Peter Steinberger
7fd4328854
fix(e2e): include shared tool display resource in onboard docker build
2026-03-03 03:02:27 +00:00
Peter Steinberger
7bad42910b
docs: reorder unreleased changelog by user interest
2026-03-03 03:00:37 +00:00
Vincent Koc
f2c37e543e
CI: optimize Windows lane by splitting bundle and dropping duplicate lanes
2026-03-02 18:58:43 -08:00
Josh Avant
806803b7ef
feat(secrets): expand SecretRef coverage across user-supplied credentials ( #29580 )
...
* feat(secrets): expand secret target coverage and gateway tooling
* docs(secrets): align gateway and CLI secret docs
* chore(protocol): regenerate swift gateway models for secrets methods
* fix(config): restore talk apiKey fallback and stabilize runner test
* ci(windows): reduce test worker count for shard stability
* ci(windows): raise node heap for test shard stability
* test(feishu): make proxy env precedence assertion windows-safe
* fix(gateway): resolve auth password SecretInput refs for clients
* fix(gateway): resolve remote SecretInput credentials for clients
* fix(secrets): skip inactive refs in command snapshot assignments
* fix(secrets): scope gateway.remote refs to effective auth surfaces
* fix(secrets): ignore memory defaults when enabled agents disable search
* fix(secrets): honor Google Chat serviceAccountRef inheritance
* fix(secrets): address tsgo errors in command and gateway collectors
* fix(secrets): avoid auth-store load in providers-only configure
* fix(gateway): defer local password ref resolution by precedence
* fix(secrets): gate telegram webhook secret refs by webhook mode
* fix(secrets): gate slack signing secret refs to http mode
* fix(secrets): skip telegram botToken refs when tokenFile is set
* fix(secrets): gate discord pluralkit refs by enabled flag
* fix(secrets): gate discord voice tts refs by voice enabled
* test(secrets): make runtime fixture modes explicit
* fix(cli): resolve local qr password secret refs
* fix(cli): fail when gateway leaves command refs unresolved
* fix(gateway): fail when local password SecretRef is unresolved
* fix(gateway): fail when required remote SecretRefs are unresolved
* fix(gateway): resolve local password refs only when password can win
* fix(cli): skip local password SecretRef resolution on qr token override
* test(gateway): cast SecretRef fixtures to OpenClawConfig
* test(secrets): activate mode-gated targets in runtime coverage fixture
* fix(cron): support SecretInput webhook tokens safely
* fix(bluebubbles): support SecretInput passwords across config paths
* fix(msteams): make appPassword SecretInput-safe in onboarding/token paths
* fix(bluebubbles): align SecretInput schema helper typing
* fix(cli): clarify secrets.resolve version-skew errors
* refactor(secrets): return structured inactive paths from secrets.resolve
* refactor(gateway): type onboarding secret writes as SecretInput
* chore(protocol): regenerate swift models for secrets.resolve
* feat(secrets): expand extension credential secretref support
* fix(secrets): gate web-search refs by active provider
* fix(onboarding): detect SecretRef credentials in extension status
* fix(onboarding): allow keeping existing ref in secret prompt
* fix(onboarding): resolve gateway password SecretRefs for probe and tui
* fix(onboarding): honor secret-input-mode for local gateway auth
* fix(acp): resolve gateway SecretInput credentials
* fix(secrets): gate gateway.remote refs to remote surfaces
* test(secrets): cover pattern matching and inactive array refs
* docs(secrets): clarify secrets.resolve and remote active surfaces
* fix(bluebubbles): keep existing SecretRef during onboarding
* fix(tests): resolve CI type errors in new SecretRef coverage
* fix(extensions): replace raw fetch with SSRF-guarded fetch
* test(secrets): mark gateway remote targets active in runtime coverage
* test(infra): normalize home-prefix expectation across platforms
* fix(cli): only resolve local qr password refs in password mode
* test(cli): cover local qr token mode with unresolved password ref
* docs(cli): clarify local qr password ref resolution behavior
* refactor(extensions): reuse sdk SecretInput helpers
* fix(wizard): resolve onboarding env-template secrets before plaintext
* fix(cli): surface secrets.resolve diagnostics in memory and qr
* test(secrets): repair post-rebase runtime and fixtures
* fix(gateway): skip remote password ref resolution when token wins
* fix(secrets): treat tailscale remote gateway refs as active
* fix(gateway): allow remote password fallback when token ref is unresolved
* fix(gateway): ignore stale local password refs for none and trusted-proxy
* fix(gateway): skip remote secret ref resolution on local call paths
* test(cli): cover qr remote tailscale secret ref resolution
* fix(secrets): align gateway password active-surface with auth inference
* fix(cli): resolve inferred local gateway password refs in qr
* fix(gateway): prefer resolvable remote password over token ref pre-resolution
* test(gateway): cover none and trusted-proxy stale password refs
* docs(secrets): sync qr and gateway active-surface behavior
* fix: restore stability blockers from pre-release audit
* Secrets: fix collector/runtime precedence contradictions
* docs: align secrets and web credential docs
* fix(rebase): resolve integration regressions after main rebase
* fix(node-host): resolve gateway secret refs for auth
* fix(secrets): harden secretinput runtime readers
* gateway: skip inactive auth secretref resolution
* cli: avoid gateway preflight for inactive secret refs
* extensions: allow unresolved refs in onboarding status
* tests: fix qr-cli module mock hoist ordering
* Security: align audit checks with SecretInput resolution
* Gateway: resolve local-mode remote fallback secret refs
* Node host: avoid resolving inactive password secret refs
* Secrets runtime: mark Slack appToken inactive for HTTP mode
* secrets: keep inactive gateway remote refs non-blocking
* cli: include agent memory secret targets in runtime resolution
* docs(secrets): sync docs with active-surface and web search behavior
* fix(secrets): keep telegram top-level token refs active for blank account tokens
* fix(daemon): resolve gateway password secret refs for probe auth
* fix(secrets): skip IRC NickServ ref resolution when NickServ is disabled
* fix(secrets): align token inheritance and exec timeout defaults
* docs(secrets): clarify active-surface notes in cli docs
* cli: require secrets.resolve gateway capability
* gateway: log auth secret surface diagnostics
* secrets: remove dead provider resolver module
* fix(secrets): restore gateway auth precedence and fallback resolution
* fix(tests): align plugin runtime mock typings
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-03-03 02:58:20 +00:00
Peter Steinberger
f212351aed
refactor(telegram): dedupe monitor retry test helpers
2026-03-03 02:53:14 +00:00
Peter Steinberger
6408b7f81c
refactor(agents): dedupe steer restart test replacement flow
2026-03-03 02:53:14 +00:00
Peter Steinberger
1538813096
refactor(agents): dedupe ollama provider test scaffolding
2026-03-03 02:53:14 +00:00
Peter Steinberger
55c128ddc2
refactor(memory): dedupe readonly recovery test scenarios
2026-03-03 02:53:14 +00:00
Peter Steinberger
3ff0cf262d
refactor(infra): dedupe update startup test setup
2026-03-03 02:53:14 +00:00
Peter Steinberger
a50dd0bb06
refactor(infra): dedupe ssrf fetch guard test fixtures
2026-03-03 02:53:13 +00:00
Peter Steinberger
8b4cdbb21d
refactor(infra): dedupe exec approval allowlist evaluation flow
2026-03-03 02:53:13 +00:00
Peter Steinberger
b8181e5944
refactor(gateway): dedupe agents server-method handlers
2026-03-03 02:53:13 +00:00
Peter Steinberger
7a8232187b
refactor(config): dedupe session store save error handling
2026-03-03 02:53:13 +00:00
Peter Steinberger
1a0036283d
refactor(security): dedupe telegram allowlist validation loops
2026-03-03 02:53:13 +00:00
Peter Steinberger
4fb6da2b32
refactor(tests): dedupe canvas host server setup
2026-03-03 02:53:13 +00:00
Peter Steinberger
4a59d0ad98
refactor(tests): dedupe session store route fixtures
2026-03-03 02:53:13 +00:00
Peter Steinberger
d068fc9f9d
refactor(tests): dedupe agent handler test scaffolding
2026-03-03 02:53:13 +00:00
Peter Steinberger
369646a513
refactor(tests): dedupe openresponses http fixtures
2026-03-03 02:53:13 +00:00
Peter Steinberger
3460aa4dee
refactor(browser): dedupe playwright interaction helpers
2026-03-03 02:53:13 +00:00
Peter Steinberger
e290f4ca41
refactor(config): dedupe repeated zod schema shapes
2026-03-03 02:53:13 +00:00
Peter Steinberger
884ca65dc7
refactor(acp): dedupe runtime option command plumbing
2026-03-03 02:53:13 +00:00
Peter Steinberger
1a52d943ed
refactor(tests): dedupe model compat assertions
2026-03-03 02:53:13 +00:00
Peter Steinberger
7897ffb72f
refactor(memory): dedupe openai batch fetch flows
2026-03-03 02:53:13 +00:00
Peter Steinberger
5c18ba6f65
refactor(tests): dedupe gateway chat history fixtures
2026-03-03 02:53:13 +00:00
Peter Steinberger
25a2fe2bea
refactor(tests): dedupe control ui auth pairing fixtures
2026-03-03 02:53:13 +00:00
Peter Steinberger
fa4ff5f3d2
refactor(acp): extract install hint resolver
2026-03-03 02:51:24 +00:00
Peter Steinberger
ac318be405
refactor(voice-call): unify runtime cleanup lifecycle
2026-03-03 02:51:17 +00:00
Peter Steinberger
c85bd2646a
refactor(cli): extract plugin install plan helper
2026-03-03 02:51:11 +00:00
Peter Steinberger
6472e03412
refactor(agents): share failover error matchers
2026-03-03 02:51:00 +00:00
Vincent Koc
24fd6c8278
CI: use Blacksmith docker builder in sandbox smoke
2026-03-02 18:48:18 -08:00
Vincent Koc
5cffbbda32
CI: use Blacksmith docker builder in install smoke
2026-03-02 18:48:18 -08:00
Vincent Koc
85d17fd429
CI: migrate docker release build cache to Blacksmith
2026-03-02 18:48:18 -08:00
Vincent Koc
96d56a9721
CI: enable sticky-disk pnpm cache on Linux CI jobs
2026-03-02 18:48:18 -08:00
Vincent Koc
ffd3ad032a
CI: add sticky-disk mode to pnpm cache action
2026-03-02 18:48:18 -08:00
Vincent Koc
8a463af823
CI: add sticky-disk toggle to setup node action
2026-03-02 18:48:18 -08:00
Peter Steinberger
6bf1abf603
ci: use valid Blacksmith Windows runner label
2026-03-03 02:47:06 +00:00
Josh Lehman
3a8133d587
fix(scripts/pr): SSH-first prhead remote with GraphQL fallback for fork PRs ( #32126 )
...
Co-authored-by: Shakker <shakkerdroid@gmail.com >
2026-03-03 02:46:01 +00:00
Peter Steinberger
8ac924c769
refactor(security): centralize audit execution context
2026-03-03 02:42:43 +00:00
Peter Steinberger
2d033d2aa8
refactor(agents): split tool-result char estimator
2026-03-03 02:42:43 +00:00
Peter Steinberger
1ec9673cc5
refactor(telegram): split lane preview target helpers
2026-03-03 02:42:43 +00:00
Peter Steinberger
fdb0bf804f
refactor(test): dedupe telegram draft-stream fixtures
2026-03-03 02:42:43 +00:00
Peter Steinberger
40f2e2b8a6
ci: scale Windows CI runner and test workers
2026-03-03 02:42:32 +00:00
Ayaan Zaidi
87977d7a19
fix: unblock build type errors
2026-03-03 08:11:51 +05:30
Peter Steinberger
9f691099db
fix(voice-call): harden webhook lifecycle cleanup and retries ( #32395 ) (thanks @scoootscooob)
2026-03-03 02:39:50 +00:00
scoootscooob
e707c97ca6
fix(voice-call): prevent EADDRINUSE by guarding webhook server lifecycle
...
Three issues caused the port to remain bound after partial failures:
1. VoiceCallWebhookServer.start() had no idempotency guard — calling it
while the server was already listening would create a second server on
the same port.
2. createVoiceCallRuntime() did not clean up the webhook server if a step
after webhookServer.start() failed (e.g. manager.initialize). The
server kept the port bound while the runtime promise rejected.
3. ensureRuntime() cached the rejected promise forever, so subsequent
calls would re-throw the same error without ever retrying. Combined
with (2), the port stayed orphaned until gateway restart.
Fixes #32387
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-03-03 02:39:50 +00:00
Peter Steinberger
0750fc2de1
test: consolidate extension runtime mocks and split bluebubbles webhook auth suite
2026-03-03 02:37:23 +00:00
Peter Steinberger
59567a8c5d
ci: move changed-scope logic into tested script
2026-03-03 02:37:23 +00:00
Peter Steinberger
8ee357fc76
refactor: extract session init helpers
2026-03-03 02:37:23 +00:00
Peter Steinberger
9702d94196
refactor: split plugin runtime type contracts
2026-03-03 02:37:23 +00:00
AI南柯(KingMo)
30ab9b2068
fix(agents): recognize connection errors as retryable timeout failures ( #31697 )
...
* fix(agents): recognize connection errors as retryable timeout failures
## Problem
When a model endpoint becomes unreachable (e.g., local proxy down,
relay server offline), the failover system fails to switch to the
next candidate model. Errors like "Connection error." are not
classified as retryable, causing the session to hang on a broken
endpoint instead of falling back to healthy alternatives.
## Root Cause
Connection/network errors are not recognized by the current failover
classifier:
- Text patterns like "Connection error.", "fetch failed", "network error"
- Error codes like ECONNREFUSED, ENOTFOUND, EAI_AGAIN (in message text)
While `failover-error.ts` handles these as error codes (err.code),
it misses them when they appear as plain text in error messages.
## Solution
Extend timeout error patterns to include connection/network failures:
**In `errors.ts` (ERROR_PATTERNS.timeout):**
- Text: "connection error", "network error", "fetch failed", etc.
- Regex: /\beconn(?:refused|reset|aborted)\b/i, /\benotfound\b/i, /\beai_again\b/i
**In `failover-error.ts` (TIMEOUT_HINT_RE):**
- Same patterns for non-assistant error paths
## Testing
Added test cases covering:
- "Connection error."
- "fetch failed"
- "network error: ECONNREFUSED"
- "ENOTFOUND" / "EAI_AGAIN" in message text
## Impact
- **Compatibility:** High - only expands retryable error detection
- **Behavior:** Connection failures now trigger automatic fallback
- **Risk:** Low - changes are additive and well-tested
* style: fix code formatting for test file
2026-03-03 02:37:23 +00:00
