Peter Steinberger
568ea29d2e
refactor(plugins): inherit shared package boundary settings ( #117474 )
2026-08-01 09:11:09 -07:00
Wynne668
522c747d3c
fix(exa): reject invalid UTF-8 search responses ( #111736 )
2026-07-29 05:58:02 -04:00
Peter Steinberger
f6131a4fbf
build(deps): remove npm shrinkwrap; mirror pnpm lock into transient package locks ( #114006 )
...
* build(deps): remove npm shrinkwrap; mirror pnpm lock into transient package locks
npm 12 removed shrinkwrap (command + tarball/root loading). Delete all 82
committed npm-shrinkwrap.json files and stop publishing lockfiles; keep
pnpm-lock.yaml as the single reviewed dependency boundary. The generator
becomes scripts/generate-npm-package-lock.mjs and feeds plugin bundling via
a transient package-lock.json + npm ci (works on npm 11 and 12). Tarball
validation treats the published 2026.7.2 beta train as a shrinkwrap
transition; self-update npm detection now uses install topology instead of
the shipped shrinkwrap.
* fix(deps): repair lint, deadcode, and test-type lanes for the npm 12 migration
- sort integrity comparisons with an explicit comparator (oxlint)
- keep resolveBunGlobalNodeModules module-local (knip unused-export gate)
- model npm pack --json as npm<=11 array / npm 12 name-keyed object
- default calver destructuring in the tarball test fixture
2026-07-26 01:29:55 -04:00
Peter Steinberger
edecdbd05e
refactor(config): config-surface reduction tranche 3 — product consolidations (review request) ( #111527 )
...
* refactor(config): consolidate media model lists
* refactor(config): unify memory configuration
* refactor(config): consolidate TTS ownership
* refactor(config): move typing policy to agents
* refactor(config): retire product-level config surfaces
* refactor(config): share scoped tool policy type
* chore(config): refresh generated baselines
* fix(config): honor agent typing overrides
* fix(config): migrate sibling config consumers
* refactor(infra): keep base64url decoder private
* fix(config): strip invalid legacy TTS values
* chore(config): refresh rebased baseline hash
* fix(doctor): route legacy messages.tts.realtime voice to talk during tts move
* refactor(config): polish final layout names
* refactor(config): freeze retired tuning defaults
* feat(config): add fast mode default symmetry
* refactor(config): key agent entries by id
* docs(config): update final layout reference
* test(config): cover final layout migrations
* chore(config): refresh final layout baselines
* fix(config): align final layout runtime readers
* fix(config): align remaining readers
* fix(config): stabilize final layout migrations
* fix(config): finalize config projection proof
* fix(config): address final layout review
* docs(release): preserve historical config names
* fix(config): complete keyed agent migration
* fix(config): close final migration gaps
* fix(config): finish full-branch review
* fix(config): complete runtime secret detection
* fix(config): close final review findings
* fix(config): finish canonical docs and heartbeat migration
* fix(config): integrate latest main after rebase
* refactor(env): isolate test-only controls
* refactor(env): isolate build and development controls
* refactor(env): collapse process identity indirection
* refactor(env): remove duplicate config and temp aliases
* docs(env): define the operator-facing allowlist
* ci(env): ratchet production variable count
* fix(env): remove stale provider helper import
* fix(env): make ratchet sorting explicit
* test(env): keep test seam in dead-code audit
* test(env): cover ratchet growth and boundary; document surface budgets
* docs(config): document tier-eval consolidations
* docs(config): clarify speech preference ownership
* test(memory): align retired tuning fixtures
* refactor(memory): freeze engine heuristics
* refactor(config): apply tier-eval tranche
* refactor(tts): move persona shaping to providers
* refactor(compaction): move prompt policy to providers
* test(config): align hookified prompt fixtures
* chore(deadcode): classify test-only exports
* chore(github): remove unused spawn helper
* chore(deadcode): classify queue diagnostics
* chore(deadcode): remove unused lane snapshot export
* chore(plugin-sdk): ratchet consolidated surface
* fix(config): integrate latest main after rebase
2026-07-21 20:28:43 -07:00
Peter Steinberger
c7e7ac2728
refactor: remove expired plugin compatibility surfaces ( #111451 )
...
* docs(secrets): remove retired web credential paths
* refactor(web): remove retired provider compatibility paths
* refactor(providers): delete retired compatibility routes
* refactor(secrets): remove retired credential aliases
* refactor(plugin-sdk): delete retired compatibility surfaces
* docs(plugin-sdk): remove retired migration guidance
* chore(plugin-sdk): refresh rebased surface budgets
* chore(plugin-sdk): refresh API removal baseline
* refactor(compat): migrate retired internal callers
* chore(plugin-sdk): refresh current-main baselines
* test(config): migrate plugin-owned secret assertions
* test(gateway): narrow plugin secret refs
* fix(plugin-sdk): preserve private boundary type identity
* chore(compat): remove stale sweep references
* chore(lint): lower max-lines budget
* refactor(secrets): remove unused web helper
* build(plugin-sdk): drop removed compat entries
* chore(plugin-sdk): refresh rebased API baseline
* chore(plugin-sdk): use Linux API baseline hash
* fix(plugin-sdk): preserve private bundled build entries
* fix(plugin-sdk): package private runtime facades
* fix(plugins): preserve external credential contracts
2026-07-19 11:04:48 -07:00
Peter Steinberger
7bf80dc2c6
chore(tooling): enforce formatting and refresh TypeScript checks ( #104239 )
...
* chore(tooling): enforce current formatter and refresh checks
* chore(tooling): keep release changelog formatter-owned
* chore(tooling): retain compatible Node type surface
* ci: enforce formatting for docs-only changes
* ci: isolate docs formatter check
* chore(tooling): apply updated lint and format rules
* chore(tooling): satisfy updated switch lint
* style(ui): apply Linux formatter layout
* test(doctor): match quiet local audio contribution
* test(doctor): assert quiet output only
* test(doctor): follow restored information contract
2026-07-11 01:09:51 -07:00
Peter Steinberger
dba64d574f
chore(release): set version to 2026.7.2
2026-07-11 04:00:49 +01:00
soldforaloss
200e1df007
fix(exa): cache disabled content options separately ( #103653 )
...
* fix(exa): partition cache by disabled content options
* fix(exa): align cache keys with effective contents
---------
Co-authored-by: Vincent Koc <vincentkoc@ieee.org >
2026-07-11 10:25:22 +08:00
Dallin Romney
8c5f45fc36
refactor(shared): consolidate provider and utility lazy loaders ( #98749 )
...
* refactor(shared): consolidate provider lazy loaders
* refactor(shared): leave enforcement to follow-up
2026-07-02 21:16:26 -07:00
Vincent Koc
66e676d29b
chore(release): close out 2026.6.11 on main
2026-06-30 11:31:08 -07:00
Alix-007
605aede38c
fix(exa): bound untrusted search JSON response reads ( #96038 )
...
Exa search success responses were read via an unbounded `await
response.json()`, so a misbehaving or hostile endpoint could stream an
arbitrarily large body into memory before parsing. Read the success
body through the shared bounded reader (16 MiB cap, the same limit other
bundled providers use) and cancel the stream on overflow. This mirrors
the error-body bound already in place and the #95103/#95108 response
-limit campaign on the success-JSON side.
AI-assisted.
2026-06-24 10:57:37 -04:00
Vincent Koc
0671c08900
chore(release): close out 2026.6.10 on main ( #96271 )
...
* chore(release): close out 2026.6.10 on main
* chore(release): align native app metadata for 2026.6.10
* chore(release): sync Android 2026.6.10 notes
* docs(changelog): preserve 2026.6.9 history
* docs(changelog): preserve 2026.6.9 history
2026-06-24 11:51:14 +08:00
Vincent Koc
b039e949b6
chore(release): close out 2026.6.9
2026-06-21 12:24:15 +08:00
Vincent Koc
1e53ee4fd5
fix(exa): bound search error bodies
2026-06-19 19:18:38 +02:00
Vincent Koc
21728777df
feat(plugins): externalize official provider batch
2026-06-19 01:05:52 +08:00
Vincent Koc
6774e7f259
chore(release): sync main to 2026.6.8
2026-06-17 07:25:30 +08:00
Shakker
920e6a8eec
chore: set version 2026.6.9
2026-06-16 19:54:07 +01:00
Peter Steinberger
4fa5092cdc
docs: document small extension sources
2026-06-04 21:02:07 -04:00
Peter Steinberger
1878ca0820
chore(release): prepare 2026.6.2 beta
2026-06-04 00:06:52 +01:00
Peter Steinberger
e254346bc2
chore(release): prepare 2026.6.3 beta
2026-06-03 23:42:34 +01:00
Peter Steinberger
a14eacf372
chore(release): set version 2026.6.2
2026-06-01 23:06:55 +01:00
Peter Steinberger
8e28c773fe
chore(release): prepare 2026.6.1
2026-06-01 10:30:15 +01:00
Peter Steinberger
0d17623f00
chore: bump OpenClaw version to 2026.5.31
...
Bumps OpenClaw release metadata to 2026.5.31 across package manifests, app version files, plugin metadata, changelog headings, and generated shrinkwraps.
Verification:
- pnpm plugins:sync:check
- pnpm ios:version:check
- pnpm deps:shrinkwrap:check
- git diff --check
- stale 2026.5.30/build-code scan across changed files
- autoreview clean: no accepted/actionable findings
- PR CI green for real gates: Checks, security scans, dependency guard, app lanes, real behavior proof
Known non-code workflow issue:
- label workflow failed because this PR hits GitHub's 100-label issue cap before the size-label step.
2026-05-31 14:46:17 +01:00
Peter Steinberger
cd07d013ba
chore(release): bump version to 2026.5.30
2026-05-30 06:49:13 +01:00
Peter Steinberger
d095d1663b
fix(exa): reject non-decimal search counts
2026-05-29 06:49:23 -04:00
Peter Steinberger
59d4327698
fix: validate web search count integers
2026-05-28 18:38:39 -04:00
Peter Steinberger
cee2a50fe6
chore(release): prepare 2026.5.28
2026-05-28 01:48:07 +01:00
Peter Steinberger
bb46b79d3c
refactor: internalize OpenClaw agent runtime ( #85341 )
...
* refactor: extract agent core package
Introduce packages/agent-core as the OpenClaw-owned home for reusable agent loop, harness, session, prompt, and runtime dependency contracts.
* refactor: extract shared llm runtime
Move provider model registries, stream wrappers, OAuth helpers, and LLM utilities into src/llm with plugin-sdk barrels instead of depending on the old embedded runtime layout.
* refactor: remove pi runtime internals
Rename remaining Pi-shaped agent surfaces to OpenClaw agent runtime names, delete obsolete Pi docs and package graph checks, and add the third-party notice for incorporated code.
* refactor: tighten agent session runtime
Make agent-core/runtime dependencies explicit, consolidate compaction and session transcript helpers, and move model/session helpers behind OpenClaw-owned contracts.
* refactor: remove static model and pi auth paths
Drop static model catalogs and Pi auth bridges, move model/provider facts to manifest-owned runtime contracts, and harden internal embedded-agent utilities.
* refactor: remove legacy provider compat paths
* docs: remove agent parity notes
* fix: skip provider wildcard metadata parsing
* refactor: share session extension sdk loading
* refactor: inline acpx proxy error formatter
* refactor: fold edit recovery into edit tool
* fix: accept extension batch separator
* test: align startup provider plugin expectations
* fix: restore provider-scoped release discovery
* test: align static asset packaging expectations
* fix: run static provider catalogs during scoped discovery
* fix: add provider entry catalogs for scoped live discovery
* fix: load lightweight provider catalog entries
* fix: refresh provider-scoped plugin metadata
* fix: keep provider catalog entries on release live path
* fix: keep static manifest models in release live checks
* fix: harden release model discovery
* fix: reduce OpenAI live cache probe reasoning
* fix: disable OpenAI cache probe reasoning
* ci: extend OpenAI gateway live timeout
* fix: extend live gateway model budget
* fix: stabilize release validation regressions
* fix: honor provider aliases in model rows
* fix: stabilize release validation lanes
* fix: stabilize release memory qa
* ci: stabilize release validation lanes
* ci: prefer ipv4 for live docker node calls
* fix: restore shared tool-call stream wrapper
* ci: remove legacy pi test shard alias
* fix: clean up embedded agent test drift
* fix: stabilize runtime alias status
* fix: clean up embedded agent ci drift
* fix: restore release ci invariants
* fix: clean up post-rebase runtime drift
* fix: restore release ci checks
* fix: restore release ci after rebase
* fix: remove stale pi runtime path
* test: align compaction runtime expectations
* test: update plugin prerelease expectations
* fix: handle claude live tool approvals
* fix: stabilize release validation gates
* fix: finish agent runtime import
* test: finish post-rebase agent runtime mocks
* fix: keep codex compaction native
* fix: stabilize codex app-server hook tests
* test: isolate codex diagnostic active run
* test: remove codex diagnostic completion race
# Conflicts:
# extensions/codex/src/app-server/run-attempt.test.ts
* ci: fix full release manifest performance run id
* refactor: narrow llm plugin sdk boundary
* chore: drop generated google boundary stamps
* fix: repair rebase fallout
* fix: clean up rebased runtime references
* fix: decode codex jwt payloads as base64url
* fix: preserve shipped pi runtime alias
* fix: add scoped sdk virtual modules
* fix: decode llm codex oauth jwt as base64url
* fix: avoid stale vertex adc negative cache
* fix: harden tool arg decoding and codeql path
* fix: keep vertex adc negative checks live
* refactor: consolidate codex jwt and edit helpers
* fix: await codex oauth node runtime imports
* fix: preserve sdk tool and notice contracts
* fix: preserve shipped compat config boundaries
* fix: align codex oauth callback host
* fix: terminate agent-core loop streams on failure
* fix: keep codex oauth callback alive during fallback
* ci: include session tools in critical codeql scans
* fix: keep Cloudflare Anthropic provider auth header
* docs: redirect legacy pi runtime pages
* fix: honor bundled web provider compat discovery
* fix: protect session output spill files
* fix: keep legacy agent dir env blocked
* fix: contain auto-discovered skill symlinks
* fix: harden agent core sdk proxy surfaces
* fix: restore approval reaction sdk compat
* fix: keep live docker runs bounded
* fix: keep codex oauth redirect host aligned
* fix: resolve post-rebase agent runtime drift
* fix: redact anthropic oauth parse failures
* fix: preserve responses strict tool shaping
* fix: repair agent runtime rebase cleanup
* docs: redirect retired parity pages
* fix: bound auto-discovered resources to roots
* fix: repair post-rebase agent test drift
* fix: preserve bundled provider allowlist migration
* fix: preserve manifest-owned provider aliases
* fix: declare photon image dependency
* fix: keep provider headers out of proxy body
* fix: preserve shipped env aliases
* fix: refresh control ui i18n generated state
* fix: quote read fallback paths
* fix: preview edits through configured backend
* test: satisfy core test typecheck
* fix: preserve ZAI usage auth fallback
* test: repair codex diagnostic test
* fix: repair agent runtime rebase drift
* test: finish embedded runner import rename
* fix: repair agent runtime rebase integrations
* test: align compaction oauth fallback expectations
* fix: allow sdk-auth session models
* fix: update doctor tool schema import
* fix: preserve bedrock plugin region
* fix: stream harmony-like prose immediately
* ci: include session runtime in codeql shards
* fix: repair latest rebase integrations
* fix: honor explicit codex websocket transport
* fix: keep openai-compatible credentials provider-scoped
* fix: refresh sdk api baseline after rebase
* fix: route cli runtime aliases through openclaw harness
* test: rename stale harness mock expectation
* test: rename embedded agent overflow calls
* test: clean embedded auth test wording
* test: use openclaw stream types in deepinfra cache test
* fix: refresh sdk api baseline on latest main
* fix: honor bundled discovery compat allowlists
* fix: refresh sdk api baseline after latest rebase
* fix: remove stale rebase imports
* test: rename stale model catalog mock
* test: mock renamed doctor runtime modules
* fix: map canonical kimi env auth
* fix: use internal model registry in bench script
* fix: migrate deepinfra provider catalog entry
* fix: enforce builtin tool suppression
* fix: route compaction auth and proxy payloads safely
* refactor: prune unused llm registry leftovers
* test: update codex hooks session import
* test: fix model picker ci coverage
* test: align model picker auth mock types
2026-05-27 19:24:04 +01:00
Peter Steinberger
7aaca4a8a6
chore(release): prepare 2026.5.27
2026-05-27 16:53:50 +01:00
Peter Steinberger
d00d0a21c2
chore: bump OpenClaw to 2026.5.26
2026-05-26 01:26:00 +01:00
Peter Steinberger
0cba872e38
chore: bump version to 2026.5.24
2026-05-24 02:40:16 +01:00
Peter Steinberger
4df34cb790
chore(release): bump version to 2026.5.22
2026-05-22 21:25:16 +01:00
Peter Steinberger
e2c92be90b
chore(release): bump version to 2026.5.21
2026-05-22 00:09:45 +01:00
Peter Steinberger
7b9066120a
chore(release): bump version to 2026.5.20
2026-05-20 21:58:56 +01:00
Peter Steinberger
c1579b7727
chore: bump release version to 2026.5.19
2026-05-18 23:11:42 +01:00
Peter Steinberger
4f4d108639
chore(lint): remove underscore-dangle allow list ( #83542 )
...
* chore(lint): reduce underscore-dangle exceptions
* chore(lint): reduce more underscore exceptions
* chore(lint): remove underscore-dangle allow list
* fix(lint): repair underscore cleanup regressions
* test(lint): track version define suppression
2026-05-18 14:56:06 +01:00
Peter Steinberger
9c5acb7ea3
chore: release 2026.5.17
2026-05-16 10:11:41 +01:00
Vincent Koc
f553dad560
Reapply "chore(release): set 2026.5.16 version"
...
This reverts commit 73aab6abd8
2026-05-16 08:59:33 +08:00
Vincent Koc
73aab6abd8
Revert "chore(release): set 2026.5.16 version"
...
This reverts commit b7e8f6da6a
2026-05-16 08:20:19 +08:00
Peter Steinberger
b7e8f6da6a
chore(release): set 2026.5.16 version
2026-05-15 22:06:19 +01:00
Vincent Koc
31bfe7f084
fix(web-search): wrap malformed provider json
2026-05-15 09:04:20 +08:00
Peter Steinberger
1d8d664570
chore(release): prepare 2026.5.14
2026-05-14 21:38:45 +01:00
Peter Steinberger
c98698aa0e
chore: release 2026.5.12-beta.1
2026-05-12 06:33:41 +01:00
Shakker
748788177b
test: tighten exa provider assertions
2026-05-11 08:18:30 +01:00
Shakker
0aac9e8758
test: clear exa broad matcher
2026-05-10 16:39:14 +01:00
Peter Steinberger
827b0de0ce
refactor: reduce plugin sdk surface
2026-05-10 12:37:10 +01:00
Peter Steinberger
9243b575ed
chore(release): prepare 2026.5.10-beta.1
2026-05-10 06:13:38 +01:00
Peter Steinberger
9385eaaf88
chore(release): prepare 2026.5.8
2026-05-09 08:05:17 +01:00
Peter Steinberger
92c702b97a
test: tighten provider config helper assertions
2026-05-08 20:52:17 +01:00
Shakker
b7bdcaeb88
test: tighten web search provider assertions
2026-05-08 18:58:20 +01:00
