fa0329c340
test: cover cron nested lane selection
2026-03-11 00:02:00 +00:00
36d2ae2a22
SecretRef: harden custom/provider secret persistence and reuse ( #42554 )
...
* Models: gate custom provider keys by usable secret semantics
* Config: project runtime writes onto source snapshot
* Models: prevent stale apiKey preservation for marker-managed providers
* Runner: strip SecretRef marker headers from resolved models
* Secrets: scan active agent models.json path in audit
* Config: guard runtime-source projection for unrelated configs
* Extensions: fix onboarding type errors in CI
* Tests: align setup helper account-enabled expectation
* Secrets audit: harden models.json file reads
* fix: harden SecretRef custom/provider secret persistence (#42554 ) (thanks @joshavant)
2026-03-10 23:55:10 +00:00
0bac47de51
refactor: split tar.bz2 extraction helpers
2026-03-10 23:53:32 +00:00
9c64508822
refactor: rename tar archive preflight checker
2026-03-10 23:52:51 +00:00
658cf4bd94
fix: harden archive extraction destinations
2026-03-10 23:49:35 +00:00
9f5dee32f6
fix(acp): implicit streamToParent for mode=run without thread ( #42404 )
...
* fix(acp): implicit streamToParent for mode=run without thread
When spawning ACP sessions with mode=run and no thread binding,
automatically route output to parent session instead of Discord.
This enables agent-to-agent supervision patterns where the spawning
agent wants results returned programmatically, not posted as chat.
The change makes sessions_spawn with runtime=acp and thread=false
behave like direct acpx invocation - output goes to the spawning
session, not to Discord.
Fixes the issue where mode=run without thread still posted to Discord
because hasDeliveryTarget was true when called from a Discord context.
* fix: use resolved spawnMode instead of params.mode
Move implicit streamToParent check to after resolveSpawnMode so that
both explicit mode="run" and omitted mode (which defaults to "run"
when thread is false) correctly trigger parent routing.
This fixes the issue where callers that rely on default mode selection
would not get the intended parent streaming behavior.
* fix: tighten implicit ACP parent relay gating (#42404 ) (thanks @davidguttman)
---------
Co-authored-by: Onur Solmaz <2453968+osolmaz@users.noreply.github.com>
2026-03-10 21:42:15 +01:00
283570de4d
fix: normalize stale openai completions transport
2026-03-10 20:23:03 +00:00
6d4241cbd9
fix: wire modelstudio env discovery ( #40634 ) (thanks @pomelo-nwu)
2026-03-10 19:58:43 +00:00
0687e04760
fix: thread runtime config through Discord/Telegram sends ( #42352 ) (thanks @joshavant) ( #42352 )
2026-03-10 13:30:57 -05:00
c2d9386796
fix: log auth profile resolution failures instead of swallowing silently ( #41271 )
...
Merged via squash.
Prepared head SHA: 049d1e119a
2026-03-10 20:38:49 +03:00
e9e8b81939
fix(failover): classify Gemini MALFORMED_RESPONSE as retryable timeout ( #42292 )
...
Merged via squash.
Prepared head SHA: 68f106ff49
2026-03-10 20:34:32 +03:00
bc9b35d6ce
fix(logging): include model and provider in overload/error log ( #41236 )
...
Merged via squash.
Prepared head SHA: bb16fecbf7
2026-03-10 20:32:14 +03:00
8bf64f219a
fix: recognize Poe 402 'used up your points' as billing for fallback ( #42278 )
...
Merged via squash.
Prepared head SHA: f3cdfa76dd
2026-03-10 20:17:36 +03:00
bfeea5d23f
fix(agents): prevent /v1beta duplication in Gemini PDF URL ( #34369 )
...
Strip trailing /v1beta from baseUrl before appending the version
segment, so callers that already include /v1beta in their base URL
(e.g. subagent-registry) no longer produce /v1beta/v1beta/models/…
which results in a 404 from the Gemini API.
Closes #34312
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-10 12:52:49 -04:00
ac88a39acc
fix: align pi-ai 0.57.1 oauth imports and payload hooks
2026-03-10 20:29:03 +05:30
59bc3c6630
Agents: align onPayload callback and OAuth imports
2026-03-10 08:50:30 -05:00
309162f9a2
fix: strip leaked model control tokens from user-facing text ( #42173 )
...
Models like GLM-5 and DeepSeek sometimes emit internal delimiter tokens in their responses. Uses generic pattern in the text extraction pipeline, following the same architecture as stripMinimaxToolCallXml.
Closes #40020
Supersedes #40573
Co-authored-by: imwyvern <100903837+imwyvern@users.noreply.github.com>
2026-03-10 06:27:59 -07:00
048e25c2b2
fix(agents): avoid duplicate same-provider cooldown probes in fallback runs ( #41711 )
...
Merged via squash.
Prepared head SHA: 8be8967bcb
2026-03-10 15:26:47 +03:00
aca216bfcf
feat(acp): add resumeSessionId to sessions_spawn for ACP session resume ( #41847 )
...
* feat(acp): add resumeSessionId to sessions_spawn for ACP session resume
Thread resumeSessionId through the ACP session spawn pipeline so agents
can resume existing sessions (e.g. a prior Codex conversation) instead
of starting fresh.
Flow: sessions_spawn tool → spawnAcpDirect → initializeSession →
ensureSession → acpx --resume-session flag → agent session/load
- Add resumeSessionId param to sessions-spawn-tool schema with
description so agents can discover and use it
- Thread through SpawnAcpParams → AcpInitializeSessionInput →
AcpRuntimeEnsureInput → acpx extension runtime
- Pass as --resume-session flag to acpx CLI
- Error hard (exit 4) on non-existent session, no silent fallback
- All new fields optional for backward compatibility
Depends on acpx >= 0.1.16 (openclaw/acpx#85, merged, pending release).
Tests: 26/26 pass (runtime + tool schema)
Verified e2e: Discord → sessions_spawn(resumeSessionId) → Codex
resumed session and recalled stored secret.
🤖 AI-assisted
* fix: guard resumeSessionId against non-ACP runtime
Add early-return error when resumeSessionId is passed without
runtime="acp" (mirrors existing streamTo guard). Without this,
the parameter is silently ignored and the agent gets a fresh
session instead of resuming.
Also update schema description to note the runtime=acp requirement.
Addresses Greptile review feedback.
* ACP: add changelog entry for session resume (#41847 ) (thanks @pejmanjohn)
---------
Co-authored-by: Pejman Pour-Moezzi <481729+pejmanjohn@users.noreply.github.com>
Co-authored-by: Onur <onur@textcortex.com>
2026-03-10 10:36:13 +01:00
3495563cfe
fix(sandbox): pass real workspace to sessions_spawn when workspaceAccess is ro ( #40757 )
...
Merged via squash.
Prepared head SHA: 0e8b27bf80
2026-03-10 04:12:50 -03:00
8306eabf85
fix(agents): forward memory flush write path ( #41761 )
...
Merged via squash.
Prepared head SHA: 0a8ebf8e5b
2026-03-10 14:18:41 +08:00
cf9db91b61
fix(web-search): recover OpenRouter Perplexity citations from message annotations ( #40881 )
...
Merged via squash.
Prepared head SHA: 66c8bb2c6a
2026-03-10 10:37:44 +05:30
96e4975922
fix: protect bootstrap files during memory flush ( #38574 )
...
Merged via squash.
Prepared head SHA: a0b9a02e2e
2026-03-10 12:44:33 +08:00
f0eb67923c
fix(secrets): resolve web tool SecretRefs atomically at runtime
2026-03-09 22:57:03 -05:00
731f1aa906
test: avoid detect-secrets churn in observation fixtures
2026-03-10 08:43:19 +05:30
de49a8b72c
Telegram: exec approvals for OpenCode/Codex ( #37233 )
...
Merged via squash.
Prepared head SHA: f243379094
2026-03-09 23:04:35 -04:00
9432a8bb3f
test: allowlist detect-secrets fixture strings
2026-03-10 08:14:35 +05:30
25c2facc2b
fix(agents): fix Brave llm-context empty snippets ( #41387 )
...
Merged via squash.
Prepared head SHA: 1e6f1d9d51
2026-03-10 08:09:57 +05:30
b48291e01e
Exec: mark child command env with OPENCLAW_CLI ( #41411 )
2026-03-09 19:14:08 -04:00
c9a6c542ef
Add HTTP 499 to transient error codes for model fallback ( #41468 )
...
Merged via squash.
Prepared head SHA: 0053bae140
2026-03-10 01:55:10 +03:00
531e8362b1
Agents: add fallback error observations ( #41337 )
...
Merged via squash.
Prepared head SHA: 852469c82f
2026-03-10 01:12:10 +03:00
0669b0ddc2
fix(agents): probe single-provider billing cooldowns ( #41422 )
...
Merged via squash.
Prepared head SHA: bbc4254b94
2026-03-10 00:58:51 +03:00
30340d6835
Sandbox: import STATE_DIR from paths directly ( #41439 )
2026-03-10 00:18:41 +03:00
5f90883ad3
fix(auth): reset cooldown error counters on expiry to prevent infinite escalation ( #41028 )
...
Merged via squash.
Prepared head SHA: 89bd83f09a
2026-03-09 23:40:11 +03:00
87d939be79
Agents: add embedded error observations ( #41336 )
...
Merged via squash.
Prepared head SHA: 4900042298
2026-03-09 22:27:05 +03:00
54be30ef89
fix(agents): bound compaction retry wait and drain embedded runs on restart ( #40324 )
...
Merged via squash.
Prepared head SHA: cfd99562d6
2026-03-09 08:27:29 -07:00
51bae75120
fix(kimi-coding): fix kimi tool format: use native Anthropic tool schema instead of OpenAI … (openclaw#40008)
...
Verified:
- pnpm install --frozen-lockfile
- pnpm build
- pnpm check
- pnpm test:macmini
Co-authored-by: opriz <51957849+opriz@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
2026-03-09 08:28:47 -05:00
8d2d6db9ad
test: fix Node 24+ test runner and subagent registry mocks
2026-03-09 06:45:13 +00:00
2e79d82198
build: update app deps except carbon
2026-03-09 06:09:33 +00:00
9abf014f35
fix(skills): pin validated download roots
2026-03-09 06:00:50 +00:00
e8775cda93
fix(agents): re-expose configured tools under restrictive profiles
2026-03-09 03:49:50 +00:00
adec8b28bb
alphabetize web search providers ( #40259 )
...
Merged via squash.
Prepared head SHA: be6350e5ae
2026-03-09 08:54:54 +05:30
f6243916b5
fix(models): use 1M context for openai-codex gpt-5.4 ( #37876 )
...
Merged via squash.
Prepared head SHA: c41020779e
2026-03-08 18:23:49 -07:00
ff4745fc3f
refactor(models): split provider discovery helpers
2026-03-09 00:26:20 +00:00
c29b098744
refactor(models): split models.json planning from writes
2026-03-09 00:26:20 +00:00
24b53fcf47
refactor(agents): extract provider model normalization
2026-03-09 00:26:20 +00:00
362248e559
refactor: harden browser relay CDP flows
2026-03-08 23:46:10 +00:00
661af2acd3
fix(agents): bootstrap runtime plugins before context-engine resolution
2026-03-08 23:38:38 +00:00
bf601db3fc
test: dedupe brave llm-context rejection cases
2026-03-08 23:38:24 +00:00
024857050a
fix: normalize openai-codex gpt-5.4 transport overrides
2026-03-08 23:35:21 +00:00
Peter Steinberger
Josh Avant
David Guttman
Yufeng He
JiangNan
jiarung
CryUshio
sline
Ayaan Zaidi
George Zhang
Charles Dusek
Pejman Pour-Moezzi
Daniel Reis
Frank Yang
Laurie Luo
Harold Hunt
Zhe Liu
Vincent Koc
alan blount
Altay
zerone0x
opriz
Kesku
yuweuii
0xsline