vultr/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-07-22 15:01:13 +00:00
Code Issues Packages Projects Releases Wiki Activity
70,704 Commits 1,843 Branches 149 Tags
b4a206fc41f1dd31968bd1f68e501aa174ce2bdb
Commit Graph

2626 Commits

Author SHA1 Message Date
Peter Steinberger
06f5f73e47 refactor: own model discovery by runtime lifecycle (#111173) 
* refactor(agents): prepare model runtime catalogs

Build lifecycle-owned model and auth snapshots, carry prepared stores into hot agent paths, and serialize config/auth publication.

Credits @zeroaltitude's #90741 investigation and benchmark approach.

* refactor: finish lifecycle-owned model discovery

* fix: align prepared model catalog contracts

* test: align lifecycle catalog mocks

* test: fix prepared catalog type fixtures

* refactor: split prepared model runtime ownership

* fix: import prepared runtime replacement gate type

* test: split media runtime coverage

* test: preserve image auth fixture key types

* test: isolate lifecycle gate fixtures

* chore: keep release changelog owned

* refactor: finish prepared model catalog migration

* test: keep catalog review fixtures scanner-safe

* refactor: preserve lifecycle model runtime ownership

* fix: close prepared runtime lifecycle races

* fix: preserve compaction workspace fallback

* chore: document btw generation rebinding

* fix: preserve prepared generation boundaries

* fix: keep model-list discovery flag explicit

* fix: serialize standalone model runtime activation

* refactor: migrate subagent model catalog lookup

* refactor: clarify doctor catalog lookup seam

* chore: refresh plugin sdk api baseline

* test: migrate swarm catalog dependency

* refactor(telegram): rename runtime catalog seam

* refactor: extract model-aware tool context

* test(models): isolate lifecycle catalog fixtures

* refactor(agents): avoid btw parameter rebinding

* fix(net-policy): align root ipaddr dependency

* fix(build): keep net policy dependency bundled

* fix(deadcode): document net policy compile dependency
 2026-07-19 05:30:54 -07:00
Peter Steinberger
3b84a55d99 refactor(protocol): pre-publish cheat-window cleanup and vintage tracking (#111041) 
* fix(codex): drain dynamic-tool handlers before side-thread cleanup

* refactor(protocol): rename question ids to questionId and flatten answer maps

* refactor(protocol): slim worker stack and unify session-catalog shapes

* refactor(protocol): delete dead public surface and polish packaging

* feat(protocol): track release-train vintage on gateway methods and schemas

* fix(apps): align question surfaces merged from main with reshaped protocol

* test(health): shape secret fixtures to scanner-safe token names

* test(health): use scanner-safe token fixtures

* fix(apps): align question surfaces merged from main with reshaped protocol

* fix(ci): prove reshaped protocol in shallow checks

* fix(ui): align sidebar question fixtures with protocol

* fix(apps): read flat Swift question answers

* fix(apps): align question surfaces merged from main with reshaped protocol

* fix(apps): refresh native question inventory

* fix(apps): align macOS snapshot fixtures with protocol

* fix(ui): align narration question fixture with protocol
 2026-07-19 04:07:15 -07:00
Peter Steinberger
bbcfec9e96 fix(channels): prevent outbound echoes and expose native login (#111341) 
* fix(channels): centralize outbound echo suppression

* chore(plugin-sdk): refresh channel outbound surface

* test(commands): avoid native plugin fallback loading

* refactor(channels): separate outbound echo state

* docs(changelog): note channel action decisions

* fix(discord): align webhook preflight call

* fix(discord): use type-only thread binding import

* fix(channels): stream login blocks and widen turn results

* test(channels): narrow drop-capable turn results

* fix(channels): address echo and reply edge cases
 2026-07-19 03:49:11 -07:00
Peter Steinberger
4efcea1fd2 feat(browser): send pages to OpenClaw from the Chrome extension (#111158) 
* feat(browser): send pages to the main session from the Chrome extension

One-click page share in the OpenClaw Chrome extension: toolbar popup with an
optional note, page/selection context menu, and Alt+Shift+S. Capture is
selection-first with a readability heuristic, X/Twitter thread extraction, and
Google Docs plain-text export via the user's session cookies. Payloads ride the
existing paired relay WebSocket as a new pageShare message; the gateway-only
page-share sink wraps page text in the external-content safety boundary, then
enqueues a main-session system event and requests an immediate heartbeat
(hooks/wake semantics). Node-hosted relays report a clear unsupported error.

Capture heuristics adapted from Nat Eliason's MIT-licensed send-to-openclaw.

Co-authored-by: Codex <codex@openai.com>

* fix(browser): keep page-controlled metadata inside the share safety boundary

Review findings: move title/URL inside wrapExternalContent (a hostile <title>
must not become trusted header text), prefer the user's selection over the
full Google Docs export, and pass the context-menu selectionText through so
iframe selections and selections cleared during relay reconnect still win.

* fix(browser): bind context-menu shares to the click-time document

Selection shares from the context menu now send the click snapshot directly
(no recapture), so navigations during relay reconnect cannot mislabel the
source and iframe selections are preserved. The Google Docs selection probe
scans all accessible frames before falling back to the full-document export.

* test(browser): expect the page-share handler in relay server args

* fix(browser): probe only the main frame for Google Docs selections

All-frame injection rejects wholesale when one frame is inaccessible and
returns child frames in nondeterministic order, so the probe now reads the
main frame only. Child-frame selections still share correctly through the
context menu's click-time selectionText; toolbar/shortcut entry sends the
full page for that case (named tradeoff in the code comment).

* fix(browser): satisfy page-share CI gates

---------

Co-authored-by: Codex <codex@openai.com>
 2026-07-19 01:07:28 -07:00
Peter Steinberger
58452de711 refactor(config): config-surface reduction tranche 1 — retire dead keys, dedupe channel schemas, add growth ratchet (#111142) 
* refactor(config): retire dead and aliased config keys via doctor migrations

* refactor(config): dedupe bundled channel config schemas into shared builders

* feat(config): add config-surface count ratchet to doc-baseline check

* test(config): drop stale fixtures for retired config keys

* fix(doctor): migrate only positive finite MCP timeout aliases

* fix(migrate-hermes): emit canonical MCP timeouts only

* fix(config): satisfy lint and contract gates
 2026-07-19 00:52:37 -07:00
Peter Steinberger
ea54060223 feat(codex): fork upstream-linked sessions at a message via thread/fork (#111149) 
* feat(codex): fork upstream-linked sessions at a message via thread/fork

* fix(gateway): fail closed for rewind and branch switch on upstream-linked sessions

* fix(codex): fail closed on first-message forks, image-only prompts, and orphan archival

* fix(codex): baseline retained history and reject paginated threads on upstream fork

* fix(codex): validate the full fork prefix and fail closed across crash windows

* fix(codex): treat all non-text inputs as unverifiable in fork drift checks

* fix(codex): support first-message forks as empty-history upstream cuts

* fix(codex): reject source-id reuse and unverifiable hidden inputs in fork boundaries

* refactor(codex): materialize upstream forks from verified thread read-back

* fix(codex): satisfy strict type lanes and knip for upstream fork
 2026-07-19 00:11:10 -07:00
Peter Steinberger
e23dde3de5 feat: disable automatic session resets by default (#111140) 
* feat(config): disable automatic session resets by default

* fix(sessions): honor pending reset tombstones

* test(sessions): align reset coverage with disabled default

* fix(sessions): preserve explicit reset override fallback

* fix(sessions): inherit active mode in partial type resets
 2026-07-18 21:50:48 -07:00
Marcus Castro
d5cb708623 fix(qa): repair WhatsApp live scenario regressions (#110754) 
* fix(qa): make WhatsApp scenarios account-aware

* test(qa): cover configured WhatsApp SUT account

* refactor(qa): centralize QA target encoding

* fix(qa): configure scenario policies at startup
 2026-07-19 01:43:38 -03:00
Bartok
b49c5463fe fix(status): preserve thinking level for discovered Ollama models (#108789) 
* fix(status): carry prepared thinking catalog

Resolve status thinking levels from model metadata prepared by each caller.
Model-state paths carry their resolved catalog forward, while standalone status
surfaces make one side-effect-free read without provider discovery.

Co-authored-by: Bartok9 <danielrpike9@gmail.com>

* test(status): assert read-only native catalog load

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
 2026-07-18 20:55:02 -07:00
Yuval Dinodia
18b79d99ab fix(gateway): bound busy channel health by real run age (#103793) 
* fix(gateway): bound busy channel health by real run age

The channel health policy treats a channel as healthy-busy even while
disconnected, bounded only by a 25 minute stale ceiling measured from
lastRunActivityAt. The run-state heartbeat refreshes lastRunActivityAt
every 60 seconds for as long as any run is active, so a run that hangs
forever (for example a send blocking on a dead socket after the
transport already reported connected:false) keeps that timestamp fresh
and the stuck ceiling is never reached. The account is then reported
healthy forever by the health monitor, readiness probe, and health CLI,
and no restart ever fires.

createRunStateMachine now tracks each in-flight run's start time keyed by
an opaque run handle and publishes the oldest still-active run's start as
activeRunStartedAt. The health policy busy override keys its ceiling off
the real run age, so a run stuck longer than the threshold reports stuck
and the monitor can restart it. Because the reported start is the oldest
active run and advances to the next-oldest as runs complete, a channel
churning through many short overlapping runs (activeRuns above 1 across
concurrent queue keys) stays healthy; only a genuinely hung run breaches
the ceiling. Short and active runs stay healthy and the existing
lastRunActivityAt fallback is preserved for snapshots without a start
time.

* fix(channels): retain run-state callback compatibility

Keep the released zero-argument onRunEnd callback source-compatible while allowing internal queue callers to pass a run handle for exact concurrent-run accounting. The compatibility path closes the oldest active run, preserving existing lifecycle behavior for consumers that do not use handles.

* fix(channels): keep anonymous runs out of age tracking

The zero-argument lifecycle callbacks cannot identify which concurrent run completed, so they must not update the identity-sensitive run start used by channel health. Keep their busy count separately and reserve exact start tracking for the shared queue's handle-aware lifecycle path.

* fix(channels): keep tracked runs internal

Keep the public run-state lifecycle callbacks unchanged. The channel queue now owns opaque run identity and augments its status updates with the oldest active queue run, so implementation details do not expand the SDK surface.

* fix(channels): type queue run start status

Keep activeRunStartedAt in the internal status patch type so the queue can publish its private tracked-run age through the existing status sink.

* fix(channels): wrap isActive to satisfy unbound-method lint

* fix(gateway): gate busy run-age ceiling on disconnected transport
 2026-07-18 20:26:17 -06:00
Peter Steinberger
7562b79465 refactor(channels): share durable ingress monitor (#111017) 
* refactor(channels): share durable ingress monitor

* fix(channels): harden ingress monitor shutdown

* docs: refresh SDK documentation map
 2026-07-19 00:42:08 +01:00
Peter Steinberger
333a3297af refactor(plugin-sdk): consolidate persistent dedupe claim loop (#110984) 2026-07-18 23:36:59 +01:00
Peter Steinberger
f3f6eb2321 fix(codex): stop fallback for superseded sessions (#110980) 2026-07-18 23:02:03 +01:00
Peter Steinberger
cd78fb3843 fix(channels): harden prepared turn lifecycle (#110981) 2026-07-18 23:01:38 +01:00
tzy-17
09c46fb682 fix(stt-live-audio): cancel ElevenLabs error response body (#110759) 
Avoid buffering unbounded provider error streams and cover the resource lifecycle with a deterministic cancellation contract.

Co-authored-by: Peter Steinberger <steipete@gmail.com>
 2026-07-18 21:48:04 +01:00
Peter Steinberger
09a64f7ab0 feat(models): make per-agent allowlists explicit (#110888) 2026-07-18 21:42:05 +01:00
Josh Lehman
453444636c feat: bound transcript reads across replacements (#110374) 2026-07-18 11:41:39 -07:00
Peter Steinberger
3572fba7f9 feat(plugin-sdk): guard ingress effects once per event (#110846) 
* feat(plugin-sdk): add ingress effect guard

* docs: refresh docs map

* fix(plugin-sdk): propagate effect commit failures

* fix(plugin-sdk): isolate ingress effect namespaces
 2026-07-18 19:23:39 +01:00
Peter Steinberger
8a5c8690e1 fix(secrets): keep unaffected owners live during reload failures (#110779) 
* fix(secrets): isolate reload failures per owner

* refactor(secrets): split runtime activation helpers

* fix(secrets): export web warning type

* fix(secrets): reject unsafe degraded config writes

* fix(secrets): derive reload defaults type

* fix(secrets): defer reload state publication

* fix(secrets): preserve partial refresh state

* fix(secrets): retry superseded reload preflight

* fix(secrets): bind stale credentials to owner contracts

* fix(secrets): scope degraded credential contracts

* fix(secrets): restore source ownership guards

* fix(secrets): recover provider-only degradation

* fix(secrets): enforce degraded reload contracts

* fix(secrets): preserve scoped reload state

* fix(secrets): reconcile deferred descendant state

* fix(secrets): commit reload state atomically

* fix(secrets): preserve source transaction lineage

* test(secrets): use non-secret lineage marker

* chore(plugin-sdk): refresh API baseline

* fix(secrets): canonicalize web owner contracts

* fix(plugin-sdk): preserve legacy secret owner contracts

* fix(secrets): satisfy startup activation types

* test(secrets): align reload fixtures with owner contracts

* refactor(secrets): move source recovery scope helper

* fix(secrets): preserve owner contracts on web failures

* fix(secrets): bind legacy web resolution contract

* fix(secrets): retry stale auth publication
 2026-07-18 18:29:24 +01:00
Wynne668
c1eba30949 fix(qa): discard ignored guarded response bodies (#110443) 
* fix(qa-lab): release failed suite gateway response bodies

* fix(qa): discard ignored guarded response bodies

Co-authored-by: ZengWen-DT <ceng.wen@xydigit.com>

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
 2026-07-18 18:08:16 +01:00
Peter Steinberger
63a32e360b fix(qa): stop retries after overall health deadline (#110753) 2026-07-18 16:07:35 +01:00
Peter Steinberger
40793e6f8b fix: bound pasted input and provider response bodies (#110627) 
* refactor(runtime): centralize bounded I/O handling

* fix(runtime): finalize bounded I/O contracts

* chore(security): drop stale audit import

* docs(changelog): credit bounded I/O fixes

Co-authored-by: Pick-cat <huang.ting3@xydigit.com>

* fix(agents): keep provider HTTP options private

* fix(ai): traverse OpenAI schema maps by value

* fix(runtime): preserve absolute download deadlines

* ci(ui): stabilize compressed CSS budget

* fix(ai): traverse legacy schema applicators

---------

Co-authored-by: Pick-cat <huang.ting3@xydigit.com>
 2026-07-18 13:54:56 +01:00
Peter Steinberger
01a9e1d398 feat(memory): default cross-conversation recall for personal installs (#110597) 
* feat(memory): default private recall for personal installs

* fix(memory): repair remember-across CI checks
 2026-07-18 12:16:49 +01:00
Peter Steinberger
9d97e10efe refactor: move non-session runtime journals to SQLite (#109427) 
* refactor: migrate runtime JSONL state to SQLite

* chore: refresh SQLite migration validation

* fix: preserve safe audit migration order

* fix: sanitize retired audit archives safely

* fix: satisfy SQLite storage architecture gates

* fix: serialize plugin doctor state migrations

* fix: bound memory event SQLite projections

* fix: rotate memory event projections safely

* fix: preserve imported event retention age

* fix: harden memory event export projection

* fix: canonicalize memory event migrations

* fix: harden legacy journal migrations

* fix: report unsafe legacy journal paths

* fix: preserve journal ownership during migration

* fix: keep legacy file imports doctor-only

* fix: align SQLite audit CI coverage

* refactor: keep state helpers module-private

* fix: harden legacy state migration recovery

* fix: reconcile SQLite state audit migration

* test: use neutral audit redaction fixtures

* fix: close SQLite migration recovery gaps

* refactor: split audit migration recovery helpers

* test: prove completed audit pads stay out of backups

* fix: preserve audit record ordinals across blank lines

* fix: align SQLite audit CI contracts

* build: package SQLite audit E2E entries

* fix: preserve audit ordinals in backup snapshots
 2026-07-18 11:42:14 +01:00
mushuiyu886
adff355caf fix(plugin-sdk): failed raw channel sends report success (#109906) 
* fix(plugin-sdk): reject failed raw channel sends

* fix(plugin-sdk): preserve raw result helper compatibility

* test(plugin-sdk): cover raw send fallback errors

Co-authored-by: 杨浩宇0668001029 <yang.haoyu@xydigit.com>

* fix(security): bound skill-file audit read via safe reader (restore removed fs dependency) (#110589)

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
 2026-07-18 11:30:13 +01:00
mushuiyu886
04d7462806 fix(plugin-sdk): attached send results report the configured channel (#110069) 
* fix(plugin-sdk): keep attached channel authoritative

* refactor(plugin-sdk): simplify channel attachment

Co-authored-by: 杨浩宇0668001029 <yang.haoyu@xydigit.com>

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
 2026-07-18 11:10:39 +01:00
Peter Steinberger
d7de67ae02 feat: ask_user follow-ups — harness convergence, channel finalization + reactions, native cards, docked web panel (#110372) 
* feat(ask-user): follow-up harness slice

* feat(ask-user): follow-up channels slice

* feat(ask-user): follow-up native slice

* feat(ui): dock question panel above composer with stepper and compact stream summaries

* docs: refresh follow-up integration maps

* test(ui): align terminal summary proof

* fix(infra): echo declared option answers in terminal status when free-text is allowed

* fix(infra): keep reaction answering when display labels are formatter-adjusted

* fix(agents): settle plain-text claims only after question registration commits

* fix(agents,apps): commit-ordered claim persistence, claim-aware prompt delivery, non-blocking question refresh

* fix(harness,infra): reaction-appropriate question copy, caller presentations honored

* fix(native,infra,agents): local-expiry eviction, value-addressed reactions, reserve-before-request

* fix(infra,android): dual-mode question resolver for compact callbacks; reset terminal retention on replayed pending

* fix(harness,discord): claim-aware prompt delivery in run helper; escape finalization labels

* fix(macos): merge transient-content visibility with question cards after main sync

* fix: repair ask user follow-up CI

* test: update limited bootstrap scope expectation

* fix: retain shared question card API

* chore: refresh native i18n inventory
 2026-07-18 03:32:39 -04:00
pick-cat
32b3f0e54d fix(plugin-sdk): drop unreachable openai tool-compat branch (#108310) 
* fix(plugin-sdk): drop unreachable openai tool-compat branch

* refactor(plugin-sdk): remove dead OpenAI compat branch

Keep behavioral route coverage and drop the brittle source-text assertion.\n\nCo-authored-by: Pick-cat <huang.ting3@xydigit.com>

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
 2026-07-18 08:13:50 +01:00
Peter Steinberger
442c166122 refactor(sessions): replace ambient watch sentinels with provenance (#110428) 
* refactor(sessions): store watch provenance in cursors

* style(docs): align database schema table

* refactor(state): use Kysely for watch migration

* style(state): remove redundant timestamp casts
 2026-07-18 06:55:29 +01:00
Peter Steinberger
d2ac282f25 fix(channels): harden turn lifecycle boundaries (#110406) 2026-07-18 06:02:46 +01:00
Peter Steinberger
31ed59bdf6 feat: keep main agents aware of group activity (#110332) 
* feat(sessions): auto-watch group activity from main

* feat(sessions): allow watchers to read watched sessions

* fix(sessions): skip group watches for system turns

* fix(sessions): preserve watched session semantics

* fix(channels): propagate effective dm scope

* fix(sessions): canonicalize main watch identity

* fix(sessions): distinguish ambient group watches

* fix(sessions): revoke ineligible ambient watches

* chore: drop CHANGELOG edit (release generation owns it)
 2026-07-18 04:06:58 +01:00
Peter Steinberger
d8f2645c2c refactor(memory-wiki): move compiled cache to plugin state (#110167) 
* feat(plugin-sdk): prepare memory prompts asynchronously

* refactor(memory-wiki): move compiled cache to plugin state

* fix(plugin-sdk): export memory prompt preparer type

* refactor(plugin-sdk): keep prompt preparer type private

* test(memory-wiki): isolate compiled cache state

* chore(memory-wiki): satisfy changed gates

* fix(memory): preserve prepared prompts across context engines

* docs(plugin-sdk): refresh API baseline

* fix(memory): revalidate prepared prompt ownership

* fix(codex): propagate sandboxed memory context

* test(memory-wiki): seed durable vault identity

* refactor(memory-wiki): keep cache lifecycle internal

* fix(memory-wiki): harden compiled cache publication

* style(memory-wiki): format cache lifecycle changes

* test(memory-wiki): support extension test lib target

* style(memory-wiki): remove redundant catch

* refactor(memory-wiki): keep vault generation helper private
 2026-07-18 03:05:03 +01:00
Peter Steinberger
601ffa2530 refactor(channels): move inbound turn execution into core (#110095) 
* refactor(channels): centralize turn execution lifecycle

* refactor(extensions): adopt core channel turn plans

* test(channels): ratchet modern dispatch ownership

* chore(channels): drop stale max-lines exemption

* fix(channels): allow async delivery error cleanup

* test(channels): await async delivery cleanup

* test(channels): await delivery error callbacks

* fix(channels): preserve delivery error contract

* fix(plugin-sdk): preserve channel inbound declarations

* test(channels): exercise core delivery plans

* fix(channels): await delivery error cleanup

* fix(channels): preserve async cleanup contract

* refactor(channels): trim dispatch boilerplate

* fix(channels): mask observe-only dispatch results

* refactor(channels): delete unused dispatch exports

* fix(msteams): preserve resolver config overrides

* refactor(channels): keep Teams turn config internal

* test(plugins): drop retired Teams runtime export guard
 2026-07-18 00:55:46 +01:00
Peter Steinberger
b0a2d02427 fix(ci): make plugin SDK API manifest mergeable (#110228) 2026-07-18 00:16:39 +01:00
Peter Steinberger
79c7569fa6 refactor(session): compress restart recovery internals (#110170) 
Co-authored-by: xingzhou <zhang.guiping@xydigit.com>
 2026-07-17 23:14:10 +01:00
Peter Steinberger
da44d52ac6 feat: ask_user — structured questions from the agent with web card, channel buttons, and text answers (#109922) 
* feat(gateway): add transient question runtime (question.* methods + broadcasts)

* feat(agents): add blocking ask_user question tool with chat prompt delivery and text-reply claim

* feat(ui): interactive in-thread question cards for ask_user

* feat(channels): native tap-to-answer buttons for ask_user on Telegram, Discord, and Slack

* feat(ui): unify codex and gateway question cards with interactive gateway answering

* refactor(agents): collapse ask_user pending state to one registry; docs for ask_user

* fix(agents): include ask_user in normal gateway runs; add question-flow control-ui e2e

* test(ui): avoid credential-shaped fixture in question card test

* refactor(ui): reorder stream-group context keys

* fix(gateway,ui): validate question answers at resolve; reject secret/duplicate-label questions; UI retry and reconnect hardening

* fix(gateway,agents): canonicalize accepted option answers; bound ask_user option labels to 64 chars

* chore(ci): prune unused question exports, allowlist mobile question events, fix discord lint

* chore(ci): regenerate protocol/i18n/docs/tool-display artifacts for question surface

* fix(protocol): flatten QuestionRecord for native codegen; drop TS-only alias from schema registry

* chore(android): regenerate ask-user localization resources

* docs: regenerate docs map after rebase

* fix(ci): avoid stale read-only dependency disks

* test: remove stale reef lint suppression ratchet

* fix(ci): keep source locale drift advisory in release gates

* fix(ci): scope locale advisory handling to parity check
 2026-07-17 22:24:17 +01:00
Peter Steinberger
fed1b69f6e test(release): repair extension runtime fixtures 2026-07-17 21:55:27 +01:00
Peter Steinberger
4ec2f9db25 test(discord): isolate component runtime fixtures 2026-07-17 16:23:17 +01:00
xingzhou
0a868179e4 fix(session): stop repeated restart recovery after retry budget (#96230) 
* fix(session): bound restart recovery across gateway restarts

Co-authored-by: Mason Huang <masonxhuang@proton.me>

* style(session): format restart recovery changes

* fix(session): fence recovery notice state

* test(session): align internal recovery types

* test(session): type recovery completion fixture

* style(session): satisfy recovery lint rules

* test(plugin-sdk): split recovery boundary coverage

* test(plugin-sdk): use tracked recovery temp dirs

* fix(session): preserve stale admission errors

* fix(session): close recovery lifecycle races

* fix(session): rotate rejected recovery dispatch ids

* fix(session): enforce recovery quarantine boundaries

* fix(session): close restart recovery exhaustion gaps

* fix(session): preserve recovery command narrowing

* test(session): type restart recovery fixtures

* fix(session): enforce restart recovery quarantine

* fix(session): close restart recovery races

* fix(session): type recovery lifecycle state

* fix(session): enforce recovery ownership fences

* fix(session): fence recovery lifecycle completion

* fix(session): quarantine cross-process recovery

* fix(session): retire stale recovery ownership

* fix(session): restore rejected recovery admission

* fix(session): preserve restored recovery target

* fix(session): retry pending recovery races

* fix(session): preserve concurrent recovery aborts

* fix(session): quarantine recovery lifecycle state

* fix(session): settle exact recovery delivery fences

* fix(session): keep recovery restoration internal

* fix(session): close recovery admission races

* fix(session): retry durable recovery rollback

* fix(session): guard cached recovery settlement

* fix(session): close recovery ownership gaps

* fix(session): resume after delayed recovery rollback

* fix(session): finalize unrecoverable restart state

* fix(session): retry admitted recovery restoration

* fix(session): preserve recovery cleanup guarantees

* fix(session): restore failed terminal settlement

* chore(plugin-sdk): refresh API baseline

* fix(session): close recovery owner retry races

* test(session): type recovery owner fixture

* refactor(session): remove obsolete owner validator

* fix(session): preserve explicit abort recovery

---------

Co-authored-by: Mason Huang <masonxhuang@proton.me>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
 2026-07-17 15:36:09 +01:00
Peter Steinberger
b319493a52 improve: let Code Mode use declared tool result shapes (#109813) 
* feat(agents): add Code Mode output contracts

* perf(agents): defer untrusted tool schemas

* chore(plugin-sdk): refresh API baseline

* fix(agents): preserve deferred schema markers

* fix(agents): preserve policy-blocked tool results

* fix(agents): preserve nullable output contracts

* fix(agents): reject policy blocks from success contracts

* fix(agents): preserve output contracts through normalization

* test(agents): type normalized tool fixtures

* fix(agents): validate catalog results before projection

* fix(agents): keep result snapshots internal

* fix(agents): fail closed on unrenderable unions

* fix(agents): preserve empty result markers

* test(agents): keep result fixture discriminator literal

* test(agents): use native own-property check
 2026-07-17 14:46:37 +01:00
Peter Steinberger
b48c801623 test(release): repair extension runtime fixtures 2026-07-17 14:24:13 +01:00
Peter Steinberger
2920ec1fab docs(channels): settle replay-guard vs ingress-drain layering contract (#109799) 
* docs(channels): settle replay-guard vs ingress-drain layering contract in code comments and SDK docs

* docs: refresh SDK channel docs map
 2026-07-17 11:13:00 +01:00
Peter Steinberger
1a2d9e5e5c refactor(meeting-bot): extract browser meeting-bot core behind MeetingPlatformAdapter (#109755) 
* refactor(meeting-bot): extract browser meeting-bot core behind MeetingPlatformAdapter

* chore(google-meet): prune max-lines baseline entries shrunk by extraction

* fix(meeting-bot): drop orphaned extension realtime files and refresh lint/test types after extraction

* chore(google-meet): prune deleted realtime max-lines baseline

* chore(meeting-bot): remove release-owned changelog entry

* fix(meeting-bot): harden session leave, cleanup retry, and engine teardown paths
 2026-07-17 10:35:56 +01:00
Peter Steinberger
4ecd85e0b7 fix: keep healthy channel accounts running when one credential fails (#109766) 
* fix(secrets): isolate channel account credentials

* fix(secrets): normalize Feishu default ownership

* fix(feishu): preserve accountless secret ownership

* fix(matrix): keep accountless top-level refs active
 2026-07-17 01:12:18 -07:00
Peter Steinberger
543244e7bb perf(ci): remove the anthropic-cli jiti stall and stripe the full-plan whales (#109769) 
* perf(sdk): load Claude CLI identity from a narrow plugin artifact

src/plugin-sdk/anthropic-cli.ts snapshots CLAUDE_CLI_BACKEND_ID at module
scope through the sync facade loader, which jiti-evaluates the full
anthropic api.js barrel on source checkouts: 130.86s of self time per
cold worker on CI (Testbox import profile), silently stalling every job
whose graph reaches cli-runner/prepare.ts. A narrow cli-api.js artifact
carries the two static facts; Testbox proof: the reliability+helpers
agents-core pair drops from 157.6s to 14.3s.

* perf(ci): stripe unit-fast and tooling node tests on the full plan

core-fast ran the import-bound unit-fast graph as one job (247s vitest,
181s module evaluation) and core-tooling as one serial job (241s); both
now stripe on the full plan like the compact plan, so the compact-only
expansion is deleted and the docker helper config rides with the
isolated shard on both plans. Group hints refreshed from main run
29551077288; stale per-file commands hints dropped (the consolidation
landed); cache-writer selection and the warm workflow track the stripe
names.

* fix(state): tolerate vanished sqlite sidecars in agent-db permission sweep

existsSync+chmodSync raced SQLite's own WAL/SHM cleanup: a checkpoint or
close between the two calls throws ENOENT (observed from the transcript
reconcile worker in server-startup-web-fetch-bind on CI). chmod directly
and swallow only ENOENT, which removes the TOCTOU window.
 2026-07-17 00:58:32 -07:00
Peter Steinberger
0e792b6de3 refactor(channels): centralize inbound orchestration and remove internal compat (#109716) 
* refactor(channels): centralize inbound turn orchestration

* refactor(runtime): remove stale compatibility paths

* chore(guards): reject internal deprecated API use

* refactor(channels): simplify core turn planning

* chore(guards): keep deprecated checks boundary-focused

* refactor(memory): keep modern config off compat barrel

* fix(msteams): preserve feedback learning

* test(channels): align modern inbound fixtures

* refactor(channels): finish modern inbound migration

* refactor(channels): tighten core inbound kernel

* fix(channels): preserve turn assembly narrowing

* test(sdk): keep runtime mock binding immutable

* test(matrix): isolate read policy runtime

* test(msteams): mock canonical reply factory

* test(slack): mock core inbound turn dispatch

* test(telegram): inject core session recorder

* test(signal): inject core session recorder

* test(googlechat): assert canonical inbound routing

* test(synology-chat): align core turn fixture

* fix(sdk): preserve direct DM runtime compat

* refactor(channels): own inbound envelope compat in core

* refactor(channels): trim inbound dispatch seams

* refactor(channels): remove redundant async wrappers

* test(synology-chat): type canonical dispatcher mock

* refactor(channels): remove remaining dead compat seams

* chore(sdk): refresh API baseline after rebase

* fix(channels): preserve direct DM identity metadata
 2026-07-17 00:56:46 -07:00
Peter Steinberger
a2ec3f6904 refactor: separate external conversations from local sessions (#109411) 
* feat: separate external conversations from sessions

* test: cover conversation tool authorization

* chore: refresh session schema baseline

* fix: persist effective conversation delivery text

* fix: bind conversation identity to delivery target

* fix: preserve pending conversation deliveries

* fix: make conversation delivery outcomes synchronous

* refactor: make conversation delivery durable

* fix: harden durable conversation retries

* fix: close durable conversation pre-send gaps

* fix: terminally reject invalid conversation deliveries

* refactor: route external conversations through gateway

* fix: namespace conversation delivery queue intents

* refactor: remove obsolete transcript replacement path

* test: prove conversation delivery v10 migration

* test: keep conversation action mock typed

* fix: clear conversation refactor CI gates

* test: align Reef delivery coverage

* chore: refresh Android conversation strings

* fix: harden external conversation state

* fix: close conversation race edges

* fix: preserve conversation delivery identity

* fix: replay durable conversation operations

* fix: unify agent schema at version 11

* chore: move release note context to PR

* fix: make required queue persistence force core delivery

* chore: refresh plugin SDK baseline
 2026-07-17 00:09:51 -07:00
Peter Steinberger
630b16805c fix(providers): refresh zai/kimi/moonshot/xai catalogs against July 2026 vendor docs (#109666) 
* fix(providers): refresh vendor catalogs and setup hints

* test(providers): align registration metadata expectations
 2026-07-16 22:41:03 -07:00
Peter Steinberger
e873a7f955 refactor(memory): move QMD coordination to SQLite (#109636) 
* refactor(memory): move QMD coordination to SQLite

* chore: keep release notes in PR body

* chore: annotate lease SQLite primitive
 2026-07-16 22:01:34 -07:00
Peter Steinberger
a77c0770ff refactor(speech-core): share TTS request pre-resolution across discord and voice-call (#109640) 2026-07-16 21:47:06 -07:00