* fix(ui): restore chat flow e2e coverage
(cherry picked from commit 16a094eaec4ae121db09f67c094a41262aa9cefc)
* test(ui): align browser Talk mocks with voice sessions
(cherry picked from commit ef0649334539954b253ab8c51ff436bd8ce757c6)
* test(ui): wait for chat startup in update E2E
(cherry picked from commit 586e1046320dd56398fd8a3b995a1a465f6c6fe2)
* test(ui): update sidebar session route expectation
(cherry picked from commit 9692985027556fad7bb7819c8e140a101e181c47)
* test(ui): update session management e2e contracts
(cherry picked from commit 4e99348dabf08fb8886d55e25a9f9eda1dfe1056)
* test(ui): align Codex session E2E contracts
Update the catalog layout assertion for reorderable sibling sections, expose advanced plugin settings explicitly, and make adopted sessions resolvable through the current path router.
(cherry picked from commit 1a03f924a32facb23302c5618a2b15004feeccff)
* test(ui): align composer e2e with metadata hydration
(cherry picked from commit eca1902e773be32c993ddb22594925f7da82f98f)
* fix(ui): restore usage hint click behavior
(cherry picked from commit ea63b5dab7c3c54048a04d60703e529e5b900df6)
* fix(ui): give reveal-only tooltips an explicit click-to-open opt-in
#112602 made the shared tooltip dismiss on pointer activation so an action
button never strands one open. The usage summary hint exists only to be read,
so clicking it did nothing on touch or in browsers that skip focus on click.
Opt that trigger in rather than bouncing focus through blur/focus, which
briefly drops focus for assistive tech.
(cherry picked from commit 16d165857a4006ae0a0df42168f34a40f4cc9117)
* test(ui): follow sidebar dock resize ownership
(cherry picked from commit fd4792a2dd9fc81fc63f8c9e25291ff2246d235a)
* test(ui): prove the dock resize persists off its clamp
Asserting the post-End width equals SIDEBAR_MIN_WIDTH_PX compared the clamp
to itself across reload, so the check would pass even if the persisted width
were dropped and the column fell back to its minimum. Step off the clamp
first and assert that value survives.
(cherry picked from commit 3636124c326a93b80006ccc4064415ec1a6c2c9f)
* test(ui): align native link routing e2e contracts
Use a non-link bubble hit target after flat assistant styling, assert modified clicks at the routing boundary instead of relying on Chromium tab creation, and preserve native context menus for internal anchors.
(cherry picked from commit 55fbd3052a40c5c03f00f0bf595ef356ac0d1f10)
* test(ui): align native catalog host assertions
(cherry picked from commit 9db9a2fcd5633675a88296b2ccd874563a00cb80)
* test(ui): target tool outcome rollup at dashboard session
Completed-work groups are dashboard-only, so the legacy main session never rendered the disclosure exercised by this test.
(cherry picked from commit ba84b617ef038866451ad03491298349d966a54f)
* test(ui): track discussion panel close action
The flexible multi-sidebar layout replaced the generic Close sidebar action with a panel-specific Close Discussion action. Keep the E2E toggle proof aligned with that intentional accessible-name contract.
(cherry picked from commit 422b1f2bd8fae2a7571881d0455c3040c2ef2de9)
* test(ui): mock pairing list in WhatsApp logout e2e
(cherry picked from commit 3730de075bbb50071fc0cb57c007ab894688a7a1)
* test(ui): open build info from identity menu
(cherry picked from commit b1626a6a723ec13c2cf50444b4c7a65fec289213)
* fix(ui): let the board fixture host page own its theme
The fixture module unconditionally re-added `wa-dark` at import time, which
runs after the host page's inline theme script. #111998 gave that page the
real prefers-color-scheme contract, leaving the line from #112076 stale: in
light mode the root ended up with both `wa-light` and `wa-dark`, so Web
Awesome rendered dropdowns dark.
(cherry picked from commit 43e50de9728f3d5feac9609142d28821896b4f77)
* test(ui): align approval E2E with scoped errors
(cherry picked from commit 6435fe995491c6bae2c28fa374d06cd77f3c46ac)
* test(ui): use radio role in Set Default E2E
(cherry picked from commit acc8d5a487aac4d56515ae35d976fd347efa0be5)
* ci: gate merges on the Control UI e2e suite
test/vitest/vitest.ui-e2e.config.ts was referenced only by package.json and
mantis-web-ui-chat-proof.yml, so nothing in the merge gate ever ran it and 39
failures accumulated across 21 files (#114438). Give it its own job: the suite
runs one file at a time because each owns a Chromium context and a mocked
Gateway, ~21 min measured, which does not fit checks-ui's 20-minute budget.
Also route the config file itself through the Control UI changed-scope so a
change to it triggers the job.
* test(ui): isolate MCP app conformance from sidecars
(cherry picked from commit c2bfd0a00edad804474ebb23449d3150557c7f78)
* test(ui): list newly created E2E sessions
(cherry picked from commit e1a2188699011e818e040358d4eaf6ce26eb0732)
* test(ui): synchronize full-suite e2e setup
* test(ui): drop implied-eval module import and align the e2e workflow guard
* test(ui): wait for pin editor roving focus before keyboard nav
* test(ui): read the startle class in one in-page step
* test(ui): synchronize transient e2e assertions
* refactor(memory-core): remove orphaned shadow trials
* refactor(qqbot): migrate direct voice upload formats
Release note: QQBot configs using voiceDirectUploadFormats now migrate through openclaw doctor --fix to audioFormatPolicy.uploadDirectFormats at root and account scope. Existing nested uploadDirectFormats values win conflicts, and runtime reads only the nested policy.
* refactor(feishu): migrate tools base alias
Release note: Feishu configs using tools.base now migrate through openclaw doctor --fix to tools.bitable at root and account scope. Existing bitable values win conflicts, and runtime accepts only the canonical key.
* refactor(extensions): remove dead runtime state
* chore(config): refresh bundled channel metadata
* refactor(codex): keep realtime fallback type private
* test(ci): align QA compatibility scenario count
Three defects that compounded into a test suite nobody could run and nobody
was running.
The suite has been red on main since 2026-07-20. `connect_frame_matches_gateway_schema`
asserts a TLS-pinned connection advertises no capabilities, but #111933 wrote
that assertion while caps held only inline-widgets, and #111920 made
`agent-kind` unconditional the same day. No textual conflict, so both landed
and the assertion has been wrong ever since. Pinning only withdraws inline
widgets, so assert exactly that.
`cargo test` could not run on macOS at all: tauri-plugin-notifications links a
Swift static library, nothing adds an rpath for the Swift runtime, and every
test binary aborted at load with `Library not loaded:
@rpath/libswift_Concurrency.dylib`. Emit the rpath from build.rs.
Neither surfaced because linux-app.yml never ran `cargo test` - it only checked
formatting and built bundles. Run the suite on Linux, and upgrade the macOS job
from `check` to `test` so link-time breakage like the rpath is caught at all;
`check` never links, so it cannot see this class of failure.
* fix(linux): restore the macOS build of the Tauri companion
Tauri gates `WebviewWindowBuilder::transparent` behind its `macos-private-api`
feature on macOS, so the companion stopped compiling for macOS when Quick Chat
landed in #109947: `no method named 'transparent' found for struct
'WebviewWindowBuilder'`. Enable that feature together with the matching
`app.macOSPrivateApi` config flag, which Tauri requires to agree with it or
tauri-build fails the allowlist check.
Quick Chat is built for a transparent window - quickchat.css makes html and
body transparent behind a 16px-radius translucent card with a drop shadow - so
compiling macOS by dropping `.transparent(true)` would ship an opaque rectangle
instead of the floating composer.
Also add a per-PR macOS `cargo check`. The only job that compiled the macOS
target sits behind a manual dispatch input in linux-app-release.yml, which is
why a broken macOS build survived for nine days.
* ci(linux): build the macOS companion on macos-15
tauri-plugin-notifications' Swift sources use typed throws
(`throws(FFIResult)`), which requires Swift 6. The macos-14 runner image still
ships Swift 5.x and cannot parse them, so the plugin's build script panics with
"Swift build failed for target: arm64-apple-macosx13.0".
This hit the new per-PR check immediately, and it means the release workflow's
`build_macos` job could not have produced a macOS bundle either - it compiles
the same crate on the same image, but only runs behind a manual dispatch input
so nothing surfaced it. Move both to macos-15.
* build(deps): remove npm shrinkwrap; mirror pnpm lock into transient package locks
npm 12 removed shrinkwrap (command + tarball/root loading). Delete all 82
committed npm-shrinkwrap.json files and stop publishing lockfiles; keep
pnpm-lock.yaml as the single reviewed dependency boundary. The generator
becomes scripts/generate-npm-package-lock.mjs and feeds plugin bundling via
a transient package-lock.json + npm ci (works on npm 11 and 12). Tarball
validation treats the published 2026.7.2 beta train as a shrinkwrap
transition; self-update npm detection now uses install topology instead of
the shipped shrinkwrap.
* fix(deps): repair lint, deadcode, and test-type lanes for the npm 12 migration
- sort integrity comparisons with an explicit comparator (oxlint)
- keep resolveBunGlobalNodeModules module-local (knip unused-export gate)
- model npm pack --json as npm<=11 array / npm 12 name-keyed object
- default calver destructuring in the tarball test fixture
* chore(compat): date the annotated deprecation families and expose removal-pending debt
Adds 10 dated compat-registry records for shipped deprecated surfaces that
previously had @deprecated annotations only (removeAfter 2026-10-01 per the
approved 60-day window), extends the beta5 session-store record with the
package-root aliases, surfaces removal-pending records with due dates,
blockers, and readers in the plugin boundary report, and converts undated
cleanup obligations (CI timing job, zizmor excessive-permissions, staged
Codex CI auth, memory-host legacy state dir, agent-DB schema-ladder floors)
into dated markers visible to the weekly dated-TODO sweep. Metadata,
diagnostics, and docs only - no runtime behavior change.
* fix(compat): keep extension src test paths out of core string literals
The core import guardrail forbids extensions/*/src/ path shapes in core
production string literals; cite the package-root google-meet test and the
registry test for official-plugin-export-aliases instead.
* feat(ci): weekly Codex sweep for date-carrying to-dos
Mondays 06:23 UTC (plus default-branch-only manual dispatch with
dry_run): a deterministic prefilter collects candidate lines where
to-do markers co-occur with date tokens, plus every deprecated compat
record from the plugin registry; a pinned openai/codex-action step
judges each candidate in context (genuine dated commitment vs
historical date or fixture) and writes an OVERDUE / DUE-30-days /
FUTURE report; a separate privileged job validates the report (tracked
file:line locations, date shape, inert text) and upserts one
marker-tagged tracking issue via the Barnacle app token, commenting
only when items newly become due.
The app token is minted on a fresh runner and checkout — never beside
Codex or its child processes; only the validated report artifact
crosses jobs. No permission-* subsets on token minting (installations
reject explicit subsets; see pr-ci-sweeper).
* chore(ci): localize upsert helpers with no external consumers
* feat(models): add Claude Opus 5 support
* test(models): align Opus 5 setup fixtures
* test(models): update ambient Opus 5 detection
* fix(models): reconcile Opus 5 support with main
Every scheduled sweep failed at token minting since the explicit
permission subset was added: actions/create-github-app-token rejects any
request exceeding the installation grant, and these installations lack
actions:write/checks:read (stale.yml succeeds with actions:read;
auto-response succeeds with neither). Requesting no subset restores the
app's full granted set, which the re-fire lane demonstrably worked with.
If the org later grants actions:write+checks:read, the explicit subset
can return.
* fix(scripts): ignore superseded workflow runs in watch-pr-ci rollup classification
Draft->ready re-triggers leave cancelled superseded runs on the head SHA
forever, and GitHub's aggregate rollup state counts them, so the watcher
emitted terminal FAILURE while the replacement run was still in progress
and could never reach GREEN (observed on PR #113150, head bd1b9a0e).
- fetch run identity per check and resolve same-name checks to the newest
run/check id (GitHub latest-name-wins); drop cancelled checks from
replaced runs; keep older runs' unique jobs visible
- paginate statusCheckRollup contexts (bounded, 10 pages) so >100-context
rollups are not truncation-blind; changed or lost snapshots throw into
the bounded retry
- classify GREEN when aggregate FAILURE is explained solely by superseded
contexts with full visibility; truncation still fails conservatively
* ci: scope GitHub App token permissions in stale, labeler, auto-response, and pr-ci-sweeper
Fixes red main: #112963 bumped zizmor v1.22.0 -> v1.28.0, whose github-app
audit flags create-github-app-token mints without permission-* inputs (14
high findings, Workflow Sanity red on main since 3b7b2a2a1f). Most
workflows already migrated to scoped tokens; these four were stragglers.
Scopes follow each consumer's actual API surface: stale needs issues/PR
write plus actions read for its state-cache check; labeler needs label
CRUD (issues write), PR write, members read for maintainer gates, and
contents read where actions/labeler reads its config; auto-response needs
issues/PR write plus members read; pr-ci-sweeper needs actions write to
re-fire runs, checks read, and PR write. Verified locally with the exact
CI invocation (zizmor 1.28.0, repo config, regular persona, medium
severity/confidence): no findings, ignore/suppress counts match CI.
