Publish bounded, deduplicated ancestor snapshots through the existing per-viewer
Gateway presenter, and refresh derived facts on keyed registry publications.
Apply complete rows with their own identity and field receipts while retaining
conservative membership and pagination refreshes. Skip recap-only invalidation
in the agent roster.
The 28-viewer fixture eliminates window reads for repeated child, terminal-child,
and recap changes while preserving initial pages and broad invalidations.
Rendering is unchanged; protocol-v4 snapshot additions are documented.
* fix(gateway): preserve work during recovered Node restarts
Let Unix Node recovery wrappers respect the existing Gateway stop budget.
Share startup-safe command classification and deadline facts, and resolve
managed restart intent against the live serving owner in its write
transaction with current update authority.
Preserve the existing public PID intent API, record format, and Windows
behavior. Keep cold lifecycle test preparation outside timed hooks.
Inspired by @ly85206559's wrapper-grace approach in #147054; this repair
is independently authored from main. Related: #146956. Windows cooperative
shutdown remains a follow-up.
* refactor(gateway): stabilize restart callback and test setup
Declare receiver-independent restart intent callbacks as arrows and retain typed signal spy handles for lint-safe assertions. Move cold lifecycle imports into test collection so worker preparation cannot consume timed setup hooks.
* fix(onboarding): avoid blocking recommendation storage
Keep recommendation reads on the independent read-only worker and route all five mutations through the existing shared-state actor. Preserve workspace identity, no-create reads, transaction and CAS behavior, and await persistence in registered CLI actions and both wizard completion paths.
* refactor(onboarding): keep state decoding and dispatch with owners
Publication and confirmation now distinguish held workspace leases from unavailable storage and caller-canceled acquisition. The shared SQLite lease owner records these outcomes, replacing the publication-specific retry inference while preserving caller authority, native settlement, and retired-owner fencing.
Doctor records pre-grant cancellation as a visible inspection warning without changing its signal budget or mutating source state. No new configuration, CLI options, schemas, dependencies, or wait limits are introduced.
Validation: scoped-clean Codex review; native SQLite/worker, registered publication RPC, Doctor, updater-authority, and wrapper-boundary proof; exact-head CI gate success. The current candidate's published-updater through healthy Gateway restart scenario remains an explicitly accepted, bounded validation gap recorded in the PR body.
* refactor(auth): prepare bounded shared auth scopes asynchronously
Read shared ownership and portable credentials through the existing state
worker before entering bounded CLI and provider-setup auth scopes. Resolve
paths before awaiting and recheck admission and ownership before entry.
Preserve local overrides, OAuth refresh ownership, and personal-account
isolation. Record the cold-worker latency and memory tradeoff in PR evidence.
Related: #149309
* fix(test): await scoped auth while staging live fixtures
Wait for the portable auth view and target persistence before fixture
installation continues. Drain the CLI's existing maintenance owner before
exit and run direct helper tests through the host database-worker lane.
* test(auth): include cacheability in scoped read fixtures
* test(auth): align cancellation fixture with current row metadata
* test(outbound): clean up ACK fixtures with their owner
(cherry picked from commit 4681239a66)
* fix(update): keep a managed update from stranding the gateway after the install swap
A managed package update stages the new version, swaps it over the live
install root, and only then restarts and verifies the gateway. That
restart runs inside the updater process, which is still executing the
build that was just replaced. The bundled dist is split into
content-hashed chunks, so any `import()` reached for the first time after
the swap resolves to a chunk name that only the old tree contained:
Gateway: restart failed: Error: ENOENT: no such file or directory,
open '.../node_modules/openclaw/dist/shared-DFJEouXv.js'
`maybeRestartService` caught that as a restart failure, which became
`recovery.serviceRestartSafe: false`, which made the update helper exit
with the unsafe code and log "keep the gateway stopped until the
installation is repaired". The installation was fine -- npm install, the
swap, and doctor had all exited 0 -- but the gateway stayed down until
someone restarted it by hand. Observed on a 2026.9.1 -> 2026.9.2 npm
update: a 3h outage from a successful upgrade.
Two changes:
- Warm the restart path's lazy modules in `beforeActivate`, the last
point where this process can still read its own install tree. The probe
gained a loader for `gateway/call.js`, which was a bare dynamic import
and so could not be warmed.
- Recognize a missing module inside our own install root and stop
treating it as a verdict on the new install. Restarting the service is
strictly better than parking it: the old process is gone either way,
and a genuinely broken install still surfaces through the service's own
supervision. A missing *data* file in the install root is still a real
failure.
Claude-Session: https://claude.ai/code/session_01WKVaMWLzdHNJCa82nnTfWg
* test(update): use canonical normalization in restart regression
* test(update): register package-swap regression in its CI owner
* test(gateway): join task events before reset fixture cleanup
* test(gateway): join task events before in-test settlement
* test(gateway): prepare auth command runtime before handshake
* fix(ci): bound serial storage-state test stripes
* fix(ci): scope storage file ceiling to hosted jobs
* test(transcripts): wait for routed provider startup
* test: honor delivery and session fixture ownership
* test(transcripts): join configured provider startup
---------
Co-authored-by: baovo15 <duybao.vin@gmail.com>
Co-authored-by: Jason (Json) <263060202+fuller-stack-dev@users.noreply.github.com>
* fix: avoid blocking Gateway work on queued collector registry writes
* fix(tasks): retain delayed flow repairs through cleanup
Move live flow retries and projection snapshots onto the shared task-domain
worker while retaining transaction-time live selection and lifecycle custody.
Join failed projection reads before releasing Gateway work, and give durable
retry timers their own async cleanup scope when they fire.
Preserve immediate synchronous compatibility, full-row compound writer checks,
and the existing retry schedule. No schema or retention changes.
* fix(tasks): avoid redundant mirrored-flow snapshot reads
Let the canonical write transaction classify dirty mirrored-flow targets
without first refreshing the full projection. Preserve clean missing and
managed no-entry behavior and use the existing getter on failure to retain
current failure metadata. Keep unrelated dirty obligations and query budgets.
* fix(test): remove duplicate Codex attempt inventory entries
* test(ci): distinguish retained job worker caps
* fix(test): preserve under-cap syntax repairs in validation
* refactor(tasks): share creation and transition operations
* fix: publish acknowledged managed task receipts
* fix: await initial task persistence before Gateway activation
* fix(subagents): settle cancelled queued launch metadata
* fix(test): await registration in waiting reply fixtures
* test: await routed transcript provider readiness
* test(outbound): clean up ACK fixtures with their owner
* fix: restore Mac presence context and Canvas media playback
* refactor(gateway): separate the node session type contract
* test(codex): cover active presence in prompt fixtures
* test: include active computer in Codex context ordering
* test: supply snapshot auth-profile store
* test: align presence search and CLI prompt expectations
* fix(scripts): use REST for writer identity and reviewer claims
Use included-header REST identity reads through the protected selected CLI, preserving the actual mutation writer and quota diagnostics. Verify reviewer assignment through the REST assignees response. Keep GraphQL contracts for queue state, squash previews, required-check app binding, and atomic publication. Refs #153199.
* test: preserve acknowledgement worker owner checks
* fix(ui): keep attached context out of message text
Preserve bounded send-time reference snapshots separately from authored text through queued sends, retries, transcript display, and edit actions. Keep raw context inspectable behind a disclosure without changing its authority.
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
* fix(ui): complete context attachment CI coverage
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
* test(state): align custody proof with worker acquisition
Apply the already-landed test correction from bfec65a2a0. Release the late competing host owner before awaiting the worker, while preserving authority checks, operation outcomes, and persisted-state assertions. Reproduces and repairs both failures in CI job 105859785996 without production changes or longer timeouts.
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
* test(ui): keep simulated history fling events contiguous
Drive the final contact movement, release, and initial inertia in one browser task so RPC latency cannot split the intended continuous gesture. Preserve total movement, stationary-touch coverage, omitted scrollend, and every-frame anchoring assertions.
* test(ui): avoid shadowing the momentum fixture parameter
* test: fix native shutdown and session fixture races
Keep Sparkplug compilation synchronous in test Node processes and propagate the shared argv policy to Vitest fork workers. This avoids a proven compiler/GC deadlock during process.exit without changing production shutdown, assertions, or deadlines. Join background session disk measurements before closing and handing off SQLite fixtures.
* test: fix compiler policy assertion and rebalance UI typechecks
Retain the independent Sparkplug shutdown policy when opting into Maglev. Split chat test roots into an appended shard without changing coverage or root limits.
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
---------
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix: keep Gateway responsive while admitting outbound messages
* test: run durable delivery flows with the host database broker
* test: complete durable delivery test routing
* test: include WhatsApp in the database-worker batch expectation
Recover interrupted parent turns regardless of subagent-result provenance. Settle interrupted children through normal completion and let the parent inspect retained state before continuing or replacing them. Remove automatic child relaunch and retry machinery, preserve existing receipt reconciliation, and fence cleanup against newer owners.
* fix(codex): preserve delivery facts and native approval semantics
Keep failed sends from suppressing replies or recording false delivery. Share the host delivery facts before presentation middleware, preserve per-artifact media and finalized native text, and honor native approval lifetimes and explicit form answers.
Replace duplicate delivery and quota decisions with their existing owners. Document the seven shared SDK helpers and apply the approved seven-export and seven-callable surface budget increase.
* test(codex): align native fixtures with canonical outcomes
* test(codex): align mirrored transcript assertions
* fix(codex): retain core conversation delivery receipts
Open About beside Connection and Gateways without requiring a Gateway connection. Replace the obsolete menu-bar description with the current homepage tagline, retain build metadata and resource links, and add Copy Build Info.
Complete managed Gateway upgrades after Node prefix changes while preserving the verified service during preparation and recovering only owned failed activations.
Keep requester/executor and original/candidate ownership through native children; retain uncertain cleanup and original failure outcomes. Source and isolated native component checks are documented in the canonical PR. The wider first-hop installer and other platform journeys remain separate program work.
Closes#107930. Canonical PR history retains the original contributor commits; repository-supported squash preserves explicit contributor credit.
Co-authored-by: Jason (Json) <263060202+fuller-stack-dev@users.noreply.github.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Co-authored-by: Dallin Romney <dallinromney@gmail.com>
Windows installations can now recover automatically when winget, Chocolatey, or Scoop fails or leaves an unsupported Node.js runtime. Guarded package-manager attempts warn and continue through the remaining methods to the existing elevation-free portable Node installer. Runtime validation still gates OpenClaw installation.
The installer remains the sole owner of runtime provisioning. Updated Windows documentation and regression coverage describe and protect failure fallthrough, successful recovery, and final refusal when no usable runtime can be provisioned.
Validation: all 99 exact-head checks completed without failures, including Windows installer CI and openclaw/ci-gate. The isolated Windows recovery trace exercised real portable download, extraction, PATH recovery, and runtime/SQLite validation after an injected Chocolatey failure. Codex review was scoped-clean; ClawSweeper reported no actionable findings or Rank-up moves.
Related: #133869
* fix(plugins): preserve authored config through runtime load plans
* feat(judgments): add typed provider runtime and plugin SDK
* feat(plugins): add per-agent decision models
Add an opt-in decisionModel role for typed choices, scores, and boolean
probabilities, with global defaults and per-agent inheritance or disablement.
Keep provider lifecycle and prepared credentials host-owned, and expose
manifest-only decision choices separately from conversational model catalogs.
Adapt the provider foundation from #152237 to the decisions contract. Existing
configurations keep decision calls disabled until a model is selected.
Co-authored-by: Josh Lehman <550978+jalehman@users.noreply.github.com>
* fix(plugins): complete decision inspection and preserve authored config
Expose optional decision-provider health through the Gateway wire schema
and generated native DTOs. Preserve the landed SecretRef prerequisite’s
identity behavior for unchanged activation plans. Move model mocks into
one private sibling factory without expanding the public helper surface.
Validation: 51 handler/protocol tests, 18 post-extraction tests, 52 runtime
and integration tests, generated protocol checks, and clean P0-P2 review.
The SDK surface-budget increase remains pending maintainer approval.
Co-authored-by: Josh Lehman <550978+jalehman@users.noreply.github.com>
* perf(plugins): reduce decision overhead and unnecessary reloads
Keep one full provider input snapshot and an independent question rubric. Recognize decision-only catalog providers with the existing normalization policy, and reload plugins only for decision-model changes while preserving roster actions. Apply the approved SDK surface increment and behavior-neutral cleanup.
Validation: 58 runtime/config/loader tests, 610 Gateway regression/sibling tests plus 15 final catalog cases, full core typechecks, scoped lint and clean managed review. A 143155-attempt synthetic stress run settles all 18104 provider calls at max concurrency four.
* fix(plugins): preserve reload boundaries and decision test contracts
Materialize only present decision-selector leaves so Telegram account creation/removal retains its parent lifecycle action. Select UI controls by model role, preserve independent chat and decision catalogs in tests, remove an unused probe, and rebalance existing typecheck shards without raising their limits.
Validation: 588 reload tests, 58 shard/loader tests, 38 UI catalog tests, 9 browser tests, affected typechecks, unused-file scans, and clean managed review.
* test(ui): address model pickers by role in gateway flows
Disambiguate Primary from the new Decision picker in the real-Gateway catalog test, alias browser test, and Agents view assertions. Preserve draft and publication checks. Unit/browser/typecheck proof and managed review pass; real-Gateway execution follows on the integrated build.
* test(plugins): isolate runtime metadata and preserve shard headroom
Move the existing lazy-runtime metadata contract intact into its own focused module. Group CLI program tests with commands so newer main tests keep every typecheck shard within existing limits. No production changes or limit increases.
Validation: 57 tests, four typecheck graphs, canonical line guards against the CI main snapshot, targeted lint and clean managed review.
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Co-authored-by: Josh Lehman <550978+jalehman@users.noreply.github.com>
* refactor: reuse fs-safe 0.16 filesystem helpers
Upgrade core and plugin dependencies to the published release. Delegate missing-suffix probing and positional snapshot copying while retaining database identity policy, cache, durability, and cleanup ownership. Remove 333 production lines and document bounded alias diagnostics.
* fix: retain exact directory identities for fs-safe 0.16
Preserve bigint directory identity in updater handoffs, backup publication, and snapshot staging. Keep initial receipts through durability checks, retain published update-state compatibility, and share snapshot directory policy. Cover real publication phases and large filesystem IDs while documenting the released dependency declaration gap.
* test: record approved fs-safe receipt type exceptions
* test: rebalance Gateway type-check groups
* fix(tasks): keep agent event ingestion responsive during database contention
Persist ordered, coalesced task-event metadata through the existing shared-state
worker and canonical publication owner. Preserve exact counts, lifecycle and
identity fences, native overlap, joined shutdown, and notification ownership.
Recover confirmed commits after result or settlement failures without replay.
Record receipt-owned writes independently of projection-byte changes while
keeping canonical refreshes and unpersisted observations distinct. Registered
Gateway task reads retain their synchronous native wait boundary.
Validation: 352-test full sibling campaign before final publication refinements;
114 affected tests on the final behavior, final core/test type checks, targeted
lint, formatting, line caps, and clean managed review. Full changed checks and
build passed before the bounded publication-only/type-only delta. Synthetic
Node/macOS contention proof keeps event emission below 0.4 ms with exact counts.
* test(tasks): settle accepted events before restoring state
* fix(tasks): retain committed event targets before worker settlement
* style(infra): specify worker message transfer lists
* fix(tasks): prepare progress authority without blocking the event loop
* fix(tasks): finish asynchronous progress read integration
Retain the fork pool, non-isolated cleanup, exclusive CI plan, and worker ceiling. Share Gateway fixture port claims, retire file-local redaction state after teardown, and wait for actual fixture readiness.
