* feat(presentation): support hosted widget actions
* refactor(discord): route widget launches through presentation
* chore: keep changelog release-owned
* test(interactive): type the invalid web-app boundary case explicitly
* test: type web-app action fixtures against the split union
The two-member web-app union no longer accepts a distributed
type: "url" | "web-app" literal or an empty receipt in typed
callbacks; use explicit action casts and the Discord receipt factory.
* fix(cli): add 10s timeout to port-inspection subprocess calls
fuser, netstat, and lsof can hang on a busy or misbehaving system.
Node.js execFileSync already supports a timeout option; use 10s to
match the existing convention in debug-claude-usage.ts.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(cli): harden port subprocess deadlines
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(workboard): record resolved runtime metadata instead of hardcoded codex engine
Workboard executions labeled every dispatched run engine=codex, model=default,
and id suffix :codex even for Claude/other harness agents. The gateway agent
admission phase now returns the resolved {harness, provider, model} for plugin
subagent runs; the dispatcher records it verbatim and omits engine/model when
unresolved. Engine becomes an open runtime identifier in the workboard
contract (built-in launch choices stay a closed list), store/UI normalizers
preserve historical labels as written instead of inventing codex, and new
execution ids use an :agent-session suffix. Fixes#108362
* fix(workboard): accept undefined engine in ui engineModel helper
* refactor(channels): generalize channel retry runner and retry-after parsing; drop dead configured-state probes
* fix(channels): align retry and metadata contracts
Apply the existing device-token ownership rule to node pairing list, approve, reject, and rename. Preserve shared-auth, admin, and self-service management while preventing cross-device enumeration and mutation.
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(gateway): allow clearing agent model overrides
* fix(protocol): preserve Swift agent model compatibility
* fix(protocol): preserve null when Swift decodes agent updates
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(line): run post-ack webhook processing on its own admitted work root
LINE acks the webhook and dispatches event processing fire-and-forget on
the same async chain. The HTTP request admission that chain inherited is
released as soon as the route handler returns, and a released admission
refuses subordinate queue work - so every LINE inbound agent turn fails
with "GatewayDrainingError: Gateway is draining; new tasks are not
accepted" even though the gateway is healthy. DMs, group mentions, and
postbacks are all affected; the user-visible symptom is the bot replying
"Sorry, I encountered an error processing your message." to everything.
Add runDetachedWebhookWork to the plugin-sdk webhook-request-guards
surface (a thin wrapper over the gateway independent-root continuation,
the same shape core uses in gateway/server/hooks.ts) and route all three
LINE ack-first dispatch sites through it: the gateway monitor handler
(the live path), and the createLineNodeWebhookHandler / Express
middleware handlers (public webhook building blocks an embedder can
register under the gateway). #65375 unified these three into one ack-first
pattern; keeping the detach consistent avoids re-introducing the same
latent defect in the two that are not on the live gateway path today.
The continuation is reserved synchronously while the request is still
admitted, so the detached processing stays accepted and a real restart
drain can wait for it instead of stranding it mid-turn.
Tests pin every layer: the guards suite proves detached post-ack work is
admitted after the request admission is released (and that the inherited
chain without the helper is refused); the monitor lifecycle suite and the
webhook-node suite assert each dispatch site goes through the detached
root. Red/green verified: reverting any dispatch fails its test.
* fix(plugin-sdk): account for runDetachedWebhookWork in public surface budget
* fix(channels): track detached webhook processing
Co-authored-by: 許元豪 <146086744+edenfunf@users.noreply.github.com>
* docs: refresh generated docs map
* chore(plugin-sdk): refresh API baseline
* fix(webhooks): preserve post-ack ordering
* test(plugin-sdk): satisfy detached work lint
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* feat(line): wire base.allowlist config-edit adapter
LINE was the only DM/group channel without a base.allowlist adapter, so
`openclaw allow line` / the /allowlist command replied "does not support"
instead of editing the LINE allowlist. Reuse buildDmGroupAccountAllowlistAdapter
(DM + group + per-group-override scopes), matching Telegram/Signal; entry
normalization flows through the existing lineConfigAdapter.formatAllowFrom.
* fix(allowlist): preserve inherited account entries
* fix(allowlist): preserve all-scope store edits
Co-authored-by: Eden <146086744+edenfunf@users.noreply.github.com>
* test(allowlist): import config type
Co-authored-by: Eden <146086744+edenfunf@users.noreply.github.com>
* fix(allowlist): preserve empty effective overrides
Co-authored-by: Eden <146086744+edenfunf@users.noreply.github.com>
* fix(allowlist): reject group-only store edits
Co-authored-by: Eden <146086744+edenfunf@users.noreply.github.com>
* fix(allowlist): preserve cleared channel overrides
Co-authored-by: Eden <146086744+edenfunf@users.noreply.github.com>
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(embedded-runner): clear tool-search catalog when a run aborts during prep
* fix(embedded-runner): point catalog test at relocated tool-search test api
* fix(memory-lancedb): gate auto-recall and auto-capture on per-agent memorySearch.enabled (#103590)
The before_prompt_build auto-recall hook only checked the plugin-level
autoRecall flag, so agents configured with memorySearch.enabled: false
still received <relevant-memories> injected from the shared LanceDB store
- leaking one agent's private memories into another agent's prompts. Gate
both recall injection and agent_end auto-capture on the current agent's
memorySearch.enabled (per-agent entry wins over agents.defaults; unset
means enabled), mirroring core resolveMemorySearchConfig semantics.
* fix(memory-lancedb): normalize agent ids before the memorySearch gate
Review follow-up on #103799: a configured id like 'XiaoHuo' or one with
surrounding whitespace missed the exact-match per-agent override and
inherited the enabled default, leaving the disclosure path active.
Normalize both the hook agent id and configured entry ids with the SDK
normalizeAgentId before comparing.
* fix(memory-lancedb): resolve the per-agent memorySearch gate via resolveAgentConfig
* fix(memory): isolate LanceDB rows by agent
Co-authored-by: Shubhankar Tripathy <reach2shubhankar@gmail.com>
* fix(memory): isolate LanceDB rows by agent
Co-authored-by: Shubhankar Tripathy <reach2shubhankar@gmail.com>
* refactor(memory): keep LanceDB store types private
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(sessions): complete tail-read windows despite short positional reads
Replace single-shot handle.read() calls in two session tail-read
paths with readFileWindowFully so multibyte-range positional reads
do not silently return incomplete tail data on network filesystems.
- readRecentTranscriptTailLinesAsync: tail-window read for recent
session messages now loops until the requested window fills
- readLastMessagePreviewFromOpenTranscriptAsync: last-message
preview tail read now loops until the requested window fills
The same readFileWindowFully helper was introduced in #108253 and
expanded with a sync variant in #108127 (both by sunlit-deng).
* fix(sessions): complete sync title preview reads
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Ports the unique coverage from #108126 onto the parser landed via #106850:
wrapped 401/403/404 and quota-exhausted 429 stay non-retryable, an
envelope embedded in user text is ignored, and a short-window wrapped
429 retries. Credit @zhanxingxin1998.
* fix: normalize provider keys during model config merge
* fix: normalize source-managed provider keys when reapplying secret markers
Make enforceSourceManagedProviderSecrets canonicalize provider keys with
normalizeProviderId so mixed-case (e.g. "OpenAI") source config still matches
the canonical "openai" generated provider. Without this, the trim-only source
lookup misses, the source SecretRef marker is never reapplied, and resolved
runtime secret values leak into generated models.json.
Adds plan-level regressions in models-config.runtime-source-snapshot.test.ts
covering mixed-case apiKey and header source configs.
* fix: use Array#toSorted in mixed-case provider regression tests
oxlint(no-array-sort) flagged the new test assertions for using
.sort() on Object.keys(...). Switch to .toSorted() to keep the
check-lint shard green.
* style(agents): oxfmt models-config provider merge files
* fix(agents): define provider key collision precedence
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Co-authored-by: Peter Steinberger <peter@steipete.me>
The canonical schema gate rejects non-STRICT tables, failing every
gateway-suite shard since #108543 added the tombstones table without
STRICT. Align it with every sibling table and regenerate the schema
mirror.
* fix(plugins): handle ENOTDIR gracefully in npm-project-roots
The listManagedPluginNpmProjectRootsSync and listManagedPluginNpmProjectRoots
functions only caught ENOENT errors when reading the projects directory,
but an ENOTDIR error (when a file path is mistakenly used as a directory)
would propagate unhandled and crash the CLI.
Replace the local isMissing helper with the shared isNotFoundPathError from
infra/path-guards.ts, which already covers both ENOENT and ENOTDIR.
Fixes#107467
* test(plugins): use managed temp directory fixture
* chore: keep release notes out of contributor PR
* fix(plugins): restore not-found path guard export
* fix(plugins): normalize Windows managed install paths
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Co-authored-by: Peter Steinberger <peter@steipete.me>
* fix(envelope): accept timestamp 0 in formatEnvelopeTimestamp
formatEnvelopeTimestamp used if (!ts) to check for missing timestamps,
which incorrectly rejected the valid numeric timestamp 0 (Unix epoch).
Replace the falsy check with an explicit undefined/null check so 0 is
treated as a valid timestamp value.
* refactor(auto-reply): tighten epoch timestamp fix
Exercise the public envelope path with an exact epoch result and keep the missing-value guard aligned with its declared input type.
Co-authored-by: zenglingbiao <zeng.lingbiao@xydigit.com>
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
