Skip to content

Commit 1ba1110

Browse files
Leon-SK668Leon-SK668
committed
Merge upstream main into leon/utf16-history-scan
2 parents 917f5f2 + 8677273 commit 1ba1110

679 files changed

Lines changed: 39992 additions & 18826 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.agents/skills/autoreview/scripts/autoreview‎

Lines changed: 330 additions & 25 deletions
Large diffs are not rendered by default.

‎.agents/skills/autoreview/tests/test_autoreview_hardening.py‎

Lines changed: 556 additions & 0 deletions
Large diffs are not rendered by default.

‎.github/labeler.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -228,6 +228,7 @@
228228
- any-glob-to-any-file:
229229
- "apps/linux/**"
230230
- "docs/platforms/linux.md"
231+
- "extensions/linux-canvas/**"
231232
"app: web-ui":
232233
- changed-files:
233234
- any-glob-to-any-file:

‎.github/workflows/ci.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1399,7 +1399,7 @@ jobs:
13991399
// isolate each scenario so one invocation cannot pin a profile part.
14001400
const compatibilityScenarioIds = new Set([
14011401
"control-ui-chat-flow-playwright",
1402-
"crestodian-ring-zero-setup",
1402+
"system-agent-ring-zero-setup",
14031403
"dreaming-shadow-trial-report",
14041404
"gateway-smoke",
14051405
"group-visible-reply-tool",

‎.github/workflows/full-release-validation.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,11 @@ on:
1313
required: false
1414
default: ""
1515
type: string
16+
allow_unreleased_changelog:
17+
description: Allow current-tree packaging to use Unreleased notes; canonical release contexts stay strict
18+
required: false
19+
default: false
20+
type: boolean
1621
provider:
1722
description: Provider lane for cross-OS onboarding and the end-to-end agent turn
1823
required: false
@@ -177,6 +182,7 @@ jobs:
177182
CODEX_PLUGIN_SPEC: ${{ inputs.codex_plugin_spec }}
178183
RELEASE_PROFILE: ${{ inputs.release_profile }}
179184
RUN_RELEASE_SOAK: ${{ inputs.run_release_soak || inputs.release_profile == 'stable' || inputs.release_profile == 'full' }}
185+
ALLOW_UNRELEASED_CHANGELOG: ${{ inputs.target_context_ref == '' && (inputs.allow_unreleased_changelog || inputs.ref == 'main' || inputs.ref == 'refs/heads/main') }}
180186
RERUN_GROUP: ${{ inputs.rerun_group }}
181187
LIVE_SUITE_FILTER: ${{ inputs.live_suite_filter }}
182188
CROSS_OS_SUITE_FILTER: ${{ inputs.cross_os_suite_filter }}
@@ -188,6 +194,7 @@ jobs:
188194
echo "- Target SHA: \`${TARGET_SHA}\`"
189195
echo "- Child workflow ref: \`${CHILD_WORKFLOW_REF}\`"
190196
echo "- Release soak lanes: \`${RUN_RELEASE_SOAK}\`"
197+
echo "- Allow Unreleased changelog packaging: \`${ALLOW_UNRELEASED_CHANGELOG}\`"
191198
echo "- Rerun group: \`${RERUN_GROUP}\`"
192199
if [[ -n "${LIVE_SUITE_FILTER// }" ]]; then
193200
echo "- Live suite filter: \`${LIVE_SUITE_FILTER}\`"
@@ -772,6 +779,7 @@ jobs:
772779
MODE: ${{ inputs.mode }}
773780
RELEASE_PROFILE: ${{ inputs.release_profile }}
774781
RUN_RELEASE_SOAK: ${{ inputs.run_release_soak || inputs.release_profile == 'stable' || inputs.release_profile == 'full' }}
782+
ALLOW_UNRELEASED_CHANGELOG: ${{ inputs.target_context_ref == '' && (inputs.allow_unreleased_changelog || inputs.ref == 'main' || inputs.ref == 'refs/heads/main') }}
775783
RERUN_GROUP: ${{ inputs.rerun_group }}
776784
LIVE_SUITE_FILTER: ${{ inputs.live_suite_filter }}
777785
CROSS_OS_SUITE_FILTER: ${{ inputs.cross_os_suite_filter }}
@@ -1042,6 +1050,7 @@ jobs:
10421050
-f mode="$MODE"
10431051
-f release_profile="$RELEASE_PROFILE"
10441052
-f run_release_soak="$RUN_RELEASE_SOAK"
1053+
-f allow_unreleased_changelog="$ALLOW_UNRELEASED_CHANGELOG"
10451054
-f rerun_group="$child_rerun_group"
10461055
)
10471056
if [[ -n "${LIVE_SUITE_FILTER// }" ]]; then

‎.github/workflows/openclaw-release-checks.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,11 @@ on:
5151
required: false
5252
default: false
5353
type: boolean
54+
allow_unreleased_changelog:
55+
description: Allow current-tree packaging to use Unreleased notes; release branches and tags stay strict
56+
required: false
57+
default: false
58+
type: boolean
5459
rerun_group:
5560
description: Release check group to run
5661
required: false
@@ -119,6 +124,7 @@ jobs:
119124
release_profile: ${{ steps.inputs.outputs.release_profile }}
120125
run_release_soak: ${{ steps.inputs.outputs.run_release_soak }}
121126
run_maturity_scorecard: ${{ steps.inputs.outputs.run_maturity_scorecard }}
127+
allow_unreleased_changelog: ${{ steps.inputs.outputs.allow_unreleased_changelog }}
122128
rerun_group: ${{ steps.inputs.outputs.rerun_group }}
123129
live_suite_filter: ${{ steps.inputs.outputs.live_suite_filter }}
124130
cross_os_suite_filter: ${{ steps.inputs.outputs.cross_os_suite_filter }}
@@ -293,6 +299,7 @@ jobs:
293299
RELEASE_PROFILE_INPUT: ${{ inputs.release_profile }}
294300
RELEASE_RUN_RELEASE_SOAK_INPUT: ${{ inputs.run_release_soak }}
295301
RELEASE_RUN_MATURITY_SCORECARD_INPUT: ${{ inputs.run_maturity_scorecard }}
302+
RELEASE_ALLOW_UNRELEASED_CHANGELOG_INPUT: ${{ inputs.allow_unreleased_changelog }}
296303
RELEASE_RERUN_GROUP_INPUT: ${{ inputs.rerun_group }}
297304
RELEASE_LIVE_SUITE_FILTER_INPUT: ${{ inputs.live_suite_filter }}
298305
RELEASE_CROSS_OS_SUITE_FILTER_INPUT: ${{ inputs.cross_os_suite_filter }}
@@ -353,6 +360,16 @@ jobs:
353360
if [[ "$release_profile" == "stable" || "$release_profile" == "full" ]]; then
354361
run_release_soak=true
355362
fi
363+
allow_unreleased_changelog="$(printf '%s' "$RELEASE_ALLOW_UNRELEASED_CHANGELOG_INPUT" | tr '[:upper:]' '[:lower:]')"
364+
if [[ "$RELEASE_REF_INPUT" == "main" || "$RELEASE_REF_INPUT" == "refs/heads/main" ]]; then
365+
allow_unreleased_changelog=true
366+
elif [[ "$RELEASE_REF_INPUT" =~ ^(refs/heads/)?(release/[0-9]{4}\.[0-9]+\.[0-9]+|extended-stable/[0-9]{4}\.[0-9]+\.33|tideclaw/alpha/) ]] || [[ "$RELEASE_REF_INPUT" =~ ^(refs/tags/)?v[0-9]{4}\.[0-9]+\.[0-9]+ ]]; then
367+
allow_unreleased_changelog=false
368+
elif [[ "$allow_unreleased_changelog" != "true" && "$allow_unreleased_changelog" != "1" && "$allow_unreleased_changelog" != "yes" ]]; then
369+
allow_unreleased_changelog=false
370+
else
371+
allow_unreleased_changelog=true
372+
fi
356373
codex_plugin_spec="$RELEASE_CODEX_PLUGIN_SPEC_INPUT"
357374
if [[ -z "${codex_plugin_spec// }" && "$RELEASE_PACKAGE_SPEC_INPUT" =~ ^openclaw@(.+)$ ]]; then
358375
codex_plugin_spec="npm:@openclaw/codex@${BASH_REMATCH[1]}"
@@ -443,6 +460,7 @@ jobs:
443460
printf 'release_profile=%s\n' "$release_profile"
444461
printf 'run_release_soak=%s\n' "$run_release_soak"
445462
printf 'run_maturity_scorecard=%s\n' "$run_maturity_scorecard"
463+
printf 'allow_unreleased_changelog=%s\n' "$allow_unreleased_changelog"
446464
printf 'rerun_group=%s\n' "$RELEASE_RERUN_GROUP_INPUT"
447465
printf 'live_suite_filter=%s\n' "$RELEASE_LIVE_SUITE_FILTER_INPUT"
448466
printf 'cross_os_suite_filter=%s\n' "$RELEASE_CROSS_OS_SUITE_FILTER_INPUT"
@@ -466,6 +484,7 @@ jobs:
466484
RELEASE_PROFILE: ${{ steps.inputs.outputs.release_profile }}
467485
RUN_RELEASE_SOAK: ${{ steps.inputs.outputs.run_release_soak }}
468486
RUN_MATURITY_SCORECARD: ${{ steps.inputs.outputs.run_maturity_scorecard }}
487+
ALLOW_UNRELEASED_CHANGELOG: ${{ steps.inputs.outputs.allow_unreleased_changelog }}
469488
RELEASE_RERUN_GROUP: ${{ inputs.rerun_group }}
470489
RELEASE_LIVE_SUITE_FILTER: ${{ inputs.live_suite_filter }}
471490
RELEASE_CROSS_OS_SUITE_FILTER: ${{ inputs.cross_os_suite_filter }}
@@ -484,6 +503,7 @@ jobs:
484503
echo "- Release profile: \`${RELEASE_PROFILE}\`"
485504
echo "- Release soak lanes: \`${RUN_RELEASE_SOAK}\`"
486505
echo "- Maturity scorecard docs: \`${RUN_MATURITY_SCORECARD}\`"
506+
echo "- Allow Unreleased changelog packaging: \`${ALLOW_UNRELEASED_CHANGELOG}\`"
487507
echo "- Rerun group: \`${RELEASE_RERUN_GROUP}\`"
488508
if [[ -n "${RELEASE_LIVE_SUITE_FILTER// }" ]]; then
489509
echo "- Live suite filter: \`${RELEASE_LIVE_SUITE_FILTER}\`"
@@ -654,6 +674,7 @@ jobs:
654674
packages: read
655675
uses: ./.github/workflows/install-smoke-reusable.yml
656676
with:
677+
allow_unreleased_changelog: ${{ needs.resolve_target.outputs.allow_unreleased_changelog == 'true' }}
657678
ref: ${{ needs.resolve_target.outputs.revision }}
658679
run_bun_global_install_smoke: true
659680

@@ -701,6 +722,7 @@ jobs:
701722
uses: ./.github/workflows/openclaw-live-and-e2e-checks-reusable.yml
702723
with:
703724
advisory: ${{ startsWith(github.ref, 'refs/heads/tideclaw/alpha/') }}
725+
allow_unreleased_changelog: ${{ needs.resolve_target.outputs.allow_unreleased_changelog == 'true' }}
704726
# Live-provider suites depend on third-party model deployments; beta
705727
# treats only those as advisory while repo E2E stays blocking and
706728
# stable/full keep everything blocking.
@@ -774,6 +796,7 @@ jobs:
774796
uses: ./.github/workflows/openclaw-live-and-e2e-checks-reusable.yml
775797
with:
776798
advisory: ${{ startsWith(github.ref, 'refs/heads/tideclaw/alpha/') }}
799+
allow_unreleased_changelog: ${{ needs.resolve_target.outputs.allow_unreleased_changelog == 'true' }}
777800
ref: ${{ needs.resolve_target.outputs.revision }}
778801
include_repo_e2e: false
779802
include_release_path_suites: true

‎AGENTS.md‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -143,14 +143,17 @@ Skills own workflows; root owns hard policy and routing.
143143
- Delegated Testbox rejects `--fresh-pr` and `--stop-after`; sync current checkout, workflow owns lifecycle.
144144
- PR review artifacts: keep template enum values; put evidence detail in summaries.
145145
- Crabbox request means real scenario proof: install/update/call/repro user path; not just copy tests and run them remotely.
146+
- Blacksmith Testbox delegated runs: omit `--stop-after`; unsupported, cleanup is delegated.
146147
- Visual proof: use Crabbox, set up like a user, then screenshot-verify. No harness/bypass/shortcut unless explicitly asked.
147148
- Trusted-source local agent work includes one/few focused tests, `git diff --check`, targeted formatting, and cheap static probes when dependencies already exist. Untrusted source executes none of its repository-controlled tooling locally. Computationally intensive work uses the selected remote box.
148149
- In Codex or linked worktrees, direct local `pnpm test*`, `pnpm check*`, `pnpm crabbox:run`, and `scripts/committer` can trigger pnpm dependency reconciliation or install prompts. Prefer `node` wrappers locally and Crabbox/Testbox for pnpm-gated proof.
149150
- Direct Blacksmith lease: use `blacksmith testbox run`; Crabbox wrapper reuse needs a wrapper-created lease.
151+
- Wrapper Testbox reuse requires its local SSH key; missing after restart/handoff means warm fresh.
150152
- Dirty-sync generator proof: compare hashes before/after; `git diff` includes the synced patch.
151153
- Crabbox wrapper `stop` has no `--timing-json`; use `node scripts/crabbox-wrapper.mjs stop --provider <provider> --id <id>`.
152154
- Repo-native PR worktree may omit `node_modules`; prove remotely, then use `git commit --no-verify`, not `scripts/committer`.
153155
- Release-branch formatting: Testbox or existing binary; never local `pnpm exec` reconciliation.
156+
- Targeted local format/lint: existing `./node_modules/.bin/*`; never `pnpm exec` reconciliation.
154157
- Parallel agents share the checkout; never switch its branch while sibling work runs.
155158
- Testbox status: `blacksmith testbox status --id <tbx_id>`; no `--json` flag.
156159
- QA CLI `--output-dir` must be repo-relative.
@@ -161,6 +164,8 @@ Skills own workflows; root owns hard policy and routing.
161164
- Before handoff/push: prove touched surface. Before landing to `main`: proof matches actual risk. Bounded behavior-neutral refactor: focused tests/checks enough; no issue proof or full/broad suite by default.
162165
- Release-branch full validation: freeze the product-complete **Code SHA**, then use `node scripts/full-release-validation-at-sha.mjs --sha <code-sha> --target-ref release/YYYY.M.PATCH`; no raw dispatch without `target_context_ref`.
163166
- Pre-land/pre-commit code changes: mandatory fresh `$autoreview` until no accepted/actionable findings remain. Do not land code on CI, ClawSweeper, prior review comments, or your own manual review alone unless user explicitly opts out or scope is truly trivial/docs-only. If findings want refactor, refactor; no ugly fixes.
167+
- Autoreview uncommitted changes: `--mode uncommitted`; no `dirty` mode.
168+
- Autoreview staged/uncommitted diff: use `--mode uncommitted`; no `staged` mode.
164169
- If proof is blocked, say exactly what is missing and why.
165170
- Do not land related failing format/lint/type/build/tests. If unrelated on latest `origin/main`, say so with scoped proof.
166171
- Docs/changelog-only and CI/workflow metadata-only: `git diff --check` plus relevant docs/workflow sanity; escalate only if scripts/config/generated/package/runtime behavior changed.
@@ -175,11 +180,13 @@ Skills own workflows; root owns hard policy and routing.
175180
- Issue/PR start: `git status -sb`; if clean, `git pull --ff-only`; if dirty, yell before pull/rebase.
176181
- PR refs: `gh pr view/diff` or `gh api`, not web search. Prefer `gitcrawl` for maintainer discovery; missing/stale `gitcrawl` falls through to live `gh`, not contributor setup. Verify live with `gh` before mutation.
177182
- `gh pr view` takes the branch positionally; no `--head` flag.
183+
- `gh pr diff` has no `--stat`; use `gh pr view --json changedFiles,additions,deletions` or `git diff --stat`.
178184
- zsh: quote `gh api` endpoints containing `?` or brackets; otherwise glob expansion corrupts the invocation.
179185
- Blacksmith Testbox status/stop: `--id <tbx_id>`; no status JSON flag.
180186
- Crabbox final timing JSON = proof complete; if portal sync hangs after it, interrupt wrapper only.
181187
- Sparse-sync temp checkout may claim kept Testbox; repo-path reuse needs `--reclaim`.
182188
- GitHub Actions: resolve workflow files from `.github/workflows` or API; never infer filenames from display names.
189+
- Yielded exec: retain the returned session id before polling; never blind-retry.
183190
- zsh: quote command globs; unmatched patterns abort before the tool runs.
184191
- Nested remote shell: avoid local `$()` expansion; use remote-safe validation.
185192
- zsh: don't use `path` as a variable; it rewrites `$PATH`.
@@ -188,7 +195,7 @@ Skills own workflows; root owns hard policy and routing.
188195
- `scripts/pr` review: checkout main baseline, then PR, before artifact validation.
189196
- Review artifacts: validate from PR-head mode; moving main invalidates main-baseline guard.
190197
- `scripts/pr` prepare/merge: `main` PRs only; non-main uses reviewed release-branch flow.
191-
- PR head changed: rerun `scripts/pr review-init`; checkout alone leaves stale guard SHA.
198+
- After every PR push, rerun `scripts/pr review-init`; checkout alone leaves stale guard SHA.
192199
- `rg`: options/globs before `--`; `--` immediately before a leading-dash pattern only.
193200
- `gh --jq` is not standalone `jq`; pipe JSON to `jq` for variables or `--arg`.
194201
- `gh api --paginate '<endpoint>' | jq -s ...`; gh `--slurp` may emit nothing and forbids `--jq`/`--template`.
@@ -224,7 +231,7 @@ Skills own workflows; root owns hard policy and routing.
224231
- GitHub issue/PR create: read `$agent-transcript`; ask about sanitized transcript logs when available.
225232
- Contributor PRs: parsed context requires authored `What Problem This Solves` and `Evidence` sections. Do not require field-level proof forms; reviewers inspect code, tests, and CI for correctness.
226233
- PR artifacts/screenshots: attach to PR/comment/external artifact store. Never push screenshots, videos, proof images, or proof assets to OpenClaw or any product repo branch, including temp artifact branches. Use Crabbox artifact publishing plus the manifest URL. Do not commit `.github/pr-assets`.
227-
- CI polling: exact SHA, relevant checks only, minimal fields. Skip routine noise (`Auto response`, `Labeler`, docs agents, performance/stale). Logs only after failure/completion or concrete need. Never `gh run watch`; its 3s polling exhausts API quota. Use sparse GraphQL rollups.
234+
- CI polling: exact SHA, relevant checks only, minimal fields. Skip routine noise (`Auto response`, `Labeler`, docs agents, performance/stale). Logs only after failure/completion or concrete need. Never `gh run watch`; its 3s polling exhausts API quota. Use sparse GraphQL rollups. Filter `gh run list` by workflow/branch/commit; broad JSON lists can exceed relay caps. `gh --jq` has no jq `--arg`; use `--commit` for SHA filtering.
228235
- Trusted-workflow release-branch CI: pass `target_ref` + `release_candidate_ref`; never `release_gate` (requires workflow head == target).
229236
- Agent PR landing to `main`: use only the repo-native `scripts/pr` wrapper: run `scripts/pr review-init <PR>`, follow its emitted checkout/guard guidance, initialize and complete review artifacts with `scripts/pr review-artifacts-init <PR>`, validate them with `scripts/pr review-validate-artifacts <PR>`, then run `OPENCLAW_TESTBOX=1 scripts/pr prepare-run <PR>` and `scripts/pr merge-run <PR>`. The Testbox flag is mandatory for agents so prepare verifies hosted CI/Testbox on the current head or reuses a patch-identical pre-rebase run green within 24 hours instead of running full gates locally. `prepare-run` fails fast; invoke only after exact-head CI is complete and green. For owner-approved reviewed fork code without hosted Testbox, use `OPENCLAW_PR_GATES_REMOTE=testbox` instead. Do not rebase only because `main` advanced; merge drift is advisory unless strict drift is explicitly enabled, while GitHub still blocks conflicts. Do not idle on `auto-response` or `check-docs`.
230237
- Non-main PRs: do not run `scripts/pr prepare-run` or `merge-run`; they diff against `main`. Use review artifacts, exact base-head CI, revalidate `headRefOid`, then `gh pr merge --match-head-commit <verified-sha>`.

‎CHANGELOG.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,8 @@ Docs: https://docs.openclaw.ai
3939

4040
### Fixes
4141

42+
- **Codex dynamic tool outcomes:** use the shared tool-result failure contract for arbitrary lifecycle metadata, preventing successful Skill Workshop results from being displayed and persisted as failed calls. Fixes #107684. Thanks @shakkernerd.
43+
- **Nested resource ignores:** honor slash-free patterns and escaped literal exclamation marks in nested ignore files during skill and resource discovery. Thanks @moguangyu5-design.
4244
- **Proxy bypass precedence:** honor blank lower-case `no_proxy` values shadowing upper-case `NO_PROXY` consistently with Undici, and reuse the canonical matcher for Telegram fallback selection.
4345
- **Tokenjuice exec compaction:** avoid retaining raw command output inside compacted middleware metadata, preventing large successful compactions from failing the middleware details-size guard.
4446
- **Agent git package identities:** strip refs before hosted-repository parsing and reject traversal segments so GitLab branch refs resolve to the canonical managed install path.

0 commit comments

Comments
 (0)