* fix(usage-bar): clear dead watcher reference after transient error
When a usage bar template file watcher hits a transient error, the error
handler closes the FSWatcher but leaves entry.watcher pointing to the
closed instance. loadUsageBarTemplate treats a truthy cached.watcher
as "still watching" and never re-reads the file, so a template that
became invalid stays stuck at the default forever.
Clear entry.watcher after closing so the next access that needs a
re-read can create a fresh watcher.
This matches the pattern from #109682 (config hot-reload watcher
recovery).
* fix(usage-bar): invalidate cached template on watcher error
Clear both entry.watcher and entry.template when the FSWatcher errors
so the next loadUsageBarTemplate call re-reads from disk and creates a
fresh watcher. Previously only the watcher reference was cleared,
leaving a valid cached template that never observed future file edits.
This addresses the remaining valid-cache recovery gap from #109682.
* fix(usage-bar): fix no-promise-executor-return lint in test
* fix(config): bound state-directory .env file reads with size limit
Replace unbounded fs.readFileSync with readRegularFileSync capped at
1 MiB (MAX_STATE_DIR_DOTENV_BYTES) so an oversized .env file is
rejected before loading the entire file into memory.
Resolve symlinks via fs.realpathSync before the bounded read so
symlinked .env files keep working — matching the marketplace.ts
pattern for bounded manifest reads.
* fix(config): add diagnostic when oversized state .env is skipped
Log a warning when the state-directory .env file exceeds the 1 MiB
limit so operators know a configured file was skipped — matching the
pattern from #108200 (plugin catalog bounded read diagnostic).
* fix(config): bound global runtime dotenv file reads with size limit
Replace unbounded fs.readFileSync in readDotEnvFile with readRegularFileSync
capped at 1 MiB so CLI/Gateway startup dotenv loading also gets the bounded
read protection — not just the state-dir service-env path.
This addresses the P1 review finding that the original fix only capped the
helper-level reader while the shared readDotEnvFile used by
loadGlobalRuntimeDotEnvFiles was still unbounded.
* fix(config): bound external catalog file reads with size limit
Replace unbounded fs.readFileSync with readRegularFileSync capped at
16 MiB (MAX_EXTERNAL_CATALOG_BYTES) to prevent memory exhaustion from
oversized or malicious plugin catalog files.
Resolve symlinks via fs.realpathSync before the bounded read so
symlinked catalog files keep working — matching the marketplace.ts
pattern for bounded manifest reads.
* fix(config): add diagnostic when oversized catalog is skipped
Log a warning when an external catalog file exceeds the 16 MiB limit
so operators know a configured file was skipped. Add regression test
verifying the oversized catalog is skipped and selection continues.
* fix(config): fix false-positive oversized catalog test
Replace the broken spy-on-object-literal mock with a real sparse file
that genuinely triggers readRegularFileSync rejection via stat.size.
The previous vi.spyOn({ readRegularFileSync }, ...) intercepted a
throwaway object, never the actual module import, so the test passed
regardless of whether the fix was applied or not.
Also fix the no-unused-expressions lint error on the env-primary
assertion that used a discarded ternary (? undefined : undefined)
instead of a proper expect assertion.
Reload the current on-disk config once replacement native or polling watchers finish their initial scan, so edits made during recovery backoff are not lost.
* fix(litellm): guard loopback hostname auto-allow with isIP to prevent DNS bypass
The isAutoAllowedLitellmHostname helper auto-enables private-network access
for loopback-style hosts. Before this fix, lowered.startsWith("127.")
matched DNS hostnames like 127.evil.com, letting remote endpoints bypass
the explicit allowPrivateNetwork opt-in — a SSRF risk.
Add isIP(host)===4 guard so only literal IPv4 loopback addresses qualify.
Same canonical pattern as extensions/slack/src/monitor/relay-source.ts:271
and the codex loopback fix.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(litellm): cover loopback endpoint policy
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(cron): support current and session: targets in initial delivery resolution
resolveInitialCronDelivery only checked sessionTarget === 'isolated' for
default announce delivery. All other cron paths (delivery-plan.ts:106-114,
normalize.ts:680-684, jobs.ts:288-298) already treat 'isolated', 'current',
and 'session:' as equivalent. This gap meant cron jobs created with
--session-target current or --session-target session:... would not get
default announce delivery at creation time.
Real behavior proof:
Input: sessionTarget='current', payload.kind='agentTurn'
OLD: undefined <- missing default announce delivery
NEW: {mode:'announce'} <- consistent with other cron code paths
Co-Authored-By: Claude <noreply@anthropic.com>
* test(cron): add typed initial delivery resolution tests for all session targets
* test(cron): document direct-service delivery contract and cover service callers
* refactor(cron): centralize detached-delivery-target predicate into shared helper
Extract isDetachedDeliveryTarget(sessionTarget, payloadKind) in normalize.ts
and use it from all three callers:
- normalizeCronJobInput (write-time default, normalize.ts)
- resolveCronDeliveryPlan (read-time default, delivery-plan.ts)
- resolveInitialCronDelivery (service-bypass default, initial-delivery.ts)
This removes the third manually synchronized copy that the original PR
added, addressing ClawSweeper P1 finding.
* fix(cron): align initial delivery targets
Co-authored-by: 陈宪彪0668000387 <chen.xianbiao@xydigit.com>
* test(cron): consolidate initial delivery coverage
Co-authored-by: 陈宪彪0668000387 <chen.xianbiao@xydigit.com>
* test(cron): keep delivery matrix type-safe
Co-authored-by: 陈宪彪0668000387 <chen.xianbiao@xydigit.com>
* chore: keep release note in PR metadata
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(imessage): keep fast progress out of chat
* test(imessage): require fast progress callback
---------
Co-authored-by: Omar Shahine <10343873+omarshahine@users.noreply.github.com>
* fix(whatsapp): evaluate mention patterns when other members are @-mentioned
isBotMentionedFromTargets returned false as soon as a group message
carried native @-mentions that did not include the bot, so the
configured mentionPatterns were never evaluated and a message like
'marlow, look at @SomeoneElse's message' was silently dropped by the
requireMention gate (#109488).
Fall through to the configured text mentionPatterns when the native
@-mention JIDs do not include the bot. The loose self-number digit
fallback stays suppressed in that shape: an @-tag of another member
injects that member's number into the body, so substring digit
matching is unreliable there.
Fixes#109488
* refactor(whatsapp): unify mention pattern gating
---------
Co-authored-by: Marcus Castro <mcaxtr@openclaw.ai>
* fix(agents): use fatal UTF-8 decoding in provider response readers
* fix(agents): use fatal UTF-8 decoding only for JSON responses, preserve compatibility for text
* fix(scripts): bound duplicate PR closure GitHub lookups
The duplicate PR closure helper performs multiple sequential gh API
reads and writes after a merge. Each call used execFileSync without a
timeout, so one stalled GitHub request could block the surrounding
workflow job until it expires.
Add a 60-second timeout and SIGKILL to the default gh runner, applied
to both read-only lookups and pr edit writes that forward stdin.
* test(scripts): add real behavior proof for duplicate PR closure timeout
Add two live subprocess tests using the real spawnSync (not mocked) to
prove the timeout + SIGKILL surface works against actual child
processes:
- A 1 ms timeout against a long-running node subprocess proves
SIGKILL is delivered and the timeout triggers correctly.
- A fast node -e 0 subprocess with the production 60-second bound
proves the timeout does not false-positive on healthy completions.
Switch the vi.mock to a partial mock using importOriginal so
spawnSync remains the real implementation for live tests while
execFileSync stays mocked for the DI-based option assertions.
* refactor(scripts): inject duplicate closure GitHub runner
* fix(scripts): declare trusted tooling pin validator
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(thread-ownership): bound 409 response read and preserve cancel semantics
The thread-ownership 409 conflict path still used unbounded resp.json(),
inconsistent with the bounded readers shipped across the other channel/provider
success paths. A compromised or buggy forwarder returning a multi-GB 409 body
would buffer the entire body before JSON.parse, OOMing the agent.
Bound the 409 body via readResponseTextLimited (8 KiB cap; a 409 owner field is
~30 bytes). Wrap the parse in try/catch so a truncated or malformed 409 body
still cancels the send (owner logged as "unknown") — the 409 status itself
means another agent owns this thread, independent of body parseability.
The discord webhook and huggingface /v1/models success reads from the original
PR were superseded upstream by #98098 and #101079 (readProviderJsonResponse),
so this branch now carries only the thread-ownership fix.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(thread-ownership): bound forwarder conflict handling
---------
Co-authored-by: Claude <noreply@anthropic.com>
Add optional per-job pacing bounds across the cron API, CLI, tool schema, public output, and SQLite job envelope, requiring at least one bound. Allow only the currently running paced job to record a one-shot next_check proposal and carry it through isolated-run completion.
After successful runs, clamp the proposal to the job bounds and persist an exact one-shot slot marker so maintenance preserves only that timestamp. Clear the marker on runs, edits, and schedule normalization; preserve existing no-proposal, skip, timeout, and error scheduling behavior.
* fix(scripts): bound release CI summary GitHub lookups
The release CI summary helper performs multiple sequential gh API reads
during full release validation. Each read used execFileSync without a
timeout, so one stalled GitHub request could block the surrounding
workflow job until it expires.
Route the default gh runner through a caller-owned execFileSync with a
60-second timeout and SIGKILL, and apply the same bound to artifact zip
downloads. The runner accepts an execFileSyncImpl injection so the
timeout contract can be tested without a slow timer-based test.
* test(scripts): add real behavior proof for release CI summary timeout
Add two live subprocess tests alongside the existing mocked tests:
- A 1 ms timeout against a real gh subprocess proves the SIGKILL +
timeout surface works on actual child processes (not only mocks).
- A fast node -e 0 subprocess with the production 60-second bound
proves the timeout does not false-positive on healthy completions.
The runReleaseCiGh runner now accepts an optional timeoutMs parameter
so tests can exercise a shorter timeout without changing the production
default.
* refactor(scripts): share bounded release GitHub runner
* test(scripts): keep release runner assertions type-safe
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix: bound misc unbounded fs.readFile calls; remove unused fs import
* fix: decode buffer to string before passing to string consumers
readRegularFile and readRegularFileSync return { buffer, stat },
not a string. All 4 new call sites passed the raw object to functions
expecting a string (JSON.parse, RegExp.test, template literals, etc.),
causing TS2345 type errors and runtime failures.
Fix each call by extracting .buffer and calling .toString('utf8')
before passing the result to string consumers.
* style: fix oxfmt formatting in config-set-input.ts
* fix: bound config and trajectory metadata reads
Co-authored-by: 陈宪彪0668000387 <chen.xianbiao@xydigit.com>
* refactor: isolate bounded read ownership
Co-authored-by: 陈宪彪0668000387 <chen.xianbiao@xydigit.com>
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
