sync/upstream-v0.4.33-and-fixes

clawdie commented

2026-10-16 08:07:15 +02:00

Owner

No description provided.

clawdie added 25 commits

2026-10-16 08:07:15 +02:00

fix(agent): show all release notes since the last dismissed version 034cee93b4

Fixes #233

fix(continuous): synchronize native test event collection 8908caa6f5

feat(continuous): add authenticated WebSocket access 680f27a625

Add a browser endpoint with token authentication, origin restrictions,
and TLS requirements for non-loopback addresses.

Keep generated admin tokens out of startup logs, join WebSocket handlers
before runtime teardown, and validate close frame payloads.

Document the endpoint and cover transport, token storage, and shutdown.

feat(continuous): add model.list to the host protocol da43d9cd09

Clients attached to a continuous host had no way to discover which
models they can select. model.list returns the active catalog models
of a provider (the host default when omitted) with context window, max
output, and reasoning support. It is available to the read role, and
runtime.status advertises capabilities.models so clients can fall back
on older hosts.

fix(continuous): report cancellation from Step instead of a stuck chain 532abf230a

When the caller cancels Step while a tool runs, the scheduler cancels
the invocation and its task stays running without a claim. If Step
decided on that state before observing the cancellation, it reported
"chain cannot progress" (ErrBusy) instead of context.Canceled. This
made TestExecutionCancellationLeavesRecoverableRun flaky on CI.

Check the caller's context after each scheduler pass. The run stays
recoverable as before.

feat: Add explicit file content inclusion and Swarm image prompts a9b640a63f

Support !@ file content selections in main chat, /btw, and Swarm
editors while preserving local @ path references and remote transfers.
Queue local image prompts with copied bytes and submission ordering.
Transfer Swarm images through startup stdin and additive inbox frames,
and persist hosted image turns without resubmitting them on resume.

Add regression tests and document attachment limits and compatibility.

Refs #184

test: Synchronize Continuous execution event collection 0f23566192

Protect the queued-input test's event slice against concurrent callbacks
from separate task event gates. Snapshot events under the same mutex
before assertions without changing runtime behavior or weakening checks.

feat: add OSC 7501 program status reporting b7a758325f

fix: preserve finalized Responses tool arguments e7ded64a8a

fix: Preserve indentation on wrapped panel editor lines 8aa172ce93

test: Stabilize codemode store-limit checks under CI load 80d4867d3a

feat: Route continuous conversations across providers c7fb090957

Resolve each conversation's provider credentials and endpoint independently.
Expose available models and validate selections before saving configuration.
Follow the selected model's compaction limits and deduplicate catalog entries.

test: Wait for prompt completion status before asserting output ff9188eb48

feat: Add configurable navigation keybindings 4bf679fc5b

Support next and previous actions in built-in navigation contexts while
preserving slash-command bindings and reserved controls. Refuse config
saves when the existing file cannot be loaded.

Refs #234

fix(continuous): authorize and isolate nested tool calls 907854bbfb

feat(continuous): make nested tool calls durable child tasks 5bce3a13ef

Nested calls from ToolRuntime and extension call_tool now run as owned
zot.tool tasks with their own intent, approval, replay policy and
bounded committed result. A replaying parent reuses completed children
by key instead of executing them again.

- Keys: ordinal or explicit (core.WithNestedToolKey, call_tool key).
  A key reused with a different tool or arguments executes nothing.
- Approval, recovery and abort: nested approvals persist and park Step
  with ErrAwaitingApproval when ancestors replay safely. Non-replayed
  parents abort live children first. Abort settles bottom-up and never
  rewrites a committed child result.
- Nested results carry data only. Handoff, terminate and tool
  activation apply to model-issued calls.
- Observability: child progress in the parent's tool panel, nested
  fields on view events, hierarchical recovery preview, usage per task.
- Integrity: orphan, duplicate key, depth, background and transcript
  checks for nested tasks.
- Protocol: optional call_tool key and call_tool_durable capability.
  The Go SDK sends keys only to durable hosts. Approval waits are not
  bounded by the 60-second execution deadline.
- Scheduler: phases may create fenced children, waiting parents release
  their worker slot, and a lost wakeup between selection and wait is
  fixed.

Tool task schema moves to version 2 with a migration from version 1.
Behavior outside continuous mode and for older extensions is unchanged.

docs: show explicit wires for one gateway 94b4f93038

Merge pull request #235 from A2agent-ai/docs/mixed-wire-a2agent-current 00989e5f05

docs: show explicit wires for one gateway

feat: Add thumbnail previews for pasted images 8f0108620d

Show active clipboard attachments above the editor and render sent images
outside text bubble backgrounds. Bound previews to available terminal
space and retain metadata fallbacks when graphics are unavailable.

Repaint visible graphics on changes and removal without replaying the
entire transcript into native scrollback. Add regression tests and docs.

Fixes #226

fix: Return the latest settled handoff continuation 49679401c5

Use the newest committed generation result when Step reaches idle, even
if a fast continuation completed between observations of its active chain.

Add a deterministic regression test for returning a stale observed run.

fix(gate): adopt the colibri placeholder-injection fix 2cfaa49391

Zot still imported colibri 444e07d, whose matcher bound any single token to a
placeholder, so a compound command kept the rule's token count and was allowed:
with the real inventory, 'bastille list | grep demo;true' matched the jail-status
rule and the shell then ran 'true'. Same for &&, ||, |, $(...), backticks,
redirection and newline/CR variants.

- bump code.clawdie.si/clawdie/colibri to 0d74bff
  (v0.13.0-dev.0.20261015174358-0d74bffa7498), which forbids shell
  metacharacters in placeholder bindings;
- add TestGateCommandResultRejectsCompoundInjection, running the evaluator zot
  installs against a pinned inventory, so downgrading the dependency fails the
  test instead of silently reopening the hole.

Note: the fix is conservative — a quoted argument containing ; $( ) > now also
escalates, because the gate cannot see shell quoting.

fix(auth): stop tests from launching the developer's browser a7d7eb679c

TestCloseWhileKeyServerConsumerRuns loops ten times calling StartAPIKey on a
Manager whose openBrowser field defaults to true, so a plain `make test`
spawned ten real xdg-open processes - one per iteration, all with
provider=deepseek. TestStartAPIKeyFlowWithBrowserStartsLoopbackForm adds one
more, because it forces the desktop path to prove the loopback form is used.

Measured with a stubbed xdg-open first on PATH:
  before: 11 spawns (10 + 1), matching the observed tab burst;
  after:  0 spawns, full `make test` still green.

- add Manager.SetOpenBrowser so a caller outside the package can force the
  browser path without launching a process;
- make maybeOpen honour ZOT_NO_BROWSER. It previously only influenced
  HasBrowser(), so once a flow had started nothing could stop the spawn;
- disable spawning in the two tests that reach the flow.

Both tests still assert the browser-flow behaviour (loopback URL, waiting
state); only the process spawn is suppressed.

merge fix/zot-tests-no-browser into sync/upstream-v0.4.33-and-fixes 641212e368

merge fix/gate-colibri-dep-0d74bff into sync/upstream-v0.4.33-and-fixes b350d0b348

Merge upstream v0.4.33 into downstream main

leak-guard / guard (pull_request) Successful in 2s

Details

14648ec472

clawdie merged commit 35c5d22a2f into main

2026-10-16 08:09:43 +02:00

clawdie deleted branch sync/upstream-v0.4.33-and-fixes

2026-10-16 08:09:44 +02:00

clawdie referenced this pull request from a commit

2026-10-16 08:09:45 +02:00

Merge pull request 'sync/upstream-v0.4.33-and-fixes' (#26) from sync/upstream-v0.4.33-and-fixes into main

Rows
Columns

sync/upstream-v0.4.33-and-fixes #26