Commit graph

465 commits

Author SHA1 Message Date
Chummy
dea02a6915
Merge pull request #318 from zeroclaw-labs/fix/issue-309-composio-v3-endpoint
fix: update Composio API endpoint from v2 to v3
2026-02-16 22:26:40 +08:00
Will Sarg
b61d33aa1c
feat(dev): add local dockerized ci workflow (#342) 2026-02-16 09:10:39 -05:00
Chummy
8bcb5efa8a fix(ci): align reliable provider tests with ChatResponse 2026-02-16 22:06:40 +08:00
Chummy
f2c73bacf8
Merge pull request #343 from zeroclaw-labs/chore-codeowner-route-ci-docs
chore(codeowners): route ci/docs surfaces to @chumyin
2026-02-16 22:00:57 +08:00
Chummy
1c3f4ec804
`chore(codeowners): route ci/docs surfaces to @chumyin
add route ci/docs surfaces to @chumyin to view directly.
2026-02-16 21:59:38 +08:00
stawky
9a5db46cf7 feat(providers): model failover chain + API key rotation
- Add model_fallbacks and api_keys to ReliabilityConfig
- Implement per-model fallback chain in ReliableProvider
- Add API key rotation on auth failures (401/403)
- Add retry-after header parsing and exponential backoff
- Integrate failover into chat_with_system and chat_with_history
- 20 unit tests covering failover, rotation, and retry logic
2026-02-16 21:59:35 +08:00
Chummy
ef41f2ab10 chore(fmt): format composio conflict-resolution tests 2026-02-16 21:54:19 +08:00
Chummy
fa9cdabbcb
Merge pull request #340 from chumyin/fix/agent-turn-provider-name-signature
fix(agent): align channel agent_turn signature with provider label
2026-02-16 21:51:17 +08:00
Chummy
593dbb3641 fix(agent): align agent_turn signature with channel provider label 2026-02-16 21:48:49 +08:00
argenis de la rosa
58693ae5a1 fix: update Composio API endpoint from v2 to v3
Fixes #309 - Composio v2 endpoint has been discontinued. Updated to v3
endpoint which is the current supported version.

Composio v2 API is no longer available, causing all Composio tool
executions to fail. This updates the base URL to use v3.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-16 21:40:22 +08:00
Chummy
fa0c77385c
Merge pull request #266 from chumyin/fix/provider-chatresponse-unification
fix(provider): complete ChatResponse integration across runtime surfaces
2026-02-16 21:21:43 +08:00
Will Sarg
b76a3879a9
fix(ci): mitigate GitHub API rate-limit failures (#334)
* fix(ci): mitigate GitHub API rate-limit failures in workflows

* fix(ci): resolve signature drift blocking Docker smoke
2026-02-16 08:05:52 -05:00
dependabot[bot]
07dc8b3927
build(deps): bump rusqlite from 0.32.1 to 0.38.0 (#315)
Bumps [rusqlite](https://github.com/rusqlite/rusqlite) from 0.32.1 to 0.38.0.
- [Release notes](https://github.com/rusqlite/rusqlite/releases)
- [Changelog](https://github.com/rusqlite/rusqlite/blob/master/Changelog.md)
- [Commits](https://github.com/rusqlite/rusqlite/compare/v0.32.1...v0.38.0)

---
updated-dependencies:
- dependency-name: rusqlite
  dependency-version: 0.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Will Sarg <12886992+willsarg@users.noreply.github.com>
2026-02-16 07:45:00 -05:00
dependabot[bot]
52f62dc24c
build(deps): bump prometheus from 0.13.4 to 0.14.0 (#316)
Bumps [prometheus](https://github.com/tikv/rust-prometheus) from 0.13.4 to 0.14.0.
- [Changelog](https://github.com/tikv/rust-prometheus/blob/master/CHANGELOG.md)
- [Commits](https://github.com/tikv/rust-prometheus/compare/v0.13.4...v0.14.0)

---
updated-dependencies:
- dependency-name: prometheus
  dependency-version: 0.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Will Sarg <12886992+willsarg@users.noreply.github.com>
2026-02-16 07:44:57 -05:00
dependabot[bot]
debe24038c
build(deps): bump toml from 0.8.23 to 1.0.1+spec-1.1.0 (#317)
Bumps [toml](https://github.com/toml-rs/toml) from 0.8.23 to 1.0.1+spec-1.1.0.
- [Commits](https://github.com/toml-rs/toml/compare/toml-v0.8.23...toml-v1.0.1)

---
updated-dependencies:
- dependency-name: toml
  dependency-version: 1.0.1+spec-1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Will Sarg <12886992+willsarg@users.noreply.github.com>
2026-02-16 07:44:54 -05:00
dependabot[bot]
444dee978a
build(deps): bump dialoguer from 0.11.0 to 0.12.0 (#319)
Bumps [dialoguer](https://github.com/console-rs/dialoguer) from 0.11.0 to 0.12.0.
- [Release notes](https://github.com/console-rs/dialoguer/releases)
- [Changelog](https://github.com/console-rs/dialoguer/blob/main/CHANGELOG-OLD.md)
- [Commits](https://github.com/console-rs/dialoguer/compare/v0.11.0...v0.12.0)

---
updated-dependencies:
- dependency-name: dialoguer
  dependency-version: 0.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Will Sarg <12886992+willsarg@users.noreply.github.com>
2026-02-16 07:44:51 -05:00
dependabot[bot]
d451af1237
build(deps): bump axum from 0.7.9 to 0.8.8 (#320)
Bumps [axum](https://github.com/tokio-rs/axum) from 0.7.9 to 0.8.8.
- [Release notes](https://github.com/tokio-rs/axum/releases)
- [Changelog](https://github.com/tokio-rs/axum/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tokio-rs/axum/compare/axum-v0.7.9...axum-v0.8.8)

---
updated-dependencies:
- dependency-name: axum
  dependency-version: 0.8.8
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Will Sarg <12886992+willsarg@users.noreply.github.com>
2026-02-16 07:44:47 -05:00
dependabot[bot]
bd137c89fb
build(deps): bump DavidAnson/markdownlint-cli2-action from 20 to 22 (#312)
Bumps [DavidAnson/markdownlint-cli2-action](https://github.com/davidanson/markdownlint-cli2-action) from 20 to 22.
- [Release notes](https://github.com/davidanson/markdownlint-cli2-action/releases)
- [Commits](https://github.com/davidanson/markdownlint-cli2-action/compare/v20...v22)

---
updated-dependencies:
- dependency-name: DavidAnson/markdownlint-cli2-action
  dependency-version: '22'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-16 07:42:22 -05:00
dependabot[bot]
1ec8b7e57a
build(deps): bump actions/github-script from 7 to 8 (#313)
Bumps [actions/github-script](https://github.com/actions/github-script) from 7 to 8.
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](https://github.com/actions/github-script/compare/v7...v8)

---
updated-dependencies:
- dependency-name: actions/github-script
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-16 07:42:10 -05:00
dependabot[bot]
8338b9c7a7
build(deps): bump actions/upload-artifact from 4 to 6 (#314)
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 6.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v4...v6)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-16 07:42:07 -05:00
Chummy
05de9003f1
Merge pull request #332 from chumyin/fix/labeler-collapse-all-prefixes
ci(labeler): collapse duplicate module labels for all prefixes
2026-02-16 20:23:21 +08:00
Chummy
5410ce4afd ci(labeler): compact duplicate module labels across all prefixes 2026-02-16 20:20:55 +08:00
Chummy
1851cf58a2
Merge pull request #328 from chumyin/fix/labeler-compact-noisy-modules
ci(labeler): dedupe noisy module labels and improve label UX
2026-02-16 20:06:08 +08:00
Chummy
140dad1f72 style(labeler): lock low-saturation ordered module palette 2026-02-16 20:01:36 +08:00
Chummy
3a25f4fa3a ci(labeler): enforce ordered gradient palette and compact module labels 2026-02-16 19:52:14 +08:00
Chummy
004fc4590f ci(labeler): compact noisy module labels for tool/provider/channel 2026-02-16 19:49:45 +08:00
Chummy
389496823d
ci(labeler): dedupe labels, add hover rules, and tune low-sat palette (#6)
* ci(labeler): dedupe scope labels and prioritize risk/size

* ci(labeler): add hover rule descriptions and refresh label palette

* style(labeler): reduce label saturation for better readability
2026-02-16 19:46:22 +08:00
chumyin
dedb465377 test(telegram): ensure newline split case exceeds max length 2026-02-16 19:36:39 +08:00
chumyin
2d6ec2fb71 fix(rebase): resolve PR #266 conflicts against latest main 2026-02-16 19:33:04 +08:00
chumyin
34306e32d8 fix(provider): complete ChatResponse integration across runtime surfaces 2026-02-16 19:18:12 +08:00
chumyin
3b4a4de457 refactor(provider): unify Provider responses with ChatResponse
- Switch Provider trait methods to return structured ChatResponse
- Map OpenAI-compatible tool_calls into shared ToolCall type
- Update reliable/router wrappers and provider tests for new interface
- Make agent loop prefer structured tool calls with text fallback parsing
- Adapt gateway replies to structured responses with safe tool-call fallback
2026-02-16 19:16:22 +08:00
Mgrsc
b3fcdad3b5
fix: use consistent <tool_call> tag in channel system prompt (#305)
The tool use protocol in channels/mod.rs was using <invoke> tags,
but the parser in agent/loop_.rs only recognizes <tool_call> tags.
This ensures consistency across all entry points.
2026-02-16 05:59:40 -05:00
Abdul Samad
4fd1408034
fix(telegram): add message splitting, timeout, and validation fixes (#246)
High-priority fixes:
- Message length validation and splitting (4096 char limit)
- Empty chat_id validation to prevent silent failures
- Health check timeout (5s) to prevent service hangs

Testing infrastructure:
- Comprehensive test suite (20+ automated tests)
- Quick smoke test script
- Test message generator
- Complete testing documentation

All changes are backward compatible.

Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-02-16 05:59:11 -05:00
mai1015
50f508766f
feat: add verbose logging and complete observability (#251) 2026-02-16 05:59:07 -05:00
Chummy
6d56a040ce
docs: strengthen collaboration governance and AGENTS engineering protocol (#263)
* docs: harden collaboration policy and review automation

* ci(docs): remove unsupported lychee --exclude-mail flag

* docs(governance): reduce automation side-effects and tighten risk controls

* docs(governance): add backlog pruning and supersede protocol

* docs(agents): codify engineering principles and risk-tier workflow

* docs(readme): add centered star history section at bottom

* docs(agents): enforce privacy-safe and neutral test wording

* docs(governance): enforce privacy-safe and neutral collaboration checks

* fix(ci): satisfy rustfmt and discord schema test fields

* docs(governance): require ZeroClaw-native identity wording

* docs(agents): add ZeroClaw identity-safe naming palette

* docs(governance): codify code naming and architecture contracts

* docs(contributing): add naming and architecture good/bad examples

* docs(pr): reduce checkbox TODOs and shift to label-first metadata

* docs(pr): remove duplicate collaboration track field

* ci(labeler): auto-derive module labels and expand provider hints

* ci(labeler): auto-apply trusted contributor on PRs and issues

* fix(ci): apply rustfmt updates from latest main

* ci(labels): flatten namespaces and add contributor tiers

* chore: drop stale rustfmt-only drift

* ci: scope Rust and docs checks by change set

* ci: exclude non-markdown docs from docs-quality targets

* ci: satisfy actionlint shellcheck output style

* ci(labels): auto-correct manual contributor tier edits

* ci(labeler): auto-correct risk label edits

* ci(labeler): auto-correct size label edits

---------

Co-authored-by: Chummy <183474434+chumyin@users.noreply.github.com>
2026-02-16 05:59:04 -05:00
Chummy
b5d9f72023
test(channels): neutralize UTF-8 truncation regression fixture (#289)
* test(channels): neutralize UTF-8 truncation regression fixture

* fix(ci): resolve fmt drift and discord test config init
2026-02-16 05:58:35 -05:00
Argenis
3231a61323
test: add comprehensive recovery tests for agent loop (#288)
Add recovery test coverage for all edge cases and failure scenarios
in the agentic loop, addressing the missing test coverage for
recovery use cases.

Tool Call Parsing Edge Cases:
- Empty tool_result tags
- Empty tool_calls arrays
- Whitespace-only tool names
- Empty string arguments

History Management:
- Trimming without system prompt
- Role ordering consistency after trim
- Only system prompt edge case

Arguments Parsing:
- Invalid JSON string fallback
- None arguments handling
- Null value handling

JSON Extraction:
- Empty input handling
- Whitespace only input
- Multiple JSON objects
- JSON arrays

Tool Call Value Parsing:
- Missing name field
- Non-OpenAI format
- Empty tool_calls array
- Missing tool_calls field fallback
- Top-level array format

Constants Validation:
- MAX_TOOL_ITERATIONS bounds (prevent runaway loops)
- MAX_HISTORY_MESSAGES bounds (prevent memory bloat)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-16 05:58:32 -05:00
Chummy
49fcc7a2c4
test: deepen and complete project-wide test coverage (#297)
* test: deepen coverage for health doctor provider and tunnels

* test: add broad trait and module re-export coverage
2026-02-16 05:58:24 -05:00
Chummy
79a6f180a8
fix(composio): migrate tool API calls to v3 with v2 fallback (#309) (#310) 2026-02-16 05:58:06 -05:00
Argenis
1530a8707d
feat: add Git operations tool for structured repository management
Implements #214 - Add git_operations tool that provides safe, parsed
git operations with JSON output and security policy integration.

Features:
- Operations: status, diff, log, branch, commit, add, checkout, stash
- Structured JSON output (parsed status, diff hunks, commit history)
- SecurityPolicy integration with autonomy-aware controls
- Command injection protection

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-16 05:53:29 -05:00
Chummy
2b04ebd2fb
fix(provider): normalize responses fallback
* fix(provider): avoid duplicate /v1 in responses endpoint

* fix(provider): derive precise responses endpoint from configured path
2026-02-16 05:26:01 -05:00
Chummy
85fc12bcf7
feat(browser): add optional rust-native backend via fantoccini
* feat(browser): add optional rust-native automation backend

* style: align channels module with stable rustfmt

* fix(browser): switch rust-native backend to fantoccini

Replace headless_chrome with fantoccini to satisfy license checks and keep browser-native optional. Adds native_webdriver_url wiring, migrates native backend session/actions to WebDriver, updates docs/config defaults, and keeps backend auto-resolution behavior intact.

* test(config): serialize env override tests with lock

Prevent flaky CI failures caused by concurrent environment variable mutation across config env-override tests.

* style: apply rustfmt 1.92 for CI parity

* chore(ci): sync lockfile and rustfmt with current main

Resolve feature table drift after rebasing onto latest main, refresh Cargo.lock for browser-native fantoccini, and apply rustfmt 1.92 formatting required by CI.
2026-02-16 05:25:27 -05:00
Chummy
9d29f30a31
fix(channels): execute tool calls in channel runtime (#302)
* fix(channels): execute tool calls in channel runtime (#302)

* chore(fmt): align repo formatting with rustfmt 1.92
2026-02-16 05:07:01 -05:00
Argenis
efabe9703f
fix: update MiniMax model names to M2.5/M2.1
Fixes #294 - Updates MiniMax model names from the old ABAB 6.5 series to
the current M2.5/M2.1 series.

- Updated wizard model selection for MiniMax provider
- Fixed DiscordConfig test cases to include new listen_to_bots field

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-16 04:21:44 -05:00
Argenis
0383a82a6f
feat(security): Add Phase 1 security features
* test: add comprehensive recovery tests for agent loop

Add recovery test coverage for all edge cases and failure scenarios
in the agentic loop, addressing the missing test coverage for
recovery use cases.

Tool Call Parsing Edge Cases:
- Empty tool_result tags
- Empty tool_calls arrays
- Whitespace-only tool names
- Empty string arguments

History Management:
- Trimming without system prompt
- Role ordering consistency after trim
- Only system prompt edge case

Arguments Parsing:
- Invalid JSON string fallback
- None arguments handling
- Null value handling

JSON Extraction:
- Empty input handling
- Whitespace only input
- Multiple JSON objects
- JSON arrays

Tool Call Value Parsing:
- Missing name field
- Non-OpenAI format
- Empty tool_calls array
- Missing tool_calls field fallback
- Top-level array format

Constants Validation:
- MAX_TOOL_ITERATIONS bounds (prevent runaway loops)
- MAX_HISTORY_MESSAGES bounds (prevent memory bloat)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat(security): Add Phase 1 security features - sandboxing, resource limits, audit logging

Phase 1 security enhancements with zero impact on the quick setup wizard:
-  Pluggable sandbox trait system (traits.rs)
-  Landlock sandbox support (Linux kernel 5.13+)
-  Firejail sandbox support (Linux user-space)
-  Bubblewrap sandbox support (Linux/macOS user namespaces)
-  Docker sandbox support (container isolation)
-  No-op fallback (application-layer security only)
-  Auto-detection logic (detect.rs)
-  Audit logging with HMAC signing support (audit.rs)
-  SecurityConfig schema (SandboxConfig, ResourceLimitsConfig, AuditConfig)
-  Feature-gated implementation (sandbox-landlock, sandbox-bubblewrap)
-  1,265 tests passing

Key design principles:
- Silent auto-detection: no new prompts in wizard
- Graceful degradation: works on all platforms
- Feature flags: zero overhead when disabled
- Pluggable architecture: swap sandbox backends via config
- Backward compatible: existing configs work unchanged

Config usage:
```toml
[security.sandbox]
enabled = false  # Explicitly disable
backend = "auto"  # auto, landlock, firejail, bubblewrap, docker, none

[security.resources]
max_memory_mb = 512
max_cpu_time_seconds = 60

[security.audit]
enabled = true
log_path = "audit.log"
sign_events = false
```

Security documentation:
- docs/sandboxing.md: Sandbox implementation strategies
- docs/resource-limits.md: Resource limit approaches
- docs/audit-logging.md: Audit logging specification
- docs/security-roadmap.md: 3-phase implementation plan
- docs/frictionless-security.md: Zero-impact wizard design
- docs/agnostic-security.md: Platform/hardware agnostic approach

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-16 04:14:16 -05:00
Argenis
1140a7887d
feat: add HTTP request tool for API interactions
Implements #210 - Add http_request tool that enables the agent to make
HTTP requests to external APIs.

Features:
- Supports GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS methods
- JSON request/response handling
- Configurable timeout (default: 30s)
- Configurable max response size (default: 1MB)
- Security: domain allowlist, blocks local/private IPs (SSRF protection)
- Headers support with auth token redaction

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-16 03:44:42 -05:00
Argenis
9bdbc1287c
fix: add tool use protocol to channel/daemon/gateway system prompts
Fixes #284 - Tool call format was missing from the system prompt in
channel, daemon, and gateway modes. This caused LLMs to not know how
to properly invoke tools when using these modes.

The tool use protocol with <invoke> tags and JSON payload format now
matches the implementation in agent loop mode.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-16 02:36:21 -05:00
不做了睡大觉
21dc22f249
test(channels): add regression for UTF-8 truncation panic in channel logs (#262) 2026-02-16 02:30:26 -05:00
Vernon Stinebaker
40c41cf3d2
feat(discord): add listen_to_bots config and fix model IDs across codebase (#280)
* fix(config): apply env overrides at runtime and fix Docker compose defaults

- Call apply_env_overrides() after Config::load_or_init() in main.rs so
  environment variables (API_KEY, PROVIDER, ZEROCLAW_GATEWAY_PORT, etc.)
  are actually applied at runtime, not just in tests
- Add ZEROCLAW_ALLOW_PUBLIC_BIND env var support for gateway bind policy
- Fix docker-compose.yml: correct volume path (/zeroclaw-data not /data),
  add ZEROCLAW_ALLOW_PUBLIC_BIND=true for container networking, make host
  port configurable via HOST_PORT env var
- Add docker-compose.override.yml to .gitignore for local dev overrides

* feat(discord): add listen_to_bots config and fix model IDs across codebase

Add listen_to_bots field to DiscordConfig so bot messages are processed
when explicitly enabled (defaults to false for backward compat). Remove
ZEROCLAW_MODEL from Dockerfile release stage so config.toml is the
source of truth for model selection. Fix all hardcoded model IDs from
the dated anthropic/claude-sonnet-4-20250514 to the valid OpenRouter
identifier anthropic/claude-sonnet-4.
2026-02-16 02:13:36 -05:00
Vernon Stinebaker
d5e8fc1652
fix(config): apply env overrides at runtime and fix Docker compose defaults (#279)
- Call apply_env_overrides() after Config::load_or_init() in main.rs so
  environment variables (API_KEY, PROVIDER, ZEROCLAW_GATEWAY_PORT, etc.)
  are actually applied at runtime, not just in tests
- Add ZEROCLAW_ALLOW_PUBLIC_BIND env var support for gateway bind policy
- Fix docker-compose.yml: correct volume path (/zeroclaw-data not /data),
  add ZEROCLAW_ALLOW_PUBLIC_BIND=true for container networking, make host
  port configurable via HOST_PORT env var
- Add docker-compose.override.yml to .gitignore for local dev overrides
2026-02-16 02:12:49 -05:00