* fix(cron): cap trigger script tool access
Persist the creator tool cap for any cron job with a trigger script and pass it to the headless trigger runtime. System event and command payloads retain the cap across cron updates.
* fix(cron): persist trigger tool cap for systemEvent and command payloads
The creator tool cap is stamped on systemEvent and command payloads whenever a
cron job carries a trigger script, but the SQLite codec dropped
payload.toolsAllow for those kinds. After a gateway restart the reloaded job
carried no cap and the trigger regained the full coding surface. Persist and
restore toolsAllow through the existing payload_tools_allow_json column for all
payload kinds, and add restart-aware round-trip coverage.
* ci: re-trigger workflows (transient self-hosted runner flake)
* fix(cron): use expectDefined for store test job access
* refactor(cron): hoist cron tool types, payload merge, and wire types into companion modules
Keeps the oversized cron files at or below their baseline line counts for the
changed-file TypeScript LOC ratchet on main. No behavior change.
* fix(cron): retain freshly stamped cap markers
* test(ci): align compact shard count
* fix(cron): make trigger cap updates atomic
* fix(cron): preserve explicit cap provenance
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Co-authored-by: Peter Steinberger <peter@steipete.me>
* refactor(tui): move last session state to sqlite
* chore: keep release notes in PR body
* test: update doctor migration fixture
* chore: satisfy dead code export gate
* fix(github-copilot): reject unsupported OAuth enterprise domain before refresh and model routing
Legacy github-copilot OAuth credentials can carry a non-github.com
enterpriseUrl. The token-refresh path templated it into the endpoint and
sent the bearer refresh token there with no allowlist, and the model
routing path derived a base URL from the same credential, so an unexpired
credential kept routing its access token to that origin without ever
reaching a refresh.
A persisted credential origin that is not on the Copilot host allowlist
is now rejected before any request is issued and before any model URL is
produced. Because an off-allowlist origin means the stored access token
may itself have been minted by that origin, the credential is refused as
a whole rather than coerced to github.com: modifyModels withholds the
github-copilot models so the token has no route, and its proxy-ep is
never trusted. Login rejects an unsupported host up front, so every path
that turns a domain into a bearer-bearing URL validates first.
formatAuthDoctorHint guides affected users to re-authenticate, mirroring
the qwen-portal hint. Supported hosts are unchanged: github.com and
*.ghe.com data-residency tenants still route and refresh as before.
The allowlist plus a new isSupportedGithubCopilotDomain predicate move to
a dependency-free plugin-sdk leaf so the core OAuth runtime can share them
without closing a module cycle; plugin-sdk/provider-auth re-exports
normalizeGithubCopilotDomain, so the plugin-owned GitHub Copilot provider
keeps its existing import.
Fixes#103078.
* fix(github-copilot): resolve provider auth base conflict
* fix(github-copilot): resolve provider auth base conflict
* fix(github-copilot): validate token proxy endpoint
* fix(github-copilot): remove stale helper import
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Co-authored-by: Peter Steinberger <peter@steipete.me>
* fix(doctor): preserve allowlist entries for version-bound runtime plugins (codex) during stale config scan
* fix(doctor): restore codex to scanner stale expectation, protect at repair-sequencing
Scanner now flags codex in plugins.allow as stale so diagnostics are visible.
Repair-sequencing preserves the entry via preservePluginIds which already
includes VERSION_BOUND_RUNTIME_PLUGIN_IDS.
* fix(doctor): scope version-bound runtime plugin preservation to allow surface only
ClawSweeper P2: VERSION_BOUND_RUNTIME_PLUGIN_IDS was applied globally
across all stale config surfaces (deny, entries, slots, channels, etc.),
but only plugins.allow needs preservation. Move to a surface-scoped
parameter surfacePreservePluginIds so codex is preserved only in allow.
* fix(doctor): harden version-bound allowlist repair
* fix(doctor): retain version-bound plugin policy
* fix(doctor): align version-bound plugin diagnostics
Co-authored-by: hailory <hailory@xydigit.com>
---------
Co-authored-by: hailory <hailory@xydigit.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(config): reject zero-value resetArchiveRetention to prevent silent data loss
* fix: add braces to guard clauses for curly lint rule
* fix: normalize numeric values and cover pruneAfter fallback in migration
* fix: reject zero-value pruneAfter at schema level to close fallback gap
* fix: independently check and repair both retention fields in migration
* fix: split doctor diagnostics into field-specific rules and messages
* fix: remove unused local in migration test helper
* fix: repair 5 lint errors (curly braces, zero-fraction, narrow value)
* fix(doctor): rewrite zero resetArchiveRetention to false instead of deleting it
Deleting a zero resetArchiveRetention caused the runtime to fall back to
pruneAfter (default 30d), which contradicted the doctor output that
claimed archives would be kept indefinitely. Only an explicit false
value produces indefinite retention per the documented schema.
- P1: Rewrite zero resetArchiveRetention to false in the doctor
migration apply callback, matching the promised indefinite-retention
behavior.
- P3: Update the pruneAfter rule warning to describe eligible
stale/non-preserved session entries instead of "all sessions".
* fix(config): repair zero retention safely
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Co-authored-by: Peter Steinberger <peter@steipete.me>
* fix(config): warn before stripping JSON5 comments on config write
Add checkCommentLossWarning in json5-comments.ts to detect JSON5 comments
before config writes. Warn via deps.logger.warn for main config writes and
via options.warn for $include file writes. Both paths support skipOutputLogs
to suppress warnings during automated operations.
Fixes#105683
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(config): remove public warn callback, route through internal sink
Fixes#105683
- Remove warn field from exported ConfigWriteOptions (P1 merge-risk)
- Default checkCommentLossWarning to console.warn when no callback
- Move include warning after hash-conflict/rejection checks
- Update tests to spy on console.warn instead of custom callback
* fix(config): warn before stripping JSON5 comments
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Co-authored-by: Peter Steinberger <peter@steipete.me>
* refactor(plugin-sdk)!: delete the zero-consumer channel-ingress facade, AccessFacts projections, and dead dispatch aliases
* chore(plugin-sdk): refresh API baseline hash for the facade deletions
* fix(channels): drop dead AccessFacts field writes stranded by the facade deletion
* chore(plugin-sdk): refresh API baseline hash after rebase
