Peter Steinberger
cd4bd7c6c0
fix(tui): cancel buffered submissions on shutdown [AI-assisted] ( #117331 )
...
* fix(tui): cancel buffered submissions on shutdown
* refactor(tui): preserve callable submit coalescer
* test(tui): run local PTY smoke against built CLI
2026-08-01 05:00:05 -07:00
Peter Steinberger
5620ea7c57
fix(tui): canonical terminal outcomes, cancellation, and error privacy ( #117044 )
...
* fix(tui): preserve canonical terminal and queued cancellation outcomes
* refactor(tui): unify terminal projection without growing production code
* fix(tui): respect authoritative abort facts and sanitize structured errors
* fix(tui): surface canonical error-only terminal outcomes
* fix(tui): retain queued turn fences and canonical terminal reasons
* fix(tui): preserve transitive queue fences and trusted terminal ownership
* fix(tui): follow canceled queue ancestry through bounded maintenance waits
* fix(tui): preserve canonical safe terminal outcomes and cancel queued turns
* fix(agents): redact every lifecycle error at its producer
* test(agents): keep terminal lifecycle fixtures fully typed
---------
Co-authored-by: Peter Steinberger <steipete@macos.shared >
2026-07-31 15:23:10 -07:00
Peter Steinberger
262f26355a
fix(tui): keep reset transitions isolated from stale input ( #116873 )
...
* fix(tui): fence reset session transitions
* fix(tui): explain blocked reset input
* test(tui): isolate reset transition PTY proof
* fix(tui): preserve input across session transitions
* test(tui): synchronize preserved reset draft proof
* test(tui): control reset submit timing
* test(tui): close reset PTY with EOF
* test(tui): exit reset PTY without submit buffering
* test(tui): synchronize reset PTY shutdown
* test(tui): widen reset PTY exit window
* test(tui): stabilize reset transition PTY proof
* test(tui): keep reset PTY harness bounded
* test(tui): split reset PTY fixture wiring
2026-07-31 14:18:34 -07:00
Peter Steinberger
cd8a96491e
fix: repair canonical session keys with doctor ( #116703 )
...
* fix: repair canonical session keys with doctor
* test: align canonical validation with reopen boundary
* test: align session fixtures with canonical keys
* fix: copy only canonical session repair winners
* fix: cover canonical repair edge cases
* test: remove retired preview helper import
* test: align canonical repair delivery scope
* fix: close canonical repair validation gaps
* fix: preserve destination-only repair generations
* fix: preserve canonical repair window projections
* style: format canonical repair imports
* fix: preserve canonical repair delivery ownership
* fix: preserve winner-owned cross-store state
* fix: guard canonical delivery rehoming
* fix: align canonical session contracts after rebase
* test: accept internal canonical repair fixtures
* test: move sharing alias coverage to doctor
2026-07-31 10:04:08 -07:00
Vincent Koc
20e68e01df
fix(gateway): sign device proofs with challenge time ( #116679 )
2026-07-31 16:45:53 +08:00
Peter Steinberger
5fc976571e
fix(tui): require a fresh agent roster ( #116715 )
2026-07-31 01:05:32 -07:00
Peter Steinberger
3b864a18c4
fix(tui): contain shutdown phase failures ( #116609 )
2026-07-30 18:47:55 -07:00
Peter Steinberger
319fd692d1
fix(tui): preserve session state across switches and reconnects ( #116399 )
...
* fix(tui): isolate session lifecycle state
* fix(tui): preserve session incarnation identity
* fix(tui): preserve gateway disconnect fallback
2026-07-30 06:29:31 -07:00
Peter Steinberger
b7ab8aa3da
refactor(chat): consolidate browser and terminal history ownership ( #115511 )
...
* refactor(chat): consolidate session history lifecycle ownership
* fix(ui): share canonical isolated test registry
2026-07-29 00:00:13 -04:00
Peter Steinberger
ad3f74f296
fix(chat): make web and terminal share one session state ( #115429 )
...
* fix(chat): consolidate web and terminal session state
* fix(chat): preserve live history across stale snapshots
2026-07-28 18:53:21 -04:00
Peter Steinberger
18ecde3d9f
refactor(chat): keep web and terminal sessions synchronized ( #115377 )
...
* refactor(chat): unify web and TUI session synchronization
* refactor(chat): extract canonical projection and transcript owners
* test(gateway): verify private transcript store identity
* test(agents): protect public transcript storage boundary
* fix(chat): harden cross-client identity and subscription lifecycles
* fix(gateway-client): preserve type-safe release callback rejection
* test(ui): complete shared sidebar gateway fixture
2026-07-28 16:08:10 -04:00
Peter Steinberger
d4513634af
fix(tui): order delayed prompts before completed replies ( #115219 )
...
* fix(tui): order delayed prompts before completed replies
* fix(tui): anchor delayed prompts before surviving tools
* fix(tui): preserve live tools during scrollback recovery
* refactor(tui): centralize tracked tool lifecycle
* refactor(tui): centralize transcript run state
2026-07-28 13:08:44 -04:00
Peter Steinberger
fda8391fd9
fix: keep shared web and TUI chats synchronized under load ( #115191 )
...
* fix: keep shared web and TUI chats synchronized under load
* test: satisfy strict shared-chat ordering types
2026-07-28 09:39:22 -04:00
Peter Steinberger
0f188c8cc6
fix(tui): preserve shared prompts when scrollback is full ( #115165 )
2026-07-28 08:05:16 -04:00
Peter Steinberger
fdc1ca073c
fix: keep shared web and TUI chats in sync ( #115066 )
2026-07-28 04:38:12 -04:00
Peter Steinberger
0bc6f7525a
fix(tui): recover from transient session subscription failures ( #115010 )
2026-07-28 03:21:34 -04:00
Peter Steinberger
b0a8346ae2
perf(gateway): single-entry reads and config-keyed projections for chat startup ( #115007 )
2026-07-28 03:07:03 -04:00
Peter Steinberger
42fdb81d97
fix(tui): recover chat after dropped gateway events ( #114932 )
2026-07-28 00:54:51 -04:00
Peter Steinberger
eeba5a3433
fix(tui): prevent unsafe errors and out-of-order streamed replies ( #114869 )
...
* fix(tui): redact and sanitize terminal errors
Co-authored-by: Marnie0415 <xzh110415@gmail.com >
* fix(tui): keep streamed answers and tools chronological
Co-authored-by: Foxy6670 <snorblok@gmail.com >
* fix(tui): keep revised answers after tool calls
Co-authored-by: Foxy6670 <snorblok@gmail.com >
* fix(tui): discard retracted streamed assistant rows
Co-authored-by: Foxy6670 <snorblok@gmail.com >
---------
Co-authored-by: Marnie0415 <xzh110415@gmail.com >
Co-authored-by: Foxy6670 <snorblok@gmail.com >
2026-07-27 22:56:58 -04:00
Peter Steinberger
4273ca9dbd
refactor(sessions): remove file-era transcript runtime ( #113233 )
...
* refactor(sessions): keep helper transcripts in memory
* refactor(sessions): remove file-era transcript storage
* test(sessions): use SQLite identity in attempt persistence
* test(codex): isolate legacy transcript fixtures
* fix(sessions): preserve SQLite transcript identity
* fix(sessions): harden transcript lifecycle invariants
* fix(sessions): validate transcript identities
* fix(sessions): close identity compatibility gaps
* fix(sessions): preserve leaf and plugin identities
* fix(sessions): retain dispatch transcript targets
* fix(sessions): preserve active transcript context
* fix(sessions): isolate artifact accounting
* fix(sessions): bound SQLite usage accounting
* fix(sessions): retain bounded latest usage
* fix(sessions): align rebased transcript targets
* test(sessions): align accessor scope fixture
* fix(telegram): derive SQLite transcript identity
* refactor(sessions): remove file-era compaction residue
* chore(sessions): lower max-lines baseline
* fix(sessions): preserve structured transcript identity
* test(sessions): align doctor identity assertions
* fix(sessions): isolate default SDK database
* refactor(sessions): remove dead file-era exports
* fix(sessions): reconcile SQLite transcript identity
* fix(sessions): pass checkpoint identity explicitly
* test(sessions): make entry field probe explicit
* test(sessions): satisfy transcript cleanup lint
* test(sessions): align diagnostics identity proof
* fix(sessions): finish transcript runtime teardown
* fix(sessions): preserve transcript identity invariants
* fix(sessions): harden transcript compatibility edges
* fix(sessions): preserve checkpoint transcript anchors
* fix(sessions): preserve SQLite lifecycle invariants
* fix(sessions): retarget compaction successors
* test(sessions): preserve transcript fixture semantics
* feat(plugin-sdk): add command transcript targets
* fix(sessions): serialize transcript rewrites
* fix(sessions): validate legacy successor identity
* fix(sessions): normalize compaction ownership
* fix(sessions): validate successor identity before adoption
* fix(sessions): preserve plugin transcript ownership
* fix(sessions): carry transcript identity through commands
* fix(sessions): import legacy checkpoint artifacts into SQLite
* fix(sessions): preserve successor transcript ownership
* fix(sessions): align transcript consumers with target identity
* fix(sessions): scope transcript token estimates
* fix(sessions): retain agent identity across lifecycle hooks
* fix(sessions): resolve scoped SQLite targets
* fix(sessions): isolate lifecycle transcript targets
* fix(sessions): validate compaction agent ownership
* fix(sessions): preserve reset and cleanup lifecycle
* fix(sessions): serialize prompt cleanup lifecycle
* fix(sessions): remove stale lock import
* fix(sessions): preserve reset target context
* fix(sessions): fence prompt reload takeover
* fix(sessions): unblock abort and default lifecycle reads
* fix(sessions): validate legacy successor scope
* fix(sessions): reject metadata-only runtime rows
* fix(sessions): propagate custom transcript stores
* fix(sessions): preserve adopted retry targets
* fix(sessions): allow unkeyed usage reads
* fix(sessions): harden runtime target boundaries
* fix(sessions): serialize retry transcript writes
* fix(sessions): bound prompt reload disposal
* fix(sessions): complete retry marker identity
* fix(sessions): keep legacy marker identity minimal
* test(sessions): tighten teardown fixture types
* fix(sessions): preserve compatibility target identity
* test(sessions): persist post-checkpoint boundary turn
* test(sessions): align runtime store mock contracts
* style(sessions): simplify persisted identity guard
* fix(sessions): prefer complete typed targets
* fix(sessions): recover legacy marker targets
* test(sessions): align marker lookup fixture scope
* fix(sessions): validate partial transcript targets
* fix(sessions): reconcile partial transcript identities
* fix(sessions): canonicalize compatibility identities
* test(sessions): cover compatibility aliases
* fix(sessions): adopt legacy successor identity
* fix(sessions): preserve usage read identity
* fix(sessions): preserve partial marker compatibility
* fix(sessions): validate legacy successor mappings
* fix(sessions): reconcile marker store mappings
* fix(sessions): preserve legacy fallback identity
* fix(sessions): harden marker alias resolution
* fix(sessions): prefer verified successor aliases
* fix(sessions): resolve preferred marker aliases
* fix(sessions): serialize cleanup admission
* fix(sessions): align marker lookup scopes
* fix(codex): type marker alias summaries
* style(sessions): satisfy changed lint
* test(sessions): align structured target assertions
* fix(sessions): reconcile latest identity contracts
* fix(sessions): validate transcript identity boundaries
* docs(sessions): explain stable registry keys
* fix(sessions): harden compatibility target round trips
* fix(sessions): port usage identity to split modules
* test(sessions): align subagent transcript identity
* fix(sessions): finish transcript identity migration
* fix(agents): route subagent completion capture through transcript targets
* fix(agents): settle SQLite prompt handoff during cleanup
* chore: shrink max-lines baseline after teardown
* fix(sessions): port teardown across split runtime owners
* fix(sessions): carry transcript targets through split owners
* test(agents): use SQLite compaction target in abort coverage
* chore: retain unrelated max-lines suppressions
* chore: shrink max-lines baseline after main splits
* style(agents): const compaction checkpoint locals
* fix(sessions): harden SQLite teardown boundaries
* test(sessions): use typed metadata in predicate isolation fixture
* test(agents): cover malformed settlement rejections lint-safely
* fix(sessions): close remaining SQLite identity races
* fix(agents): fail closed on incomplete successor targets
* fix(sessions): preserve transcript identity fallbacks
* fix(agents): preserve session-key abort admission
* fix(trajectory): validate incomplete export targets
* test(sessions): drop retired pricing cache imports
* fix(sessions): validate partial transcript identities
* fix(sessions): close transcript identity edge cases
* fix(plugins): reserve retired transcript locator slot
* fix(sessions): scope transcript locks by target
* style(sessions): simplify SDK initialization error
* fix(sessions): preserve initialized transcript state
* fix(codex): verify mirrored history session keys
* fix(sessions): reject stale transcript ownership
* fix(sessions): anchor asynchronous transcript ownership
* fix(sessions): measure active transcript state
* fix(sessions): preserve scoped transcript compaction
* fix(sessions): harden transcript identity and lifecycle
* fix(sessions): resolve scoped command transcript stores
* fix(sessions): make transcript appends failure-atomic
* fix(sessions): enforce scoped transcript ownership
* fix(sessions): reject cross-owner transcript handoffs
* fix(sessions): fence cleanup transcript ownership
* fix(sessions): retire stale write ownership contexts
* fix(sessions): preserve pending session migration state
* fix(sessions): validate migrated transcript ownership
* fix(sessions): validate usage transcript targets
* fix(sessions): clear predecessor transcript metadata
* fix(sessions): align durable session event targets
* fix(sessions): fence late prompt handoffs
* fix(sessions): fence lifecycle transcript fallbacks
* fix(sessions): bound zero-length memory capture
* fix(sessions): preserve transcript teardown ownership
* fix(sessions): reject duplicate cleanup ownership
* fix(sessions): serialize runtime writes with sqlite leases
* fix(sessions): close sqlite teardown concurrency gaps
* fix(sessions): preserve nested lifecycle failures
* fix(sessions): canonicalize sqlite transcript ownership
* fix(sessions): settle disposed prompt handoffs
* fix(sessions): resolve canonical attempt lock targets
* test(sessions): align canonical target fixtures
* test(sessions): retire redundant jsonl parser coverage
* refactor(sessions): split active transcript cursors
* test(memory): retire legacy marker fixture
* fix(sessions): preserve canonical transcript access after rebase
* fix(sessions): fence prompt lease and return transcript targets
* fix(sessions): colocate transcript leases with target store
* fix(sessions): canonicalize transcript lease and worker targets
* fix(sessions): preserve plugin and fork identity markers
* fix(sessions): complete sqlite transcript target migration
* fix(sessions): integrate canonical followup identity
* fix(sessions): preserve bounded transcript topology
* fix(sessions): validate transcript identity boundaries
* fix(context): separate caller and successor targets
* test(sessions): split persistence compatibility coverage
* test(sessions): preserve fixture topology efficiently
* chore(sdk): refresh plugin api baseline
* test(agents): align compaction lock target mocks
* test(sessions): seed malformed transcript fixtures directly
* fix(agents): canonicalize transcript compatibility inputs
* fix(agents): type optional tool result ids
* test(ci): stabilize loaded process timing
* test(tui): wait for collect queue admission
2026-07-27 22:33:24 -04:00
Peter Steinberger
1de8b74e70
fix(tui): harden terminal sessions, streaming, and input ( #114816 )
2026-07-27 20:54:26 -04:00
Peter Steinberger
c656e73065
fix(tui): preserve Unicode during fragmented terminal input [AI-assisted] ( #114728 )
...
* fix(tests): run Codex prewarm in exactly one shard
* fix(tui): preserve Unicode in fragmented terminal input
* fix(tui): keep Unicode stress coverage within lint limits
2026-07-27 16:47:49 -04:00
Peter Steinberger
e2fbd3b1ed
fix(tui): prevent wrapped terminal stress-test failures ( #114672 )
...
* fix(tui): stabilize wrapped terminal stress tests
* fix(ci): cover Codex prewarm in full-suite shard
2026-07-27 14:34:43 -04:00
Peter Steinberger
c0b388e35e
fix(tui): make compact terminal stress tests reliable ( #114571 )
2026-07-27 08:38:19 -04:00
Peter Steinberger
a62abee427
fix(tui): prevent cross-session leaks and lost streamed replies ( #114504 )
...
* fix(tui): isolate sessions and preserve concurrent streamed replies
* refactor(tui): extract bounded terminal fixture support
* fix(tui): prevent stale concurrent streams from reopening sessions
* fix(tui): reconcile Gateway run aliases and test ownership
2026-07-27 07:26:52 -04:00
Peter Steinberger
b7cc6811b7
fix: fall back on raw provider request errors ( #114457 )
...
* fix(agents): classify raw provider request errors
Co-authored-by: Christopher Bradford <7553311+sunkencity999@users.noreply.github.com >
* chore: leave release notes to release workflow
* test(agents): lock error classification precedence
* fix(agents): preserve structured error diagnostics
* fix(gateway): retry sends during transcript rebuilds
* fix(gateway): preserve steer sequencing across rebuilds
* style(tui): satisfy retry guard lint
---------
Co-authored-by: Christopher Bradford <7553311+sunkencity999@users.noreply.github.com >
2026-07-27 06:02:15 -04:00
Peter Steinberger
fd6e042d87
fix(gateway): keep configured local auth authoritative ( #114462 )
...
* fix(gateway): align configured local credentials
* test(gateway): align local credential coverage
* chore(gateway): leave release note to release process
2026-07-27 05:43:31 -04:00
Peter Steinberger
ac6009eab1
fix(tui): keep shared sessions live and bound stream state ( #114443 )
...
Fix cross-client terminal history synchronization without letting stale snapshots erase in-flight responses. Bound orphaned stream assembly, preserve session and agent ownership, and cover real Gateway delivery, persistence races, reconnects, and stress bursts.
Closes #38829 .
Credits prior issue investigation in #96252 and bounded-stream work in #109492 .
Co-authored-by: Harjoth Khara <48686985+harjothkhara@users.noreply.github.com >
Co-authored-by: Wynne668 <290981215+ZengWen-DT@users.noreply.github.com >
2026-07-27 04:39:42 -04:00
Peter Steinberger
2242b968b3
fix(tui): prevent duplicate session rollover after stale terminal redraw ( #114373 )
...
* test(tui): make real session rollover deterministic
* test(tui): satisfy typed deferred lint
2026-07-27 02:40:43 -04:00
Erick Kinnee
0b1ef9017b
fix(sessions): gateway becomes unusable when there are many sessions ( #113959 )
...
* fix(sessions): add SQLite session entry cache with current-schema support
Rebase PR #113959 cache changes onto current origin/main:
- Replace listSqliteSessionEntries with cached version using
session_nodes table (was session_entries)
- Add connection-identity token for data_version cross-connection safety
- Add light listing variant with LIMIT/OFFSET pagination
- Add file-stat + data_version coherence guards
- Add cache invalidation on all mutation paths
- Add SessionEntryListScope type with light/limit/offset fields
- Restore store-cache.ts (deleted upstream, re-added with cache layer)
* perf(sessions): project lightweight gateway lists
Replace the request-time session cache and freshness probes with an explicit SQL-side list projection. Keep full entry reads as the default, preserve the post-await sharing authorization refresh, and carry the projection through Gateway, TUI, and embedded-tool list paths.
Co-authored-by: Erick Kinnee <1707617+ekinnee@users.noreply.github.com >
Co-authored-by: gucasbrg <buruguo2000@163.com >
* test(tui): expect lightweight session projection
---------
Co-authored-by: Erick Kinnee <ekinnee@gmail.com >
Co-authored-by: Peter Steinberger <steipete@gmail.com >
Co-authored-by: gucasbrg <buruguo2000@163.com >
2026-07-27 01:58:14 -04:00
Jesse Merhi
d7627d6f4c
refactor(prompt): use plain inbound context labels and drop system-tag sanitizer ( #112000 )
...
* refactor(prompt): plain inbound context labels with a provenance marker
Replaces trust-worded inbound context labels ("(untrusted metadata)",
"(untrusted, for context)") with plain labels plus a fixed provenance
marker suffix appended to every OpenClaw-injected context header.
Detection keys on the marker, not label text, so strippers stay correct
across UI, TUI, replay, /trace segmentation, memory recall, and the Swift
chat preprocessor. Drops sanitizeInboundSystemTags in favor of the marker
boundary plus trusted system-prompt narration.
Renames the untrusted-named plugin SDK context identifiers to
channel-provenance names, keeping deprecated aliases registered for
removal after 2026-09-08.
Adds `openclaw doctor --fix` migrations that rewrite legacy inbound
labels in stored SQLite transcripts and purge legacy envelope-
contaminated LanceDB recall rows.
* fix(ci): resolve gate failures for plain inbound context labels
- doctor sqlite readers: open read-only connections via openNodeSqliteDatabase
so the Kysely connection-boundary guardrail holds; unexport the now-internal
transcript snapshot type (Knip unused-export gate).
- compat registry: split the record table into registry-records.ts and
plugin-sdk-subpath-records.ts. The new compat record pushed registry.ts past
the 700-line oxlint cap; suppressions are disallowed, so follow the existing
sibling record-module pattern. Public exports and PluginCompatCode literals
unchanged.
- acp-runtime test: assert current finalization behavior (newline normalization
only). The bracket de-fang and System: rewrite it expected were removed with
sanitizeInboundSystemTags; forged system lines are neutralized at the
system-event queue, the single chokepoint feeding the System:-per-line render.
- regenerate docs_map and the plugin SDK API baseline manifest.
* fix(prompt): harden inbound context label migration and drop in-band sanitizer
Review follow-ups on the plain-label + provenance-marker change:
- Remove src/security/system-tags.ts. Rewriting inbound text to neutralize
look-alike `System:`/`[System]` markers corrupted legitimate user text and is
not a real injection boundary; role separation plus external-content wrapping
is. Explicit product decision, recorded at the system-event queue.
- Narrow the LanceDB legacy-row purge so it cannot delete benign memories. It
now requires a complete known legacy sentinel line, a legacy label followed by
a fenced JSON body, or the complete legacy external-content header. The prior
predicates matched ordinary prose such as `Notes (untrusted metadata):`, and
deletion is irreversible.
- Make explicit-empty canonical ChannelStructuredContext win over the deprecated
alias via a present/absent result instead of collapsing `[]` to undefined.
- Keep `\r?` in the active-memory doctor rule. It is the only rule spanning the
header's line break, migrated assistant rows skip newline normalization, and
without it the marked-header replace wins and the body strips to empty. Added
a CRLF regression test.
- Fix stale comments that described removed behavior, and cover the Swift
prose-block strip path.
Claude-Session: https://claude.ai/code/session_01WNzsPddQmxy9Y7jKD4wAxH
2026-07-27 11:27:53 +10:00
Peter Steinberger
c31d15bd0f
test(tui): show terminal output when a PTY fixture RPC wait times out ( #114045 )
2026-07-26 01:50:48 -04:00
Peter Steinberger
d515ad571c
fix(tui): restore Ctrl+D forward delete ( #113872 )
...
* fix(tui): restore Ctrl+D forward delete
* test(tui): wait for session response before reset
2026-07-25 16:13:39 -07:00
Peter Steinberger
f2d2cc34bb
fix(tui): preserve active conversations during session reset ( #113841 )
2026-07-25 13:23:57 -07:00
Peter Steinberger
8ae37fd4b2
fix(tui): wait for terminal reply before switching sessions ( #113818 )
...
Co-authored-by: Peter Steinberger <steipete@golden-gate.local >
2026-07-25 12:36:28 -07:00
Peter Steinberger
31190d6469
fix(tui): preserve case-sensitive Matrix and Signal conversations ( #113800 )
...
* test(tui): reproduce opaque provider session identity loss
* fix(tui): preserve case-sensitive provider session identities
* test(tui): cover cross-agent opaque session identities
---------
Co-authored-by: Peter Steinberger <steipete@golden-gate.local >
2026-07-25 12:10:43 -07:00
Peter Steinberger
6f1950ec1a
fix(tui): expose supported verbose and reasoning levels ( #113782 )
...
Co-authored-by: Peter Steinberger <steipete@golden-gate.local >
2026-07-25 10:52:53 -07:00
Peter Steinberger
d33683a9d8
fix(tui): request approved operator scopes for terminal sessions ( #113644 )
...
Co-authored-by: Peter Steinberger <steipete@golden-gate.local >
2026-07-25 05:23:32 -07:00
Peter Steinberger
82d1a03f25
refactor(agents): move implicit-main fallback into load-time roster injection ( #112678 )
...
* refactor(agents): require explicit roster defaults
* feat(onboard): create named first roster agent
* refactor(agents): remove runtime main fallbacks
* style(agents): apply roster refactor formatting
* refactor(agents): finish roster-only runtime sweep
* fix(doctor): migrate legacy main session sqlite
* fix(doctor): harden roster session migrations
* fix(onboard): commit first agent atomically
* fix(config): support empty-roster analysis
* fix(agents): preserve legacy main state during creation
* fix(setup): materialize baseline agent roster
* fix(agents): harden legacy default transfer recovery
* fix(agents): simplify roster-only legacy compatibility
* fix(agents): preserve staged first-agent entries
* fix(config): migrate persisted implicit-main rosters
* fix(config): preserve staged empty rosters
* fix(agents): finalize roster-only upgrade paths
* fix(sessions): close legacy main migration outcomes
* fix(config): migrate legacy roster markers at load
* fix(sessions): preserve roster upgrade history
* refactor(sessions): restore lean legacy main compatibility
* fix(setup): prepare first-agent credentials before publish
* fix(config): stabilize roster snapshot migration
* refactor(sessions): shrink legacy main compatibility
* fix(agents): restore roster compatibility fidelity
* fix(sessions): preserve divergent legacy history
* refactor(agents): narrow roster-only scope
* fix(config): isolate roster migration
* test(agents): align roster-only fixtures
* fix(agents): keep main agent undeletable
* fix(agents): harden roster migration invariants
* fix(agents): close setup and audit scope gaps
* fix(cron): scope session reaper throttles by agent
* fix(agents): preserve scoped owner precedence
* fix(config): preserve authored config ownership
* fix(setup): keep default workspace and roster in sync
* fix(setup): preserve default entry workspace on bare runs
* fix(agents): adapt roster rebase to keyed entries
* fix(agents): honor both roster representations
* fix(agents): route roster reads through shared helpers
* fix(config): preserve canonical roster writes
* fix(cron): resolve dynamic default for session reaper
* fix(agents): close dynamic default migration gaps
* fix(agents): align scoped session ownership
* fix(sessions): preserve legacy main directory casing
* fix(agents): align cron and legacy auth ownership
* fix(setup): provision the committed default workspace
* fix(cron): align scoped ownership and reaping
* fix(cron): treat blank agent ids as absent
* fix(cron): retain configured session-store owners
* fix(agents): repair roster-aware CI boundaries
* fix(cron): preserve scoped ownership resolution
* fix(agents): preserve rosterless maintenance paths
* fix(agents): propagate roster ownership through runtime boundaries
* fix(agents): preserve roster ownership across runtime paths
* fix(agents): harden roster diagnostics and legacy routing
* fix(agents): remove redundant diagnostic import
* test(agents): type CLI policy fixture explicitly
* fix(config): preserve canonical roster mutation identity
* fix(doctor): read canonical agent rosters consistently
* fix(config): resolve compound roster unsets safely
* fix(config): finalize main-session reconciliation
* fix(doctor): read canonical session state safely
* fix(sessions): preserve current visibility alias
* fix(config): track roster include provenance
* test(config): type roster provenance cases
* fix(config): refine roster include ownership
* fix(agents): preserve staged roster invariants
* test(config): align fixtures with explicit roster ownership
* test(node-host): preserve optional plan typing
* fix(config): preserve authored roster projections
* test(config): keep raw roster fixtures explicit
* test(config): normalize rosters at runtime fixtures
* fix(config): protect authored roster ownership
* fix(agents): require explicit session ownership
* fix(agents): enforce scoped roster ownership
* fix(sessions): merge fixed-store agent partitions
* fix(agents): harden roster ownership boundaries
* fix(config): reject ambiguous roster projections
* fix(sessions): preserve persisted store ownership
* fix(sessions): keep collision diagnostics additive
* fix(security): scan malformed roster workspaces
* test(config): align snapshot fixtures after rebase
* test(agents): use explicit roster fixtures
* fix(config): harden roster diagnostic boundaries
* fix(sessions): isolate fixed-store agent databases
* test(agents): type malformed default markers
* refactor(sessions): extract store collision resolution
* test(system-agent): split oversized setup coverage
* style(system-agent): format split setup suite
* fix(sessions): preserve promoted store ownership
* fix(sessions): derive scoped owner before target
* fix(sessions): preserve explicit sqlite ownership
* fix(agents): restore roster compatibility across CI
* fix(agents): enforce roster-owned runtime boundaries
* fix(agents): satisfy default lookup lint
* test(sessions): split known-owner coverage
* fix(state): satisfy path identity lint
* fix(agents): preserve malformed roster safety boundaries
* fix(agents): restore roster compatibility at runtime boundaries
* fix(config): satisfy roster boundary type checks
* fix(agents): preserve roster ownership across runtime probes
Setup inference probes now execute as the configured roster owner. Malformed agent-prefixed session rows are intentionally omitted by the fail-closed visibility contract rather than normalized by tests.
* fix(agents): satisfy session list owner lint
* fix(agents): preserve roster-owned runtime boundaries
Restore shared logical rows for exact SQLite session locators while keeping their physical database owner separate. The ownership regression test now constructs an explicit sole-owner database directly instead of relying on first-touch capture, matching the intentional shared-store contract.
* fix(sessions): preserve multiply owned exact stores
* fix(sessions): restore runtime owner boundaries
Keep incognito sentinels agent-owned, fold default-agent approvals into the global snapshot, and preserve the configless legacy-main CLI policy fallback. Also repair the existing CLI watchdog test lifecycle so the compact shard observes its timeout without an unawaited assertion or async timer stall; product behavior is unchanged by that test-only fix.
* test(ci): align owner-scoped fixtures
These assertions are unchanged. The fixtures now declare the intended non-default runner, expose the session-key constant imported by production status code, and select the main approvals bucket explicitly on Windows.
* fix(agents): close final roster ownership gaps
2026-07-24 22:38:09 -07:00
Peter Steinberger
09672312c4
feat(gateway): incognito sessions for the web Control UI ( #113006 )
...
* feat(gateway): add web-only incognito sessions held in process memory
* feat(ui): add incognito toggle and badges to the web new-session flow
* fix(sessions): classify incognito by key shape, fail closed on stale keys, and gate memory writes
* fix(codex): start harness threads ephemeral for incognito sessions
* fix(sessions): reshape internal-effects incognito keys and add doctor repair for reserved key collisions
* refactor(plugin-sdk): export canonical incognito key classifier and guard the sentinel path
* fix(state): classify incognito DB handles from the recorded open-time set
* fix(gateway): isolate incognito sessions from durable lineage and allocation on read-only misses
* docs(sessions): pin the reserved incognito namespace ownership decision
* feat(gateway): admin-scope incognito visibility and incognito-blind cross-session surfaces
* fix(ci): repair kysely guardrails, dead export, docs map, protocol bindings, and ACP reset rotation
* fix(gateway): remove non-admin observability side channels for incognito sessions
* fix(gateway): enforce admin-scope incognito access and cover all parent-reference creation paths
2026-07-23 09:04:36 -07:00
Peter Steinberger
099d6351b3
refactor(sessions): canonical lineage model — creation provenance, fork ancestry, generation chain, typed row contract ( #111861 )
...
* fix(sessions): preserve spawn/fork lineage across implicit daily/idle rollover
* refactor(sessions): canonical creation model with forkSource ancestry and generation chain
* feat(sessions): stamp creation provenance across all creation paths and emit created events
* refactor(gateway): lock lineage patching, split control from navigation, add typed session-row contract
* docs(gateway): document creation provenance stamping and lineage patch tightening
* fix(sessions): keep provenance proof-only on wire fallbacks and strip node-local lineage from cron continuations
* fix(gateway): never journal a created event for session adoption
* fix(gateway): keep post-create work on adoption while gating the created event
* fix(sessions): restore trusted ensure-main provenance and stamp navigation parent at spawn
* fix(sessions): allow parentSessionKey through the direct child spawn patch
* fix(ci): break type cycles, satisfy export scan, regenerate Swift protocol models
* refactor(sessions): replace createdBy with createdActor
* fix(protocol): export session row type
* fix(sessions): preserve proven creation provenance
* fix(sessions): close lineage creation gaps
* test(sessions): align atomic spawn lineage coverage
* test(sessions): widen transcript search reconcile wait
* fix(sessions): stamp reset-created rows
* test(sessions): keep reset provenance coverage focused
* fix(sessions): journal chat-created rows
* test(ci): anchor release skill reads to repo
* test(ci): avoid cached module paths
2026-07-22 22:54:31 -04:00
Peter Steinberger
6f29fc88e9
refactor(sessions): migrate pure readers to read-only session accessors ( #112568 )
...
* refactor(sessions): migrate pure readers to read-only session accessors
* test(sessions): teach mocks and declarations the read-only accessors
* test(sessions): align remaining harnesses with read-only accessors
2026-07-22 01:16:35 -07:00
Hiroshi Tanaka
52f412bf17
fix(browser): tab creation steals window focus during agent automation ( #105356 )
...
* fix(browser): tab creation steals window focus during agent automation
Agent-created tabs inherited CDP's foreground default: direct CDP
Target.createTarget omitted the background flag, and the extension
relay's createTab defaulted to active:true, so every agent tab open
activated the new tab (and, on the extension driver, focused the
window), interrupting whatever the human was doing in that browser.
Direct CDP tab creation now requests background:true (agent tab
ownership/selection is target-id based and never depended on
activation), and the extension relay defaults an omitted background
to true while preserving an explicit background:false, matching the
Codex/Claude-in-Chrome model the extension driver mirrors.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
* refactor(browser): keep focus fix LOC-neutral
Preserve background tab creation while keeping the oversized CDP and relay modules within the current LOC ratchet.\n\nCodex-Session: 019f5e93-780a-7350-88f9-1986cdb64914
* fix(browser): honor explicit CDP focus requests
Keep background-by-default automation while treating Target.createTarget focus=true as an explicit foreground request in the extension relay.
Codex-Session: 019f5e93-780a-7350-88f9-1986cdb64914
* fix(browser): preserve explicit CDP focus semantics
Apply the background-by-default automation policy only when focus is omitted, preserving focus=false foreground-tab requests as well as focus=true.
Codex-Session: 019f5e93-780a-7350-88f9-1986cdb64914
* fix(browser): preserve create target window focus
Carry the resolved CDP focus intent through the extension relay and explicitly focus the containing Chrome window when requested.\n\nCodex-Session: 019f5e93-780a-7350-88f9-1986cdb64914
* style(browser): refresh relay import order
* test(secrets): use secure node exec fixtures
* test(doctor): secure exec secret fixture
* test(doctor): retain narrowed temp path
* test(secrets): secure remaining exec fixtures
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com >
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-21 21:35:40 -07:00
Peter Steinberger
edecdbd05e
refactor(config): config-surface reduction tranche 3 — product consolidations (review request) ( #111527 )
...
* refactor(config): consolidate media model lists
* refactor(config): unify memory configuration
* refactor(config): consolidate TTS ownership
* refactor(config): move typing policy to agents
* refactor(config): retire product-level config surfaces
* refactor(config): share scoped tool policy type
* chore(config): refresh generated baselines
* fix(config): honor agent typing overrides
* fix(config): migrate sibling config consumers
* refactor(infra): keep base64url decoder private
* fix(config): strip invalid legacy TTS values
* chore(config): refresh rebased baseline hash
* fix(doctor): route legacy messages.tts.realtime voice to talk during tts move
* refactor(config): polish final layout names
* refactor(config): freeze retired tuning defaults
* feat(config): add fast mode default symmetry
* refactor(config): key agent entries by id
* docs(config): update final layout reference
* test(config): cover final layout migrations
* chore(config): refresh final layout baselines
* fix(config): align final layout runtime readers
* fix(config): align remaining readers
* fix(config): stabilize final layout migrations
* fix(config): finalize config projection proof
* fix(config): address final layout review
* docs(release): preserve historical config names
* fix(config): complete keyed agent migration
* fix(config): close final migration gaps
* fix(config): finish full-branch review
* fix(config): complete runtime secret detection
* fix(config): close final review findings
* fix(config): finish canonical docs and heartbeat migration
* fix(config): integrate latest main after rebase
* refactor(env): isolate test-only controls
* refactor(env): isolate build and development controls
* refactor(env): collapse process identity indirection
* refactor(env): remove duplicate config and temp aliases
* docs(env): define the operator-facing allowlist
* ci(env): ratchet production variable count
* fix(env): remove stale provider helper import
* fix(env): make ratchet sorting explicit
* test(env): keep test seam in dead-code audit
* test(env): cover ratchet growth and boundary; document surface budgets
* docs(config): document tier-eval consolidations
* docs(config): clarify speech preference ownership
* test(memory): align retired tuning fixtures
* refactor(memory): freeze engine heuristics
* refactor(config): apply tier-eval tranche
* refactor(tts): move persona shaping to providers
* refactor(compaction): move prompt policy to providers
* test(config): align hookified prompt fixtures
* chore(deadcode): classify test-only exports
* chore(github): remove unused spawn helper
* chore(deadcode): classify queue diagnostics
* chore(deadcode): remove unused lane snapshot export
* chore(plugin-sdk): ratchet consolidated surface
* fix(config): integrate latest main after rebase
2026-07-21 20:28:43 -07:00
Peter Steinberger
0baf0495ab
fix(cron): honor script limits and permanent failures ( #112415 )
...
* fix(cron): honor script execution contracts
* test(tui): isolate gateway fixture startup
* test(tui): type shared fixture cleanup
2026-07-21 17:41:45 -07:00
Peter Steinberger
72ca080218
fix(tui): show launch thinking override in footer ( #112237 )
2026-07-21 03:06:08 -07:00
Peter Steinberger
4ff2cdd215
fix(sessions): reconcile client-abandoned running sessions on restart ( #111699 )
2026-07-20 19:39:41 -07:00
wahaha1223
80c16ecc80
fix(tui): prevent memory growth during repeated selector searches ( #109451 )
...
* fix(tui): bound searchable select regex cache
* fix(tui): discard stale selector regexes
Co-authored-by: wahaha1223 <0668001153@xydigit.com >
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-20 19:06:58 -07:00
Peter Steinberger
49ff6a4497
fix(protocol): classify system agents in rosters ( #111920 )
...
* fix(protocol): classify system agents in rosters
* fix(ci): align agent kind client gates
* fix(ci): keep roster filtering in startup bundle
* chore(ui): remove superseded roster module
* style(android): satisfy agent kind test formatting
* style(linux): format merged agent capability assertion
* fix(config): reject reserved system agent ids
* chore(i18n): refresh native source inventory
* style(android): format agent kind surfaces
* fix(gateway): preserve configured agent ownership
2026-07-20 16:57:04 -07:00
Peter Steinberger
783a5d21cf
refactor(config): purge numeric tuning knobs behind built-in defaults ( #111382 )
2026-07-19 07:35:45 -07:00
