* fix: prevent concurrent memory hygiene passes and Windows file lock errors (#495)
The heartbeat system spawns hygiene passes via tokio::spawn on every
tick, creating a TOCTOU race where multiple tasks read the state file
before any saves, causing all to execute concurrently. On Windows this
also triggers OS error 1224 (file locked by memory-mapped section)
when multiple tasks call std::fs::write on the same file.
Three fixes:
- AtomicBool guard (RUNNING + RunningGuard RAII) ensures only one
hygiene pass runs at a time
- State file is saved before cleanup (not after) to claim the cadence
window early and close the TOCTOU race
- Atomic file write (write to .tmp then rename) avoids Windows
file-locking errors from concurrent writers
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: add Mutex to serialize tests touching global RUNNING AtomicBool
Address PR review feedback: the running_guard_prevents_reentry test
manipulates a global static AtomicBool, which could cause flaky
failures if future tests also touch it and run in parallel. A test-only
Mutex ensures serialization.
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix: sort tool_definitions() for deterministic LLM tool ordering
HashMap iteration order is non-deterministic, causing the LLM to receive
tools in different orders across calls. Sort alphabetically by name to
eliminate position bias in tool selection.
Closes#566
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* refactor: use sort_unstable_by for tool definitions ordering
Stable sort is unnecessary since tool names are unique. Unstable sort
avoids the overhead of preserving equal-element order.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix: repair bad merge in registry.rs (missing closing brace and test attribute)
The merge of main into fix/sort-tool-definitions dropped the closing `}`
of test_tool_definitions_sorted_alphabetically and the `#[tokio::test]`
attribute on test_retain_only_filters_tools, causing an unclosed delimiter
parse error that failed all CI jobs.
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
* feat: merge http/web_fetch tools, add tool output stash for large responses
Merge `web_fetch` into `http` tool with smart approval: plain GETs (no
headers, no body) run without approval and follow redirects with SSRF
re-validation per hop; all other requests require approval as before.
Add `tool_output_stash` on JobContext so full tool outputs are preserved
before safety-layer truncation. The `json` tool gains a
`source_tool_call_id` parameter to reference stashed outputs, enabling
reliable parsing of large API responses that exceed the 100KB context
limit.
Other improvements:
- Descriptive User-Agent header using CARGO_PKG_VERSION
- Truncation now keeps partial data + hint about source_tool_call_id
- System prompt reinforces tool_calls over narration
- json tool query/stringify handle pre-parsed (non-string) data
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* chore: delete dead web_fetch.rs (merged into http tool)
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: fix rustfmt formatting
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: rename shadowed data binding for clarity in json tool
Address PR review: rename owned `data` to `data_value` before
re-binding as `let data = &data_value` to make ownership explicit.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix(ci): mark network-dependent trace tests as #[ignore]
The weather_sf and baseball_stats tests hit live external APIs (wttr.in,
ESPN) which are unreliable in CI. Mark them #[ignore] so they don't
block the pipeline. Run locally with `--ignored` to include them.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: replay recorded HTTP exchanges in trace tests instead of hitting live APIs
Wire ReplayingHttpInterceptor into TestRig when the trace fixture
contains http_exchanges. This replays recorded responses instead of
making live network calls, making tests deterministic and CI-stable.
Add captured HTTP responses to weather_sf.json (wttr.in) and
baseball_stats.json (ESPN API) fixtures.
Revert #[ignore] on both tests — they now run offline.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: recover inline bracket-format tool calls from LLM text responses
When flatten_tool_messages converts tool calls to text like
`[Called tool `http` with arguments: {...}]` for NEAR AI compatibility,
the LLM sometimes echoes this format back in its text responses instead
of using proper tool_calls. Add recovery for this bracket format in
recover_tool_calls_from_content and strip it in clean_response so
users don't see raw tool call syntax.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* feat(llm): add smart model routing based on request complexity
Automatically selects optimal model tier (flash/standard/pro/frontier) for each
request based on 13-dimension complexity scoring:
- Reasoning words, multi-step signals, code indicators
- Domain-specific terms, creativity, precision
- Safety sensitivity, tool likelihood, question complexity
- Token estimate, context dependency, sentence complexity
Features:
- Pattern overrides for fast-path routing (greetings → flash, security audits → frontier)
- Configurable tier-to-model mappings (defaults to -latest aliases)
- Thinking mode per tier (pro: low, frontier: medium)
- User-configurable pattern overrides
- Zero-config for default benefits, full control for power users
Expected cost savings: 50-70% vs always-using-frontier baseline.
Refs: smart-routing-spec.md
* fix(routing): address Gemini Code Assist review feedback
- Add tracing warnings for invalid tier/regex in user overrides (router.rs)
- Use unreachable!() for tier hint match since regex enforces valid tiers (scorer.rs)
- Refactor weighted total to array iteration for maintainability (scorer.rs)
- Add TODO for making domain keywords configurable (scorer.rs)
Refs: PR #208
* feat(routing): make domain keywords configurable
- Add ScorerConfig with optional domain_keywords field
- Add DEFAULT_DOMAIN_KEYWORDS constant (exported for reference)
- Add domain_keywords to RouterConfig for top-level configuration
- Build domain regex at runtime from config, fallback to defaults
- Add score_complexity_with_config() function
- Add test for custom domain keywords
Users can now provide project-specific keywords:
RouterConfig {
domain_keywords: Some(vec!["mycompany".into(), "myproduct".into()]),
..Default::default()
}
Addresses Gemini Code Assist review feedback on PR #208.
Tests: 20/20 passing
* docs: add domain_keywords to routing config example
* feat: integrate 13-dimension complexity scorer into smart routing (takeover #208)
Folds the 13-dimension complexity scorer and pattern overrides from PR #208
into the existing SmartRoutingProvider, replacing the simpler keyword-based
classifier. Adds 4-tier system (Flash/Standard/Pro/Frontier), configurable
scorer weights, domain keywords, regex pattern overrides, tier hints, and
multi-dimensional boost. Removes separate routing/ directory and lazy_static
dependency in favor of std::sync::LazyLock. Includes 44 tests covering all
scoring dimensions, tier boundaries, pattern overrides, and provider routing.
Co-Authored-By: onlyamicrowave <[email protected]>
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: address review feedback on smart routing PR (#529)
- Cache compiled domain regex in SmartRoutingProvider (built once at
construction, not per-request) and add score_complexity_with_regex() API
- Check explicit tier hints before pattern overrides so user intent wins
(e.g. "[tier:flash] security audit" routes as Flash, not Frontier)
- Trim input before matching/scoring so trailing whitespace doesn't break
anchored override regexes or skew token-length scoring
- Fix token estimate comment (>=520 chars = 100, not >500)
- Update spec: check implementation plan boxes, fix file paths, add note
that llm.routing YAML schema is target design (current config uses env vars)
- Add regression tests for tier hint precedence and trimmed greeting matching
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: restore Cargo.lock from main to fix html_to_markdown test
The lockfile was fully regenerated during the PR #208 merge conflict
resolution, which bumped html-to-markdown-rs from 2.25.1 to 2.27.2.
The new version produces different output that breaks the golden-file
snapshot test. Restore the original lockfile from main — lazy_static
was never in main's lockfile, so no further changes needed.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: address second round of review feedback (#529)
- Tighten quick-lookup override regex with end anchor to prevent matching
complex questions like "What time complexity is merge sort?"
- Handle empty domain keywords list by falling back to defaults instead of
producing a broken regex that matches empty strings everywhere
- Clarify spec architecture diagram: current impl uses 2-provider split
(cheap/primary), per-tier model mapping is target design
- Add regression tests for both fixes
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Microwave <[email protected]>
Co-authored-by: Joe <[email protected]>
Co-authored-by: onlyamicrowave <[email protected]>
Co-authored-by: Claude Opus 4.6 <[email protected]>
* refactor: extract shared assertion helpers to support/assertions.rs
Move 5 assertion helpers from e2e_spot_checks.rs to a shared module.
Add assert_all_tools_succeeded and assert_tool_succeeded for eliminating
false positives in E2E tests.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat: add tool output capture via tool_results() accessor
Extract (name, preview) from ToolResult status events in TestChannel
and TestRig, enabling content assertions on tool outputs.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: correct tool parameters in 3 broken trace fixtures
- tool_time.json: add missing "operation": "now" for time tool
- robust_correct_tool.json: same fix
- memory_full_cycle.json: change "path" to "target" for memory_write
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: add tool success and output assertions to eliminate false positives
Every E2E test that exercises tools now calls assert_all_tools_succeeded.
Added tool output content assertions where tool results are predictable
(time year, read_file content, memory_read content).
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat: capture per-tool timing from ToolStarted/ToolCompleted events
Record Instant on ToolStarted and compute elapsed duration on
ToolCompleted, wiring real timing data into collect_metrics() instead
of hardcoded zeros.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor: add RAII CleanupGuard for temp file/dir cleanup in tests
Replace manual cleanup_test_dir() calls and inline remove_file() with
Drop-based CleanupGuard that ensures cleanup even if a test panics.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: add Drop impl and graceful shutdown for TestRig
Wrap agent_handle in Option so Drop can abort leaked tasks. Signal
the channel shutdown before aborting for future cooperative shutdown.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: replace agent startup sleep with oneshot ready signal
Use a oneshot channel fired in Channel::start() instead of a fixed
100ms sleep, eliminating the race condition on slow systems.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: replace fragile string-matching iteration limit with count-based detection
Use tool completion count vs max_tool_iterations instead of scanning
status messages for "iteration"/"limit" substrings.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: use assert_all_tools_succeeded for memory_full_cycle test
Remove incorrect comment about memory_tree failing with empty path
(it actually succeeds). Omit empty path from fixture and use the
standard assert_all_tools_succeeded instead of per-tool assertions.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor: promote benchmark metrics types to library code
Move TraceMetrics, ScenarioResult, RunResult, MetricDelta, and
compare_runs() from tests/support/metrics.rs to src/benchmark/metrics.rs.
Existing tests use re-export for backward compatibility.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat: add Scenario and Criterion types for agent benchmarking
Scenario defines a task with input, success criteria, and resource
limits. Criterion is an enum of programmatic checks (tool_used,
response_contains, etc.) evaluated without LLM judgment.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat: add initial benchmark scenario suite (12 scenarios across 5 categories)
Scenarios cover tool_selection, tool_chaining, error_recovery,
efficiency, and memory_operations. All loaded from JSON with
deserialization validation test.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat: add benchmark runner with BenchChannel and InstrumentedLlm
BenchChannel is a minimal Channel implementation for benchmarks.
InstrumentedLlm wraps any LlmProvider to capture per-call metrics.
Runner creates a fresh agent per scenario, evaluates success criteria,
and produces RunResult with timing, token, and cost metrics.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat: add baseline management, reports, and benchmark entry point
- baseline.rs: load/save/promote benchmark results
- report.rs: format comparison reports with regression detection
- benchmark_runner.rs: integration test with real LLM (feature-gated)
- Add benchmark feature flag to Cargo.toml
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: apply cargo fmt to benchmark module
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat(benchmark): add multi-turn scenario types with setup, judge, ResponseNotContains
Add BenchScenario, Turn, TurnAssertions, JudgeConfig, ScenarioSetup,
WorkspaceSetup, SeedDocument types for multi-turn benchmark scenarios.
Add ResponseNotContains criterion variant. Add TurnAssertions::to_criteria()
converter for backward compat with existing evaluation engine.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat(benchmark): add JSON scenario loader with recursive discovery and tag filter
Add load_bench_scenarios() for the new BenchScenario format with recursive
directory traversal and tag-based filtering. Create 4 initial trajectory
scenarios across tool-selection, multi-turn, and efficiency categories.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat(benchmark): multi-turn runner with workspace seeding and per-turn metrics
Add run_bench_scenario() that loops over BenchScenario turns, seeds workspace
documents, collects per-turn metrics (tokens, tool calls, wall time), and
evaluates per-turn assertions. Add TurnMetrics to metrics.rs and
clear_for_next_turn() to BenchChannel.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat(benchmark): add LLM-as-judge scoring with prompt formatting and score parsing
Create judge.rs with format_judge_prompt, parse_judge_score, and judge_turn.
Wire into run_bench_scenario for turns with judge config -- scores below
min_score fail the turn.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat(benchmark): add CLI subcommand (ironclaw benchmark)
Add BenchmarkCommand with --tags, --scenario, --no-judge, --timeout,
--update-baseline flags. Wire into Command enum and main.rs dispatch.
Feature-gated behind benchmark flag.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat(benchmark): per-scenario JSON output with full trajectory
Add save_scenario_results() that writes per-scenario JSON files alongside
the run summary. Each scenario gets its own file with turn_metrics trajectory.
Update CLI to use new output format.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat(benchmark): add ToolRegistry::retain_only and wire tool filtering in scenarios
Add a retain_only() method to ToolRegistry that filters tools down to a
given allowlist. Wire this into run_bench_scenario() so that when a
scenario specifies a tools list in its setup, only those tools are
available during the benchmark run. Includes two tests for the new
method: one verifying filtering works and one verifying empty input
is a no-op.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat(benchmark): wire identity overrides into workspace before agent start
Add seed_identity() helper that writes identity files (IDENTITY.md,
USER.md, etc.) into the workspace before the agent starts, so that
workspace.system_prompt() picks them up. Wire it into
run_bench_scenario() after workspace seeding. Include a test that
verifies identity files are written and readable.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat(benchmark): add --parallel and --max-cost CLI flags
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix(benchmark): use feature-conditional snapshot names for CLI help tests
Prevents snapshot conflicts between default (no benchmark) and
all-features (with benchmark) builds by using separate snapshot names
per feature set.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat(benchmark): parallel execution with JoinSet and budget cap enforcement
Replace sequential loop in run_all_bench() with parallel execution using
JoinSet + semaphore when config.parallel > 1. Add budget cap enforcement
that skips remaining scenarios when max_total_cost_usd is exceeded.
Track skipped count in RunResult.skipped_scenarios and display it in
format_report().
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat(benchmark): add tool restriction and identity override test scenarios
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* chore: fix formatting for Phase 3
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat(benchmark): add SkillRegistry::retain_only and wire skill filtering in scenarios
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat(benchmark): add --json flag for machine-readable output
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* ci: add GitHub Actions benchmark workflow (manual trigger)
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor(benchmark): remove in-tree benchmark harness, keep retain_only utilities
Move benchmark-specific code out of ironclaw in preparation for the
nearai/benchmarks trajectory adapter. This removes:
- src/benchmark/ (runner, scenarios, metrics, judge, report, etc.)
- src/cli/benchmark.rs and the Benchmark CLI subcommand
- benchmarks/ data directory (scenarios + trajectories)
- .github/workflows/benchmark.yml
- The "benchmark" Cargo feature flag
What remains:
- ToolRegistry::retain_only() and SkillRegistry::retain_only()
- Test support types (TraceMetrics, InstrumentedLlm) inlined into
tests/support/ instead of re-exporting from the deleted module
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* docs: add README for LLM trace fixture format
Documents the trajectory JSON format, response types, request hints,
directory structure, and how to write new traces.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat(test): unify trace format around turns, add multi-turn support
Introduce TraceTurn type that groups user_input with LLM response steps,
making traces self-contained conversation trajectories. Add run_trace()
to TestRig for automatic multi-turn replay. Backward-compatible: flat
"steps" JSON is deserialized as a single turn transparently.
Includes all trace fixtures (spot, coverage, advanced), plan docs, and
new e2e tests for steering, error recovery, long chains, memory, and
prompt injection resilience.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix(test): fix CI failures after merging main
- Fix tool_json fixture: use "data" parameter (not "input") to match
JsonTool schema
- Fix status_events test: remove assertion for "time" tool that isn't
in the fixture (only "echo" calls are used)
- Allow dead_code in test support metrics/instrumented_llm modules
(utilities for future benchmark tests)
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* Working on recording traces and testing them
* feat(test): add declarative expects to trace fixtures, split infra tests
Add TraceExpects struct with 9 optional assertion fields (response_contains,
tools_used, all_tools_succeeded, etc.) that can be declared in fixture JSON
instead of hand-written Rust. Add verify_expects() and run_recorded_trace()
so recorded trace tests become one-liners.
Split trace infra tests (deserialization, backward compat) into
tests/trace_format.rs which doesn't require the libsql feature gate.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor(test): add expects to all trace fixtures, simplify e2e tests
Add declarative expects blocks to all 19 trace fixture JSONs across
spot/, coverage/, advanced/, and root directories. Update all 8 e2e
test files to use verify_trace_expects() / run_and_verify_trace(),
replacing ~270 lines of hand-written assertions with fixture-driven
verification.
Tests that check things beyond expects (file content on disk, metrics,
event ordering) keep those extra assertions alongside the declarative
ones.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix(test): adapt tests to AppBuilder refactor, fix formatting
Update test files to work with refactored TestRigBuilder that uses
AppBuilder::build_all() (removing with_tools/with_workspace methods).
Update telegram_check fixture to use tool_list instead of echo.
Fix cargo fmt issues in src/llm/mod.rs and src/llm/recording.rs.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor(test): deduplicate support unit tests into single binary
Support modules (assertions, cleanup, test_channel, test_rig, trace_llm)
had #[cfg(test)] mod tests blocks that were compiled and run 12 times —
once per e2e test binary that declares `mod support;`. Extracted all 29
support unit tests into a dedicated `tests/support_unit_tests.rs` so they
run exactly once.
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: fix trailing newlines in support files
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor(test): unify trace types and fix recorded multi-turn replay
Import shared types (TraceStep, TraceResponse, TraceToolCall, RequestHint,
ExpectedToolResult, MemorySnapshotEntry, HttpExchange*) from
ironclaw::llm::recording instead of redefining them in trace_llm.rs.
Fix the flat-steps deserializer to split at UserInput boundaries into
multiple turns, instead of filtering them out and wrapping everything
into a single turn. This enables recorded multi-turn traces to be
replayed as proper multi-turn conversations via run_trace().
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix(test): fix CI failures - unused imports and missing struct fields
- Add #[allow(unused_imports)] on pub use re-exports in trace_llm.rs
(types are re-exported for downstream test files, not used locally)
- Add `..` to ToolCompleted pattern in test_channel.rs to match new
`error` and `parameters` fields
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix(test): fix CI failures after merging main
- Add missing `error` and `parameters` fields to ToolCompleted
constructors in support_unit_tests.rs
- Add `..` to ToolCompleted pattern match in support_unit_tests.rs
- Add #[allow(dead_code)] to CleanupGuard, LlmTrace impl, and
TraceLlm impl (only used behind #[cfg(feature = "libsql")])
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* Adding coverage running script
* fix(test): address review feedback on E2E test infrastructure
- Increase wait_for_responses polling to exponential backoff (50ms-500ms)
and raise default timeout from 15s to 30s to reduce CI flakiness (#1)
- Strengthen prompt_injection_resilience test with positive safety layer
assertion via has_safety_warnings(), enable injection_check (#2)
- Add assert_tool_order() helper and tools_order field in TraceExpects
for verifying tool execution ordering in multi-step traces (#3)
- Document TraceLlm sequential-call assumption for concurrency (#6)
- Clean up CleanupGuard with PathKind enum instead of shotgun
remove_file + remove_dir_all on every path (#8)
- Fix coverage.sh: default to --lib only, fix multi-filter syntax,
add COV_ALL_TARGETS option
- Add coverage/ to .gitignore
- Remove planning docs from PR
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: address PR review - use HashSet in retain_only, improve skill test
- Use HashSet for O(N+M) lookup in SkillRegistry::retain_only and
ToolRegistry::retain_only instead of linear scan
- Strengthen test_retain_only_empty_is_noop in SkillRegistry to
pre-populate with a skill before asserting the no-op behavior
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix(test): revert incorrect safety layer assertion in injection test
The safety layer sanitizes tool output, not user input. The injection
test sends a malicious user message with no tools called, so the safety
layer never fires. Reverted to the original test which correctly
validates the LLM refuses via trace expects. Also fixed case-sensitive
request hint ("ignore" -> "Ignore") to suppress noisy warning.
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: clean stale profdata before coverage run
Adds `cargo llvm-cov clean` before each run to prevent
"mismatched data" warnings from stale instrumentation profiles.
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: fix formatting in retain_only test
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
Co-authored-by: Illia Polosukhin <[email protected]>
* fix(ci): persist all cargo-llvm-cov env vars for E2E coverage
Newer cargo-llvm-cov versions output CARGO_ENCODED_RUSTFLAGS instead of
RUSTFLAGS from show-env. The workflow was cherry-picking specific vars
(RUSTFLAGS, LLVM_PROFILE_FILE, etc.) to persist to $GITHUB_ENV, so
CARGO_ENCODED_RUSTFLAGS was never set during the build step, producing a
non-instrumented binary and zero .profraw files.
Replace the manual echo lines with `cargo llvm-cov show-env >> $GITHUB_ENV`
to forward all vars (including CARGO_ENCODED_RUSTFLAGS, CARGO_INCREMENTAL,
etc.) regardless of cargo-llvm-cov version.
Also forward CARGO_ENCODED_RUSTFLAGS in the E2E conftest subprocess env.
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix(ci): address PR review — prefix-based env forwarding, split clean step
- conftest.py: replace explicit env var list with prefix-based matching
(CARGO_LLVM_COV*, LLVM_*) plus specific vars (CARGO_ENCODED_RUSTFLAGS,
CARGO_INCREMENTAL) to stay resilient to cargo-llvm-cov changes.
- coverage.yml: move `cargo llvm-cov clean` to its own step so the env
vars from show-env (persisted via $GITHUB_ENV) are active when clean runs.
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* feat: route OAuth callbacks through web gateway for hosted instances
On hosted instances (e.g., NEAR AI), OAuth callbacks can't reach the
local TCP listener on port 9876. This adds a gateway-routed OAuth flow
that works behind reverse proxies and load balancers.
Backend changes:
- Add /oauth/callback as a public route on the web gateway
- PendingOAuthFlow registry shared between ExtensionManager and handler
- Gateway mode auto-detected via IRONCLAW_OAUTH_CALLBACK_URL env var
- Platform state format (instance:nonce) for nginx routing
- Token exchange proxy support via IRONCLAW_OAUTH_EXCHANGE_URL
- Local TCP listener mode preserved as backward-compatible fallback
UX improvements:
- Hide Configure button for tools with auto-resolved OAuth credentials
(builtin defaults or platform-injected env vars)
- Skip client_id/client_secret fields in setup schema when auto-resolved
- Show Reconfigure only after successful authentication
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix(oauth): harden gateway callback and refactor AuthResult
- Add 60s timeout to exchange_via_proxy HTTP client (matching exchange_oauth_code)
- Read GATEWAY_AUTH_TOKEN once at ExtensionManager construction instead of
per-flow from env (prevents coupling and clarifies token provenance)
- Extract oauth_error_page() helper to deduplicate error landing pages
- Remove IRONCLAW_FORCE_GATEWAY_CALLBACK env var (auto-detection suffices)
- Refactor AuthResult into typed AuthStatus enum with constructors,
eliminating stringly-typed status and Option fields that were always None
- Adapt all handlers (chat, extensions, ws) to new AuthResult/AuthStatus API
- Use setup_url (not validation_endpoint) for awaiting_token responses
[skip-regression-check]
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
* fix(oauth): address review feedback — empty token guard, test flakiness, doc typos
- Fail early in exchange_via_proxy() when gateway_token is empty instead
of sending an unauthenticated request to the exchange proxy
- Fix test_oauth_callback_strips_instance_prefix to use an expired flow
so it never attempts a real HTTP token exchange (prevents CI flakiness)
- Fix doc comments: /auth/callback → /oauth/callback in PendingOAuthFlow
and ExtensionManager pending_oauth_flows docs
[skip-regression-check]
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
* fix: clarify strip_instance_prefix safety, wrapper credential fix, test assertion
- Add comment to strip_instance_prefix noting nonces are base64url (no colons)
- Expand wrapper.rs comment explaining the credential_user_id bug fix
- Fix test_oauth_callback_strips_instance_prefix assertion: landing_html
does not include provider_name on error pages
[skip-regression-check]
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
* feat(web): show error details and input params for failed tool calls
Failed tool calls in the gateway UI previously showed only a red X icon
with an empty expandable body. This change:
- Adds optional `error` and `parameters` fields to `ToolCompleted` SSE
events so the browser receives failure details in real-time
- Auto-expands failed tool cards to make errors immediately visible
- Adds `StatusUpdate::tool_completed()` constructor that centralizes
the 5 duplicated construction sites and applies `redact_params()` to
prevent sensitive values (e.g. secret_save's "value" param) from
leaking through SSE broadcasts
- Adds `sensitive_params()` trait method to `Tool` for declaring which
parameters must be redacted before logging, hooks, and UI display
- Adds `redact_params()` utility and wires it through hooks, approvals,
ActionRecord storage, and debug logs in dispatcher/worker
- Adds `SecretListTool` and `SecretDeleteTool` for LLM-driven secret
management (values never returned, only names/metadata)
- Fixes auth flow: setup-only extensions show configure modal instead
of OAuth card; auth_completed SSE dismisses both UI paths
- CI: release workflow creates PR instead of pushing directly to main
- Registry: MissingChecksum error enables source fallback for
bootstrapping when checksums haven't been populated yet
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* style: apply cargo fmt
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix: keep original params in PendingApproval for execution, redact only for display
Address two PR review comments:
1. execute_chat_tool_standalone now redacts sensitive params before logging,
matching the pattern already used in worker.rs.
2. PendingApproval previously stored redacted parameters, which meant
approved tool calls received "[REDACTED]" instead of the actual values.
Add a display_parameters field for UI/logs and keep parameters as the
original values used for execution.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix: address PR review comments
- worker.rs: redact sensitive params before BeforeToolCall hook, matching
dispatcher.rs — hooks in the autonomous job path now receive redacted
params instead of raw values
- registry.rs: fix docstring for register_secrets_tools (list, delete,
not save/list/delete — no SecretSaveTool is registered)
- app.js: fix double toast/loadExtensions in submitConfigureModal —
for non-OAuth success the auth_completed SSE already handles both,
so skip them in the HTTP response handler to avoid duplicates
[skip-regression-check]
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
* feat(extensions): add load-time validation for auth capabilities
Catch common misconfigurations (missing auth section, missing setup_url,
short prompts) at startup via tracing::warn instead of silently failing
at auth time.
* feat(extensions): improve auth prompts, setup_url, and showAuthCard
Add setup_url and descriptive prompts to channel and tool capabilities
files. Fix showAuthCard in web gateway and improve extension manager
auth flow messaging.
* refactor(extensions): extract MIN_PROMPT_LENGTH constant in validate()
Address review feedback: replace magic number 30 with a named constant
for readability and maintainability.
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix(security): restrict query-token auth to SSE endpoints only
Query-string `?token=xxx` auth was accepted on all endpoints, exposing
the main auth token in server logs, Referer headers, and browser history
for state-changing routes. Now only GET /api/chat/events and
GET /api/logs/events accept query tokens; all other endpoints require
the Authorization header.
Supersedes #364.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: add WebSocket endpoint to query-token allowlist, add URL-encoding tests
The WS upgrade at /api/chat/ws also can't set custom headers, so it
needs query-token auth like the SSE endpoints. Also adds tests for
URL-encoded token values to cover the form_urlencoded parser.
Addresses review feedback from Gemini (partially, /api/jobs/{id}/events
is a JSON endpoint not SSE, so it correctly stays excluded) and Copilot
(URL-encoded token test).
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
The ironclaw binary only handles SIGINT (via tokio::signal::ctrl_c),
not SIGTERM. When conftest.py sent SIGTERM during teardown, the OS
killed the process immediately without running atexit handlers, so
LLVM never flushed .profraw files. cargo llvm-cov report then found
zero profraw files and failed.
- Send SIGINT instead of SIGTERM so the existing ctrl_c handler
triggers graceful shutdown → main() returns → atexit runs → profraw
flushed
- Increase shutdown wait from 5s to 10s for graceful cleanup
- Add a diagnostic step to verify profraw files exist before the
report step, making future issues visible in CI logs
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix(wasm): coerce string parameters to schema-declared types
LLMs frequently pass numeric values as JSON strings ("5" instead of 5)
or booleans as strings ("true" instead of true). The WASM module's
serde deserializer rejects these type mismatches. This adds a
coerce_params_to_schema() helper that walks the params JSON object
and converts string values to their schema-declared types (number,
integer, boolean) before passing to the WASM module.
Adds 5 unit tests covering number, integer, boolean coercion,
already-correct types, and unparseable strings.
Closes#486
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor: use in-place mutation and case-insensitive boolean coercion
Address review feedback:
- Use get_mut instead of clone+insert to avoid allocations
- Make boolean coercion case-insensitive (handles "True", "FALSE", etc.)
- Expand boolean test to cover false and mixed-case values
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: cargo fmt
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: collapse nested if-let to satisfy clippy collapsible_if lint
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix(agent): strip leaked [Called tool ...] text from agent responses
When the NEAR AI provider flattens tool_call messages to plain text,
markers like [Called tool ...] and [Tool ... returned: ...] can leak
into the user-visible response if the LLM echoes them back. This adds
a sanitization step in the agentic loop's text response path that
strips these internal markers before returning. If stripping leaves
the response empty, a generic fallback message is returned instead.
Closes#487
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor: use fold instead of collect+join to avoid heap allocation
Address review feedback: replace Vec collect + join with fold to build
the filtered string directly, avoiding an intermediate heap allocation.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: cargo fmt
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
Co-authored-by: Pierre LE GUEN <[email protected]>
* fix(web): reset job list UI on restart failure
The restartJob() catch handler was missing a loadJobs() call, so the
job row stayed in a stale highlighted state after a failed restart
attempt. Add loadJobs() to match the success path behavior.
Closes#485
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor: use .finally() for loadJobs() instead of duplicating
Move loadJobs() to a .finally() block so it runs on both success and
failure without duplication.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
The Telegram channel capabilities file was missing the `webhook`
block inside `capabilities.channel`, causing the router to fall back
to the default `X-Webhook-Secret` header instead of the Telegram-
specific `X-Telegram-Bot-Api-Secret-Token`.
When a webhook secret is configured (via `telegram_webhook_secret`),
incoming updates are rejected with 401 because Telegram sends the
token in `X-Telegram-Bot-Api-Secret-Token` but the router looks for
`X-Webhook-Secret`.
The existing test in `schema.rs` already expects the correct header
name, confirming this is an oversight in the shipped capabilities
file.
Co-authored-by: SMKRV <[email protected]>
Co-authored-by: firat.sertgoz <[email protected]>
The pairing store called .unwrap() on path.parent() in three locations
(upsert_request, record_failed_approve, add_allow_from). If a path has
no parent (root path or empty), this panics — a potential denial-of-service
vector if an attacker can influence the path.
Added InvalidPath variant to PairingStoreError and replaced all three
.unwrap() calls with ok_or_else error propagation. This follows the
project's no-panics-in-production policy.
Locations fixed:
- upsert_request (line ~227)
- record_failed_approve (line ~322)
- add_allow_from (line ~465)
Co-authored-by: Claude Sonnet 4.6 <[email protected]>
* ci: enhance coverage workflow with feature matrix, postgres, and E2E
Replace single-config coverage job with a multi-job pipeline:
- Mirror test.yml's 3-config feature matrix (all-features, default, libsql-only)
- Add PostgreSQL service (pgvector/pgvector:pg16) with migrations for
postgres configs so integration tests actually run instead of skipping
- Add E2E coverage job using cargo-llvm-cov instrumented binary with
Playwright browser tests
- Add coverage-gate roll-up job for branch protection
- Upload per-config flags to Codecov (all-features, default, libsql-only, e2e)
- Forward LLVM coverage env vars in E2E conftest.py so profraw data
lands where cargo-llvm-cov report expects it
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: address PR review feedback on coverage workflow
- Avoid setting DATABASE_URL to empty string for libsql-only config;
use $GITHUB_ENV conditional step so the var is unset entirely
- Add set -euo pipefail and psql -v ON_ERROR_STOP=1 to migrations
so SQL errors fail the job immediately
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
Add Dockerfile.test as reusable infrastructure for spinning up local
test instances with libsql (no PostgreSQL dependency). Defaults to
port 3003 to avoid conflict with dev server.
Add local-test workspace skill that teaches the agent how to build,
run, and test against local Docker containers using Chrome MCP browser
automation tools. Covers LLM backend configuration, multi-instance
testing, cleanup, and troubleshooting.
* ci: enforce regression tests for fix commits
Add a commit-msg hook and CI workflow that require test changes
alongside bug fix commits, ensuring every fix includes a regression
test that would have caught the bug.
- scripts/commit-msg-regression.sh: local git hook (blocks fix commits
without test changes; exempts static/docs-only; bypass via
[skip-regression-check] marker)
- .github/workflows/regression-test-check.yml: CI mirror on PRs
(checks title + commit messages; skip via label)
- scripts/dev-setup.sh: install hook in step 6
- .github/scripts/create-labels.sh: add skip-regression-check label
- CLAUDE.md: document regression test policy
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: address PR review feedback on regression test enforcement
- Use here-strings instead of echo|grep to avoid misinterpreting
special characters in variables
- Use git diff -W (whole-function context) to detect edits inside
existing test functions, not just new #[test] attributes
- Honor [skip-regression-check] in commit messages in CI (not just
the PR label)
- Use git rev-parse --git-path hooks for worktree-safe hook install
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* Update .github/workflows/regression-test-check.yml
Co-authored-by: Copilot <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
Co-authored-by: Copilot <[email protected]>
* ci: add code coverage with cargo-llvm-cov and Codecov
Add a Coverage workflow that runs on PRs and pushes to main using
cargo-llvm-cov with --all-features, uploading LCOV results to Codecov.
Include codecov.yml config with project/patch targets and ignore rules
for stub files.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* ci: switch Codecov upload to OIDC (tokenless)
Use GitHub OIDC tokens instead of CODECOV_TOKEN secret so coverage
uploads work for fork PRs where secrets are not available.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* ci: fail coverage upload strictly on push, leniently on PRs
Use a conditional so pushes to main fail if Codecov upload breaks
(preventing silent reporting gaps) while PRs stay lenient to avoid
blocking fork PRs where OIDC may not be available.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* ci: disable Codecov auto-detection to suppress warnings
We provide lcov.info explicitly, so disable auto-search for gcov,
coverage.py, and Xcode formats that produce noisy warnings.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* ci: include channels-src and tools-src in coverage reporting
These WASM source directories should be tracked for test coverage
rather than ignored.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* ci: remove stale ignore entries from codecov.yml
The marketplace, ecommerce, taskrabbit, and restaurant stub files
no longer exist in the codebase.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* ci: run coverage on push to main only
Avoids running tests twice on PRs (once in test.yml, once for coverage).
Coverage runs on merge to main instead. Simplify fail_ci_if_error to
always true since it only runs on push now.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix(web): use dvh units to prevent mobile browser bar from obscuring chat input
On mobile browsers (Brave/Android, Safari/iOS), the bottom navigation bar
covers the chat input because 100vh includes space behind browser chrome.
Switch to 100dvh (dynamic viewport height) with vh fallback for older
browsers, and add safe-area-inset padding for notched devices.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* Fix padding declaration in chat input style
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
Co-authored-by: Illia Polosukhin <[email protected]>
* fix(web): assign unique thread_id to manual routine triggers
Manual routine triggers via the web API created an IncomingMessage
without a thread_id, causing session_manager.resolve_thread() to
route the output to whatever thread was last associated with the
(user, "gateway", None) key. This sets a unique thread_id of the
form "routine-{id}-{timestamp}" so each manual trigger gets its own
dedicated thread.
Closes#484
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: add ownership check to routine trigger handler (IDOR)
Address review feedback: verify routine.user_id matches the
authenticated user before allowing the trigger, preventing
unauthorized cross-user routine execution.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: cargo fmt
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix(web): refresh routine UI after "Run Now" trigger
triggerRoutine() only showed a toast but did not refresh the routine
data after triggering. This adds openRoutineDetail() / loadRoutines()
calls after the toast, matching the pattern used by toggleRoutine().
Closes#483
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: only refresh detail view if triggered routine matches current view
Check currentRoutineId === id before refreshing the detail panel to
avoid refreshing the wrong routine's view.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix(web): use slug for skill download URL from ClawHub
The skill install handler was using req.name (display name like
"Markdown Converter") instead of the slug (like "owner/markdown-converter")
when constructing the download URL. The registry endpoint expects a slug,
so display names caused 502 errors.
- Add optional `slug` field to SkillInstallRequest
- Prefer slug over name when building the download URL
- JS installSkill() now sends slug from search results
Closes#482
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: guard against empty slug string in skill download URL
Filter out empty slug strings so we fall back to name instead of
constructing an invalid download URL.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: cargo fmt
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix(workspace): thread document path through search results
Memory search results were showing chunk UUIDs instead of source file
paths. Thread document_path through RankedResult, SearchResult, and the
RRF fusion pipeline so handlers can display the actual file path.
Fixes#481
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor: use into_iter to move values instead of cloning
Address review feedback: consume results with into_iter() to move
String fields directly instead of cloning them.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
Swap the order of import_from_directory() and seed_if_empty() so that
custom workspace templates from WORKSPACE_IMPORT_DIR take priority
over generic seeds. Previously, seed_if_empty() ran first and created
all default files, causing import_from_directory() to skip everything
since the files already existed in the DB.
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
* feat: add OAuth support for WASM tools in web gateway
Extract reusable OAuth functions (build_oauth_url, exchange_oauth_code,
store_oauth_tokens, validate_oauth_token) from CLI into shared
oauth_defaults module, then wire them into the web gateway's
ExtensionManager.
Key changes:
- Install auto-activates WASM tools (no separate Activate button)
- Configure button triggers OAuth flow via save_setup_secrets
- Scope merging: installing a second Google tool triggers re-auth with
merged scopes from all tools sharing the same secret_name
- Cancel-and-retry: aborting stale OAuth listeners prevents port conflicts
- Post-auth validation: wrong account detected via validation_endpoint
- Reconfigure always re-auths (deletes old token before starting fresh)
- UI shows error toast on OAuth failure, refreshes extension list
Flow: Install → Active → Configure (enter client_id/secret) → Save →
OAuth popup → authorize → done. Second Google tool install auto-triggers
scope expansion OAuth.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix: address PR review comments
- Add custom headers support to ValidationEndpointSchema (fixes
missing Notion-Version header regression)
- Guard activate handler auth check with status == "awaiting_authorization"
to prevent unexpected OAuth popups
- Add window dimensions to OAuth popup in activateExtension()
- Simplify UTF-8 truncation boundary check
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix: address Copilot PR review comments (security, UX, bugs)
- Add CSRF state parameter to OAuth flow (random state in auth URL, validated in callback)
- Restore MCP server Activate button in web UI (was hidden for all non-channel extensions)
- Abort JoinHandle in cleanup_expired_auths to prevent port 9876 conflicts
- Fix Google-specific error message for non-Google OAuth providers
- Add has_auth field to ExtensionInfo API response (fixes Configure button visibility)
- Use oauth_defaults::callback_url() instead of hardcoded redirect_uri (both CLI and manager)
- Update auth check comment to match actual behavior (scope expansion + first-time auth)
- Add unit tests for build_oauth_url (basic, PKCE, extra params, state uniqueness)
- Check all required setup secrets (client_id + client_secret) before starting OAuth
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
* fix: use std::sync::RwLock in MessageTool to avoid runtime panic
The `requires_approval` method is synchronous but was using
`tokio::sync::RwLock` with `.await` which requires blocking the
runtime. This caused a panic:
"Cannot block the current thread from within a runtime"
Changes:
- Replace `tokio::sync::RwLock` with `std::sync::RwLock` for
`default_channel` and `default_target` fields
- Use `unwrap_or_else(|e| e.into_inner())` to gracefully handle
poisoned locks (recovers instead of panicking)
- Update all usages from `.read().await` to `.read().unwrap_or_else()`
The locks are short-held (just cloning strings), making std::sync::RwLock
appropriate for sync methods called from async contexts.
Fixes: "Cannot block the current thread from within a runtime" panic
when the LLM tries to send a message via the message tool.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: address code review feedback for MessageTool RwLock fix
- Fix formatting (long lines broken up per rustfmt)
- Add regression test that demonstrates the panic with tokio::sync::RwLock
and passes with std::sync::RwLock when calling requires_approval()
(sync method) from async context
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* feat(web): fix jobs UI parity for non-sandbox mode
The web gateway Jobs UI was built primarily for sandbox (Docker) jobs.
When running without sandbox (common for NEAR AI hosted envs), multiple
features were broken. This change fixes all of them:
- Agent jobs now broadcast live SSE events to the web UI (Activity tab)
- Agent job restart via scheduler.dispatch_job (not chat message)
- Follow-up prompts for agent jobs via WorkerMessage injection
- Capability flags (can_restart, can_prompt, job_kind) in job detail API
- Rate-limit retry with cap (10 consecutive) and Retry-After header parsing
- Plan interruption on user message (breaks out of plan, re-evaluates)
- Correct SSE status field in mark_completed/mark_failed/mark_stuck
- SseManager preserved across rebuild_state calls
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* style: fix formatting in db/mod.rs and nearai_chat.rs
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
* refactor: remove restart infrastructure and generalize Telegram-specific code
Remove the gateway restart mechanism (hot-activation works, restart won't
fix activation failures) and generalize Telegram-specific hardcoded checks
so all WASM channels get equal treatment.
Part 1 - Remove restart infrastructure:
- Remove needs_restart from ActionResponse, restart_requested from GatewayState
- Remove gateway_restart_handler, /api/gateway/restart route, exit code 75
- Remove restart overlay JS/CSS (dead code - restartGateway() never called)
- Surface actual activation errors instead of suggesting restart
Part 2 - Generalize Telegram-specific code:
- Replace telegram_owner_id: Option<i64> with generic
wasm_channel_owner_ids: HashMap<String, i64> (backwards-compatible
via TELEGRAM_OWNER_ID env var)
- Pairing status check now applies to all active WASM channels
- All channels get 3-step stepper in web UI, remove "coming soon" note
- Remove dead setup_telegram() code (~700 lines) - Telegram's
capabilities.json declares required_secrets, so the generic
setup_wasm_channel() path handles it
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* test: add Settings::set() test for wasm_channel_owner_ids
Addresses review feedback: verify that setting per-channel owner IDs
via the dotted-path Settings::set() API works correctly with the new
HashMap<String, i64> type.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix(web): refresh extension stepper after pairing approval
loadPairingRequests only refreshed the pairing section, not the
stepper status. Call loadExtensions() instead so the stepper updates
from "Awaiting Pairing" to "Active" immediately after approval.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
* feat(workspace): add TOOLS.md, BOOTSTRAP.md, and disk-to-DB import
Add two new OpenClaw-compatible workspace markdown files:
- TOOLS.md: Environment-specific tool notes (SSH hosts, device names,
etc.) injected into the system prompt under "## Tool Notes". Seeded
as comment-only (like HEARTBEAT.md) so it's effectively empty until
the user adds real content. Not write-protected — the agent can
update it as it learns the environment.
- BOOTSTRAP.md: First-run onboarding ritual. Injected FIRST in the
system prompt when present. Guides the agent through introducing
itself, learning about the user, and updating workspace files.
Only seeded on truly fresh workspaces (no existing identity files)
to avoid triggering the ritual on existing deployments. Agent clears
it via `memory_write(target="bootstrap")` when done.
Add `Workspace::import_from_directory()` for disk-to-DB import:
- Scans a directory for *.md files and imports any that don't already
exist in the database (never overwrites user edits)
- Controlled by WORKSPACE_IMPORT_DIR env var, runs after seed_if_empty()
- Enables Docker images / deployment scripts to ship customized
workspace templates that override generic seeds
- Backwards compatible: no-op when env var is unset
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix: address PR review comments
- Use stable `path.extension() != Some(OsStr::new("md"))` instead of
unstable `is_none_or` (nightly-only)
- Use `tokio::join!` for concurrent DB reads in fresh-workspace check
- Skip unreadable directory entries instead of failing the entire import
- Skip unreadable files instead of failing the entire import
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
WASM tools and channels activated at runtime (via web UI or CLI) were
missing secrets store wiring, causing credential injection to silently
fail. Tools like web-search would get 401s from APIs even though the
user had configured their API key.
Four bugs fixed:
- activate_wasm_tool(): WasmToolLoader created without .with_secrets_store()
- register_wasm_from_storage(): hardcoded secrets_store: None
- WasmChannelLoader: no secrets_store field at all (added field + builder)
- activate_wasm_channel() and startup path: both missed wiring secrets
The startup path in app.rs was correct; all runtime paths now match it.
Co-authored-by: Claude Sonnet 4.6 <[email protected]>
* feat: add Brave Web Search WASM tool
Add a new WASM tool for searching the web via the Brave Search API.
Follows the same architecture as the GitHub WASM tool with zero-exposure
credential injection (X-Subscription-Token header).
Features:
- Full Brave Search API support (query, count, country, search_lang,
ui_lang, freshness)
- Input validation on all parameters
- Retry logic for 429/5xx transient errors
- RFC 3986 percent-encoding
- Registry manifest for Extensions tab discovery
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix: avoid Vec allocation in is_valid_ui_lang
Use iterator-based destructuring instead of collecting into a Vec,
avoiding a heap allocation in the WASM sandbox.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
- Add scrollIntoView to keep arrow-key-selected item visible in dropdown
- Make Enter complete the first matching command when autocomplete is
visible, instead of requiring explicit arrow-key navigation first
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
The tool manifests pointed to channel bundle URLs (telegram-wasm32-wasip2.tar.gz,
slack-wasm32-wasip2.tar.gz) instead of the tool bundles (telegram-mtproto-...,
slack-tool-...). This caused install to fail because the archive contents
didn't match the expected .wasm filename.
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
The compiler cannot infer the element type of `conflicts` on Windows
because all `push` calls are inside `#[cfg(unix)]` blocks which don't
compile on Windows.
Co-authored-by: Claude Sonnet 4.6 (1M context) <[email protected]>
* fix(channels): add host-based credential injection to WASM channel wrapper
The channel WASM wrapper was missing the host-based credential injection
that the tools wrapper implements. The `credentials` block in channel
capabilities files was dead code: Slack's `on_respond` sends requests
with no Authorization header, expecting the host to inject the bot token
based on `host_patterns`, but the host never did.
This caused Slack (and any channel relying on capabilities-declared
credentials) to fail all outbound API calls with `not_authed`.
Changes:
- Add `ResolvedHostCredential` struct mirroring the tools wrapper
- Add `host_credentials` field to `ChannelStoreData`
- Add `inject_host_credentials()` method on `ChannelStoreData`
- Update `redact_credentials()` to also scrub host-injected secret values
- Add `secrets_store` field to `WasmChannel` + `with_secrets_store()` builder
- Add `resolve_channel_host_credentials()` async helper that decrypts
capabilities-declared credentials before each WASM callback
- Update `create_store()` and all `call_on_*` / `execute_status` /
`execute_poll` call sites to pre-resolve and pass host credentials
- Fix leak scan ordering: scan runs on WASM-provided values BEFORE host
credential injection, preventing false-positive blocks on injected
Bearer tokens (e.g. xoxb- Slack tokens)
- Make `credential_injector` module pub(crate) so channels can reuse
`inject_credential` and `host_matches_pattern`
Fixes#389, root cause of #413
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
* fix(wasm): redact URL-encoded credentials, use url::Url, derive Clone
Address review feedback on PR #421:
1. Security: redact_credentials now scrubs URL-encoded forms of secrets
in addition to raw values, preventing exfiltration via encoded
representations in error strings from reqwest
2. Use url::Url::query_pairs_mut() for query parameter injection instead
of manual string manipulation, improving robustness with malformed URLs
3. Derive Clone on ResolvedHostCredential and simplify the per-tick
clone in the status repeater loop
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: cargo fmt
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Sprite <[email protected]>
Co-authored-by: Claude Sonnet 4.6 <[email protected]>
* refactor: rename WasmBuildable::repo_url to source_dir
The field receives a local directory path (e.g. "tools-src/gmail"), not a
URL. Rename to source_dir to accurately reflect its purpose.
Adds #[serde(alias = "repo_url")] for backwards compatibility with any
previously serialized data.
Closes#329
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor: rename extract_url to extract_source
The function can return a local directory path, not just a URL.
Addresses review feedback on PR #445.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix: pre-validate Cloudflare tunnel token by spawning cloudflared
After format validation passes, spawn `cloudflared tunnel run` briefly
with a dummy URL and watch stderr for up to 10s. If an error appears
before a connection URL, report it and offer "Save anyway?". This
catches bad tokens during setup instead of at runtime 30s later.
Closes#440
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: tighten cloudflared output matching in live validation
- Check for cfargotunnel.com/trycloudflare.com in success detection
- Use starts_with("err") instead of contains("err") to avoid false
positives on words like "stderr"
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix: prevent Telegram 409 Conflict on webhook re-registration
Delete any existing webhook before calling setWebhook in on_start(),
matching the defensive cleanup that polling mode already does. As a
safety net, register_webhook() now retries once on 409 after calling
delete_webhook().
Closes#440
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor: deduplicate 409 retry logic in register_webhook
Restructure the match block so the initial request and retry share
a single response-handling code path.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix: persist channel activation state across restarts (#392)
Channels activated via the web UI were lost on restart because
active_channel_names was only in memory. Now persist activation state
to the settings store under "activated_channels" and auto-activate
persisted channels on startup.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: log warnings for channel activation load failures
Replace silent catch-all with explicit error logging when
database queries or deserialization fails for activated channels.
Addresses Gemini review feedback on PR #432.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* Apply suggestions from code review
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
Co-authored-by: Illia Polosukhin <[email protected]>
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
* fix: init WASM runtime eagerly regardless of tools directory existence
The WASM tool runtime was only created at startup when both
`wasm.enabled` and `wasm.tools_dir.exists()` were true. This meant
that if the tools directory didn't exist yet (e.g. fresh deploy with
`--no-onboard`), the runtime was set to None and passed to the
ExtensionManager. Extensions installed later via the web UI would
then fail with "WASM runtime not available" because the runtime
could not be retroactively created.
The Wasmtime engine initialization has no dependency on the tools
directory — it only configures the compiler and starts an epoch
ticker thread. The directory is only needed later when loading
.wasm modules. Remove the directory check so the runtime is
available for post-startup extension activation.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* test: add regression tests for WASM runtime eager init
- runtime.rs: test_runtime_creation_without_tools_dir confirms the
Wasmtime engine initialises without a tools directory on disk
- manager.rs: test_activate_wasm_tool_with_runtime_passes_runtime_check
verifies activation gets past the runtime check when a runtime is
provided (fails on missing file, not missing runtime)
- manager.rs: test_activate_wasm_tool_without_runtime_fails_with_runtime_error
verifies the original error when no runtime is available
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor: use idiomatic Result-to-Option conversion for WASM runtime init
Address PR review feedback: replace match block with
.map(Arc::new).map_err(|e| warn!(...)).ok() chain.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: fix formatting in extension manager tests
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
