* feat(llm): add smart model routing based on request complexity
Automatically selects optimal model tier (flash/standard/pro/frontier) for each
request based on 13-dimension complexity scoring:
- Reasoning words, multi-step signals, code indicators
- Domain-specific terms, creativity, precision
- Safety sensitivity, tool likelihood, question complexity
- Token estimate, context dependency, sentence complexity
Features:
- Pattern overrides for fast-path routing (greetings → flash, security audits → frontier)
- Configurable tier-to-model mappings (defaults to -latest aliases)
- Thinking mode per tier (pro: low, frontier: medium)
- User-configurable pattern overrides
- Zero-config for default benefits, full control for power users
Expected cost savings: 50-70% vs always-using-frontier baseline.
Refs: smart-routing-spec.md
* fix(routing): address Gemini Code Assist review feedback
- Add tracing warnings for invalid tier/regex in user overrides (router.rs)
- Use unreachable!() for tier hint match since regex enforces valid tiers (scorer.rs)
- Refactor weighted total to array iteration for maintainability (scorer.rs)
- Add TODO for making domain keywords configurable (scorer.rs)
Refs: PR #208
* feat(routing): make domain keywords configurable
- Add ScorerConfig with optional domain_keywords field
- Add DEFAULT_DOMAIN_KEYWORDS constant (exported for reference)
- Add domain_keywords to RouterConfig for top-level configuration
- Build domain regex at runtime from config, fallback to defaults
- Add score_complexity_with_config() function
- Add test for custom domain keywords
Users can now provide project-specific keywords:
RouterConfig {
domain_keywords: Some(vec!["mycompany".into(), "myproduct".into()]),
..Default::default()
}
Addresses Gemini Code Assist review feedback on PR #208.
Tests: 20/20 passing
* docs: add domain_keywords to routing config example
* feat: integrate 13-dimension complexity scorer into smart routing (takeover #208)
Folds the 13-dimension complexity scorer and pattern overrides from PR #208
into the existing SmartRoutingProvider, replacing the simpler keyword-based
classifier. Adds 4-tier system (Flash/Standard/Pro/Frontier), configurable
scorer weights, domain keywords, regex pattern overrides, tier hints, and
multi-dimensional boost. Removes separate routing/ directory and lazy_static
dependency in favor of std::sync::LazyLock. Includes 44 tests covering all
scoring dimensions, tier boundaries, pattern overrides, and provider routing.
Co-Authored-By: onlyamicrowave <[email protected]>
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: address review feedback on smart routing PR (#529)
- Cache compiled domain regex in SmartRoutingProvider (built once at
construction, not per-request) and add score_complexity_with_regex() API
- Check explicit tier hints before pattern overrides so user intent wins
(e.g. "[tier:flash] security audit" routes as Flash, not Frontier)
- Trim input before matching/scoring so trailing whitespace doesn't break
anchored override regexes or skew token-length scoring
- Fix token estimate comment (>=520 chars = 100, not >500)
- Update spec: check implementation plan boxes, fix file paths, add note
that llm.routing YAML schema is target design (current config uses env vars)
- Add regression tests for tier hint precedence and trimmed greeting matching
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: restore Cargo.lock from main to fix html_to_markdown test
The lockfile was fully regenerated during the PR #208 merge conflict
resolution, which bumped html-to-markdown-rs from 2.25.1 to 2.27.2.
The new version produces different output that breaks the golden-file
snapshot test. Restore the original lockfile from main — lazy_static
was never in main's lockfile, so no further changes needed.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: address second round of review feedback (#529)
- Tighten quick-lookup override regex with end anchor to prevent matching
complex questions like "What time complexity is merge sort?"
- Handle empty domain keywords list by falling back to defaults instead of
producing a broken regex that matches empty strings everywhere
- Clarify spec architecture diagram: current impl uses 2-provider split
(cheap/primary), per-tier model mapping is target design
- Add regression tests for both fixes
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Microwave <[email protected]>
Co-authored-by: Joe <[email protected]>
Co-authored-by: onlyamicrowave <[email protected]>
Co-authored-by: Claude Opus 4.6 <[email protected]>
* refactor: extract shared assertion helpers to support/assertions.rs
Move 5 assertion helpers from e2e_spot_checks.rs to a shared module.
Add assert_all_tools_succeeded and assert_tool_succeeded for eliminating
false positives in E2E tests.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat: add tool output capture via tool_results() accessor
Extract (name, preview) from ToolResult status events in TestChannel
and TestRig, enabling content assertions on tool outputs.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: correct tool parameters in 3 broken trace fixtures
- tool_time.json: add missing "operation": "now" for time tool
- robust_correct_tool.json: same fix
- memory_full_cycle.json: change "path" to "target" for memory_write
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: add tool success and output assertions to eliminate false positives
Every E2E test that exercises tools now calls assert_all_tools_succeeded.
Added tool output content assertions where tool results are predictable
(time year, read_file content, memory_read content).
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat: capture per-tool timing from ToolStarted/ToolCompleted events
Record Instant on ToolStarted and compute elapsed duration on
ToolCompleted, wiring real timing data into collect_metrics() instead
of hardcoded zeros.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor: add RAII CleanupGuard for temp file/dir cleanup in tests
Replace manual cleanup_test_dir() calls and inline remove_file() with
Drop-based CleanupGuard that ensures cleanup even if a test panics.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: add Drop impl and graceful shutdown for TestRig
Wrap agent_handle in Option so Drop can abort leaked tasks. Signal
the channel shutdown before aborting for future cooperative shutdown.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: replace agent startup sleep with oneshot ready signal
Use a oneshot channel fired in Channel::start() instead of a fixed
100ms sleep, eliminating the race condition on slow systems.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: replace fragile string-matching iteration limit with count-based detection
Use tool completion count vs max_tool_iterations instead of scanning
status messages for "iteration"/"limit" substrings.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: use assert_all_tools_succeeded for memory_full_cycle test
Remove incorrect comment about memory_tree failing with empty path
(it actually succeeds). Omit empty path from fixture and use the
standard assert_all_tools_succeeded instead of per-tool assertions.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor: promote benchmark metrics types to library code
Move TraceMetrics, ScenarioResult, RunResult, MetricDelta, and
compare_runs() from tests/support/metrics.rs to src/benchmark/metrics.rs.
Existing tests use re-export for backward compatibility.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat: add Scenario and Criterion types for agent benchmarking
Scenario defines a task with input, success criteria, and resource
limits. Criterion is an enum of programmatic checks (tool_used,
response_contains, etc.) evaluated without LLM judgment.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat: add initial benchmark scenario suite (12 scenarios across 5 categories)
Scenarios cover tool_selection, tool_chaining, error_recovery,
efficiency, and memory_operations. All loaded from JSON with
deserialization validation test.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat: add benchmark runner with BenchChannel and InstrumentedLlm
BenchChannel is a minimal Channel implementation for benchmarks.
InstrumentedLlm wraps any LlmProvider to capture per-call metrics.
Runner creates a fresh agent per scenario, evaluates success criteria,
and produces RunResult with timing, token, and cost metrics.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat: add baseline management, reports, and benchmark entry point
- baseline.rs: load/save/promote benchmark results
- report.rs: format comparison reports with regression detection
- benchmark_runner.rs: integration test with real LLM (feature-gated)
- Add benchmark feature flag to Cargo.toml
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: apply cargo fmt to benchmark module
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat(benchmark): add multi-turn scenario types with setup, judge, ResponseNotContains
Add BenchScenario, Turn, TurnAssertions, JudgeConfig, ScenarioSetup,
WorkspaceSetup, SeedDocument types for multi-turn benchmark scenarios.
Add ResponseNotContains criterion variant. Add TurnAssertions::to_criteria()
converter for backward compat with existing evaluation engine.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat(benchmark): add JSON scenario loader with recursive discovery and tag filter
Add load_bench_scenarios() for the new BenchScenario format with recursive
directory traversal and tag-based filtering. Create 4 initial trajectory
scenarios across tool-selection, multi-turn, and efficiency categories.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat(benchmark): multi-turn runner with workspace seeding and per-turn metrics
Add run_bench_scenario() that loops over BenchScenario turns, seeds workspace
documents, collects per-turn metrics (tokens, tool calls, wall time), and
evaluates per-turn assertions. Add TurnMetrics to metrics.rs and
clear_for_next_turn() to BenchChannel.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat(benchmark): add LLM-as-judge scoring with prompt formatting and score parsing
Create judge.rs with format_judge_prompt, parse_judge_score, and judge_turn.
Wire into run_bench_scenario for turns with judge config -- scores below
min_score fail the turn.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat(benchmark): add CLI subcommand (ironclaw benchmark)
Add BenchmarkCommand with --tags, --scenario, --no-judge, --timeout,
--update-baseline flags. Wire into Command enum and main.rs dispatch.
Feature-gated behind benchmark flag.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat(benchmark): per-scenario JSON output with full trajectory
Add save_scenario_results() that writes per-scenario JSON files alongside
the run summary. Each scenario gets its own file with turn_metrics trajectory.
Update CLI to use new output format.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat(benchmark): add ToolRegistry::retain_only and wire tool filtering in scenarios
Add a retain_only() method to ToolRegistry that filters tools down to a
given allowlist. Wire this into run_bench_scenario() so that when a
scenario specifies a tools list in its setup, only those tools are
available during the benchmark run. Includes two tests for the new
method: one verifying filtering works and one verifying empty input
is a no-op.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat(benchmark): wire identity overrides into workspace before agent start
Add seed_identity() helper that writes identity files (IDENTITY.md,
USER.md, etc.) into the workspace before the agent starts, so that
workspace.system_prompt() picks them up. Wire it into
run_bench_scenario() after workspace seeding. Include a test that
verifies identity files are written and readable.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat(benchmark): add --parallel and --max-cost CLI flags
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix(benchmark): use feature-conditional snapshot names for CLI help tests
Prevents snapshot conflicts between default (no benchmark) and
all-features (with benchmark) builds by using separate snapshot names
per feature set.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat(benchmark): parallel execution with JoinSet and budget cap enforcement
Replace sequential loop in run_all_bench() with parallel execution using
JoinSet + semaphore when config.parallel > 1. Add budget cap enforcement
that skips remaining scenarios when max_total_cost_usd is exceeded.
Track skipped count in RunResult.skipped_scenarios and display it in
format_report().
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat(benchmark): add tool restriction and identity override test scenarios
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* chore: fix formatting for Phase 3
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat(benchmark): add SkillRegistry::retain_only and wire skill filtering in scenarios
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat(benchmark): add --json flag for machine-readable output
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* ci: add GitHub Actions benchmark workflow (manual trigger)
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor(benchmark): remove in-tree benchmark harness, keep retain_only utilities
Move benchmark-specific code out of ironclaw in preparation for the
nearai/benchmarks trajectory adapter. This removes:
- src/benchmark/ (runner, scenarios, metrics, judge, report, etc.)
- src/cli/benchmark.rs and the Benchmark CLI subcommand
- benchmarks/ data directory (scenarios + trajectories)
- .github/workflows/benchmark.yml
- The "benchmark" Cargo feature flag
What remains:
- ToolRegistry::retain_only() and SkillRegistry::retain_only()
- Test support types (TraceMetrics, InstrumentedLlm) inlined into
tests/support/ instead of re-exporting from the deleted module
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* docs: add README for LLM trace fixture format
Documents the trajectory JSON format, response types, request hints,
directory structure, and how to write new traces.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* feat(test): unify trace format around turns, add multi-turn support
Introduce TraceTurn type that groups user_input with LLM response steps,
making traces self-contained conversation trajectories. Add run_trace()
to TestRig for automatic multi-turn replay. Backward-compatible: flat
"steps" JSON is deserialized as a single turn transparently.
Includes all trace fixtures (spot, coverage, advanced), plan docs, and
new e2e tests for steering, error recovery, long chains, memory, and
prompt injection resilience.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix(test): fix CI failures after merging main
- Fix tool_json fixture: use "data" parameter (not "input") to match
JsonTool schema
- Fix status_events test: remove assertion for "time" tool that isn't
in the fixture (only "echo" calls are used)
- Allow dead_code in test support metrics/instrumented_llm modules
(utilities for future benchmark tests)
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* Working on recording traces and testing them
* feat(test): add declarative expects to trace fixtures, split infra tests
Add TraceExpects struct with 9 optional assertion fields (response_contains,
tools_used, all_tools_succeeded, etc.) that can be declared in fixture JSON
instead of hand-written Rust. Add verify_expects() and run_recorded_trace()
so recorded trace tests become one-liners.
Split trace infra tests (deserialization, backward compat) into
tests/trace_format.rs which doesn't require the libsql feature gate.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor(test): add expects to all trace fixtures, simplify e2e tests
Add declarative expects blocks to all 19 trace fixture JSONs across
spot/, coverage/, advanced/, and root directories. Update all 8 e2e
test files to use verify_trace_expects() / run_and_verify_trace(),
replacing ~270 lines of hand-written assertions with fixture-driven
verification.
Tests that check things beyond expects (file content on disk, metrics,
event ordering) keep those extra assertions alongside the declarative
ones.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix(test): adapt tests to AppBuilder refactor, fix formatting
Update test files to work with refactored TestRigBuilder that uses
AppBuilder::build_all() (removing with_tools/with_workspace methods).
Update telegram_check fixture to use tool_list instead of echo.
Fix cargo fmt issues in src/llm/mod.rs and src/llm/recording.rs.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor(test): deduplicate support unit tests into single binary
Support modules (assertions, cleanup, test_channel, test_rig, trace_llm)
had #[cfg(test)] mod tests blocks that were compiled and run 12 times —
once per e2e test binary that declares `mod support;`. Extracted all 29
support unit tests into a dedicated `tests/support_unit_tests.rs` so they
run exactly once.
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: fix trailing newlines in support files
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor(test): unify trace types and fix recorded multi-turn replay
Import shared types (TraceStep, TraceResponse, TraceToolCall, RequestHint,
ExpectedToolResult, MemorySnapshotEntry, HttpExchange*) from
ironclaw::llm::recording instead of redefining them in trace_llm.rs.
Fix the flat-steps deserializer to split at UserInput boundaries into
multiple turns, instead of filtering them out and wrapping everything
into a single turn. This enables recorded multi-turn traces to be
replayed as proper multi-turn conversations via run_trace().
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix(test): fix CI failures - unused imports and missing struct fields
- Add #[allow(unused_imports)] on pub use re-exports in trace_llm.rs
(types are re-exported for downstream test files, not used locally)
- Add `..` to ToolCompleted pattern in test_channel.rs to match new
`error` and `parameters` fields
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix(test): fix CI failures after merging main
- Add missing `error` and `parameters` fields to ToolCompleted
constructors in support_unit_tests.rs
- Add `..` to ToolCompleted pattern match in support_unit_tests.rs
- Add #[allow(dead_code)] to CleanupGuard, LlmTrace impl, and
TraceLlm impl (only used behind #[cfg(feature = "libsql")])
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* Adding coverage running script
* fix(test): address review feedback on E2E test infrastructure
- Increase wait_for_responses polling to exponential backoff (50ms-500ms)
and raise default timeout from 15s to 30s to reduce CI flakiness (#1)
- Strengthen prompt_injection_resilience test with positive safety layer
assertion via has_safety_warnings(), enable injection_check (#2)
- Add assert_tool_order() helper and tools_order field in TraceExpects
for verifying tool execution ordering in multi-step traces (#3)
- Document TraceLlm sequential-call assumption for concurrency (#6)
- Clean up CleanupGuard with PathKind enum instead of shotgun
remove_file + remove_dir_all on every path (#8)
- Fix coverage.sh: default to --lib only, fix multi-filter syntax,
add COV_ALL_TARGETS option
- Add coverage/ to .gitignore
- Remove planning docs from PR
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: address PR review - use HashSet in retain_only, improve skill test
- Use HashSet for O(N+M) lookup in SkillRegistry::retain_only and
ToolRegistry::retain_only instead of linear scan
- Strengthen test_retain_only_empty_is_noop in SkillRegistry to
pre-populate with a skill before asserting the no-op behavior
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix(test): revert incorrect safety layer assertion in injection test
The safety layer sanitizes tool output, not user input. The injection
test sends a malicious user message with no tools called, so the safety
layer never fires. Reverted to the original test which correctly
validates the LLM refuses via trace expects. Also fixed case-sensitive
request hint ("ignore" -> "Ignore") to suppress noisy warning.
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: clean stale profdata before coverage run
Adds `cargo llvm-cov clean` before each run to prevent
"mismatched data" warnings from stale instrumentation profiles.
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: fix formatting in retain_only test
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
Co-authored-by: Illia Polosukhin <[email protected]>
* feat: route OAuth callbacks through web gateway for hosted instances
On hosted instances (e.g., NEAR AI), OAuth callbacks can't reach the
local TCP listener on port 9876. This adds a gateway-routed OAuth flow
that works behind reverse proxies and load balancers.
Backend changes:
- Add /oauth/callback as a public route on the web gateway
- PendingOAuthFlow registry shared between ExtensionManager and handler
- Gateway mode auto-detected via IRONCLAW_OAUTH_CALLBACK_URL env var
- Platform state format (instance:nonce) for nginx routing
- Token exchange proxy support via IRONCLAW_OAUTH_EXCHANGE_URL
- Local TCP listener mode preserved as backward-compatible fallback
UX improvements:
- Hide Configure button for tools with auto-resolved OAuth credentials
(builtin defaults or platform-injected env vars)
- Skip client_id/client_secret fields in setup schema when auto-resolved
- Show Reconfigure only after successful authentication
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix(oauth): harden gateway callback and refactor AuthResult
- Add 60s timeout to exchange_via_proxy HTTP client (matching exchange_oauth_code)
- Read GATEWAY_AUTH_TOKEN once at ExtensionManager construction instead of
per-flow from env (prevents coupling and clarifies token provenance)
- Extract oauth_error_page() helper to deduplicate error landing pages
- Remove IRONCLAW_FORCE_GATEWAY_CALLBACK env var (auto-detection suffices)
- Refactor AuthResult into typed AuthStatus enum with constructors,
eliminating stringly-typed status and Option fields that were always None
- Adapt all handlers (chat, extensions, ws) to new AuthResult/AuthStatus API
- Use setup_url (not validation_endpoint) for awaiting_token responses
[skip-regression-check]
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
* fix(oauth): address review feedback — empty token guard, test flakiness, doc typos
- Fail early in exchange_via_proxy() when gateway_token is empty instead
of sending an unauthenticated request to the exchange proxy
- Fix test_oauth_callback_strips_instance_prefix to use an expired flow
so it never attempts a real HTTP token exchange (prevents CI flakiness)
- Fix doc comments: /auth/callback → /oauth/callback in PendingOAuthFlow
and ExtensionManager pending_oauth_flows docs
[skip-regression-check]
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
* fix: clarify strip_instance_prefix safety, wrapper credential fix, test assertion
- Add comment to strip_instance_prefix noting nonces are base64url (no colons)
- Expand wrapper.rs comment explaining the credential_user_id bug fix
- Fix test_oauth_callback_strips_instance_prefix assertion: landing_html
does not include provider_name on error pages
[skip-regression-check]
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
* feat(web): show error details and input params for failed tool calls
Failed tool calls in the gateway UI previously showed only a red X icon
with an empty expandable body. This change:
- Adds optional `error` and `parameters` fields to `ToolCompleted` SSE
events so the browser receives failure details in real-time
- Auto-expands failed tool cards to make errors immediately visible
- Adds `StatusUpdate::tool_completed()` constructor that centralizes
the 5 duplicated construction sites and applies `redact_params()` to
prevent sensitive values (e.g. secret_save's "value" param) from
leaking through SSE broadcasts
- Adds `sensitive_params()` trait method to `Tool` for declaring which
parameters must be redacted before logging, hooks, and UI display
- Adds `redact_params()` utility and wires it through hooks, approvals,
ActionRecord storage, and debug logs in dispatcher/worker
- Adds `SecretListTool` and `SecretDeleteTool` for LLM-driven secret
management (values never returned, only names/metadata)
- Fixes auth flow: setup-only extensions show configure modal instead
of OAuth card; auth_completed SSE dismisses both UI paths
- CI: release workflow creates PR instead of pushing directly to main
- Registry: MissingChecksum error enables source fallback for
bootstrapping when checksums haven't been populated yet
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* style: apply cargo fmt
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix: keep original params in PendingApproval for execution, redact only for display
Address two PR review comments:
1. execute_chat_tool_standalone now redacts sensitive params before logging,
matching the pattern already used in worker.rs.
2. PendingApproval previously stored redacted parameters, which meant
approved tool calls received "[REDACTED]" instead of the actual values.
Add a display_parameters field for UI/logs and keep parameters as the
original values used for execution.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix: address PR review comments
- worker.rs: redact sensitive params before BeforeToolCall hook, matching
dispatcher.rs — hooks in the autonomous job path now receive redacted
params instead of raw values
- registry.rs: fix docstring for register_secrets_tools (list, delete,
not save/list/delete — no SecretSaveTool is registered)
- app.js: fix double toast/loadExtensions in submitConfigureModal —
for non-OAuth success the auth_completed SSE already handles both,
so skip them in the HTTP response handler to avoid duplicates
[skip-regression-check]
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
* feat(extensions): add load-time validation for auth capabilities
Catch common misconfigurations (missing auth section, missing setup_url,
short prompts) at startup via tracing::warn instead of silently failing
at auth time.
* feat(extensions): improve auth prompts, setup_url, and showAuthCard
Add setup_url and descriptive prompts to channel and tool capabilities
files. Fix showAuthCard in web gateway and improve extension manager
auth flow messaging.
* refactor(extensions): extract MIN_PROMPT_LENGTH constant in validate()
Address review feedback: replace magic number 30 with a named constant
for readability and maintainability.
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix(security): restrict query-token auth to SSE endpoints only
Query-string `?token=xxx` auth was accepted on all endpoints, exposing
the main auth token in server logs, Referer headers, and browser history
for state-changing routes. Now only GET /api/chat/events and
GET /api/logs/events accept query tokens; all other endpoints require
the Authorization header.
Supersedes #364.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: add WebSocket endpoint to query-token allowlist, add URL-encoding tests
The WS upgrade at /api/chat/ws also can't set custom headers, so it
needs query-token auth like the SSE endpoints. Also adds tests for
URL-encoded token values to cover the form_urlencoded parser.
Addresses review feedback from Gemini (partially, /api/jobs/{id}/events
is a JSON endpoint not SSE, so it correctly stays excluded) and Copilot
(URL-encoded token test).
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix(wasm): coerce string parameters to schema-declared types
LLMs frequently pass numeric values as JSON strings ("5" instead of 5)
or booleans as strings ("true" instead of true). The WASM module's
serde deserializer rejects these type mismatches. This adds a
coerce_params_to_schema() helper that walks the params JSON object
and converts string values to their schema-declared types (number,
integer, boolean) before passing to the WASM module.
Adds 5 unit tests covering number, integer, boolean coercion,
already-correct types, and unparseable strings.
Closes#486
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor: use in-place mutation and case-insensitive boolean coercion
Address review feedback:
- Use get_mut instead of clone+insert to avoid allocations
- Make boolean coercion case-insensitive (handles "True", "FALSE", etc.)
- Expand boolean test to cover false and mixed-case values
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: cargo fmt
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: collapse nested if-let to satisfy clippy collapsible_if lint
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix(agent): strip leaked [Called tool ...] text from agent responses
When the NEAR AI provider flattens tool_call messages to plain text,
markers like [Called tool ...] and [Tool ... returned: ...] can leak
into the user-visible response if the LLM echoes them back. This adds
a sanitization step in the agentic loop's text response path that
strips these internal markers before returning. If stripping leaves
the response empty, a generic fallback message is returned instead.
Closes#487
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor: use fold instead of collect+join to avoid heap allocation
Address review feedback: replace Vec collect + join with fold to build
the filtered string directly, avoiding an intermediate heap allocation.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: cargo fmt
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
Co-authored-by: Pierre LE GUEN <[email protected]>
* fix(web): reset job list UI on restart failure
The restartJob() catch handler was missing a loadJobs() call, so the
job row stayed in a stale highlighted state after a failed restart
attempt. Add loadJobs() to match the success path behavior.
Closes#485
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor: use .finally() for loadJobs() instead of duplicating
Move loadJobs() to a .finally() block so it runs on both success and
failure without duplication.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
The pairing store called .unwrap() on path.parent() in three locations
(upsert_request, record_failed_approve, add_allow_from). If a path has
no parent (root path or empty), this panics — a potential denial-of-service
vector if an attacker can influence the path.
Added InvalidPath variant to PairingStoreError and replaced all three
.unwrap() calls with ok_or_else error propagation. This follows the
project's no-panics-in-production policy.
Locations fixed:
- upsert_request (line ~227)
- record_failed_approve (line ~322)
- add_allow_from (line ~465)
Co-authored-by: Claude Sonnet 4.6 <[email protected]>
* fix(web): use dvh units to prevent mobile browser bar from obscuring chat input
On mobile browsers (Brave/Android, Safari/iOS), the bottom navigation bar
covers the chat input because 100vh includes space behind browser chrome.
Switch to 100dvh (dynamic viewport height) with vh fallback for older
browsers, and add safe-area-inset padding for notched devices.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* Fix padding declaration in chat input style
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
Co-authored-by: Illia Polosukhin <[email protected]>
* fix(web): assign unique thread_id to manual routine triggers
Manual routine triggers via the web API created an IncomingMessage
without a thread_id, causing session_manager.resolve_thread() to
route the output to whatever thread was last associated with the
(user, "gateway", None) key. This sets a unique thread_id of the
form "routine-{id}-{timestamp}" so each manual trigger gets its own
dedicated thread.
Closes#484
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: add ownership check to routine trigger handler (IDOR)
Address review feedback: verify routine.user_id matches the
authenticated user before allowing the trigger, preventing
unauthorized cross-user routine execution.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: cargo fmt
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix(web): refresh routine UI after "Run Now" trigger
triggerRoutine() only showed a toast but did not refresh the routine
data after triggering. This adds openRoutineDetail() / loadRoutines()
calls after the toast, matching the pattern used by toggleRoutine().
Closes#483
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: only refresh detail view if triggered routine matches current view
Check currentRoutineId === id before refreshing the detail panel to
avoid refreshing the wrong routine's view.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix(web): use slug for skill download URL from ClawHub
The skill install handler was using req.name (display name like
"Markdown Converter") instead of the slug (like "owner/markdown-converter")
when constructing the download URL. The registry endpoint expects a slug,
so display names caused 502 errors.
- Add optional `slug` field to SkillInstallRequest
- Prefer slug over name when building the download URL
- JS installSkill() now sends slug from search results
Closes#482
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: guard against empty slug string in skill download URL
Filter out empty slug strings so we fall back to name instead of
constructing an invalid download URL.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: cargo fmt
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix(workspace): thread document path through search results
Memory search results were showing chunk UUIDs instead of source file
paths. Thread document_path through RankedResult, SearchResult, and the
RRF fusion pipeline so handlers can display the actual file path.
Fixes#481
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor: use into_iter to move values instead of cloning
Address review feedback: consume results with into_iter() to move
String fields directly instead of cloning them.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
Swap the order of import_from_directory() and seed_if_empty() so that
custom workspace templates from WORKSPACE_IMPORT_DIR take priority
over generic seeds. Previously, seed_if_empty() ran first and created
all default files, causing import_from_directory() to skip everything
since the files already existed in the DB.
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
* feat: add OAuth support for WASM tools in web gateway
Extract reusable OAuth functions (build_oauth_url, exchange_oauth_code,
store_oauth_tokens, validate_oauth_token) from CLI into shared
oauth_defaults module, then wire them into the web gateway's
ExtensionManager.
Key changes:
- Install auto-activates WASM tools (no separate Activate button)
- Configure button triggers OAuth flow via save_setup_secrets
- Scope merging: installing a second Google tool triggers re-auth with
merged scopes from all tools sharing the same secret_name
- Cancel-and-retry: aborting stale OAuth listeners prevents port conflicts
- Post-auth validation: wrong account detected via validation_endpoint
- Reconfigure always re-auths (deletes old token before starting fresh)
- UI shows error toast on OAuth failure, refreshes extension list
Flow: Install → Active → Configure (enter client_id/secret) → Save →
OAuth popup → authorize → done. Second Google tool install auto-triggers
scope expansion OAuth.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix: address PR review comments
- Add custom headers support to ValidationEndpointSchema (fixes
missing Notion-Version header regression)
- Guard activate handler auth check with status == "awaiting_authorization"
to prevent unexpected OAuth popups
- Add window dimensions to OAuth popup in activateExtension()
- Simplify UTF-8 truncation boundary check
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix: address Copilot PR review comments (security, UX, bugs)
- Add CSRF state parameter to OAuth flow (random state in auth URL, validated in callback)
- Restore MCP server Activate button in web UI (was hidden for all non-channel extensions)
- Abort JoinHandle in cleanup_expired_auths to prevent port 9876 conflicts
- Fix Google-specific error message for non-Google OAuth providers
- Add has_auth field to ExtensionInfo API response (fixes Configure button visibility)
- Use oauth_defaults::callback_url() instead of hardcoded redirect_uri (both CLI and manager)
- Update auth check comment to match actual behavior (scope expansion + first-time auth)
- Add unit tests for build_oauth_url (basic, PKCE, extra params, state uniqueness)
- Check all required setup secrets (client_id + client_secret) before starting OAuth
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
* fix: use std::sync::RwLock in MessageTool to avoid runtime panic
The `requires_approval` method is synchronous but was using
`tokio::sync::RwLock` with `.await` which requires blocking the
runtime. This caused a panic:
"Cannot block the current thread from within a runtime"
Changes:
- Replace `tokio::sync::RwLock` with `std::sync::RwLock` for
`default_channel` and `default_target` fields
- Use `unwrap_or_else(|e| e.into_inner())` to gracefully handle
poisoned locks (recovers instead of panicking)
- Update all usages from `.read().await` to `.read().unwrap_or_else()`
The locks are short-held (just cloning strings), making std::sync::RwLock
appropriate for sync methods called from async contexts.
Fixes: "Cannot block the current thread from within a runtime" panic
when the LLM tries to send a message via the message tool.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: address code review feedback for MessageTool RwLock fix
- Fix formatting (long lines broken up per rustfmt)
- Add regression test that demonstrates the panic with tokio::sync::RwLock
and passes with std::sync::RwLock when calling requires_approval()
(sync method) from async context
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* feat(web): fix jobs UI parity for non-sandbox mode
The web gateway Jobs UI was built primarily for sandbox (Docker) jobs.
When running without sandbox (common for NEAR AI hosted envs), multiple
features were broken. This change fixes all of them:
- Agent jobs now broadcast live SSE events to the web UI (Activity tab)
- Agent job restart via scheduler.dispatch_job (not chat message)
- Follow-up prompts for agent jobs via WorkerMessage injection
- Capability flags (can_restart, can_prompt, job_kind) in job detail API
- Rate-limit retry with cap (10 consecutive) and Retry-After header parsing
- Plan interruption on user message (breaks out of plan, re-evaluates)
- Correct SSE status field in mark_completed/mark_failed/mark_stuck
- SseManager preserved across rebuild_state calls
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* style: fix formatting in db/mod.rs and nearai_chat.rs
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
* refactor: remove restart infrastructure and generalize Telegram-specific code
Remove the gateway restart mechanism (hot-activation works, restart won't
fix activation failures) and generalize Telegram-specific hardcoded checks
so all WASM channels get equal treatment.
Part 1 - Remove restart infrastructure:
- Remove needs_restart from ActionResponse, restart_requested from GatewayState
- Remove gateway_restart_handler, /api/gateway/restart route, exit code 75
- Remove restart overlay JS/CSS (dead code - restartGateway() never called)
- Surface actual activation errors instead of suggesting restart
Part 2 - Generalize Telegram-specific code:
- Replace telegram_owner_id: Option<i64> with generic
wasm_channel_owner_ids: HashMap<String, i64> (backwards-compatible
via TELEGRAM_OWNER_ID env var)
- Pairing status check now applies to all active WASM channels
- All channels get 3-step stepper in web UI, remove "coming soon" note
- Remove dead setup_telegram() code (~700 lines) - Telegram's
capabilities.json declares required_secrets, so the generic
setup_wasm_channel() path handles it
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* test: add Settings::set() test for wasm_channel_owner_ids
Addresses review feedback: verify that setting per-channel owner IDs
via the dotted-path Settings::set() API works correctly with the new
HashMap<String, i64> type.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix(web): refresh extension stepper after pairing approval
loadPairingRequests only refreshed the pairing section, not the
stepper status. Call loadExtensions() instead so the stepper updates
from "Awaiting Pairing" to "Active" immediately after approval.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
* feat(workspace): add TOOLS.md, BOOTSTRAP.md, and disk-to-DB import
Add two new OpenClaw-compatible workspace markdown files:
- TOOLS.md: Environment-specific tool notes (SSH hosts, device names,
etc.) injected into the system prompt under "## Tool Notes". Seeded
as comment-only (like HEARTBEAT.md) so it's effectively empty until
the user adds real content. Not write-protected — the agent can
update it as it learns the environment.
- BOOTSTRAP.md: First-run onboarding ritual. Injected FIRST in the
system prompt when present. Guides the agent through introducing
itself, learning about the user, and updating workspace files.
Only seeded on truly fresh workspaces (no existing identity files)
to avoid triggering the ritual on existing deployments. Agent clears
it via `memory_write(target="bootstrap")` when done.
Add `Workspace::import_from_directory()` for disk-to-DB import:
- Scans a directory for *.md files and imports any that don't already
exist in the database (never overwrites user edits)
- Controlled by WORKSPACE_IMPORT_DIR env var, runs after seed_if_empty()
- Enables Docker images / deployment scripts to ship customized
workspace templates that override generic seeds
- Backwards compatible: no-op when env var is unset
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix: address PR review comments
- Use stable `path.extension() != Some(OsStr::new("md"))` instead of
unstable `is_none_or` (nightly-only)
- Use `tokio::join!` for concurrent DB reads in fresh-workspace check
- Skip unreadable directory entries instead of failing the entire import
- Skip unreadable files instead of failing the entire import
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
WASM tools and channels activated at runtime (via web UI or CLI) were
missing secrets store wiring, causing credential injection to silently
fail. Tools like web-search would get 401s from APIs even though the
user had configured their API key.
Four bugs fixed:
- activate_wasm_tool(): WasmToolLoader created without .with_secrets_store()
- register_wasm_from_storage(): hardcoded secrets_store: None
- WasmChannelLoader: no secrets_store field at all (added field + builder)
- activate_wasm_channel() and startup path: both missed wiring secrets
The startup path in app.rs was correct; all runtime paths now match it.
Co-authored-by: Claude Sonnet 4.6 <[email protected]>
- Add scrollIntoView to keep arrow-key-selected item visible in dropdown
- Make Enter complete the first matching command when autocomplete is
visible, instead of requiring explicit arrow-key navigation first
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
The compiler cannot infer the element type of `conflicts` on Windows
because all `push` calls are inside `#[cfg(unix)]` blocks which don't
compile on Windows.
Co-authored-by: Claude Sonnet 4.6 (1M context) <[email protected]>
* fix(channels): add host-based credential injection to WASM channel wrapper
The channel WASM wrapper was missing the host-based credential injection
that the tools wrapper implements. The `credentials` block in channel
capabilities files was dead code: Slack's `on_respond` sends requests
with no Authorization header, expecting the host to inject the bot token
based on `host_patterns`, but the host never did.
This caused Slack (and any channel relying on capabilities-declared
credentials) to fail all outbound API calls with `not_authed`.
Changes:
- Add `ResolvedHostCredential` struct mirroring the tools wrapper
- Add `host_credentials` field to `ChannelStoreData`
- Add `inject_host_credentials()` method on `ChannelStoreData`
- Update `redact_credentials()` to also scrub host-injected secret values
- Add `secrets_store` field to `WasmChannel` + `with_secrets_store()` builder
- Add `resolve_channel_host_credentials()` async helper that decrypts
capabilities-declared credentials before each WASM callback
- Update `create_store()` and all `call_on_*` / `execute_status` /
`execute_poll` call sites to pre-resolve and pass host credentials
- Fix leak scan ordering: scan runs on WASM-provided values BEFORE host
credential injection, preventing false-positive blocks on injected
Bearer tokens (e.g. xoxb- Slack tokens)
- Make `credential_injector` module pub(crate) so channels can reuse
`inject_credential` and `host_matches_pattern`
Fixes#389, root cause of #413
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
* fix(wasm): redact URL-encoded credentials, use url::Url, derive Clone
Address review feedback on PR #421:
1. Security: redact_credentials now scrubs URL-encoded forms of secrets
in addition to raw values, preventing exfiltration via encoded
representations in error strings from reqwest
2. Use url::Url::query_pairs_mut() for query parameter injection instead
of manual string manipulation, improving robustness with malformed URLs
3. Derive Clone on ResolvedHostCredential and simplify the per-tick
clone in the status repeater loop
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: cargo fmt
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Sprite <[email protected]>
Co-authored-by: Claude Sonnet 4.6 <[email protected]>
* refactor: rename WasmBuildable::repo_url to source_dir
The field receives a local directory path (e.g. "tools-src/gmail"), not a
URL. Rename to source_dir to accurately reflect its purpose.
Adds #[serde(alias = "repo_url")] for backwards compatibility with any
previously serialized data.
Closes#329
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor: rename extract_url to extract_source
The function can return a local directory path, not just a URL.
Addresses review feedback on PR #445.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix: pre-validate Cloudflare tunnel token by spawning cloudflared
After format validation passes, spawn `cloudflared tunnel run` briefly
with a dummy URL and watch stderr for up to 10s. If an error appears
before a connection URL, report it and offer "Save anyway?". This
catches bad tokens during setup instead of at runtime 30s later.
Closes#440
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: tighten cloudflared output matching in live validation
- Check for cfargotunnel.com/trycloudflare.com in success detection
- Use starts_with("err") instead of contains("err") to avoid false
positives on words like "stderr"
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix: persist channel activation state across restarts (#392)
Channels activated via the web UI were lost on restart because
active_channel_names was only in memory. Now persist activation state
to the settings store under "activated_channels" and auto-activate
persisted channels on startup.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: log warnings for channel activation load failures
Replace silent catch-all with explicit error logging when
database queries or deserialization fails for activated channels.
Addresses Gemini review feedback on PR #432.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* Apply suggestions from code review
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
Co-authored-by: Illia Polosukhin <[email protected]>
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
* fix: init WASM runtime eagerly regardless of tools directory existence
The WASM tool runtime was only created at startup when both
`wasm.enabled` and `wasm.tools_dir.exists()` were true. This meant
that if the tools directory didn't exist yet (e.g. fresh deploy with
`--no-onboard`), the runtime was set to None and passed to the
ExtensionManager. Extensions installed later via the web UI would
then fail with "WASM runtime not available" because the runtime
could not be retroactively created.
The Wasmtime engine initialization has no dependency on the tools
directory — it only configures the compiler and starts an epoch
ticker thread. The directory is only needed later when loading
.wasm modules. Remove the directory check so the runtime is
available for post-startup extension activation.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* test: add regression tests for WASM runtime eager init
- runtime.rs: test_runtime_creation_without_tools_dir confirms the
Wasmtime engine initialises without a tools directory on disk
- manager.rs: test_activate_wasm_tool_with_runtime_passes_runtime_check
verifies activation gets past the runtime check when a runtime is
provided (fails on missing file, not missing runtime)
- manager.rs: test_activate_wasm_tool_without_runtime_fails_with_runtime_error
verifies the original error when no runtime is available
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor: use idiomatic Result-to-Option conversion for WASM runtime init
Address PR review feedback: replace match block with
.map(Arc::new).map_err(|e| warn!(...)).ok() chain.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: fix formatting in extension manager tests
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
All PostgreSQL connection sites hardcoded NoTls, preventing connections
to managed providers that require TLS (AWS RDS, Neon, Supabase, etc.).
- Add tokio-postgres-rustls with rustls + system root certificates
- Add SslMode enum (disable/prefer/require) via DATABASE_SSLMODE env var
- Replace NoTls at all 4 production call sites with TLS-aware pool creation
- Add SslMode::from_env() helper for lightweight CLI tools
- Log native cert loading errors and warn on empty root store
Default mode is Prefer (attempts TLS, matching most managed providers).
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix: scan inbound messages for leaked secrets before LLM processing (#393)
Add scan_inbound_for_secrets() to SafetyLayer that reuses the existing
leak detector on user input. Wire it into thread_ops.rs after the policy
check so messages containing API keys or tokens are rejected early,
preventing the LLM from echoing them back and triggering outbound
leak-detection error loops.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: unify inbound secret scan warning messages
Both the detected-secret and error branches now show the same
actionable message guiding users to remove secrets and use the
config system instead.
Addresses Gemini review feedback on PR #433.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix: use tailscale funnel --bg for proper tunnel setup (#394)
The old command `tailscale funnel http://127.0.0.1:3000` would hang
without establishing a tunnel. The correct invocation is
`tailscale funnel --bg <port>` which configures the tunnel as a
background daemon and exits.
Changes:
- Use `--bg` flag with just the port number
- Run as a one-shot command instead of spawning a child process
- Use `tailscale <cmd> off` to tear down (matches --bg semantics)
- health_check uses stored URL instead of non-existent child PID
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: use local_host parameter and verify tailscale health
Pass full http://host:port URL to tailscale instead of ignoring
the local_host parameter. Health check now verifies tailscale is
actually running via 'tailscale status --json'.
Addresses Gemini review feedback on PR #430.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
The Slack channel capabilities.json declares secret names in lowercase
(slack_bot_token) but the web UI stored them in UPPERCASE
(SLACK_BOT_TOKEN), causing credential injection to fail with
"not_authed".
Changes:
- CreateSecretParams::new() normalizes name to lowercase on creation
- All SecretsStore lookups (get, exists, delete, is_accessible) now
lowercase the name parameter before querying
- Applied to all three backends: PostgreSQL, libSQL, InMemory
- CredentialInjector::is_secret_allowed() uses case-insensitive
comparison
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix: persist model name to .env so dotted names survive restart (#400)
The setup wizard saved selected_model to the DB but not to .env.
Since Config::from_env_with_toml() runs before the DB connects, the
model name was lost on restart -- backends fell back to hardcoded
defaults, truncating names like "llama3.2" to "llama3".
- Add LlmBackend::model_env_var() as single source of truth for the
backend-to-env-var mapping
- Write the model env var in write_bootstrap_env() using the new method
- Add selected_model fallback to all 6 backends (was missing from
OpenAI, Anthropic, Ollama, and Tinfoil)
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor: extract resolve_model() helper to reduce duplication
Address review feedback: the env → settings → default model resolution
pattern was repeated across all 6 backends. Centralise it in a single
LlmConfig::resolve_model() helper.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix(setup): check cloudflared binary and validate tunnel token (#418)
The Cloudflare tunnel setup accepted tokens blindly without checking if
cloudflared was installed or if the token was valid. Now:
- Checks for cloudflared on PATH before accepting a token, with install
instructions if missing (user can continue anyway)
- Validates token format (base64-decoded JSON with account/tunnel fields)
with a warning if malformed (user can override)
- Replaces misleading "will start automatically at boot" with honest
instructions for starting the tunnel and installing as a service
- Reuses binary_exists() from skills::gating (promoted to pub(crate))
for cross-platform PATH lookup
Closes#418
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: reuse cloudflared_found instead of redundant binary_exists call
Address review feedback: the binary check result was already stored
in cloudflared_found from earlier in the function.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix(setup): validate PostgreSQL version and pgvector before migrations
The setup wizard accepted any DATABASE_URL without checking the server
version or pgvector availability. Users who installed PostgreSQL 14
(or any version < 15) got opaque migration failures. Users without
pgvector installed hit CREATE EXTENSION errors at runtime.
After a successful connection, the wizard now:
1. Queries SHOW server_version and rejects versions below 15
2. Checks pg_available_extensions for the vector extension
Both checks provide actionable error messages with platform-specific
install guidance.
Closes#415Closes#416
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* refactor: extract version constant, fix hex escapes in pgvector message
- Extract MIN_PG_MAJOR_VERSION constant to avoid magic number
- Replace \x20 hex escapes with regular spaces in install guidance
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix(setup): use detected PG version in pgvector install instructions
The pgvector install hints were hardcoded for PG 16. Since we already
parse major_version from SHOW server_version, use it dynamically so
users on PG 15 or 17 get correct package names.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* fix: guard zsh compdef call to prevent error before compinit
The generated ironclaw.zsh completions file calls compdef without
checking if it exists. Users who source this file before compinit
runs in their .zshrc get "compdef: command not found" on every
terminal open.
Wrap the call with the standard (( $+functions[compdef] )) guard.
Closes#420
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix(completions): apply compdef guard during zsh generation
Instead of hand-patching the generated ironclaw.zsh file (which is
fragile and lost on regeneration), patch the compdef call in the
generation code itself. The Zsh output is post-processed to wrap
`compdef _ironclaw ironclaw` with a `$+functions[compdef]` guard.
Regenerated ironclaw.zsh from the patched code to stay in sync.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
* feat(cli): add `tool setup` command + GitHub setup schema
- Add `ironclaw tool setup <name>` CLI command that reads
`setup.required_secrets` from a tool's capabilities file and
prompts the user for each secret, saving them to the encrypted
secrets store. Handles already-configured secrets (ask to replace),
optional secrets (skip on empty), and hidden input.
- Add `setup.required_secrets` to GitHub tool capabilities file
with `github_token` — the only WASM tool that was missing it
after PR #437 added setup schemas to all other tools.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* refactor(cli): extract init_secrets_store helper + add tool name validation
Address PR review feedback:
- Extract duplicated secrets store initialization (~50 lines) from
auth_tool and setup_tool into shared init_secrets_store() helper
- Add validate_tool_name() to reject path traversal in tool names
(applies to both auth_tool and setup_tool)
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
* fix(web): remove gateway restart button from channel activation failure cards
When a WASM channel (e.g. Telegram) fails to hot-activate after setup,
the extension card showed a "Restart" button that calls POST /api/gateway/restart.
This triggers a process exit and relies on an external supervisor to relaunch,
which doesn't work reliably when running inside Docker.
Remove the Restart button entirely from the failed-activation card for all
channels — Reconfigure is the correct recovery action (re-enter credentials).
Also fix two bugs found during review:
- setServerLogLevel/loadServerLogLevel called .json() on the already-parsed
object returned by apiFetch, causing a silent TypeError that prevented the
log level selector from updating
- buildBreadcrumb embedded paths in inline onclick JS strings using escapeHtml,
which doesn't escape single quotes; switched to data-path attribute pattern
to avoid JS string injection from paths containing quotes
And simplify: collapse the dead Telegram-specific branch in submitConfigureModal
toast messaging — all channels now show "Configured and activated X" on success.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
* fix(telegram): propagate token validation errors from on_start
Both webhook and polling mode in on_start() swallowed activation errors
from register_webhook/delete_webhook — using `if let Err(e)` to log
but then returning Ok regardless. This caused a bad bot token to show
as "configured and active" instead of failing activation.
Telegram returns {"ok": true} when deleteWebhook is called with no
existing webhook (idempotent), so any error (e.g. 401 Unauthorized)
genuinely means an invalid token.
The WASM is rebuilt automatically via build.rs on cargo build.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
* fix(telegram): validate bot token before storing, fix misleading toast
Add upfront GET /getMe validation in save_setup_secrets() before writing
the bot token to the secrets store. This catches bad tokens immediately
for both fresh installs and reconfigures — the reconfigure path
(refresh_active_channel) skips on_start entirely and would never catch
an invalid token without this check. URL-encode the token before
interpolating into the getMe URL path.
Also update the activation-failure toast from "Restart required to
activate" (misleading now that the Restart button is gone) to
"Use Reconfigure to re-enter credentials and activate".
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
* fix(telegram): collapse nested if, fix formatting (clippy + fmt)
Collapse `if name == "telegram" { if let Some(...) }` into a single
let-chain condition as suggested by clippy's collapsible_if lint.
Also apply rustfmt line-length fixes in the same block.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
---------
Co-authored-by: Claude Sonnet 4.6 <[email protected]>
* feat: add web_fetch built-in tool and web-fetch skill
- New web_fetch Rust built-in tool (GET-only, auto-approved, structured
output: url/title/content/word_count) with HTML to Markdown via Readability
- Full SSRF protection: HTTPS-only, no private IPs, DNS rebinding defence,
outbound/inbound leak scanning, 5 MB cap, no redirect following
- Rate limited: 30 req/min, 500/hr (same as http tool)
- Protected tool name; registered in register_builtin_tools()
- validate_url made pub(crate) so web_fetch can reuse it from http.rs
- New skills/web-fetch/SKILL.md for agent guidance on web browsing
- Fixes unicode panic in extract_title: use to_ascii_lowercase not
to_lowercase to preserve byte offsets when indexing original string
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
* chore: remove web-fetch skill (tool description is self-sufficient)
The web_fetch tool's schema description already tells the LLM when and
how to use it. A SKILL.md would only add redundant prompt context.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
* fix: include HTTP status in web_fetch output
The LLM had no way to distinguish a 404 error page from a 200 success.
Including status in the structured output (alongside url/title/content/
word_count) lets the agent report failures correctly and matches the
behaviour of the http tool which always returns status.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
* feat(web_fetch): add Chrome UA and safe redirect following
- Set a Chrome-like User-Agent so sites that block the default reqwest
string return real content instead of bot-rejection pages.
- Add Accept: text/markdown, text/html header (mirrors OpenClaw).
- Follow up to 3 redirects manually instead of blocking all 3xx.
Every Location URL is run through validate_url() before the next
request is sent, so SSRF protection applies to every hop identically
to how it applies to the original URL.
- Resolve relative Location values against the current URL before
SSRF-validating them.
- Log each followed hop at DEBUG level.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
* fix(web_fetch): expose final_url after redirect following
When redirects are followed, the original `url` field no longer
reflects where the content actually came from. Add `final_url` so
the LLM can cite the canonical source correctly. Equals `url` when
no redirects occurred.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
* fix(web_fetch): address review comments and fix CI failures
- Store LeakDetector in WebFetchTool struct (init once in new(), not per execute() call)
- Use self.leak_detector for both outbound scan and redirect re-validation
- Simplify HTML/cfg blocks to reduce duplication (gemini-code-assist suggestion)
- Fix pub use ordering in mod.rs (cargo fmt)
- Add web_fetch to core_registration_covers_expected_tools snapshot test
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
---------
Co-authored-by: Claude Sonnet 4.6 <[email protected]>
* feat(web): DB-backed Jobs tab, scheduler-dispatched local jobs, remove active-jobs-bar
- Remove active-jobs-bar UI element (HTML, CSS, JS polling)
- Move job handlers from server.rs to handlers/jobs.rs
- Remove user_id scoping (single-user gateway)
- Add list_agent_jobs() and agent_job_summary() to Database trait
(both postgres and libsql backends) for non-sandbox job visibility
- Wire SchedulerSlot into CreateJobTool so execute_local dispatches
via scheduler (persists to DB + spawns worker) instead of creating
phantom ContextManager-only jobs
- Update /status and /list slash commands to read from DB for
consistency with Jobs tab
- Fix worker mark_completed: skip if already terminal or stuck
- Add agent job cancel via DB update in both web handler and slash cmd
- Add Stuck → Completed guard with tracing in worker completion path
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
* fix: address PR review comments
- Log warning when get_context fails in worker completion path
- Extract duplicated status-counting logic into AgentJobSummary::add_count()
helper, used by both postgres and libsql backends
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
---------
Co-authored-by: Claude Sonnet 4.6 <[email protected]>
Co-authored-by: Nick Pismenkov <[email protected]>
* feat(bootstrap): auto-detect libsql when ironclaw.db exists
If DATABASE_BACKEND is unset after loading all env files and
~/.ironclaw/ironclaw.db exists, default to libsql automatically.
Fixes the chicken-and-egg problem on cloud instances where no
DATABASE_URL is configured: users no longer need to prefix every
ironclaw command with DATABASE_BACKEND=libsql.
Priority order: explicit env var > .env > ~/.ironclaw/.env > auto-detect
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
* fix(bootstrap): move env loading to sync main() before tokio runtime
- Fix cargo fmt: wrap three long assert! lines in new tests
- Address set_var data race: load_ironclaw_env() is now called from a
synchronous fn main() wrapper before the Tokio runtime starts, making
the set_var call provably safe (no worker threads exist yet)
- Remove the redundant dotenvy::dotenv() + load_ironclaw_env() calls
from inside command handlers and agent startup (already done pre-tokio)
- Update SAFETY comment to reflect the actual invariant
Addresses Gemini code review comment and cargo fmt CI failure on PR #399.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
---------
Co-authored-by: Claude Sonnet 4.6 <[email protected]>
* feat(web): slash command autocomplete, /status /list /cancel, fix input locking
Backend:
- Add JobStatus, JobList, JobCancel Submission variants to submission.rs
- Parse /status [id], /progress [id], /list, /cancel <id> as control commands
- Dispatch to existing handle_check_status/handle_list_jobs/handle_cancel_job
handlers via new process_job_status/process_job_list/process_job_cancel methods
- Add 4 parser tests (34 total, all passing)
Web UI:
- Add slash command autocomplete: type / in chat input to see all 18 commands
with descriptions; arrow-key navigation, Tab/Enter to select, Escape to close
- Remove chat input locking: drop textarea.disabled + sendBtn.disabled so users
can always type and send (including /interrupt while agent is processing)
- Remove quick-action toolbar buttons (↩↪⏸⊖🗑📋) added in previous session
- Remove dead #chat-status bar (min-height 28px black bar always visible when empty)
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
* refactor: address PR review comments
- Remove Submission::JobList variant; parse /list directly as
JobStatus { job_id: None } (simpler, eliminates redundant enum
variant, match arm, is_control branch, and wrapper function)
- Cache autocomplete matches in _slashMatches to avoid re-filtering
SLASH_COMMANDS on every keydown while autocomplete is open
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
---------
Co-authored-by: Claude Sonnet 4.6 <[email protected]>
Co-authored-by: Pierre LE GUEN <[email protected]>
* feat(routines): deliver notifications to all installed channels
Routine notifications were silently lost because the forwarder didn't
use NotifyConfig fields and WASM channels (Telegram, Slack) had
broadcast() as a no-op. This fixes three issues:
1. send_notification() now includes notify_user/notify_channel in
metadata so the forwarder can route to specific channels
2. The routine forwarder mirrors the heartbeat pattern: try targeted
channel first, fall back to broadcast_all
3. WasmChannel implements broadcast() using last-seen message metadata
(chat_id), with persistence to the settings table so it survives
restarts. Only writes to DB when the value actually changes.
Heartbeat notifications also benefit from the WASM broadcast fix.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
* refactor(wasm): extract do_update_broadcast_metadata to eliminate duplication
The inline metadata-update block in `dispatch_emitted_messages` was
identical to the `update_broadcast_metadata` instance method. Extract
the shared logic into a private free function `do_update_broadcast_metadata`
that both call, so the persistence logic lives in one place.
Addresses Gemini code review comment on PR #398.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
---------
Co-authored-by: Claude Sonnet 4.6 <[email protected]>
Routines created via Telegram (or any WASM channel) were invisible in the
web UI because the routines list endpoint filtered by GATEWAY_USER_ID,
which didn't match the Telegram user's ID stored on the routine.
Add list_all_routines() to the RoutineStore trait (both libSQL and
PostgreSQL backends) and use it in the web dashboard handlers so all
routines are visible regardless of which channel created them.
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
