* fix(line): adopt durable ingress drain with ack gated on spool write
LINE acked webhooks 200 before processing events detached, so a crash or
dispatch failure silently lost inbound messages. Events now enqueue their raw
JSON into the channel ingress queue before the webhook responds; dispatch,
retry, dead-letter, and completion tombstones run through the core drain.
The in-memory replay guard is deleted; tombstone retention (30d/4096)
strictly covers its old 10min/4096 window, and message-id keys preserve the
guard keyspace so redeliveries under changed webhookEventIds still dedupe.
Autoreview: secret scanner false-positive on HMAC test fixtures
(test-channel-secret); full manual review of all five files + test matrix
performed instead. Part of the #109657 fleet adoption program (wave 1).
* style(line): oxfmt pass on drain adoption files
* fix(line): cap repeated ingress drain deliveries
* fix(line): preserve ingress lifecycle bounds
* style(line): satisfy ingress lint gates
* fix(slack): adopt durable ingress drain across Bolt and relay with logical twin guard
Slack events now enqueue their raw envelope durably before the transport ack
on all three modes: the Bolt receiver wrap covers Socket Mode and HTTP
(event_id = Events API event_id), and relay frames enqueue before the router
ack (keyed by logical team:channel:ts since router delivery-id redelivery
stability is undocumented). Dispatch, retry, dead-letter, and 30d/20k
tombstones run through the core drain; claimed relay events retry until the
relay source reattaches after a restart. The in-memory + persistent inbound
delivery caches and the app-mention race machinery are deleted.
One dedupe layer deliberately survives: Slack emits both a message and an
app_mention event (distinct event_ids) for a single mention post, so a new
claim-based dispatch guard keyed on logical (team, channel, ts) collapses the
twins — commit at turn adoption, release on gated/abandoned dispatch so the
surviving twin can re-run the same gate. 24h/20k retention mirrors the
retired persistent cache.
Slack monitor test state now scopes a fresh OPENCLAW_STATE_DIR per test;
persisted guard keys otherwise dedupe unrelated fixture messages that reuse
ts values. Five reaction tests in monitor.tool-result.test.ts are flaky on
clean origin/main under full-suite load (verified 2-of-3 baseline runs);
tracked separately.
Autoreview: secret scanner false-positives on token-shaped test fixtures
(three files); full manual review performed instead, which caught and fixed
the twin-guard regression. Part of the #109657 fleet adoption program.
* fix(slack): remove unused ingress exports
* chore(slack): prune max-lines baseline
* docs(plugin-sdk): refresh API baseline hash
* test(slack): type dispatch mock argument
* test(slack): use managed temp root
* Harden Mattermost API paths
* fix(mattermost): guard direct media file paths
* refactor(mattermost): streamline API path validation
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(signal): adopt durable ingress drain with deferred claims through debounce
Signal's receive loop was purely in-memory: a crash between signal-cli
receive and dispatch silently lost the message with no re-emit. Dispatchable
receive envelopes (data/edit/reaction; never sync/receipt/typing) now journal
their raw JSON at one chokepoint (event_id = [sender uuid/number, timestamp],
lane per group/sender) before the SSE loop continues — the awaited enqueue is
the only receive boundary signal-cli offers. Dispatch, retry, dead-letter,
and 30d/1000 tombstones run through the core drain with startup + interval
pumps.
Debounce merging stays on under the drain: claims defer (held, watchdog
armed) instead of completing at enqueue, a merged flush fans adoption out to
every constituent claim, terminal no-dispatch turns settle by completing
(skipped -> completed), and exhausted flush retries abandon claims back to
queue retry policy. Regression tests cover deferred return, merged fan-out
adoption, and no-adoption settlement.
No prior replay guard existed; this adoption adds durable cross-restart
dedupe. Autoreview blocked by codex sandbox network in the build stage; full
manual review performed (caught the debounce bypass and the unsettled gated
claims). Part of the #109657 fleet adoption program (wave 1).
* fix(signal): keep ingress test helpers private
* fix(signal): align ingress lifecycle result types
* fix(sms): adopt durable ingress drain with ack gated on MessageSid enqueue
Twilio inbound webhooks acked 200 then dispatched detached behind a 10-minute
in-memory replay guard; Twilio does not reliably retry inbound messages, so a
crash between ack and dispatch silently lost the SMS. The raw Twilio form now
enqueues durably (event_id = MessageSid, lane per sender) before the TwiML
200; dispatch, retry, dead-letter, and tombstones run through the core drain
with a startup + interval pump for restart recovery. Payload/account
validation moved to parse-at-dispatch and dead-letters as non-retryable. The
replay guard and its saturation 429 path are deleted; 24h/20k tombstones
strictly cover the old 10min/10k window.
Autoreview P1 (ambiguous non-adopted settlement) rejected with evidence:
bindIngressLifecycleToReplyOptions threads onAdopted/onDeferred/onAbandoned
into reply admission, so deferral and abandonment settle via core lifecycle
callbacks; normal non-adopted return = terminal local handling, matching the
Telegram reference mapping (skipped -> completed). Part of #109657 wave 1.
* fix(sms): keep ingress payload type internal
* fix(sms): preserve Twilio message SID aliases
* fix(sms): preserve ingress ordering and timestamps
* test(sms): satisfy type and lint gates
* fix(voice-call): honor abortSignal during Twilio audio chunk pacing
* fix(voice-call): prove abortable Twilio pacing
Exit chunk pacing immediately on cancellation, preserve unexpected delay failures, and make the regression target the first real audio chunk with deterministic timers.
Co-authored-by: wangmiao0668000666 <wang.miao86@xydigit.com>
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(browser): honor abortSignal during Playwright click-and-hold delay
The click-and-hold delay in clickViaPlaywright slept with a bare
setTimeout(resolve, delayMs) where delayMs can reach ACT_MAX_CLICK_DELAY_MS
(5s). The interaction AbortSignal was checked before and after the sleep
but the sleep itself was not abortable, so an abort mid-hold left the
action chain orphaned: the ref'd timer kept the event loop busy for the
full remaining delay and postponed the navigation-guard teardown (grace
recheck and, with an SSRF policy, the page.route interception) until the
orphaned sleep ended.
Swap the bare timer for sleepWithAbort(delayMs, signal) from
openclaw/plugin-sdk/runtime-env so the abort clears the timer and unwinds
the chain immediately. The caller-visible rejection is unchanged: the
abort listener registered before the action still wins the race with the
original signal.reason.
Co-Authored-By: Claude <noreply@anthropic.com>
* refactor(browser): reuse click abort helper
Keep the contributor abort-aware hold delay while deleting duplicate promise and listener lifecycle code in favor of the existing interaction helper.
Co-authored-by: wangmiao0668000666 <wang.miao86@xydigit.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(browser): honor AbortSignal in tab discovery poll
* fix(browser): unify abort-aware tab discovery
Apply the canonical abortable sleep to both discovery loops, reject late backend results after cancellation, and replace timing-sensitive proof with deterministic timer coverage.
Co-authored-by: wangmiao0668000666 <wang.miao86@xydigit.com>
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(msteams): cancel non-OK consent upload response body before throwing
* fix(msteams): release all consent upload responses
Cancel unread response bodies after successful uploads as well as failed uploads, and fold the lifecycle assertions into the existing status-path tests.
Co-authored-by: Monkey-wusky <66244686+Monkey-wusky@users.noreply.github.com>
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* perf(sdk): load Claude CLI identity from a narrow plugin artifact
src/plugin-sdk/anthropic-cli.ts snapshots CLAUDE_CLI_BACKEND_ID at module
scope through the sync facade loader, which jiti-evaluates the full
anthropic api.js barrel on source checkouts: 130.86s of self time per
cold worker on CI (Testbox import profile), silently stalling every job
whose graph reaches cli-runner/prepare.ts. A narrow cli-api.js artifact
carries the two static facts; Testbox proof: the reliability+helpers
agents-core pair drops from 157.6s to 14.3s.
* perf(ci): stripe unit-fast and tooling node tests on the full plan
core-fast ran the import-bound unit-fast graph as one job (247s vitest,
181s module evaluation) and core-tooling as one serial job (241s); both
now stripe on the full plan like the compact plan, so the compact-only
expansion is deleted and the docker helper config rides with the
isolated shard on both plans. Group hints refreshed from main run
29551077288; stale per-file commands hints dropped (the consolidation
landed); cache-writer selection and the warm workflow track the stripe
names.
* fix(state): tolerate vanished sqlite sidecars in agent-db permission sweep
existsSync+chmodSync raced SQLite's own WAL/SHM cleanup: a checkpoint or
close between the two calls throws ENOENT (observed from the transcript
reconcile worker in server-startup-web-fetch-bind on CI). chmod directly
and swallow only ENOENT, which removes the TOCTOU window.
