Commit Graph

640 Commits

Author SHA1 Message Date
Vincent Koc
628104662b refactor: share browser client request helpers 2026-05-29 10:26:44 +02:00
Vincent Koc
a4bb9b1438 refactor: share browser debug route responses 2026-05-29 10:14:18 +02:00
Vincent Koc
3e050d05e8 refactor: share session tab registry helpers 2026-05-29 10:02:18 +02:00
Peter Steinberger
24614ac100 refactor(browser): centralize route numeric readers 2026-05-29 03:59:19 -04:00
Vincent Koc
6c309b9883 refactor: share browser route navigation policy 2026-05-29 09:52:12 +02:00
Peter Steinberger
2ea8d88d63 fix(browser): validate cookie expiry values 2026-05-29 03:50:19 -04:00
Peter Steinberger
ac52499aca fix(browser): validate screenshot timeout 2026-05-29 03:46:53 -04:00
Peter Steinberger
c48a4a3188 fix(browser): validate geolocation options 2026-05-29 03:43:06 -04:00
Peter Steinberger
c7f50738c0 fix(browser): validate permission grant timeout 2026-05-29 03:34:06 -04:00
Peter Steinberger
dca86d47e0 fix(browser): validate hook download timeouts 2026-05-29 03:30:46 -04:00
Peter Steinberger
854cb9292d fix(browser): validate response body numeric options 2026-05-29 03:27:34 -04:00
Peter Steinberger
0b24f47465 fix(browser): tighten act numeric parsing 2026-05-29 03:23:42 -04:00
Peter Steinberger
4fae13e29e fix(browser): centralize snapshot numeric parsing 2026-05-29 03:15:56 -04:00
Peter Steinberger
0bc591a7d7 fix(browser): reject invalid tab indexes 2026-05-29 03:07:15 -04:00
Peter Steinberger
286883cc54 fix(browser): cap route timer delays 2026-05-29 03:03:07 -04:00
Peter Steinberger
b0730944eb fix(browser): cap cli request timeouts 2026-05-29 02:50:51 -04:00
Vincent Koc
611adb2ee0 test(browser): align loopback auth mock types 2026-05-29 08:01:21 +02:00
Vincent Koc
2e042fbca8 fix(browser): reject excessive viewport resizes 2026-05-29 07:51:27 +02:00
Peter Steinberger
621db8f0b1 fix(browser): reject explicit zero cdp ports 2026-05-29 01:43:05 -04:00
Peter Steinberger
59cec74d89 fix(browser): clamp non-finite viewport dimensions 2026-05-29 00:46:07 -04:00
Peter Steinberger
1e48ca4e32 fix(browser): default non-finite chrome mcp click delays 2026-05-29 00:42:37 -04:00
Peter Steinberger
4638f58615 fix(browser): default non-finite keypress delays 2026-05-29 00:38:45 -04:00
Peter Steinberger
c7144a8689 fix(browser): default non-finite DOM text budgets 2026-05-29 00:35:43 -04:00
Peter Steinberger
4dd3ba149c fix(browser): default non-finite snapshot limits 2026-05-29 00:32:35 -04:00
Peter Steinberger
adabff1bf0 fix(browser): centralize non-finite tool timeouts 2026-05-29 00:04:04 -04:00
Peter Steinberger
dac13d9a69 fix(browser): default non-finite navigation timeouts 2026-05-29 00:00:44 -04:00
Peter Steinberger
3c8ad8cbaa fix(browser): default non-finite fetch timeouts 2026-05-28 23:52:40 -04:00
Peter Steinberger
b2bdad5bee fix(browser): default non-finite snapshot timeouts 2026-05-28 23:48:33 -04:00
Peter Steinberger
18ef59bb33 fix(browser): default non-finite dialog arm timeouts 2026-05-28 23:44:42 -04:00
Peter Steinberger
10a3417bd3 fix: validate browser act numeric params 2026-05-28 21:16:12 -04:00
Peter Steinberger
091e15139b refactor: centralize numeric tool schemas 2026-05-28 20:39:51 -04:00
Peter Steinberger
7e04680e23 fix: parse browser top-level timeouts 2026-05-28 20:36:34 -04:00
Peter Steinberger
913241ebf9 fix: parse browser snapshot numeric params 2026-05-28 20:25:18 -04:00
Peter Steinberger
d487c58c6f fix: validate browser profile ports 2026-05-28 15:40:16 -04:00
Peter Steinberger
1e67387475 fix: validate browser responsebody limits 2026-05-28 15:37:59 -04:00
Peter Steinberger
8fbdfc0a76 fix: validate browser geolocation numbers 2026-05-28 15:35:14 -04:00
Peter Steinberger
503d8d5542 fix: validate browser snapshot numbers 2026-05-28 15:32:25 -04:00
Peter Steinberger
ec8ff27803 fix: validate browser viewport dimensions 2026-05-28 15:29:12 -04:00
Peter Steinberger
afb56ea972 fix: reject invalid browser tab indexes 2026-05-28 15:26:33 -04:00
Peter Steinberger
4b8c260444 fix: parse browser action timeouts strictly 2026-05-28 14:51:23 -04:00
Peter Steinberger
f0bfa650dc fix: parse browser cli numbers strictly 2026-05-28 14:46:34 -04:00
Peter Steinberger
f4f059ef94 fix: cap chrome mcp stderr by utf8 bytes 2026-05-28 12:42:18 -04:00
Peter Steinberger
fb80d3a491 perf: reduce gateway startup sidecar overhead 2026-05-28 17:05:19 +01:00
Peter Steinberger
b6ef874220 fix: reject partial numeric parsing 2026-05-28 10:51:32 -04:00
Peter Steinberger
aab5410bd5 test: speed up slow test suite (#87611)
* test: speed up slow test suite

* test: preserve fake timer cleanup hooks

* test: avoid timeout readiness race

* test: satisfy reply test types

* test: restore runner and image coverage

* test: restore final media runner path

* test: make cli auth status fixture deterministic

* test: repair runtime alias fixtures
2026-05-28 13:20:19 +01:00
Peter Steinberger
cee2a50fe6 chore(release): prepare 2026.5.28 2026-05-28 01:48:07 +01:00
Peter Steinberger
94749b0a45 fix(cli): reject malformed numeric inputs 2026-05-27 15:43:12 -04:00
Peter Steinberger
bb46b79d3c refactor: internalize OpenClaw agent runtime (#85341)
* refactor: extract agent core package

Introduce packages/agent-core as the OpenClaw-owned home for reusable agent loop, harness, session, prompt, and runtime dependency contracts.

* refactor: extract shared llm runtime

Move provider model registries, stream wrappers, OAuth helpers, and LLM utilities into src/llm with plugin-sdk barrels instead of depending on the old embedded runtime layout.

* refactor: remove pi runtime internals

Rename remaining Pi-shaped agent surfaces to OpenClaw agent runtime names, delete obsolete Pi docs and package graph checks, and add the third-party notice for incorporated code.

* refactor: tighten agent session runtime

Make agent-core/runtime dependencies explicit, consolidate compaction and session transcript helpers, and move model/session helpers behind OpenClaw-owned contracts.

* refactor: remove static model and pi auth paths

Drop static model catalogs and Pi auth bridges, move model/provider facts to manifest-owned runtime contracts, and harden internal embedded-agent utilities.

* refactor: remove legacy provider compat paths

* docs: remove agent parity notes

* fix: skip provider wildcard metadata parsing

* refactor: share session extension sdk loading

* refactor: inline acpx proxy error formatter

* refactor: fold edit recovery into edit tool

* fix: accept extension batch separator

* test: align startup provider plugin expectations

* fix: restore provider-scoped release discovery

* test: align static asset packaging expectations

* fix: run static provider catalogs during scoped discovery

* fix: add provider entry catalogs for scoped live discovery

* fix: load lightweight provider catalog entries

* fix: refresh provider-scoped plugin metadata

* fix: keep provider catalog entries on release live path

* fix: keep static manifest models in release live checks

* fix: harden release model discovery

* fix: reduce OpenAI live cache probe reasoning

* fix: disable OpenAI cache probe reasoning

* ci: extend OpenAI gateway live timeout

* fix: extend live gateway model budget

* fix: stabilize release validation regressions

* fix: honor provider aliases in model rows

* fix: stabilize release validation lanes

* fix: stabilize release memory qa

* ci: stabilize release validation lanes

* ci: prefer ipv4 for live docker node calls

* fix: restore shared tool-call stream wrapper

* ci: remove legacy pi test shard alias

* fix: clean up embedded agent test drift

* fix: stabilize runtime alias status

* fix: clean up embedded agent ci drift

* fix: restore release ci invariants

* fix: clean up post-rebase runtime drift

* fix: restore release ci checks

* fix: restore release ci after rebase

* fix: remove stale pi runtime path

* test: align compaction runtime expectations

* test: update plugin prerelease expectations

* fix: handle claude live tool approvals

* fix: stabilize release validation gates

* fix: finish agent runtime import

* test: finish post-rebase agent runtime mocks

* fix: keep codex compaction native

* fix: stabilize codex app-server hook tests

* test: isolate codex diagnostic active run

* test: remove codex diagnostic completion race

# Conflicts:
#	extensions/codex/src/app-server/run-attempt.test.ts

* ci: fix full release manifest performance run id

* refactor: narrow llm plugin sdk boundary

* chore: drop generated google boundary stamps

* fix: repair rebase fallout

* fix: clean up rebased runtime references

* fix: decode codex jwt payloads as base64url

* fix: preserve shipped pi runtime alias

* fix: add scoped sdk virtual modules

* fix: decode llm codex oauth jwt as base64url

* fix: avoid stale vertex adc negative cache

* fix: harden tool arg decoding and codeql path

* fix: keep vertex adc negative checks live

* refactor: consolidate codex jwt and edit helpers

* fix: await codex oauth node runtime imports

* fix: preserve sdk tool and notice contracts

* fix: preserve shipped compat config boundaries

* fix: align codex oauth callback host

* fix: terminate agent-core loop streams on failure

* fix: keep codex oauth callback alive during fallback

* ci: include session tools in critical codeql scans

* fix: keep Cloudflare Anthropic provider auth header

* docs: redirect legacy pi runtime pages

* fix: honor bundled web provider compat discovery

* fix: protect session output spill files

* fix: keep legacy agent dir env blocked

* fix: contain auto-discovered skill symlinks

* fix: harden agent core sdk proxy surfaces

* fix: restore approval reaction sdk compat

* fix: keep live docker runs bounded

* fix: keep codex oauth redirect host aligned

* fix: resolve post-rebase agent runtime drift

* fix: redact anthropic oauth parse failures

* fix: preserve responses strict tool shaping

* fix: repair agent runtime rebase cleanup

* docs: redirect retired parity pages

* fix: bound auto-discovered resources to roots

* fix: repair post-rebase agent test drift

* fix: preserve bundled provider allowlist migration

* fix: preserve manifest-owned provider aliases

* fix: declare photon image dependency

* fix: keep provider headers out of proxy body

* fix: preserve shipped env aliases

* fix: refresh control ui i18n generated state

* fix: quote read fallback paths

* fix: preview edits through configured backend

* test: satisfy core test typecheck

* fix: preserve ZAI usage auth fallback

* test: repair codex diagnostic test

* fix: repair agent runtime rebase drift

* test: finish embedded runner import rename

* fix: repair agent runtime rebase integrations

* test: align compaction oauth fallback expectations

* fix: allow sdk-auth session models

* fix: update doctor tool schema import

* fix: preserve bedrock plugin region

* fix: stream harmony-like prose immediately

* ci: include session runtime in codeql shards

* fix: repair latest rebase integrations

* fix: honor explicit codex websocket transport

* fix: keep openai-compatible credentials provider-scoped

* fix: refresh sdk api baseline after rebase

* fix: route cli runtime aliases through openclaw harness

* test: rename stale harness mock expectation

* test: rename embedded agent overflow calls

* test: clean embedded auth test wording

* test: use openclaw stream types in deepinfra cache test

* fix: refresh sdk api baseline on latest main

* fix: honor bundled discovery compat allowlists

* fix: refresh sdk api baseline after latest rebase

* fix: remove stale rebase imports

* test: rename stale model catalog mock

* test: mock renamed doctor runtime modules

* fix: map canonical kimi env auth

* fix: use internal model registry in bench script

* fix: migrate deepinfra provider catalog entry

* fix: enforce builtin tool suppression

* fix: route compaction auth and proxy payloads safely

* refactor: prune unused llm registry leftovers

* test: update codex hooks session import

* test: fix model picker ci coverage

* test: align model picker auth mock types
2026-05-27 19:24:04 +01:00
Peter Steinberger
7aaca4a8a6 chore(release): prepare 2026.5.27 2026-05-27 16:53:50 +01:00
Agustin Rivera
06047005ef fix(browser): validate current tab before snapshots (#78526)
* fix(browser): validate current tab before snapshots

* fix(browser): reject snapshot selector before SSRF guard

* fix(test): stabilize plugin activation normalization

* fix(ci): fetch opengrep base history

* fix(snapshot): enforce snapshot ssrf policy

* docs(changelog): add unreleased entry for snapshot SSRF fix

* Revert "docs(changelog): add unreleased entry for snapshot SSRF fix"

This reverts commit 4f3031ff65.

* fix(changelog): record snapshot ssrf entry
2026-05-26 19:11:01 -07:00