Vincent Koc
b4f16bad32
Plugin SDK: export windows spawn and temp path
2026-03-18 09:46:24 -07:00
Vincent Koc
a02bfd30c5
Plugin SDK: use public utility subpaths
2026-03-18 09:43:46 -07:00
Peter Steinberger
5fd482d6b0
test: align acp session mode list
2026-03-18 16:14:14 +00:00
Peter Steinberger
c0c3c4824d
fix: checkpoint gate fixes before rebase
2026-03-18 15:36:18 +00:00
Bob
732e075e92
ACP: reproduce binding restart session reset ( #49435 )
...
* ACP: reproduce restart binding regression
* ACP: resume configured bindings after restart
* ACP: scope restart resume to persistent sessions
---------
Co-authored-by: Onur <2453968+osolmaz@users.noreply.github.com >
2026-03-18 07:24:38 +01:00
Bob
ea15819ecf
ACP: harden startup and move configured routing behind plugin seams ( #48197 )
...
* ACPX: keep plugin-local runtime installs out of dist
* Gateway: harden ACP startup and service PATH
* ACP: reinitialize error-state configured bindings
* ACP: classify pre-turn runtime failures as session init failures
* Plugins: move configured ACP routing behind channel seams
* Telegram tests: align startup probe assertions after rebase
* Discord: harden ACP configured binding recovery
* ACP: recover Discord bindings after stale runtime exits
* ACPX: replace dead sessions during ensure
* Discord: harden ACP binding recovery
* Discord: fix review follow-ups
* ACP bindings: load channel snapshots across workspaces
* ACP bindings: cache snapshot channel plugin resolution
* Experiments: add ACP pluginification holy grail plan
* Experiments: rename ACP pluginification plan doc
* Experiments: drop old ACP pluginification doc path
* ACP: move configured bindings behind plugin services
* Experiments: update bindings capability architecture plan
* Bindings: isolate configured binding routing and targets
* Discord tests: fix runtime env helper path
* Tests: fix channel binding CI regressions
* Tests: normalize ACP workspace assertion on Windows
* Bindings: isolate configured binding registry
* Bindings: finish configured binding cleanup
* Bindings: finish generic cleanup
* Bindings: align runtime approval callbacks
* ACP: delete residual bindings barrel
* Bindings: restore legacy compatibility
* Revert "Bindings: restore legacy compatibility"
This reverts commit ac2ed68fa2426ecc874d68278c71c71ad363fcfe.
* Tests: drop ACP route legacy helper names
* Discord/ACP: fix binding regressions
---------
Co-authored-by: Onur <2453968+osolmaz@users.noreply.github.com >
2026-03-17 17:27:52 +01:00
Peter Steinberger
9f8cf7f71a
test: stabilize full gate
2026-03-17 16:21:59 +00:00
Josh Lehman
1399ca5fcb
fix(plugins): forward plugin subagent overrides ( #48277 )
...
Merged via squash.
Prepared head SHA: ffa45893e0550978+jalehman@users.noreply.github.com >
Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com >
Reviewed-by: @jalehman
2026-03-17 07:20:27 -07:00
Peter Steinberger
5fb7a1363f
fix: stabilize full gate
2026-03-17 07:06:25 +00:00
Peter Steinberger
026d8ea534
fix: unblock full gate
2026-03-17 07:06:24 +00:00
Josh Lehman
eeb140b4f0
fix(plugins): late-binding subagent runtime for non-gateway load paths ( #46648 )
...
Merged via squash.
Prepared head SHA: 44742652c9550978+jalehman@users.noreply.github.com >
Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com >
Reviewed-by: @jalehman
2026-03-16 14:27:54 -07:00
Peter Steinberger
d163278e9c
refactor: move channel delivery and ACP seams into plugins
2026-03-15 23:25:20 -07:00
Vincent Koc
e4c61723cd
ACP: fail closed on conflicting tool identity hints ( #46817 )
...
* ACP: fail closed on conflicting tool identity hints
* ACP: restore rawInput fallback for safe tool resolution
* ACP tests: cover rawInput-only safe tool approval
2026-03-15 08:39:49 -07:00
Tak Hoffman
89e3969d64
feat(feishu): add ACP and subagent session binding ( #46819 )
...
* feat(feishu): add ACP session support
* fix(feishu): preserve sender-scoped ACP rebinding
* fix(feishu): recover sender scope from bound ACP sessions
* fix(feishu): support DM ACP binding placement
* feat(feishu): add current-conversation session binding
* fix(feishu): avoid DM parent binding fallback
* fix(feishu): require canonical topic sender ids
* fix(feishu): honor sender-scoped ACP bindings
* fix(feishu): allow user-id ACP DM bindings
* fix(feishu): recover user-id ACP DM bindings
2026-03-15 10:33:49 -05:00
Peter Steinberger
e4924a0134
test: dedupe acp translator cancel scoping tests
2026-03-13 21:40:53 +00:00
Peter Steinberger
0f637b5e30
refactor: share acp conversation text normalization
2026-03-13 21:40:53 +00:00
Peter Steinberger
9b6790e3a6
refactor: share acp binding resolution helper
2026-03-13 21:40:53 +00:00
Peter Steinberger
d9fb1e0e45
test: dedupe acp startup test harness
2026-03-13 21:40:53 +00:00
Peter Steinberger
1301462a1b
refactor: share acp persistent binding fixtures
2026-03-13 21:40:53 +00:00
Peter Steinberger
d2a36d0a98
refactor: share small test harness helpers
2026-03-13 20:19:38 +00:00
scoootscooob
17c954c46e
fix(acp): preserve final assistant message snapshot before end_turn ( #44597 )
...
Process messageData via handleDeltaEvent for both delta and final states
before resolving the turn, so ACP clients no longer drop the last visible
assistant text when the gateway sends the final message body on the
terminal chat event.
Closes #15377
Based on #17615
Co-authored-by: PJ Eby <3527052+pjeby@users.noreply.github.com >
2026-03-12 20:23:57 -07:00
Peter Steinberger
d5bffcdeab
feat: add fast mode toggle for OpenAI models
2026-03-12 23:31:31 +00:00
Gustavo Madeira Santana
46f0bfc55b
Gateway: harden custom session-store discovery ( #44176 )
...
Merged via squash.
Prepared head SHA: 52ebbf51885599352+gumadeiras@users.noreply.github.com >
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com >
Reviewed-by: @gumadeiras
2026-03-12 16:44:46 +00:00
Frank Yang
5231277163
fix(acp): rehydrate restarted main ACP sessions ( #43285 )
...
Merged via squash.
Prepared head SHA: f06318e58f4488090+frankekn@users.noreply.github.com >
Co-authored-by: frankekn <4488090+frankekn@users.noreply.github.com >
Reviewed-by: @frankekn
2026-03-12 11:05:09 +08:00
Peter Steinberger
9c81c31232
chore: refresh dependencies except carbon
2026-03-11 20:10:33 +00:00
Peter Steinberger
201420a7ee
fix: harden secret-file readers
2026-03-10 23:40:10 +00:00
Rodrigo Uroz
ff2e7a2945
fix(acp): strip provider auth env for child ACP processes (openclaw#42250)
...
Verified:
- pnpm build
- pnpm check
- pnpm test:macmini
Co-authored-by: rodrigouroz <384037+rodrigouroz@users.noreply.github.com >
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com >
2026-03-10 16:50:10 -05:00
Pejman Pour-Moezzi
7c76acafd6
fix(acp): scope cancellation and event routing by runId ( #41331 )
2026-03-10 22:37:21 +01:00
Pejman Pour-Moezzi
aca216bfcf
feat(acp): add resumeSessionId to sessions_spawn for ACP session resume ( #41847 )
...
* feat(acp): add resumeSessionId to sessions_spawn for ACP session resume
Thread resumeSessionId through the ACP session spawn pipeline so agents
can resume existing sessions (e.g. a prior Codex conversation) instead
of starting fresh.
Flow: sessions_spawn tool → spawnAcpDirect → initializeSession →
ensureSession → acpx --resume-session flag → agent session/load
- Add resumeSessionId param to sessions-spawn-tool schema with
description so agents can discover and use it
- Thread through SpawnAcpParams → AcpInitializeSessionInput →
AcpRuntimeEnsureInput → acpx extension runtime
- Pass as --resume-session flag to acpx CLI
- Error hard (exit 4) on non-existent session, no silent fallback
- All new fields optional for backward compatibility
Depends on acpx >= 0.1.16 (openclaw/acpx#85, merged, pending release).
Tests: 26/26 pass (runtime + tool schema)
Verified e2e: Discord → sessions_spawn(resumeSessionId) → Codex
resumed session and recalled stored secret.
🤖 AI-assisted
* fix: guard resumeSessionId against non-ACP runtime
Add early-return error when resumeSessionId is passed without
runtime="acp" (mirrors existing streamTo guard). Without this,
the parameter is silently ignored and the agent gets a fresh
session instead of resuming.
Also update schema description to note the runtime=acp requirement.
Addresses Greptile review feedback.
* ACP: add changelog entry for session resume (#41847 ) (thanks @pejmanjohn)
---------
Co-authored-by: Pejman Pour-Moezzi <481729+pejmanjohn@users.noreply.github.com >
Co-authored-by: Onur <onur@textcortex.com >
2026-03-10 10:36:13 +01:00
Mariano
3c3474360b
acp: harden follow-up reliability and attachments ( #41464 )
...
Merged via squash.
Prepared head SHA: 7d167dff54132747814+mbelinky@users.noreply.github.com >
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com >
Reviewed-by: @mbelinky
2026-03-09 23:03:50 +01:00
Mariano
4aebff78bc
acp: forward attachments into ACP runtime sessions ( #41427 )
...
Merged via squash.
Prepared head SHA: f2ac51df2c132747814+mbelinky@users.noreply.github.com >
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com >
Reviewed-by: @mbelinky
2026-03-09 22:32:32 +01:00
Mariano
8e3f3bc3cf
acp: enrich streaming updates for ide clients ( #41442 )
...
Merged via squash.
Prepared head SHA: 0764368e80132747814+mbelinky@users.noreply.github.com >
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com >
Reviewed-by: @mbelinky
2026-03-09 22:26:46 +01:00
Mariano
d346f2d9ce
acp: restore session context and controls ( #41425 )
...
Merged via squash.
Prepared head SHA: fcabdf7c31132747814+mbelinky@users.noreply.github.com >
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com >
Reviewed-by: @mbelinky
2026-03-09 22:17:19 +01:00
Mariano
e6e4169e82
acp: fail honestly in bridge mode ( #41424 )
...
Merged via squash.
Prepared head SHA: b5e6e13afe132747814+mbelinky@users.noreply.github.com >
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com >
Reviewed-by: @mbelinky
2026-03-09 22:01:30 +01:00
Pejman Pour-Moezzi
14bbcad169
fix(acp): propagate setSessionMode gateway errors to client ( #41185 )
...
* fix(acp): propagate setSessionMode gateway errors to client
* fix: add changelog entry for ACP setSessionMode propagation (#41185 ) (thanks @pejmanjohn)
---------
Co-authored-by: Pejman Pour-Moezzi <481729+pejmanjohn@users.noreply.github.com >
Co-authored-by: Onur <onur@textcortex.com >
2026-03-09 17:50:38 +01:00
Pejman Pour-Moezzi
eab39c721b
fix(acp): map error states to end_turn instead of unconditional refusal ( #41187 )
...
* fix(acp): map error states to end_turn instead of unconditional refusal
* fix: map ACP error stop reason to end_turn (#41187 ) (thanks @pejmanjohn)
---------
Co-authored-by: Pejman Pour-Moezzi <481729+pejmanjohn@users.noreply.github.com >
Co-authored-by: Onur <onur@textcortex.com >
2026-03-09 17:37:33 +01:00
Mariano
e3df94365b
ACP: add optional ingress provenance receipts ( #40473 )
...
Merged via squash.
Prepared head SHA: b63e46dd94132747814+mbelinky@users.noreply.github.com >
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com >
Reviewed-by: @mbelinky
2026-03-09 04:19:03 +01:00
Peter Steinberger
68775745d2
fix: restore acp session meta narrowing
2026-03-08 18:40:15 +00:00
Peter Steinberger
f6cb77134c
refactor: centralize acp session resolution guards
2026-03-08 18:40:14 +00:00
Vincent Koc
4062aa5e5d
Gateway: add safer password-file input for gateway run ( #39067 )
...
* CLI: add gateway password-file option
* Docs: document safer gateway password input
* Update src/cli/gateway-cli/run.ts
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
* Tests: clean up gateway password temp dirs
* CLI: restore gateway password warning flow
* Security: harden secret file reads
---------
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
2026-03-07 18:20:17 -08:00
Peter Steinberger
6a8081a7f3
refactor(routing): centralize inbound last-route policy
2026-03-08 02:16:03 +00:00
Josh Avant
25252ab5ab
gateway: harden shared auth resolution across systemd, discord, and node host
2026-03-07 18:28:32 -06:00
Vincent Koc
e4d80ed556
CI: restore main detect-secrets scan ( #38438 )
...
* Tests: stabilize detect-secrets fixtures
* Tests: fix rebased detect-secrets false positives
* Docs: keep snippets valid under detect-secrets
* Tests: finalize detect-secrets false-positive fixes
* Tests: reduce detect-secrets false positives
* Tests: keep detect-secrets pragmas inline
* Tests: remediate next detect-secrets batch
* Tests: tighten detect-secrets allowlists
* Tests: stabilize detect-secrets formatter drift
2026-03-07 10:06:35 -08:00
Peter Steinberger
3c71e2bd48
refactor(core): extract shared dedup helpers
2026-03-07 10:41:05 +00:00
Drew Wagner
ae96a81916
fix: strip skill-injected env vars from ACP harness spawn env ( #36280 ) ( #36316 )
...
* fix: strip skill-injected env vars from ACP harness spawn env
Skill apiKey entries (e.g., openai-image-gen with primaryEnv=OPENAI_API_KEY)
are set on process.env during agent runs and only reverted after the run
completes. ACP harnesses like Codex CLI inherit these vars, causing them
to silently use API billing instead of their own auth (e.g., OAuth).
The fix tracks which env vars are actively injected by skill overrides in
a module-level Set (activeSkillEnvKeys) and strips them in
resolveAcpClientSpawnEnv() before spawning ACP child processes.
Fixes #36280
* ACP: type spawn env for stripped keys
* Skills: cover active env key lifecycle
* Changelog: note ACP skill env isolation
* ACP: preserve shell marker after env stripping
---------
Co-authored-by: Vincent Koc <vincentkoc@ieee.org >
2026-03-06 18:18:13 -05:00
Bob
6a705a37f2
ACP: add persistent Discord channel and Telegram topic bindings ( #34873 )
...
* docs: add ACP persistent binding experiment plan
* docs: align ACP persistent binding spec to channel-local config
* docs: scope Telegram ACP bindings to forum topics only
* docs: lock bound /new and /reset behavior to in-place ACP reset
* ACP: add persistent discord/telegram conversation bindings
* ACP: fix persistent binding reuse and discord thread parent context
* docs: document channel-specific persistent ACP bindings
* ACP: split persistent bindings and share conversation id helpers
* ACP: defer configured binding init until preflight passes
* ACP: fix discord thread parent fallback and explicit disable inheritance
* ACP: keep bound /new and /reset in-place
* ACP: honor configured bindings in native command flows
* ACP: avoid configured fallback after runtime bind failure
* docs: refine ACP bindings experiment config examples
* acp: cut over to typed top-level persistent bindings
* ACP bindings: harden reset recovery and native command auth
* Docs: add ACP bound command auth proposal
* Tests: normalize i18n registry zh-CN assertion encoding
* ACP bindings: address review findings for reset and fallback routing
* ACP reset: gate hooks on success and preserve /new arguments
* ACP bindings: fix auth and binding-priority review findings
* Telegram ACP: gate ensure on auth and accepted messages
* ACP bindings: fix session-key precedence and unavailable handling
* ACP reset/native commands: honor fallback targets and abort on bootstrap failure
* Config schema: validate ACP binding channel and Telegram topic IDs
* Discord ACP: apply configured DM bindings to native commands
* ACP reset tails: dispatch through ACP after command handling
* ACP tails/native reset auth: fix target dispatch and restore full auth
* ACP reset detection: fallback to active ACP keys for DM contexts
* Tests: type runTurn mock input in ACP dispatch test
* ACP: dedup binding route bootstrap and reset target resolution
* reply: align ACP reset hooks with bound session key
* docs: replace personal discord ids with placeholders
* fix: add changelog entry for ACP persistent bindings (#34873 ) (thanks @dutifulbob)
---------
Co-authored-by: Onur <2453968+osolmaz@users.noreply.github.com >
2026-03-05 09:38:12 +01:00
Bob
61f7cea48b
fix: kill stuck ACP child processes on startup and harden sessions in discord threads ( #33699 )
...
* Gateway: resolve agent.wait for chat.send runs
* Discord: harden ACP thread binding + listener timeout
* ACPX: handle already-exited child wait
* Gateway/Discord: address PR review findings
* Discord: keep ACP error-state thread bindings on startup
* gateway: make agent.wait dedupe bridge event-driven
* discord: harden ACP probe classification and cap startup fan-out
* discord: add cooperative timeout cancellation
* discord: fix startup probe concurrency helper typing
* plugin-sdk: avoid Windows root-alias shard timeout
* plugin-sdk: keep root alias reflection path non-blocking
* discord+gateway: resolve remaining PR review findings
* gateway+discord: fix codex review regressions
* Discord/Gateway: address Codex review findings
* Gateway: keep agent.wait lifecycle active with shared run IDs
* Discord: clean up status reactions on aborted runs
* fix: add changelog note for ACP/Discord startup hardening (#33699 ) (thanks @dutifulbob)
---------
Co-authored-by: Onur <2453968+osolmaz@users.noreply.github.com >
2026-03-04 10:52:28 +01:00
Viz
0b3bbfec06
fix(gateway+acp): thread stopReason through final event to ACP bridge ( #24867 )
...
Complete the stop reason propagation chain so ACP clients can
distinguish end_turn from max_tokens:
- server-chat.ts: emitChatFinal accepts optional stopReason param,
includes it in the final payload, reads it from lifecycle event data
- translator.ts: read stopReason from the final payload instead of
hardcoding end_turn
Chain: LLM API → run.ts (meta.stopReason) → agent.ts (lifecycle event)
→ server-chat.ts (final payload) → ACP translator (PromptResponse)
2026-03-03 00:40:54 -05:00
Josh Avant
806803b7ef
feat(secrets): expand SecretRef coverage across user-supplied credentials ( #29580 )
...
* feat(secrets): expand secret target coverage and gateway tooling
* docs(secrets): align gateway and CLI secret docs
* chore(protocol): regenerate swift gateway models for secrets methods
* fix(config): restore talk apiKey fallback and stabilize runner test
* ci(windows): reduce test worker count for shard stability
* ci(windows): raise node heap for test shard stability
* test(feishu): make proxy env precedence assertion windows-safe
* fix(gateway): resolve auth password SecretInput refs for clients
* fix(gateway): resolve remote SecretInput credentials for clients
* fix(secrets): skip inactive refs in command snapshot assignments
* fix(secrets): scope gateway.remote refs to effective auth surfaces
* fix(secrets): ignore memory defaults when enabled agents disable search
* fix(secrets): honor Google Chat serviceAccountRef inheritance
* fix(secrets): address tsgo errors in command and gateway collectors
* fix(secrets): avoid auth-store load in providers-only configure
* fix(gateway): defer local password ref resolution by precedence
* fix(secrets): gate telegram webhook secret refs by webhook mode
* fix(secrets): gate slack signing secret refs to http mode
* fix(secrets): skip telegram botToken refs when tokenFile is set
* fix(secrets): gate discord pluralkit refs by enabled flag
* fix(secrets): gate discord voice tts refs by voice enabled
* test(secrets): make runtime fixture modes explicit
* fix(cli): resolve local qr password secret refs
* fix(cli): fail when gateway leaves command refs unresolved
* fix(gateway): fail when local password SecretRef is unresolved
* fix(gateway): fail when required remote SecretRefs are unresolved
* fix(gateway): resolve local password refs only when password can win
* fix(cli): skip local password SecretRef resolution on qr token override
* test(gateway): cast SecretRef fixtures to OpenClawConfig
* test(secrets): activate mode-gated targets in runtime coverage fixture
* fix(cron): support SecretInput webhook tokens safely
* fix(bluebubbles): support SecretInput passwords across config paths
* fix(msteams): make appPassword SecretInput-safe in onboarding/token paths
* fix(bluebubbles): align SecretInput schema helper typing
* fix(cli): clarify secrets.resolve version-skew errors
* refactor(secrets): return structured inactive paths from secrets.resolve
* refactor(gateway): type onboarding secret writes as SecretInput
* chore(protocol): regenerate swift models for secrets.resolve
* feat(secrets): expand extension credential secretref support
* fix(secrets): gate web-search refs by active provider
* fix(onboarding): detect SecretRef credentials in extension status
* fix(onboarding): allow keeping existing ref in secret prompt
* fix(onboarding): resolve gateway password SecretRefs for probe and tui
* fix(onboarding): honor secret-input-mode for local gateway auth
* fix(acp): resolve gateway SecretInput credentials
* fix(secrets): gate gateway.remote refs to remote surfaces
* test(secrets): cover pattern matching and inactive array refs
* docs(secrets): clarify secrets.resolve and remote active surfaces
* fix(bluebubbles): keep existing SecretRef during onboarding
* fix(tests): resolve CI type errors in new SecretRef coverage
* fix(extensions): replace raw fetch with SSRF-guarded fetch
* test(secrets): mark gateway remote targets active in runtime coverage
* test(infra): normalize home-prefix expectation across platforms
* fix(cli): only resolve local qr password refs in password mode
* test(cli): cover local qr token mode with unresolved password ref
* docs(cli): clarify local qr password ref resolution behavior
* refactor(extensions): reuse sdk SecretInput helpers
* fix(wizard): resolve onboarding env-template secrets before plaintext
* fix(cli): surface secrets.resolve diagnostics in memory and qr
* test(secrets): repair post-rebase runtime and fixtures
* fix(gateway): skip remote password ref resolution when token wins
* fix(secrets): treat tailscale remote gateway refs as active
* fix(gateway): allow remote password fallback when token ref is unresolved
* fix(gateway): ignore stale local password refs for none and trusted-proxy
* fix(gateway): skip remote secret ref resolution on local call paths
* test(cli): cover qr remote tailscale secret ref resolution
* fix(secrets): align gateway password active-surface with auth inference
* fix(cli): resolve inferred local gateway password refs in qr
* fix(gateway): prefer resolvable remote password over token ref pre-resolution
* test(gateway): cover none and trusted-proxy stale password refs
* docs(secrets): sync qr and gateway active-surface behavior
* fix: restore stability blockers from pre-release audit
* Secrets: fix collector/runtime precedence contradictions
* docs: align secrets and web credential docs
* fix(rebase): resolve integration regressions after main rebase
* fix(node-host): resolve gateway secret refs for auth
* fix(secrets): harden secretinput runtime readers
* gateway: skip inactive auth secretref resolution
* cli: avoid gateway preflight for inactive secret refs
* extensions: allow unresolved refs in onboarding status
* tests: fix qr-cli module mock hoist ordering
* Security: align audit checks with SecretInput resolution
* Gateway: resolve local-mode remote fallback secret refs
* Node host: avoid resolving inactive password secret refs
* Secrets runtime: mark Slack appToken inactive for HTTP mode
* secrets: keep inactive gateway remote refs non-blocking
* cli: include agent memory secret targets in runtime resolution
* docs(secrets): sync docs with active-surface and web search behavior
* fix(secrets): keep telegram top-level token refs active for blank account tokens
* fix(daemon): resolve gateway password secret refs for probe auth
* fix(secrets): skip IRC NickServ ref resolution when NickServ is disabled
* fix(secrets): align token inheritance and exec timeout defaults
* docs(secrets): clarify active-surface notes in cli docs
* cli: require secrets.resolve gateway capability
* gateway: log auth secret surface diagnostics
* secrets: remove dead provider resolver module
* fix(secrets): restore gateway auth precedence and fallback resolution
* fix(tests): align plugin runtime mock typings
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-03-03 02:58:20 +00:00
Peter Steinberger
287606e445
feat(acp): add kimi harness support surfaces
2026-03-03 01:05:24 +00:00
