When a tunnel provider (ngrok, cloudflare, tailscale, etc.) or static
TUNNEL_URL is configured, external traffic arrives through the tunnel,
so binding 0.0.0.0 is unnecessary attack surface. The webhook server
now defaults to 127.0.0.1 when a tunnel is active. Explicit HTTP_HOST
still overrides the default in all cases.
Co-authored-by: Claude Opus 4.6 <[email protected]>
ChannelsConfig::resolve() ignored most ChannelSettings fields, reading
exclusively from env vars. This made `config set` ineffective for gateway,
HTTP, CLI, and WASM channel settings — a prerequisite blocker for #86
(hot-reload) and CLI management commands.
- Add gateway and CLI fields to ChannelSettings with correct defaults
- Rewrite resolve() to fall back to settings when env var is unset
- Keep strict boolean validation via parse_bool_env for all bool fields
- Fix GATEWAY_PORT default divergence (3001 -> 3000) in extension manager
- Export DEFAULT_GATEWAY_PORT constant as single source of truth
- Add 8 tests: settings fallback, env override, DB roundtrip, invalid bool rejection
Part of #1119 (Phase 1: Channels pilot)
[skip-regression-check]
* test: add unit tests across 20 modules for coverage push
Add 300+ unit tests covering config, context, evaluation, extensions,
LLM, secrets, tools/builder, and tools/mcp modules. All tests are
pure unit tests (no mocks) exercising serde roundtrips, edge cases,
error paths, and business logic.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix(tests): replace hardcoded /tmp paths with tempfile::tempdir
The e2e_metrics_test::test_metrics_collected_from_tool_trace test was
failing because setup_test_dir() created /tmp/ironclaw_metrics_test but
the fixture referenced /tmp/ironclaw_e2e_test/hello.txt (path mismatch).
Added LlmTrace::replace_paths() to substitute fixture paths at runtime,
then converted all 12 test files from hardcoded /tmp/ironclaw_* paths to
tempfile::tempdir(). Tests are now isolated, parallel-safe, and leave no
debris on disk.
Regression test: test_metrics_collected_from_tool_trace now passes
consistently regardless of prior /tmp state.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* refactor: remove restart infrastructure and generalize Telegram-specific code
Remove the gateway restart mechanism (hot-activation works, restart won't
fix activation failures) and generalize Telegram-specific hardcoded checks
so all WASM channels get equal treatment.
Part 1 - Remove restart infrastructure:
- Remove needs_restart from ActionResponse, restart_requested from GatewayState
- Remove gateway_restart_handler, /api/gateway/restart route, exit code 75
- Remove restart overlay JS/CSS (dead code - restartGateway() never called)
- Surface actual activation errors instead of suggesting restart
Part 2 - Generalize Telegram-specific code:
- Replace telegram_owner_id: Option<i64> with generic
wasm_channel_owner_ids: HashMap<String, i64> (backwards-compatible
via TELEGRAM_OWNER_ID env var)
- Pairing status check now applies to all active WASM channels
- All channels get 3-step stepper in web UI, remove "coming soon" note
- Remove dead setup_telegram() code (~700 lines) - Telegram's
capabilities.json declares required_secrets, so the generic
setup_wasm_channel() path handles it
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* test: add Settings::set() test for wasm_channel_owner_ids
Addresses review feedback: verify that setting per-channel owner IDs
via the dotted-path Settings::set() API works correctly with the new
HashMap<String, i64> type.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix(web): refresh extension stepper after pairing approval
loadPairingRequests only refreshed the pairing section, not the
stepper status. Call loadExtensions() instead so the stepper updates
from "Awaiting Pairing" to "Active" immediately after approval.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
* feat(channels): add native Signal channel via signal-cli HTTP daemon
Implement a native Rust Signal channel that connects to a running
signal-cli daemon's HTTP endpoint, enabling Signal messaging without
WASM overhead.
Architecture:
- SSE listener at /api/v1/events for receiving messages with automatic
reconnection and exponential backoff
- JSON-RPC client at /api/v1/rpc for sending messages and typing
indicators
- Reply target tracking via Arc<RwLock<HashMap>> to route responses
back to the correct DM or group conversation
Features:
- User allowlisting supporting E.164 phone numbers, bare UUIDs, and
uuid:-prefixed identifiers (matching OpenClaw's format)
- Group allowlisting with wildcard (*) support
- Configurable story and attachment-only message filtering
- Health check via signal-cli /api/v1/check
- Broadcast support to all tracked reply targets
Configuration via environment variables:
- SIGNAL_HTTP_URL, SIGNAL_ACCOUNT (required)
- SIGNAL_ALLOWED_USERS, SIGNAL_ALLOWED_GROUPS
- SIGNAL_IGNORE_ATTACHMENTS (default: false)
- SIGNAL_IGNORE_STORIES (default: true)
Includes unit tests covering allowlist logic, envelope parsing,
recipient targeting, SSE deserialization, and edge cases.
* refactor(signal): remove expect|unwrap calls
- Change SignalChannel::new to return Result<Self, ChannelError>
- Replace .expect() on reqwest client build with proper error handling
- Replace .expect() on NonZeroUsize with compile-time const using unsafe new_unchecked
- Propagate errors through test helpers to avoid unwraps in tests
* fix(signal): prevent OOM from chunked response without Content-Length
Use bytes_stream() to check response size during download rather than
buffering entire body first. This closes the OOM vector where a
malicious signal-cli daemon could send unbounded chunked data.
* fix(signal): align is_e164 minimum digits with setup wizard
Both now require 7-15 digits after '+', preventing environment
variable bypass of the stricter onboarding validation.
* refactor(signal): extract from_parts constructor
Extract SignalChannel::from_parts() used by both new() and
sse_listener() to ensure consistent object construction.
* chore: remove redundant unused var
* refactor(signal): rename allowed_users to allow_from and add dm_policy/group_policy
- Rename allowed_users -> allow_from for consistency with other channels
- Rename allowed_groups -> allow_from_groups
- Add dm_policy field: 'open', 'allowlist', or 'pairing' (default: 'pairing')
- Add group_policy field: 'allowlist', 'open', or 'disabled' (default: 'allowlist')
- Add group_allow_from field that inherits from allow_from if empty
- Implement dm_policy and group_policy logic in message processing
- Add environment variable resolution: SIGNAL_ALLOW_FROM, SIGNAL_ALLOW_FROM_GROUPS,
SIGNAL_DM_POLICY, SIGNAL_GROUP_POLICY, SIGNAL_GROUP_ALLOW_FROM
- Add setup wizard prompts for new policy options
- Note: full pairing flow (PairingStore integration) marked as pending for future PR
* feat(signal): implement DM pairing workflow for unapproved senders
- Add PairingStore integration to check approved senders
- Handle pairing requests for unknown senders with dm_policy=pairing
- Send pairing reply message with approval instructions
- Update FEATURE_PARITY.md to reflect DM pairing support
* chore(ci): fix clippy warnings
* refactor: simplify config resolution and consolidate main.rs init into AppBuilder
- Add parse_bool_env() and parse_string_env() helpers to eliminate repetitive
5-line optional_env/parse/map_err/unwrap_or boilerplate across 12 config files
- Add EmbeddingsConfig::create_provider() to centralize embeddings construction
(fixes hardcoded 1536 dimensions and missing Ollama provider in app.rs)
- Extract init_cli_tracing(), setup_wasm_channels(), start_tunnel(),
run_memory_command(), run_worker(), run_claude_bridge() from main.rs
- Replace ~600 lines of inline init in main.rs with AppBuilder::build_all()
- Expose catalog_entries from AppComponents for gateway registry entries
- Net reduction: ~738 lines across 15 files
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: propagate dev_loaded_tool_names from AppBuilder and add parse_option_env helper
Address PR review feedback:
- Capture dev_loaded_tool_names from WASM loading in init_extensions()
and expose via AppComponents so bootstrap_hooks receives the actual
dev tool names instead of an empty slice (fixes silent hook skip)
- Add parse_option_env<T>() helper for Option<T> config fields,
simplifying max_cost_per_day_cents and max_actions_per_hour in agent.rs
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: fetch real NEAR AI pricing and unify cost calculation path
CostGuard was independently looking up pricing via costs::model_cost(),
falling back to GPT-4o default rates when NEAR AI model names didn't
match the static table — causing ~3x cost overestimates in logs.
- Add pricing map to NearAiChatProvider that fetches real rates from
/v1/model/list at startup (background, non-blocking)
- Update cost_per_token() to check fetched pricing first, then static
table, then default
- Add cost_per_token parameter to CostGuard::record_llm_call() so the
dispatcher passes provider-sourced rates directly
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* chore: update default NEAR AI model to GLM-latest
Replace fireworks llama4-maverick-instruct-basic with zai-org/GLM-latest
as the default model in config and setup wizard.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: align wizard default model name with config
Change "zai/GLM-latest" to "zai-org/GLM-latest" in wizard.rs to match
the default in config/llm.rs.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* refactor: split large files and consolidate test stubs for contributor velocity
- Extract 7 Database sub-traits (ConversationStore, JobStore, SandboxStore,
RoutineStore, ToolFailureStore, SettingsStore, WorkspaceStore) with Database
as a supertrait combining them all
- Split libsql_backend.rs (2769 lines) into src/db/libsql/ directory with
one file per sub-trait implementation
- Split config.rs (1753 lines) into src/config/ directory with 16 domain files
- Consolidate 3 duplicate test LLM stubs into shared StubLlm in src/testing.rs
- Split server.rs handlers into src/channels/web/handlers/ directory
- Extract main.rs init phases into AppBuilder (src/app.rs)
- Add developer setup script (scripts/dev-setup.sh)
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor: move heartbeat test from examples/ to tests/
Convert standalone example binary into a proper #[ignore] integration
test, matching the convention of the other integration tests.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: fix rustfmt formatting for CI
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: address PR review comments from Copilot
- tunnel.rs: replace .ok().flatten() with ? to propagate env var errors
- secrets.rs: remove misleading "process-wide cache" comment
- database.rs: use uppercase "DATABASE_URL" in error key
- testing.rs: gate harness tests with #[cfg(feature = "libsql")]
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Illia Polosukhin <[email protected]>
Co-authored-by: Claude Opus 4.6 <[email protected]>
