* refactor(channels): converge internal group-policy drift onto the scope tree
* chore(plugin-sdk): refresh API baseline hash for scope-key exports
* fix(config): avoid shadowing the scopeKey export in the case-insensitive lookup
New grouped sessions tool (patch: label/pin/archive/model/thinking; group
CRUD; owner-gated; no reset/delete/compact). sessions_spawn gains visible +
worktree via sessions.create with admission reservation and abort-confirmed
rollback; a started run with no run id is aborted and deleted rather than
left orphaned. subagents tool reads the unified task_runs ledger tree-scoped
(subagent/acp/media/cron) and cancels detached runs, enforcing the
controlScope gate for leaf callers. session_status gains a cost line.
Agent-origin model patches record a fallback marker; runs failing on
auth/billing/model_not_found revert to the last working model (transient
errors never revert), and an independent thinkingLevel change realigns the
marker so revert cannot clobber it.
Refs #107237
* fix(tui): keep the newer session when a stale switch history resolves last
setSession set state.currentSessionKey synchronously and then awaited
loadHistory, but nothing serialized overlapping switches. When a user
switched to session A then quickly to B, if A's loadHistory RPC resolved
after B's, A's completion saw sessionInfo.key !== the now-current key and
unconditionally reverted currentSessionKey, currentSessionId, and the
chat log back to A, and adopted A's in-flight run onto activeChatRunId.
The next typed message was then routed to A while the user believed they
were on B.
Give setSession and loadHistory a monotonic generation token, mirroring
the existing refreshSessionInfo overlap guard. setSession bumps the
generation and loadHistory captures it before the RPC, so a completion
whose generation is stale no-ops instead of clobbering the newer session.
* fix(tui): ignore rejected history from a superseded session switch
Guard the loadHistory catch path with the session-switch generation so a
stale switch whose history RPC rejects no longer writes a history-failed
notice into the session the user has since moved to.
Add a fake-backend PTY rapid-switch e2e test that drives the real runTui
loop and a reject-path regression test for the superseded-switch case.
* fix(tui): guard stale session refreshes
* test(tui): cover session alias canonicalization
* fix(tui): reject stale session refresh generations
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* feat(linux): canvas via CLI-node + Tauri app IPC bridge
* refactor: extract gateway helper modules
* build(linux-canvas): register plugin package in lockfile
* fix(linux-canvas): move canvas advertise test out of core, regen docs/protocol/deadcode
* fix(gateway): break node-catalog/registry import cycle via leaf normalize module; add canvas glossary term
* style: oxfmt invoke.ts and runtime.ts after buildNodeEventParams extraction
* fix(linux): load Canvas WebView via dedicated data_directory context
Wry's Linux/WebKitGTK incognito mode discards Tauri's registered
WebContext (wry webkitgtk/mod.rs), so the Canvas window got a fresh
ephemeral context without the openclaw-canvas:// scheme handler — the
bundled A2UI page never committed (stayed about:blank) and every A2UI
command timed out. Use an isolated cache-backed data_directory instead,
which keeps the protocol handler while still isolating Canvas storage
from the dashboard window.
* fix(linux): keep Canvas WebView ephemeral via incognito + data_directory
Autoreview flagged that a dedicated data_directory alone persists Canvas
browser state (cookies, localStorage, IndexedDB, service workers) across
restarts, so an agent that navigates Canvas to a site could leak an
authenticated session into a later session. iOS uses a non-persistent
store; Linux should match.
Add .incognito(true) alongside .data_directory(): the distinct directory
gives Tauri a fresh WebContext key so it still attaches the
openclaw-canvas:// protocol closure, and incognito makes Wry swap in a
fresh *ephemeral* context carrying those protocols. Live-verified on a
Wayland/WebKitGTK box: the bundled page still loads
(location.href=openclaw-canvas://localhost/index.html, openclawA2UI
present, A2UI renders) and the canvas-webview dir holds no persistent
cookie/storage files.
The Crestodian->OpenClaw reconciliation restored a pre-#102197 `if (opts.approved)`
wrapper around the execute-time plugin-install trust check, so an unapproved
plugin-install op produced a formatted plan for an arbitrary npm/url/file
source instead of rejecting it. Validate unconditionally, matching #102197,
and restore its dropped regression test. Also fix a stale
crestodian-ring-zero-setup id in the CI compat list and a doubled
openclaw-openclaw-planner tmpdir prefix from the mechanical rename.
* fix(sessions): wire SQLite transcript byte size into preflight compaction guard
readSessionLogSnapshot returned {} for SQLite-backed transcripts, so
maxActiveTranscriptBytes never saw a byte count and silently degraded to
token-only compaction triggering for every migrated session. Read the
size via readTranscriptStatsSync using the identity already encoded in
the SQLite sessionFile marker.
Fixes#104762
* test(memory): cover SQLite byte-triggered flush
---------
Co-authored-by: Peter Steinberger <peter@steipete.me>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(usage): keep response reads within request deadline
* fix(usage): preserve caller aborts across body reads
---------
Co-authored-by: Peter Steinberger <peter@steipete.me>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(agents): map cacheRetention 'standard' to 'short' for Bedrock Claude models
* fix(agents): scope standard cacheRetention alias to Anthropic cache family only
* fix(agents): validate prompt cache retention
* chore: keep changelog release-owned
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
