Validation run 29487321249 measured stripe 2 at 179s (hint said 110)
while stripes 1/3 run light; the index striping concentrates import cost
unevenly. Weight the hints accordingly so no compact bin overpacks past
the 260s target.
* fix(clickclack): commit websocket cursors after processing
Serialize realtime events and wait for queued handlers before reconnecting so only successfully processed cursors advance.
Co-Authored-By: OpenAI Codex <noreply@openai.com>
* fix(clickclack): replay failed websocket events
Keep the last successful cursor when realtime handling fails, then reconnect through durable backlog recovery before reopening the stream.
Co-authored-by: 詹幸心0668001037 <zhan.xingxin@xydigit.com>
---------
Co-authored-by: OpenAI Codex <noreply@openai.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(workboard): record resolved runtime metadata instead of hardcoded codex engine
Workboard executions labeled every dispatched run engine=codex, model=default,
and id suffix :codex even for Claude/other harness agents. The gateway agent
admission phase now returns the resolved {harness, provider, model} for plugin
subagent runs; the dispatcher records it verbatim and omits engine/model when
unresolved. Engine becomes an open runtime identifier in the workboard
contract (built-in launch choices stay a closed list), store/UI normalizers
preserve historical labels as written instead of inventing codex, and new
execution ids use an :agent-session suffix. Fixes#108362
* fix(workboard): accept undefined engine in ui engineModel helper
* refactor(channels): generalize channel retry runner and retry-after parsing; drop dead configured-state probes
* fix(channels): align retry and metadata contracts
Apply the existing device-token ownership rule to node pairing list, approve, reject, and rename. Preserve shared-auth, admin, and self-service management while preventing cross-device enumeration and mutation.
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(ui): honor timezone in usage detail timeline
Apply the selected local or UTC calendar boundaries to session detail points and keep the full final day.
Co-Authored-By: OpenAI Codex <noreply@openai.com>
* test(ui): make usage timezone regression deterministic
Model a non-UTC local calendar through Date getters instead of relying on runtime TZ mutation.
Co-Authored-By: OpenAI Codex <noreply@openai.com>
* test(ui): type local date getter mocks
Annotate Date receivers so the deterministic timezone regression passes strict test type checking.
Co-Authored-By: OpenAI Codex <noreply@openai.com>
* fix(ui): complete usage timeline timezone handling
---------
Co-authored-by: OpenAI Codex <noreply@openai.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(anthropic-vertex): shim native fetch so Google auth avoids gaxios's node-fetch import
@anthropic-ai/vertex-sdk's bundled gaxios only uses native fetch when a
global `window.fetch` exists; otherwise it dynamically imports
`node-fetch`, which can fail to resolve depending on how the plugin's
dependencies are installed. That failure surfaces deep inside gaxios's
token-exchange path as "Cannot convert undefined or null to object",
breaking every Vertex auth request (#107341). The same gaxios root
cause hit a different provider in #41380, where a global window.fetch
shim was the confirmed workaround.
Fixes#107341
* fix(anthropic-vertex): compare window directly against undefined
oxlint's unicorn/no-typeof-undefined flagged the typeof check; a
direct comparison is safe here since target.window is a property
access, not a possibly-undeclared identifier.
* fix(anthropic-vertex): keep ADC fetch provider-local
Co-authored-by: Ian Alloway <ian@allowayllc.com>
* test(anthropic-vertex): inject auth in API fixtures
Co-authored-by: Ian Alloway <ian@allowayllc.com>
* refactor(anthropic-vertex): clarify auth transport contract
Co-authored-by: Ian Alloway <ian@allowayllc.com>
* fix(anthropic-vertex): preserve ADC proxy routing
* chore: leave changelog to release workflow
---------
Co-authored-by: Ian Alloway <ian@allowayllc.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(gateway): allow clearing agent model overrides
* fix(protocol): preserve Swift agent model compatibility
* fix(protocol): preserve null when Swift decodes agent updates
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(memory-core): write MEMORY.md atomically during short-term promotion
applyShortTermPromotions rewrote MEMORY.md with a single non-atomic
fs.writeFile, which truncates the file before streaming the new content.
An OS write failure part way through (for example EFBIG on a size-limited
or full volume) left MEMORY.md truncated to the bytes written before the
failure, permanently dropping user long-term memory. The dreaming cron
path invokes this writer automatically, and the recall store is only
updated after the write, so the promotion stays eligible and the next
run reads the already-truncated file.
Route the write through replaceFileAtomic (temp file, fsync, atomic
rename), the same durable-write helper the sibling DREAMS.md writer in
this extension already uses. On failure the temp file is discarded and
the existing MEMORY.md is left untouched; on success the content and the
existing file mode are preserved.
* fix(memory-core): harden atomic promotion durability
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(line): run post-ack webhook processing on its own admitted work root
LINE acks the webhook and dispatches event processing fire-and-forget on
the same async chain. The HTTP request admission that chain inherited is
released as soon as the route handler returns, and a released admission
refuses subordinate queue work - so every LINE inbound agent turn fails
with "GatewayDrainingError: Gateway is draining; new tasks are not
accepted" even though the gateway is healthy. DMs, group mentions, and
postbacks are all affected; the user-visible symptom is the bot replying
"Sorry, I encountered an error processing your message." to everything.
Add runDetachedWebhookWork to the plugin-sdk webhook-request-guards
surface (a thin wrapper over the gateway independent-root continuation,
the same shape core uses in gateway/server/hooks.ts) and route all three
LINE ack-first dispatch sites through it: the gateway monitor handler
(the live path), and the createLineNodeWebhookHandler / Express
middleware handlers (public webhook building blocks an embedder can
register under the gateway). #65375 unified these three into one ack-first
pattern; keeping the detach consistent avoids re-introducing the same
latent defect in the two that are not on the live gateway path today.
The continuation is reserved synchronously while the request is still
admitted, so the detached processing stays accepted and a real restart
drain can wait for it instead of stranding it mid-turn.
Tests pin every layer: the guards suite proves detached post-ack work is
admitted after the request admission is released (and that the inherited
chain without the helper is refused); the monitor lifecycle suite and the
webhook-node suite assert each dispatch site goes through the detached
root. Red/green verified: reverting any dispatch fails its test.
* fix(plugin-sdk): account for runDetachedWebhookWork in public surface budget
* fix(channels): track detached webhook processing
Co-authored-by: 許元豪 <146086744+edenfunf@users.noreply.github.com>
* docs: refresh generated docs map
* chore(plugin-sdk): refresh API baseline
* fix(webhooks): preserve post-ack ordering
* test(plugin-sdk): satisfy detached work lint
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* feat(line): wire base.allowlist config-edit adapter
LINE was the only DM/group channel without a base.allowlist adapter, so
`openclaw allow line` / the /allowlist command replied "does not support"
instead of editing the LINE allowlist. Reuse buildDmGroupAccountAllowlistAdapter
(DM + group + per-group-override scopes), matching Telegram/Signal; entry
normalization flows through the existing lineConfigAdapter.formatAllowFrom.
* fix(allowlist): preserve inherited account entries
* fix(allowlist): preserve all-scope store edits
Co-authored-by: Eden <146086744+edenfunf@users.noreply.github.com>
* test(allowlist): import config type
Co-authored-by: Eden <146086744+edenfunf@users.noreply.github.com>
* fix(allowlist): preserve empty effective overrides
Co-authored-by: Eden <146086744+edenfunf@users.noreply.github.com>
* fix(allowlist): reject group-only store edits
Co-authored-by: Eden <146086744+edenfunf@users.noreply.github.com>
* fix(allowlist): preserve cleared channel overrides
Co-authored-by: Eden <146086744+edenfunf@users.noreply.github.com>
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(embedded-runner): clear tool-search catalog when a run aborts during prep
* fix(embedded-runner): point catalog test at relocated tool-search test api
* perf(ci): scale Vitest workers with runner class and share serial module cache
Compact node-test jobs pinned OPENCLAW_VITEST_MAX_WORKERS=2 regardless of
runner size, so import-bound suites (30-45s of module-graph import per
file) crawled: runner-cli spent 284s on 5s of tests, commands-1 296s on
10s. With serial plans the budget now scales with the class (6 on 8vcpu,
3 on 4vcpu); timing-sensitive groups (tooling, tui-pty, infra-process)
stay pinned to 2 via plan-level env. Serial bins share one Vitest
fs-module-cache path so later plans reuse the first plan's transforms.
The import-bound commands stripes and security suite move to the 8vcpu
class, and packing hints refresh from serial-run measurements (run
29481835688).
* perf(ci): stripe cli-runner suite and pin media-ui worker budget
The agents-core config runs files serially (fileParallelism false guards
shared module state), so raising the worker budget cannot help its
import-heavy cli-runner suite (~35s module import per file, 213s serial).
Stripe it three ways so bins parallelize the imports instead. media-ui
hosts browser locator tests that timed out at 6 workers on the first
validation run; pin it to the proven 2-worker budget. commands-1's hint
drops to its measured 6-worker runtime.
* fix(memory-lancedb): gate auto-recall and auto-capture on per-agent memorySearch.enabled (#103590)
The before_prompt_build auto-recall hook only checked the plugin-level
autoRecall flag, so agents configured with memorySearch.enabled: false
still received <relevant-memories> injected from the shared LanceDB store
- leaking one agent's private memories into another agent's prompts. Gate
both recall injection and agent_end auto-capture on the current agent's
memorySearch.enabled (per-agent entry wins over agents.defaults; unset
means enabled), mirroring core resolveMemorySearchConfig semantics.
* fix(memory-lancedb): normalize agent ids before the memorySearch gate
Review follow-up on #103799: a configured id like 'XiaoHuo' or one with
surrounding whitespace missed the exact-match per-agent override and
inherited the enabled default, leaving the disclosure path active.
Normalize both the hook agent id and configured entry ids with the SDK
normalizeAgentId before comparing.
* fix(memory-lancedb): resolve the per-agent memorySearch gate via resolveAgentConfig
* fix(memory): isolate LanceDB rows by agent
Co-authored-by: Shubhankar Tripathy <reach2shubhankar@gmail.com>
* fix(memory): isolate LanceDB rows by agent
Co-authored-by: Shubhankar Tripathy <reach2shubhankar@gmail.com>
* refactor(memory): keep LanceDB store types private
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(line): avoid exposing media URLs in errors
* test(line): cover media URL redaction paths
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(sessions): complete tail-read windows despite short positional reads
Replace single-shot handle.read() calls in two session tail-read
paths with readFileWindowFully so multibyte-range positional reads
do not silently return incomplete tail data on network filesystems.
- readRecentTranscriptTailLinesAsync: tail-window read for recent
session messages now loops until the requested window fills
- readLastMessagePreviewFromOpenTranscriptAsync: last-message
preview tail read now loops until the requested window fills
The same readFileWindowFully helper was introduced in #108253 and
expanded with a sync variant in #108127 (both by sunlit-deng).
* fix(sessions): complete sync title preview reads
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Ports the unique coverage from #108126 onto the parser landed via #106850:
wrapped 401/403/404 and quota-exhausted 429 stay non-retryable, an
envelope embedded in user text is ignored, and a short-window wrapped
429 retries. Credit @zhanxingxin1998.
