* fix(acpx): keep leaked non-openai model out of the Codex ACP thinking slot
Codex ACP spawn mis-routed an inherited non-OpenAI fleet default into the
reasoning-effort slot and aborted (#95780). Replace the splitter with a closed
classifier and make the spawn path provenance-aware: drop an inherited leaked
default so Codex starts on its own default, but fail closed with
ACP_INVALID_RUNTIME_OPTION when a caller explicitly selects an unsupported or
malformed model. Thread a modelExplicit flag from resolveAcpSpawnRuntimeOptions
through the ACP runtime ensure contract; strip it before the acpx delegate.
Dropping the inherited default only at ensureSession was not enough: the manager
still persisted the leaked model in runtimeOptions, and the first turn replayed
it through applyRuntimeControls -> setConfigOption(model), which the new
fail-closed Codex control path then rejected. ensureSession now reports the
effective model it applied on the returned handle (applied | dropped), and the
manager persists that effective model, so a dropped inherited default is never
saved or replayed as a model control before the first turn. Explicit unsupported
selections still fail closed at spawn and never persist.
* test(acp): split runtime config validation tests
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
`taskkill.exe` can hang when the target process is stuck in a kernel wait
state (e.g. a pending I/O request). Add a 5-second timeout so QA scenario
cleanup fails closed instead of hanging the test runner indefinitely.
Co-authored-by: Peter Steinberger <steipete@gmail.com>
`taskkill.exe` can hang when the target process is stuck in a kernel wait
state. Add a 5-second timeout to both taskkill invocations in the gateway
child process tree cleanup so stalled termination fails closed instead of
hanging the QA runner.
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* feat(llama-cpp): add in-process text inference
* test(llama-cpp): narrow setup provider fixture
* fix(llama-cpp): trim public surface and refresh docs map
* fix(llama-cpp): import Context type in inference test
* refactor(google-meet): merge host and node realtime engines behind one audio transport
* refactor(google-meet): internalize engine helpers left test-only after realtime-node removal
* feat(mattermost): add thread.requireExplicitMention to opt out of thread auto-follow
Mattermost treats any reply in a thread the bot has participated in as an
implicit mention, so requireMention only gates the first message and the bot
then answers follow-ups addressed to other people for the participation TTL.
Slack exposes channels.slack.thread.requireExplicitMention for exactly this;
Mattermost had no equivalent and its strict schema rejected the key.
Add channels.mattermost.thread.requireExplicitMention (channel + per-account),
mirroring Slack. When set, thread participation no longer counts as a mention.
Default (unset/false) keeps today's auto-follow behavior unchanged.
Related: #108269
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* feat(channels): add implicit mention policy foundation
* feat(channels): unify implicit mention policy
Co-authored-by: leon <dodoma0919@gmail.com>
* refactor(channels): keep implicit policy inside evaluator
* fix(channels): use exported implicit mention type
* chore(channels): satisfy extension lint
* fix(config): break implicit mention type cycle
* fix(plugin-sdk): account for implicit mention config export
* refactor(config): isolate implicit mention schema
* chore(plugin-sdk): align implicit mention surface budget
* fix(config): remove unused schema re-export
---------
Co-authored-by: leon <dodoma0919@gmail.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* refactor(channels): move reef, msteams, matrix, zalouser file state to SQLite with doctor imports
* fix(channels): harden SQLite state migrations
* test(reef): use SQLite flow stores in receipt suites
* fix(reef): validate restored request policy
* fix(reef): retain replay state through relay window
* docs(reef): describe durable state import
* fix(reef): honor configured legacy state path
* chore: leave changelog to release flow
* fix(reef): use managed temp root in flow tests
* fix(matrix): omit undefined device id from state
* Fix Feishu local media fallback leaks
* refactor(feishu): clarify media fallback link style
* fix(feishu): reject credentialed media fallbacks
* fix(feishu): reject ambiguous media fallback URLs
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Recent setup commits left the hard-zero gates red on every PR:
parseClickClackSetupCodeInput was exported but only used internally,
ClickClackSetupCodeClaimError was exported yet consumed only by its
test (production catches it structurally through a status field), a
string spread tripped no-misused-spread, and a computed "token" key
tripped no-useless-computed-key. Un-export both symbols, switch the
test to a structural claim-error stand-in matching what the formatter
reads, and apply the two mechanical lint fixes.
* fix(voice-call): decode ngrok pipe chunks as UTF-8
Keep ERR_NGROK diagnostics and startup log lines intact when a multibyte code point is split across stdout/stderr reads.
* test(voice-call): add L3 real-pipe UTF-8 chunk proof for ngrok
Spawn a real Node child through the production startTunnel path so OS pipe boundaries exercise setEncoding("utf8"), and emit a scrapable live-proof line.
* test(voice-call): type real ngrok pipe child for check-test-types
Use ChildProcessByStdio<null, Readable, Readable> for stdio ignore/pipe/pipe instead of casting to ChildProcessWithoutNullStreams.
* test(voice-call): simplify ngrok UTF-8 proof
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* test(slack): drop rotating loading-message fixture expectations
* refactor(slack): drive progress drafts through the shared compositor
Slack's status_final progress path now uses the shared channel compositor
(preamble headline, reasoning, tools, plan checklist, commentary
arbitration) instead of its hand-rolled gate/merge/render pipeline, and
native task cards consume compositor snapshots with stable row identity
(line ids first, fixed reasoning id, occurrence-suffixed content hashes).
Finals in progress mode post as fresh messages that follow the draft's
thread; the working draft then collapses into a compact activity receipt,
while failed or error finals leave the draft as the turn record. The
rotating native loading messages are gone in favor of the plain typing
status. Queued and assistant-boundary turns re-arm with clean delivery
state, and native completion status survives transient append failures.
The live-test helper is exported from openclaw/plugin-sdk/test-live (as every
other extension live test imports it), not test-env. The wrong subpath in
#109335 broke check-test-types repo-wide.
* test: fix environment-dependent failures on built and partial-clone checkouts
Canvas A2UI fixtures now pin the resolved root through a new canvas
test-api hook: dev checkouts with a locally built a2ui.bundle.js won
candidate resolution and shadowed the fixture root. Speech-core prefs
tests resolve the canonical tmpdir (macOS /tmp symlink breaks fs-safe
store roots), and the bundled plugin install test asks discovery for
the canonical bundled path instead of hardcoding the source tree.
* fix(release): keep evidence verifier blob reads local-deterministic
git show against a forged or missing SHA lazily fetched from the
promisor remote on partial clones, hanging a security check on network
state (266s observed). GIT_NO_LAZY_FETCH pins verification to local
objects; missing blobs fail closed as before.
* perf(test): pay the command-handler barrel once and merge subagent command tests
commands-name and commands-login imported the full handler barrel
(~1,700 modules) for registration assertions; those now live in a
dedicated registration test, dropping the two files from 12.6s/4.6s to
1.4s/1.0s locally. Five subagent command test files merged into one so
the auto-reply module graph evaluates once instead of five times.
* perf(ci): stripe node test bins by measured file cost
Round-robin striping packed the whale files together, leaving
auto-reply-commands-1 at ~220s while sibling stripes idled at ~30s.
Greedy LPT over advisory per-file seconds hints balances the commands,
cli-runner, and tooling stripes deterministically; group hints for the
restriped bins are equalized at the old totals.
