* feat(dev): use pinned Bun for local formatting
* test(lint): include dev tool resolver in lifecycle fixture
* perf(format): allow native formatter parallelism
* perf(dev): retain faster formatter defaults and document fork
Related: #176053 (merged; it trims root `AGENTS.md` under the cap)
## What Problem This Solves
Fixes: PRs fail CI on their first push for generated files, docs lint and size caps that a seconds-fast local check would have caught, and root `AGENTS.md` regrows past the 20,000-character cap that OpenClaw loads whole.
## User Impact
No product change. Contributors and agents see these failures at commit time with the regen command, not after a CI round trip. A tracked `AGENTS.md` over the workspace bootstrap cap now fails CI.
## Why This Change Was Made
- **Pre-commit freshness checks.** `git-hooks/pre-commit` (installed by `pnpm install`) now runs existing `--check` scripts, chosen from staged paths and run in parallel: `lint:docs` on changed docs, `protocol:check`, `native:i18n:verify`, `config:docs:check`, the line-cap ratchet, and the new AGENTS.md size check. Each failure prints its fix command. Typecheck, lint and tests stay with hosted CI, and commits replayed by merge, rebase, cherry-pick or revert skip the checks. The content guard (`guard-staged-content.mjs`) runs the step and redacts its output with its existing redactor, so blocked private literals are never echoed. The hook judges only the bytes being committed: checks that import the working-tree code graph (protocol, native i18n, config docs, AGENTS.md size) are skipped with a one-line note when any tracked file has unstaged edits, `lint:docs` is skipped only when its own files or config are dirty, and the line-cap ratchet reads the index and always runs. Plain `node` package scripts start without pnpm. Path predicates live in their owners: `changed-lanes.mts` (also used by `check:changed` for the line-cap ratchet) and `hasProtocolGenerationInput` shared with CI's check family scope.
- **AGENTS.md size check.** `scripts/check-agents-md-size.mts` reads the cap from `resolveBootstrapMaxChars()` instead of copying the number. It runs in the hook, `pnpm check` and the CI check-docs job.
Left out on purpose, because each is too slow or already red on `main` for unrelated files: max-lines ratchet (~30 s), knip unused files (92 s), madge cycles (22 s), Control UI i18n (16 s), plugin SDK API diff (two full builds).
## Evidence
Back-test against first-push CI failures from a 90-day sample of merged PRs (26 rows; 2 retired checks; detached worktrees at each failing head):
| Row | CI failure | Hook before | Hook after |
|---|---|---|---|
| #122960 | docs MD051 link fragments | pass | **fail**, same 3 errors as CI |
| #112339 | Swift protocol models drift | pass | **fail**, same drift |
| #115577 | native i18n inventory drift | pass | **fail**, same message |
| #165543 | config baseline hash | pass | **fail**, same hash mismatch |
| #151896 | line-cap growth 3557 → 3676 | pass | **fail**, same counts |
The other 19 live rows need typecheck, tests, UI build or slow audits, which stay in hosted CI by design.
Size check back-test: it first fails at bb7d32e55d (#167739, 20,414 chars), and fails again at b19d5542f6 (#173903) after the earlier trim.
Freshness step wall time, median of 3 on a warm checkout (before = previous head 7aae97981b, after = this head):
| Staged change | Checks | Before | After |
|---|---|---|---|
| nothing | none | 0.17 s | 0.28 s |
| `CHANGELOG.md` | none | 0.20 s | 0.24 s |
| one docs page | lint:docs | 0.92 s | 1.13 s |
| one `src/**/*.ts` | line-cap | 1.29 s | 1.42 s |
| a scoped `AGENTS.md` | size check | 0.92 s | 1.07 s |
| protocol schema `.ts` | protocol, line-cap | 4.77 s | 4.39 s |
| Android Kotlin source | protocol, native i18n | 4.41 s | 4.48 s |
| plugin manifest | config docs | 8.19 s | 8.97 s |
Spawning `node` directly saves about 0.1–0.3 s per check against `pnpm -s`; the after column also pays one extra `git diff` for the unstaged-input rule. Most of the remaining time is in the checks themselves. `protocol:check` and `config:docs:check` are not cached: their inputs are transitive imports across `src/`, `packages/` and every plugin manifest, and no existing owner lists them reliably.
Checks run: new and existing hook tests, including `test/git-hooks-pre-commit-freshness.test.ts` (real guard, real freshness step and a real `node` runner: a partly staged docs page with a blocked literal in its unstaged edit is skipped; a staged protocol schema with an unstaged edit in an imported owner outside the trigger list skips `protocol:check` while the line-cap ratchet still runs; and a failing check that prints a private literal is redacted), `test/scripts/check-staged-freshness.test.ts`, `changed-lanes.test.ts`, `check.test.ts`, `tsgo:scripts`, `tsgo:test:root`, oxlint, oxfmt. All commits went through the new hook.
**Merge danger:** two-way door; a revert restores the previous hook and CI step. No state, config or published contract changes. Blast radius: every local commit in this repository (adds about 0.3 s to 9 s depending on staged paths) and the CI check-docs job. #176053 has landed, so the size check passes on `main`.
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
The npm12 installed tree exceeded the unchanged 47,500-entry package guard and approached the 50,000-entry cap in shipped updaters. Bundle the reachable pinned Mistral SDK into @openclaw/ai, preserving external dependencies, optional telemetry peers, its license, and production advisory coverage.
Linux npm12 entries fall from 47,898 to 41,793; independent macOS measurement confirms the same 6,105-entry reduction. Mistral itself accounts for 6,384 fewer entries, offset by unrelated integrated-main additions. Workers and updater bridges remain packaged.
Package Acceptance and the published-driver update cell pass. Actual built-runtime streaming, bootstrap tests, final static gates, and two Codex reviews completed. Known inherited/unresolved behavioral failures are recorded in the PR validation evidence. No schema, public API, guard, cap, or provider-version change.
Raise the staged-content guard's path-count batch limit from 64 to 256
while retaining the 16 KiB argument limit and both complete scans.
Extend the existing regression fixture beyond both batch limits.
* ci: narrow PR tests by import and dependency impact
Resolve affected tests through the existing runtime import graph, workspace
and SDK aliases, configured Vitest inputs, and explicit policy owners.
Compare exact-base dependency closures instead of treating every lockfile
or package metadata change as global. Keep documentation and localization
data out of PR Node test rows.
Preserve canonical execution metadata and complete automatic main coverage.
Retain diagnostic fallbacks for global inputs and unverifiable ownership.
The 40-run replay reduces explicit fallbacks from 30 to 6 and median selected
jobs from 132 to 122, with no unexplained historical failure omissions.
The remaining large import closures do not meet the requested cost target.
* fix(ci): run test selector parsing under Node
Bun workers cannot provide the Node TypeScript parser used by the selector. Resolve the existing Node executable at the scanner boundary and retain that built-in-only dependency in materialized wrappers and standalone fixtures. Preserve real shard inventory exports in the command planner fixture.
* test(ci): isolate changed-gate compiler fixtures
Source-aware selection reaches inline compiler checks that bypassed the fixtures’ subprocess stubs, repeatedly compiling the real repository during gate-order and root-lint tests. Bind that owner to the shared synthetic recorder while preserving the real CLI, lint execution, serial-order assertions, and failure sentinels.
* fix(ci): retain compiler gates for TypeScript catalogs
Catalog-only PRs suppress Node test rows, but their TypeScript modules still need compiler validation. Admit the existing check owner independently of Node tests while preserving documentation and JSON-only skips. The catalog fixtures retain main and manual coverage and distinguish compiler admission from test execution.
* fix(runtime): require Node builds with lossless SQLite reads
* fix(runtime): preserve upgrades and guard sealed workers
Validate downloaded Node before switching the active runtime alias, reject unsupported sealed-worker runtimes, and keep the Gateway error fixture on a supported Node release. Document the approved ARMv7 and older macOS compatibility losses and decoder fix boundaries.
* test(runtime): use typed process exports in worker fixture
* test(runtime): align installer fixtures without growing test shards
* test(runtime): align release and guest runtime fixtures
* fix(test): canonicalize Windows temp roots for Node 24
Expand Windows short paths before creating test directories and owned child environments. Node 24 filesystem watchers otherwise abort when native long event paths differ from inherited short temporary paths. Preserve explicit custom-root spelling and existing cleanup ownership.
* test(ci): run Windows temp-root regressions in the native lane
* fix(git-hooks): format ordinary commits with orphan rebase refs
* test(git-hooks): group operation-state boundary coverage
* test(gateway): settle synthetic restart before teardown
Recover flapping npm audit requests with four attempts, Retry-After, a total deadline, and attempt logs. Restore fail-closed security-fast and prove recovery and persistent failure through both audit callers.
Reject malformed npm advisory responses before filtering. Submit each dependency graph once, cap ordinary CI requests at 30 seconds, and publish audit summaries. Add a daily strict production audit with documented ownership and recovery.
Builds on the single-request simplification in #137865 and the incomplete-coverage policy in #137881.
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
* fix(git-hooks): keep unstaged bytes out of pre-commit formatting
format-staged.sh formatted working-tree files and then git-added the
complete working-tree contents of every staged file, so partial staging
(hunk-level git apply --cached) silently committed unstaged work, and
dirty non-format files were restaged wholesale.
Fully staged files keep the fast batch oxfmt --write + restage path, now
scoped to format-eligible files only. Partially staged files are formatted
index-only: the staged blob goes through oxfmt --stdin-filepath (same repo
config and ignorePatterns as batch mode, verified live), then
git hash-object --no-filters and git update-index --index-info, preserving
the staged mode and never touching working-tree bytes. Non-format staged
files are no longer restaged at all; staged deletions, unstaged working-tree
deletions, symlinks, and executable modes are preserved, and a formatter
that exits 0 with empty output for nonempty input fails the hook instead of
staging an emptied file.
Security scans (pre/post-format literal scan), filename protections, and
the sequencer early-exit are unchanged. Regression tests fail on the
pre-fix script; the guard/boundary suites now protect the staged-bytes-only
invariant instead of the old restage behavior.
* fix(git-hooks): pin literal pathspecs in formatter Git lookups
Enumerated staged filenames re-enter Git as pathspecs in the new
partial-state diff, staged-entry lookup, and restage add. Production runs
under the guard's GIT_LITERAL_PATHSPECS env, but the script now pins
--literal-pathspecs itself so bracket or ":(...)" magic filenames cannot
misclassify partial staging when invoked without that env. Regression
covers direct invocation with magic names; it fails without the flags.
Cross-check published advisories from verified public upstream repositories with bounded requests and explicit partial coverage. Keep the zero-install hook npm-only, preserve per-lock severity policy, and retain evidence when a release gate blocks. Reuse the existing release job token and timeout owner without changing dependency pins or SDK behavior.
* build: migrate tooling and source installs to pnpm 12
Pin the verified native toolchain without changing application dependency
versions. Preserve the existing release-age policy explicitly and separate
package-manager lock metadata from the application dependency graph.
Use exact checkout pins for bootstrap and rollback, approve only the native
pnpm installer where npm requires it, and retain global install ownership
without equating the CLI major to the storage layout. Verify the Docker
runtime toolchain offline as its non-root user.
Remove duplicate bootstrap paths and obsolete prune input, update native
CLI flags and regression fixtures, and preserve UTF-8 in macOS Bash
installer NDJSON output.
* fix(build): isolate production dependency installs for pnpm 12
Build production dependencies from the same frozen manifest inputs instead
of pruning the inherited development tree. pnpm 12's native hoisted
importer cannot rename lower-layer OverlayFS directories during pruning.
Preserve native addon outputs, workspace builds, and offline non-root
Corepack use while deleting the obsolete production-store seeder.
Exercise runtime assembly and explicitly consent to the local agent-plugin
E2E fixture under the current plugin capability contract.
Validated full Matrix image and offline non-root runtime, focused Docker
regressions, full checks with test types and architecture, docs, real
agent-plugin gateway E2E, and isolated Codex autoreview.
* test: align package smoke with pnpm 12 global installs
* test: follow native pnpm artifact approval in distribution guard
* test: modernize pnpm fixtures for v12
* test: align rebased update fixtures with pnpm 12
* test: retain sanitized upgrade restart diagnostics
* test: expose CI navigation failures and register diagnostics
* test: retain post-core outcomes and plugin artifact identity
* chore(tooling): group upgrade diagnostic entrypoints
* fix(update): support native pnpm global installs and source links
Qualify local source and archive specs, carry verified global ownership through pnpm configuration, and verify intentional checkout links with shared runtime-readiness checks. Preserve strict packaged-install verification and manager ownership safeguards.
Verified the production updater with pnpm 11.22 and 12 using default and custom roots, source links, and tarball updates.
* test: preserve survivor diagnostics after service sealing
Promote incomplete exit-zero runs before failure capture and exercise the sealed-service manager fixture without inventing successful child exits.
* fix(update): preserve legacy pnpm global ownership
Carry the verified root and bin through both pnpm and npm configuration dialects after original-environment probes. Real pnpm 10 custom-root updates and pnpm 11/12 source and tarball matrices pass without redirecting the caller or weakening ownership checks.
* test(update): verify wizard consent through checkout handoff
Use the prepared checkout and fresh-process finalization boundary introduced by the updater repair. Preserve explicit consent forwarding before and after the wizard subcommand without assuming plugin callbacks run in the old process.
* refactor(update): validate checkout build metadata records
Use the canonical record coercer instead of carrying an unchecked assertion into the shared runtime verifier. Remove the now-unused grandfathered assertion entry; no allowance is added.
* docs(sandbox): document standalone common-image inputs
* test(packaging): account for required native prebuilds
Align installer and release size budgets at 235 MiB for the required native payload added on main. Keep both loader layouts, upstream binaries, explicit overrides, and missing-data rejection intact. Exercise actual defaults and the one-byte boundary. Retain bounded stderr diagnostics for the intermittent Bun signal test without claiming a production signal fix.
* test: align refreshed installer fixtures with pnpm 12
* fix(test): share Bun smoke force-kill ownership
Record the successful force-kill once across the timer and post-close drain. Native Darwin traces reproduced both duplicate-signal orders; genuine permission failures and uncleared groups still fail without extending deadlines.
* chore(types): add declaration files for scripts/lib and scripts/e2e modules
* chore(types): add declaration files for top-level script modules (a-m)
* chore(types): add declaration files for top-level script modules (n-z)
* test: use a non-secret-shaped gateway token fixture
* test: type ci workflow guard helpers for the root test lane
* chore(tooling): typecheck root test/** with a dedicated tsgo lane
- test/tsconfig/tsconfig.test.root.json: root-test program (strict unused checks,
fixtures excluded; two Docker E2E clients that import built dist/** stay out,
same rationale as the scripts/e2e exclusion in tsconfig.scripts.json)
- tsgo:test:root wired into tsgo:test, check:test-types, scripts/check.mjs, and
the ci.yml test-types shard, mirroring the tsgo:scripts lane (#104348)
- changed-lane routing: test/**/*.ts (excluding fixtures) and the lane tsconfig
now trigger 'typecheck test root' in check:changed; previously test/ paths ran
lint only, so harness type errors surfaced first in CI (#104287 envDir case)
- burn down all 1071 latent type errors in the program: precise param/local
types across test/scripts, test/vitest, test/e2e, and transitive scripts/e2e
program members; 205 sibling .d.mts declaration files for imported .mjs
modules (committed separately); zero any, zero ts-expect-error
- resolve the pre-existing testing star-export ambiguity in
scripts/e2e/parallels/common.ts with an explicit re-export
Closes#104388
* chore(types): correct declaration fidelity per structured review
- re-derive 51 .d.mts files from implementation data flow instead of
initializers: fix a wrong never return (runTestProjectsDelegation returns
the child), add encoding-sensitive exec/spawn overloads (plain-gh), restore
the full release profile union, make parsed paths string | null, add missing
parseArgs fields via help/non-help unions, add a missing sibling declaration
(budget-number-args), drop 15 unused lint directives
- precise install-record/tuple typing removes the type-aware oxlint
regressions the first declarations caused in scripts/e2e implementations
- route .mts declaration edits under test/ to the testRoot lane and reference
the test-root project from tsconfig.projects.json so tsgo:all covers it
(closes both review findings against the lane wiring)
* chore(scripts): keep telegram runner dist typing structural for the boundary guard
* chore(types): declare runtime pack and gateway readiness exports added on main
* test: pin the importTargetPlan form of the plugin-contract plan import
The guard expectation still referenced the raw await import( form that
7ae5996bb3 (#103975) replaced with the importTargetPlan fallback helper;
the assertion fails on current main.
Preserve canonical iMessage Full Disk Access probe failures through non-sensitive health snapshots and status output, promote imsg denial banners to the public remediation message, and add a narrow audit exception for the reviewed Mistral advisory false-positive.
