* fix: auto-compact and retry on ContextLengthExceeded in agentic loop
When the LLM returns a context-length-exceeded error mid-turn, the
dispatcher now automatically compacts the conversation history and
retries once instead of propagating the raw error to the user.
The compaction keeps all system messages (system prompt, skill context),
the last user message, and all subsequent messages (current turn's tool
calls and results), dropping older conversation history. A note is
inserted to inform the LLM that earlier context was dropped.
If the retry also fails, the original error is returned.
Fixesnearai/ironclaw#260
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* Address Gemini/Copilot review feedback
- Fix system message duplication: only collect system messages before the
last User message to avoid duplicating nudges in the tail slice (Gemini + Copilot)
- Only add compaction note when earlier history is actually dropped (Copilot)
- Propagate actual retry error instead of masking with original (Copilot)
- Fix else branch to preserve system messages when no User messages exist
- Add test for nudge-after-user deduplication
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix: make Telegram status prompts reliable
Approval and auth prompts could be missed when polling or reply-context sends failed, leaving users stuck in waiting states. This adds explicit status mapping and retries, keeps typing active through intermediate work while suppressing noisy tool telemetry, and adds regression tests plus CI coverage for the Telegram channel crate.
* fix: normalize terminal status handling
Terminal status strings from the agent loop can vary in casing and formatting, which could leak internal status lines to Telegram. This normalizes Done/Interrupted mapping and filters terminal status text consistently to keep chat UX clean while preserving actionable prompts.
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix: persist user message at turn start before agentic loop
Split persist_turn into persist_user_message + persist_assistant_response.
The user message is now written to DB immediately after thread.start_turn(),
before the agentic loop runs. This ensures the message survives process
crashes mid-response. The assistant response is persisted only on completion.
Updated all 6 call sites in thread_ops.rs (success, error, approval
success/error, rejection, and auth intercept paths).
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix: document persist_assistant_response dependency on persist_user_message
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* style: apply cargo fmt
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix: re-ensure conversation in persist_assistant_response
Add ensure_conversation call and user_id parameter to
persist_assistant_response so assistant replies are still persisted
even if persist_user_message failed transiently at turn start.
Addresses PR review feedback from @ilblackdragon.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
* feat: add web UI test skill for Chrome extension testing
Add a SKILL.md checklist for manually testing the IronClaw web gateway
UI using the Claude for Chrome browser extension. Covers connection,
chat, skills tab (search, install by search, install by URL, remove),
and smoke tests for other tabs.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: use placeholder token and correct cleanup path per review
- Replace hardcoded test123 token with <your-token> placeholder
- Fix cleanup path: ~/.ironclaw/installed_skills/ (not skills/)
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix: block send until thread is selected
Prevents messages from ending up in orphan threads when user sends
while currentThreadId is null during page load.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix: guard enableChatInput against null thread + add user feedback
Prevents SSE events from re-enabling input before a thread is selected.
Adds status message when user tries to send without a thread.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
When SSE auto-reconnects after a server restart, the chat now
re-syncs from the database so no messages are lost.
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
* feat: implement FullJob routine mode with scheduler dispatch
FullJob routines previously fell back to lightweight mode (single LLM call,
no tools) with a warning. This wires them to the existing Scheduler/Worker
infrastructure so they dispatch real jobs with full tool access.
Fire-and-forget model: the routine creates a job via ContextManager, schedules
it, links the routine_run to the job_id, and completes immediately. The job
runs independently with full tool access.
- Add RoutineError::JobDispatchFailed variant
- Add RoutineStore::link_routine_run_to_job (PostgreSQL + libSQL)
- Add execute_full_job() in routine_engine with context_manager/scheduler
- Wire context_manager + scheduler into RoutineEngine from agent_loop
- Fix pre-existing clippy warnings in tests/html_to_markdown.rs
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: persist job to DB before scheduling in execute_full_job
The worker emits job_actions and llm_calls rows that reference agent_jobs
via foreign key. Without persisting the job first, those inserts can fail.
Match the pattern from commands.rs: fetch JobContext, save_job(), then schedule.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor: consolidate job dispatch into Scheduler::dispatch_job and wire max_iterations
Move the create + persist + schedule sequence into a single
Scheduler::dispatch_job() method so callers (commands.rs, routine_engine.rs)
don't duplicate the logic. FullJob routines now pass max_iterations via job
metadata, and the worker reads it (defaulting to 50 if unset).
Also removes the context_manager field from RoutineEngine since dispatch_job
handles everything internally.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: clamp max_iterations to 500 and log category update failures
Address PR review feedback:
- worker.rs: clamp max_iterations from metadata to MAX_WORKER_ITERATIONS (500)
to prevent unbounded LLM token usage from malicious/buggy configs
- commands.rs: log warning on category update failure instead of silently
discarding the error
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat: persist worker events to DB and fix activity tab rendering
In-process Worker (used by Scheduler::dispatch_job) now persists events
via save_job_event at key execution points: plan creation, LLM
responses, tool_use, tool_result, and job completion/failure/stuck.
Event data shapes match the container worker format so the gateway
activity tab renders them correctly.
Frontend: tool_result errors now show a red X icon with danger styling
instead of a silent empty output. The result event falls back to the
error field when message is absent.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* refactor: unify WASM artifact resolution into registry/artifacts.rs
Consolidate duplicated WASM find/build/install logic from 5+ files into
a single src/registry/artifacts.rs module. This fixes two bugs:
- registry/installer.rs now respects CARGO_TARGET_DIR (was hardcoded)
- channels/wasm/bundled.rs now searches all WASM triples (was wasip2 only)
Also includes: extension manager hot-activation for WASM channels,
extension guidance in LLM prompts, channel manager hot-add support,
webhook router channel lookup, and minor cleanups.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: send approval prompts as messages on WASM channels (Telegram, Slack)
WASM channels mapped ApprovalNeeded status to a typing indicator,
so users on Telegram never saw tool approval prompts — the agent
got stuck in AwaitingApproval and all subsequent messages failed
with "Waiting for approval".
- Intercept ApprovalNeeded in WasmChannel::handle_status_update and
send the prompt as an actual message via call_on_respond, showing
tool name, description, parameters, and yes/no/always instructions
- Guard against empty LLM responses after clean_response() strips
reasoning_content think-tags (defense-in-depth for reasoning models)
- Add reasoning_content fallback to NearAiChatProvider::complete()
for consistency with complete_with_tools()
- Add debug logging when empty responses are suppressed
- Improve error logging for channel respond() failures
- Register WASM channel webhook routes before credential checks so
platforms don't deactivate webhook URLs with 404s
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: address PR #297 review comments
- ChannelManager::add: use async write().await instead of try_write()
- resolve_target_dir: resolve relative CARGO_TARGET_DIR against crate_dir
- install_wasm_files: log warning on capabilities copy failure
- refresh_active_channel: load capabilities file for webhook secret name
- activate_wasm_channel: validate name against path traversal
- Fix cargo fmt formatting in nearai_chat.rs
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: wire up channel runtime for hot-activation and address PR review round 2
- Wire up set_channel_runtime() in main.rs so hot-activation actually works
(with_channel_runtime was never called — hot-activation was dead code)
- Change ExtensionManager channel runtime fields to RwLock<Option<...>>
interior mutability so set_channel_runtime(&self) works after Arc wrapping
- Fix artifact tests to use resolve_target_dir() instead of hardcoding
"target/" (breaks when CARGO_TARGET_DIR is set)
- Fix bundled.rs build hint: cargo component build (not cargo build --target)
- Fix wasm_artifact_path doc: binary_name should not include .wasm extension
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: use char-aware truncation to prevent UTF-8 panic in approval prompt
&s[..77] panics on multi-byte UTF-8 (CJK, emoji). Use s.chars().take(77)
for safe truncation at character boundaries.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix: remove union type arrays from tool schemas for OpenAI compatibility
OpenAI rejects JSON Schema union types containing "array" without an
"items" subschema. The http tool's "body" and json tool's "data" params
used union types to accept any value. Replace with freeform (untyped)
schemas which OpenAI treats as accepting any JSON value.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: update schema tests to assert type is absent, fix missed json.rs test
- http.rs test: assert body has no "type" (not just has description)
- json.rs test: update to match the freeform schema change (was still
asserting type is present)
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* refactor: simplify config resolution and consolidate main.rs init into AppBuilder
- Add parse_bool_env() and parse_string_env() helpers to eliminate repetitive
5-line optional_env/parse/map_err/unwrap_or boilerplate across 12 config files
- Add EmbeddingsConfig::create_provider() to centralize embeddings construction
(fixes hardcoded 1536 dimensions and missing Ollama provider in app.rs)
- Extract init_cli_tracing(), setup_wasm_channels(), start_tunnel(),
run_memory_command(), run_worker(), run_claude_bridge() from main.rs
- Replace ~600 lines of inline init in main.rs with AppBuilder::build_all()
- Expose catalog_entries from AppComponents for gateway registry entries
- Net reduction: ~738 lines across 15 files
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: propagate dev_loaded_tool_names from AppBuilder and add parse_option_env helper
Address PR review feedback:
- Capture dev_loaded_tool_names from WASM loading in init_extensions()
and expose via AppComponents so bootstrap_hooks receives the actual
dev tool names instead of an empty slice (fixes silent hook skip)
- Add parse_option_env<T>() helper for Option<T> config fields,
simplifying max_cost_per_day_cents and max_actions_per_hour in agent.rs
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: fetch real NEAR AI pricing and unify cost calculation path
CostGuard was independently looking up pricing via costs::model_cost(),
falling back to GPT-4o default rates when NEAR AI model names didn't
match the static table — causing ~3x cost overestimates in logs.
- Add pricing map to NearAiChatProvider that fetches real rates from
/v1/model/list at startup (background, non-blocking)
- Update cost_per_token() to check fetched pricing first, then static
table, then default
- Add cost_per_token parameter to CostGuard::record_llm_call() so the
dispatcher passes provider-sourced rates directly
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* chore: update default NEAR AI model to GLM-latest
Replace fireworks llama4-maverick-instruct-basic with zai-org/GLM-latest
as the default model in config and setup wizard.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: align wizard default model name with config
Change "zai/GLM-latest" to "zai-org/GLM-latest" in wizard.rs to match
the default in config/llm.rs.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
The Bundled variant and its local-artifacts fallback are superseded by the
embedded registry catalog which provides WasmDownload entries with GitHub
release URLs. The in-chat extension manager now always downloads channel
WASM binaries from releases, simplifying the install path.
The setup wizard retains its own local install_bundled_channel path for
dev builds where build artifacts exist on disk.
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix: allow OAuth callback to work on remote servers via OAUTH_CALLBACK_HOST
Fixes#186.
The OAuth callback URL was hardcoded to `http://127.0.0.1:9876` in two
places (NEAR AI login and MCP server auth). On a remote server this URL
is unreachable from the user's browser, making authentication impossible.
Changes:
- Add `callback_host()` to `oauth_defaults` that reads `OAUTH_CALLBACK_HOST`
(default: `127.0.0.1`)
- Update `bind_callback_listener()` to bind to `0.0.0.0` when a non-loopback
host is configured, so the port is reachable from outside the machine
- Update `session.rs` and `mcp/auth.rs` to use `callback_host()` instead
of hardcoded `127.0.0.1` / `localhost`
Usage on a remote server:
export OAUTH_CALLBACK_HOST=<your-server-ip>
ironclaw login
* fix: address PR review comments for OAuth callback security
* fix: address serrrfirat review comments on PR #212
---------
Co-authored-by: firat.sertgoz <[email protected]>
Port Telegram's permission model (owner_id, dm_policy, allow_from, pairing codes)
to Discord, Slack, and WhatsApp WASM channels. Add web UI for configuration and
pairing approval. Fix extension registry issues preventing Discord install and
causing Slack activation to hit the wrong endpoint.
WASM channels:
- Discord: add DiscordConfig, permission checks, ephemeral pairing replies,
fix capabilities.json (header_name→name), downgrade wit-bindgen to 0.36
- Slack: expand SlackConfig with permission fields, add check_sender_permission
and send_pairing_reply via chat.postMessage
- WhatsApp: expand WhatsAppConfig with permission fields, add permission checks
and pairing reply via Cloud API
- Telegram: reformat capabilities.json, add setup.required_secrets
Extension system:
- Add Discord to KNOWN_CHANNELS in bundled.rs and to extension registry
- Rename "slack" MCP→"slack-mcp", "slack-channel"→"slack" to fix name collision
- Add ExtensionSource::Bundled variant handling in discovery.rs
- Add get_setup_schema/save_setup_secrets to ExtensionManager
- Add needs_setup field to InstalledExtension
Web gateway:
- Add GET/POST /api/extensions/{name}/setup for configuration modal
- Add GET /api/pairing/{channel} and POST /api/pairing/{channel}/approve
- Add configure modal UI (password fields, provided badges, auto-generate hints)
- Add pairing request UI on active WASM channel cards
- Show "Restart to activate" label instead of Activate button for WASM channels
Co-authored-by: Claude Opus 4.6 <[email protected]>
Prevent personal memory (MEMORY.md) from leaking into group chat contexts
by adding system_prompt_for_context(is_group_chat) to the workspace. Add
channel-specific formatting hints (Discord, Telegram, Slack, WhatsApp),
runtime metadata injection, group chat behavioral guidance with NO_REPLY
silent token, safety rules in the system prompt, tool call style guidance,
wrap_external_content() for untrusted data, and improved workspace seed
files with richer identity/soul/agent templates and heartbeat checklist.
Co-authored-by: Claude Opus 4.6 <[email protected]>
- Add docs/LLM_PROVIDERS.md with setup instructions for all supported providers
- Expand .env.example with Together AI and Fireworks AI example configs
- Add "Alternative LLM Providers" section to README with quickstart snippet
Co-authored-by: Claude Sonnet 4.6 <[email protected]>
Co-authored-by: firat.sertgoz <[email protected]>
* feat: add HTML-to-Markdown conversion for web content
- Add readabilityrs for content extraction
- Add html-to-markdown for conversion
- Feature-gated behind html-markdown flag
- Integrates with HTTP tool response handling
- Includes comprehensive tests and examples
Closes#106
* Update comments for is_html_response helper and fix tests to not fail silently in certain instances
---------
Co-authored-by: Zach Frederick <[email protected]>
Co-authored-by: Illia Polosukhin <[email protected]>
* feat: embedded registry catalog and WASM bundle install pipeline
Embed registry manifests at compile time so the extension catalog is
available without network access. Add tar.gz bundle support for WASM
extension downloads (tools and channels), a /api/extensions/registry
endpoint, CI job to build and publish WASM bundles on release, and
ephemeral in-memory secrets fallback so the extension manager works
even without a persistent secrets store.
Key changes:
- build.rs: collect registry/*.json into embedded_catalog.json at compile time
- src/registry/embedded.rs + catalog.rs: load embedded or on-disk catalog
- src/extensions/manager.rs: download_and_install_wasm handles tar.gz bundles,
bare .wasm files, and separate capabilities downloads; wasm channel install
- src/channels/web/server.rs: /api/extensions/registry endpoint + no-cache headers
- src/app.rs: ephemeral InMemorySecretsStore fallback for extension manager
- registry/*.json: populate artifact download URLs for release bundles
- .github/workflows/release.yml: build-wasm-extensions CI job
- Simplified setup wizard and CLI registry commands
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: address PR review — archive hardening, decompression bomb guard, test fix
- Add 100 MB decompressed entry size cap to tar.gz extraction in both
manager.rs and installer.rs to prevent decompression bombs
- Add archive.set_preserve_permissions(false) and set_unpack_xattrs(false)
for defense-in-depth against malicious archives
- Fix test assertion logic in catalog.rs (|| → || with correct negation)
- Replace silent tar fallback in CI with explicit if/else for capabilities
- Add warning when installing without SHA256 verification
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: resolve clippy warning in settings.rs and enforce zero-warnings policy
Use struct initializer with ..Default::default() instead of field
reassignment. Update CLAUDE.md to codify zero clippy warnings policy —
all warnings must be fixed before committing, including pre-existing ones.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: address PR review round 2 — build reliability, caps validation, naming
- build.rs: emit per-file rerun-if-changed for reliable content tracking;
fix bundles fallback to match BundlesFile shape ({"bundles":{}})
- embedded.rs: parse catalog once via OnceLock instead of double-parsing
- manager.rs + installer.rs: add 1 MB size cap on capabilities_url downloads
with proper error surfacing
- secrets/store.rs: rename misleading `pub mod testing` to `pub mod in_memory`
- server.rs: track installed extensions by (name, kind) tuple to avoid
false positives across different extension kinds
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* feat: show token usage, cost tracker, and uptime in gateway status popover
The "Connected" hover popover in the web gateway now displays three
sections: connection info (SSE/WS counts, uptime), daily cost tracker
(spend + actions/hr), and per-model token usage (input/output counts
with cost per model). Also fixes the field name mismatch between the
backend response and JS rendering that prevented the popover from
showing correct data.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: address PR review — escape HTML in popover, add model_usage test
- Escape model name and cost strings with escapeHtml() before inserting
into innerHTML to prevent XSS via crafted model names
- Add test_model_usage_per_model_tracking test covering multi-model
token/cost accumulation in CostGuard
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
Add LLM_EXTRA_HEADERS env var (format: Key:Value,Key2:Value2) to inject
custom HTTP headers into every request to OpenAI-compatible endpoints.
This enables OpenRouter attribution headers (HTTP-Referer, X-Title)
and other service-specific headers without code changes.
Closes#179
Co-authored-by: Claude Opus 4.6 <[email protected]>
Co-authored-by: Illia Polosukhin <[email protected]>
* fix: move Logs to status bar and fix chat history ordering after restart
Move the Logs tab out of the main tab bar and into the right-side status
area as a compact pill button next to "Connected". Remove it from the
Ctrl+1-N shortcut order (now Ctrl+1-5).
Fix chat message ordering in libSQL backend: datetime('now') has only
second precision, so back-to-back user+assistant inserts got identical
timestamps causing non-deterministic ORDER BY. Now passes explicit
millisecond-precision timestamps and uses rowid as tiebreaker for
existing data.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor: separate WASM extensions from MCP servers on Extensions page
Reorganize the Extensions tab into 5 distinct sections: Installed
Extensions, Available WASM Extensions, Install WASM Extension (by
tar.gz URL), MCP Servers (with Add Custom form), and Registered Tools.
Registry entries are now filtered client-side by kind so WASM tools/
channels and MCP servers each have dedicated UI sections.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: adopt agent-market design language for web UI
Refresh the web gateway visual identity with a cleaner, modern aesthetic:
deeper blacks, green accent palette, DM Sans + IBM Plex Mono typography,
larger border-radii, glassmorphic navigation, refined hover effects,
pill badges, and green focus rings. CSS-only change plus Google Fonts.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* Update src/channels/web/static/style.css
Co-authored-by: Copilot <[email protected]>
* Update src/channels/web/static/style.css
Co-authored-by: Copilot <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
Co-authored-by: Copilot <[email protected]>
* feat: add smart routing provider for cost-optimized model selection
Route simple tasks (greetings, status checks, short questions) to a cheap
model (e.g. Haiku) and complex tasks (code generation, analysis) to the
primary model, reducing agent costs without sacrificing quality.
Activates automatically when NEARAI_CHEAP_MODEL is set. Cascade mode
retries uncertain cheap-model responses with the primary model.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: apply cargo fmt formatting
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor: extract provider chain into shared build_provider_chain()
Consolidate the duplicated LLM provider chain construction from main.rs
and app.rs into a single build_provider_chain() function in llm/mod.rs.
This fixes the inconsistency where app.rs was missing retry wrapping
that main.rs had, and ensures both paths apply identical decorators:
retry → smart routing → failover → circuit breaker → cache.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: address PR review — uncertainty detection and clippy lint
- Remove false-positive short response (<20 chars) uncertainty check
that would escalate "Yes.", "42" etc. Now only empty responses and
explicit uncertainty phrases trigger cascade escalation.
- Add #[allow(clippy::type_complexity)] to build_provider_chain() to
fix CI clippy -D warnings failure.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
Three high-impact changes eliminate most startup latency:
1. Enable wasmtime persistent compilation cache — call
cache_config_load_default() so compiled native code is serialized to
disk (~/.cache/wasmtime). Subsequent startups deserialize instead of
recompiling, dropping the WASM phase from ~13s to <1s.
2. Cache compiled Component in PreparedModule — store the compiled
wasmtime::component::Component directly instead of raw bytes.
Eliminates ~2.6s recompilation on every first tool/channel execution.
3. Move blocking housekeeping to background tasks — embedding backfill
(~1.3s of failing HTTP calls) and stale job cleanup are fire-and-forget
work that no longer blocks the critical startup path.
Also: deduplicate Workspace creation in main.rs (two identical instances
reduced to one), and replace leftover println! in session validation with
tracing calls.
Co-authored-by: Claude Opus 4.6 <[email protected]>
* refactor: consolidate tool approval into single param-aware method
Replace the two confusing approval methods (requires_approval() and
requires_approval_for()) with a single requires_approval(&self, params)
returning a 3-variant ApprovalRequirement enum (Never, UnlessAutoApproved,
Always). This enables param-aware approval decisions: HTTP calls without
auth headers now skip approval entirely, while authenticated requests
always require it. Shell tool merges its destructive-command detection
into the same method.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat: add credential injection to built-in HTTP tool
Wire the WASM credential injection system into the built-in HTTP tool
so credentials are auto-injected at the boundary (zero-exposure model).
- Add SharedCredentialRegistry: thread-safe, append-only registry of
credential mappings populated by WASM tools at registration time
- Add credential_detect module with broad auth detection for headers
(12 exact + 5 substring matches), header values (7 auth scheme
prefixes), and URL query params (17 exact + 5 substring matches)
- HttpTool now accepts optional credential registry + secrets store,
auto-injects matching credentials in execute(), and uses broader
auth detection in requires_approval()
- ToolRegistry passes credential registry to HttpTool at startup and
populates it when WASM tools register
- Remove old hardcoded AUTH_HEADER_NAMES / has_auth_headers in favor
of the new params_contain_manual_credentials()
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: address PR #274 review comments (query param injection, lock poisoning, visibility)
- Fix injected query params not being sent on outbound HTTP requests by
also calling .query() on the RequestBuilder alongside parsed_url mutation
- Recover from poisoned RwLock in SharedCredentialRegistry instead of
silently ignoring failures, with tracing::warn for visibility
- Narrow inject_credential and host_matches_pattern to pub(crate) to
avoid committing to them as stable public API
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
Show a shield indicator in the tab bar when the instance is running
inside a TEE deployment. On hover, fetches and displays the TDX
attestation report (image digest, TLS cert fingerprint, report data,
VM config) from the management API.
Co-authored-by: Cursor <[email protected]>
Nginx buffers responses by default, breaking SSE connections that go
through a reverse proxy. Add X-Accel-Buffering: no header to chat and
log SSE handlers to match what compose-api and chat-api already do.
* feat: direct agentic loop for SWE-bench benchmarks
Replace the full Agent-based runner with a purpose-built agentic loop
that directly calls the LLM with tools. The old path routed through
SafetyLayer (which blocked SWE-bench prompts), dispatcher (capped at
10 iterations), approval flow (wasted iterations), and 20+ irrelevant
builtin tools (diluted the model's focus).
New architecture:
- AgenticLoop: LLM call -> tool execution -> repeat (up to 30 iters)
- Per-task tool scoping via BenchSuite::task_tools() with working dirs
- Suite-provided system prompts via BenchSuite::system_prompt()
- No safety layer, no approval flow, no sessions/threads overhead
- Configurable max_iterations in BenchConfig and TOML
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: apply --model CLI override to LLM provider
The --model flag was updating matrix entry labels but not the actual
LLM provider, so requests were still sent using the model from .env.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat: configurable tool iterations and auto-approve for benchmarks
Add max_tool_iterations and auto_approve_tools settings to AgentConfig,
replacing the hardcoded MAX_TOOL_ITERATIONS constant. Fix shell_injection
policy rule to not block markdown backtick code snippets.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: address benchmarks crate audit findings
High:
- Fix truncate_output UTF-8 panic on multi-byte char boundaries
- Fix parallel results durability (write JSONL per-task, not after all)
Medium:
- Fix --sample to use random shuffle instead of first-N
- Delegate all LlmProvider methods in InstrumentedLlm
- Fix LLM-as-judge to return fail instead of misleading 0.5
- Remove unnecessary shallow clone (always gets unshallowed)
- Replace .unwrap() with .expect() in LazyLock regex init
Low:
- Remove dead code: unused error variants, trait methods, struct fields
- Remove BenchSuite::name() (redundant with id())
- Remove TaskSubmission::conversation, ConversationTurn, TurnRole
- Remove unused methods from BenchChannel, results, config
- Clean up ChannelCapture conversation tracking
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat: add SWE-bench dataset and Docker scoring infrastructure
Add the SWE-bench Lite dataset (300 tasks) and Docker files for
isolated test execution and scoring of SWE-bench patches.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* chore: remove benchmarks (extracted to separate repo)
Benchmarks crate has been extracted to its own repository.
Remove the workspace member and all benchmarks/ files.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: add missing AgentConfig fields in test initializer
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix: strip reasoning from LLM responses and persist assistant messages reliably
- Filter out `type: "reasoning"` output items from NEAR AI Responses API
parsing so chain-of-thought never reaches the UI (nearai.rs)
- Rewrite clean_response with regex-based tag stripping that is
code-aware (preserves tags inside fenced blocks and inline backticks),
supports 9+ tag names (think, thought, reasoning, reflection, etc.),
handles <final> extraction, pipe-delimited tags, and case/whitespace
tolerance (reasoning.rs)
- Add Reasoning::complete() helper so all non-agentic LLM call sites
(summarize, suggest, heartbeat, compaction) get automatic response
cleaning; thread SafetyLayer through to those callers
- Change persist_turn from fire-and-forget tokio::spawn to awaited async
so both user and assistant messages are written before returning,
preventing data loss on shutdown/restart
- Pass input_count through seed_response_chain so response chaining
delta calculation is accurate after thread hydration on restart
- Make NearAiResponse.usage optional and preserve response_id in alt
response path for chaining continuity
- Persist session token to DB during onboarding wizard so runtime
loads it without legacy-key fallback; suppress spurious warning on
fresh installs
- Fix dev tool double-registration when builder already registers them
- Load dotenv/ironclaw env for doctor and status subcommands
- Reduce startup log noise (demote info→debug for skills, remove
redundant info lines)
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* Nudge to not loop over tools continuesly
* refactor: remove Responses API, consolidate NEAR AI to Chat Completions only
The Responses API provider (nearai.rs, 1278 lines) added significant complexity
(response chaining state machine, delta message calculation, previous_response_id
persistence) for marginal benefit. This consolidates to the Chat Completions API
only, upgrading NearAiChatProvider with dual auth (session token + API key) and
401 retry for session token renewal.
- Delete src/llm/nearai.rs (Responses API provider)
- Upgrade nearai_chat.rs with SessionManager, dual auth, flexible list_models
- Remove response_id from CompletionResponse and ToolCompletionResponse
- Remove seed_response_chain/get_response_chain_id from LlmProvider trait
- Remove response chain persistence from agent (thread_ops, session)
- Remove NearAiApiMode enum and NEARAI_API_MODE config
- Clean up all wrapper providers (retry, circuit_breaker, failover, cache)
- Update documentation (CLAUDE.md, .env.example)
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat: runtime log level control via gateway UI and URL parameter
Add server-side log level switching using tracing_subscriber::reload::Layer
so the EnvFilter can be swapped at runtime without restarting. Expose via
GET/PUT /api/logs/level endpoints, a "Server: LEVEL" dropdown in the logs
toolbar, and a ?log_level=debug URL parameter for one-click activation.
Also applies cargo fmt to pre-existing files (llm/, tests/).
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix: persist WASM channel workspace writes across callbacks
WASM channel callbacks (polling, webhooks, on_start) call
workspace_write() to persist state, but the host code never committed
these writes — take_pending_writes() was never called. Additionally,
no WorkspaceReader was injected into channel capabilities, so
workspace_read() always returned None.
This caused Telegram's polling offset to reset to 0 on every tick,
making getUpdates re-deliver already-processed messages and producing
2-4 duplicate LLM responses per user message.
Add ChannelWorkspaceStore (Arc-wrapped HashMap with std::sync::RwLock)
that persists across callback invocations within a channel's lifetime.
Inject it as the WorkspaceReader and commit pending writes after every
callback execution (on_start, on_poll, on_http_request, execute_poll).
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: fix formatting
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
Each config test module (llm.rs, embeddings.rs) defined its own
ENV_MUTEX, which doesn't prevent cross-module env races since
cargo test runs in parallel. Move to a single shared mutex in
config/helpers.rs so all unsafe set_var/remove_var calls are
serialized crate-wide.
Closes#245
Co-authored-by: Claude Opus 4.6 <[email protected]>
The agentic loop injected fake user messages ("Please proceed and use
the available tools to complete this task.") when the LLM responded
with text instead of tool calls. This caused hallucinated conversations
during casual chat, 3x wasted LLM calls, and trust issues.
Remove the `resume_after_tool` parameter and `tools_executed` tracking
entirely. Text responses now return immediately, trusting the LLM to
decide when tools are needed (consistent with ZeroClaw and OpenClaw).
Closes#145
Co-authored-by: Claude Opus 4.6 <[email protected]>
* ci: add automated PR labeling system
Add two independent workflows for PR auto-labeling:
- Scope labels via actions/labeler (path glob matching)
- Size, risk, and contributor tier via custom shell script
Includes idempotent label bootstrap script (create-labels.sh).
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* ci: temporarily use pull_request trigger for testing
Switch to pull_request so workflows run from the PR branch.
Will revert to pull_request_target before merge.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix(ci): use absolute path for search/issues API call
gh api requires a leading slash for REST endpoints.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix(ci): use gh pr list instead of search API for contributor count
The search/issues API returns 404 with the default GITHUB_TOKEN.
gh pr list --state merged works with standard permissions.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* ci: revert to pull_request_target for fork PR support
Restore pull_request_target trigger and base branch checkout
now that testing is complete.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix: incremental settings persistence and remote server auth (#185, #186)
Persist settings after each wizard step so failures don't lose prior
progress. Load existing settings on re-run to recover from partial
onboarding. Add manual token paste option for remote/headless servers
where browser OAuth is unreachable, and support IRONCLAW_OAUTH_CALLBACK_URL
for custom callback URLs. Color prompt output (green/red/blue prefixes).
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: replace session token paste with API key entry, address PR review
Replace option 4 in NEAR AI auth menu from session token paste to NEAR
AI Cloud API key entry (cloud.near.ai). Also address all PR review
feedback: restrict .env file permissions to 0o600, mask API key input
with secret_input, fix libsql loaded flag in try_load_existing_settings,
add ENV_MUTEX to oauth_defaults tests, and add NEARAI_API_KEY to secrets
injection.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: deduplicate keys in upsert_bootstrap_var
When the .env file contains duplicate keys (e.g. from manual editing),
only write the replacement once and skip subsequent duplicates.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: NEARAI_SESSION_TOKEN env var takes precedence over file-based tokens
Hosting providers inject session tokens via env var and expect them to
be used directly. Previously the env var was only picked up when no
session file existed and was treated as a legacy migration. Now the env
var always wins, without persisting to disk.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* docs: distinguish NEAR AI Chat and NEAR AI Cloud providers
Split documentation into two clearly named modes:
- NEAR AI Chat: Responses API at private.near.ai, session token auth
- NEAR AI Cloud: Chat Completions API at cloud-api.near.ai, API key auth
Update default base URLs so each mode points to its correct endpoint.
Update .env.example, deploy/env.example, CLAUDE.md, setup spec, and
code comments across config/llm.rs, nearai.rs, nearai_chat.rs, mod.rs.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: wizard recovery ordering — load DB before persist, fresh choices win
Previously, persist_after_step() ran after Step 1 but before
try_load_existing_settings(), bulk-upserting defaults that clobbered
prior settings. Additionally, merge_from gave stale DB values
precedence over fresh Step 1 choices.
Fix: snapshot Step 1 settings, load DB, then re-apply the snapshot.
This ensures prior progress (steps 2-7) is recovered while fresh
Step 1 choices override stale DB values.
Add two tests verifying wizard recovery merge ordering.
Addresses PR review comments from Copilot on wizard.rs:150,
wizard.rs:1607, and wizard.rs:1626.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: fix rustfmt formatting in config/llm.rs
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: collapse nested if per clippy collapsible_if lint
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: use print_success for API key confirmation, fix menu spacing
- Use print_success() for colored output consistency in api_key_login
- Fix box-drawing alignment: options 1-2 had an extra trailing space
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix: parallelize tool call execution via JoinSet (#219)
When the LLM returns multiple tool_calls in a single response, they were
executed sequentially. This change makes both the worker and dispatcher
paths concurrent using tokio::task::JoinSet, so N independent tool calls
complete in ~max(latency) instead of sum(latency).
Worker path: migrate execute_tools_parallel from join_all to JoinSet and
route the respond_with_tools branch through the same parallel path.
Dispatcher path: restructure the while-idx loop into three phases —
preflight (sequential approval/hook checks), parallel execution via
JoinSet, and sequential post-flight processing (session recording,
auth detection, sanitization).
Also fixes a pre-existing infinite loop bug where hook rejection used
`continue` inside a `while idx` loop, skipping `idx += 1` and retrying
the same rejected tool forever.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: address PR review — ordered results, deferred auth, dedup standalone fn
- Fix auth early return skipping unrecorded tool results: defer auth
response until after all results in the batch are recorded in session
history and context_messages (both dispatcher and thread_ops paths)
- Fix tool results appearing out of order: collect Phase 1 hook
rejections indexed by original position, merge with Phase 2 execution
results, and emit all in Phase 3 in original tool_calls order
- Deduplicate execute_chat_tool: Agent method now delegates to the
standalone function instead of duplicating 90 lines of logic
- Fix benchmark compilation: add missing session_manager arg to Agent::new
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: rustfmt alignment for CI compatibility
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: address second round of PR review comments
- Distinguish JoinError panic vs cancellation in log messages and error
reasons across all 3 files (dispatcher, thread_ops, worker)
- Simplify deferred_auth from Option<(String, String)> to Option<String>
since only the instructions string is used
- Add single-tool short-circuit in worker execute_tools_parallel to
avoid JoinSet overhead for the common single-tool case
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
Drain stdout and stderr concurrently with child.wait() using tokio::join
to prevent deadlocks when command output exceeds the OS pipe buffer
(64KB on Linux, 16KB on macOS).
Use AsyncReadExt::take() for memory-bounded reads and
tokio::io::copy to sink for draining excess output.
Add regression test that generates 128KB of output to verify the
fix prevents deadlocks.
Agent::new gained an 8th parameter (session_manager) but the benchmark
runner was not updated, breaking compilation of the bench crate.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: persist turns after approval and add agent-level tests
Port relevant changes from PR #112 that were not carried over to #237:
- Add persist_turn calls in process_approval for the response, error,
and auth-required paths. Previously, turns completed after tool
approval were never persisted to DB — if the process crashed after
approval the entire turn (user message + assistant response) was lost.
- Add agent-level unit tests: StaticLlmProvider mock, make_test_agent
helper, tests for auto-approval logic, destructive shell command
detection, and PendingApproval backward-compatible deserialization
(without deferred_tool_calls field).
- Remove unused _thread_state binding in process_approval.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: address 14 audit findings in src/agent/
Audit of the agent module found 2 High, 7 Medium, 3 Low, and 2 Nit
severity issues. This commit fixes all of them:
High:
- Remove 4 `.expect()` calls in session.rs (entry API, match, direct
indexing, if-let) to eliminate panic paths in production
- Add typed RoutineError enum replacing Result<_, String> across
routine.rs, routine_engine.rs, and callers in history/store.rs and
db/libsql/mod.rs
Medium:
- Sanitize routine names in path construction to prevent directory
traversal (routine_engine.rs)
- Log warnings for 5 silently-swallowed errors in scheduler.rs,
compaction.rs, and worker.rs
- Extract shared handle_auth_intercept helper to deduplicate auth
interception in thread_ops.rs
- Add session count warning threshold in session_manager.rs
- Make FullJob stub degradation visible via warn-level log and
prepended warning in output
Low:
- Restrict dead code visibility with #[cfg(test)] on 19 unused items
in submission.rs, task.rs, and undo.rs
- Narrow pub to pub(crate) on self_repair.rs builder methods
- Remove TaskStatus from mod.rs re-exports (test-only type)
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: address PR review comments
- Reorder persist_turn before persist_response_chain so the
conversation row exists before the metadata UPDATE runs
- Add persist_response_chain call to handle_auth_intercept so
auth-required paths preserve the response chain
- Harden sanitize_routine_name to use allowlist (alphanumeric,
dash, underscore) instead of denylist replacements
- Fix stale active_thread ID in get_or_create_thread: fall back
to create_thread() when the stored ID is missing from the map
- Persist turn on approval rejection so user messages survive
crashes after a tool is rejected
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* feat: add extension registry with metadata catalog, CLI, and onboarding integration
Adds a central registry that catalogs all 14 available extensions (10 tools,
4 channels) with their capabilities, auth requirements, and artifact references.
The onboarding wizard now shows installable channels from the registry and
offers tool installation as a new Step 7.
- registry/ folder with per-extension JSON manifests and bundle definitions
- src/registry/ module: manifest structs, catalog loader, installer
- `ironclaw registry list|info|install|install-defaults` CLI commands
- Setup wizard enhanced: channels from registry, new extensions step (8 steps)
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix(setup): resolve workspace errors for tool crates and channels-only onboarding
Tool crates in tools-src/ and channels-src/ failed `cargo metadata` during
onboard install because Cargo resolved them as part of the root workspace.
Add `[workspace]` table to each standalone crate and extend the root
`workspace.exclude` list so they build independently.
Channels-only mode (`onboard --channels-only`) failed with "Secrets not
configured" and "No database connection" because it skipped database and
security setup. Add `reconnect_existing_db()` to establish the DB connection
and load saved settings before running channel configuration.
Also improve the tunnel "already configured" display to show full provider
details (domain, mode, command) instead of just the provider name.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix(registry): address PR review feedback on installer and catalog
- Use manifest.name (not crate_name) for installed filenames so
discovery, auth, and CLI commands all agree on the stem (#1)
- Add AlreadyInstalled error variant instead of misleading
ExtensionNotFound (#2)
- Add DownloadFailed error variant with URL context instead of
stuffing URLs into PathBuf (#3)
- Validate HTTP status with error_for_status() before reading
response bytes in artifact downloads (#4)
- Switch build_wasm_component to tokio::process::Command with
status() so build output streams to the terminal (#6)
- Find WASM artifact by crate_name specifically instead of picking
the first .wasm file in the release directory (#7)
- Add is_file() guard in catalog loader to skip directories (#8)
- Detect ambiguous bare-name lookups when both tools/<name> and
channels/<name> exist, with get_strict() returning an error (#9)
- Fix wizard step_extensions to check tool.name for installed
detection, consistent with the new naming (#11, #12)
- Fix redundant closures and map_or clippy warnings in changed files
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix(setup): restore DB connection fields after settings reload
reconnect_postgres() and reconnect_libsql() called Settings::from_db_map()
which overwrote database_url / libsql_path / libsql_url set from env vars.
Also use get_strict() in cmd_info to surface ambiguous bare-name errors.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: fix clippy collapsible_if and print_literal warnings
Collapse nested if-let chains and inline string literals in format
macros to satisfy CI clippy lint checks (deny warnings).
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix(registry): prefer artifacts for install-defaults and improve dir lookup
- InstallDefaults now defaults to downloading pre-built artifacts
(matching `registry install` behavior), with --build flag for source builds.
- find_registry_dir() walks up 3 ancestor levels from the exe and adds
a CARGO_MANIFEST_DIR fallback, matching load_registry_catalog() logic.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
