Vincent Koc
e0635eb6fd
fix(release): bound npm release checks
2026-05-28 14:20:01 +02:00
Vincent Koc
4ce3c3e36c
fix(test): rebuild startup memory artifacts
2026-05-28 14:14:34 +02:00
Vincent Koc
653e8d1ea5
fix(release): bound prepack subprocesses
2026-05-28 14:14:13 +02:00
Vincent Koc
98d6331d10
fix(release): bound release check commands
2026-05-28 14:11:55 +02:00
Vincent Koc
2b0e399da1
fix(release): bound npm verifier commands
2026-05-28 14:06:46 +02:00
Vincent Koc
b234aa0085
fix(e2e): bound bundled plugin selection
2026-05-28 14:03:24 +02:00
Vincent Koc
cee364e2f6
fix(docker): bound package capture output
2026-05-28 14:01:02 +02:00
Vincent Koc
259796dc3d
fix(test): bound package candidate command output
2026-05-28 13:26:16 +02:00
Vincent Koc
d64b394537
fix(test): bound extension memory profiler output
2026-05-28 13:22:57 +02:00
Vincent Koc
88c395c83c
fix(test): wait for credential timeout cleanup
2026-05-28 13:17:35 +02:00
Vincent Koc
beb25d60f7
fix(test): escalate e2e watchdog termination
2026-05-28 13:03:29 +02:00
Vincent Koc
9fef53c3b1
fix(test): keep upgrade survivor runtime state local
2026-05-28 12:30:58 +02:00
Vincent Koc
dc5671edae
fix(install): harden Windows git installs
2026-05-28 11:47:05 +02:00
Peter Steinberger
7275304793
fix(parallels): guard release target harness mismatch
2026-05-28 10:11:40 +01:00
Vincent Koc
13dcded7c8
fix(release): bound cross-os fetch bodies
2026-05-28 10:38:08 +02:00
Vincent Koc
9f7006407f
fix(scripts): bound audit advisory error bodies
2026-05-28 10:22:44 +02:00
Vincent Koc
23f494cba9
fix(scripts): bound docker preflight capture
2026-05-28 09:59:51 +02:00
Vincent Koc
744da7e6bd
fix(scripts): bound gh read error bodies
2026-05-28 09:47:07 +02:00
Peter Steinberger
a0cf1858a2
fix(release): pin ClawHub publish workdir
2026-05-28 08:37:06 +01:00
Vincent Koc
1395d71821
fix(scripts): bound labeler error bodies
2026-05-28 09:24:40 +02:00
Vincent Koc
05f357b13b
fix(scripts): bound memory fd ready output
2026-05-28 09:05:47 +02:00
Vincent Koc
0ade360da5
fix(scripts): bound gateway watch log capture
2026-05-28 08:45:18 +02:00
Peter Steinberger
13427276b8
fix(release): speed windows upgrade fallback
2026-05-28 07:01:55 +01:00
Peter Steinberger
97717277c4
fix(release): close cross-os artifact sockets
2026-05-28 07:01:55 +01:00
Dallin Romney
53704b26e8
perf(ci): instrument build artifacts phases ( #87514 )
2026-05-27 22:31:32 -07:00
Vincent Koc
d10d30c5fa
fix(test): harden startup benchmark harness
2026-05-28 06:53:58 +02:00
Vincent Koc
6ae4a00a66
fix(qa): reject loose openwebui probe timeouts
2026-05-28 06:27:04 +02:00
Dallin Romney
8d21ac3f6e
refactor: share QA runtime helpers ( #87412 )
...
* refactor: share QA runtime helpers
* refactor: keep QA helpers private
* refactor: keep QA helpers on private runtime seam
* chore: prune stale QA duplicate ignores
* fix: align qa runtime boundary alias
* fix: avoid startup memory lint conversion
2026-05-27 21:16:24 -07:00
Vincent Koc
6adf2340fb
fix(qa): parse kitchen sink rpc guardrails strictly
2026-05-28 06:05:24 +02:00
Vincent Koc
6a324f6400
fix(perf): keep abort leak thresholds active
2026-05-28 05:29:40 +02:00
Agustin Rivera
b860a0d4d0
fix: harden qqbot direct media uploads
...
Harden QQBot direct media URL uploads by downloading through the local SSRF guard before QQ upload, disabling redirects, bounding fetch/setup and body reads, and routing downloaded buffers through the existing one-shot/chunked size gate.
Co-authored-by: Agustin Rivera <agustin@rivera-web.com >
2026-05-28 04:21:46 +01:00
Vincent Koc
f5e48f767f
fix(perf): keep startup memory budgets active
2026-05-28 05:07:34 +02:00
Vincent Koc
bf22893cb6
fix(perf): reject loose extension memory numeric flags
2026-05-28 04:57:51 +02:00
Vincent Koc
6fe7dddcf2
fix(qa): reject loose Docker scheduler numeric env
2026-05-28 04:48:56 +02:00
Vincent Koc
3ef34702c8
fix(qa): reject loose gateway CPU numeric flags
2026-05-28 04:38:41 +02:00
Peter Steinberger
2229122077
fix: keep private SDK declarations local
2026-05-28 03:28:27 +01:00
Vincent Koc
ac28c0611d
fix(qa): reject loose gauntlet numeric flags
2026-05-28 04:24:13 +02:00
Dallin Romney
3005b62242
perf(plugins) refactor plugin SDK declarations for flat package types ( #87165 )
...
* refactor: flatten plugin sdk declarations
* fix: align package inventory with flat sdk declarations
* refactor: move packed sdk smoke to fixture
* test: simplify packed sdk type smoke
* fix(canvas): use focused number runtime helpers
* fix(ci): stabilize sdk boundary checks
* test: guard private sdk declaration leaks
Co-authored-by: Peter Steinberger <steipete@gmail.com >
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-05-27 19:22:32 -07:00
Vincent Koc
d1577a2ff2
fix(perf): reject invalid startup bench counts
2026-05-28 03:48:55 +02:00
Peter Steinberger
cee2a50fe6
chore(release): prepare 2026.5.28
2026-05-28 01:48:07 +01:00
Peter Steinberger
c86667c5cf
test(discord): use reply payload SDK test helper ( #87454 )
...
* test(discord): use reply payload SDK test helper
* build(plugin-sdk): exclude reply payload test helper
2026-05-28 00:57:22 +01:00
Edward Abrams
05db911775
fix(outbound): thread session keys into outbound hooks ( #73706 )
...
Thread the canonical outbound session key into plugin message_sending and message_sent hook contexts, and align native command redirect routed delivery with the agent runtime session key. This lets plugins correlate agent_end with outbound delivery hooks without seeing missing or divergent session keys.
Verification:
- gh pr checks 73706 --repo openclaw/openclaw --watch=false
- Real behavior proof: https://github.com/openclaw/openclaw/actions/runs/26526635074/job/78131933497
Thanks @zeroaltitude.
Co-authored-by: Edward Abrams <zeroaltitude@gmail.com >
2026-05-28 00:43:27 +01:00
Peter Steinberger
1f1cdd84ea
chore: forward gateway profiling env
2026-05-28 00:35:35 +01:00
lukeboyett
b5bd6e8828
fix(sessions): preserve Matrix room-id case in session keys ( #75670 ) ( #87366 )
...
* fix(sessions): preserve Matrix room-id case in session keys (#75670 )
Matrix room IDs (and thread event IDs) are opaque, case-sensitive per the
Matrix spec, but session-key canonicalization lowercased them. That forked
one room into duplicate sessions and produced 403 M_FORBIDDEN on recovery /
delivery paths that reconstruct the target from the (lowercased) session key,
even though deliveryContext.to stayed correct.
Introduce a generic, opt-in case-preservation registry (CASE_PRESERVING_PEERS)
consulted at all three lowercasing sites:
- construction: normalizeSessionPeerId
- store canonicalization: normalizeSessionKeyPreservingOpaquePeerIds
- gateway send: explicit request.sessionKey
Signal group preservation is encoded to match prior behavior exactly (segment
span, unscoped, thread suffix still lowercased). Matrix channel/group enrolls
the opaque tail (room id with embedded :server + any 🧵 <event> suffix).
Exact mixed-case keys now win over folded legacy aliases in
resolveSessionStoreEntry and delivery-info lookup; existing lowercased rows
collapse on the next write. Matrix DM/MXID and non-enrolled channels keep the
default lowercase behavior.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com >
* fix(sessions): guard Matrix folded alias delivery proof
* test(agents): cover cold OpenAI gpt-5.5 fallback
* fix(sessions): preserve non-opaque alias freshness
* fix(sessions): prevent Matrix cross-room thread recovery
* build(protocol): refresh tools effective Swift models
* test(codex): include effective cwd in startup fixture
* test(codex): align startup failure cleanup expectation
* fix(sessions): keep Signal folded aliases fresh
* fix(sessions): preserve unscoped Matrix room keys
* fix(sessions): recover legacy Matrix thread aliases
* fix(sessions): preserve Matrix keys in state migrations
* fix(sessions): keep Matrix structural alias freshness
* fix(sessions): preserve unscoped Matrix migration keys
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com >
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-05-28 00:26:49 +01:00
samzong
316fd5b625
[Fix] Warm provider auth off main thread ( #86281 )
...
* fix(agents): warm provider auth off main thread
Signed-off-by: samzong <samzong.lu@gmail.com >
* fix(agents): keep provider auth warm read-only
* fix(ci): unblock provider auth landing
* ci: serialize gateway watch artifact check
* fix(ci): stabilize diffs viewer asset generation
* fix(agents): avoid stale plugin auth warm results
* fix(agents): keep partial auth warm cache
---------
Signed-off-by: samzong <samzong.lu@gmail.com >
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-05-27 23:24:55 +01:00
Vincent Koc
53ad531df9
fix(crabbox): preserve sparse run artifacts
2026-05-28 00:20:39 +02:00
Vincent Koc
f39f1a4712
fix(e2e): bound MCP channel harness buffers
2026-05-27 22:34:08 +02:00
Peter Steinberger
bb46b79d3c
refactor: internalize OpenClaw agent runtime ( #85341 )
...
* refactor: extract agent core package
Introduce packages/agent-core as the OpenClaw-owned home for reusable agent loop, harness, session, prompt, and runtime dependency contracts.
* refactor: extract shared llm runtime
Move provider model registries, stream wrappers, OAuth helpers, and LLM utilities into src/llm with plugin-sdk barrels instead of depending on the old embedded runtime layout.
* refactor: remove pi runtime internals
Rename remaining Pi-shaped agent surfaces to OpenClaw agent runtime names, delete obsolete Pi docs and package graph checks, and add the third-party notice for incorporated code.
* refactor: tighten agent session runtime
Make agent-core/runtime dependencies explicit, consolidate compaction and session transcript helpers, and move model/session helpers behind OpenClaw-owned contracts.
* refactor: remove static model and pi auth paths
Drop static model catalogs and Pi auth bridges, move model/provider facts to manifest-owned runtime contracts, and harden internal embedded-agent utilities.
* refactor: remove legacy provider compat paths
* docs: remove agent parity notes
* fix: skip provider wildcard metadata parsing
* refactor: share session extension sdk loading
* refactor: inline acpx proxy error formatter
* refactor: fold edit recovery into edit tool
* fix: accept extension batch separator
* test: align startup provider plugin expectations
* fix: restore provider-scoped release discovery
* test: align static asset packaging expectations
* fix: run static provider catalogs during scoped discovery
* fix: add provider entry catalogs for scoped live discovery
* fix: load lightweight provider catalog entries
* fix: refresh provider-scoped plugin metadata
* fix: keep provider catalog entries on release live path
* fix: keep static manifest models in release live checks
* fix: harden release model discovery
* fix: reduce OpenAI live cache probe reasoning
* fix: disable OpenAI cache probe reasoning
* ci: extend OpenAI gateway live timeout
* fix: extend live gateway model budget
* fix: stabilize release validation regressions
* fix: honor provider aliases in model rows
* fix: stabilize release validation lanes
* fix: stabilize release memory qa
* ci: stabilize release validation lanes
* ci: prefer ipv4 for live docker node calls
* fix: restore shared tool-call stream wrapper
* ci: remove legacy pi test shard alias
* fix: clean up embedded agent test drift
* fix: stabilize runtime alias status
* fix: clean up embedded agent ci drift
* fix: restore release ci invariants
* fix: clean up post-rebase runtime drift
* fix: restore release ci checks
* fix: restore release ci after rebase
* fix: remove stale pi runtime path
* test: align compaction runtime expectations
* test: update plugin prerelease expectations
* fix: handle claude live tool approvals
* fix: stabilize release validation gates
* fix: finish agent runtime import
* test: finish post-rebase agent runtime mocks
* fix: keep codex compaction native
* fix: stabilize codex app-server hook tests
* test: isolate codex diagnostic active run
* test: remove codex diagnostic completion race
# Conflicts:
# extensions/codex/src/app-server/run-attempt.test.ts
* ci: fix full release manifest performance run id
* refactor: narrow llm plugin sdk boundary
* chore: drop generated google boundary stamps
* fix: repair rebase fallout
* fix: clean up rebased runtime references
* fix: decode codex jwt payloads as base64url
* fix: preserve shipped pi runtime alias
* fix: add scoped sdk virtual modules
* fix: decode llm codex oauth jwt as base64url
* fix: avoid stale vertex adc negative cache
* fix: harden tool arg decoding and codeql path
* fix: keep vertex adc negative checks live
* refactor: consolidate codex jwt and edit helpers
* fix: await codex oauth node runtime imports
* fix: preserve sdk tool and notice contracts
* fix: preserve shipped compat config boundaries
* fix: align codex oauth callback host
* fix: terminate agent-core loop streams on failure
* fix: keep codex oauth callback alive during fallback
* ci: include session tools in critical codeql scans
* fix: keep Cloudflare Anthropic provider auth header
* docs: redirect legacy pi runtime pages
* fix: honor bundled web provider compat discovery
* fix: protect session output spill files
* fix: keep legacy agent dir env blocked
* fix: contain auto-discovered skill symlinks
* fix: harden agent core sdk proxy surfaces
* fix: restore approval reaction sdk compat
* fix: keep live docker runs bounded
* fix: keep codex oauth redirect host aligned
* fix: resolve post-rebase agent runtime drift
* fix: redact anthropic oauth parse failures
* fix: preserve responses strict tool shaping
* fix: repair agent runtime rebase cleanup
* docs: redirect retired parity pages
* fix: bound auto-discovered resources to roots
* fix: repair post-rebase agent test drift
* fix: preserve bundled provider allowlist migration
* fix: preserve manifest-owned provider aliases
* fix: declare photon image dependency
* fix: keep provider headers out of proxy body
* fix: preserve shipped env aliases
* fix: refresh control ui i18n generated state
* fix: quote read fallback paths
* fix: preview edits through configured backend
* test: satisfy core test typecheck
* fix: preserve ZAI usage auth fallback
* test: repair codex diagnostic test
* fix: repair agent runtime rebase drift
* test: finish embedded runner import rename
* fix: repair agent runtime rebase integrations
* test: align compaction oauth fallback expectations
* fix: allow sdk-auth session models
* fix: update doctor tool schema import
* fix: preserve bedrock plugin region
* fix: stream harmony-like prose immediately
* ci: include session runtime in codeql shards
* fix: repair latest rebase integrations
* fix: honor explicit codex websocket transport
* fix: keep openai-compatible credentials provider-scoped
* fix: refresh sdk api baseline after rebase
* fix: route cli runtime aliases through openclaw harness
* test: rename stale harness mock expectation
* test: rename embedded agent overflow calls
* test: clean embedded auth test wording
* test: use openclaw stream types in deepinfra cache test
* fix: refresh sdk api baseline on latest main
* fix: honor bundled discovery compat allowlists
* fix: refresh sdk api baseline after latest rebase
* fix: remove stale rebase imports
* test: rename stale model catalog mock
* test: mock renamed doctor runtime modules
* fix: map canonical kimi env auth
* fix: use internal model registry in bench script
* fix: migrate deepinfra provider catalog entry
* fix: enforce builtin tool suppression
* fix: route compaction auth and proxy payloads safely
* refactor: prune unused llm registry leftovers
* test: update codex hooks session import
* test: fix model picker ci coverage
* test: align model picker auth mock types
2026-05-27 19:24:04 +01:00
Dallin Romney
2c95752c1e
fix(diffs): align language pack host floor ( #87370 )
2026-05-27 11:13:50 -07:00
Vincent Koc
11ca150a1b
fix(testing): bound plugin gauntlet relay logs
2026-05-27 20:04:56 +02:00
