gitops/optimclaw
1
0
Fork 0
mirror of https://github.com/outbackdingo/optimclaw.git synced 2026-08-25 14:53:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1192 from nearai/staging-promote/15ab156d-23103553911

Browse Source 
chore: promote staging to staging-promote/c79754df-23099429381 (2026-03-15 04:45 UTC)
This commit is contained in:
Henry Park
2026-03-16 13:26:42 -07:00
committed by GitHub
parent 4890e73a34 15ab156d62
commit 218e8778b9
23 changed files with 626 additions and 134 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/agent/session.rs
+5 -2
View File
@@ -92,8 +92,11 @@ impl Session {
None => self.create_thread(),
Some(id) => {
if self.threads.contains_key(&id) {
// Safe: contains_key confirmed the entry exists.
self.threads.get_mut(&id).unwrap()
// Entry existence confirmed by contains_key above.
// get_mut borrows self.threads mutably, so we can't
// combine the check and access into if-let without
// conflicting with the self.create_thread() fallback.
self.threads.get_mut(&id).unwrap() // safety: contains_key guard above
} else {
// Stale active_thread ID: create a new thread, which
// updates self.active_thread to the new thread's ID.
src/channels/signal.rs
+1 -1
View File
@@ -32,7 +32,7 @@ const MAX_HTTP_RESPONSE_SIZE: usize = 10 * 1024 * 1024;
const MAX_REPLY_TARGETS: usize = 10000;
const MAX_ERROR_LOG_BODY: usize = 1024;
const REPLY_TARGETS_CAP: NonZeroUsize = NonZeroUsize::new(MAX_REPLY_TARGETS).unwrap();
const REPLY_TARGETS_CAP: NonZeroUsize = NonZeroUsize::new(MAX_REPLY_TARGETS).unwrap(); // safety: 10000 is nonzero
/// Recipient classification for outbound messages.
#[derive(Debug, Clone, PartialEq, Eq)]
src/document_extraction/extractors.rs
+2 -1
View File
@@ -205,7 +205,8 @@ fn extract_rtf(data: &[u8]) -> Result<String, String> {
let mut word = String::new();
while let Some(&next) = chars.peek() {
if next.is_ascii_alphabetic() {
word.push(chars.next().unwrap());
chars.next();
word.push(next);
} else {
break;
}
src/extensions/manager.rs
+14 -8
View File
@@ -248,12 +248,14 @@ impl ExtensionManager {
self.tunnel_url
.as_ref()
.filter(|u| !u.is_empty())
.and_then(|raw| url::Url::parse(raw).ok())
.and_then(|u| u.host_str().map(String::from))
.filter(|host| !oauth_defaults::is_loopback_host(host))
.map(|_| {
let base = self.tunnel_url.as_ref().unwrap().trim_end_matches('/');
format!("{}/oauth/callback", base)
.and_then(|raw| {
let url = url::Url::parse(raw).ok()?;
let host = url.host_str().map(String::from)?;
if oauth_defaults::is_loopback_host(&host) {
return None;
}
let base = raw.trim_end_matches('/');
Some(format!("{}/oauth/callback", base))
})
}
@@ -1309,8 +1311,12 @@ impl ExtensionManager {
match fallback_decision(&primary_result, &entry.fallback_source) {
FallbackDecision::Return => primary_result,
FallbackDecision::TryFallback => {
let primary_err = primary_result.unwrap_err();
let fallback = entry.fallback_source.as_ref().unwrap();
// TryFallback guarantees primary is Err and fallback_source is Some.
let (primary_err, fallback) = match (primary_result, entry.fallback_source.as_ref())
{
(Err(e), Some(f)) => (e, f),
(other, _) => return other,
};
tracing::info!(
extension = %entry.name,
primary_error = %primary_err,
src/llm/reasoning.rs
+4 -4
View File
@@ -155,22 +155,22 @@ pub fn is_silent_reply(text: &str) -> bool {
/// Quick-check: bail early if no reasoning/final tags are present at all.
static QUICK_TAG_RE: LazyLock<Regex> = LazyLock::new(|| {
Regex::new(r"(?i)<\s*/?\s*(?:think(?:ing)?|thought|thoughts|antthinking|reasoning|reflection|scratchpad|inner_monologue|final)\b").expect("QUICK_TAG_RE")
Regex::new(r"(?i)<\s*/?\s*(?:think(?:ing)?|thought|thoughts|antthinking|reasoning|reflection|scratchpad|inner_monologue|final)\b").expect("QUICK_TAG_RE") // safety: hardcoded literal
});
/// Matches thinking/reasoning open and close tags. Capture group 1 is "/" for close tags.
/// Whitespace-tolerant, case-insensitive, attribute-aware.
static THINKING_TAG_RE: LazyLock<Regex> = LazyLock::new(|| {
Regex::new(r"(?i)<\s*(/?)\s*(?:think(?:ing)?|thought|thoughts|antthinking|reasoning|reflection|scratchpad|inner_monologue)\b[^<>]*>").expect("THINKING_TAG_RE")
Regex::new(r"(?i)<\s*(/?)\s*(?:think(?:ing)?|thought|thoughts|antthinking|reasoning|reflection|scratchpad|inner_monologue)\b[^<>]*>").expect("THINKING_TAG_RE") // safety: hardcoded literal
});
/// Matches `<final>` / `</final>` tags. Capture group 1 is "/" for close tags.
static FINAL_TAG_RE: LazyLock<Regex> =
LazyLock::new(|| Regex::new(r"(?i)<\s*(/?)\s*final\b[^<>]*>").expect("FINAL_TAG_RE"));
LazyLock::new(|| Regex::new(r"(?i)<\s*(/?)\s*final\b[^<>]*>").expect("FINAL_TAG_RE")); // safety: hardcoded literal
/// Matches pipe-delimited reasoning tags: `<|think|>...<|/think|>` etc.
static PIPE_REASONING_TAG_RE: LazyLock<Regex> = LazyLock::new(|| {
Regex::new(r"(?i)<\|(/?)\s*(?:think(?:ing)?|thought|thoughts|antthinking|reasoning|reflection|scratchpad|inner_monologue)\|>").expect("PIPE_REASONING_TAG_RE")
Regex::new(r"(?i)<\|(/?)\s*(?:think(?:ing)?|thought|thoughts|antthinking|reasoning|reflection|scratchpad|inner_monologue)\|>").expect("PIPE_REASONING_TAG_RE") // safety: hardcoded literal
});
/// Context for reasoning operations.
src/llm/registry.rs
+1 -1
View File
@@ -219,7 +219,7 @@ impl ProviderRegistry {
pub fn load() -> Self {
let builtins: Vec<ProviderDefinition> =
serde_json::from_str(include_str!("../../providers.json"))
.expect("built-in providers.json must be valid JSON");
.expect("built-in providers.json must be valid JSON"); // safety: compile-time embedded file
let mut all = builtins;
src/llm/smart_routing.rs
+22 -21
View File
@@ -248,7 +248,7 @@ fn build_domain_regex(keywords: &[&str]) -> Regex {
let pattern = format!(r"(?i)\b({})\b", keywords.join("|"));
Regex::new(&pattern).unwrap_or_else(|e| {
tracing::warn!(error = %e, "Invalid domain keywords pattern, using minimal fallback");
Regex::new(r"(?i)\b(api|code|deploy)\b").expect("fallback regex is valid")
Regex::new(r"(?i)\b(api|code|deploy)\b").expect("fallback regex is valid") // safety: hardcoded literal
})
}
@@ -274,71 +274,71 @@ use std::sync::LazyLock;
static RE_REASONING: LazyLock<Regex> = LazyLock::new(|| {
Regex::new(
r"(?i)\b(why|how|explain|analyze|analyse|compare|contrast|evaluate|assess|reason|think|consider|implications?|consequences?|trade-?offs?|pros?\s*(and|&)\s*cons?|advantages?|disadvantages?|benefits?|drawbacks?|differs?|difference|versus|vs\.?|better|worse|optimal|best|worst)\b"
).expect("RE_REASONING is a valid regex")
).expect("RE_REASONING is a valid regex") // safety: hardcoded literal
});
static RE_MULTI_STEP: LazyLock<Regex> = LazyLock::new(|| {
Regex::new(
r"(?i)\b(first|then|next|after|before|finally|step|steps|phase|stages?|process|workflow|sequence|procedure|pipeline|chain|series|order|followed by)\b"
).expect("RE_MULTI_STEP is a valid regex")
).expect("RE_MULTI_STEP is a valid regex") // safety: hardcoded literal
});
static RE_CREATIVITY: LazyLock<Regex> = LazyLock::new(|| {
Regex::new(
r"(?i)\b(write|create|generate|compose|design|imagine|brainstorm|ideate|draft|invent|story|poem|essay|article|blog|content|narrative|script|summarize|summarise|rewrite|paraphrase|translate|adapt|tweet|post|thread|outline|structure|format|style|tone|voice)\b"
).expect("RE_CREATIVITY is a valid regex")
).expect("RE_CREATIVITY is a valid regex") // safety: hardcoded literal
});
static RE_PRECISION: LazyLock<Regex> = LazyLock::new(|| {
Regex::new(
r"(?i)\b(\d{4}|\d+\.\d+|exactly|precisely|specific|accurate|correct|verify|confirm|date|time|number|calculate|compute|measure|count)\b"
).expect("RE_PRECISION is a valid regex")
).expect("RE_PRECISION is a valid regex") // safety: hardcoded literal
});
static RE_CODE: LazyLock<Regex> = LazyLock::new(|| {
Regex::new(
r"(?i)(`{1,3}|```|function|const|let|var|import|export|class|def |async|await|=>|\.ts|\.js|\.py|\.rs|\.go|\.sol|\(\)|\[\]|\{\}|<[A-Z][a-z]+>|useState|useEffect|npm|yarn|pnpm|cargo|pip|implement|rebase|merge|commit|branch|PR|pull.?request|columns?|migrations?|module|refactor|debug|fix|bug|error|schema|database|query)"
).expect("RE_CODE is a valid regex")
).expect("RE_CODE is a valid regex") // safety: hardcoded literal
});
static RE_TOOL: LazyLock<Regex> = LazyLock::new(|| {
Regex::new(
r"(?i)\b(file|read|write|search|fetch|run|execute|check|look up|find|open|save|send|post|get|download|upload|install|deploy|build|compile|test|add|update|remove|delete|modify|change|edit|create|resolve|push|pull|clone)\b"
).expect("RE_TOOL is a valid regex")
).expect("RE_TOOL is a valid regex") // safety: hardcoded literal
});
static RE_SAFETY: LazyLock<Regex> = LazyLock::new(|| {
Regex::new(
r"(?i)\b(password|secret|private|confidential|medical|legal|financial|personal|sensitive|ssn|credit.?card|auth|token|key|encrypt|decrypt|hash|vulnerability|exploit|attack|breach)\b"
).expect("RE_SAFETY is a valid regex")
).expect("RE_SAFETY is a valid regex") // safety: hardcoded literal
});
static RE_CONTEXT: LazyLock<Regex> = LazyLock::new(|| {
Regex::new(
r"(?i)\b(previous|earlier|above|before|last|that|those|it|they|we discussed|you said|mentioned|remember|recall|as I said|like I mentioned)\b"
).expect("RE_CONTEXT is a valid regex")
).expect("RE_CONTEXT is a valid regex") // safety: hardcoded literal
});
static RE_VAGUE: LazyLock<Regex> = LazyLock::new(|| {
Regex::new(r"(?i)\b(it|this|that|something|stuff|thing|things)\b")
.expect("RE_VAGUE is a valid regex")
.expect("RE_VAGUE is a valid regex") // safety: hardcoded literal
});
static RE_OPEN_ENDED: LazyLock<Regex> = LazyLock::new(|| {
Regex::new(r"(?i)\b(why|how|what if|explain|describe|elaborate|discuss)\b")
.expect("RE_OPEN_ENDED is a valid regex")
.expect("RE_OPEN_ENDED is a valid regex") // safety: hardcoded literal
});
static RE_CONJUNCTIONS: LazyLock<Regex> = LazyLock::new(|| {
Regex::new(
r"(?i)\b(and|but|or|however|therefore|because|although|while|whereas|moreover|furthermore)\b",
)
.expect("RE_CONJUNCTIONS is a valid regex")
.expect("RE_CONJUNCTIONS is a valid regex") // safety: hardcoded literal
});
static RE_TIER_HINT: LazyLock<Regex> = LazyLock::new(|| {
Regex::new(r"(?i)\[tier:(flash|standard|pro|frontier)\]")
.expect("RE_TIER_HINT is a valid regex")
.expect("RE_TIER_HINT is a valid regex") // safety: hardcoded literal
});
/// Default domain regex, compiled once from `DEFAULT_DOMAIN_KEYWORDS`.
@@ -363,7 +363,7 @@ static DEFAULT_OVERRIDES: LazyLock<Vec<PatternOverride>> = LazyLock::new(|| {
regex: Regex::new(
r"(?i)^(hi|hello|hey|thanks|ok|sure|yes|no|yep|nope|cool|nice|great|got it)$",
)
.expect("greeting pattern is valid"),
.expect("greeting pattern is valid"), // safety: hardcoded literal
tier: Tier::Flash,
},
// Flash tier: quick lookups (end-anchored to avoid matching complex questions
@@ -372,29 +372,29 @@ static DEFAULT_OVERRIDES: LazyLock<Vec<PatternOverride>> = LazyLock::new(|| {
regex: Regex::new(
r"(?i)^what(?:'s|\s+is)?\s+(?:the\s+)?(time|date|day|weather)\b(?:\s+(?:is\s+it|today|now|in\s+\S+))?[?.!]*$",
)
.expect("lookup pattern is valid"),
.expect("lookup pattern is valid"), // safety: hardcoded literal
tier: Tier::Flash,
},
// Frontier tier: security audits
PatternOverride {
regex: Regex::new(r"(?i)security.*(audit|review|scan)")
.expect("security audit pattern is valid"),
.expect("security audit pattern is valid"), // safety: hardcoded literal
tier: Tier::Frontier,
},
PatternOverride {
regex: Regex::new(r"(?i)vulnerabilit(y|ies).*(review|scan|check|audit)")
.expect("vulnerability pattern is valid"),
.expect("vulnerability pattern is valid"), // safety: hardcoded literal
tier: Tier::Frontier,
},
// Pro tier: production deployments
PatternOverride {
regex: Regex::new(r"(?i)deploy.*(mainnet|production)")
.expect("deploy pattern is valid"),
.expect("deploy pattern is valid"), // safety: hardcoded literal
tier: Tier::Pro,
},
PatternOverride {
regex: Regex::new(r"(?i)production.*(deploy|release|push)")
.expect("production pattern is valid"),
.expect("production pattern is valid"), // safety: hardcoded literal
tier: Tier::Pro,
},
]
@@ -451,7 +451,7 @@ fn score_complexity_internal(
// Check for explicit tier hint (e.g. "[tier:flash]")
if let Some(caps) = RE_TIER_HINT.captures(prompt) {
let tier_str = caps.get(1).expect("capture group 1 exists").as_str();
let tier_str = caps.get(1).expect("capture group 1 exists").as_str(); // safety: RE_TIER_HINT has group 1
let tier = match tier_str.to_lowercase().as_str() {
"flash" => Tier::Flash,
"standard" => Tier::Standard,
@@ -758,7 +758,8 @@ impl SmartRoutingProvider {
// Highest priority: explicit tier hints (e.g. "[tier:flash]")
if let Some(caps) = RE_TIER_HINT.captures(last_user_msg) {
let tier_str = caps.get(1).expect("capture group 1 exists").as_str();
// SAFETY: RE_TIER_HINT has exactly one capture group; get(1) is guaranteed Some after match.
let tier_str = caps.get(1).expect("capture group 1 exists").as_str(); // safety: RE_TIER_HINT has group 1
let tier = match tier_str.to_lowercase().as_str() {
"flash" => Tier::Flash,
"standard" => Tier::Standard,
src/settings.rs
+3 -6
View File
@@ -837,19 +837,16 @@ impl Settings {
.map_err(|e| format!("Failed to serialize settings: {}", e))?;
let parts: Vec<&str> = path.split('.').collect();
if parts.is_empty() {
return Err("Empty path".to_string());
}
let (final_key, parent_parts) =
parts.split_last().ok_or_else(|| "Empty path".to_string())?;
// Navigate to parent and set the final key
let mut current = &mut json;
for part in &parts[..parts.len() - 1] {
for part in parent_parts {
current = current
.get_mut(*part)
.ok_or_else(|| format!("Path not found: {}", path))?;
}
let final_key = parts.last().unwrap();
let obj = current
.as_object_mut()
.ok_or_else(|| format!("Parent is not an object: {}", path))?;
src/setup/channels.rs
+1 -1
View File
@@ -1016,7 +1016,7 @@ fn validation_placeholder_regex() -> &'static regex::Regex {
static PLACEHOLDER_RE: std::sync::OnceLock<regex::Regex> = std::sync::OnceLock::new();
PLACEHOLDER_RE.get_or_init(|| {
regex::Regex::new(r"\{([A-Za-z0-9_]+)\}")
.expect("validation placeholder regex must compile")
.expect("validation placeholder regex must compile") // safety: hardcoded literal
})
}
src/skills/mod.rs
+4 -4
View File
@@ -48,7 +48,7 @@ pub const MAX_PROMPT_FILE_SIZE: u64 = 64 * 1024;
/// Regex for validating skill names: alphanumeric, hyphens, underscores, dots.
static SKILL_NAME_PATTERN: std::sync::LazyLock<Regex> =
std::sync::LazyLock::new(|| Regex::new(r"^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$").unwrap());
std::sync::LazyLock::new(|| Regex::new(r"^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$").unwrap()); // safety: hardcoded literal
/// Validate a skill name against the allowed pattern.
pub fn validate_skill_name(name: &str) -> bool {
@@ -268,13 +268,13 @@ pub fn escape_skill_content(content: &str) -> String {
// Match `<` followed by optional `/`, optional whitespace/control chars,
// then `skill` (case-insensitive). Catches both opening and closing tags:
// `<skill`, `</skill`, `< skill`, `</\0skill`, `<SKILL`, etc.
Regex::new(r"(?i)</?[\s\x00]*skill").unwrap()
Regex::new(r"(?i)</?[\s\x00]*skill").unwrap() // safety: hardcoded literal
});
SKILL_TAG_RE
.replace_all(content, |caps: &regex::Captures| {
// Replace leading `<` with `&lt;` to neutralize the tag
let matched = caps.get(0).unwrap().as_str();
// Replace leading `<` with `&lt;` to neutralize the tag.
let matched = caps.get(0).unwrap().as_str(); // safety: group 0 always exists
format!("&lt;{}", &matched[1..])
})
.into_owned()
src/tools/builtin/job.rs
+30 -1
View File
@@ -330,7 +330,11 @@ impl CreateJobTool {
ctx: &JobContext,
) -> Result<ToolOutput, ToolError> {
let start = std::time::Instant::now();
let jm = self.job_manager.as_ref().expect("sandbox deps required");
let jm = self.job_manager.as_ref().ok_or_else(|| {
ToolError::ExecutionFailed(
"Sandbox execution requires a configured job manager (container runtime not available)".to_string(),
)
})?;
let job_id = Uuid::new_v4();
let (project_dir, browse_id) = resolve_project_dir(explicit_dir, job_id)?;
@@ -1422,6 +1426,31 @@ mod tests {
assert_eq!(tool.execution_timeout(), Duration::from_secs(30));
}
#[tokio::test]
async fn test_sandbox_without_job_manager_returns_error() {
let manager = Arc::new(ContextManager::new(5));
// Create tool without sandbox deps — job_manager is None.
let tool = CreateJobTool::new(manager);
assert!(!tool.sandbox_enabled());
let result = tool
.execute_sandbox(
"test task",
None,
false,
JobMode::Worker,
vec![],
&JobContext::default(),
)
.await;
let err = result.unwrap_err();
assert!(
matches!(err, ToolError::ExecutionFailed(_)),
"expected ExecutionFailed, got: {err:?}"
);
}
#[tokio::test]
async fn test_list_jobs_tool() {
let manager = Arc::new(ContextManager::new(5));
src/tools/mcp/http_transport.rs
+1 -1
View File
@@ -39,7 +39,7 @@ impl HttpMcpTransport {
http_client: reqwest::Client::builder()
.timeout(std::time::Duration::from_secs(30))
.build()
.expect("Failed to create HTTP client"),
.expect("Failed to create HTTP client"), // safety: TLS init with default rustls cannot fail
session_manager: None,
custom_headers: HashMap::new(),
}
src/tools/wasm/wrapper.rs
+1 -1
View File
@@ -343,7 +343,7 @@ impl near::agent::host::Host for StoreData {
.map_err(|e| format!("Failed to create HTTP runtime: {e}"))?,
);
}
let rt = self.http_runtime.as_ref().expect("just initialized");
let rt = self.http_runtime.as_ref().expect("just initialized"); // safety: is_none branch above guarantees Some
let result = rt.block_on(async {
let client = reqwest::Client::builder()
.connect_timeout(Duration::from_secs(10))
src/workspace/chunker.rs
+3 -2
View File
@@ -92,8 +92,9 @@ pub fn chunk_document(content: &str, config: ChunkConfig) -> Vec<String> {
let chunk_words = &words[start..end];
// Don't create tiny trailing chunks, merge with previous
if chunk_words.len() < config.min_chunk_size && !chunks.is_empty() {
let last = chunks.pop().unwrap();
if chunk_words.len() < config.min_chunk_size
&& let Some(last) = chunks.pop()
{
let combined = format!("{} {}", last, chunk_words.join(" "));
chunks.push(combined);
break;