Cole Tebou 60406d0e60 feat(bluebubbles): promote attachment download errors to runtime.error and redact secrets in logs ...

Carries forward two BlueBubbles observability/security fixes from #73241
so this PR is a strict superset of the competing implementation.

- Promote attachment download failures from logVerbose to runtime.error
  alongside a verbose copy. Previously, BB attachment download failures
  (pinned-dispatcher compat bugs, BB server 500s, transient network
  errors) were invisible at default log level — agents only saw the
  `<media:image> (1 image)` placeholder text with nothing in the log
  pointing at the actual failure.
- Extend sanitizeForLog to redact `?password=…` / `?token=…` /
  `?api_key=…` / `?secret=…` query params and `Authorization: Bearer …`
  headers before they reach the log sink. BB uses query-string auth by
  default, so error chains carrying captured request URLs were
  vulnerable to leaking the API password into log aggregators
  (CWE-532).
- Move the changelog entry to the bottom of `## Unreleased` →
  `### Changes`. Insertions at the top of that section are the most
  common cause of CHANGELOG conflicts on long-lived PRs; bottom
  position keeps the diff context stable.

Both behavioral changes originated in @zqchris's PR #73241; attribution
preserved in the CHANGELOG entry.

2026-05-01 04:51:29 +00:00

..

acpx

test(plugins): align release validation fixtures

2026-04-30 01:25:54 +01:00

active-memory

fix(active-memory): expose memory tools to recall runs (#74592)

2026-05-01 05:48:59 +01:00

alibaba

perf: mark capability plugins startup lazy

2026-04-28 04:33:47 +01:00

amazon-bedrock

fix(bedrock): expose Opus 4.7 max thinking

2026-04-29 22:25:58 -07:00

amazon-bedrock-mantle

chore: update dependencies

2026-04-29 22:42:45 +01:00

anthropic

[codex] Fix commitments safety and coverage (#75302)

2026-05-01 01:14:07 +00:00

anthropic-vertex

chore: update dependencies

2026-04-29 22:42:45 +01:00

arcee

perf: mark provider plugins startup lazy

2026-04-28 04:33:47 +01:00

azure-speech

perf: mark capability plugins startup lazy

2026-04-28 04:33:47 +01:00

bluebubbles

feat(bluebubbles): promote attachment download errors to runtime.error and redact secrets in logs

2026-05-01 04:51:29 +00:00

bonjour

fix(bonjour): cap flapping advertiser restarts

2026-04-30 03:46:18 +01:00

brave

chore: update dependencies

2026-04-29 22:42:45 +01:00

browser

fix(browser): use source config for proxy decisions

2026-04-30 15:56:49 +01:00

byteplus

fix: simplify volc catalog model builders

2026-04-28 06:21:24 +01:00

cerebras

fix: normalize raw manifest provider catalogs

2026-04-28 05:30:04 +01:00

chutes

perf: mark provider plugins startup lazy

2026-04-28 04:33:47 +01:00

cloudflare-ai-gateway

perf: mark provider plugins startup lazy

2026-04-28 04:33:47 +01:00

codex

chore(release): forward-port 2026.4.29 fixes and bump 2026.4.30

2026-05-01 01:06:13 +01:00

comfy

perf: mark provider plugins startup lazy

2026-04-28 04:33:47 +01:00

copilot-proxy

perf: mark provider plugins startup lazy

2026-04-28 04:33:47 +01:00

deepgram

build(deps): trim runtime dependency graph

2026-04-29 08:11:57 +01:00

deepinfra

perf: mark provider plugins startup lazy

2026-04-28 04:33:47 +01:00

deepseek

fix(deepseek): expose V4 max thinking levels (#73008)

2026-04-30 23:34:05 +08:00

device-pair

fix(device-pair): reject invalid remote setup URLs

2026-04-29 20:45:33 +01:00

diagnostics-otel

fix(otel): record liveness warnings

2026-04-28 05:41:30 +01:00

diagnostics-prometheus

fix: restore main ci and speed tests

2026-04-28 05:34:28 +01:00

diffs

chore: update dependencies

2026-04-29 22:42:45 +01:00

discord

fix(discord): harden rate limit retries (#75338)

2026-05-01 01:49:02 +00:00

document-extract

fix(pdf): resolve standard fonts from pdfjs package root (#70936)

2026-04-30 00:38:48 -07:00

duckduckgo

perf: mark capability plugins startup lazy

2026-04-28 04:33:47 +01:00

elevenlabs

build(deps): trim runtime dependency graph

2026-04-29 08:11:57 +01:00

exa

perf: mark capability plugins startup lazy

2026-04-28 04:33:47 +01:00

fal

perf: mark provider plugins startup lazy

2026-04-28 04:33:47 +01:00

feishu

fix(feishu): skip empty-text messages with no media to prevent blank session turns (#74634) (#74661)

2026-04-30 04:24:27 +00:00

file-transfer

fix(file-transfer): require canonical node policy authorization (#74742)

2026-04-30 04:03:40 +00:00

firecrawl

chore: update dependencies

2026-04-29 22:42:45 +01:00

fireworks

chore: update dependencies

2026-04-29 22:42:45 +01:00

github-copilot

fix(github-copilot): support GUI/RPC wizard auth flow (#73290)

2026-04-29 16:45:31 -07:00

google

[codex] Fix commitments safety and coverage (#75302)

2026-05-01 01:14:07 +00:00

google-meet

fix: restore Twilio Meet voice intro

2026-05-01 05:41:49 +01:00

googlechat

fix(channels): keep status accessors config-only

2026-04-30 05:08:32 +01:00

gradium

perf: mark capability plugins startup lazy

2026-04-28 04:33:47 +01:00

groq

perf: mark provider plugins startup lazy

2026-04-28 04:33:47 +01:00

huggingface

perf: mark provider plugins startup lazy

2026-04-28 04:33:47 +01:00

image-generation-core

refactor: narrow media core plugin api barrels

2026-04-27 14:34:00 +01:00

imessage

refactor(channels): route inbound turns through kernel

2026-04-30 04:08:47 +01:00

inworld

perf: mark capability plugins startup lazy

2026-04-28 04:33:47 +01:00

irc

fix: align open DM allowlist policy (#74112)

2026-04-29 06:52:12 +01:00

kilocode

perf: mark provider plugins startup lazy

2026-04-28 04:33:47 +01:00

kimi-coding

chore: update dependencies

2026-04-29 22:42:45 +01:00

line

refactor(channels): route inbound turns through kernel

2026-04-30 04:08:47 +01:00

litellm

perf: mark provider plugins startup lazy

2026-04-28 04:33:47 +01:00

llm-task

chore: update dependencies

2026-04-29 22:42:45 +01:00

lmstudio

chore: update dependencies

2026-04-29 22:42:45 +01:00

lobster

chore: update dependencies

2026-04-29 22:42:45 +01:00

matrix

refactor(channels): route inbound turns through kernel

2026-04-30 04:08:47 +01:00

mattermost

fix: stabilize full release validation

2026-04-30 04:55:23 +01:00

media-understanding-core

refactor(media): move sharp image ops into media runtime (#71519)

2026-04-25 04:31:10 -07:00

memory-core

fix: retain local memory runtime deps

2026-04-30 15:22:26 +01:00

memory-lancedb

fix(memory-lancedb): get memory records through ltm list command (#67952)

2026-04-30 16:01:51 +08:00

memory-wiki

chore: update dependencies

2026-04-29 22:42:45 +01:00

microsoft

perf: mark capability plugins startup lazy

2026-04-28 04:33:47 +01:00

microsoft-foundry

perf: mark provider plugins startup lazy

2026-04-28 04:33:47 +01:00

migrate-claude

refactor(migration): share cached config runtime helper

2026-04-29 20:05:23 +01:00

migrate-hermes

refactor(migration): share cached config runtime helper

2026-04-29 20:05:23 +01:00

minimax

perf: mark provider plugins startup lazy

2026-04-28 04:33:47 +01:00

mistral

build(deps): trim runtime dependency graph

2026-04-29 08:11:57 +01:00

moonshot

test: relax live web search timeouts

2026-04-29 19:14:15 +01:00

msteams

refactor(channels): route inbound turns through kernel

2026-04-30 04:08:47 +01:00

nextcloud-talk

fix(nextcloud-talk): replace manual XOR with crypto.timingSafeEqual and fix length leak (#58097)

2026-05-01 10:26:54 +08:00

nostr

perf: mark channel plugins startup lazy

2026-04-28 04:33:47 +01:00

nvidia

feat(nvidia): add NVIDIA provider with onboarding flow (#71204)

2026-04-29 09:25:12 -07:00

ollama

chore: update dependencies

2026-04-29 22:42:45 +01:00

open-prose

perf: mark capability plugins startup lazy

2026-04-28 04:33:47 +01:00

openai

[codex] Fix commitments safety and coverage (#75302)

2026-05-01 01:14:07 +00:00

opencode

perf: mark provider plugins startup lazy

2026-04-28 04:33:47 +01:00

opencode-go

perf: mark provider plugins startup lazy

2026-04-28 04:33:47 +01:00

openrouter

feat(openrouter): add video generation provider (#72700)

2026-04-28 10:57:31 +01:00

openshell

feat: declare startup plugin imports explicitly

2026-04-28 04:33:47 +01:00

perplexity

perf: mark capability plugins startup lazy

2026-04-28 04:33:47 +01:00

phone-control

feat: declare startup plugin imports explicitly

2026-04-28 04:33:47 +01:00

qa-channel

chore: update dependencies

2026-04-29 22:42:45 +01:00

qa-lab

chore(release): forward-port 2026.4.29 fixes and bump 2026.4.30

2026-05-01 01:06:13 +01:00

qa-matrix

test(ci): harden release failure paths

2026-04-29 06:41:58 +01:00

qianfan

refactor: build qianfan and xiaomi catalogs from manifests

2026-04-28 05:30:04 +01:00

qqbot

fix(qqbot): unify slash command auth, c2cOnly gating, and file delivery (#73616)

2026-04-30 16:12:39 +08:00

qwen

docs(types): mark remaining deprecated aliases

2026-04-29 00:04:17 -07:00

runway

perf: mark capability plugins startup lazy

2026-04-28 04:33:47 +01:00

searxng

perf: mark capability plugins startup lazy

2026-04-28 04:33:47 +01:00

senseaudio

perf: mark capability plugins startup lazy

2026-04-28 04:33:47 +01:00

sglang

perf: mark provider plugins startup lazy

2026-04-28 04:33:47 +01:00

shared

refactor: split plugin sdk test helpers

2026-04-28 01:14:19 +01:00

signal

Isolate Codex app-server state per agent (#74556)

2026-05-01 04:49:02 +09:00

skill-workshop

chore: update dependencies

2026-04-29 22:42:45 +01:00

slack

Isolate Codex app-server state per agent (#74556)

2026-05-01 04:49:02 +09:00

speech-core

fix(gateway): use runtime config for secret-backed talk

2026-04-28 06:05:27 +01:00

stepfun

fix: narrow stepfun manifest provider keys

2026-04-28 05:30:04 +01:00

synology-chat

refactor(channels): finish turn kernel migration

2026-04-30 01:31:00 +01:00

synthetic

perf: mark provider plugins startup lazy

2026-04-28 04:33:47 +01:00

talk-voice

feat: declare startup plugin imports explicitly

2026-04-28 04:33:47 +01:00

tavily

chore: update dependencies

2026-04-29 22:42:45 +01:00

telegram

fix: keep telegram polling timeout above long poll

2026-04-30 16:11:42 +01:00

tencent

feat: declare tencent tokenhub model catalog

2026-04-28 05:30:04 +01:00

test-support

refactor: split plugin sdk test helpers

2026-04-28 01:14:19 +01:00

thread-ownership

feat: declare startup plugin imports explicitly

2026-04-28 04:33:47 +01:00

tlon

refactor(channels): route remaining turns through kernel

2026-04-29 23:16:16 +01:00

together

feat: declare together model catalog

2026-04-28 07:25:03 +01:00

tokenjuice

fix(plugins): use tokenjuice published openclaw types

2026-04-29 19:12:52 -07:00

tts-local-cli

perf: mark capability plugins startup lazy

2026-04-28 04:33:47 +01:00

twitch

refactor(channels): finish turn kernel migration

2026-04-30 01:31:00 +01:00

venice

fix(deepseek): backfill v4 assistant reasoning replay

2026-04-28 10:07:39 +01:00

vercel-ai-gateway

fix: add vercel ai gateway thinking profile

2026-04-29 12:13:20 +01:00

video-generation-core

refactor: narrow media core plugin api barrels

2026-04-27 14:34:00 +01:00

vllm

perf: mark provider plugins startup lazy

2026-04-28 04:33:47 +01:00

voice-call

fix: restore Twilio Meet voice intro

2026-05-01 05:41:49 +01:00

volcengine

fix: simplify volc catalog model builders

2026-04-28 06:21:24 +01:00

voyage

perf: mark capability plugins startup lazy

2026-04-28 04:33:47 +01:00

vydra

perf: mark provider plugins startup lazy

2026-04-28 04:33:47 +01:00

web-readability

perf: mark capability plugins startup lazy

2026-04-28 04:33:47 +01:00

webhooks

refactor(plugin-sdk): add managed task flow runtime

2026-04-28 05:32:40 +01:00

whatsapp

refactor(channels): route inbound turns through kernel

2026-04-30 04:08:47 +01:00

xai

chore: update dependencies

2026-04-29 22:42:45 +01:00

xiaomi

refactor: build qianfan and xiaomi catalogs from manifests

2026-04-28 05:30:04 +01:00

zai

perf: mark provider plugins startup lazy

2026-04-28 04:33:47 +01:00

zalo

refactor(channels): route inbound turns through kernel

2026-04-30 04:08:47 +01:00

zalouser

refactor(channels): route inbound turns through kernel

2026-04-30 04:08:47 +01:00

.npmignore

…

AGENTS.md

Docs: add test performance guardrails

2026-04-17 02:23:49 -04:00

CLAUDE.md

…

music-generation-providers.live.test.ts

test(live): classify provider media drift

2026-04-29 05:25:43 +01:00

tsconfig.package-boundary.base.json

…

tsconfig.package-boundary.paths.json

refactor(plugin-sdk): retire reserved helper exports

2026-04-28 05:21:57 +01:00

video-generation-providers.live.test.ts

test(live): classify provider media drift

2026-04-29 05:25:43 +01:00