1042b59471
feat(web-search): add bundled Exa plugin ( #52617 )
2026-03-22 20:57:33 -07:00
04cd389ef8
fix(ci): repair voice-call typing and provider contracts
2026-03-22 20:17:01 -07:00
59105fd614
fix(ci): restore plugin manifests and boundary tests
2026-03-22 20:01:25 -07:00
ac0fd26e16
fix(ci): resync generated baselines and line runtime seam
2026-03-22 19:53:26 -07:00
02f8a86e5c
refactor(kilocode): route shared model constants through core seam
2026-03-22 19:43:19 -07:00
3ad652fa9e
fix(build): restore plugin-sdk and line compat after refactor
2026-03-22 19:37:27 -07:00
042669d8c8
refactor(plugins): finish provider and whatsapp cleanup
2026-03-22 19:13:25 -07:00
2131981230
refactor(plugins): move remaining channel and provider ownership out of src
2026-03-22 19:13:25 -07:00
f04b49ee3e
test: fix provider config typing drift
2026-03-22 19:10:43 -07:00
74cb08bede
fix(plugins): accept media-understanding id hints
2026-03-23 02:08:49 +00:00
9aafff7378
fix: restore main gate after type updates
2026-03-22 19:08:08 -07:00
e5be5c1b99
style: format plugin sdk helper updates
2026-03-23 01:56:01 +00:00
7d032ed38c
refactor: add provider onboarding preset appliers
2026-03-23 01:56:00 +00:00
29f3b7f6eb
fix: harden image auth env lookups ( #52552 ) (thanks @vincentkoc)
2026-03-22 18:42:18 -07:00
ecdf5d457a
test: fix latest main test regressions
2026-03-22 18:28:13 -07:00
0a329b2c9f
Revert "style(format): fix check drift in provider tests"
...
This reverts commit 2619f5fe55
2026-03-22 18:25:07 -07:00
2619f5fe55
style(format): fix check drift in provider tests
2026-03-22 18:24:40 -07:00
6fde263046
fix(ci): refresh bundled plugin metadata
2026-03-22 18:19:49 -07:00
b5b193d5ca
fix(moonshot): refresh kimi k2 catalog
2026-03-22 18:00:51 -07:00
3fe96c7b9e
device-pair: align internal command checks
2026-03-22 17:56:33 -07:00
100d9a7a23
refactor: share boundary open and gateway test helpers
2026-03-23 00:37:05 +00:00
a5ace56a19
test: align rebased expectations and typecheck ( #52428 ) (thanks @karanuppal)
2026-03-22 16:56:19 -07:00
38ee17145b
fix: restore rebase regression coverage ( #52428 ) (thanks @karanuppal)
2026-03-22 16:56:19 -07:00
63130118ba
test: fix rebased gateway and binding baselines ( #52491 )
2026-03-22 23:22:48 +00:00
d73852ff21
fix: land plugin discovery missing-entry handling ( #52491 ) (thanks @hclsys)
2026-03-22 23:22:48 +00:00
4f11982ae6
fix: emit warn diagnostic for I/O errors, keep silent only for ENOENT
...
Address Codex P1 + Greptile P2: the previous commit collapsed both
"path" (ENOENT) and "io" (EACCES/EMFILE) into silent null returns.
Now:
- reason="path" (missing file): return null silently — not a security issue
- reason="io" (permission/disk): push warn diagnostic — surface anomaly
without aborting gateway
- reason="validation" (path escape): push error diagnostic — security violation
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: HCL <chenglunhu@gmail.com>
2026-03-22 16:13:54 -07:00
8701a224f8
fix(plugins): distinguish missing entry file from security violation
...
resolvePackageEntrySource() treats all openBoundaryFileSync failures
as path-escape security violations. When an extension entry file is
simply missing (ENOENT, reason="path"), the gateway emits "extension
entry escapes package directory" and aborts — crashing in a loop.
Root cause: src/plugins/discovery.ts:478 checks !opened.ok but never
inspects opened.reason. SafeOpenSyncResult already distinguishes
"path" (ENOENT) from "validation" (actual path escape).
Fix: only push the security diagnostic when opened.reason is
"validation". For "path" or "io" failures, return null to skip the
entry silently — a missing file is not a security violation.
Closes #52445
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: HCL <chenglunhu@gmail.com>
2026-03-22 16:13:54 -07:00
1eba6f830c
test: remove stale plugin registry helper
2026-03-22 23:07:32 +00:00
d84b3f5d5d
test: fix conversation binding registry stub
2026-03-22 16:02:13 -07:00
f8ff2a4f38
test: fix gate after main drift
2026-03-22 23:00:02 +00:00
5c8e1275a0
feat(minimax): add missing pi catalog models
2026-03-22 15:55:20 -07:00
1ad47b8fa1
test: harden path resolution test helpers
2026-03-22 22:47:58 +00:00
5a8f77aa6a
refactor: adopt chat plugin builder in zalouser
2026-03-22 22:45:06 +00:00
9c0983618e
feat(models): sync pi provider catalogs
2026-03-22 15:40:56 -07:00
6df6a691fc
perf: lazy-load plugin runtime heavy surfaces
2026-03-22 22:33:07 +00:00
47e8ffc2e9
test: repair current main gate regressions
2026-03-22 22:22:46 +00:00
91cd38f4d4
fix(test): repair main CI drift
2026-03-22 22:12:43 +00:00
e15f156f85
fix(test): reduce node hotspot startup cost
...
Scope: conversation-binding/targets startup trimming + schema help isolation guardrail
2026-03-22 15:05:00 -07:00
f7bc9818b5
feat(minimax): support fast mode and sync pi defaults
2026-03-22 14:54:30 -07:00
5d379f92a3
perf: lazy-load plugin install runtime helpers
2026-03-22 21:52:42 +00:00
4235fb16d6
perf: split provider metadata from runtime loading
2026-03-22 21:52:42 +00:00
ae6f42484f
fix: restore cron and bundled plugin test metadata
2026-03-22 14:49:40 -07:00
11ca41f457
fix(test): repair cron and loader regressions
2026-03-22 14:39:17 -07:00
171b24c5c5
perf: generate bundled plugin metadata for cold startup
2026-03-22 21:28:16 +00:00
3ca7922dfe
refactor: split plugin command registration startup path
2026-03-22 21:28:16 +00:00
cf8891a824
fix: stabilize docker live test lanes
2026-03-22 20:07:27 +00:00
b369397b43
ACP: revert acpx-plugin package naming ( #52456 )
...
* ACP: revert acpx-plugin package naming
* Test: format acp install hints expectations
2026-03-22 20:55:48 +01:00
4240c64491
test: harden no-isolate oauth contract coverage
2026-03-22 12:31:36 -07:00
f85cfc8b6c
fix(gateway): harden first-turn startup readiness ( #52387 )
...
* fix(gateway): harden first-turn startup readiness
* fix(gateway): scope startup model retry
2026-03-22 12:12:08 -07:00
e3151af6bc
refactor(cli): extract hook pack update flow
2026-03-22 12:02:52 -07:00
5696e24c3f
refactor(cli): use typed clawhub fallback decisions
2026-03-22 12:02:52 -07:00
412a3eb1ac
build: bump version to 2026.3.22
2026-03-22 11:58:33 -07:00
c40488453e
test: remove thread-unsafe cwd mutations
2026-03-22 11:47:28 -07:00
b79560c7f0
ACP: fully rename acpx plugin ( #52404 )
...
* ACP: rename acpx plugin package
* ACP: fully rename acpx plugin
* ACP: remove old acpx paths
* Docs: add bundled plugin naming guardrails
* Docs: keep plugin naming guardrails internal
* ACP: keep acpx plugin id stable
* ACP: drop old acpx-plugin tree
2026-03-22 19:33:31 +01:00
04b283ffc2
fix: restore clawhub archive installs and gateway params
2026-03-22 18:31:52 +00:00
88d39b1542
refactor: simplify remaining runtime singletons
2026-03-22 18:09:45 +00:00
f095bbd7b0
refactor: simplify plugin runtime singletons
2026-03-22 18:09:45 +00:00
ca986d05aa
test: trim repeated archive install work
2026-03-22 18:05:44 +00:00
91b2800241
feat: add native clawhub install flows
2026-03-22 17:03:49 +00:00
1d2dff0c4e
test: trim import-heavy startup paths
2026-03-22 16:34:09 +00:00
3fa2300ba1
perf: reduce plugin runtime startup overhead
2026-03-22 16:34:09 +00:00
3ce5a8366a
fix(plugins): enforce minimum host versions for installable plugins ( #52094 )
...
* fix(plugins): enforce min host versions
* fix(plugins): tighten min host version validation
* chore(plugins): trim dead min host version code
* fix(plugins): handle malformed min host metadata
* fix(plugins): key manifest cache by host version
2026-03-22 09:12:08 -07:00
05279539a8
docs(plugin-sdk): document public SDK surface
2026-03-22 08:50:48 -07:00
e1ff24903f
fix(gateway): follow up startup import reviews ( #52337 )
2026-03-22 08:48:53 -07:00
d3a0a623a3
fix(gateway): trim startup plugin imports ( #52326 )
...
* fix(gateway): trim startup plugin imports
* fix(gateway): follow up startup import reviews
2026-03-22 08:43:54 -07:00
b70b7b0d94
test: trim more local test startup overhead
2026-03-22 09:35:36 +00:00
94ec0d6aeb
test: trim plugin-sdk import-heavy startup
2026-03-22 07:22:42 +00:00
b2f9ab9a1f
test: trim import-heavy startup paths
2026-03-22 05:59:46 +00:00
e1854dfbf6
test: trim import-heavy startup paths
2026-03-22 05:03:10 +00:00
0f6dbb4390
Fix configure cache ownership for plugin resolvers ( #52018 )
...
* fix configure cache ownership
* address web-search cache review
* rekey provider wizard cache
* honor plugin cache opt-outs
* fix cache invalidation gaps
* align plugin snapshot ttl
* refresh snapshot cache keys
2026-03-21 23:41:45 -05:00
177136c964
perf(inbound): trim reply startup imports ( #51988 )
...
* perf(inbound): narrow reply startup imports
* perf(inbound): trim reply startup imports
* fix(perf): dedupe archive helpers
2026-03-21 20:49:41 -07:00
d81772dbc7
test: trim import-heavy startup paths
2026-03-22 02:11:43 +00:00
2cc777539a
perf: reduce plugin and memory startup overhead
2026-03-22 02:11:43 +00:00
d0d82ea67b
test: trim import-heavy startup paths
2026-03-22 00:53:12 +00:00
8b7f40580d
perf: split telegram audit runtime seams
2026-03-22 00:53:12 +00:00
37d5cbe43a
test: trim test startup overhead
2026-03-21 23:30:51 +00:00
80441baa15
perf(core): trim provider and inbound startup imports ( #51927 )
...
* fix(telegram): fail fast on stuck getUpdates
* perf(core): trim provider and inbound startup imports
2026-03-21 16:20:42 -07:00
5069c771e7
fix(test): recycle unit-fast CI batches ( #51884 )
...
* fix(test): recycle unit-fast ci batches
* refactor(config): narrow discord timeout import
* test(outbound): lighten target plugin stubs
* refactor(auth): narrow env api key resolution
* docs(auth): restore anthropic vertex sentinel comment
2026-03-21 14:56:29 -07:00
4229ffe2b9
perf: reduce runtime and test startup overhead
2026-03-21 20:18:16 +00:00
fd2b3ed6af
feat(memory): pluggable system prompt section for memory plugins ( #40126 )
...
Merged via squash.
Prepared head SHA: 5228d1937f
2026-03-21 11:20:45 -07:00
d6367c2c55
refactor: route Telegram runtime through plugin sdk ( #51772 )
2026-03-21 10:24:56 -07:00
c0e482f4bd
refactor: route iMessage runtime through plugin sdk ( #51770 )
2026-03-21 10:21:20 -07:00
6516cfa566
refactor: route Slack runtime through plugin sdk ( #51766 )
2026-03-21 10:11:17 -07:00
e24bf22f98
Fix Discord `/codex_resume` picker expiration ( #51260 )
...
Merged via squash.
Prepared head SHA: 76eb184dbe
2026-03-21 12:59:21 -04:00
2fe0efc9e1
fix: compaction safeguard summary budget ( #27727 )
...
Merged via squash.
Prepared head SHA: a7ab64e394
2026-03-21 09:27:51 -07:00
2e8c8a7ae6
refactor(openai): centralize provider defaults
2026-03-21 08:40:03 -07:00
265386cd6b
feat(plugins): register claude bundle commands natively
2026-03-21 08:14:48 -07:00
1169d51aee
fix(onboarding): clarify web search key copy
2026-03-21 08:13:39 -07:00
a3a5cad7d7
fix(onboarding): hide image-only auth providers
2026-03-21 07:42:42 -07:00
f10d054745
refactor: route discord runtime through plugin sdk ( #51444 )
2026-03-21 07:40:51 -07:00
11aff6ed72
fix(auth): support remote Codex OAuth manual input ( #51631 )
...
* fix(auth): support remote codex oauth manual input
* fix: support remote Codex OAuth manual input (#51631 ) (thanks @cash-echo-bot)
---------
Co-authored-by: Cash Williams <cashwilliams@gmail.com>
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
2026-03-21 19:40:54 +05:30
7bf437402d
fix: trim config validation startup imports ( #51574 )
...
Merged via squash.
Prepared head SHA: 23b235e465
2026-03-21 09:31:39 -04:00
2fd372836e
iOS: improve QR pairing flow ( #51359 )
...
- improve QR pairing UX and bootstrap token handling
- preserve repeated optimistic user messages during refresh
- add regression coverage for refresh reconciliation
Thanks @ImLukeF
2026-03-21 01:10:29 -05:00
6b4c24c2e5
feat(telegram): support custom apiRoot for alternative API endpoints ( #48842 )
...
* feat(telegram): support custom apiRoot for alternative API endpoints
Add `apiRoot` config option to allow users to specify custom Telegram Bot
API endpoints (e.g., self-hosted Bot API servers). Threads the configured
base URL through all Telegram API call sites: bot creation, send, probe,
audit, media download, and api-fetch. Extends SSRF policy to dynamically
trust custom apiRoot hostname for media downloads.
Closes #28535
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(telegram): thread apiRoot through allowFrom lookups
* fix(telegram): honor lookup transport and local file paths
* refactor(telegram): unify username lookup plumbing
* fix(telegram): restore doctor lookup imports
* fix: document Telegram apiRoot support (#48842 ) (thanks @Cypherm)
---------
Co-authored-by: Cypherm <28184436+Cypherm@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
2026-03-21 10:10:38 +05:30
b71686ab44
Enhance web search provider config validation and compatibility handling
...
- Added a test to ensure no warnings for legacy Brave config when bundled web search allowlist compatibility is applied.
- Updated validation logic to incorporate compatibility configuration for bundled web search plugins.
- Refactored the ensureRegistry function to utilize the new compatibility handling.
2026-03-20 18:20:50 -07:00
2364e45fe4
test: align extension runtime mocks with plugin-sdk ( #51289 )
...
* test: align extension runtime mocks with plugin-sdk
Update stale extension tests to mock the plugin-sdk runtime barrels that production code now imports, and harden the Signal tool-result harness around system-event assertions so the channels lane matches current extension boundaries.
Regeneration-Prompt: |
Verify the failing channels-lane tests against current origin/main in an isolated worktree before changing anything. If the failures reproduce on main, keep the fix test-only unless production behavior is clearly wrong. Recent extension refactors moved Telegram, WhatsApp, and Signal code onto plugin-sdk runtime barrels, so update stale tests that still mock old core module paths to intercept the seams production code now uses. For Signal reaction notifications, avoid brittle assertions that depend on shared queued system-event state when a direct harness spy on enqueue behavior is sufficient. Preserve scope: only touch the failing tests and their local harness, then rerun the reproduced targeted tests plus the full channels lane and repo check gate.
* test: fix extension test drift on main
* fix: lazy-load bundled web search plugin registry
* test: make matrix sweeper failure injection portable
* fix: split heavy matrix runtime-api seams
* fix: simplify bundled web search id lookup
* test: tolerate windows env key casing
2026-03-20 15:59:53 -07:00
c3972982b5
fix: sanitize malformed replay tool calls ( #50005 )
...
Merged via squash.
Prepared head SHA: 64ad5563f7
2026-03-20 15:03:30 -07:00
3da66718f4
Web: derive search provider metadata from plugin contracts ( #50935 )
...
Merged via squash.
Prepared head SHA: e1c7d72833
2026-03-20 12:41:04 -07:00
62ddc9d9e0
refactor: consolidate plugin sdk surface
2026-03-20 19:24:10 +00:00
46854a84a4
test(plugin-sdk): cover legacy root diagnostic listeners
2026-03-20 12:23:02 -07:00
Vincent Koc
Peter Steinberger
Josh Lehman
HCL
Onur Solmaz
Tak Hoffman
Jari Mustonen
scoootscooob
Harold Hunt
Pandadadadazxf
Echo
RichardCao
Val Alexander
Cypherm
Tyler Yust
Gustavo Madeira Santana