* feat(extensions): add load-time validation for auth capabilities
Catch common misconfigurations (missing auth section, missing setup_url,
short prompts) at startup via tracing::warn instead of silently failing
at auth time.
* feat(extensions): improve auth prompts, setup_url, and showAuthCard
Add setup_url and descriptive prompts to channel and tool capabilities
files. Fix showAuthCard in web gateway and improve extension manager
auth flow messaging.
* refactor(extensions): extract MIN_PROMPT_LENGTH constant in validate()
Address review feedback: replace magic number 30 with a named constant
for readability and maintainability.
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix(security): restrict query-token auth to SSE endpoints only
Query-string `?token=xxx` auth was accepted on all endpoints, exposing
the main auth token in server logs, Referer headers, and browser history
for state-changing routes. Now only GET /api/chat/events and
GET /api/logs/events accept query tokens; all other endpoints require
the Authorization header.
Supersedes #364.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: add WebSocket endpoint to query-token allowlist, add URL-encoding tests
The WS upgrade at /api/chat/ws also can't set custom headers, so it
needs query-token auth like the SSE endpoints. Also adds tests for
URL-encoded token values to cover the form_urlencoded parser.
Addresses review feedback from Gemini (partially, /api/jobs/{id}/events
is a JSON endpoint not SSE, so it correctly stays excluded) and Copilot
(URL-encoded token test).
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
The ironclaw binary only handles SIGINT (via tokio::signal::ctrl_c),
not SIGTERM. When conftest.py sent SIGTERM during teardown, the OS
killed the process immediately without running atexit handlers, so
LLVM never flushed .profraw files. cargo llvm-cov report then found
zero profraw files and failed.
- Send SIGINT instead of SIGTERM so the existing ctrl_c handler
triggers graceful shutdown → main() returns → atexit runs → profraw
flushed
- Increase shutdown wait from 5s to 10s for graceful cleanup
- Add a diagnostic step to verify profraw files exist before the
report step, making future issues visible in CI logs
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix(wasm): coerce string parameters to schema-declared types
LLMs frequently pass numeric values as JSON strings ("5" instead of 5)
or booleans as strings ("true" instead of true). The WASM module's
serde deserializer rejects these type mismatches. This adds a
coerce_params_to_schema() helper that walks the params JSON object
and converts string values to their schema-declared types (number,
integer, boolean) before passing to the WASM module.
Adds 5 unit tests covering number, integer, boolean coercion,
already-correct types, and unparseable strings.
Closes#486
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor: use in-place mutation and case-insensitive boolean coercion
Address review feedback:
- Use get_mut instead of clone+insert to avoid allocations
- Make boolean coercion case-insensitive (handles "True", "FALSE", etc.)
- Expand boolean test to cover false and mixed-case values
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: cargo fmt
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: collapse nested if-let to satisfy clippy collapsible_if lint
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix(agent): strip leaked [Called tool ...] text from agent responses
When the NEAR AI provider flattens tool_call messages to plain text,
markers like [Called tool ...] and [Tool ... returned: ...] can leak
into the user-visible response if the LLM echoes them back. This adds
a sanitization step in the agentic loop's text response path that
strips these internal markers before returning. If stripping leaves
the response empty, a generic fallback message is returned instead.
Closes#487
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor: use fold instead of collect+join to avoid heap allocation
Address review feedback: replace Vec collect + join with fold to build
the filtered string directly, avoiding an intermediate heap allocation.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: cargo fmt
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
Co-authored-by: Pierre LE GUEN <[email protected]>
* fix(web): reset job list UI on restart failure
The restartJob() catch handler was missing a loadJobs() call, so the
job row stayed in a stale highlighted state after a failed restart
attempt. Add loadJobs() to match the success path behavior.
Closes#485
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor: use .finally() for loadJobs() instead of duplicating
Move loadJobs() to a .finally() block so it runs on both success and
failure without duplication.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
The Telegram channel capabilities file was missing the `webhook`
block inside `capabilities.channel`, causing the router to fall back
to the default `X-Webhook-Secret` header instead of the Telegram-
specific `X-Telegram-Bot-Api-Secret-Token`.
When a webhook secret is configured (via `telegram_webhook_secret`),
incoming updates are rejected with 401 because Telegram sends the
token in `X-Telegram-Bot-Api-Secret-Token` but the router looks for
`X-Webhook-Secret`.
The existing test in `schema.rs` already expects the correct header
name, confirming this is an oversight in the shipped capabilities
file.
Co-authored-by: SMKRV <[email protected]>
Co-authored-by: firat.sertgoz <[email protected]>
The pairing store called .unwrap() on path.parent() in three locations
(upsert_request, record_failed_approve, add_allow_from). If a path has
no parent (root path or empty), this panics — a potential denial-of-service
vector if an attacker can influence the path.
Added InvalidPath variant to PairingStoreError and replaced all three
.unwrap() calls with ok_or_else error propagation. This follows the
project's no-panics-in-production policy.
Locations fixed:
- upsert_request (line ~227)
- record_failed_approve (line ~322)
- add_allow_from (line ~465)
Co-authored-by: Claude Sonnet 4.6 <[email protected]>
* ci: enhance coverage workflow with feature matrix, postgres, and E2E
Replace single-config coverage job with a multi-job pipeline:
- Mirror test.yml's 3-config feature matrix (all-features, default, libsql-only)
- Add PostgreSQL service (pgvector/pgvector:pg16) with migrations for
postgres configs so integration tests actually run instead of skipping
- Add E2E coverage job using cargo-llvm-cov instrumented binary with
Playwright browser tests
- Add coverage-gate roll-up job for branch protection
- Upload per-config flags to Codecov (all-features, default, libsql-only, e2e)
- Forward LLVM coverage env vars in E2E conftest.py so profraw data
lands where cargo-llvm-cov report expects it
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: address PR review feedback on coverage workflow
- Avoid setting DATABASE_URL to empty string for libsql-only config;
use $GITHUB_ENV conditional step so the var is unset entirely
- Add set -euo pipefail and psql -v ON_ERROR_STOP=1 to migrations
so SQL errors fail the job immediately
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
Add Dockerfile.test as reusable infrastructure for spinning up local
test instances with libsql (no PostgreSQL dependency). Defaults to
port 3003 to avoid conflict with dev server.
Add local-test workspace skill that teaches the agent how to build,
run, and test against local Docker containers using Chrome MCP browser
automation tools. Covers LLM backend configuration, multi-instance
testing, cleanup, and troubleshooting.
* ci: enforce regression tests for fix commits
Add a commit-msg hook and CI workflow that require test changes
alongside bug fix commits, ensuring every fix includes a regression
test that would have caught the bug.
- scripts/commit-msg-regression.sh: local git hook (blocks fix commits
without test changes; exempts static/docs-only; bypass via
[skip-regression-check] marker)
- .github/workflows/regression-test-check.yml: CI mirror on PRs
(checks title + commit messages; skip via label)
- scripts/dev-setup.sh: install hook in step 6
- .github/scripts/create-labels.sh: add skip-regression-check label
- CLAUDE.md: document regression test policy
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: address PR review feedback on regression test enforcement
- Use here-strings instead of echo|grep to avoid misinterpreting
special characters in variables
- Use git diff -W (whole-function context) to detect edits inside
existing test functions, not just new #[test] attributes
- Honor [skip-regression-check] in commit messages in CI (not just
the PR label)
- Use git rev-parse --git-path hooks for worktree-safe hook install
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* Update .github/workflows/regression-test-check.yml
Co-authored-by: Copilot <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
Co-authored-by: Copilot <[email protected]>
* ci: add code coverage with cargo-llvm-cov and Codecov
Add a Coverage workflow that runs on PRs and pushes to main using
cargo-llvm-cov with --all-features, uploading LCOV results to Codecov.
Include codecov.yml config with project/patch targets and ignore rules
for stub files.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* ci: switch Codecov upload to OIDC (tokenless)
Use GitHub OIDC tokens instead of CODECOV_TOKEN secret so coverage
uploads work for fork PRs where secrets are not available.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* ci: fail coverage upload strictly on push, leniently on PRs
Use a conditional so pushes to main fail if Codecov upload breaks
(preventing silent reporting gaps) while PRs stay lenient to avoid
blocking fork PRs where OIDC may not be available.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* ci: disable Codecov auto-detection to suppress warnings
We provide lcov.info explicitly, so disable auto-search for gcov,
coverage.py, and Xcode formats that produce noisy warnings.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* ci: include channels-src and tools-src in coverage reporting
These WASM source directories should be tracked for test coverage
rather than ignored.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* ci: remove stale ignore entries from codecov.yml
The marketplace, ecommerce, taskrabbit, and restaurant stub files
no longer exist in the codebase.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* ci: run coverage on push to main only
Avoids running tests twice on PRs (once in test.yml, once for coverage).
Coverage runs on merge to main instead. Simplify fail_ci_if_error to
always true since it only runs on push now.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix(web): use dvh units to prevent mobile browser bar from obscuring chat input
On mobile browsers (Brave/Android, Safari/iOS), the bottom navigation bar
covers the chat input because 100vh includes space behind browser chrome.
Switch to 100dvh (dynamic viewport height) with vh fallback for older
browsers, and add safe-area-inset padding for notched devices.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* Fix padding declaration in chat input style
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
Co-authored-by: Illia Polosukhin <[email protected]>
* fix(web): assign unique thread_id to manual routine triggers
Manual routine triggers via the web API created an IncomingMessage
without a thread_id, causing session_manager.resolve_thread() to
route the output to whatever thread was last associated with the
(user, "gateway", None) key. This sets a unique thread_id of the
form "routine-{id}-{timestamp}" so each manual trigger gets its own
dedicated thread.
Closes#484
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: add ownership check to routine trigger handler (IDOR)
Address review feedback: verify routine.user_id matches the
authenticated user before allowing the trigger, preventing
unauthorized cross-user routine execution.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: cargo fmt
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix(web): refresh routine UI after "Run Now" trigger
triggerRoutine() only showed a toast but did not refresh the routine
data after triggering. This adds openRoutineDetail() / loadRoutines()
calls after the toast, matching the pattern used by toggleRoutine().
Closes#483
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: only refresh detail view if triggered routine matches current view
Check currentRoutineId === id before refreshing the detail panel to
avoid refreshing the wrong routine's view.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix(web): use slug for skill download URL from ClawHub
The skill install handler was using req.name (display name like
"Markdown Converter") instead of the slug (like "owner/markdown-converter")
when constructing the download URL. The registry endpoint expects a slug,
so display names caused 502 errors.
- Add optional `slug` field to SkillInstallRequest
- Prefer slug over name when building the download URL
- JS installSkill() now sends slug from search results
Closes#482
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: guard against empty slug string in skill download URL
Filter out empty slug strings so we fall back to name instead of
constructing an invalid download URL.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: cargo fmt
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix(workspace): thread document path through search results
Memory search results were showing chunk UUIDs instead of source file
paths. Thread document_path through RankedResult, SearchResult, and the
RRF fusion pipeline so handlers can display the actual file path.
Fixes#481
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor: use into_iter to move values instead of cloning
Address review feedback: consume results with into_iter() to move
String fields directly instead of cloning them.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
Swap the order of import_from_directory() and seed_if_empty() so that
custom workspace templates from WORKSPACE_IMPORT_DIR take priority
over generic seeds. Previously, seed_if_empty() ran first and created
all default files, causing import_from_directory() to skip everything
since the files already existed in the DB.
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
* feat: add OAuth support for WASM tools in web gateway
Extract reusable OAuth functions (build_oauth_url, exchange_oauth_code,
store_oauth_tokens, validate_oauth_token) from CLI into shared
oauth_defaults module, then wire them into the web gateway's
ExtensionManager.
Key changes:
- Install auto-activates WASM tools (no separate Activate button)
- Configure button triggers OAuth flow via save_setup_secrets
- Scope merging: installing a second Google tool triggers re-auth with
merged scopes from all tools sharing the same secret_name
- Cancel-and-retry: aborting stale OAuth listeners prevents port conflicts
- Post-auth validation: wrong account detected via validation_endpoint
- Reconfigure always re-auths (deletes old token before starting fresh)
- UI shows error toast on OAuth failure, refreshes extension list
Flow: Install → Active → Configure (enter client_id/secret) → Save →
OAuth popup → authorize → done. Second Google tool install auto-triggers
scope expansion OAuth.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix: address PR review comments
- Add custom headers support to ValidationEndpointSchema (fixes
missing Notion-Version header regression)
- Guard activate handler auth check with status == "awaiting_authorization"
to prevent unexpected OAuth popups
- Add window dimensions to OAuth popup in activateExtension()
- Simplify UTF-8 truncation boundary check
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix: address Copilot PR review comments (security, UX, bugs)
- Add CSRF state parameter to OAuth flow (random state in auth URL, validated in callback)
- Restore MCP server Activate button in web UI (was hidden for all non-channel extensions)
- Abort JoinHandle in cleanup_expired_auths to prevent port 9876 conflicts
- Fix Google-specific error message for non-Google OAuth providers
- Add has_auth field to ExtensionInfo API response (fixes Configure button visibility)
- Use oauth_defaults::callback_url() instead of hardcoded redirect_uri (both CLI and manager)
- Update auth check comment to match actual behavior (scope expansion + first-time auth)
- Add unit tests for build_oauth_url (basic, PKCE, extra params, state uniqueness)
- Check all required setup secrets (client_id + client_secret) before starting OAuth
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
* fix: use std::sync::RwLock in MessageTool to avoid runtime panic
The `requires_approval` method is synchronous but was using
`tokio::sync::RwLock` with `.await` which requires blocking the
runtime. This caused a panic:
"Cannot block the current thread from within a runtime"
Changes:
- Replace `tokio::sync::RwLock` with `std::sync::RwLock` for
`default_channel` and `default_target` fields
- Use `unwrap_or_else(|e| e.into_inner())` to gracefully handle
poisoned locks (recovers instead of panicking)
- Update all usages from `.read().await` to `.read().unwrap_or_else()`
The locks are short-held (just cloning strings), making std::sync::RwLock
appropriate for sync methods called from async contexts.
Fixes: "Cannot block the current thread from within a runtime" panic
when the LLM tries to send a message via the message tool.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: address code review feedback for MessageTool RwLock fix
- Fix formatting (long lines broken up per rustfmt)
- Add regression test that demonstrates the panic with tokio::sync::RwLock
and passes with std::sync::RwLock when calling requires_approval()
(sync method) from async context
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* feat(web): fix jobs UI parity for non-sandbox mode
The web gateway Jobs UI was built primarily for sandbox (Docker) jobs.
When running without sandbox (common for NEAR AI hosted envs), multiple
features were broken. This change fixes all of them:
- Agent jobs now broadcast live SSE events to the web UI (Activity tab)
- Agent job restart via scheduler.dispatch_job (not chat message)
- Follow-up prompts for agent jobs via WorkerMessage injection
- Capability flags (can_restart, can_prompt, job_kind) in job detail API
- Rate-limit retry with cap (10 consecutive) and Retry-After header parsing
- Plan interruption on user message (breaks out of plan, re-evaluates)
- Correct SSE status field in mark_completed/mark_failed/mark_stuck
- SseManager preserved across rebuild_state calls
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* style: fix formatting in db/mod.rs and nearai_chat.rs
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
* refactor: remove restart infrastructure and generalize Telegram-specific code
Remove the gateway restart mechanism (hot-activation works, restart won't
fix activation failures) and generalize Telegram-specific hardcoded checks
so all WASM channels get equal treatment.
Part 1 - Remove restart infrastructure:
- Remove needs_restart from ActionResponse, restart_requested from GatewayState
- Remove gateway_restart_handler, /api/gateway/restart route, exit code 75
- Remove restart overlay JS/CSS (dead code - restartGateway() never called)
- Surface actual activation errors instead of suggesting restart
Part 2 - Generalize Telegram-specific code:
- Replace telegram_owner_id: Option<i64> with generic
wasm_channel_owner_ids: HashMap<String, i64> (backwards-compatible
via TELEGRAM_OWNER_ID env var)
- Pairing status check now applies to all active WASM channels
- All channels get 3-step stepper in web UI, remove "coming soon" note
- Remove dead setup_telegram() code (~700 lines) - Telegram's
capabilities.json declares required_secrets, so the generic
setup_wasm_channel() path handles it
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* test: add Settings::set() test for wasm_channel_owner_ids
Addresses review feedback: verify that setting per-channel owner IDs
via the dotted-path Settings::set() API works correctly with the new
HashMap<String, i64> type.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix(web): refresh extension stepper after pairing approval
loadPairingRequests only refreshed the pairing section, not the
stepper status. Call loadExtensions() instead so the stepper updates
from "Awaiting Pairing" to "Active" immediately after approval.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
* feat(workspace): add TOOLS.md, BOOTSTRAP.md, and disk-to-DB import
Add two new OpenClaw-compatible workspace markdown files:
- TOOLS.md: Environment-specific tool notes (SSH hosts, device names,
etc.) injected into the system prompt under "## Tool Notes". Seeded
as comment-only (like HEARTBEAT.md) so it's effectively empty until
the user adds real content. Not write-protected — the agent can
update it as it learns the environment.
- BOOTSTRAP.md: First-run onboarding ritual. Injected FIRST in the
system prompt when present. Guides the agent through introducing
itself, learning about the user, and updating workspace files.
Only seeded on truly fresh workspaces (no existing identity files)
to avoid triggering the ritual on existing deployments. Agent clears
it via `memory_write(target="bootstrap")` when done.
Add `Workspace::import_from_directory()` for disk-to-DB import:
- Scans a directory for *.md files and imports any that don't already
exist in the database (never overwrites user edits)
- Controlled by WORKSPACE_IMPORT_DIR env var, runs after seed_if_empty()
- Enables Docker images / deployment scripts to ship customized
workspace templates that override generic seeds
- Backwards compatible: no-op when env var is unset
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix: address PR review comments
- Use stable `path.extension() != Some(OsStr::new("md"))` instead of
unstable `is_none_or` (nightly-only)
- Use `tokio::join!` for concurrent DB reads in fresh-workspace check
- Skip unreadable directory entries instead of failing the entire import
- Skip unreadable files instead of failing the entire import
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
WASM tools and channels activated at runtime (via web UI or CLI) were
missing secrets store wiring, causing credential injection to silently
fail. Tools like web-search would get 401s from APIs even though the
user had configured their API key.
Four bugs fixed:
- activate_wasm_tool(): WasmToolLoader created without .with_secrets_store()
- register_wasm_from_storage(): hardcoded secrets_store: None
- WasmChannelLoader: no secrets_store field at all (added field + builder)
- activate_wasm_channel() and startup path: both missed wiring secrets
The startup path in app.rs was correct; all runtime paths now match it.
Co-authored-by: Claude Sonnet 4.6 <[email protected]>
* feat: add Brave Web Search WASM tool
Add a new WASM tool for searching the web via the Brave Search API.
Follows the same architecture as the GitHub WASM tool with zero-exposure
credential injection (X-Subscription-Token header).
Features:
- Full Brave Search API support (query, count, country, search_lang,
ui_lang, freshness)
- Input validation on all parameters
- Retry logic for 429/5xx transient errors
- RFC 3986 percent-encoding
- Registry manifest for Extensions tab discovery
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix: avoid Vec allocation in is_valid_ui_lang
Use iterator-based destructuring instead of collecting into a Vec,
avoiding a heap allocation in the WASM sandbox.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
- Add scrollIntoView to keep arrow-key-selected item visible in dropdown
- Make Enter complete the first matching command when autocomplete is
visible, instead of requiring explicit arrow-key navigation first
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
The tool manifests pointed to channel bundle URLs (telegram-wasm32-wasip2.tar.gz,
slack-wasm32-wasip2.tar.gz) instead of the tool bundles (telegram-mtproto-...,
slack-tool-...). This caused install to fail because the archive contents
didn't match the expected .wasm filename.
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
The compiler cannot infer the element type of `conflicts` on Windows
because all `push` calls are inside `#[cfg(unix)]` blocks which don't
compile on Windows.
Co-authored-by: Claude Sonnet 4.6 (1M context) <[email protected]>
* fix(channels): add host-based credential injection to WASM channel wrapper
The channel WASM wrapper was missing the host-based credential injection
that the tools wrapper implements. The `credentials` block in channel
capabilities files was dead code: Slack's `on_respond` sends requests
with no Authorization header, expecting the host to inject the bot token
based on `host_patterns`, but the host never did.
This caused Slack (and any channel relying on capabilities-declared
credentials) to fail all outbound API calls with `not_authed`.
Changes:
- Add `ResolvedHostCredential` struct mirroring the tools wrapper
- Add `host_credentials` field to `ChannelStoreData`
- Add `inject_host_credentials()` method on `ChannelStoreData`
- Update `redact_credentials()` to also scrub host-injected secret values
- Add `secrets_store` field to `WasmChannel` + `with_secrets_store()` builder
- Add `resolve_channel_host_credentials()` async helper that decrypts
capabilities-declared credentials before each WASM callback
- Update `create_store()` and all `call_on_*` / `execute_status` /
`execute_poll` call sites to pre-resolve and pass host credentials
- Fix leak scan ordering: scan runs on WASM-provided values BEFORE host
credential injection, preventing false-positive blocks on injected
Bearer tokens (e.g. xoxb- Slack tokens)
- Make `credential_injector` module pub(crate) so channels can reuse
`inject_credential` and `host_matches_pattern`
Fixes#389, root cause of #413
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
* fix(wasm): redact URL-encoded credentials, use url::Url, derive Clone
Address review feedback on PR #421:
1. Security: redact_credentials now scrubs URL-encoded forms of secrets
in addition to raw values, preventing exfiltration via encoded
representations in error strings from reqwest
2. Use url::Url::query_pairs_mut() for query parameter injection instead
of manual string manipulation, improving robustness with malformed URLs
3. Derive Clone on ResolvedHostCredential and simplify the per-tick
clone in the status repeater loop
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: cargo fmt
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Sprite <[email protected]>
Co-authored-by: Claude Sonnet 4.6 <[email protected]>
* refactor: rename WasmBuildable::repo_url to source_dir
The field receives a local directory path (e.g. "tools-src/gmail"), not a
URL. Rename to source_dir to accurately reflect its purpose.
Adds #[serde(alias = "repo_url")] for backwards compatibility with any
previously serialized data.
Closes#329
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor: rename extract_url to extract_source
The function can return a local directory path, not just a URL.
Addresses review feedback on PR #445.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix: pre-validate Cloudflare tunnel token by spawning cloudflared
After format validation passes, spawn `cloudflared tunnel run` briefly
with a dummy URL and watch stderr for up to 10s. If an error appears
before a connection URL, report it and offer "Save anyway?". This
catches bad tokens during setup instead of at runtime 30s later.
Closes#440
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: tighten cloudflared output matching in live validation
- Check for cfargotunnel.com/trycloudflare.com in success detection
- Use starts_with("err") instead of contains("err") to avoid false
positives on words like "stderr"
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix: prevent Telegram 409 Conflict on webhook re-registration
Delete any existing webhook before calling setWebhook in on_start(),
matching the defensive cleanup that polling mode already does. As a
safety net, register_webhook() now retries once on 409 after calling
delete_webhook().
Closes#440
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor: deduplicate 409 retry logic in register_webhook
Restructure the match block so the initial request and retry share
a single response-handling code path.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix: persist channel activation state across restarts (#392)
Channels activated via the web UI were lost on restart because
active_channel_names was only in memory. Now persist activation state
to the settings store under "activated_channels" and auto-activate
persisted channels on startup.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: log warnings for channel activation load failures
Replace silent catch-all with explicit error logging when
database queries or deserialization fails for activated channels.
Addresses Gemini review feedback on PR #432.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* Apply suggestions from code review
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
Co-authored-by: Illia Polosukhin <[email protected]>
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
* fix: init WASM runtime eagerly regardless of tools directory existence
The WASM tool runtime was only created at startup when both
`wasm.enabled` and `wasm.tools_dir.exists()` were true. This meant
that if the tools directory didn't exist yet (e.g. fresh deploy with
`--no-onboard`), the runtime was set to None and passed to the
ExtensionManager. Extensions installed later via the web UI would
then fail with "WASM runtime not available" because the runtime
could not be retroactively created.
The Wasmtime engine initialization has no dependency on the tools
directory — it only configures the compiler and starts an epoch
ticker thread. The directory is only needed later when loading
.wasm modules. Remove the directory check so the runtime is
available for post-startup extension activation.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* test: add regression tests for WASM runtime eager init
- runtime.rs: test_runtime_creation_without_tools_dir confirms the
Wasmtime engine initialises without a tools directory on disk
- manager.rs: test_activate_wasm_tool_with_runtime_passes_runtime_check
verifies activation gets past the runtime check when a runtime is
provided (fails on missing file, not missing runtime)
- manager.rs: test_activate_wasm_tool_without_runtime_fails_with_runtime_error
verifies the original error when no runtime is available
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor: use idiomatic Result-to-Option conversion for WASM runtime init
Address PR review feedback: replace match block with
.map(Arc::new).map_err(|e| warn!(...)).ok() chain.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: fix formatting in extension manager tests
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
All PostgreSQL connection sites hardcoded NoTls, preventing connections
to managed providers that require TLS (AWS RDS, Neon, Supabase, etc.).
- Add tokio-postgres-rustls with rustls + system root certificates
- Add SslMode enum (disable/prefer/require) via DATABASE_SSLMODE env var
- Replace NoTls at all 4 production call sites with TLS-aware pool creation
- Add SslMode::from_env() helper for lightweight CLI tools
- Log native cert loading errors and warn on empty root store
Default mode is Prefer (attempts TLS, matching most managed providers).
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix: scan inbound messages for leaked secrets before LLM processing (#393)
Add scan_inbound_for_secrets() to SafetyLayer that reuses the existing
leak detector on user input. Wire it into thread_ops.rs after the policy
check so messages containing API keys or tokens are rejected early,
preventing the LLM from echoing them back and triggering outbound
leak-detection error loops.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: unify inbound secret scan warning messages
Both the detected-secret and error branches now show the same
actionable message guiding users to remove secrets and use the
config system instead.
Addresses Gemini review feedback on PR #433.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix: use tailscale funnel --bg for proper tunnel setup (#394)
The old command `tailscale funnel http://127.0.0.1:3000` would hang
without establishing a tunnel. The correct invocation is
`tailscale funnel --bg <port>` which configures the tunnel as a
background daemon and exits.
Changes:
- Use `--bg` flag with just the port number
- Run as a one-shot command instead of spawning a child process
- Use `tailscale <cmd> off` to tear down (matches --bg semantics)
- health_check uses stored URL instead of non-existent child PID
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: use local_host parameter and verify tailscale health
Pass full http://host:port URL to tailscale instead of ignoring
the local_host parameter. Health check now verifies tailscale is
actually running via 'tailscale status --json'.
Addresses Gemini review feedback on PR #430.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix: add missing build.sh for Discord and WhatsApp channels (#406)
Both channels had full source code in channels-src/ but no build.sh,
so their WASM binaries were never compiled and they didn't appear in
the setup wizard's channel selection list.
Modeled after the existing channels-src/telegram/build.sh.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: guard wasm-tools availability in WASM build scripts
Add command existence check before invoking wasm-tools in discord
and whatsapp build scripts. Prints actionable error message if missing.
Addresses Gemini review feedback on PR #429.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
The Slack channel capabilities.json declares secret names in lowercase
(slack_bot_token) but the web UI stored them in UPPERCASE
(SLACK_BOT_TOKEN), causing credential injection to fail with
"not_authed".
Changes:
- CreateSecretParams::new() normalizes name to lowercase on creation
- All SecretsStore lookups (get, exists, delete, is_accessible) now
lowercase the name parameter before querying
- Applied to all three backends: PostgreSQL, libSQL, InMemory
- CredentialInjector::is_secret_allowed() uses case-insensitive
comparison
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix: persist model name to .env so dotted names survive restart (#400)
The setup wizard saved selected_model to the DB but not to .env.
Since Config::from_env_with_toml() runs before the DB connects, the
model name was lost on restart -- backends fell back to hardcoded
defaults, truncating names like "llama3.2" to "llama3".
- Add LlmBackend::model_env_var() as single source of truth for the
backend-to-env-var mapping
- Write the model env var in write_bootstrap_env() using the new method
- Add selected_model fallback to all 6 backends (was missing from
OpenAI, Anthropic, Ollama, and Tinfoil)
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor: extract resolve_model() helper to reduce duplication
Address review feedback: the env → settings → default model resolution
pattern was repeated across all 6 backends. Centralise it in a single
LlmConfig::resolve_model() helper.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix(setup): check cloudflared binary and validate tunnel token (#418)
The Cloudflare tunnel setup accepted tokens blindly without checking if
cloudflared was installed or if the token was valid. Now:
- Checks for cloudflared on PATH before accepting a token, with install
instructions if missing (user can continue anyway)
- Validates token format (base64-decoded JSON with account/tunnel fields)
with a warning if malformed (user can override)
- Replaces misleading "will start automatically at boot" with honest
instructions for starting the tunnel and installing as a service
- Reuses binary_exists() from skills::gating (promoted to pub(crate))
for cross-platform PATH lookup
Closes#418
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: reuse cloudflared_found instead of redundant binary_exists call
Address review feedback: the binary check result was already stored
in cloudflared_found from earlier in the function.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix(setup): validate PostgreSQL version and pgvector before migrations
The setup wizard accepted any DATABASE_URL without checking the server
version or pgvector availability. Users who installed PostgreSQL 14
(or any version < 15) got opaque migration failures. Users without
pgvector installed hit CREATE EXTENSION errors at runtime.
After a successful connection, the wizard now:
1. Queries SHOW server_version and rejects versions below 15
2. Checks pg_available_extensions for the vector extension
Both checks provide actionable error messages with platform-specific
install guidance.
Closes#415Closes#416
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor: extract version constant, fix hex escapes in pgvector message
- Extract MIN_PG_MAJOR_VERSION constant to avoid magic number
- Replace \x20 hex escapes with regular spaces in install guidance
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix(setup): use detected PG version in pgvector install instructions
The pgvector install hints were hardcoded for PG 16. Since we already
parse major_version from SHOW server_version, use it dynamically so
users on PG 15 or 17 get correct package names.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix: guard zsh compdef call to prevent error before compinit
The generated ironclaw.zsh completions file calls compdef without
checking if it exists. Users who source this file before compinit
runs in their .zshrc get "compdef: command not found" on every
terminal open.
Wrap the call with the standard (( $+functions[compdef] )) guard.
Closes#420
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix(completions): apply compdef guard during zsh generation
Instead of hand-patching the generated ironclaw.zsh file (which is
fragile and lost on regeneration), patch the compdef call in the
generation code itself. The Zsh output is post-processed to wrap
`compdef _ironclaw ironclaw` with a `$+functions[compdef]` guard.
Regenerated ironclaw.zsh from the patched code to stay in sync.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* feat(cli): add `tool setup` command + GitHub setup schema
- Add `ironclaw tool setup <name>` CLI command that reads
`setup.required_secrets` from a tool's capabilities file and
prompts the user for each secret, saving them to the encrypted
secrets store. Handles already-configured secrets (ask to replace),
optional secrets (skip on empty), and hidden input.
- Add `setup.required_secrets` to GitHub tool capabilities file
with `github_token` — the only WASM tool that was missing it
after PR #437 added setup schemas to all other tools.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* refactor(cli): extract init_secrets_store helper + add tool name validation
Address PR review feedback:
- Extract duplicated secrets store initialization (~50 lines) from
auth_tool and setup_tool into shared init_secrets_store() helper
- Add validate_tool_name() to reject path traversal in tool names
(applies to both auth_tool and setup_tool)
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
