* fix(outbound): keep queued TTS/local media alive past its producer process
Outbound TTS synthesizes into a producer-owned temp and the raw path is
persisted into the durable delivery queue with no copy. The temp is removed
when its producer exits (and by a 5-minute timer well inside the queue's
~22-minute retry budget), so a deferred delivery replayed by a fresh recovery
process reads a path whose owner already deleted it: the send burns all five
retries on a missing file and the voice is never delivered.
Give the queue its own copy. Before a deliverable row is published, each
authorized local source is read through the same media access the live send
uses and copied into a process-generation-owned artifact root outside the
media TTL sweep; only the queue payload is rewritten, so the live send stays
copy-free on the original path. Custody is proven by owner identity rather
than by a marker file or lease table: artifacts are grouped under
<pid>-<processStartTime>-<nonce>, and reclaim touches a generation only when
its owner is provably gone. A live owner, an unverifiable owner, or a
recycled PID whose start time no longer matches are all handled without
deleting media that a pending row still needs. Wall-clock age is never an
ownership signal.
Ordering is durable-state-first: rows commit before artifacts are unlinked,
so a crash between the two leaves an orphan for reclaim rather than a
delivery that lost its media. Sensitive media reaches neither the spool nor
the row, so required sends fail closed and best-effort sends go live-only
instead of persisting a row that cannot replay.
No schema change, no public SDK surface, no lease/owner table.
* fix(outbound): resolve queue media owner identity on every platform
Generation ownership read process start time through the Linux/Darwin lock
reader only, so on Windows every generation stayed unverifiable and its
artifacts were never reclaimed. gateway-lock already paired that reader with
the Windows CIM/WMIC creation-time reader behind its own private helper, so
the pairing was duplicated policy waiting to drift.
Move the pair behind one owner-identity helper and route both callers through
it. No new process inspection: Windows still resolves through
readWindowsProcessStartTimeSync, Linux/Darwin still through
getFileLockProcessStartTime, and neither platform's behavior changes.
Also cover the production crash boundary end to end: a real child process
stages media, commits the row, and is killed before dispatch; a fresh process
then reclaims the dead generation while retaining the artifact its pending row
still needs, reads the same bytes after the producer's source is deleted, and
drops the artifact once the row is acked.
* fix(outbound): close reclaim race and partial-stage leak in queue media
Two defects found by external review of the previous commits.
Reclaim built its retain set before proving generation ownership, so a
short-lived producer (`openclaw message send`) that staged, committed its row,
and exited while a sweep was running would have its artifact judged against a
snapshot taken before that commit: the sweep saw a dead owner, missed the new
reference, and unlinked media a pending row still needed. The retain set is now
read after each death proof. That is sufficient rather than merely narrower: a
process only ever stages into its own generation, so once an owner is proven
dead no further references to it can appear, and everything it committed before
exiting is already durable.
Staging also leaked on partial failure. When a later source in an entry failed,
earlier copies were already published, no row would ever reference them, and
reclaim deliberately never touches a live owner's generation, so they
accumulated for the process lifetime. Failed staging now releases what it
published. Per-payload media staging is sequential for the same reason: a
concurrent copy could land after the cleanup ran and orphan itself anyway,
and one source at a time also bounds peak memory.
* fix(outbound): resolve queue media access exactly as the live send does
Queue staging read media through params.mediaAccess directly, while the live
send resolves an agent-scoped capability first. The two gates therefore
disagreed: agent-generated media under the agent workspace is reachable only
through the agent-scoped roots, so staging rejected sources the send itself
would have delivered. A required send failed outright, and a best-effort send
silently lost its write-ahead row for exactly the media class this change is
meant to protect.
Resolve the capability once and share it, so staging can neither reject media
the send would deliver nor read more than the send may. The live send now
routes through the same helper rather than keeping a second copy of the
argument list.
The spool test previously fabricated an explicit localRoots and placeholder
bytes, which hid the gap; it now uses the production shape (no explicit media
access, source in the OpenClaw temp root that TTS writes to) and real
buffer-verifiable audio, because host-local sends are content-verified.
* test(outbound): cover agent-workspace media that only the scoped capability reads
The existing staging test used a source in the OpenClaw temp root, which both
the raw and the agent-scoped capability permit, so it could not tell the two
apart and would have passed against the defect it was meant to guard.
Add a case whose source lives in an agent workspace at
<state>/workspace-<agentId>. The unscoped default roots reject that path by
construction, so a durable row exists only when staging resolves the same
agent-scoped capability the live send resolves. Reverting staging to the raw
media access, or bypassing the shared resolver, fails this test.
* test(outbound): pin agent-workspace staging to the agent-scoped capability
The regression case admitted its source two ways that had nothing to do with
agent scoping: the state dir sat inside the OpenClaw temp root, which is itself
a default media root, and parent-root expansion grants any declared source
directory. Either would keep the test green after the agent identity was
dropped from the resolver.
Move the state dir outside the temp root and set tools.fs.workspaceOnly, which
suppresses source-derived root expansion. The agent workspace is then reachable
only through the agent-scoped capability, so removing the agent identity, the
shared resolver, or reverting to the raw media access each fail the test.
* test(gateway): pin queue media retention across retry backoff
* fix(outbound): retain queued media for retries
Co-authored-by: Masato Hoshino <g515hoshino@gmail.com>
* fix(outbound): retain queued media for retries
Co-authored-by: Masato Hoshino <g515hoshino@gmail.com>
* fix(outbound): retain queued media for retries
Co-authored-by: Masato Hoshino <g515hoshino@gmail.com>
* docs(changelog): avoid queued TTS merge conflict
Co-authored-by: Masato Hoshino <g515hoshino@gmail.com>
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Co-authored-by: Peter Steinberger <peter@steipete.me>
* fix(ios): attach EKAlarm to reminders.add so due-time notifications fire
EKReminder.dueDateComponents only sets the deadline; without an explicit
EKAlarm, iOS does not produce lock-screen or banner notifications.
Closes#105523
* fix(ios): configure reminder due alerts
Co-authored-by: xialonglee <li.xialong@xydigit.com>
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(sandbox): stabilize stat errors across locales
* fix(sandbox): normalize remote stat locale
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(agents,cron): remove pattern field from model-facing cron tool schema
Fixes#107449
* fix(agents): regenerate prompt snapshots for cron schema pattern removal
Remove "pattern": "\\S" from the declarationKey field in the
model-facing cron tool schema across all three codex dynamic-tools
snapshot fixtures. This aligns the committed prompt contract with
the runtime schema change that removed the unanchored pattern
constraint incompatible with llama.cpp.
* test(cron): lock llama.cpp schema boundary
Co-authored-by: 李健0668000722 <li.jian21@xydigit.com>
* docs(changelog): place cron fix in release tail
Co-authored-by: 李健0668000722 <li.jian21@xydigit.com>
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(scripts): bound ntfy auth notifications
* test(queue): align Sol default with current main
* fix(protocol): regenerate bundled clients for sessions thinkingLevel
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(restart-sentinel): log DB errors instead of silently swallowing them
Replace empty catch blocks in clearRestartSentinel, readRestartSentinel,
and hasRestartSentinel with sentinelLog.warn(...) calls so SQLite errors
are visible in diagnostics while preserving best-effort fallback semantics.
Tests use deterministic fault injection via vi.mock on openclaw-state-db.js
with hoisted throw flags, replacing the previous non-deterministic state-dir
removal approach. Each error path asserts both the warning message and the
correct fallback return value.
* fix(restart-sentinel): report persistence failures
Co-authored-by: wendy-chsy <wan.wenyan@xydigit.com>
* ci: retrigger pull request checks
* chore(ci): prune stale max-lines baseline
* chore(ci): retest against repaired protocol baseline
* chore: stabilize restart sentinel changelog entry
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Co-authored-by: wendy-chsy <wan.wenyan@xydigit.com>
* refactor(plugin-sdk): narrow wildcard barrels to explicit used exports
* refactor(tools): delete dead tool-planning module exposed by barrel narrowing
* fix(plugin-sdk): restore deprecation tag on OpenClawSchemaType alias
* test(agents): drop test for deleted runtime proxy module
* refactor(tools): trim descriptor types to cache consumers
* refactor(deadcode): harvest exports orphaned by barrel narrowing
* refactor(deadcode): harvest exports orphaned by barrel narrowing (rest)
* fix(agents): restore sdk imports and test markers via public predicate
* fix(plugin-sdk): named type re-exports in plugin-entry; trim types barrel precisely
* chore(plugin-sdk): account unmasked deprecated provider types in budgets
* fix(plugins): name star-only type rows for dts bundling
* fix(plugins): restore host-hook surface; unexport internal api compositions
* fix(plugins): named type imports for api composition; restore needed source exports
* fix(plugins): knip-visible type imports for registry surfaces
* test: adapt tests to privatized media and command internals
* fix(qa-lab): re-export snapshot conversation type
* style: format sessions sdk imports
* fix(plugins): restore smoke entry export; pin budgets to exact actuals
* fix(plugins): canonical smoke-entry import; drop orphaned root shims
* fix(plugins): allowlist manifest probe, repoint qa web import, drop dead browser barrels
* fix(plugin-sdk): pin codex auth marker and scaffold provider type
* fix(qa-lab): keep web-facing model-selection shim within boundary rules
* fix(plugin-sdk): preserve merged contracts through narrowed barrels
* chore(plugin-sdk): pin post-rebase surface budgets
* refactor(ui): share one panel tab strip between terminal and browser
Extract the terminal tab strip (tab + attached close button as one
surface, from #108611) into a shared panel-tab-strip module and migrate
the in-app browser panel onto it. The browser tabs inherit the attached
close design; terminal tabs gain middle-click close and long-label
ellipsis; both get the empty-group workaround and a strip that shrinks
inside the flex header. Net -24 prod LOC; duplicated tp-/bp- strip CSS
deleted.
* fix(ui): keep shared panel new-tab button stable
* fix(daemon): write Windows gateway launchers in encodings wscript/cmd can decode
gateway.vbs and gateway.cmd were written as UTF-8 without BOM, but
wscript.exe only reads .vbs as ANSI or UTF-16 LE with BOM and cmd.exe
reads .cmd in the console OEM code page, so installs under CJK profile
paths failed with "file not found" (#107416).
Write .vbs as UTF-16 LE with BOM, write non-ASCII .cmd content in the
system code page when it matches the console page (CJK/Thai locales),
and BOM-sniff plus code-page-fallback on read so launchers from older
installs keep parsing and migrate on refresh. The hidden .vbs launch
path originates from #95480, which addressed console visibility only.
* refactor(daemon): drop unused WindowsLauncherScriptFormat export
The type is only referenced by encodeWindowsLauncherScript's format
parameter within the module, so the export tripped check-deadcode-exports.
Keep it module-local.
* fix(daemon): mark code-page cmd launchers with their encoding for deterministic readback
Prepend an ASCII '@rem openclaw-launcher-encoding=<label>' line to code-page
.cmd launchers and decode by that marker instead of sniffing UTF-8. Some GBK
byte sequences are valid UTF-8 (隆 = C2 A1 reads as ¡), so the old sniff
silently corrupted readback and rejected valid paths; the marker makes decode
deterministic and drops the code-page probe (a PowerShell spawn) from the
frequent readScheduledTaskCommand poll path.
Also fix the representability guard for euc-kr: Node ICU decodes euc-kr as
KS X 1001 only, but Windows code page 949 is cp949/UHC, so the TextDecoder
cross-check false-rejected ~8,800 UHC extension syllables (똠 = 8C 63) that
iconv encodes and cmd.exe reads fine. Verify euc-kr via iconv's own cp949
round-trip; keep TextDecoder for the other five labels.
* fix(infra): write Windows restart helper scripts through the launcher encoder
The update-time restart helper wrote its temp .cmd as raw UTF-8 while
embedding the restart-log path, task name, and task script path, so a CJK
profile path or task name broke the same way as the gateway launchers
(#107416). Route the write through encodeWindowsLauncherScript: ASCII content
stays byte-identical UTF-8, CJK content gets the marked code-page encoding, and
an unrepresentable task name now fails the restart attempt cleanly instead of
writing a script cmd.exe would misread.
* chore(deps): minimize pnpm-lock delta for the iconv-lite promotion
Reset pnpm-lock.yaml to origin/main and re-add only the iconv-lite root
importer entry, dropping the unrelated @types/node peer-context flips and
audio-decode deprecation metadata that a mismatched-toolchain regeneration had
pulled in. The diff vs main is now the three-line importer entry only; the
version already resolves in main's tree via express -> body-parser/raw-body.
* refactor(windows): centralize launcher encoding
Co-authored-by: Jason Yao <wsyjh8@gmail.com>
* style(windows): format launcher encoding test
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Co-authored-by: Peter Steinberger <peter@steipete.me>
* fix(http-error-body): log response body snippet read errors instead of silently returning empty string
readResponseBodySnippet used a bare catch {} that silently swallowed all
errors (network failure, body already consumed, decode errors, stream
aborts) and returned an empty string with no diagnostic. This made it
impossible to distinguish between a genuinely empty response body and
a read failure.
Replace catch {} with catch (err) { errorBodyLog.warn(...); return ""; }
so failures are visible in diagnostics while preserving the best-effort
snippet contract.
* fix(http-error-body): assert subsystem warning in error visibility tests
ClawSweeper review identified that the error-path tests only checked
the empty-string fallback, which the old silent catch would also pass.
Add mockWarn assertions to verify the warning is emitted with the
formatted error text, and add beforeEach to clear mocks between tests.
* test(http-error-body): assert logged read errors
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix: recognize provider-wrapped HTTP status for session retry
* fix(llm): scope wrapped status parsing to retry
Preserve the leading-status contract for rate-window and formatting callers while letting retry classification recognize built-in provider wrappers.
Co-authored-by: wuqingxuan <wu.qingxuan@xydigit.com>
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
