20753 Commits

Author SHA1 Message Date
Peter Steinberger
0a842de354 test: widen low-profile singleton batching 2026-03-20 23:02:33 +00:00
Josh Lehman
2364e45fe4
test: align extension runtime mocks with plugin-sdk (#51289)
* test: align extension runtime mocks with plugin-sdk

Update stale extension tests to mock the plugin-sdk runtime barrels that production code now imports, and harden the Signal tool-result harness around system-event assertions so the channels lane matches current extension boundaries.

Regeneration-Prompt: |
  Verify the failing channels-lane tests against current origin/main in an isolated worktree before changing anything. If the failures reproduce on main, keep the fix test-only unless production behavior is clearly wrong. Recent extension refactors moved Telegram, WhatsApp, and Signal code onto plugin-sdk runtime barrels, so update stale tests that still mock old core module paths to intercept the seams production code now uses. For Signal reaction notifications, avoid brittle assertions that depend on shared queued system-event state when a direct harness spy on enqueue behavior is sufficient. Preserve scope: only touch the failing tests and their local harness, then rerun the reproduced targeted tests plus the full channels lane and repo check gate.

* test: fix extension test drift on main

* fix: lazy-load bundled web search plugin registry

* test: make matrix sweeper failure injection portable

* fix: split heavy matrix runtime-api seams

* fix: simplify bundled web search id lookup

* test: tolerate windows env key casing
2026-03-20 15:59:53 -07:00
Vincent Koc
e635cedb85 test(openai): cover bundle media surfaces 2026-03-20 15:53:12 -07:00
Vincent Koc
d54ebed7c8 test(openai): add plugin entry live coverage 2026-03-20 15:53:12 -07:00
Vincent Koc
d1d46c6cfb test(openai): broaden live model coverage 2026-03-20 15:53:12 -07:00
Vincent Koc
f1802a5bc7 test(openai): add live provider probe 2026-03-20 15:53:12 -07:00
Sally O'Malley
6e20c4baa0
feat: add anthropic-vertex provider for Claude via GCP Vertex AI (#43356)
Reuse pi-ai's Anthropic client injection seam for streaming, and add
the OpenClaw-side provider discovery, auth, model catalog, and tests
needed to expose anthropic-vertex cleanly.

Signed-off-by: sallyom <somalley@redhat.com>
2026-03-20 18:48:42 -04:00
Vincent Koc
42ca447189 test(openrouter): add live plugin coverage 2026-03-20 15:36:34 -07:00
Peter Steinberger
fac64c2392 test: widen unit timing snapshot coverage 2026-03-20 22:33:49 +00:00
Peter Steinberger
39a4fe576d test: normalize perf manifest paths 2026-03-20 22:06:46 +00:00
Josh Lehman
c3972982b5
fix: sanitize malformed replay tool calls (#50005)
Merged via squash.

Prepared head SHA: 64ad5563f7ae321b749d5a52bc0b477d666dc6be
Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com>
Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com>
Reviewed-by: @jalehman
2026-03-20 15:03:30 -07:00
Peter Steinberger
cadbaa34c1 test: widen low-profile scheduler peeling 2026-03-20 21:30:44 +00:00
Peter Steinberger
994b42a5a5 test: parallelize safe audit case tables 2026-03-20 21:16:01 +00:00
Peter Steinberger
aed1f6d807 test: parallelize low-profile deferred lanes 2026-03-20 21:07:56 +00:00
Peter Steinberger
09cf6d80ec test: batch thread-only unit lanes 2026-03-20 20:51:38 +00:00
Josh Avant
7abfff756d
Exec: harden host env override handling across gateway and node (#51207)
* Exec: harden host env override enforcement and fail closed

* Node host: enforce env override diagnostics before shell filtering

* Env overrides: align Windows key handling and mac node rejection
2026-03-20 15:44:15 -05:00
Josh Avant
c7134e629c
LINE: harden Express webhook parsing to verified raw body (#51202)
* LINE: enforce signed-raw webhook parsing

* LINE: narrow scope and add buffer regression

* changelog

Signed-off-by: joshavant <830519+joshavant@users.noreply.github.com>

---------

Signed-off-by: joshavant <830519+joshavant@users.noreply.github.com>
2026-03-20 15:32:55 -05:00
Vincent Koc
11d71ca352
pairing: keep setup codes bootstrap-token only (#51259) 2026-03-20 13:27:39 -07:00
Peter Steinberger
5a5e84ca1d test: drop duplicate web search helper 2026-03-20 20:25:24 +00:00
Peter Steinberger
fa71ad7c5d test: repair latest-main web search regressions 2026-03-20 20:17:11 +00:00
Josh Lehman
23fef04c4e
test: fix setup finalize web search mocks (#51253) 2026-03-20 13:07:22 -07:00
Peter Steinberger
1b18742e8e test: peel more slow unit files out of unit-fast 2026-03-20 20:04:52 +00:00
Teddy Tennant
a20ba74978
test: add SSRF guard coverage for URL credential bypass vectors (#50523)
* security: add SSRF guard tests for URL credential bypass vectors

* test(security): strengthen SSRF redirect guard coverage

---------

Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
2026-03-20 12:45:06 -07:00
Gustavo Madeira Santana
3da66718f4
Web: derive search provider metadata from plugin contracts (#50935)
Merged via squash.

Prepared head SHA: e1c7d72833afff6ef33e8d32cdd395190742dc08
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Reviewed-by: @gumadeiras
2026-03-20 12:41:04 -07:00
Peter Steinberger
acf32287b4 test: trim more extension startup from unit tests 2026-03-20 19:28:32 +00:00
Jaaneek
916f496b51
Add Grok 4.20 reasoning and non-reasoning to xAI model catalog (#50772)
Merged via squash.

Prepared head SHA: 095e645ea58b2259b25c923aeaf11bbcb2990c8f
Co-authored-by: Jaaneek <25470423+Jaaneek@users.noreply.github.com>
Co-authored-by: huntharo <5617868+huntharo@users.noreply.github.com>
Reviewed-by: @huntharo
2026-03-20 15:28:30 -04:00
Peter Steinberger
f6b3245a7b fix: pass full sdk gate 2026-03-20 19:24:10 +00:00
Peter Steinberger
62ddc9d9e0 refactor: consolidate plugin sdk surface 2026-03-20 19:24:10 +00:00
Vincent Koc
46854a84a4 test(plugin-sdk): cover legacy root diagnostic listeners 2026-03-20 12:23:02 -07:00
Peter Steinberger
7b00a0620a test: stabilize gateway alias coverage 2026-03-20 19:17:44 +00:00
Gustavo Madeira Santana
a05da76718
Matrix: dedupe replayed inbound events on restart (#50922)
Merged via squash.

Prepared head SHA: 10d9770aa61d864686e4ba20fbcffb8a8dd68903
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Reviewed-by: @gumadeiras
2026-03-20 12:13:24 -07:00
Vincent Koc
5408a3d1a4 docs(contributing): clarify accepted PR scope 2026-03-20 12:04:16 -07:00
Peter Steinberger
39053bddd7 test: decouple zalo outbound payload contract from channel runtime 2026-03-20 19:02:07 +00:00
Peter Steinberger
a7401366ef test: trim more channel-heavy startup in unit tests 2026-03-20 18:50:52 +00:00
Vincent Koc
083f825122 docs: expand community plugins (always visible), add Codex App Server/Lossless Claw/Opik, A-Z order 2026-03-20 11:40:50 -07:00
Peter Steinberger
b26edfe1ff test: trim plugin-heavy unit test imports 2026-03-20 18:35:39 +00:00
Vincent Koc
740b345a2e docs: sort Tools nav group alphabetically 2026-03-20 11:33:51 -07:00
Vincent Koc
483926a6fb docs: rewrite sdk-migration and bundles, fold agent-tools into building-plugins, remove cookbook from nav, remove dead WeChat listing 2026-03-20 11:32:11 -07:00
Vincent Koc
2e0b445b46 docs: use expandable Accordions for community plugins, keep A-Z order 2026-03-20 11:27:45 -07:00
Tak Hoffman
16e055c083
restore extension-api backward compatibility with migration warning 2026-03-20 13:27:30 -05:00
Vincent Koc
e4d0fdcc15 docs: rewrite community plugins page with Cards, Steps, and quality bar table 2026-03-20 11:23:46 -07:00
Vincent Koc
fb293fa36f docs: rewrite plugins install/configure page with Steps, Accordions, and clear hierarchy 2026-03-20 11:20:36 -07:00
Vincent Koc
a4a5ed8948 docs: retitle plugin internals/agent-tools/cookbook, collapse Browser into Tools, reorder Plugins group 2026-03-20 11:17:49 -07:00
Vincent Koc
4edab304db docs: reorder Tools & Plugins nav, move Media/devices to Gateway tab, rewrite 4 problem pages with Mintlify components 2026-03-20 11:10:45 -07:00
Vincent Koc
3d097f1052 docs: rewrite tools landing page with Tools/Skills/Plugins explainer using Steps 2026-03-20 11:02:01 -07:00
Vincent Koc
e18ab85f08 docs(agents): clarify plugin nomenclature 2026-03-20 10:59:29 -07:00
Vincent Koc
5f600e117d docs: restructure Tools & Plugins section, rename building-extensions to building-plugins, rewrite tools landing page and SDK migration 2026-03-20 10:55:56 -07:00
Ayaan Zaidi
35ac1f6e07 fix: add changelog for telegram account routing fix (#50853) (thanks @hclsys) 2026-03-20 23:24:40 +05:30
HCL
4e45a663e7 fix(telegram): prevent silent wrong-bot routing when accountId not in config
When a non-default accountId is specified but not found in the accounts
config, resolveTelegramToken() falls through to channel-level defaults
(botToken, tokenFile, env) — silently routing messages via the wrong
bot's token. This is a cross-bot message leak with no error or warning.

Root cause: extensions/telegram/src/token.ts:44-46, resolveAccountCfg()
returns undefined for unknown accountIds but code continues to fallbacks.
Introduced in e5bca0832f when Telegram moved to extensions/.

Fix: return { token: "", source: "none" } with a diagnostic log when
a non-default accountId is not found. Existing behavior for known
accounts (with or without per-account tokens) preserved.

Test: added "does not fall through when non-default accountId not in
config" — 1/1 new, 10/10 existing unaffected.

Closes #49383

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: HCL <chenglunhu@gmail.com>
2026-03-20 23:24:40 +05:30
Vincent Koc
c64893a9c2
fix(config): use static channel metadata in docs baseline (#51161) 2026-03-20 10:52:40 -07:00