* docs: fix stale commands, paths, and provider claims
Sweep findings: D-03, D-04, D-05, D-06, D-07, D-08, D-09. Align setup and API examples with current configuration and CLI behavior.
(cherry picked from commit 2b21ee513b)
* fix(review): correct crypto output flag
Addresses blocking review finding on #3401.
(cherry picked from commit 85bb502709)
* docs(ov): finish stale CLI path cleanup
Complete the #3401 salvage by updating the API-writing templates and the remaining encryption guide examples to the Rust CLI surface.
* fix(ov): make local content operations race-safe
Salvage the safe-I/O portions of OpenViking#3414: reject unsupported local watch requests before upload, atomically create download targets, and write snapshot output before reporting JSON success. Add focused regression coverage.
* fix(ov): validate timeout and node-limit inputs
Salvage and complete OpenViking#3414 by validating every timeout and node-limit surface consistently while preserving config commands as a repair path for invalid persisted values.
* fix(ov): allow explicit help before language setup
Salvage OpenViking#3416 with a narrower contract: only clap-recognized -h/--help requests bypass first-run language selection. Bare command groups, legacy -help, and option values keep the existing gate.
* docs(ov): align session and snapshot command examples
Salvage OpenViking#3419 by correcting positional session and snapshot examples, documenting the canonical observer filesystem command, and keeping fs as a compatible alias.
* fix(ov): honor configured output defaults safely
Salvage and complete OpenViking#3424 with CLI-over-config precedence, runtime validation for normal commands, and a table fallback that leaves config repair commands usable. Also clarify the Python-client versus Rust-CLI upload-mode controls.
* fix(ov): preserve zero node-limit semantics
* ci: skip embedding-dependent resource test without secrets
* fix(cli): validate compile timeout consistently
---------
Co-authored-by: zhiheng.liu <zhiheng.liu@bytedance.com>
* fix(ragfs): preserve cache visibility on partial S3 deletes
Surface exact and per-object S3 deletion failures, while always invalidating the affected directory and stat cache scope after a recursive delete attempt.
Source-PR: #3407
Original-Commit: 8d6addf28e
* fix(session): preserve legacy policy and peer identity compatibility
Parse string false and other legacy boolean-like memory policy values without silently enabling extraction or breaking persisted configs. Encode mixed-script peers losslessly, while retaining their former lossy IDs as read-only retrieval and extraction aliases.
Source-PR: #3422
Original-Commit: 0dfd5a9ed9
* fix(memory): drain timer flush tasks during shutdown
Retain the shielded timer flush task and await it when close cancels the timer loop, so batch failures are observed and submitters are resolved without unhandled task exceptions.
Source-PR: #3438
Original-Commit: ca1d74e164
* fix(storage): preserve peer isolation and cache correctness
* fix(ingest): reserve encoded peer namespace
* ci: skip embedding-dependent resource test without secrets
* fix(ragfs): invalidate caches after partial remove
---------
Co-authored-by: zhiheng.liu <zhiheng.liu@bytedance.com>
Print-to-PDF producers routinely emit several image XObjects drawn at the
exact same position on a page (a background layer plus a content layer).
Because `_extract_image_from_page` rasterises the page *region* rather than
decoding the XObject itself, every one of them renders to identical bytes —
so a document with two stacked full-page layers wrote two byte-identical
PNGs per page and referenced both from the generated markdown.
Dedup within each page, in two steps:
- bbox first, so a repeat is skipped before paying for the render;
- a content hash as a backstop, for bboxes that differ slightly but still
rasterise to the same bytes.
Both sets are per-page, so a header logo repeated across pages is still
kept once on every page. `meta["images_deduplicated"]` reports how many
were skipped.
Measured on an 8-page article exported from a web page: 16 saved PNGs -> 8,
16 markdown image references -> 8, local conversion 3.8s -> 2.4s.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
- add storage.agfs.pathlock.lock_timeout_secs
- use pathlock default timeout instead of hardcoded zero in wrapper
- map legacy storage.transaction.lock_timeout when new config is unset
- remote redolog by using persistent `session_commit` queue.
Issue #3522 — the OpenClaw plugin's `config.apiKey` only accepted a plain
string, resolved through local `${ENV_VAR}` interpolation. `INSTALL*.md`
documented this as a known limitation: users who store their other OpenClaw
provider credentials (LLM, TTS, MCP servers) through the standard
`{source, id[, provider]}` SecretRef mechanism (env / file mount /
exec-backed vault such as 1Password, Vault, gopass) had to keep the
OpenViking key as cleartext inside `openclaw.json`.
### config.ts — `string | OpenVikingSecretRef` widening
* Add `OpenVikingSecretRef = "env"|"file"|"exec"` discriminated union type,
matching the shape OpenClaw core uses for its own credential fields
(`env` + `file` implemented in-plugin, `exec` forwarded to `child_process`
so providers like `@transmitt0r/openclaw-plugin-onepassword` can manage
the OpenViking key without SDK coupling).
* Add `resolveSecret()` resolver with explicit, actionable errors:
- env: unset var = throw, no silent empty fallback
- file: `~` expanded, UTF-8 read, whitespace trimmed; unreadable file
rethrows with the OpenViking field name prefixed so config misconfigs
surface with a clear label and path
- exec: lazy `require("node:child_process").execFileSync(provider,[id])`,
stdout trimmed, 15s timeout; errors prefixed with provider + id
- unknown source / missing id / missing exec provider = explicit throw
* `memoryOpenVikingConfigSchema.parse()` widens `rawApiKey` to
`string | OpenVikingSecretRef`, then passes it through
`resolveSecret(rawApiKey, "config.apiKey")` *before* the existing
`resolveEnvVars` pass. Plain strings transparently fall through
`resolveSecret` unchanged, so `${ENV_VAR}` interpolation is preserved
100% backward-compatibly.
* `OPENVIKING_API_KEY` env fallback is unchanged and triggers only when the
`apiKey` config key is absent — a user who deliberately sets `apiKey: ""`
still gets "" (explicitly unauthenticated), not the env fallback.
* `uiHints.apiKey.help` documents the SecretRef shape and recommends it.
### openclaw.plugin.json — widening schema + UI hints
* `configSchema.properties.apiKey` becomes `oneOf: [string, env ref, file ref, exec ref]`.
Each object variant has a `title`, `additionalProperties: false`,
`required`, and explicit description per field, so OpenClaw's config UI
can render them individually instead of showing a generic JSON object blob.
* `uiHints.apiKey.help` matches the new config.ts wording.
### INSTALL.md / INSTALL-ZH.md — SecretRef usage tables
Replace the old "plaintext / chmod 0600" caveat bullet with a 3-row table
(env / file / exec) showing example JSON + notes (Kubernetes secretKeyRef
mount for `file`, 1Password `op://` URL convention for `exec`). The
backward-compat string path is retained at the end of the new bullet so
existing deployments that haven't migrated yet still get the old permission
advice — no surprise behaviour for upgrading users.
### tests/ut/config.test.ts — SecretRef regression suite (10 new cases)
Under a new `describe("… SecretRef (#3522)")`:
1. Backward compat: `${OV_KEY}` interpolation still resolves.
2. env source — happy path with a fresh env var.
3. env source — unset var throws, no silent fallback.
4. file source — real `mkdtemp`-created file, trimmed whitespace. Cleanup
in `afterEach`.
5. file source — missing-path error message contains readable label + path.
6. exec source — `vi.spyOn(child_process.execFileSync)` asserts provider +
args, stdout trimmed.
7. exec source — missing `provider` field errors.
8. Schema validation — unknown `source` and missing `id` each throw with
error messages that name the problem.
9. Env fallback boundary — explicit `apiKey: ""` is NOT overridden by
OPENVIKING_API_KEY, but `apiKey` absent IS (backward-compat behaviour
contract pinned with a test so future refactors can't regress).
Covers every branch inside `resolveSecret()`, plus the backward-compat
contracts issue #3522 called out.
* feat: implement server-resolved OpenViking Assets manifests
Add the openviking-assets/1 declaration flow with server-owned configuration parsing and native Rust CLI execution.
- Resolve one flat Manifest against one Catalog through an authenticated server endpoint with strict schema and Git semantic validation.
- Reject recursive includes and unsafe clone URLs; return a resolved plan without submitting resources or running server-side batches.
- Keep local credential aliases, manifest state, dry-run, failure isolation, and per-asset create/sync orchestration in the CLI.
- Generate normalized stable asset identities on the server and remove the CLI direct SHA-1 dependency.
- Update flat examples and add server resolver/API plus Rust CLI coverage.
* feat: implement server-resolved OpenViking Assets manifests
* feat: implement server-resolved OpenViking Assets manifests
* fix(pathlock): tolerate missing lock token after recursive delete
* feat: implement server-resolved OpenViking Assets manifests
* feat: implement server-resolved OpenViking Assets manifests
Give with_openviking_context a deterministic lifecycle owner, reuse adapter clients without sharing invocation state, and preserve loop-scoped async behavior. Make component copies lifecycle-safe and reject post-close use before history access.
Copy connection and retriever configuration without cloning caller-owned live clients or carrying owned client caches into copied adapters. Guard optional Pydantic private state before resetting compatibility caches.
* feat(agent-evolution): reload global switch at commit time
* feat(agent-evolution): expose configured account in status
* test(agent-evolution): cover account in status response
* fix(agent-evolution): align live config reload semantics
* fix(agent-evolution): tolerate non-object live config
* fix(usage-reporter): use snake case count fields
* feat(usage-reporter): add file log sink
* fix
* fix: address live reload and usage sink review findings
* fix(usage-reporter): complete file sink compatibility
* fix: make experience snapshot source unambiguous
* docs(usage-reporter): align count record implementation plan
* fix: address agent evolution review blockers
* fix(usage-reporter): preserve Windows rollover deadline
* fix(usage-reporter): encode file records as JSON envelopes
* fix(usage-reporter): use snake case unique id
* fix(parse): distinguish mpegts from TypeScript ts
* fix(parse): tighten mpegts ts routing semantics
* fix(semantic): use file name for media summary type
---------
Co-authored-by: chenxiaobin.monkey <chenxiaobin.monkey@bytedance.com>
* fix(langchain): make async recording concurrency-safe
* fix(langchain): scope async state to each invocation
* fix(langchain): preserve cancellation progress on Python 3.10
* feat(connector): support more git like platform
* feat(connector): support more git like platform
* feat(connector): support more git like platform
* feat(connector): support more git like platform
* feat(connector): support more git like platform
* docs: fix broken links and anchors across READMEs and guides
Sweep findings: D-10, D-11, D-12, D-13, D-14, D-15. Restore valid documentation targets and stable cross-page anchors.
(cherry picked from commit e3504d633d)
* docs: correct contributor and release references
Reconstruct the factual parts of draft #3397 against current upstream: use the supported setup wizard, align the repository tree and workflow names with tracked files, document current release paths, and repair the bug-bounty link. Excludes install-policy and subjective content rewrites.
Based-on: b332e19e40
Based-on: c89afb17f2
Co-authored-by: zhiheng.liu <zhiheng.liu@bytedance.com>
* build: propagate recipe failures and align CMake minimum
Keep build failures visible, use isolated temporary extraction paths, and enforce the native build's CMake 3.15 floor across all contributor guides. CMake version parsing accepts prerelease and vendor suffixes.
Based-on: 8943a12285
Co-authored-by: zhiheng.liu <zhiheng.liu@bytedance.com>
* fix(scripts): surface backfill enumeration failures
Preserve the safety fix from draft #3415 while retaining legacy no-op arguments for existing operational scripts. Deprecated arguments now remain parse-compatible, advertise their status in help, and emit explicit warnings when used.
Based-on: 5516d96048
Co-authored-by: zhiheng.liu <zhiheng.liu@bytedance.com>
---------
Co-authored-by: zhiheng.liu <zhiheng.liu@bytedance.com>
* fix(models): route multimodal inputs to DashScope embed_content
Sweep findings: A-09. Preserve image parts through the shared embedding entrypoints.
(cherry picked from commit 50b20d7ca9)
* fix(models): constrain DashScope multimodal routing
Sweep findings: A-09. Preserve text mode and require a single fused vector for multipart input.
(cherry picked from commit 77784429d4)
* fix(models): respect DashScope Qwen fusion parameters
Sweep finding A-09
(cherry picked from commit aafc702b20)
* fix(review): preserve tongyi multipart compatibility
Addresses blocking review finding on #3400.
(cherry picked from commit 96844047c5)
* fix(eval): flush queued records on stop and adapt RAG pipeline to FindResult
Sweep findings: B-05, B-12. Drain recorder queues through the sentinel and consume current retrieval result objects.
(cherry picked from commit fecdbeb6d4)
* fix(sdk/python): support sync client inside a running event loop
Sweep findings: F-09. Run sync wrappers on one persistent worker loop with result and exception propagation.
(cherry picked from commit ba0faadc87)
* fix(sdk/python): preserve cancellation and fork safety
Sweep finding: F-09. Preserve original cancellation errors and reset worker synchronization after fork.
(cherry picked from commit a19e3c95e9)
* feat(sdk/go): add tags filter and relations API for parity
Sweep findings: F-11, F-12. Expose existing server capabilities consistently to Go callers.
(cherry picked from commit 8af0c2cb36)
* fix(sdk/python): runnable quickstarts, correct migrate payload, explicit timeout precedence
Sweep findings: F-01, F-02, F-14. Initialize documented clients and preserve Python SDK request/config semantics.
(cherry picked from commit d9a64f5665)
---------
Co-authored-by: zhiheng.liu <zhiheng.liu@bytedance.com>
DuTao