13324 Commits

Author SHA1 Message Date
JaiminBhojani
c7738ab9fb Merge remote-tracking branch 'upstream/main' into fix/image-model-unknown-model-33185
# Conflicts:
#	src/media-understanding/providers/image.test.ts
2026-03-21 10:29:01 +05:30
scoootscooob
d78e13f545
fix(agent): clarify embedded transport errors (#51419)
Merged via squash.

Prepared head SHA: cea32a4bdaca0a0e8f21c4bd734d7bae787b0c98
Co-authored-by: scoootscooob <167050519+scoootscooob@users.noreply.github.com>
Co-authored-by: scoootscooob <167050519+scoootscooob@users.noreply.github.com>
Reviewed-by: @scoootscooob
2026-03-20 21:47:47 -07:00
Cypherm
6b4c24c2e5
feat(telegram): support custom apiRoot for alternative API endpoints (#48842)
* feat(telegram): support custom apiRoot for alternative API endpoints

Add `apiRoot` config option to allow users to specify custom Telegram Bot
API endpoints (e.g., self-hosted Bot API servers). Threads the configured
base URL through all Telegram API call sites: bot creation, send, probe,
audit, media download, and api-fetch. Extends SSRF policy to dynamically
trust custom apiRoot hostname for media downloads.

Closes #28535

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(telegram): thread apiRoot through allowFrom lookups

* fix(telegram): honor lookup transport and local file paths

* refactor(telegram): unify username lookup plumbing

* fix(telegram): restore doctor lookup imports

* fix: document Telegram apiRoot support (#48842) (thanks @Cypherm)

---------

Co-authored-by: Cypherm <28184436+Cypherm@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
2026-03-21 10:10:38 +05:30
wesley
598f1826d8
fix(subagent): include partial progress when subagent times out (#40700)
* fix(subagent): preserve timeout partial progress reporting

* refactor: unify subagent output selection

* test: cover distilled subagent timeout output

* fix: remove timeout-only subagent path

---------

Co-authored-by: Wesley <imwyvern@users.noreply.github.com>
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
2026-03-21 08:44:38 +05:30
Tyler Yust
5e417b44e1 Outbound: skip broadcast channel scan when channel is explicit 2026-03-20 18:21:01 -07:00
Tyler Yust
b71686ab44 Enhance web search provider config validation and compatibility handling
- Added a test to ensure no warnings for legacy Brave config when bundled web search allowlist compatibility is applied.
- Updated validation logic to incorporate compatibility configuration for bundled web search plugins.
- Refactored the ensureRegistry function to utilize the new compatibility handling.
2026-03-20 18:20:50 -07:00
Danh Doan
e78129a4d9
feat(context-engine): pass incoming prompt to assemble (#50848)
Merged via squash.

Prepared head SHA: 282dc9264d4157c78959c626bbe6f33ea364def5
Co-authored-by: danhdoan <12591333+danhdoan@users.noreply.github.com>
Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com>
Reviewed-by: @jalehman
2026-03-20 17:03:21 -07:00
Josh Lehman
751d5b7849
feat: add context engine transcript maintenance (#51191)
Merged via squash.

Prepared head SHA: b42a3c28b4395bd8a253c7728080f09100d02f42
Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com>
Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com>
Reviewed-by: @jalehman
2026-03-20 16:28:27 -07:00
Peter Steinberger
6526074c85 test: trim singleton cold-start reloads 2026-03-20 23:14:28 +00:00
Josh Lehman
2364e45fe4
test: align extension runtime mocks with plugin-sdk (#51289)
* test: align extension runtime mocks with plugin-sdk

Update stale extension tests to mock the plugin-sdk runtime barrels that production code now imports, and harden the Signal tool-result harness around system-event assertions so the channels lane matches current extension boundaries.

Regeneration-Prompt: |
  Verify the failing channels-lane tests against current origin/main in an isolated worktree before changing anything. If the failures reproduce on main, keep the fix test-only unless production behavior is clearly wrong. Recent extension refactors moved Telegram, WhatsApp, and Signal code onto plugin-sdk runtime barrels, so update stale tests that still mock old core module paths to intercept the seams production code now uses. For Signal reaction notifications, avoid brittle assertions that depend on shared queued system-event state when a direct harness spy on enqueue behavior is sufficient. Preserve scope: only touch the failing tests and their local harness, then rerun the reproduced targeted tests plus the full channels lane and repo check gate.

* test: fix extension test drift on main

* fix: lazy-load bundled web search plugin registry

* test: make matrix sweeper failure injection portable

* fix: split heavy matrix runtime-api seams

* fix: simplify bundled web search id lookup

* test: tolerate windows env key casing
2026-03-20 15:59:53 -07:00
Vincent Koc
e635cedb85 test(openai): cover bundle media surfaces 2026-03-20 15:53:12 -07:00
Sally O'Malley
6e20c4baa0
feat: add anthropic-vertex provider for Claude via GCP Vertex AI (#43356)
Reuse pi-ai's Anthropic client injection seam for streaming, and add
the OpenClaw-side provider discovery, auth, model catalog, and tests
needed to expose anthropic-vertex cleanly.

Signed-off-by: sallyom <somalley@redhat.com>
2026-03-20 18:48:42 -04:00
Josh Lehman
c3972982b5
fix: sanitize malformed replay tool calls (#50005)
Merged via squash.

Prepared head SHA: 64ad5563f7ae321b749d5a52bc0b477d666dc6be
Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com>
Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com>
Reviewed-by: @jalehman
2026-03-20 15:03:30 -07:00
Peter Steinberger
994b42a5a5 test: parallelize safe audit case tables 2026-03-20 21:16:01 +00:00
Josh Avant
7abfff756d
Exec: harden host env override handling across gateway and node (#51207)
* Exec: harden host env override enforcement and fail closed

* Node host: enforce env override diagnostics before shell filtering

* Env overrides: align Windows key handling and mac node rejection
2026-03-20 15:44:15 -05:00
Josh Avant
c7134e629c
LINE: harden Express webhook parsing to verified raw body (#51202)
* LINE: enforce signed-raw webhook parsing

* LINE: narrow scope and add buffer regression

* changelog

Signed-off-by: joshavant <830519+joshavant@users.noreply.github.com>

---------

Signed-off-by: joshavant <830519+joshavant@users.noreply.github.com>
2026-03-20 15:32:55 -05:00
Vincent Koc
11d71ca352
pairing: keep setup codes bootstrap-token only (#51259) 2026-03-20 13:27:39 -07:00
Peter Steinberger
5a5e84ca1d test: drop duplicate web search helper 2026-03-20 20:25:24 +00:00
Peter Steinberger
fa71ad7c5d test: repair latest-main web search regressions 2026-03-20 20:17:11 +00:00
Josh Lehman
23fef04c4e
test: fix setup finalize web search mocks (#51253) 2026-03-20 13:07:22 -07:00
Teddy Tennant
a20ba74978
test: add SSRF guard coverage for URL credential bypass vectors (#50523)
* security: add SSRF guard tests for URL credential bypass vectors

* test(security): strengthen SSRF redirect guard coverage

---------

Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
2026-03-20 12:45:06 -07:00
Gustavo Madeira Santana
3da66718f4
Web: derive search provider metadata from plugin contracts (#50935)
Merged via squash.

Prepared head SHA: e1c7d72833afff6ef33e8d32cdd395190742dc08
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Reviewed-by: @gumadeiras
2026-03-20 12:41:04 -07:00
Peter Steinberger
acf32287b4 test: trim more extension startup from unit tests 2026-03-20 19:28:32 +00:00
Jaaneek
916f496b51
Add Grok 4.20 reasoning and non-reasoning to xAI model catalog (#50772)
Merged via squash.

Prepared head SHA: 095e645ea58b2259b25c923aeaf11bbcb2990c8f
Co-authored-by: Jaaneek <25470423+Jaaneek@users.noreply.github.com>
Co-authored-by: huntharo <5617868+huntharo@users.noreply.github.com>
Reviewed-by: @huntharo
2026-03-20 15:28:30 -04:00
Peter Steinberger
f6b3245a7b fix: pass full sdk gate 2026-03-20 19:24:10 +00:00
Peter Steinberger
62ddc9d9e0 refactor: consolidate plugin sdk surface 2026-03-20 19:24:10 +00:00
Vincent Koc
46854a84a4 test(plugin-sdk): cover legacy root diagnostic listeners 2026-03-20 12:23:02 -07:00
Peter Steinberger
7b00a0620a test: stabilize gateway alias coverage 2026-03-20 19:17:44 +00:00
Peter Steinberger
39053bddd7 test: decouple zalo outbound payload contract from channel runtime 2026-03-20 19:02:07 +00:00
Peter Steinberger
a7401366ef test: trim more channel-heavy startup in unit tests 2026-03-20 18:50:52 +00:00
Peter Steinberger
b26edfe1ff test: trim plugin-heavy unit test imports 2026-03-20 18:35:39 +00:00
Tak Hoffman
16e055c083
restore extension-api backward compatibility with migration warning 2026-03-20 13:27:30 -05:00
JaiminBhojani
8d0db12885 fix: prefer exact provider alias over normalized lookup for image config fallback
Use params.provider (exact key, e.g. "nvidia-api") for direct config
lookup before falling back to findNormalizedProviderValue. This prevents
ambiguity when configs contain both an alias and its canonical name
(e.g. "nvidia-api" and "nvidia"), which could cause the wrong provider
block to be selected and miss the model definition.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-20 23:47:27 +05:30
JaiminBhojani
35a29f71f2 fix: match provider-prefixed model IDs against original alias and resolve lint errors
Match config model IDs using the original (pre-normalization) provider
name (e.g. nvidia-api/meta-llama) so the image input fallback works for
aliased providers. Remove unnecessary type assertion in image.ts and
rename unused variable in image-tool.test.ts to satisfy oxlint.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-20 23:27:45 +05:30
Vincent Koc
c64893a9c2
fix(config): use static channel metadata in docs baseline (#51161) 2026-03-20 10:52:40 -07:00
Vincent Koc
a2e1991ed3 refactor(plugin-sdk): route bundled runtime barrels through public subpaths 2026-03-20 10:38:55 -07:00
Vincent Koc
fb3550ef5e test(sessions): stabilize pruning integration setup 2026-03-20 10:38:55 -07:00
JaiminBhojani
86231b5dbf fix: address PR review feedback — test coverage, formatting, and config fallback
- Fix oxfmt formatting issue in image.ts (CI check failure)
- Add toHaveBeenCalledWith assertions to Google model normalization tests
  to verify normalized model IDs are passed to resolveModelWithRegistry
- Copy api field from configured model in config fallback, not just input,
  so custom providers with explicit api configs route through correct adapter
- Add dedicated tests for !imageProvider fallback in image-tool.test.ts
  covering both single-image and multi-image branches
- Fix type errors in test configs (missing reasoning/cost fields)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-20 23:00:19 +05:30
Vincent Koc
a39c440d39 fix(config): share json compatibility parsing 2026-03-20 10:17:53 -07:00
Vincent Koc
93fbe26adb
fix(config): tighten json and json5 parsing paths (#51153) 2026-03-20 10:10:57 -07:00
Vincent Koc
87eeab7034 docs: add plugin SDK migration guide, link deprecation warning to docs 2026-03-20 10:05:06 -07:00
JaiminBhojani
f4efe1514e fix(agents): resolve imageModel "Unknown model" for custom providers (#33185)
The image tool failed with "Unknown model" for any user-configured custom
provider (vllm, nvidia-api, iflow) because resolveImageRuntime used bare
modelRegistry.find() which only checks built-in models.json entries.

- Replace modelRegistry.find() with resolveModelWithRegistry() to use the
  full 4-layer resolution stack (registry → inline config → plugin → ad-hoc)
- Add config-aware input field fallback for provider-prefixed model IDs
  (e.g. "vllm/Qwen3.5" in config vs "Qwen3.5" after ref parsing)
- Fall back to describeImageWithModel in image-tool.ts when no
  media-understanding provider is registered for custom providers
- Normalize nvidia-api provider alias to nvidia in provider-id.ts
- Add regression tests for custom provider image model resolution

Closes #33185

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-20 22:31:54 +05:30
Peter Steinberger
fcabecc9a4 fix: remove duplicate plugin sdk exports 2026-03-20 16:52:10 +00:00
Peter Steinberger
18fa2992f9 fix: restore plugin sdk runtime barrels 2026-03-20 16:46:34 +00:00
Peter Steinberger
cb89325cd8 fix: restore latest main gate 2026-03-20 16:46:34 +00:00
Vincent Koc
aa78a0c00e refactor(plugin-sdk): formalize runtime contract barrels 2026-03-20 09:30:34 -07:00
Vincent Koc
9b6f286ac2 refactor(channels): share route format and binding helpers 2026-03-20 09:30:34 -07:00
Vincent Koc
faa9faa767 refactor(web-search): share provider clients and config helpers 2026-03-20 09:30:34 -07:00
Vincent Koc
d3ffa1e4e7 refactor(errors): share api error payload parsing 2026-03-20 09:30:33 -07:00
Vincent Koc
dbc9d3dd70 fix(plugin-sdk): restore root diagnostic compat 2026-03-20 09:27:37 -07:00