Patrick Erichsen
a691eb7372
Revert "feat(skills): support skills-sh install references ( #112517 )" ( #112531 )
...
This reverts commit 7c353b7436
2026-07-21 22:37:50 -07:00
Patrick Erichsen
7c353b7436
feat(skills): support skills-sh install references ( #112517 )
2026-07-21 22:33:22 -07:00
Peter Steinberger
edecdbd05e
refactor(config): config-surface reduction tranche 3 — product consolidations (review request) ( #111527 )
...
* refactor(config): consolidate media model lists
* refactor(config): unify memory configuration
* refactor(config): consolidate TTS ownership
* refactor(config): move typing policy to agents
* refactor(config): retire product-level config surfaces
* refactor(config): share scoped tool policy type
* chore(config): refresh generated baselines
* fix(config): honor agent typing overrides
* fix(config): migrate sibling config consumers
* refactor(infra): keep base64url decoder private
* fix(config): strip invalid legacy TTS values
* chore(config): refresh rebased baseline hash
* fix(doctor): route legacy messages.tts.realtime voice to talk during tts move
* refactor(config): polish final layout names
* refactor(config): freeze retired tuning defaults
* feat(config): add fast mode default symmetry
* refactor(config): key agent entries by id
* docs(config): update final layout reference
* test(config): cover final layout migrations
* chore(config): refresh final layout baselines
* fix(config): align final layout runtime readers
* fix(config): align remaining readers
* fix(config): stabilize final layout migrations
* fix(config): finalize config projection proof
* fix(config): address final layout review
* docs(release): preserve historical config names
* fix(config): complete keyed agent migration
* fix(config): close final migration gaps
* fix(config): finish full-branch review
* fix(config): complete runtime secret detection
* fix(config): close final review findings
* fix(config): finish canonical docs and heartbeat migration
* fix(config): integrate latest main after rebase
* refactor(env): isolate test-only controls
* refactor(env): isolate build and development controls
* refactor(env): collapse process identity indirection
* refactor(env): remove duplicate config and temp aliases
* docs(env): define the operator-facing allowlist
* ci(env): ratchet production variable count
* fix(env): remove stale provider helper import
* fix(env): make ratchet sorting explicit
* test(env): keep test seam in dead-code audit
* test(env): cover ratchet growth and boundary; document surface budgets
* docs(config): document tier-eval consolidations
* docs(config): clarify speech preference ownership
* test(memory): align retired tuning fixtures
* refactor(memory): freeze engine heuristics
* refactor(config): apply tier-eval tranche
* refactor(tts): move persona shaping to providers
* refactor(compaction): move prompt policy to providers
* test(config): align hookified prompt fixtures
* chore(deadcode): classify test-only exports
* chore(github): remove unused spawn helper
* chore(deadcode): classify queue diagnostics
* chore(deadcode): remove unused lane snapshot export
* chore(plugin-sdk): ratchet consolidated surface
* fix(config): integrate latest main after rebase
2026-07-21 20:28:43 -07:00
Mark
7a0ae5070a
fix(goals): route completion wakes to live session ( #104265 )
...
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-21 13:58:16 -07:00
Yiğit ERDOĞAN
1096b74ab7
fix(browser): retire durable tab rows whose browser never returns ( #111307 )
...
* fix(browser): retire durable tab rows whose browser never returns
Durable cleanup defers whenever ownership cannot be proven, so a browser
that never comes back at the same cdpUrl leaves its rows behind forever:
each sweep re-claims them, fails the identity lookup, warns, and defers
again. Nothing in the subsystem removes a row by age.
The `browser.session-tabs` namespace is opened with a 5000-row cap and
`reject-new`, so once those rows accumulate to the cap, tracking a new tab
throws PLUGIN_STATE_LIMIT_EXCEEDED. That propagates into the compensation
path in browser-tool-session-tabs.ts, which closes the tab the user just
opened and rethrows -- every `browser open` on that profile then opens a
tab, closes it again, and errors, with no self-healing path.
Bound the retry: when a close attempt reports the target unavailable and
the tab has been unused for longer than the retire window, drop the row
instead of deferring again. A browser returning after that long almost
always carries a fresh instance fingerprint, which retires the row through
the ownership-mismatch path anyway.
closeTrackedBrowserTabsForSessions now accepts `now` like the sweep does,
so lifecycle cleanup can be exercised on a coherent clock.
* refactor(browser): split session tab cleanup claim and test harness
check-lint failed on max-lines: session-tab-registry.ts was at 699 of its
700-line budget and the durable registry test at 982 of 1000, so the retire
branch and its regression test pushed both over.
Extract the cleanup claim bookkeeping (claim, ownership match, delete) into
session-tab-cleanup-claim.ts, and the durable registry test shapes into
session-tab-registry.sqlite.test-helpers.ts, matching the existing
*.test-helpers.ts convention in this directory. No behavior change.
* test(browser): protect unreachable retirement races
Co-authored-by: Yigtwxx <yigiterdogan023@gmail.com >
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-21 10:10:28 -07:00
Peter Steinberger
c5254f13ee
refactor(cli)!: remove automatic gateway→embedded fallback from openclaw agent ( #112074 )
...
A Gateway timeout or closed connection now fails the command with an
actionable stderr hint instead of silently re-running the whole turn
embedded under a fresh gateway-fallback-* session. The silent fallback
could double-execute side effects (the Gateway may still finish an
accepted turn), returned context-free answers to --session-key callers,
and ran with the CLI host's local config. --local remains the only
embedded execution path.
Also deletes the resultMetaOverrides plumbing (the fallback was its only
writer) and the fallback marker fields added in #111645 .
2026-07-20 23:30:37 -07:00
Josh Avant
33720886c8
fix(agents): keep sender-scoped tools in delegated runs ( #110345 )
...
* fix(agents): preserve requester policy across delegation
* fix(agents): keep policy types internal
* test(codex): cover delegated policy forwarding
* fix(agents): harden delegated policy contract
* fix(agents): preserve split-owner completion policy
* fix: version delegated requester snapshots
* fix: refresh delegated policy protocol artifacts
2026-07-20 19:42:06 -05:00
Peter Steinberger
ba3711bb82
feat(linux): render widgets in Quick Chat ( #111933 )
2026-07-20 11:56:03 -07:00
Peter Steinberger
154a49a78b
feat(dashboard): widget capabilities — net CSP, host tools, hardened shared sandbox ( #111687 )
...
* feat(boards): enforce widget capability grants
* feat(ui): expose dashboard widget capabilities
* test(dashboard): align rebased gateway contracts
* refactor(dashboard): finish capability alignment
* chore: internalize unused board sandbox exports
* test(dashboard): bind grants to widget instances
* fix(dashboard): close widget authority lifetime gaps
* refactor(ui): preserve modular widget frame ownership
* test(ui): preserve explicit MCP App lease refresh
* test(ui): use shared dashboard sandbox server
* fix(ui): settle widget requests on reconnect
* fix(ui): retry transient widget document loads
* refactor(dashboard): document WebRTC egress residual
* fix(dashboard): clear landing checks
2026-07-20 06:54:44 -07:00
Peter Steinberger
7d4dccf959
improve(swarm): close out wait, phase, and worker follow-ups ( #111605 )
...
* fix(codex): support full swarm wait budgets
* feat(ui): bucket swarm dots by phase
* docs(swarm): document flat worker patterns
* fix(codex): configured per-tool timeout still wins over swarm wait default
* fix(codex): outer swarm-wait watchdog outlives the 600s budget (cap + grace)
* fix(ui): order swarm phase buckets by observation rank
* fix(ui): repair rank-order widget test — proper lit render container, untangle sibling assertions
* fix(ui): implicit swarm phase assignment only on child creation events
* test(ui): split swarm activity integration coverage
2026-07-19 20:11:54 -07:00
Peter Steinberger
06480d767c
feat(dashboard): stitch session dashboards end-to-end — live provider, show_widget pin, board commands ( #111218 )
...
* feat(dashboard): pin canvas widgets through board domain
* feat(control-ui): wire session dashboards end to end
* fix(control-ui): preserve direct reset confirmation
* fix(control-ui): localize dashboard default tab
* test(dashboard): satisfy changed typecheck gate
* fix(dashboard): satisfy changed lint gate
* fix(dashboard): harden pinned widget lifecycle
* fix(dashboard): use extracted mock normalizer
* test(dashboard): reconcile hardened board admission tests
* fix(dashboard): align grant and canvas protocol requests
* fix(dashboard): preserve refresh and pin invariants
* fix(boards): treat missing board tables as empty on read-only paths
* fix(boards): accept read-only handles in board table probe
* fix(control-ui): preserve virtual board widget types
* fix(dashboard): align view types with protocol
* fix(dashboard): keep resolved board view typed
* chore(canvas): drop test-only html read wrapper
* chore(release): defer dashboard note generation
* fix(protocol): align board widget put params type
* fix(control-ui): preserve queued reset approval
* fix(control-ui): gate dashboard pinning capability
* chore(test): isolate dashboard capability fixture
* fix(control-ui): refresh dashboard pin affordance
2026-07-19 12:36:54 -07:00
Peter Steinberger
163a6c6e16
fix(agents): declare visible-session constraints upfront in sessions_spawn ( #111502 )
2026-07-19 11:42:05 -07:00
Peter Steinberger
3e154b6761
fix(agents): let swarm collector fan-outs honor group caps ( #111505 )
...
* refactor(agents): single admission owner per child mode (#111401 )
* refactor(agents): branch admission gather per mode — no cross-mode fallback pairing
2026-07-19 11:40:55 -07:00
Peter Steinberger
c7e7ac2728
refactor: remove expired plugin compatibility surfaces ( #111451 )
...
* docs(secrets): remove retired web credential paths
* refactor(web): remove retired provider compatibility paths
* refactor(providers): delete retired compatibility routes
* refactor(secrets): remove retired credential aliases
* refactor(plugin-sdk): delete retired compatibility surfaces
* docs(plugin-sdk): remove retired migration guidance
* chore(plugin-sdk): refresh rebased surface budgets
* chore(plugin-sdk): refresh API removal baseline
* refactor(compat): migrate retired internal callers
* chore(plugin-sdk): refresh current-main baselines
* test(config): migrate plugin-owned secret assertions
* test(gateway): narrow plugin secret refs
* fix(plugin-sdk): preserve private boundary type identity
* chore(compat): remove stale sweep references
* chore(lint): lower max-lines budget
* refactor(secrets): remove unused web helper
* build(plugin-sdk): drop removed compat entries
* chore(plugin-sdk): refresh rebased API baseline
* chore(plugin-sdk): use Linux API baseline hash
* fix(plugin-sdk): preserve private bundled build entries
* fix(plugin-sdk): package private runtime facades
* fix(plugins): preserve external credential contracts
2026-07-19 11:04:48 -07:00
Peter Steinberger
783a5d21cf
refactor(config): purge numeric tuning knobs behind built-in defaults ( #111382 )
2026-07-19 07:35:45 -07:00
Peter Steinberger
3a85143d97
fix(qa): align ask-user protocol shape ( #111429 )
2026-07-19 07:03:47 -07:00
Peter Steinberger
46b9a3e12d
docs: Swarm user guide ( #110325 ) ( #111384 )
2026-07-19 05:33:00 -07:00
Peter Steinberger
4efcea1fd2
feat(browser): send pages to OpenClaw from the Chrome extension ( #111158 )
...
* feat(browser): send pages to the main session from the Chrome extension
One-click page share in the OpenClaw Chrome extension: toolbar popup with an
optional note, page/selection context menu, and Alt+Shift+S. Capture is
selection-first with a readability heuristic, X/Twitter thread extraction, and
Google Docs plain-text export via the user's session cookies. Payloads ride the
existing paired relay WebSocket as a new pageShare message; the gateway-only
page-share sink wraps page text in the external-content safety boundary, then
enqueues a main-session system event and requests an immediate heartbeat
(hooks/wake semantics). Node-hosted relays report a clear unsupported error.
Capture heuristics adapted from Nat Eliason's MIT-licensed send-to-openclaw.
Co-authored-by: Codex <codex@openai.com >
* fix(browser): keep page-controlled metadata inside the share safety boundary
Review findings: move title/URL inside wrapExternalContent (a hostile <title>
must not become trusted header text), prefer the user's selection over the
full Google Docs export, and pass the context-menu selectionText through so
iframe selections and selections cleared during relay reconnect still win.
* fix(browser): bind context-menu shares to the click-time document
Selection shares from the context menu now send the click snapshot directly
(no recapture), so navigations during relay reconnect cannot mislabel the
source and iframe selections are preserved. The Google Docs selection probe
scans all accessible frames before falling back to the full-document export.
* test(browser): expect the page-share handler in relay server args
* fix(browser): probe only the main frame for Google Docs selections
All-frame injection rejects wholesale when one frame is inaccessible and
returns child frames in nondeterministic order, so the probe now reads the
main frame only. Child-frame selections still share correctly through the
context menu's click-time selectionText; toolbar/shortcut entry sends the
full page for that case (named tradeoff in the code comment).
* fix(browser): satisfy page-share CI gates
---------
Co-authored-by: Codex <codex@openai.com >
2026-07-19 01:07:28 -07:00
Peter Steinberger
a2ccbdfa96
feat(cli): list and resolve pending approvals headlessly ( #111060 )
...
* feat(cli): manage pending approvals
* fix(cli): show terminal-safe approval ids raw, reserve id64 tokens for hostile ids
* fix(cli): preserve opaque approval ids verbatim
* fix(cli): tokenize leading-hyphen approval ids for pasteability
* fix(cli): lossless utf16 id64 tokens for opaque approval ids
* fix(cli): resolve approval ids verbatim, no input trim
* fix(cli): scope-only approval auth, reviewer-safe system-agent summaries, skip ill-formed ids
* fix(cli): validate pending approval ids
* fix(cli): align approvals catalog and docs map
2026-07-18 23:23:49 -07:00
FMLS
4074e0cae1
fix(browser): close tracked tabs after gateway restart ( #110797 )
...
* fix(browser): preserve tab cleanup across restarts
* fix(browser): disambiguate restart tab aliases
* fix(browser): keep untrack selection type private
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-18 22:24:20 -07:00
Peter Steinberger
d96a87e8e9
docs: document session automation contracts ( #111095 )
2026-07-18 18:10:14 -07:00
Yuval Dinodia
0a588fa795
fix(acp): /acp sessions exposes every gateway session to non-owner senders ( #110745 )
...
* fix(acp): scope /acp sessions listing for non-owner senders
/acp sessions listed every ACP session on the gateway for any sender
allowlisted via commands.allowFrom, exposing other senders' session
labels, agent ids, runtime state, and thread bindings. The handler now
returns only the current bound or requester session for non-owner
senders, while owner identity and operator.admin clients keep the full
gateway-wide listing, matching the documented contract.
Fixes #103055
* test(acp): cover empty and missing-session cases for /acp sessions scoping
* fix(acp): avoid non-owner session scans
* docs(acp): remove duplicated session scope text
* test(acp): cover internal session visibility
* fix(acp): require current ACP metadata
* test(acp): reject sessions target tokens
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-18 18:38:48 -06:00
Peter Steinberger
4b7d6fa3bf
docs: align interactive client behavior ( #111047 )
2026-07-18 17:00:14 -07:00
Peter Steinberger
ec998a0f3f
feat(canvas): export widgets as PNG — copy or download from the card menu ( #110992 )
...
* feat(canvas): export widgets as PNG — copy to clipboard or download from the card menu
* fix(ui): widget-export lint, knip, and lines-budget cleanup
2026-07-19 00:39:59 +01:00
Peter Steinberger
5590d7c280
docs: align SecretRef degradation semantics ( #111021 )
2026-07-19 00:18:01 +01:00
Peter Steinberger
242093fb00
fix(ui): dark theme AA contrast for coral fills — deepen primary/destructive, add widget accent-fill token ( #110957 )
2026-07-18 21:56:24 +01:00
Peter Steinberger
81362bf643
feat(apps,ui): question surface parity and composer takeover ( #110681 )
...
* feat(apple): question parity — persistent summaries, skip, reconnect fallback, macOS keyboard
* feat(android): question parity — persistent summaries, skip, reconnect fallback
* feat(ui): question panel replaces composer while expanded
* fix(apps): regenerate question parity contracts
* fix(apps): preserve question reconciliation state
* fix(apps): keep question terminal state monotonic
* test(android): satisfy question test formatting
* fix(security): restore skill audit file reads
* fix(apps): harden question parity edge cases
* fix(apps): preserve expired question summaries
* fix(apps): keep question recovery retries current
* fix(apps): retry stale question recovery snapshots
* fix(android): reset stale question retry budgets
* docs(tools): clarify question composer takeover
* fix(apps): satisfy question recovery release gates
* fix(apps): preserve unknown question outcomes
* fix(apps): harden question action state
* fix(apps): keep unavailable questions terminal
* fix(apps): finalize local question outcomes
* fix(apps): preserve question card API
* fix(apps): reconcile external question answers
* fix(apps): reset question backoff budget
* chore(apps): refresh native i18n inventory
* fix(android): distinguish question skip progress
* fix(android): reconcile locally expired questions
* fix(apps): keep question recovery state fresh
* docs: note question surface parity
* fix(ui): reconcile IME draft before question takeover
* docs: leave question parity notes to release workflow
2026-07-18 21:42:15 +01:00
Peter Steinberger
09a64f7ab0
feat(models): make per-agent allowlists explicit ( #110888 )
2026-07-18 21:42:05 +01:00
Peter Steinberger
1cacb12c4d
feat(canvas): give show_widget a design system — theme tokens, base styles, live host theme bridge ( #110832 )
2026-07-18 21:05:16 +01:00
Peter Steinberger
9710a1339e
refactor(canvas): promote inline-widget hosting and show_widget to core ( #110475 )
...
* refactor(canvas): promote inline widgets to core
* docs(agents): note discord show_widget ownership at core registration
* ci: retrigger after GitHub scheduling outage
* fix(canvas): satisfy dead-code and test type checks
2026-07-18 14:40:45 +01:00
cxbAsDev
05fb8e6e61
fix(cli): bound --message-file reads for agent command ( #101442 )
...
* fix(cli): bound --message-file reads for agent command
* fix(cli): preserve symlinked --message-file paths with bounded reads
* fix(cli): preserve FIFO message files with bounded reads, document 4 MiB cap
* fix(cli): accept FIFO --message-file targets via bounded descriptor read
* test(cli): drop duplicate FIFO message-file read test
* docs(cli): note 4 MiB --message-file cap in agent help text
* style(commands): format agent-via-gateway test
* fix(cli): preserve procfs message-file reads
Co-authored-by: 陈宪彪0668000387 <chen.xianbiao@xydigit.com >
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
Co-authored-by: Peter Steinberger <peter@steipete.me >
2026-07-18 12:29:33 +01:00
Peter Steinberger
9d97e10efe
refactor: move non-session runtime journals to SQLite ( #109427 )
...
* refactor: migrate runtime JSONL state to SQLite
* chore: refresh SQLite migration validation
* fix: preserve safe audit migration order
* fix: sanitize retired audit archives safely
* fix: satisfy SQLite storage architecture gates
* fix: serialize plugin doctor state migrations
* fix: bound memory event SQLite projections
* fix: rotate memory event projections safely
* fix: preserve imported event retention age
* fix: harden memory event export projection
* fix: canonicalize memory event migrations
* fix: harden legacy journal migrations
* fix: report unsafe legacy journal paths
* fix: preserve journal ownership during migration
* fix: keep legacy file imports doctor-only
* fix: align SQLite audit CI coverage
* refactor: keep state helpers module-private
* fix: harden legacy state migration recovery
* fix: reconcile SQLite state audit migration
* test: use neutral audit redaction fixtures
* fix: close SQLite migration recovery gaps
* refactor: split audit migration recovery helpers
* test: prove completed audit pads stay out of backups
* fix: preserve audit record ordinals across blank lines
* fix: align SQLite audit CI contracts
* build: package SQLite audit E2E entries
* fix: preserve audit ordinals in backup snapshots
2026-07-18 11:42:14 +01:00
Peter Steinberger
09963412d1
fix(exec): track background commands as tasks ( #110468 )
2026-07-18 08:51:23 +01:00
Peter Steinberger
d7de67ae02
feat: ask_user follow-ups — harness convergence, channel finalization + reactions, native cards, docked web panel ( #110372 )
...
* feat(ask-user): follow-up harness slice
* feat(ask-user): follow-up channels slice
* feat(ask-user): follow-up native slice
* feat(ui): dock question panel above composer with stepper and compact stream summaries
* docs: refresh follow-up integration maps
* test(ui): align terminal summary proof
* fix(infra): echo declared option answers in terminal status when free-text is allowed
* fix(infra): keep reaction answering when display labels are formatter-adjusted
* fix(agents): settle plain-text claims only after question registration commits
* fix(agents,apps): commit-ordered claim persistence, claim-aware prompt delivery, non-blocking question refresh
* fix(harness,infra): reaction-appropriate question copy, caller presentations honored
* fix(native,infra,agents): local-expiry eviction, value-addressed reactions, reserve-before-request
* fix(infra,android): dual-mode question resolver for compact callbacks; reset terminal retention on replayed pending
* fix(harness,discord): claim-aware prompt delivery in run helper; escape finalization labels
* fix(macos): merge transient-content visibility with question cards after main sync
* fix: repair ask user follow-up CI
* test: update limited bootstrap scope expectation
* fix: retain shared question card API
* chore: refresh native i18n inventory
2026-07-18 03:32:39 -04:00
Peter Steinberger
746d257f05
feat: contract sessions-family tool outputs ( #110424 )
...
* feat(agents): contract sessions-family tool outputs
* refactor(agents): remove unused fast-mode exports
2026-07-18 06:43:12 +01:00
Peter Steinberger
b9c5c7c9fc
feat(agents): contract filesystem tools for code mode ( #110395 )
2026-07-18 06:26:04 +01:00
Peter Steinberger
1c225c855d
fix: CLI timeout warnings explain stopped work ( #110369 )
...
* fix: clarify CLI timeout failures
* docs: update timeout docs map
2026-07-18 06:18:11 +01:00
Vito Cappello
cd1ab40632
fix: gateway boots when a configured plugin payload is broken ( #110239 )
...
* fix: quarantine broken plugins during gateway startup
* fix(plugins): preserve degraded boot on package read errors
* fix(gateway): emit quarantine diagnostic once
* fix(gateway): refresh plugin quarantine every boot
* fix(gateway): harden plugin payload quarantine
Co-authored-by: VACInc <3279061+VACInc@users.noreply.github.com >
* fix(ci): satisfy plugin quarantine checks
Co-authored-by: VACInc <3279061+VACInc@users.noreply.github.com >
---------
Co-authored-by: VACInc <3279061+VACInc@users.noreply.github.com >
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-18 03:50:50 +01:00
Peter Steinberger
19296b003b
improve(agents): normalized web_search output contract with boundary-owned wrapping ( #110308 )
...
* feat: normalize web search output contract
* refactor(agents): promote web_search contract from a dedicated output module
* fix(agents): wrap unwrapped web_search text and pass unknown provider payloads through as raw
* fix(agents): gate web_search results branch on conforming rows and cover metadata fields
* fix(agents): gate every provider text path at the web_search boundary
* test(agents): align web_search fixtures with boundary-owned wrapping
* fix(agents): make the web_search boundary own the untrusted-content envelope
* fix(agents): report declared web_search errors first and align the documented contract
* fix(agents): bind envelope stripping to real markers and densify result rows
* fix(agents): emit canonical urls and a closed error code from web_search
* fix(agents): keep structured provider error diagnostics in the wrapped message
* fix(agents): satisfy production export and lint gates for the web_search contract
2026-07-18 03:39:29 +01:00
Peter Steinberger
53b53f1977
improve(agents): exact web_fetch output contract with cleaned result shape ( #110223 )
...
* feat: add web fetch output contract
* fix(agents): keep web_fetch contract schema module-local
* docs: refresh docs map for the web_fetch result section
2026-07-18 03:28:29 +01:00
Peter Steinberger
d371ea1f01
perf(agents): wave-1 tool output contracts for code mode ( #110215 )
...
* feat(agents): keep output contracts complete across opaque schema leaves
* test(agents): add code mode schema-hint hot-path micro-benchmark
* test(agents): count raw-first inspection execs per tool in live bench
* feat(agents): expand compact output contract hints
* feat(agents): declare wave one tool output contracts
* docs(tools): list built-in output contracts
* fix(agents): bound union scans before literal-union analysis
* fix(agents): keep wave-1 contract schemas module-local and type-exact
2026-07-18 01:02:18 +01:00
Peter Steinberger
ec8f6e5e03
feat(browser): add secure per-tab copilot panel ( #109817 )
...
* feat(browser): add copilot security contracts
* fix(gateway): expose verified client identity to handlers
* feat(browser): add secure per-tab copilot panel
Co-authored-by: Cameron Beeley <cameron.beeley@gmail.com >
* refactor(browser): separate copilot gateway hint custody
* fix(browser): preserve legacy pairing parse shape
* fix(browser): harden copilot lifecycle custody
Co-authored-by: Cameron Beeley <cameron.beeley@gmail.com >
* fix(browser): enforce copilot lifecycle boundaries
Co-authored-by: Cameron Beeley <cameron.beeley@gmail.com >
* style(browser): format copilot sources
Co-authored-by: Cameron Beeley <cameron.beeley@gmail.com >
* fix(browser): preserve copilot consent revocation
Co-authored-by: Cameron Beeley <cameron.beeley@gmail.com >
* refactor(browser): split copilot custody owners
Co-authored-by: Cameron Beeley <cameron.beeley@gmail.com >
* test(browser): normalize websocket array buffers
Co-authored-by: Cameron Beeley <cameron.beeley@gmail.com >
* chore(protocol): regenerate Swift gateway models
Co-authored-by: Cameron Beeley <cameron.beeley@gmail.com >
* refactor(browser): model copilot runtime entrypoints
Co-authored-by: Cameron Beeley <cameron.beeley@gmail.com >
* fix(browser): honor extension build boundaries
Co-authored-by: Cameron Beeley <cameron.beeley@gmail.com >
* test(gateway): assert targeted chat delivery
Co-authored-by: Cameron Beeley <cameron.beeley@gmail.com >
* test(gateway): cover targeted delivery calls
Co-authored-by: Cameron Beeley <cameron.beeley@gmail.com >
* fix(browser): declare copilot build dependencies
Co-authored-by: Cameron Beeley <cameron.beeley@gmail.com >
* fix(ci): clear browser copilot gate failures
Co-authored-by: Cameron Beeley <cameron.beeley@gmail.com >
* test(ci): cover copilot lint exclusion
Co-authored-by: Cameron Beeley <cameron.beeley@gmail.com >
* fix(browser): gate copilot on relay custody
Co-authored-by: Cameron Beeley <cameron.beeley@gmail.com >
* test(browser): bound copilot relay frames
Co-authored-by: Cameron Beeley <cameron.beeley@gmail.com >
---------
Co-authored-by: Cameron Beeley <cameron.beeley@gmail.com >
2026-07-18 01:00:23 +01:00
Peter Steinberger
da44d52ac6
feat: ask_user — structured questions from the agent with web card, channel buttons, and text answers ( #109922 )
...
* feat(gateway): add transient question runtime (question.* methods + broadcasts)
* feat(agents): add blocking ask_user question tool with chat prompt delivery and text-reply claim
* feat(ui): interactive in-thread question cards for ask_user
* feat(channels): native tap-to-answer buttons for ask_user on Telegram, Discord, and Slack
* feat(ui): unify codex and gateway question cards with interactive gateway answering
* refactor(agents): collapse ask_user pending state to one registry; docs for ask_user
* fix(agents): include ask_user in normal gateway runs; add question-flow control-ui e2e
* test(ui): avoid credential-shaped fixture in question card test
* refactor(ui): reorder stream-group context keys
* fix(gateway,ui): validate question answers at resolve; reject secret/duplicate-label questions; UI retry and reconnect hardening
* fix(gateway,agents): canonicalize accepted option answers; bound ask_user option labels to 64 chars
* chore(ci): prune unused question exports, allowlist mobile question events, fix discord lint
* chore(ci): regenerate protocol/i18n/docs/tool-display artifacts for question surface
* fix(protocol): flatten QuestionRecord for native codegen; drop TS-only alias from schema registry
* chore(android): regenerate ask-user localization resources
* docs: regenerate docs map after rebase
* fix(ci): avoid stale read-only dependency disks
* test: remove stale reef lint suppression ratchet
* fix(ci): keep source locale drift advisory in release gates
* fix(ci): scope locale advisory handling to parity check
2026-07-17 22:24:17 +01:00
Peter Steinberger
3d1e8f9475
perf(agents): compose conversation tools in code mode ( #110098 )
2026-07-17 20:54:32 +01:00
Peter Steinberger
b319493a52
improve: let Code Mode use declared tool result shapes ( #109813 )
...
* feat(agents): add Code Mode output contracts
* perf(agents): defer untrusted tool schemas
* chore(plugin-sdk): refresh API baseline
* fix(agents): preserve deferred schema markers
* fix(agents): preserve policy-blocked tool results
* fix(agents): preserve nullable output contracts
* fix(agents): reject policy blocks from success contracts
* fix(agents): preserve output contracts through normalization
* test(agents): type normalized tool fixtures
* fix(agents): validate catalog results before projection
* fix(agents): keep result snapshots internal
* fix(agents): fail closed on unrenderable unions
* fix(agents): preserve empty result markers
* test(agents): keep result fixture discriminator literal
* test(agents): use native own-property check
2026-07-17 14:46:37 +01:00
snowzlmbot
17c2ce05d8
fix(secrets): keep startup alive when TTS SecretRefs are missing ( #101265 )
...
* fix(secrets): degrade missing TTS SecretRefs at startup
* test(secrets): keep non-activating startup strict
* test(secrets): mark denied key fixture synthetic
* test(secrets): use synthetic TTS key fixture
* test(secrets): use neutral TTS key placeholder
* test(secrets): isolate TTS key placeholder
* test(secrets): shorten TTS ref fixture name
* test(secrets): normalize synthetic credential fixtures
* test(secrets): isolate optional redaction coverage
* fix(secrets): preserve degraded TTS ref ownership
* refactor(secrets): keep optional resolver internal
* test(secrets): cover default provider alias misses
* test(secrets): pin explicit provider ownership
* style(secrets): format optional assignment imports
* refactor(secrets): keep optional metadata private
* style(secrets): restore collector file header
* fix(secrets): isolate unavailable SecretRef owners
Co-authored-by: snowzlmbot <293528334+snowzlmbot@users.noreply.github.com >
* test(secrets): complete provider fixtures
* style(status): avoid degraded path shadowing
* style(secrets): satisfy runtime lint
* refactor(secrets): keep error codes internal
* fix(secrets): keep unowned assignments fail closed
* fix(secrets): preserve provider resolution batching
* fix(secrets): normalize stalled resolution errors
* fix(secrets): reject provider limit violations
---------
Co-authored-by: snowzlmbot <293528334+snowzlmbot@users.noreply.github.com >
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-16 21:07:01 -07:00
Peter Steinberger
57cc2ca308
improve: reduce compact tool orchestration turns ( #109596 )
...
* perf(agents): streamline compact tool orchestration
* fix(agents): preserve compact schema narrowing
* refactor(agents): focus legacy tool-search guidance
* fix(agents): defer MCP compact schema hints
* chore: drop release-owned changelog edit
2026-07-16 20:53:42 -07:00
Peter Steinberger
28a3540f32
feat: add native inline widget support ( #109212 )
...
* feat: add native inline widget support
* refactor: simplify plugin surface refresh
* fix: preserve plugin surface refresh API
* fix: reload widgets after WebKit termination
* fix: harden native widget refresh
* fix: bound native widget recovery
* docs: defer native widget release note
* chore: refresh native i18n inventory
* fix: harden native widget delivery
* refactor: simplify native widget API surface
* fix: serialize native widget capability refresh
* fix: harden native widget recovery
* fix: recover native widget capabilities
* style: format widget refresh role selection
* fix: correct widget refresh formatting
* fix: harden cross-platform widget recovery
* fix: bind widget trust and recovery to routes
* chore: refresh native i18n inventory
* chore: regenerate Android gateway protocol
* test: remove unused release workflow read
2026-07-16 19:24:41 -07:00
Peter Steinberger
349f78776d
fix(models): refresh bundled provider catalogs ( #109410 )
...
* fix(models): refresh bundled provider catalogs
* docs(models): refresh generated docs map
* fix(xiaomi): keep provider helper private
* chore(release): defer catalog release note
2026-07-16 16:47:25 -07:00
Peter Steinberger
334c182c27
refactor(diffs): move ephemeral artifacts to SQLite ( #109328 )
...
* refactor(diffs): move ephemeral artifacts to SQLite
* fix(plugin-state): satisfy SDK validation gates
* test(diffs): satisfy lint contracts
* fix(plugin-state): count expired blobs toward quotas
* fix(plugin-state): harden blob storage boundaries
* fix(plugins): replace stale install provenance
2026-07-16 16:47:19 -07:00
