Peter Steinberger
374e8e99e0
fix(agents): make overflow recovery append-only via branch-and-reappend ( #115271 ) ( #115310 )
2026-07-28 14:58:24 -04:00
Peter Steinberger
4273ca9dbd
refactor(sessions): remove file-era transcript runtime ( #113233 )
...
* refactor(sessions): keep helper transcripts in memory
* refactor(sessions): remove file-era transcript storage
* test(sessions): use SQLite identity in attempt persistence
* test(codex): isolate legacy transcript fixtures
* fix(sessions): preserve SQLite transcript identity
* fix(sessions): harden transcript lifecycle invariants
* fix(sessions): validate transcript identities
* fix(sessions): close identity compatibility gaps
* fix(sessions): preserve leaf and plugin identities
* fix(sessions): retain dispatch transcript targets
* fix(sessions): preserve active transcript context
* fix(sessions): isolate artifact accounting
* fix(sessions): bound SQLite usage accounting
* fix(sessions): retain bounded latest usage
* fix(sessions): align rebased transcript targets
* test(sessions): align accessor scope fixture
* fix(telegram): derive SQLite transcript identity
* refactor(sessions): remove file-era compaction residue
* chore(sessions): lower max-lines baseline
* fix(sessions): preserve structured transcript identity
* test(sessions): align doctor identity assertions
* fix(sessions): isolate default SDK database
* refactor(sessions): remove dead file-era exports
* fix(sessions): reconcile SQLite transcript identity
* fix(sessions): pass checkpoint identity explicitly
* test(sessions): make entry field probe explicit
* test(sessions): satisfy transcript cleanup lint
* test(sessions): align diagnostics identity proof
* fix(sessions): finish transcript runtime teardown
* fix(sessions): preserve transcript identity invariants
* fix(sessions): harden transcript compatibility edges
* fix(sessions): preserve checkpoint transcript anchors
* fix(sessions): preserve SQLite lifecycle invariants
* fix(sessions): retarget compaction successors
* test(sessions): preserve transcript fixture semantics
* feat(plugin-sdk): add command transcript targets
* fix(sessions): serialize transcript rewrites
* fix(sessions): validate legacy successor identity
* fix(sessions): normalize compaction ownership
* fix(sessions): validate successor identity before adoption
* fix(sessions): preserve plugin transcript ownership
* fix(sessions): carry transcript identity through commands
* fix(sessions): import legacy checkpoint artifacts into SQLite
* fix(sessions): preserve successor transcript ownership
* fix(sessions): align transcript consumers with target identity
* fix(sessions): scope transcript token estimates
* fix(sessions): retain agent identity across lifecycle hooks
* fix(sessions): resolve scoped SQLite targets
* fix(sessions): isolate lifecycle transcript targets
* fix(sessions): validate compaction agent ownership
* fix(sessions): preserve reset and cleanup lifecycle
* fix(sessions): serialize prompt cleanup lifecycle
* fix(sessions): remove stale lock import
* fix(sessions): preserve reset target context
* fix(sessions): fence prompt reload takeover
* fix(sessions): unblock abort and default lifecycle reads
* fix(sessions): validate legacy successor scope
* fix(sessions): reject metadata-only runtime rows
* fix(sessions): propagate custom transcript stores
* fix(sessions): preserve adopted retry targets
* fix(sessions): allow unkeyed usage reads
* fix(sessions): harden runtime target boundaries
* fix(sessions): serialize retry transcript writes
* fix(sessions): bound prompt reload disposal
* fix(sessions): complete retry marker identity
* fix(sessions): keep legacy marker identity minimal
* test(sessions): tighten teardown fixture types
* fix(sessions): preserve compatibility target identity
* test(sessions): persist post-checkpoint boundary turn
* test(sessions): align runtime store mock contracts
* style(sessions): simplify persisted identity guard
* fix(sessions): prefer complete typed targets
* fix(sessions): recover legacy marker targets
* test(sessions): align marker lookup fixture scope
* fix(sessions): validate partial transcript targets
* fix(sessions): reconcile partial transcript identities
* fix(sessions): canonicalize compatibility identities
* test(sessions): cover compatibility aliases
* fix(sessions): adopt legacy successor identity
* fix(sessions): preserve usage read identity
* fix(sessions): preserve partial marker compatibility
* fix(sessions): validate legacy successor mappings
* fix(sessions): reconcile marker store mappings
* fix(sessions): preserve legacy fallback identity
* fix(sessions): harden marker alias resolution
* fix(sessions): prefer verified successor aliases
* fix(sessions): resolve preferred marker aliases
* fix(sessions): serialize cleanup admission
* fix(sessions): align marker lookup scopes
* fix(codex): type marker alias summaries
* style(sessions): satisfy changed lint
* test(sessions): align structured target assertions
* fix(sessions): reconcile latest identity contracts
* fix(sessions): validate transcript identity boundaries
* docs(sessions): explain stable registry keys
* fix(sessions): harden compatibility target round trips
* fix(sessions): port usage identity to split modules
* test(sessions): align subagent transcript identity
* fix(sessions): finish transcript identity migration
* fix(agents): route subagent completion capture through transcript targets
* fix(agents): settle SQLite prompt handoff during cleanup
* chore: shrink max-lines baseline after teardown
* fix(sessions): port teardown across split runtime owners
* fix(sessions): carry transcript targets through split owners
* test(agents): use SQLite compaction target in abort coverage
* chore: retain unrelated max-lines suppressions
* chore: shrink max-lines baseline after main splits
* style(agents): const compaction checkpoint locals
* fix(sessions): harden SQLite teardown boundaries
* test(sessions): use typed metadata in predicate isolation fixture
* test(agents): cover malformed settlement rejections lint-safely
* fix(sessions): close remaining SQLite identity races
* fix(agents): fail closed on incomplete successor targets
* fix(sessions): preserve transcript identity fallbacks
* fix(agents): preserve session-key abort admission
* fix(trajectory): validate incomplete export targets
* test(sessions): drop retired pricing cache imports
* fix(sessions): validate partial transcript identities
* fix(sessions): close transcript identity edge cases
* fix(plugins): reserve retired transcript locator slot
* fix(sessions): scope transcript locks by target
* style(sessions): simplify SDK initialization error
* fix(sessions): preserve initialized transcript state
* fix(codex): verify mirrored history session keys
* fix(sessions): reject stale transcript ownership
* fix(sessions): anchor asynchronous transcript ownership
* fix(sessions): measure active transcript state
* fix(sessions): preserve scoped transcript compaction
* fix(sessions): harden transcript identity and lifecycle
* fix(sessions): resolve scoped command transcript stores
* fix(sessions): make transcript appends failure-atomic
* fix(sessions): enforce scoped transcript ownership
* fix(sessions): reject cross-owner transcript handoffs
* fix(sessions): fence cleanup transcript ownership
* fix(sessions): retire stale write ownership contexts
* fix(sessions): preserve pending session migration state
* fix(sessions): validate migrated transcript ownership
* fix(sessions): validate usage transcript targets
* fix(sessions): clear predecessor transcript metadata
* fix(sessions): align durable session event targets
* fix(sessions): fence late prompt handoffs
* fix(sessions): fence lifecycle transcript fallbacks
* fix(sessions): bound zero-length memory capture
* fix(sessions): preserve transcript teardown ownership
* fix(sessions): reject duplicate cleanup ownership
* fix(sessions): serialize runtime writes with sqlite leases
* fix(sessions): close sqlite teardown concurrency gaps
* fix(sessions): preserve nested lifecycle failures
* fix(sessions): canonicalize sqlite transcript ownership
* fix(sessions): settle disposed prompt handoffs
* fix(sessions): resolve canonical attempt lock targets
* test(sessions): align canonical target fixtures
* test(sessions): retire redundant jsonl parser coverage
* refactor(sessions): split active transcript cursors
* test(memory): retire legacy marker fixture
* fix(sessions): preserve canonical transcript access after rebase
* fix(sessions): fence prompt lease and return transcript targets
* fix(sessions): colocate transcript leases with target store
* fix(sessions): canonicalize transcript lease and worker targets
* fix(sessions): preserve plugin and fork identity markers
* fix(sessions): complete sqlite transcript target migration
* fix(sessions): integrate canonical followup identity
* fix(sessions): preserve bounded transcript topology
* fix(sessions): validate transcript identity boundaries
* fix(context): separate caller and successor targets
* test(sessions): split persistence compatibility coverage
* test(sessions): preserve fixture topology efficiently
* chore(sdk): refresh plugin api baseline
* test(agents): align compaction lock target mocks
* test(sessions): seed malformed transcript fixtures directly
* fix(agents): canonicalize transcript compatibility inputs
* fix(agents): type optional tool result ids
* test(ci): stabilize loaded process timing
* test(tui): wait for collect queue admission
2026-07-27 22:33:24 -04:00
Peter Steinberger
7ad7cf8b0f
refactor(sessions): unify canonical SQLite lifecycle and transcript projection ( #114369 )
...
* refactor(sessions): unify canonical SQLite lifecycle and transcript projection
* fix(sessions): ratchet eliminated transcript accessor debt
2026-07-27 02:59:08 -04:00
Peter Steinberger
c440ae3e86
refactor(sessions): collapse legacy JSON store ( #113075 )
...
* refactor(sessions): collapse legacy JSON store
* chore(sessions): ratchet legacy importer boundary
* fix(sessions): align cleanup checks
2026-07-23 09:36:48 -07:00
Peter Steinberger
68d6c8ec8f
refactor(sessions): remove gateway legacy JSON fallback ( #112676 )
2026-07-22 06:57:13 -07:00
Peter Steinberger
c7e7ac2728
refactor: remove expired plugin compatibility surfaces ( #111451 )
...
* docs(secrets): remove retired web credential paths
* refactor(web): remove retired provider compatibility paths
* refactor(providers): delete retired compatibility routes
* refactor(secrets): remove retired credential aliases
* refactor(plugin-sdk): delete retired compatibility surfaces
* docs(plugin-sdk): remove retired migration guidance
* chore(plugin-sdk): refresh rebased surface budgets
* chore(plugin-sdk): refresh API removal baseline
* refactor(compat): migrate retired internal callers
* chore(plugin-sdk): refresh current-main baselines
* test(config): migrate plugin-owned secret assertions
* test(gateway): narrow plugin secret refs
* fix(plugin-sdk): preserve private boundary type identity
* chore(compat): remove stale sweep references
* chore(lint): lower max-lines budget
* refactor(secrets): remove unused web helper
* build(plugin-sdk): drop removed compat entries
* chore(plugin-sdk): refresh rebased API baseline
* chore(plugin-sdk): use Linux API baseline hash
* fix(plugin-sdk): preserve private bundled build entries
* fix(plugin-sdk): package private runtime facades
* fix(plugins): preserve external credential contracts
2026-07-19 11:04:48 -07:00
Peter Steinberger
16e967eb7f
fix(gateway): reject unknown session agents ( #111178 )
2026-07-18 21:15:57 -07:00
Peter Steinberger
7181233320
fix(ci): settle deadcode hard-zero sweep debt across guard lanes
...
The repository hard-zero sweep (bae9752c5a#108641 ) left five CI lanes
red on every PR: a stale max-lines baseline entry for the shrunken
live-cache-regression-runner, session-accessor debt baseline above the
real count, two sqlite-reliability contract types un-exported while
scripts/lib still imports them, a deleted-file entry on the production
lint-suppression allowlist, and a stale wildcard-barrel assertion in the
parallels smoke model test.
2026-07-15 23:16:10 -07:00
Peter Steinberger
4e78d91c0f
refactor(sessions): split session accessor by ownership ( #108247 )
2026-07-15 06:47:29 -07:00
Peter Steinberger
aac4c16f84
refactor(doctor): split Codex route diagnostics ( #107955 )
2026-07-14 22:02:56 -07:00
Peter Steinberger
0b9e3e19fa
refactor(sessions): separate SQLite accessor owners ( #107772 )
...
* refactor(sessions): separate SQLite accessor owners
* refactor(sessions): keep SQLite helper types private
2026-07-14 14:23:20 -07:00
Peter Steinberger
d1684f48a3
refactor: delete dead infra and config exports ( #106019 )
...
* refactor: delete dead infra and config exports
* refactor: preserve live infra and config contracts
* refactor(config): remove obsolete file-store lifecycle APIs
* refactor(infra): finish current-main dead export cleanup
2026-07-13 12:00:47 -07:00
Peter Steinberger
8aab4ff94d
refactor(state): split migration modules ( #106356 )
...
* refactor(state): split migration modules
* fix(state): relocate migration guard baselines
2026-07-13 05:13:42 -07:00
Peter Steinberger
dce8eed0b9
ci(deadcode): restore enforced unused-export ratchet ( #105826 )
...
* ci(deadcode): restore export ratchet
* chore(deadcode): refresh export baseline
* refactor(sessions): remove obsolete patch writer
* refactor(deadcode): classify current export residue
* fix(deadcode): preserve exported signature types
* chore(deadcode): sync export baseline after rebase
* chore(deadcode): classify pairing test exports
* fix(ci): refresh plugin SDK declaration budget
2026-07-12 19:58:38 -07:00
Peter Steinberger
f9d7aa286e
refactor(sessions): reduce accessor boundary debt ( #105786 )
...
* refactor(sessions): publish rewrite updates through accessor
* refactor(sessions): patch suspensions through accessor
* refactor(acp): clarify accessor-backed session loads
* test(sessions): ratchet accessor boundary debt
* fix(sessions): preserve file-backed rewrite notifications
* test(sessions): retain file-backed rewrite debt
* fix(sessions): preserve transcript rewrite update identity
* test(sessions): restore rewrite debt baseline
2026-07-12 18:07:55 -07:00
Peter Steinberger
fbade914f5
refactor(plugins): decompose plugin registry ( #105783 )
...
* refactor(plugins): decompose plugin registry
* chore(plugins): move session accessor debt baseline
2026-07-12 17:44:27 -07:00
Ayaan Zaidi
596603f7d3
refactor(sessions): route get-reply-run session refresh through the accessor
...
Drops the last non-doctor whole-store resolveSessionStoreEntry read in the
reply pipeline; exact working-set key plus accessor disk read match the
sibling refresh sites in runPreparedReply. Part of #104219 (seam 8).
2026-07-12 10:06:11 +05:30
NianJiu
da6a24d7dc
fix(reply): prevent hung pre-delivery hooks from blocking lanes ( #104256 )
...
* fix(reply): bound pre-delivery hook settlement
* test(plugins): preserve hook timeout fixtures
* fix(reply): preserve declared pre-delivery budgets
* chore(reply): finalize pre-delivery recovery
* fix(reply): preserve per-final recovery semantics
* fix(reply): guard pending-final settlement identity
* test(reply): align pending-final store fixture
* fix(reply): bind settlement to originating intent
* test(reply): satisfy timeout fixture lint
* chore(plugin-sdk): refresh rebased baseline
* fix(reply): preserve normalized retry ownership
* fix(reply): narrow pending retry metadata
* fix: align reply dispatch state access
* chore(plugin-sdk): refresh rebased surface baseline
* test(reply): align rebased accessor assertion
* chore(plugin-sdk): regenerate drifted API baseline
---------
Co-authored-by: NianJiuZst <180004567+NianJiuZst@users.noreply.github.com >
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-11 15:47:15 -07:00
Josh Lehman
0a8e3604ba
refactor: flip sessions and transcripts to sqlite storage ( #98236 )
...
* refactor(sessions): migrate runtime storage to sqlite
* test(sessions): fix sqlite CI regressions
* test(sessions): align remaining sqlite fixtures
* fix(codex): require sqlite trajectory recorder
* test(sessions): align orphan recovery sqlite fixture
* test(sessions): align sqlite rebase fixtures
* fix(sessions): finish current-main integration of the sqlite flip
Resolve the whole-store SDK removal across its owner boundary: drop the
loadSessionStore re-export and the registry whole-store wrappers, wire
hasTrackedActiveSessionRun into gateway chat, complete the
preserveLockedHarnessIds cleanup contract, flip the codex thread-history
import to storePath targets, and port remaining main-side tests from
file-store helpers to session accessor reads.
* chore: drop committed pebbles log, revert plugin-inspector bump, refresh generated docs
Remove the 1.8k-line .pebbles/events.jsonl work log from the branch, restore
the plugin-inspector advisory lane to main's pinned 0.3.10 so the supply-chain
bump gets its own review, and regenerate docs_map, the plugin SDK API baseline,
and the export-surface ratchet for the merged tree.
* feat(sessions): keep archived transcripts by default with zstd cold storage
Codex-style retention: deleting or resetting a session archives its
transcript as a zstd-compressed JSONL artifact (plain when the runtime
lacks node:zlib zstd) and keeps it until the disk budget evicts oldest
first. resetArchiveRetention now governs both deleted and reset archives
and defaults to keep; maxDiskBytes defaults to 2gb so retention stays
bounded, with archives evicted before live sessions. The cron reaper
follows the same knob instead of deleting archives on its own timer.
* fix(state): converge agent DB migration lineages and bound database growth
Merge coherence: run both structure-gated legacy memory-schema repairs
(flip-lineage drop, main-lineage identity rebuild) before the flip
migration so pre-flip v1/v2 and pre-merge flip v1/v4 databases all
converge, and hoist foreign_keys=OFF outside the schema transaction
where the pragma was silently ignored and the v1 sessions rebuild
cascade-deleted session_entries.
Growth guards: fresh agent DBs enable auto_vacuum=INCREMENTAL, WAL
maintenance releases freed pages in bounded passes (never a blocking
full VACUUM), and doctor reports state/agent DB bloat from freelist
stats.
* fix(codex): resolve the store path for thread-history import via the SDK
The supervision catalog passed the legacy sessionFile locator to the
storePath-targeted transcript mirror; resolve the agent store path with
the session-store SDK helper instead of a runtime-object seam so test
fakes and headless callers need no extra surface. Drop the obsolete
missing-session-id preprocessing case: sessions rows are NOT NULL on
session_id and upsert repairs id-less patches at write time.
* fix(sessions): fail safe on malformed disk-budget config and doctor stat errors
A malformed explicit maxDiskBytes disables the budget instead of
falling back to the destructive 2gb default the user never chose, and
the doctor bloat check skips databases whose paths stat-fail instead of
aborting doctor.
* fix(sessions): complete sqlite conflict translations
* test(sqlite): align hardening checks with maintenance
* test(sessions): inspect compressed transcript archives
* fix(tests): await session seeds and drop unused helpers flagged by CI lint
The five unawaited writeSessionStoreSeed calls raced their SQLite seeds
against the assertions, failing compact shards; the bloat probe drops a
useless initializer and the merged tests drop now-unused helpers.
* test(sessions): type legacy proof events directly
* test(sessions): align hardening contracts
* perf(sessions): read usage transcript sizes from SQL aggregates
Usage/cost scans walked every session and materialized every transcript
event just to re-stringify it for a byte estimate — the #86718 stall
class reborn on the DB. readTranscriptStatsSync sums stored JSON bytes
in SQLite without loading a single row.
* fix(sessions): re-root foreign-root transcript paths onto the current sessions dir
Restored backups, moved OPENCLAW_STATE_DIR, and rehearsal copies carry
absolute sessionFile paths from the old root; the containment fallback
kept those foreign paths, so migration read (and would archive) files in
the original root and reported local copies missing. Re-root the
canonical agents/<id>/sessions suffix onto the current dir when the file
exists there; genuine cross-root layouts still fall through unchanged.
* test(agents): seed harness admission through sqlite
* fix(sqlite): close agent db on pragma setup failure
* fix(doctor): compact and retrofit incremental auto-vacuum after session import
The migration is the sanctioned offline window: post-import compact
reclaims import churn and applies auto_vacuum=INCREMENTAL to databases
created before the fresh-DB pragma existed, so runtime maintenance can
release pages in bounded passes on every install.
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-11 14:50:37 -07:00
Peter Steinberger
f94a7dc183
feat(codex): supervise native Codex sessions ( #104045 )
...
* feat(codex): add native session supervision
* fix(codex): harden supervision integration
* fix(codex): preserve locked harness ownership
* fix(codex): fence native session archive
* fix(codex): revalidate archive binding ownership
* feat(codex): integrate supervision runtime
* feat(sessions): preserve harness-owned execution
* feat(sessions): persist harness ownership invariants
* feat(gateway): enforce harness-owned sessions
* feat(setup): enable detected Codex supervision
* feat(mac): expose supervised Codex sessions
* feat(ui): make Codex sessions actionable
* docs(codex): document session supervision
* test(codex): cover integration ownership
* chore(i18n): refresh supervision inventories
* fix(setup): finalize Codex activation atomically
* test(codex): narrow binding store update
* fix(sessions): preserve legacy model locks
* test(macos): serialize Codex catalog fixtures
* fix(sessions): preserve legacy lock admission
* chore(i18n): reconcile supervision metadata
* test(sessions): mark legacy lock fixture
* fix(macos): drain final Codex catalog frame
* docs: leave supervision note to release
* style(macos): satisfy Codex catalog type length
* chore: record session accessor seam owners
* fix(macos): honor configured Codex supervision
* fix(codex): preserve harness-owned model locks
* fix(codex): satisfy supervision lint gates
* chore(i18n): refresh native supervision inventory
* fix(codex): align supervision validation contracts
* fix(codex): close supervision boundary gaps
* fix(codex): preserve supervision activation contracts
* fix(codex): dispose standalone supervision runtime
* fix(codex): pin supervised source connection
* fix(plugins): bind delegated runs to exact session target
* fix(codex): scope supervised sessions to configured agents
* fix(codex): fingerprint effective supervision home
* fix(codex): normalize supervision plugin policy
* fix(codex): keep supervised bindings stable across upgrades
* fix(codex): guard all supervised binding connections
* fix(codex): preserve catalog filters and pending CAS identity
* fix(codex): preserve supervision identity for diagnostics
* fix(codex): bind uncertain commits to supervision connection
* fix(codex): satisfy supervision type boundaries
* fix(macos): reconcile current main validation
* fix(codex): handle absent runtime config in supervision
* fix(doctor): own local audio acceleration check
* fix(codex): satisfy integration lint gates
* fix(codex): satisfy lifecycle safety guards
2026-07-11 00:12:08 -07:00
Josh Lehman
a68caa185b
refactor(sessions): move parent-session forking behind the accessor boundary ( #101699 )
...
* refactor(sessions): move parent-session forking behind the accessor boundary
* fix(sessions): lazy-load fork transcript runtime to keep accessor imports lean
* test(sessions): align parent fork mock shape
2026-07-07 10:47:02 -07:00
Josh Lehman
453f5968bb
refactor(gateway): route chat transcript injection through the session accessor ( #101688 )
...
* refactor(gateway): route chat transcript injection through the session accessor
* fix(gateway): avoid map-spread in source reply mirror rewrite results
* perf(sessions): find injected transcript duplicates with a reverse early-exit scan
2026-07-07 09:10:30 -07:00
Josh Lehman
cb0d8a1294
refactor(sessions): move inbound meta, goals, and delivery reads behind the session accessor ( #101180 )
2026-07-06 18:07:26 -07:00
Josh Lehman
4e2a80cac3
refactor(sessions): route new session store bypasses through the accessor ( #101179 )
2026-07-06 18:05:18 -07:00
Josh Lehman
c7295e417d
chore(scripts): add debt ratchet to the session-accessor boundary guard ( #101178 )
...
* chore(scripts): add debt ratchet baseline to session-accessor boundary gate
* fix(scripts): fail session-accessor debt gate until baseline ratchets down
2026-07-06 13:55:16 -07:00
