Fail build and copy generators with ETIMEDOUT after 600000ms and terminate the complete managed process tree. Keep the timeout policy in the bundled-assets caller while preserving the shared helper for distinct callers such as #111349.
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
* fix(scripts): keep format-docs output tails UTF-8 safe
When formatter (oxfmt) error output exceeds the 16 KiB tail cap and the
retained byte window starts inside a multibyte UTF-8 character, the
diagnostic tail would begin with a replacement character (�).
Add a decodeUtf8Tail helper that skips leading UTF-8 continuation bytes
before decoding the byte suffix, matching the existing pattern in
scripts/run-additional-boundary-checks.mjs (#109167).
Keep the existing 16 KiB cap and ASCII behavior unchanged.
* refactor(scripts): share UTF-8-safe output tails
Co-authored-by: 陈志强0668000989 <chen.zhiqiang1@xydigit.com>
* test(scripts): prove real formatter UTF-8 failures
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(e2e): bound Docker stats sample lines
* fix(e2e): format Docker stats line cap proof
* fix docker stats CRLF line cap
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* feat(ui): add chat media player cards
* fix(ui): harden chat media attachment lifecycle
* fix(ui): finalize chat media fallbacks
* fix(ui): rely on video playback errors
* fix(ui): guard deferred media resume
* test(ui): align local media assertions with player cards
* docs(ui): note cross-origin download fallback
* fix(ui): keep player helpers module-private
* test(ui): wait for encoded video attachment
* test(ui): wait for hidden audio media element
* test(scripts): give oxlint shard-kill test headroom under CI load
Allow before_agent_reply plugins to declare host-enforced trigger eligibility so scheduled-only hooks do not block interrupted user-turn recovery. Keep omitted and malformed scopes fail-closed, scope both memory-core maintenance hooks, and cover three runner reload cycles through the public registration contract.
Refs: #111442
Source: #114836
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
The qa-profile-evidence timeout was deliberately raised to 90m (28e09a04d3)
without its workflow guard; code-mode-repair.ts grew a local copy of
CodeModeFailurePhase stranding the runtime re-export, and the matrix test
kept an unused validateQaEvidenceSummaryJson import.
* feat(gateway): share the canonical browser-origin policy with plugins
Export resolveAcceptedBrowserOrigin through openclaw/plugin-sdk/webhook-request-guards
so browser-facing plugin routes reuse the Gateway's real origin contract instead of a
narrow allowedOrigins array check. Private LAN/Tailnet Control UI loads and the
Host-header fallback were previously rejected with 403 by plugin offer routes while the
Control UI itself worked.
Moves the loopback/forwarded-header helpers to net.ts (re-exported from auth.ts) so the
guard can delegate without importing gateway auth, and migrates the Codex realtime
broker onto the shared seam.
* feat(talk): let providers own agent delegation for realtime voice
Adds an optional runAgentConsult callback to the browser-session create request and
injects the existing embedded consult runtime from talk-client, bound to the same agent
and session key the GA tool path uses. Providers whose realtime protocol delegates work
through their own control channel (rather than GA function calls) can now reach the
OpenClaw agent without a client round-trip.
Threads the effective per-session model into browser-session capability resolution so a
request-level model override selects the right capability set, and propagates a caller
abort signal into consultRealtimeVoiceAgent so a superseded delegation stops its run.
* feat(openai): support GPT-Live realtime voice over ChatGPT OAuth
Implements OpenAI's quicksilver/frameless session natively for Talk browser sessions.
The Gateway creates the WebRTC call (multipart sdp+session to https://api.openai.com/v1/live)
and owns the sideband control socket, so the browser never holds upstream credentials;
delegation.created events run through the OpenClaw agent and stream back as speakable
context appends.
Verified end-to-end on 2026-07-28 against a ChatGPT Pro OAuth profile: call create 201
with an rtc_* id and answer SDP, sideband session.started, session.close teardown.
ChatGPT OAuth is preferred over a Platform API key because /v1/live access for platform
keys is waitlist-gated; the legacy chatgpt.com backend route returns 403 for every model
and protocol version and is not used.
Accepted models are gpt-live-1-codex and gpt-live-1-boulder-alpha; the voice allowlist is
the ten values the route actually accepts, since an invalid voice is rejected at call
creation and cannot be repaired afterwards (session.update reports immutable_field_update).
* docs: document GPT-Live Talk support and its route gotchas
Records the working route and auth, the accepted models and voices, the browser-only
scope, and the two traps that cost the most time: the chatgpt.com backend route returns
403 Voice session access denied for every model, and that same 403 is also what an
invalid voice returns, so it must not be read as an account entitlement block.
* fix(openai): resolve GPT-Live CI failures
* refactor(openai): own zod runtime dependency
* fix(openai): satisfy lint and live-shard gates for GPT-Live
Types the retry-delay finish callback as Error so the rejection reason is provably an
Error at the call site; the abort path already normalized a non-Error AbortSignal reason,
but the unknown parameter type hid that from static analysis.
Registers the new GPT-Live live test in the native-live-extensions-openai shard
expectation. The shard selector already picked the file up from the real tree; only the
hardcoded list in the tooling test lagged.
* fix(openai): clean up post-rebase capability resolver
* fix(openai): preserve GPT-Live delegation fragments
* fix(openai): close GPT-Live sideband handoff race
* fix(openai): accept UUID GPT-Live call ids
* style: apply oxfmt to GPT-Live sources and Talk docs
* style: format Talk docs after rebase
* fix(openai): keep GPT-Live transcript context across ignored delegations
* origin/test/parallels-main-3224005-host:
docs(changelog): cover Windows prerequisite readiness
fix(e2e): preserve Windows installer reboot results
docs(changelog): include Windows stop safety gate
fix(e2e): force Windows smoke gateway stop
docs(changelog): note Parallels and update fixes
fix(update): finalize install switches in fresh process
fix(e2e): harden Parallels guest preparation
* origin/main: (72 commits)
fix: macOS-only Parallels smoke harness regression (#75293)
fix(ios): use configured speech language for system voice (#113372)
refactor: centralize isolated agent test ownership (#115340)
test(ui): stabilize browser route readiness (#115320)
fix(cron): clear automation after failed scheduler shutdown (#115316)
fix: keep isolated gateway workspaces and skills inside state dir (#114487)
docs: document local TTS on macOS, Linux, and Windows (#110230)
fix(tasks): clone only the requested task page (#114277)
fix(agents): prevent Code Mode resume loss and unbounded preparation (#115314)
fix(process): preserve the first process cancellation reason (#115317)
fix(nostr): report unavailable ingress when queue open fails (#115313)
fix: prevent Slack and Feishu ingress startup leaks (#115295)
fix(slack): avoid unsafe emphasis boundaries (#111575)
fix: prevent changed checks from expanding into full lint (#115322)
fix(codex): stabilize prompts and expose real cache regressions (#115238)
refactor(ui): derive page route specs from the route table (#115214)
fix(compaction): plan cut points in trigger units (#111886) (#115309)
fix: prevent cron and gateway stress-run timeouts (#115241)
fix(ci): validate frozen Matrix QA targets (#115298)
test(macos): block real process fallthrough (#113337)
...
# Conflicts:
# CHANGELOG.md
