13133 Commits

Author SHA1 Message Date
zeroaltitude
f086588599
fix(channels): use caller normalizer in reverse map; skip disabled accounts
Two fixes in response to review:

1. Use options.normalizeAccountId (caller-provided) instead of the
   imported normalizeAccountId when building the reverse map in
   everyAccountHasOwnTokens. Ensures the reverse map keys match the IDs
   returned by listConfiguredAccountIds() when a custom normalizer is used.

2. Filter disabled accounts before the everyAccountHasOwnTokens gate.
   Disabled accounts are skipped at channel startup; allowing them to block
   default injection would prevent the base account from starting in mixed
   enabled/disabled configs where all enabled accounts are independent.
2026-03-18 19:57:50 -07:00
zeroaltitude
86cc78d593
fix: resolve normalized account IDs before token-override checks
When normalizeAccountId transforms config keys (e.g. 'Router D' →
'router-d'), listAccountIds returns normalized IDs but the
everyAccountHasOwnTokens check used accounts[normalizedId], which
misses the raw config key. Added a reverse map from normalized ID
to raw key for the lookup.

Regression test: non-canonical key normalizes correctly and default
is still injected when the account has its own tokens.
2026-03-18 14:48:33 -07:00
zeroaltitude
4e626e91db
fix(channels): require full token override for independence, trim whitespace tokens
- Named accounts must now override ALL base token fields (not just any
  one) to be considered independent. Partial overrides (e.g. only
  appToken when base has both botToken+appToken) are correctly treated
  as inheriting the base identity.
- Base token check now trims whitespace — '   ' is not a valid token.
- Added 2 test cases: partial override, whitespace-only tokens.

Addresses codex-connector P1+P2 on PR #30310.
2026-03-18 14:48:33 -07:00
zeroaltitude
3800f859d2
fix(channels): only inject default when ALL named accounts have own tokens
Mixed configs (some accounts with own tokens, some inheriting base)
would still duplicate credentials between default and inheriting
accounts. Now requires every named account to carry per-account auth
before injecting default.

Addresses codex-connector P1 on PR #30310.
2026-03-18 14:48:32 -07:00
zeroaltitude
4b67092c2b
fix(channels): skip default account injection when named accounts inherit base tokens
- Don't inject 'default' when all named accounts lack per-account
  auth overrides (they'd use the same base credentials, causing
  duplicate provider connections and event processing)
- Use normalizeAccountId for case-insensitive default detection
- Applies to Slack (botToken/appToken) and Discord (token) alike

Addresses review feedback from codex-connector on PR #30310.
2026-03-18 14:48:32 -07:00
zeroaltitude
4e183da984
fix(channels): include default account when base config has tokens
When a channel config has top-level tokens (botToken/appToken/token)
AND named accounts in the accounts section, listAccountIds() omitted
the default account. This meant only named accounts started, leaving
the base-config bot disconnected.

Now detects base-level tokens and includes 'default' alongside named
accounts so both providers start.

Includes 3 test cases: base tokens present, default already in accounts
(no duplicate), and no base tokens (unchanged behavior).

Co-authored-by: Eddie Abrams <eddie@bighatbio.com>
2026-03-18 14:48:31 -07:00
Vincent Koc
91d37ccfc3 fix(auth): lazy-load provider oauth helpers 2026-03-18 13:40:28 -07:00
Vincent Koc
6ebcd853be fix(plugin-sdk): isolate provider entry surfaces 2026-03-18 13:20:46 -07:00
Josh Avant
e6911f0448
Tests: restore deterministic plugins CLI coverage (#49955)
* Tests: restore deterministic plugins CLI coverage

* CLI: preserve plugins exit control-flow narrowing

* Tests: fix plugins CLI mock typing for tsgo

* Tests: fix provider usage mock typing in key normalization
2026-03-18 14:05:04 -05:00
Vincent Koc
ef1346e503 Plugin SDK: route reply payload through public subpath 2026-03-18 12:01:15 -07:00
Vincent Koc
ecfa79ee4c Tests: fix provider auth plugin mock spread 2026-03-18 12:01:05 -07:00
darkamenosa
4b5487ee85
LINE: avoid runtime lookup during onboarding (#49960) 2026-03-19 01:27:21 +07:00
Peter Steinberger
a0d3dc94d0 perf: reduce unit test hot path overhead 2026-03-18 18:19:40 +00:00
Vincent Koc
fa52d122c4 Plugin SDK: route provider metadata through public models subpath 2026-03-18 11:18:04 -07:00
Peter Steinberger
62edfdffbd refactor: deduplicate reply payload handling 2026-03-18 18:14:57 +00:00
Vincent Koc
152d179302 Plugin SDK: add public WhatsApp runtime subpaths 2026-03-18 11:13:19 -07:00
Vincent Koc
8240fd900a Plugin SDK: route core channel runtimes through public subpaths 2026-03-18 11:00:58 -07:00
Vincent Koc
7d08070dd7 Plugins: generate bundled auth env metadata 2026-03-18 10:53:48 -07:00
Peter Steinberger
8d73bc77fa refactor: deduplicate reply payload helpers 2026-03-18 17:30:25 +00:00
Vincent Koc
891e2a3da8 Build: isolate optional bundled plugin-sdk clusters 2026-03-18 09:54:22 -07:00
Vincent Koc
b4f16bad32 Plugin SDK: export windows spawn and temp path 2026-03-18 09:46:24 -07:00
Vincent Koc
a02bfd30c5 Plugin SDK: use public utility subpaths 2026-03-18 09:43:46 -07:00
Vincent Koc
f187e8bac4 Plugin SDK: use public slack subpath 2026-03-18 09:40:57 -07:00
Vincent Koc
e64cc1983f Plugin SDK: use public discord subpath 2026-03-18 09:39:12 -07:00
Vincent Koc
b3ca855283 Plugin SDK: use public whatsapp subpath 2026-03-18 09:37:54 -07:00
Peter Steinberger
27f655ed11 refactor: deduplicate channel runtime helpers 2026-03-18 16:37:27 +00:00
Vincent Koc
3e02635df3 Plugin SDK: use public telegram subpath 2026-03-18 09:33:21 -07:00
Vincent Koc
382640e674 Channels: trim optional bundled plugin defaults 2026-03-18 09:30:54 -07:00
Peter Steinberger
3d8afb96bd fix: use transpiled jiti for source plugin shims 2026-03-18 16:24:45 +00:00
liyuan97
b64f4e313d
MiniMax: add M2.7 models and update default to M2.7 (#49691)
* MiniMax: add M2.7 models and update default to M2.7

- Add MiniMax-M2.7 and MiniMax-M2.7-highspeed to provider catalog and model definitions
- Update default model from MiniMax-M2.5 to MiniMax-M2.7 across onboard, portal, and provider configs
- Update isModernMiniMaxModel to recognize M2.7 prefix
- Update all test fixtures to reflect M2.7 as default

Made-with: Cursor

* MiniMax: add extension test for model definitions

* update 2.7

* feat: add MiniMax M2.7 models and update default (#49691) (thanks @liyuan97)

---------

Co-authored-by: George Zhang <georgezhangtj97@gmail.com>
2026-03-18 09:24:37 -07:00
Peter Steinberger
5fd482d6b0 test: align acp session mode list 2026-03-18 16:14:14 +00:00
Vincent Koc
73539ac787 Core: move web media seam out of plugin sdk 2026-03-18 09:12:23 -07:00
Vincent Koc
cfdc0fdbe1 Plugins: include fal in image-generation contract registry 2026-03-18 08:59:00 -07:00
Vincent Koc
22fc5a5442 Contracts: narrow codex catalog hint return type 2026-03-18 08:54:01 -07:00
Vincent Koc
ebb10c0852 Contracts: fix codex catalog hint assertion 2026-03-18 08:46:58 -07:00
Vincent Koc
6a381e80bc Contracts: stabilize provider plugin test imports 2026-03-18 08:44:47 -07:00
Peter Steinberger
a0e7a2fcc1 fix: repair rebased contract gate 2026-03-18 15:43:24 +00:00
Peter Steinberger
f6928617b7 test: stabilize gate regressions 2026-03-18 15:36:32 +00:00
Peter Steinberger
7943e83c6c fix: restore rebased full gate 2026-03-18 15:36:18 +00:00
Peter Steinberger
c0c3c4824d fix: checkpoint gate fixes before rebase 2026-03-18 15:36:18 +00:00
Peter Steinberger
e9b19ca1d1 fix: restore full gate after web-search rebase 2026-03-18 15:35:27 +00:00
Peter Steinberger
861fcb1575 fix: restore rebased full gate 2026-03-18 15:34:27 +00:00
Peter Steinberger
b5d2123156 fix: stabilize rebased full gate 2026-03-18 15:34:27 +00:00
Peter Steinberger
0cddb5fb7c fix: restore full gate 2026-03-18 15:34:27 +00:00
Tak Hoffman
5d41fd4497
test: extend plugin contract setup timeouts 2026-03-18 09:42:52 -05:00
Tak Hoffman
13f396b395
Plugins: sync contract registry image providers 2026-03-18 08:27:48 -05:00
Andrew Demczuk
089a43f5e8
fix(security): block build-tool and glibc env injection vectors in host exec sandbox (#49702)
Add GLIBC_TUNABLES, MAVEN_OPTS, SBT_OPTS, GRADLE_OPTS, ANT_OPTS,
DOTNET_ADDITIONAL_DEPS to blockedKeys and GRADLE_USER_HOME to
blockedOverrideKeys in the host exec security policy.

Closes #22681
2026-03-18 13:11:01 +01:00
Vincent Koc
b9e08a6839 Config: align model compat thinking format types 2026-03-18 02:45:15 -07:00
Vincent Koc
f96ee99bbc Plugin SDK: harden provider auth seams 2026-03-18 02:29:25 -07:00
Ayaan Zaidi
93a31b69de
fix(config): add missing qwen-chat-template to thinking format schema 2026-03-18 14:54:38 +05:30