* feat(cron): add pure scheduled execution context builder
buildScheduledExecutionContext derives one occurrence's principal, placement,
authority, tool policy, resource scopes and inference account from stored job
fields plus caller-read facts (parent row, requester check). No consumer reads
it yet; admission minting follows in openclaw-0d5.2.
Jobs with sourceConversation or operatorSource become children of that exact
parent and pause when it is removed, archived or reset, or its worktree is
gone. Key-only parent links stay on their legacy decisions. A parent-linked
job without a recorded requester gets no owner authority.
The admission-source rule moves unchanged into src/cron/admission-source.ts
so the timer and the builder share one owner.
* feat(cron): mint the scheduled execution context at run admission
Each prompt-executor attempt reads the parent session row (for jobs with an
exact parent link), rechecks the requester, builds the context and binds it to
the admitted run. A parent-linked context holds the parent's session generation
so assertCurrent fails once the parent is reset or removed; the lease is
released when the admission closes. Nothing reads the context yet, and minting
errors become a fail result instead of failing the run.
The prompt executor's scheduled tool policy setup moves into the same module so
the executor stays under its line cap.
* test(cron): add execution context replay and stored-shape fixtures
execution-context-projection reproduces what the existing scheduled-run code
decides for a stored job and labels where the context differs (equal,
gain-intended, gain-unexpected, loss, retarget, pause). Doctor will reuse it.
scripts/dev/cron-context-replay.mts is a development script: it copies a
Gateway's state and agent session databases with SQLite's online backup into a
private temp directory, replays every stored job against the copies, prints the
labels and can emit anonymized job shapes. The fixture test pins the builder and
projection results for those shapes.
* fix(cron): align the context's parent read with principal resolution
Read the parent row with the same precedence the builder uses (operator source
first, then the creating conversation). Expose the minted context through the
admission owner until a consumer reads it, use typed rank lookups, keep real
exports in test mocks, and register the replay script as a Knip script entry.
* fix(cron): keep replay fixtures faithful to runtime admission
Replay now reads the parent row with the admission's parent precedence
(operator source first) and resolves each job's agent through the cron
owner resolver, reporting jobs with no resolvable owner instead of
replaying them as main. Fixture anonymization keeps operator sources,
channel requesters, lifecycle-revision changes and worktree existence,
so emitted fixtures replay to the same outcome as the recorded jobs.
Drops two tests that restated existing assertions and comments that
named future work.
* fix(cron): release the minted context when admission preparation throws
The parent-generation lease taken while minting was released only by a closed admission or the missing-fence path. Any other preparation error left it held. The prompt executor now releases it whenever preparation throws, and admission keeps releasing it on close.
* fix(cron): sanitize every replay fixture payload and keep tool-cap inputs
Script and system-event payloads were exported unchanged, so --emit-fixtures could write private script bodies into anonymized fixtures. Trigger and runtime-authority markers were dropped, letting resolveCronRunToolsAllow widen a restricted automatic cap in the fixture.
* fix(cron): hold the observed parent generation for revisionless links
A parent link stored without a lifecycle revision leased generation null, which the generation owner rejects against the row's revision, so a valid parent-linked occurrence minted a fail result. Admission now leases the revision of the parent row the builder validated. Also replaces the anonymizer's switch with returns that satisfy consistent-return.
The maintainer live-proof runner stopped in listNodes with "Runtime config is not prepared", asked for System Events automation consent to read the frontmost app, and found no editable element because Peekaboo reports the textField raw value.
* feat(automations): migrate heartbeat jobs through Doctor
Migrate heartbeat state, scratch, execution policy, and monitor ownership into ordinary editable Automations. Preserve Doctor backups and a once-only migration notice, controller settlement, retained source authority, and revision-owned scratch.
* fix(automations): retain implicit owner task enablement
Separate legacy enrollment from migration discovery so stored tasks retain implicit ambient cadence without provisioning jobs on empty installations. Preserve explicit monitor and task disables.
* fix(automations): preserve migration and execution contracts
* test(automations): prepare migrated wake fixtures
* test(automations): adapt imported presence cases to the request fixture
Keep the five native Mac presence identity assertions on the existing S3 options-based fixture. The merged cases still referenced their predecessor helper names, breaking the Gateway-methods test type graph and runtime shard.
Validation: 21 focused cases, Gateway-methods test type graph, typed lint, formatting, and scoped review pass.
* fix(automations): preserve main-session delivery controls
Keep announce and owner delivery available for main-session agent turns in the CLI and editor. Preserve unflagged main delivery defaults and system-event/script restrictions.
* fix(automations): retain one-shot jobs outside active hours
Remove four dormant, uncalled developer tools: the CLI OAuth/MCP proof,
shell-completion simulator, iOS log-copy helper, and CPU-profile summarizer.
Remove their dedicated tests and shrink test inventories. Shared helpers,
supported product commands, and retained completion/OAuth regressions stay.
837 production/tooling lines removed. Caller and history audit found no live
package, workflow, docs, skill, or script caller, and no current-week edits.
Manual use of these retired developer entrypoints now requires Git history or
the supported product/platform tools. No runtime guard, public contract, schema,
or durability change.
Exact-head hosted CI passed. Independent review, both zero-cycle checks, script
and root-test types, lint, and 41 retained product tests passed. Local broad Knip
scans timed out; the script scan passed. A local Crabbox fixture timeout remains
disclosed in the PR (its untouched baseline passed); no passing replay is claimed
as a fix. No retries, skips, or timeout changes were added.
Derive script report and option types from their producers and existing owners. Remove redundant planning, validation, and process-forwarding paths while preserving output and lifecycle contracts.
Remove 1,131 net production lines across 63 scripts. Linux Testbox focused tests, script and consuming-test types, changed-file checks, lint, dead-export scans, and import-cycle checks passed.
Maintainer-authorized inherited-CI exception: source-map-js advisory GHSA-68fv-2mgg-jv7q fails identically in PR CI 37402187044 and main CI 37402399816. The aggregate failed and 75 sibling jobs were cancelled; that hosted coverage is not claimed as passing. Dependency and sensitive-change reviews passed. Full evidence and compatibility disposition are recorded in the PR.
Specialize private agent, Gateway, infrastructure, and plugin flows to their actual callers. Remove unused options, fixed-value forwarding, and unread result fields while preserving public SDK, configuration, protocol, and lifecycle contracts. Preserve the new commentary-media ownership hook during conflict integration.
Net production reduction: 969 lines. Independent review was clean; focused owner tests passed and both import-cycle checks reported zero. Matching inherited main failures and exact-head CI evidence are recorded in PR #165198. Related prior batches: #164268, #164810, #165124.
Use one metadata owner for pairing failures and one constructor table for message-only worker errors, preserving parameter-bearing reconstruction and subclass precedence. Reuse canonical error coercion, simplify identical transport copy and Slack/Teams classification, and share the argument-error class across four script entrypoints.
Messages, status and exit codes, retry behavior, and serialized error shapes remain unchanged. Net reduction: 144 production lines and 9 tooling lines; the PR contains the below-threshold coverage log. No tests were removed or weakened.
Validation: focused error/CLI/HTTP/worker tests, plugin contracts, both import-cycle checks, the changed-file gate plan, and independent review.
A Bun Gateway could not control its managed desktop without a separate
Node.js install: the computer host resolved a real Node from the desktop
PATH (#147275, then #151933 skipped Bun's node shim). Under Node that
owner already returned process.execPath; under Bun it demanded a second
runtime even though the helper and the CUA provider run on Bun.
Spawn the helper with process.execPath and resolveRuntimeWorkerArgv, the
contract other runtime workers use. Node keeps the same executable.
The runtime test now asserts the helper runs on the host's executable;
it fails under Bun with the previous code, which launched a PATH node.
The Linux live proof gains --runtime to start the built Gateway on
another executable with no node on PATH and to record every owned
process's executable. Docs drop the Node requirement and note that
Bun 1.4.2 lets launched desktop apps inherit the helper's streams until
Bun marks inherited descriptors close-on-exec like Node (openclaw/bun#12).
Consolidate repeated tooling flows while preserving command contracts. Fix swallowed HTML translation errors and browser-realm error handling in the Google Live smoke. Owner tests and CLI parity passed on Testbox; final broad gate replay follows a fixture lint correction.
Open About beside Connection and Gateways without requiring a Gateway connection. Replace the obsolete menu-bar description with the current homepage tagline, retain build metadata and resource links, and add Copy Build Info.
* feat: change the voice during a Talk call
* refactor(talk): group runtime modules and deduplicate shared operations
* fix(discord): support changing voices during active calls
Bind the Talk voice tool to an authorized Discord room run and reconnect its
speaker providers without changing saved defaults. Preserve final transcripts,
unheard exact speech, accepted agent work, and supported provider ownership.
Report unsupported in-call changes before reconnecting.
Repair browser and relay cancellation, stale callbacks, replay, and teardown
races exposed by review. Validate with voice and playback regressions, browser
E2E, scoped lint and types, package builds, and independent review.
* fix(ci): document native voice event coverage
* fix(talk): preserve history across voice changes
* refactor(talk): keep relay capacity limits private
* fix(talk): complete asynchronous stop handling
* fix(talk): complete browser cleanup promise ownership
* fix(ci): close voice selection validation gaps
Keep Discord configuration inputs acyclic, preserve exact gateway method-order coverage for the new voice RPCs, and repair existing process-readiness and wrapper-dependency fixtures without weakening their guards.
* feat(talk): support in-call voice changes on iOS and Android
Negotiate voice selection and consume the Gateway handoff event through the
native call owners. Preserve the conversation, accepted agent work, and the
original Gateway connection while awaiting source closure and replacement
media readiness. Fence Stop, account changes, and push-to-talk recorder races.
Keep successful selections through same-Gateway iOS reconnects without saving
voice defaults. Replace mobile protocol exclusions with handlers, document the
supported transports, and localize failure guidance.
* fix(ci): leave generated native locales to the refresh workflow
* fix: negotiate mobile in-call voice selection support
* feat(openai): support public GPT-Live-1 voice sessions
Adapt public Live sessions, startup events, delegation, audio, captions, and
Platform authentication through the existing OpenAI voice plugin. Keep the
Codex subscription transport separate.
Persist public WebRTC transcripts through the Gateway and drain provider
finalization before releasing voice session owners across relay, Discord,
Voice Call, and MeetingBot. Preserve synchronous bridge disposal.
Validate targeted protocol and lifecycle regressions, authenticated synthetic
voice and WebRTC flows, and the iOS Simulator app build.
Closes#145071
* fix(voice): preserve cleanup and package boundaries
Keep the OpenAI capability catalog cold, remove the delegation type cycle, and expose portable Google mock declarations. Route failed call startup through the existing binding cleanup owner and stop failed local audio processes while provider finalization drains.
* fix(ui): preserve public Live caption fragments
Carry explicit verbatim semantics through the browser transcript pipeline so split words, repeated fragments, whitespace, and overlapping speakers bypass legacy ASR heuristics. Keep Gateway-only persistence and avoid synthetic final or item events.
* test(openai): expose portable delegation mock types
Use public logger and gateway callback contracts in test helpers so declaration-enabled plugin package compilation does not reference private Vitest types. Verified declaration compilation for all six affected plugins and test callers.
* fix(openai): wait for delayed GPT-Live delegation transcripts
Retain metadata-only public delegation notices while user captions are empty, resume through the existing admission owners when text arrives, and claim notice IDs before callbacks to prevent duplicate work. Bound pending notices and missing-input waits; revoke them during close, cancellation, and transcript drain. Preserve subscription prompt fallback behavior.
Validation: 103 focused tests pass; new regressions failed against the original behavior. Independent P0-P2 autoreview is scoped-clean. Combined type/lint gates are owned by the landing checkout because declaration boundaries reject this worker worktree borrowed compiler install.
* feat(openai): select GPT-Live Talk defaults by account
Resolve unpinned Talk models with the selected agent account and session requirements. Platform credentials select public GPT-Live; ChatGPT-only accounts select the subscription voice model. Preserve explicit model pins, manual responses, video, Azure, and direct tool bridge defaults. Keep catalog discovery aligned with session creation without rewriting saved config.
Validation: 177 focused tests pass; scope and account regressions fail on the prior owners. Authenticated microphone-to-delegation-to-spoken-answer proof passes with 211200 audio bytes and awaited completed shutdown. Core and plugin production/test typechecks pass; independent review through P2 is scoped-clean. Full changed-file guards continue in the landing workflow.
* test(openai): isolate Talk account default coverage
Keep the routing suite below its existing line limit by reusing its fixtures in a focused defaults suite with injected host auth. Use explicit blocks in the live audio fixture. Production behavior is unchanged.
Validation: all 61 routing/default tests, extension test typecheck and typed lint pass; independent P0-P2 review is scoped-clean.
* refactor(openai): split realtime delegation dispatch and tests
Keep direct bridge admission and dispatch in a focused local owner, reuse the existing bridge fixture across a dedicated delayed-delegation suite, and apply the required block style. Preserve lifecycle checks, callback binding, transcript publication and subscription behavior without relaxing file budgets.
Validation: 103 focused tests pass across five files; independent P0-P2 autoreview is scoped-clean. The landing lane owns canonical typed validation of the combined candidate with physical dependencies.
* test(openai): expose portable bridge mock callback types
Use public Mock annotations tied to the realtime callback and logger contracts so exported bridge fixtures emit declarations without Vitest private Procedure types.
Validation: actual OpenAI declaration emission and extension-test typecheck pass after reproducing TS2883 before the fix; 40 helper-consumer tests pass; independent P0-P2 autoreview scoped-clean.
* fix(openai): preserve camera-capable Talk defaults
* fix(talk): align browser capabilities with launch models
Resolve optional provider and model overrides through the existing Talk catalog before browser camera negotiation. Preserve other provider rows and explicit model choices, while unpinned OpenAI Talk follows the requested GPT Live account defaults.
* fix(ui): avoid shadowing Talk provider selections
* feat(tui): answer agent questions in gateway and local modes
Render session-owned questions with choices, Other, multi-select, a stepper,
Skip, expiry, and /question. Restore pending prompts after reconnect and
session changes, and keep masked input outside the composer and history.
Serve local questions through QuestionManager and claim eligible replies
before queue policy so answers cannot wait behind their blocked run.
Keep local secret-store requests blocked with explicit setup guidance.
Recover uncertain resolutions without replaying input and surface saved
secret refresh failures without exposing submitted values.
Validation: 1,893 focused and sibling tests; 102 PTY tests; isolated Gateway
and local scripted-model round trips; full build; check:changed; docs checks;
independent P0-P2 review. The broader docs anchor audit reports three existing
broken links in untouched generated maturity pages.
* fix(ci): register the TUI question proof command
* fix(scripts): use system Bash for macOS tooling and owned Mach-O fixtures
Pin native entrypoints and package commands to /bin/bash, guard portable heredoc callers on Darwin, and preserve Bash 3.2 boolean parsing. Streamed installers explain how to use system Bash when their input cannot be replayed.
Generate deterministic x86_64, arm64, and arm64e framework fixtures instead of borrowing /bin/ls. Preserve the existing framework pipeline repair from #141056 and verify merged slice bytes.
* fix(scripts): keep guarded portable scripts bash 3.2 compatible
* fix(scripts): keep macOS Bash CI coverage green
Distinguish sourced installer returns from stdin exits without ShellCheck unreachable-code warnings. Retain the shebang regression suite in changed-target routing, and repartition hosted tooling tails toward 50-second groups within the existing 150-second budget and 80-job cap.
Validation: 635 interpreter and routing tests plus 53 planner tests passed; ShellCheck, targeted lint, formatting, and fresh Codex review passed. The broader local changed-file check hit an unrelated existing dependency graph crossing through extensions/reef/node_modules/@noble/hashes; exact-head hosted CI remains required.
* docs(install): use system Bash in install and recovery commands
Align macOS-facing copy-and-paste commands and emitted installer guidance with the supported streamed interpreter. This addresses the remaining installer-command review finding without changing the PR body.
Validation: streamed help for both installers, install.sh dry-run, 16 selected fresh-install and upgrade lifecycle tests, formatting, diff check, and fresh Codex review passed. Landing remains blocked by unrelated provider-transport integration CI failure caused by an unchanged incomplete plugin-registry mock.
* fix(scripts): preserve streamed installs and CI packing
Keep public installer commands portable while replaying Darwin Bash 5.3+
stdin under system Bash through an immediately unlinked private temp file.
Retain actionable sourced-install rejection and the SC2317-safe check.
Restore the original CI packing policy and move the Bash policy scan into
its existing macOS tooling owner without adding a routed test file.
Validation: real Homebrew Bash streamed help and cleanup; 642 scan/routing
tests; 23 selected installer tests under both PATH orders; planner cap and
coverage tests; 139 Bash syntax checks; ShellCheck; 1,135 changed-gate tests;
focused lint/changed-check repair; fresh Codex review with no P0/P1 findings.
Use fresh proof-only token auth for both macOS and Linux rig configs and force loopback token auth at Gateway launch. Keep read-only CLI calls usable without creating or copying device identities, preserve node pairing and signing guards, and isolate ambient Gateway credentials and targets. Cover generated configs and command precedence, and document secret-safe proof cleanup.
* chore(deps): update cooled Oxfmt and isolate declaration fixtures
Select Oxfmt 0.65.0 and its 19 native bindings at the seven-day cutoff, preserving all other dependency pins and security policy. Apply its canonical formatter output and split over-limit UI presentation owners without adding lint or assertion exemptions.
Expose only the real packages needed by declaration fixtures instead of the entire repository dependency namespace. Preserve compiler mutation, cache, publication and cleanup guards and existing deadlines. Retain the fallback boundary assertion that the final reply outcome is failed.
Local proof: 100 declaration and sibling tests; 48 Chromium form-boundary tests; focused UI type/lint/ownership checks; inspected synthetic before/after UI parity; full formatter check; clean bounded Codex review. Current-main integration and exact-head CI follow before landing.
* test(ci): cover unified declarations on Windows
Exercise both declaration fixture modes in the existing second Windows lane. Preserve its serial execution, worker count, and deadlines. Inventory and workflow guards pass; native execution is required in PR CI.
* fix(build): keep native Node steps shell-free on Windows
Preserve literal Node arguments, including encoded import URLs, when the build orchestrator delegates to managed execution. Share native invocation construction across ordinary steps and no-pnpm fallbacks, while retaining pnpm shim handling and all shell-safety and process-cleanup guards.
Four boundary regressions fail before and pass after the repair. Final local launcher and combined declaration runs pass 204 and 21 tests respectively. The original native Windows failure and unrelated local readiness diagnostic are retained in PR evidence.
* style: apply Oxfmt to integrated main changes
Apply only verified canonical formatter output to five newly integrated files. The reviewed Windows launcher repair remains byte-identical. Whole formatting, UI types/build, and the complete line-limit ratchet pass.
* test(ui): consolidate unresolved session workspace cases
* style: format refreshed main presentation changes
Canonical Oxfmt output only. Preserved reviewed Windows and fixture bytes; verified frozen install, all-tree formatting, 382 changed core/UI/package lint targets, 59 session-menu tests, UI types and the canonical UI build.
* style: format current main approval and profile code
* fix(gateway): distinguish policy denials from pending approval
Correct session-host picker guidance after hot-reloaded node command denials. Evaluate Gateway policy independently from pairing approval while keeping commands and capabilities bounded by actual admission. Preserve live connections across deny and reallow. Follow-up to the hot-reload integration in https://github.com/openclaw/openclaw/pull/137160. Verified with registry-backed regressions, 127 owner and sibling tests, 14 UI tests, and a real Gateway/browser deny-reallow flow.
* style: format the updated dashboard gallery
* test(telegram): synchronize abort with real probe backoff
* style: format the current Devices action menu
* fix(ui): keep sidebar invitation layout stable
Keep deployment policy and browser dismissal authoritative while deferring the invitation until active sidebar interaction ends. Remove its independent idle-loaded component, preserve internal focus handoffs and organizer drag ownership, and keep artwork loading geometry-neutral.
Protect the original layout race and delayed policy, pointer, keyboard, drag, touch-input, disablement, and dismissal paths. Full owner proof passed 35 browser and 344 unit cases; four negative controls failed as intended. Final lint, styles, invitation cases and existing build budgets pass. Document the first-appearance behavior.
Independent scoped P0 review found no actionable issue. Follow-up for https://github.com/openclaw/openclaw/pull/137004.
* style: format integrated connected-account views
Canonical Oxfmt output for current main account controls. Executable AST and literal values remain unchanged; profile/account unit tests, browser flows, real-Gateway policy flow, and scoped checks pass. Independent P0 review found no actionable issue. The separately reported startup-JS budget excess remains a pre-land blocker.
* perf(ui): defer connected-account English copy
Load the 50 unchanged account-specific strings with their existing UI consumers rather than every initial page. Preserve shared navigation copy, the complete ordered catalog, and English fallback while registering the fragment in host generation and source hashing.
The explicit startup gate changes from 350191 B failing to 349242 B passing: 949 B removed with no budget, baseline, boot-manifest, or translation-memory changes. The canonical catalog is byte-identical; 150 unit tests, 16 browser cases, classified checks, and independent scoped P0 review pass. Follow-up for https://github.com/openclaw/openclaw/pull/137004.
* test(ui): scope reconnect headings to the page
Assert the selected agent heading inside the New Session surface, not the first heading anywhere in the document. The sidebar invitation is a separate valid heading. Preserve reconnect ordering, draft and request assertions, and all existing timeouts.
Both original assertions reproduce the CI mismatch locally; the complete 15-case file and classified checks pass with the scoped selectors. Independent P0 review is clean. Production code is unchanged.
* fix(test): keep source compiler cache in owned test namespaces
Preserve the tooling shared-cache opt-out while allowing source subprocesses to reuse transforms under the Vitest-owned temporary root. Keep worker IPC safeguards and Doctor deadlines unchanged. Real cache regression fails before the fix; Doctor and tooling boundary suites pass.
* fix(plugin-sdk): keep cold facade loading on canonical boundaries
Load Slack QA operations asynchronously without changing their Promise contracts. Restore prepared workspace aliases for cold activation and resolve bundled tracking metadata without eagerly loading activation policy. Preserve actual activation checks and registry fallback. Use the canonical record guard and shrink the old assertion baseline. Cold-source regression fails with the old alias override; unchanged Slack QA and sibling suites pass.
* test(gateway): keep cancellation fixtures live through cold setup
Give intended running descendants real run-context ownership before awaited setup. The unchanged real sweeper must not classify the fixture as an orphan. The deterministic pre-fix sweep reproduces the missed drain; the corrected fixture passes the same probe, all six cases and 33 admission siblings. No production or deadline changes.
* fix(plugin-sdk): activate browser cleanup asynchronously
Use the existing async activated-facade loader in already-async browser cleanup and remove the duplicate synchronous activation check. This avoids blocking cold source-hosted session resets while preserving activation rechecks, optional cleanup warnings and the public Promise contract. Both unchanged Gateway regressions pass; production shrinks by ten lines. Browser bridge throwing-loader migration is a separate follow-up.
* fix(update): preserve configuration and verify upgrade recovery
Prefer npm before ClawHub only among declared plugin identities, preserving explicit source/version intent, artifact integrity and capability consent. Keep the exact installed beta cohort and require typed target absence before fallback.
Preserve authored environment references through both Doctor writers, resolve snapshot destinations at operation time, and keep migration-only metadata out of redacted snapshots. Avoid loading channel runtimes for unused pairing account facts while retaining captured migration-owner attribution.
Record activation safety at package/Git mutation boundaries. Keep installed-CLI recovery, verify runtime/native-service identity, fence Windows autostart, preserve child status, and avoid duplicating consumed notifications or rejecting completed install switches. Surface update-specific disconnect diagnostics without changing explicit-restart guidance in Model Setup.
Retain the upgrade-survivor first-hop, approval and installed-version oracles. Repair CI's type-only Doctor cycle and stale source-policy, final-Doctor and Teams whitespace expectations without weakening timeouts, gates or the main-owned Markdown fix.
PR: https://github.com/openclaw/openclaw/pull/134490
* test(msteams): align the corrected main whitespace fixture
* perf(ui): remove unreachable update translations
Remove superseded version-only verification copy and the unused idle label from the eager catalog. Keep identity-aware verification and all recovery guidance unchanged, align translation fixtures, and restore the existing merged startup budget without increasing its baseline or limits.
* fix(update): retain consent failures and isolate validation homes
Carry unresolved non-retained plugin capability refusals from missing-install
repair through post-core convergence as typed outcomes, preserving the existing
update failure and restart boundary. Keep usable retained artifacts and
transient fetch failures on their existing notice/warning paths.
Give test invocations a native process HOME before config imports and worker
creation. Preserve bounded live/profile context, report selection, installed
tool caches, and process-group/pipe-owned namespace cleanup or truthful
retention. Keep unknown or mixed explicit real-home selections closed.
Resolve the repo-owned staging helper from its owning cwd and await complete
PID readiness before cancelling native report fixtures.
Align the survivor recovery oracle with typed consent errors that intentionally
have no Doctor reason. Preserve strict plugin/code/version/core-step checks and
historical warning-only reports; successful-update admission still rejects
refusals. Keep the local TestHomeMode alias private and satisfy helper lint.
PR: https://github.com/openclaw/openclaw/pull/134490
* fix(plugins): preserve declared catalog identity during upgrade integration
Carry the prepared, provenance-validated ClawHub package instead of discarding
it into a boolean. Suppress the declared installed counterpart without deriving
an npm identity from overlaid display metadata or hiding an npm namesake.
Keep lazy prepared catalog facts and first-normalized-record icon behavior.
Retain explicit ClawHub-only actions and npm-first dual-source actions, and
cover the selected source's pinned inspection metadata with existing tables.
The incoming duplicate-row cases fail before the provenance fact is retained.
PR: https://github.com/openclaw/openclaw/pull/134490
* fix(ci): include home isolation in PR anchor closure
Register the three runtime dependencies in the canonical extraction and trust inventory. Extracted planners and publishers now load the real home policy, context, and selection modules without stubs or weaker assertions. The existing extracted-anchor regression fails before this change and the full wrapper suite passes afterward.
* fix(update): hand failed upgrades to local coding agents
Route interactive update failures through triage after updater ownership is
released. Preserve the captured installation, invocation directory, bounded
diagnostics and original update result while the installed coding agent
repairs and verifies the machine using its existing permissions.
Keep background and JSON guidance consistent, preserve config references,
and fix resolved consent failures and selected catalog source provenance.
Validation: complete combined P2 review, 639 focused tests, 71 UI unit
tests, and four Chromium scenarios passed. Full changed-code checks passed
all typegraphs but stopped on one no-map-spread lint error in a test fixture.
Local integration checkpoint: fix that fixture and combine the current main
triage owner before final review, package proof, publication, or landing.
* fix(update): preserve configuration and verify upgrade recovery
Prefer npm before ClawHub only among declared plugin identities, preserving explicit source/version intent, artifact integrity and capability consent. Keep the exact installed beta cohort and require typed target absence before fallback.
Preserve authored environment references through both Doctor writers, resolve snapshot destinations at operation time, and keep migration-only metadata out of redacted snapshots. Avoid loading channel runtimes for unused pairing account facts while retaining captured migration-owner attribution.
Record activation safety at package/Git mutation boundaries. Keep installed-CLI recovery, verify runtime/native-service identity, fence Windows autostart, preserve child status, and avoid duplicating consumed notifications or rejecting completed install switches. Surface update-specific disconnect diagnostics without changing explicit-restart guidance in Model Setup.
Retain the upgrade-survivor first-hop, approval and installed-version oracles. Repair CI's type-only Doctor cycle and stale source-policy, final-Doctor and Teams whitespace expectations without weakening timeouts, gates or the main-owned Markdown fix.
PR: https://github.com/openclaw/openclaw/pull/134490
* test(msteams): align the corrected main whitespace fixture
* perf(ui): remove unreachable update translations
Remove superseded version-only verification copy and the unused idle label from the eager catalog. Keep identity-aware verification and all recovery guidance unchanged, align translation fixtures, and restore the existing merged startup budget without increasing its baseline or limits.
* fix(update): retain consent failures and isolate validation homes
Carry unresolved non-retained plugin capability refusals from missing-install
repair through post-core convergence as typed outcomes, preserving the existing
update failure and restart boundary. Keep usable retained artifacts and
transient fetch failures on their existing notice/warning paths.
Give test invocations a native process HOME before config imports and worker
creation. Preserve bounded live/profile context, report selection, installed
tool caches, and process-group/pipe-owned namespace cleanup or truthful
retention. Keep unknown or mixed explicit real-home selections closed.
Resolve the repo-owned staging helper from its owning cwd and await complete
PID readiness before cancelling native report fixtures.
Align the survivor recovery oracle with typed consent errors that intentionally
have no Doctor reason. Preserve strict plugin/code/version/core-step checks and
historical warning-only reports; successful-update admission still rejects
refusals. Keep the local TestHomeMode alias private and satisfy helper lint.
PR: https://github.com/openclaw/openclaw/pull/134490
* fix(plugins): preserve declared catalog identity during upgrade integration
Carry the prepared, provenance-validated ClawHub package instead of discarding
it into a boolean. Suppress the declared installed counterpart without deriving
an npm identity from overlaid display metadata or hiding an npm namesake.
Keep lazy prepared catalog facts and first-normalized-record icon behavior.
Retain explicit ClawHub-only actions and npm-first dual-source actions, and
cover the selected source's pinned inspection metadata with existing tables.
The incoming duplicate-row cases fail before the provenance fact is retained.
PR: https://github.com/openclaw/openclaw/pull/134490
* fix(ci): include home isolation in PR anchor closure
Register the three runtime dependencies in the canonical extraction and trust inventory. Extracted planners and publishers now load the real home policy, context, and selection modules without stubs or weaker assertions. The existing extracted-anchor regression fails before this change and the full wrapper suite passes afterward.
* fix(test): preserve source home when loading profiles
Read the explicitly selected profile with a non-login Bash command so
system and user login startup cannot replace the source HOME first.
Keep positional profile quoting, child-only HOME/USERPROFILE, existing
profile opt-in and test/native-home isolation unchanged.
The existing six profile-home matrix cases failed on Linux CI run
33536959196, job 99953769387. New exact-head Linux CI remains required;
this local repair does not refresh or admit the prior native proof.
PR: https://github.com/openclaw/openclaw/pull/134490
* fix(update): complete failure triage integration
Keep landed failure diagnosis after recovery and cleanup decisions without
letting diagnostic exports authorize activation or overwrite updater exits.
Preserve exact unsafe handoff and nested foreground results, consumed
notifications, successful install-root switches, typed consent failures and
update-specific disconnected guidance alongside main's triage takeover.
Contain diagnostic read failures inside the diagnostic owner so a completed
recovery still releases its lease and sensitive files. Retain phase-labelled
updater, recovery and diagnostic exits plus helper terminal completion.
Remove the trivial aggregate-error wrapper while preserving both failures,
and consolidate launchd/notification coverage into canonical test support.
Focused CLI, Doctor, handoff, UI and profile-home proof passed under external
synthetic homes. Complete integrated P0 review is scoped-clean; exact-head
Linux CI and native/package qualification remain with the parent workflow.
The unchanged main models-cli auth-login test-type error remains a follow-up.
PR: https://github.com/openclaw/openclaw/pull/134490
* test(update): split Doctor and service recovery fixtures
Move the existing Windows Doctor recovery matrix and shared fixtures into
focused files, and keep managed terminal-outcome tests in their existing
result helper. Preserve all case bodies, assertions, and hook cleanup.
Keep Windows restore failure in a local variable and narrow the triage
prompt-write fixture path before string matching. Scoped type-aware lint,
all affected existing suites, and independent follow-up review pass.
The full repository gate and final packaged Crabbox recovery and upgrade
proof remain required before landing.
* fix(update): retain plugin attempt spec on consent failure
* test(update): preserve runtime exports in option mocks
---------
Co-authored-by: Jason (Json) <263060202+fuller-stack-dev@users.noreply.github.com>
* fix(computer-use): unblock the macOS live-rig proof flow
The rig ran its operator CLI and its proof runner from one state dir, so both
shared one device identity. A paired operator device is pinned to the scopes of
its first connect, and `nodes list` connects first for `node.pair.list`
(operator.pairing); the proof runner then needs operator.write, which is a scope
upgrade the gateway never approves silently and which no rig client can approve
for itself. The proof runner is a GATEWAY_CLIENT/BACKEND client, so on a
loopback auth-none gateway it is admitted unpaired with the scopes it asks for:
giving the CLI its own `cli-state` identity is enough, and `agent-state` now
never accumulates a pairing row.
`nodes list` also read `node.list` through the plain CLI client while
`nodes status`/`describe` used the diagnostics ladder. On any gateway where the
CLI must pair, the unfiltered list silently dropped connected/commands/
computerUse and `--connected` failed outright, so the documented rig gate could
not confirm the node. Both call sites now use `callNodeDiagnosticsGatewayCli`.
Docs drop the `devices approve <requestId>` instruction, which was circular:
that invocation is its own new device identity.
* test(cli): share the runtime-log formatter across nodes CLI e2e files
The extracted diagnostics-auth file stringified captured log arguments directly, which the type-aware core lint stripe rejects (no-base-to-string). Move the existing formatter into the shared node test helpers instead of duplicating it.
* fix(cua-computer): prove Linux X11 live vertical
* test(computer-use): authenticate isolated Linux rig
* fix(gateway): refresh computer use after node approval
* refactor(cua-computer): resolve the plugin manifest by static import
* fix(gateway): break plugin runtime import cycle
* fix(computer-use): bind live rig to committed helpers
Stream bounded browser camera frames directly to Gemini Live and keep camera media off the Gateway. Add lifecycle, function-calling, fake-camera E2E, and live-smoke coverage.
Co-authored-by: shushushu <1064076525@qq.com>
