* fix(tui): cancel buffered submissions on shutdown
* refactor(tui): preserve callable submit coalescer
* test(tui): run local PTY smoke against built CLI
* fix(ui): restore chat flow e2e coverage
(cherry picked from commit 16a094eaec4ae121db09f67c094a41262aa9cefc)
* test(ui): align browser Talk mocks with voice sessions
(cherry picked from commit ef0649334539954b253ab8c51ff436bd8ce757c6)
* test(ui): wait for chat startup in update E2E
(cherry picked from commit 586e1046320dd56398fd8a3b995a1a465f6c6fe2)
* test(ui): update sidebar session route expectation
(cherry picked from commit 9692985027556fad7bb7819c8e140a101e181c47)
* test(ui): update session management e2e contracts
(cherry picked from commit 4e99348dabf08fb8886d55e25a9f9eda1dfe1056)
* test(ui): align Codex session E2E contracts
Update the catalog layout assertion for reorderable sibling sections, expose advanced plugin settings explicitly, and make adopted sessions resolvable through the current path router.
(cherry picked from commit 1a03f924a32facb23302c5618a2b15004feeccff)
* test(ui): align composer e2e with metadata hydration
(cherry picked from commit eca1902e773be32c993ddb22594925f7da82f98f)
* fix(ui): restore usage hint click behavior
(cherry picked from commit ea63b5dab7c3c54048a04d60703e529e5b900df6)
* fix(ui): give reveal-only tooltips an explicit click-to-open opt-in
#112602 made the shared tooltip dismiss on pointer activation so an action
button never strands one open. The usage summary hint exists only to be read,
so clicking it did nothing on touch or in browsers that skip focus on click.
Opt that trigger in rather than bouncing focus through blur/focus, which
briefly drops focus for assistive tech.
(cherry picked from commit 16d165857a4006ae0a0df42168f34a40f4cc9117)
* test(ui): follow sidebar dock resize ownership
(cherry picked from commit fd4792a2dd9fc81fc63f8c9e25291ff2246d235a)
* test(ui): prove the dock resize persists off its clamp
Asserting the post-End width equals SIDEBAR_MIN_WIDTH_PX compared the clamp
to itself across reload, so the check would pass even if the persisted width
were dropped and the column fell back to its minimum. Step off the clamp
first and assert that value survives.
(cherry picked from commit 3636124c326a93b80006ccc4064415ec1a6c2c9f)
* test(ui): align native link routing e2e contracts
Use a non-link bubble hit target after flat assistant styling, assert modified clicks at the routing boundary instead of relying on Chromium tab creation, and preserve native context menus for internal anchors.
(cherry picked from commit 55fbd3052a40c5c03f00f0bf595ef356ac0d1f10)
* test(ui): align native catalog host assertions
(cherry picked from commit 9db9a2fcd5633675a88296b2ccd874563a00cb80)
* test(ui): target tool outcome rollup at dashboard session
Completed-work groups are dashboard-only, so the legacy main session never rendered the disclosure exercised by this test.
(cherry picked from commit ba84b617ef038866451ad03491298349d966a54f)
* test(ui): track discussion panel close action
The flexible multi-sidebar layout replaced the generic Close sidebar action with a panel-specific Close Discussion action. Keep the E2E toggle proof aligned with that intentional accessible-name contract.
(cherry picked from commit 422b1f2bd8fae2a7571881d0455c3040c2ef2de9)
* test(ui): mock pairing list in WhatsApp logout e2e
(cherry picked from commit 3730de075bbb50071fc0cb57c007ab894688a7a1)
* test(ui): open build info from identity menu
(cherry picked from commit b1626a6a723ec13c2cf50444b4c7a65fec289213)
* fix(ui): let the board fixture host page own its theme
The fixture module unconditionally re-added `wa-dark` at import time, which
runs after the host page's inline theme script. #111998 gave that page the
real prefers-color-scheme contract, leaving the line from #112076 stale: in
light mode the root ended up with both `wa-light` and `wa-dark`, so Web
Awesome rendered dropdowns dark.
(cherry picked from commit 43e50de9728f3d5feac9609142d28821896b4f77)
* test(ui): align approval E2E with scoped errors
(cherry picked from commit 6435fe995491c6bae2c28fa374d06cd77f3c46ac)
* test(ui): use radio role in Set Default E2E
(cherry picked from commit acc8d5a487aac4d56515ae35d976fd347efa0be5)
* ci: gate merges on the Control UI e2e suite
test/vitest/vitest.ui-e2e.config.ts was referenced only by package.json and
mantis-web-ui-chat-proof.yml, so nothing in the merge gate ever ran it and 39
failures accumulated across 21 files (#114438). Give it its own job: the suite
runs one file at a time because each owns a Chromium context and a mocked
Gateway, ~21 min measured, which does not fit checks-ui's 20-minute budget.
Also route the config file itself through the Control UI changed-scope so a
change to it triggers the job.
* test(ui): isolate MCP app conformance from sidecars
(cherry picked from commit c2bfd0a00edad804474ebb23449d3150557c7f78)
* test(ui): list newly created E2E sessions
(cherry picked from commit e1a2188699011e818e040358d4eaf6ce26eb0732)
* test(ui): synchronize full-suite e2e setup
* test(ui): drop implied-eval module import and align the e2e workflow guard
* test(ui): wait for pin editor roving focus before keyboard nav
* test(ui): read the startle class in one in-page step
* test(ui): synchronize transient e2e assertions
* refactor(memory-core): remove orphaned shadow trials
* refactor(qqbot): migrate direct voice upload formats
Release note: QQBot configs using voiceDirectUploadFormats now migrate through openclaw doctor --fix to audioFormatPolicy.uploadDirectFormats at root and account scope. Existing nested uploadDirectFormats values win conflicts, and runtime reads only the nested policy.
* refactor(feishu): migrate tools base alias
Release note: Feishu configs using tools.base now migrate through openclaw doctor --fix to tools.bitable at root and account scope. Existing bitable values win conflicts, and runtime accepts only the canonical key.
* refactor(extensions): remove dead runtime state
* chore(config): refresh bundled channel metadata
* refactor(codex): keep realtime fallback type private
* test(ci): align QA compatibility scenario count
* build(deps): remove npm shrinkwrap; mirror pnpm lock into transient package locks
npm 12 removed shrinkwrap (command + tarball/root loading). Delete all 82
committed npm-shrinkwrap.json files and stop publishing lockfiles; keep
pnpm-lock.yaml as the single reviewed dependency boundary. The generator
becomes scripts/generate-npm-package-lock.mjs and feeds plugin bundling via
a transient package-lock.json + npm ci (works on npm 11 and 12). Tarball
validation treats the published 2026.7.2 beta train as a shrinkwrap
transition; self-update npm detection now uses install topology instead of
the shipped shrinkwrap.
* fix(deps): repair lint, deadcode, and test-type lanes for the npm 12 migration
- sort integrity comparisons with an explicit comparator (oxlint)
- keep resolveBunGlobalNodeModules module-local (knip unused-export gate)
- model npm pack --json as npm<=11 array / npm 12 name-keyed object
- default calver destructuring in the tarball test fixture
* chore(compat): date the annotated deprecation families and expose removal-pending debt
Adds 10 dated compat-registry records for shipped deprecated surfaces that
previously had @deprecated annotations only (removeAfter 2026-10-01 per the
approved 60-day window), extends the beta5 session-store record with the
package-root aliases, surfaces removal-pending records with due dates,
blockers, and readers in the plugin boundary report, and converts undated
cleanup obligations (CI timing job, zizmor excessive-permissions, staged
Codex CI auth, memory-host legacy state dir, agent-DB schema-ladder floors)
into dated markers visible to the weekly dated-TODO sweep. Metadata,
diagnostics, and docs only - no runtime behavior change.
* fix(compat): keep extension src test paths out of core string literals
The core import guardrail forbids extensions/*/src/ path shapes in core
production string literals; cite the package-root google-meet test and the
registry test for official-plugin-export-aliases instead.
* perf(ci): cut the pre-fan-out critical path on canonical runs
Two changes to the run head and matrix shape:
1. runner-admission was a hosted 90s sleep every run queued behind
(observed 1.7min hosted-queue latency before the sleep started). The
debounce now lives at the tail of preflight: heavy jobs all need
preflight, so a superseding main push still cancels the run before
fan-out while only one 4 vCPU runner has been spent, and preflight's
own work usually exceeds the window so the residual sleep is zero.
security-fast (hosted, dependency-free) starts immediately.
2. Canonical main pushes now use the compact bin plan like PRs: the
82-job named matrix drained the runner pool for ~4.5min (job starts
trickled from minute 5.2 to 9.7 in run 29592647843) with no
branch-protection consumer for per-shard names on main. Coverage is
identical; dispatch/release-gate runs keep the full named matrix.
* perf(test): boot TUI PTY suite fixtures concurrently
tsx+TUI startup dominated the harness file's wall time and the three
suite PTYs booted serially. Boot them concurrently in beforeAll
(allSettled so a failed boot still assigns survivors for afterAll
cleanup); the env-specific fixtures never receive input, so their tests
only await their own readiness output. The slow-startup test now proves
frame ordering on the append-only output, which the old sequential
waits did not. File wall 10.2s -> ~4.9s, 3/3 repeat runs green.
* docs(ci): align gate and debounce descriptions with the removed admission job
* test(tooling): wait for readiness file content, not existence
writeFileSync creates the file before its bytes land, so the existence
poll raced the child's write on loaded runners and read an empty ready
file (observed in compact-small-4, run 29615028678). Poll for non-empty
content at both readiness sites.
The installation hit Blacksmith's backing-disk cap because sticky keys
embedded PR numbers and content hashes, minting a new disk per PR and
per input change until every mount 429-failed fleet-wide. node-deps
(#109752) and ext-boundary (#109804) were already re-keyed; this
converts the last two minters and audits the third suspect.
Keys changed:
- Vitest fs transform cache: `vitest-fs-v2-<pr-N|protected>-...` ->
the one existing `vitest-fs-v2-protected-<os>-<arch>-node-<ver>`
disk. Entries are content-hash keyed (vitest sha1 over
id+content+NODE_ENV+version+env config), so cross-PR sharing is safe
by construction: PRs now mount the protected snapshot directly
(read-only, commit false) and the separate PR-only seed mount is
deleted. Writers (non-PR shard writer + scheduled warm run) keep
explicit commit true. Disk count: 1 + O(open PRs) -> 1.
- Gradle: `gradle-v1-<task>-<pr-N|protected>-<hashFiles(deps)>` ->
`gradle-v2-<task>`. Task scope stays (light ktlint must not seed
heavy build lanes); PR number and dependency hash leave the key. The
dependency hash moved to an in-job fingerprint marker that makes the
non-PR writer rebuild its snapshot cold when inputs change, bounding
disk growth; PR mounts are read-only and safely reuse stale
snapshots because Gradle caches are content-addressed. Disk count:
O(tasks x PRs x dependency bumps) -> O(tasks) (7 today).
- Docker builder (useblacksmith/setup-docker-builder): audited, out of
scope. The action owns its key internally and always uses the repo
name only (src/setup_builder.ts getStickyDisk), so it is already one
disk per installation repo and cannot mint per-PR disks.
PR warm-path behavior changes:
- Vitest: PRs lose only PR-local warm entries for files the PR itself
changed (previously persisted on the pr-N disk between pushes);
changed files re-transform once per push, unchanged files still hit
the protected snapshot. PRs touching transform inputs
(lockfile/tsconfig/package.json) run cold per push since the
generation wipe is now local to the discarded clone.
- Gradle: dependency-bump PRs get warmer (stale-but-valid protected
snapshot instead of a cold fresh key); other PRs are unchanged.
Deleted `.github/workflows/pr-cache-cleanup.yml`: it existed for the
per-PR cache layer (#109425) and only deleted GitHub actions/cache
archives, which GitHub's own LRU/TTL eviction already handles for the
remaining fork/Windows per-PR archive paths.
Guards: pinned the O(1) vitest key + non-PR commit gate, added a
Gradle per-task key/writer/fingerprint guard, added a repo-wide scan
asserting no useblacksmith/stickydisk key ever contains
github.event.pull_request.number or hashFiles(), and replaced the
cleanup-workflow assertions with a stays-deleted check.
check-additional-extension-package-boundary is the light-run critical-path
pole. Measured on runs 29564442266/29564411446/29564259862 (8 vCPU, sticky
mounts 429-failing): Setup Node ~40s cold install, shard step 142-161s =
~101s cold plugin-sdk dts prep (nine parallel tsgo builds) + ~58s compiling
122 plugins at concurrency 6 + ~1s canary; warm actions/cache path on a main
push (29551077288) runs the shard in 67s.
Levers chosen from that data:
- Re-key the ext-boundary sticky disk from per-PR/per-config keys (v1) to one
O(1) protected key (v2), following the node_modules snapshot fix in
#109752. Blacksmith's installation-wide 1000-disk cap is saturated and
every mount 429s; per-PR keys are a direct contributor. The config/scripts/
lockfile hash moves from the key into the in-job .source-trees marker next
to the existing tree-OID + node/pnpm gate. Single semantic writer: the
boundary lane commits explicitly (true, not if-missing) on protected pushes
only; PR mounts and the check-lint consumer stay read-only, and the seed
step is now writer-only (saves ~11s per PR cold run).
- Bump the lane 8 -> 32 vCPU and raise OPENCLAW_EXTENSION_BOUNDARY_CONCURRENCY
6 -> 16: both the parallel dts prep and the 122 plugin compiles scale with
cores at similar billed core-minutes (same precedent as check-lint/deps).
Expected pole time: warm PR runs (protected snapshot tracks every main push)
drop to roughly checkout + install-skip + restore + incremental shard, well
under 2 minutes; cold runs that touch boundary trees shrink via the core
bump. Guarded in ci-workflow-guards so the O(1) key, single-writer commit,
and fingerprint composition cannot silently regress.
