Commit graph

2571 commits

Author SHA1 Message Date
程智超0668000959
62a2b0015a fix: explicitly ignore Close() errors in error paths and retry loops 2026-06-25 15:38:41 +08:00
程智超0668000959
d6371fcb68 fix(agent): close base64 encoder on io.Copy error path
Previously when io.Copy to the base64 encoder failed, encoder.Close()
was skipped. This left the encoder's internal buffer unflushed.
Now always call Close() and handle both copy and close errors
explicitly.
2026-06-25 15:23:34 +08:00
程智超0668000959
c3aa8c088c fix(web): explicitly ignore resp.Body.Close() errors after io.ReadAll 2026-06-25 15:13:29 +08:00
Mauro
dff16dbb91
Merge pull request #3169 from Alix-007/fix/evolution-heartbeat-coldpath
fix(evolution): skip cold path for heartbeat turns
2026-06-25 08:59:03 +02:00
Mauro
0a47fc8eb1
Merge pull request #3168 from Alix-007/fix/model-list-http-error-read
fix(model): handle error response read failures
2026-06-25 08:42:36 +02:00
Alix-007
f53e6e68e2 fix(model): avoid shadowing response error 2026-06-24 23:35:06 +08:00
Alix-007
288013ca0f fix(evolution): skip cold path for heartbeat turns 2026-06-24 23:29:46 +08:00
Alix-007
5e3fd4cd0f fix(model): handle error response read failures 2026-06-24 23:29:46 +08:00
Alix-007
540f81ff9e fix(openai_compat): use structured logger for native_search warning 2026-06-24 18:30:44 +08:00
danmobot
acc2c5c6aa test(fs): cover root path separator normalization 2026-06-23 20:57:42 +01:00
danmobot
ff247b63ac fix(exec): preserve additive custom allow behavior 2026-06-23 20:47:15 +01:00
danmobot
0c404869ae fix: restore openai compat log import 2026-06-23 20:41:28 +01:00
danmobot
263e940825 Merge remote-tracking branch 'upstream/main' into fix/launcher-setup-csrf 2026-06-23 20:38:16 +01:00
danmobot
9721c36e55 fix(exec): keep deny patterns active for custom allow rules 2026-06-23 02:53:14 +01:00
danmobot
1758eea948 test: cover launcher setup csrf guard 2026-06-23 02:24:53 +01:00
danmobot
f5b2ce7482 fix: reject cross-site launcher setup requests 2026-06-23 02:23:06 +01:00
danmobot
46ffda264f fix: import log in openai compat provider 2026-06-22 23:42:27 +01:00
danmobot
88bda73db6 Merge remote-tracking branch 'upstream/main' into fix/sandbox-fs-windows-paths 2026-06-22 23:42:04 +01:00
Mauro
a75b3d15bb
Merge pull request #3053 from chengzhichao-xydt/codex/store-lock-type-assert
fix(evolution): add ok check for LoadOrStore type assertion in lockStoreFile
2026-06-23 00:04:42 +02:00
danmobot
29e019ec66 test: cover sandbox fs Windows path handling 2026-06-22 23:01:20 +01:00
Mauro
eb8b6ca7c8
Merge pull request #3101 from sipeed/dependabot/npm_and_yarn/web/frontend/vite-8.0.16
build(deps-dev): bump vite from 8.0.13 to 8.0.16 in /web/frontend
2026-06-22 23:13:12 +02:00
Mauro
ec9c6cde8e
Merge pull request #3091 from chengzhichao-xydt/codex/provider-native-search-type-assert
fix(openai_compat): add ok check for native_search type assertion
2026-06-22 23:12:51 +02:00
dependabot[bot]
646c2db1e9
build(deps-dev): bump vite from 8.0.13 to 8.0.16 in /web/frontend
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 8.0.13 to 8.0.16.
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 8.0.16
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-06-22 21:04:17 +00:00
Mauro
dc46c05aac
Merge pull request #3105 from sipeed/dependabot/npm_and_yarn/web/frontend/eslint-10.4.1
build(deps-dev): bump eslint from 10.2.1 to 10.4.1 in /web/frontend
2026-06-22 23:01:39 +02:00
Mauro
43c671abdc
Merge pull request #3152 from phoeagon/main
add installation instructions to picoclaw skills search.
2026-06-22 22:59:12 +02:00
Andy Lo-A-Foe
cc7b4ca86b
fix(pico): deliver per-turn token usage to the streamer
Two bugs prevented the usage block from ever reaching the wire:

1. CallLLM read turnStateFromContext(ctx), but the raw ctx is not seeded
   with the turn state (only turnCtx is), so SetLastUsage/SetLastFinishReason
   were dropped — GetLastUsage() returned nil at finalize. Set them on the
   ts parameter directly, which is also what the streaming publisher reads.

2. The manager wraps the channel streamer in finalizeHookStreamer /
   splitMarkerStreamer, neither of which forwarded SetTurnUsage (it is not
   part of the bus.Streamer interface), so the type assertion in the
   publisher's Finalize failed silently. Mirror the existing SetModelName
   forwarding: add a turnUsageStreamer interface + setStreamerTurnUsage
   helper and SetTurnUsage methods on both wrappers (splitMarker also stores
   and re-applies usage to each freshly-begun part streamer).

Adds regression tests asserting both wrappers forward SetTurnUsage.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-22 15:38:46 +02:00
Andy Lo-A-Foe
697e94fe8c
feat(pico): emit real per-turn token usage on finalized message 2026-06-22 13:15:35 +02:00
Andy Lo-A-Foe
052c742fe7
feat(pico): add SetTurnUsage and usage payload helper 2026-06-22 13:07:48 +02:00
phoeagon
a63b44ac74 add installation instructions to picoclaw skills search. 2026-06-21 14:15:27 -07:00
Mauro
287853ab58
Merge pull request #3144 from sipeed/dependabot/github_actions/actions/checkout-7
build(deps): bump actions/checkout from 6 to 7
2026-06-18 22:09:12 +02:00
Mauro
0d1ed99007
Merge pull request #3146 from sipeed/dependabot/go_modules/golang.org/x/term-0.44.0
build(deps): bump golang.org/x/term from 0.43.0 to 0.44.0
2026-06-18 22:08:40 +02:00
Mauro
70afab59e6
Merge pull request #3147 from sipeed/dependabot/go_modules/github.com/Azure/azure-sdk-for-go/sdk/azidentity-1.14.0
build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.13.1 to 1.14.0
2026-06-18 22:08:22 +02:00
Mauro
a3be5a6b25
Merge pull request #3149 from sipeed/dependabot/go_modules/github.com/anthropics/anthropic-sdk-go-1.50.2
build(deps): bump github.com/anthropics/anthropic-sdk-go from 1.46.0 to 1.50.2
2026-06-18 22:07:53 +02:00
Mauro
62206befe1
Merge pull request #3148 from sipeed/dependabot/go_modules/golang.org/x/sys-0.46.0
build(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0
2026-06-18 22:07:28 +02:00
dependabot[bot]
38a1d823c3
build(deps): bump github.com/anthropics/anthropic-sdk-go
Bumps [github.com/anthropics/anthropic-sdk-go](https://github.com/anthropics/anthropic-sdk-go) from 1.46.0 to 1.50.2.
- [Release notes](https://github.com/anthropics/anthropic-sdk-go/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-go/blob/main/CHANGELOG.md)
- [Commits](https://github.com/anthropics/anthropic-sdk-go/compare/v1.46.0...v1.50.2)

---
updated-dependencies:
- dependency-name: github.com/anthropics/anthropic-sdk-go
  dependency-version: 1.50.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-06-18 17:14:29 +00:00
dependabot[bot]
35db389025
build(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0
Bumps [golang.org/x/sys](https://github.com/golang/sys) from 0.45.0 to 0.46.0.
- [Commits](https://github.com/golang/sys/compare/v0.45.0...v0.46.0)

---
updated-dependencies:
- dependency-name: golang.org/x/sys
  dependency-version: 0.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-06-18 17:14:24 +00:00
dependabot[bot]
aeab7b15a4
build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azidentity
Bumps [github.com/Azure/azure-sdk-for-go/sdk/azidentity](https://github.com/Azure/azure-sdk-for-go) from 1.13.1 to 1.14.0.
- [Release notes](https://github.com/Azure/azure-sdk-for-go/releases)
- [Commits](https://github.com/Azure/azure-sdk-for-go/compare/sdk/azidentity/v1.13.1...sdk/azcore/v1.14.0)

---
updated-dependencies:
- dependency-name: github.com/Azure/azure-sdk-for-go/sdk/azidentity
  dependency-version: 1.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-06-18 17:14:21 +00:00
dependabot[bot]
6d0ca80f21
build(deps): bump golang.org/x/term from 0.43.0 to 0.44.0
Bumps [golang.org/x/term](https://github.com/golang/term) from 0.43.0 to 0.44.0.
- [Commits](https://github.com/golang/term/compare/v0.43.0...v0.44.0)

---
updated-dependencies:
- dependency-name: golang.org/x/term
  dependency-version: 0.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-06-18 17:14:11 +00:00
dependabot[bot]
4514d54ff5
build(deps): bump actions/checkout from 6 to 7
Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v6...v7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-06-18 17:13:51 +00:00
lc6464
d4adbf9418
fix(web): block private IPv4 embeds in ISATAP literals 2026-06-18 17:12:38 +08:00
Mauro
99291182e7
Merge pull request #3141 from jincheng-xydt/fix/3125-brave-search-logging
fix(web_search): add diagnostic logging for Brave empty results
2026-06-18 08:16:14 +02:00
Mauro
6c31f9ffdd
Merge pull request #3136 from ZOOWH/fix/3111-gemini-thought-signature
fix(gemini): set both camelCase and snake_case thought_signature in tool call request body
2026-06-17 20:40:13 +02:00
Mauro
e3464f4388
Merge pull request #2917 from PierreLeGuen/nearai-provider
feat(provider): add NEAR AI Cloud provider
2026-06-17 20:37:38 +02:00
徐闻涵0668001344
08192ddf1b style(test): split long t.Fatalf line to satisfy golines 120-char limit 2026-06-17 17:49:52 +08:00
肆月
7b5fe01187
fix(web): update sogou search regex to match new HTML structure (#3139)
- reSogouTitle: make class attribute quotes optional (class="?resultLink"?)
- reSogouSnippet: allow additional CSS classes after clamp (clamp\d*[^"]*)

Sogou WAP search page changed its HTML format:
- class=resultLink -> class="resultLink" (added quotes)
- class="clamp3" -> class="clamp2 fz-mid click-sugg-content" (extra classes)

Fixes web_search tool failing to parse sogou search results.
2026-06-17 17:02:54 +08:00
lc6464
1420875921 fix(onebot): tighten inbound media download handling 2026-06-17 17:00:24 +08:00
lc6464
234bd03018 fix(onebot): block private inbound media fetches 2026-06-17 17:00:24 +08:00
徐金城0668000897
b2fbe83565 fix(web_search): add diagnostic logging for Brave empty results
When the Brave Search API returns HTTP 200 with zero results, log a
warning with the response body preview to help diagnose silent failures.
This addresses cases where the API response format has changed or a
non-standard error response is misinterpreted as a successful empty
result, leaving the LLM with a misleading "No results" message.

Previously, empty results were silently returned to the LLM as "No
results for: <query>", making it impossible to distinguish between
genuinely empty results and API format mismatches or silent errors.

Closes #3125
2026-06-17 16:23:25 +08:00
Mauro
a16a1e1535
Merge pull request #3137 from jp39/cron-command-remotes
feat: allow configured remote cron commands
2026-06-16 22:16:05 +02:00
Mauro
910bfbe6a4
Merge pull request #3120 from carlosprados/feat/register-channel-settings
feat(config): add RegisterChannelSettings hook for out-of-tree channels
2026-06-16 22:09:00 +02:00