惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

Stack Overflow Blog
Stack Overflow Blog
酷 壳 – CoolShell
酷 壳 – CoolShell
P
Proofpoint News Feed
Apple Machine Learning Research
Apple Machine Learning Research
T
Tailwind CSS Blog
罗磊的独立博客
F
Future of Privacy Forum
The Register - Security
The Register - Security
MyScale Blog
MyScale Blog
P
Privacy & Cybersecurity Law Blog
V
Visual Studio Blog
T
Tenable Blog
F
Fortinet All Blogs
D
Docker
V
Vulnerabilities – Threatpost
Cyberwarzone
Cyberwarzone
A
Arctic Wolf
T
Threat Research - Cisco Blogs
I
Intezer
T
Tor Project blog
大猫的无限游戏
大猫的无限游戏
MongoDB | Blog
MongoDB | Blog
博客园 - 司徒正美
AWS News Blog
AWS News Blog
freeCodeCamp Programming Tutorials: Python, JavaScript, Git & More
G
GRAHAM CLULEY
T
Threatpost
美团技术团队
K
Kaspersky official blog
F
Fox-IT International blog
Hugging Face - Blog
Hugging Face - Blog
Vercel News
Vercel News
P
Palo Alto Networks Blog
Google DeepMind News
Google DeepMind News
T
The Blog of Author Tim Ferriss
S
Schneier on Security
腾讯CDC
Cisco Talos Blog
Cisco Talos Blog
C
Check Point Blog
博客园 - 叶小钗
I
InfoQ
Threat Intelligence Blog | Flashpoint
Threat Intelligence Blog | Flashpoint
Blog — PlanetScale
Blog — PlanetScale
F
Full Disclosure
T
True Tiger Recordings
CTFtime.org: upcoming CTF events
CTFtime.org: upcoming CTF events
E
Exploit-DB.com RSS Feed
L
LINUX DO - 热门话题
J
Java Code Geeks
C
CERT Recently Published Vulnerability Notes

Recent Commits to openclaw:main

fix: guard QMD session stem fallback (#86482) · openclaw/openclaw@2e3b59b fix(gateway): keep session tool mirrors under pressure docs: route github creation through agent transcript test(tools): add unmocked image custom-provider auth regression (#85733) · openclaw/openclaw@f0bfb3f refactor(plugin-sdk): rename plain text tool-call compat wrapper docs(skills): defer private release locators · openclaw/openclaw@23d38e4 Replace Sharp image backend with Photon (#86437) · openclaw/openclaw@b9f975b fix(agents): release embedded-attempt session lock on every exit path… · openclaw/openclaw@32ddfc2 fix: accept OpenClaw voice wake confusions (#86507) fix(crabbox): bootstrap macos js toolchain chore: add agent transcript skill · openclaw/openclaw@d63e8d4 fix(gateway): dedupe session tool fanout · openclaw/openclaw@89a21db fix: Hook ingress token unlocks password-mode gateway auth (#86453) · openclaw/openclaw@d51f268 fix #86077: keep fallback errors candidate scoped (#86134) · openclaw/openclaw@d6b7fe8 fix(diagnostics): reclaim wedged session lanes with a stale leaked ac… · openclaw/openclaw@6f76d9f fix: derive plugin media trust from metadata (#86410) · openclaw/openclaw@e761eb8 fix(media-understanding): normalize HEIC before image descriptions (#… · openclaw/openclaw@75c7236 fix: accept leading fuzzy Discord voice wake names (#86484) · openclaw/openclaw@8fe4f34 feat: promote provider tool call stream wrapper (#86489) fix(test): dedupe kitchen sink command assertions test: derive deprecated sdk usage guard (#86403) fix(qa): extend memory fallback Windows budget fix(ui): move control ui chunking helper out of runtime source · openclaw/openclaw@968c87d fix: quiet retained lost task noise (#86475) fix(build): keep control ui chunking out of deadcode · openclaw/openclaw@dc26069 fix: rotate realtime voice sessions on max duration · openclaw/openclaw@dc2c4aa fix(test): stream bundled plugin sweep logs · openclaw/openclaw@fc3cd49 docs: add bugfix changelog credits · openclaw/openclaw@2e7e4bc fix(models): show oauth marker auth status (#86378) · openclaw/openclaw@a6df39d fix: seed cron task progress summaries (#86313) · openclaw/openclaw@92afd8b fix(update): exclude prerelease tags from stable git channel (#86260) · openclaw/openclaw@28f169b fix(doctor): warn and continue when cron job store is unreadable (#86… fix(gateway): clear runtime config snapshot before in-process restart… · openclaw/openclaw@90caa3b fix(scripts): restore sparse crabbox changed gates · openclaw/openclaw@d270879 fix(build): support Windows UI builds · openclaw/openclaw@0bb9b42 Fix local embedding worker safety (#85348) · openclaw/openclaw@7ff29a9 fix(ui): scope chat session picker to active agent (#85965) · openclaw/openclaw@70c7d6f [codex] improve iOS realtime talk mode (#86355) · openclaw/openclaw@9ca52ce fix(scripts): dedupe docker lane resources · openclaw/openclaw@5e94469 docs: add code size guidance · openclaw/openclaw@9a60fcf fix(test): avoid source gateway import in rpc walk · openclaw/openclaw@e9b8a6e docs: add bugfix changelog entries · openclaw/openclaw@f950132 Fix heartbeat response loop guard (#86324) (#86357) · openclaw/openclaw@e2c174e fix(memory-core): filter REM dreaming candidates to light-staged entr… · openclaw/openclaw@8b42771 fix(telegram): propagate forum topic names into agent context (#86299) fix(slack): keep downloaded files out of reply media (#86318) · openclaw/openclaw@2fcd481 fix(cron): accept plus durations for one-shot jobs (#86341) · openclaw/openclaw@9239f94 fix(plugins): clear metadata memo at lifecycle boundaries · openclaw/openclaw@e7c696a chore(skills): normalize release skill routing · openclaw/openclaw@4737e19 docs(release): require early performance regression check · openclaw/openclaw@0336938 fix(qa): capture Windows gateway metrics · openclaw/openclaw@9afbfc1 feat(qa): add coverage scenario matching · openclaw/openclaw@a1fe86a fix(perf): avoid duplicate docker package ui build build: enable modern TypeScript module syntax · openclaw/openclaw@bbc1772 ci: include performance evidence in release validation fix(providers): stream ordinary tool-like prose promptly fix(perf): harden gateway restart bench exits · openclaw/openclaw@82bbcf6 fix(gateway): gate talk secret bootstrap handoff (#85690) · openclaw/openclaw@c791e42 fix: suppress async media incomplete-turn errors (#85933) · openclaw/openclaw@35dcd42 migrate auth credentials · openclaw/openclaw@f036bac fix migrate auth lint · openclaw/openclaw@50e6cb0 fix migrate supported auth imports · openclaw/openclaw@44bb2be fix migrate auth opt-out precedence · openclaw/openclaw@2016a51 honor migrate auth opt-out in plan · openclaw/openclaw@17edec7 address migrate auth review comments · openclaw/openclaw@0a98c2d fix ci blockers for migrate auth docs: add migrate auth changelog (#85667) · openclaw/openclaw@f7fcbdb fix(scripts): avoid duplicate install smoke ui build · openclaw/openclaw@b1b2841 fix(telegram): preserve inbound text entities (#83873) · openclaw/openclaw@b552919 chore: ignore Python bytecode caches · openclaw/openclaw@b6b2755 fix: make autoreview progress visible · openclaw/openclaw@236edb2 ci(release): fix plugin prerelease extension batch invocation test(telegram): provide topic cache store in message context harness · openclaw/openclaw@ff1fde1 test(agents): complete provider runtime test mocks · openclaw/openclaw@be8cd12 test(telegram): type topic cache harness store · openclaw/openclaw@84ab206 test(agents): sync provider runtime mocks · openclaw/openclaw@a289dd9 refactor: keep plain text tool-call promotion private (#86374) · openclaw/openclaw@c3ab2de fix(discord): suppress self-reply prompt echoes (#86238) docs: clarify config migration policy · openclaw/openclaw@c44367f fix(perf): fail startup bench on early gateway exit · openclaw/openclaw@a8fc28c fix: prevent plain text tool call leaks (#86222) · openclaw/openclaw@cd62780 fix: handle npm min-release-age in installers · openclaw/openclaw@316d97c fix(scripts): include ui:build in build-all full and ciArtifacts prof… · openclaw/openclaw@6704d0a fix(e2e): sample Windows kitchen sink gateway RSS · openclaw/openclaw@73189e3 fix(cron): respect isolated target and error on missing remove id (#8… · openclaw/openclaw@6709f4e fix(pi-embedded-runner): propagate trigger-derived priority to the gl… · openclaw/openclaw@0580f57 fix(cli): suppress self-update version warnings · openclaw/openclaw@e2bd20f fix: preserve webchat source reply details · openclaw/openclaw@aa50c51 docs: replace OpenClaw docs skill and add plugin permissions guide · openclaw/openclaw@0dabb70 fix(codex): preserve source reply mode for active runs (#86325) · openclaw/openclaw@b962110 fix: make compaction reinjection opt-in · openclaw/openclaw@ab910f8 fix codex usage-limit recovery copy (#86305) · openclaw/openclaw@c3c8a65 feat(ui): add ephemeral Activity tab · openclaw/openclaw@3dd0e8e fix(tests): harden native macos plugin proof · openclaw/openclaw@a5d5604 fix(commitments): serialize load-modify-save with in-process queue + … · openclaw/openclaw@d3c293d Fail Codex compaction at the Codex boundary (#85958) · openclaw/openclaw@dd47e47 fix(docker): restore config parent ownership · openclaw/openclaw@908b894 docs: clarify config default review policy (#86329) · openclaw/openclaw@3a03dd5 docs: clean changelog script entries · openclaw/openclaw@0eead19 fix(scripts): budget restart benchmark timeouts · openclaw/openclaw@5bd5509
Guard OpenAI chat payload turns (#86497) · openclaw/openclaw@489e415
clawsweeper · 2026-05-25 · via Recent Commits to openclaw:main

@@ -1028,6 +1028,136 @@ describe("openai transport stream", () => {

10281028

}

10291029

});

103010301031+

it("refuses ModelStudio chat streams with no user or assistant payload turns", async () => {

1032+

const model = {

1033+

id: "qwen-coder-plus",

1034+

name: "qwen-coder-plus",

1035+

api: "openai-completions",

1036+

provider: "qwen",

1037+

baseUrl: "https://dashscope-intl.aliyuncs.com/compatible-mode/v1",

1038+

reasoning: false,

1039+

input: ["text"],

1040+

cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },

1041+

contextWindow: 4096,

1042+

maxTokens: 256,

1043+

} satisfies Model<"openai-completions">;

1044+

const stream = createOpenAICompletionsTransportStreamFn()(

1045+

model,

1046+

{

1047+

systemPrompt: "runtime-only system prompt",

1048+

messages: [],

1049+

tools: [],

1050+

} as never,

1051+

{ apiKey: "test-key" } as never,

1052+

);

1053+1054+

let errorPayload: Record<string, unknown> | undefined;

1055+

for await (const event of stream as AsyncIterable<{

1056+

type: string;

1057+

error?: Record<string, unknown>;

1058+

}>) {

1059+

if (event.type === "error") {

1060+

errorPayload = event.error;

1061+

}

1062+

}

1063+1064+

expect(errorPayload).toMatchObject({ stopReason: "error" });

1065+

expect(String(errorPayload?.errorMessage)).toContain(

1066+

"contains no non-empty user or assistant messages",

1067+

);

1068+

expect(String(errorPayload?.errorMessage)).toContain("system/tool-only request");

1069+

});

1070+1071+

it("allows generic OpenAI-compatible chat streams without the ModelStudio turn guard", async () => {

1072+

let capturedRoles: string[] | undefined;

1073+

const server = createServer((req, res) => {

1074+

let body = "";

1075+

req.setEncoding("utf8");

1076+

req.on("data", (chunk) => {

1077+

body += chunk;

1078+

});

1079+

req.on("end", () => {

1080+

const parsed = JSON.parse(body) as { messages?: Array<{ role?: string }> };

1081+

capturedRoles = parsed.messages?.map((message) => message.role ?? "");

1082+

res.writeHead(200, {

1083+

"content-type": "text/event-stream; charset=utf-8",

1084+

"cache-control": "no-cache",

1085+

connection: "keep-alive",

1086+

});

1087+

const created = Math.floor(Date.now() / 1000);

1088+

res.write(

1089+

`data: ${JSON.stringify({

1090+

id: "chatcmpl-system-only",

1091+

object: "chat.completion.chunk",

1092+

created,

1093+

model: "generic-openai-compatible",

1094+

choices: [

1095+

{

1096+

index: 0,

1097+

delta: { role: "assistant", content: "OK" },

1098+

finish_reason: null,

1099+

},

1100+

],

1101+

})}\n\n`,

1102+

);

1103+

res.write(

1104+

`data: ${JSON.stringify({

1105+

id: "chatcmpl-system-only",

1106+

object: "chat.completion.chunk",

1107+

created,

1108+

model: "generic-openai-compatible",

1109+

choices: [{ index: 0, delta: {}, finish_reason: "stop" }],

1110+

})}\n\n`,

1111+

);

1112+

res.write("data: [DONE]\n\n");

1113+

res.end();

1114+

});

1115+

});

1116+1117+

await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));

1118+

try {

1119+

const address = server.address();

1120+

if (!address || typeof address === "string") {

1121+

throw new Error("Missing loopback server address");

1122+

}

1123+

const model = {

1124+

id: "generic-openai-compatible",

1125+

name: "Generic OpenAI Compatible",

1126+

api: "openai-completions",

1127+

provider: "custom-openai-compatible",

1128+

baseUrl: `http://127.0.0.1:${address.port}/v1`,

1129+

reasoning: false,

1130+

input: ["text"],

1131+

cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },

1132+

contextWindow: 4096,

1133+

maxTokens: 256,

1134+

} satisfies Model<"openai-completions">;

1135+

const stream = createOpenAICompletionsTransportStreamFn()(

1136+

model,

1137+

{

1138+

systemPrompt: "runtime-only system prompt",

1139+

messages: [],

1140+

tools: [],

1141+

} as never,

1142+

{ apiKey: "test-key" } as never,

1143+

);

1144+1145+

let doneReason: string | undefined;

1146+

for await (const event of stream as AsyncIterable<{ type: string; reason?: string }>) {

1147+

if (event.type === "done") {

1148+

doneReason = event.reason;

1149+

}

1150+

}

1151+1152+

expect(capturedRoles).toEqual(["system"]);

1153+

expect(doneReason).toBe("stop");

1154+

} finally {

1155+

await new Promise<void>((resolve, reject) => {

1156+

server.close((error) => (error ? reject(error) : resolve()));

1157+

});

1158+

}

1159+

});

1160+10311161

it("parses JSON chat completions returned to streaming requests", async () => {

10321162

let capturedStreamFlag: unknown;

10331163

const server = createServer((req, res) => {