Disable fetch-triggered automatic maintenance at the PR source owner. Git 2.54+ can otherwise prune a sibling admin directory with a missing or empty backlink during healthy worktree entry. Keep the existing preservation assertions and align direct helper fixtures with the Darwin Bash guard.
Refs #147527. Reproduces the six containment failures from run 34800901928; three full containment runs pass after the fix. P1 autoreview and check:changed passed.
* perf(workspace): offload inventory and manifest processing
Keep the Gateway and paired nodes responsive during large workspace transfers with bounded computation workers. Hosts retain session authority, Git processes, file writes, durable acceptance, and cleanup.
Use transferable UTF-8 payloads for supported Unicode inventories, preserve independent errors during cancellation, and compare already-decoded manifests without copying their object graphs between threads.
* test(workspace): finish manifest fixture ownership
* refactor(workspace): distinguish stage input implementation
* test: register workspace benchmark and honor system Bash
* fix(ui): load Home and System busyness inside their panels
* chore(ui): record approved immediate-panel startup budgets
* fix(ui): retain System busyness through automatic chunk recovery
* fix(ui): keep automatic diagnostic restores out of Settings
* chore(ui): refresh approved startup baseline against current main
* fix(sandbox): restore workspace files in Docker Gateways
Resolve managed workspace, agent, skill and nested bind sources from a verified Gateway container before sandbox hashing and creation. Share the effective mount plan across shell and browser lifecycles; preserve read-only permissions and refuse stale hot mounts with scoped recreate guidance.
Fixes#31331
Co-authored-by: AaronWander <siralonne@163.com>
Co-authored-by: Frank Yang <frank.ekn@gmail.com>
* test(sandbox): isolate managed mount permission fixtures
* fix(sandbox): narrow discovered Docker container ids
* test(sandbox): split container creation and mount coverage
* test(sandbox): restore filesystem fixture import
* test(sandbox): sort mount proof records immutably
* fix(sandbox): inspect typed Docker metadata and isolate E2E cleanup
* test(sandbox): assert package import follows fixture environment
---------
Co-authored-by: AaronWander <siralonne@163.com>
Co-authored-by: Frank Yang <frank.ekn@gmail.com>
Extend the existing model matrix with isolated Gateway tasks, fixed-workload build comparisons, and separate task and interview evidence. Preserve failed trials, exact source identities, task effects, logical cell completion, and observed preview coverage.
Validation: 187 focused tests, changed-file and targeted type/lint/docs checks, exact-candidate runtime build, actual OpenAI smoke, read-only replay of 24 original trials plus the final smoke, and fresh P2 review. Original scores and interview qualifications remain preserved.
Isolate the native hook relay build graph while preserving readonly state lookup, explicit policy decisions, and the lazy authenticated Gateway fallback.
Cancel disconnected request waits through the existing approval authority. Keep duplicate callers independently cancellable, retain unbound durable approval deduplication, and detach exact relay-owned entries before callbacks so old cleanup cannot remove a successor. Observe already-started promises when synchronous cancellation wins.
Update managed Codex to the official 0.154.0 release and align its version fixtures and current documentation. This improves lifecycle ownership and reduces the relay import closure; it does not cap hook concurrency, prove faster bursts, or establish resolution of the historical constrained-host timeout.
Related: https://github.com/openclaw/openclaw/issues/91009
Thanks to @nvtoroy for the constrained-host captures and guarded opt-out evidence in https://github.com/openclaw/openclaw/pull/121668 and https://github.com/openclaw/openclaw/pull/111205. The opt-out proposal remains distinct and unimplemented by this change.
* fix(codex): route Bun history reads through built worker
* test(codex): align prepared auth restart requests
* fix(codex): recognize aliased Bun history workers
* test(codex): allow optional account read after restart
* fix(logging): share redaction state across module copies
Share the live registry, revision, and cached redactor while preserving independent captured snapshots. Include the singleton helper in frozen publication tooling and its fixture.
* test(agents): keep live read arguments within output budget
Use the fixture path relative to the configured session workspace so deep temporary roots do not exhaust the unchanged 128-token model limit before a tool call completes. Preserve all redaction and continuation assertions.
Publish the complete generated artifact through the existing atomic replacement owner. Preserve ordinary modes and symlinked output parents, remove the direct truncating write, and cover partial-write and rename failures. Fixes#127453. Production net -3 lines.
#143968 added test/scripts/qa-profile-run-status.test.ts, which references
.github/workflows/qa-profile-evidence.yml, so changed-target routing now
selects it for that workflow. The routing expectation in
test-projects.test.ts still listed the previous five owners, which turned
main's tooling shard red. Add the new owner to the expected target list.
* refactor(workboard): run SQLite persistence in workers
Preserve board-scoped hydration and card-scoped notification reads while moving complete database operations to plugin-owned worker connection leases. Drain admitted work and retain retryable cleanup across service retirement and transport failure.
* test(workboard): preserve unclassified plugin routing coverage
* test(workboard): await persisted cleanup outcomes
* fix(ui): stop repeated background metadata reads across chat panes
Share automatic metadata and model catalog refresh generations across panes and defer hidden views until presented. Preserve startup snapshots, in-flight settlement, and explicit retries while coalescing invalidations.
Validated with 317 focused unit tests, 18 mocked Chromium scenarios, targeted owner regressions, full changed-file checks, UI test types, unchanged bundle budgets, and a clean independent review.
* fix(ui): preserve chat readiness during shared metadata refreshes
Keep startup catalog delivery and command metadata independent across early and late presentation changes. Let the current catalog result enable the picker while command metadata is pending, and route integration proof through the application shell owner.
Validation: 673 unit/integration tests; cold and visibility browser regressions; ordered account-snapshot proof; real-Gateway palette recovery; full changed-file and UI test type checks; unchanged bundle budget; clean independent review through P2. Earlier broad local account-picker timeouts remain unattributed and were not hidden by timeout or assertion changes.
* test(ui): target pending account rows before pointer clicks
Raw bounding-box replay could hit the adjacent Manage row after popup placement moved. Hover the retained More row, verify pointer targeting, then send one mouse down/up pair while preserving all disabled, request-count, navigation, and keyboard assertions.
Proven with the original 13-test-order failure trace, which delivered the second click to Manage, followed by all 13 tests passing. UI test types, changed-file checks, and independent review through P2 pass.
* fix(ui): preserve metadata startup settlement across visibility changes
Keep an inactive startup command fallback behind its predecessor's transport
settlement. Reobserve waiting demand through the same admission owner, and
fence inherited catalog work with its creation revision so invalidation cannot
publish an old catalog as current. Same-generation visibility return and
explicit refresh remain immediate.
Honor writer-owned pending state during explicit synchronous metadata error
retry after the publication-owner integration.
Validation: 53 metadata/catalog tests, 94 chat/app-host entrypoint cases,
14 metadata browser scenarios, UI test types, full changed-file checks, and
independent full-diff review through P2. Startup gzip is 354949 bytes under the
unchanged 355719-byte limit. Both hidden invalidation/remount regressions fail
before the repair and pass afterward.
* fix(ci): restore agent test graph headroom
Move the complete managed worktree test family into the existing agents-tools graph. Preserve all canonical roots, graph identities, stripe assignments, compiler concurrency, and the existing 700-root target and 720-root cap.
* fix(test): complete sidebar deferred helper migration
Use the canonical createDeferred helper in the two remaining sidebar scope tests after the shared helper export was retired. Preserve the existing scope-replacement assertions.
* test(ui): close file previews through their hosted tabs
* fix(ui): retain queued metadata publication during invalidation
Let visible command demand adopt the existing queued publication through the command owner while preserving transport settlement barriers. Keep the skill activation request bound intact and repair catalog and hydration test fixtures exposed by CI.
