* feat: add LLM_CHEAP_MODEL for generic smart routing across all backends
Add generic cheap model support that works with any LLM backend, not just
NearAI. New env vars: LLM_CHEAP_MODEL (cheap model for any backend) and
SMART_ROUTING_CASCADE (top-level cascade flag).
Resolution order: LLM_CHEAP_MODEL > NEARAI_CHEAP_MODEL (backward compat).
Registry-based providers (OpenAI, Anthropic, Groq, etc.) clone their
RegistryProviderConfig with the cheap model swapped in. Bedrock returns
an explicit error (not yet supported). All error paths use ok_or_else
with proper LlmError variants -- no unwrap/expect in production code.
* refactor: address Gemini review — remove unnecessary async, extract cheap_model_name()
- Remove async from create_cheap_provider_for_backend() and
create_cheap_llm_provider() — neither contains .await calls
- Extract duplicated cheap model resolution logic into
LlmConfig::cheap_model_name() helper method (DRY)
- Revert tests from tokio::test async back to sync #[test]
- Add test_cheap_model_name_resolution() unit test for the helper
---------
Co-authored-by: SMKRV <[email protected]>
* feat(orchestrator): read ORCHESTRATOR_PORT env var for configurable API port
The orchestrator internal API port was hardcoded to 50051 in two places
(ContainerJobConfig and OrchestratorApi::start call), making it impossible
to run multiple IronClaw instances on the same host — the second instance
fails with "Address already in use".
NETWORK_SECURITY.md already documents ORCHESTRATOR_PORT as configurable,
and ContainerJobConfig.orchestrator_port is propagated to worker containers
via IRONCLAW_ORCHESTRATOR_URL, but the env var was never actually read.
Extract resolve_orchestrator_port() that reads ORCHESTRATOR_PORT and falls
back to 50051. Includes tests for valid, invalid, and out-of-range values.
* test: add ENV_LOCK mutex for env-var test serialization
Address Gemini review: add std::sync::Mutex to serialize env var access
across test threads. Keep unsafe blocks — required in Rust edition 2024
where std::env::set_var/remove_var are unsafe functions.
---------
Co-authored-by: SMKRV <[email protected]>
* feat(transcription): add Chat Completions API provider for audio transcription
The existing transcription pipeline only supports the OpenAI Whisper API
(/v1/audio/transcriptions with multipart upload). Providers like OpenRouter
expose audio transcription through the Chat Completions API instead, using
base64-encoded audio in the `input_audio` content type.
Add `ChatCompletionsTranscriptionProvider` that sends audio as base64 in
a chat completion request and extracts the transcript from the response.
Compatible with OpenRouter, OpenAI GPT-4o-audio, and any provider that
supports audio input via Chat Completions.
Config changes:
- TRANSCRIPTION_PROVIDER=chat_completions selects the new provider
- TRANSCRIPTION_API_KEY overrides provider-specific keys
- LLM_API_KEY used as fallback for chat_completions provider
- Default model per provider (whisper-1 for openai, gemini-2.0-flash for
chat_completions)
* style: address review feedback — formatting, idiomatic patterns
- Fix rustfmt formatting for provider constructor chain
- Use or_else for resolve_api_key priority chain (Gemini review)
- Use trim_end_matches('/') instead of while loop (Gemini review)
---------
Co-authored-by: SMKRV <[email protected]>
* feat: add Criterion benchmarks for safety layer hot paths
Add benchmark suite using Criterion.rs for performance-critical paths:
- benches/safety_check.rs: Sanitizer (clean/adversarial), Validator
(normal/long/tool params), LeakDetector (clean/secrets/HTTP scan)
- benches/tool_dispatch.rs: JSON parsing, schema validation patterns,
tool output serialization
CI compiles benchmarks on every PR to prevent regressions.
Run locally with: cargo bench
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: add bench-compile to CI roll-up job
Include bench-compile in the run-tests roll-up job's needs array
so benchmark compilation failures block PRs.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: add black_box to benchmarks, use real SafetyLayer pipeline
- Wrap all benchmark inputs in criterion::black_box to prevent
compiler optimization from skewing results
- Replace generic JSON benchmarks in tool_dispatch.rs with actual
SafetyLayer pipeline benchmarks (sanitize_tool_output, wrap_for_llm,
scan_inbound_for_secrets)
- Keep JSON parsing benchmarks for tool parameter overhead measurement
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: apply cargo fmt to benchmark files
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: copy benches/ in Dockerfile to fix manifest parse error
Cargo.toml references [[bench]] targets that must exist for manifest
parsing to succeed. Add COPY benches/ to the Docker build stage.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* chore: re-trigger CI after adding skip-regression-check label
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: address PR review comments on criterion benchmarks
- Move header string allocations outside b.iter() closure in
http_request_scan to avoid measuring allocation overhead
- Add .unwrap() to serde_json::from_str results in JSON parsing
benchmarks to catch invalid JSON instead of silently benchmarking
error construction
- Add comment explaining why benches/ COPY is needed in Dockerfile
([[bench]] entries require source files for cargo manifest parsing)
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* chore: update Cargo.lock with criterion dependencies
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix(bench): build secret-like strings at runtime to avoid CI secret scanners
Construct AWS key and GitHub token patterns via format!() concatenation
so the literal strings don't appear in source and trigger push protection
or secret scanning in CI pipelines. The resulting strings still match
LeakDetector patterns for valid benchmarking.
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: rename tool_dispatch bench, drop async_tokio, replace JSON benchmarks
1. Rename `tool_dispatch.rs` → `safety_pipeline.rs` to match actual
content (SafetyLayer pipeline benchmarks).
2. Drop unused `async_tokio` feature from criterion dependency.
3. Replace serde_json::from_str benchmarks (third-party only) with
Validator::validate_tool_params exercising IronClaw's recursive
validation on simple, complex, and deeply nested JSON inputs.
4. Add `--all-features` to CI bench-compile to match clippy/test
convention and verify both DB backends.
Addresses zmanian's review feedback on PR #836.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix: eliminate panic paths in production code and document infallible operations
PolicyRule::new() now returns Result instead of panicking on invalid
caller-supplied regex. CreateJobTool returns ToolError when job_manager
is unconfigured instead of panicking. Remaining infallible unwrap/expect
calls (hardcoded regexes, compile-time constants, guarded accesses)
are annotated with SAFETY comments. Where possible, unwraps are replaced
with safer patterns: split_last(), if-let, match-destructure, and
reusing peek() values.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix: use inline lowercase safety comments to match CI pattern
The no-panics CI check greps for '// safety:' (lowercase, inline)
to suppress false positives. Switch from block SAFETY comments to
inline safety comments on the .unwrap() lines.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* test: add regression tests for panic-path fixes
- PolicyRule::new returns Err on invalid regex (not panic)
- CreateJobTool::execute_sandbox returns ToolError when job_manager is None
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix: add inline // safety: comments on all infallible unwrap/expect lines
The CI no-panics check requires '// safety:' on the same line as
unwrap()/expect() to suppress false positives. Move safety annotations
from block comments to inline comments on every infallible production
unwrap/expect across all touched files.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* chore: trigger CI with skip-regression-check label
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* refactor: remove redundant block-level SAFETY comments
Each unwrap/expect now carries its own inline // safety: annotation,
making the standalone block comments above them redundant.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
* fix(llm): add stop_sequences parity for tool completions
* refactor(web-openai): dedupe request builders and satisfy no-panics gate
* test(llm): mark multiline assert with safety comment for CI gate
* test(llm): make safety-marked assert formatting-stable
Python bytecode cache files were accidentally committed. Remove them
from tracking and prevent future occurrences via .gitignore.
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
Implement industry-standard HMAC-SHA256 header-based webhook authentication
to resolve issue #722. The X-Hub-Signature-256 header follows GitHub's
webhook security model, replacing the non-standard X-IronClaw-Signature header.
**Changes:**
- Rename HTTP webhook signature header from X-IronClaw-Signature to X-Hub-Signature-256
- X-Hub-Signature-256 is the standard used by GitHub, Stripe, and other webhook providers
- HMAC-SHA256 signatures continue to use sha256=<hex> format
- Body 'secret' field remains supported as deprecated fallback for backward compatibility
- All error messages and documentation updated to reflect new header name
**Security impact:**
- Signatures verified via HTTP header instead of request body
- Signature visible in Authorization header only, not logged in request body
- Follows industry best practices for webhook authentication
- Fail-closed policy: rejects requests without authentication
**Backward compatibility:**
- Requests without X-Hub-Signature-256 header fall back to 'secret' field in body (with deprecation warning)
- Deprecation path: migrate to header-based auth, body field support will be removed in a future release
**Test coverage:**
Unit tests (20 tests in src/channels/http.rs):
- 6 header-based auth tests (valid/invalid/malformed signatures, header encoding)
- 2 backward compatibility tests (deprecated body secret fallback)
- 3 error handling tests (missing auth, invalid JSON, content-type validation)
- 4 signature verification unit tests (valid digest, invalid digest, missing prefix, invalid hex)
- 5 advanced tests (concurrency, dynamic updates, header precedence, no deadlocks, runtime clearing)
E2E tests (12 tests in tests/e2e/scenarios/test_webhook.py):
- Valid HMAC-SHA256 signature acceptance
- Invalid/wrong/malformed signature rejection
- Header precedence over body secret
- Deprecated body secret backward compatibility
- Missing auth rejection (fail-closed)
- Content-Type validation
- Invalid JSON handling
- Case-insensitive header lookup
- Message queuing and processing
- Fixture for running server with HTTP_WEBHOOK_SECRET configured
All 3,033 lib tests pass with zero clippy warnings.
**Example usage after fix:**
BODY='{"content": "hello"}'
SECRET="your-webhook-secret"
SIG=$(echo -n "$BODY" | openssl dgst -sha256 -hmac "$SECRET" | sed 's/^.* //')
curl -X POST http://127.0.0.1:9090/webhook \
-H "Content-Type: application/json" \
-H "X-Hub-Signature-256: sha256=$SIG" \
-d "$BODY"
Co-authored-by: Claude Haiku 4.5 <[email protected]>
* refactor(registry): move MCP server entries from code to JSON manifests
Move 8 hardcoded MCP server RegistryEntry structs from
builtin_entries() into data-driven JSON files under
registry/mcp-servers/, matching the existing pattern used by
tools and channels. Exclude the GitHub MCP entry which conflicts
with the WASM GitHub tool's OAuth flow.
Extend ManifestKind with McpServer, make version/source optional
on ExtensionManifest (MCP servers don't need them), and add
url/auth fields for MCP-specific config. Update build.rs,
embedded catalog, catalog loader, installer, and CLI display
to handle the new kind and optional fields.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix(registry): address PR review — add missing slack-mcp, remove .expect(), fix fmt
- Add missing slack-mcp.json (was dropped during migration)
- Remove production .expect() in get_strict(), replace with .ok_or_else()
- Clean up unwrap_or_default() in key_for() to use .next() directly
- Log warning for MCP manifests missing url field instead of silent empty
- Run cargo fmt to fix formatting diffs
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* ci: re-trigger CI with correct base branch (staging)
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix(ci): improve no-panics check to properly exclude test modules
The grep-based filter only excluded lines literally containing
#[cfg(test)], #[test], or 'mod tests' — not lines *inside* test
modules. Use awk to track hunk context from diff @@ headers and
skip all added lines within test module hunks.
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* refactor(registry): remove slack-mcp MCP entry (conflicts with WASM slack tool)
Remove slack-mcp.json alongside the already-excluded github MCP
entry — both conflict with existing WASM tools of the same name.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix(registry): address re-review — skip invalid MCP entries, fix install order
- to_registry_entry() now returns Option<RegistryEntry>; MCP manifests
missing a url field are skipped with a warning instead of creating
broken entries with empty URLs
- Move McpServer early-return before require_source() in install paths
so the error message is clear ("cannot install MCP servers") rather
than the misleading "missing source spec"
- Add test for MCP manifest with missing URL returning None
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
* feat(web): add follow-up suggestion chips and ghost text to chat UI
The LLM now always generates 1-3 follow-up command suggestions via
<suggestions> tags in its response. These are extracted server-side,
broadcast as SSE events, and rendered as clickable chips above the
chat input. The first suggestion also appears as ghost text in the
input field (Tab to accept). Includes debug logging for LLM responses
in the agentic loop and removes noisy NEAR AI status logging.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix: resolve deferred review items from PR #1156 [skip-regression-check]
- Remove literal backslashes from raw string prompt (reasoning.rs)
- Make WASM channels skip Suggestions status (no-op instead of empty callback)
- Add !e.shiftKey guard to Tab-to-accept ghost text handler
- Cap extracted suggestions at 3 and trim whitespace-only entries
- Extract suggestions in approval-resume path (prevents tag leaking)
- Remove stale .has-ghost class during showSuggestionChips reset
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
* fix(mcp): address 14 audit findings across MCP module
- Replace panicking assert! in new_with_config with Result return (Critical)
- Fix initialize() race condition using tokio::sync::OnceCell (High)
- Fix localhost check bypass via proper URL parsing (High)
- Extract shared stream_transport_send() to deduplicate stdio/unix send logic
- Use atomic write (tmp+rename) for config file persistence
- Filter SSE responses by request_id to prevent wrong-response dispatch
- Share a single reqwest::Client for OAuth via fallible OnceLock
- Log notification send errors instead of silently discarding
- Fix unwrap_or(0) that could steal id=0 responses
- Store InitializeResult in OnceCell so callers can access server capabilities
- Add redirect logging in OAuth discovery
- Reuse is_localhost_url() in auth.rs
- Add McpToolWrapper unit tests and regression tests
- URL-encode PKCE challenge for consistency
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* chore: retrigger CI with skip-regression-check label
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix(http): replace .expect() with match in webhook handler
Replace `.expect("checked is_none above")` with a proper `match` on
`webhook_secret.as_ref()`. The is_none-then-expect pattern was logically
safe but violates the project rule against .expect() in production code.
Update pre-existing test to expect SERVICE_UNAVAILABLE (503) instead of
UNAUTHORIZED (401) when the secret is cleared, since the None check now
returns early before signature verification.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix(ci): formatting + suppress no-panics false positive in test
- Collapse multi-line Some() to single line per rustfmt
- Add // safety: comment on test assert_eq to suppress CI grep
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
LLMs sometimes pass "" for optional parameters instead of omitting
them. Previously, passing timezone: "" or from_timezone: "" to the
time tool would trigger a parse error ("Unknown timezone ''") rather
than falling back to the context timezone or UTC.
Fix by adding .filter(|s| !s.is_empty()) after .as_str() in
resolve_timezone_for_output and optional_timezone, so empty strings
are treated the same as a missing field.
The same pattern exists in routine.rs (cron trigger timezone and
schedule fields), where "" produces "invalid IANA timezone: ''" or a
cron parse error. That will be addressed separately once routine.rs
has a test harness in place.
Regression tests added for the now and convert operations with
empty timezone strings.
Closes#1127
Add a diff-based CI job and pre-commit hook check that block
panic-inducing calls (.unwrap(), .expect(), assert!, assert_eq!,
assert_ne!) from entering production Rust code. debug_assert is
excluded (compiled out in release). False positives can be suppressed
with an inline `// safety: <reason>` comment.
- pre-commit-safety.sh: add check 6 (PANIC) for staged diffs
- code_style.yml: add `no-panics` job, wire into roll-up gate
- check-boundaries.sh: extend check 2 to also catch assert!()
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix: address 5 critical and high-priority bugs from issue tracker
- #1033: reject webhook requests when secret is cleared at runtime via
update_secret(None), preventing auth bypass through SIGHUP hot-swap
- #908: reset consecutive_failures counter on successful SSE stream
reconnection in relay channel, so circuit breaker counts truly
consecutive failures
- #975: add depth limit (16) to validate_tool_schema() to prevent
stack overflow on deeply nested schemas
- #974: add depth limit (8) to resolve_nested() to prevent stack
overflow on deeply nested capabilities wrappers
- #826: truncate oversized tool outputs (>8KB) in routine lightweight
loop to prevent unbounded context growth across iterations
Each fix includes a regression test.
Closes#1033, #908, #975, #974, #826
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: 5 more high-priority bugs (routine cache, job signals, input limits)
- #1077: recompute next_fire_at when re-enabling cron routines via web
toggle, mirroring CLI behavior so cron ticker picks them up
- #1076: refresh event trigger cache after web toggle/delete operations
so event/system_event routines reflect changes immediately
- #892: remove Stuck from check_signals() stop-states in JobDelegate
since Stuck is recoverable (Stuck -> InProgress via self-repair)
- #976: truncate oversized description strings in CapabilitiesFile to
4KB to prevent memory abuse from malicious capabilities files
- #977: drop oversized parameters schema JSON (>64KB) in
CapabilitiesFile to prevent unbounded memory growth
Each fix includes regression tests where applicable.
Closes#1077, #1076, #892, #976, #977
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: prevent ReDoS in event trigger regex patterns
- #825: use RegexBuilder with 64KB size limit when compiling
user-supplied event trigger patterns, both at creation time
(routine tool) and at cache refresh (routine engine)
Note: Rust's regex crate already guarantees O(n) matching, so the
size limit prevents excessive memory use during compilation rather
than catastrophic backtracking at match time.
Closes#825
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* Harden HTTP SSRF IP filtering
* Apply rustfmt after staging merge
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
