* refactor: consolidate secret and meeting configuration
Complete the retained configuration family from #173394. Preserve main's cron and restart fixture fixes, and exclude the four UI-reachable changes plus their dependent omission migration. Keep provider precedence, account ownership, meeting defaults, TTS layering, and duration policies.
* refactor(config): keep independent meeting configuration consolidation
Restore the nine changed core files reachable from failed runtime tests and
their dependent provider migrations. Keep the shared meeting configuration
owner, typed Fish/MiniMax reads, Slack record predicate, and existing-behavior
Google Chat regression coverage.
Preserve public configuration, credential policy, provider defaults, and
shipped SDK contracts. The excluded family remains on the preservation branch.
Shared transcript byte accounting was imported through the runtime session
SDK barrel, so constructing OpenAI and Mistral catalog descriptors also
loaded the websocket transport. Keep the shared helper and move both
catalog factories to a small private provider SDK leaf with type-only
contracts. Preserve the existing session helper export for other callers.
Register the leaf through the canonical SDK export generator and document
its descriptor-only purpose. No provider algorithm, transport behavior,
configuration, permission, dependency or test assertion changes.
The unchanged cold-catalog contract reproduces both failures before the
fix and passes all 18 provider cases after. OpenAI/Mistral runtime tests
pass all 44 cases, including split-surrogate accounting and transcript
limits. SDK export/declaration tooling passes 14 cases with one existing
skip. Independent P2 review of the final patch is scoped-clean.
Share database-engine contracts, physical-store admission and bootstrap, transaction capabilities, and observation. Workboard consumes the shared adapters while SQLite remains the default and PostgreSQL remains experimental.
Includes one bounded CI-contract repair. Remaining wrapper-inventory and unmatched test failures are recorded in the PR; no passing CI result is claimed. Landed under the maintainer-authorized campaign exception with the reviewed head pinned.
Prefer a validated newer stable same-major Codex CLI on PATH for managed turns, and carry the selected client version into ChatGPT model discovery. Return to the bundled runtime when it catches up or the installed candidate fails qualification/startup.
Bound cold selection, retain shared fallback ownership and explicit/desktop precedence, isolate probe storage, and skip selection for unrelated catalog and auth-only requests.
Production-authenticated ChatGPT discovery and turns remain unproven; same-major post-initialize protocol compatibility is an accepted residual risk.
Co-authored-by: obviyus <22031114+obviyus@users.noreply.github.com>
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
* feat(plugin-sdk): expose local state owner routing for CLI commands
* fix(workboard): route CLI mutations through the active Gateway
* fix(workboard): preserve dispatch without explicit parameters
* fix(plugin-sdk): type and account for the CLI ownership surface
* test(workboard): preserve state owner module exports
* test(workboard): prune the retired config mock allowance
* test(workboard): load plugin owners through public test surfaces
* test(workboard): type owner routing fixtures precisely
* test(workboard): type the facade export as a standalone function
* fix(workboard): report empty worker results for offline dispatch
* test(workboard): exercise Gateway lifecycle through RPC
Retire the public plugin-sdk/command-auth, plugin-sdk/discord, and plugin-sdk/telegram-account subpaths early, with the Plugin SDK owner's approval (2026-10-02). No bundled runtime imports them. No official external plugin at latest or extended-stable imports them either, and the only older @openclaw/discord releases that did (2026.3.7-3.13, 2026.5.2) already import subpaths main removed earlier.
Remove the modules, package exports, entrypoint inventory, compat registrations, and obsolete tests. Move the three surviving contract tests to their focused SDK subpaths. Drop 15 internal exports orphaned by the retirement and the dead isCommandMessage and resolveDualTextControlCommandGate wrappers. Shrink the SDK surface budgets by exactly 3 entrypoints, 128 exports, 79 callable exports, and 128 deprecated exports.
Breaking change for third-party plugins that import these paths: use channel-ingress-runtime, command-auth-native, command-status, or models-provider-runtime, as described in docs/plugins/sdk-migration/import-paths.md and the removal timeline.
Landed over inherited main reds only (Codex model/list sequence tests from #163320, the memory-host-sdk boundary test fixed by 2516be90f1).
* test(core): split oversized subprocess consumer suites
Separate CLI lifecycle, Gateway startup, command dispatch, and bare-root
flows; media reads and storage; catalog metadata and hosted persistence.
Prepare workers during collection only for the six observed consumers.
Keep all 221 cases, assertions, and fixture initialization order; the
exit-only and catalog metadata files remain declaration-free.
Prune the two split baselines and one already-stale baseline entry.
Validation: 221 passing cases; six collection loads and two none results.
Changed-file formatting/lint, affected tsgo graphs, both line-cap ratchets,
and diff checks pass. The global changed-path typecheck remains blocked
by the inherited agents-other root budget (724/720); affected graphs pass.
The review's baseline concern was rejected against the native stale-entry
check and direct lint of the unchanged target file.
* fix(test): collect extension subprocess dependencies
Move Anthropic's real process helper acquisition to collection while
retaining vi.importActual and its mock reset behavior. Move DeepInfra
and xAI's one-time subject imports and mock setup to collection, keeping
their real HTTP transport and negative SSRF assertions intact.
Validation: all 20 cases pass and first declaration loads are collection;
all case names/counts are unchanged. Formatting and extension test types
pass. The normal extension lint lane was blocked while preparing Plugin
SDK declarations by its existing 300000 ms timeout; no timeout or guard
was changed. The final candidate received the scoped P2 review recorded
with the preceding core split commit.
* test(plugin-sdk): preload compiled subprocesses for extension tests
Move worker preparation into collection through a repo-local, non-production
SDK subpath. Let Codex app-server setup preload declarations while keeping
worker-cpu imports after file mocks; preserve per-test imports and assertions.
Register private source and declaration aliases without adding package exports
or production artifacts. Remove unused CLI fixture exports and reuse the alias
normalization owner so the existing dead-export and line-cap gates pass.
* fix(test): preload compiled subprocesses for newly screened suites
* fix(test): preload remaining screened subprocess declarations
Move compiled subprocess preparation out of test and hook deadlines in six confirmed declaration consumers. Preserve lazy imports, mock ordering, and assertions; keep the shared meeting plugin helper unchanged so platform-scoped loading retains its existing order.
* style(test): keep Parallel suite separator
* fix(ci): keep protected selection for split CLI and catalog suites
The owner splits moved protected run-main and official-catalog cases into
four new suites. Add them to PR_PROTECTED_RUNTIME_TEST_FILES so global inputs
such as pnpm-lock.yaml still select them, and assert that in the existing
global-input planner test.
Retire the five SDK compatibility facades under the approved September 30 owner decision, and migrate in-repository callers onto their focused contracts. Keep implementations with their canonical owners and remove forwarding exports that become unused after the cutover.
BREAKING CHANGE: remove openclaw/plugin-sdk/channel-lifecycle, channel-message, channel-reply-pipeline, config-runtime, and infra-runtime. Use channel-outbound/channel-inbound, config-contracts and focused configuration/infra entrypoints. The new system-event-runtime entrypoint supplies public snapshot inspection and consumption. Update affected external plugins before upgrading the host; this retirement does not certify universal external migration.
Package exports, SDK entry inventories, compatibility tombstones, migration docs, and surface budgets move together. Canonical API comparison confirms exactly five removed entrypoints, 869 removed export paths, 35 focused additions, and no retained-export signature changes. Net production reduction: 1,320 lines.
Remove Tasks and TaskFlow runtime, APIs, CLI, SDK surfaces and panels after the Cron, session, native execution and media completion ownership cutovers. Preserve stored rows and import provable legacy native assignments through Doctor; ambiguous ownership stays untouched with a warning.
Follows #158221, #158217, #158225, #158222, #158702 and #158776. Related: #156532. Task-specific public APIs retire immediately; retained responsibilities use their existing owners.
Maintainer-authorized administrative landing after full CI run 36312986498 attempt 2 passed on 274595e2, with subsequent actual conflicts reviewed and focused checks passing. Current PR CI preflight hits the 64 KiB changed-path metadata limit before tests (run 36335042695); its duplicate security-review status mirrors that planning failure. Review and scoped proof are recorded in the PR. Published 9.4 native import is proven; remaining native completion and 9.4 rollback witnesses are explicitly unproven.
* feat: add selectable Code Mode executors
Default enabled Code Mode to trusted Node execution and move QuickJS into a bundled executor plugin. Preserve typed discovery, JavaScript-only execution, tool authorization, continuation ownership, and explicit legacy QuickJS selections. Add a web settings selector and document both security boundaries.
* refactor: finish Code Mode executor source cutover
Remove the retired core worker copies and regenerate config documentation for the requested QuickJS plugin. The 21 added plugin paths are standard plugin management fields; core and channel counts stay unchanged.
* refactor: narrow the Code Mode plugin contract
Keep only the executor and guest protocol exports consumed by the QuickJS plugin, budget that generic contract, and load the public plugin artifact through the existing runtime test boundary.
* refactor: align Code Mode workers with current runtime boundaries
Use the worker-side task server, keep asynchronous cleanup ownership explicit, and model the real Promise contracts in lifecycle fixtures. Regenerate the requested plugin config surface and budget the exact 35 public executor exports.
* refactor: keep executor implementation types private
* chore: regenerate code mode config baseline
* fix: satisfy Code Mode executor integration contracts
* test: cover QuickJS plugin metadata and exact settings titles
* test: retain QuickJS integration in the agent runtime suite
* test: keep Code Mode validation within lint and type-shard contracts
* fix(plugins): preserve authored config through runtime load plans
* feat(judgments): add typed provider runtime and plugin SDK
* feat(plugins): add per-agent decision models
Add an opt-in decisionModel role for typed choices, scores, and boolean
probabilities, with global defaults and per-agent inheritance or disablement.
Keep provider lifecycle and prepared credentials host-owned, and expose
manifest-only decision choices separately from conversational model catalogs.
Adapt the provider foundation from #152237 to the decisions contract. Existing
configurations keep decision calls disabled until a model is selected.
Co-authored-by: Josh Lehman <550978+jalehman@users.noreply.github.com>
* fix(plugins): complete decision inspection and preserve authored config
Expose optional decision-provider health through the Gateway wire schema
and generated native DTOs. Preserve the landed SecretRef prerequisite’s
identity behavior for unchanged activation plans. Move model mocks into
one private sibling factory without expanding the public helper surface.
Validation: 51 handler/protocol tests, 18 post-extraction tests, 52 runtime
and integration tests, generated protocol checks, and clean P0-P2 review.
The SDK surface-budget increase remains pending maintainer approval.
Co-authored-by: Josh Lehman <550978+jalehman@users.noreply.github.com>
* perf(plugins): reduce decision overhead and unnecessary reloads
Keep one full provider input snapshot and an independent question rubric. Recognize decision-only catalog providers with the existing normalization policy, and reload plugins only for decision-model changes while preserving roster actions. Apply the approved SDK surface increment and behavior-neutral cleanup.
Validation: 58 runtime/config/loader tests, 610 Gateway regression/sibling tests plus 15 final catalog cases, full core typechecks, scoped lint and clean managed review. A 143155-attempt synthetic stress run settles all 18104 provider calls at max concurrency four.
* fix(plugins): preserve reload boundaries and decision test contracts
Materialize only present decision-selector leaves so Telegram account creation/removal retains its parent lifecycle action. Select UI controls by model role, preserve independent chat and decision catalogs in tests, remove an unused probe, and rebalance existing typecheck shards without raising their limits.
Validation: 588 reload tests, 58 shard/loader tests, 38 UI catalog tests, 9 browser tests, affected typechecks, unused-file scans, and clean managed review.
* test(ui): address model pickers by role in gateway flows
Disambiguate Primary from the new Decision picker in the real-Gateway catalog test, alias browser test, and Agents view assertions. Preserve draft and publication checks. Unit/browser/typecheck proof and managed review pass; real-Gateway execution follows on the integrated build.
* test(plugins): isolate runtime metadata and preserve shard headroom
Move the existing lazy-runtime metadata contract intact into its own focused module. Group CLI program tests with commands so newer main tests keep every typecheck shard within existing limits. No production changes or limit increases.
Validation: 57 tests, four typecheck graphs, canonical line guards against the CI main snapshot, targeted lint and clean managed review.
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Co-authored-by: Josh Lehman <550978+jalehman@users.noreply.github.com>
Keep public GitHub issues, pull requests, commits, comments, images, and diffs readable beside chat in a resizable, tabbed reader. Preserve external navigation for modified clicks and explicit links.
Move GitHub transport and document mapping into the bundled plugin, and expose the passive reader through the shared plugin contract. Preserve operator plugin controls, managed-preview credential authority, anonymous detail reads, and existing host read-library behavior.
Bind responses to their requested resource, retain rapid reader opens in FIFO order, and cancel stale batches on close or session replacement. Add regression coverage and synchronize heartbeat and attachment tests with their actual completion boundaries.
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
Route isolated vector-search children through one private host entrypoint for the existing SQLite, sqlite-vec and text helpers.
Preserve the contributor repair, query results, cancellation, admission and index-publication behavior. Matched native-child measurements improve by 86.3%; real Gateway calls and independent behavior validation confirm the improvement with unchanged results.
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
Five copies of the same in-memory one-shot ticket (48-hex token, 60 s TTL,
unref'd expiry timer, single-use consume) and seven copies of "write a raw
HTTP status and destroy the socket" had accumulated across the desktop
observer bridge, the node desktop/portal stream broker, sandbox noVNC auth,
the browser extension relay, the browser screencast, voice-call realtime
upgrades, and core upgrade routing. The browser screencast also hand-rolled
the ping/pong keepalive that core already owned.
One shared store now owns ticket generation, shape checks, timers, and
expiry callbacks; one helper writes upgrade rejections (flushing before
destroy) for every status the callers use; the keepalive helper takes a
structural socket so plugins need no `ws` types. Bundled plugins reach all
three through the private-local `openclaw/plugin-sdk/websocket-runtime`
subpath, which keeps the public SDK surface budget unchanged.
Migrated sites: src/gateway/desktop/observe-bridge.ts,
src/gateway/desktop/node-stream-broker.ts, src/agents/sandbox/novnc-auth.ts,
src/gateway/server/plugins-http.ts, src/gateway/server-http-upgrades.ts,
src/gateway/server/http-work-admission.ts,
extensions/browser/src/browser/screencast/{tokens,upgrade}.ts,
extensions/browser/src/browser/extension-relay/{relay-server,gateway-relay-route}.ts,
extensions/voice-call/src/webhook/realtime-handler.ts.
Deliberately unchanged: the artifact-transfer capability tokens (revocable
serving authority, 43-char base64url contract), the Mattermost client
keepalive (own ping/pong deadlines and reconnect coupling), and the diffs
plugin's persistent hashed artifact tokens. The voice-call 401 rejection now
also sends `Connection: close`; relay upgrade sockets gain an error guard so
a client reset during rejection cannot surface as an unhandled error.
Preserve requester revocation with shared-store revokeSignal and listener cleanup.
* fix(gateway): reduce cold model-runtime request stalls
Bind provider/auth/config operations at the native plugin loader boundary
instead of importing broad host execution graphs during registration.
Keep descriptor construction light and defer execution-only Codex/OpenAI
work to its canonical owners without changing synchronous auth, process,
logging, or lifecycle semantics.
Preserve full runtime readiness, authored cache/override identity, mutable
runtime method views, and invocation-bound latest session lineage. Remove
obsolete wrappers and the unused eager conversation startup path.
The isolated source reproduction reduced prepared refresh from roughly
291 seconds to 17 seconds on the same historical Linux proof setup. The
latest integrated ARM64 profile still measures 19 seconds; this does not
claim that all cold source-registration blocking is eliminated. Compiled
Gateway/browser catalog proof returned in 568 ms.
Protected Gateway/browser tests use fresh secretless VM/containers only.
No timeout/assertion, configuration, schema, dependency, or SDK budget
expansion. New private host seams require coordinated host/plugin release,
not independent publication with an older compatibility floor.
Refs #139867
* fix(plugins): finish native runtime import boundaries
Keep unused native policy facets lazy, use canonical type and profile-ID leaves, and reuse SDK lazy-method forwarding. Remove obsolete provider wrappers and repair lifecycle/catalog fixtures without weakening assertions or deadlines.
Validated with the original 273-file CLI selection (6841 passed, 85 skipped), the complete changed gate in a fresh secretless container, the final build, and isolated review. Context: #139911 and #139867.
* test(doctor): supply native auth in memory startup fixture
Register the real OpenAI plugin with the host model-auth contract while preserving all semantic-data, migration, SecretRef, and degraded-owner assertions. Both cases and the original 259-case CI shard pass in a fresh secretless container; typed lint and isolated review pass. No production changes.
* refactor: simplify command rendering and diagnostic plumbing
* refactor(providers): share exact effort profile parsing
Keep model overrides and API fallbacks in their provider owners. The shared helper has no runtime imports so eager policy loading retains its narrow dependency graph.
Official plugin packages gain a host runtime dependency. Publish this with the next synchronized core and plugin release, whose canonical release sync advances pluginApi floors; do not publish these plugins alone with the existing older API floor.
* chore: prune removed provider assertion allowances
* fix(talk): avoid full plugin imports during cold catalog discovery
Use optional capability catalog entries backed by the same provider factories and native host operations as full registration. Preserve prepared generations, active descriptors, installed-plugin registration, and explicit empty-family semantics. Account for exactly three approved public catalog type exports.
* fix(plugins): complete cold catalog boundary integration
Keep catalog descriptors separate from native host-operation types, and
move DeepInfra shared model types and constants to their leaf owner.
Recognize manifest-loaded catalog entrypoints and remove the unused xAI
transcription wrapper while retaining the production factory tests.
Preserve real module exports under existing test overrides. Keep all
assertions, deadlines, public SDK exports, and approved budgets unchanged.
* feat: let plugins customize the Control UI
* fix: harden feature plugin lifecycle and artifact activation
* fix(plugins): complete native UI integration
* fix(plugins): preserve hook ownership and composer styling
* chore(workboard): refresh generated browser assets
* test(android): hold reconciliation replies until delivery checks
* refactor(plugins): simplify feature UI ownership
Share bundle validation and scoped host-handle cleanup. Consolidate
Workboard component and draft-save lifecycles, and remove unreachable
loading/enablement paths and retired select styles.
Keep both compiler regression matrices through shared fixtures, remove
duplicate tests, and regenerate the reduced locale catalog and browser
asset references.
* test(ui): return session snapshots from worker stop fixtures
* fix(ui): hydrate session rosters from selected agents
Use the application selection owner for bootstrap and reconnect, retain its filtered query for later refreshes, and remove duplicate sidebar refreshes. Cover delayed bootstrap, saved selection, and offline selection changes.
Refresh generated protocol and browser assets after the rebase, and share hydration fixtures and roster reconciliation helpers.
* perf(ui): defer plugin initialization and customization
Load plugin assets with the existing lazy SDK host and load customization controls on demand. Keep activation cleanup with the runtime and preserve dialog reload state across close and reopen.
Remove retired Workboard selectors, move glyph styling into the plugin, and regenerate its browser revision. Preserve the existing startup payload limits.
* refactor(ui): separate native asset loading from host services
* test(plugins): align UI integration with current main
Refresh canonical Workboard assets and the Control UI boot inventory after rebasing. Match the current bootstrap signature, delegated permission policy, and widget Delete label in existing regressions.
* chore(workboard): refresh browser revision after rebase
* chore(ui): refresh generated assets after main sync
* fix(plugins): preserve native UI lifetimes after main sync
Keep saved plugin panels closable while their registration is unavailable and prevent actions withdrawn during resolution from starting. Defer native view mounting code through plugin activation while preserving synchronous built-in rendering.
Integrate the shared Dashboard side-panel lifecycle, remove the session helper type cycle, reuse core Gateway classification, and consolidate menu coverage. Refresh generated assets after the main rebase.
Validated with focused Gateway/UI tests, failing/passing lifetime regressions, 14 browser scenarios, typechecks, lint, cycle and assertion guards, and the enforced Control UI performance check.
* chore(ui): refresh boot manifest after main rebase
* chore(ui): refresh feature integration after main update
Preserve current composer admission and sidebar ownership while adopting the canonical formatter output and browser assets. Complete the existing panel fixture with the new desktop-focus contract.
* test(ui): verify native plugin asset admission
* test(ui): await service worker activation in phone proof
* refactor(plugins): remove redundant UI plumbing
* feat(plugins): gate custom UI behind an experimental lab
* fix(plugins): align Labs helper types with callers
* style(ui): format retained plugin panel definitions
* test(ui): preserve minimized dashboard in native plugin flow
* fix: preserve plugin UI edits and refresh ordering
Synchronize reapplied template fields, fence shared widget reads across moves, and retain newer mutation errors through queued refreshes. Verify immutable browser assets when Windows reports a directory collision. Keep the checkout helper terminal exit outside exception handlers to avoid Python 3.9 context-cycle hangs.
* test: align plugin UI proof with current panel layout
* test: repair plugin UI validation and generated checkout helper
* test: bind session search fixtures to their selection owner
* fix: preserve session search ownership and execution denial proof
* test: use a real page element for plugin sidebar fixtures
* fix: respect native plugin UI deployment boundaries
* test: share UI fixture isolation across runners
* refactor: share the native plugin asset root
* test: check failure trailers on their owning stream
* fix(models): refresh Chutes and Cerebras native pricing
Use owner-native advertised rates without pinning generated model costs during merge-mode setup. Preserve metadata when native prices disappear, reject malformed feeds, and keep explicit user rates intact. Fixes#134248.
* chore: clean up pricing tests and isolated landing workflow
Remove unused Chutes fake-timer plumbing. Select a complete, writable landing checkout before native review and preserve generated review identity stamps without weakening isolation or merge guards.
This reverts commit 5d7bd83a4a.
Roll back PR #113115 at maintainer request, restoring the previous Matrix and runtime behavior while preserving subsequent main changes. Retain only the publication-safe synthetic model name in an existing test fixture.
* feat(matrix): add intelligent multi-agent turn-taking
* fix(matrix): enforce receiver context and finalization ownership
Resolve Matrix context visibility through each live receiver and intersect classifier context without duplicating the transport journal. Invalidate monitor-bound decisions, preserve native thread correlation, and bound the complete classifier request.
Keep CLI runtime-binding failures terminal, publish validated replacements atomically, clean failed preparations, and preserve intentional discard semantics. Add regressions for policy isolation, lifecycle changes, input bounds, and runtime drift.
Co-authored-by: Benjamin Badejo <ben@benbadejo.com>
* test(matrix): align finalization coverage with main
Extract receiver access preparation into its existing owner and preserve source-finalization assertions in a focused suite. Update stale nested activity fixtures and normalize concurrent gate results.
Co-authored-by: Benjamin Badejo <ben@benbadejo.com>
* fix(matrix): stream provisional previews before freshness review
Keep source-owned preview callbacks live during generation while committed
assistant events and block replies remain behind terminal acceptance.
Preserve global finalization hook buffering and avoid replaying previews
when deferred events drain.
Cover the real preparation/subscription boundary for local continue,
redraft and discard plus global-hook quarantine. Repair the Matrix access
type declaration and rebalance complete CLI test families under the
existing type-shard limit.
Co-authored-by: Benjamin Badejo <ben@benbadejo.com>
* fix(agents): settle transcript projection before finalization retries
Reuse the existing owned-retry projection barrier after rejecting a final candidate. Cover both global and source-local finalization alongside compaction, and clarify Matrix preview behavior with global finalization hooks.
Co-authored-by: Benjamin Badejo <ben@benbadejo.com>
* fix(codex): restrict native tools during finalization retries
Apply the existing native tool policy and MCP attestation to ordinary
tools-disabled retries while preserving their lifecycle and Stop hooks.
Keep strong policy modes isolated and reuse the prepared restriction in
start/resume verification. Cover inherited MCP, managed requirements,
transient bindings, restored tools, and authoritative finalization.
Clarify external-tool isolation versus native compute in Matrix docs and
keep the projection retry fixture aligned with the literal revision type.
Co-authored-by: Benjamin Badejo <ben@benbadejo.com>
* test(codex): align native lifecycle fixtures with tool policy
Use ordinary tool-enabled startup, schema and cleanup fixtures. Preserve
the shared web-disabled cleanup configuration and expect no app-policy
fingerprint when no plugin policy is configured. Keep restriction,
cleanup, cancellation and retry assertions intact without larger timeouts.
Consolidate adjacent native planning defaults without changing their
values, property order or precedence, and remove a shadowed test binding.
Co-authored-by: Benjamin Badejo <ben@benbadejo.com>
---------
Co-authored-by: Benjamin Badejo <ben@benbadejo.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(browser): preserve controlled document navigation authority
* fix(browser): checkpoint relay lifecycle and cold-start repair
Preserve the reviewed browser repair candidate before refreshing main and finalizing the private Gateway configuration SDK boundary. Validation and real browser proof remain pending; this checkpoint is not a land-ready claim.
* fix(browser): isolate native bootstrap configuration imports
Use a private Gateway config runtime facade for bundled port lookups while preserving the shipped public core export. Keep private declarations out of the package and finish the relay auth-test cleanup check.
* test(browser): align bootstrap script contract with native build
* test(voice-call): await notification hangups before teardown
* fix(browser): unblock compiled native-host bootstrap
Load canonical config and pairing only after native-host validation. Keep
pure Browser URL and port helpers out of transport and mixed runtime
barrels, register the existing private CDP SDK export, and remove obsolete
bridge exports.
Run the extracted compiled-host integration case in the existing artifact
CI job with exact report validation. Preserve the custom installation
context, native framing, private Node trampoline, and 10-second deadline.
* fix(build): map private Browser SDK declarations
Complete browser-cdp registration in the shared plugin package-boundary
paths and XAI's matching override. Keep the SDK JavaScript-only in the
published package while using package-built declarations inside the repo.
The unchanged package-boundary contract reproduced the missing mapping
before this fix. No native-host runtime, fixture, assertion, or deadline
changes are included.
* feat(channels): introduce bots when they join group rooms
* feat(channels): add Discord and Telegram join introductions
* fix(channels): isolate untrusted evidence and select allowed join targets
* refactor(channels): scope joinIntro to implementing channels
* fix(channels): keep a delivered join introduction settled when its durable commit fails
* feat(channels): read more room history and document join introductions in detail
* chore(config): regenerate bundled channel metadata after rebase
