clawdie/zot
Watch
1
0
Fork
You've already forked zot
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

sync/upstream-v0.4.57 #27

Merged
clawdie merged 62 commits from sync/upstream-v0.4.57 into main 2026-10-30 02:00:45 +01:00
Conversation 0 Commits 62 Files changed 288 +27827 -1360
clawdie commented 2026-10-30 02:00:36 +01:00
Owner
Copy link
No description provided. 
Add an optional external PostgreSQL 15-18 store for zot continuous,
selected explicitly with --backend postgres and --store-name, using the
pure Go pgx v5.11.0 driver. Journal stays the default and local backend
detection is unchanged.

The backend holds a session advisory lock on a dedicated writer
connection, commits a new writer epoch on every open, and checks the
persisted revision and epoch on each atomic commit. It never reconnects,
retries a mutation, or takes over another writer. A lost session, an
operation timeout, or a commit whose outcome is unknown terminates the
store. Caller cancellation bounds only admission, so client disconnects
cannot destroy the writer session.

Runtime reads now go through checked storage.Get and storage.Page, so a
failed remote read is an error instead of a false absence. Host.Run and
Service.Step cancel execution on terminal store failure before joining
tasks and report that cause. serve keeps local endpoints in a locked,
identity-bound --state-dir.

Credentials come from a private DSN file or ZOT_CONTINUOUS_POSTGRES_DSN.
Transport requires verify-full TLS, numeric loopback plaintext, or a
Unix socket. Journal-only commands are refused for PostgreSQL.

Tests cover the backend against real servers, including a dropped COMMIT
reply, TLS verification, the execution and nested crash matrices, and
serve end to end. CI runs them on PostgreSQL 15 and 18 and fails on any
skip.
Managed services such as Neon report fsync=off because durability comes
from replicated remote storage rather than local disk flushes. The
continuous PostgreSQL backend refused them.

Add --postgres-trust-remote-durability (Options.TrustRemoteDurability).
It skips only the fsync=on check, warns on every open, and requires
--backend postgres. All other server checks remain. Without the flag,
fsync=off is still refused, and the error now names the flag.

Also write test DSN files with the platform private-file helper, so they
pass the owner-only access check on Windows, and add a round-trip test
for that check.
Route Neon pooled connection strings to verified direct endpoints.
Batch transcript reads and pipeline commit checks and writes while
preserving synchronous durability, fencing, and rollback semantics.

Cache bounded point reads, pages, and recent acknowledged commits.
Carry unchanged reads across revisions and invalidate matching pages.
Add regression coverage, a synthetic prompt benchmark, and documentation.
Add revision-checked conversation renaming and title metadata in snapshots,
lists, and view watches without changing conversation identity or policy.
Cover persistence, validation, permissions, and conflicts with tests.
Document the additive protocol and backward compatibility.
Start a separate fsync-off server for each PostgreSQL matrix version.
Keep the primary fixture durable and preserve the no-skipped-tests gate.
Fail required integration runs immediately when the fixture is missing
and document the additional test configuration.
Prefix invalid-content fixture names so the NUL-byte case creates a
regular file rather than opening the Windows NUL device. Preserve all
DSN validation and private-file permission assertions.
feat(provider): prefer MiniMax M3.1 Flash and preserve legacy models
Connect Model Context Protocol servers from $ZOT_HOME/mcp.json and
.zot/mcp.json without an extension. The new packages/mcp package owns
configuration, connections, OAuth, and the tool and resource catalog.

- stdio, streamable HTTP, and legacy SSE transports
- deferred, direct, and hidden exposure, per-tool toolExposure
- partial project overrides of enabled, exposure, and toolExposure
- /mcp manager with one-key actions and a guided add wizard
- OAuth sign-in with PKCE, dynamic registration, token refresh, and a
  pasted redirect for browsers on another machine
- reconnect on the next call, single-server reconnect, HTTP retries
  that never repeat tool calls
- live tool-list updates, and relisting of servers that cannot announce
  changes before a prompt or after an unknown-tool error
- resource tools to list and read server resources
- /mcp reload, reconnect, login, and logout in every mode
- --no-mcp opt-out, /cd follows the project configuration

Read the agent tool registry under its lock, since built-in sources
can now replace it during a turn.
Add --continuous-conversation <id> to attach the interactive TUI to one
existing conversation, such as a fork or an owned subagent, instead of a
workspace root. The conversation is never created or reconfigured, the
flag cannot be combined with --continuous-workspace, and it requires
--continuous.
- revalidate tools after reconnect so withdrawn tools are not called
- connect resource-only servers without requesting tools/list
- keep the advertised OAuth metadata URL for sign-in, origin-checked
- refresh MCP tools in live and new continuous agents
- report MCP failures without blocking continuous worker startup
- store explicit project override values instead of inheriting user ones
- reject null config objects and resource items instead of panicking
Persist same-origin OAuth metadata for refresh after reconnects and restarts.
Recover expired resource sessions and recheck capabilities before retrying.
Use the active prompt context for pre-turn discovery and preserve turn events.

Add regression coverage and update MCP documentation.
Coalesce overlapping discoveries and validate results against the individual
connection instead of a manager-wide generation. Detect stdio disconnects
from protocol output rather than stderr and explicitly clean up processes.

Preserve Telegram tools during catalog refreshes with atomic registry updates.
Record runtime OAuth failures, withdraw unavailable capabilities, and keep
the sign-in action accessible for rejected stored credentials.

Add regression coverage for all five review findings and update MCP docs.
Review fixes for the built-in MCP package.

- Stdio shutdown follows the specification: close stdin, wait, SIGTERM
  the process group, wait, then SIGKILL. Windows kills after the first
  wait since it has no interrupt signal.
- Text in tool results and resources is limited to 64 KiB per block.
  Longer text is saved whole to a temporary file and the model receives
  the head plus the path. Temporary files are removed on Close.
- Tools whose input schema is not an object are advertised with an empty
  object schema, since providers reject other types.
- A relisted tool list with colliding names withdraws the server's tools
  and reports the collision instead of keeping a stale catalog.
- The HTTP retry transport honors Retry-After, capped at 30 seconds.
- Snapshot reads the token file once outside the manager lock.
- OAuth refresh configuration reuses the stored client's redirect URI.
- Sign-in errors keep structured OAuth error codes but no longer quote
  raw response bodies or URLs. The callback page no longer claims success
  before the token exchange.
- The callbackPort validation message mentions 0 for a free port.
Fixes #244
Keep interactive startup available without a registered llama.cpp or
LM Studio endpoint. Require a server URL before enabling inference.

Fixes #246
Add --list-models-json with provider filtering and stable model metadata.
Wait for bounded local discovery before exporting, keep diagnostics on
stderr, and never execute credential commands for model enumeration.

Include discovery, CLI, cancellation, and credential-command regression
tests and document catalog freshness limits.

Integrates #247 with the discovery review fix.
Render persistent diagnostics above the conversation, skip hidden skill
entries, and add skill_exclude configuration for filesystem sources.
Apply exclusions to model discovery, skill pickers, and pin resolution.

Fixes #249
fix(provider): use reported context length for discovered custom models
Add --continuous-conversation <id> to attach the interactive TUI to one
existing conversation, such as a fork or an owned subagent, instead of a
workspace root. The conversation is never created or reconfigured, the
flag cannot be combined with --continuous-workspace, and it requires
--continuous.
Add opt-in reasoning streams across providers, interactive settings, and
machine clients. Request readable summaries where required and retain
bounded display tails with sessions and attached conversations without
adding them to model context.

Fixes #253
Bypass chat path quoting and file placeholders when composing shell
escapes, while preserving ordinary chat and !@ picker behavior.
Add regression coverage and document shell paste handling.

Fixes #254
* mcp-bridge: add keyless deed.page setup template

* docs: explain durable storage for deed.page owner tokens

---------

Co-authored-by: patriceckhart <mail@patriceckhart.com>
Refresh the authenticated streaming chat catalog independently of the shared
cache. Preserve explicit and saved model IDs before discovery completes,
and replace seed metadata with published limits, capabilities, and prices.

Cover discovery, request metadata, startup selection, cache refresh, failures,
and logout with regression tests. Document offline behavior and limitations.
feat(provider): add Cheaper Inference provider
Render the unbounded side-chat conversation in the main terminal flow
while keeping its editor and pending confirmations in the bottom band.
Share history navigation without adding side-chat content to the main
model context or saved transcript.

Clarify that ZOT_HOME is an optional override and that zot resolves its
state directory internally without exporting the variable to the shell.

Add regression tests for unbounded rendering, cursor layout, shared
scrolling, streaming, confirmation handling, and transcript isolation.

Fixes #259
Fixes #257
# Conflicts:
#	packages/core/agent.go
Remove interactive mouse capture and its settings toggle. Ignore legacy
click-to-position values while keeping side chat in the shared terminal
flow without a separate viewport or height limit.

Cover native mouse behavior and shared side-chat scrollback with regression
tests, and update the user documentation.
* feat(provider): add Opper provider

Adds Opper, an EU-hosted, OpenAI Chat Completions-compatible LLM gateway, as provider `opper` (OPPER_API_KEY, https://api.opper.ai/v3/compat). It follows the shape of the existing account-scoped gateways: an OpenAI-compatible client, a seed entry for the offline default claude-sonnet-4-6, an API-key probe, and authenticated discovery from /v3/compat/models (simplified view) that keeps tool-capable chat models and reads context and output limits, vision, reasoning efforts and per-token prices. Discovered entries replace the seed and are dropped on failed refresh or logout. Saved and explicit IDs, including pinned provider/model IDs, are preserved before discovery finishes.

Tests cover discovery parsing and errors, price sanitizing, seed replacement, the wire request, selection preservation and refresh with a fresh cache. The strict-transport refresh tests now clear OPPER_API_KEY as well.

Disclosure: Opper is my startup.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix(provider): use the correct Opper chat completions endpoint

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: patriceckhart <mail@patriceckhart.com>
* feat(provider): add Runcrate provider

Adds Runcrate as provider `runcrate` (RUNCRATE_API_KEY,
https://api.runcrate.ai/v1), an OpenAI Chat Completions-compatible
inference API whose model IDs are vendor/model. It follows the existing
gateway shape: an OpenAI-compatible client, a seed entry for the offline
default deepseek-ai/DeepSeek-V4.1-Flash, an API-key probe, a display
label, and the env var and credential wiring.

Runcrate's /v1/models catalog is public, so discovery follows Gondola:
it runs with the shared catalog refresh, gated on a configured
credential, and keeps tool-capable text-in, text-out chat models with
their context and output limits, vision, reasoning and USD per 1M token
prices. Saved and explicit vendor/model IDs are preserved before
discovery finishes; plain unknown IDs still fall back to the default.

Tests cover discovery mapping and filtering, errors, seed replacement,
the wire request, selection preservation, offline default resolution
and credential-gated refresh.

* fix(agent): discover missing Runcrate models with a fresh cache

---------

Co-authored-by: patriceckhart <mail@patriceckhart.com>
Add session-scoped supervision tools, persistent follow-ups, correlated
completion updates, serialized inbox input, and explicit cancellation and
resume controls. Reconnect continuous-host agents and recover missed results
without replaying uncertain work.

Cover restart, cancellation, and reconnect behavior with real-process smoke
tests and document recovery limitations.

Fixes #261
fix(codemode): raise test timeout to 30s for race-instrumented FreeBSD builders
All checks were successful
leak-guard / guard (pull_request) Successful in 1s
Details
b8263e3414
clawdie deleted branch sync/upstream-v0.4.57 2026-10-30 02:00:46 +01:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
clawdie/zot!27
No description provided.