Repository navigation
feat(knox): keep one bounded progress digest with recent tool results - #376
Conversation
Dependency GuardThis PR changes dependency-related files. Maintainers should confirm these changes are intentional. Changed files:
Maintainer follow-up:
|
Dependency graph changes notedThis PR includes dependency graph changes. The dependency guard is informational because the PR author is a repository admin or a member of
Security review is still recommended before merge when the dependency graph change is intentional. |
|
Land-ready proof for 29da39f (merge base Knox now keeps one changed-only 15-second digest: latest five observed call results plus current execution/approval, 50 graphemes per item and 400 per notice. Empty snapshots alone use the request-language fallback. Confirmed replacement/final delivery and authoritative cancellation control recall; unchanged content makes no messenger calls. ALL exact-head checks are terminal: 70 success, 12 legitimately skipped, zero failed/pending/cancelled. CI40059058282, PlatformClaw CI40059058277, aggregate gate, security-fast, former small-3 failure, and build-artifacts passed. Hosted startup gzip is333002B under the unchanged333824B cap, with814 finalized sidecars. Actual local proof used task-owned Ubuntu Docker, Node24.18.0, pinned pnpm11.15.1 and separate Linux dependencies. Source bytes were frozen and all13 final committed Git blobs independently matched their reviewed SHA256 map; worktree is clean. Exact commands: pnpm install --offline --frozen-lockfile
env -u NODE_ENV OPENCLAW_CHECK_CHANGED_REMOTE_CHILD=1 python3 /tmp/pr376-subreaper.py node scripts/platformclaw-check.mjs --changed --base a083a64d0504981aa29b82fa544f6ac17c4ceb60
env -u NODE_ENV -u NODE_OPTIONS pnpm build
node scripts/pre-commit/pnpm-audit-prod.mjsAll exited0. The mandatory92-path wrapper passed Knox227 Mock tests, UI591 tests,95 npm locks, the144-module SDK baseline and approved budgets, exact patch guard, Knip,258 declaration contracts, all-project tsgo, full type-aware lint (core16506 files,22 plugin shards,scripts906 files), and zero runtime cycles. The full production build passed all plugin assets,nine declaration stages and UI (local333786B/818sidecars uses its own Git/build metadata). Prepush live production audit found no high-or-higher advisories. Connected dependency repairs were explicitly approved: official narrow MSAL5.4.2 backport, same-major Undici7.30.1/8.12.2 and normal body-parser2.4.0/required qs6.16.1 resolution. Both audit entrypoints require exact reviewed patch bytes, upstream integrity, registration, lock hash and every matching snapshot; other advisories/tampering still fail closed. MSAL patch/install hash is Fresh whole-PR review and subsequent affected-delta reviews leave no accepted/actionable finding. The old Zod Set/Map P2 remains in its raw report with a separate official-source and executed old/patched/official disposition: raw upper-bound rejection is intentional security semantics. It was not rewritten as a clean report. Latest MSAL/HTTP and narrow fixture/pin reviews have zero findings; independent reviewer and primary verified consequential evidence. No ClawSweeper comments/rank-up moves, PR reviews, or inline findings exist at final live refresh. Personally checked sibling Codex Production LOC+1007/−288 (net+719) owns bounded request progress/recall and exact security-artifact verification; tests+2212/−531, docs net+116, dependency patch text+757, manifests/lock net−25. No release-owned changelog change. Limits: Knox send/cancel/status uses the explicitly required Mock, not production Knox. Deploy the agreed durable proxy endpoints first. Azure responses are deterministic, not live-tenant verification; unchanged ManagedIdentity is source-inspected only. Abrupt-restart receipt recovery, standalone npm patch transport, the older Feishu groupPolicy JSON-default gap and prefixed production service-worker preview fixture remain named follow-ups. Upper-bound parser protection is not a universal DoS guarantee. No release/deployment/npm publishing is requested. Native reviewed-head/artifact guards are validated; proceeding only through |
|
Merged via squash.
|
Closes #375
What Problem This Solves
Knox users waiting for a reply receive coarse progress notices that can accumulate. A long sampling interval can hide completed calls; repeated text spends messenger API calls without adding information.
Why This Change Was Made
The Knox plugin now samples every 15 seconds and keeps one factual digest. It shows at most five recent terminal calls in chronological order, followed by current execution or approval state. Each item is limited to 50 Unicode graphemes; the complete notice, including the existing DM indicator, stays within 400. Paths prefer file basenames. Commands, browser actions, and hosts come from actual invocation facts, without an AI summarizer or command-purpose dictionary.
Only a completely empty snapshot gets a generic fallback: any Hangul character in the raw request selects
⏳ 요청을 처리 중입니다., otherwise⏳ Processing request. Factual labels remain English and Korean filenames/commands remain intact. Completed-history-only snapshots contain no fallback.Identical rendered snapshots make zero extra messenger requests. Confirm a replacement before recalling its predecessor; confirm the final answer before removing temporary notices. Abort or an authoritative cancelled result cleans up immediately, including uncertain sends. Questions, substantive block replies, and final/error answers are protected. Uncertain progress delivery or failed recall freezes replacements to avoid accumulating notices.
The relay uses the agreed authenticated
/outbound/canceland/outbound/statussiblings. Pending/lost acknowledgements retain the original composite request/run key and resolve through GET only, bounded to 30 seconds with 10-second HTTP timeouts. Explicit stored failures andretryable: falseremain authoritative. Not-found is never treated as invented cancellation success.CI repairs included in this landing PR:
Startup UI gzip exceeded the unchanged 333824 B cap by one byte. Reuse the existing identical metadata normalizer instead of retaining a local duplicate. With identical build metadata, startup gzip decreased from 333809 to 333795 B. No budget, baseline, or metadata contract changed.
The shared UI runner intentionally resets module evaluation while the browser retains registered constructors. The bulk-delete fixture mounted an older class but supplied the current Gateway error class. A fresh test subclass now mounts the actual current component. A canonical registration module consumes the exported production class and is the sole runtime registration owner, avoiding a test-only unused export. Deletion certainty, assertions, timeouts, and runner isolation are unchanged.
Review found a stale resolved-approval row. Matching definitive execution completion now retires only that call's approval; approval-ID-only resolution finds the actual call, unrelated calls preserve other approvals, and late resolution cannot resurrect a terminal call after history eviction. Approval-pending/unavailable pseudo-results remain eligible for real resolution/execution.
New CI exposed high-severity Zod collection traversal advisory GHSA-mrhx-c7xc-m3w5. With explicit owner approval, normal direct Zod pins move from 4.4.3 to 4.6.6. Compatible transitive resolution follows normally. Remaining exposed v3 parsers, including Zod 4.6.6's
/v3export and Discord's separately bundled parser, receive reviewed upper-bound backports. Zod 3.25.76's optional old-v4 exports are patched too. Both audit entrypoints recognize only these exact reviewed artifacts, validating upstream integrity, patch bytes, workspace registration, pnpm lock hash, and every matching snapshot. Unknown versions, changed bytes, missing registration, and unrelated/new advisory details still fail closed. No blanket version waiver, dependency override, or audit ignore was added.The package-patch policy guard now uses the same exact reviewed-artifact owner as both audit entrypoints. Legacy Baileys rules stay intact. Declared, tracked, active, missing, and orphan security artifacts all reach identity verification; unknown patches remain rejected. Pnpm-supported empty context lines remove Git trailing-whitespace failures while all eleven installed parser source bytes remain identical.
Npm lock generation now normalizes pnpm snapshot patch/peer decorations before extracting exact scoped child pins. Git parents use their actual lock metadata version rather than a URL as an npm selector. The real 95-package generation gate passes without dependency overrides.
Zod's newer JSON Schema projection uses equivalent primitive type arrays and an equivalent email regex. Real validators confirm the changes. The Feishu plugin explicitly retains URI format alongside its HTTPS prefix, preventing an unknown format from silently dropping URL validation. The generated channel metadata is regenerated from that canonical owner.
Locale regression fixtures now clear the handler after constructing the probe, preserving the actual bare fallback and explicit English restoration checks. Retired secret-provider bypasses still fail, with precise unknown-key diagnostics instead of an obsolete generic union message.
The two-tab baseball E2E observes actual taunt DOM additions before releasing receipts. It requires exactly one event across both tabs and through queue settlement, including separated duplicates, instead of sampling a two-second transient late. Product duration and timeouts are unchanged.
With separate explicit owner approval, the public SDK baseline accepts exactly two changed module hashes. The existing deprecated Zod barrel gains 21 export names and 14 callable values (twelve new callable names plus runtime input/output functions). The four measured budgets become public 4000, callable 2401, deprecated 832, and Zod-deprecated 303; other gates remain intact.
The beta.5 session-store ledger now matches the already documented conditional removal policy: original October 12 date retained, published-reader/minimum-version/legacy-doctor blockers remain visible as removal-pending. The unconditional deprecated-expiry guard still fails its real fixture. Public APIs and session bridges are unchanged; the normal compatibility-registry hash change refreshes installed-plugin index policy.
The later exact-head audit reported four additional high findings: MSAL GHSA-xcx6-jx8p-x3h5, body-parser GHSA-27r3-jxmh-p828, and both Undici majors affected by GHSA-xjj6-f33q-929c. With explicit approval, Undici's existing pins/overrides move to 7.30.1/8.12.2; body-parser resolves normally to 2.4.0, with its required qs 6.16.1 range satisfied by the existing override. Obsolete Undici release-age exceptions are removed. Body-parser's exact-version exception applies only during its approved 48-hour window.
Current Azure Identity and Teams supported ranges cannot admit fixed MSAL 7.1.0. The reviewed 5.4.2 backport applies Microsoft's narrow official fix to source, ESM, CJS, and shared declarations. Confidential apps now explicitly reject instance-aware configuration/query parameters and discard untrusted response routing metadata; state and nonce checks remain. Public-client behavior is preserved. Five stale source-map links are removed within the seven patched files; their original maps remain unreferenced, reducing debug/editor source navigation for these files. Both audit entrypoints require the exact reviewed MSAL artifact identity before recognizing remediation; other advisories still block.
The small-3 package-policy fixture now asserts the actual nested
simple-git/debugoverride retained by the earlier canonical lock-generator repair, rather than demanding that its child pin disappear.New runtime evidence: all nine real local-HTTP child scenarios pass for installed Undici 7.30.1/8.12.2 and body-parser 2.4.0, including the previously process-crashing attacks and plain/gzip controls. The original installed versions exited 1 on the three attacks. Actual installed MSAL public ESM/CJS flows verify trusted endpoint and request code, preserved state/nonce rejection, normal authorization and client-secret/certificate grants, PS256 signature and audience/issuer/subject, and unchanged public-client instance-aware authorization URL support. Deterministic Azure responses use the official network-client seam; this is not live Azure tenant verification. ManagedIdentity's separate unchanged class was source-inspected, not executed.
MSAL patch SHA256 and pnpm 11 install hash:
c2854316529b20e93e91e44a4edb703526a9b2cfed9512baa9d4ac9c6f200679. All seven installed artifacts were independently hashed and compared with the supported pnpm editable tree. Four differ only in pnpm-preserved line endings/EOF; normalized source is identical, including the exact official CCA source. Editable-buffer hashes are not presented as installed-file hashes.The security fix intentionally checks raw collection size before parsing children. Oversized collections can now fail even when child transforms would deduplicate the parsed result. This matches official 4.6.6. Earlier container overwrite/preprocess ordering is preserved. Oversized child effects/issues and enclosing union diagnostics can differ. Unbounded/custom post-parse constraints and the v3 Map API remain unchanged; this is not a universal denial-of-service guarantee.
User Impact
Five new identical calls do not trigger send/cancel when the rendered latest-five digest stays identical. Seven calls within 10.5 seconds retain only the latest five. Unchanged samples cost zero API calls; normally each visible digest costs one send and one eventual recall. Status GETs occur only for pending/uncertain acknowledgements.
Command failure, background start, non-dispatch, unknown outcome, and pending/resolved approval remain distinct. Tool completion does not claim the whole request is complete. The default first delay changes from 10 to 15 seconds; an explicit delay override is preserved. No new config key, core protocol surface, or database schema is added.
Evidence
Current exact head:
29da39f05de7fd6cdedb608a4e8a28c8f5b75a9d; PR merge base:a083a64d0504981aa29b82fa544f6ac17c4ceb60. All exact-head hosted checks are now terminal: 70 successful / 12 legitimately skipped / 0 failed / 0 pending / 0 cancelled. CI run 40059058282 and PlatformClaw CI run 40059058277 passed; aggregate CI gate, security-fast, small-3 regression shard, and build-artifacts all succeeded. Native prepare/merge remains the final delivery step. Hosted build logs record startup gzip 333002 B <= unchanged 333824 B and 814 finalized sidecars; the separate full local build records 333786 B and 818 with its own Git/build metadata. Previous head 80ac finished with 67 successful, 12 skipped, and three failed checks (security-fast, small-3, and aggregate CI gate), zero pending/cancelled. Its actual failures are repaired here; they are not passing evidence for this candidate.Mandatory final full validation completed exit 0 on the exact source committed as
29da39f05de7fd6cdedb608a4e8a28c8f5b75a9d:env -u NODE_ENV OPENCLAW_CHECK_CHANGED_REMOTE_CHILD=1 node scripts/platformclaw-check.mjs --changed --base a083a64d0504981aa29b82fa544f6ac17c4ceb60. The trusted task-owned subreaper retained the repository wrapper and cleaned browser descendants. Its whole-PR 92-file plan passed 95 npm locks, generated channel metadata, the full 144-module SDK manifest and approved budgets, compatibility expiry/report, all six patch registrations, Knip, 258 declaration contracts, all-project tsgo, full type-aware lint (core 16506 files, 22 plugin shards, scripts 906 files), and zero runtime import cycles. The Git fixture setup uses matching task-checkout ownership and isolated Vitest HOME; no safe-directory exception, assertion, timeout, skip flag, or gate was changed.Local validation: task-owned Ubuntu Docker, Node 24.18.0, pinned pnpm 11.15.1, separate Linux dependencies.
pnpm install --offline --frozen-lockfilecompleted exit 0. Earlier online installers printed completion but retained optional-fetch processes; those attempts were stopped/reconciled and were not counted as passing.node scripts/platformclaw-check.mjs --surface knox: lint/package types and 13 files / 227 Mock tests passed after the dependency update. Extension TEST types had already passed for the unchanged Knox source.node scripts/run-vitest.mjson the four security/audit files: 53 tests passed. The native Node probe resolves 20 installed runtime entrypoints, including A2UI core/lit consumers, Discord's vendored ESM/CJS, Zod root/v3/optional v4 classic/mini/core, plus real MCPobjectFromShape/safeParseboundaries. Bounded oversized inputs do zero child/effect work; valid/minimum/async/type/overwrite/conditional-check controls are covered. Audit tests exercise tampered bytes, hashes, upstream integrity, registrations, unknown versions, other advisories, and SDK verification without a registry advisory. After the declaration-only lint repair, all 52 audit tests passed again.Independent baseline/fixed package probe: 16 runtime entries, baseline 16 passing / 154 failing versus backport 170 passing / 0 failing. An additional 18-case old/patched/official comparison confirms intended raw Set/Map cardinality tightening and preserved preprocess/overwrite controls. Original and patched dependency TypeScript source both compile with the same Node ambient types.
UI observed-order regression reproduced 78 passing / 3 failing before repair; repaired original triple 81/81, standalone bulk-delete 27/27. Final registration/actions integration: 4 files / 88 tests passed. No expected outcome was weakened.
Dependency siblings: 6 files / 115 tests passed covering config/plugin validation, agent schema, plugin SDK schema, model normalization, and Canvas asset tooling.
Root production, root TEST, UI TEST, and UI production
tsgoconfigs passed. Focused lint: 0 warnings / 0 errors. Script declarations: 258 contracts matched. Direct dependency pin guard: 639 specs / 186 tracked manifests / 0 violations. Both production and all-exports Knip checks passed. Oxfmt andgit diff --checkpassed.Live production advisory check immediately before commit: no high-or-higher advisories with all reviewed artifact verification active. Security-focused regressions: 78 tests passed, then affected MSAL/package-policy 11 passed after the certificate fixture repair. Vertex HTTP/proxy siblings: 33 passed. Real local HTTP attack/control proof: 9/9 child processes passed, compared with three original process-crashing attacks. Both sparse-owner npm locks passed explicitly and all 95 passed in the mandatory full wrapper.
Canonical full production
env -u NODE_ENV -u NODE_OPTIONS pnpm build: exit 0, including all plugin assets, nine declaration stages, runtime postbuild and UI. Startup gzip 333786 B <= unchanged 333824 B, 818 compression sidecars; all performance gates passed. This local source-identical build uses Docker Git metadata; the exact-head hosted build also passed (linked above). Prior UI build-info/Vite regression: 30 tests passed.Connected repairs: 266 focused tests for patch/audit guards, npm pins, config/doctor metadata, and Feishu validation; 217 precise retired-config/locale regressions; SDK surface 10 tests plus the actual full API manifest gate. Compat registry/index/report siblings 38 tests passed, followed by the fixture-only 4 rerun. Real package-patch and boundary-report CLIs pass with all flags intact.
Real Chrome: all 11 enhancement E2E cases passed using Vitest’s normal test environment. A natural 2200 ms late-observation diagnostic demonstrates old instantaneous count zero versus recorded event one. Deliberately changed receipt controls correctly fail for zero events and for two separated events; these controls are retained outside the repository, not committed as expected failures. UI test types and lint pass.
Generated-schema evidence: 94 bare primitive union pairs matched on 1316 actual validator comparisons; old/new Reef email expressions matched 137270 cases. Remaining structural/default/required differences are zero after the Feishu URI fix. Scoped fresh P0–P2 reviews of each subsequent repair and the approved SDK metadata delta found no accepted/actionable issue.
The integration harness exercises real core inbound/dispatch/delivery with ephemeral state and Mock Knox send/cancel/status. A real Node subprocess runs from a long path with over 400 command/argument characters; tests observe running and exit-zero facts, 50-grapheme truncation, notice budget, and no output/credential leakage. Held acknowledgements prove replacement-before-recall, final-before-cleanup, and abort cleanup while final acknowledgement is pending.
{"verdict":"pass","channelApi":"mock Knox send/cancel/status","tests":227,"liveKnoxCalls":0,"unchangedDigestExtraCalls":0,"emptyFallbackUsesRawRequestLanguage":true,"itemLimitGraphemes":50,"noticeBudgetGraphemes":400,"replacementAckBeforeRecall":true,"finalAckBeforeCleanup":true,"nativeCancellationCleanupBeforeFinalAck":true}Fresh reviews repaired the transport/attempt ownership and approval findings. The final security delta completed a three-pass P0-P2 autoreview. Its raw report retains one Set/Map cardinality finding; direct official source, executed comparison, primary inspection, and independent verification establish that it is the intended security contract, so the suggested child-transform exemption was rejected. This is a documented disposition, not a rewritten clean report. No accepted/actionable finding remains. The later explicit tuple declaration received its own fresh full-helper-context autoreview with no findings. Review verdicts are static; execution results are separate evidence. The later MSAL/HTTP delta received a fresh two-pass P0–P2 review with zero findings; its certificate-fixture correction and the two remaining direct Undici pins received separate narrow reviews, also zero findings. Final exact-head live refresh found only the two informational dependency bot comments, no reviews/inline comments, and no ClawSweeper rank-up moves.
Personally checked sibling Codex at
ad020f29aeda36ceac4f7c75fc6b5c7e00ab6f7b:codex-rs/app-server-protocol/src/protocol/v2/item.rs:270-334,codex-rs/app-server/src/bespoke_event_handling.rs:1328-1418; corresponding normalized projector and embedded producer contracts were inspected. Independent primary inspection also covered approval callbacks and item lifecycle atitem.rs:1425-1516andbespoke_event_handling.rs:630-707,1937-2029. No Codex source change is needed.Reviewed patch SHA256 (also pnpm 11 lock install hashes):
zod@3.25.76:7603e669a671f61a89c898cba1c3eedbb5c529274ac7187ec3394c10a055dec9zod@4.6.6:5b448a1a3aafd543cd67bc4520817f995b85324b886be37256af9b4cb15401aa@discord/embedded-app-sdk@2.5.0:f48e401bc4364900e83f8fe2a1319182b3ef04cf1aef48cb518c7e3010e9af10@azure/msal-node@5.4.2:c2854316529b20e93e91e44a4edb703526a9b2cfed9512baa9d4ac9c6f200679Net LOC versus PR base: production +719 (1007 added / 288 removed), tests +1681 (2212 / 531), docs +116 (140 / 24); generated dependency patch artifacts 757 added lines; manifests/lock/config -25 (274 / 299). Production growth owns request-correlated progress/recall and exact security-artifact verification; generated parser and MSAL dialects cover actual shipped entrypoints. The additional audit-owner growth recognizes the exact approved MSAL security artifact through the existing canonical verifier. No parallel legacy progress path remains. Release-owned changelog is untouched.
Rollout: deploy the agreed durable single-instance proxy cancel/status endpoints before enabling this release. Production proxy/native Knox was intentionally not exercised; Mock was explicitly required. Follow-up: persist/reconcile temporary receipt keys for abrupt Gateway restart and queued requests rejected before adoption. Normal adopted-request completion/abort cleanup is covered; durable outbox recovery is not. Broader UI startup headroom remains a separate loading/chunking follow-up.
Additional limits/follow-ups: standalone npm package-lock generation pins upstream versions but does not transport pnpm parser patches; no npm publish is requested or claimed remediated. The older Feishu groupPolicy JSON-input default omission is unchanged; domain defaults/inheritance are covered. Ordinary E2E uses Vitest’s normal test environment; its success does not establish prefixed production service-worker preview routing, a separate pre-existing fixture gap. Dedicated production worker-update proof remains a separate owner gate.