docker.sh", "test:e2e": "node scripts/run-vitest.mjs run --config test/vitest/vitest.e2e.config.ts", "test:e2e:openshell": "OPENCLAW_E2E_OPENSHELL=1 node scripts/run-vitest.mjs run --config test/vitest/vitest.e2e.config.ts extensions/openshell/src/backend.e2e.test.ts", diff --git a/scripts/check-openclaw-package-tarball.mjs b/scripts/check-openclaw-package-tarball.mjs index e7275e1e61c..bdf62b00ded 100644 --- a/scripts/check-openclaw-package-tarball.mjs +++ b/scripts/check-openclaw-package-tarball.mjs @@ -38,6 +38,20 @@ const normalized = entries.map((entry) => entry.replace(/^package\//u, "")); const entrySet = new Set(normalized); const errors = []; +function readTarEntry(entryPath) { + const candidates = [entryPath, `package/${entryPath}`]; + for (const candidate of candidates) { + const result = spawnSync("tar", ["-xOf", tarball, candidate], { + encoding: "utf8", + stdio: ["ignore", "pipe", "pipe"], + }); + if (result.status === 0) { + return result.stdout; + } + } + return ""; +} + for (const entry of normalized) { if (entry.startsWith("/") || entry.split("/").includes("..")) { errors.push(`unsafe tar entry: ${entry}`); @@ -53,6 +67,27 @@ if (!normalized.some((entry) => entry.startsWith("dist/"))) { if (!entrySet.has("dist/postinstall-inventory.json")) { errors.push("missing dist/postinstall-inventory.json"); } +if (entrySet.has("dist/postinstall-inventory.json")) { + try { + const inventory = JSON.parse(readTarEntry("dist/postinstall-inventory.json")); + if (!Array.isArray(inventory) || inventory.some((entry) => typeof entry !== "string")) { + errors.push("invalid dist/postinstall-inventory.json"); + } else { + for (const inventoryEntry of inventory) { + const normalizedEntry = inventoryEntry.replace(/\\/gu, "/"); + if (!entrySet.has(normalizedEntry)) { + errors.push(`inventory references missing tar entry ${normalizedEntry}`); + } + } + } + } catch (error) { + errors.push( + `unreadable dist/postinstall-inventory.json: ${ + error instanceof Error ? error.message : String(error) + }`, + ); + } +} if (errors.length > 0) { fail(`OpenClaw package tarball integrity failed:\n${errors.join("\n")}`); diff --git a/scripts/check-workflows.mjs b/scripts/check-workflows.mjs new file mode 100644 index 00000000000..36a321e3416 --- /dev/null +++ b/scripts/check-workflows.mjs @@ -0,0 +1,27 @@ +#!/usr/bin/env node +// Runs local workflow sanity checks. +// Uses an installed actionlint when present, otherwise falls back to `go run` +// for the pinned version used by CI, then runs repo-specific composite guards. +import { spawnSync } from "node:child_process"; + +const ACTIONLINT_VERSION = "1.7.11"; + +function commandExists(command) { + return spawnSync("bash", ["-lc", `command -v ${command}`], { stdio: "ignore" }).status === 0; +} + +function run(command, args) { + const result = spawnSync(command, args, { stdio: "inherit" }); + if (result.status !== 0) { + process.exit(result.status ?? 1); + } +} + +if (commandExists("actionlint")) { + run("actionlint", []); +} else { + run("go", ["run", `github.com/rhysd/actionlint/cmd/actionlint@v${ACTIONLINT_VERSION}`]); +} + +run("python3", ["scripts/check-composite-action-input-interpolation.py"]); +run("node", ["scripts/check-no-conflict-markers.mjs"]); diff --git a/scripts/docker-e2e-rerun.mjs b/scripts/docker-e2e-rerun.mjs new file mode 100644 index 00000000000..710cb8194a2 --- /dev/null +++ b/scripts/docker-e2e-rerun.mjs @@ -0,0 +1,259 @@ +#!/usr/bin/env node +// Builds cheap rerun commands from a Docker E2E GitHub run or local summary. +// For GitHub runs, the script downloads Docker E2E artifacts, reads +// summary/failures JSON, and prints targeted workflow commands that prepare a +// fresh OpenClaw tarball for the same ref before running only failed lanes. +import { spawnSync } from "node:child_process"; +import fs from "node:fs"; +import os from "node:os"; +import path from "node:path"; + +const DEFAULT_WORKFLOW = "openclaw-live-and-e2e-checks-reusable.yml"; + +function usage() { + return [ + "Usage:", + " node scripts/docker-e2e-rerun.mjs <run-id|summary.json|failures.json> [--repo owner/repo] [--dir output-dir] [--workflow workflow.yml] [--ref ref]", + ].join("\n"); +} + +function parseArgs(argv) { + const options = { + dir: "", + input: "", + ref: "", + repo: "", + workflow: DEFAULT_WORKFLOW, + }; + for (let index = 0; index < argv.length; index += 1) { + const arg = argv[index]; + if (arg === "--repo") { + options.repo = argv[(index += 1)] ?? ""; + } else if (arg?.startsWith("--repo=")) { + options.repo = arg.slice("--repo=".length); + } else if (arg === "--dir") { + options.dir = argv[(index += 1)] ?? ""; + } else if (arg?.startsWith("--dir=")) { + options.dir = arg.slice("--dir=".length); + } else if (arg === "--workflow") { + options.workflow = argv[(index += 1)] ?? ""; + } else if (arg?.startsWith("--workflow=")) { + options.workflow = arg.slice("--workflow=".length); + } else if (arg === "--ref") { + options.ref = argv[(index += 1)] ?? ""; + } else if (arg?.startsWith("--ref=")) { + options.ref = arg.slice("--ref=".length); + } else if (!options.input) { + options.input = arg; + } else { + throw new Error(`unknown argument: ${arg}\n${usage()}`); + } + } + if (!options.input || !options.workflow) { + throw new Error(usage()); + } + return options; +} + +function run(command, args, options = {}) { + const result = spawnSync(command, args, { + encoding: "utf8", + stdio: options.stdio ?? ["ignore", "pipe", "pipe"], + }); + if (result.status !== 0) { + throw new Error( + `${command} ${args.join(" ")} failed with ${result.status ?? result.signal}\n${result.stderr}`, + ); + } + return result.stdout; +} + +function readJson(file) { + return JSON.parse(fs.readFileSync(file, "utf8")); +} + +function shellQuote(value) { + return `'${String(value).replaceAll("'", "'\\''")}'`; +} + +function ghWorkflowCommand(lanes, ref, workflow) { + return [ + "gh workflow run", + shellQuote(workflow), + "-f", + `ref=${shellQuote(ref)}`, + "-f", + "include_repo_e2e=false", + "-f", + "include_release_path_suites=false", + "-f", + "include_openwebui=false", + "-f", + `docker_lanes=${shellQuote(lanes.join(" "))}`, + "-f", + "include_live_suites=false", + "-f", + "live_models_only=false", + ].join(" "); +} + +function detectRepo() { + return JSON.parse(run("gh", ["repo", "view", "--json", "nameWithOwner"])).nameWithOwner; +} + +function findFiles(rootDir, basenames, out = []) { + for (const entry of fs.readdirSync(rootDir, { withFileTypes: true })) { + const file = path.join(rootDir, entry.name); + if (entry.isDirectory()) { + findFiles(file, basenames, out); + } else if (basenames.has(entry.name)) { + out.push(file); + } + } + return out; +} + +function failedLaneEntriesFromJson(file, ref, workflow) { + const parsed = readJson(file); + const source = path.basename(file); + if (source === "failures.json" && Array.isArray(parsed.lanes)) { + return parsed.lanes + .filter((lane) => lane.name) + .map((lane) => ({ + ghWorkflowCommand: lane.ghWorkflowCommand, + lane: lane.name, + localRerunCommand: lane.rerunCommand, + logFile: lane.logFile, + source: file, + status: lane.status, + })); + } + + const lanes = Array.isArray(parsed.lanes) ? parsed.lanes : []; + return lanes + .filter((lane) => lane.status !== 0 && lane.name) + .map((lane) => ({ + ghWorkflowCommand: ghWorkflowCommand([lane.name], ref, workflow), + lane: lane.name, + localRerunCommand: lane.rerunCommand, + logFile: lane.logFile, + source: file, + status: lane.status, + })); +} + +function mergeByLane(entries) { + const byLane = new Map(); + for (const entry of entries) { + if (!byLane.has(entry.lane)) { + byLane.set(entry.lane, entry); + } + } + return [...byLane.values()].toSorted((left, right) => left.lane.localeCompare(right.lane)); +} + +function downloadDockerArtifacts(runId, repo, outputDir) { + fs.mkdirSync(outputDir, { recursive: true }); + const artifacts = JSON.parse( + run("gh", [ + "api", + `repos/${repo}/actions/runs/${runId}/artifacts?per_page=100`, + "--jq", + ".artifacts", + ]), + ); + const names = artifacts + .filter((artifact) => !artifact.expired && artifact.name.startsWith("docker-e2e-")) + .map((artifact) => artifact.name); + if (names.length === 0) { + throw new Error(`No docker-e2e-* artifacts found for run ${runId}`); + } + for (const name of names) { + run( + "gh", + ["run", "download", String(runId), "--repo", repo, "--name", name, "--dir", outputDir], + { + stdio: "inherit", + }, + ); + } + return names; +} + +function runInfo(runId, repo) { + return JSON.parse( + run("gh", [ + "run", + "view", + String(runId), + "--repo", + repo, + "--json", + "databaseId,headSha,headBranch,status,conclusion,url,workflowName", + ]), + ); +} + +function printEntries(entries, ref, workflow, run) { + if (run) { + console.log(`Run: ${run.url}`); + console.log(`Workflow: ${run.workflowName}`); + } + console.log(`Ref: ${ref}`); + console.log( + "Targeted GitHub reruns prepare a fresh OpenClaw npm tarball for that ref before lane execution.", + ); + if (entries.length === 0) { + console.log("No failed Docker E2E lanes found."); + return; + } + console.log(`Failed lanes: ${entries.map((entry) => entry.lane).join(", ")}`); + console.log(""); + console.log("Combined GitHub rerun:"); + console.log( + ghWorkflowCommand( + entries.map((entry) => entry.lane), + ref, + workflow, + ), + ); + console.log(""); + console.log("Per-lane GitHub reruns:"); + for (const entry of entries) { + console.log( + `- ${entry.lane}: ${entry.ghWorkflowCommand || ghWorkflowCommand([entry.lane], ref, workflow)}`, + ); + } + console.log(""); + console.log("Local rerun starting points:"); + for (const entry of entries) { + if (entry.localRerunCommand) { + console.log(`- ${entry.lane}: ${entry.localRerunCommand}`); + } + } +} + +const options = parseArgs(process.argv.slice(2)); +const isLocalJson = fs.existsSync(options.input) && fs.statSync(options.input).isFile(); +if (isLocalJson) { + const ref = options.ref || process.env.GITHUB_SHA || "HEAD"; + printEntries( + mergeByLane(failedLaneEntriesFromJson(options.input, ref, options.workflow)), + ref, + options.workflow, + ); +} else { + const repo = options.repo || detectRepo(); + const run = runInfo(options.input, repo); + const ref = options.ref || run.headSha || run.headBranch; + const outputDir = + options.dir || path.join(os.tmpdir(), `openclaw-docker-e2e-rerun-${options.input}`); + const artifactNames = downloadDockerArtifacts(options.input, repo, outputDir); + const files = findFiles(outputDir, new Set(["failures.json", "summary.json"])); + const entries = mergeByLane( + files.flatMap((file) => failedLaneEntriesFromJson(file, ref, options.workflow)), + ); + console.log(`Artifacts: ${artifactNames.join(", ")}`); + console.log(`Downloaded: ${outputDir}`); + printEntries(entries, ref, options.workflow, run); +} diff --git a/scripts/docker-e2e-timings.mjs b/scripts/docker-e2e-timings.mjs new file mode 100644 index 00000000000..69babad99be --- /dev/null +++ b/scripts/docker-e2e-timings.mjs @@ -0,0 +1,130 @@ +#!/usr/bin/env node +// Summarizes Docker E2E timing artifacts. +// Accepts scheduler summary.json or lane-timings.json so agents can see the +// slowest lanes and phase critical path before deciding what to rerun. +import fs from "node:fs"; + +function usage() { + return "Usage: node scripts/docker-e2e-timings.mjs <summary.json|lane-timings.json> [--limit N]"; +} + +function parseArgs(argv) { + const options = { file: "", limit: 12 }; + for (let index = 0; index < argv.length; index += 1) { + const arg = argv[index]; + if (arg === "--limit") { + options.limit = Number(argv[(index += 1)] ?? ""); + } else if (arg?.startsWith("--limit=")) { + options.limit = Number(arg.slice("--limit=".length)); + } else if (!options.file) { + options.file = arg; + } else { + throw new Error(`unknown argument: ${arg}\n${usage()}`); + } + } + if (!options.file || !Number.isInteger(options.limit) || options.limit < 1) { + throw new Error(usage()); + } + return options; +} + +function readJson(file) { + return JSON.parse(fs.readFileSync(file, "utf8")); +} + +function seconds(value) { + return typeof value === "number" && Number.isFinite(value) ? value : 0; +} + +function durationBetween(startedAt, finishedAt) { + if (!startedAt || !finishedAt) { + return 0; + } + const started = Date.parse(startedAt); + const finished = Date.parse(finishedAt); + if (!Number.isFinite(started) || !Number.isFinite(finished) || finished < started) { + return 0; + } + return Math.round((finished - started) / 1000); +} + +function summarizeSummary(summary, limit) { + const lanes = (Array.isArray(summary.lanes) ? summary.lanes : []) + .map((lane) => ({ + imageKind: lane.imageKind ?? "", + name: lane.name, + seconds: seconds(lane.elapsedSeconds), + status: lane.status === 0 ? "pass" : `fail ${lane.status}`, + timedOut: lane.timedOut === true, + })) + .filter((lane) => lane.name) + .toSorted((left, right) => right.seconds - left.seconds || left.name.localeCompare(right.name)); + const phases = (Array.isArray(summary.phases) ? summary.phases : []) + .map((phase) => ({ + name: phase.name, + seconds: seconds(phase.elapsedSeconds), + status: phase.status ?? "", + })) + .filter((phase) => phase.name); + const wallSeconds = durationBetween(summary.startedAt, summary.finishedAt); + const totalLaneSeconds = lanes.reduce((total, lane) => total + lane.seconds, 0); + const criticalPathSeconds = + phases.reduce((total, phase) => total + phase.seconds, 0) || + wallSeconds || + lanes[0]?.seconds || + 0; + + console.log(`Status: ${summary.status ?? "unknown"}`); + if (wallSeconds > 0) { + console.log(`Wall seconds: ${wallSeconds}`); + } + console.log(`Lane seconds total: ${totalLaneSeconds}`); + console.log(`Approx critical path seconds: ${criticalPathSeconds}`); + if (wallSeconds > 0 && totalLaneSeconds > 0) { + console.log(`Approx parallelism: ${(totalLaneSeconds / wallSeconds).toFixed(1)}x`); + } + if (phases.length > 0) { + console.log(""); + console.log("Phases:"); + for (const phase of phases.toSorted((left, right) => right.seconds - left.seconds)) { + console.log(`- ${phase.name}: ${phase.seconds}s ${phase.status}`); + } + } + console.log(""); + console.log(`Slowest lanes (top ${Math.min(limit, lanes.length)}):`); + for (const lane of lanes.slice(0, limit)) { + console.log( + `- ${lane.name}: ${lane.seconds}s ${lane.status}${lane.timedOut ? " timeout" : ""}${ + lane.imageKind ? ` image=${lane.imageKind}` : "" + }`, + ); + } +} + +function summarizeTimingStore(store, limit) { + const lanes = Object.entries(store.lanes ?? {}) + .map(([name, lane]) => ({ + name, + seconds: seconds(lane.durationSeconds), + status: lane.status === 0 ? "pass" : `fail ${lane.status}`, + updatedAt: lane.updatedAt ?? "", + })) + .toSorted((left, right) => right.seconds - left.seconds || left.name.localeCompare(right.name)); + console.log(`Updated: ${store.updatedAt ?? "unknown"}`); + console.log(`Known lanes: ${lanes.length}`); + console.log(""); + console.log(`Slowest lanes (top ${Math.min(limit, lanes.length)}):`); + for (const lane of lanes.slice(0, limit)) { + console.log(`- ${lane.name}: ${lane.seconds}s ${lane.status} ${lane.updatedAt}`.trim()); + } +} + +const options = parseArgs(process.argv.slice(2)); +const payload = readJson(options.file); +if (Array.isArray(payload.lanes)) { + summarizeSummary(payload, options.limit); +} else if (payload.lanes && typeof payload.lanes === "object") { + summarizeTimingStore(payload, options.limit); +} else { + throw new Error(`Unsupported Docker E2E timing artifact: ${options.file}`); +} diff --git a/scripts/test-docker-all.mjs b/scripts/test-docker-all.mjs index 4ef804a43e2..c678718284e 100644 --- a/scripts/test-docker-all.mjs +++ b/scripts/test-docker-all.mjs @@ -35,6 +35,7 @@ const DEFAULT_LANE_START_STAGGER_MS = 2_000; const DEFAULT_STATUS_INTERVAL_MS = 30_000; const DEFAULT_PREFLIGHT_RUN_TIMEOUT_MS = 60_000; const DEFAULT_TIMINGS_FILE = path.join(ROOT_DIR, ".artifacts/docker-tests/lane-timings.json"); +const DEFAULT_GITHUB_WORKFLOW = "openclaw-live-and-e2e-checks-reusable.yml"; const cliArgs = new Set(process.argv.slice(2)); for (const arg of cliArgs) { if (arg !== "--plan-json") { @@ -151,6 +152,27 @@ function shellQuote(value) { return `'${String(value).replaceAll("'", "'\\''")}'`; } +function githubWorkflowRerunCommand(laneNames, ref) { + return [ + "gh workflow run", + shellQuote(process.env.OPENCLAW_DOCKER_E2E_WORKFLOW || DEFAULT_GITHUB_WORKFLOW), + "-f", + `ref=${shellQuote(ref)}`, + "-f", + "include_repo_e2e=false", + "-f", + "include_release_path_suites=false", + "-f", + "include_openwebui=false", + "-f", + `docker_lanes=${shellQuote(laneNames.join(" "))}`, + "-f", + "include_live_suites=false", + "-f", + "live_models_only=false", + ].join(" "); +} + function buildLaneRerunCommand(name, baseEnv) { const poolLane = findLaneByName(name); const build = name.startsWith("live-") ? "1" : "0"; @@ -228,12 +250,63 @@ async function writeRunSummary(logDir, summary) { const payload = { ...summary, finishedAt: new Date().toISOString(), + github: { + ref: process.env.GITHUB_REF_NAME || undefined, + repository: process.env.GITHUB_REPOSITORY || undefined, + runId: process.env.GITHUB_RUN_ID || undefined, + runUrl: + process.env.GITHUB_SERVER_URL && process.env.GITHUB_REPOSITORY && process.env.GITHUB_RUN_ID + ? `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}` + : undefined, + sha: process.env.GITHUB_SHA || undefined, + workflow: process.env.GITHUB_WORKFLOW || undefined, + }, version: 1, }; await fs.promises.writeFile(file, `${JSON.stringify(payload, null, 2)}\n`); + await writeFailureIndex(logDir, payload); console.log(`==> Docker run summary: ${file}`); } +async function writeFailureIndex(logDir, summary) { + const ref = summary.github?.sha || summary.github?.ref || process.env.GITHUB_SHA || "HEAD"; + const failures = Array.isArray(summary.failures) + ? summary.failures + : (summary.lanes ?? []).filter((lane) => lane.status !== 0); + const lanes = failures.map((failure) => ({ + ghWorkflowCommand: githubWorkflowRerunCommand([failure.name], ref), + image: failure.image, + imageKind: failure.imageKind, + lane: failure.name, + logFile: failure.logFile, + name: failure.name, + rerunCommand: failure.rerunCommand, + status: failure.status, + timedOut: failure.timedOut, + })); + const failureIndex = { + combinedGhWorkflowCommand: + lanes.length > 0 + ? githubWorkflowRerunCommand( + lanes.map((lane) => lane.lane), + ref, + ) + : undefined, + generatedAt: new Date().toISOString(), + lanes, + note: "Targeted GitHub reruns prepare a fresh OpenClaw npm tarball for the selected ref before lane execution.", + ref, + runUrl: summary.github?.runUrl, + status: summary.status, + version: 1, + workflow: process.env.OPENCLAW_DOCKER_E2E_WORKFLOW || DEFAULT_GITHUB_WORKFLOW, + }; + await fs.promises.writeFile( + path.join(logDir, "failures.json"), + `${JSON.stringify(failureIndex, null, 2)}\n`, + ); +} + function phaseElapsedSeconds(startedAtMs) { return Math.round((Date.now() - startedAtMs) / 1000); } From 1ddf6b4e39c2b15bb84de718d8bc950a58bbca0b Mon Sep 17 00:00:00 2001 From: Peter Steinberger <steipete@gmail.com> Date: Sun, 26 Apr 2026 23:56:00 +0100 Subject: [PATCH 079/418] ci: skip existing docker e2e images --- .../openclaw-live-and-e2e-checks-reusable.yml | 38 +++++++++++++++++-- 1 file changed, 35 insertions(+), 3 deletions(-) diff --git a/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml b/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml index 46e953cd2de..3162a2e842e 100644 --- a/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml +++ b/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml @@ -768,12 +768,44 @@ jobs: username: ${{ github.actor }} password: ${{ github.token }} - - name: Setup Docker builder + - name: Check existing shared Docker E2E images + id: image_exists if: steps.plan.outputs.needs_e2e_image == '1' + shell: bash + run: | + set -euo pipefail + bare_exists=0 + functional_exists=0 + needs_build=0 + + if [[ "${{ steps.plan.outputs.needs_bare_image }}" == "1" ]]; then + if docker manifest inspect "${{ steps.image.outputs.bare_image }}" >/dev/null 2>&1; then + bare_exists=1 + echo "Shared Docker E2E bare image already exists: ${{ steps.image.outputs.bare_image }}" + else + needs_build=1 + fi + fi + + if [[ "${{ steps.plan.outputs.needs_functional_image }}" == "1" ]]; then + if docker manifest inspect "${{ steps.image.outputs.functional_image }}" >/dev/null 2>&1; then + functional_exists=1 + echo "Shared Docker E2E functional image already exists: ${{ steps.image.outputs.functional_image }}" + else + needs_build=1 + fi + fi + + echo "bare_exists=$bare_exists" >> "$GITHUB_OUTPUT" + echo "functional_exists=$functional_exists" >> "$GITHUB_OUTPUT" + echo "needs_build=$needs_build" >> "$GITHUB_OUTPUT" + + - name: Setup Docker builder + if: steps.image_exists.outputs.needs_build == '1' uses: useblacksmith/setup-docker-builder@ac083cc84672d01c60d5e8561d0a939b697de542 # v1 - name: Build and push bare Docker E2E image - if: steps.plan.outputs.needs_bare_image == '1' + if: steps.plan.outputs.needs_bare_image == '1' && steps.image_exists.outputs.bare_exists != '1' uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0 with: context: . @@ -788,7 +820,7 @@ jobs: push: true - name: Build and push functional Docker E2E image - if: steps.plan.outputs.needs_functional_image == '1' + if: steps.plan.outputs.needs_functional_image == '1' && steps.image_exists.outputs.functional_exists != '1' uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0 with: context: . From 2fe11020d283ee1b686857f23eeb81a2790de447 Mon Sep 17 00:00:00 2001 From: Peter Steinberger <steipete@gmail.com> Date: Sun, 26 Apr 2026 23:56:05 +0100 Subject: [PATCH 080/418] refactor(test): split bundled channel docker scenarios --- .../bundled-channel-runtime-deps-docker.sh | 1609 +---------------- scripts/e2e/lib/bundled-channel/channel.sh | 420 +++++ .../lib/bundled-channel/disabled-config.sh | 169 ++ .../e2e/lib/bundled-channel/load-failure.sh | 159 ++ scripts/e2e/lib/bundled-channel/root-owned.sh | 181 ++ .../e2e/lib/bundled-channel/setup-entry.sh | 261 +++ scripts/e2e/lib/bundled-channel/update.sh | 438 +++++ 7 files changed, 1634 insertions(+), 1603 deletions(-) create mode 100644 scripts/e2e/lib/bundled-channel/channel.sh create mode 100644 scripts/e2e/lib/bundled-channel/disabled-config.sh create mode 100644 scripts/e2e/lib/bundled-channel/load-failure.sh create mode 100644 scripts/e2e/lib/bundled-channel/root-owned.sh create mode 100644 scripts/e2e/lib/bundled-channel/setup-entry.sh create mode 100644 scripts/e2e/lib/bundled-channel/update.sh diff --git a/scripts/e2e/bundled-channel-runtime-deps-docker.sh b/scripts/e2e/bundled-channel-runtime-deps-docker.sh index c9a08951dbf..fbe269239a6 100644 --- a/scripts/e2e/bundled-channel-runtime-deps-docker.sh +++ b/scripts/e2e/bundled-channel-runtime-deps-docker.sh @@ -8,6 +8,12 @@ ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" source "$ROOT_DIR/scripts/lib/docker-e2e-image.sh" source "$ROOT_DIR/scripts/lib/docker-e2e-package.sh" source "$ROOT_DIR/scripts/e2e/lib/bundled-channel-runtime-deps-runner.sh" +source "$ROOT_DIR/scripts/e2e/lib/bundled-channel/channel.sh" +source "$ROOT_DIR/scripts/e2e/lib/bundled-channel/root-owned.sh" +source "$ROOT_DIR/scripts/e2e/lib/bundled-channel/setup-entry.sh" +source "$ROOT_DIR/scripts/e2e/lib/bundled-channel/disabled-config.sh" +source "$ROOT_DIR/scripts/e2e/lib/bundled-channel/update.sh" +source "$ROOT_DIR/scripts/e2e/lib/bundled-channel/load-failure.sh" IMAGE_NAME="$(docker_e2e_resolve_image "openclaw-bundled-channel-deps-e2e" OPENCLAW_BUNDLED_CHANNEL_DEPS_E2E_IMAGE)" UPDATE_BASELINE_VERSION="${OPENCLAW_BUNDLED_CHANNEL_UPDATE_BASELINE_VERSION:-2026.4.20}" @@ -40,1608 +46,5 @@ prepare_package_tgz() { prepare_package_tgz docker_e2e_package_mount_args "$PACKAGE_TGZ" -run_channel_scenario() { - local channel="$1" - local dep_sentinel="$2" - local run_log - run_log="$(docker_e2e_run_log "bundled-channel-deps-$channel")" - - echo "Running bundled $channel runtime deps Docker E2E..." - if ! timeout "$DOCKER_RUN_TIMEOUT" docker run --rm \ - -e COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \ - -e OPENCLAW_CHANNEL_UNDER_TEST="$channel" \ - -e OPENCLAW_DEP_SENTINEL="$dep_sentinel" \ - "${DOCKER_E2E_PACKAGE_ARGS[@]}" \ - -i "$IMAGE_NAME" bash -s >"$run_log" 2>&1 <<'EOF' -set -euo pipefail - -export HOME="$(mktemp -d "/tmp/openclaw-bundled-channel-deps.XXXXXX")" -export NPM_CONFIG_PREFIX="$HOME/.npm-global" -export PATH="$NPM_CONFIG_PREFIX/bin:$PATH" -export OPENAI_API_KEY="sk-openclaw-bundled-channel-deps-e2e" -export OPENCLAW_NO_ONBOARD=1 - -TOKEN="bundled-channel-deps-token" -PORT="18789" -CHANNEL="${OPENCLAW_CHANNEL_UNDER_TEST:?missing OPENCLAW_CHANNEL_UNDER_TEST}" -DEP_SENTINEL="${OPENCLAW_DEP_SENTINEL:?missing OPENCLAW_DEP_SENTINEL}" -gateway_pid="" - -terminate_gateways() { - if [ -n "${gateway_pid:-}" ] && kill -0 "$gateway_pid" 2>/dev/null; then - kill "$gateway_pid" 2>/dev/null || true - fi - if command -v pkill >/dev/null 2>&1; then - pkill -TERM -f "[o]penclaw-gateway" 2>/dev/null || true - fi - for _ in $(seq 1 100); do - local alive=0 - if [ -n "${gateway_pid:-}" ] && kill -0 "$gateway_pid" 2>/dev/null; then - alive=1 - fi - if command -v pgrep >/dev/null 2>&1 && pgrep -f "[o]penclaw-gateway" >/dev/null 2>&1; then - alive=1 - fi - [ "$alive" = "0" ] && break - sleep 0.1 - done - if [ -n "${gateway_pid:-}" ] && kill -0 "$gateway_pid" 2>/dev/null; then - kill -KILL "$gateway_pid" 2>/dev/null || true - fi - if command -v pkill >/dev/null 2>&1; then - pkill -KILL -f "[o]penclaw-gateway" 2>/dev/null || true - fi - if [ -n "${gateway_pid:-}" ]; then - wait "$gateway_pid" 2>/dev/null || true - fi -} - -cleanup() { - terminate_gateways -} -trap cleanup EXIT - -echo "Installing mounted OpenClaw package..." -package_tgz="${OPENCLAW_CURRENT_PACKAGE_TGZ:?missing OPENCLAW_CURRENT_PACKAGE_TGZ}" -npm install -g "$package_tgz" --no-fund --no-audit >/tmp/openclaw-install.log 2>&1 - -command -v openclaw >/dev/null -package_root="$(npm root -g)/openclaw" -test -d "$package_root/dist/extensions/telegram" -test -d "$package_root/dist/extensions/discord" -test -d "$package_root/dist/extensions/slack" -test -d "$package_root/dist/extensions/feishu" -test -d "$package_root/dist/extensions/memory-lancedb" - -stage_root() { - printf "%s/.openclaw/plugin-runtime-deps" "$HOME" -} - -find_external_dep_package() { - local dep_path="$1" - find "$(stage_root)" -maxdepth 12 -path "*/node_modules/$dep_path/package.json" -type f -print -quit 2>/dev/null || true -} - -assert_package_dep_absent() { - local channel="$1" - local dep_path="$2" - for candidate in \ - "$package_root/dist/extensions/$channel/node_modules/$dep_path/package.json" \ - "$package_root/dist/extensions/node_modules/$dep_path/package.json" \ - "$package_root/node_modules/$dep_path/package.json"; do - if [ -f "$candidate" ]; then - echo "packaged install should not mutate package tree for $channel: $candidate" >&2 - exit 1 - fi - done -} - -if [ -d "$package_root/dist/extensions/$CHANNEL/node_modules" ]; then - echo "$CHANNEL runtime deps should not be preinstalled in package" >&2 - find "$package_root/dist/extensions/$CHANNEL/node_modules" -maxdepth 2 -type f | head -20 >&2 || true - exit 1 -fi - -write_config() { - local mode="$1" - node - <<'NODE' "$mode" "$TOKEN" "$PORT" -const fs = require("node:fs"); -const path = require("node:path"); - -const mode = process.argv[2]; -const token = process.argv[3]; -const port = Number(process.argv[4]); -const configPath = path.join(process.env.HOME, ".openclaw", "openclaw.json"); -const config = fs.existsSync(configPath) - ? JSON.parse(fs.readFileSync(configPath, "utf8")) - : {}; - -config.gateway = { - ...(config.gateway || {}), - port, - auth: { mode: "token", token }, - controlUi: { enabled: false }, -}; -config.agents = { - ...(config.agents || {}), - defaults: { - ...(config.agents?.defaults || {}), - model: { primary: "openai/gpt-4.1-mini" }, - }, -}; -config.models = { - ...(config.models || {}), - providers: { - ...(config.models?.providers || {}), - openai: { - ...(config.models?.providers?.openai || {}), - apiKey: process.env.OPENAI_API_KEY, - baseUrl: "https://api.openai.com/v1", - models: [], - }, - }, -}; -config.plugins = { - ...(config.plugins || {}), - enabled: true, -}; - -if (mode === "telegram") { - config.channels = { - ...(config.channels || {}), - telegram: { - ...(config.channels?.telegram || {}), - enabled: true, - dmPolicy: "disabled", - groupPolicy: "disabled", - }, - }; -} -if (mode === "discord") { - config.channels = { - ...(config.channels || {}), - discord: { - ...(config.channels?.discord || {}), - enabled: true, - dmPolicy: "disabled", - groupPolicy: "disabled", - }, - }; -} -if (mode === "slack") { - config.channels = { - ...(config.channels || {}), - slack: { - ...(config.channels?.slack || {}), - enabled: true, - }, - }; -} -if (mode === "feishu") { - config.channels = { - ...(config.channels || {}), - feishu: { - ...(config.channels?.feishu || {}), - enabled: true, - }, - }; -} -if (mode === "memory-lancedb") { - config.plugins = { - ...(config.plugins || {}), - enabled: true, - allow: [...new Set([...(config.plugins?.allow || []), "memory-lancedb"])], - slots: { - ...(config.plugins?.slots || {}), - memory: "memory-lancedb", - }, - entries: { - ...(config.plugins?.entries || {}), - "memory-lancedb": { - ...(config.plugins?.entries?.["memory-lancedb"] || {}), - enabled: true, - config: { - ...(config.plugins?.entries?.["memory-lancedb"]?.config || {}), - embedding: { - ...(config.plugins?.entries?.["memory-lancedb"]?.config?.embedding || {}), - apiKey: process.env.OPENAI_API_KEY, - model: "text-embedding-3-small", - }, - dbPath: "~/.openclaw/memory/lancedb-e2e", - autoCapture: false, - autoRecall: false, - }, - }, - }, - }; -} - -fs.mkdirSync(path.dirname(configPath), { recursive: true }); -fs.writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`, "utf8"); -NODE -} - -start_gateway() { - local log_file="$1" - local skip_sidecars="${2:-0}" - : >"$log_file" - if [ "$skip_sidecars" = "1" ]; then - OPENCLAW_SKIP_CHANNELS=1 OPENCLAW_SKIP_PROVIDERS=1 \ - openclaw gateway --port "$PORT" --bind loopback --allow-unconfigured >"$log_file" 2>&1 & - else - openclaw gateway --port "$PORT" --bind loopback --allow-unconfigured >"$log_file" 2>&1 & - fi - gateway_pid="$!" - - # Cold bundled dependency staging can exceed 60s under 10-way Docker aggregate load. - for _ in $(seq 1 1200); do - if grep -Eq "listening on ws://|\\[gateway\\] ready \\(" "$log_file"; then - return 0 - fi - if ! kill -0 "$gateway_pid" 2>/dev/null; then - echo "gateway exited unexpectedly" >&2 - cat "$log_file" >&2 - exit 1 - fi - sleep 0.25 - done - - echo "timed out waiting for gateway" >&2 - cat "$log_file" >&2 - exit 1 -} - -stop_gateway() { - terminate_gateways - gateway_pid="" -} - -wait_for_gateway_health() { - local log_file="${1:-}" - if [ -n "${gateway_pid:-}" ] && kill -0 "$gateway_pid" 2>/dev/null; then - return 0 - fi - echo "gateway process exited after ready marker" >&2 - if [ -n "$log_file" ]; then - cat "$log_file" >&2 - fi - return 1 -} - -assert_channel_status() { - local channel="$1" - if [ "$channel" = "memory-lancedb" ]; then - echo "memory-lancedb plugin activation verified by dependency sentinel" - return 0 - fi - local out="/tmp/openclaw-channel-status-$channel.json" - local err="/tmp/openclaw-channel-status-$channel.err" - for _ in $(seq 1 12); do - if openclaw gateway call channels.status \ - --url "ws://127.0.0.1:$PORT" \ - --token "$TOKEN" \ - --timeout 10000 \ - --json \ - --params '{"probe":false}' >"$out" 2>"$err"; then - break - fi - sleep 2 - done - if [ ! -s "$out" ]; then - if grep -Eq "\\[gateway\\] ready \\(.*\\b$channel\\b" /tmp/openclaw-"$channel"-*.log 2>/dev/null; then - echo "$channel channel plugin visible in gateway ready log" - return 0 - fi - cat "$err" >&2 || true - return 1 - fi - node - <<'NODE' "$out" "$channel" -const fs = require("node:fs"); -const raw = JSON.parse(fs.readFileSync(process.argv[2], "utf8")); -const payload = raw.result ?? raw.data ?? raw; -const channel = process.argv[3]; -const dump = () => JSON.stringify(raw, null, 2).slice(0, 4000); -const hasChannelMeta = Array.isArray(payload.channelMeta) - ? payload.channelMeta.some((entry) => entry?.id === channel) - : Boolean(payload.channelMeta?.[channel]); -if (!hasChannelMeta) { - throw new Error(`missing channelMeta.${channel}\n${dump()}`); -} -if (!payload.channels || !payload.channels[channel]) { - throw new Error(`missing channels.${channel}\n${dump()}`); -} -const accounts = payload.channelAccounts?.[channel]; -if (!Array.isArray(accounts) || accounts.length === 0) { - throw new Error(`missing channelAccounts.${channel}\n${dump()}`); -} -console.log(`${channel} channel plugin visible`); -NODE -} - -assert_installed_once() { - local log_file="$1" - local channel="$2" - local dep_path="$3" - local count - count="$(grep -Ec "\\[plugins\\] $channel installed bundled runtime deps( in [0-9]+ms)?:" "$log_file" || true)" - if [ "$count" -eq 1 ]; then - return 0 - fi - if [ "$count" -eq 0 ] && [ -n "$(find_external_dep_package "$dep_path")" ]; then - return 0 - fi - echo "expected one runtime deps install log or staged dependency sentinel for $channel, got $count log lines" >&2 - cat "$log_file" >&2 - find "$(stage_root)" -maxdepth 12 -type f | sort | head -120 >&2 || true - exit 1 -} - -assert_not_installed() { - local log_file="$1" - local channel="$2" - if grep -Eq "\\[plugins\\] $channel installed bundled runtime deps( in [0-9]+ms)?:" "$log_file"; then - echo "expected no runtime deps reinstall for $channel" >&2 - cat "$log_file" >&2 - exit 1 - fi -} - -assert_dep_sentinel() { - local channel="$1" - local dep_path="$2" - local sentinel - sentinel="$(find_external_dep_package "$dep_path")" - if [ -z "$sentinel" ]; then - echo "missing external dependency sentinel for $channel: $dep_path" >&2 - find "$(stage_root)" -maxdepth 12 -type f | sort | head -120 >&2 || true - exit 1 - fi - assert_package_dep_absent "$channel" "$dep_path" -} - -assert_no_dep_sentinel() { - local channel="$1" - local dep_path="$2" - assert_package_dep_absent "$channel" "$dep_path" - if [ -n "$(find_external_dep_package "$dep_path")" ]; then - echo "external dependency sentinel should be absent before activation for $channel: $dep_path" >&2 - exit 1 - fi -} - -assert_no_install_stage() { - local channel="$1" - local stage="$package_root/dist/extensions/$channel/.openclaw-install-stage" - if [ -e "$stage" ]; then - echo "install stage should be cleaned after activation for $channel" >&2 - find "$stage" -maxdepth 4 -type f | sort | head -80 >&2 || true - exit 1 - fi -} - -echo "Starting baseline gateway with OpenAI configured..." -write_config baseline -start_gateway "/tmp/openclaw-$CHANNEL-baseline.log" 1 -wait_for_gateway_health "/tmp/openclaw-$CHANNEL-baseline.log" -stop_gateway -assert_no_dep_sentinel "$CHANNEL" "$DEP_SENTINEL" - -echo "Enabling $CHANNEL by config edit, then restarting gateway..." -write_config "$CHANNEL" -start_gateway "/tmp/openclaw-$CHANNEL-first.log" -wait_for_gateway_health "/tmp/openclaw-$CHANNEL-first.log" -assert_installed_once "/tmp/openclaw-$CHANNEL-first.log" "$CHANNEL" "$DEP_SENTINEL" -assert_dep_sentinel "$CHANNEL" "$DEP_SENTINEL" -assert_no_install_stage "$CHANNEL" -assert_channel_status "$CHANNEL" -stop_gateway - -echo "Restarting gateway again; $CHANNEL deps must stay installed..." -start_gateway "/tmp/openclaw-$CHANNEL-second.log" -wait_for_gateway_health "/tmp/openclaw-$CHANNEL-second.log" -assert_not_installed "/tmp/openclaw-$CHANNEL-second.log" "$CHANNEL" -assert_no_install_stage "$CHANNEL" -assert_channel_status "$CHANNEL" -stop_gateway - -echo "bundled $CHANNEL runtime deps Docker E2E passed" -EOF - then - docker_e2e_print_log "$run_log" - rm -f "$run_log" - exit 1 - fi - - docker_e2e_print_log "$run_log" - rm -f "$run_log" -} - -run_root_owned_global_scenario() { - local run_log - run_log="$(docker_e2e_run_log bundled-channel-root-owned)" - - echo "Running bundled channel root-owned global install Docker E2E..." - if ! timeout "$DOCKER_RUN_TIMEOUT" docker run --rm --user root \ - -e COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \ - "${DOCKER_E2E_PACKAGE_ARGS[@]}" \ - -i "$IMAGE_NAME" bash -s >"$run_log" 2>&1 <<'EOF' -set -euo pipefail - -export HOME="/root" -export OPENAI_API_KEY="sk-openclaw-bundled-channel-root-owned-e2e" -export OPENCLAW_NO_ONBOARD=1 -export OPENCLAW_PLUGIN_STAGE_DIR="/var/lib/openclaw/plugin-runtime-deps" - -TOKEN="bundled-channel-root-owned-token" -PORT="18791" -CHANNEL="slack" -DEP_SENTINEL="@slack/web-api" -gateway_pid="" - -package_root() { - printf "%s/openclaw" "$(npm root -g)" -} - -cleanup() { - if [ -n "${gateway_pid:-}" ] && kill -0 "$gateway_pid" 2>/dev/null; then - kill "$gateway_pid" 2>/dev/null || true - wait "$gateway_pid" 2>/dev/null || true - fi -} -trap cleanup EXIT - -echo "Installing mounted OpenClaw package into root-owned global npm..." -package_tgz="${OPENCLAW_CURRENT_PACKAGE_TGZ:?missing OPENCLAW_CURRENT_PACKAGE_TGZ}" -npm install -g "$package_tgz" --no-fund --no-audit >/tmp/openclaw-root-owned-install.log 2>&1 - -root="$(package_root)" -test -d "$root/dist/extensions/$CHANNEL" -rm -rf "$root/dist/extensions/$CHANNEL/node_modules" -chmod -R a-w "$root" -mkdir -p "$OPENCLAW_PLUGIN_STAGE_DIR" /home/appuser/.openclaw -chown -R appuser:appuser /home/appuser/.openclaw /var/lib/openclaw - -if runuser -u appuser -- test -w "$root"; then - echo "expected package root to be unwritable for appuser" >&2 - exit 1 -fi - -node - <<'NODE' "$TOKEN" "$PORT" -const fs = require("node:fs"); -const path = require("node:path"); -const token = process.argv[2]; -const port = Number(process.argv[3]); -const configPath = "/home/appuser/.openclaw/openclaw.json"; -const config = { - gateway: { - port, - auth: { mode: "token", token }, - controlUi: { enabled: false }, - }, - agents: { - defaults: { - model: { primary: "openai/gpt-4.1-mini" }, - }, - }, - models: { - providers: { - openai: { - apiKey: process.env.OPENAI_API_KEY, - baseUrl: "https://api.openai.com/v1", - models: [], - }, - }, - }, - plugins: { enabled: true }, - channels: { - slack: { - enabled: true, - botToken: "xoxb-bundled-channel-root-owned-token", - appToken: "xapp-bundled-channel-root-owned-token", - }, - }, -}; -fs.mkdirSync(path.dirname(configPath), { recursive: true }); -fs.writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`, "utf8"); -NODE -chown appuser:appuser /home/appuser/.openclaw/openclaw.json - -start_gateway() { - local log_file="$1" - : >"$log_file" - chown appuser:appuser "$log_file" - runuser -u appuser -- env \ - HOME=/home/appuser \ - OPENAI_API_KEY="$OPENAI_API_KEY" \ - OPENCLAW_NO_ONBOARD=1 \ - OPENCLAW_PLUGIN_STAGE_DIR="$OPENCLAW_PLUGIN_STAGE_DIR" \ - npm_config_cache=/tmp/openclaw-root-owned-npm-cache \ - bash -c 'openclaw gateway --port "$1" --bind loopback --allow-unconfigured >"$2" 2>&1' \ - bash "$PORT" "$log_file" & - gateway_pid="$!" - - # Cold bundled dependency staging can exceed 60s under 10-way Docker aggregate load. - for _ in $(seq 1 1200); do - if grep -Eq "listening on ws://|\\[gateway\\] ready \\(" "$log_file"; then - return 0 - fi - if ! kill -0 "$gateway_pid" 2>/dev/null; then - echo "gateway exited unexpectedly" >&2 - cat "$log_file" >&2 - exit 1 - fi - sleep 0.25 - done - - echo "timed out waiting for gateway" >&2 - cat "$log_file" >&2 - exit 1 -} - -wait_for_slack_provider_start() { - for _ in $(seq 1 180); do - if grep -Eq "\\[slack\\] \\[default\\] starting provider|An API error occurred: invalid_auth|\\[plugins\\] slack installed bundled runtime deps|\\[gateway\\] ready \\(.*\\bslack\\b" /tmp/openclaw-root-owned-gateway.log; then - return 0 - fi - sleep 1 - done - echo "timed out waiting for slack provider startup" >&2 - cat /tmp/openclaw-root-owned-gateway.log >&2 - exit 1 -} - -start_gateway /tmp/openclaw-root-owned-gateway.log -wait_for_slack_provider_start - -if [ -e "$root/dist/extensions/$CHANNEL/node_modules/$DEP_SENTINEL/package.json" ]; then - echo "root-owned package tree was mutated" >&2 - find "$root/dist/extensions/$CHANNEL/node_modules" -maxdepth 4 -type f | sort | head -80 >&2 || true - exit 1 -fi -if ! find "$OPENCLAW_PLUGIN_STAGE_DIR" -maxdepth 12 -path "*/node_modules/$DEP_SENTINEL/package.json" -type f | grep -q .; then - echo "missing external staged dependency sentinel for $DEP_SENTINEL" >&2 - find "$OPENCLAW_PLUGIN_STAGE_DIR" -maxdepth 12 -type f | sort | head -120 >&2 || true - cat /tmp/openclaw-root-owned-gateway.log >&2 - exit 1 -fi -if [ -e "$root/dist/extensions/node_modules/openclaw/package.json" ]; then - echo "root-owned package tree was mutated with SDK alias" >&2 - find "$root/dist/extensions/node_modules/openclaw" -maxdepth 4 -type f | sort | head -80 >&2 || true - exit 1 -fi -if ! find "$OPENCLAW_PLUGIN_STAGE_DIR" -maxdepth 12 -path "*/dist/extensions/node_modules/openclaw/package.json" -type f | grep -q .; then - echo "missing external staged openclaw/plugin-sdk alias" >&2 - find "$OPENCLAW_PLUGIN_STAGE_DIR" -maxdepth 12 -type f | sort | head -120 >&2 || true - cat /tmp/openclaw-root-owned-gateway.log >&2 - exit 1 -fi -if grep -Eq "failed to install bundled runtime deps|Cannot find package 'openclaw'|Cannot find module 'openclaw/plugin-sdk'" /tmp/openclaw-root-owned-gateway.log; then - echo "root-owned gateway hit bundled runtime dependency errors" >&2 - cat /tmp/openclaw-root-owned-gateway.log >&2 - exit 1 -fi - -echo "root-owned global install Docker E2E passed" -EOF - then - docker_e2e_print_log "$run_log" - rm -f "$run_log" - exit 1 - fi - - docker_e2e_print_log "$run_log" - rm -f "$run_log" -} - -run_setup_entry_scenario() { - local run_log - run_log="$(docker_e2e_run_log bundled-channel-setup-entry)" - - echo "Running bundled channel setup-entry runtime deps Docker E2E..." - if ! timeout "$DOCKER_RUN_TIMEOUT" docker run --rm \ - -e COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \ - "${DOCKER_E2E_PACKAGE_ARGS[@]}" \ - -i "$IMAGE_NAME" bash -s >"$run_log" 2>&1 <<'EOF' -set -euo pipefail - -export HOME="$(mktemp -d "/tmp/openclaw-bundled-channel-setup-entry.XXXXXX")" -export NPM_CONFIG_PREFIX="$HOME/.npm-global" -export PATH="$NPM_CONFIG_PREFIX/bin:$PATH" -export OPENCLAW_NO_ONBOARD=1 -export OPENCLAW_PLUGIN_STAGE_DIR="$HOME/.openclaw/plugin-runtime-deps" -mkdir -p "$OPENCLAW_PLUGIN_STAGE_DIR" - -declare -A SETUP_ENTRY_DEP_SENTINELS=( - [feishu]="@larksuiteoapi/node-sdk" - [whatsapp]="@whiskeysockets/baileys" -) - -package_root() { - printf "%s/openclaw" "$(npm root -g)" -} - -echo "Installing mounted OpenClaw package..." -package_tgz="${OPENCLAW_CURRENT_PACKAGE_TGZ:?missing OPENCLAW_CURRENT_PACKAGE_TGZ}" -npm install -g "$package_tgz" --no-fund --no-audit >/tmp/openclaw-setup-entry-install.log 2>&1 - -root="$(package_root)" -for channel in "${!SETUP_ENTRY_DEP_SENTINELS[@]}"; do - dep_sentinel="${SETUP_ENTRY_DEP_SENTINELS[$channel]}" - test -d "$root/dist/extensions/$channel" - if [ -d "$root/dist/extensions/$channel/node_modules" ]; then - echo "$channel runtime deps should not be preinstalled in package" >&2 - find "$root/dist/extensions/$channel/node_modules" -maxdepth 3 -type f | head -40 >&2 || true - exit 1 - fi - if [ -f "$root/node_modules/$dep_sentinel/package.json" ]; then - echo "$dep_sentinel should not be installed at package root before setup-entry load" >&2 - exit 1 - fi -done - -echo "Probing real bundled setup entries before channel configuration..." -( - cd "$root" - node --input-type=module - <<'NODE' -import fs from "node:fs"; -import path from "node:path"; -import { pathToFileURL } from "node:url"; - -const root = process.cwd(); -const distDir = path.join(root, "dist"); -const bundledPath = fs - .readdirSync(distDir) - .filter((entry) => /^bundled-[A-Za-z0-9_-]+\.js$/.test(entry)) - .map((entry) => path.join(distDir, entry)) - .find((entry) => fs.readFileSync(entry, "utf8").includes("src/channels/plugins/bundled.ts")); -if (!bundledPath) { - throw new Error("missing packaged bundled channel loader artifact"); -} -const bundled = await import(pathToFileURL(bundledPath)); -const setupPluginLoader = Object.values(bundled).find( - (value) => typeof value === "function" && value.name === "getBundledChannelSetupPlugin", -); -if (!setupPluginLoader) { - throw new Error("missing packaged getBundledChannelSetupPlugin export"); -} -for (const channel of ["feishu", "whatsapp"]) { - const plugin = setupPluginLoader(channel); - if (!plugin) { - throw new Error(`${channel} setup plugin did not load pre-config`); - } - if (plugin.id !== channel) { - throw new Error(`${channel} setup plugin id mismatch: ${plugin.id}`); - } - console.log(`${channel} setup plugin loaded pre-config`); -} -NODE -) - -for channel in "${!SETUP_ENTRY_DEP_SENTINELS[@]}"; do - dep_sentinel="${SETUP_ENTRY_DEP_SENTINELS[$channel]}" - if [ -e "$root/dist/extensions/$channel/node_modules/$dep_sentinel/package.json" ]; then - echo "setup-entry discovery installed $channel deps into bundled plugin tree before channel configuration" >&2 - exit 1 - fi - if find "$OPENCLAW_PLUGIN_STAGE_DIR" -maxdepth 12 -path "*/node_modules/$dep_sentinel/package.json" -type f | grep -q .; then - echo "setup-entry discovery installed $channel external staged deps before channel configuration" >&2 - find "$OPENCLAW_PLUGIN_STAGE_DIR" -maxdepth 12 -type f | sort | head -160 >&2 || true - exit 1 - fi -done - -echo "Running packaged guided WhatsApp setup; runtime deps should be staged before finalize..." -OPENCLAW_PACKAGE_ROOT="$root" node --input-type=module - <<'NODE' -import path from "node:path"; -import { readdir } from "node:fs/promises"; -import { pathToFileURL } from "node:url"; - -const root = process.env.OPENCLAW_PACKAGE_ROOT; -if (!root) { - throw new Error("missing OPENCLAW_PACKAGE_ROOT"); -} -const distDir = path.join(root, "dist"); -const onboardChannelFiles = (await readdir(distDir)) - .filter((entry) => /^onboard-channels-.*\.js$/.test(entry)) - .sort(); -let setupChannels; -for (const entry of onboardChannelFiles) { - const module = await import(pathToFileURL(path.join(distDir, entry))); - if (typeof module.setupChannels === "function") { - setupChannels = module.setupChannels; - break; - } -} -if (!setupChannels) { - throw new Error( - `could not find packaged setupChannels export in ${JSON.stringify(onboardChannelFiles)}`, - ); -} - -let channelSelectCount = 0; -const notes = []; -const prompter = { - intro: async () => {}, - outro: async () => {}, - note: async (body, title) => { - notes.push({ title, body }); - }, - confirm: async ({ message, initialValue }) => { - if (message === "Link WhatsApp now (QR)?") { - return false; - } - return initialValue ?? true; - }, - select: async ({ message, options }) => { - if (message === "Select a channel") { - channelSelectCount += 1; - return channelSelectCount === 1 ? "whatsapp" : "__done__"; - } - if (message === "Install WhatsApp plugin?") { - if (!options?.some((option) => option.value === "local")) { - throw new Error(`missing bundled local install option: ${JSON.stringify(options)}`); - } - return "local"; - } - if (message === "WhatsApp phone setup") { - return "separate"; - } - if (message === "WhatsApp DM policy") { - return "disabled"; - } - throw new Error(`unexpected select prompt: ${message}`); - }, - multiselect: async ({ message }) => { - throw new Error(`unexpected multiselect prompt: ${message}`); - }, - text: async ({ message }) => { - throw new Error(`unexpected text prompt: ${message}`); - }, -}; -const runtime = { - log: (message) => console.log(message), - error: (message) => console.error(message), -}; - -const result = await setupChannels( - { plugins: { enabled: true } }, - runtime, - prompter, - { - deferStatusUntilSelection: true, - skipConfirm: true, - skipStatusNote: true, - skipDmPolicyPrompt: true, - initialSelection: ["whatsapp"], - }, -); - -if (!result.channels?.whatsapp) { - throw new Error(`WhatsApp setup did not write channel config: ${JSON.stringify(result)}`); -} -console.log("packaged guided WhatsApp setup completed"); -NODE - -if [ -e "$root/dist/extensions/whatsapp/node_modules/@whiskeysockets/baileys/package.json" ]; then - echo "expected guided WhatsApp setup deps to be installed externally, not into bundled plugin tree" >&2 - exit 1 -fi -if ! find "$OPENCLAW_PLUGIN_STAGE_DIR" -maxdepth 12 -path "*/node_modules/@whiskeysockets/baileys/package.json" -type f | grep -q .; then - echo "guided WhatsApp setup did not stage @whiskeysockets/baileys before finalize" >&2 - find "$OPENCLAW_PLUGIN_STAGE_DIR" -maxdepth 12 -type f | sort | head -160 >&2 || true - exit 1 -fi - -echo "Configuring setup-entry channels; doctor should now install bundled runtime deps externally..." -node - <<'NODE' -const fs = require("node:fs"); -const path = require("node:path"); - -const configPath = path.join(process.env.HOME, ".openclaw", "openclaw.json"); -fs.mkdirSync(path.dirname(configPath), { recursive: true }); -const config = fs.existsSync(configPath) - ? JSON.parse(fs.readFileSync(configPath, "utf8")) - : {}; - -config.plugins = { - ...(config.plugins || {}), - enabled: true, -}; -config.channels = { - ...(config.channels || {}), - feishu: { - ...(config.channels?.feishu || {}), - enabled: true, - }, - whatsapp: { - ...(config.channels?.whatsapp || {}), - enabled: true, - }, -}; - -fs.writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`, "utf8"); -NODE - -openclaw doctor --non-interactive >/tmp/openclaw-setup-entry-doctor.log 2>&1 - -for channel in "${!SETUP_ENTRY_DEP_SENTINELS[@]}"; do - dep_sentinel="${SETUP_ENTRY_DEP_SENTINELS[$channel]}" - if [ -e "$root/dist/extensions/$channel/node_modules/$dep_sentinel/package.json" ]; then - echo "expected configured $channel deps to be installed externally, not into bundled plugin tree" >&2 - exit 1 - fi - if ! find "$OPENCLAW_PLUGIN_STAGE_DIR" -maxdepth 12 -path "*/node_modules/$dep_sentinel/package.json" -type f | grep -q .; then - echo "missing external staged dependency sentinel for configured $channel: $dep_sentinel" >&2 - cat /tmp/openclaw-setup-entry-doctor.log >&2 - find "$OPENCLAW_PLUGIN_STAGE_DIR" -maxdepth 12 -type f | sort | head -160 >&2 || true - exit 1 - fi -done - -echo "bundled channel setup-entry runtime deps Docker E2E passed" -EOF - then - docker_e2e_print_log "$run_log" - rm -f "$run_log" - exit 1 - fi - - docker_e2e_print_log "$run_log" - rm -f "$run_log" -} - -run_disabled_config_scenario() { - local run_log - run_log="$(docker_e2e_run_log bundled-channel-disabled-config)" - - echo "Running bundled channel disabled-config runtime deps Docker E2E..." - if ! timeout "$DOCKER_RUN_TIMEOUT" docker run --rm \ - -e COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \ - "${DOCKER_E2E_PACKAGE_ARGS[@]}" \ - -i "$IMAGE_NAME" bash -s >"$run_log" 2>&1 <<'EOF' -set -euo pipefail - -export HOME="$(mktemp -d "/tmp/openclaw-bundled-channel-disabled-config.XXXXXX")" -export NPM_CONFIG_PREFIX="$HOME/.npm-global" -export PATH="$NPM_CONFIG_PREFIX/bin:$PATH" -export OPENCLAW_NO_ONBOARD=1 -export OPENCLAW_PLUGIN_STAGE_DIR="$HOME/.openclaw/plugin-runtime-deps" -mkdir -p "$OPENCLAW_PLUGIN_STAGE_DIR" - -package_root() { - printf "%s/openclaw" "$(npm root -g)" -} - -assert_dep_absent_everywhere() { - local channel="$1" - local dep_path="$2" - local root="$3" - for candidate in \ - "$root/dist/extensions/$channel/node_modules/$dep_path/package.json" \ - "$root/dist/extensions/node_modules/$dep_path/package.json" \ - "$root/node_modules/$dep_path/package.json"; do - if [ -f "$candidate" ]; then - echo "disabled $channel unexpectedly installed $dep_path at $candidate" >&2 - exit 1 - fi - done - - if ! node - <<'NODE' "$OPENCLAW_PLUGIN_STAGE_DIR" "$dep_path" -const fs = require("node:fs"); -const path = require("node:path"); - -const stageDir = process.argv[2]; -const depName = process.argv[3]; -const manifestName = ".openclaw-runtime-deps.json"; -const matches = []; - -function visit(dir) { - let entries; - try { - entries = fs.readdirSync(dir, { withFileTypes: true }); - } catch { - return; - } - for (const entry of entries) { - const fullPath = path.join(dir, entry.name); - if (entry.isDirectory()) { - visit(fullPath); - continue; - } - if (entry.name !== manifestName) { - continue; - } - let parsed; - try { - parsed = JSON.parse(fs.readFileSync(fullPath, "utf8")); - } catch { - continue; - } - const specs = Array.isArray(parsed.specs) ? parsed.specs : []; - for (const spec of specs) { - if (typeof spec === "string" && spec.startsWith(`${depName}@`)) { - matches.push(`${fullPath}: ${spec}`); - } - } - } -} - -visit(stageDir); -if (matches.length > 0) { - process.stderr.write(`${matches.join("\n")}\n`); - process.exit(1); -} -NODE - then - echo "disabled $channel unexpectedly selected $dep_path for external runtime deps" >&2 - cat /tmp/openclaw-disabled-config-doctor.log >&2 - exit 1 - fi -} - -echo "Installing mounted OpenClaw package..." -package_tgz="${OPENCLAW_CURRENT_PACKAGE_TGZ:?missing OPENCLAW_CURRENT_PACKAGE_TGZ}" -npm install -g "$package_tgz" --no-fund --no-audit >/tmp/openclaw-disabled-config-install.log 2>&1 - -root="$(package_root)" -test -d "$root/dist/extensions/telegram" -test -d "$root/dist/extensions/discord" -test -d "$root/dist/extensions/slack" -rm -rf "$root/dist/extensions/telegram/node_modules" -rm -rf "$root/dist/extensions/discord/node_modules" -rm -rf "$root/dist/extensions/slack/node_modules" - -node - <<'NODE' -const fs = require("node:fs"); -const path = require("node:path"); - -const configPath = path.join(process.env.HOME, ".openclaw", "openclaw.json"); -const config = { - plugins: { - enabled: true, - entries: { - discord: { enabled: false }, - }, - }, - channels: { - telegram: { - enabled: false, - botToken: "123456:disabled-config-token", - dmPolicy: "disabled", - groupPolicy: "disabled", - }, - slack: { - enabled: false, - botToken: "xoxb-disabled-config-token", - appToken: "xapp-disabled-config-token", - }, - discord: { - enabled: true, - token: "disabled-plugin-entry-token", - dmPolicy: "disabled", - groupPolicy: "disabled", - }, - }, -}; -fs.mkdirSync(path.dirname(configPath), { recursive: true }); -fs.writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`, "utf8"); -NODE - -if ! openclaw doctor --non-interactive >/tmp/openclaw-disabled-config-doctor.log 2>&1; then - echo "doctor failed for disabled-config runtime deps smoke" >&2 - cat /tmp/openclaw-disabled-config-doctor.log >&2 - exit 1 -fi - -assert_dep_absent_everywhere telegram grammy "$root" -assert_dep_absent_everywhere slack @slack/web-api "$root" -assert_dep_absent_everywhere discord discord-api-types "$root" - -if grep -Eq "(used by .*\\b(telegram|slack|discord)\\b|\\[plugins\\] (telegram|slack|discord) installed bundled runtime deps( in [0-9]+ms)?:)" /tmp/openclaw-disabled-config-doctor.log; then - echo "doctor installed runtime deps for an explicitly disabled channel/plugin" >&2 - cat /tmp/openclaw-disabled-config-doctor.log >&2 - exit 1 -fi - -echo "bundled channel disabled-config runtime deps Docker E2E passed" -EOF - then - docker_e2e_print_log "$run_log" - rm -f "$run_log" - exit 1 - fi - - docker_e2e_print_log "$run_log" - rm -f "$run_log" -} - -run_update_scenario() { - local run_log - run_log="$(docker_e2e_run_log bundled-channel-update)" - - echo "Running bundled channel runtime deps Docker update E2E..." - if ! timeout "$DOCKER_RUN_TIMEOUT" docker run --rm \ - -e COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \ - -e OPENCLAW_BUNDLED_CHANNEL_UPDATE_BASELINE_VERSION="$UPDATE_BASELINE_VERSION" \ - -e "OPENCLAW_BUNDLED_CHANNEL_UPDATE_TARGETS=${OPENCLAW_BUNDLED_CHANNEL_UPDATE_TARGETS:-telegram,discord,slack,feishu,memory-lancedb,acpx}" \ - "${DOCKER_E2E_PACKAGE_ARGS[@]}" \ - -i "$IMAGE_NAME" bash -s >"$run_log" 2>&1 <<'EOF' -set -euo pipefail - -export HOME="$(mktemp -d "/tmp/openclaw-bundled-channel-update.XXXXXX")" -export NPM_CONFIG_PREFIX="$HOME/.npm-global" -export PATH="$NPM_CONFIG_PREFIX/bin:$PATH" -export OPENAI_API_KEY="sk-openclaw-bundled-channel-update-e2e" -export OPENCLAW_NO_ONBOARD=1 -export OPENCLAW_UPDATE_PACKAGE_SPEC="" - -TOKEN="bundled-channel-update-token" -PORT="18790" -UPDATE_TARGETS="${OPENCLAW_BUNDLED_CHANNEL_UPDATE_TARGETS:-telegram,discord,slack,feishu,memory-lancedb,acpx}" - -package_root() { - printf "%s/openclaw" "$(npm root -g)" -} - -stage_root() { - printf "%s/.openclaw/plugin-runtime-deps" "$HOME" -} - -poison_home_npm_project() { - printf '{"name":"openclaw-home-prefix-poison","private":true}\n' >"$HOME/package.json" - rm -rf "$HOME/node_modules" - mkdir -p "$HOME/node_modules" - chmod 500 "$HOME/node_modules" -} - -find_external_dep_package() { - local dep_path="$1" - find "$(stage_root)" -maxdepth 12 -path "*/node_modules/$dep_path/package.json" -type f -print -quit 2>/dev/null || true -} - -assert_no_unknown_stage_roots() { - if find "$(stage_root)" -maxdepth 1 -type d -name 'openclaw-unknown-*' -print -quit 2>/dev/null | grep -q .; then - echo "runtime deps created second-generation unknown stage roots" >&2 - find "$(stage_root)" -maxdepth 1 -type d -name 'openclaw-*' -print | sort >&2 || true - exit 1 - fi -} - -package_tgz="${OPENCLAW_CURRENT_PACKAGE_TGZ:?missing OPENCLAW_CURRENT_PACKAGE_TGZ}" -update_target="file:$package_tgz" -candidate_version="$(node - <<'NODE' "$package_tgz" -const { execFileSync } = require("node:child_process"); -const raw = execFileSync("tar", ["-xOf", process.argv[2], "package/package.json"], { - encoding: "utf8", -}); -process.stdout.write(String(JSON.parse(raw).version)); -NODE -)" - -write_config() { - local mode="$1" - node - <<'NODE' "$mode" "$TOKEN" "$PORT" -const fs = require("node:fs"); -const path = require("node:path"); - -const mode = process.argv[2]; -const token = process.argv[3]; -const port = Number(process.argv[4]); -const configPath = path.join(process.env.HOME, ".openclaw", "openclaw.json"); -const config = fs.existsSync(configPath) - ? JSON.parse(fs.readFileSync(configPath, "utf8")) - : {}; - -config.gateway = { - ...(config.gateway || {}), - port, - auth: { mode: "token", token }, - controlUi: { enabled: false }, -}; -config.agents = { - ...(config.agents || {}), - defaults: { - ...(config.agents?.defaults || {}), - model: { primary: "openai/gpt-4.1-mini" }, - }, -}; -config.models = { - ...(config.models || {}), - providers: { - ...(config.models?.providers || {}), - openai: { - ...(config.models?.providers?.openai || {}), - apiKey: process.env.OPENAI_API_KEY, - baseUrl: "https://api.openai.com/v1", - models: [], - }, - }, -}; -config.plugins = { - ...(config.plugins || {}), - enabled: true, -}; -config.channels = { - ...(config.channels || {}), - telegram: { - ...(config.channels?.telegram || {}), - enabled: mode === "telegram", - botToken: "123456:bundled-channel-update-token", - dmPolicy: "disabled", - groupPolicy: "disabled", - }, - discord: { - ...(config.channels?.discord || {}), - enabled: mode === "discord", - dmPolicy: "disabled", - groupPolicy: "disabled", - }, - slack: { - ...(config.channels?.slack || {}), - enabled: mode === "slack", - botToken: "xoxb-bundled-channel-update-token", - appToken: "xapp-bundled-channel-update-token", - }, - feishu: { - ...(config.channels?.feishu || {}), - enabled: mode === "feishu", - }, -}; -if (mode === "memory-lancedb") { - config.plugins = { - ...(config.plugins || {}), - enabled: true, - allow: [...new Set([...(config.plugins?.allow || []), "memory-lancedb"])], - slots: { - ...(config.plugins?.slots || {}), - memory: "memory-lancedb", - }, - entries: { - ...(config.plugins?.entries || {}), - "memory-lancedb": { - ...(config.plugins?.entries?.["memory-lancedb"] || {}), - enabled: true, - config: { - ...(config.plugins?.entries?.["memory-lancedb"]?.config || {}), - embedding: { - ...(config.plugins?.entries?.["memory-lancedb"]?.config?.embedding || {}), - apiKey: process.env.OPENAI_API_KEY, - model: "text-embedding-3-small", - }, - dbPath: "~/.openclaw/memory/lancedb-update-e2e", - autoCapture: false, - autoRecall: false, - }, - }, - }, - }; -} -if (mode === "acpx") { - config.plugins = { - ...(config.plugins || {}), - enabled: true, - allow: - Array.isArray(config.plugins?.allow) && config.plugins.allow.length > 0 - ? [...new Set([...config.plugins.allow, "acpx"])] - : config.plugins?.allow, - entries: { - ...(config.plugins?.entries || {}), - acpx: { - ...(config.plugins?.entries?.acpx || {}), - enabled: true, - }, - }, - }; -} - -fs.mkdirSync(path.dirname(configPath), { recursive: true }); -fs.writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`, "utf8"); -NODE -} - -assert_dep_sentinel() { - local channel="$1" - local dep_path="$2" - local root - local sentinel - root="$(package_root)" - sentinel="$(find_external_dep_package "$dep_path")" - if [ -z "$sentinel" ]; then - echo "missing external dependency sentinel for $channel: $dep_path" >&2 - find "$(stage_root)" -maxdepth 12 -type f | sort | head -120 >&2 || true - exit 1 - fi - assert_no_package_dep_available "$channel" "$dep_path" "$root" -} - -assert_no_dep_sentinel() { - local channel="$1" - local dep_path="$2" - local root - root="$(package_root)" - assert_no_package_dep_available "$channel" "$dep_path" "$root" - if [ -n "$(find_external_dep_package "$dep_path")" ]; then - echo "external dependency sentinel should be absent before repair for $channel: $dep_path" >&2 - exit 1 - fi -} - -assert_no_package_dep_available() { - local channel="$1" - local dep_path="$2" - local root="$3" - for candidate in \ - "$root/dist/extensions/$channel/node_modules/$dep_path/package.json" \ - "$root/dist/extensions/node_modules/$dep_path/package.json" \ - "$root/node_modules/$dep_path/package.json"; do - if [ -f "$candidate" ]; then - echo "packaged install should not mutate package tree for $channel: $candidate" >&2 - exit 1 - fi - done - if [ -f "$HOME/node_modules/$dep_path/package.json" ]; then - echo "bundled runtime deps should not use HOME npm project for $channel: $HOME/node_modules/$dep_path/package.json" >&2 - exit 1 - fi -} - -assert_dep_available() { - local channel="$1" - local dep_path="$2" - local root - local sentinel - root="$(package_root)" - sentinel="$(find_external_dep_package "$dep_path")" - if [ -n "$sentinel" ]; then - assert_no_package_dep_available "$channel" "$dep_path" "$root" - return 0 - fi - echo "missing dependency sentinel for $channel: $dep_path" >&2 - find "$root/dist/extensions/$channel" -maxdepth 3 -type f | sort | head -80 >&2 || true - find "$root/node_modules" -maxdepth 3 -path "*/$dep_path/package.json" -type f -print >&2 || true - find "$(stage_root)" -maxdepth 12 -type f | sort | head -120 >&2 || true - exit 1 -} - -assert_no_dep_available() { - local channel="$1" - local dep_path="$2" - local root - root="$(package_root)" - assert_no_package_dep_available "$channel" "$dep_path" "$root" - if [ -n "$(find_external_dep_package "$dep_path")" ]; then - echo "dependency sentinel should be absent before repair for $channel: $dep_path" >&2 - exit 1 - fi -} - -remove_runtime_dep() { - local channel="$1" - local dep_path="$2" - local root - root="$(package_root)" - rm -rf "$root/dist/extensions/$channel/node_modules" - rm -rf "$root/dist/extensions/node_modules/$dep_path" - rm -rf "$root/node_modules/$dep_path" - rm -rf "$(stage_root)" -} - -assert_update_ok() { - local json_file="$1" - local expected_before="$2" - node - <<'NODE' "$json_file" "$expected_before" "$candidate_version" -const fs = require("node:fs"); -const payload = JSON.parse(fs.readFileSync(process.argv[2], "utf8")); -const expectedBefore = process.argv[3]; -const expectedAfter = process.argv[4]; -if (payload.status !== "ok") { - throw new Error(`expected update status ok, got ${JSON.stringify(payload.status)}`); -} -if (expectedBefore && (payload.before?.version ?? null) !== expectedBefore) { - throw new Error( - `expected before.version ${expectedBefore}, got ${JSON.stringify(payload.before?.version)}`, - ); -} -if ((payload.after?.version ?? null) !== expectedAfter) { - throw new Error( - `expected after.version ${expectedAfter}, got ${JSON.stringify(payload.after?.version)}`, - ); -} -const steps = Array.isArray(payload.steps) ? payload.steps : []; -const doctor = steps.find((step) => step?.name === "openclaw doctor"); -if (!doctor) { - throw new Error("missing openclaw doctor step"); -} -if (Number(doctor.exitCode ?? 1) !== 0) { - throw new Error(`openclaw doctor step failed: ${JSON.stringify(doctor)}`); -} -NODE -} - -run_update_and_capture() { - local label="$1" - local out_file="$2" - set +e - openclaw update --tag "$update_target" --yes --json >"$out_file" 2>"/tmp/openclaw-$label-update.stderr" - local status=$? - set -e - if [ "$status" -ne 0 ]; then - echo "openclaw update failed for $label with exit code $status" >&2 - cat "$out_file" >&2 || true - cat "/tmp/openclaw-$label-update.stderr" >&2 || true - exit "$status" - fi -} - -should_run_update_target() { - local target="$1" - case ",$UPDATE_TARGETS," in - *",all,"* | *",$target,"*) return 0 ;; - *) return 1 ;; - esac -} - -echo "Installing current candidate as update baseline..." -echo "Update targets: $UPDATE_TARGETS" -npm install -g "$package_tgz" --no-fund --no-audit >/tmp/openclaw-update-baseline-install.log 2>&1 -command -v openclaw >/dev/null -poison_home_npm_project -baseline_root="$(package_root)" -test -d "$baseline_root/dist/extensions/telegram" -test -d "$baseline_root/dist/extensions/feishu" -test -d "$baseline_root/dist/extensions/acpx" - -if should_run_update_target telegram; then - echo "Replicating configured Telegram missing-runtime state..." - write_config telegram - assert_no_dep_available telegram grammy - set +e - openclaw doctor --non-interactive >/tmp/openclaw-baseline-doctor.log 2>&1 - baseline_doctor_status=$? - set -e - echo "baseline doctor exited with $baseline_doctor_status" - remove_runtime_dep telegram grammy - assert_no_dep_available telegram grammy - - echo "Updating from baseline to current candidate; candidate doctor must repair Telegram deps..." - run_update_and_capture telegram /tmp/openclaw-update-telegram.json - cat /tmp/openclaw-update-telegram.json - assert_update_ok /tmp/openclaw-update-telegram.json "$candidate_version" - assert_dep_available telegram grammy - assert_no_unknown_stage_roots - - echo "Mutating installed package: remove Telegram deps, then update-mode doctor repairs them..." - remove_runtime_dep telegram grammy - assert_no_dep_available telegram grammy - if ! OPENCLAW_UPDATE_IN_PROGRESS=1 openclaw doctor --non-interactive >/tmp/openclaw-update-mode-doctor.log 2>&1; then - echo "update-mode doctor failed while repairing Telegram deps" >&2 - cat /tmp/openclaw-update-mode-doctor.log >&2 - exit 1 - fi - assert_dep_available telegram grammy - assert_no_unknown_stage_roots -fi - -if should_run_update_target discord; then - echo "Mutating config to Discord and rerunning same-version update path..." - write_config discord - remove_runtime_dep discord discord-api-types - assert_no_dep_available discord discord-api-types - run_update_and_capture discord /tmp/openclaw-update-discord.json - cat /tmp/openclaw-update-discord.json - assert_update_ok /tmp/openclaw-update-discord.json "$candidate_version" - assert_dep_available discord discord-api-types -fi - -if should_run_update_target slack; then - echo "Mutating config to Slack and rerunning same-version update path..." - write_config slack - remove_runtime_dep slack @slack/web-api - assert_no_dep_available slack @slack/web-api - run_update_and_capture slack /tmp/openclaw-update-slack.json - cat /tmp/openclaw-update-slack.json - assert_update_ok /tmp/openclaw-update-slack.json "$candidate_version" - assert_dep_available slack @slack/web-api -fi - -if should_run_update_target feishu; then - echo "Mutating config to Feishu and rerunning same-version update path..." - write_config feishu - remove_runtime_dep feishu @larksuiteoapi/node-sdk - assert_no_dep_available feishu @larksuiteoapi/node-sdk - run_update_and_capture feishu /tmp/openclaw-update-feishu.json - cat /tmp/openclaw-update-feishu.json - assert_update_ok /tmp/openclaw-update-feishu.json "$candidate_version" - assert_dep_available feishu @larksuiteoapi/node-sdk -fi - -if should_run_update_target memory-lancedb; then - echo "Mutating config to memory-lancedb and rerunning same-version update path..." - write_config memory-lancedb - remove_runtime_dep memory-lancedb @lancedb/lancedb - assert_no_dep_available memory-lancedb @lancedb/lancedb - run_update_and_capture memory-lancedb /tmp/openclaw-update-memory-lancedb.json - cat /tmp/openclaw-update-memory-lancedb.json - assert_update_ok /tmp/openclaw-update-memory-lancedb.json "$candidate_version" - assert_dep_available memory-lancedb @lancedb/lancedb -fi - -if should_run_update_target acpx; then - echo "Removing ACPX runtime package and rerunning same-version update path..." - write_config acpx - remove_runtime_dep acpx acpx - assert_no_dep_available acpx acpx - run_update_and_capture acpx /tmp/openclaw-update-acpx.json - cat /tmp/openclaw-update-acpx.json - assert_update_ok /tmp/openclaw-update-acpx.json "$candidate_version" - assert_dep_available acpx acpx -fi - -echo "bundled channel runtime deps Docker update E2E passed" -EOF - then - docker_e2e_print_log "$run_log" - rm -f "$run_log" - exit 1 - fi - - docker_e2e_print_log "$run_log" - rm -f "$run_log" -} - -run_load_failure_scenario() { - local run_log - run_log="$(docker_e2e_run_log bundled-channel-load-failure)" - - echo "Running bundled channel load-failure isolation Docker E2E..." - if ! timeout "$DOCKER_RUN_TIMEOUT" docker run --rm \ - -e COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \ - "${DOCKER_E2E_PACKAGE_ARGS[@]}" \ - -i "$IMAGE_NAME" bash -s >"$run_log" 2>&1 <<'EOF' -set -euo pipefail - -export HOME="$(mktemp -d "/tmp/openclaw-bundled-channel-load-failure.XXXXXX")" -export NPM_CONFIG_PREFIX="$HOME/.npm-global" -export PATH="$NPM_CONFIG_PREFIX/bin:$PATH" -export OPENCLAW_NO_ONBOARD=1 - -package_root() { - printf "%s/openclaw" "$(npm root -g)" -} - -echo "Installing mounted OpenClaw package..." -package_tgz="${OPENCLAW_CURRENT_PACKAGE_TGZ:?missing OPENCLAW_CURRENT_PACKAGE_TGZ}" -npm install -g "$package_tgz" --no-fund --no-audit >/tmp/openclaw-load-failure-install.log 2>&1 - -root="$(package_root)" -plugin_dir="$root/dist/extensions/load-failure-alpha" -mkdir -p "$plugin_dir" -cat >"$plugin_dir/package.json" <<'JSON' -{ - "name": "@openclaw/load-failure-alpha", - "version": "2026.4.21", - "private": true, - "type": "module", - "openclaw": { - "extensions": ["./index.js"], - "setupEntry": "./setup-entry.js" - } -} -JSON -cat >"$plugin_dir/openclaw.plugin.json" <<'JSON' -{ - "id": "load-failure-alpha", - "channels": ["load-failure-alpha"], - "configSchema": { - "type": "object", - "additionalProperties": false, - "properties": {} - } -} -JSON -cat >"$plugin_dir/index.js" <<'JS' -export default { - kind: "bundled-channel-entry", - id: "load-failure-alpha", - name: "Load Failure Alpha", - description: "Load Failure Alpha", - register() {}, - loadChannelSecrets() { - globalThis.__loadFailureSecrets = (globalThis.__loadFailureSecrets ?? 0) + 1; - throw new Error("synthetic channel secrets failure"); - }, - loadChannelPlugin() { - globalThis.__loadFailurePlugin = (globalThis.__loadFailurePlugin ?? 0) + 1; - throw new Error("synthetic channel plugin failure"); - } -}; -JS -cat >"$plugin_dir/setup-entry.js" <<'JS' -export default { - kind: "bundled-channel-setup-entry", - loadSetupSecrets() { - globalThis.__loadFailureSetupSecrets = (globalThis.__loadFailureSetupSecrets ?? 0) + 1; - throw new Error("synthetic setup secrets failure"); - }, - loadSetupPlugin() { - globalThis.__loadFailureSetup = (globalThis.__loadFailureSetup ?? 0) + 1; - throw new Error("synthetic setup plugin failure"); - } -}; -JS - -echo "Loading synthetic failing bundled channel through packaged loader..." -( - cd "$root" - OPENCLAW_BUNDLED_PLUGINS_DIR="$root/dist/extensions" node --input-type=module - <<'NODE' -import fs from "node:fs"; -import path from "node:path"; -import { pathToFileURL } from "node:url"; - -const root = process.cwd(); -const distDir = path.join(root, "dist"); -const bundledPath = fs - .readdirSync(distDir) - .filter((entry) => /^bundled-[A-Za-z0-9_-]+\.js$/.test(entry)) - .map((entry) => path.join(distDir, entry)) - .find((entry) => fs.readFileSync(entry, "utf8").includes("src/channels/plugins/bundled.ts")); -if (!bundledPath) { - throw new Error("missing packaged bundled channel loader artifact"); -} -const bundled = await import(pathToFileURL(bundledPath)); -const oneArgExports = Object.entries(bundled).filter( - ([, value]) => typeof value === "function" && value.length === 1, -); -if (oneArgExports.length === 0) { - throw new Error(`missing one-argument bundled loader exports; exports=${Object.keys(bundled).join(",")}`); -} - -const id = "load-failure-alpha"; -for (let i = 0; i < 2; i += 1) { - for (const [name, fn] of oneArgExports) { - try { - fn(id); - } catch (error) { - const message = error instanceof Error ? error.message : String(error); - if (message.includes("synthetic")) { - throw new Error(`bundled export ${name} leaked synthetic load failure: ${message}`); - } - } - } -} - -const counts = { - plugin: globalThis.__loadFailurePlugin, - setup: globalThis.__loadFailureSetup, - secrets: globalThis.__loadFailureSecrets, - setupSecrets: globalThis.__loadFailureSetupSecrets, -}; -for (const [key, value] of Object.entries({ - plugin: counts.plugin, - setup: counts.setup, - setupSecrets: counts.setupSecrets, -})) { - if (value !== 1) { - throw new Error(`expected ${key} failure to be cached after one load, got ${value}`); - } -} -if (counts.secrets !== undefined && counts.secrets !== 1) { - throw new Error(`expected secrets failure to be cached after one load when exercised, got ${counts.secrets}`); -} -console.log("synthetic bundled channel load failures were isolated and cached"); -NODE -) - -echo "bundled channel load-failure isolation Docker E2E passed" -EOF - then - docker_e2e_print_log "$run_log" - rm -f "$run_log" - exit 1 - fi - - docker_e2e_print_log "$run_log" - rm -f "$run_log" -} run_bundled_channel_runtime_dep_scenarios diff --git a/scripts/e2e/lib/bundled-channel/channel.sh b/scripts/e2e/lib/bundled-channel/channel.sh new file mode 100644 index 00000000000..a9c1e7a3a53 --- /dev/null +++ b/scripts/e2e/lib/bundled-channel/channel.sh @@ -0,0 +1,420 @@ +#!/usr/bin/env bash +# +# Runs one bundled plugin channel runtime-dependency scenario. +# Sourced by scripts/e2e/bundled-channel-runtime-deps-docker.sh. + +run_channel_scenario() { + local channel="$1" + local dep_sentinel="$2" + local run_log + run_log="$(docker_e2e_run_log "bundled-channel-deps-$channel")" + + echo "Running bundled $channel runtime deps Docker E2E..." + if ! timeout "$DOCKER_RUN_TIMEOUT" docker run --rm \ + -e COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \ + -e OPENCLAW_CHANNEL_UNDER_TEST="$channel" \ + -e OPENCLAW_DEP_SENTINEL="$dep_sentinel" \ + "${DOCKER_E2E_PACKAGE_ARGS[@]}" \ + -i "$IMAGE_NAME" bash -s >"$run_log" 2>&1 <<'EOF' +set -euo pipefail + +export HOME="$(mktemp -d "/tmp/openclaw-bundled-channel-deps.XXXXXX")" +export NPM_CONFIG_PREFIX="$HOME/.npm-global" +export PATH="$NPM_CONFIG_PREFIX/bin:$PATH" +export OPENAI_API_KEY="sk-openclaw-bundled-channel-deps-e2e" +export OPENCLAW_NO_ONBOARD=1 + +TOKEN="bundled-channel-deps-token" +PORT="18789" +CHANNEL="${OPENCLAW_CHANNEL_UNDER_TEST:?missing OPENCLAW_CHANNEL_UNDER_TEST}" +DEP_SENTINEL="${OPENCLAW_DEP_SENTINEL:?missing OPENCLAW_DEP_SENTINEL}" +gateway_pid="" + +terminate_gateways() { + if [ -n "${gateway_pid:-}" ] && kill -0 "$gateway_pid" 2>/dev/null; then + kill "$gateway_pid" 2>/dev/null || true + fi + if command -v pkill >/dev/null 2>&1; then + pkill -TERM -f "[o]penclaw-gateway" 2>/dev/null || true + fi + for _ in $(seq 1 100); do + local alive=0 + if [ -n "${gateway_pid:-}" ] && kill -0 "$gateway_pid" 2>/dev/null; then + alive=1 + fi + if command -v pgrep >/dev/null 2>&1 && pgrep -f "[o]penclaw-gateway" >/dev/null 2>&1; then + alive=1 + fi + [ "$alive" = "0" ] && break + sleep 0.1 + done + if [ -n "${gateway_pid:-}" ] && kill -0 "$gateway_pid" 2>/dev/null; then + kill -KILL "$gateway_pid" 2>/dev/null || true + fi + if command -v pkill >/dev/null 2>&1; then + pkill -KILL -f "[o]penclaw-gateway" 2>/dev/null || true + fi + if [ -n "${gateway_pid:-}" ]; then + wait "$gateway_pid" 2>/dev/null || true + fi +} + +cleanup() { + terminate_gateways +} +trap cleanup EXIT + +echo "Installing mounted OpenClaw package..." +package_tgz="${OPENCLAW_CURRENT_PACKAGE_TGZ:?missing OPENCLAW_CURRENT_PACKAGE_TGZ}" +npm install -g "$package_tgz" --no-fund --no-audit >/tmp/openclaw-install.log 2>&1 + +command -v openclaw >/dev/null +package_root="$(npm root -g)/openclaw" +test -d "$package_root/dist/extensions/telegram" +test -d "$package_root/dist/extensions/discord" +test -d "$package_root/dist/extensions/slack" +test -d "$package_root/dist/extensions/feishu" +test -d "$package_root/dist/extensions/memory-lancedb" + +stage_root() { + printf "%s/.openclaw/plugin-runtime-deps" "$HOME" +} + +find_external_dep_package() { + local dep_path="$1" + find "$(stage_root)" -maxdepth 12 -path "*/node_modules/$dep_path/package.json" -type f -print -quit 2>/dev/null || true +} + +assert_package_dep_absent() { + local channel="$1" + local dep_path="$2" + for candidate in \ + "$package_root/dist/extensions/$channel/node_modules/$dep_path/package.json" \ + "$package_root/dist/extensions/node_modules/$dep_path/package.json" \ + "$package_root/node_modules/$dep_path/package.json"; do + if [ -f "$candidate" ]; then + echo "packaged install should not mutate package tree for $channel: $candidate" >&2 + exit 1 + fi + done +} + +if [ -d "$package_root/dist/extensions/$CHANNEL/node_modules" ]; then + echo "$CHANNEL runtime deps should not be preinstalled in package" >&2 + find "$package_root/dist/extensions/$CHANNEL/node_modules" -maxdepth 2 -type f | head -20 >&2 || true + exit 1 +fi + +write_config() { + local mode="$1" + node - <<'NODE' "$mode" "$TOKEN" "$PORT" +const fs = require("node:fs"); +const path = require("node:path"); + +const mode = process.argv[2]; +const token = process.argv[3]; +const port = Number(process.argv[4]); +const configPath = path.join(process.env.HOME, ".openclaw", "openclaw.json"); +const config = fs.existsSync(configPath) + ? JSON.parse(fs.readFileSync(configPath, "utf8")) + : {}; + +config.gateway = { + ...(config.gateway || {}), + port, + auth: { mode: "token", token }, + controlUi: { enabled: false }, +}; +config.agents = { + ...(config.agents || {}), + defaults: { + ...(config.agents?.defaults || {}), + model: { primary: "openai/gpt-4.1-mini" }, + }, +}; +config.models = { + ...(config.models || {}), + providers: { + ...(config.models?.providers || {}), + openai: { + ...(config.models?.providers?.openai || {}), + apiKey: process.env.OPENAI_API_KEY, + baseUrl: "https://api.openai.com/v1", + models: [], + }, + }, +}; +config.plugins = { + ...(config.plugins || {}), + enabled: true, +}; + +if (mode === "telegram") { + config.channels = { + ...(config.channels || {}), + telegram: { + ...(config.channels?.telegram || {}), + enabled: true, + dmPolicy: "disabled", + groupPolicy: "disabled", + }, + }; +} +if (mode === "discord") { + config.channels = { + ...(config.channels || {}), + discord: { + ...(config.channels?.discord || {}), + enabled: true, + dmPolicy: "disabled", + groupPolicy: "disabled", + }, + }; +} +if (mode === "slack") { + config.channels = { + ...(config.channels || {}), + slack: { + ...(config.channels?.slack || {}), + enabled: true, + }, + }; +} +if (mode === "feishu") { + config.channels = { + ...(config.channels || {}), + feishu: { + ...(config.channels?.feishu || {}), + enabled: true, + }, + }; +} +if (mode === "memory-lancedb") { + config.plugins = { + ...(config.plugins || {}), + enabled: true, + allow: [...new Set([...(config.plugins?.allow || []), "memory-lancedb"])], + slots: { + ...(config.plugins?.slots || {}), + memory: "memory-lancedb", + }, + entries: { + ...(config.plugins?.entries || {}), + "memory-lancedb": { + ...(config.plugins?.entries?.["memory-lancedb"] || {}), + enabled: true, + config: { + ...(config.plugins?.entries?.["memory-lancedb"]?.config || {}), + embedding: { + ...(config.plugins?.entries?.["memory-lancedb"]?.config?.embedding || {}), + apiKey: process.env.OPENAI_API_KEY, + model: "text-embedding-3-small", + }, + dbPath: "~/.openclaw/memory/lancedb-e2e", + autoCapture: false, + autoRecall: false, + }, + }, + }, + }; +} + +fs.mkdirSync(path.dirname(configPath), { recursive: true }); +fs.writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`, "utf8"); +NODE +} + +start_gateway() { + local log_file="$1" + local skip_sidecars="${2:-0}" + : >"$log_file" + if [ "$skip_sidecars" = "1" ]; then + OPENCLAW_SKIP_CHANNELS=1 OPENCLAW_SKIP_PROVIDERS=1 \ + openclaw gateway --port "$PORT" --bind loopback --allow-unconfigured >"$log_file" 2>&1 & + else + openclaw gateway --port "$PORT" --bind loopback --allow-unconfigured >"$log_file" 2>&1 & + fi + gateway_pid="$!" + + # Cold bundled dependency staging can exceed 60s under 10-way Docker aggregate load. + for _ in $(seq 1 1200); do + if grep -Eq "listening on ws://|\\[gateway\\] ready \\(" "$log_file"; then + return 0 + fi + if ! kill -0 "$gateway_pid" 2>/dev/null; then + echo "gateway exited unexpectedly" >&2 + cat "$log_file" >&2 + exit 1 + fi + sleep 0.25 + done + + echo "timed out waiting for gateway" >&2 + cat "$log_file" >&2 + exit 1 +} + +stop_gateway() { + terminate_gateways + gateway_pid="" +} + +wait_for_gateway_health() { + local log_file="${1:-}" + if [ -n "${gateway_pid:-}" ] && kill -0 "$gateway_pid" 2>/dev/null; then + return 0 + fi + echo "gateway process exited after ready marker" >&2 + if [ -n "$log_file" ]; then + cat "$log_file" >&2 + fi + return 1 +} + +assert_channel_status() { + local channel="$1" + if [ "$channel" = "memory-lancedb" ]; then + echo "memory-lancedb plugin activation verified by dependency sentinel" + return 0 + fi + local out="/tmp/openclaw-channel-status-$channel.json" + local err="/tmp/openclaw-channel-status-$channel.err" + for _ in $(seq 1 12); do + if openclaw gateway call channels.status \ + --url "ws://127.0.0.1:$PORT" \ + --token "$TOKEN" \ + --timeout 10000 \ + --json \ + --params '{"probe":false}' >"$out" 2>"$err"; then + break + fi + sleep 2 + done + if [ ! -s "$out" ]; then + if grep -Eq "\\[gateway\\] ready \\(.*\\b$channel\\b" /tmp/openclaw-"$channel"-*.log 2>/dev/null; then + echo "$channel channel plugin visible in gateway ready log" + return 0 + fi + cat "$err" >&2 || true + return 1 + fi + node - <<'NODE' "$out" "$channel" +const fs = require("node:fs"); +const raw = JSON.parse(fs.readFileSync(process.argv[2], "utf8")); +const payload = raw.result ?? raw.data ?? raw; +const channel = process.argv[3]; +const dump = () => JSON.stringify(raw, null, 2).slice(0, 4000); +const hasChannelMeta = Array.isArray(payload.channelMeta) + ? payload.channelMeta.some((entry) => entry?.id === channel) + : Boolean(payload.channelMeta?.[channel]); +if (!hasChannelMeta) { + throw new Error(`missing channelMeta.${channel}\n${dump()}`); +} +if (!payload.channels || !payload.channels[channel]) { + throw new Error(`missing channels.${channel}\n${dump()}`); +} +const accounts = payload.channelAccounts?.[channel]; +if (!Array.isArray(accounts) || accounts.length === 0) { + throw new Error(`missing channelAccounts.${channel}\n${dump()}`); +} +console.log(`${channel} channel plugin visible`); +NODE +} + +assert_installed_once() { + local log_file="$1" + local channel="$2" + local dep_path="$3" + local count + count="$(grep -Ec "\\[plugins\\] $channel installed bundled runtime deps( in [0-9]+ms)?:" "$log_file" || true)" + if [ "$count" -eq 1 ]; then + return 0 + fi + if [ "$count" -eq 0 ] && [ -n "$(find_external_dep_package "$dep_path")" ]; then + return 0 + fi + echo "expected one runtime deps install log or staged dependency sentinel for $channel, got $count log lines" >&2 + cat "$log_file" >&2 + find "$(stage_root)" -maxdepth 12 -type f | sort | head -120 >&2 || true + exit 1 +} + +assert_not_installed() { + local log_file="$1" + local channel="$2" + if grep -Eq "\\[plugins\\] $channel installed bundled runtime deps( in [0-9]+ms)?:" "$log_file"; then + echo "expected no runtime deps reinstall for $channel" >&2 + cat "$log_file" >&2 + exit 1 + fi +} + +assert_dep_sentinel() { + local channel="$1" + local dep_path="$2" + local sentinel + sentinel="$(find_external_dep_package "$dep_path")" + if [ -z "$sentinel" ]; then + echo "missing external dependency sentinel for $channel: $dep_path" >&2 + find "$(stage_root)" -maxdepth 12 -type f | sort | head -120 >&2 || true + exit 1 + fi + assert_package_dep_absent "$channel" "$dep_path" +} + +assert_no_dep_sentinel() { + local channel="$1" + local dep_path="$2" + assert_package_dep_absent "$channel" "$dep_path" + if [ -n "$(find_external_dep_package "$dep_path")" ]; then + echo "external dependency sentinel should be absent before activation for $channel: $dep_path" >&2 + exit 1 + fi +} + +assert_no_install_stage() { + local channel="$1" + local stage="$package_root/dist/extensions/$channel/.openclaw-install-stage" + if [ -e "$stage" ]; then + echo "install stage should be cleaned after activation for $channel" >&2 + find "$stage" -maxdepth 4 -type f | sort | head -80 >&2 || true + exit 1 + fi +} + +echo "Starting baseline gateway with OpenAI configured..." +write_config baseline +start_gateway "/tmp/openclaw-$CHANNEL-baseline.log" 1 +wait_for_gateway_health "/tmp/openclaw-$CHANNEL-baseline.log" +stop_gateway +assert_no_dep_sentinel "$CHANNEL" "$DEP_SENTINEL" + +echo "Enabling $CHANNEL by config edit, then restarting gateway..." +write_config "$CHANNEL" +start_gateway "/tmp/openclaw-$CHANNEL-first.log" +wait_for_gateway_health "/tmp/openclaw-$CHANNEL-first.log" +assert_installed_once "/tmp/openclaw-$CHANNEL-first.log" "$CHANNEL" "$DEP_SENTINEL" +assert_dep_sentinel "$CHANNEL" "$DEP_SENTINEL" +assert_no_install_stage "$CHANNEL" +assert_channel_status "$CHANNEL" +stop_gateway + +echo "Restarting gateway again; $CHANNEL deps must stay installed..." +start_gateway "/tmp/openclaw-$CHANNEL-second.log" +wait_for_gateway_health "/tmp/openclaw-$CHANNEL-second.log" +assert_not_installed "/tmp/openclaw-$CHANNEL-second.log" "$CHANNEL" +assert_no_install_stage "$CHANNEL" +assert_channel_status "$CHANNEL" +stop_gateway + +echo "bundled $CHANNEL runtime deps Docker E2E passed" +EOF + then + docker_e2e_print_log "$run_log" + rm -f "$run_log" + exit 1 + fi + + docker_e2e_print_log "$run_log" + rm -f "$run_log" +} diff --git a/scripts/e2e/lib/bundled-channel/disabled-config.sh b/scripts/e2e/lib/bundled-channel/disabled-config.sh new file mode 100644 index 00000000000..b1c30b56308 --- /dev/null +++ b/scripts/e2e/lib/bundled-channel/disabled-config.sh @@ -0,0 +1,169 @@ +#!/usr/bin/env bash +# +# Runs disabled-config runtime-dependency isolation scenarios. +# Sourced by scripts/e2e/bundled-channel-runtime-deps-docker.sh. + +run_disabled_config_scenario() { + local run_log + run_log="$(docker_e2e_run_log bundled-channel-disabled-config)" + + echo "Running bundled channel disabled-config runtime deps Docker E2E..." + if ! timeout "$DOCKER_RUN_TIMEOUT" docker run --rm \ + -e COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \ + "${DOCKER_E2E_PACKAGE_ARGS[@]}" \ + -i "$IMAGE_NAME" bash -s >"$run_log" 2>&1 <<'EOF' +set -euo pipefail + +export HOME="$(mktemp -d "/tmp/openclaw-bundled-channel-disabled-config.XXXXXX")" +export NPM_CONFIG_PREFIX="$HOME/.npm-global" +export PATH="$NPM_CONFIG_PREFIX/bin:$PATH" +export OPENCLAW_NO_ONBOARD=1 +export OPENCLAW_PLUGIN_STAGE_DIR="$HOME/.openclaw/plugin-runtime-deps" +mkdir -p "$OPENCLAW_PLUGIN_STAGE_DIR" + +package_root() { + printf "%s/openclaw" "$(npm root -g)" +} + +assert_dep_absent_everywhere() { + local channel="$1" + local dep_path="$2" + local root="$3" + for candidate in \ + "$root/dist/extensions/$channel/node_modules/$dep_path/package.json" \ + "$root/dist/extensions/node_modules/$dep_path/package.json" \ + "$root/node_modules/$dep_path/package.json"; do + if [ -f "$candidate" ]; then + echo "disabled $channel unexpectedly installed $dep_path at $candidate" >&2 + exit 1 + fi + done + + if ! node - <<'NODE' "$OPENCLAW_PLUGIN_STAGE_DIR" "$dep_path" +const fs = require("node:fs"); +const path = require("node:path"); + +const stageDir = process.argv[2]; +const depName = process.argv[3]; +const manifestName = ".openclaw-runtime-deps.json"; +const matches = []; + +function visit(dir) { + let entries; + try { + entries = fs.readdirSync(dir, { withFileTypes: true }); + } catch { + return; + } + for (const entry of entries) { + const fullPath = path.join(dir, entry.name); + if (entry.isDirectory()) { + visit(fullPath); + continue; + } + if (entry.name !== manifestName) { + continue; + } + let parsed; + try { + parsed = JSON.parse(fs.readFileSync(fullPath, "utf8")); + } catch { + continue; + } + const specs = Array.isArray(parsed.specs) ? parsed.specs : []; + for (const spec of specs) { + if (typeof spec === "string" && spec.startsWith(`${depName}@`)) { + matches.push(`${fullPath}: ${spec}`); + } + } + } +} + +visit(stageDir); +if (matches.length > 0) { + process.stderr.write(`${matches.join("\n")}\n`); + process.exit(1); +} +NODE + then + echo "disabled $channel unexpectedly selected $dep_path for external runtime deps" >&2 + cat /tmp/openclaw-disabled-config-doctor.log >&2 + exit 1 + fi +} + +echo "Installing mounted OpenClaw package..." +package_tgz="${OPENCLAW_CURRENT_PACKAGE_TGZ:?missing OPENCLAW_CURRENT_PACKAGE_TGZ}" +npm install -g "$package_tgz" --no-fund --no-audit >/tmp/openclaw-disabled-config-install.log 2>&1 + +root="$(package_root)" +test -d "$root/dist/extensions/telegram" +test -d "$root/dist/extensions/discord" +test -d "$root/dist/extensions/slack" +rm -rf "$root/dist/extensions/telegram/node_modules" +rm -rf "$root/dist/extensions/discord/node_modules" +rm -rf "$root/dist/extensions/slack/node_modules" + +node - <<'NODE' +const fs = require("node:fs"); +const path = require("node:path"); + +const configPath = path.join(process.env.HOME, ".openclaw", "openclaw.json"); +const config = { + plugins: { + enabled: true, + entries: { + discord: { enabled: false }, + }, + }, + channels: { + telegram: { + enabled: false, + botToken: "123456:disabled-config-token", + dmPolicy: "disabled", + groupPolicy: "disabled", + }, + slack: { + enabled: false, + botToken: "xoxb-disabled-config-token", + appToken: "xapp-disabled-config-token", + }, + discord: { + enabled: true, + token: "disabled-plugin-entry-token", + dmPolicy: "disabled", + groupPolicy: "disabled", + }, + }, +}; +fs.mkdirSync(path.dirname(configPath), { recursive: true }); +fs.writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`, "utf8"); +NODE + +if ! openclaw doctor --non-interactive >/tmp/openclaw-disabled-config-doctor.log 2>&1; then + echo "doctor failed for disabled-config runtime deps smoke" >&2 + cat /tmp/openclaw-disabled-config-doctor.log >&2 + exit 1 +fi + +assert_dep_absent_everywhere telegram grammy "$root" +assert_dep_absent_everywhere slack @slack/web-api "$root" +assert_dep_absent_everywhere discord discord-api-types "$root" + +if grep -Eq "(used by .*\\b(telegram|slack|discord)\\b|\\[plugins\\] (telegram|slack|discord) installed bundled runtime deps( in [0-9]+ms)?:)" /tmp/openclaw-disabled-config-doctor.log; then + echo "doctor installed runtime deps for an explicitly disabled channel/plugin" >&2 + cat /tmp/openclaw-disabled-config-doctor.log >&2 + exit 1 +fi + +echo "bundled channel disabled-config runtime deps Docker E2E passed" +EOF + then + docker_e2e_print_log "$run_log" + rm -f "$run_log" + exit 1 + fi + + docker_e2e_print_log "$run_log" + rm -f "$run_log" +} diff --git a/scripts/e2e/lib/bundled-channel/load-failure.sh b/scripts/e2e/lib/bundled-channel/load-failure.sh new file mode 100644 index 00000000000..fad53419a3a --- /dev/null +++ b/scripts/e2e/lib/bundled-channel/load-failure.sh @@ -0,0 +1,159 @@ +#!/usr/bin/env bash +# +# Runs load-failure isolation scenarios. +# Sourced by scripts/e2e/bundled-channel-runtime-deps-docker.sh. + +run_load_failure_scenario() { + local run_log + run_log="$(docker_e2e_run_log bundled-channel-load-failure)" + + echo "Running bundled channel load-failure isolation Docker E2E..." + if ! timeout "$DOCKER_RUN_TIMEOUT" docker run --rm \ + -e COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \ + "${DOCKER_E2E_PACKAGE_ARGS[@]}" \ + -i "$IMAGE_NAME" bash -s >"$run_log" 2>&1 <<'EOF' +set -euo pipefail + +export HOME="$(mktemp -d "/tmp/openclaw-bundled-channel-load-failure.XXXXXX")" +export NPM_CONFIG_PREFIX="$HOME/.npm-global" +export PATH="$NPM_CONFIG_PREFIX/bin:$PATH" +export OPENCLAW_NO_ONBOARD=1 + +package_root() { + printf "%s/openclaw" "$(npm root -g)" +} + +echo "Installing mounted OpenClaw package..." +package_tgz="${OPENCLAW_CURRENT_PACKAGE_TGZ:?missing OPENCLAW_CURRENT_PACKAGE_TGZ}" +npm install -g "$package_tgz" --no-fund --no-audit >/tmp/openclaw-load-failure-install.log 2>&1 + +root="$(package_root)" +plugin_dir="$root/dist/extensions/load-failure-alpha" +mkdir -p "$plugin_dir" +cat >"$plugin_dir/package.json" <<'JSON' +{ + "name": "@openclaw/load-failure-alpha", + "version": "2026.4.21", + "private": true, + "type": "module", + "openclaw": { + "extensions": ["./index.js"], + "setupEntry": "./setup-entry.js" + } +} +JSON +cat >"$plugin_dir/openclaw.plugin.json" <<'JSON' +{ + "id": "load-failure-alpha", + "channels": ["load-failure-alpha"], + "configSchema": { + "type": "object", + "additionalProperties": false, + "properties": {} + } +} +JSON +cat >"$plugin_dir/index.js" <<'JS' +export default { + kind: "bundled-channel-entry", + id: "load-failure-alpha", + name: "Load Failure Alpha", + description: "Load Failure Alpha", + register() {}, + loadChannelSecrets() { + globalThis.__loadFailureSecrets = (globalThis.__loadFailureSecrets ?? 0) + 1; + throw new Error("synthetic channel secrets failure"); + }, + loadChannelPlugin() { + globalThis.__loadFailurePlugin = (globalThis.__loadFailurePlugin ?? 0) + 1; + throw new Error("synthetic channel plugin failure"); + } +}; +JS +cat >"$plugin_dir/setup-entry.js" <<'JS' +export default { + kind: "bundled-channel-setup-entry", + loadSetupSecrets() { + globalThis.__loadFailureSetupSecrets = (globalThis.__loadFailureSetupSecrets ?? 0) + 1; + throw new Error("synthetic setup secrets failure"); + }, + loadSetupPlugin() { + globalThis.__loadFailureSetup = (globalThis.__loadFailureSetup ?? 0) + 1; + throw new Error("synthetic setup plugin failure"); + } +}; +JS + +echo "Loading synthetic failing bundled channel through packaged loader..." +( + cd "$root" + OPENCLAW_BUNDLED_PLUGINS_DIR="$root/dist/extensions" node --input-type=module - <<'NODE' +import fs from "node:fs"; +import path from "node:path"; +import { pathToFileURL } from "node:url"; + +const root = process.cwd(); +const distDir = path.join(root, "dist"); +const bundledPath = fs + .readdirSync(distDir) + .filter((entry) => /^bundled-[A-Za-z0-9_-]+\.js$/.test(entry)) + .map((entry) => path.join(distDir, entry)) + .find((entry) => fs.readFileSync(entry, "utf8").includes("src/channels/plugins/bundled.ts")); +if (!bundledPath) { + throw new Error("missing packaged bundled channel loader artifact"); +} +const bundled = await import(pathToFileURL(bundledPath)); +const oneArgExports = Object.entries(bundled).filter( + ([, value]) => typeof value === "function" && value.length === 1, +); +if (oneArgExports.length === 0) { + throw new Error(`missing one-argument bundled loader exports; exports=${Object.keys(bundled).join(",")}`); +} + +const id = "load-failure-alpha"; +for (let i = 0; i < 2; i += 1) { + for (const [name, fn] of oneArgExports) { + try { + fn(id); + } catch (error) { + const message = error instanceof Error ? error.message : String(error); + if (message.includes("synthetic")) { + throw new Error(`bundled export ${name} leaked synthetic load failure: ${message}`); + } + } + } +} + +const counts = { + plugin: globalThis.__loadFailurePlugin, + setup: globalThis.__loadFailureSetup, + secrets: globalThis.__loadFailureSecrets, + setupSecrets: globalThis.__loadFailureSetupSecrets, +}; +for (const [key, value] of Object.entries({ + plugin: counts.plugin, + setup: counts.setup, + setupSecrets: counts.setupSecrets, +})) { + if (value !== 1) { + throw new Error(`expected ${key} failure to be cached after one load, got ${value}`); + } +} +if (counts.secrets !== undefined && counts.secrets !== 1) { + throw new Error(`expected secrets failure to be cached after one load when exercised, got ${counts.secrets}`); +} +console.log("synthetic bundled channel load failures were isolated and cached"); +NODE +) + +echo "bundled channel load-failure isolation Docker E2E passed" +EOF + then + docker_e2e_print_log "$run_log" + rm -f "$run_log" + exit 1 + fi + + docker_e2e_print_log "$run_log" + rm -f "$run_log" +} diff --git a/scripts/e2e/lib/bundled-channel/root-owned.sh b/scripts/e2e/lib/bundled-channel/root-owned.sh new file mode 100644 index 00000000000..8b2f57bed7a --- /dev/null +++ b/scripts/e2e/lib/bundled-channel/root-owned.sh @@ -0,0 +1,181 @@ +#!/usr/bin/env bash +# +# Runs the root-owned global install runtime-dependency scenario. +# Sourced by scripts/e2e/bundled-channel-runtime-deps-docker.sh. + +run_root_owned_global_scenario() { + local run_log + run_log="$(docker_e2e_run_log bundled-channel-root-owned)" + + echo "Running bundled channel root-owned global install Docker E2E..." + if ! timeout "$DOCKER_RUN_TIMEOUT" docker run --rm --user root \ + -e COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \ + "${DOCKER_E2E_PACKAGE_ARGS[@]}" \ + -i "$IMAGE_NAME" bash -s >"$run_log" 2>&1 <<'EOF' +set -euo pipefail + +export HOME="/root" +export OPENAI_API_KEY="sk-openclaw-bundled-channel-root-owned-e2e" +export OPENCLAW_NO_ONBOARD=1 +export OPENCLAW_PLUGIN_STAGE_DIR="/var/lib/openclaw/plugin-runtime-deps" + +TOKEN="bundled-channel-root-owned-token" +PORT="18791" +CHANNEL="slack" +DEP_SENTINEL="@slack/web-api" +gateway_pid="" + +package_root() { + printf "%s/openclaw" "$(npm root -g)" +} + +cleanup() { + if [ -n "${gateway_pid:-}" ] && kill -0 "$gateway_pid" 2>/dev/null; then + kill "$gateway_pid" 2>/dev/null || true + wait "$gateway_pid" 2>/dev/null || true + fi +} +trap cleanup EXIT + +echo "Installing mounted OpenClaw package into root-owned global npm..." +package_tgz="${OPENCLAW_CURRENT_PACKAGE_TGZ:?missing OPENCLAW_CURRENT_PACKAGE_TGZ}" +npm install -g "$package_tgz" --no-fund --no-audit >/tmp/openclaw-root-owned-install.log 2>&1 + +root="$(package_root)" +test -d "$root/dist/extensions/$CHANNEL" +rm -rf "$root/dist/extensions/$CHANNEL/node_modules" +chmod -R a-w "$root" +mkdir -p "$OPENCLAW_PLUGIN_STAGE_DIR" /home/appuser/.openclaw +chown -R appuser:appuser /home/appuser/.openclaw /var/lib/openclaw + +if runuser -u appuser -- test -w "$root"; then + echo "expected package root to be unwritable for appuser" >&2 + exit 1 +fi + +node - <<'NODE' "$TOKEN" "$PORT" +const fs = require("node:fs"); +const path = require("node:path"); +const token = process.argv[2]; +const port = Number(process.argv[3]); +const configPath = "/home/appuser/.openclaw/openclaw.json"; +const config = { + gateway: { + port, + auth: { mode: "token", token }, + controlUi: { enabled: false }, + }, + agents: { + defaults: { + model: { primary: "openai/gpt-4.1-mini" }, + }, + }, + models: { + providers: { + openai: { + apiKey: process.env.OPENAI_API_KEY, + baseUrl: "https://api.openai.com/v1", + models: [], + }, + }, + }, + plugins: { enabled: true }, + channels: { + slack: { + enabled: true, + botToken: "xoxb-bundled-channel-root-owned-token", + appToken: "xapp-bundled-channel-root-owned-token", + }, + }, +}; +fs.mkdirSync(path.dirname(configPath), { recursive: true }); +fs.writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`, "utf8"); +NODE +chown appuser:appuser /home/appuser/.openclaw/openclaw.json + +start_gateway() { + local log_file="$1" + : >"$log_file" + chown appuser:appuser "$log_file" + runuser -u appuser -- env \ + HOME=/home/appuser \ + OPENAI_API_KEY="$OPENAI_API_KEY" \ + OPENCLAW_NO_ONBOARD=1 \ + OPENCLAW_PLUGIN_STAGE_DIR="$OPENCLAW_PLUGIN_STAGE_DIR" \ + npm_config_cache=/tmp/openclaw-root-owned-npm-cache \ + bash -c 'openclaw gateway --port "$1" --bind loopback --allow-unconfigured >"$2" 2>&1' \ + bash "$PORT" "$log_file" & + gateway_pid="$!" + + # Cold bundled dependency staging can exceed 60s under 10-way Docker aggregate load. + for _ in $(seq 1 1200); do + if grep -Eq "listening on ws://|\\[gateway\\] ready \\(" "$log_file"; then + return 0 + fi + if ! kill -0 "$gateway_pid" 2>/dev/null; then + echo "gateway exited unexpectedly" >&2 + cat "$log_file" >&2 + exit 1 + fi + sleep 0.25 + done + + echo "timed out waiting for gateway" >&2 + cat "$log_file" >&2 + exit 1 +} + +wait_for_slack_provider_start() { + for _ in $(seq 1 180); do + if grep -Eq "\\[slack\\] \\[default\\] starting provider|An API error occurred: invalid_auth|\\[plugins\\] slack installed bundled runtime deps|\\[gateway\\] ready \\(.*\\bslack\\b" /tmp/openclaw-root-owned-gateway.log; then + return 0 + fi + sleep 1 + done + echo "timed out waiting for slack provider startup" >&2 + cat /tmp/openclaw-root-owned-gateway.log >&2 + exit 1 +} + +start_gateway /tmp/openclaw-root-owned-gateway.log +wait_for_slack_provider_start + +if [ -e "$root/dist/extensions/$CHANNEL/node_modules/$DEP_SENTINEL/package.json" ]; then + echo "root-owned package tree was mutated" >&2 + find "$root/dist/extensions/$CHANNEL/node_modules" -maxdepth 4 -type f | sort | head -80 >&2 || true + exit 1 +fi +if ! find "$OPENCLAW_PLUGIN_STAGE_DIR" -maxdepth 12 -path "*/node_modules/$DEP_SENTINEL/package.json" -type f | grep -q .; then + echo "missing external staged dependency sentinel for $DEP_SENTINEL" >&2 + find "$OPENCLAW_PLUGIN_STAGE_DIR" -maxdepth 12 -type f | sort | head -120 >&2 || true + cat /tmp/openclaw-root-owned-gateway.log >&2 + exit 1 +fi +if [ -e "$root/dist/extensions/node_modules/openclaw/package.json" ]; then + echo "root-owned package tree was mutated with SDK alias" >&2 + find "$root/dist/extensions/node_modules/openclaw" -maxdepth 4 -type f | sort | head -80 >&2 || true + exit 1 +fi +if ! find "$OPENCLAW_PLUGIN_STAGE_DIR" -maxdepth 12 -path "*/dist/extensions/node_modules/openclaw/package.json" -type f | grep -q .; then + echo "missing external staged openclaw/plugin-sdk alias" >&2 + find "$OPENCLAW_PLUGIN_STAGE_DIR" -maxdepth 12 -type f | sort | head -120 >&2 || true + cat /tmp/openclaw-root-owned-gateway.log >&2 + exit 1 +fi +if grep -Eq "failed to install bundled runtime deps|Cannot find package 'openclaw'|Cannot find module 'openclaw/plugin-sdk'" /tmp/openclaw-root-owned-gateway.log; then + echo "root-owned gateway hit bundled runtime dependency errors" >&2 + cat /tmp/openclaw-root-owned-gateway.log >&2 + exit 1 +fi + +echo "root-owned global install Docker E2E passed" +EOF + then + docker_e2e_print_log "$run_log" + rm -f "$run_log" + exit 1 + fi + + docker_e2e_print_log "$run_log" + rm -f "$run_log" +} diff --git a/scripts/e2e/lib/bundled-channel/setup-entry.sh b/scripts/e2e/lib/bundled-channel/setup-entry.sh new file mode 100644 index 00000000000..ff35352a7f0 --- /dev/null +++ b/scripts/e2e/lib/bundled-channel/setup-entry.sh @@ -0,0 +1,261 @@ +#!/usr/bin/env bash +# +# Runs setup-entry runtime-dependency installation scenarios. +# Sourced by scripts/e2e/bundled-channel-runtime-deps-docker.sh. + +run_setup_entry_scenario() { + local run_log + run_log="$(docker_e2e_run_log bundled-channel-setup-entry)" + + echo "Running bundled channel setup-entry runtime deps Docker E2E..." + if ! timeout "$DOCKER_RUN_TIMEOUT" docker run --rm \ + -e COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \ + "${DOCKER_E2E_PACKAGE_ARGS[@]}" \ + -i "$IMAGE_NAME" bash -s >"$run_log" 2>&1 <<'EOF' +set -euo pipefail + +export HOME="$(mktemp -d "/tmp/openclaw-bundled-channel-setup-entry.XXXXXX")" +export NPM_CONFIG_PREFIX="$HOME/.npm-global" +export PATH="$NPM_CONFIG_PREFIX/bin:$PATH" +export OPENCLAW_NO_ONBOARD=1 +export OPENCLAW_PLUGIN_STAGE_DIR="$HOME/.openclaw/plugin-runtime-deps" +mkdir -p "$OPENCLAW_PLUGIN_STAGE_DIR" + +declare -A SETUP_ENTRY_DEP_SENTINELS=( + [feishu]="@larksuiteoapi/node-sdk" + [whatsapp]="@whiskeysockets/baileys" +) + +package_root() { + printf "%s/openclaw" "$(npm root -g)" +} + +echo "Installing mounted OpenClaw package..." +package_tgz="${OPENCLAW_CURRENT_PACKAGE_TGZ:?missing OPENCLAW_CURRENT_PACKAGE_TGZ}" +npm install -g "$package_tgz" --no-fund --no-audit >/tmp/openclaw-setup-entry-install.log 2>&1 + +root="$(package_root)" +for channel in "${!SETUP_ENTRY_DEP_SENTINELS[@]}"; do + dep_sentinel="${SETUP_ENTRY_DEP_SENTINELS[$channel]}" + test -d "$root/dist/extensions/$channel" + if [ -d "$root/dist/extensions/$channel/node_modules" ]; then + echo "$channel runtime deps should not be preinstalled in package" >&2 + find "$root/dist/extensions/$channel/node_modules" -maxdepth 3 -type f | head -40 >&2 || true + exit 1 + fi + if [ -f "$root/node_modules/$dep_sentinel/package.json" ]; then + echo "$dep_sentinel should not be installed at package root before setup-entry load" >&2 + exit 1 + fi +done + +echo "Probing real bundled setup entries before channel configuration..." +( + cd "$root" + node --input-type=module - <<'NODE' +import fs from "node:fs"; +import path from "node:path"; +import { pathToFileURL } from "node:url"; + +const root = process.cwd(); +const distDir = path.join(root, "dist"); +const bundledPath = fs + .readdirSync(distDir) + .filter((entry) => /^bundled-[A-Za-z0-9_-]+\.js$/.test(entry)) + .map((entry) => path.join(distDir, entry)) + .find((entry) => fs.readFileSync(entry, "utf8").includes("src/channels/plugins/bundled.ts")); +if (!bundledPath) { + throw new Error("missing packaged bundled channel loader artifact"); +} +const bundled = await import(pathToFileURL(bundledPath)); +const setupPluginLoader = Object.values(bundled).find( + (value) => typeof value === "function" && value.name === "getBundledChannelSetupPlugin", +); +if (!setupPluginLoader) { + throw new Error("missing packaged getBundledChannelSetupPlugin export"); +} +for (const channel of ["feishu", "whatsapp"]) { + const plugin = setupPluginLoader(channel); + if (!plugin) { + throw new Error(`${channel} setup plugin did not load pre-config`); + } + if (plugin.id !== channel) { + throw new Error(`${channel} setup plugin id mismatch: ${plugin.id}`); + } + console.log(`${channel} setup plugin loaded pre-config`); +} +NODE +) + +for channel in "${!SETUP_ENTRY_DEP_SENTINELS[@]}"; do + dep_sentinel="${SETUP_ENTRY_DEP_SENTINELS[$channel]}" + if [ -e "$root/dist/extensions/$channel/node_modules/$dep_sentinel/package.json" ]; then + echo "setup-entry discovery installed $channel deps into bundled plugin tree before channel configuration" >&2 + exit 1 + fi + if find "$OPENCLAW_PLUGIN_STAGE_DIR" -maxdepth 12 -path "*/node_modules/$dep_sentinel/package.json" -type f | grep -q .; then + echo "setup-entry discovery installed $channel external staged deps before channel configuration" >&2 + find "$OPENCLAW_PLUGIN_STAGE_DIR" -maxdepth 12 -type f | sort | head -160 >&2 || true + exit 1 + fi +done + +echo "Running packaged guided WhatsApp setup; runtime deps should be staged before finalize..." +OPENCLAW_PACKAGE_ROOT="$root" node --input-type=module - <<'NODE' +import path from "node:path"; +import { readdir } from "node:fs/promises"; +import { pathToFileURL } from "node:url"; + +const root = process.env.OPENCLAW_PACKAGE_ROOT; +if (!root) { + throw new Error("missing OPENCLAW_PACKAGE_ROOT"); +} +const distDir = path.join(root, "dist"); +const onboardChannelFiles = (await readdir(distDir)) + .filter((entry) => /^onboard-channels-.*\.js$/.test(entry)) + .sort(); +let setupChannels; +for (const entry of onboardChannelFiles) { + const module = await import(pathToFileURL(path.join(distDir, entry))); + if (typeof module.setupChannels === "function") { + setupChannels = module.setupChannels; + break; + } +} +if (!setupChannels) { + throw new Error( + `could not find packaged setupChannels export in ${JSON.stringify(onboardChannelFiles)}`, + ); +} + +let channelSelectCount = 0; +const notes = []; +const prompter = { + intro: async () => {}, + outro: async () => {}, + note: async (body, title) => { + notes.push({ title, body }); + }, + confirm: async ({ message, initialValue }) => { + if (message === "Link WhatsApp now (QR)?") { + return false; + } + return initialValue ?? true; + }, + select: async ({ message, options }) => { + if (message === "Select a channel") { + channelSelectCount += 1; + return channelSelectCount === 1 ? "whatsapp" : "__done__"; + } + if (message === "Install WhatsApp plugin?") { + if (!options?.some((option) => option.value === "local")) { + throw new Error(`missing bundled local install option: ${JSON.stringify(options)}`); + } + return "local"; + } + if (message === "WhatsApp phone setup") { + return "separate"; + } + if (message === "WhatsApp DM policy") { + return "disabled"; + } + throw new Error(`unexpected select prompt: ${message}`); + }, + multiselect: async ({ message }) => { + throw new Error(`unexpected multiselect prompt: ${message}`); + }, + text: async ({ message }) => { + throw new Error(`unexpected text prompt: ${message}`); + }, +}; +const runtime = { + log: (message) => console.log(message), + error: (message) => console.error(message), +}; + +const result = await setupChannels( + { plugins: { enabled: true } }, + runtime, + prompter, + { + deferStatusUntilSelection: true, + skipConfirm: true, + skipStatusNote: true, + skipDmPolicyPrompt: true, + initialSelection: ["whatsapp"], + }, +); + +if (!result.channels?.whatsapp) { + throw new Error(`WhatsApp setup did not write channel config: ${JSON.stringify(result)}`); +} +console.log("packaged guided WhatsApp setup completed"); +NODE + +if [ -e "$root/dist/extensions/whatsapp/node_modules/@whiskeysockets/baileys/package.json" ]; then + echo "expected guided WhatsApp setup deps to be installed externally, not into bundled plugin tree" >&2 + exit 1 +fi +if ! find "$OPENCLAW_PLUGIN_STAGE_DIR" -maxdepth 12 -path "*/node_modules/@whiskeysockets/baileys/package.json" -type f | grep -q .; then + echo "guided WhatsApp setup did not stage @whiskeysockets/baileys before finalize" >&2 + find "$OPENCLAW_PLUGIN_STAGE_DIR" -maxdepth 12 -type f | sort | head -160 >&2 || true + exit 1 +fi + +echo "Configuring setup-entry channels; doctor should now install bundled runtime deps externally..." +node - <<'NODE' +const fs = require("node:fs"); +const path = require("node:path"); + +const configPath = path.join(process.env.HOME, ".openclaw", "openclaw.json"); +fs.mkdirSync(path.dirname(configPath), { recursive: true }); +const config = fs.existsSync(configPath) + ? JSON.parse(fs.readFileSync(configPath, "utf8")) + : {}; + +config.plugins = { + ...(config.plugins || {}), + enabled: true, +}; +config.channels = { + ...(config.channels || {}), + feishu: { + ...(config.channels?.feishu || {}), + enabled: true, + }, + whatsapp: { + ...(config.channels?.whatsapp || {}), + enabled: true, + }, +}; + +fs.writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`, "utf8"); +NODE + +openclaw doctor --non-interactive >/tmp/openclaw-setup-entry-doctor.log 2>&1 + +for channel in "${!SETUP_ENTRY_DEP_SENTINELS[@]}"; do + dep_sentinel="${SETUP_ENTRY_DEP_SENTINELS[$channel]}" + if [ -e "$root/dist/extensions/$channel/node_modules/$dep_sentinel/package.json" ]; then + echo "expected configured $channel deps to be installed externally, not into bundled plugin tree" >&2 + exit 1 + fi + if ! find "$OPENCLAW_PLUGIN_STAGE_DIR" -maxdepth 12 -path "*/node_modules/$dep_sentinel/package.json" -type f | grep -q .; then + echo "missing external staged dependency sentinel for configured $channel: $dep_sentinel" >&2 + cat /tmp/openclaw-setup-entry-doctor.log >&2 + find "$OPENCLAW_PLUGIN_STAGE_DIR" -maxdepth 12 -type f | sort | head -160 >&2 || true + exit 1 + fi +done + +echo "bundled channel setup-entry runtime deps Docker E2E passed" +EOF + then + docker_e2e_print_log "$run_log" + rm -f "$run_log" + exit 1 + fi + + docker_e2e_print_log "$run_log" + rm -f "$run_log" +} diff --git a/scripts/e2e/lib/bundled-channel/update.sh b/scripts/e2e/lib/bundled-channel/update.sh new file mode 100644 index 00000000000..89258903289 --- /dev/null +++ b/scripts/e2e/lib/bundled-channel/update.sh @@ -0,0 +1,438 @@ +#!/usr/bin/env bash +# +# Runs baseline-to-current bundled plugin update scenarios. +# Sourced by scripts/e2e/bundled-channel-runtime-deps-docker.sh. + +run_update_scenario() { + local run_log + run_log="$(docker_e2e_run_log bundled-channel-update)" + + echo "Running bundled channel runtime deps Docker update E2E..." + if ! timeout "$DOCKER_RUN_TIMEOUT" docker run --rm \ + -e COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \ + -e OPENCLAW_BUNDLED_CHANNEL_UPDATE_BASELINE_VERSION="$UPDATE_BASELINE_VERSION" \ + -e "OPENCLAW_BUNDLED_CHANNEL_UPDATE_TARGETS=${OPENCLAW_BUNDLED_CHANNEL_UPDATE_TARGETS:-telegram,discord,slack,feishu,memory-lancedb,acpx}" \ + "${DOCKER_E2E_PACKAGE_ARGS[@]}" \ + -i "$IMAGE_NAME" bash -s >"$run_log" 2>&1 <<'EOF' +set -euo pipefail + +export HOME="$(mktemp -d "/tmp/openclaw-bundled-channel-update.XXXXXX")" +export NPM_CONFIG_PREFIX="$HOME/.npm-global" +export PATH="$NPM_CONFIG_PREFIX/bin:$PATH" +export OPENAI_API_KEY="sk-openclaw-bundled-channel-update-e2e" +export OPENCLAW_NO_ONBOARD=1 +export OPENCLAW_UPDATE_PACKAGE_SPEC="" + +TOKEN="bundled-channel-update-token" +PORT="18790" +UPDATE_TARGETS="${OPENCLAW_BUNDLED_CHANNEL_UPDATE_TARGETS:-telegram,discord,slack,feishu,memory-lancedb,acpx}" + +package_root() { + printf "%s/openclaw" "$(npm root -g)" +} + +stage_root() { + printf "%s/.openclaw/plugin-runtime-deps" "$HOME" +} + +poison_home_npm_project() { + printf '{"name":"openclaw-home-prefix-poison","private":true}\n' >"$HOME/package.json" + rm -rf "$HOME/node_modules" + mkdir -p "$HOME/node_modules" + chmod 500 "$HOME/node_modules" +} + +find_external_dep_package() { + local dep_path="$1" + find "$(stage_root)" -maxdepth 12 -path "*/node_modules/$dep_path/package.json" -type f -print -quit 2>/dev/null || true +} + +assert_no_unknown_stage_roots() { + if find "$(stage_root)" -maxdepth 1 -type d -name 'openclaw-unknown-*' -print -quit 2>/dev/null | grep -q .; then + echo "runtime deps created second-generation unknown stage roots" >&2 + find "$(stage_root)" -maxdepth 1 -type d -name 'openclaw-*' -print | sort >&2 || true + exit 1 + fi +} + +package_tgz="${OPENCLAW_CURRENT_PACKAGE_TGZ:?missing OPENCLAW_CURRENT_PACKAGE_TGZ}" +update_target="file:$package_tgz" +candidate_version="$(node - <<'NODE' "$package_tgz" +const { execFileSync } = require("node:child_process"); +const raw = execFileSync("tar", ["-xOf", process.argv[2], "package/package.json"], { + encoding: "utf8", +}); +process.stdout.write(String(JSON.parse(raw).version)); +NODE +)" + +write_config() { + local mode="$1" + node - <<'NODE' "$mode" "$TOKEN" "$PORT" +const fs = require("node:fs"); +const path = require("node:path"); + +const mode = process.argv[2]; +const token = process.argv[3]; +const port = Number(process.argv[4]); +const configPath = path.join(process.env.HOME, ".openclaw", "openclaw.json"); +const config = fs.existsSync(configPath) + ? JSON.parse(fs.readFileSync(configPath, "utf8")) + : {}; + +config.gateway = { + ...(config.gateway || {}), + port, + auth: { mode: "token", token }, + controlUi: { enabled: false }, +}; +config.agents = { + ...(config.agents || {}), + defaults: { + ...(config.agents?.defaults || {}), + model: { primary: "openai/gpt-4.1-mini" }, + }, +}; +config.models = { + ...(config.models || {}), + providers: { + ...(config.models?.providers || {}), + openai: { + ...(config.models?.providers?.openai || {}), + apiKey: process.env.OPENAI_API_KEY, + baseUrl: "https://api.openai.com/v1", + models: [], + }, + }, +}; +config.plugins = { + ...(config.plugins || {}), + enabled: true, +}; +config.channels = { + ...(config.channels || {}), + telegram: { + ...(config.channels?.telegram || {}), + enabled: mode === "telegram", + botToken: "123456:bundled-channel-update-token", + dmPolicy: "disabled", + groupPolicy: "disabled", + }, + discord: { + ...(config.channels?.discord || {}), + enabled: mode === "discord", + dmPolicy: "disabled", + groupPolicy: "disabled", + }, + slack: { + ...(config.channels?.slack || {}), + enabled: mode === "slack", + botToken: "xoxb-bundled-channel-update-token", + appToken: "xapp-bundled-channel-update-token", + }, + feishu: { + ...(config.channels?.feishu || {}), + enabled: mode === "feishu", + }, +}; +if (mode === "memory-lancedb") { + config.plugins = { + ...(config.plugins || {}), + enabled: true, + allow: [...new Set([...(config.plugins?.allow || []), "memory-lancedb"])], + slots: { + ...(config.plugins?.slots || {}), + memory: "memory-lancedb", + }, + entries: { + ...(config.plugins?.entries || {}), + "memory-lancedb": { + ...(config.plugins?.entries?.["memory-lancedb"] || {}), + enabled: true, + config: { + ...(config.plugins?.entries?.["memory-lancedb"]?.config || {}), + embedding: { + ...(config.plugins?.entries?.["memory-lancedb"]?.config?.embedding || {}), + apiKey: process.env.OPENAI_API_KEY, + model: "text-embedding-3-small", + }, + dbPath: "~/.openclaw/memory/lancedb-update-e2e", + autoCapture: false, + autoRecall: false, + }, + }, + }, + }; +} +if (mode === "acpx") { + config.plugins = { + ...(config.plugins || {}), + enabled: true, + allow: + Array.isArray(config.plugins?.allow) && config.plugins.allow.length > 0 + ? [...new Set([...config.plugins.allow, "acpx"])] + : config.plugins?.allow, + entries: { + ...(config.plugins?.entries || {}), + acpx: { + ...(config.plugins?.entries?.acpx || {}), + enabled: true, + }, + }, + }; +} + +fs.mkdirSync(path.dirname(configPath), { recursive: true }); +fs.writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`, "utf8"); +NODE +} + +assert_dep_sentinel() { + local channel="$1" + local dep_path="$2" + local root + local sentinel + root="$(package_root)" + sentinel="$(find_external_dep_package "$dep_path")" + if [ -z "$sentinel" ]; then + echo "missing external dependency sentinel for $channel: $dep_path" >&2 + find "$(stage_root)" -maxdepth 12 -type f | sort | head -120 >&2 || true + exit 1 + fi + assert_no_package_dep_available "$channel" "$dep_path" "$root" +} + +assert_no_dep_sentinel() { + local channel="$1" + local dep_path="$2" + local root + root="$(package_root)" + assert_no_package_dep_available "$channel" "$dep_path" "$root" + if [ -n "$(find_external_dep_package "$dep_path")" ]; then + echo "external dependency sentinel should be absent before repair for $channel: $dep_path" >&2 + exit 1 + fi +} + +assert_no_package_dep_available() { + local channel="$1" + local dep_path="$2" + local root="$3" + for candidate in \ + "$root/dist/extensions/$channel/node_modules/$dep_path/package.json" \ + "$root/dist/extensions/node_modules/$dep_path/package.json" \ + "$root/node_modules/$dep_path/package.json"; do + if [ -f "$candidate" ]; then + echo "packaged install should not mutate package tree for $channel: $candidate" >&2 + exit 1 + fi + done + if [ -f "$HOME/node_modules/$dep_path/package.json" ]; then + echo "bundled runtime deps should not use HOME npm project for $channel: $HOME/node_modules/$dep_path/package.json" >&2 + exit 1 + fi +} + +assert_dep_available() { + local channel="$1" + local dep_path="$2" + local root + local sentinel + root="$(package_root)" + sentinel="$(find_external_dep_package "$dep_path")" + if [ -n "$sentinel" ]; then + assert_no_package_dep_available "$channel" "$dep_path" "$root" + return 0 + fi + echo "missing dependency sentinel for $channel: $dep_path" >&2 + find "$root/dist/extensions/$channel" -maxdepth 3 -type f | sort | head -80 >&2 || true + find "$root/node_modules" -maxdepth 3 -path "*/$dep_path/package.json" -type f -print >&2 || true + find "$(stage_root)" -maxdepth 12 -type f | sort | head -120 >&2 || true + exit 1 +} + +assert_no_dep_available() { + local channel="$1" + local dep_path="$2" + local root + root="$(package_root)" + assert_no_package_dep_available "$channel" "$dep_path" "$root" + if [ -n "$(find_external_dep_package "$dep_path")" ]; then + echo "dependency sentinel should be absent before repair for $channel: $dep_path" >&2 + exit 1 + fi +} + +remove_runtime_dep() { + local channel="$1" + local dep_path="$2" + local root + root="$(package_root)" + rm -rf "$root/dist/extensions/$channel/node_modules" + rm -rf "$root/dist/extensions/node_modules/$dep_path" + rm -rf "$root/node_modules/$dep_path" + rm -rf "$(stage_root)" +} + +assert_update_ok() { + local json_file="$1" + local expected_before="$2" + node - <<'NODE' "$json_file" "$expected_before" "$candidate_version" +const fs = require("node:fs"); +const payload = JSON.parse(fs.readFileSync(process.argv[2], "utf8")); +const expectedBefore = process.argv[3]; +const expectedAfter = process.argv[4]; +if (payload.status !== "ok") { + throw new Error(`expected update status ok, got ${JSON.stringify(payload.status)}`); +} +if (expectedBefore && (payload.before?.version ?? null) !== expectedBefore) { + throw new Error( + `expected before.version ${expectedBefore}, got ${JSON.stringify(payload.before?.version)}`, + ); +} +if ((payload.after?.version ?? null) !== expectedAfter) { + throw new Error( + `expected after.version ${expectedAfter}, got ${JSON.stringify(payload.after?.version)}`, + ); +} +const steps = Array.isArray(payload.steps) ? payload.steps : []; +const doctor = steps.find((step) => step?.name === "openclaw doctor"); +if (!doctor) { + throw new Error("missing openclaw doctor step"); +} +if (Number(doctor.exitCode ?? 1) !== 0) { + throw new Error(`openclaw doctor step failed: ${JSON.stringify(doctor)}`); +} +NODE +} + +run_update_and_capture() { + local label="$1" + local out_file="$2" + set +e + openclaw update --tag "$update_target" --yes --json >"$out_file" 2>"/tmp/openclaw-$label-update.stderr" + local status=$? + set -e + if [ "$status" -ne 0 ]; then + echo "openclaw update failed for $label with exit code $status" >&2 + cat "$out_file" >&2 || true + cat "/tmp/openclaw-$label-update.stderr" >&2 || true + exit "$status" + fi +} + +should_run_update_target() { + local target="$1" + case ",$UPDATE_TARGETS," in + *",all,"* | *",$target,"*) return 0 ;; + *) return 1 ;; + esac +} + +echo "Installing current candidate as update baseline..." +echo "Update targets: $UPDATE_TARGETS" +npm install -g "$package_tgz" --no-fund --no-audit >/tmp/openclaw-update-baseline-install.log 2>&1 +command -v openclaw >/dev/null +poison_home_npm_project +baseline_root="$(package_root)" +test -d "$baseline_root/dist/extensions/telegram" +test -d "$baseline_root/dist/extensions/feishu" +test -d "$baseline_root/dist/extensions/acpx" + +if should_run_update_target telegram; then + echo "Replicating configured Telegram missing-runtime state..." + write_config telegram + assert_no_dep_available telegram grammy + set +e + openclaw doctor --non-interactive >/tmp/openclaw-baseline-doctor.log 2>&1 + baseline_doctor_status=$? + set -e + echo "baseline doctor exited with $baseline_doctor_status" + remove_runtime_dep telegram grammy + assert_no_dep_available telegram grammy + + echo "Updating from baseline to current candidate; candidate doctor must repair Telegram deps..." + run_update_and_capture telegram /tmp/openclaw-update-telegram.json + cat /tmp/openclaw-update-telegram.json + assert_update_ok /tmp/openclaw-update-telegram.json "$candidate_version" + assert_dep_available telegram grammy + assert_no_unknown_stage_roots + + echo "Mutating installed package: remove Telegram deps, then update-mode doctor repairs them..." + remove_runtime_dep telegram grammy + assert_no_dep_available telegram grammy + if ! OPENCLAW_UPDATE_IN_PROGRESS=1 openclaw doctor --non-interactive >/tmp/openclaw-update-mode-doctor.log 2>&1; then + echo "update-mode doctor failed while repairing Telegram deps" >&2 + cat /tmp/openclaw-update-mode-doctor.log >&2 + exit 1 + fi + assert_dep_available telegram grammy + assert_no_unknown_stage_roots +fi + +if should_run_update_target discord; then + echo "Mutating config to Discord and rerunning same-version update path..." + write_config discord + remove_runtime_dep discord discord-api-types + assert_no_dep_available discord discord-api-types + run_update_and_capture discord /tmp/openclaw-update-discord.json + cat /tmp/openclaw-update-discord.json + assert_update_ok /tmp/openclaw-update-discord.json "$candidate_version" + assert_dep_available discord discord-api-types +fi + +if should_run_update_target slack; then + echo "Mutating config to Slack and rerunning same-version update path..." + write_config slack + remove_runtime_dep slack @slack/web-api + assert_no_dep_available slack @slack/web-api + run_update_and_capture slack /tmp/openclaw-update-slack.json + cat /tmp/openclaw-update-slack.json + assert_update_ok /tmp/openclaw-update-slack.json "$candidate_version" + assert_dep_available slack @slack/web-api +fi + +if should_run_update_target feishu; then + echo "Mutating config to Feishu and rerunning same-version update path..." + write_config feishu + remove_runtime_dep feishu @larksuiteoapi/node-sdk + assert_no_dep_available feishu @larksuiteoapi/node-sdk + run_update_and_capture feishu /tmp/openclaw-update-feishu.json + cat /tmp/openclaw-update-feishu.json + assert_update_ok /tmp/openclaw-update-feishu.json "$candidate_version" + assert_dep_available feishu @larksuiteoapi/node-sdk +fi + +if should_run_update_target memory-lancedb; then + echo "Mutating config to memory-lancedb and rerunning same-version update path..." + write_config memory-lancedb + remove_runtime_dep memory-lancedb @lancedb/lancedb + assert_no_dep_available memory-lancedb @lancedb/lancedb + run_update_and_capture memory-lancedb /tmp/openclaw-update-memory-lancedb.json + cat /tmp/openclaw-update-memory-lancedb.json + assert_update_ok /tmp/openclaw-update-memory-lancedb.json "$candidate_version" + assert_dep_available memory-lancedb @lancedb/lancedb +fi + +if should_run_update_target acpx; then + echo "Removing ACPX runtime package and rerunning same-version update path..." + write_config acpx + remove_runtime_dep acpx acpx + assert_no_dep_available acpx acpx + run_update_and_capture acpx /tmp/openclaw-update-acpx.json + cat /tmp/openclaw-update-acpx.json + assert_update_ok /tmp/openclaw-update-acpx.json "$candidate_version" + assert_dep_available acpx acpx +fi + +echo "bundled channel runtime deps Docker update E2E passed" +EOF + then + docker_e2e_print_log "$run_log" + rm -f "$run_log" + exit 1 + fi + + docker_e2e_print_log "$run_log" + rm -f "$run_log" +} From 199d5f765f113f214db742416beb679f50ed9c22 Mon Sep 17 00:00:00 2001 From: Peter Steinberger <steipete@gmail.com> Date: Sun, 26 Apr 2026 23:56:08 +0100 Subject: [PATCH 081/418] docs(test): explain cheap docker reruns --- .agents/skills/openclaw-testing/SKILL.md | 69 ++++++++++++++++++------ docs/ci.md | 2 +- docs/reference/test.md | 2 +- 3 files changed, 55 insertions(+), 18 deletions(-) diff --git a/.agents/skills/openclaw-testing/SKILL.md b/.agents/skills/openclaw-testing/SKILL.md index 8c7c66e2bf4..be0ef3ba2d2 100644 --- a/.agents/skills/openclaw-testing/SKILL.md +++ b/.agents/skills/openclaw-testing/SKILL.md @@ -101,9 +101,11 @@ docker_lanes: install-e2e bundled-channel-update-acpx ``` That skips the three chunk matrix and runs one targeted Docker job against the -prepared GHCR images and the prepared OpenClaw npm tarball. Live-only targeted -reruns skip the E2E images and build only the live-test image. Release-path -normal mode remains max three Docker chunk jobs: +prepared GHCR images and a fresh OpenClaw npm tarball for the selected ref. +Reruns usually need that new tarball because the fix being tested changed the +package contents even if the SHA-tagged GHCR Docker image can be reused. +Live-only targeted reruns skip the E2E images and build only the live-test +image. Release-path normal mode remains max three Docker chunk jobs: - `core` - `package-update` @@ -112,17 +114,50 @@ normal mode remains max three Docker chunk jobs: Docker E2E images never copy repo sources as the app under test: the bare image is a Node/Git runner, and the functional image installs the same prebuilt npm tarball that bare lanes mount. `scripts/package-openclaw-for-docker.mjs` is the -single packer for local scripts and CI. `scripts/test-docker-all.mjs ---plan-json` is the scheduler-owned CI plan for image kind, package, live image, -lane, and credential needs. Docker lane definitions live in the single scenario -catalog `scripts/lib/docker-e2e-scenarios.mjs`; planner logic lives in +single packer for local scripts and CI and validates the tarball inventory +before Docker consumes it. `scripts/test-docker-all.mjs --plan-json` is the +scheduler-owned CI plan for image kind, package, live image, lane, and +credential needs. Docker lane definitions live in the single scenario catalog +`scripts/lib/docker-e2e-scenarios.mjs`; planner logic lives in `scripts/lib/docker-e2e-plan.mjs`. `scripts/docker-e2e.mjs` converts plan and summary JSON into GitHub outputs and step summaries. Every scheduler run writes -`.artifacts/docker-tests/**/summary.json`. Read it +`.artifacts/docker-tests/**/summary.json` plus `failures.json`. Read those before rerunning. Lane entries include `command`, `rerunCommand`, status, timing, timeout state, image kind, and log file path. The summary also includes top-level phase timings for preflight, image build, package prep, lane pools, -and cleanup. +and cleanup. Use `pnpm test:docker:timings <summary.json>` to rank slow lanes +and phases before deciding whether a broader rerun is justified. + +## Cheap Docker Reruns + +First derive the smallest rerun command from artifacts: + +```bash +pnpm test:docker:rerun <github-run-id> +pnpm test:docker:rerun .artifacts/docker-tests/<run>/failures.json +``` + +The script downloads Docker E2E artifacts for a GitHub run, reads +`summary.json`/`failures.json`, and prints a combined targeted workflow command +plus per-lane commands. Prefer the combined targeted command when several lanes +failed for the same patch: + +```bash +gh workflow run openclaw-live-and-e2e-checks-reusable.yml \ + -f ref=<sha> \ + -f include_repo_e2e=false \ + -f include_release_path_suites=false \ + -f include_openwebui=false \ + -f docker_lanes='install-e2e bundled-channel-update-acpx' \ + -f include_live_suites=false \ + -f live_models_only=false +``` + +That path still runs the prepare job, so it creates a new tarball for `<sha>`. +If the SHA-tagged GHCR bare/functional image already exists, CI skips rebuilding +that image and only uploads the fresh package artifact before the targeted lane +job. Do not rerun the full three-chunk release path unless the failed lane list +or touched surface really requires it. ## Docker Expected Timings @@ -158,12 +193,14 @@ lane log/artifacts first, not “run the whole thing again.” ## Failure Workflow 1. Identify exact failing job, SHA, lane, and artifact path. -2. Read `summary.json` and the failed lane log tail. -3. If the lane has `rerunCommand`, use that command as the starting point. -4. For Docker release failures, dispatch `docker_lanes=<failed-lane>` on GitHub - before considering local Docker. -5. Patch narrowly, then rerun the failed file/lane only. -6. Broaden to `pnpm check:changed` or CI only after the isolated proof passes. +2. Read `failures.json`, `summary.json`, and the failed lane log tail. +3. Use `pnpm test:docker:rerun <run-id|failures.json>` to generate targeted + GitHub rerun commands. +4. If the lane has `rerunCommand`, use that only as a local starting point. +5. For Docker release failures, dispatch targeted `docker_lanes=<failed-lane>` + on GitHub before considering local Docker. +6. Patch narrowly, then rerun the failed file/lane only. +7. Broaden to `pnpm check:changed` or CI only after the isolated proof passes. ## When To Escalate @@ -171,6 +208,6 @@ lane log/artifacts first, not “run the whole thing again.” validation. - Build output, lazy imports, package boundaries, or published surfaces: include `pnpm build`. -- Workflow edits: run `actionlint` or equivalent workflow sanity. +- Workflow edits: run `pnpm check:workflows`. - Release branch or tag validation: use release docs and GitHub workflows; avoid local Docker unless Peter explicitly asks. diff --git a/docs/ci.md b/docs/ci.md index 02b8358107a..3118edb835d 100644 --- a/docs/ci.md +++ b/docs/ci.md @@ -92,7 +92,7 @@ Scope logic lives in `scripts/ci-changed-scope.mjs` and is covered by unit tests CI workflow edits validate the Node CI graph plus workflow linting, but do not force Windows, Android, or macOS native builds by themselves; those platform lanes stay scoped to platform source changes. CI routing-only edits, selected cheap core-test fixture edits, and narrow plugin contract helper/test-routing edits use a fast Node-only manifest path: preflight, security, and a single `checks-fast-core` task. That path avoids build artifacts, Node 22 compatibility, channel contracts, full core shards, bundled-plugin shards, and additional guard matrices when the changed files are limited to the routing or helper surfaces that the fast task exercises directly. Windows Node checks are scoped to Windows-specific process/path wrappers, npm/pnpm/UI runner helpers, package manager config, and the CI workflow surfaces that execute that lane; unrelated source, plugin, install-smoke, and test-only changes stay on the Linux Node lanes so they do not reserve a 16-vCPU Windows worker for coverage that is already exercised by the normal test shards. -The separate `install-smoke` workflow reuses the same scope script through its own `preflight` job. It splits smoke coverage into `run_fast_install_smoke` and `run_full_install_smoke`. Pull requests run the fast path for Docker/package surfaces, bundled plugin package/manifest changes, and core plugin/channel/gateway/Plugin SDK surfaces that the Docker smoke jobs exercise. Source-only bundled plugin changes, test-only edits, and docs-only edits do not reserve Docker workers. The fast path builds the root Dockerfile image once, checks the CLI, runs the agents delete shared-workspace CLI smoke, runs the container gateway-network e2e, verifies a bundled extension build arg, and runs the bounded bundled-plugin Docker profile under a 240-second aggregate command timeout with each scenario's Docker run capped separately. The full path keeps QR package install and installer Docker/update coverage for nightly scheduled runs, manual dispatches, workflow-call release checks, and pull requests that truly touch installer/package/Docker surfaces. `main` pushes, including merge commits, do not force the full path; when changed-scope logic would request full coverage on a push, the workflow keeps the fast Docker smoke and leaves the full install smoke to nightly or release validation. The slow Bun global install image-provider smoke is separately gated by `run_bun_global_install_smoke`; it runs on the nightly schedule and from the release checks workflow, and manual `install-smoke` dispatches can opt into it, but pull requests and `main` pushes do not run it. QR and installer Docker tests keep their own install-focused Dockerfiles. Local `test:docker:all` prebuilds one shared live-test image, packs OpenClaw once as an npm tarball, and builds two shared `scripts/e2e/Dockerfile` images: a bare Node/Git runner for installer/update/plugin-dependency lanes and a functional image that installs the same tarball into `/app` for normal functionality lanes. Docker lane definitions live in `scripts/lib/docker-e2e-scenarios.mjs`, planner logic lives in `scripts/lib/docker-e2e-plan.mjs`, and the runner only executes the selected plan. The scheduler selects the image per lane with `OPENCLAW_DOCKER_E2E_BARE_IMAGE` and `OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE`, then runs lanes with `OPENCLAW_SKIP_DOCKER_BUILD=1`; tune the default main-pool slot count of 10 with `OPENCLAW_DOCKER_ALL_PARALLELISM` and the provider-sensitive tail-pool slot count of 10 with `OPENCLAW_DOCKER_ALL_TAIL_PARALLELISM`. Heavy lane caps default to `OPENCLAW_DOCKER_ALL_LIVE_LIMIT=9`, `OPENCLAW_DOCKER_ALL_NPM_LIMIT=10`, and `OPENCLAW_DOCKER_ALL_SERVICE_LIMIT=7` so npm install and multi-service lanes do not overcommit Docker while lighter lanes still fill available slots. Lane starts are staggered by 2 seconds by default to avoid local Docker daemon create storms; override with `OPENCLAW_DOCKER_ALL_START_STAGGER_MS=0` or another millisecond value. The local aggregate preflights Docker, removes stale OpenClaw E2E containers, emits active-lane status, persists lane timings for longest-first ordering, and supports `OPENCLAW_DOCKER_ALL_DRY_RUN=1` for scheduler inspection. It stops scheduling new pooled lanes after the first failure by default, and each lane has a 120-minute fallback timeout overrideable with `OPENCLAW_DOCKER_ALL_LANE_TIMEOUT_MS`; selected live/tail lanes use tighter per-lane caps. `OPENCLAW_DOCKER_ALL_LANES=<lane[,lane]>` runs exact scheduler lanes, including release-only lanes such as `install-e2e` and split bundled update lanes such as `bundled-channel-update-acpx`, while skipping the cleanup smoke so agents can reproduce one failed lane. The reusable live/E2E workflow asks `scripts/test-docker-all.mjs --plan-json` which package, image kind, live image, lane, and credential coverage is required, then `scripts/docker-e2e.mjs` converts that plan into GitHub outputs and summaries. It packs OpenClaw through `scripts/package-openclaw-for-docker.mjs`, builds and pushes one SHA-tagged bare GHCR Docker E2E image when the plan needs install/update/plugin-dependency lanes, and builds one SHA-tagged functional GHCR Docker E2E image when the plan needs package-installed functionality lanes. The release-path Docker suite runs as at most three chunked jobs with `OPENCLAW_SKIP_DOCKER_BUILD=1` so each chunk pulls only the image kind it needs and executes multiple lanes through the same weighted scheduler (`OPENCLAW_DOCKER_ALL_PROFILE=release-path`, `OPENCLAW_DOCKER_ALL_CHUNK=core|package-update|plugins-integrations`). Each chunk uploads `.artifacts/docker-tests/` with lane logs, timings, `summary.json`, phase timings, scheduler plan JSON, and per-lane rerun commands. The workflow `docker_lanes` input runs selected lanes against the prepared images instead of the three chunk jobs, which keeps failed-lane debugging bounded to one targeted Docker job; if a selected lane is a live Docker lane, the targeted job builds the live-test image locally for that rerun. When Open WebUI is requested with the release-path suite, it runs inside the plugins/integrations chunk instead of reserving a fourth Docker worker; Open WebUI keeps a standalone job only for openwebui-only dispatches. The scheduled live/E2E workflow runs the full release-path Docker suite daily. The bundled update matrix is split by update target so repeated npm update and doctor repair passes can shard with other bundled checks. +The separate `install-smoke` workflow reuses the same scope script through its own `preflight` job. It splits smoke coverage into `run_fast_install_smoke` and `run_full_install_smoke`. Pull requests run the fast path for Docker/package surfaces, bundled plugin package/manifest changes, and core plugin/channel/gateway/Plugin SDK surfaces that the Docker smoke jobs exercise. Source-only bundled plugin changes, test-only edits, and docs-only edits do not reserve Docker workers. The fast path builds the root Dockerfile image once, checks the CLI, runs the agents delete shared-workspace CLI smoke, runs the container gateway-network e2e, verifies a bundled extension build arg, and runs the bounded bundled-plugin Docker profile under a 240-second aggregate command timeout with each scenario's Docker run capped separately. The full path keeps QR package install and installer Docker/update coverage for nightly scheduled runs, manual dispatches, workflow-call release checks, and pull requests that truly touch installer/package/Docker surfaces. `main` pushes, including merge commits, do not force the full path; when changed-scope logic would request full coverage on a push, the workflow keeps the fast Docker smoke and leaves the full install smoke to nightly or release validation. The slow Bun global install image-provider smoke is separately gated by `run_bun_global_install_smoke`; it runs on the nightly schedule and from the release checks workflow, and manual `install-smoke` dispatches can opt into it, but pull requests and `main` pushes do not run it. QR and installer Docker tests keep their own install-focused Dockerfiles. Local `test:docker:all` prebuilds one shared live-test image, packs OpenClaw once as an npm tarball, and builds two shared `scripts/e2e/Dockerfile` images: a bare Node/Git runner for installer/update/plugin-dependency lanes and a functional image that installs the same tarball into `/app` for normal functionality lanes. Docker lane definitions live in `scripts/lib/docker-e2e-scenarios.mjs`, planner logic lives in `scripts/lib/docker-e2e-plan.mjs`, and the runner only executes the selected plan. The scheduler selects the image per lane with `OPENCLAW_DOCKER_E2E_BARE_IMAGE` and `OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE`, then runs lanes with `OPENCLAW_SKIP_DOCKER_BUILD=1`; tune the default main-pool slot count of 10 with `OPENCLAW_DOCKER_ALL_PARALLELISM` and the provider-sensitive tail-pool slot count of 10 with `OPENCLAW_DOCKER_ALL_TAIL_PARALLELISM`. Heavy lane caps default to `OPENCLAW_DOCKER_ALL_LIVE_LIMIT=9`, `OPENCLAW_DOCKER_ALL_NPM_LIMIT=10`, and `OPENCLAW_DOCKER_ALL_SERVICE_LIMIT=7` so npm install and multi-service lanes do not overcommit Docker while lighter lanes still fill available slots. Lane starts are staggered by 2 seconds by default to avoid local Docker daemon create storms; override with `OPENCLAW_DOCKER_ALL_START_STAGGER_MS=0` or another millisecond value. The local aggregate preflights Docker, removes stale OpenClaw E2E containers, emits active-lane status, persists lane timings for longest-first ordering, and supports `OPENCLAW_DOCKER_ALL_DRY_RUN=1` for scheduler inspection. It stops scheduling new pooled lanes after the first failure by default, and each lane has a 120-minute fallback timeout overrideable with `OPENCLAW_DOCKER_ALL_LANE_TIMEOUT_MS`; selected live/tail lanes use tighter per-lane caps. `OPENCLAW_DOCKER_ALL_LANES=<lane[,lane]>` runs exact scheduler lanes, including release-only lanes such as `install-e2e` and split bundled update lanes such as `bundled-channel-update-acpx`, while skipping the cleanup smoke so agents can reproduce one failed lane. The reusable live/E2E workflow asks `scripts/test-docker-all.mjs --plan-json` which package, image kind, live image, lane, and credential coverage is required, then `scripts/docker-e2e.mjs` converts that plan into GitHub outputs and summaries. It packs OpenClaw through `scripts/package-openclaw-for-docker.mjs`, validates the tarball inventory, builds and pushes one SHA-tagged bare GHCR Docker E2E image when the plan needs install/update/plugin-dependency lanes, and builds one SHA-tagged functional GHCR Docker E2E image when the plan needs package-installed functionality lanes; if either SHA-tagged image already exists, the workflow skips rebuilding that image but still creates the fresh tarball artifact required by targeted reruns. The release-path Docker suite runs as at most three chunked jobs with `OPENCLAW_SKIP_DOCKER_BUILD=1` so each chunk pulls only the image kind it needs and executes multiple lanes through the same weighted scheduler (`OPENCLAW_DOCKER_ALL_PROFILE=release-path`, `OPENCLAW_DOCKER_ALL_CHUNK=core|package-update|plugins-integrations`). Each chunk uploads `.artifacts/docker-tests/` with lane logs, timings, `summary.json`, `failures.json`, phase timings, scheduler plan JSON, and per-lane rerun commands. The workflow `docker_lanes` input runs selected lanes against the prepared images instead of the three chunk jobs, which keeps failed-lane debugging bounded to one targeted Docker job and prepares a fresh npm tarball for the selected ref; if a selected lane is a live Docker lane, the targeted job builds the live-test image locally for that rerun. Use `pnpm test:docker:rerun <run-id>` to download Docker artifacts from a GitHub run and print combined/per-lane targeted rerun commands; use `pnpm test:docker:timings <summary.json>` for slow-lane and phase critical-path summaries. When Open WebUI is requested with the release-path suite, it runs inside the plugins/integrations chunk instead of reserving a fourth Docker worker; Open WebUI keeps a standalone job only for openwebui-only dispatches. The scheduled live/E2E workflow runs the full release-path Docker suite daily. The bundled update matrix is split by update target so repeated npm update and doctor repair passes can shard with other bundled checks. Local changed-lane logic lives in `scripts/changed-lanes.mjs` and is executed by `scripts/check-changed.mjs`. That local gate is stricter about architecture boundaries than the broad CI platform scope: core production changes run core prod typecheck plus core tests, core test-only changes run only core test typecheck/tests, extension production changes run extension prod typecheck plus extension tests, and extension test-only changes run only extension test typecheck/tests. Public Plugin SDK or plugin-contract changes expand to extension validation because extensions depend on those core contracts. Release metadata-only version bumps run targeted version/config/root-dependency checks. Unknown root/config changes fail safe to all lanes. diff --git a/docs/reference/test.md b/docs/reference/test.md index a5aa8673e71..f8203bb2f9a 100644 --- a/docs/reference/test.md +++ b/docs/reference/test.md @@ -33,7 +33,7 @@ title: "Tests" - Gateway integration: opt-in via `OPENCLAW_TEST_INCLUDE_GATEWAY=1 pnpm test` or `pnpm test:gateway`. - `pnpm test:e2e`: Runs gateway end-to-end smoke tests (multi-instance WS/HTTP/node pairing). Defaults to `threads` + `isolate: false` with adaptive workers in `vitest.e2e.config.ts`; tune with `OPENCLAW_E2E_WORKERS=<n>` and set `OPENCLAW_E2E_VERBOSE=1` for verbose logs. - `pnpm test:live`: Runs provider live tests (minimax/zai). Requires API keys and `LIVE=1` (or provider-specific `*_LIVE_TEST=1`) to unskip. -- `pnpm test:docker:all`: Builds the shared live-test image, packs OpenClaw once as an npm tarball, builds/reuses a bare Node/Git runner image plus a functional image that installs that tarball into `/app`, then runs Docker smoke lanes with `OPENCLAW_SKIP_DOCKER_BUILD=1` through a weighted scheduler. The bare image (`OPENCLAW_DOCKER_E2E_BARE_IMAGE`) is used for installer/update/plugin-dependency lanes; those lanes mount the prebuilt tarball instead of using copied repo sources. The functional image (`OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE`) is used for normal built-app functionality lanes. `scripts/package-openclaw-for-docker.mjs` is the single local/CI package packer. Docker lane definitions live in `scripts/lib/docker-e2e-scenarios.mjs`; planner logic lives in `scripts/lib/docker-e2e-plan.mjs`; `scripts/test-docker-all.mjs` executes the selected plan. `node scripts/test-docker-all.mjs --plan-json` emits the scheduler-owned CI plan for selected lanes, image kinds, package/live-image needs, and credential checks without building or running Docker. `OPENCLAW_DOCKER_ALL_PARALLELISM=<n>` controls process slots and defaults to 10; `OPENCLAW_DOCKER_ALL_TAIL_PARALLELISM=<n>` controls the provider-sensitive tail pool and defaults to 10. Heavy lane caps default to `OPENCLAW_DOCKER_ALL_LIVE_LIMIT=9`, `OPENCLAW_DOCKER_ALL_NPM_LIMIT=10`, and `OPENCLAW_DOCKER_ALL_SERVICE_LIMIT=7`; provider caps default to one heavy lane per provider via `OPENCLAW_DOCKER_ALL_LIVE_CLAUDE_LIMIT=4`, `OPENCLAW_DOCKER_ALL_LIVE_CODEX_LIMIT=4`, and `OPENCLAW_DOCKER_ALL_LIVE_GEMINI_LIMIT=4`. Use `OPENCLAW_DOCKER_ALL_WEIGHT_LIMIT` or `OPENCLAW_DOCKER_ALL_DOCKER_LIMIT` for larger hosts. Lane starts are staggered by 2 seconds by default to avoid local Docker daemon create storms; override with `OPENCLAW_DOCKER_ALL_START_STAGGER_MS=<ms>`. The runner preflights Docker by default, cleans stale OpenClaw E2E containers, emits active-lane status every 30 seconds, shares provider CLI tool caches between compatible lanes, retries transient live-provider failures once by default (`OPENCLAW_DOCKER_ALL_LIVE_RETRIES=<n>`), and stores lane timings in `.artifacts/docker-tests/lane-timings.json` for longest-first ordering on later runs. Use `OPENCLAW_DOCKER_ALL_DRY_RUN=1` to print the lane manifest without running Docker, `OPENCLAW_DOCKER_ALL_STATUS_INTERVAL_MS=<ms>` to tune status output, or `OPENCLAW_DOCKER_ALL_TIMINGS=0` to disable timing reuse. Use `OPENCLAW_DOCKER_ALL_LIVE_MODE=skip` for deterministic/local lanes only or `OPENCLAW_DOCKER_ALL_LIVE_MODE=only` for live-provider lanes only; package aliases are `pnpm test:docker:local:all` and `pnpm test:docker:live:all`. Live-only mode merges main and tail live lanes into one longest-first pool so provider buckets can pack Claude, Codex, and Gemini work together. The runner stops scheduling new pooled lanes after the first failure unless `OPENCLAW_DOCKER_ALL_FAIL_FAST=0` is set, and each lane has a 120-minute fallback timeout overrideable with `OPENCLAW_DOCKER_ALL_LANE_TIMEOUT_MS`; selected live/tail lanes use tighter per-lane caps. CLI backend Docker setup commands have their own timeout via `OPENCLAW_LIVE_CLI_BACKEND_SETUP_TIMEOUT_SECONDS` (default 180). Per-lane logs and `summary.json` phase timings are written under `.artifacts/docker-tests/<run-id>/`. +- `pnpm test:docker:all`: Builds the shared live-test image, packs OpenClaw once as an npm tarball, builds/reuses a bare Node/Git runner image plus a functional image that installs that tarball into `/app`, then runs Docker smoke lanes with `OPENCLAW_SKIP_DOCKER_BUILD=1` through a weighted scheduler. The bare image (`OPENCLAW_DOCKER_E2E_BARE_IMAGE`) is used for installer/update/plugin-dependency lanes; those lanes mount the prebuilt tarball instead of using copied repo sources. The functional image (`OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE`) is used for normal built-app functionality lanes. `scripts/package-openclaw-for-docker.mjs` is the single local/CI package packer and validates the tarball plus `dist/postinstall-inventory.json` before Docker consumes it. Docker lane definitions live in `scripts/lib/docker-e2e-scenarios.mjs`; planner logic lives in `scripts/lib/docker-e2e-plan.mjs`; `scripts/test-docker-all.mjs` executes the selected plan. `node scripts/test-docker-all.mjs --plan-json` emits the scheduler-owned CI plan for selected lanes, image kinds, package/live-image needs, and credential checks without building or running Docker. `OPENCLAW_DOCKER_ALL_PARALLELISM=<n>` controls process slots and defaults to 10; `OPENCLAW_DOCKER_ALL_TAIL_PARALLELISM=<n>` controls the provider-sensitive tail pool and defaults to 10. Heavy lane caps default to `OPENCLAW_DOCKER_ALL_LIVE_LIMIT=9`, `OPENCLAW_DOCKER_ALL_NPM_LIMIT=10`, and `OPENCLAW_DOCKER_ALL_SERVICE_LIMIT=7`; provider caps default to one heavy lane per provider via `OPENCLAW_DOCKER_ALL_LIVE_CLAUDE_LIMIT=4`, `OPENCLAW_DOCKER_ALL_LIVE_CODEX_LIMIT=4`, and `OPENCLAW_DOCKER_ALL_LIVE_GEMINI_LIMIT=4`. Use `OPENCLAW_DOCKER_ALL_WEIGHT_LIMIT` or `OPENCLAW_DOCKER_ALL_DOCKER_LIMIT` for larger hosts. Lane starts are staggered by 2 seconds by default to avoid local Docker daemon create storms; override with `OPENCLAW_DOCKER_ALL_START_STAGGER_MS=<ms>`. The runner preflights Docker by default, cleans stale OpenClaw E2E containers, emits active-lane status every 30 seconds, shares provider CLI tool caches between compatible lanes, retries transient live-provider failures once by default (`OPENCLAW_DOCKER_ALL_LIVE_RETRIES=<n>`), and stores lane timings in `.artifacts/docker-tests/lane-timings.json` for longest-first ordering on later runs. Use `OPENCLAW_DOCKER_ALL_DRY_RUN=1` to print the lane manifest without running Docker, `OPENCLAW_DOCKER_ALL_STATUS_INTERVAL_MS=<ms>` to tune status output, or `OPENCLAW_DOCKER_ALL_TIMINGS=0` to disable timing reuse. Use `OPENCLAW_DOCKER_ALL_LIVE_MODE=skip` for deterministic/local lanes only or `OPENCLAW_DOCKER_ALL_LIVE_MODE=only` for live-provider lanes only; package aliases are `pnpm test:docker:local:all` and `pnpm test:docker:live:all`. Live-only mode merges main and tail live lanes into one longest-first pool so provider buckets can pack Claude, Codex, and Gemini work together. The runner stops scheduling new pooled lanes after the first failure unless `OPENCLAW_DOCKER_ALL_FAIL_FAST=0` is set, and each lane has a 120-minute fallback timeout overrideable with `OPENCLAW_DOCKER_ALL_LANE_TIMEOUT_MS`; selected live/tail lanes use tighter per-lane caps. CLI backend Docker setup commands have their own timeout via `OPENCLAW_LIVE_CLI_BACKEND_SETUP_TIMEOUT_SECONDS` (default 180). Per-lane logs, `summary.json`, `failures.json`, and phase timings are written under `.artifacts/docker-tests/<run-id>/`; use `pnpm test:docker:timings <summary.json>` to inspect slow lanes and `pnpm test:docker:rerun <run-id|summary.json|failures.json>` to print cheap targeted rerun commands. - `pnpm test:docker:browser-cdp-snapshot`: Builds a Chromium-backed source E2E container, starts raw CDP plus an isolated Gateway, runs `browser doctor --deep`, and verifies CDP role snapshots include link URLs, cursor-promoted clickables, iframe refs, and frame metadata. - CLI backend live Docker probes can be run as focused lanes, for example `pnpm test:docker:live-cli-backend:codex`, `pnpm test:docker:live-cli-backend:codex:resume`, or `pnpm test:docker:live-cli-backend:codex:mcp`. Claude and Gemini have matching `:resume` and `:mcp` aliases. - `pnpm test:docker:openwebui`: Starts Dockerized OpenClaw + Open WebUI, signs in through Open WebUI, checks `/api/models`, then runs a real proxied chat through `/api/chat/completions`. Requires a usable live model key (for example OpenAI in `~/.profile`), pulls an external Open WebUI image, and is not expected to be CI-stable like the normal unit/e2e suites. From 89ab39ca640d3589cd6157a77946571d60e18903 Mon Sep 17 00:00:00 2001 From: Peter Steinberger <steipete@gmail.com> Date: Sun, 26 Apr 2026 23:58:09 +0100 Subject: [PATCH 082/418] test: simplify changed test routing --- .agents/skills/openclaw-testing/SKILL.md | 22 ++- docs/ci.md | 5 +- docs/help/testing.md | 15 +- docs/reference/test.md | 7 +- package.json | 1 - scripts/changed-lanes.mjs | 58 +++++-- scripts/check-changed.mjs | 125 +-------------- scripts/test-projects.mjs | 29 +++- scripts/test-projects.test-support.d.mts | 2 +- scripts/test-projects.test-support.mjs | 63 +++----- test/scripts/changed-lanes.test.ts | 188 +++++++++++++++-------- test/scripts/test-projects.test.ts | 104 +++++++++++-- 12 files changed, 340 insertions(+), 279 deletions(-) diff --git a/.agents/skills/openclaw-testing/SKILL.md b/.agents/skills/openclaw-testing/SKILL.md index be0ef3ba2d2..bf6bb6c18e2 100644 --- a/.agents/skills/openclaw-testing/SKILL.md +++ b/.agents/skills/openclaw-testing/SKILL.md @@ -41,9 +41,9 @@ Prove the touched surface first. Do not reflexively run the whole suite. ```bash pnpm changed:lanes --json -pnpm check:changed -pnpm test:changed -pnpm test:changed:focused +pnpm check:changed # changed typecheck/lint/guards; no Vitest +pnpm test:changed # cheap smart changed Vitest targets +OPENCLAW_TEST_CHANGED_BROAD=1 pnpm test:changed pnpm test <path-or-filter> -- --reporter=verbose OPENCLAW_VITEST_MAX_WORKERS=1 pnpm test <path-or-filter> ``` @@ -51,6 +51,22 @@ OPENCLAW_VITEST_MAX_WORKERS=1 pnpm test <path-or-filter> Use targeted file paths whenever possible. Avoid raw `vitest`; use the repo `pnpm test` wrapper so project routing, workers, and setup stay correct. +## Command Semantics + +- `pnpm check` and `pnpm check:changed` do not run Vitest tests. They are for + typecheck, lint, and guard proof. +- `pnpm test` and `pnpm test:changed` run Vitest tests. +- `pnpm test:changed` is intentionally cheap by default: direct test edits, + sibling tests, explicit source mappings, and import-graph dependents. +- `OPENCLAW_TEST_CHANGED_BROAD=1 pnpm test:changed` is the explicit broad + fallback for harness/config/package edits that genuinely need it. +- Do not run extension sweeps just because core changed. If a core edit is for a + specific plugin bug, run that plugin's tests explicitly. If a public SDK or + contract change needs consumer proof, choose the smallest representative + plugin/contract tests first, then broaden only when the risk justifies it. +- The test wrapper prints a short `[test] passed|failed|skipped ... in ...` + line. Vitest's own duration is still the per-shard detail. + ## CI Debugging Start with current run state, not logs for everything: diff --git a/docs/ci.md b/docs/ci.md index 3118edb835d..1387fb4d3e1 100644 --- a/docs/ci.md +++ b/docs/ci.md @@ -94,7 +94,7 @@ CI routing-only edits, selected cheap core-test fixture edits, and narrow plugin Windows Node checks are scoped to Windows-specific process/path wrappers, npm/pnpm/UI runner helpers, package manager config, and the CI workflow surfaces that execute that lane; unrelated source, plugin, install-smoke, and test-only changes stay on the Linux Node lanes so they do not reserve a 16-vCPU Windows worker for coverage that is already exercised by the normal test shards. The separate `install-smoke` workflow reuses the same scope script through its own `preflight` job. It splits smoke coverage into `run_fast_install_smoke` and `run_full_install_smoke`. Pull requests run the fast path for Docker/package surfaces, bundled plugin package/manifest changes, and core plugin/channel/gateway/Plugin SDK surfaces that the Docker smoke jobs exercise. Source-only bundled plugin changes, test-only edits, and docs-only edits do not reserve Docker workers. The fast path builds the root Dockerfile image once, checks the CLI, runs the agents delete shared-workspace CLI smoke, runs the container gateway-network e2e, verifies a bundled extension build arg, and runs the bounded bundled-plugin Docker profile under a 240-second aggregate command timeout with each scenario's Docker run capped separately. The full path keeps QR package install and installer Docker/update coverage for nightly scheduled runs, manual dispatches, workflow-call release checks, and pull requests that truly touch installer/package/Docker surfaces. `main` pushes, including merge commits, do not force the full path; when changed-scope logic would request full coverage on a push, the workflow keeps the fast Docker smoke and leaves the full install smoke to nightly or release validation. The slow Bun global install image-provider smoke is separately gated by `run_bun_global_install_smoke`; it runs on the nightly schedule and from the release checks workflow, and manual `install-smoke` dispatches can opt into it, but pull requests and `main` pushes do not run it. QR and installer Docker tests keep their own install-focused Dockerfiles. Local `test:docker:all` prebuilds one shared live-test image, packs OpenClaw once as an npm tarball, and builds two shared `scripts/e2e/Dockerfile` images: a bare Node/Git runner for installer/update/plugin-dependency lanes and a functional image that installs the same tarball into `/app` for normal functionality lanes. Docker lane definitions live in `scripts/lib/docker-e2e-scenarios.mjs`, planner logic lives in `scripts/lib/docker-e2e-plan.mjs`, and the runner only executes the selected plan. The scheduler selects the image per lane with `OPENCLAW_DOCKER_E2E_BARE_IMAGE` and `OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE`, then runs lanes with `OPENCLAW_SKIP_DOCKER_BUILD=1`; tune the default main-pool slot count of 10 with `OPENCLAW_DOCKER_ALL_PARALLELISM` and the provider-sensitive tail-pool slot count of 10 with `OPENCLAW_DOCKER_ALL_TAIL_PARALLELISM`. Heavy lane caps default to `OPENCLAW_DOCKER_ALL_LIVE_LIMIT=9`, `OPENCLAW_DOCKER_ALL_NPM_LIMIT=10`, and `OPENCLAW_DOCKER_ALL_SERVICE_LIMIT=7` so npm install and multi-service lanes do not overcommit Docker while lighter lanes still fill available slots. Lane starts are staggered by 2 seconds by default to avoid local Docker daemon create storms; override with `OPENCLAW_DOCKER_ALL_START_STAGGER_MS=0` or another millisecond value. The local aggregate preflights Docker, removes stale OpenClaw E2E containers, emits active-lane status, persists lane timings for longest-first ordering, and supports `OPENCLAW_DOCKER_ALL_DRY_RUN=1` for scheduler inspection. It stops scheduling new pooled lanes after the first failure by default, and each lane has a 120-minute fallback timeout overrideable with `OPENCLAW_DOCKER_ALL_LANE_TIMEOUT_MS`; selected live/tail lanes use tighter per-lane caps. `OPENCLAW_DOCKER_ALL_LANES=<lane[,lane]>` runs exact scheduler lanes, including release-only lanes such as `install-e2e` and split bundled update lanes such as `bundled-channel-update-acpx`, while skipping the cleanup smoke so agents can reproduce one failed lane. The reusable live/E2E workflow asks `scripts/test-docker-all.mjs --plan-json` which package, image kind, live image, lane, and credential coverage is required, then `scripts/docker-e2e.mjs` converts that plan into GitHub outputs and summaries. It packs OpenClaw through `scripts/package-openclaw-for-docker.mjs`, validates the tarball inventory, builds and pushes one SHA-tagged bare GHCR Docker E2E image when the plan needs install/update/plugin-dependency lanes, and builds one SHA-tagged functional GHCR Docker E2E image when the plan needs package-installed functionality lanes; if either SHA-tagged image already exists, the workflow skips rebuilding that image but still creates the fresh tarball artifact required by targeted reruns. The release-path Docker suite runs as at most three chunked jobs with `OPENCLAW_SKIP_DOCKER_BUILD=1` so each chunk pulls only the image kind it needs and executes multiple lanes through the same weighted scheduler (`OPENCLAW_DOCKER_ALL_PROFILE=release-path`, `OPENCLAW_DOCKER_ALL_CHUNK=core|package-update|plugins-integrations`). Each chunk uploads `.artifacts/docker-tests/` with lane logs, timings, `summary.json`, `failures.json`, phase timings, scheduler plan JSON, and per-lane rerun commands. The workflow `docker_lanes` input runs selected lanes against the prepared images instead of the three chunk jobs, which keeps failed-lane debugging bounded to one targeted Docker job and prepares a fresh npm tarball for the selected ref; if a selected lane is a live Docker lane, the targeted job builds the live-test image locally for that rerun. Use `pnpm test:docker:rerun <run-id>` to download Docker artifacts from a GitHub run and print combined/per-lane targeted rerun commands; use `pnpm test:docker:timings <summary.json>` for slow-lane and phase critical-path summaries. When Open WebUI is requested with the release-path suite, it runs inside the plugins/integrations chunk instead of reserving a fourth Docker worker; Open WebUI keeps a standalone job only for openwebui-only dispatches. The scheduled live/E2E workflow runs the full release-path Docker suite daily. The bundled update matrix is split by update target so repeated npm update and doctor repair passes can shard with other bundled checks. -Local changed-lane logic lives in `scripts/changed-lanes.mjs` and is executed by `scripts/check-changed.mjs`. That local gate is stricter about architecture boundaries than the broad CI platform scope: core production changes run core prod typecheck plus core tests, core test-only changes run only core test typecheck/tests, extension production changes run extension prod typecheck plus extension tests, and extension test-only changes run only extension test typecheck/tests. Public Plugin SDK or plugin-contract changes expand to extension validation because extensions depend on those core contracts. Release metadata-only version bumps run targeted version/config/root-dependency checks. Unknown root/config changes fail safe to all lanes. +Local changed-lane logic lives in `scripts/changed-lanes.mjs` and is executed by `scripts/check-changed.mjs`. That local check gate is stricter about architecture boundaries than the broad CI platform scope: core production changes run core prod and core test typecheck plus core lint/guards, core test-only changes run only core test typecheck plus core lint, extension production changes run extension prod and extension test typecheck plus extension lint, and extension test-only changes run extension test typecheck plus extension lint. Public Plugin SDK or plugin-contract changes expand to extension typecheck because extensions depend on those core contracts, but Vitest extension sweeps are explicit test work. Release metadata-only version bumps run targeted version/config/root-dependency checks. Unknown root/config changes fail safe to all check lanes. On pushes, the `checks` matrix adds the push-only `compat-node22` lane. On pull requests, that lane is skipped and the matrix stays focused on the normal test/channel lanes. @@ -120,7 +120,7 @@ The CI concurrency key is versioned (`CI-v7-*`) so a GitHub-side zombie in an ol ```bash pnpm changed:lanes # inspect the local changed-lane classifier for origin/main...HEAD -pnpm check:changed # smart local gate: changed typecheck/lint/tests by boundary lane +pnpm check:changed # smart local check gate: changed typecheck/lint/guards by boundary lane pnpm check # fast local gate: production tsgo + sharded lint + parallel fast guards pnpm check:test-types pnpm check:timed # same gate with per-stage timings @@ -128,6 +128,7 @@ pnpm build:strict-smoke pnpm check:architecture pnpm test:gateway:watch-regression pnpm test # vitest tests +pnpm test:changed # cheap smart changed Vitest targets pnpm test:channels pnpm test:contracts:channels pnpm check:docs # docs format + lint + broken links diff --git a/docs/help/testing.md b/docs/help/testing.md index 05374017e9c..8b5cdb338b1 100644 --- a/docs/help/testing.md +++ b/docs/help/testing.md @@ -411,9 +411,9 @@ Think of the suites as “increasing realism” (and increasing flakiness/cost): - Untargeted `pnpm test` runs twelve smaller shard configs (`core-unit-fast`, `core-unit-src`, `core-unit-security`, `core-unit-ui`, `core-unit-support`, `core-support-boundary`, `core-contracts`, `core-bundled`, `core-runtime`, `agentic`, `auto-reply`, `extensions`) instead of one giant native root-project process. This cuts peak RSS on loaded machines and avoids auto-reply/extension work starving unrelated suites. - `pnpm test --watch` still uses the native root `vitest.config.ts` project graph, because a multi-shard watch loop is not practical. - `pnpm test`, `pnpm test:watch`, and `pnpm test:perf:imports` route explicit file/directory targets through scoped lanes first, so `pnpm test extensions/discord/src/monitor/message-handler.preflight.test.ts` avoids paying the full root project startup tax. - - `pnpm test:changed` expands changed git paths into the same scoped lanes when the diff only touches routable source/test files; config/setup edits still fall back to the broad root-project rerun. - - `pnpm check:changed` is the normal smart local gate for narrow work. It classifies the diff into core, core tests, extensions, extension tests, apps, docs, release metadata, live Docker tooling, and tooling, then runs the matching typecheck/lint/test lanes. Public Plugin SDK and plugin-contract changes include one extension validation pass because extensions depend on those core contracts. Release metadata-only version bumps run targeted version/config/root-dependency checks instead of the full suite, with a guard that rejects package changes outside the top-level version field. - - Live Docker ACP harness edits run a focused local gate: shell syntax for the live Docker auth scripts, live Docker scheduler dry-run, ACP bind unit tests, and the ACPX extension tests. `package.json` changes are included only when the diff is limited to `scripts["test:docker:live-*"]`; dependency, export, version, and other package-surface edits still use the broader guards. + - `pnpm test:changed` expands changed git paths into cheap scoped lanes by default: direct test edits, sibling `*.test.ts` files, explicit source mappings, and local import-graph dependents. Config/setup/package edits do not broad-run tests unless you explicitly use `OPENCLAW_TEST_CHANGED_BROAD=1 pnpm test:changed`. + - `pnpm check:changed` is the normal smart local check gate for narrow work. It classifies the diff into core, core tests, extensions, extension tests, apps, docs, release metadata, live Docker tooling, and tooling, then runs the matching typecheck, lint, and guard commands. It does not run Vitest tests; call `pnpm test:changed` or explicit `pnpm test <target>` for test proof. Release metadata-only version bumps run targeted version/config/root-dependency checks, with a guard that rejects package changes outside the top-level version field. + - Live Docker ACP harness edits run focused checks: shell syntax for the live Docker auth scripts and a live Docker scheduler dry-run. `package.json` changes are included only when the diff is limited to `scripts["test:docker:live-*"]`; dependency, export, version, and other package-surface edits still use the broader guards. - Import-light unit tests from agents, commands, plugins, auto-reply helpers, `plugin-sdk`, and similar pure utility areas route through the `unit-fast` lane, which skips `test/setup-openclaw-runtime.ts`; stateful/runtime-heavy files stay on the existing lanes. - Selected `plugin-sdk` and `commands` helper source files also map changed-mode runs to explicit sibling tests in those light lanes, so helper edits avoid rerunning the full heavy suite for that directory. - `auto-reply` has dedicated buckets for top-level core helpers, top-level `reply.*` integration tests, and the `src/auto-reply/reply/**` subtree. CI further splits the reply subtree into agent-runner, dispatch, and commands/state-routing shards so one import-heavy bucket does not own the full Node tail. @@ -458,10 +458,11 @@ Think of the suites as “increasing realism” (and increasing flakiness/cost): - The pre-commit hook is formatting-only. It restages formatted files and does not run lint, typecheck, or tests. - Run `pnpm check:changed` explicitly before handoff or push when you - need the smart local gate. Public Plugin SDK and plugin-contract - changes include one extension validation pass. - - `pnpm test:changed` routes through scoped lanes when the changed paths - map cleanly to a smaller suite. + need the smart local check gate. + - `pnpm test:changed` routes through cheap scoped lanes by default. Use + `OPENCLAW_TEST_CHANGED_BROAD=1 pnpm test:changed` only when the agent + decides a harness, config, package, or contract edit really needs broader + Vitest coverage. - `pnpm test:max` and `pnpm test:changed:max` keep the same routing behavior, just with a higher worker cap. - Local worker auto-scaling is intentionally conservative and backs off diff --git a/docs/reference/test.md b/docs/reference/test.md index f8203bb2f9a..c375b83338c 100644 --- a/docs/reference/test.md +++ b/docs/reference/test.md @@ -10,11 +10,12 @@ title: "Tests" - `pnpm test:force`: Kills any lingering gateway process holding the default control port, then runs the full Vitest suite with an isolated gateway port so server tests don’t collide with a running instance. Use this when a prior gateway run left port 18789 occupied. - `pnpm test:coverage`: Runs the unit suite with V8 coverage (via `vitest.unit.config.ts`). This is a loaded-file unit coverage gate, not whole-repo all-file coverage. Thresholds are 70% lines/functions/statements and 55% branches. Because `coverage.all` is false, the gate measures files loaded by the unit coverage suite instead of treating every split-lane source file as uncovered. - `pnpm test:coverage:changed`: Runs unit coverage only for files changed since `origin/main`. -- `pnpm test:changed`: expands changed git paths into scoped Vitest lanes when the diff only touches routable source/test files. Config/setup changes still fall back to the native root projects run so wiring edits rerun broadly when needed. -- `pnpm test:changed:focused`: inner-loop changed test run. It only runs precise targets from direct test edits, sibling `*.test.ts` files, explicit source mappings, and the local import graph. Broad/config/package changes are skipped instead of expanding to the full changed-test fallback. +- `pnpm test:changed`: cheap smart changed test run. It runs precise targets from direct test edits, sibling `*.test.ts` files, explicit source mappings, and the local import graph. Broad/config/package changes are skipped unless they map to precise tests. +- `OPENCLAW_TEST_CHANGED_BROAD=1 pnpm test:changed`: explicit broad changed test run. Use it when a test harness/config/package edit should fall back to Vitest's broader changed-test behavior. - `pnpm changed:lanes`: shows the architectural lanes triggered by the diff against `origin/main`. -- `pnpm check:changed`: runs the smart changed gate for the diff against `origin/main`. It runs core work with core test lanes, extension work with extension test lanes, test-only work with test typecheck/tests only, expands public Plugin SDK or plugin-contract changes to one extension validation pass, and keeps release metadata-only version bumps on targeted version/config/root-dependency checks. +- `pnpm check:changed`: runs the smart changed check gate for the diff against `origin/main`. It runs typecheck, lint, and guard commands for the affected architectural lanes, but does not run Vitest tests. Use `pnpm test:changed` or explicit `pnpm test <target>` for test proof. - `pnpm test`: routes explicit file/directory targets through scoped Vitest lanes. Untargeted runs use fixed shard groups and expand to leaf configs for local parallel execution; the extension group always expands to the per-extension shard configs instead of one giant root-project process. +- Test wrapper runs end with a short `[test] passed|failed|skipped ... in ...` summary. Vitest's own duration line stays the per-shard detail. - Full, extension, and include-pattern shard runs update local timing data in `.artifacts/vitest-shard-timings.json`; later whole-config runs use those timings to balance slow and fast shards. Include-pattern CI shards append the shard name to the timing key, which keeps filtered shard timings visible without replacing whole-config timing data. Set `OPENCLAW_TEST_PROJECTS_TIMINGS=0` to ignore the local timing artifact. - Selected `plugin-sdk` and `commands` test files now route through dedicated light lanes that keep only `test/setup.ts`, leaving runtime-heavy cases on their existing lanes. - Source files with sibling tests map to that sibling before falling back to wider directory globs. Helper edits under `test/helpers/channels` and `test/helpers/plugins` use a local import graph to run importing tests instead of broad-running every shard when the dependency path is precise. diff --git a/package.json b/package.json index 607c298b14d..bc630dc9596 100644 --- a/package.json +++ b/package.json @@ -1480,7 +1480,6 @@ "test:build:singleton": "node scripts/test-built-plugin-singleton.mjs", "test:bundled": "node scripts/run-vitest.mjs run --config test/vitest/vitest.bundled.config.ts", "test:changed": "node scripts/test-projects.mjs --changed origin/main", - "test:changed:focused": "OPENCLAW_TEST_CHANGED_FOCUSED=1 node scripts/test-projects.mjs --changed origin/main", "test:changed:max": "OPENCLAW_VITEST_MAX_WORKERS=8 node scripts/test-projects.mjs --changed origin/main", "test:channels": "node scripts/run-vitest.mjs run --config test/vitest/vitest.channels.config.ts", "test:contracts": "pnpm test:contracts:channels && pnpm test:contracts:plugins", diff --git a/scripts/changed-lanes.mjs b/scripts/changed-lanes.mjs index fdf25890412..7790cb4ee06 100644 --- a/scripts/changed-lanes.mjs +++ b/scripts/changed-lanes.mjs @@ -67,7 +67,7 @@ export function createEmptyChangedLanes() { /** * @param {string[]} changedPaths - * @param {{ packageJsonChangeKind?: "liveDockerTooling" | null }} [options] + * @param {{ packageJsonChangeKind?: "liveDockerTooling" | "tooling" | null }} [options] * @returns {ChangedLaneResult} */ export function detectChangedLanes(changedPaths, options = {}) { @@ -80,6 +80,8 @@ export function detectChangedLanes(changedPaths, options = {}) { let hasNonDocs = false; const packageJsonIsLiveDockerTooling = paths.includes("package.json") && options.packageJsonChangeKind === "liveDockerTooling"; + const packageJsonIsTooling = + paths.includes("package.json") && options.packageJsonChangeKind === "tooling"; if (paths.length === 0) { reasons.push("no changed paths"); @@ -88,6 +90,7 @@ export function detectChangedLanes(changedPaths, options = {}) { if ( !packageJsonIsLiveDockerTooling && + !packageJsonIsTooling && paths.some((changedPath) => RELEASE_METADATA_PATHS.has(changedPath)) && paths.every( (changedPath) => RELEASE_METADATA_PATHS.has(changedPath) || DOCS_PATH_RE.test(changedPath), @@ -115,6 +118,12 @@ export function detectChangedLanes(changedPaths, options = {}) { continue; } + if (changedPath === "package.json" && packageJsonIsTooling) { + lanes.tooling = true; + reasons.push(`${changedPath}: package scripts`); + continue; + } + if (LIVE_DOCKER_TOOLING_PATH_RE.test(changedPath)) { lanes.liveDockerTooling = true; reasons.push(`${changedPath}: live Docker tooling surface`); @@ -195,39 +204,42 @@ export function detectChangedLanes(changedPaths, options = {}) { } /** - * @param {{ base: string; head?: string; includeWorktree?: boolean }} params + * @param {{ base: string; head?: string; includeWorktree?: boolean; cwd?: string }} params * @returns {string[]} */ export function listChangedPathsFromGit(params) { const base = params.base; const head = params.head ?? "HEAD"; + const cwd = params.cwd ?? process.cwd(); if (!base) { return []; } - const rangePaths = runGitNameOnlyDiff([`${base}...${head}`]); + const rangePaths = runGitNameOnlyDiff([`${base}...${head}`], cwd); if (params.includeWorktree === false) { return rangePaths; } return [ ...new Set([ ...rangePaths, - ...runGitNameOnlyDiff(["--cached", "--diff-filter=ACMR"]), - ...runGitNameOnlyDiff(["--diff-filter=ACMR"]), - ...runGitLsFiles(["--others", "--exclude-standard"]), + ...runGitNameOnlyDiff(["--cached", "--diff-filter=ACMR"], cwd), + ...runGitNameOnlyDiff(["--diff-filter=ACMR"], cwd), + ...runGitLsFiles(["--others", "--exclude-standard"], cwd), ]), ].toSorted((left, right) => left.localeCompare(right)); } -function runGitNameOnlyDiff(extraArgs) { +function runGitNameOnlyDiff(extraArgs, cwd = process.cwd()) { const output = execFileSync("git", ["diff", "--name-only", ...extraArgs], { + cwd, stdio: ["ignore", "pipe", "pipe"], encoding: "utf8", }); return output.split("\n").map(normalizeChangedPath).filter(Boolean); } -function runGitLsFiles(extraArgs) { +function runGitLsFiles(extraArgs, cwd = process.cwd()) { const output = execFileSync("git", ["ls-files", ...extraArgs], { + cwd, stdio: ["ignore", "pipe", "pipe"], encoding: "utf8", }); @@ -245,7 +257,10 @@ export function listStagedChangedPaths() { export function classifyPackageJsonChangeFromGit(params) { try { const { before, after } = readPackageJsonBeforeAfter(params); - return isLiveDockerPackageScriptOnlyChange(before, after) ? "liveDockerTooling" : null; + if (isLiveDockerPackageScriptOnlyChange(before, after)) { + return "liveDockerTooling"; + } + return isPackageScriptOnlyChange(before, after) ? "tooling" : null; } catch { return null; } @@ -265,6 +280,20 @@ export function isLiveDockerPackageScriptOnlyChange(before, after) { ); } +export function isPackageScriptOnlyChange(before, after) { + const beforePackage = JSON.parse(before); + const afterPackage = JSON.parse(after); + const beforeScripts = extractPackageScripts(beforePackage); + const afterScripts = extractPackageScripts(afterPackage); + const beforeStripped = stripPackageScripts(beforePackage); + const afterStripped = stripPackageScripts(afterPackage); + + return ( + stableJson(beforeStripped) === stableJson(afterStripped) && + stableJson(beforeScripts) !== stableJson(afterScripts) + ); +} + function readPackageJsonBeforeAfter(params) { const before = readGitText(params.staged ? "HEAD" : params.base, "package.json"); if (params.staged) { @@ -317,6 +346,17 @@ function stripLiveDockerPackageScripts(packageJson) { return clone; } +function extractPackageScripts(packageJson) { + const scripts = packageJson?.scripts; + return scripts && typeof scripts === "object" && !Array.isArray(scripts) ? scripts : {}; +} + +function stripPackageScripts(packageJson) { + const clone = JSON.parse(JSON.stringify(packageJson)); + delete clone.scripts; + return clone; +} + function stableJson(value) { if (Array.isArray(value)) { return `[${value.map(stableJson).join(",")}]`; diff --git a/scripts/check-changed.mjs b/scripts/check-changed.mjs index f8a5df47902..75e5df7c9ec 100644 --- a/scripts/check-changed.mjs +++ b/scripts/check-changed.mjs @@ -14,12 +14,7 @@ import { } from "./lib/local-heavy-check-runtime.mjs"; import { runManagedCommand } from "./lib/managed-child-process.mjs"; import { createSparseTsgoSkipEnv } from "./lib/tsgo-sparse-guard.mjs"; -import { isCiLikeEnv } from "./lib/vitest-local-scheduling.mjs"; -import { resolveChangedTestTargetPlan } from "./test-projects.test-support.mjs"; -export const CHANGED_CHECK_VITEST_NO_OUTPUT_TIMEOUT_MS = "600000"; -const VITEST_NO_OUTPUT_TIMEOUT_ENV_KEY = "OPENCLAW_VITEST_NO_OUTPUT_TIMEOUT_MS"; -const VITEST_NO_OUTPUT_RETRY_ENV_KEY = "OPENCLAW_VITEST_NO_OUTPUT_RETRY"; const LIVE_DOCKER_AUTH_SHELL_TARGETS = [ "scripts/lib/live-docker-auth.sh", "scripts/test-live-acp-bind-docker.sh", @@ -39,35 +34,6 @@ export function createChangedCheckChildEnv(baseEnv = process.env) { }; } -export function createChangedCheckVitestEnv(baseEnv = process.env) { - const resolvedBaseEnv = createChangedCheckChildEnv(baseEnv); - const env = { - ...resolvedBaseEnv, - [VITEST_NO_OUTPUT_TIMEOUT_ENV_KEY]: - resolvedBaseEnv[VITEST_NO_OUTPUT_TIMEOUT_ENV_KEY]?.trim() || - CHANGED_CHECK_VITEST_NO_OUTPUT_TIMEOUT_MS, - [VITEST_NO_OUTPUT_RETRY_ENV_KEY]: - resolvedBaseEnv[VITEST_NO_OUTPUT_RETRY_ENV_KEY]?.trim() || "0", - }; - - const hasWorkerOverride = Boolean( - (resolvedBaseEnv.OPENCLAW_VITEST_MAX_WORKERS ?? resolvedBaseEnv.OPENCLAW_TEST_WORKERS)?.trim(), - ); - const hasParallelOverride = Boolean(resolvedBaseEnv.OPENCLAW_TEST_PROJECTS_PARALLEL?.trim()); - const serialOverride = resolvedBaseEnv.OPENCLAW_TEST_PROJECTS_SERIAL?.trim(); - if ( - !isCiLikeEnv(resolvedBaseEnv) && - !hasWorkerOverride && - !hasParallelOverride && - serialOverride !== "0" - ) { - env.OPENCLAW_TEST_PROJECTS_SERIAL = serialOverride || "1"; - env.OPENCLAW_VITEST_MAX_WORKERS = "1"; - } - - return env; -} - export function createChangedCheckPlan(result, options = {}) { const commands = []; const baseEnv = createChangedCheckChildEnv(options.env ?? process.env); @@ -93,10 +59,6 @@ export function createChangedCheckPlan(result, options = {}) { if (result.docsOnly) { return { commands, - testTargets: [], - runChangedTestsBroad: false, - runFullTests: false, - runExtensionTests: false, summary: "docs-only", }; } @@ -118,10 +80,6 @@ export function createChangedCheckPlan(result, options = {}) { add("root dependency ownership", ["deps:root-ownership:check"]); return { commands, - testTargets: [], - runChangedTestsBroad: false, - runFullTests: false, - runExtensionTests: false, summary: "release metadata", }; } @@ -132,10 +90,6 @@ export function createChangedCheckPlan(result, options = {}) { add("runtime import cycles", ["check:import-cycles"]); return { commands, - testTargets: [], - runChangedTestsBroad: false, - runFullTests: true, - runExtensionTests: false, summary: "all", }; } @@ -189,26 +143,10 @@ export function createChangedCheckPlan(result, options = {}) { OPENCLAW_DOCKER_ALL_DRY_RUN: "1", OPENCLAW_DOCKER_ALL_LIVE_MODE: "only", }); - add( - "ACP bind unit tests", - ["test", "src/gateway/live-agent-probes.test.ts", "src/agents/acp-spawn.test.ts"], - createChangedCheckVitestEnv(baseEnv), - ); - add("ACPX extension tests", ["test:extension", "acpx"], createChangedCheckVitestEnv(baseEnv)); } - const testPlan = resolveChangedTestTargetPlan(result.paths); - const runExtensionTests = result.extensionImpactFromCore; - const testTargets = runExtensionTests - ? testPlan.targets.filter((target) => target !== "extensions") - : testPlan.targets; - const runChangedTestsBroad = testPlan.mode === "broad"; return { commands, - testTargets, - runChangedTestsBroad, - runFullTests: false, - runExtensionTests, summary: Object.entries(lanes) .filter(([, enabled]) => enabled) .map(([lane]) => lane) @@ -244,61 +182,6 @@ export async function runChangedCheck(result, options = {}) { } } - if (plan.runFullTests) { - const status = await runPnpm( - { name: "tests all", args: ["test"], env: createChangedCheckVitestEnv(childEnv) }, - timings, - ); - if (status !== 0) { - printSummary(timings, options); - return status; - } - } else if (plan.runChangedTestsBroad) { - const testArgs = options.explicitPaths - ? ["test"] - : ["test", "--changed", options.base ?? "origin/main"]; - const status = await runPnpm( - { - name: options.explicitPaths ? "tests all" : "tests changed broad", - args: testArgs, - env: createChangedCheckVitestEnv(childEnv), - }, - timings, - ); - if (status !== 0) { - printSummary(timings, options); - return status; - } - } else if (plan.testTargets.length > 0) { - const status = await runPnpm( - { - name: "tests changed", - args: ["test", ...plan.testTargets], - env: createChangedCheckVitestEnv(childEnv), - }, - timings, - ); - if (status !== 0) { - printSummary(timings, options); - return status; - } - } - - if (plan.runExtensionTests) { - const status = await runPnpm( - { - name: "tests extensions", - args: ["test:extensions"], - env: createChangedCheckVitestEnv(childEnv), - }, - timings, - ); - if (status !== 0) { - printSummary(timings, options); - return status; - } - } - printSummary(timings, options); return 0; } finally { @@ -314,17 +197,11 @@ function printPlan(result, plan, options) { const prefix = options.dryRun ? "[check:changed:dry-run]" : "[check:changed]"; console.error(`${prefix} lanes=${plan.summary || "none"}`); if (result.extensionImpactFromCore) { - console.error(`${prefix} core contract changed; extension tests included`); - } - if (plan.runChangedTestsBroad) { - console.error(`${prefix} broad changed tests included`); + console.error(`${prefix} extension-impacting surface; extension typecheck included`); } for (const reason of result.reasons) { console.error(`${prefix} ${reason}`); } - if (plan.testTargets.length > 0) { - console.error(`${prefix} test targets=${plan.testTargets.length}`); - } } async function runPnpm(command, timings) { diff --git a/scripts/test-projects.mjs b/scripts/test-projects.mjs index 832db912b0a..571df0a8743 100644 --- a/scripts/test-projects.mjs +++ b/scripts/test-projects.mjs @@ -1,5 +1,6 @@ import fs from "node:fs"; import { performance } from "node:perf_hooks"; +import { formatMs } from "./lib/check-timing-summary.mjs"; import { acquireLocalHeavyCheckLockSync } from "./lib/local-heavy-check-runtime.mjs"; import { isCiLikeEnv, @@ -271,6 +272,7 @@ async function runVitestSpecsParallel(specs, concurrency) { } async function main() { + const suiteStartedAt = performance.now(); const args = process.argv.slice(2); const baseEnv = resolveLocalVitestEnv(process.env); const { targetArgs } = parseTestProjectsArgs(args, process.cwd()); @@ -309,6 +311,7 @@ async function main() { if (runSpecs.length === 0) { console.error("[test] no changed test targets; skipping Vitest."); + printTestSummary("skipped", 0, performance.now() - suiteStartedAt); return; } @@ -360,8 +363,11 @@ async function main() { concurrency, ); writeShardTimings(timings, process.cwd(), baseEnv); - console.error( - `[test] completed ${parallelSpecs.length} Vitest shards; Vitest summaries above are per-shard, not aggregate totals.`, + printTestSummary( + parallelExitCode === 0 ? "passed" : "failed", + parallelSpecs.length, + performance.now() - suiteStartedAt, + "Vitest summaries above are per-shard, not aggregate totals.", ); releaseLockOnce(); if (parallelExitCode !== 0) { @@ -378,18 +384,24 @@ async function main() { if (!result) { return; } + if (result.timing) { + timings.push(result.timing); + } if (result.code !== 0) { exitCode = exitCode || result.code; if (spec.continueOnFailure !== true) { + printTestSummary("failed", timings.length, performance.now() - suiteStartedAt); releaseLockOnce(); process.exit(result.code); } } - if (result.timing) { - timings.push(result.timing); - } } writeShardTimings(timings, process.cwd(), baseEnv); + printTestSummary( + exitCode === 0 ? "passed" : "failed", + timings.length, + performance.now() - suiteStartedAt, + ); releaseLockOnce(); if (exitCode !== 0) { @@ -397,6 +409,13 @@ async function main() { } } +function printTestSummary(status, shardCount, durationMs, detail) { + const suffix = detail ? `; ${detail}` : ""; + console.error( + `[test] ${status} ${shardCount} Vitest shard${shardCount === 1 ? "" : "s"} in ${formatMs(durationMs)}${suffix}`, + ); +} + main().catch((error) => { releaseLockOnce(); console.error(error); diff --git a/scripts/test-projects.test-support.d.mts b/scripts/test-projects.test-support.d.mts index 65e7f861d67..008b5a5c04d 100644 --- a/scripts/test-projects.test-support.d.mts +++ b/scripts/test-projects.test-support.d.mts @@ -17,7 +17,7 @@ export type VitestRunSpec = { export type ChangedTestTargetOptions = { cwd?: string; env?: Record<string, string | undefined>; - focused?: boolean; + broad?: boolean; }; export const DEFAULT_TEST_PROJECTS_VITEST_NO_OUTPUT_TIMEOUT_MS: string; diff --git a/scripts/test-projects.test-support.mjs b/scripts/test-projects.test-support.mjs index 098afc803d1..c2a48ea397e 100644 --- a/scripts/test-projects.test-support.mjs +++ b/scripts/test-projects.test-support.mjs @@ -1,4 +1,3 @@ -import { execFileSync } from "node:child_process"; import fs from "node:fs"; import os from "node:os"; import path from "node:path"; @@ -40,7 +39,10 @@ import { isBoundaryTestFile, isBundledPluginDependentUnitTestFile, } from "../test/vitest/vitest.unit-paths.mjs"; -import { detectChangedLanes } from "./changed-lanes.mjs"; +import { + detectChangedLanes, + listChangedPathsFromGit as listChangedPathsFromGitSource, +} from "./changed-lanes.mjs"; import { isCiLikeEnv, resolveLocalFullSuiteProfile } from "./lib/vitest-local-scheduling.mjs"; import { resolveVitestCliEntry, resolveVitestNodeArgs } from "./run-vitest.mjs"; @@ -207,7 +209,7 @@ const VITEST_CONFIG_BY_KIND = { utils: UTILS_VITEST_CONFIG, wizard: WIZARD_VITEST_CONFIG, }; -const BROAD_CHANGED_RERUN_PATTERNS = [ +const BROAD_CHANGED_FALLBACK_PATTERNS = [ /^package\.json$/u, /^pnpm-lock\.yaml$/u, /^test\/setup(?:\.shared|\.extensions|-openclaw-runtime)?\.ts$/u, @@ -305,7 +307,7 @@ const SOURCE_ROOTS_FOR_IMPORT_GRAPH = ["src", "extensions", "packages", "ui/src" const IMPORTABLE_FILE_EXTENSIONS = [".ts", ".tsx", ".mts", ".cts"]; const IMPORT_SPECIFIER_PATTERN = /\b(?:import|export)\s+(?:type\s+)?(?:[^'"]*?\s+from\s+)?["']([^"']+)["']|\bimport\s*\(\s*["']([^"']+)["']\s*\)/gu; -const FOCUSED_CHANGED_ENV_KEY = "OPENCLAW_TEST_CHANGED_FOCUSED"; +const BROAD_CHANGED_ENV_KEY = "OPENCLAW_TEST_CHANGED_BROAD"; const VITEST_NO_OUTPUT_TIMEOUT_ENV_KEY = "OPENCLAW_VITEST_NO_OUTPUT_TIMEOUT_MS"; const VITEST_NO_OUTPUT_RETRY_ENV_KEY = "OPENCLAW_VITEST_NO_OUTPUT_RETRY"; export const DEFAULT_TEST_PROJECTS_VITEST_NO_OUTPUT_TIMEOUT_MS = "180000"; @@ -594,36 +596,7 @@ function resolveChannelContractTargetKind(relative) { } function listChangedPathsFromGit(baseRef, cwd) { - return [ - ...new Set([ - ...runGitNameOnlyDiff(cwd, [`${baseRef}...HEAD`]), - ...runGitNameOnlyDiff(cwd, ["--cached", "--diff-filter=ACMR"]), - ...runGitNameOnlyDiff(cwd, ["--diff-filter=ACMR"]), - ...runGitLsFiles(cwd, ["--others", "--exclude-standard"]), - ]), - ].toSorted((left, right) => left.localeCompare(right)); -} - -function runGitNameOnlyDiff(cwd, extraArgs) { - return execFileSync("git", ["diff", "--name-only", ...extraArgs], { - cwd, - encoding: "utf8", - stdio: ["ignore", "pipe", "pipe"], - }) - .split("\n") - .map((line) => normalizePathPattern(line.trim())) - .filter((line) => line.length > 0); -} - -function runGitLsFiles(cwd, extraArgs) { - return execFileSync("git", ["ls-files", ...extraArgs], { - cwd, - encoding: "utf8", - stdio: ["ignore", "pipe", "pipe"], - }) - .split("\n") - .map((line) => normalizePathPattern(line.trim())) - .filter((line) => line.length > 0); + return listChangedPathsFromGitSource({ base: baseRef, cwd }); } function extractChangedBaseRef(args) { @@ -665,7 +638,7 @@ function shouldKeepBroadChangedRun(changedPaths) { return changedPaths.some((changedPath) => PRECISE_SOURCE_TEST_TARGETS.has(changedPath) ? false - : BROAD_CHANGED_RERUN_PATTERNS.some((pattern) => pattern.test(changedPath)), + : BROAD_CHANGED_FALLBACK_PATTERNS.some((pattern) => pattern.test(changedPath)), ); } @@ -685,8 +658,8 @@ function resolveToolingTestTargets(changedPath) { return TOOLING_SOURCE_TEST_TARGETS.get(changedPath) ?? TOOLING_TEST_TARGETS.get(changedPath); } -function shouldUseFocusedChangedTargets(env = process.env) { - const value = env[FOCUSED_CHANGED_ENV_KEY]?.trim().toLowerCase(); +function shouldUseBroadChangedTargets(env = process.env) { + const value = env[BROAD_CHANGED_ENV_KEY]?.trim().toLowerCase(); return ["1", "true", "yes", "on"].includes(value ?? ""); } @@ -741,7 +714,8 @@ export function resolveChangedTestTargetPlan(changedPaths, options = {}) { return { mode: "targets", targets: toolingTargets }; } const changedLanes = detectChangedLanes(changedPaths); - const focused = options.focused ?? shouldUseFocusedChangedTargets(options.env ?? {}); + const env = options.env ?? {}; + const useBroadFallback = options.broad ?? shouldUseBroadChangedTargets(env); const targets = []; for (const changedPath of changedPaths) { const preciseTargets = resolvePreciseChangedTestTargets(changedPath, options); @@ -749,20 +723,21 @@ export function resolveChangedTestTargetPlan(changedPaths, options = {}) { targets.push(...preciseTargets); continue; } - if (focused) { + const needsBroadFallback = shouldKeepBroadChangedRun([changedPath]) || changedLanes.lanes.all; + if (needsBroadFallback) { + if (useBroadFallback) { + return { mode: "broad", targets: [] }; + } continue; } - if (shouldKeepBroadChangedRun([changedPath]) || changedLanes.lanes.all) { - return { mode: "broad", targets: [] }; - } if (isRoutableChangedTarget(changedPath)) { targets.push(changedPath); } } - if (!focused && changedLanes.lanes.all) { + if (useBroadFallback && changedLanes.lanes.all) { return { mode: "broad", targets: [] }; } - if (!focused && changedLanes.extensionImpactFromCore) { + if (useBroadFallback && changedLanes.extensionImpactFromCore) { targets.push("extensions"); } return { mode: "targets", targets: [...new Set(targets)] }; diff --git a/test/scripts/changed-lanes.test.ts b/test/scripts/changed-lanes.test.ts index f29d3ae64bc..ab014980a8d 100644 --- a/test/scripts/changed-lanes.test.ts +++ b/test/scripts/changed-lanes.test.ts @@ -5,12 +5,11 @@ import { afterEach, describe, expect, it } from "vitest"; import { detectChangedLanes, isLiveDockerPackageScriptOnlyChange, + isPackageScriptOnlyChange, } from "../../scripts/changed-lanes.mjs"; import { - CHANGED_CHECK_VITEST_NO_OUTPUT_TIMEOUT_MS, createChangedCheckChildEnv, createChangedCheckPlan, - createChangedCheckVitestEnv, } from "../../scripts/check-changed.mjs"; import { cleanupTempDirs, makeTempRepoRoot } from "../helpers/temp-repo.js"; @@ -216,8 +215,8 @@ describe("scripts/changed-lanes", () => { extensionTests: true, all: false, }); - expect(plan.runExtensionTests).toBe(true); - expect(plan.testTargets).toEqual(["src/plugin-sdk/core.test.ts"]); + expect(plan.commands.map((command) => command.args[0])).toContain("tsgo:extensions"); + expect(plan.commands.map((command) => command.args[0])).toContain("tsgo:extensions:test"); }); it("fails safe for root config changes", () => { @@ -225,8 +224,8 @@ describe("scripts/changed-lanes", () => { const plan = createChangedCheckPlan(result); expect(result.lanes.all).toBe(true); - expect(plan.runFullTests).toBe(true); expect(plan.commands.map((command) => command.args[0])).toContain("tsgo:all"); + expect(plan.commands.map((command) => command.args[0])).not.toContain("test"); }); it("routes gitignore changes to tooling instead of all lanes", () => { @@ -237,10 +236,9 @@ describe("scripts/changed-lanes", () => { tooling: true, all: false, }); - expect(plan.runFullTests).toBe(false); - expect(plan.runChangedTestsBroad).toBe(false); expect(plan.commands.map((command) => command.args[0])).toContain("lint:scripts"); expect(plan.commands.map((command) => command.args[0])).not.toContain("tsgo:all"); + expect(plan.commands.map((command) => command.args[0])).not.toContain("test"); }); it("routes live Docker ACP tooling changes through a focused gate", () => { @@ -258,8 +256,6 @@ describe("scripts/changed-lanes", () => { all: false, tooling: false, }); - expect(plan.runFullTests).toBe(false); - expect(plan.runChangedTestsBroad).toBe(false); expect(plan.commands.map((command) => command.name)).toEqual([ "conflict markers", "typecheck core tests", @@ -267,8 +263,6 @@ describe("scripts/changed-lanes", () => { "lint scripts", "live Docker shell syntax", "live Docker scheduler dry run", - "ACP bind unit tests", - "ACPX extension tests", ]); expect( plan.commands.find((command) => command.name === "live Docker shell syntax"), @@ -330,7 +324,6 @@ describe("scripts/changed-lanes", () => { releaseMetadata: false, all: false, }); - expect(plan.runFullTests).toBe(false); expect(plan.commands.map((command) => command.name)).toContain("live Docker scheduler dry run"); }); @@ -400,6 +393,77 @@ describe("scripts/changed-lanes", () => { }); }); + it("classifies normal package script changes from the git diff", () => { + const dir = makeTempRepoRoot(tempDirs, "openclaw-package-scripts-"); + git(dir, ["init", "-q", "--initial-branch=main"]); + writeFileSync( + path.join(dir, "package.json"), + `${JSON.stringify( + { + name: "fixture", + scripts: { + test: "node scripts/test-projects.mjs", + }, + dependencies: { + leftpad: "1.0.0", + }, + }, + null, + 2, + )}\n`, + "utf8", + ); + git(dir, ["add", "package.json"]); + git(dir, [ + "-c", + "user.email=test@example.com", + "-c", + "user.name=Test User", + "commit", + "-q", + "-m", + "initial", + ]); + + writeFileSync( + path.join(dir, "package.json"), + `${JSON.stringify( + { + name: "fixture", + scripts: { + test: "node scripts/test-projects.mjs", + "test:profile": "node scripts/profile-tests.mjs", + }, + dependencies: { + leftpad: "1.0.0", + }, + }, + null, + 2, + )}\n`, + "utf8", + ); + + const output = execFileSync( + process.execPath, + [path.join(repoRoot, "scripts", "changed-lanes.mjs"), "--json", "--base", "HEAD"], + { + cwd: dir, + encoding: "utf8", + env: createNestedGitEnv(), + }, + ); + + expect(JSON.parse(output)).toMatchObject({ + paths: ["package.json"], + lanes: { + tooling: true, + all: false, + liveDockerTooling: false, + }, + }); + }); + it("keeps non-script package changes off the live Docker focused gate", () => { const before = `${JSON.stringify( { name: "fixture", scripts: {}, dependencies: { leftpad: "1.0.0" } }, @@ -422,6 +486,41 @@ describe("scripts/changed-lanes", () => { expect(isLiveDockerPackageScriptOnlyChange(before, after)).toBe(false); }); + it("routes package script-only changes through the tooling gate", () => { + const before = `${JSON.stringify( + { name: "fixture", scripts: { test: "node test.js" }, dependencies: { leftpad: "1.0.0" } }, + null, + 2, + )}\n`; + const after = `${JSON.stringify( + { + name: "fixture", + scripts: { + test: "node test.js", + "test:profile": "node scripts/profile-tests.mjs", + }, + dependencies: { leftpad: "1.0.0" }, + }, + null, + 2, + )}\n`; + + expect(isPackageScriptOnlyChange(before, after)).toBe(true); + + const result = detectChangedLanes(["package.json"], { + packageJsonChangeKind: "tooling", + }); + const plan = createChangedCheckPlan(result); + + expect(result.lanes).toMatchObject({ + tooling: true, + all: false, + liveDockerTooling: false, + }); + expect(plan.commands.map((command) => command.args[0])).toContain("lint:scripts"); + expect(plan.commands.map((command) => command.args[0])).not.toContain("tsgo:all"); + }); + it("keeps release metadata commits off the full changed gate", () => { const result = detectChangedLanes([ "CHANGELOG.md", @@ -443,7 +542,6 @@ describe("scripts/changed-lanes", () => { core: false, apps: false, }); - expect(plan.runFullTests).toBe(false); expect(plan.commands.map((command) => command.args[0])).toEqual([ "check:no-conflict-markers", "release-metadata:check", @@ -519,26 +617,24 @@ describe("scripts/changed-lanes", () => { tooling: true, all: false, }); - expect(plan.testTargets).toEqual(["test/git-hooks-pre-commit.test.ts"]); - expect(plan.runFullTests).toBe(false); + expect(plan.commands.map((command) => command.args[0])).toContain("lint:scripts"); + expect(plan.commands.map((command) => command.args[0])).not.toContain("test"); }); - it("keeps shared Vitest wiring changes on the broad changed test path", () => { + it("keeps shared Vitest wiring changes out of check test execution", () => { const result = detectChangedLanes(["test/vitest/vitest.shared.config.ts"]); const plan = createChangedCheckPlan(result); - expect(plan.testTargets).toEqual([]); - expect(plan.runChangedTestsBroad).toBe(true); - expect(plan.runFullTests).toBe(false); + expect(plan.commands.map((command) => command.args[0])).toContain("lint:scripts"); + expect(plan.commands.map((command) => command.args[0])).not.toContain("test"); }); - it("keeps setup changes on the broad changed test path", () => { + it("keeps setup changes out of check test execution", () => { const result = detectChangedLanes(["test/setup.ts"]); const plan = createChangedCheckPlan(result); - expect(plan.testTargets).toEqual([]); - expect(plan.runChangedTestsBroad).toBe(true); - expect(plan.runFullTests).toBe(false); + expect(plan.commands.map((command) => command.args[0])).toContain("lint:scripts"); + expect(plan.commands.map((command) => command.args[0])).not.toContain("test"); }); it("does not route generated A2UI artifacts as direct Vitest targets", () => { @@ -548,17 +644,16 @@ describe("scripts/changed-lanes", () => { ]); const plan = createChangedCheckPlan(result); - expect(plan.testTargets).toEqual(["test/scripts/bundle-a2ui.test.ts"]); - expect(plan.runChangedTestsBroad).toBe(false); + expect(plan.commands.map((command) => command.args[0])).toContain("tsgo:core"); + expect(plan.commands.map((command) => command.args[0])).not.toContain("test"); }); it("routes changed extension Vitest configs to only their owning shard", () => { const result = detectChangedLanes(["test/vitest/vitest.extension-discord.config.ts"]); const plan = createChangedCheckPlan(result); - expect(plan.testTargets).toEqual(["test/vitest/vitest.extension-discord.config.ts"]); - expect(plan.runChangedTestsBroad).toBe(false); - expect(plan.runFullTests).toBe(false); + expect(plan.commands.map((command) => command.args[0])).toContain("lint:scripts"); + expect(plan.commands.map((command) => command.args[0])).not.toContain("test"); }); it("keeps an empty changed path list as a no-op", () => { @@ -580,8 +675,6 @@ describe("scripts/changed-lanes", () => { expect(plan.commands).toEqual([ { name: "conflict markers", args: ["check:no-conflict-markers"] }, ]); - expect(plan.runChangedTestsBroad).toBe(false); - expect(plan.runFullTests).toBe(false); }); it("keeps docs-only changes cheap", () => { @@ -592,40 +685,5 @@ describe("scripts/changed-lanes", () => { expect(plan.commands).toEqual([ { name: "conflict markers", args: ["check:no-conflict-markers"] }, ]); - expect(plan.runChangedTestsBroad).toBe(false); - expect(plan.runFullTests).toBe(false); - }); - - it("sets a ten-minute Vitest watchdog for changed checks", () => { - expect(CHANGED_CHECK_VITEST_NO_OUTPUT_TIMEOUT_MS).toBe("600000"); - expect(createChangedCheckVitestEnv({ PATH: "/usr/bin" })).toMatchObject({ - PATH: "/usr/bin", - OPENCLAW_VITEST_NO_OUTPUT_TIMEOUT_MS: CHANGED_CHECK_VITEST_NO_OUTPUT_TIMEOUT_MS, - OPENCLAW_VITEST_NO_OUTPUT_RETRY: "0", - OPENCLAW_TEST_PROJECTS_SERIAL: "1", - OPENCLAW_VITEST_MAX_WORKERS: "1", - }); - - expect( - createChangedCheckVitestEnv({ - OPENCLAW_VITEST_NO_OUTPUT_TIMEOUT_MS: "45000", - OPENCLAW_VITEST_NO_OUTPUT_RETRY: "1", - }), - ).toMatchObject({ - OPENCLAW_VITEST_NO_OUTPUT_TIMEOUT_MS: "45000", - OPENCLAW_VITEST_NO_OUTPUT_RETRY: "1", - }); - }); - - it("does not force serial changed-check tests in CI or when workers are explicit", () => { - expect(createChangedCheckVitestEnv({ CI: "true" })).not.toHaveProperty( - "OPENCLAW_VITEST_MAX_WORKERS", - ); - expect(createChangedCheckVitestEnv({ OPENCLAW_VITEST_MAX_WORKERS: "4" })).toMatchObject({ - OPENCLAW_VITEST_MAX_WORKERS: "4", - }); - expect( - createChangedCheckVitestEnv({ OPENCLAW_TEST_PROJECTS_PARALLEL: "4" }), - ).not.toHaveProperty("OPENCLAW_TEST_PROJECTS_SERIAL"); }); }); diff --git a/test/scripts/test-projects.test.ts b/test/scripts/test-projects.test.ts index 85bd5d7d08d..78450d3ab67 100644 --- a/test/scripts/test-projects.test.ts +++ b/test/scripts/test-projects.test.ts @@ -25,12 +25,23 @@ describe("scripts/test-projects changed-target routing", () => { ).toEqual(["src/shared/string-normalization.test.ts", "src/utils/provider-utils.test.ts"]); }); - it("keeps the broad changed run for Vitest wiring edits", () => { + it("keeps changed mode focused by default for Vitest wiring edits", () => { expect( resolveChangedTargetArgs(["--changed", "origin/main"], process.cwd(), () => [ "test/vitest/vitest.shared.config.ts", "src/utils/provider-utils.ts", ]), + ).toEqual(["src/utils/provider-utils.test.ts"]); + }); + + it("keeps the broad changed run available for Vitest wiring edits", () => { + expect( + resolveChangedTargetArgs( + ["--changed", "origin/main"], + process.cwd(), + () => ["test/vitest/vitest.shared.config.ts", "src/utils/provider-utils.ts"], + { env: { OPENCLAW_TEST_CHANGED_BROAD: "1" } }, + ), ).toBeNull(); }); @@ -129,11 +140,22 @@ describe("scripts/test-projects changed-target routing", () => { ]); }); - it("keeps the broad changed run for shared test helpers", () => { + it("keeps shared test helpers cheap by default when no precise target exists", () => { expect( resolveChangedTargetArgs(["--changed", "origin/main"], process.cwd(), () => [ "test/helpers/channels/plugin.ts", ]), + ).toEqual([]); + }); + + it("keeps the broad changed run available for shared test helpers", () => { + expect( + resolveChangedTargetArgs( + ["--changed", "origin/main"], + process.cwd(), + () => ["test/helpers/channels/plugin.ts"], + { env: { OPENCLAW_TEST_CHANGED_BROAD: "1" } }, + ), ).toBeNull(); }); @@ -174,11 +196,22 @@ describe("scripts/test-projects changed-target routing", () => { ]); }); - it("keeps the broad changed run for unknown root surfaces", () => { + it("keeps unknown root surfaces cheap by default", () => { expect( resolveChangedTargetArgs(["--changed", "origin/main"], process.cwd(), () => [ "unknown/file.txt", ]), + ).toEqual([]); + }); + + it("keeps the broad changed run available for unknown root surfaces", () => { + expect( + resolveChangedTargetArgs( + ["--changed", "origin/main"], + process.cwd(), + () => ["unknown/file.txt"], + { env: { OPENCLAW_TEST_CHANGED_BROAD: "1" } }, + ), ).toBeNull(); }); @@ -204,11 +237,29 @@ describe("scripts/test-projects changed-target routing", () => { ).toEqual([]); }); - it("adds extension tests for public plugin SDK changes", () => { + it("keeps public plugin SDK changes focused by default", () => { const plans = buildVitestRunPlans(["--changed", "origin/main"], process.cwd(), () => [ "src/plugin-sdk/provider-entry.ts", ]); + expect(plans).toEqual([ + { + config: "test/vitest/vitest.unit-fast.config.ts", + forwardedArgs: [], + includePatterns: ["src/plugin-sdk/provider-entry.test.ts"], + watchMode: false, + }, + ]); + }); + + it("adds extension tests for public plugin SDK changes in broad changed mode", () => { + const plans = buildVitestRunPlans( + ["--changed", "origin/main"], + process.cwd(), + () => ["src/plugin-sdk/provider-entry.ts"], + { env: { OPENCLAW_TEST_CHANGED_BROAD: "1" } }, + ); + expect(plans).toEqual([ { config: "test/vitest/vitest.unit-fast.config.ts", @@ -485,11 +536,29 @@ describe("scripts/test-projects changed-target routing", () => { ]); }); - it("routes plugin-sdk source files with sibling tests narrowly plus extension tests", () => { + it("routes plugin-sdk source files with sibling tests narrowly by default", () => { const plans = buildVitestRunPlans(["--changed", "origin/main"], process.cwd(), () => [ "src/plugin-sdk/facade-runtime.ts", ]); + expect(plans).toEqual([ + { + config: "test/vitest/vitest.bundled.config.ts", + forwardedArgs: [], + includePatterns: ["src/plugin-sdk/facade-runtime.test.ts"], + watchMode: false, + }, + ]); + }); + + it("routes plugin-sdk source files with sibling tests plus extensions in broad changed mode", () => { + const plans = buildVitestRunPlans( + ["--changed", "origin/main"], + process.cwd(), + () => ["src/plugin-sdk/facade-runtime.ts"], + { env: { OPENCLAW_TEST_CHANGED_BROAD: "1" } }, + ); + expect(plans).toEqual([ { config: "test/vitest/vitest.bundled.config.ts", @@ -521,22 +590,27 @@ describe("scripts/test-projects changed-target routing", () => { ]); }); - it("keeps focused changed mode to precise targets only", () => { - expect( - resolveChangedTestTargetPlan(["package.json", "src/commands/channels.add.ts"], { - focused: true, - }), - ).toEqual({ + it("keeps changed mode to precise targets by default", () => { + expect(resolveChangedTestTargetPlan(["package.json", "src/commands/channels.add.ts"])).toEqual({ mode: "targets", targets: ["src/commands/channels.add.test.ts"], }); }); - it("uses import-graph targets in focused changed mode", () => { + it("keeps broad changed fallback available through explicit env", () => { expect( - resolveChangedTestTargetPlan(["test/helpers/plugins/plugin-registration.ts"], { - focused: true, - }).targets, + resolveChangedTestTargetPlan(["package.json", "src/commands/channels.add.ts"], { + env: { OPENCLAW_TEST_CHANGED_BROAD: "1" }, + }), + ).toEqual({ + mode: "broad", + targets: [], + }); + }); + + it("uses import-graph targets in default changed mode", () => { + expect( + resolveChangedTestTargetPlan(["test/helpers/plugins/plugin-registration.ts"]).targets, ).toContain("extensions/openrouter/index.test.ts"); }); From 989cfd1e33dbca9907d5b940445a7e61cadc4545 Mon Sep 17 00:00:00 2001 From: Peter Steinberger <steipete@gmail.com> Date: Sun, 26 Apr 2026 23:59:38 +0100 Subject: [PATCH 083/418] fix(bonjour): auto-disable advertising in containers --- extensions/bonjour/src/advertiser.test.ts | 33 +++++++++++++++ extensions/bonjour/src/advertiser.ts | 50 ++++++++++++++++++++++- 2 files changed, 81 insertions(+), 2 deletions(-) diff --git a/extensions/bonjour/src/advertiser.test.ts b/extensions/bonjour/src/advertiser.test.ts index 7b1de8be9ed..25a205e6771 100644 --- a/extensions/bonjour/src/advertiser.test.ts +++ b/extensions/bonjour/src/advertiser.test.ts @@ -1,3 +1,4 @@ +import fs from "node:fs"; import os from "node:os"; import { afterEach, describe, expect, it, vi } from "vitest"; @@ -207,6 +208,38 @@ describe("gateway bonjour advertiser", () => { await expect(started.stop()).resolves.toBeUndefined(); }); + it("auto-disables Bonjour in detected containers", async () => { + enableAdvertiserUnitMode(); + vi.spyOn(fs, "existsSync").mockImplementation((filePath) => String(filePath) === "/.dockerenv"); + + const started = await startAdvertiser({ + gatewayPort: 18789, + sshPort: 2222, + }); + + expect(createService).not.toHaveBeenCalled(); + await expect(started.stop()).resolves.toBeUndefined(); + }); + + it("honors explicit Bonjour opt-in inside detected containers", async () => { + enableAdvertiserUnitMode(); + process.env.OPENCLAW_DISABLE_BONJOUR = "0"; + vi.spyOn(fs, "existsSync").mockImplementation((filePath) => String(filePath) === "/.dockerenv"); + + const destroy = vi.fn().mockResolvedValue(undefined); + const advertise = vi.fn().mockResolvedValue(undefined); + mockCiaoService({ advertise, destroy }); + + const started = await startAdvertiser({ + gatewayPort: 18789, + sshPort: 2222, + }); + + expect(createService).toHaveBeenCalledTimes(1); + + await started.stop(); + }); + it("attaches conflict listeners for services", async () => { enableAdvertiserUnitMode(); diff --git a/extensions/bonjour/src/advertiser.ts b/extensions/bonjour/src/advertiser.ts index 0db1fcbed7f..1908d69aa1b 100644 --- a/extensions/bonjour/src/advertiser.ts +++ b/extensions/bonjour/src/advertiser.ts @@ -1,3 +1,4 @@ +import fs from "node:fs"; import type { PluginLogger } from "openclaw/plugin-sdk/plugin-entry"; import { isTruthyEnvValue } from "openclaw/plugin-sdk/runtime-env"; import { classifyCiaoProcessError, type CiaoProcessErrorClassification } from "./ciao.js"; @@ -89,16 +90,61 @@ async function loadCiaoModule(): Promise<CiaoModule> { return ciaoModulePromise; } -function isDisabledByEnv() { - if (isTruthyEnvValue(process.env.OPENCLAW_DISABLE_BONJOUR)) { +function readBonjourDisableOverride(): boolean | null { + const raw = process.env.OPENCLAW_DISABLE_BONJOUR; + const normalized = raw?.trim().toLowerCase(); + if (!normalized) { + return null; + } + if (isTruthyEnvValue(raw)) { return true; } + switch (normalized) { + case "0": + case "false": + case "no": + case "off": + return false; + default: + return null; + } +} + +function isContainerEnvironment() { + for (const sentinelPath of ["/.dockerenv", "/run/.containerenv", "/var/run/.containerenv"]) { + try { + if (fs.existsSync(sentinelPath)) { + return true; + } + } catch { + // ignore + } + } + + try { + const cgroup = fs.readFileSync("/proc/1/cgroup", "utf8"); + return /\/docker\/|cri-containerd-[0-9a-f]|containerd\/[0-9a-f]{64}|\/kubepods[/.]|\blxc\b/u.test( + cgroup, + ); + } catch { + return false; + } +} + +function isDisabledByEnv() { if (process.env.NODE_ENV === "test") { return true; } if (process.env.VITEST) { return true; } + const envOverride = readBonjourDisableOverride(); + if (envOverride !== null) { + return envOverride; + } + if (isContainerEnvironment()) { + return true; + } return false; } From 6018f29dbff2e39bf44c224f70eb15ed00e6b2ea Mon Sep 17 00:00:00 2001 From: Peter Steinberger <steipete@gmail.com> Date: Sun, 26 Apr 2026 23:59:42 +0100 Subject: [PATCH 084/418] ci: keep docker bonjour setting automatic --- docker-compose.yml | 6 +++--- scripts/docker/setup.sh | 8 +++++--- src/docker-setup.e2e.test.ts | 6 +++--- 3 files changed, 11 insertions(+), 9 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index 0d8f1497475..559b560bfad 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -6,9 +6,9 @@ services: TERM: xterm-256color OPENCLAW_GATEWAY_TOKEN: ${OPENCLAW_GATEWAY_TOKEN:-} OPENCLAW_ALLOW_INSECURE_PRIVATE_WS: ${OPENCLAW_ALLOW_INSECURE_PRIVATE_WS:-} - # Docker bridge networks usually do not carry mDNS multicast reliably. - # Set OPENCLAW_DISABLE_BONJOUR=0 only on host/macvlan/mDNS-capable networks. - OPENCLAW_DISABLE_BONJOUR: ${OPENCLAW_DISABLE_BONJOUR:-1} + # Empty means auto: Bonjour disables itself in detected containers. + # Set 0 only on host/macvlan/mDNS-capable networks; set 1 to force off. + OPENCLAW_DISABLE_BONJOUR: ${OPENCLAW_DISABLE_BONJOUR:-} # OpenTelemetry export is outbound OTLP/HTTP from the Gateway. Prometheus # uses the existing authenticated Gateway route; it does not need a port. OTEL_EXPORTER_OTLP_ENDPOINT: ${OTEL_EXPORTER_OTLP_ENDPOINT:-} diff --git a/scripts/docker/setup.sh b/scripts/docker/setup.sh index d47d7526efd..ab4f2e14d18 100755 --- a/scripts/docker/setup.sh +++ b/scripts/docker/setup.sh @@ -276,7 +276,7 @@ export OPENCLAW_WORKSPACE_DIR export OPENCLAW_GATEWAY_PORT="${OPENCLAW_GATEWAY_PORT:-18789}" export OPENCLAW_BRIDGE_PORT="${OPENCLAW_BRIDGE_PORT:-18790}" export OPENCLAW_GATEWAY_BIND="${OPENCLAW_GATEWAY_BIND:-lan}" -export OPENCLAW_DISABLE_BONJOUR="${OPENCLAW_DISABLE_BONJOUR:-1}" +export OPENCLAW_DISABLE_BONJOUR="${OPENCLAW_DISABLE_BONJOUR:-}" export OPENCLAW_IMAGE="$IMAGE_NAME" export OPENCLAW_DOCKER_APT_PACKAGES="${OPENCLAW_DOCKER_APT_PACKAGES:-}" export OPENCLAW_EXTENSIONS="${OPENCLAW_EXTENSIONS:-}" @@ -529,9 +529,11 @@ echo "Docker setup pins Gateway mode to local." echo "Gateway runtime bind comes from OPENCLAW_GATEWAY_BIND (default: lan)." echo "Current runtime bind: $OPENCLAW_GATEWAY_BIND" if is_truthy_value "$OPENCLAW_DISABLE_BONJOUR"; then - echo "Bonjour/mDNS advertising: disabled for Docker bridge networking (OPENCLAW_DISABLE_BONJOUR=$OPENCLAW_DISABLE_BONJOUR)." + echo "Bonjour/mDNS advertising: force disabled (OPENCLAW_DISABLE_BONJOUR=$OPENCLAW_DISABLE_BONJOUR)." +elif [[ -z "$OPENCLAW_DISABLE_BONJOUR" ]]; then + echo "Bonjour/mDNS advertising: auto (disabled inside the Gateway container unless explicitly enabled)." else - echo "Bonjour/mDNS advertising: enabled (OPENCLAW_DISABLE_BONJOUR=$OPENCLAW_DISABLE_BONJOUR)." + echo "Bonjour/mDNS advertising: explicitly enabled (OPENCLAW_DISABLE_BONJOUR=$OPENCLAW_DISABLE_BONJOUR)." fi echo "Gateway token: $OPENCLAW_GATEWAY_TOKEN" echo "Tailscale exposure: Off (use host-level tailnet/Tailscale setup separately)." diff --git a/src/docker-setup.e2e.test.ts b/src/docker-setup.e2e.test.ts index c16e7ba206f..b17dfe0d744 100644 --- a/src/docker-setup.e2e.test.ts +++ b/src/docker-setup.e2e.test.ts @@ -231,7 +231,7 @@ describe("scripts/docker/setup.sh", () => { expect(envFile).toContain("OPENCLAW_DOCKER_APT_PACKAGES=ffmpeg build-essential"); expect(envFile).toContain("OPENCLAW_EXTRA_MOUNTS="); expect(envFile).toContain("OPENCLAW_HOME_VOLUME=openclaw-home"); // pragma: allowlist secret - expect(envFile).toContain("OPENCLAW_DISABLE_BONJOUR=1"); + expect(envFile).toContain("OPENCLAW_DISABLE_BONJOUR="); const extraCompose = await readFile( join(activeSandbox.rootDir, "docker-compose.extra.yml"), "utf8", @@ -556,10 +556,10 @@ describe("scripts/docker/setup.sh", () => { expect(compose).toContain('"gateway"'); }); - it("keeps docker-compose gateway Bonjour advertising disabled by default", async () => { + it("keeps docker-compose gateway Bonjour advertising in auto mode by default", async () => { const compose = await readFile(join(repoRoot, "docker-compose.yml"), "utf8"); expect( - compose.match(/OPENCLAW_DISABLE_BONJOUR: \$\{OPENCLAW_DISABLE_BONJOUR:-1\}/g), + compose.match(/OPENCLAW_DISABLE_BONJOUR: \$\{OPENCLAW_DISABLE_BONJOUR:-\}/g), ).toHaveLength(1); }); From 20d6daaeaa4e4d6b8530aa88313ff380ca5caede Mon Sep 17 00:00:00 2001 From: Peter Steinberger <steipete@gmail.com> Date: Sun, 26 Apr 2026 23:59:48 +0100 Subject: [PATCH 085/418] docs: document automatic bonjour container policy --- docs/gateway/bonjour.md | 26 +++++++++++++------------- docs/gateway/discovery.md | 6 +++--- 2 files changed, 16 insertions(+), 16 deletions(-) diff --git a/docs/gateway/bonjour.md b/docs/gateway/bonjour.md index 98a367269ed..a8c7935c719 100644 --- a/docs/gateway/bonjour.md +++ b/docs/gateway/bonjour.md @@ -179,11 +179,10 @@ openclaw plugins disable bonjour ## Docker gotchas -Bundled Docker Compose sets `OPENCLAW_DISABLE_BONJOUR=1` for the Gateway service -by default. Docker bridge networks usually do not forward mDNS multicast -(`224.0.0.251:5353`) between the container and the LAN, so leaving Bonjour on can -produce repeated ciao `probing` or `announcing` failures without making discovery -work. +The bundled Bonjour plugin auto-disables LAN multicast advertising in detected +containers when `OPENCLAW_DISABLE_BONJOUR` is unset. Docker bridge networks +usually do not forward mDNS multicast (`224.0.0.251:5353`) between the container +and the LAN, so advertising from the container rarely makes discovery work. Important gotchas: @@ -193,16 +192,16 @@ Important gotchas: `OPENCLAW_GATEWAY_BIND=lan` so the published host port can work. - Disabling Bonjour does not disable wide-area DNS-SD. Use wide-area discovery or Tailnet when the Gateway and node are not on the same LAN. -- Reusing the same `OPENCLAW_CONFIG_DIR` outside Docker does not inherit the - Compose default unless the environment still sets `OPENCLAW_DISABLE_BONJOUR`. +- Reusing the same `OPENCLAW_CONFIG_DIR` outside Docker does not persist the + container auto-disable policy. - Set `OPENCLAW_DISABLE_BONJOUR=0` only for host networking, macvlan, or another - network where mDNS multicast is known to pass. + network where mDNS multicast is known to pass; set it to `1` to force-disable. ## Troubleshooting disabled Bonjour If a node no longer auto-discovers the Gateway after Docker setup: -1. Confirm whether the Gateway is intentionally suppressing LAN advertising: +1. Confirm whether the Gateway is running in auto, forced-on, or forced-off mode: ```bash docker compose config | grep OPENCLAW_DISABLE_BONJOUR @@ -239,9 +238,9 @@ If a node no longer auto-discovers the Gateway after Docker setup: container bridges, WSL, or interface churn can leave the ciao advertiser in a non-announced state. OpenClaw retries a few times and then disables Bonjour for the current Gateway process instead of restarting the advertiser forever. -- **Docker bridge networking**: bundled Docker Compose disables Bonjour by - default with `OPENCLAW_DISABLE_BONJOUR=1`. Set it to `0` only for host, - macvlan, or another mDNS-capable network. +- **Docker bridge networking**: Bonjour auto-disables in detected containers. + Set `OPENCLAW_DISABLE_BONJOUR=0` only for host, macvlan, or another + mDNS-capable network. - **Sleep / interface churn**: macOS may temporarily drop mDNS results; retry. - **Browse works but resolve fails**: keep machine names simple (avoid emojis or punctuation), then restart the Gateway. The service instance name derives from @@ -260,7 +259,8 @@ sequences (e.g. spaces become `\032`). - `openclaw plugins disable bonjour` disables LAN multicast advertising by disabling the bundled plugin. - `openclaw plugins enable bonjour` restores the default LAN discovery plugin. - `OPENCLAW_DISABLE_BONJOUR=1` disables LAN multicast advertising without changing plugin config; accepted truthy values are `1`, `true`, `yes`, and `on` (legacy: `OPENCLAW_DISABLE_BONJOUR`). -- Docker Compose sets `OPENCLAW_DISABLE_BONJOUR=1` by default for bridge networking; override with `OPENCLAW_DISABLE_BONJOUR=0` only when mDNS multicast is available. +- `OPENCLAW_DISABLE_BONJOUR=0` forces LAN multicast advertising on, including inside detected containers; accepted falsy values are `0`, `false`, `no`, and `off`. +- When `OPENCLAW_DISABLE_BONJOUR` is unset, Bonjour advertises on normal hosts and auto-disables inside detected containers. - `gateway.bind` in `~/.openclaw/openclaw.json` controls the Gateway bind mode. - `OPENCLAW_SSH_PORT` overrides the SSH port when `sshPort` is advertised (legacy: `OPENCLAW_SSH_PORT`). - `OPENCLAW_TAILNET_DNS` publishes a MagicDNS hint in TXT when mDNS full mode is enabled (legacy: `OPENCLAW_TAILNET_DNS`). diff --git a/docs/gateway/discovery.md b/docs/gateway/discovery.md index a8033af764f..94e06581d22 100644 --- a/docs/gateway/discovery.md +++ b/docs/gateway/discovery.md @@ -86,9 +86,9 @@ Security notes: Disable/override: - `OPENCLAW_DISABLE_BONJOUR=1` disables advertising. -- Docker Compose defaults `OPENCLAW_DISABLE_BONJOUR=1` because bridge networks - usually do not carry mDNS multicast reliably; use `0` only on host, macvlan, - or another mDNS-capable network. +- When `OPENCLAW_DISABLE_BONJOUR` is unset, Bonjour advertises on normal hosts + and auto-disables inside detected containers. Use `0` only on host, macvlan, + or another mDNS-capable network; use `1` to force-disable. - `gateway.bind` in `~/.openclaw/openclaw.json` controls the Gateway bind mode. - `OPENCLAW_SSH_PORT` overrides the SSH port advertised when `sshPort` is emitted. - `OPENCLAW_TAILNET_DNS` publishes a `tailnetDns` hint (MagicDNS). From 4a578740a2ebf7ea10d08df7bd210ceb34103a4d Mon Sep 17 00:00:00 2001 From: Peter Steinberger <steipete@gmail.com> Date: Mon, 27 Apr 2026 00:01:56 +0100 Subject: [PATCH 086/418] refactor: deduplicate changed lane detection --- scripts/changed-lanes.mjs | 29 +++++++++++++++++++------- scripts/check-changed.mjs | 17 +++++++-------- scripts/test-projects.test-support.mjs | 3 --- 3 files changed, 28 insertions(+), 21 deletions(-) diff --git a/scripts/changed-lanes.mjs b/scripts/changed-lanes.mjs index 7790cb4ee06..6e47f74d925 100644 --- a/scripts/changed-lanes.mjs +++ b/scripts/changed-lanes.mjs @@ -203,6 +203,21 @@ export function detectChangedLanes(changedPaths, options = {}) { }; } +/** + * @param {{ paths: string[]; base: string; head?: string; staged?: boolean }} params + * @returns {ChangedLaneResult} + */ +export function detectChangedLanesForPaths(params) { + const packageJsonChangeKind = params.paths.includes("package.json") + ? classifyPackageJsonChangeFromGit({ + base: params.base, + head: params.head, + staged: params.staged, + }) + : null; + return detectChangedLanes(params.paths, { packageJsonChangeKind }); +} + /** * @param {{ base: string; head?: string; includeWorktree?: boolean; cwd?: string }} params * @returns {string[]} @@ -458,14 +473,12 @@ if (isDirectRun()) { : args.staged ? listStagedChangedPaths() : listChangedPathsFromGit({ base: args.base, head: args.head }); - const packageJsonChangeKind = paths.includes("package.json") - ? classifyPackageJsonChangeFromGit({ - base: args.base, - head: args.head, - staged: args.staged, - }) - : null; - const result = detectChangedLanes(paths, { packageJsonChangeKind }); + const result = detectChangedLanesForPaths({ + paths, + base: args.base, + head: args.head, + staged: args.staged, + }); if (args.githubOutput) { writeChangedLaneGitHubOutput(result); } diff --git a/scripts/check-changed.mjs b/scripts/check-changed.mjs index 75e5df7c9ec..ee97a218b7a 100644 --- a/scripts/check-changed.mjs +++ b/scripts/check-changed.mjs @@ -1,7 +1,6 @@ import { performance } from "node:perf_hooks"; import { - classifyPackageJsonChangeFromGit, - detectChangedLanes, + detectChangedLanesForPaths, listChangedPathsFromGit, listStagedChangedPaths, normalizeChangedPath, @@ -285,14 +284,12 @@ if (isDirectRun()) { : args.staged ? listStagedChangedPaths() : listChangedPathsFromGit({ base: args.base, head: args.head }); - const packageJsonChangeKind = paths.includes("package.json") - ? classifyPackageJsonChangeFromGit({ - base: args.base, - head: args.head, - staged: args.staged, - }) - : null; - const result = detectChangedLanes(paths, { packageJsonChangeKind }); + const result = detectChangedLanesForPaths({ + paths, + base: args.base, + head: args.head, + staged: args.staged, + }); process.exitCode = await runChangedCheck(result, { ...args, explicitPaths: args.paths.length > 0, diff --git a/scripts/test-projects.test-support.mjs b/scripts/test-projects.test-support.mjs index c2a48ea397e..4421c3e3f56 100644 --- a/scripts/test-projects.test-support.mjs +++ b/scripts/test-projects.test-support.mjs @@ -734,9 +734,6 @@ export function resolveChangedTestTargetPlan(changedPaths, options = {}) { targets.push(changedPath); } } - if (useBroadFallback && changedLanes.lanes.all) { - return { mode: "broad", targets: [] }; - } if (useBroadFallback && changedLanes.extensionImpactFromCore) { targets.push("extensions"); } From 41ad03dda4603deb40979b36709402c4fdae380e Mon Sep 17 00:00:00 2001 From: Peter Steinberger <steipete@gmail.com> Date: Mon, 27 Apr 2026 00:02:32 +0100 Subject: [PATCH 087/418] fix(test): allow legacy qa inventory entry --- scripts/check-openclaw-package-tarball.mjs | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/scripts/check-openclaw-package-tarball.mjs b/scripts/check-openclaw-package-tarball.mjs index bdf62b00ded..e9150325f3d 100644 --- a/scripts/check-openclaw-package-tarball.mjs +++ b/scripts/check-openclaw-package-tarball.mjs @@ -5,6 +5,8 @@ import { spawnSync } from "node:child_process"; import fs from "node:fs"; +const INVENTORY_COMPAT_MISSING_ENTRIES = new Set(["dist/extensions/qa-channel/runtime-api.js"]); + function usage() { return "Usage: node scripts/check-openclaw-package-tarball.mjs <openclaw.tgz>"; } @@ -75,6 +77,9 @@ if (entrySet.has("dist/postinstall-inventory.json")) { } else { for (const inventoryEntry of inventory) { const normalizedEntry = inventoryEntry.replace(/\\/gu, "/"); + if (INVENTORY_COMPAT_MISSING_ENTRIES.has(normalizedEntry)) { + continue; + } if (!entrySet.has(normalizedEntry)) { errors.push(`inventory references missing tar entry ${normalizedEntry}`); } From 97e64196a01d533ac5898bff91e557262ef63a92 Mon Sep 17 00:00:00 2001 From: Vincent Koc <vincentkoc@ieee.org> Date: Sun, 26 Apr 2026 16:04:10 -0700 Subject: [PATCH 088/418] fix(hooks): use local timezone for session-memory filenames (#72408) --- CHANGELOG.md | 1 + docs/automation/hooks.md | 2 +- src/hooks/bundled/session-memory/HOOK.md | 4 +- .../bundled/session-memory/handler.test.ts | 23 ++++++ src/hooks/bundled/session-memory/handler.ts | 71 +++++++++++++++++-- 5 files changed, 91 insertions(+), 10 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index b2184f65875..a709de1401a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,7 @@ Docs: https://docs.openclaw.ai ### Fixes +- Hooks/session-memory: use the host local timezone for memory filenames, fallback timestamp slugs, and markdown headers instead of UTC dates. Fixes #46703. (#46721) Thanks @Astro-Han. - Feishu: extract quoted/replied interactive-card text across schema 1.0, schema 2.0, i18n, template-variable, and post-format fallback shapes without carrying broad generated/config churn from related parser experiments. (#38776, #60383, #42218, #45936) Thanks @lishuaigit, @lskun, @just2gooo, and @Br1an67. - Exec approvals: accept a symlinked `OPENCLAW_HOME` as the trusted approvals root while still rejecting symlinked `.openclaw` path components below it. (#64663) Thanks @FunJim. - Logging: add top-level `hostname`, flattened `message`, and available `agent_id`, `session_id`, and `channel` fields to file-log JSONL records for multi-agent filtering without removing existing structured log arguments. Fixes #51075. Thanks @stevengonsalvez. diff --git a/docs/automation/hooks.md b/docs/automation/hooks.md index 5976c44ce1f..13db57a7d7d 100644 --- a/docs/automation/hooks.md +++ b/docs/automation/hooks.md @@ -173,7 +173,7 @@ openclaw hooks enable <hook-name> ### session-memory details -Extracts the last 15 user/assistant messages, generates a descriptive filename slug via LLM, and saves to `<workspace>/memory/YYYY-MM-DD-slug.md`. Requires `workspace.dir` to be configured. +Extracts the last 15 user/assistant messages, generates a descriptive filename slug via LLM, and saves to `<workspace>/memory/YYYY-MM-DD-slug.md` using the host local date. Requires `workspace.dir` to be configured. <a id="bootstrap-extra-files"></a> diff --git a/src/hooks/bundled/session-memory/HOOK.md b/src/hooks/bundled/session-memory/HOOK.md index b087e8fe164..8130fc91047 100644 --- a/src/hooks/bundled/session-memory/HOOK.md +++ b/src/hooks/bundled/session-memory/HOOK.md @@ -32,7 +32,7 @@ When you run `/new` or `/reset` to start a fresh session: Memory files are created with the following format: ```markdown -# Session: 2026-01-16 14:30:00 UTC +# Session: 2026-01-16 14:30:00 EST - **Session Key**: agent:main:main - **Session ID**: abc123def456 @@ -46,7 +46,7 @@ The LLM generates descriptive slugs based on your conversation: - `2026-01-16-vendor-pitch.md` - Discussion about vendor evaluation - `2026-01-16-api-design.md` - API architecture planning - `2026-01-16-bug-fix.md` - Debugging session -- `2026-01-16-1430.md` - Fallback timestamp if slug generation fails +- `2026-01-16-1430.md` - Fallback local timestamp if slug generation fails ## Requirements diff --git a/src/hooks/bundled/session-memory/handler.test.ts b/src/hooks/bundled/session-memory/handler.test.ts index 36dcb5438a2..e0232122f02 100644 --- a/src/hooks/bundled/session-memory/handler.test.ts +++ b/src/hooks/bundled/session-memory/handler.test.ts @@ -4,6 +4,7 @@ import path from "node:path"; import { afterAll, beforeAll, describe, expect, it, vi } from "vitest"; import type { OpenClawConfig } from "../../../config/config.js"; import { writeWorkspaceFile } from "../../../test-helpers/workspace.js"; +import { withEnvAsync } from "../../../test-utils/env.js"; import { createHookEvent } from "../../hooks.js"; import { findPreviousSessionFile, @@ -71,6 +72,7 @@ async function runNewWithPreviousSessionEntry(params: { action?: "new" | "reset"; sessionKey?: string; workspaceDirOverride?: string; + timestamp?: Date; }): Promise<{ files: string[]; memoryContent: string }> { const event = createHookEvent( "command", @@ -86,6 +88,9 @@ async function runNewWithPreviousSessionEntry(params: { ...(params.workspaceDirOverride ? { workspaceDir: params.workspaceDirOverride } : {}), }, ); + if (params.timestamp) { + event.timestamp = params.timestamp; + } await handler(event); @@ -247,6 +252,24 @@ describe("session-memory hook", () => { expect(memoryContent).toContain("assistant: Captured before reset"); }); + it("uses local timezone date and fallback time in memory filenames and headers", async () => { + await withEnvAsync({ TZ: "America/New_York" }, async () => { + const tempDir = await createCaseWorkspace("workspace"); + + const { files, memoryContent } = await runNewWithPreviousSessionEntry({ + tempDir, + timestamp: new Date("2026-01-01T04:30:15.000Z"), + previousSessionEntry: { + sessionId: "local-time-session", + }, + }); + + expect(files).toEqual(["2025-12-31-2330.md"]); + expect(memoryContent).toMatch(/^# Session: 2025-12-31 23:30:15(?: EST| GMT-5)?/); + expect(memoryContent).not.toContain("# Session: 2026-01-01 04:30:15 UTC"); + }); + }); + it("prefers workspaceDir from hook context when sessionKey points at main", async () => { const mainWorkspace = await createCaseWorkspace("workspace-main"); const naviWorkspace = await createCaseWorkspace("workspace-navi"); diff --git a/src/hooks/bundled/session-memory/handler.ts b/src/hooks/bundled/session-memory/handler.ts index 9236b23ddaa..647127d5fe2 100644 --- a/src/hooks/bundled/session-memory/handler.ts +++ b/src/hooks/bundled/session-memory/handler.ts @@ -28,6 +28,63 @@ import { findPreviousSessionFile, getRecentSessionContentWithResetFallback } fro const log = createSubsystemLogger("hooks/session-memory"); +function pickDateTimePart( + parts: Intl.DateTimeFormatPart[], + type: Intl.DateTimeFormatPartTypes, +): string | undefined { + return parts.find((part) => part.type === type)?.value; +} + +function resolveLocalTimeZone(): string | undefined { + const timeZone = process.env.TZ?.trim(); + if (!timeZone) { + return undefined; + } + try { + new Intl.DateTimeFormat("en-US", { timeZone }).format(new Date()); + return timeZone; + } catch { + return undefined; + } +} + +function formatLocalSessionTimestamp(date: Date): { + date: string; + time: string; + timeSlug: string; + timeZoneName?: string; +} { + const parts = new Intl.DateTimeFormat("en-US", { + timeZone: resolveLocalTimeZone(), + year: "numeric", + month: "2-digit", + day: "2-digit", + hour: "2-digit", + minute: "2-digit", + second: "2-digit", + hourCycle: "h23", + timeZoneName: "short", + }).formatToParts(date); + + const year = pickDateTimePart(parts, "year") ?? String(date.getFullYear()).padStart(4, "0"); + const month = pickDateTimePart(parts, "month") ?? String(date.getMonth() + 1).padStart(2, "0"); + const day = pickDateTimePart(parts, "day") ?? String(date.getDate()).padStart(2, "0"); + const hour = pickDateTimePart(parts, "hour") ?? String(date.getHours()).padStart(2, "0"); + const minute = pickDateTimePart(parts, "minute") ?? String(date.getMinutes()).padStart(2, "0"); + const second = pickDateTimePart(parts, "second") ?? String(date.getSeconds()).padStart(2, "0"); + const timeZoneName = [...parts] + .toReversed() + .find((part) => part.type === "timeZoneName") + ?.value?.trim(); + + return { + date: `${year}-${month}-${day}`, + time: `${hour}:${minute}:${second}`, + timeSlug: `${hour}${minute}`, + timeZoneName, + }; +} + function resolveDisplaySessionKey(params: { cfg?: OpenClawConfig; workspaceDir?: string; @@ -80,9 +137,10 @@ const saveSessionToMemory: HookHandler = async (event) => { const memoryDir = path.join(workspaceDir, "memory"); await fs.mkdir(memoryDir, { recursive: true }); - // Get today's date for filename + // Use the user's local timezone for memory artifact names and headings. const now = new Date(event.timestamp); - const dateStr = now.toISOString().split("T")[0]; // YYYY-MM-DD + const localTimestamp = formatLocalSessionTimestamp(now); + const dateStr = localTimestamp.date; // Generate descriptive slug from session using LLM // Prefer previousSessionEntry (old session before /new) over current (which may be empty) @@ -160,8 +218,7 @@ const saveSessionToMemory: HookHandler = async (event) => { // If no slug, use timestamp if (!slug) { - const timeSlug = now.toISOString().split("T")[1].split(".")[0].replace(/:/g, ""); - slug = timeSlug.slice(0, 4); // HHMM + slug = localTimestamp.timeSlug; log.debug("Using fallback timestamp slug", { slug }); } @@ -173,8 +230,8 @@ const saveSessionToMemory: HookHandler = async (event) => { path: memoryFilePath.replace(os.homedir(), "~"), }); - // Format time as HH:MM:SS UTC - const timeStr = now.toISOString().split("T")[1].split(".")[0]; + const timeStr = localTimestamp.time; + const timeZoneSuffix = localTimestamp.timeZoneName ? ` ${localTimestamp.timeZoneName}` : ""; // Extract context details const sessionId = (sessionEntry.sessionId as string) || "unknown"; @@ -182,7 +239,7 @@ const saveSessionToMemory: HookHandler = async (event) => { // Build Markdown entry const entryParts = [ - `# Session: ${dateStr} ${timeStr} UTC`, + `# Session: ${dateStr} ${timeStr}${timeZoneSuffix}`, "", `- **Session Key**: ${displaySessionKey}`, `- **Session ID**: ${sessionId}`, From 95ae3c00bd94dc57c4957ece8e4773f357a420b8 Mon Sep 17 00:00:00 2001 From: Peter Steinberger <steipete@gmail.com> Date: Mon, 27 Apr 2026 00:05:24 +0100 Subject: [PATCH 089/418] docs: explain test routing model --- .agents/skills/openclaw-testing/SKILL.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.agents/skills/openclaw-testing/SKILL.md b/.agents/skills/openclaw-testing/SKILL.md index bf6bb6c18e2..ad3fff2ea01 100644 --- a/.agents/skills/openclaw-testing/SKILL.md +++ b/.agents/skills/openclaw-testing/SKILL.md @@ -67,6 +67,21 @@ Use targeted file paths whenever possible. Avoid raw `vitest`; use the repo - The test wrapper prints a short `[test] passed|failed|skipped ... in ...` line. Vitest's own duration is still the per-shard detail. +## Routing Model + +- `pnpm changed:lanes --json` answers "which check lanes does this diff touch?" + It is used by `pnpm check:changed` for typecheck/lint/guard selection. +- `pnpm test:changed` answers "which Vitest targets are worth running now?" It + uses the same changed path list, but applies a cheaper test-target resolver. +- Direct test edits run themselves. Source edits prefer explicit mappings, + sibling `*.test.ts`, then import-graph dependents. Shared harness/config/root + edits are skipped by default unless they have precise mapped tests. +- Public SDK or contract edits do not automatically run every plugin test. + `check:changed` proves extension type contracts; the agent chooses the + smallest plugin/contract Vitest proof that matches the actual risk. +- Use `OPENCLAW_TEST_CHANGED_BROAD=1 pnpm test:changed` only when a harness, + config, package, or unknown-root edit really needs the broad Vitest fallback. + ## CI Debugging Start with current run state, not logs for everything: From ef3309a986629f71a1a1aef91ecc3abbcfc08f4a Mon Sep 17 00:00:00 2001 From: Peter Steinberger <steipete@gmail.com> Date: Sun, 26 Apr 2026 22:19:43 +0100 Subject: [PATCH 090/418] fix(release): harden beta validation lanes (cherry picked from commit 218bceaa14f92f3b6ec6f5e76f06626cafd4e159) --- .github/workflows/npm-telegram-beta-e2e.yml | 1 + .../openclaw-live-and-e2e-checks-reusable.yml | 2 +- .../telegram/telegram-live.runtime.test.ts | 1 + .../telegram/telegram-live.runtime.ts | 7 +++++++ scripts/openclaw-cross-os-release-checks.ts | 15 +++++++++++++++ 5 files changed, 25 insertions(+), 1 deletion(-) diff --git a/.github/workflows/npm-telegram-beta-e2e.yml b/.github/workflows/npm-telegram-beta-e2e.yml index 394513f9fcc..96eb43db14c 100644 --- a/.github/workflows/npm-telegram-beta-e2e.yml +++ b/.github/workflows/npm-telegram-beta-e2e.yml @@ -145,6 +145,7 @@ jobs: OPENCLAW_QA_CONVEX_SITE_URL: ${{ secrets.OPENCLAW_QA_CONVEX_SITE_URL }} OPENCLAW_QA_CONVEX_SECRET_CI: ${{ secrets.OPENCLAW_QA_CONVEX_SECRET_CI }} OPENCLAW_QA_REDACT_PUBLIC_METADATA: "1" + OPENCLAW_QA_TELEGRAM_CAPTURE_CONTENT: "1" INPUT_SCENARIO: ${{ inputs.scenario }} run: | set -euo pipefail diff --git a/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml b/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml index 3162a2e842e..279073e15e1 100644 --- a/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml +++ b/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml @@ -313,7 +313,7 @@ jobs: requires_live_suites: false - suite_id: openai-ws-stream-live-e2e label: OpenAI WebSocket live E2E - command: pnpm test:e2e -- src/agents/openai-ws-stream.e2e.test.ts + command: pnpm test:e2e src/agents/openai-ws-stream.e2e.test.ts timeout_minutes: 90 requires_repo_e2e: false requires_live_suites: true diff --git a/extensions/qa-lab/src/live-transports/telegram/telegram-live.runtime.test.ts b/extensions/qa-lab/src/live-transports/telegram/telegram-live.runtime.test.ts index 3759bcbd007..6ab4c7ce061 100644 --- a/extensions/qa-lab/src/live-transports/telegram/telegram-live.runtime.test.ts +++ b/extensions/qa-lab/src/live-transports/telegram/telegram-live.runtime.test.ts @@ -162,6 +162,7 @@ describe("telegram live qa runtime", () => { sutAccountId: "sut", }); + expect(next.agents?.defaults?.skipBootstrap).toBe(true); expect(next.plugins?.allow).toContain("telegram"); expect(next.plugins?.entries?.telegram).toEqual({ enabled: true }); expect(next.channels?.telegram).toEqual({ diff --git a/extensions/qa-lab/src/live-transports/telegram/telegram-live.runtime.ts b/extensions/qa-lab/src/live-transports/telegram/telegram-live.runtime.ts index c42f9ce034f..ccd4ce75abd 100644 --- a/extensions/qa-lab/src/live-transports/telegram/telegram-live.runtime.ts +++ b/extensions/qa-lab/src/live-transports/telegram/telegram-live.runtime.ts @@ -476,6 +476,13 @@ function buildTelegramQaConfig( }; return { ...baseCfg, + agents: { + ...baseCfg.agents, + defaults: { + ...baseCfg.agents?.defaults, + skipBootstrap: true, + }, + }, plugins: { ...baseCfg.plugins, allow: pluginAllow, diff --git a/scripts/openclaw-cross-os-release-checks.ts b/scripts/openclaw-cross-os-release-checks.ts index 4ac181a51f7..aa392fd6ed9 100644 --- a/scripts/openclaw-cross-os-release-checks.ts +++ b/scripts/openclaw-cross-os-release-checks.ts @@ -1742,6 +1742,14 @@ async function runInstalledModelsSet(params) { logPath: params.logPath, timeoutMs: 2 * 60 * 1000, }); + await runInstalledCli({ + cliPath: params.cliPath, + args: ["config", "set", "agents.defaults.skipBootstrap", "true", "--strict-json"], + cwd: params.cwd, + env: params.env, + logPath: params.logPath, + timeoutMs: 2 * 60 * 1000, + }); } async function runInstalledAgentTurn(params) { @@ -2388,6 +2396,13 @@ async function runModelsSet(params) { logPath: params.logPath, timeoutMs: 2 * 60 * 1000, }); + await runOpenClaw({ + lane: params.lane, + env: params.env, + args: ["config", "set", "agents.defaults.skipBootstrap", "true", "--strict-json"], + logPath: params.logPath, + timeoutMs: 2 * 60 * 1000, + }); } async function runAgentTurn(params) { From 16c6a92c53a7a23d0a489ee64614548c0da9db09 Mon Sep 17 00:00:00 2001 From: Peter Steinberger <steipete@gmail.com> Date: Sun, 26 Apr 2026 22:33:05 +0100 Subject: [PATCH 091/418] ci(release): allow npm telegram e2e from release branch (cherry picked from commit 53f8e9de13118d37b47bc15cdc9d8c558fd9a2a1) --- .github/workflows/npm-telegram-beta-e2e.yml | 17 +---------------- test/scripts/npm-telegram-live.test.ts | 2 ++ 2 files changed, 3 insertions(+), 16 deletions(-) diff --git a/.github/workflows/npm-telegram-beta-e2e.yml b/.github/workflows/npm-telegram-beta-e2e.yml index 96eb43db14c..3f59dc69b73 100644 --- a/.github/workflows/npm-telegram-beta-e2e.yml +++ b/.github/workflows/npm-telegram-beta-e2e.yml @@ -34,23 +34,8 @@ env: PNPM_VERSION: "10.33.0" jobs: - validate_dispatch_ref: - name: Validate dispatch ref - runs-on: blacksmith-8vcpu-ubuntu-2404 - steps: - - name: Require main workflow ref - env: - WORKFLOW_REF: ${{ github.ref }} - run: | - set -euo pipefail - if [[ "${WORKFLOW_REF}" != "refs/heads/main" ]]; then - echo "NPM Telegram beta E2E must be dispatched from main so workflow logic stays controlled." >&2 - exit 1 - fi - approve_release_manager: name: Approve npm Telegram beta E2E - needs: validate_dispatch_ref runs-on: ubuntu-latest environment: npm-release steps: @@ -71,7 +56,7 @@ jobs: DOCKER_BUILD_SUMMARY: "false" DOCKER_BUILD_RECORD_UPLOAD: "false" steps: - - name: Checkout main + - name: Checkout dispatch ref uses: actions/checkout@v6 with: ref: ${{ github.sha }} diff --git a/test/scripts/npm-telegram-live.test.ts b/test/scripts/npm-telegram-live.test.ts index 7bd40f2cfe2..2a2bebc2d43 100644 --- a/test/scripts/npm-telegram-live.test.ts +++ b/test/scripts/npm-telegram-live.test.ts @@ -47,6 +47,8 @@ describe("npm Telegram live Docker E2E", () => { expect(workflow).toContain("approve_release_manager:"); expect(workflow).toContain("environment: npm-release"); expect(workflow).toContain("needs: approve_release_manager"); + expect(workflow).not.toContain("Require main workflow ref"); + expect(workflow).not.toContain("refs/heads/main"); expect(workflow).not.toContain('new Set(["admin", "write"])'); expect(workflow).not.toContain("data.role_name"); expect(workflow).not.toContain("github.rest.teams.listMembersInOrg"); From 17094640f876be133de430428bead4c5799339bd Mon Sep 17 00:00:00 2001 From: Peter Steinberger <steipete@gmail.com> Date: Sun, 26 Apr 2026 22:35:45 +0100 Subject: [PATCH 092/418] ci(release): trust release branch docker checks (cherry picked from commit abf0ef9cd35889f4a07bd6c1129713300bffca08) --- .../openclaw-live-and-e2e-checks-reusable.yml | 9 ++++++++- test/scripts/test-install-sh-docker.test.ts | 10 ++++++++++ 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml b/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml index 279073e15e1..37ab6538e71 100644 --- a/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml +++ b/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml @@ -192,6 +192,7 @@ jobs: env: GH_TOKEN: ${{ github.token }} INPUT_REF: ${{ inputs.ref }} + WORKFLOW_REF_NAME: ${{ github.ref_name }} shell: bash run: | set -euo pipefail @@ -199,9 +200,15 @@ jobs: trusted_reason="" git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main + if [[ "${WORKFLOW_REF_NAME}" =~ ^release/[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*$ ]]; then + git fetch --no-tags origin "+refs/heads/${WORKFLOW_REF_NAME}:refs/remotes/origin/${WORKFLOW_REF_NAME}" + fi if git merge-base --is-ancestor "$selected_sha" refs/remotes/origin/main; then trusted_reason="main-ancestor" + elif [[ "${WORKFLOW_REF_NAME}" =~ ^release/[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*$ ]] && + [[ "$selected_sha" == "$(git rev-parse "refs/remotes/origin/${WORKFLOW_REF_NAME}")" ]]; then + trusted_reason="release-branch-head" elif git tag --points-at "$selected_sha" | grep -Eq '^v'; then trusted_reason="release-tag" else @@ -218,7 +225,7 @@ jobs: if [[ -z "$trusted_reason" ]]; then echo "Ref '${INPUT_REF}' resolved to $selected_sha, which is not trusted for secret-bearing live/E2E checks." >&2 - echo "Allowed refs must be on main, point to a release tag, or match an open PR head in ${GITHUB_REPOSITORY}." >&2 + echo "Allowed refs must be on main, match the current release branch head, point to a release tag, or match an open PR head in ${GITHUB_REPOSITORY}." >&2 exit 1 fi diff --git a/test/scripts/test-install-sh-docker.test.ts b/test/scripts/test-install-sh-docker.test.ts index 288a7b4a547..909a3e9b0db 100644 --- a/test/scripts/test-install-sh-docker.test.ts +++ b/test/scripts/test-install-sh-docker.test.ts @@ -6,6 +6,7 @@ const SMOKE_RUNNER_PATH = "scripts/docker/install-sh-smoke/run.sh"; const BUN_GLOBAL_SMOKE_PATH = "scripts/e2e/bun-global-install-smoke.sh"; const INSTALL_SMOKE_WORKFLOW_PATH = ".github/workflows/install-smoke.yml"; const RELEASE_CHECKS_WORKFLOW_PATH = ".github/workflows/openclaw-release-checks.yml"; +const LIVE_E2E_WORKFLOW_PATH = ".github/workflows/openclaw-live-and-e2e-checks-reusable.yml"; describe("test-install-sh-docker", () => { it("defaults local Apple Silicon smoke runs to native arm64 while keeping CI on amd64", () => { @@ -57,6 +58,15 @@ describe("test-install-sh-docker", () => { expect(script).toContain('echo "==> Reuse local dist/ from Docker image: $image"'); }); + it("allows release branch head refs for secret-backed Docker release checks", () => { + const workflow = readFileSync(LIVE_E2E_WORKFLOW_PATH, "utf8"); + + expect(workflow).toContain("WORKFLOW_REF_NAME: ${{ github.ref_name }}"); + expect(workflow).toContain("release-branch-head"); + expect(workflow).toContain("refs/remotes/origin/${WORKFLOW_REF_NAME}"); + expect(workflow).toContain("match the current release branch head"); + }); + it("prints package size audits for release smoke tarballs", () => { const script = readFileSync(SCRIPT_PATH, "utf8"); From e7d069edcf0df4da827565f040222d3391c7c2c0 Mon Sep 17 00:00:00 2001 From: Peter Steinberger <steipete@gmail.com> Date: Sun, 26 Apr 2026 22:43:54 +0100 Subject: [PATCH 093/418] test(qa): relax telegram mention reply assertion (cherry picked from commit 710925131843417b9ed2074c867fcbbd450f73a2) --- .../telegram/telegram-live.runtime.test.ts | 21 +++++++++++++++++++ .../telegram/telegram-live.runtime.ts | 20 ++++++++++-------- 2 files changed, 32 insertions(+), 9 deletions(-) diff --git a/extensions/qa-lab/src/live-transports/telegram/telegram-live.runtime.test.ts b/extensions/qa-lab/src/live-transports/telegram/telegram-live.runtime.test.ts index 6ab4c7ce061..7b83a00526c 100644 --- a/extensions/qa-lab/src/live-transports/telegram/telegram-live.runtime.test.ts +++ b/extensions/qa-lab/src/live-transports/telegram/telegram-live.runtime.test.ts @@ -376,6 +376,27 @@ describe("telegram live qa runtime", () => { matchText: "TELEGRAM_QA_NOMENTION_TOKEN", }), ).toBe(false); + expect( + __testing.matchesTelegramScenarioReply({ + allowAnySutReply: true, + groupId: "-100123", + sentMessageId: 55, + sutBotId: 88, + message: { + updateId: 3, + messageId: 12, + chatId: -100123, + senderId: 88, + senderIsBot: true, + senderUsername: "sut_bot", + text: "Protocol note: acknowledged.", + replyToMessageId: undefined, + timestamp: 1_700_000_003_000, + inlineButtons: [], + mediaKinds: [], + }, + }), + ).toBe(true); }); it("validates expected Telegram reply markers", () => { diff --git a/extensions/qa-lab/src/live-transports/telegram/telegram-live.runtime.ts b/extensions/qa-lab/src/live-transports/telegram/telegram-live.runtime.ts index ccd4ce75abd..6d287ace2f8 100644 --- a/extensions/qa-lab/src/live-transports/telegram/telegram-live.runtime.ts +++ b/extensions/qa-lab/src/live-transports/telegram/telegram-live.runtime.ts @@ -51,6 +51,7 @@ type TelegramQaScenarioId = | "telegram-mention-gating"; type TelegramQaScenarioRun = { + allowAnySutReply?: boolean; expectReply: boolean; input: string; expectedTextIncludes?: string[]; @@ -268,15 +269,11 @@ const TELEGRAM_QA_SCENARIOS: TelegramQaScenarioDefinition[] = [ id: "telegram-mentioned-message-reply", title: "Telegram mentioned message gets a reply", timeoutMs: 45_000, - buildRun: (sutUsername) => { - const token = `TELEGRAM_QA_REPLY_${randomUUID().slice(0, 8).toUpperCase()}`; - return { - expectReply: true, - input: `@${sutUsername} reply with only this exact marker: ${token}`, - expectedTextIncludes: [token], - matchText: token, - }; - }, + buildRun: (sutUsername) => ({ + allowAnySutReply: true, + expectReply: true, + input: `@${sutUsername} Telegram QA mention routing check. Reply with a short acknowledgement.`, + }), }, { id: "telegram-mention-gating", @@ -758,6 +755,7 @@ function findScenario(ids?: string[]) { function matchesTelegramScenarioReply(params: { groupId: string; + allowAnySutReply?: boolean; matchText?: string; message: TelegramObservedMessage; sentMessageId: number; @@ -772,6 +770,9 @@ function matchesTelegramScenarioReply(params: { if (params.message.replyToMessageId === params.sentMessageId) { return true; } + if (params.allowAnySutReply === true) { + return true; + } return Boolean(params.matchText && params.message.text.includes(params.matchText)); } @@ -1223,6 +1224,7 @@ export async function runTelegramQaLive(params: { observationScenarioTitle: scenario.title, predicate: (message) => matchesTelegramScenarioReply({ + allowAnySutReply: scenarioRun.allowAnySutReply, groupId: runtimeEnv.groupId, matchText: scenarioRun.matchText, message, From 43e651db9a05d29f7f91e17c44c62902114f478d Mon Sep 17 00:00:00 2001 From: Peter Steinberger <steipete@gmail.com> Date: Sun, 26 Apr 2026 22:45:11 +0100 Subject: [PATCH 094/418] ci(docker): preserve pnpm path in scheduler lanes (cherry picked from commit 2e8a089836f8071327b2420fd9417fce744668cf) --- scripts/test-docker-all.mjs | 12 +++++++++++- test/scripts/docker-build-helper.test.ts | 10 ++++++++++ 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/scripts/test-docker-all.mjs b/scripts/test-docker-all.mjs index c678718284e..790d3faba91 100644 --- a/scripts/test-docker-all.mjs +++ b/scripts/test-docker-all.mjs @@ -142,10 +142,20 @@ function appendExtension(env, extension) { } function commandEnv(extra = {}) { - return { + const env = { ...process.env, ...extra, }; + const pathEntries = [ + env.PATH, + env.PNPM_HOME, + env.npm_execpath ? path.dirname(env.npm_execpath) : undefined, + path.dirname(process.execPath), + ] + .flatMap((entry) => (entry ? String(entry).split(path.delimiter) : [])) + .filter(Boolean); + env.PATH = [...new Set(pathEntries)].join(path.delimiter); + return env; } function shellQuote(value) { diff --git a/test/scripts/docker-build-helper.test.ts b/test/scripts/docker-build-helper.test.ts index 82e7096fb81..28f36e9388b 100644 --- a/test/scripts/docker-build-helper.test.ts +++ b/test/scripts/docker-build-helper.test.ts @@ -2,6 +2,7 @@ import { readFileSync } from "node:fs"; import { describe, expect, it } from "vitest"; const HELPER_PATH = "scripts/lib/docker-build.sh"; +const DOCKER_ALL_SCHEDULER_PATH = "scripts/test-docker-all.mjs"; const CENTRALIZED_BUILD_SCRIPTS = [ "scripts/docker/setup.sh", "scripts/e2e/browser-cdp-snapshot-docker.sh", @@ -35,4 +36,13 @@ describe("docker build helper", () => { expect(script, path).not.toMatch(/run_logged\s+\S+\s+docker\s+build/); } }); + + it("preserves pnpm lookup paths for scheduled Docker child lanes", () => { + const scheduler = readFileSync(DOCKER_ALL_SCHEDULER_PATH, "utf8"); + + expect(scheduler).toContain("env.PNPM_HOME"); + expect(scheduler).toContain("env.npm_execpath ? path.dirname(env.npm_execpath)"); + expect(scheduler).toContain("path.dirname(process.execPath)"); + expect(scheduler).toContain("env.PATH = [...new Set(pathEntries)].join(path.delimiter)"); + }); }); From 54e77a9ec448e1e8ec056913c62f4b11d958e30e Mon Sep 17 00:00:00 2001 From: Peter Steinberger <steipete@gmail.com> Date: Sun, 26 Apr 2026 22:54:17 +0100 Subject: [PATCH 095/418] ci(docker): use resolved pnpm for scheduled lanes (cherry picked from commit 61a539a1b7bd4f027df86a54ffaa2893c1700c9d) --- .../openclaw-live-and-e2e-checks-reusable.yml | 2 ++ scripts/test-docker-all.mjs | 29 ++++++++++++++++++- test/scripts/docker-build-helper.test.ts | 2 ++ 3 files changed, 32 insertions(+), 1 deletion(-) diff --git a/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml b/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml index 37ab6538e71..08eaf802ad2 100644 --- a/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml +++ b/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml @@ -493,6 +493,7 @@ jobs: export OPENCLAW_DOCKER_ALL_INCLUDE_OPENWEBUI="${INCLUDE_OPENWEBUI}" export OPENCLAW_DOCKER_ALL_LOG_DIR=".artifacts/docker-tests/release-${DOCKER_E2E_CHUNK}" export OPENCLAW_DOCKER_ALL_TIMINGS_FILE=".artifacts/docker-tests/release-${DOCKER_E2E_CHUNK}-timings.json" + export OPENCLAW_DOCKER_ALL_PNPM_COMMAND="$(command -v pnpm)" pnpm test:docker:all @@ -616,6 +617,7 @@ jobs: export OPENCLAW_DOCKER_ALL_INCLUDE_OPENWEBUI="${INCLUDE_OPENWEBUI}" export OPENCLAW_DOCKER_ALL_LOG_DIR=".artifacts/docker-tests/targeted" export OPENCLAW_DOCKER_ALL_TIMINGS_FILE=".artifacts/docker-tests/targeted-timings.json" + export OPENCLAW_DOCKER_ALL_PNPM_COMMAND="$(command -v pnpm)" if [[ "${{ steps.plan.outputs.needs_live_image }}" == "1" ]]; then pnpm test:docker:live-build fi diff --git a/scripts/test-docker-all.mjs b/scripts/test-docker-all.mjs index 790d3faba91..c4870924bba 100644 --- a/scripts/test-docker-all.mjs +++ b/scripts/test-docker-all.mjs @@ -197,12 +197,38 @@ function buildLaneRerunCommand(name, baseEnv) { ["OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE", baseEnv.OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE], ["OPENCLAW_CURRENT_PACKAGE_TGZ", baseEnv.OPENCLAW_CURRENT_PACKAGE_TGZ], ]; + if (baseEnv.OPENCLAW_DOCKER_ALL_PNPM_COMMAND) { + env.push(["OPENCLAW_DOCKER_ALL_PNPM_COMMAND", baseEnv.OPENCLAW_DOCKER_ALL_PNPM_COMMAND]); + } return `${env .filter(([, value]) => value !== undefined && value !== "") .map(([key, value]) => `${key}=${shellQuote(value)}`) .join(" ")} pnpm test:docker:all`; } +function withResolvedPnpmCommand(command, env) { + const pnpmCommand = env.OPENCLAW_DOCKER_ALL_PNPM_COMMAND?.trim(); + if (!pnpmCommand) { + return command; + } + return command.replace(/(^|\s)pnpm(?=\s)/g, `$1${shellQuote(pnpmCommand)}`); +} + +function timingSeconds(timingStore, poolLane) { + const fromStore = timingStore?.lanes?.[poolLane.name]?.durationSeconds; + if (typeof fromStore === "number" && Number.isFinite(fromStore) && fromStore > 0) { + return fromStore; + } + return poolLane.estimateSeconds ?? 0; +} + +function orderLanes(poolLanes, timingStore) { + return poolLanes + .map((poolLane, index) => ({ index, poolLane, seconds: timingSeconds(timingStore, poolLane) })) + .toSorted((a, b) => b.seconds - a.seconds || a.index - b.index) + .map(({ poolLane }) => poolLane); +} + async function loadTimingStore(file, enabled) { if (!enabled) { return { enabled: false, file, lanes: {}, version: 1 }; @@ -611,10 +637,11 @@ function laneEnv(poolLane, baseEnv, logDir, cacheKey) { } async function runLane(lane, baseEnv, logDir, fallbackTimeoutMs) { - const { command, name } = lane; + const { name } = lane; const timeoutMs = lane.timeoutMs ?? fallbackTimeoutMs; const logFile = path.join(logDir, `${name}.log`); const env = laneEnv(lane, baseEnv, logDir, lane.cacheKey); + const command = withResolvedPnpmCommand(lane.command, env); await mkdir(env.OPENCLAW_DOCKER_CLI_TOOLS_DIR, { recursive: true }); await mkdir(env.OPENCLAW_DOCKER_CACHE_HOME_DIR, { recursive: true }); await fs.promises.writeFile( diff --git a/test/scripts/docker-build-helper.test.ts b/test/scripts/docker-build-helper.test.ts index 28f36e9388b..c7fcb204063 100644 --- a/test/scripts/docker-build-helper.test.ts +++ b/test/scripts/docker-build-helper.test.ts @@ -44,5 +44,7 @@ describe("docker build helper", () => { expect(scheduler).toContain("env.npm_execpath ? path.dirname(env.npm_execpath)"); expect(scheduler).toContain("path.dirname(process.execPath)"); expect(scheduler).toContain("env.PATH = [...new Set(pathEntries)].join(path.delimiter)"); + expect(scheduler).toContain("withResolvedPnpmCommand"); + expect(scheduler).toContain("OPENCLAW_DOCKER_ALL_PNPM_COMMAND"); }); }); From 1bb46ce68ac1198a375bdc807c4cec3fed128427 Mon Sep 17 00:00:00 2001 From: Peter Steinberger <steipete@gmail.com> Date: Sun, 26 Apr 2026 23:09:05 +0100 Subject: [PATCH 096/418] ci(docker): test release installer against beta (cherry picked from commit d8c4dcb6a4d5e08a37626ba600224f9eb6012282) --- scripts/lib/docker-e2e-scenarios.mjs | 12 ++++++++---- test/scripts/docker-build-helper.test.ts | 9 +++++++++ 2 files changed, 17 insertions(+), 4 deletions(-) diff --git a/scripts/lib/docker-e2e-scenarios.mjs b/scripts/lib/docker-e2e-scenarios.mjs index 9696f8a6184..28acd792a13 100644 --- a/scripts/lib/docker-e2e-scenarios.mjs +++ b/scripts/lib/docker-e2e-scenarios.mjs @@ -341,10 +341,14 @@ const releasePathChunks = { }), ], "package-update": [ - npmLane("install-e2e", "OPENCLAW_E2E_MODELS=both pnpm test:install:e2e", { - resources: ["service"], - weight: 4, - }), + npmLane( + "install-e2e", + "OPENCLAW_INSTALL_TAG=beta OPENCLAW_E2E_MODELS=both pnpm test:install:e2e", + { + resources: ["service"], + weight: 4, + }, + ), npmLane( "npm-onboard-channel-agent", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:npm-onboard-channel-agent", diff --git a/test/scripts/docker-build-helper.test.ts b/test/scripts/docker-build-helper.test.ts index c7fcb204063..a5db1bf9808 100644 --- a/test/scripts/docker-build-helper.test.ts +++ b/test/scripts/docker-build-helper.test.ts @@ -3,6 +3,7 @@ import { describe, expect, it } from "vitest"; const HELPER_PATH = "scripts/lib/docker-build.sh"; const DOCKER_ALL_SCHEDULER_PATH = "scripts/test-docker-all.mjs"; +const DOCKER_E2E_SCENARIOS_PATH = "scripts/lib/docker-e2e-scenarios.mjs"; const CENTRALIZED_BUILD_SCRIPTS = [ "scripts/docker/setup.sh", "scripts/e2e/browser-cdp-snapshot-docker.sh", @@ -47,4 +48,12 @@ describe("docker build helper", () => { expect(scheduler).toContain("withResolvedPnpmCommand"); expect(scheduler).toContain("OPENCLAW_DOCKER_ALL_PNPM_COMMAND"); }); + + it("runs release installer E2E against the npm beta tag", () => { + const scenarios = readFileSync(DOCKER_E2E_SCENARIOS_PATH, "utf8"); + + expect(scenarios).toContain( + '"OPENCLAW_INSTALL_TAG=beta OPENCLAW_E2E_MODELS=both pnpm test:install:e2e"', + ); + }); }); From 8d909ed0da85b16371d3a20990183fe458214275 Mon Sep 17 00:00:00 2001 From: Peter Steinberger <steipete@gmail.com> Date: Sun, 26 Apr 2026 23:21:56 +0100 Subject: [PATCH 097/418] ci(docker): pass beta env to installer e2e (cherry picked from commit 7677b4ca24c3c669af8ae951a71974c5c24001f9) --- scripts/docker/install-sh-e2e/run.sh | 4 ++-- test/scripts/docker-build-helper.test.ts | 12 ++++++++++++ 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/scripts/docker/install-sh-e2e/run.sh b/scripts/docker/install-sh-e2e/run.sh index ecc8af74cc5..d9cbdffb7aa 100755 --- a/scripts/docker/install-sh-e2e/run.sh +++ b/scripts/docker/install-sh-e2e/run.sh @@ -74,9 +74,9 @@ fi echo "==> Run official installer one-liner" if [[ "$INSTALL_TAG" == "beta" ]]; then - OPENCLAW_BETA=1 curl -fsSL "$INSTALL_URL" | bash + curl -fsSL "$INSTALL_URL" | OPENCLAW_BETA=1 bash elif [[ "$INSTALL_TAG" != "latest" ]]; then - OPENCLAW_VERSION="$INSTALL_TAG" curl -fsSL "$INSTALL_URL" | bash + curl -fsSL "$INSTALL_URL" | OPENCLAW_VERSION="$INSTALL_TAG" bash else curl -fsSL "$INSTALL_URL" | bash fi diff --git a/test/scripts/docker-build-helper.test.ts b/test/scripts/docker-build-helper.test.ts index a5db1bf9808..34993bd622b 100644 --- a/test/scripts/docker-build-helper.test.ts +++ b/test/scripts/docker-build-helper.test.ts @@ -4,6 +4,7 @@ import { describe, expect, it } from "vitest"; const HELPER_PATH = "scripts/lib/docker-build.sh"; const DOCKER_ALL_SCHEDULER_PATH = "scripts/test-docker-all.mjs"; const DOCKER_E2E_SCENARIOS_PATH = "scripts/lib/docker-e2e-scenarios.mjs"; +const INSTALL_E2E_RUNNER_PATH = "scripts/docker/install-sh-e2e/run.sh"; const CENTRALIZED_BUILD_SCRIPTS = [ "scripts/docker/setup.sh", "scripts/e2e/browser-cdp-snapshot-docker.sh", @@ -56,4 +57,15 @@ describe("docker build helper", () => { '"OPENCLAW_INSTALL_TAG=beta OPENCLAW_E2E_MODELS=both pnpm test:install:e2e"', ); }); + + it("passes installer tag env to bash, not curl", () => { + const runner = readFileSync(INSTALL_E2E_RUNNER_PATH, "utf8"); + + expect(runner).toContain('curl -fsSL "$INSTALL_URL" | OPENCLAW_BETA=1 bash'); + expect(runner).toContain('curl -fsSL "$INSTALL_URL" | OPENCLAW_VERSION="$INSTALL_TAG" bash'); + expect(runner).not.toContain('OPENCLAW_BETA=1 curl -fsSL "$INSTALL_URL" | bash'); + expect(runner).not.toContain( + 'OPENCLAW_VERSION="$INSTALL_TAG" curl -fsSL "$INSTALL_URL" | bash', + ); + }); }); From efe940e9cb69ce63423e2be7e701139c66a81b17 Mon Sep 17 00:00:00 2001 From: Peter Steinberger <steipete@gmail.com> Date: Sun, 26 Apr 2026 23:30:33 +0100 Subject: [PATCH 098/418] ci(qa): remove telegram beta approval gate (cherry picked from commit 5e04b0f97a4244bed5be8e10462fc027f22ad08a) --- .../skills/openclaw-release-maintainer/SKILL.md | 8 +++++--- .github/workflows/npm-telegram-beta-e2e.yml | 11 ----------- test/scripts/npm-telegram-live.test.ts | 14 ++++++++------ 3 files changed, 13 insertions(+), 20 deletions(-) diff --git a/.agents/skills/openclaw-release-maintainer/SKILL.md b/.agents/skills/openclaw-release-maintainer/SKILL.md index 3aa8fbb179b..19c1c58f820 100644 --- a/.agents/skills/openclaw-release-maintainer/SKILL.md +++ b/.agents/skills/openclaw-release-maintainer/SKILL.md @@ -325,9 +325,11 @@ node --import tsx scripts/openclaw-npm-postpublish-verify.ts <published-version> - Docker install/update coverage that exercises the published beta package - published npm Telegram proof: dispatch Actions > `NPM Telegram Beta E2E` from `main` with `package_spec=openclaw@<beta-version>` and - `provider_mode=mock-openai`, approve `npm-release`, and require success. - This is the default button path for installed-package onboarding, - Telegram setup, and real Telegram E2E against the published npm package. + `provider_mode=mock-openai`, and require success. This workflow is + maintainer-dispatched and intentionally has no `npm-release` approval gate; + `qa-live-shared` only supplies the shared QA secrets. This is the default + button path for installed-package onboarding, Telegram setup, and real + Telegram E2E against the published npm package. Use the local `pnpm test:docker:npm-telegram-live` lane with the matching `OPENCLAW_NPM_TELEGRAM_PACKAGE_SPEC` and Convex CI env only as a fallback or debugging path. diff --git a/.github/workflows/npm-telegram-beta-e2e.yml b/.github/workflows/npm-telegram-beta-e2e.yml index 3f59dc69b73..a76f46f9fbd 100644 --- a/.github/workflows/npm-telegram-beta-e2e.yml +++ b/.github/workflows/npm-telegram-beta-e2e.yml @@ -34,19 +34,8 @@ env: PNPM_VERSION: "10.33.0" jobs: - approve_release_manager: - name: Approve npm Telegram beta E2E - runs-on: ubuntu-latest - environment: npm-release - steps: - - name: Record approval - env: - PACKAGE_SPEC: ${{ inputs.package_spec }} - run: echo "Approved npm Telegram beta E2E for ${PACKAGE_SPEC}" - run_npm_telegram_beta_e2e: name: Run published npm Telegram E2E - needs: approve_release_manager runs-on: blacksmith-32vcpu-ubuntu-2404 timeout-minutes: 60 environment: qa-live-shared diff --git a/test/scripts/npm-telegram-live.test.ts b/test/scripts/npm-telegram-live.test.ts index 2a2bebc2d43..b721a2f6d08 100644 --- a/test/scripts/npm-telegram-live.test.ts +++ b/test/scripts/npm-telegram-live.test.ts @@ -41,12 +41,14 @@ describe("npm Telegram live Docker E2E", () => { expect(script).toContain('credential_role="ci"'); }); - it("requires release manager environment approval for the manual npm beta workflow", () => { + it("does not require release manager environment approval for the manual npm beta workflow", () => { const workflow = readFileSync(WORKFLOW_PATH, "utf8"); - expect(workflow).toContain("approve_release_manager:"); - expect(workflow).toContain("environment: npm-release"); - expect(workflow).toContain("needs: approve_release_manager"); + expect(workflow).not.toContain("approve_release_manager:"); + expect(workflow).not.toContain("Approve npm Telegram beta E2E"); + expect(workflow).not.toContain("environment: npm-release"); + expect(workflow).not.toContain("needs: approve_release_manager"); + expect(workflow).toContain("environment: qa-live-shared"); expect(workflow).not.toContain("Require main workflow ref"); expect(workflow).not.toContain("refs/heads/main"); expect(workflow).not.toContain('new Set(["admin", "write"])'); @@ -55,12 +57,12 @@ describe("npm Telegram live Docker E2E", () => { expect(workflow).not.toContain("getMembershipForUserInOrg"); }); - it("builds and reuses a local Docker E2E image after approval", () => { + it("builds and reuses a local Docker E2E image", () => { const workflow = readFileSync(WORKFLOW_PATH, "utf8"); expect(workflow).not.toContain("prepare_docker_e2e_image:"); expect(workflow).toContain("run_npm_telegram_beta_e2e:"); - expect(workflow).toContain("needs: approve_release_manager"); + expect(workflow).not.toContain("needs: approve_release_manager"); expect(workflow).toContain("useblacksmith/setup-docker-builder"); expect(workflow).toContain("useblacksmith/build-push-action"); expect(workflow).toContain("tags: openclaw-docker-e2e:local"); From 5b257cb352b5ee66d7b554a6400ea471bbb90b36 Mon Sep 17 00:00:00 2001 From: Peter Steinberger <steipete@gmail.com> Date: Sun, 26 Apr 2026 23:51:51 +0100 Subject: [PATCH 099/418] test(qa): drop brittle telegram workflow assertions (cherry picked from commit b02fdb8264daf81da421a5df271f755812f5a487) --- AGENTS.md | 1 + test/scripts/npm-telegram-live.test.ts | 34 -------------------------- 2 files changed, 1 insertion(+), 34 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 8e1e0d7ab53..29bf3eff3f5 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -120,6 +120,7 @@ Telegraph style. Root rules only. Read scoped `AGENTS.md` before subtree work. ## Tests - Vitest. Colocated `*.test.ts`; e2e `*.e2e.test.ts`; example models `sonnet-4.6`, `gpt-5.4`. +- Avoid brittle tests that grep workflow/docs strings for operator policy. Prefer executable behavior, parsed config/schema checks, or live run proof; put release/CI policy reminders in AGENTS/docs instead. - Clean timers/env/globals/mocks/sockets/temp dirs/module state; `--isolate=false` safe. - Hot tests: avoid per-test `vi.resetModules()` + heavy imports. Measure with `pnpm test:perf:imports <file>` / `pnpm test:perf:hotspots --limit N`. - Seam depth: pure helper/contract unit tests; one integration smoke per boundary. diff --git a/test/scripts/npm-telegram-live.test.ts b/test/scripts/npm-telegram-live.test.ts index b721a2f6d08..a5912fb7abc 100644 --- a/test/scripts/npm-telegram-live.test.ts +++ b/test/scripts/npm-telegram-live.test.ts @@ -6,7 +6,6 @@ import { __testing } from "../../scripts/e2e/npm-telegram-live-runner.ts"; const TEST_DIR = path.dirname(fileURLToPath(import.meta.url)); const DOCKER_SCRIPT_PATH = path.resolve(TEST_DIR, "../../scripts/e2e/npm-telegram-live-docker.sh"); -const WORKFLOW_PATH = path.resolve(TEST_DIR, "../../.github/workflows/npm-telegram-beta-e2e.yml"); describe("npm Telegram live Docker E2E", () => { it("supports npm-specific Convex credential aliases", () => { @@ -41,39 +40,6 @@ describe("npm Telegram live Docker E2E", () => { expect(script).toContain('credential_role="ci"'); }); - it("does not require release manager environment approval for the manual npm beta workflow", () => { - const workflow = readFileSync(WORKFLOW_PATH, "utf8"); - - expect(workflow).not.toContain("approve_release_manager:"); - expect(workflow).not.toContain("Approve npm Telegram beta E2E"); - expect(workflow).not.toContain("environment: npm-release"); - expect(workflow).not.toContain("needs: approve_release_manager"); - expect(workflow).toContain("environment: qa-live-shared"); - expect(workflow).not.toContain("Require main workflow ref"); - expect(workflow).not.toContain("refs/heads/main"); - expect(workflow).not.toContain('new Set(["admin", "write"])'); - expect(workflow).not.toContain("data.role_name"); - expect(workflow).not.toContain("github.rest.teams.listMembersInOrg"); - expect(workflow).not.toContain("getMembershipForUserInOrg"); - }); - - it("builds and reuses a local Docker E2E image", () => { - const workflow = readFileSync(WORKFLOW_PATH, "utf8"); - - expect(workflow).not.toContain("prepare_docker_e2e_image:"); - expect(workflow).toContain("run_npm_telegram_beta_e2e:"); - expect(workflow).not.toContain("needs: approve_release_manager"); - expect(workflow).toContain("useblacksmith/setup-docker-builder"); - expect(workflow).toContain("useblacksmith/build-push-action"); - expect(workflow).toContain("tags: openclaw-docker-e2e:local"); - expect(workflow).toContain("load: true"); - expect(workflow).toContain("push: false"); - expect(workflow).not.toContain("cache-from: type=gha"); - expect(workflow).not.toContain("cache-to: type=gha"); - expect(workflow).toContain('OPENCLAW_SKIP_DOCKER_BUILD: "1"'); - expect(workflow).toContain("OPENCLAW_DOCKER_E2E_IMAGE: openclaw-docker-e2e:local"); - }); - it("lets npm-specific credential aliases override shared QA env", () => { expect( __testing.resolveCredentialSource({ From 09a635a28b2b0029ef01cb7224eb16e75c3a9a1e Mon Sep 17 00:00:00 2001 From: Peter Steinberger <steipete@gmail.com> Date: Mon, 27 Apr 2026 00:02:29 +0100 Subject: [PATCH 100/418] test: fix main release validation forward-port --- scripts/e2e/npm-telegram-live-runner.ts | 5 ++++- scripts/test-docker-all.mjs | 15 --------------- 2 files changed, 4 insertions(+), 16 deletions(-) diff --git a/scripts/e2e/npm-telegram-live-runner.ts b/scripts/e2e/npm-telegram-live-runner.ts index 51ca2930bf7..d7b26995aa5 100644 --- a/scripts/e2e/npm-telegram-live-runner.ts +++ b/scripts/e2e/npm-telegram-live-runner.ts @@ -5,7 +5,6 @@ import fs from "node:fs/promises"; import path from "node:path"; import { pathToFileURL } from "node:url"; -import { formatErrorMessage } from "../../dist/infra/errors.js"; import { runTelegramQaLive } from "../../extensions/qa-lab/src/live-transports/telegram/telegram-live.runtime.ts"; function parseBoolean(value: string | undefined) { @@ -28,6 +27,10 @@ function resolveCredentialRole(env: NodeJS.ProcessEnv) { return env.OPENCLAW_NPM_TELEGRAM_CREDENTIAL_ROLE ?? env.OPENCLAW_QA_CREDENTIAL_ROLE; } +function formatErrorMessage(error: unknown) { + return error instanceof Error ? error.message : String(error); +} + async function resolveTrustedOpenClawCommand(rawCommand: string) { if (!path.isAbsolute(rawCommand)) { throw new Error("OPENCLAW_NPM_TELEGRAM_SUT_COMMAND must be an absolute path."); diff --git a/scripts/test-docker-all.mjs b/scripts/test-docker-all.mjs index c4870924bba..fb3dcafe23e 100644 --- a/scripts/test-docker-all.mjs +++ b/scripts/test-docker-all.mjs @@ -214,21 +214,6 @@ function withResolvedPnpmCommand(command, env) { return command.replace(/(^|\s)pnpm(?=\s)/g, `$1${shellQuote(pnpmCommand)}`); } -function timingSeconds(timingStore, poolLane) { - const fromStore = timingStore?.lanes?.[poolLane.name]?.durationSeconds; - if (typeof fromStore === "number" && Number.isFinite(fromStore) && fromStore > 0) { - return fromStore; - } - return poolLane.estimateSeconds ?? 0; -} - -function orderLanes(poolLanes, timingStore) { - return poolLanes - .map((poolLane, index) => ({ index, poolLane, seconds: timingSeconds(timingStore, poolLane) })) - .toSorted((a, b) => b.seconds - a.seconds || a.index - b.index) - .map(({ poolLane }) => poolLane); -} - async function loadTimingStore(file, enabled) { if (!enabled) { return { enabled: false, file, lanes: {}, version: 1 }; From eccb79db99a5227dbeefa7ea5bccd378f217c623 Mon Sep 17 00:00:00 2001 From: Peter Steinberger <steipete@gmail.com> Date: Mon, 27 Apr 2026 00:25:54 +0100 Subject: [PATCH 101/418] build: remove private QA package compat shims --- .../.generated/plugin-sdk-api-baseline.sha256 | 4 +- package.json | 14 +++--- scripts/check-openclaw-package-tarball.mjs | 5 --- scripts/check-plugin-sdk-subpath-exports.mjs | 14 ++++++ scripts/lib/plugin-sdk-entrypoints.json | 2 - ...lugin-sdk-private-local-only-subpaths.json | 2 +- scripts/openclaw-npm-release-check.ts | 25 +++++++++-- scripts/postinstall-bundled-plugins.mjs | 45 +------------------ scripts/release-check.ts | 11 +++-- scripts/write-npm-update-compat-sidecars.ts | 10 ----- src/infra/npm-update-compat-sidecars.ts | 30 ------------- src/infra/package-dist-inventory.test.ts | 19 ++++++-- src/infra/package-dist-inventory.ts | 31 ++++++------- src/infra/update-global.test.ts | 15 ------- src/infra/update-global.ts | 26 +++-------- .../contracts/plugin-sdk-subpaths.test.ts | 2 + test/openclaw-npm-release-check.test.ts | 16 ++++++- test/release-check.test.ts | 14 +++++- .../postinstall-bundled-plugins.test.ts | 32 +++---------- 19 files changed, 123 insertions(+), 194 deletions(-) delete mode 100644 scripts/write-npm-update-compat-sidecars.ts delete mode 100644 src/infra/npm-update-compat-sidecars.ts diff --git a/docs/.generated/plugin-sdk-api-baseline.sha256 b/docs/.generated/plugin-sdk-api-baseline.sha256 index 493d1effdba..cd7c3e48449 100644 --- a/docs/.generated/plugin-sdk-api-baseline.sha256 +++ b/docs/.generated/plugin-sdk-api-baseline.sha256 @@ -1,2 +1,2 @@ -fd941e0485a92ebb8256cf2256330b58c2d5bd94189f4a05d7394353ef7bed88 plugin-sdk-api-baseline.json -11ef8362518a0d9f221dc1958b25db46956d1916f278b53e52199bf6c2cbc65b plugin-sdk-api-baseline.jsonl +21914ef8c5840e0defc36d571834dc28a92d6d5ca2d42a088c33b4de681e836a plugin-sdk-api-baseline.json +3f22e6af0dad3433d25d996802d7436a3cc0e68bc86ecaf813a22e2b4e5333eb plugin-sdk-api-baseline.jsonl diff --git a/package.json b/package.json index bc630dc9596..e1f45690c76 100644 --- a/package.json +++ b/package.json @@ -37,14 +37,20 @@ "!dist/extensions/qa-channel/**", "!dist/extensions/qa-lab/**", "!dist/extensions/qa-matrix/**", + "!dist/plugin-sdk/extensions/qa-channel/**", "!dist/plugin-sdk/extensions/qa-lab/**", + "!dist/plugin-sdk/qa-channel.*", + "!dist/plugin-sdk/qa-channel-protocol.*", "!dist/plugin-sdk/qa-lab.*", "!dist/plugin-sdk/qa-runtime.*", + "!dist/plugin-sdk/src/plugin-sdk/qa-channel.d.ts", + "!dist/plugin-sdk/src/plugin-sdk/qa-channel-protocol.d.ts", "!dist/plugin-sdk/src/plugin-sdk/qa-lab.d.ts", "!dist/plugin-sdk/src/plugin-sdk/qa-runtime.d.ts", "!dist/qa-runtime-*.js", "docs/", "!docs/.generated/**", + "!docs/channels/qa-channel.md", "patches/", "skills/", "scripts/npm-runner.mjs", @@ -1044,14 +1050,6 @@ "types": "./dist/plugin-sdk/nostr.d.ts", "default": "./dist/plugin-sdk/nostr.js" }, - "./plugin-sdk/qa-channel": { - "types": "./dist/plugin-sdk/qa-channel.d.ts", - "default": "./dist/plugin-sdk/qa-channel.js" - }, - "./plugin-sdk/qa-channel-protocol": { - "types": "./dist/plugin-sdk/qa-channel-protocol.d.ts", - "default": "./dist/plugin-sdk/qa-channel-protocol.js" - }, "./plugin-sdk/provider-auth": { "types": "./dist/plugin-sdk/provider-auth.d.ts", "default": "./dist/plugin-sdk/provider-auth.js" diff --git a/scripts/check-openclaw-package-tarball.mjs b/scripts/check-openclaw-package-tarball.mjs index e9150325f3d..bdf62b00ded 100644 --- a/scripts/check-openclaw-package-tarball.mjs +++ b/scripts/check-openclaw-package-tarball.mjs @@ -5,8 +5,6 @@ import { spawnSync } from "node:child_process"; import fs from "node:fs"; -const INVENTORY_COMPAT_MISSING_ENTRIES = new Set(["dist/extensions/qa-channel/runtime-api.js"]); - function usage() { return "Usage: node scripts/check-openclaw-package-tarball.mjs <openclaw.tgz>"; } @@ -77,9 +75,6 @@ if (entrySet.has("dist/postinstall-inventory.json")) { } else { for (const inventoryEntry of inventory) { const normalizedEntry = inventoryEntry.replace(/\\/gu, "/"); - if (INVENTORY_COMPAT_MISSING_ENTRIES.has(normalizedEntry)) { - continue; - } if (!entrySet.has(normalizedEntry)) { errors.push(`inventory references missing tar entry ${normalizedEntry}`); } diff --git a/scripts/check-plugin-sdk-subpath-exports.mjs b/scripts/check-plugin-sdk-subpath-exports.mjs index d494844ce13..061e37e9dfd 100644 --- a/scripts/check-plugin-sdk-subpath-exports.mjs +++ b/scripts/check-plugin-sdk-subpath-exports.mjs @@ -30,6 +30,16 @@ function readEntrypoints() { return new Set(entrypoints.filter((entry) => entry !== "index")); } +function readPrivateLocalOnlySubpaths() { + const subpaths = JSON.parse( + readFileSync( + path.join(repoRoot, "scripts/lib/plugin-sdk-private-local-only-subpaths.json"), + "utf8", + ), + ); + return new Set(subpaths.filter((entry) => typeof entry === "string" && !entry.includes("/"))); +} + function parsePluginSdkSubpath(specifier) { if (!specifier.startsWith("openclaw/plugin-sdk/")) { return null; @@ -51,6 +61,7 @@ function compareEntries(left, right) { async function collectViolations() { const entrypoints = readEntrypoints(); const exports = readPackageExports(); + const privateLocalOnlySubpaths = readPrivateLocalOnlySubpaths(); const files = (await collectTypeScriptFilesFromRoots(scanRoots, { includeTests: true })).toSorted( (left, right) => normalizeRepoPath(repoRoot, left).localeCompare(normalizeRepoPath(repoRoot, right)), @@ -72,6 +83,9 @@ async function collectViolations() { if (!subpath) { return; } + if (privateLocalOnlySubpaths.has(subpath)) { + return; + } const missingFrom = []; if (!entrypoints.has(subpath)) { diff --git a/scripts/lib/plugin-sdk-entrypoints.json b/scripts/lib/plugin-sdk-entrypoints.json index 3b01bf352fa..ee0371c4f72 100644 --- a/scripts/lib/plugin-sdk-entrypoints.json +++ b/scripts/lib/plugin-sdk-entrypoints.json @@ -246,8 +246,6 @@ "native-command-registry", "nextcloud-talk", "nostr", - "qa-channel", - "qa-channel-protocol", "provider-auth", "provider-auth-runtime", "provider-auth-api-key", diff --git a/scripts/lib/plugin-sdk-private-local-only-subpaths.json b/scripts/lib/plugin-sdk-private-local-only-subpaths.json index 6b4a7af24a7..5e7ea8c64ca 100644 --- a/scripts/lib/plugin-sdk-private-local-only-subpaths.json +++ b/scripts/lib/plugin-sdk-private-local-only-subpaths.json @@ -1 +1 @@ -["qa-lab", "qa-runtime"] +["qa-channel", "qa-channel-protocol", "qa-lab", "qa-runtime"] diff --git a/scripts/openclaw-npm-release-check.ts b/scripts/openclaw-npm-release-check.ts index 328e8bbc167..1d975d20f98 100644 --- a/scripts/openclaw-npm-release-check.ts +++ b/scripts/openclaw-npm-release-check.ts @@ -74,6 +74,11 @@ const FORBIDDEN_PACKED_PATH_RULES = [ describe: (packedPath: string) => `npm package must not include generated docs artifact "${packedPath}".`, }, + { + prefix: "docs/channels/qa-channel.md", + describe: (packedPath: string) => + `npm package must not include private QA channel docs "${packedPath}".`, + }, { prefix: "dist/extensions/qa-channel/", describe: (packedPath: string) => @@ -84,11 +89,26 @@ const FORBIDDEN_PACKED_PATH_RULES = [ describe: (packedPath: string) => `npm package must not include private QA lab artifact "${packedPath}".`, }, + { + prefix: "dist/plugin-sdk/extensions/qa-channel/", + describe: (packedPath: string) => + `npm package must not include private QA channel type artifact "${packedPath}".`, + }, { prefix: "dist/plugin-sdk/extensions/qa-lab/", describe: (packedPath: string) => `npm package must not include private QA lab type artifact "${packedPath}".`, }, + { + prefix: "dist/plugin-sdk/qa-channel.", + describe: (packedPath: string) => + `npm package must not include private QA channel SDK artifact "${packedPath}".`, + }, + { + prefix: "dist/plugin-sdk/qa-channel-protocol.", + describe: (packedPath: string) => + `npm package must not include private QA channel SDK artifact "${packedPath}".`, + }, { prefix: "dist/qa-runtime-", describe: (packedPath: string) => @@ -103,6 +123,8 @@ const FORBIDDEN_PACKED_PATH_RULES = [ const FORBIDDEN_PRIVATE_QA_CONTENT_MARKERS = [ "//#region extensions/qa-lab/", "qa-channel/runtime-api.js", + "qa-channel.js", + "qa-channel-protocol.js", "qa-lab/cli.js", "qa-lab/runtime-api.js", ] as const; @@ -559,9 +581,6 @@ export function collectForbiddenPackedContentErrors( const textPathPattern = /\.(?:[cm]?js|d\.ts|json|md|mjs|cjs)$/u; const errors: string[] = []; for (const packedPath of paths) { - if (packedPath === PACKAGE_DIST_INVENTORY_RELATIVE_PATH) { - continue; - } if ( !FORBIDDEN_PRIVATE_QA_CONTENT_SCAN_PREFIXES.some((prefix) => packedPath.startsWith(prefix)) ) { diff --git a/scripts/postinstall-bundled-plugins.mjs b/scripts/postinstall-bundled-plugins.mjs index 5e5573ae571..c4917a0ca43 100644 --- a/scripts/postinstall-bundled-plugins.mjs +++ b/scripts/postinstall-bundled-plugins.mjs @@ -11,7 +11,6 @@ import { closeSync, existsSync, lstatSync, - mkdirSync, openSync, readdirSync, readFileSync, @@ -35,18 +34,6 @@ const DISABLE_POSTINSTALL_ENV = "OPENCLAW_DISABLE_BUNDLED_PLUGIN_POSTINSTALL"; const DISABLE_PLUGIN_REGISTRY_MIGRATION_ENV = "OPENCLAW_DISABLE_PLUGIN_REGISTRY_MIGRATION"; const EAGER_BUNDLED_PLUGIN_DEPS_ENV = "OPENCLAW_EAGER_BUNDLED_PLUGIN_DEPS"; const DIST_INVENTORY_PATH = "dist/postinstall-inventory.json"; -const LEGACY_QA_CHANNEL_DIR = ["qa", "channel"].join("-"); -const LEGACY_QA_LAB_DIR = ["qa", "lab"].join("-"); -const LEGACY_UPDATE_COMPAT_SIDECARS = [ - { - path: `dist/extensions/${LEGACY_QA_CHANNEL_DIR}/runtime-api.js`, - content: "export {};\n", - }, - { - path: `dist/extensions/${LEGACY_QA_LAB_DIR}/runtime-api.js`, - content: "export {};\n", - }, -]; const BAILEYS_MEDIA_FILE = join( "node_modules", "@whiskeysockets", @@ -329,29 +316,6 @@ export function pruneInstalledPackageDist(params = {}) { return removed; } -export function restoreLegacyUpdaterCompatSidecars(params = {}) { - const packageRoot = params.packageRoot ?? DEFAULT_PACKAGE_ROOT; - const writeFile = params.writeFileSync ?? writeFileSync; - const makeDirectory = params.mkdirSync ?? mkdirSync; - const log = params.log ?? console; - const restored = []; - - for (const sidecar of LEGACY_UPDATE_COMPAT_SIDECARS) { - // Older npm updater builds verify these exact sidecars after npm has - // already replaced the package, so generate them independently of prune - // results. - const sidecarPath = join(packageRoot, sidecar.path); - makeDirectory(dirname(sidecarPath), { recursive: true }); - writeFile(sidecarPath, sidecar.content, "utf8"); - restored.push(sidecar.path); - } - - if (restored.length > 0) { - log.log(`[postinstall] restored legacy updater compat sidecars: ${restored.join(", ")}`); - } - return restored; -} - function dependencySentinelPath(depName) { return join("node_modules", ...depName.split("/"), "package.json"); } @@ -781,7 +745,7 @@ export function runBundledPluginPostinstall(params = {}) { }); return; } - const prunedDistFiles = pruneInstalledPackageDist({ + pruneInstalledPackageDist({ packageRoot, existsSync: pathExists, readFileSync: params.readFileSync, @@ -789,13 +753,6 @@ export function runBundledPluginPostinstall(params = {}) { rmSync: params.rmSync, log, }); - restoreLegacyUpdaterCompatSidecars({ - packageRoot, - removedFiles: prunedDistFiles, - mkdirSync: params.mkdirSync, - writeFileSync: params.writeFileSync, - log, - }); if ( !shouldRunBundledPluginPostinstall({ env, diff --git a/scripts/release-check.ts b/scripts/release-check.ts index 1c6746f9e97..ea039f7d2fc 100755 --- a/scripts/release-check.ts +++ b/scripts/release-check.ts @@ -79,19 +79,27 @@ const forbiddenPrefixes = [ "dist/OpenClaw.app/", "dist/extensions/qa-channel/", "dist/extensions/qa-lab/", + "dist/plugin-sdk/extensions/qa-channel/", "dist/plugin-sdk/extensions/qa-lab/", + "dist/plugin-sdk/qa-channel.", + "dist/plugin-sdk/qa-channel-protocol.", "dist/plugin-sdk/qa-lab.", "dist/plugin-sdk/qa-runtime.", + "dist/plugin-sdk/src/plugin-sdk/qa-channel.d.ts", + "dist/plugin-sdk/src/plugin-sdk/qa-channel-protocol.d.ts", "dist/plugin-sdk/src/plugin-sdk/qa-lab.d.ts", "dist/plugin-sdk/src/plugin-sdk/qa-runtime.d.ts", "dist/qa-runtime-", "dist/plugin-sdk/.tsbuildinfo", "docs/.generated/", + "docs/channels/qa-channel.md", "qa/", ]; const forbiddenPrivateQaContentMarkers = [ "//#region extensions/qa-lab/", "qa-channel/runtime-api.js", + "qa-channel.js", + "qa-channel-protocol.js", "qa-lab/cli.js", "qa-lab/runtime-api.js", ] as const; @@ -602,9 +610,6 @@ export function collectForbiddenPackContentPaths( const textPathPattern = /\.(?:[cm]?js|d\.ts|json|md|mjs|cjs)$/u; return [...paths] .filter((packedPath) => { - if (packedPath === PACKAGE_DIST_INVENTORY_RELATIVE_PATH) { - return false; - } if (!forbiddenPrivateQaContentScanPrefixes.some((prefix) => packedPath.startsWith(prefix))) { return false; } diff --git a/scripts/write-npm-update-compat-sidecars.ts b/scripts/write-npm-update-compat-sidecars.ts deleted file mode 100644 index f002f6f81fa..00000000000 --- a/scripts/write-npm-update-compat-sidecars.ts +++ /dev/null @@ -1,10 +0,0 @@ -#!/usr/bin/env -S node --import tsx - -import fs from "node:fs"; -import path from "node:path"; -import { NPM_UPDATE_COMPAT_SIDECARS } from "../src/infra/npm-update-compat-sidecars.ts"; - -for (const entry of NPM_UPDATE_COMPAT_SIDECARS) { - fs.mkdirSync(path.dirname(entry.path), { recursive: true }); - fs.writeFileSync(entry.path, entry.content, "utf8"); -} diff --git a/src/infra/npm-update-compat-sidecars.ts b/src/infra/npm-update-compat-sidecars.ts deleted file mode 100644 index 456746f9770..00000000000 --- a/src/infra/npm-update-compat-sidecars.ts +++ /dev/null @@ -1,30 +0,0 @@ -const LEGACY_QA_CHANNEL_DIR = ["qa", "channel"].join("-"); -const LEGACY_QA_LAB_DIR = ["qa", "lab"].join("-"); - -type NpmUpdateCompatSidecar = { - path: string; - content: string; -}; - -const EMPTY_RUNTIME_SIDECAR = "export {};\n"; - -export const NPM_UPDATE_COMPAT_SIDECARS = [ - { - path: `dist/extensions/${LEGACY_QA_CHANNEL_DIR}/runtime-api.js`, - content: EMPTY_RUNTIME_SIDECAR, - }, - { - path: `dist/extensions/${LEGACY_QA_LAB_DIR}/runtime-api.js`, - content: EMPTY_RUNTIME_SIDECAR, - }, -] as const satisfies readonly NpmUpdateCompatSidecar[]; - -export const NPM_UPDATE_COMPAT_SIDECAR_PATHS = new Set<string>( - NPM_UPDATE_COMPAT_SIDECARS.map((entry) => entry.path), -); - -export const NPM_UPDATE_OMITTED_BUNDLED_PLUGIN_ROOTS = new Set<string>([ - `dist/extensions/${LEGACY_QA_CHANNEL_DIR}`, - `dist/extensions/${LEGACY_QA_LAB_DIR}`, - "dist/extensions/qa-matrix", -]); diff --git a/src/infra/package-dist-inventory.test.ts b/src/infra/package-dist-inventory.test.ts index 292077d1883..4f9e7029600 100644 --- a/src/infra/package-dist-inventory.test.ts +++ b/src/infra/package-dist-inventory.test.ts @@ -21,7 +21,6 @@ describe("package dist inventory", () => { await expect(writePackageDistInventory(packageRoot)).resolves.toEqual([ "dist/current-BR6xv1a1.js", - "dist/extensions/qa-channel/runtime-api.js", ]); await expect(collectPackageDistInventoryErrors(packageRoot)).resolves.toEqual([]); @@ -65,6 +64,18 @@ describe("package dist inventory", () => { "index.js", ); const omittedQaLabPluginSdk = path.join(packageRoot, "dist", "plugin-sdk", "qa-lab.js"); + const omittedQaChannelPluginSdk = path.join( + packageRoot, + "dist", + "plugin-sdk", + "qa-channel.js", + ); + const omittedQaChannelProtocolPluginSdk = path.join( + packageRoot, + "dist", + "plugin-sdk", + "qa-channel-protocol.js", + ); const omittedQaLabTypes = path.join( packageRoot, "dist", @@ -135,6 +146,8 @@ describe("package dist inventory", () => { await fs.writeFile(omittedQaLabChunk, "export {};\n", "utf8"); await fs.writeFile(omittedQaMatrixChunk, "export {};\n", "utf8"); await fs.writeFile(omittedQaLabPluginSdk, "export {};\n", "utf8"); + await fs.writeFile(omittedQaChannelPluginSdk, "export {};\n", "utf8"); + await fs.writeFile(omittedQaChannelProtocolPluginSdk, "export {};\n", "utf8"); await fs.writeFile(omittedQaLabTypes, "export {};\n", "utf8"); await fs.writeFile(omittedQaRuntimeChunk, "export {};\n", "utf8"); await fs.writeFile(omittedRuntimeDepsStamp, "{}\n", "utf8"); @@ -150,9 +163,7 @@ describe("package dist inventory", () => { ); await fs.writeFile(omittedMap, "{}", "utf8"); - await expect(writePackageDistInventory(packageRoot)).resolves.toEqual([ - "dist/extensions/qa-channel/runtime-api.js", - ]); + await expect(writePackageDistInventory(packageRoot)).resolves.toEqual([]); }); }); diff --git a/src/infra/package-dist-inventory.ts b/src/infra/package-dist-inventory.ts index 34b893e968c..7afefd88a95 100644 --- a/src/infra/package-dist-inventory.ts +++ b/src/infra/package-dist-inventory.ts @@ -1,24 +1,29 @@ import fs from "node:fs/promises"; import path from "node:path"; -import { NPM_UPDATE_COMPAT_SIDECAR_PATHS } from "./npm-update-compat-sidecars.js"; export const PACKAGE_DIST_INVENTORY_RELATIVE_PATH = "dist/postinstall-inventory.json"; const LEGACY_QA_CHANNEL_DIR = ["qa", "channel"].join("-"); const LEGACY_QA_LAB_DIR = ["qa", "lab"].join("-"); -const LEGACY_VERIFIER_COMPAT_INVENTORY_PATHS = [ - `dist/extensions/${LEGACY_QA_CHANNEL_DIR}/runtime-api.js`, -]; const OMITTED_QA_EXTENSION_PREFIXES = [ `dist/extensions/${LEGACY_QA_CHANNEL_DIR}/`, `dist/extensions/${LEGACY_QA_LAB_DIR}/`, "dist/extensions/qa-matrix/", ]; -const OMITTED_PRIVATE_QA_PLUGIN_SDK_PREFIXES = [`dist/plugin-sdk/extensions/${LEGACY_QA_LAB_DIR}/`]; +const OMITTED_PRIVATE_QA_PLUGIN_SDK_PREFIXES = [ + `dist/plugin-sdk/extensions/${LEGACY_QA_CHANNEL_DIR}/`, + `dist/plugin-sdk/extensions/${LEGACY_QA_LAB_DIR}/`, +]; const OMITTED_PRIVATE_QA_PLUGIN_SDK_FILES = new Set([ + `dist/plugin-sdk/${LEGACY_QA_CHANNEL_DIR}.d.ts`, + `dist/plugin-sdk/${LEGACY_QA_CHANNEL_DIR}.js`, + `dist/plugin-sdk/${LEGACY_QA_CHANNEL_DIR}-protocol.d.ts`, + `dist/plugin-sdk/${LEGACY_QA_CHANNEL_DIR}-protocol.js`, `dist/plugin-sdk/${LEGACY_QA_LAB_DIR}.d.ts`, `dist/plugin-sdk/${LEGACY_QA_LAB_DIR}.js`, "dist/plugin-sdk/qa-runtime.d.ts", "dist/plugin-sdk/qa-runtime.js", + `dist/plugin-sdk/src/plugin-sdk/${LEGACY_QA_CHANNEL_DIR}.d.ts`, + `dist/plugin-sdk/src/plugin-sdk/${LEGACY_QA_CHANNEL_DIR}-protocol.d.ts`, `dist/plugin-sdk/src/plugin-sdk/${LEGACY_QA_LAB_DIR}.d.ts`, "dist/plugin-sdk/src/plugin-sdk/qa-runtime.d.ts", ]); @@ -28,6 +33,7 @@ const OMITTED_DIST_SUBTREE_PATTERNS = [ /^dist\/extensions\/[^/]+\/node_modules(?:\/|$)/u, /^dist\/extensions\/[^/]+\/\.openclaw-runtime-deps-[^/]+(?:\/|$)/u, /^dist\/extensions\/qa-matrix(?:\/|$)/u, + new RegExp(`^dist/plugin-sdk/extensions/${LEGACY_QA_CHANNEL_DIR}(?:/|$)`, "u"), new RegExp(`^dist/plugin-sdk/extensions/${LEGACY_QA_LAB_DIR}(?:/|$)`, "u"), ] as const; const INSTALL_STAGE_DEBRIS_DIR_PATTERN = /^\.openclaw-install-stage(?:-[^/]+)?$/iu; @@ -67,9 +73,6 @@ function isPackagedDistPath(relativePath: string): boolean { if (relativePath === "dist/plugin-sdk/.tsbuildinfo") { return false; } - if (LEGACY_VERIFIER_COMPAT_INVENTORY_PATHS.includes(relativePath)) { - return true; - } if ( OMITTED_PRIVATE_QA_PLUGIN_SDK_PREFIXES.some((prefix) => relativePath.startsWith(prefix)) || OMITTED_PRIVATE_QA_PLUGIN_SDK_FILES.has(relativePath) || @@ -219,12 +222,9 @@ export async function assertNoBundledRuntimeDepsStagingDebris(packageRoot: strin export async function writePackageDistInventory(packageRoot: string): Promise<string[]> { await assertNoBundledRuntimeDepsStagingDebris(packageRoot); - const inventory = [ - ...new Set([ - ...(await collectPackageDistInventory(packageRoot)), - ...LEGACY_VERIFIER_COMPAT_INVENTORY_PATHS, - ]), - ].toSorted((left, right) => left.localeCompare(right)); + const inventory = [...new Set(await collectPackageDistInventory(packageRoot))].toSorted( + (left, right) => left.localeCompare(right), + ); const inventoryPath = path.join(packageRoot, PACKAGE_DIST_INVENTORY_RELATIVE_PATH); await fs.mkdir(path.dirname(inventoryPath), { recursive: true }); await fs.writeFile(inventoryPath, `${JSON.stringify(inventory, null, 2)}\n`, "utf8"); @@ -269,9 +269,6 @@ export async function collectPackageDistInventoryErrors(packageRoot: string): Pr for (const relativePath of expectedFiles) { if (!actualSet.has(relativePath)) { - if (NPM_UPDATE_COMPAT_SIDECAR_PATHS.has(relativePath)) { - continue; - } errors.push(`missing packaged dist file ${relativePath}`); } } diff --git a/src/infra/update-global.test.ts b/src/infra/update-global.test.ts index 869a0943c18..f406afbb8a5 100644 --- a/src/infra/update-global.test.ts +++ b/src/infra/update-global.test.ts @@ -5,7 +5,6 @@ import { bundledDistPluginFile } from "../../test/helpers/bundled-plugin-paths.j import { BUNDLED_RUNTIME_SIDECAR_PATHS } from "../plugins/runtime-sidecar-paths.js"; import { withTempDir } from "../test-helpers/temp-dir.js"; import { captureEnv } from "../test-utils/env.js"; -import { NPM_UPDATE_COMPAT_SIDECAR_PATHS } from "./npm-update-compat-sidecars.js"; import { PACKAGE_DIST_INVENTORY_RELATIVE_PATH, writePackageDistInventory, @@ -39,14 +38,6 @@ async function writeGlobalPackageJson(packageRoot: string, version = "1.0.0") { ); } -async function writeCompatSidecars(packageRoot: string) { - for (const relativePath of NPM_UPDATE_COMPAT_SIDECAR_PATHS) { - const absolutePath = path.join(packageRoot, relativePath); - await fs.mkdir(path.dirname(absolutePath), { recursive: true }); - await fs.writeFile(absolutePath, "export {};\n", "utf-8"); - } -} - async function writeBundledPluginPackageJson( packageRoot: string, pluginId: string, @@ -399,7 +390,6 @@ describe("update global helpers", () => { it("checks installed dist against the packaged inventory", async () => { await withTempDir({ prefix: "openclaw-update-global-pkg-" }, async (packageRoot) => { await writeGlobalPackageJson(packageRoot); - await writeCompatSidecars(packageRoot); for (const relativePath of BUNDLED_RUNTIME_SIDECAR_PATHS) { const absolutePath = path.join(packageRoot, relativePath); await fs.mkdir(path.dirname(absolutePath), { recursive: true }); @@ -428,7 +418,6 @@ describe("update global helpers", () => { it("ignores bundled plugin install stages during installed dist verification", async () => { await withTempDir({ prefix: "openclaw-update-global-plugin-stage-" }, async (packageRoot) => { await writeGlobalPackageJson(packageRoot); - await writeCompatSidecars(packageRoot); await fs.mkdir(path.join(packageRoot, "dist", "extensions", "brave"), { recursive: true }); await writePackageDistInventory(packageRoot); @@ -456,7 +445,6 @@ describe("update global helpers", () => { it("does not require private QA sidecars when the inventory is missing", async () => { await withTempDir({ prefix: "openclaw-update-global-legacy-" }, async (packageRoot) => { await writeGlobalPackageJson(packageRoot); - await writeCompatSidecars(packageRoot); await expect(collectInstalledGlobalPackageErrors({ packageRoot })).resolves.toEqual([]); }); @@ -467,7 +455,6 @@ describe("update global helpers", () => { { prefix: "openclaw-update-global-missing-inventory-new-" }, async (packageRoot) => { await writeGlobalPackageJson(packageRoot, "2026.4.15"); - await writeCompatSidecars(packageRoot); await expect(collectInstalledGlobalPackageErrors({ packageRoot })).resolves.toContain( `missing package dist inventory ${PACKAGE_DIST_INVENTORY_RELATIVE_PATH}`, @@ -511,7 +498,6 @@ describe("update global helpers", () => { { prefix: "openclaw-update-global-critical-sidecars-" }, async (packageRoot) => { await writeGlobalPackageJson(packageRoot, "2026.4.15"); - await writeCompatSidecars(packageRoot); await writeBundledPluginPackageJson(packageRoot, "matrix", "@openclaw/matrix"); await writePackageDistInventory(packageRoot); @@ -527,7 +513,6 @@ describe("update global helpers", () => { { prefix: "openclaw-update-global-stale-private-qa-" }, async (packageRoot) => { await writeGlobalPackageJson(packageRoot, "2026.4.15"); - await writeCompatSidecars(packageRoot); await writeBundledPluginPackageJson(packageRoot, "qa-lab", "@openclaw/qa-lab"); await writePackageDistInventory(packageRoot); diff --git a/src/infra/update-global.ts b/src/infra/update-global.ts index 5c1f479499c..c2359125008 100644 --- a/src/infra/update-global.ts +++ b/src/infra/update-global.ts @@ -5,10 +5,6 @@ import path from "node:path"; import { BUNDLED_RUNTIME_SIDECAR_PATHS } from "../plugins/runtime-sidecar-paths.js"; import { normalizeLowercaseStringOrEmpty } from "../shared/string-coerce.js"; import { pathExists } from "../utils.js"; -import { - NPM_UPDATE_COMPAT_SIDECAR_PATHS, - NPM_UPDATE_OMITTED_BUNDLED_PLUGIN_ROOTS, -} from "./npm-update-compat-sidecars.js"; import { collectPackageDistInventory, PACKAGE_DIST_INVENTORY_RELATIVE_PATH, @@ -46,6 +42,11 @@ const NPM_GLOBAL_INSTALL_OMIT_OPTIONAL_FLAGS = [ ...NPM_GLOBAL_INSTALL_QUIET_FLAGS, ] as const; const FIRST_PACKAGED_DIST_INVENTORY_VERSION = { major: 2026, minor: 4, patch: 15 }; +const OMITTED_PRIVATE_QA_BUNDLED_PLUGIN_ROOTS = new Set([ + "dist/extensions/qa-channel", + "dist/extensions/qa-lab", + "dist/extensions/qa-matrix", +]); function normalizePackageTarget(value: string): string { return value.trim(); @@ -187,25 +188,18 @@ async function collectInstalledPackageDistErrors(params: { } async function collectLegacyInstalledPackageDistPaths(packageRoot: string): Promise<string[]> { - const expectedFiles = new Set(NPM_UPDATE_COMPAT_SIDECAR_PATHS); - for (const relativePath of await collectCriticalInstalledPackageDistPaths(packageRoot)) { - expectedFiles.add(relativePath); - } - return [...expectedFiles].toSorted((left, right) => left.localeCompare(right)); + return await collectCriticalInstalledPackageDistPaths(packageRoot); } async function collectCriticalInstalledPackageDistPaths(packageRoot: string): Promise<string[]> { const expectedFiles = new Set<string>(); await Promise.all( BUNDLED_RUNTIME_SIDECAR_PATHS.map(async (relativePath) => { - if (NPM_UPDATE_COMPAT_SIDECAR_PATHS.has(relativePath)) { - return; - } const pluginRoot = resolveBundledPluginRoot(relativePath); if (pluginRoot === null) { return; } - if (NPM_UPDATE_OMITTED_BUNDLED_PLUGIN_ROOTS.has(pluginRoot)) { + if (OMITTED_PRIVATE_QA_BUNDLED_PLUGIN_ROOTS.has(pluginRoot)) { return; } if ( @@ -239,18 +233,12 @@ async function collectInstalledPathErrors(params: { ? actualSet.has(relativePath) : await pathExists(path.join(params.packageRoot, relativePath)); if (!exists) { - if (NPM_UPDATE_COMPAT_SIDECAR_PATHS.has(relativePath)) { - continue; - } errors.push(params.missingMessage(relativePath)); } } if (actualSet !== null && params.unexpectedMessage) { const expectedSet = new Set(params.expectedFiles); for (const relativePath of params.actualFiles ?? []) { - if (NPM_UPDATE_COMPAT_SIDECAR_PATHS.has(relativePath)) { - continue; - } if (!expectedSet.has(relativePath)) { errors.push(params.unexpectedMessage(relativePath)); } diff --git a/src/plugins/contracts/plugin-sdk-subpaths.test.ts b/src/plugins/contracts/plugin-sdk-subpaths.test.ts index f383efbd260..553aad87c0a 100644 --- a/src/plugins/contracts/plugin-sdk-subpaths.test.ts +++ b/src/plugins/contracts/plugin-sdk-subpaths.test.ts @@ -354,6 +354,8 @@ describe("plugin-sdk subpath exports", () => { "lobster", "pairing-access", "provider-model-definitions", + "qa-channel", + "qa-channel-protocol", "reply-prefix", "secret-input-schema", "signal-core", diff --git a/test/openclaw-npm-release-check.test.ts b/test/openclaw-npm-release-check.test.ts index 6e4b49a1928..0016959c9d3 100644 --- a/test/openclaw-npm-release-check.test.ts +++ b/test/openclaw-npm-release-check.test.ts @@ -333,16 +333,26 @@ describe("collectForbiddenPackedPathErrors", () => { "dist/extensions/qa-channel/package.json", "dist/extensions/qa-lab/runtime-api.js", "dist/extensions/qa-lab/src/cli.js", + "dist/plugin-sdk/extensions/qa-channel/api.d.ts", "dist/plugin-sdk/extensions/qa-lab/cli.d.ts", + "dist/plugin-sdk/qa-channel.js", + "dist/plugin-sdk/qa-channel-protocol.d.ts", "dist/qa-runtime-B9LDtssJ.js", + "docs/channels/qa-channel.md", + "docs/refactor/qa.md", "qa/scenarios/index.md", ]), ).toEqual([ 'npm package must not include private QA channel artifact "dist/extensions/qa-channel/package.json".', 'npm package must not include private QA channel artifact "dist/extensions/qa-channel/runtime-api.js".', + 'npm package must not include private QA channel docs "docs/channels/qa-channel.md".', + 'npm package must not include private QA channel SDK artifact "dist/plugin-sdk/qa-channel-protocol.d.ts".', + 'npm package must not include private QA channel SDK artifact "dist/plugin-sdk/qa-channel.js".', + 'npm package must not include private QA channel type artifact "dist/plugin-sdk/extensions/qa-channel/api.d.ts".', 'npm package must not include private QA lab artifact "dist/extensions/qa-lab/runtime-api.js".', 'npm package must not include private QA lab artifact "dist/extensions/qa-lab/src/cli.js".', 'npm package must not include private QA lab type artifact "dist/plugin-sdk/extensions/qa-lab/cli.d.ts".', + 'npm package must not include private QA refactor docs "docs/refactor/qa.md".', 'npm package must not include private QA runtime chunk "dist/qa-runtime-B9LDtssJ.js".', 'npm package must not include private QA suite artifact "qa/scenarios/index.md".', ]); @@ -380,7 +390,7 @@ describe("collectForbiddenPackedPathErrors", () => { } }); - it("allows legacy QA compatibility paths in the generated dist inventory", () => { + it("rejects private QA paths in the generated dist inventory", () => { const rootDir = mkdtempSync(join(tmpdir(), "openclaw-pack-inventory-")); try { @@ -393,7 +403,9 @@ describe("collectForbiddenPackedPathErrors", () => { expect( collectForbiddenPackedContentErrors([PACKAGE_DIST_INVENTORY_RELATIVE_PATH], rootDir), - ).toEqual([]); + ).toEqual([ + 'npm package must not include private QA lab marker "qa-lab/runtime-api.js" in "dist/postinstall-inventory.json".', + ]); } finally { rmSync(rootDir, { recursive: true, force: true }); } diff --git a/test/release-check.test.ts b/test/release-check.test.ts index da894422940..c8347f5542f 100644 --- a/test/release-check.test.ts +++ b/test/release-check.test.ts @@ -451,19 +451,29 @@ describe("collectForbiddenPackPaths", () => { "dist/index.js", "dist/extensions/qa-channel/runtime-api.js", "dist/extensions/qa-lab/runtime-api.js", + "dist/plugin-sdk/extensions/qa-channel/api.d.ts", "dist/plugin-sdk/extensions/qa-lab/cli.d.ts", + "dist/plugin-sdk/qa-channel.js", + "dist/plugin-sdk/qa-channel-protocol.d.ts", "dist/plugin-sdk/qa-lab.js", "dist/plugin-sdk/qa-runtime.js", "dist/qa-runtime-B9LDtssJ.js", + "docs/channels/qa-channel.md", + "docs/refactor/qa.md", "qa/scenarios/index.md", ]), ).toEqual([ "dist/extensions/qa-channel/runtime-api.js", "dist/extensions/qa-lab/runtime-api.js", + "dist/plugin-sdk/extensions/qa-channel/api.d.ts", "dist/plugin-sdk/extensions/qa-lab/cli.d.ts", + "dist/plugin-sdk/qa-channel-protocol.d.ts", + "dist/plugin-sdk/qa-channel.js", "dist/plugin-sdk/qa-lab.js", "dist/plugin-sdk/qa-runtime.js", "dist/qa-runtime-B9LDtssJ.js", + "docs/channels/qa-channel.md", + "docs/refactor/qa.md", "qa/scenarios/index.md", ]); }); @@ -488,7 +498,7 @@ describe("collectForbiddenPackPaths", () => { } }); - it("allows legacy QA compatibility paths in the generated dist inventory", () => { + it("blocks private QA paths in the generated dist inventory", () => { const tempRoot = mkdtempSync(join(tmpdir(), "openclaw-release-inventory-")); try { @@ -501,7 +511,7 @@ describe("collectForbiddenPackPaths", () => { expect( collectForbiddenPackContentPaths([PACKAGE_DIST_INVENTORY_RELATIVE_PATH], tempRoot), - ).toEqual([]); + ).toEqual([PACKAGE_DIST_INVENTORY_RELATIVE_PATH]); } finally { rmSync(tempRoot, { recursive: true, force: true }); } diff --git a/test/scripts/postinstall-bundled-plugins.test.ts b/test/scripts/postinstall-bundled-plugins.test.ts index 90d25a0185f..d32542c8d2e 100644 --- a/test/scripts/postinstall-bundled-plugins.test.ts +++ b/test/scripts/postinstall-bundled-plugins.test.ts @@ -11,9 +11,7 @@ import { pruneBundledPluginSourceNodeModules, runBundledPluginPostinstall, runPluginRegistryPostinstallMigration, - restoreLegacyUpdaterCompatSidecars, } from "../../scripts/postinstall-bundled-plugins.mjs"; -import { NPM_UPDATE_COMPAT_SIDECARS } from "../../src/infra/npm-update-compat-sidecars.ts"; import { writePackageDistInventory } from "../../src/infra/package-dist-inventory.ts"; import { createScriptTestHarness } from "./test-helpers.js"; @@ -396,7 +394,7 @@ describe("bundled plugin postinstall", () => { await expect(fs.stat(staleFile)).rejects.toMatchObject({ code: "ENOENT" }); }); - it("restores only postinstall-generated QA compat sidecars after pruning old installs", async () => { + it("prunes stale private QA files without restoring compat sidecars", async () => { const packageRoot = await createTempDirAsync("openclaw-packaged-install-qa-compat-"); const currentFile = path.join(packageRoot, "dist", "entry.js"); const stalePackage = path.join(packageRoot, "dist", "extensions", "qa-lab", "package.json"); @@ -422,10 +420,8 @@ describe("bundled plugin postinstall", () => { await expect(fs.stat(stalePackage)).rejects.toMatchObject({ code: "ENOENT" }); await expect(fs.stat(staleManifest)).rejects.toMatchObject({ code: "ENOENT" }); await expect( - fs.readFile(path.join(packageRoot, "dist", "extensions", "qa-channel", "runtime-api.js"), { - encoding: "utf8", - }), - ).resolves.toBe("export {};\n"); + fs.stat(path.join(packageRoot, "dist", "extensions", "qa-channel", "runtime-api.js")), + ).rejects.toMatchObject({ code: "ENOENT" }); await expect( fs.stat(path.join(packageRoot, "dist", "extensions", "qa-channel", "package.json")), ).rejects.toMatchObject({ code: "ENOENT" }); @@ -433,26 +429,8 @@ describe("bundled plugin postinstall", () => { fs.stat(path.join(packageRoot, "dist", "extensions", "qa-channel", "openclaw.plugin.json")), ).rejects.toMatchObject({ code: "ENOENT" }); await expect( - fs.readFile(path.join(packageRoot, "dist", "extensions", "qa-lab", "runtime-api.js"), { - encoding: "utf8", - }), - ).resolves.toBe("export {};\n"); - }); - - it("keeps postinstall QA compat sidecars aligned with update verification metadata", async () => { - const packageRoot = await createTempDirAsync("openclaw-packaged-install-qa-compat-"); - - const restored = restoreLegacyUpdaterCompatSidecars({ - packageRoot, - log: { log: vi.fn(), warn: vi.fn() }, - }); - - expect(restored).toEqual(NPM_UPDATE_COMPAT_SIDECARS.map((sidecar) => sidecar.path)); - for (const sidecar of NPM_UPDATE_COMPAT_SIDECARS) { - await expect(fs.readFile(path.join(packageRoot, sidecar.path), "utf8")).resolves.toBe( - sidecar.content, - ); - } + fs.stat(path.join(packageRoot, "dist", "extensions", "qa-lab", "runtime-api.js")), + ).rejects.toMatchObject({ code: "ENOENT" }); }); it("keeps packaged postinstall non-fatal when the dist inventory is missing", async () => { From 9be8d43c3182c2b773bbb25a79a08895320addab Mon Sep 17 00:00:00 2001 From: Peter Steinberger <steipete@gmail.com> Date: Mon, 27 Apr 2026 00:25:56 +0100 Subject: [PATCH 102/418] docs: document installer recovery cleanup --- docs/install/updating.md | 14 + ...exec-duplicate-completion-investigation.md | 133 ----- docs/refactor/qa.md | 540 ------------------ 3 files changed, 14 insertions(+), 673 deletions(-) delete mode 100644 docs/refactor/async-exec-duplicate-completion-investigation.md delete mode 100644 docs/refactor/qa.md diff --git a/docs/install/updating.md b/docs/install/updating.md index 56af3187ebd..e5384bf450b 100644 --- a/docs/install/updating.md +++ b/docs/install/updating.md @@ -67,6 +67,20 @@ Add `--no-onboard` to skip onboarding. To force a specific install type through the installer, pass `--install-method git --no-onboard` or `--install-method npm --no-onboard`. +If `openclaw update` fails after the npm package install phase, re-run the +installer. The installer does not call the old updater; it runs the global +package install directly and can recover a partially updated npm install. + +```bash +curl -fsSL https://openclaw.ai/install.sh | bash -s -- --install-method npm +``` + +To pin the recovery to a specific version or dist-tag, add `--version`: + +```bash +curl -fsSL https://openclaw.ai/install.sh | bash -s -- --install-method npm --version <version-or-dist-tag> +``` + ## Alternative: manual npm, pnpm, or bun ```bash diff --git a/docs/refactor/async-exec-duplicate-completion-investigation.md b/docs/refactor/async-exec-duplicate-completion-investigation.md deleted file mode 100644 index 8f92ae3ed0c..00000000000 --- a/docs/refactor/async-exec-duplicate-completion-investigation.md +++ /dev/null @@ -1,133 +0,0 @@ ---- -summary: "Investigation notes for duplicate async exec completion injection" -read_when: - - Debugging repeated node exec completion events - - Working on heartbeat/system-event dedupe -title: "Async exec duplicate completion investigation" ---- - -## Scope - -- Session: `agent:main:telegram:group:-1003774691294:topic:1` -- Symptom: the same async exec completion for session/run `keen-nexus` was recorded twice in LCM as user turns. -- Goal: identify whether this is most likely duplicate session injection or plain outbound delivery retry. - -## Conclusion - -Most likely this is **duplicate session injection**, not a pure outbound delivery retry. - -The strongest gateway-side gap is in the **node exec completion path**: - -1. A node-side exec finish emits `exec.finished` with the full `runId`. -2. Gateway `server-node-events` converts that into a system event and requests a heartbeat. -3. The heartbeat run injects the drained system event block into the agent prompt. -4. The embedded runner persists that prompt as a new user turn in the session transcript. - -If the same `exec.finished` reaches the gateway twice for the same `runId` for any reason (replay, reconnect duplicate, upstream resend, duplicated producer), OpenClaw currently has **no idempotency check keyed by `runId`/`contextKey`** on this path. The second copy will become a second user message with the same content. - -## Exact Code Path - -### 1. Producer: node exec completion event - -- `src/node-host/invoke.ts:340-360` - - `sendExecFinishedEvent(...)` emits `node.event` with event `exec.finished`. - - Payload includes `sessionKey` and full `runId`. - -### 2. Gateway event ingestion - -- `src/gateway/server-node-events.ts:574-640` - - Handles `exec.finished`. - - Builds text: - - `Exec finished (node=..., id=<runId>, code ...)` - - Enqueues it via: - - `enqueueSystemEvent(text, { sessionKey, contextKey: runId ? \`exec:${runId}\` : "exec", trusted: false })` - - Immediately requests a wake: - - `requestHeartbeatNow(scopedHeartbeatWakeOptions(sessionKey, { reason: "exec-event" }))` - -### 3. System event dedupe weakness - -- `src/infra/system-events.ts:90-115` - - `enqueueSystemEvent(...)` only suppresses **consecutive duplicate text**: - - `if (entry.lastText === cleaned) return false` - - It stores `contextKey`, but does **not** use `contextKey` for idempotency. - - After drain, duplicate suppression resets. - -This means a replayed `exec.finished` with the same `runId` can be accepted again later, even though the code already had a stable idempotency candidate (`exec:<runId>`). - -### 4. Wake handling is not the primary duplicator - -- `src/infra/heartbeat-wake.ts:79-117` - - Wakes are coalesced by `(agentId, sessionKey)`. - - Duplicate wake requests for the same target collapse to one pending wake entry. - -This makes **duplicate wake handling alone** a weaker explanation than duplicate event ingestion. - -### 5. Heartbeat consumes the event and turns it into prompt input - -- `src/infra/heartbeat-runner.ts:535-574` - - Preflight peeks pending system events and classifies exec-event runs. -- `src/auto-reply/reply/session-system-events.ts:86-90` - - `drainFormattedSystemEvents(...)` drains the queue for the session. -- `src/auto-reply/reply/get-reply-run.ts:400-427` - - The drained system event block is prepended into the agent prompt body. - -### 6. Transcript injection point - -- `src/agents/pi-embedded-runner/run/attempt.ts:2000-2017` - - `activeSession.prompt(effectivePrompt)` submits the full prompt to the embedded PI session. - - That is the point where the completion-derived prompt becomes a persisted user turn. - -So once the same system event is rebuilt into the prompt twice, duplicate LCM user messages are expected. - -## Why plain outbound delivery retry is less likely - -There is a real outbound failure path in the heartbeat runner: - -- `src/infra/heartbeat-runner.ts:1194-1242` - - The reply is generated first. - - Outbound delivery happens later via `deliverOutboundPayloads(...)`. - - Failure there returns `{ status: "failed" }`. - -However, for the same system event queue entry, this alone is **not sufficient** to explain the duplicate user turns: - -- `src/auto-reply/reply/session-system-events.ts:86-90` - - The system event queue is already drained before outbound delivery. - -So a channel send retry by itself would not recreate the exact same queued event. It could explain missing/failed external delivery, but not by itself a second identical session user message. - -## Secondary, lower-confidence possibility - -There is a full-run retry loop in the agent runner: - -- `src/auto-reply/reply/agent-runner-execution.ts:741-1473` - - Certain transient failures can retry the whole run and resubmit the same `commandBody`. - -That can duplicate a persisted user prompt **within the same reply execution** if the prompt was already appended before the retry condition triggered. - -I rank this lower than duplicate `exec.finished` ingestion because: - -- the observed gap was around 51 seconds, which looks more like a second wake/turn than an in-process retry; -- the report already mentions repeated message send failures, which points more toward a separate later turn than an immediate model/runtime retry. - -## Root Cause Hypothesis - -Highest-confidence hypothesis: - -- The `keen-nexus` completion came through the **node exec event path**. -- The same `exec.finished` was delivered to `server-node-events` twice. -- Gateway accepted both because `enqueueSystemEvent(...)` does not dedupe by `contextKey` / `runId`. -- Each accepted event triggered a heartbeat and was injected as a user turn into the PI transcript. - -## Proposed Tiny Surgical Fix - -If a fix is wanted, the smallest high-value change is: - -- make exec/system-event idempotency honor `contextKey` for a short horizon, at least for exact `(sessionKey, contextKey, text)` repeats; -- or add a dedicated dedupe in `server-node-events` for `exec.finished` keyed by `(sessionKey, runId, event kind)`. - -That would directly block replayed `exec.finished` duplicates before they become session turns. - -## Related - -- [Exec tool](/tools/exec) -- [Session management](/concepts/session) diff --git a/docs/refactor/qa.md b/docs/refactor/qa.md deleted file mode 100644 index 4770aeafe7a..00000000000 --- a/docs/refactor/qa.md +++ /dev/null @@ -1,540 +0,0 @@ ---- -summary: "QA refactor plan for scenario catalog and harness consolidation" -read_when: - - Refactoring QA scenario definitions or qa-lab harness code - - Moving QA behavior between markdown scenarios and TypeScript harness logic -title: "QA refactor" ---- - -Status: foundational migration landed. - -## Goal - -Move OpenClaw QA from a split-definition model to a single source of truth: - -- scenario metadata -- prompts sent to the model -- setup and teardown -- harness logic -- assertions and success criteria -- artifacts and report hints - -The desired end state is a generic QA harness that loads powerful scenario definition files instead of hardcoding most behavior in TypeScript. - -## Current State - -Primary source of truth now lives in `qa/scenarios/index.md` plus one file per -scenario under `qa/scenarios/<theme>/*.md`. - -Implemented: - -- `qa/scenarios/index.md` - - canonical QA pack metadata - - operator identity - - kickoff mission -- `qa/scenarios/<theme>/*.md` - - one markdown file per scenario - - scenario metadata - - handler bindings - - scenario-specific execution config -- `extensions/qa-lab/src/scenario-catalog.ts` - - markdown pack parser + zod validation -- `extensions/qa-lab/src/qa-agent-bootstrap.ts` - - plan rendering from the markdown pack -- `extensions/qa-lab/src/qa-agent-workspace.ts` - - seeds generated compatibility files plus `QA_SCENARIOS.md` -- `extensions/qa-lab/src/suite.ts` - - selects executable scenarios through markdown-defined handler bindings -- QA bus protocol + UI - - generic inline attachments for image/video/audio/file rendering - -Remaining split surfaces: - -- `extensions/qa-lab/src/suite.ts` - - still owns most executable custom handler logic -- `extensions/qa-lab/src/report.ts` - - still derives report structure from runtime outputs - -So the source-of-truth split is fixed, but execution is still mostly handler-backed rather than fully declarative. - -## What The Real Scenario Surface Looks Like - -Reading the current suite shows a few distinct scenario classes. - -### Simple interaction - -- channel baseline -- DM baseline -- threaded follow-up -- model switch -- approval followthrough -- reaction/edit/delete - -### Config and runtime mutation - -- config patch skill disable -- config apply restart wake-up -- config restart capability flip -- runtime inventory drift check - -### Filesystem and repo assertions - -- source/docs discovery report -- build Lobster Invaders -- generated image artifact lookup - -### Memory orchestration - -- memory recall -- memory tools in channel context -- memory failure fallback -- session memory ranking -- thread memory isolation -- memory dreaming sweep - -### Tool and plugin integration - -- MCP plugin-tools call -- skill visibility -- skill hot install -- native image generation -- image roundtrip -- image understanding from attachment - -### Multi-turn and multi-actor - -- subagent handoff -- subagent fanout synthesis -- restart recovery style flows - -These categories matter because they drive DSL requirements. A flat list of prompt + expected text is not enough. - -## Direction - -### Single source of truth - -Use `qa/scenarios/index.md` plus `qa/scenarios/<theme>/*.md` as the authored -source of truth. - -The pack should stay: - -- human-readable in review -- machine-parseable -- rich enough to drive: - - suite execution - - QA workspace bootstrap - - QA Lab UI metadata - - docs/discovery prompts - - report generation - -### Preferred authoring format - -Use markdown as the top-level format, with structured YAML inside it. - -Recommended shape: - -- YAML frontmatter - - id - - title - - surface - - tags - - docs refs - - code refs - - model/provider overrides - - prerequisites -- prose sections - - objective - - notes - - debugging hints -- fenced YAML blocks - - setup - - steps - - assertions - - cleanup - -This gives: - -- better PR readability than giant JSON -- richer context than pure YAML -- strict parsing and zod validation - -Raw JSON is acceptable only as an intermediate generated form. - -## Proposed Scenario File Shape - -Example: - -````md ---- -id: image-generation-roundtrip -title: Image generation roundtrip -surface: image -tags: [media, image, roundtrip] -models: - primary: openai/gpt-5.4 -requires: - tools: [image_generate] - plugins: [openai, qa-channel] -docsRefs: - - docs/help/testing.md - - docs/concepts/model-providers.md -codeRefs: - - extensions/qa-lab/src/suite.ts - - src/gateway/chat-attachments.ts ---- - -# Objective - -Verify generated media is reattached on the follow-up turn. - -# Setup - -```yaml scenario.setup -- action: config.patch - patch: - agents: - defaults: - imageGenerationModel: - primary: openai/gpt-image-1 -- action: session.create - key: agent:qa:image-roundtrip -``` - -# Steps - -```yaml scenario.steps -- action: agent.send - session: agent:qa:image-roundtrip - message: | - Image generation check: generate a QA lighthouse image and summarize it in one short sentence. -- action: artifact.capture - kind: generated-image - promptSnippet: Image generation check - saveAs: lighthouseImage -- action: agent.send - session: agent:qa:image-roundtrip - message: | - Roundtrip image inspection check: describe the generated lighthouse attachment in one short sentence. - attachments: - - fromArtifact: lighthouseImage -``` - -# Expect - -```yaml scenario.expect -- assert: outbound.textIncludes - value: lighthouse -- assert: requestLog.matches - where: - promptIncludes: Roundtrip image inspection check - imageInputCountGte: 1 -- assert: artifact.exists - ref: lighthouseImage -``` -```` - -## Runner Capabilities The DSL Must Cover - -Based on the current suite, the generic runner needs more than prompt execution. - -### Environment and setup actions - -- `bus.reset` -- `gateway.waitHealthy` -- `channel.waitReady` -- `session.create` -- `thread.create` -- `workspace.writeSkill` - -### Agent turn actions - -- `agent.send` -- `agent.wait` -- `bus.injectInbound` -- `bus.injectOutbound` - -### Config and runtime actions - -- `config.get` -- `config.patch` -- `config.apply` -- `gateway.restart` -- `tools.effective` -- `skills.status` - -### File and artifact actions - -- `file.write` -- `file.read` -- `file.delete` -- `file.touchTime` -- `artifact.captureGeneratedImage` -- `artifact.capturePath` - -### Memory and cron actions - -- `memory.indexForce` -- `memory.searchCli` -- `doctor.memory.status` -- `cron.list` -- `cron.run` -- `cron.waitCompletion` -- `sessionTranscript.write` - -### MCP actions - -- `mcp.callTool` - -### Assertions - -- `outbound.textIncludes` -- `outbound.inThread` -- `outbound.notInRoot` -- `tool.called` -- `tool.notPresent` -- `skill.visible` -- `skill.disabled` -- `file.contains` -- `memory.contains` -- `requestLog.matches` -- `sessionStore.matches` -- `cron.managedPresent` -- `artifact.exists` - -## Variables and Artifact References - -The DSL must support saved outputs and later references. - -Examples from the current suite: - -- create a thread, then reuse `threadId` -- create a session, then reuse `sessionKey` -- generate an image, then attach the file on the next turn -- generate a wake marker string, then assert that it appears later - -Needed capabilities: - -- `saveAs` -- `${vars.name}` -- `${artifacts.name}` -- typed references for paths, session keys, thread ids, markers, tool outputs - -Without variable support, the harness will keep leaking scenario logic back into TypeScript. - -## What Should Stay As Escape Hatches - -A fully pure declarative runner is not realistic in phase 1. - -Some scenarios are inherently orchestration-heavy: - -- memory dreaming sweep -- config apply restart wake-up -- config restart capability flip -- generated image artifact resolution by timestamp/path -- discovery-report evaluation - -These should use explicit custom handlers for now. - -Recommended rule: - -- 85-90% declarative -- explicit `customHandler` steps for the hard remainder -- named and documented custom handlers only -- no anonymous inline code in the scenario file - -That keeps the generic engine clean while still allowing progress. - -## Architecture Change - -### Current - -Scenario markdown already is the source of truth for: - -- suite execution -- workspace bootstrap files -- QA Lab UI scenario catalog -- report metadata -- discovery prompts - -Generated compatibility: - -- seeded workspace still includes `QA_KICKOFF_TASK.md` -- seeded workspace still includes `QA_SCENARIO_PLAN.md` -- seeded workspace now also includes `QA_SCENARIOS.md` - -## Refactor Plan - -### Phase 1: loader and schema - -Done. - -- added `qa/scenarios/index.md` -- split scenarios into `qa/scenarios/<theme>/*.md` -- added parser for named markdown YAML pack content -- validated with zod -- switched consumers to the parsed pack -- removed repo-level `qa/seed-scenarios.json` and `qa/QA_KICKOFF_TASK.md` - -### Phase 2: generic engine - -- split `extensions/qa-lab/src/suite.ts` into: - - loader - - engine - - action registry - - assertion registry - - custom handlers -- keep existing helper functions as engine operations - -Deliverable: - -- engine executes simple declarative scenarios - -Start with scenarios that are mostly prompt + wait + assert: - -- threaded follow-up -- image understanding from attachment -- skill visibility and invocation -- channel baseline - -Deliverable: - -- first real markdown-defined scenarios shipping through the generic engine - -### Phase 4: migrate medium scenarios - -- image generation roundtrip -- memory tools in channel context -- session memory ranking -- subagent handoff -- subagent fanout synthesis - -Deliverable: - -- variables, artifacts, tool assertions, request-log assertions proven out - -### Phase 5: keep hard scenarios on custom handlers - -- memory dreaming sweep -- config apply restart wake-up -- config restart capability flip -- runtime inventory drift - -Deliverable: - -- same authoring format, but with explicit custom-step blocks where needed - -### Phase 6: delete hardcoded scenario map - -Once the pack coverage is good enough: - -- remove most scenario-specific TypeScript branching from `extensions/qa-lab/src/suite.ts` - -## Fake Slack / Rich Media Support - -The current QA bus is text-first. - -Relevant files: - -- `extensions/qa-channel/src/protocol.ts` -- `extensions/qa-lab/src/bus-state.ts` -- `extensions/qa-lab/src/bus-queries.ts` -- `extensions/qa-lab/src/bus-server.ts` -- `extensions/qa-lab/web/src/ui-render.ts` - -Today the QA bus supports: - -- text -- reactions -- threads - -It does not yet model inline media attachments. - -### Needed transport contract - -Add a generic QA bus attachment model: - -```ts -type QaBusAttachment = { - id: string; - kind: "image" | "video" | "audio" | "file"; - mimeType: string; - fileName?: string; - inline?: boolean; - url?: string; - contentBase64?: string; - width?: number; - height?: number; - durationMs?: number; - altText?: string; - transcript?: string; -}; -``` - -Then add `attachments?: QaBusAttachment[]` to: - -- `QaBusMessage` -- `QaBusInboundMessageInput` -- `QaBusOutboundMessageInput` - -### Why generic first - -Do not build a Slack-only media model. - -Instead: - -- one generic QA transport model -- multiple renderers on top of it - - current QA Lab chat - - future fake Slack web - - any other fake transport views - -This prevents duplicate logic and lets media scenarios stay transport-agnostic. - -### UI work needed - -Update the QA UI to render: - -- inline image preview -- inline audio player -- inline video player -- file attachment chip - -The current UI can already render threads and reactions, so attachment rendering should layer onto the same message card model. - -### Scenario work enabled by media transport - -Once attachments flow through QA bus, we can add richer fake-chat scenarios: - -- inline image reply in fake Slack -- audio attachment understanding -- video attachment understanding -- mixed attachment ordering -- thread reply with media retained - -## Recommendation - -The next implementation chunk should be: - -1. add markdown scenario loader + zod schema -2. generate the current catalog from markdown -3. migrate a few simple scenarios first -4. add generic QA bus attachment support -5. render inline image in the QA UI -6. then expand to audio and video - -This is the smallest path that proves both goals: - -- generic markdown-defined QA -- richer fake messaging surfaces - -## Open Questions - -- whether scenario files should allow embedded markdown prompt templates with variable interpolation -- whether setup/cleanup should be named sections or just ordered action lists -- whether artifact references should be strongly typed in schema or string-based -- whether custom handlers should live in one registry or per-surface registries -- whether the generated JSON compatibility file should remain checked in during migration - -## Related - -- [QA E2E automation](/concepts/qa-e2e-automation) From 7902c769dabe5fdd45c7bd2edef2eb823e9d5dd4 Mon Sep 17 00:00:00 2001 From: Vincent Koc <vincentkoc@ieee.org> Date: Sun, 26 Apr 2026 16:24:02 -0700 Subject: [PATCH 103/418] fix(codex): normalize cached harness input tokens --- .../src/app-server/event-projector.test.ts | 16 +++++----- .../codex/src/app-server/event-projector.ts | 32 +++++++++++++------ 2 files changed, 31 insertions(+), 17 deletions(-) diff --git a/extensions/codex/src/app-server/event-projector.test.ts b/extensions/codex/src/app-server/event-projector.test.ts index c6997ea0a31..3ceaa739b4f 100644 --- a/extensions/codex/src/app-server/event-projector.test.ts +++ b/extensions/codex/src/app-server/event-projector.test.ts @@ -167,7 +167,7 @@ describe("CodexAppServerEventProjector", () => { outputTokens: 100_000, }, last: { - totalTokens: 14, + totalTokens: 12, inputTokens: 5, cachedInputTokens: 2, outputTokens: 7, @@ -186,12 +186,12 @@ describe("CodexAppServerEventProjector", () => { expect(result.assistantTexts).toEqual(["hello"]); expect(result.messagesSnapshot.map((message) => message.role)).toEqual(["user", "assistant"]); expect(result.lastAssistant?.content).toEqual([{ type: "text", text: "hello" }]); - expect(result.attemptUsage).toMatchObject({ input: 5, output: 7, cacheRead: 2, total: 14 }); + expect(result.attemptUsage).toMatchObject({ input: 3, output: 7, cacheRead: 2, total: 12 }); expect(result.lastAssistant?.usage).toMatchObject({ - input: 5, + input: 3, output: 7, cacheRead: 2, - totalTokens: 14, + totalTokens: 12, }); expect(result.replayMetadata.replaySafe).toBe(true); }); @@ -289,7 +289,7 @@ describe("CodexAppServerEventProjector", () => { tokenUsage: { total: { total_tokens: 1_000_000 }, last_token_usage: { - total_tokens: 20, + total_tokens: 17, input_tokens: 8, cached_input_tokens: 3, output_tokens: 9, @@ -300,12 +300,12 @@ describe("CodexAppServerEventProjector", () => { const result = projector.buildResult(buildEmptyToolTelemetry()); - expect(result.attemptUsage).toMatchObject({ input: 8, output: 9, cacheRead: 3, total: 20 }); + expect(result.attemptUsage).toMatchObject({ input: 5, output: 9, cacheRead: 3, total: 17 }); expect(result.lastAssistant?.usage).toMatchObject({ - input: 8, + input: 5, output: 9, cacheRead: 3, - totalTokens: 20, + totalTokens: 17, }); }); diff --git a/extensions/codex/src/app-server/event-projector.ts b/extensions/codex/src/app-server/event-projector.ts index 6b5d4805d57..dc40dc6260b 100644 --- a/extensions/codex/src/app-server/event-projector.ts +++ b/extensions/codex/src/app-server/event-projector.ts @@ -61,6 +61,13 @@ const CURRENT_TOKEN_USAGE_KEYS = [ "last_token_usage", ] as const; +const CODEX_PROMPT_TOTAL_INPUT_KEYS = [ + "inputTokens", + "input_tokens", + "promptTokens", + "prompt_tokens", +] as const; + const MAX_TOOL_OUTPUT_DELTA_MESSAGES_PER_ITEM = 20; export class CodexAppServerEventProjector { @@ -910,17 +917,24 @@ function readNumberAlias(record: JsonObject, keys: readonly string[]): number | } function normalizeCodexTokenUsage(record: JsonObject): ReturnType<typeof normalizeUsage> { + const promptTotalInput = readNumberAlias(record, CODEX_PROMPT_TOTAL_INPUT_KEYS); + const cacheRead = readNumberAlias(record, [ + "cachedInputTokens", + "cached_input_tokens", + "cacheRead", + "cache_read", + "cache_read_input_tokens", + "cached_tokens", + ]); + const input = + promptTotalInput !== undefined && cacheRead !== undefined + ? Math.max(0, promptTotalInput - cacheRead) + : (promptTotalInput ?? readNumber(record, "input")); + return normalizeUsage({ - input: readNumberAlias(record, ["inputTokens", "input_tokens", "input", "promptTokens"]), + input, output: readNumberAlias(record, ["outputTokens", "output_tokens", "output"]), - cacheRead: readNumberAlias(record, [ - "cachedInputTokens", - "cached_input_tokens", - "cacheRead", - "cache_read", - "cache_read_input_tokens", - "cached_tokens", - ]), + cacheRead, cacheWrite: readNumberAlias(record, [ "cacheWrite", "cache_write", From 3cc52d9050310cc7dc6ce1f3beb6d4b3d60bf39a Mon Sep 17 00:00:00 2001 From: Vincent Koc <vincentkoc@ieee.org> Date: Sun, 26 Apr 2026 16:24:23 -0700 Subject: [PATCH 104/418] docs(changelog): note codex usage accounting fix --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index a709de1401a..0aca7510e90 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,7 @@ Docs: https://docs.openclaw.ai ### Fixes +- Codex harness: normalize cached input tokens before session/context accounting so prompt cache reads are not double-counted in `/status`, `session_status`, or persisted `sessionEntry.totalTokens`. Fixes #69298. Thanks @richardmqq. - Hooks/session-memory: use the host local timezone for memory filenames, fallback timestamp slugs, and markdown headers instead of UTC dates. Fixes #46703. (#46721) Thanks @Astro-Han. - Feishu: extract quoted/replied interactive-card text across schema 1.0, schema 2.0, i18n, template-variable, and post-format fallback shapes without carrying broad generated/config churn from related parser experiments. (#38776, #60383, #42218, #45936) Thanks @lishuaigit, @lskun, @just2gooo, and @Br1an67. - Exec approvals: accept a symlinked `OPENCLAW_HOME` as the trusted approvals root while still rejecting symlinked `.openclaw` path components below it. (#64663) Thanks @FunJim. From 998e37fcb3d5b937fcf70d7509b677efba939f10 Mon Sep 17 00:00:00 2001 From: Peter Steinberger <steipete@gmail.com> Date: Mon, 27 Apr 2026 00:31:26 +0100 Subject: [PATCH 105/418] ci: allow installer smoke baseline override --- .github/workflows/install-smoke.yml | 12 +++++++++++- docs/help/testing.md | 2 +- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/.github/workflows/install-smoke.yml b/.github/workflows/install-smoke.yml index 6a75eb849c1..14d9e620172 100644 --- a/.github/workflows/install-smoke.yml +++ b/.github/workflows/install-smoke.yml @@ -10,6 +10,11 @@ on: required: false default: false type: boolean + update_baseline_version: + description: Baseline openclaw version or dist-tag for installer update smoke + required: false + default: latest + type: string workflow_call: inputs: ref: @@ -21,6 +26,11 @@ on: required: false default: true type: boolean + update_baseline_version: + description: Baseline openclaw version or dist-tag for installer update smoke + required: false + default: latest + type: string permissions: contents: read @@ -330,7 +340,7 @@ jobs: OPENCLAW_INSTALL_SMOKE_SKIP_NONROOT: "0" OPENCLAW_INSTALL_SMOKE_SKIP_NPM_GLOBAL: "1" OPENCLAW_INSTALL_SMOKE_SKIP_PREVIOUS: "1" - OPENCLAW_INSTALL_SMOKE_UPDATE_BASELINE: latest + OPENCLAW_INSTALL_SMOKE_UPDATE_BASELINE: ${{ inputs.update_baseline_version || 'latest' }} OPENCLAW_INSTALL_SMOKE_UPDATE_DIST_IMAGE: openclaw-dockerfile-smoke:local OPENCLAW_INSTALL_SMOKE_UPDATE_SKIP_LOCAL_BUILD: "1" run: bash scripts/test-install-sh-docker.sh diff --git a/docs/help/testing.md b/docs/help/testing.md index 8b5cdb338b1..0206aa1f901 100644 --- a/docs/help/testing.md +++ b/docs/help/testing.md @@ -623,7 +623,7 @@ The live-model Docker runners also bind-mount only the needed CLI auth homes (or - Update channel switch smoke: `pnpm test:docker:update-channel-switch` installs the packed OpenClaw tarball globally in Docker, switches from package `stable` to git `dev`, verifies the persisted channel and plugin post-update work, then switches back to package `stable` and checks update status. - Session runtime context smoke: `pnpm test:docker:session-runtime-context` verifies hidden runtime context transcript persistence plus doctor repair of affected duplicated prompt-rewrite branches. - Bun global install smoke: `bash scripts/e2e/bun-global-install-smoke.sh` packs the current tree, installs it with `bun install -g` in an isolated home, and verifies `openclaw infer image providers --json` returns bundled image providers instead of hanging. Reuse a prebuilt tarball with `OPENCLAW_BUN_GLOBAL_SMOKE_PACKAGE_TGZ=/path/to/openclaw-*.tgz`, skip the host build with `OPENCLAW_BUN_GLOBAL_SMOKE_HOST_BUILD=0`, or copy `dist/` from a built Docker image with `OPENCLAW_BUN_GLOBAL_SMOKE_DIST_IMAGE=openclaw-dockerfile-smoke:local`. -- Installer Docker smoke: `bash scripts/test-install-sh-docker.sh` shares one npm cache across its root, update, and direct-npm containers. Update smoke defaults to npm `latest` as the stable baseline before upgrading to the candidate tarball. Non-root installer checks keep an isolated npm cache so root-owned cache entries do not mask user-local install behavior. Set `OPENCLAW_INSTALL_SMOKE_NPM_CACHE_DIR=/path/to/cache` to reuse the root/update/direct-npm cache across local reruns. +- Installer Docker smoke: `bash scripts/test-install-sh-docker.sh` shares one npm cache across its root, update, and direct-npm containers. Update smoke defaults to npm `latest` as the stable baseline before upgrading to the candidate tarball. Override with `OPENCLAW_INSTALL_SMOKE_UPDATE_BASELINE=2026.4.22` locally, or with the Install Smoke workflow's `update_baseline_version` input on GitHub. Non-root installer checks keep an isolated npm cache so root-owned cache entries do not mask user-local install behavior. Set `OPENCLAW_INSTALL_SMOKE_NPM_CACHE_DIR=/path/to/cache` to reuse the root/update/direct-npm cache across local reruns. - Install Smoke CI skips the duplicate direct-npm global update with `OPENCLAW_INSTALL_SMOKE_SKIP_NPM_GLOBAL=1`; run the script locally without that env when direct `npm install -g` coverage is needed. - Agents delete shared workspace CLI smoke: `pnpm test:docker:agents-delete-shared-workspace` (script: `scripts/e2e/agents-delete-shared-workspace-docker.sh`) builds the root Dockerfile image by default, seeds two agents with one workspace in an isolated container home, runs `agents delete --json`, and verifies valid JSON plus retained workspace behavior. Reuse the install-smoke image with `OPENCLAW_AGENTS_DELETE_SHARED_WORKSPACE_E2E_IMAGE=openclaw-dockerfile-smoke:local OPENCLAW_AGENTS_DELETE_SHARED_WORKSPACE_E2E_SKIP_BUILD=1`. - Gateway networking (two containers, WS auth + health): `pnpm test:docker:gateway-network` (script: `scripts/e2e/gateway-network-docker.sh`) From 560ddd2f9b13fe2cf2073ea2922df481b7c06bb4 Mon Sep 17 00:00:00 2001 From: Tak Hoffman <781889+Takhoffman@users.noreply.github.com> Date: Sun, 26 Apr 2026 18:38:23 -0500 Subject: [PATCH 106/418] Fail package update on unhealthy restart (#72422) --- src/cli/daemon-cli/restart-health.test.ts | 38 ++++++++ src/cli/daemon-cli/restart-health.ts | 111 +++++++++++++++++----- src/cli/update-cli/update-command.ts | 4 + 3 files changed, 129 insertions(+), 24 deletions(-) diff --git a/src/cli/daemon-cli/restart-health.test.ts b/src/cli/daemon-cli/restart-health.test.ts index 8077a2877f5..1c33c5c0fef 100644 --- a/src/cli/daemon-cli/restart-health.test.ts +++ b/src/cli/daemon-cli/restart-health.test.ts @@ -438,6 +438,44 @@ describe("inspectGatewayRestart", () => { expect(sleep).not.toHaveBeenCalled(); }); + it("stops waiting once the expected-version gateway reports channel probe errors", async () => { + probeGateway.mockResolvedValue({ + ok: true, + close: null, + server: { version: "2026.4.24", connId: "new" }, + health: { + ok: true, + channels: { + telegram: { + configured: true, + probe: { ok: false, error: "This operation was aborted" }, + }, + }, + }, + }); + inspectPortUsage.mockResolvedValue({ + port: 18789, + status: "busy", + listeners: [{ pid: 8000, commandLine: "openclaw-gateway" }], + hints: [], + }); + + const { waitForGatewayHealthyRestart } = await import("./restart-health.js"); + const snapshot = await waitForGatewayHealthyRestart({ + service: makeGatewayService({ status: "running", pid: 8000 }), + port: 18789, + expectedVersion: "2026.4.24", + }); + + expect(snapshot).toMatchObject({ + healthy: false, + waitOutcome: "channel-errors", + elapsedMs: 0, + channelProbeErrors: [{ id: "telegram", error: "This operation was aborted" }], + }); + expect(sleep).not.toHaveBeenCalled(); + }); + it("treats busy ports with unavailable listener details as healthy when runtime is running", async () => { const service = { readRuntime: vi.fn(async () => ({ status: "running", pid: 8000 })), diff --git a/src/cli/daemon-cli/restart-health.ts b/src/cli/daemon-cli/restart-health.ts index 1a01a1ef20a..1eba53b970d 100644 --- a/src/cli/daemon-cli/restart-health.ts +++ b/src/cli/daemon-cli/restart-health.ts @@ -26,6 +26,7 @@ const WINDOWS_STOPPED_FREE_EARLY_EXIT_GRACE_MS = 90_000; export type GatewayRestartWaitOutcome = | "healthy" | "plugin-errors" + | "channel-errors" | "version-mismatch" | "stale-pids" | "stopped-free" @@ -38,6 +39,7 @@ export type GatewayRestartSnapshot = { staleGatewayPids: number[]; gatewayVersion?: string | null; activatedPluginErrors?: PluginHealthErrorSummary[]; + channelProbeErrors?: Array<{ id: string; error: string }>; expectedVersion?: string; versionMismatch?: { expected: string; @@ -56,6 +58,7 @@ type GatewayReachability = { reachable: boolean; gatewayVersion: string | null; activatedPluginErrors: PluginHealthErrorSummary[]; + channelProbeErrors: Array<{ id: string; error: string }>; }; function hasListenerAttributionGap(portUsage: PortUsage): boolean { @@ -154,6 +157,36 @@ function readActivatedPluginErrors(health: unknown): PluginHealthErrorSummary[] }); } +function readChannelProbeErrors(health: unknown): Array<{ id: string; error: string }> { + if (!health || typeof health !== "object") { + return []; + } + const channels = (health as { channels?: unknown }).channels; + if (!channels || typeof channels !== "object" || Array.isArray(channels)) { + return []; + } + const errors: Array<{ id: string; error: string }> = []; + for (const [id, summary] of Object.entries(channels)) { + if (!summary || typeof summary !== "object") { + continue; + } + const probe = (summary as { probe?: unknown }).probe; + if (!probe || typeof probe !== "object") { + continue; + } + const ok = (probe as { ok?: unknown }).ok; + if (ok !== false) { + continue; + } + const error = (probe as { error?: unknown }).error; + errors.push({ + id, + error: typeof error === "string" && error.trim() ? error : "probe failed", + }); + } + return errors; +} + function applyActivatedPluginErrors(snapshot: GatewayRestartSnapshot): GatewayRestartSnapshot { if (!snapshot.activatedPluginErrors?.length) { return snapshot; @@ -161,6 +194,13 @@ function applyActivatedPluginErrors(snapshot: GatewayRestartSnapshot): GatewayRe return { ...snapshot, healthy: false }; } +function applyChannelProbeErrors(snapshot: GatewayRestartSnapshot): GatewayRestartSnapshot { + if (!snapshot.channelProbeErrors?.length) { + return snapshot; + } + return { ...snapshot, healthy: false }; +} + async function confirmGatewayReachable(params: { port: number; includeHealthDetails?: boolean; @@ -177,6 +217,7 @@ async function confirmGatewayReachable(params: { reachable: probe.ok || looksLikeAuthClose(probe.close?.code, probe.close?.reason), gatewayVersion: probe.server?.version ?? null, activatedPluginErrors: readActivatedPluginErrors(probe.health), + channelProbeErrors: readChannelProbeErrors(probe.health), }; } @@ -217,6 +258,7 @@ export async function inspectGatewayRestart(params: { const expectedVersion = normalizeOptionalString(params.expectedVersion); let reachability: GatewayReachability | null = null; let activatedPluginErrors: PluginHealthErrorSummary[] = []; + let channelProbeErrors: Array<{ id: string; error: string }> = []; const loadReachability = async () => { if (!reachability) { reachability = await confirmGatewayReachable({ @@ -224,6 +266,7 @@ export async function inspectGatewayRestart(params: { includeHealthDetails: Boolean(expectedVersion), }); activatedPluginErrors = reachability.activatedPluginErrors; + channelProbeErrors = reachability.channelProbeErrors; } return reachability; }; @@ -251,19 +294,24 @@ export async function inspectGatewayRestart(params: { try { const reachable = await loadReachability(); if (reachable.reachable) { - return applyActivatedPluginErrors( - applyExpectedVersion( - { - runtime, - portUsage, - healthy: true, - staleGatewayPids: [], - gatewayVersion: reachable.gatewayVersion, - ...(reachable.activatedPluginErrors.length > 0 - ? { activatedPluginErrors: reachable.activatedPluginErrors } - : {}), - }, - expectedVersion, + return applyChannelProbeErrors( + applyActivatedPluginErrors( + applyExpectedVersion( + { + runtime, + portUsage, + healthy: true, + staleGatewayPids: [], + gatewayVersion: reachable.gatewayVersion, + ...(reachable.activatedPluginErrors.length > 0 + ? { activatedPluginErrors: reachable.activatedPluginErrors } + : {}), + ...(reachable.channelProbeErrors.length > 0 + ? { channelProbeErrors: reachable.channelProbeErrors } + : {}), + }, + expectedVersion, + ), ), ); } @@ -307,6 +355,9 @@ export async function inspectGatewayRestart(params: { if (reachable.activatedPluginErrors.length > 0) { healthy = false; } + if (reachable.channelProbeErrors.length > 0) { + healthy = false; + } } catch { healthy = false; } @@ -340,17 +391,20 @@ export async function inspectGatewayRestart(params: { ]), ); - return applyActivatedPluginErrors( - applyExpectedVersion( - { - runtime, - portUsage, - healthy, - staleGatewayPids, - ...(gatewayVersion !== undefined ? { gatewayVersion } : {}), - ...(activatedPluginErrors.length ? { activatedPluginErrors } : {}), - }, - expectedVersion, + return applyChannelProbeErrors( + applyActivatedPluginErrors( + applyExpectedVersion( + { + runtime, + portUsage, + healthy, + staleGatewayPids, + ...(gatewayVersion !== undefined ? { gatewayVersion } : {}), + ...(activatedPluginErrors.length ? { activatedPluginErrors } : {}), + ...(channelProbeErrors.length ? { channelProbeErrors } : {}), + }, + expectedVersion, + ), ), ); } @@ -415,6 +469,9 @@ export async function waitForGatewayHealthyRestart(params: { if (snapshot.activatedPluginErrors?.length) { return withWaitContext(snapshot, "plugin-errors", attempt * delayMs); } + if (snapshot.channelProbeErrors?.length) { + return withWaitContext(snapshot, "channel-errors", attempt * delayMs); + } if (snapshot.versionMismatch) { return withWaitContext(snapshot, "version-mismatch", attempt * delayMs); } @@ -493,6 +550,12 @@ export function renderRestartDiagnostics(snapshot: GatewayRestartSnapshot): stri lines.push(`- ${plugin.id}: ${plugin.error}`); } } + if (snapshot.channelProbeErrors?.length) { + lines.push("Channel health probe errors:"); + for (const channel of snapshot.channelProbeErrors) { + lines.push(`- ${channel.id}: ${channel.error}`); + } + } const runtimeSummary = [ snapshot.runtime.status ? `status=${snapshot.runtime.status}` : null, snapshot.runtime.state ? `state=${snapshot.runtime.state}` : null, diff --git a/src/cli/update-cli/update-command.ts b/src/cli/update-cli/update-command.ts index 24e5cc4f0ca..54937619ae2 100644 --- a/src/cli/update-cli/update-command.ts +++ b/src/cli/update-cli/update-command.ts @@ -856,6 +856,10 @@ async function maybeRestartService(params: { } } + if (isPackageManagerUpdateMode(params.result.mode)) { + return false; + } + return !(health.versionMismatch || health.activatedPluginErrors?.length); }; From 5d7c6e6bda3f779e324d72f58f9f2fe18a2a8106 Mon Sep 17 00:00:00 2001 From: Vincent Koc <vincentkoc@ieee.org> Date: Sun, 26 Apr 2026 16:43:56 -0700 Subject: [PATCH 107/418] test(docker): add observability smoke Add Docker aggregate observability coverage for QA-lab OTEL and Prometheus diagnostics. --- CHANGELOG.md | 1 + docs/concepts/qa-e2e-automation.md | 8 + docs/help/testing.md | 1 + .../runtime/docker-prometheus-smoke.md | 156 ++++++++++++++++++ scripts/e2e/Dockerfile.observability | 55 ++++++ scripts/e2e/docker-observability-smoke.sh | 52 ++++++ scripts/lib/docker-e2e-scenarios.mjs | 9 +- 7 files changed, 281 insertions(+), 1 deletion(-) create mode 100644 qa/scenarios/runtime/docker-prometheus-smoke.md create mode 100644 scripts/e2e/Dockerfile.observability create mode 100644 scripts/e2e/docker-observability-smoke.sh diff --git a/CHANGELOG.md b/CHANGELOG.md index 0aca7510e90..667c88e56f7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -19,6 +19,7 @@ Docs: https://docs.openclaw.ai - Providers/Ollama: honor `/api/show` capabilities when registering local models so non-tool Ollama models no longer receive the agent tool surface, and keep native Ollama thinking opt-in instead of enabling it by default. Fixes #64710 and duplicate #65343. Thanks @yuan-b, @netherby, @xilopaint, and @Diyforfun2026. - Providers/Ollama: expose native Ollama thinking effort levels so `/think max` is accepted for reasoning-capable Ollama models and maps to Ollama's highest supported `think` effort. Fixes #71584. Thanks @g0st1n. - Agents/Ollama: validate explicit `--thinking max` against catalog-discovered Ollama reasoning metadata so local agent runs accept the same native thinking levels shown in the model catalog. Fixes #71584. Thanks @g0st1n. +- Docker/QA: add observability coverage to the normal Docker aggregate so QA-lab OTEL and Prometheus diagnostics run inside Docker. Thanks @vincentkoc. - Auto-reply: poison inbound message dedupe after replay-unsafe provider/runtime failures so retries stay safe before visible progress but cannot duplicate messages after block output, tool side effects, or session progress. Fixes #69303; keeps #58549 and #64606 as duplicate validation. Thanks @martingarramon, @NikolaFC, and @zeroth-blip. - Agents/model fallback: jump directly to a known later live-session model redirect instead of walking unrelated fallback candidates, while preserving the already-landed live-session/fallback loop guard. Fixes #57471; related loop family already closed via #58496. Thanks @yuxiaoyang2007-prog. - Gateway/Bonjour: keep @homebridge/ciao cancellation handlers registered across advertiser restarts so late probing cancellations cannot crash Linux and other mDNS-churned gateways. Thanks @codex. diff --git a/docs/concepts/qa-e2e-automation.md b/docs/concepts/qa-e2e-automation.md index d56e546b6f1..68e35f189f3 100644 --- a/docs/concepts/qa-e2e-automation.md +++ b/docs/concepts/qa-e2e-automation.md @@ -65,6 +65,14 @@ model calls must not export `StreamAbandoned` on successful turns; raw diagnosti `openclaw.content.*` attributes must stay out of the trace. It writes `otel-smoke-summary.json` next to the QA suite artifacts. +The normal Docker aggregate also runs an observability lane. It builds or +reuses a source-backed Docker observability image, runs the OTEL trace smoke +inside the container, then runs the `docker-prometheus-smoke` QA scenario with the +`diagnostics-prometheus` plugin enabled. Set +`OPENCLAW_DOCKER_OBSERVABILITY_LOOPS=<count>` to repeat both checks inside one +Docker run while preserving per-loop artifacts under +`.artifacts/docker-observability/...`. + For a transport-real Matrix smoke lane, run: ```bash diff --git a/docs/help/testing.md b/docs/help/testing.md index 0206aa1f901..7da6a728b1f 100644 --- a/docs/help/testing.md +++ b/docs/help/testing.md @@ -617,6 +617,7 @@ The live-model Docker runners also bind-mount only the needed CLI auth homes (or - CLI backend smoke: `pnpm test:docker:live-cli-backend` (script: `scripts/test-live-cli-backend-docker.sh`) - Codex app-server harness smoke: `pnpm test:docker:live-codex-harness` (script: `scripts/test-live-codex-harness-docker.sh`) - Gateway + dev agent: `pnpm test:docker:live-gateway` (script: `scripts/test-live-gateway-models-docker.sh`) +- Docker observability smoke: included in `pnpm test:docker:all` and `pnpm test:docker:local:all` (script: `scripts/e2e/docker-observability-smoke.sh`). It runs QA-lab OTEL and Prometheus diagnostics checks inside a source-backed Docker image. Set `OPENCLAW_DOCKER_OBSERVABILITY_LOOPS=<count>` to repeat both checks in one container run. - Open WebUI live smoke: `pnpm test:docker:openwebui` (script: `scripts/e2e/openwebui-docker.sh`) - Onboarding wizard (TTY, full scaffolding): `pnpm test:docker:onboard` (script: `scripts/e2e/onboard-docker.sh`) - Npm tarball onboarding/channel/agent smoke: `pnpm test:docker:npm-onboard-channel-agent` installs the packed OpenClaw tarball globally in Docker, configures OpenAI via env-ref onboarding plus Telegram by default, verifies doctor repairs activated plugin runtime deps, and runs one mocked OpenAI agent turn. Reuse a prebuilt tarball with `OPENCLAW_CURRENT_PACKAGE_TGZ=/path/to/openclaw-*.tgz`, skip the host rebuild with `OPENCLAW_NPM_ONBOARD_HOST_BUILD=0`, or switch channel with `OPENCLAW_NPM_ONBOARD_CHANNEL=discord`. diff --git a/qa/scenarios/runtime/docker-prometheus-smoke.md b/qa/scenarios/runtime/docker-prometheus-smoke.md new file mode 100644 index 00000000000..a91965e6ed9 --- /dev/null +++ b/qa/scenarios/runtime/docker-prometheus-smoke.md @@ -0,0 +1,156 @@ +# Docker Prometheus smoke + +```yaml qa-scenario +id: docker-prometheus-smoke +title: Docker Prometheus smoke +surface: telemetry +coverage: + primary: + - telemetry.prometheus + secondary: + - harness.qa-lab + - docker.e2e +objective: Verify a QA-lab gateway run emits protected, bounded Prometheus diagnostics metrics through the diagnostics-prometheus plugin. +successCriteria: + - The diagnostics-prometheus plugin exposes the protected scrape route. + - An unauthenticated scrape is rejected. + - A minimal QA-channel agent turn completes. + - The authenticated scrape includes release-critical diagnostics metric families. + - Prometheus output omits prompt content, session keys, auth tokens, raw ids, and file paths. +plugins: + - diagnostics-prometheus +gatewayConfigPatch: + diagnostics: + enabled: true +docsRefs: + - docs/gateway/prometheus.md + - docs/concepts/qa-e2e-automation.md +codeRefs: + - extensions/diagnostics-prometheus/src/service.ts + - src/diagnostics/internal-diagnostics.ts + - extensions/qa-lab/src/suite.ts +execution: + kind: flow + summary: Complete a minimal QA-lab turn and scrape the protected Prometheus route. + config: + prompt: Reply exactly DOCKER-PROMETHEUS-OK. Do not repeat DOCKER-PROMETHEUS-SECRET. + secretNeedle: DOCKER-PROMETHEUS-SECRET +``` + +```yaml qa-flow +steps: + - name: emits protected low-cardinality prometheus metrics + actions: + - call: waitForGatewayHealthy + args: + - ref: env + - 60000 + - call: waitForQaChannelReady + args: + - ref: env + - 60000 + - call: reset + - set: startCursor + value: + expr: state.getSnapshot().messages.length + - call: runAgentPrompt + args: + - ref: env + - sessionKey: agent:qa:docker-prometheus-smoke + message: + expr: config.prompt + timeoutMs: + expr: liveTurnTimeoutMs(env, 30000) + - call: waitForCondition + saveAs: outbound + args: + - lambda: + expr: "state.getSnapshot().messages.slice(startCursor).filter((candidate) => candidate.direction === 'outbound' && candidate.conversation.id === 'qa-operator' && String(candidate.text ?? '').trim().length > 0).at(-1)" + - expr: liveTurnTimeoutMs(env, 30000) + - expr: "env.providerMode === 'mock-openai' ? 100 : 250" + - assert: + expr: "String(outbound.text ?? '').trim().length > 0" + message: "expected non-empty qa output before scraping metrics" + - set: prometheusUrl + value: + expr: "`${env.gateway.baseUrl}/api/diagnostics/prometheus`" + - set: gatewayToken + value: + expr: "String(env.gateway.token ?? env.gateway.runtimeEnv.OPENCLAW_GATEWAY_TOKEN ?? '')" + - assert: + expr: "gatewayToken.length > 0" + message: "expected QA gateway token to be available for protected scrape" + - set: unauthenticatedScrape + value: + expr: |- + (async () => { + const response = await fetch(prometheusUrl); + await response.text().catch(() => ""); + return { status: response.status }; + })() + - assert: + expr: "unauthenticatedScrape.status === 401 || unauthenticatedScrape.status === 403" + message: + expr: "`expected unauthenticated prometheus scrape to be rejected, got ${unauthenticatedScrape.status}`" + - set: authenticatedScrape + value: + expr: |- + (async () => { + const response = await fetch(prometheusUrl, { + headers: { authorization: `Bearer ${gatewayToken}` }, + }); + const text = await response.text(); + return { + status: response.status, + contentType: response.headers.get("content-type") ?? "", + text, + }; + })() + - assert: + expr: "authenticatedScrape.status === 200" + message: + expr: "`expected authenticated prometheus scrape to return 200, got ${authenticatedScrape.status}`" + - assert: + expr: "authenticatedScrape.contentType.includes('text/plain')" + message: + expr: "`expected prometheus text content type, got ${authenticatedScrape.contentType}`" + - set: prometheusText + value: + expr: "String(authenticatedScrape.text ?? '')" + - assert: + expr: "prometheusText.includes('# TYPE openclaw_run_completed_total counter')" + message: "missing run completion counter" + - assert: + expr: "prometheusText.includes('# TYPE openclaw_run_duration_seconds histogram')" + message: "missing run duration histogram" + - assert: + expr: "prometheusText.includes('# TYPE openclaw_model_call_total counter')" + message: "missing model call counter" + - assert: + expr: "prometheusText.includes('# TYPE openclaw_harness_run_total counter')" + message: "missing harness run counter" + - assert: + expr: "!prometheusText.includes(config.secretNeedle)" + message: "prometheus output leaked prompt sentinel" + - assert: + expr: "!prometheusText.includes('DOCKER-PROMETHEUS-OK')" + message: "prometheus output leaked response content" + - assert: + expr: "!prometheusText.includes('agent:qa:docker-prometheus-smoke')" + message: "prometheus output leaked the session key" + - assert: + expr: "!prometheusText.includes(gatewayToken)" + message: "prometheus output leaked the gateway token" + - assert: + expr: "!/runId|sessionId|sessionKey|callId|toolCallId|messageId|providerRequestId/.test(prometheusText)" + message: "prometheus output leaked raw diagnostic identifiers" + - assert: + expr: "!/\\/tmp\\/|\\/private\\/tmp\\/|\\/app\\//.test(prometheusText)" + message: "prometheus output leaked a local file path" + - assert: + expr: "!prometheusText.includes('openclaw.content.')" + message: "prometheus output leaked content attributes" + - assert: + expr: "!/openclaw_prometheus_series_dropped_total(?:\\{[^}]*\\})?\\s+(?!0(?:\\.0+)?(?:\\s|$))/.test(prometheusText)" + message: "prometheus dropped series during the smoke" +``` diff --git a/scripts/e2e/Dockerfile.observability b/scripts/e2e/Dockerfile.observability new file mode 100644 index 00000000000..55ada3f2f22 --- /dev/null +++ b/scripts/e2e/Dockerfile.observability @@ -0,0 +1,55 @@ +# syntax=docker/dockerfile:1.7 + +FROM node:24-bookworm-slim@sha256:e8e2e91b1378f83c5b2dd15f0247f34110e2fe895f6ca7719dbb780f929368eb AS observability-runner + +RUN apt-get update \ + && apt-get install -y --no-install-recommends ca-certificates git \ + && rm -rf /var/lib/apt/lists/* + +RUN corepack enable + +RUN useradd --create-home --shell /bin/bash appuser \ + && mkdir -p /app \ + && chown appuser:appuser /app + +ENV HOME="/home/appuser" +ENV NODE_OPTIONS="--disable-warning=ExperimentalWarning" +ENV OPENCLAW_DISABLE_BONJOUR="1" + +USER appuser +WORKDIR /app + +COPY --chown=appuser:appuser package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./ +COPY --chown=appuser:appuser ui/package.json ./ui/package.json +COPY --chown=appuser:appuser patches ./patches +COPY --chown=appuser:appuser scripts/postinstall-bundled-plugins.mjs scripts/preinstall-package-manager-warning.mjs scripts/npm-runner.mjs scripts/windows-cmd-helpers.mjs ./scripts/ +RUN --mount=type=bind,source=extensions,target=/tmp/extensions,readonly \ + find /tmp/extensions -mindepth 2 -maxdepth 2 -name package.json -print | \ + while IFS= read -r manifest; do \ + dest="${manifest#/tmp/}"; \ + mkdir -p "$(dirname "$dest")"; \ + cp "$manifest" "$dest"; \ + done + +RUN --mount=type=cache,id=openclaw-pnpm-store,target=/home/appuser/.local/share/pnpm/store,sharing=locked \ + pnpm install --frozen-lockfile + +COPY --chown=appuser:appuser .oxlintrc.json tsconfig.json tsconfig.plugin-sdk.dts.json tsconfig.oxlint*.json tsdown.config.ts vitest.config.ts openclaw.mjs ./ +COPY --chown=appuser:appuser src ./src +COPY --chown=appuser:appuser test ./test +COPY --chown=appuser:appuser scripts ./scripts +COPY --chown=appuser:appuser docs ./docs +COPY --chown=appuser:appuser packages ./packages +COPY --chown=appuser:appuser qa ./qa +COPY --chown=appuser:appuser skills ./skills +COPY --chown=appuser:appuser ui ./ui +COPY --chown=appuser:appuser extensions ./extensions +COPY --chown=appuser:appuser vendor/a2ui/renderers/lit ./vendor/a2ui/renderers/lit +COPY --chown=appuser:appuser apps/shared/OpenClawKit/Sources/OpenClawKit/Resources ./apps/shared/OpenClawKit/Sources/OpenClawKit/Resources +COPY --chown=appuser:appuser apps/shared/OpenClawKit/Tools/CanvasA2UI ./apps/shared/OpenClawKit/Tools/CanvasA2UI + +RUN pnpm build +RUN mkdir -p dist/control-ui \ + && printf '%s\n' '<!doctype html><title>OpenClaw Control UI' > dist/control-ui/index.html + +CMD ["bash"] diff --git a/scripts/e2e/docker-observability-smoke.sh b/scripts/e2e/docker-observability-smoke.sh new file mode 100644 index 00000000000..885c1179d90 --- /dev/null +++ b/scripts/e2e/docker-observability-smoke.sh @@ -0,0 +1,52 @@ +#!/usr/bin/env bash +set -euo pipefail + +ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" +source "$ROOT_DIR/scripts/lib/docker-e2e-image.sh" + +IMAGE_NAME="$(docker_e2e_resolve_image "openclaw-docker-observability-e2e:local" OPENCLAW_DOCKER_OBSERVABILITY_E2E_IMAGE)" +SKIP_BUILD="${OPENCLAW_DOCKER_OBSERVABILITY_E2E_SKIP_BUILD:-0}" +LOOPS="${OPENCLAW_DOCKER_OBSERVABILITY_LOOPS:-1}" +OUTPUT_DIR="${OPENCLAW_DOCKER_OBSERVABILITY_OUTPUT_DIR:-$ROOT_DIR/.artifacts/docker-observability/$(date +%Y%m%d-%H%M%S)}" + +if ! [[ "$LOOPS" =~ ^[1-9][0-9]*$ ]]; then + echo "OPENCLAW_DOCKER_OBSERVABILITY_LOOPS must be a positive integer, got: $LOOPS" >&2 + exit 1 +fi + +mkdir -p "$OUTPUT_DIR" + +docker_e2e_build_or_reuse "$IMAGE_NAME" docker-observability "$ROOT_DIR/scripts/e2e/Dockerfile.observability" "$ROOT_DIR" "" "$SKIP_BUILD" + +echo "Running Docker observability smoke with $LOOPS loop(s)..." +run_logged docker-observability docker run --rm \ + -e "OPENCLAW_DOCKER_OBSERVABILITY_LOOPS=$LOOPS" \ + -v "$OUTPUT_DIR:/app/.artifacts/docker-observability-current" \ + "$IMAGE_NAME" \ + bash -lc ' +set -euo pipefail + +loops="${OPENCLAW_DOCKER_OBSERVABILITY_LOOPS:-1}" +artifact_root=".artifacts/docker-observability-current" +mkdir -p "$artifact_root" + +for i in $(seq 1 "$loops"); do + iteration_dir="$artifact_root/loop-$i" + mkdir -p "$iteration_dir" + + echo "== docker observability loop $i/$loops: otel ==" + pnpm qa:otel:smoke \ + --provider-mode mock-openai \ + --output-dir "$iteration_dir/otel" + + echo "== docker observability loop $i/$loops: prometheus ==" + pnpm openclaw qa suite \ + --provider-mode mock-openai \ + --scenario docker-prometheus-smoke \ + --concurrency 1 \ + --fast \ + --output-dir "$iteration_dir/prometheus" +done +' + +echo "Docker observability smoke passed. Artifacts: $OUTPUT_DIR" diff --git a/scripts/lib/docker-e2e-scenarios.mjs b/scripts/lib/docker-e2e-scenarios.mjs index 28acd792a13..bddda074b03 100644 --- a/scripts/lib/docker-e2e-scenarios.mjs +++ b/scripts/lib/docker-e2e-scenarios.mjs @@ -25,7 +25,10 @@ function lane(name, command, options = {}) { return { cacheKey: options.cacheKey, command, - e2eImageKind: options.e2eImageKind ?? (options.live ? undefined : "functional"), + e2eImageKind: + options.e2eImageKind === false + ? undefined + : (options.e2eImageKind ?? (options.live ? undefined : "functional")), estimateSeconds: options.estimateSeconds, live: options.live === true, name, @@ -181,6 +184,10 @@ export const mainLanes = [ { resources: ["service"], weight: 3 }, ), serviceLane("gateway-network", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:gateway-network"), + serviceLane("observability", "bash scripts/e2e/docker-observability-smoke.sh", { + e2eImageKind: false, + weight: 3, + }), serviceLane( "agents-delete-shared-workspace", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:agents-delete-shared-workspace", From 42db865673a05bd5fcf0a276496c29e266183df0 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 00:49:36 +0100 Subject: [PATCH 108/418] test(docker): run observability on shared image --- docs/concepts/qa-e2e-automation.md | 7 +-- docs/help/testing.md | 2 +- scripts/e2e/Dockerfile.observability | 55 ----------------------- scripts/e2e/docker-observability-smoke.sh | 11 ++++- scripts/lib/docker-e2e-scenarios.mjs | 18 ++++++-- 5 files changed, 28 insertions(+), 65 deletions(-) delete mode 100644 scripts/e2e/Dockerfile.observability diff --git a/docs/concepts/qa-e2e-automation.md b/docs/concepts/qa-e2e-automation.md index 68e35f189f3..b0a55d8e4a2 100644 --- a/docs/concepts/qa-e2e-automation.md +++ b/docs/concepts/qa-e2e-automation.md @@ -65,9 +65,10 @@ model calls must not export `StreamAbandoned` on successful turns; raw diagnosti `openclaw.content.*` attributes must stay out of the trace. It writes `otel-smoke-summary.json` next to the QA suite artifacts. -The normal Docker aggregate also runs an observability lane. It builds or -reuses a source-backed Docker observability image, runs the OTEL trace smoke -inside the container, then runs the `docker-prometheus-smoke` QA scenario with the +The normal Docker aggregate and release-path core chunk also run an +observability lane. It reuses the shared package-installed functional Docker +image, mounts the QA harness files read-only, runs the OTEL trace smoke inside +the container, then runs the `docker-prometheus-smoke` QA scenario with the `diagnostics-prometheus` plugin enabled. Set `OPENCLAW_DOCKER_OBSERVABILITY_LOOPS=` to repeat both checks inside one Docker run while preserving per-loop artifacts under diff --git a/docs/help/testing.md b/docs/help/testing.md index 7da6a728b1f..c08edc47d37 100644 --- a/docs/help/testing.md +++ b/docs/help/testing.md @@ -617,7 +617,7 @@ The live-model Docker runners also bind-mount only the needed CLI auth homes (or - CLI backend smoke: `pnpm test:docker:live-cli-backend` (script: `scripts/test-live-cli-backend-docker.sh`) - Codex app-server harness smoke: `pnpm test:docker:live-codex-harness` (script: `scripts/test-live-codex-harness-docker.sh`) - Gateway + dev agent: `pnpm test:docker:live-gateway` (script: `scripts/test-live-gateway-models-docker.sh`) -- Docker observability smoke: included in `pnpm test:docker:all` and `pnpm test:docker:local:all` (script: `scripts/e2e/docker-observability-smoke.sh`). It runs QA-lab OTEL and Prometheus diagnostics checks inside a source-backed Docker image. Set `OPENCLAW_DOCKER_OBSERVABILITY_LOOPS=` to repeat both checks in one container run. +- Docker observability smoke: included in `pnpm test:docker:all`, `pnpm test:docker:local:all`, and the release-path `core` chunk (script: `scripts/e2e/docker-observability-smoke.sh`). It runs QA-lab OTEL and Prometheus diagnostics checks inside the shared package-installed functional Docker image, with only QA harness files mounted read-only. Set `OPENCLAW_DOCKER_OBSERVABILITY_LOOPS=` to repeat both checks in one container run. - Open WebUI live smoke: `pnpm test:docker:openwebui` (script: `scripts/e2e/openwebui-docker.sh`) - Onboarding wizard (TTY, full scaffolding): `pnpm test:docker:onboard` (script: `scripts/e2e/onboard-docker.sh`) - Npm tarball onboarding/channel/agent smoke: `pnpm test:docker:npm-onboard-channel-agent` installs the packed OpenClaw tarball globally in Docker, configures OpenAI via env-ref onboarding plus Telegram by default, verifies doctor repairs activated plugin runtime deps, and runs one mocked OpenAI agent turn. Reuse a prebuilt tarball with `OPENCLAW_CURRENT_PACKAGE_TGZ=/path/to/openclaw-*.tgz`, skip the host rebuild with `OPENCLAW_NPM_ONBOARD_HOST_BUILD=0`, or switch channel with `OPENCLAW_NPM_ONBOARD_CHANNEL=discord`. diff --git a/scripts/e2e/Dockerfile.observability b/scripts/e2e/Dockerfile.observability deleted file mode 100644 index 55ada3f2f22..00000000000 --- a/scripts/e2e/Dockerfile.observability +++ /dev/null @@ -1,55 +0,0 @@ -# syntax=docker/dockerfile:1.7 - -FROM node:24-bookworm-slim@sha256:e8e2e91b1378f83c5b2dd15f0247f34110e2fe895f6ca7719dbb780f929368eb AS observability-runner - -RUN apt-get update \ - && apt-get install -y --no-install-recommends ca-certificates git \ - && rm -rf /var/lib/apt/lists/* - -RUN corepack enable - -RUN useradd --create-home --shell /bin/bash appuser \ - && mkdir -p /app \ - && chown appuser:appuser /app - -ENV HOME="/home/appuser" -ENV NODE_OPTIONS="--disable-warning=ExperimentalWarning" -ENV OPENCLAW_DISABLE_BONJOUR="1" - -USER appuser -WORKDIR /app - -COPY --chown=appuser:appuser package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./ -COPY --chown=appuser:appuser ui/package.json ./ui/package.json -COPY --chown=appuser:appuser patches ./patches -COPY --chown=appuser:appuser scripts/postinstall-bundled-plugins.mjs scripts/preinstall-package-manager-warning.mjs scripts/npm-runner.mjs scripts/windows-cmd-helpers.mjs ./scripts/ -RUN --mount=type=bind,source=extensions,target=/tmp/extensions,readonly \ - find /tmp/extensions -mindepth 2 -maxdepth 2 -name package.json -print | \ - while IFS= read -r manifest; do \ - dest="${manifest#/tmp/}"; \ - mkdir -p "$(dirname "$dest")"; \ - cp "$manifest" "$dest"; \ - done - -RUN --mount=type=cache,id=openclaw-pnpm-store,target=/home/appuser/.local/share/pnpm/store,sharing=locked \ - pnpm install --frozen-lockfile - -COPY --chown=appuser:appuser .oxlintrc.json tsconfig.json tsconfig.plugin-sdk.dts.json tsconfig.oxlint*.json tsdown.config.ts vitest.config.ts openclaw.mjs ./ -COPY --chown=appuser:appuser src ./src -COPY --chown=appuser:appuser test ./test -COPY --chown=appuser:appuser scripts ./scripts -COPY --chown=appuser:appuser docs ./docs -COPY --chown=appuser:appuser packages ./packages -COPY --chown=appuser:appuser qa ./qa -COPY --chown=appuser:appuser skills ./skills -COPY --chown=appuser:appuser ui ./ui -COPY --chown=appuser:appuser extensions ./extensions -COPY --chown=appuser:appuser vendor/a2ui/renderers/lit ./vendor/a2ui/renderers/lit -COPY --chown=appuser:appuser apps/shared/OpenClawKit/Sources/OpenClawKit/Resources ./apps/shared/OpenClawKit/Sources/OpenClawKit/Resources -COPY --chown=appuser:appuser apps/shared/OpenClawKit/Tools/CanvasA2UI ./apps/shared/OpenClawKit/Tools/CanvasA2UI - -RUN pnpm build -RUN mkdir -p dist/control-ui \ - && printf '%s\n' 'OpenClaw Control UI' > dist/control-ui/index.html - -CMD ["bash"] diff --git a/scripts/e2e/docker-observability-smoke.sh b/scripts/e2e/docker-observability-smoke.sh index 885c1179d90..a488ec14a14 100644 --- a/scripts/e2e/docker-observability-smoke.sh +++ b/scripts/e2e/docker-observability-smoke.sh @@ -1,10 +1,13 @@ #!/usr/bin/env bash +# Runs QA diagnostics smoke checks inside the shared package-installed Docker +# E2E image. The OpenClaw app under test comes from the prepared npm tarball; +# only QA harness files are mounted read-only. set -euo pipefail ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" source "$ROOT_DIR/scripts/lib/docker-e2e-image.sh" -IMAGE_NAME="$(docker_e2e_resolve_image "openclaw-docker-observability-e2e:local" OPENCLAW_DOCKER_OBSERVABILITY_E2E_IMAGE)" +IMAGE_NAME="$(docker_e2e_resolve_image "openclaw-docker-observability-e2e:local" OPENCLAW_DOCKER_OBSERVABILITY_E2E_IMAGE OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE)" SKIP_BUILD="${OPENCLAW_DOCKER_OBSERVABILITY_E2E_SKIP_BUILD:-0}" LOOPS="${OPENCLAW_DOCKER_OBSERVABILITY_LOOPS:-1}" OUTPUT_DIR="${OPENCLAW_DOCKER_OBSERVABILITY_OUTPUT_DIR:-$ROOT_DIR/.artifacts/docker-observability/$(date +%Y%m%d-%H%M%S)}" @@ -16,11 +19,15 @@ fi mkdir -p "$OUTPUT_DIR" -docker_e2e_build_or_reuse "$IMAGE_NAME" docker-observability "$ROOT_DIR/scripts/e2e/Dockerfile.observability" "$ROOT_DIR" "" "$SKIP_BUILD" +docker_e2e_build_or_reuse "$IMAGE_NAME" docker-observability "$ROOT_DIR/scripts/e2e/Dockerfile" "$ROOT_DIR" "" "$SKIP_BUILD" +docker_e2e_harness_mount_args echo "Running Docker observability smoke with $LOOPS loop(s)..." run_logged docker-observability docker run --rm \ -e "OPENCLAW_DOCKER_OBSERVABILITY_LOOPS=$LOOPS" \ + "${DOCKER_E2E_HARNESS_ARGS[@]}" \ + -v "$ROOT_DIR/scripts/qa-otel-smoke.ts:/app/scripts/qa-otel-smoke.ts:ro" \ + -v "$ROOT_DIR/qa:/app/qa:ro" \ -v "$OUTPUT_DIR:/app/.artifacts/docker-observability-current" \ "$IMAGE_NAME" \ bash -lc ' diff --git a/scripts/lib/docker-e2e-scenarios.mjs b/scripts/lib/docker-e2e-scenarios.mjs index bddda074b03..227adae9d00 100644 --- a/scripts/lib/docker-e2e-scenarios.mjs +++ b/scripts/lib/docker-e2e-scenarios.mjs @@ -184,10 +184,13 @@ export const mainLanes = [ { resources: ["service"], weight: 3 }, ), serviceLane("gateway-network", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:gateway-network"), - serviceLane("observability", "bash scripts/e2e/docker-observability-smoke.sh", { - e2eImageKind: false, - weight: 3, - }), + serviceLane( + "observability", + "OPENCLAW_SKIP_DOCKER_BUILD=1 bash scripts/e2e/docker-observability-smoke.sh", + { + weight: 3, + }, + ), serviceLane( "agents-delete-shared-workspace", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:agents-delete-shared-workspace", @@ -342,6 +345,13 @@ const releasePathChunks = { "pi-bundle-mcp-tools", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:pi-bundle-mcp-tools", ), + serviceLane( + "observability", + "OPENCLAW_SKIP_DOCKER_BUILD=1 bash scripts/e2e/docker-observability-smoke.sh", + { + weight: 3, + }, + ), serviceLane("mcp-channels", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:mcp-channels", { resources: ["npm"], weight: 3, From 265bc6b6ea790ee9388b4005dd2d91848060458f Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 16:51:36 -0700 Subject: [PATCH 109/418] test(plugins): guard command cold registry paths Add command-level sentinel coverage proving channel setup metadata, onboarding auth choices, and models-list provider ownership stay on manifest/registry paths without importing plugin runtime.\n\nLocal verification:\n- pnpm exec oxfmt --check --threads=1 src/commands/plugin-control-plane-cold-imports.test.ts\n- OPENCLAW_LOCAL_CHECK_MODE=throttled pnpm test:serial src/commands/plugin-control-plane-cold-imports.test.ts\n- OPENCLAW_LOCAL_CHECK_MODE=throttled pnpm check:changed\n- clean rebase sanity: git diff --check origin/main...HEAD\n\nPR CI had known unrelated main-red failures matching latest main run 24970053892; the new sentinel test passed in CI. --- .../plugin-control-plane-cold-imports.test.ts | 186 ++++++++++++++++++ 1 file changed, 186 insertions(+) create mode 100644 src/commands/plugin-control-plane-cold-imports.test.ts diff --git a/src/commands/plugin-control-plane-cold-imports.test.ts b/src/commands/plugin-control-plane-cold-imports.test.ts new file mode 100644 index 00000000000..8572af6130d --- /dev/null +++ b/src/commands/plugin-control-plane-cold-imports.test.ts @@ -0,0 +1,186 @@ +import fs from "node:fs"; +import os from "node:os"; +import path from "node:path"; +import { afterEach, describe, expect, it } from "vitest"; +import type { OpenClawConfig } from "../config/types.openclaw.js"; +import { clearPluginDiscoveryCache } from "../plugins/discovery.js"; +import { clearPluginManifestRegistryCache } from "../plugins/manifest-registry.js"; +import { refreshPluginRegistry } from "../plugins/plugin-registry.js"; +import { buildAuthChoiceOptions, formatAuthChoiceChoicesForCli } from "./auth-choice-options.js"; +import { listManifestInstalledChannelIds } from "./channel-setup/discovery.js"; +import { resolveProviderCatalogPluginIdsForFilter } from "./models/list.provider-catalog.js"; + +const tempDirs: string[] = []; + +function makeTempDir() { + const dir = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-command-cold-imports-")); + tempDirs.push(dir); + return dir; +} + +function hermeticEnv( + homeDir: string, + options: { disablePersistedRegistry?: boolean } = {}, +): NodeJS.ProcessEnv { + return { + ...process.env, + OPENCLAW_HOME: path.join(homeDir, "home"), + OPENCLAW_BUNDLED_PLUGINS_DIR: undefined, + OPENCLAW_DISABLE_PERSISTED_PLUGIN_REGISTRY: + options.disablePersistedRegistry === false ? undefined : "1", + OPENCLAW_DISABLE_PLUGIN_DISCOVERY_CACHE: "1", + OPENCLAW_DISABLE_PLUGIN_MANIFEST_CACHE: "1", + OPENCLAW_VERSION: "2026.4.25", + VITEST: "true", + }; +} + +function createColdControlPlanePlugin() { + const rootDir = makeTempDir(); + const runtimeMarker = path.join(rootDir, "runtime-loaded.txt"); + fs.writeFileSync( + path.join(rootDir, "package.json"), + JSON.stringify( + { + name: "@example/openclaw-cold-control-plane", + version: "1.0.0", + openclaw: { extensions: ["./index.cjs"] }, + }, + null, + 2, + ), + "utf8", + ); + fs.writeFileSync( + path.join(rootDir, "openclaw.plugin.json"), + JSON.stringify( + { + id: "cold-control-plane", + name: "Cold Control Plane", + configSchema: { type: "object" }, + providers: ["cold-model-provider"], + channels: ["cold-channel"], + channelConfigs: { + "cold-channel": { + schema: { type: "object" }, + }, + }, + providerAuthChoices: [ + { + provider: "cold-model-provider", + method: "api-key", + choiceId: "cold-provider-api-key", + choiceLabel: "Cold Provider API key", + groupId: "cold-model-provider", + groupLabel: "Cold Provider", + optionKey: "coldProviderApiKey", + cliFlag: "--cold-provider-api-key", + cliOption: "--cold-provider-api-key ", + onboardingScopes: ["text-inference"], + }, + ], + }, + null, + 2, + ), + "utf8", + ); + fs.writeFileSync( + path.join(rootDir, "index.cjs"), + `require("node:fs").writeFileSync(${JSON.stringify(runtimeMarker)}, "loaded", "utf8");\nthrow new Error("runtime entry should not load for command control-plane discovery");\n`, + "utf8", + ); + return { rootDir, runtimeMarker }; +} + +function createColdConfig(pluginDir: string): OpenClawConfig { + return { + plugins: { + load: { paths: [pluginDir] }, + entries: { + "cold-control-plane": { enabled: true }, + }, + }, + }; +} + +afterEach(() => { + clearPluginDiscoveryCache(); + clearPluginManifestRegistryCache(); + for (const dir of tempDirs.splice(0)) { + fs.rmSync(dir, { recursive: true, force: true }); + } +}); + +describe("command control-plane plugin discovery", () => { + it("resolves channel setup metadata without importing plugin runtime", () => { + const plugin = createColdControlPlanePlugin(); + const workspaceDir = makeTempDir(); + const cfg = createColdConfig(plugin.rootDir); + const env = hermeticEnv(workspaceDir); + + expect( + listManifestInstalledChannelIds({ + cfg, + workspaceDir, + env, + }), + ).toContain("cold-channel"); + expect(fs.existsSync(plugin.runtimeMarker)).toBe(false); + }); + + it("builds onboarding auth choices from manifest metadata without importing plugin runtime", () => { + const plugin = createColdControlPlanePlugin(); + const workspaceDir = makeTempDir(); + const cfg = createColdConfig(plugin.rootDir); + const env = hermeticEnv(workspaceDir); + + expect( + buildAuthChoiceOptions({ + store: {} as never, + includeSkip: false, + config: cfg, + workspaceDir, + env, + }), + ).toContainEqual( + expect.objectContaining({ + value: "cold-provider-api-key", + label: "Cold Provider API key", + groupId: "cold-model-provider", + }), + ); + expect( + formatAuthChoiceChoicesForCli({ + config: cfg, + workspaceDir, + env, + }).split("|"), + ).toContain("cold-provider-api-key"); + expect(fs.existsSync(plugin.runtimeMarker)).toBe(false); + }); + + it("resolves models-list provider ownership without importing plugin runtime", async () => { + const plugin = createColdControlPlanePlugin(); + const workspaceDir = makeTempDir(); + const cfg = createColdConfig(plugin.rootDir); + const env = hermeticEnv(workspaceDir, { disablePersistedRegistry: false }); + + await refreshPluginRegistry({ + config: cfg, + workspaceDir, + env, + reason: "manual", + }); + expect(fs.existsSync(plugin.runtimeMarker)).toBe(false); + + await expect( + resolveProviderCatalogPluginIdsForFilter({ + cfg, + env, + providerFilter: "cold-model-provider", + }), + ).resolves.toEqual(["cold-control-plane"]); + expect(fs.existsSync(plugin.runtimeMarker)).toBe(false); + }); +}); From 21c51bc140295e4286f1adc871a96b9b33c6a8b9 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 00:51:45 +0100 Subject: [PATCH 110/418] test(docker): resolve otel decoder from plugin runtime --- scripts/qa-otel-smoke.ts | 34 +++++++++++++++++++++++++++++----- 1 file changed, 29 insertions(+), 5 deletions(-) diff --git a/scripts/qa-otel-smoke.ts b/scripts/qa-otel-smoke.ts index a1660e8fedc..6849c864845 100644 --- a/scripts/qa-otel-smoke.ts +++ b/scripts/qa-otel-smoke.ts @@ -93,10 +93,34 @@ const DISALLOWED_ATTRIBUTE_KEYS = new Set([ "openclaw.toolCallId", ]); -const require = createRequire(import.meta.url); -const otlpRoot = require("@opentelemetry/otlp-transformer/build/src/generated/root.js") as OtlpRoot; -const traceRequestDecoder = - otlpRoot.opentelemetry.proto.collector.trace.v1.ExportTraceServiceRequest; +let traceRequestDecoder: + | OtlpRoot["opentelemetry"]["proto"]["collector"]["trace"]["v1"]["ExportTraceServiceRequest"] + | undefined; + +function requireOtlpRoot(): OtlpRoot { + const candidates = [ + path.join(process.cwd(), "dist", "extensions", "diagnostics-otel", "package.json"), + path.join(process.cwd(), "extensions", "diagnostics-otel", "package.json"), + import.meta.url, + ]; + const failures: string[] = []; + for (const candidate of candidates) { + try { + return createRequire(candidate)( + "@opentelemetry/otlp-transformer/build/src/generated/root.js", + ) as OtlpRoot; + } catch (error) { + failures.push(`${candidate}: ${error instanceof Error ? error.message : String(error)}`); + } + } + throw new Error(`failed to load OTLP transformer decoder:\n${failures.join("\n")}`); +} + +function getTraceRequestDecoder() { + traceRequestDecoder ??= + requireOtlpRoot().opentelemetry.proto.collector.trace.v1.ExportTraceServiceRequest; + return traceRequestDecoder; +} function usage(): string { return `Usage: pnpm qa:otel:smoke [--output-dir ] [--provider-mode ] [--scenario ] [--model ] [--alt-model ] @@ -197,7 +221,7 @@ function spanAttributes(span: OtlpSpan): Record Date: Mon, 27 Apr 2026 00:54:40 +0100 Subject: [PATCH 111/418] test: auto-discover vitest suites --- .github/workflows/ci.yml | 37 ++++---- docs/ci.md | 19 +++- docs/reference/RELEASING.md | 18 +++- scripts/e2e/npm-telegram-live-runner.ts | 22 +++-- src/docker-build-cache.test.ts | 40 ++------ src/scripts/test-projects.test.ts | 11 +-- test/scripts/test-projects.test.ts | 116 ++++++++++++++++++++++++ test/vitest-scoped-config.test.ts | 14 +-- test/vitest/vitest.infra.config.ts | 2 + test/vitest/vitest.plugin-sdk.config.ts | 3 +- test/vitest/vitest.plugins.config.ts | 2 +- test/vitest/vitest.test-shards.mjs | 1 + test/vitest/vitest.tooling.config.ts | 10 +- test/vitest/vitest.ui.config.ts | 6 +- test/vitest/vitest.unit-fast-paths.mjs | 2 + test/vitest/vitest.unit-src.config.ts | 2 +- ui/src/styles/components.test.ts | 3 +- ui/src/styles/config-quick.test.ts | 3 +- ui/src/styles/layout.mobile.test.ts | 3 +- 19 files changed, 220 insertions(+), 94 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c7cd5af05ff..7505e45af83 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,6 +1,7 @@ name: CI on: + workflow_dispatch: push: branches: [main] paths-ignore: @@ -13,8 +14,8 @@ permissions: contents: read concurrency: - group: ${{ github.event_name == 'pull_request' && format('{0}-v7-{1}', github.workflow, github.event.pull_request.number) || (github.repository == 'openclaw/openclaw' && format('{0}-v7-{1}', github.workflow, github.ref) || format('{0}-v7-{1}-{2}', github.workflow, github.ref, github.sha)) }} - cancel-in-progress: true + group: ${{ github.event_name == 'workflow_dispatch' && format('{0}-manual-v1-{1}', github.workflow, github.run_id) || (github.event_name == 'pull_request' && format('{0}-v7-{1}', github.workflow, github.event.pull_request.number) || (github.repository == 'openclaw/openclaw' && format('{0}-v7-{1}', github.workflow, github.ref) || format('{0}-v7-{1}-{2}', github.workflow, github.ref, github.sha))) }} + cancel-in-progress: ${{ github.event_name != 'workflow_dispatch' }} env: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" @@ -75,6 +76,7 @@ jobs: submodules: false - name: Ensure preflight base commit + if: github.event_name != 'workflow_dispatch' uses: ./.github/actions/ensure-base-commit with: base-sha: ${{ github.event_name == 'push' && github.event.before || github.event.pull_request.base.sha }} @@ -82,11 +84,12 @@ jobs: - name: Detect docs-only changes id: docs_scope + if: github.event_name != 'workflow_dispatch' uses: ./.github/actions/detect-docs-changes - name: Detect changed scopes id: changed_scope - if: steps.docs_scope.outputs.docs_only != 'true' + if: github.event_name != 'workflow_dispatch' && steps.docs_scope.outputs.docs_only != 'true' shell: bash run: | set -euo pipefail @@ -101,7 +104,7 @@ jobs: - name: Detect changed extensions id: changed_extensions - if: steps.docs_scope.outputs.docs_only != 'true' && steps.changed_scope.outputs.run_node == 'true' + if: github.event_name != 'workflow_dispatch' && steps.docs_scope.outputs.docs_only != 'true' && steps.changed_scope.outputs.run_node == 'true' env: BASE_SHA: ${{ github.event_name == 'push' && github.event.before || github.event.pull_request.base.sha }} BASE_REF: ${{ github.event_name == 'push' && github.ref_name || github.event.pull_request.base.ref }} @@ -125,19 +128,19 @@ jobs: - name: Build CI manifest id: manifest env: - OPENCLAW_CI_DOCS_ONLY: ${{ steps.docs_scope.outputs.docs_only }} - OPENCLAW_CI_DOCS_CHANGED: ${{ steps.docs_scope.outputs.docs_changed }} - OPENCLAW_CI_RUN_NODE: ${{ steps.changed_scope.outputs.run_node || 'false' }} - OPENCLAW_CI_RUN_MACOS: ${{ steps.changed_scope.outputs.run_macos || 'false' }} - OPENCLAW_CI_RUN_ANDROID: ${{ steps.changed_scope.outputs.run_android || 'false' }} - OPENCLAW_CI_RUN_WINDOWS: ${{ steps.changed_scope.outputs.run_windows || 'false' }} - OPENCLAW_CI_RUN_NODE_FAST_ONLY: ${{ steps.changed_scope.outputs.run_node_fast_only || 'false' }} - OPENCLAW_CI_RUN_NODE_FAST_PLUGIN_CONTRACTS: ${{ steps.changed_scope.outputs.run_node_fast_plugin_contracts || 'false' }} - OPENCLAW_CI_RUN_NODE_FAST_CI_ROUTING: ${{ steps.changed_scope.outputs.run_node_fast_ci_routing || 'false' }} - OPENCLAW_CI_RUN_SKILLS_PYTHON: ${{ steps.changed_scope.outputs.run_skills_python || 'false' }} - OPENCLAW_CI_RUN_CONTROL_UI_I18N: ${{ steps.changed_scope.outputs.run_control_ui_i18n || 'false' }} - OPENCLAW_CI_HAS_CHANGED_EXTENSIONS: ${{ steps.changed_extensions.outputs.has_changed_extensions || 'false' }} - OPENCLAW_CI_CHANGED_EXTENSIONS_MATRIX: ${{ steps.changed_extensions.outputs.changed_extensions_matrix || '{"include":[]}' }} + OPENCLAW_CI_DOCS_ONLY: ${{ github.event_name == 'workflow_dispatch' && 'false' || steps.docs_scope.outputs.docs_only }} + OPENCLAW_CI_DOCS_CHANGED: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.docs_scope.outputs.docs_changed }} + OPENCLAW_CI_RUN_NODE: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.changed_scope.outputs.run_node || 'false' }} + OPENCLAW_CI_RUN_MACOS: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.changed_scope.outputs.run_macos || 'false' }} + OPENCLAW_CI_RUN_ANDROID: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.changed_scope.outputs.run_android || 'false' }} + OPENCLAW_CI_RUN_WINDOWS: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.changed_scope.outputs.run_windows || 'false' }} + OPENCLAW_CI_RUN_NODE_FAST_ONLY: ${{ github.event_name == 'workflow_dispatch' && 'false' || steps.changed_scope.outputs.run_node_fast_only || 'false' }} + OPENCLAW_CI_RUN_NODE_FAST_PLUGIN_CONTRACTS: ${{ github.event_name == 'workflow_dispatch' && 'false' || steps.changed_scope.outputs.run_node_fast_plugin_contracts || 'false' }} + OPENCLAW_CI_RUN_NODE_FAST_CI_ROUTING: ${{ github.event_name == 'workflow_dispatch' && 'false' || steps.changed_scope.outputs.run_node_fast_ci_routing || 'false' }} + OPENCLAW_CI_RUN_SKILLS_PYTHON: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.changed_scope.outputs.run_skills_python || 'false' }} + OPENCLAW_CI_RUN_CONTROL_UI_I18N: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.changed_scope.outputs.run_control_ui_i18n || 'false' }} + OPENCLAW_CI_HAS_CHANGED_EXTENSIONS: ${{ github.event_name == 'workflow_dispatch' && 'false' || steps.changed_extensions.outputs.has_changed_extensions || 'false' }} + OPENCLAW_CI_CHANGED_EXTENSIONS_MATRIX: ${{ github.event_name == 'workflow_dispatch' && '{"include":[]}' || steps.changed_extensions.outputs.changed_extensions_matrix || '{"include":[]}' }} OPENCLAW_CI_REPOSITORY: ${{ github.repository }} run: | node --input-type=module <<'EOF' diff --git a/docs/ci.md b/docs/ci.md index 1387fb4d3e1..070e744e576 100644 --- a/docs/ci.md +++ b/docs/ci.md @@ -6,7 +6,7 @@ read_when: - You are debugging failing GitHub Actions checks --- -The CI runs on every push to `main` and every pull request. It uses smart scoping to skip expensive jobs when only unrelated areas changed. +The CI runs on every push to `main` and every pull request. It uses smart scoping to skip expensive jobs when only unrelated areas changed. Manual `workflow_dispatch` runs intentionally bypass smart scoping and fan out the full CI graph for release candidates or broad validation. QA Lab has dedicated CI lanes outside the main smart-scoped workflow. The `Parity gate` workflow runs on matching PR changes and manual dispatch; it @@ -79,6 +79,19 @@ gh workflow run duplicate-after-merge.yml \ | `android` | Android unit tests for both flavors plus one debug APK build | Android-relevant changes | | `test-performance-agent` | Daily Codex slow-test optimization after trusted activity | Main CI success or manual dispatch | +Manual CI dispatches run the same job graph as normal CI but force every +scoped lane on: Linux Node shards, bundled-plugin shards, channel contracts, +`check`, `check-additional`, build smoke, docs checks, Python skills, Windows, +macOS, Android, and Control UI i18n. They do not run the PR-only +`extension-fast` lane because the full bundled-plugin shard matrix already +covers bundled-plugin tests. Manual runs use a unique concurrency group so a +release-candidate full suite is not cancelled by another push or PR run on the +same ref. + +```bash +gh workflow run ci.yml --ref release/YYYY.M.D +``` + ## Fail-fast order Jobs are ordered so cheap checks fail before expensive ones run: @@ -89,6 +102,8 @@ Jobs are ordered so cheap checks fail before expensive ones run: 4. Heavier platform and runtime lanes fan out after that: `checks-fast-core`, `checks-fast-contracts-channels`, `checks-node-extensions`, `checks-node-core-test`, PR-only `extension-fast`, `checks`, `checks-windows`, `macos-node`, `macos-swift`, and `android`. Scope logic lives in `scripts/ci-changed-scope.mjs` and is covered by unit tests in `src/scripts/ci-changed-scope.test.ts`. +Manual dispatch skips changed-scope detection and makes the preflight manifest +act as if every scoped area changed. CI workflow edits validate the Node CI graph plus workflow linting, but do not force Windows, Android, or macOS native builds by themselves; those platform lanes stay scoped to platform source changes. CI routing-only edits, selected cheap core-test fixture edits, and narrow plugin contract helper/test-routing edits use a fast Node-only manifest path: preflight, security, and a single `checks-fast-core` task. That path avoids build artifacts, Node 22 compatibility, channel contracts, full core shards, bundled-plugin shards, and additional guard matrices when the changed files are limited to the routing or helper surfaces that the fast task exercises directly. Windows Node checks are scoped to Windows-specific process/path wrappers, npm/pnpm/UI runner helpers, package manager config, and the CI workflow surfaces that execute that lane; unrelated source, plugin, install-smoke, and test-only changes stay on the Linux Node lanes so they do not reserve a 16-vCPU Windows worker for coverage that is already exercised by the normal test shards. @@ -103,7 +118,7 @@ Android CI runs both `testPlayDebugUnitTest` and `testThirdPartyDebugUnitTest`, `extension-fast` is PR-only because push runs already execute the full bundled plugin shards. That keeps changed-plugin feedback for reviews without reserving an extra Blacksmith worker on `main` for coverage already present in `checks-node-extensions`. GitHub may mark superseded jobs as `cancelled` when a newer push lands on the same PR or `main` ref. Treat that as CI noise unless the newest run for the same ref is also failing. Aggregate shard checks use `!cancelled() && always()` so they still report normal shard failures but do not queue after the whole workflow has already been superseded. -The CI concurrency key is versioned (`CI-v7-*`) so a GitHub-side zombie in an old queue group cannot indefinitely block newer main runs. +The automatic CI concurrency key is versioned (`CI-v7-*`) so a GitHub-side zombie in an old queue group cannot indefinitely block newer main runs. Manual full-suite runs use `CI-manual-v1-*` and do not cancel in-progress runs. ## Runners diff --git a/docs/reference/RELEASING.md b/docs/reference/RELEASING.md index 1600117b3a8..ea0f9deec96 100644 --- a/docs/reference/RELEASING.md +++ b/docs/reference/RELEASING.md @@ -49,6 +49,12 @@ OpenClaw has three public release lanes: - Run `pnpm build && pnpm ui:build` before `pnpm release:check` so the expected `dist/*` release artifacts and Control UI bundle exist for the pack validation step +- Run the manual `CI` workflow before release approval when you need full normal + CI coverage for the release candidate. Manual CI dispatches bypass changed + scoping and force the Linux Node shards, bundled-plugin shards, channel + contracts, `check`, `check-additional`, build smoke, docs checks, Python + skills, Windows, macOS, Android, and Control UI i18n lanes. + Example: `gh workflow run ci.yml --ref release/YYYY.M.D` - Run `pnpm qa:otel:smoke` when validating release telemetry. It exercises QA-lab through a local OTLP/HTTP receiver and verifies the exported trace span names, bounded attributes, and content/identifier redaction without @@ -182,18 +188,20 @@ When cutting a stable npm release: SHA for a validation-only dry run of the preflight workflow 2. Choose `npm_dist_tag=beta` for the normal beta-first flow, or `latest` only when you intentionally want a direct stable publish -3. Run `OpenClaw Release Checks` separately with the same tag or the +3. Run the manual `CI` workflow on the release ref when you want full normal CI + coverage instead of smart-scoped merge coverage +4. Run `OpenClaw Release Checks` separately with the same tag or the full current workflow-branch commit SHA when you want live prompt cache, QA Lab parity, Matrix, and Telegram coverage - This is separate on purpose so live coverage stays available without recoupling long-running or flaky checks to the publish workflow -4. Save the successful `preflight_run_id` -5. Run `OpenClaw NPM Release` again with `preflight_only=false`, the same +5. Save the successful `preflight_run_id` +6. Run `OpenClaw NPM Release` again with `preflight_only=false`, the same `tag`, the same `npm_dist_tag`, and the saved `preflight_run_id` -6. If the release landed on `beta`, use the private +7. If the release landed on `beta`, use the private `openclaw/releases-private/.github/workflows/openclaw-npm-dist-tags.yml` workflow to promote that stable version from `beta` to `latest` -7. If the release intentionally published directly to `latest` and `beta` +8. If the release intentionally published directly to `latest` and `beta` should follow the same stable build immediately, use that same private workflow to point both dist-tags at the stable version, or let its scheduled self-healing sync move `beta` later diff --git a/scripts/e2e/npm-telegram-live-runner.ts b/scripts/e2e/npm-telegram-live-runner.ts index d7b26995aa5..ad5500968fa 100644 --- a/scripts/e2e/npm-telegram-live-runner.ts +++ b/scripts/e2e/npm-telegram-live-runner.ts @@ -5,7 +5,6 @@ import fs from "node:fs/promises"; import path from "node:path"; import { pathToFileURL } from "node:url"; -import { runTelegramQaLive } from "../../extensions/qa-lab/src/live-transports/telegram/telegram-live.runtime.ts"; function parseBoolean(value: string | undefined) { const normalized = value?.trim().toLowerCase(); @@ -27,10 +26,6 @@ function resolveCredentialRole(env: NodeJS.ProcessEnv) { return env.OPENCLAW_NPM_TELEGRAM_CREDENTIAL_ROLE ?? env.OPENCLAW_QA_CREDENTIAL_ROLE; } -function formatErrorMessage(error: unknown) { - return error instanceof Error ? error.message : String(error); -} - async function resolveTrustedOpenClawCommand(rawCommand: string) { if (!path.isAbsolute(rawCommand)) { throw new Error("OPENCLAW_NPM_TELEGRAM_SUT_COMMAND must be an absolute path."); @@ -56,6 +51,8 @@ async function resolveTrustedOpenClawCommand(rawCommand: string) { } async function main() { + const { runTelegramQaLive } = + await import("../../extensions/qa-lab/src/live-transports/telegram/telegram-live.runtime.ts"); const rawSutOpenClawCommand = process.env.OPENCLAW_NPM_TELEGRAM_SUT_COMMAND?.trim(); if (!rawSutOpenClawCommand) { throw new Error("Missing OPENCLAW_NPM_TELEGRAM_SUT_COMMAND."); @@ -92,9 +89,20 @@ async function main() { } } +async function formatRunnerErrorMessage(error: unknown) { + try { + const { formatErrorMessage } = await import("../../dist/infra/errors.js"); + return formatErrorMessage(error); + } catch { + return error instanceof Error ? error.message : String(error); + } +} + if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) { - main().catch((error) => { - process.stderr.write(`npm telegram live e2e failed: ${formatErrorMessage(error)}\n`); + main().catch(async (error) => { + process.stderr.write( + `npm telegram live e2e failed: ${await formatRunnerErrorMessage(error)}\n`, + ); process.exitCode = 1; }); } diff --git a/src/docker-build-cache.test.ts b/src/docker-build-cache.test.ts index 9854c135f9a..434751341d2 100644 --- a/src/docker-build-cache.test.ts +++ b/src/docker-build-cache.test.ts @@ -28,7 +28,6 @@ describe("docker build cache layout", () => { it("uses pnpm cache mounts in Dockerfiles that install repo dependencies", async () => { for (const path of [ "Dockerfile", - "scripts/e2e/Dockerfile", "scripts/e2e/Dockerfile.qr-import", "scripts/docker/cleanup-smoke/Dockerfile", ]) { @@ -89,41 +88,16 @@ describe("docker build cache layout", () => { } }); - it("copies only install inputs before pnpm install in the e2e image", async () => { + it("keeps the shared e2e image on the packaged tarball install path", async () => { const dockerfile = await readRepoFile("scripts/e2e/Dockerfile"); - const installIndex = dockerfile.indexOf("pnpm install --frozen-lockfile"); - const expectPatternBeforeInstall = (pattern: RegExp) => { - const index = indexOfPattern(dockerfile, pattern); - expect(index).toBeGreaterThan(-1); - expect(index).toBeLessThan(installIndex); - }; - const expectPatternAfterInstall = (pattern: RegExp) => { - const index = indexOfPattern(dockerfile, pattern); - expect(index).toBeGreaterThan(installIndex); - }; - expectPatternBeforeInstall( - /^COPY(?:\s+--chown=\S+)?\s+package\.json pnpm-lock\.yaml pnpm-workspace\.yaml \.npmrc \.\/$/m, + expect(dockerfile).not.toContain("pnpm install --frozen-lockfile"); + expect(dockerfile).not.toContain("COPY . ."); + expect(dockerfile).toMatch( + /^COPY --from=openclaw_package --chown=appuser:appuser openclaw-current\.tgz \/tmp\/openclaw-current\.tgz$/m, ); - expectPatternBeforeInstall( - /^COPY(?:\s+--chown=\S+)?\s+ui\/package\.json \.\/ui\/package\.json$/m, - ); - expectPatternBeforeInstall( - /^RUN --mount=type=bind,source=extensions,target=\/tmp\/extensions,readonly\s+\\$/m, - ); - expectPatternBeforeInstall(/^COPY(?:\s+--chown=\S+)?\s+patches \.\/patches$/m); - expectPatternBeforeInstall( - /^COPY(?:\s+--chown=\S+)?\s+scripts\/postinstall-bundled-plugins\.mjs scripts\/preinstall-package-manager-warning\.mjs scripts\/npm-runner\.mjs scripts\/windows-cmd-helpers\.mjs \.\/scripts\/$/m, - ); - expectPatternAfterInstall( - /^COPY(?:\s+--chown=\S+)?\s+\.oxlintrc\.json tsconfig\.json tsconfig\.plugin-sdk\.dts\.json tsconfig\.oxlint\*\.json tsdown\.config\.ts vitest\.config\.ts openclaw\.mjs \.\/$/m, - ); - expectPatternAfterInstall(/^COPY(?:\s+--chown=\S+)?\s+src \.\/src$/m); - expectPatternAfterInstall(/^COPY(?:\s+--chown=\S+)?\s+test \.\/test$/m); - expectPatternAfterInstall(/^COPY(?:\s+--chown=\S+)?\s+scripts \.\/scripts$/m); - expectPatternAfterInstall(/^COPY(?:\s+--chown=\S+)?\s+ui \.\/ui$/m); - expectPatternAfterInstall( - /^COPY(?:\s+--link)?(?:\s+--chown=\S+)?\s+extensions \.\/extensions$/m, + expect(dockerfile).toContain( + "npm install -g --prefix /tmp/openclaw-prefix /tmp/openclaw-current.tgz --no-fund --no-audit", ); }); diff --git a/src/scripts/test-projects.test.ts b/src/scripts/test-projects.test.ts index c72805a8d99..324110488de 100644 --- a/src/scripts/test-projects.test.ts +++ b/src/scripts/test-projects.test.ts @@ -904,25 +904,20 @@ describe("test-projects args", () => { ]); }); - it("widens extension-facing core contract changes to extension tests", () => { + it("keeps extension-facing core contract changes focused by default", () => { const changedPaths = ["src/plugin-sdk/core.ts"]; const plans = buildVitestRunPlans(["--changed=origin/main"], process.cwd(), () => changedPaths); expect( resolveChangedTargetArgs(["--changed=origin/main"], process.cwd(), () => changedPaths), - ).toEqual(["src/plugin-sdk/core.test.ts", "extensions"]); + ).toEqual(["src/plugin-sdk/core.test.ts"]); expect(plans[0]).toEqual({ config: "test/vitest/vitest.plugin-sdk.config.ts", forwardedArgs: [], includePatterns: ["src/plugin-sdk/core.test.ts"], watchMode: false, }); - expect(plans.map((plan) => plan.config)).toContain( - "test/vitest/vitest.extension-discord.config.ts", - ); - expect(plans.map((plan) => plan.config)).toContain( - "test/vitest/vitest.extension-providers.config.ts", - ); + expect(plans).toHaveLength(1); }); it("keeps extension production changes on the owning extension lane", () => { diff --git a/test/scripts/test-projects.test.ts b/test/scripts/test-projects.test.ts index 78450d3ab67..b028386ce03 100644 --- a/test/scripts/test-projects.test.ts +++ b/test/scripts/test-projects.test.ts @@ -1,4 +1,5 @@ import path from "node:path"; +import fg from "fast-glob"; import { describe, expect, it } from "vitest"; import { DEFAULT_TEST_PROJECTS_VITEST_NO_OUTPUT_TIMEOUT_MS, @@ -14,6 +15,87 @@ import { resolveParallelFullSuiteConcurrency, shouldRetryVitestNoOutputTimeout, } from "../../scripts/test-projects.test-support.mjs"; +import { fullSuiteVitestShards } from "../vitest/vitest.test-shards.mjs"; + +const normalizeRepoPath = (value: string) => value.replaceAll("\\", "/"); + +type VitestTestConfig = { + dir?: string; + exclude?: string[]; + include?: string[]; +}; + +type VitestConfig = { + test?: VitestTestConfig; +}; + +type VitestConfigFactory = (env?: Record) => VitestConfig; + +function isVitestConfigFactory(value: unknown): value is VitestConfigFactory { + return typeof value === "function"; +} + +function findVitestConfigFactory(mod: Record): VitestConfigFactory | null { + for (const [name, value] of Object.entries(mod)) { + if ( + name !== "default" && + /^create.*VitestConfig$/u.test(name) && + isVitestConfigFactory(value) + ) { + return value; + } + } + return null; +} + +async function loadRawVitestConfig(configPath: string): Promise { + const previousArgv = process.argv; + const previousIncludeFile = process.env.OPENCLAW_VITEST_INCLUDE_FILE; + process.argv = [previousArgv[0] ?? "node", previousArgv[1] ?? "vitest"]; + delete process.env.OPENCLAW_VITEST_INCLUDE_FILE; + try { + const mod = (await import(path.resolve(process.cwd(), configPath))) as Record; + return findVitestConfigFactory(mod)?.(process.env) ?? ((mod.default ?? {}) as VitestConfig); + } finally { + process.argv = previousArgv; + if (previousIncludeFile === undefined) { + delete process.env.OPENCLAW_VITEST_INCLUDE_FILE; + } else { + process.env.OPENCLAW_VITEST_INCLUDE_FILE = previousIncludeFile; + } + } +} + +async function listMatchedTestFilesForConfig(configPath: string): Promise { + const testConfig = (await loadRawVitestConfig(configPath)).test ?? {}; + const dir = testConfig.dir ? path.resolve(process.cwd(), testConfig.dir) : process.cwd(); + const include = testConfig.include ?? []; + const exclude = (testConfig.exclude ?? []).map((pattern) => + path.isAbsolute(pattern) + ? normalizeRepoPath(path.relative(dir, pattern)) + : normalizeRepoPath(pattern), + ); + return fg + .sync(include, { + absolute: false, + cwd: dir, + dot: false, + ignore: exclude, + }) + .map((file) => normalizeRepoPath(path.relative(process.cwd(), path.resolve(dir, file)))) + .toSorted((left, right) => left.localeCompare(right)); +} + +async function listFullSuiteTestFileMatches(): Promise> { + const configs = [...new Set(fullSuiteVitestShards.flatMap((shard) => shard.projects))]; + const matches = new Map(); + for (const config of configs) { + for (const file of await listMatchedTestFilesForConfig(config)) { + matches.set(file, [...(matches.get(file) ?? []), config]); + } + } + return matches; +} describe("scripts/test-projects changed-target routing", () => { it("maps changed source files into scoped lane targets", () => { @@ -707,6 +789,39 @@ describe("scripts/test-projects local heavy-check lock", () => { }); describe("scripts/test-projects full-suite sharding", () => { + it("covers each normal full-suite test file exactly once", async () => { + const matches = await listFullSuiteTestFileMatches(); + const e2eNamedIntegrationTests = new Set([ + "src/gateway/gateway.test.ts", + "src/gateway/server.startup-matrix-migration.integration.test.ts", + "src/gateway/sessions-history-http.test.ts", + ]); + const normalTestFiles = fg + .sync(["**/*.{test,spec}.{ts,tsx,mts,cts,js,jsx,mjs,cjs}"], { + cwd: process.cwd(), + dot: false, + ignore: ["**/.*/**", "**/dist/**", "**/node_modules/**", "**/vendor/**"], + }) + .map(normalizeRepoPath) + .filter( + (file) => + !file.includes(".live.test.") && + !file.includes(".e2e.test.") && + !file.startsWith("test/fixtures/") && + !e2eNamedIntegrationTests.has(file), + ) + .toSorted((left, right) => left.localeCompare(right)); + + const missing = normalTestFiles.filter((file) => !matches.has(file)); + const duplicated = [...matches.entries()] + .filter(([, configs]) => configs.length > 1) + .map(([file, configs]) => `${file}: ${configs.join(", ")}`) + .toSorted((left, right) => left.localeCompare(right)); + + expect(missing).toEqual([]); + expect(duplicated).toEqual([]); + }); + it("uses the large host-aware local profile on roomy local hosts", () => { expect( resolveParallelFullSuiteConcurrency( @@ -965,6 +1080,7 @@ describe("scripts/test-projects full-suite sharding", () => { "test/vitest/vitest.extension-browser.config.ts", "test/vitest/vitest.extension-qa.config.ts", "test/vitest/vitest.extension-media.config.ts", + "test/vitest/vitest.extensions.config.ts", "test/vitest/vitest.extension-misc.config.ts", ]); expect(plans).toEqual( diff --git a/test/vitest-scoped-config.test.ts b/test/vitest-scoped-config.test.ts index 22321328d0d..d1552272286 100644 --- a/test/vitest-scoped-config.test.ts +++ b/test/vitest-scoped-config.test.ts @@ -731,11 +731,10 @@ describe("scoped vitest configs", () => { it("keeps tooling tests in their own lane", () => { expect(defaultToolingConfig.test?.include).toEqual( - expect.arrayContaining([ - "test/**/*.test.ts", - "src/scripts/**/*.test.ts", - "src/config/doc-baseline.integration.test.ts", - ]), + expect.arrayContaining(["test/**/*.test.ts", "src/scripts/**/*.test.ts"]), + ); + expect(defaultToolingConfig.test?.include).not.toContain( + "src/config/doc-baseline.integration.test.ts", ); }); @@ -771,8 +770,9 @@ describe("scoped vitest configs", () => { }); it("normalizes ui include patterns relative to the scoped dir", () => { - expect(defaultUiConfig.test?.dir).toBe(path.join(process.cwd(), "ui", "src", "ui")); - expect(defaultUiConfig.test?.include).toEqual(["**/*.test.ts"]); + expect(defaultUiConfig.test?.dir).toBe(process.cwd()); + expect(defaultUiConfig.test?.include).toEqual(["ui/src/**/*.test.ts"]); + expect(defaultUiConfig.test?.exclude).toContain("ui/src/ui/app-chat.test.ts"); }); it("normalizes utils include patterns relative to the scoped dir", () => { diff --git a/test/vitest/vitest.infra.config.ts b/test/vitest/vitest.infra.config.ts index 065cdc2a060..015c1cde297 100644 --- a/test/vitest/vitest.infra.config.ts +++ b/test/vitest/vitest.infra.config.ts @@ -1,9 +1,11 @@ import { createScopedVitestConfig } from "./vitest.scoped-config.ts"; +import { boundaryTestFiles } from "./vitest.unit-paths.mjs"; export function createInfraVitestConfig(env?: Record) { return createScopedVitestConfig(["src/infra/**/*.test.ts"], { dir: "src", env, + exclude: boundaryTestFiles, name: "infra", passWithNoTests: true, }); diff --git a/test/vitest/vitest.plugin-sdk.config.ts b/test/vitest/vitest.plugin-sdk.config.ts index 37fed11ed48..0125d42fdd3 100644 --- a/test/vitest/vitest.plugin-sdk.config.ts +++ b/test/vitest/vitest.plugin-sdk.config.ts @@ -1,11 +1,12 @@ import { pluginSdkLightTestFiles } from "./vitest.plugin-sdk-paths.mjs"; import { createScopedVitestConfig } from "./vitest.scoped-config.ts"; +import { bundledPluginDependentUnitTestFiles } from "./vitest.unit-paths.mjs"; export function createPluginSdkVitestConfig(env?: Record) { return createScopedVitestConfig(["src/plugin-sdk/**/*.test.ts"], { dir: "src", env, - exclude: pluginSdkLightTestFiles, + exclude: [...pluginSdkLightTestFiles, ...bundledPluginDependentUnitTestFiles], name: "plugin-sdk", passWithNoTests: true, }); diff --git a/test/vitest/vitest.plugins.config.ts b/test/vitest/vitest.plugins.config.ts index ba63916e560..2a188095bcb 100644 --- a/test/vitest/vitest.plugins.config.ts +++ b/test/vitest/vitest.plugins.config.ts @@ -4,7 +4,7 @@ export function createPluginsVitestConfig(env?: Record = process.env, @@ -9,15 +10,10 @@ export function loadIncludePatternsFromEnv( export function createToolingVitestConfig(env?: Record) { return createScopedVitestConfig( - loadIncludePatternsFromEnv(env) ?? [ - "test/**/*.test.ts", - "src/scripts/**/*.test.ts", - "src/config/doc-baseline.integration.test.ts", - "src/config/schema.base.generated.test.ts", - "src/config/schema.help.quality.test.ts", - ], + loadIncludePatternsFromEnv(env) ?? ["test/**/*.test.ts", "src/scripts/**/*.test.ts"], { env, + exclude: boundaryTestFiles, name: "tooling", passWithNoTests: true, }, diff --git a/test/vitest/vitest.ui.config.ts b/test/vitest/vitest.ui.config.ts index cf6a2bee026..98d7b745ee4 100644 --- a/test/vitest/vitest.ui.config.ts +++ b/test/vitest/vitest.ui.config.ts @@ -17,11 +17,13 @@ export function createUiVitestConfig( env?: Record, options?: { includePatterns?: string[]; name?: string }, ) { - return createScopedVitestConfig(options?.includePatterns ?? ["ui/src/ui/**/*.test.ts"], { + const includePatterns = options?.includePatterns ?? ["ui/src/**/*.test.ts"]; + const exclude = options?.includePatterns ? [] : unitUiIncludePatterns; + return createScopedVitestConfig(includePatterns, { deps: jsdomOptimizedDeps, - dir: "ui/src/ui", environment: "jsdom", env, + exclude, excludeUnitFastTests: false, includeOpenClawRuntimeSetup: false, isolate: true, diff --git a/test/vitest/vitest.unit-fast-paths.mjs b/test/vitest/vitest.unit-fast-paths.mjs index cd1438e9d70..751aed4ea1c 100644 --- a/test/vitest/vitest.unit-fast-paths.mjs +++ b/test/vitest/vitest.unit-fast-paths.mjs @@ -5,6 +5,7 @@ import { commandsLightTestFiles, } from "./vitest.commands-light-paths.mjs"; import { pluginSdkLightSourceFiles, pluginSdkLightTestFiles } from "./vitest.plugin-sdk-paths.mjs"; +import { boundaryTestFiles } from "./vitest.unit-paths.mjs"; const normalizeRepoPath = (value) => value.replaceAll("\\", "/"); @@ -71,6 +72,7 @@ const broadUnitFastCandidateSkipGlobs = [ "src/plugin-sdk/browser-subpaths.test.ts", "src/security/**/*.test.ts", "src/secrets/**/*.test.ts", + ...boundaryTestFiles, ]; const disqualifyingPatterns = [ diff --git a/test/vitest/vitest.unit-src.config.ts b/test/vitest/vitest.unit-src.config.ts index ff889eda037..b0d8a4a92d9 100644 --- a/test/vitest/vitest.unit-src.config.ts +++ b/test/vitest/vitest.unit-src.config.ts @@ -3,5 +3,5 @@ import { createUnitVitestConfigWithOptions } from "./vitest.unit.config.ts"; export default createUnitVitestConfigWithOptions(process.env, { name: "unit-src", includePatterns: ["src/**/*.test.ts"], - extraExcludePatterns: ["src/security/**"], + extraExcludePatterns: ["src/acp/**", "src/security/**"], }); diff --git a/ui/src/styles/components.test.ts b/ui/src/styles/components.test.ts index cfa33785535..fb1e556bd58 100644 --- a/ui/src/styles/components.test.ts +++ b/ui/src/styles/components.test.ts @@ -1,9 +1,10 @@ import { readFileSync } from "node:fs"; +import path from "node:path"; import { describe, expect, it } from "vitest"; describe("agent fallback chip styles", () => { it("styles the chip remove control inside the agent model input", () => { - const css = readFileSync(new URL("./components.css", import.meta.url), "utf8"); + const css = readFileSync(path.join(process.cwd(), "ui/src/styles/components.css"), "utf8"); expect(css).toContain(".agent-chip-input .chip {"); expect(css).toContain(".agent-chip-input .chip-remove {"); diff --git a/ui/src/styles/config-quick.test.ts b/ui/src/styles/config-quick.test.ts index 1effbf8e8e5..f4967cd9958 100644 --- a/ui/src/styles/config-quick.test.ts +++ b/ui/src/styles/config-quick.test.ts @@ -1,7 +1,8 @@ import { readFileSync } from "node:fs"; +import path from "node:path"; import { describe, expect, it } from "vitest"; -const css = readFileSync(new URL("./config-quick.css", import.meta.url), "utf8"); +const css = readFileSync(path.join(process.cwd(), "ui/src/styles/config-quick.css"), "utf8"); describe("config-quick styles", () => { it("includes the local user identity quick-settings styles", () => { diff --git a/ui/src/styles/layout.mobile.test.ts b/ui/src/styles/layout.mobile.test.ts index 05e25c6cd72..5a1fe3b0e13 100644 --- a/ui/src/styles/layout.mobile.test.ts +++ b/ui/src/styles/layout.mobile.test.ts @@ -1,9 +1,10 @@ import { readFileSync } from "node:fs"; +import path from "node:path"; import { describe, expect, it } from "vitest"; describe("chat header responsive mobile styles", () => { it("keeps the chat header and session controls from clipping on narrow widths", () => { - const css = readFileSync(new URL("./layout.mobile.css", import.meta.url), "utf8"); + const css = readFileSync(path.join(process.cwd(), "ui/src/styles/layout.mobile.css"), "utf8"); expect(css).toContain("@media (max-width: 1320px)"); expect(css).toContain(".content--chat .content-header"); From d2786fb969b90dcf0bca8ad9685e51356eac299b Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 00:57:55 +0100 Subject: [PATCH 112/418] test(docker): run observability harness with global tsx --- scripts/e2e/docker-observability-smoke.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/scripts/e2e/docker-observability-smoke.sh b/scripts/e2e/docker-observability-smoke.sh index a488ec14a14..fce34dd8c2d 100644 --- a/scripts/e2e/docker-observability-smoke.sh +++ b/scripts/e2e/docker-observability-smoke.sh @@ -42,7 +42,9 @@ for i in $(seq 1 "$loops"); do mkdir -p "$iteration_dir" echo "== docker observability loop $i/$loops: otel ==" - pnpm qa:otel:smoke \ + # The functional image has a global tsx runner for mounted harness files; the + # published package intentionally does not ship tsx as an app dependency. + tsx scripts/qa-otel-smoke.ts \ --provider-mode mock-openai \ --output-dir "$iteration_dir/otel" From be56f172ab956ef5a34fcc65238ee39fb2928dbb Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 01:01:49 +0100 Subject: [PATCH 113/418] fix: scope qmd root memory collection --- CHANGELOG.md | 1 + .../memory-core/src/memory/qmd-compat.test.ts | 12 ++++---- .../memory-core/src/memory/qmd-compat.ts | 2 +- .../src/memory/qmd-manager.test.ts | 29 ++++++++++++++----- .../memory-core/src/memory/qmd-manager.ts | 2 +- 5 files changed, 31 insertions(+), 15 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 667c88e56f7..eb9d23cfe2b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,7 @@ Docs: https://docs.openclaw.ai ### Fixes +- Memory/QMD: prefer QMD's `--mask` collection pattern flag so root memory indexing stays scoped to `MEMORY.md` instead of widening to every markdown file in the workspace. Thanks @codex. - Codex harness: normalize cached input tokens before session/context accounting so prompt cache reads are not double-counted in `/status`, `session_status`, or persisted `sessionEntry.totalTokens`. Fixes #69298. Thanks @richardmqq. - Hooks/session-memory: use the host local timezone for memory filenames, fallback timestamp slugs, and markdown headers instead of UTC dates. Fixes #46703. (#46721) Thanks @Astro-Han. - Feishu: extract quoted/replied interactive-card text across schema 1.0, schema 2.0, i18n, template-variable, and post-format fallback shapes without carrying broad generated/config churn from related parser experiments. (#38776, #60383, #42218, #45936) Thanks @lishuaigit, @lskun, @just2gooo, and @Br1an67. diff --git a/extensions/memory-core/src/memory/qmd-compat.test.ts b/extensions/memory-core/src/memory/qmd-compat.test.ts index 2846167d8cb..9e926ebd730 100644 --- a/extensions/memory-core/src/memory/qmd-compat.test.ts +++ b/extensions/memory-core/src/memory/qmd-compat.test.ts @@ -2,12 +2,12 @@ import { describe, expect, it } from "vitest"; import { resolveQmdCollectionPatternFlags } from "./qmd-compat.js"; describe("resolveQmdCollectionPatternFlags", () => { - it("prefers modern --glob by default and falls back to legacy --mask", () => { - expect(resolveQmdCollectionPatternFlags(null)).toEqual(["--glob", "--mask"]); - expect(resolveQmdCollectionPatternFlags("--glob")).toEqual(["--glob", "--mask"]); - }); - - it("keeps preferring legacy --mask after a legacy-only qmd succeeds", () => { + it("prefers --mask by default and falls back to --glob", () => { + expect(resolveQmdCollectionPatternFlags(null)).toEqual(["--mask", "--glob"]); expect(resolveQmdCollectionPatternFlags("--mask")).toEqual(["--mask", "--glob"]); }); + + it("keeps preferring --glob after a glob-only qmd succeeds", () => { + expect(resolveQmdCollectionPatternFlags("--glob")).toEqual(["--glob", "--mask"]); + }); }); diff --git a/extensions/memory-core/src/memory/qmd-compat.ts b/extensions/memory-core/src/memory/qmd-compat.ts index 5c1c5240be4..30090cc384b 100644 --- a/extensions/memory-core/src/memory/qmd-compat.ts +++ b/extensions/memory-core/src/memory/qmd-compat.ts @@ -3,5 +3,5 @@ export type QmdCollectionPatternFlag = "--glob" | "--mask"; export function resolveQmdCollectionPatternFlags( preferredFlag: QmdCollectionPatternFlag | null, ): QmdCollectionPatternFlag[] { - return preferredFlag === "--mask" ? ["--mask", "--glob"] : ["--glob", "--mask"]; + return preferredFlag === "--glob" ? ["--glob", "--mask"] : ["--mask", "--glob"]; } diff --git a/extensions/memory-core/src/memory/qmd-manager.test.ts b/extensions/memory-core/src/memory/qmd-manager.test.ts index 5a1b4a9bcc6..7a35e8a5242 100644 --- a/extensions/memory-core/src/memory/qmd-manager.test.ts +++ b/extensions/memory-core/src/memory/qmd-manager.test.ts @@ -929,7 +929,12 @@ describe("QmdMemoryManager", () => { const child = createMockChild({ autoClose: false }); const pathArg = args[2] ?? ""; const name = args[args.indexOf("--name") + 1] ?? ""; - const pattern = args[args.indexOf("--glob") + 1] ?? args[args.indexOf("--mask") + 1] ?? ""; + const patternIndex = args.includes("--glob") + ? args.indexOf("--glob") + 1 + : args.includes("--mask") + ? args.indexOf("--mask") + 1 + : -1; + const pattern = patternIndex >= 0 ? (args[patternIndex] ?? "") : ""; const hasConflict = [...listedCollections.entries()].some( ([existingName, info]) => existingName !== name && info.path === pathArg && info.pattern === pattern, @@ -1023,7 +1028,12 @@ describe("QmdMemoryManager", () => { if (args[0] === "collection" && args[1] === "add") { const child = createMockChild({ autoClose: false }); const name = args[args.indexOf("--name") + 1] ?? ""; - const pattern = args[args.indexOf("--glob") + 1] ?? args[args.indexOf("--mask") + 1] ?? ""; + const patternIndex = args.includes("--glob") + ? args.indexOf("--glob") + 1 + : args.includes("--mask") + ? args.indexOf("--mask") + 1 + : -1; + const pattern = patternIndex >= 0 ? (args[patternIndex] ?? "") : ""; const attempts = addAttempts.get(name) ?? 0; addAttempts.set(name, attempts + 1); if (name === "memory-root-main" && attempts === 0) { @@ -1097,7 +1107,12 @@ describe("QmdMemoryManager", () => { if (args[0] === "collection" && args[1] === "add") { const child = createMockChild({ autoClose: false }); const name = args[args.indexOf("--name") + 1] ?? ""; - const pattern = args[args.indexOf("--glob") + 1] ?? args[args.indexOf("--mask") + 1] ?? ""; + const patternIndex = args.includes("--glob") + ? args.indexOf("--glob") + 1 + : args.includes("--mask") + ? args.indexOf("--mask") + 1 + : -1; + const pattern = patternIndex >= 0 ? (args[patternIndex] ?? "") : ""; added.set(name, pattern); queueMicrotask(() => child.closeWith(0)); return child; @@ -1113,7 +1128,7 @@ describe("QmdMemoryManager", () => { expect(removed).not.toContain("memory-dir-main"); }); - it("falls back to --mask when qmd collection add rejects --glob", async () => { + it("falls back to --glob when qmd collection add rejects --mask", async () => { cfg = { ...cfg, memory: { @@ -1137,8 +1152,8 @@ describe("QmdMemoryManager", () => { const child = createMockChild({ autoClose: false }); const flag = args.includes("--glob") ? "--glob" : args.includes("--mask") ? "--mask" : ""; addFlagCalls.push(flag); - if (flag === "--glob") { - emitAndClose(child, "stderr", "unknown flag: --glob", 1); + if (flag === "--mask") { + emitAndClose(child, "stderr", "unknown flag: --mask", 1); return child; } queueMicrotask(() => child.closeWith(0)); @@ -1150,7 +1165,7 @@ describe("QmdMemoryManager", () => { const { manager } = await createManager({ mode: "full" }); await manager.close(); - expect(addFlagCalls).toEqual(["--glob", "--mask", "--mask"]); + expect(addFlagCalls).toEqual(["--mask", "--glob", "--glob"]); expect(logWarnMock).toHaveBeenCalledWith( expect.stringContaining("retrying with legacy compatibility flag"), ); diff --git a/extensions/memory-core/src/memory/qmd-manager.ts b/extensions/memory-core/src/memory/qmd-manager.ts index c0a3b075737..5ca07dad05b 100644 --- a/extensions/memory-core/src/memory/qmd-manager.ts +++ b/extensions/memory-core/src/memory/qmd-manager.ts @@ -333,7 +333,7 @@ export class QmdMemoryManager implements MemorySearchManager { private attemptedNullByteCollectionRepair = false; private attemptedDuplicateDocumentRepair = false; private readonly sessionWarm = new Set(); - private collectionPatternFlag: QmdCollectionPatternFlag | null = "--glob"; + private collectionPatternFlag: QmdCollectionPatternFlag | null = "--mask"; private constructor(params: { agentId: string; From a3e0674261633234aba1bdb855c4bb4a511608a7 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 01:01:51 +0100 Subject: [PATCH 114/418] fix(ollama): harden native provider routing --- CHANGELOG.md | 4 + docs/providers/ollama.md | 7 +- docs/tools/ollama-search.md | 8 +- extensions/ollama/index.test.ts | 10 +- extensions/ollama/index.ts | 12 +- extensions/ollama/ollama.live.test.ts | 149 ++++++++++++++ .../ollama/src/embedding-provider.test.ts | 88 +++++++-- extensions/ollama/src/embedding-provider.ts | 78 +++++--- extensions/ollama/src/model-id.ts | 24 +++ extensions/ollama/src/stream-runtime.test.ts | 127 ++++++++++++ extensions/ollama/src/stream.ts | 111 ++++++++++- .../ollama/src/web-search-provider.test.ts | 84 ++++++++ extensions/ollama/src/web-search-provider.ts | 186 ++++++++++++------ src/plugins/provider-config-owner.ts | 27 +++ src/plugins/provider-hook-runtime.ts | 13 +- src/plugins/provider-runtime.test.ts | 32 +++ src/plugins/providers.runtime.ts | 28 +++ src/plugins/providers.test.ts | 41 ++++ 18 files changed, 909 insertions(+), 120 deletions(-) create mode 100644 extensions/ollama/ollama.live.test.ts create mode 100644 extensions/ollama/src/model-id.ts create mode 100644 src/plugins/provider-config-owner.ts diff --git a/CHANGELOG.md b/CHANGELOG.md index eb9d23cfe2b..6081dc1759a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -19,6 +19,10 @@ Docs: https://docs.openclaw.ai - Logging/sessions: apply configured redaction patterns to persisted session transcript text and accept escaped character classes in safe custom redaction regexes, so transcript JSONL no longer keeps matching sensitive text in the clear. Fixes #42982. Thanks @panpan0000. - Providers/Ollama: honor `/api/show` capabilities when registering local models so non-tool Ollama models no longer receive the agent tool surface, and keep native Ollama thinking opt-in instead of enabling it by default. Fixes #64710 and duplicate #65343. Thanks @yuan-b, @netherby, @xilopaint, and @Diyforfun2026. - Providers/Ollama: expose native Ollama thinking effort levels so `/think max` is accepted for reasoning-capable Ollama models and maps to Ollama's highest supported `think` effort. Fixes #71584. Thanks @g0st1n. +- Providers/Ollama: strip the active custom Ollama provider prefix before native chat and embedding requests, so custom provider ids like `ollama-spark/qwen3:32b` reach Ollama as the real model name. Fixes #72353. Thanks @maximus-dss and @hclsys. +- Providers/Ollama: move memory embeddings to Ollama's current `/api/embed` endpoint with batched `input` requests while preserving vector normalization and custom provider auth/header overrides. Fixes #39983. Thanks @sskkcc and @LiudengZhang. +- Providers/Ollama: try both current and legacy Ollama web-search endpoints and use `OLLAMA_API_KEY` only for the `ollama.com` cloud fallback, keeping local signed-in hosts keyless. Fixes #69132. Thanks @yoon1012 and @hyspacex. +- Agents/Ollama: apply provider-owned replay turn normalization to native Ollama chat so Cloud models no longer reject non-alternating replay history in agent/Gateway runs. Fixes #71697. Thanks @ismael-81. - Agents/Ollama: validate explicit `--thinking max` against catalog-discovered Ollama reasoning metadata so local agent runs accept the same native thinking levels shown in the model catalog. Fixes #71584. Thanks @g0st1n. - Docker/QA: add observability coverage to the normal Docker aggregate so QA-lab OTEL and Prometheus diagnostics run inside Docker. Thanks @vincentkoc. - Auto-reply: poison inbound message dedupe after replay-unsafe provider/runtime failures so retries stay safe before visible progress but cannot duplicate messages after block output, tool side effects, or session progress. Fixes #69303; keeps #58549 and #64606 as duplicate validation. Thanks @martingarramon, @NikolaFC, and @zeroth-blip. diff --git a/docs/providers/ollama.md b/docs/providers/ollama.md index 68ea42d8dec..339dd1d7fe3 100644 --- a/docs/providers/ollama.md +++ b/docs/providers/ollama.md @@ -318,6 +318,10 @@ Once configured, all your Ollama models are available: } ``` +Custom Ollama provider ids are also supported. When a model ref uses the active +provider prefix, such as `ollama-spark/qwen3:32b`, OpenClaw strips only that +prefix before calling Ollama so the server receives `qwen3:32b`. + ## Ollama Web Search OpenClaw supports **Ollama Web Search** as a bundled `web_search` provider. @@ -437,7 +441,8 @@ For the full setup and behavior details, see [Ollama Web Search](/tools/ollama-s The bundled Ollama plugin registers a memory embedding provider for [memory search](/concepts/memory). It uses the configured Ollama base URL - and API key. + and API key, calls Ollama's current `/api/embed` endpoint, and batches + multiple memory chunks into one `input` request when possible. | Property | Value | | ------------- | ------------------- | diff --git a/docs/tools/ollama-search.md b/docs/tools/ollama-search.md index 96036f62a05..073cb39d7c1 100644 --- a/docs/tools/ollama-search.md +++ b/docs/tools/ollama-search.md @@ -78,18 +78,22 @@ If no explicit Ollama base URL is set, OpenClaw uses `http://127.0.0.1:11434`. If your Ollama host expects bearer auth, OpenClaw reuses `models.providers.ollama.apiKey` (or the matching env-backed provider auth) -for web-search requests too. +for requests to that configured host. ## Notes - No web-search-specific API key field is required for this provider. - If the Ollama host is auth-protected, OpenClaw reuses the normal Ollama provider API key when present. +- If the configured host does not expose web search and `OLLAMA_API_KEY` is set, + OpenClaw can fall back to `https://ollama.com/api/web_search` without sending + that env key to the local host. - OpenClaw warns during setup if Ollama is unreachable or not signed in, but it does not block selection. - Runtime auto-detect can fall back to Ollama Web Search when no higher-priority credentialed provider is configured. -- The provider uses Ollama's `/api/web_search` endpoint. +- The provider tries Ollama's `/api/web_search` endpoint first, then the legacy + `/api/experimental/web_search` endpoint for older hosts. ## Related diff --git a/extensions/ollama/index.test.ts b/extensions/ollama/index.test.ts index f7792b97d76..e9ee52de232 100644 --- a/extensions/ollama/index.test.ts +++ b/extensions/ollama/index.test.ts @@ -429,7 +429,7 @@ describe("ollama plugin", () => { ).toBeUndefined(); }); - it("owns replay policy for OpenAI-compatible Ollama routes only", () => { + it("owns replay policy for OpenAI-compatible and native Ollama routes", () => { const provider = registerProvider(); expect( @@ -466,7 +466,13 @@ describe("ollama plugin", () => { modelApi: "ollama", modelId: "qwen3.5:9b", } as never), - ).toBeUndefined(); + ).toMatchObject({ + sanitizeToolCallIds: true, + toolCallIdMode: "strict", + applyAssistantFirstOrderingFix: true, + validateGeminiTurns: true, + validateAnthropicTurns: true, + }); }); it("routes createStreamFn to the correct provider baseUrl for ollama2", () => { diff --git a/extensions/ollama/index.ts b/extensions/ollama/index.ts index 956359f7dda..4ca916d7d64 100644 --- a/extensions/ollama/index.ts +++ b/extensions/ollama/index.ts @@ -8,7 +8,10 @@ import { type ProviderDiscoveryContext, } from "openclaw/plugin-sdk/plugin-entry"; import { buildApiKeyCredential } from "openclaw/plugin-sdk/provider-auth"; -import { OPENAI_COMPATIBLE_REPLAY_HOOKS } from "openclaw/plugin-sdk/provider-model-shared"; +import { + buildOpenAICompatibleReplayPolicy, + OPENAI_COMPATIBLE_REPLAY_HOOKS, +} from "openclaw/plugin-sdk/provider-model-shared"; import { buildOllamaProvider, configureOllamaNonInteractive, @@ -163,6 +166,10 @@ export default definePluginEntry({ }); }, ...OPENAI_COMPATIBLE_REPLAY_HOOKS, + buildReplayPolicy: (ctx) => + ctx.modelApi === "ollama" + ? buildOpenAICompatibleReplayPolicy("openai-completions") + : buildOpenAICompatibleReplayPolicy(ctx.modelApi), contributeResolvedModelCompat: ({ model }) => usesOllamaOpenAICompatTransport(model) ? { supportsUsageInStreaming: true } : undefined, resolveReasoningOutputMode: () => "native", @@ -174,11 +181,12 @@ export default definePluginEntry({ defaultLevel: "off", }), wrapStreamFn: createConfiguredOllamaCompatStreamWrapper, - createEmbeddingProvider: async ({ config, model, remote }) => { + createEmbeddingProvider: async ({ config, model, provider: embeddingProvider, remote }) => { const { provider, client } = await createOllamaEmbeddingProvider({ config, remote, model: model || DEFAULT_OLLAMA_EMBEDDING_MODEL, + provider: embeddingProvider || OLLAMA_PROVIDER_ID, }); return { ...provider, diff --git a/extensions/ollama/ollama.live.test.ts b/extensions/ollama/ollama.live.test.ts new file mode 100644 index 00000000000..c4d4666dd1c --- /dev/null +++ b/extensions/ollama/ollama.live.test.ts @@ -0,0 +1,149 @@ +import { describe, expect, it } from "vitest"; +import { createOllamaEmbeddingProvider } from "./src/embedding-provider.js"; +import { createOllamaStreamFn } from "./src/stream.js"; +import { createOllamaWebSearchProvider } from "./src/web-search-provider.js"; + +const LIVE = process.env.OPENCLAW_LIVE_TEST === "1" && process.env.OPENCLAW_LIVE_OLLAMA === "1"; +const OLLAMA_BASE_URL = + process.env.OPENCLAW_LIVE_OLLAMA_BASE_URL?.trim() || "http://127.0.0.1:11434"; +const CHAT_MODEL = process.env.OPENCLAW_LIVE_OLLAMA_MODEL?.trim() || "llama3.2:latest"; +const EMBEDDING_MODEL = + process.env.OPENCLAW_LIVE_OLLAMA_EMBED_MODEL?.trim() || "embeddinggemma:latest"; +const PROVIDER_ID = process.env.OPENCLAW_LIVE_OLLAMA_PROVIDER_ID?.trim() || "ollama-live-custom"; +const RUN_WEB_SEARCH = process.env.OPENCLAW_LIVE_OLLAMA_WEB_SEARCH !== "0"; + +async function collectStreamEvents(stream: AsyncIterable): Promise { + const events: T[] = []; + for await (const event of stream) { + events.push(event); + } + return events; +} + +describe.skipIf(!LIVE)("ollama live", () => { + it("runs native chat with a custom provider prefix and normalized tool schemas", async () => { + const streamFn = createOllamaStreamFn(OLLAMA_BASE_URL); + let payload: + | { + model?: string; + tools?: Array<{ + function?: { + parameters?: { + properties?: Record; + }; + }; + }>; + } + | undefined; + + const stream = streamFn( + { + id: `${PROVIDER_ID}/${CHAT_MODEL}`, + api: "ollama", + provider: PROVIDER_ID, + contextWindow: 8192, + } as never, + { + messages: [{ role: "user", content: "Reply exactly OK." }], + tools: [ + { + name: "lookup_weather", + description: "Lookup weather for a city.", + parameters: { + properties: { + city: { enum: ["London", "Vienna"] }, + units: { enum: ["metric", "imperial"] }, + options: { + properties: { + includeWind: { type: "boolean" }, + }, + }, + }, + required: ["city"], + }, + }, + ], + } as never, + { + maxTokens: 32, + temperature: 0, + onPayload: (body: unknown) => { + payload = body as NonNullable; + }, + } as never, + ); + + const events = await collectStreamEvents(await Promise.resolve(stream)); + const error = events.find((event) => (event as { type?: string }).type === "error"); + + expect(error).toBeUndefined(); + expect(events.some((event) => (event as { type?: string }).type === "done")).toBe(true); + expect(payload?.model).toBe(CHAT_MODEL); + const properties = payload?.tools?.[0]?.function?.parameters?.properties; + expect(properties?.city?.type).toBe("string"); + expect(properties?.units?.type).toBe("string"); + expect(properties?.options?.type).toBe("object"); + }, 60_000); + + it("embeds a batch through the current Ollama endpoint for custom providers", async () => { + const { client } = await createOllamaEmbeddingProvider({ + config: { + models: { + providers: { + [PROVIDER_ID]: { + api: "ollama", + baseUrl: OLLAMA_BASE_URL, + apiKey: "ollama-local", + }, + }, + }, + }, + provider: PROVIDER_ID, + model: `${PROVIDER_ID}/${EMBEDDING_MODEL}`, + } as never); + + const embeddings = await client.embedBatch(["hello", "world"]); + + expect(embeddings).toHaveLength(2); + expect(embeddings[0]?.length ?? 0).toBeGreaterThan(0); + expect(embeddings[1]?.length).toBe(embeddings[0]?.length); + expect(Math.hypot(...embeddings[0])).toBeGreaterThan(0.99); + expect(Math.hypot(...embeddings[0])).toBeLessThan(1.01); + }, 45_000); + + it.skipIf(!RUN_WEB_SEARCH)( + "searches through Ollama web search fallback endpoints", + async () => { + const provider = createOllamaWebSearchProvider(); + const tool = provider.createTool({ + config: { + models: { + providers: { + ollama: { + api: "ollama", + baseUrl: OLLAMA_BASE_URL, + apiKey: "ollama-local", + }, + }, + }, + }, + } as never); + if (!tool) { + throw new Error("Ollama web-search provider did not create a tool"); + } + + const result = (await tool.execute({ + query: "OpenClaw documentation", + count: 1, + })) as { + provider?: string; + results?: Array<{ url?: string }>; + }; + + expect(result.provider).toBe("ollama"); + expect(result.results?.length ?? 0).toBeGreaterThan(0); + expect(result.results?.[0]?.url).toMatch(/^https?:\/\//); + }, + 45_000, + ); +}); diff --git a/extensions/ollama/src/embedding-provider.test.ts b/extensions/ollama/src/embedding-provider.test.ts index a6f7ad02078..533ecd3e8e8 100644 --- a/extensions/ollama/src/embedding-provider.test.ts +++ b/extensions/ollama/src/embedding-provider.test.ts @@ -37,7 +37,7 @@ afterEach(() => { function mockEmbeddingFetch(embedding: number[]) { const fetchMock = vi.fn( async () => - new Response(JSON.stringify({ embedding }), { + new Response(JSON.stringify({ embeddings: [embedding] }), { status: 200, headers: { "content-type": "application/json" }, }), @@ -47,7 +47,7 @@ function mockEmbeddingFetch(embedding: number[]) { } describe("ollama embedding provider", () => { - it("calls /api/embeddings and returns normalized vectors", async () => { + it("calls /api/embed and returns normalized vectors", async () => { const fetchMock = mockEmbeddingFetch([3, 4]); const { provider } = await createOllamaEmbeddingProvider({ @@ -61,6 +61,13 @@ describe("ollama embedding provider", () => { const vector = await provider.embedQuery("hi"); expect(fetchMock).toHaveBeenCalledTimes(1); + expect(fetchMock).toHaveBeenCalledWith( + "http://127.0.0.1:11434/api/embed", + expect.objectContaining({ + method: "POST", + body: JSON.stringify({ model: "nomic-embed-text", input: "hi" }), + }), + ); expect(vector[0]).toBeCloseTo(0.6, 5); expect(vector[1]).toBeCloseTo(0.8, 5); }); @@ -90,7 +97,7 @@ describe("ollama embedding provider", () => { await provider.embedQuery("hello"); expect(fetchMock).toHaveBeenCalledWith( - "http://127.0.0.1:11434/api/embeddings", + "http://127.0.0.1:11434/api/embed", expect.objectContaining({ method: "POST", headers: expect.objectContaining({ @@ -141,7 +148,7 @@ describe("ollama embedding provider", () => { await provider.embedQuery("hello"); expect(fetchMock).toHaveBeenCalledWith( - "http://127.0.0.1:11434/api/embeddings", + "http://127.0.0.1:11434/api/embed", expect.objectContaining({ headers: expect.objectContaining({ Authorization: "Bearer ollama-env", @@ -150,22 +157,25 @@ describe("ollama embedding provider", () => { ); }); - it("serializes batch embeddings to avoid flooding local Ollama", async () => { - let inFlight = 0; - let maxInFlight = 0; - const prompts: string[] = []; + it("sends batch embeddings in one Ollama request", async () => { + const inputs: unknown[] = []; const fetchMock = vi.fn(async (_url: string, init?: RequestInit) => { - inFlight += 1; - maxInFlight = Math.max(maxInFlight, inFlight); const rawBody = typeof init?.body === "string" ? init.body : "{}"; - const body = JSON.parse(rawBody) as { prompt?: string }; - prompts.push(body.prompt ?? ""); - await new Promise((resolve) => setTimeout(resolve, 0)); - inFlight -= 1; - return new Response(JSON.stringify({ embedding: [1, 0] }), { - status: 200, - headers: { "content-type": "application/json" }, - }); + const body = JSON.parse(rawBody) as { input?: unknown }; + inputs.push(body.input); + return new Response( + JSON.stringify({ + embeddings: [ + [1, 0], + [1, 0], + [1, 0], + ], + }), + { + status: 200, + headers: { "content-type": "application/json" }, + }, + ); }); vi.stubGlobal("fetch", fetchMock); @@ -178,9 +188,45 @@ describe("ollama embedding provider", () => { }); await expect(provider.embedBatch(["a", "bb", "ccc"])).resolves.toHaveLength(3); - expect(fetchMock).toHaveBeenCalledTimes(3); - expect(prompts).toEqual(["a", "bb", "ccc"]); - expect(maxInFlight).toBe(1); + expect(fetchMock).toHaveBeenCalledTimes(1); + expect(inputs).toEqual([["a", "bb", "ccc"]]); + }); + + it("uses custom Ollama provider config and strips that provider prefix", async () => { + const fetchMock = mockEmbeddingFetch([1, 0]); + + const { provider } = await createOllamaEmbeddingProvider({ + config: { + models: { + providers: { + "ollama-spark": { + baseUrl: "http://spark.local:11434/v1", + apiKey: "spark-key", + headers: { + "X-Custom-Ollama": "spark", + }, + models: [], + }, + }, + }, + } as unknown as OpenClawConfig, + provider: "ollama-spark", + model: "ollama-spark/qwen3-embedding:4b", + fallback: "none", + }); + + await provider.embedQuery("hello"); + + expect(provider.model).toBe("qwen3-embedding:4b"); + expect(fetchMock).toHaveBeenCalledWith( + "http://spark.local:11434/api/embed", + expect.objectContaining({ + headers: expect.objectContaining({ + Authorization: "Bearer spark-key", + "X-Custom-Ollama": "spark", + }), + }), + ); }); it("marks inline memory batches as local-server timeout work", async () => { diff --git a/extensions/ollama/src/embedding-provider.ts b/extensions/ollama/src/embedding-provider.ts index c1e1421b79d..68753fc1f07 100644 --- a/extensions/ollama/src/embedding-provider.ts +++ b/extensions/ollama/src/embedding-provider.ts @@ -1,6 +1,7 @@ import type { OpenClawConfig } from "openclaw/plugin-sdk/provider-auth"; import { normalizeOptionalSecretInput } from "openclaw/plugin-sdk/provider-auth"; import { resolveEnvApiKey } from "openclaw/plugin-sdk/provider-auth-runtime"; +import { normalizeProviderId } from "openclaw/plugin-sdk/provider-model-shared"; import { hasConfiguredSecretInput, normalizeResolvedSecretInputString, @@ -11,6 +12,7 @@ import { ssrfPolicyFromHttpBaseUrlAllowedHostname, type SsrFPolicy, } from "openclaw/plugin-sdk/ssrf-runtime"; +import { normalizeOllamaWireModelId } from "./model-id.js"; import { resolveOllamaApiBase } from "./provider-models.js"; export type OllamaEmbeddingProvider = { @@ -48,7 +50,6 @@ export type OllamaEmbeddingClient = { type OllamaEmbeddingClientConfig = Omit; export const DEFAULT_OLLAMA_EMBEDDING_MODEL = "nomic-embed-text"; -const OLLAMA_EMBEDDING_BATCH_CONCURRENCY = 1; function sanitizeAndNormalizeEmbedding(vec: number[]): number[] { const sanitized = vec.map((value) => (Number.isFinite(value) ? value : 0)); @@ -78,12 +79,31 @@ async function withRemoteHttpResponse(params: { } } -function normalizeEmbeddingModel(model: string): string { +function normalizeEmbeddingModel(model: string, providerId?: string): string { const trimmed = model.trim(); if (!trimmed) { return DEFAULT_OLLAMA_EMBEDDING_MODEL; } - return trimmed.startsWith("ollama/") ? trimmed.slice("ollama/".length) : trimmed; + return normalizeOllamaWireModelId(trimmed, providerId); +} + +function resolveConfiguredProvider(options: OllamaEmbeddingOptions) { + const providers = options.config.models?.providers; + if (!providers) { + return undefined; + } + const providerId = options.provider?.trim() || "ollama"; + const direct = providers[providerId]; + if (direct) { + return direct; + } + const normalized = normalizeProviderId(providerId); + for (const [candidateId, candidate] of Object.entries(providers)) { + if (normalizeProviderId(candidateId) === normalized) { + return candidate; + } + } + return providers.ollama; } function resolveMemorySecretInputString(params: { @@ -107,9 +127,7 @@ function resolveOllamaApiKey(options: OllamaEmbeddingOptions): string | undefine if (remoteApiKey) { return remoteApiKey; } - const providerApiKey = normalizeOptionalSecretInput( - options.config.models?.providers?.ollama?.apiKey, - ); + const providerApiKey = normalizeOptionalSecretInput(resolveConfiguredProvider(options)?.apiKey); if (providerApiKey) { return providerApiKey; } @@ -119,10 +137,10 @@ function resolveOllamaApiKey(options: OllamaEmbeddingOptions): string | undefine function resolveOllamaEmbeddingClient( options: OllamaEmbeddingOptions, ): OllamaEmbeddingClientConfig { - const providerConfig = options.config.models?.providers?.ollama; + const providerConfig = resolveConfiguredProvider(options); const rawBaseUrl = options.remote?.baseUrl?.trim() || providerConfig?.baseUrl?.trim(); const baseUrl = resolveOllamaApiBase(rawBaseUrl); - const model = normalizeEmbeddingModel(options.model); + const model = normalizeEmbeddingModel(options.model, options.provider); const headerOverrides = Object.assign({}, providerConfig?.headers, options.remote?.headers); const headers: Record = { "Content-Type": "application/json", @@ -144,42 +162,54 @@ export async function createOllamaEmbeddingProvider( options: OllamaEmbeddingOptions, ): Promise<{ provider: OllamaEmbeddingProvider; client: OllamaEmbeddingClient }> { const client = resolveOllamaEmbeddingClient(options); - const embedUrl = `${client.baseUrl.replace(/\/$/, "")}/api/embeddings`; + const embedUrl = `${client.baseUrl.replace(/\/$/, "")}/api/embed`; - const embedOne = async (text: string): Promise => { + const embedMany = async (input: string | string[]): Promise => { const json = await withRemoteHttpResponse({ url: embedUrl, ssrfPolicy: client.ssrfPolicy, init: { method: "POST", headers: client.headers, - body: JSON.stringify({ model: client.model, prompt: text }), + body: JSON.stringify({ model: client.model, input }), }, onResponse: async (response) => { if (!response.ok) { - throw new Error(`Ollama embeddings HTTP ${response.status}: ${await response.text()}`); + throw new Error(`Ollama embed HTTP ${response.status}: ${await response.text()}`); } - return (await response.json()) as { embedding?: number[] }; + return (await response.json()) as { embeddings?: unknown }; }, }); - if (!Array.isArray(json.embedding)) { - throw new Error("Ollama embeddings response missing embedding[]"); + if (!Array.isArray(json.embeddings)) { + throw new Error("Ollama embed response missing embeddings[]"); } - return sanitizeAndNormalizeEmbedding(json.embedding); + const expectedCount = Array.isArray(input) ? input.length : 1; + if (json.embeddings.length !== expectedCount) { + throw new Error( + `Ollama embed response returned ${json.embeddings.length} embeddings for ${expectedCount} inputs`, + ); + } + return json.embeddings.map((embedding) => { + if (!Array.isArray(embedding)) { + throw new Error("Ollama embed response contains a non-array embedding"); + } + return sanitizeAndNormalizeEmbedding(embedding); + }); + }; + + const embedOne = async (text: string): Promise => { + const [embedding] = await embedMany(text); + if (!embedding) { + throw new Error("Ollama embed response returned no embedding"); + } + return embedding; }; const provider: OllamaEmbeddingProvider = { id: "ollama", model: client.model, embedQuery: embedOne, - embedBatch: async (texts) => { - const embeddings: number[][] = []; - for (let index = 0; index < texts.length; index += OLLAMA_EMBEDDING_BATCH_CONCURRENCY) { - const batch = texts.slice(index, index + OLLAMA_EMBEDDING_BATCH_CONCURRENCY); - embeddings.push(...(await Promise.all(batch.map(embedOne)))); - } - return embeddings; - }, + embedBatch: async (texts) => (texts.length === 0 ? [] : await embedMany(texts)), }; return { diff --git a/extensions/ollama/src/model-id.ts b/extensions/ollama/src/model-id.ts new file mode 100644 index 00000000000..df0bcae7e73 --- /dev/null +++ b/extensions/ollama/src/model-id.ts @@ -0,0 +1,24 @@ +import { normalizeProviderId } from "openclaw/plugin-sdk/provider-model-shared"; + +export const OLLAMA_PROVIDER_ID = "ollama"; + +function uniqueModelPrefixCandidates(providerId?: string): string[] { + const candidates = [providerId, normalizeProviderId(providerId ?? ""), OLLAMA_PROVIDER_ID] + .map((candidate) => candidate?.trim()) + .filter((candidate): candidate is string => Boolean(candidate)); + return [...new Set(candidates)]; +} + +export function normalizeOllamaWireModelId(modelId: string, providerId?: string): string { + const trimmed = modelId.trim(); + if (!trimmed) { + return trimmed; + } + for (const candidate of uniqueModelPrefixCandidates(providerId)) { + const prefix = `${candidate}/`; + if (trimmed.startsWith(prefix)) { + return trimmed.slice(prefix.length); + } + } + return trimmed; +} diff --git a/extensions/ollama/src/stream-runtime.test.ts b/extensions/ollama/src/stream-runtime.test.ts index 2e502be5d15..d6598dd04eb 100644 --- a/extensions/ollama/src/stream-runtime.test.ts +++ b/extensions/ollama/src/stream-runtime.test.ts @@ -56,6 +56,30 @@ describe("buildOllamaChatRequest", () => { model: "qwen3:14b-q8_0", }); }); + + it("strips the active custom provider prefix from chat model ids", () => { + expect( + buildOllamaChatRequest({ + modelId: "ollama-spark/qwen3:32b", + providerId: "ollama-spark", + messages: [{ role: "user", content: "hello" }], + }), + ).toMatchObject({ + model: "qwen3:32b", + }); + }); + + it("keeps unrelated slash-containing Ollama model ids intact", () => { + expect( + buildOllamaChatRequest({ + modelId: "library/qwen3:32b", + providerId: "ollama-spark", + messages: [{ role: "user", content: "hello" }], + }), + ).toMatchObject({ + model: "library/qwen3:32b", + }); + }); }); describe("createConfiguredOllamaCompatStreamWrapper", () => { @@ -255,6 +279,109 @@ describe("createConfiguredOllamaCompatStreamWrapper", () => { }, ); }); + + it("sends custom-provider Ollama chat requests with the bare Ollama model id", async () => { + await withMockNdjsonFetch( + [ + '{"model":"m","created_at":"t","message":{"role":"assistant","content":"ok"},"done":false}', + '{"model":"m","created_at":"t","message":{"role":"assistant","content":""},"done":true,"prompt_eval_count":1,"eval_count":1}', + ], + async (fetchMock) => { + const streamFn = createOllamaStreamFn("http://ollama-host:11434"); + const model = { + api: "ollama", + provider: "ollama-spark", + id: "ollama-spark/qwen3:32b", + contextWindow: 131072, + }; + + const stream = await Promise.resolve( + streamFn( + model as never, + { + messages: [{ role: "user", content: "hello" }], + } as never, + {} as never, + ), + ); + + await collectStreamEvents(stream); + + const requestInit = getGuardedFetchCall(fetchMock).init ?? {}; + if (typeof requestInit.body !== "string") { + throw new Error("Expected string request body"); + } + const requestBody = JSON.parse(requestInit.body) as { model?: string }; + expect(requestBody.model).toBe("qwen3:32b"); + }, + ); + }); + + it("adds direct type hints to native Ollama tool schemas before sending them", async () => { + await withMockNdjsonFetch( + [ + '{"model":"m","created_at":"t","message":{"role":"assistant","content":"ok"},"done":false}', + '{"model":"m","created_at":"t","message":{"role":"assistant","content":""},"done":true,"prompt_eval_count":1,"eval_count":1}', + ], + async (fetchMock) => { + const streamFn = createOllamaStreamFn("http://ollama-host:11434"); + const model = { + api: "ollama", + provider: "ollama", + id: "qwen3:32b", + contextWindow: 131072, + }; + + const stream = await Promise.resolve( + streamFn( + model as never, + { + messages: [{ role: "user", content: "hello" }], + tools: [ + { + name: "search", + description: "search", + parameters: { + properties: { + query: { + anyOf: [{ type: "string" }, { type: "null" }], + }, + tags: { + items: { type: "string" }, + }, + }, + required: ["query"], + }, + }, + ], + } as never, + {} as never, + ), + ); + + await collectStreamEvents(stream); + + const requestInit = getGuardedFetchCall(fetchMock).init ?? {}; + if (typeof requestInit.body !== "string") { + throw new Error("Expected string request body"); + } + const requestBody = JSON.parse(requestInit.body) as { + tools?: Array<{ + function?: { + parameters?: { + type?: string; + properties?: Record; + }; + }; + }>; + }; + const parameters = requestBody.tools?.[0]?.function?.parameters; + expect(parameters?.type).toBe("object"); + expect(parameters?.properties?.query?.type).toBe("string"); + expect(parameters?.properties?.tags?.type).toBe("array"); + }, + ); + }); }); describe("convertToOllamaMessages", () => { diff --git a/extensions/ollama/src/stream.ts b/extensions/ollama/src/stream.ts index 2a1093ddb5b..c1f45a2070e 100644 --- a/extensions/ollama/src/stream.ts +++ b/extensions/ollama/src/stream.ts @@ -30,6 +30,7 @@ import { createSubsystemLogger } from "openclaw/plugin-sdk/runtime-env"; import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime"; import { normalizeLowercaseStringOrEmpty, readStringValue } from "openclaw/plugin-sdk/text-runtime"; import { OLLAMA_DEFAULT_BASE_URL } from "./defaults.js"; +import { normalizeOllamaWireModelId } from "./model-id.js"; import { parseJsonObjectPreservingUnsafeIntegers, parseJsonPreservingUnsafeIntegers, @@ -239,20 +240,16 @@ export function createConfiguredOllamaCompatStreamWrapper( // Ollama compat wrapper now owns more than num_ctx injection. export const createConfiguredOllamaCompatNumCtxWrapper = createConfiguredOllamaCompatStreamWrapper; -function normalizeOllamaWireModelId(modelId: string): string { - const trimmed = modelId.trim(); - return trimmed.startsWith("ollama/") ? trimmed.slice("ollama/".length) : trimmed; -} - export function buildOllamaChatRequest(params: { modelId: string; + providerId?: string; messages: OllamaChatMessage[]; tools?: OllamaTool[]; options?: Record; stream?: boolean; }): OllamaChatRequest { return { - model: normalizeOllamaWireModelId(params.modelId), + model: normalizeOllamaWireModelId(params.modelId, params.providerId), messages: params.messages, stream: params.stream ?? true, ...(params.tools && params.tools.length > 0 ? { tools: params.tools } : {}), @@ -449,6 +446,105 @@ function normalizeOllamaCompatMessageToolArgs(payloadRecord: Record { + return Boolean(value && typeof value === "object" && !Array.isArray(value)); +} + +function inferOllamaSchemaType(schema: Record): string | undefined { + if (schema.properties && isRecord(schema.properties)) { + return "object"; + } + if (schema.items) { + return "array"; + } + if (Array.isArray(schema.enum) && schema.enum.length > 0) { + const values = schema.enum.filter((value) => value !== null); + if (values.length > 0 && values.every((value) => typeof value === "string")) { + return "string"; + } + if (values.length > 0 && values.every((value) => typeof value === "number")) { + return "number"; + } + if (values.length > 0 && values.every((value) => typeof value === "boolean")) { + return "boolean"; + } + } + for (const unionKey of ["anyOf", "oneOf"] as const) { + const variants = schema[unionKey]; + if (!Array.isArray(variants)) { + continue; + } + for (const variant of variants) { + if (!isRecord(variant)) { + continue; + } + const variantType = variant.type; + if (typeof variantType === "string" && variantType !== "null") { + return variantType; + } + if (Array.isArray(variantType)) { + const firstType = variantType.find( + (entry): entry is string => typeof entry === "string" && entry !== "null", + ); + if (firstType) { + return firstType; + } + } + const inferred = inferOllamaSchemaType(variant); + if (inferred) { + return inferred; + } + } + } + return undefined; +} + +function normalizeOllamaToolSchema(schema: unknown, isRoot = false): Record { + if (!isRecord(schema)) { + return { + type: "object", + properties: {}, + }; + } + + const normalized: Record = {}; + for (const [key, value] of Object.entries(schema)) { + if (key === "properties" && isRecord(value)) { + normalized.properties = Object.fromEntries( + Object.entries(value).map(([propertyName, propertySchema]) => [ + propertyName, + normalizeOllamaToolSchema(propertySchema), + ]), + ); + continue; + } + if (key === "items") { + normalized.items = Array.isArray(value) + ? value.map((entry) => normalizeOllamaToolSchema(entry)) + : normalizeOllamaToolSchema(value); + continue; + } + if ((key === "anyOf" || key === "oneOf" || key === "allOf") && Array.isArray(value)) { + normalized[key] = value.map((entry) => normalizeOllamaToolSchema(entry)); + continue; + } + normalized[key] = value; + } + + const schemaType = normalized.type; + if ( + typeof schemaType !== "string" && + (!Array.isArray(schemaType) || + !schemaType.some((entry) => typeof entry === "string" && entry !== "null")) + ) { + normalized.type = inferOllamaSchemaType(normalized) ?? (isRoot ? "object" : "string"); + } + if (normalized.type === "object" && !isRecord(normalized.properties)) { + normalized.properties = {}; + } + return normalized; +} + function extractToolCalls(content: unknown): OllamaToolCall[] { if (!Array.isArray(content)) { return []; @@ -529,7 +625,7 @@ function extractOllamaTools(tools: Tool[] | undefined): OllamaTool[] { function: { name: tool.name, description: typeof tool.description === "string" ? tool.description : "", - parameters: (tool.parameters ?? {}) as Record, + parameters: normalizeOllamaToolSchema(tool.parameters, true), }, }); } @@ -653,6 +749,7 @@ export function createOllamaStreamFn( const body = buildOllamaChatRequest({ modelId: model.id, + providerId: model.provider, messages: ollamaMessages, stream: true, tools: ollamaTools, diff --git a/extensions/ollama/src/web-search-provider.test.ts b/extensions/ollama/src/web-search-provider.test.ts index c336c591ca4..4d70d28f51c 100644 --- a/extensions/ollama/src/web-search-provider.test.ts +++ b/extensions/ollama/src/web-search-provider.test.ts @@ -184,6 +184,90 @@ describe("ollama web search provider", () => { expect(release).toHaveBeenCalledTimes(1); }); + it("falls back to the legacy Ollama web search endpoint when /api/web_search is missing", async () => { + fetchWithSsrFGuardMock + .mockResolvedValueOnce({ + response: new Response("not found", { status: 404 }), + release: vi.fn(async () => {}), + }) + .mockResolvedValueOnce({ + response: new Response( + JSON.stringify({ + results: [{ title: "Legacy", url: "https://example.com", content: "result" }], + }), + { + status: 200, + headers: { "Content-Type": "application/json" }, + }, + ), + release: vi.fn(async () => {}), + }); + + await expect( + runOllamaWebSearch({ config: createOllamaConfig(), query: "openclaw" }), + ).resolves.toMatchObject({ + count: 1, + results: [{ url: "https://example.com" }], + }); + + expect(fetchWithSsrFGuardMock.mock.calls.map((call) => call[0].url)).toEqual([ + "http://ollama.local:11434/api/web_search", + "http://ollama.local:11434/api/experimental/web_search", + ]); + }); + + it("uses an env Ollama key only for the cloud fallback from a local host", async () => { + const original = process.env.OLLAMA_API_KEY; + try { + process.env.OLLAMA_API_KEY = "cloud-secret"; + fetchWithSsrFGuardMock + .mockResolvedValueOnce({ + response: new Response("not found", { status: 404 }), + release: vi.fn(async () => {}), + }) + .mockResolvedValueOnce({ + response: new Response("not found", { status: 404 }), + release: vi.fn(async () => {}), + }) + .mockResolvedValueOnce({ + response: new Response( + JSON.stringify({ + results: [{ title: "Cloud", url: "https://example.com", content: "result" }], + }), + { + status: 200, + headers: { "Content-Type": "application/json" }, + }, + ), + release: vi.fn(async () => {}), + }); + + await expect( + runOllamaWebSearch({ config: createOllamaConfig(), query: "openclaw" }), + ).resolves.toMatchObject({ + count: 1, + }); + + const firstHeaders = fetchWithSsrFGuardMock.mock.calls[0]?.[0].init?.headers as + | Record + | undefined; + const cloudHeaders = fetchWithSsrFGuardMock.mock.calls[2]?.[0].init?.headers as + | Record + | undefined; + expect(firstHeaders?.Authorization).toBeUndefined(); + expect(cloudHeaders?.Authorization).toBe("Bearer cloud-secret"); + expect(fetchWithSsrFGuardMock.mock.calls[2]?.[0].url).toBe( + "https://ollama.com/api/web_search", + ); + } finally { + if (original === undefined) { + delete process.env.OLLAMA_API_KEY; + } else { + process.env.OLLAMA_API_KEY = original; + } + } + }); + it("surfaces Ollama signin guidance for 401 responses", async () => { fetchWithSsrFGuardMock.mockResolvedValue({ response: new Response("", { status: 401 }), diff --git a/extensions/ollama/src/web-search-provider.ts b/extensions/ollama/src/web-search-provider.ts index 61279ef2c95..c4ed075ff2f 100644 --- a/extensions/ollama/src/web-search-provider.ts +++ b/extensions/ollama/src/web-search-provider.ts @@ -42,6 +42,8 @@ const OLLAMA_WEB_SEARCH_SCHEMA = Type.Object( ); const OLLAMA_WEB_SEARCH_PATH = "/api/web_search"; +const OLLAMA_LEGACY_WEB_SEARCH_PATH = "/api/experimental/web_search"; +const OLLAMA_CLOUD_BASE_URL = "https://ollama.com"; const DEFAULT_OLLAMA_WEB_SEARCH_COUNT = 5; const DEFAULT_OLLAMA_WEB_SEARCH_TIMEOUT_MS = 15_000; const OLLAMA_WEB_SEARCH_SNIPPET_MAX_CHARS = 300; @@ -56,14 +58,31 @@ type OllamaWebSearchResponse = { results?: OllamaWebSearchResult[]; }; -function resolveOllamaWebSearchApiKey(config?: OpenClawConfig): string | undefined { +function isOllamaCloudBaseUrl(baseUrl: string): boolean { + try { + const parsed = new URL(baseUrl); + return parsed.protocol === "https:" && parsed.hostname === "ollama.com"; + } catch { + return false; + } +} + +function resolveConfiguredOllamaWebSearchApiKey(config?: OpenClawConfig): string | undefined { const providerApiKey = normalizeOptionalSecretInput(config?.models?.providers?.ollama?.apiKey); if (providerApiKey && !isNonSecretApiKeyMarker(providerApiKey)) { return providerApiKey; } + return undefined; +} + +function resolveEnvOllamaWebSearchApiKey(): string | undefined { return resolveEnvApiKey("ollama")?.apiKey; } +function resolveOllamaWebSearchApiKey(config?: OpenClawConfig): string | undefined { + return resolveConfiguredOllamaWebSearchApiKey(config) ?? resolveEnvOllamaWebSearchApiKey(); +} + function resolveOllamaWebSearchBaseUrl(config?: OpenClawConfig): string { const pluginBaseUrl = normalizeOptionalString( resolveProviderWebSearchPluginConfig(config, "ollama")?.baseUrl, @@ -103,71 +122,117 @@ export async function runOllamaWebSearch(params: { } const baseUrl = resolveOllamaWebSearchBaseUrl(params.config); - const apiKey = resolveOllamaWebSearchApiKey(params.config); + const configuredApiKey = resolveConfiguredOllamaWebSearchApiKey(params.config); + const envApiKey = resolveEnvOllamaWebSearchApiKey(); const count = resolveSearchCount(params.count, DEFAULT_OLLAMA_WEB_SEARCH_COUNT); const startedAt = Date.now(); - const headers: Record = { "Content-Type": "application/json" }; - if (apiKey) { - headers.Authorization = `Bearer ${apiKey}`; - } - const { response, release } = await fetchWithSsrFGuard({ - url: `${baseUrl}${OLLAMA_WEB_SEARCH_PATH}`, - init: { - method: "POST", - headers, - body: JSON.stringify({ query, max_results: count }), - signal: AbortSignal.timeout(DEFAULT_OLLAMA_WEB_SEARCH_TIMEOUT_MS), + const body = JSON.stringify({ query, max_results: count }); + const attempts = [ + { + baseUrl, + path: OLLAMA_WEB_SEARCH_PATH, + apiKey: isOllamaCloudBaseUrl(baseUrl) ? (configuredApiKey ?? envApiKey) : configuredApiKey, }, - policy: buildOllamaBaseUrlSsrFPolicy(baseUrl), - auditContext: "ollama-web-search.search", - }); + { + baseUrl, + path: OLLAMA_LEGACY_WEB_SEARCH_PATH, + apiKey: isOllamaCloudBaseUrl(baseUrl) ? (configuredApiKey ?? envApiKey) : configuredApiKey, + }, + ...(!isOllamaCloudBaseUrl(baseUrl) && envApiKey + ? [ + { + baseUrl: OLLAMA_CLOUD_BASE_URL, + path: OLLAMA_WEB_SEARCH_PATH, + apiKey: envApiKey, + }, + ] + : []), + ]; - try { - if (response.status === 401) { - throw new Error("Ollama web search authentication failed. Run `ollama signin`."); + let payload: OllamaWebSearchResponse | undefined; + let lastError: Error | undefined; + for (const attempt of attempts) { + const headers: Record = { "Content-Type": "application/json" }; + if (attempt.apiKey) { + headers.Authorization = `Bearer ${attempt.apiKey}`; } - if (response.status === 403) { - throw new Error( - "Ollama web search is unavailable. Ensure cloud-backed web search is enabled on the Ollama host.", - ); - } - if (!response.ok) { - const detail = await readResponseText(response, { maxBytes: 64_000 }); - throw new Error(`Ollama web search failed (${response.status}): ${detail.text || ""}`.trim()); - } - - const payload = (await response.json()) as OllamaWebSearchResponse; - const results = Array.isArray(payload.results) - ? payload.results - .map(normalizeOllamaWebSearchResult) - .filter((result): result is NonNullable => result !== null) - .slice(0, count) - : []; - - return { - query, - provider: "ollama", - count: results.length, - tookMs: Date.now() - startedAt, - externalContent: { - untrusted: true, - source: "web_search", - provider: "ollama", - wrapped: true, + const { response, release } = await fetchWithSsrFGuard({ + url: `${attempt.baseUrl}${attempt.path}`, + init: { + method: "POST", + headers, + body, + signal: AbortSignal.timeout(DEFAULT_OLLAMA_WEB_SEARCH_TIMEOUT_MS), }, - results: results.map((result) => { - const snippet = truncateText(result.content, OLLAMA_WEB_SEARCH_SNIPPET_MAX_CHARS).text; - return { - title: result.title ? wrapWebContent(result.title, "web_search") : "", - url: result.url, - snippet: snippet ? wrapWebContent(snippet, "web_search") : "", - siteName: resolveSiteName(result.url) || undefined, - }; - }), - }; - } finally { - await release(); + policy: buildOllamaBaseUrlSsrFPolicy(attempt.baseUrl), + auditContext: "ollama-web-search.search", + }); + + try { + if (response.status === 401) { + throw new Error("Ollama web search authentication failed. Run `ollama signin`."); + } + if (response.status === 403) { + throw new Error( + "Ollama web search is unavailable. Ensure cloud-backed web search is enabled on the Ollama host.", + ); + } + if (!response.ok) { + const detail = await readResponseText(response, { maxBytes: 64_000 }); + const message = + `Ollama web search failed (${response.status}): ${detail.text || ""}`.trim(); + if (response.status === 404) { + lastError = new Error(message); + continue; + } + throw new Error(message); + } + payload = (await response.json()) as OllamaWebSearchResponse; + break; + } catch (error) { + if (error instanceof Error) { + lastError = error; + } else { + lastError = new Error(String(error)); + } + throw lastError; + } finally { + await release(); + } } + + if (!payload) { + throw lastError ?? new Error("Ollama web search failed"); + } + + const results = Array.isArray(payload.results) + ? payload.results + .map(normalizeOllamaWebSearchResult) + .filter((result): result is NonNullable => result !== null) + .slice(0, count) + : []; + + return { + query, + provider: "ollama", + count: results.length, + tookMs: Date.now() - startedAt, + externalContent: { + untrusted: true, + source: "web_search", + provider: "ollama", + wrapped: true, + }, + results: results.map((result) => { + const snippet = truncateText(result.content, OLLAMA_WEB_SEARCH_SNIPPET_MAX_CHARS).text; + return { + title: result.title ? wrapWebContent(result.title, "web_search") : "", + url: result.url, + snippet: snippet ? wrapWebContent(snippet, "web_search") : "", + siteName: resolveSiteName(result.url) || undefined, + }; + }), + }; } async function warnOllamaWebSearchPrereqs(params: { @@ -241,7 +306,10 @@ export function createOllamaWebSearchProvider(): WebSearchProviderPlugin { export const __testing = { normalizeOllamaWebSearchResult, + resolveConfiguredOllamaWebSearchApiKey, + resolveEnvOllamaWebSearchApiKey, resolveOllamaWebSearchApiKey, resolveOllamaWebSearchBaseUrl, + isOllamaCloudBaseUrl, warnOllamaWebSearchPrereqs, }; diff --git a/src/plugins/provider-config-owner.ts b/src/plugins/provider-config-owner.ts new file mode 100644 index 00000000000..e863082df93 --- /dev/null +++ b/src/plugins/provider-config-owner.ts @@ -0,0 +1,27 @@ +import { normalizeProviderId } from "../agents/provider-id.js"; +import type { OpenClawConfig } from "../config/types.openclaw.js"; + +export function resolveProviderConfigApiOwnerHint(params: { + provider: string; + config?: OpenClawConfig; +}): string | undefined { + const providers = params.config?.models?.providers; + if (!providers) { + return undefined; + } + const normalizedProvider = normalizeProviderId(params.provider); + if (!normalizedProvider) { + return undefined; + } + const providerConfig = + providers[params.provider] ?? + Object.entries(providers).find( + ([candidateId]) => normalizeProviderId(candidateId) === normalizedProvider, + )?.[1]; + const api = + typeof providerConfig?.api === "string" ? normalizeProviderId(providerConfig.api) : ""; + if (!api || api === normalizedProvider) { + return undefined; + } + return api; +} diff --git a/src/plugins/provider-hook-runtime.ts b/src/plugins/provider-hook-runtime.ts index ef9c2961939..4d7c705c7fe 100644 --- a/src/plugins/provider-hook-runtime.ts +++ b/src/plugins/provider-hook-runtime.ts @@ -1,6 +1,7 @@ import { normalizeProviderId } from "../agents/provider-id.js"; import type { OpenClawConfig } from "../config/types.openclaw.js"; import { normalizePluginIdScope, serializePluginIdScope } from "./plugin-scope.js"; +import { resolveProviderConfigApiOwnerHint } from "./provider-config-owner.js"; import { isPluginProvidersLoadInFlight, resolvePluginProviders } from "./providers.runtime.js"; import { resolvePluginCacheInputs } from "./roots.js"; import { getActivePluginRegistryWorkspaceDirFromState } from "./runtime-state.js"; @@ -164,16 +165,24 @@ export function resolveProviderRuntimePlugin(params: { bundledProviderVitestCompat?: boolean; installBundledRuntimeDeps?: boolean; }): ProviderPlugin | undefined { + const apiOwnerHint = resolveProviderConfigApiOwnerHint({ + provider: params.provider, + config: params.config, + }); return resolveProviderPluginsForHooks({ config: params.config, workspaceDir: params.workspaceDir ?? getActivePluginRegistryWorkspaceDirFromState(), env: params.env, - providerRefs: [params.provider], + providerRefs: apiOwnerHint ? [params.provider, apiOwnerHint] : [params.provider], applyAutoEnable: params.applyAutoEnable, bundledProviderAllowlistCompat: params.bundledProviderAllowlistCompat, bundledProviderVitestCompat: params.bundledProviderVitestCompat, installBundledRuntimeDeps: params.installBundledRuntimeDeps, - }).find((plugin) => matchesProviderId(plugin, params.provider)); + }).find( + (plugin) => + matchesProviderId(plugin, params.provider) || + (apiOwnerHint ? matchesProviderId(plugin, apiOwnerHint) : false), + ); } export function resolveProviderHookPlugin(params: { diff --git a/src/plugins/provider-runtime.test.ts b/src/plugins/provider-runtime.test.ts index 86d2db022ea..741a7c2404a 100644 --- a/src/plugins/provider-runtime.test.ts +++ b/src/plugins/provider-runtime.test.ts @@ -1630,6 +1630,38 @@ describe("provider-runtime", () => { ); }); + it("matches provider hooks through a custom provider's native api owner", () => { + const ollamaPlugin: ProviderPlugin = { + id: "ollama", + label: "Ollama", + auth: [], + createStreamFn: vi.fn(() => vi.fn()), + }; + resolvePluginProvidersMock.mockReturnValue([ollamaPlugin]); + + const plugin = resolveProviderRuntimePlugin({ + provider: "ollama-spark", + config: { + models: { + providers: { + "ollama-spark": { + api: "ollama", + baseUrl: "http://127.0.0.1:11434", + models: [], + }, + }, + }, + } as never, + }); + + expect(plugin).toBe(ollamaPlugin); + expect(resolvePluginProvidersMock).toHaveBeenCalledWith( + expect.objectContaining({ + providerRefs: ["ollama-spark", "ollama"], + }), + ); + }); + it("merges compat contributions from owner and foreign provider plugins", () => { resolvePluginProvidersMock.mockImplementation((params) => { const onlyPluginIds = params.onlyPluginIds ?? []; diff --git a/src/plugins/providers.runtime.ts b/src/plugins/providers.runtime.ts index 7b3cfbbb087..d723a1808bb 100644 --- a/src/plugins/providers.runtime.ts +++ b/src/plugins/providers.runtime.ts @@ -8,6 +8,7 @@ import { type PluginLoadOptions, } from "./loader.js"; import { hasExplicitPluginIdScope } from "./plugin-scope.js"; +import { resolveProviderConfigApiOwnerHint } from "./provider-config-owner.js"; import { resolveActivatableProviderOwnerPluginIds, resolveDiscoverableProviderOwnerPluginIds, @@ -49,6 +50,33 @@ function resolveExplicitProviderOwnerPluginIds(params: { if (plannedPluginIds.length > 0) { return plannedPluginIds; } + const apiOwnerHint = resolveProviderConfigApiOwnerHint({ + provider, + config: params.config, + }); + if (apiOwnerHint) { + const apiOwnerPluginIds = resolveManifestActivationPluginIds({ + trigger: { + kind: "provider", + provider: apiOwnerHint, + }, + config: params.config, + workspaceDir: params.workspaceDir, + env: params.env, + }); + if (apiOwnerPluginIds.length > 0) { + return apiOwnerPluginIds; + } + const legacyApiOwnerPluginIds = resolveOwningPluginIdsForProvider({ + provider: apiOwnerHint, + config: params.config, + workspaceDir: params.workspaceDir, + env: params.env, + }); + if (legacyApiOwnerPluginIds?.length) { + return legacyApiOwnerPluginIds; + } + } // Keep legacy provider/CLI-backend ownership working until every owner is // expressible through activation descriptors. return ( diff --git a/src/plugins/providers.test.ts b/src/plugins/providers.test.ts index a34057ba930..ed20ed7cec5 100644 --- a/src/plugins/providers.test.ts +++ b/src/plugins/providers.test.ts @@ -804,6 +804,47 @@ describe("resolvePluginProviders", () => { ); }); + it("activates the owner plugin for custom provider refs that use a native provider api", () => { + setManifestPlugins([ + createManifestProviderPlugin({ + id: "ollama", + providerIds: ["ollama"], + enabledByDefault: true, + }), + ]); + + resolvePluginProviders({ + config: { + models: { + providers: { + "ollama-spark": { + api: "ollama", + baseUrl: "http://127.0.0.1:11434", + models: [], + }, + }, + }, + } as OpenClawConfig, + providerRefs: ["ollama-spark"], + activate: true, + }); + + expect(resolveRuntimePluginRegistryMock).toHaveBeenCalledWith( + expect.objectContaining({ + onlyPluginIds: ["ollama"], + activate: true, + config: expect.objectContaining({ + plugins: expect.objectContaining({ + allow: ["ollama"], + entries: { + ollama: { enabled: true }, + }, + }), + }), + }), + ); + }); + it("uses activation.onProviders to keep explicit provider owners on the runtime path", () => { setManifestPlugins([ createManifestProviderPlugin({ From 30d9e70988607c606310024f7b5eb94605a31057 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 01:02:00 +0100 Subject: [PATCH 115/418] test(gateway): stabilize session cleanup gates --- src/agents/session-write-lock.ts | 24 +++++++++++++++++++++++- test/gateway.multi.e2e.test.ts | 1 + 2 files changed, 24 insertions(+), 1 deletion(-) diff --git a/src/agents/session-write-lock.ts b/src/agents/session-write-lock.ts index 7be469185fe..be8e203425a 100644 --- a/src/agents/session-write-lock.ts +++ b/src/agents/session-write-lock.ts @@ -25,6 +25,10 @@ type HeldLock = { releasePromise?: Promise; }; +type SyncClosableFileHandle = fs.FileHandle & { + [key: symbol]: unknown; +}; + export type SessionLockInspection = { lockPath: string; pid: number | null; @@ -180,7 +184,7 @@ async function releaseHeldLock( */ function releaseAllLocksSync(): void { for (const [sessionFile, held] of HELD_LOCKS) { - void held.handle.close().catch(() => undefined); + closeFileHandleSyncBestEffort(held.handle); try { fsSync.rmSync(held.lockPath, { force: true }); } catch { @@ -193,6 +197,24 @@ function releaseAllLocksSync(): void { } } +function closeFileHandleSyncBestEffort(handle: fs.FileHandle): void { + const syncCloseSymbol = Object.getOwnPropertySymbols(Object.getPrototypeOf(handle)).find( + (symbol) => symbol.description === "kCloseSync", + ); + if (syncCloseSymbol) { + const closeSync = (handle as SyncClosableFileHandle)[syncCloseSymbol]; + if (typeof closeSync === "function") { + try { + closeSync.call(handle); + return; + } catch { + // Fall back to async close below. + } + } + } + void handle.close().catch(() => undefined); +} + async function runLockWatchdogCheck(nowMs = Date.now()): Promise { let released = 0; for (const [sessionFile, held] of HELD_LOCKS.entries()) { diff --git a/test/gateway.multi.e2e.test.ts b/test/gateway.multi.e2e.test.ts index 043d49e2040..a2bc48a41d1 100644 --- a/test/gateway.multi.e2e.test.ts +++ b/test/gateway.multi.e2e.test.ts @@ -116,6 +116,7 @@ describe("gateway multi-instance e2e", () => { events: chatEvents, runId: String(runId), sessionKey, + timeoutMs: 45_000, }); const finalText = extractFirstTextBlock(finalEvent.message); expect(typeof finalText).toBe("string"); From 82b928232e072d06ff2e867f57ebbdaed909c709 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 01:02:35 +0100 Subject: [PATCH 116/418] test(docker): stabilize package update lanes --- scripts/docker/install-sh-e2e/run.sh | 3 ++- scripts/e2e/update-channel-switch-docker.sh | 3 +++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/scripts/docker/install-sh-e2e/run.sh b/scripts/docker/install-sh-e2e/run.sh index d9cbdffb7aa..908e21da806 100755 --- a/scripts/docker/install-sh-e2e/run.sh +++ b/scripts/docker/install-sh-e2e/run.sh @@ -350,7 +350,8 @@ const payloads = []; const texts = payloads.map((x) => String(x?.text ?? "").trim()).filter(Boolean); const match = texts.find((text) => text === expected); -process.stdout.write(match ?? texts[0] ?? ""); +const containingMatch = texts.find((text) => text.includes(expected)); +process.stdout.write(match ?? (containingMatch ? expected : texts[0]) ?? ""); NODE } diff --git a/scripts/e2e/update-channel-switch-docker.sh b/scripts/e2e/update-channel-switch-docker.sh index c9bca848fb8..dc52e3f3526 100755 --- a/scripts/e2e/update-channel-switch-docker.sh +++ b/scripts/e2e/update-channel-switch-docker.sh @@ -41,6 +41,9 @@ git_root="/tmp/openclaw-git" mkdir -p "$git_root" # Build the fake git install from the packed package contents, not the checkout. tar -xzf "$package_tgz" -C "$git_root" --strip-components=1 +# The package-derived fixture can carry patchedDependencies whose targets are +# absent from the trimmed tarball install; that should not block update preflight. +printf "\nallow-unused-patches=true\n" >>"$git_root/.npmrc" ( cd "$git_root" npm install --omit=optional --no-fund --no-audit >/tmp/openclaw-git-install.log 2>&1 From 3b514ad5f379b6f81ecc51ea2f6a44a48e5369ee Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 01:05:20 +0100 Subject: [PATCH 117/418] test(docker): run mounted harnesses with image tsx --- scripts/e2e/crestodian-first-run-docker.sh | 2 +- scripts/e2e/crestodian-planner-docker.sh | 2 +- scripts/e2e/crestodian-rescue-docker.sh | 2 +- scripts/e2e/cron-mcp-cleanup-docker.sh | 4 ++-- scripts/e2e/docker-observability-smoke.sh | 2 +- scripts/e2e/mcp-channels-docker.sh | 4 ++-- scripts/e2e/npm-telegram-live-docker.sh | 2 +- scripts/e2e/openai-image-auth-docker.sh | 2 +- scripts/e2e/pi-bundle-mcp-tools-docker.sh | 2 +- scripts/e2e/session-runtime-context-docker.sh | 2 +- scripts/qa-otel-smoke.ts | 24 +++++++++++-------- 11 files changed, 26 insertions(+), 22 deletions(-) diff --git a/scripts/e2e/crestodian-first-run-docker.sh b/scripts/e2e/crestodian-first-run-docker.sh index f9292c3b17a..4614a680ddb 100644 --- a/scripts/e2e/crestodian-first-run-docker.sh +++ b/scripts/e2e/crestodian-first-run-docker.sh @@ -28,7 +28,7 @@ docker run --rm \ "${DOCKER_E2E_HARNESS_ARGS[@]}" \ "$IMAGE_NAME" \ bash -lc "set -euo pipefail - node --import tsx scripts/e2e/crestodian-first-run-docker-client.ts + tsx scripts/e2e/crestodian-first-run-docker-client.ts " >"$RUN_LOG" 2>&1 status=${PIPESTATUS[0]} set -e diff --git a/scripts/e2e/crestodian-planner-docker.sh b/scripts/e2e/crestodian-planner-docker.sh index cad3272ad48..559ee5161ae 100755 --- a/scripts/e2e/crestodian-planner-docker.sh +++ b/scripts/e2e/crestodian-planner-docker.sh @@ -28,7 +28,7 @@ docker run --rm \ "${DOCKER_E2E_HARNESS_ARGS[@]}" \ "$IMAGE_NAME" \ bash -lc "set -euo pipefail - node --import tsx scripts/e2e/crestodian-planner-docker-client.ts + tsx scripts/e2e/crestodian-planner-docker-client.ts " >"$RUN_LOG" 2>&1 status=${PIPESTATUS[0]} set -e diff --git a/scripts/e2e/crestodian-rescue-docker.sh b/scripts/e2e/crestodian-rescue-docker.sh index 4db23f4be82..efaa230d52e 100755 --- a/scripts/e2e/crestodian-rescue-docker.sh +++ b/scripts/e2e/crestodian-rescue-docker.sh @@ -28,7 +28,7 @@ docker run --rm \ "${DOCKER_E2E_HARNESS_ARGS[@]}" \ "$IMAGE_NAME" \ bash -lc "set -euo pipefail - node --import tsx scripts/e2e/crestodian-rescue-docker-client.ts + tsx scripts/e2e/crestodian-rescue-docker-client.ts " >"$RUN_LOG" 2>&1 status=${PIPESTATUS[0]} set -e diff --git a/scripts/e2e/cron-mcp-cleanup-docker.sh b/scripts/e2e/cron-mcp-cleanup-docker.sh index eca96a8f175..7b579e74df7 100644 --- a/scripts/e2e/cron-mcp-cleanup-docker.sh +++ b/scripts/e2e/cron-mcp-cleanup-docker.sh @@ -48,7 +48,7 @@ docker run --rm \ export OPENCLAW_DOCKER_OPENAI_BASE_URL=\"http://127.0.0.1:\$MOCK_PORT/v1\" node scripts/e2e/mock-openai-server.mjs >/tmp/cron-mcp-cleanup-mock-openai.log 2>&1 & mock_pid=\$! - node --import tsx scripts/e2e/cron-mcp-cleanup-seed.ts >/tmp/cron-mcp-cleanup-seed.log + tsx scripts/e2e/cron-mcp-cleanup-seed.ts >/tmp/cron-mcp-cleanup-seed.log node \"\$entry\" gateway --port $PORT --bind loopback --allow-unconfigured >/tmp/cron-mcp-cleanup-gateway.log 2>&1 & gateway_pid=\$! stop_process() { @@ -101,7 +101,7 @@ docker run --rm \ tail -n 120 /tmp/cron-mcp-cleanup-gateway.log 2>/dev/null || true exit 1 fi - node --import tsx scripts/e2e/cron-mcp-cleanup-docker-client.ts + tsx scripts/e2e/cron-mcp-cleanup-docker-client.ts " >"$CLIENT_LOG" 2>&1 status=${PIPESTATUS[0]} set -e diff --git a/scripts/e2e/docker-observability-smoke.sh b/scripts/e2e/docker-observability-smoke.sh index fce34dd8c2d..caa08d1b5c1 100644 --- a/scripts/e2e/docker-observability-smoke.sh +++ b/scripts/e2e/docker-observability-smoke.sh @@ -49,7 +49,7 @@ for i in $(seq 1 "$loops"); do --output-dir "$iteration_dir/otel" echo "== docker observability loop $i/$loops: prometheus ==" - pnpm openclaw qa suite \ + node openclaw.mjs qa suite \ --provider-mode mock-openai \ --scenario docker-prometheus-smoke \ --concurrency 1 \ diff --git a/scripts/e2e/mcp-channels-docker.sh b/scripts/e2e/mcp-channels-docker.sh index d8d214ef2c2..0553f8b1225 100644 --- a/scripts/e2e/mcp-channels-docker.sh +++ b/scripts/e2e/mcp-channels-docker.sh @@ -53,7 +53,7 @@ docker run --rm \ sleep 0.1 done node -e \"fetch('http://127.0.0.1:' + process.argv[1] + '/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\" \"\$mock_port\" - node --import tsx scripts/e2e/mcp-channels-seed.ts >/tmp/mcp-channels-seed.log + tsx scripts/e2e/mcp-channels-seed.ts >/tmp/mcp-channels-seed.log node \"\$entry\" gateway --port $PORT --bind loopback --allow-unconfigured >/tmp/mcp-channels-gateway.log 2>&1 & gateway_pid=\$! stop_process() { @@ -96,7 +96,7 @@ docker run --rm \ tail -n 120 /tmp/mcp-channels-gateway.log 2>/dev/null || true exit 1 fi - node --import tsx scripts/e2e/mcp-channels-docker-client.ts + tsx scripts/e2e/mcp-channels-docker-client.ts " >"$CLIENT_LOG" 2>&1 status=${PIPESTATUS[0]} set -e diff --git a/scripts/e2e/npm-telegram-live-docker.sh b/scripts/e2e/npm-telegram-live-docker.sh index 9fdb21b9432..5cb4335973c 100755 --- a/scripts/e2e/npm-telegram-live-docker.sh +++ b/scripts/e2e/npm-telegram-live-docker.sh @@ -207,7 +207,7 @@ fi export OPENCLAW_NPM_TELEGRAM_SUT_COMMAND="$(command -v openclaw)" trap - ERR -node --import tsx scripts/e2e/npm-telegram-live-runner.ts +tsx scripts/e2e/npm-telegram-live-runner.ts EOF echo "published npm Telegram live Docker E2E passed ($PACKAGE_SPEC)" diff --git a/scripts/e2e/openai-image-auth-docker.sh b/scripts/e2e/openai-image-auth-docker.sh index 059c78aa60a..f2b22cb1b62 100644 --- a/scripts/e2e/openai-image-auth-docker.sh +++ b/scripts/e2e/openai-image-auth-docker.sh @@ -27,5 +27,5 @@ export OPENCLAW_SKIP_GMAIL_WATCHER=1 export OPENCLAW_SKIP_CRON=1 export OPENCLAW_SKIP_CANVAS_HOST=1 -node --import tsx scripts/e2e/openai-image-auth-docker-client.ts +tsx scripts/e2e/openai-image-auth-docker-client.ts ' diff --git a/scripts/e2e/pi-bundle-mcp-tools-docker.sh b/scripts/e2e/pi-bundle-mcp-tools-docker.sh index 20f9c7ad699..a303a3f7dc5 100755 --- a/scripts/e2e/pi-bundle-mcp-tools-docker.sh +++ b/scripts/e2e/pi-bundle-mcp-tools-docker.sh @@ -27,7 +27,7 @@ docker run --rm \ "${DOCKER_E2E_HARNESS_ARGS[@]}" \ "$IMAGE_NAME" \ bash -lc "set -euo pipefail - node --import tsx scripts/e2e/pi-bundle-mcp-tools-docker-client.ts + tsx scripts/e2e/pi-bundle-mcp-tools-docker-client.ts " >"$RUN_LOG" 2>&1 status=${PIPESTATUS[0]} set -e diff --git a/scripts/e2e/session-runtime-context-docker.sh b/scripts/e2e/session-runtime-context-docker.sh index 27a97814564..fb0e9eec10a 100644 --- a/scripts/e2e/session-runtime-context-docker.sh +++ b/scripts/e2e/session-runtime-context-docker.sh @@ -27,7 +27,7 @@ docker run --rm \ -e COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \ "${DOCKER_E2E_HARNESS_ARGS[@]}" \ "$IMAGE_NAME" \ - bash -lc 'set -euo pipefail; node --import tsx scripts/e2e/session-runtime-context-docker-client.ts' \ + bash -lc 'set -euo pipefail; tsx scripts/e2e/session-runtime-context-docker-client.ts' \ >"$RUN_LOG" 2>&1 status=$? set -e diff --git a/scripts/qa-otel-smoke.ts b/scripts/qa-otel-smoke.ts index 6849c864845..0df2099309d 100644 --- a/scripts/qa-otel-smoke.ts +++ b/scripts/qa-otel-smoke.ts @@ -1,6 +1,7 @@ #!/usr/bin/env -S node --import tsx import { spawn, type ChildProcess } from "node:child_process"; +import { existsSync } from "node:fs"; import { mkdir, writeFile } from "node:fs/promises"; import { createServer, type IncomingMessage, type ServerResponse } from "node:http"; import { createRequire } from "node:module"; @@ -285,15 +286,19 @@ function startLocalOtlpTraceReceiver() { }; } -function spawnPnpm(args: string[], env: NodeJS.ProcessEnv): ChildProcess { - const npmExecPath = process.env.npm_execpath?.trim(); - if (npmExecPath) { - return spawn(process.execPath, [npmExecPath, ...args], { - env, - stdio: ["ignore", "pipe", "pipe"], - }); +function openClawEntryArgs(): string[] { + if ( + existsSync(path.join(process.cwd(), "openclaw.mjs")) && + (existsSync(path.join(process.cwd(), "dist", "entry.js")) || + existsSync(path.join(process.cwd(), "dist", "entry.mjs"))) + ) { + return ["openclaw.mjs"]; } - return spawn(process.platform === "win32" ? "pnpm.cmd" : "pnpm", args, { + return ["scripts/run-node.mjs"]; +} + +function spawnOpenClaw(args: string[], env: NodeJS.ProcessEnv): ChildProcess { + return spawn(process.execPath, [...openClawEntryArgs(), ...args], { env, stdio: ["ignore", "pipe", "pipe"], }); @@ -321,7 +326,6 @@ function buildQaEnv(port: number): NodeJS.ProcessEnv { function buildQaArgs(options: CliOptions): string[] { const args = [ - "openclaw", "qa", "suite", "--provider-mode", @@ -434,7 +438,7 @@ async function main() { let childExitCode = 1; try { - const child = spawnPnpm(buildQaArgs(options), buildQaEnv(port)); + const child = spawnOpenClaw(buildQaArgs(options), buildQaEnv(port)); child.stdout?.on("data", (chunk) => process.stdout.write(chunk)); child.stderr?.on("data", (chunk) => process.stderr.write(chunk)); childExitCode = await waitForChild(child); From b825c8d34b7d1c419f6883fc5f7cfe7939f8197f Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 01:10:28 +0100 Subject: [PATCH 118/418] test: fix full ci suite follow-ups --- src/cli/update-cli.test.ts | 60 +++++++++++++++++++++++------ test/vitest-scoped-config.test.ts | 28 ++++++++++++++ test/vitest/vitest.shared.config.ts | 6 ++- 3 files changed, 82 insertions(+), 12 deletions(-) diff --git a/src/cli/update-cli.test.ts b/src/cli/update-cli.test.ts index e60bbd18a07..700c26e2fea 100644 --- a/src/cli/update-cli.test.ts +++ b/src/cli/update-cli.test.ts @@ -25,6 +25,7 @@ const serviceLoaded = vi.fn(); const prepareRestartScript = vi.fn(); const runRestartScript = vi.fn(); const mockedRunDaemonInstall = vi.fn(); +const serviceReadCommand = vi.fn(); const serviceReadRuntime = vi.fn(); const inspectPortUsage = vi.fn(); const classifyPortListener = vi.fn(); @@ -164,8 +165,27 @@ vi.mock("../plugins/installed-plugin-index-records.js", async (importOriginal) = }); vi.mock("../daemon/service.js", () => ({ + readGatewayServiceState: async () => { + const command = await serviceReadCommand(); + const env = { + ...process.env, + ...(command && typeof command === "object" && "environment" in command + ? (command.environment as NodeJS.ProcessEnv | undefined) + : undefined), + }; + const [loaded, runtime] = await Promise.all([serviceLoaded({ env }), serviceReadRuntime(env)]); + return { + installed: command !== null, + loaded, + running: runtime?.status === "running", + env, + command, + runtime, + }; + }, resolveGatewayService: vi.fn(() => ({ isLoaded: (...args: unknown[]) => serviceLoaded(...args), + readCommand: (...args: unknown[]) => serviceReadCommand(...args), readRuntime: (...args: unknown[]) => serviceReadRuntime(...args), })), })); @@ -451,6 +471,9 @@ describe("update-cli", () => { readPackageVersion.mockResolvedValue("1.0.0"); resolveGlobalManager.mockResolvedValue("npm"); serviceLoaded.mockResolvedValue(false); + serviceReadCommand.mockImplementation(async () => + (await serviceLoaded()) ? { programArguments: ["openclaw", "gateway", "run"] } : null, + ); serviceReadRuntime.mockResolvedValue({ status: "running", pid: 4242, @@ -543,11 +566,12 @@ describe("update-cli", () => { }); it("keeps downgrade post-update work in the current process", async () => { + const downgradedRoot = createCaseDir("openclaw-downgraded-root"); setupUpdatedRootRefresh({ gatewayUpdateImpl: async () => makeOkUpdateResult({ mode: "npm", - root: createCaseDir("openclaw-downgraded-root"), + root: downgradedRoot, before: { version: "2026.4.14" }, after: { version: "2026.4.10" }, }), @@ -574,13 +598,13 @@ describe("update-cli", () => { url: "ws://127.0.0.1:18789", }); - await updateCommand({ yes: true, tag: "2026.4.10" }); + await updateCommand({ yes: true, tag: "2026.4.10", restart: false }); expect(spawn).not.toHaveBeenCalled(); expect(syncPluginsForUpdateChannel).toHaveBeenCalled(); expect(updateNpmInstalledPlugins).toHaveBeenCalled(); - expect(runDaemonInstall).toHaveBeenCalled(); - expect(probeGateway).toHaveBeenCalled(); + expect(runDaemonInstall).not.toHaveBeenCalled(); + expect(probeGateway).not.toHaveBeenCalled(); expect(defaultRuntime.exit).not.toHaveBeenCalledWith(1); }); @@ -1872,25 +1896,32 @@ describe("update-cli", () => { await updateCommand({ yes: true }); - expect(runDaemonInstall).toHaveBeenCalledWith({ - force: true, - json: undefined, - }); + expect(runDaemonInstall).not.toHaveBeenCalled(); expect(runRestartScript).not.toHaveBeenCalled(); expect(defaultRuntime.exit).toHaveBeenCalledWith(1); + expect( + vi + .mocked(defaultRuntime.log) + .mock.calls.map((call) => String(call[0])) + .join("\n"), + ).toContain("updated install entrypoint not found"); }); it("fails a JSON package update when fallback restart leaves the old gateway running", async () => { + const updatedRoot = createCaseDir("openclaw-updated-root"); + const updatedEntrypoint = path.join(updatedRoot, "dist", "entry.js"); setupUpdatedRootRefresh({ + entrypoints: [updatedEntrypoint], gatewayUpdateImpl: async () => makeOkUpdateResult({ mode: "npm", - root: createCaseDir("openclaw-updated-root"), + root: updatedRoot, before: { version: "2026.4.23" }, after: { version: "2026.4.24" }, }), }); prepareRestartScript.mockResolvedValue(null); + serviceLoaded.mockResolvedValue(true); probeGateway.mockResolvedValue({ ok: true, close: null, @@ -1911,7 +1942,11 @@ describe("update-cli", () => { await updateCommand({ yes: true, json: true }); expect(runRestartScript).not.toHaveBeenCalled(); - expect(runDaemonRestart).toHaveBeenCalled(); + expect(runDaemonRestart).not.toHaveBeenCalled(); + expect(runCommandWithTimeout).toHaveBeenCalledWith( + [expect.stringMatching(/node/), updatedEntrypoint, "gateway", "restart", "--json"], + expect.objectContaining({ cwd: updatedRoot, timeoutMs: 60_000 }), + ); expect(probeGateway).toHaveBeenCalledWith(expect.objectContaining({ includeDetails: true })); expect(defaultRuntime.exit).toHaveBeenCalledWith(1); expect(defaultRuntime.writeJson).not.toHaveBeenCalled(); @@ -1927,11 +1962,14 @@ describe("update-cli", () => { }); it("fails a package update when the restarted gateway reports activated plugin load errors", async () => { + const updatedRoot = createCaseDir("openclaw-updated-root"); + const updatedEntrypoint = path.join(updatedRoot, "dist", "entry.js"); setupUpdatedRootRefresh({ + entrypoints: [updatedEntrypoint], gatewayUpdateImpl: async () => makeOkUpdateResult({ mode: "npm", - root: createCaseDir("openclaw-updated-root"), + root: updatedRoot, before: { version: "2026.4.23" }, after: { version: "2026.4.24" }, }), diff --git a/test/vitest-scoped-config.test.ts b/test/vitest-scoped-config.test.ts index d1552272286..9cee32e5ea2 100644 --- a/test/vitest-scoped-config.test.ts +++ b/test/vitest-scoped-config.test.ts @@ -69,6 +69,12 @@ import { createUtilsVitestConfig } from "./vitest/vitest.utils.config.ts"; import { createWizardVitestConfig } from "./vitest/vitest.wizard.config.ts"; const EXTENSIONS_CHANNEL_GLOB = ["extensions", "channel", "**"].join("/"); +const PRIVATE_PLUGIN_SDK_SUBPATHS = [ + "qa-channel", + "qa-channel-protocol", + "qa-lab", + "qa-runtime", +] as const; function bundledExcludePatternCouldMatchFile(pattern: string, file: string): boolean { if (pattern === file) { @@ -82,6 +88,28 @@ function bundledExcludePatternCouldMatchFile(pattern: string, file: string): boo } describe("resolveVitestIsolation", () => { + it("aliases private QA plugin SDK subpaths for source tests only", () => { + expect(sharedVitestConfig.resolve.alias).toEqual( + expect.arrayContaining( + PRIVATE_PLUGIN_SDK_SUBPATHS.map((subpath) => + expect.objectContaining({ + find: `openclaw/plugin-sdk/${subpath}`, + replacement: path.join(process.cwd(), "src", "plugin-sdk", `${subpath}.ts`), + }), + ), + ), + ); + expect(sharedVitestConfig.resolve.alias).not.toEqual( + expect.arrayContaining( + PRIVATE_PLUGIN_SDK_SUBPATHS.map((subpath) => + expect.objectContaining({ + find: `@openclaw/plugin-sdk/${subpath}`, + }), + ), + ), + ); + }); + it("defaults shared scoped configs to the non-isolated runner", () => { expect(resolveVitestIsolation({})).toBe(false); }); diff --git a/test/vitest/vitest.shared.config.ts b/test/vitest/vitest.shared.config.ts index da298c03a3d..e186781ccde 100644 --- a/test/vitest/vitest.shared.config.ts +++ b/test/vitest/vitest.shared.config.ts @@ -1,6 +1,7 @@ import path from "node:path"; import { fileURLToPath } from "node:url"; import { pluginSdkSubpaths } from "../../scripts/lib/plugin-sdk-entries.mjs"; +import privateLocalOnlyPluginSdkSubpaths from "../../scripts/lib/plugin-sdk-private-local-only-subpaths.json" with { type: "json" }; import { detectVitestHostInfo as detectVitestHostInfoImpl, isCiLikeEnv, @@ -113,6 +114,9 @@ const workerConfig = resolveSharedVitestWorkerConfig({ isWindows, localScheduling, }); +const sourcePluginSdkSubpaths = [ + ...new Set([...pluginSdkSubpaths, ...privateLocalOnlyPluginSdkSubpaths]), +].toSorted((left, right) => left.localeCompare(right)); if (!isCI && localScheduling.throttledBySystem && shouldPrintVitestThrottle(process.env)) { console.error( @@ -131,7 +135,7 @@ export const sharedVitestConfig = { find: "openclaw/extension-api", replacement: path.join(repoRoot, "src", "extensionAPI.ts"), }, - ...pluginSdkSubpaths.map((subpath) => ({ + ...sourcePluginSdkSubpaths.map((subpath) => ({ find: `openclaw/plugin-sdk/${subpath}`, replacement: path.join(repoRoot, "src", "plugin-sdk", `${subpath}.ts`), })), From 0f672dcc738e820ce1ea1037ac5196db9d22a1a4 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 01:10:23 +0100 Subject: [PATCH 119/418] fix(ollama): align web search endpoint routing --- CHANGELOG.md | 2 +- docs/tools/ollama-search.md | 6 +- .../ollama/src/web-search-provider.test.ts | 44 ++++++++++-- extensions/ollama/src/web-search-provider.ts | 70 +++++++++++++------ 4 files changed, 92 insertions(+), 30 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6081dc1759a..fa3b26a87e8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -21,7 +21,7 @@ Docs: https://docs.openclaw.ai - Providers/Ollama: expose native Ollama thinking effort levels so `/think max` is accepted for reasoning-capable Ollama models and maps to Ollama's highest supported `think` effort. Fixes #71584. Thanks @g0st1n. - Providers/Ollama: strip the active custom Ollama provider prefix before native chat and embedding requests, so custom provider ids like `ollama-spark/qwen3:32b` reach Ollama as the real model name. Fixes #72353. Thanks @maximus-dss and @hclsys. - Providers/Ollama: move memory embeddings to Ollama's current `/api/embed` endpoint with batched `input` requests while preserving vector normalization and custom provider auth/header overrides. Fixes #39983. Thanks @sskkcc and @LiudengZhang. -- Providers/Ollama: try both current and legacy Ollama web-search endpoints and use `OLLAMA_API_KEY` only for the `ollama.com` cloud fallback, keeping local signed-in hosts keyless. Fixes #69132. Thanks @yoon1012 and @hyspacex. +- Providers/Ollama: route local web search through Ollama's signed `/api/experimental/web_search` daemon proxy, use hosted `/api/web_search` directly for `ollama.com`, and keep `OLLAMA_API_KEY` scoped to cloud fallback auth. Fixes #69132. Thanks @yoon1012 and @hyspacex. - Agents/Ollama: apply provider-owned replay turn normalization to native Ollama chat so Cloud models no longer reject non-alternating replay history in agent/Gateway runs. Fixes #71697. Thanks @ismael-81. - Agents/Ollama: validate explicit `--thinking max` against catalog-discovered Ollama reasoning metadata so local agent runs accept the same native thinking levels shown in the model catalog. Fixes #71584. Thanks @g0st1n. - Docker/QA: add observability coverage to the normal Docker aggregate so QA-lab OTEL and Prometheus diagnostics run inside Docker. Thanks @vincentkoc. diff --git a/docs/tools/ollama-search.md b/docs/tools/ollama-search.md index 073cb39d7c1..280748e6637 100644 --- a/docs/tools/ollama-search.md +++ b/docs/tools/ollama-search.md @@ -92,8 +92,10 @@ for requests to that configured host. it does not block selection. - Runtime auto-detect can fall back to Ollama Web Search when no higher-priority credentialed provider is configured. -- The provider tries Ollama's `/api/web_search` endpoint first, then the legacy - `/api/experimental/web_search` endpoint for older hosts. +- Local Ollama daemon hosts use the local proxy endpoint + `/api/experimental/web_search`, which signs and forwards to Ollama Cloud. +- `https://ollama.com` hosts use the public hosted endpoint + `/api/web_search` directly with bearer API-key auth. ## Related diff --git a/extensions/ollama/src/web-search-provider.test.ts b/extensions/ollama/src/web-search-provider.test.ts index 4d70d28f51c..2b82bc49752 100644 --- a/extensions/ollama/src/web-search-provider.test.ts +++ b/extensions/ollama/src/web-search-provider.test.ts @@ -125,7 +125,7 @@ describe("ollama web search provider", () => { ).toBe("https://ollama.com"); }); - it("maps generic search args into the Ollama search endpoint", async () => { + it("maps generic search args into the local Ollama proxy endpoint", async () => { const release = vi.fn(async () => {}); fetchWithSsrFGuardMock.mockResolvedValue({ response: new Response( @@ -157,7 +157,7 @@ describe("ollama web search provider", () => { expect(fetchWithSsrFGuardMock).toHaveBeenCalledWith( expect.objectContaining({ - url: "http://ollama.local:11434/api/web_search", + url: "http://ollama.local:11434/api/experimental/web_search", auditContext: "ollama-web-search.search", }), ); @@ -184,7 +184,7 @@ describe("ollama web search provider", () => { expect(release).toHaveBeenCalledTimes(1); }); - it("falls back to the legacy Ollama web search endpoint when /api/web_search is missing", async () => { + it("tries the future local direct endpoint when the local proxy endpoint is missing", async () => { fetchWithSsrFGuardMock .mockResolvedValueOnce({ response: new Response("not found", { status: 404 }), @@ -211,11 +211,42 @@ describe("ollama web search provider", () => { }); expect(fetchWithSsrFGuardMock.mock.calls.map((call) => call[0].url)).toEqual([ - "http://ollama.local:11434/api/web_search", "http://ollama.local:11434/api/experimental/web_search", + "http://ollama.local:11434/api/web_search", ]); }); + it("uses only the hosted endpoint for Ollama Cloud base URLs", async () => { + fetchWithSsrFGuardMock.mockResolvedValueOnce({ + response: new Response( + JSON.stringify({ + results: [{ title: "Cloud", url: "https://example.com", content: "result" }], + }), + { + status: 200, + headers: { "Content-Type": "application/json" }, + }, + ), + release: vi.fn(async () => {}), + }); + + await expect( + runOllamaWebSearch({ + config: createOllamaConfig({ + baseUrl: "https://ollama.com", + apiKey: "cloud-config-secret", + }), + query: "openclaw", + }), + ).resolves.toMatchObject({ count: 1 }); + + expect(fetchWithSsrFGuardMock.mock.calls).toHaveLength(1); + expect(fetchWithSsrFGuardMock.mock.calls[0]?.[0].url).toBe("https://ollama.com/api/web_search"); + expect(fetchWithSsrFGuardMock.mock.calls[0]?.[0].init?.headers).toMatchObject({ + Authorization: "Bearer cloud-config-secret", + }); + }); + it("uses an env Ollama key only for the cloud fallback from a local host", async () => { const original = process.env.OLLAMA_API_KEY; try { @@ -256,6 +287,11 @@ describe("ollama web search provider", () => { | undefined; expect(firstHeaders?.Authorization).toBeUndefined(); expect(cloudHeaders?.Authorization).toBe("Bearer cloud-secret"); + expect(fetchWithSsrFGuardMock.mock.calls.map((call) => call[0].url)).toEqual([ + "http://ollama.local:11434/api/experimental/web_search", + "http://ollama.local:11434/api/web_search", + "https://ollama.com/api/web_search", + ]); expect(fetchWithSsrFGuardMock.mock.calls[2]?.[0].url).toBe( "https://ollama.com/api/web_search", ); diff --git a/extensions/ollama/src/web-search-provider.ts b/extensions/ollama/src/web-search-provider.ts index c4ed075ff2f..79399ca8b21 100644 --- a/extensions/ollama/src/web-search-provider.ts +++ b/extensions/ollama/src/web-search-provider.ts @@ -41,8 +41,8 @@ const OLLAMA_WEB_SEARCH_SCHEMA = Type.Object( { additionalProperties: false }, ); -const OLLAMA_WEB_SEARCH_PATH = "/api/web_search"; -const OLLAMA_LEGACY_WEB_SEARCH_PATH = "/api/experimental/web_search"; +const OLLAMA_HOSTED_WEB_SEARCH_PATH = "/api/web_search"; +const OLLAMA_LOCAL_WEB_SEARCH_PROXY_PATH = "/api/experimental/web_search"; const OLLAMA_CLOUD_BASE_URL = "https://ollama.com"; const DEFAULT_OLLAMA_WEB_SEARCH_COUNT = 5; const DEFAULT_OLLAMA_WEB_SEARCH_TIMEOUT_MS = 15_000; @@ -58,6 +58,12 @@ type OllamaWebSearchResponse = { results?: OllamaWebSearchResult[]; }; +type OllamaWebSearchAttempt = { + baseUrl: string; + path: string; + apiKey?: string; +}; + function isOllamaCloudBaseUrl(baseUrl: string): boolean { try { const parsed = new URL(baseUrl); @@ -111,6 +117,43 @@ function normalizeOllamaWebSearchResult( }; } +function buildOllamaWebSearchAttempts(params: { + baseUrl: string; + configuredApiKey?: string; + envApiKey?: string; +}): OllamaWebSearchAttempt[] { + if (isOllamaCloudBaseUrl(params.baseUrl)) { + return [ + { + baseUrl: params.baseUrl, + path: OLLAMA_HOSTED_WEB_SEARCH_PATH, + apiKey: params.configuredApiKey ?? params.envApiKey, + }, + ]; + } + + const attempts: OllamaWebSearchAttempt[] = [ + { + baseUrl: params.baseUrl, + path: OLLAMA_LOCAL_WEB_SEARCH_PROXY_PATH, + apiKey: params.configuredApiKey, + }, + { + baseUrl: params.baseUrl, + path: OLLAMA_HOSTED_WEB_SEARCH_PATH, + apiKey: params.configuredApiKey, + }, + ]; + if (params.envApiKey) { + attempts.push({ + baseUrl: OLLAMA_CLOUD_BASE_URL, + path: OLLAMA_HOSTED_WEB_SEARCH_PATH, + apiKey: params.envApiKey, + }); + } + return attempts; +} + export async function runOllamaWebSearch(params: { config?: OpenClawConfig; query: string; @@ -127,27 +170,7 @@ export async function runOllamaWebSearch(params: { const count = resolveSearchCount(params.count, DEFAULT_OLLAMA_WEB_SEARCH_COUNT); const startedAt = Date.now(); const body = JSON.stringify({ query, max_results: count }); - const attempts = [ - { - baseUrl, - path: OLLAMA_WEB_SEARCH_PATH, - apiKey: isOllamaCloudBaseUrl(baseUrl) ? (configuredApiKey ?? envApiKey) : configuredApiKey, - }, - { - baseUrl, - path: OLLAMA_LEGACY_WEB_SEARCH_PATH, - apiKey: isOllamaCloudBaseUrl(baseUrl) ? (configuredApiKey ?? envApiKey) : configuredApiKey, - }, - ...(!isOllamaCloudBaseUrl(baseUrl) && envApiKey - ? [ - { - baseUrl: OLLAMA_CLOUD_BASE_URL, - path: OLLAMA_WEB_SEARCH_PATH, - apiKey: envApiKey, - }, - ] - : []), - ]; + const attempts = buildOllamaWebSearchAttempts({ baseUrl, configuredApiKey, envApiKey }); let payload: OllamaWebSearchResponse | undefined; let lastError: Error | undefined; @@ -305,6 +328,7 @@ export function createOllamaWebSearchProvider(): WebSearchProviderPlugin { } export const __testing = { + buildOllamaWebSearchAttempts, normalizeOllamaWebSearchResult, resolveConfiguredOllamaWebSearchApiKey, resolveEnvOllamaWebSearchApiKey, From 7cecbe1002c017a12e2333bcf3773282289d0cb6 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 17:15:39 -0700 Subject: [PATCH 120/418] test(plugins): guard cold status snapshots Add a reusable cold plugin fixture and status snapshot guard proving read-only plugin metadata paths do not import plugin runtime entries. --- .../plugin-control-plane-cold-imports.test.ts | 143 ++++-------------- src/plugins/status.registry-snapshot.test.ts | 91 ++++++----- .../test-helpers/cold-plugin-fixtures.ts | 128 ++++++++++++++++ 3 files changed, 213 insertions(+), 149 deletions(-) create mode 100644 src/plugins/test-helpers/cold-plugin-fixtures.ts diff --git a/src/commands/plugin-control-plane-cold-imports.test.ts b/src/commands/plugin-control-plane-cold-imports.test.ts index 8572af6130d..3f52603d548 100644 --- a/src/commands/plugin-control-plane-cold-imports.test.ts +++ b/src/commands/plugin-control-plane-cold-imports.test.ts @@ -1,11 +1,14 @@ -import fs from "node:fs"; -import os from "node:os"; -import path from "node:path"; import { afterEach, describe, expect, it } from "vitest"; -import type { OpenClawConfig } from "../config/types.openclaw.js"; import { clearPluginDiscoveryCache } from "../plugins/discovery.js"; import { clearPluginManifestRegistryCache } from "../plugins/manifest-registry.js"; import { refreshPluginRegistry } from "../plugins/plugin-registry.js"; +import { + createColdPluginConfig, + createColdPluginFixture, + createColdPluginHermeticEnv, + isColdPluginRuntimeLoaded, +} from "../plugins/test-helpers/cold-plugin-fixtures.js"; +import { cleanupTrackedTempDirs, makeTrackedTempDir } from "../plugins/test-helpers/fs-fixtures.js"; import { buildAuthChoiceOptions, formatAuthChoiceChoicesForCli } from "./auth-choice-options.js"; import { listManifestInstalledChannelIds } from "./channel-setup/discovery.js"; import { resolveProviderCatalogPluginIdsForFilter } from "./models/list.provider-catalog.js"; @@ -13,111 +16,21 @@ import { resolveProviderCatalogPluginIdsForFilter } from "./models/list.provider const tempDirs: string[] = []; function makeTempDir() { - const dir = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-command-cold-imports-")); - tempDirs.push(dir); - return dir; -} - -function hermeticEnv( - homeDir: string, - options: { disablePersistedRegistry?: boolean } = {}, -): NodeJS.ProcessEnv { - return { - ...process.env, - OPENCLAW_HOME: path.join(homeDir, "home"), - OPENCLAW_BUNDLED_PLUGINS_DIR: undefined, - OPENCLAW_DISABLE_PERSISTED_PLUGIN_REGISTRY: - options.disablePersistedRegistry === false ? undefined : "1", - OPENCLAW_DISABLE_PLUGIN_DISCOVERY_CACHE: "1", - OPENCLAW_DISABLE_PLUGIN_MANIFEST_CACHE: "1", - OPENCLAW_VERSION: "2026.4.25", - VITEST: "true", - }; -} - -function createColdControlPlanePlugin() { - const rootDir = makeTempDir(); - const runtimeMarker = path.join(rootDir, "runtime-loaded.txt"); - fs.writeFileSync( - path.join(rootDir, "package.json"), - JSON.stringify( - { - name: "@example/openclaw-cold-control-plane", - version: "1.0.0", - openclaw: { extensions: ["./index.cjs"] }, - }, - null, - 2, - ), - "utf8", - ); - fs.writeFileSync( - path.join(rootDir, "openclaw.plugin.json"), - JSON.stringify( - { - id: "cold-control-plane", - name: "Cold Control Plane", - configSchema: { type: "object" }, - providers: ["cold-model-provider"], - channels: ["cold-channel"], - channelConfigs: { - "cold-channel": { - schema: { type: "object" }, - }, - }, - providerAuthChoices: [ - { - provider: "cold-model-provider", - method: "api-key", - choiceId: "cold-provider-api-key", - choiceLabel: "Cold Provider API key", - groupId: "cold-model-provider", - groupLabel: "Cold Provider", - optionKey: "coldProviderApiKey", - cliFlag: "--cold-provider-api-key", - cliOption: "--cold-provider-api-key ", - onboardingScopes: ["text-inference"], - }, - ], - }, - null, - 2, - ), - "utf8", - ); - fs.writeFileSync( - path.join(rootDir, "index.cjs"), - `require("node:fs").writeFileSync(${JSON.stringify(runtimeMarker)}, "loaded", "utf8");\nthrow new Error("runtime entry should not load for command control-plane discovery");\n`, - "utf8", - ); - return { rootDir, runtimeMarker }; -} - -function createColdConfig(pluginDir: string): OpenClawConfig { - return { - plugins: { - load: { paths: [pluginDir] }, - entries: { - "cold-control-plane": { enabled: true }, - }, - }, - }; + return makeTrackedTempDir("openclaw-command-cold-imports", tempDirs); } afterEach(() => { clearPluginDiscoveryCache(); clearPluginManifestRegistryCache(); - for (const dir of tempDirs.splice(0)) { - fs.rmSync(dir, { recursive: true, force: true }); - } + cleanupTrackedTempDirs(tempDirs); }); describe("command control-plane plugin discovery", () => { it("resolves channel setup metadata without importing plugin runtime", () => { - const plugin = createColdControlPlanePlugin(); + const plugin = createColdPluginFixture({ rootDir: makeTempDir() }); const workspaceDir = makeTempDir(); - const cfg = createColdConfig(plugin.rootDir); - const env = hermeticEnv(workspaceDir); + const cfg = createColdPluginConfig(plugin.rootDir, plugin.pluginId); + const env = createColdPluginHermeticEnv(workspaceDir); expect( listManifestInstalledChannelIds({ @@ -125,15 +38,15 @@ describe("command control-plane plugin discovery", () => { workspaceDir, env, }), - ).toContain("cold-channel"); - expect(fs.existsSync(plugin.runtimeMarker)).toBe(false); + ).toContain(plugin.channelId); + expect(isColdPluginRuntimeLoaded(plugin)).toBe(false); }); it("builds onboarding auth choices from manifest metadata without importing plugin runtime", () => { - const plugin = createColdControlPlanePlugin(); + const plugin = createColdPluginFixture({ rootDir: makeTempDir() }); const workspaceDir = makeTempDir(); - const cfg = createColdConfig(plugin.rootDir); - const env = hermeticEnv(workspaceDir); + const cfg = createColdPluginConfig(plugin.rootDir, plugin.pluginId); + const env = createColdPluginHermeticEnv(workspaceDir); expect( buildAuthChoiceOptions({ @@ -145,9 +58,9 @@ describe("command control-plane plugin discovery", () => { }), ).toContainEqual( expect.objectContaining({ - value: "cold-provider-api-key", + value: plugin.authChoiceId, label: "Cold Provider API key", - groupId: "cold-model-provider", + groupId: plugin.providerId, }), ); expect( @@ -156,15 +69,15 @@ describe("command control-plane plugin discovery", () => { workspaceDir, env, }).split("|"), - ).toContain("cold-provider-api-key"); - expect(fs.existsSync(plugin.runtimeMarker)).toBe(false); + ).toContain(plugin.authChoiceId); + expect(isColdPluginRuntimeLoaded(plugin)).toBe(false); }); it("resolves models-list provider ownership without importing plugin runtime", async () => { - const plugin = createColdControlPlanePlugin(); + const plugin = createColdPluginFixture({ rootDir: makeTempDir() }); const workspaceDir = makeTempDir(); - const cfg = createColdConfig(plugin.rootDir); - const env = hermeticEnv(workspaceDir, { disablePersistedRegistry: false }); + const cfg = createColdPluginConfig(plugin.rootDir, plugin.pluginId); + const env = createColdPluginHermeticEnv(workspaceDir, { disablePersistedRegistry: false }); await refreshPluginRegistry({ config: cfg, @@ -172,15 +85,15 @@ describe("command control-plane plugin discovery", () => { env, reason: "manual", }); - expect(fs.existsSync(plugin.runtimeMarker)).toBe(false); + expect(isColdPluginRuntimeLoaded(plugin)).toBe(false); await expect( resolveProviderCatalogPluginIdsForFilter({ cfg, env, - providerFilter: "cold-model-provider", + providerFilter: plugin.providerId, }), - ).resolves.toEqual(["cold-control-plane"]); - expect(fs.existsSync(plugin.runtimeMarker)).toBe(false); + ).resolves.toEqual([plugin.pluginId]); + expect(isColdPluginRuntimeLoaded(plugin)).toBe(false); }); }); diff --git a/src/plugins/status.registry-snapshot.test.ts b/src/plugins/status.registry-snapshot.test.ts index 245e0fd9c8f..474fb27a69b 100644 --- a/src/plugins/status.registry-snapshot.test.ts +++ b/src/plugins/status.registry-snapshot.test.ts @@ -1,43 +1,36 @@ import fs from "node:fs"; -import os from "node:os"; -import path from "node:path"; import { afterEach, describe, expect, it } from "vitest"; import { clearPluginDiscoveryCache } from "./discovery.js"; import { clearPluginManifestRegistryCache } from "./manifest-registry.js"; -import { buildPluginRegistrySnapshotReport } from "./status.js"; +import { buildPluginRegistrySnapshotReport, buildPluginSnapshotReport } from "./status.js"; +import { + createColdPluginConfig, + createColdPluginFixture, + createColdPluginHermeticEnv, + isColdPluginRuntimeLoaded, +} from "./test-helpers/cold-plugin-fixtures.js"; +import { cleanupTrackedTempDirs, makeTrackedTempDir } from "./test-helpers/fs-fixtures.js"; const tempDirs: string[] = []; function makeTempDir() { - const dir = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-plugin-status-")); - tempDirs.push(dir); - return dir; + return makeTrackedTempDir("openclaw-plugin-status", tempDirs); } afterEach(() => { clearPluginDiscoveryCache(); clearPluginManifestRegistryCache(); - for (const dir of tempDirs.splice(0)) { - fs.rmSync(dir, { recursive: true, force: true }); - } + cleanupTrackedTempDirs(tempDirs); }); describe("buildPluginRegistrySnapshotReport", () => { it("reconstructs list metadata from indexed manifests without importing plugin runtime", () => { - const pluginDir = makeTempDir(); - const runtimeMarker = path.join(pluginDir, "runtime-loaded.txt"); - fs.writeFileSync( - path.join(pluginDir, "package.json"), - JSON.stringify({ - name: "@example/openclaw-indexed-demo", - version: "9.8.7", - openclaw: { extensions: ["./index.cjs"] }, - }), - "utf-8", - ); - fs.writeFileSync( - path.join(pluginDir, "openclaw.plugin.json"), - JSON.stringify({ + const fixture = createColdPluginFixture({ + rootDir: makeTempDir(), + pluginId: "indexed-demo", + packageName: "@example/openclaw-indexed-demo", + packageVersion: "9.8.7", + manifest: { id: "indexed-demo", name: "Indexed Demo", description: "Manifest-backed list metadata", @@ -49,19 +42,13 @@ describe("buildPluginRegistrySnapshotReport", () => { additionalProperties: false, properties: {}, }, - }), - "utf-8", - ); - fs.writeFileSync( - path.join(pluginDir, "index.cjs"), - `require("node:fs").writeFileSync(${JSON.stringify(runtimeMarker)}, "loaded", "utf-8");\nmodule.exports = { id: "indexed-demo", register() {} };\n`, - "utf-8", - ); + }, + }); const report = buildPluginRegistrySnapshotReport({ config: { plugins: { - load: { paths: [pluginDir] }, + load: { paths: [fixture.rootDir] }, }, }, }); @@ -75,9 +62,45 @@ describe("buildPluginRegistrySnapshotReport", () => { format: "openclaw", providerIds: ["indexed-provider"], commands: ["indexed-demo"], - source: fs.realpathSync(path.join(pluginDir, "index.cjs")), + source: fs.realpathSync(fixture.runtimeSource), status: "loaded", }); - expect(fs.existsSync(runtimeMarker)).toBe(false); + expect(isColdPluginRuntimeLoaded(fixture)).toBe(false); + }); + + it("builds read-only plugin status snapshots without importing plugin runtime", () => { + const fixture = createColdPluginFixture({ + rootDir: makeTempDir(), + pluginId: "snapshot-demo", + manifest: { + id: "snapshot-demo", + name: "Snapshot Demo", + description: "Status metadata", + providers: ["snapshot-provider"], + }, + providerId: "snapshot-provider", + runtimeMessage: "runtime entry should not load for plugin status snapshot report", + }); + const workspaceDir = makeTempDir(); + const report = buildPluginSnapshotReport({ + config: createColdPluginConfig(fixture.rootDir, fixture.pluginId), + workspaceDir, + env: createColdPluginHermeticEnv(workspaceDir, { + bundledPluginsDir: makeTempDir(), + }), + }); + + expect(report.plugins).toEqual( + expect.arrayContaining([ + expect.objectContaining({ + id: "snapshot-demo", + name: "Snapshot Demo", + source: fs.realpathSync(fixture.runtimeSource), + status: "loaded", + imported: false, + }), + ]), + ); + expect(isColdPluginRuntimeLoaded(fixture)).toBe(false); }); }); diff --git a/src/plugins/test-helpers/cold-plugin-fixtures.ts b/src/plugins/test-helpers/cold-plugin-fixtures.ts new file mode 100644 index 00000000000..3fa98d5fc3d --- /dev/null +++ b/src/plugins/test-helpers/cold-plugin-fixtures.ts @@ -0,0 +1,128 @@ +import fs from "node:fs"; +import path from "node:path"; +import type { OpenClawConfig } from "../../config/types.openclaw.js"; + +export type ColdPluginFixture = { + authChoiceId: string; + channelId: string; + pluginId: string; + providerId: string; + rootDir: string; + runtimeMarker: string; + runtimeSource: string; +}; + +type ColdPluginFixtureOptions = { + rootDir: string; + pluginId?: string; + packageName?: string; + packageVersion?: string; + providerId?: string; + channelId?: string; + authChoiceId?: string; + runtimeMessage?: string; + manifest?: Record; +}; + +export function createColdPluginFixture(options: ColdPluginFixtureOptions): ColdPluginFixture { + const pluginId = options.pluginId ?? "cold-control-plane"; + const providerId = options.providerId ?? "cold-model-provider"; + const channelId = options.channelId ?? "cold-channel"; + const authChoiceId = options.authChoiceId ?? "cold-provider-api-key"; + const runtimeSource = path.join(options.rootDir, "index.cjs"); + const runtimeMarker = path.join(options.rootDir, "runtime-loaded.txt"); + fs.writeFileSync( + path.join(options.rootDir, "package.json"), + JSON.stringify( + { + name: options.packageName ?? "@example/openclaw-cold-control-plane", + version: options.packageVersion ?? "1.0.0", + openclaw: { extensions: ["./index.cjs"] }, + }, + null, + 2, + ), + "utf8", + ); + fs.writeFileSync( + path.join(options.rootDir, "openclaw.plugin.json"), + JSON.stringify( + { + id: pluginId, + name: "Cold Control Plane", + configSchema: { type: "object" }, + providers: [providerId], + channels: [channelId], + channelConfigs: { + [channelId]: { + schema: { type: "object" }, + }, + }, + providerAuthChoices: [ + { + provider: providerId, + method: "api-key", + choiceId: authChoiceId, + choiceLabel: "Cold Provider API key", + groupId: providerId, + groupLabel: "Cold Provider", + optionKey: "coldProviderApiKey", + cliFlag: "--cold-provider-api-key", + cliOption: "--cold-provider-api-key ", + onboardingScopes: ["text-inference"], + }, + ], + ...options.manifest, + }, + null, + 2, + ), + "utf8", + ); + fs.writeFileSync( + runtimeSource, + `require("node:fs").writeFileSync(${JSON.stringify(runtimeMarker)}, "loaded", "utf8");\nthrow new Error(${JSON.stringify(options.runtimeMessage ?? "runtime entry should not load for cold plugin metadata discovery")});\n`, + "utf8", + ); + return { + authChoiceId, + channelId, + pluginId, + providerId, + rootDir: options.rootDir, + runtimeMarker, + runtimeSource, + }; +} + +export function createColdPluginConfig(pluginDir: string, pluginId: string): OpenClawConfig { + return { + plugins: { + load: { paths: [pluginDir] }, + entries: { + [pluginId]: { enabled: true }, + }, + }, + }; +} + +export function createColdPluginHermeticEnv( + homeDir: string, + options: { bundledPluginsDir?: string; disablePersistedRegistry?: boolean } = {}, +): NodeJS.ProcessEnv { + return { + ...process.env, + OPENCLAW_HOME: path.join(homeDir, "home"), + OPENCLAW_BUNDLED_PLUGINS_DIR: options.bundledPluginsDir, + OPENCLAW_DISABLE_PERSISTED_PLUGIN_REGISTRY: + options.disablePersistedRegistry === false ? undefined : "1", + OPENCLAW_DISABLE_PLUGIN_DISCOVERY_CACHE: "1", + OPENCLAW_DISABLE_PLUGIN_MANIFEST_CACHE: "1", + OPENCLAW_VERSION: "2026.4.25", + VITEST: "true", + }; +} + +export function isColdPluginRuntimeLoaded(fixture: Pick) { + return fs.existsSync(fixture.runtimeMarker); +} From 6fed7872973c5f76de8053266c1ab1b90b93070f Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 01:16:13 +0100 Subject: [PATCH 121/418] test: align release boundary expectations --- test/openclaw-npm-release-check.test.ts | 2 -- test/release-check.test.ts | 2 -- test/scripts/test-install-sh-docker.test.ts | 4 +++- 3 files changed, 3 insertions(+), 5 deletions(-) diff --git a/test/openclaw-npm-release-check.test.ts b/test/openclaw-npm-release-check.test.ts index 0016959c9d3..6a1721bed76 100644 --- a/test/openclaw-npm-release-check.test.ts +++ b/test/openclaw-npm-release-check.test.ts @@ -339,7 +339,6 @@ describe("collectForbiddenPackedPathErrors", () => { "dist/plugin-sdk/qa-channel-protocol.d.ts", "dist/qa-runtime-B9LDtssJ.js", "docs/channels/qa-channel.md", - "docs/refactor/qa.md", "qa/scenarios/index.md", ]), ).toEqual([ @@ -352,7 +351,6 @@ describe("collectForbiddenPackedPathErrors", () => { 'npm package must not include private QA lab artifact "dist/extensions/qa-lab/runtime-api.js".', 'npm package must not include private QA lab artifact "dist/extensions/qa-lab/src/cli.js".', 'npm package must not include private QA lab type artifact "dist/plugin-sdk/extensions/qa-lab/cli.d.ts".', - 'npm package must not include private QA refactor docs "docs/refactor/qa.md".', 'npm package must not include private QA runtime chunk "dist/qa-runtime-B9LDtssJ.js".', 'npm package must not include private QA suite artifact "qa/scenarios/index.md".', ]); diff --git a/test/release-check.test.ts b/test/release-check.test.ts index c8347f5542f..a92d5449646 100644 --- a/test/release-check.test.ts +++ b/test/release-check.test.ts @@ -459,7 +459,6 @@ describe("collectForbiddenPackPaths", () => { "dist/plugin-sdk/qa-runtime.js", "dist/qa-runtime-B9LDtssJ.js", "docs/channels/qa-channel.md", - "docs/refactor/qa.md", "qa/scenarios/index.md", ]), ).toEqual([ @@ -473,7 +472,6 @@ describe("collectForbiddenPackPaths", () => { "dist/plugin-sdk/qa-runtime.js", "dist/qa-runtime-B9LDtssJ.js", "docs/channels/qa-channel.md", - "docs/refactor/qa.md", "qa/scenarios/index.md", ]); }); diff --git a/test/scripts/test-install-sh-docker.test.ts b/test/scripts/test-install-sh-docker.test.ts index 909a3e9b0db..ae18f09b4d2 100644 --- a/test/scripts/test-install-sh-docker.test.ts +++ b/test/scripts/test-install-sh-docker.test.ts @@ -46,7 +46,9 @@ describe("test-install-sh-docker", () => { ); expect(runner).toContain("resolve_update_baseline_version"); expect(runner).toContain('quiet_npm view "${PACKAGE_NAME}@${UPDATE_BASELINE_VERSION}" version'); - expect(workflow).toContain("OPENCLAW_INSTALL_SMOKE_UPDATE_BASELINE: latest"); + expect(workflow).toContain( + "OPENCLAW_INSTALL_SMOKE_UPDATE_BASELINE: ${{ inputs.update_baseline_version || 'latest' }}", + ); }); it("can reuse dist from the already-built root Docker smoke image", () => { From d7c173b6945687985a60842e500aeabec522f060 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 17:18:26 -0700 Subject: [PATCH 122/418] fix(gateway): harden macOS launchd service startup --- CHANGELOG.md | 1 + src/commands/daemon-install-helpers.test.ts | 41 ++++++++++++++++++++- src/commands/daemon-install-helpers.ts | 26 ++++++++++++- src/daemon/launchd.test.ts | 16 +++++++- src/daemon/launchd.ts | 21 +++++++++-- src/daemon/runtime-format.test.ts | 10 +++++ src/daemon/runtime-format.ts | 16 +++++++- src/daemon/service-env.test.ts | 29 +++++++++++++-- src/daemon/service-env.ts | 18 ++++++++- 9 files changed, 164 insertions(+), 14 deletions(-) create mode 100644 src/daemon/runtime-format.test.ts diff --git a/CHANGELOG.md b/CHANGELOG.md index fa3b26a87e8..3e7ce714884 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,7 @@ Docs: https://docs.openclaw.ai ### Fixes +- macOS Gateway: write launchd services with a state-dir `WorkingDirectory`, use a durable state-dir temp path instead of freezing macOS session `TMPDIR`, create that temp directory before bootstrap, and label abort-shaped launchd exits as `SIGABRT/abort` in status output. Fixes #53679 and #70223; refs #71848. Thanks @dlturock, @stammi922, and @palladius. - Memory/QMD: prefer QMD's `--mask` collection pattern flag so root memory indexing stays scoped to `MEMORY.md` instead of widening to every markdown file in the workspace. Thanks @codex. - Codex harness: normalize cached input tokens before session/context accounting so prompt cache reads are not double-counted in `/status`, `session_status`, or persisted `sessionEntry.totalTokens`. Fixes #69298. Thanks @richardmqq. - Hooks/session-memory: use the host local timezone for memory filenames, fallback timestamp slugs, and markdown headers instead of UTC dates. Fixes #46703. (#46721) Thanks @Astro-Han. diff --git a/src/commands/daemon-install-helpers.test.ts b/src/commands/daemon-install-helpers.test.ts index 70e022ef385..df00aeeb754 100644 --- a/src/commands/daemon-install-helpers.test.ts +++ b/src/commands/daemon-install-helpers.test.ts @@ -66,12 +66,14 @@ function mockNodeGatewayPlanFixture( } = {}, ) { const { - workingDirectory = "/Users/me", version = "22.0.0", supported = true, warning, serviceEnvironment = { OPENCLAW_PORT: "3000" }, } = params; + const workingDirectory = Object.hasOwn(params, "workingDirectory") + ? params.workingDirectory + : "/Users/me"; mocks.resolvePreferredNodePath.mockResolvedValue("/opt/node"); mocks.resolveGatewayProgramArguments.mockResolvedValue({ programArguments: ["node", "gateway"], @@ -166,6 +168,43 @@ describe("buildGatewayInstallPlan", () => { expect(mocks.resolvePreferredNodePath).toHaveBeenCalled(); }); + it("uses the state dir as the default macOS launchd working directory", async () => { + mockNodeGatewayPlanFixture({ + workingDirectory: undefined, + serviceEnvironment: {}, + }); + + const plan = await buildGatewayInstallPlan({ + env: isolatedPlanEnv(), + port: 3000, + runtime: "node", + platform: "darwin", + }); + + expect(plan.workingDirectory).toBe(path.join(isolatedHome, ".openclaw")); + expect(mocks.buildServiceEnvironment).toHaveBeenCalledWith( + expect.objectContaining({ + platform: "darwin", + }), + ); + }); + + it("does not invent a working directory for non-macOS service installs", async () => { + mockNodeGatewayPlanFixture({ + workingDirectory: undefined, + serviceEnvironment: {}, + }); + + const plan = await buildGatewayInstallPlan({ + env: isolatedPlanEnv(), + port: 3000, + runtime: "node", + platform: "linux", + }); + + expect(plan.workingDirectory).toBeUndefined(); + }); + it("merges safe config env while dropping unsafe values and keeping service precedence", async () => { mockNodeGatewayPlanFixture({ serviceEnvironment: { diff --git a/src/commands/daemon-install-helpers.ts b/src/commands/daemon-install-helpers.ts index 0d811cdd838..0f477141690 100644 --- a/src/commands/daemon-install-helpers.ts +++ b/src/commands/daemon-install-helpers.ts @@ -5,6 +5,7 @@ import { formatCliCommand } from "../cli/command-format.js"; import { collectDurableServiceEnvVars } from "../config/state-dir-dotenv.js"; import type { OpenClawConfig } from "../config/types.js"; import { resolveGatewayLaunchAgentLabel } from "../daemon/constants.js"; +import { resolveGatewayStateDir } from "../daemon/paths.js"; import { resolveGatewayProgramArguments } from "../daemon/program-args.js"; import { buildServiceEnvironment } from "../daemon/service-env.js"; import { @@ -212,6 +213,20 @@ function collectPreservedExistingServiceEnvVars( return preserved; } +function resolveGatewayInstallWorkingDirectory(params: { + env: Record; + platform: NodeJS.Platform; + workingDirectory: string | undefined; +}): string | undefined { + if (params.workingDirectory) { + return params.workingDirectory; + } + if (params.platform !== "darwin") { + return undefined; + } + return resolveGatewayStateDir(params.env); +} + async function buildGatewayInstallEnvironment(params: { env: Record; config?: OpenClawConfig; @@ -261,11 +276,13 @@ export async function buildGatewayInstallPlan(params: { existingEnvironment?: Record; devMode?: boolean; nodePath?: string; + platform?: NodeJS.Platform; warn?: DaemonInstallWarnFn; /** Full config to extract env vars from (env vars + inline env keys). */ config?: OpenClawConfig; authStore?: AuthProfileStore; }): Promise { + const platform = params.platform ?? process.platform; const { devMode, nodePath } = await resolveDaemonInstallRuntimeInputs({ env: params.env, runtime: params.runtime, @@ -289,16 +306,21 @@ export async function buildGatewayInstallPlan(params: { env: params.env, port: params.port, launchdLabel: - process.platform === "darwin" + platform === "darwin" ? resolveGatewayLaunchAgentLabel(params.env.OPENCLAW_PROFILE) : undefined, + platform, extraPathDirs: resolveDaemonNodeBinDir(nodePath), }); // Lowest to highest: preserved custom vars, durable config, auth env refs, generated service env. return { programArguments, - workingDirectory, + workingDirectory: resolveGatewayInstallWorkingDirectory({ + env: params.env, + platform, + workingDirectory, + }), environment: await buildGatewayInstallEnvironment({ env: params.env, config: params.config, diff --git a/src/daemon/launchd.test.ts b/src/daemon/launchd.test.ts index 3cacdeee259..e0f36f86072 100644 --- a/src/daemon/launchd.test.ts +++ b/src/daemon/launchd.test.ts @@ -451,7 +451,7 @@ describe("launchd install", () => { it("writes TMPDIR to LaunchAgent environment when provided", async () => { const env = createDefaultLaunchdEnv(); - const tmpDir = "/var/folders/xy/abc123/T/"; + const tmpDir = "/Users/test/.openclaw/tmp"; await installLaunchAgent({ env, stdout: new PassThrough(), @@ -466,6 +466,20 @@ describe("launchd install", () => { expect(plist).toContain(`${tmpDir}`); }); + it("creates the LaunchAgent TMPDIR before bootstrap", async () => { + const env = createDefaultLaunchdEnv(); + const tmpDir = "/Users/test/.openclaw/tmp"; + await installLaunchAgent({ + env, + stdout: new PassThrough(), + programArguments: defaultProgramArguments, + environment: { TMPDIR: tmpDir }, + }); + + expect(state.dirs.has(tmpDir)).toBe(true); + expect(state.dirModes.get(tmpDir)).toBe(0o700); + }); + it("writes KeepAlive=true policy with restrictive umask", async () => { const env = createDefaultLaunchdEnv(); await installLaunchAgent({ diff --git a/src/daemon/launchd.ts b/src/daemon/launchd.ts index a79eb3da4b8..f1c12d098b5 100644 --- a/src/daemon/launchd.ts +++ b/src/daemon/launchd.ts @@ -36,6 +36,7 @@ import type { const LAUNCH_AGENT_DIR_MODE = 0o755; const LAUNCH_AGENT_PLIST_MODE = 0o644; +const LAUNCH_AGENT_PRIVATE_DIR_MODE = 0o700; function assertValidLaunchAgentLabel(label: string): string { const trimmed = label.trim(); @@ -209,12 +210,16 @@ async function bootstrapLaunchAgentOrThrow(params: { throw new Error(`launchctl bootstrap failed: ${detail}`); } -async function ensureSecureDirectory(targetPath: string): Promise { - await fs.mkdir(targetPath, { recursive: true, mode: LAUNCH_AGENT_DIR_MODE }); +async function ensureSecureDirectory( + targetPath: string, + dirMode = LAUNCH_AGENT_DIR_MODE, +): Promise { + await fs.mkdir(targetPath, { recursive: true, mode: dirMode }); try { const stat = await fs.stat(targetPath); const mode = stat.mode & 0o777; - const tightenedMode = mode & ~0o022; + const forbiddenMode = dirMode === LAUNCH_AGENT_PRIVATE_DIR_MODE ? 0o077 : 0o022; + const tightenedMode = mode & ~forbiddenMode; if (tightenedMode !== mode) { await fs.chmod(targetPath, tightenedMode); } @@ -223,6 +228,15 @@ async function ensureSecureDirectory(targetPath: string): Promise { } } +async function ensureLaunchAgentEnvironmentDirectories( + environment: Record | undefined, +): Promise { + const tmpDir = environment?.TMPDIR?.trim(); + if (tmpDir) { + await ensureSecureDirectory(tmpDir, LAUNCH_AGENT_PRIVATE_DIR_MODE); + } +} + export type LaunchctlPrintInfo = { state?: string; pid?: number; @@ -535,6 +549,7 @@ async function writeLaunchAgentPlist({ await ensureSecureDirectory(home); await ensureSecureDirectory(libraryDir); await ensureSecureDirectory(path.dirname(plistPath)); + await ensureLaunchAgentEnvironmentDirectories(environment); const serviceDescription = resolveGatewayServiceDescription({ env, environment, description }); const plist = buildLaunchAgentPlist({ diff --git a/src/daemon/runtime-format.test.ts b/src/daemon/runtime-format.test.ts new file mode 100644 index 00000000000..c98fc7d29b3 --- /dev/null +++ b/src/daemon/runtime-format.test.ts @@ -0,0 +1,10 @@ +import { describe, expect, it } from "vitest"; +import { formatRuntimeStatus } from "./runtime-format.js"; + +describe("formatRuntimeStatus", () => { + it("labels abort-shaped launchd exit statuses", () => { + expect(formatRuntimeStatus({ status: "stopped", lastExitStatus: 134 })).toContain( + "last exit 134 (SIGABRT/abort)", + ); + }); +}); diff --git a/src/daemon/runtime-format.ts b/src/daemon/runtime-format.ts index 67155ab69bd..a2248febc02 100644 --- a/src/daemon/runtime-format.ts +++ b/src/daemon/runtime-format.ts @@ -12,6 +12,20 @@ export type ServiceRuntimeLike = { detail?: string; }; +const SIGNAL_NAMES_BY_STATUS = new Map([ + [129, "SIGHUP"], + [130, "SIGINT"], + [131, "SIGQUIT"], + [134, "SIGABRT/abort"], + [137, "SIGKILL"], + [143, "SIGTERM"], +]); + +function formatLastExitStatus(status: number): string { + const signalName = SIGNAL_NAMES_BY_STATUS.get(status); + return signalName ? `last exit ${status} (${signalName})` : `last exit ${status}`; +} + export function formatRuntimeStatus(runtime: ServiceRuntimeLike | undefined): string | null { if (!runtime) { return null; @@ -21,7 +35,7 @@ export function formatRuntimeStatus(runtime: ServiceRuntimeLike | undefined): st details.push(`sub ${runtime.subState}`); } if (runtime.lastExitStatus !== undefined) { - details.push(`last exit ${runtime.lastExitStatus}`); + details.push(formatLastExitStatus(runtime.lastExitStatus)); } if (runtime.lastExitReason) { details.push(`reason ${runtime.lastExitReason}`); diff --git a/src/daemon/service-env.test.ts b/src/daemon/service-env.test.ts index 1396b769f3c..983399eb6bd 100644 --- a/src/daemon/service-env.test.ts +++ b/src/daemon/service-env.test.ts @@ -398,18 +398,29 @@ describe("buildServiceEnvironment", () => { } }); - it("forwards TMPDIR from the host environment", () => { + it("forwards TMPDIR from the host environment on Linux", () => { const env = buildServiceEnvironment({ env: { HOME: "/home/user", TMPDIR: "/var/folders/xw/abc123/T/" }, port: 18789, + platform: "linux", }); expect(env.TMPDIR).toBe("/var/folders/xw/abc123/T/"); }); - it("falls back to os.tmpdir when TMPDIR is not set", () => { + it("uses a durable state temp directory for macOS LaunchAgents", () => { + const env = buildServiceEnvironment({ + env: { HOME: "/Users/user", TMPDIR: "/var/folders/xw/abc123/T/" }, + port: 18789, + platform: "darwin", + }); + expect(env.TMPDIR).toBe(path.join("/Users/user", ".openclaw", "tmp")); + }); + + it("falls back to os.tmpdir when TMPDIR is not set on Linux", () => { const env = buildServiceEnvironment({ env: { HOME: "/home/user" }, port: 18789, + platform: "linux", }); expect(env.TMPDIR).toBe(os.tmpdir()); }); @@ -519,16 +530,26 @@ describe("buildNodeServiceEnvironment", () => { expect(env.no_proxy).toBe("localhost,127.0.0.1"); }); - it("forwards TMPDIR for node services", () => { + it("forwards TMPDIR for node services on Linux", () => { const env = buildNodeServiceEnvironment({ env: { HOME: "/home/user", TMPDIR: "/tmp/custom" }, + platform: "linux", }); expect(env.TMPDIR).toBe("/tmp/custom"); }); - it("falls back to os.tmpdir for node services when TMPDIR is not set", () => { + it("uses a durable state temp directory for macOS node services", () => { + const env = buildNodeServiceEnvironment({ + env: { HOME: "/Users/user", TMPDIR: "/var/folders/xw/abc123/T/" }, + platform: "darwin", + }); + expect(env.TMPDIR).toBe(path.join("/Users/user", ".openclaw", "tmp")); + }); + + it("falls back to os.tmpdir for node services when TMPDIR is not set on Linux", () => { const env = buildNodeServiceEnvironment({ env: { HOME: "/home/user" }, + platform: "linux", }); expect(env.TMPDIR).toBe(os.tmpdir()); }); diff --git a/src/daemon/service-env.ts b/src/daemon/service-env.ts index baa652501be..c2fddf395f6 100644 --- a/src/daemon/service-env.ts +++ b/src/daemon/service-env.ts @@ -20,6 +20,7 @@ import { resolveNodeSystemdServiceName, resolveNodeWindowsTaskName, } from "./constants.js"; +import { resolveGatewayStateDir } from "./paths.js"; export { isNodeVersionManagerRuntime, resolveLinuxSystemCaBundle }; @@ -360,6 +361,20 @@ function buildCommonServiceEnvironment( return serviceEnv; } +function resolveServiceTmpDir( + env: Record, + platform: NodeJS.Platform, +): string { + if (platform === "darwin") { + try { + return path.join(resolveGatewayStateDir(env), "tmp"); + } catch { + return env.TMPDIR?.trim() || os.tmpdir(); + } + } + return env.TMPDIR?.trim() || os.tmpdir(); +} + function resolveSharedServiceEnvironmentFields( env: Record, platform: NodeJS.Platform, @@ -368,8 +383,7 @@ function resolveSharedServiceEnvironmentFields( ): SharedServiceEnvironmentFields { const stateDir = env.OPENCLAW_STATE_DIR; const configPath = env.OPENCLAW_CONFIG_PATH; - // Keep a usable temp directory for supervised services even when the host env omits TMPDIR. - const tmpDir = env.TMPDIR?.trim() || os.tmpdir(); + const tmpDir = resolveServiceTmpDir(env, platform); const proxyEnv = readServiceProxyEnvironment(env); // On macOS, launchd services don't inherit the shell environment, so Node's undici/fetch // cannot locate the system CA bundle. Default to /etc/ssl/cert.pem so TLS verification From 732a5842ee99f569cdd21214f38dd9f80af794c7 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 17:21:50 -0700 Subject: [PATCH 123/418] fix(gateway): defer implicit qmd memory startup --- src/gateway/server-startup-memory.test.ts | 69 ++++++++++++++++++----- src/gateway/server-startup-memory.ts | 60 ++++++++++++++++++-- 2 files changed, 110 insertions(+), 19 deletions(-) diff --git a/src/gateway/server-startup-memory.test.ts b/src/gateway/server-startup-memory.test.ts index bf1d040e6fb..21ea1896c36 100644 --- a/src/gateway/server-startup-memory.test.ts +++ b/src/gateway/server-startup-memory.test.ts @@ -5,13 +5,8 @@ const { getMemorySearchManagerMock } = vi.hoisted(() => ({ getMemorySearchManagerMock: vi.fn(), })); -const { resolveActiveMemoryBackendConfigMock } = vi.hoisted(() => ({ - resolveActiveMemoryBackendConfigMock: vi.fn(), -})); - vi.mock("../plugins/memory-runtime.js", () => ({ getActiveMemorySearchManager: getMemorySearchManagerMock, - resolveActiveMemoryBackendConfig: resolveActiveMemoryBackendConfigMock, })); import { startGatewayMemoryBackend } from "./server-startup-memory.js"; @@ -30,11 +25,6 @@ function createGatewayLogMock() { describe("startGatewayMemoryBackend", () => { beforeEach(() => { getMemorySearchManagerMock.mockClear(); - resolveActiveMemoryBackendConfigMock.mockReset(); - resolveActiveMemoryBackendConfigMock.mockImplementation(({ cfg }: { cfg: OpenClawConfig }) => ({ - backend: cfg.memory?.backend === "qmd" ? "qmd" : "builtin", - qmd: cfg.memory?.backend === "qmd" ? {} : undefined, - })); }); it("skips initialization when memory backend is not qmd", async () => { @@ -51,8 +41,14 @@ describe("startGatewayMemoryBackend", () => { expect(log.warn).not.toHaveBeenCalled(); }); - it("initializes qmd backend for each configured agent", async () => { - const cfg = createQmdConfig({ list: [{ id: "ops", default: true }, { id: "main" }] }); + it("initializes qmd backend for the default and explicitly configured agents", async () => { + const cfg = createQmdConfig({ + list: [ + { id: "ops", default: true }, + { id: "main", memorySearch: { enabled: true } }, + { id: "lazy" }, + ], + }); const log = createGatewayLogMock(); getMemorySearchManagerMock.mockResolvedValue({ manager: { search: vi.fn() } }); @@ -61,15 +57,41 @@ describe("startGatewayMemoryBackend", () => { expect(getMemorySearchManagerMock).toHaveBeenCalledTimes(2); expect(getMemorySearchManagerMock).toHaveBeenNthCalledWith(1, { cfg, agentId: "ops" }); expect(getMemorySearchManagerMock).toHaveBeenNthCalledWith(2, { cfg, agentId: "main" }); - expect(log.info).toHaveBeenCalledTimes(1); expect(log.info).toHaveBeenCalledWith( 'qmd memory startup initialization armed for 2 agents: "ops", "main"', ); + expect(log.info).toHaveBeenCalledWith( + 'qmd memory startup initialization deferred for 1 agent: "lazy"', + ); expect(log.warn).not.toHaveBeenCalled(); }); + it("initializes all qmd agents when memory search is explicitly enabled in defaults", async () => { + const cfg = createQmdConfig({ + defaults: { memorySearch: { enabled: true } }, + list: [{ id: "ops", default: true }, { id: "main" }], + }); + const log = createGatewayLogMock(); + getMemorySearchManagerMock.mockResolvedValue({ manager: { search: vi.fn() } }); + + await startGatewayMemoryBackend({ cfg, log }); + + expect(getMemorySearchManagerMock).toHaveBeenCalledTimes(2); + expect(getMemorySearchManagerMock).toHaveBeenNthCalledWith(1, { cfg, agentId: "ops" }); + expect(getMemorySearchManagerMock).toHaveBeenNthCalledWith(2, { cfg, agentId: "main" }); + expect(log.info).toHaveBeenCalledWith( + 'qmd memory startup initialization armed for 2 agents: "ops", "main"', + ); + expect(log.info).not.toHaveBeenCalledWith(expect.stringContaining("deferred")); + }); + it("logs a warning when qmd manager init fails and continues with other agents", async () => { - const cfg = createQmdConfig({ list: [{ id: "main", default: true }, { id: "ops" }] }); + const cfg = createQmdConfig({ + list: [ + { id: "main", default: true }, + { id: "ops", memorySearch: { enabled: true } }, + ], + }); const log = createGatewayLogMock(); getMemorySearchManagerMock .mockResolvedValueOnce({ manager: null, error: "qmd missing" }) @@ -105,4 +127,23 @@ describe("startGatewayMemoryBackend", () => { ); expect(log.warn).not.toHaveBeenCalled(); }); + + it("does not initialize qmd managers when background work is disabled", async () => { + const cfg = { + agents: { list: [{ id: "main", default: true }] }, + memory: { + backend: "qmd", + qmd: { + update: { onBoot: false, interval: "0s", embedInterval: "0s" }, + }, + }, + } as OpenClawConfig; + const log = createGatewayLogMock(); + + await startGatewayMemoryBackend({ cfg, log }); + + expect(getMemorySearchManagerMock).not.toHaveBeenCalled(); + expect(log.info).not.toHaveBeenCalled(); + expect(log.warn).not.toHaveBeenCalled(); + }); }); diff --git a/src/gateway/server-startup-memory.ts b/src/gateway/server-startup-memory.ts index ace12fe0113..80d90425c16 100644 --- a/src/gateway/server-startup-memory.ts +++ b/src/gateway/server-startup-memory.ts @@ -1,10 +1,39 @@ -import { listAgentIds } from "../agents/agent-scope.js"; +import { listAgentEntries, listAgentIds, resolveDefaultAgentId } from "../agents/agent-scope.js"; import { resolveMemorySearchConfig } from "../agents/memory-search.js"; import type { OpenClawConfig } from "../config/types.openclaw.js"; import { - getActiveMemorySearchManager, - resolveActiveMemoryBackendConfig, -} from "../plugins/memory-runtime.js"; + resolveMemoryBackendConfig, + type ResolvedQmdConfig, +} from "../memory-host-sdk/host/backend-config.js"; +import { getActiveMemorySearchManager } from "../plugins/memory-runtime.js"; +import { normalizeAgentId } from "../routing/session-key.js"; + +function shouldStartQmdBackgroundWork(qmd: ResolvedQmdConfig): boolean { + return qmd.update.onBoot || qmd.update.intervalMs > 0 || qmd.update.embedIntervalMs > 0; +} + +function hasExplicitAgentMemorySearchConfig(cfg: OpenClawConfig, agentId: string): boolean { + return listAgentEntries(cfg).some( + (entry) => normalizeAgentId(entry.id) === agentId && entry.memorySearch != null, + ); +} + +function shouldEagerlyStartAgentMemory(params: { + cfg: OpenClawConfig; + agentId: string; + agentCount: number; +}): boolean { + if (params.agentCount <= 1) { + return true; + } + if (params.agentId === resolveDefaultAgentId(params.cfg)) { + return true; + } + if (params.cfg.agents?.defaults?.memorySearch?.enabled === true) { + return true; + } + return hasExplicitAgentMemorySearchConfig(params.cfg, params.agentId); +} export async function startGatewayMemoryBackend(params: { cfg: OpenClawConfig; @@ -12,17 +41,31 @@ export async function startGatewayMemoryBackend(params: { }): Promise { const agentIds = listAgentIds(params.cfg); const armedAgentIds: string[] = []; + const deferredAgentIds: string[] = []; for (const agentId of agentIds) { if (!resolveMemorySearchConfig(params.cfg, agentId)) { continue; } - const resolved = resolveActiveMemoryBackendConfig({ cfg: params.cfg, agentId }); + const resolved = resolveMemoryBackendConfig({ cfg: params.cfg, agentId }); if (!resolved) { continue; } if (resolved.backend !== "qmd" || !resolved.qmd) { continue; } + if (!shouldStartQmdBackgroundWork(resolved.qmd)) { + continue; + } + if ( + !shouldEagerlyStartAgentMemory({ + cfg: params.cfg, + agentId, + agentCount: agentIds.length, + }) + ) { + deferredAgentIds.push(agentId); + continue; + } const { manager, error } = await getActiveMemorySearchManager({ cfg: params.cfg, agentId }); if (!manager) { @@ -40,6 +83,13 @@ export async function startGatewayMemoryBackend(params: { .join(", ")}`, ); } + if (deferredAgentIds.length > 0) { + params.log.info?.( + `qmd memory startup initialization deferred for ${formatAgentCount(deferredAgentIds.length)}: ${deferredAgentIds + .map((agentId) => `"${agentId}"`) + .join(", ")}`, + ); + } } function formatAgentCount(count: number): string { From 7ca2f9fed52226d0e02128872d087268d07c62b2 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 01:22:50 +0100 Subject: [PATCH 124/418] test(docker): align package harness image --- docs/concepts/qa-e2e-automation.md | 12 ++--- docs/help/testing.md | 2 +- scripts/e2e/Dockerfile | 8 ++- scripts/e2e/docker-observability-smoke.sh | 61 ----------------------- scripts/lib/docker-e2e-scenarios.mjs | 14 ------ scripts/qa-otel-smoke.ts | 10 ++-- tsdown.config.ts | 26 ++++++++++ 7 files changed, 41 insertions(+), 92 deletions(-) delete mode 100644 scripts/e2e/docker-observability-smoke.sh diff --git a/docs/concepts/qa-e2e-automation.md b/docs/concepts/qa-e2e-automation.md index b0a55d8e4a2..fb75fb73ed9 100644 --- a/docs/concepts/qa-e2e-automation.md +++ b/docs/concepts/qa-e2e-automation.md @@ -65,14 +65,10 @@ model calls must not export `StreamAbandoned` on successful turns; raw diagnosti `openclaw.content.*` attributes must stay out of the trace. It writes `otel-smoke-summary.json` next to the QA suite artifacts. -The normal Docker aggregate and release-path core chunk also run an -observability lane. It reuses the shared package-installed functional Docker -image, mounts the QA harness files read-only, runs the OTEL trace smoke inside -the container, then runs the `docker-prometheus-smoke` QA scenario with the -`diagnostics-prometheus` plugin enabled. Set -`OPENCLAW_DOCKER_OBSERVABILITY_LOOPS=` to repeat both checks inside one -Docker run while preserving per-loop artifacts under -`.artifacts/docker-observability/...`. +Observability QA stays source-checkout only. The npm tarball intentionally omits +QA Lab, so package Docker release lanes do not run `qa` commands. Use +`pnpm qa:otel:smoke` from a built source checkout when changing diagnostics +instrumentation. For a transport-real Matrix smoke lane, run: diff --git a/docs/help/testing.md b/docs/help/testing.md index c08edc47d37..f8eff284744 100644 --- a/docs/help/testing.md +++ b/docs/help/testing.md @@ -617,7 +617,7 @@ The live-model Docker runners also bind-mount only the needed CLI auth homes (or - CLI backend smoke: `pnpm test:docker:live-cli-backend` (script: `scripts/test-live-cli-backend-docker.sh`) - Codex app-server harness smoke: `pnpm test:docker:live-codex-harness` (script: `scripts/test-live-codex-harness-docker.sh`) - Gateway + dev agent: `pnpm test:docker:live-gateway` (script: `scripts/test-live-gateway-models-docker.sh`) -- Docker observability smoke: included in `pnpm test:docker:all`, `pnpm test:docker:local:all`, and the release-path `core` chunk (script: `scripts/e2e/docker-observability-smoke.sh`). It runs QA-lab OTEL and Prometheus diagnostics checks inside the shared package-installed functional Docker image, with only QA harness files mounted read-only. Set `OPENCLAW_DOCKER_OBSERVABILITY_LOOPS=` to repeat both checks in one container run. +- Observability smoke: `pnpm qa:otel:smoke` is a private QA source-checkout lane. It is intentionally not part of package Docker release lanes because the npm tarball omits QA Lab. - Open WebUI live smoke: `pnpm test:docker:openwebui` (script: `scripts/e2e/openwebui-docker.sh`) - Onboarding wizard (TTY, full scaffolding): `pnpm test:docker:onboard` (script: `scripts/e2e/onboard-docker.sh`) - Npm tarball onboarding/channel/agent smoke: `pnpm test:docker:npm-onboard-channel-agent` installs the packed OpenClaw tarball globally in Docker, configures OpenAI via env-ref onboarding plus Telegram by default, verifies doctor repairs activated plugin runtime deps, and runs one mocked OpenAI agent turn. Reuse a prebuilt tarball with `OPENCLAW_CURRENT_PACKAGE_TGZ=/path/to/openclaw-*.tgz`, skip the host rebuild with `OPENCLAW_NPM_ONBOARD_HOST_BUILD=0`, or switch channel with `OPENCLAW_NPM_ONBOARD_CHANNEL=discord`. diff --git a/scripts/e2e/Dockerfile b/scripts/e2e/Dockerfile index dbda16a418f..0c1be69bb3e 100644 --- a/scripts/e2e/Dockerfile +++ b/scripts/e2e/Dockerfile @@ -6,8 +6,10 @@ FROM node:24-bookworm-slim@sha256:e8e2e91b1378f83c5b2dd15f0247f34110e2fe895f6ca7719dbb780f929368eb AS e2e-runner +# python3 covers package/plugin install paths that execute helper scripts while +# staying below a full build-essential toolchain. RUN apt-get update \ - && apt-get install -y --no-install-recommends ca-certificates git \ + && apt-get install -y --no-install-recommends ca-certificates git python3 \ && rm -rf /var/lib/apt/lists/* RUN corepack enable @@ -40,10 +42,14 @@ FROM bare AS functional # The app under test enters through the named BuildKit context, not by copying # checkout sources into the image. COPY --from=openclaw_package --chown=appuser:appuser openclaw-current.tgz /tmp/openclaw-current.tgz +# Preserve package self-reference imports such as openclaw/plugin-sdk/* after +# copying the installed package out of npm's global node_modules tree. RUN npm install -g --prefix /tmp/openclaw-prefix /tmp/openclaw-current.tgz --no-fund --no-audit \ && cp -a /tmp/openclaw-prefix/lib/node_modules/openclaw/. /app/ \ && mkdir -p "$HOME/.local/bin" \ && ln -sf /app/openclaw.mjs "$HOME/.local/bin/openclaw" \ + && mkdir -p /app/node_modules \ + && ln -sf /app /app/node_modules/openclaw \ && rm -rf /tmp/openclaw-prefix /tmp/openclaw-current.tgz CMD ["bash"] diff --git a/scripts/e2e/docker-observability-smoke.sh b/scripts/e2e/docker-observability-smoke.sh deleted file mode 100644 index caa08d1b5c1..00000000000 --- a/scripts/e2e/docker-observability-smoke.sh +++ /dev/null @@ -1,61 +0,0 @@ -#!/usr/bin/env bash -# Runs QA diagnostics smoke checks inside the shared package-installed Docker -# E2E image. The OpenClaw app under test comes from the prepared npm tarball; -# only QA harness files are mounted read-only. -set -euo pipefail - -ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" -source "$ROOT_DIR/scripts/lib/docker-e2e-image.sh" - -IMAGE_NAME="$(docker_e2e_resolve_image "openclaw-docker-observability-e2e:local" OPENCLAW_DOCKER_OBSERVABILITY_E2E_IMAGE OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE)" -SKIP_BUILD="${OPENCLAW_DOCKER_OBSERVABILITY_E2E_SKIP_BUILD:-0}" -LOOPS="${OPENCLAW_DOCKER_OBSERVABILITY_LOOPS:-1}" -OUTPUT_DIR="${OPENCLAW_DOCKER_OBSERVABILITY_OUTPUT_DIR:-$ROOT_DIR/.artifacts/docker-observability/$(date +%Y%m%d-%H%M%S)}" - -if ! [[ "$LOOPS" =~ ^[1-9][0-9]*$ ]]; then - echo "OPENCLAW_DOCKER_OBSERVABILITY_LOOPS must be a positive integer, got: $LOOPS" >&2 - exit 1 -fi - -mkdir -p "$OUTPUT_DIR" - -docker_e2e_build_or_reuse "$IMAGE_NAME" docker-observability "$ROOT_DIR/scripts/e2e/Dockerfile" "$ROOT_DIR" "" "$SKIP_BUILD" -docker_e2e_harness_mount_args - -echo "Running Docker observability smoke with $LOOPS loop(s)..." -run_logged docker-observability docker run --rm \ - -e "OPENCLAW_DOCKER_OBSERVABILITY_LOOPS=$LOOPS" \ - "${DOCKER_E2E_HARNESS_ARGS[@]}" \ - -v "$ROOT_DIR/scripts/qa-otel-smoke.ts:/app/scripts/qa-otel-smoke.ts:ro" \ - -v "$ROOT_DIR/qa:/app/qa:ro" \ - -v "$OUTPUT_DIR:/app/.artifacts/docker-observability-current" \ - "$IMAGE_NAME" \ - bash -lc ' -set -euo pipefail - -loops="${OPENCLAW_DOCKER_OBSERVABILITY_LOOPS:-1}" -artifact_root=".artifacts/docker-observability-current" -mkdir -p "$artifact_root" - -for i in $(seq 1 "$loops"); do - iteration_dir="$artifact_root/loop-$i" - mkdir -p "$iteration_dir" - - echo "== docker observability loop $i/$loops: otel ==" - # The functional image has a global tsx runner for mounted harness files; the - # published package intentionally does not ship tsx as an app dependency. - tsx scripts/qa-otel-smoke.ts \ - --provider-mode mock-openai \ - --output-dir "$iteration_dir/otel" - - echo "== docker observability loop $i/$loops: prometheus ==" - node openclaw.mjs qa suite \ - --provider-mode mock-openai \ - --scenario docker-prometheus-smoke \ - --concurrency 1 \ - --fast \ - --output-dir "$iteration_dir/prometheus" -done -' - -echo "Docker observability smoke passed. Artifacts: $OUTPUT_DIR" diff --git a/scripts/lib/docker-e2e-scenarios.mjs b/scripts/lib/docker-e2e-scenarios.mjs index 227adae9d00..d08982f2628 100644 --- a/scripts/lib/docker-e2e-scenarios.mjs +++ b/scripts/lib/docker-e2e-scenarios.mjs @@ -184,13 +184,6 @@ export const mainLanes = [ { resources: ["service"], weight: 3 }, ), serviceLane("gateway-network", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:gateway-network"), - serviceLane( - "observability", - "OPENCLAW_SKIP_DOCKER_BUILD=1 bash scripts/e2e/docker-observability-smoke.sh", - { - weight: 3, - }, - ), serviceLane( "agents-delete-shared-workspace", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:agents-delete-shared-workspace", @@ -345,13 +338,6 @@ const releasePathChunks = { "pi-bundle-mcp-tools", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:pi-bundle-mcp-tools", ), - serviceLane( - "observability", - "OPENCLAW_SKIP_DOCKER_BUILD=1 bash scripts/e2e/docker-observability-smoke.sh", - { - weight: 3, - }, - ), serviceLane("mcp-channels", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:mcp-channels", { resources: ["npm"], weight: 3, diff --git a/scripts/qa-otel-smoke.ts b/scripts/qa-otel-smoke.ts index 0df2099309d..3455f6d7b54 100644 --- a/scripts/qa-otel-smoke.ts +++ b/scripts/qa-otel-smoke.ts @@ -287,14 +287,10 @@ function startLocalOtlpTraceReceiver() { } function openClawEntryArgs(): string[] { - if ( - existsSync(path.join(process.cwd(), "openclaw.mjs")) && - (existsSync(path.join(process.cwd(), "dist", "entry.js")) || - existsSync(path.join(process.cwd(), "dist", "entry.mjs"))) - ) { - return ["openclaw.mjs"]; + if (existsSync(path.join(process.cwd(), "scripts", "run-node.mjs"))) { + return ["scripts/run-node.mjs"]; } - return ["scripts/run-node.mjs"]; + return ["openclaw.mjs"]; } function spawnOpenClaw(args: string[], env: NodeJS.ProcessEnv): ChildProcess { diff --git a/tsdown.config.ts b/tsdown.config.ts index 67f8777dc67..7327921efd3 100644 --- a/tsdown.config.ts +++ b/tsdown.config.ts @@ -234,7 +234,32 @@ function buildCoreDistEntries(): Record { }; } +function buildDockerE2eHarnessEntries(): Record { + return { + // Mounted Docker harnesses run against the npm tarball image, so any + // internal module they assert must have a stable package dist entry. + "agents/pi-bundle-mcp-materialize": "src/agents/pi-bundle-mcp-materialize.ts", + "agents/pi-bundle-mcp-runtime": "src/agents/pi-bundle-mcp-runtime.ts", + "agents/pi-embedded-runner/effective-tool-policy": + "src/agents/pi-embedded-runner/effective-tool-policy.ts", + "agents/pi-embedded-runner/run/runtime-context-prompt": + "src/agents/pi-embedded-runner/run/runtime-context-prompt.ts", + "auto-reply/reply/commands-crestodian": "src/auto-reply/reply/commands-crestodian.ts", + "cli/run-main": "src/cli/run-main.ts", + "config/config": "src/config/config.ts", + "crestodian/crestodian": "src/crestodian/crestodian.ts", + "crestodian/rescue-message": "src/crestodian/rescue-message.ts", + "gateway/protocol/index": "src/gateway/protocol/index.ts", + "infra/errors": "src/infra/errors.ts", + "infra/ws": "src/infra/ws.ts", + "plugin-sdk/provider-onboard": "src/plugin-sdk/provider-onboard.ts", + "plugins/tools": "src/plugins/tools.ts", + "shared/string-coerce": "src/shared/string-coerce.ts", + }; +} + const coreDistEntries = buildCoreDistEntries(); +const dockerE2eHarnessEntries = buildDockerE2eHarnessEntries(); const stagedBundledPluginBuildEntries = bundledPluginBuildEntries.filter(({ packageJson }) => shouldStageBundledPluginRuntimeDependencies(packageJson), ); @@ -247,6 +272,7 @@ const rootBundledPluginBuildEntries = bundledPluginBuildEntries.filter( function buildUnifiedDistEntries(): Record { return { ...coreDistEntries, + ...dockerE2eHarnessEntries, // Internal compat artifact for the root-alias.cjs lazy loader. "plugin-sdk/compat": "src/plugin-sdk/compat.ts", ...Object.fromEntries( From 90b3cdb6a7221974a7293872c26b517cb65a0d41 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 01:25:00 +0100 Subject: [PATCH 125/418] test(docker): fix update fixture pnpm patch config --- scripts/e2e/update-channel-switch-docker.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/e2e/update-channel-switch-docker.sh b/scripts/e2e/update-channel-switch-docker.sh index dc52e3f3526..a301e4fb568 100755 --- a/scripts/e2e/update-channel-switch-docker.sh +++ b/scripts/e2e/update-channel-switch-docker.sh @@ -43,7 +43,7 @@ mkdir -p "$git_root" tar -xzf "$package_tgz" -C "$git_root" --strip-components=1 # The package-derived fixture can carry patchedDependencies whose targets are # absent from the trimmed tarball install; that should not block update preflight. -printf "\nallow-unused-patches=true\n" >>"$git_root/.npmrc" +printf "\nallowUnusedPatches=true\n" >>"$git_root/.npmrc" ( cd "$git_root" npm install --omit=optional --no-fund --no-audit >/tmp/openclaw-git-install.log 2>&1 From 11e17793e1d22b7ad342a76e71507ad229327326 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 01:27:20 +0100 Subject: [PATCH 126/418] ci: include node22 compat in manual full ci --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7505e45af83..e005e97a400 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1087,7 +1087,7 @@ jobs: contents: read name: checks-node-compat-node22 needs: [preflight] - if: needs.preflight.outputs.run_build_artifacts == 'true' && github.event_name == 'push' + if: needs.preflight.outputs.run_build_artifacts == 'true' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') runs-on: ${{ github.repository == 'openclaw/openclaw' && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-24.04' }} timeout-minutes: 60 steps: From acd1bd7d3111b7d4c2f23a182be52021cbd69cab Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 01:27:32 +0100 Subject: [PATCH 127/418] fix(exec): skip node approval prepare in yolo mode --- CHANGELOG.md | 1 + .../bash-tools.exec-host-node-phases.ts | 312 ++++++++++++++++++ src/agents/bash-tools.exec-host-node.test.ts | 30 +- src/agents/bash-tools.exec-host-node.ts | 281 ++++------------ 4 files changed, 409 insertions(+), 215 deletions(-) create mode 100644 src/agents/bash-tools.exec-host-node-phases.ts diff --git a/CHANGELOG.md b/CHANGELOG.md index 3e7ce714884..ba9efff4662 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,7 @@ Docs: https://docs.openclaw.ai ### Fixes - macOS Gateway: write launchd services with a state-dir `WorkingDirectory`, use a durable state-dir temp path instead of freezing macOS session `TMPDIR`, create that temp directory before bootstrap, and label abort-shaped launchd exits as `SIGABRT/abort` in status output. Fixes #53679 and #70223; refs #71848. Thanks @dlturock, @stammi922, and @palladius. +- Exec/node: skip approval-plan preparation for full-trust `host=node` runs so interpreter and script commands no longer fail with `SYSTEM_RUN_DENIED: approval cannot safely bind` when effective policy is `security=full` and `ask=off`. Fixes #48457 and duplicate #69251. Thanks @ajtran303, @jaserNo1, @Blakeshannon, @lesliefag, and @AvIsBeastMC. - Memory/QMD: prefer QMD's `--mask` collection pattern flag so root memory indexing stays scoped to `MEMORY.md` instead of widening to every markdown file in the workspace. Thanks @codex. - Codex harness: normalize cached input tokens before session/context accounting so prompt cache reads are not double-counted in `/status`, `session_status`, or persisted `sessionEntry.totalTokens`. Fixes #69298. Thanks @richardmqq. - Hooks/session-memory: use the host local timezone for memory filenames, fallback timestamp slugs, and markdown headers instead of UTC dates. Fixes #46703. (#46721) Thanks @Astro-Han. diff --git a/src/agents/bash-tools.exec-host-node-phases.ts b/src/agents/bash-tools.exec-host-node-phases.ts new file mode 100644 index 00000000000..e2cd226b408 --- /dev/null +++ b/src/agents/bash-tools.exec-host-node-phases.ts @@ -0,0 +1,312 @@ +import crypto from "node:crypto"; +import type { AgentToolResult } from "@mariozechner/pi-agent-core"; +import { + type ExecApprovalsFile, + type ExecAsk, + type ExecSecurity, + type SystemRunApprovalPlan, + evaluateShellAllowlist, + hasDurableExecApproval, + resolveExecApprovalsFromFile, +} from "../infra/exec-approvals.js"; +import { + describeInterpreterInlineEval, + detectInterpreterInlineEvalArgv, +} from "../infra/exec-inline-eval.js"; +import { buildNodeShellCommand } from "../infra/node-shell.js"; +import { parsePreparedSystemRunPayload } from "../infra/system-run-approval-context.js"; +import type { ExecuteNodeHostCommandParams } from "./bash-tools.exec-host-node.js"; +import type { ExecToolDetails } from "./bash-tools.exec-types.js"; +import { callGatewayTool } from "./tools/gateway.js"; +import { listNodes, resolveNodeIdFromList } from "./tools/nodes-utils.js"; + +export type NodeExecutionTarget = { + nodeId: string; + platform?: string | null; + argv: string[]; + env: Record | undefined; + invokeTimeoutMs: number; +}; + +export type PreparedNodeRun = { + plan: SystemRunApprovalPlan; + argv: string[]; + rawCommand: string; + cwd: string | undefined; + agentId: string | undefined; + sessionKey: string | undefined; +}; + +export type NodeApprovalAnalysis = { + analysisOk: boolean; + allowlistSatisfied: boolean; + durableApprovalSatisfied: boolean; + inlineEvalHit: ReturnType; +}; + +export function shouldSkipNodeApprovalPrepare(params: { + hostSecurity: ExecSecurity; + hostAsk: ExecAsk; + strictInlineEval?: boolean; +}): boolean { + return ( + params.hostSecurity === "full" && params.hostAsk === "off" && params.strictInlineEval !== true + ); +} + +export function formatNodeRunToolResult(params: { + raw: unknown; + startedAt: number; + cwd: string | undefined; +}): AgentToolResult { + const payload = + params.raw && typeof params.raw === "object" + ? (params.raw as { payload?: unknown }).payload + : undefined; + const payloadObj = + payload && typeof payload === "object" ? (payload as Record) : {}; + const stdout = typeof payloadObj.stdout === "string" ? payloadObj.stdout : ""; + const stderr = typeof payloadObj.stderr === "string" ? payloadObj.stderr : ""; + const errorText = typeof payloadObj.error === "string" ? payloadObj.error : ""; + const success = typeof payloadObj.success === "boolean" ? payloadObj.success : false; + const exitCode = typeof payloadObj.exitCode === "number" ? payloadObj.exitCode : null; + return { + content: [ + { + type: "text", + text: stdout || stderr || errorText || "", + }, + ], + details: { + status: success ? "completed" : "failed", + exitCode, + durationMs: Date.now() - params.startedAt, + aggregated: [stdout, stderr, errorText].filter(Boolean).join("\n"), + cwd: params.cwd, + } satisfies ExecToolDetails, + }; +} + +export async function resolveNodeExecutionTarget( + params: ExecuteNodeHostCommandParams, +): Promise { + if (params.boundNode && params.requestedNode && params.boundNode !== params.requestedNode) { + throw new Error(`exec node not allowed (bound to ${params.boundNode})`); + } + const nodeQuery = params.boundNode || params.requestedNode; + const nodes = await listNodes({}); + if (nodes.length === 0) { + throw new Error( + "exec host=node requires a paired node (none available). This requires a companion app or node host.", + ); + } + let nodeId: string; + try { + nodeId = resolveNodeIdFromList(nodes, nodeQuery, !nodeQuery); + } catch (err) { + if (!nodeQuery && String(err).includes("node required")) { + throw new Error( + "exec host=node requires a node id when multiple nodes are available (set tools.exec.node or exec.node).", + { cause: err }, + ); + } + throw err; + } + const nodeInfo = nodes.find((entry) => entry.nodeId === nodeId); + const supportsSystemRun = Array.isArray(nodeInfo?.commands) + ? nodeInfo?.commands?.includes("system.run") + : false; + if (!supportsSystemRun) { + throw new Error( + "exec host=node requires a node that supports system.run (companion app or node host).", + ); + } + + return { + nodeId, + platform: nodeInfo?.platform, + argv: buildNodeShellCommand(params.command, nodeInfo?.platform), + env: params.requestedEnv ? { ...params.requestedEnv } : undefined, + invokeTimeoutMs: Math.max( + 10_000, + (typeof params.timeoutSec === "number" ? params.timeoutSec : params.defaultTimeoutSec) * + 1000 + + 5_000, + ), + }; +} + +export function buildNodeSystemRunInvoke(params: { + target: NodeExecutionTarget; + command: string[]; + rawCommand: string; + cwd: string | undefined; + timeoutSec: number | undefined; + agentId: string | undefined; + sessionKey: string | undefined; + approved?: boolean; + approvalDecision?: "allow-once" | "allow-always" | null; + runId?: string; + suppressNotifyOnExit?: boolean; + notifyOnExit?: boolean; + systemRunPlan?: SystemRunApprovalPlan; +}): Record { + return { + nodeId: params.target.nodeId, + command: "system.run", + params: { + command: params.command, + rawCommand: params.rawCommand, + ...(params.systemRunPlan ? { systemRunPlan: params.systemRunPlan } : {}), + ...(params.cwd != null ? { cwd: params.cwd } : {}), + env: params.target.env, + timeoutMs: typeof params.timeoutSec === "number" ? params.timeoutSec * 1000 : undefined, + agentId: params.agentId, + sessionKey: params.sessionKey, + approved: params.approved, + approvalDecision: params.approvalDecision ?? undefined, + runId: params.runId ?? undefined, + suppressNotifyOnExit: + params.suppressNotifyOnExit === true || params.notifyOnExit === false ? true : undefined, + }, + idempotencyKey: crypto.randomUUID(), + }; +} + +export async function invokeNodeSystemRunDirect(params: { + request: ExecuteNodeHostCommandParams; + target: NodeExecutionTarget; +}): Promise> { + const startedAt = Date.now(); + const raw = await callGatewayTool( + "node.invoke", + { timeoutMs: params.target.invokeTimeoutMs }, + buildNodeSystemRunInvoke({ + target: params.target, + command: params.target.argv, + rawCommand: params.request.command, + cwd: params.request.workdir, + timeoutSec: params.request.timeoutSec, + agentId: params.request.agentId, + sessionKey: params.request.sessionKey, + notifyOnExit: params.request.notifyOnExit, + }), + ); + return formatNodeRunToolResult({ raw, startedAt, cwd: params.request.workdir }); +} + +export async function prepareNodeSystemRun(params: { + request: ExecuteNodeHostCommandParams; + target: NodeExecutionTarget; +}): Promise { + const prepareRaw = await callGatewayTool( + "node.invoke", + { timeoutMs: 15_000 }, + { + nodeId: params.target.nodeId, + command: "system.run.prepare", + params: { + command: params.target.argv, + rawCommand: params.request.command, + ...(params.request.workdir != null ? { cwd: params.request.workdir } : {}), + agentId: params.request.agentId, + sessionKey: params.request.sessionKey, + }, + idempotencyKey: crypto.randomUUID(), + }, + ); + const prepared = parsePreparedSystemRunPayload(prepareRaw?.payload); + if (!prepared) { + throw new Error("invalid system.run.prepare response"); + } + return { + plan: prepared.plan, + argv: prepared.plan.argv, + rawCommand: prepared.plan.commandText, + cwd: prepared.plan.cwd ?? params.request.workdir, + agentId: prepared.plan.agentId ?? params.request.agentId, + sessionKey: prepared.plan.sessionKey ?? params.request.sessionKey, + }; +} + +export async function analyzeNodeApprovalRequirement(params: { + request: ExecuteNodeHostCommandParams; + target: NodeExecutionTarget; + prepared: PreparedNodeRun; + hostSecurity: ExecSecurity; + hostAsk: ExecAsk; +}): Promise { + const baseAllowlistEval = evaluateShellAllowlist({ + command: params.request.command, + allowlist: [], + safeBins: new Set(), + cwd: params.request.workdir, + env: params.request.env, + platform: params.target.platform, + trustedSafeBinDirs: params.request.trustedSafeBinDirs, + }); + let analysisOk = baseAllowlistEval.analysisOk; + let allowlistSatisfied = false; + let durableApprovalSatisfied = false; + const inlineEvalHit = + params.request.strictInlineEval === true + ? (baseAllowlistEval.segments + .map((segment) => + detectInterpreterInlineEvalArgv(segment.resolution?.effectiveArgv ?? segment.argv), + ) + .find((entry) => entry !== null) ?? null) + : null; + if (inlineEvalHit) { + params.request.warnings.push( + `Warning: strict inline-eval mode requires explicit approval for ${describeInterpreterInlineEval( + inlineEvalHit, + )}.`, + ); + } + if ((params.hostAsk === "always" || params.hostSecurity === "allowlist") && analysisOk) { + try { + const approvalsSnapshot = await callGatewayTool<{ file: string }>( + "exec.approvals.node.get", + { timeoutMs: 10_000 }, + { nodeId: params.target.nodeId }, + ); + const approvalsFile = + approvalsSnapshot && typeof approvalsSnapshot === "object" + ? approvalsSnapshot.file + : undefined; + if (approvalsFile && typeof approvalsFile === "object") { + const resolved = resolveExecApprovalsFromFile({ + file: approvalsFile as ExecApprovalsFile, + agentId: params.request.agentId, + overrides: { security: "full" }, + }); + // Allowlist-only precheck; safe bins are node-local and may diverge. + const allowlistEval = evaluateShellAllowlist({ + command: params.request.command, + allowlist: resolved.allowlist, + safeBins: new Set(), + cwd: params.request.workdir, + env: params.request.env, + platform: params.target.platform, + trustedSafeBinDirs: params.request.trustedSafeBinDirs, + }); + durableApprovalSatisfied = hasDurableExecApproval({ + analysisOk: allowlistEval.analysisOk, + segmentAllowlistEntries: allowlistEval.segmentAllowlistEntries, + allowlist: resolved.allowlist, + commandText: params.prepared.rawCommand, + }); + allowlistSatisfied = allowlistEval.allowlistSatisfied; + analysisOk = allowlistEval.analysisOk; + } + } catch { + // Fall back to requiring approval if node approvals cannot be fetched. + } + } + return { + analysisOk, + allowlistSatisfied, + durableApprovalSatisfied, + inlineEvalHit, + }; +} diff --git a/src/agents/bash-tools.exec-host-node.test.ts b/src/agents/bash-tools.exec-host-node.test.ts index 83030c15436..d708fba4a0c 100644 --- a/src/agents/bash-tools.exec-host-node.test.ts +++ b/src/agents/bash-tools.exec-host-node.test.ts @@ -238,6 +238,13 @@ describe("executeNodeHostCommand", () => { }); it("forwards prepared systemRunPlan on async node invoke after approval", async () => { + resolveExecHostApprovalContextMock.mockReturnValue({ + approvals: { allowlist: [], file: { version: 1, agents: {} } }, + hostSecurity: "full", + hostAsk: "always", + askFallback: "deny", + }); + const result = await executeNodeHostCommand({ command: "bun ./script.ts", workdir: "/tmp/work", @@ -259,11 +266,11 @@ describe("executeNodeHostCommand", () => { ); await vi.waitFor(() => { - expect(callGatewayToolMock).toHaveBeenCalledTimes(2); + expect(callGatewayToolMock).toHaveBeenCalledTimes(3); }); expect(callGatewayToolMock).toHaveBeenNthCalledWith( - 2, + 3, "node.invoke", expect.anything(), expect.objectContaining({ @@ -277,9 +284,7 @@ describe("executeNodeHostCommand", () => { ); }); - it("suppresses node completion events when notifyOnExit is disabled", async () => { - requiresExecApprovalMock.mockReturnValue(false); - + it("skips approval prepare in full/off mode", async () => { await executeNodeHostCommand({ command: "bun ./script.ts", workdir: "/tmp/work", @@ -294,17 +299,28 @@ describe("executeNodeHostCommand", () => { notifyOnExit: false, }); - expect(callGatewayToolMock).toHaveBeenNthCalledWith( - 2, + expect(callGatewayToolMock).toHaveBeenCalledTimes(1); + expect(callGatewayToolMock).toHaveBeenCalledWith( "node.invoke", expect.anything(), expect.objectContaining({ command: "system.run", params: expect.objectContaining({ + command: ["bash", "-lc", "bun ./script.ts"], + rawCommand: "bun ./script.ts", suppressNotifyOnExit: true, }), }), ); + expect(callGatewayToolMock).toHaveBeenCalledWith( + "node.invoke", + expect.anything(), + expect.objectContaining({ + params: expect.not.objectContaining({ + systemRunPlan: expect.anything(), + }), + }), + ); }); it("denies timed-out inline-eval requests instead of invoking the node", async () => { diff --git a/src/agents/bash-tools.exec-host-node.ts b/src/agents/bash-tools.exec-host-node.ts index 27d7fd092c4..426ca296ebd 100644 --- a/src/agents/bash-tools.exec-host-node.ts +++ b/src/agents/bash-tools.exec-host-node.ts @@ -1,26 +1,24 @@ -import crypto from "node:crypto"; import type { AgentToolResult } from "@mariozechner/pi-agent-core"; import { - type ExecApprovalsFile, type ExecAsk, type ExecSecurity, - evaluateShellAllowlist, - hasDurableExecApproval, requiresExecApproval, resolveExecApprovalAllowedDecisions, - resolveExecApprovalsFromFile, } from "../infra/exec-approvals.js"; -import { - describeInterpreterInlineEval, - detectInterpreterInlineEvalArgv, -} from "../infra/exec-inline-eval.js"; -import { buildNodeShellCommand } from "../infra/node-shell.js"; -import { parsePreparedSystemRunPayload } from "../infra/system-run-approval-context.js"; import { buildExecApprovalRequesterContext, buildExecApprovalTurnSourceContext, registerExecApprovalRequestForHostOrThrow, } from "./bash-tools.exec-approval-request.js"; +import { + analyzeNodeApprovalRequirement, + buildNodeSystemRunInvoke, + formatNodeRunToolResult, + invokeNodeSystemRunDirect, + prepareNodeSystemRun, + resolveNodeExecutionTarget, + shouldSkipNodeApprovalPrepare, +} from "./bash-tools.exec-host-node-phases.js"; import * as execHostShared from "./bash-tools.exec-host-shared.js"; import { DEFAULT_NOTIFY_TAIL_CHARS, @@ -29,7 +27,6 @@ import { } from "./bash-tools.exec-runtime.js"; import type { ExecToolDetails } from "./bash-tools.exec-types.js"; import { callGatewayTool } from "./tools/gateway.js"; -import { listNodes, resolveNodeIdFromList } from "./tools/nodes-utils.js"; export type ExecuteNodeHostCommandParams = { command: string; @@ -66,132 +63,27 @@ export async function executeNodeHostCommand( ask: params.ask, host: "node", }); - if (params.boundNode && params.requestedNode && params.boundNode !== params.requestedNode) { - throw new Error(`exec node not allowed (bound to ${params.boundNode})`); + const target = await resolveNodeExecutionTarget(params); + if ( + shouldSkipNodeApprovalPrepare({ + hostSecurity, + hostAsk, + strictInlineEval: params.strictInlineEval, + }) + ) { + return await invokeNodeSystemRunDirect({ request: params, target }); } - const nodeQuery = params.boundNode || params.requestedNode; - const nodes = await listNodes({}); - if (nodes.length === 0) { - throw new Error( - "exec host=node requires a paired node (none available). This requires a companion app or node host.", - ); - } - let nodeId: string; - try { - nodeId = resolveNodeIdFromList(nodes, nodeQuery, !nodeQuery); - } catch (err) { - if (!nodeQuery && String(err).includes("node required")) { - throw new Error( - "exec host=node requires a node id when multiple nodes are available (set tools.exec.node or exec.node).", - { cause: err }, - ); - } - throw err; - } - const nodeInfo = nodes.find((entry) => entry.nodeId === nodeId); - const supportsSystemRun = Array.isArray(nodeInfo?.commands) - ? nodeInfo?.commands?.includes("system.run") - : false; - if (!supportsSystemRun) { - throw new Error( - "exec host=node requires a node that supports system.run (companion app or node host).", - ); - } - const argv = buildNodeShellCommand(params.command, nodeInfo?.platform); - const prepareRaw = await callGatewayTool( - "node.invoke", - { timeoutMs: 15_000 }, - { - nodeId, - command: "system.run.prepare", - params: { - command: argv, - rawCommand: params.command, - ...(params.workdir != null ? { cwd: params.workdir } : {}), - agentId: params.agentId, - sessionKey: params.sessionKey, - }, - idempotencyKey: crypto.randomUUID(), - }, - ); - const prepared = parsePreparedSystemRunPayload(prepareRaw?.payload); - if (!prepared) { - throw new Error("invalid system.run.prepare response"); - } - const runArgv = prepared.plan.argv; - const runRawCommand = prepared.plan.commandText; - const runCwd = prepared.plan.cwd ?? params.workdir; - const runAgentId = prepared.plan.agentId ?? params.agentId; - const runSessionKey = prepared.plan.sessionKey ?? params.sessionKey; - const nodeEnv = params.requestedEnv ? { ...params.requestedEnv } : undefined; - const baseAllowlistEval = evaluateShellAllowlist({ - command: params.command, - allowlist: [], - safeBins: new Set(), - cwd: params.workdir, - env: params.env, - platform: nodeInfo?.platform, - trustedSafeBinDirs: params.trustedSafeBinDirs, + const prepared = await prepareNodeSystemRun({ request: params, target }); + const approvalAnalysis = await analyzeNodeApprovalRequirement({ + request: params, + target, + prepared, + hostSecurity, + hostAsk, }); - let analysisOk = baseAllowlistEval.analysisOk; - let allowlistSatisfied = false; - let durableApprovalSatisfied = false; - const inlineEvalHit = - params.strictInlineEval === true - ? (baseAllowlistEval.segments - .map((segment) => - detectInterpreterInlineEvalArgv(segment.resolution?.effectiveArgv ?? segment.argv), - ) - .find((entry) => entry !== null) ?? null) - : null; - if (inlineEvalHit) { - params.warnings.push( - `Warning: strict inline-eval mode requires explicit approval for ${describeInterpreterInlineEval( - inlineEvalHit, - )}.`, - ); - } - if ((hostAsk === "always" || hostSecurity === "allowlist") && analysisOk) { - try { - const approvalsSnapshot = await callGatewayTool<{ file: string }>( - "exec.approvals.node.get", - { timeoutMs: 10_000 }, - { nodeId }, - ); - const approvalsFile = - approvalsSnapshot && typeof approvalsSnapshot === "object" - ? approvalsSnapshot.file - : undefined; - if (approvalsFile && typeof approvalsFile === "object") { - const resolved = resolveExecApprovalsFromFile({ - file: approvalsFile as ExecApprovalsFile, - agentId: params.agentId, - overrides: { security: "full" }, - }); - // Allowlist-only precheck; safe bins are node-local and may diverge. - const allowlistEval = evaluateShellAllowlist({ - command: params.command, - allowlist: resolved.allowlist, - safeBins: new Set(), - cwd: params.workdir, - env: params.env, - platform: nodeInfo?.platform, - trustedSafeBinDirs: params.trustedSafeBinDirs, - }); - durableApprovalSatisfied = hasDurableExecApproval({ - analysisOk: allowlistEval.analysisOk, - segmentAllowlistEntries: allowlistEval.segmentAllowlistEntries, - allowlist: resolved.allowlist, - commandText: runRawCommand, - }); - allowlistSatisfied = allowlistEval.allowlistSatisfied; - analysisOk = allowlistEval.analysisOk; - } - } catch { - // Fall back to requiring approval if node approvals cannot be fetched. - } - } + const { analysisOk, allowlistSatisfied, durableApprovalSatisfied, inlineEvalHit } = + approvalAnalysis; const requiresAsk = requiresExecApproval({ ask: hostAsk, @@ -200,40 +92,6 @@ export async function executeNodeHostCommand( allowlistSatisfied, durableApprovalSatisfied, }) || inlineEvalHit !== null; - const invokeTimeoutMs = Math.max( - 10_000, - (typeof params.timeoutSec === "number" ? params.timeoutSec : params.defaultTimeoutSec) * 1000 + - 5_000, - ); - const buildInvokeParams = ( - approvedByAsk: boolean, - approvalDecision: "allow-once" | "allow-always" | null, - runId?: string, - suppressNotifyOnExit?: boolean, - ) => - ({ - nodeId, - command: "system.run", - params: { - command: runArgv, - rawCommand: runRawCommand, - systemRunPlan: prepared.plan, - cwd: runCwd, - env: nodeEnv, - timeoutMs: typeof params.timeoutSec === "number" ? params.timeoutSec * 1000 : undefined, - agentId: runAgentId, - sessionKey: runSessionKey, - approved: approvedByAsk, - approvalDecision: - approvalDecision === "allow-always" && inlineEvalHit !== null - ? "allow-once" - : (approvalDecision ?? undefined), - runId: runId ?? undefined, - suppressNotifyOnExit: - suppressNotifyOnExit === true || params.notifyOnExit === false ? true : undefined, - }, - idempotencyKey: crypto.randomUUID(), - }) satisfies Record; let inlineApprovedByAsk = false; let inlineApprovalDecision: "allow-once" | "allow-always" | null = null; @@ -250,15 +108,15 @@ export async function executeNodeHostCommand( await registerExecApprovalRequestForHostOrThrow({ approvalId, systemRunPlan: prepared.plan, - env: nodeEnv, - workdir: runCwd, + env: target.env, + workdir: prepared.cwd, host: "node", - nodeId, + nodeId: target.nodeId, security: hostSecurity, ask: hostAsk, ...buildExecApprovalRequesterContext({ - agentId: runAgentId, - sessionKey: runSessionKey, + agentId: prepared.agentId, + sessionKey: prepared.sessionKey, }), ...buildExecApprovalTurnSourceContext(params), }); @@ -324,7 +182,7 @@ export async function executeNodeHostCommand( onFailure: () => void execHostShared.sendExecApprovalFollowupResult( followupTarget, - `Exec denied (node=${nodeId} id=${approvalId}, approval-request-failed): ${params.command}`, + `Exec denied (node=${target.nodeId} id=${approvalId}, approval-request-failed): ${params.command}`, ), }); if (decision === undefined) { @@ -366,7 +224,7 @@ export async function executeNodeHostCommand( if (deniedReason) { await execHostShared.sendExecApprovalFollowupResult( followupTarget, - `Exec denied (node=${nodeId} id=${approvalId}, ${deniedReason}): ${params.command}`, + `Exec denied (node=${target.nodeId} id=${approvalId}, ${deniedReason}): ${params.command}`, ); return; } @@ -374,8 +232,25 @@ export async function executeNodeHostCommand( try { const raw = await callGatewayTool( "node.invoke", - { timeoutMs: invokeTimeoutMs }, - buildInvokeParams(approvedByAsk, approvalDecision, approvalId, true), + { timeoutMs: target.invokeTimeoutMs }, + buildNodeSystemRunInvoke({ + target, + command: prepared.argv, + rawCommand: prepared.rawCommand, + cwd: prepared.cwd, + timeoutSec: params.timeoutSec, + agentId: prepared.agentId, + sessionKey: prepared.sessionKey, + approved: approvedByAsk, + approvalDecision: + approvalDecision === "allow-always" && inlineEvalHit !== null + ? "allow-once" + : approvalDecision, + runId: approvalId, + suppressNotifyOnExit: true, + notifyOnExit: params.notifyOnExit, + systemRunPlan: prepared.plan, + }), ); const payload = raw?.payload && typeof raw.payload === "object" @@ -393,13 +268,13 @@ export async function executeNodeHostCommand( const output = normalizeNotifyOutput(combined.slice(-DEFAULT_NOTIFY_TAIL_CHARS)); const exitLabel = payload.timedOut ? "timeout" : `code ${payload.exitCode ?? "?"}`; const summary = output - ? `Exec finished (node=${nodeId} id=${approvalId}, ${exitLabel})\n${output}` - : `Exec finished (node=${nodeId} id=${approvalId}, ${exitLabel})`; + ? `Exec finished (node=${target.nodeId} id=${approvalId}, ${exitLabel})\n${output}` + : `Exec finished (node=${target.nodeId} id=${approvalId}, ${exitLabel})`; await execHostShared.sendExecApprovalFollowupResult(followupTarget, summary); } catch { await execHostShared.sendExecApprovalFollowupResult( followupTarget, - `Exec denied (node=${nodeId} id=${approvalId}, invoke-failed): ${params.command}`, + `Exec denied (node=${target.nodeId} id=${approvalId}, invoke-failed): ${params.command}`, ); } })(); @@ -416,7 +291,7 @@ export async function executeNodeHostCommand( sentApproverDms, unavailableReason, allowedDecisions: resolveExecApprovalAllowedDecisions({ ask: hostAsk }), - nodeId, + nodeId: target.nodeId, }); } } @@ -424,31 +299,21 @@ export async function executeNodeHostCommand( const startedAt = Date.now(); const raw = await callGatewayTool( "node.invoke", - { timeoutMs: invokeTimeoutMs }, - buildInvokeParams(inlineApprovedByAsk, inlineApprovalDecision, inlineApprovalId), + { timeoutMs: target.invokeTimeoutMs }, + buildNodeSystemRunInvoke({ + target, + command: prepared.argv, + rawCommand: prepared.rawCommand, + cwd: prepared.cwd, + timeoutSec: params.timeoutSec, + agentId: prepared.agentId, + sessionKey: prepared.sessionKey, + approved: inlineApprovedByAsk, + approvalDecision: inlineApprovalDecision, + runId: inlineApprovalId, + notifyOnExit: params.notifyOnExit, + systemRunPlan: prepared.plan, + }), ); - const payload = - raw && typeof raw === "object" ? (raw as { payload?: unknown }).payload : undefined; - const payloadObj = - payload && typeof payload === "object" ? (payload as Record) : {}; - const stdout = typeof payloadObj.stdout === "string" ? payloadObj.stdout : ""; - const stderr = typeof payloadObj.stderr === "string" ? payloadObj.stderr : ""; - const errorText = typeof payloadObj.error === "string" ? payloadObj.error : ""; - const success = typeof payloadObj.success === "boolean" ? payloadObj.success : false; - const exitCode = typeof payloadObj.exitCode === "number" ? payloadObj.exitCode : null; - return { - content: [ - { - type: "text", - text: stdout || stderr || errorText || "", - }, - ], - details: { - status: success ? "completed" : "failed", - exitCode, - durationMs: Date.now() - startedAt, - aggregated: [stdout, stderr, errorText].filter(Boolean).join("\n"), - cwd: params.workdir, - } satisfies ExecToolDetails, - }; + return formatNodeRunToolResult({ raw, startedAt, cwd: params.workdir }); } From 92c1924d27a656f887b376a5d8b7e44ed17bf153 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 01:36:45 +0100 Subject: [PATCH 128/418] ci: remove duplicate extension fast lane --- .github/workflows/ci.yml | 133 ------------------------------------ docs/ci.md | 20 +++--- docs/reference/RELEASING.md | 5 +- 3 files changed, 11 insertions(+), 147 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e005e97a400..540b4d5e563 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -38,8 +38,6 @@ jobs: run_skills_python: ${{ steps.manifest.outputs.run_skills_python }} run_skills_python_job: ${{ steps.manifest.outputs.run_skills_python_job }} run_windows: ${{ steps.manifest.outputs.run_windows }} - has_changed_extensions: ${{ steps.manifest.outputs.has_changed_extensions }} - changed_extensions_matrix: ${{ steps.manifest.outputs.changed_extensions_matrix }} run_build_artifacts: ${{ steps.manifest.outputs.run_build_artifacts }} run_checks_fast_core: ${{ steps.manifest.outputs.run_checks_fast_core }} run_checks_fast: ${{ steps.manifest.outputs.run_checks_fast }} @@ -52,8 +50,6 @@ jobs: checks_node_core_nondist_matrix: ${{ steps.manifest.outputs.checks_node_core_nondist_matrix }} run_checks_node_core_dist: ${{ steps.manifest.outputs.run_checks_node_core_dist }} checks_node_core_dist_matrix: ${{ steps.manifest.outputs.checks_node_core_dist_matrix }} - run_extension_fast: ${{ steps.manifest.outputs.run_extension_fast }} - extension_fast_matrix: ${{ steps.manifest.outputs.extension_fast_matrix }} run_check: ${{ steps.manifest.outputs.run_check }} run_check_additional: ${{ steps.manifest.outputs.run_check_additional }} run_build_smoke: ${{ steps.manifest.outputs.run_build_smoke }} @@ -102,29 +98,6 @@ jobs: node scripts/ci-changed-scope.mjs --base "$BASE" --head HEAD - - name: Detect changed extensions - id: changed_extensions - if: github.event_name != 'workflow_dispatch' && steps.docs_scope.outputs.docs_only != 'true' && steps.changed_scope.outputs.run_node == 'true' - env: - BASE_SHA: ${{ github.event_name == 'push' && github.event.before || github.event.pull_request.base.sha }} - BASE_REF: ${{ github.event_name == 'push' && github.ref_name || github.event.pull_request.base.ref }} - run: | - node --input-type=module <<'EOF' - import { appendFileSync } from "node:fs"; - import { listChangedExtensionIds } from "./scripts/lib/changed-extensions.mjs"; - - const extensionIds = listChangedExtensionIds({ - base: process.env.BASE_SHA, - head: "HEAD", - fallbackBaseRef: process.env.BASE_REF, - unavailableBaseBehavior: "all", - }); - const matrix = JSON.stringify({ include: extensionIds.map((extension) => ({ extension })) }); - - appendFileSync(process.env.GITHUB_OUTPUT, `has_changed_extensions=${extensionIds.length > 0}\n`, "utf8"); - appendFileSync(process.env.GITHUB_OUTPUT, `changed_extensions_matrix=${matrix}\n`, "utf8"); - EOF - - name: Build CI manifest id: manifest env: @@ -139,8 +112,6 @@ jobs: OPENCLAW_CI_RUN_NODE_FAST_CI_ROUTING: ${{ github.event_name == 'workflow_dispatch' && 'false' || steps.changed_scope.outputs.run_node_fast_ci_routing || 'false' }} OPENCLAW_CI_RUN_SKILLS_PYTHON: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.changed_scope.outputs.run_skills_python || 'false' }} OPENCLAW_CI_RUN_CONTROL_UI_I18N: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.changed_scope.outputs.run_control_ui_i18n || 'false' }} - OPENCLAW_CI_HAS_CHANGED_EXTENSIONS: ${{ github.event_name == 'workflow_dispatch' && 'false' || steps.changed_extensions.outputs.has_changed_extensions || 'false' }} - OPENCLAW_CI_CHANGED_EXTENSIONS_MATRIX: ${{ github.event_name == 'workflow_dispatch' && '{"include":[]}' || steps.changed_extensions.outputs.changed_extensions_matrix || '{"include":[]}' }} OPENCLAW_CI_REPOSITORY: ${{ github.repository }} run: | node --input-type=module <<'EOF' @@ -164,18 +135,8 @@ jobs: return fallback; }; - const parseJson = (value, fallback) => { - try { - return value ? JSON.parse(value) : fallback; - } catch { - return fallback; - } - }; - const createMatrix = (include) => ({ include }); const outputPath = process.env.GITHUB_OUTPUT; - const eventName = process.env.GITHUB_EVENT_NAME ?? "pull_request"; - const isPush = eventName === "push"; const isCanonicalRepository = process.env.OPENCLAW_CI_REPOSITORY === "openclaw/openclaw"; const docsOnly = parseBoolean(process.env.OPENCLAW_CI_DOCS_ONLY); const docsChanged = parseBoolean(process.env.OPENCLAW_CI_DOCS_CHANGED); @@ -200,11 +161,6 @@ jobs: const runSkillsPython = parseBoolean(process.env.OPENCLAW_CI_RUN_SKILLS_PYTHON) && !docsOnly; const runControlUiI18n = parseBoolean(process.env.OPENCLAW_CI_RUN_CONTROL_UI_I18N) && !docsOnly; - const hasChangedExtensions = - parseBoolean(process.env.OPENCLAW_CI_HAS_CHANGED_EXTENSIONS) && !docsOnly; - const changedExtensionsMatrix = hasChangedExtensions - ? parseJson(process.env.OPENCLAW_CI_CHANGED_EXTENSIONS_MATRIX, { include: [] }) - : { include: [] }; const extensionTestShardCount = isCanonicalRepository ? DEFAULT_EXTENSION_TEST_SHARD_COUNT : Math.max(DEFAULT_EXTENSION_TEST_SHARD_COUNT, 36); @@ -274,8 +230,6 @@ jobs: run_android: runAndroid, run_skills_python: runSkillsPython, run_windows: runWindows, - has_changed_extensions: hasChangedExtensions, - changed_extensions_matrix: changedExtensionsMatrix, run_build_artifacts: runNodeFull, run_checks_fast_core: runChecksFastCore, run_checks_fast: runNodeFull, @@ -296,15 +250,6 @@ jobs: checks_node_core_nondist_matrix: createMatrix(nodeTestNonDistShards), run_checks_node_core_dist: nodeTestDistShards.length > 0, checks_node_core_dist_matrix: createMatrix(nodeTestDistShards), - run_extension_fast: hasChangedExtensions && !isPush, - extension_fast_matrix: createMatrix( - hasChangedExtensions && !isPush - ? (changedExtensionsMatrix.include ?? []).map((entry) => ({ - check_name: `extension-fast-${entry.extension}`, - extension: entry.extension, - })) - : [], - ), run_check: runNodeFull, run_check_additional: runNodeFull, run_build_smoke: runNodeFull, @@ -1326,84 +1271,6 @@ jobs: exit 1 fi - extension-fast: - permissions: - contents: read - name: "extension-fast" - needs: [preflight] - if: needs.preflight.outputs.run_extension_fast == 'true' - runs-on: ${{ github.repository == 'openclaw/openclaw' && 'blacksmith-8vcpu-ubuntu-2404' || 'ubuntu-24.04' }} - timeout-minutes: 60 - strategy: - fail-fast: false - matrix: ${{ fromJson(needs.preflight.outputs.extension_fast_matrix) }} - steps: - - name: Checkout - shell: bash - env: - CHECKOUT_REPO: ${{ github.repository }} - CHECKOUT_SHA: ${{ github.sha }} - CHECKOUT_TOKEN: ${{ github.token }} - run: | - set -euo pipefail - - workdir="$GITHUB_WORKSPACE" - auth_header="$(printf 'x-access-token:%s' "$CHECKOUT_TOKEN" | base64 | tr -d '\n')" - - reset_checkout_dir() { - mkdir -p "$workdir" - find "$workdir" -mindepth 1 -maxdepth 1 -exec rm -rf {} + - } - - checkout_attempt() { - local attempt="$1" - - reset_checkout_dir - git init "$workdir" >/dev/null - git config --global --add safe.directory "$workdir" - git -C "$workdir" remote add origin "https://github.com/${CHECKOUT_REPO}" - git -C "$workdir" config gc.auto 0 - - timeout --signal=TERM 30s git -C "$workdir" \ - -c protocol.version=2 \ - -c "http.https://github.com/.extraheader=AUTHORIZATION: basic ${auth_header}" \ - fetch --no-tags --prune --no-recurse-submodules --depth=1 origin \ - "+${CHECKOUT_SHA}:refs/remotes/origin/ci-target" || return 1 - - git -C "$workdir" checkout --force --detach "$CHECKOUT_SHA" || return 1 - test -f "$workdir/.github/actions/setup-node-env/action.yml" || return 1 - echo "checkout attempt ${attempt}/5 succeeded" - } - - for attempt in 1 2 3 4 5; do - if checkout_attempt "$attempt"; then - exit 0 - fi - echo "checkout attempt ${attempt}/5 failed" - sleep $((attempt * 5)) - done - - echo "checkout failed after 5 attempts" >&2 - exit 1 - - - name: Setup Node environment - uses: ./.github/actions/setup-node-env - with: - install-bun: "false" - - - name: Run changed extension tests - env: - OPENCLAW_CHANGED_EXTENSION: ${{ matrix.extension }} - run: | - set -euo pipefail - if [ "$OPENCLAW_CHANGED_EXTENSION" = "telegram" ]; then - export OPENCLAW_VITEST_MAX_WORKERS=1 - export NODE_OPTIONS="${NODE_OPTIONS:+$NODE_OPTIONS }--max-old-space-size=6144" - pnpm test:extension "$OPENCLAW_CHANGED_EXTENSION" -- --pool=forks - exit 0 - fi - pnpm test:extension "$OPENCLAW_CHANGED_EXTENSION" - # Types, lint, and format check shards. check-shard: permissions: diff --git a/docs/ci.md b/docs/ci.md index 070e744e576..0ec0e3210a8 100644 --- a/docs/ci.md +++ b/docs/ci.md @@ -66,11 +66,11 @@ gh workflow run duplicate-after-merge.yml \ | `checks-fast-contracts-channels` | Sharded channel contract checks with a stable aggregate check result | Node-relevant changes | | `checks-node-extensions` | Full bundled-plugin test shards across the extension suite | Node-relevant changes | | `checks-node-core-test` | Core Node test shards, excluding channel, bundled, contract, and extension lanes | Node-relevant changes | -| `extension-fast` | Focused tests for only the changed bundled plugins | Pull requests with extension changes | | `check` | Sharded main local gate equivalent: prod types, lint, guards, test types, and strict smoke | Node-relevant changes | | `check-additional` | Architecture, boundary, extension-surface guards, package-boundary, and gateway-watch shards | Node-relevant changes | | `build-smoke` | Built-CLI smoke tests and startup-memory smoke | Node-relevant changes | -| `checks` | Verifier for built-artifact channel tests plus push-only Node 22 compatibility | Node-relevant changes | +| `checks` | Verifier for built-artifact channel tests | Node-relevant changes | +| `checks-node-compat-node22` | Node 22 compatibility build and smoke lane | `main` pushes and manual CI dispatch | | `check-docs` | Docs formatting, lint, and broken-link checks | Docs changed | | `skills-python` | Ruff + pytest for Python-backed skills | Python-skill-relevant changes | | `checks-windows` | Windows-specific test lanes | Windows-relevant changes | @@ -81,12 +81,10 @@ gh workflow run duplicate-after-merge.yml \ Manual CI dispatches run the same job graph as normal CI but force every scoped lane on: Linux Node shards, bundled-plugin shards, channel contracts, -`check`, `check-additional`, build smoke, docs checks, Python skills, Windows, -macOS, Android, and Control UI i18n. They do not run the PR-only -`extension-fast` lane because the full bundled-plugin shard matrix already -covers bundled-plugin tests. Manual runs use a unique concurrency group so a -release-candidate full suite is not cancelled by another push or PR run on the -same ref. +Node 22 compatibility, `check`, `check-additional`, build smoke, docs checks, +Python skills, Windows, macOS, Android, and Control UI i18n. Manual runs use a +unique concurrency group so a release-candidate full suite is not cancelled by +another push or PR run on the same ref. ```bash gh workflow run ci.yml --ref release/YYYY.M.D @@ -99,7 +97,7 @@ Jobs are ordered so cheap checks fail before expensive ones run: 1. `preflight` decides which lanes exist at all. The `docs-scope` and `changed-scope` logic are steps inside this job, not standalone jobs. 2. `security-scm-fast`, `security-dependency-audit`, `security-fast`, `check`, `check-additional`, `check-docs`, and `skills-python` fail quickly without waiting on the heavier artifact and platform matrix jobs. 3. `build-artifacts` overlaps with the fast Linux lanes so downstream consumers can start as soon as the shared build is ready. -4. Heavier platform and runtime lanes fan out after that: `checks-fast-core`, `checks-fast-contracts-channels`, `checks-node-extensions`, `checks-node-core-test`, PR-only `extension-fast`, `checks`, `checks-windows`, `macos-node`, `macos-swift`, and `android`. +4. Heavier platform and runtime lanes fan out after that: `checks-fast-core`, `checks-fast-contracts-channels`, `checks-node-extensions`, `checks-node-core-test`, `checks`, `checks-windows`, `macos-node`, `macos-swift`, and `android`. Scope logic lives in `scripts/ci-changed-scope.mjs` and is covered by unit tests in `src/scripts/ci-changed-scope.test.ts`. Manual dispatch skips changed-scope detection and makes the preflight manifest @@ -111,12 +109,10 @@ The separate `install-smoke` workflow reuses the same scope script through its o Local changed-lane logic lives in `scripts/changed-lanes.mjs` and is executed by `scripts/check-changed.mjs`. That local check gate is stricter about architecture boundaries than the broad CI platform scope: core production changes run core prod and core test typecheck plus core lint/guards, core test-only changes run only core test typecheck plus core lint, extension production changes run extension prod and extension test typecheck plus extension lint, and extension test-only changes run extension test typecheck plus extension lint. Public Plugin SDK or plugin-contract changes expand to extension typecheck because extensions depend on those core contracts, but Vitest extension sweeps are explicit test work. Release metadata-only version bumps run targeted version/config/root-dependency checks. Unknown root/config changes fail safe to all check lanes. -On pushes, the `checks` matrix adds the push-only `compat-node22` lane. On pull requests, that lane is skipped and the matrix stays focused on the normal test/channel lanes. +On pushes and manual dispatches, `checks-node-compat-node22` runs the Node 22 compatibility build/smoke lane. On pull requests, that lane is skipped and the matrix stays focused on the normal Node 24 test/channel lanes. The slowest Node test families are split or balanced so each job stays small without over-reserving runners: channel contracts run as three weighted shards, bundled plugin tests balance across six extension workers, small core unit lanes are paired, auto-reply runs as four balanced workers with the reply subtree split into agent-runner, dispatch, and commands/state-routing shards, and agentic gateway/plugin configs are spread across the existing source-only agentic Node jobs instead of waiting on built artifacts. Broad browser, QA, media, and miscellaneous plugin tests use their dedicated Vitest configs instead of the shared plugin catch-all. Extension shard jobs run up to two plugin config groups at a time with one Vitest worker per group and a larger Node heap so import-heavy plugin batches do not create extra CI jobs. The broad agents lane uses the shared Vitest file-parallel scheduler because it is import/scheduling dominated rather than owned by a single slow test file. `runtime-config` runs with the infra core-runtime shard to keep the shared runtime shard from owning the tail. Include-pattern shards record timing entries using the CI shard name, so `.artifacts/vitest-shard-timings.json` can distinguish a whole config from a filtered shard. `check-additional` keeps package-boundary compile/canary work together and separates runtime topology architecture from gateway watch coverage; the boundary guard shard runs its small independent guards concurrently inside one job. Gateway watch, channel tests, and the core support-boundary shard run concurrently inside `build-artifacts` after `dist/` and `dist-runtime/` are already built, keeping their old check names as lightweight verifier jobs while avoiding two extra Blacksmith workers and a second artifact-consumer queue. Android CI runs both `testPlayDebugUnitTest` and `testThirdPartyDebugUnitTest`, then builds the Play debug APK. The third-party flavor has no separate source set or manifest; its unit-test lane still compiles that flavor with the SMS/call-log BuildConfig flags, while avoiding a duplicate debug APK packaging job on every Android-relevant push. -`extension-fast` is PR-only because push runs already execute the full bundled plugin shards. That keeps changed-plugin feedback for reviews without reserving an extra Blacksmith worker on `main` for coverage already present in `checks-node-extensions`. - GitHub may mark superseded jobs as `cancelled` when a newer push lands on the same PR or `main` ref. Treat that as CI noise unless the newest run for the same ref is also failing. Aggregate shard checks use `!cancelled() && always()` so they still report normal shard failures but do not queue after the whole workflow has already been superseded. The automatic CI concurrency key is versioned (`CI-v7-*`) so a GitHub-side zombie in an old queue group cannot indefinitely block newer main runs. Manual full-suite runs use `CI-manual-v1-*` and do not cancel in-progress runs. diff --git a/docs/reference/RELEASING.md b/docs/reference/RELEASING.md index ea0f9deec96..dfec8dc506a 100644 --- a/docs/reference/RELEASING.md +++ b/docs/reference/RELEASING.md @@ -52,8 +52,9 @@ OpenClaw has three public release lanes: - Run the manual `CI` workflow before release approval when you need full normal CI coverage for the release candidate. Manual CI dispatches bypass changed scoping and force the Linux Node shards, bundled-plugin shards, channel - contracts, `check`, `check-additional`, build smoke, docs checks, Python - skills, Windows, macOS, Android, and Control UI i18n lanes. + contracts, Node 22 compatibility, `check`, `check-additional`, build smoke, + docs checks, Python skills, Windows, macOS, Android, and Control UI i18n + lanes. Example: `gh workflow run ci.yml --ref release/YYYY.M.D` - Run `pnpm qa:otel:smoke` when validating release telemetry. It exercises QA-lab through a local OTLP/HTTP receiver and verifies the exported trace From b109c1f99c6efdc7cce9a7f812cf26c5ec307e36 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 01:39:32 +0100 Subject: [PATCH 129/418] ci: limit node 22 compatibility to manual ci --- .github/workflows/ci.yml | 2 +- docs/ci.md | 48 ++++++++++++++++++++-------------------- 2 files changed, 25 insertions(+), 25 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 540b4d5e563..89823c371cd 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1032,7 +1032,7 @@ jobs: contents: read name: checks-node-compat-node22 needs: [preflight] - if: needs.preflight.outputs.run_build_artifacts == 'true' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') + if: needs.preflight.outputs.run_build_artifacts == 'true' && github.event_name == 'workflow_dispatch' runs-on: ${{ github.repository == 'openclaw/openclaw' && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-24.04' }} timeout-minutes: 60 steps: diff --git a/docs/ci.md b/docs/ci.md index 0ec0e3210a8..6e420b6481f 100644 --- a/docs/ci.md +++ b/docs/ci.md @@ -55,29 +55,29 @@ gh workflow run duplicate-after-merge.yml \ ## Job Overview -| Job | Purpose | When it runs | -| -------------------------------- | -------------------------------------------------------------------------------------------- | ------------------------------------ | -| `preflight` | Detect docs-only changes, changed scopes, changed extensions, and build the CI manifest | Always on non-draft pushes and PRs | -| `security-scm-fast` | Private key detection and workflow audit via `zizmor` | Always on non-draft pushes and PRs | -| `security-dependency-audit` | Dependency-free production lockfile audit against npm advisories | Always on non-draft pushes and PRs | -| `security-fast` | Required aggregate for the fast security jobs | Always on non-draft pushes and PRs | -| `build-artifacts` | Build `dist/`, Control UI, built-artifact checks, and reusable downstream artifacts | Node-relevant changes | -| `checks-fast-core` | Fast Linux correctness lanes such as bundled/plugin-contract/protocol checks | Node-relevant changes | -| `checks-fast-contracts-channels` | Sharded channel contract checks with a stable aggregate check result | Node-relevant changes | -| `checks-node-extensions` | Full bundled-plugin test shards across the extension suite | Node-relevant changes | -| `checks-node-core-test` | Core Node test shards, excluding channel, bundled, contract, and extension lanes | Node-relevant changes | -| `check` | Sharded main local gate equivalent: prod types, lint, guards, test types, and strict smoke | Node-relevant changes | -| `check-additional` | Architecture, boundary, extension-surface guards, package-boundary, and gateway-watch shards | Node-relevant changes | -| `build-smoke` | Built-CLI smoke tests and startup-memory smoke | Node-relevant changes | -| `checks` | Verifier for built-artifact channel tests | Node-relevant changes | -| `checks-node-compat-node22` | Node 22 compatibility build and smoke lane | `main` pushes and manual CI dispatch | -| `check-docs` | Docs formatting, lint, and broken-link checks | Docs changed | -| `skills-python` | Ruff + pytest for Python-backed skills | Python-skill-relevant changes | -| `checks-windows` | Windows-specific test lanes | Windows-relevant changes | -| `macos-node` | macOS TypeScript test lane using the shared built artifacts | macOS-relevant changes | -| `macos-swift` | Swift lint, build, and tests for the macOS app | macOS-relevant changes | -| `android` | Android unit tests for both flavors plus one debug APK build | Android-relevant changes | -| `test-performance-agent` | Daily Codex slow-test optimization after trusted activity | Main CI success or manual dispatch | +| Job | Purpose | When it runs | +| -------------------------------- | -------------------------------------------------------------------------------------------- | ---------------------------------- | +| `preflight` | Detect docs-only changes, changed scopes, changed extensions, and build the CI manifest | Always on non-draft pushes and PRs | +| `security-scm-fast` | Private key detection and workflow audit via `zizmor` | Always on non-draft pushes and PRs | +| `security-dependency-audit` | Dependency-free production lockfile audit against npm advisories | Always on non-draft pushes and PRs | +| `security-fast` | Required aggregate for the fast security jobs | Always on non-draft pushes and PRs | +| `build-artifacts` | Build `dist/`, Control UI, built-artifact checks, and reusable downstream artifacts | Node-relevant changes | +| `checks-fast-core` | Fast Linux correctness lanes such as bundled/plugin-contract/protocol checks | Node-relevant changes | +| `checks-fast-contracts-channels` | Sharded channel contract checks with a stable aggregate check result | Node-relevant changes | +| `checks-node-extensions` | Full bundled-plugin test shards across the extension suite | Node-relevant changes | +| `checks-node-core-test` | Core Node test shards, excluding channel, bundled, contract, and extension lanes | Node-relevant changes | +| `check` | Sharded main local gate equivalent: prod types, lint, guards, test types, and strict smoke | Node-relevant changes | +| `check-additional` | Architecture, boundary, extension-surface guards, package-boundary, and gateway-watch shards | Node-relevant changes | +| `build-smoke` | Built-CLI smoke tests and startup-memory smoke | Node-relevant changes | +| `checks` | Verifier for built-artifact channel tests | Node-relevant changes | +| `checks-node-compat-node22` | Node 22 compatibility build and smoke lane | Manual CI dispatch for releases | +| `check-docs` | Docs formatting, lint, and broken-link checks | Docs changed | +| `skills-python` | Ruff + pytest for Python-backed skills | Python-skill-relevant changes | +| `checks-windows` | Windows-specific test lanes | Windows-relevant changes | +| `macos-node` | macOS TypeScript test lane using the shared built artifacts | macOS-relevant changes | +| `macos-swift` | Swift lint, build, and tests for the macOS app | macOS-relevant changes | +| `android` | Android unit tests for both flavors plus one debug APK build | Android-relevant changes | +| `test-performance-agent` | Daily Codex slow-test optimization after trusted activity | Main CI success or manual dispatch | Manual CI dispatches run the same job graph as normal CI but force every scoped lane on: Linux Node shards, bundled-plugin shards, channel contracts, @@ -109,7 +109,7 @@ The separate `install-smoke` workflow reuses the same scope script through its o Local changed-lane logic lives in `scripts/changed-lanes.mjs` and is executed by `scripts/check-changed.mjs`. That local check gate is stricter about architecture boundaries than the broad CI platform scope: core production changes run core prod and core test typecheck plus core lint/guards, core test-only changes run only core test typecheck plus core lint, extension production changes run extension prod and extension test typecheck plus extension lint, and extension test-only changes run extension test typecheck plus extension lint. Public Plugin SDK or plugin-contract changes expand to extension typecheck because extensions depend on those core contracts, but Vitest extension sweeps are explicit test work. Release metadata-only version bumps run targeted version/config/root-dependency checks. Unknown root/config changes fail safe to all check lanes. -On pushes and manual dispatches, `checks-node-compat-node22` runs the Node 22 compatibility build/smoke lane. On pull requests, that lane is skipped and the matrix stays focused on the normal Node 24 test/channel lanes. +Manual CI dispatches run `checks-node-compat-node22` as release-candidate compatibility coverage. Normal pull requests and `main` pushes skip that lane and keep the matrix focused on the Node 24 test/channel lanes. The slowest Node test families are split or balanced so each job stays small without over-reserving runners: channel contracts run as three weighted shards, bundled plugin tests balance across six extension workers, small core unit lanes are paired, auto-reply runs as four balanced workers with the reply subtree split into agent-runner, dispatch, and commands/state-routing shards, and agentic gateway/plugin configs are spread across the existing source-only agentic Node jobs instead of waiting on built artifacts. Broad browser, QA, media, and miscellaneous plugin tests use their dedicated Vitest configs instead of the shared plugin catch-all. Extension shard jobs run up to two plugin config groups at a time with one Vitest worker per group and a larger Node heap so import-heavy plugin batches do not create extra CI jobs. The broad agents lane uses the shared Vitest file-parallel scheduler because it is import/scheduling dominated rather than owned by a single slow test file. `runtime-config` runs with the infra core-runtime shard to keep the shared runtime shard from owning the tail. Include-pattern shards record timing entries using the CI shard name, so `.artifacts/vitest-shard-timings.json` can distinguish a whole config from a filtered shard. `check-additional` keeps package-boundary compile/canary work together and separates runtime topology architecture from gateway watch coverage; the boundary guard shard runs its small independent guards concurrently inside one job. Gateway watch, channel tests, and the core support-boundary shard run concurrently inside `build-artifacts` after `dist/` and `dist-runtime/` are already built, keeping their old check names as lightweight verifier jobs while avoiding two extra Blacksmith workers and a second artifact-consumer queue. Android CI runs both `testPlayDebugUnitTest` and `testThirdPartyDebugUnitTest`, then builds the Play debug APK. The third-party flavor has no separate source set or manifest; its unit-test lane still compiles that flavor with the SMS/call-log BuildConfig flags, while avoiding a duplicate debug APK packaging job on every Android-relevant push. From 3937d16c44ff9580939a35b832d01886694f55ec Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 01:42:53 +0100 Subject: [PATCH 130/418] fix(exec): fallback when node lacks run prepare --- CHANGELOG.md | 1 + .../bash-tools.exec-host-node-phases.ts | 48 +++++++++++++- src/agents/bash-tools.exec-host-node.test.ts | 65 ++++++++++++++++++- .../bash-tools.exec.approval-id.test.ts | 24 ++++--- 4 files changed, 124 insertions(+), 14 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ba9efff4662..133530152ee 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,7 @@ Docs: https://docs.openclaw.ai - macOS Gateway: write launchd services with a state-dir `WorkingDirectory`, use a durable state-dir temp path instead of freezing macOS session `TMPDIR`, create that temp directory before bootstrap, and label abort-shaped launchd exits as `SIGABRT/abort` in status output. Fixes #53679 and #70223; refs #71848. Thanks @dlturock, @stammi922, and @palladius. - Exec/node: skip approval-plan preparation for full-trust `host=node` runs so interpreter and script commands no longer fail with `SYSTEM_RUN_DENIED: approval cannot safely bind` when effective policy is `security=full` and `ask=off`. Fixes #48457 and duplicate #69251. Thanks @ajtran303, @jaserNo1, @Blakeshannon, @lesliefag, and @AvIsBeastMC. +- Exec/node: synthesize a local approval plan when a paired node advertises `system.run` without `system.run.prepare`, unblocking approval-required `host=node` exec on current macOS companion nodes while preserving remote prepare for node hosts that support it. Fixes #37591 and duplicate #66839; carries forward #69725. Thanks @soloclz. - Memory/QMD: prefer QMD's `--mask` collection pattern flag so root memory indexing stays scoped to `MEMORY.md` instead of widening to every markdown file in the workspace. Thanks @codex. - Codex harness: normalize cached input tokens before session/context accounting so prompt cache reads are not double-counted in `/status`, `session_status`, or persisted `sessionEntry.totalTokens`. Fixes #69298. Thanks @richardmqq. - Hooks/session-memory: use the host local timezone for memory filenames, fallback timestamp slugs, and markdown headers instead of UTC dates. Fixes #46703. (#46721) Thanks @Astro-Han. diff --git a/src/agents/bash-tools.exec-host-node-phases.ts b/src/agents/bash-tools.exec-host-node-phases.ts index e2cd226b408..04a83f843b7 100644 --- a/src/agents/bash-tools.exec-host-node-phases.ts +++ b/src/agents/bash-tools.exec-host-node-phases.ts @@ -15,6 +15,8 @@ import { } from "../infra/exec-inline-eval.js"; import { buildNodeShellCommand } from "../infra/node-shell.js"; import { parsePreparedSystemRunPayload } from "../infra/system-run-approval-context.js"; +import { formatExecCommand, resolveSystemRunCommandRequest } from "../infra/system-run-command.js"; +import { normalizeNullableString } from "../shared/string-coerce.js"; import type { ExecuteNodeHostCommandParams } from "./bash-tools.exec-host-node.js"; import type { ExecToolDetails } from "./bash-tools.exec-types.js"; import { callGatewayTool } from "./tools/gateway.js"; @@ -26,6 +28,7 @@ export type NodeExecutionTarget = { argv: string[]; env: Record | undefined; invokeTimeoutMs: number; + supportsSystemRunPrepare: boolean; }; export type PreparedNodeRun = { @@ -113,9 +116,8 @@ export async function resolveNodeExecutionTarget( throw err; } const nodeInfo = nodes.find((entry) => entry.nodeId === nodeId); - const supportsSystemRun = Array.isArray(nodeInfo?.commands) - ? nodeInfo?.commands?.includes("system.run") - : false; + const declaredCommands = Array.isArray(nodeInfo?.commands) ? nodeInfo.commands : []; + const supportsSystemRun = declaredCommands.includes("system.run"); if (!supportsSystemRun) { throw new Error( "exec host=node requires a node that supports system.run (companion app or node host).", @@ -133,6 +135,7 @@ export async function resolveNodeExecutionTarget( 1000 + 5_000, ), + supportsSystemRunPrepare: declaredCommands.includes("system.run.prepare"), }; } @@ -199,6 +202,10 @@ export async function prepareNodeSystemRun(params: { request: ExecuteNodeHostCommandParams; target: NodeExecutionTarget; }): Promise { + if (!params.target.supportsSystemRunPrepare) { + return buildLocalPreparedNodeRun(params); + } + const prepareRaw = await callGatewayTool( "node.invoke", { timeoutMs: 15_000 }, @@ -229,6 +236,41 @@ export async function prepareNodeSystemRun(params: { }; } +function buildLocalPreparedNodeRun(params: { + request: ExecuteNodeHostCommandParams; + target: NodeExecutionTarget; +}): PreparedNodeRun { + const command = resolveSystemRunCommandRequest({ + command: params.target.argv, + rawCommand: params.request.command, + }); + if (!command.ok) { + throw new Error(command.message); + } + if (command.argv.length === 0) { + throw new Error("command required"); + } + const commandText = formatExecCommand(command.argv); + const previewText = command.previewText?.trim(); + const commandPreview = previewText && previewText !== commandText ? previewText : null; + const plan = { + argv: [...command.argv], + cwd: normalizeNullableString(params.request.workdir), + commandText, + commandPreview, + agentId: normalizeNullableString(params.request.agentId), + sessionKey: normalizeNullableString(params.request.sessionKey), + } satisfies SystemRunApprovalPlan; + return { + plan, + argv: plan.argv, + rawCommand: plan.commandText, + cwd: plan.cwd ?? params.request.workdir, + agentId: plan.agentId ?? params.request.agentId, + sessionKey: plan.sessionKey ?? params.request.sessionKey, + }; +} + export async function analyzeNodeApprovalRequirement(params: { request: ExecuteNodeHostCommandParams; target: NodeExecutionTarget; diff --git a/src/agents/bash-tools.exec-host-node.test.ts b/src/agents/bash-tools.exec-host-node.test.ts index d708fba4a0c..ef45f35ffbd 100644 --- a/src/agents/bash-tools.exec-host-node.test.ts +++ b/src/agents/bash-tools.exec-host-node.test.ts @@ -182,7 +182,11 @@ describe("executeNodeHostCommand", () => { ); listNodesMock.mockReset(); listNodesMock.mockResolvedValue([ - { nodeId: "node-1", commands: ["system.run"], platform: process.platform }, + { + nodeId: "node-1", + commands: ["system.run", "system.run.prepare"], + platform: process.platform, + }, ]); parsePreparedSystemRunPayloadMock.mockReset(); parsePreparedSystemRunPayloadMock.mockReturnValue({ plan: preparedPlan }); @@ -284,6 +288,65 @@ describe("executeNodeHostCommand", () => { ); }); + it("builds a local systemRunPlan when approval is required and the node omits prepare", async () => { + listNodesMock.mockResolvedValueOnce([ + { + nodeId: "node-1", + commands: ["system.run", "system.which", "system.notify"], + platform: "darwin", + }, + ]); + resolveExecHostApprovalContextMock.mockReturnValue({ + approvals: { allowlist: [], file: { version: 1, agents: {} } }, + hostSecurity: "full", + hostAsk: "always", + askFallback: "deny", + }); + + const result = await executeNodeHostCommand({ + command: "bun ./script.ts", + workdir: "/tmp/work", + env: {}, + security: "full", + ask: "off", + defaultTimeoutSec: 30, + approvalRunningNoticeMs: 0, + warnings: [], + agentId: "requested-agent", + sessionKey: "requested-session", + }); + + expect(result.details?.status).toBe("approval-pending"); + expect(parsePreparedSystemRunPayloadMock).not.toHaveBeenCalled(); + const expectedPlan = { + argv: ["bash", "-lc", "bun ./script.ts"], + cwd: "/tmp/work", + commandText: 'bash -lc "bun ./script.ts"', + commandPreview: "bun ./script.ts", + agentId: "requested-agent", + sessionKey: "requested-session", + }; + expect(registerExecApprovalRequestForHostOrThrowMock).toHaveBeenCalledWith( + expect.objectContaining({ + systemRunPlan: expectedPlan, + }), + ); + + await vi.waitFor(() => { + expect(callGatewayToolMock).toHaveBeenCalledWith( + "node.invoke", + expect.anything(), + expect.objectContaining({ + command: "system.run", + params: expect.objectContaining({ + rawCommand: expectedPlan.commandText, + systemRunPlan: expectedPlan, + }), + }), + ); + }); + }); + it("skips approval prepare in full/off mode", async () => { await executeNodeHostCommand({ command: "bun ./script.ts", diff --git a/src/agents/bash-tools.exec.approval-id.test.ts b/src/agents/bash-tools.exec.approval-id.test.ts index 379a5238b2c..52fa7dc525c 100644 --- a/src/agents/bash-tools.exec.approval-id.test.ts +++ b/src/agents/bash-tools.exec.approval-id.test.ts @@ -15,7 +15,11 @@ vi.mock("./tools/gateway.js", () => ({ vi.mock("./tools/nodes-utils.js", () => ({ listNodes: vi.fn(async () => [ - { nodeId: "node-1", commands: ["system.run"], platform: "darwin" }, + { + nodeId: "node-1", + commands: ["system.run", "system.run.prepare"], + platform: "darwin", + }, ]), resolveNodeIdFromList: vi.fn((nodes: Array<{ nodeId: string }>) => nodes[0]?.nodeId), })); @@ -522,16 +526,16 @@ describe("exec approvals", () => { it("preserves explicit workdir for node exec", async () => { const remoteWorkdir = "/Users/vv"; - let prepareCwd: string | undefined; + let runCwd: string | undefined; vi.mocked(callGatewayTool).mockImplementation(async (method, _opts, params) => { if (method === "node.invoke") { const invoke = params as { command?: string; params?: { cwd?: string } }; if (invoke.command === "system.run.prepare") { - prepareCwd = invoke.params?.cwd; return buildPreparedSystemRunPayload(params); } if (invoke.command === "system.run") { + runCwd = invoke.params?.cwd; return { payload: { success: true, stdout: "ok" } }; } } @@ -551,23 +555,23 @@ describe("exec approvals", () => { }); expect(result.details.status).toBe("completed"); - expect(prepareCwd).toBe(remoteWorkdir); + expect(runCwd).toBe(remoteWorkdir); }); it("does not forward the gateway default cwd to node exec when workdir is omitted", async () => { const gatewayWorkspace = "/gateway/workspace"; - let prepareHasCwd = false; - let prepareCwd: string | undefined; + let runHasCwd = false; + let runCwd: string | undefined; vi.mocked(callGatewayTool).mockImplementation(async (method, _opts, params) => { if (method === "node.invoke") { const invoke = params as { command?: string; params?: { cwd?: string } }; if (invoke.command === "system.run.prepare") { - prepareHasCwd = Object.hasOwn(invoke.params ?? {}, "cwd"); - prepareCwd = invoke.params?.cwd; return buildPreparedSystemRunPayload(params); } if (invoke.command === "system.run") { + runHasCwd = Object.hasOwn(invoke.params ?? {}, "cwd"); + runCwd = invoke.params?.cwd; return { payload: { success: true, stdout: "ok" } }; } } @@ -587,8 +591,8 @@ describe("exec approvals", () => { }); expect(result.details.status).toBe("completed"); - expect(prepareHasCwd).toBe(false); - expect(prepareCwd).toBeUndefined(); + expect(runHasCwd).toBe(false); + expect(runCwd).toBeUndefined(); }); it("routes explicit host=node to node invoke when elevated default is on under auto host", async () => { From ffbb4d4ae73e3576fe10d0e31210f53a10855662 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 01:43:54 +0100 Subject: [PATCH 131/418] test(docker): fix update preflight fixture patches --- scripts/e2e/update-channel-switch-docker.sh | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/scripts/e2e/update-channel-switch-docker.sh b/scripts/e2e/update-channel-switch-docker.sh index a301e4fb568..f94af9ba5f8 100755 --- a/scripts/e2e/update-channel-switch-docker.sh +++ b/scripts/e2e/update-channel-switch-docker.sh @@ -43,7 +43,13 @@ mkdir -p "$git_root" tar -xzf "$package_tgz" -C "$git_root" --strip-components=1 # The package-derived fixture can carry patchedDependencies whose targets are # absent from the trimmed tarball install; that should not block update preflight. -printf "\nallowUnusedPatches=true\n" >>"$git_root/.npmrc" +node - <<'"'"'NODE'"'"' +const fs = require("node:fs"); +const packageJsonPath = "/tmp/openclaw-git/package.json"; +const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf8")); +packageJson.pnpm = { ...packageJson.pnpm, allowUnusedPatches: true }; +fs.writeFileSync(packageJsonPath, `${JSON.stringify(packageJson, null, 2)}\n`); +NODE ( cd "$git_root" npm install --omit=optional --no-fund --no-audit >/tmp/openclaw-git-install.log 2>&1 From ddac6f73e549a217ac82afe834871df842d99081 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 01:46:30 +0100 Subject: [PATCH 132/418] fix(approvals): accept allowlist metadata --- CHANGELOG.md | 1 + docs/tools/exec-approvals.md | 2 + .../exec-approvals-validators.test.ts | 75 +++++++++++++++++++ src/gateway/protocol/schema/exec-approvals.ts | 2 + ui/src/ui/controllers/exec-approvals.ts | 3 + 5 files changed, 83 insertions(+) create mode 100644 src/gateway/protocol/exec-approvals-validators.test.ts diff --git a/CHANGELOG.md b/CHANGELOG.md index 133530152ee..795bf46c3f6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,7 @@ Docs: https://docs.openclaw.ai ### Fixes - macOS Gateway: write launchd services with a state-dir `WorkingDirectory`, use a durable state-dir temp path instead of freezing macOS session `TMPDIR`, create that temp directory before bootstrap, and label abort-shaped launchd exits as `SIGABRT/abort` in status output. Fixes #53679 and #70223; refs #71848. Thanks @dlturock, @stammi922, and @palladius. +- Exec approvals: accept runtime-owned `source: "allow-always"` and `commandText` allowlist metadata in gateway and node approval-set payloads so Control UI round-trips no longer fail with `unexpected property 'source'`. Fixes #60000; carries forward #60064. Thanks @sd1471123, @sharkqwy, and @luoyanglang. - Exec/node: skip approval-plan preparation for full-trust `host=node` runs so interpreter and script commands no longer fail with `SYSTEM_RUN_DENIED: approval cannot safely bind` when effective policy is `security=full` and `ask=off`. Fixes #48457 and duplicate #69251. Thanks @ajtran303, @jaserNo1, @Blakeshannon, @lesliefag, and @AvIsBeastMC. - Exec/node: synthesize a local approval plan when a paired node advertises `system.run` without `system.run.prepare`, unblocking approval-required `host=node` exec on current macOS companion nodes while preserving remote prepare for node hosts that support it. Fixes #37591 and duplicate #66839; carries forward #69725. Thanks @soloclz. - Memory/QMD: prefer QMD's `--mask` collection pattern flag so root memory indexing stays scoped to `MEMORY.md` instead of widening to every markdown file in the workspace. Thanks @codex. diff --git a/docs/tools/exec-approvals.md b/docs/tools/exec-approvals.md index e26a80cee99..2354be48130 100644 --- a/docs/tools/exec-approvals.md +++ b/docs/tools/exec-approvals.md @@ -99,6 +99,8 @@ Example schema: { "id": "B0C8C0B3-2C2D-4F8A-9A3C-5A4B3C2D1E0F", "pattern": "~/Projects/**/bin/rg", + "source": "allow-always", + "commandText": "rg -n TODO", "lastUsedAt": 1737150000000, "lastUsedCommand": "rg -n TODO", "lastResolvedPath": "/Users/user/Projects/.../bin/rg" diff --git a/src/gateway/protocol/exec-approvals-validators.test.ts b/src/gateway/protocol/exec-approvals-validators.test.ts new file mode 100644 index 00000000000..13bb01ded9f --- /dev/null +++ b/src/gateway/protocol/exec-approvals-validators.test.ts @@ -0,0 +1,75 @@ +import { describe, expect, it } from "vitest"; +import { validateExecApprovalsNodeSetParams, validateExecApprovalsSetParams } from "./index.js"; + +describe("exec approvals protocol validators", () => { + it("accepts runtime-owned allowlist metadata on gateway and node set payloads", () => { + const file = { + version: 1 as const, + agents: { + main: { + allowlist: [ + { + id: "entry-1", + pattern: "cmd:allow-always:abcdef", + source: "allow-always" as const, + commandText: "python3 -c 'print(123)'", + argPattern: "-c *", + lastUsedAt: 1775154056736, + lastUsedCommand: "python3 -c 'print(123)'", + lastResolvedPath: "/usr/bin/python3", + }, + ], + }, + }, + }; + + expect(validateExecApprovalsSetParams({ file, baseHash: "abc123" })).toBe(true); + expect( + validateExecApprovalsNodeSetParams({ + nodeId: "node-1", + file, + baseHash: "abc123", + }), + ).toBe(true); + }); + + it("rejects unknown allowlist metadata", () => { + expect( + validateExecApprovalsSetParams({ + file: { + version: 1, + agents: { + main: { + allowlist: [ + { + pattern: "/usr/bin/python3", + source: "unknown-source", + }, + ], + }, + }, + }, + baseHash: "abc123", + }), + ).toBe(false); + + expect( + validateExecApprovalsSetParams({ + file: { + version: 1, + agents: { + main: { + allowlist: [ + { + pattern: "/usr/bin/python3", + randomMetadata: true, + }, + ], + }, + }, + }, + baseHash: "abc123", + }), + ).toBe(false); + }); +}); diff --git a/src/gateway/protocol/schema/exec-approvals.ts b/src/gateway/protocol/schema/exec-approvals.ts index 7806c0e92ca..b94d674aac9 100644 --- a/src/gateway/protocol/schema/exec-approvals.ts +++ b/src/gateway/protocol/schema/exec-approvals.ts @@ -5,6 +5,8 @@ export const ExecApprovalsAllowlistEntrySchema = Type.Object( { id: Type.Optional(NonEmptyString), pattern: Type.String(), + source: Type.Optional(Type.Literal("allow-always")), + commandText: Type.Optional(Type.String()), argPattern: Type.Optional(Type.String()), lastUsedAt: Type.Optional(Type.Integer({ minimum: 0 })), lastUsedCommand: Type.Optional(Type.String()), diff --git a/ui/src/ui/controllers/exec-approvals.ts b/ui/src/ui/controllers/exec-approvals.ts index 104035f9ce8..c69f02e3a3a 100644 --- a/ui/src/ui/controllers/exec-approvals.ts +++ b/ui/src/ui/controllers/exec-approvals.ts @@ -11,6 +11,9 @@ export type ExecApprovalsDefaults = { export type ExecApprovalsAllowlistEntry = { id?: string; pattern: string; + source?: "allow-always"; + commandText?: string; + argPattern?: string; lastUsedAt?: number; lastUsedCommand?: string; lastResolvedPath?: string; From 0a117b59606d335af165811c17c94c4ed1beaa98 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 17:47:41 -0700 Subject: [PATCH 133/418] test(plugins): guard persisted status replay --- src/plugins/status.registry-snapshot.test.ts | 54 ++++++++++++++++++++ 1 file changed, 54 insertions(+) diff --git a/src/plugins/status.registry-snapshot.test.ts b/src/plugins/status.registry-snapshot.test.ts index 474fb27a69b..6cc5dd43ed0 100644 --- a/src/plugins/status.registry-snapshot.test.ts +++ b/src/plugins/status.registry-snapshot.test.ts @@ -2,6 +2,7 @@ import fs from "node:fs"; import { afterEach, describe, expect, it } from "vitest"; import { clearPluginDiscoveryCache } from "./discovery.js"; import { clearPluginManifestRegistryCache } from "./manifest-registry.js"; +import { refreshPluginRegistry } from "./plugin-registry.js"; import { buildPluginRegistrySnapshotReport, buildPluginSnapshotReport } from "./status.js"; import { createColdPluginConfig, @@ -68,6 +69,59 @@ describe("buildPluginRegistrySnapshotReport", () => { expect(isColdPluginRuntimeLoaded(fixture)).toBe(false); }); + it("replays persisted list metadata without importing plugin runtime", async () => { + const fixture = createColdPluginFixture({ + rootDir: makeTempDir(), + pluginId: "persisted-demo", + packageName: "@example/openclaw-persisted-demo", + packageVersion: "2.0.0", + manifest: { + id: "persisted-demo", + name: "Persisted Demo", + description: "Persisted registry metadata", + providers: ["persisted-provider"], + commandAliases: [{ name: "persisted-demo" }], + }, + }); + const workspaceDir = makeTempDir(); + const config = createColdPluginConfig(fixture.rootDir, fixture.pluginId); + const env = createColdPluginHermeticEnv(workspaceDir, { + bundledPluginsDir: makeTempDir(), + disablePersistedRegistry: false, + }); + + await refreshPluginRegistry({ + config, + workspaceDir, + env, + reason: "manual", + }); + expect(isColdPluginRuntimeLoaded(fixture)).toBe(false); + + const report = buildPluginRegistrySnapshotReport({ + config, + workspaceDir, + env, + }); + + expect(report.registrySource).toBe("persisted"); + expect(report.plugins).toEqual( + expect.arrayContaining([ + expect.objectContaining({ + id: "persisted-demo", + name: "Persisted Demo", + description: "Persisted registry metadata", + version: "2.0.0", + providerIds: ["persisted-provider"], + commands: ["persisted-demo"], + source: fs.realpathSync(fixture.runtimeSource), + status: "loaded", + }), + ]), + ); + expect(isColdPluginRuntimeLoaded(fixture)).toBe(false); + }); + it("builds read-only plugin status snapshots without importing plugin runtime", () => { const fixture = createColdPluginFixture({ rootDir: makeTempDir(), From 3c95327b346a653936a2c187e207954f88d304f4 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 01:51:00 +0100 Subject: [PATCH 134/418] Fix compacted session transcript rotation --- docs/.generated/config-baseline.sha256 | 6 +- .../.generated/plugin-sdk-api-baseline.sha256 | 4 +- docs/concepts/compaction.md | 6 + docs/concepts/context-engine.md | 4 + .../session-management-compaction.md | 4 + .../bash-tools.exec-host-node-phases.ts | 2 +- src/agents/bash-tools.exec-host-node.ts | 29 +- src/agents/bash-tools.exec-host-node.types.ts | 27 ++ .../pi-embedded-runner/compact.hooks.test.ts | 84 ++++ .../pi-embedded-runner/compact.queued.ts | 61 ++- src/agents/pi-embedded-runner/compact.ts | 76 ++-- .../compaction-successor-transcript.test.ts | 177 +++++++++ .../compaction-successor-transcript.ts | 206 ++++++++++ .../run.overflow-compaction.fixture.ts | 6 + .../run.overflow-compaction.harness.ts | 2 + .../run.overflow-compaction.test.ts | 36 ++ .../run.timeout-triggered-compaction.test.ts | 17 +- src/agents/pi-embedded-runner/run.ts | 69 +++- src/agents/pi-embedded-runner/run/attempt.ts | 35 ++ src/agents/pi-embedded-runner/run/types.ts | 1 + .../session-truncation.test.ts | 368 ------------------ .../pi-embedded-runner/session-truncation.ts | 252 ------------ src/agents/pi-embedded-runner/types.ts | 3 + src/auto-reply/reply/agent-runner-memory.ts | 7 + src/auto-reply/reply/agent-runner.ts | 1 + src/auto-reply/reply/commands-compact.ts | 2 + src/auto-reply/reply/followup-runner.ts | 1 + .../reply/session-run-accounting.ts | 2 + src/auto-reply/reply/session-updates.ts | 17 +- src/cli/update-cli.test.ts | 4 +- src/config/schema.base.generated.ts | 8 +- src/config/schema.help.ts | 2 +- src/config/schema.labels.ts | 2 +- src/config/types.agent-defaults.ts | 5 +- src/context-engine/delegate.ts | 2 + src/context-engine/types.ts | 4 + src/gateway/server-methods/sessions.ts | 6 + src/scripts/test-projects.test.ts | 19 +- 38 files changed, 823 insertions(+), 734 deletions(-) create mode 100644 src/agents/bash-tools.exec-host-node.types.ts create mode 100644 src/agents/pi-embedded-runner/compaction-successor-transcript.test.ts create mode 100644 src/agents/pi-embedded-runner/compaction-successor-transcript.ts delete mode 100644 src/agents/pi-embedded-runner/session-truncation.test.ts delete mode 100644 src/agents/pi-embedded-runner/session-truncation.ts diff --git a/docs/.generated/config-baseline.sha256 b/docs/.generated/config-baseline.sha256 index 2d0e0e2b4d3..9c40ce9f7a8 100644 --- a/docs/.generated/config-baseline.sha256 +++ b/docs/.generated/config-baseline.sha256 @@ -1,4 +1,4 @@ -4d1995e41b659e484afb5a48d6fca0558337123200a4a537f556ca38e8e829e7 config-baseline.json -3245c9a013c55ee8a24db52d5e88c42bc86e26f822d4a144fc7f37fc71e05fa8 config-baseline.core.json +79fa6b9b9df5e22ac56a7edb9bfc25550131e285ce9f4868f468d957a8768240 config-baseline.json +2722504ab6bd37eea9e7542689bd6dba5fb4e485c0eab9c1915427c49a5c5b66 config-baseline.core.json 7cd9c908f066c143eab2a201efbc9640f483ab28bba92ddeca1d18cc2b528bc3 config-baseline.channel.json -f9e0174988718959fe1923a54496ec5b9262721fe1e7306f32ccb1316d9d9c3f config-baseline.plugin.json +74b74cb18ac37c0acaa765f398f1f9edbcee4c43567f02d45c89598a1e13afb4 config-baseline.plugin.json diff --git a/docs/.generated/plugin-sdk-api-baseline.sha256 b/docs/.generated/plugin-sdk-api-baseline.sha256 index cd7c3e48449..5d6211c3505 100644 --- a/docs/.generated/plugin-sdk-api-baseline.sha256 +++ b/docs/.generated/plugin-sdk-api-baseline.sha256 @@ -1,2 +1,2 @@ -21914ef8c5840e0defc36d571834dc28a92d6d5ca2d42a088c33b4de681e836a plugin-sdk-api-baseline.json -3f22e6af0dad3433d25d996802d7436a3cc0e68bc86ecaf813a22e2b4e5333eb plugin-sdk-api-baseline.jsonl +ba5191d586958233c69921928e4d13ae6e8af61e26cf57eec6f50c5d551d8b43 plugin-sdk-api-baseline.json +e6fc8ea33cfc6251a080c3a49d0db2e7d82c117f412902c79da359ebbc9197cc plugin-sdk-api-baseline.jsonl diff --git a/docs/concepts/compaction.md b/docs/concepts/compaction.md index 5a1f3dab24a..95e0b851795 100644 --- a/docs/concepts/compaction.md +++ b/docs/concepts/compaction.md @@ -118,6 +118,12 @@ honors that Pi cut-point and keeps the recent tail in rebuilt context. Without an explicit keep budget, manual compaction behaves as a hard checkpoint and continues from the new summary alone. +When `agents.defaults.compaction.truncateAfterCompaction` is enabled, +OpenClaw does not rewrite the existing transcript in place. It creates a new +active successor transcript from the compaction summary, preserved state, and +unsummarized tail, then keeps the previous JSONL as the archived checkpoint +source. + ## Using a different model By default, compaction uses your agent's primary model. You can use a more diff --git a/docs/concepts/context-engine.md b/docs/concepts/context-engine.md index 6426b2b3417..74eb2512f62 100644 --- a/docs/concepts/context-engine.md +++ b/docs/concepts/context-engine.md @@ -194,6 +194,10 @@ Required members: Prepended to the system prompt. +`compact` returns a `CompactResult`. When compaction rotates the active +transcript, `result.sessionId` and `result.sessionFile` identify the successor +session that the next retry or turn must use. + Optional members: | Member | Kind | Purpose | diff --git a/docs/reference/session-management-compaction.md b/docs/reference/session-management-compaction.md index 37a7b65181c..aced6697325 100644 --- a/docs/reference/session-management-compaction.md +++ b/docs/reference/session-management-compaction.md @@ -285,6 +285,10 @@ OpenClaw also enforces a safety floor for embedded runs: and keeps Pi's recent-tail cut point. Without an explicit keep budget, manual compaction remains a hard checkpoint and rebuilt context starts from the new summary. +- When `agents.defaults.compaction.truncateAfterCompaction` is enabled, + OpenClaw rotates the active transcript to a compacted successor JSONL after + compaction. The old full transcript remains archived and linked from the + compaction checkpoint instead of being rewritten in place. Why: leave enough headroom for multi-turn “housekeeping” (like memory writes) before compaction becomes unavoidable. diff --git a/src/agents/bash-tools.exec-host-node-phases.ts b/src/agents/bash-tools.exec-host-node-phases.ts index 04a83f843b7..6adadacb4b7 100644 --- a/src/agents/bash-tools.exec-host-node-phases.ts +++ b/src/agents/bash-tools.exec-host-node-phases.ts @@ -17,7 +17,7 @@ import { buildNodeShellCommand } from "../infra/node-shell.js"; import { parsePreparedSystemRunPayload } from "../infra/system-run-approval-context.js"; import { formatExecCommand, resolveSystemRunCommandRequest } from "../infra/system-run-command.js"; import { normalizeNullableString } from "../shared/string-coerce.js"; -import type { ExecuteNodeHostCommandParams } from "./bash-tools.exec-host-node.js"; +import type { ExecuteNodeHostCommandParams } from "./bash-tools.exec-host-node.types.js"; import type { ExecToolDetails } from "./bash-tools.exec-types.js"; import { callGatewayTool } from "./tools/gateway.js"; import { listNodes, resolveNodeIdFromList } from "./tools/nodes-utils.js"; diff --git a/src/agents/bash-tools.exec-host-node.ts b/src/agents/bash-tools.exec-host-node.ts index 426ca296ebd..9d216bea328 100644 --- a/src/agents/bash-tools.exec-host-node.ts +++ b/src/agents/bash-tools.exec-host-node.ts @@ -1,7 +1,5 @@ import type { AgentToolResult } from "@mariozechner/pi-agent-core"; import { - type ExecAsk, - type ExecSecurity, requiresExecApproval, resolveExecApprovalAllowedDecisions, } from "../infra/exec-approvals.js"; @@ -19,6 +17,7 @@ import { resolveNodeExecutionTarget, shouldSkipNodeApprovalPrepare, } from "./bash-tools.exec-host-node-phases.js"; +import type { ExecuteNodeHostCommandParams } from "./bash-tools.exec-host-node.types.js"; import * as execHostShared from "./bash-tools.exec-host-shared.js"; import { DEFAULT_NOTIFY_TAIL_CHARS, @@ -28,31 +27,7 @@ import { import type { ExecToolDetails } from "./bash-tools.exec-types.js"; import { callGatewayTool } from "./tools/gateway.js"; -export type ExecuteNodeHostCommandParams = { - command: string; - workdir: string | undefined; - env: Record; - requestedEnv?: Record; - requestedNode?: string; - boundNode?: string; - sessionKey?: string; - turnSourceChannel?: string; - turnSourceTo?: string; - turnSourceAccountId?: string; - turnSourceThreadId?: string | number; - trigger?: string; - agentId?: string; - security: ExecSecurity; - ask: ExecAsk; - strictInlineEval?: boolean; - timeoutSec?: number; - defaultTimeoutSec: number; - approvalRunningNoticeMs: number; - warnings: string[]; - notifySessionKey?: string; - notifyOnExit?: boolean; - trustedSafeBinDirs?: ReadonlySet; -}; +export type { ExecuteNodeHostCommandParams } from "./bash-tools.exec-host-node.types.js"; export async function executeNodeHostCommand( params: ExecuteNodeHostCommandParams, diff --git a/src/agents/bash-tools.exec-host-node.types.ts b/src/agents/bash-tools.exec-host-node.types.ts new file mode 100644 index 00000000000..1b212200ad5 --- /dev/null +++ b/src/agents/bash-tools.exec-host-node.types.ts @@ -0,0 +1,27 @@ +import type { ExecAsk, ExecSecurity } from "../infra/exec-approvals.js"; + +export type ExecuteNodeHostCommandParams = { + command: string; + workdir: string | undefined; + env: Record; + requestedEnv?: Record; + requestedNode?: string; + boundNode?: string; + sessionKey?: string; + turnSourceChannel?: string; + turnSourceTo?: string; + turnSourceAccountId?: string; + turnSourceThreadId?: string | number; + trigger?: string; + agentId?: string; + security: ExecSecurity; + ask: ExecAsk; + strictInlineEval?: boolean; + timeoutSec?: number; + defaultTimeoutSec: number; + approvalRunningNoticeMs: number; + warnings: string[]; + notifySessionKey?: string; + notifyOnExit?: boolean; + trustedSafeBinDirs?: ReadonlySet; +}; diff --git a/src/agents/pi-embedded-runner/compact.hooks.test.ts b/src/agents/pi-embedded-runner/compact.hooks.test.ts index fa4e0fcd57a..4795b8c5ab8 100644 --- a/src/agents/pi-embedded-runner/compact.hooks.test.ts +++ b/src/agents/pi-embedded-runner/compact.hooks.test.ts @@ -752,6 +752,38 @@ describe("compactEmbeddedPiSession hooks (ownsCompaction engine)", () => { ); }); + it("passes the rotated session id to engine-owned after_compaction hooks", async () => { + hookRunner.hasHooks.mockReturnValue(true); + const rotatedSessionId = "rotated-session"; + const rotatedSessionFile = "/tmp/rotated-session.jsonl"; + contextEngineCompactMock.mockResolvedValue({ + ok: true, + compacted: true, + reason: undefined, + result: { + summary: "engine-summary", + firstKeptEntryId: "entry-1", + tokensBefore: 120, + tokensAfter: 50, + sessionId: rotatedSessionId, + sessionFile: rotatedSessionFile, + }, + } as never); + + const result = await compactEmbeddedPiSession(wrappedCompactionArgs()); + + expect(result.ok).toBe(true); + expect(hookRunner.runAfterCompaction).toHaveBeenCalledWith( + expect.objectContaining({ + sessionFile: rotatedSessionFile, + }), + expect.objectContaining({ + sessionId: rotatedSessionId, + sessionKey: TEST_SESSION_KEY, + }), + ); + }); + it("emits a transcript update and post-compaction memory sync on the engine-owned path", async () => { const listener = vi.fn(); const cleanup = onSessionTranscriptUpdate(listener); @@ -924,6 +956,58 @@ describe("compactEmbeddedPiSession hooks (ownsCompaction engine)", () => { } }); + it("reuses a delegated compaction successor transcript", async () => { + const maintain = vi.fn(async (_params?: unknown) => ({ + changed: false, + bytesFreed: 0, + rewrittenEntries: 0, + })); + const delegatedSessionId = "delegated-session"; + const delegatedSessionFile = "/tmp/delegated-session.jsonl"; + resolveContextEngineMock.mockResolvedValue({ + info: { ownsCompaction: false }, + compact: contextEngineCompactMock, + maintain, + } as never); + contextEngineCompactMock.mockResolvedValue({ + ok: true, + compacted: true, + reason: undefined, + result: { + summary: "engine-summary", + firstKeptEntryId: "entry-1", + tokensBefore: 120, + tokensAfter: 50, + sessionId: delegatedSessionId, + sessionFile: delegatedSessionFile, + }, + } as never); + + const result = await compactEmbeddedPiSession( + wrappedCompactionArgs({ + config: { + agents: { + defaults: { + compaction: { + truncateAfterCompaction: true, + }, + }, + }, + }, + }), + ); + + expect(result.ok).toBe(true); + expect(result.result?.sessionId).toBe(delegatedSessionId); + expect(result.result?.sessionFile).toBe(delegatedSessionFile); + expect(maintain).toHaveBeenCalledWith( + expect.objectContaining({ + sessionId: delegatedSessionId, + sessionFile: delegatedSessionFile, + }), + ); + }); + it("catches and logs hook exceptions without aborting compaction", async () => { hookRunner.hasHooks.mockReturnValue(true); hookRunner.runBeforeCompaction.mockRejectedValue(new Error("hook boom")); diff --git a/src/agents/pi-embedded-runner/compact.queued.ts b/src/agents/pi-embedded-runner/compact.queued.ts index cdca8b0b503..1efc1984d7c 100644 --- a/src/agents/pi-embedded-runner/compact.queued.ts +++ b/src/agents/pi-embedded-runner/compact.queued.ts @@ -26,6 +26,10 @@ import { buildEmbeddedCompactionRuntimeContext, resolveEmbeddedCompactionTarget, } from "./compaction-runtime-context.js"; +import { + rotateTranscriptAfterCompaction, + shouldRotateCompactionTranscript, +} from "./compaction-successor-transcript.js"; import { runContextEngineMaintenance } from "./context-engine-maintenance.js"; import { resolveGlobalLane, resolveSessionLane } from "./lanes.js"; import { log } from "./logger.js"; @@ -158,15 +162,44 @@ export async function compactEmbeddedPiSession( force: params.trigger === "manual", runtimeContext, }); + const delegatedSessionId = result.result?.sessionId; + const delegatedSessionFile = result.result?.sessionFile; + const delegatedRotatedTranscript = Boolean(delegatedSessionId || delegatedSessionFile); + let postCompactionSessionId = delegatedSessionId ?? params.sessionId; + let postCompactionSessionFile = delegatedSessionFile ?? params.sessionFile; + let postCompactionLeafId: string | undefined; if (result.ok && result.compacted) { + if (shouldRotateCompactionTranscript(params.config) && !delegatedRotatedTranscript) { + try { + const rotation = await rotateTranscriptAfterCompaction({ + sessionManager: SessionManager.open(params.sessionFile), + sessionFile: params.sessionFile, + }); + if (rotation.rotated) { + postCompactionSessionId = rotation.sessionId ?? postCompactionSessionId; + postCompactionSessionFile = rotation.sessionFile ?? postCompactionSessionFile; + postCompactionLeafId = rotation.leafId; + log.info( + `[compaction] rotated active transcript after context-engine compaction ` + + `(sessionKey=${params.sessionKey ?? params.sessionId})`, + ); + } + } catch (err) { + log.warn("failed to rotate compacted transcript", { + errorMessage: formatErrorMessage(err), + }); + } + } if (params.config && params.sessionKey && checkpointSnapshot) { try { - const postCompactionSession = SessionManager.open(params.sessionFile); - const postLeafId = postCompactionSession.getLeafId() ?? undefined; + const postLeafId = + postCompactionLeafId ?? + SessionManager.open(postCompactionSessionFile).getLeafId() ?? + undefined; const storedCheckpoint = await persistSessionCompactionCheckpoint({ cfg: params.config, sessionKey: params.sessionKey, - sessionId: params.sessionId, + sessionId: postCompactionSessionId, reason: resolveSessionCompactionCheckpointReason({ trigger: params.trigger, }), @@ -175,7 +208,7 @@ export async function compactEmbeddedPiSession( firstKeptEntryId: result.result?.firstKeptEntryId, tokensBefore: result.result?.tokensBefore, tokensAfter: result.result?.tokensAfter, - postSessionFile: params.sessionFile, + postSessionFile: postCompactionSessionFile, postLeafId, postEntryId: postLeafId, }); @@ -188,9 +221,9 @@ export async function compactEmbeddedPiSession( } await runContextEngineMaintenance({ contextEngine, - sessionId: params.sessionId, + sessionId: postCompactionSessionId, sessionKey: params.sessionKey, - sessionFile: params.sessionFile, + sessionFile: postCompactionSessionFile, reason: "compaction", runtimeContext, }); @@ -199,7 +232,7 @@ export async function compactEmbeddedPiSession( await runPostCompactionSideEffects({ config: params.config, sessionKey: params.sessionKey, - sessionFile: params.sessionFile, + sessionFile: postCompactionSessionFile, }); } if ( @@ -209,14 +242,18 @@ export async function compactEmbeddedPiSession( hookRunner.runAfterCompaction ) { try { + const afterHookCtx = { + ...hookCtx, + sessionId: postCompactionSessionId, + }; await hookRunner.runAfterCompaction( { messageCount: -1, compactedCount: -1, tokenCount: result.result?.tokensAfter, - sessionFile: params.sessionFile, + sessionFile: postCompactionSessionFile, }, - hookCtx, + afterHookCtx, ); } catch (err) { log.warn("after_compaction hook failed", { @@ -235,6 +272,12 @@ export async function compactEmbeddedPiSession( tokensBefore: result.result.tokensBefore, tokensAfter: result.result.tokensAfter, details: result.result.details, + ...(postCompactionSessionId !== params.sessionId + ? { sessionId: postCompactionSessionId } + : {}), + ...(postCompactionSessionFile !== params.sessionFile + ? { sessionFile: postCompactionSessionFile } + : {}), } : undefined, }; diff --git a/src/agents/pi-embedded-runner/compact.ts b/src/agents/pi-embedded-runner/compact.ts index 43688dda31c..085b3fe9b81 100644 --- a/src/agents/pi-embedded-runner/compact.ts +++ b/src/agents/pi-embedded-runner/compact.ts @@ -19,7 +19,6 @@ import { type CapturedCompactionCheckpointSnapshot, } from "../../gateway/session-compaction-checkpoints.js"; import { formatErrorMessage } from "../../infra/errors.js"; -import { resolveHeartbeatSummaryForAgent } from "../../infra/heartbeat-summary.js"; import { getMachineDisplayName } from "../../infra/machine-name.js"; import { generateSecureToken } from "../../infra/secure-random.js"; import { getGlobalHookRunner } from "../../plugins/hook-runner-global.js"; @@ -113,6 +112,11 @@ import { compactWithSafetyTimeout, resolveCompactionTimeoutMs, } from "./compaction-safety-timeout.js"; +import { + type CompactionTranscriptRotation, + rotateTranscriptAfterCompaction, + shouldRotateCompactionTranscript, +} from "./compaction-successor-transcript.js"; import { applyFinalEffectiveToolPolicy } from "./effective-tool-policy.js"; import { buildEmbeddedExtensionFactories } from "./extensions.js"; import { applyExtraParamsToAgent } from "./extra-params.js"; @@ -126,7 +130,6 @@ import { sanitizeSessionHistory, validateReplayTurns } from "./replay-history.js import { shouldUseOpenAIWebSocketTransport } from "./run/attempt.thread-helpers.js"; import { buildEmbeddedSandboxInfo } from "./sandbox-info.js"; import { prewarmSessionFile, trackSessionManagerAccess } from "./session-manager-cache.js"; -import { truncateSessionAfterCompaction } from "./session-truncation.js"; import { resolveEmbeddedRunSkillEntries } from "./skills-runtime.js"; import { resolveEmbeddedAgentApiKey, @@ -1080,6 +1083,7 @@ export async function compactEmbeddedPiSessionDirect( typeof sessionManager.getLeafId === "function" ? (sessionManager.getLeafId() ?? undefined) : undefined; + let transcriptRotationSessionManager = sessionManager; if (params.trigger === "manual") { try { const hardenedBoundary = await hardenManualCompactionBoundary({ @@ -1092,6 +1096,7 @@ export async function compactEmbeddedPiSessionDirect( hardenedBoundary.firstKeptEntryId ?? effectiveFirstKeptEntryId; postCompactionLeafId = hardenedBoundary.leafId ?? postCompactionLeafId; session.agent.state.messages = hardenedBoundary.messages; + transcriptRotationSessionManager = SessionManager.open(params.sessionFile); } } catch (err) { log.warn("[compaction] failed to harden manual compaction boundary", { @@ -1108,12 +1113,40 @@ export async function compactEmbeddedPiSessionDirect( }); const messageCountAfter = session.messages.length; const compactedCount = Math.max(0, messageCountCompactionInput - messageCountAfter); + let transcriptRotation: CompactionTranscriptRotation = { rotated: false }; + if (shouldRotateCompactionTranscript(params.config)) { + try { + transcriptRotation = await rotateTranscriptAfterCompaction({ + sessionManager: transcriptRotationSessionManager, + sessionFile: params.sessionFile, + }); + } catch (err) { + log.warn("[compaction] post-compaction transcript rotation failed", { + errorMessage: formatErrorMessage(err), + errorStack: err instanceof Error ? err.stack : undefined, + }); + } + } + const activeSessionId = transcriptRotation.sessionId ?? params.sessionId; + const activeSessionFile = transcriptRotation.sessionFile ?? params.sessionFile; + const activePostLeafId = transcriptRotation.leafId ?? postCompactionLeafId; + if (transcriptRotation.rotated) { + log.info( + `[compaction] rotated active transcript after compaction ` + + `(sessionKey=${params.sessionKey ?? params.sessionId})`, + ); + await runPostCompactionSideEffects({ + config: params.config, + sessionKey: params.sessionKey, + sessionFile: activeSessionFile, + }); + } if (params.config && params.sessionKey && checkpointSnapshot) { try { const storedCheckpoint = await persistSessionCompactionCheckpoint({ cfg: params.config, sessionKey: params.sessionKey, - sessionId: params.sessionId, + sessionId: activeSessionId, reason: resolveSessionCompactionCheckpointReason({ trigger: params.trigger, }), @@ -1122,9 +1155,9 @@ export async function compactEmbeddedPiSessionDirect( firstKeptEntryId: effectiveFirstKeptEntryId, tokensBefore: observedTokenCount ?? result.tokensBefore, tokensAfter, - postSessionFile: params.sessionFile, - postLeafId: postCompactionLeafId, - postEntryId: postCompactionLeafId, + postSessionFile: activeSessionFile, + postLeafId: activePostLeafId, + postEntryId: activePostLeafId, createdAt: compactStartedAt, }); checkpointSnapshotRetained = storedCheckpoint !== null; @@ -1153,7 +1186,7 @@ export async function compactEmbeddedPiSessionDirect( } await runAfterCompactionHooks({ hookRunner, - sessionId: params.sessionId, + sessionId: activeSessionId, sessionAgentId, hookSessionKey, missingSessionKey, @@ -1162,36 +1195,11 @@ export async function compactEmbeddedPiSessionDirect( messageCountAfter, tokensAfter, compactedCount, - sessionFile: params.sessionFile, + sessionFile: activeSessionFile, summaryLength: typeof result.summary === "string" ? result.summary.length : undefined, tokensBefore: result.tokensBefore, firstKeptEntryId: effectiveFirstKeptEntryId, }); - // Truncate session file to remove compacted entries (#39953) - if (params.config?.agents?.defaults?.compaction?.truncateAfterCompaction) { - try { - const heartbeatSummary = resolveHeartbeatSummaryForAgent( - params.config, - sessionAgentId, - ); - const truncResult = await truncateSessionAfterCompaction({ - sessionFile: params.sessionFile, - ackMaxChars: heartbeatSummary.ackMaxChars, - heartbeatPrompt: heartbeatSummary.prompt, - }); - if (truncResult.truncated) { - log.info( - `[compaction] post-compaction truncation removed ${truncResult.entriesRemoved} entries ` + - `(sessionKey=${params.sessionKey ?? params.sessionId})`, - ); - } - } catch (err) { - log.warn("[compaction] post-compaction truncation failed", { - errorMessage: formatErrorMessage(err), - errorStack: err instanceof Error ? err.stack : undefined, - }); - } - } return { ok: true, compacted: true, @@ -1201,6 +1209,8 @@ export async function compactEmbeddedPiSessionDirect( tokensBefore: observedTokenCount ?? result.tokensBefore, tokensAfter, details: result.details, + sessionId: transcriptRotation.sessionId, + sessionFile: transcriptRotation.sessionFile, }, }; } catch (err) { diff --git a/src/agents/pi-embedded-runner/compaction-successor-transcript.test.ts b/src/agents/pi-embedded-runner/compaction-successor-transcript.test.ts new file mode 100644 index 00000000000..c0f5f7e1f9a --- /dev/null +++ b/src/agents/pi-embedded-runner/compaction-successor-transcript.test.ts @@ -0,0 +1,177 @@ +import fs from "node:fs/promises"; +import os from "node:os"; +import path from "node:path"; +import { SessionManager } from "@mariozechner/pi-coding-agent"; +import { afterEach, describe, expect, it } from "vitest"; +import { makeAgentAssistantMessage } from "../test-helpers/agent-message-fixtures.js"; +import { + rotateTranscriptAfterCompaction, + shouldRotateCompactionTranscript, +} from "./compaction-successor-transcript.js"; +import { hardenManualCompactionBoundary } from "./manual-compaction-boundary.js"; + +let tmpDir: string | undefined; + +async function createTmpDir(): Promise { + tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "compaction-successor-test-")); + return tmpDir; +} + +afterEach(async () => { + if (tmpDir) { + await fs.rm(tmpDir, { recursive: true, force: true }).catch(() => undefined); + tmpDir = undefined; + } +}); + +function makeAssistant(text: string, timestamp: number) { + return makeAgentAssistantMessage({ + content: [{ type: "text", text }], + timestamp, + }); +} + +function createCompactedSession(sessionDir: string): { + manager: SessionManager; + sessionFile: string; + firstKeptId: string; + oldUserId: string; +} { + const manager = SessionManager.create(sessionDir, sessionDir); + manager.appendModelChange("openai", "gpt-5.2"); + manager.appendThinkingLevelChange("medium"); + manager.appendCustomEntry("test-extension", { cursor: "before-compaction" }); + const oldUserId = manager.appendMessage({ role: "user", content: "old user", timestamp: 1 }); + manager.appendLabelChange(oldUserId, "old bookmark"); + manager.appendMessage(makeAssistant("old assistant", 2)); + const firstKeptId = manager.appendMessage({ role: "user", content: "kept user", timestamp: 3 }); + manager.appendLabelChange(firstKeptId, "kept bookmark"); + manager.appendMessage(makeAssistant("kept assistant", 4)); + manager.appendCompaction("Summary of old user and old assistant.", firstKeptId, 5000); + manager.appendMessage({ role: "user", content: "post user", timestamp: 5 }); + manager.appendMessage(makeAssistant("post assistant", 6)); + return { manager, sessionFile: manager.getSessionFile()!, firstKeptId, oldUserId }; +} + +describe("rotateTranscriptAfterCompaction", () => { + it("creates a compacted successor transcript and leaves the archive untouched", async () => { + const dir = await createTmpDir(); + const { manager, sessionFile, firstKeptId, oldUserId } = createCompactedSession(dir); + const originalBytes = await fs.readFile(sessionFile, "utf8"); + const originalEntryCount = manager.getEntries().length; + + const result = await rotateTranscriptAfterCompaction({ + sessionManager: manager, + sessionFile, + now: () => new Date("2026-04-27T12:00:00.000Z"), + }); + + expect(result.rotated).toBe(true); + expect(result.sessionId).toBeTruthy(); + expect(result.sessionFile).toBeTruthy(); + expect(result.sessionFile).not.toBe(sessionFile); + expect(await fs.readFile(sessionFile, "utf8")).toBe(originalBytes); + + const successor = SessionManager.open(result.sessionFile!); + expect(successor.getHeader()).toMatchObject({ + id: result.sessionId, + parentSession: sessionFile, + cwd: dir, + }); + expect(successor.getEntries().length).toBeLessThan(originalEntryCount); + expect(successor.getBranch()[0]?.type).toBe("model_change"); + expect(successor.getBranch()).toContainEqual( + expect.objectContaining({ + type: "custom", + customType: "test-extension", + data: { cursor: "before-compaction" }, + }), + ); + + const context = successor.buildSessionContext(); + const contextText = JSON.stringify(context.messages); + expect(contextText).toContain("Summary of old user and old assistant."); + expect(contextText).toContain("kept user"); + expect(contextText).toContain("post assistant"); + expect( + context.messages.some((message) => message.role === "user" && message.content === "old user"), + ).toBe(false); + expect(context.model?.provider).toBe("openai"); + expect(context.thinkingLevel).toBe("medium"); + expect(successor.getLabel(firstKeptId)).toBe("kept bookmark"); + expect(successor.getLabel(oldUserId)).toBeUndefined(); + }); + + it("skips sessions with no compaction entry", async () => { + const dir = await createTmpDir(); + const manager = SessionManager.create(dir, dir); + manager.appendMessage({ role: "user", content: "hello", timestamp: 1 }); + manager.appendMessage(makeAssistant("hi", 2)); + + const result = await rotateTranscriptAfterCompaction({ + sessionManager: manager, + sessionFile: manager.getSessionFile()!, + }); + + expect(result).toMatchObject({ + rotated: false, + reason: "no compaction entry", + }); + }); + + it("uses a refreshed manager after manual boundary hardening", async () => { + const dir = await createTmpDir(); + const manager = SessionManager.create(dir, dir); + manager.appendMessage({ role: "user", content: "old question", timestamp: 1 }); + manager.appendMessage(makeAssistant("old answer", 2)); + const recentTailId = manager.appendMessage({ + role: "user", + content: "recent question", + timestamp: 3, + }); + manager.appendMessage(makeAssistant("detailed recent answer", 4)); + const compactionId = manager.appendCompaction("fresh manual summary", recentTailId, 200); + const sessionFile = manager.getSessionFile(); + expect(sessionFile).toBeTruthy(); + const staleManager = SessionManager.open(sessionFile!); + + const hardened = await hardenManualCompactionBoundary({ sessionFile: sessionFile! }); + expect(hardened.applied).toBe(true); + const staleLeaf = staleManager.getLeafEntry(); + expect(staleLeaf?.type).toBe("compaction"); + if (!staleLeaf || staleLeaf.type !== "compaction") { + throw new Error("expected stale leaf to be a compaction entry"); + } + expect(staleLeaf.firstKeptEntryId).toBe(recentTailId); + + const result = await rotateTranscriptAfterCompaction({ + sessionManager: SessionManager.open(sessionFile!), + sessionFile: sessionFile!, + now: () => new Date("2026-04-27T12:30:00.000Z"), + }); + + expect(result.rotated).toBe(true); + const successor = SessionManager.open(result.sessionFile!); + const successorText = JSON.stringify(successor.buildSessionContext().messages); + expect(successorText).toContain("fresh manual summary"); + expect(successorText).not.toContain("recent question"); + expect(successorText).not.toContain("detailed recent answer"); + const successorCompaction = successor + .getEntries() + .find((entry) => entry.type === "compaction" && entry.id === compactionId); + expect(successorCompaction).toMatchObject({ + firstKeptEntryId: compactionId, + }); + }); +}); + +describe("shouldRotateCompactionTranscript", () => { + it("keeps transcript rotation opt-in behind the existing config key", () => { + expect(shouldRotateCompactionTranscript()).toBe(false); + expect( + shouldRotateCompactionTranscript({ + agents: { defaults: { compaction: { truncateAfterCompaction: true } } }, + }), + ).toBe(true); + }); +}); diff --git a/src/agents/pi-embedded-runner/compaction-successor-transcript.ts b/src/agents/pi-embedded-runner/compaction-successor-transcript.ts new file mode 100644 index 00000000000..ce701c0b16a --- /dev/null +++ b/src/agents/pi-embedded-runner/compaction-successor-transcript.ts @@ -0,0 +1,206 @@ +import { randomUUID } from "node:crypto"; +import fs from "node:fs/promises"; +import path from "node:path"; +import { + CURRENT_SESSION_VERSION, + SessionManager, + type CompactionEntry, + type SessionEntry, + type SessionHeader, +} from "@mariozechner/pi-coding-agent"; +import type { OpenClawConfig } from "../../config/types.openclaw.js"; + +type ReadonlySessionManagerForRotation = Pick< + SessionManager, + "buildSessionContext" | "getBranch" | "getCwd" | "getHeader" +>; + +export type CompactionTranscriptRotation = { + rotated: boolean; + reason?: string; + sessionId?: string; + sessionFile?: string; + compactionEntryId?: string; + leafId?: string; + entriesWritten?: number; +}; + +export function shouldRotateCompactionTranscript(config?: OpenClawConfig): boolean { + return config?.agents?.defaults?.compaction?.truncateAfterCompaction === true; +} + +export async function rotateTranscriptAfterCompaction(params: { + sessionManager: ReadonlySessionManagerForRotation; + sessionFile: string; + now?: () => Date; +}): Promise { + const sessionFile = params.sessionFile.trim(); + if (!sessionFile) { + return { rotated: false, reason: "missing session file" }; + } + + const branch = params.sessionManager.getBranch(); + const latestCompactionIndex = findLatestCompactionIndex(branch); + if (latestCompactionIndex < 0) { + return { rotated: false, reason: "no compaction entry" }; + } + + const compaction = branch[latestCompactionIndex] as CompactionEntry; + const timestamp = (params.now?.() ?? new Date()).toISOString(); + const sessionId = randomUUID(); + const successorFile = resolveSuccessorSessionFile({ + sessionFile, + sessionId, + timestamp, + }); + const successorEntries = buildSuccessorEntries({ + branch, + latestCompactionIndex, + }); + if (successorEntries.length === 0) { + return { rotated: false, reason: "empty successor transcript" }; + } + + const header = buildSuccessorHeader({ + previousHeader: params.sessionManager.getHeader(), + sessionId, + timestamp, + cwd: params.sessionManager.getCwd(), + parentSession: sessionFile, + }); + await writeSessionFileAtomic(successorFile, [header, ...successorEntries]); + + try { + SessionManager.open(successorFile).buildSessionContext(); + } catch (err) { + await fs.unlink(successorFile).catch(() => undefined); + throw err; + } + + return { + rotated: true, + sessionId, + sessionFile: successorFile, + compactionEntryId: compaction.id, + leafId: successorEntries[successorEntries.length - 1]?.id, + entriesWritten: successorEntries.length, + }; +} + +function findLatestCompactionIndex(entries: SessionEntry[]): number { + for (let index = entries.length - 1; index >= 0; index -= 1) { + if (entries[index]?.type === "compaction") { + return index; + } + } + return -1; +} + +function buildSuccessorEntries(params: { + branch: SessionEntry[]; + latestCompactionIndex: number; +}): SessionEntry[] { + const { branch, latestCompactionIndex } = params; + const compaction = branch[latestCompactionIndex] as CompactionEntry; + const firstKeptIndex = branch.findIndex((entry) => entry.id === compaction.firstKeptEntryId); + const keptBeforeCompaction = + firstKeptIndex >= 0 && firstKeptIndex < latestCompactionIndex + ? branch.slice(firstKeptIndex, latestCompactionIndex) + : []; + const afterCompaction = branch.slice(latestCompactionIndex + 1); + const statePrefix = collectLatestStatePrefix(branch.slice(0, latestCompactionIndex)); + const successorEntries: SessionEntry[] = []; + const seenIds = new Set(); + let parentId: string | null = null; + + const append = (entry: SessionEntry) => { + if (seenIds.has(entry.id)) { + return; + } + const nextEntry = { ...entry, parentId } as SessionEntry; + successorEntries.push(nextEntry); + seenIds.add(nextEntry.id); + parentId = nextEntry.id; + }; + + for (const entry of statePrefix) { + append(entry); + } + append(compaction); + for (const entry of [...keptBeforeCompaction, ...afterCompaction]) { + if (entry.type === "compaction" || entry.type === "label") { + continue; + } + append(entry); + } + const retainedIds = new Set(successorEntries.map((entry) => entry.id)); + for (const entry of branch) { + if (entry.type !== "label" || !retainedIds.has(entry.targetId)) { + continue; + } + append(entry); + } + return successorEntries; +} + +function collectLatestStatePrefix(entries: SessionEntry[]): SessionEntry[] { + const customEntries: Array<{ index: number; entry: SessionEntry }> = []; + const latestByType = new Map(); + for (const [index, entry] of entries.entries()) { + if (entry.type === "custom") { + customEntries.push({ index, entry }); + } else if ( + entry.type === "thinking_level_change" || + entry.type === "model_change" || + entry.type === "session_info" + ) { + latestByType.set(entry.type, { index, entry }); + } + } + return [...customEntries, ...latestByType.values()] + .toSorted((left, right) => left.index - right.index) + .map(({ entry }) => entry); +} + +function buildSuccessorHeader(params: { + previousHeader: SessionHeader | null; + sessionId: string; + timestamp: string; + cwd: string; + parentSession: string; +}): SessionHeader { + return { + type: "session", + version: CURRENT_SESSION_VERSION, + id: params.sessionId, + timestamp: params.timestamp, + cwd: params.previousHeader?.cwd || params.cwd, + parentSession: params.parentSession, + }; +} + +function resolveSuccessorSessionFile(params: { + sessionFile: string; + sessionId: string; + timestamp: string; +}): string { + const fileTimestamp = params.timestamp.replace(/[:.]/g, "-"); + return path.join(path.dirname(params.sessionFile), `${fileTimestamp}_${params.sessionId}.jsonl`); +} + +async function writeSessionFileAtomic( + filePath: string, + entries: Array, +) { + const dir = path.dirname(filePath); + await fs.mkdir(dir, { recursive: true }); + const tmpFile = path.join(dir, `.${path.basename(filePath)}.${process.pid}.${randomUUID()}.tmp`); + const content = `${entries.map((entry) => JSON.stringify(entry)).join("\n")}\n`; + try { + await fs.writeFile(tmpFile, content, { encoding: "utf8", flag: "wx" }); + await fs.rename(tmpFile, filePath); + } catch (err) { + await fs.unlink(tmpFile).catch(() => undefined); + throw err; + } +} diff --git a/src/agents/pi-embedded-runner/run.overflow-compaction.fixture.ts b/src/agents/pi-embedded-runner/run.overflow-compaction.fixture.ts index dbebd4004f9..da7e077ff67 100644 --- a/src/agents/pi-embedded-runner/run.overflow-compaction.fixture.ts +++ b/src/agents/pi-embedded-runner/run.overflow-compaction.fixture.ts @@ -13,6 +13,8 @@ export function makeCompactionSuccess(params: { firstKeptEntryId?: string; tokensBefore?: number; tokensAfter?: number; + sessionId?: string; + sessionFile?: string; }) { return { ok: true as const, @@ -22,6 +24,8 @@ export function makeCompactionSuccess(params: { ...(params.firstKeptEntryId ? { firstKeptEntryId: params.firstKeptEntryId } : {}), ...(params.tokensBefore !== undefined ? { tokensBefore: params.tokensBefore } : {}), ...(params.tokensAfter !== undefined ? { tokensAfter: params.tokensAfter } : {}), + ...(params.sessionId !== undefined ? { sessionId: params.sessionId } : {}), + ...(params.sessionFile !== undefined ? { sessionFile: params.sessionFile } : {}), }, }; } @@ -83,6 +87,8 @@ type MockCompactDirect = { firstKeptEntryId?: string; tokensBefore?: number; tokensAfter?: number; + sessionId?: string; + sessionFile?: string; }; }) => unknown; }; diff --git a/src/agents/pi-embedded-runner/run.overflow-compaction.harness.ts b/src/agents/pi-embedded-runner/run.overflow-compaction.harness.ts index 9d3c20ff7ba..61342d7a320 100644 --- a/src/agents/pi-embedded-runner/run.overflow-compaction.harness.ts +++ b/src/agents/pi-embedded-runner/run.overflow-compaction.harness.ts @@ -22,6 +22,8 @@ type MockCompactionResult = firstKeptEntryId?: string; tokensBefore?: number; tokensAfter?: number; + sessionId?: string; + sessionFile?: string; }; reason?: string; } diff --git a/src/agents/pi-embedded-runner/run.overflow-compaction.test.ts b/src/agents/pi-embedded-runner/run.overflow-compaction.test.ts index ae88872fde4..013de551084 100644 --- a/src/agents/pi-embedded-runner/run.overflow-compaction.test.ts +++ b/src/agents/pi-embedded-runner/run.overflow-compaction.test.ts @@ -611,6 +611,42 @@ describe("runEmbeddedPiAgent overflow compaction trigger routing", () => { ); }); + it("retries overflow recovery against the rotated compacted transcript", async () => { + mockedRunEmbeddedAttempt + .mockResolvedValueOnce(makeAttemptResult({ promptError: makeOverflowError() })) + .mockResolvedValueOnce( + makeAttemptResult({ + promptError: null, + sessionIdUsed: "rotated-session", + sessionFileUsed: "/tmp/rotated-session.json", + }), + ); + mockedCompactDirect.mockResolvedValueOnce( + makeCompactionSuccess({ + summary: "rotated overflow compaction", + tokensAfter: 50, + sessionId: "rotated-session", + sessionFile: "/tmp/rotated-session.json", + }), + ); + + await runEmbeddedPiAgent(overflowBaseRunParams); + + expect(mockedRunEmbeddedAttempt).toHaveBeenNthCalledWith( + 2, + expect.objectContaining({ + sessionId: "rotated-session", + sessionFile: "/tmp/rotated-session.json", + }), + ); + expect(mockedRunContextEngineMaintenance).toHaveBeenCalledWith( + expect.objectContaining({ + sessionId: "rotated-session", + sessionFile: "/tmp/rotated-session.json", + }), + ); + }); + it("guards thrown engine-owned overflow compaction attempts", async () => { mockedContextEngine.info.ownsCompaction = true; mockedGlobalHookRunner.hasHooks.mockImplementation( diff --git a/src/agents/pi-embedded-runner/run.timeout-triggered-compaction.test.ts b/src/agents/pi-embedded-runner/run.timeout-triggered-compaction.test.ts index 31b5ad859c5..ac3c20a9c56 100644 --- a/src/agents/pi-embedded-runner/run.timeout-triggered-compaction.test.ts +++ b/src/agents/pi-embedded-runner/run.timeout-triggered-compaction.test.ts @@ -118,15 +118,30 @@ describe("timeout-triggered compaction", () => { summary: "compacted for timeout", tokensBefore: 160000, tokensAfter: 60000, + sessionId: "timeout-rotated-session", + sessionFile: "/tmp/timeout-rotated-session.json", }), ); // Second attempt succeeds - mockedRunEmbeddedAttempt.mockResolvedValueOnce(makeAttemptResult({ promptError: null })); + mockedRunEmbeddedAttempt.mockResolvedValueOnce( + makeAttemptResult({ + promptError: null, + sessionIdUsed: "timeout-rotated-session", + sessionFileUsed: "/tmp/timeout-rotated-session.json", + }), + ); const result = await runEmbeddedPiAgent(overflowBaseRunParams); // Verify the loop continued (retry happened) expect(mockedRunEmbeddedAttempt).toHaveBeenCalledTimes(2); + expect(mockedRunEmbeddedAttempt).toHaveBeenNthCalledWith( + 2, + expect.objectContaining({ + sessionId: "timeout-rotated-session", + sessionFile: "/tmp/timeout-rotated-session.json", + }), + ); expect(mockedRunPostCompactionSideEffects).not.toHaveBeenCalled(); expect(result.meta.error).toBeUndefined(); }); diff --git a/src/agents/pi-embedded-runner/run.ts b/src/agents/pi-embedded-runner/run.ts index 9677e5907e5..4aede7500ee 100644 --- a/src/agents/pi-embedded-runner/run.ts +++ b/src/agents/pi-embedded-runner/run.ts @@ -706,6 +706,24 @@ export async function runEmbeddedPiAgent( ensureContextEnginesInitialized(); const contextEngine = await resolveContextEngine(params.config); try { + let activeSessionId = params.sessionId; + let activeSessionFile = params.sessionFile; + const resolveActiveHookContext = () => ({ + ...hookCtx, + sessionId: activeSessionId, + }); + const adoptCompactionTranscript = ( + compactResult: Awaited>, + ) => { + const nextSessionId = compactResult.result?.sessionId; + const nextSessionFile = compactResult.result?.sessionFile; + if (nextSessionId && nextSessionId !== activeSessionId) { + activeSessionId = nextSessionId; + } + if (nextSessionFile && nextSessionFile !== activeSessionFile) { + activeSessionFile = nextSessionFile; + } + }; // When the engine owns compaction, compactEmbeddedPiSessionDirect is // bypassed. Fire lifecycle hooks here so recovery paths still notify // subscribers like memory extensions and usage trackers. @@ -718,8 +736,8 @@ export async function runEmbeddedPiAgent( } try { await hookRunner.runBeforeCompaction( - { messageCount: -1, sessionFile: params.sessionFile }, - hookCtx, + { messageCount: -1, sessionFile: activeSessionFile }, + resolveActiveHookContext(), ); } catch (hookErr) { log.warn(`before_compaction hook failed during ${reason}: ${String(hookErr)}`); @@ -743,9 +761,9 @@ export async function runEmbeddedPiAgent( messageCount: -1, compactedCount: -1, tokenCount: compactResult.result?.tokensAfter, - sessionFile: params.sessionFile, + sessionFile: compactResult.result?.sessionFile ?? activeSessionFile, }, - hookCtx, + resolveActiveHookContext(), ); } catch (hookErr) { log.warn(`after_compaction hook failed during ${reason}: ${String(hookErr)}`); @@ -778,7 +796,7 @@ export async function runEmbeddedPiAgent( profileId: lastProfileId, durationMs: Date.now() - started, agentMeta: buildErrorAgentMeta({ - sessionId: params.sessionId, + sessionId: activeSessionId, provider, model: model.id, contextTokens: ctxInfo.tokens, @@ -836,7 +854,7 @@ export async function runEmbeddedPiAgent( }); const attempt = await runEmbeddedAttemptWithBackend({ - sessionId: params.sessionId, + sessionId: activeSessionId, sessionKey: resolvedSessionKey, sandboxSessionKey: params.sandboxSessionKey, trigger: params.trigger, @@ -862,7 +880,7 @@ export async function runEmbeddedPiAgent( currentMessageId: params.currentMessageId, replyToMode: params.replyToMode, hasRepliedRef: params.hasRepliedRef, - sessionFile: params.sessionFile, + sessionFile: activeSessionFile, workspaceDir: resolvedWorkspace, agentDir, config: params.config, @@ -951,9 +969,16 @@ export async function runEmbeddedPiAgent( idleTimedOut, timedOutDuringCompaction, sessionIdUsed, + sessionFileUsed, lastAssistant: sessionLastAssistant, currentAttemptAssistant, } = attempt; + if (sessionIdUsed && sessionIdUsed !== activeSessionId) { + activeSessionId = sessionIdUsed; + } + if (sessionFileUsed && sessionFileUsed !== activeSessionFile) { + activeSessionFile = sessionFileUsed; + } bootstrapPromptWarningSignaturesSeen = attempt.bootstrapPromptWarningSignaturesSeen ?? (attempt.bootstrapPromptWarningSignature @@ -1096,9 +1121,9 @@ export async function runEmbeddedPiAgent( maxAttempts: MAX_TIMEOUT_COMPACTION_ATTEMPTS, }; timeoutCompactResult = await contextEngine.compact({ - sessionId: params.sessionId, + sessionId: activeSessionId, sessionKey: params.sessionKey, - sessionFile: params.sessionFile, + sessionFile: activeSessionFile, tokenBudget: ctxInfo.tokens, force: true, compactionTarget: "budget", @@ -1114,6 +1139,9 @@ export async function runEmbeddedPiAgent( reason: String(compactErr), }; } + if (timeoutCompactResult.compacted) { + adoptCompactionTranscript(timeoutCompactResult); + } await runOwnsCompactionAfterHook("timeout recovery", timeoutCompactResult); if (timeoutCompactResult.compacted) { autoCompactionCount += 1; @@ -1121,7 +1149,7 @@ export async function runEmbeddedPiAgent( await runPostCompactionSideEffects({ config: params.config, sessionKey: params.sessionKey, - sessionFile: params.sessionFile, + sessionFile: activeSessionFile, }); } log.info( @@ -1165,7 +1193,7 @@ export async function runEmbeddedPiAgent( log.warn( `[context-overflow-diag] sessionKey=${params.sessionKey ?? params.sessionId} ` + `provider=${provider}/${modelId} source=${contextOverflowError.source} ` + - `messages=${msgCount} sessionFile=${params.sessionFile} ` + + `messages=${msgCount} sessionFile=${activeSessionFile} ` + `diagId=${overflowDiagId} compactionAttempts=${overflowCompactionAttempts} ` + `observedTokens=${observedOverflowTokens ?? "unknown"} ` + `error=${errorText.slice(0, 200)}`, @@ -1241,9 +1269,9 @@ export async function runEmbeddedPiAgent( maxAttempts: MAX_OVERFLOW_COMPACTION_ATTEMPTS, }; compactResult = await contextEngine.compact({ - sessionId: params.sessionId, + sessionId: activeSessionId, sessionKey: params.sessionKey, - sessionFile: params.sessionFile, + sessionFile: activeSessionFile, tokenBudget: ctxInfo.tokens, ...(observedOverflowTokens !== undefined ? { currentTokenCount: observedOverflowTokens } @@ -1253,11 +1281,12 @@ export async function runEmbeddedPiAgent( runtimeContext: overflowCompactionRuntimeContext, }); if (compactResult.ok && compactResult.compacted) { + adoptCompactionTranscript(compactResult); await runContextEngineMaintenance({ contextEngine, - sessionId: params.sessionId, + sessionId: activeSessionId, sessionKey: params.sessionKey, - sessionFile: params.sessionFile, + sessionFile: activeSessionFile, reason: "compaction", runtimeContext: overflowCompactionRuntimeContext, }); @@ -1274,16 +1303,17 @@ export async function runEmbeddedPiAgent( } await runOwnsCompactionAfterHook("overflow recovery", compactResult); if (compactResult.compacted) { + adoptCompactionTranscript(compactResult); if (preflightRecovery?.route === "compact_then_truncate") { const truncResult = await truncateOversizedToolResultsInSession({ - sessionFile: params.sessionFile, + sessionFile: activeSessionFile, contextWindowTokens: ctxInfo.tokens, maxCharsOverride: resolveLiveToolResultMaxChars({ contextWindowTokens: ctxInfo.tokens, cfg: params.config, agentId: sessionAgentId, }), - sessionId: params.sessionId, + sessionId: activeSessionId, sessionKey: params.sessionKey, }); if (truncResult.truncated) { @@ -1328,10 +1358,10 @@ export async function runEmbeddedPiAgent( `(contextWindow=${contextWindowTokens} tokens)`, ); const truncResult = await truncateOversizedToolResultsInSession({ - sessionFile: params.sessionFile, + sessionFile: activeSessionFile, contextWindowTokens, maxCharsOverride: toolResultMaxChars, - sessionId: params.sessionId, + sessionId: activeSessionId, sessionKey: params.sessionKey, }); if (truncResult.truncated) { @@ -1782,6 +1812,7 @@ export async function runEmbeddedPiAgent( }); const agentMeta: EmbeddedPiAgentMeta = { sessionId: sessionIdUsed, + sessionFile: sessionFileUsed, provider: sessionLastAssistant?.provider ?? provider, model: sessionLastAssistant?.model ?? model.id, contextTokens: ctxInfo.tokens, diff --git a/src/agents/pi-embedded-runner/run/attempt.ts b/src/agents/pi-embedded-runner/run/attempt.ts index e05a9571e70..f7ad939e648 100644 --- a/src/agents/pi-embedded-runner/run/attempt.ts +++ b/src/agents/pi-embedded-runner/run/attempt.ts @@ -232,6 +232,10 @@ import { shouldStripBootstrapFromEmbeddedContext, } from "./attempt-bootstrap-routing.js"; export { shouldStripBootstrapFromEmbeddedContext } from "./attempt-bootstrap-routing.js"; +import { + rotateTranscriptAfterCompaction, + shouldRotateCompactionTranscript, +} from "../compaction-successor-transcript.js"; import { configureEmbeddedAttemptHttpRuntime } from "./attempt-http-runtime.js"; import { assembleAttemptContextEngine, @@ -2170,6 +2174,7 @@ export async function runEmbeddedAttempt( let messagesSnapshot: AgentMessage[] = []; let sessionIdUsed = activeSession.sessionId; + let sessionFileUsed: string | undefined = params.sessionFile; const onAbort = () => { externalAbort = true; const reason = params.abortSignal ? getAbortReason(params.abortSignal) : undefined; @@ -2904,6 +2909,35 @@ export async function runEmbeddedAttempt( } } + if ( + compactionOccurredThisAttempt && + !promptError && + !aborted && + !timedOut && + !idleTimedOut && + !timedOutDuringCompaction && + shouldRotateCompactionTranscript(params.config) + ) { + try { + const rotation = await rotateTranscriptAfterCompaction({ + sessionManager, + sessionFile: params.sessionFile, + }); + if (rotation.rotated) { + sessionIdUsed = rotation.sessionId ?? sessionIdUsed; + sessionFileUsed = rotation.sessionFile ?? sessionFileUsed; + log.info( + `[compaction] rotated active transcript after automatic compaction ` + + `(sessionKey=${params.sessionKey ?? params.sessionId})`, + ); + } + } catch (err) { + log.warn("[compaction] automatic transcript rotation failed", { + errorMessage: formatErrorMessage(err), + }); + } + } + cacheTrace?.recordStage("session:after", { messages: messagesSnapshot, note: timedOutDuringCompaction @@ -3127,6 +3161,7 @@ export async function runEmbeddedAttempt( promptErrorSource, preflightRecovery, sessionIdUsed, + sessionFileUsed, diagnosticTrace, bootstrapPromptWarningSignaturesSeen: bootstrapPromptWarning.warningSignaturesSeen, bootstrapPromptWarningSignature: bootstrapPromptWarning.signature, diff --git a/src/agents/pi-embedded-runner/run/types.ts b/src/agents/pi-embedded-runner/run/types.ts index 29700bf7c73..5f948bb524a 100644 --- a/src/agents/pi-embedded-runner/run/types.ts +++ b/src/agents/pi-embedded-runner/run/types.ts @@ -76,6 +76,7 @@ export type EmbeddedRunAttemptResult = { handled?: false; }; sessionIdUsed: string; + sessionFileUsed?: string; diagnosticTrace?: DiagnosticTraceContext; agentHarnessId?: string; agentHarnessResultClassification?: "empty" | "reasoning-only" | "planning-only"; diff --git a/src/agents/pi-embedded-runner/session-truncation.test.ts b/src/agents/pi-embedded-runner/session-truncation.test.ts deleted file mode 100644 index 1eddf723b65..00000000000 --- a/src/agents/pi-embedded-runner/session-truncation.test.ts +++ /dev/null @@ -1,368 +0,0 @@ -import fs from "node:fs/promises"; -import os from "node:os"; -import path from "node:path"; -import { SessionManager } from "@mariozechner/pi-coding-agent"; -import { afterEach, describe, expect, it } from "vitest"; -import { makeAgentAssistantMessage } from "../test-helpers/agent-message-fixtures.js"; -import { truncateSessionAfterCompaction } from "./session-truncation.js"; - -let tmpDir: string; - -async function createTmpDir(): Promise { - tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "session-truncation-test-")); - return tmpDir; -} - -afterEach(async () => { - if (tmpDir) { - await fs.rm(tmpDir, { recursive: true, force: true }).catch(() => {}); - } -}); - -function makeAssistant(text: string, timestamp: number) { - return makeAgentAssistantMessage({ - content: [{ type: "text", text }], - timestamp, - }); -} - -function createSessionWithCompaction(sessionDir: string): string { - const sm = SessionManager.create(sessionDir, sessionDir); - // Add messages before compaction - sm.appendMessage({ role: "user", content: "hello", timestamp: 1 }); - sm.appendMessage(makeAssistant("hi there", 2)); - sm.appendMessage({ role: "user", content: "do something", timestamp: 3 }); - sm.appendMessage(makeAssistant("done", 4)); - - // Add compaction (summarizing the above) - const branch = sm.getBranch(); - const firstKeptId = branch[branch.length - 1].id; - sm.appendCompaction("Summary of conversation so far.", firstKeptId, 5000); - - // Add messages after compaction - sm.appendMessage({ role: "user", content: "next task", timestamp: 5 }); - sm.appendMessage(makeAssistant("working on it", 6)); - - return sm.getSessionFile()!; -} - -describe("truncateSessionAfterCompaction", () => { - it("removes entries before compaction and keeps entries after (#39953)", async () => { - const dir = await createTmpDir(); - const sessionFile = createSessionWithCompaction(dir); - - // Verify pre-truncation state - const smBefore = SessionManager.open(sessionFile); - const entriesBefore = smBefore.getEntries().length; - expect(entriesBefore).toBeGreaterThan(5); // 4 messages + compaction + 2 messages - - const result = await truncateSessionAfterCompaction({ sessionFile }); - - expect(result.truncated).toBe(true); - expect(result.entriesRemoved).toBeGreaterThan(0); - expect(result.bytesAfter).toBeLessThan(result.bytesBefore!); - - // Verify post-truncation: file is still a valid session - const smAfter = SessionManager.open(sessionFile); - const entriesAfter = smAfter.getEntries().length; - expect(entriesAfter).toBeLessThan(entriesBefore); - - // The branch should contain the firstKeptEntryId message (unsummarized - // tail), compaction, and post-compaction messages - const branchAfter = smAfter.getBranch(); - // The firstKeptEntryId message is preserved as the new root - expect(branchAfter[0].type).toBe("message"); - expect(branchAfter[0].parentId).toBeNull(); - expect(branchAfter[1].type).toBe("compaction"); - - // Session context should still work - const ctx = smAfter.buildSessionContext(); - expect(ctx.messages.length).toBeGreaterThan(0); - }); - - it("skips truncation when no compaction entry exists", async () => { - const dir = await createTmpDir(); - const sm = SessionManager.create(dir, dir); - // appendMessage implicitly creates the session file - sm.appendMessage({ role: "user", content: "hello", timestamp: 1 }); - sm.appendMessage(makeAssistant("hi", 2)); - sm.appendMessage({ role: "user", content: "bye", timestamp: 3 }); - const sessionFile = sm.getSessionFile()!; - - const result = await truncateSessionAfterCompaction({ sessionFile }); - - expect(result.truncated).toBe(false); - expect(result.reason).toBe("no compaction entry found"); - }); - - it("is idempotent — second truncation is a no-op", async () => { - const dir = await createTmpDir(); - const sessionFile = createSessionWithCompaction(dir); - - const first = await truncateSessionAfterCompaction({ sessionFile }); - expect(first.truncated).toBe(true); - - // Run again — no message entries left to remove - const second = await truncateSessionAfterCompaction({ sessionFile }); - expect(second.truncated).toBe(false); - }); - - it("archives original file when archivePath is provided (#39953)", async () => { - const dir = await createTmpDir(); - const sessionFile = createSessionWithCompaction(dir); - const archivePath = path.join(dir, "archive", "backup.jsonl"); - - const result = await truncateSessionAfterCompaction({ sessionFile, archivePath }); - - expect(result.truncated).toBe(true); - const archiveExists = await fs - .stat(archivePath) - .then(() => true) - .catch(() => false); - expect(archiveExists).toBe(true); - - // Archive should be larger than truncated file (it has the full history) - const archiveSize = (await fs.stat(archivePath)).size; - const truncatedSize = (await fs.stat(sessionFile)).size; - expect(archiveSize).toBeGreaterThan(truncatedSize); - }); - - it("handles multiple compaction cycles (#39953)", async () => { - const dir = await createTmpDir(); - const sm = SessionManager.create(dir, dir); - - // First cycle: messages + compaction - sm.appendMessage({ role: "user", content: "cycle 1 message 1", timestamp: 1 }); - sm.appendMessage(makeAssistant("response 1", 2)); - const branch1 = sm.getBranch(); - sm.appendCompaction("Summary of cycle 1.", branch1[branch1.length - 1].id, 3000); - - // Second cycle: more messages + another compaction - sm.appendMessage({ role: "user", content: "cycle 2 message 1", timestamp: 3 }); - sm.appendMessage(makeAssistant("response 2", 4)); - const branch2 = sm.getBranch(); - sm.appendCompaction("Summary of cycles 1 and 2.", branch2[branch2.length - 1].id, 6000); - - // Post-compaction messages - sm.appendMessage({ role: "user", content: "final question", timestamp: 5 }); - - const sessionFile = sm.getSessionFile()!; - const entriesBefore = sm.getEntries().length; - - const result = await truncateSessionAfterCompaction({ sessionFile }); - - expect(result.truncated).toBe(true); - - // Should preserve both compactions (older compactions are non-message state) - // but remove the summarized message entries - const smAfter = SessionManager.open(sessionFile); - const branchAfter = smAfter.getBranch(); - expect(branchAfter[0].type).toBe("compaction"); - - // Both compaction entries are preserved (non-message state is kept) - const compactionEntries = branchAfter.filter((e) => e.type === "compaction"); - expect(compactionEntries).toHaveLength(2); - - // But message entries before the latest compaction were removed - const entriesAfter = smAfter.getEntries().length; - expect(entriesAfter).toBeLessThan(entriesBefore); - - // Only the firstKeptEntryId message should remain before the latest compaction - const latestCompIdx = branchAfter.findIndex( - (e) => e.type === "compaction" && e === compactionEntries[compactionEntries.length - 1], - ); - const messagesBeforeLatest = branchAfter - .slice(0, latestCompIdx) - .filter((e) => e.type === "message"); - expect(messagesBeforeLatest).toHaveLength(1); - }); - - it("preserves non-message session state during truncation", async () => { - const dir = await createTmpDir(); - const sm = SessionManager.create(dir, dir); - - // Messages before compaction - sm.appendMessage({ role: "user", content: "hello", timestamp: 1 }); - sm.appendMessage(makeAssistant("hi", 2)); - - // Non-message state entries interleaved with messages - sm.appendModelChange("anthropic", "claude-sonnet-4-5-20250514"); - sm.appendThinkingLevelChange("high"); - sm.appendCustomEntry("my-extension", { key: "value" }); - sm.appendSessionInfo("my session"); - - sm.appendMessage({ role: "user", content: "do task", timestamp: 3 }); - sm.appendMessage(makeAssistant("done", 4)); - - // Compaction summarizing the conversation - const branch = sm.getBranch(); - const firstKeptId = branch[branch.length - 1].id; - sm.appendCompaction("Summary.", firstKeptId, 5000); - - // Post-compaction messages - sm.appendMessage({ role: "user", content: "next", timestamp: 5 }); - - const sessionFile = sm.getSessionFile()!; - const result = await truncateSessionAfterCompaction({ sessionFile }); - - expect(result.truncated).toBe(true); - - // Verify non-message entries are preserved - const smAfter = SessionManager.open(sessionFile); - const allAfter = smAfter.getEntries(); - const types = allAfter.map((e) => e.type); - - expect(types).toContain("model_change"); - expect(types).toContain("thinking_level_change"); - expect(types).toContain("custom"); - expect(types).toContain("session_info"); - expect(types).toContain("compaction"); - - // Only the firstKeptEntryId message should remain before the compaction - // (all other messages before it were summarized and removed) - const branchAfter = smAfter.getBranch(); - const compIdx = branchAfter.findIndex((e) => e.type === "compaction"); - const msgsBefore = branchAfter.slice(0, compIdx).filter((e) => e.type === "message"); - expect(msgsBefore).toHaveLength(1); - - // Session context should still work - const ctx = smAfter.buildSessionContext(); - expect(ctx.messages.length).toBeGreaterThan(0); - // Non-message state entries are preserved in the truncated file - expect(ctx.model).toBeDefined(); - expect(ctx.thinkingLevel).toBe("high"); - }); - - it("drops label entries whose target message was truncated", async () => { - const dir = await createTmpDir(); - const sm = SessionManager.create(dir, dir); - - // Messages before compaction - sm.appendMessage({ role: "user", content: "hello", timestamp: 1 }); - sm.appendMessage(makeAssistant("hi", 2)); - sm.appendMessage({ role: "user", content: "do task", timestamp: 3 }); - sm.appendMessage(makeAssistant("done", 4)); - - // Capture a pre-compaction message that will be summarized away. - const branch = sm.getBranch(); - const preCompactionMsgId = branch[1].id; // "hi" message - - // Compaction summarizing the conversation - const firstKeptId = branch[branch.length - 1].id; - sm.appendCompaction("Summary.", firstKeptId, 5000); - - // Post-compaction messages - sm.appendMessage({ role: "user", content: "next", timestamp: 5 }); - sm.appendLabelChange(preCompactionMsgId, "my-label"); - - const sessionFile = sm.getSessionFile()!; - const labelEntry = sm.getEntries().find((entry) => entry.type === "label"); - expect(labelEntry?.parentId).not.toBe(preCompactionMsgId); - - const smBefore = SessionManager.open(sessionFile); - expect(smBefore.getLabel(preCompactionMsgId)).toBe("my-label"); - - const result = await truncateSessionAfterCompaction({ sessionFile }); - - expect(result.truncated).toBe(true); - - // Verify label metadata was dropped with the removed target message. - const smAfter = SessionManager.open(sessionFile); - const allAfter = smAfter.getEntries(); - const labels = allAfter.filter((e) => e.type === "label"); - expect(labels).toHaveLength(0); - expect(smAfter.getLabel(preCompactionMsgId)).toBeUndefined(); - }); - - it("preserves the firstKeptEntryId unsummarized tail", async () => { - const dir = await createTmpDir(); - const sm = SessionManager.create(dir, dir); - - // Build a conversation where firstKeptEntryId is NOT the last message - sm.appendMessage({ role: "user", content: "msg1", timestamp: 1 }); - sm.appendMessage(makeAssistant("resp1", 2)); - sm.appendMessage({ role: "user", content: "msg2", timestamp: 3 }); - sm.appendMessage(makeAssistant("resp2", 4)); - - const branch = sm.getBranch(); - // Set firstKeptEntryId to the second message — so msg1 is summarized - // but msg2, resp2, and everything after are the unsummarized tail. - const firstKeptId = branch[1].id; // "resp1" - sm.appendCompaction("Summary of msg1.", firstKeptId, 2000); - - sm.appendMessage({ role: "user", content: "next", timestamp: 5 }); - - const sessionFile = sm.getSessionFile()!; - const result = await truncateSessionAfterCompaction({ sessionFile }); - - expect(result.truncated).toBe(true); - // Only msg1 was summarized (1 entry removed) - expect(result.entriesRemoved).toBe(1); - - // Verify the unsummarized tail is preserved - const smAfter = SessionManager.open(sessionFile); - const branchAfter = smAfter.getBranch(); - const types = branchAfter.map((e) => e.type); - // resp1 (firstKeptEntryId), msg2, resp2, compaction, next - expect(types).toEqual(["message", "message", "message", "compaction", "message"]); - - // buildSessionContext should include the unsummarized tail - const ctx = smAfter.buildSessionContext(); - expect(ctx.messages.length).toBeGreaterThan(2); - }); - - it("preserves unsummarized sibling branches during truncation", async () => { - const dir = await createTmpDir(); - const sm = SessionManager.create(dir, dir); - - // Build main conversation - sm.appendMessage({ role: "user", content: "hello", timestamp: 1 }); - sm.appendMessage(makeAssistant("hi there", 2)); - - // Save a branch point - const branchPoint = sm.getBranch(); - const branchFromId = branchPoint[branchPoint.length - 1].id; - - // Continue main branch - sm.appendMessage({ role: "user", content: "do task A", timestamp: 3 }); - sm.appendMessage(makeAssistant("done A", 4)); - - // Create a sibling branch from the earlier point - sm.branch(branchFromId); - sm.appendMessage({ role: "user", content: "do task B instead", timestamp: 5 }); - const siblingMsg = sm.appendMessage(makeAssistant("done B", 6)); - - // Go back to main branch tip and add compaction there - sm.branch(branchFromId); - sm.appendMessage({ role: "user", content: "do task A", timestamp: 3 }); - sm.appendMessage(makeAssistant("done A take 2", 7)); - const mainBranch = sm.getBranch(); - const firstKeptId = mainBranch[mainBranch.length - 1].id; - sm.appendCompaction("Summary of main branch.", firstKeptId, 5000); - sm.appendMessage({ role: "user", content: "next", timestamp: 8 }); - - const sessionFile = sm.getSessionFile()!; - - const entriesBefore = sm.getEntries(); - - const result = await truncateSessionAfterCompaction({ sessionFile }); - - expect(result.truncated).toBe(true); - - // Verify sibling branch is preserved in the full entry list - const smAfter = SessionManager.open(sessionFile); - const allAfter = smAfter.getEntries(); - - // The sibling branch message should still exist - const siblingAfter = allAfter.find((e) => e.id === siblingMsg); - expect(siblingAfter).toBeDefined(); - - // The tree should have entries from both branches - const tree = smAfter.getTree(); - expect(tree.length).toBeGreaterThan(0); - - // Total entries should be less (main branch messages removed) but not zero - expect(allAfter.length).toBeGreaterThan(0); - expect(allAfter.length).toBeLessThan(entriesBefore.length); - }); -}); diff --git a/src/agents/pi-embedded-runner/session-truncation.ts b/src/agents/pi-embedded-runner/session-truncation.ts deleted file mode 100644 index 00886156094..00000000000 --- a/src/agents/pi-embedded-runner/session-truncation.ts +++ /dev/null @@ -1,252 +0,0 @@ -import fs from "node:fs/promises"; -import path from "node:path"; -import type { CompactionEntry, SessionEntry } from "@mariozechner/pi-coding-agent"; -import { SessionManager } from "@mariozechner/pi-coding-agent"; -import { - isHeartbeatOkResponse, - isHeartbeatUserMessage, -} from "../../auto-reply/heartbeat-filter.js"; -import { formatErrorMessage } from "../../infra/errors.js"; -import { log } from "./logger.js"; - -/** - * Truncate a session JSONL file after compaction by removing only the - * message entries that the compaction actually summarized. - * - * After compaction, the session file still contains all historical entries - * even though `buildSessionContext()` logically skips entries before - * `firstKeptEntryId`. Over many compaction cycles this causes unbounded - * file growth (issue #39953). - * - * This function rewrites the file keeping: - * 1. The session header - * 2. All non-message session state (custom, model_change, thinking_level_change, - * session_info, custom_message, compaction entries) - * Note: label and branch_summary entries referencing removed messages are - * also dropped to avoid dangling metadata. - * 3. All entries from sibling branches not covered by the compaction - * 4. The unsummarized tail: entries from `firstKeptEntryId` through (and - * including) the compaction entry, plus all entries after it - * - * Only `message` entries in the current branch that precede the compaction's - * `firstKeptEntryId` are removed — they are the entries the compaction - * actually summarized. Entries from `firstKeptEntryId` onward are preserved - * because `buildSessionContext()` expects them when reconstructing the - * session. Entries whose parent was removed are re-parented to the nearest - * kept ancestor (or become roots). - */ -export async function truncateSessionAfterCompaction(params: { - sessionFile: string; - /** Optional path to archive the pre-truncation file. */ - archivePath?: string; - ackMaxChars?: number; - heartbeatPrompt?: string; -}): Promise { - const { sessionFile } = params; - - let sm: SessionManager; - try { - sm = SessionManager.open(sessionFile); - } catch (err) { - const reason = formatErrorMessage(err); - log.warn(`[session-truncation] Failed to open session file: ${reason}`); - return { truncated: false, entriesRemoved: 0, reason }; - } - - const header = sm.getHeader(); - if (!header) { - return { truncated: false, entriesRemoved: 0, reason: "missing session header" }; - } - - const branch = sm.getBranch(); - if (branch.length === 0) { - return { truncated: false, entriesRemoved: 0, reason: "empty session" }; - } - - // Find the latest compaction entry in the current branch - let latestCompactionIdx = -1; - for (let i = branch.length - 1; i >= 0; i--) { - if (branch[i].type === "compaction") { - latestCompactionIdx = i; - break; - } - } - - if (latestCompactionIdx < 0) { - return { truncated: false, entriesRemoved: 0, reason: "no compaction entry found" }; - } - - // Nothing to truncate if compaction is already at root - if (latestCompactionIdx === 0) { - return { truncated: false, entriesRemoved: 0, reason: "compaction already at root" }; - } - - // The compaction's firstKeptEntryId marks the start of the "unsummarized - // tail" — entries from firstKeptEntryId through the compaction that - // buildSessionContext() expects to find when reconstructing the session. - // Only entries *before* firstKeptEntryId were actually summarized. - const compactionEntry = branch[latestCompactionIdx] as CompactionEntry; - const { firstKeptEntryId } = compactionEntry; - - // Collect IDs of entries in the current branch that were actually summarized - // (everything before firstKeptEntryId). Entries from firstKeptEntryId through - // the compaction are the unsummarized tail and must be preserved. - const summarizedBranchIds = new Set(); - for (let i = 0; i < latestCompactionIdx; i++) { - if (firstKeptEntryId && branch[i].id === firstKeptEntryId) { - break; // Everything from here to the compaction is the unsummarized tail - } - summarizedBranchIds.add(branch[i].id); - } - - // Operate on the full transcript so sibling branches and tree metadata - // are not silently dropped. - const allEntries = sm.getEntries(); - - // Only remove message-type entries that the compaction actually summarized. - // Non-message session state (custom, model_change, thinking_level_change, - // session_info, custom_message) is preserved even if it sits in the - // summarized portion of the branch. - // - // label and branch_summary entries that reference removed message IDs are - // also dropped to avoid dangling metadata (consistent with the approach in - // tool-result-truncation.ts). - const removedIds = new Set(); - for (const entry of allEntries) { - if (summarizedBranchIds.has(entry.id) && entry.type === "message") { - removedIds.add(entry.id); - } - } - - for (let i = 0; i < branch.length - 1; i++) { - const userEntry = branch[i]; - const assistantEntry = branch[i + 1]; - if ( - userEntry.type === "message" && - assistantEntry.type === "message" && - summarizedBranchIds.has(userEntry.id) && - summarizedBranchIds.has(assistantEntry.id) && - !removedIds.has(userEntry.id) && - !removedIds.has(assistantEntry.id) && - isHeartbeatUserMessage(userEntry.message, params.heartbeatPrompt) && - isHeartbeatOkResponse(assistantEntry.message, params.ackMaxChars) - ) { - removedIds.add(userEntry.id); - removedIds.add(assistantEntry.id); - i++; - } - } - - // Labels bookmark targetId while parentId just records the leaf when the - // label was changed, so targetId determines whether the label is still valid. - // Branch summaries still hang off the summarized branch via parentId. - for (const entry of allEntries) { - if (entry.type === "label" && removedIds.has(entry.targetId)) { - removedIds.add(entry.id); - continue; - } - if ( - entry.type === "branch_summary" && - entry.parentId !== null && - removedIds.has(entry.parentId) - ) { - removedIds.add(entry.id); - } - } - - if (removedIds.size === 0) { - return { truncated: false, entriesRemoved: 0, reason: "no entries to remove" }; - } - - // Build an id→entry map for walking parent chains during re-parenting. - const entryById = new Map(); - for (const entry of allEntries) { - entryById.set(entry.id, entry); - } - - // Keep every entry that was not removed, re-parenting where necessary so - // the tree stays connected. - const keptEntries: SessionEntry[] = []; - for (const entry of allEntries) { - if (removedIds.has(entry.id)) { - continue; - } - - // Walk up the parent chain to find the nearest kept ancestor. - let newParentId = entry.parentId; - while (newParentId !== null && removedIds.has(newParentId)) { - const parent = entryById.get(newParentId); - newParentId = parent?.parentId ?? null; - } - - if (newParentId !== entry.parentId) { - keptEntries.push({ ...entry, parentId: newParentId }); - } else { - keptEntries.push(entry); - } - } - - const entriesRemoved = removedIds.size; - const totalEntriesBefore = allEntries.length; - - // Get file size before truncation - let bytesBefore = 0; - try { - const stat = await fs.stat(sessionFile); - bytesBefore = stat.size; - } catch { - // If stat fails, continue anyway - } - - // Archive original file if requested - if (params.archivePath) { - try { - const archiveDir = path.dirname(params.archivePath); - await fs.mkdir(archiveDir, { recursive: true }); - await fs.copyFile(sessionFile, params.archivePath); - log.info(`[session-truncation] Archived pre-truncation file to ${params.archivePath}`); - } catch (err) { - const reason = formatErrorMessage(err); - log.warn(`[session-truncation] Failed to archive: ${reason}`); - } - } - - // Write truncated file atomically (temp + rename) - const lines: string[] = [JSON.stringify(header), ...keptEntries.map((e) => JSON.stringify(e))]; - const content = lines.join("\n") + "\n"; - - const tmpFile = `${sessionFile}.truncate-tmp`; - try { - await fs.writeFile(tmpFile, content, "utf-8"); - await fs.rename(tmpFile, sessionFile); - } catch (err) { - // Clean up temp file on failure - try { - await fs.unlink(tmpFile); - } catch { - // Ignore cleanup errors - } - const reason = formatErrorMessage(err); - log.warn(`[session-truncation] Failed to write truncated file: ${reason}`); - return { truncated: false, entriesRemoved: 0, reason }; - } - - const bytesAfter = Buffer.byteLength(content, "utf-8"); - - log.info( - `[session-truncation] Truncated session file: ` + - `entriesBefore=${totalEntriesBefore} entriesAfter=${keptEntries.length} ` + - `removed=${entriesRemoved} bytesBefore=${bytesBefore} bytesAfter=${bytesAfter} ` + - `reduction=${bytesBefore > 0 ? ((1 - bytesAfter / bytesBefore) * 100).toFixed(1) : "?"}%`, - ); - - return { truncated: true, entriesRemoved, bytesBefore, bytesAfter }; -} - -export type TruncationResult = { - truncated: boolean; - entriesRemoved: number; - bytesBefore?: number; - bytesAfter?: number; - reason?: string; -}; diff --git a/src/agents/pi-embedded-runner/types.ts b/src/agents/pi-embedded-runner/types.ts index 1b38517285b..b9dd3e73ab3 100644 --- a/src/agents/pi-embedded-runner/types.ts +++ b/src/agents/pi-embedded-runner/types.ts @@ -4,6 +4,7 @@ import type { MessagingToolSend } from "../pi-embedded-messaging.types.js"; export type EmbeddedPiAgentMeta = { sessionId: string; + sessionFile?: string; provider: string; model: string; contextTokens?: number; @@ -174,6 +175,8 @@ export type EmbeddedPiCompactResult = { tokensBefore: number; tokensAfter?: number; details?: unknown; + sessionId?: string; + sessionFile?: string; }; }; diff --git a/src/auto-reply/reply/agent-runner-memory.ts b/src/auto-reply/reply/agent-runner-memory.ts index f7c3fab3ecb..366e6febff7 100644 --- a/src/auto-reply/reply/agent-runner-memory.ts +++ b/src/auto-reply/reply/agent-runner-memory.ts @@ -506,6 +506,8 @@ export async function runPreflightCompactionIfNeeded(params: { sessionKey: params.sessionKey, storePath: params.storePath, tokensAfter: result.result?.tokensAfter, + newSessionId: result.result?.sessionId, + newSessionFile: result.result?.sessionFile, }); await appendPostCompactionRefreshPrompt({ cfg: params.cfg, @@ -749,6 +751,7 @@ export async function runMemoryFlushIfNeeded(params: { .filter(Boolean) .join("\n\n"); let postCompactionSessionId: string | undefined; + let postCompactionSessionFile: string | undefined; try { await memoryDeps.runWithModelFallback({ ...resolveModelFallbackOptions(params.followupRun.run), @@ -791,6 +794,9 @@ export async function runMemoryFlushIfNeeded(params: { if (result.meta?.agentMeta?.sessionId) { postCompactionSessionId = result.meta.agentMeta.sessionId; } + if (result.meta?.agentMeta?.sessionFile) { + postCompactionSessionFile = result.meta.agentMeta.sessionFile; + } bootstrapPromptWarningSignaturesSeen = resolveBootstrapWarningSignaturesSeen( result.meta?.systemPromptReport, ); @@ -810,6 +816,7 @@ export async function runMemoryFlushIfNeeded(params: { sessionKey: params.sessionKey, storePath: params.storePath, newSessionId: postCompactionSessionId, + newSessionFile: postCompactionSessionFile, }); const updatedEntry = params.sessionKey ? activeSessionStore?.[params.sessionKey] : undefined; if (updatedEntry) { diff --git a/src/auto-reply/reply/agent-runner.ts b/src/auto-reply/reply/agent-runner.ts index b0ecc8b5d3b..4a44124cfdd 100644 --- a/src/auto-reply/reply/agent-runner.ts +++ b/src/auto-reply/reply/agent-runner.ts @@ -1537,6 +1537,7 @@ export async function runReplyAgent(params: { lastCallUsage: runResult.meta?.agentMeta?.lastCallUsage, contextTokensUsed, newSessionId: runResult.meta?.agentMeta?.sessionId, + newSessionFile: runResult.meta?.agentMeta?.sessionFile, }); const refreshedSessionEntry = sessionKey && activeSessionStore ? activeSessionStore[sessionKey] : undefined; diff --git a/src/auto-reply/reply/commands-compact.ts b/src/auto-reply/reply/commands-compact.ts index faf0e0ebd6a..1a9024164a8 100644 --- a/src/auto-reply/reply/commands-compact.ts +++ b/src/auto-reply/reply/commands-compact.ts @@ -176,6 +176,8 @@ export const handleCompactCommand: CommandHandler = async (params) => { storePath: params.storePath, // Update token counts after compaction tokensAfter: result.result?.tokensAfter, + newSessionId: result.result?.sessionId, + newSessionFile: result.result?.sessionFile, }); } // Use the post-compaction token count for context summary if available diff --git a/src/auto-reply/reply/followup-runner.ts b/src/auto-reply/reply/followup-runner.ts index 4f0e79a06b8..d27fab7984d 100644 --- a/src/auto-reply/reply/followup-runner.ts +++ b/src/auto-reply/reply/followup-runner.ts @@ -455,6 +455,7 @@ export function createFollowupRunner(params: { lastCallUsage: runResult.meta?.agentMeta?.lastCallUsage, contextTokensUsed, newSessionId: runResult.meta?.agentMeta?.sessionId, + newSessionFile: runResult.meta?.agentMeta?.sessionFile, }); const refreshedSessionEntry = sessionKey && sessionStore ? sessionStore[sessionKey] : undefined; diff --git a/src/auto-reply/reply/session-run-accounting.ts b/src/auto-reply/reply/session-run-accounting.ts index 78566dd4a36..75b817655ce 100644 --- a/src/auto-reply/reply/session-run-accounting.ts +++ b/src/auto-reply/reply/session-run-accounting.ts @@ -14,6 +14,7 @@ type IncrementRunCompactionCountParams = Omit< lastCallUsage?: NormalizedUsage; contextTokensUsed?: number; newSessionId?: string; + newSessionFile?: string; }; export async function persistRunSessionUsage(params: PersistRunSessionUsageParams): Promise { @@ -38,5 +39,6 @@ export async function incrementRunCompactionCount( amount: params.amount, tokensAfter: tokensAfterCompaction, newSessionId: params.newSessionId, + newSessionFile: params.newSessionFile, }); } diff --git a/src/auto-reply/reply/session-updates.ts b/src/auto-reply/reply/session-updates.ts index 80361a800f5..47121243b79 100644 --- a/src/auto-reply/reply/session-updates.ts +++ b/src/auto-reply/reply/session-updates.ts @@ -219,6 +219,8 @@ export async function incrementCompactionCount(params: { tokensAfter?: number; /** Session id after compaction, when the runtime rotated transcripts. */ newSessionId?: string; + /** Session file after compaction, when the runtime rotated transcripts. */ + newSessionFile?: string; }): Promise { const { sessionEntry, @@ -230,6 +232,7 @@ export async function incrementCompactionCount(params: { amount = 1, tokensAfter, newSessionId, + newSessionFile, } = params; if (!sessionStore || !sessionKey) { return undefined; @@ -247,12 +250,14 @@ export async function incrementCompactionCount(params: { }; if (newSessionId && newSessionId !== entry.sessionId) { updates.sessionId = newSessionId; - updates.sessionFile = resolveCompactionSessionFile({ - entry, - sessionKey, - storePath, - newSessionId, - }); + updates.sessionFile = + newSessionFile ?? + resolveCompactionSessionFile({ + entry, + sessionKey, + storePath, + newSessionId, + }); } // If tokensAfter is provided, update the cached token counts to reflect post-compaction state if (tokensAfter != null && tokensAfter > 0) { diff --git a/src/cli/update-cli.test.ts b/src/cli/update-cli.test.ts index 700c26e2fea..849b286c4b1 100644 --- a/src/cli/update-cli.test.ts +++ b/src/cli/update-cli.test.ts @@ -381,14 +381,14 @@ describe("update-cli", () => { }; const setupUpdatedRootRefresh = (params?: { - gatewayUpdateImpl?: () => Promise; + gatewayUpdateImpl?: (root: string) => Promise; entrypoints?: string[]; }) => { const root = createCaseDir("openclaw-updated-root"); const entrypoints = params?.entrypoints ?? [path.join(root, "dist", "entry.js")]; pathExists.mockImplementation(async (candidate: string) => entrypoints.includes(candidate)); if (params?.gatewayUpdateImpl) { - vi.mocked(runGatewayUpdate).mockImplementation(params.gatewayUpdateImpl); + vi.mocked(runGatewayUpdate).mockImplementation(() => params.gatewayUpdateImpl!(root)); } else { vi.mocked(runGatewayUpdate).mockResolvedValue({ status: "ok", diff --git a/src/config/schema.base.generated.ts b/src/config/schema.base.generated.ts index 47149742c34..f380f1f6921 100644 --- a/src/config/schema.base.generated.ts +++ b/src/config/schema.base.generated.ts @@ -4990,9 +4990,9 @@ export const GENERATED_BASE_CONFIG_SCHEMA: BaseConfigSchemaResponse = { }, truncateAfterCompaction: { type: "boolean", - title: "Truncate After Compaction", + title: "Rotate Transcript After Compaction", description: - "When enabled, rewrites the session JSONL file after compaction to remove entries that were summarized. Prevents unbounded file growth in long-running sessions with many compaction cycles. Default: false.", + "When enabled, rotates the active session JSONL file after compaction so future turns load only the summary and unsummarized tail while the previous full transcript remains archived. Prevents unbounded active transcript growth in long-running sessions. Default: false.", }, notifyUser: { type: "boolean", @@ -26856,8 +26856,8 @@ export const GENERATED_BASE_CONFIG_SCHEMA: BaseConfigSchemaResponse = { tags: ["models"], }, "agents.defaults.compaction.truncateAfterCompaction": { - label: "Truncate After Compaction", - help: "When enabled, rewrites the session JSONL file after compaction to remove entries that were summarized. Prevents unbounded file growth in long-running sessions with many compaction cycles. Default: false.", + label: "Rotate Transcript After Compaction", + help: "When enabled, rotates the active session JSONL file after compaction so future turns load only the summary and unsummarized tail while the previous full transcript remains archived. Prevents unbounded active transcript growth in long-running sessions. Default: false.", tags: ["advanced"], }, "agents.defaults.compaction.notifyUser": { diff --git a/src/config/schema.help.ts b/src/config/schema.help.ts index e56682f1eb4..557b638c5cb 100644 --- a/src/config/schema.help.ts +++ b/src/config/schema.help.ts @@ -1266,7 +1266,7 @@ export const FIELD_HELP: Record = { "agents.defaults.compaction.model": "Optional provider/model override used only for compaction summarization. Set this when you want compaction to run on a different model than the session default, and leave it unset to keep using the primary agent model.", "agents.defaults.compaction.truncateAfterCompaction": - "When enabled, rewrites the session JSONL file after compaction to remove entries that were summarized. Prevents unbounded file growth in long-running sessions with many compaction cycles. Default: false.", + "When enabled, rotates the active session JSONL file after compaction so future turns load only the summary and unsummarized tail while the previous full transcript remains archived. Prevents unbounded active transcript growth in long-running sessions. Default: false.", "agents.defaults.compaction.notifyUser": "When enabled, sends brief compaction notices to the user when compaction starts and when it completes (for example, '🧹 Compacting context...' and '🧹 Compaction complete'). Disabled by default to keep compaction silent and non-intrusive.", "agents.defaults.compaction.memoryFlush": diff --git a/src/config/schema.labels.ts b/src/config/schema.labels.ts index 8374c1e185f..8517201d683 100644 --- a/src/config/schema.labels.ts +++ b/src/config/schema.labels.ts @@ -594,7 +594,7 @@ export const FIELD_LABELS: Record = { "agents.defaults.compaction.postCompactionSections": "Post-Compaction Context Sections", "agents.defaults.compaction.timeoutSeconds": "Compaction Timeout (Seconds)", "agents.defaults.compaction.model": "Compaction Model Override", - "agents.defaults.compaction.truncateAfterCompaction": "Truncate After Compaction", + "agents.defaults.compaction.truncateAfterCompaction": "Rotate Transcript After Compaction", "agents.defaults.compaction.notifyUser": "Compaction Notify User", "agents.defaults.compaction.memoryFlush": "Compaction Memory Flush", "agents.defaults.compaction.memoryFlush.enabled": "Compaction Memory Flush Enabled", diff --git a/src/config/types.agent-defaults.ts b/src/config/types.agent-defaults.ts index 5ec5e9606db..7c86706b9e9 100644 --- a/src/config/types.agent-defaults.ts +++ b/src/config/types.agent-defaults.ts @@ -471,8 +471,9 @@ export type AgentCompactionConfig = { */ provider?: string; /** - * Truncate the session JSONL file after compaction to remove entries that - * were summarized. Prevents unbounded file growth in long-running sessions. + * Rotate the active session JSONL file after compaction so the next turn + * starts from the compaction summary and unsummarized tail while the old + * transcript stays archived. * Default: false (existing behavior preserved). */ truncateAfterCompaction?: boolean; diff --git a/src/context-engine/delegate.ts b/src/context-engine/delegate.ts index 379ec7d3d21..c02a65effc6 100644 --- a/src/context-engine/delegate.ts +++ b/src/context-engine/delegate.ts @@ -74,6 +74,8 @@ export async function delegateCompactionToRuntime( tokensBefore: result.result.tokensBefore, tokensAfter: result.result.tokensAfter, details: result.result.details, + sessionId: result.result.sessionId, + sessionFile: result.result.sessionFile, } : undefined, }; diff --git a/src/context-engine/types.ts b/src/context-engine/types.ts index 21cea5aee37..8a7d6e8b6f0 100644 --- a/src/context-engine/types.ts +++ b/src/context-engine/types.ts @@ -22,6 +22,10 @@ export type CompactResult = { tokensBefore: number; tokensAfter?: number; details?: unknown; + /** Session id after compaction, when the runtime rotated transcripts. */ + sessionId?: string; + /** Session file after compaction, when the runtime rotated transcripts. */ + sessionFile?: string; }; }; diff --git a/src/gateway/server-methods/sessions.ts b/src/gateway/server-methods/sessions.ts index ff5c60c6c7f..6f3ee233696 100644 --- a/src/gateway/server-methods/sessions.ts +++ b/src/gateway/server-methods/sessions.ts @@ -1597,6 +1597,12 @@ export const sessionsHandlers: GatewayRequestHandlers = { } entryToUpdate.updatedAt = Date.now(); entryToUpdate.compactionCount = Math.max(0, entryToUpdate.compactionCount ?? 0) + 1; + if (result.result?.sessionId && result.result.sessionId !== entryToUpdate.sessionId) { + entryToUpdate.sessionId = result.result.sessionId; + } + if (result.result?.sessionFile) { + entryToUpdate.sessionFile = result.result.sessionFile; + } delete entryToUpdate.inputTokens; delete entryToUpdate.outputTokens; if ( diff --git a/src/scripts/test-projects.test.ts b/src/scripts/test-projects.test.ts index 324110488de..08390f26be7 100644 --- a/src/scripts/test-projects.test.ts +++ b/src/scripts/test-projects.test.ts @@ -74,6 +74,11 @@ const { args: string[], cwd?: string, listChangedPaths?: (baseRef: string, cwd: string) => string[], + options?: { + cwd?: string; + env?: NodeJS.ProcessEnv; + broad?: boolean; + }, ) => string[] | null; resolveChangedTestTargetPlan: ( changedPaths: string[], @@ -904,13 +909,21 @@ describe("test-projects args", () => { ]); }); - it("keeps extension-facing core contract changes focused by default", () => { + it("routes extension-facing core contract changes and supports broad extension opt-in", () => { const changedPaths = ["src/plugin-sdk/core.ts"]; const plans = buildVitestRunPlans(["--changed=origin/main"], process.cwd(), () => changedPaths); + const targetArgs = resolveChangedTargetArgs( + ["--changed=origin/main"], + process.cwd(), + () => changedPaths, + ); + expect(targetArgs).toEqual(["src/plugin-sdk/core.test.ts"]); expect( - resolveChangedTargetArgs(["--changed=origin/main"], process.cwd(), () => changedPaths), - ).toEqual(["src/plugin-sdk/core.test.ts"]); + resolveChangedTargetArgs(["--changed=origin/main"], process.cwd(), () => changedPaths, { + env: { OPENCLAW_TEST_CHANGED_BROAD: "1" }, + }), + ).toEqual(["src/plugin-sdk/core.test.ts", "extensions"]); expect(plans[0]).toEqual({ config: "test/vitest/vitest.plugin-sdk.config.ts", forwardedArgs: [], From 67d00826b2bba1806e18626de69c412a6ed32110 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 17:57:59 -0700 Subject: [PATCH 135/418] fix(gateway): bound Lobster Ajv schema compilation --- CHANGELOG.md | 1 + extensions/lobster/src/lobster-ajv-cache.ts | 142 ++++++++++++++++++ extensions/lobster/src/lobster-runner.test.ts | 81 ++++++++++ extensions/lobster/src/lobster-runner.ts | 3 + 4 files changed, 227 insertions(+) create mode 100644 extensions/lobster/src/lobster-ajv-cache.ts diff --git a/CHANGELOG.md b/CHANGELOG.md index 795bf46c3f6..d9a381c7add 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,7 @@ Docs: https://docs.openclaw.ai - Exec/node: skip approval-plan preparation for full-trust `host=node` runs so interpreter and script commands no longer fail with `SYSTEM_RUN_DENIED: approval cannot safely bind` when effective policy is `security=full` and `ask=off`. Fixes #48457 and duplicate #69251. Thanks @ajtran303, @jaserNo1, @Blakeshannon, @lesliefag, and @AvIsBeastMC. - Exec/node: synthesize a local approval plan when a paired node advertises `system.run` without `system.run.prepare`, unblocking approval-required `host=node` exec on current macOS companion nodes while preserving remote prepare for node hosts that support it. Fixes #37591 and duplicate #66839; carries forward #69725. Thanks @soloclz. - Memory/QMD: prefer QMD's `--mask` collection pattern flag so root memory indexing stays scoped to `MEMORY.md` instead of widening to every markdown file in the workspace. Thanks @codex. +- Lobster/Gateway: memoize repeated Ajv schema compilation before loading the embedded Lobster runtime so scheduled workflows and `llm.invoke` loops stop growing gateway heap on content-identical schemas. Fixes #71148. Thanks @cmi525 and @vsolaz. - Codex harness: normalize cached input tokens before session/context accounting so prompt cache reads are not double-counted in `/status`, `session_status`, or persisted `sessionEntry.totalTokens`. Fixes #69298. Thanks @richardmqq. - Hooks/session-memory: use the host local timezone for memory filenames, fallback timestamp slugs, and markdown headers instead of UTC dates. Fixes #46703. (#46721) Thanks @Astro-Han. - Feishu: extract quoted/replied interactive-card text across schema 1.0, schema 2.0, i18n, template-variable, and post-format fallback shapes without carrying broad generated/config churn from related parser experiments. (#38776, #60383, #42218, #45936) Thanks @lishuaigit, @lskun, @just2gooo, and @Br1an67. diff --git a/extensions/lobster/src/lobster-ajv-cache.ts b/extensions/lobster/src/lobster-ajv-cache.ts new file mode 100644 index 00000000000..4121710c1b7 --- /dev/null +++ b/extensions/lobster/src/lobster-ajv-cache.ts @@ -0,0 +1,142 @@ +import { createHash } from "node:crypto"; +import AjvPkg, { type AnySchema, type ValidateFunction } from "ajv"; + +const installedSymbol = Symbol.for("openclaw.lobster.ajv-compile-cache.installed"); +const cacheSymbol = Symbol.for("openclaw.lobster.ajv-compile-cache.entries"); +const maxEntries = 512; + +type AjvInstance = import("ajv").default; + +type CompileCacheEntry = { + schema: AnySchema; + validate: ValidateFunction; +}; + +const AjvCtor = AjvPkg as unknown as { + new (opts?: object): AjvInstance; + prototype: AjvInstance; +}; + +type AjvWithCompileCache = AjvInstance & { + [cacheSymbol]?: Map; +}; + +type AjvPrototypePatch = { + [installedSymbol]?: boolean; + compile: (schema: AnySchema) => ValidateFunction; + removeSchema: (schemaKeyRef?: Parameters[0]) => AjvInstance; +}; + +type JsonLike = null | boolean | number | string | JsonLike[] | { [key: string]: JsonLike }; + +function stableJsonStringify(value: unknown, seen = new WeakSet()): string { + if (value === null || typeof value !== "object") { + return JSON.stringify(value); + } + if (seen.has(value)) { + throw new TypeError("Cannot cache cyclic JSON schema"); + } + seen.add(value); + if (Array.isArray(value)) { + const items = value.map((entry) => stableJsonStringify(entry, seen)); + seen.delete(value); + return `[${items.join(",")}]`; + } + const record = value as Record; + const keys = Object.keys(record).toSorted(); + const properties = keys + .filter((key) => record[key] !== undefined) + .map((key) => `${JSON.stringify(key)}:${stableJsonStringify(record[key], seen)}`); + seen.delete(value); + return `{${properties.join(",")}}`; +} + +function compileCacheKey(schema: unknown): string | null { + try { + return createHash("sha256").update(stableJsonStringify(schema)).digest("hex"); + } catch { + return null; + } +} + +function readCompileCache(instance: AjvWithCompileCache): Map { + let cache = instance[cacheSymbol]; + if (!cache) { + cache = new Map(); + Object.defineProperty(instance, cacheSymbol, { + value: cache, + configurable: true, + }); + } + return cache; +} + +function rememberCompiledValidator(params: { + cache: Map; + instance: AjvWithCompileCache; + key: string; + removeSchema: AjvPrototypePatch["removeSchema"]; + schema: AnySchema; + validate: ValidateFunction; +}) { + const { cache, instance, key, removeSchema, schema, validate } = params; + if (!cache.has(key) && cache.size >= maxEntries) { + const oldest = cache.keys().next().value; + if (oldest !== undefined) { + const evicted = cache.get(oldest); + cache.delete(oldest); + if (evicted) { + removeSchema.call(instance, evicted.schema); + } + } + } + cache.set(key, { schema, validate }); +} + +export function installLobsterAjvCompileCache() { + const proto = AjvCtor.prototype as unknown as AjvPrototypePatch; + if (proto[installedSymbol]) { + return; + } + + const originalCompile = proto.compile; + const originalRemoveSchema = proto.removeSchema; + + Object.defineProperty(proto, installedSymbol, { + value: true, + configurable: true, + }); + + proto.compile = function compileWithContentCache( + this: AjvWithCompileCache, + schema: AnySchema, + ): ValidateFunction { + const key = compileCacheKey(schema); + if (!key) { + return originalCompile.call(this, schema) as ValidateFunction; + } + const cache = readCompileCache(this); + const cached = cache.get(key); + if (cached) { + return cached.validate as ValidateFunction; + } + const validate = originalCompile.call(this, schema) as ValidateFunction; + rememberCompiledValidator({ + cache, + instance: this, + key, + removeSchema: originalRemoveSchema, + schema, + validate, + }); + return validate; + }; + + proto.removeSchema = function removeSchemaAndClearContentCache( + this: AjvWithCompileCache, + schemaKeyRef?: Parameters[0], + ) { + this[cacheSymbol]?.clear(); + return originalRemoveSchema.call(this, schemaKeyRef); + }; +} diff --git a/extensions/lobster/src/lobster-runner.test.ts b/extensions/lobster/src/lobster-runner.test.ts index ff0cf6927ee..7dfd764c1cb 100644 --- a/extensions/lobster/src/lobster-runner.test.ts +++ b/extensions/lobster/src/lobster-runner.test.ts @@ -1,6 +1,8 @@ import fs from "node:fs/promises"; +import { createRequire } from "node:module"; import os from "node:os"; import path from "node:path"; +import { pathToFileURL } from "node:url"; import { afterEach, describe, expect, it, vi } from "vitest"; import { createEmbeddedLobsterRunner, @@ -8,6 +10,38 @@ import { resolveLobsterCwd, } from "./lobster-runner.js"; +const requireForTest = createRequire(import.meta.url); + +type AjvCacheOwner = { + _cache?: { size: number }; +}; + +function readAjvInternalCacheSize(ajv: unknown): number { + return (ajv as AjvCacheOwner)._cache?.size ?? 0; +} + +function createRepeatedResponseSchema() { + return { + type: "object", + properties: { + answer: { type: "string" }, + }, + required: ["answer"], + additionalProperties: false, + }; +} + +function createUniqueResponseSchema(index: number) { + return { + type: "object", + properties: { + [`answer${index}`]: { type: "string" }, + }, + required: [`answer${index}`], + additionalProperties: false, + }; +} + describe("resolveLobsterCwd", () => { it("defaults to the current working directory", () => { expect(resolveLobsterCwd(undefined)).toBe(process.cwd()); @@ -356,6 +390,53 @@ describe("createEmbeddedLobsterRunner", () => { expect(loadRuntime).toHaveBeenCalledTimes(1); }); + it("installs an Ajv content cache before loading the embedded runtime", async () => { + const AjvModule = await import("ajv"); + const AjvCtor = AjvModule.default as unknown as new (opts?: object) => import("ajv").default; + const ajv = new AjvCtor({ allErrors: true, strict: false, addUsedSchema: false }); + const before = readAjvInternalCacheSize(ajv); + + await loadEmbeddedToolRuntimeFromPackage({ + importModule: async () => ({ + runToolRequest: vi.fn(), + resumeToolRequest: vi.fn(), + }), + }); + + const first = ajv.compile(createRepeatedResponseSchema()); + const second = ajv.compile(createRepeatedResponseSchema()); + const afterRepeated = readAjvInternalCacheSize(ajv); + + expect(second).toBe(first); + expect(afterRepeated - before).toBe(1); + + for (let index = 0; index < 520; index += 1) { + ajv.compile(createUniqueResponseSchema(index)); + } + + expect(readAjvInternalCacheSize(ajv)).toBeLessThanOrEqual(before + 512); + }); + + it("deduplicates content-identical schema compilation in the installed Lobster runtime", async () => { + await loadEmbeddedToolRuntimeFromPackage(); + + const corePath = requireForTest.resolve("@clawdbot/lobster/core"); + const validationPath = corePath.replace(/\/core\/index\.js$/, "/validation.js"); + const validationModule = (await import(pathToFileURL(validationPath).href)) as { + sharedAjv: import("ajv").default; + }; + const before = readAjvInternalCacheSize(validationModule.sharedAjv); + + const first = validationModule.sharedAjv.compile(createRepeatedResponseSchema()); + for (let index = 0; index < 1000; index += 1) { + validationModule.sharedAjv.compile(createRepeatedResponseSchema()); + } + const second = validationModule.sharedAjv.compile(createRepeatedResponseSchema()); + + expect(second).toBe(first); + expect(readAjvInternalCacheSize(validationModule.sharedAjv) - before).toBe(1); + }); + it("falls back to the installed package core file when the core export is unavailable", async () => { const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "openclaw-lobster-package-")); const packageRoot = path.join(tempDir, "node_modules", "@clawdbot", "lobster"); diff --git a/extensions/lobster/src/lobster-runner.ts b/extensions/lobster/src/lobster-runner.ts index 7209b719d60..bccae0453a7 100644 --- a/extensions/lobster/src/lobster-runner.ts +++ b/extensions/lobster/src/lobster-runner.ts @@ -4,6 +4,7 @@ import { createRequire } from "node:module"; import path from "node:path"; import { Readable, Writable } from "node:stream"; import { pathToFileURL } from "node:url"; +import { installLobsterAjvCompileCache } from "./lobster-ajv-cache.js"; export type LobsterEnvelope = | { @@ -296,6 +297,8 @@ async function withTimeout( export async function loadEmbeddedToolRuntimeFromPackage( options: LoadEmbeddedToolRuntimeFromPackageOptions = {}, ): Promise { + installLobsterAjvCompileCache(); + const importModule = options.importModule ?? (async (specifier: string) => (await import(specifier)) as Partial); From 658240de747a73ad42775275014ded4d1a3255c6 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 02:02:25 +0100 Subject: [PATCH 136/418] ci: add full release validation workflow --- .github/workflows/ci.yml | 43 ++- .github/workflows/full-release-validation.yml | 339 ++++++++++++++++++ .../openclaw-live-and-e2e-checks-reusable.yml | 25 +- .github/workflows/openclaw-release-checks.yml | 33 +- docs/ci.md | 15 +- docs/reference/RELEASING.md | 48 +-- 6 files changed, 432 insertions(+), 71 deletions(-) create mode 100644 .github/workflows/full-release-validation.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 89823c371cd..00117a2725b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -2,6 +2,12 @@ name: CI on: workflow_dispatch: + inputs: + target_ref: + description: Optional branch, tag, or full commit SHA to validate instead of the workflow ref + required: false + default: "" + type: string push: branches: [main] paths-ignore: @@ -30,6 +36,7 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 20 outputs: + checkout_sha: ${{ steps.checkout_ref.outputs.sha }} docs_only: ${{ steps.manifest.outputs.docs_only }} docs_changed: ${{ steps.manifest.outputs.docs_changed }} run_node: ${{ steps.manifest.outputs.run_node }} @@ -66,11 +73,16 @@ jobs: - name: Checkout uses: actions/checkout@v6 with: + ref: ${{ inputs.target_ref || github.sha }} fetch-depth: 1 fetch-tags: false persist-credentials: false submodules: false + - name: Resolve checkout SHA + id: checkout_ref + run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT" + - name: Ensure preflight base commit if: github.event_name != 'workflow_dispatch' uses: ./.github/actions/ensure-base-commit @@ -302,12 +314,14 @@ jobs: - name: Checkout uses: actions/checkout@v6 with: + ref: ${{ inputs.target_ref || github.sha }} fetch-depth: 1 fetch-tags: false persist-credentials: false submodules: false - name: Ensure security base commit + if: github.event_name != 'workflow_dispatch' uses: ./.github/actions/ensure-base-commit with: base-sha: ${{ github.event_name == 'push' && github.event.before || github.event.pull_request.base.sha }} @@ -391,6 +405,7 @@ jobs: - name: Checkout uses: actions/checkout@v6 with: + ref: ${{ inputs.target_ref || github.sha }} fetch-depth: 1 fetch-tags: false persist-credentials: false @@ -453,7 +468,7 @@ jobs: shell: bash env: CHECKOUT_REPO: ${{ github.repository }} - CHECKOUT_SHA: ${{ github.sha }} + CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_sha }} CHECKOUT_TOKEN: ${{ github.token }} run: | set -euo pipefail @@ -525,7 +540,7 @@ jobs: path: | dist/ dist-runtime/ - key: ${{ runner.os }}-dist-build-${{ github.sha }} + key: ${{ runner.os }}-dist-build-${{ needs.preflight.outputs.checkout_sha }} - name: Pack built runtime artifacts run: tar --posix -cf dist-runtime-build.tar.zst --use-compress-program zstdmt dist dist-runtime @@ -654,7 +669,7 @@ jobs: shell: bash env: CHECKOUT_REPO: ${{ github.repository }} - CHECKOUT_SHA: ${{ github.sha }} + CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_sha }} CHECKOUT_TOKEN: ${{ github.token }} run: | set -euo pipefail @@ -749,7 +764,7 @@ jobs: shell: bash env: CHECKOUT_REPO: ${{ github.repository }} - CHECKOUT_SHA: ${{ github.sha }} + CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_sha }} CHECKOUT_TOKEN: ${{ github.token }} run: | set -euo pipefail @@ -852,7 +867,7 @@ jobs: shell: bash env: CHECKOUT_REPO: ${{ github.repository }} - CHECKOUT_SHA: ${{ github.sha }} + CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_sha }} CHECKOUT_TOKEN: ${{ github.token }} run: | set -euo pipefail @@ -920,7 +935,7 @@ jobs: shell: bash env: CHECKOUT_REPO: ${{ github.repository }} - CHECKOUT_SHA: ${{ github.sha }} + CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_sha }} CHECKOUT_TOKEN: ${{ github.token }} run: | set -euo pipefail @@ -1040,7 +1055,7 @@ jobs: shell: bash env: CHECKOUT_REPO: ${{ github.repository }} - CHECKOUT_SHA: ${{ github.sha }} + CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_sha }} CHECKOUT_TOKEN: ${{ github.token }} run: | set -euo pipefail @@ -1120,7 +1135,7 @@ jobs: shell: bash env: CHECKOUT_REPO: ${{ github.repository }} - CHECKOUT_SHA: ${{ github.sha }} + CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_sha }} CHECKOUT_TOKEN: ${{ github.token }} run: | set -euo pipefail @@ -1307,7 +1322,7 @@ jobs: shell: bash env: CHECKOUT_REPO: ${{ github.repository }} - CHECKOUT_SHA: ${{ github.sha }} + CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_sha }} CHECKOUT_TOKEN: ${{ github.token }} run: | set -euo pipefail @@ -1439,7 +1454,7 @@ jobs: shell: bash env: CHECKOUT_REPO: ${{ github.repository }} - CHECKOUT_SHA: ${{ github.sha }} + CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_sha }} CHECKOUT_TOKEN: ${{ github.token }} run: | set -euo pipefail @@ -1637,7 +1652,7 @@ jobs: shell: bash env: CHECKOUT_REPO: ${{ github.repository }} - CHECKOUT_SHA: ${{ github.sha }} + CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_sha }} CHECKOUT_TOKEN: ${{ github.token }} run: | set -euo pipefail @@ -1700,6 +1715,7 @@ jobs: - name: Checkout uses: actions/checkout@v6 with: + ref: ${{ needs.preflight.outputs.checkout_sha }} persist-credentials: false submodules: false @@ -1742,6 +1758,7 @@ jobs: - name: Checkout uses: actions/checkout@v6 with: + ref: ${{ needs.preflight.outputs.checkout_sha }} persist-credentials: false submodules: false @@ -1846,6 +1863,7 @@ jobs: - name: Checkout uses: actions/checkout@v6 with: + ref: ${{ needs.preflight.outputs.checkout_sha }} persist-credentials: false submodules: false @@ -1886,6 +1904,7 @@ jobs: - name: Checkout uses: actions/checkout@v6 with: + ref: ${{ needs.preflight.outputs.checkout_sha }} persist-credentials: false submodules: false @@ -1986,7 +2005,7 @@ jobs: shell: bash env: CHECKOUT_REPO: ${{ github.repository }} - CHECKOUT_SHA: ${{ github.sha }} + CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_sha }} CHECKOUT_TOKEN: ${{ github.token }} run: | set -euo pipefail diff --git a/.github/workflows/full-release-validation.yml b/.github/workflows/full-release-validation.yml new file mode 100644 index 00000000000..fe2f90c8dee --- /dev/null +++ b/.github/workflows/full-release-validation.yml @@ -0,0 +1,339 @@ +name: Full Release Validation + +on: + workflow_dispatch: + inputs: + ref: + description: Branch, tag, or full commit SHA to validate + required: true + default: main + type: string + workflow_ref: + description: Trusted workflow ref used to run child workflows + required: false + default: main + type: string + provider: + description: Provider lane for cross-OS onboarding and the end-to-end agent turn + required: false + default: openai + type: choice + options: + - openai + - anthropic + - minimax + mode: + description: Which cross-OS release lanes to run + required: false + default: both + type: choice + options: + - fresh + - upgrade + - both + npm_telegram_package_spec: + description: Optional published package spec for the post-publish Telegram E2E lane + required: false + default: "" + type: string + npm_telegram_provider_mode: + description: Provider mode for the optional post-publish Telegram E2E lane + required: false + default: mock-openai + type: choice + options: + - mock-openai + - live-frontier + npm_telegram_scenario: + description: Optional comma-separated Telegram scenario ids for the post-publish lane + required: false + default: "" + type: string + +permissions: + actions: write + contents: read + +concurrency: + group: full-release-validation-${{ inputs.ref }} + cancel-in-progress: false + +env: + FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" + +jobs: + resolve_target: + name: Resolve target ref + runs-on: ubuntu-24.04 + timeout-minutes: 10 + outputs: + sha: ${{ steps.resolve.outputs.sha }} + steps: + - name: Checkout target ref + uses: actions/checkout@v6 + with: + ref: ${{ inputs.ref }} + fetch-depth: 0 + persist-credentials: false + submodules: false + + - name: Resolve target SHA + id: resolve + run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT" + + - name: Summarize target + env: + TARGET_REF: ${{ inputs.ref }} + TARGET_SHA: ${{ steps.resolve.outputs.sha }} + WORKFLOW_REF: ${{ inputs.workflow_ref }} + NPM_TELEGRAM_PACKAGE_SPEC: ${{ inputs.npm_telegram_package_spec }} + run: | + { + echo "## Full release validation" + echo + echo "- Target ref: \`${TARGET_REF}\`" + echo "- Target SHA: \`${TARGET_SHA}\`" + echo "- Child workflow ref: \`${WORKFLOW_REF}\`" + echo "- Normal CI: \`CI\` with \`target_ref=${TARGET_REF}\`" + echo "- Release/live/Docker/QA: \`OpenClaw Release Checks\`" + if [[ -n "${NPM_TELEGRAM_PACKAGE_SPEC// }" ]]; then + echo "- Post-publish Telegram E2E: \`${NPM_TELEGRAM_PACKAGE_SPEC}\`" + else + echo "- Post-publish Telegram E2E: skipped because no published package spec was provided" + fi + } >> "$GITHUB_STEP_SUMMARY" + + normal_ci: + name: Run normal full CI + needs: [resolve_target] + runs-on: ubuntu-24.04 + timeout-minutes: 240 + steps: + - name: Dispatch and monitor CI + env: + GH_TOKEN: ${{ github.token }} + TARGET_REF: ${{ inputs.ref }} + TARGET_SHA: ${{ needs.resolve_target.outputs.sha }} + WORKFLOW_REF: ${{ inputs.workflow_ref }} + run: | + set -euo pipefail + + dispatch_and_wait() { + local workflow="$1" + local workflow_ref="$2" + shift 2 + + local before_json run_id status conclusion url + before_json="$(gh run list --workflow "$workflow" --event workflow_dispatch --limit 100 --json databaseId --jq '[.[].databaseId]')" + + gh workflow run "$workflow" --ref "$workflow_ref" "$@" + + for _ in $(seq 1 60); do + run_id="$( + BEFORE_IDS="$before_json" gh run list --workflow "$workflow" --event workflow_dispatch --limit 50 --json databaseId,createdAt \ + --jq 'map(select(.databaseId as $id | (env.BEFORE_IDS | fromjson | index($id) | not))) | sort_by(.createdAt) | reverse | .[0].databaseId // empty' + )" + if [[ -n "$run_id" ]]; then + break + fi + sleep 5 + done + + if [[ -z "${run_id:-}" ]]; then + echo "Could not find dispatched run for ${workflow}." >&2 + exit 1 + fi + + echo "Dispatched ${workflow}: https://github.com/${GITHUB_REPOSITORY}/actions/runs/${run_id}" + + while true; do + status="$(gh run view "$run_id" --json status --jq '.status')" + if [[ "$status" == "completed" ]]; then + break + fi + sleep 30 + done + + conclusion="$(gh run view "$run_id" --json conclusion --jq '.conclusion')" + url="$(gh run view "$run_id" --json url --jq '.url')" + echo "${workflow} finished with ${conclusion}: ${url}" + if [[ "$conclusion" != "success" ]]; then + gh run view "$run_id" --json jobs --jq '.jobs[] | select(.conclusion != "success" and .conclusion != "skipped") | {name, conclusion, url}' + exit 1 + fi + } + + { + echo "### Normal CI" + echo + echo "- Target ref: \`${TARGET_REF}\`" + echo "- Target SHA: \`${TARGET_SHA}\`" + } >> "$GITHUB_STEP_SUMMARY" + + dispatch_and_wait ci.yml "$WORKFLOW_REF" -f target_ref="$TARGET_REF" + + release_checks: + name: Run release/live/Docker/QA validation + needs: [resolve_target] + runs-on: ubuntu-24.04 + timeout-minutes: 720 + steps: + - name: Dispatch and monitor release checks + env: + GH_TOKEN: ${{ github.token }} + TARGET_REF: ${{ inputs.ref }} + TARGET_SHA: ${{ needs.resolve_target.outputs.sha }} + WORKFLOW_REF: ${{ inputs.workflow_ref }} + PROVIDER: ${{ inputs.provider }} + MODE: ${{ inputs.mode }} + run: | + set -euo pipefail + + dispatch_and_wait() { + local workflow="$1" + local workflow_ref="$2" + shift 2 + + local before_json run_id status conclusion url + before_json="$(gh run list --workflow "$workflow" --event workflow_dispatch --limit 100 --json databaseId --jq '[.[].databaseId]')" + + gh workflow run "$workflow" --ref "$workflow_ref" "$@" + + for _ in $(seq 1 60); do + run_id="$( + BEFORE_IDS="$before_json" gh run list --workflow "$workflow" --event workflow_dispatch --limit 50 --json databaseId,createdAt \ + --jq 'map(select(.databaseId as $id | (env.BEFORE_IDS | fromjson | index($id) | not))) | sort_by(.createdAt) | reverse | .[0].databaseId // empty' + )" + if [[ -n "$run_id" ]]; then + break + fi + sleep 5 + done + + if [[ -z "${run_id:-}" ]]; then + echo "Could not find dispatched run for ${workflow}." >&2 + exit 1 + fi + + echo "Dispatched ${workflow}: https://github.com/${GITHUB_REPOSITORY}/actions/runs/${run_id}" + + while true; do + status="$(gh run view "$run_id" --json status --jq '.status')" + if [[ "$status" == "completed" ]]; then + break + fi + sleep 60 + done + + conclusion="$(gh run view "$run_id" --json conclusion --jq '.conclusion')" + url="$(gh run view "$run_id" --json url --jq '.url')" + echo "${workflow} finished with ${conclusion}: ${url}" + if [[ "$conclusion" != "success" ]]; then + gh run view "$run_id" --json jobs --jq '.jobs[] | select(.conclusion != "success" and .conclusion != "skipped") | {name, conclusion, url}' + exit 1 + fi + } + + { + echo "### Release/live/Docker/QA validation" + echo + echo "- Target ref: \`${TARGET_REF}\`" + echo "- Target SHA: \`${TARGET_SHA}\`" + echo "- Provider: \`${PROVIDER}\`" + echo "- Cross-OS mode: \`${MODE}\`" + } >> "$GITHUB_STEP_SUMMARY" + + dispatch_and_wait openclaw-release-checks.yml "$WORKFLOW_REF" \ + -f ref="$TARGET_REF" \ + -f provider="$PROVIDER" \ + -f mode="$MODE" + + npm_telegram: + name: Run post-publish Telegram E2E + needs: [resolve_target] + if: inputs.npm_telegram_package_spec != '' + runs-on: ubuntu-24.04 + timeout-minutes: 120 + steps: + - name: Dispatch and monitor npm Telegram E2E + env: + GH_TOKEN: ${{ github.token }} + WORKFLOW_REF: ${{ inputs.workflow_ref }} + PACKAGE_SPEC: ${{ inputs.npm_telegram_package_spec }} + PROVIDER_MODE: ${{ inputs.npm_telegram_provider_mode }} + SCENARIO: ${{ inputs.npm_telegram_scenario }} + run: | + set -euo pipefail + + before_json="$(gh run list --workflow npm-telegram-beta-e2e.yml --event workflow_dispatch --limit 100 --json databaseId --jq '[.[].databaseId]')" + + args=(-f package_spec="$PACKAGE_SPEC" -f provider_mode="$PROVIDER_MODE") + if [[ -n "${SCENARIO// }" ]]; then + args+=(-f scenario="$SCENARIO") + fi + + gh workflow run npm-telegram-beta-e2e.yml --ref "$WORKFLOW_REF" "${args[@]}" + + run_id="" + for _ in $(seq 1 60); do + run_id="$( + BEFORE_IDS="$before_json" gh run list --workflow npm-telegram-beta-e2e.yml --event workflow_dispatch --limit 50 --json databaseId,createdAt \ + --jq 'map(select(.databaseId as $id | (env.BEFORE_IDS | fromjson | index($id) | not))) | sort_by(.createdAt) | reverse | .[0].databaseId // empty' + )" + if [[ -n "$run_id" ]]; then + break + fi + sleep 5 + done + + if [[ -z "$run_id" ]]; then + echo "Could not find dispatched run for npm-telegram-beta-e2e.yml." >&2 + exit 1 + fi + + echo "Dispatched npm-telegram-beta-e2e.yml: https://github.com/${GITHUB_REPOSITORY}/actions/runs/${run_id}" + + while true; do + status="$(gh run view "$run_id" --json status --jq '.status')" + if [[ "$status" == "completed" ]]; then + break + fi + sleep 60 + done + + conclusion="$(gh run view "$run_id" --json conclusion --jq '.conclusion')" + url="$(gh run view "$run_id" --json url --jq '.url')" + echo "npm-telegram-beta-e2e.yml finished with ${conclusion}: ${url}" + if [[ "$conclusion" != "success" ]]; then + gh run view "$run_id" --json jobs --jq '.jobs[] | select(.conclusion != "success" and .conclusion != "skipped") | {name, conclusion, url}' + exit 1 + fi + + summary: + name: Verify full validation + needs: [normal_ci, release_checks, npm_telegram] + if: always() + runs-on: ubuntu-24.04 + timeout-minutes: 5 + steps: + - name: Verify child workflow results + env: + NORMAL_CI_RESULT: ${{ needs.normal_ci.result }} + RELEASE_CHECKS_RESULT: ${{ needs.release_checks.result }} + NPM_TELEGRAM_RESULT: ${{ needs.npm_telegram.result }} + run: | + set -euo pipefail + failed=0 + for item in \ + "normal_ci=${NORMAL_CI_RESULT}" \ + "release_checks=${RELEASE_CHECKS_RESULT}" \ + "npm_telegram=${NPM_TELEGRAM_RESULT}" + do + name="${item%%=*}" + result="${item#*=}" + if [[ "$result" != "success" && "$result" != "skipped" ]]; then + echo "::error::${name} ended with ${result}" + failed=1 + fi + done + exit "$failed" diff --git a/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml b/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml index 08eaf802ad2..6259e23db8f 100644 --- a/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml +++ b/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml @@ -190,42 +190,29 @@ jobs: - name: Validate selected ref id: validate env: - GH_TOKEN: ${{ github.token }} INPUT_REF: ${{ inputs.ref }} - WORKFLOW_REF_NAME: ${{ github.ref_name }} shell: bash run: | set -euo pipefail selected_sha="$(git rev-parse HEAD)" trusted_reason="" - git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main - if [[ "${WORKFLOW_REF_NAME}" =~ ^release/[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*$ ]]; then - git fetch --no-tags origin "+refs/heads/${WORKFLOW_REF_NAME}:refs/remotes/origin/${WORKFLOW_REF_NAME}" - fi + git fetch --no-tags origin '+refs/heads/*:refs/remotes/origin/*' + git fetch --tags origin '+refs/tags/*:refs/tags/*' if git merge-base --is-ancestor "$selected_sha" refs/remotes/origin/main; then trusted_reason="main-ancestor" - elif [[ "${WORKFLOW_REF_NAME}" =~ ^release/[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*$ ]] && - [[ "$selected_sha" == "$(git rev-parse "refs/remotes/origin/${WORKFLOW_REF_NAME}")" ]]; then - trusted_reason="release-branch-head" elif git tag --points-at "$selected_sha" | grep -Eq '^v'; then trusted_reason="release-tag" + elif git for-each-ref --format='%(refname:short)' --contains "$selected_sha" refs/remotes/origin | grep -Eq '^origin/'; then + trusted_reason="repository-branch-history" else - pr_head_count="$( - gh api \ - -H "Accept: application/vnd.github+json" \ - "repos/${GITHUB_REPOSITORY}/commits/${selected_sha}/pulls" \ - --jq '[.[] | select(.state == "open" and .head.repo.full_name == "'"${GITHUB_REPOSITORY}"'" and .head.sha == "'"${selected_sha}"'")] | length' - )" - if [[ "$pr_head_count" != "0" ]]; then - trusted_reason="open-pr-head" - fi + trusted_reason="" fi if [[ -z "$trusted_reason" ]]; then echo "Ref '${INPUT_REF}' resolved to $selected_sha, which is not trusted for secret-bearing live/E2E checks." >&2 - echo "Allowed refs must be on main, match the current release branch head, point to a release tag, or match an open PR head in ${GITHUB_REPOSITORY}." >&2 + echo "Allowed refs must be reachable from an OpenClaw branch or release tag." >&2 exit 1 fi diff --git a/.github/workflows/openclaw-release-checks.yml b/.github/workflows/openclaw-release-checks.yml index 1a2509582fc..c5203a6552f 100644 --- a/.github/workflows/openclaw-release-checks.yml +++ b/.github/workflows/openclaw-release-checks.yml @@ -4,7 +4,7 @@ on: workflow_dispatch: inputs: ref: - description: Existing release tag or current full 40-character workflow-branch commit SHA to validate (for example v2026.4.12 or 0123456789abcdef0123456789abcdef01234567) + description: Branch, tag, or full commit SHA to validate required: true type: string provider: @@ -63,8 +63,8 @@ jobs: RELEASE_REF: ${{ inputs.ref }} run: | set -euo pipefail - if [[ ! "${RELEASE_REF}" =~ ^v[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*((-beta\.[1-9][0-9]*)|(-[1-9][0-9]*))?$ ]] && [[ ! "${RELEASE_REF}" =~ ^[0-9a-fA-F]{40}$ ]]; then - echo "Expected an existing release tag or current full 40-character workflow-branch commit SHA, got: ${RELEASE_REF}" >&2 + if [[ -z "${RELEASE_REF// }" ]] || [[ "${RELEASE_REF}" == -* ]]; then + echo "Expected a branch, tag, or full commit SHA; got: ${RELEASE_REF}" >&2 exit 1 fi @@ -78,24 +78,27 @@ jobs: id: ref run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT" - - name: Validate selected ref is on workflow branch + - name: Validate selected ref belongs to this repository env: RELEASE_REF: ${{ inputs.ref }} - WORKFLOW_REF_NAME: ${{ github.ref_name }} run: | set -euo pipefail - RELEASE_BRANCH_REF="refs/remotes/origin/${WORKFLOW_REF_NAME}" - git fetch --no-tags origin "+refs/heads/${WORKFLOW_REF_NAME}:refs/remotes/origin/${WORKFLOW_REF_NAME}" - if [[ "${RELEASE_REF}" =~ ^[0-9a-fA-F]{40}$ ]]; then - BRANCH_SHA="$(git rev-parse "${RELEASE_BRANCH_REF}")" - if [[ "$(git rev-parse HEAD)" != "${BRANCH_SHA}" ]]; then - echo "Commit SHA mode only supports the current ${WORKFLOW_REF_NAME} HEAD. Use a release tag for older commits." >&2 - exit 1 - fi - else - git merge-base --is-ancestor HEAD "${RELEASE_BRANCH_REF}" + SELECTED_SHA="$(git rev-parse HEAD)" + git fetch --no-tags origin '+refs/heads/*:refs/remotes/origin/*' + git fetch --tags origin '+refs/tags/*:refs/tags/*' + + if git tag --points-at "${SELECTED_SHA}" | grep -Eq '^v'; then + exit 0 fi + if git for-each-ref --format='%(refname:short)' --contains "${SELECTED_SHA}" refs/remotes/origin | grep -Eq '^origin/'; then + exit 0 + fi + + echo "Ref '${RELEASE_REF}' resolved to ${SELECTED_SHA}, but that commit is not reachable from an OpenClaw branch or release tag." >&2 + echo "Secret-bearing release checks only run repository-owned branch/tag history, not arbitrary unreferenced commits." >&2 + exit 1 + - name: Capture selected inputs id: inputs env: diff --git a/docs/ci.md b/docs/ci.md index 6e420b6481f..74497fb47dc 100644 --- a/docs/ci.md +++ b/docs/ci.md @@ -6,7 +6,14 @@ read_when: - You are debugging failing GitHub Actions checks --- -The CI runs on every push to `main` and every pull request. It uses smart scoping to skip expensive jobs when only unrelated areas changed. Manual `workflow_dispatch` runs intentionally bypass smart scoping and fan out the full CI graph for release candidates or broad validation. +The CI runs on every push to `main` and every pull request. It uses smart scoping to skip expensive jobs when only unrelated areas changed. Manual `workflow_dispatch` runs intentionally bypass smart scoping and fan out the full normal CI graph for release candidates or broad validation. + +`Full Release Validation` is the manual umbrella workflow for "run everything +before release." It accepts a branch, tag, or full commit SHA, dispatches the +manual `CI` workflow with that target, and dispatches `OpenClaw Release Checks` +for install smoke, Docker release-path suites, live/E2E, OpenWebUI, QA Lab +parity, Matrix, and Telegram lanes. It can also run the post-publish `NPM +Telegram Beta E2E` workflow when a published package spec is provided. QA Lab has dedicated CI lanes outside the main smart-scoped workflow. The `Parity gate` workflow runs on matching PR changes and manual dispatch; it @@ -84,10 +91,14 @@ scoped lane on: Linux Node shards, bundled-plugin shards, channel contracts, Node 22 compatibility, `check`, `check-additional`, build smoke, docs checks, Python skills, Windows, macOS, Android, and Control UI i18n. Manual runs use a unique concurrency group so a release-candidate full suite is not cancelled by -another push or PR run on the same ref. +another push or PR run on the same ref. The optional `target_ref` input lets a +trusted caller run that graph against a branch, tag, or full commit SHA while +using the workflow file from the selected dispatch ref. ```bash gh workflow run ci.yml --ref release/YYYY.M.D +gh workflow run ci.yml --ref main -f target_ref= +gh workflow run full-release-validation.yml --ref main -f ref= ``` ## Fail-fast order diff --git a/docs/reference/RELEASING.md b/docs/reference/RELEASING.md index dfec8dc506a..0a31abfc90d 100644 --- a/docs/reference/RELEASING.md +++ b/docs/reference/RELEASING.md @@ -49,8 +49,16 @@ OpenClaw has three public release lanes: - Run `pnpm build && pnpm ui:build` before `pnpm release:check` so the expected `dist/*` release artifacts and Control UI bundle exist for the pack validation step -- Run the manual `CI` workflow before release approval when you need full normal - CI coverage for the release candidate. Manual CI dispatches bypass changed +- Run the manual `Full Release Validation` workflow before release approval + when you need the whole release validation suite from one entrypoint. It + accepts a branch, tag, or full commit SHA, dispatches manual `CI`, and + dispatches `OpenClaw Release Checks` for install smoke, Docker release-path + suites, live/E2E, OpenWebUI, QA Lab parity, Matrix, and Telegram lanes. + Provide `npm_telegram_package_spec` only after a package has been published + and the post-publish Telegram E2E should run too. + Example: `gh workflow run full-release-validation.yml --ref main -f ref=release/YYYY.M.D` +- Run the manual `CI` workflow directly when you only need full normal CI + coverage for the release candidate. Manual CI dispatches bypass changed scoping and force the Linux Node shards, bundled-plugin shards, channel contracts, Node 22 compatibility, `check`, `check-additional`, build smoke, docs checks, Python skills, Windows, macOS, Android, and Control UI i18n @@ -74,13 +82,11 @@ OpenClaw has three public release lanes: - This split is intentional: keep the real npm release path short, deterministic, and artifact-focused, while slower live checks stay in their own lane so they do not stall or block publish -- Release checks must be dispatched from the `main` workflow ref or from a - `release/YYYY.M.D` workflow ref so the workflow logic and secrets stay - controlled -- That workflow accepts either an existing release tag or the current full - 40-character workflow-branch commit SHA -- In commit-SHA mode it only accepts the current workflow-branch HEAD; use a - release tag for older release commits +- Secret-bearing release checks should be dispatched through `Full Release +Validation` or from the `main`/release workflow ref so workflow logic and + secrets stay controlled +- `OpenClaw Release Checks` accepts a branch, tag, or full commit SHA as long + as the resolved commit is reachable from an OpenClaw branch or release tag - `OpenClaw NPM Release` validation-only preflight also accepts the current full 40-character workflow-branch commit SHA without requiring a pushed tag - That SHA path is validation-only and cannot be promoted into a real publish @@ -163,10 +169,9 @@ OpenClaw has three public release lanes: `OpenClaw Release Checks` accepts these operator-controlled inputs: -- `ref`: existing release tag or the current full 40-character `main` commit - SHA to validate when dispatched from `main`; from a release branch, use an - existing release tag or the current full 40-character release-branch commit - SHA +- `ref`: branch, tag, or full commit SHA to validate. Secret-bearing checks + require the resolved commit to be reachable from an OpenClaw branch or + release tag. Rules: @@ -174,9 +179,8 @@ Rules: - Beta prerelease tags may publish only to `beta` - For `OpenClaw NPM Release`, full commit SHA input is allowed only when `preflight_only=true` -- `OpenClaw Release Checks` is always validation-only and also accepts the - current workflow-branch commit SHA -- Release checks commit-SHA mode also requires the current workflow-branch HEAD +- `OpenClaw Release Checks` and `Full Release Validation` are always + validation-only - The real publish path must use the same `npm_dist_tag` used during preflight; the workflow verifies that metadata before publish continues @@ -189,13 +193,11 @@ When cutting a stable npm release: SHA for a validation-only dry run of the preflight workflow 2. Choose `npm_dist_tag=beta` for the normal beta-first flow, or `latest` only when you intentionally want a direct stable publish -3. Run the manual `CI` workflow on the release ref when you want full normal CI - coverage instead of smart-scoped merge coverage -4. Run `OpenClaw Release Checks` separately with the same tag or the - full current workflow-branch commit SHA when you want live prompt cache, - QA Lab parity, Matrix, and Telegram coverage - - This is separate on purpose so live coverage stays available without - recoupling long-running or flaky checks to the publish workflow +3. Run `Full Release Validation` on the release branch, release tag, or full + commit SHA when you want normal CI plus live prompt cache, Docker, QA Lab, + Matrix, and Telegram coverage from one manual workflow +4. If you intentionally only need the deterministic normal test graph, run the + manual `CI` workflow on the release ref instead 5. Save the successful `preflight_run_id` 6. Run `OpenClaw NPM Release` again with `preflight_only=false`, the same `tag`, the same `npm_dist_tag`, and the saved `preflight_run_id` From b9c7a4306b20ae91780b3d63d70cc6aa22431339 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 18:04:03 -0700 Subject: [PATCH 137/418] fix(ci): declare Lobster Ajv runtime dependency --- extensions/lobster/package.json | 1 + pnpm-lock.yaml | 3 +++ 2 files changed, 4 insertions(+) diff --git a/extensions/lobster/package.json b/extensions/lobster/package.json index cae5bcfabd6..9639431e85c 100644 --- a/extensions/lobster/package.json +++ b/extensions/lobster/package.json @@ -5,6 +5,7 @@ "type": "module", "dependencies": { "@clawdbot/lobster": "2026.4.6", + "ajv": "^8.18.0", "typebox": "1.1.33" }, "devDependencies": { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 8edbe16abed..52af352ac8f 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -761,6 +761,9 @@ importers: '@clawdbot/lobster': specifier: 2026.4.6 version: 2026.4.6 + ajv: + specifier: ^8.18.0 + version: 8.18.0 typebox: specifier: 1.1.33 version: 1.1.33 From b99540964c057939c8012d64fa41dfd22391d505 Mon Sep 17 00:00:00 2001 From: pashpashpash Date: Sun, 26 Apr 2026 18:06:57 -0700 Subject: [PATCH 138/418] Fix compaction rotation follow-ups --- .../compact.hooks.harness.ts | 29 ++++- .../pi-embedded-runner/compact.hooks.test.ts | 101 ++++++++++++++++++ .../pi-embedded-runner/compact.queued.ts | 4 +- src/agents/pi-embedded-runner/compact.ts | 15 +-- .../compaction-successor-transcript.test.ts | 49 +++++++++ .../compaction-successor-transcript.ts | 100 +++++++++-------- src/auto-reply/reply/reply-state.test.ts | 25 +++++ src/auto-reply/reply/session-updates.ts | 13 ++- 8 files changed, 270 insertions(+), 66 deletions(-) diff --git a/src/agents/pi-embedded-runner/compact.hooks.harness.ts b/src/agents/pi-embedded-runner/compact.hooks.harness.ts index 36057b7ddf6..603b16ad94d 100644 --- a/src/agents/pi-embedded-runner/compact.hooks.harness.ts +++ b/src/agents/pi-embedded-runner/compact.hooks.harness.ts @@ -1,5 +1,6 @@ import { vi, type Mock } from "vitest"; import { clearAgentHarnesses } from "../harness/registry.js"; +import type { CompactionTranscriptRotation } from "./compaction-successor-transcript.js"; type MockResolvedModel = { model: { provider: string; api: string; id: string; input: unknown[] }; @@ -98,6 +99,11 @@ export const resolveAgentTransportOverrideMock: Mock<(params?: unknown) => strin export const resolveSandboxContextMock = vi.fn(async () => null); export const maybeCompactAgentHarnessSessionMock: Mock<(params?: unknown) => Promise> = vi.fn(async () => undefined); +export const rotateTranscriptAfterCompactionMock: Mock< + (_params?: unknown) => Promise +> = vi.fn(async () => ({ + rotated: false, +})); export function resetCompactSessionStateMocks(): void { sanitizeSessionHistoryMock.mockReset(); @@ -138,6 +144,8 @@ export function resetCompactSessionStateMocks(): void { resolveSandboxContextMock.mockResolvedValue(null); maybeCompactAgentHarnessSessionMock.mockReset(); maybeCompactAgentHarnessSessionMock.mockResolvedValue(undefined); + rotateTranscriptAfterCompactionMock.mockReset(); + rotateTranscriptAfterCompactionMock.mockResolvedValue({ rotated: false }); } export function resetCompactHooksHarnessMocks(): void { @@ -209,6 +217,7 @@ export async function loadCompactHooksHarness(): Promise<{ vi.doMock("../../plugins/provider-runtime.js", () => ({ prepareProviderRuntimeAuth: vi.fn(async () => ({ resolvedApiKey: undefined })), + resolveProviderReasoningOutputModeWithPlugin: vi.fn(() => undefined), resolveProviderSystemPromptContribution: vi.fn(() => undefined), resolveProviderTextTransforms: vi.fn(() => undefined), transformProviderSystemPrompt: vi.fn( @@ -264,12 +273,17 @@ export async function loadCompactHooksHarness(): Promise<{ session.messages.splice(1); return await sessionCompactImpl(); }), + setActiveToolsByName: vi.fn(), abortCompaction: sessionAbortCompactionMock, dispose: vi.fn(), }; return { session }; }), - DefaultResourceLoader: function DefaultResourceLoader() {}, + DefaultResourceLoader: function DefaultResourceLoader() { + return { + reload: vi.fn(async () => undefined), + }; + }, SessionManager: { open: vi.fn(() => ({})), }, @@ -287,6 +301,7 @@ export async function loadCompactHooksHarness(): Promise<{ })); vi.doMock("../pi-settings.js", () => ({ + applyPiCompactionSettingsFromConfig: vi.fn(), ensurePiCompactionReserveTokens: vi.fn(), resolveCompactionReserveTokensFloor: vi.fn(() => 0), })); @@ -442,6 +457,16 @@ export async function loadCompactHooksHarness(): Promise<{ resolveCompactionTimeoutMs: vi.fn(() => 30_000), })); + vi.doMock("./compaction-successor-transcript.js", async () => { + const actual = await vi.importActual( + "./compaction-successor-transcript.js", + ); + return { + ...actual, + rotateTranscriptAfterCompaction: rotateTranscriptAfterCompactionMock, + }; + }); + vi.doMock("./wait-for-idle-before-flush.js", () => ({ flushPendingToolResultsAfterIdle: vi.fn(async () => {}), })); @@ -476,6 +501,8 @@ export async function loadCompactHooksHarness(): Promise<{ vi.doMock("../agent-scope.js", () => ({ listAgentEntries: vi.fn(() => []), + resolveAgentConfig: vi.fn(() => undefined), + resolveDefaultAgentId: vi.fn(() => "main"), resolveSessionAgentId: resolveSessionAgentIdMock, resolveSessionAgentIds: vi.fn(() => ({ defaultAgentId: "main", sessionAgentId: "main" })), })); diff --git a/src/agents/pi-embedded-runner/compact.hooks.test.ts b/src/agents/pi-embedded-runner/compact.hooks.test.ts index 4795b8c5ab8..5be6bc0d9a3 100644 --- a/src/agents/pi-embedded-runner/compact.hooks.test.ts +++ b/src/agents/pi-embedded-runner/compact.hooks.test.ts @@ -17,6 +17,7 @@ import { resolveModelMock, resolveSandboxContextMock, resolveSessionAgentIdMock, + rotateTranscriptAfterCompactionMock, resetCompactHooksHarnessMocks, resetCompactSessionStateMocks, sessionAbortCompactionMock, @@ -411,6 +412,49 @@ describe("compactEmbeddedPiSessionDirect hooks", () => { } }); + it("emits post-compaction side effects once for a rotated successor transcript", async () => { + const listener = vi.fn(); + const cleanup = onSessionTranscriptUpdate(listener); + const sync = vi.fn(async () => {}); + getMemorySearchManagerMock.mockResolvedValue({ manager: { sync } }); + rotateTranscriptAfterCompactionMock.mockResolvedValueOnce({ + rotated: true, + sessionId: "rotated-session", + sessionFile: "/tmp/rotated-session.jsonl", + leafId: "rotated-leaf", + }); + + try { + const result = await compactEmbeddedPiSessionDirect({ + sessionId: "session-1", + sessionKey: TEST_SESSION_KEY, + sessionFile: "/tmp/session.jsonl", + workspaceDir: "/tmp/workspace", + config: { + agents: { + defaults: { + compaction: { + truncateAfterCompaction: true, + postIndexSync: "await", + }, + }, + }, + } as never, + }); + + expect(result.ok).toBe(true); + expect(listener).toHaveBeenCalledTimes(1); + expect(listener).toHaveBeenCalledWith({ sessionFile: "/tmp/rotated-session.jsonl" }); + expect(sync).toHaveBeenCalledTimes(1); + expect(sync).toHaveBeenCalledWith({ + reason: "post-compaction", + sessionFiles: ["/tmp/rotated-session.jsonl"], + }); + } finally { + cleanup(); + } + }); + it("preserves tokensAfter when full-session context exceeds result.tokensBefore", async () => { estimateTokensMock.mockImplementation((message: unknown) => { const role = (message as { role?: string }).role; @@ -1008,6 +1052,63 @@ describe("compactEmbeddedPiSession hooks (ownsCompaction engine)", () => { ); }); + it("rotates in the wrapper when a delegated result echoes the current transcript", async () => { + const maintain = vi.fn(async (_params?: unknown) => ({ + changed: false, + bytesFreed: 0, + rewrittenEntries: 0, + })); + resolveContextEngineMock.mockResolvedValue({ + info: { ownsCompaction: false }, + compact: contextEngineCompactMock, + maintain, + } as never); + contextEngineCompactMock.mockResolvedValue({ + ok: true, + compacted: true, + reason: undefined, + result: { + summary: "engine-summary", + firstKeptEntryId: "entry-1", + tokensBefore: 120, + tokensAfter: 50, + sessionId: TEST_SESSION_ID, + sessionFile: TEST_SESSION_FILE, + }, + } as never); + rotateTranscriptAfterCompactionMock.mockResolvedValueOnce({ + rotated: true, + sessionId: "wrapper-rotated-session", + sessionFile: "/tmp/wrapper-rotated-session.jsonl", + leafId: "wrapper-rotated-leaf", + }); + + const result = await compactEmbeddedPiSession( + wrappedCompactionArgs({ + config: { + agents: { + defaults: { + compaction: { + truncateAfterCompaction: true, + }, + }, + }, + }, + }), + ); + + expect(result.ok).toBe(true); + expect(rotateTranscriptAfterCompactionMock).toHaveBeenCalledTimes(1); + expect(result.result?.sessionId).toBe("wrapper-rotated-session"); + expect(result.result?.sessionFile).toBe("/tmp/wrapper-rotated-session.jsonl"); + expect(maintain).toHaveBeenCalledWith( + expect.objectContaining({ + sessionId: "wrapper-rotated-session", + sessionFile: "/tmp/wrapper-rotated-session.jsonl", + }), + ); + }); + it("catches and logs hook exceptions without aborting compaction", async () => { hookRunner.hasHooks.mockReturnValue(true); hookRunner.runBeforeCompaction.mockRejectedValue(new Error("hook boom")); diff --git a/src/agents/pi-embedded-runner/compact.queued.ts b/src/agents/pi-embedded-runner/compact.queued.ts index 1efc1984d7c..422d619222e 100644 --- a/src/agents/pi-embedded-runner/compact.queued.ts +++ b/src/agents/pi-embedded-runner/compact.queued.ts @@ -164,7 +164,9 @@ export async function compactEmbeddedPiSession( }); const delegatedSessionId = result.result?.sessionId; const delegatedSessionFile = result.result?.sessionFile; - const delegatedRotatedTranscript = Boolean(delegatedSessionId || delegatedSessionFile); + const delegatedRotatedTranscript = + (typeof delegatedSessionId === "string" && delegatedSessionId !== params.sessionId) || + (typeof delegatedSessionFile === "string" && delegatedSessionFile !== params.sessionFile); let postCompactionSessionId = delegatedSessionId ?? params.sessionId; let postCompactionSessionFile = delegatedSessionFile ?? params.sessionFile; let postCompactionLeafId: string | undefined; diff --git a/src/agents/pi-embedded-runner/compact.ts b/src/agents/pi-embedded-runner/compact.ts index 085b3fe9b81..8306f37b3c9 100644 --- a/src/agents/pi-embedded-runner/compact.ts +++ b/src/agents/pi-embedded-runner/compact.ts @@ -1073,11 +1073,6 @@ export async function compactEmbeddedPiSessionDirect( }, }, ); - await runPostCompactionSideEffects({ - config: params.config, - sessionKey: params.sessionKey, - sessionFile: params.sessionFile, - }); let effectiveFirstKeptEntryId = result.firstKeptEntryId; let postCompactionLeafId = typeof sessionManager.getLeafId === "function" @@ -1135,12 +1130,12 @@ export async function compactEmbeddedPiSessionDirect( `[compaction] rotated active transcript after compaction ` + `(sessionKey=${params.sessionKey ?? params.sessionId})`, ); - await runPostCompactionSideEffects({ - config: params.config, - sessionKey: params.sessionKey, - sessionFile: activeSessionFile, - }); } + await runPostCompactionSideEffects({ + config: params.config, + sessionKey: params.sessionKey, + sessionFile: activeSessionFile, + }); if (params.config && params.sessionKey && checkpointSnapshot) { try { const storedCheckpoint = await persistSessionCompactionCheckpoint({ diff --git a/src/agents/pi-embedded-runner/compaction-successor-transcript.test.ts b/src/agents/pi-embedded-runner/compaction-successor-transcript.test.ts index c0f5f7e1f9a..d7fb656a642 100644 --- a/src/agents/pi-embedded-runner/compaction-successor-transcript.test.ts +++ b/src/agents/pi-embedded-runner/compaction-successor-transcript.test.ts @@ -163,6 +163,55 @@ describe("rotateTranscriptAfterCompaction", () => { firstKeptEntryId: compactionId, }); }); + + it("preserves unsummarized sibling branches and branch summaries", async () => { + const dir = await createTmpDir(); + const manager = SessionManager.create(dir, dir); + + manager.appendMessage({ role: "user", content: "hello", timestamp: 1 }); + const branchFromId = manager.appendMessage(makeAssistant("hi there", 2)); + + const branchSummaryId = manager.branchWithSummary( + branchFromId, + "Summary of the abandoned branch.", + ); + const siblingMsgId = manager.appendMessage({ + role: "user", + content: "do task B instead", + timestamp: 3, + }); + manager.appendMessage(makeAssistant("done B", 4)); + + manager.branch(branchFromId); + manager.appendMessage({ role: "user", content: "do task A", timestamp: 5 }); + const firstKeptId = manager.appendMessage(makeAssistant("done A", 6)); + manager.appendCompaction("Summary of main branch.", firstKeptId, 5000); + manager.appendMessage({ role: "user", content: "next", timestamp: 7 }); + + const sessionFile = manager.getSessionFile()!; + const result = await rotateTranscriptAfterCompaction({ + sessionManager: manager, + sessionFile, + now: () => new Date("2026-04-27T12:45:00.000Z"), + }); + + expect(result.rotated).toBe(true); + const successor = SessionManager.open(result.sessionFile!); + const allEntries = successor.getEntries(); + expect(allEntries.find((entry) => entry.id === branchSummaryId)).toMatchObject({ + type: "branch_summary", + summary: "Summary of the abandoned branch.", + }); + expect(allEntries.find((entry) => entry.id === siblingMsgId)).toMatchObject({ + type: "message", + message: expect.objectContaining({ content: "do task B instead" }), + }); + + const activeContextText = JSON.stringify(successor.buildSessionContext().messages); + expect(activeContextText).toContain("Summary of main branch."); + expect(activeContextText).toContain("next"); + expect(activeContextText).not.toContain("do task B instead"); + }); }); describe("shouldRotateCompactionTranscript", () => { diff --git a/src/agents/pi-embedded-runner/compaction-successor-transcript.ts b/src/agents/pi-embedded-runner/compaction-successor-transcript.ts index ce701c0b16a..9deee8f14cc 100644 --- a/src/agents/pi-embedded-runner/compaction-successor-transcript.ts +++ b/src/agents/pi-embedded-runner/compaction-successor-transcript.ts @@ -12,7 +12,7 @@ import type { OpenClawConfig } from "../../config/types.openclaw.js"; type ReadonlySessionManagerForRotation = Pick< SessionManager, - "buildSessionContext" | "getBranch" | "getCwd" | "getHeader" + "buildSessionContext" | "getBranch" | "getCwd" | "getEntries" | "getHeader" >; export type CompactionTranscriptRotation = { @@ -54,6 +54,7 @@ export async function rotateTranscriptAfterCompaction(params: { timestamp, }); const successorEntries = buildSuccessorEntries({ + allEntries: params.sessionManager.getEntries(), branch, latestCompactionIndex, }); @@ -97,69 +98,66 @@ function findLatestCompactionIndex(entries: SessionEntry[]): number { } function buildSuccessorEntries(params: { + allEntries: SessionEntry[]; branch: SessionEntry[]; latestCompactionIndex: number; }): SessionEntry[] { - const { branch, latestCompactionIndex } = params; + const { allEntries, branch, latestCompactionIndex } = params; const compaction = branch[latestCompactionIndex] as CompactionEntry; - const firstKeptIndex = branch.findIndex((entry) => entry.id === compaction.firstKeptEntryId); - const keptBeforeCompaction = - firstKeptIndex >= 0 && firstKeptIndex < latestCompactionIndex - ? branch.slice(firstKeptIndex, latestCompactionIndex) - : []; - const afterCompaction = branch.slice(latestCompactionIndex + 1); - const statePrefix = collectLatestStatePrefix(branch.slice(0, latestCompactionIndex)); - const successorEntries: SessionEntry[] = []; - const seenIds = new Set(); - let parentId: string | null = null; - const append = (entry: SessionEntry) => { - if (seenIds.has(entry.id)) { - return; - } - const nextEntry = { ...entry, parentId } as SessionEntry; - successorEntries.push(nextEntry); - seenIds.add(nextEntry.id); - parentId = nextEntry.id; - }; - - for (const entry of statePrefix) { - append(entry); - } - append(compaction); - for (const entry of [...keptBeforeCompaction, ...afterCompaction]) { - if (entry.type === "compaction" || entry.type === "label") { + const summarizedBranchIds = new Set(); + for (let index = 0; index < latestCompactionIndex; index += 1) { + const entry = branch[index]; + if (!entry) { continue; } - append(entry); + if (compaction.firstKeptEntryId && entry.id === compaction.firstKeptEntryId) { + break; + } + summarizedBranchIds.add(entry.id); } - const retainedIds = new Set(successorEntries.map((entry) => entry.id)); - for (const entry of branch) { - if (entry.type !== "label" || !retainedIds.has(entry.targetId)) { + + const removedIds = new Set(); + for (const entry of allEntries) { + if (summarizedBranchIds.has(entry.id) && entry.type === "message") { + removedIds.add(entry.id); + } + } + for (const entry of allEntries) { + if (entry.type === "label" && removedIds.has(entry.targetId)) { + removedIds.add(entry.id); + } + } + + const entryById = new Map(allEntries.map((entry) => [entry.id, entry])); + const activeBranchIds = new Set(branch.map((entry) => entry.id)); + const keptEntries: SessionEntry[] = []; + for (const entry of allEntries) { + if (removedIds.has(entry.id)) { continue; } - append(entry); - } - return successorEntries; -} -function collectLatestStatePrefix(entries: SessionEntry[]): SessionEntry[] { - const customEntries: Array<{ index: number; entry: SessionEntry }> = []; - const latestByType = new Map(); - for (const [index, entry] of entries.entries()) { - if (entry.type === "custom") { - customEntries.push({ index, entry }); - } else if ( - entry.type === "thinking_level_change" || - entry.type === "model_change" || - entry.type === "session_info" - ) { - latestByType.set(entry.type, { index, entry }); + let parentId = entry.parentId; + while (parentId !== null && removedIds.has(parentId)) { + parentId = entryById.get(parentId)?.parentId ?? null; + } + + keptEntries.push( + parentId === entry.parentId ? entry : ({ ...entry, parentId } as SessionEntry), + ); + } + + const inactiveEntries: SessionEntry[] = []; + const activeEntries: SessionEntry[] = []; + for (const entry of keptEntries) { + if (activeBranchIds.has(entry.id)) { + activeEntries.push(entry); + } else { + inactiveEntries.push(entry); } } - return [...customEntries, ...latestByType.values()] - .toSorted((left, right) => left.index - right.index) - .map(({ entry }) => entry); + + return [...inactiveEntries, ...activeEntries]; } function buildSuccessorHeader(params: { diff --git a/src/auto-reply/reply/reply-state.test.ts b/src/auto-reply/reply/reply-state.test.ts index 6485965b630..3101742b053 100644 --- a/src/auto-reply/reply/reply-state.test.ts +++ b/src/auto-reply/reply/reply-state.test.ts @@ -556,6 +556,31 @@ describe("incrementCompactionCount", () => { expect(stored[sessionKey].compactionCount).toBe(1); }); + it("updates sessionFile when rotation keeps the same sessionId", async () => { + const entry = { + sessionId: "same-id", + sessionFile: "same-id.jsonl", + updatedAt: Date.now(), + compactionCount: 0, + } as SessionEntry; + const { storePath, sessionKey, sessionStore } = await createCompactionSessionFixture(entry); + const rotatedSessionFile = path.join(path.dirname(storePath), "rotated-same-id.jsonl"); + + await incrementCompactionCount({ + sessionEntry: entry, + sessionStore, + sessionKey, + storePath, + newSessionId: "same-id", + newSessionFile: rotatedSessionFile, + }); + + const stored = JSON.parse(await fs.readFile(storePath, "utf-8")); + expect(stored[sessionKey].sessionId).toBe("same-id"); + expect(stored[sessionKey].sessionFile).toBe(rotatedSessionFile); + expect(stored[sessionKey].compactionCount).toBe(1); + }); + it("does not update totalTokens when tokensAfter is not provided", async () => { const entry = { sessionId: "s1", diff --git a/src/auto-reply/reply/session-updates.ts b/src/auto-reply/reply/session-updates.ts index 47121243b79..df90d6bb02f 100644 --- a/src/auto-reply/reply/session-updates.ts +++ b/src/auto-reply/reply/session-updates.ts @@ -248,16 +248,23 @@ export async function incrementCompactionCount(params: { compactionCount: nextCount, updatedAt: now, }; - if (newSessionId && newSessionId !== entry.sessionId) { + const explicitNewSessionFile = normalizeOptionalString(newSessionFile); + const sessionIdChanged = Boolean(newSessionId && newSessionId !== entry.sessionId); + const sessionFileChanged = Boolean( + explicitNewSessionFile && explicitNewSessionFile !== entry.sessionFile, + ); + if (sessionIdChanged && newSessionId) { updates.sessionId = newSessionId; updates.sessionFile = - newSessionFile ?? + explicitNewSessionFile ?? resolveCompactionSessionFile({ entry, sessionKey, storePath, newSessionId, }); + } else if (sessionFileChanged && explicitNewSessionFile) { + updates.sessionFile = explicitNewSessionFile; } // If tokensAfter is provided, update the cached token counts to reflect post-compaction state if (tokensAfter != null && tokensAfter > 0) { @@ -281,7 +288,7 @@ export async function incrementCompactionCount(params: { }; }); } - if (newSessionId && newSessionId !== entry.sessionId && cfg) { + if ((sessionIdChanged || sessionFileChanged) && cfg) { emitCompactionSessionLifecycleHooks({ cfg, sessionKey, From f0b758fba2e03412e3d4293d5ffe740b327f7b42 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 02:07:28 +0100 Subject: [PATCH 139/418] test(docker): stub package-derived update fixture builds --- scripts/e2e/update-channel-switch-docker.sh | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/scripts/e2e/update-channel-switch-docker.sh b/scripts/e2e/update-channel-switch-docker.sh index f94af9ba5f8..8e3ec184a60 100755 --- a/scripts/e2e/update-channel-switch-docker.sh +++ b/scripts/e2e/update-channel-switch-docker.sh @@ -48,6 +48,11 @@ const fs = require("node:fs"); const packageJsonPath = "/tmp/openclaw-git/package.json"; const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf8")); packageJson.pnpm = { ...packageJson.pnpm, allowUnusedPatches: true }; +packageJson.scripts = { + ...packageJson.scripts, + build: "node -e \"console.log('fixture build skipped')\"", + "ui:build": "node -e \"console.log('fixture ui build skipped')\"", +}; fs.writeFileSync(packageJsonPath, `${JSON.stringify(packageJson, null, 2)}\n`); NODE ( From 6a20c83cf704a71671ff0a4bbad9d4bed6ffcfb9 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 02:02:01 +0100 Subject: [PATCH 140/418] docs: clarify Ollama web search auth --- docs/providers/ollama.md | 10 +++--- docs/reference/api-usage-costs.md | 2 +- docs/tools/ollama-search.md | 52 +++++++++++++++++++++++++++++-- docs/tools/web.md | 32 +++++++++---------- 4 files changed, 72 insertions(+), 24 deletions(-) diff --git a/docs/providers/ollama.md b/docs/providers/ollama.md index 339dd1d7fe3..27f5aead375 100644 --- a/docs/providers/ollama.md +++ b/docs/providers/ollama.md @@ -326,11 +326,11 @@ prefix before calling Ollama so the server receives `qwen3:32b`. OpenClaw supports **Ollama Web Search** as a bundled `web_search` provider. -| Property | Detail | -| ----------- | ----------------------------------------------------------------------------------------------------------------- | -| Host | Uses your configured Ollama host (`models.providers.ollama.baseUrl` when set, otherwise `http://127.0.0.1:11434`) | -| Auth | Key-free | -| Requirement | Ollama must be running and signed in with `ollama signin` | +| Property | Detail | +| ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Host | Uses your configured Ollama host (`models.providers.ollama.baseUrl` when set, otherwise `http://127.0.0.1:11434`); `https://ollama.com` uses the hosted API directly | +| Auth | Key-free for signed-in local Ollama hosts; `OLLAMA_API_KEY` or configured provider auth for direct `https://ollama.com` search or auth-protected hosts | +| Requirement | Local/self-hosted hosts must be running and signed in with `ollama signin`; direct hosted search requires `baseUrl: "https://ollama.com"` plus a real Ollama API key | Choose **Ollama Web Search** during `openclaw onboard` or `openclaw configure --section web`, or set: diff --git a/docs/reference/api-usage-costs.md b/docs/reference/api-usage-costs.md index 9dd612b8daa..16d8bd38507 100644 --- a/docs/reference/api-usage-costs.md +++ b/docs/reference/api-usage-costs.md @@ -132,7 +132,7 @@ See [Memory](/concepts/memory). - **Grok (xAI)**: `XAI_API_KEY` or `plugins.entries.xai.config.webSearch.apiKey` - **Kimi (Moonshot)**: `KIMI_API_KEY`, `MOONSHOT_API_KEY`, or `plugins.entries.moonshot.config.webSearch.apiKey` - **MiniMax Search**: `MINIMAX_CODE_PLAN_KEY`, `MINIMAX_CODING_API_KEY`, `MINIMAX_API_KEY`, or `plugins.entries.minimax.config.webSearch.apiKey` -- **Ollama Web Search**: key-free by default, but requires a reachable Ollama host plus `ollama signin`; can also reuse normal Ollama provider bearer auth when the host requires it +- **Ollama Web Search**: key-free for a reachable signed-in local Ollama host; direct `https://ollama.com` search uses `OLLAMA_API_KEY`, and auth-protected hosts can reuse normal Ollama provider bearer auth - **Perplexity Search API**: `PERPLEXITY_API_KEY`, `OPENROUTER_API_KEY`, or `plugins.entries.perplexity.config.webSearch.apiKey` - **Tavily**: `TAVILY_API_KEY` or `plugins.entries.tavily.config.webSearch.apiKey` - **DuckDuckGo**: key-free fallback (no API billing, but unofficial and HTML-based) diff --git a/docs/tools/ollama-search.md b/docs/tools/ollama-search.md index 280748e6637..2b159e148c6 100644 --- a/docs/tools/ollama-search.md +++ b/docs/tools/ollama-search.md @@ -1,8 +1,9 @@ --- -summary: "Ollama Web Search via your configured Ollama host" +summary: "Ollama Web Search via a local Ollama host or the hosted Ollama API" read_when: - You want to use Ollama for web_search - You want a key-free web_search provider + - You want to use hosted Ollama Web Search with OLLAMA_API_KEY - You need Ollama Web Search setup guidance title: "Ollama web search" --- @@ -11,12 +12,15 @@ OpenClaw supports **Ollama Web Search** as a bundled `web_search` provider. It uses Ollama's web-search API and returns structured results with titles, URLs, and snippets. -Unlike the Ollama model provider, this setup does not need an API key by +For local or self-hosted Ollama, this setup does not need an API key by default. It does require: - an Ollama host that is reachable from OpenClaw - `ollama signin` +For direct hosted search, set the Ollama provider base URL to `https://ollama.com` +and provide a real `OLLAMA_API_KEY`. + ## Setup @@ -62,6 +66,25 @@ configured host. Optional Ollama host override: +```json5 +{ + plugins: { + entries: { + ollama: { + config: { + webSearch: { + baseUrl: "http://ollama-host:11434", + }, + }, + }, + }, + }, +} +``` + +If you already configure Ollama as a model provider, the web-search provider can +reuse that host instead: + ```json5 { models: { @@ -80,11 +103,36 @@ If your Ollama host expects bearer auth, OpenClaw reuses `models.providers.ollama.apiKey` (or the matching env-backed provider auth) for requests to that configured host. +Direct hosted Ollama Web Search: + +```json5 +{ + models: { + providers: { + ollama: { + baseUrl: "https://ollama.com", + apiKey: "OLLAMA_API_KEY", + }, + }, + }, + tools: { + web: { + search: { + provider: "ollama", + }, + }, + }, +} +``` + ## Notes - No web-search-specific API key field is required for this provider. - If the Ollama host is auth-protected, OpenClaw reuses the normal Ollama provider API key when present. +- If `baseUrl` is `https://ollama.com`, OpenClaw calls + `https://ollama.com/api/web_search` directly and sends the configured Ollama + API key as bearer auth. - If the configured host does not expose web search and `OLLAMA_API_KEY` is set, OpenClaw can fall back to `https://ollama.com/api/web_search` without sending that env key to the local host. diff --git a/docs/tools/web.md b/docs/tools/web.md index e759ae3de9e..a3d93bdb361 100644 --- a/docs/tools/web.md +++ b/docs/tools/web.md @@ -82,7 +82,7 @@ local while `web_search` and `x_search` can use xAI Responses under the hood. Structured results via the MiniMax Coding Plan search API. - Key-free search via your configured Ollama host. Requires `ollama signin`. + Search via a signed-in local Ollama host or the hosted Ollama API. Structured results with content extraction controls and domain filtering. @@ -97,20 +97,20 @@ local while `web_search` and `x_search` can use xAI Responses under the hood. ### Provider comparison -| Provider | Result style | Filters | API key | -| ----------------------------------------- | -------------------------- | ------------------------------------------------ | -------------------------------------------------------------------------------- | -| [Brave](/tools/brave-search) | Structured snippets | Country, language, time, `llm-context` mode | `BRAVE_API_KEY` | -| [DuckDuckGo](/tools/duckduckgo-search) | Structured snippets | -- | None (key-free) | -| [Exa](/tools/exa-search) | Structured + extracted | Neural/keyword mode, date, content extraction | `EXA_API_KEY` | -| [Firecrawl](/tools/firecrawl) | Structured snippets | Via `firecrawl_search` tool | `FIRECRAWL_API_KEY` | -| [Gemini](/tools/gemini-search) | AI-synthesized + citations | -- | `GEMINI_API_KEY` | -| [Grok](/tools/grok-search) | AI-synthesized + citations | -- | `XAI_API_KEY` | -| [Kimi](/tools/kimi-search) | AI-synthesized + citations | -- | `KIMI_API_KEY` / `MOONSHOT_API_KEY` | -| [MiniMax Search](/tools/minimax-search) | Structured snippets | Region (`global` / `cn`) | `MINIMAX_CODE_PLAN_KEY` / `MINIMAX_CODING_API_KEY` | -| [Ollama Web Search](/tools/ollama-search) | Structured snippets | -- | None by default; `ollama signin` required, can reuse Ollama provider bearer auth | -| [Perplexity](/tools/perplexity-search) | Structured snippets | Country, language, time, domains, content limits | `PERPLEXITY_API_KEY` / `OPENROUTER_API_KEY` | -| [SearXNG](/tools/searxng-search) | Structured snippets | Categories, language | None (self-hosted) | -| [Tavily](/tools/tavily) | Structured snippets | Via `tavily_search` tool | `TAVILY_API_KEY` | +| Provider | Result style | Filters | API key | +| ----------------------------------------- | -------------------------- | ------------------------------------------------ | --------------------------------------------------------------------------------------- | +| [Brave](/tools/brave-search) | Structured snippets | Country, language, time, `llm-context` mode | `BRAVE_API_KEY` | +| [DuckDuckGo](/tools/duckduckgo-search) | Structured snippets | -- | None (key-free) | +| [Exa](/tools/exa-search) | Structured + extracted | Neural/keyword mode, date, content extraction | `EXA_API_KEY` | +| [Firecrawl](/tools/firecrawl) | Structured snippets | Via `firecrawl_search` tool | `FIRECRAWL_API_KEY` | +| [Gemini](/tools/gemini-search) | AI-synthesized + citations | -- | `GEMINI_API_KEY` | +| [Grok](/tools/grok-search) | AI-synthesized + citations | -- | `XAI_API_KEY` | +| [Kimi](/tools/kimi-search) | AI-synthesized + citations | -- | `KIMI_API_KEY` / `MOONSHOT_API_KEY` | +| [MiniMax Search](/tools/minimax-search) | Structured snippets | Region (`global` / `cn`) | `MINIMAX_CODE_PLAN_KEY` / `MINIMAX_CODING_API_KEY` | +| [Ollama Web Search](/tools/ollama-search) | Structured snippets | -- | None for signed-in local hosts; `OLLAMA_API_KEY` for direct `https://ollama.com` search | +| [Perplexity](/tools/perplexity-search) | Structured snippets | Country, language, time, domains, content limits | `PERPLEXITY_API_KEY` / `OPENROUTER_API_KEY` | +| [SearXNG](/tools/searxng-search) | Structured snippets | Categories, language | None (self-hosted) | +| [Tavily](/tools/tavily) | Structured snippets | Via `tavily_search` tool | `TAVILY_API_KEY` | ## Auto-detection @@ -176,7 +176,7 @@ API-backed providers first: Key-free fallbacks after that: 10. **DuckDuckGo** -- key-free HTML fallback with no account or API key (order 100) -11. **Ollama Web Search** -- key-free fallback via your configured Ollama host; requires Ollama to be reachable and signed in with `ollama signin` and can reuse Ollama provider bearer auth if the host needs it (order 110) +11. **Ollama Web Search** -- key-free fallback via your configured local Ollama host when it is reachable and signed in with `ollama signin`; can reuse Ollama provider bearer auth when the host needs it, and can call direct `https://ollama.com` search when configured with `OLLAMA_API_KEY` (order 110) 12. **SearXNG** -- `SEARXNG_BASE_URL` or `plugins.entries.searxng.config.webSearch.baseUrl` (order 200) If no provider is detected, it falls back to Brave (you will get a missing-key From acfa9877b32a6de63cab204890c98df0c2f63c5d Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 02:02:16 +0100 Subject: [PATCH 141/418] fix: parse Ollama tool call arguments --- extensions/ollama/src/stream-runtime.test.ts | 69 +++++++++++++++++++- extensions/ollama/src/stream.ts | 8 ++- 2 files changed, 74 insertions(+), 3 deletions(-) diff --git a/extensions/ollama/src/stream-runtime.test.ts b/extensions/ollama/src/stream-runtime.test.ts index d6598dd04eb..dcd664b1f2d 100644 --- a/extensions/ollama/src/stream-runtime.test.ts +++ b/extensions/ollama/src/stream-runtime.test.ts @@ -606,6 +606,73 @@ describe("buildAssistantMessage", () => { expect(toolCall.id).toMatch(/^ollama_call_[0-9a-f-]{36}$/); }); + it("parses stringified tool call arguments from Ollama responses", () => { + const response = { + model: "qwen3:32b", + created_at: "2026-01-01T00:00:00Z", + message: { + role: "assistant" as const, + content: "", + tool_calls: [{ function: { name: "bash", arguments: '{"command":"ls","path":"/tmp"}' } }], + }, + done: true, + }; + const result = buildAssistantMessage(response, modelInfo); + expect(result.content[0]).toMatchObject({ + type: "toolCall", + name: "bash", + arguments: { command: "ls", path: "/tmp" }, + }); + }); + + it("preserves unsafe integers in stringified tool call arguments", () => { + const response = { + model: "qwen3:32b", + created_at: "2026-01-01T00:00:00Z", + message: { + role: "assistant" as const, + content: "", + tool_calls: [ + { + function: { + name: "send", + arguments: '{"target":9223372036854775807,"nested":{"thread":1234567890123456789}}', + }, + }, + ], + }, + done: true, + }; + const result = buildAssistantMessage(response, modelInfo); + expect(result.content[0]).toMatchObject({ + type: "toolCall", + name: "send", + arguments: { + target: "9223372036854775807", + nested: { thread: "1234567890123456789" }, + }, + }); + }); + + it("falls back to empty arguments for malformed stringified tool call arguments", () => { + const response = { + model: "qwen3:32b", + created_at: "2026-01-01T00:00:00Z", + message: { + role: "assistant" as const, + content: "", + tool_calls: [{ function: { name: "bash", arguments: '{"command":"ls"' } }], + }, + done: true, + }; + const result = buildAssistantMessage(response, modelInfo); + expect(result.content[0]).toMatchObject({ + type: "toolCall", + name: "bash", + arguments: {}, + }); + }); + it("sets all costs to zero for local models", () => { const response = { model: "qwen3:32b", @@ -701,7 +768,7 @@ describe("parseNdjsonStream", () => { // Simulate the accumulation logic from createOllamaStreamFn const accumulatedToolCalls: Array<{ - function: { name: string; arguments: Record }; + function: { name: string; arguments: unknown }; }> = []; const chunks = []; for await (const chunk of parseNdjsonStream(reader)) { diff --git a/extensions/ollama/src/stream.ts b/extensions/ollama/src/stream.ts index c1f45a2070e..4dfd694fcdd 100644 --- a/extensions/ollama/src/stream.ts +++ b/extensions/ollama/src/stream.ts @@ -350,7 +350,7 @@ interface OllamaTool { interface OllamaToolCall { function: { name: string; - arguments: Record; + arguments: Record | string; }; } @@ -406,6 +406,10 @@ function ensureArgsObject(value: unknown): Record { return parseJsonObjectPreservingUnsafeIntegers(value) ?? {}; } +function normalizeOllamaToolCallArguments(value: unknown): Record { + return ensureArgsObject(value); +} + function normalizeOllamaCompatMessageToolArgs(payloadRecord: Record): void { const messages = payloadRecord.messages; if (!Array.isArray(messages)) { @@ -653,7 +657,7 @@ export function buildAssistantMessage( type: "toolCall", id: `ollama_call_${randomUUID()}`, name: toolCall.function.name, - arguments: toolCall.function.arguments, + arguments: normalizeOllamaToolCallArguments(toolCall.function.arguments), }); } } From 1316ca9aa87a04f8d0e036047512e5701326abdb Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 02:02:30 +0100 Subject: [PATCH 142/418] fix: gate Ollama ambient discovery --- extensions/ollama/index.test.ts | 19 +++++++++++++++---- extensions/ollama/provider-discovery.test.ts | 4 ++-- extensions/ollama/src/discovery-shared.ts | 4 ++++ 3 files changed, 21 insertions(+), 6 deletions(-) diff --git a/extensions/ollama/index.test.ts b/extensions/ollama/index.test.ts index e9ee52de232..4a7f5931a9b 100644 --- a/extensions/ollama/index.test.ts +++ b/extensions/ollama/index.test.ts @@ -241,7 +241,20 @@ describe("ollama plugin", () => { }); }); - it("keeps empty default-ish provider stubs quiet", async () => { + it("skips ambient discovery without Ollama auth or meaningful config", async () => { + const provider = registerProvider(); + + const result = await provider.discovery.run({ + config: {}, + env: { NODE_ENV: "development" }, + resolveProviderApiKey: () => ({ apiKey: "" }), + } as never); + + expect(result).toBeNull(); + expect(buildOllamaProviderMock).not.toHaveBeenCalled(); + }); + + it("skips empty default-ish provider stubs without probing localhost", async () => { const provider = registerProvider(); buildOllamaProviderMock.mockResolvedValueOnce({ baseUrl: "http://127.0.0.1:11434", @@ -266,9 +279,7 @@ describe("ollama plugin", () => { } as never); expect(result).toBeNull(); - expect(buildOllamaProviderMock).toHaveBeenCalledWith("http://127.0.0.1:11434", { - quiet: true, - }); + expect(buildOllamaProviderMock).not.toHaveBeenCalled(); }); it("treats non-default baseUrl as explicit discovery config", async () => { diff --git a/extensions/ollama/provider-discovery.test.ts b/extensions/ollama/provider-discovery.test.ts index 79049bd5b1c..0fcf658f377 100644 --- a/extensions/ollama/provider-discovery.test.ts +++ b/extensions/ollama/provider-discovery.test.ts @@ -210,10 +210,10 @@ describe("Ollama provider", () => { vi.stubGlobal("fetch", withFetchPreconnect(fetchMock)); const provider = await runOllamaCatalog({ - env: { VITEST: "", NODE_ENV: "development" }, + env: { OLLAMA_API_KEY: OLLAMA_LOCAL_AUTH_MARKER, VITEST: "", NODE_ENV: "development" }, }); - expect(provider?.apiKey).toBe(OLLAMA_LOCAL_AUTH_MARKER); + expect(provider?.apiKey).toBe("OLLAMA_API_KEY"); expect(provider?.api).toBe("ollama"); expect(provider?.baseUrl).toBe("http://127.0.0.1:11434"); expect(provider?.models).toHaveLength(2); diff --git a/extensions/ollama/src/discovery-shared.ts b/extensions/ollama/src/discovery-shared.ts index 2dd1a8dba51..b45dee32ba9 100644 --- a/extensions/ollama/src/discovery-shared.ts +++ b/extensions/ollama/src/discovery-shared.ts @@ -108,6 +108,7 @@ export async function resolveOllamaDiscoveryResult(params: { return null; } const ollamaKey = params.ctx.resolveProviderApiKey(OLLAMA_PROVIDER_ID).apiKey; + const hasOllamaDiscoveryOptIn = typeof ollamaKey === "string" && ollamaKey.trim().length > 0; const hasRealOllamaKey = typeof ollamaKey === "string" && ollamaKey.trim().length > 0 && @@ -130,6 +131,9 @@ export async function resolveOllamaDiscoveryResult(params: { }, }; } + if (!hasOllamaDiscoveryOptIn && !hasMeaningfulExplicitConfig) { + return null; + } if ( !hasRealOllamaKey && !hasMeaningfulExplicitConfig && From c6617c31554e8966b999a8985f623e4fc5822fa2 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 02:02:52 +0100 Subject: [PATCH 143/418] fix: silence Ollama memory doctor key warning --- src/commands/doctor-memory-search.test.ts | 31 +++++++++++++++++++++++ src/commands/doctor-memory-search.ts | 10 +++++--- 2 files changed, 38 insertions(+), 3 deletions(-) diff --git a/src/commands/doctor-memory-search.test.ts b/src/commands/doctor-memory-search.test.ts index f3118469ec5..8d480b70f84 100644 --- a/src/commands/doctor-memory-search.test.ts +++ b/src/commands/doctor-memory-search.test.ts @@ -394,6 +394,37 @@ describe("noteMemorySearchHealth", () => { expect(note).not.toHaveBeenCalled(); }); + it("does not warn for ollama when gateway probe is ready without CLI API key", async () => { + resolveMemorySearchConfig.mockReturnValue({ + provider: "ollama", + local: {}, + remote: {}, + }); + + await noteMemorySearchHealth(cfg, { + gatewayMemoryProbe: { checked: true, ready: true }, + }); + + expect(note).not.toHaveBeenCalled(); + expect(resolveApiKeyForProvider).not.toHaveBeenCalled(); + }); + + it("warns for ollama when gateway probe reports embeddings are not ready", async () => { + resolveMemorySearchConfig.mockReturnValue({ + provider: "ollama", + local: {}, + remote: {}, + }); + + await noteMemorySearchHealth(cfg, { + gatewayMemoryProbe: { checked: true, ready: false, error: "connection refused" }, + }); + + const message = String(note.mock.calls[0]?.[0] ?? ""); + expect(message).toContain('provider "ollama" is configured'); + expect(message).toContain("embeddings are not ready"); + }); + it("warns when lmstudio gateway probe reports embeddings are not ready", async () => { resolveMemorySearchConfig.mockReturnValue({ provider: "lmstudio", diff --git a/src/commands/doctor-memory-search.ts b/src/commands/doctor-memory-search.ts index 1b836a18e9d..c8ba2560579 100644 --- a/src/commands/doctor-memory-search.ts +++ b/src/commands/doctor-memory-search.ts @@ -128,6 +128,10 @@ function resolveSuggestedRemoteMemoryProvider(): string | undefined { )?.providerId; } +function isKeyOptionalMemoryProvider(providerId: string): boolean { + return providerId === "local" || providerId === "ollama" || providerId === "lmstudio"; +} + async function resolveRuntimeMemoryAuditContext( cfg: OpenClawConfig, ): Promise { @@ -402,7 +406,7 @@ export async function noteMemorySearchHealth( ); return; } - if (resolved.provider === "lmstudio") { + if (isKeyOptionalMemoryProvider(resolved.provider)) { if (opts?.gatewayMemoryProbe?.checked && opts.gatewayMemoryProbe.ready) { return; } @@ -410,8 +414,8 @@ export async function noteMemorySearchHealth( note( [ gatewayProbeWarning - ? 'Memory search provider "lmstudio" is configured, but the gateway reports embeddings are not ready.' - : 'Memory search provider "lmstudio" is configured, but the gateway could not confirm embeddings are ready.', + ? `Memory search provider "${resolved.provider}" is configured, but the gateway reports embeddings are not ready.` + : `Memory search provider "${resolved.provider}" is configured, but the gateway could not confirm embeddings are ready.`, gatewayProbeWarning, `Verify: ${formatCliCommand("openclaw memory status --deep")}`, ] From e28ad0f84f46466a404c8b70cce3c161222e31e0 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 02:02:59 +0100 Subject: [PATCH 144/418] fix: list configured provider models --- .../list.list-command.forward-compat.test.ts | 52 +++++++++++++++++++ src/commands/models/list.row-sources.ts | 7 +++ 2 files changed, 59 insertions(+) diff --git a/src/commands/models/list.list-command.forward-compat.test.ts b/src/commands/models/list.list-command.forward-compat.test.ts index 127921005fe..1c49749be10 100644 --- a/src/commands/models/list.list-command.forward-compat.test.ts +++ b/src/commands/models/list.list-command.forward-compat.test.ts @@ -273,6 +273,58 @@ describe("modelsListCommand forward-compat", () => { expect(runtime.log).toHaveBeenCalledWith("No models found."); }); + it("includes configured provider model rows for provider-filtered lists", async () => { + const ollamaConfig = { + agents: { defaults: { model: { primary: "ollama/qwen2.5:7b" } } }, + models: { + providers: { + ollama: { + api: "ollama", + apiKey: "ollama-local", + baseUrl: "http://127.0.0.1:11434", + models: [ + { id: "qwen2.5:7b", name: "Qwen 2.5 7B", input: ["text"] }, + { id: "llama3.2:3b", name: "Llama 3.2 3B", input: ["text"] }, + ], + }, + }, + }, + }; + mocks.loadModelsConfigWithSource.mockResolvedValueOnce({ + sourceConfig: ollamaConfig, + resolvedConfig: ollamaConfig, + diagnostics: [], + }); + mocks.resolveConfiguredEntries.mockReturnValueOnce({ + entries: [ + { + key: "ollama/qwen2.5:7b", + ref: { provider: "ollama", model: "qwen2.5:7b" }, + tags: new Set(["default"]), + aliases: [], + }, + ], + }); + const runtime = createRuntime(); + + await modelsListCommand({ json: true, provider: "ollama" }, runtime as never); + + expect(mocks.loadModelRegistry).not.toHaveBeenCalled(); + const rows = lastPrintedRows<{ key: string; name: string; tags: string[] }>(); + expect(rows).toEqual([ + expect.objectContaining({ + key: "ollama/qwen2.5:7b", + name: "Qwen 2.5 7B", + tags: ["default"], + }), + expect.objectContaining({ + key: "ollama/llama3.2:3b", + name: "Llama 3.2 3B", + tags: [], + }), + ]); + }); + it("does not mark configured codex model as missing when forward-compat can build a fallback", async () => { const runtime = createRuntime(); diff --git a/src/commands/models/list.row-sources.ts b/src/commands/models/list.row-sources.ts index ec5dc6363f0..93c05e42cbf 100644 --- a/src/commands/models/list.row-sources.ts +++ b/src/commands/models/list.row-sources.ts @@ -135,4 +135,11 @@ export async function appendConfiguredModelRowSources(params: { context: RowBuilderContext; }): Promise { await appendConfiguredRows(params); + if (params.context.filter.provider) { + await appendConfiguredProviderRows({ + rows: params.rows, + context: params.context, + seenKeys: new Set(params.rows.map((row) => row.key)), + }); + } } From 8c18df02f3d01f36c1c94ae805724f963f4ac4b9 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 02:03:03 +0100 Subject: [PATCH 145/418] docs: update Ollama fix changelog --- CHANGELOG.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index d9a381c7add..36e50c9d8cd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -25,10 +25,14 @@ Docs: https://docs.openclaw.ai - Providers/Ollama: honor `/api/show` capabilities when registering local models so non-tool Ollama models no longer receive the agent tool surface, and keep native Ollama thinking opt-in instead of enabling it by default. Fixes #64710 and duplicate #65343. Thanks @yuan-b, @netherby, @xilopaint, and @Diyforfun2026. - Providers/Ollama: expose native Ollama thinking effort levels so `/think max` is accepted for reasoning-capable Ollama models and maps to Ollama's highest supported `think` effort. Fixes #71584. Thanks @g0st1n. - Providers/Ollama: strip the active custom Ollama provider prefix before native chat and embedding requests, so custom provider ids like `ollama-spark/qwen3:32b` reach Ollama as the real model name. Fixes #72353. Thanks @maximus-dss and @hclsys. +- Providers/Ollama: parse stringified native tool-call arguments before dispatch, preserving unsafe integer values so Ollama tool use receives structured parameters. Fixes #69735; supersedes #69910. Thanks @rongshuzhao and @yfge. +- Providers/Ollama: skip ambient localhost discovery unless Ollama auth or meaningful config opts in, preventing unexpected probes to `127.0.0.1:11434` for users who are not using Ollama. Fixes #56939; supersedes #57116. Thanks @IanxDev and @tsukhani. - Providers/Ollama: move memory embeddings to Ollama's current `/api/embed` endpoint with batched `input` requests while preserving vector normalization and custom provider auth/header overrides. Fixes #39983. Thanks @sskkcc and @LiudengZhang. - Providers/Ollama: route local web search through Ollama's signed `/api/experimental/web_search` daemon proxy, use hosted `/api/web_search` directly for `ollama.com`, and keep `OLLAMA_API_KEY` scoped to cloud fallback auth. Fixes #69132. Thanks @yoon1012 and @hyspacex. +- Memory/doctor: treat Ollama memory embeddings as key-optional so `openclaw doctor` no longer warns about a missing API key when the gateway reports embeddings are ready. Fixes #46584. Thanks @fengly78. - Agents/Ollama: apply provider-owned replay turn normalization to native Ollama chat so Cloud models no longer reject non-alternating replay history in agent/Gateway runs. Fixes #71697. Thanks @ismael-81. - Agents/Ollama: validate explicit `--thinking max` against catalog-discovered Ollama reasoning metadata so local agent runs accept the same native thinking levels shown in the model catalog. Fixes #71584. Thanks @g0st1n. +- CLI/models: include explicitly configured provider models in `openclaw models list --provider ` without requiring the full catalog path, so configured Ollama models are visible. Fixes #65207. Thanks @drzeast-png. - Docker/QA: add observability coverage to the normal Docker aggregate so QA-lab OTEL and Prometheus diagnostics run inside Docker. Thanks @vincentkoc. - Auto-reply: poison inbound message dedupe after replay-unsafe provider/runtime failures so retries stay safe before visible progress but cannot duplicate messages after block output, tool side effects, or session progress. Fixes #69303; keeps #58549 and #64606 as duplicate validation. Thanks @martingarramon, @NikolaFC, and @zeroth-blip. - Agents/model fallback: jump directly to a known later live-session model redirect instead of walking unrelated fallback candidates, while preserving the already-landed live-session/fallback loop guard. Fixes #57471; related loop family already closed via #58496. Thanks @yuxiaoyang2007-prog. From 110fa97f2aa171d601d1736a5f4855d299f6fb88 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 02:09:06 +0100 Subject: [PATCH 146/418] fix: repair release validation follow-up checks --- extensions/lobster/src/lobster-runner.test.ts | 2 +- test/scripts/test-install-sh-docker.test.ts | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/extensions/lobster/src/lobster-runner.test.ts b/extensions/lobster/src/lobster-runner.test.ts index 7dfd764c1cb..6e93c9e9d85 100644 --- a/extensions/lobster/src/lobster-runner.test.ts +++ b/extensions/lobster/src/lobster-runner.test.ts @@ -421,7 +421,7 @@ describe("createEmbeddedLobsterRunner", () => { await loadEmbeddedToolRuntimeFromPackage(); const corePath = requireForTest.resolve("@clawdbot/lobster/core"); - const validationPath = corePath.replace(/\/core\/index\.js$/, "/validation.js"); + const validationPath = path.join(path.dirname(path.dirname(corePath)), "validation.js"); const validationModule = (await import(pathToFileURL(validationPath).href)) as { sharedAjv: import("ajv").default; }; diff --git a/test/scripts/test-install-sh-docker.test.ts b/test/scripts/test-install-sh-docker.test.ts index ae18f09b4d2..f7e0393c1bc 100644 --- a/test/scripts/test-install-sh-docker.test.ts +++ b/test/scripts/test-install-sh-docker.test.ts @@ -60,13 +60,13 @@ describe("test-install-sh-docker", () => { expect(script).toContain('echo "==> Reuse local dist/ from Docker image: $image"'); }); - it("allows release branch head refs for secret-backed Docker release checks", () => { + it("allows repository branch history and release tags for secret-backed Docker release checks", () => { const workflow = readFileSync(LIVE_E2E_WORKFLOW_PATH, "utf8"); - expect(workflow).toContain("WORKFLOW_REF_NAME: ${{ github.ref_name }}"); - expect(workflow).toContain("release-branch-head"); - expect(workflow).toContain("refs/remotes/origin/${WORKFLOW_REF_NAME}"); - expect(workflow).toContain("match the current release branch head"); + expect(workflow).toContain("git fetch --no-tags origin '+refs/heads/*:refs/remotes/origin/*'"); + expect(workflow).toContain("repository-branch-history"); + expect(workflow).toContain("git tag --points-at \"$selected_sha\" | grep -Eq '^v'"); + expect(workflow).toContain("reachable from an OpenClaw branch or release tag"); }); it("prints package size audits for release smoke tarballs", () => { From bf08dc2ed6c5902164f2f45d5ae89beefe811c71 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 02:13:55 +0100 Subject: [PATCH 147/418] test(docker): fix packaged docker harness lanes --- scripts/e2e/cron-mcp-cleanup-docker-client.ts | 2 +- scripts/e2e/plugins-docker.sh | 2 -- scripts/e2e/update-channel-switch-docker.sh | 4 ++-- 3 files changed, 3 insertions(+), 5 deletions(-) diff --git a/scripts/e2e/cron-mcp-cleanup-docker-client.ts b/scripts/e2e/cron-mcp-cleanup-docker-client.ts index 20fc912e343..8f8de202bf9 100644 --- a/scripts/e2e/cron-mcp-cleanup-docker-client.ts +++ b/scripts/e2e/cron-mcp-cleanup-docker-client.ts @@ -170,7 +170,7 @@ async function runCronCleanupScenario(params: { ); const initialArgs = await describeProbePid(pid); assert( - initialArgs?.includes("openclaw-cron-mcp-cleanup-probe"), + initialArgs === undefined || initialArgs.includes("openclaw-cron-mcp-cleanup-probe"), `cron MCP probe pid did not look like the test server: pid=${pid} args=${initialArgs}`, ); diff --git a/scripts/e2e/plugins-docker.sh b/scripts/e2e/plugins-docker.sh index f568cbb6526..5c34508a6cb 100755 --- a/scripts/e2e/plugins-docker.sh +++ b/scripts/e2e/plugins-docker.sh @@ -749,8 +749,6 @@ console.log("ok"); NODE fi -echo "Running bundle MCP CLI-agent e2e..." -node scripts/run-vitest.mjs run --config test/vitest/vitest.e2e.config.ts src/agents/cli-runner.bundle-mcp.e2e.test.ts EOF then cat "$RUN_LOG" diff --git a/scripts/e2e/update-channel-switch-docker.sh b/scripts/e2e/update-channel-switch-docker.sh index 8e3ec184a60..b68a4847e38 100755 --- a/scripts/e2e/update-channel-switch-docker.sh +++ b/scripts/e2e/update-channel-switch-docker.sh @@ -50,8 +50,8 @@ const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf8")); packageJson.pnpm = { ...packageJson.pnpm, allowUnusedPatches: true }; packageJson.scripts = { ...packageJson.scripts, - build: "node -e \"console.log('fixture build skipped')\"", - "ui:build": "node -e \"console.log('fixture ui build skipped')\"", + build: "node -e \"console.log(\\\"fixture build skipped\\\")\"", + "ui:build": "node -e \"console.log(\\\"fixture ui build skipped\\\")\"", }; fs.writeFileSync(packageJsonPath, `${JSON.stringify(packageJson, null, 2)}\n`); NODE From efec8a4a84c50be3b7884937bee14493da1bc9ea Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 02:17:02 +0100 Subject: [PATCH 148/418] docs: note Vitest cache race footgun --- AGENTS.md | 1 + 1 file changed, 1 insertion(+) diff --git a/AGENTS.md b/AGENTS.md index 29bf3eff3f5..faca52035ae 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -128,6 +128,7 @@ Telegraph style. Root rules only. Read scoped `AGENTS.md` before subtree work. - Prefer injection; if module mocking, mock narrow local `*.runtime.ts`, not broad barrels or `openclaw/plugin-sdk/*`. - Share fixtures/builders; delete duplicate assertions; assert behavior that can regress here. - Do not edit baseline/inventory/ignore/snapshot/expected-failure files to silence checks without explicit approval. +- Do not run multiple independent `pnpm test`/Vitest commands concurrently in the same worktree. They can race on `node_modules/.experimental-vitest-cache` and fail with `ENOTEMPTY`. Use one grouped `pnpm test ...` invocation, run targeted lanes sequentially, or set distinct `OPENCLAW_VITEST_FS_MODULE_CACHE_PATH` values when true parallel Vitest processes are needed. - Test workers max 16. Memory pressure: `OPENCLAW_VITEST_MAX_WORKERS=1 pnpm test`. - Live: `OPENCLAW_LIVE_TEST=1 pnpm test:live`; verbose `OPENCLAW_LIVE_TEST_QUIET=0`. - Guide: `docs/help/testing.md`. From eed7b13b62d6d46123a95790145fe6f39682ab17 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 18:17:39 -0700 Subject: [PATCH 149/418] fix(doctor): scope bundled runtime deps to active plugins --- src/cli/plugins-cli.list.test.ts | 2 +- src/cli/plugins-cli.ts | 2 +- ...doctor-bundled-plugin-runtime-deps.test.ts | 156 +++++++++++++++- .../doctor-bundled-plugin-runtime-deps.ts | 16 +- src/plugins/bundled-runtime-deps.ts | 20 +- src/plugins/effective-plugin-ids.ts | 171 ++++++++++++++++++ src/plugins/status.ts | 12 ++ 7 files changed, 366 insertions(+), 13 deletions(-) create mode 100644 src/plugins/effective-plugin-ids.ts diff --git a/src/cli/plugins-cli.list.test.ts b/src/cli/plugins-cli.list.test.ts index b2f67bf2235..07ffd5d5a13 100644 --- a/src/cli/plugins-cli.list.test.ts +++ b/src/cli/plugins-cli.list.test.ts @@ -71,7 +71,7 @@ describe("plugins cli list", () => { await runPluginsCommand(["plugins", "doctor"]); - expect(buildPluginDiagnosticsReport).toHaveBeenCalledWith(); + expect(buildPluginDiagnosticsReport).toHaveBeenCalledWith({ effectiveOnly: true }); expect(runtimeLogs).toContain("No plugin issues detected."); }); diff --git a/src/cli/plugins-cli.ts b/src/cli/plugins-cli.ts index 7e92b6a7213..0387ce3f923 100644 --- a/src/cli/plugins-cli.ts +++ b/src/cli/plugins-cli.ts @@ -836,7 +836,7 @@ export function registerPluginsCli(program: Command) { buildPluginDiagnosticsReport, formatPluginCompatibilityNotice, } = await import("../plugins/status.js"); - const report = buildPluginDiagnosticsReport(); + const report = buildPluginDiagnosticsReport({ effectiveOnly: true }); const errors = report.plugins.filter((p) => p.status === "error"); const diags = report.diagnostics.filter((d) => d.level === "error"); const compatibility = buildPluginCompatibilityNotices({ report }); diff --git a/src/commands/doctor-bundled-plugin-runtime-deps.test.ts b/src/commands/doctor-bundled-plugin-runtime-deps.test.ts index 006b283005a..39e1a381705 100644 --- a/src/commands/doctor-bundled-plugin-runtime-deps.test.ts +++ b/src/commands/doctor-bundled-plugin-runtime-deps.test.ts @@ -18,12 +18,21 @@ function writeJson(filePath: string, value: unknown) { } function writeBundledChannelPlugin(root: string, id: string, dependencies: Record) { + writeBundledChannelOwnerPlugin(root, id, [id], dependencies); +} + +function writeBundledChannelOwnerPlugin( + root: string, + id: string, + channels: string[], + dependencies: Record, +) { writeJson(path.join(root, "dist", "extensions", id, "package.json"), { dependencies, }); writeJson(path.join(root, "dist", "extensions", id, "openclaw.plugin.json"), { id, - channels: [id], + channels, configSchema: { type: "object" }, }); } @@ -259,16 +268,16 @@ describe("doctor bundled plugin runtime deps", () => { expect(result.conflicts).toEqual([]); }); - it("reports default-enabled bundled plugin deps", () => { + it("reports default-enabled gateway startup sidecar deps", () => { const root = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-doctor-bundled-")); writeJson(path.join(root, "package.json"), { name: "openclaw" }); - writeJson(path.join(root, "dist", "extensions", "openai", "package.json"), { + writeJson(path.join(root, "dist", "extensions", "browser", "package.json"), { dependencies: { - "openai-only": "1.0.0", + "browser-only": "1.0.0", }, }); - writeJson(path.join(root, "dist", "extensions", "openai", "openclaw.plugin.json"), { - id: "openai", + writeJson(path.join(root, "dist", "extensions", "browser", "openclaw.plugin.json"), { + id: "browser", enabledByDefault: true, configSchema: { type: "object" }, }); @@ -281,7 +290,39 @@ describe("doctor bundled plugin runtime deps", () => { }); expect(result.missing.map((dep) => `${dep.name}@${dep.version}`)).toEqual([ - "openai-only@1.0.0", + "browser-only@1.0.0", + ]); + expect(result.conflicts).toEqual([]); + }); + + it("reports explicitly enabled provider deps", () => { + const root = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-doctor-bundled-")); + writeJson(path.join(root, "package.json"), { name: "openclaw" }); + writeJson(path.join(root, "dist", "extensions", "bedrock", "package.json"), { + dependencies: { + "bedrock-only": "1.0.0", + }, + }); + writeJson(path.join(root, "dist", "extensions", "bedrock", "openclaw.plugin.json"), { + id: "bedrock", + enabledByDefault: true, + providers: ["bedrock"], + configSchema: { type: "object" }, + }); + + const result = scanBundledPluginRuntimeDeps({ + packageRoot: root, + config: { + plugins: { + enabled: true, + allow: ["bedrock"], + entries: { bedrock: { enabled: true } }, + }, + }, + }); + + expect(result.missing.map((dep) => `${dep.name}@${dep.version}`)).toEqual([ + "bedrock-only@1.0.0", ]); expect(result.conflicts).toEqual([]); }); @@ -352,6 +393,78 @@ describe("doctor bundled plugin runtime deps", () => { expect(result.conflicts).toEqual([]); }); + it("does not repair inactive default-enabled provider deps", async () => { + const root = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-doctor-bundled-")); + writeJson(path.join(root, "package.json"), { name: "openclaw" }); + writeJson(path.join(root, "dist", "extensions", "bedrock", "package.json"), { + dependencies: { + "bedrock-only": "1.0.0", + }, + }); + writeJson(path.join(root, "dist", "extensions", "bedrock", "openclaw.plugin.json"), { + id: "bedrock", + enabledByDefault: true, + providers: ["bedrock"], + configSchema: { type: "object" }, + }); + const installed = createInstalledRuntimeDeps(); + + await maybeRepairBundledPluginRuntimeDeps({ + runtime: { error: () => {} } as never, + prompter: createNonInteractivePrompter(), + packageRoot: root, + config: { + plugins: { enabled: true }, + }, + installDeps: (params) => { + installed.push(params); + }, + }); + + expect(installed).toEqual([]); + }); + + it("repairs explicitly enabled provider deps", async () => { + const root = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-doctor-bundled-")); + writeJson(path.join(root, "package.json"), { name: "openclaw" }); + writeJson(path.join(root, "dist", "extensions", "bedrock", "package.json"), { + dependencies: { + "bedrock-only": "1.0.0", + }, + }); + writeJson(path.join(root, "dist", "extensions", "bedrock", "openclaw.plugin.json"), { + id: "bedrock", + enabledByDefault: true, + providers: ["bedrock"], + configSchema: { type: "object" }, + }); + const installed = createInstalledRuntimeDeps(); + + await maybeRepairBundledPluginRuntimeDeps({ + runtime: { error: () => {} } as never, + prompter: createNonInteractivePrompter(), + packageRoot: root, + config: { + plugins: { + enabled: true, + allow: ["bedrock"], + entries: { bedrock: { enabled: true } }, + }, + }, + installDeps: (params) => { + installed.push(params); + }, + }); + + expect(installed).toEqual([ + { + installRoot: resolveBundledRuntimeDependencyPackageInstallRoot(root), + missingSpecs: ["bedrock-only@1.0.0"], + installSpecs: ["bedrock-only@1.0.0"], + }, + ]); + }); + it("repairs missing deps during non-interactive doctor", async () => { const root = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-doctor-bundled-")); writeJson(path.join(root, "package.json"), { name: "openclaw" }); @@ -383,6 +496,35 @@ describe("doctor bundled plugin runtime deps", () => { expect(readRetainedRuntimeDepsManifest(installRoot)).toEqual(["grammy@1.37.0"]); }); + it("repairs deps for configured channel owner plugins", async () => { + const root = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-doctor-bundled-")); + writeJson(path.join(root, "package.json"), { name: "openclaw" }); + writeBundledChannelOwnerPlugin(root, "chat-bridge", ["telegram"], { grammy: "1.37.0" }); + const installed = createInstalledRuntimeDeps(); + + await maybeRepairBundledPluginRuntimeDeps({ + runtime: { error: () => {} } as never, + prompter: createNonInteractivePrompter(), + packageRoot: root, + config: { + plugins: { enabled: true }, + channels: { telegram: { enabled: true } }, + }, + installDeps: (params) => { + installed.push(params); + }, + }); + + const installRoot = resolveBundledRuntimeDependencyPackageInstallRoot(root); + expect(installed).toEqual([ + { + installRoot, + missingSpecs: ["grammy@1.37.0"], + installSpecs: ["grammy@1.37.0"], + }, + ]); + }); + it("throws when bundled runtime dependency repair fails", async () => { const root = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-doctor-bundled-")); const errors: string[] = []; diff --git a/src/commands/doctor-bundled-plugin-runtime-deps.ts b/src/commands/doctor-bundled-plugin-runtime-deps.ts index e572eb17c8c..4918f22011c 100644 --- a/src/commands/doctor-bundled-plugin-runtime-deps.ts +++ b/src/commands/doctor-bundled-plugin-runtime-deps.ts @@ -1,3 +1,4 @@ +import path from "node:path"; import { formatCliCommand } from "../cli/command-format.js"; import type { OpenClawConfig } from "../config/types.openclaw.js"; import { resolveOpenClawPackageRootSync } from "../infra/openclaw-root.js"; @@ -7,6 +8,7 @@ import { scanBundledPluginRuntimeDeps, type BundledRuntimeDepsInstallParams, } from "../plugins/bundled-runtime-deps.js"; +import { resolveEffectivePluginIds } from "../plugins/effective-plugin-ids.js"; import type { RuntimeEnv } from "../runtime.js"; import { note } from "../terminal/note.js"; import type { DoctorPrompter } from "./doctor-prompter.js"; @@ -31,11 +33,23 @@ export async function maybeRepairBundledPluginRuntimeDeps(params: { return; } + const env = params.env ?? process.env; + const bundledPluginsDir = path.join(packageRoot, "dist", "extensions"); + const effectivePluginIds = params.config + ? resolveEffectivePluginIds({ + config: params.config, + env: { + ...env, + OPENCLAW_BUNDLED_PLUGINS_DIR: bundledPluginsDir, + }, + }) + : undefined; const { deps, missing, conflicts } = scanBundledPluginRuntimeDeps({ packageRoot, config: params.config, + pluginIds: effectivePluginIds, includeConfiguredChannels: params.includeConfiguredChannels, - env: params.env ?? process.env, + env, }); if (conflicts.length > 0) { const conflictLines = conflicts.flatMap((conflict) => diff --git a/src/plugins/bundled-runtime-deps.ts b/src/plugins/bundled-runtime-deps.ts index 2e6c69adcd0..4e248ef3602 100644 --- a/src/plugins/bundled-runtime-deps.ts +++ b/src/plugins/bundled-runtime-deps.ts @@ -930,9 +930,9 @@ function isBundledPluginConfiguredForRuntimeDeps(params: { if (entry?.enabled === false) { return false; } + const manifest = readBundledPluginRuntimeDepsManifest(params.pluginDir, params.manifestCache); let hasExplicitChannelDisable = false; let hasConfiguredChannel = false; - const manifest = readBundledPluginRuntimeDepsManifest(params.pluginDir, params.manifestCache); for (const channelId of manifest.channels) { const normalizedChannelId = normalizeOptionalLowercaseString(channelId); if (!normalizedChannelId) { @@ -990,12 +990,26 @@ function shouldIncludeBundledPluginRuntimeDeps(params: { includeConfiguredChannels?: boolean; manifestCache?: BundledPluginRuntimeDepsManifestCache; }): boolean { - if (params.pluginIds && !params.pluginIds.has(params.pluginId)) { - return false; + const scopedToPluginIds = Boolean(params.pluginIds); + if (params.pluginIds) { + if (!params.pluginIds.has(params.pluginId)) { + return false; + } + if (!params.config) { + return true; + } } if (!params.config) { return true; } + if (scopedToPluginIds) { + const plugins = normalizePluginsConfig(params.config.plugins); + if (!plugins.enabled || plugins.deny.includes(params.pluginId)) { + return false; + } + const entry = plugins.entries[params.pluginId]; + return entry?.enabled !== false; + } return isBundledPluginConfiguredForRuntimeDeps({ config: params.config, pluginId: params.pluginId, diff --git a/src/plugins/effective-plugin-ids.ts b/src/plugins/effective-plugin-ids.ts new file mode 100644 index 00000000000..f151134cfe9 --- /dev/null +++ b/src/plugins/effective-plugin-ids.ts @@ -0,0 +1,171 @@ +import fs from "node:fs"; +import path from "node:path"; +import { listPotentialConfiguredChannelIds } from "../channels/config-presence.js"; +import { applyPluginAutoEnable } from "../config/plugin-auto-enable.js"; +import type { OpenClawConfig } from "../config/types.openclaw.js"; +import { normalizeOptionalLowercaseString } from "../shared/string-coerce.js"; +import { resolveBundledPluginsDir } from "./bundled-dir.js"; +import { + listExplicitConfiguredChannelIdsForConfig, + resolveConfiguredChannelPluginIds, + resolveGatewayStartupPluginIds, +} from "./channel-plugin-ids.js"; +import { normalizePluginsConfig } from "./config-state.js"; +import { loadPluginManifest } from "./manifest.js"; + +function listExplicitlyDisabledChannelIds(config: OpenClawConfig): Set { + const channels = config.channels; + if (!channels || typeof channels !== "object" || Array.isArray(channels)) { + return new Set(); + } + return new Set( + Object.entries(channels) + .filter(([, value]) => { + return ( + value && + typeof value === "object" && + !Array.isArray(value) && + (value as { enabled?: unknown }).enabled === false + ); + }) + .map(([channelId]) => normalizeOptionalLowercaseString(channelId)) + .filter((channelId): channelId is string => Boolean(channelId)), + ); +} + +function collectConfiguredChannelIds( + config: OpenClawConfig, + activationSourceConfig: OpenClawConfig, + env: NodeJS.ProcessEnv, +): string[] { + const disabled = new Set([ + ...listExplicitlyDisabledChannelIds(config), + ...listExplicitlyDisabledChannelIds(activationSourceConfig), + ]); + const ids = new Set([ + ...listPotentialConfiguredChannelIds(config, env, { includePersistedAuthState: false }), + ...listExplicitConfiguredChannelIdsForConfig(activationSourceConfig), + ]); + return [...ids] + .map((channelId) => normalizeOptionalLowercaseString(channelId)) + .filter((channelId): channelId is string => { + if (!channelId) { + return false; + } + return !disabled.has(channelId); + }) + .toSorted((left, right) => left.localeCompare(right)); +} + +function collectBundledChannelOwnerPluginIds(params: { + channelIds: readonly string[]; + env: NodeJS.ProcessEnv; +}): string[] { + const channelIds = new Set( + params.channelIds + .map((channelId) => normalizeOptionalLowercaseString(channelId)) + .filter((channelId): channelId is string => Boolean(channelId)), + ); + if (channelIds.size === 0) { + return []; + } + const bundledDir = resolveBundledPluginsDir(params.env); + if (!bundledDir) { + return []; + } + let entries: fs.Dirent[]; + try { + entries = fs.readdirSync(bundledDir, { withFileTypes: true }); + } catch { + return []; + } + const pluginIds = new Set(); + for (const entry of entries) { + if (!entry.isDirectory()) { + continue; + } + const pluginDir = path.join(bundledDir, entry.name); + const manifest = loadPluginManifest(pluginDir, false); + if (!manifest.ok) { + continue; + } + if ( + (manifest.manifest.channels ?? []).some((channelId) => + channelIds.has(normalizeOptionalLowercaseString(channelId) ?? ""), + ) + ) { + const pluginId = normalizeOptionalLowercaseString(manifest.manifest.id); + if (pluginId) { + pluginIds.add(pluginId); + } + } + } + return [...pluginIds].toSorted((left, right) => left.localeCompare(right)); +} + +function collectExplicitEffectivePluginIds(config: OpenClawConfig): string[] { + const plugins = normalizePluginsConfig(config.plugins); + if (!plugins.enabled) { + return []; + } + + const ids = new Set(plugins.allow); + for (const [pluginId, entry] of Object.entries(plugins.entries)) { + if ( + entry?.enabled === true && + (plugins.allow.length === 0 || plugins.allow.includes(pluginId)) + ) { + ids.add(pluginId); + } + } + for (const pluginId of plugins.deny) { + ids.delete(pluginId); + } + for (const [pluginId, entry] of Object.entries(plugins.entries)) { + if (entry?.enabled === false) { + ids.delete(pluginId); + } + } + return [...ids].toSorted((left, right) => left.localeCompare(right)); +} + +export function resolveEffectivePluginIds(params: { + config: OpenClawConfig; + env: NodeJS.ProcessEnv; + workspaceDir?: string; +}): string[] { + const autoEnabled = applyPluginAutoEnable({ + config: params.config, + env: params.env, + }); + const effectiveConfig = autoEnabled.config; + const ids = new Set(collectExplicitEffectivePluginIds(effectiveConfig)); + const configuredChannelIds = collectConfiguredChannelIds( + effectiveConfig, + params.config, + params.env, + ); + for (const pluginId of resolveConfiguredChannelPluginIds({ + config: effectiveConfig, + activationSourceConfig: params.config, + workspaceDir: params.workspaceDir, + env: params.env, + })) { + ids.add(pluginId); + } + for (const pluginId of collectBundledChannelOwnerPluginIds({ + channelIds: configuredChannelIds, + env: params.env, + })) { + ids.add(pluginId); + } + for (const pluginId of resolveGatewayStartupPluginIds({ + config: effectiveConfig, + activationSourceConfig: params.config, + workspaceDir: params.workspaceDir, + env: params.env, + })) { + ids.add(pluginId); + } + return [...ids].toSorted((left, right) => left.localeCompare(right)); +} diff --git a/src/plugins/status.ts b/src/plugins/status.ts index 423ef68c1f7..848622b90f7 100644 --- a/src/plugins/status.ts +++ b/src/plugins/status.ts @@ -12,6 +12,7 @@ import { } from "./bundled-compat.js"; import type { PluginCompatCode } from "./compat/registry.js"; import { normalizePluginsConfig } from "./config-state.js"; +import { resolveEffectivePluginIds } from "./effective-plugin-ids.js"; import { buildPluginShapeSummary, type PluginCapabilityEntry, @@ -149,6 +150,7 @@ function resolveReportedPluginVersion( type PluginReportParams = { config?: OpenClawConfig; + effectiveOnly?: boolean; workspaceDir?: string; /** Use an explicit env when plugin roots should resolve independently from process.env. */ env?: NodeJS.ProcessEnv; @@ -273,6 +275,14 @@ function buildPluginReport( config: effectiveConfig, pluginIds: bundledProviderIds, }); + const onlyPluginIds = + params?.effectiveOnly === true + ? resolveEffectivePluginIds({ + config: rawConfig, + workspaceDir, + env: params?.env ?? process.env, + }) + : undefined; const registry = loadModules ? loadOpenClawPlugins( @@ -284,6 +294,7 @@ function buildPluginReport( loadModules, activate: false, cache: false, + onlyPluginIds, }), ) : loadPluginMetadataRegistrySnapshot({ @@ -293,6 +304,7 @@ function buildPluginReport( env: params?.env, logger: params?.logger, loadModules: false, + onlyPluginIds, }); const importedPluginIds = new Set([ ...(loadModules From 6a5ecb955c1c5973606cc8045a39bbd35b151803 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 18:19:05 -0700 Subject: [PATCH 150/418] refactor(plugins): drop provider discovery alias --- src/plugins/provider-discovery.test.ts | 5 +++++ src/plugins/provider-discovery.ts | 12 ------------ 2 files changed, 5 insertions(+), 12 deletions(-) diff --git a/src/plugins/provider-discovery.test.ts b/src/plugins/provider-discovery.test.ts index 65e4bddbf22..23aaf1f9201 100644 --- a/src/plugins/provider-discovery.test.ts +++ b/src/plugins/provider-discovery.test.ts @@ -10,6 +10,7 @@ import { runProviderCatalog, runProviderStaticCatalog, } from "./provider-discovery.js"; +import * as providerDiscoveryModule from "./provider-discovery.js"; import { cleanupTrackedTempDirs, makeTrackedTempDir } from "./test-helpers/fs-fixtures.js"; import type { ProviderCatalogResult, ProviderDiscoveryOrder, ProviderPlugin } from "./types.js"; @@ -179,6 +180,10 @@ describe("resolveInstalledPluginProviderContributionIds", () => { } }); + it("does not keep exporting the ambiguous runtime-discovery alias", () => { + expect(Object.keys(providerDiscoveryModule)).not.toContain("resolvePluginDiscoveryProviders"); + }); + it("reads provider ids from the installed plugin index without importing runtime entries", () => { const candidate = createProviderContributionCandidate({ pluginId: "demo", diff --git a/src/plugins/provider-discovery.ts b/src/plugins/provider-discovery.ts index 5168ed924cc..48f00710264 100644 --- a/src/plugins/provider-discovery.ts +++ b/src/plugins/provider-discovery.ts @@ -79,18 +79,6 @@ export async function resolveRuntimePluginDiscoveryProviders( .filter((provider) => resolveProviderCatalogOrderHook(provider)); } -/** - * @deprecated Runtime-backed provider discovery must be explicit at call sites. - * Use `resolveRuntimePluginDiscoveryProviders(...)` for paths that intentionally - * import provider plugin runtime, or `resolveInstalledPluginProviderContributionIds(...)` - * for cold installed-index reads. - */ -export async function resolvePluginDiscoveryProviders( - params: ResolveRuntimePluginDiscoveryProvidersParams, -): Promise { - return resolveRuntimePluginDiscoveryProviders(params); -} - export function groupPluginDiscoveryProvidersByOrder( providers: ProviderPlugin[], ): Record { From 90de4bd85566b45f804366199853ad345b163d24 Mon Sep 17 00:00:00 2001 From: pashpashpash Date: Sun, 26 Apr 2026 18:27:38 -0700 Subject: [PATCH 151/418] fix: address successor transcript review follow-ups Fixes the post-merge review follow-ups from #72471 by deduping stale pre-compaction state entries and preserving parent-before-child ordering for successor transcripts. --- .../compaction-successor-transcript.test.ts | 100 ++++++++++++++++++ .../compaction-successor-transcript.ts | 93 ++++++++++++++-- 2 files changed, 184 insertions(+), 9 deletions(-) diff --git a/src/agents/pi-embedded-runner/compaction-successor-transcript.test.ts b/src/agents/pi-embedded-runner/compaction-successor-transcript.test.ts index d7fb656a642..3329e3f10c8 100644 --- a/src/agents/pi-embedded-runner/compaction-successor-transcript.test.ts +++ b/src/agents/pi-embedded-runner/compaction-successor-transcript.test.ts @@ -102,6 +102,57 @@ describe("rotateTranscriptAfterCompaction", () => { expect(successor.getLabel(oldUserId)).toBeUndefined(); }); + it("deduplicates stale pre-compaction session state", async () => { + const dir = await createTmpDir(); + const manager = SessionManager.create(dir, dir); + + const staleModelId = manager.appendModelChange("anthropic", "claude-sonnet-4-5"); + const staleThinkingId = manager.appendThinkingLevelChange("low"); + const staleSessionInfoId = manager.appendSessionInfo("stale title"); + manager.appendCustomEntry("test-extension", { cursor: "preserved" }); + manager.appendMessage({ role: "user", content: "old user", timestamp: 1 }); + manager.appendMessage(makeAssistant("old assistant", 2)); + + manager.appendModelChange("openai", "gpt-5.2"); + manager.appendThinkingLevelChange("high"); + manager.appendSessionInfo("current title"); + const firstKeptId = manager.appendMessage({ role: "user", content: "kept user", timestamp: 3 }); + manager.appendMessage(makeAssistant("kept assistant", 4)); + manager.appendCompaction("Summary of old user and old assistant.", firstKeptId, 5000); + manager.appendMessage({ role: "user", content: "post user", timestamp: 5 }); + + const result = await rotateTranscriptAfterCompaction({ + sessionManager: manager, + sessionFile: manager.getSessionFile()!, + now: () => new Date("2026-04-27T12:05:00.000Z"), + }); + + expect(result.rotated).toBe(true); + const successor = SessionManager.open(result.sessionFile!); + const entries = successor.getEntries(); + expect(entries.find((entry) => entry.id === staleModelId)).toBeUndefined(); + expect(entries.find((entry) => entry.id === staleThinkingId)).toBeUndefined(); + expect(entries.find((entry) => entry.id === staleSessionInfoId)).toBeUndefined(); + expect(entries.filter((entry) => entry.type === "model_change")).toHaveLength(1); + expect(entries.filter((entry) => entry.type === "thinking_level_change")).toHaveLength(1); + expect(entries.filter((entry) => entry.type === "session_info")).toHaveLength(1); + expect(entries.find((entry) => entry.type === "model_change")).toMatchObject({ + provider: "openai", + modelId: "gpt-5.2", + }); + expect(entries).toContainEqual( + expect.objectContaining({ + type: "custom", + customType: "test-extension", + data: { cursor: "preserved" }, + }), + ); + + const context = successor.buildSessionContext(); + expect(context.thinkingLevel).toBe("high"); + expect(successor.getSessionName()).toBe("current title"); + }); + it("skips sessions with no compaction entry", async () => { const dir = await createTmpDir(); const manager = SessionManager.create(dir, dir); @@ -212,6 +263,55 @@ describe("rotateTranscriptAfterCompaction", () => { expect(activeContextText).toContain("next"); expect(activeContextText).not.toContain("do task B instead"); }); + + it("orders preserved sibling branches after their surviving parents", async () => { + const dir = await createTmpDir(); + const manager = SessionManager.create(dir, dir); + + manager.appendMessage({ role: "user", content: "hello", timestamp: 1 }); + const branchFromId = manager.appendMessage(makeAssistant("hi there", 2)); + + const branchSummaryId = manager.branchWithSummary( + branchFromId, + "Summary of the inactive branch.", + ); + const inactiveMsgId = manager.appendMessage({ + role: "user", + content: "inactive branch", + timestamp: 3, + }); + manager.appendMessage(makeAssistant("inactive done", 4)); + + manager.branch(branchFromId); + manager.appendMessage({ role: "user", content: "active branch", timestamp: 5 }); + manager.appendMessage(makeAssistant("active done", 6)); + manager.appendCompaction("Summary of active work.", branchFromId, 5000); + const activeLeafId = manager.appendMessage({ + role: "user", + content: "next active", + timestamp: 7, + }); + + const result = await rotateTranscriptAfterCompaction({ + sessionManager: manager, + sessionFile: manager.getSessionFile()!, + now: () => new Date("2026-04-27T13:00:00.000Z"), + }); + + expect(result.rotated).toBe(true); + const successor = SessionManager.open(result.sessionFile!); + const entries = successor.getEntries(); + const indexById = new Map(entries.map((entry, index) => [entry.id, index])); + expect(indexById.get(branchFromId)).toBeLessThan(indexById.get(branchSummaryId)!); + expect(indexById.get(branchSummaryId)).toBeLessThan(indexById.get(inactiveMsgId)!); + expect(entries.at(-1)?.id).toBe(activeLeafId); + expect(successor.getLeafId()).toBe(activeLeafId); + + const activeContextText = JSON.stringify(successor.buildSessionContext().messages); + expect(activeContextText).toContain("Summary of active work."); + expect(activeContextText).toContain("next active"); + expect(activeContextText).not.toContain("inactive branch"); + }); }); describe("shouldRotateCompactionTranscript", () => { diff --git a/src/agents/pi-embedded-runner/compaction-successor-transcript.ts b/src/agents/pi-embedded-runner/compaction-successor-transcript.ts index 9deee8f14cc..1e6dd00347a 100644 --- a/src/agents/pi-embedded-runner/compaction-successor-transcript.ts +++ b/src/agents/pi-embedded-runner/compaction-successor-transcript.ts @@ -117,9 +117,20 @@ function buildSuccessorEntries(params: { summarizedBranchIds.add(entry.id); } + const latestStateEntryIds = collectLatestStateEntryIds(branch.slice(0, latestCompactionIndex)); + const staleStateEntryIds = new Set(); + for (const entry of branch.slice(0, latestCompactionIndex)) { + if (isDedupedStateEntry(entry) && !latestStateEntryIds.has(entry.id)) { + staleStateEntryIds.add(entry.id); + } + } + const removedIds = new Set(); for (const entry of allEntries) { - if (summarizedBranchIds.has(entry.id) && entry.type === "message") { + if ( + (summarizedBranchIds.has(entry.id) && entry.type === "message") || + staleStateEntryIds.has(entry.id) + ) { removedIds.add(entry.id); } } @@ -131,6 +142,7 @@ function buildSuccessorEntries(params: { const entryById = new Map(allEntries.map((entry) => [entry.id, entry])); const activeBranchIds = new Set(branch.map((entry) => entry.id)); + const originalIndexById = new Map(allEntries.map((entry, index) => [entry.id, index])); const keptEntries: SessionEntry[] = []; for (const entry of allEntries) { if (removedIds.has(entry.id)) { @@ -147,17 +159,80 @@ function buildSuccessorEntries(params: { ); } - const inactiveEntries: SessionEntry[] = []; - const activeEntries: SessionEntry[] = []; - for (const entry of keptEntries) { - if (activeBranchIds.has(entry.id)) { - activeEntries.push(entry); - } else { - inactiveEntries.push(entry); + return orderSuccessorEntries({ + entries: keptEntries, + activeBranchIds, + originalIndexById, + }); +} + +function collectLatestStateEntryIds(entries: SessionEntry[]): Set { + const latestByType = new Map(); + for (const entry of entries) { + if (isDedupedStateEntry(entry)) { + latestByType.set(entry.type, entry); } } + return new Set(Array.from(latestByType.values(), (entry) => entry.id)); +} - return [...inactiveEntries, ...activeEntries]; +function isDedupedStateEntry(entry: SessionEntry): boolean { + return ( + entry.type === "model_change" || + entry.type === "thinking_level_change" || + entry.type === "session_info" + ); +} + +function orderSuccessorEntries(params: { + entries: SessionEntry[]; + activeBranchIds: Set; + originalIndexById: Map; +}): SessionEntry[] { + const { entries, activeBranchIds, originalIndexById } = params; + const entryIds = new Set(entries.map((entry) => entry.id)); + const childrenByParentId = new Map(); + + for (const entry of entries) { + const parentId = + entry.parentId !== null && entryIds.has(entry.parentId) ? entry.parentId : null; + const children = childrenByParentId.get(parentId) ?? []; + children.push(parentId === entry.parentId ? entry : ({ ...entry, parentId } as SessionEntry)); + childrenByParentId.set(parentId, children); + } + + const sortForActiveLeaf = (left: SessionEntry, right: SessionEntry) => { + const leftActive = activeBranchIds.has(left.id); + const rightActive = activeBranchIds.has(right.id); + if (leftActive !== rightActive) { + return leftActive ? 1 : -1; + } + return (originalIndexById.get(left.id) ?? 0) - (originalIndexById.get(right.id) ?? 0); + }; + + const ordered: SessionEntry[] = []; + const emittedIds = new Set(); + const emitSubtree = (entry: SessionEntry) => { + if (emittedIds.has(entry.id)) { + return; + } + emittedIds.add(entry.id); + ordered.push(entry); + for (const child of (childrenByParentId.get(entry.id) ?? []).toSorted(sortForActiveLeaf)) { + emitSubtree(child); + } + }; + + for (const root of (childrenByParentId.get(null) ?? []).toSorted(sortForActiveLeaf)) { + emitSubtree(root); + } + + // Defensive fallback for malformed transcripts with cycles or broken parents. + for (const entry of entries.toSorted(sortForActiveLeaf)) { + emitSubtree(entry); + } + + return ordered; } function buildSuccessorHeader(params: { From 3f59cd0a091a5726abe25b9d21bf242544c4b57a Mon Sep 17 00:00:00 2001 From: Shadow Date: Sun, 26 Apr 2026 20:31:00 -0500 Subject: [PATCH 152/418] Adjust message for stale workflow --- .github/workflows/stale.yml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index b491094811f..237696e2779 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -41,7 +41,7 @@ jobs: days-before-pr-close: 3 stale-issue-label: stale stale-pr-label: stale - exempt-issue-labels: enhancement,maintainer,pinned,security,no-stale + exempt-issue-labels: enhancement,maintainer,pinned,security,no-stale,bad-barnacle exempt-pr-labels: maintainer,no-stale,bad-barnacle operations-per-run: 2000 ascending: true @@ -60,7 +60,7 @@ jobs: close-issue-reason: not_planned close-pr-message: | Closing due to inactivity. - If you believe this PR should be revived, post in #pr-thunderdome-dangerzone on Discord to talk to a maintainer. + If you believe this PR should be revived, post in #clawtributors on Discord to talk to a maintainer. That channel is the escape hatch for high-quality PRs that get auto-closed. - name: Mark stale assigned issues (primary) id: assigned-issue-stale-primary @@ -73,7 +73,7 @@ jobs: days-before-pr-stale: -1 days-before-pr-close: -1 stale-issue-label: stale - exempt-issue-labels: enhancement,maintainer,pinned,security,no-stale + exempt-issue-labels: enhancement,maintainer,pinned,security,no-stale,bad-barnacle operations-per-run: 2000 ascending: true include-only-assigned: true @@ -108,7 +108,7 @@ jobs: Please add updates or it will be closed. close-pr-message: | Closing due to inactivity. - If you believe this PR should be revived, post in #pr-thunderdome-dangerzone on Discord to talk to a maintainer. + If you believe this PR should be revived, post in #clawtributors on Discord to talk to a maintainer. That channel is the escape hatch for high-quality PRs that get auto-closed. - name: Check stale state cache id: stale-state @@ -145,7 +145,7 @@ jobs: days-before-pr-close: 3 stale-issue-label: stale stale-pr-label: stale - exempt-issue-labels: enhancement,maintainer,pinned,security,no-stale + exempt-issue-labels: enhancement,maintainer,pinned,security,no-stale,bad-barnacle exempt-pr-labels: maintainer,no-stale,bad-barnacle operations-per-run: 2000 ascending: true @@ -164,7 +164,7 @@ jobs: close-issue-reason: not_planned close-pr-message: | Closing due to inactivity. - If you believe this PR should be revived, post in #pr-thunderdome-dangerzone on Discord to talk to a maintainer. + If you believe this PR should be revived, post in #clawtributors on Discord to talk to a maintainer. That channel is the escape hatch for high-quality PRs that get auto-closed. - name: Mark stale assigned issues (fallback) if: (steps.assigned-issue-stale-primary.outcome == 'failure' || steps.stale-state.outputs.has_state == 'true') && steps.app-token-fallback.outputs.token != '' @@ -176,7 +176,7 @@ jobs: days-before-pr-stale: -1 days-before-pr-close: -1 stale-issue-label: stale - exempt-issue-labels: enhancement,maintainer,pinned,security,no-stale + exempt-issue-labels: enhancement,maintainer,pinned,security,no-stale,bad-barnacle operations-per-run: 2000 ascending: true include-only-assigned: true @@ -210,7 +210,7 @@ jobs: Please add updates or it will be closed. close-pr-message: | Closing due to inactivity. - If you believe this PR should be revived, post in #pr-thunderdome-dangerzone on Discord to talk to a maintainer. + If you believe this PR should be revived, post in #clawtributors on Discord to talk to a maintainer. That channel is the escape hatch for high-quality PRs that get auto-closed. lock-closed-issues: From 69daef8246f15bd8af6500e73f6f88210fe5d56e Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 02:31:46 +0100 Subject: [PATCH 153/418] fix: honor Ollama Modelfile num_ctx discovery --- CHANGELOG.md | 1 + docs/providers/ollama.md | 4 +- extensions/ollama/src/provider-models.test.ts | 60 +++++++++++++++++++ extensions/ollama/src/provider-models.ts | 25 ++++++++ 4 files changed, 88 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 36e50c9d8cd..033b8f07fda 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -23,6 +23,7 @@ Docs: https://docs.openclaw.ai - Logging: write validated diagnostic trace context as top-level `traceId`, `spanId`, `parentSpanId`, and `traceFlags` fields in file-log JSONL records so traced requests and model calls are easier to correlate in log processors. Refs #40353. Thanks @liangruochong44-ui. - Logging/sessions: apply configured redaction patterns to persisted session transcript text and accept escaped character classes in safe custom redaction regexes, so transcript JSONL no longer keeps matching sensitive text in the clear. Fixes #42982. Thanks @panpan0000. - Providers/Ollama: honor `/api/show` capabilities when registering local models so non-tool Ollama models no longer receive the agent tool surface, and keep native Ollama thinking opt-in instead of enabling it by default. Fixes #64710 and duplicate #65343. Thanks @yuan-b, @netherby, @xilopaint, and @Diyforfun2026. +- Providers/Ollama: read larger custom Modelfile `PARAMETER num_ctx` values from `/api/show` so auto-discovered Ollama models with expanded context no longer stay pinned to the base model context. Fixes #68344. Thanks @neeravmakwana. - Providers/Ollama: expose native Ollama thinking effort levels so `/think max` is accepted for reasoning-capable Ollama models and maps to Ollama's highest supported `think` effort. Fixes #71584. Thanks @g0st1n. - Providers/Ollama: strip the active custom Ollama provider prefix before native chat and embedding requests, so custom provider ids like `ollama-spark/qwen3:32b` reach Ollama as the real model name. Fixes #72353. Thanks @maximus-dss and @hclsys. - Providers/Ollama: parse stringified native tool-call arguments before dispatch, preserving unsafe integer values so Ollama tool use receives structured parameters. Fixes #69735; supersedes #69910. Thanks @rongshuzhao and @yfge. diff --git a/docs/providers/ollama.md b/docs/providers/ollama.md index 27f5aead375..0233c70f6fb 100644 --- a/docs/providers/ollama.md +++ b/docs/providers/ollama.md @@ -155,7 +155,7 @@ When you set `OLLAMA_API_KEY` (or an auth profile) and **do not** define `models | Behavior | Detail | | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Catalog query | Queries `/api/tags` | -| Capability detection | Uses best-effort `/api/show` lookups to read `contextWindow` and detect capabilities (including vision) | +| Capability detection | Uses best-effort `/api/show` lookups to read `contextWindow`, expanded `num_ctx` Modelfile parameters, and capabilities including vision/tools | | Vision models | Models with a `vision` capability reported by `/api/show` are marked as image-capable (`input: ["text", "image"]`), so OpenClaw auto-injects images into the prompt | | Reasoning detection | Marks `reasoning` with a model-name heuristic (`r1`, `reasoning`, `think`) | | Token limits | Sets `maxTokens` to the default Ollama max-token cap used by OpenClaw | @@ -399,7 +399,7 @@ For the full setup and behavior details, see [Ollama Web Search](/tools/ollama-s - For auto-discovered models, OpenClaw uses the context window reported by Ollama when available, otherwise it falls back to the default Ollama context window used by OpenClaw. + For auto-discovered models, OpenClaw uses the context window reported by Ollama when available, including larger `PARAMETER num_ctx` values from custom Modelfiles. Otherwise it falls back to the default Ollama context window used by OpenClaw. You can override `contextWindow` and `maxTokens` in explicit provider config: diff --git a/extensions/ollama/src/provider-models.test.ts b/extensions/ollama/src/provider-models.test.ts index 76f85fbf34f..ea4dbf8933d 100644 --- a/extensions/ollama/src/provider-models.test.ts +++ b/extensions/ollama/src/provider-models.test.ts @@ -3,6 +3,7 @@ import { jsonResponse, requestBodyText, requestUrl } from "../../../src/test-hel import { buildOllamaModelDefinition, enrichOllamaModelsWithContext, + parseOllamaNumCtxParameter, resetOllamaModelShowInfoCacheForTest, resolveOllamaApiBase, type OllamaTagModel, @@ -42,6 +43,58 @@ describe("ollama provider models", () => { ]); }); + it("uses Modelfile num_ctx when it expands the discovered context window", async () => { + const models: OllamaTagModel[] = [{ name: "llama3-32k:latest" }]; + const fetchMock = vi.fn(async () => + jsonResponse({ + model_info: { "llama.context_length": 8192 }, + parameters: 'stop "<|eot_id|>"\nnum_ctx 32768\nnum_keep 5', + capabilities: ["completion"], + }), + ); + vi.stubGlobal("fetch", fetchMock); + + const enriched = await enrichOllamaModelsWithContext("http://127.0.0.1:11434", models); + + expect(enriched).toEqual([ + { + name: "llama3-32k:latest", + contextWindow: 32768, + capabilities: ["completion"], + }, + ]); + }); + + it("keeps the larger native context window when Modelfile num_ctx is smaller", async () => { + const models: OllamaTagModel[] = [{ name: "llama3.2:latest" }]; + const fetchMock = vi.fn(async () => + jsonResponse({ + model_info: { "llama.context_length": 131072 }, + parameters: "num_ctx 4096", + }), + ); + vi.stubGlobal("fetch", fetchMock); + + const enriched = await enrichOllamaModelsWithContext("http://127.0.0.1:11434", models); + + expect(enriched[0]?.contextWindow).toBe(131072); + }); + + it("uses positive num_ctx when /api/show omits model context metadata", async () => { + const models: OllamaTagModel[] = [{ name: "custom-model:latest" }]; + const fetchMock = vi.fn(async () => + jsonResponse({ + model_info: {}, + parameters: "num_ctx 16384", + }), + ); + vi.stubGlobal("fetch", fetchMock); + + const enriched = await enrichOllamaModelsWithContext("http://127.0.0.1:11434", models); + + expect(enriched[0]?.contextWindow).toBe(16384); + }); + it("sets models with vision capability from /api/show capabilities", async () => { const models: OllamaTagModel[] = [{ name: "kimi-k2.5:cloud" }, { name: "glm-5.1:cloud" }]; const fetchMock = vi.fn(async (input: string | URL | Request, init?: RequestInit) => { @@ -225,4 +278,11 @@ describe("ollama provider models", () => { expect(model.reasoning).toBe(false); expect(model.compat?.supportsTools).toBe(false); }); + + it("parses the last positive Modelfile num_ctx value", () => { + expect(parseOllamaNumCtxParameter("num_ctx 8192\nnum_ctx 32768")).toBe(32768); + expect(parseOllamaNumCtxParameter("temperature 0.8\nnum_ctx -1\nnum_ctx 0")).toBeUndefined(); + expect(parseOllamaNumCtxParameter('stop "<|eot_id|>"')).toBeUndefined(); + expect(parseOllamaNumCtxParameter({ num_ctx: 8192 })).toBeUndefined(); + }); }); diff --git a/extensions/ollama/src/provider-models.ts b/extensions/ollama/src/provider-models.ts index f3c891fae94..401c88ab83b 100644 --- a/extensions/ollama/src/provider-models.ts +++ b/extensions/ollama/src/provider-models.ts @@ -95,6 +95,25 @@ function hasCachedOllamaModelShowInfo(info: OllamaModelShowInfo): boolean { return typeof info.contextWindow === "number" || (info.capabilities?.length ?? 0) > 0; } +export function parseOllamaNumCtxParameter(parameters: unknown): number | undefined { + if (typeof parameters !== "string" || !parameters.trim()) { + return undefined; + } + + let lastValue: number | undefined; + for (const rawLine of parameters.split(/\r?\n/)) { + const match = rawLine.trim().match(/^num_ctx\s+(-?\d+)\b/); + if (!match) { + continue; + } + const parsed = Number.parseInt(match[1], 10); + if (Number.isFinite(parsed) && parsed > 0) { + lastValue = parsed; + } + } + return lastValue; +} + export async function queryOllamaModelShowInfo( apiBase: string, modelName: string, @@ -119,6 +138,7 @@ export async function queryOllamaModelShowInfo( const data = (await response.json()) as { model_info?: Record; capabilities?: unknown; + parameters?: unknown; }; let contextWindow: number | undefined; @@ -138,6 +158,11 @@ export async function queryOllamaModelShowInfo( } } + const paramCtx = parseOllamaNumCtxParameter(data.parameters); + if (paramCtx !== undefined && (contextWindow === undefined || paramCtx > contextWindow)) { + contextWindow = paramCtx; + } + const capabilities = Array.isArray(data.capabilities) ? (data.capabilities as unknown[]).filter((c): c is string => typeof c === "string") : undefined; From d8c1140235142bb32714f0c2deabb241321f7f23 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 02:35:56 +0100 Subject: [PATCH 154/418] ci: fix full release validation gh repo context --- .github/workflows/full-release-validation.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/full-release-validation.yml b/.github/workflows/full-release-validation.yml index fe2f90c8dee..4a514a12d51 100644 --- a/.github/workflows/full-release-validation.yml +++ b/.github/workflows/full-release-validation.yml @@ -60,6 +60,7 @@ concurrency: env: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" + GH_REPO: ${{ github.repository }} jobs: resolve_target: From 5176dba8a03ca85034f99a6c1a4eb67ca1f55e55 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 02:43:14 +0100 Subject: [PATCH 155/418] test(docker): stub update fixture lint preflight --- scripts/e2e/update-channel-switch-docker.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/scripts/e2e/update-channel-switch-docker.sh b/scripts/e2e/update-channel-switch-docker.sh index b68a4847e38..ef18adee0cb 100755 --- a/scripts/e2e/update-channel-switch-docker.sh +++ b/scripts/e2e/update-channel-switch-docker.sh @@ -51,6 +51,7 @@ packageJson.pnpm = { ...packageJson.pnpm, allowUnusedPatches: true }; packageJson.scripts = { ...packageJson.scripts, build: "node -e \"console.log(\\\"fixture build skipped\\\")\"", + lint: "node -e \"console.log(\\\"fixture lint skipped\\\")\"", "ui:build": "node -e \"console.log(\\\"fixture ui build skipped\\\")\"", }; fs.writeFileSync(packageJsonPath, `${JSON.stringify(packageJson, null, 2)}\n`); From 3e020a16507c804733ed68c3b6e14db243877df7 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 18:43:31 -0700 Subject: [PATCH 156/418] fix(memory-lancedb): force float embedding encoding (#72391) --- CHANGELOG.md | 1 + extensions/memory-lancedb/index.test.ts | 5 +++++ extensions/memory-lancedb/index.ts | 3 ++- 3 files changed, 8 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 033b8f07fda..905b967f9d7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -53,6 +53,7 @@ Docs: https://docs.openclaw.ai - Discord/gateway: count failed health-monitor restart attempts toward cooldown and hourly caps, and evict stale account lifecycle state during channel reloads so repeated Discord gateway recovery cannot loop on old status. Fixes #38596. (#40413) Thanks @jellyAI-dev and @vashquez. - Cron/context engine: run isolated cron jobs under run-scoped context-engine session keys so prior runs of the same job are not inherited unless the job is explicitly session-bound. (#72292) Thanks @jalehman. - Control UI: localize command palette labels, categories, skill shortcuts, footer hints, and connect-command copy labels while preserving localized command palette search matching. (#61130, #61119) Thanks @rubensfox20. +- Plugins/memory-lancedb: request float embedding responses from OpenAI-compatible servers so local providers that default SDK requests to base64 no longer return dimension-mismatched LanceDB vectors while preserving configured dimensions. Fixes #45982. (#59048, #46069, #45986) Thanks @deep-introspection, @xiaokhkh, @caicongyang, and @thiswind. ## 2026.4.26 diff --git a/extensions/memory-lancedb/index.test.ts b/extensions/memory-lancedb/index.test.ts index 4b26b1b4325..25846e53da4 100644 --- a/extensions/memory-lancedb/index.test.ts +++ b/extensions/memory-lancedb/index.test.ts @@ -386,6 +386,7 @@ describe("memory plugin e2e", () => { expect(embeddingsCreate).toHaveBeenCalledWith({ model: "text-embedding-3-small", input: "what editor should i use?", + encoding_format: "float", }); expect(vectorSearch).toHaveBeenCalledWith([0.1, 0.2, 0.3]); expect(limit).toHaveBeenCalledWith(3); @@ -535,6 +536,7 @@ describe("memory plugin e2e", () => { expect(embeddingsCreate).toHaveBeenCalledWith({ model: "text-embedding-3-small", input: "what editor should i use?", + encoding_format: "float", }); expect(result).toMatchObject({ prependContext: expect.stringContaining("I prefer Helix for editing code."), @@ -871,6 +873,7 @@ describe("memory plugin e2e", () => { expect(embeddingsCreate).toHaveBeenCalledWith({ model: "text-embedding-3-small", input: "I prefer Helix for editing code every day.", + encoding_format: "float", }); expect(vectorSearch).toHaveBeenCalledTimes(1); expect(add).toHaveBeenCalledTimes(1); @@ -1012,6 +1015,7 @@ describe("memory plugin e2e", () => { expect(embeddingsCreate).toHaveBeenCalledWith({ model: "text-embedding-3-small", input: "I prefer Helix for editing code every day.", + encoding_format: "float", }); expect(add).toHaveBeenCalledWith([ expect.objectContaining({ @@ -1349,6 +1353,7 @@ describe("memory plugin e2e", () => { expect(embeddingsCreate).toHaveBeenCalledWith({ model: "text-embedding-3-small", input: "hello dimensions", + encoding_format: "float", dimensions: 1024, }); } finally { diff --git a/extensions/memory-lancedb/index.ts b/extensions/memory-lancedb/index.ts index 0b6caeafa69..197e86929c6 100644 --- a/extensions/memory-lancedb/index.ts +++ b/extensions/memory-lancedb/index.ts @@ -177,9 +177,10 @@ class Embeddings { } async embed(text: string): Promise { - const params: { model: string; input: string; dimensions?: number } = { + const params: OpenAI.EmbeddingCreateParams = { model: this.model, input: text, + encoding_format: "float", }; if (this.dimensions) { params.dimensions = this.dimensions; From 988cb1ebfe9224606e30deb426732e525a7e6942 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 18:44:51 -0700 Subject: [PATCH 157/418] fix(test): stabilize restart sentinel mocks --- src/gateway/server-restart-sentinel.test.ts | 41 ++++++++++----------- 1 file changed, 19 insertions(+), 22 deletions(-) diff --git a/src/gateway/server-restart-sentinel.test.ts b/src/gateway/server-restart-sentinel.test.ts index 8fc9ea98f76..cb3288f62c3 100644 --- a/src/gateway/server-restart-sentinel.test.ts +++ b/src/gateway/server-restart-sentinel.test.ts @@ -1,6 +1,5 @@ import { afterEach, beforeEach, describe, expect, it, vi } from "vitest"; import type { ChannelPlugin } from "../channels/plugins/types.plugin.js"; -import { mergeMockedModule } from "../test-utils/vitest-module-mocks.js"; type LoadedSessionEntry = ReturnType; type RecordInboundSessionAndDispatchReplyParams = Parameters< @@ -158,21 +157,20 @@ vi.mock("../utils/delivery-context.shared.js", () => ({ })); vi.mock("../channels/plugins/index.js", async () => { - return await mergeMockedModule( - await vi.importActual( - "../channels/plugins/index.js", - ), - (actual) => ({ - getChannelPlugin: mocks.getChannelPlugin, - normalizeChannelId: mocks.normalizeChannelId.mockImplementation( - (channel?: string | null) => - actual.normalizeChannelId(channel) ?? - (typeof channel === "string" && channel.trim().length > 0 - ? channel.trim().toLowerCase() - : null), - ), - }), + const actual = await vi.importActual( + "../channels/plugins/index.js", ); + return { + ...actual, + getChannelPlugin: mocks.getChannelPlugin, + normalizeChannelId: mocks.normalizeChannelId.mockImplementation( + (channel?: string | null) => + actual.normalizeChannelId(channel) ?? + (typeof channel === "string" && channel.trim().length > 0 + ? channel.trim().toLowerCase() + : null), + ), + }; }); vi.mock("../infra/outbound/targets.js", () => ({ @@ -198,14 +196,13 @@ vi.mock("../plugin-sdk/inbound-reply-dispatch.js", () => ({ })); vi.mock("../infra/heartbeat-wake.js", async () => { - return await mergeMockedModule( - await vi.importActual( - "../infra/heartbeat-wake.js", - ), - () => ({ - requestHeartbeatNow: mocks.requestHeartbeatNow, - }), + const actual = await vi.importActual( + "../infra/heartbeat-wake.js", ); + return { + ...actual, + requestHeartbeatNow: mocks.requestHeartbeatNow, + }; }); vi.mock("../logging/subsystem.js", () => ({ From 9b79eef75091a8444af822229de00727ba9bcf67 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 02:47:31 +0100 Subject: [PATCH 158/418] fix(memory-core): honor configured index concurrency --- CHANGELOG.md | 1 + .../src/memory/manager-embedding-ops.ts | 14 +++++++- .../memory/manager-embedding-timeout.test.ts | 32 ++++++++++++++++++- 3 files changed, 45 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 905b967f9d7..8061c2a2467 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -54,6 +54,7 @@ Docs: https://docs.openclaw.ai - Cron/context engine: run isolated cron jobs under run-scoped context-engine session keys so prior runs of the same job are not inherited unless the job is explicitly session-bound. (#72292) Thanks @jalehman. - Control UI: localize command palette labels, categories, skill shortcuts, footer hints, and connect-command copy labels while preserving localized command palette search matching. (#61130, #61119) Thanks @rubensfox20. - Plugins/memory-lancedb: request float embedding responses from OpenAI-compatible servers so local providers that default SDK requests to base64 no longer return dimension-mismatched LanceDB vectors while preserving configured dimensions. Fixes #45982. (#59048, #46069, #45986) Thanks @deep-introspection, @xiaokhkh, @caicongyang, and @thiswind. +- Plugins/memory-core: respect configured memory-search embedding concurrency during non-batch indexing so local Ollama embedding backends can serialize indexing instead of flooding the server. Fixes #66822. (#66931) Thanks @oliviareid-svg and @LyraInTheFlesh. ## 2026.4.26 diff --git a/extensions/memory-core/src/memory/manager-embedding-ops.ts b/extensions/memory-core/src/memory/manager-embedding-ops.ts index f49621dca8b..3382dab930f 100644 --- a/extensions/memory-core/src/memory/manager-embedding-ops.ts +++ b/extensions/memory-core/src/memory/manager-embedding-ops.ts @@ -87,6 +87,15 @@ export function resolveEmbeddingTimeoutMs(params: { : EMBEDDING_BATCH_TIMEOUT_REMOTE_MS; } +export function resolveMemoryIndexConcurrency(params: { + batch: { enabled: boolean; concurrency: number }; + configuredConcurrency?: number; +}): number { + return params.configuredConcurrency != null || params.batch.enabled + ? params.batch.concurrency + : EMBEDDING_INDEX_CONCURRENCY; +} + export abstract class MemoryManagerEmbeddingOps extends MemoryManagerSyncOps { protected abstract batchFailureCount: number; protected abstract batchFailureLastError?: string; @@ -498,7 +507,10 @@ export abstract class MemoryManagerEmbeddingOps extends MemoryManagerSyncOps { } protected getIndexConcurrency(): number { - return this.batch.enabled ? this.batch.concurrency : EMBEDDING_INDEX_CONCURRENCY; + return resolveMemoryIndexConcurrency({ + batch: this.batch, + configuredConcurrency: this.settings.remote?.batch?.concurrency, + }); } private clearIndexedFileData(pathname: string, source: MemorySource): void { diff --git a/extensions/memory-core/src/memory/manager-embedding-timeout.test.ts b/extensions/memory-core/src/memory/manager-embedding-timeout.test.ts index ebdd72160d8..bf67130f0c1 100644 --- a/extensions/memory-core/src/memory/manager-embedding-timeout.test.ts +++ b/extensions/memory-core/src/memory/manager-embedding-timeout.test.ts @@ -1,5 +1,8 @@ import { describe, expect, it } from "vitest"; -import { resolveEmbeddingTimeoutMs } from "./manager-embedding-ops.js"; +import { + resolveEmbeddingTimeoutMs, + resolveMemoryIndexConcurrency, +} from "./manager-embedding-ops.js"; describe("memory embedding timeout resolution", () => { it("uses hosted defaults for inline embedding calls", () => { @@ -33,3 +36,30 @@ describe("memory embedding timeout resolution", () => { ).toBe(45_000); }); }); + +describe("memory index concurrency resolution", () => { + it("uses the default index concurrency when batch mode is disabled and unconfigured", () => { + expect( + resolveMemoryIndexConcurrency({ + batch: { enabled: false, concurrency: 2 }, + }), + ).toBe(4); + }); + + it("respects configured concurrency even when batch mode is disabled", () => { + expect( + resolveMemoryIndexConcurrency({ + batch: { enabled: false, concurrency: 1 }, + configuredConcurrency: 1, + }), + ).toBe(1); + }); + + it("uses resolved batch concurrency when batch mode is enabled", () => { + expect( + resolveMemoryIndexConcurrency({ + batch: { enabled: true, concurrency: 3 }, + }), + ).toBe(3); + }); +}); From 20b71e18b23039a8d89b5c6027ee7647a516385d Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 02:50:48 +0100 Subject: [PATCH 159/418] test(docker): seed update fixture control ui asset --- scripts/e2e/update-channel-switch-docker.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/scripts/e2e/update-channel-switch-docker.sh b/scripts/e2e/update-channel-switch-docker.sh index ef18adee0cb..bfcc53734a5 100755 --- a/scripts/e2e/update-channel-switch-docker.sh +++ b/scripts/e2e/update-channel-switch-docker.sh @@ -55,6 +55,8 @@ packageJson.scripts = { "ui:build": "node -e \"console.log(\\\"fixture ui build skipped\\\")\"", }; fs.writeFileSync(packageJsonPath, `${JSON.stringify(packageJson, null, 2)}\n`); +fs.mkdirSync("/tmp/openclaw-git/dist/control-ui", { recursive: true }); +fs.writeFileSync("/tmp/openclaw-git/dist/control-ui/index.html", "fixture\n"); NODE ( cd "$git_root" From b96a75c95b54694c8a7e2e8f1204d1bb69a4691f Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 18:54:49 -0700 Subject: [PATCH 160/418] fix(gateway): scope memory runtime plugin loading --- src/plugins/memory-runtime.test.ts | 58 ++++++++++++++++++++++++++++++ src/plugins/memory-runtime.ts | 15 +++++++- 2 files changed, 72 insertions(+), 1 deletion(-) diff --git a/src/plugins/memory-runtime.test.ts b/src/plugins/memory-runtime.test.ts index 754be95e60c..f02b6a19cd1 100644 --- a/src/plugins/memory-runtime.test.ts +++ b/src/plugins/memory-runtime.test.ts @@ -60,6 +60,7 @@ function expectMemoryRuntimeLoaded(rawConfig: unknown, autoEnabledConfig: unknow expect.objectContaining({ config: autoEnabledConfig, activationSourceConfig: rawConfig, + onlyPluginIds: ["memory-core"], }), ); } @@ -159,6 +160,63 @@ describe("memory runtime auto-enable loading", () => { await expectAutoEnabledMemoryRuntimeCase({ run, expectedResult }); }); + it("loads only the configured memory slot plugin", async () => { + const rawConfig = { + plugins: { + slots: { + memory: "memory-lancedb", + }, + }, + }; + const runtime = createMemoryRuntimeFixture(); + applyPluginAutoEnableMock.mockReturnValue({ + config: rawConfig, + changes: [], + autoEnabledReasons: {}, + }); + getMemoryRuntimeMock.mockReturnValueOnce(undefined).mockReturnValue(runtime); + + await getActiveMemorySearchManager({ + cfg: rawConfig as never, + agentId: "main", + }); + + expect(resolveRuntimePluginRegistryMock).toHaveBeenCalledWith( + expect.objectContaining({ + onlyPluginIds: ["memory-lancedb"], + }), + ); + }); + + it("does not fall back to broad plugin loading when the memory slot is disabled", async () => { + const rawConfig = { + plugins: { + slots: { + memory: "none", + }, + }, + }; + applyPluginAutoEnableMock.mockReturnValue({ + config: rawConfig, + changes: [], + autoEnabledReasons: {}, + }); + getMemoryRuntimeMock.mockReturnValue(undefined); + + await expect( + getActiveMemorySearchManager({ + cfg: rawConfig as never, + agentId: "main", + }), + ).resolves.toEqual({ manager: null, error: "memory plugin unavailable" }); + + expect(applyPluginAutoEnableMock).toHaveBeenCalledWith({ + config: rawConfig, + env: process.env, + }); + expect(resolveRuntimePluginRegistryMock).not.toHaveBeenCalled(); + }); + it.each([ { name: "does not bootstrap the memory runtime just to close managers", diff --git a/src/plugins/memory-runtime.ts b/src/plugins/memory-runtime.ts index f8fd9566a92..cc5a6fabf8c 100644 --- a/src/plugins/memory-runtime.ts +++ b/src/plugins/memory-runtime.ts @@ -1,4 +1,5 @@ import type { OpenClawConfig } from "../config/types.openclaw.js"; +import { normalizePluginsConfig } from "./config-state.js"; import { resolveRuntimePluginRegistry } from "./loader.js"; import { getMemoryRuntime } from "./memory-state.js"; import { @@ -6,13 +7,25 @@ import { resolvePluginRuntimeLoadContext, } from "./runtime/load-context.js"; +function resolveMemoryRuntimePluginIds(config: OpenClawConfig): string[] { + const memorySlot = normalizePluginsConfig(config.plugins).slots.memory; + return typeof memorySlot === "string" && memorySlot.trim().length > 0 ? [memorySlot] : []; +} + function ensureMemoryRuntime(cfg?: OpenClawConfig) { const current = getMemoryRuntime(); if (current || !cfg) { return current; } + const context = resolvePluginRuntimeLoadContext({ config: cfg }); + const onlyPluginIds = resolveMemoryRuntimePluginIds(context.config); + if (onlyPluginIds.length === 0) { + return getMemoryRuntime(); + } resolveRuntimePluginRegistry( - buildPluginRuntimeLoadOptions(resolvePluginRuntimeLoadContext({ config: cfg })), + buildPluginRuntimeLoadOptions(context, { + onlyPluginIds, + }), ); return getMemoryRuntime(); } From c45a7d7a7aec62acfe6f11ca2f1bf42b90b951a2 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 02:56:09 +0100 Subject: [PATCH 161/418] ci: use available macOS release runner --- scripts/openclaw-cross-os-release-checks.ts | 2 +- test/scripts/openclaw-cross-os-release-checks.test.ts | 7 +++++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/scripts/openclaw-cross-os-release-checks.ts b/scripts/openclaw-cross-os-release-checks.ts index aa392fd6ed9..ab98fc71bbe 100644 --- a/scripts/openclaw-cross-os-release-checks.ts +++ b/scripts/openclaw-cross-os-release-checks.ts @@ -160,7 +160,7 @@ export function resolveRunnerMatrix(params) { { os_id: "macos", display_name: "macOS", - runner: pick(params.macosRunner, params.varMacosRunner, "macos-latest-xlarge"), + runner: pick(params.macosRunner, params.varMacosRunner, "blacksmith-6vcpu-macos-latest"), artifact_name: "macos", }, ]; diff --git a/test/scripts/openclaw-cross-os-release-checks.test.ts b/test/scripts/openclaw-cross-os-release-checks.test.ts index 9477eb7caa8..49c28eba24f 100644 --- a/test/scripts/openclaw-cross-os-release-checks.test.ts +++ b/test/scripts/openclaw-cross-os-release-checks.test.ts @@ -162,6 +162,13 @@ describe("scripts/openclaw-cross-os-release-checks", () => { lane: "fresh", }), ); + expect(matrix.include).toContainEqual( + expect.objectContaining({ + os_id: "macos", + runner: "blacksmith-6vcpu-macos-latest", + suite: "packaged-fresh", + }), + ); }); it("can rebuild the Windows PATH with or without current-process entries", () => { From 8c2bc951a9438b48e82bd270a61819139197e68d Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 18:58:04 -0700 Subject: [PATCH 162/418] fix(plugins): hydrate bundled channel config metadata Hydrate bundled channel schema metadata through opt-in registry schema paths while keeping ordinary manifest registry loads lightweight. --- src/config/doc-baseline.runtime.ts | 2 + src/config/doc-baseline.ts | 1 + src/config/runtime-schema.ts | 2 + src/plugins/manifest-registry-installed.ts | 5 + src/plugins/manifest-registry.test.ts | 103 +++++++++++++++++++ src/plugins/manifest-registry.ts | 26 ++++- src/plugins/plugin-registry-contributions.ts | 5 + 7 files changed, 142 insertions(+), 2 deletions(-) diff --git a/src/config/doc-baseline.runtime.ts b/src/config/doc-baseline.runtime.ts index 62474bef75e..6180b6a1b9b 100644 --- a/src/config/doc-baseline.runtime.ts +++ b/src/config/doc-baseline.runtime.ts @@ -1,3 +1,4 @@ +import { collectBundledChannelConfigs as collectBundledChannelConfigsImpl } from "../plugins/bundled-channel-config-metadata.js"; import { loadPluginManifestRegistry as loadPluginManifestRegistryImpl } from "../plugins/manifest-registry.js"; import { collectChannelSchemaMetadata as collectChannelSchemaMetadataImpl, @@ -6,6 +7,7 @@ import { import { buildConfigSchema as buildConfigSchemaImpl } from "./schema.js"; export const loadPluginManifestRegistry = loadPluginManifestRegistryImpl; +export const collectBundledChannelConfigs = collectBundledChannelConfigsImpl; export const collectChannelSchemaMetadata = collectChannelSchemaMetadataImpl; export const collectPluginSchemaMetadata = collectPluginSchemaMetadataImpl; export const buildConfigSchema = buildConfigSchemaImpl; diff --git a/src/config/doc-baseline.ts b/src/config/doc-baseline.ts index 06d30e7e21c..1c18edc4d0b 100644 --- a/src/config/doc-baseline.ts +++ b/src/config/doc-baseline.ts @@ -368,6 +368,7 @@ async function loadBundledConfigSchemaResponse(): Promise cache: false, env, config: {}, + bundledChannelConfigCollector: runtime.collectBundledChannelConfigs, }); logConfigDocBaselineDebug(`loaded ${manifestRegistry.plugins.length} bundled plugin manifests`); const bundledRegistry = { diff --git a/src/config/runtime-schema.ts b/src/config/runtime-schema.ts index b32313fe2b7..ccf15809c15 100644 --- a/src/config/runtime-schema.ts +++ b/src/config/runtime-schema.ts @@ -1,4 +1,5 @@ import { resolveAgentWorkspaceDir, resolveDefaultAgentId } from "../agents/agent-scope.js"; +import { collectBundledChannelConfigs } from "../plugins/bundled-channel-config-metadata.js"; import { loadPluginManifestRegistryForPluginRegistry } from "../plugins/plugin-registry.js"; import { collectChannelSchemaMetadata, @@ -16,6 +17,7 @@ function loadManifestRegistry(config: OpenClawConfig, env?: NodeJS.ProcessEnv) { env, workspaceDir, includeDisabled: true, + bundledChannelConfigCollector: collectBundledChannelConfigs, }); } diff --git a/src/plugins/manifest-registry-installed.ts b/src/plugins/manifest-registry-installed.ts index 747cf048727..976f91768fd 100644 --- a/src/plugins/manifest-registry-installed.ts +++ b/src/plugins/manifest-registry-installed.ts @@ -5,6 +5,7 @@ import type { PluginCandidate } from "./discovery.js"; import type { InstalledPluginIndex, InstalledPluginIndexRecord } from "./installed-plugin-index.js"; import { extractPluginInstallRecordsFromInstalledPluginIndex } from "./installed-plugin-index.js"; import { loadPluginManifestRegistry, type PluginManifestRegistry } from "./manifest-registry.js"; +import type { BundledChannelConfigCollector } from "./manifest-registry.js"; import { DEFAULT_PLUGIN_ENTRY_CANDIDATES, getPackageManifestMetadata, @@ -88,6 +89,7 @@ export function loadPluginManifestRegistryForInstalledIndex(params: { env?: NodeJS.ProcessEnv; pluginIds?: readonly string[]; includeDisabled?: boolean; + bundledChannelConfigCollector?: BundledChannelConfigCollector; }): PluginManifestRegistry { if (params.pluginIds && params.pluginIds.length === 0) { return { plugins: [], diagnostics: [] }; @@ -111,5 +113,8 @@ export function loadPluginManifestRegistryForInstalledIndex(params: { candidates, diagnostics: [...diagnostics], installRecords: extractPluginInstallRecordsFromInstalledPluginIndex(params.index), + ...(params.bundledChannelConfigCollector + ? { bundledChannelConfigCollector: params.bundledChannelConfigCollector } + : {}), }); } diff --git a/src/plugins/manifest-registry.test.ts b/src/plugins/manifest-registry.test.ts index 058f44cc647..a2279c8dca3 100644 --- a/src/plugins/manifest-registry.test.ts +++ b/src/plugins/manifest-registry.test.ts @@ -1,6 +1,8 @@ import fs from "node:fs"; import path from "node:path"; import { afterEach, describe, expect, it, vi } from "vitest"; +import { collectChannelSchemaMetadata } from "../config/channel-config-metadata.js"; +import { collectBundledChannelConfigs } from "./bundled-channel-config-metadata.js"; import type { PluginCandidate } from "./discovery.js"; import { clearPluginManifestRegistryCache, @@ -630,6 +632,107 @@ describe("loadPluginManifestRegistry", () => { }); }); + it("hydrates bundled channel config metadata from plugin-local config surfaces", () => { + const dir = makeTempDir(); + writeManifest(dir, { + id: "alpha", + channels: ["alpha"], + configSchema: { type: "object" }, + channelConfigs: { + alpha: { + schema: { + type: "object", + properties: { + manifestOnly: { type: "boolean" }, + }, + }, + uiHints: { + manifestOnly: { help: "manifest hint" }, + }, + }, + }, + }); + writeTextFile(dir, "index.ts", "export {};\n"); + writeTextFile( + dir, + "src/config-schema.js", + [ + "export const AlphaChannelConfigSchema = {", + " schema: {", + " type: 'object',", + " properties: {", + " generatedOnly: { type: 'string' },", + " },", + " additionalProperties: false,", + " },", + " uiHints: {", + " generatedOnly: { label: 'Generated only' },", + " },", + "};", + ].join("\n"), + ); + + const candidate = createPluginCandidate({ + idHint: "alpha", + rootDir: dir, + origin: "bundled", + packageDir: dir, + packageManifest: { + channel: { + id: "alpha", + label: "Alpha", + blurb: "Alpha channel", + }, + }, + }); + expect(loadRegistry([candidate]).plugins[0]?.channelConfigs?.alpha?.schema).toEqual({ + type: "object", + properties: { + manifestOnly: { type: "boolean" }, + }, + }); + + const registry = loadPluginManifestRegistry({ + cache: false, + bundledChannelConfigCollector: collectBundledChannelConfigs, + candidates: [candidate], + }); + + expect(registry.plugins[0]?.channelConfigs?.alpha).toEqual({ + schema: { + type: "object", + properties: { + generatedOnly: { type: "string" }, + }, + additionalProperties: false, + }, + label: "Alpha", + description: "Alpha channel", + uiHints: { + generatedOnly: { label: "Generated only" }, + manifestOnly: { help: "manifest hint" }, + }, + }); + expect(collectChannelSchemaMetadata(registry)).toEqual([ + { + id: "alpha", + label: "Alpha", + description: "Alpha channel", + configSchema: { + type: "object", + properties: { + generatedOnly: { type: "string" }, + }, + additionalProperties: false, + }, + configUiHints: { + generatedOnly: { label: "Generated only" }, + manifestOnly: { help: "manifest hint" }, + }, + }, + ]); + }); + it("reports non-bundled providerAuthEnvVars as deprecated compat metadata", () => { const dir = makeTempDir(); writeManifest(dir, { diff --git a/src/plugins/manifest-registry.ts b/src/plugins/manifest-registry.ts index 5e20d3039f1..51ecf2d88d7 100644 --- a/src/plugins/manifest-registry.ts +++ b/src/plugins/manifest-registry.ts @@ -158,6 +158,12 @@ export type PluginManifestRegistry = { diagnostics: PluginDiagnostic[]; }; +export type BundledChannelConfigCollector = (params: { + pluginDir: string; + manifest: PluginManifest; + packageManifest?: OpenClawPackageManifest; +}) => Record | undefined; + const registryCache = pluginManifestRegistryCache as Map< string, { expiresAt: number; registry: PluginManifestRegistry } @@ -293,9 +299,18 @@ function buildRecord(params: { manifestPath: string; schemaCacheKey?: string; configSchema?: Record; + bundledChannelConfigCollector?: BundledChannelConfigCollector; }): PluginManifestRecord { + const manifestChannelConfigs = + params.candidate.origin === "bundled" && params.bundledChannelConfigCollector + ? params.bundledChannelConfigCollector({ + pluginDir: params.candidate.packageDir ?? params.candidate.rootDir, + manifest: params.manifest, + packageManifest: params.candidate.packageManifest, + }) + : params.manifest.channelConfigs; const channelConfigs = mergePackageChannelMetaIntoChannelConfigs({ - channelConfigs: params.manifest.channelConfigs, + channelConfigs: manifestChannelConfigs, packageChannel: params.candidate.packageManifest?.channel, }); const packageChannelCommands = normalizePackageChannelCommands( @@ -542,6 +557,7 @@ export function loadPluginManifestRegistry( candidates?: PluginCandidate[]; diagnostics?: PluginDiagnostic[]; installRecords?: Record; + bundledChannelConfigCollector?: BundledChannelConfigCollector; } = {}, ): PluginManifestRegistry { const config = params.config ?? {}; @@ -549,7 +565,10 @@ export function loadPluginManifestRegistry( const env = params.env ?? process.env; const cacheKey = buildCacheKey({ workspaceDir: params.workspaceDir, plugins: normalized, env }); const cacheEnabled = - params.cache !== false && !params.installRecords && shouldUseManifestCache(env); + params.cache !== false && + !params.installRecords && + !params.bundledChannelConfigCollector && + shouldUseManifestCache(env); if (cacheEnabled) { const cached = registryCache.get(cacheKey); if (cached && cached.expiresAt > Date.now()) { @@ -659,6 +678,9 @@ export function loadPluginManifestRegistry( manifestPath: manifestRes.manifestPath, schemaCacheKey, configSchema, + ...(params.bundledChannelConfigCollector + ? { bundledChannelConfigCollector: params.bundledChannelConfigCollector } + : {}), }); const existing = seenIds.get(manifest.id); diff --git a/src/plugins/plugin-registry-contributions.ts b/src/plugins/plugin-registry-contributions.ts index af2938f168b..0460d505944 100644 --- a/src/plugins/plugin-registry-contributions.ts +++ b/src/plugins/plugin-registry-contributions.ts @@ -7,6 +7,7 @@ import { import { isInstalledPluginEnabled } from "./installed-plugin-index.js"; import { loadPluginManifestRegistryForInstalledIndex } from "./manifest-registry-installed.js"; import type { + BundledChannelConfigCollector, PluginManifestContractListKey, PluginManifestRecord, PluginManifestRegistry, @@ -25,6 +26,7 @@ export type PluginRegistryContributionOptions = LoadPluginRegistryParams & { export type LoadPluginRegistryManifestParams = LoadPluginRegistryParams & { includeDisabled?: boolean; pluginIds?: readonly string[]; + bundledChannelConfigCollector?: BundledChannelConfigCollector; }; export type PluginRegistryContributionKey = @@ -201,6 +203,9 @@ export function loadPluginManifestRegistryForPluginRegistry( env: params.env, pluginIds: params.pluginIds, includeDisabled: params.includeDisabled, + ...(params.bundledChannelConfigCollector + ? { bundledChannelConfigCollector: params.bundledChannelConfigCollector } + : {}), }); } From 22c9e82e835f4ef2cb3807f7fe6e148f4535a5ec Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 02:58:23 +0100 Subject: [PATCH 163/418] test(docker): track update fixture control ui asset --- scripts/e2e/update-channel-switch-docker.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/scripts/e2e/update-channel-switch-docker.sh b/scripts/e2e/update-channel-switch-docker.sh index bfcc53734a5..2ae11d6fe28 100755 --- a/scripts/e2e/update-channel-switch-docker.sh +++ b/scripts/e2e/update-channel-switch-docker.sh @@ -69,6 +69,7 @@ git config --global gc.auto 0 git -C "$git_root" init -q git -C "$git_root" config gc.auto 0 git -C "$git_root" add -A +git -C "$git_root" add -f dist/control-ui/index.html git -C "$git_root" commit -qm "test fixture" fixture_sha="$(git -C "$git_root" rev-parse HEAD)" From fc3abc139bedbdfb8fba2bc634e95aa3e2bef4f4 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 03:01:47 +0100 Subject: [PATCH 164/418] fix(cron): classify denied isolated runs --- CHANGELOG.md | 1 + docs/automation/cron-jobs.md | 1 + docs/cli/cron.md | 5 ++ src/cron/isolated-agent.helpers.test.ts | 71 ++++++++++++++++++++++- src/cron/isolated-agent/helpers.ts | 76 +++++++++++++++++++++++-- 5 files changed, 149 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8061c2a2467..dadbc04ba72 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,7 @@ Docs: https://docs.openclaw.ai ### Fixes +- Cron: classify isolated runs as errors when final output narrates known execution-denial markers such as `SYSTEM_RUN_DENIED`, `INVALID_REQUEST`, or approval-binding refusal phrases, so blocked commands no longer appear green in cron history. Fixes #67172; carries forward #67186. Thanks @oc-gh-dr, @hclsys, and @1yihui. - macOS Gateway: write launchd services with a state-dir `WorkingDirectory`, use a durable state-dir temp path instead of freezing macOS session `TMPDIR`, create that temp directory before bootstrap, and label abort-shaped launchd exits as `SIGABRT/abort` in status output. Fixes #53679 and #70223; refs #71848. Thanks @dlturock, @stammi922, and @palladius. - Exec approvals: accept runtime-owned `source: "allow-always"` and `commandText` allowlist metadata in gateway and node approval-set payloads so Control UI round-trips no longer fail with `unexpected property 'source'`. Fixes #60000; carries forward #60064. Thanks @sd1471123, @sharkqwy, and @luoyanglang. - Exec/node: skip approval-plan preparation for full-trust `host=node` runs so interpreter and script commands no longer fail with `SYSTEM_RUN_DENIED: approval cannot safely bind` when effective policy is `security=full` and `ask=off`. Fixes #48457 and duplicate #69251. Thanks @ajtran303, @jaserNo1, @Blakeshannon, @lesliefag, and @AvIsBeastMC. diff --git a/docs/automation/cron-jobs.md b/docs/automation/cron-jobs.md index c8f072aa42c..fcc57d630ad 100644 --- a/docs/automation/cron-jobs.md +++ b/docs/automation/cron-jobs.md @@ -47,6 +47,7 @@ Cron is the Gateway's built-in scheduler. It persists jobs, wakes the agent at t - One-shot jobs (`--at`) auto-delete after success by default. - Isolated cron runs best-effort close tracked browser tabs/processes for their `cron:` session when the run completes, so detached browser automation does not leave orphaned processes behind. - Isolated cron runs also guard against stale acknowledgement replies. If the first result is just an interim status update (`on it`, `pulling everything together`, and similar hints) and no descendant subagent run is still responsible for the final answer, OpenClaw re-prompts once for the actual result before delivery. +- Isolated cron runs classify known execution-denial markers in the final summary/output as failures, including host markers such as `SYSTEM_RUN_DENIED` and `INVALID_REQUEST`, so a blocked command is not reported as a green run. diff --git a/docs/cli/cron.md b/docs/cli/cron.md index c34939f0a4f..1398d95cb37 100644 --- a/docs/cli/cron.md +++ b/docs/cli/cron.md @@ -57,6 +57,11 @@ Note: if an isolated cron run returns only the silent token (`NO_REPLY` / `no_reply`), cron suppresses direct outbound delivery and the fallback queued summary path as well, so nothing is posted back to chat. +Note: isolated cron runs treat known denial markers in final output, such as +`SYSTEM_RUN_DENIED`, `INVALID_REQUEST`, and approval-binding refusal phrases, as +errors. `cron list` and run history then surface the matched token in the error +reason instead of reporting a blocked command as `ok`. + Note: `cron add|edit --model ...` uses that selected allowed model for the job. If the model is not allowed, cron warns and falls back to the job's agent/default model selection instead. Configured fallback chains still apply, but a plain diff --git a/src/cron/isolated-agent.helpers.test.ts b/src/cron/isolated-agent.helpers.test.ts index 74b140bc105..4f8e1fe217c 100644 --- a/src/cron/isolated-agent.helpers.test.ts +++ b/src/cron/isolated-agent.helpers.test.ts @@ -1,5 +1,31 @@ import { describe, expect, it } from "vitest"; -import { resolveCronPayloadOutcome } from "./isolated-agent/helpers.js"; +import { detectCronDenialToken, resolveCronPayloadOutcome } from "./isolated-agent/helpers.js"; + +describe("detectCronDenialToken", () => { + it("matches host denial markers case-sensitively", () => { + expect(detectCronDenialToken("SYSTEM_RUN_DENIED: approval blocked")).toBe("SYSTEM_RUN_DENIED"); + expect(detectCronDenialToken("INVALID_REQUEST: denied")).toBe("INVALID_REQUEST"); + expect(detectCronDenialToken("system_run_denied: approval blocked")).toBeUndefined(); + expect(detectCronDenialToken("invalid_request: denied")).toBeUndefined(); + }); + + it("matches model-narrated denial phrases case-insensitively", () => { + expect(detectCronDenialToken("Approval Cannot Safely Bind this runtime command")).toBe( + "approval cannot safely bind", + ); + expect(detectCronDenialToken("The runtime denied the operation.")).toBe("runtime denied"); + expect(detectCronDenialToken("I could not run the script.")).toBe("could not run"); + expect(detectCronDenialToken("The command did not run to completion.")).toBe("did not run"); + expect(detectCronDenialToken("The request was denied by policy.")).toBe("was denied"); + }); + + it("ignores empty and non-token text", () => { + expect(detectCronDenialToken(undefined)).toBeUndefined(); + expect( + detectCronDenialToken("The denied claim was reviewed, then the job succeeded."), + ).toBeUndefined(); + }); +}); describe("resolveCronPayloadOutcome", () => { it("uses the last non-empty non-error payload as summary and output", () => { @@ -134,4 +160,47 @@ describe("resolveCronPayloadOutcome", () => { { text: "Final weather summary" }, ]); }); + + it("promotes narrated denial markers in summary text to fatal errors", () => { + const result = resolveCronPayloadOutcome({ + payloads: [ + { + text: "SYSTEM_RUN_DENIED: approval cannot safely bind this interpreter/runtime command", + }, + ], + }); + + expect(result.hasFatalErrorPayload).toBe(true); + expect(result.embeddedRunError).toBe( + 'cron classifier: denial token "SYSTEM_RUN_DENIED" detected in summary', + ); + }); + + it("promotes narrated denial markers from final assistant visible text", () => { + const result = resolveCronPayloadOutcome({ + payloads: [{ text: "Working on it..." }], + finalAssistantVisibleText: "I could not run the requested script.", + preferFinalAssistantVisibleText: true, + }); + + expect(result.hasFatalErrorPayload).toBe(true); + expect(result.outputText).toBe("I could not run the requested script."); + expect(result.embeddedRunError).toBe( + 'cron classifier: denial token "could not run" detected in summary', + ); + }); + + it("keeps structured error payload reasons ahead of denial-token reasons", () => { + const result = resolveCronPayloadOutcome({ + payloads: [ + { + text: "Exec failed before SYSTEM_RUN_DENIED could be retried", + isError: true, + }, + ], + }); + + expect(result.hasFatalErrorPayload).toBe(true); + expect(result.embeddedRunError).toBe("Exec failed before SYSTEM_RUN_DENIED could be retried"); + }); }); diff --git a/src/cron/isolated-agent/helpers.ts b/src/cron/isolated-agent/helpers.ts index 1a822215db2..08d8a8b30b5 100644 --- a/src/cron/isolated-agent/helpers.ts +++ b/src/cron/isolated-agent/helpers.ts @@ -21,6 +21,60 @@ export type CronPayloadOutcome = { embeddedRunError?: string; }; +type CronDenialSignal = { + token: string; + field: string; +}; + +const CRON_DENIAL_EXACT_TOKENS = ["SYSTEM_RUN_DENIED", "INVALID_REQUEST"] as const; +const CRON_DENIAL_CASE_INSENSITIVE_TOKENS = [ + "approval cannot safely bind", + "runtime denied", + "could not run", + "did not run", + "was denied", +] as const; + +export function detectCronDenialToken(text: string | undefined): string | undefined { + const normalized = normalizeOptionalString(text); + if (!normalized) { + return undefined; + } + for (const token of CRON_DENIAL_EXACT_TOKENS) { + if (normalized.includes(token)) { + return token; + } + } + const lowerText = normalized.toLowerCase(); + for (const token of CRON_DENIAL_CASE_INSENSITIVE_TOKENS) { + if (lowerText.includes(token)) { + return token; + } + } + return undefined; +} + +function resolveCronDenialSignal( + fields: Array<{ field: string; text?: string | undefined }>, +): CronDenialSignal | undefined { + const seen = new Set(); + for (const { field, text } of fields) { + if (seen.has(field)) { + continue; + } + seen.add(field); + const token = detectCronDenialToken(text); + if (token) { + return { token, field }; + } + } + return undefined; +} + +function formatCronDenialSignal(signal: CronDenialSignal): string { + return `cron classifier: denial token "${signal.token}" detected in ${signal.field}`; +} + export function pickSummaryFromOutput(text: string | undefined) { const clean = (text ?? "").trim(); if (!clean) { @@ -157,7 +211,7 @@ export function resolveCronPayloadOutcome(params: { params.payloads .slice(lastErrorPayloadIndex + 1) .some((payload) => payload?.isError !== true && Boolean(payload?.text?.trim())); - const hasFatalErrorPayload = hasErrorPayload && !hasSuccessfulPayloadAfterLastError; + const hasFatalStructuredErrorPayload = hasErrorPayload && !hasSuccessfulPayloadAfterLastError; const normalizedFinalAssistantVisibleText = normalizeOptionalString( params.finalAssistantVisibleText, ); @@ -169,7 +223,7 @@ export function resolveCronPayloadOutcome(params: { const shouldUseFinalAssistantVisibleText = params.preferFinalAssistantVisibleText === true && normalizedFinalAssistantVisibleText !== undefined && - !hasFatalErrorPayload && + !hasFatalStructuredErrorPayload && !hasStructuredDeliveryPayloads; const summary = shouldUseFinalAssistantVisibleText ? (pickSummaryFromOutput(normalizedFinalAssistantVisibleText) ?? fallbackSummary) @@ -189,6 +243,18 @@ export function resolveCronPayloadOutcome(params: { .toReversed() .find((payload) => payload?.isError === true && Boolean(payload?.text?.trim())) ?.text?.trim(); + const denialSignal = resolveCronDenialSignal([ + { field: "summary", text: summary }, + { field: "outputText", text: outputText }, + { field: "synthesizedText", text: synthesizedText }, + { field: "fallbackSummary", text: fallbackSummary }, + { field: "fallbackOutputText", text: fallbackOutputText }, + ...params.payloads.map((payload, index) => ({ + field: `payloads[${index}].text`, + text: payload?.text, + })), + ]); + const hasFatalErrorPayload = hasFatalStructuredErrorPayload || denialSignal !== undefined; return { summary, outputText, @@ -197,8 +263,10 @@ export function resolveCronPayloadOutcome(params: { deliveryPayloads: resolvedDeliveryPayloads, deliveryPayloadHasStructuredContent, hasFatalErrorPayload, - embeddedRunError: hasFatalErrorPayload + embeddedRunError: hasFatalStructuredErrorPayload ? (lastErrorPayloadText ?? "cron isolated run returned an error payload") - : undefined, + : denialSignal + ? formatCronDenialSignal(denialSignal) + : undefined, }; } From 2dba9e6a765a1bdee80d0c8e3a26e77a71d513a8 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 03:02:12 +0100 Subject: [PATCH 165/418] fix(ollama): honor configured num_ctx params --- CHANGELOG.md | 1 + docs/.generated/config-baseline.sha256 | 4 +- docs/providers/ollama.md | 7 +- extensions/ollama/ollama.live.test.ts | 3 + extensions/ollama/src/stream-runtime.test.ts | 68 +++++++++- extensions/ollama/src/stream.ts | 19 ++- src/agents/pi-embedded-runner/model.test.ts | 74 +++++++++++ src/agents/pi-embedded-runner/model.ts | 126 ++++++++++++++++++- src/config/schema.base.generated.ts | 11 +- src/config/schema.help.ts | 2 +- src/config/types.models.ts | 2 + src/config/zod-schema.core.ts | 1 + src/plugins/provider-runtime-model.types.ts | 1 + 13 files changed, 305 insertions(+), 14 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index dadbc04ba72..0313dea5da4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -25,6 +25,7 @@ Docs: https://docs.openclaw.ai - Logging/sessions: apply configured redaction patterns to persisted session transcript text and accept escaped character classes in safe custom redaction regexes, so transcript JSONL no longer keeps matching sensitive text in the clear. Fixes #42982. Thanks @panpan0000. - Providers/Ollama: honor `/api/show` capabilities when registering local models so non-tool Ollama models no longer receive the agent tool surface, and keep native Ollama thinking opt-in instead of enabling it by default. Fixes #64710 and duplicate #65343. Thanks @yuan-b, @netherby, @xilopaint, and @Diyforfun2026. - Providers/Ollama: read larger custom Modelfile `PARAMETER num_ctx` values from `/api/show` so auto-discovered Ollama models with expanded context no longer stay pinned to the base model context. Fixes #68344. Thanks @neeravmakwana. +- Providers/Ollama: honor configured model `params.num_ctx` in native and OpenAI-compatible Ollama requests so local models can cap runtime context without rebuilding Modelfiles. Fixes #44550 and #52206; supersedes #69464. Thanks @taitruong, @armi0024, and @LokiCode404. - Providers/Ollama: expose native Ollama thinking effort levels so `/think max` is accepted for reasoning-capable Ollama models and maps to Ollama's highest supported `think` effort. Fixes #71584. Thanks @g0st1n. - Providers/Ollama: strip the active custom Ollama provider prefix before native chat and embedding requests, so custom provider ids like `ollama-spark/qwen3:32b` reach Ollama as the real model name. Fixes #72353. Thanks @maximus-dss and @hclsys. - Providers/Ollama: parse stringified native tool-call arguments before dispatch, preserving unsafe integer values so Ollama tool use receives structured parameters. Fixes #69735; supersedes #69910. Thanks @rongshuzhao and @yfge. diff --git a/docs/.generated/config-baseline.sha256 b/docs/.generated/config-baseline.sha256 index 9c40ce9f7a8..3a86622216c 100644 --- a/docs/.generated/config-baseline.sha256 +++ b/docs/.generated/config-baseline.sha256 @@ -1,4 +1,4 @@ -79fa6b9b9df5e22ac56a7edb9bfc25550131e285ce9f4868f468d957a8768240 config-baseline.json -2722504ab6bd37eea9e7542689bd6dba5fb4e485c0eab9c1915427c49a5c5b66 config-baseline.core.json +502a73267bd7195caf3fc4fb513e51a01bfd1c9567f8c22037ee10a11169a0bf config-baseline.json +2edac1da06bbb3709375bf82ae68890c67634f5ad3200a98a1d008b22c335e79 config-baseline.core.json 7cd9c908f066c143eab2a201efbc9640f483ab28bba92ddeca1d18cc2b528bc3 config-baseline.channel.json 74b74cb18ac37c0acaa765f398f1f9edbcee4c43567f02d45c89598a1e13afb4 config-baseline.plugin.json diff --git a/docs/providers/ollama.md b/docs/providers/ollama.md index 0233c70f6fb..692b25e20fd 100644 --- a/docs/providers/ollama.md +++ b/docs/providers/ollama.md @@ -401,7 +401,7 @@ For the full setup and behavior details, see [Ollama Web Search](/tools/ollama-s For auto-discovered models, OpenClaw uses the context window reported by Ollama when available, including larger `PARAMETER num_ctx` values from custom Modelfiles. Otherwise it falls back to the default Ollama context window used by OpenClaw. - You can override `contextWindow` and `maxTokens` in explicit provider config: + You can override `contextWindow` and `maxTokens` in explicit provider config. To cap Ollama's per-request runtime context without rebuilding a Modelfile, set `params.num_ctx`; OpenClaw sends it as `options.num_ctx` for both native Ollama and the OpenAI-compatible Ollama adapter. Invalid, zero, negative, and non-finite values are ignored and fall back to `contextWindow`. ```json5 { @@ -413,6 +413,9 @@ For the full setup and behavior details, see [Ollama Web Search](/tools/ollama-s id: "llama3.3", contextWindow: 131072, maxTokens: 65536, + params: { + num_ctx: 32768, + }, } ] } @@ -421,6 +424,8 @@ For the full setup and behavior details, see [Ollama Web Search](/tools/ollama-s } ``` + Per-model `agents.defaults.models["ollama/"].params.num_ctx` works too. If both are configured, the explicit provider model entry wins over the agent default. + diff --git a/extensions/ollama/ollama.live.test.ts b/extensions/ollama/ollama.live.test.ts index c4d4666dd1c..88304ddadcf 100644 --- a/extensions/ollama/ollama.live.test.ts +++ b/extensions/ollama/ollama.live.test.ts @@ -26,6 +26,7 @@ describe.skipIf(!LIVE)("ollama live", () => { let payload: | { model?: string; + options?: { num_ctx?: number }; tools?: Array<{ function?: { parameters?: { @@ -42,6 +43,7 @@ describe.skipIf(!LIVE)("ollama live", () => { api: "ollama", provider: PROVIDER_ID, contextWindow: 8192, + params: { num_ctx: 4096 }, } as never, { messages: [{ role: "user", content: "Reply exactly OK." }], @@ -79,6 +81,7 @@ describe.skipIf(!LIVE)("ollama live", () => { expect(error).toBeUndefined(); expect(events.some((event) => (event as { type?: string }).type === "done")).toBe(true); expect(payload?.model).toBe(CHAT_MODEL); + expect(payload?.options?.num_ctx).toBe(4096); const properties = payload?.tools?.[0]?.function?.parameters?.properties; expect(properties?.city?.type).toBe("string"); expect(properties?.units?.type).toBe("string"); diff --git a/extensions/ollama/src/stream-runtime.test.ts b/extensions/ollama/src/stream-runtime.test.ts index dcd664b1f2d..4d7e8958f4c 100644 --- a/extensions/ollama/src/stream-runtime.test.ts +++ b/extensions/ollama/src/stream-runtime.test.ts @@ -94,6 +94,7 @@ describe("createConfiguredOllamaCompatStreamWrapper", () => { provider: "ollama", id: "kimi-k2.5:cloud", contextWindow: 262144, + params: { num_ctx: 65536 }, }; const wrapped = createConfiguredOllamaCompatStreamWrapper({ @@ -117,7 +118,43 @@ describe("createConfiguredOllamaCompatStreamWrapper", () => { expect(patchedPayload).toMatchObject({ thinking: { type: "enabled" }, - options: { num_ctx: 262144 }, + options: { num_ctx: 65536 }, + }); + }); + + it("falls back to contextWindow when configured num_ctx is invalid", async () => { + let patchedPayload: Record | undefined; + const baseStreamFn = vi.fn((_model, _context, options) => { + options?.onPayload?.({}); + return (async function* () {})(); + }); + const model = { + api: "openai-completions", + provider: "ollama", + id: "qwen3:32b", + contextWindow: 131072, + params: { num_ctx: 0 }, + }; + + const wrapped = createConfiguredOllamaCompatStreamWrapper({ + provider: "ollama", + modelId: "qwen3:32b", + model, + streamFn: baseStreamFn, + } as never); + + await wrapped?.( + model as never, + { messages: [] } as never, + { + onPayload: (payload: unknown) => { + patchedPayload = payload as Record; + }, + } as never, + ); + + expect(patchedPayload).toMatchObject({ + options: { num_ctx: 131072 }, }); }); @@ -878,6 +915,7 @@ function getGuardedFetchCall(fetchMock: typeof fetchWithSsrFGuardMock): GuardedF async function createOllamaTestStream(params: { baseUrl: string; defaultHeaders?: Record; + model?: Record; options?: { apiKey?: string; maxTokens?: number; @@ -892,6 +930,7 @@ async function createOllamaTestStream(params: { api: "ollama", provider: "custom-ollama", contextWindow: 131072, + ...params.model, } as unknown as Parameters[0], { messages: [{ role: "user", content: "hello" }], @@ -1157,6 +1196,33 @@ describe("createOllamaStreamFn", () => { ); }); + it("uses configured params.num_ctx for native Ollama chat options", async () => { + await withMockNdjsonFetch( + [ + '{"model":"m","created_at":"t","message":{"role":"assistant","content":"ok"},"done":false}', + '{"model":"m","created_at":"t","message":{"role":"assistant","content":""},"done":true,"prompt_eval_count":1,"eval_count":1}', + ], + async (fetchMock) => { + const stream = await createOllamaTestStream({ + baseUrl: "http://ollama-host:11434", + model: { params: { num_ctx: 32768 }, contextWindow: 131072 }, + }); + + const events = await collectStreamEvents(stream); + expect(events.at(-1)?.type).toBe("done"); + + const requestInit = getGuardedFetchCall(fetchMock).init ?? {}; + if (typeof requestInit.body !== "string") { + throw new Error("Expected string request body"); + } + const requestBody = JSON.parse(requestInit.body) as { + options: { num_ctx?: number }; + }; + expect(requestBody.options.num_ctx).toBe(32768); + }, + ); + }); + it("uses the default loopback policy when baseUrl is empty", async () => { await withMockNdjsonFetch( [ diff --git a/extensions/ollama/src/stream.ts b/extensions/ollama/src/stream.ts index 4dfd694fcdd..6845b47a713 100644 --- a/extensions/ollama/src/stream.ts +++ b/extensions/ollama/src/stream.ts @@ -181,8 +181,19 @@ function resolveOllamaThinkValue(thinkingLevel: unknown): OllamaThinkValue | und return undefined; } -function resolveOllamaCompatNumCtx(model: ProviderRuntimeModel): number { - return Math.max(1, Math.floor(model.contextWindow ?? model.maxTokens ?? DEFAULT_CONTEXT_TOKENS)); +function resolveOllamaConfiguredNumCtx(model: ProviderRuntimeModel): number | undefined { + const raw = model.params?.num_ctx; + if (typeof raw !== "number" || !Number.isFinite(raw) || raw <= 0) { + return undefined; + } + return Math.floor(raw); +} + +function resolveOllamaNumCtx(model: ProviderRuntimeModel): number { + return ( + resolveOllamaConfiguredNumCtx(model) ?? + Math.max(1, Math.floor(model.contextWindow ?? model.maxTokens ?? DEFAULT_CONTEXT_TOKENS)) + ); } function isOllamaCloudKimiModelRef(modelId: string): boolean { @@ -215,7 +226,7 @@ export function createConfiguredOllamaCompatStreamWrapper( } if (injectNumCtx && model) { - streamFn = wrapOllamaCompatNumCtx(streamFn, resolveOllamaCompatNumCtx(model)); + streamFn = wrapOllamaCompatNumCtx(streamFn, resolveOllamaNumCtx(model)); } const ollamaThinkValue = isNativeOllamaTransport @@ -743,7 +754,7 @@ export function createOllamaStreamFn( ); const ollamaTools = extractOllamaTools(context.tools); - const ollamaOptions: Record = { num_ctx: model.contextWindow ?? 65536 }; + const ollamaOptions: Record = { num_ctx: resolveOllamaNumCtx(model) }; if (typeof options?.temperature === "number") { ollamaOptions.temperature = options.temperature; } diff --git a/src/agents/pi-embedded-runner/model.test.ts b/src/agents/pi-embedded-runner/model.test.ts index b8fef65e0ff..a3b2839a44b 100644 --- a/src/agents/pi-embedded-runner/model.test.ts +++ b/src/agents/pi-embedded-runner/model.test.ts @@ -369,6 +369,80 @@ describe("resolveModel", () => { expect(result.model?.maxTokens).toBe(32768); }); + it("merges configured model params with agent defaults for resolved models", () => { + mockDiscoveredModel(discoverModels, { + provider: "ollama", + modelId: "qwen3:32b", + templateModel: { + ...makeModel("qwen3:32b"), + provider: "ollama", + params: { num_ctx: 4096, keep_alive: "1m" }, + }, + }); + const cfg = { + agents: { + defaults: { + models: { + "OLLAMA/qwen3:32B": { + params: { num_ctx: 8192, thinking: "low" }, + }, + }, + }, + }, + models: { + providers: { + ollama: { + baseUrl: "http://localhost:11434", + models: [ + { + ...makeModel("qwen3:32b"), + params: { num_ctx: 16384 }, + }, + ], + }, + }, + }, + } as unknown as OpenClawConfig; + + const result = resolveModelForTest("ollama", "qwen3:32b", "/tmp/agent", cfg); + + expect(result.error).toBeUndefined(); + expect((result.model as { params?: Record } | undefined)?.params).toEqual({ + num_ctx: 16384, + keep_alive: "1m", + thinking: "low", + }); + }); + + it("applies agent default model params without explicit provider config", () => { + mockDiscoveredModel(discoverModels, { + provider: "ollama", + modelId: "llama3.2", + templateModel: { + ...makeModel("llama3.2"), + provider: "ollama", + }, + }); + const cfg = { + agents: { + defaults: { + models: { + "ollama/llama3.2": { + params: { num_ctx: 32768 }, + }, + }, + }, + }, + } as unknown as OpenClawConfig; + + const result = resolveModelForTest("ollama", "llama3.2", "/tmp/agent", cfg); + + expect(result.error).toBeUndefined(); + expect((result.model as { params?: Record } | undefined)?.params).toEqual({ + num_ctx: 32768, + }); + }); + it("propagates reasoning from matching configured fallback model", () => { const cfg = { models: { diff --git a/src/agents/pi-embedded-runner/model.ts b/src/agents/pi-embedded-runner/model.ts index c8791fd9b91..2586218bce4 100644 --- a/src/agents/pi-embedded-runner/model.ts +++ b/src/agents/pi-embedded-runner/model.ts @@ -21,7 +21,7 @@ import { import { resolveOpenClawAgentDir } from "../agent-paths.js"; import { DEFAULT_CONTEXT_TOKENS } from "../defaults.js"; import { buildModelAliasLines } from "../model-alias-lines.js"; -import { normalizeStaticProviderModelId } from "../model-ref-shared.js"; +import { modelKey, normalizeStaticProviderModelId } from "../model-ref-shared.js"; import { findNormalizedProviderValue, normalizeProviderId } from "../model-selection.js"; import { buildSuppressedBuiltInModelError, @@ -346,6 +346,80 @@ function findConfiguredProviderModel( ); } +function readModelParams(value: unknown): Record | undefined { + if (!value || typeof value !== "object" || Array.isArray(value)) { + return undefined; + } + return value as Record; +} + +function mergeModelParams( + ...entries: Array | undefined> +): Record | undefined { + const merged = Object.assign({}, ...entries.filter(Boolean)); + return Object.keys(merged).length > 0 ? merged : undefined; +} + +function findConfiguredAgentModelParams(params: { + cfg?: OpenClawConfig; + provider: string; + modelId: string; +}): Record | undefined { + const configuredModels = params.cfg?.agents?.defaults?.models; + if (!configuredModels) { + return undefined; + } + const directKeys = [ + modelKey(params.provider, params.modelId), + `${params.provider}/${params.modelId}`, + ]; + for (const key of directKeys) { + const direct = readModelParams(configuredModels[key]?.params); + if (direct) { + return direct; + } + } + + const normalizedProvider = normalizeProviderId(params.provider); + const normalizedModelId = normalizeStaticProviderModelId(normalizedProvider, params.modelId) + .trim() + .toLowerCase(); + for (const [rawKey, entry] of Object.entries(configuredModels)) { + const slashIndex = rawKey.indexOf("/"); + if (slashIndex <= 0) { + continue; + } + const candidateProvider = rawKey.slice(0, slashIndex); + const candidateModelId = rawKey.slice(slashIndex + 1); + if ( + normalizeProviderId(candidateProvider) === normalizedProvider && + normalizeStaticProviderModelId(normalizedProvider, candidateModelId).trim().toLowerCase() === + normalizedModelId + ) { + return readModelParams(entry.params); + } + } + return undefined; +} + +function mergeConfiguredRuntimeModelParams(params: { + cfg?: OpenClawConfig; + provider: string; + modelId: string; + discoveredParams?: unknown; + configuredParams?: unknown; +}): Record | undefined { + return mergeModelParams( + readModelParams(params.discoveredParams), + findConfiguredAgentModelParams({ + cfg: params.cfg, + provider: params.provider, + modelId: params.modelId, + }), + readModelParams(params.configuredParams), + ); +} + function applyConfiguredProviderOverrides(params: { provider: string; discoveredModel: ProviderRuntimeModel; @@ -356,9 +430,19 @@ function applyConfiguredProviderOverrides(params: { preferDiscoveredModelMetadata?: boolean; }): ProviderRuntimeModel { const { discoveredModel, providerConfig, modelId } = params; + const defaultModelParams = findConfiguredAgentModelParams({ + cfg: params.cfg, + provider: params.provider, + modelId, + }); if (!providerConfig) { + const resolvedParams = mergeModelParams( + readModelParams(discoveredModel.params), + defaultModelParams, + ); return { ...discoveredModel, + ...(resolvedParams ? { params: resolvedParams } : {}), // Discovered models originate from models.json and may contain persistence markers. headers: sanitizeModelHeaders(discoveredModel.headers, { stripSecretRefMarkers: true }), }; @@ -390,11 +474,21 @@ function applyConfiguredProviderOverrides(params: { !providerHeaders && !providerRequest ) { + const resolvedParams = mergeModelParams( + readModelParams(discoveredModel.params), + defaultModelParams, + ); return { ...discoveredModel, + ...(resolvedParams ? { params: resolvedParams } : {}), headers: discoveredHeaders, }; } + const resolvedParams = mergeModelParams( + readModelParams(discoveredModel.params), + defaultModelParams, + readModelParams(configuredModel?.params), + ); const normalizedInput = resolveProviderModelInput({ provider: params.provider, modelId, @@ -436,6 +530,7 @@ function applyConfiguredProviderOverrides(params: { contextWindow: metadataOverrideModel?.contextWindow ?? discoveredModel.contextWindow, contextTokens: metadataOverrideModel?.contextTokens ?? discoveredModel.contextTokens, maxTokens: metadataOverrideModel?.maxTokens ?? discoveredModel.maxTokens, + ...(resolvedParams ? { params: resolvedParams } : {}), headers: requestConfig.headers, compat: metadataOverrideModel?.compat ?? discoveredModel.compat, }, @@ -468,13 +563,22 @@ function resolveExplicitModelWithRegistry(params: { modelId, }); if (inlineMatch?.api) { + const resolvedParams = mergeConfiguredRuntimeModelParams({ + cfg, + provider, + modelId, + configuredParams: inlineMatch.params, + }); return { kind: "resolved", model: normalizeResolvedModel({ provider, cfg, agentDir, - model: inlineMatch as Model, + model: { + ...inlineMatch, + ...(resolvedParams ? { params: resolvedParams } : {}), + } as Model, runtimeHooks, }), }; @@ -508,13 +612,22 @@ function resolveExplicitModelWithRegistry(params: { modelId, }); if (fallbackInlineMatch?.api) { + const resolvedParams = mergeConfiguredRuntimeModelParams({ + cfg, + provider, + modelId, + configuredParams: fallbackInlineMatch.params, + }); return { kind: "resolved", model: normalizeResolvedModel({ provider, cfg, agentDir, - model: fallbackInlineMatch as Model, + model: { + ...fallbackInlineMatch, + ...(resolvedParams ? { params: resolvedParams } : {}), + } as Model, runtimeHooks, }), }; @@ -594,6 +707,12 @@ function resolveConfiguredFallbackModel(params: { const modelHeaders = sanitizeModelHeaders(configuredModel?.headers, { stripSecretRefMarkers: true, }); + const resolvedParams = mergeConfiguredRuntimeModelParams({ + cfg, + provider, + modelId, + configuredParams: configuredModel?.params, + }); if (!providerConfig && !modelId.startsWith("mock-")) { return undefined; } @@ -643,6 +762,7 @@ function resolveConfiguredFallbackModel(params: { configuredModel?.maxTokens ?? providerConfig?.models?.[0]?.maxTokens ?? DEFAULT_CONTEXT_TOKENS, + ...(resolvedParams ? { params: resolvedParams } : {}), headers: requestConfig.headers, } as Model, providerRequest, diff --git a/src/config/schema.base.generated.ts b/src/config/schema.base.generated.ts index f380f1f6921..1210a81a461 100644 --- a/src/config/schema.base.generated.ts +++ b/src/config/schema.base.generated.ts @@ -2995,6 +2995,13 @@ export const GENERATED_BASE_CONFIG_SCHEMA: BaseConfigSchemaResponse = { type: "number", exclusiveMinimum: 0, }, + params: { + type: "object", + propertyNames: { + type: "string", + }, + additionalProperties: {}, + }, headers: { type: "object", propertyNames: { @@ -3122,7 +3129,7 @@ export const GENERATED_BASE_CONFIG_SCHEMA: BaseConfigSchemaResponse = { }, title: "Model Provider Model List", description: - "Declared model list for a provider including identifiers, metadata, and optional compatibility/cost hints. Keep IDs exact to provider catalog values so selection and fallback resolve correctly.", + "Declared model list for a provider including identifiers, metadata, provider-specific params, and optional compatibility/cost hints. Keep IDs exact to provider catalog values so selection and fallback resolve correctly.", }, }, required: ["baseUrl", "models"], @@ -26612,7 +26619,7 @@ export const GENERATED_BASE_CONFIG_SCHEMA: BaseConfigSchemaResponse = { }, "models.providers.*.models": { label: "Model Provider Model List", - help: "Declared model list for a provider including identifiers, metadata, and optional compatibility/cost hints. Keep IDs exact to provider catalog values so selection and fallback resolve correctly.", + help: "Declared model list for a provider including identifiers, metadata, provider-specific params, and optional compatibility/cost hints. Keep IDs exact to provider catalog values so selection and fallback resolve correctly.", tags: ["models"], }, "auth.cooldowns.billingBackoffHours": { diff --git a/src/config/schema.help.ts b/src/config/schema.help.ts index 557b638c5cb..83d63ae9a0a 100644 --- a/src/config/schema.help.ts +++ b/src/config/schema.help.ts @@ -885,7 +885,7 @@ export const FIELD_HELP: Record = { "models.providers.*.request.allowPrivateNetwork": "When true, allow HTTPS to the model base URL when DNS resolves to private, CGNAT, or similar ranges, via the provider HTTP fetch guard (fetchWithSsrFGuard). OpenAI Responses WebSocket reuses request for headers/TLS but does not use that fetch SSRF path. Use only for operator-controlled self-hosted OpenAI-compatible endpoints (LAN, overlay, split DNS). Default is false.", "models.providers.*.models": - "Declared model list for a provider including identifiers, metadata, and optional compatibility/cost hints. Keep IDs exact to provider catalog values so selection and fallback resolve correctly.", + "Declared model list for a provider including identifiers, metadata, provider-specific params, and optional compatibility/cost hints. Keep IDs exact to provider catalog values so selection and fallback resolve correctly.", auth: "Authentication profile root used for multi-profile provider credentials and cooldown-based failover ordering. Keep profiles minimal and explicit so automatic failover behavior stays auditable.", "channels.matrix.allowBots": 'Allow messages from other configured Matrix bot accounts to trigger replies (default: false). Set "mentions" to only accept bot messages that visibly mention this bot.', diff --git a/src/config/types.models.ts b/src/config/types.models.ts index 985d3f476b3..07ee3da6662 100644 --- a/src/config/types.models.ts +++ b/src/config/types.models.ts @@ -107,6 +107,8 @@ export type ModelDefinitionConfig = { */ contextTokens?: number; maxTokens: number; + /** Provider-specific request/runtime parameters passed through to provider plugins. */ + params?: Record; headers?: Record; compat?: ModelCompatConfig; metadataSource?: "models-add"; diff --git a/src/config/zod-schema.core.ts b/src/config/zod-schema.core.ts index 1b387910c88..d8b49977df9 100644 --- a/src/config/zod-schema.core.ts +++ b/src/config/zod-schema.core.ts @@ -342,6 +342,7 @@ export const ModelDefinitionSchema = z contextWindow: z.number().positive().optional(), contextTokens: z.number().int().positive().optional(), maxTokens: z.number().positive().optional(), + params: z.record(z.string(), z.unknown()).optional(), headers: z.record(z.string(), z.string()).optional(), compat: ModelCompatSchema, metadataSource: z.literal("models-add").optional(), diff --git a/src/plugins/provider-runtime-model.types.ts b/src/plugins/provider-runtime-model.types.ts index 5eba458acc2..7c07fbc4d04 100644 --- a/src/plugins/provider-runtime-model.types.ts +++ b/src/plugins/provider-runtime-model.types.ts @@ -6,4 +6,5 @@ import type { Api, Model } from "@mariozechner/pi-ai"; */ export type ProviderRuntimeModel = Model & { contextTokens?: number; + params?: Record; }; From f4cf7e3b4f5eeae94b3638364596b017e9040671 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 03:06:06 +0100 Subject: [PATCH 166/418] test(docker): recreate update fixture ui asset after install --- scripts/e2e/update-channel-switch-docker.sh | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/scripts/e2e/update-channel-switch-docker.sh b/scripts/e2e/update-channel-switch-docker.sh index 2ae11d6fe28..730ff942142 100755 --- a/scripts/e2e/update-channel-switch-docker.sh +++ b/scripts/e2e/update-channel-switch-docker.sh @@ -62,6 +62,11 @@ NODE cd "$git_root" npm install --omit=optional --no-fund --no-audit >/tmp/openclaw-git-install.log 2>&1 ) +node - <<'"'"'NODE'"'"' +const fs = require("node:fs"); +fs.mkdirSync("/tmp/openclaw-git/dist/control-ui", { recursive: true }); +fs.writeFileSync("/tmp/openclaw-git/dist/control-ui/index.html", "fixture\n"); +NODE git config --global user.email "docker-e2e@openclaw.local" git config --global user.name "OpenClaw Docker E2E" From aa071e0b60613f5ed49345a1c9b9bbdaa10cae19 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 03:08:03 +0100 Subject: [PATCH 167/418] fix(ollama): forward native model params --- CHANGELOG.md | 1 + docs/providers/ollama.md | 5 ++ extensions/ollama/ollama.live.test.ts | 7 +- extensions/ollama/src/stream-runtime.test.ts | 27 ++++++- extensions/ollama/src/stream.ts | 80 +++++++++++++++++++- 5 files changed, 114 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0313dea5da4..f874cbde582 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -26,6 +26,7 @@ Docs: https://docs.openclaw.ai - Providers/Ollama: honor `/api/show` capabilities when registering local models so non-tool Ollama models no longer receive the agent tool surface, and keep native Ollama thinking opt-in instead of enabling it by default. Fixes #64710 and duplicate #65343. Thanks @yuan-b, @netherby, @xilopaint, and @Diyforfun2026. - Providers/Ollama: read larger custom Modelfile `PARAMETER num_ctx` values from `/api/show` so auto-discovered Ollama models with expanded context no longer stay pinned to the base model context. Fixes #68344. Thanks @neeravmakwana. - Providers/Ollama: honor configured model `params.num_ctx` in native and OpenAI-compatible Ollama requests so local models can cap runtime context without rebuilding Modelfiles. Fixes #44550 and #52206; supersedes #69464. Thanks @taitruong, @armi0024, and @LokiCode404. +- Providers/Ollama: forward whitelisted native Ollama model params such as `temperature`, `top_p`, and top-level `think` so users can disable API-level thinking or tune local models from config without proxy shims. Fixes #48010. Thanks @tangzhi, @pandego, @maweibin, @Adam-Researchh, and @EmpireCreator. - Providers/Ollama: expose native Ollama thinking effort levels so `/think max` is accepted for reasoning-capable Ollama models and maps to Ollama's highest supported `think` effort. Fixes #71584. Thanks @g0st1n. - Providers/Ollama: strip the active custom Ollama provider prefix before native chat and embedding requests, so custom provider ids like `ollama-spark/qwen3:32b` reach Ollama as the real model name. Fixes #72353. Thanks @maximus-dss and @hclsys. - Providers/Ollama: parse stringified native tool-call arguments before dispatch, preserving unsafe integer values so Ollama tool use receives structured parameters. Fixes #69735; supersedes #69910. Thanks @rongshuzhao and @yfge. diff --git a/docs/providers/ollama.md b/docs/providers/ollama.md index 692b25e20fd..acd8c1a5e8e 100644 --- a/docs/providers/ollama.md +++ b/docs/providers/ollama.md @@ -403,6 +403,8 @@ For the full setup and behavior details, see [Ollama Web Search](/tools/ollama-s You can override `contextWindow` and `maxTokens` in explicit provider config. To cap Ollama's per-request runtime context without rebuilding a Modelfile, set `params.num_ctx`; OpenClaw sends it as `options.num_ctx` for both native Ollama and the OpenAI-compatible Ollama adapter. Invalid, zero, negative, and non-finite values are ignored and fall back to `contextWindow`. + Native Ollama model entries also accept the common Ollama runtime options under `params`, including `temperature`, `top_p`, `top_k`, `min_p`, `num_predict`, `stop`, `repeat_penalty`, `num_batch`, `num_thread`, and `use_mmap`. OpenClaw forwards only Ollama request keys, so OpenClaw runtime params such as `streaming` are not leaked to Ollama. Use `params.think` or `params.thinking` to send top-level Ollama `think`; `false` disables API-level thinking for Qwen-style thinking models. + ```json5 { models: { @@ -415,6 +417,9 @@ For the full setup and behavior details, see [Ollama Web Search](/tools/ollama-s maxTokens: 65536, params: { num_ctx: 32768, + temperature: 0.7, + top_p: 0.9, + thinking: false, }, } ] diff --git a/extensions/ollama/ollama.live.test.ts b/extensions/ollama/ollama.live.test.ts index 88304ddadcf..b4fb48a1b1e 100644 --- a/extensions/ollama/ollama.live.test.ts +++ b/extensions/ollama/ollama.live.test.ts @@ -26,7 +26,8 @@ describe.skipIf(!LIVE)("ollama live", () => { let payload: | { model?: string; - options?: { num_ctx?: number }; + think?: boolean; + options?: { num_ctx?: number; top_p?: number }; tools?: Array<{ function?: { parameters?: { @@ -43,7 +44,7 @@ describe.skipIf(!LIVE)("ollama live", () => { api: "ollama", provider: PROVIDER_ID, contextWindow: 8192, - params: { num_ctx: 4096 }, + params: { num_ctx: 4096, top_p: 0.9, thinking: false }, } as never, { messages: [{ role: "user", content: "Reply exactly OK." }], @@ -82,6 +83,8 @@ describe.skipIf(!LIVE)("ollama live", () => { expect(events.some((event) => (event as { type?: string }).type === "done")).toBe(true); expect(payload?.model).toBe(CHAT_MODEL); expect(payload?.options?.num_ctx).toBe(4096); + expect(payload?.options?.top_p).toBe(0.9); + expect(payload?.think).toBe(false); const properties = payload?.tools?.[0]?.function?.parameters?.properties; expect(properties?.city?.type).toBe("string"); expect(properties?.units?.type).toBe("string"); diff --git a/extensions/ollama/src/stream-runtime.test.ts b/extensions/ollama/src/stream-runtime.test.ts index 4d7e8958f4c..a34862aaf4c 100644 --- a/extensions/ollama/src/stream-runtime.test.ts +++ b/extensions/ollama/src/stream-runtime.test.ts @@ -919,6 +919,7 @@ async function createOllamaTestStream(params: { options?: { apiKey?: string; maxTokens?: number; + temperature?: number; signal?: AbortSignal; headers?: Record; }; @@ -1205,7 +1206,17 @@ describe("createOllamaStreamFn", () => { async (fetchMock) => { const stream = await createOllamaTestStream({ baseUrl: "http://ollama-host:11434", - model: { params: { num_ctx: 32768 }, contextWindow: 131072 }, + model: { + params: { + num_ctx: 32768, + temperature: 0.2, + top_p: 0.9, + thinking: false, + streaming: false, + }, + contextWindow: 131072, + }, + options: { temperature: 0.7, maxTokens: 55 }, }); const events = await collectStreamEvents(stream); @@ -1216,9 +1227,21 @@ describe("createOllamaStreamFn", () => { throw new Error("Expected string request body"); } const requestBody = JSON.parse(requestInit.body) as { - options: { num_ctx?: number }; + think?: boolean; + options: { + num_ctx?: number; + num_predict?: number; + temperature?: number; + top_p?: number; + streaming?: boolean; + }; }; expect(requestBody.options.num_ctx).toBe(32768); + expect(requestBody.options.num_predict).toBe(55); + expect(requestBody.options.temperature).toBe(0.7); + expect(requestBody.options.top_p).toBe(0.9); + expect(requestBody.options.streaming).toBeUndefined(); + expect(requestBody.think).toBe(false); }, ); }); diff --git a/extensions/ollama/src/stream.ts b/extensions/ollama/src/stream.ts index 6845b47a713..29fd46523d1 100644 --- a/extensions/ollama/src/stream.ts +++ b/extensions/ollama/src/stream.ts @@ -152,7 +152,31 @@ export function wrapOllamaCompatNumCtx(baseFn: StreamFn | undefined, numCtx: num }); } -type OllamaThinkValue = boolean | "low" | "medium" | "high"; +type OllamaThinkValue = boolean | "low" | "medium" | "high" | "max"; + +const OLLAMA_OPTION_PARAM_KEYS = new Set([ + "num_keep", + "seed", + "num_predict", + "top_k", + "top_p", + "min_p", + "typical_p", + "repeat_last_n", + "temperature", + "repeat_penalty", + "presence_penalty", + "frequency_penalty", + "stop", + "num_ctx", + "num_batch", + "num_gpu", + "main_gpu", + "use_mmap", + "num_thread", +]); + +const OLLAMA_TOP_LEVEL_PARAM_KEYS = new Set(["format", "keep_alive", "truncate", "shift"]); function createOllamaThinkingWrapper( baseFn: StreamFn | undefined, @@ -181,6 +205,22 @@ function resolveOllamaThinkValue(thinkingLevel: unknown): OllamaThinkValue | und return undefined; } +function resolveOllamaThinkParamValue( + params: Record | undefined, +): OllamaThinkValue | undefined { + const raw = params?.think ?? params?.thinking; + if (typeof raw === "boolean") { + return raw; + } + if (raw === "off") { + return false; + } + if (raw === "low" || raw === "medium" || raw === "high" || raw === "max") { + return raw; + } + return undefined; +} + function resolveOllamaConfiguredNumCtx(model: ProviderRuntimeModel): number | undefined { const raw = model.params?.num_ctx; if (typeof raw !== "number" || !Number.isFinite(raw) || raw <= 0) { @@ -196,6 +236,39 @@ function resolveOllamaNumCtx(model: ProviderRuntimeModel): number { ); } +function resolveOllamaModelOptions(model: ProviderRuntimeModel): Record { + const options: Record = {}; + const params = model.params; + if (params && typeof params === "object" && !Array.isArray(params)) { + for (const [key, value] of Object.entries(params)) { + if (value !== undefined && OLLAMA_OPTION_PARAM_KEYS.has(key)) { + options[key] = value; + } + } + } + options.num_ctx = resolveOllamaNumCtx(model); + return options; +} + +function resolveOllamaTopLevelParams( + model: ProviderRuntimeModel, +): Record | undefined { + const requestParams: Record = {}; + const params = model.params; + if (params && typeof params === "object" && !Array.isArray(params)) { + for (const [key, value] of Object.entries(params)) { + if (value !== undefined && OLLAMA_TOP_LEVEL_PARAM_KEYS.has(key)) { + requestParams[key] = value; + } + } + } + const think = resolveOllamaThinkParamValue(params); + if (think !== undefined) { + requestParams.think = think; + } + return Object.keys(requestParams).length > 0 ? requestParams : undefined; +} + function isOllamaCloudKimiModelRef(modelId: string): boolean { const normalizedModelId = normalizeLowercaseStringOrEmpty(modelId); return normalizedModelId.startsWith("kimi-k") && normalizedModelId.includes(":cloud"); @@ -257,6 +330,7 @@ export function buildOllamaChatRequest(params: { messages: OllamaChatMessage[]; tools?: OllamaTool[]; options?: Record; + requestParams?: Record; stream?: boolean; }): OllamaChatRequest { return { @@ -265,6 +339,7 @@ export function buildOllamaChatRequest(params: { stream: params.stream ?? true, ...(params.tools && params.tools.length > 0 ? { tools: params.tools } : {}), ...(params.options ? { options: params.options } : {}), + ...params.requestParams, }; } @@ -754,7 +829,7 @@ export function createOllamaStreamFn( ); const ollamaTools = extractOllamaTools(context.tools); - const ollamaOptions: Record = { num_ctx: resolveOllamaNumCtx(model) }; + const ollamaOptions: Record = resolveOllamaModelOptions(model); if (typeof options?.temperature === "number") { ollamaOptions.temperature = options.temperature; } @@ -769,6 +844,7 @@ export function createOllamaStreamFn( stream: true, tools: ollamaTools, options: ollamaOptions, + requestParams: resolveOllamaTopLevelParams(model), }); options?.onPayload?.(body, model); const headers: Record = { From de0ece20d180633b84901160a770cfec357276a4 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 03:08:21 +0100 Subject: [PATCH 168/418] test: accept live release validation variance --- src/agents/live-cache-regression-baseline.ts | 4 ++-- src/agents/live-cache-regression-runner.ts | 9 ++++++++- src/gateway/gateway-codex-harness.live-helpers.test.ts | 6 ++++++ src/gateway/gateway-codex-harness.live-helpers.ts | 3 +++ 4 files changed, 19 insertions(+), 3 deletions(-) diff --git a/src/agents/live-cache-regression-baseline.ts b/src/agents/live-cache-regression-baseline.ts index a8d628272b4..77c30b1488e 100644 --- a/src/agents/live-cache-regression-baseline.ts +++ b/src/agents/live-cache-regression-baseline.ts @@ -3,6 +3,7 @@ export type LiveCacheFloor = { observedCacheWrite?: number; observedHitRate?: number; minCacheRead?: number; + minCacheReadOrWrite?: number; minCacheWrite?: number; minHitRate?: number; maxCacheRead?: number; @@ -37,9 +38,8 @@ export const LIVE_CACHE_REGRESSION_BASELINE = { observedCacheRead: 5_660, observedCacheWrite: 18, observedHitRate: 0.996, - minCacheRead: 5_400, + minCacheReadOrWrite: 5_400, minCacheWrite: 1, - minHitRate: 0.97, }, tool: { observedCacheRead: 6_223, diff --git a/src/agents/live-cache-regression-runner.ts b/src/agents/live-cache-regression-runner.ts index 609d81ec0ee..8bed81c072c 100644 --- a/src/agents/live-cache-regression-runner.ts +++ b/src/agents/live-cache-regression-runner.ts @@ -367,7 +367,14 @@ function assertAgainstBaseline(params: { if (params.result.best) { const usage = params.result.best.usage; - if ((usage.cacheRead ?? 0) < (floor.minCacheRead ?? 0)) { + if (floor.minCacheReadOrWrite !== undefined) { + const cacheReadOrWrite = Math.max(usage.cacheRead ?? 0, usage.cacheWrite ?? 0); + if (cacheReadOrWrite < floor.minCacheReadOrWrite) { + params.regressions.push( + `${params.provider}:${params.lane} cacheReadOrWrite=${cacheReadOrWrite} < min=${floor.minCacheReadOrWrite}`, + ); + } + } else if ((usage.cacheRead ?? 0) < (floor.minCacheRead ?? 0)) { params.regressions.push( `${params.provider}:${params.lane} cacheRead=${usage.cacheRead ?? 0} < min=${floor.minCacheRead}`, ); diff --git a/src/gateway/gateway-codex-harness.live-helpers.test.ts b/src/gateway/gateway-codex-harness.live-helpers.test.ts index fd2de9372f2..caa5ef46d15 100644 --- a/src/gateway/gateway-codex-harness.live-helpers.test.ts +++ b/src/gateway/gateway-codex-harness.live-helpers.test.ts @@ -159,6 +159,12 @@ describe("gateway codex harness live helpers", () => { "I couldn’t list them because the local `codex models` command requires elevated execution in this environment, and that request was rejected.", "I couldn’t list them because the local `codex models` command requires host permissions here, and that escalation was rejected.", "I couldn’t run `codex models` because the sandboxed attempt failed and the required elevated retry was not approved.", + [ + "I tried `codex models`, but the sandbox blocked it due to the kernel namespace restriction.", + "I then requested an escalated run, but the automatic approval review failed before it could be approved.", + "", + "I can’t safely run the command from here right now.", + ].join("\n"), ]; for (const text of texts) { diff --git a/src/gateway/gateway-codex-harness.live-helpers.ts b/src/gateway/gateway-codex-harness.live-helpers.ts index 71016e6528d..cee1176fc9c 100644 --- a/src/gateway/gateway-codex-harness.live-helpers.ts +++ b/src/gateway/gateway-codex-harness.live-helpers.ts @@ -85,6 +85,9 @@ export function isExpectedCodexModelsCommandText(text: string): boolean { normalized.includes("fails to start") || normalized.includes("repo-local fallback") || normalized.includes("sandbox blocks") || + normalized.includes("sandbox blocked") || + normalized.includes("approval review failed") || + normalized.includes("failed before it could be approved") || ((normalized.includes("rejected") || normalized.includes("not approved")) && (normalized.includes("sandbox") || normalized.includes("permission") || From 0c30d0d0b86a429418f7035bd79aec267904c636 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 19:10:21 -0700 Subject: [PATCH 169/418] fix(gateway): resolve configured thinking default in session rows (#72324) * fix(gateway): resolve configured thinking default in session rows * fix(gateway): preserve model thinking precedence --- CHANGELOG.md | 1 + src/gateway/session-utils.test.ts | 83 +++++++++++++++++++++++++++++++ src/gateway/session-utils.ts | 33 +++++++++--- 3 files changed, 111 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f874cbde582..f244644aee7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -51,6 +51,7 @@ Docs: https://docs.openclaw.ai - WebChat/Control UI: support non-video file attachments in chat uploads while preserving the existing image attachment path and MIME-sniff fallback for generic image uploads. (#70947) Thanks @IAMSamuelRodda. - Skills/memory: restore Chokidar v5 hot reloads by watching concrete skill and memory roots with filters, including SKILL.md removals and deleted skill folders without broad workspace recursion. Fixes #27404, #33585, and #41606. Thanks @shelvenzhou, @08820048, and @rocke2020. - Gateway/chat: keep duplicate attachment-backed `chat.send` retries with the same idempotency key on the documented in-flight path so aborts still target the real active run. Fixes #70139. Thanks @Feelw00. +- Gateway/session rows: report the same config-resolved thinking default that runtime sessions use, including global and per-agent defaults, so Control UI and TUI default labels stay aligned. (#71779, #70981, #71033, #70302) Thanks @chen-zhang-cs-code, @SymbolStar, and @cholaolu-boop. - Plugins: share package entrypoint resolution between install and discovery, reject mismatched `runtimeExtensions`, and cache bundled runtime-dependency manifest reads during scans. Thanks @codex. - WhatsApp/Web: keep quiet but healthy linked-device sessions connected by basing the watchdog on WhatsApp Web transport activity, while retaining a longer app-silence cap so frame activity cannot mask a stuck session forever. Fixes #70678; carries forward the focused #71466 approach and keeps #63939 as related configurable-timeout follow-up. Thanks @vincentkoc and @oromeis. - Discord/gateway: count failed health-monitor restart attempts toward cooldown and hourly caps, and evict stale account lifecycle state during channel reloads so repeated Discord gateway recovery cannot loop on old status. Fixes #38596. (#40413) Thanks @jellyAI-dev and @vashquez. diff --git a/src/gateway/session-utils.test.ts b/src/gateway/session-utils.test.ts index ccc8927ed2f..a5985d4f765 100644 --- a/src/gateway/session-utils.test.ts +++ b/src/gateway/session-utils.test.ts @@ -9,6 +9,7 @@ import { createEmptyPluginRegistry } from "../plugins/registry-empty.js"; import { resetPluginRuntimeStateForTest, setActivePluginRegistry } from "../plugins/runtime.js"; import { withStateDirEnv } from "../test-helpers/state-dir-env.js"; import { + buildGatewaySessionRow, capArrayByJsonBytes, classifySessionKey, deriveSessionTitle, @@ -139,6 +140,88 @@ describe("gateway session utils", () => { ); }); + test("session defaults use configured thinking default", () => { + const defaults = getSessionDefaults({ + agents: { + defaults: { + model: { primary: "openai-codex/gpt-5.5" }, + thinkingDefault: "high", + }, + }, + } as OpenClawConfig); + + expect(defaults).toMatchObject({ + modelProvider: "openai-codex", + model: "gpt-5.5", + thinkingDefault: "high", + }); + }); + + test("session rows use per-agent thinking default from config", () => { + const cfg = { + agents: { + defaults: { + model: { primary: "openai-codex/gpt-5.5" }, + thinkingDefault: "low", + models: { + "openai-codex/gpt-5.5": { + params: { thinking: "max" }, + }, + }, + }, + list: [ + { + id: "alpha", + default: true, + thinkingDefault: "high", + }, + ], + }, + } as OpenClawConfig; + + const row = buildGatewaySessionRow({ + cfg, + storePath: "", + store: {}, + key: "agent:alpha:main", + }); + + expect(row).toMatchObject({ + modelProvider: "openai-codex", + model: "gpt-5.5", + thinkingDefault: "high", + }); + }); + + test("session rows prefer per-model thinking over global default", () => { + const cfg = { + agents: { + defaults: { + model: { primary: "openai-codex/gpt-5.5" }, + thinkingDefault: "low", + models: { + "openai-codex/gpt-5.5": { + params: { thinking: "max" }, + }, + }, + }, + }, + } as OpenClawConfig; + + const row = buildGatewaySessionRow({ + cfg, + storePath: "", + store: {}, + key: "main", + }); + + expect(row).toMatchObject({ + modelProvider: "openai-codex", + model: "gpt-5.5", + thinkingDefault: "max", + }); + }); + test("classifySessionKey respects chat type + prefixes", () => { expect(classifySessionKey("global")).toBe("global"); expect(classifySessionKey("unknown")).toBe("unknown"); diff --git a/src/gateway/session-utils.ts b/src/gateway/session-utils.ts index 53c5ab1d6cc..6cc3839c730 100644 --- a/src/gateway/session-utils.ts +++ b/src/gateway/session-utils.ts @@ -2,6 +2,7 @@ import fs from "node:fs"; import path from "node:path"; import { listAgentIds, + resolveAgentConfig, resolveAgentEffectiveModelPrimary, resolveAgentModelFallbacksOverride, resolveAgentWorkspaceDir, @@ -17,6 +18,7 @@ import { resolveConfiguredModelRef, resolveDefaultModelForAgent, resolvePersistedSelectedModelRef, + resolveThinkingDefault, } from "../agents/model-selection.js"; import { countActiveDescendantRuns, @@ -31,10 +33,7 @@ import { RECENT_ENDED_SUBAGENT_CHILD_SESSION_MS, shouldKeepSubagentRunChildLink, } from "../agents/subagent-run-liveness.js"; -import { - listThinkingLevelOptions, - resolveThinkingDefaultForModel, -} from "../auto-reply/thinking.js"; +import { listThinkingLevelOptions } from "../auto-reply/thinking.js"; import { loadConfig } from "../config/config.js"; import { resolveAgentModelFallbackValues } from "../config/model-input.js"; import { resolveStateDir } from "../config/paths.js"; @@ -1038,6 +1037,25 @@ export function resolveGatewaySessionStoreTarget(params: { export { loadCombinedSessionStoreForGateway } from "../config/sessions/combined-store-gateway.js"; +function resolveGatewaySessionThinkingDefault(params: { + cfg: OpenClawConfig; + provider: string; + model: string; + agentId?: string; +}) { + const agentThinkingDefault = params.agentId + ? resolveAgentConfig(params.cfg, params.agentId)?.thinkingDefault + : undefined; + return ( + agentThinkingDefault ?? + resolveThinkingDefault({ + cfg: params.cfg, + provider: params.provider, + model: params.model, + }) + ); +} + export function getSessionDefaults(cfg: OpenClawConfig): GatewaySessionsDefaults { const resolved = resolveConfiguredModelRef({ cfg, @@ -1055,7 +1073,8 @@ export function getSessionDefaults(cfg: OpenClawConfig): GatewaySessionsDefaults contextTokens: contextTokens ?? null, thinkingLevels, thinkingOptions: thinkingLevels.map((level) => level.label), - thinkingDefault: resolveThinkingDefaultForModel({ + thinkingDefault: resolveGatewaySessionThinkingDefault({ + cfg, provider: resolved.provider, model: resolved.model, }), @@ -1429,9 +1448,11 @@ export function buildGatewaySessionRow(params: { thinkingLevel: entry?.thinkingLevel, thinkingLevels, thinkingOptions: thinkingLevels.map((level) => level.label), - thinkingDefault: resolveThinkingDefaultForModel({ + thinkingDefault: resolveGatewaySessionThinkingDefault({ + cfg, provider: thinkingProvider, model: thinkingModel, + agentId: sessionAgentId, }), fastMode: entry?.fastMode, verboseLevel: entry?.verboseLevel, From f5f4f514d814b1666efde51b92095af1ce4a73c9 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 19:11:02 -0700 Subject: [PATCH 170/418] docs(changelog): backfill gateway memory fixes --- CHANGELOG.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f244644aee7..6c91c10fa6d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,7 +12,8 @@ Docs: https://docs.openclaw.ai - Exec/node: skip approval-plan preparation for full-trust `host=node` runs so interpreter and script commands no longer fail with `SYSTEM_RUN_DENIED: approval cannot safely bind` when effective policy is `security=full` and `ask=off`. Fixes #48457 and duplicate #69251. Thanks @ajtran303, @jaserNo1, @Blakeshannon, @lesliefag, and @AvIsBeastMC. - Exec/node: synthesize a local approval plan when a paired node advertises `system.run` without `system.run.prepare`, unblocking approval-required `host=node` exec on current macOS companion nodes while preserving remote prepare for node hosts that support it. Fixes #37591 and duplicate #66839; carries forward #69725. Thanks @soloclz. - Memory/QMD: prefer QMD's `--mask` collection pattern flag so root memory indexing stays scoped to `MEMORY.md` instead of widening to every markdown file in the workspace. Thanks @codex. -- Lobster/Gateway: memoize repeated Ajv schema compilation before loading the embedded Lobster runtime so scheduled workflows and `llm.invoke` loops stop growing gateway heap on content-identical schemas. Fixes #71148. Thanks @cmi525 and @vsolaz. +- Gateway/memory: defer QMD startup for implicit non-default agents and scope memory runtime loading to the selected memory slot so Gateway boot and first memory recall avoid broad plugin runtime fanout. Thanks @vincentkoc. +- Lobster/Gateway: memoize repeated Ajv schema compilation before loading the embedded Lobster runtime so scheduled workflows and `llm.invoke` loops stop growing gateway heap on content-identical schemas. Fixes #71148. Thanks @cmi525, @vsolaz, and @vincentkoc. - Codex harness: normalize cached input tokens before session/context accounting so prompt cache reads are not double-counted in `/status`, `session_status`, or persisted `sessionEntry.totalTokens`. Fixes #69298. Thanks @richardmqq. - Hooks/session-memory: use the host local timezone for memory filenames, fallback timestamp slugs, and markdown headers instead of UTC dates. Fixes #46703. (#46721) Thanks @Astro-Han. - Feishu: extract quoted/replied interactive-card text across schema 1.0, schema 2.0, i18n, template-variable, and post-format fallback shapes without carrying broad generated/config churn from related parser experiments. (#38776, #60383, #42218, #45936) Thanks @lishuaigit, @lskun, @just2gooo, and @Br1an67. From 1882a8e5eaceae41d1d97902d07cbf6eeaf5563d Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 02:00:03 +0100 Subject: [PATCH 171/418] fix: refresh preflight rotated runs --- .../reply/agent-runner-memory.test.ts | 81 ++++++++++++++++++- src/auto-reply/reply/agent-runner-memory.ts | 17 ++++ 2 files changed, 96 insertions(+), 2 deletions(-) diff --git a/src/auto-reply/reply/agent-runner-memory.test.ts b/src/auto-reply/reply/agent-runner-memory.test.ts index d8ca2221298..500d777cf6b 100644 --- a/src/auto-reply/reply/agent-runner-memory.test.ts +++ b/src/auto-reply/reply/agent-runner-memory.test.ts @@ -67,8 +67,15 @@ describe("runMemoryFlushIfNeeded", () => { }; if (typeof params.newSessionId === "string" && params.newSessionId) { nextEntry.sessionId = params.newSessionId; - const storePath = typeof params.storePath === "string" ? params.storePath : rootDir; - nextEntry.sessionFile = path.join(path.dirname(storePath), `${params.newSessionId}.jsonl`); + if (typeof params.newSessionFile === "string" && params.newSessionFile) { + nextEntry.sessionFile = params.newSessionFile; + } else { + const storePath = typeof params.storePath === "string" ? params.storePath : rootDir; + nextEntry.sessionFile = path.join( + path.dirname(storePath), + `${params.newSessionId}.jsonl`, + ); + } } params.sessionStore[sessionKey] = nextEntry; if (typeof params.storePath === "string") { @@ -287,6 +294,76 @@ describe("runMemoryFlushIfNeeded", () => { ); }); + it("updates the active preflight run after transcript rotation", async () => { + const sessionFile = path.join(rootDir, "session.jsonl"); + const successorFile = path.join(rootDir, "session-rotated.jsonl"); + await fs.writeFile( + sessionFile, + `${JSON.stringify({ message: { role: "user", content: "x".repeat(5_000) } })}\n`, + "utf8", + ); + registerMemoryFlushPlanResolver(() => ({ + softThresholdTokens: 1, + forceFlushTranscriptBytes: 1_000_000_000, + reserveTokensFloor: 0, + prompt: "Pre-compaction memory flush.\nNO_REPLY", + systemPrompt: "Write memory to memory/YYYY-MM-DD.md.", + relativePath: "memory/2023-11-14.md", + })); + compactEmbeddedPiSessionMock.mockResolvedValueOnce({ + ok: true, + compacted: true, + result: { + tokensAfter: 42, + sessionId: "session-rotated", + sessionFile: successorFile, + }, + }); + const sessionEntry: SessionEntry = { + sessionId: "session", + sessionFile, + updatedAt: Date.now(), + totalTokensFresh: false, + }; + const sessionStore = { "agent:main:main": sessionEntry }; + const followupRun = createTestFollowupRun({ + sessionId: "session", + sessionFile, + sessionKey: "agent:main:main", + }); + const updateSessionId = vi.fn(); + const replyOperation = { + abortSignal: new AbortController().signal, + setPhase: vi.fn(), + updateSessionId, + } as never; + + const entry = await runPreflightCompactionIfNeeded({ + cfg: { agents: { defaults: { compaction: { memoryFlush: {} } } } }, + followupRun, + defaultModel: "anthropic/claude-opus-4-6", + agentCfgContextTokens: 100, + sessionEntry, + sessionStore, + sessionKey: "agent:main:main", + storePath: path.join(rootDir, "sessions.json"), + isHeartbeat: false, + replyOperation, + }); + + expect(entry?.sessionId).toBe("session-rotated"); + expect(entry?.sessionFile).toBe(successorFile); + expect(followupRun.run.sessionId).toBe("session-rotated"); + expect(followupRun.run.sessionFile).toBe(successorFile); + expect(updateSessionId).toHaveBeenCalledWith("session-rotated"); + expect(refreshQueuedFollowupSessionMock).toHaveBeenCalledWith({ + key: "agent:main:main", + previousSessionId: "session", + nextSessionId: "session-rotated", + nextSessionFile: successorFile, + }); + }); + it("uses configured prompts and stored bootstrap warning signatures", async () => { const sessionEntry: SessionEntry = { sessionId: "session", diff --git a/src/auto-reply/reply/agent-runner-memory.ts b/src/auto-reply/reply/agent-runner-memory.ts index 366e6febff7..640dbe18daa 100644 --- a/src/auto-reply/reply/agent-runner-memory.ts +++ b/src/auto-reply/reply/agent-runner-memory.ts @@ -514,6 +514,23 @@ export async function runPreflightCompactionIfNeeded(params: { followupRun: params.followupRun, }); entry = params.sessionStore?.[params.sessionKey] ?? entry; + if (entry) { + const previousSessionId = params.followupRun.run.sessionId; + params.followupRun.run.sessionId = entry.sessionId; + params.replyOperation.updateSessionId(entry.sessionId); + if (entry.sessionFile) { + params.followupRun.run.sessionFile = entry.sessionFile; + } + const queueKey = params.followupRun.run.sessionKey ?? params.sessionKey; + if (queueKey) { + memoryDeps.refreshQueuedFollowupSession({ + key: queueKey, + previousSessionId, + nextSessionId: entry.sessionId, + nextSessionFile: entry.sessionFile, + }); + } + } return entry ?? params.sessionEntry; } From 0b46227d6c84ef1a59d84a3174d1786a64a220a8 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 03:13:14 +0100 Subject: [PATCH 172/418] fix(ollama): keep configured max thinking compatible --- extensions/ollama/src/stream-runtime.test.ts | 29 ++++++++++++++++++++ extensions/ollama/src/stream.ts | 10 +++++-- 2 files changed, 37 insertions(+), 2 deletions(-) diff --git a/extensions/ollama/src/stream-runtime.test.ts b/extensions/ollama/src/stream-runtime.test.ts index a34862aaf4c..4fc712f26bd 100644 --- a/extensions/ollama/src/stream-runtime.test.ts +++ b/extensions/ollama/src/stream-runtime.test.ts @@ -1246,6 +1246,35 @@ describe("createOllamaStreamFn", () => { ); }); + it("maps configured native Ollama params.thinking=max to the stable top-level think value", async () => { + await withMockNdjsonFetch( + [ + '{"model":"m","created_at":"t","message":{"role":"assistant","content":"ok"},"done":false}', + '{"model":"m","created_at":"t","message":{"role":"assistant","content":""},"done":true,"prompt_eval_count":1,"eval_count":1}', + ], + async (fetchMock) => { + const stream = await createOllamaTestStream({ + baseUrl: "http://ollama-host:11434", + model: { params: { thinking: "max" } }, + }); + + const events = await collectStreamEvents(stream); + expect(events.at(-1)?.type).toBe("done"); + + const requestInit = getGuardedFetchCall(fetchMock).init ?? {}; + if (typeof requestInit.body !== "string") { + throw new Error("Expected string request body"); + } + const requestBody = JSON.parse(requestInit.body) as { + think?: string; + options?: { think?: string }; + }; + expect(requestBody.think).toBe("high"); + expect(requestBody.options?.think).toBeUndefined(); + }, + ); + }); + it("uses the default loopback policy when baseUrl is empty", async () => { await withMockNdjsonFetch( [ diff --git a/extensions/ollama/src/stream.ts b/extensions/ollama/src/stream.ts index 29fd46523d1..aeac03084c5 100644 --- a/extensions/ollama/src/stream.ts +++ b/extensions/ollama/src/stream.ts @@ -152,7 +152,7 @@ export function wrapOllamaCompatNumCtx(baseFn: StreamFn | undefined, numCtx: num }); } -type OllamaThinkValue = boolean | "low" | "medium" | "high" | "max"; +type OllamaThinkValue = boolean | "low" | "medium" | "high"; const OLLAMA_OPTION_PARAM_KEYS = new Set([ "num_keep", @@ -215,9 +215,15 @@ function resolveOllamaThinkParamValue( if (raw === "off") { return false; } - if (raw === "low" || raw === "medium" || raw === "high" || raw === "max") { + if (raw === "low" || raw === "medium" || raw === "high") { return raw; } + if (raw === "minimal") { + return "low"; + } + if (raw === "xhigh" || raw === "adaptive" || raw === "max") { + return "high"; + } return undefined; } From 90ad79cbcdc8f812a862581e604e9167e814b6d6 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 03:13:50 +0100 Subject: [PATCH 173/418] test(docker): generate update fixture ui asset --- scripts/e2e/update-channel-switch-docker.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/scripts/e2e/update-channel-switch-docker.sh b/scripts/e2e/update-channel-switch-docker.sh index 730ff942142..97b1e56e910 100755 --- a/scripts/e2e/update-channel-switch-docker.sh +++ b/scripts/e2e/update-channel-switch-docker.sh @@ -47,12 +47,14 @@ node - <<'"'"'NODE'"'"' const fs = require("node:fs"); const packageJsonPath = "/tmp/openclaw-git/package.json"; const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf8")); +const fixtureUiBuildSource = `const fs=require("node:fs");fs.mkdirSync("dist/control-ui",{recursive:true});fs.writeFileSync("dist/control-ui/index.html","fixture\\n")`; +const fixtureUiBuildCommand = `node -e ${JSON.stringify(fixtureUiBuildSource)}`; packageJson.pnpm = { ...packageJson.pnpm, allowUnusedPatches: true }; packageJson.scripts = { ...packageJson.scripts, build: "node -e \"console.log(\\\"fixture build skipped\\\")\"", lint: "node -e \"console.log(\\\"fixture lint skipped\\\")\"", - "ui:build": "node -e \"console.log(\\\"fixture ui build skipped\\\")\"", + "ui:build": fixtureUiBuildCommand, }; fs.writeFileSync(packageJsonPath, `${JSON.stringify(packageJson, null, 2)}\n`); fs.mkdirSync("/tmp/openclaw-git/dist/control-ui", { recursive: true }); From bd42f350978b8202f5f7b11855912820387ea3de Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 03:21:37 +0100 Subject: [PATCH 174/418] fix(ui): show configured thinking defaults --- CHANGELOG.md | 1 + ui/src/ui/chat-model.test-helpers.ts | 3 ++ ui/src/ui/views/chat.test.ts | 41 ++++++++++++++++++++++++++++ ui/src/ui/views/sessions.test.ts | 26 ++++++++++++++++++ ui/src/ui/views/sessions.ts | 3 +- 5 files changed, 73 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6c91c10fa6d..123944b43a7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -36,6 +36,7 @@ Docs: https://docs.openclaw.ai - Providers/Ollama: route local web search through Ollama's signed `/api/experimental/web_search` daemon proxy, use hosted `/api/web_search` directly for `ollama.com`, and keep `OLLAMA_API_KEY` scoped to cloud fallback auth. Fixes #69132. Thanks @yoon1012 and @hyspacex. - Memory/doctor: treat Ollama memory embeddings as key-optional so `openclaw doctor` no longer warns about a missing API key when the gateway reports embeddings are ready. Fixes #46584. Thanks @fengly78. - Agents/Ollama: apply provider-owned replay turn normalization to native Ollama chat so Cloud models no longer reject non-alternating replay history in agent/Gateway runs. Fixes #71697. Thanks @ismael-81. +- Control UI/Ollama: show the resolved configured thinking default in chat and session thinking dropdowns so inherited `adaptive`/per-model thinking config no longer appears as `Default (off)` or a generic inherit value. Fixes #72407. Thanks @NotecAG. - Agents/Ollama: validate explicit `--thinking max` against catalog-discovered Ollama reasoning metadata so local agent runs accept the same native thinking levels shown in the model catalog. Fixes #71584. Thanks @g0st1n. - CLI/models: include explicitly configured provider models in `openclaw models list --provider ` without requiring the full catalog path, so configured Ollama models are visible. Fixes #65207. Thanks @drzeast-png. - Docker/QA: add observability coverage to the normal Docker aggregate so QA-lab OTEL and Prometheus diagnostics run inside Docker. Thanks @vincentkoc. diff --git a/ui/src/ui/chat-model.test-helpers.ts b/ui/src/ui/chat-model.test-helpers.ts index 0c5f78c77d3..fb86798a989 100644 --- a/ui/src/ui/chat-model.test-helpers.ts +++ b/ui/src/ui/chat-model.test-helpers.ts @@ -63,6 +63,7 @@ export function createSessionsListResult( defaultsThinkingLevels?: SessionsListResult["defaults"]["thinkingLevels"]; defaultsThinkingOptions?: string[]; defaultsThinkingDefault?: string; + thinkingDefault?: string; omitSessionFromList?: boolean; } = {}, ): SessionsListResult { @@ -74,6 +75,7 @@ export function createSessionsListResult( defaultsThinkingLevels, defaultsThinkingOptions, defaultsThinkingDefault, + thinkingDefault, omitSessionFromList = false, } = params; @@ -95,6 +97,7 @@ export function createSessionsListResult( createMainSessionRow({ ...(modelProvider ? { modelProvider } : {}), ...(model ? { model } : {}), + ...(thinkingDefault ? { thinkingDefault } : {}), }), ], }; diff --git a/ui/src/ui/views/chat.test.ts b/ui/src/ui/views/chat.test.ts index 3a62433f1cd..5c82c0aa85e 100644 --- a/ui/src/ui/views/chat.test.ts +++ b/ui/src/ui/views/chat.test.ts @@ -180,6 +180,8 @@ function createChatHeaderState( model?: string | null; modelProvider?: string | null; models?: ModelCatalogEntry[]; + defaultsThinkingDefault?: string; + thinkingDefault?: string; omitSessionFromList?: boolean; } = {}, ): { state: AppViewState; request: ReturnType } { @@ -218,6 +220,8 @@ function createChatHeaderState( return createSessionsListResult({ model: currentModel, modelProvider: currentModelProvider, + defaultsThinkingDefault: overrides.defaultsThinkingDefault, + thinkingDefault: overrides.thinkingDefault, omitSessionFromList, }); } @@ -240,6 +244,8 @@ function createChatHeaderState( sessionsResult: createSessionsListResult({ model: currentModel, modelProvider: currentModelProvider, + defaultsThinkingDefault: overrides.defaultsThinkingDefault, + thinkingDefault: overrides.thinkingDefault, omitSessionFromList, }), chatModelOverrides: {}, @@ -704,4 +710,39 @@ describe("chat session controls", () => { ?.textContent?.trim(), ).toBe("maximum"); }); + + it("labels chat thinking default from the active session row", () => { + const { state } = createChatHeaderState({ + model: "gemma4:hermes-e4b", + modelProvider: "ollama", + thinkingDefault: "adaptive", + }); + const container = document.createElement("div"); + render(renderChatSessionSelect(state), container); + + const thinkingSelect = container.querySelector( + 'select[data-chat-thinking-select="true"]', + ); + + expect(thinkingSelect?.value).toBe(""); + expect(thinkingSelect?.options[0]?.textContent?.trim()).toBe("Default (adaptive)"); + expect(thinkingSelect?.title).toBe("Default (adaptive)"); + }); + + it("labels chat thinking default from session defaults when the row is absent", () => { + const { state } = createChatHeaderState({ + defaultsThinkingDefault: "adaptive", + omitSessionFromList: true, + }); + const container = document.createElement("div"); + render(renderChatSessionSelect(state), container); + + const thinkingSelect = container.querySelector( + 'select[data-chat-thinking-select="true"]', + ); + + expect(thinkingSelect?.value).toBe(""); + expect(thinkingSelect?.options[0]?.textContent?.trim()).toBe("Default (adaptive)"); + expect(thinkingSelect?.title).toBe("Default (adaptive)"); + }); }); diff --git a/ui/src/ui/views/sessions.test.ts b/ui/src/ui/views/sessions.test.ts index 74b9e495228..760facc4a09 100644 --- a/ui/src/ui/views/sessions.test.ts +++ b/ui/src/ui/views/sessions.test.ts @@ -109,6 +109,32 @@ describe("sessions view", () => { expect(onPatch).toHaveBeenCalledWith("agent:main:main", { thinkingLevel: "max" }); }); + it("labels inherited thinking with the resolved session default", async () => { + const container = document.createElement("div"); + render( + renderSessions( + buildProps( + buildResult({ + key: "agent:main:main", + kind: "direct", + updatedAt: Date.now(), + thinkingDefault: "adaptive", + thinkingLevels: [ + { id: "off", label: "off" }, + { id: "adaptive", label: "adaptive" }, + ], + }), + ), + ), + container, + ); + await Promise.resolve(); + + const thinking = container.querySelector("tbody select") as HTMLSelectElement | null; + expect(thinking?.value).toBe(""); + expect(thinking?.options[0]?.textContent?.trim()).toBe("Default (adaptive)"); + }); + it("keeps legacy binary thinking labels patching canonical ids", async () => { const container = document.createElement("div"); const onPatch = vi.fn(); diff --git a/ui/src/ui/views/sessions.ts b/ui/src/ui/views/sessions.ts index 2e8d50dec96..e5a475370b6 100644 --- a/ui/src/ui/views/sessions.ts +++ b/ui/src/ui/views/sessions.ts @@ -87,6 +87,7 @@ function normalizeThinkingOptionValue(raw: string): string { function resolveThinkLevelOptions( row: GatewaySessionRow, ): readonly { value: string; label: string }[] { + const defaultLabel = row.thinkingDefault ? `Default (${row.thinkingDefault})` : "inherit"; const options: readonly GatewayThinkingLevelOption[] = row.thinkingLevels?.length ? row.thinkingLevels : (row.thinkingOptions?.length ? row.thinkingOptions : DEFAULT_THINK_LEVELS).map((label) => ({ @@ -94,7 +95,7 @@ function resolveThinkLevelOptions( label, })); return [ - { value: "", label: "inherit" }, + { value: "", label: defaultLabel }, ...options.map((option) => ({ value: normalizeThinkingOptionValue(option.id), label: option.label, From b72c0bdfad7c6b0f95bd9dc3c849fa98c1d50da3 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 03:22:56 +0100 Subject: [PATCH 175/418] ci: force gemini api key auth in acp bind --- scripts/test-live-acp-bind-docker.sh | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/scripts/test-live-acp-bind-docker.sh b/scripts/test-live-acp-bind-docker.sh index 06d87742ae9..a8e145cb127 100644 --- a/scripts/test-live-acp-bind-docker.sh +++ b/scripts/test-live-acp-bind-docker.sh @@ -172,6 +172,32 @@ WRAP if [ ! -x "$NPM_CONFIG_PREFIX/bin/gemini" ]; then npm install -g @google/gemini-cli fi + if [ -n "${GEMINI_API_KEY:-}" ] || [ -n "${GOOGLE_API_KEY:-}" ]; then + gemini_auth_type="gemini-api-key" + if [ -z "${GEMINI_API_KEY:-}" ] && [ -n "${GOOGLE_API_KEY:-}" ]; then + gemini_auth_type="vertex-ai" + export GOOGLE_GENAI_USE_VERTEXAI="${GOOGLE_GENAI_USE_VERTEXAI:-true}" + fi + GEMINI_CLI_AUTH_TYPE="$gemini_auth_type" node <<'NODE' +const fs = require("node:fs"); +const os = require("node:os"); +const path = require("node:path"); + +const settingsPath = path.join(os.homedir(), ".gemini", "settings.json"); +let settings = {}; +try { + settings = JSON.parse(fs.readFileSync(settingsPath, "utf8")); +} catch {} +settings.security = settings.security && typeof settings.security === "object" ? settings.security : {}; +settings.security.auth = + settings.security.auth && typeof settings.security.auth === "object" ? settings.security.auth : {}; +settings.security.auth.selectedType = process.env.GEMINI_CLI_AUTH_TYPE; +settings.security.auth.enforcedType = process.env.GEMINI_CLI_AUTH_TYPE; +fs.mkdirSync(path.dirname(settingsPath), { recursive: true }); +fs.writeFileSync(settingsPath, `${JSON.stringify(settings, null, 2)}\n`); +NODE + echo "Using Gemini CLI auth type $gemini_auth_type" + fi ;; opencode) if [ ! -x "$NPM_CONFIG_PREFIX/bin/opencode" ]; then From a313c4db92bf4cb7494c7a8b18c5e6034936b8cc Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 19:04:51 -0700 Subject: [PATCH 176/418] chore(config): refresh bundled channel metadata --- docs/.generated/config-baseline.sha256 | 4 +- ...ndled-channel-config-metadata.generated.ts | 494 ++++++++++++++++++ 2 files changed, 496 insertions(+), 2 deletions(-) diff --git a/docs/.generated/config-baseline.sha256 b/docs/.generated/config-baseline.sha256 index 3a86622216c..237f6856ec9 100644 --- a/docs/.generated/config-baseline.sha256 +++ b/docs/.generated/config-baseline.sha256 @@ -1,4 +1,4 @@ -502a73267bd7195caf3fc4fb513e51a01bfd1c9567f8c22037ee10a11169a0bf config-baseline.json +29181dbaa26242ced515ba4c2b363853a24b5b2623b33ecfede252c2a984b7c6 config-baseline.json 2edac1da06bbb3709375bf82ae68890c67634f5ad3200a98a1d008b22c335e79 config-baseline.core.json -7cd9c908f066c143eab2a201efbc9640f483ab28bba92ddeca1d18cc2b528bc3 config-baseline.channel.json +07963db49502132f26db396c56b36e018b110e6c55a68b3cb012d3ec96f43901 config-baseline.channel.json 74b74cb18ac37c0acaa765f398f1f9edbcee4c43567f02d45c89598a1e13afb4 config-baseline.plugin.json diff --git a/src/config/bundled-channel-config-metadata.generated.ts b/src/config/bundled-channel-config-metadata.generated.ts index 575c97f4f33..7843f16c159 100644 --- a/src/config/bundled-channel-config-metadata.generated.ts +++ b/src/config/bundled-channel-config-metadata.generated.ts @@ -1502,6 +1502,181 @@ export const GENERATED_BUNDLED_CHANNEL_CONFIG_METADATA = [ type: "string", minLength: 1, }, + persona: { + type: "string", + }, + personas: { + type: "object", + propertyNames: { + type: "string", + }, + additionalProperties: { + type: "object", + properties: { + label: { + type: "string", + }, + description: { + type: "string", + }, + provider: { + type: "string", + minLength: 1, + }, + fallbackPolicy: { + anyOf: [ + { + type: "string", + const: "preserve-persona", + }, + { + type: "string", + const: "provider-defaults", + }, + { + type: "string", + const: "fail", + }, + ], + }, + prompt: { + type: "object", + properties: { + profile: { + type: "string", + }, + scene: { + type: "string", + }, + sampleContext: { + type: "string", + }, + style: { + type: "string", + }, + accent: { + type: "string", + }, + pacing: { + type: "string", + }, + constraints: { + type: "array", + items: { + type: "string", + }, + }, + }, + additionalProperties: false, + }, + providers: { + type: "object", + propertyNames: { + type: "string", + }, + additionalProperties: { + type: "object", + properties: { + apiKey: { + anyOf: [ + { + type: "string", + }, + { + oneOf: [ + { + type: "object", + properties: { + source: { + type: "string", + const: "env", + }, + provider: { + type: "string", + pattern: "^[a-z][a-z0-9_-]{0,63}$", + }, + id: { + type: "string", + pattern: "^[A-Z][A-Z0-9_]{0,127}$", + }, + }, + required: ["source", "provider", "id"], + additionalProperties: false, + }, + { + type: "object", + properties: { + source: { + type: "string", + const: "file", + }, + provider: { + type: "string", + pattern: "^[a-z][a-z0-9_-]{0,63}$", + }, + id: { + type: "string", + }, + }, + required: ["source", "provider", "id"], + additionalProperties: false, + }, + { + type: "object", + properties: { + source: { + type: "string", + const: "exec", + }, + provider: { + type: "string", + pattern: "^[a-z][a-z0-9_-]{0,63}$", + }, + id: { + type: "string", + }, + }, + required: ["source", "provider", "id"], + additionalProperties: false, + }, + ], + }, + ], + }, + }, + additionalProperties: { + anyOf: [ + { + type: "string", + }, + { + type: "number", + }, + { + type: "boolean", + }, + { + type: "null", + }, + { + type: "array", + items: {}, + }, + { + type: "object", + propertyNames: { + type: "string", + }, + additionalProperties: {}, + }, + ], + }, + }, + }, + }, + additionalProperties: false, + }, + }, summaryModel: { type: "string", }, @@ -2682,6 +2857,181 @@ export const GENERATED_BUNDLED_CHANNEL_CONFIG_METADATA = [ type: "string", minLength: 1, }, + persona: { + type: "string", + }, + personas: { + type: "object", + propertyNames: { + type: "string", + }, + additionalProperties: { + type: "object", + properties: { + label: { + type: "string", + }, + description: { + type: "string", + }, + provider: { + type: "string", + minLength: 1, + }, + fallbackPolicy: { + anyOf: [ + { + type: "string", + const: "preserve-persona", + }, + { + type: "string", + const: "provider-defaults", + }, + { + type: "string", + const: "fail", + }, + ], + }, + prompt: { + type: "object", + properties: { + profile: { + type: "string", + }, + scene: { + type: "string", + }, + sampleContext: { + type: "string", + }, + style: { + type: "string", + }, + accent: { + type: "string", + }, + pacing: { + type: "string", + }, + constraints: { + type: "array", + items: { + type: "string", + }, + }, + }, + additionalProperties: false, + }, + providers: { + type: "object", + propertyNames: { + type: "string", + }, + additionalProperties: { + type: "object", + properties: { + apiKey: { + anyOf: [ + { + type: "string", + }, + { + oneOf: [ + { + type: "object", + properties: { + source: { + type: "string", + const: "env", + }, + provider: { + type: "string", + pattern: "^[a-z][a-z0-9_-]{0,63}$", + }, + id: { + type: "string", + pattern: "^[A-Z][A-Z0-9_]{0,127}$", + }, + }, + required: ["source", "provider", "id"], + additionalProperties: false, + }, + { + type: "object", + properties: { + source: { + type: "string", + const: "file", + }, + provider: { + type: "string", + pattern: "^[a-z][a-z0-9_-]{0,63}$", + }, + id: { + type: "string", + }, + }, + required: ["source", "provider", "id"], + additionalProperties: false, + }, + { + type: "object", + properties: { + source: { + type: "string", + const: "exec", + }, + provider: { + type: "string", + pattern: "^[a-z][a-z0-9_-]{0,63}$", + }, + id: { + type: "string", + }, + }, + required: ["source", "provider", "id"], + additionalProperties: false, + }, + ], + }, + ], + }, + }, + additionalProperties: { + anyOf: [ + { + type: "string", + }, + { + type: "number", + }, + { + type: "boolean", + }, + { + type: "null", + }, + { + type: "array", + items: {}, + }, + { + type: "object", + propertyNames: { + type: "string", + }, + additionalProperties: {}, + }, + ], + }, + }, + }, + }, + additionalProperties: false, + }, + }, summaryModel: { type: "string", }, @@ -3792,6 +4142,78 @@ export const GENERATED_BUNDLED_CHANNEL_CONFIG_METADATA = [ default: true, type: "boolean", }, + tts: { + type: "object", + properties: { + auto: { + type: "string", + enum: ["off", "always", "inbound", "tagged"], + }, + enabled: { + type: "boolean", + }, + mode: { + type: "string", + enum: ["final", "all"], + }, + provider: { + type: "string", + }, + persona: { + type: "string", + }, + personas: { + type: "object", + propertyNames: { + type: "string", + }, + additionalProperties: { + type: "object", + propertyNames: { + type: "string", + }, + additionalProperties: {}, + }, + }, + summaryModel: { + type: "string", + }, + modelOverrides: { + type: "object", + propertyNames: { + type: "string", + }, + additionalProperties: {}, + }, + providers: { + type: "object", + propertyNames: { + type: "string", + }, + additionalProperties: { + type: "object", + propertyNames: { + type: "string", + }, + additionalProperties: {}, + }, + }, + prefsPath: { + type: "string", + }, + maxTextLength: { + type: "integer", + minimum: 1, + maximum: 9007199254740991, + }, + timeoutMs: { + type: "integer", + minimum: 1000, + maximum: 120000, + }, + }, + additionalProperties: false, + }, groupSessionScope: { type: "string", enum: ["group", "group_sender", "group_topic", "group_topic_sender"], @@ -4345,6 +4767,78 @@ export const GENERATED_BUNDLED_CHANNEL_CONFIG_METADATA = [ resolveSenderNames: { type: "boolean", }, + tts: { + type: "object", + properties: { + auto: { + type: "string", + enum: ["off", "always", "inbound", "tagged"], + }, + enabled: { + type: "boolean", + }, + mode: { + type: "string", + enum: ["final", "all"], + }, + provider: { + type: "string", + }, + persona: { + type: "string", + }, + personas: { + type: "object", + propertyNames: { + type: "string", + }, + additionalProperties: { + type: "object", + propertyNames: { + type: "string", + }, + additionalProperties: {}, + }, + }, + summaryModel: { + type: "string", + }, + modelOverrides: { + type: "object", + propertyNames: { + type: "string", + }, + additionalProperties: {}, + }, + providers: { + type: "object", + propertyNames: { + type: "string", + }, + additionalProperties: { + type: "object", + propertyNames: { + type: "string", + }, + additionalProperties: {}, + }, + }, + prefsPath: { + type: "string", + }, + maxTextLength: { + type: "integer", + minimum: 1, + maximum: 9007199254740991, + }, + timeoutMs: { + type: "integer", + minimum: 1000, + maximum: 120000, + }, + }, + additionalProperties: false, + }, groupSessionScope: { type: "string", enum: ["group", "group_sender", "group_topic", "group_topic_sender"], From a5f6603e61762d9f11073a851a08ed42f7c838ae Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 19:05:09 -0700 Subject: [PATCH 177/418] fix(release): clarify control ui build requirement --- scripts/release-check.ts | 35 ++++++++++++++++++++++++----------- test/release-check.test.ts | 27 +++++++++++++++++++++++++++ 2 files changed, 51 insertions(+), 11 deletions(-) diff --git a/scripts/release-check.ts b/scripts/release-check.ts index ea039f7d2fc..7f598ada691 100755 --- a/scripts/release-check.ts +++ b/scripts/release-check.ts @@ -590,6 +590,27 @@ export function collectMissingPackPaths(paths: Iterable): string[] { .toSorted((left, right) => left.localeCompare(right)); } +export function resolveMissingPackBuildHint(missing: readonly string[]): string | null { + const needsControlUiBuild = missing.includes("dist/control-ui/index.html"); + const needsRuntimeBuild = missing.some( + (path) => + path !== "dist/control-ui/index.html" && + (path === "dist/build-info.json" || path.startsWith("dist/")), + ); + + if (!needsControlUiBuild && !needsRuntimeBuild) { + return null; + } + + if (needsControlUiBuild && needsRuntimeBuild) { + return "release-check: build and Control UI artifacts are missing. Run `pnpm build && pnpm ui:build` before `pnpm release:check`."; + } + if (needsControlUiBuild) { + return "release-check: Control UI artifacts are missing. Run `pnpm ui:build` before `pnpm release:check`."; + } + return "release-check: build artifacts are missing. Run `pnpm build` before `pnpm release:check`."; +} + export function collectForbiddenPackPaths(paths: Iterable): string[] { return [...paths] .filter( @@ -817,17 +838,9 @@ async function main() { for (const path of missing) { console.error(` - ${path}`); } - if ( - missing.some( - (path) => - path === "dist/build-info.json" || - path === "dist/control-ui/index.html" || - path.startsWith("dist/"), - ) - ) { - console.error( - "release-check: build artifacts are missing. Run `pnpm build` before `pnpm release:check`.", - ); + const buildHint = resolveMissingPackBuildHint(missing); + if (buildHint) { + console.error(buildHint); } } if (forbidden.length > 0) { diff --git a/test/release-check.test.ts b/test/release-check.test.ts index a92d5449646..f3fae32e6cf 100644 --- a/test/release-check.test.ts +++ b/test/release-check.test.ts @@ -21,6 +21,7 @@ import { createPackedBundledPluginPostinstallEnv, PACKED_CLI_SMOKE_COMMANDS, packageNameFromSpecifier, + resolveMissingPackBuildHint, } from "../scripts/release-check.ts"; import { PACKAGE_DIST_INVENTORY_RELATIVE_PATH } from "../src/infra/package-dist-inventory.ts"; import { bundledDistPluginFile, bundledPluginFile } from "./helpers/bundled-plugin-paths.js"; @@ -585,6 +586,32 @@ describe("collectMissingPackPaths", () => { }); }); +describe("resolveMissingPackBuildHint", () => { + it("points missing runtime build artifacts at pnpm build", () => { + expect(resolveMissingPackBuildHint(["dist/build-info.json"])).toBe( + "release-check: build artifacts are missing. Run `pnpm build` before `pnpm release:check`.", + ); + }); + + it("points missing Control UI artifacts at pnpm ui:build", () => { + expect(resolveMissingPackBuildHint(["dist/control-ui/index.html"])).toBe( + "release-check: Control UI artifacts are missing. Run `pnpm ui:build` before `pnpm release:check`.", + ); + }); + + it("points combined runtime and Control UI misses at both build commands", () => { + expect( + resolveMissingPackBuildHint(["dist/build-info.json", "dist/control-ui/index.html"]), + ).toBe( + "release-check: build and Control UI artifacts are missing. Run `pnpm build && pnpm ui:build` before `pnpm release:check`.", + ); + }); + + it("does not emit a build hint for unrelated packed paths", () => { + expect(resolveMissingPackBuildHint(["scripts/npm-runner.mjs"])).toBeNull(); + }); +}); + describe("collectPackUnpackedSizeErrors", () => { it("accepts pack results within the unpacked size budget", () => { expect( From ead76f61d87e8e9aead1ccd59cd1855085a862bb Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 19:05:26 -0700 Subject: [PATCH 178/418] fix(cli): skip plugin preload for plugin updates --- src/cli/program/register.subclis-core.ts | 11 ++++++-- src/cli/program/register.subclis.test.ts | 35 ++++++++++++++++++++++++ 2 files changed, 43 insertions(+), 3 deletions(-) diff --git a/src/cli/program/register.subclis-core.ts b/src/cli/program/register.subclis-core.ts index 066b0410c02..80176ced24f 100644 --- a/src/cli/program/register.subclis-core.ts +++ b/src/cli/program/register.subclis-core.ts @@ -1,5 +1,6 @@ import type { Command } from "commander"; import { resolveCliArgvInvocation } from "../argv-invocation.js"; +import { resolveCliCommandPathPolicy } from "../command-path-policy.js"; import { shouldEagerRegisterSubcommands, shouldRegisterPrimarySubcommandOnly, @@ -30,13 +31,17 @@ async function registerSubCliWithPluginCommands( registerSubCli: () => Promise, pluginCliPosition: "before" | "after", ) { - const isHelpOrVersion = resolveCliArgvInvocation(process.argv).hasHelpOrVersion; + const invocation = resolveCliArgvInvocation(process.argv); + const shouldRegisterPluginCommands = + !invocation.hasHelpOrVersion && + (invocation.commandPath.length <= 1 || + resolveCliCommandPathPolicy(invocation.commandPath).loadPlugins !== "never"); const { registerPluginCliCommandsFromValidatedConfig } = await import("../../plugins/cli.js"); - if (pluginCliPosition === "before" && !isHelpOrVersion) { + if (pluginCliPosition === "before" && shouldRegisterPluginCommands) { await registerPluginCliCommandsFromValidatedConfig(program); } await registerSubCli(); - if (pluginCliPosition === "after" && !isHelpOrVersion) { + if (pluginCliPosition === "after" && shouldRegisterPluginCommands) { await registerPluginCliCommandsFromValidatedConfig(program); } } diff --git a/src/cli/program/register.subclis.test.ts b/src/cli/program/register.subclis.test.ts index 6720eb3424f..fd3b3053947 100644 --- a/src/cli/program/register.subclis.test.ts +++ b/src/cli/program/register.subclis.test.ts @@ -37,9 +37,22 @@ const { inferAction, registerCapabilityCli } = vi.hoisted(() => { return { inferAction: action, registerCapabilityCli: register }; }); +const { registerPluginsCli, registerPluginCliCommandsFromValidatedConfig } = vi.hoisted(() => ({ + registerPluginsCli: vi.fn((program: Command) => { + const plugins = program.command("plugins"); + plugins + .command("update") + .argument("[id]") + .action(() => undefined); + }), + registerPluginCliCommandsFromValidatedConfig: vi.fn(async () => null), +})); + vi.mock("../acp-cli.js", () => ({ registerAcpCli })); vi.mock("../nodes-cli.js", () => ({ registerNodesCli })); vi.mock("../capability-cli.js", () => ({ registerCapabilityCli })); +vi.mock("../plugins-cli.js", () => ({ registerPluginsCli })); +vi.mock("../../plugins/cli.js", () => ({ registerPluginCliCommandsFromValidatedConfig })); vi.mock("./private-qa-cli.js", async () => { const actual = await vi.importActual("./private-qa-cli.js"); return { @@ -78,6 +91,8 @@ describe("registerSubCliCommands", () => { loadPrivateQaCliModule.mockClear(); registerCapabilityCli.mockClear(); inferAction.mockClear(); + registerPluginsCli.mockClear(); + registerPluginCliCommandsFromValidatedConfig.mockClear(); }); afterEach(() => { @@ -158,4 +173,24 @@ describe("registerSubCliCommands", () => { expect(registerAcpCli).toHaveBeenCalledTimes(1); expect(acpAction).toHaveBeenCalledTimes(1); }); + + it("does not preload plugin CLI registrations for builtin plugins update", async () => { + process.argv = ["node", "openclaw", "plugins", "update", "lossless-claw"]; + const program = new Command().name("openclaw"); + + await registerSubCliByName(program, "plugins"); + + expect(registerPluginsCli).toHaveBeenCalledTimes(1); + expect(registerPluginCliCommandsFromValidatedConfig).not.toHaveBeenCalled(); + }); + + it("keeps plugin CLI registrations available for the plugins command root", async () => { + process.argv = ["node", "openclaw", "plugins"]; + const program = new Command().name("openclaw"); + + await registerSubCliByName(program, "plugins"); + + expect(registerPluginsCli).toHaveBeenCalledTimes(1); + expect(registerPluginCliCommandsFromValidatedConfig).toHaveBeenCalledTimes(1); + }); }); From ae89d447606c2d14165366503047adcbce56e55e Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 19:16:21 -0700 Subject: [PATCH 179/418] chore(plugin-sdk): refresh api baseline --- docs/.generated/plugin-sdk-api-baseline.sha256 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/.generated/plugin-sdk-api-baseline.sha256 b/docs/.generated/plugin-sdk-api-baseline.sha256 index 5d6211c3505..2d76d9b4abf 100644 --- a/docs/.generated/plugin-sdk-api-baseline.sha256 +++ b/docs/.generated/plugin-sdk-api-baseline.sha256 @@ -1,2 +1,2 @@ -ba5191d586958233c69921928e4d13ae6e8af61e26cf57eec6f50c5d551d8b43 plugin-sdk-api-baseline.json -e6fc8ea33cfc6251a080c3a49d0db2e7d82c117f412902c79da359ebbc9197cc plugin-sdk-api-baseline.jsonl +2a3fb85feb7420de8b166a695c3693dcc1eaa7a7f31de0dd139da856f10b2085 plugin-sdk-api-baseline.json +6bdb96f7f92c34d7ae698784c0073343c34fb4274ab7eeded49acebb81056074 plugin-sdk-api-baseline.jsonl From dc78d584482c18e25ef29925d1d86f323df9b95e Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 03:28:14 +0100 Subject: [PATCH 180/418] fix(ollama): honor baseURL provider aliases --- CHANGELOG.md | 1 + docs/providers/ollama.md | 2 + docs/tools/ollama-search.md | 2 + extensions/ollama/index.test.ts | 70 +++++++++++++++++++ extensions/ollama/index.ts | 6 +- extensions/ollama/src/discovery-shared.ts | 13 ++-- .../ollama/src/embedding-provider.test.ts | 27 +++++++ extensions/ollama/src/embedding-provider.ts | 3 +- .../ollama/src/provider-base-url.test.ts | 44 ++++++++++++ extensions/ollama/src/provider-base-url.ts | 23 ++++++ extensions/ollama/src/setup.test.ts | 32 +++++++++ extensions/ollama/src/setup.ts | 4 +- .../ollama/src/web-search-provider.test.ts | 12 ++++ extensions/ollama/src/web-search-provider.ts | 5 +- 14 files changed, 231 insertions(+), 13 deletions(-) create mode 100644 extensions/ollama/src/provider-base-url.test.ts create mode 100644 extensions/ollama/src/provider-base-url.ts diff --git a/CHANGELOG.md b/CHANGELOG.md index 123944b43a7..72ed22a1c91 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -34,6 +34,7 @@ Docs: https://docs.openclaw.ai - Providers/Ollama: skip ambient localhost discovery unless Ollama auth or meaningful config opts in, preventing unexpected probes to `127.0.0.1:11434` for users who are not using Ollama. Fixes #56939; supersedes #57116. Thanks @IanxDev and @tsukhani. - Providers/Ollama: move memory embeddings to Ollama's current `/api/embed` endpoint with batched `input` requests while preserving vector normalization and custom provider auth/header overrides. Fixes #39983. Thanks @sskkcc and @LiudengZhang. - Providers/Ollama: route local web search through Ollama's signed `/api/experimental/web_search` daemon proxy, use hosted `/api/web_search` directly for `ollama.com`, and keep `OLLAMA_API_KEY` scoped to cloud fallback auth. Fixes #69132. Thanks @yoon1012 and @hyspacex. +- Providers/Ollama: accept OpenAI SDK-style `baseURL` as an alias for `baseUrl` across discovery, streaming, setup pulls, embeddings, and web search so remote Ollama hosts are not silently ignored. Fixes #62533; supersedes #62549. Thanks @Julien-BKK and @Linux2010. - Memory/doctor: treat Ollama memory embeddings as key-optional so `openclaw doctor` no longer warns about a missing API key when the gateway reports embeddings are ready. Fixes #46584. Thanks @fengly78. - Agents/Ollama: apply provider-owned replay turn normalization to native Ollama chat so Cloud models no longer reject non-alternating replay history in agent/Gateway runs. Fixes #71697. Thanks @ismael-81. - Control UI/Ollama: show the resolved configured thinking default in chat and session thinking dropdowns so inherited `adaptive`/per-model thinking config no longer appears as `Default (off)` or a generic inherit value. Fixes #72407. Thanks @NotecAG. diff --git a/docs/providers/ollama.md b/docs/providers/ollama.md index acd8c1a5e8e..d7e66573eb0 100644 --- a/docs/providers/ollama.md +++ b/docs/providers/ollama.md @@ -13,6 +13,8 @@ OpenClaw integrates with Ollama's native API (`/api/chat`) for hosted cloud mode **Remote Ollama users**: Do not use the `/v1` OpenAI-compatible URL (`http://host:11434/v1`) with OpenClaw. This breaks tool calling and models may output raw tool JSON as plain text. Use the native Ollama API URL instead: `baseUrl: "http://host:11434"` (no `/v1`). +Ollama provider config uses `baseUrl` as the canonical key. OpenClaw also accepts `baseURL` for compatibility with OpenAI SDK-style examples, but new config should prefer `baseUrl`. + ## Getting started Choose your preferred setup method and mode. diff --git a/docs/tools/ollama-search.md b/docs/tools/ollama-search.md index 2b159e148c6..3086863ce14 100644 --- a/docs/tools/ollama-search.md +++ b/docs/tools/ollama-search.md @@ -97,6 +97,8 @@ reuse that host instead: } ``` +The Ollama model provider uses `baseUrl` as the canonical key. The web-search provider also honors `baseURL` on `models.providers.ollama` for compatibility with OpenAI SDK-style config examples. + If no explicit Ollama base URL is set, OpenClaw uses `http://127.0.0.1:11434`. If your Ollama host expects bearer auth, OpenClaw reuses diff --git a/extensions/ollama/index.test.ts b/extensions/ollama/index.test.ts index 4a7f5931a9b..5463650e689 100644 --- a/extensions/ollama/index.test.ts +++ b/extensions/ollama/index.test.ts @@ -312,6 +312,36 @@ describe("ollama plugin", () => { }); }); + it("accepts baseURL alias as explicit discovery config", async () => { + const provider = registerProvider(); + buildOllamaProviderMock.mockResolvedValueOnce({ + baseUrl: "http://remote-ollama:11434", + api: "ollama", + models: [], + }); + + const result = await provider.discovery.run({ + config: { + models: { + providers: { + ollama: { + baseURL: "http://remote-ollama:11434", + api: "ollama", + models: [], + }, + }, + }, + }, + env: { NODE_ENV: "development" }, + resolveProviderApiKey: () => ({ apiKey: "" }), + } as never); + + expect(result).toBeNull(); + expect(buildOllamaProviderMock).toHaveBeenCalledWith("http://remote-ollama:11434", { + quiet: false, + }); + }); + it("keeps stored ollama-local marker auth on the quiet ambient path", async () => { const provider = registerProvider(); buildOllamaProviderMock.mockResolvedValueOnce({ @@ -371,6 +401,24 @@ describe("ollama plugin", () => { }); }); + it("mints synthetic auth for non-default baseURL alias config", () => { + const provider = registerProvider(); + + const auth = provider.resolveSyntheticAuth?.({ + providerConfig: { + baseURL: "http://remote-ollama:11434", + api: "ollama", + models: [], + } as never, + }); + + expect(auth).toEqual({ + apiKey: "ollama-local", + source: "models.providers.ollama (synthetic local key)", + mode: "api-key", + }); + }); + it("wraps OpenAI-compatible payloads with num_ctx for Ollama compat routes", () => { const provider = registerProvider(); let payloadSeen: Record | undefined; @@ -513,6 +561,28 @@ describe("ollama plugin", () => { ); }); + it("routes createStreamFn through baseURL alias for custom Ollama providers", () => { + const provider = registerProvider(); + const config = { + models: { + providers: { + ollama2: { + api: "ollama", + baseURL: "http://127.0.0.1:11435", + models: [], + }, + }, + }, + }; + const model = { id: "llama3.2", provider: "ollama2", baseUrl: undefined }; + + provider.createStreamFn?.({ config, model, provider: "ollama2" } as never); + + expect(createConfiguredOllamaStreamFnMock).toHaveBeenCalledWith( + expect.objectContaining({ providerBaseUrl: "http://127.0.0.1:11435" }), + ); + }); + it("uses ollama provider baseUrl when provider is ollama (backward compat)", () => { const provider = registerProvider(); const config = { diff --git a/extensions/ollama/index.ts b/extensions/ollama/index.ts index 4ca916d7d64..24f186b9af5 100644 --- a/extensions/ollama/index.ts +++ b/extensions/ollama/index.ts @@ -31,6 +31,7 @@ import { } from "./src/embedding-provider.js"; import { ollamaMediaUnderstandingProvider } from "./src/media-understanding-provider.js"; import { ollamaMemoryEmbeddingProviderAdapter } from "./src/memory-embedding-adapter.js"; +import { readProviderBaseUrl } from "./src/provider-base-url.js"; import { createConfiguredOllamaCompatStreamWrapper, createConfiguredOllamaStreamFn, @@ -161,8 +162,9 @@ export default definePluginEntry({ createStreamFn: ({ config, model, provider }) => { return createConfiguredOllamaStreamFn({ model, - providerBaseUrl: resolveConfiguredOllamaProviderConfig({ config, providerId: provider }) - ?.baseUrl, + providerBaseUrl: readProviderBaseUrl( + resolveConfiguredOllamaProviderConfig({ config, providerId: provider }), + ), }); }, ...OPENAI_COMPATIBLE_REPLAY_HOOKS, diff --git a/extensions/ollama/src/discovery-shared.ts b/extensions/ollama/src/discovery-shared.ts index b45dee32ba9..23108ad6e08 100644 --- a/extensions/ollama/src/discovery-shared.ts +++ b/extensions/ollama/src/discovery-shared.ts @@ -1,5 +1,6 @@ import type { ModelProviderConfig } from "openclaw/plugin-sdk/provider-model-shared"; import { OLLAMA_DEFAULT_BASE_URL } from "./defaults.js"; +import { readProviderBaseUrl } from "./provider-base-url.js"; import { resolveOllamaApiBase } from "./provider-models.js"; export const OLLAMA_PROVIDER_ID = "ollama"; @@ -63,8 +64,9 @@ export function hasMeaningfulExplicitOllamaConfig( if (Array.isArray(providerConfig.models) && providerConfig.models.length > 0) { return true; } - if (typeof providerConfig.baseUrl === "string" && providerConfig.baseUrl.trim()) { - return resolveOllamaApiBase(providerConfig.baseUrl) !== OLLAMA_DEFAULT_BASE_URL; + const baseUrl = readProviderBaseUrl(providerConfig); + if (baseUrl) { + return resolveOllamaApiBase(baseUrl) !== OLLAMA_DEFAULT_BASE_URL; } if (readStringValue(providerConfig.apiKey)) { return true; @@ -118,10 +120,7 @@ export async function resolveOllamaDiscoveryResult(params: { return { provider: { ...explicit, - baseUrl: - typeof explicit.baseUrl === "string" && explicit.baseUrl.trim() - ? resolveOllamaApiBase(explicit.baseUrl) - : OLLAMA_DEFAULT_BASE_URL, + baseUrl: resolveOllamaApiBase(readProviderBaseUrl(explicit) ?? OLLAMA_DEFAULT_BASE_URL), api: explicit.api ?? "ollama", apiKey: resolveOllamaDiscoveryApiKey({ env: params.ctx.env, @@ -142,7 +141,7 @@ export async function resolveOllamaDiscoveryResult(params: { return null; } - const provider = await params.buildProvider(explicit?.baseUrl, { + const provider = await params.buildProvider(readProviderBaseUrl(explicit), { quiet: !hasRealOllamaKey && !hasMeaningfulExplicitConfig, }); if (provider.models?.length === 0 && !ollamaKey && !explicit?.apiKey) { diff --git a/extensions/ollama/src/embedding-provider.test.ts b/extensions/ollama/src/embedding-provider.test.ts index 533ecd3e8e8..e0b9441661e 100644 --- a/extensions/ollama/src/embedding-provider.test.ts +++ b/extensions/ollama/src/embedding-provider.test.ts @@ -109,6 +109,33 @@ describe("ollama embedding provider", () => { ); }); + it("resolves configured baseURL alias", async () => { + const fetchMock = mockEmbeddingFetch([1, 0]); + + const { provider } = await createOllamaEmbeddingProvider({ + config: { + models: { + providers: { + ollama: { + baseURL: "http://remote-ollama:11434/v1", + models: [], + }, + }, + }, + } as unknown as OpenClawConfig, + provider: "ollama", + model: "nomic-embed-text", + fallback: "none", + }); + + await provider.embedQuery("hello"); + + expect(fetchMock).toHaveBeenCalledWith( + "http://remote-ollama:11434/api/embed", + expect.objectContaining({ method: "POST" }), + ); + }); + it("fails fast when memory-search remote apiKey is an unresolved SecretRef", async () => { await expect( createOllamaEmbeddingProvider({ diff --git a/extensions/ollama/src/embedding-provider.ts b/extensions/ollama/src/embedding-provider.ts index 68753fc1f07..b9351d3097d 100644 --- a/extensions/ollama/src/embedding-provider.ts +++ b/extensions/ollama/src/embedding-provider.ts @@ -13,6 +13,7 @@ import { type SsrFPolicy, } from "openclaw/plugin-sdk/ssrf-runtime"; import { normalizeOllamaWireModelId } from "./model-id.js"; +import { readProviderBaseUrl } from "./provider-base-url.js"; import { resolveOllamaApiBase } from "./provider-models.js"; export type OllamaEmbeddingProvider = { @@ -138,7 +139,7 @@ function resolveOllamaEmbeddingClient( options: OllamaEmbeddingOptions, ): OllamaEmbeddingClientConfig { const providerConfig = resolveConfiguredProvider(options); - const rawBaseUrl = options.remote?.baseUrl?.trim() || providerConfig?.baseUrl?.trim(); + const rawBaseUrl = options.remote?.baseUrl?.trim() || readProviderBaseUrl(providerConfig); const baseUrl = resolveOllamaApiBase(rawBaseUrl); const model = normalizeEmbeddingModel(options.model, options.provider); const headerOverrides = Object.assign({}, providerConfig?.headers, options.remote?.headers); diff --git a/extensions/ollama/src/provider-base-url.test.ts b/extensions/ollama/src/provider-base-url.test.ts new file mode 100644 index 00000000000..51c812bfa8c --- /dev/null +++ b/extensions/ollama/src/provider-base-url.test.ts @@ -0,0 +1,44 @@ +import { describe, expect, it } from "vitest"; +import { readProviderBaseUrl } from "./provider-base-url.js"; + +describe("readProviderBaseUrl", () => { + it("reads canonical baseUrl and trims whitespace", () => { + expect(readProviderBaseUrl({ baseUrl: " http://host:11434/v1 ", models: [] })).toBe( + "http://host:11434/v1", + ); + }); + + it("falls back to OpenAI SDK-style baseURL", () => { + const provider = { + baseURL: " http://remote-ollama:11434 ", + models: [], + } as unknown as Parameters[0]; + + expect(readProviderBaseUrl(provider)).toBe("http://remote-ollama:11434"); + }); + + it("prefers canonical baseUrl over baseURL", () => { + const provider = { + baseUrl: "http://canonical:11434", + baseURL: "http://alternate:11434", + models: [], + } as unknown as Parameters[0]; + + expect(readProviderBaseUrl(provider)).toBe("http://canonical:11434"); + }); + + it("ignores inherited baseUrl aliases", () => { + const provider = { models: [] } as unknown as Parameters[0]; + Object.setPrototypeOf(provider, { baseUrl: "http://inherited:11434" }); + + expect(readProviderBaseUrl(provider)).toBeUndefined(); + }); + + it("returns undefined for empty or missing values", () => { + expect(readProviderBaseUrl(undefined)).toBeUndefined(); + expect( + readProviderBaseUrl({ models: [] } as unknown as Parameters[0]), + ).toBeUndefined(); + expect(readProviderBaseUrl({ baseUrl: " ", models: [] })).toBeUndefined(); + }); +}); diff --git a/extensions/ollama/src/provider-base-url.ts b/extensions/ollama/src/provider-base-url.ts new file mode 100644 index 00000000000..0d250cf05af --- /dev/null +++ b/extensions/ollama/src/provider-base-url.ts @@ -0,0 +1,23 @@ +import type { ModelProviderConfig } from "openclaw/plugin-sdk/provider-model-shared"; + +export function readProviderBaseUrl(provider: ModelProviderConfig | undefined): string | undefined { + if (!provider) { + return undefined; + } + if ( + Object.hasOwn(provider, "baseUrl") && + typeof provider.baseUrl === "string" && + provider.baseUrl.trim() + ) { + return provider.baseUrl.trim(); + } + const alternate = provider as ModelProviderConfig & { baseURL?: unknown }; + if ( + Object.hasOwn(alternate, "baseURL") && + typeof alternate.baseURL === "string" && + alternate.baseURL.trim() + ) { + return alternate.baseURL.trim(); + } + return undefined; +} diff --git a/extensions/ollama/src/setup.test.ts b/extensions/ollama/src/setup.test.ts index 46c5d95679a..926f2b690b0 100644 --- a/extensions/ollama/src/setup.test.ts +++ b/extensions/ollama/src/setup.test.ts @@ -434,6 +434,38 @@ describe("ollama setup", () => { expect(fetchMock).toHaveBeenCalledTimes(1); }); + it("uses baseURL alias when checking and pulling models", async () => { + const progress = { update: vi.fn(), stop: vi.fn() }; + const prompter = { + progress: vi.fn(() => progress), + } as unknown as WizardPrompter; + + const fetchMock = createOllamaFetchMock({ + tags: [], + pullResponse: new Response('{"status":"success"}\n', { status: 200 }), + }); + vi.stubGlobal("fetch", fetchMock); + + await ensureOllamaModelPulled({ + config: { + agents: { defaults: { model: { primary: "ollama/gemma4" } } }, + models: { + providers: { + ollama: { + baseURL: "http://127.0.0.1:11435", + models: [], + } as never, + }, + }, + }, + model: "ollama/gemma4", + prompter, + }); + + expect(fetchMock.mock.calls[0]?.[0]).toBe("http://127.0.0.1:11435/api/tags"); + expect(fetchMock.mock.calls[1]?.[0]).toBe("http://127.0.0.1:11435/api/pull"); + }); + it("skips pull for cloud models", async () => { const prompter = {} as unknown as WizardPrompter; const fetchMock = vi.fn(); diff --git a/extensions/ollama/src/setup.ts b/extensions/ollama/src/setup.ts index e1a866f8459..4a36e327ecf 100644 --- a/extensions/ollama/src/setup.ts +++ b/extensions/ollama/src/setup.ts @@ -25,6 +25,7 @@ import { OLLAMA_DEFAULT_BASE_URL, OLLAMA_DEFAULT_MODEL, } from "./defaults.js"; +import { readProviderBaseUrl } from "./provider-base-url.js"; import { buildOllamaBaseUrlSsrFPolicy, buildOllamaProvider, @@ -631,7 +632,8 @@ export async function ensureOllamaModelPulled(params: { if (!params.model.startsWith("ollama/")) { return; } - const baseUrl = params.config.models?.providers?.ollama?.baseUrl ?? OLLAMA_DEFAULT_BASE_URL; + const baseUrl = + readProviderBaseUrl(params.config.models?.providers?.ollama) ?? OLLAMA_DEFAULT_BASE_URL; const modelName = params.model.slice("ollama/".length); if (isOllamaCloudModel(modelName)) { return; diff --git a/extensions/ollama/src/web-search-provider.test.ts b/extensions/ollama/src/web-search-provider.test.ts index 2b82bc49752..350bdef27fa 100644 --- a/extensions/ollama/src/web-search-provider.test.ts +++ b/extensions/ollama/src/web-search-provider.test.ts @@ -19,6 +19,7 @@ type OllamaProviderConfigOverride = Partial<{ api: "ollama"; apiKey: string; baseUrl: string; + baseURL: string; models: NonNullable< NonNullable["providers"]>[string] >["models"]; @@ -125,6 +126,17 @@ describe("ollama web search provider", () => { ).toBe("https://ollama.com"); }); + it("uses the model provider baseURL alias for web search", () => { + expect( + testing.resolveOllamaWebSearchBaseUrl( + createOllamaConfig({ + baseUrl: undefined, + baseURL: "http://remote-ollama:11434/v1", + } as OllamaProviderConfigOverride), + ), + ).toBe("http://remote-ollama:11434"); + }); + it("maps generic search args into the local Ollama proxy endpoint", async () => { const release = vi.fn(async () => {}); fetchWithSsrFGuardMock.mockResolvedValue({ diff --git a/extensions/ollama/src/web-search-provider.ts b/extensions/ollama/src/web-search-provider.ts index 79399ca8b21..712c0b42a46 100644 --- a/extensions/ollama/src/web-search-provider.ts +++ b/extensions/ollama/src/web-search-provider.ts @@ -20,6 +20,7 @@ import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime"; import { normalizeOptionalString } from "openclaw/plugin-sdk/text-runtime"; import { Type } from "typebox"; import { OLLAMA_DEFAULT_BASE_URL } from "./defaults.js"; +import { readProviderBaseUrl } from "./provider-base-url.js"; import { buildOllamaBaseUrlSsrFPolicy, fetchOllamaModels, @@ -96,8 +97,8 @@ function resolveOllamaWebSearchBaseUrl(config?: OpenClawConfig): string { if (pluginBaseUrl) { return resolveOllamaApiBase(pluginBaseUrl); } - const configuredBaseUrl = config?.models?.providers?.ollama?.baseUrl; - if (normalizeOptionalString(configuredBaseUrl)) { + const configuredBaseUrl = readProviderBaseUrl(config?.models?.providers?.ollama); + if (configuredBaseUrl) { return resolveOllamaApiBase(configuredBaseUrl); } return OLLAMA_DEFAULT_BASE_URL; From 348728c28c1ea9ae7c5824350baba35ee08a275e Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 03:33:51 +0100 Subject: [PATCH 181/418] fix(providers): bound native fetch timeouts --- CHANGELOG.md | 1 + extensions/ollama/src/setup.test.ts | 3 +++ extensions/ollama/src/setup.ts | 2 ++ src/agents/tools/pdf-native-providers.test.ts | 4 ++++ src/agents/tools/pdf-native-providers.ts | 4 ++++ 5 files changed, 14 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 72ed22a1c91..7516d18293c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -35,6 +35,7 @@ Docs: https://docs.openclaw.ai - Providers/Ollama: move memory embeddings to Ollama's current `/api/embed` endpoint with batched `input` requests while preserving vector normalization and custom provider auth/header overrides. Fixes #39983. Thanks @sskkcc and @LiudengZhang. - Providers/Ollama: route local web search through Ollama's signed `/api/experimental/web_search` daemon proxy, use hosted `/api/web_search` directly for `ollama.com`, and keep `OLLAMA_API_KEY` scoped to cloud fallback auth. Fixes #69132. Thanks @yoon1012 and @hyspacex. - Providers/Ollama: accept OpenAI SDK-style `baseURL` as an alias for `baseUrl` across discovery, streaming, setup pulls, embeddings, and web search so remote Ollama hosts are not silently ignored. Fixes #62533; supersedes #62549. Thanks @Julien-BKK and @Linux2010. +- Providers/PDF/Ollama: add bounded network timeouts for Ollama model pulls and native Anthropic/Gemini PDF analysis requests so unresponsive provider endpoints no longer hang sessions indefinitely. Fixes #54142; supersedes #54144 and #54145. Thanks @jinduwang1001-max and @arkyu2077. - Memory/doctor: treat Ollama memory embeddings as key-optional so `openclaw doctor` no longer warns about a missing API key when the gateway reports embeddings are ready. Fixes #46584. Thanks @fengly78. - Agents/Ollama: apply provider-owned replay turn normalization to native Ollama chat so Cloud models no longer reject non-alternating replay history in agent/Gateway runs. Fixes #71697. Thanks @ismael-81. - Control UI/Ollama: show the resolved configured thinking default in chat and session thinking dropdowns so inherited `adaptive`/per-model thinking config no longer appears as `Default (off)` or a generic inherit value. Fixes #72407. Thanks @NotecAG. diff --git a/extensions/ollama/src/setup.test.ts b/extensions/ollama/src/setup.test.ts index 926f2b690b0..8a7a4d3b4ae 100644 --- a/extensions/ollama/src/setup.test.ts +++ b/extensions/ollama/src/setup.test.ts @@ -417,6 +417,9 @@ describe("ollama setup", () => { expect(fetchMock).toHaveBeenCalledTimes(2); expect(fetchMock.mock.calls[1][0]).toContain("/api/pull"); + const pullInit = fetchMock.mock.calls[1][1]; + expect(pullInit?.signal).toBeInstanceOf(AbortSignal); + expect(pullInit?.signal?.aborted).toBe(false); }); it("skips pull when model is already available", async () => { diff --git a/extensions/ollama/src/setup.ts b/extensions/ollama/src/setup.ts index 4a36e327ecf..2c44fdad742 100644 --- a/extensions/ollama/src/setup.ts +++ b/extensions/ollama/src/setup.ts @@ -42,6 +42,7 @@ const OLLAMA_SUGGESTED_MODELS_LOCAL = [OLLAMA_DEFAULT_MODEL]; const OLLAMA_SUGGESTED_MODELS_CLOUD = ["kimi-k2.5:cloud", "minimax-m2.7:cloud", "glm-5.1:cloud"]; const OLLAMA_CONTEXT_ENRICH_LIMIT = 200; const OLLAMA_CLOUD_MAX_DISCOVERED_MODELS = 500; +const OLLAMA_PULL_REQUEST_TIMEOUT_MS = 30_000; type OllamaSetupOptions = { customBaseUrl?: string; @@ -172,6 +173,7 @@ async function pullOllamaModelCore(params: { headers: { "Content-Type": "application/json" }, body: JSON.stringify({ name: modelName }), }, + timeoutMs: OLLAMA_PULL_REQUEST_TIMEOUT_MS, policy: buildOllamaBaseUrlSsrFPolicy(baseUrl), auditContext: "ollama-setup.pull", }); diff --git a/src/agents/tools/pdf-native-providers.test.ts b/src/agents/tools/pdf-native-providers.test.ts index 5e7cceb2538..b2aedd833f8 100644 --- a/src/agents/tools/pdf-native-providers.test.ts +++ b/src/agents/tools/pdf-native-providers.test.ts @@ -78,6 +78,8 @@ describe("native PDF provider API calls", () => { expect(fetchMock).toHaveBeenCalledTimes(1); const [url, opts] = fetchMock.mock.calls[0]; expect(url).toContain("/v1/messages"); + expect(opts.signal).toBeInstanceOf(AbortSignal); + expect(opts.signal.aborted).toBe(false); const body = JSON.parse(opts.body); expect(body.model).toBe("claude-opus-4-6"); expect(body.messages[0].content).toHaveLength(2); @@ -132,6 +134,8 @@ describe("native PDF provider API calls", () => { const [url, opts] = fetchMock.mock.calls[0]; expect(url).toContain("generateContent"); expect(url).toContain("gemini-2.5-pro"); + expect(opts.signal).toBeInstanceOf(AbortSignal); + expect(opts.signal.aborted).toBe(false); const body = JSON.parse(opts.body); expect(body.contents[0].parts).toHaveLength(2); expect(body.contents[0].parts[0].inline_data.mime_type).toBe("application/pdf"); diff --git a/src/agents/tools/pdf-native-providers.ts b/src/agents/tools/pdf-native-providers.ts index aa47540e530..fc7622145b2 100644 --- a/src/agents/tools/pdf-native-providers.ts +++ b/src/agents/tools/pdf-native-providers.ts @@ -12,6 +12,8 @@ type PdfInput = { filename?: string; }; +const NATIVE_PDF_PROVIDER_FETCH_TIMEOUT_MS = 120_000; + // --------------------------------------------------------------------------- // Anthropic – native PDF via Messages API // --------------------------------------------------------------------------- @@ -74,6 +76,7 @@ export async function anthropicAnalyzePdf(params: { max_tokens: params.maxTokens ?? 4096, messages: [{ role: "user", content }], }), + signal: AbortSignal.timeout(NATIVE_PDF_PROVIDER_FETCH_TIMEOUT_MS), }); if (!res.ok) { @@ -158,6 +161,7 @@ export async function geminiAnalyzePdf(params: { body: JSON.stringify({ contents: [{ role: "user", parts }], }), + signal: AbortSignal.timeout(NATIVE_PDF_PROVIDER_FETCH_TIMEOUT_MS), }); if (!res.ok) { From f39f4629d9779911d6b6833938bbf52cf091d9d6 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 19:38:07 -0700 Subject: [PATCH 182/418] docs(changelog): credit update fixture repair Add the missing Unreleased changelog credit for the Docker update-channel fixture repair. --- CHANGELOG.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7516d18293c..c7d4aa2da64 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -63,6 +63,8 @@ Docs: https://docs.openclaw.ai - Control UI: localize command palette labels, categories, skill shortcuts, footer hints, and connect-command copy labels while preserving localized command palette search matching. (#61130, #61119) Thanks @rubensfox20. - Plugins/memory-lancedb: request float embedding responses from OpenAI-compatible servers so local providers that default SDK requests to base64 no longer return dimension-mismatched LanceDB vectors while preserving configured dimensions. Fixes #45982. (#59048, #46069, #45986) Thanks @deep-introspection, @xiaokhkh, @caicongyang, and @thiswind. - Plugins/memory-core: respect configured memory-search embedding concurrency during non-batch indexing so local Ollama embedding backends can serialize indexing instead of flooding the server. Fixes #66822. (#66931) Thanks @oliviareid-svg and @LyraInTheFlesh. +- Docker/update smoke: keep the package-derived update-channel fixture on package-shipped files and make its UI build stub create the asset the updater verifies. Thanks @vincentkoc. + ## 2026.4.26 From 8b27c489f5aed9ebacd79503caca4e15cb323efc Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 03:39:19 +0100 Subject: [PATCH 183/418] test: bound openai websocket live e2e --- src/agents/openai-ws-stream.e2e.test.ts | 62 +++++++++++++++++++++---- 1 file changed, 54 insertions(+), 8 deletions(-) diff --git a/src/agents/openai-ws-stream.e2e.test.ts b/src/agents/openai-ws-stream.e2e.test.ts index 2f6392c10c0..65e411558a0 100644 --- a/src/agents/openai-ws-stream.e2e.test.ts +++ b/src/agents/openai-ws-stream.e2e.test.ts @@ -20,6 +20,7 @@ import type { AssistantMessageEventStream, Context, } from "@mariozechner/pi-ai"; +import { createAssistantMessageEventStream } from "@mariozechner/pi-ai"; import { afterEach, beforeEach, describe, expect, it, vi } from "vitest"; import { isLiveTestEnabled } from "./live-test-helpers.js"; import type { OutputItem, ResponseObject } from "./openai-ws-connection.js"; @@ -108,8 +109,10 @@ async function runWebsocketToolFollowupTurn(params: { await collectEvents( params.streamFn(model, secondContext, { transport: "websocket", - maxTokens: 128, - }), + maxTokens: 16, + reasoningEffort: "none", + textVerbosity: "low", + } as unknown as StreamFnParams[2]), ), ); } @@ -272,7 +275,9 @@ describe("OpenAI WebSocket e2e", () => { streamFn(model, firstContext, { transport: "websocket", toolChoice: "required", - maxTokens: 128, + maxTokens: 16, + reasoningEffort: "none", + textVerbosity: "low", } as unknown as StreamFnParams[2]), ); const firstDone = expectDone(firstEvents); @@ -419,15 +424,56 @@ describe("OpenAI WebSocket e2e", () => { ); testFn( - "falls back to HTTP gracefully with invalid API key", + "falls back to HTTP gracefully when websocket connect fails", async () => { const sid = freshSession("fallback"); - const streamFn = openAIWsStreamModule.createOpenAIWebSocketStreamFn("sk-invalid-key", sid); - const stream = streamFn(model, makeContext("Hello"), {}); + openAIWsStreamModule.__testing.setDepsForTest({ + createHttpFallbackStreamFn: () => + (() => { + const stream = createAssistantMessageEventStream(); + queueMicrotask(() => { + stream.push({ + type: "done", + reason: "stop", + message: { + role: "assistant", + content: [{ type: "text", text: "FALLBACK_OK" }], + stopReason: "stop", + api: "openai-responses", + provider: "openai", + model: "gpt-5.4", + usage: { + input: 0, + output: 0, + cacheRead: 0, + cacheWrite: 0, + totalTokens: 0, + cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 }, + }, + timestamp: Date.now(), + }, + }); + stream.end(); + }); + return stream; + }) as never, + }); + const streamFn = openAIWsStreamModule.createOpenAIWebSocketStreamFn(API_KEY!, sid, { + managerOptions: { + url: "ws://127.0.0.1:1", + maxRetries: 0, + backoffDelaysMs: [0], + }, + }); + const stream = streamFn(model, makeContext("Reply with exactly FALLBACK_OK."), { + maxTokens: 8, + reasoningEffort: "none", + textVerbosity: "low", + } as unknown as StreamFnParams[2]); const events = await collectEvents(stream); - const hasTerminal = events.some((e) => e.type === "done" || e.type === "error"); - expect(hasTerminal).toBe(true); + const done = expectDone(events); + expect(assistantText(done)).toContain("FALLBACK_OK"); }, 45_000, ); From 414fd41a1f2ce06229f21420c11aa9d14d4f0a09 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 03:40:26 +0100 Subject: [PATCH 184/418] fix(ollama): avoid timing out active model pulls --- extensions/ollama/src/setup.test.ts | 87 ++++++++++++++++++++++------- extensions/ollama/src/setup.ts | 57 ++++++++++++++++++- 2 files changed, 122 insertions(+), 22 deletions(-) diff --git a/extensions/ollama/src/setup.test.ts b/extensions/ollama/src/setup.test.ts index 8a7a4d3b4ae..136c4ef8308 100644 --- a/extensions/ollama/src/setup.test.ts +++ b/extensions/ollama/src/setup.test.ts @@ -398,28 +398,77 @@ describe("ollama setup", () => { describe("ensureOllamaModelPulled", () => { it("pulls model when not available locally", async () => { - const progress = { update: vi.fn(), stop: vi.fn() }; - const prompter = { - progress: vi.fn(() => progress), - } as unknown as WizardPrompter; + vi.useFakeTimers(); + try { + const progress = { update: vi.fn(), stop: vi.fn() }; + const prompter = { + progress: vi.fn(() => progress), + } as unknown as WizardPrompter; - const fetchMock = createOllamaFetchMock({ - tags: ["llama3:8b"], - pullResponse: new Response('{"status":"success"}\n', { status: 200 }), - }); - vi.stubGlobal("fetch", fetchMock); + const fetchMock = createOllamaFetchMock({ + tags: ["llama3:8b"], + pullResponse: new Response('{"status":"success"}\n', { status: 200 }), + }); + vi.stubGlobal("fetch", fetchMock); - await ensureOllamaModelPulled({ - config: createDefaultOllamaConfig("ollama/gemma4"), - model: "ollama/gemma4", - prompter, - }); + await ensureOllamaModelPulled({ + config: createDefaultOllamaConfig("ollama/gemma4"), + model: "ollama/gemma4", + prompter, + }); - expect(fetchMock).toHaveBeenCalledTimes(2); - expect(fetchMock.mock.calls[1][0]).toContain("/api/pull"); - const pullInit = fetchMock.mock.calls[1][1]; - expect(pullInit?.signal).toBeInstanceOf(AbortSignal); - expect(pullInit?.signal?.aborted).toBe(false); + expect(fetchMock).toHaveBeenCalledTimes(2); + expect(fetchMock.mock.calls[1][0]).toContain("/api/pull"); + const pullInit = fetchMock.mock.calls[1][1]; + expect(pullInit?.signal).toBeInstanceOf(AbortSignal); + expect(pullInit?.signal?.aborted).toBe(false); + + await vi.advanceTimersByTimeAsync(30_000); + expect(pullInit?.signal?.aborted).toBe(false); + } finally { + vi.useRealTimers(); + } + }); + + it("fails stalled model pull streams after an idle timeout", async () => { + vi.useFakeTimers(); + try { + const progress = { update: vi.fn(), stop: vi.fn() }; + const prompter = { + progress: vi.fn(() => progress), + } as unknown as WizardPrompter; + const fetchMock = vi.fn(async (input: string | URL | Request) => { + const url = requestUrl(input); + if (url.endsWith("/api/tags")) { + return jsonResponse({ models: [] }); + } + if (url.endsWith("/api/pull")) { + return new Response(new ReadableStream(), { status: 200 }); + } + throw new Error(`Unexpected fetch: ${url}`); + }); + vi.stubGlobal("fetch", fetchMock); + + const pullPromise = ensureOllamaModelPulled({ + config: createDefaultOllamaConfig("ollama/gemma4"), + model: "ollama/gemma4", + prompter, + }).catch((err: unknown) => err); + + for (let attempts = 0; attempts < 50 && fetchMock.mock.calls.length < 2; attempts += 1) { + await vi.advanceTimersByTimeAsync(0); + await Promise.resolve(); + } + expect(fetchMock.mock.calls[1]?.[0]).toContain("/api/pull"); + + await vi.advanceTimersByTimeAsync(300_000); + await expect(pullPromise).resolves.toEqual( + expect.objectContaining({ message: "Failed to download selected Ollama model" }), + ); + expect(progress.stop).toHaveBeenCalledWith(expect.stringContaining("Ollama pull stalled")); + } finally { + vi.useRealTimers(); + } }); it("skips pull when model is already available", async () => { diff --git a/extensions/ollama/src/setup.ts b/extensions/ollama/src/setup.ts index 2c44fdad742..362d3292fce 100644 --- a/extensions/ollama/src/setup.ts +++ b/extensions/ollama/src/setup.ts @@ -42,7 +42,8 @@ const OLLAMA_SUGGESTED_MODELS_LOCAL = [OLLAMA_DEFAULT_MODEL]; const OLLAMA_SUGGESTED_MODELS_CLOUD = ["kimi-k2.5:cloud", "minimax-m2.7:cloud", "glm-5.1:cloud"]; const OLLAMA_CONTEXT_ENRICH_LIMIT = 200; const OLLAMA_CLOUD_MAX_DISCOVERED_MODELS = 500; -const OLLAMA_PULL_REQUEST_TIMEOUT_MS = 30_000; +const OLLAMA_PULL_RESPONSE_TIMEOUT_MS = 30_000; +const OLLAMA_PULL_STREAM_IDLE_TIMEOUT_MS = 300_000; type OllamaSetupOptions = { customBaseUrl?: string; @@ -158,6 +159,48 @@ type OllamaPullChunk = { type OllamaPullResult = { ok: true } | { ok: false; message: string }; +async function readOllamaPullChunkWithIdleTimeout( + reader: ReadableStreamDefaultReader, +): Promise> { + let timeoutId: ReturnType | undefined; + let timedOut = false; + + return await new Promise((resolve, reject) => { + const clear = () => { + if (timeoutId !== undefined) { + clearTimeout(timeoutId); + timeoutId = undefined; + } + }; + + timeoutId = setTimeout(() => { + timedOut = true; + clear(); + void reader.cancel().catch(() => undefined); + reject( + new Error( + `Ollama pull stalled: no data received for ${Math.round(OLLAMA_PULL_STREAM_IDLE_TIMEOUT_MS / 1000)}s`, + ), + ); + }, OLLAMA_PULL_STREAM_IDLE_TIMEOUT_MS); + + void reader.read().then( + (result) => { + clear(); + if (!timedOut) { + resolve(result); + } + }, + (err) => { + clear(); + if (!timedOut) { + reject(err); + } + }, + ); + }); +} + async function pullOllamaModelCore(params: { baseUrl: string; modelName: string; @@ -165,6 +208,11 @@ async function pullOllamaModelCore(params: { }): Promise { const baseUrl = resolveOllamaApiBase(params.baseUrl); const modelName = normalizeOllamaModelName(params.modelName) ?? params.modelName.trim(); + const responseController = new AbortController(); + const responseTimeout = setTimeout( + responseController.abort.bind(responseController), + OLLAMA_PULL_RESPONSE_TIMEOUT_MS, + ); try { const { response, release } = await fetchWithSsrFGuard({ url: `${baseUrl}/api/pull`, @@ -173,10 +221,11 @@ async function pullOllamaModelCore(params: { headers: { "Content-Type": "application/json" }, body: JSON.stringify({ name: modelName }), }, - timeoutMs: OLLAMA_PULL_REQUEST_TIMEOUT_MS, + signal: responseController.signal, policy: buildOllamaBaseUrlSsrFPolicy(baseUrl), auditContext: "ollama-setup.pull", }); + clearTimeout(responseTimeout); try { if (!response.ok) { return { ok: false, message: `Failed to download ${modelName} (HTTP ${response.status})` }; @@ -225,7 +274,7 @@ async function pullOllamaModelCore(params: { }; for (;;) { - const { done, value } = await reader.read(); + const { done, value } = await readOllamaPullChunkWithIdleTimeout(reader); if (done) { break; } @@ -255,6 +304,8 @@ async function pullOllamaModelCore(params: { } catch (err) { const reason = formatErrorMessage(err); return { ok: false, message: `Failed to download ${modelName}: ${reason}` }; + } finally { + clearTimeout(responseTimeout); } } From 9f9bd41f40df281da5258b897675b2c989d1af64 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 01:32:30 +0100 Subject: [PATCH 185/418] fix: persist gateway service wrappers --- CHANGELOG.md | 1 + docs/cli/gateway.md | 6 ++- src/cli/daemon-cli.coverage.test.ts | 29 ++++++++++ src/cli/daemon-cli/install.ts | 53 +++++++++++++++++++ .../daemon-cli/register-service-commands.ts | 1 + src/cli/daemon-cli/types.ts | 1 + src/commands/daemon-install-helpers.test.ts | 38 +++++++++++++ src/commands/daemon-install-helpers.ts | 22 ++++++-- src/commands/doctor-gateway-services.test.ts | 43 +++++++++++++++ src/commands/doctor-gateway-services.ts | 35 ++++++++++-- src/daemon/program-args.test.ts | 30 +++++++++++ src/daemon/program-args.ts | 35 ++++++++++++ src/daemon/service-env.test.ts | 12 +++++ src/daemon/service-env.ts | 2 + 14 files changed, 297 insertions(+), 11 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c7d4aa2da64..5c1aa6de223 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,7 @@ Docs: https://docs.openclaw.ai ### Fixes - Cron: classify isolated runs as errors when final output narrates known execution-denial markers such as `SYSTEM_RUN_DENIED`, `INVALID_REQUEST`, or approval-binding refusal phrases, so blocked commands no longer appear green in cron history. Fixes #67172; carries forward #67186. Thanks @oc-gh-dr, @hclsys, and @1yihui. +- Gateway/install: add a validated `--wrapper`/`OPENCLAW_WRAPPER` service install path that persists executable LaunchAgent/systemd wrappers across forced reinstalls, updates, and doctor repairs instead of falling back to raw node/bun `ProgramArguments`. Fixes #69400. Thanks @willtmc. - macOS Gateway: write launchd services with a state-dir `WorkingDirectory`, use a durable state-dir temp path instead of freezing macOS session `TMPDIR`, create that temp directory before bootstrap, and label abort-shaped launchd exits as `SIGABRT/abort` in status output. Fixes #53679 and #70223; refs #71848. Thanks @dlturock, @stammi922, and @palladius. - Exec approvals: accept runtime-owned `source: "allow-always"` and `commandText` allowlist metadata in gateway and node approval-set payloads so Control UI round-trips no longer fail with `unexpected property 'source'`. Fixes #60000; carries forward #60064. Thanks @sd1471123, @sharkqwy, and @luoyanglang. - Exec/node: skip approval-plan preparation for full-trust `host=node` runs so interpreter and script commands no longer fail with `SYSTEM_RUN_DENIED: approval cannot safely bind` when effective policy is `security=full` and `ask=off`. Fixes #48457 and duplicate #69251. Thanks @ajtran303, @jaserNo1, @Blakeshannon, @lesliefag, and @AvIsBeastMC. diff --git a/docs/cli/gateway.md b/docs/cli/gateway.md index 0abae2ff35d..a55cd1dbbe5 100644 --- a/docs/cli/gateway.md +++ b/docs/cli/gateway.md @@ -425,11 +425,13 @@ openclaw gateway uninstall - `gateway status`: `--url`, `--token`, `--password`, `--timeout`, `--no-probe`, `--require-rpc`, `--deep`, `--json` - - `gateway install`: `--port`, `--runtime `, `--token`, `--force`, `--json` + - `gateway install`: `--port`, `--runtime `, `--token`, `--wrapper `, `--force`, `--json` - `gateway uninstall|start|stop|restart`: `--json` - - `gateway install` supports `--port`, `--runtime`, `--token`, `--force`, `--json`. + - `gateway install` supports `--port`, `--runtime`, `--token`, `--wrapper`, `--force`, `--json`. + - `--wrapper ` makes the managed service start through an executable wrapper, writing `ProgramArguments` as ` gateway --port ...` and persisting `OPENCLAW_WRAPPER` in the service environment so forced reinstalls, updates, and doctor repairs keep using the same wrapper. `openclaw doctor` also reports the active wrapper. If `--wrapper` is omitted, install honors an existing `OPENCLAW_WRAPPER` from the shell or current service environment. + - To remove a persisted wrapper, reinstall with an empty wrapper environment, for example `OPENCLAW_WRAPPER= openclaw gateway install --force`. - Use `gateway restart` to restart a managed service. Do not chain `gateway stop` and `gateway start` as a restart substitute; on macOS, `gateway stop` intentionally disables the LaunchAgent before stopping it. - When token auth requires a token and `gateway.auth.token` is SecretRef-managed, `gateway install` validates that the SecretRef is resolvable but does not persist the resolved token into service environment metadata. - If token auth requires a token and the configured token SecretRef is unresolved, install fails closed instead of persisting fallback plaintext. diff --git a/src/cli/daemon-cli.coverage.test.ts b/src/cli/daemon-cli.coverage.test.ts index b50e91d6c1f..968113ace74 100644 --- a/src/cli/daemon-cli.coverage.test.ts +++ b/src/cli/daemon-cli.coverage.test.ts @@ -33,12 +33,14 @@ const buildGatewayInstallPlan = vi.fn( port: number; token?: string; env?: NodeJS.ProcessEnv; + wrapperPath?: string; existingEnvironment?: Record; }) => ({ programArguments: ["/bin/node", "cli", "gateway", "--port", String(params.port)], workingDirectory: process.cwd(), environment: { OPENCLAW_GATEWAY_PORT: String(params.port), + ...(params.wrapperPath ? { OPENCLAW_WRAPPER: params.wrapperPath } : {}), ...(params.token ? { OPENCLAW_GATEWAY_TOKEN: params.token } : {}), }, }), @@ -61,7 +63,9 @@ vi.mock("../gateway/probe-auth.js", () => ({ })); vi.mock("../daemon/program-args.js", () => ({ + OPENCLAW_WRAPPER_ENV_KEY: "OPENCLAW_WRAPPER", resolveGatewayProgramArguments: (opts: unknown) => resolveGatewayProgramArguments(opts), + resolveOpenClawWrapperPath: async (value: string | undefined) => value?.trim() || undefined, })); vi.mock("../daemon/service.js", async () => { @@ -109,6 +113,7 @@ vi.mock("../commands/daemon-install-helpers.js", () => ({ port: number; token?: string; env?: NodeJS.ProcessEnv; + wrapperPath?: string; existingEnvironment?: Record; }) => buildGatewayInstallPlan(params), })); @@ -263,6 +268,7 @@ describe("daemon-cli coverage", () => { serviceReadCommand.mockResolvedValueOnce({ programArguments: ["/bin/node", "cli", "gateway", "--port", "18789"], environment: { + OPENCLAW_WRAPPER: "/usr/local/bin/openclaw-doppler", PATH: "/custom/go/bin:/usr/bin", GOPATH: "/Users/test/.local/gopath", GOBIN: "/Users/test/.local/gopath/bin", @@ -276,9 +282,32 @@ describe("daemon-cli coverage", () => { expect.objectContaining({ existingEnvironment: { PATH: "/custom/go/bin:/usr/bin", + OPENCLAW_WRAPPER: "/usr/local/bin/openclaw-doppler", GOPATH: "/Users/test/.local/gopath", GOBIN: "/Users/test/.local/gopath/bin", }, + env: expect.objectContaining({ + OPENCLAW_WRAPPER: "/usr/local/bin/openclaw-doppler", + }), + }), + ); + }); + + it("passes an explicit service wrapper into the install plan", async () => { + runtimeLogs.length = 0; + serviceIsLoaded.mockResolvedValueOnce(false); + + await runDaemonCommand([ + "daemon", + "install", + "--wrapper", + "/usr/local/bin/openclaw-doppler", + "--json", + ]); + + expect(buildGatewayInstallPlan).toHaveBeenCalledWith( + expect.objectContaining({ + wrapperPath: "/usr/local/bin/openclaw-doppler", }), ); }); diff --git a/src/cli/daemon-cli/install.ts b/src/cli/daemon-cli/install.ts index c426120ec7b..c0b65ee9382 100644 --- a/src/cli/daemon-cli/install.ts +++ b/src/cli/daemon-cli/install.ts @@ -10,6 +10,7 @@ import { resolveFutureConfigActionBlock } from "../../config/future-version-guar import { readConfigFileSnapshotForWrite } from "../../config/io.js"; import { resolveGatewayPort } from "../../config/paths.js"; import type { OpenClawConfig } from "../../config/types.js"; +import { OPENCLAW_WRAPPER_ENV_KEY, resolveOpenClawWrapperPath } from "../../daemon/program-args.js"; import { readEmbeddedGatewayToken } from "../../daemon/service-audit.js"; import { resolveGatewayService } from "../../daemon/service.js"; import type { GatewayServiceCommandConfig } from "../../daemon/service.js"; @@ -44,6 +45,13 @@ function mergeInstallInvocationEnv(params: { continue; } const upper = key.toUpperCase(); + if (upper === OPENCLAW_WRAPPER_ENV_KEY) { + const value = rawValue.trim(); + if (value) { + preservedServiceEnv[OPENCLAW_WRAPPER_ENV_KEY] = value; + } + continue; + } if ( upper === "HOME" || upper === "PATH" || @@ -99,6 +107,19 @@ export async function runDaemonInstall(opts: DaemonInstallOptions) { fail('Invalid --runtime (use "node" or "bun")'); return; } + let wrapperPath: string | undefined; + if (opts.wrapper !== undefined) { + try { + wrapperPath = await resolveOpenClawWrapperPath(opts.wrapper); + if (!wrapperPath) { + fail("Invalid --wrapper"); + return; + } + } catch (err) { + fail(`Invalid --wrapper: ${String(err)}`); + return; + } + } const service = resolveGatewayService(); let loaded = false; @@ -122,6 +143,14 @@ export async function runDaemonInstall(opts: DaemonInstallOptions) { env: process.env, existingServiceEnv, }); + if (!wrapperPath) { + try { + wrapperPath = await resolveOpenClawWrapperPath(installEnv[OPENCLAW_WRAPPER_ENV_KEY]); + } catch (err) { + fail(`Invalid ${OPENCLAW_WRAPPER_ENV_KEY}: ${String(err)}`); + return; + } + } if (loaded) { if (!opts.force) { const autoRefreshMessage = await getGatewayServiceAutoRefreshMessage({ @@ -130,6 +159,7 @@ export async function runDaemonInstall(opts: DaemonInstallOptions) { installEnv, port, runtime: runtimeRaw, + wrapperPath, existingEnvironment: existingServiceEnv, config: cfg, }); @@ -182,6 +212,7 @@ export async function runDaemonInstall(opts: DaemonInstallOptions) { env: installEnv, port, runtime: runtimeRaw, + wrapperPath, existingEnvironment: existingServiceEnv, warn: (message) => { if (json) { @@ -217,6 +248,7 @@ async function getGatewayServiceAutoRefreshMessage(params: { installEnv: NodeJS.ProcessEnv; port: number; runtime: GatewayDaemonRuntime; + wrapperPath?: string; existingEnvironment?: Record; config: OpenClawConfig; }): Promise { @@ -231,6 +263,7 @@ async function getGatewayServiceAutoRefreshMessage(params: { env: params.installEnv, port: params.port, runtime: params.runtime, + wrapperPath: params.wrapperPath, existingEnvironment: params.existingEnvironment, warn: () => undefined, config: params.config, @@ -242,6 +275,26 @@ async function getGatewayServiceAutoRefreshMessage(params: { return "Gateway service OPENCLAW_GATEWAY_TOKEN differs from the current install plan; refreshing the install."; } } + const wrapperRequested = Boolean( + params.wrapperPath || normalizeOptionalString(params.installEnv[OPENCLAW_WRAPPER_ENV_KEY]), + ); + if (wrapperRequested) { + const plannedInstall = await buildGatewayInstallPlan({ + env: params.installEnv, + port: params.port, + runtime: params.runtime, + wrapperPath: params.wrapperPath, + existingEnvironment: params.existingEnvironment, + warn: () => undefined, + config: params.config, + }); + if ( + plannedInstall.programArguments.join("\u0000") !== + currentCommand.programArguments.join("\u0000") + ) { + return "Gateway service command differs from the current wrapper install plan; refreshing the install."; + } + } const currentExecPath = currentCommand.programArguments[0]?.trim(); if (!currentExecPath) { return undefined; diff --git a/src/cli/daemon-cli/register-service-commands.ts b/src/cli/daemon-cli/register-service-commands.ts index fc77a5afcff..1992f77a309 100644 --- a/src/cli/daemon-cli/register-service-commands.ts +++ b/src/cli/daemon-cli/register-service-commands.ts @@ -77,6 +77,7 @@ export function addGatewayServiceCommands(parent: Command, opts?: { statusDescri .option("--port ", "Gateway port") .option("--runtime ", "Daemon runtime (node|bun). Default: node") .option("--token ", "Gateway token (token auth)") + .option("--wrapper ", "Executable wrapper for generated service ProgramArguments") .option("--force", "Reinstall/overwrite if already installed", false) .option("--json", "Output JSON", false) .action(async (cmdOpts, command) => { diff --git a/src/cli/daemon-cli/types.ts b/src/cli/daemon-cli/types.ts index 08a6d407329..3ae79327f81 100644 --- a/src/cli/daemon-cli/types.ts +++ b/src/cli/daemon-cli/types.ts @@ -19,6 +19,7 @@ export type DaemonInstallOptions = { port?: string | number; runtime?: string; token?: string; + wrapper?: string; force?: boolean; json?: boolean; }; diff --git a/src/commands/daemon-install-helpers.test.ts b/src/commands/daemon-install-helpers.test.ts index df00aeeb754..5561d069915 100644 --- a/src/commands/daemon-install-helpers.test.ts +++ b/src/commands/daemon-install-helpers.test.ts @@ -12,6 +12,7 @@ const mocks = vi.hoisted(() => ({ resolveSystemNodeInfo: vi.fn(), renderSystemNodeWarning: vi.fn(), buildServiceEnvironment: vi.fn(), + resolveOpenClawWrapperPath: vi.fn(), })); vi.mock("./daemon-install-auth-profiles-source.runtime.js", () => ({ @@ -29,7 +30,9 @@ vi.mock("../daemon/runtime-paths.js", () => ({ })); vi.mock("../daemon/program-args.js", () => ({ + OPENCLAW_WRAPPER_ENV_KEY: "OPENCLAW_WRAPPER", resolveGatewayProgramArguments: mocks.resolveGatewayProgramArguments, + resolveOpenClawWrapperPath: mocks.resolveOpenClawWrapperPath, })); vi.mock("../daemon/service-env.js", () => ({ @@ -75,6 +78,9 @@ function mockNodeGatewayPlanFixture( ? params.workingDirectory : "/Users/me"; mocks.resolvePreferredNodePath.mockResolvedValue("/opt/node"); + mocks.resolveOpenClawWrapperPath.mockImplementation(async (value: string | undefined) => + value?.trim() ? path.resolve(value) : undefined, + ); mocks.resolveGatewayProgramArguments.mockResolvedValue({ programArguments: ["node", "gateway"], workingDirectory, @@ -205,6 +211,38 @@ describe("buildGatewayInstallPlan", () => { expect(plan.workingDirectory).toBeUndefined(); }); + it("passes OPENCLAW_WRAPPER through program args and managed service env", async () => { + const wrapperPath = path.resolve("/usr/local/bin/openclaw-doppler"); + mockNodeGatewayPlanFixture({ + serviceEnvironment: { + OPENCLAW_PORT: "3000", + OPENCLAW_WRAPPER: wrapperPath, + }, + }); + + const plan = await buildGatewayInstallPlan({ + env: isolatedPlanEnv({ + OPENCLAW_WRAPPER: wrapperPath, + }), + port: 3000, + runtime: "node", + }); + + expect(mocks.resolveGatewayProgramArguments).toHaveBeenCalledWith( + expect.objectContaining({ + wrapperPath, + }), + ); + expect(mocks.buildServiceEnvironment).toHaveBeenCalledWith( + expect.objectContaining({ + env: expect.objectContaining({ + OPENCLAW_WRAPPER: wrapperPath, + }), + }), + ); + expect(plan.environment.OPENCLAW_WRAPPER).toBe(wrapperPath); + }); + it("merges safe config env while dropping unsafe values and keeping service precedence", async () => { mockNodeGatewayPlanFixture({ serviceEnvironment: { diff --git a/src/commands/daemon-install-helpers.ts b/src/commands/daemon-install-helpers.ts index 0f477141690..18e0ebe8d86 100644 --- a/src/commands/daemon-install-helpers.ts +++ b/src/commands/daemon-install-helpers.ts @@ -6,7 +6,11 @@ import { collectDurableServiceEnvVars } from "../config/state-dir-dotenv.js"; import type { OpenClawConfig } from "../config/types.js"; import { resolveGatewayLaunchAgentLabel } from "../daemon/constants.js"; import { resolveGatewayStateDir } from "../daemon/paths.js"; -import { resolveGatewayProgramArguments } from "../daemon/program-args.js"; +import { + OPENCLAW_WRAPPER_ENV_KEY, + resolveGatewayProgramArguments, + resolveOpenClawWrapperPath, +} from "../daemon/program-args.js"; import { buildServiceEnvironment } from "../daemon/service-env.js"; import { isDangerousHostEnvOverrideVarName, @@ -276,6 +280,7 @@ export async function buildGatewayInstallPlan(params: { existingEnvironment?: Record; devMode?: boolean; nodePath?: string; + wrapperPath?: string; platform?: NodeJS.Platform; warn?: DaemonInstallWarnFn; /** Full config to extract env vars from (env vars + inline env keys). */ @@ -289,11 +294,18 @@ export async function buildGatewayInstallPlan(params: { devMode: params.devMode, nodePath: params.nodePath, }); + const wrapperPath = await resolveOpenClawWrapperPath( + params.wrapperPath ?? params.env[OPENCLAW_WRAPPER_ENV_KEY], + ); + const serviceInputEnv: Record = wrapperPath + ? { ...params.env, [OPENCLAW_WRAPPER_ENV_KEY]: wrapperPath } + : params.env; const { programArguments, workingDirectory } = await resolveGatewayProgramArguments({ port: params.port, dev: devMode, runtime: params.runtime, nodePath, + wrapperPath, }); await emitDaemonInstallRuntimeWarning({ env: params.env, @@ -303,11 +315,11 @@ export async function buildGatewayInstallPlan(params: { title: "Gateway runtime", }); const serviceEnvironment = buildServiceEnvironment({ - env: params.env, + env: serviceInputEnv, port: params.port, launchdLabel: platform === "darwin" - ? resolveGatewayLaunchAgentLabel(params.env.OPENCLAW_PROFILE) + ? resolveGatewayLaunchAgentLabel(serviceInputEnv.OPENCLAW_PROFILE) : undefined, platform, extraPathDirs: resolveDaemonNodeBinDir(nodePath), @@ -317,12 +329,12 @@ export async function buildGatewayInstallPlan(params: { return { programArguments, workingDirectory: resolveGatewayInstallWorkingDirectory({ - env: params.env, + env: serviceInputEnv, platform, workingDirectory, }), environment: await buildGatewayInstallEnvironment({ - env: params.env, + env: serviceInputEnv, config: params.config, authStore: params.authStore, warn: params.warn, diff --git a/src/commands/doctor-gateway-services.test.ts b/src/commands/doctor-gateway-services.test.ts index 6b09c866fc8..bc69586e9e5 100644 --- a/src/commands/doctor-gateway-services.test.ts +++ b/src/commands/doctor-gateway-services.test.ts @@ -365,6 +365,49 @@ describe("maybeRepairGatewayServiceConfig", () => { expect(mocks.install).not.toHaveBeenCalled(); }); + it("keeps wrapper-managed gateway services aligned during entrypoint drift checks", async () => { + const wrapperPath = "/usr/local/bin/openclaw-doppler"; + mocks.readCommand.mockResolvedValue({ + programArguments: [wrapperPath, "gateway", "--port", "18789"], + environment: { + OPENCLAW_WRAPPER: wrapperPath, + }, + }); + mocks.auditGatewayServiceConfig.mockResolvedValue({ + ok: true, + issues: [], + }); + mocks.buildGatewayInstallPlan.mockImplementation(async ({ env }) => ({ + programArguments: [env.OPENCLAW_WRAPPER, "gateway", "--port", "18789"], + environment: { + OPENCLAW_WRAPPER: env.OPENCLAW_WRAPPER, + }, + })); + + await runRepair({ gateway: {} }); + + expect(mocks.buildGatewayInstallPlan).toHaveBeenCalledWith( + expect.objectContaining({ + env: expect.objectContaining({ + OPENCLAW_WRAPPER: wrapperPath, + }), + existingEnvironment: expect.objectContaining({ + OPENCLAW_WRAPPER: wrapperPath, + }), + }), + ); + expect(mocks.note).not.toHaveBeenCalledWith( + expect.stringContaining("Gateway service entrypoint does not match the current install."), + "Gateway service config", + ); + expect(mocks.note).toHaveBeenCalledWith( + "Gateway service invokes OPENCLAW_WRAPPER: /usr/local/bin/openclaw-doppler", + "Gateway", + ); + expect(mocks.stage).not.toHaveBeenCalled(); + expect(mocks.install).not.toHaveBeenCalled(); + }); + it("still flags entrypoint mismatch when canonicalized paths differ", async () => { setupGatewayEntrypointRepairScenario({ currentEntrypoint: diff --git a/src/commands/doctor-gateway-services.ts b/src/commands/doctor-gateway-services.ts index 6eb81e2ce45..a059d9e4547 100644 --- a/src/commands/doctor-gateway-services.ts +++ b/src/commands/doctor-gateway-services.ts @@ -11,6 +11,7 @@ import { renderGatewayServiceCleanupHints, type ExtraGatewayService, } from "../daemon/inspect.js"; +import { OPENCLAW_WRAPPER_ENV_KEY } from "../daemon/program-args.js"; import { renderSystemNodeWarning, resolveSystemNodeInfo } from "../daemon/runtime-paths.js"; import { auditGatewayServiceConfig, @@ -18,7 +19,7 @@ import { readEmbeddedGatewayToken, SERVICE_AUDIT_CODES, } from "../daemon/service-audit.js"; -import { resolveGatewayService } from "../daemon/service.js"; +import { resolveGatewayService, type GatewayServiceCommandConfig } from "../daemon/service.js"; import { uninstallLegacySystemdUnits } from "../daemon/systemd.js"; import type { RuntimeEnv } from "../runtime.js"; import { @@ -65,6 +66,25 @@ function findGatewayEntrypoint(programArguments?: string[]): string | null { return programArguments[gatewayIndex - 1] ?? null; } +function buildGatewayServiceRepairEnv( + command: GatewayServiceCommandConfig | null, +): NodeJS.ProcessEnv { + const wrapperPath = command?.environment?.[OPENCLAW_WRAPPER_ENV_KEY]?.trim(); + if (!wrapperPath || Object.hasOwn(process.env, OPENCLAW_WRAPPER_ENV_KEY)) { + return process.env; + } + return { + ...process.env, + [OPENCLAW_WRAPPER_ENV_KEY]: wrapperPath, + }; +} + +function resolveGatewayServiceWrapperPath( + command: GatewayServiceCommandConfig | null, +): string | null { + return normalizeOptionalString(command?.environment?.[OPENCLAW_WRAPPER_ENV_KEY]) ?? null; +} + async function normalizeExecutablePath(value: string): Promise { const resolvedPath = path.resolve(value); try { @@ -227,6 +247,11 @@ export async function maybeRepairGatewayServiceConfig( if (!command) { return; } + const serviceInstallEnv = buildGatewayServiceRepairEnv(command); + const serviceWrapperPath = resolveGatewayServiceWrapperPath(command); + if (serviceWrapperPath) { + note(`Gateway service invokes ${OPENCLAW_WRAPPER_ENV_KEY}: ${serviceWrapperPath}`, "Gateway"); + } const tokenRefConfigured = Boolean( resolveSecretInputRef({ @@ -276,10 +301,11 @@ export async function maybeRepairGatewayServiceConfig( const port = resolveGatewayPort(cfg, process.env); const runtimeChoice = detectGatewayRuntime(command.programArguments); const { programArguments } = await buildGatewayInstallPlan({ - env: process.env, + env: serviceInstallEnv, port, runtime: needsNodeRuntime && systemNodePath ? "node" : runtimeChoice, nodePath: systemNodePath ?? undefined, + existingEnvironment: command.environment, warn: (message, title) => note(message, title), config: cfg, }); @@ -389,16 +415,17 @@ export async function maybeRepairGatewayServiceConfig( const updatedPort = resolveGatewayPort(cfgForServiceInstall, process.env); const updatedPlan = await buildGatewayInstallPlan({ - env: process.env, + env: serviceInstallEnv, port: updatedPort, runtime: needsNodeRuntime && systemNodePath ? "node" : runtimeChoice, nodePath: systemNodePath ?? undefined, + existingEnvironment: command.environment, warn: (message, title) => note(message, title), config: cfgForServiceInstall, }); try { await (updateRepairMode ? service.stage : service.install)({ - env: process.env, + env: serviceInstallEnv, stdout: process.stdout, programArguments: updatedPlan.programArguments, workingDirectory: updatedPlan.workingDirectory, diff --git a/src/daemon/program-args.test.ts b/src/daemon/program-args.test.ts index 4c46687b076..43478050f64 100644 --- a/src/daemon/program-args.test.ts +++ b/src/daemon/program-args.test.ts @@ -8,6 +8,7 @@ const childProcessMocks = vi.hoisted(() => ({ const fsMocks = vi.hoisted(() => ({ access: vi.fn(), realpath: vi.fn(), + stat: vi.fn(), })); vi.mock("node:fs/promises", async () => { @@ -18,9 +19,11 @@ vi.mock("node:fs/promises", async () => { ...actual, access: fsMocks.access, realpath: fsMocks.realpath, + stat: fsMocks.stat, }, access: fsMocks.access, realpath: fsMocks.realpath, + stat: fsMocks.stat, }; }); @@ -175,4 +178,31 @@ describe("resolveGatewayProgramArguments", () => { ]); expect(result.workingDirectory).toBe(path.resolve("/repo")); }); + + it("uses an executable wrapper when provided", async () => { + const wrapperPath = path.resolve("/usr/local/bin/openclaw-doppler"); + fsMocks.stat.mockResolvedValue({ isFile: () => true } as never); + fsMocks.access.mockResolvedValue(undefined); + + const result = await resolveGatewayProgramArguments({ + port: 18789, + wrapperPath, + }); + + expect(result.programArguments).toEqual([wrapperPath, "gateway", "--port", "18789"]); + expect(result.workingDirectory).toBeUndefined(); + }); + + it("rejects a non-executable wrapper file", async () => { + const wrapperPath = path.resolve("/usr/local/bin/openclaw-doppler"); + fsMocks.stat.mockResolvedValue({ isFile: () => true } as never); + fsMocks.access.mockRejectedValue(new Error("EACCES")); + + await expect( + resolveGatewayProgramArguments({ + port: 18789, + wrapperPath, + }), + ).rejects.toThrow("OPENCLAW_WRAPPER must point to an executable file"); + }); }); diff --git a/src/daemon/program-args.ts b/src/daemon/program-args.ts index b4148126954..dfc262a504d 100644 --- a/src/daemon/program-args.ts +++ b/src/daemon/program-args.ts @@ -1,4 +1,5 @@ import { execFileSync } from "node:child_process"; +import { constants as fsConstants } from "node:fs"; import fs from "node:fs/promises"; import path from "node:path"; import { @@ -15,6 +16,8 @@ type GatewayProgramArgs = { type GatewayRuntimePreference = "auto" | "node" | "bun"; +export const OPENCLAW_WRAPPER_ENV_KEY = "OPENCLAW_WRAPPER"; + async function resolveCliEntrypointPathForService(): Promise { const argv1 = process.argv[1]; if (!argv1) { @@ -177,12 +180,42 @@ async function resolveBinaryPath(binary: string): Promise { } } +export async function resolveOpenClawWrapperPath( + inputPath: string | undefined, +): Promise { + const trimmed = inputPath?.trim(); + if (!trimmed) { + return undefined; + } + const resolved = path.resolve(trimmed); + try { + const stat = await fs.stat(resolved); + if (!stat.isFile()) { + throw new Error("not a regular file"); + } + await fs.access(resolved, fsConstants.X_OK); + } catch (error) { + const detail = error instanceof Error ? ` (${error.message})` : ""; + throw new Error( + `${OPENCLAW_WRAPPER_ENV_KEY} must point to an executable file: ${resolved}${detail}`, + { cause: error }, + ); + } + return resolved; +} + async function resolveCliProgramArguments(params: { args: string[]; dev?: boolean; runtime?: GatewayRuntimePreference; nodePath?: string; + wrapperPath?: string; }): Promise { + const wrapperPath = await resolveOpenClawWrapperPath(params.wrapperPath); + if (wrapperPath) { + return { programArguments: [wrapperPath, ...params.args] }; + } + const execPath = process.execPath; const runtime = params.runtime ?? "auto"; @@ -255,6 +288,7 @@ export async function resolveGatewayProgramArguments(params: { dev?: boolean; runtime?: GatewayRuntimePreference; nodePath?: string; + wrapperPath?: string; }): Promise { const gatewayArgs = ["gateway", "--port", String(params.port)]; return resolveCliProgramArguments({ @@ -262,6 +296,7 @@ export async function resolveGatewayProgramArguments(params: { dev: params.dev, runtime: params.runtime, nodePath: params.nodePath, + wrapperPath: params.wrapperPath, }); } diff --git a/src/daemon/service-env.test.ts b/src/daemon/service-env.test.ts index 983399eb6bd..fbd57862f38 100644 --- a/src/daemon/service-env.test.ts +++ b/src/daemon/service-env.test.ts @@ -398,6 +398,18 @@ describe("buildServiceEnvironment", () => { } }); + it("passes through OPENCLAW_WRAPPER for gateway services", () => { + const env = buildServiceEnvironment({ + env: { + HOME: "/home/user", + OPENCLAW_WRAPPER: " /usr/local/bin/openclaw-doppler ", + }, + port: 18789, + }); + + expect(env.OPENCLAW_WRAPPER).toBe("/usr/local/bin/openclaw-doppler"); + }); + it("forwards TMPDIR from the host environment on Linux", () => { const env = buildServiceEnvironment({ env: { HOME: "/home/user", TMPDIR: "/var/folders/xw/abc123/T/" }, diff --git a/src/daemon/service-env.ts b/src/daemon/service-env.ts index c2fddf395f6..4233bdda3ae 100644 --- a/src/daemon/service-env.ts +++ b/src/daemon/service-env.ts @@ -295,12 +295,14 @@ export function buildServiceEnvironment(params: { params.execPath, ); const profile = env.OPENCLAW_PROFILE; + const wrapperPath = normalizeOptionalString(env.OPENCLAW_WRAPPER); const resolvedLaunchdLabel = launchdLabel || (platform === "darwin" ? resolveGatewayLaunchAgentLabel(profile) : undefined); const systemdUnit = `${resolveGatewaySystemdServiceName(profile)}.service`; return { ...buildCommonServiceEnvironment(env, sharedEnv), OPENCLAW_PROFILE: profile, + OPENCLAW_WRAPPER: wrapperPath, OPENCLAW_GATEWAY_PORT: String(port), OPENCLAW_LAUNCHD_LABEL: resolvedLaunchdLabel, OPENCLAW_SYSTEMD_UNIT: systemdUnit, From 0b3f13b3375f2a4a05aefaa7517217a4b36d9982 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 03:07:34 +0100 Subject: [PATCH 186/418] fix: preserve wrapper env during gateway reinstall --- src/cli/daemon-cli/install.test.ts | 79 +++++++++++++++++++++++++----- src/cli/daemon-cli/install.ts | 15 ++++-- 2 files changed, 78 insertions(+), 16 deletions(-) diff --git a/src/cli/daemon-cli/install.test.ts b/src/cli/daemon-cli/install.test.ts index 65a2aeccfa1..1099d4c3e66 100644 --- a/src/cli/daemon-cli/install.test.ts +++ b/src/cli/daemon-cli/install.test.ts @@ -30,13 +30,22 @@ const resolveGatewayAuthMock = vi.hoisted(() => ); const resolveSecretRefValuesMock = vi.hoisted(() => vi.fn()); const randomTokenMock = vi.hoisted(() => vi.fn(() => "generated-token")); -const buildGatewayInstallPlanMock = vi.hoisted(() => - vi.fn(async () => ({ - programArguments: ["openclaw", "gateway", "run"], - workingDirectory: "/tmp", - environment: {}, - })), -); +const createInstallPlanFixture = vi.hoisted(() => { + return async (params?: { wrapperPath?: string; env?: Record }) => { + const environment: Record = {}; + if (params?.wrapperPath || params?.env?.OPENCLAW_WRAPPER) { + environment.OPENCLAW_WRAPPER = params.wrapperPath ?? params.env?.OPENCLAW_WRAPPER; + } + return { + programArguments: params?.wrapperPath + ? [params.wrapperPath, "gateway", "run"] + : ["openclaw", "gateway", "run"], + workingDirectory: "/tmp", + environment, + }; + }; +}); +const buildGatewayInstallPlanMock = vi.hoisted(() => vi.fn(createInstallPlanFixture)); const parsePortMock = vi.hoisted(() => vi.fn(() => null)); const isGatewayDaemonRuntimeMock = vi.hoisted(() => vi.fn(() => true)); const installDaemonServiceAndEmitMock = vi.hoisted(() => vi.fn(async () => {})); @@ -108,6 +117,11 @@ vi.mock("../../commands/daemon-install-helpers.js", () => ({ buildGatewayInstallPlan: buildGatewayInstallPlanMock, })); +vi.mock("../../daemon/program-args.js", () => ({ + OPENCLAW_WRAPPER_ENV_KEY: "OPENCLAW_WRAPPER", + resolveOpenClawWrapperPath: async (value: string | undefined) => value?.trim() || undefined, +})); + vi.mock("./shared.js", () => ({ parsePort: parsePortMock, createDaemonInstallActionContext: (jsonFlag: unknown) => { @@ -188,6 +202,7 @@ describe("runDaemonInstall", () => { installDaemonServiceAndEmitMock.mockReset(); service.isLoaded.mockReset(); service.stage.mockReset(); + service.readCommand.mockReset(); resetRuntimeCapture(); actionState.warnings.length = 0; actionState.emitted.length = 0; @@ -211,11 +226,7 @@ describe("runDaemonInstall", () => { }); resolveSecretRefValuesMock.mockResolvedValue(new Map()); randomTokenMock.mockReturnValue("generated-token"); - buildGatewayInstallPlanMock.mockResolvedValue({ - programArguments: ["openclaw", "gateway", "run"], - workingDirectory: "/tmp", - environment: {}, - }); + buildGatewayInstallPlanMock.mockImplementation(createInstallPlanFixture); parsePortMock.mockReturnValue(null); isGatewayDaemonRuntimeMock.mockReturnValue(true); installDaemonServiceAndEmitMock.mockResolvedValue(undefined); @@ -402,6 +413,50 @@ describe("runDaemonInstall", () => { expect(actionState.emitted.at(-1)).toMatchObject({ result: "already-installed" }); }); + it("preserves wrapper env from an installed but unloaded service during forced reinstall", async () => { + service.isLoaded.mockResolvedValue(false); + service.readCommand.mockResolvedValue({ + programArguments: ["/usr/local/bin/openclaw-doppler", "gateway", "run"], + environment: { + OPENCLAW_WRAPPER: "/usr/local/bin/openclaw-doppler", + }, + } as never); + + await runDaemonInstall({ json: true, force: true }); + + expect(service.readCommand).toHaveBeenCalledTimes(1); + expect(buildGatewayInstallPlanMock).toHaveBeenCalledWith( + expect.objectContaining({ + wrapperPath: "/usr/local/bin/openclaw-doppler", + existingEnvironment: expect.objectContaining({ + OPENCLAW_WRAPPER: "/usr/local/bin/openclaw-doppler", + }), + env: expect.objectContaining({ + OPENCLAW_WRAPPER: "/usr/local/bin/openclaw-doppler", + }), + }), + ); + expect(installDaemonServiceAndEmitMock).toHaveBeenCalledTimes(1); + }); + + it("reinstalls when wrapper command matches but wrapper env is missing", async () => { + service.isLoaded.mockResolvedValue(true); + service.readCommand.mockResolvedValue({ + programArguments: ["/usr/local/bin/openclaw-doppler", "gateway", "run"], + environment: {}, + } as never); + + await runDaemonInstall({ + json: true, + wrapper: "/usr/local/bin/openclaw-doppler", + }); + + expect(installDaemonServiceAndEmitMock).toHaveBeenCalledTimes(1); + expect(actionState.warnings).toContain( + "Gateway service OPENCLAW_WRAPPER differs from the current wrapper install plan; refreshing the install.", + ); + }); + it("reinstalls when the embedded gateway token differs from the install plan", async () => { service.isLoaded.mockResolvedValue(true); service.readCommand.mockResolvedValue({ diff --git a/src/cli/daemon-cli/install.ts b/src/cli/daemon-cli/install.ts index c0b65ee9382..62fbabae874 100644 --- a/src/cli/daemon-cli/install.ts +++ b/src/cli/daemon-cli/install.ts @@ -135,10 +135,8 @@ export async function runDaemonInstall(opts: DaemonInstallOptions) { return; } } - if (loaded) { - existingServiceCommand = await service.readCommand(process.env).catch(() => null); - existingServiceEnv = existingServiceCommand?.environment; - } + existingServiceCommand = await service.readCommand(process.env).catch(() => null); + existingServiceEnv = existingServiceCommand?.environment; const installEnv = mergeInstallInvocationEnv({ env: process.env, existingServiceEnv, @@ -294,6 +292,15 @@ async function getGatewayServiceAutoRefreshMessage(params: { ) { return "Gateway service command differs from the current wrapper install plan; refreshing the install."; } + const plannedWrapperPath = normalizeOptionalString( + plannedInstall.environment[OPENCLAW_WRAPPER_ENV_KEY], + ); + const currentWrapperPath = normalizeOptionalString( + currentCommand.environment?.[OPENCLAW_WRAPPER_ENV_KEY], + ); + if (plannedWrapperPath !== currentWrapperPath) { + return `Gateway service ${OPENCLAW_WRAPPER_ENV_KEY} differs from the current wrapper install plan; refreshing the install.`; + } } const currentExecPath = currentCommand.programArguments[0]?.trim(); if (!currentExecPath) { From ef31a333f79696781d17ddf08479204c663e0984 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 03:29:55 +0100 Subject: [PATCH 187/418] docs: add gateway wrapper install examples --- CHANGELOG.md | 2 +- docs/cli/gateway.md | 35 +++++++++++++++++++++++++++++++++++ 2 files changed, 36 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5c1aa6de223..eccfe3fad68 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,7 +7,7 @@ Docs: https://docs.openclaw.ai ### Fixes - Cron: classify isolated runs as errors when final output narrates known execution-denial markers such as `SYSTEM_RUN_DENIED`, `INVALID_REQUEST`, or approval-binding refusal phrases, so blocked commands no longer appear green in cron history. Fixes #67172; carries forward #67186. Thanks @oc-gh-dr, @hclsys, and @1yihui. -- Gateway/install: add a validated `--wrapper`/`OPENCLAW_WRAPPER` service install path that persists executable LaunchAgent/systemd wrappers across forced reinstalls, updates, and doctor repairs instead of falling back to raw node/bun `ProgramArguments`. Fixes #69400. Thanks @willtmc. +- Gateway/install: add a validated `--wrapper`/`OPENCLAW_WRAPPER` service install path that persists executable LaunchAgent/systemd wrappers across forced reinstalls, updates, and doctor repairs instead of falling back to raw node/bun `ProgramArguments`. Fixes #69400. (#72445) Thanks @willtmc. - macOS Gateway: write launchd services with a state-dir `WorkingDirectory`, use a durable state-dir temp path instead of freezing macOS session `TMPDIR`, create that temp directory before bootstrap, and label abort-shaped launchd exits as `SIGABRT/abort` in status output. Fixes #53679 and #70223; refs #71848. Thanks @dlturock, @stammi922, and @palladius. - Exec approvals: accept runtime-owned `source: "allow-always"` and `commandText` allowlist metadata in gateway and node approval-set payloads so Control UI round-trips no longer fail with `unexpected property 'source'`. Fixes #60000; carries forward #60064. Thanks @sd1471123, @sharkqwy, and @luoyanglang. - Exec/node: skip approval-plan preparation for full-trust `host=node` runs so interpreter and script commands no longer fail with `SYSTEM_RUN_DENIED: approval cannot safely bind` when effective policy is `security=full` and `ask=off`. Fixes #48457 and duplicate #69251. Thanks @ajtran303, @jaserNo1, @Blakeshannon, @lesliefag, and @AvIsBeastMC. diff --git a/docs/cli/gateway.md b/docs/cli/gateway.md index a55cd1dbbe5..7322e2f5f81 100644 --- a/docs/cli/gateway.md +++ b/docs/cli/gateway.md @@ -422,6 +422,41 @@ openclaw gateway restart openclaw gateway uninstall ``` +### Install with a wrapper + +Use `--wrapper` when the managed service must start through another executable, for example a +secrets manager shim or a run-as helper. The wrapper receives the normal Gateway args and is +responsible for eventually exec'ing `openclaw` or Node with those args. + +```bash +cat > ~/.local/bin/openclaw-doppler <<'EOF' +#!/usr/bin/env bash +set -euo pipefail +exec doppler run --project my-project --config production -- openclaw "$@" +EOF +chmod +x ~/.local/bin/openclaw-doppler + +openclaw gateway install --wrapper ~/.local/bin/openclaw-doppler --force +openclaw gateway restart +``` + +You can also set the wrapper through the environment. `gateway install` validates that the path is +an executable file, writes the wrapper into service `ProgramArguments`, and persists +`OPENCLAW_WRAPPER` in the service environment for later forced reinstalls, updates, and doctor +repairs. + +```bash +OPENCLAW_WRAPPER="$HOME/.local/bin/openclaw-doppler" openclaw gateway install --force +openclaw doctor +``` + +To remove a persisted wrapper, clear `OPENCLAW_WRAPPER` while reinstalling: + +```bash +OPENCLAW_WRAPPER= openclaw gateway install --force +openclaw gateway restart +``` + - `gateway status`: `--url`, `--token`, `--password`, `--timeout`, `--no-probe`, `--require-rpc`, `--deep`, `--json` From 6d0e84aadb0371b615f1e081744f9fb785504775 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 03:41:39 +0100 Subject: [PATCH 188/418] test(docker): skip bootstrap ritual in install smoke --- scripts/docker/install-sh-e2e/run.sh | 10 ++++++++++ test/scripts/docker-build-helper.test.ts | 9 +++++++++ 2 files changed, 19 insertions(+) diff --git a/scripts/docker/install-sh-e2e/run.sh b/scripts/docker/install-sh-e2e/run.sh index 908e21da806..4ceae37bbd4 100755 --- a/scripts/docker/install-sh-e2e/run.sh +++ b/scripts/docker/install-sh-e2e/run.sh @@ -1,4 +1,10 @@ #!/usr/bin/env bash +# Official installer E2E harness for Docker. +# +# Installs OpenClaw through the public one-liner, verifies the resolved npm +# version, then exercises onboard + local embedded agent tool turns for the +# configured model providers. Keep this script package-install based: it should +# validate the installed npm artifact, not repo sources. set -euo pipefail SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" @@ -496,6 +502,10 @@ run_profile() { test -f "$workspace/USER.md" test -f "$workspace/SOUL.md" test -f "$workspace/TOOLS.md" + # The remaining checks are deterministic tool smokes, not the interactive + # first-run identity ritual. Drop BOOTSTRAP.md so provider prompts stay focused + # on the fixture task and do not spend turns following onboarding copy. + rm -f "$workspace/BOOTSTRAP.md" echo "==> Configure models ($profile)" local agent_model diff --git a/test/scripts/docker-build-helper.test.ts b/test/scripts/docker-build-helper.test.ts index 34993bd622b..48970a85660 100644 --- a/test/scripts/docker-build-helper.test.ts +++ b/test/scripts/docker-build-helper.test.ts @@ -68,4 +68,13 @@ describe("docker build helper", () => { 'OPENCLAW_VERSION="$INSTALL_TAG" curl -fsSL "$INSTALL_URL" | bash', ); }); + + it("keeps installer E2E agent turns out of the interactive bootstrap ritual", () => { + const runner = readFileSync(INSTALL_E2E_RUNNER_PATH, "utf8"); + + expect(runner).toContain('rm -f "$workspace/BOOTSTRAP.md"'); + expect(runner.indexOf('rm -f "$workspace/BOOTSTRAP.md"')).toBeLessThan( + runner.indexOf('echo "==> Agent turns ($profile)"'), + ); + }); }); From d5063d5b16329632e15cb244e423f09553422eef Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 19:43:23 -0700 Subject: [PATCH 189/418] fix(telegram): avoid materializing tool-progress drafts Address Clownfish follow-up on Telegram native draft finalization. Requires real streamed assistant partials before materializing drafts, clears stale native draft previews, and keeps media/buttons on normal send path. --- CHANGELOG.md | 1 + .../telegram/src/bot-message-dispatch.test.ts | 42 +++++++-- extensions/telegram/src/draft-stream.test.ts | 3 + extensions/telegram/src/draft-stream.ts | 33 ++++--- .../src/lane-delivery-text-deliverer.ts | 3 +- extensions/telegram/src/lane-delivery.test.ts | 85 ++++++++++++++++++- 6 files changed, 143 insertions(+), 24 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index eccfe3fad68..0eab864e594 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -399,6 +399,7 @@ Docs: https://docs.openclaw.ai - CLI/models: make `openclaw models scan` fall back to public OpenRouter free-model metadata when no `OPENROUTER_API_KEY` is configured, avoid config secret resolution for explicit `--no-probe` scans, and apply the scan timeout to the OpenRouter catalog request. - Feishu: keep streaming cards to one live card per turn, flush throttled card edits after meaningful text boundaries, and skip exact block/partial repeats so tool-heavy replies do not duplicate card output. Thanks @allan0509. - Feishu: finish the streaming-card duplicate closeout by stripping leaked reasoning tags, preserving cross-block partial snapshots, enabling topic-thread streaming cards, omitting the generic `main` card header, surfacing transient tool/compaction status, and cleaning streaming state after close failures. Thanks @sesame437, @Vicky-v7, @maoku-family, @Pengxiao-Wang, and @Maple778. +- Telegram: keep final-only answers on the normal final-send path instead of creating synthetic draft previews, while preserving real partial preview finalization. Credited from #39213. Thanks @chalawbot. - Telegram: recover incomplete partial-stream previews by falling back to a final send when an ambiguous final edit failure would otherwise retain a strict prefix of the answer. Fixes #71525. (#71554) Thanks @sahilsatralkar. - Control UI/chat: collapse assistant token/model context details behind an explicit Context disclosure and show full dates in message footers, making historical transcript timing clear without noisy default metadata. (#71337) Thanks @BunsDev. - OpenAI/Codex OAuth: explain `unsupported_country_region_territory` token-exchange failures with a proxy/region hint instead of surfacing a generic OAuth error. Fixes #51175. (#71501) Thanks @vincentkoc and @wulala-xjj. diff --git a/extensions/telegram/src/bot-message-dispatch.test.ts b/extensions/telegram/src/bot-message-dispatch.test.ts index 50c294b84d9..d30e37dc66e 100644 --- a/extensions/telegram/src/bot-message-dispatch.test.ts +++ b/extensions/telegram/src/bot-message-dispatch.test.ts @@ -740,6 +740,31 @@ describe("dispatchTelegramMessage draft streaming", () => { ); }); + it("does not materialize native draft tool progress before final-only text", async () => { + const draftStream = createTestDraftStream({ previewMode: "draft" }); + draftStream.materialize.mockResolvedValue(321); + createTelegramDraftStream.mockReturnValue(draftStream); + dispatchReplyWithBufferedBlockDispatcher.mockImplementation( + async ({ dispatcherOptions, replyOptions }) => { + await replyOptions?.onToolStart?.({ name: "exec", phase: "start" }); + await dispatcherOptions.deliver({ text: "Done" }, { kind: "final" }); + return { queuedFinal: true }; + }, + ); + + await dispatchWithContext({ context: createContext(), streamMode: "partial" }); + + expect(draftStream.update).toHaveBeenCalledWith("Working…\n• `tool: exec`"); + expect(draftStream.update).not.toHaveBeenCalledWith("Done"); + expect(draftStream.materialize).not.toHaveBeenCalled(); + expect(deliverReplies).toHaveBeenCalledWith( + expect.objectContaining({ + replies: [expect.objectContaining({ text: "Done" })], + }), + ); + expect(draftStream.clear).toHaveBeenCalledTimes(1); + }); + it("suppresses Telegram tool progress when explicitly disabled", async () => { const draftStream = createDraftStream(); createTelegramDraftStream.mockReturnValue(draftStream); @@ -1201,12 +1226,14 @@ describe("dispatchTelegramMessage draft streaming", () => { await replyOptions?.onPartialReply?.({ text: "Message A partial" }); await dispatcherOptions.deliver({ text: "Message A final" }, { kind: "final" }); const startPromise = replyOptions?.onAssistantMessageStart?.(); + const partialPromise = replyOptions?.onPartialReply?.({ text: "Message B partial" }); const finalPromise = dispatcherOptions.deliver( { text: "Message B final" }, { kind: "final" }, ); resolveMaterialize?.(1001); await startPromise; + await partialPromise; await finalPromise; return { queuedFinal: true }; }, @@ -1368,7 +1395,7 @@ describe("dispatchTelegramMessage draft streaming", () => { expect(boundaryRotationOrder).toBeLessThan(secondUpdateOrder); }); - it("keeps final-only preview lane finalized until a real boundary rotation happens", async () => { + it("sends final-only text without creating a synthetic preview before real partials", async () => { const answerDraftStream = createSequencedDraftStream(1001); const reasoningDraftStream = createDraftStream(); createTelegramDraftStream @@ -1392,17 +1419,16 @@ describe("dispatchTelegramMessage draft streaming", () => { await dispatchWithContext({ context: createContext(), streamMode: "partial" }); expect(answerDraftStream.forceNewMessage).toHaveBeenCalledTimes(1); + expect(deliverReplies).toHaveBeenCalledWith( + expect.objectContaining({ + replies: [expect.objectContaining({ text: "Message A final" })], + }), + ); + expect(editMessageTelegram).toHaveBeenCalledTimes(1); expect(editMessageTelegram).toHaveBeenNthCalledWith( 1, 123, 1001, - "Message A final", - expect.any(Object), - ); - expect(editMessageTelegram).toHaveBeenNthCalledWith( - 2, - 123, - 1002, "Message B final", expect.any(Object), ); diff --git a/extensions/telegram/src/draft-stream.test.ts b/extensions/telegram/src/draft-stream.test.ts index cd82809cffe..c5fa46a7ec4 100644 --- a/extensions/telegram/src/draft-stream.test.ts +++ b/extensions/telegram/src/draft-stream.test.ts @@ -151,6 +151,9 @@ describe("createTelegramDraftStream", () => { expect(api.editMessageText).not.toHaveBeenCalled(); await stream.clear(); + expect(api.sendMessageDraft).toHaveBeenLastCalledWith(123, expect.any(Number), "", { + message_thread_id: 42, + }); expect(api.deleteMessage).not.toHaveBeenCalled(); }); diff --git a/extensions/telegram/src/draft-stream.ts b/extensions/telegram/src/draft-stream.ts index 802442f74ba..19511a224a3 100644 --- a/extensions/telegram/src/draft-stream.ts +++ b/extensions/telegram/src/draft-stream.ts @@ -1,7 +1,7 @@ import type { Bot } from "grammy"; import { - clearFinalizableDraftMessage, createFinalizableDraftStreamControlsForState, + takeMessageIdAfterStop, } from "openclaw/plugin-sdk/channel-lifecycle"; import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime"; import { buildTelegramThreadParams, type TelegramThreadSpec } from "./bot/helpers.js"; @@ -380,23 +380,32 @@ export function createTelegramDraftStream(params: { }); const clear = async () => { - await clearFinalizableDraftMessage({ + const messageId = await takeMessageIdAfterStop({ stopForClear, readMessageId: () => streamMessageId, clearMessageId: () => { streamMessageId = undefined; }, - isValidMessageId: (value): value is number => - typeof value === "number" && Number.isFinite(value), - deleteMessage: async (messageId) => { - await params.api.deleteMessage(chatId, messageId); - }, - onDeleteSuccess: (messageId) => { - params.log?.(`telegram stream preview deleted (chat=${chatId}, message=${messageId})`); - }, - warn: params.warn, - warnPrefix: "telegram stream preview cleanup failed", }); + if (typeof messageId === "number" && Number.isFinite(messageId)) { + try { + await params.api.deleteMessage(chatId, messageId); + params.log?.(`telegram stream preview deleted (chat=${chatId}, message=${messageId})`); + } catch (err) { + params.warn?.(`telegram stream preview cleanup failed: ${formatErrorMessage(err)}`); + } + return; + } + if (previewTransport !== "draft" || resolvedDraftApi == null || streamDraftId == null) { + return; + } + const clearDraftId = streamDraftId; + streamDraftId = undefined; + try { + await resolvedDraftApi(chatId, clearDraftId, "", threadParams); + } catch (err) { + params.warn?.(`telegram stream preview cleanup failed: ${formatErrorMessage(err)}`); + } }; const discard = async () => { diff --git a/extensions/telegram/src/lane-delivery-text-deliverer.ts b/extensions/telegram/src/lane-delivery-text-deliverer.ts index ae1d83c065f..8fb0a42f411 100644 --- a/extensions/telegram/src/lane-delivery-text-deliverer.ts +++ b/extensions/telegram/src/lane-delivery-text-deliverer.ts @@ -225,6 +225,7 @@ export function createLaneTextDeliverer(params: CreateLaneTextDelivererParams) { ) => { const hasPreviewButtons = Boolean(previewButtons && previewButtons.length > 0); return ( + lane.hasStreamedMessage && isDraftPreviewLane(lane) && !hasPreviewButtons && typeof lane.stream?.materialize === "function" @@ -412,7 +413,7 @@ export function createLaneTextDeliverer(params: CreateLaneTextDelivererParams) { stopBeforeEdit, context, }); - if (previewTargetBeforeStop.stopCreatesFirstPreview) { + if (previewTargetBeforeStop.stopCreatesFirstPreview && lane.hasStreamedMessage) { // Final stop() can create the first visible preview message. // Prime pending text so the stop flush sends the final text snapshot. lane.stream.update(text); diff --git a/extensions/telegram/src/lane-delivery.test.ts b/extensions/telegram/src/lane-delivery.test.ts index 174c73c9ddd..adbabaa20e4 100644 --- a/extensions/telegram/src/lane-delivery.test.ts +++ b/extensions/telegram/src/lane-delivery.test.ts @@ -1,6 +1,9 @@ import type { ReplyPayload } from "openclaw/plugin-sdk/reply-runtime"; import { describe, expect, it, vi } from "vitest"; -import { createTestDraftStream } from "./draft-stream.test-helpers.js"; +import { + createSequencedTestDraftStream, + createTestDraftStream, +} from "./draft-stream.test-helpers.js"; import { type ArchivedPreview, createLaneTextDeliverer, @@ -173,7 +176,10 @@ describe("createLaneTextDeliverer", () => { }); it("primes stop-created previews with final text before editing", async () => { - const harness = createHarness({ answerMessageIdAfterStop: 777 }); + const harness = createHarness({ + answerMessageIdAfterStop: 777, + answerHasStreamedMessage: true, + }); harness.lanes.answer.lastPartialText = "no"; const result = await harness.deliverLaneText({ @@ -196,7 +202,10 @@ describe("createLaneTextDeliverer", () => { }); it("keeps stop-created preview when follow-up final edit fails", async () => { - const harness = createHarness({ answerMessageIdAfterStop: 777 }); + const harness = createHarness({ + answerMessageIdAfterStop: 777, + answerHasStreamedMessage: true, + }); harness.editPreview.mockRejectedValue(new Error("500: edit failed after stop flush")); const result = await harness.deliverLaneText({ @@ -314,6 +323,29 @@ describe("createLaneTextDeliverer", () => { ); }); + it("does not create a synthetic preview for final-only text", async () => { + const answerStream = createSequencedTestDraftStream(777); + const harness = createHarness({ + answerStream: answerStream as DraftLaneState["stream"], + answerHasStreamedMessage: false, + }); + + const result = await harness.deliverLaneText({ + laneName: "answer", + text: "Final only", + payload: { text: "Final only" }, + infoKind: "final", + }); + + expect(result.kind).toBe("sent"); + expect(answerStream.update).not.toHaveBeenCalled(); + expect(answerStream.materialize).not.toHaveBeenCalled(); + expect(harness.editPreview).not.toHaveBeenCalled(); + expect(harness.sendPayload).toHaveBeenCalledWith( + expect.objectContaining({ text: "Final only" }), + ); + }); + it("keeps existing preview when final text regresses", async () => { const harness = createHarness({ answerMessageId: 999 }); harness.lanes.answer.lastPartialText = "Recovered final answer."; @@ -485,6 +517,53 @@ describe("createLaneTextDeliverer", () => { expect(harness.markDelivered).toHaveBeenCalledTimes(1); }); + it("does not materialize a native draft for final-only text", async () => { + const answerStream = createTestDraftStream({ previewMode: "draft" }); + answerStream.materialize.mockResolvedValue(321); + const harness = createHarness({ + answerStream: answerStream as DraftLaneState["stream"], + answerHasStreamedMessage: false, + }); + + const result = await harness.deliverLaneText({ + laneName: "answer", + text: "Final only", + payload: { text: "Final only" }, + infoKind: "final", + }); + + expect(result.kind).toBe("sent"); + expect(answerStream.update).not.toHaveBeenCalled(); + expect(answerStream.materialize).not.toHaveBeenCalled(); + expect(harness.sendPayload).toHaveBeenCalledWith( + expect.objectContaining({ text: "Final only" }), + ); + }); + + it("does not materialize native draft tool-progress preview before final-only text", async () => { + const answerStream = createTestDraftStream({ previewMode: "draft" }); + answerStream.materialize.mockResolvedValue(321); + const harness = createHarness({ + answerStream: answerStream as DraftLaneState["stream"], + answerHasStreamedMessage: false, + answerLastPartialText: "Working...\n- tool: exec", + }); + + const result = await harness.deliverLaneText({ + laneName: "answer", + text: "Final only", + payload: { text: "Final only" }, + infoKind: "final", + }); + + expect(result.kind).toBe("sent"); + expect(answerStream.update).not.toHaveBeenCalledWith("Final only"); + expect(answerStream.materialize).not.toHaveBeenCalled(); + expect(harness.sendPayload).toHaveBeenCalledWith( + expect.objectContaining({ text: "Final only" }), + ); + }); + it("materializes DM draft streaming final when revision changes", async () => { let previewRevision = 3; const answerStream = createTestDraftStream({ previewMode: "draft", messageId: 654 }); From 29af4add2a8e612921e87aeb6426373e162c9d4a Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 03:45:28 +0100 Subject: [PATCH 190/418] feat: trigger compaction for oversized transcripts --- CHANGELOG.md | 4 + docs/.generated/config-baseline.sha256 | 4 +- docs/concepts/compaction.md | 10 ++ docs/gateway/config-agents.md | 3 + .../session-management-compaction.md | 12 ++ .../reply/agent-runner-memory.test.ts | 110 ++++++++++++++++++ src/auto-reply/reply/agent-runner-memory.ts | 35 +++++- src/auto-reply/reply/memory-flush.ts | 10 ++ src/config/config.compaction-settings.test.ts | 2 + src/config/config.schema-regressions.test.ts | 1 + src/config/schema.base.generated.ts | 20 ++++ src/config/schema.help.quality.test.ts | 5 + src/config/schema.help.ts | 2 + src/config/schema.labels.ts | 2 + src/config/types.agent-defaults.ts | 8 ++ src/config/zod-schema.agent-defaults.test.ts | 2 + src/config/zod-schema.agent-defaults.ts | 15 ++- 17 files changed, 230 insertions(+), 15 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0eab864e594..9950c8445ba 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,10 @@ Docs: https://docs.openclaw.ai ## Unreleased +### Changes + +- Agents/compaction: add an opt-in `agents.defaults.compaction.maxActiveTranscriptBytes` preflight trigger that runs normal local compaction when the active JSONL grows too large, requiring transcript rotation so successful compaction moves future turns onto a smaller successor file instead of raw byte-splitting history. Thanks @vincentkoc. + ### Fixes - Cron: classify isolated runs as errors when final output narrates known execution-denial markers such as `SYSTEM_RUN_DENIED`, `INVALID_REQUEST`, or approval-binding refusal phrases, so blocked commands no longer appear green in cron history. Fixes #67172; carries forward #67186. Thanks @oc-gh-dr, @hclsys, and @1yihui. diff --git a/docs/.generated/config-baseline.sha256 b/docs/.generated/config-baseline.sha256 index 237f6856ec9..15ec791ff4e 100644 --- a/docs/.generated/config-baseline.sha256 +++ b/docs/.generated/config-baseline.sha256 @@ -1,4 +1,4 @@ -29181dbaa26242ced515ba4c2b363853a24b5b2623b33ecfede252c2a984b7c6 config-baseline.json -2edac1da06bbb3709375bf82ae68890c67634f5ad3200a98a1d008b22c335e79 config-baseline.core.json +0c3eaaee031f0adec2fcfc8a3a6a0d80dfc19d4d1c10b0ff4249b30e04b3c47d config-baseline.json +420269ce22f17382cb253c80a232329e943296be101cda313506341ae39cc674 config-baseline.core.json 07963db49502132f26db396c56b36e018b110e6c55a68b3cb012d3ec96f43901 config-baseline.channel.json 74b74cb18ac37c0acaa765f398f1f9edbcee4c43567f02d45c89598a1e13afb4 config-baseline.plugin.json diff --git a/docs/concepts/compaction.md b/docs/concepts/compaction.md index 95e0b851795..d7ebc4504d4 100644 --- a/docs/concepts/compaction.md +++ b/docs/concepts/compaction.md @@ -124,6 +124,16 @@ active successor transcript from the compaction summary, preserved state, and unsummarized tail, then keeps the previous JSONL as the archived checkpoint source. +When `agents.defaults.compaction.maxActiveTranscriptBytes` is set, OpenClaw can +trigger normal local compaction before a run if the active JSONL reaches that +size. This is useful for long-running sessions where provider-side context +management may keep model context healthy while the local transcript keeps +growing. It does not split raw JSONL bytes; it only asks the normal compaction +pipeline to create a semantic summary. Combine it with +`truncateAfterCompaction: true` to move future turns onto the smaller successor +transcript; without transcript rotation, the byte guard remains inactive because +the active file would not shrink. + ## Using a different model By default, compaction uses your agent's primary model. You can use a more diff --git a/docs/gateway/config-agents.md b/docs/gateway/config-agents.md index 13fec116f52..4c36bf8e8d1 100644 --- a/docs/gateway/config-agents.md +++ b/docs/gateway/config-agents.md @@ -554,6 +554,8 @@ Periodic heartbeat runs. qualityGuard: { enabled: true, maxRetries: 1 }, postCompactionSections: ["Session Startup", "Red Lines"], // [] disables reinjection model: "openrouter/anthropic/claude-sonnet-4-6", // optional compaction-only model override + truncateAfterCompaction: true, // rotate to a smaller successor JSONL after compaction + maxActiveTranscriptBytes: "20mb", // optional preflight local compaction trigger notifyUser: true, // send brief notices when compaction starts and completes (default: false) memoryFlush: { enabled: true, @@ -576,6 +578,7 @@ Periodic heartbeat runs. - `qualityGuard`: retry-on-malformed-output checks for safeguard summaries. Enabled by default in safeguard mode; set `enabled: false` to skip the audit. - `postCompactionSections`: optional AGENTS.md H2/H3 section names to re-inject after compaction. Defaults to `["Session Startup", "Red Lines"]`; set `[]` to disable reinjection. When unset or explicitly set to that default pair, older `Every Session`/`Safety` headings are also accepted as a legacy fallback. - `model`: optional `provider/model-id` override for compaction summarization only. Use this when the main session should keep one model but compaction summaries should run on another; when unset, compaction uses the session's primary model. +- `maxActiveTranscriptBytes`: optional byte threshold (`number` or strings like `"20mb"`) that triggers normal local compaction before a run when the active JSONL grows past the threshold. Requires `truncateAfterCompaction` so successful compaction can rotate to a smaller successor transcript. Disabled when unset or `0`. - `notifyUser`: when `true`, sends brief notices to the user when compaction starts and when it completes (for example, "Compacting context..." and "Compaction complete"). Disabled by default to keep compaction silent. - `memoryFlush`: silent agentic turn before auto-compaction to store durable memories. Skipped when workspace is read-only. diff --git a/docs/reference/session-management-compaction.md b/docs/reference/session-management-compaction.md index aced6697325..a1e2ab7cd66 100644 --- a/docs/reference/session-management-compaction.md +++ b/docs/reference/session-management-compaction.md @@ -259,6 +259,13 @@ Where: These are Pi runtime semantics (OpenClaw consumes the events, but Pi decides when to compact). +OpenClaw can also trigger a preflight local compaction before opening the next +run when `agents.defaults.compaction.maxActiveTranscriptBytes` is set and the +active transcript file reaches that size. This is a file-size guard for local +reopen cost, not raw archival: OpenClaw still runs normal semantic compaction, +and it requires `truncateAfterCompaction` so the compacted summary can become a +new successor transcript. + --- ## Compaction settings (`reserveTokens`, `keepRecentTokens`) @@ -285,6 +292,11 @@ OpenClaw also enforces a safety floor for embedded runs: and keeps Pi's recent-tail cut point. Without an explicit keep budget, manual compaction remains a hard checkpoint and rebuilt context starts from the new summary. +- Set `agents.defaults.compaction.maxActiveTranscriptBytes` to a byte value or + string such as `"20mb"` to run local compaction before a turn when the active + transcript gets large. This guard is active only when + `truncateAfterCompaction` is also enabled. Leave it unset or set `0` to + disable. - When `agents.defaults.compaction.truncateAfterCompaction` is enabled, OpenClaw rotates the active transcript to a compacted successor JSONL after compaction. The old full transcript remains archived and linked from the diff --git a/src/auto-reply/reply/agent-runner-memory.test.ts b/src/auto-reply/reply/agent-runner-memory.test.ts index 500d777cf6b..3fdbf4b2ef8 100644 --- a/src/auto-reply/reply/agent-runner-memory.test.ts +++ b/src/auto-reply/reply/agent-runner-memory.test.ts @@ -364,6 +364,116 @@ describe("runMemoryFlushIfNeeded", () => { }); }); + it("triggers preflight compaction when the active transcript exceeds the configured byte threshold", async () => { + const sessionFile = path.join(rootDir, "large-session.jsonl"); + await fs.writeFile( + sessionFile, + `${JSON.stringify({ message: { role: "user", content: "x".repeat(256) } })}\n`, + "utf8", + ); + const sessionEntry: SessionEntry = { + sessionId: "session", + sessionFile, + updatedAt: Date.now(), + totalTokens: 10, + totalTokensFresh: true, + compactionCount: 0, + }; + const sessionStore = { main: sessionEntry }; + const replyOperation = { + abortSignal: new AbortController().signal, + setPhase: vi.fn(), + updateSessionId: vi.fn(), + }; + + const entry = await runPreflightCompactionIfNeeded({ + cfg: { + agents: { + defaults: { + compaction: { + truncateAfterCompaction: true, + maxActiveTranscriptBytes: "10b", + }, + }, + }, + }, + followupRun: createTestFollowupRun({ + sessionId: "session", + sessionFile, + sessionKey: "main", + }), + defaultModel: "anthropic/claude-opus-4-6", + agentCfgContextTokens: 100_000, + sessionEntry, + sessionStore, + sessionKey: "main", + storePath: path.join(rootDir, "sessions.json"), + isHeartbeat: false, + replyOperation: replyOperation as never, + }); + + expect(entry?.compactionCount).toBe(1); + expect(replyOperation.setPhase).toHaveBeenCalledWith("preflight_compacting"); + const compactCall = compactEmbeddedPiSessionMock.mock.calls[0]?.[0] as { + currentTokenCount?: number; + sessionFile?: string; + sessionId?: string; + trigger?: string; + }; + expect(compactCall).toEqual( + expect.objectContaining({ + sessionId: "session", + trigger: "budget", + currentTokenCount: 10, + }), + ); + expect(compactCall.sessionFile).toContain("large-session.jsonl"); + }); + + it("keeps the active transcript byte threshold inactive unless transcript rotation is enabled", async () => { + const sessionFile = path.join(rootDir, "large-session-no-rotation.jsonl"); + await fs.writeFile( + sessionFile, + `${JSON.stringify({ message: { role: "user", content: "x".repeat(256) } })}\n`, + "utf8", + ); + const sessionEntry: SessionEntry = { + sessionId: "session", + sessionFile, + updatedAt: Date.now(), + totalTokens: 10, + totalTokensFresh: true, + compactionCount: 0, + }; + + const entry = await runPreflightCompactionIfNeeded({ + cfg: { + agents: { + defaults: { + compaction: { + maxActiveTranscriptBytes: "10b", + }, + }, + }, + }, + followupRun: createTestFollowupRun({ + sessionId: "session", + sessionFile, + sessionKey: "main", + }), + defaultModel: "anthropic/claude-opus-4-6", + agentCfgContextTokens: 100_000, + sessionEntry, + sessionStore: { main: sessionEntry }, + sessionKey: "main", + isHeartbeat: false, + replyOperation: createReplyOperation(), + }); + + expect(entry).toBe(sessionEntry); + expect(compactEmbeddedPiSessionMock).not.toHaveBeenCalled(); + }); + it("uses configured prompts and stored bootstrap warning signatures", async () => { const sessionEntry: SessionEntry = { sessionId: "session", diff --git a/src/auto-reply/reply/agent-runner-memory.ts b/src/auto-reply/reply/agent-runner-memory.ts index 640dbe18daa..c9efcc431df 100644 --- a/src/auto-reply/reply/agent-runner-memory.ts +++ b/src/auto-reply/reply/agent-runner-memory.ts @@ -35,6 +35,7 @@ import { } from "./agent-runner-utils.js"; import { hasAlreadyFlushedForCurrentCompaction, + resolveMaxActiveTranscriptBytes, resolveMemoryFlushContextWindowTokens, shouldRunMemoryFlush, shouldRunPreflightCompaction, @@ -400,8 +401,25 @@ export async function runPreflightCompactionIfNeeded(params: { typeof persistedTotalTokens === "number" && Number.isFinite(persistedTotalTokens) && persistedTotalTokens > 0; + const maxActiveTranscriptBytes = resolveMaxActiveTranscriptBytes(params.cfg); + const shouldCheckActiveTranscriptBytes = typeof maxActiveTranscriptBytes === "number"; + const transcriptSizeSnapshot = shouldCheckActiveTranscriptBytes + ? await readSessionLogSnapshot({ + sessionId: entry.sessionId, + sessionEntry: entry, + sessionKey: params.sessionKey ?? params.followupRun.run.sessionKey, + opts: { storePath: params.storePath }, + includeByteSize: true, + includeUsage: false, + }) + : undefined; + const activeTranscriptBytes = transcriptSizeSnapshot?.byteSize; + const shouldCompactByTranscriptBytes = + typeof activeTranscriptBytes === "number" && + typeof maxActiveTranscriptBytes === "number" && + activeTranscriptBytes >= maxActiveTranscriptBytes; const shouldUseTranscriptFallback = entry.totalTokensFresh === false || !hasPersistedTotalTokens; - if (!shouldUseTranscriptFallback) { + if (!shouldUseTranscriptFallback && !shouldCompactByTranscriptBytes) { return entry ?? params.sessionEntry; } const promptTokenEstimate = estimatePromptTokensForMemoryFlush( @@ -434,24 +452,31 @@ export async function runPreflightCompactionIfNeeded(params: { `isHeartbeat=${params.isHeartbeat} isCli=${isCli} ` + `persistedFresh=${entry?.totalTokensFresh === true} ` + `transcriptPromptTokens=${transcriptPromptTokens ?? "undefined"} ` + - `promptTokensEst=${promptTokenEstimate ?? "undefined"}`, + `promptTokensEst=${promptTokenEstimate ?? "undefined"} ` + + `activeTranscriptBytes=${activeTranscriptBytes ?? "undefined"} ` + + `maxActiveTranscriptBytes=${maxActiveTranscriptBytes ?? "undefined"} ` + + `sizeTrigger=${shouldCompactByTranscriptBytes}`, ); - const shouldCompact = shouldRunPreflightCompaction({ + const shouldCompactByTokens = shouldRunPreflightCompaction({ entry, tokenCount: tokenCountForCompaction, contextWindowTokens, reserveTokensFloor, softThresholdTokens, }); + const shouldCompact = shouldCompactByTokens || shouldCompactByTranscriptBytes; if (!shouldCompact) { return entry ?? params.sessionEntry; } + const compactionTrigger = shouldCompactByTranscriptBytes ? "transcript_bytes" : "tokens"; logVerbose( `preflightCompaction triggered: sessionKey=${params.sessionKey} ` + `tokenCount=${tokenCountForCompaction ?? freshPersistedTokens ?? "undefined"} ` + - `threshold=${threshold}`, + `threshold=${threshold} trigger=${compactionTrigger} ` + + `activeTranscriptBytes=${activeTranscriptBytes ?? "undefined"} ` + + `maxActiveTranscriptBytes=${maxActiveTranscriptBytes ?? "undefined"}`, ); params.replyOperation.setPhase("preflight_compacting"); @@ -486,7 +511,7 @@ export async function runPreflightCompactionIfNeeded(params: { thinkLevel: params.followupRun.run.thinkLevel, bashElevated: params.followupRun.run.bashElevated, trigger: "budget", - currentTokenCount: tokenCountForCompaction, + currentTokenCount: tokenCountForCompaction ?? freshPersistedTokens, senderIsOwner: params.followupRun.run.senderIsOwner, ownerNumbers: params.followupRun.run.ownerNumbers, abortSignal: params.replyOperation.abortSignal, diff --git a/src/auto-reply/reply/memory-flush.ts b/src/auto-reply/reply/memory-flush.ts index 76c5714c199..e4be2b3a7a0 100644 --- a/src/auto-reply/reply/memory-flush.ts +++ b/src/auto-reply/reply/memory-flush.ts @@ -1,6 +1,7 @@ import crypto from "node:crypto"; import { resolveContextTokensForModel } from "../../agents/context.js"; import { DEFAULT_CONTEXT_TOKENS } from "../../agents/defaults.js"; +import { parseNonNegativeByteSize } from "../../config/byte-size.js"; import { resolveFreshSessionTotalTokens, type SessionEntry } from "../../config/sessions.js"; import type { OpenClawConfig } from "../../config/types.openclaw.js"; @@ -21,6 +22,15 @@ export function resolveMemoryFlushContextWindowTokens(params: { ); } +export function resolveMaxActiveTranscriptBytes(cfg?: OpenClawConfig): number | undefined { + const compaction = cfg?.agents?.defaults?.compaction; + if (compaction?.truncateAfterCompaction !== true) { + return undefined; + } + const parsed = parseNonNegativeByteSize(compaction.maxActiveTranscriptBytes); + return typeof parsed === "number" && parsed > 0 ? parsed : undefined; +} + function resolvePositiveTokenCount(value: number | undefined): number | undefined { return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) diff --git a/src/config/config.compaction-settings.test.ts b/src/config/config.compaction-settings.test.ts index af9d4fe867a..d7980de244f 100644 --- a/src/config/config.compaction-settings.test.ts +++ b/src/config/config.compaction-settings.test.ts @@ -32,6 +32,7 @@ describe("config compaction settings", () => { prompt: "Write notes.", systemPrompt: "Flush memory now.", }, + maxActiveTranscriptBytes: "20mb", }); expect(compaction?.reserveTokensFloor).toBe(12_345); @@ -46,6 +47,7 @@ describe("config compaction settings", () => { expect(compaction?.memoryFlush?.softThresholdTokens).toBe(1234); expect(compaction?.memoryFlush?.prompt).toBe("Write notes."); expect(compaction?.memoryFlush?.systemPrompt).toBe("Flush memory now."); + expect(compaction?.maxActiveTranscriptBytes).toBe("20mb"); }); it("preserves pi compaction override values", () => { diff --git a/src/config/config.schema-regressions.test.ts b/src/config/config.schema-regressions.test.ts index 332ef25eb36..bc2bbceef0e 100644 --- a/src/config/config.schema-regressions.test.ts +++ b/src/config/config.schema-regressions.test.ts @@ -151,6 +151,7 @@ describe("config schema regressions", () => { defaults: { compaction: { truncateAfterCompaction: true, + maxActiveTranscriptBytes: "20mb", }, }, }, diff --git a/src/config/schema.base.generated.ts b/src/config/schema.base.generated.ts index 1210a81a461..4addd3d5ba8 100644 --- a/src/config/schema.base.generated.ts +++ b/src/config/schema.base.generated.ts @@ -5001,6 +5001,21 @@ export const GENERATED_BASE_CONFIG_SCHEMA: BaseConfigSchemaResponse = { description: "When enabled, rotates the active session JSONL file after compaction so future turns load only the summary and unsummarized tail while the previous full transcript remains archived. Prevents unbounded active transcript growth in long-running sessions. Default: false.", }, + maxActiveTranscriptBytes: { + anyOf: [ + { + type: "integer", + minimum: 0, + maximum: 9007199254740991, + }, + { + type: "string", + }, + ], + title: "Compaction Active Transcript Size Threshold", + description: + 'Triggers normal local compaction when the active session transcript reaches this size (bytes or strings like "20mb"). Requires truncateAfterCompaction so successful compaction can rotate to a smaller successor transcript; set to 0 or leave unset to disable. This never splits raw transcript bytes.', + }, notifyUser: { type: "boolean", title: "Compaction Notify User", @@ -26867,6 +26882,11 @@ export const GENERATED_BASE_CONFIG_SCHEMA: BaseConfigSchemaResponse = { help: "When enabled, rotates the active session JSONL file after compaction so future turns load only the summary and unsummarized tail while the previous full transcript remains archived. Prevents unbounded active transcript growth in long-running sessions. Default: false.", tags: ["advanced"], }, + "agents.defaults.compaction.maxActiveTranscriptBytes": { + label: "Compaction Active Transcript Size Threshold", + help: 'Triggers normal local compaction when the active session transcript reaches this size (bytes or strings like "20mb"). Requires truncateAfterCompaction so successful compaction can rotate to a smaller successor transcript; set to 0 or leave unset to disable. This never splits raw transcript bytes.', + tags: ["performance"], + }, "agents.defaults.compaction.notifyUser": { label: "Compaction Notify User", help: "When enabled, sends brief compaction notices to the user when compaction starts and when it completes (for example, '🧹 Compacting context...' and '🧹 Compaction complete'). Disabled by default to keep compaction silent and non-intrusive.", diff --git a/src/config/schema.help.quality.test.ts b/src/config/schema.help.quality.test.ts index 80331de0200..ef359c16861 100644 --- a/src/config/schema.help.quality.test.ts +++ b/src/config/schema.help.quality.test.ts @@ -389,6 +389,7 @@ const TARGET_KEYS = [ "agents.defaults.compaction.timeoutSeconds", "agents.defaults.compaction.model", "agents.defaults.compaction.truncateAfterCompaction", + "agents.defaults.compaction.maxActiveTranscriptBytes", "agents.defaults.compaction.memoryFlush", "agents.defaults.compaction.memoryFlush.enabled", "agents.defaults.compaction.memoryFlush.softThresholdTokens", @@ -811,6 +812,10 @@ describe("config help copy quality", () => { const compactionModel = FIELD_HELP["agents.defaults.compaction.model"]; expect(/provider\/model|different model|primary agent model/i.test(compactionModel)).toBe(true); + const transcriptBytes = FIELD_HELP["agents.defaults.compaction.maxActiveTranscriptBytes"]; + expect(/transcript|bytes|compaction/i.test(transcriptBytes)).toBe(true); + expect(/never splits raw transcript bytes/i.test(transcriptBytes)).toBe(true); + const flush = FIELD_HELP["agents.defaults.compaction.memoryFlush.enabled"]; expect(/pre-compaction|memory flush|token/i.test(flush)).toBe(true); }); diff --git a/src/config/schema.help.ts b/src/config/schema.help.ts index 83d63ae9a0a..c4e873858ba 100644 --- a/src/config/schema.help.ts +++ b/src/config/schema.help.ts @@ -1267,6 +1267,8 @@ export const FIELD_HELP: Record = { "Optional provider/model override used only for compaction summarization. Set this when you want compaction to run on a different model than the session default, and leave it unset to keep using the primary agent model.", "agents.defaults.compaction.truncateAfterCompaction": "When enabled, rotates the active session JSONL file after compaction so future turns load only the summary and unsummarized tail while the previous full transcript remains archived. Prevents unbounded active transcript growth in long-running sessions. Default: false.", + "agents.defaults.compaction.maxActiveTranscriptBytes": + 'Triggers normal local compaction when the active session transcript reaches this size (bytes or strings like "20mb"). Requires truncateAfterCompaction so successful compaction can rotate to a smaller successor transcript; set to 0 or leave unset to disable. This never splits raw transcript bytes.', "agents.defaults.compaction.notifyUser": "When enabled, sends brief compaction notices to the user when compaction starts and when it completes (for example, '🧹 Compacting context...' and '🧹 Compaction complete'). Disabled by default to keep compaction silent and non-intrusive.", "agents.defaults.compaction.memoryFlush": diff --git a/src/config/schema.labels.ts b/src/config/schema.labels.ts index 8517201d683..8806ed461c6 100644 --- a/src/config/schema.labels.ts +++ b/src/config/schema.labels.ts @@ -595,6 +595,8 @@ export const FIELD_LABELS: Record = { "agents.defaults.compaction.timeoutSeconds": "Compaction Timeout (Seconds)", "agents.defaults.compaction.model": "Compaction Model Override", "agents.defaults.compaction.truncateAfterCompaction": "Rotate Transcript After Compaction", + "agents.defaults.compaction.maxActiveTranscriptBytes": + "Compaction Active Transcript Size Threshold", "agents.defaults.compaction.notifyUser": "Compaction Notify User", "agents.defaults.compaction.memoryFlush": "Compaction Memory Flush", "agents.defaults.compaction.memoryFlush.enabled": "Compaction Memory Flush Enabled", diff --git a/src/config/types.agent-defaults.ts b/src/config/types.agent-defaults.ts index 7c86706b9e9..4e7d4cb8455 100644 --- a/src/config/types.agent-defaults.ts +++ b/src/config/types.agent-defaults.ts @@ -477,6 +477,14 @@ export type AgentCompactionConfig = { * Default: false (existing behavior preserved). */ truncateAfterCompaction?: boolean; + /** + * Trigger a normal local compaction when the active session JSONL reaches + * this size (bytes, or byte-size string like "20mb"). Set to 0/unset to + * disable. Requires truncateAfterCompaction so successful compaction can + * rotate to a smaller successor transcript. This does not split raw + * transcript bytes. + */ + maxActiveTranscriptBytes?: number | string; /** * Send brief compaction notices to the user when compaction starts and completes. * Default: false (silent by default). diff --git a/src/config/zod-schema.agent-defaults.test.ts b/src/config/zod-schema.agent-defaults.test.ts index ad4dd60019a..53294caea64 100644 --- a/src/config/zod-schema.agent-defaults.test.ts +++ b/src/config/zod-schema.agent-defaults.test.ts @@ -96,9 +96,11 @@ describe("agent defaults schema", () => { const result = AgentDefaultsSchema.parse({ compaction: { truncateAfterCompaction: true, + maxActiveTranscriptBytes: "20mb", }, })!; expect(result.compaction?.truncateAfterCompaction).toBe(true); + expect(result.compaction?.maxActiveTranscriptBytes).toBe("20mb"); }); it("accepts focused contextLimits on defaults and agent entries", () => { diff --git a/src/config/zod-schema.agent-defaults.ts b/src/config/zod-schema.agent-defaults.ts index f565ed106a0..6556d8f6e6e 100644 --- a/src/config/zod-schema.agent-defaults.ts +++ b/src/config/zod-schema.agent-defaults.ts @@ -20,6 +20,11 @@ import { export const SilentReplyPolicySchema = z.union([z.literal("allow"), z.literal("disallow")]); +const NonNegativeByteSizeSchema = z.union([ + z.number().int().nonnegative(), + z.string().refine(isValidNonNegativeByteSizeString, "Expected byte size string like 2mb"), +]); + export const SilentReplyPolicyConfigSchema = z .object({ direct: SilentReplyPolicySchema.optional(), @@ -199,20 +204,14 @@ export const AgentDefaultsSchema = z .object({ enabled: z.boolean().optional(), softThresholdTokens: z.number().int().nonnegative().optional(), - forceFlushTranscriptBytes: z - .union([ - z.number().int().nonnegative(), - z - .string() - .refine(isValidNonNegativeByteSizeString, "Expected byte size string like 2mb"), - ]) - .optional(), + forceFlushTranscriptBytes: NonNegativeByteSizeSchema.optional(), prompt: z.string().optional(), systemPrompt: z.string().optional(), }) .strict() .optional(), truncateAfterCompaction: z.boolean().optional(), + maxActiveTranscriptBytes: NonNegativeByteSizeSchema.optional(), notifyUser: z.boolean().optional(), }) .strict() From 313a19c94096ab0ace247757f36030341d632376 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 03:53:57 +0100 Subject: [PATCH 191/418] fix(ollama): scope auth to local hosts --- CHANGELOG.md | 2 +- docs/providers/ollama.md | 4 + extensions/ollama/index.test.ts | 30 +++- extensions/ollama/index.ts | 4 +- extensions/ollama/provider-discovery.test.ts | 41 ++++- extensions/ollama/provider-discovery.ts | 4 +- .../ollama/src/discovery-shared.test.ts | 38 +++++ extensions/ollama/src/discovery-shared.ts | 106 +++++++++++-- .../ollama/src/embedding-provider.test.ts | 140 ++++++++++++++++- extensions/ollama/src/embedding-provider.ts | 141 ++++++++++++++++-- 10 files changed, 471 insertions(+), 39 deletions(-) create mode 100644 extensions/ollama/src/discovery-shared.test.ts diff --git a/CHANGELOG.md b/CHANGELOG.md index 9950c8445ba..5f53282ec21 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -40,6 +40,7 @@ Docs: https://docs.openclaw.ai - Providers/Ollama: move memory embeddings to Ollama's current `/api/embed` endpoint with batched `input` requests while preserving vector normalization and custom provider auth/header overrides. Fixes #39983. Thanks @sskkcc and @LiudengZhang. - Providers/Ollama: route local web search through Ollama's signed `/api/experimental/web_search` daemon proxy, use hosted `/api/web_search` directly for `ollama.com`, and keep `OLLAMA_API_KEY` scoped to cloud fallback auth. Fixes #69132. Thanks @yoon1012 and @hyspacex. - Providers/Ollama: accept OpenAI SDK-style `baseURL` as an alias for `baseUrl` across discovery, streaming, setup pulls, embeddings, and web search so remote Ollama hosts are not silently ignored. Fixes #62533; supersedes #62549. Thanks @Julien-BKK and @Linux2010. +- Providers/Ollama: scope synthetic local auth and embedding bearer headers to declared Ollama host boundaries so cloud keys are not sent to local/self-hosted embedding endpoints and remote/cloud Ollama endpoints no longer receive the `ollama-local` marker as if it were a real token. Supersedes #69261 and #69857; refs #43945. Thanks @hyspacex, @maxramsay, and @Meli73. - Providers/PDF/Ollama: add bounded network timeouts for Ollama model pulls and native Anthropic/Gemini PDF analysis requests so unresponsive provider endpoints no longer hang sessions indefinitely. Fixes #54142; supersedes #54144 and #54145. Thanks @jinduwang1001-max and @arkyu2077. - Memory/doctor: treat Ollama memory embeddings as key-optional so `openclaw doctor` no longer warns about a missing API key when the gateway reports embeddings are ready. Fixes #46584. Thanks @fengly78. - Agents/Ollama: apply provider-owned replay turn normalization to native Ollama chat so Cloud models no longer reject non-alternating replay history in agent/Gateway runs. Fixes #71697. Thanks @ismael-81. @@ -70,7 +71,6 @@ Docs: https://docs.openclaw.ai - Plugins/memory-core: respect configured memory-search embedding concurrency during non-batch indexing so local Ollama embedding backends can serialize indexing instead of flooding the server. Fixes #66822. (#66931) Thanks @oliviareid-svg and @LyraInTheFlesh. - Docker/update smoke: keep the package-derived update-channel fixture on package-shipped files and make its UI build stub create the asset the updater verifies. Thanks @vincentkoc. - ## 2026.4.26 ### Fixes diff --git a/docs/providers/ollama.md b/docs/providers/ollama.md index d7e66573eb0..49afb9affdc 100644 --- a/docs/providers/ollama.md +++ b/docs/providers/ollama.md @@ -15,6 +15,10 @@ OpenClaw integrates with Ollama's native API (`/api/chat`) for hosted cloud mode Ollama provider config uses `baseUrl` as the canonical key. OpenClaw also accepts `baseURL` for compatibility with OpenAI SDK-style examples, but new config should prefer `baseUrl`. +Local and LAN Ollama hosts do not need a real bearer token; OpenClaw uses the local `ollama-local` marker only for loopback, private-network, `.local`, and bare-hostname Ollama base URLs. Remote public hosts and Ollama Cloud (`https://ollama.com`) require a real credential through `OLLAMA_API_KEY`, an auth profile, or the provider's `apiKey`. + +When Ollama is used for memory embeddings, bearer auth is scoped to the host where it was declared. A provider-level key is sent only to that provider's Ollama host; `agents.*.memorySearch.remote.apiKey` is sent only to its remote embedding host; and a pure `OLLAMA_API_KEY` env value is treated as the Ollama Cloud convention rather than being sent to local/self-hosted hosts by default. + ## Getting started Choose your preferred setup method and mode. diff --git a/extensions/ollama/index.test.ts b/extensions/ollama/index.test.ts index 5463650e689..f6cb521699a 100644 --- a/extensions/ollama/index.test.ts +++ b/extensions/ollama/index.test.ts @@ -236,7 +236,7 @@ describe("ollama plugin", () => { baseUrl: "http://127.0.0.1:11434", api: "ollama", models: [{ id: "llama3.2", name: "Llama 3.2" }], - apiKey: "OLLAMA_API_KEY", + apiKey: "ollama-local", }, }); }); @@ -419,6 +419,34 @@ describe("ollama plugin", () => { }); }); + it("does not mint synthetic auth for Ollama Cloud baseUrl", () => { + const provider = registerProvider(); + + const auth = provider.resolveSyntheticAuth?.({ + providerConfig: { + baseUrl: "https://ollama.com", + api: "ollama", + models: [], + }, + }); + + expect(auth).toBeUndefined(); + }); + + it("does not mint synthetic auth for public IPv4 baseUrl", () => { + const provider = registerProvider(); + + const auth = provider.resolveSyntheticAuth?.({ + providerConfig: { + baseUrl: "http://8.8.8.8:11434", + api: "ollama", + models: [], + }, + }); + + expect(auth).toBeUndefined(); + }); + it("wraps OpenAI-compatible payloads with num_ctx for Ollama compat routes", () => { const provider = registerProvider(); let payloadSeen: Record | undefined; diff --git a/extensions/ollama/index.ts b/extensions/ollama/index.ts index 24f186b9af5..4bc708d6269 100644 --- a/extensions/ollama/index.ts +++ b/extensions/ollama/index.ts @@ -21,8 +21,8 @@ import { import { OLLAMA_DEFAULT_API_KEY, OLLAMA_PROVIDER_ID, - hasMeaningfulExplicitOllamaConfig, resolveOllamaDiscoveryResult, + shouldUseSyntheticOllamaAuth, type OllamaPluginConfig, } from "./src/discovery-shared.js"; import { @@ -199,7 +199,7 @@ export default definePluginEntry({ /\bollama\b.*(?:context length|too many tokens|context window)/i.test(errorMessage) || /\btruncating input\b.*\btoo long\b/i.test(errorMessage), resolveSyntheticAuth: ({ providerConfig }) => { - if (!hasMeaningfulExplicitOllamaConfig(providerConfig)) { + if (!shouldUseSyntheticOllamaAuth(providerConfig)) { return undefined; } return { diff --git a/extensions/ollama/provider-discovery.test.ts b/extensions/ollama/provider-discovery.test.ts index 0fcf658f377..948aebc1eb8 100644 --- a/extensions/ollama/provider-discovery.test.ts +++ b/extensions/ollama/provider-discovery.test.ts @@ -119,7 +119,7 @@ describe("Ollama provider", () => { const provider = await runOllamaCatalog({}); expect(provider).toBeDefined(); - expect(provider?.apiKey).toBe("OLLAMA_API_KEY"); + expect(provider?.apiKey).toBe(OLLAMA_LOCAL_AUTH_MARKER); expect(provider?.api).toBe("ollama"); expect(provider?.baseUrl).toBe("http://127.0.0.1:11434"); expectDiscoveryCallCounts(fetchMock, { tags: 1, show: 0 }); @@ -213,7 +213,7 @@ describe("Ollama provider", () => { env: { OLLAMA_API_KEY: OLLAMA_LOCAL_AUTH_MARKER, VITEST: "", NODE_ENV: "development" }, }); - expect(provider?.apiKey).toBe("OLLAMA_API_KEY"); + expect(provider?.apiKey).toBe(OLLAMA_LOCAL_AUTH_MARKER); expect(provider?.api).toBe("ollama"); expect(provider?.baseUrl).toBe("http://127.0.0.1:11434"); expect(provider?.models).toHaveLength(2); @@ -428,6 +428,43 @@ describe("Ollama provider", () => { }); }); + it("should not use synthetic local auth for configured cloud providers without apiKey", async () => { + await withoutAmbientOllamaEnv(async () => { + const fetchMock = vi.fn(); + vi.stubGlobal("fetch", withFetchPreconnect(fetchMock)); + + const provider = await runOllamaCatalog({ + config: { + models: { + providers: { + ollama: { + baseUrl: "https://ollama.com/v1", + models: [ + { + id: "gpt-oss:20b", + name: "GPT-OSS 20B", + reasoning: false, + input: ["text"], + cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 }, + contextWindow: 8192, + maxTokens: 81920, + }, + ], + }, + }, + }, + }, + env: { VITEST: "", NODE_ENV: "development" }, + }); + + expect(fetchMock).not.toHaveBeenCalled(); + expect(provider?.baseUrl).toBe("https://ollama.com"); + expect(provider?.api).toBe("ollama"); + expect(provider?.apiKey).toBeUndefined(); + expect(provider?.models).toHaveLength(1); + }); + }); + it("should preserve explicit apiKey from configured remote providers", async () => { await withoutAmbientOllamaEnv(async () => { const fetchMock = vi.fn(async (input: unknown) => { diff --git a/extensions/ollama/provider-discovery.ts b/extensions/ollama/provider-discovery.ts index d2372700b4c..6cb40cee779 100644 --- a/extensions/ollama/provider-discovery.ts +++ b/extensions/ollama/provider-discovery.ts @@ -3,8 +3,8 @@ import type { ModelProviderConfig } from "openclaw/plugin-sdk/provider-model-sha import { OLLAMA_DEFAULT_API_KEY, OLLAMA_PROVIDER_ID, - hasMeaningfulExplicitOllamaConfig, resolveOllamaDiscoveryResult, + shouldUseSyntheticOllamaAuth, type OllamaPluginConfig, } from "./src/discovery-shared.js"; import { buildOllamaProvider } from "./src/provider-models.js"; @@ -51,7 +51,7 @@ export const ollamaProviderDiscovery: OllamaProviderPlugin = { envVars: ["OLLAMA_API_KEY"], auth: [], resolveSyntheticAuth: ({ providerConfig }) => { - if (!hasMeaningfulExplicitOllamaConfig(providerConfig)) { + if (!shouldUseSyntheticOllamaAuth(providerConfig)) { return undefined; } return { diff --git a/extensions/ollama/src/discovery-shared.test.ts b/extensions/ollama/src/discovery-shared.test.ts new file mode 100644 index 00000000000..911c234683e --- /dev/null +++ b/extensions/ollama/src/discovery-shared.test.ts @@ -0,0 +1,38 @@ +import { describe, expect, it } from "vitest"; +import { isLocalOllamaBaseUrl } from "./discovery-shared.js"; + +describe("isLocalOllamaBaseUrl", () => { + it.each([ + undefined, + "", + "http://localhost:11434", + "http://127.0.0.1:11434", + "http://0.0.0.0:11434", + "http://[::1]:11434", + "http://10.0.0.5:11434", + "http://172.16.0.10:11434", + "http://172.31.255.254:11434", + "http://192.168.1.100:11434", + "http://gpu-node-1:11434", + "http://mac-studio.local:11434", + "http://[fd00::1]:11434", + "http://[fe90::1]:11434", + ])("classifies %s as local", (baseUrl) => { + expect(isLocalOllamaBaseUrl(baseUrl)).toBe(true); + }); + + it.each([ + "https://ollama.com", + "https://api.ollama.com/v1", + "https://ollama.example.com:11434", + "http://8.8.8.8:11434", + "http://172.15.255.254:11434", + "http://172.32.0.1:11434", + "http://193.168.1.1:11434", + "http://[2001:4860:4860::8888]:11434", + "http://10.example.com:11434", + "not a url", + ])("classifies %s as remote", (baseUrl) => { + expect(isLocalOllamaBaseUrl(baseUrl)).toBe(false); + }); +}); diff --git a/extensions/ollama/src/discovery-shared.ts b/extensions/ollama/src/discovery-shared.ts index 23108ad6e08..f12d736e6dd 100644 --- a/extensions/ollama/src/discovery-shared.ts +++ b/extensions/ollama/src/discovery-shared.ts @@ -43,18 +43,85 @@ function readStringValue(value: unknown): string | undefined { export function resolveOllamaDiscoveryApiKey(params: { env: NodeJS.ProcessEnv; + baseUrl?: string; explicitApiKey?: string; + hasDeclaredApiKey?: boolean; resolvedApiKey?: unknown; -}): string { - const envApiKey = params.env.OLLAMA_API_KEY?.trim() ? "OLLAMA_API_KEY" : undefined; +}): string | undefined { + const envValue = normalizeOptionalString(params.env.OLLAMA_API_KEY); + const envApiKey = envValue ? "OLLAMA_API_KEY" : undefined; const resolvedApiKey = normalizeOptionalString(params.resolvedApiKey); - return envApiKey ?? params.explicitApiKey ?? resolvedApiKey ?? OLLAMA_DEFAULT_API_KEY; + const explicitApiKey = normalizeOptionalString(params.explicitApiKey); + if (explicitApiKey) { + return explicitApiKey; + } + if (params.hasDeclaredApiKey && resolvedApiKey) { + return resolvedApiKey; + } + if (!isLocalOllamaBaseUrl(params.baseUrl)) { + return envApiKey ?? (resolvedApiKey !== OLLAMA_DEFAULT_API_KEY ? resolvedApiKey : undefined); + } + if (resolvedApiKey && resolvedApiKey !== envValue && resolvedApiKey !== OLLAMA_DEFAULT_API_KEY) { + return resolvedApiKey; + } + return OLLAMA_DEFAULT_API_KEY; } function shouldSkipAmbientOllamaDiscovery(env: NodeJS.ProcessEnv): boolean { return Boolean(env.VITEST) || env.NODE_ENV === "test"; } +const LOCAL_OLLAMA_HOSTNAMES = new Set(["localhost", "127.0.0.1", "0.0.0.0", "::1", "::"]); + +function isIpv4PrivateRange(host: string): boolean { + if (!/^\d+\.\d+\.\d+\.\d+$/.test(host)) { + return false; + } + const octets = host.split(".").map((part) => Number.parseInt(part, 10)); + if (octets.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) { + return false; + } + const [a, b] = octets; + return a === 10 || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168); +} + +function isIpv6LocalRange(host: string): boolean { + const lower = host.toLowerCase(); + return /^fe[89ab][0-9a-f]:/.test(lower) || /^f[cd][0-9a-f]{2}:/.test(lower); +} + +export function isLocalOllamaBaseUrl(baseUrl: string | undefined | null): boolean { + if (!baseUrl) { + return true; + } + let parsed: URL; + try { + parsed = new URL(baseUrl); + } catch { + return false; + } + let host = parsed.hostname.toLowerCase(); + if (host.startsWith("[") && host.endsWith("]")) { + host = host.slice(1, -1); + } + return ( + LOCAL_OLLAMA_HOSTNAMES.has(host) || + host.endsWith(".local") || + isIpv4PrivateRange(host) || + isIpv6LocalRange(host) || + (!host.includes(".") && !host.includes(":")) + ); +} + +export function shouldUseSyntheticOllamaAuth( + providerConfig: ModelProviderConfig | undefined, +): boolean { + if (!hasMeaningfulExplicitOllamaConfig(providerConfig)) { + return false; + } + return isLocalOllamaBaseUrl(readProviderBaseUrl(providerConfig)); +} + export function hasMeaningfulExplicitOllamaConfig( providerConfig: ModelProviderConfig | undefined, ): boolean { @@ -116,17 +183,22 @@ export async function resolveOllamaDiscoveryResult(params: { ollamaKey.trim().length > 0 && ollamaKey.trim() !== OLLAMA_DEFAULT_API_KEY; const explicitApiKey = readStringValue(explicit?.apiKey); + const hasDeclaredApiKey = explicit?.apiKey !== undefined; if (hasExplicitModels && explicit) { + const baseUrl = resolveOllamaApiBase(readProviderBaseUrl(explicit) ?? OLLAMA_DEFAULT_BASE_URL); + const apiKey = resolveOllamaDiscoveryApiKey({ + env: params.ctx.env, + baseUrl, + explicitApiKey, + hasDeclaredApiKey, + resolvedApiKey: ollamaKey, + }); return { provider: { ...explicit, - baseUrl: resolveOllamaApiBase(readProviderBaseUrl(explicit) ?? OLLAMA_DEFAULT_BASE_URL), + baseUrl, api: explicit.api ?? "ollama", - apiKey: resolveOllamaDiscoveryApiKey({ - env: params.ctx.env, - explicitApiKey, - resolvedApiKey: ollamaKey, - }), + ...(apiKey ? { apiKey } : {}), }, }; } @@ -141,20 +213,24 @@ export async function resolveOllamaDiscoveryResult(params: { return null; } - const provider = await params.buildProvider(readProviderBaseUrl(explicit), { + const configuredBaseUrl = readProviderBaseUrl(explicit); + const provider = await params.buildProvider(configuredBaseUrl, { quiet: !hasRealOllamaKey && !hasMeaningfulExplicitConfig, }); if (provider.models?.length === 0 && !ollamaKey && !explicit?.apiKey) { return null; } + const apiKey = resolveOllamaDiscoveryApiKey({ + env: params.ctx.env, + baseUrl: provider.baseUrl ?? configuredBaseUrl, + explicitApiKey, + hasDeclaredApiKey, + resolvedApiKey: ollamaKey, + }); return { provider: { ...provider, - apiKey: resolveOllamaDiscoveryApiKey({ - env: params.ctx.env, - explicitApiKey, - resolvedApiKey: ollamaKey, - }), + ...(apiKey ? { apiKey } : {}), }, }; } diff --git a/extensions/ollama/src/embedding-provider.test.ts b/extensions/ollama/src/embedding-provider.test.ts index e0b9441661e..d006cee55bf 100644 --- a/extensions/ollama/src/embedding-provider.test.ts +++ b/extensions/ollama/src/embedding-provider.test.ts @@ -72,7 +72,7 @@ describe("ollama embedding provider", () => { expect(vector[1]).toBeCloseTo(0.8, 5); }); - it("resolves configured base URL, API key, and headers", async () => { + it("resolves configured base URL and headers without sending local marker auth", async () => { const fetchMock = mockEmbeddingFetch([1, 0]); const { provider } = await createOllamaEmbeddingProvider({ @@ -102,11 +102,16 @@ describe("ollama embedding provider", () => { method: "POST", headers: expect.objectContaining({ "Content-Type": "application/json", - Authorization: "Bearer ollama-local", "X-Provider-Header": "provider", }), }), ); + const [, init] = (fetchMock.mock.calls[0] ?? []) as unknown as [ + string, + RequestInit | undefined, + ]; + const headers = init?.headers as Record | undefined; + expect(headers?.Authorization).toBeUndefined(); }); it("resolves configured baseURL alias", async () => { @@ -256,6 +261,137 @@ describe("ollama embedding provider", () => { ); }); + it("does not attach pure env OLLAMA_API_KEY to a local host", async () => { + const fetchMock = mockEmbeddingFetch([1, 0]); + vi.stubEnv("OLLAMA_API_KEY", "ollama-cloud-key"); + + const { provider } = await createOllamaEmbeddingProvider({ + config: {} as OpenClawConfig, + provider: "ollama", + model: "nomic-embed-text", + fallback: "none", + remote: { baseUrl: "http://127.0.0.1:11434" }, + }); + + await provider.embedQuery("hello"); + + const [, init] = (fetchMock.mock.calls[0] ?? []) as unknown as [ + string, + RequestInit | undefined, + ]; + const headers = init?.headers as Record | undefined; + expect(headers?.Authorization).toBeUndefined(); + }); + + it("attaches pure env OLLAMA_API_KEY to Ollama Cloud", async () => { + const fetchMock = mockEmbeddingFetch([1, 0]); + vi.stubEnv("OLLAMA_API_KEY", "ollama-cloud-key"); + + const { provider } = await createOllamaEmbeddingProvider({ + config: {} as OpenClawConfig, + provider: "ollama", + model: "nomic-embed-text", + fallback: "none", + remote: { baseUrl: "https://ollama.com" }, + }); + + await provider.embedQuery("hello"); + + expect(fetchMock).toHaveBeenCalledWith( + "https://ollama.com/api/embed", + expect.objectContaining({ + headers: expect.objectContaining({ + Authorization: "Bearer ollama-cloud-key", + }), + }), + ); + }); + + it("does not attach provider apiKey to a different remote embedding host", async () => { + const fetchMock = mockEmbeddingFetch([1, 0]); + + const { provider } = await createOllamaEmbeddingProvider({ + config: { + models: { + providers: { + ollama: { + baseUrl: "http://127.0.0.1:11434", + apiKey: "provider-host-key", + models: [], + }, + }, + }, + } as unknown as OpenClawConfig, + provider: "ollama", + model: "nomic-embed-text", + fallback: "none", + remote: { baseUrl: "https://memory.example.com" }, + }); + + await provider.embedQuery("hello"); + + const [, init] = (fetchMock.mock.calls[0] ?? []) as unknown as [ + string, + RequestInit | undefined, + ]; + const headers = init?.headers as Record | undefined; + expect(headers?.Authorization).toBeUndefined(); + }); + + it("attaches remote apiKey to a remote embedding host", async () => { + const fetchMock = mockEmbeddingFetch([1, 0]); + + const { provider } = await createOllamaEmbeddingProvider({ + config: {} as OpenClawConfig, + provider: "ollama", + model: "nomic-embed-text", + fallback: "none", + remote: { baseUrl: "https://memory.example.com", apiKey: "remote-host-key" }, + }); + + await provider.embedQuery("hello"); + + expect(fetchMock).toHaveBeenCalledWith( + "https://memory.example.com/api/embed", + expect.objectContaining({ + headers: expect.objectContaining({ + Authorization: "Bearer remote-host-key", + }), + }), + ); + }); + + it("honors remote local marker as an explicit no-auth opt-out", async () => { + const fetchMock = mockEmbeddingFetch([1, 0]); + + const { provider } = await createOllamaEmbeddingProvider({ + config: { + models: { + providers: { + ollama: { + baseUrl: "http://127.0.0.1:11434", + apiKey: "provider-host-key", + models: [], + }, + }, + }, + } as unknown as OpenClawConfig, + provider: "ollama", + model: "nomic-embed-text", + fallback: "none", + remote: { apiKey: "ollama-local" }, // pragma: allowlist secret + }); + + await provider.embedQuery("hello"); + + const [, init] = (fetchMock.mock.calls[0] ?? []) as unknown as [ + string, + RequestInit | undefined, + ]; + const headers = init?.headers as Record | undefined; + expect(headers?.Authorization).toBeUndefined(); + }); + it("marks inline memory batches as local-server timeout work", async () => { const result = await ollamaMemoryEmbeddingProviderAdapter.create({ config: {} as OpenClawConfig, diff --git a/extensions/ollama/src/embedding-provider.ts b/extensions/ollama/src/embedding-provider.ts index b9351d3097d..1909ffb58c9 100644 --- a/extensions/ollama/src/embedding-provider.ts +++ b/extensions/ollama/src/embedding-provider.ts @@ -1,5 +1,9 @@ import type { OpenClawConfig } from "openclaw/plugin-sdk/provider-auth"; -import { normalizeOptionalSecretInput } from "openclaw/plugin-sdk/provider-auth"; +import { + isKnownEnvApiKeyMarker, + isNonSecretApiKeyMarker, + normalizeOptionalSecretInput, +} from "openclaw/plugin-sdk/provider-auth"; import { resolveEnvApiKey } from "openclaw/plugin-sdk/provider-auth-runtime"; import { normalizeProviderId } from "openclaw/plugin-sdk/provider-model-shared"; import { @@ -12,6 +16,7 @@ import { ssrfPolicyFromHttpBaseUrlAllowedHostname, type SsrFPolicy, } from "openclaw/plugin-sdk/ssrf-runtime"; +import { OLLAMA_CLOUD_BASE_URL } from "./defaults.js"; import { normalizeOllamaWireModelId } from "./model-id.js"; import { readProviderBaseUrl } from "./provider-base-url.js"; import { resolveOllamaApiBase } from "./provider-models.js"; @@ -120,34 +125,142 @@ function resolveMemorySecretInputString(params: { }); } -function resolveOllamaApiKey(options: OllamaEmbeddingOptions): string | undefined { - const remoteApiKey = resolveMemorySecretInputString({ - value: options.remote?.apiKey, - path: "agents.*.memorySearch.remote.apiKey", +type OllamaEmbeddingBaseUrlOrigin = "remote-config" | "provider-config" | "default"; +type OllamaEmbeddingSourceResolution = "unset" | "opt-out" | { apiKey: string }; + +type OllamaEmbeddingResolvedKeys = { + remote: OllamaEmbeddingSourceResolution; + provider: OllamaEmbeddingSourceResolution; + env: string | undefined; +}; + +function resolveSourcedOllamaEmbeddingKey(params: { + configString: string | undefined; + declared: boolean; +}): OllamaEmbeddingSourceResolution { + if (params.configString !== undefined) { + if (!isNonSecretApiKeyMarker(params.configString)) { + return { apiKey: params.configString }; + } + if (!isKnownEnvApiKeyMarker(params.configString)) { + return "opt-out"; + } + const envKey = resolveEnvApiKey("ollama")?.apiKey; + return envKey && !isNonSecretApiKeyMarker(envKey) ? { apiKey: envKey } : "opt-out"; + } + if (params.declared) { + const envKey = resolveEnvApiKey("ollama")?.apiKey; + return envKey && !isNonSecretApiKeyMarker(envKey) ? { apiKey: envKey } : "opt-out"; + } + return "unset"; +} + +function resolveOllamaEmbeddingResolvedKeys( + options: OllamaEmbeddingOptions, + providerConfig: ReturnType, +): OllamaEmbeddingResolvedKeys { + const remoteValue = options.remote?.apiKey; + const remote = resolveSourcedOllamaEmbeddingKey({ + configString: resolveMemorySecretInputString({ + value: remoteValue, + path: "agents.*.memorySearch.remote.apiKey", + }), + declared: hasConfiguredSecretInput(remoteValue), }); - if (remoteApiKey) { - return remoteApiKey; + const providerValue = providerConfig?.apiKey; + const provider = resolveSourcedOllamaEmbeddingKey({ + configString: normalizeOptionalSecretInput(providerValue), + declared: hasConfiguredSecretInput(providerValue), + }); + const envKey = resolveEnvApiKey("ollama")?.apiKey; + const env = envKey && !isNonSecretApiKeyMarker(envKey) ? envKey : undefined; + return { remote, provider, env }; +} + +function resolveOllamaEmbeddingBaseUrl(params: { + remoteBaseUrl?: string; + providerConfig: ReturnType; +}): { baseUrl: string; origin: OllamaEmbeddingBaseUrlOrigin } { + const remoteBaseUrl = params.remoteBaseUrl?.trim(); + if (remoteBaseUrl) { + return { baseUrl: resolveOllamaApiBase(remoteBaseUrl), origin: "remote-config" }; } - const providerApiKey = normalizeOptionalSecretInput(resolveConfiguredProvider(options)?.apiKey); - if (providerApiKey) { - return providerApiKey; + const providerBaseUrl = readProviderBaseUrl(params.providerConfig); + if (providerBaseUrl) { + return { baseUrl: resolveOllamaApiBase(providerBaseUrl), origin: "provider-config" }; } - return resolveEnvApiKey("ollama")?.apiKey; + return { baseUrl: resolveOllamaApiBase(undefined), origin: "default" }; +} + +function normalizeOllamaHostKey(baseUrl: string): string | undefined { + try { + const parsed = new URL(baseUrl); + let hostname = parsed.hostname.toLowerCase(); + if (hostname === "localhost" || hostname === "::1" || hostname === "[::1]") { + hostname = "127.0.0.1"; + } + const port = parsed.port || (parsed.protocol === "https:" ? "443" : "80"); + const path = parsed.pathname === "/" ? "" : parsed.pathname.replace(/\/$/, ""); + return `${parsed.protocol}//${hostname}:${port}${path}`; + } catch { + return undefined; + } +} + +function areOllamaHostsEquivalent(a: string, b: string): boolean { + const aKey = normalizeOllamaHostKey(a); + const bKey = normalizeOllamaHostKey(b); + return aKey !== undefined && bKey !== undefined && aKey === bKey; +} + +function isOllamaCloudBaseUrl(baseUrl: string): boolean { + return areOllamaHostsEquivalent(baseUrl, OLLAMA_CLOUD_BASE_URL); +} + +function selectOllamaEmbeddingApiKey(params: { + resolved: OllamaEmbeddingResolvedKeys; + baseUrl: string; + baseUrlOrigin: OllamaEmbeddingBaseUrlOrigin; + providerOwnedHost: string; +}): string | undefined { + if (params.resolved.remote !== "unset") { + return typeof params.resolved.remote === "object" ? params.resolved.remote.apiKey : undefined; + } + const reachesProviderHost = + params.baseUrlOrigin === "provider-config" || + params.baseUrlOrigin === "default" || + areOllamaHostsEquivalent(params.baseUrl, params.providerOwnedHost); + if (params.resolved.provider !== "unset" && reachesProviderHost) { + return typeof params.resolved.provider === "object" + ? params.resolved.provider.apiKey + : undefined; + } + if (params.resolved.env && isOllamaCloudBaseUrl(params.baseUrl)) { + return params.resolved.env; + } + return undefined; } function resolveOllamaEmbeddingClient( options: OllamaEmbeddingOptions, ): OllamaEmbeddingClientConfig { const providerConfig = resolveConfiguredProvider(options); - const rawBaseUrl = options.remote?.baseUrl?.trim() || readProviderBaseUrl(providerConfig); - const baseUrl = resolveOllamaApiBase(rawBaseUrl); + const { baseUrl, origin: baseUrlOrigin } = resolveOllamaEmbeddingBaseUrl({ + remoteBaseUrl: options.remote?.baseUrl, + providerConfig, + }); const model = normalizeEmbeddingModel(options.model, options.provider); const headerOverrides = Object.assign({}, providerConfig?.headers, options.remote?.headers); const headers: Record = { "Content-Type": "application/json", ...headerOverrides, }; - const apiKey = resolveOllamaApiKey(options); + const apiKey = selectOllamaEmbeddingApiKey({ + resolved: resolveOllamaEmbeddingResolvedKeys(options, providerConfig), + baseUrl, + baseUrlOrigin, + providerOwnedHost: resolveOllamaApiBase(readProviderBaseUrl(providerConfig)), + }); if (apiKey) { headers.Authorization = `Bearer ${apiKey}`; } From a72522d05d05dad88e0647d19189dd58a3c20b9d Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 03:56:08 +0100 Subject: [PATCH 192/418] test: prefer glm 5 in live sweeps --- docs/help/testing-live.md | 8 ++-- src/agents/live-model-filter.ts | 12 +++++- src/agents/model-compat.test.ts | 43 +++++++++++++++++++ src/agents/zai.live.test.ts | 6 +-- .../gateway-models.profiles.live.test.ts | 10 ++--- 5 files changed, 66 insertions(+), 13 deletions(-) diff --git a/docs/help/testing-live.md b/docs/help/testing-live.md index 7438da2d2ee..9323873113d 100644 --- a/docs/help/testing-live.md +++ b/docs/help/testing-live.md @@ -339,7 +339,7 @@ Narrow, explicit allowlists are fastest and least flaky: - `OPENCLAW_LIVE_GATEWAY_MODELS="openai/gpt-5.2" pnpm test:live src/gateway/gateway-models.profiles.live.test.ts` - Tool calling across several providers: - - `OPENCLAW_LIVE_GATEWAY_MODELS="openai/gpt-5.2,openai-codex/gpt-5.2,anthropic/claude-opus-4-6,google/gemini-3-flash-preview,deepseek/deepseek-v4-flash,zai/glm-4.7,minimax/MiniMax-M2.7" pnpm test:live src/gateway/gateway-models.profiles.live.test.ts` + - `OPENCLAW_LIVE_GATEWAY_MODELS="openai/gpt-5.2,openai-codex/gpt-5.2,anthropic/claude-opus-4-6,google/gemini-3-flash-preview,deepseek/deepseek-v4-flash,zai/glm-5.1,minimax/MiniMax-M2.7" pnpm test:live src/gateway/gateway-models.profiles.live.test.ts` - Google focus (Gemini API key + Antigravity): - Gemini (API key): `OPENCLAW_LIVE_GATEWAY_MODELS="google/gemini-3-flash-preview" pnpm test:live src/gateway/gateway-models.profiles.live.test.ts` @@ -373,11 +373,11 @@ This is the “common models” run we expect to keep working: - Google (Gemini API): `google/gemini-3.1-pro-preview` and `google/gemini-3-flash-preview` (avoid older Gemini 2.x models) - Google (Antigravity): `google-antigravity/claude-opus-4-6-thinking` and `google-antigravity/gemini-3-flash` - DeepSeek: `deepseek/deepseek-v4-flash` and `deepseek/deepseek-v4-pro` -- Z.AI (GLM): `zai/glm-4.7` +- Z.AI (GLM): `zai/glm-5.1` - MiniMax: `minimax/MiniMax-M2.7` Run gateway smoke with tools + image: -`OPENCLAW_LIVE_GATEWAY_MODELS="openai/gpt-5.2,openai-codex/gpt-5.2,anthropic/claude-opus-4-6,google/gemini-3.1-pro-preview,google/gemini-3-flash-preview,google-antigravity/claude-opus-4-6-thinking,google-antigravity/gemini-3-flash,deepseek/deepseek-v4-flash,zai/glm-4.7,minimax/MiniMax-M2.7" pnpm test:live src/gateway/gateway-models.profiles.live.test.ts` +`OPENCLAW_LIVE_GATEWAY_MODELS="openai/gpt-5.2,openai-codex/gpt-5.2,anthropic/claude-opus-4-6,google/gemini-3.1-pro-preview,google/gemini-3-flash-preview,google-antigravity/claude-opus-4-6-thinking,google-antigravity/gemini-3-flash,deepseek/deepseek-v4-flash,zai/glm-5.1,minimax/MiniMax-M2.7" pnpm test:live src/gateway/gateway-models.profiles.live.test.ts` ### Baseline: tool calling (Read + optional Exec) @@ -387,7 +387,7 @@ Pick at least one per provider family: - Anthropic: `anthropic/claude-opus-4-6` (or `anthropic/claude-sonnet-4-6`) - Google: `google/gemini-3-flash-preview` (or `google/gemini-3.1-pro-preview`) - DeepSeek: `deepseek/deepseek-v4-flash` -- Z.AI (GLM): `zai/glm-4.7` +- Z.AI (GLM): `zai/glm-5.1` - MiniMax: `minimax/MiniMax-M2.7` Optional additional coverage (nice to have): diff --git a/src/agents/live-model-filter.ts b/src/agents/live-model-filter.ts index 5d08e03fcd3..ff724075f16 100644 --- a/src/agents/live-model-filter.ts +++ b/src/agents/live-model-filter.ts @@ -23,9 +23,11 @@ const HIGH_SIGNAL_LIVE_MODEL_PRIORITY = [ "opencode-go/glm-5", "openrouter/ai21/jamba-large-1.7", "xai/grok-4-1-fast-non-reasoning", - "zai/glm-4.7", + "zai/glm-5.1", "fireworks/accounts/fireworks/models/kimi-k2p6", "fireworks/accounts/fireworks/routers/kimi-k2p5-turbo", + "fireworks/accounts/fireworks/models/glm-5", + "fireworks/accounts/fireworks/models/glm-5p1", "minimax-portal/minimax-m2.7", ] as const; @@ -104,6 +106,11 @@ function isOldMiniMaxLiveModelRef(id: string): boolean { return modelName === "minimax-m2.1" || modelName.startsWith("minimax-m2.1:"); } +function isOldGlmLiveModelRef(id: string): boolean { + const modelName = normalizeLowercaseStringOrEmpty(id).split("/").pop() ?? ""; + return /^glm-4(?:$|[.\-p])/.test(modelName); +} + export function isModernModelRef(ref: ModelRef): boolean { const provider = normalizeProviderId(ref.provider ?? ""); const id = normalizeLowercaseStringOrEmpty(ref.id); @@ -139,6 +146,9 @@ export function isHighSignalLiveModelRef(ref: ModelRef): boolean { if (isOldMiniMaxLiveModelRef(id)) { return false; } + if (isOldGlmLiveModelRef(id)) { + return false; + } return isHighSignalClaudeModelId(id); } diff --git a/src/agents/model-compat.test.ts b/src/agents/model-compat.test.ts index 4c08f56117a..da4742f2d13 100644 --- a/src/agents/model-compat.test.ts +++ b/src/agents/model-compat.test.ts @@ -520,6 +520,28 @@ describe("isHighSignalLiveModelRef", () => { ); }); + it("drops GLM 4.x models from the default live matrix while keeping GLM 5", () => { + providerRuntimeMocks.resolveProviderModernModelRef.mockReturnValue(true); + + expect(isHighSignalLiveModelRef({ provider: "zai", id: "glm-4.7" })).toBe(false); + expect( + isHighSignalLiveModelRef({ provider: "fireworks", id: "accounts/fireworks/models/glm-4p7" }), + ).toBe(false); + expect( + isHighSignalLiveModelRef({ + provider: "fireworks", + id: "accounts/fireworks/models/glm-4p5-air", + }), + ).toBe(false); + expect(isHighSignalLiveModelRef({ provider: "zai", id: "glm-5.1" })).toBe(true); + expect( + isHighSignalLiveModelRef({ provider: "fireworks", id: "accounts/fireworks/models/glm-5" }), + ).toBe(true); + expect( + isHighSignalLiveModelRef({ provider: "fireworks", id: "accounts/fireworks/models/glm-5p1" }), + ).toBe(true); + }); + it("keeps DeepSeek V4 models in the default live matrix when the provider marks them modern", () => { providerRuntimeMocks.resolveProviderModernModelRef.mockImplementation(({ provider, context }) => provider === "deepseek" && context.modelId.startsWith("deepseek-v4") ? true : undefined, @@ -579,6 +601,27 @@ describe("selectHighSignalLiveItems", () => { { provider: "minimax", id: "minimax-m2.7" }, ]); }); + + it("prioritizes Fireworks GLM 5 models over GLM 4.x fallback entries", () => { + const items = [ + { provider: "fireworks", id: "accounts/fireworks/models/glm-4p7" }, + { provider: "fireworks", id: "accounts/fireworks/models/glm-5" }, + { provider: "fireworks", id: "accounts/fireworks/models/glm-5p1" }, + { provider: "fireworks", id: "accounts/fireworks/models/gpt-oss-120b" }, + ]; + + expect( + selectHighSignalLiveItems( + items, + 2, + (item) => item, + (item) => item.provider, + ), + ).toEqual([ + { provider: "fireworks", id: "accounts/fireworks/models/glm-5" }, + { provider: "fireworks", id: "accounts/fireworks/models/glm-5p1" }, + ]); + }); }); describe("resolveHighSignalLiveModelLimit", () => { diff --git a/src/agents/zai.live.test.ts b/src/agents/zai.live.test.ts index 4cc40285868..2ce4765b684 100644 --- a/src/agents/zai.live.test.ts +++ b/src/agents/zai.live.test.ts @@ -11,7 +11,7 @@ const LIVE = isLiveTestEnabled(["ZAI_LIVE_TEST"]); const describeLive = LIVE && ZAI_KEY ? describe : describe.skip; -async function expectModelReturnsAssistantText(modelId: "glm-5" | "glm-4.7") { +async function expectModelReturnsAssistantText(modelId: "glm-5" | "glm-5.1") { const model = getModel("zai", modelId); const res = await completeSimple( model, @@ -29,7 +29,7 @@ describeLive("zai live", () => { await expectModelReturnsAssistantText("glm-5"); }, 20000); - it("glm-4.7 returns assistant text", async () => { - await expectModelReturnsAssistantText("glm-4.7"); + it("glm-5.1 returns assistant text", async () => { + await expectModelReturnsAssistantText("glm-5.1"); }, 20000); }); diff --git a/src/gateway/gateway-models.profiles.live.test.ts b/src/gateway/gateway-models.profiles.live.test.ts index 4f0d4359e8a..7edea9a02d3 100644 --- a/src/gateway/gateway-models.profiles.live.test.ts +++ b/src/gateway/gateway-models.profiles.live.test.ts @@ -695,7 +695,7 @@ describe("shouldSkipToolNonceProbeMissForLiveModel", () => { { modelKey: "opencode/big-pickle", expected: true }, { modelKey: "opencode-go/glm-5", expected: true }, { modelKey: "xai/grok-4.1-fast", expected: true }, - { modelKey: "zai/glm-4.7", expected: true }, + { modelKey: "zai/glm-5.1", expected: true }, { modelKey: "google/gemini-3-flash-preview", expected: true }, { modelKey: "openai/gpt-5.4", expected: false }, ])("returns $expected for $modelKey", ({ modelKey, expected }) => { @@ -2287,7 +2287,7 @@ describeLive("gateway live (dev agent, profile keys)", () => { const authStorage = discoverAuthStorage(agentDir); const modelRegistry = discoverModels(authStorage, agentDir); const anthropic = modelRegistry.find("anthropic", "claude-opus-4-6") as Model | null; - const zai = modelRegistry.find("zai", "glm-4.7") as Model | null; + const zai = modelRegistry.find("zai", "glm-5.1") as Model | null; if (!anthropic || !zai) { return; @@ -2393,7 +2393,7 @@ describeLive("gateway live (dev agent, profile keys)", () => { await withGatewayLiveProbeTimeout( client.request("sessions.patch", { key: sessionKey, - model: "zai/glm-4.7", + model: "zai/glm-5.1", }), "zai-fallback: sessions-patch-zai", ); @@ -2402,7 +2402,7 @@ describeLive("gateway live (dev agent, profile keys)", () => { client, sessionKey, idempotencyKey: `idem-${randomUUID()}-followup`, - modelKey: "zai/glm-4.7", + modelKey: "zai/glm-5.1", message: `What are the values of nonceA and nonceB in "${toolProbePath}"? ` + `Reply with exactly: ${nonceA} ${nonceB}.`, @@ -2411,7 +2411,7 @@ describeLive("gateway live (dev agent, profile keys)", () => { }); assertNoReasoningTags({ text: followupText, - model: "zai/glm-4.7", + model: "zai/glm-5.1", phase: "zai-fallback-followup", label: "zai-fallback", }); From 9bd4200f3cdd6915bae9cfdcd4083e9a689472bf Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 04:00:05 +0100 Subject: [PATCH 193/418] docs: prefer targeted test reruns --- AGENTS.md | 1 + 1 file changed, 1 insertion(+) diff --git a/AGENTS.md b/AGENTS.md index faca52035ae..c1928b93e5e 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -70,6 +70,7 @@ Telegraph style. Root rules only. Read scoped `AGENTS.md` before subtree work. - PR review answer must explicitly cover: what bug/behavior we are trying to fix; PR/issue URL(s) and affected endpoint/surface; whether this is the best possible fix, with high-certainty evidence from code, tests, CI, and shipped/current behavior. - CI polling: exact SHA, needed fields only. Example: `gh api repos///actions/runs/ --jq '{status,conclusion,head_sha,updated_at,name,path}'`. - Post-land wait: minimal. Exact landed SHA only. If superseded on `main`, same-branch `cancel-in-progress` cancellations are expected; stop once local touched-surface proof exists. Never wait for newer unrelated `main` unless asked. +- Test reruns: after a narrow fix, prefer the smallest affected test subset, shard, workflow job, lane, provider, or model allowlist that proves the changed behavior. Rerun a full suite only when the change touches shared orchestration, broad contracts, or the prior evidence no longer covers the risk. - Wait matrix: - never: `Auto response`, `Labeler`, `Docs Sync Publish Repo`, `Docs Agent`, `Test Performance Agent`, `Stale`. - conditional: `CI` exact SHA only; `Docs` only docs task/no local docs proof; `Workflow Sanity` only workflow/composite/CI-policy edits; `Plugin NPM Release` only plugin package/release metadata. From cbbd860ef9091ea6be1688470ff2add0deef3d0f Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 04:01:42 +0100 Subject: [PATCH 194/418] test(docker): isolate installer smoke sessions --- scripts/docker/install-sh-e2e/run.sh | 46 ++++++++++++++++-------- test/scripts/docker-build-helper.test.ts | 9 +++++ 2 files changed, 41 insertions(+), 14 deletions(-) diff --git a/scripts/docker/install-sh-e2e/run.sh b/scripts/docker/install-sh-e2e/run.sh index 4ceae37bbd4..1ed310f3ac1 100755 --- a/scripts/docker/install-sh-e2e/run.sh +++ b/scripts/docker/install-sh-e2e/run.sh @@ -438,6 +438,12 @@ if (missing.length > 0) { NODE } +session_jsonl_path() { + local profile="$1" + local session_id="$2" + echo "$HOME/.openclaw-${profile}/agents/main/sessions/${session_id}.jsonl" +} + run_profile() { local profile="$1" local port="$2" @@ -535,8 +541,8 @@ run_profile() { HOSTNAME_TXT="$workspace/hostname.txt" IMAGE_PNG="$workspace/proof.png" IMAGE_TXT="$workspace/image.txt" - SESSION_ID="e2e-tools-${profile}" - SESSION_JSONL="$HOME/.openclaw-${profile}/agents/main/sessions/${SESSION_ID}.jsonl" + SESSION_ID_PREFIX="e2e-tools-${profile}" + SESSION_JSONL="" PROOF_VALUE="$(node -e 'console.log(require("node:crypto").randomBytes(16).toString("hex"))')" echo -n "$PROOF_VALUE" >"$PROOF_TXT" @@ -578,7 +584,9 @@ run_profile() { echo "==> Agent turns ($profile)" - run_agent_turn "$profile" "$SESSION_ID" \ + TURN1_SESSION_ID="${SESSION_ID_PREFIX}-read-proof" + SESSION_JSONL="$(session_jsonl_path "$profile" "$TURN1_SESSION_ID")" + run_agent_turn "$profile" "$TURN1_SESSION_ID" \ "Use the read tool (not exec) to read ${PROOF_TXT}. Reply with the exact contents only (no extra whitespace)." \ "$TURN1_JSON" assert_agent_json_has_text "$TURN1_JSON" @@ -592,7 +600,9 @@ run_profile() { local prompt2 prompt2=$'Use the write tool (not exec) to write exactly this string into '"${PROOF_COPY}"$':\n'"${reply1}"$'\nReply with exactly: WROTE' - run_agent_turn "$profile" "$SESSION_ID" "$prompt2" "$TURN2_JSON" + TURN2_SESSION_ID="${SESSION_ID_PREFIX}-write-copy" + SESSION_JSONL="$(session_jsonl_path "$profile" "$TURN2_SESSION_ID")" + run_agent_turn "$profile" "$TURN2_SESSION_ID" "$prompt2" "$TURN2_JSON" assert_agent_json_has_text "$TURN2_JSON" assert_agent_json_ok "$TURN2_JSON" "$agent_model_provider" local copy_value @@ -601,7 +611,9 @@ run_profile() { echo "ERROR: copy.txt did not match proof.txt ($profile)" >&2 exit 1 fi - run_agent_turn "$profile" "$SESSION_ID" \ + TURN2B_SESSION_ID="${SESSION_ID_PREFIX}-read-copy" + SESSION_JSONL="$(session_jsonl_path "$profile" "$TURN2B_SESSION_ID")" + run_agent_turn "$profile" "$TURN2B_SESSION_ID" \ "Use the read tool (not exec) to read ${PROOF_COPY}. Reply with the exact contents only (no extra whitespace)." \ "$TURN2B_JSON" assert_agent_json_has_text "$TURN2B_JSON" @@ -613,7 +625,9 @@ run_profile() { exit 1 fi - run_agent_turn "$profile" "$SESSION_ID" \ + TURN3_SESSION_ID="${SESSION_ID_PREFIX}-exec-hostname" + SESSION_JSONL="$(session_jsonl_path "$profile" "$TURN3_SESSION_ID")" + run_agent_turn "$profile" "$TURN3_SESSION_ID" \ "Use the exec tool to run this command: hostname. Reply with the exact stdout only (trim trailing newline)." \ "$TURN3_JSON" assert_agent_json_has_text "$TURN3_JSON" @@ -626,7 +640,9 @@ run_profile() { fi local prompt3b prompt3b=$'Use the write tool to write exactly this string into '"${HOSTNAME_TXT}"$':\n'"${reply3}"$'\nReply with exactly: WROTE' - run_agent_turn "$profile" "$SESSION_ID" "$prompt3b" "$TURN3B_JSON" + TURN3B_SESSION_ID="${SESSION_ID_PREFIX}-write-hostname" + SESSION_JSONL="$(session_jsonl_path "$profile" "$TURN3B_SESSION_ID")" + run_agent_turn "$profile" "$TURN3B_SESSION_ID" "$prompt3b" "$TURN3B_JSON" assert_agent_json_has_text "$TURN3B_JSON" assert_agent_json_ok "$TURN3B_JSON" "$agent_model_provider" if [[ "$(cat "$HOSTNAME_TXT" 2>/dev/null | tr -d '\r\n' || true)" != "$EXPECTED_HOSTNAME" ]]; then @@ -634,7 +650,9 @@ run_profile() { exit 1 fi - run_agent_turn "$profile" "$SESSION_ID" \ + TURN4_SESSION_ID="${SESSION_ID_PREFIX}-image-write" + SESSION_JSONL="$(session_jsonl_path "$profile" "$TURN4_SESSION_ID")" + run_agent_turn "$profile" "$TURN4_SESSION_ID" \ "Use the image tool on ${IMAGE_PNG}. Determine which color is on the left half and which is on the right half. Then use the write tool to write exactly: LEFT=RED RIGHT=GREEN into ${IMAGE_TXT}. Reply with exactly: LEFT=RED RIGHT=GREEN" \ "$TURN4_JSON" assert_agent_json_has_text "$TURN4_JSON" @@ -653,12 +671,12 @@ run_profile() { echo "==> Verify tool usage via session transcript ($profile)" # Give the gateway a moment to flush transcripts. sleep 1 - if [[ ! -f "$SESSION_JSONL" ]]; then - echo "ERROR: missing session transcript ($profile): $SESSION_JSONL" >&2 - ls -la "$HOME/.openclaw-${profile}/agents/main/sessions" >&2 || true - exit 1 - fi - assert_session_used_tools "$SESSION_JSONL" read write exec image + assert_session_used_tools "$(session_jsonl_path "$profile" "$TURN1_SESSION_ID")" read + assert_session_used_tools "$(session_jsonl_path "$profile" "$TURN2_SESSION_ID")" write + assert_session_used_tools "$(session_jsonl_path "$profile" "$TURN2B_SESSION_ID")" read + assert_session_used_tools "$(session_jsonl_path "$profile" "$TURN3_SESSION_ID")" exec + assert_session_used_tools "$(session_jsonl_path "$profile" "$TURN3B_SESSION_ID")" write + assert_session_used_tools "$(session_jsonl_path "$profile" "$TURN4_SESSION_ID")" image write cleanup_profile trap - EXIT diff --git a/test/scripts/docker-build-helper.test.ts b/test/scripts/docker-build-helper.test.ts index 48970a85660..9f9a73ca07c 100644 --- a/test/scripts/docker-build-helper.test.ts +++ b/test/scripts/docker-build-helper.test.ts @@ -77,4 +77,13 @@ describe("docker build helper", () => { runner.indexOf('echo "==> Agent turns ($profile)"'), ); }); + + it("keeps installer E2E tool smokes in isolated sessions", () => { + const runner = readFileSync(INSTALL_E2E_RUNNER_PATH, "utf8"); + + expect(runner).toContain('SESSION_ID_PREFIX="e2e-tools-${profile}"'); + expect(runner).toContain('TURN1_SESSION_ID="${SESSION_ID_PREFIX}-read-proof"'); + expect(runner).toContain('TURN3_SESSION_ID="${SESSION_ID_PREFIX}-exec-hostname"'); + expect(runner).toContain('TURN4_SESSION_ID="${SESSION_ID_PREFIX}-image-write"'); + }); }); From e0141946b2fe0c39ca0944956c010f59f0565bf1 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 04:04:35 +0100 Subject: [PATCH 195/418] ci: allow targeted live model providers --- .../openclaw-live-and-e2e-checks-reusable.yml | 115 +++++++++++++++--- 1 file changed, 95 insertions(+), 20 deletions(-) diff --git a/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml b/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml index 6259e23db8f..c776f58b509 100644 --- a/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml +++ b/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml @@ -38,6 +38,11 @@ on: required: false default: false type: boolean + live_model_providers: + description: Comma/space separated provider ids for the Docker live model matrix; blank runs all providers + required: false + default: "" + type: string workflow_call: inputs: ref: @@ -74,6 +79,11 @@ on: required: false default: false type: boolean + live_model_providers: + description: Comma/space separated provider ids for the Docker live model matrix; blank runs all providers + required: false + default: "" + type: string secrets: OPENAI_API_KEY: required: false @@ -180,6 +190,7 @@ jobs: outputs: selected_sha: ${{ steps.validate.outputs.selected_sha }} trusted_reason: ${{ steps.validate.outputs.trusted_reason }} + live_model_matrix: ${{ steps.live_model_matrix.outputs.matrix }} steps: - name: Checkout selected ref uses: actions/checkout@v6 @@ -224,6 +235,89 @@ jobs: echo "Trust reason: \`$trusted_reason\`" } >> "$GITHUB_STEP_SUMMARY" + - name: Resolve live model provider matrix + id: live_model_matrix + env: + INPUT_LIVE_MODEL_PROVIDERS: ${{ inputs.live_model_providers }} + shell: bash + run: | + set -euo pipefail + + all_providers=(anthropic google minimax openai opencode-go openrouter xai zai fireworks) + + provider_label() { + case "$1" in + anthropic) echo "Anthropic" ;; + google) echo "Google" ;; + minimax) echo "MiniMax" ;; + openai) echo "OpenAI" ;; + opencode-go) echo "OpenCode" ;; + openrouter) echo "OpenRouter" ;; + xai) echo "xAI" ;; + zai) echo "Z.ai" ;; + fireworks) echo "Fireworks" ;; + *) return 1 ;; + esac + } + + normalize_provider() { + local value="${1,,}" + case "$value" in + z.ai|z-ai) echo "zai" ;; + opencode|opencode-go) echo "opencode-go" ;; + open-router|openrouter) echo "openrouter" ;; + *) echo "$value" ;; + esac + } + + is_known_provider() { + local value="$1" + local provider + for provider in "${all_providers[@]}"; do + [[ "$provider" == "$value" ]] && return 0 + done + return 1 + } + + selected=() + declare -A seen=() + raw="${INPUT_LIVE_MODEL_PROVIDERS:-}" + normalized_all="${raw,,}" + normalized_all="${normalized_all//[[:space:],]/}" + if [[ -z "$normalized_all" || "$normalized_all" == "all" ]]; then + selected=("${all_providers[@]}") + else + while IFS= read -r entry; do + [[ -z "$entry" ]] && continue + provider="$(normalize_provider "$entry")" + if ! is_known_provider "$provider"; then + echo "Unknown live model provider '${entry}'. Expected one of: ${all_providers[*]}" >&2 + exit 1 + fi + if [[ -z "${seen[$provider]:-}" ]]; then + selected+=("$provider") + seen[$provider]=1 + fi + done < <(printf '%s\n' "$raw" | tr ',' '\n' | tr '[:space:]' '\n') + fi + + if [[ "${#selected[@]}" -eq 0 ]]; then + echo "No live model providers selected." >&2 + exit 1 + fi + + matrix_entries="[]" + for provider in "${selected[@]}"; do + label="$(provider_label "$provider")" + matrix_entries="$(jq -c --arg label "$label" --arg provider "$provider" '. + [{provider_label: $label, providers: $provider}]' <<<"$matrix_entries")" + done + matrix="$(jq -c --argjson include "$matrix_entries" '{include: $include}')" + echo "matrix=$matrix" >> "$GITHUB_OUTPUT" + { + echo + echo "Live model providers: \`$(IFS=,; echo "${selected[*]}")\`" + } >> "$GITHUB_STEP_SUMMARY" + validate_release_live_cache: needs: validate_selected_ref if: inputs.include_live_suites && !inputs.live_models_only @@ -842,26 +936,7 @@ jobs: timeout-minutes: 75 strategy: fail-fast: false - matrix: - include: - - provider_label: Anthropic - providers: anthropic - - provider_label: Google - providers: google - - provider_label: MiniMax - providers: minimax - - provider_label: OpenAI - providers: openai - - provider_label: OpenCode - providers: opencode-go - - provider_label: OpenRouter - providers: openrouter - - provider_label: xAI - providers: xai - - provider_label: Z.ai - providers: zai - - provider_label: Fireworks - providers: fireworks + matrix: ${{ fromJSON(needs.validate_selected_ref.outputs.live_model_matrix) }} env: OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} OPENAI_BASE_URL: ${{ secrets.OPENAI_BASE_URL }} From 6c1cffa7f887107bcfa16ed8be37bfa2ea05b1db Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 04:08:16 +0100 Subject: [PATCH 196/418] ci: fix targeted live model provider run --- .../openclaw-live-and-e2e-checks-reusable.yml | 264 ++++++++++++------ 1 file changed, 178 insertions(+), 86 deletions(-) diff --git a/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml b/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml index c776f58b509..5e4ad9cbf80 100644 --- a/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml +++ b/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml @@ -190,7 +190,6 @@ jobs: outputs: selected_sha: ${{ steps.validate.outputs.selected_sha }} trusted_reason: ${{ steps.validate.outputs.trusted_reason }} - live_model_matrix: ${{ steps.live_model_matrix.outputs.matrix }} steps: - name: Checkout selected ref uses: actions/checkout@v6 @@ -235,89 +234,6 @@ jobs: echo "Trust reason: \`$trusted_reason\`" } >> "$GITHUB_STEP_SUMMARY" - - name: Resolve live model provider matrix - id: live_model_matrix - env: - INPUT_LIVE_MODEL_PROVIDERS: ${{ inputs.live_model_providers }} - shell: bash - run: | - set -euo pipefail - - all_providers=(anthropic google minimax openai opencode-go openrouter xai zai fireworks) - - provider_label() { - case "$1" in - anthropic) echo "Anthropic" ;; - google) echo "Google" ;; - minimax) echo "MiniMax" ;; - openai) echo "OpenAI" ;; - opencode-go) echo "OpenCode" ;; - openrouter) echo "OpenRouter" ;; - xai) echo "xAI" ;; - zai) echo "Z.ai" ;; - fireworks) echo "Fireworks" ;; - *) return 1 ;; - esac - } - - normalize_provider() { - local value="${1,,}" - case "$value" in - z.ai|z-ai) echo "zai" ;; - opencode|opencode-go) echo "opencode-go" ;; - open-router|openrouter) echo "openrouter" ;; - *) echo "$value" ;; - esac - } - - is_known_provider() { - local value="$1" - local provider - for provider in "${all_providers[@]}"; do - [[ "$provider" == "$value" ]] && return 0 - done - return 1 - } - - selected=() - declare -A seen=() - raw="${INPUT_LIVE_MODEL_PROVIDERS:-}" - normalized_all="${raw,,}" - normalized_all="${normalized_all//[[:space:],]/}" - if [[ -z "$normalized_all" || "$normalized_all" == "all" ]]; then - selected=("${all_providers[@]}") - else - while IFS= read -r entry; do - [[ -z "$entry" ]] && continue - provider="$(normalize_provider "$entry")" - if ! is_known_provider "$provider"; then - echo "Unknown live model provider '${entry}'. Expected one of: ${all_providers[*]}" >&2 - exit 1 - fi - if [[ -z "${seen[$provider]:-}" ]]; then - selected+=("$provider") - seen[$provider]=1 - fi - done < <(printf '%s\n' "$raw" | tr ',' '\n' | tr '[:space:]' '\n') - fi - - if [[ "${#selected[@]}" -eq 0 ]]; then - echo "No live model providers selected." >&2 - exit 1 - fi - - matrix_entries="[]" - for provider in "${selected[@]}"; do - label="$(provider_label "$provider")" - matrix_entries="$(jq -c --arg label "$label" --arg provider "$provider" '. + [{provider_label: $label, providers: $provider}]' <<<"$matrix_entries")" - done - matrix="$(jq -c --argjson include "$matrix_entries" '{include: $include}')" - echo "matrix=$matrix" >> "$GITHUB_OUTPUT" - { - echo - echo "Live model providers: \`$(IFS=,; echo "${selected[*]}")\`" - } >> "$GITHUB_STEP_SUMMARY" - validate_release_live_cache: needs: validate_selected_ref if: inputs.include_live_suites && !inputs.live_models_only @@ -931,12 +847,31 @@ jobs: validate_live_models_docker: name: Docker live models (${{ matrix.provider_label }}) needs: validate_selected_ref - if: inputs.include_live_suites + if: inputs.include_live_suites && inputs.live_model_providers == '' runs-on: ubuntu-24.04 timeout-minutes: 75 strategy: fail-fast: false - matrix: ${{ fromJSON(needs.validate_selected_ref.outputs.live_model_matrix) }} + matrix: + include: + - provider_label: Anthropic + providers: anthropic + - provider_label: Google + providers: google + - provider_label: MiniMax + providers: minimax + - provider_label: OpenAI + providers: openai + - provider_label: OpenCode + providers: opencode-go + - provider_label: OpenRouter + providers: openrouter + - provider_label: xAI + providers: xai + - provider_label: Z.ai + providers: zai + - provider_label: Fireworks + providers: fireworks env: OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} OPENAI_BASE_URL: ${{ secrets.OPENAI_BASE_URL }} @@ -1026,6 +961,163 @@ jobs: - name: Run Docker live model sweep run: pnpm test:docker:live-models + validate_live_models_docker_targeted: + name: Docker live models (selected providers) + needs: validate_selected_ref + if: inputs.include_live_suites && inputs.live_model_providers != '' + runs-on: ubuntu-24.04 + timeout-minutes: 75 + env: + OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} + OPENAI_BASE_URL: ${{ secrets.OPENAI_BASE_URL }} + ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} + ANTHROPIC_API_TOKEN: ${{ secrets.ANTHROPIC_API_TOKEN }} + ANTHROPIC_API_KEY_OLD: ${{ secrets.ANTHROPIC_API_KEY_OLD }} + BYTEPLUS_API_KEY: ${{ secrets.BYTEPLUS_API_KEY }} + CEREBRAS_API_KEY: ${{ secrets.CEREBRAS_API_KEY }} + DASHSCOPE_API_KEY: ${{ secrets.DASHSCOPE_API_KEY }} + GROQ_API_KEY: ${{ secrets.GROQ_API_KEY }} + KIMI_API_KEY: ${{ secrets.KIMI_API_KEY }} + MODELSTUDIO_API_KEY: ${{ secrets.MODELSTUDIO_API_KEY }} + MOONSHOT_API_KEY: ${{ secrets.MOONSHOT_API_KEY }} + MISTRAL_API_KEY: ${{ secrets.MISTRAL_API_KEY }} + MINIMAX_API_KEY: ${{ secrets.MINIMAX_API_KEY }} + OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }} + OPENCODE_ZEN_API_KEY: ${{ secrets.OPENCODE_ZEN_API_KEY }} + GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }} + GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }} + OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }} + QWEN_API_KEY: ${{ secrets.QWEN_API_KEY }} + XAI_API_KEY: ${{ secrets.XAI_API_KEY }} + ZAI_API_KEY: ${{ secrets.ZAI_API_KEY }} + Z_AI_API_KEY: ${{ secrets.Z_AI_API_KEY }} + CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} + OPENCLAW_CODEX_AUTH_JSON: ${{ secrets.OPENCLAW_CODEX_AUTH_JSON }} + OPENCLAW_CODEX_CONFIG_TOML: ${{ secrets.OPENCLAW_CODEX_CONFIG_TOML }} + OPENCLAW_CLAUDE_JSON: ${{ secrets.OPENCLAW_CLAUDE_JSON }} + OPENCLAW_CLAUDE_CREDENTIALS_JSON: ${{ secrets.OPENCLAW_CLAUDE_CREDENTIALS_JSON }} + OPENCLAW_CLAUDE_SETTINGS_JSON: ${{ secrets.OPENCLAW_CLAUDE_SETTINGS_JSON }} + OPENCLAW_CLAUDE_SETTINGS_LOCAL_JSON: ${{ secrets.OPENCLAW_CLAUDE_SETTINGS_LOCAL_JSON }} + OPENCLAW_GEMINI_SETTINGS_JSON: ${{ secrets.OPENCLAW_GEMINI_SETTINGS_JSON }} + FIREWORKS_API_KEY: ${{ secrets.FIREWORKS_API_KEY }} + REQUESTED_LIVE_MODEL_PROVIDERS: ${{ inputs.live_model_providers }} + OPENCLAW_VITEST_MAX_WORKERS: "2" + steps: + - name: Checkout selected ref + uses: actions/checkout@v6 + with: + ref: ${{ needs.validate_selected_ref.outputs.selected_sha }} + fetch-depth: 1 + + - name: Setup Node environment + uses: ./.github/actions/setup-node-env + with: + node-version: ${{ env.NODE_VERSION }} + pnpm-version: ${{ env.PNPM_VERSION }} + install-bun: "true" + + - name: Normalize provider allowlist + shell: bash + run: | + set -euo pipefail + + all_providers=(anthropic google minimax openai opencode-go openrouter xai zai fireworks) + + normalize_provider() { + local value="${1,,}" + case "$value" in + z.ai|z-ai) echo "zai" ;; + opencode|opencode-go) echo "opencode-go" ;; + open-router|openrouter) echo "openrouter" ;; + *) echo "$value" ;; + esac + } + + is_known_provider() { + local value="$1" + local provider + for provider in "${all_providers[@]}"; do + [[ "$provider" == "$value" ]] && return 0 + done + return 1 + } + + selected=() + declare -A seen=() + raw="${REQUESTED_LIVE_MODEL_PROVIDERS:-}" + normalized_all="${raw,,}" + normalized_all="${normalized_all//[[:space:],]/}" + if [[ -z "$normalized_all" || "$normalized_all" == "all" ]]; then + selected=("${all_providers[@]}") + else + while IFS= read -r entry; do + [[ -z "$entry" ]] && continue + provider="$(normalize_provider "$entry")" + if ! is_known_provider "$provider"; then + echo "Unknown live model provider '${entry}'. Expected one of: ${all_providers[*]}" >&2 + exit 1 + fi + if [[ -z "${seen[$provider]:-}" ]]; then + selected+=("$provider") + seen[$provider]=1 + fi + done < <(printf '%s\n' "$raw" | tr ',' '\n' | tr '[:space:]' '\n') + fi + + if [[ "${#selected[@]}" -eq 0 ]]; then + echo "No live model providers selected." >&2 + exit 1 + fi + + providers_csv="$(IFS=,; echo "${selected[*]}")" + echo "OPENCLAW_LIVE_PROVIDERS=$providers_csv" >> "$GITHUB_ENV" + { + echo "Live model providers: \`$providers_csv\`" + } >> "$GITHUB_STEP_SUMMARY" + + - name: Hydrate live auth/profile inputs + run: bash scripts/ci-hydrate-live-auth.sh + + - name: Validate provider credentials + shell: bash + run: | + set -euo pipefail + + require_any() { + local label="$1" + shift + local key + for key in "$@"; do + if [[ -n "${!key:-}" ]]; then + return 0 + fi + done + echo "Missing credential for ${label}: expected one of $*" >&2 + exit 1 + } + + IFS=',' read -r -a providers <<<"${OPENCLAW_LIVE_PROVIDERS}" + for provider in "${providers[@]}"; do + case "$provider" in + anthropic) require_any Anthropic ANTHROPIC_API_KEY ANTHROPIC_API_KEY_OLD ANTHROPIC_API_TOKEN ;; + google) require_any Google GEMINI_API_KEY GOOGLE_API_KEY ;; + minimax) require_any MiniMax MINIMAX_API_KEY ;; + openai) require_any OpenAI OPENAI_API_KEY ;; + opencode-go) require_any OpenCode OPENCODE_API_KEY OPENCODE_ZEN_API_KEY ;; + openrouter) require_any OpenRouter OPENROUTER_API_KEY ;; + xai) require_any xAI XAI_API_KEY ;; + zai) require_any Z.ai ZAI_API_KEY Z_AI_API_KEY ;; + fireworks) require_any Fireworks FIREWORKS_API_KEY ;; + *) + echo "Unhandled live model provider shard: ${provider}" >&2 + exit 1 + ;; + esac + done + + - name: Run Docker live model sweep + run: pnpm test:docker:live-models + validate_live_provider_suites: needs: validate_selected_ref if: inputs.include_live_suites && !inputs.live_models_only From d3fd275aa5fc8b8eff8ca9b1148ad86da8abc2ed Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 04:15:31 +0100 Subject: [PATCH 197/418] test: cover gateway wrapper persistence in docker e2e --- scripts/e2e/doctor-install-switch-docker.sh | 122 ++++++++++++++++++++ 1 file changed, 122 insertions(+) diff --git a/scripts/e2e/doctor-install-switch-docker.sh b/scripts/e2e/doctor-install-switch-docker.sh index 5f5b1bc3a6c..c0a3aa8e19f 100755 --- a/scripts/e2e/doctor-install-switch-docker.sh +++ b/scripts/e2e/doctor-install-switch-docker.sh @@ -139,6 +139,49 @@ LOGINCTL fi } + assert_exec_arg() { + local unit_path="$1" + local index="$2" + local expected="$3" + local exec_line="" + local actual="" + exec_line=$(grep -m1 "^ExecStart=" "$unit_path" || true) + if [ -z "$exec_line" ]; then + echo "Missing ExecStart in $unit_path" + exit 1 + fi + exec_line="${exec_line#ExecStart=}" + actual=$(echo "$exec_line" | awk -v field="$index" "{print \$field}") + actual="${actual%\"}" + actual="${actual#\"}" + if [ "$actual" != "$expected" ]; then + echo "Expected ExecStart arg $index to be $expected, got $actual" + cat "$unit_path" + exit 1 + fi + } + + assert_env_value() { + local unit_path="$1" + local key="$2" + local expected="$3" + if ! grep -Fxq "Environment=${key}=${expected}" "$unit_path"; then + echo "Expected Environment=${key}=${expected} in $unit_path" + cat "$unit_path" + exit 1 + fi + } + + assert_no_env_key() { + local unit_path="$1" + local key="$2" + if grep -q "^Environment=${key}=" "$unit_path"; then + echo "Expected no Environment=${key}= line in $unit_path" + cat "$unit_path" + exit 1 + fi + } + # Each flow: install service with one variant, run doctor from the other, # and verify ExecStart entrypoint switches accordingly. run_flow() { @@ -191,4 +234,83 @@ LOGINCTL "$git_entry" \ "$npm_bin doctor --repair --force --yes" \ "$npm_entry" + + run_wrapper_flow() { + local name="wrapper-persistence" + local install_log="/tmp/openclaw-doctor-switch-${name}-install.log" + local reinstall_log="/tmp/openclaw-doctor-switch-${name}-reinstall.log" + local env_repair_log="/tmp/openclaw-doctor-switch-${name}-env-repair.log" + local doctor_log="/tmp/openclaw-doctor-switch-${name}-doctor.log" + local clear_log="/tmp/openclaw-doctor-switch-${name}-clear.log" + local command_timeout="${OPENCLAW_DOCKER_DOCTOR_SWITCH_COMMAND_TIMEOUT:-300s}" + + echo "== Flow: $name ==" + home_dir=$(mktemp -d "/tmp/openclaw-switch-${name}.XXXXXX") + export HOME="$home_dir" + export USER="testuser" + mkdir -p "$HOME/.local/bin" + local wrapper="$HOME/.local/bin/openclaw-wrapper" + cat > "$wrapper" <> "$HOME/openclaw-wrapper-argv.log" +exec "$npm_bin" "\$@" +WRAPPER + chmod +x "$wrapper" + + local unit_path="$HOME/.config/systemd/user/openclaw-gateway.service" + + if ! timeout "$command_timeout" "$npm_bin" gateway install --wrapper "$wrapper" --force >"$install_log" 2>&1; then + cat "$install_log" + exit 1 + fi + assert_exec_arg "$unit_path" 1 "$wrapper" + assert_exec_arg "$unit_path" 2 "gateway" + assert_env_value "$unit_path" "OPENCLAW_WRAPPER" "$wrapper" + + if ! timeout "$command_timeout" "$npm_bin" gateway install --force >"$reinstall_log" 2>&1; then + cat "$reinstall_log" + exit 1 + fi + assert_exec_arg "$unit_path" 1 "$wrapper" + assert_exec_arg "$unit_path" 2 "gateway" + assert_env_value "$unit_path" "OPENCLAW_WRAPPER" "$wrapper" + + sed -i "/^Environment=OPENCLAW_WRAPPER=/d" "$unit_path" + if ! timeout "$command_timeout" "$npm_bin" gateway install --wrapper "$wrapper" >"$env_repair_log" 2>&1; then + cat "$env_repair_log" + exit 1 + fi + assert_exec_arg "$unit_path" 1 "$wrapper" + assert_env_value "$unit_path" "OPENCLAW_WRAPPER" "$wrapper" + + sed -i "s#^Environment=OPENCLAW_WRAPPER=.*#Environment=OPENCLAW_WRAPPER=/tmp/stale-openclaw-wrapper#" "$unit_path" + if ! timeout "$command_timeout" "$npm_bin" gateway install --wrapper "$wrapper" >"$env_repair_log" 2>&1; then + cat "$env_repair_log" + exit 1 + fi + assert_exec_arg "$unit_path" 1 "$wrapper" + assert_env_value "$unit_path" "OPENCLAW_WRAPPER" "$wrapper" + + if ! timeout "$command_timeout" node "$git_cli" doctor --repair --force --yes >"$doctor_log" 2>&1; then + cat "$doctor_log" + exit 1 + fi + if ! grep -Fq "Gateway service invokes OPENCLAW_WRAPPER:" "$doctor_log"; then + echo "Expected doctor to report active wrapper" + cat "$doctor_log" + exit 1 + fi + assert_exec_arg "$unit_path" 1 "$wrapper" + assert_env_value "$unit_path" "OPENCLAW_WRAPPER" "$wrapper" + + if ! timeout "$command_timeout" env OPENCLAW_WRAPPER= "$npm_bin" gateway install --force >"$clear_log" 2>&1; then + cat "$clear_log" + exit 1 + fi + assert_no_env_key "$unit_path" "OPENCLAW_WRAPPER" + assert_entrypoint "$unit_path" "$npm_entry" + } + + run_wrapper_flow ' From 2a08848dd137b5a575dcaef5eeea926f4050260c Mon Sep 17 00:00:00 2001 From: jnuyao Date: Mon, 27 Apr 2026 11:22:51 +0800 Subject: [PATCH 198/418] feat(feishu): display group names in session labels Resolve Feishu group chat labels through getChatInfo so session labels prefer human-readable group names over raw chat IDs.\n\nPreserve topic/thread label priority and defer the lookup until after broadcast dedup claims to avoid duplicate account API calls.\n\nValidation:\n- pnpm test extensions/feishu/src/bot-group-name.test.ts extensions/feishu/src/bot.broadcast.test.ts\n- pnpm check:changed\n- GitHub CI green on c154dc0a41fd715dce95ef1fb5d0c269533b8c22\n\nCloses #35675 --- AGENTS.md | 1 - extensions/feishu/src/bot-group-name.test.ts | 108 +++++++++++++++++++ extensions/feishu/src/bot.broadcast.test.ts | 36 ++++++- extensions/feishu/src/bot.ts | 105 +++++++++++++++++- 4 files changed, 244 insertions(+), 6 deletions(-) create mode 100644 extensions/feishu/src/bot-group-name.test.ts diff --git a/AGENTS.md b/AGENTS.md index c1928b93e5e..faca52035ae 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -70,7 +70,6 @@ Telegraph style. Root rules only. Read scoped `AGENTS.md` before subtree work. - PR review answer must explicitly cover: what bug/behavior we are trying to fix; PR/issue URL(s) and affected endpoint/surface; whether this is the best possible fix, with high-certainty evidence from code, tests, CI, and shipped/current behavior. - CI polling: exact SHA, needed fields only. Example: `gh api repos///actions/runs/ --jq '{status,conclusion,head_sha,updated_at,name,path}'`. - Post-land wait: minimal. Exact landed SHA only. If superseded on `main`, same-branch `cancel-in-progress` cancellations are expected; stop once local touched-surface proof exists. Never wait for newer unrelated `main` unless asked. -- Test reruns: after a narrow fix, prefer the smallest affected test subset, shard, workflow job, lane, provider, or model allowlist that proves the changed behavior. Rerun a full suite only when the change touches shared orchestration, broad contracts, or the prior evidence no longer covers the risk. - Wait matrix: - never: `Auto response`, `Labeler`, `Docs Sync Publish Repo`, `Docs Agent`, `Test Performance Agent`, `Stale`. - conditional: `CI` exact SHA only; `Docs` only docs task/no local docs proof; `Workflow Sanity` only workflow/composite/CI-policy edits; `Plugin NPM Release` only plugin package/release metadata. diff --git a/extensions/feishu/src/bot-group-name.test.ts b/extensions/feishu/src/bot-group-name.test.ts new file mode 100644 index 00000000000..d5d53627c28 --- /dev/null +++ b/extensions/feishu/src/bot-group-name.test.ts @@ -0,0 +1,108 @@ +import { describe, it, expect, vi, beforeEach } from "vitest"; +import { resolveGroupName, clearGroupNameCache } from "./bot.js"; +import type { ResolvedFeishuAccount } from "./types.js"; + +const mockGetChatInfo = vi.hoisted(() => vi.fn()); +const mockCreateFeishuClient = vi.hoisted(() => vi.fn()); + +vi.mock("./chat.js", () => ({ getChatInfo: mockGetChatInfo })); +vi.mock("./client.js", () => ({ createFeishuClient: mockCreateFeishuClient })); + +function makeAccount(id = "test-account"): ResolvedFeishuAccount { + return { + accountId: id, + selectionSource: "explicit", + enabled: true, + configured: true, + appId: "cli_test", + appSecret: "secret", + domain: "feishu", + config: { + domain: "feishu", + connectionMode: "websocket", + webhookPath: "/feishu/events", + dmPolicy: "pairing", + reactionNotifications: "own", + groupPolicy: "allowlist", + typingIndicator: true, + resolveSenderNames: true, + }, + }; +} + +/** + * Unit tests for resolveGroupName. + * + * Covers: successful lookup, API failure, empty name, positive cache, + * negative cache, undefined response, and cross-account isolation. + */ +describe("resolveGroupName", () => { + const account = makeAccount(); + const log = vi.fn(); + + beforeEach(() => { + vi.clearAllMocks(); + mockGetChatInfo.mockReset(); + mockCreateFeishuClient.mockReset(); + mockCreateFeishuClient.mockReturnValue({}); + clearGroupNameCache(); + }); + + it("returns the trimmed group name on successful API call", async () => { + mockGetChatInfo.mockResolvedValue({ name: " Engineering Team " }); + const result = await resolveGroupName({ account, chatId: "oc_test1", log }); + expect(result).toBe("Engineering Team"); + expect(mockGetChatInfo).toHaveBeenCalledOnce(); + }); + + it("returns undefined and logs on API failure", async () => { + mockGetChatInfo.mockRejectedValue(new Error("network timeout")); + const result = await resolveGroupName({ account, chatId: "oc_test2", log }); + expect(result).toBeUndefined(); + expect(log).toHaveBeenCalledWith(expect.stringContaining("getChatInfo failed")); + }); + + it("returns undefined for whitespace-only name", async () => { + mockGetChatInfo.mockResolvedValue({ name: " " }); + const result = await resolveGroupName({ account, chatId: "oc_test3", log }); + expect(result).toBeUndefined(); + }); + + it("serves subsequent calls from cache (positive hit)", async () => { + mockGetChatInfo.mockResolvedValue({ name: "Cached Group" }); + await resolveGroupName({ account, chatId: "oc_test4", log }); + const result = await resolveGroupName({ account, chatId: "oc_test4", log }); + expect(result).toBe("Cached Group"); + expect(mockGetChatInfo).toHaveBeenCalledOnce(); // only 1 API call + }); + + it("caches negative result (API failure) and skips retry", async () => { + mockGetChatInfo.mockRejectedValue(new Error("fail")); + await resolveGroupName({ account, chatId: "oc_test5", log }); + mockGetChatInfo.mockResolvedValue({ name: "Recovered" }); + const result = await resolveGroupName({ account, chatId: "oc_test5", log }); + expect(result).toBeUndefined(); // still cached negative + expect(mockGetChatInfo).toHaveBeenCalledOnce(); + }); + + it("returns undefined when API returns object with missing name field", async () => { + mockGetChatInfo.mockResolvedValue({ name: undefined }); + const result = await resolveGroupName({ account, chatId: "oc_test6", log }); + expect(result).toBeUndefined(); + }); + + it("isolates cache entries across different accounts", async () => { + const accountA = makeAccount("account-A"); + const accountB = makeAccount("account-B"); + mockGetChatInfo + .mockResolvedValueOnce({ name: "Team Alpha" }) + .mockResolvedValueOnce({ name: "Team Beta" }); + + const nameA = await resolveGroupName({ account: accountA, chatId: "oc_shared", log }); + const nameB = await resolveGroupName({ account: accountB, chatId: "oc_shared", log }); + + expect(nameA).toBe("Team Alpha"); + expect(nameB).toBe("Team Beta"); + expect(mockGetChatInfo).toHaveBeenCalledTimes(2); // separate API calls + }); +}); diff --git a/extensions/feishu/src/bot.broadcast.test.ts b/extensions/feishu/src/bot.broadcast.test.ts index 27b2f201ae0..ac3c57b2cb1 100644 --- a/extensions/feishu/src/bot.broadcast.test.ts +++ b/extensions/feishu/src/bot.broadcast.test.ts @@ -2,7 +2,7 @@ import type { EnvelopeFormatOptions } from "openclaw/plugin-sdk/channel-inbound" import { beforeEach, describe, expect, it, vi } from "vitest"; import type { ClawdbotConfig, PluginRuntime } from "../runtime-api.js"; import type { FeishuMessageEvent } from "./bot.js"; -import { handleFeishuMessage } from "./bot.js"; +import { clearGroupNameCache, handleFeishuMessage } from "./bot.js"; import { setFeishuRuntime } from "./runtime.js"; const { mockCreateFeishuReplyDispatcher, mockCreateFeishuClient, mockResolveAgentRoute } = @@ -46,6 +46,7 @@ function createRuntimeEnv() { describe("broadcast dispatch", () => { const finalizeInboundContextCalls: Array> = []; + const mockGetChatInfo = vi.fn(); const mockFinalizeInboundContext: PluginRuntime["channel"]["reply"]["finalizeInboundContext"] = ( ctx, ) => { @@ -125,6 +126,8 @@ describe("broadcast dispatch", () => { agents: { list: [{ id: "main" }, { id: "susan" }] }, channels: { feishu: { + appId: "cli_test", + appSecret: "sec_test", // pragma: allowlist secret groups: { "oc-broadcast-group": { requireMention: true, @@ -166,6 +169,7 @@ describe("broadcast dispatch", () => { beforeEach(() => { vi.clearAllMocks(); + clearGroupNameCache(); finalizeInboundContextCalls.length = 0; mockResolveAgentRoute.mockReturnValue({ agentId: "main", @@ -182,6 +186,14 @@ describe("broadcast dispatch", () => { get: vi.fn().mockResolvedValue({ data: { user: { name: "Sender" } } }), }, }, + im: { + chat: { + get: mockGetChatInfo.mockResolvedValue({ + code: 0, + data: { name: "Broadcast Team" }, + }), + }, + }, }); setFeishuRuntime(runtimeStub); }); @@ -205,6 +217,15 @@ describe("broadcast dispatch", () => { const sessionKeys = finalizeInboundContextCalls.map((call) => call.SessionKey); expect(sessionKeys).toContain("agent:susan:feishu:group:oc-broadcast-group"); expect(sessionKeys).toContain("agent:main:feishu:group:oc-broadcast-group"); + expect(mockGetChatInfo).toHaveBeenCalledTimes(1); + expect(finalizeInboundContextCalls).toEqual( + expect.arrayContaining([ + expect.objectContaining({ + GroupSubject: "Broadcast Team", + ConversationLabel: "Broadcast Team", + }), + ]), + ); expect(mockCreateFeishuReplyDispatcher).toHaveBeenCalledTimes(1); expect(mockCreateFeishuReplyDispatcher).toHaveBeenCalledWith( expect.objectContaining({ agentId: "main" }), @@ -227,6 +248,7 @@ describe("broadcast dispatch", () => { expect(mockDispatchReplyFromConfig).not.toHaveBeenCalled(); expect(mockCreateFeishuReplyDispatcher).not.toHaveBeenCalled(); + expect(mockGetChatInfo).not.toHaveBeenCalled(); }); it("skips broadcast dispatch when bot identity is unknown (requireMention=true)", async () => { @@ -244,12 +266,15 @@ describe("broadcast dispatch", () => { expect(mockDispatchReplyFromConfig).not.toHaveBeenCalled(); expect(mockCreateFeishuReplyDispatcher).not.toHaveBeenCalled(); + expect(mockGetChatInfo).not.toHaveBeenCalled(); }); it("preserves single-agent dispatch when no broadcast config", async () => { const cfg: ClawdbotConfig = { channels: { feishu: { + appId: "cli_test", + appSecret: "sec_test", // pragma: allowlist secret groups: { "oc-broadcast-group": { requireMention: false, @@ -281,8 +306,11 @@ describe("broadcast dispatch", () => { expect(finalizeInboundContextCalls).toContainEqual( expect.objectContaining({ SessionKey: "agent:main:feishu:group:oc-broadcast-group", + GroupSubject: "Broadcast Team", + ConversationLabel: "Broadcast Team", }), ); + expect(mockGetChatInfo).toHaveBeenCalledTimes(1); }); it("cross-account broadcast dedup: second account skips dispatch", async () => { @@ -291,6 +319,8 @@ describe("broadcast dispatch", () => { agents: { list: [{ id: "main" }, { id: "susan" }] }, channels: { feishu: { + appId: "cli_test", + appSecret: "sec_test", // pragma: allowlist secret groups: { "oc-broadcast-group": { requireMention: false, @@ -320,6 +350,7 @@ describe("broadcast dispatch", () => { expect(mockDispatchReplyFromConfig).toHaveBeenCalledTimes(2); mockDispatchReplyFromConfig.mockClear(); + mockGetChatInfo.mockClear(); finalizeInboundContextCalls.length = 0; await handleFeishuMessage({ @@ -329,6 +360,7 @@ describe("broadcast dispatch", () => { accountId: "account-B", }); expect(mockDispatchReplyFromConfig).not.toHaveBeenCalled(); + expect(mockGetChatInfo).not.toHaveBeenCalled(); }); it("skips unknown agents not in agents.list", async () => { @@ -337,6 +369,8 @@ describe("broadcast dispatch", () => { agents: { list: [{ id: "main" }, { id: "susan" }] }, channels: { feishu: { + appId: "cli_test", + appSecret: "sec_test", // pragma: allowlist secret groups: { "oc-broadcast-group": { requireMention: false, diff --git a/extensions/feishu/src/bot.ts b/extensions/feishu/src/bot.ts index 26691dfd46f..154e81bc06d 100644 --- a/extensions/feishu/src/bot.ts +++ b/extensions/feishu/src/bot.ts @@ -38,6 +38,7 @@ import { } from "./bot-runtime-api.js"; import type { ClawdbotConfig, RuntimeEnv } from "./bot-runtime-api.js"; import { type FeishuPermissionError, resolveFeishuSenderName } from "./bot-sender-name.js"; +import { getChatInfo } from "./chat.js"; import { createFeishuClient } from "./client.js"; import { finalizeFeishuMessageProcessing, tryRecordMessagePersistent } from "./dedup.js"; import { maybeCreateDynamicAgent } from "./dynamic-agent.js"; @@ -59,6 +60,7 @@ import { type FeishuMessageContext, type FeishuMediaInfo, type FeishuMessageInfo, + type ResolvedFeishuAccount, } from "./types.js"; import type { DynamicAgentCreationConfig } from "./types.js"; @@ -69,6 +71,86 @@ export { toMessageResourceType } from "./bot-content.js"; const permissionErrorNotifiedAt = new Map(); const PERMISSION_ERROR_COOLDOWN_MS = 5 * 60 * 1000; // 5 minutes +const groupNameCache = new Map(); +const GROUP_NAME_CACHE_TTL_MS = 30 * 60 * 1000; // 30 minutes +const GROUP_NAME_CACHE_MAX_SIZE = 500; // hard cap + +function evictGroupNameCache(): void { + const now = Date.now(); + for (const [key, val] of groupNameCache) { + if (val.expiresAt <= now) { + groupNameCache.delete(key); + } + } + + if (groupNameCache.size > GROUP_NAME_CACHE_MAX_SIZE) { + const excess = groupNameCache.size - GROUP_NAME_CACHE_MAX_SIZE; + let removed = 0; + for (const key of groupNameCache.keys()) { + if (removed >= excess) { + break; + } + groupNameCache.delete(key); + removed++; + } + } +} + +function setCacheEntry(key: string, value: { name: string; expiresAt: number }): void { + groupNameCache.delete(key); + groupNameCache.set(key, value); +} + +export function clearGroupNameCache(): void { + groupNameCache.clear(); +} + +export async function resolveGroupName(params: { + account: ResolvedFeishuAccount; + chatId: string; + log: (...args: unknown[]) => void; +}): Promise { + const { account, chatId, log } = params; + if (!account.configured) { + return undefined; + } + + const cacheKey = `${account.accountId}:${chatId}`; + + const cached = groupNameCache.get(cacheKey); + if (cached && cached.expiresAt > Date.now()) { + return cached.name || undefined; + } + + try { + const client = createFeishuClient(account); + const chatInfo = await getChatInfo(client, chatId); + const name = chatInfo?.name?.trim(); + if (name) { + setCacheEntry(cacheKey, { + name, + expiresAt: Date.now() + GROUP_NAME_CACHE_TTL_MS, + }); + } else { + setCacheEntry(cacheKey, { + name: "", + expiresAt: Date.now() + GROUP_NAME_CACHE_TTL_MS, + }); + } + } catch (err) { + log(`feishu[${account.accountId}]: getChatInfo failed for ${chatId}: ${String(err)}`); + setCacheEntry(cacheKey, { + name: "", + expiresAt: Date.now() + GROUP_NAME_CACHE_TTL_MS, + }); + } + + const result = groupNameCache.get(cacheKey)?.name || undefined; + evictGroupNameCache(); + + return result; +} + async function resolveFeishuAudioPreflightTranscript(params: { cfg: ClawdbotConfig; mediaList: FeishuMediaInfo[]; @@ -932,7 +1014,20 @@ export async function handleFeishuMessage(params: { } return rootMessageInfo ?? null; }; - const resolveThreadContextForAgent = async (agentId: string, agentSessionKey: string) => { + let groupNamePromise: Promise | undefined; + const resolveGroupNameForLabel = (): Promise => { + if (!isGroup) { + return Promise.resolve(undefined); + } + groupNamePromise ??= resolveGroupName({ account, chatId: ctx.chatId, log }); + return groupNamePromise; + }; + + const resolveThreadContextForAgent = async ( + agentId: string, + agentSessionKey: string, + groupName: string | undefined, + ) => { const cached = threadContextBySessionKey.get(agentSessionKey); if (cached) { return cached; @@ -945,7 +1040,7 @@ export async function handleFeishuMessage(params: { } = { threadLabel: (ctx.rootId || ctx.threadId) && isTopicSessionForThread - ? `Feishu thread in ${ctx.chatId}` + ? `Feishu thread in ${groupName ?? ctx.chatId}` : undefined, }; @@ -1047,7 +1142,8 @@ export async function handleFeishuMessage(params: { agentAccountId: string, wasMentioned: boolean, ) => { - const threadContext = await resolveThreadContextForAgent(agentId, agentSessionKey); + const groupName = await resolveGroupNameForLabel(); + const threadContext = await resolveThreadContextForAgent(agentId, agentSessionKey, groupName); return core.channel.reply.finalizeInboundContext({ Body: combinedBody, BodyForAgent: messageBody, @@ -1062,7 +1158,8 @@ export async function handleFeishuMessage(params: { SessionKey: agentSessionKey, AccountId: agentAccountId, ChatType: isGroup ? "group" : "direct", - GroupSubject: isGroup ? ctx.chatId : undefined, + GroupSubject: isGroup ? groupName || ctx.chatId : undefined, + ConversationLabel: isGroup && groupName && !isTopicSessionForThread ? groupName : undefined, SenderName: ctx.senderName ?? ctx.senderOpenId, SenderId: ctx.senderOpenId, Provider: "feishu" as const, From 76de167ca1022ec7a07c94ddea4bb0a1fa3cbd80 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 04:25:25 +0100 Subject: [PATCH 199/418] ci: add package acceptance workflow --- .agents/skills/openclaw-testing/SKILL.md | 35 ++ .github/actions/docker-e2e-plan/action.yml | 6 +- .github/workflows/npm-telegram-beta-e2e.yml | 30 ++ .../openclaw-live-and-e2e-checks-reusable.yml | 88 +++-- .github/workflows/package-acceptance.yml | 309 ++++++++++++++++ docs/ci.md | 11 +- docs/help/testing.md | 36 ++ docs/reference/RELEASING.md | 16 + .../resolve-openclaw-package-candidate.mjs | 330 ++++++++++++++++++ .../package-acceptance-workflow.test.ts | 65 ++++ ...resolve-openclaw-package-candidate.test.ts | 51 +++ 11 files changed, 955 insertions(+), 22 deletions(-) create mode 100644 .github/workflows/package-acceptance.yml create mode 100644 scripts/resolve-openclaw-package-candidate.mjs create mode 100644 test/scripts/package-acceptance-workflow.test.ts create mode 100644 test/scripts/resolve-openclaw-package-candidate.test.ts diff --git a/.agents/skills/openclaw-testing/SKILL.md b/.agents/skills/openclaw-testing/SKILL.md index ad3fff2ea01..a64d5ac69cb 100644 --- a/.agents/skills/openclaw-testing/SKILL.md +++ b/.agents/skills/openclaw-testing/SKILL.md @@ -142,6 +142,41 @@ image. Release-path normal mode remains max three Docker chunk jobs: - `package-update` - `plugins-integrations` +## Package Acceptance + +Use the manual `Package Acceptance` workflow when the question is "does this +installable package work as a product?" rather than "does this source diff pass +Vitest?" + +Good defaults: + +```bash +gh workflow run package-acceptance.yml --ref main \ + -f source=npm \ + -f package_spec=openclaw@beta \ + -f suite_profile=product +``` + +Profiles: + +- `smoke`: quick package install/channel/agent + gateway/config lanes. +- `package`: package, update, and plugin lanes; no OpenWebUI. +- `product`: package profile plus MCP channels, cron/subagent cleanup, OpenAI + web search, and OpenWebUI. +- `full`: Docker release-path chunks with OpenWebUI. +- `custom`: exact `docker_lanes` list for a focused rerun. + +Candidate sources: + +- `source=npm`: `openclaw@beta`, `openclaw@latest`, or an exact release version. +- `source=ref`: pack the trusted ref in the workflow. +- `source=url`: HTTPS `.tgz` plus required `package_sha256`. +- `source=artifact`: download one `.tgz` from `artifact_run_id`/`artifact_name`. + +Use `telegram_mode=mock-openai` or `telegram_mode=live-frontier` only with +`source=npm`; that path reuses the published npm Telegram E2E workflow and the +`qa-live-shared` environment. + Docker E2E images never copy repo sources as the app under test: the bare image is a Node/Git runner, and the functional image installs the same prebuilt npm tarball that bare lanes mount. `scripts/package-openclaw-for-docker.mjs` is the diff --git a/.github/actions/docker-e2e-plan/action.yml b/.github/actions/docker-e2e-plan/action.yml index 4dbb354157d..ffb53edae24 100644 --- a/.github/actions/docker-e2e-plan/action.yml +++ b/.github/actions/docker-e2e-plan/action.yml @@ -26,6 +26,10 @@ inputs: description: Whether to download/pull artifacts required by the plan. required: false default: "true" + package-artifact-name: + description: Workflow artifact name containing openclaw-current.tgz. + required: false + default: docker-e2e-package outputs: credentials: description: Comma-separated credential groups required by selected lanes. @@ -108,7 +112,7 @@ runs: if: inputs.hydrate-artifacts == 'true' && steps.plan.outputs.needs_package == '1' uses: actions/download-artifact@v8 with: - name: docker-e2e-package + name: ${{ inputs.package-artifact-name }} path: .artifacts/docker-e2e-package - name: Pull shared bare Docker E2E image diff --git a/.github/workflows/npm-telegram-beta-e2e.yml b/.github/workflows/npm-telegram-beta-e2e.yml index a76f46f9fbd..960abc15c81 100644 --- a/.github/workflows/npm-telegram-beta-e2e.yml +++ b/.github/workflows/npm-telegram-beta-e2e.yml @@ -20,6 +20,29 @@ on: description: Optional comma-separated Telegram scenario ids required: false type: string + workflow_call: + inputs: + package_spec: + description: Published OpenClaw package spec to test + required: true + type: string + provider_mode: + description: QA provider mode + required: false + default: mock-openai + type: string + scenario: + description: Optional comma-separated Telegram scenario ids + required: false + default: "" + type: string + secrets: + OPENAI_API_KEY: + required: false + OPENCLAW_QA_CONVEX_SITE_URL: + required: false + OPENCLAW_QA_CONVEX_SECRET_CI: + required: false permissions: contents: read @@ -90,6 +113,13 @@ jobs: echo "package_spec must be openclaw@beta, openclaw@latest, or an exact OpenClaw release version; got: ${PACKAGE_SPEC}" >&2 exit 1 fi + case "${PROVIDER_MODE}" in + mock-openai | live-frontier) ;; + *) + echo "provider_mode must be mock-openai or live-frontier; got: ${PROVIDER_MODE}" >&2 + exit 1 + ;; + esac require_var() { local key="$1" diff --git a/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml b/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml index 5e4ad9cbf80..753dfe7d9fe 100644 --- a/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml +++ b/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml @@ -28,6 +28,11 @@ on: required: false default: "" type: string + package_artifact_name: + description: Existing workflow artifact containing openclaw-current.tgz; blank packs the selected ref + required: false + default: "" + type: string include_live_suites: description: Whether to run live-provider coverage required: false @@ -69,6 +74,11 @@ on: required: false default: "" type: string + package_artifact_name: + description: Existing workflow artifact containing openclaw-current.tgz; blank packs the selected ref + required: false + default: "" + type: string include_live_suites: description: Whether to run live-provider coverage required: false @@ -477,6 +487,7 @@ jobs: mode: chunk chunk: ${{ matrix.chunk_id }} include-openwebui: ${{ inputs.include_openwebui }} + package-artifact-name: ${{ inputs.package_artifact_name || 'docker-e2e-package' }} - name: Run Docker E2E chunk shell: bash @@ -603,6 +614,7 @@ jobs: mode: targeted lanes: ${{ inputs.docker_lanes }} include-openwebui: ${{ inputs.include_openwebui }} + package-artifact-name: ${{ inputs.package_artifact_name || 'docker-e2e-package' }} - name: Run targeted Docker E2E lanes shell: bash @@ -713,23 +725,6 @@ jobs: ref: ${{ needs.validate_selected_ref.outputs.selected_sha }} fetch-depth: 1 - - name: Resolve shared Docker E2E image tags - id: image - shell: bash - env: - SELECTED_SHA: ${{ needs.validate_selected_ref.outputs.selected_sha }} - run: | - set -euo pipefail - repository="${GITHUB_REPOSITORY,,}" - bare_image="ghcr.io/${repository}-docker-e2e-bare:${SELECTED_SHA}" - functional_image="ghcr.io/${repository}-docker-e2e-functional:${SELECTED_SHA}" - image="$functional_image" - echo "image=$image" >> "$GITHUB_OUTPUT" - echo "bare_image=$bare_image" >> "$GITHUB_OUTPUT" - echo "functional_image=$functional_image" >> "$GITHUB_OUTPUT" - echo "Shared Docker E2E bare image: \`$bare_image\`" >> "$GITHUB_STEP_SUMMARY" - echo "Shared Docker E2E functional image: \`$functional_image\`" >> "$GITHUB_STEP_SUMMARY" - - name: Plan Docker E2E images id: plan uses: ./.github/actions/docker-e2e-plan @@ -741,15 +736,22 @@ jobs: hydrate-artifacts: "false" - name: Setup Node environment - if: steps.plan.outputs.needs_package == '1' + if: steps.plan.outputs.needs_package == '1' && inputs.package_artifact_name == '' uses: ./.github/actions/setup-node-env with: node-version: ${{ env.NODE_VERSION }} pnpm-version: ${{ env.PNPM_VERSION }} install-bun: "true" + - name: Download provided OpenClaw Docker E2E package + if: steps.plan.outputs.needs_package == '1' && inputs.package_artifact_name != '' + uses: actions/download-artifact@v8 + with: + name: ${{ inputs.package_artifact_name }} + path: .artifacts/docker-e2e-package + - name: Pack OpenClaw package for Docker E2E - if: steps.plan.outputs.needs_package == '1' + if: steps.plan.outputs.needs_package == '1' && inputs.package_artifact_name == '' shell: bash run: | set -euo pipefail @@ -758,14 +760,60 @@ jobs: --output-dir .artifacts/docker-e2e-package \ --output-name openclaw-current.tgz - - name: Upload OpenClaw Docker E2E package + - name: Validate OpenClaw Docker E2E package + id: package if: steps.plan.outputs.needs_package == '1' + shell: bash + run: | + set -euo pipefail + mkdir -p .artifacts/docker-e2e-package + target=".artifacts/docker-e2e-package/openclaw-current.tgz" + if [[ ! -f "$target" ]]; then + mapfile -t tgzs < <(find .artifacts/docker-e2e-package -type f -name '*.tgz' | sort) + if [[ "${#tgzs[@]}" -ne 1 ]]; then + echo "Expected exactly one package tarball in .artifacts/docker-e2e-package; found ${#tgzs[@]}." >&2 + printf '%s\n' "${tgzs[@]}" >&2 + exit 1 + fi + cp "${tgzs[0]}" "$target" + fi + node scripts/check-openclaw-package-tarball.mjs "$target" + digest="$(sha256sum "$target" | awk '{print $1}')" + tag="pkg-${digest:0:32}" + echo "sha256=$digest" >> "$GITHUB_OUTPUT" + echo "tag=$tag" >> "$GITHUB_OUTPUT" + { + echo "Docker E2E package: \`$target\`" + echo "Docker E2E package SHA-256: \`$digest\`" + } >> "$GITHUB_STEP_SUMMARY" + + - name: Upload OpenClaw Docker E2E package + if: steps.plan.outputs.needs_package == '1' && inputs.package_artifact_name == '' uses: actions/upload-artifact@v7 with: name: docker-e2e-package path: .artifacts/docker-e2e-package/openclaw-current.tgz if-no-files-found: error + - name: Resolve shared Docker E2E image tags + id: image + shell: bash + env: + PACKAGE_TAG: ${{ steps.package.outputs.tag }} + SELECTED_SHA: ${{ needs.validate_selected_ref.outputs.selected_sha }} + run: | + set -euo pipefail + repository="${GITHUB_REPOSITORY,,}" + image_tag="${PACKAGE_TAG:-$SELECTED_SHA}" + bare_image="ghcr.io/${repository}-docker-e2e-bare:${image_tag}" + functional_image="ghcr.io/${repository}-docker-e2e-functional:${image_tag}" + image="$functional_image" + echo "image=$image" >> "$GITHUB_OUTPUT" + echo "bare_image=$bare_image" >> "$GITHUB_OUTPUT" + echo "functional_image=$functional_image" >> "$GITHUB_OUTPUT" + echo "Shared Docker E2E bare image: \`$bare_image\`" >> "$GITHUB_STEP_SUMMARY" + echo "Shared Docker E2E functional image: \`$functional_image\`" >> "$GITHUB_STEP_SUMMARY" + - name: Log in to GHCR if: steps.plan.outputs.needs_e2e_image == '1' uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4 diff --git a/.github/workflows/package-acceptance.yml b/.github/workflows/package-acceptance.yml new file mode 100644 index 00000000000..5ec2d0c76b1 --- /dev/null +++ b/.github/workflows/package-acceptance.yml @@ -0,0 +1,309 @@ +name: Package Acceptance + +on: + workflow_dispatch: + inputs: + source: + description: Package candidate source + required: true + default: npm + type: choice + options: + - npm + - ref + - url + - artifact + ref: + description: Trusted repo ref for workflow scripts, or package source when source=ref + required: true + default: main + type: string + package_spec: + description: Published package spec when source=npm + required: false + default: openclaw@beta + type: string + package_url: + description: HTTPS .tgz URL when source=url + required: false + default: "" + type: string + package_sha256: + description: Expected package SHA-256; required for source=url + required: false + default: "" + type: string + artifact_run_id: + description: GitHub Actions run id when source=artifact + required: false + default: "" + type: string + artifact_name: + description: Artifact name containing one .tgz when source=artifact + required: false + default: package-under-test + type: string + suite_profile: + description: Acceptance profile + required: true + default: package + type: choice + options: + - smoke + - package + - product + - full + - custom + docker_lanes: + description: Comma/space separated Docker lanes when suite_profile=custom + required: false + default: "" + type: string + telegram_mode: + description: Optional published-npm Telegram QA lane + required: true + default: none + type: choice + options: + - none + - mock-openai + - live-frontier + +permissions: + actions: read + contents: read + packages: write + +concurrency: + group: package-acceptance-${{ github.run_id }} + cancel-in-progress: false + +env: + FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" + NODE_VERSION: "24.x" + PNPM_VERSION: "10.33.0" + PACKAGE_ARTIFACT_NAME: package-under-test + +jobs: + resolve_package: + name: Resolve package candidate + runs-on: ubuntu-24.04 + timeout-minutes: 60 + outputs: + docker_lanes: ${{ steps.profile.outputs.docker_lanes }} + include_live_suites: ${{ steps.profile.outputs.include_live_suites }} + include_openwebui: ${{ steps.profile.outputs.include_openwebui }} + include_release_path_suites: ${{ steps.profile.outputs.include_release_path_suites }} + package_artifact_name: ${{ steps.profile.outputs.package_artifact_name }} + package_sha256: ${{ steps.resolve.outputs.sha256 }} + package_version: ${{ steps.resolve.outputs.package_version }} + telegram_enabled: ${{ steps.profile.outputs.telegram_enabled }} + telegram_mode: ${{ steps.profile.outputs.telegram_mode }} + steps: + - name: Checkout package workflow ref + uses: actions/checkout@v6 + with: + ref: ${{ inputs.ref }} + fetch-depth: 1 + + - name: Setup Node environment + uses: ./.github/actions/setup-node-env + with: + node-version: ${{ env.NODE_VERSION }} + pnpm-version: ${{ env.PNPM_VERSION }} + install-bun: ${{ inputs.source == 'ref' && 'true' || 'false' }} + install-deps: ${{ inputs.source == 'ref' && 'true' || 'false' }} + + - name: Download package artifact input + if: inputs.source == 'artifact' + env: + GH_TOKEN: ${{ github.token }} + ARTIFACT_RUN_ID: ${{ inputs.artifact_run_id }} + ARTIFACT_NAME: ${{ inputs.artifact_name }} + shell: bash + run: | + set -euo pipefail + if [[ -z "${ARTIFACT_RUN_ID// }" ]]; then + echo "artifact_run_id is required when source=artifact." >&2 + exit 1 + fi + if [[ -z "${ARTIFACT_NAME// }" ]]; then + echo "artifact_name is required when source=artifact." >&2 + exit 1 + fi + mkdir -p .artifacts/package-candidate-input + gh run download "$ARTIFACT_RUN_ID" -n "$ARTIFACT_NAME" -D .artifacts/package-candidate-input + + - name: Resolve package candidate + id: resolve + env: + SOURCE: ${{ inputs.source }} + PACKAGE_SPEC: ${{ inputs.package_spec }} + PACKAGE_URL: ${{ inputs.package_url }} + PACKAGE_SHA256: ${{ inputs.package_sha256 }} + shell: bash + run: | + set -euo pipefail + artifact_dir="" + if [[ "$SOURCE" == "artifact" ]]; then + artifact_dir=".artifacts/package-candidate-input" + fi + + node scripts/resolve-openclaw-package-candidate.mjs \ + --source "$SOURCE" \ + --package-spec "$PACKAGE_SPEC" \ + --package-url "$PACKAGE_URL" \ + --package-sha256 "$PACKAGE_SHA256" \ + --artifact-dir "${artifact_dir:-.}" \ + --output-dir .artifacts/docker-e2e-package \ + --output-name openclaw-current.tgz \ + --metadata .artifacts/docker-e2e-package/package-candidate.json \ + --github-output "$GITHUB_OUTPUT" + + - name: Select acceptance profile + id: profile + env: + SOURCE: ${{ inputs.source }} + SUITE_PROFILE: ${{ inputs.suite_profile }} + CUSTOM_DOCKER_LANES: ${{ inputs.docker_lanes }} + TELEGRAM_MODE: ${{ inputs.telegram_mode }} + shell: bash + run: | + set -euo pipefail + + include_release_path_suites=false + include_openwebui=false + include_live_suites=false + docker_lanes="" + + case "$SUITE_PROFILE" in + smoke) + docker_lanes="npm-onboard-channel-agent gateway-network config-reload" + ;; + package) + docker_lanes="install-e2e npm-onboard-channel-agent doctor-switch update-channel-switch bundled-channel-deps plugins plugin-update" + ;; + product) + docker_lanes="install-e2e npm-onboard-channel-agent doctor-switch update-channel-switch bundled-channel-deps plugins plugin-update mcp-channels cron-mcp-cleanup openai-web-search-minimal openwebui" + include_openwebui=true + ;; + full) + include_release_path_suites=true + include_openwebui=true + ;; + custom) + docker_lanes="$CUSTOM_DOCKER_LANES" + if [[ -z "${docker_lanes// }" ]]; then + echo "docker_lanes is required when suite_profile=custom." >&2 + exit 1 + fi + if [[ "$docker_lanes" == *"openwebui"* ]]; then + include_openwebui=true + fi + ;; + *) + echo "Unknown suite_profile: $SUITE_PROFILE" >&2 + exit 1 + ;; + esac + + telegram_enabled=false + if [[ "$TELEGRAM_MODE" != "none" ]]; then + if [[ "$SOURCE" != "npm" ]]; then + echo "telegram_mode requires source=npm because the Telegram workflow installs a published package spec." >&2 + exit 1 + fi + telegram_enabled=true + fi + + { + echo "docker_lanes=$docker_lanes" + echo "include_release_path_suites=$include_release_path_suites" + echo "include_openwebui=$include_openwebui" + echo "include_live_suites=$include_live_suites" + echo "telegram_enabled=$telegram_enabled" + echo "telegram_mode=$TELEGRAM_MODE" + echo "package_artifact_name=${PACKAGE_ARTIFACT_NAME}" + } >> "$GITHUB_OUTPUT" + + - name: Upload package-under-test artifact + uses: actions/upload-artifact@v7 + with: + name: ${{ env.PACKAGE_ARTIFACT_NAME }} + path: | + .artifacts/docker-e2e-package/openclaw-current.tgz + .artifacts/docker-e2e-package/package-candidate.json + retention-days: 14 + if-no-files-found: error + + - name: Summarize package candidate + env: + PACKAGE_SHA256: ${{ steps.resolve.outputs.sha256 }} + PACKAGE_VERSION: ${{ steps.resolve.outputs.package_version }} + SOURCE: ${{ inputs.source }} + SUITE_PROFILE: ${{ inputs.suite_profile }} + shell: bash + run: | + { + echo "## Package acceptance" + echo + echo "- Source: \`${SOURCE}\`" + echo "- Version: \`${PACKAGE_VERSION}\`" + echo "- SHA-256: \`${PACKAGE_SHA256}\`" + echo "- Profile: \`${SUITE_PROFILE}\`" + } >> "$GITHUB_STEP_SUMMARY" + + docker_acceptance: + name: Docker product acceptance + needs: resolve_package + uses: ./.github/workflows/openclaw-live-and-e2e-checks-reusable.yml + with: + ref: ${{ inputs.ref }} + include_repo_e2e: false + include_release_path_suites: ${{ needs.resolve_package.outputs.include_release_path_suites == 'true' }} + include_openwebui: ${{ needs.resolve_package.outputs.include_openwebui == 'true' }} + docker_lanes: ${{ needs.resolve_package.outputs.docker_lanes }} + package_artifact_name: ${{ needs.resolve_package.outputs.package_artifact_name }} + include_live_suites: ${{ needs.resolve_package.outputs.include_live_suites == 'true' }} + live_models_only: false + secrets: inherit + + npm_telegram: + name: Published npm Telegram acceptance + needs: resolve_package + if: needs.resolve_package.outputs.telegram_enabled == 'true' + uses: ./.github/workflows/npm-telegram-beta-e2e.yml + with: + package_spec: ${{ inputs.package_spec }} + provider_mode: ${{ needs.resolve_package.outputs.telegram_mode }} + secrets: inherit + + summary: + name: Verify package acceptance + needs: [resolve_package, docker_acceptance, npm_telegram] + if: always() + runs-on: ubuntu-24.04 + timeout-minutes: 5 + steps: + - name: Verify package acceptance results + env: + DOCKER_RESULT: ${{ needs.docker_acceptance.result }} + NPM_TELEGRAM_RESULT: ${{ needs.npm_telegram.result }} + RESOLVE_RESULT: ${{ needs.resolve_package.result }} + shell: bash + run: | + set -euo pipefail + failed=0 + for item in \ + "resolve_package=${RESOLVE_RESULT}" \ + "docker_acceptance=${DOCKER_RESULT}" \ + "npm_telegram=${NPM_TELEGRAM_RESULT}" + do + name="${item%%=*}" + result="${item#*=}" + if [[ "$result" != "success" && "$result" != "skipped" ]]; then + echo "::error::${name} ended with ${result}" + failed=1 + fi + done + exit "$failed" diff --git a/docs/ci.md b/docs/ci.md index 74497fb47dc..44f645bd65a 100644 --- a/docs/ci.md +++ b/docs/ci.md @@ -15,6 +15,15 @@ for install smoke, Docker release-path suites, live/E2E, OpenWebUI, QA Lab parity, Matrix, and Telegram lanes. It can also run the post-publish `NPM Telegram Beta E2E` workflow when a published package spec is provided. +`Package Acceptance` is the side-run workflow for validating a package artifact +without blocking the release workflow. It resolves one candidate from a trusted +ref, a published npm spec, an HTTPS tarball URL with SHA-256, or a tarball +artifact from another GitHub Actions run, uploads it as `package-under-test`, +then reuses the Docker release/E2E scheduler with that tarball instead of +packing the selected ref. Profiles cover smoke, package, product, full, and +custom Docker lane selections. The optional Telegram lane is published-npm only +and reuses the `NPM Telegram Beta E2E` workflow. + QA Lab has dedicated CI lanes outside the main smart-scoped workflow. The `Parity gate` workflow runs on matching PR changes and manual dispatch; it builds the private QA runtime and compares the mock GPT-5.5 and Opus 4.6 @@ -116,7 +125,7 @@ act as if every scoped area changed. CI workflow edits validate the Node CI graph plus workflow linting, but do not force Windows, Android, or macOS native builds by themselves; those platform lanes stay scoped to platform source changes. CI routing-only edits, selected cheap core-test fixture edits, and narrow plugin contract helper/test-routing edits use a fast Node-only manifest path: preflight, security, and a single `checks-fast-core` task. That path avoids build artifacts, Node 22 compatibility, channel contracts, full core shards, bundled-plugin shards, and additional guard matrices when the changed files are limited to the routing or helper surfaces that the fast task exercises directly. Windows Node checks are scoped to Windows-specific process/path wrappers, npm/pnpm/UI runner helpers, package manager config, and the CI workflow surfaces that execute that lane; unrelated source, plugin, install-smoke, and test-only changes stay on the Linux Node lanes so they do not reserve a 16-vCPU Windows worker for coverage that is already exercised by the normal test shards. -The separate `install-smoke` workflow reuses the same scope script through its own `preflight` job. It splits smoke coverage into `run_fast_install_smoke` and `run_full_install_smoke`. Pull requests run the fast path for Docker/package surfaces, bundled plugin package/manifest changes, and core plugin/channel/gateway/Plugin SDK surfaces that the Docker smoke jobs exercise. Source-only bundled plugin changes, test-only edits, and docs-only edits do not reserve Docker workers. The fast path builds the root Dockerfile image once, checks the CLI, runs the agents delete shared-workspace CLI smoke, runs the container gateway-network e2e, verifies a bundled extension build arg, and runs the bounded bundled-plugin Docker profile under a 240-second aggregate command timeout with each scenario's Docker run capped separately. The full path keeps QR package install and installer Docker/update coverage for nightly scheduled runs, manual dispatches, workflow-call release checks, and pull requests that truly touch installer/package/Docker surfaces. `main` pushes, including merge commits, do not force the full path; when changed-scope logic would request full coverage on a push, the workflow keeps the fast Docker smoke and leaves the full install smoke to nightly or release validation. The slow Bun global install image-provider smoke is separately gated by `run_bun_global_install_smoke`; it runs on the nightly schedule and from the release checks workflow, and manual `install-smoke` dispatches can opt into it, but pull requests and `main` pushes do not run it. QR and installer Docker tests keep their own install-focused Dockerfiles. Local `test:docker:all` prebuilds one shared live-test image, packs OpenClaw once as an npm tarball, and builds two shared `scripts/e2e/Dockerfile` images: a bare Node/Git runner for installer/update/plugin-dependency lanes and a functional image that installs the same tarball into `/app` for normal functionality lanes. Docker lane definitions live in `scripts/lib/docker-e2e-scenarios.mjs`, planner logic lives in `scripts/lib/docker-e2e-plan.mjs`, and the runner only executes the selected plan. The scheduler selects the image per lane with `OPENCLAW_DOCKER_E2E_BARE_IMAGE` and `OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE`, then runs lanes with `OPENCLAW_SKIP_DOCKER_BUILD=1`; tune the default main-pool slot count of 10 with `OPENCLAW_DOCKER_ALL_PARALLELISM` and the provider-sensitive tail-pool slot count of 10 with `OPENCLAW_DOCKER_ALL_TAIL_PARALLELISM`. Heavy lane caps default to `OPENCLAW_DOCKER_ALL_LIVE_LIMIT=9`, `OPENCLAW_DOCKER_ALL_NPM_LIMIT=10`, and `OPENCLAW_DOCKER_ALL_SERVICE_LIMIT=7` so npm install and multi-service lanes do not overcommit Docker while lighter lanes still fill available slots. Lane starts are staggered by 2 seconds by default to avoid local Docker daemon create storms; override with `OPENCLAW_DOCKER_ALL_START_STAGGER_MS=0` or another millisecond value. The local aggregate preflights Docker, removes stale OpenClaw E2E containers, emits active-lane status, persists lane timings for longest-first ordering, and supports `OPENCLAW_DOCKER_ALL_DRY_RUN=1` for scheduler inspection. It stops scheduling new pooled lanes after the first failure by default, and each lane has a 120-minute fallback timeout overrideable with `OPENCLAW_DOCKER_ALL_LANE_TIMEOUT_MS`; selected live/tail lanes use tighter per-lane caps. `OPENCLAW_DOCKER_ALL_LANES=` runs exact scheduler lanes, including release-only lanes such as `install-e2e` and split bundled update lanes such as `bundled-channel-update-acpx`, while skipping the cleanup smoke so agents can reproduce one failed lane. The reusable live/E2E workflow asks `scripts/test-docker-all.mjs --plan-json` which package, image kind, live image, lane, and credential coverage is required, then `scripts/docker-e2e.mjs` converts that plan into GitHub outputs and summaries. It packs OpenClaw through `scripts/package-openclaw-for-docker.mjs`, validates the tarball inventory, builds and pushes one SHA-tagged bare GHCR Docker E2E image when the plan needs install/update/plugin-dependency lanes, and builds one SHA-tagged functional GHCR Docker E2E image when the plan needs package-installed functionality lanes; if either SHA-tagged image already exists, the workflow skips rebuilding that image but still creates the fresh tarball artifact required by targeted reruns. The release-path Docker suite runs as at most three chunked jobs with `OPENCLAW_SKIP_DOCKER_BUILD=1` so each chunk pulls only the image kind it needs and executes multiple lanes through the same weighted scheduler (`OPENCLAW_DOCKER_ALL_PROFILE=release-path`, `OPENCLAW_DOCKER_ALL_CHUNK=core|package-update|plugins-integrations`). Each chunk uploads `.artifacts/docker-tests/` with lane logs, timings, `summary.json`, `failures.json`, phase timings, scheduler plan JSON, and per-lane rerun commands. The workflow `docker_lanes` input runs selected lanes against the prepared images instead of the three chunk jobs, which keeps failed-lane debugging bounded to one targeted Docker job and prepares a fresh npm tarball for the selected ref; if a selected lane is a live Docker lane, the targeted job builds the live-test image locally for that rerun. Use `pnpm test:docker:rerun ` to download Docker artifacts from a GitHub run and print combined/per-lane targeted rerun commands; use `pnpm test:docker:timings ` for slow-lane and phase critical-path summaries. When Open WebUI is requested with the release-path suite, it runs inside the plugins/integrations chunk instead of reserving a fourth Docker worker; Open WebUI keeps a standalone job only for openwebui-only dispatches. The scheduled live/E2E workflow runs the full release-path Docker suite daily. The bundled update matrix is split by update target so repeated npm update and doctor repair passes can shard with other bundled checks. +The separate `install-smoke` workflow reuses the same scope script through its own `preflight` job. It splits smoke coverage into `run_fast_install_smoke` and `run_full_install_smoke`. Pull requests run the fast path for Docker/package surfaces, bundled plugin package/manifest changes, and core plugin/channel/gateway/Plugin SDK surfaces that the Docker smoke jobs exercise. Source-only bundled plugin changes, test-only edits, and docs-only edits do not reserve Docker workers. The fast path builds the root Dockerfile image once, checks the CLI, runs the agents delete shared-workspace CLI smoke, runs the container gateway-network e2e, verifies a bundled extension build arg, and runs the bounded bundled-plugin Docker profile under a 240-second aggregate command timeout with each scenario's Docker run capped separately. The full path keeps QR package install and installer Docker/update coverage for nightly scheduled runs, manual dispatches, workflow-call release checks, and pull requests that truly touch installer/package/Docker surfaces. `main` pushes, including merge commits, do not force the full path; when changed-scope logic would request full coverage on a push, the workflow keeps the fast Docker smoke and leaves the full install smoke to nightly or release validation. The slow Bun global install image-provider smoke is separately gated by `run_bun_global_install_smoke`; it runs on the nightly schedule and from the release checks workflow, and manual `install-smoke` dispatches can opt into it, but pull requests and `main` pushes do not run it. QR and installer Docker tests keep their own install-focused Dockerfiles. Local `test:docker:all` prebuilds one shared live-test image, packs OpenClaw once as an npm tarball, and builds two shared `scripts/e2e/Dockerfile` images: a bare Node/Git runner for installer/update/plugin-dependency lanes and a functional image that installs the same tarball into `/app` for normal functionality lanes. Docker lane definitions live in `scripts/lib/docker-e2e-scenarios.mjs`, planner logic lives in `scripts/lib/docker-e2e-plan.mjs`, and the runner only executes the selected plan. The scheduler selects the image per lane with `OPENCLAW_DOCKER_E2E_BARE_IMAGE` and `OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE`, then runs lanes with `OPENCLAW_SKIP_DOCKER_BUILD=1`; tune the default main-pool slot count of 10 with `OPENCLAW_DOCKER_ALL_PARALLELISM` and the provider-sensitive tail-pool slot count of 10 with `OPENCLAW_DOCKER_ALL_TAIL_PARALLELISM`. Heavy lane caps default to `OPENCLAW_DOCKER_ALL_LIVE_LIMIT=9`, `OPENCLAW_DOCKER_ALL_NPM_LIMIT=10`, and `OPENCLAW_DOCKER_ALL_SERVICE_LIMIT=7` so npm install and multi-service lanes do not overcommit Docker while lighter lanes still fill available slots. Lane starts are staggered by 2 seconds by default to avoid local Docker daemon create storms; override with `OPENCLAW_DOCKER_ALL_START_STAGGER_MS=0` or another millisecond value. The local aggregate preflights Docker, removes stale OpenClaw E2E containers, emits active-lane status, persists lane timings for longest-first ordering, and supports `OPENCLAW_DOCKER_ALL_DRY_RUN=1` for scheduler inspection. It stops scheduling new pooled lanes after the first failure by default, and each lane has a 120-minute fallback timeout overrideable with `OPENCLAW_DOCKER_ALL_LANE_TIMEOUT_MS`; selected live/tail lanes use tighter per-lane caps. `OPENCLAW_DOCKER_ALL_LANES=` runs exact scheduler lanes, including release-only lanes such as `install-e2e` and split bundled update lanes such as `bundled-channel-update-acpx`, while skipping the cleanup smoke so agents can reproduce one failed lane. The reusable live/E2E workflow asks `scripts/test-docker-all.mjs --plan-json` which package, image kind, live image, lane, and credential coverage is required, then `scripts/docker-e2e.mjs` converts that plan into GitHub outputs and summaries. It either packs OpenClaw through `scripts/package-openclaw-for-docker.mjs` or downloads a caller-provided package artifact, validates the tarball inventory, builds and pushes package-digest-tagged bare/functional GHCR Docker E2E images when the plan needs package-installed lanes, and reuses those images when the same package digest has already been prepared. The release-path Docker suite runs as at most three chunked jobs with `OPENCLAW_SKIP_DOCKER_BUILD=1` so each chunk pulls only the image kind it needs and executes multiple lanes through the same weighted scheduler (`OPENCLAW_DOCKER_ALL_PROFILE=release-path`, `OPENCLAW_DOCKER_ALL_CHUNK=core|package-update|plugins-integrations`). Each chunk uploads `.artifacts/docker-tests/` with lane logs, timings, `summary.json`, `failures.json`, phase timings, scheduler plan JSON, and per-lane rerun commands. The workflow `docker_lanes` input runs selected lanes against the prepared images instead of the three chunk jobs, which keeps failed-lane debugging bounded to one targeted Docker job and prepares or downloads the package artifact for that run; if a selected lane is a live Docker lane, the targeted job builds the live-test image locally for that rerun. Use `pnpm test:docker:rerun ` to download Docker artifacts from a GitHub run and print combined/per-lane targeted rerun commands; use `pnpm test:docker:timings ` for slow-lane and phase critical-path summaries. When Open WebUI is requested with the release-path suite, it runs inside the plugins/integrations chunk instead of reserving a fourth Docker worker; Open WebUI keeps a standalone job only for openwebui-only dispatches. The scheduled live/E2E workflow runs the full release-path Docker suite daily. The bundled update matrix is split by update target so repeated npm update and doctor repair passes can shard with other bundled checks. Local changed-lane logic lives in `scripts/changed-lanes.mjs` and is executed by `scripts/check-changed.mjs`. That local check gate is stricter about architecture boundaries than the broad CI platform scope: core production changes run core prod and core test typecheck plus core lint/guards, core test-only changes run only core test typecheck plus core lint, extension production changes run extension prod and extension test typecheck plus extension lint, and extension test-only changes run extension test typecheck plus extension lint. Public Plugin SDK or plugin-contract changes expand to extension typecheck because extensions depend on those core contracts, but Vitest extension sweeps are explicit test work. Release metadata-only version bumps run targeted version/config/root-dependency checks. Unknown root/config changes fail safe to all check lanes. diff --git a/docs/help/testing.md b/docs/help/testing.md index f8eff284744..9e7b9084d05 100644 --- a/docs/help/testing.md +++ b/docs/help/testing.md @@ -151,6 +151,42 @@ runs the same lanes before release approval. - GitHub Actions exposes this lane as the manual maintainer workflow `NPM Telegram Beta E2E`. It does not run on merge. The workflow uses the `qa-live-shared` environment and Convex CI credential leases. +- GitHub Actions also exposes `Package Acceptance` for side-run product proof + against one candidate package. It accepts a trusted ref, published npm spec, + HTTPS tarball URL plus SHA-256, or tarball artifact from another run, uploads + the normalized `openclaw-current.tgz` as `package-under-test`, then runs the + existing Docker E2E scheduler with smoke, package, product, full, or custom + lane profiles. Published npm candidates can additionally run the Telegram QA + workflow. + - Latest beta product proof: + +```bash +gh workflow run package-acceptance.yml --ref main \ + -f source=npm \ + -f package_spec=openclaw@beta \ + -f suite_profile=product +``` + +- Exact tarball URL proof requires a digest: + +```bash +gh workflow run package-acceptance.yml --ref main \ + -f source=url \ + -f package_url=https://registry.npmjs.org/openclaw/-/openclaw-VERSION.tgz \ + -f package_sha256= \ + -f suite_profile=package +``` + +- Artifact proof downloads a tarball artifact from another Actions run: + +```bash +gh workflow run package-acceptance.yml --ref main \ + -f source=artifact \ + -f artifact_run_id= \ + -f artifact_name= \ + -f suite_profile=smoke +``` + - `pnpm test:docker:bundled-channel-deps` - Packs and installs the current OpenClaw build in Docker, starts the Gateway with OpenAI configured, then enables bundled channel/plugins via config diff --git a/docs/reference/RELEASING.md b/docs/reference/RELEASING.md index 0a31abfc90d..8433f5db357 100644 --- a/docs/reference/RELEASING.md +++ b/docs/reference/RELEASING.md @@ -57,6 +57,22 @@ OpenClaw has three public release lanes: Provide `npm_telegram_package_spec` only after a package has been published and the post-publish Telegram E2E should run too. Example: `gh workflow run full-release-validation.yml --ref main -f ref=release/YYYY.M.D` +- Run the manual `Package Acceptance` workflow when you want side-channel proof + for a package candidate while release work continues. Use `source=npm` for + `openclaw@beta`, `openclaw@latest`, or an exact release version; `source=ref` + to pack a trusted branch/tag/SHA; `source=url` for an HTTPS tarball with a + required SHA-256; or `source=artifact` for a tarball uploaded by another + GitHub Actions run. The workflow resolves the candidate to + `package-under-test`, reuses the Docker E2E release scheduler against that + tarball, and can optionally run published-npm Telegram QA. + Example: `gh workflow run package-acceptance.yml --ref main -f source=npm -f package_spec=openclaw@beta -f suite_profile=product` + Common profiles: + - `smoke`: install/channel/agent, gateway network, and config reload lanes + - `package`: package/update/plugin lanes without OpenWebUI + - `product`: package profile plus MCP channels, cron/subagent cleanup, + OpenAI web search, and OpenWebUI + - `full`: Docker release-path chunks with OpenWebUI + - `custom`: exact `docker_lanes` selection for a focused rerun - Run the manual `CI` workflow directly when you only need full normal CI coverage for the release candidate. Manual CI dispatches bypass changed scoping and force the Linux Node shards, bundled-plugin shards, channel diff --git a/scripts/resolve-openclaw-package-candidate.mjs b/scripts/resolve-openclaw-package-candidate.mjs new file mode 100644 index 00000000000..e290c054886 --- /dev/null +++ b/scripts/resolve-openclaw-package-candidate.mjs @@ -0,0 +1,330 @@ +#!/usr/bin/env node +// Normalizes package-acceptance inputs into the tarball shape consumed by Docker E2E. +import { spawn } from "node:child_process"; +import { createHash } from "node:crypto"; +import { createWriteStream } from "node:fs"; +import fs from "node:fs/promises"; +import path from "node:path"; +import { pipeline } from "node:stream/promises"; +import { fileURLToPath } from "node:url"; + +const ROOT_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), ".."); +const DEFAULT_OUTPUT_NAME = "openclaw-current.tgz"; +export const OPENCLAW_PACKAGE_SPEC_RE = + /^openclaw@(beta|latest|[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*(-[1-9][0-9]*|-beta\.[1-9][0-9]*)?)$/u; + +function usage() { + return `Usage: node scripts/resolve-openclaw-package-candidate.mjs --source --output-dir [options] + +Options: + --package-spec Published npm spec for source=npm. + --package-url HTTPS tarball URL for source=url. + --package-sha256 Expected tarball SHA-256 for source=url or source=artifact. + --artifact-dir Directory containing exactly one .tgz for source=artifact. + --output-name Output tarball filename. Default: ${DEFAULT_OUTPUT_NAME} + --metadata Write package metadata JSON. + --github-output Append tarball, sha256, package name/version outputs.`; +} + +export function parseArgs(argv) { + const options = { + artifactDir: "", + githubOutput: "", + metadata: "", + outputDir: "", + outputName: DEFAULT_OUTPUT_NAME, + packageSha256: "", + packageSpec: "", + packageUrl: "", + source: "", + }; + for (let index = 0; index < argv.length; index += 1) { + const arg = argv[index]; + const readValue = (name) => { + const value = argv[(index += 1)]; + if (value === undefined) { + throw new Error(`${name} requires a value`); + } + return value; + }; + if (arg === "--artifact-dir") { + options.artifactDir = readValue(arg); + } else if (arg === "--github-output") { + options.githubOutput = readValue(arg); + } else if (arg === "--metadata") { + options.metadata = readValue(arg); + } else if (arg === "--output-dir") { + options.outputDir = readValue(arg); + } else if (arg === "--output-name") { + options.outputName = readValue(arg); + } else if (arg === "--package-sha256") { + options.packageSha256 = readValue(arg).toLowerCase(); + } else if (arg === "--package-spec") { + options.packageSpec = readValue(arg); + } else if (arg === "--package-url") { + options.packageUrl = readValue(arg); + } else if (arg === "--source") { + options.source = readValue(arg); + } else if (arg === "--help" || arg === "-h") { + options.help = true; + } else { + throw new Error(`unknown argument: ${arg}`); + } + } + return options; +} + +export function validateOpenClawPackageSpec(spec) { + if (!OPENCLAW_PACKAGE_SPEC_RE.test(spec)) { + throw new Error( + `package_spec must be openclaw@beta, openclaw@latest, or an exact OpenClaw release version; got: ${spec}`, + ); + } +} + +function run(command, args, options = {}) { + return new Promise((resolve, reject) => { + const child = spawn(command, args, { + cwd: options.cwd ?? ROOT_DIR, + stdio: options.capture ? ["ignore", "pipe", "pipe"] : ["ignore", "inherit", "inherit"], + }); + let stdout = ""; + let stderr = ""; + if (options.capture) { + child.stdout.on("data", (chunk) => { + stdout += String(chunk); + }); + child.stderr.on("data", (chunk) => { + stderr += String(chunk); + }); + } + child.on("error", reject); + child.on("close", (status, signal) => { + if (status === 0) { + resolve(stdout); + return; + } + const detail = stderr.trim() ? `\n${stderr.trim()}` : ""; + reject(new Error(`${command} ${args.join(" ")} failed with ${status ?? signal}${detail}`)); + }); + }); +} + +async function walkFiles(dir) { + const entries = await fs.readdir(dir, { withFileTypes: true }); + const files = []; + for (const entry of entries) { + const absolute = path.join(dir, entry.name); + if (entry.isDirectory()) { + files.push(...(await walkFiles(absolute))); + } else if (entry.isFile()) { + files.push(absolute); + } + } + return files; +} + +async function sha256(file) { + const hash = createHash("sha256"); + const handle = await fs.open(file, "r"); + try { + for await (const chunk of handle.createReadStream()) { + hash.update(chunk); + } + } finally { + await handle.close(); + } + return hash.digest("hex"); +} + +function assertSha256(value) { + if (!/^[a-f0-9]{64}$/u.test(value)) { + throw new Error(`package_sha256 must be a lowercase or uppercase 64-character SHA-256 digest`); + } +} + +async function assertExpectedSha256(file, expected) { + if (!expected) { + return await sha256(file); + } + assertSha256(expected); + const actual = await sha256(file); + if (actual !== expected.toLowerCase()) { + throw new Error(`package SHA-256 mismatch: expected ${expected}, got ${actual}`); + } + return actual; +} + +async function findSingleTarball(dir) { + const files = (await walkFiles(path.resolve(ROOT_DIR, dir))) + .filter((file) => /\.t(?:ar\.)?gz$/u.test(path.basename(file))) + .toSorted((a, b) => a.localeCompare(b)); + if (files.length !== 1) { + throw new Error( + `source=artifact requires exactly one .tgz under ${dir}; found ${files.length}: ${files.join(", ")}`, + ); + } + return files[0]; +} + +async function moveNewestPackedTarball(outputDir, packOutput, outputName) { + let filename = ""; + try { + const parsed = JSON.parse(packOutput); + if (Array.isArray(parsed)) { + filename = parsed.find((entry) => typeof entry?.filename === "string")?.filename ?? ""; + } + } catch {} + if (!filename) { + for (const line of packOutput.split(/\r?\n/u)) { + const trimmed = line.trim(); + if (/^openclaw-.*\.tgz$/u.test(trimmed)) { + filename = trimmed; + } + } + } + if (!filename) { + const entries = await fs.readdir(outputDir); + filename = entries + .filter((entry) => /^openclaw-.*\.tgz$/u.test(entry)) + .toSorted((a, b) => a.localeCompare(b)) + .at(-1); + } + if (!filename) { + throw new Error(`npm pack produced no OpenClaw tarball in ${outputDir}`); + } + const packed = path.join(outputDir, filename); + const target = path.join(outputDir, outputName); + if (packed !== target) { + await fs.rm(target, { force: true }); + await fs.rename(packed, target); + } + return target; +} + +async function downloadUrl(url, target) { + const parsed = new URL(url); + if (parsed.protocol !== "https:") { + throw new Error(`package_url must use https: ${url}`); + } + const response = await fetch(parsed); + if (!response.ok || !response.body) { + throw new Error(`failed to download package_url: HTTP ${response.status}`); + } + await pipeline(response.body, createWriteStream(target)); +} + +async function readPackageJson(tarball) { + const raw = await run("tar", ["-xOf", tarball, "package/package.json"], { capture: true }); + const pkg = JSON.parse(raw); + return { + name: typeof pkg.name === "string" ? pkg.name : "", + version: typeof pkg.version === "string" ? pkg.version : "", + }; +} + +async function appendGithubOutputs(file, outputs) { + if (!file) { + return; + } + const body = Object.entries(outputs) + .map(([key, value]) => `${key}=${String(value).replace(/\n/gu, " ")}`) + .join("\n"); + await fs.appendFile(file, `${body}\n`); +} + +async function resolveCandidate(options) { + const outputDir = path.resolve(ROOT_DIR, options.outputDir); + const target = path.join(outputDir, options.outputName || DEFAULT_OUTPUT_NAME); + await fs.mkdir(outputDir, { recursive: true }); + await fs.rm(target, { force: true }); + + if (options.source === "ref") { + await run("node", [ + "scripts/package-openclaw-for-docker.mjs", + "--output-dir", + outputDir, + "--output-name", + options.outputName || DEFAULT_OUTPUT_NAME, + ]); + } else if (options.source === "npm") { + validateOpenClawPackageSpec(options.packageSpec); + const packOutput = await run( + "npm", + ["pack", options.packageSpec, "--ignore-scripts", "--json", "--pack-destination", outputDir], + { capture: true }, + ); + await moveNewestPackedTarball(outputDir, packOutput, options.outputName || DEFAULT_OUTPUT_NAME); + } else if (options.source === "url") { + if (!options.packageUrl) { + throw new Error("source=url requires --package-url"); + } + if (!options.packageSha256) { + throw new Error("source=url requires --package-sha256"); + } + await downloadUrl(options.packageUrl, target); + } else if (options.source === "artifact") { + if (!options.artifactDir) { + throw new Error("source=artifact requires --artifact-dir"); + } + const input = await findSingleTarball(options.artifactDir); + await fs.copyFile(input, target); + } else { + throw new Error(`source must be one of: ref, npm, url, artifact. Got: ${options.source}`); + } + + const digest = await assertExpectedSha256(target, options.packageSha256); + await run("node", ["scripts/check-openclaw-package-tarball.mjs", target]); + const pkg = await readPackageJson(target); + const metadata = { + name: pkg.name, + packageSpec: options.packageSpec || "", + sha256: digest, + source: options.source, + tarball: path.relative(ROOT_DIR, target), + version: pkg.version, + }; + + if (pkg.name !== "openclaw") { + throw new Error(`package candidate must be named "openclaw"; got: ${pkg.name || ""}`); + } + if (!pkg.version) { + throw new Error("package candidate package.json has no version"); + } + + if (options.metadata) { + await fs.mkdir(path.dirname(path.resolve(ROOT_DIR, options.metadata)), { recursive: true }); + await fs.writeFile( + path.resolve(ROOT_DIR, options.metadata), + `${JSON.stringify(metadata, null, 2)}\n`, + ); + } + await appendGithubOutputs(options.githubOutput, { + package_name: pkg.name, + package_version: pkg.version, + sha256: digest, + tarball: metadata.tarball, + }); + return metadata; +} + +export async function main(argv = process.argv.slice(2)) { + const options = parseArgs(argv); + if (options.help) { + console.log(usage()); + return; + } + if (!options.outputDir) { + throw new Error("--output-dir is required"); + } + const metadata = await resolveCandidate(options); + console.log(JSON.stringify(metadata, null, 2)); +} + +if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) { + await main().catch((error) => { + console.error(error instanceof Error ? error.message : String(error)); + console.error(usage()); + process.exit(1); + }); +} diff --git a/test/scripts/package-acceptance-workflow.test.ts b/test/scripts/package-acceptance-workflow.test.ts new file mode 100644 index 00000000000..5f7cd12731b --- /dev/null +++ b/test/scripts/package-acceptance-workflow.test.ts @@ -0,0 +1,65 @@ +import { readFileSync } from "node:fs"; +import { describe, expect, it } from "vitest"; + +const PACKAGE_ACCEPTANCE_WORKFLOW = ".github/workflows/package-acceptance.yml"; +const LIVE_E2E_WORKFLOW = ".github/workflows/openclaw-live-and-e2e-checks-reusable.yml"; +const DOCKER_E2E_PLAN_ACTION = ".github/actions/docker-e2e-plan/action.yml"; +const NPM_TELEGRAM_WORKFLOW = ".github/workflows/npm-telegram-beta-e2e.yml"; + +describe("package acceptance workflow", () => { + it("resolves candidate package sources before reusing Docker E2E lanes", () => { + const workflow = readFileSync(PACKAGE_ACCEPTANCE_WORKFLOW, "utf8"); + + expect(workflow).toContain("name: Package Acceptance"); + expect(workflow).toContain("source:"); + expect(workflow).toContain("- npm"); + expect(workflow).toContain("- ref"); + expect(workflow).toContain("- url"); + expect(workflow).toContain("- artifact"); + expect(workflow).toContain("scripts/resolve-openclaw-package-candidate.mjs"); + expect(workflow).toContain('gh run download "$ARTIFACT_RUN_ID"'); + expect(workflow).toContain("name: ${{ env.PACKAGE_ARTIFACT_NAME }}"); + expect(workflow).toContain( + "uses: ./.github/workflows/openclaw-live-and-e2e-checks-reusable.yml", + ); + expect(workflow).toContain( + "package_artifact_name: ${{ needs.resolve_package.outputs.package_artifact_name }}", + ); + }); + + it("offers bounded product profiles and keeps Telegram published-npm only", () => { + const workflow = readFileSync(PACKAGE_ACCEPTANCE_WORKFLOW, "utf8"); + + expect(workflow).toContain("suite_profile:"); + expect(workflow).toContain("npm-onboard-channel-agent gateway-network config-reload"); + expect(workflow).toContain("install-e2e npm-onboard-channel-agent doctor-switch"); + expect(workflow).toContain("include_release_path_suites=true"); + expect(workflow).toContain("telegram_mode requires source=npm"); + expect(workflow).toContain("uses: ./.github/workflows/npm-telegram-beta-e2e.yml"); + }); +}); + +describe("package artifact reuse", () => { + it("lets reusable Docker E2E consume an already resolved package artifact", () => { + const workflow = readFileSync(LIVE_E2E_WORKFLOW, "utf8"); + const action = readFileSync(DOCKER_E2E_PLAN_ACTION, "utf8"); + + expect(workflow).toContain("package_artifact_name:"); + expect(workflow).toContain("Download provided OpenClaw Docker E2E package"); + expect(workflow).toContain("inputs.package_artifact_name != ''"); + expect(workflow).toContain('image_tag="${PACKAGE_TAG:-$SELECTED_SHA}"'); + expect(workflow).toContain( + "package-artifact-name: ${{ inputs.package_artifact_name || 'docker-e2e-package' }}", + ); + expect(action).toContain("package-artifact-name:"); + expect(action).toContain("name: ${{ inputs.package-artifact-name }}"); + }); + + it("allows the npm Telegram lane to run from reusable package acceptance", () => { + const workflow = readFileSync(NPM_TELEGRAM_WORKFLOW, "utf8"); + + expect(workflow).toContain("workflow_call:"); + expect(workflow).toContain("provider_mode:"); + expect(workflow).toContain("provider_mode must be mock-openai or live-frontier"); + }); +}); diff --git a/test/scripts/resolve-openclaw-package-candidate.test.ts b/test/scripts/resolve-openclaw-package-candidate.test.ts new file mode 100644 index 00000000000..a3eb4f9422c --- /dev/null +++ b/test/scripts/resolve-openclaw-package-candidate.test.ts @@ -0,0 +1,51 @@ +import { describe, expect, it } from "vitest"; +import { + parseArgs, + validateOpenClawPackageSpec, +} from "../../scripts/resolve-openclaw-package-candidate.mjs"; + +describe("resolve-openclaw-package-candidate", () => { + it("accepts only OpenClaw release package specs for npm candidates", () => { + expect(() => validateOpenClawPackageSpec("openclaw@beta")).not.toThrow(); + expect(() => validateOpenClawPackageSpec("openclaw@latest")).not.toThrow(); + expect(() => validateOpenClawPackageSpec("openclaw@2026.4.27")).not.toThrow(); + expect(() => validateOpenClawPackageSpec("openclaw@2026.4.27-1")).not.toThrow(); + expect(() => validateOpenClawPackageSpec("openclaw@2026.4.27-beta.2")).not.toThrow(); + + expect(() => validateOpenClawPackageSpec("@evil/openclaw@1.0.0")).toThrow( + "package_spec must be openclaw@beta", + ); + expect(() => validateOpenClawPackageSpec("openclaw@canary")).toThrow( + "package_spec must be openclaw@beta", + ); + expect(() => validateOpenClawPackageSpec("openclaw@2026.04.27")).toThrow( + "package_spec must be openclaw@beta", + ); + }); + + it("parses optional empty workflow inputs without rejecting the command line", () => { + expect( + parseArgs([ + "--source", + "npm", + "--package-spec", + "openclaw@beta", + "--package-url", + "", + "--package-sha256", + "", + "--artifact-dir", + ".", + "--output-dir", + ".artifacts/docker-e2e-package", + ]), + ).toMatchObject({ + artifactDir: ".", + outputDir: ".artifacts/docker-e2e-package", + packageSha256: "", + packageSpec: "openclaw@beta", + packageUrl: "", + source: "npm", + }); + }); +}); From 2c092a0eff33148beeae55df6d2f3361091f8a01 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 04:27:05 +0100 Subject: [PATCH 200/418] docs: document release validation test workflows --- .agents/skills/openclaw-testing/SKILL.md | 86 ++++++++++++++++++++++++ 1 file changed, 86 insertions(+) diff --git a/.agents/skills/openclaw-testing/SKILL.md b/.agents/skills/openclaw-testing/SKILL.md index a64d5ac69cb..773b5cdbb22 100644 --- a/.agents/skills/openclaw-testing/SKILL.md +++ b/.agents/skills/openclaw-testing/SKILL.md @@ -96,6 +96,92 @@ gh run view --job --log - For cancelled same-branch runs, confirm whether a newer run superseded it. - Fetch full logs only for failed or relevant jobs. +## GitHub Release Workflows + +Use the smallest workflow that proves the current risk. The full umbrella is +available, but it is usually the last step after narrower proof, not the first +rerun after a focused patch. + +### Full Release Validation + +`Full Release Validation` (`.github/workflows/full-release-validation.yml`) is +the manual "everything before release" umbrella. It resolves a target ref, then +dispatches: + +- manual `CI` for the full normal CI graph +- `OpenClaw Release Checks` for install smoke, cross-OS release checks, live and + E2E checks, Docker release-path suites, OpenWebUI, QA Lab, Matrix, and + Telegram release lanes +- optional post-publish Telegram E2E when a package spec is supplied + +Run it only when validating an actual release candidate, after broad shared CI +or release orchestration changes, or when explicitly asked: + +```bash +gh workflow run full-release-validation.yml \ + --repo openclaw/openclaw \ + --ref main \ + -f ref= \ + -f workflow_ref=main \ + -f provider=openai \ + -f mode=both +``` + +If a full run is already active on a newer `origin/main`, prefer watching that +run over dispatching a duplicate. If you accidentally dispatch a stale duplicate, +cancel it and monitor the current run. + +### Release Checks + +`OpenClaw Release Checks` (`openclaw-release-checks.yml`) is the release child +workflow. It is broader than normal CI but narrower than the umbrella because it +does not dispatch the separate full normal CI child. Use it when release-path +validation is needed without rerunning the entire umbrella. + +```bash +gh workflow run openclaw-release-checks.yml \ + --repo openclaw/openclaw \ + --ref main \ + -f ref= \ + -f provider=openai \ + -f mode=both +``` + +### Reusable Live/E2E Checks + +`OpenClaw Live And E2E Checks (Reusable)` +(`openclaw-live-and-e2e-checks-reusable.yml`) is the preferred entry point for +targeted live, Docker, model, and E2E proof. Inputs let you turn off unrelated +lanes: + +```bash +gh workflow run openclaw-live-and-e2e-checks-reusable.yml \ + --repo openclaw/openclaw \ + --ref main \ + -f ref= \ + -f include_repo_e2e=false \ + -f include_release_path_suites=false \ + -f include_openwebui=false \ + -f include_live_suites=true \ + -f live_models_only=true \ + -f live_model_providers=fireworks +``` + +Useful knobs: + +- `docker_lanes=''`: run selected Docker scheduler lanes against + prepared artifacts instead of the three release chunks. +- `include_live_suites=false`: skip live/provider suites when testing Docker + scheduler or release packaging only. +- `live_models_only=true`: run only Docker live model coverage. +- `live_model_providers=fireworks` (or comma/space separated providers): run one + targeted Docker live model job instead of the full provider matrix. +- blank `live_model_providers`: run the full live-model provider matrix. + +For model-list or provider-selection fixes, use `live_models_only=true` plus the +specific `live_model_providers` allowlist. Confirm logs show the expected +`OPENCLAW_LIVE_PROVIDERS` and selected model ids before declaring proof. + ## Docker Docker is expensive. First inspect the scheduler without running Docker: From 6a05b9eec5d83f39e021e675d9f055724441c74e Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 04:27:42 +0100 Subject: [PATCH 201/418] ci: fix package acceptance permissions --- .github/workflows/package-acceptance.yml | 1 + test/scripts/package-acceptance-workflow.test.ts | 1 + 2 files changed, 2 insertions(+) diff --git a/.github/workflows/package-acceptance.yml b/.github/workflows/package-acceptance.yml index 5ec2d0c76b1..09d96e50492 100644 --- a/.github/workflows/package-acceptance.yml +++ b/.github/workflows/package-acceptance.yml @@ -73,6 +73,7 @@ permissions: actions: read contents: read packages: write + pull-requests: read concurrency: group: package-acceptance-${{ github.run_id }} diff --git a/test/scripts/package-acceptance-workflow.test.ts b/test/scripts/package-acceptance-workflow.test.ts index 5f7cd12731b..e802dc0bc5e 100644 --- a/test/scripts/package-acceptance-workflow.test.ts +++ b/test/scripts/package-acceptance-workflow.test.ts @@ -19,6 +19,7 @@ describe("package acceptance workflow", () => { expect(workflow).toContain("scripts/resolve-openclaw-package-candidate.mjs"); expect(workflow).toContain('gh run download "$ARTIFACT_RUN_ID"'); expect(workflow).toContain("name: ${{ env.PACKAGE_ARTIFACT_NAME }}"); + expect(workflow).toContain("pull-requests: read"); expect(workflow).toContain( "uses: ./.github/workflows/openclaw-live-and-e2e-checks-reusable.yml", ); From 4878d3e059cee7fb0652cf973e82d76cc7371764 Mon Sep 17 00:00:00 2001 From: Josh Avant <830519+joshavant@users.noreply.github.com> Date: Sun, 26 Apr 2026 22:31:39 -0500 Subject: [PATCH 202/418] fix: resolve tts secret refs for local infer (#72549) --- src/cli/capability-cli.test.ts | 76 +++++++++++++++++++ src/cli/capability-cli.ts | 9 ++- ...command-secret-resolution.coverage.test.ts | 1 + src/cli/command-secret-targets.test.ts | 6 ++ src/cli/command-secret-targets.ts | 7 +- 5 files changed, 97 insertions(+), 2 deletions(-) diff --git a/src/cli/capability-cli.test.ts b/src/cli/capability-cli.test.ts index 24cfbb27ad3..1f1e210aa4d 100644 --- a/src/cli/capability-cli.test.ts +++ b/src/cli/capability-cli.test.ts @@ -97,6 +97,13 @@ const mocks = vi.hoisted(() => ({ : {}), }), ), + resolveCommandSecretRefsViaGateway: vi.fn(async ({ config }: { config: unknown }) => ({ + resolvedConfig: config, + diagnostics: [], + targetStatesByPath: {}, + hadUnresolvedTargets: false, + })), + getTtsCommandSecretTargetIds: vi.fn(() => new Set(["messages.tts.providers.*.apiKey"])), createEmbeddingProvider: vi.fn(async () => ({ provider: { id: "openai", @@ -188,6 +195,14 @@ vi.mock("../gateway/connection-details.js", () => ({ })), })); +vi.mock("./command-secret-gateway.js", () => ({ + resolveCommandSecretRefsViaGateway: mocks.resolveCommandSecretRefsViaGateway, +})); + +vi.mock("./command-secret-targets.js", () => ({ + getTtsCommandSecretTargetIds: mocks.getTtsCommandSecretTargetIds, +})); + vi.mock("../media-understanding/runtime.js", () => ({ describeImageFile: mocks.describeImageFile as typeof import("../media-understanding/runtime.js").describeImageFile, @@ -311,6 +326,15 @@ describe("capability cli", () => { mocks.generateVideo.mockReset(); mocks.transcribeAudioFile.mockClear(); mocks.textToSpeech.mockClear(); + mocks.resolveCommandSecretRefsViaGateway + .mockReset() + .mockImplementation(async ({ config }: { config: unknown }) => ({ + resolvedConfig: config, + diagnostics: [], + targetStatesByPath: {}, + hadUnresolvedTargets: false, + })); + mocks.getTtsCommandSecretTargetIds.mockClear(); mocks.setTtsProvider.mockClear(); mocks.resolveExplicitTtsOverrides.mockClear(); mocks.buildMediaUnderstandingRegistry.mockReset().mockReturnValue(new Map()); @@ -1057,6 +1081,58 @@ describe("capability cli", () => { expect(mocks.setTtsProvider).not.toHaveBeenCalled(); }); + it("resolves static TTS SecretRefs before local conversion", async () => { + const sourceConfig = { + messages: { + tts: { + providers: { + minimax: { + apiKey: { source: "exec", provider: "mockexec", id: "minimax/tts/apiKey" }, + }, + }, + }, + }, + }; + const resolvedConfig = { + messages: { + tts: { + providers: { + minimax: { + apiKey: "resolved-minimax-key", + }, + }, + }, + }, + }; + mocks.loadConfig.mockReturnValueOnce(sourceConfig); + mocks.resolveCommandSecretRefsViaGateway.mockResolvedValueOnce({ + resolvedConfig, + diagnostics: [], + targetStatesByPath: { + "messages.tts.providers.minimax.apiKey": "resolved_local", + }, + hadUnresolvedTargets: false, + }); + + await runRegisteredCli({ + register: registerCapabilityCli as (program: Command) => void, + argv: ["capability", "tts", "convert", "--text", "hello", "--json"], + }); + + expect(mocks.resolveCommandSecretRefsViaGateway).toHaveBeenCalledWith({ + config: sourceConfig, + commandName: "infer tts convert", + targetIds: new Set(["messages.tts.providers.*.apiKey"]), + mode: "enforce_resolved", + }); + expect(mocks.resolveExplicitTtsOverrides).toHaveBeenCalledWith( + expect.objectContaining({ cfg: resolvedConfig }), + ); + expect(mocks.textToSpeech).toHaveBeenCalledWith( + expect.objectContaining({ cfg: resolvedConfig }), + ); + }); + it("disables TTS fallback when explicit provider or voice/model selection is requested", async () => { await runRegisteredCli({ register: registerCapabilityCli as (program: Command) => void, diff --git a/src/cli/capability-cli.ts b/src/cli/capability-cli.ts index a5ba86618b7..4c12e1cf385 100644 --- a/src/cli/capability-cli.ts +++ b/src/cli/capability-cli.ts @@ -79,6 +79,8 @@ import { runWebSearch, } from "../web-search/runtime.js"; import { runCommandWithRuntime } from "./cli-utils.js"; +import { resolveCommandSecretRefsViaGateway } from "./command-secret-gateway.js"; +import { getTtsCommandSecretTargetIds } from "./command-secret-targets.js"; import { createDefaultDeps } from "./deps.js"; import { removeCommandByName } from "./program/command-tree.js"; import { collectOption } from "./program/helpers.js"; @@ -1111,7 +1113,12 @@ async function runTtsConvert(params: { } satisfies CapabilityEnvelope; } - const cfg = loadConfig(); + const { resolvedConfig: cfg } = await resolveCommandSecretRefsViaGateway({ + config: loadConfig(), + commandName: "infer tts convert", + targetIds: getTtsCommandSecretTargetIds(), + mode: "enforce_resolved", + }); const overrides = resolveExplicitTtsOverrides({ cfg, provider: params.provider, diff --git a/src/cli/command-secret-resolution.coverage.test.ts b/src/cli/command-secret-resolution.coverage.test.ts index 9da2c0f322b..3dd9e440675 100644 --- a/src/cli/command-secret-resolution.coverage.test.ts +++ b/src/cli/command-secret-resolution.coverage.test.ts @@ -4,6 +4,7 @@ import { readCommandSource } from "./command-source.test-helpers.js"; const SECRET_TARGET_CALLSITES = [ bundledPluginFile("memory-core", "src/cli.runtime.ts"), + "src/cli/capability-cli.ts", "src/cli/qr-cli.ts", "src/agents/agent-runtime-config.ts", "src/commands/agent.ts", diff --git a/src/cli/command-secret-targets.test.ts b/src/cli/command-secret-targets.test.ts index cabf3028da7..8515a295536 100644 --- a/src/cli/command-secret-targets.test.ts +++ b/src/cli/command-secret-targets.test.ts @@ -58,6 +58,7 @@ import { getQrRemoteCommandSecretTargetIds, getScopedChannelsCommandSecretTargets, getSecurityAuditCommandSecretTargetIds, + getTtsCommandSecretTargetIds, } from "./command-secret-targets.js"; describe("command secret target ids", () => { @@ -73,6 +74,11 @@ describe("command secret target ids", () => { expect(ids.has("channels.discord.token")).toBe(false); }); + it("keeps static TTS targets out of the registry path", () => { + const ids = getTtsCommandSecretTargetIds(); + expect(ids).toEqual(new Set(["messages.tts.providers.*.apiKey"])); + }); + it("includes memorySearch remote targets for agent runtime commands", () => { const ids = getAgentRuntimeCommandSecretTargetIds(); expect(ids.has("agents.defaults.memorySearch.remote.apiKey")).toBe(true); diff --git a/src/cli/command-secret-targets.ts b/src/cli/command-secret-targets.ts index 9bbed1c5707..1309d290d10 100644 --- a/src/cli/command-secret-targets.ts +++ b/src/cli/command-secret-targets.ts @@ -23,12 +23,13 @@ const STATIC_MODEL_TARGET_IDS = [ "models.providers.*.request.tls.key", "models.providers.*.request.tls.passphrase", ] as const; +const STATIC_TTS_TARGET_IDS = ["messages.tts.providers.*.apiKey"] as const; const STATIC_AGENT_RUNTIME_BASE_TARGET_IDS = [ ...STATIC_MODEL_TARGET_IDS, "agents.defaults.memorySearch.remote.apiKey", "agents.list[].memorySearch.remote.apiKey", "agents.list[].tts.providers.*.apiKey", - "messages.tts.providers.*.apiKey", + ...STATIC_TTS_TARGET_IDS, "skills.entries.*.apiKey", "tools.web.search.apiKey", ] as const; @@ -221,6 +222,10 @@ export function getModelsCommandSecretTargetIds(): Set { return toTargetIdSet(STATIC_MODEL_TARGET_IDS); } +export function getTtsCommandSecretTargetIds(): Set { + return toTargetIdSet(STATIC_TTS_TARGET_IDS); +} + export function getAgentRuntimeCommandSecretTargetIds(params?: { includeChannelTargets?: boolean; }): Set { From f60378519ccf4089e94e98af2ddab641e2eccd56 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 20:30:45 -0700 Subject: [PATCH 203/418] test(plugins): cover bundled dependency edge cases --- src/cli/command-path-policy.test.ts | 15 +++++ src/cli/program/register.subclis.test.ts | 13 +++- src/plugins/bundled-runtime-deps.test.ts | 75 +++++++++++++++++++++++- 3 files changed, 99 insertions(+), 4 deletions(-) diff --git a/src/cli/command-path-policy.test.ts b/src/cli/command-path-policy.test.ts index 5c7fc1d2a87..e92ce4c55ac 100644 --- a/src/cli/command-path-policy.test.ts +++ b/src/cli/command-path-policy.test.ts @@ -97,6 +97,21 @@ describe("command-path-policy", () => { hideBanner: true, ensureCliPath: true, }); + for (const commandPath of [ + ["plugins", "install"], + ["plugins", "list"], + ["plugins", "inspect"], + ["plugins", "registry"], + ["plugins", "doctor"], + ]) { + expect(resolveCliCommandPathPolicy(commandPath)).toEqual({ + bypassConfigGuard: false, + routeConfigGuard: "never", + loadPlugins: "never", + hideBanner: false, + ensureCliPath: true, + }); + } expect(resolveCliCommandPathPolicy(["cron", "list"])).toEqual({ bypassConfigGuard: true, routeConfigGuard: "never", diff --git a/src/cli/program/register.subclis.test.ts b/src/cli/program/register.subclis.test.ts index fd3b3053947..f55ded1be1a 100644 --- a/src/cli/program/register.subclis.test.ts +++ b/src/cli/program/register.subclis.test.ts @@ -174,8 +174,17 @@ describe("registerSubCliCommands", () => { expect(acpAction).toHaveBeenCalledTimes(1); }); - it("does not preload plugin CLI registrations for builtin plugins update", async () => { - process.argv = ["node", "openclaw", "plugins", "update", "lossless-claw"]; + it.each([ + ["plugins update", ["plugins", "update", "lossless-claw"]], + ["plugins update --all", ["plugins", "update", "--all"]], + ["plugins install", ["plugins", "install", "lossless-claw"]], + ["plugins list", ["plugins", "list"]], + ["plugins inspect", ["plugins", "inspect", "lossless-claw"]], + ["plugins registry --refresh", ["plugins", "registry", "--refresh"]], + ["plugins doctor", ["plugins", "doctor"]], + ["plugins --help", ["plugins", "--help"]], + ])("does not preload plugin CLI registrations for builtin %s", async (_label, args) => { + process.argv = ["node", "openclaw", ...args]; const program = new Command().name("openclaw"); await registerSubCliByName(program, "plugins"); diff --git a/src/plugins/bundled-runtime-deps.test.ts b/src/plugins/bundled-runtime-deps.test.ts index 053399ccf3d..6ece5bd6b04 100644 --- a/src/plugins/bundled-runtime-deps.test.ts +++ b/src/plugins/bundled-runtime-deps.test.ts @@ -613,6 +613,13 @@ describe("installBundledRuntimeDeps", () => { }); describe("scanBundledPluginRuntimeDeps config policy", () => { + type RuntimeDepsConfigCase = { + name: string; + config: Parameters[0]["config"]; + includeConfiguredChannels: boolean; + expectedDeps: string[]; + }; + function setupPolicyPackageRoot(): string { const packageRoot = makeTempDir(); writeBundledPluginPackage({ @@ -630,7 +637,7 @@ describe("scanBundledPluginRuntimeDeps config policy", () => { return packageRoot; } - it.each([ + const cases: RuntimeDepsConfigCase[] = [ { name: "includes default-enabled bundled plugins", config: {}, @@ -661,6 +668,33 @@ describe("scanBundledPluginRuntimeDeps config policy", () => { includeConfiguredChannels: false, expectedDeps: [], }, + { + name: "lets plugin deny override explicit bundled channel enablement", + config: { + plugins: { deny: ["telegram"] }, + channels: { telegram: { enabled: true } }, + }, + includeConfiguredChannels: false, + expectedDeps: ["alpha-runtime@1.0.0"], + }, + { + name: "lets the plugin master toggle suppress explicit bundled channel enablement", + config: { + plugins: { enabled: false }, + channels: { telegram: { enabled: true } }, + }, + includeConfiguredChannels: false, + expectedDeps: [], + }, + { + name: "lets plugin entry disablement override explicit bundled channel enablement", + config: { + plugins: { entries: { telegram: { enabled: false } } }, + channels: { telegram: { enabled: true } }, + }, + includeConfiguredChannels: false, + expectedDeps: ["alpha-runtime@1.0.0"], + }, { name: "lets explicit bundled channel enablement bypass restrictive allowlists", config: { @@ -691,7 +725,9 @@ describe("scanBundledPluginRuntimeDeps config policy", () => { includeConfiguredChannels: true, expectedDeps: ["alpha-runtime@1.0.0"], }, - ])("$name", ({ config, includeConfiguredChannels, expectedDeps }) => { + ]; + + it.each(cases)("$name", ({ config, includeConfiguredChannels, expectedDeps }) => { const result = scanBundledPluginRuntimeDeps({ packageRoot: setupPolicyPackageRoot(), config, @@ -702,6 +738,41 @@ describe("scanBundledPluginRuntimeDeps config policy", () => { expect(result.conflicts).toEqual([]); }); + it("honors deny and disabled entries when scanning an explicit effective plugin set", () => { + const packageRoot = setupPolicyPackageRoot(); + + const denied = scanBundledPluginRuntimeDeps({ + packageRoot, + pluginIds: ["telegram"], + config: { + plugins: { deny: ["telegram"] }, + channels: { telegram: { enabled: true } }, + }, + }); + const disabled = scanBundledPluginRuntimeDeps({ + packageRoot, + pluginIds: ["telegram"], + config: { + plugins: { entries: { telegram: { enabled: false } } }, + channels: { telegram: { enabled: true } }, + }, + }); + const allowed = scanBundledPluginRuntimeDeps({ + packageRoot, + pluginIds: ["telegram"], + config: { + plugins: { entries: { telegram: { enabled: true } } }, + channels: { telegram: { enabled: true } }, + }, + }); + + expect(denied.deps).toEqual([]); + expect(disabled.deps).toEqual([]); + expect(allowed.deps.map((dep) => `${dep.name}@${dep.version}`)).toEqual([ + "telegram-runtime@2.0.0", + ]); + }); + it("reads each bundled plugin manifest once per runtime-deps scan", () => { const packageRoot = makeTempDir(); const pluginRoot = writeBundledPluginPackage({ From 67650c4c0a6fc2f75d14d6d75d1cc82be4d7f237 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 04:33:05 +0100 Subject: [PATCH 204/418] fix(ollama): resolve custom local provider auth --- CHANGELOG.md | 1 + docs/providers/ollama.md | 2 + extensions/ollama/index.ts | 4 +- extensions/ollama/provider-discovery.ts | 6 +- src/agents/model-auth.test.ts | 47 ++++++++++- ...r-runtime.synthetic-auth-discovery.test.ts | 49 ++++++++++- src/plugins/provider-runtime.ts | 84 ++++++++++++++----- 7 files changed, 167 insertions(+), 26 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5f53282ec21..82b86c400cc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -41,6 +41,7 @@ Docs: https://docs.openclaw.ai - Providers/Ollama: route local web search through Ollama's signed `/api/experimental/web_search` daemon proxy, use hosted `/api/web_search` directly for `ollama.com`, and keep `OLLAMA_API_KEY` scoped to cloud fallback auth. Fixes #69132. Thanks @yoon1012 and @hyspacex. - Providers/Ollama: accept OpenAI SDK-style `baseURL` as an alias for `baseUrl` across discovery, streaming, setup pulls, embeddings, and web search so remote Ollama hosts are not silently ignored. Fixes #62533; supersedes #62549. Thanks @Julien-BKK and @Linux2010. - Providers/Ollama: scope synthetic local auth and embedding bearer headers to declared Ollama host boundaries so cloud keys are not sent to local/self-hosted embedding endpoints and remote/cloud Ollama endpoints no longer receive the `ollama-local` marker as if it were a real token. Supersedes #69261 and #69857; refs #43945. Thanks @hyspacex, @maxramsay, and @Meli73. +- Providers/Ollama: resolve custom-named local Ollama providers such as `ollama-remote` through the Ollama synthetic-auth hook so subagents no longer miss `ollama-local` auth and silently fall back to cloud models. Fixes #43945. Thanks @Meli73 and @maxramsay. - Providers/PDF/Ollama: add bounded network timeouts for Ollama model pulls and native Anthropic/Gemini PDF analysis requests so unresponsive provider endpoints no longer hang sessions indefinitely. Fixes #54142; supersedes #54144 and #54145. Thanks @jinduwang1001-max and @arkyu2077. - Memory/doctor: treat Ollama memory embeddings as key-optional so `openclaw doctor` no longer warns about a missing API key when the gateway reports embeddings are ready. Fixes #46584. Thanks @fengly78. - Agents/Ollama: apply provider-owned replay turn normalization to native Ollama chat so Cloud models no longer reject non-alternating replay history in agent/Gateway runs. Fixes #71697. Thanks @ismael-81. diff --git a/docs/providers/ollama.md b/docs/providers/ollama.md index 49afb9affdc..cb88cfc2ffd 100644 --- a/docs/providers/ollama.md +++ b/docs/providers/ollama.md @@ -17,6 +17,8 @@ Ollama provider config uses `baseUrl` as the canonical key. OpenClaw also accept Local and LAN Ollama hosts do not need a real bearer token; OpenClaw uses the local `ollama-local` marker only for loopback, private-network, `.local`, and bare-hostname Ollama base URLs. Remote public hosts and Ollama Cloud (`https://ollama.com`) require a real credential through `OLLAMA_API_KEY`, an auth profile, or the provider's `apiKey`. +Custom provider ids that set `api: "ollama"` use the same auth rules. For example, an `ollama-remote` provider that points at a private LAN Ollama host can use `apiKey: "ollama-local"` and sub-agents will resolve that marker through the Ollama provider hook instead of treating it as a missing credential. + When Ollama is used for memory embeddings, bearer auth is scoped to the host where it was declared. A provider-level key is sent only to that provider's Ollama host; `agents.*.memorySearch.remote.apiKey` is sent only to its remote embedding host; and a pure `OLLAMA_API_KEY` env value is treated as the Ollama Cloud convention rather than being sent to local/self-hosted hosts by default. ## Getting started diff --git a/extensions/ollama/index.ts b/extensions/ollama/index.ts index 4bc708d6269..c997f989196 100644 --- a/extensions/ollama/index.ts +++ b/extensions/ollama/index.ts @@ -198,13 +198,13 @@ export default definePluginEntry({ matchesContextOverflowError: ({ errorMessage }) => /\bollama\b.*(?:context length|too many tokens|context window)/i.test(errorMessage) || /\btruncating input\b.*\btoo long\b/i.test(errorMessage), - resolveSyntheticAuth: ({ providerConfig }) => { + resolveSyntheticAuth: ({ provider, providerConfig }) => { if (!shouldUseSyntheticOllamaAuth(providerConfig)) { return undefined; } return { apiKey: OLLAMA_DEFAULT_API_KEY, - source: "models.providers.ollama (synthetic local key)", + source: `models.providers.${provider ?? OLLAMA_PROVIDER_ID} (synthetic local key)`, mode: "api-key", }; }, diff --git a/extensions/ollama/provider-discovery.ts b/extensions/ollama/provider-discovery.ts index 6cb40cee779..485d7b813ba 100644 --- a/extensions/ollama/provider-discovery.ts +++ b/extensions/ollama/provider-discovery.ts @@ -15,7 +15,7 @@ type OllamaProviderPlugin = { docsPath: string; envVars: string[]; auth: []; - resolveSyntheticAuth: (ctx: { providerConfig?: ModelProviderConfig }) => + resolveSyntheticAuth: (ctx: { provider?: string; providerConfig?: ModelProviderConfig }) => | { apiKey: string; source: string; @@ -50,13 +50,13 @@ export const ollamaProviderDiscovery: OllamaProviderPlugin = { docsPath: "/providers/ollama", envVars: ["OLLAMA_API_KEY"], auth: [], - resolveSyntheticAuth: ({ providerConfig }) => { + resolveSyntheticAuth: ({ provider, providerConfig }) => { if (!shouldUseSyntheticOllamaAuth(providerConfig)) { return undefined; } return { apiKey: OLLAMA_DEFAULT_API_KEY, - source: "models.providers.ollama (synthetic local key)", + source: `models.providers.${provider ?? OLLAMA_PROVIDER_ID} (synthetic local key)`, mode: "api-key", }; }, diff --git a/src/agents/model-auth.test.ts b/src/agents/model-auth.test.ts index 5904c165ad4..2f9506f1e51 100644 --- a/src/agents/model-auth.test.ts +++ b/src/agents/model-auth.test.ts @@ -14,7 +14,7 @@ vi.mock("../plugins/plugin-registry.js", () => ({ plugins: [ { origin: "bundled", - nonSecretAuthMarkers: ["gcp-vertex-credentials"], + nonSecretAuthMarkers: ["gcp-vertex-credentials", "ollama-local"], }, ], }), @@ -98,6 +98,16 @@ vi.mock("../plugins/provider-runtime.js", async () => { mode: "oauth" as const, }; } + if ( + params.context.providerConfig?.api === "ollama" && + params.context.providerConfig.baseUrl?.startsWith("http://192.168.") + ) { + return { + apiKey: "ollama-local", + source: `models.providers.${params.provider} (synthetic local key)`, + mode: "api-key" as const, + }; + } return undefined; }, }; @@ -867,6 +877,41 @@ describe("resolveApiKeyForProvider – synthetic local auth for custom providers ).rejects.toThrow("No API key found"); }); + it("resolves custom named Ollama providers with explicit local marker auth", async () => { + const auth = await resolveApiKeyForProvider({ + provider: "ollama-remote", + cfg: { + models: { + providers: { + "ollama-remote": { + baseUrl: "http://192.168.178.122:11434", + api: "ollama", + apiKey: "ollama-local", + models: [ + { + id: "qwen3.5:27b", + name: "Qwen 3.5 27B", + reasoning: false, + input: ["text"], + cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 }, + contextWindow: 8192, + maxTokens: 4096, + }, + ], + }, + }, + }, + }, + store: { version: 1, profiles: {} }, + }); + + expect(auth).toMatchObject({ + apiKey: "ollama-local", + source: "models.providers.ollama-remote (synthetic local key)", + mode: "api-key", + }); + }); + it("does not synthesize local auth when apiKey is explicitly configured but unresolved", async () => { const previous = process.env.OPENAI_API_KEY; delete process.env.OPENAI_API_KEY; diff --git a/src/plugins/provider-runtime.synthetic-auth-discovery.test.ts b/src/plugins/provider-runtime.synthetic-auth-discovery.test.ts index 7a0a0529e7b..c2cfe091c16 100644 --- a/src/plugins/provider-runtime.synthetic-auth-discovery.test.ts +++ b/src/plugins/provider-runtime.synthetic-auth-discovery.test.ts @@ -13,6 +13,25 @@ const resolvePluginDiscoveryProvidersRuntime = vi.hoisted(() => mode: "api-key" as const, }), }, + { + id: "ollama", + label: "Ollama", + auth: [], + resolveSyntheticAuth: ({ + provider, + providerConfig, + }: { + provider: string; + providerConfig?: { api?: string; baseUrl?: string }; + }) => + providerConfig?.api === "ollama" && providerConfig.baseUrl?.startsWith("http://10.") + ? { + apiKey: "ollama-local", + source: `models.providers.${provider} (synthetic local key)`, + mode: "api-key" as const, + } + : undefined, + }, ]), ); @@ -39,7 +58,13 @@ vi.mock("./providers.js", () => ({ resolveCatalogHookProviderPluginIds: vi.fn(() => []), resolveExternalAuthProfileCompatFallbackPluginIds: vi.fn(() => []), resolveExternalAuthProfileProviderPluginIds: vi.fn(() => []), - resolveOwningPluginIdsForProvider: vi.fn(() => ["anthropic-vertex"]), + resolveOwningPluginIdsForProvider: vi.fn(({ provider }: { provider: string }) => + provider === "ollama" + ? ["ollama"] + : provider === "anthropic-vertex" + ? ["anthropic-vertex"] + : [], + ), })); import { resolveProviderSyntheticAuthWithPlugin } from "./provider-runtime.js"; @@ -63,4 +88,26 @@ describe("resolveProviderSyntheticAuthWithPlugin", () => { expect(resolveProviderRuntimePlugin).not.toHaveBeenCalled(); expect(resolvePluginDiscoveryProvidersRuntime).toHaveBeenCalled(); }); + + it("uses the configured provider api as the synthetic-auth hook owner", () => { + expect( + resolveProviderSyntheticAuthWithPlugin({ + provider: "ollama-remote", + context: { + config: undefined, + provider: "ollama-remote", + providerConfig: { + api: "ollama", + baseUrl: "http://10.0.0.8:11434", + apiKey: "ollama-local", + models: [], + }, + }, + }), + ).toEqual({ + apiKey: "ollama-local", + source: "models.providers.ollama-remote (synthetic local key)", + mode: "api-key", + }); + }); }); diff --git a/src/plugins/provider-runtime.ts b/src/plugins/provider-runtime.ts index 4c1ed4b5d4e..d7db821653c 100644 --- a/src/plugins/provider-runtime.ts +++ b/src/plugins/provider-runtime.ts @@ -108,6 +108,19 @@ function matchesProviderPluginRef(provider: ProviderPlugin, providerId: string): ); } +function resolveProviderHookRefs(provider: string, providerConfig?: ModelProviderConfig): string[] { + const refs = [provider]; + const apiRef = normalizeOptionalString(providerConfig?.api); + if (apiRef && normalizeProviderId(apiRef) !== normalizeProviderId(provider)) { + refs.push(apiRef); + } + return [...new Set(refs)]; +} + +function matchesAnyProviderPluginRef(provider: ProviderPlugin, providerRefs: readonly string[]) { + return providerRefs.some((providerRef) => matchesProviderPluginRef(provider, providerRef)); +} + function hasExplicitProviderRuntimePluginActivation(params: { provider: string; config?: OpenClawConfig; @@ -930,13 +943,20 @@ export function resolveProviderSyntheticAuthWithPlugin(params: { env?: NodeJS.ProcessEnv; context: ProviderResolveSyntheticAuthContext; }) { - const discoveryPluginIds = - resolveOwningPluginIdsForProvider({ - provider: params.provider, - config: params.config, - workspaceDir: params.workspaceDir, - env: params.env, - }) ?? []; + const providerRefs = resolveProviderHookRefs(params.provider, params.context.providerConfig); + const discoveryPluginIds = [ + ...new Set( + providerRefs.flatMap( + (provider) => + resolveOwningPluginIdsForProvider({ + provider, + config: params.config, + workspaceDir: params.workspaceDir, + env: params.env, + }) ?? [], + ), + ), + ]; const discoveryProvider = ( discoveryPluginIds.length > 0 ? resolvePluginDiscoveryProvidersRuntime({ @@ -947,7 +967,7 @@ export function resolveProviderSyntheticAuthWithPlugin(params: { discoveryEntriesOnly: true, }) : [] - ).find((provider) => matchesProviderPluginRef(provider, params.provider)); + ).find((provider) => matchesAnyProviderPluginRef(provider, providerRefs)); if (typeof discoveryProvider?.resolveSyntheticAuth === "function") { return discoveryProvider.resolveSyntheticAuth(params.context) ?? undefined; } @@ -961,13 +981,32 @@ export function resolveProviderSyntheticAuthWithPlugin(params: { if (runtimeResolved) { return runtimeResolved; } - return resolvePluginDiscoveryProvidersRuntime({ - config: params.config, - workspaceDir: params.workspaceDir, - env: params.env, - }) - .find((provider) => provider.id === params.provider) - ?.resolveSyntheticAuth?.(params.context); + for (const providerRef of providerRefs) { + if (normalizeProviderId(providerRef) === normalizeProviderId(params.provider)) { + continue; + } + const runtimeProviderResolved = resolveProviderRuntimePlugin({ + ...params, + provider: providerRef, + applyAutoEnable: false, + bundledProviderAllowlistCompat: false, + bundledProviderVitestCompat: false, + installBundledRuntimeDeps: false, + })?.resolveSyntheticAuth?.(params.context); + if (runtimeProviderResolved) { + return runtimeProviderResolved; + } + } + if (providerRefs.length === 1) { + return resolvePluginDiscoveryProvidersRuntime({ + config: params.config, + workspaceDir: params.workspaceDir, + env: params.env, + }) + .find((provider) => matchesAnyProviderPluginRef(provider, providerRefs)) + ?.resolveSyntheticAuth?.(params.context); + } + return undefined; } export function resolveExternalAuthProfilesWithPlugins(params: { @@ -1040,10 +1079,17 @@ export function shouldDeferProviderSyntheticProfileAuthWithPlugin(params: { env?: NodeJS.ProcessEnv; context: ProviderDeferSyntheticProfileAuthContext; }) { - return ( - resolveProviderRuntimePlugin(params)?.shouldDeferSyntheticProfileAuth?.(params.context) ?? - undefined - ); + const providerRefs = resolveProviderHookRefs(params.provider, params.context.providerConfig); + for (const providerRef of providerRefs) { + const resolved = resolveProviderRuntimePlugin({ + ...params, + provider: providerRef, + })?.shouldDeferSyntheticProfileAuth?.(params.context); + if (resolved !== undefined) { + return resolved; + } + } + return undefined; } export function resolveProviderBuiltInModelSuppression(params: { From e6eea6cfe262f405b296c9f25dc4323d061db500 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 04:34:10 +0100 Subject: [PATCH 205/418] docs: clarify package acceptance npm selection --- .agents/skills/openclaw-testing/SKILL.md | 25 ++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/.agents/skills/openclaw-testing/SKILL.md b/.agents/skills/openclaw-testing/SKILL.md index 773b5cdbb22..cee6e4774e2 100644 --- a/.agents/skills/openclaw-testing/SKILL.md +++ b/.agents/skills/openclaw-testing/SKILL.md @@ -243,6 +243,31 @@ gh workflow run package-acceptance.yml --ref main \ -f suite_profile=product ``` +Npm candidate selection: + +- Resolve the registry immediately before dispatch: + `npm view openclaw dist-tags --json --prefer-online --cache /tmp/openclaw-npm-cache-verify-$$` + and `npm view openclaw@beta version dist.tarball dist.integrity --json --prefer-online --cache /tmp/openclaw-npm-cache-verify-$$`. +- If Peter asks for "latest beta", use `source=npm` with + `package_spec=openclaw@beta`, then record the resolved version from `npm view` + or the workflow summary. +- For reruns, release proof, or comparing one known package, prefer the exact + immutable spec: `package_spec=openclaw@YYYY.M.D-beta.N` or + `package_spec=openclaw@YYYY.M.D`. +- For stable package proof, use `package_spec=openclaw@latest` only when the + question is explicitly the current stable dist-tag; otherwise pin the exact + version. +- `source=npm` only accepts registry specs for `openclaw@beta`, + `openclaw@latest`, or exact OpenClaw release versions. Do not pass semver + ranges, git refs, file paths, tarball URLs, or plugin package names there. +- If the candidate is a tarball URL, use `source=url` with `package_sha256`. If + it is an Actions tarball artifact, use `source=artifact`. If it is an + unpublished source candidate, use `source=ref` with a trusted ref or SHA. +- Package acceptance tests exactly the selected package candidate. Do not apply + `openclaw update --channel beta` fallback semantics here; if `beta` is absent, + stale, older than `latest`, or points at a broken tarball, report that tag + state instead of silently testing `latest`. + Profiles: - `smoke`: quick package install/channel/agent + gateway/config lanes. From b0c70786fd6377e65b19e922f48628c4f4ea3aeb Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 04:33:36 +0100 Subject: [PATCH 206/418] fix(cron): preserve structured denial failures --- CHANGELOG.md | 2 +- docs/automation/cron-jobs.md | 2 +- docs/cli/cron.md | 9 +- .../pi-embedded-runner/failure-signal.test.ts | 95 +++++++++++++++++++ .../pi-embedded-runner/failure-signal.ts | 46 +++++++++ src/agents/pi-embedded-runner/run.ts | 10 ++ src/agents/pi-embedded-runner/types.ts | 10 ++ .../pi-embedded-subscribe.tools.test.ts | 21 ++++ src/agents/pi-embedded-subscribe.tools.ts | 73 ++++++++++---- src/cron/isolated-agent.helpers.test.ts | 45 +++++++++ src/cron/isolated-agent/helpers.ts | 71 +++++++++++--- src/cron/isolated-agent/run-executor.ts | 3 + .../isolated-agent/run.interim-retry.test.ts | 66 +++++++++++++ src/cron/isolated-agent/run.test-harness.ts | 37 ++++++-- src/cron/isolated-agent/run.ts | 4 +- 15 files changed, 450 insertions(+), 44 deletions(-) create mode 100644 src/agents/pi-embedded-runner/failure-signal.test.ts create mode 100644 src/agents/pi-embedded-runner/failure-signal.ts diff --git a/CHANGELOG.md b/CHANGELOG.md index 82b86c400cc..b7b7ea42f37 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,7 +10,7 @@ Docs: https://docs.openclaw.ai ### Fixes -- Cron: classify isolated runs as errors when final output narrates known execution-denial markers such as `SYSTEM_RUN_DENIED`, `INVALID_REQUEST`, or approval-binding refusal phrases, so blocked commands no longer appear green in cron history. Fixes #67172; carries forward #67186. Thanks @oc-gh-dr, @hclsys, and @1yihui. +- Cron: classify isolated runs as errors from structured embedded-run execution-denial metadata, with final-output marker fallback for `SYSTEM_RUN_DENIED`, `INVALID_REQUEST`, and approval-binding refusals, so blocked commands no longer appear green in cron history. Fixes #67172; carries forward #67186. Thanks @oc-gh-dr, @hclsys, and @1yihui. - Gateway/install: add a validated `--wrapper`/`OPENCLAW_WRAPPER` service install path that persists executable LaunchAgent/systemd wrappers across forced reinstalls, updates, and doctor repairs instead of falling back to raw node/bun `ProgramArguments`. Fixes #69400. (#72445) Thanks @willtmc. - macOS Gateway: write launchd services with a state-dir `WorkingDirectory`, use a durable state-dir temp path instead of freezing macOS session `TMPDIR`, create that temp directory before bootstrap, and label abort-shaped launchd exits as `SIGABRT/abort` in status output. Fixes #53679 and #70223; refs #71848. Thanks @dlturock, @stammi922, and @palladius. - Exec approvals: accept runtime-owned `source: "allow-always"` and `commandText` allowlist metadata in gateway and node approval-set payloads so Control UI round-trips no longer fail with `unexpected property 'source'`. Fixes #60000; carries forward #60064. Thanks @sd1471123, @sharkqwy, and @luoyanglang. diff --git a/docs/automation/cron-jobs.md b/docs/automation/cron-jobs.md index fcc57d630ad..19c6d2cf6a5 100644 --- a/docs/automation/cron-jobs.md +++ b/docs/automation/cron-jobs.md @@ -47,7 +47,7 @@ Cron is the Gateway's built-in scheduler. It persists jobs, wakes the agent at t - One-shot jobs (`--at`) auto-delete after success by default. - Isolated cron runs best-effort close tracked browser tabs/processes for their `cron:` session when the run completes, so detached browser automation does not leave orphaned processes behind. - Isolated cron runs also guard against stale acknowledgement replies. If the first result is just an interim status update (`on it`, `pulling everything together`, and similar hints) and no descendant subagent run is still responsible for the final answer, OpenClaw re-prompts once for the actual result before delivery. -- Isolated cron runs classify known execution-denial markers in the final summary/output as failures, including host markers such as `SYSTEM_RUN_DENIED` and `INVALID_REQUEST`, so a blocked command is not reported as a green run. +- Isolated cron runs prefer structured execution-denial metadata from the embedded run, then fall back to known final summary/output markers such as `SYSTEM_RUN_DENIED` and `INVALID_REQUEST`, so a blocked command is not reported as a green run. diff --git a/docs/cli/cron.md b/docs/cli/cron.md index 1398d95cb37..a0a11173073 100644 --- a/docs/cli/cron.md +++ b/docs/cli/cron.md @@ -57,10 +57,11 @@ Note: if an isolated cron run returns only the silent token (`NO_REPLY` / `no_reply`), cron suppresses direct outbound delivery and the fallback queued summary path as well, so nothing is posted back to chat. -Note: isolated cron runs treat known denial markers in final output, such as -`SYSTEM_RUN_DENIED`, `INVALID_REQUEST`, and approval-binding refusal phrases, as -errors. `cron list` and run history then surface the matched token in the error -reason instead of reporting a blocked command as `ok`. +Note: isolated cron runs prefer structured execution-denial metadata from the +embedded run, then fall back to known denial markers in final output, such as +`SYSTEM_RUN_DENIED`, `INVALID_REQUEST`, and approval-binding refusal phrases. +`cron list` and run history surface the denial reason instead of reporting a +blocked command as `ok`. Note: `cron add|edit --model ...` uses that selected allowed model for the job. If the model is not allowed, cron warns and falls back to the job's agent/default diff --git a/src/agents/pi-embedded-runner/failure-signal.test.ts b/src/agents/pi-embedded-runner/failure-signal.test.ts new file mode 100644 index 00000000000..25fb5c0ad50 --- /dev/null +++ b/src/agents/pi-embedded-runner/failure-signal.test.ts @@ -0,0 +1,95 @@ +import { describe, expect, it } from "vitest"; +import { resolveEmbeddedRunFailureSignal } from "./failure-signal.js"; + +describe("resolveEmbeddedRunFailureSignal", () => { + it("classifies cron exec denials from tool error metadata", () => { + expect( + resolveEmbeddedRunFailureSignal({ + trigger: "cron", + lastToolError: { + toolName: "exec", + error: "SYSTEM_RUN_DENIED: approval required", + }, + }), + ).toEqual({ + kind: "execution_denied", + source: "tool", + toolName: "exec", + code: "SYSTEM_RUN_DENIED", + message: "SYSTEM_RUN_DENIED: approval required", + fatalForCron: true, + }); + }); + + it("classifies invalid request denials from tool error metadata", () => { + expect( + resolveEmbeddedRunFailureSignal({ + trigger: "cron", + lastToolError: { + toolName: "bash", + error: "INVALID_REQUEST: approval denied", + }, + })?.code, + ).toBe("INVALID_REQUEST"); + }); + + it("does not mark non-cron runs", () => { + expect( + resolveEmbeddedRunFailureSignal({ + trigger: "user", + lastToolError: { + toolName: "exec", + error: "SYSTEM_RUN_DENIED: approval required", + }, + }), + ).toBeUndefined(); + }); + + it("does not mark ordinary tool failures as cron-denial failures", () => { + expect( + resolveEmbeddedRunFailureSignal({ + trigger: "cron", + lastToolError: { + toolName: "exec", + error: "/bin/bash: line 1: python: command not found", + }, + }), + ).toBeUndefined(); + }); + + it("does not mark non-exec validation errors as execution denials", () => { + expect( + resolveEmbeddedRunFailureSignal({ + trigger: "cron", + lastToolError: { + toolName: "browser", + error: "INVALID_REQUEST: url required", + }, + }), + ).toBeUndefined(); + }); + + it("does not mark non-exec tool output that merely mentions host denial tokens", () => { + expect( + resolveEmbeddedRunFailureSignal({ + trigger: "cron", + lastToolError: { + toolName: "web_fetch", + error: "The fetched page says SYSTEM_RUN_DENIED in its troubleshooting section.", + }, + }), + ).toBeUndefined(); + }); + + it("infers approval-binding denials even when the host code is omitted", () => { + expect( + resolveEmbeddedRunFailureSignal({ + trigger: "cron", + lastToolError: { + toolName: "exec", + error: "Approval cannot safely bind this interpreter/runtime command", + }, + })?.code, + ).toBe("SYSTEM_RUN_DENIED"); + }); +}); diff --git a/src/agents/pi-embedded-runner/failure-signal.ts b/src/agents/pi-embedded-runner/failure-signal.ts new file mode 100644 index 00000000000..30bfe3e0aa8 --- /dev/null +++ b/src/agents/pi-embedded-runner/failure-signal.ts @@ -0,0 +1,46 @@ +import { normalizeOptionalString } from "../../shared/string-coerce.js"; +import { isExecLikeToolName, type ToolErrorSummary } from "../tool-error-summary.js"; +import type { EmbeddedRunFailureSignal } from "./types.js"; + +const FAILURE_SIGNAL_CODES = ["SYSTEM_RUN_DENIED", "INVALID_REQUEST"] as const; + +function resolveFailureSignalCode(message: string): EmbeddedRunFailureSignal["code"] | undefined { + for (const code of FAILURE_SIGNAL_CODES) { + if (message.includes(code)) { + return code; + } + } + if (message.toLowerCase().includes("approval cannot safely bind")) { + return "SYSTEM_RUN_DENIED"; + } + return undefined; +} + +export function resolveEmbeddedRunFailureSignal(params: { + trigger?: string | undefined; + lastToolError?: ToolErrorSummary | undefined; +}): EmbeddedRunFailureSignal | undefined { + if (params.trigger !== "cron") { + return undefined; + } + const lastToolError = params.lastToolError; + if (!lastToolError || !isExecLikeToolName(lastToolError.toolName)) { + return undefined; + } + const message = normalizeOptionalString(lastToolError.error); + if (!message) { + return undefined; + } + const code = resolveFailureSignalCode(message); + if (!code) { + return undefined; + } + return { + kind: "execution_denied", + source: "tool", + ...(lastToolError.toolName ? { toolName: lastToolError.toolName } : {}), + code, + message, + fatalForCron: true, + }; +} diff --git a/src/agents/pi-embedded-runner/run.ts b/src/agents/pi-embedded-runner/run.ts index 4aede7500ee..3adbcc24131 100644 --- a/src/agents/pi-embedded-runner/run.ts +++ b/src/agents/pi-embedded-runner/run.ts @@ -84,6 +84,7 @@ import { redactRunIdentifier, resolveRunWorkspaceDir } from "../workspace-run.js import { runPostCompactionSideEffects } from "./compaction-hooks.js"; import { buildEmbeddedCompactionRuntimeContext } from "./compaction-runtime-context.js"; import { runContextEngineMaintenance } from "./context-engine-maintenance.js"; +import { resolveEmbeddedRunFailureSignal } from "./failure-signal.js"; import { resolveGlobalLane, resolveSessionLane } from "./lanes.js"; import { log } from "./logger.js"; import { resolveModelAsync } from "./model.js"; @@ -1853,6 +1854,10 @@ export async function runEmbeddedPiAgent( toolMetas: attempt.toolMetas, hadFailure: Boolean(attempt.lastToolError), }); + const failureSignal = resolveEmbeddedRunFailureSignal({ + trigger: params.trigger, + lastToolError: attempt.lastToolError, + }); // Timeout aborts can leave the run without any assistant payloads. // Emit an explicit timeout error instead of silently completing, so @@ -1893,6 +1898,7 @@ export async function runEmbeddedPiAgent( replayInvalid, livenessState, toolSummary: attemptToolSummary, + ...(failureSignal ? { failureSignal } : {}), agentHarnessResultClassification: attempt.agentHarnessResultClassification, }, didSendViaMessagingTool: attempt.didSendViaMessagingTool, @@ -2070,6 +2076,7 @@ export async function runEmbeddedPiAgent( replayInvalid, livenessState, toolSummary: attemptToolSummary, + ...(failureSignal ? { failureSignal } : {}), agentHarnessResultClassification: attempt.agentHarnessResultClassification, }, didSendViaMessagingTool: attempt.didSendViaMessagingTool, @@ -2119,6 +2126,7 @@ export async function runEmbeddedPiAgent( replayInvalid, livenessState, toolSummary: attemptToolSummary, + ...(failureSignal ? { failureSignal } : {}), agentHarnessResultClassification: attempt.agentHarnessResultClassification, }, didSendViaMessagingTool: attempt.didSendViaMessagingTool, @@ -2227,6 +2235,7 @@ export async function runEmbeddedPiAgent( replayInvalid, livenessState, toolSummary: attemptToolSummary, + ...(failureSignal ? { failureSignal } : {}), agentHarnessResultClassification: attempt.agentHarnessResultClassification, }, didSendViaMessagingTool: attempt.didSendViaMessagingTool, @@ -2334,6 +2343,7 @@ export async function runEmbeddedPiAgent( ...(params.blockReplyBreak ? { blockStreaming: params.blockReplyBreak } : {}), }, toolSummary: attemptToolSummary, + ...(failureSignal ? { failureSignal } : {}), completion: { ...(stopReason ? { stopReason } : {}), ...(stopReason ? { finishReason: stopReason } : {}), diff --git a/src/agents/pi-embedded-runner/types.ts b/src/agents/pi-embedded-runner/types.ts index b9dd3e73ab3..fbc25212951 100644 --- a/src/agents/pi-embedded-runner/types.ts +++ b/src/agents/pi-embedded-runner/types.ts @@ -103,6 +103,15 @@ export type ContextManagementTrace = { export type EmbeddedRunLivenessState = "working" | "paused" | "blocked" | "abandoned"; +export type EmbeddedRunFailureSignal = { + kind: "execution_denied"; + source: "tool"; + toolName?: string; + code: "SYSTEM_RUN_DENIED" | "INVALID_REQUEST"; + message: string; + fatalForCron: true; +}; + export type EmbeddedPiRunMeta = { durationMs: number; agentMeta?: EmbeddedPiAgentMeta; @@ -124,6 +133,7 @@ export type EmbeddedPiRunMeta = { | "retry_limit"; message: string; }; + failureSignal?: EmbeddedRunFailureSignal; /** Stop reason for the agent run (e.g., "completed", "tool_calls"). */ stopReason?: string; /** Pending tool calls when stopReason is "tool_calls". */ diff --git a/src/agents/pi-embedded-subscribe.tools.test.ts b/src/agents/pi-embedded-subscribe.tools.test.ts index 2ab5a09738a..6407e23360a 100644 --- a/src/agents/pi-embedded-subscribe.tools.test.ts +++ b/src/agents/pi-embedded-subscribe.tools.test.ts @@ -12,4 +12,25 @@ describe("extractToolErrorMessage", () => { expect(extractToolErrorMessage({ details: { status: "failed" } })).toBe("failed"); expect(extractToolErrorMessage({ details: { status: "timeout" } })).toBe("timeout"); }); + + it("prefers node-host aggregated denial text over generic failed status", () => { + expect( + extractToolErrorMessage({ + content: [{ type: "text", text: "SYSTEM_RUN_DENIED: approval required" }], + details: { + status: "failed", + aggregated: "SYSTEM_RUN_DENIED: approval required", + }, + }), + ).toBe("SYSTEM_RUN_DENIED: approval required"); + }); + + it("uses result text before generic failed status when details omit aggregated output", () => { + expect( + extractToolErrorMessage({ + content: [{ type: "text", text: "SYSTEM_RUN_DENIED: approval required" }], + details: { status: "failed" }, + }), + ).toBe("SYSTEM_RUN_DENIED: approval required"); + }); }); diff --git a/src/agents/pi-embedded-subscribe.tools.ts b/src/agents/pi-embedded-subscribe.tools.ts index e796b24321a..ebe91ecf0e9 100644 --- a/src/agents/pi-embedded-subscribe.tools.ts +++ b/src/agents/pi-embedded-subscribe.tools.ts @@ -75,10 +75,7 @@ function extractErrorField(value: unknown): string | undefined { return undefined; } const record = value as Record; - const direct = - readErrorCandidate(record.error) ?? - readErrorCandidate(record.message) ?? - readErrorCandidate(record.reason); + const direct = extractDirectErrorField(record); if (direct) { return direct; } @@ -89,6 +86,34 @@ function extractErrorField(value: unknown): string | undefined { return normalizeToolErrorText(status); } +function extractDirectErrorField(value: unknown): string | undefined { + if (!value || typeof value !== "object") { + return undefined; + } + const record = value as Record; + return ( + readErrorCandidate(record.error) ?? + readErrorCandidate(record.message) ?? + readErrorCandidate(record.reason) + ); +} + +function extractAggregatedErrorField(value: unknown): string | undefined { + if (!value || typeof value !== "object") { + return undefined; + } + const record = value as Record; + return readErrorCandidate(record.aggregated); +} + +function isHostDenialToolText(text: string): boolean { + const normalized = text.trim(); + if (normalized.includes("SYSTEM_RUN_DENIED") || normalized.includes("INVALID_REQUEST")) { + return true; + } + return normalized.toLowerCase().includes("approval cannot safely bind"); +} + export function sanitizeToolResult(result: unknown): unknown { if (!result || typeof result !== "object") { return result; @@ -388,28 +413,42 @@ export function extractToolErrorMessage(result: unknown): string | undefined { return undefined; } const record = result as Record; - const fromDetails = extractErrorField(record.details); + const fromDetails = extractDirectErrorField(record.details); if (fromDetails) { return fromDetails; } - const fromRoot = extractErrorField(record); + const fromDetailsAggregated = extractAggregatedErrorField(record.details); + if (fromDetailsAggregated) { + return fromDetailsAggregated; + } + const fromRoot = extractDirectErrorField(record); if (fromRoot) { return fromRoot; } const text = extractToolResultText(result); - if (!text) { - return undefined; - } - try { - const parsed = JSON.parse(text) as unknown; - const fromJson = extractErrorField(parsed); - if (fromJson) { - return fromJson; + if (text) { + try { + const parsed = JSON.parse(text) as unknown; + const fromJson = extractErrorField(parsed); + if (fromJson) { + return fromJson; + } + } catch { + // Fall through to status/text fallback. + } + if (isHostDenialToolText(text)) { + return normalizeToolErrorText(text); } - } catch { - // Fall through to first-line text fallback. } - return normalizeToolErrorText(text); + const fromDetailsStatus = extractErrorField(record.details); + if (fromDetailsStatus) { + return fromDetailsStatus; + } + const fromRootStatus = extractErrorField(record); + if (fromRootStatus) { + return fromRootStatus; + } + return text ? normalizeToolErrorText(text) : undefined; } function resolveMessageToolTarget(args: Record): string | undefined { diff --git a/src/cron/isolated-agent.helpers.test.ts b/src/cron/isolated-agent.helpers.test.ts index 4f8e1fe217c..876ebe59d0f 100644 --- a/src/cron/isolated-agent.helpers.test.ts +++ b/src/cron/isolated-agent.helpers.test.ts @@ -190,6 +190,51 @@ describe("resolveCronPayloadOutcome", () => { ); }); + it("prefers typed failure signals over denial-token fallback", () => { + const result = resolveCronPayloadOutcome({ + payloads: [{ text: "On it, retrying now." }], + failureSignal: { + kind: "execution_denied", + source: "tool", + toolName: "exec", + code: "SYSTEM_RUN_DENIED", + message: "SYSTEM_RUN_DENIED: approval required", + fatalForCron: true, + }, + }); + + expect(result.hasFatalErrorPayload).toBe(true); + expect(result.embeddedRunError).toBe( + "cron classifier: execution_denied failure from exec (SYSTEM_RUN_DENIED): SYSTEM_RUN_DENIED: approval required", + ); + expect(result.summary).toBe("SYSTEM_RUN_DENIED: approval required"); + expect(result.outputText).toBe("SYSTEM_RUN_DENIED: approval required"); + expect(result.synthesizedText).toBe("SYSTEM_RUN_DENIED: approval required"); + expect(result.deliveryPayload).toEqual({ + text: "SYSTEM_RUN_DENIED: approval required", + isError: true, + }); + expect(result.deliveryPayloads).toEqual([ + { text: "SYSTEM_RUN_DENIED: approval required", isError: true }, + ]); + expect(result.deliveryPayloadHasStructuredContent).toBe(false); + }); + + it("ignores non-fatal failure signal metadata", () => { + const result = resolveCronPayloadOutcome({ + payloads: [{ text: "ordinary success" }], + failureSignal: { + kind: "execution_denied", + source: "tool", + message: "SYSTEM_RUN_DENIED: approval required", + fatalForCron: false, + }, + }); + + expect(result.hasFatalErrorPayload).toBe(false); + expect(result.embeddedRunError).toBeUndefined(); + }); + it("keeps structured error payload reasons ahead of denial-token reasons", () => { const result = resolveCronPayloadOutcome({ payloads: [ diff --git a/src/cron/isolated-agent/helpers.ts b/src/cron/isolated-agent/helpers.ts index 08d8a8b30b5..3901f53a00c 100644 --- a/src/cron/isolated-agent/helpers.ts +++ b/src/cron/isolated-agent/helpers.ts @@ -26,6 +26,20 @@ type CronDenialSignal = { field: string; }; +type CronFailureSignal = { + kind?: string; + source?: string; + toolName?: string; + code?: string; + message?: string; + fatalForCron?: boolean; +}; + +type NormalizedCronFailureSignal = CronFailureSignal & { + message: string; + fatalForCron: true; +}; + const CRON_DENIAL_EXACT_TOKENS = ["SYSTEM_RUN_DENIED", "INVALID_REQUEST"] as const; const CRON_DENIAL_CASE_INSENSITIVE_TOKENS = [ "approval cannot safely bind", @@ -75,6 +89,25 @@ function formatCronDenialSignal(signal: CronDenialSignal): string { return `cron classifier: denial token "${signal.token}" detected in ${signal.field}`; } +function normalizeCronFailureSignal( + signal: CronFailureSignal | undefined, +): NormalizedCronFailureSignal | undefined { + const message = normalizeOptionalString(signal?.message); + if (signal?.fatalForCron !== true || !message) { + return undefined; + } + return { ...signal, message, fatalForCron: true }; +} + +function formatCronFailureSignal(signal: NormalizedCronFailureSignal): string { + const kind = normalizeOptionalString(signal.kind) ?? "run"; + const code = normalizeOptionalString(signal.code); + const source = normalizeOptionalString(signal.toolName) ?? normalizeOptionalString(signal.source); + return `cron classifier: ${kind} failure${source ? ` from ${source}` : ""}${ + code ? ` (${code})` : "" + }: ${signal.message}`; +} + export function pickSummaryFromOutput(text: string | undefined) { const clean = (text ?? "").trim(); if (!clean) { @@ -191,7 +224,8 @@ export function resolveHeartbeatAckMaxChars(agentCfg?: { heartbeat?: { ackMaxCha export function resolveCronPayloadOutcome(params: { payloads: DeliveryPayload[]; runLevelError?: unknown; - finalAssistantVisibleText?: string; + failureSignal?: CronFailureSignal | undefined; + finalAssistantVisibleText?: string | undefined; preferFinalAssistantVisibleText?: boolean; }): CronPayloadOutcome { const firstText = params.payloads[0]?.text ?? ""; @@ -254,19 +288,34 @@ export function resolveCronPayloadOutcome(params: { text: payload?.text, })), ]); - const hasFatalErrorPayload = hasFatalStructuredErrorPayload || denialSignal !== undefined; + const failureSignal = normalizeCronFailureSignal(params.failureSignal); + const hasFatalErrorPayload = + hasFatalStructuredErrorPayload || failureSignal !== undefined || denialSignal !== undefined; + const shouldUseFailureSignalPayload = + failureSignal !== undefined && !hasFatalStructuredErrorPayload; + const failureSignalDeliveryPayload = shouldUseFailureSignalPayload + ? ({ text: failureSignal.message, isError: true } satisfies DeliveryPayload) + : undefined; return { - summary, - outputText, - synthesizedText, - deliveryPayload, - deliveryPayloads: resolvedDeliveryPayloads, - deliveryPayloadHasStructuredContent, + summary: shouldUseFailureSignalPayload + ? (pickSummaryFromOutput(failureSignal.message) ?? summary) + : summary, + outputText: shouldUseFailureSignalPayload ? failureSignal.message : outputText, + synthesizedText: shouldUseFailureSignalPayload ? failureSignal.message : synthesizedText, + deliveryPayload: failureSignalDeliveryPayload ?? deliveryPayload, + deliveryPayloads: failureSignalDeliveryPayload + ? [failureSignalDeliveryPayload] + : resolvedDeliveryPayloads, + deliveryPayloadHasStructuredContent: failureSignalDeliveryPayload + ? false + : deliveryPayloadHasStructuredContent, hasFatalErrorPayload, embeddedRunError: hasFatalStructuredErrorPayload ? (lastErrorPayloadText ?? "cron isolated run returned an error payload") - : denialSignal - ? formatCronDenialSignal(denialSignal) - : undefined, + : failureSignal + ? formatCronFailureSignal(failureSignal) + : denialSignal + ? formatCronDenialSignal(denialSignal) + : undefined, }; } diff --git a/src/cron/isolated-agent/run-executor.ts b/src/cron/isolated-agent/run-executor.ts index 18e48796eb4..bbcc1d5ba79 100644 --- a/src/cron/isolated-agent/run-executor.ts +++ b/src/cron/isolated-agent/run-executor.ts @@ -359,10 +359,12 @@ export async function executeCronRun(params: { const interimPayloads = runResult.payloads ?? []; const { deliveryPayloadHasStructuredContent: interimPayloadHasStructuredContent, + hasFatalErrorPayload: interimHasFatalErrorPayload, outputText: interimOutputText, } = resolveCronPayloadOutcome({ payloads: interimPayloads, runLevelError: runResult.meta?.error, + failureSignal: runResult.meta?.failureSignal, finalAssistantVisibleText: runResult.meta?.finalAssistantVisibleText, preferFinalAssistantVisibleText: ( await resolveCronChannelOutputPolicy(params.resolvedDelivery.channel) @@ -371,6 +373,7 @@ export async function executeCronRun(params: { const interimText = interimOutputText?.trim() ?? ""; const shouldRetryInterimAck = !runResult.meta?.error && + !interimHasFatalErrorPayload && !runResult.didSendViaMessagingTool && !interimPayloadHasStructuredContent && !interimPayloads.some((payload) => payload?.isError === true) && diff --git a/src/cron/isolated-agent/run.interim-retry.test.ts b/src/cron/isolated-agent/run.interim-retry.test.ts index 2c799869a44..b4c75fd3c0d 100644 --- a/src/cron/isolated-agent/run.interim-retry.test.ts +++ b/src/cron/isolated-agent/run.interim-retry.test.ts @@ -5,10 +5,13 @@ import { } from "./run.suite-helpers.js"; import { countActiveDescendantRunsMock, + dispatchCronDeliveryMock, + isHeartbeatOnlyResponseMock, listDescendantRunsForRequesterMock, loadRunCronIsolatedAgentTurn, mockRunCronFallbackPassthrough, pickLastNonEmptyTextFromPayloadsMock, + resolveCronDeliveryPlanMock, runEmbeddedPiAgentMock, runWithModelFallbackMock, } from "./run.test-harness.js"; @@ -74,6 +77,69 @@ describe("runCronIsolatedAgentTurn — interim ack retry", () => { await runTurnAndExpectOk(1, 1); }); + it("does not retry over a fatal structured failure signal", async () => { + usePayloadTextExtraction(); + runEmbeddedPiAgentMock.mockResolvedValueOnce({ + payloads: [{ text: "On it, retrying now." }], + meta: { + agentMeta: { usage: { input: 10, output: 20 } }, + failureSignal: { + kind: "execution_denied", + source: "tool", + toolName: "exec", + code: "SYSTEM_RUN_DENIED", + message: "SYSTEM_RUN_DENIED: approval required", + fatalForCron: true, + }, + }, + }); + + mockRunCronFallbackPassthrough(); + const result = await runCronIsolatedAgentTurn(makeIsolatedAgentTurnParams()); + + expect(result.status).toBe("error"); + expect(result.error).toBe("SYSTEM_RUN_DENIED: approval required"); + expect(runWithModelFallbackMock).toHaveBeenCalledTimes(1); + expect(runEmbeddedPiAgentMock).toHaveBeenCalledTimes(1); + }); + + it("delivers synthesized fatal failure signals even when the original payloads are empty", async () => { + usePayloadTextExtraction(); + resolveCronDeliveryPlanMock.mockReturnValue({ + requested: true, + mode: "announce", + channel: "messagechat", + to: "123", + }); + isHeartbeatOnlyResponseMock.mockReturnValue(true); + runEmbeddedPiAgentMock.mockResolvedValueOnce({ + payloads: [], + meta: { + agentMeta: { usage: { input: 10, output: 20 } }, + failureSignal: { + kind: "execution_denied", + source: "tool", + toolName: "exec", + code: "SYSTEM_RUN_DENIED", + message: "SYSTEM_RUN_DENIED: approval required", + fatalForCron: true, + }, + }, + }); + + mockRunCronFallbackPassthrough(); + const result = await runCronIsolatedAgentTurn(makeIsolatedAgentTurnParams()); + + expect(result.status).toBe("error"); + expect(result.error).toBe("SYSTEM_RUN_DENIED: approval required"); + expect(dispatchCronDeliveryMock).toHaveBeenCalledWith( + expect.objectContaining({ + skipHeartbeatDelivery: false, + deliveryPayloads: [{ text: "SYSTEM_RUN_DENIED: approval required", isError: true }], + }), + ); + }); + it("does not retry when descendants were spawned in this run even if they already settled", async () => { usePayloadTextExtraction(); runEmbeddedPiAgentMock.mockResolvedValueOnce({ diff --git a/src/cron/isolated-agent/run.test-harness.ts b/src/cron/isolated-agent/run.test-harness.ts index 44cc62b5ece..747727c3ecf 100644 --- a/src/cron/isolated-agent/run.test-harness.ts +++ b/src/cron/isolated-agent/run.test-harness.ts @@ -362,21 +362,40 @@ function resetRunOutcomeMocks(): void { pickLastNonEmptyTextFromPayloadsMock.mockReturnValue("test output"); resolveCronPayloadOutcomeMock.mockReset(); resolveCronPayloadOutcomeMock.mockImplementation( - ({ payloads }: { payloads: Array<{ isError?: boolean }> }) => { - const outputText = pickLastNonEmptyTextFromPayloadsMock(payloads); + ({ + payloads, + failureSignal, + }: { + payloads: Array<{ isError?: boolean }>; + failureSignal?: { fatalForCron?: boolean; message?: string }; + }) => { + const failureMessage = + failureSignal?.fatalForCron === true + ? (failureSignal.message ?? "cron isolated run returned a fatal failure signal") + : undefined; + const outputText = failureMessage ?? pickLastNonEmptyTextFromPayloadsMock(payloads); const synthesizedText = outputText?.trim() || "summary"; - const hasFatalErrorPayload = payloads.some((payload) => payload?.isError === true); + const hasFatalErrorPayload = + payloads.some((payload) => payload?.isError === true) || failureMessage !== undefined; + const deliveryPayload = failureMessage ? { text: failureMessage, isError: true } : undefined; return { - summary: "summary", + summary: failureMessage ?? "summary", outputText, synthesizedText, - deliveryPayload: undefined, - deliveryPayloads: synthesizedText ? [{ text: synthesizedText }] : [], + deliveryPayload, + deliveryPayloads: deliveryPayload + ? [deliveryPayload] + : synthesizedText + ? [{ text: synthesizedText }] + : [], deliveryPayloadHasStructuredContent: false, hasFatalErrorPayload, - embeddedRunError: hasFatalErrorPayload - ? "cron isolated run returned an error payload" - : undefined, + embeddedRunError: + failureMessage !== undefined + ? failureMessage + : hasFatalErrorPayload + ? "cron isolated run returned an error payload" + : undefined, }; }, ); diff --git a/src/cron/isolated-agent/run.ts b/src/cron/isolated-agent/run.ts index 577d0544493..b1a3bdd80d9 100644 --- a/src/cron/isolated-agent/run.ts +++ b/src/cron/isolated-agent/run.ts @@ -839,6 +839,7 @@ async function finalizeCronRun(params: { } = resolveCronPayloadOutcome({ payloads, runLevelError: finalRunResult.meta?.error, + failureSignal: finalRunResult.meta?.failureSignal, finalAssistantVisibleText: finalRunResult.meta?.finalAssistantVisibleText, preferFinalAssistantVisibleText: ( await resolveCronChannelOutputPolicy(prepared.resolvedDelivery.channel) @@ -864,7 +865,8 @@ async function finalizeCronRun(params: { const skipHeartbeatDelivery = prepared.deliveryRequested && - isHeartbeatOnlyResponse(payloads, resolveHeartbeatAckMaxChars(prepared.agentCfg)); + !hasFatalErrorPayload && + isHeartbeatOnlyResponse(deliveryPayloads, resolveHeartbeatAckMaxChars(prepared.agentCfg)); const { dispatchCronDelivery, matchesMessagingToolDeliveryTarget, From 831f03b8140f8ab9c2fa1ee4d9313d9e4eb34aec Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 20:32:28 -0700 Subject: [PATCH 207/418] fix(cli): speed up gateway status config reads --- CHANGELOG.md | 1 + src/cli/daemon-cli/status.gather.test.ts | 49 +++++++ src/cli/daemon-cli/status.gather.ts | 162 +++++++++++++++++------ 3 files changed, 169 insertions(+), 43 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index b7b7ea42f37..068f5bd27fd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -18,6 +18,7 @@ Docs: https://docs.openclaw.ai - Exec/node: synthesize a local approval plan when a paired node advertises `system.run` without `system.run.prepare`, unblocking approval-required `host=node` exec on current macOS companion nodes while preserving remote prepare for node hosts that support it. Fixes #37591 and duplicate #66839; carries forward #69725. Thanks @soloclz. - Memory/QMD: prefer QMD's `--mask` collection pattern flag so root memory indexing stays scoped to `MEMORY.md` instead of widening to every markdown file in the workspace. Thanks @codex. - Gateway/memory: defer QMD startup for implicit non-default agents and scope memory runtime loading to the selected memory slot so Gateway boot and first memory recall avoid broad plugin runtime fanout. Thanks @vincentkoc. +- CLI/Gateway: use a parse-only config snapshot for plain `gateway status` reads and reuse same-path service config context so status no longer spends tens of seconds in full config validation before printing. Thanks @vincentkoc. - Lobster/Gateway: memoize repeated Ajv schema compilation before loading the embedded Lobster runtime so scheduled workflows and `llm.invoke` loops stop growing gateway heap on content-identical schemas. Fixes #71148. Thanks @cmi525, @vsolaz, and @vincentkoc. - Codex harness: normalize cached input tokens before session/context accounting so prompt cache reads are not double-counted in `/status`, `session_status`, or persisted `sessionEntry.totalTokens`. Fixes #69298. Thanks @richardmqq. - Hooks/session-memory: use the host local timezone for memory filenames, fallback timestamp slugs, and markdown headers instead of UTC dates. Fixes #46703. (#46721) Thanks @Astro-Han. diff --git a/src/cli/daemon-cli/status.gather.test.ts b/src/cli/daemon-cli/status.gather.test.ts index b562f417f2c..f8b404ac425 100644 --- a/src/cli/daemon-cli/status.gather.test.ts +++ b/src/cli/daemon-cli/status.gather.test.ts @@ -1,3 +1,6 @@ +import fs from "node:fs/promises"; +import os from "node:os"; +import path from "node:path"; import { afterEach, beforeEach, describe, expect, it, vi } from "vitest"; import { createMockGatewayService } from "../../daemon/service.test-helpers.js"; import { captureEnv } from "../../test-utils/env.js"; @@ -340,6 +343,52 @@ describe("gatherDaemonStatus", () => { }); }); + it("uses the fast config path for plain same-file status reads", async () => { + const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "openclaw-status-config-")); + const configPath = path.join(tmp, "openclaw.json"); + await fs.writeFile( + configPath, + JSON.stringify({ + gateway: { + bind: "custom", + customBindHost: "10.0.0.5", + controlUi: { enabled: true }, + }, + }), + ); + process.env.OPENCLAW_STATE_DIR = tmp; + process.env.OPENCLAW_CONFIG_PATH = configPath; + serviceReadCommand.mockResolvedValueOnce({ + programArguments: ["/bin/node", "cli", "gateway", "--port", "19001"], + environment: { + OPENCLAW_STATE_DIR: tmp, + OPENCLAW_CONFIG_PATH: configPath, + }, + }); + + try { + const status = await gatherDaemonStatus({ + rpc: {}, + probe: false, + deep: false, + }); + + expect(readConfigFileSnapshotCalls).not.toHaveBeenCalled(); + expect(loadConfigCalls).not.toHaveBeenCalled(); + expect(status.config?.cli).toMatchObject({ + path: configPath, + exists: true, + valid: true, + controlUi: { enabled: true }, + }); + expect(status.config?.daemon).toBe(status.config?.cli); + expect(status.gateway?.bindMode).toBe("custom"); + expect(status.gateway?.customBindHost).toBe("10.0.0.5"); + } finally { + await fs.rm(tmp, { recursive: true, force: true }); + } + }); + it("resolves daemon gateway auth password SecretRef values before probing", async () => { daemonLoadedConfig = { gateway: { diff --git a/src/cli/daemon-cli/status.gather.ts b/src/cli/daemon-cli/status.gather.ts index b695956f5c4..173929cfcaf 100644 --- a/src/cli/daemon-cli/status.gather.ts +++ b/src/cli/daemon-cli/status.gather.ts @@ -1,3 +1,5 @@ +import fs from "node:fs/promises"; +import JSON5 from "json5"; import { createConfigIO, resolveConfigPath, @@ -66,6 +68,12 @@ type DaemonConfigContext = { configMismatch: boolean; }; +type StatusConfigRead = { + summary: ConfigSummary; + cfg: OpenClawConfig; + mode: "fast" | "full"; +}; + type ResolvedGatewayStatus = { gateway: GatewayStatusSummary; daemonPort: number; @@ -119,6 +127,104 @@ function resolveSnapshotRuntimeConfig(snapshot: ConfigFileSnapshot | null): Open return snapshot.runtimeConfig; } +function coerceStatusConfig(value: unknown): OpenClawConfig { + if (!value || typeof value !== "object" || Array.isArray(value)) { + return {}; + } + return value as OpenClawConfig; +} + +function hasOwnKey(value: unknown, key: string): boolean { + return Boolean( + value && + typeof value === "object" && + !Array.isArray(value) && + Object.prototype.hasOwnProperty.call(value, key), + ); +} + +function needsFullStatusConfigRead(raw: string, parsed: unknown): boolean { + return raw.includes("$include") || raw.includes("${") || hasOwnKey(parsed, "env"); +} + +async function readFastStatusConfig(configPath: string): Promise { + let raw: string; + try { + raw = await fs.readFile(configPath, "utf8"); + } catch { + return null; + } + + let parsed: unknown; + try { + parsed = JSON5.parse(raw); + } catch (err) { + return { + summary: { + path: configPath, + exists: true, + valid: false, + issues: [{ path: "", message: `JSON5 parse failed: ${String(err)}` }], + }, + cfg: {}, + mode: "fast", + }; + } + + if (needsFullStatusConfigRead(raw, parsed)) { + return null; + } + + const cfg = coerceStatusConfig(parsed); + return { + summary: { + path: configPath, + exists: true, + valid: true, + controlUi: cfg.gateway?.controlUi, + }, + cfg, + mode: "fast", + }; +} + +async function readFullStatusConfig(params: { + env: NodeJS.ProcessEnv; + configPath: string; +}): Promise { + const io = createConfigIO({ + env: params.env, + configPath: params.configPath, + pluginValidation: "skip", + }); + const snapshot = await io.readConfigFileSnapshot().catch(() => null); + const cfg = resolveSnapshotRuntimeConfig(snapshot) ?? io.loadConfig(); + return { + summary: { + path: snapshot?.path ?? params.configPath, + exists: snapshot?.exists ?? false, + valid: snapshot?.valid ?? true, + ...(snapshot?.issues?.length ? { issues: snapshot.issues } : {}), + controlUi: cfg.gateway?.controlUi, + }, + cfg, + mode: "full", + }; +} + +async function readStatusConfig(params: { + env: NodeJS.ProcessEnv; + configPath: string; +}): Promise { + return ( + (await readFastStatusConfig(params.configPath)) ?? + (await readFullStatusConfig({ + env: params.env, + configPath: params.configPath, + })) + ); +} + function appendProbeNote( existing: string | undefined, extra: string | undefined, @@ -207,57 +313,27 @@ async function loadDaemonConfigContext( mergedDaemonEnv as NodeJS.ProcessEnv, resolveStateDir(mergedDaemonEnv as NodeJS.ProcessEnv), ); - - const cliIO = createConfigIO({ + const sameConfigPath = cliConfigPath === daemonConfigPath; + const cliConfigRead = await readStatusConfig({ env: process.env, configPath: cliConfigPath, - pluginValidation: "skip", }); - const sharesDaemonConfigContext = !serviceEnv && cliConfigPath === daemonConfigPath; - const daemonIO = sharesDaemonConfigContext - ? cliIO - : createConfigIO({ - env: mergedDaemonEnv, + const sharesDaemonConfigContext = + sameConfigPath && (cliConfigRead.mode === "fast" || !serviceEnv); + const daemonConfigRead = sharesDaemonConfigContext + ? cliConfigRead + : await readStatusConfig({ + env: mergedDaemonEnv as NodeJS.ProcessEnv, configPath: daemonConfigPath, - pluginValidation: "skip", }); - const cliSnapshotPromise = cliIO.readConfigFileSnapshot().catch(() => null); - const daemonSnapshotPromise = sharesDaemonConfigContext - ? cliSnapshotPromise - : daemonIO.readConfigFileSnapshot().catch(() => null); - const [cliSnapshot, daemonSnapshot] = await Promise.all([ - cliSnapshotPromise, - daemonSnapshotPromise, - ]); - const cliCfg = resolveSnapshotRuntimeConfig(cliSnapshot) ?? cliIO.loadConfig(); - const daemonCfg = - sharesDaemonConfigContext && cliSnapshot === daemonSnapshot - ? cliCfg - : (resolveSnapshotRuntimeConfig(daemonSnapshot) ?? daemonIO.loadConfig()); - - const cliConfigSummary: ConfigSummary = { - path: cliSnapshot?.path ?? cliConfigPath, - exists: cliSnapshot?.exists ?? false, - valid: cliSnapshot?.valid ?? true, - ...(cliSnapshot?.issues?.length ? { issues: cliSnapshot.issues } : {}), - controlUi: cliCfg.gateway?.controlUi, - }; - const daemonConfigSummary: ConfigSummary = { - path: daemonSnapshot?.path ?? daemonConfigPath, - exists: daemonSnapshot?.exists ?? false, - valid: daemonSnapshot?.valid ?? true, - ...(daemonSnapshot?.issues?.length ? { issues: daemonSnapshot.issues } : {}), - controlUi: daemonCfg.gateway?.controlUi, - }; - return { mergedDaemonEnv, - cliCfg, - daemonCfg, - cliConfigSummary, - daemonConfigSummary, - configMismatch: cliConfigSummary.path !== daemonConfigSummary.path, + cliCfg: cliConfigRead.cfg, + daemonCfg: daemonConfigRead.cfg, + cliConfigSummary: cliConfigRead.summary, + daemonConfigSummary: daemonConfigRead.summary, + configMismatch: cliConfigRead.summary.path !== daemonConfigRead.summary.path, }; } From 6a7980e984903e1092cbfff6f037365b5bebb4e4 Mon Sep 17 00:00:00 2001 From: Ayaan Zaidi Date: Mon, 27 Apr 2026 09:04:49 +0530 Subject: [PATCH 208/418] fix(doctor): migrate legacy OpenAI provider api --- .../doctor-legacy-config.migrations.test.ts | 34 ++++++++ .../legacy-config-compatibility-base.ts | 2 + .../shared/legacy-config-core-normalizers.ts | 78 ++++++++++++++++++- 3 files changed, 111 insertions(+), 3 deletions(-) diff --git a/src/commands/doctor-legacy-config.migrations.test.ts b/src/commands/doctor-legacy-config.migrations.test.ts index 9894c753e0f..77299be60c0 100644 --- a/src/commands/doctor-legacy-config.migrations.test.ts +++ b/src/commands/doctor-legacy-config.migrations.test.ts @@ -342,6 +342,40 @@ describe("normalizeCompatibilityConfigValues", () => { ); }); + it("migrates legacy OpenAI provider api values to OpenAI completions", () => { + const res = normalizeCompatibilityConfigValues({ + models: { + providers: { + openrouter: { + baseUrl: "https://openrouter.ai/api/v1", + api: "openai", + models: [ + { + id: "openai/gpt-4o-mini", + name: "OpenRouter GPT-4o Mini", + api: "openai", + reasoning: false, + input: ["text"], + cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 }, + contextWindow: 128_000, + maxTokens: 16_384, + }, + ], + }, + }, + }, + } as unknown as OpenClawConfig); + + expect(res.config.models?.providers?.openrouter?.api).toBe("openai-completions"); + expect(res.config.models?.providers?.openrouter?.models?.[0]?.api).toBe("openai-completions"); + expect(res.changes).toContain( + 'Moved models.providers.openrouter.api "openai" → "openai-completions".', + ); + expect(res.changes).toContain( + 'Moved models.providers.openrouter.models[0].api "openai" → "openai-completions".', + ); + }); + it("marks legacy untagged /models add OpenAI Codex metadata rows for doctor repair", () => { const res = normalizeCompatibilityConfigValues({ models: { diff --git a/src/commands/doctor/shared/legacy-config-compatibility-base.ts b/src/commands/doctor/shared/legacy-config-compatibility-base.ts index c0464f84bb4..c6cd288753d 100644 --- a/src/commands/doctor/shared/legacy-config-compatibility-base.ts +++ b/src/commands/doctor/shared/legacy-config-compatibility-base.ts @@ -4,6 +4,7 @@ import { normalizeLegacyCrossContextMessageConfig, normalizeLegacyMediaProviderOptions, normalizeLegacyMistralModelMaxTokens, + normalizeLegacyOpenAIModelProviderApi, normalizeLegacyRuntimeModelRefs, normalizeLegacyNanoBananaSkill, normalizeLegacyTalkConfig, @@ -37,6 +38,7 @@ export function normalizeBaseCompatibilityConfigValues( next = normalizeLegacyNanoBananaSkill(next, changes); next = normalizeLegacyTalkConfig(next, changes); + next = normalizeLegacyOpenAIModelProviderApi(next, changes); next = normalizeLegacyRuntimeModelRefs(next, changes); next = normalizeLegacyCrossContextMessageConfig(next, changes); next = normalizeLegacyMediaProviderOptions(next, changes); diff --git a/src/commands/doctor/shared/legacy-config-core-normalizers.ts b/src/commands/doctor/shared/legacy-config-core-normalizers.ts index a576e58d7f6..cc4b287ed81 100644 --- a/src/commands/doctor/shared/legacy-config-core-normalizers.ts +++ b/src/commands/doctor/shared/legacy-config-core-normalizers.ts @@ -390,9 +390,10 @@ export function normalizeLegacyOpenAICodexModelsAddMetadata( return cfg; } + const rawProviders: Record = rawModels.providers; let providersChanged = false; - const nextProviders = { ...rawModels.providers }; - for (const [providerId, rawProvider] of Object.entries(rawModels.providers)) { + const nextProviders: Record = { ...rawProviders }; + for (const [providerId, rawProvider] of Object.entries(rawProviders)) { if (normalizeProviderId(providerId) !== "openai-codex" || !isRecord(rawProvider)) { continue; } @@ -413,7 +414,7 @@ export function normalizeLegacyOpenAICodexModelsAddMetadata( ) { providerChanged = true; const safeProviderId = sanitizeForLog(providerId); - const safeModelId = sanitizeForLog(model.id); + const safeModelId = sanitizeForLog(normalizeOptionalString(model.id) ?? "unknown"); changes.push( `Marked models.providers.${safeProviderId}.models.${safeModelId} as /models add metadata so official OpenAI Codex metadata can override it.`, ); @@ -446,6 +447,77 @@ export function normalizeLegacyOpenAICodexModelsAddMetadata( }; } +export function normalizeLegacyOpenAIModelProviderApi( + cfg: OpenClawConfig, + changes: string[], +): OpenClawConfig { + const rawModels = cfg.models; + if (!isRecord(rawModels) || !isRecord(rawModels.providers)) { + return cfg; + } + + const rawProviders: Record = rawModels.providers; + let providersChanged = false; + const nextProviders: Record = { ...rawProviders }; + for (const [providerId, rawProvider] of Object.entries(rawProviders)) { + if (!isRecord(rawProvider)) { + continue; + } + + let providerChanged = false; + const nextProvider: Record = { ...rawProvider }; + if (nextProvider.api === "openai") { + nextProvider.api = "openai-completions"; + providerChanged = true; + changes.push( + `Moved models.providers.${sanitizeForLog(providerId)}.api "openai" → "openai-completions".`, + ); + } + + const rawProviderModels = rawProvider.models; + if (Array.isArray(rawProviderModels)) { + let modelsChanged = false; + const nextModels: unknown[] = []; + rawProviderModels.forEach((model, index) => { + if (!isRecord(model) || model.api !== "openai") { + nextModels.push(model); + return; + } + modelsChanged = true; + changes.push( + `Moved models.providers.${sanitizeForLog(providerId)}.models[${index}].api "openai" → "openai-completions".`, + ); + nextModels.push({ + ...model, + api: "openai-completions", + }); + }); + if (modelsChanged) { + nextProvider.models = nextModels; + providerChanged = true; + } + } + + if (!providerChanged) { + continue; + } + nextProviders[providerId] = nextProvider; + providersChanged = true; + } + + if (!providersChanged) { + return cfg; + } + + return { + ...cfg, + models: { + ...rawModels, + providers: nextProviders as NonNullable["providers"], + }, + }; +} + export function normalizeLegacyNanoBananaSkill( cfg: OpenClawConfig, changes: string[], From 147f4f50f5d1c0407dd7b8df83d6a1b3a29f683d Mon Sep 17 00:00:00 2001 From: Ayaan Zaidi Date: Mon, 27 Apr 2026 09:04:50 +0530 Subject: [PATCH 209/418] fix(gateway): skip stale model provider api entries --- .../server-startup-config.recovery.test.ts | 77 +++++++++++ src/gateway/server-startup-config.ts | 126 +++++++++++++++++- src/gateway/server.impl.ts | 1 + 3 files changed, 198 insertions(+), 6 deletions(-) diff --git a/src/gateway/server-startup-config.recovery.test.ts b/src/gateway/server-startup-config.recovery.test.ts index 8d0ea271a0f..7a6e32ead90 100644 --- a/src/gateway/server-startup-config.recovery.test.ts +++ b/src/gateway/server-startup-config.recovery.test.ts @@ -18,6 +18,11 @@ vi.mock("../config/config.js", () => ({ snapshot.issues.every((issue) => issue.path.startsWith("plugins.entries.")) ); }), + validateConfigObjectWithPlugins: vi.fn((config: OpenClawConfig) => ({ + ok: true, + config, + warnings: [], + })), writeConfigFile: vi.fn(), })); @@ -176,6 +181,78 @@ describe("gateway startup config recovery", () => { expect(recoveryNotice.enqueueConfigRecoveryNotice).not.toHaveBeenCalled(); }); + it("skips providers with stale model api enum values during startup", async () => { + const config = { + gateway: { mode: "local" }, + models: { + providers: { + openrouter: { + baseUrl: "https://openrouter.ai/api/v1", + api: "openai", + models: [ + { + id: "openai/gpt-4o-mini", + name: "OpenRouter GPT-4o Mini", + api: "openai", + reasoning: false, + input: ["text"], + cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 }, + contextWindow: 128_000, + maxTokens: 16_384, + }, + ], + }, + anthropic: { + baseUrl: "https://api.anthropic.com", + api: "anthropic-messages", + models: [], + }, + }, + }, + } as unknown as OpenClawConfig; + const invalidSnapshot = buildTestConfigSnapshot({ + path: configPath, + exists: true, + raw: `${JSON.stringify(config)}\n`, + parsed: config, + valid: false, + config, + issues: [ + { + path: "models.providers.openrouter.api", + message: + 'Invalid option: expected one of "openai-completions"|"openai-responses"|"openai-codex-responses"|"anthropic-messages"|"google-generative-ai"|"github-copilot"|"bedrock-converse-stream"|"ollama"|"azure-openai-responses"', + }, + { + path: "models.providers.openrouter.models.0.api", + message: + 'Invalid option: expected one of "openai-completions"|"openai-responses"|"openai-codex-responses"|"anthropic-messages"|"google-generative-ai"|"github-copilot"|"bedrock-converse-stream"|"ollama"|"azure-openai-responses"', + }, + ], + legacyIssues: [], + }); + vi.mocked(configIo.readConfigFileSnapshot).mockResolvedValueOnce(invalidSnapshot); + const log = { info: vi.fn(), warn: vi.fn() }; + + const result = await loadGatewayStartupConfigSnapshot({ + minimalTestGateway: false, + log, + }); + + expect(result.wroteConfig).toBe(false); + expect(result.degradedProviderApi).toBe(true); + expect(result.snapshot.valid).toBe(true); + expect(result.snapshot.sourceConfig.models?.providers?.openrouter).toBeUndefined(); + expect(result.snapshot.sourceConfig.models?.providers?.anthropic).toEqual( + config.models?.providers?.anthropic, + ); + expect(configIo.recoverConfigFromLastKnownGood).not.toHaveBeenCalled(); + expect(configIo.writeConfigFile).not.toHaveBeenCalled(); + expect(log.warn).toHaveBeenCalledWith( + 'gateway: skipped model provider openrouter; configured provider api is invalid. Run "openclaw doctor --fix" to repair the config.', + ); + }); + it("strips a valid JSON suffix when last-known-good recovery is unavailable", async () => { const invalidSnapshot = buildSnapshot({ valid: false, diff --git a/src/gateway/server-startup-config.ts b/src/gateway/server-startup-config.ts index 3e7574e9090..4fd3c5dc544 100644 --- a/src/gateway/server-startup-config.ts +++ b/src/gateway/server-startup-config.ts @@ -10,9 +10,11 @@ import { recoverConfigFromLastKnownGood, recoverConfigFromJsonRootSuffix, shouldAttemptLastKnownGoodRecovery, + validateConfigObjectWithPlugins, writeConfigFile, } from "../config/config.js"; import { formatConfigIssueLines } from "../config/issue-format.js"; +import { asResolvedSourceConfig, materializeRuntimeConfig } from "../config/materialize.js"; import { applyPluginAutoEnable } from "../config/plugin-auto-enable.js"; import { isTruthyEnvValue } from "../infra/env.js"; import { @@ -56,20 +58,122 @@ type GatewayStartupConfigOverrides = { export type GatewayStartupConfigSnapshotLoadResult = { snapshot: ConfigFileSnapshot; wroteConfig: boolean; + degradedProviderApi?: boolean; }; +const MODEL_PROVIDER_API_PATH_RE = /^models\.providers\.([^.]+)\.api$/; +const MODEL_PROVIDER_MODEL_API_PATH_RE = /^models\.providers\.([^.]+)\.models\.\d+\.api$/; + +function resolveInvalidModelProviderApiIssueProviderId(issue: { + path: string; + message: string; +}): string | null { + if (!issue.message.startsWith("Invalid option:")) { + return null; + } + const providerMatch = + issue.path.match(MODEL_PROVIDER_API_PATH_RE) ?? + issue.path.match(MODEL_PROVIDER_MODEL_API_PATH_RE); + return providerMatch?.[1] ?? null; +} + +function cloneConfigWithoutModelProviders( + config: OpenClawConfig, + providerIds: ReadonlySet, +): OpenClawConfig { + const providers = config.models?.providers; + if (!providers) { + return config; + } + let changed = false; + const nextProviders = { ...providers }; + for (const providerId of providerIds) { + if (!Object.hasOwn(nextProviders, providerId)) { + continue; + } + delete nextProviders[providerId]; + changed = true; + } + if (!changed) { + return config; + } + return { + ...config, + models: { + ...config.models, + providers: nextProviders, + }, + }; +} + +function resolveGatewayStartupConfigWithoutInvalidModelProviders(params: { + snapshot: ConfigFileSnapshot; + log: GatewayStartupLog; +}): ConfigFileSnapshot | null { + if (params.snapshot.valid || params.snapshot.legacyIssues.length > 0) { + return null; + } + const providerIds = new Set(); + for (const issue of params.snapshot.issues) { + const providerId = resolveInvalidModelProviderApiIssueProviderId(issue); + if (!providerId) { + return null; + } + providerIds.add(providerId); + } + if (providerIds.size === 0) { + return null; + } + + const prunedSourceConfig = cloneConfigWithoutModelProviders( + params.snapshot.sourceConfig, + providerIds, + ); + const validated = validateConfigObjectWithPlugins(prunedSourceConfig); + if (!validated.ok) { + return null; + } + const runtimeConfig = materializeRuntimeConfig(validated.config, "load"); + for (const providerId of providerIds) { + params.log.warn( + `gateway: skipped model provider ${providerId}; configured provider api is invalid. Run "openclaw doctor --fix" to repair the config.`, + ); + } + return { + ...params.snapshot, + sourceConfig: asResolvedSourceConfig(validated.config), + resolved: asResolvedSourceConfig(validated.config), + valid: true, + runtimeConfig, + config: runtimeConfig, + issues: [], + warnings: validated.warnings, + }; +} + export async function loadGatewayStartupConfigSnapshot(params: { minimalTestGateway: boolean; log: GatewayStartupLog; }): Promise { let configSnapshot = await readConfigFileSnapshot(); let wroteConfig = false; + let degradedStartupConfig = false; if (configSnapshot.legacyIssues.length > 0 && isNixMode) { throw new Error( "Legacy config entries detected while running in Nix mode. Update your Nix config to the latest schema and restart.", ); } if (configSnapshot.exists) { + if (!configSnapshot.valid) { + const providerApiPrunedSnapshot = resolveGatewayStartupConfigWithoutInvalidModelProviders({ + snapshot: configSnapshot, + log: params.log, + }); + if (providerApiPrunedSnapshot) { + degradedStartupConfig = true; + configSnapshot = providerApiPrunedSnapshot; + } + } if (!configSnapshot.valid) { const canRecoverFromLastKnownGood = shouldAttemptLastKnownGoodRecovery(configSnapshot); const recovered = canRecoverFromLastKnownGood @@ -109,11 +213,16 @@ export async function loadGatewayStartupConfigSnapshot(params: { assertValidGatewayStartupConfigSnapshot(configSnapshot, { includeDoctorHint: true }); } - const autoEnable = params.minimalTestGateway - ? { config: configSnapshot.config, changes: [] as string[] } - : applyPluginAutoEnable({ config: configSnapshot.config, env: process.env }); + const autoEnable = + params.minimalTestGateway || degradedStartupConfig + ? { config: configSnapshot.config, changes: [] as string[] } + : applyPluginAutoEnable({ config: configSnapshot.config, env: process.env }); if (autoEnable.changes.length === 0) { - return { snapshot: configSnapshot, wroteConfig }; + return { + snapshot: configSnapshot, + wroteConfig, + ...(degradedStartupConfig ? { degradedProviderApi: true } : {}), + }; } try { @@ -128,7 +237,11 @@ export async function loadGatewayStartupConfigSnapshot(params: { params.log.warn(`gateway: failed to persist plugin auto-enable changes: ${String(err)}`); } - return { snapshot: configSnapshot, wroteConfig }; + return { + snapshot: configSnapshot, + wroteConfig, + ...(degradedStartupConfig ? { degradedProviderApi: true } : {}), + }; } export function createRuntimeSecretsActivator(params: { @@ -226,6 +339,7 @@ export async function prepareGatewayStartupConfig(params: { authOverride?: GatewayAuthConfig; tailscaleOverride?: GatewayTailscaleConfig; activateRuntimeSecrets: ActivateRuntimeSecrets; + persistStartupAuth?: boolean; }): Promise>> { assertValidGatewayStartupConfigSnapshot(params.configSnapshot); @@ -262,7 +376,7 @@ export async function prepareGatewayStartupConfig(params: { env: process.env, authOverride: preflightAuthOverride, tailscaleOverride: params.tailscaleOverride, - persist: true, + persist: params.persistStartupAuth ?? true, baseHash: params.configSnapshot.hash, }); const runtimeStartupConfig = applyGatewayAuthOverridesForStartupPreflight(authBootstrap.cfg, { diff --git a/src/gateway/server.impl.ts b/src/gateway/server.impl.ts index d8837ca76af..525c957c39e 100644 --- a/src/gateway/server.impl.ts +++ b/src/gateway/server.impl.ts @@ -296,6 +296,7 @@ export async function startGatewayServer( authOverride: opts.auth, tailscaleOverride: opts.tailscale, activateRuntimeSecrets, + persistStartupAuth: startupConfigLoad.degradedProviderApi !== true, }), ); cfgAtStart = authBootstrap.cfg; From 34f81c6a8a525a11aa0dce3f6707296afe3e0e4a Mon Sep 17 00:00:00 2001 From: Ayaan Zaidi Date: Mon, 27 Apr 2026 09:04:51 +0530 Subject: [PATCH 210/418] docs(changelog): note model provider api recovery --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 068f5bd27fd..cf5999054b7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -72,6 +72,7 @@ Docs: https://docs.openclaw.ai - Plugins/memory-lancedb: request float embedding responses from OpenAI-compatible servers so local providers that default SDK requests to base64 no longer return dimension-mismatched LanceDB vectors while preserving configured dimensions. Fixes #45982. (#59048, #46069, #45986) Thanks @deep-introspection, @xiaokhkh, @caicongyang, and @thiswind. - Plugins/memory-core: respect configured memory-search embedding concurrency during non-batch indexing so local Ollama embedding backends can serialize indexing instead of flooding the server. Fixes #66822. (#66931) Thanks @oliviareid-svg and @LyraInTheFlesh. - Docker/update smoke: keep the package-derived update-channel fixture on package-shipped files and make its UI build stub create the asset the updater verifies. Thanks @vincentkoc. +- Gateway/models: repair legacy `models.providers.*.api = "openai"` config values to `openai-completions`, and skip providers with future stale API enum values during startup instead of bricking the gateway. Fixes #72477. (#72542) Thanks @JooyoungChoi14 and @obviyus. ## 2026.4.26 From 02d266c6c4be828d08a469b54ce66514e3a9e51e Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 04:39:19 +0100 Subject: [PATCH 211/418] ci: split package acceptance refs --- .agents/skills/blacksmith-testbox/SKILL.md | 8 + .agents/skills/openclaw-testing/SKILL.md | 37 +++- .github/workflows/full-release-validation.yml | 2 +- .github/workflows/openclaw-release-checks.yml | 54 +++++ .github/workflows/package-acceptance.yml | 81 +++++++- docs/ci.md | 24 ++- docs/help/testing.md | 1 + docs/reference/RELEASING.md | 14 +- scripts/package-openclaw-for-docker.mjs | 52 +++-- .../resolve-openclaw-package-candidate.mjs | 195 +++++++++++++++--- .../package-acceptance-workflow.test.ts | 15 ++ ...resolve-openclaw-package-candidate.test.ts | 3 + 12 files changed, 407 insertions(+), 79 deletions(-) diff --git a/.agents/skills/blacksmith-testbox/SKILL.md b/.agents/skills/blacksmith-testbox/SKILL.md index cb9bf0b2602..ef53f45c78b 100644 --- a/.agents/skills/blacksmith-testbox/SKILL.md +++ b/.agents/skills/blacksmith-testbox/SKILL.md @@ -93,6 +93,14 @@ Only use Testbox in OpenClaw when the user explicitly wants CI-parity or the check truly depends on remote secrets/services that the local repo loop cannot provide. +For installable-package product proof, prefer the GitHub `Package Acceptance` +workflow over an ad hoc Testbox command. It resolves one package candidate +(`source=npm`, `source=ref`, `source=url`, or `source=artifact`), uploads it as +`package-under-test`, and runs the reusable Docker E2E lanes against that exact +tarball on GitHub/Blacksmith runners. Use `workflow_ref` for the trusted +workflow/harness code and `package_ref` for the source ref to pack when testing +an older trusted branch, tag, or SHA. + ## Setup: Warmup before coding If you decided Testbox is actually warranted, warm one up early. This returns diff --git a/.agents/skills/openclaw-testing/SKILL.md b/.agents/skills/openclaw-testing/SKILL.md index cee6e4774e2..cba803168e3 100644 --- a/.agents/skills/openclaw-testing/SKILL.md +++ b/.agents/skills/openclaw-testing/SKILL.md @@ -239,6 +239,7 @@ Good defaults: ```bash gh workflow run package-acceptance.yml --ref main \ -f source=npm \ + -f workflow_ref=main \ -f package_spec=openclaw@beta \ -f suite_profile=product ``` @@ -270,20 +271,46 @@ Npm candidate selection: Profiles: -- `smoke`: quick package install/channel/agent + gateway/config lanes. -- `package`: package, update, and plugin lanes; no OpenWebUI. -- `product`: package profile plus MCP channels, cron/subagent cleanup, OpenAI - web search, and OpenWebUI. +- `smoke`: quick confidence that the tarball installs, can onboard a channel, + can run an agent turn, and basic gateway/config lanes work. +- `package`: release-package contract. Adds installer/update, doctor install + switching, bundled plugin runtime deps, plugin install/update, and package + repair lanes. This is the default native replacement for most Parallels + package/update coverage. +- `product`: package profile plus broader product surfaces: MCP channels, + cron/subagent cleanup, OpenAI web search, and OpenWebUI. - `full`: Docker release-path chunks with OpenWebUI. - `custom`: exact `docker_lanes` list for a focused rerun. Candidate sources: - `source=npm`: `openclaw@beta`, `openclaw@latest`, or an exact release version. -- `source=ref`: pack the trusted ref in the workflow. +- `source=ref`: pack `package_ref` using the trusted `workflow_ref` harness. + This intentionally separates old package commits from new workflow/test code. - `source=url`: HTTPS `.tgz` plus required `package_sha256`. - `source=artifact`: download one `.tgz` from `artifact_run_id`/`artifact_name`. +Ref model: + +- `gh workflow run ... --ref ` selects the workflow file revision + GitHub executes. +- `workflow_ref` is the trusted harness/script ref passed to reusable Docker + E2E. +- `package_ref` is the source ref to build when `source=ref`. It can be an + older branch/tag/SHA as long as it is reachable from an OpenClaw branch or + release tag. + +Example: run latest package acceptance harness against an older trusted commit: + +```bash +gh workflow run package-acceptance.yml --ref main \ + -f workflow_ref=main \ + -f source=ref \ + -f package_ref= \ + -f suite_profile=package \ + -f telegram_mode=none +``` + Use `telegram_mode=mock-openai` or `telegram_mode=live-frontier` only with `source=npm`; that path reuses the published npm Telegram E2E workflow and the `qa-live-shared` environment. diff --git a/.github/workflows/full-release-validation.yml b/.github/workflows/full-release-validation.yml index 4a514a12d51..d8d1e461817 100644 --- a/.github/workflows/full-release-validation.yml +++ b/.github/workflows/full-release-validation.yml @@ -96,7 +96,7 @@ jobs: echo "- Target SHA: \`${TARGET_SHA}\`" echo "- Child workflow ref: \`${WORKFLOW_REF}\`" echo "- Normal CI: \`CI\` with \`target_ref=${TARGET_REF}\`" - echo "- Release/live/Docker/QA: \`OpenClaw Release Checks\`" + echo "- Release/live/Docker/package/QA: \`OpenClaw Release Checks\`" if [[ -n "${NPM_TELEGRAM_PACKAGE_SPEC// }" ]]; then echo "- Post-publish Telegram E2E: \`${NPM_TELEGRAM_PACKAGE_SPEC}\`" else diff --git a/.github/workflows/openclaw-release-checks.yml b/.github/workflows/openclaw-release-checks.yml index c5203a6552f..bcd0974125a 100644 --- a/.github/workflows/openclaw-release-checks.yml +++ b/.github/workflows/openclaw-release-checks.yml @@ -214,6 +214,23 @@ jobs: OPENCLAW_GEMINI_SETTINGS_JSON: ${{ secrets.OPENCLAW_GEMINI_SETTINGS_JSON }} FIREWORKS_API_KEY: ${{ secrets.FIREWORKS_API_KEY }} + package_acceptance_release_checks: + name: Run package acceptance + needs: [resolve_target] + permissions: + actions: read + contents: read + packages: write + pull-requests: read + uses: ./.github/workflows/package-acceptance.yml + with: + workflow_ref: ${{ github.ref_name }} + source: ref + package_ref: ${{ needs.resolve_target.outputs.ref }} + suite_profile: package + telegram_mode: none + secrets: inherit + qa_lab_parity_release_checks: name: Run QA Lab parity gate needs: [resolve_target] @@ -441,3 +458,40 @@ jobs: path: ${{ steps.run_lane.outputs.output_dir }} retention-days: 14 if-no-files-found: warn + + summary: + name: Verify release checks + needs: + - install_smoke_release_checks + - cross_os_release_checks + - live_and_e2e_release_checks + - package_acceptance_release_checks + - qa_lab_parity_release_checks + - qa_live_matrix_release_checks + - qa_live_telegram_release_checks + if: always() + runs-on: ubuntu-24.04 + timeout-minutes: 5 + steps: + - name: Verify release check results + shell: bash + run: | + set -euo pipefail + failed=0 + for item in \ + "install_smoke_release_checks=${{ needs.install_smoke_release_checks.result }}" \ + "cross_os_release_checks=${{ needs.cross_os_release_checks.result }}" \ + "live_and_e2e_release_checks=${{ needs.live_and_e2e_release_checks.result }}" \ + "package_acceptance_release_checks=${{ needs.package_acceptance_release_checks.result }}" \ + "qa_lab_parity_release_checks=${{ needs.qa_lab_parity_release_checks.result }}" \ + "qa_live_matrix_release_checks=${{ needs.qa_live_matrix_release_checks.result }}" \ + "qa_live_telegram_release_checks=${{ needs.qa_live_telegram_release_checks.result }}" + do + name="${item%%=*}" + result="${item#*=}" + if [[ "$result" != "success" && "$result" != "skipped" ]]; then + echo "::error::${name} ended with ${result}" + failed=1 + fi + done + exit "$failed" diff --git a/.github/workflows/package-acceptance.yml b/.github/workflows/package-acceptance.yml index 09d96e50492..6116973ed05 100644 --- a/.github/workflows/package-acceptance.yml +++ b/.github/workflows/package-acceptance.yml @@ -3,6 +3,11 @@ name: Package Acceptance on: workflow_dispatch: inputs: + workflow_ref: + description: Trusted repo ref for workflow scripts and Docker E2E harness + required: true + default: main + type: string source: description: Package candidate source required: true @@ -13,8 +18,8 @@ on: - ref - url - artifact - ref: - description: Trusted repo ref for workflow scripts, or package source when source=ref + package_ref: + description: Trusted package source ref when source=ref required: true default: main type: string @@ -68,6 +73,62 @@ on: - none - mock-openai - live-frontier + workflow_call: + inputs: + workflow_ref: + description: Trusted repo ref for workflow scripts and Docker E2E harness + required: false + default: main + type: string + source: + description: "Package candidate source: npm, ref, url, or artifact" + required: true + type: string + package_ref: + description: Trusted package source ref when source=ref + required: false + default: main + type: string + package_spec: + description: Published package spec when source=npm + required: false + default: openclaw@beta + type: string + package_url: + description: HTTPS .tgz URL when source=url + required: false + default: "" + type: string + package_sha256: + description: Expected package SHA-256; required for source=url + required: false + default: "" + type: string + artifact_run_id: + description: GitHub Actions run id when source=artifact + required: false + default: "" + type: string + artifact_name: + description: Artifact name containing one .tgz when source=artifact + required: false + default: package-under-test + type: string + suite_profile: + description: "Acceptance profile: smoke, package, product, full, or custom" + required: false + default: package + type: string + docker_lanes: + description: Comma/space separated Docker lanes when suite_profile=custom + required: false + default: "" + type: string + telegram_mode: + description: Optional published-npm Telegram QA lane + required: false + default: none + type: string permissions: actions: read @@ -104,8 +165,8 @@ jobs: - name: Checkout package workflow ref uses: actions/checkout@v6 with: - ref: ${{ inputs.ref }} - fetch-depth: 1 + ref: ${{ inputs.workflow_ref }} + fetch-depth: 0 - name: Setup Node environment uses: ./.github/actions/setup-node-env @@ -113,7 +174,7 @@ jobs: node-version: ${{ env.NODE_VERSION }} pnpm-version: ${{ env.PNPM_VERSION }} install-bun: ${{ inputs.source == 'ref' && 'true' || 'false' }} - install-deps: ${{ inputs.source == 'ref' && 'true' || 'false' }} + install-deps: "false" - name: Download package artifact input if: inputs.source == 'artifact' @@ -139,6 +200,7 @@ jobs: id: resolve env: SOURCE: ${{ inputs.source }} + PACKAGE_REF: ${{ inputs.package_ref }} PACKAGE_SPEC: ${{ inputs.package_spec }} PACKAGE_URL: ${{ inputs.package_url }} PACKAGE_SHA256: ${{ inputs.package_sha256 }} @@ -152,6 +214,7 @@ jobs: node scripts/resolve-openclaw-package-candidate.mjs \ --source "$SOURCE" \ + --package-ref "$PACKAGE_REF" \ --package-spec "$PACKAGE_SPEC" \ --package-url "$PACKAGE_URL" \ --package-sha256 "$PACKAGE_SHA256" \ @@ -241,14 +304,20 @@ jobs: env: PACKAGE_SHA256: ${{ steps.resolve.outputs.sha256 }} PACKAGE_VERSION: ${{ steps.resolve.outputs.package_version }} + PACKAGE_REF: ${{ inputs.package_ref }} SOURCE: ${{ inputs.source }} SUITE_PROFILE: ${{ inputs.suite_profile }} + WORKFLOW_REF: ${{ inputs.workflow_ref }} shell: bash run: | { echo "## Package acceptance" echo echo "- Source: \`${SOURCE}\`" + echo "- Workflow ref: \`${WORKFLOW_REF}\`" + if [[ "${SOURCE}" == "ref" ]]; then + echo "- Package ref: \`${PACKAGE_REF}\`" + fi echo "- Version: \`${PACKAGE_VERSION}\`" echo "- SHA-256: \`${PACKAGE_SHA256}\`" echo "- Profile: \`${SUITE_PROFILE}\`" @@ -259,7 +328,7 @@ jobs: needs: resolve_package uses: ./.github/workflows/openclaw-live-and-e2e-checks-reusable.yml with: - ref: ${{ inputs.ref }} + ref: ${{ inputs.workflow_ref }} include_repo_e2e: false include_release_path_suites: ${{ needs.resolve_package.outputs.include_release_path_suites == 'true' }} include_openwebui: ${{ needs.resolve_package.outputs.include_openwebui == 'true' }} diff --git a/docs/ci.md b/docs/ci.md index 44f645bd65a..bdf13ad82f1 100644 --- a/docs/ci.md +++ b/docs/ci.md @@ -11,18 +11,20 @@ The CI runs on every push to `main` and every pull request. It uses smart scopin `Full Release Validation` is the manual umbrella workflow for "run everything before release." It accepts a branch, tag, or full commit SHA, dispatches the manual `CI` workflow with that target, and dispatches `OpenClaw Release Checks` -for install smoke, Docker release-path suites, live/E2E, OpenWebUI, QA Lab -parity, Matrix, and Telegram lanes. It can also run the post-publish `NPM -Telegram Beta E2E` workflow when a published package spec is provided. +for install smoke, package acceptance, Docker release-path suites, live/E2E, +OpenWebUI, QA Lab parity, Matrix, and Telegram lanes. It can also run the +post-publish `NPM Telegram Beta E2E` workflow when a published package spec is +provided. `Package Acceptance` is the side-run workflow for validating a package artifact -without blocking the release workflow. It resolves one candidate from a trusted -ref, a published npm spec, an HTTPS tarball URL with SHA-256, or a tarball -artifact from another GitHub Actions run, uploads it as `package-under-test`, -then reuses the Docker release/E2E scheduler with that tarball instead of -packing the selected ref. Profiles cover smoke, package, product, full, and -custom Docker lane selections. The optional Telegram lane is published-npm only -and reuses the `NPM Telegram Beta E2E` workflow. +without blocking the release workflow. It resolves one candidate from a +published npm spec, a trusted `package_ref` built with the selected +`workflow_ref` harness, an HTTPS tarball URL with SHA-256, or a tarball artifact +from another GitHub Actions run, uploads it as `package-under-test`, then reuses +the Docker release/E2E scheduler with that tarball instead of repacking the +workflow checkout. Profiles cover smoke, package, product, full, and custom +Docker lane selections. The optional Telegram lane is published-npm only and +reuses the `NPM Telegram Beta E2E` workflow. QA Lab has dedicated CI lanes outside the main smart-scoped workflow. The `Parity gate` workflow runs on matching PR changes and manual dispatch; it @@ -125,7 +127,7 @@ act as if every scoped area changed. CI workflow edits validate the Node CI graph plus workflow linting, but do not force Windows, Android, or macOS native builds by themselves; those platform lanes stay scoped to platform source changes. CI routing-only edits, selected cheap core-test fixture edits, and narrow plugin contract helper/test-routing edits use a fast Node-only manifest path: preflight, security, and a single `checks-fast-core` task. That path avoids build artifacts, Node 22 compatibility, channel contracts, full core shards, bundled-plugin shards, and additional guard matrices when the changed files are limited to the routing or helper surfaces that the fast task exercises directly. Windows Node checks are scoped to Windows-specific process/path wrappers, npm/pnpm/UI runner helpers, package manager config, and the CI workflow surfaces that execute that lane; unrelated source, plugin, install-smoke, and test-only changes stay on the Linux Node lanes so they do not reserve a 16-vCPU Windows worker for coverage that is already exercised by the normal test shards. -The separate `install-smoke` workflow reuses the same scope script through its own `preflight` job. It splits smoke coverage into `run_fast_install_smoke` and `run_full_install_smoke`. Pull requests run the fast path for Docker/package surfaces, bundled plugin package/manifest changes, and core plugin/channel/gateway/Plugin SDK surfaces that the Docker smoke jobs exercise. Source-only bundled plugin changes, test-only edits, and docs-only edits do not reserve Docker workers. The fast path builds the root Dockerfile image once, checks the CLI, runs the agents delete shared-workspace CLI smoke, runs the container gateway-network e2e, verifies a bundled extension build arg, and runs the bounded bundled-plugin Docker profile under a 240-second aggregate command timeout with each scenario's Docker run capped separately. The full path keeps QR package install and installer Docker/update coverage for nightly scheduled runs, manual dispatches, workflow-call release checks, and pull requests that truly touch installer/package/Docker surfaces. `main` pushes, including merge commits, do not force the full path; when changed-scope logic would request full coverage on a push, the workflow keeps the fast Docker smoke and leaves the full install smoke to nightly or release validation. The slow Bun global install image-provider smoke is separately gated by `run_bun_global_install_smoke`; it runs on the nightly schedule and from the release checks workflow, and manual `install-smoke` dispatches can opt into it, but pull requests and `main` pushes do not run it. QR and installer Docker tests keep their own install-focused Dockerfiles. Local `test:docker:all` prebuilds one shared live-test image, packs OpenClaw once as an npm tarball, and builds two shared `scripts/e2e/Dockerfile` images: a bare Node/Git runner for installer/update/plugin-dependency lanes and a functional image that installs the same tarball into `/app` for normal functionality lanes. Docker lane definitions live in `scripts/lib/docker-e2e-scenarios.mjs`, planner logic lives in `scripts/lib/docker-e2e-plan.mjs`, and the runner only executes the selected plan. The scheduler selects the image per lane with `OPENCLAW_DOCKER_E2E_BARE_IMAGE` and `OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE`, then runs lanes with `OPENCLAW_SKIP_DOCKER_BUILD=1`; tune the default main-pool slot count of 10 with `OPENCLAW_DOCKER_ALL_PARALLELISM` and the provider-sensitive tail-pool slot count of 10 with `OPENCLAW_DOCKER_ALL_TAIL_PARALLELISM`. Heavy lane caps default to `OPENCLAW_DOCKER_ALL_LIVE_LIMIT=9`, `OPENCLAW_DOCKER_ALL_NPM_LIMIT=10`, and `OPENCLAW_DOCKER_ALL_SERVICE_LIMIT=7` so npm install and multi-service lanes do not overcommit Docker while lighter lanes still fill available slots. Lane starts are staggered by 2 seconds by default to avoid local Docker daemon create storms; override with `OPENCLAW_DOCKER_ALL_START_STAGGER_MS=0` or another millisecond value. The local aggregate preflights Docker, removes stale OpenClaw E2E containers, emits active-lane status, persists lane timings for longest-first ordering, and supports `OPENCLAW_DOCKER_ALL_DRY_RUN=1` for scheduler inspection. It stops scheduling new pooled lanes after the first failure by default, and each lane has a 120-minute fallback timeout overrideable with `OPENCLAW_DOCKER_ALL_LANE_TIMEOUT_MS`; selected live/tail lanes use tighter per-lane caps. `OPENCLAW_DOCKER_ALL_LANES=` runs exact scheduler lanes, including release-only lanes such as `install-e2e` and split bundled update lanes such as `bundled-channel-update-acpx`, while skipping the cleanup smoke so agents can reproduce one failed lane. The reusable live/E2E workflow asks `scripts/test-docker-all.mjs --plan-json` which package, image kind, live image, lane, and credential coverage is required, then `scripts/docker-e2e.mjs` converts that plan into GitHub outputs and summaries. It either packs OpenClaw through `scripts/package-openclaw-for-docker.mjs` or downloads a caller-provided package artifact, validates the tarball inventory, builds and pushes package-digest-tagged bare/functional GHCR Docker E2E images when the plan needs package-installed lanes, and reuses those images when the same package digest has already been prepared. The release-path Docker suite runs as at most three chunked jobs with `OPENCLAW_SKIP_DOCKER_BUILD=1` so each chunk pulls only the image kind it needs and executes multiple lanes through the same weighted scheduler (`OPENCLAW_DOCKER_ALL_PROFILE=release-path`, `OPENCLAW_DOCKER_ALL_CHUNK=core|package-update|plugins-integrations`). Each chunk uploads `.artifacts/docker-tests/` with lane logs, timings, `summary.json`, `failures.json`, phase timings, scheduler plan JSON, and per-lane rerun commands. The workflow `docker_lanes` input runs selected lanes against the prepared images instead of the three chunk jobs, which keeps failed-lane debugging bounded to one targeted Docker job and prepares or downloads the package artifact for that run; if a selected lane is a live Docker lane, the targeted job builds the live-test image locally for that rerun. Use `pnpm test:docker:rerun ` to download Docker artifacts from a GitHub run and print combined/per-lane targeted rerun commands; use `pnpm test:docker:timings ` for slow-lane and phase critical-path summaries. When Open WebUI is requested with the release-path suite, it runs inside the plugins/integrations chunk instead of reserving a fourth Docker worker; Open WebUI keeps a standalone job only for openwebui-only dispatches. The scheduled live/E2E workflow runs the full release-path Docker suite daily. The bundled update matrix is split by update target so repeated npm update and doctor repair passes can shard with other bundled checks. +The separate `install-smoke` workflow reuses the same scope script through its own `preflight` job. It splits smoke coverage into `run_fast_install_smoke` and `run_full_install_smoke`. Pull requests run the fast path for Docker/package surfaces, bundled plugin package/manifest changes, and core plugin/channel/gateway/Plugin SDK surfaces that the Docker smoke jobs exercise. Source-only bundled plugin changes, test-only edits, and docs-only edits do not reserve Docker workers. The fast path builds the root Dockerfile image once, checks the CLI, runs the agents delete shared-workspace CLI smoke, runs the container gateway-network e2e, verifies a bundled extension build arg, and runs the bounded bundled-plugin Docker profile under a 240-second aggregate command timeout with each scenario's Docker run capped separately. The full path keeps QR package install and installer Docker/update coverage for nightly scheduled runs, manual dispatches, workflow-call release checks, and pull requests that truly touch installer/package/Docker surfaces. `main` pushes, including merge commits, do not force the full path; when changed-scope logic would request full coverage on a push, the workflow keeps the fast Docker smoke and leaves the full install smoke to nightly or release validation. The slow Bun global install image-provider smoke is separately gated by `run_bun_global_install_smoke`; it runs on the nightly schedule and from the release checks workflow, and manual `install-smoke` dispatches can opt into it, but pull requests and `main` pushes do not run it. QR and installer Docker tests keep their own install-focused Dockerfiles. Local `test:docker:all` prebuilds one shared live-test image, packs OpenClaw once as an npm tarball, and builds two shared `scripts/e2e/Dockerfile` images: a bare Node/Git runner for installer/update/plugin-dependency lanes and a functional image that installs the same tarball into `/app` for normal functionality lanes. Docker lane definitions live in `scripts/lib/docker-e2e-scenarios.mjs`, planner logic lives in `scripts/lib/docker-e2e-plan.mjs`, and the runner only executes the selected plan. The scheduler selects the image per lane with `OPENCLAW_DOCKER_E2E_BARE_IMAGE` and `OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE`, then runs lanes with `OPENCLAW_SKIP_DOCKER_BUILD=1`; tune the default main-pool slot count of 10 with `OPENCLAW_DOCKER_ALL_PARALLELISM` and the provider-sensitive tail-pool slot count of 10 with `OPENCLAW_DOCKER_ALL_TAIL_PARALLELISM`. Heavy lane caps default to `OPENCLAW_DOCKER_ALL_LIVE_LIMIT=9`, `OPENCLAW_DOCKER_ALL_NPM_LIMIT=10`, and `OPENCLAW_DOCKER_ALL_SERVICE_LIMIT=7` so npm install and multi-service lanes do not overcommit Docker while lighter lanes still fill available slots. Lane starts are staggered by 2 seconds by default to avoid local Docker daemon create storms; override with `OPENCLAW_DOCKER_ALL_START_STAGGER_MS=0` or another millisecond value. The local aggregate preflights Docker, removes stale OpenClaw E2E containers, emits active-lane status, persists lane timings for longest-first ordering, and supports `OPENCLAW_DOCKER_ALL_DRY_RUN=1` for scheduler inspection. It stops scheduling new pooled lanes after the first failure by default, and each lane has a 120-minute fallback timeout overrideable with `OPENCLAW_DOCKER_ALL_LANE_TIMEOUT_MS`; selected live/tail lanes use tighter per-lane caps. `OPENCLAW_DOCKER_ALL_LANES=` runs exact scheduler lanes, including release-only lanes such as `install-e2e` and split bundled update lanes such as `bundled-channel-update-acpx`, while skipping the cleanup smoke so agents can reproduce one failed lane. The reusable live/E2E workflow asks `scripts/test-docker-all.mjs --plan-json` which package, image kind, live image, lane, and credential coverage is required, then `scripts/docker-e2e.mjs` converts that plan into GitHub outputs and summaries. It either packs OpenClaw through `scripts/package-openclaw-for-docker.mjs` or downloads a caller-provided package artifact, validates the tarball inventory, builds and pushes package-digest-tagged bare/functional GHCR Docker E2E images when the plan needs package-installed lanes, and reuses those images when the same package digest has already been prepared. The `Package Acceptance` workflow is the high-level package gate: it resolves a candidate from npm, a trusted `package_ref`, an HTTPS tarball plus SHA-256, or a prior workflow artifact, then passes that single `package-under-test` artifact into the reusable Docker E2E workflow. It keeps `workflow_ref` separate from `package_ref` so current harness logic can validate older trusted source commits without checking out old workflow code. Release checks run the `package` acceptance profile for the target ref; that profile covers package/update/plugin contracts and is the default GitHub-native replacement for most Parallels package/update coverage. The release-path Docker suite runs as at most three chunked jobs with `OPENCLAW_SKIP_DOCKER_BUILD=1` so each chunk pulls only the image kind it needs and executes multiple lanes through the same weighted scheduler (`OPENCLAW_DOCKER_ALL_PROFILE=release-path`, `OPENCLAW_DOCKER_ALL_CHUNK=core|package-update|plugins-integrations`). Each chunk uploads `.artifacts/docker-tests/` with lane logs, timings, `summary.json`, `failures.json`, phase timings, scheduler plan JSON, and per-lane rerun commands. The workflow `docker_lanes` input runs selected lanes against the prepared images instead of the three chunk jobs, which keeps failed-lane debugging bounded to one targeted Docker job and prepares or downloads the package artifact for that run; if a selected lane is a live Docker lane, the targeted job builds the live-test image locally for that rerun. Use `pnpm test:docker:rerun ` to download Docker artifacts from a GitHub run and print combined/per-lane targeted rerun commands; use `pnpm test:docker:timings ` for slow-lane and phase critical-path summaries. When Open WebUI is requested with the release-path suite, it runs inside the plugins/integrations chunk instead of reserving a fourth Docker worker; Open WebUI keeps a standalone job only for openwebui-only dispatches. The scheduled live/E2E workflow runs the full release-path Docker suite daily. The bundled update matrix is split by update target so repeated npm update and doctor repair passes can shard with other bundled checks. Local changed-lane logic lives in `scripts/changed-lanes.mjs` and is executed by `scripts/check-changed.mjs`. That local check gate is stricter about architecture boundaries than the broad CI platform scope: core production changes run core prod and core test typecheck plus core lint/guards, core test-only changes run only core test typecheck plus core lint, extension production changes run extension prod and extension test typecheck plus extension lint, and extension test-only changes run extension test typecheck plus extension lint. Public Plugin SDK or plugin-contract changes expand to extension typecheck because extensions depend on those core contracts, but Vitest extension sweeps are explicit test work. Release metadata-only version bumps run targeted version/config/root-dependency checks. Unknown root/config changes fail safe to all check lanes. diff --git a/docs/help/testing.md b/docs/help/testing.md index 9e7b9084d05..5822ea4e05f 100644 --- a/docs/help/testing.md +++ b/docs/help/testing.md @@ -644,6 +644,7 @@ These Docker runners split into two buckets: `OPENCLAW_LIVE_GATEWAY_MODEL_TIMEOUT_MS=90000`. Override those env vars when you explicitly want the larger exhaustive scan. - `test:docker:all` builds the live Docker image once via `test:docker:live-build`, packs OpenClaw once as an npm tarball through `scripts/package-openclaw-for-docker.mjs`, then builds/reuses two `scripts/e2e/Dockerfile` images. The bare image is only the Node/Git runner for install/update/plugin-dependency lanes; those lanes mount the prebuilt tarball. The functional image installs the same tarball into `/app` for built-app functionality lanes. Docker lane definitions live in `scripts/lib/docker-e2e-scenarios.mjs`; planner logic lives in `scripts/lib/docker-e2e-plan.mjs`; `scripts/test-docker-all.mjs` executes the selected plan. The aggregate uses a weighted local scheduler: `OPENCLAW_DOCKER_ALL_PARALLELISM` controls process slots, while resource caps keep heavy live, npm-install, and multi-service lanes from all starting at once. Defaults are 10 slots, `OPENCLAW_DOCKER_ALL_LIVE_LIMIT=9`, `OPENCLAW_DOCKER_ALL_NPM_LIMIT=10`, and `OPENCLAW_DOCKER_ALL_SERVICE_LIMIT=7`; tune `OPENCLAW_DOCKER_ALL_WEIGHT_LIMIT` or `OPENCLAW_DOCKER_ALL_DOCKER_LIMIT` only when the Docker host has more headroom. The runner performs a Docker preflight by default, removes stale OpenClaw E2E containers, prints status every 30 seconds, stores successful lane timings in `.artifacts/docker-tests/lane-timings.json`, and uses those timings to start longer lanes first on later runs. Use `OPENCLAW_DOCKER_ALL_DRY_RUN=1` to print the weighted lane manifest without building or running Docker, or `node scripts/test-docker-all.mjs --plan-json` to print the CI plan for selected lanes, package/image needs, and credentials. +- `Package Acceptance` is the GitHub-native package gate for "does this installable tarball work as a product?" It resolves one candidate package from `source=npm`, `source=ref`, `source=url`, or `source=artifact`, uploads it as `package-under-test`, then runs the reusable Docker E2E lanes against that exact tarball instead of repacking the selected ref. `workflow_ref` selects the trusted workflow/harness scripts, while `package_ref` selects the source commit/branch/tag to pack when `source=ref`; this lets current acceptance logic validate older trusted commits. Profiles are ordered by breadth: `smoke` is quick install/channel/agent plus gateway/config, `package` is the package/update/plugin contract and the default native replacement for most Parallels package/update coverage, `product` adds MCP channels, cron/subagent cleanup, OpenAI web search, and OpenWebUI, and `full` runs the release-path Docker chunks with OpenWebUI. Release validation runs the `package` profile for the target ref. - Container smoke runners: `test:docker:openwebui`, `test:docker:onboard`, `test:docker:npm-onboard-channel-agent`, `test:docker:update-channel-switch`, `test:docker:session-runtime-context`, `test:docker:agents-delete-shared-workspace`, `test:docker:gateway-network`, `test:docker:browser-cdp-snapshot`, `test:docker:mcp-channels`, `test:docker:pi-bundle-mcp-tools`, `test:docker:cron-mcp-cleanup`, `test:docker:plugins`, `test:docker:plugin-update`, and `test:docker:config-reload` boot one or more real containers and verify higher-level integration paths. The live-model Docker runners also bind-mount only the needed CLI auth homes (or all supported ones when the run is not narrowed), then copy them into the container home before the run so external-CLI OAuth can refresh tokens without mutating the host auth store: diff --git a/docs/reference/RELEASING.md b/docs/reference/RELEASING.md index 8433f5db357..0892d6bd7f3 100644 --- a/docs/reference/RELEASING.md +++ b/docs/reference/RELEASING.md @@ -52,20 +52,22 @@ OpenClaw has three public release lanes: - Run the manual `Full Release Validation` workflow before release approval when you need the whole release validation suite from one entrypoint. It accepts a branch, tag, or full commit SHA, dispatches manual `CI`, and - dispatches `OpenClaw Release Checks` for install smoke, Docker release-path - suites, live/E2E, OpenWebUI, QA Lab parity, Matrix, and Telegram lanes. + dispatches `OpenClaw Release Checks` for install smoke, package acceptance, + Docker release-path suites, live/E2E, OpenWebUI, QA Lab parity, Matrix, and + Telegram lanes. Provide `npm_telegram_package_spec` only after a package has been published and the post-publish Telegram E2E should run too. Example: `gh workflow run full-release-validation.yml --ref main -f ref=release/YYYY.M.D` - Run the manual `Package Acceptance` workflow when you want side-channel proof for a package candidate while release work continues. Use `source=npm` for `openclaw@beta`, `openclaw@latest`, or an exact release version; `source=ref` - to pack a trusted branch/tag/SHA; `source=url` for an HTTPS tarball with a - required SHA-256; or `source=artifact` for a tarball uploaded by another - GitHub Actions run. The workflow resolves the candidate to + to pack a trusted `package_ref` branch/tag/SHA with the current + `workflow_ref` harness; `source=url` for an HTTPS tarball with a required + SHA-256; or `source=artifact` for a tarball uploaded by another GitHub + Actions run. The workflow resolves the candidate to `package-under-test`, reuses the Docker E2E release scheduler against that tarball, and can optionally run published-npm Telegram QA. - Example: `gh workflow run package-acceptance.yml --ref main -f source=npm -f package_spec=openclaw@beta -f suite_profile=product` + Example: `gh workflow run package-acceptance.yml --ref main -f workflow_ref=main -f source=npm -f package_spec=openclaw@beta -f suite_profile=product` Common profiles: - `smoke`: install/channel/agent, gateway network, and config reload lanes - `package`: package/update/plugin lanes without OpenWebUI diff --git a/scripts/package-openclaw-for-docker.mjs b/scripts/package-openclaw-for-docker.mjs index 0d7003b4ff4..69226853f97 100644 --- a/scripts/package-openclaw-for-docker.mjs +++ b/scripts/package-openclaw-for-docker.mjs @@ -14,6 +14,7 @@ function parseArgs(argv) { outputDir: "", outputName: "", skipBuild: false, + sourceDir: ROOT_DIR, }; for (let index = 0; index < argv.length; index += 1) { const arg = argv[index]; @@ -27,6 +28,10 @@ function parseArgs(argv) { options.outputName = arg.slice("--output-name=".length); } else if (arg === "--skip-build") { options.skipBuild = true; + } else if (arg === "--source-dir") { + options.sourceDir = argv[(index += 1)] ?? ""; + } else if (arg?.startsWith("--source-dir=")) { + options.sourceDir = arg.slice("--source-dir=".length); } else { throw new Error(`unknown argument: ${arg}`); } @@ -34,10 +39,10 @@ function parseArgs(argv) { return options; } -function run(command, args) { +function run(command, args, cwd) { return new Promise((resolve, reject) => { const child = spawn(command, args, { - cwd: ROOT_DIR, + cwd, stdio: ["ignore", "pipe", "pipe"], }); child.stdout.pipe(process.stderr, { end: false }); @@ -53,10 +58,10 @@ function run(command, args) { }); } -async function runCapture(command, args) { +async function runCapture(command, args, cwd) { return await new Promise((resolve, reject) => { const child = spawn(command, args, { - cwd: ROOT_DIR, + cwd, stdio: ["ignore", "pipe", "pipe"], }); let stdout = ""; @@ -100,6 +105,7 @@ async function newestOpenClawTarball(outputDir, packOutput) { async function main() { const options = parseArgs(process.argv.slice(2)); + const sourceDir = path.resolve(ROOT_DIR, options.sourceDir || ROOT_DIR); const outputDir = path.resolve( ROOT_DIR, options.outputDir || path.join(".artifacts", "docker-e2e-package"), @@ -108,26 +114,28 @@ async function main() { if (!options.skipBuild) { console.error("==> Building OpenClaw package artifacts"); - await run("pnpm", ["build"]); + await run("pnpm", ["build"], sourceDir); } console.error("==> Writing OpenClaw package inventory"); - await run("node", [ - "--import", - "tsx", - "--input-type=module", - "-e", - "const { writePackageDistInventory } = await import('./src/infra/package-dist-inventory.ts'); await writePackageDistInventory(process.cwd());", - ]); + await run( + "node", + [ + "--import", + "tsx", + "--input-type=module", + "-e", + "const { writePackageDistInventory } = await import('./src/infra/package-dist-inventory.ts'); await writePackageDistInventory(process.cwd());", + ], + sourceDir, + ); console.error("==> Packing OpenClaw package"); - const packOutput = await runCapture("npm", [ - "pack", - "--silent", - "--ignore-scripts", - "--pack-destination", - outputDir, - ]); + const packOutput = await runCapture( + "npm", + ["pack", "--silent", "--ignore-scripts", "--pack-destination", outputDir], + sourceDir, + ); let tarball = await newestOpenClawTarball(outputDir, packOutput); if (options.outputName) { @@ -140,7 +148,11 @@ async function main() { } console.error("==> Checking OpenClaw package tarball"); - await run("node", ["scripts/check-openclaw-package-tarball.mjs", tarball]); + await run( + "node", + [path.join(ROOT_DIR, "scripts/check-openclaw-package-tarball.mjs"), tarball], + sourceDir, + ); process.stdout.write(`${tarball}\n`); } diff --git a/scripts/resolve-openclaw-package-candidate.mjs b/scripts/resolve-openclaw-package-candidate.mjs index e290c054886..fb207a219e3 100644 --- a/scripts/resolve-openclaw-package-candidate.mjs +++ b/scripts/resolve-openclaw-package-candidate.mjs @@ -4,6 +4,7 @@ import { spawn } from "node:child_process"; import { createHash } from "node:crypto"; import { createWriteStream } from "node:fs"; import fs from "node:fs/promises"; +import os from "node:os"; import path from "node:path"; import { pipeline } from "node:stream/promises"; import { fileURLToPath } from "node:url"; @@ -18,6 +19,7 @@ function usage() { Options: --package-spec Published npm spec for source=npm. + --package-ref Trusted repo ref for source=ref. --package-url HTTPS tarball URL for source=url. --package-sha256 Expected tarball SHA-256 for source=url or source=artifact. --artifact-dir Directory containing exactly one .tgz for source=artifact. @@ -33,6 +35,7 @@ export function parseArgs(argv) { metadata: "", outputDir: "", outputName: DEFAULT_OUTPUT_NAME, + packageRef: "", packageSha256: "", packageSpec: "", packageUrl: "", @@ -59,6 +62,8 @@ export function parseArgs(argv) { options.outputName = readValue(arg); } else if (arg === "--package-sha256") { options.packageSha256 = readValue(arg).toLowerCase(); + } else if (arg === "--package-ref") { + options.packageRef = readValue(arg); } else if (arg === "--package-spec") { options.packageSpec = readValue(arg); } else if (arg === "--package-url") { @@ -167,6 +172,104 @@ async function findSingleTarball(dir) { return files[0]; } +async function revParseTrustedInputRef(ref) { + const candidates = [ref, `refs/remotes/origin/${ref}`, `refs/tags/${ref}`]; + for (const candidate of candidates) { + const resolved = await run("git", ["rev-parse", "--verify", `${candidate}^{commit}`], { + capture: true, + }).then( + (value) => value.trim(), + () => "", + ); + if (resolved) { + return resolved; + } + } + throw new Error(`package_ref does not resolve to a commit: ${ref}`); +} + +async function resolveTrustedRepoRef(ref) { + if (!ref || ref.trim() === "" || ref.startsWith("-")) { + throw new Error( + `package_ref must be a branch, tag, or full commit SHA; got: ${ref || ""}`, + ); + } + + await run("git", ["fetch", "--no-tags", "origin", "+refs/heads/*:refs/remotes/origin/*"]); + await run("git", ["fetch", "--tags", "origin", "+refs/tags/*:refs/tags/*"]); + + const selectedSha = await revParseTrustedInputRef(ref); + const isMainAncestor = await run("git", [ + "merge-base", + "--is-ancestor", + selectedSha, + "refs/remotes/origin/main", + ]).then( + () => true, + () => false, + ); + if (isMainAncestor) { + return { selectedSha, trustedReason: "main-ancestor" }; + } + + const releaseTags = (await run("git", ["tag", "--points-at", selectedSha], { capture: true })) + .split(/\r?\n/u) + .map((line) => line.trim()) + .filter(Boolean); + if (releaseTags.some((tag) => tag.startsWith("v"))) { + return { selectedSha, trustedReason: "release-tag" }; + } + + const containingBranches = ( + await run( + "git", + [ + "for-each-ref", + "--format=%(refname:short)", + "--contains", + selectedSha, + "refs/remotes/origin", + ], + { capture: true }, + ) + ) + .split(/\r?\n/u) + .map((line) => line.trim()) + .filter(Boolean); + if (containingBranches.some((branch) => branch.startsWith("origin/"))) { + return { selectedSha, trustedReason: "repository-branch-history" }; + } + + throw new Error( + `package_ref ${ref} resolved to ${selectedSha}, which is not reachable from an OpenClaw branch or release tag`, + ); +} + +async function preparePackageSourceWorktree(ref) { + const { selectedSha, trustedReason } = await resolveTrustedRepoRef(ref); + const sourceDir = path.join( + process.env.RUNNER_TEMP || os.tmpdir(), + `openclaw-package-source-${process.pid}`, + ); + await fs.rm(sourceDir, { recursive: true, force: true }); + await run("git", ["worktree", "add", "--detach", sourceDir, selectedSha]); + return { selectedSha, sourceDir, trustedReason }; +} + +async function installPackageSourceDeps(sourceDir) { + await run( + "pnpm", + [ + "install", + "--frozen-lockfile", + "--ignore-scripts=false", + "--config.engine-strict=false", + "--config.enable-pre-post-scripts=true", + ], + { cwd: sourceDir }, + ); +} + async function moveNewestPackedTarball(outputDir, packOutput, outputName) { let filename = ""; try { @@ -238,39 +341,68 @@ async function resolveCandidate(options) { const target = path.join(outputDir, options.outputName || DEFAULT_OUTPUT_NAME); await fs.mkdir(outputDir, { recursive: true }); await fs.rm(target, { force: true }); + let packageRef = ""; + let packageSourceSha = ""; + let packageTrustedReason = ""; + let packageWorktreeDir = ""; - if (options.source === "ref") { - await run("node", [ - "scripts/package-openclaw-for-docker.mjs", - "--output-dir", - outputDir, - "--output-name", - options.outputName || DEFAULT_OUTPUT_NAME, - ]); - } else if (options.source === "npm") { - validateOpenClawPackageSpec(options.packageSpec); - const packOutput = await run( - "npm", - ["pack", options.packageSpec, "--ignore-scripts", "--json", "--pack-destination", outputDir], - { capture: true }, - ); - await moveNewestPackedTarball(outputDir, packOutput, options.outputName || DEFAULT_OUTPUT_NAME); - } else if (options.source === "url") { - if (!options.packageUrl) { - throw new Error("source=url requires --package-url"); + try { + if (options.source === "ref") { + packageRef = options.packageRef || "main"; + const packageSource = await preparePackageSourceWorktree(packageRef); + packageWorktreeDir = packageSource.sourceDir; + packageSourceSha = packageSource.selectedSha; + packageTrustedReason = packageSource.trustedReason; + await installPackageSourceDeps(packageSource.sourceDir); + await run("node", [ + "scripts/package-openclaw-for-docker.mjs", + "--source-dir", + packageSource.sourceDir, + "--output-dir", + outputDir, + "--output-name", + options.outputName || DEFAULT_OUTPUT_NAME, + ]); + } else if (options.source === "npm") { + validateOpenClawPackageSpec(options.packageSpec); + const packOutput = await run( + "npm", + [ + "pack", + options.packageSpec, + "--ignore-scripts", + "--json", + "--pack-destination", + outputDir, + ], + { capture: true }, + ); + await moveNewestPackedTarball( + outputDir, + packOutput, + options.outputName || DEFAULT_OUTPUT_NAME, + ); + } else if (options.source === "url") { + if (!options.packageUrl) { + throw new Error("source=url requires --package-url"); + } + if (!options.packageSha256) { + throw new Error("source=url requires --package-sha256"); + } + await downloadUrl(options.packageUrl, target); + } else if (options.source === "artifact") { + if (!options.artifactDir) { + throw new Error("source=artifact requires --artifact-dir"); + } + const input = await findSingleTarball(options.artifactDir); + await fs.copyFile(input, target); + } else { + throw new Error(`source must be one of: ref, npm, url, artifact. Got: ${options.source}`); } - if (!options.packageSha256) { - throw new Error("source=url requires --package-sha256"); + } finally { + if (packageWorktreeDir) { + await run("git", ["worktree", "remove", "--force", packageWorktreeDir]).catch(() => {}); } - await downloadUrl(options.packageUrl, target); - } else if (options.source === "artifact") { - if (!options.artifactDir) { - throw new Error("source=artifact requires --artifact-dir"); - } - const input = await findSingleTarball(options.artifactDir); - await fs.copyFile(input, target); - } else { - throw new Error(`source must be one of: ref, npm, url, artifact. Got: ${options.source}`); } const digest = await assertExpectedSha256(target, options.packageSha256); @@ -278,7 +410,10 @@ async function resolveCandidate(options) { const pkg = await readPackageJson(target); const metadata = { name: pkg.name, + packageRef, packageSpec: options.packageSpec || "", + packageSourceSha, + packageTrustedReason, sha256: digest, source: options.source, tarball: path.relative(ROOT_DIR, target), diff --git a/test/scripts/package-acceptance-workflow.test.ts b/test/scripts/package-acceptance-workflow.test.ts index e802dc0bc5e..bca77db6009 100644 --- a/test/scripts/package-acceptance-workflow.test.ts +++ b/test/scripts/package-acceptance-workflow.test.ts @@ -5,24 +5,30 @@ const PACKAGE_ACCEPTANCE_WORKFLOW = ".github/workflows/package-acceptance.yml"; const LIVE_E2E_WORKFLOW = ".github/workflows/openclaw-live-and-e2e-checks-reusable.yml"; const DOCKER_E2E_PLAN_ACTION = ".github/actions/docker-e2e-plan/action.yml"; const NPM_TELEGRAM_WORKFLOW = ".github/workflows/npm-telegram-beta-e2e.yml"; +const RELEASE_CHECKS_WORKFLOW = ".github/workflows/openclaw-release-checks.yml"; describe("package acceptance workflow", () => { it("resolves candidate package sources before reusing Docker E2E lanes", () => { const workflow = readFileSync(PACKAGE_ACCEPTANCE_WORKFLOW, "utf8"); expect(workflow).toContain("name: Package Acceptance"); + expect(workflow).toContain("workflow_call:"); + expect(workflow).toContain("workflow_ref:"); + expect(workflow).toContain("package_ref:"); expect(workflow).toContain("source:"); expect(workflow).toContain("- npm"); expect(workflow).toContain("- ref"); expect(workflow).toContain("- url"); expect(workflow).toContain("- artifact"); expect(workflow).toContain("scripts/resolve-openclaw-package-candidate.mjs"); + expect(workflow).toContain('--package-ref "$PACKAGE_REF"'); expect(workflow).toContain('gh run download "$ARTIFACT_RUN_ID"'); expect(workflow).toContain("name: ${{ env.PACKAGE_ARTIFACT_NAME }}"); expect(workflow).toContain("pull-requests: read"); expect(workflow).toContain( "uses: ./.github/workflows/openclaw-live-and-e2e-checks-reusable.yml", ); + expect(workflow).toContain("ref: ${{ inputs.workflow_ref }}"); expect(workflow).toContain( "package_artifact_name: ${{ needs.resolve_package.outputs.package_artifact_name }}", ); @@ -63,4 +69,13 @@ describe("package artifact reuse", () => { expect(workflow).toContain("provider_mode:"); expect(workflow).toContain("provider_mode must be mock-openai or live-frontier"); }); + + it("includes package acceptance in release checks", () => { + const workflow = readFileSync(RELEASE_CHECKS_WORKFLOW, "utf8"); + + expect(workflow).toContain("package_acceptance_release_checks:"); + expect(workflow).toContain("uses: ./.github/workflows/package-acceptance.yml"); + expect(workflow).toContain("package_ref: ${{ needs.resolve_target.outputs.ref }}"); + expect(workflow).toContain("suite_profile: package"); + }); }); diff --git a/test/scripts/resolve-openclaw-package-candidate.test.ts b/test/scripts/resolve-openclaw-package-candidate.test.ts index a3eb4f9422c..0ee6822ee99 100644 --- a/test/scripts/resolve-openclaw-package-candidate.test.ts +++ b/test/scripts/resolve-openclaw-package-candidate.test.ts @@ -28,6 +28,8 @@ describe("resolve-openclaw-package-candidate", () => { parseArgs([ "--source", "npm", + "--package-ref", + "release/2026.4.27", "--package-spec", "openclaw@beta", "--package-url", @@ -43,6 +45,7 @@ describe("resolve-openclaw-package-candidate", () => { artifactDir: ".", outputDir: ".artifacts/docker-e2e-package", packageSha256: "", + packageRef: "release/2026.4.27", packageSpec: "openclaw@beta", packageUrl: "", source: "npm", From 99159f89da03f296c32c3144edf1979c719ca25c Mon Sep 17 00:00:00 2001 From: Gustavo Madeira Santana Date: Sun, 26 Apr 2026 21:47:06 -0400 Subject: [PATCH 212/418] fix(matrix): stabilize e2ee qa flows --- docs/channels/matrix.md | 29 +- extensions/matrix/index.test.ts | 1 + extensions/matrix/index.ts | 13 - extensions/matrix/src/channel.setup.test.ts | 40 + extensions/matrix/src/cli.test.ts | 263 ++ extensions/matrix/src/cli.ts | 189 +- .../matrix/src/matrix/actions/client.test.ts | 17 + .../matrix/src/matrix/actions/client.ts | 2 +- .../src/matrix/actions/verification.test.ts | 205 +- .../matrix/src/matrix/actions/verification.ts | 85 +- .../matrix/src/matrix/client-bootstrap.ts | 6 +- .../matrix/client-resolver.test-helpers.ts | 3 +- extensions/matrix/src/matrix/client/shared.ts | 4 +- extensions/matrix/src/matrix/deps.test.ts | 88 + extensions/matrix/src/matrix/deps.ts | 101 +- .../matrix/src/matrix/monitor/events.test.ts | 26 + .../matrix/src/matrix/monitor/events.ts | 12 + extensions/matrix/src/matrix/sdk.test.ts | 282 +- extensions/matrix/src/matrix/sdk.ts | 202 +- .../matrix/src/matrix/sdk/decrypt-bridge.ts | 76 +- .../matrix/src/onboarding.test-harness.ts | 1 + extensions/matrix/src/setup-bootstrap.ts | 14 +- .../src/providers/mock-openai/server.test.ts | 123 + .../src/providers/mock-openai/server.ts | 21 +- .../src/runners/contract/runtime.test.ts | 79 +- .../qa-matrix/src/runners/contract/runtime.ts | 123 +- .../src/runners/contract/scenario-catalog.ts | 105 +- .../contract/scenario-runtime-cli.test.ts | 36 + .../runners/contract/scenario-runtime-cli.ts | 10 +- .../contract/scenario-runtime-config.ts | 86 + .../scenario-runtime-e2ee-destructive.ts | 745 +++--- .../runners/contract/scenario-runtime-e2ee.ts | 2261 ++++++++++++++--- .../contract/scenario-runtime-shared.ts | 3 + .../contract/scenario-runtime-state-files.ts | 16 +- .../src/runners/contract/scenario-runtime.ts | 27 + .../src/runners/contract/scenario-types.ts | 20 + .../src/runners/contract/scenarios.test.ts | 1848 +++++++++++++- .../src/substrate/e2ee-client.test.ts | 61 +- .../qa-matrix/src/substrate/e2ee-client.ts | 49 +- 39 files changed, 6348 insertions(+), 924 deletions(-) create mode 100644 extensions/qa-matrix/src/runners/contract/scenario-runtime-config.ts diff --git a/docs/channels/matrix.md b/docs/channels/matrix.md index 8dcb4b9cc4f..8fc47b90383 100644 --- a/docs/channels/matrix.md +++ b/docs/channels/matrix.md @@ -68,6 +68,8 @@ Key wizard behaviors: - Room allowlist entries accept room IDs and aliases directly. Prefer `!room:server` or `#alias:server`; unresolved names are ignored at runtime by allowlist resolution. - In invite auto-join allowlist mode, use only stable invite targets: `!roomId:server`, `#alias:server`, or `*`. Plain room names are rejected. - To resolve room names before saving, use `openclaw channels resolve --channel matrix "Project Room"`. +- When setup enables E2EE, OpenClaw writes the encryption config and runs the + same verification bootstrap used by `openclaw matrix encryption setup`. `channels.matrix.autoJoin` defaults to `off`. @@ -292,7 +294,32 @@ Use strict room allowlists and mention requirements when enabling bot-to-bot tra In encrypted (E2EE) rooms, outbound image events use `thumbnail_file` so image previews are encrypted alongside the full attachment. Unencrypted rooms still use plain `thumbnail_url`. No configuration is needed — the plugin detects E2EE state automatically. -Enable encryption: +Recommended setup flow: + +```bash +openclaw matrix encryption setup +``` + +This enables `channels.matrix.encryption`, bootstraps Matrix secret storage and +cross-signing, creates room-key backup state when needed, then prints the +current verification and backup status with next steps. + +For a new account, enable E2EE during account creation: + +```bash +openclaw matrix account add \ + --homeserver https://matrix.example.org \ + --access-token syt_xxx \ + --enable-e2ee +``` + +Multi-account setups can target a specific account: + +```bash +openclaw matrix encryption setup --account assistant +``` + +Manual config equivalent: ```json5 { diff --git a/extensions/matrix/index.test.ts b/extensions/matrix/index.test.ts index c2327759679..487ac02ab48 100644 --- a/extensions/matrix/index.test.ts +++ b/extensions/matrix/index.test.ts @@ -116,6 +116,7 @@ describe("matrix plugin", () => { registerMatrixFullRuntime(api); + expect(runtimeMocks.ensureMatrixCryptoRuntime).not.toHaveBeenCalled(); expect(on.mock.calls.map(([hookName]) => hookName)).toEqual([ "subagent_spawning", "subagent_ended", diff --git a/extensions/matrix/index.ts b/extensions/matrix/index.ts index d0beb081675..39d0aee6c24 100644 --- a/extensions/matrix/index.ts +++ b/extensions/matrix/index.ts @@ -2,7 +2,6 @@ import { defineBundledChannelEntry, type OpenClawPluginApi, } from "openclaw/plugin-sdk/channel-entry-contract"; -import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime"; import { registerMatrixCliMetadata } from "./cli-metadata.js"; import { registerMatrixSubagentHooks } from "./subagent-hooks-api.js"; @@ -16,18 +15,6 @@ function loadMatrixHandlersRuntimeModule() { } export function registerMatrixFullRuntime(api: OpenClawPluginApi): void { - void loadMatrixHandlersRuntimeModule() - .then(({ ensureMatrixCryptoRuntime }) => - ensureMatrixCryptoRuntime({ log: api.logger.info }).catch((err: unknown) => { - const message = formatErrorMessage(err); - api.logger.warn?.(`matrix: crypto runtime bootstrap failed: ${message}`); - }), - ) - .catch((err: unknown) => { - const message = formatErrorMessage(err); - api.logger.warn?.(`matrix: failed loading crypto bootstrap runtime: ${message}`); - }); - api.registerGatewayMethod("matrix.verify.recoveryKey", async (ctx) => { const { handleVerifyRecoveryKey } = await loadMatrixHandlersRuntimeModule(); await handleVerifyRecoveryKey(ctx); diff --git a/extensions/matrix/src/channel.setup.test.ts b/extensions/matrix/src/channel.setup.test.ts index 18e9bdc6e10..a4c8944222e 100644 --- a/extensions/matrix/src/channel.setup.test.ts +++ b/extensions/matrix/src/channel.setup.test.ts @@ -138,6 +138,7 @@ describe("matrix setup post-write bootstrap", () => { expect(verificationMocks.bootstrapMatrixVerification).toHaveBeenCalledWith({ accountId: "default", + cfg: nextCfg, }); expect(log).toHaveBeenCalledWith('Matrix verification bootstrap: complete for "default".'); expect(log).toHaveBeenCalledWith('Matrix backup version for "default": 7'); @@ -177,6 +178,44 @@ describe("matrix setup post-write bootstrap", () => { expect(error).not.toHaveBeenCalled(); }); + it("bootstraps verification when setup enables encryption for an existing account", async () => { + const previousCfg = { + channels: { + matrix: { + homeserver: "https://matrix.example.org", + userId: "@flurry:example.org", + accessToken: "token", + encryption: false, + }, + }, + } as CoreConfig; + const nextCfg = { + channels: { + matrix: { + homeserver: "https://matrix.example.org", + userId: "@flurry:example.org", + accessToken: "token", + encryption: true, + }, + }, + } as CoreConfig; + mockBootstrapResult({ success: true, backupVersion: "8" }); + + await runAfterAccountConfigWritten({ + previousCfg, + nextCfg, + accountId: "default", + input: {}, + }); + + expect(verificationMocks.bootstrapMatrixVerification).toHaveBeenCalledWith({ + accountId: "default", + cfg: nextCfg, + }); + expect(log).toHaveBeenCalledWith('Matrix verification bootstrap: complete for "default".'); + expect(log).toHaveBeenCalledWith('Matrix backup version for "default": 8'); + }); + it("logs a warning when verification bootstrap fails", async () => { const { previousCfg, nextCfg, accountId, input } = applyDefaultAccountConfig(); mockBootstrapResult({ @@ -207,6 +246,7 @@ describe("matrix setup post-write bootstrap", () => { expect(verificationMocks.bootstrapMatrixVerification).toHaveBeenCalledWith({ accountId: "default", + cfg: nextCfg, }); expect(log).toHaveBeenCalledWith('Matrix verification bootstrap: complete for "default".'); }, diff --git a/extensions/matrix/src/cli.test.ts b/extensions/matrix/src/cli.test.ts index 3eef5ab5e90..435abf69ef1 100644 --- a/extensions/matrix/src/cli.test.ts +++ b/extensions/matrix/src/cli.test.ts @@ -2,6 +2,7 @@ import { Command } from "commander"; import { formatZonedTimestamp } from "openclaw/plugin-sdk/matrix-runtime-shared"; import { afterEach, beforeEach, describe, expect, it, vi } from "vitest"; import { registerMatrixCli, resetMatrixCliStateForTests } from "./cli.js"; +import type { CoreConfig } from "./types.js"; const bootstrapMatrixVerificationMock = vi.fn(); const acceptMatrixVerificationMock = vi.fn(); @@ -133,6 +134,7 @@ function mockMatrixVerificationStatus(params: { }, recoveryKeyStored: true, recoveryKeyCreatedAt: params.recoveryKeyCreatedAt, + serverDeviceKnown: true, pendingVerifications: 0, verifiedAt: params.verifiedAt, }); @@ -823,6 +825,20 @@ describe("matrix CLI verification commands", () => { expect(getMatrixVerificationStatusMock).toHaveBeenCalledWith( expect.objectContaining({ cfg: fakeCfg }), ); + expect(getMatrixVerificationStatusMock.mock.calls.at(-1)?.[0]).not.toHaveProperty("readiness"); + }); + + it("allows verify status to use degraded local-state diagnostics", async () => { + mockMatrixVerificationStatus({ recoveryKeyCreatedAt: null }); + const program = buildProgram(); + + await program.parseAsync(["matrix", "verify", "status", "--allow-degraded-local-state"], { + from: "user", + }); + + expect(getMatrixVerificationStatusMock).toHaveBeenCalledWith( + expect.objectContaining({ readiness: "none" }), + ); }); it("passes loaded cfg to all verify subcommands", async () => { @@ -1021,6 +1037,225 @@ describe("matrix CLI verification commands", () => { ); }); + it("enables E2EE and bootstraps verification from matrix account add", async () => { + matrixRuntimeLoadConfigMock.mockReturnValue({ channels: {} }); + matrixSetupApplyAccountConfigMock.mockImplementation( + ({ cfg, accountId }: { cfg: Record; accountId: string }) => ({ + ...cfg, + channels: { + ...(cfg.channels as Record | undefined), + matrix: { + accounts: { + [accountId]: { + homeserver: "https://matrix.example.org", + }, + }, + }, + }, + }), + ); + resolveMatrixAccountConfigMock.mockImplementation( + ({ cfg, accountId }: { cfg: CoreConfig; accountId: string }) => + cfg.channels?.matrix?.accounts?.[accountId] ?? {}, + ); + bootstrapMatrixVerificationMock.mockResolvedValue({ + success: true, + verification: { + recoveryKeyCreatedAt: "2026-03-09T06:00:00.000Z", + backupVersion: "7", + }, + crossSigning: {}, + pendingVerifications: 0, + cryptoBootstrap: {}, + }); + const program = buildProgram(); + + await program.parseAsync( + [ + "matrix", + "account", + "add", + "--account", + "ops", + "--homeserver", + "https://matrix.example.org", + "--access-token", + "token", + "--enable-e2ee", + ], + { from: "user" }, + ); + + expect(matrixRuntimeWriteConfigFileMock).toHaveBeenCalledWith( + expect.objectContaining({ + channels: { + matrix: { + enabled: true, + accounts: { + ops: expect.objectContaining({ + encryption: true, + }), + }, + }, + }, + }), + ); + expect(bootstrapMatrixVerificationMock).toHaveBeenCalledWith({ + accountId: "ops", + cfg: expect.objectContaining({ + channels: { + matrix: expect.objectContaining({ + accounts: expect.objectContaining({ + ops: expect.objectContaining({ + encryption: true, + }), + }), + }), + }, + }), + }); + expect(console.log).toHaveBeenCalledWith("Encryption: enabled"); + expect(console.log).toHaveBeenCalledWith("Matrix verification bootstrap: complete"); + }); + + it("enables E2EE and prints verification status from matrix encryption setup", async () => { + const cfg = { + channels: { + matrix: { + accounts: { + ops: { + homeserver: "https://matrix.example.org", + accessToken: "token", + }, + }, + }, + }, + } as CoreConfig; + matrixRuntimeLoadConfigMock.mockReturnValue(cfg); + resolveMatrixAccountMock.mockReturnValue({ + configured: true, + enabled: true, + config: cfg.channels?.matrix?.accounts?.ops, + }); + resolveMatrixAccountConfigMock.mockReturnValue({ + encryption: false, + }); + bootstrapMatrixVerificationMock.mockResolvedValue({ + success: true, + verification: { + recoveryKeyCreatedAt: "2026-03-09T06:00:00.000Z", + backupVersion: "7", + }, + crossSigning: {}, + pendingVerifications: 0, + cryptoBootstrap: {}, + }); + mockMatrixVerificationStatus({ + recoveryKeyCreatedAt: "2026-03-09T06:00:00.000Z", + }); + const program = buildProgram(); + + await program.parseAsync(["matrix", "encryption", "setup", "--account", "ops"], { + from: "user", + }); + + expect(matrixRuntimeWriteConfigFileMock).toHaveBeenCalledWith( + expect.objectContaining({ + channels: { + matrix: { + enabled: true, + accounts: { + ops: expect.objectContaining({ + encryption: true, + }), + }, + }, + }, + }), + ); + expect(bootstrapMatrixVerificationMock).toHaveBeenCalledWith({ + accountId: "ops", + cfg: expect.objectContaining({ + channels: expect.objectContaining({ + matrix: expect.objectContaining({ + accounts: expect.objectContaining({ + ops: expect.objectContaining({ encryption: true }), + }), + }), + }), + }), + recoveryKey: undefined, + forceResetCrossSigning: false, + }); + expect(getMatrixVerificationStatusMock).toHaveBeenCalledWith({ + accountId: "ops", + cfg: expect.any(Object), + }); + expect(console.log).toHaveBeenCalledWith("Account: ops"); + expect(console.log).toHaveBeenCalledWith( + "Encryption config: enabled at channels.matrix.accounts.ops", + ); + expect(console.log).toHaveBeenCalledWith("Bootstrap success: yes"); + expect(console.log).toHaveBeenCalledWith("Verified by owner: yes"); + expect(console.log).toHaveBeenCalledWith("Backup: active and trusted on this device"); + }); + + it("skips encryption bootstrap when an encrypted account is already healthy", async () => { + const cfg = { + channels: { + matrix: { + accounts: { + ops: { + encryption: true, + homeserver: "https://matrix.example.org", + accessToken: "token", + }, + }, + }, + }, + } as CoreConfig; + matrixRuntimeLoadConfigMock.mockReturnValue(cfg); + resolveMatrixAccountMock.mockReturnValue({ + configured: true, + enabled: true, + config: cfg.channels?.matrix?.accounts?.ops, + }); + resolveMatrixAccountConfigMock.mockReturnValue({ + encryption: true, + }); + mockMatrixVerificationStatus({ + recoveryKeyCreatedAt: "2026-03-09T06:00:00.000Z", + }); + const program = buildProgram(); + + await program.parseAsync(["matrix", "encryption", "setup", "--account", "ops", "--json"], { + from: "user", + }); + + expect(bootstrapMatrixVerificationMock).not.toHaveBeenCalled(); + expect(getMatrixVerificationStatusMock).toHaveBeenCalledTimes(1); + expect(getMatrixVerificationStatusMock).toHaveBeenCalledWith({ + accountId: "ops", + cfg: expect.any(Object), + readiness: "none", + }); + const jsonOutput = stdoutWriteMock.mock.calls.at(-1)?.[0]; + expect(typeof jsonOutput).toBe("string"); + expect(JSON.parse(String(jsonOutput))).toEqual( + expect.objectContaining({ + accountId: "ops", + encryptionChanged: false, + bootstrap: expect.objectContaining({ + success: true, + cryptoBootstrap: null, + }), + status: expect.objectContaining({ + verified: true, + }), + }), + ); + }); + it("bootstraps verification for newly added encrypted accounts", async () => { resolveMatrixAccountConfigMock.mockReturnValue({ encryption: true, @@ -1072,6 +1307,7 @@ describe("matrix CLI verification commands", () => { expect(bootstrapMatrixVerificationMock).toHaveBeenCalledWith({ accountId: "ops", + cfg: expect.any(Object), }); expect(console.log).toHaveBeenCalledWith("Matrix verification bootstrap: complete"); expect(console.log).toHaveBeenCalledWith( @@ -1218,6 +1454,7 @@ describe("matrix CLI verification commands", () => { expect(console.log).toHaveBeenCalledWith("Config path: channels.matrix.accounts.main-bot"); expect(updateMatrixOwnProfileMock).toHaveBeenCalledWith( expect.objectContaining({ + cfg: expect.any(Object), accountId: "main-bot", displayName: "Main Bot", }), @@ -1229,6 +1466,21 @@ describe("matrix CLI verification commands", () => { it("forwards --avatar-url through account add setup and profile sync", async () => { matrixRuntimeLoadConfigMock.mockReturnValue({ channels: {} }); + matrixSetupApplyAccountConfigMock.mockImplementation( + ({ cfg, accountId }: { cfg: Record; accountId: string }) => ({ + ...cfg, + channels: { + ...(cfg.channels as Record | undefined), + matrix: { + accounts: { + [accountId]: { + homeserver: "https://matrix.example.org", + }, + }, + }, + }, + }), + ); const program = buildProgram(); await program.parseAsync( @@ -1261,6 +1513,17 @@ describe("matrix CLI verification commands", () => { ); expect(updateMatrixOwnProfileMock).toHaveBeenCalledWith( expect.objectContaining({ + cfg: expect.objectContaining({ + channels: expect.objectContaining({ + matrix: expect.objectContaining({ + accounts: expect.objectContaining({ + "ops-bot": expect.objectContaining({ + homeserver: "https://matrix.example.org", + }), + }), + }), + }), + }), accountId: "ops-bot", displayName: "Ops Bot", avatarUrl: "mxc://example/ops-avatar", diff --git a/extensions/matrix/src/cli.ts b/extensions/matrix/src/cli.ts index 9c3d3f4d6ad..1ea87b30ece 100644 --- a/extensions/matrix/src/cli.ts +++ b/extensions/matrix/src/cli.ts @@ -245,6 +245,7 @@ type MatrixCliAccountAddResult = { accountId: string; configPath: string; useEnv: boolean; + encryptionEnabled: boolean; deviceHealth: { currentDeviceId: string | null; staleOpenClawDeviceIds: string[]; @@ -280,6 +281,7 @@ async function addMatrixAccount(params: { initialSyncLimit?: string; allowPrivateNetwork?: boolean; useEnv?: boolean; + enableEncryption?: boolean; }): Promise { const runtime = getMatrixRuntime(); const cfg = runtime.config.loadConfig() as CoreConfig; @@ -315,11 +317,14 @@ async function addMatrixAccount(params: { throw new Error(validationError); } - const updated = matrixSetupAdapter.applyAccountConfig({ + let updated = matrixSetupAdapter.applyAccountConfig({ cfg, accountId, input, }) as CoreConfig; + if (params.enableEncryption === true) { + updated = updateMatrixAccountConfig(updated, accountId, { encryption: true }); + } await runtime.config.writeConfigFile(updated as never); const accountConfig = resolveMatrixAccountConfig({ cfg: updated, accountId }); @@ -350,6 +355,7 @@ async function addMatrixAccount(params: { if (desiredDisplayName || desiredAvatarUrl) { try { const synced = await updateMatrixOwnProfile({ + cfg: updated, accountId, displayName: desiredDisplayName, avatarUrl: desiredAvatarUrl, @@ -406,6 +412,7 @@ async function addMatrixAccount(params: { accountId, configPath: resolveMatrixConfigPath(updated, accountId), useEnv: input.useEnv === true, + encryptionEnabled: accountConfig.encryption === true, deviceHealth, verificationBootstrap, profile, @@ -591,6 +598,7 @@ type MatrixCliVerificationStatus = { serverDeviceKnown?: boolean | null; recoveryKeyStored: boolean; recoveryKeyCreatedAt: string | null; + recoveryKeyId: string | null; pendingVerifications: number; recoveryKeyAccepted?: boolean; backupUsable?: boolean; @@ -659,6 +667,108 @@ type MatrixCliDirectRoomRepair = MatrixCliDirectRoomInspection & { directContentAfter: Record; }; +type MatrixCliVerificationBootstrap = Awaited>; + +type MatrixCliEncryptionSetupResult = { + accountId: string; + configPath: string; + encryptionChanged: boolean; + bootstrap: MatrixCliVerificationBootstrap; + status: MatrixCliVerificationStatus; +}; + +function isMatrixVerificationSetupComplete(status: MatrixCliVerificationStatus): boolean { + return ( + status.encryptionEnabled && + status.verified && + status.crossSigningVerified && + status.signedByOwner && + status.serverDeviceKnown === true && + resolveMatrixRoomKeyBackupIssue(resolveBackupStatus(status)).code === "ok" + ); +} + +function buildNoopMatrixVerificationBootstrap( + status: MatrixCliVerificationStatus, +): MatrixCliVerificationBootstrap { + const verification = { + ...status, + backup: resolveBackupStatus(status), + serverDeviceKnown: status.serverDeviceKnown ?? null, + }; + return { + success: true, + verification, + crossSigning: { + userId: status.userId, + masterKeyPublished: status.crossSigningVerified, + selfSigningKeyPublished: status.signedByOwner, + userSigningKeyPublished: status.signedByOwner, + published: status.crossSigningVerified && status.signedByOwner, + }, + pendingVerifications: status.pendingVerifications, + cryptoBootstrap: null, + }; +} + +async function setupMatrixEncryption(params: { + account?: string; + recoveryKey?: string; + forceResetCrossSigning?: boolean; +}): Promise { + const runtime = getMatrixRuntime(); + const { accountId, cfg } = resolveMatrixCliAccountContext(params.account); + const account = resolveMatrixAccount({ cfg, accountId }); + if (!account.configured) { + throw new Error( + `Matrix account "${accountId}" is not configured; run ${formatMatrixCliCommand( + "account add", + accountId, + )} first.`, + ); + } + + const currentAccountConfig = resolveMatrixAccountConfig({ cfg, accountId }); + const encryptionChanged = currentAccountConfig.encryption !== true; + const updated = encryptionChanged + ? updateMatrixAccountConfig(cfg, accountId, { encryption: true }) + : cfg; + if (encryptionChanged) { + await runtime.config.writeConfigFile(updated as never); + } + + const canUseExistingBootstrap = + !encryptionChanged && !params.recoveryKey && params.forceResetCrossSigning !== true; + const existingStatus = canUseExistingBootstrap + ? await getMatrixVerificationStatus({ accountId, cfg: updated, readiness: "none" }) + : null; + if (existingStatus && isMatrixVerificationSetupComplete(existingStatus)) { + return { + accountId, + configPath: resolveMatrixConfigPath(updated, accountId), + encryptionChanged, + bootstrap: buildNoopMatrixVerificationBootstrap(existingStatus), + status: existingStatus, + }; + } + + const bootstrap = await bootstrapMatrixVerification({ + accountId, + cfg: updated, + recoveryKey: params.recoveryKey, + forceResetCrossSigning: params.forceResetCrossSigning === true, + }); + const status = await getMatrixVerificationStatus({ accountId, cfg: updated }); + + return { + accountId, + configPath: resolveMatrixConfigPath(updated, accountId), + encryptionChanged, + bootstrap, + status, + }; +} + function toCliDirectRoomCandidate(room: MatrixDirectRoomCandidate): MatrixCliDirectRoomCandidate { return { roomId: room.roomId, @@ -1233,6 +1343,33 @@ function printVerificationStatus( printVerificationGuidance(status, accountId); } +function printMatrixEncryptionSetupResult( + result: MatrixCliEncryptionSetupResult, + verbose = false, +): void { + printAccountLabel(result.accountId); + console.log( + `Encryption config: ${result.encryptionChanged ? "enabled" : "already enabled"} at ${formatMatrixCliText( + result.configPath, + )}`, + ); + console.log(`Bootstrap success: ${result.bootstrap.success ? "yes" : "no"}`); + if (result.bootstrap.error) { + console.log(`Bootstrap error: ${formatMatrixCliText(result.bootstrap.error)}`); + } + console.log(`Verified by owner: ${result.status.verified ? "yes" : "no"}`); + printVerificationBackupSummary(result.status); + if (verbose) { + printVerificationIdentity(result.status); + printVerificationTrustDiagnostics(result.status); + printVerificationBackupStatus(result.status); + console.log(`Recovery key stored: ${result.status.recoveryKeyStored ? "yes" : "no"}`); + printTimestamp("Recovery key created at", result.status.recoveryKeyCreatedAt); + console.log(`Pending verifications: ${result.status.pendingVerifications}`); + } + printVerificationGuidance(result.status, result.accountId); +} + export function registerMatrixCli(params: { program: Command }): void { const root = params.program .command("matrix") @@ -1258,6 +1395,8 @@ export function registerMatrixCli(params: { program: Command }): void { .option("--password ", "Matrix password") .option("--device-name ", "Matrix device display name") .option("--initial-sync-limit ", "Matrix initial sync limit") + .option("--enable-e2ee", "Enable Matrix end-to-end encryption and bootstrap verification") + .option("--encryption", "Alias for --enable-e2ee") .option( "--use-env", "Use MATRIX_* env vars (or MATRIX__* for non-default accounts)", @@ -1277,6 +1416,8 @@ export function registerMatrixCli(params: { program: Command }): void { password?: string; deviceName?: string; initialSyncLimit?: string; + enableE2ee?: boolean; + encryption?: boolean; useEnv?: boolean; verbose?: boolean; json?: boolean; @@ -1297,6 +1438,7 @@ export function registerMatrixCli(params: { program: Command }): void { password: options.password, deviceName: options.deviceName, initialSyncLimit: options.initialSyncLimit, + enableEncryption: options.enableE2ee === true || options.encryption === true, useEnv: options.useEnv === true, }), onText: (result) => { @@ -1305,6 +1447,7 @@ export function registerMatrixCli(params: { program: Command }): void { console.log( `Credentials source: ${result.useEnv ? "MATRIX_* / MATRIX__* env vars" : "inline config"}`, ); + console.log(`Encryption: ${result.encryptionEnabled ? "enabled" : "disabled"}`); if (result.verificationBootstrap.attempted) { if (result.verificationBootstrap.success) { console.log("Matrix verification bootstrap: complete"); @@ -1466,6 +1609,44 @@ export function registerMatrixCli(params: { program: Command }): void { }, ); + const encryption = root.command("encryption").description("Set up Matrix end-to-end encryption"); + + encryption + .command("setup") + .description("Enable Matrix E2EE, bootstrap verification, and print next steps") + .option("--account ", "Account ID (for multi-account setups)") + .option("--recovery-key ", "Recovery key to apply before bootstrap") + .option("--force-reset-cross-signing", "Force reset cross-signing identity before bootstrap") + .option("--verbose", "Show detailed diagnostics") + .option("--json", "Output as JSON") + .action( + async (options: { + account?: string; + recoveryKey?: string; + forceResetCrossSigning?: boolean; + verbose?: boolean; + json?: boolean; + }) => { + await runMatrixCliCommand({ + verbose: options.verbose === true, + json: options.json === true, + run: async () => + await setupMatrixEncryption({ + account: options.account, + recoveryKey: options.recoveryKey, + forceResetCrossSigning: options.forceResetCrossSigning === true, + }), + onText: (result, verbose) => { + printMatrixEncryptionSetupResult(result, verbose); + }, + onJson: (result) => ({ success: result.bootstrap.success, ...result }), + shouldFail: (result) => !result.bootstrap.success, + errorPrefix: "Encryption setup failed", + onJsonError: (message) => ({ success: false, error: message }), + }); + }, + ); + const verify = root.command("verify").description("Device verification for Matrix E2EE"); verify @@ -1721,9 +1902,14 @@ export function registerMatrixCli(params: { program: Command }): void { .option("--account ", "Account ID (for multi-account setups)") .option("--verbose", "Show detailed diagnostics") .option("--include-recovery-key", "Include stored recovery key in output") + .option( + "--allow-degraded-local-state", + "Return best-effort diagnostics without preparing the Matrix account", + ) .option("--json", "Output as JSON") .action( async (options: { + allowDegradedLocalState?: boolean; account?: string; verbose?: boolean; includeRecoveryKey?: boolean; @@ -1738,6 +1924,7 @@ export function registerMatrixCli(params: { program: Command }): void { accountId, cfg, includeRecoveryKey: options.includeRecoveryKey === true, + ...(options.allowDegradedLocalState === true ? { readiness: "none" as const } : {}), }), onText: (status, verbose) => { printAccountLabel(accountId); diff --git a/extensions/matrix/src/matrix/actions/client.test.ts b/extensions/matrix/src/matrix/actions/client.test.ts index c7d0e7ecd90..f7a6b9063e4 100644 --- a/extensions/matrix/src/matrix/actions/client.test.ts +++ b/extensions/matrix/src/matrix/actions/client.test.ts @@ -195,6 +195,23 @@ describe("action client helpers", () => { expect(releaseSharedClientInstanceMock).toHaveBeenCalledWith(sharedClient, "stop"); }); + it("can discard read-only shared action clients without persisting crypto state", async () => { + const sharedClient = createMockMatrixClient(); + acquireSharedMatrixClientMock.mockResolvedValue(sharedClient); + + const result = await withResolvedActionClient( + { cfg: TEST_CFG, accountId: "default" }, + async (client) => { + expect(client).toBe(sharedClient); + return "ok"; + }, + "discard", + ); + + expect(result).toBe("ok"); + expect(releaseSharedClientInstanceMock).toHaveBeenCalledWith(sharedClient, "discard"); + }); + it("stops shared action clients when the wrapped call throws", async () => { const sharedClient = createMockMatrixClient(); acquireSharedMatrixClientMock.mockResolvedValue(sharedClient); diff --git a/extensions/matrix/src/matrix/actions/client.ts b/extensions/matrix/src/matrix/actions/client.ts index b4327434603..f80a74e466d 100644 --- a/extensions/matrix/src/matrix/actions/client.ts +++ b/extensions/matrix/src/matrix/actions/client.ts @@ -2,7 +2,7 @@ import { withResolvedRuntimeMatrixClient } from "../client-bootstrap.js"; import { resolveMatrixRoomId } from "../send.js"; import type { MatrixActionClient, MatrixActionClientOpts } from "./types.js"; -type MatrixActionClientStopMode = "stop" | "persist"; +type MatrixActionClientStopMode = "stop" | "persist" | "discard"; export async function withResolvedActionClient( opts: MatrixActionClientOpts, diff --git a/extensions/matrix/src/matrix/actions/verification.test.ts b/extensions/matrix/src/matrix/actions/verification.test.ts index 9e087e2de50..eb302f6b8ee 100644 --- a/extensions/matrix/src/matrix/actions/verification.test.ts +++ b/extensions/matrix/src/matrix/actions/verification.test.ts @@ -175,37 +175,43 @@ describe("matrix verification actions", () => { expect(loadConfigMock).not.toHaveBeenCalled(); }); - it("resolves verification status without starting the Matrix client", async () => { + it("prepares local crypto before resolving authoritative verification status", async () => { + const prepareForOneOff = vi.fn(async () => undefined); + const start = vi.fn(async () => undefined); + const getOwnDeviceVerificationStatus = vi.fn().mockResolvedValue({ + encryptionEnabled: true, + verified: true, + userId: "@bot:example.org", + deviceId: "DEVICE123", + localVerified: true, + crossSigningVerified: true, + signedByOwner: true, + recoveryKeyStored: true, + recoveryKeyCreatedAt: null, + recoveryKeyId: "SSSS", + backupVersion: "11", + backup: { + serverVersion: "11", + activeVersion: "11", + trusted: true, + matchesDecryptionKey: true, + decryptionKeyCached: true, + keyLoadAttempted: false, + keyLoadError: null, + }, + serverDeviceKnown: true, + }); withResolvedActionClientMock.mockImplementation(async (_opts, run) => { return await run({ + prepareForOneOff, crypto: { listVerifications: vi.fn(async () => []), getRecoveryKey: vi.fn(async () => ({ encodedPrivateKey: "rec-key", })), }, - getOwnDeviceVerificationStatus: vi.fn(async () => ({ - encryptionEnabled: true, - verified: true, - userId: "@bot:example.org", - deviceId: "DEVICE123", - localVerified: true, - crossSigningVerified: true, - signedByOwner: true, - recoveryKeyStored: true, - recoveryKeyCreatedAt: null, - recoveryKeyId: "SSSS", - backupVersion: "11", - backup: { - serverVersion: "11", - activeVersion: "11", - trusted: true, - matchesDecryptionKey: true, - decryptionKeyCached: true, - keyLoadAttempted: false, - keyLoadError: null, - }, - })), + getOwnDeviceVerificationStatus, + start, }); }); @@ -217,9 +223,68 @@ describe("matrix verification actions", () => { recoveryKey: "rec-key", }); expect(withResolvedActionClientMock).toHaveBeenCalledTimes(1); + expect(withResolvedActionClientMock).toHaveBeenCalledWith( + expect.objectContaining({ readiness: "none" }), + expect.any(Function), + "discard", + ); + expect(prepareForOneOff).toHaveBeenCalledTimes(1); + expect(start).not.toHaveBeenCalled(); + expect(getOwnDeviceVerificationStatus).toHaveBeenCalledTimes(2); expect(withStartedActionClientMock).not.toHaveBeenCalled(); }); + it("fails closed before local Matrix prep when the current device is gone", async () => { + const prepareForOneOff = vi.fn(async () => undefined); + const getOwnDeviceVerificationStatus = vi.fn(async () => ({ + encryptionEnabled: true, + verified: false, + userId: "@bot:example.org", + deviceId: "DEVICE123", + localVerified: false, + crossSigningVerified: false, + signedByOwner: false, + recoveryKeyStored: true, + recoveryKeyCreatedAt: null, + recoveryKeyId: "SSSS", + backupVersion: "11", + backup: { + serverVersion: "11", + activeVersion: "11", + trusted: true, + matchesDecryptionKey: true, + decryptionKeyCached: true, + keyLoadAttempted: false, + keyLoadError: null, + }, + serverDeviceKnown: false, + })); + withResolvedActionClientMock.mockImplementation(async (_opts, run) => { + return await run({ + crypto: { + listVerifications: vi.fn(async () => []), + }, + getOwnDeviceVerificationStatus, + prepareForOneOff, + }); + }); + + const status = await getMatrixVerificationStatus(); + + expect(status).toMatchObject({ + deviceId: "DEVICE123", + serverDeviceKnown: false, + pendingVerifications: 0, + }); + expect(withResolvedActionClientMock).toHaveBeenCalledWith( + expect.objectContaining({ readiness: "none" }), + expect.any(Function), + "discard", + ); + expect(prepareForOneOff).not.toHaveBeenCalled(); + expect(getOwnDeviceVerificationStatus).toHaveBeenCalledTimes(1); + }); + it("resolves encryption and backup status without starting the Matrix client", async () => { withResolvedActionClientMock .mockImplementationOnce(async (_opts, run) => { @@ -407,12 +472,9 @@ describe("matrix verification actions", () => { expect(crypto.startVerification).toHaveBeenCalledWith("verification-1", "sas"); expect(confirmSas).toHaveBeenCalledWith(sas.sas, sas); expect(crypto.confirmVerificationSas).toHaveBeenCalledWith("verification-1"); - expect(bootstrapOwnDeviceVerification).toHaveBeenCalledWith({ - allowAutomaticCrossSigningReset: false, - strict: false, - }); - expect(getOwnCrossSigningPublicationStatus).not.toHaveBeenCalled(); - expect(getOwnDeviceVerificationStatus).not.toHaveBeenCalled(); + expect(bootstrapOwnDeviceVerification).not.toHaveBeenCalled(); + expect(getOwnCrossSigningPublicationStatus).toHaveBeenCalledTimes(1); + expect(getOwnDeviceVerificationStatus).toHaveBeenCalledTimes(1); }); it("does not complete self-verification until the OpenClaw device has full Matrix identity trust", async () => { @@ -442,10 +504,74 @@ describe("matrix verification actions", () => { requestVerification: vi.fn(async () => requested), startVerification: vi.fn(async () => sas), }; - const getOwnDeviceIdentityVerificationStatus = vi + const getOwnDeviceVerificationStatus = vi .fn() .mockResolvedValueOnce(mockUnverifiedOwnerStatus()) .mockResolvedValueOnce(mockVerifiedOwnerStatus()); + const getOwnCrossSigningPublicationStatus = vi.fn(async () => + mockCrossSigningPublicationStatus(), + ); + const bootstrapOwnDeviceVerification = vi.fn(async () => ({ + crossSigning: mockCrossSigningPublicationStatus(), + success: true, + verification: mockUnverifiedOwnerStatus(), + })); + const trustOwnIdentityAfterSelfVerification = vi.fn(async () => {}); + withStartedActionClientMock.mockImplementation(async (_opts, run) => { + return await run({ + bootstrapOwnDeviceVerification, + crypto, + getOwnCrossSigningPublicationStatus, + getOwnDeviceVerificationStatus, + trustOwnIdentityAfterSelfVerification, + }); + }); + + await expect( + runMatrixSelfVerification({ confirmSas: vi.fn(async () => true), timeoutMs: 500 }), + ).resolves.toMatchObject({ + completed: true, + deviceOwnerVerified: true, + ownerVerification: { + verified: true, + }, + }); + + expect(getOwnDeviceVerificationStatus).toHaveBeenCalledTimes(2); + expect(getOwnCrossSigningPublicationStatus).toHaveBeenCalledTimes(2); + expect(trustOwnIdentityAfterSelfVerification).toHaveBeenCalledTimes(1); + }); + + it("does not let the SDK identity-only status read hang completed self-verification", async () => { + const requested = { + completed: false, + hasSas: false, + id: "verification-1", + phaseName: "requested", + transactionId: "tx-self", + }; + const sas = { + ...requested, + hasSas: true, + phaseName: "started", + sas: { + decimal: [1, 2, 3], + }, + }; + const completed = { + ...sas, + completed: true, + phaseName: "done", + }; + const crypto = { + confirmVerificationSas: vi.fn(async () => completed), + listVerifications: vi.fn(async () => [sas]), + requestVerification: vi.fn(async () => requested), + startVerification: vi.fn(async () => sas), + }; + const getOwnDeviceIdentityVerificationStatus = vi.fn( + async () => await new Promise(() => undefined), + ); const getOwnDeviceVerificationStatus = vi.fn(async () => mockVerifiedOwnerStatus()); const getOwnCrossSigningPublicationStatus = vi.fn(async () => mockCrossSigningPublicationStatus(), @@ -472,15 +598,10 @@ describe("matrix verification actions", () => { ).resolves.toMatchObject({ completed: true, deviceOwnerVerified: true, - ownerVerification: { - verified: true, - }, }); - expect(getOwnDeviceIdentityVerificationStatus).toHaveBeenCalledTimes(2); + expect(getOwnDeviceIdentityVerificationStatus).not.toHaveBeenCalled(); expect(getOwnDeviceVerificationStatus).toHaveBeenCalledTimes(1); - expect(getOwnCrossSigningPublicationStatus).toHaveBeenCalledTimes(2); - expect(trustOwnIdentityAfterSelfVerification).toHaveBeenCalledTimes(1); }); it("does not complete self-verification until cross-signing keys are published", async () => { @@ -510,7 +631,6 @@ describe("matrix verification actions", () => { requestVerification: vi.fn(async () => requested), startVerification: vi.fn(async () => sas), }; - const getOwnDeviceIdentityVerificationStatus = vi.fn(async () => mockVerifiedOwnerStatus()); const getOwnDeviceVerificationStatus = vi.fn(async () => mockVerifiedOwnerStatus()); const getOwnCrossSigningPublicationStatus = vi .fn() @@ -527,7 +647,6 @@ describe("matrix verification actions", () => { bootstrapOwnDeviceVerification, crypto, getOwnCrossSigningPublicationStatus, - getOwnDeviceIdentityVerificationStatus, getOwnDeviceVerificationStatus, trustOwnIdentityAfterSelfVerification, }); @@ -543,8 +662,7 @@ describe("matrix verification actions", () => { }, }); - expect(getOwnDeviceIdentityVerificationStatus).toHaveBeenCalledTimes(2); - expect(getOwnDeviceVerificationStatus).toHaveBeenCalledTimes(1); + expect(getOwnDeviceVerificationStatus).toHaveBeenCalledTimes(2); expect(getOwnCrossSigningPublicationStatus).toHaveBeenCalledTimes(2); expect(trustOwnIdentityAfterSelfVerification).not.toHaveBeenCalled(); }); @@ -722,6 +840,7 @@ describe("matrix verification actions", () => { return await run({ bootstrapOwnDeviceVerification, crypto, + getOwnCrossSigningPublicationStatus: vi.fn(async () => mockCrossSigningPublicationStatus()), getOwnDeviceVerificationStatus: vi.fn(async () => mockVerifiedOwnerStatus()), }); }); @@ -775,7 +894,6 @@ describe("matrix verification actions", () => { getOwnCrossSigningPublicationStatus: vi.fn(async () => mockCrossSigningPublicationStatus(false), ), - getOwnDeviceIdentityVerificationStatus: vi.fn(async () => mockUnverifiedOwnerStatus()), getOwnDeviceVerificationStatus: vi.fn(async () => mockUnverifiedOwnerStatus()), }); }); @@ -787,10 +905,7 @@ describe("matrix verification actions", () => { ); expect(crypto.cancelVerification).not.toHaveBeenCalled(); - expect(bootstrapOwnDeviceVerification).toHaveBeenCalledWith({ - allowAutomaticCrossSigningReset: false, - strict: false, - }); + expect(bootstrapOwnDeviceVerification).not.toHaveBeenCalled(); }); it("cancels the pending self-verification request when acceptance times out", async () => { diff --git a/extensions/matrix/src/matrix/actions/verification.ts b/extensions/matrix/src/matrix/actions/verification.ts index 9f7eb51d929..50077f9c6fc 100644 --- a/extensions/matrix/src/matrix/actions/verification.ts +++ b/extensions/matrix/src/matrix/actions/verification.ts @@ -173,17 +173,17 @@ async function waitForMatrixSelfVerificationTrustStatus(params: { timeoutMs: number; }): Promise { const startedAt = Date.now(); - let last: MatrixDeviceVerificationStatus | undefined; + let last: MatrixOwnDeviceVerificationStatus | undefined; let crossSigningPublished = false; while (Date.now() - startedAt < params.timeoutMs) { const [status, crossSigning] = await Promise.all([ - params.client.getOwnDeviceIdentityVerificationStatus(), + params.client.getOwnDeviceVerificationStatus(), params.client.getOwnCrossSigningPublicationStatus(), ]); last = status; crossSigningPublished = crossSigning.published; - if (last.verified && crossSigningPublished) { - return await params.client.getOwnDeviceVerificationStatus(); + if (status.verified && crossSigningPublished) { + return status; } await sleep(Math.min(250, Math.max(25, params.timeoutMs - (Date.now() - startedAt)))); } @@ -214,20 +214,20 @@ async function completeMatrixSelfVerification(params: { completed: MatrixVerificationSummary; timeoutMs: number; }): Promise { - const bootstrap = await params.client.bootstrapOwnDeviceVerification({ - allowAutomaticCrossSigningReset: false, - strict: false, - }); - if (!bootstrap.verification.verified) { - await params.client.trustOwnIdentityAfterSelfVerification?.(); + const initial = await Promise.all([ + params.client.getOwnDeviceVerificationStatus(), + params.client.getOwnCrossSigningPublicationStatus(), + ]); + let ownerVerification = initial[0]; + if (!ownerVerification.verified || !initial[1].published) { + if (!ownerVerification.verified) { + await params.client.trustOwnIdentityAfterSelfVerification?.(); + } + ownerVerification = await waitForMatrixSelfVerificationTrustStatus({ + client: params.client, + timeoutMs: params.timeoutMs, + }); } - const ownerVerification = - bootstrap.verification.verified && bootstrap.crossSigning.published - ? bootstrap.verification - : await waitForMatrixSelfVerificationTrustStatus({ - client: params.client, - timeoutMs: params.timeoutMs, - }); return { ...params.completed, deviceOwnerVerified: ownerVerification.verified, @@ -482,21 +482,42 @@ export async function getMatrixEncryptionStatus( export async function getMatrixVerificationStatus( opts: MatrixActionClientOpts & { includeRecoveryKey?: boolean } = {}, ) { - return await withResolvedActionClient(opts, async (client) => { - const status = await client.getOwnDeviceVerificationStatus(); - const payload = { - ...status, - pendingVerifications: client.crypto ? (await client.crypto.listVerifications()).length : 0, - }; - if (!opts.includeRecoveryKey) { - return payload; - } - const recoveryKey = client.crypto ? await client.crypto.getRecoveryKey() : null; - return { - ...payload, - recoveryKey: recoveryKey?.encodedPrivateKey ?? null, - }; - }); + const readiness = opts.readiness ?? "prepared"; + return await withResolvedActionClient( + { ...opts, readiness: "none" }, + async (client) => { + const preflight = await readMatrixVerificationStatus(client, opts); + if (readiness === "none" || preflight.serverDeviceKnown === false) { + return preflight; + } + if (readiness === "started") { + await client.start(); + } else { + await client.prepareForOneOff(); + } + return await readMatrixVerificationStatus(client, opts); + }, + "discard", + ); +} + +async function readMatrixVerificationStatus( + client: MatrixActionClient, + opts: MatrixActionClientOpts & { includeRecoveryKey?: boolean }, +) { + const status = await client.getOwnDeviceVerificationStatus(); + const payload = { + ...status, + pendingVerifications: client.crypto ? (await client.crypto.listVerifications()).length : 0, + }; + if (!opts.includeRecoveryKey) { + return payload; + } + const recoveryKey = client.crypto ? await client.crypto.getRecoveryKey() : null; + return { + ...payload, + recoveryKey: recoveryKey?.encodedPrivateKey ?? null, + }; } export async function getMatrixRoomKeyBackupStatus(opts: MatrixActionClientOpts = {}) { diff --git a/extensions/matrix/src/matrix/client-bootstrap.ts b/extensions/matrix/src/matrix/client-bootstrap.ts index 82c5890e7be..04b5d9b7ef8 100644 --- a/extensions/matrix/src/matrix/client-bootstrap.ts +++ b/extensions/matrix/src/matrix/client-bootstrap.ts @@ -11,7 +11,7 @@ type ResolvedRuntimeMatrixClient = { }; type MatrixRuntimeClientReadiness = "none" | "prepared" | "started"; -type ResolvedRuntimeMatrixClientStopMode = "stop" | "persist"; +type ResolvedRuntimeMatrixClientStopMode = "stop" | "persist" | "discard"; type MatrixResolvedClientHook = ( client: MatrixClient, @@ -146,6 +146,10 @@ export async function stopResolvedRuntimeMatrixClient( await resolved.client.stopAndPersist(); return; } + if (mode === "discard") { + resolved.client.stopWithoutPersist(); + return; + } resolved.client.stop(); } diff --git a/extensions/matrix/src/matrix/client-resolver.test-helpers.ts b/extensions/matrix/src/matrix/client-resolver.test-helpers.ts index c8a0fdd5a0c..f171f76393d 100644 --- a/extensions/matrix/src/matrix/client-resolver.test-helpers.ts +++ b/extensions/matrix/src/matrix/client-resolver.test-helpers.ts @@ -44,6 +44,7 @@ export function createMockMatrixClient(): MatrixClient { start: vi.fn(async () => undefined), stop: vi.fn(() => undefined), stopAndPersist: vi.fn(async () => undefined), + stopWithoutPersist: vi.fn(() => undefined), } as unknown as MatrixClient; } @@ -114,7 +115,7 @@ export async function expectOneOffSharedMatrixClient(params?: { timeoutMs?: number; prepareForOneOffCalls?: number; startCalls?: number; - releaseMode?: "persist" | "stop"; + releaseMode?: "persist" | "stop" | "discard"; }) { const { getActiveMatrixClientMock, diff --git a/extensions/matrix/src/matrix/client/shared.ts b/extensions/matrix/src/matrix/client/shared.ts index 6201f901862..c622748d6fe 100644 --- a/extensions/matrix/src/matrix/client/shared.ts +++ b/extensions/matrix/src/matrix/client/shared.ts @@ -294,7 +294,7 @@ export function stopSharedClientInstance(client: MatrixClient): void { export async function releaseSharedClientInstance( client: MatrixClient, - mode: "stop" | "persist" = "stop", + mode: "stop" | "persist" | "discard" = "stop", ): Promise { const state = findSharedClientStateByInstance(client); if (!state) { @@ -307,6 +307,8 @@ export async function releaseSharedClientInstance( deleteSharedClientState(state); if (mode === "persist") { await client.stopAndPersist(); + } else if (mode === "discard") { + client.stopWithoutPersist(); } else { client.stop(); } diff --git a/extensions/matrix/src/matrix/deps.test.ts b/extensions/matrix/src/matrix/deps.test.ts index c29d05d753f..6e3c10e1f6f 100644 --- a/extensions/matrix/src/matrix/deps.test.ts +++ b/extensions/matrix/src/matrix/deps.test.ts @@ -1,8 +1,53 @@ +import fs from "node:fs"; +import os from "node:os"; +import path from "node:path"; import { describe, expect, it, vi } from "vitest"; import { ensureMatrixCryptoRuntime } from "./deps.js"; const logStub = vi.fn(); +function resolveTestNativeBindingFilename(): string | null { + switch (process.platform) { + case "darwin": + return process.arch === "arm64" + ? "matrix-sdk-crypto.darwin-arm64.node" + : process.arch === "x64" + ? "matrix-sdk-crypto.darwin-x64.node" + : null; + case "linux": { + const report = process.report?.getReport?.() as + | { header?: { glibcVersionRuntime?: string } } + | undefined; + const isMusl = !report?.header?.glibcVersionRuntime; + if (process.arch === "x64") { + return isMusl + ? "matrix-sdk-crypto.linux-x64-musl.node" + : "matrix-sdk-crypto.linux-x64-gnu.node"; + } + if (process.arch === "arm64" && !isMusl) { + return "matrix-sdk-crypto.linux-arm64-gnu.node"; + } + if (process.arch === "arm") { + return "matrix-sdk-crypto.linux-arm-gnueabihf.node"; + } + if (process.arch === "s390x") { + return "matrix-sdk-crypto.linux-s390x-gnu.node"; + } + return null; + } + case "win32": + return process.arch === "x64" + ? "matrix-sdk-crypto.win32-x64-msvc.node" + : process.arch === "ia32" + ? "matrix-sdk-crypto.win32-ia32-msvc.node" + : process.arch === "arm64" + ? "matrix-sdk-crypto.win32-arm64-msvc.node" + : null; + default: + return null; + } +} + describe("ensureMatrixCryptoRuntime", () => { it("returns immediately when matrix SDK loads", async () => { const runCommand = vi.fn(); @@ -71,4 +116,47 @@ describe("ensureMatrixCryptoRuntime", () => { expect(runCommand).not.toHaveBeenCalled(); expect(requireFn).toHaveBeenCalledTimes(1); }); + + it("removes an incomplete native binding before loading the matrix SDK", async () => { + const nativeBindingFilename = resolveTestNativeBindingFilename(); + if (!nativeBindingFilename) { + return; + } + + const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "matrix-crypto-runtime-")); + const scriptPath = path.join(tmpDir, "download-lib.js"); + const nativeBindingPath = path.join(tmpDir, nativeBindingFilename); + fs.writeFileSync(scriptPath, ""); + fs.writeFileSync(nativeBindingPath, Buffer.alloc(16)); + + let bootstrapped = false; + const requireFn = vi.fn(() => { + if (!bootstrapped) { + throw new Error( + "Cannot find module '@matrix-org/matrix-sdk-crypto-nodejs-linux-x64-gnu' (required by matrix sdk)", + ); + } + return {}; + }); + const runCommand = vi.fn(async () => { + bootstrapped = true; + fs.writeFileSync(nativeBindingPath, Buffer.alloc(1_000_000)); + return { code: 0, stdout: "", stderr: "" }; + }); + + await ensureMatrixCryptoRuntime({ + log: logStub, + requireFn, + runCommand, + resolveFn: () => scriptPath, + nodeExecutable: "/usr/bin/node", + }); + + expect(runCommand).toHaveBeenCalledTimes(1); + expect(requireFn).toHaveBeenCalledTimes(2); + expect(fs.statSync(nativeBindingPath).size).toBe(1_000_000); + expect(logStub).toHaveBeenCalledWith( + "matrix: removed incomplete native crypto runtime (16 bytes); it will be downloaded again", + ); + }); }); diff --git a/extensions/matrix/src/matrix/deps.ts b/extensions/matrix/src/matrix/deps.ts index a43aab8df2c..cb0f42c49c6 100644 --- a/extensions/matrix/src/matrix/deps.ts +++ b/extensions/matrix/src/matrix/deps.ts @@ -11,6 +11,7 @@ const REQUIRED_MATRIX_PACKAGES = [ "@matrix-org/matrix-sdk-crypto-nodejs", "@matrix-org/matrix-sdk-crypto-wasm", ]; +const MIN_MATRIX_CRYPTO_NATIVE_BINDING_BYTES = 1_000_000; type MatrixCryptoRuntimeDeps = { requireFn?: (id: string) => unknown; @@ -85,6 +86,11 @@ async function runFixedCommandWithTimeout(params: { let stderr = ""; let settled = false; let timer: NodeJS.Timeout | null = null; + const killChildOnExit = () => { + if (!settled && proc.exitCode === null) { + proc.kill("SIGTERM"); + } + }; const finalize = (result: CommandResult) => { if (settled) { @@ -94,8 +100,10 @@ async function runFixedCommandWithTimeout(params: { if (timer) { clearTimeout(timer); } + process.off("exit", killChildOnExit); resolve(result); }; + process.once("exit", killChildOnExit); proc.stdout?.on("data", (chunk: Buffer | string) => { stdout += chunk.toString(); @@ -148,6 +156,93 @@ function isMissingMatrixCryptoRuntimeError(error: unknown): boolean { ); } +function isMuslRuntime(): boolean { + try { + const report = process.report?.getReport?.() as + | { header?: { glibcVersionRuntime?: string } } + | undefined; + return !report?.header?.glibcVersionRuntime; + } catch { + return true; + } +} + +function resolveMatrixCryptoNativeBindingFilename(): string | null { + switch (process.platform) { + case "darwin": + return process.arch === "arm64" + ? "matrix-sdk-crypto.darwin-arm64.node" + : process.arch === "x64" + ? "matrix-sdk-crypto.darwin-x64.node" + : null; + case "linux": + if (process.arch === "x64") { + return isMuslRuntime() + ? "matrix-sdk-crypto.linux-x64-musl.node" + : "matrix-sdk-crypto.linux-x64-gnu.node"; + } + if (process.arch === "arm64" && !isMuslRuntime()) { + return "matrix-sdk-crypto.linux-arm64-gnu.node"; + } + if (process.arch === "arm") { + return "matrix-sdk-crypto.linux-arm-gnueabihf.node"; + } + if (process.arch === "s390x") { + return "matrix-sdk-crypto.linux-s390x-gnu.node"; + } + return null; + case "win32": + return process.arch === "x64" + ? "matrix-sdk-crypto.win32-x64-msvc.node" + : process.arch === "ia32" + ? "matrix-sdk-crypto.win32-ia32-msvc.node" + : process.arch === "arm64" + ? "matrix-sdk-crypto.win32-arm64-msvc.node" + : null; + default: + return null; + } +} + +function resolveMatrixCryptoNativeBindingPath(resolveFn: (id: string) => string): string | null { + const filename = resolveMatrixCryptoNativeBindingFilename(); + if (!filename) { + return null; + } + try { + return path.join( + path.dirname(resolveFn("@matrix-org/matrix-sdk-crypto-nodejs/download-lib.js")), + filename, + ); + } catch { + return null; + } +} + +function removeIncompleteMatrixCryptoNativeBinding(params: { + bindingPath: string | null; + log?: (message: string) => void; +}): void { + const bindingPath = params.bindingPath; + if (!bindingPath) { + return; + } + try { + const stat = fs.statSync(bindingPath); + if (!stat.isFile() || stat.size >= MIN_MATRIX_CRYPTO_NATIVE_BINDING_BYTES) { + return; + } + fs.unlinkSync(bindingPath); + params.log?.( + `matrix: removed incomplete native crypto runtime (${stat.size} bytes); it will be downloaded again`, + ); + } catch (error) { + if ((error as NodeJS.ErrnoException).code !== "ENOENT") { + throw error; + } + } +} + export async function ensureMatrixCryptoRuntime( params: MatrixCryptoRuntimeDeps = {}, ): Promise { @@ -170,6 +265,9 @@ export async function ensureMatrixCryptoRuntime( } async function ensureMatrixCryptoRuntimeOnce(params: MatrixCryptoRuntimeDeps): Promise { + const resolveFn = params.resolveFn ?? defaultResolveFn; + const nativeBindingPath = resolveMatrixCryptoNativeBindingPath(resolveFn); + removeIncompleteMatrixCryptoNativeBinding({ bindingPath: nativeBindingPath, log: params.log }); const requireFn = params.requireFn ?? defaultRequireFn; try { requireFn("@matrix-org/matrix-sdk-crypto-nodejs"); @@ -180,7 +278,6 @@ async function ensureMatrixCryptoRuntimeOnce(params: MatrixCryptoRuntimeDeps): P } } - const resolveFn = params.resolveFn ?? defaultResolveFn; const scriptPath = resolveFn("@matrix-org/matrix-sdk-crypto-nodejs/download-lib.js"); params.log?.("matrix: bootstrapping native crypto runtime"); const runCommand = params.runCommand ?? runFixedCommandWithTimeout; @@ -192,11 +289,13 @@ async function ensureMatrixCryptoRuntimeOnce(params: MatrixCryptoRuntimeDeps): P env: { COREPACK_ENABLE_DOWNLOAD_PROMPT: "0" }, }); if (result.code !== 0) { + removeIncompleteMatrixCryptoNativeBinding({ bindingPath: nativeBindingPath, log: params.log }); throw new Error( result.stderr.trim() || result.stdout.trim() || "Matrix crypto runtime bootstrap failed.", ); } + removeIncompleteMatrixCryptoNativeBinding({ bindingPath: nativeBindingPath, log: params.log }); requireFn("@matrix-org/matrix-sdk-crypto-nodejs"); } diff --git a/extensions/matrix/src/matrix/monitor/events.test.ts b/extensions/matrix/src/matrix/monitor/events.test.ts index f8b0b8cb4f1..998f2481600 100644 --- a/extensions/matrix/src/matrix/monitor/events.test.ts +++ b/extensions/matrix/src/matrix/monitor/events.test.ts @@ -196,6 +196,9 @@ function createHarness(params?: { flushTasks, runDetachedTask, roomMessageListener: listeners.get("room.message") as RoomEventListener | undefined, + roomDecryptedEventListener: listeners.get("room.decrypted_event") as + | RoomEventListener + | undefined, failedDecryptListener: listeners.get("room.failed_decryption") as | FailedDecryptListener | undefined, @@ -402,6 +405,29 @@ describe("registerMatrixMonitorEvents verification routing", () => { expect(body).toContain('Open "Verify by emoji"'); }); + it("routes late-decrypted room messages through the normal room handler", async () => { + const { onRoomMessage, roomDecryptedEventListener, flushTasks } = createHarness(); + if (!roomDecryptedEventListener) { + throw new Error("room.decrypted_event listener was not registered"); + } + const event: MatrixRawEvent = { + event_id: "$decrypted1", + sender: "@alice:example.org", + type: EventType.RoomMessage, + origin_server_ts: Date.now(), + content: { + msgtype: "m.text", + body: "@bot late decrypt trigger", + }, + }; + + roomDecryptedEventListener("!room:example.org", event); + + await flushTasks(); + expect(onRoomMessage).toHaveBeenCalledTimes(1); + expect(onRoomMessage).toHaveBeenCalledWith("!room:example.org", event); + }); + it("blocks verification request notices when dmPolicy pairing would block the sender", async () => { const { onRoomMessage, sendMessage, roomMessageListener, logVerboseMessage, flushTasks } = createHarness({ diff --git a/extensions/matrix/src/matrix/monitor/events.ts b/extensions/matrix/src/matrix/monitor/events.ts index 64b9b6c8d93..4389583dddb 100644 --- a/extensions/matrix/src/matrix/monitor/events.ts +++ b/extensions/matrix/src/matrix/monitor/events.ts @@ -256,6 +256,18 @@ export function registerMatrixMonitorEvents(params: { const eventId = event?.event_id ?? "unknown"; const eventType = event?.type ?? "unknown"; logVerboseMessage(`matrix: decrypted event room=${roomId} type=${eventType} id=${eventId}`); + if (routeVerificationEvent(roomId, event)) { + return; + } + if (eventType !== EventType.RoomMessage) { + return; + } + void runMonitorTask( + `decrypted room message handler room=${roomId} id=${event.event_id ?? "unknown"}`, + async () => { + await onRoomMessage(roomId, event); + }, + ); }); client.on( diff --git a/extensions/matrix/src/matrix/sdk.test.ts b/extensions/matrix/src/matrix/sdk.test.ts index 5afa07b896e..36f5acf5207 100644 --- a/extensions/matrix/src/matrix/sdk.test.ts +++ b/extensions/matrix/src/matrix/sdk.test.ts @@ -51,15 +51,16 @@ class FakeMatrixEvent extends EventEmitter { private readonly roomId: string; private readonly eventId: string; private readonly sender: string; - private readonly type: string; + private type: string; private readonly ts: number; - private readonly content: Record; + private content: Record; private readonly stateKey?: string; private readonly unsigned?: { age?: number; redacted_because?: unknown; }; - private readonly decryptionFailure: boolean; + readonly decryptionFailureReason?: string; + private decryptionFailure: boolean; constructor(params: { roomId: string; @@ -74,6 +75,7 @@ class FakeMatrixEvent extends EventEmitter { redacted_because?: unknown; }; decryptionFailure?: boolean; + decryptionFailureReason?: string; }) { super(); this.roomId = params.roomId; @@ -84,6 +86,7 @@ class FakeMatrixEvent extends EventEmitter { this.content = params.content; this.stateKey = params.stateKey; this.unsigned = params.unsigned; + this.decryptionFailureReason = params.decryptionFailureReason; this.decryptionFailure = params.decryptionFailure === true; } @@ -122,6 +125,12 @@ class FakeMatrixEvent extends EventEmitter { isDecryptionFailure(): boolean { return this.decryptionFailure; } + + markDecrypted(params: { type: string; content: Record }): void { + this.type = params.type; + this.content = params.content; + this.decryptionFailure = false; + } } type MatrixJsClientStub = { @@ -249,6 +258,7 @@ vi.mock("matrix-js-sdk/lib/matrix.js", async () => { }); const { encodeRecoveryKey } = await import("matrix-js-sdk/lib/crypto-api/recovery-key.js"); +const { DecryptionFailureCode } = await import("matrix-js-sdk/lib/crypto-api/index.js"); const { MatrixClient } = await import("./sdk.js"); describe("MatrixClient request hardening", () => { @@ -862,6 +872,128 @@ describe("MatrixClient event bridge", () => { expect(delivered).toEqual(["m.room.message"]); }); + it("does not keep retrying terminal historical decryption failures", async () => { + vi.useFakeTimers(); + const client = new MatrixClient("https://matrix.example.org", "token"); + const failed: string[] = []; + + client.on("room.failed_decryption", (_roomId, _event, error) => { + failed.push(error.message); + }); + + const encrypted = new FakeMatrixEvent({ + roomId: "!room:example.org", + eventId: "$historical", + sender: "@alice:example.org", + type: "m.room.encrypted", + ts: Date.now() - 60_000, + content: {}, + decryptionFailure: true, + decryptionFailureReason: DecryptionFailureCode.HISTORICAL_MESSAGE_NO_KEY_BACKUP, + }); + + matrixJsClient.decryptEventIfNeeded = vi.fn(async () => {}); + + await client.start(); + matrixJsClient.emit("event", encrypted); + encrypted.emit("decrypted", encrypted, new Error("historical key missing")); + + await vi.advanceTimersByTimeAsync(60_000); + + expect(failed).toEqual(["historical key missing"]); + expect(matrixJsClient.decryptEventIfNeeded).not.toHaveBeenCalled(); + }); + + it("emits a recovered message when decrypt retry succeeds without a second SDK decrypted event", async () => { + vi.useFakeTimers(); + const client = new MatrixClient("https://matrix.example.org", "token", { + encryption: true, + }); + const delivered: string[] = []; + + client.on("room.message", (_roomId, event) => { + delivered.push(event.type); + }); + + const encrypted = new FakeMatrixEvent({ + roomId: "!room:example.org", + eventId: "$event", + sender: "@alice:example.org", + type: "m.room.encrypted", + ts: Date.now(), + content: {}, + decryptionFailure: true, + }); + + matrixJsClient.decryptEventIfNeeded = vi.fn(async () => { + encrypted.markDecrypted({ + type: "m.room.message", + content: { + msgtype: "m.text", + body: "hello", + }, + }); + }); + + await client.start(); + matrixJsClient.emit("event", encrypted); + encrypted.emit("decrypted", encrypted, new Error("missing room key")); + + expect(delivered).toHaveLength(0); + + await vi.advanceTimersByTimeAsync(1_500); + + expect(matrixJsClient.decryptEventIfNeeded).toHaveBeenCalledTimes(1); + expect(delivered).toEqual(["m.room.message"]); + }); + + it("retries encrypted events that already failed before the bridge attaches", async () => { + vi.useFakeTimers(); + const client = new MatrixClient("https://matrix.example.org", "token", { + encryption: true, + }); + const failed: string[] = []; + const delivered: string[] = []; + + client.on("room.failed_decryption", (_roomId, _event, error) => { + failed.push(error.message); + }); + client.on("room.message", (_roomId, event) => { + delivered.push(event.type); + }); + + const encrypted = new FakeMatrixEvent({ + roomId: "!room:example.org", + eventId: "$event", + sender: "@alice:example.org", + type: "m.room.encrypted", + ts: Date.now(), + content: {}, + decryptionFailure: true, + }); + + matrixJsClient.decryptEventIfNeeded = vi.fn(async () => { + encrypted.markDecrypted({ + type: "m.room.message", + content: { + msgtype: "m.text", + body: "hello", + }, + }); + }); + + await client.start(); + matrixJsClient.emit("event", encrypted); + + expect(failed).toHaveLength(0); + expect(delivered).toHaveLength(0); + + await vi.advanceTimersByTimeAsync(1_500); + + expect(matrixJsClient.decryptEventIfNeeded).toHaveBeenCalledTimes(1); + expect(delivered).toEqual(["m.room.message"]); + }); + it("stops decryption retries after hitting retry cap", async () => { vi.useFakeTimers(); const client = new MatrixClient("https://matrix.example.org", "token"); @@ -894,8 +1026,11 @@ describe("MatrixClient event bridge", () => { await vi.advanceTimersByTimeAsync(200_000); expect(matrixJsClient.decryptEventIfNeeded).toHaveBeenCalledTimes(8); + encrypted.emit("decrypted", encrypted, new Error("missing room key again")); + await vi.advanceTimersByTimeAsync(200_000); expect(matrixJsClient.decryptEventIfNeeded).toHaveBeenCalledTimes(8); + expect(failed).toEqual(["missing room key"]); }); it("does not start duplicate retries when crypto signals fire while retry is in-flight", async () => { @@ -1502,9 +1637,9 @@ describe("MatrixClient crypto bootstrapping", () => { }); }); - it("schedules periodic crypto snapshot persistence with fake timers", async () => { - vi.useFakeTimers(); + it("schedules periodic crypto snapshot persistence", async () => { const databasesSpy = vi.spyOn(indexedDB, "databases").mockResolvedValue([]); + const setIntervalSpy = vi.spyOn(globalThis, "setInterval"); const client = new MatrixClient("https://matrix.example.org", "token", { encryption: true, @@ -1513,17 +1648,10 @@ describe("MatrixClient crypto bootstrapping", () => { }); await client.start(); - const callsAfterStart = databasesSpy.mock.calls.length; - - await vi.advanceTimersByTimeAsync(60_000); - await vi.waitFor(() => { - expect(databasesSpy.mock.calls.length).toBeGreaterThan(callsAfterStart); - }); + expect(databasesSpy).toHaveBeenCalled(); + expect(setIntervalSpy).toHaveBeenCalledWith(expect.any(Function), 60_000); client.stop(); - const callsAfterStop = databasesSpy.mock.calls.length; - await vi.advanceTimersByTimeAsync(120_000); - expect(databasesSpy.mock.calls.length).toBe(callsAfterStop); }); it("reports own verification status when crypto marks device as verified", async () => { @@ -1609,6 +1737,63 @@ describe("MatrixClient crypto bootstrapping", () => { expect(status.serverDeviceKnown).toBeNull(); }); + it("reports the current Matrix device missing when the homeserver rejects the token", async () => { + matrixJsClient.getUserId = vi.fn(() => "@bot:example.org"); + matrixJsClient.getDeviceId = vi.fn(() => "DEVICE123"); + matrixJsClient.getDevices = vi.fn(async () => { + throw Object.assign(new Error("M_UNKNOWN_TOKEN: access token invalidated"), { + body: { errcode: "M_UNKNOWN_TOKEN" }, + statusCode: 401, + }); + }); + matrixJsClient.getCrypto = vi.fn(() => ({ + on: vi.fn(), + bootstrapCrossSigning: vi.fn(async () => {}), + bootstrapSecretStorage: vi.fn(async () => {}), + requestOwnUserVerification: vi.fn(async () => null), + getDeviceVerificationStatus: vi.fn(async () => ({ + isVerified: () => true, + localVerified: true, + crossSigningVerified: true, + signedByOwner: true, + })), + })); + + const client = new MatrixClient("https://matrix.example.org", "token", { + encryption: true, + }); + await client.start(); + + const status = await client.getOwnDeviceVerificationStatus(); + expect(status.serverDeviceKnown).toBe(false); + }); + + it("returns degraded verification diagnostics when Matrix SDK status calls stall", async () => { + const client = new MatrixClient("https://matrix.example.org", "token", { + encryption: true, + localTimeoutMs: 1, + }); + vi.spyOn(client, "getRoomKeyBackupStatus").mockImplementation( + async () => await new Promise(() => undefined), + ); + vi.spyOn(client, "getDeviceVerificationStatus").mockImplementation( + async () => await new Promise(() => undefined), + ); + vi.spyOn(client, "listOwnDevices").mockImplementation( + async () => await new Promise(() => undefined), + ); + + const status = await client.getOwnDeviceVerificationStatus(); + + expect(status.userId).toBe("@bot:example.org"); + expect(status.deviceId).toBe("DEVICE123"); + expect(status.verified).toBe(false); + expect(status.crossSigningVerified).toBe(false); + expect(status.backupVersion).toBeNull(); + expect(status.backup.keyLoadAttempted).toBe(false); + expect(status.serverDeviceKnown).toBeNull(); + }); + it("does not treat local-only trust as Matrix identity trust", async () => { matrixJsClient.getUserId = vi.fn(() => "@bot:example.org"); matrixJsClient.getDeviceId = vi.fn(() => "DEVICE123"); @@ -2016,6 +2201,75 @@ describe("MatrixClient crypto bootstrapping", () => { expect(persisted.encodedPrivateKey).toBe(previousEncoded); }); + it("returns recovery-key diagnostics without bootstrapping when backup is already usable", async () => { + const encoded = encodeRecoveryKey(new Uint8Array(Array.from({ length: 32 }, (_, i) => i + 1))); + const bootstrapCrossSigning = vi.fn(async () => { + throw new Error("bootstrap should not run"); + }); + + matrixJsClient.getUserId = vi.fn(() => "@bot:example.org"); + matrixJsClient.getDeviceId = vi.fn(() => "DEVICE123"); + matrixJsClient.getCrypto = vi.fn(() => ({ + on: vi.fn(), + bootstrapCrossSigning, + bootstrapSecretStorage: vi.fn(async () => {}), + requestOwnUserVerification: vi.fn(async () => null), + getSecretStorageStatus: vi.fn(async () => ({ + ready: true, + defaultKeyId: "SSSSKEY", + secretStorageKeyValidityMap: { SSSSKEY: true }, + })), + getDeviceVerificationStatus: vi.fn(async () => ({ + isVerified: () => false, + localVerified: false, + crossSigningVerified: false, + signedByOwner: false, + })), + checkKeyBackupAndEnable: vi.fn(async () => {}), + getActiveSessionBackupVersion: vi.fn(async () => "11"), + getSessionBackupPrivateKey: vi.fn(async () => new Uint8Array([1])), + getKeyBackupInfo: vi.fn(async () => ({ + algorithm: "m.megolm_backup.v1.curve25519-aes-sha2", + auth_data: {}, + version: "11", + })), + isKeyBackupTrusted: vi.fn(async () => ({ + trusted: true, + matchesDecryptionKey: true, + })), + })); + + const recoveryDir = fs.mkdtempSync(path.join(os.tmpdir(), "matrix-sdk-verify-restored-")); + const recoveryKeyPath = path.join(recoveryDir, "recovery-key.json"); + fs.writeFileSync( + recoveryKeyPath, + JSON.stringify({ + version: 1, + createdAt: new Date().toISOString(), + keyId: "SSSSKEY", + encodedPrivateKey: encoded, + privateKeyBase64: Buffer.from( + new Uint8Array(Array.from({ length: 32 }, (_, i) => i + 1)), + ).toString("base64"), + }), + "utf8", + ); + + const client = new MatrixClient("https://matrix.example.org", "token", { + encryption: true, + recoveryKeyPath, + }); + + const result = await client.verifyWithRecoveryKey(encoded as string); + + expect(bootstrapCrossSigning).not.toHaveBeenCalled(); + expect(result.success).toBe(false); + expect(result.recoveryKeyAccepted).toBe(true); + expect(result.backupUsable).toBe(true); + expect(result.deviceOwnerVerified).toBe(false); + expect(result.error).toContain("full Matrix identity trust"); + }); + it("fails recovery-key verification when backup remains untrusted after device verification", async () => { const encoded = encodeRecoveryKey(new Uint8Array(Array.from({ length: 32 }, (_, i) => i + 1))); diff --git a/extensions/matrix/src/matrix/sdk.ts b/extensions/matrix/src/matrix/sdk.ts index dc54714985b..9b3d4ed222d 100644 --- a/extensions/matrix/src/matrix/sdk.ts +++ b/extensions/matrix/src/matrix/sdk.ts @@ -106,6 +106,89 @@ export type MatrixRoomKeyBackupStatus = { keyLoadError: string | null; }; +const MATRIX_STATUS_DIAGNOSTIC_TIMEOUT_MS = 10_000; + +function unresolvedMatrixRoomKeyBackupStatus(): MatrixRoomKeyBackupStatus { + return { + serverVersion: null, + activeVersion: null, + trusted: null, + matchesDecryptionKey: null, + decryptionKeyCached: null, + keyLoadAttempted: false, + keyLoadError: null, + }; +} + +function unresolvedMatrixDeviceVerificationStatus(params: { + userId: string | null; + deviceId: string | null; +}): MatrixDeviceVerificationStatus { + return { + encryptionEnabled: true, + userId: params.userId, + deviceId: params.deviceId, + verified: false, + localVerified: false, + crossSigningVerified: false, + signedByOwner: false, + }; +} + +async function resolveMatrixDiagnostic( + promise: Promise, + timeoutMs: number, +): Promise { + const result = await resolveMatrixDiagnosticResult(promise, timeoutMs); + return result.value; +} + +async function resolveMatrixDiagnosticResult( + promise: Promise, + timeoutMs: number, +): Promise<{ error: unknown; timedOut: boolean; value: T | null }> { + let timeoutId: ReturnType | undefined; + try { + const guarded = promise + .then((value) => ({ error: null, timedOut: false, value })) + .catch((error: unknown) => ({ error, timedOut: false, value: null })); + const timeout = new Promise<{ error: null; timedOut: true; value: null }>((resolve) => { + timeoutId = setTimeout( + () => resolve({ error: null, timedOut: true, value: null }), + timeoutMs, + ); + timeoutId.unref?.(); + }); + return await Promise.race([guarded, timeout]); + } finally { + if (timeoutId) { + clearTimeout(timeoutId); + } + } +} + +function isMatrixAccessTokenInvalidatedError(error: unknown): boolean { + if (!error || typeof error !== "object") { + return false; + } + const err = error as { + body?: { errcode?: string }; + data?: { errcode?: string }; + statusCode?: number; + }; + const errcode = err.body?.errcode ?? err.data?.errcode; + if (err.statusCode === 401 && errcode === "M_UNKNOWN_TOKEN") { + return true; + } + const reason = formatMatrixErrorReason(error); + return ( + reason.includes("m_unknown_token") || + reason.includes("unknown token") || + (reason.includes("access token") && + (reason.includes("invalid") || reason.includes("unrecognized") || reason.includes("unknown"))) + ); +} + export type MatrixRoomKeyBackupRestoreResult = { success: boolean; error?: string; @@ -615,6 +698,12 @@ export class MatrixClient { await this.stopPersistPromise; } + stopWithoutPersist(): void { + this.stopSyncWithoutPersist(); + this.decryptBridge?.stop(); + this.stopPersistPromise = Promise.resolve(); + } + private async bootstrapCryptoIfNeeded(abortSignal?: AbortSignal): Promise { if (!this.encryptionEnabled || !this.cryptoInitialized || this.cryptoBootstrapped) { return; @@ -731,7 +820,9 @@ export class MatrixClient { } async getJoinedRooms(): Promise { - const joined = await this.client.getJoinedRooms(); + const joined = (await this.doRequest("GET", "/_matrix/client/v3/joined_rooms")) as { + joined_rooms?: unknown; + }; return Array.isArray(joined.joined_rooms) ? joined.joined_rooms : []; } @@ -744,6 +835,19 @@ export class MatrixClient { return Object.keys(joined); } + hasSyncedJoinedRoomMember(roomId: string, userId: string): boolean { + const room = ( + this.client as { + getRoom?: (roomId: string) => { + currentState?: { + getMember?: (userId: string) => { membership?: string | null } | null; + }; + } | null; + } + ).getRoom?.(roomId); + return room?.currentState?.getMember?.(userId)?.membership === "join"; + } + async getRoomStateEvent( roomId: string, eventType: string, @@ -1127,23 +1231,34 @@ export class MatrixClient { const recoveryKey = this.recoveryKeyStore.getRecoveryKeySummary(); const userId = this.client.getUserId() ?? this.selfUserId ?? null; const deviceId = this.client.getDeviceId()?.trim() || null; + const diagnosticTimeoutMs = Math.min(this.localTimeoutMs, MATRIX_STATUS_DIAGNOSTIC_TIMEOUT_MS); const [backup, deviceVerification, ownDevices] = await Promise.all([ - this.getRoomKeyBackupStatus(), - this.getDeviceVerificationStatus(userId, deviceId), - this.listOwnDevices().catch(() => null), + resolveMatrixDiagnostic(this.getRoomKeyBackupStatus(), diagnosticTimeoutMs), + resolveMatrixDiagnostic( + this.getDeviceVerificationStatus(userId, deviceId), + diagnosticTimeoutMs, + ), + resolveMatrixDiagnosticResult(this.listOwnDevices(), diagnosticTimeoutMs), ]); + const resolvedBackup = backup ?? unresolvedMatrixRoomKeyBackupStatus(); + const resolvedDeviceVerification = + deviceVerification ?? unresolvedMatrixDeviceVerificationStatus({ userId, deviceId }); const serverDeviceKnown = deviceId - ? (ownDevices?.some((device) => device.deviceId === deviceId) ?? null) + ? ownDevices.value + ? ownDevices.value.some((device) => device.deviceId === deviceId) + : isMatrixAccessTokenInvalidatedError(ownDevices.error) + ? false + : null : null; return { - ...deviceVerification, - verified: deviceVerification.crossSigningVerified, + ...resolvedDeviceVerification, + verified: resolvedDeviceVerification.crossSigningVerified, recoveryKeyStored: Boolean(recoveryKey), recoveryKeyCreatedAt: recoveryKey?.createdAt ?? null, recoveryKeyId: recoveryKey?.keyId ?? null, - backupVersion: backup.serverVersion, - backup, + backupVersion: resolvedBackup.serverVersion, + backup: resolvedBackup, serverDeviceKnown, }; } @@ -1241,6 +1356,61 @@ export class MatrixClient { return await fail(formatMatrixErrorMessage(err)); } + const storedRecoveryKeyMatches = + this.recoveryKeyStore.getRecoveryKeySummary()?.encodedPrivateKey?.trim() === + trimmedRecoveryKey; + if (backupUsableBeforeStagedRecovery && storedRecoveryKeyMatches) { + const status = await this.getOwnDeviceVerificationStatus(); + const backupUsable = + resolveMatrixRoomKeyBackupReadinessError(status.backup, { + requireServerBackup: true, + }) === null; + const backupError = resolveMatrixRoomKeyBackupReadinessError(status.backup, { + requireServerBackup: false, + }); + const recoveryKeyAccepted = backupUsable; + if (!status.verified) { + if (recoveryKeyAccepted) { + this.recoveryKeyStore.commitStagedRecoveryKey({ + keyId: stagedKeyId, + }); + } else { + this.recoveryKeyStore.discardStagedRecoveryKey(); + } + return { + success: false, + recoveryKeyAccepted, + backupUsable, + deviceOwnerVerified: false, + error: + "Matrix recovery key was applied, but this device still lacks full Matrix identity trust. The recovery key can unlock usable backup material only when 'Backup usable' is yes; full identity trust still requires Matrix cross-signing verification.", + ...status, + }; + } + if (backupError) { + this.recoveryKeyStore.discardStagedRecoveryKey(); + return { + success: false, + recoveryKeyAccepted, + backupUsable, + deviceOwnerVerified: true, + error: backupError, + ...status, + }; + } + this.recoveryKeyStore.commitStagedRecoveryKey({ + keyId: stagedKeyId, + }); + return { + success: true, + recoveryKeyAccepted: true, + backupUsable, + deviceOwnerVerified: true, + verifiedAt: new Date().toISOString(), + ...status, + }; + } + try { const cryptoBootstrapper = this.cryptoBootstrapper; if (!cryptoBootstrapper) { @@ -1275,9 +1445,6 @@ export class MatrixClient { !stagedRecoveryKeyConfirmedBySecretStorage && !backupUsableBeforeStagedRecovery && backupUsable; - const storedRecoveryKeyMatches = - this.recoveryKeyStore.getRecoveryKeySummary()?.encodedPrivateKey?.trim() === - trimmedRecoveryKey; const stagedRecoveryKeyValidated = (stagedRecoveryKeyUsed && (stagedRecoveryKeyConfirmedBySecretStorage || stagedRecoveryKeyUnlockedBackup)) || @@ -1585,6 +1752,7 @@ export class MatrixClient { let bootstrapError: string | undefined; let bootstrapSummary: MatrixCryptoBootstrapResult | null = null; + let rawRecoveryKey: string | undefined; try { await this.ensureStartedForCryptoControlPlane(); await this.ensureCryptoSupportInitialized(); @@ -1593,7 +1761,7 @@ export class MatrixClient { throw new Error("Matrix crypto is not available (start client with encryption enabled)"); } - const rawRecoveryKey = params?.recoveryKey?.trim(); + rawRecoveryKey = params?.recoveryKey?.trim(); if (rawRecoveryKey) { this.recoveryKeyStore.stageEncodedRecoveryKey({ encodedPrivateKey: rawRecoveryKey, @@ -1607,7 +1775,12 @@ export class MatrixClient { } bootstrapSummary = await cryptoBootstrapper.bootstrap( crypto, - createMatrixExplicitBootstrapOptions(params), + createMatrixExplicitBootstrapOptions({ + ...params, + allowAutomaticCrossSigningReset: rawRecoveryKey + ? false + : params?.allowAutomaticCrossSigningReset, + }), ); await this.ensureRoomKeyBackupEnabled(crypto); } catch (err) { @@ -1625,6 +1798,7 @@ export class MatrixClient { const backupError = verificationError === null ? resolveMatrixRoomKeyBackupReadinessError(verification.backup, { + allowUntrustedMatchingKey: Boolean(rawRecoveryKey), requireServerBackup: true, }) : null; diff --git a/extensions/matrix/src/matrix/sdk/decrypt-bridge.ts b/extensions/matrix/src/matrix/sdk/decrypt-bridge.ts index 411a09169e1..ed17317783f 100644 --- a/extensions/matrix/src/matrix/sdk/decrypt-bridge.ts +++ b/extensions/matrix/src/matrix/sdk/decrypt-bridge.ts @@ -1,4 +1,5 @@ import { CryptoEvent } from "matrix-js-sdk/lib/crypto-api/CryptoEvent.js"; +import { DecryptionFailureCode } from "matrix-js-sdk/lib/crypto-api/index.js"; import { MatrixEventEvent, type MatrixEvent } from "matrix-js-sdk/lib/matrix.js"; import { LogService, noop } from "./logger.js"; @@ -46,11 +47,34 @@ function isDecryptionFailure(event: MatrixEvent): boolean { ); } +function getDecryptionFailureReason(event: MatrixEvent): DecryptionFailureCode | null { + const reason = (event as { decryptionFailureReason?: unknown }).decryptionFailureReason; + return typeof reason === "string" && reason in DecryptionFailureCode + ? (reason as DecryptionFailureCode) + : null; +} + +function shouldRetryDecryptionFailure(event: MatrixEvent): boolean { + if (!isDecryptionFailure(event)) { + return false; + } + const reason = getDecryptionFailureReason(event); + if (!reason) { + return true; + } + return ( + reason === DecryptionFailureCode.MEGOLM_UNKNOWN_INBOUND_SESSION_ID || + reason === DecryptionFailureCode.OLM_UNKNOWN_MESSAGE_INDEX || + reason === DecryptionFailureCode.UNKNOWN_ERROR + ); +} + export class MatrixDecryptBridge { private readonly trackedEncryptedEvents = new WeakSet(); private readonly decryptedMessageDedupe = new Map(); private readonly decryptRetries = new Map(); private readonly failedDecryptionsNotified = new Set(); + private readonly exhaustedDecryptRetries = new Set(); private activeRetryRuns = 0; private readonly retryIdleResolvers = new Set<() => void>(); private cryptoRetrySignalsBound = false; @@ -91,6 +115,11 @@ export class MatrixDecryptBridge { err, }); }); + if (shouldRetryDecryptionFailure(event)) { + const raw = this.deps.toRaw(event); + const eventId = raw.event_id || event.getId() || ""; + this.scheduleDecryptRetry({ event, roomId, eventId }); + } } retryPendingNow(reason: string): void { @@ -170,11 +199,15 @@ export class MatrixDecryptBridge { if (params.err) { this.emitFailedDecryptionOnce(retryKey, decryptedRoomId, decryptedRaw, params.err); - this.scheduleDecryptRetry({ - event: params.encryptedEvent, - roomId: decryptedRoomId, - eventId: retryEventId, - }); + if (shouldRetryDecryptionFailure(params.decryptedEvent)) { + this.scheduleDecryptRetry({ + event: params.encryptedEvent, + roomId: decryptedRoomId, + eventId: retryEventId, + }); + } else if (retryKey) { + this.clearDecryptRetry(retryKey); + } return; } @@ -185,11 +218,15 @@ export class MatrixDecryptBridge { decryptedRaw, new Error("Matrix event failed to decrypt"), ); - this.scheduleDecryptRetry({ - event: params.encryptedEvent, - roomId: decryptedRoomId, - eventId: retryEventId, - }); + if (shouldRetryDecryptionFailure(params.decryptedEvent)) { + this.scheduleDecryptRetry({ + event: params.encryptedEvent, + roomId: decryptedRoomId, + eventId: retryEventId, + }); + } else if (retryKey) { + this.clearDecryptRetry(retryKey); + } return; } @@ -226,12 +263,20 @@ export class MatrixDecryptBridge { return; } const existing = this.decryptRetries.get(retryKey); + if (this.exhaustedDecryptRetries.has(retryKey)) { + return; + } if (existing?.timer || existing?.inFlight) { return; } const attempts = (existing?.attempts ?? 0) + 1; if (attempts > MATRIX_DECRYPT_RETRY_MAX_ATTEMPTS) { - this.clearDecryptRetry(retryKey); + const retry = this.decryptRetries.get(retryKey); + if (retry?.timer) { + clearTimeout(retry.timer); + } + this.decryptRetries.delete(retryKey); + this.exhaustedDecryptRetries.add(retryKey); LogService.debug( "MatrixClientLite", `Giving up decryption retry for ${params.eventId} in ${params.roomId} after ${attempts - 1} attempts`, @@ -289,11 +334,19 @@ export class MatrixDecryptBridge { return; } if (isDecryptionFailure(state.event)) { + if (!shouldRetryDecryptionFailure(state.event)) { + this.clearDecryptRetry(retryKey); + return; + } this.scheduleDecryptRetry(state); return; } this.clearDecryptRetry(retryKey); + const raw = this.deps.toRaw(state.event); + this.rememberDecryptedMessage(state.roomId, raw.event_id); + this.deps.emitDecryptedEvent(state.roomId, raw); + this.deps.emitMessage(state.roomId, raw); } private clearDecryptRetry(retryKey: string): void { @@ -302,6 +355,7 @@ export class MatrixDecryptBridge { clearTimeout(state.timer); } this.decryptRetries.delete(retryKey); + this.exhaustedDecryptRetries.delete(retryKey); this.failedDecryptionsNotified.delete(retryKey); } diff --git a/extensions/matrix/src/onboarding.test-harness.ts b/extensions/matrix/src/onboarding.test-harness.ts index 8c3dc3f925a..79e9de59fa7 100644 --- a/extensions/matrix/src/onboarding.test-harness.ts +++ b/extensions/matrix/src/onboarding.test-harness.ts @@ -295,6 +295,7 @@ export function createMatrixNamedAccountsConfig(params: { { homeserver: string; accessToken?: string; + encryption?: boolean; } >; }): CoreConfig { diff --git a/extensions/matrix/src/setup-bootstrap.ts b/extensions/matrix/src/setup-bootstrap.ts index 4c893824f7f..caf29c9468a 100644 --- a/extensions/matrix/src/setup-bootstrap.ts +++ b/extensions/matrix/src/setup-bootstrap.ts @@ -22,10 +22,15 @@ export async function maybeBootstrapNewEncryptedMatrixAccount(params: { cfg: params.cfg, accountId: params.accountId, }); + const previousAccountConfig = resolveMatrixAccountConfig({ + cfg: params.previousCfg, + accountId: params.accountId, + }); if ( - hasExplicitMatrixAccountConfig(params.previousCfg, params.accountId) || - accountConfig.encryption !== true + accountConfig.encryption !== true || + (hasExplicitMatrixAccountConfig(params.previousCfg, params.accountId) && + previousAccountConfig.encryption === true) ) { return { attempted: false, @@ -36,7 +41,10 @@ export async function maybeBootstrapNewEncryptedMatrixAccount(params: { } try { - const bootstrap = await bootstrapMatrixVerification({ accountId: params.accountId }); + const bootstrap = await bootstrapMatrixVerification({ + accountId: params.accountId, + cfg: params.cfg, + }); return { attempted: true, success: bootstrap.success, diff --git a/extensions/qa-lab/src/providers/mock-openai/server.test.ts b/extensions/qa-lab/src/providers/mock-openai/server.test.ts index 144b8fcee48..dfd10dd1460 100644 --- a/extensions/qa-lab/src/providers/mock-openai/server.test.ts +++ b/extensions/qa-lab/src/providers/mock-openai/server.test.ts @@ -1578,6 +1578,129 @@ describe("qa mock openai server", () => { }); }); + it("uses exact marker directives from request context when the latest user text is generic", async () => { + const server = await startQaMockOpenAiServer({ + host: "127.0.0.1", + port: 0, + }); + cleanups.push(async () => { + await server.stop(); + }); + + const response = await fetch(`${server.baseUrl}/v1/responses`, { + method: "POST", + headers: { + "content-type": "application/json", + }, + body: JSON.stringify({ + stream: false, + input: [ + { + role: "user", + content: [ + { + type: "input_text", + text: "@qa-sut:matrix-qa.test reply with only this exact marker: MATRIX_QA_CANARY_TEST", + }, + ], + }, + { + role: "user", + content: [ + { + type: "input_text", + text: "Continue with the QA scenario plan and report worked, failed, and blocked items.", + }, + ], + }, + ], + }), + }); + + expect(response.status).toBe(200); + expect(await response.json()).toMatchObject({ + output: [ + { + content: [{ text: "MATRIX_QA_CANARY_TEST" }], + }, + ], + }); + }); + + it("uses image generation directives from request context when the latest user text is generic", async () => { + const server = await startQaMockOpenAiServer({ + host: "127.0.0.1", + port: 0, + }); + cleanups.push(async () => { + await server.stop(); + }); + + const matrixPrompt = + "@qa-sut:matrix-qa.test Image generation check: generate a QA lighthouse image and summarize it in one short sentence."; + const genericPrompt = + "Continue with the QA scenario plan and report worked, failed, and blocked items."; + + const toolPlan = await fetch(`${server.baseUrl}/v1/responses`, { + method: "POST", + headers: { + "content-type": "application/json", + }, + body: JSON.stringify({ + stream: false, + input: [makeUserInput(matrixPrompt), makeUserInput(genericPrompt)], + }), + }); + + expect(toolPlan.status).toBe(200); + expect(await toolPlan.json()).toMatchObject({ + output: [ + { + type: "function_call", + name: "image_generate", + arguments: expect.stringContaining("qa-lighthouse.png"), + }, + ], + }); + + const toolResult = await fetch(`${server.baseUrl}/v1/responses`, { + method: "POST", + headers: { + "content-type": "application/json", + }, + body: JSON.stringify({ + stream: false, + input: [ + makeUserInput(matrixPrompt), + makeUserInput(genericPrompt), + { + type: "function_call", + name: "image_generate", + call_id: "call_mock_image_generate_1", + arguments: JSON.stringify({ + prompt: "A QA lighthouse", + filename: "qa-lighthouse.png", + }), + }, + { + type: "function_call_output", + call_id: "call_mock_image_generate_1", + output: "MEDIA:/tmp/qa-lighthouse.png", + }, + ], + }), + }); + + expect(toolResult.status).toBe(200); + expect(await toolResult.json()).toMatchObject({ + output: [ + { + content: [{ text: expect.stringContaining("MEDIA:/tmp/qa-lighthouse.png") }], + }, + ], + }); + }); + it("records image inputs and describes attached images", async () => { const server = await startQaMockOpenAiServer({ host: "127.0.0.1", diff --git a/extensions/qa-lab/src/providers/mock-openai/server.ts b/extensions/qa-lab/src/providers/mock-openai/server.ts index 290feb96f58..a6c3aa9d385 100644 --- a/extensions/qa-lab/src/providers/mock-openai/server.ts +++ b/extensions/qa-lab/src/providers/mock-openai/server.ts @@ -150,6 +150,7 @@ const QA_BLOCK_STREAMING_PROMPT_RE = /block streaming qa check/i; const QA_SUBAGENT_DIRECT_FALLBACK_PROMPT_RE = /subagent direct fallback qa check/i; const QA_SUBAGENT_DIRECT_FALLBACK_WORKER_RE = /subagent direct fallback worker/i; const QA_SUBAGENT_DIRECT_FALLBACK_MARKER = "QA-SUBAGENT-DIRECT-FALLBACK-OK"; +const QA_IMAGE_GENERATION_PROMPT_RE = /image generation check|capability flip image check/i; const QA_REASONING_ONLY_RETRY_NEEDLE = "recorded reasoning but did not produce a user-visible answer"; const QA_EMPTY_RESPONSE_RETRY_NEEDLE = @@ -671,10 +672,10 @@ function buildAssistantText( const mediaPath = /MEDIA:([^\n]+)/.exec(toolOutput)?.[1]?.trim(); const exactReplyDirective = extractExactReplyDirective(prompt) ?? extractExactReplyDirective(allInputText); - const finishExactlyDirective = - extractFinishExactlyDirective(prompt) ?? extractFinishExactlyDirective(allInputText); const exactMarkerDirective = extractExactMarkerDirective(prompt) ?? extractExactMarkerDirective(allInputText); + const finishExactlyDirective = + extractFinishExactlyDirective(prompt) ?? extractFinishExactlyDirective(allInputText); const imageInputCount = countImageInputs(input); const activeMemorySummary = extractActiveMemorySummary(allInputText); const snackPreference = extractSnackPreference(activeMemorySummary ?? memorySnippet); @@ -703,10 +704,10 @@ function buildAssistantText( if (isHeartbeatPrompt(prompt)) { return "HEARTBEAT_OK"; } - if (/\bmarker\b/i.test(prompt) && exactReplyDirective) { + if (/\bmarker\b/i.test(allInputText) && exactReplyDirective) { return exactReplyDirective; } - if (/\bmarker\b/i.test(prompt) && exactMarkerDirective) { + if (/\bmarker\b/i.test(allInputText) && exactMarkerDirective) { return exactMarkerDirective; } if (/visible skill marker/i.test(prompt)) { @@ -753,7 +754,7 @@ function buildAssistantText( if (/switch(?:ing)? models?/i.test(prompt)) { return `Protocol note: model switch acknowledged. Continuing on ${model || "the requested model"}.`; } - if (/(image generation check|capability flip image check)/i.test(prompt) && mediaPath) { + if (QA_IMAGE_GENERATION_PROMPT_RE.test(allInputText) && mediaPath) { return `Protocol note: generated the QA lighthouse image successfully.\nMEDIA:${mediaPath}`; } if (QA_SKILL_WORKSHOP_GIF_PROMPT_RE.test(prompt) && toolOutput) { @@ -1146,6 +1147,8 @@ async function buildResponsesPayload( const allInputText = extractAllRequestTexts(input, body); const exactReplyDirective = extractExactReplyDirective(prompt) ?? extractExactReplyDirective(allInputText); + const exactMarkerDirective = + extractExactMarkerDirective(prompt) ?? extractExactMarkerDirective(allInputText); const firstExactMarkerDirective = extractLabeledMarkerDirective( allInputText, "first exact marker", @@ -1269,6 +1272,12 @@ async function buildResponsesPayload( }, ]); } + if (/\bmarker\b/i.test(allInputText) && exactReplyDirective) { + return buildAssistantEvents(exactReplyDirective); + } + if (/\bmarker\b/i.test(allInputText) && exactMarkerDirective) { + return buildAssistantEvents(exactMarkerDirective); + } if (QA_SKILL_WORKSHOP_REVIEW_PROMPT_RE.test(allInputText)) { return buildAssistantEvents( JSON.stringify({ @@ -1485,7 +1494,7 @@ async function buildResponsesPayload( }); } } - if (/(image generation check|capability flip image check)/i.test(prompt) && !toolOutput) { + if (QA_IMAGE_GENERATION_PROMPT_RE.test(allInputText) && !toolOutput) { return buildToolCallEventsWithArgs("image_generate", { prompt: "A QA lighthouse on a dark sea with a tiny protocol droid silhouette.", filename: "qa-lighthouse.png", diff --git a/extensions/qa-matrix/src/runners/contract/runtime.test.ts b/extensions/qa-matrix/src/runners/contract/runtime.test.ts index 4769320b62b..3b7c781d713 100644 --- a/extensions/qa-matrix/src/runners/contract/runtime.test.ts +++ b/extensions/qa-matrix/src/runners/contract/runtime.test.ts @@ -491,26 +491,81 @@ describe("matrix live qa runtime", () => { expect(report).toContain("observed events: /tmp/observed.json"); }); - it("batches Matrix scenarios by config key while preserving stable in-group order", () => { + it("keeps Matrix scenario execution in catalog order across config changes", () => { const scenarios = liveTesting.findMatrixQaScenarios([ - "matrix-top-level-reply-shape", - "matrix-room-thread-reply-override", - "matrix-thread-follow-up", - "matrix-room-quiet-streaming-preview", - "matrix-reaction-notification", + "matrix-e2ee-cli-encryption-setup-multi-account", + "matrix-e2ee-cli-setup-then-gateway-reply", + "matrix-e2ee-cli-self-verification", ]); expect( - liveTesting.scheduleMatrixQaScenariosByConfig(scenarios).map(({ scenario }) => scenario.id), + liveTesting + .scheduleMatrixQaScenariosInCatalogOrder(scenarios) + .map(({ scenario }) => scenario.id), ).toEqual([ - "matrix-thread-follow-up", - "matrix-top-level-reply-shape", - "matrix-reaction-notification", - "matrix-room-thread-reply-override", - "matrix-room-quiet-streaming-preview", + "matrix-e2ee-cli-encryption-setup-multi-account", + "matrix-e2ee-cli-setup-then-gateway-reply", + "matrix-e2ee-cli-self-verification", ]); }); + it("uses the scenario timeout for post-restart Matrix readiness", () => { + expect( + liveTesting.getMatrixQaScenarioRestartReadyTimeoutMs({ + timeoutMs: 180_000, + }), + ).toBe(180_000); + }); + + it("retries Matrix gateway config patches after a stale config hash", async () => { + const patch = { + channels: { + matrix: { + enabled: true, + }, + }, + }; + const gateway = { + call: vi + .fn() + .mockResolvedValueOnce({ hash: "hash-old" }) + .mockRejectedValueOnce( + new Error("config changed since last load; re-run config.get and retry"), + ) + .mockResolvedValueOnce({ hash: "hash-fresh" }) + .mockResolvedValueOnce(undefined), + }; + + await liveTesting.patchMatrixQaGatewayConfig({ + gateway: gateway as never, + patch, + restartDelayMs: 250, + }); + + expect(gateway.call).toHaveBeenNthCalledWith(1, "config.get", {}, { timeoutMs: 60_000 }); + expect(gateway.call).toHaveBeenNthCalledWith( + 2, + "config.patch", + { + baseHash: "hash-old", + raw: JSON.stringify(patch, null, 2), + restartDelayMs: 250, + }, + { timeoutMs: 60_000 }, + ); + expect(gateway.call).toHaveBeenNthCalledWith(3, "config.get", {}, { timeoutMs: 60_000 }); + expect(gateway.call).toHaveBeenNthCalledWith( + 4, + "config.patch", + { + baseHash: "hash-fresh", + raw: JSON.stringify(patch, null, 2), + restartDelayMs: 250, + }, + { timeoutMs: 60_000 }, + ); + }); + it("treats only connected, healthy Matrix accounts as ready", () => { expect(liveTesting.isMatrixAccountReady({ running: true, connected: true })).toBe(true); expect(liveTesting.isMatrixAccountReady({ running: true, connected: false })).toBe(false); diff --git a/extensions/qa-matrix/src/runners/contract/runtime.ts b/extensions/qa-matrix/src/runners/contract/runtime.ts index eaf5ad806a1..216a9edd9bf 100644 --- a/extensions/qa-matrix/src/runners/contract/runtime.ts +++ b/extensions/qa-matrix/src/runners/contract/runtime.ts @@ -54,7 +54,7 @@ const DEFAULT_MATRIX_QA_CLEANUP_TIMEOUT_MS = 90_000; type MatrixQaLiveLaneGatewayHarness = { gateway: MatrixQaGatewayChild; - stop(): Promise; + stop(opts?: { keepTemp?: boolean; preserveToDir?: string }): Promise; }; function buildMatrixQaGatewayConfigKey(overrides?: MatrixQaConfigOverrides) { @@ -310,23 +310,14 @@ function buildMatrixQaScenarioResult(params: { }; } -function scheduleMatrixQaScenariosByConfig( +function scheduleMatrixQaScenariosInCatalogOrder( scenarios: readonly (typeof MATRIX_QA_SCENARIOS)[number][], ): MatrixQaScheduledScenario[] { - const grouped = new Map(); + return scenarios.map((scenario, originalIndex) => ({ originalIndex, scenario })); +} - scenarios.forEach((scenario, originalIndex) => { - const configKey = buildMatrixQaGatewayConfigKey(scenario.configOverrides); - const existing = grouped.get(configKey); - const scheduled = { originalIndex, scenario }; - if (existing) { - existing.push(scheduled); - return; - } - grouped.set(configKey, [scheduled]); - }); - - return [...grouped.values()].flat(); +function getMatrixQaScenarioRestartReadyTimeoutMs(scenario: { timeoutMs: number }): number { + return scenario.timeoutMs; } export type MatrixQaRunResult = { @@ -411,6 +402,7 @@ async function waitForMatrixChannelReady( const pollMs = opts?.pollMs ?? 500; const timeoutMs = opts?.timeoutMs ?? 60_000; const startedAt = Date.now(); + let lastAccounts: unknown; while (Date.now() - startedAt < timeoutMs) { try { const payload = (await gateway.call( @@ -430,6 +422,7 @@ async function waitForMatrixChannelReady( >; }; const accounts = payload.channelAccounts?.matrix ?? []; + lastAccounts = accounts; const match = accounts.find((entry) => entry.accountId === accountId); if (isMatrixAccountReady(match)) { return; @@ -439,7 +432,11 @@ async function waitForMatrixChannelReady( } await sleep(pollMs); } - throw new Error(`matrix account "${accountId}" did not become ready`); + throw new Error( + `matrix account "${accountId}" did not become ready; last matrix accounts: ${JSON.stringify( + lastAccounts ?? [], + )}`, + ); } async function patchMatrixQaGatewayConfig(params: { @@ -447,21 +444,35 @@ async function patchMatrixQaGatewayConfig(params: { patch: Record; restartDelayMs?: number; }) { - const snapshot = (await params.gateway.call("config.get", {}, { timeoutMs: 60_000 })) as { - hash?: string; - }; - if (!snapshot.hash) { - throw new Error("Matrix QA config patch requires config.get hash"); + for (let attempt = 0; attempt < 2; attempt += 1) { + const snapshot = (await params.gateway.call("config.get", {}, { timeoutMs: 60_000 })) as { + hash?: string; + }; + if (!snapshot.hash) { + throw new Error("Matrix QA config patch requires config.get hash"); + } + try { + await params.gateway.call( + "config.patch", + { + raw: JSON.stringify(params.patch, null, 2), + baseHash: snapshot.hash, + restartDelayMs: params.restartDelayMs ?? 0, + }, + { timeoutMs: 60_000 }, + ); + return; + } catch (error) { + if (attempt === 0 && isMatrixQaStaleConfigPatchError(error)) { + continue; + } + throw error; + } } - await params.gateway.call( - "config.patch", - { - raw: JSON.stringify(params.patch, null, 2), - baseHash: snapshot.hash, - restartDelayMs: params.restartDelayMs ?? 0, - }, - { timeoutMs: 60_000 }, - ); +} + +function isMatrixQaStaleConfigPatchError(error: unknown) { + return formatErrorMessage(error).toLowerCase().includes("config changed since last load"); } async function startMatrixQaLiveLaneGateway(params: { @@ -582,6 +593,7 @@ export async function runMatrixQaLive(params: { let canaryArtifact: MatrixQaCanaryArtifact | undefined; let gatewayHarness: MatrixQaLiveLaneGatewayHarness | null = null; let gatewayHarnessKey: string | null = null; + let preservedGatewayDebugDirPath: string | undefined; let canaryFailed = false; const syncState: { driver?: string; observer?: string } = {}; const syncStreams: MatrixQaSyncStreams = {}; @@ -604,7 +616,7 @@ export async function runMatrixQaLive(params: { const defaultConfigSnapshot = buildMatrixQaConfigSnapshot(gatewayConfigParams); const scenarioConfigSnapshots: MatrixQaScenarioConfigEntry[] = []; - const scheduledScenarios = scheduleMatrixQaScenariosByConfig(scenarios); + const scheduledScenarios = scheduleMatrixQaScenariosInCatalogOrder(scenarios); try { const ensureGatewayHarness = async (overrides?: MatrixQaConfigOverrides) => { @@ -754,6 +766,7 @@ export async function runMatrixQaLive(params: { gatewayRuntimeEnv: scenarioGateway.harness.gateway.runtimeEnv, gatewayStateDir: scenarioGateway.harness.gateway.runtimeEnv?.OPENCLAW_STATE_DIR, outputDir, + registrationToken: harness.registrationToken, restartGateway: async () => { if (!gatewayHarness) { throw new Error("Matrix restart scenario requires a live gateway"); @@ -761,7 +774,9 @@ export async function runMatrixQaLive(params: { writeMatrixQaProgress(`gateway restart start ${scenario.id}`); const measuredRestart = await measureMatrixQaStep(async () => { await scenarioGateway.harness.gateway.restart(); - await waitForMatrixChannelReady(scenarioGateway.harness.gateway, sutAccountId); + await waitForMatrixChannelReady(scenarioGateway.harness.gateway, sutAccountId, { + timeoutMs: getMatrixQaScenarioRestartReadyTimeoutMs(scenario), + }); }); gatewayRestartMs += measuredRestart.durationMs; scenarioRestartGatewayMs += measuredRestart.durationMs; @@ -769,7 +784,7 @@ export async function runMatrixQaLive(params: { `gateway restart done ${scenario.id} ${formatMatrixQaDurationMs(measuredRestart.durationMs)}`, ); }, - restartGatewayAfterStateMutation: async (mutateState) => { + restartGatewayAfterStateMutation: async (mutateState, opts) => { if (!gatewayHarness) { throw new Error( "Matrix persisted-state restart scenario requires a live gateway", @@ -785,7 +800,14 @@ export async function runMatrixQaLive(params: { writeMatrixQaProgress(`gateway hard restart start ${scenario.id}`); const measuredRestart = await measureMatrixQaStep(async () => { await restartAfterStateMutation(mutateState); - await waitForMatrixChannelReady(scenarioGateway.harness.gateway, sutAccountId); + await waitForMatrixChannelReady( + scenarioGateway.harness.gateway, + opts?.waitAccountId ?? sutAccountId, + { + timeoutMs: + opts?.timeoutMs ?? getMatrixQaScenarioRestartReadyTimeoutMs(scenario), + }, + ); }); gatewayRestartMs += measuredRestart.durationMs; scenarioRestartGatewayMs += measuredRestart.durationMs; @@ -802,7 +824,9 @@ export async function runMatrixQaLive(params: { await scenarioGateway.harness.gateway.restart(); await sleep(250); await queueMessage(); - await waitForMatrixChannelReady(scenarioGateway.harness.gateway, sutAccountId); + await waitForMatrixChannelReady(scenarioGateway.harness.gateway, sutAccountId, { + timeoutMs: getMatrixQaScenarioRestartReadyTimeoutMs(scenario), + }); }); gatewayRestartMs += measuredRestart.durationMs; scenarioRestartGatewayMs += measuredRestart.durationMs; @@ -827,6 +851,12 @@ export async function runMatrixQaLive(params: { restartDelayMs: opts?.restartDelayMs, }); }, + waitGatewayAccountReady: async (accountId, opts) => { + await waitForMatrixChannelReady(scenarioGateway.harness.gateway, accountId, { + timeoutMs: + opts?.timeoutMs ?? getMatrixQaScenarioRestartReadyTimeoutMs(scenario), + }); + }, }), ), ); @@ -871,9 +901,20 @@ export async function runMatrixQaLive(params: { } finally { if (gatewayHarness) { try { + const shouldPreserveGatewayDebugArtifacts = scenarioResults.some( + (scenario) => scenario?.status === "fail", + ); + preservedGatewayDebugDirPath = shouldPreserveGatewayDebugArtifacts + ? path.join(outputDir, "gateway-debug") + : undefined; await cleanupMatrixQaResource({ label: "Matrix live gateway cleanup", - action: () => gatewayHarness!.stop(), + action: () => + gatewayHarness!.stop( + preservedGatewayDebugDirPath + ? { preserveToDir: preservedGatewayDebugDirPath } + : undefined, + ), }); } catch (error) { appendLiveLaneIssue(cleanupErrors, "live gateway cleanup", error); @@ -899,6 +940,13 @@ export async function runMatrixQaLive(params: { details: cleanupErrors.join("\n"), }); } + if (preservedGatewayDebugDirPath) { + checks.push({ + name: "Matrix gateway debug logs", + status: "pass", + details: `preserved at: ${preservedGatewayDebugDirPath}`, + }); + } const finishedAtDate = new Date(); const finishedAt = finishedAtDate.toISOString(); @@ -1037,7 +1085,8 @@ export async function runMatrixQaLive(params: { export const __testing = { buildMatrixQaSummary, - scheduleMatrixQaScenariosByConfig, + getMatrixQaScenarioRestartReadyTimeoutMs, + scheduleMatrixQaScenariosInCatalogOrder, MATRIX_QA_SCENARIOS, buildMatrixQaConfig, buildMatrixQaConfigSnapshot, diff --git a/extensions/qa-matrix/src/runners/contract/scenario-catalog.ts b/extensions/qa-matrix/src/runners/contract/scenario-catalog.ts index 616fac0fd7a..0c5c468a611 100644 --- a/extensions/qa-matrix/src/runners/contract/scenario-catalog.ts +++ b/extensions/qa-matrix/src/runners/contract/scenario-catalog.ts @@ -59,6 +59,14 @@ export type MatrixQaScenarioId = | "matrix-e2ee-bootstrap-success" | "matrix-e2ee-recovery-key-lifecycle" | "matrix-e2ee-recovery-owner-verification-required" + | "matrix-e2ee-cli-account-add-enable-e2ee" + | "matrix-e2ee-cli-encryption-setup" + | "matrix-e2ee-cli-encryption-setup-idempotent" + | "matrix-e2ee-cli-encryption-setup-bootstrap-failure" + | "matrix-e2ee-cli-recovery-key-setup" + | "matrix-e2ee-cli-recovery-key-invalid" + | "matrix-e2ee-cli-encryption-setup-multi-account" + | "matrix-e2ee-cli-setup-then-gateway-reply" | "matrix-e2ee-cli-self-verification" | "matrix-e2ee-state-loss-external-recovery-key" | "matrix-e2ee-state-loss-stored-recovery-key" @@ -68,6 +76,7 @@ export type MatrixQaScenarioId = | "matrix-e2ee-server-backup-deleted-local-reupload-restores" | "matrix-e2ee-corrupt-crypto-idb-snapshot" | "matrix-e2ee-server-device-deleted-local-state-intact" + | "matrix-e2ee-server-device-deleted-relogin-recovers" | "matrix-e2ee-sync-state-loss-crypto-intact" | "matrix-e2ee-wrong-account-recovery-key" | "matrix-e2ee-history-exists-backup-empty" @@ -238,6 +247,11 @@ const MATRIX_QA_E2EE_CONFIG = { startupVerification: "off", } satisfies MatrixQaConfigOverrides; +const MATRIX_QA_E2EE_CLI_SETUP_CONFIG = { + encryption: false, + startupVerification: "off", +} satisfies MatrixQaConfigOverrides; + export const MATRIX_QA_SCENARIOS: MatrixQaScenarioDefinition[] = [ { id: "matrix-thread-follow-up", @@ -590,6 +604,86 @@ export const MATRIX_QA_SCENARIOS: MatrixQaScenarioDefinition[] = [ }), configOverrides: MATRIX_QA_E2EE_CONFIG, }, + { + id: "matrix-e2ee-cli-account-add-enable-e2ee", + timeoutMs: 120_000, + title: "Matrix E2EE CLI account add enables encryption and bootstraps verification", + topology: buildMatrixQaE2eeScenarioTopology({ + scenarioId: "matrix-e2ee-cli-account-add-enable-e2ee", + name: "Matrix QA E2EE CLI Account Add Room", + }), + configOverrides: MATRIX_QA_E2EE_CONFIG, + }, + { + id: "matrix-e2ee-cli-encryption-setup", + timeoutMs: 120_000, + title: "Matrix E2EE CLI encryption setup upgrades an existing account", + topology: buildMatrixQaE2eeScenarioTopology({ + scenarioId: "matrix-e2ee-cli-encryption-setup", + name: "Matrix QA E2EE CLI Encryption Setup Room", + }), + configOverrides: MATRIX_QA_E2EE_CONFIG, + }, + { + id: "matrix-e2ee-cli-encryption-setup-idempotent", + timeoutMs: 120_000, + title: "Matrix E2EE CLI encryption setup is idempotent on encrypted accounts", + topology: buildMatrixQaE2eeScenarioTopology({ + scenarioId: "matrix-e2ee-cli-encryption-setup-idempotent", + name: "Matrix QA E2EE CLI Encryption Setup Idempotent Room", + }), + configOverrides: MATRIX_QA_E2EE_CONFIG, + }, + { + id: "matrix-e2ee-cli-encryption-setup-bootstrap-failure", + timeoutMs: 120_000, + title: "Matrix E2EE CLI encryption setup reports bootstrap failures", + topology: buildMatrixQaE2eeScenarioTopology({ + scenarioId: "matrix-e2ee-cli-encryption-setup-bootstrap-failure", + name: "Matrix QA E2EE CLI Encryption Setup Failure Room", + }), + configOverrides: MATRIX_QA_E2EE_CONFIG, + }, + { + id: "matrix-e2ee-cli-recovery-key-setup", + timeoutMs: 120_000, + title: "Matrix E2EE CLI encryption setup accepts a recovery key on a second device", + topology: buildMatrixQaE2eeScenarioTopology({ + scenarioId: "matrix-e2ee-cli-recovery-key-setup", + name: "Matrix QA E2EE CLI Recovery Key Setup Room", + }), + configOverrides: MATRIX_QA_E2EE_CONFIG, + }, + { + id: "matrix-e2ee-cli-recovery-key-invalid", + timeoutMs: 120_000, + title: "Matrix E2EE CLI encryption setup rejects an invalid recovery key", + topology: buildMatrixQaE2eeScenarioTopology({ + scenarioId: "matrix-e2ee-cli-recovery-key-invalid", + name: "Matrix QA E2EE CLI Invalid Recovery Key Room", + }), + configOverrides: MATRIX_QA_E2EE_CONFIG, + }, + { + id: "matrix-e2ee-cli-encryption-setup-multi-account", + timeoutMs: 120_000, + title: "Matrix E2EE CLI encryption setup targets one account in a multi-account config", + topology: buildMatrixQaE2eeScenarioTopology({ + scenarioId: "matrix-e2ee-cli-encryption-setup-multi-account", + name: "Matrix QA E2EE CLI Multi Account Setup Room", + }), + configOverrides: MATRIX_QA_E2EE_CONFIG, + }, + { + id: "matrix-e2ee-cli-setup-then-gateway-reply", + timeoutMs: 180_000, + title: "Matrix E2EE CLI setup leaves the gateway able to reply in encrypted rooms", + topology: buildMatrixQaE2eeScenarioTopology({ + scenarioId: "matrix-e2ee-cli-setup-then-gateway-reply", + name: "Matrix QA E2EE CLI Setup Gateway Reply Room", + }), + configOverrides: MATRIX_QA_E2EE_CLI_SETUP_CONFIG, + }, { id: "matrix-e2ee-cli-self-verification", timeoutMs: 180_000, @@ -598,7 +692,6 @@ export const MATRIX_QA_SCENARIOS: MatrixQaScenarioDefinition[] = [ scenarioId: "matrix-e2ee-cli-self-verification", name: "Matrix QA E2EE CLI Self Verification Room", }), - configOverrides: MATRIX_QA_E2EE_CONFIG, }, { id: "matrix-e2ee-state-loss-external-recovery-key", @@ -680,6 +773,16 @@ export const MATRIX_QA_SCENARIOS: MatrixQaScenarioDefinition[] = [ }), configOverrides: MATRIX_QA_E2EE_CONFIG, }, + { + id: "matrix-e2ee-server-device-deleted-relogin-recovers", + timeoutMs: 180_000, + title: "Matrix E2EE server-side device deletion recovers through re-login and backup restore", + topology: buildMatrixQaE2eeScenarioTopology({ + scenarioId: "matrix-e2ee-server-device-deleted-relogin-recovers", + name: "Matrix QA E2EE Server Device Relogin Recovery Room", + }), + configOverrides: MATRIX_QA_E2EE_CONFIG, + }, { id: "matrix-e2ee-sync-state-loss-crypto-intact", timeoutMs: MATRIX_QA_E2EE_REPLY_TIMEOUT_MS, diff --git a/extensions/qa-matrix/src/runners/contract/scenario-runtime-cli.test.ts b/extensions/qa-matrix/src/runners/contract/scenario-runtime-cli.test.ts index 524301d940d..38261818890 100644 --- a/extensions/qa-matrix/src/runners/contract/scenario-runtime-cli.test.ts +++ b/extensions/qa-matrix/src/runners/contract/scenario-runtime-cli.test.ts @@ -140,4 +140,40 @@ describe("Matrix QA CLI runtime", () => { await rm(root, { force: true, recursive: true }); } }); + + it("includes timed-out CLI output in diagnostics", async () => { + const root = await mkdtemp( + path.join(resolvePreferredOpenClawTmpDir(), "matrix-qa-cli-timeout-"), + ); + try { + await mkdir(path.join(root, "dist")); + await writeFile( + path.join(root, "dist", "index.mjs"), + [ + "process.stdout.write('waiting for verification\\n');", + "process.stderr.write('matrix sdk still syncing\\n');", + "setInterval(() => {}, 1000);", + ].join("\n"), + ); + + await expect( + runMatrixQaOpenClawCli({ + args: ["matrix", "verify", "self"], + cwd: root, + env: process.env, + timeoutMs: 250, + }), + ).rejects.toThrow(/stdout:\nwaiting for verification/); + await expect( + runMatrixQaOpenClawCli({ + args: ["matrix", "verify", "self"], + cwd: root, + env: process.env, + timeoutMs: 250, + }), + ).rejects.toThrow(/stderr:\nmatrix sdk still syncing/); + } finally { + await rm(root, { force: true, recursive: true }); + } + }); }); diff --git a/extensions/qa-matrix/src/runners/contract/scenario-runtime-cli.ts b/extensions/qa-matrix/src/runners/contract/scenario-runtime-cli.ts index 1b01b6a8356..817d0e4639e 100644 --- a/extensions/qa-matrix/src/runners/contract/scenario-runtime-cli.ts +++ b/extensions/qa-matrix/src/runners/contract/scenario-runtime-cli.ts @@ -146,7 +146,15 @@ export function startMatrixQaOpenClawCli(params: { child.kill("SIGTERM"); finish( result, - new Error(`${formatMatrixQaCliCommand(params.args)} timed out after ${params.timeoutMs}ms`), + new Error( + [ + `${formatMatrixQaCliCommand(params.args)} timed out after ${params.timeoutMs}ms`, + result.stderr.trim() ? `stderr:\n${redactMatrixQaCliOutput(result.stderr.trim())}` : null, + result.stdout.trim() ? `stdout:\n${redactMatrixQaCliOutput(result.stdout.trim())}` : null, + ] + .filter(Boolean) + .join("\n"), + ), ); }, params.timeoutMs); diff --git a/extensions/qa-matrix/src/runners/contract/scenario-runtime-config.ts b/extensions/qa-matrix/src/runners/contract/scenario-runtime-config.ts new file mode 100644 index 00000000000..14346325739 --- /dev/null +++ b/extensions/qa-matrix/src/runners/contract/scenario-runtime-config.ts @@ -0,0 +1,86 @@ +import { randomUUID } from "node:crypto"; +import { readFile, rename, writeFile } from "node:fs/promises"; + +export function isMatrixQaPlainRecord(value: unknown): value is Record { + return Boolean(value && typeof value === "object" && !Array.isArray(value)); +} + +function requireMatrixQaGatewayConfigObject(config: unknown): Record { + if (!isMatrixQaPlainRecord(config)) { + throw new Error("Matrix QA gateway config file must contain an object"); + } + return config; +} + +async function readMatrixQaGatewayConfigFile(configPath: string) { + return requireMatrixQaGatewayConfigObject( + JSON.parse(await readFile(configPath, "utf8")) as unknown, + ); +} + +async function writeMatrixQaGatewayConfigFile(configPath: string, config: unknown) { + const tempPath = `${configPath}.${randomUUID()}.tmp`; + await writeFile(tempPath, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600 }); + await rename(tempPath, configPath); +} + +export async function readMatrixQaGatewayMatrixAccount(params: { + accountId: string; + configPath: string; +}) { + const config = await readMatrixQaGatewayConfigFile(params.configPath); + const channels = isMatrixQaPlainRecord(config.channels) ? config.channels : {}; + const matrix = isMatrixQaPlainRecord(channels.matrix) ? channels.matrix : {}; + const accounts = isMatrixQaPlainRecord(matrix.accounts) ? matrix.accounts : {}; + const account = accounts[params.accountId]; + if (!isMatrixQaPlainRecord(account)) { + throw new Error(`Matrix QA gateway account "${params.accountId}" missing from config`); + } + return account; +} + +export async function replaceMatrixQaGatewayMatrixAccount(params: { + accountConfig: Record; + accountId: string; + configPath: string; +}) { + const config = await readMatrixQaGatewayConfigFile(params.configPath); + const channels = isMatrixQaPlainRecord(config.channels) ? config.channels : {}; + const matrix = isMatrixQaPlainRecord(channels.matrix) ? channels.matrix : {}; + channels.matrix = { + ...matrix, + defaultAccount: params.accountId, + accounts: { + [params.accountId]: params.accountConfig, + }, + }; + config.channels = channels; + await writeMatrixQaGatewayConfigFile(params.configPath, config); +} + +export async function patchMatrixQaGatewayMatrixAccount(params: { + accountId: string; + accountPatch: Record; + configPath: string; +}) { + const config = await readMatrixQaGatewayConfigFile(params.configPath); + const channels = isMatrixQaPlainRecord(config.channels) ? config.channels : {}; + const matrix = isMatrixQaPlainRecord(channels.matrix) ? channels.matrix : {}; + const accounts = isMatrixQaPlainRecord(matrix.accounts) ? matrix.accounts : {}; + const existing = accounts[params.accountId]; + if (!isMatrixQaPlainRecord(existing)) { + throw new Error(`Matrix QA gateway account "${params.accountId}" missing from config`); + } + channels.matrix = { + ...matrix, + defaultAccount: params.accountId, + accounts: { + [params.accountId]: { + ...existing, + ...params.accountPatch, + }, + }, + }; + config.channels = channels; + await writeMatrixQaGatewayConfigFile(params.configPath, config); +} diff --git a/extensions/qa-matrix/src/runners/contract/scenario-runtime-e2ee-destructive.ts b/extensions/qa-matrix/src/runners/contract/scenario-runtime-e2ee-destructive.ts index e5507abc82d..b177dbf6126 100644 --- a/extensions/qa-matrix/src/runners/contract/scenario-runtime-e2ee-destructive.ts +++ b/extensions/qa-matrix/src/runners/contract/scenario-runtime-e2ee-destructive.ts @@ -2,7 +2,6 @@ import { randomUUID } from "node:crypto"; import { chmod, copyFile, mkdir, readdir, readFile, rm, stat, writeFile } from "node:fs/promises"; import path from "node:path"; import { setTimeout as sleep } from "node:timers/promises"; -import type { MatrixVerificationSummary } from "@openclaw/matrix/test-api.js"; import { createMatrixQaClient } from "../../substrate/client.js"; import { createMatrixQaE2eeScenarioClient, @@ -12,7 +11,6 @@ import { requestMatrixJson } from "../../substrate/request.js"; import { buildMatrixQaE2eeScenarioRoomKey, type MatrixQaE2eeScenarioId, - resolveMatrixQaScenarioRoomId, } from "./scenario-catalog.js"; import { createMatrixQaOpenClawCliRuntime, @@ -20,6 +18,10 @@ import { redactMatrixQaCliOutput, type MatrixQaCliRunResult, } from "./scenario-runtime-cli.js"; +import { + readMatrixQaGatewayMatrixAccount, + replaceMatrixQaGatewayMatrixAccount, +} from "./scenario-runtime-config.js"; import { assertTopLevelReplyArtifact, buildMentionPrompt, @@ -69,6 +71,10 @@ type MatrixQaCliVerificationStatus = { type MatrixQaDestructiveSetup = { encodedRecoveryKey: string; owner: MatrixQaE2eeScenarioClient; + ownerAccessToken: string; + ownerDeviceId: string; + ownerPassword: string; + ownerUserId: string; recoveryKeyId: string | null; roomId: string; roomKey: string; @@ -91,6 +97,14 @@ function requireMatrixQaCliRuntimeEnv(context: MatrixQaScenarioContext) { return context.gatewayRuntimeEnv; } +function requireMatrixQaGatewayConfigPath(context: MatrixQaScenarioContext) { + const configPath = requireMatrixQaCliRuntimeEnv(context).OPENCLAW_CONFIG_PATH?.trim(); + if (!configPath) { + throw new Error("Matrix E2EE destructive QA scenarios require the gateway config path"); + } + return configPath; +} + function requireMatrixQaPassword(context: MatrixQaScenarioContext, actor: "driver" | "observer") { const password = actor === "driver" ? context.driverPassword : context.observerPassword; if (!password) { @@ -99,15 +113,12 @@ function requireMatrixQaPassword(context: MatrixQaScenarioContext, actor: "drive return password; } -function resolveMatrixQaE2eeScenarioGroupRoom( - context: MatrixQaScenarioContext, - scenarioId: MatrixQaE2eeScenarioId, -) { - const roomKey = buildMatrixQaE2eeScenarioRoomKey(scenarioId); - return { - roomKey, - roomId: resolveMatrixQaScenarioRoomId(context, roomKey), - }; +function requireMatrixQaRegistrationToken(context: MatrixQaScenarioContext) { + const token = context.registrationToken?.trim(); + if (!token) { + throw new Error("Matrix E2EE destructive QA scenarios require a registration token"); + } + return token; } async function createMatrixQaDriverPersistentClient( @@ -128,6 +139,51 @@ async function createMatrixQaDriverPersistentClient( }); } +async function registerMatrixQaDestructiveOwner( + context: MatrixQaScenarioContext, + scenarioId: MatrixQaE2eeScenarioId, +) { + const localpartSuffix = scenarioId + .replace(/^matrix-e2ee-/, "") + .replace(/[^a-z0-9]+/g, "-") + .replace(/^-+|-+$/g, "") + .slice(0, 24); + const account = await createMatrixQaClient({ baseUrl: context.baseUrl }).registerWithToken({ + deviceName: "OpenClaw Matrix QA Destructive Owner", + localpart: `qa-destructive-${localpartSuffix}-${randomUUID().replaceAll("-", "").slice(0, 8)}`, + password: `matrix-qa-${randomUUID()}`, + registrationToken: requireMatrixQaRegistrationToken(context), + }); + if (!account.deviceId) { + throw new Error( + `Matrix destructive QA registration for ${scenarioId} did not return a device id`, + ); + } + return { + ...account, + deviceId: account.deviceId, + }; +} + +async function createMatrixQaDestructiveOwnerClient(params: { + account: Awaited>; + context: MatrixQaScenarioContext; + scenarioId: MatrixQaE2eeScenarioId; +}) { + return await createMatrixQaE2eeScenarioClient({ + accessToken: params.account.accessToken, + actorId: `driver-destructive-${randomUUID().slice(0, 8)}`, + baseUrl: params.context.baseUrl, + deviceId: params.account.deviceId, + observedEvents: params.context.observedEvents, + outputDir: requireMatrixQaE2eeOutputDir(params.context), + password: params.account.password, + scenarioId: params.scenarioId, + timeoutMs: params.context.timeoutMs, + userId: params.account.userId, + }); +} + async function ensureMatrixQaOwnerReady(params: { allowCrossSigningResetOnRepair?: boolean; client: MatrixQaE2eeScenarioClient; @@ -193,10 +249,20 @@ async function prepareMatrixQaDestructiveSetup( context: MatrixQaScenarioContext, scenarioId: MatrixQaE2eeScenarioId, ): Promise { - const owner = await createMatrixQaDriverPersistentClient(context, scenarioId); + const account = await registerMatrixQaDestructiveOwner(context, scenarioId); + const setupClient = createMatrixQaClient({ + accessToken: account.accessToken, + baseUrl: context.baseUrl, + }); + const roomKey = buildMatrixQaE2eeScenarioRoomKey(scenarioId); + const roomId = await setupClient.createPrivateRoom({ + encrypted: true, + inviteUserIds: [], + name: `Matrix QA ${scenarioId}`, + }); + const owner = await createMatrixQaDestructiveOwnerClient({ account, context, scenarioId }); try { - const ready = await ensureMatrixQaOwnerReady({ client: owner, label: "driver" }); - const { roomId, roomKey } = resolveMatrixQaE2eeScenarioGroupRoom(context, scenarioId); + const ready = await ensureMatrixQaOwnerReady({ client: owner, label: "destructive owner" }); const seededEventId = await owner.sendTextMessage({ body: `E2EE destructive restore seed ${randomUUID().slice(0, 8)}`, roomId, @@ -204,6 +270,10 @@ async function prepareMatrixQaDestructiveSetup( return { encodedRecoveryKey: ready.encodedRecoveryKey, owner, + ownerAccessToken: account.accessToken, + ownerDeviceId: account.deviceId, + ownerPassword: account.password, + ownerUserId: account.userId, recoveryKeyId: ready.recoveryKeyId, roomId, roomKey, @@ -324,193 +394,6 @@ async function runMatrixQaCliJson(params: { }; } -async function waitForMatrixQaVerificationSummary(params: { - client: MatrixQaE2eeScenarioClient; - label: string; - predicate: (summary: MatrixVerificationSummary) => boolean; - timeoutMs: number; -}) { - const startedAt = Date.now(); - while (Date.now() - startedAt < params.timeoutMs) { - const summaries = await params.client.listVerifications(); - const found = summaries.find(params.predicate); - if (found) { - return found; - } - await new Promise((resolve) => - setTimeout(resolve, Math.min(250, Math.max(25, params.timeoutMs - (Date.now() - startedAt)))), - ); - } - throw new Error(`timed out waiting for Matrix verification summary: ${params.label}`); -} - -function parseMatrixQaCliSummaryField(text: string, field: string): string | null { - const escaped = field.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"); - return text.match(new RegExp(`^${escaped}:\\s*(.+)$`, "m"))?.[1]?.trim() ?? null; -} - -function parseMatrixQaCliSasText( - text: string, - label: string, -): { kind: "emoji"; value: string } | { kind: "decimal"; value: string } { - const emoji = text.match(/^SAS emoji:\s*(.+)$/m)?.[1]?.trim(); - if (emoji) { - return { kind: "emoji", value: emoji }; - } - const decimal = text.match(/^SAS decimals:\s*(.+)$/m)?.[1]?.trim(); - if (decimal) { - return { kind: "decimal", value: decimal }; - } - throw new Error(`${label} did not print SAS emoji or decimals`); -} - -function formatMatrixQaSasEmoji(summary: MatrixVerificationSummary) { - return summary.sas?.emoji?.map(([emoji, label]) => `${emoji} ${label}`) ?? []; -} - -function assertMatrixQaCliSasMatches(params: { - cliSas: ReturnType; - owner: MatrixVerificationSummary; -}) { - if (params.cliSas.kind === "emoji") { - const ownerEmoji = formatMatrixQaSasEmoji(params.owner).join(" | "); - if (!ownerEmoji) { - throw new Error("Matrix owner client did not expose SAS emoji"); - } - if (params.cliSas.value !== ownerEmoji) { - throw new Error("Matrix CLI SAS emoji did not match the owner client"); - } - return; - } - const ownerDecimal = params.owner.sas?.decimal?.join(" "); - if (!ownerDecimal) { - throw new Error("Matrix owner client did not expose SAS decimals"); - } - if (params.cliSas.value !== ownerDecimal) { - throw new Error("Matrix CLI SAS decimals did not match the owner client"); - } -} - -function isMatrixQaCliOwnerSelfVerification(params: { - cliDeviceId?: string; - driverUserId: string; - requireCompleted?: boolean; - requirePending?: boolean; - requireSas?: boolean; - summary: MatrixVerificationSummary; - transactionId?: string; -}) { - const summary = params.summary; - if ( - !summary.isSelfVerification || - summary.initiatedByMe || - summary.otherUserId !== params.driverUserId - ) { - return false; - } - if (params.transactionId) { - if (summary.transactionId !== params.transactionId) { - return false; - } - } else if (params.cliDeviceId && summary.otherDeviceId !== params.cliDeviceId) { - return false; - } - if (params.requirePending === true && !summary.pending) { - return false; - } - if (params.requireSas === true && !summary.hasSas) { - return false; - } - return params.requireCompleted !== true || summary.completed; -} - -async function runMatrixQaCliSelfVerificationWithOwner(params: { - accountId: string; - cli: MatrixQaCliRuntime; - cliDeviceId: string; - context: MatrixQaScenarioContext; - label: string; - owner: MatrixQaE2eeScenarioClient; -}) { - const session = params.cli.start(["matrix", "verify", "self", "--account", params.accountId], { - timeoutMs: params.context.timeoutMs, - }); - try { - const requestOutput = await session.waitForOutput( - (output) => output.text.includes("Accept this verification request"), - "self-verification request guidance", - params.context.timeoutMs, - ); - const cliTransactionId = parseMatrixQaCliSummaryField(requestOutput.text, "Transaction id"); - const ownerRequested = await waitForMatrixQaVerificationSummary({ - client: params.owner, - label: "owner received destructive CLI self-verification request", - predicate: (summary) => - isMatrixQaCliOwnerSelfVerification({ - cliDeviceId: cliTransactionId ? undefined : params.cliDeviceId, - driverUserId: params.context.driverUserId, - requirePending: true, - summary, - transactionId: cliTransactionId ?? undefined, - }), - timeoutMs: params.context.timeoutMs, - }); - if (ownerRequested.canAccept) { - await params.owner.acceptVerification(ownerRequested.id); - } - - const sasOutput = await session.waitForOutput( - (output) => /^SAS (?:emoji|decimals):/m.test(output.text), - "SAS emoji or decimals", - params.context.timeoutMs, - ); - const cliSas = parseMatrixQaCliSasText(sasOutput.text, params.label); - const ownerSas = await waitForMatrixQaVerificationSummary({ - client: params.owner, - label: "owner SAS for destructive CLI self-verification", - predicate: (summary) => - isMatrixQaCliOwnerSelfVerification({ - cliDeviceId: cliTransactionId ? undefined : params.cliDeviceId, - driverUserId: params.context.driverUserId, - requireSas: true, - summary, - transactionId: cliTransactionId ?? undefined, - }), - timeoutMs: params.context.timeoutMs, - }); - assertMatrixQaCliSasMatches({ cliSas, owner: ownerSas }); - await session.writeStdin("yes\n"); - await params.owner.confirmVerificationSas(ownerSas.id); - const completedCli = await session.wait(); - const selfVerificationArtifacts = await writeMatrixQaCliArtifacts({ - label: "verify-self", - result: completedCli, - runtime: params.cli, - }); - const completedOwner = await waitForMatrixQaVerificationSummary({ - client: params.owner, - label: "owner completed destructive CLI self-verification", - predicate: (summary) => - isMatrixQaCliOwnerSelfVerification({ - cliDeviceId: cliTransactionId ? undefined : params.cliDeviceId, - driverUserId: params.context.driverUserId, - requireCompleted: true, - summary, - transactionId: cliTransactionId ?? undefined, - }), - timeoutMs: params.context.timeoutMs, - }); - return { - completedCli, - completedOwner, - selfVerificationArtifacts, - transactionId: cliTransactionId ?? completedOwner.transactionId ?? null, - }; - } finally { - session.kill(); - } -} - function assertMatrixQaCliBackupRestoreSucceeded(restore: MatrixQaCliBackupStatus, label: string) { if (restore.success !== true) { throw new Error(`${label} backup restore failed: ${restore.error ?? "unknown error"}`); @@ -537,6 +420,35 @@ function assertMatrixQaCliBackupRestoreFailed( } } +function isMatrixQaVerifyStatusHealthy(status: { + payload: MatrixQaCliVerificationStatus; + result: MatrixQaCliRunResult; +}) { + return status.result.exitCode === 0 && status.payload.serverDeviceKnown !== false; +} + +function isMatrixQaDeletedDeviceStatus(params: { + ownerDeviceListContainsDeletedDevice: boolean; + status: { + payload: MatrixQaCliVerificationStatus; + result: MatrixQaCliRunResult; + }; +}) { + const authInvalidated = + params.status.result.exitCode !== 0 && + typeof params.status.payload.error === "string" && + (params.status.payload.error.includes("M_UNKNOWN_TOKEN") || + params.status.payload.error.toLowerCase().includes("access token")); + const deviceMissing = + params.status.payload.serverDeviceKnown === false || + !params.ownerDeviceListContainsDeletedDevice; + return { + authInvalidated, + deviceMissing, + invalidated: authInvalidated || deviceMissing, + }; +} + async function findFilesByName(params: { filename: string; rootDir: string }): Promise { const matches: string[] = []; async function visit(dir: string, depth: number): Promise { @@ -676,7 +588,6 @@ async function runMatrixQaExternalKeyRestore(params: { export async function runMatrixQaE2eeStateLossExternalRecoveryKeyScenario( context: MatrixQaScenarioContext, ): Promise { - const driverPassword = requireMatrixQaPassword(context, "driver"); const setup = await prepareMatrixQaDestructiveSetup( context, "matrix-e2ee-state-loss-external-recovery-key", @@ -686,8 +597,8 @@ export async function runMatrixQaE2eeStateLossExternalRecoveryKeyScenario( context, deviceName: "OpenClaw Matrix QA External Key Restore", label: "state-loss-external-recovery-key", - password: driverPassword, - userId: context.driverUserId, + password: setup.ownerPassword, + userId: setup.ownerUserId, }); try { const restored = await runMatrixQaCliJson({ @@ -707,82 +618,35 @@ export async function runMatrixQaE2eeStateLossExternalRecoveryKeyScenario( timeoutMs: context.timeoutMs, }); assertMatrixQaCliBackupRestoreSucceeded(restored.payload, "external recovery-key"); - const verification = await runMatrixQaCliJson({ - allowNonZero: true, - args: [ - "matrix", - "verify", - "device", - "--recovery-key-stdin", - "--account", - "external-key", - "--json", - ], - label: "verify-device-diagnostics", + const diagnostics = await runMatrixQaCliJson({ + args: ["matrix", "verify", "status", "--account", "external-key", "--json"], + label: "status-after-external-key-restore", runtime: cli, - stdin: `${setup.encodedRecoveryKey}\n`, timeoutMs: context.timeoutMs, }); const backupKeyLoaded = - verification.payload.backup?.matchesDecryptionKey === true && - verification.payload.backup?.decryptionKeyCached === true && - !verification.payload.backup?.keyLoadError; - const ownerVerificationRequired = - verification.payload.success === false && - verification.payload.deviceOwnerVerified === false && - verification.payload.crossSigningVerified === false && - verification.payload.error?.includes("full Matrix identity trust"); + diagnostics.payload.backup?.matchesDecryptionKey === true && + diagnostics.payload.backup?.decryptionKeyCached === true && + !diagnostics.payload.backup?.keyLoadError; const recoveryKeyCompletedIdentity = - verification.payload.success === true && - verification.payload.recoveryKeyAccepted === true && - verification.payload.deviceOwnerVerified === true && - verification.payload.crossSigningVerified === true; - if (!backupKeyLoaded || (!ownerVerificationRequired && !recoveryKeyCompletedIdentity)) { + diagnostics.payload.verified === true && + diagnostics.payload.crossSigningVerified === true && + diagnostics.payload.signedByOwner === true; + if (!backupKeyLoaded) { throw new Error( - "external recovery-key scenario did not preserve backup-key restore diagnostics before self-verification", - ); - } - const selfVerification = ownerVerificationRequired - ? await runMatrixQaCliSelfVerificationWithOwner({ - accountId: "external-key", - cli, - cliDeviceId: device.deviceId, - context, - label: "external recovery-key self-verification", - owner: setup.owner, - }) - : null; - const finalStatus = recoveryKeyCompletedIdentity - ? verification - : await runMatrixQaCliJson({ - args: ["matrix", "verify", "status", "--account", "external-key", "--json"], - label: "status-after-self-verification", - runtime: cli, - timeoutMs: context.timeoutMs, - }); - if ( - finalStatus.payload.verified !== true || - finalStatus.payload.crossSigningVerified !== true || - finalStatus.payload.signedByOwner !== true || - finalStatus.payload.backup?.trusted !== true || - finalStatus.payload.backup?.matchesDecryptionKey !== true - ) { - throw new Error( - "external recovery-key scenario did not finish with full Matrix identity trust after self-verification", + "external recovery-key scenario did not preserve backup-key restore diagnostics", ); } return { artifacts: { - ...(selfVerification - ? { completedVerificationId: selfVerification.completedOwner.id } - : {}), recoveryDeviceId: device.deviceId, + recoveryKeyAccepted: backupKeyLoaded, recoveryKeyId: setup.recoveryKeyId, restoreImported: restored.payload.imported, restoreTotal: restored.payload.total, - selfVerificationTransactionId: selfVerification?.transactionId ?? null, + selfVerificationTransactionId: null, seededEventId: setup.seededEventId, - verificationExitCode: verification.result.exitCode, + verificationExitCode: diagnostics.result.exitCode, }, details: [ "deleted Matrix state simulated with a fresh OpenClaw CLI state root", @@ -790,20 +654,16 @@ export async function runMatrixQaE2eeStateLossExternalRecoveryKeyScenario( `seeded encrypted event: ${setup.seededEventId}`, `recovery device: ${device.deviceId}`, `restore imported/total: ${restored.payload.imported ?? 0}/${restored.payload.total ?? 0}`, - `recovery key accepted: ${verification.payload.recoveryKeyAccepted ? "yes" : "no"}`, - `backup usable: ${verification.payload.backupUsable ? "yes" : "no"}`, + `recovery key accepted: ${backupKeyLoaded ? "yes" : "no"}`, + `backup usable: ${backupKeyLoaded ? "yes" : "no"}`, `device owner verified before self-verification: ${ - verification.payload.deviceOwnerVerified ? "yes" : "no" + diagnostics.payload.verified ? "yes" : "no" }`, - `device owner verified after recovery flow: ${finalStatus.payload.verified ? "yes" : "no"}`, + `device owner verified after recovery flow: ${recoveryKeyCompletedIdentity ? "yes" : "no"}`, `restore stdout: ${restored.artifacts.stdoutPath}`, - `verify diagnostics stdout: ${verification.artifacts.stdoutPath}`, - selfVerification - ? `verify self stdout: ${selfVerification.selfVerificationArtifacts.stdoutPath}` - : "verify self stdout: ", - recoveryKeyCompletedIdentity - ? "final status stdout: " - : `final status stdout: ${finalStatus.artifacts.stdoutPath}`, + `verify diagnostics stdout: ${diagnostics.artifacts.stdoutPath}`, + "verify self stdout: ", + "final status stdout: ", ].join("\n"), }; } finally { @@ -816,7 +676,6 @@ export async function runMatrixQaE2eeStateLossExternalRecoveryKeyScenario( export async function runMatrixQaE2eeStateLossStoredRecoveryKeyScenario( context: MatrixQaScenarioContext, ): Promise { - const driverPassword = requireMatrixQaPassword(context, "driver"); const setup = await prepareMatrixQaDestructiveSetup( context, "matrix-e2ee-state-loss-stored-recovery-key", @@ -826,8 +685,8 @@ export async function runMatrixQaE2eeStateLossStoredRecoveryKeyScenario( context, deviceName: "OpenClaw Matrix QA Stored Key Restore", label: "state-loss-stored-recovery-key", - password: driverPassword, - userId: context.driverUserId, + password: setup.ownerPassword, + userId: setup.ownerUserId, }); try { const initial = await runMatrixQaCliJson({ @@ -897,7 +756,6 @@ export async function runMatrixQaE2eeStateLossStoredRecoveryKeyScenario( export async function runMatrixQaE2eeStateLossNoRecoveryKeyScenario( context: MatrixQaScenarioContext, ): Promise { - const driverPassword = requireMatrixQaPassword(context, "driver"); const setup = await prepareMatrixQaDestructiveSetup( context, "matrix-e2ee-state-loss-no-recovery-key", @@ -907,8 +765,8 @@ export async function runMatrixQaE2eeStateLossNoRecoveryKeyScenario( context, deviceName: "OpenClaw Matrix QA No Key Restore", label: "state-loss-no-recovery-key", - password: driverPassword, - userId: context.driverUserId, + password: setup.ownerPassword, + userId: setup.ownerUserId, }); try { const restored = await runMatrixQaCliJson({ @@ -943,7 +801,6 @@ export async function runMatrixQaE2eeStateLossNoRecoveryKeyScenario( export async function runMatrixQaE2eeStaleRecoveryKeyAfterBackupResetScenario( context: MatrixQaScenarioContext, ): Promise { - const driverPassword = requireMatrixQaPassword(context, "driver"); const setup = await prepareMatrixQaDestructiveSetup( context, "matrix-e2ee-stale-recovery-key-after-backup-reset", @@ -966,8 +823,8 @@ export async function runMatrixQaE2eeStaleRecoveryKeyAfterBackupResetScenario( context, deviceName: "OpenClaw Matrix QA Stale Key Restore", label: "stale-recovery-key-after-backup-reset", - password: driverPassword, - userId: context.driverUserId, + password: setup.ownerPassword, + userId: setup.ownerUserId, }); try { const restored = await runMatrixQaCliJson({ @@ -1026,7 +883,7 @@ export async function runMatrixQaE2eeServerBackupDeletedLocalStateIntactScenario throw new Error(`Matrix backup preflight restore failed: ${before.error ?? "unknown"}`); } const deleteStatus = await deleteMatrixQaServerRoomKeyBackup({ - accessToken: context.driverAccessToken, + accessToken: setup.ownerAccessToken, baseUrl: context.baseUrl, version: before.backupVersion, }); @@ -1104,7 +961,6 @@ async function waitForMatrixQaNonEmptyCliBackupRestore(params: { export async function runMatrixQaE2eeServerBackupDeletedLocalReuploadRestoresScenario( context: MatrixQaScenarioContext, ): Promise { - const driverPassword = requireMatrixQaPassword(context, "driver"); const scenarioId = "matrix-e2ee-server-backup-deleted-local-reupload-restores"; const setup = await prepareMatrixQaDestructiveSetup(context, scenarioId); const { cli, device } = await runMatrixQaExternalKeyRestore({ @@ -1112,8 +968,8 @@ export async function runMatrixQaE2eeServerBackupDeletedLocalReuploadRestoresSce context, deviceName: "OpenClaw Matrix QA Backup Reupload Restore", label: "server-backup-deleted-local-reupload-restores", - password: driverPassword, - userId: context.driverUserId, + password: setup.ownerPassword, + userId: setup.ownerUserId, }); try { const before = await setup.owner.restoreRoomKeyBackup({ @@ -1125,7 +981,7 @@ export async function runMatrixQaE2eeServerBackupDeletedLocalReuploadRestoresSce ); } const deleteStatus = await deleteMatrixQaServerRoomKeyBackup({ - accessToken: context.driverAccessToken, + accessToken: setup.ownerAccessToken, baseUrl: context.baseUrl, version: before.backupVersion, }); @@ -1178,7 +1034,6 @@ export async function runMatrixQaE2eeServerBackupDeletedLocalReuploadRestoresSce export async function runMatrixQaE2eeCorruptCryptoIdbSnapshotScenario( context: MatrixQaScenarioContext, ): Promise { - const driverPassword = requireMatrixQaPassword(context, "driver"); const setup = await prepareMatrixQaDestructiveSetup( context, "matrix-e2ee-corrupt-crypto-idb-snapshot", @@ -1188,8 +1043,8 @@ export async function runMatrixQaE2eeCorruptCryptoIdbSnapshotScenario( context, deviceName: "OpenClaw Matrix QA Corrupt IDB Restore", label: "corrupt-crypto-idb-snapshot", - password: driverPassword, - userId: context.driverUserId, + password: setup.ownerPassword, + userId: setup.ownerUserId, }); try { const initial = await runMatrixQaCliJson({ @@ -1254,7 +1109,6 @@ export async function runMatrixQaE2eeCorruptCryptoIdbSnapshotScenario( export async function runMatrixQaE2eeServerDeviceDeletedLocalStateIntactScenario( context: MatrixQaScenarioContext, ): Promise { - const driverPassword = requireMatrixQaPassword(context, "driver"); const setup = await prepareMatrixQaDestructiveSetup( context, "matrix-e2ee-server-device-deleted-local-state-intact", @@ -1264,8 +1118,8 @@ export async function runMatrixQaE2eeServerDeviceDeletedLocalStateIntactScenario context, deviceName: "OpenClaw Matrix QA Deleted Device", label: "server-device-deleted-local-state-intact", - password: driverPassword, - userId: context.driverUserId, + password: setup.ownerPassword, + userId: setup.ownerUserId, }); try { const restored = await runMatrixQaCliJson({ @@ -1287,28 +1141,45 @@ export async function runMatrixQaE2eeServerDeviceDeletedLocalStateIntactScenario assertMatrixQaCliBackupRestoreSucceeded(restored.payload, "deleted-device preflight"); await setup.owner.deleteOwnDevices([device.deviceId]); const ownerDevicesAfterDelete = await setup.owner.listOwnDevices(); - const status = await runMatrixQaCliJson({ + const defaultStatus = await runMatrixQaCliJson({ allowNonZero: true, args: ["matrix", "verify", "status", "--account", "deleted-device", "--json"], - label: "status-after-device-delete", + label: "status-after-device-delete-default", + runtime: cli, + timeoutMs: context.timeoutMs, + }); + if (isMatrixQaVerifyStatusHealthy(defaultStatus)) { + throw new Error("default deleted device status reported healthy local state"); + } + const status = await runMatrixQaCliJson({ + allowNonZero: true, + args: [ + "matrix", + "verify", + "status", + "--account", + "deleted-device", + "--allow-degraded-local-state", + "--json", + ], + label: "status-after-device-delete-degraded", runtime: cli, timeoutMs: context.timeoutMs, }); - const authInvalidated = - status.result.exitCode !== 0 && - typeof status.payload.error === "string" && - (status.payload.error.includes("M_UNKNOWN_TOKEN") || - status.payload.error.toLowerCase().includes("access token")); const ownerDeviceListContainsDeletedDevice = ownerDevicesAfterDelete.some( (entry) => entry.deviceId === device.deviceId, ); - const deviceMissing = - status.payload.serverDeviceKnown === false || !ownerDeviceListContainsDeletedDevice; - if (!authInvalidated && !deviceMissing) { + const invalidation = isMatrixQaDeletedDeviceStatus({ + ownerDeviceListContainsDeletedDevice, + status, + }); + if (!invalidation.invalidated) { throw new Error("deleted device status did not report homeserver device invalidation"); } return { artifacts: { + defaultStatusError: defaultStatus.payload.error, + defaultStatusExitCode: defaultStatus.result.exitCode, deletedDeviceId: device.deviceId, serverDeviceKnown: status.payload.serverDeviceKnown ?? null, statusError: status.payload.error, @@ -1317,10 +1188,11 @@ export async function runMatrixQaE2eeServerDeviceDeletedLocalStateIntactScenario details: [ "server-side device deletion invalidated the surviving local credentials", `deleted device: ${device.deviceId}`, - `status exit code: ${status.result.exitCode}`, - authInvalidated + `default status exit code: ${defaultStatus.result.exitCode}`, + `degraded status exit code: ${status.result.exitCode}`, + invalidation.authInvalidated ? `status error: ${status.payload.error}` - : `device present on server: ${deviceMissing ? "no" : "yes"}`, + : `device present on server: ${invalidation.deviceMissing ? "no" : "yes"}`, ].join("\n"), }; } finally { @@ -1329,43 +1201,240 @@ export async function runMatrixQaE2eeServerDeviceDeletedLocalStateIntactScenario } } +export async function runMatrixQaE2eeServerDeviceDeletedReloginRecoversScenario( + context: MatrixQaScenarioContext, +): Promise { + const setup = await prepareMatrixQaDestructiveSetup( + context, + "matrix-e2ee-server-device-deleted-relogin-recovers", + ); + const deleted = await runMatrixQaExternalKeyRestore({ + accountId: "deleted-device-recovery", + context, + deviceName: "OpenClaw Matrix QA Deleted Device Recovery Source", + label: "server-device-deleted-relogin-source", + password: setup.ownerPassword, + userId: setup.ownerUserId, + }); + let replacement: Awaited> | undefined; + try { + const preflight = await runMatrixQaCliJson({ + args: [ + "matrix", + "verify", + "backup", + "restore", + "--account", + "deleted-device-recovery", + "--recovery-key-stdin", + "--json", + ], + label: "restore-before-device-delete", + runtime: deleted.cli, + stdin: `${setup.encodedRecoveryKey}\n`, + timeoutMs: context.timeoutMs, + }); + assertMatrixQaCliBackupRestoreSucceeded(preflight.payload, "deleted-device recovery preflight"); + + await setup.owner.deleteOwnDevices([deleted.device.deviceId]); + const ownerDevicesAfterDelete = await setup.owner.listOwnDevices(); + const defaultStatus = await runMatrixQaCliJson({ + allowNonZero: true, + args: ["matrix", "verify", "status", "--account", "deleted-device-recovery", "--json"], + label: "status-after-source-device-delete", + runtime: deleted.cli, + timeoutMs: context.timeoutMs, + }); + const invalidation = isMatrixQaDeletedDeviceStatus({ + ownerDeviceListContainsDeletedDevice: ownerDevicesAfterDelete.some( + (entry) => entry.deviceId === deleted.device.deviceId, + ), + status: defaultStatus, + }); + if (isMatrixQaVerifyStatusHealthy(defaultStatus) || !invalidation.invalidated) { + throw new Error("deleted source device did not fail closed before recovery re-login"); + } + + replacement = await runMatrixQaExternalKeyRestore({ + accountId: "deleted-device-recovery-relogin", + context, + deviceName: "OpenClaw Matrix QA Deleted Device Recovery Relogin", + label: "server-device-deleted-relogin-recovery", + password: setup.ownerPassword, + userId: setup.ownerUserId, + }); + const restored = await runMatrixQaCliJson({ + args: [ + "matrix", + "verify", + "backup", + "restore", + "--account", + "deleted-device-recovery-relogin", + "--recovery-key-stdin", + "--json", + ], + label: "restore-after-relogin", + runtime: replacement.cli, + stdin: `${setup.encodedRecoveryKey}\n`, + timeoutMs: context.timeoutMs, + }); + assertMatrixQaCliBackupRestoreSucceeded(restored.payload, "deleted-device relogin recovery"); + const status = await runMatrixQaCliJson({ + args: [ + "matrix", + "verify", + "status", + "--account", + "deleted-device-recovery-relogin", + "--json", + ], + label: "status-after-relogin-restore", + runtime: replacement.cli, + timeoutMs: context.timeoutMs, + }); + const backupKeyLoaded = + status.payload.backup?.matchesDecryptionKey === true && + status.payload.backup?.decryptionKeyCached === true && + !status.payload.backup?.keyLoadError; + if (!backupKeyLoaded) { + throw new Error("deleted-device re-login recovery did not restore usable backup access"); + } + return { + artifacts: { + defaultStatusError: defaultStatus.payload.error, + defaultStatusExitCode: defaultStatus.result.exitCode, + deletedDeviceId: deleted.device.deviceId, + recoveryKeyAccepted: backupKeyLoaded, + replacementDeviceId: replacement.device.deviceId, + restoreImported: restored.payload.imported, + restoreTotal: restored.payload.total, + statusExitCode: status.result.exitCode, + }, + details: [ + "server-side device deletion failed closed, then a replacement login restored backup access", + `deleted device: ${deleted.device.deviceId}`, + `replacement device: ${replacement.device.deviceId}`, + `default deleted-device status exit code: ${defaultStatus.result.exitCode}`, + `restore imported/total: ${restored.payload.imported ?? 0}/${restored.payload.total ?? 0}`, + `backup usable after re-login: ${backupKeyLoaded ? "yes" : "no"}`, + ].join("\n"), + }; + } finally { + await replacement?.cli.dispose().catch(() => undefined); + if (replacement?.device.deviceId) { + await setup.owner.deleteOwnDevices([replacement.device.deviceId]).catch(() => undefined); + } + await deleted.cli.dispose().catch(() => undefined); + await setup.owner.deleteOwnDevices([deleted.device.deviceId]).catch(() => undefined); + await setup.owner.stop().catch(() => undefined); + } +} + export async function runMatrixQaE2eeSyncStateLossCryptoIntactScenario( context: MatrixQaScenarioContext, ): Promise { if (!context.gatewayStateDir || !context.restartGatewayAfterStateMutation) { throw new Error("Matrix E2EE sync-state loss scenario requires gateway state restart support"); } - const { roomId, roomKey } = resolveMatrixQaE2eeScenarioGroupRoom( - context, - "matrix-e2ee-sync-state-loss-crypto-intact", - ); - const syncStore = await waitForMatrixSyncStoreWithCursor({ - context, - stateDir: context.gatewayStateDir, - timeoutMs: context.timeoutMs, - }); - await context.restartGatewayAfterStateMutation(async () => { - await rm(syncStore.pathname, { force: true }); - }); - const driver = await createMatrixQaDriverPersistentClient( + const restoreAccountId = context.sutAccountId ?? "sut"; + const configPath = requireMatrixQaGatewayConfigPath(context); + const originalAccountConfig = await readMatrixQaGatewayMatrixAccount({ + accountId: restoreAccountId, + configPath, + }); + const accountId = "sync-state-loss-gateway"; + const account = await registerMatrixQaDestructiveOwner( context, "matrix-e2ee-sync-state-loss-crypto-intact", ); + const roomKey = `${buildMatrixQaE2eeScenarioRoomKey("matrix-e2ee-sync-state-loss-crypto-intact")}-recovery`; const rawDriver = createMatrixQaDriverScenarioClient(context); + const roomId = await rawDriver.createPrivateRoom({ + encrypted: true, + inviteUserIds: [context.observerUserId, account.userId], + name: "Matrix QA E2EE Sync State Loss Recovery Room", + }); + await Promise.all([ + createMatrixQaClient({ + accessToken: context.observerAccessToken, + baseUrl: context.baseUrl, + }).joinRoom(roomId), + createMatrixQaClient({ + accessToken: account.accessToken, + baseUrl: context.baseUrl, + }).joinRoom(roomId), + ]); + const accountConfig: Record = { + ...originalAccountConfig, + accessToken: account.accessToken, + deviceId: account.deviceId, + enabled: true, + encryption: true, + groups: { + [roomId]: { + enabled: true, + requireMention: true, + }, + }, + homeserver: context.baseUrl, + password: account.password, + startupVerification: "off", + userId: account.userId, + }; + let driver: MatrixQaE2eeScenarioClient | undefined; + let gatewayAccountReplaced = false; try { + await context.restartGatewayAfterStateMutation( + async () => { + await replaceMatrixQaGatewayMatrixAccount({ + accountConfig, + accountId, + configPath, + }); + gatewayAccountReplaced = true; + }, + { + timeoutMs: context.timeoutMs, + waitAccountId: accountId, + }, + ); + const syncStore = await waitForMatrixSyncStoreWithCursor({ + accountId, + context, + stateDir: context.gatewayStateDir, + timeoutMs: context.timeoutMs, + userId: account.userId, + }); + await context.restartGatewayAfterStateMutation( + async () => { + await rm(syncStore.pathname, { force: true }); + }, + { + timeoutMs: context.timeoutMs, + waitAccountId: accountId, + }, + ); + await context.waitGatewayAccountReady?.(accountId, { + timeoutMs: context.timeoutMs, + }); + driver = await createMatrixQaDriverPersistentClient( + context, + "matrix-e2ee-sync-state-loss-crypto-intact", + ); const token = buildMatrixQaToken("MATRIX_QA_E2EE_SYNC_LOSS"); const driverStartSince = await driver.prime(); const rawStartSince = await rawDriver.primeRoom(); const driverEventId = await driver.sendTextMessage({ - body: buildMentionPrompt(context.sutUserId, token), - mentionUserIds: [context.sutUserId], + body: buildMentionPrompt(account.userId, token), + mentionUserIds: [account.userId], roomId, }); const decrypted = await driver.waitForRoomEvent({ predicate: (event) => isMatrixQaExactMarkerReply(event, { roomId, - sutUserId: context.sutUserId, + sutUserId: account.userId, token, }), roomId, @@ -1377,7 +1446,7 @@ export async function runMatrixQaE2eeSyncStateLossCryptoIntactScenario( observedEvents: context.observedEvents, predicate: (event) => event.roomId === roomId && - event.sender === context.sutUserId && + event.sender === account.userId && event.type === "m.room.encrypted", roomId, since: rawStartSince, @@ -1401,7 +1470,24 @@ export async function runMatrixQaE2eeSyncStateLossCryptoIntactScenario( ].join("\n"), }; } finally { - await driver.stop().catch(() => undefined); + await driver?.stop().catch(() => undefined); + if (gatewayAccountReplaced) { + await context + .restartGatewayAfterStateMutation( + async () => { + await replaceMatrixQaGatewayMatrixAccount({ + accountConfig: originalAccountConfig, + accountId: restoreAccountId, + configPath, + }); + }, + { + timeoutMs: context.timeoutMs, + waitAccountId: restoreAccountId, + }, + ) + .catch(() => undefined); + } } } @@ -1493,7 +1579,6 @@ export async function runMatrixQaE2eeWrongAccountRecoveryKeyScenario( export async function runMatrixQaE2eeHistoryExistsBackupEmptyScenario( context: MatrixQaScenarioContext, ): Promise { - const driverPassword = requireMatrixQaPassword(context, "driver"); const setup = await prepareMatrixQaDestructiveSetup( context, "matrix-e2ee-history-exists-backup-empty", @@ -1514,8 +1599,8 @@ export async function runMatrixQaE2eeHistoryExistsBackupEmptyScenario( context, deviceName: "OpenClaw Matrix QA Empty Backup", label: "history-exists-backup-empty", - password: driverPassword, - userId: context.driverUserId, + password: setup.ownerPassword, + userId: setup.ownerUserId, }); try { const restored = await waitForMatrixQaNonEmptyCliBackupRestore({ diff --git a/extensions/qa-matrix/src/runners/contract/scenario-runtime-e2ee.ts b/extensions/qa-matrix/src/runners/contract/scenario-runtime-e2ee.ts index ddc06c0a210..5944f805570 100644 --- a/extensions/qa-matrix/src/runners/contract/scenario-runtime-e2ee.ts +++ b/extensions/qa-matrix/src/runners/contract/scenario-runtime-e2ee.ts @@ -1,5 +1,5 @@ import { randomUUID } from "node:crypto"; -import { chmod, mkdir, mkdtemp, rm, stat, writeFile } from "node:fs/promises"; +import { chmod, mkdir, mkdtemp, readFile, rm, stat, writeFile } from "node:fs/promises"; import path from "node:path"; import { setTimeout as sleep } from "node:timers/promises"; import type { MatrixVerificationSummary } from "@openclaw/matrix/test-api.js"; @@ -33,8 +33,15 @@ import { redactMatrixQaCliOutput, runMatrixQaOpenClawCli, startMatrixQaOpenClawCli, + type MatrixQaCliSession, type MatrixQaCliRunResult, } from "./scenario-runtime-cli.js"; +import { + isMatrixQaPlainRecord, + patchMatrixQaGatewayMatrixAccount, + readMatrixQaGatewayMatrixAccount, + replaceMatrixQaGatewayMatrixAccount, +} from "./scenario-runtime-config.js"; import { assertThreadReplyArtifact, assertTopLevelReplyArtifact, @@ -61,20 +68,51 @@ type MatrixQaCliVerificationStatus = { matchesDecryptionKey?: boolean | null; trusted?: boolean | null; }; + backupVersion?: string | null; crossSigningVerified?: boolean; verified?: boolean; signedByOwner?: boolean; deviceId?: string | null; userId?: string | null; }; +type MatrixQaCliEncryptionSetupStatus = { + accountId?: string; + bootstrap?: { + error?: string; + success?: boolean; + }; + configPath?: string; + encryptionChanged?: boolean; + status?: MatrixQaCliVerificationStatus; + success?: boolean; +}; +type MatrixQaCliAccountAddStatus = { + accountId?: string; + configPath?: string; + encryptionEnabled?: boolean; + verificationBootstrap?: { + attempted?: boolean; + backupVersion?: string | null; + error?: string; + success?: boolean; + }; +}; type MatrixQaCliBackupRestoreStatus = { success?: boolean; backup?: MatrixQaCliVerificationStatus["backup"]; error?: string; }; -function isMatrixQaCliBackupUsable(backup: MatrixQaCliVerificationStatus["backup"]): boolean { - return Boolean(backup?.trusted && backup.matchesDecryptionKey && !backup.keyLoadError); +function isMatrixQaCliBackupUsable( + backup: MatrixQaCliVerificationStatus["backup"], + opts: { allowUntrustedMatchingKey?: boolean } = {}, +): boolean { + return Boolean( + (backup?.trusted || opts.allowUntrustedMatchingKey === true) && + backup?.matchesDecryptionKey && + backup.decryptionKeyCached && + !backup.keyLoadError, + ); } function requireMatrixQaE2eeOutputDir(context: MatrixQaScenarioContext) { @@ -91,8 +129,32 @@ function requireMatrixQaCliRuntimeEnv(context: MatrixQaScenarioContext) { return context.gatewayRuntimeEnv; } -function requireMatrixQaPassword(context: MatrixQaScenarioContext, actor: "driver" | "observer") { - const password = actor === "driver" ? context.driverPassword : context.observerPassword; +function requireMatrixQaGatewayConfigPath(context: MatrixQaScenarioContext) { + const configPath = requireMatrixQaCliRuntimeEnv(context).OPENCLAW_CONFIG_PATH?.trim(); + if (!configPath) { + throw new Error("Matrix CLI QA scenarios require the gateway config path"); + } + return configPath; +} + +function requireMatrixQaRegistrationToken(context: MatrixQaScenarioContext) { + const token = context.registrationToken?.trim(); + if (!token) { + throw new Error("Matrix CLI QA scenarios require the homeserver registration token"); + } + return token; +} + +function requireMatrixQaPassword( + context: MatrixQaScenarioContext, + actor: "driver" | "observer" | "sut", +) { + const password = + actor === "driver" + ? context.driverPassword + : actor === "observer" + ? context.observerPassword + : context.sutPassword; if (!password) { throw new Error(`Matrix E2EE ${actor} password is required for this scenario`); } @@ -249,11 +311,6 @@ function parseMatrixQaCliJsonText(text: string): unknown { function parseMatrixQaCliJson(result: MatrixQaCliRunResult): unknown { const stdout = result.stdout.trim(); const stderr = result.stderr.trim(); - if (stdout && stderr) { - throw new Error( - `${formatMatrixQaCliCommand(result.args)} printed JSON with extra output\nstdout:\n${redactMatrixQaCliOutput(stdout)}\nstderr:\n${redactMatrixQaCliOutput(stderr)}`, - ); - } if (stdout) { try { return parseMatrixQaCliJsonText(stdout); @@ -282,6 +339,101 @@ function parseMatrixQaCliJson(result: MatrixQaCliRunResult): unknown { } } +function buildMatrixQaPluginActivationConfig() { + return { + plugins: { + allow: ["matrix"], + entries: { + matrix: { enabled: true }, + }, + }, + }; +} + +function buildMatrixQaEmptyMatrixCliConfig() { + return { + ...buildMatrixQaPluginActivationConfig(), + channels: { + matrix: { + enabled: true, + accounts: {}, + }, + }, + }; +} + +async function registerMatrixQaCliE2eeAccount(params: { + context: MatrixQaScenarioContext; + deviceName: string; + scenarioId: MatrixQaE2eeScenarioId; +}) { + const localpartSuffix = params.scenarioId + .replace(/^matrix-e2ee-cli-/, "") + .replace(/[^a-z0-9]+/g, "-") + .replace(/^-+|-+$/g, "") + .slice(0, 24); + const account = await createMatrixQaClient({ + baseUrl: params.context.baseUrl, + }).registerWithToken({ + deviceName: params.deviceName, + localpart: `qa-cli-${localpartSuffix}-${randomUUID().replaceAll("-", "").slice(0, 8)}`, + password: `matrix-qa-${randomUUID()}`, + registrationToken: requireMatrixQaRegistrationToken(params.context), + }); + if (!account.deviceId) { + throw new Error( + `Matrix CLI QA registration for ${params.scenarioId} did not return a device id`, + ); + } + return account; +} + +async function registerMatrixQaE2eeScenarioAccount(params: { + context: MatrixQaScenarioContext; + deviceName: string; + localpartPrefix: string; + scenarioId: MatrixQaE2eeScenarioId; +}) { + const localpartSuffix = params.scenarioId + .replace(/^matrix-e2ee-/, "") + .replace(/[^a-z0-9]+/g, "-") + .replace(/^-+|-+$/g, "") + .slice(0, 24); + const account = await createMatrixQaClient({ + baseUrl: params.context.baseUrl, + }).registerWithToken({ + deviceName: params.deviceName, + localpart: `${params.localpartPrefix}-${localpartSuffix}-${randomUUID().replaceAll("-", "").slice(0, 8)}`, + password: `matrix-qa-${randomUUID()}`, + registrationToken: requireMatrixQaRegistrationToken(params.context), + }); + if (!account.deviceId) { + throw new Error( + `Matrix E2EE QA registration for ${params.scenarioId} did not return a device id`, + ); + } + return account; +} + +async function createMatrixQaE2eeCliOwnerClient(params: { + account: Awaited>; + context: MatrixQaScenarioContext; + scenarioId: MatrixQaE2eeScenarioId; +}) { + return await createMatrixQaE2eeScenarioClient({ + accessToken: params.account.accessToken, + actorId: `cli-owner-${randomUUID().slice(0, 8)}`, + baseUrl: params.context.baseUrl, + deviceId: params.account.deviceId, + observedEvents: params.context.observedEvents, + outputDir: requireMatrixQaE2eeOutputDir(params.context), + password: params.account.password, + scenarioId: params.scenarioId, + timeoutMs: params.context.timeoutMs, + userId: params.account.userId, + }); +} + function parseMatrixQaCliSasText( text: string, label: string, @@ -356,7 +508,7 @@ function assertMatrixQaCliSasMatches(params: { function isMatrixQaCliOwnerSelfVerification(params: { cliDeviceId?: string; - driverUserId: string; + ownerUserId: string; requireCompleted?: boolean; requirePending?: boolean; requireSas?: boolean; @@ -367,7 +519,7 @@ function isMatrixQaCliOwnerSelfVerification(params: { if ( !summary.isSelfVerification || summary.initiatedByMe || - summary.otherUserId !== params.driverUserId + summary.otherUserId !== params.ownerUserId ) { return false; } @@ -483,6 +635,111 @@ async function createMatrixQaCliSelfVerificationRuntime(params: { }; } +async function createMatrixQaCliE2eeSetupRuntime(params: { + artifactLabel: string; + context: MatrixQaScenarioContext; + initialConfig?: Record; +}) { + const outputDir = requireMatrixQaE2eeOutputDir(params.context); + const rootDir = await mkdtemp( + path.join(resolvePreferredOpenClawTmpDir(), "openclaw-matrix-e2ee-setup-qa-"), + ); + const artifactDir = path.join( + outputDir, + params.artifactLabel, + randomUUID().replaceAll("-", "").slice(0, 12), + ); + const stateDir = path.join(rootDir, "state"); + const configPath = path.join(rootDir, "config.json"); + await chmod(rootDir, 0o700).catch(() => undefined); + await assertMatrixQaPrivatePathMode(rootDir, "Matrix QA CLI temp directory"); + await mkdir(artifactDir, { mode: 0o700, recursive: true }); + await chmod(artifactDir, 0o700).catch(() => undefined); + await assertMatrixQaPrivatePathMode(artifactDir, "Matrix QA CLI artifact directory"); + await mkdir(stateDir, { mode: 0o700, recursive: true }); + await chmod(stateDir, 0o700).catch(() => undefined); + await assertMatrixQaPrivatePathMode(stateDir, "Matrix QA CLI state directory"); + await writeFile( + configPath, + `${JSON.stringify(params.initialConfig ?? buildMatrixQaEmptyMatrixCliConfig(), null, 2)}\n`, + { flag: "wx", mode: 0o600 }, + ); + await assertMatrixQaPrivatePathMode(configPath, "Matrix QA CLI config file"); + const env = { + ...requireMatrixQaCliRuntimeEnv(params.context), + FORCE_COLOR: "0", + NO_COLOR: "1", + OPENCLAW_CONFIG_PATH: configPath, + OPENCLAW_DISABLE_AUTO_UPDATE: "1", + OPENCLAW_STATE_DIR: stateDir, + }; + const run = async (args: string[], timeoutMs = params.context.timeoutMs) => + await runMatrixQaOpenClawCli({ + args, + env, + timeoutMs, + }); + const start = (args: string[], timeoutMs = params.context.timeoutMs) => + startMatrixQaOpenClawCli({ + args, + env, + timeoutMs, + }); + return { + configPath, + dispose: async () => { + await rm(rootDir, { force: true, recursive: true }); + }, + run, + rootDir: artifactDir, + start, + stateDir, + }; +} + +async function createMatrixQaCliGatewayRuntime(params: { + artifactLabel: string; + context: MatrixQaScenarioContext; +}) { + const outputDir = requireMatrixQaE2eeOutputDir(params.context); + const rootDir = await mkdtemp( + path.join(resolvePreferredOpenClawTmpDir(), "openclaw-matrix-gateway-cli-qa-"), + ); + const artifactDir = path.join( + outputDir, + params.artifactLabel, + randomUUID().replaceAll("-", "").slice(0, 12), + ); + const pluginStageDir = path.join(rootDir, "plugin-stage"); + await chmod(rootDir, 0o700).catch(() => undefined); + await assertMatrixQaPrivatePathMode(rootDir, "Matrix QA CLI temp directory"); + await mkdir(artifactDir, { mode: 0o700, recursive: true }); + await chmod(artifactDir, 0o700).catch(() => undefined); + await assertMatrixQaPrivatePathMode(artifactDir, "Matrix QA CLI artifact directory"); + await mkdir(pluginStageDir, { mode: 0o700, recursive: true }); + await chmod(pluginStageDir, 0o700).catch(() => undefined); + const env = { + ...requireMatrixQaCliRuntimeEnv(params.context), + FORCE_COLOR: "0", + NO_COLOR: "1", + OPENCLAW_DISABLE_AUTO_UPDATE: "1", + OPENCLAW_PLUGIN_STAGE_DIR: pluginStageDir, + }; + const run = async (args: string[], timeoutMs = params.context.timeoutMs) => + await runMatrixQaOpenClawCli({ + args, + env, + timeoutMs, + }); + return { + dispose: async () => { + await rm(rootDir, { force: true, recursive: true }); + }, + rootDir: artifactDir, + run, + }; +} + function assertMatrixQaSasEmojiMatches(params: { initiator: MatrixVerificationSummary; recipient: MatrixVerificationSummary; @@ -531,10 +788,11 @@ function isMatrixQaE2eeNoticeTriggeredSutReply(params: { async function createMatrixQaE2eeDriverClient( context: MatrixQaScenarioContext, scenarioId: MatrixQaE2eeScenarioId, + opts: { actorId?: "driver" | `driver-${string}` } = {}, ) { return await createMatrixQaE2eeScenarioClient({ accessToken: context.driverAccessToken, - actorId: "driver", + actorId: opts.actorId ?? "driver", baseUrl: context.baseUrl, deviceId: context.driverDeviceId, observedEvents: context.observedEvents, @@ -821,8 +1079,9 @@ async function withMatrixQaE2eeDriver( context: MatrixQaScenarioContext, scenarioId: MatrixQaE2eeScenarioId, run: (client: MatrixQaE2eeScenarioClient) => Promise, + opts: { actorId?: "driver" | `driver-${string}` } = {}, ) { - const client = await createMatrixQaE2eeDriverClient(context, scenarioId); + const client = await createMatrixQaE2eeDriverClient(context, scenarioId, opts); try { return await run(client); } finally { @@ -830,6 +1089,192 @@ async function withMatrixQaE2eeDriver( } } +async function createMatrixQaE2eeRegisteredScenarioClient(params: { + account: Awaited>; + actorId: `driver-${string}`; + context: MatrixQaScenarioContext; + scenarioId: MatrixQaE2eeScenarioId; +}) { + return await createMatrixQaE2eeScenarioClient({ + accessToken: params.account.accessToken, + actorId: params.actorId, + baseUrl: params.context.baseUrl, + deviceId: params.account.deviceId, + observedEvents: params.context.observedEvents, + outputDir: requireMatrixQaE2eeOutputDir(params.context), + password: params.account.password, + scenarioId: params.scenarioId, + timeoutMs: params.context.timeoutMs, + userId: params.account.userId, + }); +} + +async function withMatrixQaIsolatedE2eeDriverRoom( + context: MatrixQaScenarioContext, + scenarioId: MatrixQaE2eeScenarioId, + run: (params: { + client: MatrixQaE2eeScenarioClient; + driverUserId: string; + roomId: string; + roomKey: string; + }) => Promise, +) { + if (!context.restartGatewayAfterStateMutation) { + throw new Error( + "Matrix E2EE isolated driver room scenario requires hard gateway restart support", + ); + } + const accountId = context.sutAccountId ?? "sut"; + const configPath = requireMatrixQaGatewayConfigPath(context); + const accountConfig = await readMatrixQaGatewayMatrixAccount({ + accountId, + configPath, + }); + const originalGroups = isMatrixQaPlainRecord(accountConfig.groups) ? accountConfig.groups : {}; + const originalGroupAllowFrom = Array.isArray(accountConfig.groupAllowFrom) + ? accountConfig.groupAllowFrom + : undefined; + const originalGroupPolicy = accountConfig.groupPolicy; + const driverAccount = await registerMatrixQaE2eeScenarioAccount({ + context, + deviceName: "OpenClaw Matrix QA Isolated E2EE Driver", + localpartPrefix: "qa-e2ee-driver", + scenarioId, + }); + const driverApi = createMatrixQaClient({ + accessToken: driverAccount.accessToken, + baseUrl: context.baseUrl, + }); + const roomKey = buildMatrixQaE2eeScenarioRoomKey(scenarioId); + const roomId = await driverApi.createPrivateRoom({ + encrypted: true, + inviteUserIds: [context.observerUserId, context.sutUserId], + name: `Matrix QA ${scenarioId} Isolated E2EE Room`, + }); + await Promise.all([ + createMatrixQaClient({ + accessToken: context.observerAccessToken, + baseUrl: context.baseUrl, + }).joinRoom(roomId), + createMatrixQaClient({ + accessToken: context.sutAccessToken, + baseUrl: context.baseUrl, + }).joinRoom(roomId), + ]); + + const isolatedGroups = { + [roomId]: { + enabled: true, + requireMention: true, + }, + }; + const applyPatch = async (accountPatch: Record) => { + await context.restartGatewayAfterStateMutation?.( + async () => { + await patchMatrixQaGatewayMatrixAccount({ + accountId, + accountPatch, + configPath, + }); + }, + { + timeoutMs: context.timeoutMs, + waitAccountId: accountId, + }, + ); + }; + + let patchedGateway = false; + let client: MatrixQaE2eeScenarioClient | undefined; + try { + await applyPatch({ + groupAllowFrom: [driverAccount.userId], + groupPolicy: "allowlist", + groups: isolatedGroups, + }); + patchedGateway = true; + const actorId: `driver-${string}` = `driver-${scenarioId + .replace(/^matrix-e2ee-/, "") + .replace(/[^A-Za-z0-9_-]/g, "-") + .slice(0, 28)}`; + client = await createMatrixQaE2eeRegisteredScenarioClient({ + account: driverAccount, + actorId, + context, + scenarioId, + }); + await Promise.all([ + client.waitForJoinedMember({ + roomId, + timeoutMs: context.timeoutMs, + userId: context.sutUserId, + }), + client.waitForJoinedMember({ + roomId, + timeoutMs: context.timeoutMs, + userId: context.observerUserId, + }), + ]); + return await run({ + client, + driverUserId: driverAccount.userId, + roomId, + roomKey, + }); + } finally { + await client?.stop().catch(() => undefined); + if (patchedGateway) { + const restorePatch: Record = { + groupAllowFrom: originalGroupAllowFrom, + groupPolicy: originalGroupPolicy, + groups: originalGroups, + }; + await applyPatch(restorePatch).catch(() => undefined); + } + } +} + +async function runMatrixQaE2eeTopLevelWithClient( + context: MatrixQaScenarioContext, + params: { + client: MatrixQaE2eeScenarioClient; + driverUserId: string; + roomId: string; + roomKey: string; + tokenPrefix: string; + }, +) { + const startSince = await params.client.prime(); + const token = buildMatrixQaToken(params.tokenPrefix); + const body = buildMentionPrompt(context.sutUserId, token); + const driverEventId = await params.client.sendTextMessage({ + body, + mentionUserIds: [context.sutUserId], + roomId: params.roomId, + }); + const matched = await params.client.waitForRoomEvent({ + predicate: (event) => + isMatrixQaExactMarkerReply(event, { + roomId: params.roomId, + sutUserId: context.sutUserId, + token, + }) && event.relatesTo === undefined, + roomId: params.roomId, + timeoutMs: context.timeoutMs, + }); + const reply = buildMatrixE2eeReplyArtifact(matched.event, token); + assertTopLevelReplyArtifact("E2EE reply", reply); + return { + driverEventId, + driverUserId: params.driverUserId, + reply, + roomId: params.roomId, + roomKey: params.roomKey, + since: matched.since ?? startSince, + token, + }; +} + async function runMatrixQaE2eeTopLevelScenario( context: MatrixQaScenarioContext, params: { @@ -839,34 +1284,13 @@ async function runMatrixQaE2eeTopLevelScenario( ) { const { roomId, roomKey } = resolveMatrixQaE2eeScenarioGroupRoom(context, params.scenarioId); return await withMatrixQaE2eeDriver(context, params.scenarioId, async (client) => { - const startSince = await client.prime(); - const token = buildMatrixQaToken(params.tokenPrefix); - const body = buildMentionPrompt(context.sutUserId, token); - const driverEventId = await client.sendTextMessage({ - body, - mentionUserIds: [context.sutUserId], - roomId, - }); - const matched = await client.waitForRoomEvent({ - predicate: (event) => - isMatrixQaExactMarkerReply(event, { - roomId, - sutUserId: context.sutUserId, - token, - }) && event.relatesTo === undefined, - roomId, - timeoutMs: context.timeoutMs, - }); - const reply = buildMatrixE2eeReplyArtifact(matched.event, token); - assertTopLevelReplyArtifact("E2EE reply", reply); - return { - driverEventId, - reply, + return await runMatrixQaE2eeTopLevelWithClient(context, { + client, + driverUserId: context.driverUserId, roomId, roomKey, - since: matched.since ?? startSince, - token, - }; + tokenPrefix: params.tokenPrefix, + }); }); } @@ -1191,234 +1615,1325 @@ export async function runMatrixQaE2eeRecoveryOwnerVerificationRequiredScenario( ); } +function assertMatrixQaCliE2eeStatus( + label: string, + status: MatrixQaCliVerificationStatus, + opts: { allowUntrustedMatchingKey?: boolean } = {}, +) { + if ( + status.verified !== true || + status.crossSigningVerified !== true || + status.signedByOwner !== true || + !isMatrixQaCliBackupUsable(status.backup, opts) + ) { + throw new Error( + `${label} did not leave the CLI account fully verified and backup-usable: ownerVerified=${ + status.verified === true && + status.crossSigningVerified === true && + status.signedByOwner === true + ? "yes" + : "no" + }, backupUsable=${isMatrixQaCliBackupUsable(status.backup, opts) ? "yes" : "no"}${ + status.backup?.keyLoadError ? `, backupError=${status.backup.keyLoadError}` : "" + }`, + ); + } +} + +async function runMatrixQaCliExpectedFailure(params: { + args: string[]; + start: (args: string[], timeoutMs?: number) => MatrixQaCliSession; + timeoutMs: number; +}): Promise { + const session = params.start(params.args, params.timeoutMs); + try { + const result = await session.wait(); + throw new Error( + `${formatMatrixQaCliCommand(params.args)} unexpectedly succeeded with stdout:\n${redactMatrixQaCliOutput( + result.stdout, + )}`, + ); + } catch (error) { + if (error instanceof Error && error.message.includes("unexpectedly succeeded")) { + throw error; + } + const output = session.output(); + if (!output.stdout.trim() && !output.stderr.trim()) { + throw error; + } + return { + args: params.args, + exitCode: 1, + stderr: output.stderr, + stdout: output.stdout, + }; + } finally { + session.kill(); + } +} + +function buildMatrixQaCliE2eeAccountConfig(params: { + accountId: string; + accessToken: string; + baseUrl: string; + deviceId: string; + encryption: boolean; + name: string; + password?: string; + userId: string; +}) { + return { + ...buildMatrixQaPluginActivationConfig(), + channels: { + matrix: { + defaultAccount: params.accountId, + accounts: { + [params.accountId]: { + accessToken: params.accessToken, + deviceId: params.deviceId, + encryption: params.encryption, + homeserver: params.baseUrl, + initialSyncLimit: 1, + name: params.name, + network: { + dangerouslyAllowPrivateNetwork: true, + }, + ...(params.password ? { password: params.password } : {}), + startupVerification: "off", + userId: params.userId, + }, + }, + }, + }, + }; +} + +async function readMatrixQaCliConfig(pathname: string): Promise<{ + channels?: { + matrix?: { + accounts?: Record>; + defaultAccount?: string; + }; + }; +}> { + return JSON.parse(await readFile(pathname, "utf8")) as { + channels?: { + matrix?: { + accounts?: Record>; + defaultAccount?: string; + }; + }; + }; +} + +export async function runMatrixQaE2eeCliAccountAddEnableE2eeScenario( + context: MatrixQaScenarioContext, +): Promise { + const accountId = "cli-add-e2ee"; + const account = await registerMatrixQaCliE2eeAccount({ + context, + deviceName: "OpenClaw Matrix QA CLI Account Add Owner", + scenarioId: "matrix-e2ee-cli-account-add-enable-e2ee", + }); + const cli = await createMatrixQaCliE2eeSetupRuntime({ + artifactLabel: "cli-account-add-enable-e2ee", + context, + }); + try { + const addResult = await cli.run([ + "matrix", + "account", + "add", + "--account", + accountId, + "--name", + "Matrix QA CLI Account Add E2EE", + "--homeserver", + context.baseUrl, + "--user-id", + account.userId, + "--password", + account.password, + "--device-name", + "OpenClaw Matrix QA CLI Account Add E2EE", + "--allow-private-network", + "--enable-e2ee", + "--json", + ]); + const addArtifacts = await writeMatrixQaCliOutputArtifacts({ + label: "account-add-enable-e2ee", + result: addResult, + rootDir: cli.rootDir, + }); + const added = parseMatrixQaCliJson(addResult) as MatrixQaCliAccountAddStatus; + if (added.accountId !== accountId || added.encryptionEnabled !== true) { + throw new Error( + "Matrix CLI account add did not report E2EE enabled for the expected account", + ); + } + if (added.verificationBootstrap?.attempted !== true) { + throw new Error("Matrix CLI account add did not attempt verification bootstrap"); + } + if (added.verificationBootstrap.success !== true) { + throw new Error( + `Matrix CLI account add verification bootstrap failed: ${added.verificationBootstrap.error ?? "unknown error"}`, + ); + } + + const statusResult = await cli.run([ + "matrix", + "verify", + "status", + "--account", + accountId, + "--json", + ]); + const statusArtifacts = await writeMatrixQaCliOutputArtifacts({ + label: "verify-status", + result: statusResult, + rootDir: cli.rootDir, + }); + const status = parseMatrixQaCliJson(statusResult) as MatrixQaCliVerificationStatus; + assertMatrixQaCliE2eeStatus("Matrix CLI account add --enable-e2ee", status); + const cliDeviceId = status.deviceId ?? null; + + return { + artifacts: { + accountId, + backupVersion: added.verificationBootstrap.backupVersion ?? null, + cliDeviceId, + encryptionEnabled: added.encryptionEnabled, + verificationBootstrapAttempted: added.verificationBootstrap.attempted, + verificationBootstrapSuccess: added.verificationBootstrap.success, + }, + details: [ + "Matrix CLI account add --enable-e2ee created an encrypted, verified account", + `account add stdout: ${addArtifacts.stdoutPath}`, + `account add stderr: ${addArtifacts.stderrPath}`, + `verify status stdout: ${statusArtifacts.stdoutPath}`, + `verify status stderr: ${statusArtifacts.stderrPath}`, + `cli device: ${cliDeviceId ?? ""}`, + `cli verified by owner: ${status.verified ? "yes" : "no"}`, + `cli backup usable: ${isMatrixQaCliBackupUsable(status.backup) ? "yes" : "no"}`, + ].join("\n"), + }; + } finally { + await cli.dispose(); + } +} + +export async function runMatrixQaE2eeCliEncryptionSetupScenario( + context: MatrixQaScenarioContext, +): Promise { + const accountId = "cli-encryption-setup"; + const account = await registerMatrixQaCliE2eeAccount({ + context, + deviceName: "OpenClaw Matrix QA CLI Encryption Setup Owner", + scenarioId: "matrix-e2ee-cli-encryption-setup", + }); + const loginClient = createMatrixQaClient({ + baseUrl: context.baseUrl, + }); + const cliDevice = await loginClient.loginWithPassword({ + deviceName: "OpenClaw Matrix QA CLI Encryption Setup Device", + password: account.password, + userId: account.userId, + }); + if (!cliDevice.deviceId) { + throw new Error("Matrix E2EE CLI encryption setup login did not return a device id"); + } + const cli = await createMatrixQaCliE2eeSetupRuntime({ + artifactLabel: "cli-encryption-setup", + context, + initialConfig: buildMatrixQaCliE2eeAccountConfig({ + accountId, + accessToken: cliDevice.accessToken, + baseUrl: context.baseUrl, + deviceId: cliDevice.deviceId, + encryption: false, + name: "Matrix QA CLI Encryption Setup", + password: account.password, + userId: cliDevice.userId, + }), + }); + try { + const setupResult = await cli.run([ + "matrix", + "encryption", + "setup", + "--account", + accountId, + "--json", + ]); + const setupArtifacts = await writeMatrixQaCliOutputArtifacts({ + label: "encryption-setup", + result: setupResult, + rootDir: cli.rootDir, + }); + const setup = parseMatrixQaCliJson(setupResult) as MatrixQaCliEncryptionSetupStatus; + if ( + setup.accountId !== accountId || + setup.success !== true || + setup.encryptionChanged !== true || + setup.bootstrap?.success !== true || + !setup.status + ) { + throw new Error( + `Matrix CLI encryption setup did not report a successful E2EE upgrade: ${setup.bootstrap?.error ?? "unknown error"}`, + ); + } + assertMatrixQaCliE2eeStatus("Matrix CLI encryption setup", setup.status); + + const statusResult = await cli.run([ + "matrix", + "verify", + "status", + "--account", + accountId, + "--json", + ]); + const statusArtifacts = await writeMatrixQaCliOutputArtifacts({ + label: "verify-status", + result: statusResult, + rootDir: cli.rootDir, + }); + const status = parseMatrixQaCliJson(statusResult) as MatrixQaCliVerificationStatus; + assertMatrixQaCliE2eeStatus("Matrix CLI encryption setup status", status); + + return { + artifacts: { + accountId, + cliDeviceId: status.deviceId ?? cliDevice.deviceId, + encryptionChanged: setup.encryptionChanged, + setupSuccess: setup.success, + verificationBootstrapSuccess: setup.bootstrap.success, + }, + details: [ + "Matrix CLI encryption setup upgraded an existing account and bootstrapped verification", + `encryption setup stdout: ${setupArtifacts.stdoutPath}`, + `encryption setup stderr: ${setupArtifacts.stderrPath}`, + `verify status stdout: ${statusArtifacts.stdoutPath}`, + `verify status stderr: ${statusArtifacts.stderrPath}`, + `cli device: ${status.deviceId ?? cliDevice.deviceId}`, + `cli verified by owner: ${status.verified ? "yes" : "no"}`, + `cli backup usable: ${isMatrixQaCliBackupUsable(status.backup) ? "yes" : "no"}`, + ].join("\n"), + }; + } finally { + await cli.dispose(); + } +} + +export async function runMatrixQaE2eeCliEncryptionSetupIdempotentScenario( + context: MatrixQaScenarioContext, +): Promise { + const accountId = "cli-encryption-idempotent"; + const account = await registerMatrixQaCliE2eeAccount({ + context, + deviceName: "OpenClaw Matrix QA CLI Encryption Idempotent Owner", + scenarioId: "matrix-e2ee-cli-encryption-setup-idempotent", + }); + const loginClient = createMatrixQaClient({ + baseUrl: context.baseUrl, + }); + const cliDevice = await loginClient.loginWithPassword({ + deviceName: "OpenClaw Matrix QA CLI Encryption Idempotent Device", + password: account.password, + userId: account.userId, + }); + if (!cliDevice.deviceId) { + throw new Error("Matrix E2EE CLI idempotent setup login did not return a device id"); + } + const cli = await createMatrixQaCliE2eeSetupRuntime({ + artifactLabel: "cli-encryption-setup-idempotent", + context, + initialConfig: buildMatrixQaCliE2eeAccountConfig({ + accountId, + accessToken: cliDevice.accessToken, + baseUrl: context.baseUrl, + deviceId: cliDevice.deviceId, + encryption: true, + name: "Matrix QA CLI Encryption Setup Idempotent", + password: account.password, + userId: cliDevice.userId, + }), + }); + try { + const setupArgs = ["matrix", "encryption", "setup", "--account", accountId, "--json"]; + const firstResult = await cli.run(setupArgs); + const firstArtifacts = await writeMatrixQaCliOutputArtifacts({ + label: "encryption-setup-first", + result: firstResult, + rootDir: cli.rootDir, + }); + const first = parseMatrixQaCliJson(firstResult) as MatrixQaCliEncryptionSetupStatus; + if ( + first.accountId !== accountId || + first.success !== true || + first.encryptionChanged !== false || + first.bootstrap?.success !== true || + !first.status + ) { + throw new Error( + `Matrix CLI encryption setup was not idempotent on first run: ${first.bootstrap?.error ?? "unknown error"}`, + ); + } + assertMatrixQaCliE2eeStatus("Matrix CLI encryption setup idempotent first run", first.status); + + const secondResult = await cli.run(setupArgs); + const secondArtifacts = await writeMatrixQaCliOutputArtifacts({ + label: "encryption-setup-second", + result: secondResult, + rootDir: cli.rootDir, + }); + const second = parseMatrixQaCliJson(secondResult) as MatrixQaCliEncryptionSetupStatus; + if ( + second.accountId !== accountId || + second.success !== true || + second.encryptionChanged !== false || + second.bootstrap?.success !== true || + !second.status + ) { + throw new Error( + `Matrix CLI encryption setup was not idempotent on second run: ${second.bootstrap?.error ?? "unknown error"}`, + ); + } + assertMatrixQaCliE2eeStatus("Matrix CLI encryption setup idempotent second run", second.status); + + return { + artifacts: { + accountId, + cliDeviceId: second.status.deviceId ?? cliDevice.deviceId, + firstEncryptionChanged: first.encryptionChanged, + secondEncryptionChanged: second.encryptionChanged, + setupSuccess: second.success, + verificationBootstrapSuccess: second.bootstrap.success, + }, + details: [ + "Matrix CLI encryption setup stayed idempotent on an already encrypted account", + `first setup stdout: ${firstArtifacts.stdoutPath}`, + `first setup stderr: ${firstArtifacts.stderrPath}`, + `second setup stdout: ${secondArtifacts.stdoutPath}`, + `second setup stderr: ${secondArtifacts.stderrPath}`, + `cli device: ${second.status.deviceId ?? cliDevice.deviceId}`, + `first encryption changed: ${first.encryptionChanged ? "yes" : "no"}`, + `second encryption changed: ${second.encryptionChanged ? "yes" : "no"}`, + ].join("\n"), + }; + } finally { + await cli.dispose(); + } +} + +export async function runMatrixQaE2eeCliEncryptionSetupBootstrapFailureScenario( + context: MatrixQaScenarioContext, +): Promise { + const accountId = "cli-encryption-failure"; + const account = await registerMatrixQaCliE2eeAccount({ + context, + deviceName: "OpenClaw Matrix QA CLI Encryption Failure Owner", + scenarioId: "matrix-e2ee-cli-encryption-setup-bootstrap-failure", + }); + const loginClient = createMatrixQaClient({ + baseUrl: context.baseUrl, + }); + const cliDevice = await loginClient.loginWithPassword({ + deviceName: "OpenClaw Matrix QA CLI Encryption Failure Device", + password: account.password, + userId: account.userId, + }); + if (!cliDevice.deviceId) { + throw new Error("Matrix E2EE CLI bootstrap-failure login did not return a device id"); + } + const proxy = await startMatrixQaFaultProxy({ + targetBaseUrl: context.baseUrl, + rules: [buildRoomKeyBackupUnavailableFaultRule(cliDevice.accessToken)], + }); + const cli = await createMatrixQaCliE2eeSetupRuntime({ + artifactLabel: "cli-encryption-setup-bootstrap-failure", + context, + initialConfig: buildMatrixQaCliE2eeAccountConfig({ + accountId, + accessToken: cliDevice.accessToken, + baseUrl: proxy.baseUrl, + deviceId: cliDevice.deviceId, + encryption: false, + name: "Matrix QA CLI Encryption Setup Bootstrap Failure", + password: account.password, + userId: cliDevice.userId, + }), + }); + try { + const failed = await runMatrixQaCliExpectedFailure({ + args: ["matrix", "encryption", "setup", "--account", accountId, "--json"], + start: cli.start, + timeoutMs: context.timeoutMs, + }); + const artifacts = await writeMatrixQaCliOutputArtifacts({ + label: "encryption-setup-bootstrap-failure", + result: failed, + rootDir: cli.rootDir, + }); + const payload = parseMatrixQaCliJson(failed) as MatrixQaCliEncryptionSetupStatus; + if (payload.success !== false && payload.bootstrap?.success !== false) { + throw new Error("Matrix CLI encryption setup failure did not report unsuccessful bootstrap"); + } + const faultHits = proxy.hits(); + if (faultHits.length === 0) { + throw new Error("Matrix CLI encryption setup bootstrap-failure proxy was not exercised"); + } + const bootstrapError = payload.bootstrap?.error ?? ""; + if (!bootstrapError.toLowerCase().includes("room key backup")) { + throw new Error( + `Matrix CLI encryption setup failed for an unexpected reason: ${bootstrapError}`, + ); + } + + return { + artifacts: { + accountId, + bootstrapErrorPreview: bootstrapError.slice(0, 240), + bootstrapSuccess: false, + cliDeviceId: cliDevice.deviceId, + faultedEndpoint: faultHits[0]?.path, + faultHitCount: faultHits.length, + faultRuleId: MATRIX_QA_ROOM_KEY_BACKUP_FAULT_RULE_ID, + }, + details: [ + "Matrix CLI encryption setup surfaced a bootstrap failure from a faulted room-key backup endpoint", + `failure stdout: ${artifacts.stdoutPath}`, + `failure stderr: ${artifacts.stderrPath}`, + `fault hits: ${faultHits.length}`, + `fault endpoint: ${faultHits[0]?.path ?? ""}`, + `bootstrap error: ${bootstrapError}`, + ].join("\n"), + }; + } finally { + await Promise.all([cli.dispose(), proxy.stop().catch(() => undefined)]); + } +} + +export async function runMatrixQaE2eeCliRecoveryKeySetupScenario( + context: MatrixQaScenarioContext, +): Promise { + const accountId = "cli-recovery-key-setup"; + const account = await registerMatrixQaCliE2eeAccount({ + context, + deviceName: "OpenClaw Matrix QA CLI Recovery Key Owner", + scenarioId: "matrix-e2ee-cli-recovery-key-setup", + }); + const owner = await createMatrixQaE2eeCliOwnerClient({ + account, + context, + scenarioId: "matrix-e2ee-cli-recovery-key-setup", + }); + const loginClient = createMatrixQaClient({ + baseUrl: context.baseUrl, + }); + const ready = await ensureMatrixQaE2eeOwnDeviceVerified({ + client: owner, + label: "driver", + }); + const encodedRecoveryKey = ready.recoveryKey?.encodedPrivateKey?.trim(); + if (!encodedRecoveryKey) { + await owner.stop().catch(() => undefined); + throw new Error("Matrix E2EE CLI recovery-key setup did not expose a recovery key"); + } + const cliDevice = await loginClient.loginWithPassword({ + deviceName: "OpenClaw Matrix QA CLI Recovery Key Setup Device", + password: account.password, + userId: account.userId, + }); + if (!cliDevice.deviceId) { + await owner.stop().catch(() => undefined); + throw new Error("Matrix E2EE CLI recovery-key setup login did not return a device id"); + } + const cli = await createMatrixQaCliE2eeSetupRuntime({ + artifactLabel: "cli-recovery-key-setup", + context, + initialConfig: buildMatrixQaCliE2eeAccountConfig({ + accountId, + accessToken: cliDevice.accessToken, + baseUrl: context.baseUrl, + deviceId: cliDevice.deviceId, + encryption: false, + name: "Matrix QA CLI Recovery Key Setup", + password: account.password, + userId: cliDevice.userId, + }), + }); + try { + const setupResult = await cli.run([ + "matrix", + "encryption", + "setup", + "--account", + accountId, + "--recovery-key", + encodedRecoveryKey, + "--json", + ]); + const setupArtifacts = await writeMatrixQaCliOutputArtifacts({ + label: "recovery-key-setup", + result: setupResult, + rootDir: cli.rootDir, + }); + const setup = parseMatrixQaCliJson(setupResult) as MatrixQaCliEncryptionSetupStatus; + if ( + setup.accountId !== accountId || + setup.success !== true || + setup.encryptionChanged !== true || + setup.bootstrap?.success !== true || + !setup.status + ) { + throw new Error( + `Matrix CLI recovery-key encryption setup did not succeed: ${setup.bootstrap?.error ?? "unknown error"}`, + ); + } + assertMatrixQaCliE2eeStatus("Matrix CLI recovery-key encryption setup", setup.status, { + allowUntrustedMatchingKey: true, + }); + + return { + artifacts: { + accountId, + backupVersion: setup.status.backupVersion ?? ready.verification.backupVersion ?? null, + cliDeviceId: setup.status.deviceId ?? cliDevice.deviceId, + encryptionChanged: setup.encryptionChanged, + recoveryKeyId: ready.recoveryKey?.keyId ?? null, + recoveryKeyStored: true, + setupSuccess: setup.success, + verificationBootstrapSuccess: setup.bootstrap.success, + }, + details: [ + "Matrix CLI encryption setup accepted a recovery key on a second device", + `recovery setup stdout: ${setupArtifacts.stdoutPath}`, + `recovery setup stderr: ${setupArtifacts.stderrPath}`, + `owner backup version: ${ready.verification.backupVersion ?? ""}`, + `recovery key id: ${ready.recoveryKey?.keyId ?? ""}`, + `cli device: ${setup.status.deviceId ?? cliDevice.deviceId}`, + `cli verified by owner: ${setup.status.verified ? "yes" : "no"}`, + `cli backup usable: ${ + isMatrixQaCliBackupUsable(setup.status.backup, { allowUntrustedMatchingKey: true }) + ? "yes" + : "no" + }`, + ].join("\n"), + }; + } finally { + try { + await owner.stop().catch(() => undefined); + await owner.deleteOwnDevices([cliDevice.deviceId]).catch(() => undefined); + } finally { + await cli.dispose(); + } + } +} + +export async function runMatrixQaE2eeCliRecoveryKeyInvalidScenario( + context: MatrixQaScenarioContext, +): Promise { + const accountId = "cli-invalid-recovery-key"; + const invalidRecoveryKey = "not-a-valid-matrix-recovery-key"; + const account = await registerMatrixQaCliE2eeAccount({ + context, + deviceName: "OpenClaw Matrix QA CLI Invalid Recovery Key Owner", + scenarioId: "matrix-e2ee-cli-recovery-key-invalid", + }); + const owner = await createMatrixQaE2eeCliOwnerClient({ + account, + context, + scenarioId: "matrix-e2ee-cli-recovery-key-invalid", + }); + const ready = await ensureMatrixQaE2eeOwnDeviceVerified({ + client: owner, + label: "cli invalid recovery-key owner", + }); + if (!ready.recoveryKey?.encodedPrivateKey?.trim()) { + await owner.stop().catch(() => undefined); + throw new Error("Matrix E2EE CLI invalid recovery-key setup did not seed secret storage"); + } + const loginClient = createMatrixQaClient({ + baseUrl: context.baseUrl, + }); + const cliDevice = await loginClient.loginWithPassword({ + deviceName: "OpenClaw Matrix QA CLI Invalid Recovery Key Device", + password: account.password, + userId: account.userId, + }); + if (!cliDevice.deviceId) { + await owner.stop().catch(() => undefined); + throw new Error("Matrix E2EE CLI invalid recovery-key login did not return a device id"); + } + const cli = await createMatrixQaCliE2eeSetupRuntime({ + artifactLabel: "cli-recovery-key-invalid", + context, + initialConfig: buildMatrixQaCliE2eeAccountConfig({ + accountId, + accessToken: cliDevice.accessToken, + baseUrl: context.baseUrl, + deviceId: cliDevice.deviceId, + encryption: false, + name: "Matrix QA CLI Invalid Recovery Key", + password: account.password, + userId: cliDevice.userId, + }), + }); + try { + const failed = await runMatrixQaCliExpectedFailure({ + args: [ + "matrix", + "encryption", + "setup", + "--account", + accountId, + "--recovery-key", + invalidRecoveryKey, + "--json", + ], + start: cli.start, + timeoutMs: context.timeoutMs, + }); + const artifacts = await writeMatrixQaCliOutputArtifacts({ + label: "recovery-key-invalid", + result: failed, + rootDir: cli.rootDir, + }); + const payload = parseMatrixQaCliJson(failed) as MatrixQaCliEncryptionSetupStatus & { + error?: string; + }; + if (payload.success !== false && payload.bootstrap?.success !== false) { + throw new Error("Matrix CLI invalid recovery-key setup did not report failure"); + } + const failure = payload.bootstrap?.error ?? payload.error ?? ""; + if (!/recovery|secret|key/i.test(failure)) { + throw new Error( + `Matrix CLI invalid recovery-key setup failed for an unexpected reason: ${failure}`, + ); + } + if (failed.stdout.includes(invalidRecoveryKey) || failed.stderr.includes(invalidRecoveryKey)) { + throw new Error("Matrix CLI invalid recovery-key output leaked the recovery key"); + } + + return { + artifacts: { + accountId, + bootstrapErrorPreview: failure.slice(0, 240), + bootstrapSuccess: false, + cliDeviceId: cliDevice.deviceId, + encryptionChanged: payload.encryptionChanged, + recoveryKeyAccepted: false, + recoveryKeyRejected: true, + setupSuccess: false, + }, + details: [ + "Matrix CLI encryption setup rejected an invalid recovery key without leaking it", + `failure stdout: ${artifacts.stdoutPath}`, + `failure stderr: ${artifacts.stderrPath}`, + `cli device: ${cliDevice.deviceId}`, + `failure: ${failure}`, + ].join("\n"), + }; + } finally { + try { + await owner.stop().catch(() => undefined); + await owner.deleteOwnDevices([cliDevice.deviceId]).catch(() => undefined); + } finally { + await cli.dispose(); + } + } +} + +export async function runMatrixQaE2eeCliEncryptionSetupMultiAccountScenario( + context: MatrixQaScenarioContext, +): Promise { + const accountId = "cli-multi-target"; + const decoyAccountId = "cli-multi-decoy"; + const account = await registerMatrixQaCliE2eeAccount({ + context, + deviceName: "OpenClaw Matrix QA CLI Multi Account Owner", + scenarioId: "matrix-e2ee-cli-encryption-setup-multi-account", + }); + const loginClient = createMatrixQaClient({ + baseUrl: context.baseUrl, + }); + const cliDevice = await loginClient.loginWithPassword({ + deviceName: "OpenClaw Matrix QA CLI Multi Account Target Device", + password: account.password, + userId: account.userId, + }); + if (!cliDevice.deviceId) { + throw new Error("Matrix E2EE CLI multi-account setup login did not return a device id"); + } + const cli = await createMatrixQaCliE2eeSetupRuntime({ + artifactLabel: "cli-encryption-setup-multi-account", + context, + initialConfig: { + ...buildMatrixQaPluginActivationConfig(), + channels: { + matrix: { + defaultAccount: decoyAccountId, + accounts: { + [decoyAccountId]: { + accessToken: "decoy-token", + deviceId: "DECOYDEVICE", + encryption: false, + homeserver: context.baseUrl, + initialSyncLimit: 1, + name: "Matrix QA CLI Multi Account Decoy", + startupVerification: "off", + userId: "@decoy:matrix-qa.test", + }, + [accountId]: { + accessToken: cliDevice.accessToken, + deviceId: cliDevice.deviceId, + encryption: false, + homeserver: context.baseUrl, + initialSyncLimit: 1, + name: "Matrix QA CLI Multi Account Target", + network: { + dangerouslyAllowPrivateNetwork: true, + }, + password: account.password, + startupVerification: "off", + userId: cliDevice.userId, + }, + }, + }, + }, + }, + }); + try { + const setupResult = await cli.run([ + "matrix", + "encryption", + "setup", + "--account", + accountId, + "--json", + ]); + const setupArtifacts = await writeMatrixQaCliOutputArtifacts({ + label: "encryption-setup-multi-account", + result: setupResult, + rootDir: cli.rootDir, + }); + const setup = parseMatrixQaCliJson(setupResult) as MatrixQaCliEncryptionSetupStatus; + if ( + setup.accountId !== accountId || + setup.success !== true || + setup.encryptionChanged !== true || + setup.bootstrap?.success !== true || + !setup.status + ) { + throw new Error( + `Matrix CLI multi-account encryption setup did not target the requested account: ${setup.bootstrap?.error ?? "unknown error"}`, + ); + } + assertMatrixQaCliE2eeStatus("Matrix CLI multi-account encryption setup", setup.status); + + const config = await readMatrixQaCliConfig(cli.configPath); + const matrix = config.channels?.matrix; + const target = matrix?.accounts?.[accountId]; + const decoy = matrix?.accounts?.[decoyAccountId]; + const defaultAccountPreserved = matrix?.defaultAccount === decoyAccountId; + const decoyAccountPreserved = + decoy?.encryption === false && + decoy?.accessToken === "decoy-token" && + decoy?.deviceId === "DECOYDEVICE"; + if (!defaultAccountPreserved) { + throw new Error("Matrix CLI multi-account setup changed the default account"); + } + if (!decoyAccountPreserved) { + throw new Error("Matrix CLI multi-account setup mutated the decoy account"); + } + if (target?.encryption !== true) { + throw new Error("Matrix CLI multi-account setup did not enable encryption on the target"); + } + + return { + artifacts: { + accountId, + cliDeviceId: setup.status.deviceId ?? cliDevice.deviceId, + decoyAccountPreserved, + defaultAccountPreserved, + encryptionChanged: setup.encryptionChanged, + setupSuccess: setup.success, + verificationBootstrapSuccess: setup.bootstrap.success, + }, + details: [ + "Matrix CLI encryption setup changed only the requested account in a multi-account config", + `setup stdout: ${setupArtifacts.stdoutPath}`, + `setup stderr: ${setupArtifacts.stderrPath}`, + `default account preserved: ${defaultAccountPreserved ? "yes" : "no"}`, + `decoy account preserved: ${decoyAccountPreserved ? "yes" : "no"}`, + `cli device: ${setup.status.deviceId ?? cliDevice.deviceId}`, + ].join("\n"), + }; + } finally { + await cli.dispose(); + } +} + +export async function runMatrixQaE2eeCliSetupThenGatewayReplyScenario( + context: MatrixQaScenarioContext, +): Promise { + if (!context.restartGatewayAfterStateMutation) { + throw new Error( + "Matrix CLI setup gateway reply scenario requires hard gateway restart support", + ); + } + const gatewayConfigPath = requireMatrixQaGatewayConfigPath(context); + const accountId = "cli-setup-gateway"; + const scenarioId = "matrix-e2ee-cli-setup-then-gateway-reply"; + const roomKey = buildMatrixQaE2eeScenarioRoomKey(scenarioId); + const account = await registerMatrixQaCliE2eeAccount({ + context, + deviceName: "OpenClaw Matrix QA CLI Setup Gateway", + scenarioId, + }); + const driverAccount = await registerMatrixQaCliE2eeAccount({ + context, + deviceName: "OpenClaw Matrix QA CLI Setup Driver", + scenarioId, + }); + const driverApi = createMatrixQaClient({ + accessToken: driverAccount.accessToken, + baseUrl: context.baseUrl, + }); + const gatewayApi = createMatrixQaClient({ + accessToken: account.accessToken, + baseUrl: context.baseUrl, + }); + const roomId = await driverApi.createPrivateRoom({ + encrypted: true, + inviteUserIds: [account.userId], + name: "Matrix QA CLI Setup Gateway E2EE", + }); + await gatewayApi.joinRoom(roomId); + + const accountConfig = { + accessToken: account.accessToken, + deviceId: account.deviceId, + dm: { + allowFrom: [driverAccount.userId], + enabled: true, + policy: "allowlist", + sessionScope: "per-room", + threadReplies: "inbound", + }, + enabled: true, + encryption: false, + groupAllowFrom: [driverAccount.userId], + groupPolicy: "allowlist", + groups: { + [roomId]: { + enabled: true, + requireMention: true, + }, + }, + homeserver: context.baseUrl, + initialSyncLimit: 1, + name: "Matrix QA CLI Setup Gateway", + network: { + dangerouslyAllowPrivateNetwork: true, + }, + password: account.password, + startupVerification: "off", + threadReplies: "inbound", + userId: account.userId, + }; + await context.restartGatewayAfterStateMutation( + async () => { + await replaceMatrixQaGatewayMatrixAccount({ + accountConfig, + accountId, + configPath: gatewayConfigPath, + }); + }, + { + timeoutMs: context.timeoutMs, + waitAccountId: accountId, + }, + ); + await context.waitGatewayAccountReady?.(accountId, { + timeoutMs: context.timeoutMs, + }); + const cli = await createMatrixQaCliGatewayRuntime({ + artifactLabel: "cli-setup-then-gateway-reply", + context, + }); + try { + const setupResult = await cli.run([ + "matrix", + "encryption", + "setup", + "--account", + accountId, + "--json", + ]); + const setupArtifacts = await writeMatrixQaCliOutputArtifacts({ + label: "encryption-setup", + result: setupResult, + rootDir: cli.rootDir, + }); + const setup = parseMatrixQaCliJson(setupResult) as MatrixQaCliEncryptionSetupStatus; + if ( + setup.accountId !== accountId || + setup.success !== true || + setup.bootstrap?.success !== true + ) { + throw new Error( + `Matrix CLI gateway account setup did not succeed: ${setup.bootstrap?.error ?? "unknown error"}`, + ); + } + if (setup.status) { + assertMatrixQaCliE2eeStatus("Matrix CLI gateway account setup", setup.status); + } + await context.restartGatewayAfterStateMutation( + async () => { + await patchMatrixQaGatewayMatrixAccount({ + accountPatch: { + encryption: true, + password: account.password, + }, + accountId, + configPath: gatewayConfigPath, + }); + }, + { + timeoutMs: context.timeoutMs, + waitAccountId: accountId, + }, + ); + await context.waitGatewayAccountReady?.(accountId, { + timeoutMs: context.timeoutMs, + }); + const driverClient = await createMatrixQaE2eeScenarioClient({ + accessToken: driverAccount.accessToken, + actorId: `driver-cli-setup-gateway-${randomUUID().slice(0, 8)}`, + baseUrl: context.baseUrl, + deviceId: driverAccount.deviceId, + observedEvents: context.observedEvents, + outputDir: requireMatrixQaE2eeOutputDir(context), + password: driverAccount.password, + scenarioId, + timeoutMs: context.timeoutMs, + userId: driverAccount.userId, + }); + const replied = await (async () => { + try { + await ensureMatrixQaE2eeOwnDeviceVerified({ + client: driverClient, + label: "Matrix CLI setup scenario driver", + }); + await driverClient.waitForJoinedMember({ + roomId, + timeoutMs: context.timeoutMs, + userId: account.userId, + }); + await driverClient.prime(); + const token = buildMatrixQaToken("MATRIX_QA_E2EE_CLI_GATEWAY"); + const driverEventId = await driverClient.sendTextMessage({ + body: buildMentionPrompt(account.userId, token), + mentionUserIds: [account.userId], + roomId, + }); + const matched = await driverClient.waitForRoomEvent({ + predicate: (event) => + isMatrixQaExactMarkerReply(event, { + roomId, + sutUserId: account.userId, + token, + }) && event.relatesTo === undefined, + roomId, + timeoutMs: context.timeoutMs, + }); + const reply = buildMatrixE2eeReplyArtifact(matched.event, token); + assertTopLevelReplyArtifact("gateway reply", reply); + return { + driverEventId, + reply, + }; + } finally { + await driverClient.stop(); + } + })(); + + return { + artifacts: { + accountId, + cliDeviceId: setup.status?.deviceId ?? account.deviceId ?? null, + driverUserId: driverAccount.userId, + encryptionChanged: setup.encryptionChanged, + gatewayReply: replied.reply, + gatewayUserId: account.userId, + roomKey, + roomId, + setupSuccess: setup.success, + verificationBootstrapSuccess: setup.bootstrap.success, + }, + details: [ + "Matrix CLI encryption setup left the gateway able to reply in an encrypted room", + `setup stdout: ${setupArtifacts.stdoutPath}`, + `setup stderr: ${setupArtifacts.stderrPath}`, + `driver user: ${driverAccount.userId}`, + `gateway user: ${account.userId}`, + `encrypted room key: ${roomKey}`, + `encrypted room id: ${roomId}`, + `driver event: ${replied.driverEventId}`, + ...buildMatrixReplyDetails("gateway reply", replied.reply), + ].join("\n"), + }; + } finally { + await cli.dispose(); + } +} + export async function runMatrixQaE2eeCliSelfVerificationScenario( context: MatrixQaScenarioContext, ): Promise { - const driverPassword = requireMatrixQaPassword(context, "driver"); const accountId = "cli"; - return await withMatrixQaE2eeDriver( + const account = await registerMatrixQaCliE2eeAccount({ context, - "matrix-e2ee-cli-self-verification", - async (owner) => { - const ownerReady = await ensureMatrixQaE2eeOwnDeviceVerified({ - client: owner, - label: "driver", - }); - const encodedRecoveryKey = ownerReady.recoveryKey?.encodedPrivateKey?.trim(); - if (!encodedRecoveryKey) { - throw new Error("Matrix E2EE self-verification scenario did not expose a recovery key"); - } - const loginClient = createMatrixQaClient({ - baseUrl: context.baseUrl, - }); - const cliDevice = await loginClient.loginWithPassword({ - deviceName: "OpenClaw Matrix QA CLI Self Verification Device", - password: driverPassword, - userId: context.driverUserId, - }); - if (!cliDevice.deviceId) { - throw new Error("Matrix E2EE CLI verification login did not return a device id"); - } + deviceName: "OpenClaw Matrix QA CLI Self Verification Owner", + scenarioId: "matrix-e2ee-cli-self-verification", + }); + const owner = await createMatrixQaE2eeCliOwnerClient({ + account, + context, + scenarioId: "matrix-e2ee-cli-self-verification", + }); + try { + const ownerReady = await ensureMatrixQaE2eeOwnDeviceVerified({ + client: owner, + label: "CLI self-verification owner", + }); + const encodedRecoveryKey = ownerReady.recoveryKey?.encodedPrivateKey?.trim(); + if (!encodedRecoveryKey) { + throw new Error("Matrix E2EE self-verification scenario did not expose a recovery key"); + } + const loginClient = createMatrixQaClient({ + baseUrl: context.baseUrl, + }); + const cliDevice = await loginClient.loginWithPassword({ + deviceName: "OpenClaw Matrix QA CLI Self Verification Device", + password: account.password, + userId: account.userId, + }); + if (!cliDevice.deviceId) { + throw new Error("Matrix E2EE CLI verification login did not return a device id"); + } - const cli = await createMatrixQaCliSelfVerificationRuntime({ - accountId, - accessToken: cliDevice.accessToken, - context, - deviceId: cliDevice.deviceId, - userId: cliDevice.userId, + const cli = await createMatrixQaCliSelfVerificationRuntime({ + accountId, + accessToken: cliDevice.accessToken, + context, + deviceId: cliDevice.deviceId, + userId: cliDevice.userId, + }); + try { + const restoreResult = await cli.run( + [ + "matrix", + "verify", + "backup", + "restore", + "--account", + accountId, + "--recovery-key-stdin", + "--json", + ], + context.timeoutMs, + `${encodedRecoveryKey}\n`, + ); + const restoreArtifacts = await writeMatrixQaCliOutputArtifacts({ + label: "verify-backup-restore", + result: restoreResult, + rootDir: cli.rootDir, }); - try { - const restoreResult = await cli.run( - [ - "matrix", - "verify", - "backup", - "restore", - "--account", - accountId, - "--recovery-key-stdin", - "--json", - ], - context.timeoutMs, - `${encodedRecoveryKey}\n`, + const restored = parseMatrixQaCliJson(restoreResult) as MatrixQaCliBackupRestoreStatus; + if ( + restored.success !== true || + restored.backup?.decryptionKeyCached !== true || + restored.backup?.matchesDecryptionKey !== true || + restored.backup?.keyLoadError + ) { + throw new Error( + `Matrix CLI recovery key did not load matching room-key backup material before self-verification: ${ + restored.error ?? restored.backup?.keyLoadError ?? "unknown backup state" + }`, ); - const restoreArtifacts = await writeMatrixQaCliOutputArtifacts({ - label: "verify-backup-restore", - result: restoreResult, + } + const session = cli.start( + [ + "matrix", + "verify", + "self", + "--account", + accountId, + "--timeout-ms", + String(context.timeoutMs), + ], + context.timeoutMs * 2, + ); + try { + const requestOutput = await session.waitForOutput( + (output) => output.text.includes("Accept this verification request"), + "self-verification request guidance", + context.timeoutMs, + ); + const cliTransactionId = parseMatrixQaCliSummaryField(requestOutput.text, "Transaction id"); + const ownerRequested = await waitForMatrixQaVerificationSummary({ + client: owner, + label: "owner received CLI self-verification request", + predicate: (summary) => + isMatrixQaCliOwnerSelfVerification({ + cliDeviceId: cliTransactionId ? undefined : cliDevice.deviceId, + ownerUserId: account.userId, + requirePending: true, + summary, + transactionId: cliTransactionId ?? undefined, + }), + timeoutMs: context.timeoutMs, + }); + if (ownerRequested.canAccept) { + await owner.acceptVerification(ownerRequested.id); + } + + const sasOutput = await session.waitForOutput( + (output) => /^SAS (?:emoji|decimals):/m.test(output.text), + "SAS emoji or decimals", + context.timeoutMs, + ); + const cliSas = parseMatrixQaCliSasText( + sasOutput.text, + "interactive openclaw matrix verify self", + ); + const ownerSas = await waitForMatrixQaVerificationSummary({ + client: owner, + label: "owner SAS for CLI self-verification", + predicate: (summary) => + isMatrixQaCliOwnerSelfVerification({ + cliDeviceId: cliTransactionId ? undefined : cliDevice.deviceId, + ownerUserId: account.userId, + requireSas: true, + summary, + transactionId: cliTransactionId ?? undefined, + }), + timeoutMs: context.timeoutMs, + }); + const sasArtifact = assertMatrixQaCliSasMatches({ + cliSas, + owner: ownerSas, + }); + const ownerConfirm = owner.confirmVerificationSas(ownerSas.id); + await session.writeStdin("yes\n"); + session.endStdin(); + await ownerConfirm; + const completedCli = await session.wait(); + const selfVerificationArtifacts = await writeMatrixQaCliOutputArtifacts({ + label: "verify-self", + result: completedCli, rootDir: cli.rootDir, }); - const restored = parseMatrixQaCliJson(restoreResult) as MatrixQaCliBackupRestoreStatus; + if (!/^Device verified by owner:\s*yes$/m.test(completedCli.stdout)) { + throw new Error( + "Interactive Matrix CLI self-verification did not report final device verification", + ); + } + if (!/^Cross-signing verified:\s*yes$/m.test(completedCli.stdout)) { + throw new Error( + "Interactive Matrix CLI self-verification did not report full Matrix identity trust", + ); + } + const completedOwner = await waitForMatrixQaVerificationSummary({ + client: owner, + label: "owner completed CLI self-verification", + predicate: (summary) => + isMatrixQaCliOwnerSelfVerification({ + cliDeviceId: cliTransactionId ? undefined : cliDevice.deviceId, + ownerUserId: account.userId, + requireCompleted: true, + summary, + transactionId: cliTransactionId ?? undefined, + }), + timeoutMs: context.timeoutMs, + }); + const cliVerificationId = + completedCli.stdout.match(/^Verification id:\s*(\S+)/m)?.[1] ?? "interactive-cli"; + const statusResult = await cli.run([ + "matrix", + "verify", + "status", + "--account", + accountId, + "--json", + ]); + const statusArtifacts = await writeMatrixQaCliOutputArtifacts({ + label: "verify-status", + result: statusResult, + rootDir: cli.rootDir, + }); + const status = parseMatrixQaCliJson(statusResult) as MatrixQaCliVerificationStatus; if ( - restored.success !== true || - restored.backup?.decryptionKeyCached !== true || - restored.backup?.matchesDecryptionKey !== true || - restored.backup?.keyLoadError + status.verified !== true || + status.crossSigningVerified !== true || + status.signedByOwner !== true || + status.backup?.trusted !== true || + status.backup?.matchesDecryptionKey !== true || + status.backup?.keyLoadError ) { throw new Error( - `Matrix CLI recovery key did not load matching room-key backup material before self-verification: ${ - restored.error ?? restored.backup?.keyLoadError ?? "unknown backup state" + `Matrix CLI device was not fully usable after SAS completion: ownerVerified=${ + status.verified === true && + status.crossSigningVerified === true && + status.signedByOwner === true + ? "yes" + : "no" + }, backupUsable=${isMatrixQaCliBackupUsable(status.backup) ? "yes" : "no"}${ + status.backup?.keyLoadError ? `, backupError=${status.backup.keyLoadError}` : "" }`, ); } - const session = cli.start(["matrix", "verify", "self", "--account", accountId]); - try { - const requestOutput = await session.waitForOutput( - (output) => output.text.includes("Accept this verification request"), - "self-verification request guidance", - context.timeoutMs, - ); - const cliTransactionId = parseMatrixQaCliSummaryField( - requestOutput.text, - "Transaction id", - ); - const ownerRequested = await waitForMatrixQaVerificationSummary({ - client: owner, - label: "owner received CLI self-verification request", - predicate: (summary) => - isMatrixQaCliOwnerSelfVerification({ - cliDeviceId: cliTransactionId ? undefined : cliDevice.deviceId, - driverUserId: context.driverUserId, - requirePending: true, - summary, - transactionId: cliTransactionId ?? undefined, - }), - timeoutMs: context.timeoutMs, - }); - if (ownerRequested.canAccept) { - await owner.acceptVerification(ownerRequested.id); - } - - const sasOutput = await session.waitForOutput( - (output) => /^SAS (?:emoji|decimals):/m.test(output.text), - "SAS emoji or decimals", - context.timeoutMs, - ); - const cliSas = parseMatrixQaCliSasText( - sasOutput.text, - "interactive openclaw matrix verify self", - ); - const ownerSas = await waitForMatrixQaVerificationSummary({ - client: owner, - label: "owner SAS for CLI self-verification", - predicate: (summary) => - isMatrixQaCliOwnerSelfVerification({ - cliDeviceId: cliTransactionId ? undefined : cliDevice.deviceId, - driverUserId: context.driverUserId, - requireSas: true, - summary, - transactionId: cliTransactionId ?? undefined, - }), - timeoutMs: context.timeoutMs, - }); - const sasArtifact = assertMatrixQaCliSasMatches({ - cliSas, - owner: ownerSas, - }); - await owner.confirmVerificationSas(ownerSas.id); - await session.writeStdin("yes\n"); - session.endStdin(); - const completedCli = await session.wait(); - const selfVerificationArtifacts = await writeMatrixQaCliOutputArtifacts({ - label: "verify-self", - result: completedCli, - rootDir: cli.rootDir, - }); - if (!/^Device verified by owner:\s*yes$/m.test(completedCli.stdout)) { - throw new Error( - "Interactive Matrix CLI self-verification did not report final device verification", - ); - } - if (!/^Cross-signing verified:\s*yes$/m.test(completedCli.stdout)) { - throw new Error( - "Interactive Matrix CLI self-verification did not report full Matrix identity trust", - ); - } - const completedOwner = await waitForMatrixQaVerificationSummary({ - client: owner, - label: "owner completed CLI self-verification", - predicate: (summary) => - isMatrixQaCliOwnerSelfVerification({ - cliDeviceId: cliTransactionId ? undefined : cliDevice.deviceId, - driverUserId: context.driverUserId, - requireCompleted: true, - summary, - transactionId: cliTransactionId ?? undefined, - }), - timeoutMs: context.timeoutMs, - }); - const cliVerificationId = - completedCli.stdout.match(/^Verification id:\s*(\S+)/m)?.[1] ?? "interactive-cli"; - const statusResult = await cli.run([ - "matrix", - "verify", - "status", - "--account", - accountId, - "--json", - ]); - const statusArtifacts = await writeMatrixQaCliOutputArtifacts({ - label: "verify-status", - result: statusResult, - rootDir: cli.rootDir, - }); - const status = parseMatrixQaCliJson(statusResult) as MatrixQaCliVerificationStatus; - if ( - status.verified !== true || - status.crossSigningVerified !== true || - status.signedByOwner !== true || - status.backup?.trusted !== true || - status.backup?.matchesDecryptionKey !== true || - status.backup?.keyLoadError - ) { - throw new Error( - `Matrix CLI device was not fully usable after SAS completion: ownerVerified=${ - status.verified === true && - status.crossSigningVerified === true && - status.signedByOwner === true - ? "yes" - : "no" - }, backupUsable=${isMatrixQaCliBackupUsable(status.backup) ? "yes" : "no"}${ - status.backup?.keyLoadError ? `, backupError=${status.backup.keyLoadError}` : "" - }`, - ); - } - return { - artifacts: { - completedVerificationIds: [cliVerificationId, completedOwner.id], - currentDeviceId: status.deviceId ?? cliDevice.deviceId, - ...(cliSas.kind === "emoji" ? { sasEmoji: sasArtifact } : {}), - secondaryDeviceId: cliDevice.deviceId, - }, - details: [ - "Matrix CLI self-verification established full Matrix identity trust through interactive openclaw matrix verify self", - "cli secret config cleaned after run: yes", - `cli backup restore stdout: ${restoreArtifacts.stdoutPath}`, - `cli backup restore stderr: ${restoreArtifacts.stderrPath}`, - `cli verify self stdout: ${selfVerificationArtifacts.stdoutPath}`, - `cli verify self stderr: ${selfVerificationArtifacts.stderrPath}`, - `cli verify status stdout: ${statusArtifacts.stdoutPath}`, - `cli verify status stderr: ${statusArtifacts.stderrPath}`, - `cli device: ${cliDevice.deviceId}`, - `cli verification id: ${cliVerificationId}`, - `owner-side verification id: ${completedOwner.id}`, - `transaction: ${completedOwner.transactionId ?? ""}`, - `cli verified by owner: ${status.verified ? "yes" : "no"}`, - `cli cross-signing verified: ${status.crossSigningVerified ? "yes" : "no"}`, - `cli backup usable: ${isMatrixQaCliBackupUsable(status.backup) ? "yes" : "no"}`, - ].join("\n"), - }; - } finally { - session.kill(); - } + return { + artifacts: { + completedVerificationIds: [cliVerificationId, completedOwner.id], + currentDeviceId: status.deviceId ?? cliDevice.deviceId, + ...(cliSas.kind === "emoji" ? { sasEmoji: sasArtifact } : {}), + secondaryDeviceId: cliDevice.deviceId, + }, + details: [ + "Matrix CLI self-verification established full Matrix identity trust through interactive openclaw matrix verify self", + "cli secret config cleaned after run: yes", + `cli backup restore stdout: ${restoreArtifacts.stdoutPath}`, + `cli backup restore stderr: ${restoreArtifacts.stderrPath}`, + `cli verify self stdout: ${selfVerificationArtifacts.stdoutPath}`, + `cli verify self stderr: ${selfVerificationArtifacts.stderrPath}`, + `cli verify status stdout: ${statusArtifacts.stdoutPath}`, + `cli verify status stderr: ${statusArtifacts.stderrPath}`, + `cli device: ${cliDevice.deviceId}`, + `cli verification id: ${cliVerificationId}`, + `owner-side verification id: ${completedOwner.id}`, + `transaction: ${completedOwner.transactionId ?? ""}`, + `cli verified by owner: ${status.verified ? "yes" : "no"}`, + `cli cross-signing verified: ${status.crossSigningVerified ? "yes" : "no"}`, + `cli backup usable: ${isMatrixQaCliBackupUsable(status.backup) ? "yes" : "no"}`, + ].join("\n"), + }; } finally { - try { - await cli.dispose(); - } finally { - await owner.deleteOwnDevices([cliDevice.deviceId]).catch(() => undefined); - } + session.kill(); } - }, - ); + } finally { + try { + await cli.dispose(); + } finally { + await owner.stop().catch(() => undefined); + await owner.deleteOwnDevices([cliDevice.deviceId]).catch(() => undefined); + } + } + } finally { + await owner.stop().catch(() => undefined); + } } export async function runMatrixQaE2eeDeviceSasVerificationScenario( @@ -1712,34 +3227,49 @@ export async function runMatrixQaE2eeRestartResumeScenario( if (!context.restartGateway) { throw new Error("Matrix E2EE restart scenario requires gateway restart support"); } - const first = await runMatrixQaE2eeTopLevelScenario(context, { - scenarioId: "matrix-e2ee-restart-resume", - tokenPrefix: "MATRIX_QA_E2EE_BEFORE_RESTART", - }); - await context.restartGateway(); - const recovered = await runMatrixQaE2eeTopLevelScenario(context, { - scenarioId: "matrix-e2ee-restart-resume", - tokenPrefix: "MATRIX_QA_E2EE_AFTER_RESTART", - }); - return { - artifacts: { - firstDriverEventId: first.driverEventId, - firstReply: first.reply, - recoveredDriverEventId: recovered.driverEventId, - recoveredReply: recovered.reply, - restartSignal: "gateway-restart", - roomKey: recovered.roomKey, - roomId: recovered.roomId, + const restartGateway = context.restartGateway; + return await withMatrixQaIsolatedE2eeDriverRoom( + context, + "matrix-e2ee-restart-resume", + async ({ client, driverUserId, roomId, roomKey }) => { + const first = await runMatrixQaE2eeTopLevelWithClient(context, { + client, + driverUserId, + roomId, + roomKey, + tokenPrefix: "MATRIX_QA_E2EE_BEFORE_RESTART", + }); + await restartGateway(); + const recovered = await runMatrixQaE2eeTopLevelWithClient(context, { + client, + driverUserId, + roomId, + roomKey, + tokenPrefix: "MATRIX_QA_E2EE_AFTER_RESTART", + }); + return { + artifacts: { + driverUserId, + firstDriverEventId: first.driverEventId, + firstReply: first.reply, + recoveredDriverEventId: recovered.driverEventId, + recoveredReply: recovered.reply, + restartSignal: "gateway-restart", + roomKey: recovered.roomKey, + roomId: recovered.roomId, + }, + details: [ + `encrypted room key: ${recovered.roomKey}`, + `encrypted room id: ${recovered.roomId}`, + `isolated driver user: ${driverUserId}`, + `pre-restart event: ${first.driverEventId}`, + ...buildMatrixReplyDetails("pre-restart reply", first.reply), + `post-restart event: ${recovered.driverEventId}`, + ...buildMatrixReplyDetails("post-restart reply", recovered.reply), + ].join("\n"), + }; }, - details: [ - `encrypted room key: ${recovered.roomKey}`, - `encrypted room id: ${recovered.roomId}`, - `pre-restart event: ${first.driverEventId}`, - ...buildMatrixReplyDetails("pre-restart reply", first.reply), - `post-restart event: ${recovered.driverEventId}`, - ...buildMatrixReplyDetails("post-restart reply", recovered.reply), - ].join("\n"), - }; + ); } export async function runMatrixQaE2eeVerificationNoticeNoTriggerScenario( @@ -1802,96 +3332,111 @@ export async function runMatrixQaE2eeVerificationNoticeNoTriggerScenario( export async function runMatrixQaE2eeArtifactRedactionScenario( context: MatrixQaScenarioContext, ): Promise { - const result = await runMatrixQaE2eeTopLevelScenario(context, { - scenarioId: "matrix-e2ee-artifact-redaction", - tokenPrefix: "MATRIX_QA_E2EE_REDACT", - }); - const leaked = context.observedEvents.some( - (event) => - event.roomId === result.roomId && - (event.body?.includes(result.token) || event.formattedBody?.includes(result.token)), - ); - if (!leaked) { - throw new Error("Matrix E2EE redaction scenario did not observe decrypted content in memory"); - } - return { - artifacts: { - driverEventId: result.driverEventId, - reply: result.reply, - roomKey: result.roomKey, - roomId: result.roomId, + return await withMatrixQaIsolatedE2eeDriverRoom( + context, + "matrix-e2ee-artifact-redaction", + async ({ client, driverUserId, roomId, roomKey }) => { + const result = await runMatrixQaE2eeTopLevelWithClient(context, { + client, + driverUserId, + roomId, + roomKey, + tokenPrefix: "MATRIX_QA_E2EE_REDACT", + }); + const leaked = context.observedEvents.some( + (event) => + event.roomId === result.roomId && + (event.body?.includes(result.token) || event.formattedBody?.includes(result.token)), + ); + if (!leaked) { + throw new Error( + "Matrix E2EE redaction scenario did not observe decrypted content in memory", + ); + } + return { + artifacts: { + driverEventId: result.driverEventId, + driverUserId, + reply: result.reply, + roomKey: result.roomKey, + roomId: result.roomId, + }, + details: [ + "decrypted E2EE payload reached in-memory assertions only", + "observed-event artifacts redact body/formatted_body unless OPENCLAW_QA_MATRIX_CAPTURE_CONTENT=1", + `encrypted room id: ${result.roomId}`, + `isolated driver user: ${driverUserId}`, + ...buildMatrixReplyDetails("E2EE reply", result.reply), + ].join("\n"), + }; }, - details: [ - "decrypted E2EE payload reached in-memory assertions only", - "observed-event artifacts redact body/formatted_body unless OPENCLAW_QA_MATRIX_CAPTURE_CONTENT=1", - `encrypted room id: ${result.roomId}`, - ...buildMatrixReplyDetails("E2EE reply", result.reply), - ].join("\n"), - }; + ); } export async function runMatrixQaE2eeMediaImageScenario( context: MatrixQaScenarioContext, ): Promise { - const { roomId, roomKey } = resolveMatrixQaE2eeScenarioGroupRoom( + return await withMatrixQaIsolatedE2eeDriverRoom( context, "matrix-e2ee-media-image", - ); - return await withMatrixQaE2eeDriver(context, "matrix-e2ee-media-image", async (client) => { - const startSince = await client.prime(); - const triggerBody = buildMatrixQaImageUnderstandingPrompt(context.sutUserId); - const driverEventId = await client.sendImageMessage({ - body: triggerBody, - buffer: createMatrixQaSplitColorImagePng(), - contentType: "image/png", - fileName: MATRIX_QA_IMAGE_ATTACHMENT_FILENAME, - mentionUserIds: [context.sutUserId], - roomId, - }); - const attachmentEvent = await client.waitForRoomEvent({ - predicate: (event) => - event.roomId === roomId && - event.eventId === driverEventId && - event.sender === context.driverUserId && - event.attachment?.kind === "image" && - event.attachment.caption === triggerBody, - roomId, - timeoutMs: context.timeoutMs, - }); - const matched = await client.waitForRoomEvent({ - predicate: (event) => - event.roomId === roomId && - event.sender === context.sutUserId && - event.type === "m.room.message" && - event.relatesTo === undefined && - hasMatrixQaExpectedColorReply(event.body), - roomId, - timeoutMs: context.timeoutMs, - }); - const reply: MatrixQaReplyArtifact = { - eventId: matched.event.eventId, - mentions: matched.event.mentions, - relatesTo: matched.event.relatesTo, - sender: matched.event.sender, - }; - return { - artifacts: { - attachmentFilename: MATRIX_QA_IMAGE_ATTACHMENT_FILENAME, - driverEventId, - reply, - roomKey, + async ({ client, driverUserId, roomId, roomKey }) => { + const startSince = await client.prime(); + const triggerBody = buildMatrixQaImageUnderstandingPrompt(context.sutUserId); + const driverEventId = await client.sendImageMessage({ + body: triggerBody, + buffer: createMatrixQaSplitColorImagePng(), + contentType: "image/png", + fileName: MATRIX_QA_IMAGE_ATTACHMENT_FILENAME, + mentionUserIds: [context.sutUserId], roomId, - }, - details: [ - `encrypted room key: ${roomKey}`, - `encrypted room id: ${roomId}`, - `driver encrypted image event: ${driverEventId}`, - `driver encrypted image filename: ${MATRIX_QA_IMAGE_ATTACHMENT_FILENAME}`, - `driver encrypted image since: ${attachmentEvent.since ?? startSince ?? ""}`, - ...buildMatrixReplyDetails("E2EE image reply", reply), - ].join("\n"), - }; - }); + }); + const attachmentEvent = await client.waitForRoomEvent({ + predicate: (event) => + event.roomId === roomId && + event.eventId === driverEventId && + event.sender === driverUserId && + event.attachment?.kind === "image" && + event.attachment.caption === triggerBody, + roomId, + timeoutMs: context.timeoutMs, + }); + const matched = await client.waitForRoomEvent({ + predicate: (event) => + event.roomId === roomId && + event.sender === context.sutUserId && + event.type === "m.room.message" && + event.relatesTo === undefined && + hasMatrixQaExpectedColorReply(event.body), + roomId, + timeoutMs: context.timeoutMs, + }); + const reply: MatrixQaReplyArtifact = { + eventId: matched.event.eventId, + mentions: matched.event.mentions, + relatesTo: matched.event.relatesTo, + sender: matched.event.sender, + }; + return { + artifacts: { + attachmentFilename: MATRIX_QA_IMAGE_ATTACHMENT_FILENAME, + driverEventId, + driverUserId, + reply, + roomKey, + roomId, + }, + details: [ + `encrypted room key: ${roomKey}`, + `encrypted room id: ${roomId}`, + `isolated driver user: ${driverUserId}`, + `driver encrypted image event: ${driverEventId}`, + `driver encrypted image filename: ${MATRIX_QA_IMAGE_ATTACHMENT_FILENAME}`, + `driver encrypted image since: ${attachmentEvent.since ?? startSince ?? ""}`, + ...buildMatrixReplyDetails("E2EE image reply", reply), + ].join("\n"), + }; + }, + ); } export async function runMatrixQaE2eeKeyBootstrapFailureScenario( diff --git a/extensions/qa-matrix/src/runners/contract/scenario-runtime-shared.ts b/extensions/qa-matrix/src/runners/contract/scenario-runtime-shared.ts index f18a9b89dd5..926c9fa7833 100644 --- a/extensions/qa-matrix/src/runners/contract/scenario-runtime-shared.ts +++ b/extensions/qa-matrix/src/runners/contract/scenario-runtime-shared.ts @@ -30,9 +30,11 @@ export type MatrixQaScenarioContext = { gatewayRuntimeEnv?: NodeJS.ProcessEnv; gatewayStateDir?: string; outputDir?: string; + registrationToken?: string; restartGateway?: () => Promise; restartGatewayAfterStateMutation?: ( mutateState: (context: { stateDir: string }) => Promise, + opts?: { timeoutMs?: number; waitAccountId?: string }, ) => Promise; restartGatewayWithQueuedMessage?: (queueMessage: () => Promise) => Promise; roomId: string; @@ -50,6 +52,7 @@ export type MatrixQaScenarioContext = { patch: Record, opts?: { restartDelayMs?: number }, ) => Promise; + waitGatewayAccountReady?: (accountId: string, opts?: { timeoutMs?: number }) => Promise; }; export const NO_REPLY_WINDOW_MS = 8_000; diff --git a/extensions/qa-matrix/src/runners/contract/scenario-runtime-state-files.ts b/extensions/qa-matrix/src/runners/contract/scenario-runtime-state-files.ts index 34e6d0da834..848e5bec00f 100644 --- a/extensions/qa-matrix/src/runners/contract/scenario-runtime-state-files.ts +++ b/extensions/qa-matrix/src/runners/contract/scenario-runtime-state-files.ts @@ -98,18 +98,22 @@ export async function rewriteMatrixSyncStoreCursor(params: { cursor: string; pat } async function scoreMatrixStateFile(params: { + accountId?: string; context: MatrixQaScenarioContext; pathname: string; + userId?: string; }) { let score = params.pathname.includes(`${path.sep}matrix${path.sep}`) ? 4 : 0; + const expectedUserId = params.userId ?? params.context.sutUserId; + const expectedAccountId = params.accountId ?? params.context.sutAccountId; try { const metadata = await readJsonFile( path.join(path.dirname(params.pathname), "storage-meta.json"), ); - if (isRecord(metadata) && metadata.userId === params.context.sutUserId) { + if (isRecord(metadata) && metadata.userId === expectedUserId) { score += 16; } - if (isRecord(metadata) && metadata.accountId === params.context.sutAccountId) { + if (isRecord(metadata) && metadata.accountId === expectedAccountId) { score += 8; } } catch { @@ -119,9 +123,11 @@ async function scoreMatrixStateFile(params: { } async function resolveBestMatrixStateFile(params: { + accountId?: string; context: MatrixQaScenarioContext; filename: string; stateDir: string; + userId?: string; }) { const candidates = await findFilesByName({ filename: params.filename, @@ -136,6 +142,8 @@ async function resolveBestMatrixStateFile(params: { score: await scoreMatrixStateFile({ context: params.context, pathname, + ...(params.accountId ? { accountId: params.accountId } : {}), + ...(params.userId ? { userId: params.userId } : {}), }), })), ); @@ -144,9 +152,11 @@ async function resolveBestMatrixStateFile(params: { } export async function waitForMatrixSyncStoreWithCursor(params: { + accountId?: string; context: MatrixQaScenarioContext; stateDir: string; timeoutMs: number; + userId?: string; }) { const startedAt = Date.now(); let lastPath: string | null = null; @@ -155,6 +165,8 @@ export async function waitForMatrixSyncStoreWithCursor(params: { context: params.context, filename: MATRIX_SYNC_STORE_FILENAME, stateDir: params.stateDir, + ...(params.accountId ? { accountId: params.accountId } : {}), + ...(params.userId ? { userId: params.userId } : {}), }); lastPath = pathname; if (pathname) { diff --git a/extensions/qa-matrix/src/runners/contract/scenario-runtime.ts b/extensions/qa-matrix/src/runners/contract/scenario-runtime.ts index ea54dd2fa82..2e7012c9cf3 100644 --- a/extensions/qa-matrix/src/runners/contract/scenario-runtime.ts +++ b/extensions/qa-matrix/src/runners/contract/scenario-runtime.ts @@ -14,6 +14,7 @@ import { runMatrixQaE2eeServerBackupDeletedLocalStateIntactScenario, runMatrixQaE2eeServerBackupDeletedLocalReuploadRestoresScenario, runMatrixQaE2eeServerDeviceDeletedLocalStateIntactScenario, + runMatrixQaE2eeServerDeviceDeletedReloginRecoversScenario, runMatrixQaE2eeStaleRecoveryKeyAfterBackupResetScenario, runMatrixQaE2eeStateLossExternalRecoveryKeyScenario, runMatrixQaE2eeStateLossNoRecoveryKeyScenario, @@ -25,6 +26,14 @@ import { runMatrixQaE2eeArtifactRedactionScenario, runMatrixQaE2eeBasicReplyScenario, runMatrixQaE2eeBootstrapSuccessScenario, + runMatrixQaE2eeCliAccountAddEnableE2eeScenario, + runMatrixQaE2eeCliEncryptionSetupBootstrapFailureScenario, + runMatrixQaE2eeCliEncryptionSetupIdempotentScenario, + runMatrixQaE2eeCliEncryptionSetupMultiAccountScenario, + runMatrixQaE2eeCliEncryptionSetupScenario, + runMatrixQaE2eeCliRecoveryKeyInvalidScenario, + runMatrixQaE2eeCliRecoveryKeySetupScenario, + runMatrixQaE2eeCliSetupThenGatewayReplyScenario, runMatrixQaE2eeCliSelfVerificationScenario, runMatrixQaE2eeDeviceSasVerificationScenario, runMatrixQaE2eeDmSasVerificationScenario, @@ -325,6 +334,22 @@ export async function runMatrixQaScenario( return await runMatrixQaE2eeRecoveryKeyLifecycleScenario(context); case "matrix-e2ee-recovery-owner-verification-required": return await runMatrixQaE2eeRecoveryOwnerVerificationRequiredScenario(context); + case "matrix-e2ee-cli-account-add-enable-e2ee": + return await runMatrixQaE2eeCliAccountAddEnableE2eeScenario(context); + case "matrix-e2ee-cli-encryption-setup": + return await runMatrixQaE2eeCliEncryptionSetupScenario(context); + case "matrix-e2ee-cli-encryption-setup-idempotent": + return await runMatrixQaE2eeCliEncryptionSetupIdempotentScenario(context); + case "matrix-e2ee-cli-encryption-setup-bootstrap-failure": + return await runMatrixQaE2eeCliEncryptionSetupBootstrapFailureScenario(context); + case "matrix-e2ee-cli-recovery-key-setup": + return await runMatrixQaE2eeCliRecoveryKeySetupScenario(context); + case "matrix-e2ee-cli-recovery-key-invalid": + return await runMatrixQaE2eeCliRecoveryKeyInvalidScenario(context); + case "matrix-e2ee-cli-encryption-setup-multi-account": + return await runMatrixQaE2eeCliEncryptionSetupMultiAccountScenario(context); + case "matrix-e2ee-cli-setup-then-gateway-reply": + return await runMatrixQaE2eeCliSetupThenGatewayReplyScenario(context); case "matrix-e2ee-cli-self-verification": return await runMatrixQaE2eeCliSelfVerificationScenario(context); case "matrix-e2ee-state-loss-external-recovery-key": @@ -343,6 +368,8 @@ export async function runMatrixQaScenario( return await runMatrixQaE2eeCorruptCryptoIdbSnapshotScenario(context); case "matrix-e2ee-server-device-deleted-local-state-intact": return await runMatrixQaE2eeServerDeviceDeletedLocalStateIntactScenario(context); + case "matrix-e2ee-server-device-deleted-relogin-recovers": + return await runMatrixQaE2eeServerDeviceDeletedReloginRecoversScenario(context); case "matrix-e2ee-sync-state-loss-crypto-intact": return await runMatrixQaE2eeSyncStateLossCryptoIntactScenario(context); case "matrix-e2ee-wrong-account-recovery-key": diff --git a/extensions/qa-matrix/src/runners/contract/scenario-types.ts b/extensions/qa-matrix/src/runners/contract/scenario-types.ts index 53932bad3a8..1e1215c3b57 100644 --- a/extensions/qa-matrix/src/runners/contract/scenario-types.ts +++ b/extensions/qa-matrix/src/runners/contract/scenario-types.ts @@ -30,6 +30,7 @@ export type MatrixQaScenarioArtifacts = { attachmentFilename?: string; attachmentKind?: string; attachmentMsgtype?: string; + accountId?: string; actorUserId?: string; blocked?: MatrixQaScenarioArtifacts; catchupDriverEventId?: string; @@ -38,6 +39,7 @@ export type MatrixQaScenarioArtifacts = { dedupeCommitObserved?: boolean; duplicateWindowMs?: number; driverEventId?: string; + driverUserId?: string; editEventId?: string; editedToken?: string; expectedNoReplyWindowMs?: number; @@ -101,6 +103,8 @@ export type MatrixQaScenarioArtifacts = { backupRestored?: boolean; backupReset?: boolean; completedVerificationId?: string; + backupVersion?: string | null; + cliDeviceId?: string | null; completedVerificationIds?: string[]; currentDeviceId?: string | null; accountRoot?: string; @@ -117,7 +121,11 @@ export type MatrixQaScenarioArtifacts = { qrBytes?: number; recoveryDeviceId?: string; recoveryKeyPreserved?: boolean; + decoyAccountPreserved?: boolean; + defaultAccountPreserved?: boolean; + recoveryKeyAccepted?: boolean; recoveryKeyId?: string | null; + recoveryKeyRejected?: boolean; recoveryKeyStored?: boolean; rotatedRecoveryKeyId?: string | null; remainingDeviceIds?: string[]; @@ -132,9 +140,21 @@ export type MatrixQaScenarioArtifacts = { replyEventId?: string; statusError?: string; statusExitCode?: number; + defaultStatusError?: string; + defaultStatusExitCode?: number; serverDeviceKnown?: boolean | null; + replacementDeviceId?: string; selfVerificationTransactionId?: string | null; transportInterruption?: string; + encryptionChanged?: boolean; + encryptionEnabled?: boolean; + firstEncryptionChanged?: boolean; + gatewayUserId?: string; + secondEncryptionChanged?: boolean; + setupSuccess?: boolean; + verificationBootstrapAttempted?: boolean; + verificationBootstrapSuccess?: boolean; + gatewayReply?: MatrixQaReplyArtifact; verificationRoomId?: string; joinedRoomId?: string; localEventId?: string; diff --git a/extensions/qa-matrix/src/runners/contract/scenarios.test.ts b/extensions/qa-matrix/src/runners/contract/scenarios.test.ts index fd828b6ee51..8a8ed497fa3 100644 --- a/extensions/qa-matrix/src/runners/contract/scenarios.test.ts +++ b/extensions/qa-matrix/src/runners/contract/scenarios.test.ts @@ -69,6 +69,7 @@ function matrixQaScenarioContext(): MatrixQaScenarioContext { observedEvents: [], observerAccessToken: "observer-token", observerUserId: "@observer:matrix-qa.test", + registrationToken: "registration-token", roomId: "!main:matrix-qa.test", restartGateway: undefined, syncState: {}, @@ -83,6 +84,41 @@ function matrixQaScenarioContext(): MatrixQaScenarioContext { }; } +function mockMatrixQaCliAccount(params: { + accessToken: string; + deviceId: string; + localpart?: string; + password?: string; + userId?: string; +}) { + const password = params.password ?? "cli-password"; + const userId = params.userId ?? "@cli:matrix-qa.test"; + const account = { + accessToken: params.accessToken, + deviceId: params.deviceId, + localpart: params.localpart ?? "qa-cli-test", + password, + userId, + }; + const registerWithToken = vi.fn().mockResolvedValue(account); + const loginWithPassword = vi.fn().mockResolvedValue(account); + const inviteUserToRoom = vi.fn().mockResolvedValue({ eventId: "$invite" }); + const joinRoom = vi.fn().mockResolvedValue({ roomId: "!joined:matrix-qa.test" }); + createMatrixQaClient.mockReturnValue({ + inviteUserToRoom, + joinRoom, + loginWithPassword, + registerWithToken, + }); + return { + account, + inviteUserToRoom, + joinRoom, + loginWithPassword, + registerWithToken, + }; +} + async function writeTestJsonFile(pathname: string, value: unknown) { await writeFile(pathname, `${JSON.stringify(value, null, 2)}\n`); } @@ -168,6 +204,14 @@ describe("matrix live qa scenarios", () => { "matrix-e2ee-bootstrap-success", "matrix-e2ee-recovery-key-lifecycle", "matrix-e2ee-recovery-owner-verification-required", + "matrix-e2ee-cli-account-add-enable-e2ee", + "matrix-e2ee-cli-encryption-setup", + "matrix-e2ee-cli-encryption-setup-idempotent", + "matrix-e2ee-cli-encryption-setup-bootstrap-failure", + "matrix-e2ee-cli-recovery-key-setup", + "matrix-e2ee-cli-recovery-key-invalid", + "matrix-e2ee-cli-encryption-setup-multi-account", + "matrix-e2ee-cli-setup-then-gateway-reply", "matrix-e2ee-cli-self-verification", "matrix-e2ee-state-loss-external-recovery-key", "matrix-e2ee-state-loss-stored-recovery-key", @@ -177,6 +221,7 @@ describe("matrix live qa scenarios", () => { "matrix-e2ee-server-backup-deleted-local-reupload-restores", "matrix-e2ee-corrupt-crypto-idb-snapshot", "matrix-e2ee-server-device-deleted-local-state-intact", + "matrix-e2ee-server-device-deleted-relogin-recovers", "matrix-e2ee-sync-state-loss-crypto-intact", "matrix-e2ee-history-exists-backup-empty", "matrix-e2ee-device-sas-verification", @@ -231,6 +276,30 @@ describe("matrix live qa scenarios", () => { 150_000, ); expect(scenarios.get("matrix-e2ee-media-image")?.timeoutMs).toBeGreaterThanOrEqual(180_000); + expect( + scenarios.get("matrix-e2ee-cli-account-add-enable-e2ee")?.timeoutMs, + ).toBeGreaterThanOrEqual(120_000); + expect(scenarios.get("matrix-e2ee-cli-encryption-setup")?.timeoutMs).toBeGreaterThanOrEqual( + 120_000, + ); + expect( + scenarios.get("matrix-e2ee-cli-encryption-setup-idempotent")?.timeoutMs, + ).toBeGreaterThanOrEqual(120_000); + expect( + scenarios.get("matrix-e2ee-cli-encryption-setup-bootstrap-failure")?.timeoutMs, + ).toBeGreaterThanOrEqual(120_000); + expect(scenarios.get("matrix-e2ee-cli-recovery-key-setup")?.timeoutMs).toBeGreaterThanOrEqual( + 120_000, + ); + expect(scenarios.get("matrix-e2ee-cli-recovery-key-invalid")?.timeoutMs).toBeGreaterThanOrEqual( + 120_000, + ); + expect( + scenarios.get("matrix-e2ee-cli-encryption-setup-multi-account")?.timeoutMs, + ).toBeGreaterThanOrEqual(120_000); + expect( + scenarios.get("matrix-e2ee-cli-setup-then-gateway-reply")?.timeoutMs, + ).toBeGreaterThanOrEqual(180_000); }); it("keeps the Matrix subagent room policy compatible with leaf child sessions", () => { @@ -1199,6 +1268,499 @@ describe("matrix live qa scenarios", () => { } }); + it("configures a fresh encrypted room before sync-state-loss recovery", async () => { + const stateRoot = await mkdtemp(path.join(os.tmpdir(), "matrix-sync-loss-")); + try { + const callOrder: string[] = []; + const gatewayConfigPath = path.join(stateRoot, "gateway-config.json"); + const originalGroups = { + "!previous:matrix-qa.test": { + enabled: true, + requireMention: true, + }, + }; + const accountDir = path.join( + stateRoot, + "matrix", + "accounts", + "sync-state-loss-gateway", + "server", + "token", + ); + const syncStorePath = path.join(accountDir, "bot-storage.json"); + await mkdir(accountDir, { recursive: true }); + await writeTestJsonFile(gatewayConfigPath, { + channels: { + matrix: { + accounts: { + sut: { + accessToken: "sut-token", + deviceId: "SUT", + enabled: true, + groups: originalGroups, + homeserver: "http://127.0.0.1:28008/", + password: "sut-password", + userId: "@sut:matrix-qa.test", + }, + }, + defaultAccount: "sut", + }, + }, + }); + await writeTestJsonFile(path.join(accountDir, "storage-meta.json"), { + accountId: "sync-state-loss-gateway", + userId: "@sync-gateway:matrix-qa.test", + }); + await writeTestJsonFile(syncStorePath, matrixSyncStoreFixture("sut-sync-before-loss")); + + const registerWithToken = vi.fn().mockResolvedValue({ + accessToken: "sync-gateway-token", + deviceId: "SYNCGATEWAY", + localpart: "qa-destructive-sync-state-loss", + password: "sync-gateway-password", + userId: "@sync-gateway:matrix-qa.test", + }); + const createPrivateRoom = vi.fn(async () => { + callOrder.push("create-room"); + return "!recovery:matrix-qa.test"; + }); + const primeRoom = vi.fn().mockResolvedValue("raw-driver-sync-start"); + const rawWaitForRoomEvent = vi.fn().mockResolvedValue({ + event: { + eventId: "$sut-encrypted-reply", + roomId: "!recovery:matrix-qa.test", + sender: "@sync-gateway:matrix-qa.test", + type: "m.room.encrypted", + }, + since: "raw-driver-sync-after-reply", + }); + const observerJoinRoom = vi.fn(async () => { + callOrder.push("observer-join"); + return "!recovery:matrix-qa.test"; + }); + const sutJoinRoom = vi.fn(async () => { + callOrder.push("sut-join"); + return "!recovery:matrix-qa.test"; + }); + createMatrixQaClient + .mockReturnValueOnce({ registerWithToken }) + .mockReturnValueOnce({ + createPrivateRoom, + primeRoom, + waitForRoomEvent: rawWaitForRoomEvent, + }) + .mockReturnValueOnce({ joinRoom: observerJoinRoom }) + .mockReturnValueOnce({ joinRoom: sutJoinRoom }); + + const sendTextMessage = vi.fn().mockResolvedValue("$driver-trigger"); + const waitForRoomEvent = vi.fn().mockImplementation(async () => { + const token = String(sendTextMessage.mock.calls[0]?.[0]?.body).replace( + "@sync-gateway:matrix-qa.test reply with only this exact marker: ", + "", + ); + return { + event: { + body: token, + eventId: "$sut-decrypted-reply", + kind: "message", + roomId: "!recovery:matrix-qa.test", + sender: "@sync-gateway:matrix-qa.test", + type: "m.room.message", + }, + }; + }); + const stop = vi.fn().mockResolvedValue(undefined); + createMatrixQaE2eeScenarioClient.mockResolvedValue({ + prime: vi.fn().mockResolvedValue("e2ee-driver-sync-start"), + sendTextMessage, + stop, + waitForRoomEvent, + }); + const hardRestartAccounts: Array<{ + accounts: Record; userId?: string }>; + defaultAccount?: string; + }> = []; + const waitGatewayAccountReady = vi.fn().mockResolvedValue(undefined); + + const scenario = MATRIX_QA_SCENARIOS.find( + (entry) => entry.id === "matrix-e2ee-sync-state-loss-crypto-intact", + ); + expect(scenario).toBeDefined(); + + await expect( + runMatrixQaScenario(scenario!, { + ...matrixQaScenarioContext(), + driverDeviceId: "DRIVER", + gatewayRuntimeEnv: { + OPENCLAW_CONFIG_PATH: gatewayConfigPath, + PATH: process.env.PATH, + }, + gatewayStateDir: stateRoot, + observerDeviceId: "OBSERVER", + outputDir: stateRoot, + restartGatewayAfterStateMutation: async (mutateState) => { + callOrder.push("hard-restart"); + await mutateState({ stateDir: stateRoot }); + const config = JSON.parse(await readFile(gatewayConfigPath, "utf8")) as { + channels: { + matrix: { + accounts: Record; userId?: string }>; + defaultAccount?: string; + }; + }; + }; + hardRestartAccounts.push({ + accounts: config.channels.matrix.accounts, + defaultAccount: config.channels.matrix.defaultAccount, + }); + }, + sutAccountId: "sut", + sutDeviceId: "SUT", + waitGatewayAccountReady, + }), + ).resolves.toMatchObject({ + artifacts: { + deletedSyncStorePath: syncStorePath, + driverEventId: "$driver-trigger", + replyEventId: "$sut-decrypted-reply", + roomKey: "e2ee-sync-state-loss-crypto-intact-recovery", + }, + }); + + await expect(stat(syncStorePath)).rejects.toThrow(); + expect(registerWithToken).toHaveBeenCalledWith( + expect.objectContaining({ + registrationToken: "registration-token", + }), + ); + expect(createPrivateRoom).toHaveBeenCalledWith({ + encrypted: true, + inviteUserIds: ["@observer:matrix-qa.test", "@sync-gateway:matrix-qa.test"], + name: "Matrix QA E2EE Sync State Loss Recovery Room", + }); + expect(observerJoinRoom).toHaveBeenCalledWith("!recovery:matrix-qa.test"); + expect(sutJoinRoom).toHaveBeenCalledWith("!recovery:matrix-qa.test"); + expect(hardRestartAccounts).toEqual([ + { + accounts: { + "sync-state-loss-gateway": expect.objectContaining({ + groups: { + "!recovery:matrix-qa.test": { + enabled: true, + requireMention: true, + }, + }, + userId: "@sync-gateway:matrix-qa.test", + }), + }, + defaultAccount: "sync-state-loss-gateway", + }, + { + accounts: { + "sync-state-loss-gateway": expect.objectContaining({ + groups: { + "!recovery:matrix-qa.test": { + enabled: true, + requireMention: true, + }, + }, + userId: "@sync-gateway:matrix-qa.test", + }), + }, + defaultAccount: "sync-state-loss-gateway", + }, + { + accounts: { + sut: expect.objectContaining({ + groups: originalGroups, + userId: "@sut:matrix-qa.test", + }), + }, + defaultAccount: "sut", + }, + ]); + expect(callOrder).toEqual([ + "create-room", + "observer-join", + "sut-join", + "hard-restart", + "hard-restart", + "hard-restart", + ]); + expect(waitGatewayAccountReady).toHaveBeenCalledWith("sync-state-loss-gateway", { + timeoutMs: 8_000, + }); + expect(sendTextMessage).toHaveBeenCalledWith({ + body: expect.stringContaining( + "@sync-gateway:matrix-qa.test reply with only this exact marker:", + ), + mentionUserIds: ["@sync-gateway:matrix-qa.test"], + roomId: "!recovery:matrix-qa.test", + }); + expect(rawWaitForRoomEvent).toHaveBeenCalledWith( + expect.objectContaining({ + roomId: "!recovery:matrix-qa.test", + since: "raw-driver-sync-start", + }), + ); + const finalConfig = JSON.parse(await readFile(gatewayConfigPath, "utf8")) as { + channels: { + matrix: { + accounts: Record }>; + defaultAccount?: string; + }; + }; + }; + expect(finalConfig.channels.matrix.defaultAccount).toBe("sut"); + expect(Object.keys(finalConfig.channels.matrix.accounts)).toEqual(["sut"]); + expect(finalConfig.channels.matrix.accounts.sut?.groups).toEqual(originalGroups); + } finally { + await rm(stateRoot, { recursive: true, force: true }); + } + }); + + it("isolates E2EE restart-resume gateway groups and restores them after the scenario", async () => { + const outputDir = await mkdtemp(path.join(os.tmpdir(), "matrix-e2ee-restart-isolation-")); + try { + const gatewayConfigPath = path.join(outputDir, "gateway-config.json"); + const originalGroups = { + "!artifact:matrix-qa.test": { + enabled: true, + requireMention: true, + }, + "!dynamic-recovery:matrix-qa.test": { + enabled: true, + requireMention: true, + }, + "!main:matrix-qa.test": { + enabled: true, + requireMention: true, + }, + "!restart:matrix-qa.test": { + enabled: true, + requireMention: true, + }, + }; + await writeTestJsonFile(gatewayConfigPath, { + channels: { + matrix: { + accounts: { + sut: { + groupAllowFrom: ["@driver:matrix-qa.test"], + groupPolicy: "allowlist", + groups: originalGroups, + }, + }, + }, + }, + }); + + const callOrder: string[] = []; + const registerWithToken = vi.fn().mockResolvedValue({ + accessToken: "isolated-driver-token", + deviceId: "ISOLATEDDRIVER", + localpart: "qa-e2ee-driver-restart", + password: "isolated-driver-password", + userId: "@isolated-driver:matrix-qa.test", + }); + const createPrivateRoom = vi.fn(async () => { + callOrder.push("create-room"); + return "!isolated-restart:matrix-qa.test"; + }); + const observerJoinRoom = vi.fn(async () => { + callOrder.push("observer-join"); + return "!isolated-restart:matrix-qa.test"; + }); + const sutJoinRoom = vi.fn(async () => { + callOrder.push("sut-join"); + return "!isolated-restart:matrix-qa.test"; + }); + createMatrixQaClient + .mockReturnValueOnce({ registerWithToken }) + .mockReturnValueOnce({ createPrivateRoom }) + .mockReturnValueOnce({ joinRoom: observerJoinRoom }) + .mockReturnValueOnce({ joinRoom: sutJoinRoom }); + + const sendTextMessage = vi.fn().mockImplementation(async ({ body }) => { + if (String(body).includes("MATRIX_QA_E2EE_BEFORE_RESTART")) { + const isolatedConfig = JSON.parse(await readFile(gatewayConfigPath, "utf8")) as { + channels: { + matrix: { + accounts: { + sut: { + groupAllowFrom: string[]; + groupPolicy: string; + groups: Record; + }; + }; + }; + }; + }; + expect(Object.keys(isolatedConfig.channels.matrix.accounts.sut.groups)).toEqual([ + "!isolated-restart:matrix-qa.test", + ]); + expect(isolatedConfig.channels.matrix.accounts.sut.groupAllowFrom).toEqual([ + "@isolated-driver:matrix-qa.test", + ]); + expect(isolatedConfig.channels.matrix.accounts.sut.groupPolicy).toBe("allowlist"); + callOrder.push("send:before"); + return "$before-trigger"; + } + callOrder.push("send:after"); + return "$after-trigger"; + }); + const waitForRoomEvent = vi.fn().mockImplementation(async (params) => { + const body = String(sendTextMessage.mock.calls.at(-1)?.[0]?.body ?? ""); + const token = body.replace("@sut:matrix-qa.test reply with only this exact marker: ", ""); + return { + event: { + body: token, + eventId: token.includes("BEFORE") ? "$before-reply" : "$after-reply", + kind: "message", + roomId: params.roomId, + sender: "@sut:matrix-qa.test", + type: "m.room.message", + }, + since: `${params.roomId}:reply`, + }; + }); + const stop = vi.fn().mockResolvedValue(undefined); + createMatrixQaE2eeScenarioClient.mockResolvedValue({ + prime: vi.fn().mockResolvedValue("driver-sync-start"), + sendTextMessage, + stop, + waitForJoinedMember: vi.fn().mockResolvedValue(undefined), + waitForRoomEvent, + }); + const restartGateway = vi.fn(async () => { + callOrder.push("restart"); + }); + const restartGatewayAfterStateMutation = vi.fn(async (mutateState) => { + callOrder.push("hard-restart"); + await mutateState({ stateDir: outputDir }); + }); + const waitGatewayAccountReady = vi.fn().mockResolvedValue(undefined); + + const scenario = MATRIX_QA_SCENARIOS.find( + (entry) => entry.id === "matrix-e2ee-restart-resume", + ); + expect(scenario).toBeDefined(); + + await expect( + runMatrixQaScenario(scenario!, { + ...matrixQaScenarioContext(), + gatewayRuntimeEnv: { + OPENCLAW_CONFIG_PATH: gatewayConfigPath, + PATH: process.env.PATH, + }, + outputDir, + restartGateway, + restartGatewayAfterStateMutation, + sutAccountId: "sut", + topology: { + defaultRoomId: "!main:matrix-qa.test", + defaultRoomKey: "main", + rooms: [ + { + key: "main", + kind: "group", + memberRoles: ["driver", "observer", "sut"], + memberUserIds: [ + "@driver:matrix-qa.test", + "@observer:matrix-qa.test", + "@sut:matrix-qa.test", + ], + name: "Main", + requireMention: true, + roomId: "!main:matrix-qa.test", + }, + { + encrypted: true, + key: matrixQaE2eeRoomKey("matrix-e2ee-restart-resume"), + kind: "group", + memberRoles: ["driver", "observer", "sut"], + memberUserIds: [ + "@driver:matrix-qa.test", + "@observer:matrix-qa.test", + "@sut:matrix-qa.test", + ], + name: "Restart", + requireMention: true, + roomId: "!restart:matrix-qa.test", + }, + ], + }, + waitGatewayAccountReady, + }), + ).resolves.toMatchObject({ + artifacts: { + driverUserId: "@isolated-driver:matrix-qa.test", + firstDriverEventId: "$before-trigger", + recoveredDriverEventId: "$after-trigger", + roomId: "!isolated-restart:matrix-qa.test", + }, + }); + + const restoredConfig = JSON.parse(await readFile(gatewayConfigPath, "utf8")) as { + channels: { + matrix: { + accounts: { + sut: { + groupAllowFrom: string[]; + groupPolicy: string; + groups: Record; + }; + }; + }; + }; + }; + expect(restoredConfig.channels.matrix.accounts.sut.groups).toEqual(originalGroups); + expect(restoredConfig.channels.matrix.accounts.sut.groupAllowFrom).toEqual([ + "@driver:matrix-qa.test", + ]); + expect(restoredConfig.channels.matrix.accounts.sut.groupPolicy).toBe("allowlist"); + expect(callOrder).toEqual([ + "create-room", + "observer-join", + "sut-join", + "hard-restart", + "send:before", + "restart", + "send:after", + "hard-restart", + ]); + expect(restartGatewayAfterStateMutation).toHaveBeenCalledTimes(2); + expect(restartGatewayAfterStateMutation).toHaveBeenNthCalledWith(1, expect.any(Function), { + timeoutMs: 8_000, + waitAccountId: "sut", + }); + expect(restartGatewayAfterStateMutation).toHaveBeenNthCalledWith(2, expect.any(Function), { + timeoutMs: 8_000, + waitAccountId: "sut", + }); + expect(waitGatewayAccountReady).not.toHaveBeenCalled(); + expect(stop).toHaveBeenCalledTimes(1); + expect(createPrivateRoom).toHaveBeenCalledWith({ + encrypted: true, + inviteUserIds: ["@observer:matrix-qa.test", "@sut:matrix-qa.test"], + name: "Matrix QA matrix-e2ee-restart-resume Isolated E2EE Room", + }); + expect(observerJoinRoom).toHaveBeenCalledWith("!isolated-restart:matrix-qa.test"); + expect(sutJoinRoom).toHaveBeenCalledWith("!isolated-restart:matrix-qa.test"); + expect(createMatrixQaE2eeScenarioClient).toHaveBeenCalledWith( + expect.objectContaining({ + accessToken: "isolated-driver-token", + actorId: "driver-restart-resume", + deviceId: "ISOLATEDDRIVER", + password: "isolated-driver-password", + userId: "@isolated-driver:matrix-qa.test", + }), + ); + } finally { + await rm(outputDir, { recursive: true, force: true }); + } + }); + it("runs the DM scenario against the provisioned DM room without a mention", async () => { const primeRoom = vi.fn().mockResolvedValue("driver-sync-start"); const sendTextMessage = vi.fn().mockResolvedValue("$dm-trigger"); @@ -2995,6 +3557,20 @@ describe("matrix live qa scenarios", () => { const confirmVerificationSas = vi.fn().mockResolvedValue(undefined); const deleteOwnDevices = vi.fn().mockResolvedValue(undefined); const stop = vi.fn().mockResolvedValue(undefined); + const cliOwnerAccount = { + accessToken: "cli-owner-token", + deviceId: "OWNERDEVICE", + localpart: "qa-cli-self-verification", + password: "cli-owner-password", + userId: "@cli-owner:matrix-qa.test", + }; + const registerWithToken = vi.fn().mockResolvedValue(cliOwnerAccount); + const loginWithPassword = vi.fn().mockResolvedValue({ + accessToken: "cli-token", + deviceId: "CLIDEVICE", + password: "cli-owner-password", + userId: "@cli-owner:matrix-qa.test", + }); const bootstrapOwnDeviceVerification = vi.fn().mockResolvedValue({ crossSigning: { published: true, @@ -3017,7 +3593,7 @@ describe("matrix live qa scenarios", () => { hasReciprocateQr: false, methods: ["m.sas.v1"], otherDeviceId: "CLIDEVICE", - otherUserId: "@driver:matrix-qa.test", + otherUserId: "@cli-owner:matrix-qa.test", pending: true, phase: 2, phaseName: "ready", @@ -3066,12 +3642,8 @@ describe("matrix live qa scenarios", () => { }, ]); createMatrixQaClient.mockReturnValue({ - loginWithPassword: vi.fn().mockResolvedValue({ - accessToken: "cli-token", - deviceId: "CLIDEVICE", - password: "driver-password", - userId: "@driver:matrix-qa.test", - }), + loginWithPassword, + registerWithToken, }); createMatrixQaE2eeScenarioClient.mockResolvedValueOnce({ acceptVerification, @@ -3155,7 +3727,7 @@ describe("matrix live qa scenarios", () => { crossSigningVerified: true, deviceId: "CLIDEVICE", signedByOwner: true, - userId: "@driver:matrix-qa.test", + userId: "@cli-owner:matrix-qa.test", verified: true, }), }; @@ -3213,12 +3785,35 @@ describe("matrix live qa scenarios", () => { "self", "--account", "cli", + "--timeout-ms", + "8000", ]); + expect(startMatrixQaOpenClawCli.mock.calls[0]?.[0].timeoutMs).toBe(16_000); expect(waitForOutput).toHaveBeenCalledTimes(2); expect(writeStdin).toHaveBeenCalledWith("yes\n"); expect(endStdin).toHaveBeenCalledTimes(1); expect(wait).toHaveBeenCalledTimes(1); expect(kill).toHaveBeenCalledTimes(1); + expect(registerWithToken).toHaveBeenCalledWith({ + deviceName: "OpenClaw Matrix QA CLI Self Verification Owner", + localpart: expect.stringMatching(/^qa-cli-self-verification-[a-f0-9]{8}$/), + password: expect.stringMatching(/^matrix-qa-/), + registrationToken: "registration-token", + }); + expect(loginWithPassword).toHaveBeenCalledWith({ + deviceName: "OpenClaw Matrix QA CLI Self Verification Device", + password: "cli-owner-password", + userId: "@cli-owner:matrix-qa.test", + }); + expect(createMatrixQaE2eeScenarioClient).toHaveBeenCalledWith( + expect.objectContaining({ + accessToken: "cli-owner-token", + deviceId: "OWNERDEVICE", + password: "cli-owner-password", + scenarioId: "matrix-e2ee-cli-self-verification", + userId: "@cli-owner:matrix-qa.test", + }), + ); expect(runMatrixQaOpenClawCli).toHaveBeenCalledTimes(2); expect(runMatrixQaOpenClawCli.mock.calls.map(([params]) => params.args)).toEqual([ [ @@ -3246,7 +3841,7 @@ describe("matrix live qa scenarios", () => { pluginAllow: expect.arrayContaining(["matrix"]), pluginEnabled: true, startupVerification: "off", - userId: "@driver:matrix-qa.test", + userId: "@cli-owner:matrix-qa.test", }); await expect(readFile(configPath, "utf8")).rejects.toThrow(); await expect(readdir(String(cliEnv?.OPENCLAW_STATE_DIR))).rejects.toThrow(); @@ -3283,6 +3878,1241 @@ describe("matrix live qa scenarios", () => { } }); + it("runs Matrix account add --enable-e2ee through the CLI QA scenario", async () => { + const outputDir = await mkdtemp(path.join(os.tmpdir(), "matrix-cli-account-add-e2ee-")); + try { + const { registerWithToken } = mockMatrixQaCliAccount({ + accessToken: "cli-add-owner-token", + deviceId: "CLIADDOWNER", + password: "cli-add-password", + userId: "@cli-add:matrix-qa.test", + }); + runMatrixQaOpenClawCli.mockImplementation(async ({ args, env }) => { + if (env.OPENCLAW_CONFIG_PATH) { + const initialConfig = JSON.parse( + await readFile(String(env.OPENCLAW_CONFIG_PATH), "utf8"), + ) as { + channels?: { matrix?: { enabled?: boolean; accounts?: Record } }; + plugins?: { allow?: string[]; entries?: { matrix?: unknown } }; + }; + expect(initialConfig.channels?.matrix?.enabled).toBe(true); + expect(initialConfig.channels?.matrix?.accounts).toEqual({}); + expect(initialConfig.plugins?.allow).toContain("matrix"); + expect(initialConfig.plugins?.entries?.matrix).toEqual({ enabled: true }); + } + const joined = args.join(" "); + if (joined.includes("matrix account add")) { + return { + args, + exitCode: 0, + stderr: "", + stdout: JSON.stringify({ + accountId: "cli-add-e2ee", + encryptionEnabled: true, + verificationBootstrap: { + attempted: true, + backupVersion: "backup-v1", + success: true, + }, + }), + }; + } + if (joined === "matrix verify status --account cli-add-e2ee --json") { + return { + args, + exitCode: 0, + stderr: "", + stdout: JSON.stringify({ + backup: { + decryptionKeyCached: true, + keyLoadError: null, + matchesDecryptionKey: true, + trusted: true, + }, + crossSigningVerified: true, + deviceId: "CLIADDDEVICE", + signedByOwner: true, + userId: "@driver:matrix-qa.test", + verified: true, + }), + }; + } + throw new Error(`unexpected CLI command: ${joined}`); + }); + + const scenario = MATRIX_QA_SCENARIOS.find( + (entry) => entry.id === "matrix-e2ee-cli-account-add-enable-e2ee", + ); + expect(scenario).toBeDefined(); + + await expect( + runMatrixQaScenario(scenario!, { + ...matrixQaScenarioContext(), + driverDeviceId: "DRIVERDEVICE", + driverPassword: "driver-password", + gatewayRuntimeEnv: { + OPENCLAW_CONFIG_PATH: "/tmp/gateway-config.json", + OPENCLAW_STATE_DIR: "/tmp/gateway-state", + PATH: process.env.PATH, + }, + outputDir, + }), + ).resolves.toMatchObject({ + artifacts: { + accountId: "cli-add-e2ee", + backupVersion: "backup-v1", + cliDeviceId: "CLIADDDEVICE", + encryptionEnabled: true, + verificationBootstrapAttempted: true, + verificationBootstrapSuccess: true, + }, + }); + + expect(runMatrixQaOpenClawCli.mock.calls.map(([params]) => params.args)).toEqual([ + [ + "matrix", + "account", + "add", + "--account", + "cli-add-e2ee", + "--name", + "Matrix QA CLI Account Add E2EE", + "--homeserver", + "http://127.0.0.1:28008/", + "--user-id", + "@cli-add:matrix-qa.test", + "--password", + "cli-add-password", + "--device-name", + "OpenClaw Matrix QA CLI Account Add E2EE", + "--allow-private-network", + "--enable-e2ee", + "--json", + ], + ["matrix", "verify", "status", "--account", "cli-add-e2ee", "--json"], + ]); + expect(registerWithToken).toHaveBeenCalledWith( + expect.objectContaining({ + deviceName: "OpenClaw Matrix QA CLI Account Add Owner", + registrationToken: "registration-token", + }), + ); + const [cliRunDir] = await readdir(path.join(outputDir, "cli-account-add-enable-e2ee")); + const cliArtifactDir = path.join(outputDir, "cli-account-add-enable-e2ee", cliRunDir ?? ""); + await expect( + readFile(path.join(cliArtifactDir, "account-add-enable-e2ee.stdout.txt"), "utf8"), + ).resolves.toContain('"encryptionEnabled":true'); + await expect( + readFile(path.join(cliArtifactDir, "verify-status.stdout.txt"), "utf8"), + ).resolves.toContain('"verified":true'); + } finally { + await rm(outputDir, { force: true, recursive: true }); + } + }); + + it("runs Matrix encryption setup through the CLI QA scenario", async () => { + const outputDir = await mkdtemp(path.join(os.tmpdir(), "matrix-cli-encryption-setup-")); + try { + const { loginWithPassword, registerWithToken } = mockMatrixQaCliAccount({ + accessToken: "cli-setup-token", + deviceId: "CLISETUPDEVICE", + password: "cli-setup-password", + userId: "@cli-setup:matrix-qa.test", + }); + let initialAccountConfig: Record | null = null; + runMatrixQaOpenClawCli.mockImplementation(async ({ args, env }) => { + if (!initialAccountConfig && env.OPENCLAW_CONFIG_PATH) { + const initialConfig = JSON.parse( + await readFile(String(env.OPENCLAW_CONFIG_PATH), "utf8"), + ) as { + channels?: { + matrix?: { + accounts?: Record>; + }; + }; + }; + initialAccountConfig = + initialConfig.channels?.matrix?.accounts?.["cli-encryption-setup"] ?? null; + } + const joined = args.join(" "); + if (joined === "matrix encryption setup --account cli-encryption-setup --json") { + return { + args, + exitCode: 0, + stderr: "", + stdout: JSON.stringify({ + accountId: "cli-encryption-setup", + bootstrap: { + success: true, + }, + encryptionChanged: true, + status: { + backup: { + decryptionKeyCached: true, + keyLoadError: null, + matchesDecryptionKey: true, + trusted: true, + }, + crossSigningVerified: true, + deviceId: "CLISETUPDEVICE", + signedByOwner: true, + userId: "@driver:matrix-qa.test", + verified: true, + }, + success: true, + }), + }; + } + if (joined === "matrix verify status --account cli-encryption-setup --json") { + return { + args, + exitCode: 0, + stderr: "", + stdout: JSON.stringify({ + backup: { + decryptionKeyCached: true, + keyLoadError: null, + matchesDecryptionKey: true, + trusted: true, + }, + crossSigningVerified: true, + deviceId: "CLISETUPDEVICE", + signedByOwner: true, + userId: "@driver:matrix-qa.test", + verified: true, + }), + }; + } + throw new Error(`unexpected CLI command: ${joined}`); + }); + + const scenario = MATRIX_QA_SCENARIOS.find( + (entry) => entry.id === "matrix-e2ee-cli-encryption-setup", + ); + expect(scenario).toBeDefined(); + + await expect( + runMatrixQaScenario(scenario!, { + ...matrixQaScenarioContext(), + driverDeviceId: "DRIVERDEVICE", + driverPassword: "driver-password", + gatewayRuntimeEnv: { + OPENCLAW_CONFIG_PATH: "/tmp/gateway-config.json", + OPENCLAW_STATE_DIR: "/tmp/gateway-state", + PATH: process.env.PATH, + }, + outputDir, + }), + ).resolves.toMatchObject({ + artifacts: { + accountId: "cli-encryption-setup", + cliDeviceId: "CLISETUPDEVICE", + encryptionChanged: true, + setupSuccess: true, + verificationBootstrapSuccess: true, + }, + }); + + expect(initialAccountConfig).toMatchObject({ + accessToken: "cli-setup-token", + deviceId: "CLISETUPDEVICE", + encryption: false, + homeserver: "http://127.0.0.1:28008/", + password: "cli-setup-password", + startupVerification: "off", + userId: "@cli-setup:matrix-qa.test", + }); + expect(runMatrixQaOpenClawCli.mock.calls.map(([params]) => params.args)).toEqual([ + ["matrix", "encryption", "setup", "--account", "cli-encryption-setup", "--json"], + ["matrix", "verify", "status", "--account", "cli-encryption-setup", "--json"], + ]); + expect(registerWithToken).toHaveBeenCalledWith( + expect.objectContaining({ + deviceName: "OpenClaw Matrix QA CLI Encryption Setup Owner", + registrationToken: "registration-token", + }), + ); + expect(loginWithPassword).toHaveBeenCalledWith( + expect.objectContaining({ + password: "cli-setup-password", + userId: "@cli-setup:matrix-qa.test", + }), + ); + const [cliRunDir] = await readdir(path.join(outputDir, "cli-encryption-setup")); + const cliArtifactDir = path.join(outputDir, "cli-encryption-setup", cliRunDir ?? ""); + await expect( + readFile(path.join(cliArtifactDir, "encryption-setup.stdout.txt"), "utf8"), + ).resolves.toContain('"encryptionChanged":true'); + await expect( + readFile(path.join(cliArtifactDir, "verify-status.stdout.txt"), "utf8"), + ).resolves.toContain('"verified":true'); + } finally { + await rm(outputDir, { force: true, recursive: true }); + } + }); + + it("runs Matrix encryption setup idempotency through the CLI QA scenario", async () => { + const outputDir = await mkdtemp( + path.join(os.tmpdir(), "matrix-cli-encryption-setup-idempotent-"), + ); + try { + const { loginWithPassword, registerWithToken } = mockMatrixQaCliAccount({ + accessToken: "cli-idempotent-token", + deviceId: "CLIIDEMPOTENTDEVICE", + password: "cli-idempotent-password", + userId: "@cli-idempotent:matrix-qa.test", + }); + let initialAccountConfig: Record | null = null; + runMatrixQaOpenClawCli.mockImplementation(async ({ args, env }) => { + if (!initialAccountConfig && env.OPENCLAW_CONFIG_PATH) { + const initialConfig = JSON.parse( + await readFile(String(env.OPENCLAW_CONFIG_PATH), "utf8"), + ) as { + channels?: { + matrix?: { + accounts?: Record>; + }; + }; + }; + initialAccountConfig = + initialConfig.channels?.matrix?.accounts?.["cli-encryption-idempotent"] ?? null; + } + const joined = args.join(" "); + if (joined === "matrix encryption setup --account cli-encryption-idempotent --json") { + return { + args, + exitCode: 0, + stderr: "", + stdout: JSON.stringify({ + accountId: "cli-encryption-idempotent", + bootstrap: { + success: true, + }, + encryptionChanged: false, + status: { + backup: { + decryptionKeyCached: true, + keyLoadError: null, + matchesDecryptionKey: true, + trusted: true, + }, + crossSigningVerified: true, + deviceId: "CLIIDEMPOTENTDEVICE", + signedByOwner: true, + userId: "@driver:matrix-qa.test", + verified: true, + }, + success: true, + }), + }; + } + throw new Error(`unexpected CLI command: ${joined}`); + }); + + const scenario = MATRIX_QA_SCENARIOS.find( + (entry) => entry.id === "matrix-e2ee-cli-encryption-setup-idempotent", + ); + expect(scenario).toBeDefined(); + + await expect( + runMatrixQaScenario(scenario!, { + ...matrixQaScenarioContext(), + driverDeviceId: "DRIVERDEVICE", + driverPassword: "driver-password", + gatewayRuntimeEnv: { + OPENCLAW_CONFIG_PATH: "/tmp/gateway-config.json", + OPENCLAW_STATE_DIR: "/tmp/gateway-state", + PATH: process.env.PATH, + }, + outputDir, + }), + ).resolves.toMatchObject({ + artifacts: { + accountId: "cli-encryption-idempotent", + cliDeviceId: "CLIIDEMPOTENTDEVICE", + firstEncryptionChanged: false, + secondEncryptionChanged: false, + setupSuccess: true, + verificationBootstrapSuccess: true, + }, + }); + + expect(initialAccountConfig).toMatchObject({ + accessToken: "cli-idempotent-token", + deviceId: "CLIIDEMPOTENTDEVICE", + encryption: true, + homeserver: "http://127.0.0.1:28008/", + password: "cli-idempotent-password", + startupVerification: "off", + userId: "@cli-idempotent:matrix-qa.test", + }); + expect(runMatrixQaOpenClawCli.mock.calls.map(([params]) => params.args)).toEqual([ + ["matrix", "encryption", "setup", "--account", "cli-encryption-idempotent", "--json"], + ["matrix", "encryption", "setup", "--account", "cli-encryption-idempotent", "--json"], + ]); + expect(registerWithToken).toHaveBeenCalledWith( + expect.objectContaining({ + deviceName: "OpenClaw Matrix QA CLI Encryption Idempotent Owner", + registrationToken: "registration-token", + }), + ); + expect(loginWithPassword).toHaveBeenCalledWith( + expect.objectContaining({ + password: "cli-idempotent-password", + userId: "@cli-idempotent:matrix-qa.test", + }), + ); + const [cliRunDir] = await readdir(path.join(outputDir, "cli-encryption-setup-idempotent")); + const cliArtifactDir = path.join( + outputDir, + "cli-encryption-setup-idempotent", + cliRunDir ?? "", + ); + await expect( + readFile(path.join(cliArtifactDir, "encryption-setup-first.stdout.txt"), "utf8"), + ).resolves.toContain('"encryptionChanged":false'); + await expect( + readFile(path.join(cliArtifactDir, "encryption-setup-second.stdout.txt"), "utf8"), + ).resolves.toContain('"verified":true'); + } finally { + await rm(outputDir, { force: true, recursive: true }); + } + }); + + it("runs Matrix encryption setup bootstrap failure through the CLI QA scenario", async () => { + const outputDir = await mkdtemp( + path.join(os.tmpdir(), "matrix-cli-encryption-setup-bootstrap-failure-"), + ); + try { + const proxyStop = vi.fn().mockResolvedValue(undefined); + const hits = vi.fn().mockReturnValue([ + { + bearerToken: "cli-failure-token", + method: "GET", + path: "/_matrix/client/v3/room_keys/version", + ruleId: "room-key-backup-version-unavailable", + }, + ]); + const { loginWithPassword, registerWithToken } = mockMatrixQaCliAccount({ + accessToken: "cli-failure-token", + deviceId: "CLIFAILUREDEVICE", + password: "cli-failure-password", + userId: "@cli-failure:matrix-qa.test", + }); + startMatrixQaFaultProxy.mockResolvedValue({ + baseUrl: "http://127.0.0.1:39878", + hits, + stop: proxyStop, + }); + const output = vi.fn(() => ({ + stderr: "", + stdout: JSON.stringify({ + accountId: "cli-encryption-failure", + bootstrap: { + error: "Matrix room key backup is still missing after bootstrap", + success: false, + }, + encryptionChanged: true, + success: false, + }), + })); + const wait = vi + .fn() + .mockRejectedValue(new Error("openclaw matrix encryption setup exited 1")); + const kill = vi.fn(); + startMatrixQaOpenClawCli.mockReturnValue({ + args: ["matrix", "encryption", "setup", "--account", "cli-encryption-failure", "--json"], + kill, + output, + wait, + waitForOutput: vi.fn(), + writeStdin: vi.fn(), + }); + + const scenario = MATRIX_QA_SCENARIOS.find( + (entry) => entry.id === "matrix-e2ee-cli-encryption-setup-bootstrap-failure", + ); + expect(scenario).toBeDefined(); + + await expect( + runMatrixQaScenario(scenario!, { + ...matrixQaScenarioContext(), + driverDeviceId: "DRIVERDEVICE", + driverPassword: "driver-password", + gatewayRuntimeEnv: { + OPENCLAW_CONFIG_PATH: "/tmp/gateway-config.json", + OPENCLAW_STATE_DIR: "/tmp/gateway-state", + PATH: process.env.PATH, + }, + outputDir, + }), + ).resolves.toMatchObject({ + artifacts: { + accountId: "cli-encryption-failure", + bootstrapSuccess: false, + cliDeviceId: "CLIFAILUREDEVICE", + faultedEndpoint: "/_matrix/client/v3/room_keys/version", + faultHitCount: 1, + faultRuleId: "room-key-backup-version-unavailable", + }, + }); + + const proxyArgs = startMatrixQaFaultProxy.mock.calls[0]?.[0]; + expect(proxyArgs).toBeDefined(); + if (!proxyArgs) { + throw new Error("expected Matrix QA fault proxy to start"); + } + const [faultRule] = proxyArgs.rules; + expect(faultRule).toBeDefined(); + if (!faultRule) { + throw new Error("expected Matrix QA fault proxy rule"); + } + expect(proxyArgs.targetBaseUrl).toBe("http://127.0.0.1:28008/"); + expect( + faultRule.match({ + bearerToken: "cli-failure-token", + headers: {}, + method: "GET", + path: "/_matrix/client/v3/room_keys/version", + search: "", + }), + ).toBe(true); + expect(startMatrixQaOpenClawCli.mock.calls[0]?.[0].args).toEqual([ + "matrix", + "encryption", + "setup", + "--account", + "cli-encryption-failure", + "--json", + ]); + expect(startMatrixQaOpenClawCli.mock.calls[0]?.[0].env.OPENCLAW_CONFIG_PATH).toContain( + "openclaw-matrix-e2ee-setup-qa-", + ); + expect(output).toHaveBeenCalledTimes(1); + expect(wait).toHaveBeenCalledTimes(1); + expect(kill).toHaveBeenCalledTimes(1); + expect(registerWithToken).toHaveBeenCalledWith( + expect.objectContaining({ + deviceName: "OpenClaw Matrix QA CLI Encryption Failure Owner", + registrationToken: "registration-token", + }), + ); + expect(loginWithPassword).toHaveBeenCalledWith( + expect.objectContaining({ + password: "cli-failure-password", + userId: "@cli-failure:matrix-qa.test", + }), + ); + expect(proxyStop).toHaveBeenCalledTimes(1); + const [cliRunDir] = await readdir( + path.join(outputDir, "cli-encryption-setup-bootstrap-failure"), + ); + const cliArtifactDir = path.join( + outputDir, + "cli-encryption-setup-bootstrap-failure", + cliRunDir ?? "", + ); + await expect( + readFile( + path.join(cliArtifactDir, "encryption-setup-bootstrap-failure.stdout.txt"), + "utf8", + ), + ).resolves.toContain('"success":false'); + } finally { + await rm(outputDir, { force: true, recursive: true }); + } + }); + + it("runs Matrix recovery-key setup through the CLI QA scenario", async () => { + const outputDir = await mkdtemp(path.join(os.tmpdir(), "matrix-cli-recovery-key-setup-")); + try { + const deleteOwnDevices = vi.fn().mockResolvedValue(undefined); + const stop = vi.fn().mockResolvedValue(undefined); + const bootstrapOwnDeviceVerification = vi.fn().mockResolvedValue({ + crossSigning: { + published: true, + }, + success: true, + verification: { + backupVersion: "backup-v1", + crossSigningVerified: true, + recoveryKeyId: "SSSS", + recoveryKeyStored: true, + signedByOwner: true, + verified: true, + }, + }); + createMatrixQaE2eeScenarioClient.mockResolvedValueOnce({ + bootstrapOwnDeviceVerification, + deleteOwnDevices, + getRecoveryKey: vi.fn().mockResolvedValue({ + encodedPrivateKey: "encoded-recovery-key", + keyId: "SSSS", + }), + stop, + }); + const { loginWithPassword, registerWithToken } = mockMatrixQaCliAccount({ + accessToken: "cli-recovery-token", + deviceId: "CLIRECOVERYDEVICE", + password: "cli-recovery-password", + userId: "@cli-recovery:matrix-qa.test", + }); + let initialAccountConfig: Record | null = null; + runMatrixQaOpenClawCli.mockImplementation(async ({ args, env }) => { + if (!initialAccountConfig && env.OPENCLAW_CONFIG_PATH) { + const initialConfig = JSON.parse( + await readFile(String(env.OPENCLAW_CONFIG_PATH), "utf8"), + ) as { + channels?: { + matrix?: { + accounts?: Record>; + }; + }; + }; + initialAccountConfig = + initialConfig.channels?.matrix?.accounts?.["cli-recovery-key-setup"] ?? null; + } + const joined = args.join(" "); + if ( + joined === + "matrix encryption setup --account cli-recovery-key-setup --recovery-key encoded-recovery-key --json" + ) { + return { + args, + exitCode: 0, + stderr: "", + stdout: JSON.stringify({ + accountId: "cli-recovery-key-setup", + bootstrap: { + success: true, + }, + encryptionChanged: true, + status: { + backup: { + decryptionKeyCached: true, + keyLoadError: null, + matchesDecryptionKey: true, + trusted: true, + }, + backupVersion: "backup-v1", + crossSigningVerified: true, + deviceId: "CLIRECOVERYDEVICE", + signedByOwner: true, + userId: "@driver:matrix-qa.test", + verified: true, + }, + success: true, + }), + }; + } + throw new Error(`unexpected CLI command: ${joined}`); + }); + + const scenario = MATRIX_QA_SCENARIOS.find( + (entry) => entry.id === "matrix-e2ee-cli-recovery-key-setup", + ); + expect(scenario).toBeDefined(); + + await expect( + runMatrixQaScenario(scenario!, { + ...matrixQaScenarioContext(), + driverDeviceId: "DRIVERDEVICE", + driverPassword: "driver-password", + gatewayRuntimeEnv: { + OPENCLAW_CONFIG_PATH: "/tmp/gateway-config.json", + OPENCLAW_STATE_DIR: "/tmp/gateway-state", + PATH: process.env.PATH, + }, + outputDir, + }), + ).resolves.toMatchObject({ + artifacts: { + accountId: "cli-recovery-key-setup", + backupVersion: "backup-v1", + cliDeviceId: "CLIRECOVERYDEVICE", + encryptionChanged: true, + recoveryKeyId: "SSSS", + recoveryKeyStored: true, + setupSuccess: true, + verificationBootstrapSuccess: true, + }, + }); + + expect(initialAccountConfig).toMatchObject({ + accessToken: "cli-recovery-token", + deviceId: "CLIRECOVERYDEVICE", + encryption: false, + homeserver: "http://127.0.0.1:28008/", + password: "cli-recovery-password", + startupVerification: "off", + userId: "@cli-recovery:matrix-qa.test", + }); + expect(bootstrapOwnDeviceVerification).toHaveBeenCalledWith({ + allowAutomaticCrossSigningReset: false, + }); + expect(runMatrixQaOpenClawCli.mock.calls.map(([params]) => params.args)).toEqual([ + [ + "matrix", + "encryption", + "setup", + "--account", + "cli-recovery-key-setup", + "--recovery-key", + "encoded-recovery-key", + "--json", + ], + ]); + expect(registerWithToken).toHaveBeenCalledWith( + expect.objectContaining({ + deviceName: "OpenClaw Matrix QA CLI Recovery Key Owner", + registrationToken: "registration-token", + }), + ); + expect(loginWithPassword).toHaveBeenCalledWith( + expect.objectContaining({ + password: "cli-recovery-password", + userId: "@cli-recovery:matrix-qa.test", + }), + ); + expect(deleteOwnDevices).toHaveBeenCalledWith(["CLIRECOVERYDEVICE"]); + expect(stop).toHaveBeenCalledTimes(1); + const [cliRunDir] = await readdir(path.join(outputDir, "cli-recovery-key-setup")); + const cliArtifactDir = path.join(outputDir, "cli-recovery-key-setup", cliRunDir ?? ""); + await expect( + readFile(path.join(cliArtifactDir, "recovery-key-setup.stdout.txt"), "utf8"), + ).resolves.toContain('"backupVersion":"backup-v1"'); + } finally { + await rm(outputDir, { force: true, recursive: true }); + } + }); + + it("runs Matrix invalid recovery-key setup through the CLI QA scenario", async () => { + const outputDir = await mkdtemp(path.join(os.tmpdir(), "matrix-cli-recovery-key-invalid-")); + try { + const deleteOwnDevices = vi.fn().mockResolvedValue(undefined); + const stop = vi.fn().mockResolvedValue(undefined); + const { loginWithPassword, registerWithToken } = mockMatrixQaCliAccount({ + accessToken: "cli-invalid-token", + deviceId: "CLIINVALIDDEVICE", + password: "cli-invalid-password", + userId: "@cli-invalid:matrix-qa.test", + }); + createMatrixQaE2eeScenarioClient.mockResolvedValueOnce({ + bootstrapOwnDeviceVerification: vi.fn().mockResolvedValue({ + crossSigning: { + published: true, + }, + success: true, + verification: { + backupVersion: "backup-v1", + crossSigningVerified: true, + recoveryKeyStored: true, + signedByOwner: true, + verified: true, + }, + }), + deleteOwnDevices, + getRecoveryKey: vi.fn().mockResolvedValue({ + encodedPrivateKey: "valid-recovery-key", + keyId: "SSSS", + }), + stop, + }); + const output = vi.fn(() => ({ + stderr: "", + stdout: JSON.stringify({ + accountId: "cli-invalid-recovery-key", + bootstrap: { + error: "Matrix recovery key could not unlock secret storage", + success: false, + }, + encryptionChanged: true, + success: false, + }), + })); + const wait = vi + .fn() + .mockRejectedValue(new Error("openclaw matrix encryption setup exited 1")); + const kill = vi.fn(); + startMatrixQaOpenClawCli.mockReturnValue({ + args: [ + "matrix", + "encryption", + "setup", + "--account", + "cli-invalid-recovery-key", + "--recovery-key", + "not-a-valid-matrix-recovery-key", + "--json", + ], + kill, + output, + wait, + waitForOutput: vi.fn(), + writeStdin: vi.fn(), + }); + + const scenario = MATRIX_QA_SCENARIOS.find( + (entry) => entry.id === "matrix-e2ee-cli-recovery-key-invalid", + ); + expect(scenario).toBeDefined(); + + await expect( + runMatrixQaScenario(scenario!, { + ...matrixQaScenarioContext(), + driverDeviceId: "DRIVERDEVICE", + driverPassword: "driver-password", + gatewayRuntimeEnv: { + OPENCLAW_CONFIG_PATH: "/tmp/gateway-config.json", + OPENCLAW_STATE_DIR: "/tmp/gateway-state", + PATH: process.env.PATH, + }, + outputDir, + }), + ).resolves.toMatchObject({ + artifacts: { + accountId: "cli-invalid-recovery-key", + bootstrapSuccess: false, + cliDeviceId: "CLIINVALIDDEVICE", + encryptionChanged: true, + recoveryKeyAccepted: false, + recoveryKeyRejected: true, + setupSuccess: false, + }, + }); + + expect(startMatrixQaOpenClawCli.mock.calls[0]?.[0].args).toEqual([ + "matrix", + "encryption", + "setup", + "--account", + "cli-invalid-recovery-key", + "--recovery-key", + "not-a-valid-matrix-recovery-key", + "--json", + ]); + expect(output).toHaveBeenCalledTimes(1); + expect(wait).toHaveBeenCalledTimes(1); + expect(kill).toHaveBeenCalledTimes(1); + expect(registerWithToken).toHaveBeenCalledWith( + expect.objectContaining({ + deviceName: "OpenClaw Matrix QA CLI Invalid Recovery Key Owner", + registrationToken: "registration-token", + }), + ); + expect(loginWithPassword).toHaveBeenCalledWith( + expect.objectContaining({ + password: "cli-invalid-password", + userId: "@cli-invalid:matrix-qa.test", + }), + ); + expect(deleteOwnDevices).toHaveBeenCalledWith(["CLIINVALIDDEVICE"]); + expect(stop).toHaveBeenCalledTimes(1); + const [cliRunDir] = await readdir(path.join(outputDir, "cli-recovery-key-invalid")); + const cliArtifactDir = path.join(outputDir, "cli-recovery-key-invalid", cliRunDir ?? ""); + await expect( + readFile(path.join(cliArtifactDir, "recovery-key-invalid.stdout.txt"), "utf8"), + ).resolves.not.toContain("not-a-valid-matrix-recovery-key"); + } finally { + await rm(outputDir, { force: true, recursive: true }); + } + }); + + it("runs Matrix multi-account encryption setup through the CLI QA scenario", async () => { + const outputDir = await mkdtemp( + path.join(os.tmpdir(), "matrix-cli-encryption-setup-multi-account-"), + ); + try { + const { loginWithPassword, registerWithToken } = mockMatrixQaCliAccount({ + accessToken: "cli-multi-token", + deviceId: "CLIMULTIDEVICE", + password: "cli-multi-password", + userId: "@cli-multi:matrix-qa.test", + }); + runMatrixQaOpenClawCli.mockImplementation(async ({ args, env }) => { + const configPath = String(env.OPENCLAW_CONFIG_PATH); + const config = JSON.parse(await readFile(configPath, "utf8")) as { + channels: { + matrix: { + accounts: Record>; + defaultAccount: string; + }; + }; + }; + expect(config.channels.matrix.defaultAccount).toBe("cli-multi-decoy"); + expect(config.channels.matrix.accounts["cli-multi-decoy"]?.encryption).toBe(false); + config.channels.matrix.accounts["cli-multi-target"] = { + ...config.channels.matrix.accounts["cli-multi-target"], + encryption: true, + }; + await writeTestJsonFile(configPath, config); + const joined = args.join(" "); + if (joined === "matrix encryption setup --account cli-multi-target --json") { + return { + args, + exitCode: 0, + stderr: "", + stdout: JSON.stringify({ + accountId: "cli-multi-target", + bootstrap: { + success: true, + }, + encryptionChanged: true, + status: { + backup: { + decryptionKeyCached: true, + keyLoadError: null, + matchesDecryptionKey: true, + trusted: true, + }, + crossSigningVerified: true, + deviceId: "CLIMULTIDEVICE", + signedByOwner: true, + userId: "@driver:matrix-qa.test", + verified: true, + }, + success: true, + }), + }; + } + throw new Error(`unexpected CLI command: ${joined}`); + }); + + const scenario = MATRIX_QA_SCENARIOS.find( + (entry) => entry.id === "matrix-e2ee-cli-encryption-setup-multi-account", + ); + expect(scenario).toBeDefined(); + + await expect( + runMatrixQaScenario(scenario!, { + ...matrixQaScenarioContext(), + driverDeviceId: "DRIVERDEVICE", + driverPassword: "driver-password", + gatewayRuntimeEnv: { + OPENCLAW_CONFIG_PATH: "/tmp/gateway-config.json", + OPENCLAW_STATE_DIR: "/tmp/gateway-state", + PATH: process.env.PATH, + }, + outputDir, + }), + ).resolves.toMatchObject({ + artifacts: { + accountId: "cli-multi-target", + cliDeviceId: "CLIMULTIDEVICE", + decoyAccountPreserved: true, + defaultAccountPreserved: true, + encryptionChanged: true, + setupSuccess: true, + verificationBootstrapSuccess: true, + }, + }); + + expect(runMatrixQaOpenClawCli.mock.calls.map(([params]) => params.args)).toEqual([ + ["matrix", "encryption", "setup", "--account", "cli-multi-target", "--json"], + ]); + expect(registerWithToken).toHaveBeenCalledWith( + expect.objectContaining({ + deviceName: "OpenClaw Matrix QA CLI Multi Account Owner", + registrationToken: "registration-token", + }), + ); + expect(loginWithPassword).toHaveBeenCalledWith( + expect.objectContaining({ + password: "cli-multi-password", + userId: "@cli-multi:matrix-qa.test", + }), + ); + const [cliRunDir] = await readdir(path.join(outputDir, "cli-encryption-setup-multi-account")); + const cliArtifactDir = path.join( + outputDir, + "cli-encryption-setup-multi-account", + cliRunDir ?? "", + ); + await expect( + readFile(path.join(cliArtifactDir, "encryption-setup-multi-account.stdout.txt"), "utf8"), + ).resolves.toContain('"accountId":"cli-multi-target"'); + } finally { + await rm(outputDir, { force: true, recursive: true }); + } + }); + + it("runs Matrix CLI setup then gateway encrypted reply through the QA scenario", async () => { + const outputDir = await mkdtemp(path.join(os.tmpdir(), "matrix-cli-setup-gateway-reply-")); + const gatewayConfigPath = path.join(outputDir, "gateway-config.json"); + try { + await writeTestJsonFile(gatewayConfigPath, { + channels: { + matrix: { + defaultAccount: "sut", + accounts: { + sut: { + accessToken: "sut-token", + enabled: true, + homeserver: "http://127.0.0.1:28008", + userId: "@sut:matrix-qa.test", + }, + }, + }, + }, + }); + const gatewayAccount = { + accessToken: "cli-gateway-token", + deviceId: "CLIGATEWAYDEVICE", + localpart: "qa-cli-gateway", + password: "cli-gateway-password", + userId: "@cli-gateway:matrix-qa.test", + }; + const driverAccount = { + accessToken: "cli-driver-token", + deviceId: "CLIDRIVERDEVICE", + localpart: "qa-cli-driver", + password: "cli-driver-password", + userId: "@cli-driver:matrix-qa.test", + }; + const registerWithToken = vi + .fn() + .mockResolvedValueOnce(gatewayAccount) + .mockResolvedValueOnce(driverAccount); + const createPrivateRoom = vi.fn().mockResolvedValue("!isolated-e2ee:matrix-qa.test"); + const joinRoom = vi.fn().mockResolvedValue({ roomId: "!isolated-e2ee:matrix-qa.test" }); + createMatrixQaClient.mockImplementation(({ accessToken } = {}) => { + if (!accessToken) { + return { registerWithToken }; + } + if (accessToken === gatewayAccount.accessToken) { + return { joinRoom }; + } + if (accessToken === driverAccount.accessToken) { + return { createPrivateRoom }; + } + throw new Error(`unexpected Matrix QA client token: ${String(accessToken)}`); + }); + let replyToken = ""; + const driverStop = vi.fn().mockResolvedValue(undefined); + const driverClient = { + bootstrapOwnDeviceVerification: vi.fn().mockResolvedValue({ + crossSigning: { published: true }, + success: true, + verification: { + backupVersion: "1", + crossSigningVerified: true, + recoveryKeyStored: true, + signedByOwner: true, + verified: true, + }, + }), + getRecoveryKey: vi.fn().mockResolvedValue({ + encodedPrivateKey: "driver-recovery-key", + keyId: "driver-recovery-key-id", + }), + prime: vi.fn().mockResolvedValue("s1"), + resetRoomKeyBackup: vi.fn().mockResolvedValue({ success: true }), + sendTextMessage: vi.fn(async ({ body }) => { + replyToken = String(body).match(/MATRIX_QA_E2EE_CLI_GATEWAY_[A-Z0-9]+/)?.[0] ?? ""; + return "$driver-event"; + }), + stop: driverStop, + waitForJoinedMember: vi.fn().mockResolvedValue(undefined), + waitForRoomEvent: vi.fn(async ({ predicate }) => { + const event = { + body: replyToken, + eventId: "$gateway-reply", + kind: "message", + roomId: "!isolated-e2ee:matrix-qa.test", + sender: "@cli-gateway:matrix-qa.test", + type: "m.room.message", + }; + expect(predicate(event)).toBe(true); + return { event, since: "s2" }; + }), + }; + createMatrixQaE2eeScenarioClient.mockResolvedValueOnce(driverClient); + runMatrixQaOpenClawCli.mockImplementation(async ({ args, env }) => { + const joined = args.join(" "); + if (joined === "matrix encryption setup --account cli-setup-gateway --json") { + const configPath = String(env.OPENCLAW_CONFIG_PATH); + const config = JSON.parse(await readFile(configPath, "utf8")) as { + channels: { + matrix: { + accounts: Record>; + defaultAccount: string; + }; + }; + }; + expect(config.channels.matrix.defaultAccount).toBe("cli-setup-gateway"); + expect(config.channels.matrix.accounts["cli-setup-gateway"]?.encryption).toBe(false); + config.channels.matrix.accounts["cli-setup-gateway"] = { + ...config.channels.matrix.accounts["cli-setup-gateway"], + encryption: true, + setupBootstrapMarker: "preserved", + }; + await writeTestJsonFile(configPath, config); + return { + args, + exitCode: 0, + stderr: "", + stdout: JSON.stringify({ + accountId: "cli-setup-gateway", + bootstrap: { + success: true, + }, + encryptionChanged: false, + status: { + backup: { + decryptionKeyCached: true, + keyLoadError: null, + matchesDecryptionKey: true, + trusted: true, + }, + crossSigningVerified: true, + deviceId: "CLIGATEWAYDEVICE", + signedByOwner: true, + userId: "@cli-gateway:matrix-qa.test", + verified: true, + }, + success: true, + }), + }; + } + throw new Error(`unexpected CLI command: ${joined}`); + }); + const patchGatewayConfig = vi.fn().mockResolvedValue(undefined); + const restartGatewayAfterStateMutation = vi.fn(async (mutateState) => { + await mutateState({ stateDir: path.join(outputDir, "state") }); + }); + const waitGatewayAccountReady = vi.fn().mockResolvedValue(undefined); + + const scenario = MATRIX_QA_SCENARIOS.find( + (entry) => entry.id === "matrix-e2ee-cli-setup-then-gateway-reply", + ); + expect(scenario).toBeDefined(); + + await expect( + runMatrixQaScenario(scenario!, { + ...matrixQaScenarioContext(), + driverDeviceId: "DRIVERDEVICE", + driverPassword: "driver-password", + gatewayRuntimeEnv: { + OPENCLAW_CONFIG_PATH: gatewayConfigPath, + OPENCLAW_STATE_DIR: "/tmp/gateway-state", + PATH: process.env.PATH, + }, + outputDir, + patchGatewayConfig, + restartGatewayAfterStateMutation, + waitGatewayAccountReady, + sutAccountId: "sut", + sutDeviceId: "SUTDEVICE", + sutPassword: "sut-password", + topology: { + defaultRoomId: "!main:matrix-qa.test", + defaultRoomKey: "main", + rooms: [ + { + encrypted: true, + key: matrixQaE2eeRoomKey("matrix-e2ee-cli-setup-then-gateway-reply"), + kind: "group", + memberRoles: ["driver", "observer", "sut"], + memberUserIds: [ + "@driver:matrix-qa.test", + "@observer:matrix-qa.test", + "@sut:matrix-qa.test", + ], + name: "E2EE", + requireMention: true, + roomId: "!e2ee:matrix-qa.test", + }, + ], + }, + }), + ).resolves.toMatchObject({ + artifacts: { + accountId: "cli-setup-gateway", + cliDeviceId: "CLIGATEWAYDEVICE", + driverUserId: "@cli-driver:matrix-qa.test", + gatewayReply: { + eventId: "$gateway-reply", + tokenMatched: true, + }, + gatewayUserId: "@cli-gateway:matrix-qa.test", + roomId: "!isolated-e2ee:matrix-qa.test", + setupSuccess: true, + verificationBootstrapSuccess: true, + }, + }); + const finalGatewayConfig = JSON.parse(await readFile(gatewayConfigPath, "utf8")) as { + channels: { + matrix: { + accounts: Record>; + defaultAccount: string; + }; + }; + }; + expect(finalGatewayConfig.channels.matrix.defaultAccount).toBe("cli-setup-gateway"); + expect(Object.keys(finalGatewayConfig.channels.matrix.accounts)).toEqual([ + "cli-setup-gateway", + ]); + expect(finalGatewayConfig.channels.matrix.accounts["cli-setup-gateway"]).toMatchObject({ + encryption: true, + setupBootstrapMarker: "preserved", + }); + + expect(runMatrixQaOpenClawCli.mock.calls.map(([params]) => params.args)).toEqual([ + ["matrix", "encryption", "setup", "--account", "cli-setup-gateway", "--json"], + ]); + expect(registerWithToken).toHaveBeenCalledWith( + expect.objectContaining({ + deviceName: "OpenClaw Matrix QA CLI Setup Gateway", + registrationToken: "registration-token", + }), + ); + expect(registerWithToken).toHaveBeenCalledWith( + expect.objectContaining({ + deviceName: "OpenClaw Matrix QA CLI Setup Driver", + registrationToken: "registration-token", + }), + ); + expect(createPrivateRoom).toHaveBeenCalledWith({ + encrypted: true, + inviteUserIds: ["@cli-gateway:matrix-qa.test"], + name: "Matrix QA CLI Setup Gateway E2EE", + }); + expect(joinRoom).toHaveBeenCalledWith("!isolated-e2ee:matrix-qa.test"); + expect(patchGatewayConfig).not.toHaveBeenCalled(); + expect(restartGatewayAfterStateMutation).toHaveBeenCalledTimes(2); + expect(driverClient.sendTextMessage).toHaveBeenCalledWith( + expect.objectContaining({ + mentionUserIds: ["@cli-gateway:matrix-qa.test"], + roomId: "!isolated-e2ee:matrix-qa.test", + }), + ); + expect(driverClient.waitForJoinedMember).toHaveBeenCalledWith({ + roomId: "!isolated-e2ee:matrix-qa.test", + timeoutMs: 8_000, + userId: "@cli-gateway:matrix-qa.test", + }); + expect(createMatrixQaE2eeScenarioClient).toHaveBeenCalledWith( + expect.objectContaining({ + accessToken: "cli-driver-token", + deviceId: "CLIDRIVERDEVICE", + userId: "@cli-driver:matrix-qa.test", + }), + ); + expect(waitGatewayAccountReady).toHaveBeenCalledWith("cli-setup-gateway", { + timeoutMs: 8_000, + }); + expect(waitGatewayAccountReady).toHaveBeenCalledTimes(2); + expect(driverStop).toHaveBeenCalledTimes(1); + const [cliRunDir] = await readdir(path.join(outputDir, "cli-setup-then-gateway-reply")); + const cliArtifactDir = path.join(outputDir, "cli-setup-then-gateway-reply", cliRunDir ?? ""); + await expect( + readFile(path.join(cliArtifactDir, "encryption-setup.stdout.txt"), "utf8"), + ).resolves.toContain('"accountId":"cli-setup-gateway"'); + } finally { + await rm(outputDir, { force: true, recursive: true }); + } + }); + it("runs Matrix E2EE bootstrap failure through a real faulted homeserver endpoint", async () => { const stop = vi.fn().mockResolvedValue(undefined); const hits = vi.fn().mockReturnValue([ diff --git a/extensions/qa-matrix/src/substrate/e2ee-client.test.ts b/extensions/qa-matrix/src/substrate/e2ee-client.test.ts index 077309b2ff3..3f59e3e82c0 100644 --- a/extensions/qa-matrix/src/substrate/e2ee-client.test.ts +++ b/extensions/qa-matrix/src/substrate/e2ee-client.test.ts @@ -11,7 +11,7 @@ describe("matrix qa e2ee client storage", () => { }); }); - it("shares persisted crypto by actor and scopes sync replay by scenario", () => { + it("shares persisted crypto and sync state by actor account", () => { const first = __testing.buildMatrixQaE2eeStoragePaths({ actorId: "driver", outputDir: "/tmp/openclaw/.artifacts/qa-e2e/matrix-run", @@ -34,27 +34,42 @@ describe("matrix qa e2ee client storage", () => { ); expect(first.cryptoDatabasePrefix).toBe(second.cryptoDatabasePrefix); expect(first.recoveryKeyPath).toBe(path.join(first.accountDir, "recovery-key.json")); - expect(first.storagePath).toBe( - path.join( - "/tmp/openclaw/.artifacts/qa-e2e/matrix-run", - "matrix-e2ee", - "accounts", - "driver", - "scenarios", - "matrix-e2ee-basic-reply", - "sync-store.json", - ), - ); - expect(second.storagePath).toBe( - path.join( - "/tmp/openclaw/.artifacts/qa-e2e/matrix-run", - "matrix-e2ee", - "accounts", - "driver", - "scenarios", - "matrix-e2ee-qr-verification", - "sync-store.json", - ), - ); + expect(first.storagePath).toBe(path.join(first.accountDir, "sync-store.json")); + expect(second.storagePath).toBe(first.storagePath); + }); + + it("records late-decrypted payload updates for an existing event id", () => { + const previous = { + eventId: "$reply", + kind: "message" as const, + roomId: "!room:matrix-qa.test", + sender: "@bot:matrix-qa.test", + type: "m.room.message", + }; + + expect( + __testing.shouldRecordMatrixQaObservedEventUpdate({ + previous, + next: { + ...previous, + body: "MATRIX_QA_E2EE_CLI_GATEWAY_OK", + msgtype: "m.text", + }, + }), + ).toBe(true); + expect( + __testing.shouldRecordMatrixQaObservedEventUpdate({ + previous: { + ...previous, + body: "MATRIX_QA_E2EE_CLI_GATEWAY_OK", + msgtype: "m.text", + }, + next: { + ...previous, + body: "MATRIX_QA_E2EE_CLI_GATEWAY_OK", + msgtype: "m.text", + }, + }), + ).toBe(false); }); }); diff --git a/extensions/qa-matrix/src/substrate/e2ee-client.ts b/extensions/qa-matrix/src/substrate/e2ee-client.ts index dc940df5f7c..1e142133bd6 100644 --- a/extensions/qa-matrix/src/substrate/e2ee-client.ts +++ b/extensions/qa-matrix/src/substrate/e2ee-client.ts @@ -21,7 +21,7 @@ import { findMatrixQaObservedEventMatch, normalizeMatrixQaObservedEvent } from " import type { MatrixQaObservedEvent } from "./events.js"; import type { MatrixQaRoomEventWaitResult } from "./sync.js"; -type MatrixQaE2eeActorId = "driver" | "observer" | `driver-${string}`; +type MatrixQaE2eeActorId = "driver" | "observer" | `driver-${string}` | `cli-${string}`; type MatrixQaE2eeRuntime = typeof import("@openclaw/matrix/test-api.js"); @@ -43,6 +43,24 @@ const MATRIX_QA_E2EE_SYNC_FILTER = { }, }; +function shouldRecordMatrixQaObservedEventUpdate(params: { + next: MatrixQaObservedEvent; + previous: MatrixQaObservedEvent | undefined; +}) { + const previous = params.previous; + if (!previous) { + return true; + } + const next = params.next; + return ( + (previous.body === undefined && next.body !== undefined) || + (previous.formattedBody === undefined && next.formattedBody !== undefined) || + (previous.msgtype === undefined && next.msgtype !== undefined) || + (previous.mentions === undefined && next.mentions !== undefined) || + (previous.attachment === undefined && next.attachment !== undefined) + ); +} + export type MatrixQaE2eeScenarioClient = { acceptVerification(id: string): Promise; bootstrapOwnDeviceVerification(params?: { @@ -111,6 +129,7 @@ export type MatrixQaE2eeScenarioClient = { roomId: string; timeoutMs: number; }): Promise; + waitForJoinedMember(params: { roomId: string; timeoutMs: number; userId: string }): Promise; waitForRoomEvent(params: { predicate: (event: MatrixQaObservedEvent) => boolean; roomId: string; @@ -134,7 +153,6 @@ function buildMatrixQaE2eeStoragePaths(params: { }) { const rootDir = path.join(params.outputDir, "matrix-e2ee", "accounts", params.actorId); const accountDir = path.join(rootDir, "account"); - const scenarioKey = params.scenarioId.replace(/[^A-Za-z0-9_-]/g, "-").slice(-80); const runKey = path .basename(params.outputDir) .replace(/[^A-Za-z0-9_-]/g, "-") @@ -146,7 +164,7 @@ function buildMatrixQaE2eeStoragePaths(params: { idbSnapshotPath: path.join(accountDir, "crypto-idb-snapshot.json"), recoveryKeyPath: path.join(accountDir, "recovery-key.json"), rootDir, - storagePath: path.join(rootDir, "scenarios", scenarioKey || "scenario", "sync-store.json"), + storagePath: path.join(accountDir, "sync-store.json"), }; } @@ -198,15 +216,21 @@ export async function createMatrixQaE2eeScenarioClient( const client: MatrixClient = await createMatrixQaE2eeMatrixClient(params); const localEvents: MatrixQaObservedEvent[] = []; const verificationSummaries: MatrixVerificationSummary[] = []; - const observedEventIds = new Set(); + const observedEventsById = new Map(); let cursorIndex = 0; const recordEvent = (roomId: string, event: MatrixRawEvent) => { const normalized = normalizeMatrixQaObservedEvent(roomId, event); - if (!normalized || observedEventIds.has(normalized.eventId)) { + if ( + !normalized || + !shouldRecordMatrixQaObservedEventUpdate({ + next: normalized, + previous: observedEventsById.get(normalized.eventId), + }) + ) { return; } - observedEventIds.add(normalized.eventId); + observedEventsById.set(normalized.eventId, normalized); localEvents.push(normalized); params.observedEvents.push(normalized); }; @@ -300,6 +324,18 @@ export async function createMatrixQaE2eeScenarioClient( ); }, prime, + async waitForJoinedMember(opts) { + const startedAt = Date.now(); + while (Date.now() - startedAt < opts.timeoutMs) { + if (client.hasSyncedJoinedRoomMember(opts.roomId, opts.userId)) { + return; + } + await sleep(Math.min(250, Math.max(25, opts.timeoutMs - (Date.now() - startedAt)))); + } + throw new Error( + `Matrix E2EE client did not sync joined membership for ${opts.userId} in ${opts.roomId}`, + ); + }, async requestVerification(opts) { return await requireCrypto().requestVerification(opts); }, @@ -388,4 +424,5 @@ export const __testing = { MATRIX_QA_E2EE_SYNC_FILTER, buildMatrixQaE2eeStoragePaths, findMatrixQaObservedEventMatch, + shouldRecordMatrixQaObservedEventUpdate, }; From 3b74b913e34067cd6de2dcc57ec02e06c78cbac6 Mon Sep 17 00:00:00 2001 From: Gustavo Madeira Santana Date: Sun, 26 Apr 2026 22:33:39 -0400 Subject: [PATCH 213/418] fix(matrix): avoid device cleanup sync races --- .../matrix/src/matrix/actions/devices.test.ts | 7 ++- .../matrix/src/matrix/actions/devices.ts | 4 +- .../scenario-runtime-e2ee-destructive.ts | 46 +++++++++++-------- .../runners/contract/scenario-runtime-e2ee.ts | 4 ++ 4 files changed, 39 insertions(+), 22 deletions(-) diff --git a/extensions/matrix/src/matrix/actions/devices.test.ts b/extensions/matrix/src/matrix/actions/devices.test.ts index 0892c811ad2..578e48471c2 100644 --- a/extensions/matrix/src/matrix/actions/devices.test.ts +++ b/extensions/matrix/src/matrix/actions/devices.test.ts @@ -96,7 +96,7 @@ describe("matrix device actions", () => { }, ], })); - withStartedActionClientMock.mockImplementation(async (_opts, run) => { + withResolvedActionClientMock.mockImplementation(async (_opts, run) => { return await run({ listOwnDevices: vi.fn(async () => [ { @@ -150,5 +150,10 @@ describe("matrix device actions", () => { current: true, }), ]); + expect(withResolvedActionClientMock).toHaveBeenCalledWith( + { accountId: "poe" }, + expect.any(Function), + ); + expect(withStartedActionClientMock).not.toHaveBeenCalled(); }); }); diff --git a/extensions/matrix/src/matrix/actions/devices.ts b/extensions/matrix/src/matrix/actions/devices.ts index 27735fc081f..c64a128712b 100644 --- a/extensions/matrix/src/matrix/actions/devices.ts +++ b/extensions/matrix/src/matrix/actions/devices.ts @@ -1,5 +1,5 @@ import { summarizeMatrixDeviceHealth } from "../device-health.js"; -import { withResolvedActionClient, withStartedActionClient } from "./client.js"; +import { withResolvedActionClient } from "./client.js"; import type { MatrixActionClientOpts } from "./types.js"; export async function listMatrixOwnDevices(opts: MatrixActionClientOpts = {}) { @@ -7,7 +7,7 @@ export async function listMatrixOwnDevices(opts: MatrixActionClientOpts = {}) { } export async function pruneMatrixStaleGatewayDevices(opts: MatrixActionClientOpts = {}) { - return await withStartedActionClient(opts, async (client) => { + return await withResolvedActionClient(opts, async (client) => { const devices = await client.listOwnDevices(); const health = summarizeMatrixDeviceHealth(devices); const staleGatewayDeviceIds = health.staleOpenClawDevices.map((device) => device.deviceId); diff --git a/extensions/qa-matrix/src/runners/contract/scenario-runtime-e2ee-destructive.ts b/extensions/qa-matrix/src/runners/contract/scenario-runtime-e2ee-destructive.ts index b177dbf6126..5577d01dc41 100644 --- a/extensions/qa-matrix/src/runners/contract/scenario-runtime-e2ee-destructive.ts +++ b/extensions/qa-matrix/src/runners/contract/scenario-runtime-e2ee-destructive.ts @@ -81,6 +81,19 @@ type MatrixQaDestructiveSetup = { seededEventId: string; }; +async function cleanupMatrixQaTempDevices( + client: MatrixQaE2eeScenarioClient, + deviceIds: Array, +): Promise { + await client.stop().catch(() => undefined); + const uniqueDeviceIds = [ + ...new Set(deviceIds.filter((deviceId): deviceId is string => !!deviceId)), + ]; + if (uniqueDeviceIds.length > 0) { + await client.deleteOwnDevices(uniqueDeviceIds).catch(() => undefined); + } +} + function requireMatrixQaE2eeOutputDir(context: MatrixQaScenarioContext) { if (!context.outputDir) { throw new Error("Matrix E2EE destructive QA scenarios require an output directory"); @@ -668,8 +681,7 @@ export async function runMatrixQaE2eeStateLossExternalRecoveryKeyScenario( }; } finally { await cli.dispose().catch(() => undefined); - await setup.owner.deleteOwnDevices([device.deviceId]).catch(() => undefined); - await setup.owner.stop().catch(() => undefined); + await cleanupMatrixQaTempDevices(setup.owner, [device.deviceId]); } } @@ -748,8 +760,7 @@ export async function runMatrixQaE2eeStateLossStoredRecoveryKeyScenario( }; } finally { await cli.dispose().catch(() => undefined); - await setup.owner.deleteOwnDevices([device.deviceId]).catch(() => undefined); - await setup.owner.stop().catch(() => undefined); + await cleanupMatrixQaTempDevices(setup.owner, [device.deviceId]); } } @@ -793,8 +804,7 @@ export async function runMatrixQaE2eeStateLossNoRecoveryKeyScenario( }; } finally { await cli.dispose().catch(() => undefined); - await setup.owner.deleteOwnDevices([device.deviceId]).catch(() => undefined); - await setup.owner.stop().catch(() => undefined); + await cleanupMatrixQaTempDevices(setup.owner, [device.deviceId]); } } @@ -863,8 +873,7 @@ export async function runMatrixQaE2eeStaleRecoveryKeyAfterBackupResetScenario( }; } finally { await cli.dispose().catch(() => undefined); - await setup.owner.deleteOwnDevices([device.deviceId]).catch(() => undefined); - await setup.owner.stop().catch(() => undefined); + await cleanupMatrixQaTempDevices(setup.owner, [device.deviceId]); } } @@ -1026,8 +1035,7 @@ export async function runMatrixQaE2eeServerBackupDeletedLocalReuploadRestoresSce }; } finally { await cli.dispose().catch(() => undefined); - await setup.owner.deleteOwnDevices([device.deviceId]).catch(() => undefined); - await setup.owner.stop().catch(() => undefined); + await cleanupMatrixQaTempDevices(setup.owner, [device.deviceId]); } } @@ -1101,8 +1109,7 @@ export async function runMatrixQaE2eeCorruptCryptoIdbSnapshotScenario( }; } finally { await cli.dispose().catch(() => undefined); - await setup.owner.deleteOwnDevices([device.deviceId]).catch(() => undefined); - await setup.owner.stop().catch(() => undefined); + await cleanupMatrixQaTempDevices(setup.owner, [device.deviceId]); } } @@ -1141,6 +1148,7 @@ export async function runMatrixQaE2eeServerDeviceDeletedLocalStateIntactScenario assertMatrixQaCliBackupRestoreSucceeded(restored.payload, "deleted-device preflight"); await setup.owner.deleteOwnDevices([device.deviceId]); const ownerDevicesAfterDelete = await setup.owner.listOwnDevices(); + await setup.owner.stop().catch(() => undefined); const defaultStatus = await runMatrixQaCliJson({ allowNonZero: true, args: ["matrix", "verify", "status", "--account", "deleted-device", "--json"], @@ -1238,6 +1246,7 @@ export async function runMatrixQaE2eeServerDeviceDeletedReloginRecoversScenario( await setup.owner.deleteOwnDevices([deleted.device.deviceId]); const ownerDevicesAfterDelete = await setup.owner.listOwnDevices(); + await setup.owner.stop().catch(() => undefined); const defaultStatus = await runMatrixQaCliJson({ allowNonZero: true, args: ["matrix", "verify", "status", "--account", "deleted-device-recovery", "--json"], @@ -1322,12 +1331,11 @@ export async function runMatrixQaE2eeServerDeviceDeletedReloginRecoversScenario( }; } finally { await replacement?.cli.dispose().catch(() => undefined); - if (replacement?.device.deviceId) { - await setup.owner.deleteOwnDevices([replacement.device.deviceId]).catch(() => undefined); - } await deleted.cli.dispose().catch(() => undefined); - await setup.owner.deleteOwnDevices([deleted.device.deviceId]).catch(() => undefined); - await setup.owner.stop().catch(() => undefined); + await cleanupMatrixQaTempDevices(setup.owner, [ + replacement?.device.deviceId, + deleted.device.deviceId, + ]); } } @@ -1566,6 +1574,7 @@ export async function runMatrixQaE2eeWrongAccountRecoveryKeyScenario( }; } finally { await cli?.dispose().catch(() => undefined); + await observer.stop().catch(() => undefined); if (device) { await observer.deleteOwnDevices([device.deviceId]).catch(() => undefined); } @@ -1627,7 +1636,6 @@ export async function runMatrixQaE2eeHistoryExistsBackupEmptyScenario( }; } finally { await cli.dispose().catch(() => undefined); - await setup.owner.deleteOwnDevices([device.deviceId]).catch(() => undefined); - await setup.owner.stop().catch(() => undefined); + await cleanupMatrixQaTempDevices(setup.owner, [device.deviceId]); } } diff --git a/extensions/qa-matrix/src/runners/contract/scenario-runtime-e2ee.ts b/extensions/qa-matrix/src/runners/contract/scenario-runtime-e2ee.ts index 5944f805570..105e0cd98f3 100644 --- a/extensions/qa-matrix/src/runners/contract/scenario-runtime-e2ee.ts +++ b/extensions/qa-matrix/src/runners/contract/scenario-runtime-e2ee.ts @@ -1495,6 +1495,7 @@ export async function runMatrixQaE2eeRecoveryKeyLifecycleScenario( } } await recoveryClient.stop(); + await client.stop().catch(() => undefined); await client.deleteOwnDevices([recoveryDevice.deviceId]).catch(() => undefined); cleanupRecoveryDevice = false; return { @@ -1530,6 +1531,7 @@ export async function runMatrixQaE2eeRecoveryKeyLifecycleScenario( } finally { if (cleanupRecoveryDevice) { await recoveryClient.stop().catch(() => undefined); + await client.stop().catch(() => undefined); await client.deleteOwnDevices([recoveryDevice.deviceId]).catch(() => undefined); } } @@ -1609,6 +1611,7 @@ export async function runMatrixQaE2eeRecoveryOwnerVerificationRequiredScenario( ].join("\n"), }; } finally { + await client.stop().catch(() => undefined); await client.deleteOwnDevices([recoveryDevice.deviceId]).catch(() => undefined); } }, @@ -3136,6 +3139,7 @@ export async function runMatrixQaE2eeStaleDeviceHygieneScenario( if (!before.some((device) => device.deviceId === secondary.deviceId)) { throw new Error("Matrix stale-device list did not include the secondary login"); } + await client.stop().catch(() => undefined); const deleted = await client.deleteOwnDevices([secondary.deviceId]); const remainingDeviceIds = deleted.remainingDevices.map((device) => device.deviceId); if (remainingDeviceIds.includes(secondary.deviceId)) { From 2b404163145b0874e7757758bd6adda1502457ce Mon Sep 17 00:00:00 2001 From: Gustavo Madeira Santana Date: Sun, 26 Apr 2026 23:39:09 -0400 Subject: [PATCH 214/418] test(matrix): speed up CLI metadata entry test --- extensions/matrix/index.test.ts | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/extensions/matrix/index.test.ts b/extensions/matrix/index.test.ts index 487ac02ab48..736388e1c92 100644 --- a/extensions/matrix/index.test.ts +++ b/extensions/matrix/index.test.ts @@ -69,8 +69,7 @@ describe("matrix plugin", () => { expect(entry.setChannelRuntime).toEqual(expect.any(Function)); }); - it("registers CLI metadata during discovery registration", () => { - const registerChannel = vi.fn(); + it("wires CLI metadata through the bundled entry", () => { const registerCli = vi.fn(); const registerGatewayMethod = vi.fn(); const api = createTestPluginApi({ @@ -79,15 +78,13 @@ describe("matrix plugin", () => { source: "test", config: {}, runtime: {} as never, - registrationMode: "discovery", - registerChannel, + registrationMode: "cli-metadata", registerCli, registerGatewayMethod, }); entry.register(api); - expect(registerChannel).toHaveBeenCalledTimes(1); expect(registerCli).toHaveBeenCalledWith(expect.any(Function), { descriptors: [ { From e1cdaa3c886a99f37ba63e726d5c6e4d13f2f3cd Mon Sep 17 00:00:00 2001 From: Gustavo Madeira Santana Date: Sun, 26 Apr 2026 23:39:14 -0400 Subject: [PATCH 215/418] docs(matrix): note E2EE setup improvements --- CHANGELOG.md | 2 ++ extensions/matrix/CHANGELOG.md | 10 ++++++++++ 2 files changed, 12 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index cf5999054b7..1e1036a39fe 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,10 +6,12 @@ Docs: https://docs.openclaw.ai ### Changes +- Matrix/E2EE: add `openclaw matrix encryption setup` to enable Matrix encryption, bootstrap recovery, and print verification status from one setup flow. Thanks @gumadeiras. - Agents/compaction: add an opt-in `agents.defaults.compaction.maxActiveTranscriptBytes` preflight trigger that runs normal local compaction when the active JSONL grows too large, requiring transcript rotation so successful compaction moves future turns onto a smaller successor file instead of raw byte-splitting history. Thanks @vincentkoc. ### Fixes +- Matrix/E2EE: stabilize recovery and broken-device QA flows while avoiding Matrix device-cleanup sync races that could leave shutdown-time crypto work running. Thanks @gumadeiras. - Cron: classify isolated runs as errors from structured embedded-run execution-denial metadata, with final-output marker fallback for `SYSTEM_RUN_DENIED`, `INVALID_REQUEST`, and approval-binding refusals, so blocked commands no longer appear green in cron history. Fixes #67172; carries forward #67186. Thanks @oc-gh-dr, @hclsys, and @1yihui. - Gateway/install: add a validated `--wrapper`/`OPENCLAW_WRAPPER` service install path that persists executable LaunchAgent/systemd wrappers across forced reinstalls, updates, and doctor repairs instead of falling back to raw node/bun `ProgramArguments`. Fixes #69400. (#72445) Thanks @willtmc. - macOS Gateway: write launchd services with a state-dir `WorkingDirectory`, use a durable state-dir temp path instead of freezing macOS session `TMPDIR`, create that temp directory before bootstrap, and label abort-shaped launchd exits as `SIGABRT/abort` in status output. Fixes #53679 and #70223; refs #71848. Thanks @dlturock, @stammi922, and @palladius. diff --git a/extensions/matrix/CHANGELOG.md b/extensions/matrix/CHANGELOG.md index bf854fc53d8..9276d92c199 100644 --- a/extensions/matrix/CHANGELOG.md +++ b/extensions/matrix/CHANGELOG.md @@ -1,5 +1,15 @@ # Changelog +## Unreleased + +### Changes + +- Matrix/E2EE: add `openclaw matrix encryption setup` to enable Matrix encryption, bootstrap recovery, and print verification status from one setup flow. Thanks @gumadeiras. + +### Fixes + +- Matrix/E2EE: stabilize recovery and broken-device QA flows while avoiding device-cleanup sync races that could leave shutdown-time crypto work running. Thanks @gumadeiras. + ## 2026.4.25 ### Changes From 5f9506f7fd3b3a39f42da81261f72df9496c7bb4 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 04:44:26 +0100 Subject: [PATCH 216/418] ci: avoid inherited package acceptance secrets --- .github/workflows/openclaw-release-checks.yml | 1 - .github/workflows/package-acceptance.yml | 144 +++++++++++++++++- 2 files changed, 142 insertions(+), 3 deletions(-) diff --git a/.github/workflows/openclaw-release-checks.yml b/.github/workflows/openclaw-release-checks.yml index bcd0974125a..1cbb282553d 100644 --- a/.github/workflows/openclaw-release-checks.yml +++ b/.github/workflows/openclaw-release-checks.yml @@ -229,7 +229,6 @@ jobs: package_ref: ${{ needs.resolve_target.outputs.ref }} suite_profile: package telegram_mode: none - secrets: inherit qa_lab_parity_release_checks: name: Run QA Lab parity gate diff --git a/.github/workflows/package-acceptance.yml b/.github/workflows/package-acceptance.yml index 6116973ed05..bfa3f1807ed 100644 --- a/.github/workflows/package-acceptance.yml +++ b/.github/workflows/package-acceptance.yml @@ -129,6 +129,99 @@ on: required: false default: none type: string + secrets: + OPENAI_API_KEY: + required: false + OPENAI_BASE_URL: + required: false + ANTHROPIC_API_KEY: + required: false + ANTHROPIC_API_KEY_OLD: + required: false + ANTHROPIC_API_TOKEN: + required: false + BYTEPLUS_API_KEY: + required: false + CEREBRAS_API_KEY: + required: false + DASHSCOPE_API_KEY: + required: false + GROQ_API_KEY: + required: false + KIMI_API_KEY: + required: false + MODELSTUDIO_API_KEY: + required: false + MOONSHOT_API_KEY: + required: false + MISTRAL_API_KEY: + required: false + MINIMAX_API_KEY: + required: false + OPENCODE_API_KEY: + required: false + OPENCODE_ZEN_API_KEY: + required: false + OPENCLAW_LIVE_BROWSER_CDP_URL: + required: false + OPENCLAW_LIVE_SETUP_TOKEN: + required: false + OPENCLAW_LIVE_SETUP_TOKEN_MODEL: + required: false + OPENCLAW_LIVE_SETUP_TOKEN_PROFILE: + required: false + OPENCLAW_LIVE_SETUP_TOKEN_VALUE: + required: false + GEMINI_API_KEY: + required: false + GOOGLE_API_KEY: + required: false + OPENROUTER_API_KEY: + required: false + QWEN_API_KEY: + required: false + FAL_KEY: + required: false + RUNWAY_API_KEY: + required: false + DEEPGRAM_API_KEY: + required: false + TOGETHER_API_KEY: + required: false + VYDRA_API_KEY: + required: false + XAI_API_KEY: + required: false + ZAI_API_KEY: + required: false + Z_AI_API_KEY: + required: false + BYTEPLUS_ACCESS_KEY_ID: + required: false + BYTEPLUS_SECRET_ACCESS_KEY: + required: false + CLAUDE_CODE_OAUTH_TOKEN: + required: false + OPENCLAW_CODEX_AUTH_JSON: + required: false + OPENCLAW_CODEX_CONFIG_TOML: + required: false + OPENCLAW_CLAUDE_JSON: + required: false + OPENCLAW_CLAUDE_CREDENTIALS_JSON: + required: false + OPENCLAW_CLAUDE_SETTINGS_JSON: + required: false + OPENCLAW_CLAUDE_SETTINGS_LOCAL_JSON: + required: false + OPENCLAW_GEMINI_SETTINGS_JSON: + required: false + FIREWORKS_API_KEY: + required: false + OPENCLAW_QA_CONVEX_SITE_URL: + required: false + OPENCLAW_QA_CONVEX_SECRET_CI: + required: false permissions: actions: read @@ -336,7 +429,51 @@ jobs: package_artifact_name: ${{ needs.resolve_package.outputs.package_artifact_name }} include_live_suites: ${{ needs.resolve_package.outputs.include_live_suites == 'true' }} live_models_only: false - secrets: inherit + secrets: + OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} + OPENAI_BASE_URL: ${{ secrets.OPENAI_BASE_URL }} + ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} + ANTHROPIC_API_KEY_OLD: ${{ secrets.ANTHROPIC_API_KEY_OLD }} + ANTHROPIC_API_TOKEN: ${{ secrets.ANTHROPIC_API_TOKEN }} + BYTEPLUS_API_KEY: ${{ secrets.BYTEPLUS_API_KEY }} + CEREBRAS_API_KEY: ${{ secrets.CEREBRAS_API_KEY }} + DASHSCOPE_API_KEY: ${{ secrets.DASHSCOPE_API_KEY }} + GROQ_API_KEY: ${{ secrets.GROQ_API_KEY }} + KIMI_API_KEY: ${{ secrets.KIMI_API_KEY }} + MODELSTUDIO_API_KEY: ${{ secrets.MODELSTUDIO_API_KEY }} + MOONSHOT_API_KEY: ${{ secrets.MOONSHOT_API_KEY }} + MISTRAL_API_KEY: ${{ secrets.MISTRAL_API_KEY }} + MINIMAX_API_KEY: ${{ secrets.MINIMAX_API_KEY }} + OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }} + OPENCODE_ZEN_API_KEY: ${{ secrets.OPENCODE_ZEN_API_KEY }} + OPENCLAW_LIVE_BROWSER_CDP_URL: ${{ secrets.OPENCLAW_LIVE_BROWSER_CDP_URL }} + OPENCLAW_LIVE_SETUP_TOKEN: ${{ secrets.OPENCLAW_LIVE_SETUP_TOKEN }} + OPENCLAW_LIVE_SETUP_TOKEN_MODEL: ${{ secrets.OPENCLAW_LIVE_SETUP_TOKEN_MODEL }} + OPENCLAW_LIVE_SETUP_TOKEN_PROFILE: ${{ secrets.OPENCLAW_LIVE_SETUP_TOKEN_PROFILE }} + OPENCLAW_LIVE_SETUP_TOKEN_VALUE: ${{ secrets.OPENCLAW_LIVE_SETUP_TOKEN_VALUE }} + GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }} + GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }} + OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }} + QWEN_API_KEY: ${{ secrets.QWEN_API_KEY }} + FAL_KEY: ${{ secrets.FAL_KEY }} + RUNWAY_API_KEY: ${{ secrets.RUNWAY_API_KEY }} + DEEPGRAM_API_KEY: ${{ secrets.DEEPGRAM_API_KEY }} + TOGETHER_API_KEY: ${{ secrets.TOGETHER_API_KEY }} + VYDRA_API_KEY: ${{ secrets.VYDRA_API_KEY }} + XAI_API_KEY: ${{ secrets.XAI_API_KEY }} + ZAI_API_KEY: ${{ secrets.ZAI_API_KEY }} + Z_AI_API_KEY: ${{ secrets.Z_AI_API_KEY }} + BYTEPLUS_ACCESS_KEY_ID: ${{ secrets.BYTEPLUS_ACCESS_KEY_ID }} + BYTEPLUS_SECRET_ACCESS_KEY: ${{ secrets.BYTEPLUS_SECRET_ACCESS_KEY }} + CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} + OPENCLAW_CODEX_AUTH_JSON: ${{ secrets.OPENCLAW_CODEX_AUTH_JSON }} + OPENCLAW_CODEX_CONFIG_TOML: ${{ secrets.OPENCLAW_CODEX_CONFIG_TOML }} + OPENCLAW_CLAUDE_JSON: ${{ secrets.OPENCLAW_CLAUDE_JSON }} + OPENCLAW_CLAUDE_CREDENTIALS_JSON: ${{ secrets.OPENCLAW_CLAUDE_CREDENTIALS_JSON }} + OPENCLAW_CLAUDE_SETTINGS_JSON: ${{ secrets.OPENCLAW_CLAUDE_SETTINGS_JSON }} + OPENCLAW_CLAUDE_SETTINGS_LOCAL_JSON: ${{ secrets.OPENCLAW_CLAUDE_SETTINGS_LOCAL_JSON }} + OPENCLAW_GEMINI_SETTINGS_JSON: ${{ secrets.OPENCLAW_GEMINI_SETTINGS_JSON }} + FIREWORKS_API_KEY: ${{ secrets.FIREWORKS_API_KEY }} npm_telegram: name: Published npm Telegram acceptance @@ -346,7 +483,10 @@ jobs: with: package_spec: ${{ inputs.package_spec }} provider_mode: ${{ needs.resolve_package.outputs.telegram_mode }} - secrets: inherit + secrets: + OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} + OPENCLAW_QA_CONVEX_SITE_URL: ${{ secrets.OPENCLAW_QA_CONVEX_SITE_URL }} + OPENCLAW_QA_CONVEX_SECRET_CI: ${{ secrets.OPENCLAW_QA_CONVEX_SECRET_CI }} summary: name: Verify package acceptance From 4340cb74c24fcad4b7a452e3ef07de3effedf629 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 20:49:56 -0700 Subject: [PATCH 217/418] docs(agents): document testbox maintainer workflow --- .agents/skills/blacksmith-testbox/SKILL.md | 73 ++++++++++++++++++---- AGENTS.md | 5 +- 2 files changed, 65 insertions(+), 13 deletions(-) diff --git a/.agents/skills/blacksmith-testbox/SKILL.md b/.agents/skills/blacksmith-testbox/SKILL.md index ef53f45c78b..60546311d03 100644 --- a/.agents/skills/blacksmith-testbox/SKILL.md +++ b/.agents/skills/blacksmith-testbox/SKILL.md @@ -10,8 +10,9 @@ description: Run Blacksmith Testbox for CI-parity checks, secrets, hosted servic Use Testbox when you need remote CI parity, injected secrets, hosted services, or an OS/runtime image that your local machine cannot provide cheaply. -Do not default to Testbox for every local test/build loop. If the repo has -documented local commands for normal iteration, use those first so you keep +Do not default to Testbox for every local test/build loop unless the repo or +the user's personal maintainer rules explicitly say Testbox-first. If the repo +has documented local commands for normal iteration, use those first so you keep warm caches, local build state, and fast feedback. Testbox is the expensive path. Reach for it deliberately. @@ -81,7 +82,8 @@ Prefer Testbox when: - you are reproducing CI-only failures - you need the exact workflow image/job environment from GitHub Actions -For OpenClaw specifically, normal local iteration should stay local: +For OpenClaw specifically, contributor and routine local iteration should stay +local: - `pnpm check:changed` - `pnpm test:changed` @@ -89,9 +91,11 @@ For OpenClaw specifically, normal local iteration should stay local: - `pnpm test:serial` - `pnpm build` -Only use Testbox in OpenClaw when the user explicitly wants CI-parity or the -check truly depends on remote secrets/services that the local repo loop cannot -provide. +OpenClaw maintainer mode is different. If the user has Blacksmith access and +sets `OPENCLAW_TESTBOX=1`, or their personal agent rules say Testbox-first, +route broad, slow, Docker, live, E2E, full-suite, and CI-parity validation +through Testbox by default. `OPENCLAW_LOCAL_CHECK_MODE=throttled` remains the +escape hatch for laptop-friendly local proof. For installable-package product proof, prefer the GitHub `Package Acceptance` workflow over an ad hoc Testbox command. It resolves one package candidate @@ -111,13 +115,35 @@ an ID instantly and boots the CI environment in the background while you work: Save this ID. You need it for every `run` command. +For long-ish OpenClaw maintainer tasks in Testbox mode, pre-warm at the start +with a longer idle timeout: + + blacksmith testbox warmup ci-check-testbox.yml --idle-timeout 90 + # → tbx_01jkz5b3t9... + +The CLI and current docs expose `--idle-timeout ` and document the +default as 30 minutes, but do not publish a universal maximum. OpenClaw policy: +use `90` for normal long-ish tasks, `240` for multi-hour work, `720` for +all-day work, and `1440` for overnight work. Anything above `1440` minutes +requires explicit user intent and an end-of-task cleanup check. + +Observed on 2026-04-27: Blacksmith accepted `90`, `240`, `720`, `1440`, +`4320`, `10080`, `43200`, and even `525600` minutes, with every probe box +stopped immediately. Treat that as "no sane visible cap", not permission to +leave giant-idle boxes around. + +Choose the warmup ref deliberately. `--ref ` can point at a +branch, tag, or SHA. For cache seeding, prefer exact current branch/SHA for +correctness; use the latest `beta` or `latest` release SHA only as a warm cache +seed, then still run the build/check that proves local synced changes. + Warmup dispatches a GitHub Actions workflow that provisions a VM with the full CI environment: dependencies installed, services started, secrets injected, and a clean checkout of the repo at the default branch. Options: - --ref Git ref to dispatch against (default: repo's default branch) + --ref Git ref to dispatch against (default: repo's default branch) --job Specific job within the workflow (if it has multiple) --idle-timeout Idle timeout in minutes (default: 30) @@ -250,18 +276,27 @@ checks that need parity or remote state. ## Workflow -1. Decide whether the repo's local loop is the right default. +1. Decide whether the repo's local loop or maintainer Testbox mode is the right + default. 2. Only if Testbox is warranted, warm up early: - `blacksmith testbox warmup ci-check-testbox.yml` → save the ID + `blacksmith testbox warmup ci-check-testbox.yml --idle-timeout 90` → save the ID. + Use `--idle-timeout 240`, `720`, or `1440` only when the task duration + justifies it. 3. Write code while the testbox boots in the background. 4. Run the remote command when needed: `blacksmith testbox run --id "npm test"` -5. If tests fail, fix code and re-run against the same warm box. +5. If tests fail, fix code and re-run against the same warm box. Reuse this + same `tbx_...` for every run/download in the task unless it expires, the + workflow/ref/env must change, or the user asks for a fresh box. 6. If you changed dependency manifests (package.json, etc.), prepend the install command: `blacksmith testbox run --id "npm install && npm test"` 7. If you need artifacts (coverage reports, build outputs, etc.), download them: `blacksmith testbox download --id coverage/ ./coverage/` 8. Once green, commit and push. +9. If you used a long timeout or created probe boxes, clean up with + `blacksmith testbox list` and `blacksmith testbox stop --id `. Stop only + boxes from the current task unless the user asks you to clean up other active + boxes. ## OpenClaw full test suite @@ -334,10 +369,24 @@ timeout is reached). Default timeout is 5m; use `--wait-timeout` for longer Testboxes automatically shut down after being idle (default: 30 minutes). If you need a longer session, increase the timeout at warmup time: - blacksmith testbox warmup ci-check-testbox.yml --idle-timeout 60 + blacksmith testbox warmup ci-check-testbox.yml --idle-timeout 90 + +For OpenClaw maintainer work, use coarse timeout bins instead of probing many +small values: + +- `90` minutes: default long-ish task +- `240` minutes: multi-hour task +- `720` minutes: all-day task +- `1440` minutes: overnight task; max without explicit user intent + +Because the service currently accepts much larger values, cleanup is part of +the workflow, not a nice-to-have: + + blacksmith testbox list + blacksmith testbox stop --id ## With options blacksmith testbox warmup ci-check-testbox.yml --ref main - blacksmith testbox warmup ci-check-testbox.yml --idle-timeout 60 + blacksmith testbox warmup ci-check-testbox.yml --idle-timeout 240 blacksmith testbox run --id "go test ./..." diff --git a/AGENTS.md b/AGENTS.md index faca52035ae..c5d54ac309b 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -54,7 +54,10 @@ Telegraph style. Root rules only. Read scoped `AGENTS.md` before subtree work. - Formatting: use `oxfmt`, not Prettier. Prefer `pnpm format:check` / `pnpm format`; for targeted files use `pnpm exec oxfmt --check --threads=1 ` or `pnpm exec oxfmt --write --threads=1 `. - Linting: use repo wrappers (`pnpm lint:*`, `scripts/run-oxlint.mjs`); do not invoke generic JS formatters/lints unless a repo script uses them. - Heavy checks: `OPENCLAW_LOCAL_CHECK=1`, mode `OPENCLAW_LOCAL_CHECK_MODE=throttled|full`; CI/shared use `OPENCLAW_LOCAL_CHECK=0`. -- Local first. Use repo `pnpm` lanes before Blacksmith/Testbox. Remote only for parity-only failures, secrets/services, or explicit ask. +- Default contributor path: local repo `pnpm` lanes first. Maintainer-only Testbox path: when Blacksmith access is configured and `OPENCLAW_TESTBOX=1` or personal rules request Testbox-first, use Blacksmith for broad, slow, Docker, live, E2E, full-suite, or CI-parity validation. `OPENCLAW_LOCAL_CHECK_MODE=throttled` is the local escape hatch. +- Testbox pre-warm: for long-ish OpenClaw tasks in Testbox mode, run from repo root early: `blacksmith testbox warmup ci-check-testbox.yml --idle-timeout 90`. Use `240`, `720`, or `1440` only for multi-hour, all-day, or overnight work; above `1440` requires explicit user intent. Save the returned `tbx_...` and reuse it for every `blacksmith testbox run --id ...` in that task unless the box expires, the workflow/ref/env must change, or the user asks for a fresh box. +- Testbox cleanup: track every created `tbx_...`; use `blacksmith testbox list` to inspect active boxes and `blacksmith testbox stop --id ` to stop boxes from the current task. Do not stop pre-existing boxes unless they are clearly yours or the user asks. +- Testbox cache seed: `--ref ` may point at the current branch/SHA for correctness or a latest `beta`/`latest` SHA for warm cache state. A seeded box is not proof by itself; still run the build/check after local sync. ## GitHub / CI From 6590e0e872f83614343de073909e013c66ed280e Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 04:50:40 +0100 Subject: [PATCH 218/418] docs: expand release validation runbook --- docs/reference/RELEASING.md | 192 +++++++++++++++++++++++++++++++++++- 1 file changed, 191 insertions(+), 1 deletion(-) diff --git a/docs/reference/RELEASING.md b/docs/reference/RELEASING.md index 0892d6bd7f3..dd8bf68a4c6 100644 --- a/docs/reference/RELEASING.md +++ b/docs/reference/RELEASING.md @@ -1,8 +1,9 @@ --- -summary: "Public release channels, version naming, and cadence" +summary: "Release lanes, operator checklist, validation boxes, version naming, and cadence" title: "Release policy" read_when: - Looking for public release channel definitions + - Running release validation or package acceptance - Looking for version naming and cadence --- @@ -40,6 +41,52 @@ OpenClaw has three public release lanes: - Detailed release procedure, approvals, credentials, and recovery notes are maintainer-only +## Release operator checklist + +This checklist is the public shape of the release flow. Private credentials, +signing, notarization, dist-tag recovery, and emergency rollback details stay in +the maintainer-only release runbook. + +1. Start from current `main`: pull latest, confirm the target commit is pushed, + and confirm current `main` CI is green enough to branch from it. +2. Rewrite the top `CHANGELOG.md` section from real commit history with + `/changelog`, keep entries user-facing, commit it, push it, and rebase/pull + once more before branching. +3. Review release compatibility records in + `src/plugins/compat/registry.ts` and + `src/commands/doctor/shared/deprecation-compat.ts`. Remove expired + compatibility only when the upgrade path stays covered, or record why it is + intentionally carried. +4. Create `release/YYYY.M.D` from current `main`; do not do normal release work + directly on `main`. +5. Bump every required version location for the intended tag, then run the + local deterministic preflight: + `pnpm check:test-types`, `pnpm check:architecture`, + `pnpm build && pnpm ui:build`, and `pnpm release:check`. +6. Run `OpenClaw NPM Release` with `preflight_only=true`. Before a tag exists, + a full 40-character release-branch SHA is allowed for validation-only + preflight. Save the successful `preflight_run_id`. +7. Run `Full Release Validation` for the release branch, tag, or full commit + SHA. This is the umbrella run for the four big release test boxes: Vitest, + Docker, QA Lab, and Package. +8. If validation fails, fix on the release branch and rerun the smallest failed + file, lane, workflow job, package profile, provider, or model allowlist that + proves the fix. Rerun the full umbrella only when the changed surface makes + prior evidence stale. +9. For beta, tag `vYYYY.M.D-beta.N`, publish with npm dist-tag `beta`, then run + post-publish package acceptance against the published `openclaw@YYYY.M.D-beta.N` + or `openclaw@beta` package. If a pushed or published beta needs a fix, cut + the next `-beta.N`; do not delete or rewrite the old beta. +10. For stable, continue only after the vetted beta or release candidate has the + required validation evidence. Stable npm publish reuses the successful + preflight artifact via `preflight_run_id`; stable macOS release readiness + also requires the packaged `.zip`, `.dmg`, `.dSYM.zip`, and updated + `appcast.xml` on `main`. +11. After publish, run the npm post-publish verifier, optional published-npm + Telegram E2E, dist-tag promotion when needed, GitHub release/prerelease + notes from the complete matching `CHANGELOG.md` section, and the release + announcement steps. + ## Release preflight - Run `pnpm check:test-types` before release preflight so test TypeScript stays @@ -172,6 +219,146 @@ Validation` or from the `main`/release workflow ref so workflow logic and URL, and a `CFBundleVersion` at or above the canonical Sparkle build floor for that release version +## Release test boxes + +`Full Release Validation` is the manual umbrella that operators use when they +want all release validation from one entrypoint: + +```bash +gh workflow run full-release-validation.yml \ + --ref main \ + -f ref=release/YYYY.M.D \ + -f workflow_ref=main \ + -f provider=openai \ + -f mode=both +``` + +The workflow resolves the target ref, dispatches manual `CI` with +`target_ref=`, dispatches `OpenClaw Release Checks`, and +optionally dispatches post-publish Telegram E2E when +`npm_telegram_package_spec` is set. A full run is only acceptable when both +child workflows succeed or an intentionally skipped optional child is recorded +in the summary. + +### Vitest + +The Vitest box is the manual `CI` child workflow. Manual CI intentionally +bypasses changed scoping and forces the normal test graph for the release +candidate: Linux Node shards, bundled-plugin shards, channel contracts, Node 22 +compatibility, `check`, `check-additional`, build smoke, docs checks, Python +skills, Windows, macOS, Android, and Control UI i18n. + +Use this box to answer "did the source tree pass the full normal test suite?" +It is not the same as release-path product validation. Evidence to keep: + +- `Full Release Validation` summary showing the dispatched `CI` run URL +- `CI` run green on the exact target SHA +- failed or slow shard names from the CI jobs when investigating regressions +- Vitest timing artifacts such as `.artifacts/vitest-shard-timings.json` when + a run needs performance analysis + +Run manual CI directly only when the release needs deterministic normal CI but +not the Docker, QA Lab, live, cross-OS, or package boxes: + +```bash +gh workflow run ci.yml --ref main -f target_ref=release/YYYY.M.D +``` + +### Docker + +The Docker box lives in `OpenClaw Release Checks` through +`openclaw-live-and-e2e-checks-reusable.yml`, plus the release-mode +`install-smoke` workflow. It validates the release candidate through packaged +Docker environments instead of only source-level tests. + +Release Docker coverage includes: + +- full install smoke with the slow Bun global install smoke enabled +- repository E2E lanes +- release-path Docker chunks: `core`, `package-update`, and + `plugins-integrations` +- OpenWebUI coverage inside the plugins/integrations chunk +- live/E2E provider suites and Docker live model coverage when release checks + include live suites + +Use Docker artifacts before rerunning. The release-path scheduler uploads +`.artifacts/docker-tests/` with lane logs, `summary.json`, `failures.json`, +phase timings, scheduler plan JSON, and rerun commands. For focused recovery, +use `docker_lanes=` on the reusable live/E2E workflow instead of +rerunning all release chunks. + +### QA Lab + +The QA Lab box is also part of `OpenClaw Release Checks`. It is the agentic +behavior and channel-level release gate, separate from Vitest and Docker +package mechanics. + +Release QA Lab coverage includes: + +- mock parity gate comparing the OpenAI candidate lane against the Opus 4.6 + baseline using the agentic parity pack +- live Matrix QA lane using the `qa-live-shared` environment +- live Telegram QA lane using Convex CI credential leases +- `pnpm qa:otel:smoke` when release telemetry needs explicit local proof + +Use this box to answer "does the release behave correctly in QA scenarios and +live channel flows?" Keep the artifact URLs for parity, Matrix, and Telegram +lanes when approving the release. + +### Package + +The Package box is the installable-product gate. It is backed by +`Package Acceptance` and the resolver +`scripts/resolve-openclaw-package-candidate.mjs`. The resolver normalizes a +candidate into the `package-under-test` tarball consumed by Docker E2E, validates +the package inventory, records the package version and SHA-256, and keeps the +workflow harness ref separate from the package source ref. + +Supported candidate sources: + +- `source=npm`: `openclaw@beta`, `openclaw@latest`, or an exact OpenClaw release + version +- `source=ref`: pack a trusted `package_ref` branch, tag, or full commit SHA + with the selected `workflow_ref` harness +- `source=url`: download an HTTPS `.tgz` with required `package_sha256` +- `source=artifact`: reuse a `.tgz` uploaded by another GitHub Actions run + +`OpenClaw Release Checks` runs Package Acceptance with `source=ref`, +`package_ref=`, and `suite_profile=package`. That profile covers +install, update, and plugin package contracts and is the GitHub-native +replacement for most of the package/update coverage that previously required +Parallels. Cross-OS release checks still matter for OS-specific onboarding, +installer, and platform behavior, but package/update product validation should +prefer Package Acceptance. + +Use broader Package Acceptance profiles when the release question is about an +actual installable package: + +```bash +gh workflow run package-acceptance.yml \ + --ref main \ + -f workflow_ref=main \ + -f source=npm \ + -f package_spec=openclaw@beta \ + -f suite_profile=product +``` + +Common package profiles: + +- `smoke`: quick package install/channel/agent, gateway network, and config + reload lanes +- `package`: install/update/plugin package contracts; this is the release-check + default +- `product`: `package` plus MCP channels, cron/subagent cleanup, OpenAI web + search, and OpenWebUI +- `full`: Docker release-path chunks with OpenWebUI +- `custom`: exact `docker_lanes` list for focused reruns + +For post-publish beta proof, use `source=npm` with the exact beta package or +`openclaw@beta`. Enable `telegram_mode=mock-openai` or +`telegram_mode=live-frontier` only for published npm packages, because that +path reuses the published-npm Telegram E2E workflow. + ## NPM workflow inputs `OpenClaw NPM Release` accepts these operator-controlled inputs: @@ -240,9 +427,12 @@ alerts, and OTP handling observable and prevents repeated host alerts. ## Public references +- [`.github/workflows/full-release-validation.yml`](https://github.com/openclaw/openclaw/blob/main/.github/workflows/full-release-validation.yml) +- [`.github/workflows/package-acceptance.yml`](https://github.com/openclaw/openclaw/blob/main/.github/workflows/package-acceptance.yml) - [`.github/workflows/openclaw-npm-release.yml`](https://github.com/openclaw/openclaw/blob/main/.github/workflows/openclaw-npm-release.yml) - [`.github/workflows/openclaw-release-checks.yml`](https://github.com/openclaw/openclaw/blob/main/.github/workflows/openclaw-release-checks.yml) - [`.github/workflows/openclaw-cross-os-release-checks-reusable.yml`](https://github.com/openclaw/openclaw/blob/main/.github/workflows/openclaw-cross-os-release-checks-reusable.yml) +- [`scripts/resolve-openclaw-package-candidate.mjs`](https://github.com/openclaw/openclaw/blob/main/scripts/resolve-openclaw-package-candidate.mjs) - [`scripts/openclaw-npm-release-check.ts`](https://github.com/openclaw/openclaw/blob/main/scripts/openclaw-npm-release-check.ts) - [`scripts/package-mac-dist.sh`](https://github.com/openclaw/openclaw/blob/main/scripts/package-mac-dist.sh) - [`scripts/make_appcast.sh`](https://github.com/openclaw/openclaw/blob/main/scripts/make_appcast.sh) From 36c08e028816e8114599c71862dd2f4b9db77c2d Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 04:51:54 +0100 Subject: [PATCH 219/418] test(docker): keep web search smoke on one gateway connection --- .../e2e/openai-web-search-minimal-docker.sh | 81 +++++++------------ test/scripts/docker-build-helper.test.ts | 9 +++ 2 files changed, 40 insertions(+), 50 deletions(-) diff --git a/scripts/e2e/openai-web-search-minimal-docker.sh b/scripts/e2e/openai-web-search-minimal-docker.sh index ab3c96cf63e..f5c8c02cacf 100755 --- a/scripts/e2e/openai-web-search-minimal-docker.sh +++ b/scripts/e2e/openai-web-search-minimal-docker.sh @@ -359,9 +359,8 @@ node "$entry" gateway health \ --json >/dev/null cat >/tmp/openclaw-openai-web-search-minimal-client.mjs <<'NODE' -import { execFileSync } from "node:child_process"; +import { pathToFileURL } from "node:url"; -const entry = process.env.OPENCLAW_ENTRY; const port = process.env.PORT; const token = process.env.OPENCLAW_GATEWAY_TOKEN; const mode = process.argv[2]; @@ -372,65 +371,47 @@ const message = : "Return exactly OPENCLAW_SCHEMA_E2E_OK."; const id = mode === "reject" ? "schema-reject" : "schema-success"; -if (!entry || !port || !token) throw new Error("missing OPENCLAW_ENTRY/PORT/OPENCLAW_GATEWAY_TOKEN"); +if (!port || !token) throw new Error("missing PORT/OPENCLAW_GATEWAY_TOKEN"); +const callGatewayUrl = new URL("dist/gateway/call.js", pathToFileURL(`${process.cwd()}/`)); +const { callGateway } = await import(callGatewayUrl.href); -const gatewayArgs = [ - entry, - "gateway", - "call", - "--url", - `ws://127.0.0.1:${port}`, - "--token", - token, - "--timeout", - "120000", - "--json", -]; - -function gatewayCall(method, params) { +async function runAgent() { try { - return { - ok: true, - value: JSON.parse(execFileSync("node", [...gatewayArgs, method, "--params", JSON.stringify(params)], { - encoding: "utf8", - stdio: ["ignore", "pipe", "pipe"], - })), - }; + return await callGateway({ + method: "agent", + params: { + sessionKey, + message, + thinking: "minimal", + deliver: false, + timeout: 180, + idempotencyKey: id, + }, + expectFinal: true, + url: `ws://127.0.0.1:${port}`, + token, + timeoutMs: 240000, + }); } catch (error) { - const stderr = typeof error?.stderr === "string" ? error.stderr : ""; - const stdout = typeof error?.stdout === "string" ? error.stdout : ""; - const combined = [String(error), stderr.trim(), stdout.trim()].filter(Boolean).join("\n"); - return { ok: false, error: new Error(combined) }; + if (mode === "reject") { + console.error(String(error)); + process.exit(0); + } + throw error; } } -const sendRes = gatewayCall("agent", { - sessionKey, - message, - thinking: "minimal", - deliver: false, - timeout: 180, - idempotencyKey: id, -}); - -if (!sendRes.ok) throw sendRes.error; -const runId = - sendRes.value && typeof sendRes.value === "object" && typeof sendRes.value.runId === "string" - ? sendRes.value.runId - : id; - -const wait = gatewayCall("agent.wait", { runId, timeoutMs: 180000 }); -if (!wait.ok) throw wait.error; +const result = await runAgent(); if (mode === "reject") { - console.error(JSON.stringify(wait.value)); + console.error(JSON.stringify(result)); process.exit(0); } -if (wait.value?.status !== "ok") { - throw new Error(`agent run did not complete successfully: ${JSON.stringify(wait.value)}`); +if (result?.status !== "ok") { + throw new Error(`agent run did not complete successfully: ${JSON.stringify(result)}`); } NODE -OPENCLAW_ENTRY="$entry" PORT="$PORT" OPENCLAW_GATEWAY_TOKEN="$TOKEN" node /tmp/openclaw-openai-web-search-minimal-client.mjs success >/tmp/openclaw-openai-web-search-minimal-client-success.log 2>&1 +PORT="$PORT" OPENCLAW_GATEWAY_TOKEN="$TOKEN" node /tmp/openclaw-openai-web-search-minimal-client.mjs success >/tmp/openclaw-openai-web-search-minimal-client-success.log 2>&1 node - "$MOCK_REQUEST_LOG" <<'NODE' const fs = require("node:fs"); @@ -454,7 +435,7 @@ if (success.body.reasoning?.effort === "minimal") { } NODE -OPENCLAW_ENTRY="$entry" PORT="$PORT" OPENCLAW_GATEWAY_TOKEN="$TOKEN" node /tmp/openclaw-openai-web-search-minimal-client.mjs reject >/tmp/openclaw-openai-web-search-minimal-client-reject.log 2>&1 +PORT="$PORT" OPENCLAW_GATEWAY_TOKEN="$TOKEN" node /tmp/openclaw-openai-web-search-minimal-client.mjs reject >/tmp/openclaw-openai-web-search-minimal-client-reject.log 2>&1 for _ in $(seq 1 80); do if grep -Fq "$RAW_SCHEMA_ERROR" "$GATEWAY_LOG"; then diff --git a/test/scripts/docker-build-helper.test.ts b/test/scripts/docker-build-helper.test.ts index 9f9a73ca07c..6b7eb1a9ad9 100644 --- a/test/scripts/docker-build-helper.test.ts +++ b/test/scripts/docker-build-helper.test.ts @@ -5,6 +5,7 @@ const HELPER_PATH = "scripts/lib/docker-build.sh"; const DOCKER_ALL_SCHEDULER_PATH = "scripts/test-docker-all.mjs"; const DOCKER_E2E_SCENARIOS_PATH = "scripts/lib/docker-e2e-scenarios.mjs"; const INSTALL_E2E_RUNNER_PATH = "scripts/docker/install-sh-e2e/run.sh"; +const OPENAI_WEB_SEARCH_MINIMAL_E2E_PATH = "scripts/e2e/openai-web-search-minimal-docker.sh"; const CENTRALIZED_BUILD_SCRIPTS = [ "scripts/docker/setup.sh", "scripts/e2e/browser-cdp-snapshot-docker.sh", @@ -86,4 +87,12 @@ describe("docker build helper", () => { expect(runner).toContain('TURN3_SESSION_ID="${SESSION_ID_PREFIX}-exec-hostname"'); expect(runner).toContain('TURN4_SESSION_ID="${SESSION_ID_PREFIX}-image-write"'); }); + + it("keeps OpenAI web search smoke on one gateway agent connection", () => { + const runner = readFileSync(OPENAI_WEB_SEARCH_MINIMAL_E2E_PATH, "utf8"); + + expect(runner).toContain('new URL("dist/gateway/call.js"'); + expect(runner).toContain("expectFinal: true"); + expect(runner).not.toContain('"agent.wait"'); + }); }); From 6b6f8ab1aaee1c550b14ac706f536b0d248d5e7c Mon Sep 17 00:00:00 2001 From: joshavant <830519+joshavant@users.noreply.github.com> Date: Sun, 26 Apr 2026 22:54:08 -0500 Subject: [PATCH 220/418] Revert "fix: resolve tts secret refs for local infer (#72549)" This reverts commit 4878d3e059cee7fb0652cf973e82d76cc7371764. --- src/cli/capability-cli.test.ts | 76 ------------------- src/cli/capability-cli.ts | 9 +-- ...command-secret-resolution.coverage.test.ts | 1 - src/cli/command-secret-targets.test.ts | 6 -- src/cli/command-secret-targets.ts | 7 +- 5 files changed, 2 insertions(+), 97 deletions(-) diff --git a/src/cli/capability-cli.test.ts b/src/cli/capability-cli.test.ts index 1f1e210aa4d..24cfbb27ad3 100644 --- a/src/cli/capability-cli.test.ts +++ b/src/cli/capability-cli.test.ts @@ -97,13 +97,6 @@ const mocks = vi.hoisted(() => ({ : {}), }), ), - resolveCommandSecretRefsViaGateway: vi.fn(async ({ config }: { config: unknown }) => ({ - resolvedConfig: config, - diagnostics: [], - targetStatesByPath: {}, - hadUnresolvedTargets: false, - })), - getTtsCommandSecretTargetIds: vi.fn(() => new Set(["messages.tts.providers.*.apiKey"])), createEmbeddingProvider: vi.fn(async () => ({ provider: { id: "openai", @@ -195,14 +188,6 @@ vi.mock("../gateway/connection-details.js", () => ({ })), })); -vi.mock("./command-secret-gateway.js", () => ({ - resolveCommandSecretRefsViaGateway: mocks.resolveCommandSecretRefsViaGateway, -})); - -vi.mock("./command-secret-targets.js", () => ({ - getTtsCommandSecretTargetIds: mocks.getTtsCommandSecretTargetIds, -})); - vi.mock("../media-understanding/runtime.js", () => ({ describeImageFile: mocks.describeImageFile as typeof import("../media-understanding/runtime.js").describeImageFile, @@ -326,15 +311,6 @@ describe("capability cli", () => { mocks.generateVideo.mockReset(); mocks.transcribeAudioFile.mockClear(); mocks.textToSpeech.mockClear(); - mocks.resolveCommandSecretRefsViaGateway - .mockReset() - .mockImplementation(async ({ config }: { config: unknown }) => ({ - resolvedConfig: config, - diagnostics: [], - targetStatesByPath: {}, - hadUnresolvedTargets: false, - })); - mocks.getTtsCommandSecretTargetIds.mockClear(); mocks.setTtsProvider.mockClear(); mocks.resolveExplicitTtsOverrides.mockClear(); mocks.buildMediaUnderstandingRegistry.mockReset().mockReturnValue(new Map()); @@ -1081,58 +1057,6 @@ describe("capability cli", () => { expect(mocks.setTtsProvider).not.toHaveBeenCalled(); }); - it("resolves static TTS SecretRefs before local conversion", async () => { - const sourceConfig = { - messages: { - tts: { - providers: { - minimax: { - apiKey: { source: "exec", provider: "mockexec", id: "minimax/tts/apiKey" }, - }, - }, - }, - }, - }; - const resolvedConfig = { - messages: { - tts: { - providers: { - minimax: { - apiKey: "resolved-minimax-key", - }, - }, - }, - }, - }; - mocks.loadConfig.mockReturnValueOnce(sourceConfig); - mocks.resolveCommandSecretRefsViaGateway.mockResolvedValueOnce({ - resolvedConfig, - diagnostics: [], - targetStatesByPath: { - "messages.tts.providers.minimax.apiKey": "resolved_local", - }, - hadUnresolvedTargets: false, - }); - - await runRegisteredCli({ - register: registerCapabilityCli as (program: Command) => void, - argv: ["capability", "tts", "convert", "--text", "hello", "--json"], - }); - - expect(mocks.resolveCommandSecretRefsViaGateway).toHaveBeenCalledWith({ - config: sourceConfig, - commandName: "infer tts convert", - targetIds: new Set(["messages.tts.providers.*.apiKey"]), - mode: "enforce_resolved", - }); - expect(mocks.resolveExplicitTtsOverrides).toHaveBeenCalledWith( - expect.objectContaining({ cfg: resolvedConfig }), - ); - expect(mocks.textToSpeech).toHaveBeenCalledWith( - expect.objectContaining({ cfg: resolvedConfig }), - ); - }); - it("disables TTS fallback when explicit provider or voice/model selection is requested", async () => { await runRegisteredCli({ register: registerCapabilityCli as (program: Command) => void, diff --git a/src/cli/capability-cli.ts b/src/cli/capability-cli.ts index 4c12e1cf385..a5ba86618b7 100644 --- a/src/cli/capability-cli.ts +++ b/src/cli/capability-cli.ts @@ -79,8 +79,6 @@ import { runWebSearch, } from "../web-search/runtime.js"; import { runCommandWithRuntime } from "./cli-utils.js"; -import { resolveCommandSecretRefsViaGateway } from "./command-secret-gateway.js"; -import { getTtsCommandSecretTargetIds } from "./command-secret-targets.js"; import { createDefaultDeps } from "./deps.js"; import { removeCommandByName } from "./program/command-tree.js"; import { collectOption } from "./program/helpers.js"; @@ -1113,12 +1111,7 @@ async function runTtsConvert(params: { } satisfies CapabilityEnvelope; } - const { resolvedConfig: cfg } = await resolveCommandSecretRefsViaGateway({ - config: loadConfig(), - commandName: "infer tts convert", - targetIds: getTtsCommandSecretTargetIds(), - mode: "enforce_resolved", - }); + const cfg = loadConfig(); const overrides = resolveExplicitTtsOverrides({ cfg, provider: params.provider, diff --git a/src/cli/command-secret-resolution.coverage.test.ts b/src/cli/command-secret-resolution.coverage.test.ts index 3dd9e440675..9da2c0f322b 100644 --- a/src/cli/command-secret-resolution.coverage.test.ts +++ b/src/cli/command-secret-resolution.coverage.test.ts @@ -4,7 +4,6 @@ import { readCommandSource } from "./command-source.test-helpers.js"; const SECRET_TARGET_CALLSITES = [ bundledPluginFile("memory-core", "src/cli.runtime.ts"), - "src/cli/capability-cli.ts", "src/cli/qr-cli.ts", "src/agents/agent-runtime-config.ts", "src/commands/agent.ts", diff --git a/src/cli/command-secret-targets.test.ts b/src/cli/command-secret-targets.test.ts index 8515a295536..cabf3028da7 100644 --- a/src/cli/command-secret-targets.test.ts +++ b/src/cli/command-secret-targets.test.ts @@ -58,7 +58,6 @@ import { getQrRemoteCommandSecretTargetIds, getScopedChannelsCommandSecretTargets, getSecurityAuditCommandSecretTargetIds, - getTtsCommandSecretTargetIds, } from "./command-secret-targets.js"; describe("command secret target ids", () => { @@ -74,11 +73,6 @@ describe("command secret target ids", () => { expect(ids.has("channels.discord.token")).toBe(false); }); - it("keeps static TTS targets out of the registry path", () => { - const ids = getTtsCommandSecretTargetIds(); - expect(ids).toEqual(new Set(["messages.tts.providers.*.apiKey"])); - }); - it("includes memorySearch remote targets for agent runtime commands", () => { const ids = getAgentRuntimeCommandSecretTargetIds(); expect(ids.has("agents.defaults.memorySearch.remote.apiKey")).toBe(true); diff --git a/src/cli/command-secret-targets.ts b/src/cli/command-secret-targets.ts index 1309d290d10..9bbed1c5707 100644 --- a/src/cli/command-secret-targets.ts +++ b/src/cli/command-secret-targets.ts @@ -23,13 +23,12 @@ const STATIC_MODEL_TARGET_IDS = [ "models.providers.*.request.tls.key", "models.providers.*.request.tls.passphrase", ] as const; -const STATIC_TTS_TARGET_IDS = ["messages.tts.providers.*.apiKey"] as const; const STATIC_AGENT_RUNTIME_BASE_TARGET_IDS = [ ...STATIC_MODEL_TARGET_IDS, "agents.defaults.memorySearch.remote.apiKey", "agents.list[].memorySearch.remote.apiKey", "agents.list[].tts.providers.*.apiKey", - ...STATIC_TTS_TARGET_IDS, + "messages.tts.providers.*.apiKey", "skills.entries.*.apiKey", "tools.web.search.apiKey", ] as const; @@ -222,10 +221,6 @@ export function getModelsCommandSecretTargetIds(): Set { return toTargetIdSet(STATIC_MODEL_TARGET_IDS); } -export function getTtsCommandSecretTargetIds(): Set { - return toTargetIdSet(STATIC_TTS_TARGET_IDS); -} - export function getAgentRuntimeCommandSecretTargetIds(params?: { includeChannelTargets?: boolean; }): Set { From 18b76e399579a9fc3794beb0c64d166a7256a975 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 04:54:57 +0100 Subject: [PATCH 221/418] fix(ollama): scope request timeouts to providers --- CHANGELOG.md | 1 + docs/.generated/config-baseline.sha256 | 4 +- docs/concepts/agent-loop.md | 1 + docs/gateway/config-tools.md | 1 + docs/providers/ollama.md | 63 +++++++++++++++++++ extensions/ollama/ollama.live.test.ts | 5 +- extensions/ollama/src/stream-runtime.test.ts | 20 ++++++ extensions/ollama/src/stream.ts | 13 ++++ .../model.inline-provider.ts | 1 + src/agents/pi-embedded-runner/model.test.ts | 29 +++++++++ src/agents/pi-embedded-runner/model.ts | 20 ++++++ src/agents/provider-transport-fetch.test.ts | 20 ++++++ src/agents/provider-transport-fetch.ts | 16 ++++- src/config/schema.base.generated.ts | 13 ++++ src/config/schema.help.ts | 2 + src/config/schema.labels.ts | 1 + src/config/types.models.ts | 1 + src/config/zod-schema.core.ts | 1 + src/infra/net/ssrf.dispatcher.test.ts | 4 ++ src/infra/net/undici-runtime.ts | 16 ++++- src/plugins/provider-runtime-model.types.ts | 1 + 21 files changed, 227 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1e1036a39fe..0eb0f60ee60 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -45,6 +45,7 @@ Docs: https://docs.openclaw.ai - Providers/Ollama: accept OpenAI SDK-style `baseURL` as an alias for `baseUrl` across discovery, streaming, setup pulls, embeddings, and web search so remote Ollama hosts are not silently ignored. Fixes #62533; supersedes #62549. Thanks @Julien-BKK and @Linux2010. - Providers/Ollama: scope synthetic local auth and embedding bearer headers to declared Ollama host boundaries so cloud keys are not sent to local/self-hosted embedding endpoints and remote/cloud Ollama endpoints no longer receive the `ollama-local` marker as if it were a real token. Supersedes #69261 and #69857; refs #43945. Thanks @hyspacex, @maxramsay, and @Meli73. - Providers/Ollama: resolve custom-named local Ollama providers such as `ollama-remote` through the Ollama synthetic-auth hook so subagents no longer miss `ollama-local` auth and silently fall back to cloud models. Fixes #43945. Thanks @Meli73 and @maxramsay. +- Providers/Ollama: add provider-scoped model request timeouts, thread them through guarded fetch connect/header/body/abort handling, and document `params.keep_alive` for cold local models so first-turn Ollama loads no longer require global agent timeout changes. Fixes #64541 and #68796; supersedes #65143 and #66511. Thanks @LittleJakub, @Juankcba, @uninhibite-scholar, and @yfge. - Providers/PDF/Ollama: add bounded network timeouts for Ollama model pulls and native Anthropic/Gemini PDF analysis requests so unresponsive provider endpoints no longer hang sessions indefinitely. Fixes #54142; supersedes #54144 and #54145. Thanks @jinduwang1001-max and @arkyu2077. - Memory/doctor: treat Ollama memory embeddings as key-optional so `openclaw doctor` no longer warns about a missing API key when the gateway reports embeddings are ready. Fixes #46584. Thanks @fengly78. - Agents/Ollama: apply provider-owned replay turn normalization to native Ollama chat so Cloud models no longer reject non-alternating replay history in agent/Gateway runs. Fixes #71697. Thanks @ismael-81. diff --git a/docs/.generated/config-baseline.sha256 b/docs/.generated/config-baseline.sha256 index 15ec791ff4e..45b535a755c 100644 --- a/docs/.generated/config-baseline.sha256 +++ b/docs/.generated/config-baseline.sha256 @@ -1,4 +1,4 @@ -0c3eaaee031f0adec2fcfc8a3a6a0d80dfc19d4d1c10b0ff4249b30e04b3c47d config-baseline.json -420269ce22f17382cb253c80a232329e943296be101cda313506341ae39cc674 config-baseline.core.json +6fceeca87ecf3245c9f3a184f1ec66c8dee8df6e5a14c6d9d1924557f8d36408 config-baseline.json +15b6223907d0930307e950752e6498edc40f7df597e8e36914490f7611eab413 config-baseline.core.json 07963db49502132f26db396c56b36e018b110e6c55a68b3cb012d3ec96f43901 config-baseline.channel.json 74b74cb18ac37c0acaa765f398f1f9edbcee4c43567f02d45c89598a1e13afb4 config-baseline.plugin.json diff --git a/docs/concepts/agent-loop.md b/docs/concepts/agent-loop.md index 6f9c5f57afc..9916974f26a 100644 --- a/docs/concepts/agent-loop.md +++ b/docs/concepts/agent-loop.md @@ -163,6 +163,7 @@ surfaces, while Codex native hooks remain a separate lower-level Codex mechanism - `agent.wait` default: 30s (just the wait). `timeoutMs` param overrides. - Agent runtime: `agents.defaults.timeoutSeconds` default 172800s (48 hours); enforced in `runEmbeddedPiAgent` abort timer. - LLM idle timeout: `agents.defaults.llm.idleTimeoutSeconds` aborts a model request when no response chunks arrive before the idle window. Set it explicitly for slow local models or reasoning/tool-call providers; set it to 0 to disable. If it is not set, OpenClaw uses `agents.defaults.timeoutSeconds` when configured, otherwise 120s. Cron-triggered runs with no explicit LLM or agent timeout disable the idle watchdog and rely on the cron outer timeout. +- Provider HTTP request timeout: `models.providers..timeoutSeconds` applies only to that provider's model HTTP fetches, including connect, headers, body, and total guarded-fetch abort handling. Use this for slow local/self-hosted providers such as Ollama before raising the whole agent runtime timeout. ## Where things can end early diff --git a/docs/gateway/config-tools.md b/docs/gateway/config-tools.md index 1a3b2e55b07..8fd0c269a66 100644 --- a/docs/gateway/config-tools.md +++ b/docs/gateway/config-tools.md @@ -429,6 +429,7 @@ OpenClaw uses the built-in model catalog. Add custom providers via `models.provi - `models.providers.*.api`: request adapter (`openai-completions`, `openai-responses`, `anthropic-messages`, `google-generative-ai`, etc). - `models.providers.*.apiKey`: provider credential (prefer SecretRef/env substitution). - `models.providers.*.auth`: auth strategy (`api-key`, `token`, `oauth`, `aws-sdk`). + - `models.providers.*.timeoutSeconds`: optional per-provider model HTTP request timeout in seconds, including connect, headers, body, and total request abort handling. - `models.providers.*.injectNumCtxForOpenAICompat`: for Ollama + `openai-completions`, inject `options.num_ctx` into requests (default: `true`). - `models.providers.*.authHeader`: force credential transport in the `Authorization` header when required. - `models.providers.*.baseUrl`: upstream API base URL. diff --git a/docs/providers/ollama.md b/docs/providers/ollama.md index cb88cfc2ffd..86462d99a60 100644 --- a/docs/providers/ollama.md +++ b/docs/providers/ollama.md @@ -296,6 +296,16 @@ OpenClaw rejects image-description requests for models that are not marked image apiKey: "ollama-local", baseUrl: "http://ollama-host:11434", // No /v1 - use native Ollama API URL api: "ollama", // Set explicitly to guarantee native tool-calling behavior + timeoutSeconds: 300, // Optional: give cold local models longer to connect and stream + models: [ + { + id: "qwen3:32b", + name: "qwen3:32b", + params: { + keep_alive: "15m", // Optional: keep the model loaded between turns + }, + }, + ], }, }, }, @@ -330,6 +340,33 @@ Custom Ollama provider ids are also supported. When a model ref uses the active provider prefix, such as `ollama-spark/qwen3:32b`, OpenClaw strips only that prefix before calling Ollama so the server receives `qwen3:32b`. +For slow local models, prefer provider-scoped request tuning before raising the +whole agent runtime timeout: + +```json5 +{ + models: { + providers: { + ollama: { + timeoutSeconds: 300, + models: [ + { + id: "gemma4:26b", + name: "gemma4:26b", + params: { keep_alive: "15m" }, + }, + ], + }, + }, + }, +} +``` + +`timeoutSeconds` applies to the model HTTP request, including connection setup, +headers, body streaming, and the total guarded-fetch abort. `params.keep_alive` +is forwarded to Ollama as top-level `keep_alive` on native `/api/chat` requests; +set it per model when first-turn load time is the bottleneck. + ## Ollama Web Search OpenClaw supports **Ollama Web Search** as a bundled `web_search` provider. @@ -535,6 +572,32 @@ For the full setup and behavior details, see [Ollama Web Search](/tools/ollama-s ``` + + + Large local models can need a long first load before streaming begins. Keep the timeout scoped to the Ollama provider, and optionally ask Ollama to keep the model loaded between turns: + + ```json5 + { + models: { + providers: { + ollama: { + timeoutSeconds: 300, + models: [ + { + id: "gemma4:26b", + name: "gemma4:26b", + params: { keep_alive: "15m" }, + }, + ], + }, + }, + }, + } + ``` + + If the host itself is slow to accept connections, `timeoutSeconds` also extends the guarded Undici connect timeout for this provider. + + diff --git a/extensions/ollama/ollama.live.test.ts b/extensions/ollama/ollama.live.test.ts index b4fb48a1b1e..fa955b85431 100644 --- a/extensions/ollama/ollama.live.test.ts +++ b/extensions/ollama/ollama.live.test.ts @@ -27,6 +27,7 @@ describe.skipIf(!LIVE)("ollama live", () => { | { model?: string; think?: boolean; + keep_alive?: string; options?: { num_ctx?: number; top_p?: number }; tools?: Array<{ function?: { @@ -44,7 +45,8 @@ describe.skipIf(!LIVE)("ollama live", () => { api: "ollama", provider: PROVIDER_ID, contextWindow: 8192, - params: { num_ctx: 4096, top_p: 0.9, thinking: false }, + params: { num_ctx: 4096, top_p: 0.9, thinking: false, keep_alive: "5m" }, + requestTimeoutMs: 120_000, } as never, { messages: [{ role: "user", content: "Reply exactly OK." }], @@ -85,6 +87,7 @@ describe.skipIf(!LIVE)("ollama live", () => { expect(payload?.options?.num_ctx).toBe(4096); expect(payload?.options?.top_p).toBe(0.9); expect(payload?.think).toBe(false); + expect(payload?.keep_alive).toBe("5m"); const properties = payload?.tools?.[0]?.function?.parameters?.properties; expect(properties?.city?.type).toBe("string"); expect(properties?.units?.type).toBe("string"); diff --git a/extensions/ollama/src/stream-runtime.test.ts b/extensions/ollama/src/stream-runtime.test.ts index 4fc712f26bd..1845a3b0047 100644 --- a/extensions/ollama/src/stream-runtime.test.ts +++ b/extensions/ollama/src/stream-runtime.test.ts @@ -23,6 +23,7 @@ type GuardedFetchCall = { url: string; init?: RequestInit; policy?: unknown; + timeoutMs?: number; auditContext?: string; }; @@ -264,6 +265,25 @@ describe("createConfiguredOllamaCompatStreamWrapper", () => { ); }); + it("passes resolved provider request timeouts to native Ollama chat fetches", async () => { + await withMockNdjsonFetch( + [ + '{"model":"m","created_at":"t","message":{"role":"assistant","content":"ok"},"done":false}', + '{"model":"m","created_at":"t","message":{"role":"assistant","content":""},"done":true,"prompt_eval_count":1,"eval_count":1}', + ], + async (fetchMock) => { + const stream = await createOllamaTestStream({ + baseUrl: "http://ollama-host:11434", + model: { requestTimeoutMs: 450_000 }, + }); + + await collectStreamEvents(stream); + + expect(getGuardedFetchCall(fetchMock).timeoutMs).toBe(450_000); + }, + ); + }); + it("maps native Ollama max thinking to think=high on the wire", async () => { await withMockNdjsonFetch( [ diff --git a/extensions/ollama/src/stream.ts b/extensions/ollama/src/stream.ts index aeac03084c5..d9461be70d9 100644 --- a/extensions/ollama/src/stream.ts +++ b/extensions/ollama/src/stream.ts @@ -817,6 +817,15 @@ function resolveOllamaModelHeaders(model: { return model.headers as Record; } +function resolveOllamaRequestTimeoutMs( + model: object, + options: { requestTimeoutMs?: unknown } | undefined, +): number | undefined { + const raw = + options?.requestTimeoutMs ?? (model as { requestTimeoutMs?: unknown }).requestTimeoutMs; + return typeof raw === "number" && Number.isFinite(raw) && raw > 0 ? Math.floor(raw) : undefined; +} + export function createOllamaStreamFn( baseUrl: string, defaultHeaders?: Record, @@ -874,6 +883,10 @@ export function createOllamaStreamFn( signal: options?.signal, }, policy: ssrfPolicy, + timeoutMs: resolveOllamaRequestTimeoutMs( + model, + options as { requestTimeoutMs?: unknown } | undefined, + ), auditContext: "ollama-stream.chat", }); diff --git a/src/agents/pi-embedded-runner/model.inline-provider.ts b/src/agents/pi-embedded-runner/model.inline-provider.ts index 27cd295c7fb..511fd35dd7e 100644 --- a/src/agents/pi-embedded-runner/model.inline-provider.ts +++ b/src/agents/pi-embedded-runner/model.inline-provider.ts @@ -22,6 +22,7 @@ export type InlineProviderConfig = { models?: ModelDefinitionConfig[]; headers?: unknown; authHeader?: boolean; + timeoutSeconds?: ModelProviderConfig["timeoutSeconds"]; request?: ModelProviderConfig["request"]; }; diff --git a/src/agents/pi-embedded-runner/model.test.ts b/src/agents/pi-embedded-runner/model.test.ts index a3b2839a44b..9f4436f4c74 100644 --- a/src/agents/pi-embedded-runner/model.test.ts +++ b/src/agents/pi-embedded-runner/model.test.ts @@ -414,6 +414,35 @@ describe("resolveModel", () => { }); }); + it("resolves provider request timeout metadata for configured provider models", () => { + mockDiscoveredModel(discoverModels, { + provider: "ollama", + modelId: "qwen3:32b", + templateModel: { + ...makeModel("qwen3:32b"), + provider: "ollama", + }, + }); + const cfg = { + models: { + providers: { + ollama: { + baseUrl: "http://localhost:11434", + timeoutSeconds: 300, + models: [makeModel("qwen3:32b")], + }, + }, + }, + } as unknown as OpenClawConfig; + + const result = resolveModelForTest("ollama", "qwen3:32b", "/tmp/agent", cfg); + + expect(result.error).toBeUndefined(); + expect((result.model as { requestTimeoutMs?: number } | undefined)?.requestTimeoutMs).toBe( + 300_000, + ); + }); + it("applies agent default model params without explicit provider config", () => { mockDiscoveredModel(discoverModels, { provider: "ollama", diff --git a/src/agents/pi-embedded-runner/model.ts b/src/agents/pi-embedded-runner/model.ts index 2586218bce4..bf290fe95bc 100644 --- a/src/agents/pi-embedded-runner/model.ts +++ b/src/agents/pi-embedded-runner/model.ts @@ -260,6 +260,17 @@ function resolveProviderTransport(params: { }; } +function resolveProviderRequestTimeoutMs(timeoutSeconds: unknown): number | undefined { + if ( + typeof timeoutSeconds !== "number" || + !Number.isFinite(timeoutSeconds) || + timeoutSeconds <= 0 + ) { + return undefined; + } + return Math.floor(timeoutSeconds) * 1000; +} + function matchesProviderScopedModelId(params: { candidateId?: string; provider: string; @@ -430,6 +441,7 @@ function applyConfiguredProviderOverrides(params: { preferDiscoveredModelMetadata?: boolean; }): ProviderRuntimeModel { const { discoveredModel, providerConfig, modelId } = params; + const requestTimeoutMs = resolveProviderRequestTimeoutMs(providerConfig?.timeoutSeconds); const defaultModelParams = findConfiguredAgentModelParams({ cfg: params.cfg, provider: params.provider, @@ -471,6 +483,7 @@ function applyConfiguredProviderOverrides(params: { !configuredModel && !providerConfig.baseUrl && !providerConfig.api && + requestTimeoutMs === undefined && !providerHeaders && !providerRequest ) { @@ -481,6 +494,7 @@ function applyConfiguredProviderOverrides(params: { return { ...discoveredModel, ...(resolvedParams ? { params: resolvedParams } : {}), + ...(requestTimeoutMs !== undefined ? { requestTimeoutMs } : {}), headers: discoveredHeaders, }; } @@ -531,6 +545,7 @@ function applyConfiguredProviderOverrides(params: { contextTokens: metadataOverrideModel?.contextTokens ?? discoveredModel.contextTokens, maxTokens: metadataOverrideModel?.maxTokens ?? discoveredModel.maxTokens, ...(resolvedParams ? { params: resolvedParams } : {}), + ...(requestTimeoutMs !== undefined ? { requestTimeoutMs } : {}), headers: requestConfig.headers, compat: metadataOverrideModel?.compat ?? discoveredModel.compat, }, @@ -547,6 +562,7 @@ function resolveExplicitModelWithRegistry(params: { }): { kind: "resolved"; model: Model } | { kind: "suppressed" } | undefined { const { provider, modelId, modelRegistry, cfg, agentDir, runtimeHooks } = params; const providerConfig = resolveConfiguredProviderConfig(cfg, provider); + const requestTimeoutMs = resolveProviderRequestTimeoutMs(providerConfig?.timeoutSeconds); if ( shouldSuppressBuiltInModel({ provider, @@ -578,6 +594,7 @@ function resolveExplicitModelWithRegistry(params: { model: { ...inlineMatch, ...(resolvedParams ? { params: resolvedParams } : {}), + ...(requestTimeoutMs !== undefined ? { requestTimeoutMs } : {}), } as Model, runtimeHooks, }), @@ -627,6 +644,7 @@ function resolveExplicitModelWithRegistry(params: { model: { ...fallbackInlineMatch, ...(resolvedParams ? { params: resolvedParams } : {}), + ...(requestTimeoutMs !== undefined ? { requestTimeoutMs } : {}), } as Model, runtimeHooks, }), @@ -699,6 +717,7 @@ function resolveConfiguredFallbackModel(params: { }): Model | undefined { const { provider, modelId, cfg, agentDir, runtimeHooks } = params; const providerConfig = resolveConfiguredProviderConfig(cfg, provider); + const requestTimeoutMs = resolveProviderRequestTimeoutMs(providerConfig?.timeoutSeconds); const configuredModel = findConfiguredProviderModel(providerConfig, provider, modelId); const providerHeaders = sanitizeModelHeaders(providerConfig?.headers, { stripSecretRefMarkers: true, @@ -763,6 +782,7 @@ function resolveConfiguredFallbackModel(params: { providerConfig?.models?.[0]?.maxTokens ?? DEFAULT_CONTEXT_TOKENS, ...(resolvedParams ? { params: resolvedParams } : {}), + ...(requestTimeoutMs !== undefined ? { requestTimeoutMs } : {}), headers: requestConfig.headers, } as Model, providerRequest, diff --git a/src/agents/provider-transport-fetch.test.ts b/src/agents/provider-transport-fetch.test.ts index 7ed262e0647..c60e6529887 100644 --- a/src/agents/provider-transport-fetch.test.ts +++ b/src/agents/provider-transport-fetch.test.ts @@ -94,6 +94,26 @@ describe("buildGuardedModelFetch", () => { ); }); + it("threads resolved provider timeout metadata into the shared guarded fetch seam", async () => { + const { buildGuardedModelFetch } = await import("./provider-transport-fetch.js"); + const model = { + id: "qwen3:32b", + provider: "ollama", + api: "ollama", + baseUrl: "http://127.0.0.1:11434", + requestTimeoutMs: 300_000, + } as unknown as Model<"ollama">; + + const fetcher = buildGuardedModelFetch(model); + await fetcher("http://127.0.0.1:11434/api/chat", { method: "POST" }); + + expect(fetchWithSsrFGuardMock).toHaveBeenCalledWith( + expect.objectContaining({ + timeoutMs: 300_000, + }), + ); + }); + it("does not force explicit debug proxy overrides onto plain HTTP model transports", async () => { process.env.OPENCLAW_DEBUG_PROXY_ENABLED = "1"; process.env.OPENCLAW_DEBUG_PROXY_URL = "http://127.0.0.1:7799"; diff --git a/src/agents/provider-transport-fetch.ts b/src/agents/provider-transport-fetch.ts index dadc4308242..434c6411b6e 100644 --- a/src/agents/provider-transport-fetch.ts +++ b/src/agents/provider-transport-fetch.ts @@ -154,9 +154,23 @@ function resolveModelRequestPolicy(model: Model) { }); } +function resolveModelRequestTimeoutMs( + model: Model, + timeoutMs: number | undefined, +): number | undefined { + if (timeoutMs !== undefined) { + return timeoutMs; + } + const modelTimeoutMs = (model as { requestTimeoutMs?: unknown }).requestTimeoutMs; + return typeof modelTimeoutMs === "number" && Number.isFinite(modelTimeoutMs) && modelTimeoutMs > 0 + ? Math.floor(modelTimeoutMs) + : undefined; +} + export function buildGuardedModelFetch(model: Model, timeoutMs?: number): typeof fetch { const requestConfig = resolveModelRequestPolicy(model); const dispatcherPolicy = buildProviderRequestDispatcherPolicy(requestConfig); + const requestTimeoutMs = resolveModelRequestTimeoutMs(model, timeoutMs); return async (input, init) => { const request = input instanceof Request ? new Request(input, init) : undefined; const url = @@ -189,7 +203,7 @@ export function buildGuardedModelFetch(model: Model, timeoutMs?: number): t }, }, dispatcherPolicy, - timeoutMs, + timeoutMs: requestTimeoutMs, // Provider transport intentionally keeps the secure default and never // replays unsafe request bodies across cross-origin redirects. allowCrossOriginUnsafeRedirectReplay: false, diff --git a/src/config/schema.base.generated.ts b/src/config/schema.base.generated.ts index 4addd3d5ba8..227955b3ed2 100644 --- a/src/config/schema.base.generated.ts +++ b/src/config/schema.base.generated.ts @@ -1554,6 +1554,14 @@ export const GENERATED_BASE_CONFIG_SCHEMA: BaseConfigSchemaResponse = { description: "Provider API adapter selection controlling request/response compatibility handling for model calls. Use the adapter that matches your upstream provider protocol to avoid feature mismatch.", }, + timeoutSeconds: { + type: "integer", + exclusiveMinimum: 0, + maximum: 9007199254740991, + title: "Model Provider Request Timeout", + description: + "Optional per-provider model request timeout in seconds. Applies to provider HTTP fetches, including connect, headers, body, and total request abort handling. Use this for slow local or self-hosted model servers instead of changing global agent timeouts.", + }, injectNumCtxForOpenAICompat: { type: "boolean", title: "Model Provider Inject num_ctx (OpenAI Compat)", @@ -26477,6 +26485,11 @@ export const GENERATED_BASE_CONFIG_SCHEMA: BaseConfigSchemaResponse = { help: "Provider API adapter selection controlling request/response compatibility handling for model calls. Use the adapter that matches your upstream provider protocol to avoid feature mismatch.", tags: ["models"], }, + "models.providers.*.timeoutSeconds": { + label: "Model Provider Request Timeout", + help: "Optional per-provider model request timeout in seconds. Applies to provider HTTP fetches, including connect, headers, body, and total request abort handling. Use this for slow local or self-hosted model servers instead of changing global agent timeouts.", + tags: ["performance", "models"], + }, "models.providers.*.injectNumCtxForOpenAICompat": { label: "Model Provider Inject num_ctx (OpenAI Compat)", help: "Controls whether OpenClaw injects `options.num_ctx` for Ollama providers configured with the OpenAI-compatible adapter (`openai-completions`). Default is true. Set false only if your proxy/upstream rejects unknown `options` payload fields.", diff --git a/src/config/schema.help.ts b/src/config/schema.help.ts index c4e873858ba..c02d9c65830 100644 --- a/src/config/schema.help.ts +++ b/src/config/schema.help.ts @@ -826,6 +826,8 @@ export const FIELD_HELP: Record = { 'Selects provider auth style: "api-key" for API key auth, "token" for bearer token auth, "oauth" for OAuth credentials, and "aws-sdk" for AWS credential resolution. Match this to your provider requirements.', "models.providers.*.api": "Provider API adapter selection controlling request/response compatibility handling for model calls. Use the adapter that matches your upstream provider protocol to avoid feature mismatch.", + "models.providers.*.timeoutSeconds": + "Optional per-provider model request timeout in seconds. Applies to provider HTTP fetches, including connect, headers, body, and total request abort handling. Use this for slow local or self-hosted model servers instead of changing global agent timeouts.", "models.providers.*.injectNumCtxForOpenAICompat": "Controls whether OpenClaw injects `options.num_ctx` for Ollama providers configured with the OpenAI-compatible adapter (`openai-completions`). Default is true. Set false only if your proxy/upstream rejects unknown `options` payload fields.", "models.providers.*.headers": diff --git a/src/config/schema.labels.ts b/src/config/schema.labels.ts index 8806ed461c6..d794df3f008 100644 --- a/src/config/schema.labels.ts +++ b/src/config/schema.labels.ts @@ -515,6 +515,7 @@ export const FIELD_LABELS: Record = { "models.providers.*.apiKey": "Model Provider API Key", // pragma: allowlist secret "models.providers.*.auth": "Model Provider Auth Mode", "models.providers.*.api": "Model Provider API Adapter", + "models.providers.*.timeoutSeconds": "Model Provider Request Timeout", "models.providers.*.injectNumCtxForOpenAICompat": "Model Provider Inject num_ctx (OpenAI Compat)", "models.providers.*.headers": "Model Provider Headers", "models.providers.*.authHeader": "Model Provider Authorization Header", diff --git a/src/config/types.models.ts b/src/config/types.models.ts index 07ee3da6662..fed8fcc258c 100644 --- a/src/config/types.models.ts +++ b/src/config/types.models.ts @@ -119,6 +119,7 @@ export type ModelProviderConfig = { apiKey?: SecretInput; auth?: ModelProviderAuthMode; api?: ModelApi; + timeoutSeconds?: number; injectNumCtxForOpenAICompat?: boolean; headers?: Record; authHeader?: boolean; diff --git a/src/config/zod-schema.core.ts b/src/config/zod-schema.core.ts index d8b49977df9..c2a018c86f8 100644 --- a/src/config/zod-schema.core.ts +++ b/src/config/zod-schema.core.ts @@ -357,6 +357,7 @@ export const ModelProviderSchema = z .union([z.literal("api-key"), z.literal("aws-sdk"), z.literal("oauth"), z.literal("token")]) .optional(), api: ModelApiSchema.optional(), + timeoutSeconds: z.number().int().positive().optional(), injectNumCtxForOpenAICompat: z.boolean().optional(), headers: z.record(z.string(), SecretInputSchema.register(sensitive)).optional(), authHeader: z.boolean().optional(), diff --git a/src/infra/net/ssrf.dispatcher.test.ts b/src/infra/net/ssrf.dispatcher.test.ts index 5a2b4825493..586fed39105 100644 --- a/src/infra/net/ssrf.dispatcher.test.ts +++ b/src/infra/net/ssrf.dispatcher.test.ts @@ -126,6 +126,7 @@ describe("createPinnedDispatcher", () => { expect(agentCtor).toHaveBeenCalledWith({ connect: { lookup, + timeout: 123_456, }, allowH2: false, bodyTimeout: 123_456, @@ -265,6 +266,9 @@ describe("createPinnedDispatcher", () => { autoSelectFamily: false, lookup, }, + connect: { + timeout: 654_321, + }, allowH2: false, bodyTimeout: 654_321, headersTimeout: 654_321, diff --git a/src/infra/net/undici-runtime.ts b/src/infra/net/undici-runtime.ts index c6e7c23b0b6..d08d05a09e7 100644 --- a/src/infra/net/undici-runtime.ts +++ b/src/infra/net/undici-runtime.ts @@ -23,6 +23,10 @@ const HTTP1_ONLY_DISPATCHER_OPTIONS = Object.freeze({ allowH2: false as const, }); +function isObjectRecord(value: unknown): value is Record { + return Boolean(value && typeof value === "object" && !Array.isArray(value)); +} + function isUndiciRuntimeDeps(value: unknown): value is UndiciRuntimeDeps { return ( typeof value === "object" && @@ -62,8 +66,16 @@ function withHttp1OnlyDispatcherOptions( // Enforce HTTP/1.1-only — must come after options to prevent accidental override Object.assign(base, HTTP1_ONLY_DISPATCHER_OPTIONS); if (timeoutMs !== undefined && Number.isFinite(timeoutMs) && timeoutMs > 0) { - (base as Record).bodyTimeout = timeoutMs; - (base as Record).headersTimeout = timeoutMs; + const normalizedTimeoutMs = Math.floor(timeoutMs); + const baseRecord = base as Record; + baseRecord.bodyTimeout = normalizedTimeoutMs; + baseRecord.headersTimeout = normalizedTimeoutMs; + if (typeof baseRecord.connect !== "function") { + baseRecord.connect = { + ...(isObjectRecord(baseRecord.connect) ? baseRecord.connect : {}), + timeout: normalizedTimeoutMs, + }; + } } return base; } diff --git a/src/plugins/provider-runtime-model.types.ts b/src/plugins/provider-runtime-model.types.ts index 7c07fbc4d04..c961ad34591 100644 --- a/src/plugins/provider-runtime-model.types.ts +++ b/src/plugins/provider-runtime-model.types.ts @@ -7,4 +7,5 @@ import type { Api, Model } from "@mariozechner/pi-ai"; export type ProviderRuntimeModel = Model & { contextTokens?: number; params?: Record; + requestTimeoutMs?: number; }; From 461c10bb512ca4f94f6af0b68a8f660419e988b5 Mon Sep 17 00:00:00 2001 From: Val Alexander <68980965+BunsDev@users.noreply.github.com> Date: Sun, 26 Apr 2026 22:56:20 -0500 Subject: [PATCH 222/418] feat(onboard): support non-interactive GitHub Copilot token auth Add manifest-owned GitHub Copilot token support for non-interactive onboarding, including documented env fallback, ref-mode tokenRef storage, saved-profile reuse, and default model wiring that preserves existing primary model configuration. Validation: - pnpm test extensions/github-copilot/index.test.ts src/plugins/contracts/registry.contract.test.ts src/commands/onboard-non-interactive/local/auth-choice-inference.test.ts - pnpm check:changed - CI green on aadac2c8d462d881ee848eba7e05550aaf806b75 --- CHANGELOG.md | 1 + docs/providers/github-copilot.md | 24 +- extensions/github-copilot/index.test.ts | 252 +++++++++++++++++- extensions/github-copilot/index.ts | 204 +++++++++++++- .../github-copilot/openclaw.plugin.json | 6 +- .../contracts/registry.contract.test.ts | 20 ++ 6 files changed, 498 insertions(+), 9 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0eb0f60ee60..278d0cd2d05 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,6 +13,7 @@ Docs: https://docs.openclaw.ai - Matrix/E2EE: stabilize recovery and broken-device QA flows while avoiding Matrix device-cleanup sync races that could leave shutdown-time crypto work running. Thanks @gumadeiras. - Cron: classify isolated runs as errors from structured embedded-run execution-denial metadata, with final-output marker fallback for `SYSTEM_RUN_DENIED`, `INVALID_REQUEST`, and approval-binding refusals, so blocked commands no longer appear green in cron history. Fixes #67172; carries forward #67186. Thanks @oc-gh-dr, @hclsys, and @1yihui. +- Onboarding/GitHub Copilot: add manifest-owned `--github-copilot-token` support for non-interactive setup, including env fallback, tokenRef storage in ref mode, saved-profile reuse, and current Copilot default-model wiring. Refs #50002 and supersedes #50003. Thanks @scottgl9. - Gateway/install: add a validated `--wrapper`/`OPENCLAW_WRAPPER` service install path that persists executable LaunchAgent/systemd wrappers across forced reinstalls, updates, and doctor repairs instead of falling back to raw node/bun `ProgramArguments`. Fixes #69400. (#72445) Thanks @willtmc. - macOS Gateway: write launchd services with a state-dir `WorkingDirectory`, use a durable state-dir temp path instead of freezing macOS session `TMPDIR`, create that temp directory before bootstrap, and label abort-shaped launchd exits as `SIGABRT/abort` in status output. Fixes #53679 and #70223; refs #71848. Thanks @dlturock, @stammi922, and @palladius. - Exec approvals: accept runtime-owned `source: "allow-always"` and `commandText` allowlist metadata in gateway and node approval-set payloads so Control UI round-trips no longer fail with `unexpected property 'source'`. Fixes #60000; carries forward #60064. Thanks @sd1471123, @sharkqwy, and @luoyanglang. diff --git a/docs/providers/github-copilot.md b/docs/providers/github-copilot.md index 67c46df4ff9..272a1ecd13a 100644 --- a/docs/providers/github-copilot.md +++ b/docs/providers/github-copilot.md @@ -1,5 +1,5 @@ --- -summary: "Sign in to GitHub Copilot from OpenClaw using the device flow" +summary: "Sign in to GitHub Copilot from OpenClaw using the device flow or non-interactive token import" read_when: - You want to use GitHub Copilot as a model provider - You need the `openclaw models auth login-github-copilot` flow @@ -73,6 +73,24 @@ openclaw models auth login-github-copilot --yes openclaw models auth login --provider github-copilot --method device --set-default ``` +## Non-interactive onboarding + +If you already have a GitHub OAuth access token for Copilot, import it during +headless setup with `openclaw onboard --non-interactive`: + +```bash +openclaw onboard --non-interactive --accept-risk \ + --auth-choice github-copilot \ + --github-copilot-token "$COPILOT_GITHUB_TOKEN" \ + --skip-channels --skip-health +``` + +You can also omit `--auth-choice`; passing `--github-copilot-token` infers the +GitHub Copilot provider auth choice. If the flag is omitted, onboarding falls +back to `COPILOT_GITHUB_TOKEN`, `GH_TOKEN`, then `GITHUB_TOKEN`. Use +`--secret-input-mode ref` with `COPILOT_GITHUB_TOKEN` set to store an env-backed +`tokenRef` instead of plaintext in `auth-profiles.json`. + The device-login flow requires an interactive TTY. Run it directly in a @@ -122,8 +140,8 @@ openclaw models auth login --provider github-copilot --method device --set-defau -Requires an interactive TTY. Run the login command directly in a terminal, not -inside a headless script or CI job. +The device-login command requires an interactive TTY. Use non-interactive +onboarding when you need headless setup. ## Memory search embeddings diff --git a/extensions/github-copilot/index.test.ts b/extensions/github-copilot/index.test.ts index bdb15174230..357142b025d 100644 --- a/extensions/github-copilot/index.test.ts +++ b/extensions/github-copilot/index.test.ts @@ -1,4 +1,11 @@ -import { describe, expect, it, vi } from "vitest"; +import fs from "node:fs/promises"; +import os from "node:os"; +import path from "node:path"; +import { afterEach, describe, expect, it, vi } from "vitest"; +import { + clearRuntimeAuthProfileStoreSnapshots, + ensureAuthProfileStore, +} from "../../src/agents/auth-profiles.js"; import { createTestPluginApi } from "../../test/helpers/plugins/plugin-api.js"; const resolveCopilotApiTokenMock = vi.hoisted(() => vi.fn()); @@ -12,6 +19,19 @@ vi.mock("./register.runtime.js", () => ({ import plugin from "./index.js"; +const tempDirs: string[] = []; + +afterEach(async () => { + clearRuntimeAuthProfileStoreSnapshots(); + await Promise.all(tempDirs.splice(0).map((dir) => fs.rm(dir, { recursive: true, force: true }))); +}); + +async function createAgentDir() { + const dir = await fs.mkdtemp(path.join(os.tmpdir(), "openclaw-github-copilot-test-")); + tempDirs.push(dir); + return dir; +} + function _registerProvider() { return registerProviderWithPluginConfig({}); } @@ -116,4 +136,234 @@ describe("github-copilot plugin", () => { }, }); }); + + it("stores GitHub Copilot token from non-interactive onboarding", async () => { + const provider = registerProviderWithPluginConfig({}); + const method = provider.auth[0]; + const agentDir = await createAgentDir(); + const runtime = { error: vi.fn(), exit: vi.fn() }; + + const result = await method.runNonInteractive({ + authChoice: "github-copilot", + config: {}, + baseConfig: {}, + opts: { githubCopilotToken: "ghu_test\r\n123" }, + runtime, + agentDir, + resolveApiKey: vi.fn(async () => ({ + key: "ghu_test123", + source: "flag" as const, + })), + toApiKeyCredential: vi.fn(), + }); + + expect(runtime.error).not.toHaveBeenCalled(); + expect(result?.auth?.profiles?.["github-copilot:github"]).toEqual({ + provider: "github-copilot", + mode: "token", + }); + expect(result?.agents?.defaults?.model).toEqual({ + primary: "github-copilot/claude-opus-4.7", + }); + expect(result?.agents?.defaults?.models?.["github-copilot/claude-opus-4.7"]).toEqual({}); + + const profile = ensureAuthProfileStore(agentDir).profiles["github-copilot:github"]; + expect(profile).toEqual({ + type: "token", + provider: "github-copilot", + token: "ghu_test123", + }); + }); + + it("stores env-backed token refs for non-interactive onboarding ref mode", async () => { + const provider = registerProviderWithPluginConfig({}); + const method = provider.auth[0]; + const agentDir = await createAgentDir(); + const runtime = { error: vi.fn(), exit: vi.fn() }; + + const result = await method.runNonInteractive({ + authChoice: "github-copilot", + config: { agents: { defaults: { model: { fallbacks: ["openai/gpt-5.4"] } } } }, + baseConfig: {}, + opts: { secretInputMode: "ref" }, + runtime, + agentDir, + resolveApiKey: vi.fn(async () => ({ + key: "ghu_from_env", + source: "env" as const, + envVarName: "COPILOT_GITHUB_TOKEN", + })), + toApiKeyCredential: vi.fn(), + }); + + expect(runtime.error).not.toHaveBeenCalled(); + expect(result?.agents?.defaults?.model).toEqual({ + fallbacks: ["openai/gpt-5.4"], + primary: "github-copilot/claude-opus-4.7", + }); + + const profile = ensureAuthProfileStore(agentDir).profiles["github-copilot:github"]; + expect(profile).toEqual({ + type: "token", + provider: "github-copilot", + tokenRef: { + source: "env", + provider: "default", + id: "COPILOT_GITHUB_TOKEN", + }, + }); + }); + + it("falls back to GH_TOKEN during non-interactive onboarding", async () => { + const provider = registerProviderWithPluginConfig({}); + const method = provider.auth[0]; + const agentDir = await createAgentDir(); + const runtime = { error: vi.fn(), exit: vi.fn() }; + const resolveApiKey = vi.fn(async ({ envVar }: { envVar?: string }) => + envVar === "GH_TOKEN" + ? { + key: "ghu_from_gh_token", + source: "env" as const, + envVarName: "GH_TOKEN", + } + : null, + ); + + const result = await method.runNonInteractive({ + authChoice: "github-copilot", + config: {}, + baseConfig: {}, + opts: {}, + runtime, + agentDir, + resolveApiKey, + toApiKeyCredential: vi.fn(), + }); + + expect(runtime.error).not.toHaveBeenCalled(); + expect(resolveApiKey).toHaveBeenCalledWith( + expect.objectContaining({ envVar: "COPILOT_GITHUB_TOKEN" }), + ); + expect(resolveApiKey).toHaveBeenCalledWith(expect.objectContaining({ envVar: "GH_TOKEN" })); + expect(result?.auth?.profiles?.["github-copilot:github"]).toEqual({ + provider: "github-copilot", + mode: "token", + }); + + const profile = ensureAuthProfileStore(agentDir).profiles["github-copilot:github"]; + expect(profile).toEqual({ + type: "token", + provider: "github-copilot", + token: "ghu_from_gh_token", + }); + }); + + it("preserves an existing primary model during non-interactive onboarding", async () => { + const provider = registerProviderWithPluginConfig({}); + const method = provider.auth[0]; + const agentDir = await createAgentDir(); + const runtime = { error: vi.fn(), exit: vi.fn() }; + + const result = await method.runNonInteractive({ + authChoice: "github-copilot", + config: { + agents: { + defaults: { + model: { + primary: "github-copilot/gpt-5.4", + fallbacks: ["openai/gpt-5.4"], + }, + models: { + "github-copilot/gpt-5.4": { label: "Existing" }, + }, + }, + }, + }, + baseConfig: {}, + opts: { githubCopilotToken: "ghu_test" }, + runtime, + agentDir, + resolveApiKey: vi.fn(async () => ({ + key: "ghu_test", + source: "flag" as const, + })), + toApiKeyCredential: vi.fn(), + }); + + expect(runtime.error).not.toHaveBeenCalled(); + expect(result?.agents?.defaults?.model).toEqual({ + primary: "github-copilot/gpt-5.4", + fallbacks: ["openai/gpt-5.4"], + }); + expect(result?.agents?.defaults?.models).toEqual({ + "github-copilot/gpt-5.4": { label: "Existing" }, + }); + }); + + it("reuses an existing token profile during non-interactive onboarding", async () => { + const provider = registerProviderWithPluginConfig({}); + const method = provider.auth[0]; + const agentDir = await createAgentDir(); + const runtime = { error: vi.fn(), exit: vi.fn() }; + await fs.writeFile( + path.join(agentDir, "auth-profiles.json"), + JSON.stringify({ + version: 1, + profiles: { + "github-copilot:github": { + type: "token", + provider: "github-copilot", + token: "existing-token", + }, + }, + }), + ); + + const result = await method.runNonInteractive({ + authChoice: "github-copilot", + config: {}, + baseConfig: {}, + opts: {}, + runtime, + agentDir, + resolveApiKey: vi.fn(async () => null), + toApiKeyCredential: vi.fn(), + }); + + expect(runtime.error).not.toHaveBeenCalled(); + expect(result?.auth?.profiles?.["github-copilot:github"]).toEqual({ + provider: "github-copilot", + mode: "token", + }); + }); + + it("does not emit a second missing-token error after ref-mode flag validation fails", async () => { + const provider = registerProviderWithPluginConfig({}); + const method = provider.auth[0]; + const agentDir = await createAgentDir(); + const runtime = { error: vi.fn(), exit: vi.fn() }; + + const result = await method.runNonInteractive({ + authChoice: "github-copilot", + config: {}, + baseConfig: {}, + opts: { + githubCopilotToken: "ghu_secret", + secretInputMode: "ref", + }, + runtime, + agentDir, + resolveApiKey: vi.fn(async () => null), + toApiKeyCredential: vi.fn(), + }); + + expect(result).toBeNull(); + expect(runtime.error).toHaveBeenCalledTimes(1); + expect(runtime.error).toHaveBeenCalledWith( + [ + "--github-copilot-token cannot be used with --secret-input-mode ref unless COPILOT_GITHUB_TOKEN, GH_TOKEN, or GITHUB_TOKEN is set in env.", + "Set one of those env vars and omit --github-copilot-token, or use --secret-input-mode plaintext.", + ].join("\n"), + ); + }); }); diff --git a/extensions/github-copilot/index.ts b/extensions/github-copilot/index.ts index bf6fcfad2fe..39e68b6361f 100644 --- a/extensions/github-copilot/index.ts +++ b/extensions/github-copilot/index.ts @@ -1,6 +1,18 @@ import { resolvePluginConfigObject, type OpenClawConfig } from "openclaw/plugin-sdk/config-runtime"; -import { definePluginEntry, type ProviderAuthContext } from "openclaw/plugin-sdk/plugin-entry"; -import { ensureAuthProfileStore } from "openclaw/plugin-sdk/provider-auth"; +import { + definePluginEntry, + type ProviderAuthContext, + type ProviderAuthMethodNonInteractiveContext, +} from "openclaw/plugin-sdk/plugin-entry"; +import { + applyAuthProfileConfig, + coerceSecretRef, + ensureAuthProfileStore, + listProfilesForProvider, + normalizeOptionalSecretInput, + resolveDefaultSecretProviderAlias, + upsertAuthProfileWithLock, +} from "openclaw/plugin-sdk/provider-auth"; import { normalizeOptionalLowercaseString } from "openclaw/plugin-sdk/text-runtime"; import { resolveFirstGithubToken } from "./auth.js"; import { githubCopilotMemoryEmbeddingProviderAdapter } from "./embeddings.js"; @@ -9,6 +21,8 @@ import { buildGithubCopilotReplayPolicy } from "./replay-policy.js"; import { wrapCopilotProviderStream } from "./stream.js"; const COPILOT_ENV_VARS = ["COPILOT_GITHUB_TOKEN", "GH_TOKEN", "GITHUB_TOKEN"]; +const DEFAULT_COPILOT_MODEL = "github-copilot/claude-opus-4.7"; +const DEFAULT_COPILOT_PROFILE_ID = "github-copilot:github"; const COPILOT_XHIGH_MODEL_IDS = ["gpt-5.4", "gpt-5.3-codex", "gpt-5.2", "gpt-5.2-codex"] as const; type GithubCopilotPluginConfig = { @@ -20,6 +34,187 @@ type GithubCopilotPluginConfig = { async function loadGithubCopilotRuntime() { return await import("./register.runtime.js"); } + +function applyCopilotDefaultModel(cfg: OpenClawConfig): OpenClawConfig { + const defaults = cfg.agents?.defaults; + const existingModel = defaults?.model; + const existingPrimary = + typeof existingModel === "string" + ? existingModel.trim() + : typeof existingModel === "object" && typeof existingModel?.primary === "string" + ? existingModel.primary.trim() + : ""; + if (existingPrimary) { + return cfg; + } + const fallbacks = + typeof existingModel === "object" && existingModel !== null && "fallbacks" in existingModel + ? (existingModel as { fallbacks?: string[] }).fallbacks + : undefined; + return { + ...cfg, + agents: { + ...cfg.agents, + defaults: { + ...defaults, + model: { + ...(fallbacks ? { fallbacks } : undefined), + primary: DEFAULT_COPILOT_MODEL, + }, + models: { + ...defaults?.models, + [DEFAULT_COPILOT_MODEL]: defaults?.models?.[DEFAULT_COPILOT_MODEL] ?? {}, + }, + }, + }, + }; +} + +function resolveExistingCopilotTokenProfileId(agentDir?: string): string | undefined { + const authStore = ensureAuthProfileStore(agentDir, { + allowKeychainPrompt: false, + }); + return listProfilesForProvider(authStore, PROVIDER_ID).find((profileId) => { + const profile = authStore.profiles[profileId]; + if (profile?.type !== "token") { + return false; + } + return Boolean( + normalizeOptionalSecretInput(profile.token) || coerceSecretRef(profile.tokenRef)?.id.trim(), + ); + }); +} + +async function resolveCopilotNonInteractiveToken( + ctx: ProviderAuthMethodNonInteractiveContext, + flagValue: string | undefined, +) { + const resolveFromEnvChain = async () => { + for (const envVar of COPILOT_ENV_VARS) { + const resolved = await ctx.resolveApiKey({ + provider: PROVIDER_ID, + flagName: "--github-copilot-token", + envVar, + envVarName: envVar, + allowProfile: false, + required: false, + }); + if (resolved) { + return resolved; + } + } + return null; + }; + + if (ctx.opts.secretInputMode === "ref") { + const resolved = await resolveFromEnvChain(); + if (resolved) { + return resolved; + } + if (flagValue) { + ctx.runtime.error( + [ + "--github-copilot-token cannot be used with --secret-input-mode ref unless COPILOT_GITHUB_TOKEN, GH_TOKEN, or GITHUB_TOKEN is set in env.", + "Set one of those env vars and omit --github-copilot-token, or use --secret-input-mode plaintext.", + ].join("\n"), + ); + ctx.runtime.exit(1); + } + return null; + } + + const primary = await ctx.resolveApiKey({ + provider: PROVIDER_ID, + flagValue, + flagName: "--github-copilot-token", + envVar: COPILOT_ENV_VARS[0], + envVarName: COPILOT_ENV_VARS[0], + allowProfile: false, + required: false, + }); + if (primary || flagValue) { + return primary; + } + + for (const envVar of COPILOT_ENV_VARS.slice(1)) { + const resolved = await ctx.resolveApiKey({ + provider: PROVIDER_ID, + flagName: "--github-copilot-token", + envVar, + envVarName: envVar, + allowProfile: false, + required: false, + }); + if (resolved) { + return resolved; + } + } + return null; +} + +async function runGitHubCopilotNonInteractiveAuth( + ctx: ProviderAuthMethodNonInteractiveContext, +): Promise { + const opts = ctx.opts as Record | undefined; + const flagValue = normalizeOptionalSecretInput(opts?.githubCopilotToken); + const resolved = await resolveCopilotNonInteractiveToken(ctx, flagValue); + + let profileId = DEFAULT_COPILOT_PROFILE_ID; + if (resolved) { + const useTokenRef = ctx.opts.secretInputMode === "ref" && resolved.source === "env"; + if (useTokenRef && !resolved.envVarName) { + ctx.runtime.error( + [ + '--secret-input-mode ref requires an explicit environment variable for provider "github-copilot".', + "Set COPILOT_GITHUB_TOKEN in env and retry, or use --secret-input-mode plaintext.", + ].join("\n"), + ); + ctx.runtime.exit(1); + return null; + } + await upsertAuthProfileWithLock({ + profileId, + credential: { + type: "token", + provider: PROVIDER_ID, + ...(useTokenRef + ? { + tokenRef: { + source: "env", + provider: resolveDefaultSecretProviderAlias(ctx.baseConfig, "env", { + preferFirstProviderForSource: true, + }), + id: resolved.envVarName!, + }, + } + : { token: resolved.key }), + }, + agentDir: ctx.agentDir, + }); + } else { + if (flagValue && ctx.opts.secretInputMode === "ref") { + return null; + } + const existingProfileId = resolveExistingCopilotTokenProfileId(ctx.agentDir); + if (!existingProfileId) { + ctx.runtime.error( + "Missing --github-copilot-token (or COPILOT_GITHUB_TOKEN / GH_TOKEN / GITHUB_TOKEN env var) for --auth-choice github-copilot.", + ); + ctx.runtime.exit(1); + return null; + } + profileId = existingProfileId; + } + + return applyCopilotDefaultModel( + applyAuthProfileConfig(ctx.config, { + profileId, + provider: PROVIDER_ID, + mode: "token", + }), + ); +} + export default definePluginEntry({ id: "github-copilot", name: "GitHub Copilot Provider", @@ -74,11 +269,11 @@ export default definePluginEntry({ return { profiles: [ { - profileId: "github-copilot:github", + profileId: DEFAULT_COPILOT_PROFILE_ID, credential, }, ], - defaultModel: "github-copilot/claude-opus-4.7", + defaultModel: DEFAULT_COPILOT_MODEL, }; } @@ -96,6 +291,7 @@ export default definePluginEntry({ hint: "Browser device-code flow", kind: "device_code", run: async (ctx) => await runGitHubCopilotAuth(ctx), + runNonInteractive: async (ctx) => await runGitHubCopilotNonInteractiveAuth(ctx), }, ], wizard: { diff --git a/extensions/github-copilot/openclaw.plugin.json b/extensions/github-copilot/openclaw.plugin.json index 01f3f8b3e0b..3a33f97926a 100644 --- a/extensions/github-copilot/openclaw.plugin.json +++ b/extensions/github-copilot/openclaw.plugin.json @@ -17,7 +17,11 @@ "choiceHint": "Device login with your GitHub account", "groupId": "copilot", "groupLabel": "Copilot", - "groupHint": "GitHub + local proxy" + "groupHint": "GitHub + local proxy", + "optionKey": "githubCopilotToken", + "cliFlag": "--github-copilot-token", + "cliOption": "--github-copilot-token ", + "cliDescription": "GitHub Copilot OAuth token" } ], "configSchema": { diff --git a/src/plugins/contracts/registry.contract.test.ts b/src/plugins/contracts/registry.contract.test.ts index f8c38b8125e..6a3573748ff 100644 --- a/src/plugins/contracts/registry.contract.test.ts +++ b/src/plugins/contracts/registry.contract.test.ts @@ -120,6 +120,26 @@ describe("plugin contract registry", () => { } }); + it("exposes the GitHub Copilot non-interactive onboarding token flag from manifest metadata", () => { + const registry = loadPluginManifestRegistry({}); + const plugin = registry.plugins.find( + (entry) => entry.origin === "bundled" && entry.id === "github-copilot", + ); + + expect(plugin?.providerAuthChoices).toEqual( + expect.arrayContaining([ + expect.objectContaining({ + provider: "github-copilot", + method: "device", + choiceId: "github-copilot", + optionKey: "githubCopilotToken", + cliFlag: "--github-copilot-token", + cliOption: "--github-copilot-token ", + }), + ]), + ); + }); + it("covers every bundled speech plugin discovered from manifests", () => { expectRegistryPluginIds({ actualPluginIds: pluginRegistrationContractRegistry From 5e8cb77e79178df3c7ed0df7a0628b79bb5092c3 Mon Sep 17 00:00:00 2001 From: Val Alexander <68980965+BunsDev@users.noreply.github.com> Date: Sun, 26 Apr 2026 22:56:35 -0500 Subject: [PATCH 223/418] Polish Control UI quick settings layout Polish the Control UI quick settings dashboard layout. - Rework quick settings into a 12-column desktop grid with matched top-row card heights. - Pair Personal with a right-side Appearance/Automations stack on large screens while preserving tablet/mobile ordering. - Add render/style guards plus an Unreleased changelog entry crediting @BunsDev. Validated with focused UI tests, formatting, git diff checks, local changed gate, and full PR CI. --- CHANGELOG.md | 1 + ui/src/styles/config-quick.css | 106 ++++++++++++++++++++------- ui/src/styles/config-quick.test.ts | 19 ++++- ui/src/ui/views/config-quick.test.ts | 10 ++- ui/src/ui/views/config-quick.ts | 22 +++--- 5 files changed, 115 insertions(+), 43 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 278d0cd2d05..18f2b01064b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,7 @@ Docs: https://docs.openclaw.ai ### Changes +- Control UI: polish the quick settings dashboard grid so common cards align across desktop, tablet, and mobile layouts without wasting horizontal space. Thanks @BunsDev. - Matrix/E2EE: add `openclaw matrix encryption setup` to enable Matrix encryption, bootstrap recovery, and print verification status from one setup flow. Thanks @gumadeiras. - Agents/compaction: add an opt-in `agents.defaults.compaction.maxActiveTranscriptBytes` preflight trigger that runs normal local compaction when the active JSONL grows too large, requiring transcript rotation so successful compaction moves future turns onto a smaller successor file instead of raw byte-splitting history. Thanks @vincentkoc. diff --git a/ui/src/styles/config-quick.css b/ui/src/styles/config-quick.css index 172c9044647..2fb160ae1f8 100644 --- a/ui/src/styles/config-quick.css +++ b/ui/src/styles/config-quick.css @@ -2,9 +2,9 @@ .qs-container { width: 100%; - max-width: none; - margin: 0; - padding: 32px 0 56px; + max-width: 1520px; + margin: 0 auto; + padding: 32px 16px 56px; } .qs-header { @@ -44,14 +44,16 @@ .qs-grid { display: grid; - grid-template-columns: repeat(3, minmax(0, 1fr)); - align-items: start; + grid-template-columns: repeat(12, minmax(0, 1fr)); + align-items: stretch; gap: 14px; } -.qs-stack { +.qs-side-stack { display: grid; - align-content: start; + grid-column: span 4; + grid-template-rows: auto 1fr; + align-self: stretch; gap: 14px; min-width: 0; } @@ -78,8 +80,14 @@ grid-column: 1 / -1; } +.qs-card--model, +.qs-card--channels, +.qs-card--security { + grid-column: span 4; +} + .qs-card--personal { - grid-column: 1 / -1; + grid-column: span 8; } .qs-card--personal .qs-identity-grid { @@ -144,7 +152,7 @@ align-items: center; justify-content: space-between; padding: 9px 16px; - min-height: 38px; + min-height: 42px; gap: 10px; } @@ -156,6 +164,8 @@ display: flex; align-items: center; gap: 8px; + min-width: 0; + flex: 1 1 auto; font-size: 0.8125rem; font-weight: 450; color: var(--text); @@ -165,9 +175,12 @@ .qs-row__value { display: flex; align-items: center; + justify-content: flex-end; gap: 8px; + min-width: 0; font-size: 0.8125rem; color: var(--muted); + text-align: right; } .qs-row__value--action { @@ -226,8 +239,8 @@ .qs-identity-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(min(220px, 100%), 1fr)); - gap: 10px; - padding: 14px 16px 10px; + gap: 12px; + padding: 14px 16px 16px; } .qs-identity-card { @@ -240,23 +253,13 @@ padding: 12px; border: 1px solid color-mix(in srgb, var(--border) 60%, transparent); border-radius: var(--radius-md); - background: - radial-gradient( - circle at 18% 18%, - color-mix(in srgb, var(--accent) 10%, transparent), - transparent 46% - ), - color-mix(in srgb, var(--bg-elevated) 42%, var(--card) 58%); + background: color-mix(in srgb, var(--bg-elevated) 42%, var(--card) 58%); + box-shadow: inset 3px 0 0 color-mix(in srgb, var(--accent) 42%, transparent); } .qs-identity-card--assistant { - background: - radial-gradient( - circle at 82% 12%, - color-mix(in srgb, var(--accent) 14%, transparent), - transparent 48% - ), - color-mix(in srgb, var(--bg-elevated) 52%, var(--card) 48%); + background: color-mix(in srgb, var(--bg-elevated) 50%, var(--card) 50%); + box-shadow: inset 3px 0 0 color-mix(in srgb, var(--border-strong) 70%, transparent); } .qs-identity-card__copy { @@ -414,7 +417,10 @@ .qs-segmented { display: flex; + flex-wrap: wrap; + justify-content: flex-end; gap: 2px; + max-width: 100%; background: color-mix(in srgb, var(--bg) 80%, var(--bg-elevated) 20%); border: 1px solid color-mix(in srgb, var(--border) 50%, transparent); border-radius: var(--radius-md); @@ -1071,6 +1077,56 @@ @media (max-width: 1100px) { .qs-grid { grid-template-columns: repeat(2, minmax(0, 1fr)); + align-items: stretch; + } + + .qs-side-stack { + display: contents; + } + + .qs-card, + .qs-card--span-all, + .qs-card--personal, + .qs-card--model, + .qs-card--channels, + .qs-card--security, + .qs-card--appearance, + .qs-card--automations { + grid-column: span 1; + } + + .qs-card--personal, + .qs-card--span-all { + grid-column: 1 / -1; + } + + .qs-card--model { + order: 1; + } + + .qs-card--channels { + order: 2; + } + + .qs-card--security { + order: 3; + } + + .qs-card--appearance { + order: 4; + } + + .qs-card--personal { + order: 5; + } + + .qs-card--automations { + grid-column: 1 / -1; + order: 6; + } + + .qs-card--span-all { + order: 7; } } diff --git a/ui/src/styles/config-quick.test.ts b/ui/src/styles/config-quick.test.ts index f4967cd9958..90300ebb48c 100644 --- a/ui/src/styles/config-quick.test.ts +++ b/ui/src/styles/config-quick.test.ts @@ -16,12 +16,23 @@ describe("config-quick styles", () => { expect(css).toContain(".qs-card--personal"); }); - it("includes the stacked quick-settings density layout", () => { - expect(css).toContain(".qs-stack"); + it("includes the dashboard quick-settings density layout", () => { + expect(css).toContain(".qs-card--model"); + expect(css).toContain(".qs-card--automations"); + expect(css).toContain(".qs-side-stack"); + expect(css).toContain("grid-template-rows: auto 1fr;"); expect(css).toContain(".qs-identity-card__actions"); - expect(css).toContain("grid-template-columns: repeat(3, minmax(0, 1fr));"); + expect(css).toContain("grid-template-columns: repeat(12, minmax(0, 1fr));"); + expect(css).toContain("grid-column: 1 / -1;"); + expect(css).toContain("grid-column: span 4;"); expect(css).toContain("grid-template-columns: repeat(2, minmax(0, 1fr));"); - expect(css).toContain("@media (max-width: 760px)"); + expect(css).toContain("align-items: stretch;"); + expect(css).toContain("display: contents;"); + expect(css).toContain(".qs-card--appearance {\n order: 4;"); + expect(css).toContain(".qs-card--appearance"); + expect(css).toContain("order: 4"); + expect(css).toContain(".qs-card--automations"); + expect(css).toContain("order: 6"); }); it("includes explicit context profile layout hooks", () => { diff --git a/ui/src/ui/views/config-quick.test.ts b/ui/src/ui/views/config-quick.test.ts index c3aa07633ff..615626ad3f5 100644 --- a/ui/src/ui/views/config-quick.test.ts +++ b/ui/src/ui/views/config-quick.test.ts @@ -62,12 +62,18 @@ function createProps(overrides: Partial = {}): QuickSettings } describe("renderQuickSettings", () => { - it("uses stacked columns for the compact settings layout", () => { + it("uses direct dashboard cards for the compact settings layout", () => { const container = document.createElement("div"); render(renderQuickSettings(createProps()), container); - expect(container.querySelectorAll(".qs-stack")).toHaveLength(2); + expect(container.querySelector(".qs-card--model")).not.toBeNull(); + expect(container.querySelector(".qs-card--channels")).not.toBeNull(); + expect(container.querySelector(".qs-card--security")).not.toBeNull(); + expect(container.querySelector(".qs-card--appearance")).not.toBeNull(); + expect(container.querySelector(".qs-card--automations")).not.toBeNull(); + expect(container.querySelector(".qs-side-stack .qs-card--appearance")).not.toBeNull(); + expect(container.querySelector(".qs-side-stack .qs-card--automations")).not.toBeNull(); expect(container.querySelector(".qs-card--personal")).not.toBeNull(); expect(container.querySelectorAll(".qs-card--span-all")).toHaveLength(1); }); diff --git a/ui/src/ui/views/config-quick.ts b/ui/src/ui/views/config-quick.ts index b307a43049f..bfa4ed941c6 100644 --- a/ui/src/ui/views/config-quick.ts +++ b/ui/src/ui/views/config-quick.ts @@ -376,7 +376,7 @@ function renderCardHeader(icon: TemplateResult, title: string, action?: Template function renderModelCard(props: QuickSettingsProps) { return html` -
+
${renderCardHeader(icons.brain, "Model & Thinking")}
@@ -426,7 +426,7 @@ function renderChannelsCard(props: QuickSettingsProps) { : undefined; return html` -
+
${renderCardHeader(icons.send, "Channels", badge)}
${props.channels.length === 0 @@ -460,7 +460,7 @@ function renderAutomationsCard(props: QuickSettingsProps) { const { cronJobCount, skillCount, mcpServerCount } = props.automation; return html` -
+
${renderCardHeader(icons.zap, "Automations")}
@@ -490,7 +490,7 @@ function renderSecurityCard(props: QuickSettingsProps) { const { gatewayAuth, execPolicy, deviceAuth } = props.security; return html` -
+
${renderCardHeader( icons.eye, "Security", @@ -525,7 +525,7 @@ function renderSecurityCard(props: QuickSettingsProps) { function renderAppearanceCard(props: QuickSettingsProps) { const themeOptions: ThemeOption[] = [...BUILTIN_THEME_OPTIONS, { id: "custom", label: "Custom" }]; return html` -
+
${renderCardHeader(icons.spark, "Appearance")}
@@ -976,10 +976,6 @@ function renderConnectionFooter(props: QuickSettingsProps) { `; } -function renderStack(...cards: TemplateResult[]) { - return html`
${cards}
`; -} - // ── Main render ── export function renderQuickSettings(props: QuickSettingsProps) { @@ -993,9 +989,11 @@ export function renderQuickSettings(props: QuickSettingsProps) {
- ${renderStack(renderModelCard(props), renderSecurityCard(props))} - ${renderChannelsCard(props)} ${renderPersonalCard(props)} - ${renderStack(renderAppearanceCard(props), renderAutomationsCard(props))} + ${renderModelCard(props)} ${renderChannelsCard(props)} ${renderSecurityCard(props)} + ${renderPersonalCard(props)} +
+ ${renderAppearanceCard(props)} ${renderAutomationsCard(props)} +
${renderPresetsCard(props)}
From 9626ef274ae2346b3d519f99c31856be98aab570 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 20:55:42 -0700 Subject: [PATCH 224/418] ci(testbox): add build artifact cache warmup --- .../workflows/ci-build-artifacts-testbox.yml | 188 ++++++++++++++++++ 1 file changed, 188 insertions(+) create mode 100644 .github/workflows/ci-build-artifacts-testbox.yml diff --git a/.github/workflows/ci-build-artifacts-testbox.yml b/.github/workflows/ci-build-artifacts-testbox.yml new file mode 100644 index 00000000000..350fb9c837e --- /dev/null +++ b/.github/workflows/ci-build-artifacts-testbox.yml @@ -0,0 +1,188 @@ +name: Blacksmith Build Artifacts Testbox + +on: + workflow_dispatch: + inputs: + testbox_id: + type: string + description: "Testbox session ID" + required: true + pull_request: + paths: + - ".github/workflows/**" + +permissions: + contents: read + +env: + FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" + +jobs: + build-artifacts: + permissions: + contents: read + name: "build-artifacts" + runs-on: blacksmith-8vcpu-ubuntu-2404 + timeout-minutes: 35 + steps: + - name: Begin Testbox + uses: useblacksmith/begin-testbox@v2 + with: + testbox_id: ${{ inputs.testbox_id }} + + - name: Checkout + shell: bash + env: + CHECKOUT_REPO: ${{ github.repository }} + CHECKOUT_SHA: ${{ github.sha }} + CHECKOUT_TOKEN: ${{ github.token }} + run: | + set -euo pipefail + + workdir="$GITHUB_WORKSPACE" + auth_header="$(printf 'x-access-token:%s' "$CHECKOUT_TOKEN" | base64 | tr -d '\n')" + + reset_checkout_dir() { + mkdir -p "$workdir" + find "$workdir" -mindepth 1 -maxdepth 1 -exec rm -rf {} + + } + + checkout_attempt() { + local attempt="$1" + + reset_checkout_dir + git init "$workdir" >/dev/null + git config --global --add safe.directory "$workdir" + git -C "$workdir" remote add origin "https://github.com/${CHECKOUT_REPO}" + git -C "$workdir" config gc.auto 0 + + timeout --signal=TERM 30s git -C "$workdir" \ + -c protocol.version=2 \ + -c "http.https://github.com/.extraheader=AUTHORIZATION: basic ${auth_header}" \ + fetch --no-tags --prune --no-recurse-submodules --depth=1 origin \ + "+${CHECKOUT_SHA}:refs/remotes/origin/ci-target" || return 1 + + git -C "$workdir" checkout --force --detach "$CHECKOUT_SHA" || return 1 + test -f "$workdir/.github/actions/setup-node-env/action.yml" || return 1 + echo "checkout attempt ${attempt}/5 succeeded" + } + + for attempt in 1 2 3 4 5; do + if checkout_attempt "$attempt"; then + exit 0 + fi + echo "checkout attempt ${attempt}/5 failed" + sleep $((attempt * 5)) + done + + echo "checkout failed after 5 attempts" >&2 + exit 1 + + - name: Setup Node environment + uses: ./.github/actions/setup-node-env + with: + install-bun: "false" + + - name: Resolve release dist cache seeds + id: dist-cache-seeds + shell: bash + run: | + set -euo pipefail + + cache_prefix="${RUNNER_OS}-dist-build-" + declare -A seen=() + + resolve_tag_sha() { + local tag="$1" + local direct="" + local peeled="" + + while read -r sha ref; do + if [[ "$ref" == "refs/tags/${tag}^{}" ]]; then + peeled="$sha" + elif [[ "$ref" == "refs/tags/${tag}" ]]; then + direct="$sha" + fi + done < <(git ls-remote --tags origin "refs/tags/${tag}" "refs/tags/${tag}^{}") + + printf '%s\n' "${peeled:-$direct}" + } + + { + echo "restore-keys</dev/null || true)" + if [[ -z "$version" ]]; then + echo "Could not resolve npm dist-tag ${dist_tag}; skipping cache seed." >&2 + continue + fi + + sha="$(resolve_tag_sha "v${version}")" + if [[ -z "$sha" ]]; then + echo "Could not resolve git tag v${version}; skipping cache seed." >&2 + continue + fi + + key="${cache_prefix}${sha}" + if [[ -z "${seen[$key]+x}" ]]; then + echo "$key" + seen[$key]=1 + fi + done + echo "${cache_prefix}" + echo "EOF" + } >> "$GITHUB_OUTPUT" + + - name: Restore dist build cache + id: dist-cache + uses: actions/cache@v5 + with: + path: | + .artifacts/build-all-cache/ + dist/ + dist-runtime/ + key: ${{ runner.os }}-dist-build-${{ github.sha }} + restore-keys: ${{ steps.dist-cache-seeds.outputs.restore-keys }} + + - name: Build dist on cache miss + if: steps.dist-cache.outputs.cache-hit != 'true' + run: pnpm build:ci-artifacts + + - name: Build Control UI on cache miss + if: steps.dist-cache.outputs.cache-hit != 'true' + run: pnpm ui:build + + - name: Verify build artifacts + shell: bash + run: | + set -euo pipefail + + test -d dist + test -d dist-runtime + if [[ ! -f dist/index.js && ! -f dist/index.mjs ]]; then + echo "Missing dist/index.js or dist/index.mjs" >&2 + exit 1 + fi + test -f dist/build-info.json + test -f dist/control-ui/index.html + + - name: Prepare Testbox shell + shell: bash + run: | + set -euo pipefail + + git fetch --no-tags --depth=50 origin "+refs/heads/main:refs/remotes/origin/main" + + node_bin="$(dirname "$(node -p 'process.execPath')")" + pnpm_bin="$(command -v pnpm)" + sudo ln -sf "$node_bin/node" /usr/local/bin/node + sudo ln -sf "$node_bin/npm" /usr/local/bin/npm + sudo ln -sf "$node_bin/npx" /usr/local/bin/npx + sudo ln -sf "$node_bin/corepack" /usr/local/bin/corepack + sudo ln -sf "$pnpm_bin" /usr/local/bin/pnpm + + - name: Run Testbox + uses: useblacksmith/run-testbox@v2 + if: always() + env: + FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" From ef828d55af13a1237939cf8e1bb93b852439ee47 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 21:01:22 -0700 Subject: [PATCH 225/418] test(live): accept current Codex status text Accept current Codex harness status prose while still requiring the OpenClaw status shape, active model, and live harness session. --- ...gateway-codex-harness.live-helpers.test.ts | 19 +++++++++++ .../gateway-codex-harness.live-helpers.ts | 33 +++++++++++++++++++ .../gateway-codex-harness.live.test.ts | 17 +++------- 3 files changed, 56 insertions(+), 13 deletions(-) diff --git a/src/gateway/gateway-codex-harness.live-helpers.test.ts b/src/gateway/gateway-codex-harness.live-helpers.test.ts index caa5ef46d15..265ad217cf4 100644 --- a/src/gateway/gateway-codex-harness.live-helpers.test.ts +++ b/src/gateway/gateway-codex-harness.live-helpers.test.ts @@ -1,10 +1,29 @@ import { describe, expect, it } from "vitest"; import { EXPECTED_CODEX_MODELS_COMMAND_TEXT, + EXPECTED_CODEX_STATUS_COMMAND_TEXT, isExpectedCodexModelsCommandText, + isExpectedCodexStatusCommandText, } from "./gateway-codex-harness.live-helpers.js"; describe("gateway codex harness live helpers", () => { + it("accepts the current codex status prose from the live harness", () => { + const text = + "OpenClaw is running on `openai/gpt-5.5` with low reasoning/text settings. Context is at `22k/272k` tokens, no compactions, and the current session is `agent:dev:live-codex-harness`."; + + expect( + EXPECTED_CODEX_STATUS_COMMAND_TEXT.some((expectedText) => text.includes(expectedText)), + ).toBe(false); + expect(isExpectedCodexStatusCommandText(text)).toBe(true); + }); + + it("rejects status prose for a different codex session", () => { + const text = + "OpenClaw is running on `openai/gpt-5.5` with low reasoning/text settings. Context is at `22k/272k` tokens, no compactions, and the current session is `agent:dev:other`."; + + expect(isExpectedCodexStatusCommandText(text)).toBe(false); + }); + it("accepts the interactive model-selection summary emitted by current codex", () => { const text = [ "`/codex models` opened an interactive model-selection prompt rather than printing a plain list.", diff --git a/src/gateway/gateway-codex-harness.live-helpers.ts b/src/gateway/gateway-codex-harness.live-helpers.ts index cee1176fc9c..eb2600fbc26 100644 --- a/src/gateway/gateway-codex-harness.live-helpers.ts +++ b/src/gateway/gateway-codex-harness.live-helpers.ts @@ -71,6 +71,39 @@ export const EXPECTED_CODEX_MODELS_COMMAND_TEXT = [ "Current OpenClaw session status reports the active model as:", ] as const; +export const EXPECTED_CODEX_STATUS_COMMAND_TEXT = [ + "Codex app-server:", + "Model: `codex/", + "Model: codex/", + "Session: `agent:dev:live-codex-harness`", + "Session: agent:dev:live-codex-harness", + "OpenClaw `", + "OpenClaw status:", + "model `codex/", + "session `agent:dev:live-codex-harness`", + "Model/status card shown above", + "Status shown above.", +] as const; + +export function isExpectedCodexStatusCommandText(text: string): boolean { + const normalized = text.toLowerCase(); + const mentionsOpenClawStatus = + normalized.includes("openclaw is running on") || normalized.includes("openclaw status:"); + const mentionsHarnessSession = + normalized.includes("session: `agent:dev:live-codex-harness`") || + normalized.includes("session: agent:dev:live-codex-harness") || + normalized.includes("session `agent:dev:live-codex-harness`") || + normalized.includes("current session is `agent:dev:live-codex-harness`") || + normalized.includes("current session is agent:dev:live-codex-harness"); + const mentionsModel = + normalized.includes("`openai/") || + normalized.includes(" openai/") || + normalized.includes("`codex/") || + normalized.includes(" codex/"); + + return mentionsOpenClawStatus && mentionsHarnessSession && mentionsModel; +} + export function isExpectedCodexModelsCommandText(text: string): boolean { const normalized = text.toLowerCase(); const mentionsCodexModelsCommand = diff --git a/src/gateway/gateway-codex-harness.live.test.ts b/src/gateway/gateway-codex-harness.live.test.ts index 7d4dd944e7c..6d4795f7771 100644 --- a/src/gateway/gateway-codex-harness.live.test.ts +++ b/src/gateway/gateway-codex-harness.live.test.ts @@ -17,7 +17,9 @@ import { } from "./gateway-cli-backend.live-helpers.js"; import { EXPECTED_CODEX_MODELS_COMMAND_TEXT, + EXPECTED_CODEX_STATUS_COMMAND_TEXT, isExpectedCodexModelsCommandText, + isExpectedCodexStatusCommandText, } from "./gateway-codex-harness.live-helpers.js"; import { assertCronJobMatches, @@ -790,19 +792,8 @@ describeLive("gateway live (Codex harness)", () => { client, sessionKey, command: "/codex status", - expectedText: [ - "Codex app-server:", - "Model: `codex/", - "Model: codex/", - "Session: `agent:dev:live-codex-harness`", - "Session: agent:dev:live-codex-harness", - "OpenClaw `", - "OpenClaw status:", - "model `codex/", - "session `agent:dev:live-codex-harness`", - "Model/status card shown above", - "Status shown above.", - ], + expectedText: [...EXPECTED_CODEX_STATUS_COMMAND_TEXT], + isExpectedText: isExpectedCodexStatusCommandText, }); logCodexLiveStep("codex-status-command", { statusText }); From 940f67e524b8a9c2a40b7c7f06d802917e2fdd54 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 05:01:34 +0100 Subject: [PATCH 226/418] test(docker): use packaged gateway expect-final smoke --- .../e2e/openai-web-search-minimal-docker.sh | 75 +++++++++++-------- test/scripts/docker-build-helper.test.ts | 4 +- 2 files changed, 46 insertions(+), 33 deletions(-) diff --git a/scripts/e2e/openai-web-search-minimal-docker.sh b/scripts/e2e/openai-web-search-minimal-docker.sh index f5c8c02cacf..1ffb61df73c 100755 --- a/scripts/e2e/openai-web-search-minimal-docker.sh +++ b/scripts/e2e/openai-web-search-minimal-docker.sh @@ -359,8 +359,9 @@ node "$entry" gateway health \ --json >/dev/null cat >/tmp/openclaw-openai-web-search-minimal-client.mjs <<'NODE' -import { pathToFileURL } from "node:url"; +import { execFileSync } from "node:child_process"; +const entry = process.env.OPENCLAW_ENTRY; const port = process.env.PORT; const token = process.env.OPENCLAW_GATEWAY_TOKEN; const mode = process.argv[2]; @@ -371,47 +372,59 @@ const message = : "Return exactly OPENCLAW_SCHEMA_E2E_OK."; const id = mode === "reject" ? "schema-reject" : "schema-success"; -if (!port || !token) throw new Error("missing PORT/OPENCLAW_GATEWAY_TOKEN"); -const callGatewayUrl = new URL("dist/gateway/call.js", pathToFileURL(`${process.cwd()}/`)); -const { callGateway } = await import(callGatewayUrl.href); +if (!entry || !port || !token) throw new Error("missing OPENCLAW_ENTRY/PORT/OPENCLAW_GATEWAY_TOKEN"); -async function runAgent() { +const gatewayArgs = [ + entry, + "gateway", + "call", + "--url", + `ws://127.0.0.1:${port}`, + "--token", + token, + "--timeout", + "240000", + "--expect-final", + "--json", +]; + +function gatewayAgent(params) { try { - return await callGateway({ - method: "agent", - params: { - sessionKey, - message, - thinking: "minimal", - deliver: false, - timeout: 180, - idempotencyKey: id, - }, - expectFinal: true, - url: `ws://127.0.0.1:${port}`, - token, - timeoutMs: 240000, - }); + return { + ok: true, + value: JSON.parse(execFileSync("node", [...gatewayArgs, "agent", "--params", JSON.stringify(params)], { + encoding: "utf8", + stdio: ["ignore", "pipe", "pipe"], + })), + }; } catch (error) { - if (mode === "reject") { - console.error(String(error)); - process.exit(0); - } - throw error; + const stderr = typeof error?.stderr === "string" ? error.stderr : ""; + const stdout = typeof error?.stdout === "string" ? error.stdout : ""; + const combined = [String(error), stderr.trim(), stdout.trim()].filter(Boolean).join("\n"); + return { ok: false, error: new Error(combined) }; } } -const result = await runAgent(); +const result = gatewayAgent({ + sessionKey, + message, + thinking: "minimal", + deliver: false, + timeout: 180, + idempotencyKey: id, +}); + if (mode === "reject") { - console.error(JSON.stringify(result)); + console.error(result.ok ? JSON.stringify(result.value) : String(result.error)); process.exit(0); } -if (result?.status !== "ok") { - throw new Error(`agent run did not complete successfully: ${JSON.stringify(result)}`); +if (!result.ok) throw result.error; +if (result.value?.status !== "ok") { + throw new Error(`agent run did not complete successfully: ${JSON.stringify(result.value)}`); } NODE -PORT="$PORT" OPENCLAW_GATEWAY_TOKEN="$TOKEN" node /tmp/openclaw-openai-web-search-minimal-client.mjs success >/tmp/openclaw-openai-web-search-minimal-client-success.log 2>&1 +OPENCLAW_ENTRY="$entry" PORT="$PORT" OPENCLAW_GATEWAY_TOKEN="$TOKEN" node /tmp/openclaw-openai-web-search-minimal-client.mjs success >/tmp/openclaw-openai-web-search-minimal-client-success.log 2>&1 node - "$MOCK_REQUEST_LOG" <<'NODE' const fs = require("node:fs"); @@ -435,7 +448,7 @@ if (success.body.reasoning?.effort === "minimal") { } NODE -PORT="$PORT" OPENCLAW_GATEWAY_TOKEN="$TOKEN" node /tmp/openclaw-openai-web-search-minimal-client.mjs reject >/tmp/openclaw-openai-web-search-minimal-client-reject.log 2>&1 +OPENCLAW_ENTRY="$entry" PORT="$PORT" OPENCLAW_GATEWAY_TOKEN="$TOKEN" node /tmp/openclaw-openai-web-search-minimal-client.mjs reject >/tmp/openclaw-openai-web-search-minimal-client-reject.log 2>&1 for _ in $(seq 1 80); do if grep -Fq "$RAW_SCHEMA_ERROR" "$GATEWAY_LOG"; then diff --git a/test/scripts/docker-build-helper.test.ts b/test/scripts/docker-build-helper.test.ts index 6b7eb1a9ad9..7784160df91 100644 --- a/test/scripts/docker-build-helper.test.ts +++ b/test/scripts/docker-build-helper.test.ts @@ -91,8 +91,8 @@ describe("docker build helper", () => { it("keeps OpenAI web search smoke on one gateway agent connection", () => { const runner = readFileSync(OPENAI_WEB_SEARCH_MINIMAL_E2E_PATH, "utf8"); - expect(runner).toContain('new URL("dist/gateway/call.js"'); - expect(runner).toContain("expectFinal: true"); + expect(runner).toContain('"--expect-final"'); + expect(runner).toContain('[...gatewayArgs, "agent", "--params"'); expect(runner).not.toContain('"agent.wait"'); }); }); From 3c8760f16d735aaf00da6bd45d8928570cb28f8c Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 05:04:47 +0100 Subject: [PATCH 227/418] fix: allow heavyweight docker lanes at low parallelism --- docs/ci.md | 2 +- docs/help/testing.md | 2 +- docs/reference/test.md | 2 +- scripts/test-docker-all.mjs | 69 +++++++---- test/scripts/docker-all-scheduler.test.ts | 138 ++++++++++++++++++++++ 5 files changed, 189 insertions(+), 24 deletions(-) create mode 100644 test/scripts/docker-all-scheduler.test.ts diff --git a/docs/ci.md b/docs/ci.md index bdf13ad82f1..72dfa26d556 100644 --- a/docs/ci.md +++ b/docs/ci.md @@ -127,7 +127,7 @@ act as if every scoped area changed. CI workflow edits validate the Node CI graph plus workflow linting, but do not force Windows, Android, or macOS native builds by themselves; those platform lanes stay scoped to platform source changes. CI routing-only edits, selected cheap core-test fixture edits, and narrow plugin contract helper/test-routing edits use a fast Node-only manifest path: preflight, security, and a single `checks-fast-core` task. That path avoids build artifacts, Node 22 compatibility, channel contracts, full core shards, bundled-plugin shards, and additional guard matrices when the changed files are limited to the routing or helper surfaces that the fast task exercises directly. Windows Node checks are scoped to Windows-specific process/path wrappers, npm/pnpm/UI runner helpers, package manager config, and the CI workflow surfaces that execute that lane; unrelated source, plugin, install-smoke, and test-only changes stay on the Linux Node lanes so they do not reserve a 16-vCPU Windows worker for coverage that is already exercised by the normal test shards. -The separate `install-smoke` workflow reuses the same scope script through its own `preflight` job. It splits smoke coverage into `run_fast_install_smoke` and `run_full_install_smoke`. Pull requests run the fast path for Docker/package surfaces, bundled plugin package/manifest changes, and core plugin/channel/gateway/Plugin SDK surfaces that the Docker smoke jobs exercise. Source-only bundled plugin changes, test-only edits, and docs-only edits do not reserve Docker workers. The fast path builds the root Dockerfile image once, checks the CLI, runs the agents delete shared-workspace CLI smoke, runs the container gateway-network e2e, verifies a bundled extension build arg, and runs the bounded bundled-plugin Docker profile under a 240-second aggregate command timeout with each scenario's Docker run capped separately. The full path keeps QR package install and installer Docker/update coverage for nightly scheduled runs, manual dispatches, workflow-call release checks, and pull requests that truly touch installer/package/Docker surfaces. `main` pushes, including merge commits, do not force the full path; when changed-scope logic would request full coverage on a push, the workflow keeps the fast Docker smoke and leaves the full install smoke to nightly or release validation. The slow Bun global install image-provider smoke is separately gated by `run_bun_global_install_smoke`; it runs on the nightly schedule and from the release checks workflow, and manual `install-smoke` dispatches can opt into it, but pull requests and `main` pushes do not run it. QR and installer Docker tests keep their own install-focused Dockerfiles. Local `test:docker:all` prebuilds one shared live-test image, packs OpenClaw once as an npm tarball, and builds two shared `scripts/e2e/Dockerfile` images: a bare Node/Git runner for installer/update/plugin-dependency lanes and a functional image that installs the same tarball into `/app` for normal functionality lanes. Docker lane definitions live in `scripts/lib/docker-e2e-scenarios.mjs`, planner logic lives in `scripts/lib/docker-e2e-plan.mjs`, and the runner only executes the selected plan. The scheduler selects the image per lane with `OPENCLAW_DOCKER_E2E_BARE_IMAGE` and `OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE`, then runs lanes with `OPENCLAW_SKIP_DOCKER_BUILD=1`; tune the default main-pool slot count of 10 with `OPENCLAW_DOCKER_ALL_PARALLELISM` and the provider-sensitive tail-pool slot count of 10 with `OPENCLAW_DOCKER_ALL_TAIL_PARALLELISM`. Heavy lane caps default to `OPENCLAW_DOCKER_ALL_LIVE_LIMIT=9`, `OPENCLAW_DOCKER_ALL_NPM_LIMIT=10`, and `OPENCLAW_DOCKER_ALL_SERVICE_LIMIT=7` so npm install and multi-service lanes do not overcommit Docker while lighter lanes still fill available slots. Lane starts are staggered by 2 seconds by default to avoid local Docker daemon create storms; override with `OPENCLAW_DOCKER_ALL_START_STAGGER_MS=0` or another millisecond value. The local aggregate preflights Docker, removes stale OpenClaw E2E containers, emits active-lane status, persists lane timings for longest-first ordering, and supports `OPENCLAW_DOCKER_ALL_DRY_RUN=1` for scheduler inspection. It stops scheduling new pooled lanes after the first failure by default, and each lane has a 120-minute fallback timeout overrideable with `OPENCLAW_DOCKER_ALL_LANE_TIMEOUT_MS`; selected live/tail lanes use tighter per-lane caps. `OPENCLAW_DOCKER_ALL_LANES=` runs exact scheduler lanes, including release-only lanes such as `install-e2e` and split bundled update lanes such as `bundled-channel-update-acpx`, while skipping the cleanup smoke so agents can reproduce one failed lane. The reusable live/E2E workflow asks `scripts/test-docker-all.mjs --plan-json` which package, image kind, live image, lane, and credential coverage is required, then `scripts/docker-e2e.mjs` converts that plan into GitHub outputs and summaries. It either packs OpenClaw through `scripts/package-openclaw-for-docker.mjs` or downloads a caller-provided package artifact, validates the tarball inventory, builds and pushes package-digest-tagged bare/functional GHCR Docker E2E images when the plan needs package-installed lanes, and reuses those images when the same package digest has already been prepared. The `Package Acceptance` workflow is the high-level package gate: it resolves a candidate from npm, a trusted `package_ref`, an HTTPS tarball plus SHA-256, or a prior workflow artifact, then passes that single `package-under-test` artifact into the reusable Docker E2E workflow. It keeps `workflow_ref` separate from `package_ref` so current harness logic can validate older trusted source commits without checking out old workflow code. Release checks run the `package` acceptance profile for the target ref; that profile covers package/update/plugin contracts and is the default GitHub-native replacement for most Parallels package/update coverage. The release-path Docker suite runs as at most three chunked jobs with `OPENCLAW_SKIP_DOCKER_BUILD=1` so each chunk pulls only the image kind it needs and executes multiple lanes through the same weighted scheduler (`OPENCLAW_DOCKER_ALL_PROFILE=release-path`, `OPENCLAW_DOCKER_ALL_CHUNK=core|package-update|plugins-integrations`). Each chunk uploads `.artifacts/docker-tests/` with lane logs, timings, `summary.json`, `failures.json`, phase timings, scheduler plan JSON, and per-lane rerun commands. The workflow `docker_lanes` input runs selected lanes against the prepared images instead of the three chunk jobs, which keeps failed-lane debugging bounded to one targeted Docker job and prepares or downloads the package artifact for that run; if a selected lane is a live Docker lane, the targeted job builds the live-test image locally for that rerun. Use `pnpm test:docker:rerun ` to download Docker artifacts from a GitHub run and print combined/per-lane targeted rerun commands; use `pnpm test:docker:timings ` for slow-lane and phase critical-path summaries. When Open WebUI is requested with the release-path suite, it runs inside the plugins/integrations chunk instead of reserving a fourth Docker worker; Open WebUI keeps a standalone job only for openwebui-only dispatches. The scheduled live/E2E workflow runs the full release-path Docker suite daily. The bundled update matrix is split by update target so repeated npm update and doctor repair passes can shard with other bundled checks. +The separate `install-smoke` workflow reuses the same scope script through its own `preflight` job. It splits smoke coverage into `run_fast_install_smoke` and `run_full_install_smoke`. Pull requests run the fast path for Docker/package surfaces, bundled plugin package/manifest changes, and core plugin/channel/gateway/Plugin SDK surfaces that the Docker smoke jobs exercise. Source-only bundled plugin changes, test-only edits, and docs-only edits do not reserve Docker workers. The fast path builds the root Dockerfile image once, checks the CLI, runs the agents delete shared-workspace CLI smoke, runs the container gateway-network e2e, verifies a bundled extension build arg, and runs the bounded bundled-plugin Docker profile under a 240-second aggregate command timeout with each scenario's Docker run capped separately. The full path keeps QR package install and installer Docker/update coverage for nightly scheduled runs, manual dispatches, workflow-call release checks, and pull requests that truly touch installer/package/Docker surfaces. `main` pushes, including merge commits, do not force the full path; when changed-scope logic would request full coverage on a push, the workflow keeps the fast Docker smoke and leaves the full install smoke to nightly or release validation. The slow Bun global install image-provider smoke is separately gated by `run_bun_global_install_smoke`; it runs on the nightly schedule and from the release checks workflow, and manual `install-smoke` dispatches can opt into it, but pull requests and `main` pushes do not run it. QR and installer Docker tests keep their own install-focused Dockerfiles. Local `test:docker:all` prebuilds one shared live-test image, packs OpenClaw once as an npm tarball, and builds two shared `scripts/e2e/Dockerfile` images: a bare Node/Git runner for installer/update/plugin-dependency lanes and a functional image that installs the same tarball into `/app` for normal functionality lanes. Docker lane definitions live in `scripts/lib/docker-e2e-scenarios.mjs`, planner logic lives in `scripts/lib/docker-e2e-plan.mjs`, and the runner only executes the selected plan. The scheduler selects the image per lane with `OPENCLAW_DOCKER_E2E_BARE_IMAGE` and `OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE`, then runs lanes with `OPENCLAW_SKIP_DOCKER_BUILD=1`; tune the default main-pool slot count of 10 with `OPENCLAW_DOCKER_ALL_PARALLELISM` and the provider-sensitive tail-pool slot count of 10 with `OPENCLAW_DOCKER_ALL_TAIL_PARALLELISM`. Heavy lane caps default to `OPENCLAW_DOCKER_ALL_LIVE_LIMIT=9`, `OPENCLAW_DOCKER_ALL_NPM_LIMIT=10`, and `OPENCLAW_DOCKER_ALL_SERVICE_LIMIT=7` so npm install and multi-service lanes do not overcommit Docker while lighter lanes still fill available slots. A single lane heavier than the effective caps can still start from an empty pool, then runs alone until it releases capacity. Lane starts are staggered by 2 seconds by default to avoid local Docker daemon create storms; override with `OPENCLAW_DOCKER_ALL_START_STAGGER_MS=0` or another millisecond value. The local aggregate preflights Docker, removes stale OpenClaw E2E containers, emits active-lane status, persists lane timings for longest-first ordering, and supports `OPENCLAW_DOCKER_ALL_DRY_RUN=1` for scheduler inspection. It stops scheduling new pooled lanes after the first failure by default, and each lane has a 120-minute fallback timeout overrideable with `OPENCLAW_DOCKER_ALL_LANE_TIMEOUT_MS`; selected live/tail lanes use tighter per-lane caps. `OPENCLAW_DOCKER_ALL_LANES=` runs exact scheduler lanes, including release-only lanes such as `install-e2e` and split bundled update lanes such as `bundled-channel-update-acpx`, while skipping the cleanup smoke so agents can reproduce one failed lane. The reusable live/E2E workflow asks `scripts/test-docker-all.mjs --plan-json` which package, image kind, live image, lane, and credential coverage is required, then `scripts/docker-e2e.mjs` converts that plan into GitHub outputs and summaries. It either packs OpenClaw through `scripts/package-openclaw-for-docker.mjs` or downloads a caller-provided package artifact, validates the tarball inventory, builds and pushes package-digest-tagged bare/functional GHCR Docker E2E images when the plan needs package-installed lanes, and reuses those images when the same package digest has already been prepared. The `Package Acceptance` workflow is the high-level package gate: it resolves a candidate from npm, a trusted `package_ref`, an HTTPS tarball plus SHA-256, or a prior workflow artifact, then passes that single `package-under-test` artifact into the reusable Docker E2E workflow. It keeps `workflow_ref` separate from `package_ref` so current acceptance logic can validate older trusted commits without checking out old workflow code. Release checks run the `package` acceptance profile for the target ref; that profile covers package/update/plugin contracts and is the default GitHub-native replacement for most Parallels package/update coverage. The release-path Docker suite runs as at most three chunked jobs with `OPENCLAW_SKIP_DOCKER_BUILD=1` so each chunk pulls only the image kind it needs and executes multiple lanes through the same weighted scheduler (`OPENCLAW_DOCKER_ALL_PROFILE=release-path`, `OPENCLAW_DOCKER_ALL_CHUNK=core|package-update|plugins-integrations`). Each chunk uploads `.artifacts/docker-tests/` with lane logs, timings, `summary.json`, `failures.json`, phase timings, scheduler plan JSON, and per-lane rerun commands. The workflow `docker_lanes` input runs selected lanes against the prepared images instead of the three chunk jobs, which keeps failed-lane debugging bounded to one targeted Docker job and prepares or downloads the package artifact for that run; if a selected lane is a live Docker lane, the targeted job builds the live-test image locally for that rerun. Use `pnpm test:docker:rerun ` to download Docker artifacts from a GitHub run and print combined/per-lane targeted rerun commands; use `pnpm test:docker:timings ` for slow-lane and phase critical-path summaries. When Open WebUI is requested with the release-path suite, it runs inside the plugins/integrations chunk instead of reserving a fourth Docker worker; Open WebUI keeps a standalone job only for openwebui-only dispatches. The scheduled live/E2E workflow runs the full release-path Docker suite daily. The bundled update matrix is split by update target so repeated npm update and doctor repair passes can shard with other bundled checks. Local changed-lane logic lives in `scripts/changed-lanes.mjs` and is executed by `scripts/check-changed.mjs`. That local check gate is stricter about architecture boundaries than the broad CI platform scope: core production changes run core prod and core test typecheck plus core lint/guards, core test-only changes run only core test typecheck plus core lint, extension production changes run extension prod and extension test typecheck plus extension lint, and extension test-only changes run extension test typecheck plus extension lint. Public Plugin SDK or plugin-contract changes expand to extension typecheck because extensions depend on those core contracts, but Vitest extension sweeps are explicit test work. Release metadata-only version bumps run targeted version/config/root-dependency checks. Unknown root/config changes fail safe to all check lanes. diff --git a/docs/help/testing.md b/docs/help/testing.md index 5822ea4e05f..5c1d9bb271e 100644 --- a/docs/help/testing.md +++ b/docs/help/testing.md @@ -643,7 +643,7 @@ These Docker runners split into two buckets: `OPENCLAW_LIVE_GATEWAY_STEP_TIMEOUT_MS=45000`, and `OPENCLAW_LIVE_GATEWAY_MODEL_TIMEOUT_MS=90000`. Override those env vars when you explicitly want the larger exhaustive scan. -- `test:docker:all` builds the live Docker image once via `test:docker:live-build`, packs OpenClaw once as an npm tarball through `scripts/package-openclaw-for-docker.mjs`, then builds/reuses two `scripts/e2e/Dockerfile` images. The bare image is only the Node/Git runner for install/update/plugin-dependency lanes; those lanes mount the prebuilt tarball. The functional image installs the same tarball into `/app` for built-app functionality lanes. Docker lane definitions live in `scripts/lib/docker-e2e-scenarios.mjs`; planner logic lives in `scripts/lib/docker-e2e-plan.mjs`; `scripts/test-docker-all.mjs` executes the selected plan. The aggregate uses a weighted local scheduler: `OPENCLAW_DOCKER_ALL_PARALLELISM` controls process slots, while resource caps keep heavy live, npm-install, and multi-service lanes from all starting at once. Defaults are 10 slots, `OPENCLAW_DOCKER_ALL_LIVE_LIMIT=9`, `OPENCLAW_DOCKER_ALL_NPM_LIMIT=10`, and `OPENCLAW_DOCKER_ALL_SERVICE_LIMIT=7`; tune `OPENCLAW_DOCKER_ALL_WEIGHT_LIMIT` or `OPENCLAW_DOCKER_ALL_DOCKER_LIMIT` only when the Docker host has more headroom. The runner performs a Docker preflight by default, removes stale OpenClaw E2E containers, prints status every 30 seconds, stores successful lane timings in `.artifacts/docker-tests/lane-timings.json`, and uses those timings to start longer lanes first on later runs. Use `OPENCLAW_DOCKER_ALL_DRY_RUN=1` to print the weighted lane manifest without building or running Docker, or `node scripts/test-docker-all.mjs --plan-json` to print the CI plan for selected lanes, package/image needs, and credentials. +- `test:docker:all` builds the live Docker image once via `test:docker:live-build`, packs OpenClaw once as an npm tarball through `scripts/package-openclaw-for-docker.mjs`, then builds/reuses two `scripts/e2e/Dockerfile` images. The bare image is only the Node/Git runner for install/update/plugin-dependency lanes; those lanes mount the prebuilt tarball. The functional image installs the same tarball into `/app` for built-app functionality lanes. Docker lane definitions live in `scripts/lib/docker-e2e-scenarios.mjs`; planner logic lives in `scripts/lib/docker-e2e-plan.mjs`; `scripts/test-docker-all.mjs` executes the selected plan. The aggregate uses a weighted local scheduler: `OPENCLAW_DOCKER_ALL_PARALLELISM` controls process slots, while resource caps keep heavy live, npm-install, and multi-service lanes from all starting at once. If a single lane is heavier than the active caps, the scheduler can still start it when the pool is empty and then keeps it running alone until capacity is available again. Defaults are 10 slots, `OPENCLAW_DOCKER_ALL_LIVE_LIMIT=9`, `OPENCLAW_DOCKER_ALL_NPM_LIMIT=10`, and `OPENCLAW_DOCKER_ALL_SERVICE_LIMIT=7`; tune `OPENCLAW_DOCKER_ALL_WEIGHT_LIMIT` or `OPENCLAW_DOCKER_ALL_DOCKER_LIMIT` only when the Docker host has more headroom. The runner performs a Docker preflight by default, removes stale OpenClaw E2E containers, prints status every 30 seconds, stores successful lane timings in `.artifacts/docker-tests/lane-timings.json`, and uses those timings to start longer lanes first on later runs. Use `OPENCLAW_DOCKER_ALL_DRY_RUN=1` to print the weighted lane manifest without building or running Docker, or `node scripts/test-docker-all.mjs --plan-json` to print the CI plan for selected lanes, package/image needs, and credentials. - `Package Acceptance` is the GitHub-native package gate for "does this installable tarball work as a product?" It resolves one candidate package from `source=npm`, `source=ref`, `source=url`, or `source=artifact`, uploads it as `package-under-test`, then runs the reusable Docker E2E lanes against that exact tarball instead of repacking the selected ref. `workflow_ref` selects the trusted workflow/harness scripts, while `package_ref` selects the source commit/branch/tag to pack when `source=ref`; this lets current acceptance logic validate older trusted commits. Profiles are ordered by breadth: `smoke` is quick install/channel/agent plus gateway/config, `package` is the package/update/plugin contract and the default native replacement for most Parallels package/update coverage, `product` adds MCP channels, cron/subagent cleanup, OpenAI web search, and OpenWebUI, and `full` runs the release-path Docker chunks with OpenWebUI. Release validation runs the `package` profile for the target ref. - Container smoke runners: `test:docker:openwebui`, `test:docker:onboard`, `test:docker:npm-onboard-channel-agent`, `test:docker:update-channel-switch`, `test:docker:session-runtime-context`, `test:docker:agents-delete-shared-workspace`, `test:docker:gateway-network`, `test:docker:browser-cdp-snapshot`, `test:docker:mcp-channels`, `test:docker:pi-bundle-mcp-tools`, `test:docker:cron-mcp-cleanup`, `test:docker:plugins`, `test:docker:plugin-update`, and `test:docker:config-reload` boot one or more real containers and verify higher-level integration paths. diff --git a/docs/reference/test.md b/docs/reference/test.md index c375b83338c..a3ea86aa76b 100644 --- a/docs/reference/test.md +++ b/docs/reference/test.md @@ -34,7 +34,7 @@ title: "Tests" - Gateway integration: opt-in via `OPENCLAW_TEST_INCLUDE_GATEWAY=1 pnpm test` or `pnpm test:gateway`. - `pnpm test:e2e`: Runs gateway end-to-end smoke tests (multi-instance WS/HTTP/node pairing). Defaults to `threads` + `isolate: false` with adaptive workers in `vitest.e2e.config.ts`; tune with `OPENCLAW_E2E_WORKERS=` and set `OPENCLAW_E2E_VERBOSE=1` for verbose logs. - `pnpm test:live`: Runs provider live tests (minimax/zai). Requires API keys and `LIVE=1` (or provider-specific `*_LIVE_TEST=1`) to unskip. -- `pnpm test:docker:all`: Builds the shared live-test image, packs OpenClaw once as an npm tarball, builds/reuses a bare Node/Git runner image plus a functional image that installs that tarball into `/app`, then runs Docker smoke lanes with `OPENCLAW_SKIP_DOCKER_BUILD=1` through a weighted scheduler. The bare image (`OPENCLAW_DOCKER_E2E_BARE_IMAGE`) is used for installer/update/plugin-dependency lanes; those lanes mount the prebuilt tarball instead of using copied repo sources. The functional image (`OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE`) is used for normal built-app functionality lanes. `scripts/package-openclaw-for-docker.mjs` is the single local/CI package packer and validates the tarball plus `dist/postinstall-inventory.json` before Docker consumes it. Docker lane definitions live in `scripts/lib/docker-e2e-scenarios.mjs`; planner logic lives in `scripts/lib/docker-e2e-plan.mjs`; `scripts/test-docker-all.mjs` executes the selected plan. `node scripts/test-docker-all.mjs --plan-json` emits the scheduler-owned CI plan for selected lanes, image kinds, package/live-image needs, and credential checks without building or running Docker. `OPENCLAW_DOCKER_ALL_PARALLELISM=` controls process slots and defaults to 10; `OPENCLAW_DOCKER_ALL_TAIL_PARALLELISM=` controls the provider-sensitive tail pool and defaults to 10. Heavy lane caps default to `OPENCLAW_DOCKER_ALL_LIVE_LIMIT=9`, `OPENCLAW_DOCKER_ALL_NPM_LIMIT=10`, and `OPENCLAW_DOCKER_ALL_SERVICE_LIMIT=7`; provider caps default to one heavy lane per provider via `OPENCLAW_DOCKER_ALL_LIVE_CLAUDE_LIMIT=4`, `OPENCLAW_DOCKER_ALL_LIVE_CODEX_LIMIT=4`, and `OPENCLAW_DOCKER_ALL_LIVE_GEMINI_LIMIT=4`. Use `OPENCLAW_DOCKER_ALL_WEIGHT_LIMIT` or `OPENCLAW_DOCKER_ALL_DOCKER_LIMIT` for larger hosts. Lane starts are staggered by 2 seconds by default to avoid local Docker daemon create storms; override with `OPENCLAW_DOCKER_ALL_START_STAGGER_MS=`. The runner preflights Docker by default, cleans stale OpenClaw E2E containers, emits active-lane status every 30 seconds, shares provider CLI tool caches between compatible lanes, retries transient live-provider failures once by default (`OPENCLAW_DOCKER_ALL_LIVE_RETRIES=`), and stores lane timings in `.artifacts/docker-tests/lane-timings.json` for longest-first ordering on later runs. Use `OPENCLAW_DOCKER_ALL_DRY_RUN=1` to print the lane manifest without running Docker, `OPENCLAW_DOCKER_ALL_STATUS_INTERVAL_MS=` to tune status output, or `OPENCLAW_DOCKER_ALL_TIMINGS=0` to disable timing reuse. Use `OPENCLAW_DOCKER_ALL_LIVE_MODE=skip` for deterministic/local lanes only or `OPENCLAW_DOCKER_ALL_LIVE_MODE=only` for live-provider lanes only; package aliases are `pnpm test:docker:local:all` and `pnpm test:docker:live:all`. Live-only mode merges main and tail live lanes into one longest-first pool so provider buckets can pack Claude, Codex, and Gemini work together. The runner stops scheduling new pooled lanes after the first failure unless `OPENCLAW_DOCKER_ALL_FAIL_FAST=0` is set, and each lane has a 120-minute fallback timeout overrideable with `OPENCLAW_DOCKER_ALL_LANE_TIMEOUT_MS`; selected live/tail lanes use tighter per-lane caps. CLI backend Docker setup commands have their own timeout via `OPENCLAW_LIVE_CLI_BACKEND_SETUP_TIMEOUT_SECONDS` (default 180). Per-lane logs, `summary.json`, `failures.json`, and phase timings are written under `.artifacts/docker-tests//`; use `pnpm test:docker:timings ` to inspect slow lanes and `pnpm test:docker:rerun ` to print cheap targeted rerun commands. +- `pnpm test:docker:all`: Builds the shared live-test image, packs OpenClaw once as an npm tarball, builds/reuses a bare Node/Git runner image plus a functional image that installs that tarball into `/app`, then runs Docker smoke lanes with `OPENCLAW_SKIP_DOCKER_BUILD=1` through a weighted scheduler. The bare image (`OPENCLAW_DOCKER_E2E_BARE_IMAGE`) is used for installer/update/plugin-dependency lanes; those lanes mount the prebuilt tarball instead of using copied repo sources. The functional image (`OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE`) is used for normal built-app functionality lanes. `scripts/package-openclaw-for-docker.mjs` is the single local/CI package packer and validates the tarball plus `dist/postinstall-inventory.json` before Docker consumes it. Docker lane definitions live in `scripts/lib/docker-e2e-scenarios.mjs`; planner logic lives in `scripts/lib/docker-e2e-plan.mjs`; `scripts/test-docker-all.mjs` executes the selected plan. `node scripts/test-docker-all.mjs --plan-json` emits the scheduler-owned CI plan for selected lanes, image kinds, package/live-image needs, and credential checks without building or running Docker. `OPENCLAW_DOCKER_ALL_PARALLELISM=` controls process slots and defaults to 10; `OPENCLAW_DOCKER_ALL_TAIL_PARALLELISM=` controls the provider-sensitive tail pool and defaults to 10. Heavy lane caps default to `OPENCLAW_DOCKER_ALL_LIVE_LIMIT=9`, `OPENCLAW_DOCKER_ALL_NPM_LIMIT=10`, and `OPENCLAW_DOCKER_ALL_SERVICE_LIMIT=7`; provider caps default to one heavy lane per provider via `OPENCLAW_DOCKER_ALL_LIVE_CLAUDE_LIMIT=4`, `OPENCLAW_DOCKER_ALL_LIVE_CODEX_LIMIT=4`, and `OPENCLAW_DOCKER_ALL_LIVE_GEMINI_LIMIT=4`. Use `OPENCLAW_DOCKER_ALL_WEIGHT_LIMIT` or `OPENCLAW_DOCKER_ALL_DOCKER_LIMIT` for larger hosts. If one lane exceeds the effective weight or resource cap on a low-parallelism host, it can still start from an empty pool and will run alone until it releases capacity. Lane starts are staggered by 2 seconds by default to avoid local Docker daemon create storms; override with `OPENCLAW_DOCKER_ALL_START_STAGGER_MS=`. The runner preflights Docker by default, cleans stale OpenClaw E2E containers, emits active-lane status every 30 seconds, shares provider CLI tool caches between compatible lanes, retries transient live-provider failures once by default (`OPENCLAW_DOCKER_ALL_LIVE_RETRIES=`), and stores lane timings in `.artifacts/docker-tests/lane-timings.json` for longest-first ordering on later runs. Use `OPENCLAW_DOCKER_ALL_DRY_RUN=1` to print the lane manifest without running Docker, `OPENCLAW_DOCKER_ALL_STATUS_INTERVAL_MS=` to tune status output, or `OPENCLAW_DOCKER_ALL_TIMINGS=0` to disable timing reuse. Use `OPENCLAW_DOCKER_ALL_LIVE_MODE=skip` for deterministic/local lanes only or `OPENCLAW_DOCKER_ALL_LIVE_MODE=only` for live-provider lanes only; package aliases are `pnpm test:docker:local:all` and `pnpm test:docker:live:all`. Live-only mode merges main and tail live lanes into one longest-first pool so provider buckets can pack Claude, Codex, and Gemini work together. The runner stops scheduling new pooled lanes after the first failure unless `OPENCLAW_DOCKER_ALL_FAIL_FAST=0` is set, and each lane has a 120-minute fallback timeout overrideable with `OPENCLAW_DOCKER_ALL_LANE_TIMEOUT_MS`; selected live/tail lanes use tighter per-lane caps. CLI backend Docker setup commands have their own timeout via `OPENCLAW_LIVE_CLI_BACKEND_SETUP_TIMEOUT_SECONDS` (default 180). Per-lane logs, `summary.json`, `failures.json`, and phase timings are written under `.artifacts/docker-tests//`; use `pnpm test:docker:timings ` to inspect slow lanes and `pnpm test:docker:rerun ` to print cheap targeted rerun commands. - `pnpm test:docker:browser-cdp-snapshot`: Builds a Chromium-backed source E2E container, starts raw CDP plus an isolated Gateway, runs `browser doctor --deep`, and verifies CDP role snapshots include link URLs, cursor-promoted clickables, iframe refs, and frame metadata. - CLI backend live Docker probes can be run as focused lanes, for example `pnpm test:docker:live-cli-backend:codex`, `pnpm test:docker:live-cli-backend:codex:resume`, or `pnpm test:docker:live-cli-backend:codex:mcp`. Claude and Gemini have matching `:resume` and `:mcp` aliases. - `pnpm test:docker:openwebui`: Starts Dockerized OpenClaw + Open WebUI, signs in through Open WebUI, checks `/api/models`, then runs a real proxied chat through `/api/chat/completions`. Requires a usable live model key (for example OpenAI in `~/.profile`), pulls an external Open WebUI image, and is not expected to be CI-stable like the normal unit/e2e suites. diff --git a/scripts/test-docker-all.mjs b/scripts/test-docker-all.mjs index fb3dcafe23e..3a6c7b6abac 100644 --- a/scripts/test-docker-all.mjs +++ b/scripts/test-docker-all.mjs @@ -36,10 +36,15 @@ const DEFAULT_STATUS_INTERVAL_MS = 30_000; const DEFAULT_PREFLIGHT_RUN_TIMEOUT_MS = 60_000; const DEFAULT_TIMINGS_FILE = path.join(ROOT_DIR, ".artifacts/docker-tests/lane-timings.json"); const DEFAULT_GITHUB_WORKFLOW = "openclaw-live-and-e2e-checks-reusable.yml"; -const cliArgs = new Set(process.argv.slice(2)); -for (const arg of cliArgs) { - if (arg !== "--plan-json") { - throw new Error(`unknown argument: ${arg}`); +const IS_MAIN = process.argv[1] + ? path.resolve(process.argv[1]) === fileURLToPath(import.meta.url) + : false; +const cliArgs = new Set(IS_MAIN ? process.argv.slice(2) : []); +if (IS_MAIN) { + for (const arg of cliArgs) { + if (arg !== "--plan-json") { + throw new Error(`unknown argument: ${arg}`); + } } } @@ -82,6 +87,12 @@ function resourceLimitEnvName(resource) { return `OPENCLAW_DOCKER_ALL_${resource.toUpperCase().replace(/[^A-Z0-9]+/g, "_")}_LIMIT`; } +export function describeDockerSchedulerLimits(parallelism, options) { + return `parallelism=${parallelism} weightLimit=${options.weightLimit} resources=${resourceLimitsSummary( + options.resourceLimits, + )}`; +} + function parseResourceLimit(env, resource, parallelism, fallback) { const envName = resourceLimitEnvName(resource); return parsePositiveInt(env[envName], Math.min(parallelism, fallback), envName); @@ -103,6 +114,26 @@ function parseSchedulerOptions(env, parallelism) { }; } +export function canStartSchedulerLane(candidate, active, parallelism, options) { + const weight = laneWeight(candidate); + if (active.count >= parallelism) { + return false; + } + + const exceedsWeightLimit = active.weight + weight > options.weightLimit; + const exceedsResourceLimit = laneResources(candidate).some((resource) => { + const limit = options.resourceLimits[resource] ?? options.weightLimit; + const current = active.resources.get(resource) ?? 0; + return current + weight > limit; + }); + + if (!exceedsWeightLimit && !exceedsResourceLimit) { + return true; + } + + return active.count === 0; +} + function timingSeconds(timingStore, poolLane) { const fromStore = timingStore?.lanes?.[poolLane.name]?.durationSeconds; if (typeof fromStore === "number" && Number.isFinite(fromStore) && fromStore > 0) { @@ -746,18 +777,7 @@ async function runLanePool(poolLanes, baseEnv, logDir, parallelism, options) { } function canStartLane(candidate) { - const weight = laneWeight(candidate); - if (active.count >= parallelism || active.weight + weight > options.weightLimit) { - return false; - } - for (const resource of laneResources(candidate)) { - const limit = options.resourceLimits[resource] ?? options.weightLimit; - const current = active.resources.get(resource) ?? 0; - if (current + weight > limit) { - return false; - } - } - return true; + return canStartSchedulerLane(candidate, active, parallelism, options); } function reserve(candidate) { @@ -818,7 +838,12 @@ async function runLanePool(poolLanes, baseEnv, logDir, parallelism, options) { } if (running.size === 0) { const blocked = pending.map(laneSummary).join(", "); - throw new Error(`No Docker lanes fit scheduler limits: ${blocked}`); + throw new Error( + `No Docker lanes fit scheduler limits (${describeDockerSchedulerLimits( + parallelism, + options, + )}): ${blocked}. Tune OPENCLAW_DOCKER_ALL_PARALLELISM, OPENCLAW_DOCKER_ALL_WEIGHT_LIMIT, or OPENCLAW_DOCKER_ALL__LIMIT.`, + ); } const { promise, result } = await Promise.race(running); @@ -1217,7 +1242,9 @@ async function main() { console.log("==> Docker test suite passed"); } -await main().catch((error) => { - console.error(error instanceof Error ? error.message : String(error)); - process.exit(1); -}); +if (IS_MAIN) { + await main().catch((error) => { + console.error(error instanceof Error ? error.message : String(error)); + process.exit(1); + }); +} diff --git a/test/scripts/docker-all-scheduler.test.ts b/test/scripts/docker-all-scheduler.test.ts new file mode 100644 index 00000000000..28f0856f1ca --- /dev/null +++ b/test/scripts/docker-all-scheduler.test.ts @@ -0,0 +1,138 @@ +import { describe, expect, it } from "vitest"; +import { + canStartSchedulerLane, + describeDockerSchedulerLimits, +} from "../../scripts/test-docker-all.mjs"; + +const limits = { + resourceLimits: { + docker: 2, + npm: 2, + }, + weightLimit: 2, +}; + +function activePool({ + count = 0, + resources = {}, + weight = 0, +}: { + count?: number; + resources?: Record; + weight?: number; +} = {}) { + return { + count, + resources: new Map(Object.entries(resources)), + weight, + }; +} + +describe("scripts/test-docker-all scheduler", () => { + it("allows an overweight lane to start alone under low parallelism", () => { + expect( + canStartSchedulerLane( + { + name: "install-e2e", + resources: ["npm"], + weight: 4, + }, + activePool(), + 2, + limits, + ), + ).toBe(true); + }); + + it("does not co-schedule another lane while an overweight lane is active", () => { + expect( + canStartSchedulerLane( + { + name: "package-update", + resources: ["npm"], + weight: 1, + }, + activePool({ + count: 1, + resources: { + docker: 4, + npm: 4, + }, + weight: 4, + }), + 2, + limits, + ), + ).toBe(false); + }); + + it("preserves the parallelism count cap", () => { + expect( + canStartSchedulerLane( + { + name: "package-update", + resources: ["npm"], + weight: 1, + }, + activePool({ + count: 2, + resources: { + docker: 1, + npm: 1, + }, + weight: 1, + }), + 2, + limits, + ), + ).toBe(false); + }); + + it("keeps resource and weight limits as co-scheduling limits", () => { + expect( + canStartSchedulerLane( + { + name: "npm-smoke", + resources: ["npm"], + weight: 1, + }, + activePool({ + count: 1, + resources: { + docker: 1, + npm: 1, + }, + weight: 1, + }), + 2, + limits, + ), + ).toBe(true); + + expect( + canStartSchedulerLane( + { + name: "npm-heavy", + resources: ["npm"], + weight: 2, + }, + activePool({ + count: 1, + resources: { + docker: 1, + npm: 1, + }, + weight: 1, + }), + 2, + limits, + ), + ).toBe(false); + }); + + it("describes effective scheduler limits for operator errors", () => { + expect(describeDockerSchedulerLimits(2, limits)).toBe( + "parallelism=2 weightLimit=2 resources=docker=2 npm=2", + ); + }); +}); From 4cc572a813ad13f72a4eacccf851f0bad0f91eb7 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 21:06:29 -0700 Subject: [PATCH 228/418] ci(testbox): save build artifact cache before wait --- .github/workflows/ci-build-artifacts-testbox.yml | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci-build-artifacts-testbox.yml b/.github/workflows/ci-build-artifacts-testbox.yml index 350fb9c837e..55027c00406 100644 --- a/.github/workflows/ci-build-artifacts-testbox.yml +++ b/.github/workflows/ci-build-artifacts-testbox.yml @@ -135,7 +135,7 @@ jobs: - name: Restore dist build cache id: dist-cache - uses: actions/cache@v5 + uses: actions/cache/restore@v5 with: path: | .artifacts/build-all-cache/ @@ -166,6 +166,16 @@ jobs: test -f dist/build-info.json test -f dist/control-ui/index.html + - name: Save dist build cache + if: steps.dist-cache.outputs.cache-hit != 'true' + uses: actions/cache/save@v5 + with: + path: | + .artifacts/build-all-cache/ + dist/ + dist-runtime/ + key: ${{ runner.os }}-dist-build-${{ github.sha }} + - name: Prepare Testbox shell shell: bash run: | From a33a2c97a373ebe200058da7fc1a74948c9c32c3 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 21:06:29 -0700 Subject: [PATCH 229/418] ci(testbox): save build artifact cache before wait --- .github/workflows/ci-build-artifacts-testbox.yml | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci-build-artifacts-testbox.yml b/.github/workflows/ci-build-artifacts-testbox.yml index 350fb9c837e..55027c00406 100644 --- a/.github/workflows/ci-build-artifacts-testbox.yml +++ b/.github/workflows/ci-build-artifacts-testbox.yml @@ -135,7 +135,7 @@ jobs: - name: Restore dist build cache id: dist-cache - uses: actions/cache@v5 + uses: actions/cache/restore@v5 with: path: | .artifacts/build-all-cache/ @@ -166,6 +166,16 @@ jobs: test -f dist/build-info.json test -f dist/control-ui/index.html + - name: Save dist build cache + if: steps.dist-cache.outputs.cache-hit != 'true' + uses: actions/cache/save@v5 + with: + path: | + .artifacts/build-all-cache/ + dist/ + dist-runtime/ + key: ${{ runner.os }}-dist-build-${{ github.sha }} + - name: Prepare Testbox shell shell: bash run: | From 0ff0c7ce576427d25483d8e3cdc52d3c4849219f Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 05:07:11 +0100 Subject: [PATCH 230/418] ci: tolerate legacy qa inventory entries --- scripts/check-openclaw-package-tarball.mjs | 39 +++++++++++ .../check-openclaw-package-tarball.test.ts | 70 +++++++++++++++++++ 2 files changed, 109 insertions(+) create mode 100644 test/scripts/check-openclaw-package-tarball.test.ts diff --git a/scripts/check-openclaw-package-tarball.mjs b/scripts/check-openclaw-package-tarball.mjs index bdf62b00ded..7a54fd9dff6 100644 --- a/scripts/check-openclaw-package-tarball.mjs +++ b/scripts/check-openclaw-package-tarball.mjs @@ -37,6 +37,36 @@ const entries = list.stdout const normalized = entries.map((entry) => entry.replace(/^package\//u, "")); const entrySet = new Set(normalized); const errors = []; +const warnings = []; + +const LEGACY_OMITTED_PRIVATE_QA_INVENTORY_PREFIXES = [ + "dist/extensions/qa-channel/", + "dist/extensions/qa-lab/", + "dist/extensions/qa-matrix/", + "dist/plugin-sdk/extensions/qa-channel/", + "dist/plugin-sdk/extensions/qa-lab/", +]; +const LEGACY_OMITTED_PRIVATE_QA_INVENTORY_FILES = new Set([ + "dist/plugin-sdk/qa-channel.d.ts", + "dist/plugin-sdk/qa-channel.js", + "dist/plugin-sdk/qa-channel-protocol.d.ts", + "dist/plugin-sdk/qa-channel-protocol.js", + "dist/plugin-sdk/qa-lab.d.ts", + "dist/plugin-sdk/qa-lab.js", + "dist/plugin-sdk/qa-runtime.d.ts", + "dist/plugin-sdk/qa-runtime.js", + "dist/plugin-sdk/src/plugin-sdk/qa-channel.d.ts", + "dist/plugin-sdk/src/plugin-sdk/qa-channel-protocol.d.ts", + "dist/plugin-sdk/src/plugin-sdk/qa-lab.d.ts", + "dist/plugin-sdk/src/plugin-sdk/qa-runtime.d.ts", +]); + +function isLegacyOmittedPrivateQaInventoryEntry(relativePath) { + return ( + LEGACY_OMITTED_PRIVATE_QA_INVENTORY_FILES.has(relativePath) || + LEGACY_OMITTED_PRIVATE_QA_INVENTORY_PREFIXES.some((prefix) => relativePath.startsWith(prefix)) + ); +} function readTarEntry(entryPath) { const candidates = [entryPath, `package/${entryPath}`]; @@ -76,6 +106,12 @@ if (entrySet.has("dist/postinstall-inventory.json")) { for (const inventoryEntry of inventory) { const normalizedEntry = inventoryEntry.replace(/\\/gu, "/"); if (!entrySet.has(normalizedEntry)) { + if (isLegacyOmittedPrivateQaInventoryEntry(normalizedEntry)) { + warnings.push( + `legacy inventory references omitted private QA tar entry ${normalizedEntry}`, + ); + continue; + } errors.push(`inventory references missing tar entry ${normalizedEntry}`); } } @@ -93,4 +129,7 @@ if (errors.length > 0) { fail(`OpenClaw package tarball integrity failed:\n${errors.join("\n")}`); } +for (const warning of warnings) { + console.warn(`OpenClaw package tarball integrity warning: ${warning}`); +} console.log("OpenClaw package tarball integrity passed."); diff --git a/test/scripts/check-openclaw-package-tarball.test.ts b/test/scripts/check-openclaw-package-tarball.test.ts new file mode 100644 index 00000000000..5d1e987d010 --- /dev/null +++ b/test/scripts/check-openclaw-package-tarball.test.ts @@ -0,0 +1,70 @@ +import { spawnSync } from "node:child_process"; +import { mkdtempSync, rmSync, mkdirSync, writeFileSync } from "node:fs"; +import { tmpdir } from "node:os"; +import { dirname, join } from "node:path"; +import { describe, expect, it } from "vitest"; + +const CHECK_SCRIPT = "scripts/check-openclaw-package-tarball.mjs"; + +function withTarball( + inventory: string[], + files: Record, + testBody: (tarball: string) => void, +) { + const root = mkdtempSync(join(tmpdir(), "openclaw-package-tarball-test-")); + try { + const packageRoot = join(root, "package"); + mkdirSync(join(packageRoot, "dist"), { recursive: true }); + writeFileSync( + join(packageRoot, "package.json"), + JSON.stringify({ name: "openclaw", version: "0.0.0" }), + ); + writeFileSync( + join(packageRoot, "dist", "postinstall-inventory.json"), + JSON.stringify(inventory), + ); + for (const [relativePath, body] of Object.entries(files)) { + const filePath = join(packageRoot, relativePath); + mkdirSync(dirname(filePath), { recursive: true }); + writeFileSync(filePath, body); + } + + const tarball = join(root, "openclaw.tgz"); + const pack = spawnSync("tar", ["-czf", tarball, "-C", root, "package"], { + encoding: "utf8", + }); + expect(pack.status, pack.stderr).toBe(0); + testBody(tarball); + } finally { + rmSync(root, { recursive: true, force: true }); + } +} + +describe("check-openclaw-package-tarball", () => { + it("allows legacy private QA inventory entries omitted from shipped tarballs", () => { + withTarball( + ["dist/index.js", "dist/extensions/qa-channel/runtime-api.js"], + { "dist/index.js": "export {};\n" }, + (tarball) => { + const result = spawnSync("node", [CHECK_SCRIPT, tarball], { encoding: "utf8" }); + + expect(result.status, result.stderr).toBe(0); + expect(result.stderr).toContain("legacy inventory references omitted private QA"); + expect(result.stdout).toContain("OpenClaw package tarball integrity passed."); + }, + ); + }); + + it("still rejects non-legacy missing inventory entries", () => { + withTarball( + ["dist/index.js", "dist/cli.js"], + { "dist/index.js": "export {};\n" }, + (tarball) => { + const result = spawnSync("node", [CHECK_SCRIPT, tarball], { encoding: "utf8" }); + + expect(result.status).not.toBe(0); + expect(result.stderr).toContain("inventory references missing tar entry dist/cli.js"); + }, + ); + }); +}); From 720ab99307ff69a253cf070f0b2d499452bed8c0 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 05:07:16 +0100 Subject: [PATCH 231/418] docs: explain release validation entrypoints --- docs/ci.md | 108 ++++++++++++++++++++++++++++++++++++ docs/reference/RELEASING.md | 73 ++++++++++++++++++------ 2 files changed, 164 insertions(+), 17 deletions(-) diff --git a/docs/ci.md b/docs/ci.md index 72dfa26d556..67bc394173f 100644 --- a/docs/ci.md +++ b/docs/ci.md @@ -26,6 +26,114 @@ workflow checkout. Profiles cover smoke, package, product, full, and custom Docker lane selections. The optional Telegram lane is published-npm only and reuses the `NPM Telegram Beta E2E` workflow. +## Package Acceptance + +Use `Package Acceptance` when the question is "does this installable OpenClaw +package work as a product?" It is different from normal CI: normal CI validates +the source tree, while package acceptance validates a single tarball through the +same Docker E2E harness users exercise after install or update. + +The workflow has four jobs: + +1. `resolve_package` checks out `workflow_ref`, resolves one package candidate, + writes `.artifacts/docker-e2e-package/openclaw-current.tgz`, writes + `.artifacts/docker-e2e-package/package-candidate.json`, uploads both as the + `package-under-test` artifact, and prints the source, workflow ref, package + ref, version, SHA-256, and profile in the GitHub step summary. +2. `docker_acceptance` calls + `openclaw-live-and-e2e-checks-reusable.yml` with `ref=workflow_ref` and + `package_artifact_name=package-under-test`. The reusable workflow downloads + that artifact, validates the tarball inventory, prepares package-digest + Docker images when needed, and runs the selected Docker lanes against that + package instead of packing the workflow checkout. +3. `npm_telegram` optionally calls `NPM Telegram Beta E2E`. It runs only when + `telegram_mode` is not `none`, and only for `source=npm`, because that lane + installs a published package spec. +4. `summary` fails the workflow if package resolution, Docker acceptance, or + the optional Telegram lane failed. + +Candidate sources: + +- `source=npm`: accepts only `openclaw@beta`, `openclaw@latest`, or an exact + OpenClaw release version such as `openclaw@2026.4.27-beta.2`. Use this for + published beta/stable acceptance. +- `source=ref`: packs a trusted `package_ref` branch, tag, or full commit SHA. + The resolver fetches OpenClaw branches/tags, verifies the selected commit is + reachable from repository branch history or a release tag, installs deps in a + detached worktree, and packs it with `scripts/package-openclaw-for-docker.mjs`. +- `source=url`: downloads an HTTPS `.tgz`; `package_sha256` is required. +- `source=artifact`: downloads one `.tgz` from `artifact_run_id` and + `artifact_name`; `package_sha256` is optional but should be supplied for + externally shared artifacts. + +Keep `workflow_ref` and `package_ref` separate. `workflow_ref` is the trusted +workflow/harness code that runs the test. `package_ref` is the source commit +that gets packed when `source=ref`. This lets the current test harness validate +older trusted source commits without running old workflow logic. + +Profiles map to Docker coverage: + +- `smoke`: `npm-onboard-channel-agent`, `gateway-network`, `config-reload` +- `package`: `install-e2e`, `npm-onboard-channel-agent`, `doctor-switch`, + `update-channel-switch`, `bundled-channel-deps`, `plugins`, `plugin-update` +- `product`: `package` plus `mcp-channels`, `cron-mcp-cleanup`, + `openai-web-search-minimal`, `openwebui` +- `full`: full Docker release-path chunks with OpenWebUI +- `custom`: exact `docker_lanes`; required when `suite_profile=custom` + +Release checks call Package Acceptance with `source=ref`, +`package_ref=`, `workflow_ref=`, and +`suite_profile=package`. That profile is the GitHub-native replacement for most +Parallels package/update validation. Cross-OS release checks still cover +OS-specific onboarding, installer, and platform behavior; package/update +product validation should start with Package Acceptance. + +Examples: + +```bash +# Validate the current beta package with product-level coverage. +gh workflow run package-acceptance.yml \ + --ref main \ + -f workflow_ref=main \ + -f source=npm \ + -f package_spec=openclaw@beta \ + -f suite_profile=product + +# Pack and validate a release branch with the current harness. +gh workflow run package-acceptance.yml \ + --ref main \ + -f workflow_ref=main \ + -f source=ref \ + -f package_ref=release/YYYY.M.D \ + -f suite_profile=package + +# Validate a tarball URL. SHA-256 is mandatory for source=url. +gh workflow run package-acceptance.yml \ + --ref main \ + -f workflow_ref=main \ + -f source=url \ + -f package_url=https://example.com/openclaw-current.tgz \ + -f package_sha256=<64-char-sha256> \ + -f suite_profile=smoke + +# Reuse a tarball uploaded by another Actions run. +gh workflow run package-acceptance.yml \ + --ref main \ + -f workflow_ref=main \ + -f source=artifact \ + -f artifact_run_id= \ + -f artifact_name=package-under-test \ + -f suite_profile=custom \ + -f docker_lanes='install-e2e plugin-update' +``` + +When debugging a failed package acceptance run, start at the `resolve_package` +summary to confirm the package source, version, and SHA-256. Then inspect the +`docker_acceptance` child run and its Docker artifacts: +`.artifacts/docker-tests/**/summary.json`, `failures.json`, lane logs, phase +timings, and rerun commands. Prefer rerunning the failed package profile or +exact Docker lanes instead of rerunning full release validation. + QA Lab has dedicated CI lanes outside the main smart-scoped workflow. The `Parity gate` workflow runs on matching PR changes and manual dispatch; it builds the private QA runtime and compares the mock GPT-5.5 and Opus 4.6 diff --git a/docs/reference/RELEASING.md b/docs/reference/RELEASING.md index dd8bf68a4c6..8eb149dea6b 100644 --- a/docs/reference/RELEASING.md +++ b/docs/reference/RELEASING.md @@ -66,9 +66,9 @@ the maintainer-only release runbook. 6. Run `OpenClaw NPM Release` with `preflight_only=true`. Before a tag exists, a full 40-character release-branch SHA is allowed for validation-only preflight. Save the successful `preflight_run_id`. -7. Run `Full Release Validation` for the release branch, tag, or full commit - SHA. This is the umbrella run for the four big release test boxes: Vitest, - Docker, QA Lab, and Package. +7. Kick off all pre-release tests with `Full Release Validation` for the + release branch, tag, or full commit SHA. This is the one manual entrypoint + for the four big release test boxes: Vitest, Docker, QA Lab, and Package. 8. If validation fails, fix on the release branch and rerun the smallest failed file, lane, workflow job, package profile, provider, or model allowlist that proves the fix. Rerun the full umbrella only when the changed surface makes @@ -96,15 +96,14 @@ the maintainer-only release runbook. - Run `pnpm build && pnpm ui:build` before `pnpm release:check` so the expected `dist/*` release artifacts and Control UI bundle exist for the pack validation step -- Run the manual `Full Release Validation` workflow before release approval - when you need the whole release validation suite from one entrypoint. It - accepts a branch, tag, or full commit SHA, dispatches manual `CI`, and - dispatches `OpenClaw Release Checks` for install smoke, package acceptance, - Docker release-path suites, live/E2E, OpenWebUI, QA Lab parity, Matrix, and - Telegram lanes. - Provide `npm_telegram_package_spec` only after a package has been published - and the post-publish Telegram E2E should run too. - Example: `gh workflow run full-release-validation.yml --ref main -f ref=release/YYYY.M.D` +- Run the manual `Full Release Validation` workflow before release approval to + kick off all pre-release test boxes from one entrypoint. It accepts a branch, + tag, or full commit SHA, dispatches manual `CI`, and dispatches + `OpenClaw Release Checks` for install smoke, package acceptance, Docker + release-path suites, live/E2E, OpenWebUI, QA Lab parity, Matrix, and Telegram + lanes. Provide `npm_telegram_package_spec` only after a package has been + published and the post-publish Telegram E2E should run too. Example: + `gh workflow run full-release-validation.yml --ref main -f ref=release/YYYY.M.D` - Run the manual `Package Acceptance` workflow when you want side-channel proof for a package candidate while release work continues. Use `source=npm` for `openclaw@beta`, `openclaw@latest`, or an exact release version; `source=ref` @@ -221,8 +220,9 @@ Validation` or from the `main`/release workflow ref so workflow logic and ## Release test boxes -`Full Release Validation` is the manual umbrella that operators use when they -want all release validation from one entrypoint: +`Full Release Validation` is how operators kick off all pre-release tests from +one entrypoint. Run it from the trusted `main` workflow ref and pass the release +branch, tag, or full commit SHA as `ref`: ```bash gh workflow run full-release-validation.yml \ @@ -236,9 +236,48 @@ gh workflow run full-release-validation.yml \ The workflow resolves the target ref, dispatches manual `CI` with `target_ref=`, dispatches `OpenClaw Release Checks`, and optionally dispatches post-publish Telegram E2E when -`npm_telegram_package_spec` is set. A full run is only acceptable when both -child workflows succeed or an intentionally skipped optional child is recorded -in the summary. +`npm_telegram_package_spec` is set. `OpenClaw Release Checks` then fans out +install smoke, cross-OS release checks, live/E2E Docker release-path coverage, +Package Acceptance, QA Lab parity, live Matrix, and live Telegram. A full run is +only acceptable when the `Full Release Validation` summary shows `normal_ci` and +`release_checks` as successful, and any optional `npm_telegram` child is either +successful or intentionally skipped. + +Use these variants depending on release stage: + +```bash +# Validate an unpublished release candidate branch. +gh workflow run full-release-validation.yml \ + --ref main \ + -f ref=release/YYYY.M.D \ + -f workflow_ref=main \ + -f provider=openai \ + -f mode=both + +# Validate an exact pushed commit. +gh workflow run full-release-validation.yml \ + --ref main \ + -f ref=<40-char-sha> \ + -f workflow_ref=main \ + -f provider=openai \ + -f mode=both + +# After publishing a beta, add published-package Telegram E2E. +gh workflow run full-release-validation.yml \ + --ref main \ + -f ref=release/YYYY.M.D \ + -f workflow_ref=main \ + -f provider=openai \ + -f mode=both \ + -f npm_telegram_package_spec=openclaw@YYYY.M.D-beta.N \ + -f npm_telegram_provider_mode=mock-openai +``` + +Do not use the full umbrella as the first rerun after a focused fix. If one box +fails, use the failed child workflow, job, Docker lane, package profile, model +provider, or QA lane for the next proof. Run the full umbrella again only when +the fix changed shared release orchestration or made earlier all-box evidence +stale. ### Vitest From 09107e0b7f4103b71d66bcf8c727f778534464f9 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 05:09:10 +0100 Subject: [PATCH 232/418] ci: let telegram e2e use package artifacts --- .github/workflows/npm-telegram-beta-e2e.yml | 60 ++++++++++++++-- .github/workflows/package-acceptance.yml | 12 ++-- scripts/e2e/npm-telegram-live-docker.sh | 68 +++++++++++++++---- scripts/e2e/npm-telegram-live-runner.ts | 12 ++-- test/scripts/npm-telegram-live.test.ts | 23 +++++-- .../package-acceptance-workflow.test.ts | 15 +++- 6 files changed, 151 insertions(+), 39 deletions(-) diff --git a/.github/workflows/npm-telegram-beta-e2e.yml b/.github/workflows/npm-telegram-beta-e2e.yml index 960abc15c81..b9baf3e81fe 100644 --- a/.github/workflows/npm-telegram-beta-e2e.yml +++ b/.github/workflows/npm-telegram-beta-e2e.yml @@ -4,10 +4,20 @@ on: workflow_dispatch: inputs: package_spec: - description: Published OpenClaw package spec to test + description: Published OpenClaw package spec to test when no artifact is supplied required: true default: openclaw@beta type: string + package_label: + description: Optional display label for an artifact-backed package candidate + required: false + default: "" + type: string + package_artifact_name: + description: Advanced package-under-test artifact name; leave blank for registry install + required: false + default: "" + type: string provider_mode: description: QA provider mode required: true @@ -23,9 +33,19 @@ on: workflow_call: inputs: package_spec: - description: Published OpenClaw package spec to test + description: Published OpenClaw package spec to test when no artifact is supplied required: true type: string + package_artifact_name: + description: Optional package-under-test artifact from the current workflow run + required: false + default: "" + type: string + package_label: + description: Optional display label for an artifact-backed package candidate + required: false + default: "" + type: string provider_mode: description: QA provider mode required: false @@ -58,7 +78,7 @@ env: jobs: run_npm_telegram_beta_e2e: - name: Run published npm Telegram E2E + name: Run package Telegram E2E runs-on: blacksmith-32vcpu-ubuntu-2404 timeout-minutes: 60 environment: qa-live-shared @@ -101,6 +121,7 @@ jobs: - name: Validate inputs and secrets env: PACKAGE_SPEC: ${{ inputs.package_spec }} + PACKAGE_ARTIFACT_NAME: ${{ inputs.package_artifact_name || '' }} PROVIDER_MODE: ${{ inputs.provider_mode }} OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} OPENCLAW_QA_CONVEX_SITE_URL: ${{ secrets.OPENCLAW_QA_CONVEX_SITE_URL }} @@ -109,9 +130,11 @@ jobs: run: | set -euo pipefail - if [[ ! "${PACKAGE_SPEC}" =~ ^openclaw@(beta|latest|[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*(-[1-9][0-9]*|-beta\.[1-9][0-9]*)?)$ ]]; then - echo "package_spec must be openclaw@beta, openclaw@latest, or an exact OpenClaw release version; got: ${PACKAGE_SPEC}" >&2 - exit 1 + if [[ -z "${PACKAGE_ARTIFACT_NAME// }" ]]; then + if [[ ! "${PACKAGE_SPEC}" =~ ^openclaw@(beta|latest|[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*(-[1-9][0-9]*|-beta\.[1-9][0-9]*)?)$ ]]; then + echo "package_spec must be openclaw@beta, openclaw@latest, or an exact OpenClaw release version; got: ${PACKAGE_SPEC}" >&2 + exit 1 + fi fi case "${PROVIDER_MODE}" in mock-openai | live-frontier) ;; @@ -135,7 +158,14 @@ jobs: require_var OPENAI_API_KEY fi - - name: Run npm Telegram beta E2E + - name: Download package-under-test artifact + if: inputs.package_artifact_name != '' + uses: actions/download-artifact@v8 + with: + name: ${{ inputs.package_artifact_name }} + path: .artifacts/telegram-package-under-test + + - name: Run package Telegram E2E id: run_lane shell: bash env: @@ -143,6 +173,7 @@ jobs: OPENCLAW_SKIP_DOCKER_BUILD: "1" OPENCLAW_DOCKER_E2E_IMAGE: openclaw-docker-e2e:local OPENCLAW_NPM_TELEGRAM_PACKAGE_SPEC: ${{ inputs.package_spec }} + OPENCLAW_NPM_TELEGRAM_PACKAGE_LABEL: ${{ inputs.package_label }} OPENCLAW_NPM_TELEGRAM_PROVIDER_MODE: ${{ inputs.provider_mode }} OPENCLAW_NPM_TELEGRAM_CREDENTIAL_SOURCE: convex OPENCLAW_NPM_TELEGRAM_CREDENTIAL_ROLE: ci @@ -151,6 +182,7 @@ jobs: OPENCLAW_QA_REDACT_PUBLIC_METADATA: "1" OPENCLAW_QA_TELEGRAM_CAPTURE_CONTENT: "1" INPUT_SCENARIO: ${{ inputs.scenario }} + PACKAGE_ARTIFACT_NAME: ${{ inputs.package_artifact_name || '' }} run: | set -euo pipefail @@ -158,6 +190,20 @@ jobs: echo "output_dir=${output_dir}" >> "$GITHUB_OUTPUT" export OPENCLAW_NPM_TELEGRAM_OUTPUT_DIR="${output_dir}" + if [[ -n "${PACKAGE_ARTIFACT_NAME// }" ]]; then + mapfile -t package_tgzs < <(find .artifacts/telegram-package-under-test -type f -name "*.tgz" | sort) + if [[ "${#package_tgzs[@]}" -ne 1 ]]; then + echo "package artifact ${PACKAGE_ARTIFACT_NAME} must contain exactly one .tgz; found ${#package_tgzs[@]}" >&2 + exit 1 + fi + export OPENCLAW_NPM_TELEGRAM_PACKAGE_TGZ="${package_tgzs[0]}" + if [[ -z "${OPENCLAW_NPM_TELEGRAM_PACKAGE_LABEL// }" ]]; then + export OPENCLAW_NPM_TELEGRAM_PACKAGE_LABEL="$(basename "${package_tgzs[0]}")" + fi + elif [[ -z "${OPENCLAW_NPM_TELEGRAM_PACKAGE_LABEL// }" ]]; then + export OPENCLAW_NPM_TELEGRAM_PACKAGE_LABEL="${OPENCLAW_NPM_TELEGRAM_PACKAGE_SPEC}" + fi + if [[ -n "${INPUT_SCENARIO// }" ]]; then export OPENCLAW_NPM_TELEGRAM_SCENARIOS="${INPUT_SCENARIO}" fi diff --git a/.github/workflows/package-acceptance.yml b/.github/workflows/package-acceptance.yml index bfa3f1807ed..53cc8ea5fbe 100644 --- a/.github/workflows/package-acceptance.yml +++ b/.github/workflows/package-acceptance.yml @@ -65,7 +65,7 @@ on: default: "" type: string telegram_mode: - description: Optional published-npm Telegram QA lane + description: Optional Telegram QA lane for the resolved package candidate required: true default: none type: choice @@ -125,7 +125,7 @@ on: default: "" type: string telegram_mode: - description: Optional published-npm Telegram QA lane + description: Optional Telegram QA lane for the resolved package candidate required: false default: none type: string @@ -366,10 +366,6 @@ jobs: telegram_enabled=false if [[ "$TELEGRAM_MODE" != "none" ]]; then - if [[ "$SOURCE" != "npm" ]]; then - echo "telegram_mode requires source=npm because the Telegram workflow installs a published package spec." >&2 - exit 1 - fi telegram_enabled=true fi @@ -476,12 +472,14 @@ jobs: FIREWORKS_API_KEY: ${{ secrets.FIREWORKS_API_KEY }} npm_telegram: - name: Published npm Telegram acceptance + name: Telegram package acceptance needs: resolve_package if: needs.resolve_package.outputs.telegram_enabled == 'true' uses: ./.github/workflows/npm-telegram-beta-e2e.yml with: package_spec: ${{ inputs.package_spec }} + package_artifact_name: ${{ needs.resolve_package.outputs.package_artifact_name }} + package_label: openclaw@${{ needs.resolve_package.outputs.package_version }} provider_mode: ${{ needs.resolve_package.outputs.telegram_mode }} secrets: OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} diff --git a/scripts/e2e/npm-telegram-live-docker.sh b/scripts/e2e/npm-telegram-live-docker.sh index 5cb4335973c..6d432f7422b 100755 --- a/scripts/e2e/npm-telegram-live-docker.sh +++ b/scripts/e2e/npm-telegram-live-docker.sh @@ -1,5 +1,5 @@ #!/usr/bin/env bash -# Installs a published OpenClaw npm package in Docker, performs Telegram +# Installs an OpenClaw package candidate in Docker, performs Telegram # onboarding/doctor recovery, then runs the Telegram QA live harness. set -euo pipefail @@ -9,6 +9,8 @@ source "$ROOT_DIR/scripts/lib/docker-e2e-image.sh" IMAGE_NAME="$(docker_e2e_resolve_image "openclaw-npm-telegram-live-e2e" OPENCLAW_NPM_TELEGRAM_LIVE_E2E_IMAGE)" DOCKER_TARGET="${OPENCLAW_NPM_TELEGRAM_DOCKER_TARGET:-build}" PACKAGE_SPEC="${OPENCLAW_NPM_TELEGRAM_PACKAGE_SPEC:-openclaw@beta}" +PACKAGE_TGZ="${OPENCLAW_NPM_TELEGRAM_PACKAGE_TGZ:-${OPENCLAW_CURRENT_PACKAGE_TGZ:-}}" +PACKAGE_LABEL="${OPENCLAW_NPM_TELEGRAM_PACKAGE_LABEL:-}" OUTPUT_DIR="${OPENCLAW_NPM_TELEGRAM_OUTPUT_DIR:-.artifacts/qa-e2e/npm-telegram-live}" resolve_credential_source() { @@ -46,7 +48,45 @@ validate_openclaw_package_spec() { exit 1 } -validate_openclaw_package_spec "$PACKAGE_SPEC" +resolve_package_tgz() { + local candidate="$1" + if [ -z "$candidate" ]; then + return 0 + fi + if [ ! -f "$candidate" ]; then + echo "OPENCLAW_NPM_TELEGRAM_PACKAGE_TGZ must point to an existing .tgz file; got: $candidate" >&2 + exit 1 + fi + case "$candidate" in + *.tgz) ;; + *) + echo "OPENCLAW_NPM_TELEGRAM_PACKAGE_TGZ must point to a .tgz file; got: $candidate" >&2 + exit 1 + ;; + esac + local dir + local base + dir="$(cd "$(dirname "$candidate")" && pwd)" + base="$(basename "$candidate")" + printf "%s/%s" "$dir" "$base" +} + +package_mount_args=() +package_install_source="$PACKAGE_SPEC" +resolved_package_tgz="$(resolve_package_tgz "$PACKAGE_TGZ")" +if [ -n "$resolved_package_tgz" ]; then + package_install_source="/package-under-test/$(basename "$resolved_package_tgz")" + package_mount_args=(-v "$resolved_package_tgz:$package_install_source:ro") +else + validate_openclaw_package_spec "$PACKAGE_SPEC" +fi +if [ -z "$PACKAGE_LABEL" ]; then + if [ -n "$resolved_package_tgz" ]; then + PACKAGE_LABEL="$(basename "$resolved_package_tgz")" + else + PACKAGE_LABEL="$PACKAGE_SPEC" + fi +fi docker_e2e_build_or_reuse "$IMAGE_NAME" npm-telegram-live "$ROOT_DIR/scripts/e2e/Dockerfile" "$ROOT_DIR" "$DOCKER_TARGET" docker_e2e_harness_mount_args @@ -64,6 +104,7 @@ fi docker_env=( -e COREPACK_ENABLE_DOWNLOAD_PROMPT=0 -e OPENCLAW_NPM_TELEGRAM_PACKAGE_SPEC="$PACKAGE_SPEC" + -e OPENCLAW_NPM_TELEGRAM_PACKAGE_LABEL="$PACKAGE_LABEL" -e OPENCLAW_NPM_TELEGRAM_OUTPUT_DIR="$OUTPUT_DIR" -e OPENCLAW_NPM_TELEGRAM_FAST="${OPENCLAW_NPM_TELEGRAM_FAST:-1}" ) @@ -124,10 +165,12 @@ run_logged() { >"$run_log" } -echo "Running published npm Telegram live Docker E2E ($PACKAGE_SPEC)..." +echo "Running package Telegram live Docker E2E ($PACKAGE_LABEL)..." run_logged docker run --rm \ -e COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \ - -e OPENCLAW_NPM_TELEGRAM_PACKAGE_SPEC="$PACKAGE_SPEC" \ + -e OPENCLAW_NPM_TELEGRAM_INSTALL_SOURCE="$package_install_source" \ + -e OPENCLAW_NPM_TELEGRAM_PACKAGE_LABEL="$PACKAGE_LABEL" \ + "${package_mount_args[@]}" \ -v "$npm_prefix_host:/npm-global" \ -i "$IMAGE_NAME" bash -s <<'EOF' set -euo pipefail @@ -136,15 +179,16 @@ export HOME="$(mktemp -d "/tmp/openclaw-npm-telegram-install.XXXXXX")" export NPM_CONFIG_PREFIX="/npm-global" export PATH="$NPM_CONFIG_PREFIX/bin:$PATH" -package_spec="${OPENCLAW_NPM_TELEGRAM_PACKAGE_SPEC:?missing OPENCLAW_NPM_TELEGRAM_PACKAGE_SPEC}" -echo "Installing ${package_spec}..." -npm install -g "$package_spec" --no-fund --no-audit +install_source="${OPENCLAW_NPM_TELEGRAM_INSTALL_SOURCE:?missing OPENCLAW_NPM_TELEGRAM_INSTALL_SOURCE}" +package_label="${OPENCLAW_NPM_TELEGRAM_PACKAGE_LABEL:-$install_source}" +echo "Installing ${package_label} from ${install_source}..." +npm install -g "$install_source" --no-fund --no-audit command -v openclaw openclaw --version EOF -# Mount only test harness/plugin QA sources; the SUT itself is the npm install. +# Mount only test harness/plugin QA sources; the SUT itself is the installed package candidate. run_logged docker run --rm \ "${docker_env[@]}" \ -v "$ROOT_DIR/.artifacts:/app/.artifacts" \ @@ -161,7 +205,7 @@ export OPENCLAW_NPM_TELEGRAM_REPO_ROOT="/app" dump_hotpath_logs() { local status="$1" - echo "installed npm onboarding recovery hot path failed with exit code $status" >&2 + echo "installed-package onboarding recovery hot path failed with exit code $status" >&2 for file in \ /tmp/openclaw-npm-telegram-onboard.json \ /tmp/openclaw-npm-telegram-channel-add.log \ @@ -178,11 +222,11 @@ trap 'status=$?; dump_hotpath_logs "$status"; exit "$status"' ERR command -v openclaw openclaw --version # The mounted QA harness imports openclaw/plugin-sdk; point that package import -# at the installed npm package without copying source into the test image. +# at the installed package without copying source into the test image. mkdir -p /app/node_modules ln -sfn /npm-global/lib/node_modules/openclaw /app/node_modules/openclaw -echo "Running installed npm onboarding recovery hot path..." +echo "Running installed-package onboarding recovery hot path..." OPENAI_API_KEY="${OPENAI_API_KEY:-sk-openclaw-npm-telegram-hotpath}" openclaw onboard --non-interactive --accept-risk \ --mode local \ --auth-choice openai-api-key \ @@ -210,4 +254,4 @@ trap - ERR tsx scripts/e2e/npm-telegram-live-runner.ts EOF -echo "published npm Telegram live Docker E2E passed ($PACKAGE_SPEC)" +echo "package Telegram live Docker E2E passed ($PACKAGE_LABEL)" diff --git a/scripts/e2e/npm-telegram-live-runner.ts b/scripts/e2e/npm-telegram-live-runner.ts index ad5500968fa..367a10b2602 100644 --- a/scripts/e2e/npm-telegram-live-runner.ts +++ b/scripts/e2e/npm-telegram-live-runner.ts @@ -1,6 +1,6 @@ #!/usr/bin/env -S node --import tsx -// Telegram npm-live Docker harness. -// Runs QA live transport code against the published package installed in Docker. +// Telegram package Docker harness. +// Runs QA live transport code against the package candidate installed in Docker. import fs from "node:fs/promises"; import path from "node:path"; @@ -78,9 +78,9 @@ async function main() { credentialRole: resolveCredentialRole(process.env), }); - process.stdout.write(`NPM Telegram QA report: ${result.reportPath}\n`); - process.stdout.write(`NPM Telegram QA summary: ${result.summaryPath}\n`); - process.stdout.write(`NPM Telegram QA observed messages: ${result.observedMessagesPath}\n`); + process.stdout.write(`Package Telegram QA report: ${result.reportPath}\n`); + process.stdout.write(`Package Telegram QA summary: ${result.summaryPath}\n`); + process.stdout.write(`Package Telegram QA observed messages: ${result.observedMessagesPath}\n`); if ( !parseBoolean(process.env.OPENCLAW_NPM_TELEGRAM_ALLOW_FAILURES) && result.scenarios.some((scenario) => scenario.status === "fail") @@ -101,7 +101,7 @@ async function formatRunnerErrorMessage(error: unknown) { if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) { main().catch(async (error) => { process.stderr.write( - `npm telegram live e2e failed: ${await formatRunnerErrorMessage(error)}\n`, + `package telegram live e2e failed: ${await formatRunnerErrorMessage(error)}\n`, ); process.exitCode = 1; }); diff --git a/test/scripts/npm-telegram-live.test.ts b/test/scripts/npm-telegram-live.test.ts index a5912fb7abc..95704c85681 100644 --- a/test/scripts/npm-telegram-live.test.ts +++ b/test/scripts/npm-telegram-live.test.ts @@ -7,7 +7,7 @@ import { __testing } from "../../scripts/e2e/npm-telegram-live-runner.ts"; const TEST_DIR = path.dirname(fileURLToPath(import.meta.url)); const DOCKER_SCRIPT_PATH = path.resolve(TEST_DIR, "../../scripts/e2e/npm-telegram-live-docker.sh"); -describe("npm Telegram live Docker E2E", () => { +describe("package Telegram live Docker E2E", () => { it("supports npm-specific Convex credential aliases", () => { const script = readFileSync(DOCKER_SCRIPT_PATH, "utf8"); @@ -28,18 +28,33 @@ describe("npm Telegram live Docker E2E", () => { expect(script).toContain('printf "convex"'); }); - it("installs the npm package before forwarding runtime secrets", () => { + it("installs the package candidate before forwarding runtime secrets", () => { const script = readFileSync(DOCKER_SCRIPT_PATH, "utf8"); - const installRunStart = script.indexOf('echo "Running published npm Telegram live Docker E2E'); + const installRunStart = script.indexOf('echo "Running package Telegram live Docker E2E'); const installRunEnd = script.indexOf('run_logged docker run --rm \\\n "${docker_env[@]}"'); const installRun = script.slice(installRunStart, installRunEnd); - expect(installRun).toContain('npm install -g "$package_spec" --no-fund --no-audit'); + expect(installRun).toContain('npm install -g "$install_source" --no-fund --no-audit'); + expect(installRun).toContain('"${package_mount_args[@]}"'); expect(installRun).not.toContain('"${docker_env[@]}"'); expect(script).toContain('if [ -z "$credential_role" ] && [ -n "${CI:-}" ]'); expect(script).toContain('credential_role="ci"'); }); + it("can install a resolved package tarball instead of a registry spec", () => { + const script = readFileSync(DOCKER_SCRIPT_PATH, "utf8"); + + expect(script).toContain("OPENCLAW_NPM_TELEGRAM_PACKAGE_TGZ"); + expect(script).toContain("OPENCLAW_CURRENT_PACKAGE_TGZ"); + expect(script).toContain( + 'package_mount_args=(-v "$resolved_package_tgz:$package_install_source:ro")', + ); + expect(script).toContain('validate_openclaw_package_spec "$PACKAGE_SPEC"'); + expect(script.indexOf('if [ -n "$resolved_package_tgz" ]; then')).toBeLessThan( + script.indexOf('validate_openclaw_package_spec "$PACKAGE_SPEC"'), + ); + }); + it("lets npm-specific credential aliases override shared QA env", () => { expect( __testing.resolveCredentialSource({ diff --git a/test/scripts/package-acceptance-workflow.test.ts b/test/scripts/package-acceptance-workflow.test.ts index bca77db6009..18b062ef892 100644 --- a/test/scripts/package-acceptance-workflow.test.ts +++ b/test/scripts/package-acceptance-workflow.test.ts @@ -34,15 +34,21 @@ describe("package acceptance workflow", () => { ); }); - it("offers bounded product profiles and keeps Telegram published-npm only", () => { + it("offers bounded product profiles and can run Telegram against the resolved artifact", () => { const workflow = readFileSync(PACKAGE_ACCEPTANCE_WORKFLOW, "utf8"); expect(workflow).toContain("suite_profile:"); expect(workflow).toContain("npm-onboard-channel-agent gateway-network config-reload"); expect(workflow).toContain("install-e2e npm-onboard-channel-agent doctor-switch"); expect(workflow).toContain("include_release_path_suites=true"); - expect(workflow).toContain("telegram_mode requires source=npm"); + expect(workflow).not.toContain("telegram_mode requires source=npm"); expect(workflow).toContain("uses: ./.github/workflows/npm-telegram-beta-e2e.yml"); + expect(workflow).toContain( + "package_artifact_name: ${{ needs.resolve_package.outputs.package_artifact_name }}", + ); + expect(workflow).toContain( + "package_label: openclaw@${{ needs.resolve_package.outputs.package_version }}", + ); }); }); @@ -62,10 +68,13 @@ describe("package artifact reuse", () => { expect(action).toContain("name: ${{ inputs.package-artifact-name }}"); }); - it("allows the npm Telegram lane to run from reusable package acceptance", () => { + it("allows the Telegram lane to run from reusable package acceptance artifacts", () => { const workflow = readFileSync(NPM_TELEGRAM_WORKFLOW, "utf8"); expect(workflow).toContain("workflow_call:"); + expect(workflow).toContain("package_artifact_name:"); + expect(workflow).toContain("Download package-under-test artifact"); + expect(workflow).toContain("OPENCLAW_NPM_TELEGRAM_PACKAGE_TGZ"); expect(workflow).toContain("provider_mode:"); expect(workflow).toContain("provider_mode must be mock-openai or live-frontier"); }); From cc79f4982c717db05369423a5dc323f5c3fe5e90 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 05:09:13 +0100 Subject: [PATCH 233/418] docs: explain telegram package artifact testing --- .agents/skills/openclaw-testing/SKILL.md | 9 ++++++--- docs/ci.md | 5 +++-- docs/help/testing.md | 11 +++++++---- docs/reference/RELEASING.md | 10 +++++----- 4 files changed, 21 insertions(+), 14 deletions(-) diff --git a/.agents/skills/openclaw-testing/SKILL.md b/.agents/skills/openclaw-testing/SKILL.md index cba803168e3..36020eecea6 100644 --- a/.agents/skills/openclaw-testing/SKILL.md +++ b/.agents/skills/openclaw-testing/SKILL.md @@ -311,9 +311,12 @@ gh workflow run package-acceptance.yml --ref main \ -f telegram_mode=none ``` -Use `telegram_mode=mock-openai` or `telegram_mode=live-frontier` only with -`source=npm`; that path reuses the published npm Telegram E2E workflow and the -`qa-live-shared` environment. +Use `telegram_mode=mock-openai` or `telegram_mode=live-frontier` when the same +resolved `package-under-test` tarball should also run through the Telegram QA +workflow in the `qa-live-shared` environment. The standalone Telegram workflow +still accepts a published npm spec for post-publish checks, but Package +Acceptance passes the resolved artifact for `source=npm`, `ref`, `url`, and +`artifact`. Docker E2E images never copy repo sources as the app under test: the bare image is a Node/Git runner, and the functional image installs the same prebuilt npm diff --git a/docs/ci.md b/docs/ci.md index 67bc394173f..b8e6f9590c9 100644 --- a/docs/ci.md +++ b/docs/ci.md @@ -23,8 +23,9 @@ published npm spec, a trusted `package_ref` built with the selected from another GitHub Actions run, uploads it as `package-under-test`, then reuses the Docker release/E2E scheduler with that tarball instead of repacking the workflow checkout. Profiles cover smoke, package, product, full, and custom -Docker lane selections. The optional Telegram lane is published-npm only and -reuses the `NPM Telegram Beta E2E` workflow. +Docker lane selections. The optional Telegram lane reuses the +`package-under-test` artifact in the `NPM Telegram Beta E2E` workflow, with the +published npm spec path kept for standalone dispatches. ## Package Acceptance diff --git a/docs/help/testing.md b/docs/help/testing.md index 5c1d9bb271e..160b128baf4 100644 --- a/docs/help/testing.md +++ b/docs/help/testing.md @@ -136,10 +136,13 @@ runs the same lanes before release approval. then seeds an affected broken session JSONL and verifies `openclaw doctor --fix` rewrites it to the active branch with a backup. - `pnpm test:docker:npm-telegram-live` - - Installs a published OpenClaw package in Docker, runs installed-package + - Installs an OpenClaw package candidate in Docker, runs installed-package onboarding, configures Telegram through the installed CLI, then reuses the live Telegram QA lane with that installed package as the SUT Gateway. - - Defaults to `OPENCLAW_NPM_TELEGRAM_PACKAGE_SPEC=openclaw@beta`. + - Defaults to `OPENCLAW_NPM_TELEGRAM_PACKAGE_SPEC=openclaw@beta`; set + `OPENCLAW_NPM_TELEGRAM_PACKAGE_TGZ=/path/to/openclaw-current.tgz` or + `OPENCLAW_CURRENT_PACKAGE_TGZ` to test a resolved local tarball instead of + installing from the registry. - Uses the same Telegram env credentials or Convex credential source as `pnpm openclaw qa telegram`. For CI/release automation, set `OPENCLAW_NPM_TELEGRAM_CREDENTIAL_SOURCE=convex` plus @@ -156,8 +159,8 @@ runs the same lanes before release approval. HTTPS tarball URL plus SHA-256, or tarball artifact from another run, uploads the normalized `openclaw-current.tgz` as `package-under-test`, then runs the existing Docker E2E scheduler with smoke, package, product, full, or custom - lane profiles. Published npm candidates can additionally run the Telegram QA - workflow. + lane profiles. Set `telegram_mode=mock-openai` or `live-frontier` to run the + Telegram QA workflow against the same `package-under-test` artifact. - Latest beta product proof: ```bash diff --git a/docs/reference/RELEASING.md b/docs/reference/RELEASING.md index 8eb149dea6b..20b5171a4a3 100644 --- a/docs/reference/RELEASING.md +++ b/docs/reference/RELEASING.md @@ -112,7 +112,7 @@ the maintainer-only release runbook. SHA-256; or `source=artifact` for a tarball uploaded by another GitHub Actions run. The workflow resolves the candidate to `package-under-test`, reuses the Docker E2E release scheduler against that - tarball, and can optionally run published-npm Telegram QA. + tarball, and can optionally run Telegram QA against the same tarball. Example: `gh workflow run package-acceptance.yml --ref main -f workflow_ref=main -f source=npm -f package_spec=openclaw@beta -f suite_profile=product` Common profiles: - `smoke`: install/channel/agent, gateway network, and config reload lanes @@ -393,10 +393,10 @@ Common package profiles: - `full`: Docker release-path chunks with OpenWebUI - `custom`: exact `docker_lanes` list for focused reruns -For post-publish beta proof, use `source=npm` with the exact beta package or -`openclaw@beta`. Enable `telegram_mode=mock-openai` or -`telegram_mode=live-frontier` only for published npm packages, because that -path reuses the published-npm Telegram E2E workflow. +For package-candidate Telegram proof, enable `telegram_mode=mock-openai` or +`telegram_mode=live-frontier` on Package Acceptance. The workflow passes the +resolved `package-under-test` tarball into the Telegram lane; the standalone +Telegram workflow still accepts a published npm spec for post-publish checks. ## NPM workflow inputs From 716b3faf7e8172ec76a64893d9788e2630f349b8 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 21:10:09 -0700 Subject: [PATCH 234/418] Revert "docs(agents): document testbox maintainer workflow" This reverts commit 4340cb74c24fcad4b7a452e3ef07de3effedf629. --- .agents/skills/blacksmith-testbox/SKILL.md | 73 ++++------------------ AGENTS.md | 5 +- 2 files changed, 13 insertions(+), 65 deletions(-) diff --git a/.agents/skills/blacksmith-testbox/SKILL.md b/.agents/skills/blacksmith-testbox/SKILL.md index 60546311d03..ef53f45c78b 100644 --- a/.agents/skills/blacksmith-testbox/SKILL.md +++ b/.agents/skills/blacksmith-testbox/SKILL.md @@ -10,9 +10,8 @@ description: Run Blacksmith Testbox for CI-parity checks, secrets, hosted servic Use Testbox when you need remote CI parity, injected secrets, hosted services, or an OS/runtime image that your local machine cannot provide cheaply. -Do not default to Testbox for every local test/build loop unless the repo or -the user's personal maintainer rules explicitly say Testbox-first. If the repo -has documented local commands for normal iteration, use those first so you keep +Do not default to Testbox for every local test/build loop. If the repo has +documented local commands for normal iteration, use those first so you keep warm caches, local build state, and fast feedback. Testbox is the expensive path. Reach for it deliberately. @@ -82,8 +81,7 @@ Prefer Testbox when: - you are reproducing CI-only failures - you need the exact workflow image/job environment from GitHub Actions -For OpenClaw specifically, contributor and routine local iteration should stay -local: +For OpenClaw specifically, normal local iteration should stay local: - `pnpm check:changed` - `pnpm test:changed` @@ -91,11 +89,9 @@ local: - `pnpm test:serial` - `pnpm build` -OpenClaw maintainer mode is different. If the user has Blacksmith access and -sets `OPENCLAW_TESTBOX=1`, or their personal agent rules say Testbox-first, -route broad, slow, Docker, live, E2E, full-suite, and CI-parity validation -through Testbox by default. `OPENCLAW_LOCAL_CHECK_MODE=throttled` remains the -escape hatch for laptop-friendly local proof. +Only use Testbox in OpenClaw when the user explicitly wants CI-parity or the +check truly depends on remote secrets/services that the local repo loop cannot +provide. For installable-package product proof, prefer the GitHub `Package Acceptance` workflow over an ad hoc Testbox command. It resolves one package candidate @@ -115,35 +111,13 @@ an ID instantly and boots the CI environment in the background while you work: Save this ID. You need it for every `run` command. -For long-ish OpenClaw maintainer tasks in Testbox mode, pre-warm at the start -with a longer idle timeout: - - blacksmith testbox warmup ci-check-testbox.yml --idle-timeout 90 - # → tbx_01jkz5b3t9... - -The CLI and current docs expose `--idle-timeout ` and document the -default as 30 minutes, but do not publish a universal maximum. OpenClaw policy: -use `90` for normal long-ish tasks, `240` for multi-hour work, `720` for -all-day work, and `1440` for overnight work. Anything above `1440` minutes -requires explicit user intent and an end-of-task cleanup check. - -Observed on 2026-04-27: Blacksmith accepted `90`, `240`, `720`, `1440`, -`4320`, `10080`, `43200`, and even `525600` minutes, with every probe box -stopped immediately. Treat that as "no sane visible cap", not permission to -leave giant-idle boxes around. - -Choose the warmup ref deliberately. `--ref ` can point at a -branch, tag, or SHA. For cache seeding, prefer exact current branch/SHA for -correctness; use the latest `beta` or `latest` release SHA only as a warm cache -seed, then still run the build/check that proves local synced changes. - Warmup dispatches a GitHub Actions workflow that provisions a VM with the full CI environment: dependencies installed, services started, secrets injected, and a clean checkout of the repo at the default branch. Options: - --ref Git ref to dispatch against (default: repo's default branch) + --ref Git ref to dispatch against (default: repo's default branch) --job Specific job within the workflow (if it has multiple) --idle-timeout Idle timeout in minutes (default: 30) @@ -276,27 +250,18 @@ checks that need parity or remote state. ## Workflow -1. Decide whether the repo's local loop or maintainer Testbox mode is the right - default. +1. Decide whether the repo's local loop is the right default. 2. Only if Testbox is warranted, warm up early: - `blacksmith testbox warmup ci-check-testbox.yml --idle-timeout 90` → save the ID. - Use `--idle-timeout 240`, `720`, or `1440` only when the task duration - justifies it. + `blacksmith testbox warmup ci-check-testbox.yml` → save the ID 3. Write code while the testbox boots in the background. 4. Run the remote command when needed: `blacksmith testbox run --id "npm test"` -5. If tests fail, fix code and re-run against the same warm box. Reuse this - same `tbx_...` for every run/download in the task unless it expires, the - workflow/ref/env must change, or the user asks for a fresh box. +5. If tests fail, fix code and re-run against the same warm box. 6. If you changed dependency manifests (package.json, etc.), prepend the install command: `blacksmith testbox run --id "npm install && npm test"` 7. If you need artifacts (coverage reports, build outputs, etc.), download them: `blacksmith testbox download --id coverage/ ./coverage/` 8. Once green, commit and push. -9. If you used a long timeout or created probe boxes, clean up with - `blacksmith testbox list` and `blacksmith testbox stop --id `. Stop only - boxes from the current task unless the user asks you to clean up other active - boxes. ## OpenClaw full test suite @@ -369,24 +334,10 @@ timeout is reached). Default timeout is 5m; use `--wait-timeout` for longer Testboxes automatically shut down after being idle (default: 30 minutes). If you need a longer session, increase the timeout at warmup time: - blacksmith testbox warmup ci-check-testbox.yml --idle-timeout 90 - -For OpenClaw maintainer work, use coarse timeout bins instead of probing many -small values: - -- `90` minutes: default long-ish task -- `240` minutes: multi-hour task -- `720` minutes: all-day task -- `1440` minutes: overnight task; max without explicit user intent - -Because the service currently accepts much larger values, cleanup is part of -the workflow, not a nice-to-have: - - blacksmith testbox list - blacksmith testbox stop --id + blacksmith testbox warmup ci-check-testbox.yml --idle-timeout 60 ## With options blacksmith testbox warmup ci-check-testbox.yml --ref main - blacksmith testbox warmup ci-check-testbox.yml --idle-timeout 240 + blacksmith testbox warmup ci-check-testbox.yml --idle-timeout 60 blacksmith testbox run --id "go test ./..." diff --git a/AGENTS.md b/AGENTS.md index c5d54ac309b..faca52035ae 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -54,10 +54,7 @@ Telegraph style. Root rules only. Read scoped `AGENTS.md` before subtree work. - Formatting: use `oxfmt`, not Prettier. Prefer `pnpm format:check` / `pnpm format`; for targeted files use `pnpm exec oxfmt --check --threads=1 ` or `pnpm exec oxfmt --write --threads=1 `. - Linting: use repo wrappers (`pnpm lint:*`, `scripts/run-oxlint.mjs`); do not invoke generic JS formatters/lints unless a repo script uses them. - Heavy checks: `OPENCLAW_LOCAL_CHECK=1`, mode `OPENCLAW_LOCAL_CHECK_MODE=throttled|full`; CI/shared use `OPENCLAW_LOCAL_CHECK=0`. -- Default contributor path: local repo `pnpm` lanes first. Maintainer-only Testbox path: when Blacksmith access is configured and `OPENCLAW_TESTBOX=1` or personal rules request Testbox-first, use Blacksmith for broad, slow, Docker, live, E2E, full-suite, or CI-parity validation. `OPENCLAW_LOCAL_CHECK_MODE=throttled` is the local escape hatch. -- Testbox pre-warm: for long-ish OpenClaw tasks in Testbox mode, run from repo root early: `blacksmith testbox warmup ci-check-testbox.yml --idle-timeout 90`. Use `240`, `720`, or `1440` only for multi-hour, all-day, or overnight work; above `1440` requires explicit user intent. Save the returned `tbx_...` and reuse it for every `blacksmith testbox run --id ...` in that task unless the box expires, the workflow/ref/env must change, or the user asks for a fresh box. -- Testbox cleanup: track every created `tbx_...`; use `blacksmith testbox list` to inspect active boxes and `blacksmith testbox stop --id ` to stop boxes from the current task. Do not stop pre-existing boxes unless they are clearly yours or the user asks. -- Testbox cache seed: `--ref ` may point at the current branch/SHA for correctness or a latest `beta`/`latest` SHA for warm cache state. A seeded box is not proof by itself; still run the build/check after local sync. +- Local first. Use repo `pnpm` lanes before Blacksmith/Testbox. Remote only for parity-only failures, secrets/services, or explicit ask. ## GitHub / CI From 4c3c3abe1acd78bd46775b97b58305961e68e0ef Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 21:11:23 -0700 Subject: [PATCH 235/418] fix(cli): keep startup help metadata on fast path --- CHANGELOG.md | 1 + src/cli/channel-options.ts | 14 +++-------- src/cli/command-registration-policy.test.ts | 14 +++++++++++ src/cli/command-registration-policy.ts | 3 +++ src/cli/root-help-metadata.ts | 22 ++++++---------- src/cli/run-main.test.ts | 2 ++ src/cli/run-main.ts | 6 ++++- src/cli/startup-metadata.test.ts | 16 ++++++++++++ src/cli/startup-metadata.ts | 28 +++++++++++++++++++++ 9 files changed, 80 insertions(+), 26 deletions(-) create mode 100644 src/cli/startup-metadata.test.ts create mode 100644 src/cli/startup-metadata.ts diff --git a/CHANGELOG.md b/CHANGELOG.md index 18f2b01064b..512f50b8cfd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,6 +12,7 @@ Docs: https://docs.openclaw.ai ### Fixes +- CLI/startup: read generated startup metadata from the bundled `dist` layout before falling back to live help rendering, so root/browser help and channel-option bootstrap stay on the fast path. Thanks @vincentkoc. - Matrix/E2EE: stabilize recovery and broken-device QA flows while avoiding Matrix device-cleanup sync races that could leave shutdown-time crypto work running. Thanks @gumadeiras. - Cron: classify isolated runs as errors from structured embedded-run execution-denial metadata, with final-output marker fallback for `SYSTEM_RUN_DENIED`, `INVALID_REQUEST`, and approval-binding refusals, so blocked commands no longer appear green in cron history. Fixes #67172; carries forward #67186. Thanks @oc-gh-dr, @hclsys, and @1yihui. - Onboarding/GitHub Copilot: add manifest-owned `--github-copilot-token` support for non-interactive setup, including env fallback, tokenRef storage in ref mode, saved-profile reuse, and current Copilot default-model wiring. Refs #50002 and supersedes #50003. Thanks @scottgl9. diff --git a/src/cli/channel-options.ts b/src/cli/channel-options.ts index 80b162afa5b..4459ada06fd 100644 --- a/src/cli/channel-options.ts +++ b/src/cli/channel-options.ts @@ -1,7 +1,5 @@ -import fs from "node:fs"; -import path from "node:path"; -import { fileURLToPath } from "node:url"; import { CHAT_CHANNEL_ORDER } from "../channels/ids.js"; +import { readCliStartupMetadata } from "./startup-metadata.js"; function dedupe(values: string[]): string[] { const seen = new Set(); @@ -23,14 +21,8 @@ function loadPrecomputedChannelOptions(): string[] | null { return precomputedChannelOptions; } try { - const metadataPath = path.resolve( - path.dirname(fileURLToPath(import.meta.url)), - "..", - "cli-startup-metadata.json", - ); - const raw = fs.readFileSync(metadataPath, "utf8"); - const parsed = JSON.parse(raw) as { channelOptions?: unknown }; - if (Array.isArray(parsed.channelOptions)) { + const parsed = readCliStartupMetadata(import.meta.url) as { channelOptions?: unknown } | null; + if (parsed && Array.isArray(parsed.channelOptions)) { precomputedChannelOptions = dedupe( parsed.channelOptions.filter((value): value is string => typeof value === "string"), ); diff --git a/src/cli/command-registration-policy.test.ts b/src/cli/command-registration-policy.test.ts index 463b2a258dc..8c6fe25bac4 100644 --- a/src/cli/command-registration-policy.test.ts +++ b/src/cli/command-registration-policy.test.ts @@ -36,6 +36,20 @@ describe("command-registration-policy", () => { hasBuiltinPrimary: false, }), ).toBe(false); + expect( + shouldSkipPluginCommandRegistration({ + argv: ["node", "openclaw", "help", "--help"], + primary: "help", + hasBuiltinPrimary: false, + }), + ).toBe(true); + expect( + shouldSkipPluginCommandRegistration({ + argv: ["node", "openclaw", "help", "voicecall"], + primary: "help", + hasBuiltinPrimary: false, + }), + ).toBe(false); }); it("matches lazy subcommand registration policy", () => { diff --git a/src/cli/command-registration-policy.ts b/src/cli/command-registration-policy.ts index f5a2b718380..638e87693eb 100644 --- a/src/cli/command-registration-policy.ts +++ b/src/cli/command-registration-policy.ts @@ -14,6 +14,9 @@ export function shouldSkipPluginCommandRegistration(params: { if (params.hasBuiltinPrimary) { return true; } + if (params.primary === "help" && resolveCliArgvInvocation(params.argv).hasHelpOrVersion) { + return true; + } if (!params.primary) { return resolveCliArgvInvocation(params.argv).hasHelpOrVersion; } diff --git a/src/cli/root-help-metadata.ts b/src/cli/root-help-metadata.ts index 2bd4431d663..1977fbc6d1e 100644 --- a/src/cli/root-help-metadata.ts +++ b/src/cli/root-help-metadata.ts @@ -1,6 +1,4 @@ -import fs from "node:fs"; -import path from "node:path"; -import { fileURLToPath } from "node:url"; +import { readCliStartupMetadata } from "./startup-metadata.js"; let precomputedRootHelpText: string | null | undefined; let precomputedBrowserHelpText: string | null | undefined; @@ -14,17 +12,13 @@ function loadPrecomputedHelpText( return cache; } try { - const metadataPath = path.resolve( - path.dirname(fileURLToPath(import.meta.url)), - "..", - "cli-startup-metadata.json", - ); - const raw = fs.readFileSync(metadataPath, "utf8"); - const parsed = JSON.parse(raw) as Record; - const value = parsed[key]; - if (typeof value === "string" && value.length > 0) { - setCache(value); - return value; + const parsed = readCliStartupMetadata(import.meta.url); + if (parsed) { + const value = parsed[key]; + if (typeof value === "string" && value.length > 0) { + setCache(value); + return value; + } } } catch { // Fall back to live help rendering. diff --git a/src/cli/run-main.test.ts b/src/cli/run-main.test.ts index 3bab0f30d6b..49cd8d20657 100644 --- a/src/cli/run-main.test.ts +++ b/src/cli/run-main.test.ts @@ -146,8 +146,10 @@ describe("shouldUseRootHelpFastPath", () => { it("uses the fast path for root help only", () => { expect(shouldUseRootHelpFastPath(["node", "openclaw", "--help"])).toBe(true); expect(shouldUseRootHelpFastPath(["node", "openclaw", "--profile", "work", "-h"])).toBe(true); + expect(shouldUseRootHelpFastPath(["node", "openclaw", "help", "--help"])).toBe(true); expect(shouldUseRootHelpFastPath(["node", "openclaw", "status", "--help"])).toBe(false); expect(shouldUseRootHelpFastPath(["node", "openclaw", "--help", "status"])).toBe(false); + expect(shouldUseRootHelpFastPath(["node", "openclaw", "help", "gateway"])).toBe(false); }); }); diff --git a/src/cli/run-main.ts b/src/cli/run-main.ts index f639b8a4e71..563d463d3f5 100644 --- a/src/cli/run-main.ts +++ b/src/cli/run-main.ts @@ -69,9 +69,13 @@ export function shouldEnsureCliPath(argv: string[]): boolean { } export function shouldUseRootHelpFastPath(argv: string[]): boolean { + const invocation = resolveCliArgvInvocation(argv); return ( process.env.OPENCLAW_DISABLE_CLI_STARTUP_HELP_FAST_PATH !== "1" && - resolveCliArgvInvocation(argv).isRootHelpInvocation + (invocation.isRootHelpInvocation || + (invocation.commandPath.length === 1 && + invocation.commandPath[0] === "help" && + invocation.hasHelpOrVersion)) ); } diff --git a/src/cli/startup-metadata.test.ts b/src/cli/startup-metadata.test.ts new file mode 100644 index 00000000000..f8ed8792c91 --- /dev/null +++ b/src/cli/startup-metadata.test.ts @@ -0,0 +1,16 @@ +import path from "node:path"; +import { pathToFileURL } from "node:url"; +import { describe, expect, it } from "vitest"; +import { __testing } from "./startup-metadata.js"; + +describe("startup metadata path resolution", () => { + it("checks metadata beside the bundled chunk before the legacy parent path", () => { + const moduleDir = path.resolve("dist"); + const moduleUrl = pathToFileURL(path.join(moduleDir, "root-help-metadata-abc123.js")).href; + + expect(__testing.resolveStartupMetadataPathCandidates(moduleUrl)).toEqual([ + path.join(moduleDir, "cli-startup-metadata.json"), + path.join(path.dirname(moduleDir), "cli-startup-metadata.json"), + ]); + }); +}); diff --git a/src/cli/startup-metadata.ts b/src/cli/startup-metadata.ts new file mode 100644 index 00000000000..3cc89087069 --- /dev/null +++ b/src/cli/startup-metadata.ts @@ -0,0 +1,28 @@ +import fs from "node:fs"; +import path from "node:path"; +import { fileURLToPath } from "node:url"; + +const STARTUP_METADATA_FILE = "cli-startup-metadata.json"; + +function resolveStartupMetadataPathCandidates(moduleUrl: string): string[] { + const moduleDir = path.dirname(fileURLToPath(moduleUrl)); + return [ + path.resolve(moduleDir, STARTUP_METADATA_FILE), + path.resolve(moduleDir, "..", STARTUP_METADATA_FILE), + ]; +} + +export function readCliStartupMetadata(moduleUrl: string): Record | null { + for (const metadataPath of resolveStartupMetadataPathCandidates(moduleUrl)) { + try { + return JSON.parse(fs.readFileSync(metadataPath, "utf8")) as Record; + } catch { + // Try the next bundled/source layout before falling back to dynamic startup work. + } + } + return null; +} + +export const __testing = { + resolveStartupMetadataPathCandidates, +}; From d857989111671c7a607a8acc0e7d047af03127ef Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 05:13:35 +0100 Subject: [PATCH 236/418] docs: clarify package acceptance release role --- .agents/skills/openclaw-testing/SKILL.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.agents/skills/openclaw-testing/SKILL.md b/.agents/skills/openclaw-testing/SKILL.md index 36020eecea6..441e6b589f3 100644 --- a/.agents/skills/openclaw-testing/SKILL.md +++ b/.agents/skills/openclaw-testing/SKILL.md @@ -234,6 +234,13 @@ Use the manual `Package Acceptance` workflow when the question is "does this installable package work as a product?" rather than "does this source diff pass Vitest?" +In release validation, treat Package Acceptance as the package-candidate shard +inside the larger release umbrella, not as a competing full-test path. Full +Release Validation and private release gauntlets should call Package Acceptance +for tarball resolution, Docker product/package proof, and optional Telegram QA +against the same resolved `package-under-test` artifact; keep orchestration, +secret policy, blocking/advisory status, and evidence rollup in the caller. + Good defaults: ```bash From 02455c0c52dd42cc576aee87e2155b0b8ac5e987 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 05:14:15 +0100 Subject: [PATCH 237/418] ci: include telegram in release package acceptance --- .agents/skills/openclaw-testing/SKILL.md | 14 ++++--- .github/workflows/npm-telegram-beta-e2e.yml | 2 +- .github/workflows/openclaw-release-checks.yml | 6 ++- .github/workflows/package-acceptance.yml | 8 ++-- docs/ci.md | 25 ++++++++----- docs/help/testing.md | 5 ++- docs/reference/RELEASING.md | 37 ++++++++++--------- .../package-acceptance-workflow.test.ts | 18 +++++++++ 8 files changed, 75 insertions(+), 40 deletions(-) diff --git a/.agents/skills/openclaw-testing/SKILL.md b/.agents/skills/openclaw-testing/SKILL.md index 441e6b589f3..321f46383f3 100644 --- a/.agents/skills/openclaw-testing/SKILL.md +++ b/.agents/skills/openclaw-testing/SKILL.md @@ -135,8 +135,10 @@ cancel it and monitor the current run. `OpenClaw Release Checks` (`openclaw-release-checks.yml`) is the release child workflow. It is broader than normal CI but narrower than the umbrella because it -does not dispatch the separate full normal CI child. Use it when release-path -validation is needed without rerunning the entire umbrella. +does not dispatch the separate full normal CI child. It runs Package Acceptance +with `telegram_mode=mock-openai`, so the release package tarball also goes +through Telegram package QA. Use it when release-path validation is needed +without rerunning the entire umbrella. ```bash gh workflow run openclaw-release-checks.yml \ @@ -248,7 +250,8 @@ gh workflow run package-acceptance.yml --ref main \ -f source=npm \ -f workflow_ref=main \ -f package_spec=openclaw@beta \ - -f suite_profile=product + -f suite_profile=product \ + -f telegram_mode=mock-openai ``` Npm candidate selection: @@ -315,7 +318,7 @@ gh workflow run package-acceptance.yml --ref main \ -f source=ref \ -f package_ref= \ -f suite_profile=package \ - -f telegram_mode=none + -f telegram_mode=mock-openai ``` Use `telegram_mode=mock-openai` or `telegram_mode=live-frontier` when the same @@ -323,7 +326,8 @@ resolved `package-under-test` tarball should also run through the Telegram QA workflow in the `qa-live-shared` environment. The standalone Telegram workflow still accepts a published npm spec for post-publish checks, but Package Acceptance passes the resolved artifact for `source=npm`, `ref`, `url`, and -`artifact`. +`artifact`. Use `telegram_mode=none` only when intentionally skipping Telegram +credentialed package proof for a focused rerun. Docker E2E images never copy repo sources as the app under test: the bare image is a Node/Git runner, and the functional image installs the same prebuilt npm diff --git a/.github/workflows/npm-telegram-beta-e2e.yml b/.github/workflows/npm-telegram-beta-e2e.yml index b9baf3e81fe..3e11e882b59 100644 --- a/.github/workflows/npm-telegram-beta-e2e.yml +++ b/.github/workflows/npm-telegram-beta-e2e.yml @@ -77,7 +77,7 @@ env: PNPM_VERSION: "10.33.0" jobs: - run_npm_telegram_beta_e2e: + run_package_telegram_e2e: name: Run package Telegram E2E runs-on: blacksmith-32vcpu-ubuntu-2404 timeout-minutes: 60 diff --git a/.github/workflows/openclaw-release-checks.yml b/.github/workflows/openclaw-release-checks.yml index 1cbb282553d..4839cbc497a 100644 --- a/.github/workflows/openclaw-release-checks.yml +++ b/.github/workflows/openclaw-release-checks.yml @@ -228,7 +228,11 @@ jobs: source: ref package_ref: ${{ needs.resolve_target.outputs.ref }} suite_profile: package - telegram_mode: none + telegram_mode: mock-openai + secrets: + OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} + OPENCLAW_QA_CONVEX_SITE_URL: ${{ secrets.OPENCLAW_QA_CONVEX_SITE_URL }} + OPENCLAW_QA_CONVEX_SECRET_CI: ${{ secrets.OPENCLAW_QA_CONVEX_SECRET_CI }} qa_lab_parity_release_checks: name: Run QA Lab parity gate diff --git a/.github/workflows/package-acceptance.yml b/.github/workflows/package-acceptance.yml index 53cc8ea5fbe..1db8a986d38 100644 --- a/.github/workflows/package-acceptance.yml +++ b/.github/workflows/package-acceptance.yml @@ -471,7 +471,7 @@ jobs: OPENCLAW_GEMINI_SETTINGS_JSON: ${{ secrets.OPENCLAW_GEMINI_SETTINGS_JSON }} FIREWORKS_API_KEY: ${{ secrets.FIREWORKS_API_KEY }} - npm_telegram: + package_telegram: name: Telegram package acceptance needs: resolve_package if: needs.resolve_package.outputs.telegram_enabled == 'true' @@ -488,7 +488,7 @@ jobs: summary: name: Verify package acceptance - needs: [resolve_package, docker_acceptance, npm_telegram] + needs: [resolve_package, docker_acceptance, package_telegram] if: always() runs-on: ubuntu-24.04 timeout-minutes: 5 @@ -496,7 +496,7 @@ jobs: - name: Verify package acceptance results env: DOCKER_RESULT: ${{ needs.docker_acceptance.result }} - NPM_TELEGRAM_RESULT: ${{ needs.npm_telegram.result }} + PACKAGE_TELEGRAM_RESULT: ${{ needs.package_telegram.result }} RESOLVE_RESULT: ${{ needs.resolve_package.result }} shell: bash run: | @@ -505,7 +505,7 @@ jobs: for item in \ "resolve_package=${RESOLVE_RESULT}" \ "docker_acceptance=${DOCKER_RESULT}" \ - "npm_telegram=${NPM_TELEGRAM_RESULT}" + "package_telegram=${PACKAGE_TELEGRAM_RESULT}" do name="${item%%=*}" result="${item#*=}" diff --git a/docs/ci.md b/docs/ci.md index b8e6f9590c9..c3df14b047e 100644 --- a/docs/ci.md +++ b/docs/ci.md @@ -47,9 +47,10 @@ The workflow has four jobs: that artifact, validates the tarball inventory, prepares package-digest Docker images when needed, and runs the selected Docker lanes against that package instead of packing the workflow checkout. -3. `npm_telegram` optionally calls `NPM Telegram Beta E2E`. It runs only when - `telegram_mode` is not `none`, and only for `source=npm`, because that lane - installs a published package spec. +3. `package_telegram` optionally calls `NPM Telegram Beta E2E`. It runs when + `telegram_mode` is not `none` and installs the same `package-under-test` + artifact when Package Acceptance resolved one; standalone Telegram dispatch + can still install a published npm spec. 4. `summary` fails the workflow if package resolution, Docker acceptance, or the optional Telegram lane failed. @@ -83,11 +84,13 @@ Profiles map to Docker coverage: - `custom`: exact `docker_lanes`; required when `suite_profile=custom` Release checks call Package Acceptance with `source=ref`, -`package_ref=`, `workflow_ref=`, and -`suite_profile=package`. That profile is the GitHub-native replacement for most -Parallels package/update validation. Cross-OS release checks still cover -OS-specific onboarding, installer, and platform behavior; package/update -product validation should start with Package Acceptance. +`package_ref=`, `workflow_ref=`, +`suite_profile=package`, and `telegram_mode=mock-openai`. That profile is the +GitHub-native replacement for most Parallels package/update validation, with +Telegram proving the same package artifact through the QA live transport. +Cross-OS release checks still cover OS-specific onboarding, installer, and +platform behavior; package/update product validation should start with Package +Acceptance. Examples: @@ -98,7 +101,8 @@ gh workflow run package-acceptance.yml \ -f workflow_ref=main \ -f source=npm \ -f package_spec=openclaw@beta \ - -f suite_profile=product + -f suite_profile=product \ + -f telegram_mode=mock-openai # Pack and validate a release branch with the current harness. gh workflow run package-acceptance.yml \ @@ -106,7 +110,8 @@ gh workflow run package-acceptance.yml \ -f workflow_ref=main \ -f source=ref \ -f package_ref=release/YYYY.M.D \ - -f suite_profile=package + -f suite_profile=package \ + -f telegram_mode=mock-openai # Validate a tarball URL. SHA-256 is mandatory for source=url. gh workflow run package-acceptance.yml \ diff --git a/docs/help/testing.md b/docs/help/testing.md index 160b128baf4..4284c7938af 100644 --- a/docs/help/testing.md +++ b/docs/help/testing.md @@ -167,7 +167,8 @@ runs the same lanes before release approval. gh workflow run package-acceptance.yml --ref main \ -f source=npm \ -f package_spec=openclaw@beta \ - -f suite_profile=product + -f suite_profile=product \ + -f telegram_mode=mock-openai ``` - Exact tarball URL proof requires a digest: @@ -647,7 +648,7 @@ These Docker runners split into two buckets: `OPENCLAW_LIVE_GATEWAY_MODEL_TIMEOUT_MS=90000`. Override those env vars when you explicitly want the larger exhaustive scan. - `test:docker:all` builds the live Docker image once via `test:docker:live-build`, packs OpenClaw once as an npm tarball through `scripts/package-openclaw-for-docker.mjs`, then builds/reuses two `scripts/e2e/Dockerfile` images. The bare image is only the Node/Git runner for install/update/plugin-dependency lanes; those lanes mount the prebuilt tarball. The functional image installs the same tarball into `/app` for built-app functionality lanes. Docker lane definitions live in `scripts/lib/docker-e2e-scenarios.mjs`; planner logic lives in `scripts/lib/docker-e2e-plan.mjs`; `scripts/test-docker-all.mjs` executes the selected plan. The aggregate uses a weighted local scheduler: `OPENCLAW_DOCKER_ALL_PARALLELISM` controls process slots, while resource caps keep heavy live, npm-install, and multi-service lanes from all starting at once. If a single lane is heavier than the active caps, the scheduler can still start it when the pool is empty and then keeps it running alone until capacity is available again. Defaults are 10 slots, `OPENCLAW_DOCKER_ALL_LIVE_LIMIT=9`, `OPENCLAW_DOCKER_ALL_NPM_LIMIT=10`, and `OPENCLAW_DOCKER_ALL_SERVICE_LIMIT=7`; tune `OPENCLAW_DOCKER_ALL_WEIGHT_LIMIT` or `OPENCLAW_DOCKER_ALL_DOCKER_LIMIT` only when the Docker host has more headroom. The runner performs a Docker preflight by default, removes stale OpenClaw E2E containers, prints status every 30 seconds, stores successful lane timings in `.artifacts/docker-tests/lane-timings.json`, and uses those timings to start longer lanes first on later runs. Use `OPENCLAW_DOCKER_ALL_DRY_RUN=1` to print the weighted lane manifest without building or running Docker, or `node scripts/test-docker-all.mjs --plan-json` to print the CI plan for selected lanes, package/image needs, and credentials. -- `Package Acceptance` is the GitHub-native package gate for "does this installable tarball work as a product?" It resolves one candidate package from `source=npm`, `source=ref`, `source=url`, or `source=artifact`, uploads it as `package-under-test`, then runs the reusable Docker E2E lanes against that exact tarball instead of repacking the selected ref. `workflow_ref` selects the trusted workflow/harness scripts, while `package_ref` selects the source commit/branch/tag to pack when `source=ref`; this lets current acceptance logic validate older trusted commits. Profiles are ordered by breadth: `smoke` is quick install/channel/agent plus gateway/config, `package` is the package/update/plugin contract and the default native replacement for most Parallels package/update coverage, `product` adds MCP channels, cron/subagent cleanup, OpenAI web search, and OpenWebUI, and `full` runs the release-path Docker chunks with OpenWebUI. Release validation runs the `package` profile for the target ref. +- `Package Acceptance` is the GitHub-native package gate for "does this installable tarball work as a product?" It resolves one candidate package from `source=npm`, `source=ref`, `source=url`, or `source=artifact`, uploads it as `package-under-test`, then runs the reusable Docker E2E lanes against that exact tarball instead of repacking the selected ref. `workflow_ref` selects the trusted workflow/harness scripts, while `package_ref` selects the source commit/branch/tag to pack when `source=ref`; this lets current acceptance logic validate older trusted commits. Profiles are ordered by breadth: `smoke` is quick install/channel/agent plus gateway/config, `package` is the package/update/plugin contract and the default native replacement for most Parallels package/update coverage, `product` adds MCP channels, cron/subagent cleanup, OpenAI web search, and OpenWebUI, and `full` runs the release-path Docker chunks with OpenWebUI. Release validation runs the `package` profile for the target ref with Telegram package QA enabled. - Container smoke runners: `test:docker:openwebui`, `test:docker:onboard`, `test:docker:npm-onboard-channel-agent`, `test:docker:update-channel-switch`, `test:docker:session-runtime-context`, `test:docker:agents-delete-shared-workspace`, `test:docker:gateway-network`, `test:docker:browser-cdp-snapshot`, `test:docker:mcp-channels`, `test:docker:pi-bundle-mcp-tools`, `test:docker:cron-mcp-cleanup`, `test:docker:plugins`, `test:docker:plugin-update`, and `test:docker:config-reload` boot one or more real containers and verify higher-level integration paths. The live-model Docker runners also bind-mount only the needed CLI auth homes (or all supported ones when the run is not narrowed), then copy them into the container home before the run so external-CLI OAuth can refresh tokens without mutating the host auth store: diff --git a/docs/reference/RELEASING.md b/docs/reference/RELEASING.md index 20b5171a4a3..390fc59f5a7 100644 --- a/docs/reference/RELEASING.md +++ b/docs/reference/RELEASING.md @@ -82,10 +82,11 @@ the maintainer-only release runbook. preflight artifact via `preflight_run_id`; stable macOS release readiness also requires the packaged `.zip`, `.dmg`, `.dSYM.zip`, and updated `appcast.xml` on `main`. -11. After publish, run the npm post-publish verifier, optional published-npm - Telegram E2E, dist-tag promotion when needed, GitHub release/prerelease - notes from the complete matching `CHANGELOG.md` section, and the release - announcement steps. +11. After publish, run the npm post-publish verifier, optional standalone + published-npm Telegram E2E when you need post-publish channel proof, + dist-tag promotion when needed, GitHub release/prerelease notes from the + complete matching `CHANGELOG.md` section, and the release announcement + steps. ## Release preflight @@ -112,8 +113,9 @@ the maintainer-only release runbook. SHA-256; or `source=artifact` for a tarball uploaded by another GitHub Actions run. The workflow resolves the candidate to `package-under-test`, reuses the Docker E2E release scheduler against that - tarball, and can optionally run Telegram QA against the same tarball. - Example: `gh workflow run package-acceptance.yml --ref main -f workflow_ref=main -f source=npm -f package_spec=openclaw@beta -f suite_profile=product` + tarball, and can run Telegram QA against the same tarball with + `telegram_mode=mock-openai` or `telegram_mode=live-frontier`. + Example: `gh workflow run package-acceptance.yml --ref main -f workflow_ref=main -f source=npm -f package_spec=openclaw@beta -f suite_profile=product -f telegram_mode=mock-openai` Common profiles: - `smoke`: install/channel/agent, gateway network, and config reload lanes - `package`: package/update/plugin lanes without OpenWebUI @@ -235,13 +237,13 @@ gh workflow run full-release-validation.yml \ The workflow resolves the target ref, dispatches manual `CI` with `target_ref=`, dispatches `OpenClaw Release Checks`, and -optionally dispatches post-publish Telegram E2E when +optionally dispatches standalone post-publish Telegram E2E when `npm_telegram_package_spec` is set. `OpenClaw Release Checks` then fans out install smoke, cross-OS release checks, live/E2E Docker release-path coverage, -Package Acceptance, QA Lab parity, live Matrix, and live Telegram. A full run is -only acceptable when the `Full Release Validation` summary shows `normal_ci` and -`release_checks` as successful, and any optional `npm_telegram` child is either -successful or intentionally skipped. +Package Acceptance with Telegram package QA, QA Lab parity, live Matrix, and +live Telegram. A full run is only acceptable when the `Full Release Validation` +summary shows `normal_ci` and `release_checks` as successful, and any optional +`npm_telegram` child is either successful or intentionally skipped. Use these variants depending on release stage: @@ -363,12 +365,13 @@ Supported candidate sources: - `source=artifact`: reuse a `.tgz` uploaded by another GitHub Actions run `OpenClaw Release Checks` runs Package Acceptance with `source=ref`, -`package_ref=`, and `suite_profile=package`. That profile covers -install, update, and plugin package contracts and is the GitHub-native -replacement for most of the package/update coverage that previously required -Parallels. Cross-OS release checks still matter for OS-specific onboarding, -installer, and platform behavior, but package/update product validation should -prefer Package Acceptance. +`package_ref=`, `suite_profile=package`, and +`telegram_mode=mock-openai`. That profile covers install, update, plugin +package contracts, and Telegram package QA against the same resolved tarball, +and is the GitHub-native replacement for most of the package/update coverage +that previously required Parallels. Cross-OS release checks still matter for +OS-specific onboarding, installer, and platform behavior, but package/update +product validation should prefer Package Acceptance. Use broader Package Acceptance profiles when the release question is about an actual installable package: diff --git a/test/scripts/package-acceptance-workflow.test.ts b/test/scripts/package-acceptance-workflow.test.ts index 18b062ef892..8afe59fbee7 100644 --- a/test/scripts/package-acceptance-workflow.test.ts +++ b/test/scripts/package-acceptance-workflow.test.ts @@ -77,6 +77,7 @@ describe("package artifact reuse", () => { expect(workflow).toContain("OPENCLAW_NPM_TELEGRAM_PACKAGE_TGZ"); expect(workflow).toContain("provider_mode:"); expect(workflow).toContain("provider_mode must be mock-openai or live-frontier"); + expect(workflow).toContain("run_package_telegram_e2e:"); }); it("includes package acceptance in release checks", () => { @@ -86,5 +87,22 @@ describe("package artifact reuse", () => { expect(workflow).toContain("uses: ./.github/workflows/package-acceptance.yml"); expect(workflow).toContain("package_ref: ${{ needs.resolve_target.outputs.ref }}"); expect(workflow).toContain("suite_profile: package"); + expect(workflow).toContain("telegram_mode: mock-openai"); + expect(workflow).toContain( + "OPENCLAW_QA_CONVEX_SITE_URL: ${{ secrets.OPENCLAW_QA_CONVEX_SITE_URL }}", + ); + expect(workflow).toContain( + "OPENCLAW_QA_CONVEX_SECRET_CI: ${{ secrets.OPENCLAW_QA_CONVEX_SECRET_CI }}", + ); + }); + + it("names package acceptance Telegram as artifact-backed package validation", () => { + const workflow = readFileSync(PACKAGE_ACCEPTANCE_WORKFLOW, "utf8"); + + expect(workflow).toContain("package_telegram:"); + expect(workflow).toContain("needs: [resolve_package, docker_acceptance, package_telegram]"); + expect(workflow).toContain("PACKAGE_TELEGRAM_RESULT:"); + expect(workflow).toContain("package_telegram=${PACKAGE_TELEGRAM_RESULT}"); + expect(workflow).not.toContain("npm_telegram:"); }); }); From d4bb4912fc3f9ee89dd21ce837c6aca9c6acf6b6 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 21:22:24 -0700 Subject: [PATCH 238/418] docs(cron): regroup notes into themed sections --- docs/cli/cron.md | 195 ++++++++++++++++++++++++++--------------------- 1 file changed, 108 insertions(+), 87 deletions(-) diff --git a/docs/cli/cron.md b/docs/cli/cron.md index a0a11173073..2be650671a4 100644 --- a/docs/cli/cron.md +++ b/docs/cli/cron.md @@ -2,7 +2,7 @@ summary: "CLI reference for `openclaw cron` (schedule and run background jobs)" read_when: - You want scheduled jobs and wakeups - - You’re debugging cron execution and logs + - You are debugging cron execution and logs title: "Cron" --- @@ -10,92 +10,134 @@ title: "Cron" Manage cron jobs for the Gateway scheduler. -Related: + +Run `openclaw cron --help` for the full command surface. See [Cron jobs](/automation/cron-jobs) for the conceptual guide. + -- Cron jobs: [Cron jobs](/automation/cron-jobs) +## Sessions -Tip: run `openclaw cron --help` for the full command surface. +`--session` accepts `main`, `isolated`, `current`, or `session:`. -Note: `openclaw cron list` and `openclaw cron show ` preview the -resolved delivery route. For `channel: "last"`, the preview shows whether the -route resolved from the main/current session or will fail closed. + + + - `main` binds to the agent's main session. + - `isolated` creates a fresh transcript and session id for each run. + - `current` binds to the active session at creation time. + - `session:` pins to an explicit persistent session key. + + + Isolated runs reset ambient conversation context. Channel and group routing, send/queue policy, elevation, origin, and ACP runtime binding are reset for the new run. Safe preferences and explicit user-selected model or auth overrides can carry across runs. + + -Note: isolated `cron add` jobs default to `--announce` delivery. Use `--no-deliver` to keep -output internal. `--deliver` remains as a deprecated alias for `--announce`. +## Delivery -Note: isolated cron chat delivery is shared. `--announce` is runner fallback -delivery for the final reply; `--no-deliver` disables that fallback but does -not remove the agent's `message` tool when a chat route is available. +`openclaw cron list` and `openclaw cron show ` preview the resolved delivery route. For `channel: "last"`, the preview shows whether the route resolved from the main or current session, or will fail closed. -Note: one-shot (`--at`) jobs delete after success by default. Use `--keep-after-run` to keep them. + +Isolated `cron add` jobs default to `--announce` delivery. Use `--no-deliver` to keep output internal. `--deliver` remains as a deprecated alias for `--announce`. + -Note: `--session` supports `main`, `isolated`, `current`, and `session:`. -Use `current` to bind to the active session at creation time, or `session:` for -an explicit persistent session key. +### Delivery ownership -Note: `--session isolated` creates a fresh transcript/session id for each run. -Safe preferences and explicit user-selected model/auth overrides can carry, but -ambient conversation context does not: channel/group routing, send/queue policy, -elevation, origin, and ACP runtime binding are reset for the new isolated run. +Isolated cron chat delivery is shared between the agent and the runner: -Note: for one-shot CLI jobs, offset-less `--at` datetimes are treated as UTC unless you also pass -`--tz `, which interprets that local wall-clock time in the given timezone. +- The agent can send directly using the `message` tool when a chat route is available. +- `announce` fallback-delivers the final reply only when the agent did not send directly to the resolved target. +- `webhook` posts the finished payload to a URL. +- `none` disables runner fallback delivery. -Note: recurring jobs now use exponential retry backoff after consecutive errors (30s → 1m → 5m → 15m → 60m), then return to normal schedule after the next successful run. +`--announce` is runner fallback delivery for the final reply. `--no-deliver` disables that fallback but does not remove the agent's `message` tool when a chat route is available. -Note: `openclaw cron run` now returns as soon as the manual run is queued for execution. Successful responses include `{ ok: true, enqueued: true, runId }`; use `openclaw cron runs --id ` to follow the eventual outcome. +Reminders created from an active chat preserve the live chat delivery target for fallback announce delivery. Internal session keys may be lowercase; do not use them as a source of truth for case-sensitive provider IDs such as Matrix room IDs. -Note: `openclaw cron run ` force-runs by default. Use `--due` to keep the -older "only run if due" behavior. +### Failure delivery -Note: isolated cron turns suppress stale acknowledgement-only replies. If the -first result is just an interim status update and no descendant subagent run is -responsible for the eventual answer, cron re-prompts once for the real result -before delivery. +Failure notifications resolve in this order: -Note: if an isolated cron run returns only the silent token (`NO_REPLY` / -`no_reply`), cron suppresses direct outbound delivery and the fallback queued -summary path as well, so nothing is posted back to chat. +1. `delivery.failureDestination` on the job. +2. Global `cron.failureDestination`. +3. The job's primary announce target (when no explicit failure destination is set). -Note: isolated cron runs prefer structured execution-denial metadata from the -embedded run, then fall back to known denial markers in final output, such as -`SYSTEM_RUN_DENIED`, `INVALID_REQUEST`, and approval-binding refusal phrases. -`cron list` and run history surface the denial reason instead of reporting a -blocked command as `ok`. + +Main-session jobs may only use `delivery.failureDestination` when primary delivery mode is `webhook`. Isolated jobs accept it in all modes. + -Note: `cron add|edit --model ...` uses that selected allowed model for the job. -If the model is not allowed, cron warns and falls back to the job's agent/default -model selection instead. Configured fallback chains still apply, but a plain -model override with no explicit per-job fallback list no longer appends the -agent primary as a hidden extra retry target. +## Scheduling -Note: isolated cron model precedence is Gmail-hook override first, then per-job -`--model`, then any user-selected stored cron-session model override, then the -normal agent/default selection. +### One-shot jobs -Note: isolated cron fast mode follows the resolved live model selection. Model -config `params.fastMode` applies by default, but a stored session `fastMode` -override still wins over config. +`--at ` schedules a one-shot run. Offset-less datetimes are treated as UTC unless you also pass `--tz `, which interprets the wall-clock time in the given timezone. -Note: if an isolated run throws `LiveSessionModelSwitchError`, cron persists the -switched provider/model (and switched auth profile override when present) for -the active run before retrying. The outer retry loop is bounded to 2 switch -retries after the initial attempt, then aborts instead of looping forever. + +One-shot jobs delete after success by default. Use `--keep-after-run` to preserve them. + -Note: failure notifications use `delivery.failureDestination` first, then -global `cron.failureDestination`, and finally fall back to the job's primary -announce target when no explicit failure destination is configured. +### Recurring jobs -Note: retention/pruning is controlled in config: +Recurring jobs use exponential retry backoff after consecutive errors: 30s, 1m, 5m, 15m, 60m. The schedule returns to normal after the next successful run. + +### Manual runs + +`openclaw cron run` returns as soon as the manual run is queued. Successful responses include `{ ok: true, enqueued: true, runId }`. Use `openclaw cron runs --id ` to follow the eventual outcome. + + +`openclaw cron run ` force-runs by default. Use `--due` to keep the older "only run if due" behavior. + + +## Models + +`cron add|edit --model ` selects an allowed model for the job. + + +If the model is not allowed, cron warns and falls back to the job's agent or default model selection. Configured fallback chains still apply, but a plain model override with no explicit per-job fallback list no longer appends the agent primary as a hidden extra retry target. + + +### Isolated cron model precedence + +Isolated cron resolves the active model in this order: + +1. Gmail-hook override. +2. Per-job `--model`. +3. Stored cron-session model override (when the user selected one). +4. Agent or default model selection. + +### Fast mode + +Isolated cron fast mode follows the resolved live model selection. Model config `params.fastMode` applies by default, but a stored session `fastMode` override still wins over config. + +### Live model switch retries + +If an isolated run throws `LiveSessionModelSwitchError`, cron persists the switched provider and model (and switched auth profile override when present) for the active run before retrying. The outer retry loop is bounded to two switch retries after the initial attempt, then aborts instead of looping forever. + +## Run output and denials + +### Stale acknowledgement suppression + +Isolated cron turns suppress stale acknowledgement-only replies. If the first result is just an interim status update and no descendant subagent run is responsible for the eventual answer, cron re-prompts once for the real result before delivery. + +### Silent token suppression + +If an isolated cron run returns only the silent token (`NO_REPLY` or `no_reply`), cron suppresses both direct outbound delivery and the fallback queued summary path, so nothing is posted back to chat. + +### Structured denials + +Isolated cron runs prefer structured execution-denial metadata from the embedded run, then fall back to known denial markers in final output, such as `SYSTEM_RUN_DENIED`, `INVALID_REQUEST`, and approval-binding refusal phrases. + +`cron list` and run history surface the denial reason instead of reporting a blocked command as `ok`. + +## Retention + +Retention and pruning are controlled in config: - `cron.sessionRetention` (default `24h`) prunes completed isolated run sessions. -- `cron.runLog.maxBytes` + `cron.runLog.keepLines` prune `~/.openclaw/cron/runs/.jsonl`. +- `cron.runLog.maxBytes` and `cron.runLog.keepLines` prune `~/.openclaw/cron/runs/.jsonl`. -Upgrade note: if you have older cron jobs from before the current delivery/store format, run -`openclaw doctor --fix`. Doctor now normalizes legacy cron fields (`jobId`, `schedule.cron`, -top-level delivery fields including legacy `threadId`, payload `provider` delivery aliases) and migrates simple -`notify: true` webhook fallback jobs to explicit webhook delivery when `cron.webhook` is -configured. +## Migrating older jobs + + +If you have cron jobs from before the current delivery and store format, run `openclaw doctor --fix`. Doctor normalizes legacy cron fields (`jobId`, `schedule.cron`, top-level delivery fields including legacy `threadId`, payload `provider` delivery aliases) and migrates simple `notify: true` webhook fallback jobs to explicit webhook delivery when `cron.webhook` is configured. + ## Common edits @@ -137,21 +179,9 @@ openclaw cron add \ `--light-context` applies to isolated agent-turn jobs only. For cron runs, lightweight mode keeps bootstrap context empty instead of injecting the full workspace bootstrap set. -Delivery ownership note: - -- Isolated cron chat delivery is shared. The agent can send directly with the - `message` tool when a chat route is available. -- `announce` fallback-delivers the final reply only when the agent did not send - directly to the resolved target. `webhook` posts the finished payload to a URL. - `none` disables runner fallback delivery. -- Reminders created from an active chat preserve the live chat delivery target - for fallback announce delivery. Internal session keys may be lowercase; do not - use them as a source of truth for case-sensitive provider IDs such as Matrix - room IDs. - ## Common admin commands -Manual run: +Manual run and inspection: ```bash openclaw cron list @@ -161,10 +191,9 @@ openclaw cron run --due openclaw cron runs --id --limit 50 ``` -`cron runs` entries include delivery diagnostics with the intended cron target, -the resolved target, message-tool sends, fallback use, and delivered state. +`cron runs` entries include delivery diagnostics with the intended cron target, the resolved target, message-tool sends, fallback use, and delivered state. -Agent/session retargeting: +Agent and session retargeting: ```bash openclaw cron edit --agent ops @@ -182,14 +211,6 @@ openclaw cron edit --no-best-effort-deliver openclaw cron edit --no-deliver ``` -Failure-delivery note: - -- `delivery.failureDestination` is supported for isolated jobs. -- Main-session jobs may only use `delivery.failureDestination` when primary - delivery mode is `webhook`. -- If you do not set any failure destination and the job already announces to a - channel, failure notifications reuse that same announce target. - ## Related - [CLI reference](/cli) From 3f1ce689a13ad4cc905492ad478b68229e2881ac Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 21:22:28 -0700 Subject: [PATCH 239/418] docs(compaction): dedupe sections and consolidate config --- docs/concepts/compaction.md | 202 ++++++++++++++++-------------------- 1 file changed, 87 insertions(+), 115 deletions(-) diff --git a/docs/concepts/compaction.md b/docs/concepts/compaction.md index d7ebc4504d4..e0da752b7a8 100644 --- a/docs/concepts/compaction.md +++ b/docs/concepts/compaction.md @@ -6,9 +6,7 @@ read_when: title: "Compaction" --- -Every model has a context window -- the maximum number of tokens it can process. -When a conversation approaches that limit, OpenClaw **compacts** older messages -into a summary so the chat can continue. +Every model has a context window: the maximum number of tokens it can process. When a conversation approaches that limit, OpenClaw **compacts** older messages into a summary so the chat can continue. ## How it works @@ -16,33 +14,53 @@ into a summary so the chat can continue. 2. The summary is saved in the session transcript. 3. Recent messages are kept intact. -When OpenClaw splits history into compaction chunks, it keeps assistant tool -calls paired with their matching `toolResult` entries. If a split point lands -inside a tool block, OpenClaw moves the boundary so the pair stays together and -the current unsummarized tail is preserved. +When OpenClaw splits history into compaction chunks, it keeps assistant tool calls paired with their matching `toolResult` entries. If a split point lands inside a tool block, OpenClaw moves the boundary so the pair stays together and the current unsummarized tail is preserved. -The full conversation history stays on disk. Compaction only changes what the -model sees on the next turn. +The full conversation history stays on disk. Compaction only changes what the model sees on the next turn. ## Auto-compaction -Auto-compaction is on by default. It runs when the session nears the context -limit, or when the model returns a context-overflow error (in which case -OpenClaw compacts and retries). Typical overflow signatures include -`request_too_large`, `context length exceeded`, `input exceeds the maximum -number of tokens`, `input token count exceeds the maximum number of input -tokens`, `input is too long for the model`, and `ollama error: context length -exceeded`. +Auto-compaction is on by default. It runs when the session nears the context limit, or when the model returns a context-overflow error (in which case OpenClaw compacts and retries). + +You will see: + +- `🧹 Auto-compaction complete` in verbose mode. +- `/status` showing `🧹 Compactions: `. -Before compacting, OpenClaw automatically reminds the agent to save important -notes to [memory](/concepts/memory) files. This prevents context loss. +Before compacting, OpenClaw automatically reminds the agent to save important notes to [memory](/concepts/memory) files. This prevents context loss. -Use the `agents.defaults.compaction` setting in your `openclaw.json` to configure compaction behavior (mode, target tokens, etc.). -Compaction summarization preserves opaque identifiers by default (`identifierPolicy: "strict"`). You can override this with `identifierPolicy: "off"` or provide custom text with `identifierPolicy: "custom"` and `identifierInstructions`. + + + OpenClaw detects context overflow from these provider error patterns: -You can optionally specify a different model for compaction summarization via `agents.defaults.compaction.model`. This is useful when your primary model is a local or small model and you want compaction summaries produced by a more capable model. The override accepts any `provider/model-id` string: + - `request_too_large` + - `context length exceeded` + - `input exceeds the maximum number of tokens` + - `input token count exceeds the maximum number of input tokens` + - `input is too long for the model` + - `ollama error: context length exceeded` + + + +## Manual compaction + +Type `/compact` in any chat to force a compaction. Add instructions to guide the summary: + +``` +/compact Focus on the API design decisions +``` + +When `agents.defaults.compaction.keepRecentTokens` is set, manual compaction honors that Pi cut-point and keeps the recent tail in rebuilt context. Without an explicit keep budget, manual compaction behaves as a hard checkpoint and continues from the new summary alone. + +## Configuration + +Configure compaction under `agents.defaults.compaction` in your `openclaw.json`. The most common knobs are listed below; for the full reference, see [Session management deep dive](/reference/session-management-compaction). + +### Using a different model + +By default, compaction uses the agent's primary model. Set `agents.defaults.compaction.model` to delegate summarization to a more capable or specialized model. The override accepts any `provider/model-id` string: ```json { @@ -56,7 +74,7 @@ You can optionally specify a different model for compaction summarization via `a } ``` -This also works with local models, for example a second Ollama model dedicated to summarization or a fine-tuned compaction specialist: +This works with local models too, for example a second Ollama model dedicated to summarization: ```json { @@ -70,91 +88,27 @@ This also works with local models, for example a second Ollama model dedicated t } ``` -When unset, compaction uses the agent’s primary model. +When unset, compaction uses the agent's primary model. -## Pluggable compaction providers +### Identifier preservation -Plugins can register a custom compaction provider via `registerCompactionProvider()` on the plugin API. When a provider is registered and configured, OpenClaw delegates summarization to it instead of the built-in LLM pipeline. +Compaction summarization preserves opaque identifiers by default (`identifierPolicy: "strict"`). Override with `identifierPolicy: "off"` to disable, or `identifierPolicy: "custom"` plus `identifierInstructions` for custom guidance. -To use a registered provider, set the provider id in your config: +### Active transcript byte guard -```json -{ - "agents": { - "defaults": { - "compaction": { - "provider": "my-provider" - } - } - } -} -``` +When `agents.defaults.compaction.maxActiveTranscriptBytes` is set, OpenClaw triggers normal local compaction before a run if the active JSONL reaches that size. This is useful for long-running sessions where provider-side context management may keep model context healthy while the local transcript keeps growing. It does not split raw JSONL bytes; it asks the normal compaction pipeline to create a semantic summary. -Setting a `provider` automatically forces `mode: "safeguard"`. Providers receive the same compaction instructions and identifier-preservation policy as the built-in path, and OpenClaw still preserves recent-turn and split-turn suffix context after provider output. If the provider fails or returns an empty result, OpenClaw falls back to built-in LLM summarization. + +The byte guard requires `truncateAfterCompaction: true`. Without transcript rotation, the active file would not shrink and the guard remains inactive. + -## Auto-compaction (default on) +### Successor transcripts -When a session nears or exceeds the model’s context window, OpenClaw triggers auto-compaction and may retry the original request using the compacted context. +When `agents.defaults.compaction.truncateAfterCompaction` is enabled, OpenClaw does not rewrite the existing transcript in place. It creates a new active successor transcript from the compaction summary, preserved state, and unsummarized tail, then keeps the previous JSONL as the archived checkpoint source. -You’ll see: +### Compaction notices -- `🧹 Auto-compaction complete` in verbose mode -- `/status` showing `🧹 Compactions: ` - -Before compaction, OpenClaw can run a **silent memory flush** turn to store -durable notes to disk. See [Memory](/concepts/memory) for details and config. - -## Manual compaction - -Type `/compact` in any chat to force a compaction. Add instructions to guide -the summary: - -``` -/compact Focus on the API design decisions -``` - -When `agents.defaults.compaction.keepRecentTokens` is set, manual compaction -honors that Pi cut-point and keeps the recent tail in rebuilt context. Without -an explicit keep budget, manual compaction behaves as a hard checkpoint and -continues from the new summary alone. - -When `agents.defaults.compaction.truncateAfterCompaction` is enabled, -OpenClaw does not rewrite the existing transcript in place. It creates a new -active successor transcript from the compaction summary, preserved state, and -unsummarized tail, then keeps the previous JSONL as the archived checkpoint -source. - -When `agents.defaults.compaction.maxActiveTranscriptBytes` is set, OpenClaw can -trigger normal local compaction before a run if the active JSONL reaches that -size. This is useful for long-running sessions where provider-side context -management may keep model context healthy while the local transcript keeps -growing. It does not split raw JSONL bytes; it only asks the normal compaction -pipeline to create a semantic summary. Combine it with -`truncateAfterCompaction: true` to move future turns onto the smaller successor -transcript; without transcript rotation, the byte guard remains inactive because -the active file would not shrink. - -## Using a different model - -By default, compaction uses your agent's primary model. You can use a more -capable model for better summaries: - -```json5 -{ - agents: { - defaults: { - compaction: { - model: "openrouter/anthropic/claude-sonnet-4-6", - }, - }, - }, -} -``` - -## Compaction notices - -By default, compaction runs silently. To show brief notices when compaction -starts and when it completes, enable `notifyUser`: +By default, compaction runs silently. Set `notifyUser` to show brief status messages when compaction starts and completes: ```json5 { @@ -168,8 +122,33 @@ starts and when it completes, enable `notifyUser`: } ``` -When enabled, the user sees short status messages around each compaction run -(for example, "Compacting context..." and "Compaction complete"). +### Memory flush + +Before compaction, OpenClaw can run a **silent memory flush** turn to store durable notes to disk. See [Memory](/concepts/memory) for details and config. + +## Pluggable compaction providers + +Plugins can register a custom compaction provider via `registerCompactionProvider()` on the plugin API. When a provider is registered and configured, OpenClaw delegates summarization to it instead of the built-in LLM pipeline. + +To use a registered provider, set its id in your config: + +```json +{ + "agents": { + "defaults": { + "compaction": { + "provider": "my-provider" + } + } + } +} +``` + +Setting a `provider` automatically forces `mode: "safeguard"`. Providers receive the same compaction instructions and identifier-preservation policy as the built-in path, and OpenClaw still preserves recent-turn and split-turn suffix context after provider output. + + +If the provider fails or returns an empty result, OpenClaw falls back to built-in LLM summarization. + ## Compaction vs pruning @@ -179,28 +158,21 @@ When enabled, the user sees short status messages around each compaction run | **Saved?** | Yes (in session transcript) | No (in-memory only, per request) | | **Scope** | Entire conversation | Tool results only | -[Session pruning](/concepts/session-pruning) is a lighter-weight complement that -trims tool output without summarizing. +[Session pruning](/concepts/session-pruning) is a lighter-weight complement that trims tool output without summarizing. ## Troubleshooting -**Compacting too often?** The model's context window may be small, or tool -outputs may be large. Try enabling -[session pruning](/concepts/session-pruning). +**Compacting too often?** The model's context window may be small, or tool outputs may be large. Try enabling [session pruning](/concepts/session-pruning). -**Context feels stale after compaction?** Use `/compact Focus on ` to -guide the summary, or enable the [memory flush](/concepts/memory) so notes -survive. +**Context feels stale after compaction?** Use `/compact Focus on ` to guide the summary, or enable the [memory flush](/concepts/memory) so notes survive. **Need a clean slate?** `/new` starts a fresh session without compacting. -For advanced configuration (reserve tokens, identifier preservation, custom -context engines, OpenAI server-side compaction), see the -[Session Management Deep Dive](/reference/session-management-compaction). +For advanced configuration (reserve tokens, identifier preservation, custom context engines, OpenAI server-side compaction), see the [Session management deep dive](/reference/session-management-compaction). ## Related -- [Session](/concepts/session) — session management and lifecycle -- [Session Pruning](/concepts/session-pruning) — trimming tool results -- [Context](/concepts/context) — how context is built for agent turns -- [Hooks](/automation/hooks) — compaction lifecycle hooks (before_compaction, after_compaction) +- [Session](/concepts/session): session management and lifecycle. +- [Session pruning](/concepts/session-pruning): trimming tool results. +- [Context](/concepts/context): how context is built for agent turns. +- [Hooks](/automation/hooks): compaction lifecycle hooks (`before_compaction`, `after_compaction`). From 4db066d1028fa1d50ab69950fbaeba80b4b62a4e Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 21:22:34 -0700 Subject: [PATCH 240/418] docs(ollama): restructure auth rules and fix duplicate card titles --- docs/providers/ollama.md | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-) diff --git a/docs/providers/ollama.md b/docs/providers/ollama.md index 86462d99a60..bb3fc9aaae4 100644 --- a/docs/providers/ollama.md +++ b/docs/providers/ollama.md @@ -15,11 +15,26 @@ OpenClaw integrates with Ollama's native API (`/api/chat`) for hosted cloud mode Ollama provider config uses `baseUrl` as the canonical key. OpenClaw also accepts `baseURL` for compatibility with OpenAI SDK-style examples, but new config should prefer `baseUrl`. -Local and LAN Ollama hosts do not need a real bearer token; OpenClaw uses the local `ollama-local` marker only for loopback, private-network, `.local`, and bare-hostname Ollama base URLs. Remote public hosts and Ollama Cloud (`https://ollama.com`) require a real credential through `OLLAMA_API_KEY`, an auth profile, or the provider's `apiKey`. +### Auth rules -Custom provider ids that set `api: "ollama"` use the same auth rules. For example, an `ollama-remote` provider that points at a private LAN Ollama host can use `apiKey: "ollama-local"` and sub-agents will resolve that marker through the Ollama provider hook instead of treating it as a missing credential. + + + Local and LAN Ollama hosts do not need a real bearer token. OpenClaw uses the local `ollama-local` marker only for loopback, private-network, `.local`, and bare-hostname Ollama base URLs. + + + Remote public hosts and Ollama Cloud (`https://ollama.com`) require a real credential through `OLLAMA_API_KEY`, an auth profile, or the provider's `apiKey`. + + + Custom provider ids that set `api: "ollama"` follow the same rules. For example, an `ollama-remote` provider that points at a private LAN Ollama host can use `apiKey: "ollama-local"` and sub-agents will resolve that marker through the Ollama provider hook instead of treating it as a missing credential. + + + When Ollama is used for memory embeddings, bearer auth is scoped to the host where it was declared: -When Ollama is used for memory embeddings, bearer auth is scoped to the host where it was declared. A provider-level key is sent only to that provider's Ollama host; `agents.*.memorySearch.remote.apiKey` is sent only to its remote embedding host; and a pure `OLLAMA_API_KEY` env value is treated as the Ollama Cloud convention rather than being sent to local/self-hosted hosts by default. + - A provider-level key is sent only to that provider's Ollama host. + - `agents.*.memorySearch.remote.apiKey` is sent only to its remote embedding host. + - A pure `OLLAMA_API_KEY` env value is treated as the Ollama Cloud convention, not sent to local or self-hosted hosts by default. + + ## Getting started @@ -485,7 +500,7 @@ For the full setup and behavior details, see [Ollama Web Search](/tools/ollama-s ollama pull deepseek-r1:32b ``` - No additional configuration is needed -- OpenClaw marks them automatically. + No additional configuration is needed. OpenClaw marks them automatically. @@ -607,7 +622,7 @@ More help: [Troubleshooting](/help/troubleshooting) and [FAQ](/help/faq). ## Related - + Overview of all providers, model refs, and failover behavior. From 5a88d8502f9b5001b47f96da69a4147845b04e74 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 21:22:38 -0700 Subject: [PATCH 241/418] docs(gateway): split lifecycle notes accordion --- docs/cli/gateway.md | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/docs/cli/gateway.md b/docs/cli/gateway.md index 7322e2f5f81..6a10c04660e 100644 --- a/docs/cli/gateway.md +++ b/docs/cli/gateway.md @@ -463,17 +463,16 @@ openclaw gateway restart - `gateway install`: `--port`, `--runtime `, `--token`, `--wrapper `, `--force`, `--json` - `gateway uninstall|start|stop|restart`: `--json` - - - `gateway install` supports `--port`, `--runtime`, `--token`, `--wrapper`, `--force`, `--json`. - - `--wrapper ` makes the managed service start through an executable wrapper, writing `ProgramArguments` as ` gateway --port ...` and persisting `OPENCLAW_WRAPPER` in the service environment so forced reinstalls, updates, and doctor repairs keep using the same wrapper. `openclaw doctor` also reports the active wrapper. If `--wrapper` is omitted, install honors an existing `OPENCLAW_WRAPPER` from the shell or current service environment. - - To remove a persisted wrapper, reinstall with an empty wrapper environment, for example `OPENCLAW_WRAPPER= openclaw gateway install --force`. + - Use `gateway restart` to restart a managed service. Do not chain `gateway stop` and `gateway start` as a restart substitute; on macOS, `gateway stop` intentionally disables the LaunchAgent before stopping it. + - Lifecycle commands accept `--json` for scripting. + + - When token auth requires a token and `gateway.auth.token` is SecretRef-managed, `gateway install` validates that the SecretRef is resolvable but does not persist the resolved token into service environment metadata. - If token auth requires a token and the configured token SecretRef is unresolved, install fails closed instead of persisting fallback plaintext. - For password auth on `gateway run`, prefer `OPENCLAW_GATEWAY_PASSWORD`, `--password-file`, or a SecretRef-backed `gateway.auth.password` over inline `--password`. - In inferred auth mode, shell-only `OPENCLAW_GATEWAY_PASSWORD` does not relax install token requirements; use durable config (`gateway.auth.password` or config `env`) when installing a managed service. - If both `gateway.auth.token` and `gateway.auth.password` are configured and `gateway.auth.mode` is unset, install is blocked until mode is set explicitly. - - Lifecycle commands accept `--json` for scripting. From 166a6d9088d000ac896be7f2aba58668d14da860 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 21:22:42 -0700 Subject: [PATCH 242/418] docs(feishu): convert blockquote callouts to Note components --- docs/channels/feishu.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/docs/channels/feishu.md b/docs/channels/feishu.md index e6158534923..cb2fa1b7e90 100644 --- a/docs/channels/feishu.md +++ b/docs/channels/feishu.md @@ -16,7 +16,9 @@ Feishu/Lark is an all-in-one collaboration platform where teams chat, share docu ## Quick start -> **Requires OpenClaw 2026.4.25 or above.** Run `openclaw --version` to check. Upgrade with `openclaw update`. + +Requires OpenClaw 2026.4.25 or above. Run `openclaw --version` to check. Upgrade with `openclaw update`. + @@ -169,7 +171,9 @@ openclaw pairing list feishu | `/reset` | Reset the current session | | `/model` | Show or switch the AI model | -> Feishu/Lark does not support native slash-command menus, so send these as plain text messages. + +Feishu/Lark does not support native slash-command menus, so send these as plain text messages. + --- From 9c07579a95bea0e415f3aa989c1905889b7f06fc Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 21:22:52 -0700 Subject: [PATCH 243/418] docs(testbox): align maintainer testbox mode --- .agents/skills/blacksmith-testbox/SKILL.md | 70 ++++++++++++++++------ AGENTS.md | 4 +- 2 files changed, 56 insertions(+), 18 deletions(-) diff --git a/.agents/skills/blacksmith-testbox/SKILL.md b/.agents/skills/blacksmith-testbox/SKILL.md index ef53f45c78b..af3d3159565 100644 --- a/.agents/skills/blacksmith-testbox/SKILL.md +++ b/.agents/skills/blacksmith-testbox/SKILL.md @@ -16,6 +16,19 @@ warm caches, local build state, and fast feedback. Testbox is the expensive path. Reach for it deliberately. +OpenClaw maintainers can opt into Testbox-first validation by setting +`OPENCLAW_TESTBOX=1` in their environment or standing agent rules. This mode is +maintainers-only and requires Blacksmith access. + +When `OPENCLAW_TESTBOX=1` is set in OpenClaw: + +- Pre-warm a Testbox early for longer, wider, or uncertain work. +- Prefer Testbox for `pnpm` gates, e2e, package-like proof, and broad suites. +- Reuse the same Testbox ID for every run command in the same task/session. +- Use local commands only when the task explicitly sets + `OPENCLAW_LOCAL_CHECK_MODE=throttled|full`, or when the user asks for local + proof. + ## Install the CLI If `blacksmith` is not installed, install it: @@ -81,7 +94,8 @@ Prefer Testbox when: - you are reproducing CI-only failures - you need the exact workflow image/job environment from GitHub Actions -For OpenClaw specifically, normal local iteration should stay local: +For OpenClaw specifically, normal local iteration stays local unless maintainer +Testbox mode is enabled with `OPENCLAW_TESTBOX=1`: - `pnpm check:changed` - `pnpm test:changed` @@ -89,9 +103,9 @@ For OpenClaw specifically, normal local iteration should stay local: - `pnpm test:serial` - `pnpm build` -Only use Testbox in OpenClaw when the user explicitly wants CI-parity or the -check truly depends on remote secrets/services that the local repo loop cannot -provide. +If `OPENCLAW_TESTBOX=1` is enabled, run those same repo commands inside the +warm Testbox. If the user wants laptop-friendly local proof for one command, use +the explicit escape hatch `OPENCLAW_LOCAL_CHECK_MODE=throttled`. For installable-package product proof, prefer the GitHub `Package Acceptance` workflow over an ad hoc Testbox command. It resolves one package candidate @@ -103,21 +117,35 @@ an older trusted branch, tag, or SHA. ## Setup: Warmup before coding -If you decided Testbox is actually warranted, warm one up early. This returns -an ID instantly and boots the CI environment in the background while you work: +If you decided Testbox is warranted, warm one up early. This returns an ID +instantly and boots the CI environment in the background while you work: blacksmith testbox warmup ci-check-testbox.yml # → tbx_01jkz5b3t9... Save this ID. You need it for every `run` command. +For OpenClaw maintainer Testbox mode, pre-warm at the start of longer or wider +tasks: + + blacksmith testbox warmup ci-check-testbox.yml --ref main --idle-timeout 90 + +Use the build-artifact warmup when e2e/package/build proof benefits from seeded +`dist/`, `dist-runtime/`, and build-all caches: + + blacksmith testbox warmup ci-build-artifacts-testbox.yml --ref main --idle-timeout 90 + Warmup dispatches a GitHub Actions workflow that provisions a VM with the full CI environment: dependencies installed, services started, secrets injected, and a clean checkout of the repo at the default branch. +In OpenClaw, raw commit SHAs are not reliable dispatch refs for `warmup --ref`; +use a branch or tag. The build-artifact workflow resolves `openclaw@beta` and +`openclaw@latest` to SHA cache keys internally. + Options: - --ref Git ref to dispatch against (default: repo's default branch) + --ref Git ref to dispatch against (default: repo's default branch) --job Specific job within the workflow (if it has multiple) --idle-timeout Idle timeout in minutes (default: 30) @@ -234,6 +262,11 @@ services, CI-only runners, or reproducibility against the workflow image. If the repo says local tests/builds are the normal path, follow the repo. +OpenClaw maintainer exception: if `OPENCLAW_TESTBOX=1` is set by the user or +agent environment, treat Testbox as the normal validation path for this repo. +Use `OPENCLAW_LOCAL_CHECK_MODE=throttled|full` as the explicit local escape +hatch. + ## When to use Use Testbox when: @@ -250,12 +283,13 @@ checks that need parity or remote state. ## Workflow -1. Decide whether the repo's local loop is the right default. -2. Only if Testbox is warranted, warm up early: - `blacksmith testbox warmup ci-check-testbox.yml` → save the ID +1. Decide whether the repo's local loop is the right default. For OpenClaw, + `OPENCLAW_TESTBOX=1` makes Testbox the maintainer default. +2. If Testbox is warranted, warm up early: + `blacksmith testbox warmup ci-check-testbox.yml --ref main --idle-timeout 90` → save the ID 3. Write code while the testbox boots in the background. 4. Run the remote command when needed: - `blacksmith testbox run --id "npm test"` + `blacksmith testbox run --id "pnpm check:changed"` 5. If tests fail, fix code and re-run against the same warm box. 6. If you changed dependency manifests (package.json, etc.), prepend the install command: `blacksmith testbox run --id "npm install && npm test"` @@ -276,9 +310,9 @@ Observed full-suite time on Blacksmith Testbox is about 3-4 minutes: - 173-180s on a warmed box - 219s on a fresh 32-vCPU box -When validating before commit/push, run `pnpm check:changed` first when -appropriate, then the full suite with the profile above if broad confidence is -needed. +When validating before commit/push in maintainer Testbox mode, run +`pnpm check:changed` inside the warmed box first when appropriate, then the full +suite with the profile above if broad confidence is needed. ## Examples @@ -332,12 +366,14 @@ timeout is reached). Default timeout is 5m; use `--wait-timeout` for longer blacksmith testbox stop --id Testboxes automatically shut down after being idle (default: 30 minutes). -If you need a longer session, increase the timeout at warmup time: +If you need a longer session, increase the timeout at warmup time. For OpenClaw +maintainer work, use 90 minutes for long-running sessions: - blacksmith testbox warmup ci-check-testbox.yml --idle-timeout 60 + blacksmith testbox warmup ci-check-testbox.yml --idle-timeout 90 + blacksmith testbox warmup ci-build-artifacts-testbox.yml --idle-timeout 90 ## With options blacksmith testbox warmup ci-check-testbox.yml --ref main - blacksmith testbox warmup ci-check-testbox.yml --idle-timeout 60 + blacksmith testbox warmup ci-check-testbox.yml --idle-timeout 90 blacksmith testbox run --id "go test ./..." diff --git a/AGENTS.md b/AGENTS.md index faca52035ae..5eb1b28406a 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -54,7 +54,9 @@ Telegraph style. Root rules only. Read scoped `AGENTS.md` before subtree work. - Formatting: use `oxfmt`, not Prettier. Prefer `pnpm format:check` / `pnpm format`; for targeted files use `pnpm exec oxfmt --check --threads=1 ` or `pnpm exec oxfmt --write --threads=1 `. - Linting: use repo wrappers (`pnpm lint:*`, `scripts/run-oxlint.mjs`); do not invoke generic JS formatters/lints unless a repo script uses them. - Heavy checks: `OPENCLAW_LOCAL_CHECK=1`, mode `OPENCLAW_LOCAL_CHECK_MODE=throttled|full`; CI/shared use `OPENCLAW_LOCAL_CHECK=0`. -- Local first. Use repo `pnpm` lanes before Blacksmith/Testbox. Remote only for parity-only failures, secrets/services, or explicit ask. +- Maintainer Testbox mode: if `OPENCLAW_TESTBOX=1` is present in env or standing user rules, use Blacksmith Testbox for `pnpm` gates, e2e, broad suites, and long/heavy validation. This is maintainers-only and requires Blacksmith access. +- Testbox escape hatch: if `OPENCLAW_TESTBOX=1` is set but `OPENCLAW_LOCAL_CHECK_MODE=throttled|full` is explicitly set for the task/command, use the local repo `pnpm` lane instead. +- Testbox warmup: start from repo root, save/reuse the returned ID for every run in the same task. Use `ci-check-testbox.yml` for normal checks; use `ci-build-artifacts-testbox.yml` when build artifacts, e2e, or package-like proof benefits from seeded `dist/`/`dist-runtime/` caches. ## GitHub / CI From e0956a08534835ad1044c265a2b65f2977ca976e Mon Sep 17 00:00:00 2001 From: Gustavo Madeira Santana Date: Mon, 27 Apr 2026 00:24:00 -0400 Subject: [PATCH 244/418] fix(cli): skip startup work for positional help --- CHANGELOG.md | 1 + src/agents/context.lookup.test.ts | 4 ++ src/agents/context.ts | 15 +------ src/cli/argv-invocation.ts | 4 +- src/cli/argv.test.ts | 66 +++++++++++++++++++++++++++++++ src/cli/argv.ts | 60 ++++++++++++++++++++++++++++ src/cli/program/preaction.ts | 4 +- 7 files changed, 137 insertions(+), 17 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 512f50b8cfd..f2ad8e25678 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,6 +13,7 @@ Docs: https://docs.openclaw.ai ### Fixes - CLI/startup: read generated startup metadata from the bundled `dist` layout before falling back to live help rendering, so root/browser help and channel-option bootstrap stay on the fast path. Thanks @vincentkoc. +- CLI/help: treat positional `help` invocations like `openclaw channels help` as help paths for startup gating, avoiding model/auth warmup while preserving positional arguments such as `openclaw docs help`. Thanks @gumadeiras. - Matrix/E2EE: stabilize recovery and broken-device QA flows while avoiding Matrix device-cleanup sync races that could leave shutdown-time crypto work running. Thanks @gumadeiras. - Cron: classify isolated runs as errors from structured embedded-run execution-denial metadata, with final-output marker fallback for `SYSTEM_RUN_DENIED`, `INVALID_REQUEST`, and approval-binding refusals, so blocked commands no longer appear green in cron history. Fixes #67172; carries forward #67186. Thanks @oc-gh-dr, @hclsys, and @1yihui. - Onboarding/GitHub Copilot: add manifest-owned `--github-copilot-token` support for non-interactive setup, including env fallback, tokenRef storage in ref mode, saved-profile reuse, and current Copilot default-model wiring. Refs #50002 and supersedes #50003. Thanks @scottgl9. diff --git a/src/agents/context.lookup.test.ts b/src/agents/context.lookup.test.ts index d6668378bcd..c80b547fb98 100644 --- a/src/agents/context.lookup.test.ts +++ b/src/agents/context.lookup.test.ts @@ -202,6 +202,10 @@ describe("lookupContextTokens", () => { expect(shouldEagerWarmContextWindowCache(["node", "openclaw", "chat"])).toBe(true); expect(shouldEagerWarmContextWindowCache(["node", "openclaw", "chat", "--help"])).toBe(false); + expect( + shouldEagerWarmContextWindowCache(["node", "openclaw", "matrix", "encryption", "help"]), + ).toBe(false); + expect(shouldEagerWarmContextWindowCache(["node", "openclaw", "help", "matrix"])).toBe(false); expect( shouldEagerWarmContextWindowCache(["node", "openclaw", "browser", "status", "--help"]), ).toBe(false); diff --git a/src/agents/context.ts b/src/agents/context.ts index 7ffbf92b3f3..aabc43650b4 100644 --- a/src/agents/context.ts +++ b/src/agents/context.ts @@ -2,6 +2,7 @@ // the agent reports a model id. This includes custom models.json entries. import path from "node:path"; +import { isHelpOrVersionInvocation } from "../cli/argv.js"; import { loadConfig } from "../config/config.js"; import type { OpenClawConfig } from "../config/types.openclaw.js"; import { computeBackoff, type BackoffPolicy } from "../infra/backoff.js"; @@ -130,18 +131,6 @@ function getCommandPathFromArgv(argv: string[]): string[] { return tokens; } -function hasHelpOrVersionFlag(argv: string[]): boolean { - for (const arg of argv.slice(2)) { - if (arg === FLAG_TERMINATOR) { - return false; - } - if (arg === "-h" || arg === "--help" || arg === "-V" || arg === "--version") { - return true; - } - } - return false; -} - const SKIP_EAGER_WARMUP_PRIMARY_COMMANDS = new Set([ "agent", "backup", @@ -175,7 +164,7 @@ export function shouldEagerWarmContextWindowCache(argv: string[] = process.argv) if (!isLikelyOpenClawCliProcess(argv)) { return false; } - if (hasHelpOrVersionFlag(argv)) { + if (isHelpOrVersionInvocation(argv)) { return false; } const [primary] = getCommandPathFromArgv(argv); diff --git a/src/cli/argv-invocation.ts b/src/cli/argv-invocation.ts index ab05807fc58..d27115bd40b 100644 --- a/src/cli/argv-invocation.ts +++ b/src/cli/argv-invocation.ts @@ -1,7 +1,7 @@ import { getCommandPathWithRootOptions, getPrimaryCommand, - hasHelpOrVersion, + isHelpOrVersionInvocation, isRootHelpInvocation, } from "./argv.js"; @@ -18,7 +18,7 @@ export function resolveCliArgvInvocation(argv: string[]): CliArgvInvocation { argv, commandPath: getCommandPathWithRootOptions(argv, 2), primary: getPrimaryCommand(argv), - hasHelpOrVersion: hasHelpOrVersion(argv), + hasHelpOrVersion: isHelpOrVersionInvocation(argv), isRootHelpInvocation: isRootHelpInvocation(argv), }; } diff --git a/src/cli/argv.test.ts b/src/cli/argv.test.ts index a7ec2b529c4..909596f62ee 100644 --- a/src/cli/argv.test.ts +++ b/src/cli/argv.test.ts @@ -10,6 +10,7 @@ import { getVerboseFlag, hasHelpOrVersion, hasFlag, + isHelpOrVersionInvocation, isRootHelpInvocation, isRootVersionInvocation, shouldMigrateState, @@ -67,6 +68,71 @@ describe("argv helpers", () => { expect(hasHelpOrVersion(argv)).toBe(expected); }); + it.each([ + { + name: "root help command", + argv: ["node", "openclaw", "help"], + expected: true, + }, + { + name: "root help command with target", + argv: ["node", "openclaw", "help", "matrix"], + expected: true, + }, + { + name: "nested help command", + argv: ["node", "openclaw", "matrix", "encryption", "help"], + expected: true, + }, + { + name: "known subcommand root help command", + argv: ["node", "openclaw", "config", "help"], + expected: true, + }, + { + name: "known leaf command positional help", + argv: ["node", "openclaw", "docs", "help"], + expected: false, + }, + { + name: "known subcommand leaf positional help", + argv: ["node", "openclaw", "config", "set", "some.path", "help"], + expected: false, + }, + { + name: "unknown plugin command help", + argv: ["node", "openclaw", "external-plugin", "tools", "help"], + expected: true, + }, + { + name: "help flag", + argv: ["node", "openclaw", "matrix", "encryption", "--help"], + expected: true, + }, + { + name: "help as option value", + argv: ["node", "openclaw", "agent", "--message", "help"], + expected: false, + }, + { + name: "help after terminator", + argv: ["node", "openclaw", "nodes", "invoke", "--", "help"], + expected: false, + }, + { + name: "help flag after terminator", + argv: ["node", "openclaw", "nodes", "invoke", "--", "--help"], + expected: false, + }, + { + name: "version flag after terminator", + argv: ["node", "openclaw", "nodes", "invoke", "--", "--version"], + expected: false, + }, + ])("detects help/version invocations: $name", ({ argv, expected }) => { + expect(isHelpOrVersionInvocation(argv)).toBe(expected); + }); + it.each([ { name: "root --version", diff --git a/src/cli/argv.ts b/src/cli/argv.ts index 02d40656222..816ff7b52fe 100644 --- a/src/cli/argv.ts +++ b/src/cli/argv.ts @@ -4,10 +4,21 @@ import { FLAG_TERMINATOR, isValueToken, } from "../infra/cli-root-options.js"; +import { CORE_CLI_COMMAND_DESCRIPTORS } from "./program/core-command-descriptors.js"; +import { SUB_CLI_DESCRIPTORS } from "./program/subcli-descriptors.js"; const HELP_FLAGS = new Set(["-h", "--help"]); const VERSION_FLAGS = new Set(["-V", "--version"]); const ROOT_VERSION_ALIAS_FLAG = "-v"; +const ROOT_COMMAND_DESCRIPTORS = [...CORE_CLI_COMMAND_DESCRIPTORS, ...SUB_CLI_DESCRIPTORS]; +const KNOWN_ROOT_COMMANDS: ReadonlySet = new Set( + ROOT_COMMAND_DESCRIPTORS.map((descriptor) => descriptor.name), +); +const ROOT_COMMANDS_WITH_SUBCOMMANDS: ReadonlySet = new Set( + ROOT_COMMAND_DESCRIPTORS.filter((descriptor) => descriptor.hasSubcommands).map( + (descriptor) => descriptor.name, + ), +); export function hasHelpOrVersion(argv: string[]): boolean { return ( @@ -15,6 +26,55 @@ export function hasHelpOrVersion(argv: string[]): boolean { ); } +export function isHelpOrVersionInvocation(argv: string[]): boolean { + if (hasRootVersionAlias(argv)) { + return true; + } + + const args = argv.slice(2); + let sawCommandOption = false; + const positionals: string[] = []; + for (let i = 0; i < args.length; i += 1) { + const arg = args[i]; + if (!arg || arg === FLAG_TERMINATOR) { + break; + } + const rootConsumed = consumeRootOptionToken(args, i); + if (rootConsumed > 0) { + i += rootConsumed - 1; + continue; + } + if (HELP_FLAGS.has(arg) || VERSION_FLAGS.has(arg)) { + return true; + } + if (arg.startsWith("-")) { + sawCommandOption = true; + continue; + } + positionals.push(arg); + if (arg !== "help") { + continue; + } + if (sawCommandOption) { + return false; + } + if (positionals.length === 1) { + return true; + } + const [primary] = positionals; + // Positional `help` may be a command argument for known leaf commands. + // Unknown roots are treated as plugin command namespaces. + if (!primary || !KNOWN_ROOT_COMMANDS.has(primary)) { + return true; + } + if (positionals.length === 2 && ROOT_COMMANDS_WITH_SUBCOMMANDS.has(primary)) { + return true; + } + return false; + } + return false; +} + function parsePositiveInt(value: string): number | undefined { const parsed = Number.parseInt(value, 10); if (Number.isNaN(parsed) || parsed <= 0) { diff --git a/src/cli/program/preaction.ts b/src/cli/program/preaction.ts index 867c172aa76..0b733e4f18a 100644 --- a/src/cli/program/preaction.ts +++ b/src/cli/program/preaction.ts @@ -2,7 +2,7 @@ import type { Command } from "commander"; import { setVerbose } from "../../globals.js"; import type { LogLevel } from "../../logging/levels.js"; import { defaultRuntime } from "../../runtime.js"; -import { getVerboseFlag, hasHelpOrVersion } from "../argv.js"; +import { getVerboseFlag, isHelpOrVersionInvocation } from "../argv.js"; import { resolveCliName } from "../cli-name.js"; import { applyCliExecutionStartupPresentation, @@ -65,7 +65,7 @@ export function registerPreActionHooks(program: Command, programVersion: string) program.hook("preAction", async (_thisCommand, actionCommand) => { setProcessTitleForCommand(actionCommand); const argv = process.argv; - if (hasHelpOrVersion(argv)) { + if (isHelpOrVersionInvocation(argv)) { return; } const jsonOutputMode = isCommandJsonOutputMode(actionCommand, argv); From 7c0fdae9b95bfcc667af3ad341b63ecc194464e4 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 05:27:35 +0100 Subject: [PATCH 245/418] docs(providers): document local model request timeout --- docs/concepts/model-providers.md | 2 ++ docs/gateway/local-models.md | 5 +++++ docs/providers/vllm.md | 30 ++++++++++++++++++++++++++++++ 3 files changed, 37 insertions(+) diff --git a/docs/concepts/model-providers.md b/docs/concepts/model-providers.md index c7847935428..01535f1d78e 100644 --- a/docs/concepts/model-providers.md +++ b/docs/concepts/model-providers.md @@ -625,6 +625,7 @@ Example (OpenAI‑compatible): baseUrl: "http://localhost:1234/v1", apiKey: "${LM_API_TOKEN}", api: "openai-completions", + timeoutSeconds: 300, models: [ { id: "my-local-model", @@ -660,6 +661,7 @@ Example (OpenAI‑compatible): - Proxy-style OpenAI-compatible routes also skip native OpenAI-only request shaping: no `service_tier`, no Responses `store`, no Completions `store`, no prompt-cache hints, no OpenAI reasoning-compat payload shaping, and no hidden OpenClaw attribution headers. - For OpenAI-compatible Completions proxies that need vendor-specific fields, set `agents.defaults.models["provider/model"].params.extra_body` (or `extraBody`) to merge extra JSON into the outbound request body. - For vLLM chat-template controls, set `agents.defaults.models["provider/model"].params.chat_template_kwargs`. OpenClaw automatically sends `enable_thinking: false` and `force_nonempty_content: true` for `vllm/nemotron-3-*` when the session thinking level is off. + - For slow local models or remote LAN/tailnet hosts, set `models.providers..timeoutSeconds`. This extends provider model HTTP request handling, including connect, headers, body streaming, and the total guarded-fetch abort, without increasing the whole agent runtime timeout. - If `baseUrl` is empty/omitted, OpenClaw keeps the default OpenAI behavior (which resolves to `api.openai.com`). - For safety, an explicit `compat.supportsDeveloperRole: true` is still overridden on non-native `openai-completions` endpoints. diff --git a/docs/gateway/local-models.md b/docs/gateway/local-models.md index 0b023a8743a..a8b91ed2ea0 100644 --- a/docs/gateway/local-models.md +++ b/docs/gateway/local-models.md @@ -124,6 +124,7 @@ vLLM, LiteLLM, OAI-proxy, or custom gateways work if they expose an OpenAI-style baseUrl: "http://127.0.0.1:8000/v1", apiKey: "sk-local", api: "openai-responses", + timeoutSeconds: 300, models: [ { id: "my-local-model", @@ -142,6 +143,10 @@ vLLM, LiteLLM, OAI-proxy, or custom gateways work if they expose an OpenAI-style ``` Keep `models.mode: "merge"` so hosted models stay available as fallbacks. +Use `models.providers..timeoutSeconds` for slow local or remote model +servers before raising `agents.defaults.timeoutSeconds`. The provider timeout +applies only to model HTTP requests, including connect, headers, body streaming, +and the total guarded-fetch abort. Behavior note for local/proxied `/v1` backends: diff --git a/docs/providers/vllm.md b/docs/providers/vllm.md index 5ab11cd33e9..8d2970ed929 100644 --- a/docs/providers/vllm.md +++ b/docs/providers/vllm.md @@ -93,6 +93,7 @@ Use explicit config when: apiKey: "${VLLM_API_KEY}", api: "openai-completions", request: { allowPrivateNetwork: true }, + timeoutSeconds: 300, // Optional: extend connect/header/body/request timeout for slow local models models: [ { id: "your-model-id", @@ -179,6 +180,7 @@ Use explicit config when: apiKey: "${VLLM_API_KEY}", api: "openai-completions", request: { allowPrivateNetwork: true }, + timeoutSeconds: 300, models: [ { id: "my-custom-model", @@ -201,6 +203,34 @@ Use explicit config when: ## Troubleshooting + + For large local models, remote LAN hosts, or tailnet links, set a + provider-scoped request timeout: + + ```json5 + { + models: { + providers: { + vllm: { + baseUrl: "http://192.168.1.50:8000/v1", + apiKey: "${VLLM_API_KEY}", + api: "openai-completions", + request: { allowPrivateNetwork: true }, + timeoutSeconds: 300, + models: [{ id: "your-model-id", name: "Local vLLM Model" }], + }, + }, + }, + } + ``` + + `timeoutSeconds` applies to vLLM model HTTP requests only, including + connection setup, response headers, body streaming, and the total + guarded-fetch abort. Prefer this before increasing + `agents.defaults.timeoutSeconds`, which controls the whole agent run. + + + Check that the vLLM server is running and accessible: From 00300b85d06824533f72aec8e490df5de0e63b86 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 21:28:32 -0700 Subject: [PATCH 246/418] docs(onboard): convert related-guides to CardGroup and group flow notes --- docs/cli/onboard.md | 71 ++++++++++++++++++++++++++++----------------- 1 file changed, 44 insertions(+), 27 deletions(-) diff --git a/docs/cli/onboard.md b/docs/cli/onboard.md index f8045e31477..8408d7d3437 100644 --- a/docs/cli/onboard.md +++ b/docs/cli/onboard.md @@ -11,11 +11,23 @@ Interactive onboarding for local or remote Gateway setup. ## Related guides -- CLI onboarding hub: [Onboarding (CLI)](/start/wizard) -- Onboarding overview: [Onboarding Overview](/start/onboarding-overview) -- CLI onboarding reference: [CLI Setup Reference](/start/wizard-cli-reference) -- CLI automation: [CLI Automation](/start/wizard-cli-automation) -- macOS onboarding: [Onboarding (macOS App)](/start/onboarding) + + + Walkthrough of the interactive CLI flow. + + + How OpenClaw onboarding fits together. + + + Outputs, internals, and per-step behavior. + + + Non-interactive flags and scripted setups. + + + Onboarding flow for the macOS menu bar app. + + ## Examples @@ -132,10 +144,11 @@ Interactive onboarding behavior with reference mode: - Onboarding performs a fast preflight validation before saving the ref. - If validation fails, onboarding shows the error and lets you retry. -Non-interactive Z.AI endpoint choices: +### Non-interactive Z.AI endpoint choices -Note: `--auth-choice zai-api-key` now auto-detects the best Z.AI endpoint for your key (prefers the general API with `zai/glm-5.1`). -If you specifically want the GLM Coding Plan endpoints, pick `zai-coding-global` or `zai-coding-cn`. + +`--auth-choice zai-api-key` auto-detects the best Z.AI endpoint for your key (prefers the general API with `zai/glm-5.1`). If you specifically want the GLM Coding Plan endpoints, pick `zai-coding-global` or `zai-coding-cn`. + ```bash # Promptless endpoint selection @@ -157,26 +170,30 @@ openclaw onboard --non-interactive \ --mistral-api-key "$MISTRAL_API_KEY" ``` -Flow notes: +## Flow notes -- `quickstart`: minimal prompts, auto-generates a gateway token. -- `manual`: full prompts for port/bind/auth (alias of `advanced`). -- When an auth choice implies a preferred provider, onboarding prefilters the - default-model and allowlist pickers to that provider. For Volcengine and - BytePlus, this also matches the coding-plan variants - (`volcengine-plan/*`, `byteplus-plan/*`). -- If the preferred-provider filter yields no loaded models yet, onboarding - falls back to the unfiltered catalog instead of leaving the picker empty. -- In the web-search step, some providers can trigger provider-specific - follow-up prompts: - - **Grok** can offer optional `x_search` setup with the same `XAI_API_KEY` - and an `x_search` model choice. - - **Kimi** can ask for the Moonshot API region (`api.moonshot.ai` vs - `api.moonshot.cn`) and the default Kimi web-search model. -- Local onboarding DM scope behavior: [CLI Setup Reference](/start/wizard-cli-reference#outputs-and-internals). -- Fastest first chat: `openclaw dashboard` (Control UI, no channel setup). -- Custom Provider: connect any OpenAI or Anthropic compatible endpoint, - including hosted providers not listed. Use Unknown to auto-detect. + + + - `quickstart`: minimal prompts, auto-generates a gateway token. + - `manual`: full prompts for port, bind, and auth (alias of `advanced`). + + + When an auth choice implies a preferred provider, onboarding prefilters the default-model and allowlist pickers to that provider. For Volcengine and BytePlus, this also matches the coding-plan variants (`volcengine-plan/*`, `byteplus-plan/*`). + + If the preferred-provider filter yields no loaded models yet, onboarding falls back to the unfiltered catalog instead of leaving the picker empty. + + + Some web-search providers trigger provider-specific follow-up prompts: + + - **Grok** can offer optional `x_search` setup with the same `XAI_API_KEY` and an `x_search` model choice. + - **Kimi** can ask for the Moonshot API region (`api.moonshot.ai` vs `api.moonshot.cn`) and the default Kimi web-search model. + + + - Local onboarding DM scope behavior: [CLI setup reference](/start/wizard-cli-reference#outputs-and-internals). + - Fastest first chat: `openclaw dashboard` (Control UI, no channel setup). + - Custom provider: connect any OpenAI or Anthropic compatible endpoint, including hosted providers not listed. Use Unknown to auto-detect. + + ## Common follow-up commands From c881d8da48c4abffce16ab5fe20efe6b80706383 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 21:28:36 -0700 Subject: [PATCH 247/418] docs(sandbox): replace bold-callout patterns with Note and Tip components --- docs/cli/sandbox.md | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-) diff --git a/docs/cli/sandbox.md b/docs/cli/sandbox.md index f6fb9fcd8f6..8c7e6c25379 100644 --- a/docs/cli/sandbox.md +++ b/docs/cli/sandbox.md @@ -75,9 +75,11 @@ openclaw sandbox recreate --all --force # Skip confirmation - `--browser`: Only recreate browser containers - `--force`: Skip confirmation prompt -**Important:** Runtimes are automatically recreated when the agent is next used. + +Runtimes are automatically recreated when the agent is next used. + -## Use Cases +## Use cases ### After updating a Docker image @@ -148,18 +150,19 @@ openclaw sandbox recreate --agent family openclaw sandbox recreate --agent alfred ``` -## Why is this needed? +## Why this is needed -**Problem:** When you update sandbox configuration: +When you update sandbox configuration: -- Existing runtimes continue running with old settings -- Runtimes are only pruned after 24h of inactivity -- Regularly-used agents keep old runtimes alive indefinitely +- Existing runtimes continue running with old settings. +- Runtimes are only pruned after 24h of inactivity. +- Regularly-used agents keep old runtimes alive indefinitely. -**Solution:** Use `openclaw sandbox recreate` to force removal of old runtimes. They'll be recreated automatically with current settings when next needed. +Use `openclaw sandbox recreate` to force removal of old runtimes. They are recreated automatically with current settings when next needed. -Tip: prefer `openclaw sandbox recreate` over manual backend-specific cleanup. -It uses the Gateway’s runtime registry and avoids mismatches when scope/session keys change. + +Prefer `openclaw sandbox recreate` over manual backend-specific cleanup. It uses the Gateway's runtime registry and avoids mismatches when scope or session keys change. + ## Configuration @@ -193,4 +196,4 @@ Sandbox settings live in `~/.openclaw/openclaw.json` under `agents.defaults.sand - [CLI reference](/cli) - [Sandboxing](/gateway/sandboxing) - [Agent workspace](/concepts/agent-workspace) -- [Doctor](/gateway/doctor) — checks sandbox setup +- [Doctor](/gateway/doctor): checks sandbox setup. From 4519b29419517d74ad079bf17fad4b6bc3d73b2d Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 21:28:40 -0700 Subject: [PATCH 248/418] docs(update): convert flow steps to Steps component --- docs/cli/update.md | 70 +++++++++++++++++++++++++++++----------------- 1 file changed, 45 insertions(+), 25 deletions(-) diff --git a/docs/cli/update.md b/docs/cli/update.md index 462ca89e243..19dc0b64aeb 100644 --- a/docs/cli/update.md +++ b/docs/cli/update.md @@ -40,9 +40,11 @@ openclaw --update `postUpdate.plugins.integrityDrifts` when npm plugin artifact drift is detected during post-update plugin sync. - `--timeout `: per-step timeout (default is 1800s). -- `--yes`: skip confirmation prompts (for example downgrade confirmation) +- `--yes`: skip confirmation prompts (for example downgrade confirmation). -Note: downgrades require confirmation because older versions can break configuration. + +Downgrades require confirmation because older versions can break configuration. + ## `update status` @@ -91,35 +93,53 @@ build. ## Git checkout flow -Channels: +### Channel selection -- `stable`: checkout the latest non-beta tag, then build + doctor. -- `beta`: prefer the latest `-beta` tag, but fall back to the latest stable tag - when beta is missing or older. -- `dev`: checkout `main`, then fetch + rebase. +- `stable`: checkout the latest non-beta tag, then build and doctor. +- `beta`: prefer the latest `-beta` tag, but fall back to the latest stable tag when beta is missing or older. +- `dev`: checkout `main`, then fetch and rebase. -High-level: +### Update steps -1. Requires a clean worktree (no uncommitted changes). -2. Switches to the selected channel (tag or branch). -3. Fetches upstream (dev only). -4. Dev only: preflight lint + TypeScript build in a temp worktree; if the tip fails, walks back up to 10 commits to find the newest clean build. -5. Rebases onto the selected commit (dev only). -6. Installs deps with the repo package manager. For pnpm checkouts, the updater bootstraps `pnpm` on demand (via `corepack` first, then a temporary `npm install pnpm@10` fallback) instead of running `npm run build` inside a pnpm workspace. -7. Builds + builds the Control UI. -8. Runs `openclaw doctor` as the final “safe update” check. -9. Syncs plugins to the active channel (dev uses bundled plugins; stable/beta uses npm) and updates npm-installed plugins. + + + Requires no uncommitted changes. + + + Switches to the selected channel (tag or branch). + + + Dev only. + + + Runs lint and TypeScript build in a temp worktree. If the tip fails, walks back up to 10 commits to find the newest clean build. + + + Rebases onto the selected commit (dev only). + + + Uses the repo package manager. For pnpm checkouts, the updater bootstraps `pnpm` on demand (via `corepack` first, then a temporary `npm install pnpm@10` fallback) instead of running `npm run build` inside a pnpm workspace. + + + Builds the gateway and the Control UI. + + + `openclaw doctor` runs as the final safe-update check. + + + Syncs plugins to the active channel. Dev uses bundled plugins; stable and beta use npm. Updates npm-installed plugins. + + -If an exact pinned npm plugin update resolves to an artifact whose integrity -differs from the stored install record, `openclaw update` aborts that plugin -artifact update instead of installing it. Reinstall or update the plugin -explicitly only after verifying that you trust the new artifact. + +If an exact pinned npm plugin update resolves to an artifact whose integrity differs from the stored install record, `openclaw update` aborts that plugin artifact update instead of installing it. Reinstall or update the plugin explicitly only after verifying that you trust the new artifact. + -Post-update plugin sync failures fail the update result and stop restart -follow-up work. Fix the plugin install/update error, then rerun -`openclaw update`. + +Post-update plugin sync failures fail the update result and stop restart follow-up work. Fix the plugin install or update error, then rerun `openclaw update`. -If pnpm bootstrap still fails, the updater now stops early with a package-manager-specific error instead of trying `npm run build` inside the checkout. +If pnpm bootstrap still fails, the updater stops early with a package-manager-specific error instead of trying `npm run build` inside the checkout. + ## `--update` shorthand From 8cd68487d907e53b719042a0f3d8c16c38e2dd42 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 21:28:44 -0700 Subject: [PATCH 249/418] docs(remote): rename numbered headings and use Note components --- docs/gateway/remote.md | 39 ++++++++++++++++++++++----------------- 1 file changed, 22 insertions(+), 17 deletions(-) diff --git a/docs/gateway/remote.md b/docs/gateway/remote.md index eed33e7d3f2..0e6c3936d68 100644 --- a/docs/gateway/remote.md +++ b/docs/gateway/remote.md @@ -15,38 +15,37 @@ This repo supports “remote over SSH” by keeping a single Gateway (the master - The Gateway WebSocket binds to **loopback** on your configured port (defaults to 18789). - For remote use, you forward that loopback port over SSH (or use a tailnet/VPN and tunnel less). -## Common VPN/tailnet setups (where the agent lives) +## Common VPN and tailnet setups -Think of the **Gateway host** as “where the agent lives.” It owns sessions, auth profiles, channels, and state. -Your laptop/desktop (and nodes) connect to that host. +Think of the **Gateway host** as where the agent lives. It owns sessions, auth profiles, channels, and state. Your laptop, desktop, and nodes connect to that host. -### 1) Always-on Gateway in your tailnet (VPS or home server) +### Always-on Gateway in your tailnet -Run the Gateway on a persistent host and reach it via **Tailscale** or SSH. +Run the Gateway on a persistent host (VPS or home server) and reach it via **Tailscale** or SSH. - **Best UX:** keep `gateway.bind: "loopback"` and use **Tailscale Serve** for the Control UI. -- **Fallback:** keep loopback + SSH tunnel from any machine that needs access. +- **Fallback:** keep loopback plus SSH tunnel from any machine that needs access. - **Examples:** [exe.dev](/install/exe-dev) (easy VM) or [Hetzner](/install/hetzner) (production VPS). -This is ideal when your laptop sleeps often but you want the agent always-on. +Ideal when your laptop sleeps often but you want the agent always-on. -### 2) Home desktop runs the Gateway, laptop is remote control +### Home desktop runs the Gateway The laptop does **not** run the agent. It connects remotely: -- Use the macOS app’s **Remote over SSH** mode (Settings → General → “OpenClaw runs”). -- The app opens and manages the tunnel, so WebChat + health checks “just work.” +- Use the macOS app's **Remote over SSH** mode (Settings → General → OpenClaw runs). +- The app opens and manages the tunnel, so WebChat and health checks just work. Runbook: [macOS remote access](/platforms/mac/remote). -### 3) Laptop runs the Gateway, remote access from other machines +### Laptop runs the Gateway Keep the Gateway local but expose it safely: - SSH tunnel to the laptop from other machines, or - Tailscale Serve the Control UI and keep the Gateway loopback-only. -Guide: [Tailscale](/gateway/tailscale) and [Web overview](/web). +Guides: [Tailscale](/gateway/tailscale) and [Web overview](/web). ## Command flow (what runs where) @@ -77,9 +76,13 @@ With the tunnel up: - `openclaw health` and `openclaw status --deep` now reach the remote gateway via `ws://127.0.0.1:18789`. - `openclaw gateway status`, `openclaw gateway health`, `openclaw gateway probe`, and `openclaw gateway call` can also target the forwarded URL via `--url` when needed. -Note: replace `18789` with your configured `gateway.port` (or `--port`/`OPENCLAW_GATEWAY_PORT`). -Note: when you pass `--url`, the CLI does not fall back to config or environment credentials. -Include `--token` or `--password` explicitly. Missing explicit credentials is an error. + +Replace `18789` with your configured `gateway.port` (or `--port` or `OPENCLAW_GATEWAY_PORT`). + + + +When you pass `--url`, the CLI does not fall back to config or environment credentials. Include `--token` or `--password` explicitly. Missing explicit credentials is an error. + ## CLI remote defaults @@ -126,7 +129,7 @@ WebChat no longer uses a separate HTTP port. The SwiftUI chat UI connects direct - Forward `18789` over SSH (see above), then connect clients to `ws://127.0.0.1:18789`. - On macOS, prefer the app’s “Remote over SSH” mode, which manages the tunnel automatically. -## macOS app "Remote over SSH" +## macOS app Remote over SSH The macOS menu bar app can drive the same setup end-to-end (remote status checks, WebChat, and Voice Wake forwarding). @@ -222,7 +225,9 @@ launchctl bootstrap gui/$UID ~/Library/LaunchAgents/ai.openclaw.ssh-tunnel.plist The tunnel will start automatically at login, restart on crash, and keep the forwarded port live. -Note: if you have a leftover `com.openclaw.ssh-tunnel` LaunchAgent from an older setup, unload and delete it. + +If you have a leftover `com.openclaw.ssh-tunnel` LaunchAgent from an older setup, unload and delete it. + #### Troubleshooting From ebbc7dcfeb0dc14795a597ac9d912bd953ea6170 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 21:28:48 -0700 Subject: [PATCH 250/418] docs(updating): group advanced npm topics in AccordionGroup --- docs/install/updating.md | 73 +++++++++++++++------------------------- 1 file changed, 28 insertions(+), 45 deletions(-) diff --git a/docs/install/updating.md b/docs/install/updating.md index e5384bf450b..f4d44b9b32f 100644 --- a/docs/install/updating.md +++ b/docs/install/updating.md @@ -101,52 +101,33 @@ pnpm add -g openclaw@latest bun add -g openclaw@latest ``` -### Global npm installs and runtime dependencies +### Advanced npm install topics -OpenClaw treats packaged global installs as read-only at runtime, even when the -global package directory is writable by the current user. Bundled plugin runtime -dependencies are staged into a writable runtime directory instead of mutating the -package tree. This keeps `openclaw update` from racing with a running gateway or -local agent that is repairing plugin dependencies during the same install. + + + OpenClaw treats packaged global installs as read-only at runtime, even when the global package directory is writable by the current user. Bundled plugin runtime dependencies are staged into a writable runtime directory instead of mutating the package tree. This keeps `openclaw update` from racing with a running gateway or local agent that is repairing plugin dependencies during the same install. -Some Linux npm setups install global packages under root-owned directories such -as `/usr/lib/node_modules/openclaw`. OpenClaw supports that layout through the -same external staging path. + Some Linux npm setups install global packages under root-owned directories such as `/usr/lib/node_modules/openclaw`. OpenClaw supports that layout through the same external staging path. + + + Set a writable stage directory that is included in `ReadWritePaths`: -For hardened systemd units, set a writable stage directory that is included in -`ReadWritePaths`: + ```ini + Environment=OPENCLAW_PLUGIN_STAGE_DIR=/var/lib/openclaw/plugin-runtime-deps + ReadWritePaths=/var/lib/openclaw /home/openclaw/.openclaw /tmp + ``` -```ini -Environment=OPENCLAW_PLUGIN_STAGE_DIR=/var/lib/openclaw/plugin-runtime-deps -ReadWritePaths=/var/lib/openclaw /home/openclaw/.openclaw /tmp -``` + If `OPENCLAW_PLUGIN_STAGE_DIR` is not set, OpenClaw uses `$STATE_DIRECTORY` when systemd provides it, then falls back to `~/.openclaw/plugin-runtime-deps`. The repair step treats that stage as an OpenClaw-owned local package root and ignores user npm prefix and global settings, so global-install npm config does not redirect bundled plugin dependencies into `~/node_modules` or the global package tree. + + + Before package updates and bundled runtime-dependency repairs, OpenClaw tries a best-effort disk-space check for the target volume. Low space produces a warning with the checked path, but does not block the update because filesystem quotas, snapshots, and network volumes can change after the check. The actual npm install, copy, and post-install verification remain authoritative. + + + Packaged installs keep bundled plugin runtime dependencies out of the read-only package tree. On startup and during `openclaw doctor --fix`, OpenClaw repairs runtime dependencies only for bundled plugins that are active in config, active through legacy channel config, or enabled by their bundled manifest default. Persisted channel auth state alone does not trigger Gateway startup runtime-dependency repair. -If `OPENCLAW_PLUGIN_STAGE_DIR` is not set, OpenClaw uses `$STATE_DIRECTORY` when -systemd provides it, then falls back to `~/.openclaw/plugin-runtime-deps`. -The repair step treats that stage as an OpenClaw-owned local package root and -ignores user npm prefix/global settings, so global-install npm config does not -redirect bundled plugin dependencies into `~/node_modules` or the global package -tree. - -Before package updates and bundled runtime-dependency repairs, OpenClaw tries a -best-effort disk-space check for the target volume. Low space produces a warning -with the checked path, but does not block the update because filesystem quotas, -snapshots, and network volumes can change after the check. The actual npm -install, copy, and post-install verification remain authoritative. - -### Bundled plugin runtime dependencies - -Packaged installs keep bundled plugin runtime dependencies out of the read-only -package tree. On startup and during `openclaw doctor --fix`, OpenClaw repairs -runtime dependencies only for bundled plugins that are active in config, active -through legacy channel config, or enabled by their bundled manifest default. -Persisted channel auth state alone does not trigger Gateway startup -runtime-dependency repair. - -Explicit disablement wins. A disabled plugin or channel does not get its -runtime dependencies repaired just because it exists in the package. External -plugins and custom load paths still use `openclaw plugins install` or -`openclaw plugins update`. + Explicit disablement wins. A disabled plugin or channel does not get its runtime dependencies repaired just because it exists in the package. External plugins and custom load paths still use `openclaw plugins install` or `openclaw plugins update`. + + ## Auto-updater @@ -210,7 +191,9 @@ openclaw doctor openclaw gateway restart ``` -Tip: `npm view openclaw version` shows the current published version. + +`npm view openclaw version` shows the current published version. + ### Pin a commit (source) @@ -232,6 +215,6 @@ To return to latest: `git checkout main && git pull`. ## Related -- [Install Overview](/install) — all installation methods -- [Doctor](/gateway/doctor) — health checks after updates -- [Migrating](/install/migrating) — major version migration guides +- [Install overview](/install): all installation methods. +- [Doctor](/gateway/doctor): health checks after updates. +- [Migrating](/install/migrating): major version migration guides. From 0eac6432c3b5333f73b24715a20257ad7f43bdda Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 21:28:52 -0700 Subject: [PATCH 251/418] docs: fix docs formatting drift --- docs/concepts/compaction.md | 1 + docs/providers/ollama.md | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/concepts/compaction.md b/docs/concepts/compaction.md index e0da752b7a8..f70af2e82c3 100644 --- a/docs/concepts/compaction.md +++ b/docs/concepts/compaction.md @@ -41,6 +41,7 @@ Before compacting, OpenClaw automatically reminds the agent to save important no - `input token count exceeds the maximum number of input tokens` - `input is too long for the model` - `ollama error: context length exceeded` + diff --git a/docs/providers/ollama.md b/docs/providers/ollama.md index bb3fc9aaae4..b5b6847f3cc 100644 --- a/docs/providers/ollama.md +++ b/docs/providers/ollama.md @@ -15,7 +15,7 @@ OpenClaw integrates with Ollama's native API (`/api/chat`) for hosted cloud mode Ollama provider config uses `baseUrl` as the canonical key. OpenClaw also accepts `baseURL` for compatibility with OpenAI SDK-style examples, but new config should prefer `baseUrl`. -### Auth rules +## Auth rules @@ -33,6 +33,7 @@ Ollama provider config uses `baseUrl` as the canonical key. OpenClaw also accept - A provider-level key is sent only to that provider's Ollama host. - `agents.*.memorySearch.remote.apiKey` is sent only to its remote embedding host. - A pure `OLLAMA_API_KEY` env value is treated as the Ollama Cloud convention, not sent to local or self-hosted hosts by default. + From f83e424a5dacc28e03fa3c843578fb70eca7d7f1 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 21:32:47 -0700 Subject: [PATCH 252/418] docs: fix onboarding docs formatting --- docs/cli/onboard.md | 2 ++ docs/install/updating.md | 3 +++ 2 files changed, 5 insertions(+) diff --git a/docs/cli/onboard.md b/docs/cli/onboard.md index 8408d7d3437..8494367a293 100644 --- a/docs/cli/onboard.md +++ b/docs/cli/onboard.md @@ -181,12 +181,14 @@ openclaw onboard --non-interactive \ When an auth choice implies a preferred provider, onboarding prefilters the default-model and allowlist pickers to that provider. For Volcengine and BytePlus, this also matches the coding-plan variants (`volcengine-plan/*`, `byteplus-plan/*`). If the preferred-provider filter yields no loaded models yet, onboarding falls back to the unfiltered catalog instead of leaving the picker empty. + Some web-search providers trigger provider-specific follow-up prompts: - **Grok** can offer optional `x_search` setup with the same `XAI_API_KEY` and an `x_search` model choice. - **Kimi** can ask for the Moonshot API region (`api.moonshot.ai` vs `api.moonshot.cn`) and the default Kimi web-search model. + - Local onboarding DM scope behavior: [CLI setup reference](/start/wizard-cli-reference#outputs-and-internals). diff --git a/docs/install/updating.md b/docs/install/updating.md index f4d44b9b32f..2916791de1c 100644 --- a/docs/install/updating.md +++ b/docs/install/updating.md @@ -108,6 +108,7 @@ bun add -g openclaw@latest OpenClaw treats packaged global installs as read-only at runtime, even when the global package directory is writable by the current user. Bundled plugin runtime dependencies are staged into a writable runtime directory instead of mutating the package tree. This keeps `openclaw update` from racing with a running gateway or local agent that is repairing plugin dependencies during the same install. Some Linux npm setups install global packages under root-owned directories such as `/usr/lib/node_modules/openclaw`. OpenClaw supports that layout through the same external staging path. + Set a writable stage directory that is included in `ReadWritePaths`: @@ -118,6 +119,7 @@ bun add -g openclaw@latest ``` If `OPENCLAW_PLUGIN_STAGE_DIR` is not set, OpenClaw uses `$STATE_DIRECTORY` when systemd provides it, then falls back to `~/.openclaw/plugin-runtime-deps`. The repair step treats that stage as an OpenClaw-owned local package root and ignores user npm prefix and global settings, so global-install npm config does not redirect bundled plugin dependencies into `~/node_modules` or the global package tree. + Before package updates and bundled runtime-dependency repairs, OpenClaw tries a best-effort disk-space check for the target volume. Low space produces a warning with the checked path, but does not block the update because filesystem quotas, snapshots, and network volumes can change after the check. The actual npm install, copy, and post-install verification remain authoritative. @@ -126,6 +128,7 @@ bun add -g openclaw@latest Packaged installs keep bundled plugin runtime dependencies out of the read-only package tree. On startup and during `openclaw doctor --fix`, OpenClaw repairs runtime dependencies only for bundled plugins that are active in config, active through legacy channel config, or enabled by their bundled manifest default. Persisted channel auth state alone does not trigger Gateway startup runtime-dependency repair. Explicit disablement wins. A disabled plugin or channel does not get its runtime dependencies repaired just because it exists in the package. External plugins and custom load paths still use `openclaw plugins install` or `openclaw plugins update`. + From fd06aeac0497b54c0aa796ab3290c5416b0ca0c2 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 05:38:23 +0100 Subject: [PATCH 253/418] test(docker): fixture ClawHub plugin smoke --- scripts/e2e/plugins-docker.sh | 163 +++++++++++++++++++++++ test/scripts/docker-build-helper.test.ts | 10 ++ 2 files changed, 173 insertions(+) diff --git a/scripts/e2e/plugins-docker.sh b/scripts/e2e/plugins-docker.sh index 5c34508a6cb..238185fa3a3 100755 --- a/scripts/e2e/plugins-docker.sh +++ b/scripts/e2e/plugins-docker.sh @@ -611,6 +611,169 @@ CLAWHUB_PLUGIN_SPEC="${OPENCLAW_PLUGINS_E2E_CLAWHUB_SPEC:-clawhub:openclaw-now4r CLAWHUB_PLUGIN_ID="${OPENCLAW_PLUGINS_E2E_CLAWHUB_ID:-now4real}" export CLAWHUB_PLUGIN_SPEC CLAWHUB_PLUGIN_ID +start_clawhub_fixture_server() { + local fixture_dir="$1" + local server_log="$fixture_dir/clawhub-fixture.log" + local server_port_file="$fixture_dir/clawhub-fixture-port" + local server_pid_file="$fixture_dir/clawhub-fixture-pid" + + node - <<'NODE' "$server_port_file" >"$server_log" 2>&1 & +const crypto = require("node:crypto"); +const http = require("node:http"); +const path = require("node:path"); +const { createRequire } = require("node:module"); + +const portFile = process.argv[2]; +const requireFromApp = createRequire(path.join(process.cwd(), "package.json")); +const JSZip = requireFromApp("jszip"); +const packageName = "openclaw-now4real"; +const pluginId = "now4real"; +const version = "0.1.2"; + +async function main() { + const zip = new JSZip(); + zip.file( + "package/package.json", + `${JSON.stringify( + { + name: packageName, + version, + openclaw: { extensions: ["./index.js"] }, + }, + null, + 2, + )}\n`, + { date: new Date(0) }, + ); + zip.file( + "package/index.js", + `module.exports = { + id: "${pluginId}", + name: "Now 4 Real", + register(api) { + api.registerGatewayMethod("now4real.ping", async () => ({ ok: true })); + }, +}; +`, + { date: new Date(0) }, + ); + zip.file( + "package/openclaw.plugin.json", + `${JSON.stringify( + { + id: pluginId, + configSchema: { + type: "object", + properties: {}, + }, + }, + null, + 2, + )}\n`, + { date: new Date(0) }, + ); + + const archive = await zip.generateAsync({ type: "nodebuffer", compression: "DEFLATE" }); + const sha256hash = crypto.createHash("sha256").update(archive).digest("hex"); + + const json = (response, value) => { + response.writeHead(200, { "content-type": "application/json" }); + response.end(`${JSON.stringify(value)}\n`); + }; + + const server = http.createServer((request, response) => { + const url = new URL(request.url, "http://127.0.0.1"); + if (request.method !== "GET") { + response.writeHead(405); + response.end("method not allowed"); + return; + } + if (url.pathname === `/api/v1/packages/${encodeURIComponent(packageName)}`) { + json(response, { + package: { + name: packageName, + displayName: "Now 4 Real", + family: "code-plugin", + channel: "official", + isOfficial: true, + runtimeId: pluginId, + latestVersion: version, + createdAt: 0, + updatedAt: 0, + compatibility: { + pluginApiRange: ">=2026.4.11", + minGatewayVersion: "2026.4.11", + }, + }, + }); + return; + } + if ( + url.pathname === `/api/v1/packages/${encodeURIComponent(packageName)}/versions/${version}` + ) { + json(response, { + version: { + version, + createdAt: 0, + changelog: "Fixture package for Docker plugin E2E.", + sha256hash, + compatibility: { + pluginApiRange: ">=2026.4.11", + minGatewayVersion: "2026.4.11", + }, + }, + }); + return; + } + if (url.pathname === `/api/v1/packages/${encodeURIComponent(packageName)}/download`) { + response.writeHead(200, { + "content-type": "application/zip", + "content-length": String(archive.length), + }); + response.end(archive); + return; + } + response.writeHead(404, { "content-type": "text/plain" }); + response.end(`not found: ${url.pathname}`); + }); + + server.listen(0, "127.0.0.1", () => { + require("node:fs").writeFileSync(portFile, String(server.address().port)); + }); +} + +main().catch((error) => { + console.error(error); + process.exit(1); +}); +NODE + local server_pid="$!" + echo "$server_pid" > "$server_pid_file" + + for _ in $(seq 1 100); do + if [[ -s "$server_port_file" ]]; then + export OPENCLAW_CLAWHUB_URL="http://127.0.0.1:$(cat "$server_port_file")" + trap 'if [[ -f "'"$server_pid_file"'" ]]; then kill "$(cat "'"$server_pid_file"'")" 2>/dev/null || true; fi' EXIT + return 0 + fi + if ! kill -0 "$server_pid" 2>/dev/null; then + cat "$server_log" + return 1 + fi + sleep 0.1 + done + + cat "$server_log" + echo "Timed out waiting for ClawHub fixture server." >&2 + return 1 +} + +if [[ -z "${OPENCLAW_CLAWHUB_URL:-}" && -z "${CLAWHUB_URL:-}" ]]; then + # Keep the release-path smoke hermetic; live ClawHub can rate-limit CI. + clawhub_fixture_dir="$(mktemp -d "/tmp/openclaw-clawhub-fixture.XXXXXX")" + start_clawhub_fixture_server "$clawhub_fixture_dir" +fi + node - <<'NODE' const spec = process.env.CLAWHUB_PLUGIN_SPEC; if (!spec?.startsWith("clawhub:")) { diff --git a/test/scripts/docker-build-helper.test.ts b/test/scripts/docker-build-helper.test.ts index 7784160df91..92f463ef61b 100644 --- a/test/scripts/docker-build-helper.test.ts +++ b/test/scripts/docker-build-helper.test.ts @@ -6,6 +6,7 @@ const DOCKER_ALL_SCHEDULER_PATH = "scripts/test-docker-all.mjs"; const DOCKER_E2E_SCENARIOS_PATH = "scripts/lib/docker-e2e-scenarios.mjs"; const INSTALL_E2E_RUNNER_PATH = "scripts/docker/install-sh-e2e/run.sh"; const OPENAI_WEB_SEARCH_MINIMAL_E2E_PATH = "scripts/e2e/openai-web-search-minimal-docker.sh"; +const PLUGINS_DOCKER_E2E_PATH = "scripts/e2e/plugins-docker.sh"; const CENTRALIZED_BUILD_SCRIPTS = [ "scripts/docker/setup.sh", "scripts/e2e/browser-cdp-snapshot-docker.sh", @@ -95,4 +96,13 @@ describe("docker build helper", () => { expect(runner).toContain('[...gatewayArgs, "agent", "--params"'); expect(runner).not.toContain('"agent.wait"'); }); + + it("keeps ClawHub plugin Docker smoke hermetic by default", () => { + const runner = readFileSync(PLUGINS_DOCKER_E2E_PATH, "utf8"); + + expect(runner).toContain("start_clawhub_fixture_server()"); + expect(runner).toContain('OPENCLAW_CLAWHUB_URL="http://127.0.0.1:'); + expect(runner).toContain("live ClawHub can rate-limit CI"); + expect(runner).toContain('[[ -z "${OPENCLAW_CLAWHUB_URL:-}" && -z "${CLAWHUB_URL:-}" ]]'); + }); }); From e2ecf292bc865796a1c4feadf644fbe12635460f Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 21:38:47 -0700 Subject: [PATCH 254/418] docs(doctor): document models.providers.api migration and stale-enum skip MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add the legacy `models.providers.*.api: "openai"` → `"openai-completions"` migration to doctor's Current migrations list, and note the gateway startup behavior that skips providers with future or unknown api enum values instead of failing closed. Traces to: - 6a7980e984 fix(doctor): migrate legacy OpenAI provider api - 147f4f50f5 fix(gateway): skip stale model provider api entries --- docs/gateway/doctor.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/gateway/doctor.md b/docs/gateway/doctor.md index ccce6cc8de1..24b68e495ee 100644 --- a/docs/gateway/doctor.md +++ b/docs/gateway/doctor.md @@ -197,6 +197,7 @@ That stages grounded durable candidates into the short-term dreaming store while - `browser.ssrfPolicy.allowPrivateNetwork` → `browser.ssrfPolicy.dangerouslyAllowPrivateNetwork` - `browser.profiles.*.driver: "extension"` → `"existing-session"` - remove `browser.relayBindHost` (legacy extension relay setting) + - legacy `models.providers.*.api: "openai"` → `"openai-completions"` (gateway startup also skips providers whose `api` is set to a future or unknown enum value rather than failing closed) Doctor warnings also include account-default guidance for multi-account channels: From edbcfe1a1d8100a0e858bec1f6dfe8aac14fd69a Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sun, 26 Apr 2026 21:38:49 -0700 Subject: [PATCH 255/418] docs(agents): keep testbox policy out of root rules --- AGENTS.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 5eb1b28406a..faca52035ae 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -54,9 +54,7 @@ Telegraph style. Root rules only. Read scoped `AGENTS.md` before subtree work. - Formatting: use `oxfmt`, not Prettier. Prefer `pnpm format:check` / `pnpm format`; for targeted files use `pnpm exec oxfmt --check --threads=1 ` or `pnpm exec oxfmt --write --threads=1 `. - Linting: use repo wrappers (`pnpm lint:*`, `scripts/run-oxlint.mjs`); do not invoke generic JS formatters/lints unless a repo script uses them. - Heavy checks: `OPENCLAW_LOCAL_CHECK=1`, mode `OPENCLAW_LOCAL_CHECK_MODE=throttled|full`; CI/shared use `OPENCLAW_LOCAL_CHECK=0`. -- Maintainer Testbox mode: if `OPENCLAW_TESTBOX=1` is present in env or standing user rules, use Blacksmith Testbox for `pnpm` gates, e2e, broad suites, and long/heavy validation. This is maintainers-only and requires Blacksmith access. -- Testbox escape hatch: if `OPENCLAW_TESTBOX=1` is set but `OPENCLAW_LOCAL_CHECK_MODE=throttled|full` is explicitly set for the task/command, use the local repo `pnpm` lane instead. -- Testbox warmup: start from repo root, save/reuse the returned ID for every run in the same task. Use `ci-check-testbox.yml` for normal checks; use `ci-build-artifacts-testbox.yml` when build artifacts, e2e, or package-like proof benefits from seeded `dist/`/`dist-runtime/` caches. +- Local first. Use repo `pnpm` lanes before Blacksmith/Testbox. Remote only for parity-only failures, secrets/services, or explicit ask. ## GitHub / CI From 390b9654607a1df8a26729cce53bb7ad97c01440 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 27 Apr 2026 05:40:13 +0100 Subject: [PATCH 256/418] docs: document release evidence workflow --- .agents/skills/openclaw-testing/SKILL.md | 26 ++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/.agents/skills/openclaw-testing/SKILL.md b/.agents/skills/openclaw-testing/SKILL.md index 321f46383f3..a3c72f9660b 100644 --- a/.agents/skills/openclaw-testing/SKILL.md +++ b/.agents/skills/openclaw-testing/SKILL.md @@ -131,6 +131,32 @@ If a full run is already active on a newer `origin/main`, prefer watching that run over dispatching a duplicate. If you accidentally dispatch a stale duplicate, cancel it and monitor the current run. +### Release Evidence + +After release-candidate validation or before a release decision, record the +important run ids in the private `openclaw/releases-private` evidence ledger. +Use the manual `OpenClaw Release Evidence` +(`openclaw-release-evidence.yml`) workflow there. It writes durable summaries +under `evidence//` and commits: + +- `release-evidence.md` +- `release-evidence.json` +- `index.json` +- `runs/