Commit graph

11 commits

Author SHA1 Message Date
Chummy
03c3ded5ef fix(discord): enforce 2000-character message chunks
Discord rejects message content longer than 2000 characters with 50035 Invalid Form Body.

This change updates Discord message chunking to:
- enforce a 2000-character hard limit
- split on UTF-8 character boundaries (no byte-boundary slicing)
- keep newline/space-aware split behavior
- add regression tests for multibyte content and chunk size guarantees

Fixes #235
2026-02-16 10:52:54 +08:00
jereanon
2f78c5e1b7 feat(channel): add typing indicator for Discord
Spawns a repeating task that fires the Discord typing endpoint every
8 seconds while the LLM processes a response. Adds start_typing and
stop_typing to the Channel trait with default no-op impls so other
channels can opt in later.
2026-02-15 15:34:10 -07:00
Argenis
a04716d86c
fix: split Discord messages over 4000 characters
Fixes #223
2026-02-15 16:35:10 -05:00
Nakano Kenji
021d03eb0b
fix(discord): add DIRECT_MESSAGES intent to enable DM support
* fix(discord): add DIRECT_MESSAGES intent to enable DM support

* fix(discord): allow DMs to bypass guild_id filter

---------

Co-authored-by: Moeblack <moeblack@example.com>
2026-02-15 15:00:11 -05:00
Argenis
a5241f34ea
fix(discord): track gateway sequence number and handle reconnect opcodes (#159)
* feat(providers): add provider-aware API key resolution

- Add resolve_api_key() function that checks provider-specific env vars first
- For Anthropic, checks ANTHROPIC_OAUTH_TOKEN before ANTHROPIC_API_KEY
- Falls back to generic ZEROCLAW_API_KEY and API_KEY env vars
- Update create_provider() to use resolved_key instead of raw api_key
- Trim and filter empty strings from input keys

This enables setup-token support for Anthropic by checking ANTHROPIC_OAUTH_TOKEN
before ANTHROPIC_API_KEY when resolving credentials.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat(providers): add Anthropic setup-token support

- Rename api_key field to credential for clarity
- Add is_setup_token() method to detect setup-token format (sk-ant-oat01-)
- Add input trimming and empty string filtering
- Use Bearer auth for setup-tokens, x-api-key for regular API keys
- Update error message to mention both ANTHROPIC_API_KEY and ANTHROPIC_OAUTH_TOKEN
- Add test for setup-token detection
- Add test for whitespace trimming in new()

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: skip serialization of config_path and workspace_dir to prevent save() failures

The config_path and workspace_dir fields are computed paths that should not be
serialized to the config file. When loading from TOML, these fields would be
deserialized as empty paths (or stale paths), causing save() to fail with
"Failed to write config file".

Fixes #112

Changes:
- Add #[serde(skip)] to config_path and workspace_dir fields
- Set computed paths in load_or_init() after deserializing from TOML

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(discord): track gateway sequence number and handle reconnect opcodes

Three Discord Gateway issues fixed:

1. **Heartbeat sent `null` sequence** — Per Discord docs, the Gateway may
   disconnect bots that don't include the last sequence number in heartbeats.
   Now tracked via `sequence: i64` and included in every heartbeat.

2. **Dispatch sequence ignored** — The `s` field from dispatch events was
   never stored. Now extracted and tracked from every event.

3. **Opcodes 7/9 silently ignored** — Reconnect (op 7) and Invalid Session
   (op 9) caused the bot to hang on a dead connection. Now breaks the event
   loop so the daemon supervisor can restart the channel cleanly.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(memory): use SHA-256 for embedding cache keys instead of DefaultHasher

- Replace DefaultHasher with SHA-256 for deterministic cache keys
- DefaultHasher is explicitly documented as unstable across Rust versions
- Truncate SHA-256 to 8 bytes (16 hex chars) to match previous format
- Ensures embedding cache is deterministic across Rust compiler versions

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-15 10:25:38 -05:00
Argenis
ef00cc9a66
fix(channels): check response status in send() for Telegram, Slack, and Discord
Reliability fix: check HTTP response status in channel send methods
2026-02-15 09:48:58 -05:00
argenis de la rosa
3d91c40970 refactor: simplify CLI commands and update architecture docs
1. Simplify CLI:
   - Make 'onboard' quick setup default (remove --quick)
   - Add --interactive flag for full wizard
   - Make 'status' detailed by default (remove --verbose)
   - Remove 'tools list/test' and 'integrations list' commands
   - Add 'channel doctor' command
2. Update Docs:
   - Update architecture.svg with Channel allowlists, Browser allowlist, and latest stats
   - Update README.md with new command usage and browser/channel config details
3. Polish:
   - Browser tool integration
   - Channel allowlist logic (empty = deny all)
2026-02-14 05:17:16 -05:00
argenis de la rosa
bc31e4389b style: cargo fmt — fix all formatting for CI
Ran cargo fmt across entire codebase to pass CI's cargo fmt --check.
No logic changes, only whitespace/formatting.
2026-02-13 16:03:50 -05:00
argenis de la rosa
a5887ad2dc docs+tests: architecture diagram, security docs, 75 new edge-case tests
README:
- Add ASCII architecture flow diagram showing all layers
- Add Security Architecture section (Layer 1: Channel Auth,
  Layer 2: Rate Limiting, Layer 3: Tool Sandbox)
- Update test count to 629

New edge-case tests (75 new):
- SecurityPolicy: command injection (semicolon, backtick, dollar-paren,
  env prefix, newline), path traversal (encoded dots, double-dot in
  filename, null byte, symlink, tilde-ssh, /var/run), rate limiter
  boundaries (exactly-at, zero, high), autonomy+command combos,
  from_config fresh tracker
- Discord: exact match not substring, empty user ID, wildcard+specific,
  case sensitivity, base64 edge cases
- Slack: exact match, empty user ID, case sensitivity, wildcard combo
- Telegram: exact match, empty string, case sensitivity, wildcard combo
- Gateway: first-match-wins, empty value, colon in value, different
  headers, empty request, newline-only request
- Config schema: backward compat (Discord/Slack without allowed_users),
  TOML roundtrip, webhook secret presence/absence

629 tests passing, 0 clippy warnings
2026-02-13 16:00:15 -05:00
argenis de la rosa
542bb80743 security: harden architecture against Moltbot security model
- Discord: add allowed_users field + sender validation in listen()
- Slack: add allowed_users field + sender validation in listen()
- Webhook: add X-Webhook-Secret header auth (401 on mismatch)
- SecurityPolicy: add ActionTracker with sliding-window rate limiting
  - record_action() enforces max_actions_per_hour
  - is_rate_limited() checks without recording
- Gateway: print auth status on startup (ENABLED/DISABLED)
- 22 new tests (Discord/Slack allowlists, gateway header extraction,
  rate limiter: starts at zero, records, allows within limit,
  blocks over limit, clone independence)
- 554 tests passing, 0 clippy warnings
2026-02-13 15:31:21 -05:00
argenis de la rosa
05cb353f7f feat: initial release — ZeroClaw v0.1.0
- 22 AI providers (OpenRouter, Anthropic, OpenAI, Mistral, etc.)
- 7 channels (CLI, Telegram, Discord, Slack, iMessage, Matrix, Webhook)
- 5-step onboarding wizard with Project Context personalization
- OpenClaw-aligned system prompt (SOUL.md, IDENTITY.md, USER.md, AGENTS.md, etc.)
- SQLite memory backend with auto-save
- Skills system with on-demand loading
- Security: autonomy levels, command allowlists, cost limits
- 532 tests passing, 0 clippy warnings
2026-02-13 12:19:14 -05:00