Skip to content

Commit ff7e970

Browse files
YigtwxxYigtwxx
committed
Merge remote-tracking branch 'origin/main' into fix/azure-responses-early-abort-usage
2 parents b61cd1e + a9f8283 commit ff7e970

1,513 files changed

Lines changed: 92814 additions & 17629 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.agents/skills/autoreview/SKILL.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ Use when:
3636
- Tools are useful in review mode. Codex receives the validated bundle in an empty workspace so ignored files and linked-worktree metadata remain unreadable; web search stays available for dependency contracts and upstream docs.
3737
- Security perspective is always included, but it should not cripple legitimate functionality. Report security findings only when the change creates a concrete, actionable risk or removes an important safety check.
3838
- Reviewer subprocesses preserve engine authentication and non-credentialed proxy variables needed by headless or restricted-network environments while stripping process-injection, Git override, and credentialed proxy values.
39-
- Review bundles fail closed before engine invocation when tracked or untracked paths look sensitive or patch text looks secret-like. Safe large diffs are scanned in full, sent as one pass while they fit the aggregate prompt limit, then partitioned into complete bounded passes without truncation.
39+
- Review bundles fail closed before engine invocation when tracked or untracked paths look sensitive or patch text looks secret-like. Obvious synthetic values shaped like `<fixture-prefix>-<credential-field>` remain reviewable, such as `token: "test-token"`, without one-off allowlists. Safe large diffs are scanned in full, sent as one pass while they fit the aggregate prompt limit, then partitioned into complete bounded passes without truncation.
4040
- For regression provenance, keep roles separate: blamed code author, blamed PR author, PR merger/committer, current PR author, and PR/date. If no blamed PR is traceable, use the blamed commit as the provenance: commit SHA, date, and author username. Do not guess a merger or frame missing PR metadata as a separate finding.
4141
- If the blamed PR was merged by `clawsweeper[bot]` or another automation, identify the human trigger when practical. Check timeline/comments first; if rate-limited, use gitcrawl/cache or public PR HTML. Look for maintainer commands such as `@clawsweeper automerge`, `/landpr`, or labels/status comments that armed automerge. Report `automerge triggered by @login`; if not found, say trigger unknown.
4242
- Do not invoke built-in `codex review`, nested reviewers, or reviewer panels from inside the review. The helper builds one validated bundle, calls the selected engine once for normal inputs or once per complete bounded chunk for oversized inputs, validates the structured results, and stops.
@@ -415,7 +415,7 @@ The helper:
415415
- recognizes `--engine droid`, `copilot`, `cursor`, and `opencode` only to fail closed with isolation errors; runnable engines are `codex`, `claude`, and `pi`; default is `AUTOREVIEW_ENGINE` or `codex`
416416
- resolves bare `git`, `gh`, reviewer, and PowerShell shell commands from absolute `PATH` entries only, never from the reviewed checkout; explicit `--*-bin` paths are interpreted from the reviewed repository root when relative and accepted only when both the supplied path and resolved target stay outside the reviewed repository
417417
- use `--mode commit --commit <ref>` for already-committed work, especially clean `main` after landing
418-
- scans safe Git patches in full, reviews them in one pass up to the aggregate prompt limit, and automatically uses complete bounded passes above it
418+
- scans safe Git patches in full, recognizes synthetic fixture values tied to their credential field, reviews them in one pass up to the aggregate prompt limit, and automatically uses complete bounded passes above it
419419
- should be left in `--mode auto` or forced to `--mode branch` for PR/branch work; do not force `--mode local` after committing
420420
- writes only to stdout unless `--output`, `--json-output`, or live streamed engine stderr is set
421421
- supports `--dry-run`, `--parallel-tests`, `--parallel-tests-shell`, `--prompt`, repo-relative `--prompt-file`, repo-relative `--dataset`, `--no-tools`, `--no-web-search`, repeatable Codex-only safe model/response tuning with `--codex-config key=value`, Codex-only `--codex-speed fast|flex|default`, and commit refs

‎.agents/skills/autoreview/scripts/autoreview‎

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -297,8 +297,12 @@ SECRET_PLACEHOLDER_VALUES = {
297297
"test-token-placeholder",
298298
"token-oversized",
299299
"clawrouter-e2e-secret",
300+
"config-token",
300301
"very-long-browser-token-0123456789",
301302
}
303+
SYNTHETIC_SECRET_PREFIXES = frozenset(
304+
{"dummy", "example", "fake", "fixture", "mock", "sample", "test"}
305+
)
302306
FETCH_CREDENTIAL_MODE_VALUES = {"include", "omit", "same-origin"}
303307
URI_PASSWORD_PLACEHOLDER_VALUES = {
304308
"clawrouter-e2e-secret",
@@ -3874,6 +3878,28 @@ def fallback_secret_risk(
38743878
)
38753879

38763880

3881+
def synthetic_secret_fixture(value: str, key: str) -> bool:
3882+
normalized = value.casefold()
3883+
if normalized in SECRET_PLACEHOLDER_VALUES:
3884+
return True
3885+
if len(normalized) > 80:
3886+
return False
3887+
camel_split_key = re.sub(
3888+
r"(?<=[a-z0-9])(?=[A-Z])",
3889+
"-",
3890+
key.strip("\"'"),
3891+
)
3892+
normalized_key = re.sub(
3893+
r"[^a-z0-9]+",
3894+
"-",
3895+
camel_split_key.casefold(),
3896+
).strip("-")
3897+
return any(
3898+
normalized == f"{prefix}-{normalized_key}"
3899+
for prefix in SYNTHETIC_SECRET_PREFIXES
3900+
)
3901+
3902+
38773903
def safe_secret_assignment_suffix(
38783904
text: str,
38793905
end: int,
@@ -5216,7 +5242,7 @@ def secret_text_risk(
52165242
)
52175243
):
52185244
continue
5219-
if value.lower() in SECRET_PLACEHOLDER_VALUES:
5245+
if synthetic_secret_fixture(value, key):
52205246
if safe_secret_assignment_suffix(
52215247
text,
52225248
match.end(),

‎.agents/skills/autoreview/tests/test_autoreview_hardening.py‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2956,10 +2956,28 @@ def test_secret_detector_allows_common_fixture_literals(self) -> None:
29562956
'token: "token-oversized"',
29572957
'API_KEY = "clawrouter-e2e-secret"',
29582958
'token: "very-long-browser-token-0123456789"',
2959+
'token: "config-token"',
29592960
):
29602961
with self.subTest(content=content):
29612962
self.assertFalse(self.helper["secret_text_risk"](content))
29622963

2964+
def test_synthetic_secret_fixture_prefixes_are_generic(self) -> None:
2965+
for prefix in self.helper["SYNTHETIC_SECRET_PREFIXES"]:
2966+
with self.subTest(prefix=prefix):
2967+
self.assertTrue(
2968+
self.helper["synthetic_secret_fixture"](
2969+
f"{prefix}-token",
2970+
"token",
2971+
)
2972+
)
2973+
2974+
self.assertFalse(
2975+
self.helper["synthetic_secret_fixture"](
2976+
"test-correct-horse-battery-staple",
2977+
"password",
2978+
)
2979+
)
2980+
29632981
def test_secret_detector_does_not_trust_in_band_suppressions(self) -> None:
29642982
for marker in ("pragma: allowlist secret", "gitleaks:allow"):
29652983
with self.subTest(marker=marker):
@@ -3064,6 +3082,21 @@ def test_secret_like_patch_content_is_blocked_in_all_modes(self) -> None:
30643082
with self.assertRaisesRegex(SystemExit, "secret-like content"):
30653083
self.helper["commit_bundle"](repo, "HEAD")
30663084

3085+
def test_local_bundle_allows_deleted_test_token_fixture(self) -> None:
3086+
with tempfile.TemporaryDirectory() as tempdir:
3087+
repo = init_repo(Path(tempdir))
3088+
path = repo / "fixture.test.ts"
3089+
path.write_text('const request = { token: "test-token" };\n', encoding="utf-8")
3090+
git(repo, "add", path.name)
3091+
git(repo, "commit", "-q", "-m", "base")
3092+
3093+
path.write_text('const request = { token: String() };\n', encoding="utf-8")
3094+
3095+
bundle, truncated = self.helper["local_bundle"](repo)
3096+
3097+
self.assertIn('-const request = { token: "test-token" };', bundle)
3098+
self.assertFalse(truncated)
3099+
30673100
def test_pi_refuses_truncated_review_input(self) -> None:
30683101
reviewer = argparse.Namespace(engine="pi", tools=True)
30693102

‎.agents/skills/openclaw-changelog-update/scripts/verify-release-notes.mjs‎

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -495,10 +495,19 @@ function referenceLabelsIn(text) {
495495

496496
export function renderContributionRecordEntry(entry) {
497497
const references = [];
498-
appendUnique(references, referenceLabelsIn(entry.title));
498+
const linkedIssueNumbers = new Set(entry.linkedIssues.map((issue) => issue.number));
499499
appendUnique(
500500
references,
501-
(entry.priorReferences ?? []).map((number) => `#${number}`),
501+
referenceLabelsIn(entry.title).filter(
502+
(reference) =>
503+
!reference.startsWith("#") || linkedIssueNumbers.has(Number(reference.slice(1))),
504+
),
505+
);
506+
appendUnique(
507+
references,
508+
(entry.priorReferences ?? [])
509+
.filter((number) => linkedIssueNumbers.has(number))
510+
.map((number) => `#${number}`),
502511
);
503512
appendUnique(references, entry.externalReferences ?? []);
504513
for (const issue of entry.linkedIssues) {
@@ -2209,11 +2218,7 @@ export function ledgerChecks(section, pullRequests, nodes, directCommits, shippe
22092218
}
22102219
}
22112220
const expectedReferences = [];
2212-
appendUnique(expectedReferences, referenceLabelsIn(entry.title));
2213-
appendUnique(
2214-
expectedReferences,
2215-
entry.priorReferences.map((number) => `#${number}`),
2216-
);
2221+
appendUnique(expectedReferences, externalReferencesIn(entry.title));
22172222
appendUnique(expectedReferences, entry.externalReferences);
22182223
appendUnique(
22192224
expectedReferences,
@@ -2320,7 +2325,7 @@ function manifestFor(options, source, ledger, directCommitRecords) {
23202325
editorialEligible: entry.editorialEligible,
23212326
thanks: entry.thanks,
23222327
externalReferences: entry.externalReferences,
2323-
relatedReferences: [...new Set([...entry.priorReferences, ...referencesIn(entry.title)])],
2328+
relatedReferences: [...new Set(entry.linkedIssues.map((issue) => issue.number))],
23242329
linkedIssues: entry.linkedIssues.map((issue) => ({
23252330
number: issue.number,
23262331
title: issue.title,

‎.github/actions/setup-android-toolchain/action.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,8 +48,10 @@ runs:
4848
- name: Install Android SDK packages
4949
shell: bash
5050
run: |
51-
set -eu
52-
yes | sdkmanager --sdk_root="${ANDROID_SDK_ROOT}" --licenses >/dev/null
51+
set -euo pipefail
52+
# sdkmanager closes stdin after accepting every license, which gives yes SIGPIPE.
53+
# Preserve sdkmanager's status so a real license failure still stops the job.
54+
yes | sdkmanager --sdk_root="${ANDROID_SDK_ROOT}" --licenses >/dev/null || [[ "${PIPESTATUS[1]}" -eq 0 ]]
5355
sdkmanager --sdk_root="${ANDROID_SDK_ROOT}" --install \
5456
"platform-tools" \
5557
"platforms;android-37.0" \

‎.github/labeler.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -411,6 +411,11 @@
411411
- any-glob-to-any-file:
412412
- "extensions/cerebras/**"
413413
- "docs/providers/cerebras.md"
414+
"extensions: baseten":
415+
- changed-files:
416+
- any-glob-to-any-file:
417+
- "extensions/baseten/**"
418+
- "docs/providers/baseten.md"
414419
"extensions: clawrouter":
415420
- changed-files:
416421
- any-glob-to-any-file:

0 commit comments

Comments
 (0)