Make the missing-cwd schema test path platform-neutral, and record a
user/model-visible notice plus tool-result flag when worktree isolation
soft-falls back outside a git repository.
Keep WorktreeCreate hook failures hard-failing so configured hooks stay
authoritative in normal git sessions. Soft-fallback remains limited to
the missing-git path that #2052 needs.
Revert silent git fallback after hook failure. Treat WorktreeCreate hook
errors as recoverable in AgentTool so multi-repo cwd overrides still work
without bypassing configured hooks at the worktree layer.
Require Agent cwd to be an existing directory, always re-persist the
original resume metadata cwd, and fall through from failed WorktreeCreate
hooks to git when the selected cwd is a git repository.
Always forward persisted Agent cwd through resume metadata writes so a
mid-life resume cannot drop the multi-repo fallback path, and tighten
prompt wording to match the missing-git fallback contract.
Persist explicit Agent cwd even when a worktree is created, preserve it
when unchanged worktrees are removed, and base fork worktree notices on
the child-repo cwd for multi-repo parent sessions.
Address final-head review: store explicit Agent cwd in metadata for
resume, pass cwd into WorktreeCreate hooks, reject relative cwd in the
schema, and make the multi-repo parent regression sandbox portable.
* fix(web): make web/ build standalone — stop importing the repo-root package.json
vercel --prod deploys only the web/ directory, so site.ts importing
../../../package.json (and verify-dist.ts reading it) broke every Vercel
build with ts(2307) while local builds passed.
- SITE.version now derives from latestVersion, the newest entry in
src/data/releases.ts — committed data inside web/, so builds are
deterministic and need nothing outside the directory
- verify-dist gains a best-effort npm freshness guard: fails the build
only when registry.npmjs.org reports a newer @gitlawb/openclaude than
releases.ts; unreachable registry or malformed responses skip the
check, and site-ahead-of-npm is allowed for release PRs
- verify-dist.test.ts covers the guard via injected fetch (no network)
Co-Authored-By: OpenClaude <openclaude@gitlawb.com>
* fix(web): reject leading-zero semver from the npm registry
Number() would normalize a malformed '01.2.3' to 1.2.3; require strict
semver components so malformed registry values skip the freshness check
instead of being silently coerced.
Co-Authored-By: OpenClaude <openclaude@gitlawb.com>
---------
Co-authored-by: OpenClaude <openclaude@gitlawb.com>
Expose Agent cwd in the open build, let cwd select the child repo for
worktree isolation, and fall back instead of hard-failing when the
session itself is outside a git repository.
* feat(web): v0.26 refresh — buddy page, changelog, partners, provider catalog
- Single-source the site version from the root package.json (never stale again)
- New /buddy/ page: all 7 hero sprites rendered as animated SVGs generated
from src/buddy/pixelSprites.ts, attack descriptions, commands, hatch lore,
plus a dedicated 1200x630 OG image composed from the real sprites
- New /changelog/ page: curated release highlights 0.19 -> 0.26 from a typed
releases.ts data file
- Landing: buddy teaser section, partners strip (GitLawb, Bankr, Atomic Chat,
Xiaomi MiMo, Atlas Cloud, AI/ML API, Novita AI) with self-hosted logos,
community links, refreshed provider strip, node >= 22 fix
- Providers docs rebuilt as grouped catalog (39 providers: subscriptions,
gateways, vendors, local, custom) incl. xAI OAuth, AI/ML API, Cloudflare
Workers AI, NVIDIA NIM, Kimi K3, GPT-5.6, Opengateway free models
- Data refresh vs v0.26.0 source: 16 new slash commands, pdf skill, new CLI
flags + 10 subcommands, modelLimits/providerFallbackChain/agentRouting
settings, corrected env vars (GEMINI_API_KEY, OPENGATEWAY_API_KEY, ...)
- Nav/footer/docs sidebar link the new pages; JSON-LD breadcrumbs on both
Co-Authored-By: OpenClaude <openclaude@gitlawb.com>
* fix(web): address CodeRabbit review — flag description + dist verification
- Correct --disable-slash-commands description: the flag empties the entire
slash-command list (REPL.tsx filters all commands), not just skills; the
upstream help string "Disable all skills" is the misleading one
- Add scripts/verify-dist.ts, wired into `bun run build` (so the existing CI
web job runs it): asserts SITE.version matches the root package.json in the
rendered pages, nav exposes /buddy/ and /changelog/, every release renders
with its GitHub URL, every hero renders with its sprite asset, partner and
community links render on the landing page, and the sitemap covers the new
routes
Co-Authored-By: OpenClaude <openclaude@gitlawb.com>
* fix(web): harden verify-dist per review — empty-page guard, rendered-nav check, tests
- page() now records a failure for a present-but-empty file, so '' is only
ever returned alongside a recorded failure and skipped assertions can no
longer mask a blank page
- assert the rendered docs sidebar (dist/docs/) links every docsNav route,
not just the source data array and the landing nav
- extract pure verifyDist(dist) and add 9 fixture-based bun tests covering
missing/empty pages, lost sidebar links, missing sprites, stale partner
links, missing release URLs, and sitemap regressions; discovered by the
root `bun test` run in CI, no workflow changes needed
Co-Authored-By: OpenClaude <openclaude@gitlawb.com>
* test(web): derive the missing-sprite fixture from heroes data
Hard-coding robinhood.svg would make the test throw during fixture mutation
if that hero were renamed, instead of exercising verifyDist().
Co-Authored-By: OpenClaude <openclaude@gitlawb.com>
---------
Co-authored-by: OpenClaude <openclaude@gitlawb.com>
* fix(ui): keep SpinnerModeGlyph visible inside status parens
Always render the ↑/↓ mode glyph for leader spins so early requesting
and thinking-only phases are not blank, and place it as the first
status part inside the parentheses next to other activity cues.
Closes#2033
* fix(ui): preserve narrow-terminal thinking with mode glyph
Restore a second-chance width gate for leader thinking-only status under
the new inside-parens glyph layout, and suppress the mode glyph when the
row cannot fit minimal status chrome.
* fix(ui): prefer bare thinking over glyph-only on narrow rows
When leader thinking-only cannot fit glyph+thinking chrome, fall back to
bare (thinking) instead of empty mode-glyph status. Tighten glyph residual
budget to account for GlimmerMessage trailing space.
* fix(ui): budget glimmer space in bare thinking fallback
Bare leader thinking-only residual must reserve the GlimmerMessage
trailing space so equality-width terminals do not overflow by one column.
* fix(ui): nest teammate bare thinking under reduced motion
Apply the bareThinkingOnly nested (thinking) wrap in both shimmer and
dimColor branches so teammate thinking-only status keeps parentheses
when reduced motion disables the shimmer arm.
* test(ui): assert exact SpinnerAnimationRow status rows
Fix TS1355 from invalid null as const in baseProps and replace partial
toContain/regex checks with full ANSI-stripped row equality for the
glyph placement regressions CodeRabbit requested.
* fix(ui): prefer status content over empty mode-glyph chrome
When reserving the SpinnerModeGlyph would drop tokens/timer from the
status row, drop the glyph instead. Keep thinking full-chrome recovery,
default unknown modes to down-arrow, and tighten exact-row tests for
typecheck plus CodeRabbit feedback.
* fix(ui): preserve spinner tokens when glyph crowds status
* fix(ui): suppress empty glyph chrome and preserve token recovery
Skip glyph-only status when numeric thinkingStatus cannot fit on narrow terminals, and refuse glyph-free recovery that would swap visible tokens for a timer-only layout.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(ui): tighten glyph recovery for duration and timer bands
Exclude numeric post-thinking duration from glyph-only status (including requesting), prefer streaming tokens over duration when both cannot fit, and recover timer+token rows at the col-30 boundary.
* fix(ui): harden SpinnerAnimationRow glyph recovery priorities
Prefer tokens over timer/duration on mid-narrow rows, recover exact-fit
token columns, keep full effort text when glyph chrome fits, and prefer
active thinking over timer-only status. Tests now use production
Thinking… message width and frozen-clock exact row assertions.
* fix(ui): address CodeRabbit SpinnerAnimationRow recovery nits
Document token-over-thinking tie-break and > vs >= bare-pass split, drop
redundant suppressModeGlyph assignments on token-only fallbacks, and make
exact-row tests use PROD_MESSAGE plus an explicit padded mode-glyph helper.
* fix(ui): drop overflowing spinner suffix for tokens/thinking
Recover mid-narrow status when stop-hook/tool suffixes overflow bare
chrome, prefer live tokens over duration after the drop, and cover long
production verb column bands plus suffix regressions.
* fix(ui): recover status after SpinnerAnimationRow suffix overflow
Re-gate tokens when thinkingStatus is null after dropping a crowding
suffix, restore teammate nested thinking on the same path, and drop the
mode glyph before truncating a suffix that still fits under bare parens.
* fix(ui): complete SpinnerAnimationRow suffix and glyph recovery
Restore timer symmetrically after suffix drop, drop crowding suffixes
when preferTokens would overflow, keep already-visible thinking when
tokens unlock, and prefer tokens over a bare-fitting suffix that cannot
share the row.
* fix(ui): harden SpinnerAnimationRow recovery against wrap cliffs
Budget timer co-restore against all visible parts, re-gate tokens onto
timer-only rows after tokens-over-suffix, prefer thinking over a crowding
bare-fit suffix, and restore the mode glyph only after a suffix-keep
cascade.
* fix(ui): close SpinnerAnimationRow mid-narrow recovery cliffs
Prefer tokens over thinking when they cannot share bare chrome, tighten
thinking-over-suffix exact-fit to avoid a one-column suffix cliff, and
restore the mode glyph whenever recovered leader content fits.
* test(ui): cover SpinnerAnimationRow cliff and glyph-restore cases
* fix(ui): restore tokens beside thinking after suffix recovery
* fix(ui): close SpinnerAnimationRow suffix recovery cliffs
Budget timer and rendered thinking width in suffix-fit predicates so
widening does not drop the elapsed timer or streaming tokens. Co-restore
teammate tokens when thinking crowds timer-only rows, clear the mode glyph
when thinking+token recovery cannot fit glyph chrome, and budget full
effort text before keeping a stop-hook suffix.
* refactor(ui): collapse redundant SpinnerAnimationRow suffix-fit branches
Rely on the combined all-visible suffix budget check instead of
duplicate tokens-only paths. Keeps timer+thinking and no-token
thinking fallbacks unchanged.
* fix(ui): re-gate recovered spinner glyph
* test(ui): tighten spinner layout coverage
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat(auth): opt-in loopback proxy hosts that keep OAuth first-party
Pointing ANTHROPIC_BASE_URL at any host other than api.anthropic.com switches
the client to API-key mode, dropping a signed-in subscription session. That
blocks running the CLI through a local transparent proxy (compression,
inspection, caching) that forwards auth headers to Anthropic unchanged.
Add ANTHROPIC_FIRST_PARTY_PROXY_HOSTS: a comma-separated host[:port] allowlist
that extends first-party detection. It is honored only when the base URL points
at a loopback host, and only loopback entries are considered -- both checks are
redundant by design so a misconfigured non-loopback entry can never widen
first-party status to an off-machine host. Default behavior is unchanged.
Closes#2016
* docs(auth): document ANTHROPIC_FIRST_PARTY_PROXY_HOSTS
* fix(auth): harden loopback proxy allowlist matching
Normalize the base URL port to its scheme default (80/443) before
comparing an explicit allowlist port, so a `127.0.0.1:80` entry matches
`http://127.0.0.1`. Reject embedded credentials and non-http(s) schemes
up front so an OAuth session is never attached to a URL carrying userinfo
or a non-proxy scheme.
* fix(sdk): report a permission timeout as a timeout
On timeout the handler called denyPendingPermission and then fell through
to the fallback. The deny resolves the promise registered by
registerPendingPermission, but Promise.race has already settled with
{timedOut: true}, so nothing is awaiting it and the decision is discarded.
The fallback is createDefaultCanUseTool, whose contract is that the host
supplied no permission callback at all. A host that wired up
onPermissionRequest and simply answered too slowly therefore got the tool
result 'no canUseTool or onPermissionRequest callback provided. Pass
canUseTool in options', plus the matching warning on stderr -- both false,
and both pointing at a configuration problem that does not exist. It also
consumed the one-shot warning latch, so a genuinely misconfigured later
query in the same process is never warned.
Return the timeout decision directly. The permission_timeout event and the
existing deny are unchanged.
* test(sdk): move the timeout cases into the existing permissions suite
tests/sdk/permissions.test.ts pinned the old behavior -- it asserted the
timeout result was the fallback's message, with a comment describing the
fall-through as intended. It is not: that message claims no permission
callback was provided, which is false whenever onPermissionRequest is
wired up. Assert the timeout reports itself instead.
The new cases live in that suite rather than a new file: a separate test
file adds a slot to bun's sequential file ordering, which shifted which
suite runs before which and surfaced an unrelated mock leak in CI
(taskReport git metadata and the /ads command).
* test(sdk): drive the permission-timeout case off a mocked clock
The no-callback-fallback-on-timeout test relied on a real 10ms wait, so
the deny hinged on scheduling. Use fake timers and advance the clock by
the timeout window instead, making the timer the deterministic cause of
the denial.
* feat(integrations): add Ling 3.0 Flash free to the Opengateway catalog
inclusionai/ling-3.0-flash:free — 124B MoE reasoning model, 262K
context, 32K max output, tool calling verified through the gateway.
Free window on the gateway runs until 2026-08-03; the gateway delists
it automatically after that.
* test(model): include Ling 3.0 Flash in the Opengateway picker expectation
The static descriptor picker asserts the exact Opengateway catalog;
inclusionai/ling-3.0-flash:free now sits between Nemotron and HY3.
---------
Co-authored-by: OpenClaude <openclaude@gitlawb.com>
* feat(ui): single-row centered startup logo with ANSI Shadow wordmark
Render OPEN and CLAUDE side by side as one centered 6-line block on the
pre-Ink startup screen, redrawn in ANSI Shadow letterforms (consistent
shadow corners, D-shaped D, clean N). Terminals narrower than the 94-col
row fall back to two stacked blocks, each centered as a unit so rows stay
aligned. The tagline, provider box, and version line are centered to
match.
The Ink welcome panel wordmark (constants/brand.ts) becomes a matching
single row: letter-spaced caps flanked by shade-gradient accents,
keeping the shimmer/brand two-tone split.
Adds layout unit tests (one-row vs stacked switchover, block centering,
box centering) and brand wordmark invariant tests; updates the D-shape
glyph regression for the new font.
Co-Authored-By: OpenClaude <openclaude@gitlawb.com>
* test(ui): address CodeRabbit review — wordmark render test, row centering asserts
Extract the LogoV2 wordmark row into a WordmarkRow component and add a
focused render test asserting segment order and the shimmer/brand color
split (left accent + OPEN in brandShimmer, CLAUDE + right accent in
brand), via renderToAnsiString with chalk pinned to truecolor.
Extend the startup-screen layout test to assert the tagline and version
rows are centered, alongside the existing provider-box check.
Co-Authored-By: OpenClaude <openclaude@gitlawb.com>
---------
Co-authored-by: OpenClaude <openclaude@gitlawb.com>
* fix(query): count parallel tool failures once per turn
Prevent the tool-failure loop guard from stopping a response when a single model turn fans out parallel tool calls that share an error signature, category, or path. Cross-turn accumulation still trips after the model has a chance to adapt.
Fixes#2035
* fix(query): emit one advisory per signature in a parallel batch
Once-per-turn counting left the penultimate advisory path repeating for every duplicate failure in the same batch. Gate advisory emission on newly seen signatures this turn.
* test(query): lock parallel once-per-turn failure counting
Cover same-path parallel batches and assert the post-batch streak so a
partial double-count regression cannot slip past the suite.
* refactor(openai-shim): extract XML and response conversion
* fix(openai-shim): align facade tests with XML extraction
* fix(openai-shim): restore shared XML tool-call sequencing
Wire parseXmlToolCalls through the façade sequence counter, reuse the
shared extractBalancedJson helper, and restore production dependency
coverage in conversion and façade tests.
* fix(openai-shim): restore façade coverage and require XML sequencer
Restore non-streaming convert and HY3 JSON-fallback e2e seams so façade
dependency wiring stays exercised, require an injected XML id sequencer,
and assert consecutive shared-sequence ids.
* fix(openai-shim): restore provider coverage and array content guard
Keep relocated openaiShim suite tests in test:provider, and reject
non-object array content parts the same way the inline converter did.
* fix(openai-shim): preserve mixed XML/HY3 tool-call order
Sort HY3 and standard XML candidates by source offset before ID
assignment, isolate focused test sequencers, and restore fetch after
the Gemini non-streaming façade test.
* fix(stats): stop over-counting totalDays by one
The /stats 'active X of Y days' denominator (totalDays) diffed the first and
last session ISO timestamps raw, ran Math.ceil over the millisecond gap, then
added 1. firstSessionDate/lastSessionDate are full timestamps, so ceil rounds
any sub-day remainder up to a whole day and the +1 double-counts it: all
activity on a single calendar day reported 2 days (50% active instead of
100%), and every non-24h-multiple span was one day long.
Extract inclusiveCalendarDaySpan, which snaps both endpoints to their UTC date
(via toDateString, the same basis activeDays/dailyActivity use) before
differencing, so the gap is an exact multiple of 24h and the inclusive +1 is
correct. Use it at both call sites (cacheToStats and
processedStatsToClaudeCodeStats).
* fix(stats): guard day-span helper against unparseable persisted dates
A same-version stats cache can carry a structurally-valid but unparseable
firstSessionDate (e.g. "not-a-date"). That value reached inclusiveCalendarDaySpan,
where new Date(...).toISOString() throws RangeError and aborts the whole /stats
render instead of degrading. Parse the endpoints up front and fall back to 0
(the same value callers use for a missing endpoint) when either is invalid.
* fix(stats): reject malformed persisted dates instead of trusting Date.parse
Date.parse accepts far more than the shapes this pipeline persists: "2026-07",
"2026", "123" and "01/01/2026" all resolve to real dates, so a truncated or
foreign-format cache value produced a plausible-but-wrong totalDays rather than
being rejected. Require the value to start with a full ISO calendar date — the
two shapes actually written are a session.timestamp instant and a bare
dailyActivity YYYY-MM-DD key — and fall back to 0 otherwise.
* test(stats): guard the off-by-one with spans that separate the formulas
The multi-day, identical-timestamp and adjacent-midnight cases return the same
value under both the old Math.ceil(gap)+1 and the new calendar-day formula, so
they could not catch a regression. Add the canonical failing spans (1.5 and 3.5
raw days, where the old formula reported 3 and 5 instead of 2 and 4), a bare
dailyActivity date-key case, and the malformed-date rejections.
* fix(stats): reject impossible calendar dates, not just non-date shapes
The corruption guard only checked for a date-shaped prefix, so Date.parse still
normalized impossible values — 2026-02-30 parsed as March 2 and
inclusiveCalendarDaySpan('2026-02-30', '2026-03-02') returned 1 instead of the
documented 0 fallback, letting a corrupt cache date fabricate the /stats
denominator. Validate the spelled year/month/day against the real calendar
(leap years included) before trusting the parse. Regression covers rollover,
month/day bounds, and Feb 29 in leap vs non-leap years.
* fix(stats): accept only the two persisted timestamp shapes
The prefix check also matched a space-delimited value such as
'2026-07-13 23:30:00', which Date.parse then read as a host-local
timestamp. That is neither a bare dailyActivity date key nor an ISO
instant emitted by the pipeline, so the computed span depended on the
machine's timezone — inclusiveCalendarDaySpan('2026-07-13 23:30:00',
'2026-07-14T00:30:00.000Z') returned 2 under UTC and 1 under
America/Los_Angeles instead of the documented 0 fallback for corrupt input.
Anchor the pattern at both ends and require the zone designator on the
instant form.
* fix(stats): select session endpoints chronologically and reject bad clocks
Both aggregation paths picked firstSessionDate/lastSessionDate by string
comparison, but offset-qualified instants do not sort that way:
2026-07-13T23:30:00-10:00 is later than 2026-07-14T00:00:00+14:00 while
sorting earlier, so it was chosen as the first endpoint and the span came
out 0 for two sessions that occupy different UTC days. Compare parsed
epochs, falling back to string order only for values that do not parse so
selection stays total.
The persisted-date guard also let out-of-range clock components through.
Date.parse normalizes 2026-07-13T24:00:00.000Z to midnight on July 14, so
a corrupt timestamp fabricated a day of span instead of taking the
documented 0 fallback. Validate hours/minutes/seconds and the offset the
same way the calendar components are already validated.
* fix(stats): order the cached first session chronologically too
The cache writer is the companion to the endpoint selection this PR fixed,
and it had the same lexical comparison. Offset-qualified timestamps do not
sort by the instant they denote, so merging 2026-07-14T00:00:00+14:00 (UTC
July 13) with 2026-07-13T23:30:00-10:00 (UTC July 14) stored the later one
as the cache's first session. A later cached /stats run has no session list
left to correct that, so it reports one total day for activity spanning two
UTC dates.
The persisted-date helpers move to statsCache.ts and are re-exported from
stats.ts: the cache writer needs them, and stats.ts already depends on that
module, so importing the other way would be a cycle.
Also assert the exact two-day span in the offset test instead of merely a
positive result, which a regression to 1 would have passed.
* fix(stats): heal a corrupt persisted firstSessionDate seed
Both first-session selection loops seed firstSessionDate from the persisted
cache, which can hold a corrupt value. A garbage seed that sorts lexically
before every real timestamp (e.g. "1") is never displaced by
comparePersistedDates, so the corruption -- and the wrong totalDays it drives
-- persists across every later run. Treat an unparseable seed as absent so
the first valid session date replaces it.
* fix(stats): accept the ISO spellings the ingestion path persists
parsePersistedDateMs required seconds and a colon in the numeric offset, so it
returned NaN for valid instants that processSessionFiles stores verbatim --
`2026-07-13T12:00Z` and `...+0000`. The session was still counted in
dailyActivity but the span came out 0, so /stats reported zero total days for
real multi-day activity. Make the seconds group and the offset colon optional
while keeping the zone requirement and range/calendar validation. Also use the
explicit leap rule instead of Date.UTC(year, ...), which maps years 0-99 to
1900-1999 and judged year 0000 inconsistently with the Date.parse result.
- Rename the Sponsors section and nav link to Partners
- Add AI/ML API and Novita AI to the partners table with local logo
assets; AI/ML API ships light/dark SVG variants behind a <picture>
element so the wordmark stays readable on both GitHub themes
- Replace the green SVG header wordmark with the orange pixel-art
OPENCLAUDE wordmark PNG
Co-authored-by: OpenClaude <openclaude@gitlawb.com>
* test(user): restore real modules from a pre-mock snapshot
This suite's teardown re-installed its own mocks instead of undoing them.
`import * as realExeca from 'execa'` is a live namespace binding, and
mock.module repoints it. By the time afterEach ran, `realExeca` WAS the
mock, so `mock.module('execa', () => realExeca)` reinstalled the stub -- and
mock.module lasts for the life of the process, so every test file loaded
afterwards got it.
The stub returns { exitCode, stdout } with no stderr, which is what made it
visible elsewhere: collectTaskReportGitMetadata does
`inside.stderr.trim()` and threw "undefined is not an object". The two
task-report CLI handler tests and the two /ads command tests failed on any
run where this file happened to be ordered before them, which is why the
same four went red on unrelated PRs and intermittently on main itself
(6bef0e16, 0ff1d1cb).
Snapshot each module surface into a plain object at load, before any mock is
installed, and restore through the snapshots. The stub definitions build on
the snapshot too -- a bare `import('execa')` inside the helper resolves to
whatever mock is current, so each stub was being layered on the last.
* chore(test): drop stray VCR fixture from mock-teardown fix
The fixtures/734ad7.json capture was accidentally recorded while running
the SDK suite locally and is unrelated to the mock-teardown repair. It
replays an empty response for the 'test undefined reason' lifecycle path
(hiding regressions) and embeds an environment-dependent agent-listing
reminder. Remove it to keep this PR focused.
* test: harden user mock teardown and stabilize interrupt lifecycle
Use win32 for the analytics platform mock (env.Platform contract) and
include stderr on the async execa stub so a future leak fails soft.
Rewrite the undefined-reason interrupt lifecycle assertion onto the
deterministic queryLoop + stop-hook path so it no longer depends on an
empty VCR fixture or SDK model-startup races after fixture removal.
* test(sdk): drop duplicate stop-hook default-abort lifecycle clone
The rewritten "undefined reason" interrupt test was an exact copy of the
existing Stop-hook default-abort regression in the same file. Keep the
single deterministic coverage path.
---------
Co-authored-by: jatmn <the@jat.mn>
* fix(commands): insert slash-command argument text literally, not as regex refs
substituteArguments filled $ARGUMENTS and named-$foo placeholders by passing
the user's argument string as the replacement operand of String.replace/
replaceAll. When the replacement is a string, JS interprets $-sequences in it
($$, $&, $`, $', $n), so argument text containing those was mangled: `$100$$`
lost a dollar, `$&` re-inserted the matched placeholder, etc. The indexed
($ARGUMENTS[n], $n) paths right beside these already use function replacers and
were unaffected. Switch the two string-replacement sites to function replacers
so the value is inserted verbatim.
* fix(commands): stop later placeholder passes from rewriting inserted values
Each substitution pass wrote into the same content the following passes then
re-scanned, so an argument value that legitimately contained a placeholder token
was substituted twice: with args '"$1" second', a $name (or $ARGUMENTS[0]) whose
value is the literal $1 came back as 'second' instead. Park each substituted
value behind a salted, NUL-delimited slot token and swap the real values back in
after every pass has run, so a value is only ever inserted, never interpreted.
* fix(commands): write the slot-token NUL delimiter as an escape, not a raw byte
The slot template and restoration regexp contained literal 0x00 bytes, which
makes Git classify the whole tracked file as binary — git diff can only say the
file differs and GitHub cannot render or review changes to it. Spell the
delimiter as \x00 escapes; the evaluated strings are unchanged, so the tokens
remain NUL-delimited at runtime while the source stays text.
* fix(memory): match nested directories on path boundaries, not name prefixes
getDirectoriesToProcess documents nestedDirs as "Directories between CWD and
targetPath", but tested containment with currentDir.startsWith(originalCwd).
A sibling whose name merely begins with the CWD's name satisfies that: with cwd
/work/myapp, reading /work/myapp-backend/src/a.ts collected /work/myapp-backend
and its subdirectory, so their CLAUDE.md loaded as Project memory. Renaming the
directory to /work/backend loads nothing — same layout and same permission
grant, different behavior purely because of how the name is spelled.
Route the check through pathInWorkingPath, the helper already used for path
containment elsewhere in this file's module graph, so the comparison happens on
path boundaries.
* test(memory): build nested-dir fixtures with path helpers for Windows
getDirectoriesToProcess resolves its inputs, so on Windows the outputs carry a
drive letter and backslashes; hardcoded POSIX fixture strings would never match
and the walk-to-CWD comparison could not terminate. Construct every fixture and
expectation with resolve/join so they follow the platform.
* fix(memory): use native case semantics for the nested-directory check
pathInWorkingPath case-folds both operands on every platform so that
case-variant spellings cannot slip past a permission check. That is the
wrong direction for memory traversal: on a case-sensitive filesystem
/work/MyApp and /work/myapp are two unrelated projects, and folding them
together made getDirectoriesToProcess('/work/myapp/src/a.ts', '/work/MyApp')
return the /work/myapp ancestors, loading the other project's
CLAUDE.md/AGENTS.md as nested project memory.
Use a local boundary check built on relative(), which keeps the platform's
native case semantics while still comparing on path boundaries rather than
string prefixes.
* fix(memory): compare the relative path on segment boundaries
The containment check used rel.startsWith('..'), which is the same
string-prefix mistake this PR set out to fix: a directory legitimately named
'..hello' yields the relative path '..hello', so a genuinely nested
directory was dropped and its CLAUDE.md never loaded.
Match '..' exactly or followed by a separator instead, and add a regression
for the dotted-name case.
Also skip the case-variant assertion on Windows: path comparison there is
case-insensitive, so /work/MyApp and /work/myapp really are the same
directory and treating them as nested is correct.
* fix(memory): keep directory containment case-faithful on Windows
path.win32.relative() compares components case-insensitively, so it
returns "src" for C:\\work\\MyApp -> C:\\work\\myapp\\src. NTFS supports
per-directory case sensitivity, so those can be distinct project trees,
and the containment check would load the other project's CLAUDE.md and
rules as nested memory for a session rooted at the first.
Rebuild the child from the parent and compare exactly: the boundary logic
relative() provides is kept, the lexical case distinction is restored. The
path implementation is injectable so the Windows semantics are covered on
every host rather than skipped outside Windows.
On Windows, writing a file directly at a drive root (e.g. writing
content to D:\foo via the Write tool) fails with EPERM: dirname('D:\foo')
is 'D:\' itself, and mkdir('D:\', { recursive: true }) always fails —
the kernel cannot create a root that already exists, and libuv maps
that to EPERM rather than EEXIST. The error propagated to the Write
tool as a spurious 'permission denied' on mkdir D:\.
Treat EPERM like EACCES in NodeFsOperations.mkdir/mkdirSync: swallow it
only when the directory already exists. Genuine permission failures
still propagate — the existsSync guard limits the no-op to cases where
there was nothing to create, and a present-but-unwritable directory
still fails at the subsequent file write.
The regression tests use spyOn + mock.restore() rather than
mock.module(): module mocks are process-global and leak across test
files in the same bun process (neither mock.restore() nor
re-registering the real module clears them in bun 1.3.x).
* fix(bridge): truncate derived session titles on grapheme boundaries
deriveTitle cut the title with flat.slice(0, TITLE_MAX_LEN - 1), a
UTF-16 code-unit slice. When an emoji or astral-plane character in the
user's first message straddles the cut, the slice keeps its high
surrogate and drops the low one, leaving a lone surrogate. The title is
PATCHed to the claude.ai backend and UTF-8-serialized, so that lone
surrogate is transmitted as the U+FFFD replacement character and the
remote/mobile session list shows mojibake.
Route through truncateToWidth, the grapheme-safe helper deriveSessionTitle
in bridgeMain.ts already uses for the identical purpose.
* test(bridge): drop lookbehind from the lone-surrogate check
The source regex in initReplBridge.ts avoids lookbehinds to stay within
YARR/JSC (the engine Bun uses); mirror that in the test by matching an
unpaired low surrogate with a leading non-high-surrogate alternation
instead of a negative lookbehind.
* fix(bridge): bound the derived title in characters, not display width
TITLE_MAX_LEN caps the session-title API field in characters, but
truncateToWidth measures terminal columns. That charged 2 columns per wide
glyph, so 30 CJK characters — well inside the 50-char field — were cut to
24 plus an ellipsis, while zero-width graphemes cost 0 columns and removed
the cap entirely (100,000 code units passed through as a title).
Walk graphemes and accumulate against the code-unit length instead. That
keeps the surrogate pair and any combining marks intact, which is what the
original raw slice broke, while still enforcing the documented character
bound.
settings.outputStyle is a free-form z.string() with no enum, and the style
maps are plain object literals, so the name reached a bare index and
resolved inherited Object.prototype members. The trailing '?? null' does not
neutralize that — the Object constructor is not nullish — so the documented
'unknown style falls back to the default' contract was skipped and a
function was handed on as if it were a config.
With outputStyle set to 'constructor' the model's system prompt gained
# Output Style: Object
undefined
and the output_style attachment announced 'Object output style is active'.
getSimpleIntroSection also branches on the config being non-null, so it told
the model to follow an output style that does not exist.
Route both lookups through a shared resolveOutputStyle helper gated on
Object.hasOwn.
* feat(onboarding): first-run experience for third-party providers
Two gates in showSetupScreens were keyed on usesAnthropicAccountFlow(),
so users of any non-Anthropic provider skipped onboarding entirely:
- Onboarding (theme + security notes) now runs for all providers. The
component already drops its preflight/OAuth steps when Anthropic auth
is not enabled, so third-party users get theme -> security notes ->
terminal setup with no login screens.
- The trust dialog now runs for all providers. Workspace trust is
orthogonal to the API provider — an untrusted repo is exactly as
dangerous over a local model as over Anthropic. (The block comment
even said "always show"; the inner gate contradicted it.)
Also: the login-method screen now detects OPENAI_BASE_URL+OPENAI_MODEL
in the environment and offers "Use current environment configuration"
as the first (default) option. Selecting it saves and activates a
provider profile via addProviderProfile — env vars alone do NOT
activate the OpenAI route (resolveActiveRouteIdFromEnv requires
CLAUDE_CODE_USE_OPENAI or a saved profile), a gap previously masked in
manual testing by a stray legacy .openclaude-profile.json in the cwd.
Verified live (tmux, scratch config dir, mock OpenAI server):
fresh 3P first run walks theme -> security -> trust -> REPL; env
option saves "Local OpenAI-compatible", the session completes a real
turn against the env endpoint, and the profile persists across
relaunch. Second launch shows no onboarding.
Co-Authored-By: OpenClaude <openclaude@gitlawb.com>
* fix(onboarding): address review — testable gating seam + env-profile dedup
- The first-run screen decisions move into src/utils/setupScreenGates.ts,
a provider-free importable seam (showSetupScreens' import chain cannot
be loaded under bun test — the same constraint and pattern as the
dev-channels registration seam). Behavioral tests cover the gate matrix
(fresh install, completed install, theme-missing re-show, trust
independence, claubbit skip); the bugfixes.test.ts checks now assert
the wiring (both dialogs consult the seam, no provider gate at the
call sites) instead of only regexing for the removed string.
- The "use current environment configuration" onboarding option dedupes:
an existing profile matching the env base URL + model is re-activated
via setActiveProviderProfile (which also re-applies profile env and
syncs the startup profile file) instead of appending a near-identical
profile on every pass through the flow.
Co-Authored-By: OpenClaude <openclaude@gitlawb.com>
* fix(onboarding): refresh reused profile credentials + accurate env var label
- The reuse branch now refreshes the stored credential from the
environment before activating: a rotated OPENAI_API_KEY would otherwise
leave the flow running on the profile's stale key. Falls back to the
existing key when the env no longer carries one, so a working
credential is never blanked. Status text says "Activated" for reuse and
keeps "Saved" for a newly created profile.
- The environment option's label names the variable the value actually
came from (OPENAI_BASE_URL vs OPENAI_API_BASE) instead of hardcoding
the former, so troubleshooting points at a variable that is really set.
Co-Authored-By: OpenClaude <openclaude@gitlawb.com>
* fix(onboarding): preserve profile fields and verify the credential refresh
Follow-up on the reuse path added last round:
- updateProviderProfile REPLACES the profile (toProfile builds a fresh
object rather than merging), so passing only name/baseUrl/model/apiKey
silently dropped any configured apiFormat, azureStyle, authHeader,
authScheme, authHeaderValue, customHeaders, or maxContextLength. Spread
the existing profile and override only the refreshed credential.
- A null return from updateProviderProfile (env values failing profile
validation) no longer falls through to activation: reporting
"Activated" while still running on the stale key is worse than routing
the user to guided setup, which is what the create path already does.
Co-Authored-By: OpenClaude <openclaude@gitlawb.com>
* fix(onboarding): redact credential-bearing endpoints before display
OPENAI_BASE_URL / OPENAI_API_BASE are credential-bearing in the wild
(userinfo like https://user:pass@host/v1, or ?token=/?api_key= query
params), and both the option label and the completion status message
rendered the raw value straight into terminal scrollback.
The derivation moves into src/utils/envProviderOption.ts, which owns the
disclosure boundary explicitly: `displayBaseUrl` is passed through the
codebase's existing redactUrlForDisplay and is the only form the UI may
render, while the raw `baseUrl` is retained for profile creation and
activation so the saved profile still authenticates. Both rendered sites
now use the redacted value.
Regression coverage: envProviderOption.test.ts asserts userinfo and
sensitive query params never reach displayBaseUrl (including via the
non-URL fallback path) while baseUrl stays intact, plus var-name and
availability cases; a wiring guard in bugfixes.test.ts fails if either
rendered site is ever pointed back at the raw endpoint.
Co-Authored-By: OpenClaude <openclaude@gitlawb.com>
---------
Co-authored-by: OpenClaude <openclaude@gitlawb.com>
* feat(perf): tier1 token optimization — universal tool compression, doom loop detection, configurable compaction
- Extend compressToolHistory to Anthropic-native transports (firstParty/
bedrock/vertex/native-GitHub), gated to runs where prompt caching is
inactive: rewriting old messages as they cross tier boundaries diverges
the request prefix every call, so cached native sessions keep relying on
the cache-aware microCompact instead. Shim-routed traffic (OpenAI-compatible
env providers, per-agent providerOverride, Codex) still compresses at its
own layer, where the local fast-path opt-out applies. compressToolHistory
is now idempotent (skips its own stub/truncation markers) so layered call
sites can never re-mangle output.
- Add doom loop detection: blocks after 3 consecutive identical tool calls
(same name + input signature). State is keyed per agent (main thread and
each subagent separately) so concurrent subagents neither trip nor reset
each other's counters. Resets at the start of each agent's query turn.
- Add configurable compactTailTurns in GlobalConfig, wired into autoCompact's
relevance pruning (default: 3, clamped to positive) and exposed in the
/config UI next to the other compaction settings.
Co-Authored-By: OpenClaude <openclaude@gitlawb.com>
* fix(perf): address review — tier-aware idempotency, full-input signatures
Post-rebase reconciliation with #1958's compressToolHistory rework (the
guard's extractText call no longer even typechecked against the new
signature) plus the CodeRabbit findings:
- Tier-aware idempotency replaces the blanket already-compressed skip,
which permanently blocked mid→old upgrades: stubs stay terminal, and a
truncated block left alone while mid-tier still upgrades to a stub when
later exchanges age it into the old tier. The upgraded stub's
omitted-chars count is recovered from the truncation marker (visible
length + marker's omitted count = exact pre-truncation length), so it
reports the tool's real output size — asserted equal to what a fresh
single-pass stub would have produced. Regression tests cover the
aging upgrade, recovered length, and same-input no-op.
- computeSignature hashes the FULL serialized input (sha-256, fixed-size
stored signature) instead of comparing a 2KB prefix, which treated
distinct calls sharing a long prefix (e.g. Write calls differing only
in trailing content) as identical — a false-positive block on
legitimate work. Regression test included.
- DEFAULT_COMPACT_TAIL_TURNS shared constant replaces the `3` duplicated
across autoCompact, pruneByRelevance's default, and the /config UI.
- Doom-loop block path: added a tengu_doom_loop_blocked analytics event
(false-positive rates become observable for threshold tuning) and the
nudge now tells the model a deliberate repeat is fine once something
observable has changed. The blocked yield's message shape mirrors the
sibling pre-execution error paths, preserving tool_use/tool_result
pairing.
Co-Authored-By: OpenClaude <openclaude@gitlawb.com>
* fix(perf): normalize compactTailTurns everywhere + native-routing coverage
Second CodeRabbit round:
- normalizeCompactTailTurns (relevancePruning.ts, next to the shared
default) is now the single rule for the hand-editable config: finite
values >= 1 floor to integers, everything else falls back to the
default. The /config UI displays AND persists through it, so the picker
shows exactly what autoCompact preserves (a hand-edited 2.5 no longer
displays as 2.5 while running as 2; 0/negatives no longer display as
selected while running as 3). Also fixes a real edge in the previous
inline clamp: 0.5 passed the `> 0` check and floored to a ZERO-message
tail, pruning everything. Unit tests cover the boundary matrix.
- shouldCompressNativeToolHistory extracted from queryModel and exported:
the request-mutating routing decision is now parameterized-tested
across all four native transports (first-party, Bedrock, Vertex,
GitHub-native-Anthropic) x caching on/off, the providerOverride
exclusion, and non-native providers — queryModel itself needs a live
client, so the predicate is the honest testable seam.
Co-Authored-By: OpenClaude <openclaude@gitlawb.com>
* fix(perf): guard custom first-party endpoints + strict config coercion
Third CodeRabbit round:
- shouldCompressNativeToolHistory now requires an Anthropic first-party
base URL before accepting the firstParty provider as native, mirroring
the exact guard getPromptCachingEnabled uses. Without it, a custom
ANTHROPIC_BASE_URL (proxy / compatible endpoint) reported firstParty
with caching disabled and had every request's messages compressed —
an assumption we cannot make about arbitrary endpoints. Test added for
the custom-base-URL exclusion.
- normalizeCompactTailTurns only coerces numbers (persisted config) and
strings (the /config picker channel); other hand-edited shapes no
longer smuggle a tiny tail through Number() coercion (true → 1,
[2] → 2) and fall back to the default instead. Boundary tests added.
Co-Authored-By: OpenClaude <openclaude@gitlawb.com>
---------
Co-authored-by: OpenClaude <openclaude@gitlawb.com>
* feat(codex): add GPT-5.6 family models and fix saved-model rehydration
Add the GPT-5.6 family (gpt-5.6-sol, gpt-5.6-terra, gpt-5.6-luna) to the
Codex OAuth provider: alias map with default reasoning efforts, /model
picker options, display names, and Codex-route context metadata. Bare
`gpt-5.6` resolves to the flagship Sol tier at parse time (Codex CLI
convention) — matched on the base name so a ?reasoning=/?thinking= query
suffix cannot defeat the rewrite — keeping context sizing and display on
real descriptor metadata.
Context windows reconcile with the #1961 direct-OpenAI routing: the
gpt.ts descriptors pin the ~272k effective Codex input cap (issue #1118
precedent; the Codex base URL resolves to a catalog-less route that
reads descriptors), while the openai vendor catalog keeps the true
1.05M window for direct api.openai.com /v1/responses traffic. The
gpt-5.6 alias-default reasoning effort is likewise Codex-transport-only:
OPENAI_API_BASE gateways do not inherit first-party effort metadata
(explicit /effort and ?reasoning= picks still flow everywhere).
Fix startup rehydration for Codex profiles: profileSupportsModel is now
authoritative for Codex-backend profiles — it accepts every Codex alias
and Codex-eligible gpt-5.x free-text pick (shared isCodexEligibleGpt5Model
predicate), so a /model choice (e.g. gpt-5.6-terra) survives restart
instead of silently reverting to codexplan/gpt-5.5. A trailing [1m] tag
is normalized off before matching, so tagged picks stick too. Foreign
leftovers (kimi-k2.6) and API-only tiers the backend does not serve
(gpt-5-mini/-nano) still fall back to the profile default instead of
400ing.
Also: generalize the picker's custom-model recovery to keep curated
labels for all Codex models across provider switches ([1m]-tolerant,
single lookup), and add GPT-5.6 cases to the display-name maps.
Co-Authored-By: OpenClaude <openclaude@gitlawb.com>
* fix(codex): address CodeRabbit review — [1m] tag parsing + coverage
- parseModelDescriptor now strips a trailing [1m] context tag (whole-string
or base-id position) before parsing: the tag is a client-side 1M opt-in,
never a wire model id, so tagged aliases keep their mapping and effort
defaults and resolvedModel never leaks the bracket suffix to the backend
(pre-existing gap for e.g. gpt-5.5[1m], now fixed at the parse layer).
- The bare-gpt-5.6 rewrite keeps a [1m] tag TRAILING after a preserved
query (gpt-5.6?reasoning=medium[1m] → gpt-5.6-sol?reasoning=medium[1m]);
the previously emitted tag-before-query form broke the request-time
base-model split. End-to-end regression tests cover parse + request.
- New coverage per review: alias effort defaults are asserted suppressed on
a custom OpenAI-compatible gateway (non-Codex transport) while explicit
?reasoning= overrides flow; picker-recovery tests assert a persisted
gpt-5.6-terra[1m] under a non-Codex provider keeps its exact tagged value
with the curated label/description instead of a "Custom model" entry.
Co-Authored-By: OpenClaude <openclaude@gitlawb.com>
---------
Co-authored-by: OpenClaude <openclaude@gitlawb.com>
* feat(install): enforce and guard the zero-warning npm install contract
`npm install -g @gitlawb/openclaude` is verified zero-warning today, but
nothing kept it that way: the runtime deps were caret ranges resolved
fresh on every user install (the published tarball ships no lockfile),
no CI step ever installed the package, and registry-side drift (a
transitive dep deprecated after we ship) is invisible to file-based CI.
Static contract (fast, offline, every PR via `bun run build`):
- Pin the 3 runtime deps to exact versions so the verified resolution IS
the shipped resolution.
- New validators in scripts/externalsValidation.ts (unit-tested):
dependencies must equal RUNTIME_DEPENDENCY_CONTRACT exactly (no ranges,
no unreviewed additions), no consumer-run install hooks or funding
field, engines.node pinned. Wired into validate-externals.ts.
Runtime verification (scripts/verify-clean-install.ts, `install:verify`):
- Tarball mode (release gate) and published mode (registry watch), each
running cold-install and upgrade-over-previous scenarios in throwaway
prefixes with a cold cache and normalized env/flags.
- Strict output whitelist (summary lines only) with network failures
retried and reported as infra (exit 2), never as a hygiene verdict.
- Structural authority over the installed tree: any package declaring
install scripts fails, the installed manifest must match the static
contract, tarball payload/size asserted.
- Boot must be silent: --version prints the exact packed version;
--help (which, unlike the --version zero-import fast path, loads the
real bundle) must exit 0 with empty stderr.
CI: release publishes only after the verify passes on Node 22 (npm 10,
the supported floor — warning phrasing and EBADENGINE behavior differ
from npm 11) and Node 24, plus a final gate on the publishing machine
replacing `npm pack --dry-run`. A daily install-hygiene workflow
re-verifies the published @latest on {ubuntu, macos, windows} x
{Node 22, 24} — the only defense against post-release registry drift,
and the OS matrix covers the per-platform @vscode/ripgrep packages.
Found-by-the-guard fix: a fresh machine printed "Warning: ignoring saved
provider profile. OPENGATEWAY_API_KEY is required..." on every command
(even --help) because the injected fresh-install Opengateway default
fails validation without a key (#1651 chose ignore+warn). The default
env is still ignored, but the warning now only fires for genuinely
persisted profiles; published 0.24.0 carries the old noise, so the
verify script exempts exactly that version until the next release.
Co-Authored-By: OpenClaude <openclaude@gitlawb.com>
* fix(install): address CodeRabbit review on the install-hygiene guard
- release.yml: pin install-verify to least-privilege `contents: read` and
disable credential persistence on its checkout; same persist-credentials
hardening on the install-hygiene cron checkout.
- verify-clean-install: previousPublishedVersion now follows the same
retry/infra discipline as installWithRetry — transient registry failures
retry and then exit 2 (infra) instead of silently skipping the
upgrade-scenario coverage; a clean not-published answer still skips.
- providerProfile: the fresh-install warning suppression now keys on
explicit provenance (persisted profile resolved once in
applyStartupEnvFromProfile) instead of sniffing the
DEFAULT_STARTUP_PROVIDER_ENV_VAR marker, which a persisted profile's
env can inherit from a parent CLI process; regression test covers the
marker-collision case.
Co-Authored-By: OpenClaude <openclaude@gitlawb.com>
* test(install): cover previousPublishedVersion retry/skip/infra branches
CodeRabbit follow-up: the branches deciding whether the upgrade-install
scenario runs, skips, or aborts as infra were untested. Extract the loop
as resolvePreviousPublishedVersion with injected effects (runView,
onRetry, onInfraFailure) per the repo's dependency-injection testing
convention, guard main() behind import.meta.main so the test import does
not launch a real verification, and add regression tests: first-try
success, transient-infra retry then success, clean E404 → null skip
without retries, persistent infra → onInfraFailure (exit 2 in the real
wiring), and unparseable version output → null.
Co-Authored-By: OpenClaude <openclaude@gitlawb.com>
---------
Co-authored-by: OpenClaude <openclaude@gitlawb.com>
jatmn
0xfandomandGitHub
Xiang HanandGitHub
SuyunandGitHub