6 Commits

Author	SHA1	Message	Date
Duy /zuey/	532ff91d8e	fix(security): harden upstream critical surfaces (#32) ... * fix(security): harden upstream critical surfaces Refs #30 * fix(security): close pre-landing review gaps Refs #30 * fix(security): close official release blockers	2026-05-20 16:33:49 +07:00
Duy /zuey/	ddf8e1099f	feat(webhooks): HTTP webhooks to trigger agents with HMAC auth + durable callbacks (#2) ... * feat(webhooks): HTTP webhooks to trigger agents with HMAC auth and durable callbacks Add multi-tenant HTTP webhook endpoints for agent triggering: - /v1/webhooks/message: send messages to channels - /v1/webhooks/llm: sync/async LLM prompts with HMAC-signed callbacks - HMAC-256 + bearer token authentication - Rate limiting and tenant isolation - Durable callback worker with exponential backoff - PG 000056 + SQLite schema v25 migrations - Unit + integration tests, P0 tenant isolation invariants - Channel media capability helpers for attachment routing - Comprehensive webhook documentation and i18n strings * fix(webhooks): address post-review findings (K1-K10) Comprehensive post-merge fixes addressing 10 blocking code review issues and 2 adversarial re-audit findings in webhook-agent-triggering feature: K1: Fix auth middleware tenant context lookup sequencing — move tenant context injection before authenticate() call to prevent unscoped secret lookups. K2: Canonicalize JSON payload format for jsonb compatibility across PostgreSQL and SQLite — ensure consistent serialization without whitespace variance to prevent hash mismatches. K3: Add fail-closed JSON parsing in body hash extraction with explicit error handling for malformed payloads before HMAC verification. K4: Fix worker queue wedge by properly draining slot reservations when delivery succeeds, preventing permanent slot occupancy. K5: Implement lease-token optimistic concurrency control to prevent duplicate webhook delivery under high concurrency or retry storms. K6: Add AES-256-GCM encrypted secret storage at rest with fail-fast skip-mount when GOCLAW_ENCRYPTION_KEY environment variable unset. K7: Implement IP allowlist enforcement supporting both CIDR ranges and exact IP matching with proper X-Forwarded-For parsing. K8: Add HMAC replay nonce cache (5min expiry, non-blocking async flush) to prevent request replay attacks on webhook handler. K9: Fix invariant test schema selection — replace hardcoded assumption with explicit schema name from config to support multi-schema testing. K10: Consolidate rate limiters into single shared instance to prevent per-endpoint limiter starvation and ensure fair rate limiting. New database migrations: - 000057: webhook_calls.lease_token for optimistic concurrency - 000058: webhooks.encrypted_secret_key for AES-256-GCM encryption New i18n keys: MsgWebhookIPDenied, MsgWebhookEncryptionUnavailable (with English, Vietnamese, Chinese translations). New modules: - internal/http/webhooks_payload.go: JSON canonicalization + body hash - internal/http/webhooks_nonce.go: Replay nonce cache implementation - internal/http/webhooks_idempotency_test.go: Integration tests Documentation updates: - docs/webhooks.md: §13-14 security sections, encryption flow - docs/00-architecture-overview.md: webhook subsystem security overview - docs/codebase-summary.md: webhook security patterns - docs/project-changelog.md: webhook fixes changelog Test coverage: 53 webhook tests + 4 P0 invariant tests all passing. No tenant isolation violations. All security gates enforced. * docs(journals): webhook feature ship + fix cycle entries * fix(webhooks): address Claude review findings - webhooks_llm.go: remove misleading ptr() helper; use &completedAt pattern for error-path audit rows (matches success path) - webhooks_auth.go: wrap TouchLastUsed context in WithoutCancel so background DB update isn't cancelled when HTTP response completes - store GetByIDUnscoped (PG+SQLite): add NOT revoked / revoked = 0 filter for defense-in-depth parity with GetByHashUnscoped - webhooks/sign.go: fix package doc — HMAC key is raw plaintext secret bytes, not hex-decoded SHA-256 - webhooks_admin.go: check auth before encKey guard to avoid leaking config state to unauthenticated callers - webhooks_ratelimit.go: two-phase Load→LoadOrStore to avoid per-call entry allocation on the hot path * docs(webhooks): fix Sign() function doc to match actual key input Function-level comment still referenced hex-decoded SecretHash after the package-level doc was corrected. Align with actual caller usage ([]byte(rawSecret)). * fix(webhooks): use WithoutCancel for worker execute DB updates Terminal status writes in execute() ran through the worker main-loop ctx, which is cancelled on graceful shutdown. If the outbound send completed but the status update raced with shutdown, the row stayed in 'running' and got re-delivered via reclaimStale. WithoutCancel lets the DB write survive worker cancellation while preserving propagated values (tenant ID, etc.). * fix(webhooks): move tctx init before panic defer in worker execute Panic recovery called updateRetry with raw ctx (no tenant ID), making requireTenantID fail and the reset-to-retry DB write silently drop. Row stayed 'running' until reclaimStale (~90s delay). Init tctx first so defer closure captures tenant-scoped non-cancellable context. * fix(webhooks): pass tenant-scoped tctx to invokeAgent in worker execute() was passing the raw worker-loop ctx (no tenant ID) to invokeAgent → router.Get → PGAgentStore.GetByID. GetByID reads TenantIDFromContext which returned uuid.Nil, making every lookup return 'agent not found'. Async LLM webhook calls silently failed all retries. Pass tctx (already tenant-scoped + WithoutCancel) so the router resolves the agent correctly. * fix(tests): resolve integration test compile errors - Remove duplicate contains() in mcp_grant_revoke_test.go (already defined in tts_gemini_live_test.go) - Update webhooks_admin_test.go RotateSecret call to match current 5-arg signature (newSecretHash, newPrefix, newEncryptedSecret) * fix(webhooks): default nil scopes/ip_allowlist to empty slice in Create PG columns are NOT NULL DEFAULT '{}'. Explicit NULL from pqStringArray(nil) violated the constraint, breaking TestWebhookAdminCRUD/TenantIsolation. Coerce nil slices to empty []string{} so the default applies at the DB layer. * chore: trigger CI on digitopvn/goclaw fork * ci: retrigger workflows * fix(webhooks): renumber migrations to 000059-000061 for merge train	2026-05-11 13:29:24 +07:00
viettranx	955b7a512f	docs: update architecture and changelog for context-tokens and compact-quality fixes ... - Update docs/00-architecture-overview.md with TokenCounter and sessions.metadata details - Update docs/codebase-summary.md with overhead accounting and compaction logic - Update docs/project-changelog.md with v3.11.0 context-tokens accuracy fixes	2026-04-23 08:31:53 +07:00
viettranx	04a9938f4f	feat(tts): wire tenant timeout + fix Gemini text-only 400 ... - HTTP synthesize + test-connection now read tenant tts.timeout_ms (default 120s, was hardcoded 15s/10s). Gemini client default also bumped 30s→120s so both layers align when tenant config unset. - Inline prefix "Speak naturally: " prepended to single-voice text; multi-speaker transcripts pass through unchanged. - ErrTextOnlyResponse sentinel for 400 "text generation" bodies; single-voice retries once with stronger prefix. Narrowed needle list avoids false positives on unrelated 400s. - SynthesizeWithFallbackAdapted now returns errors.Join so sentinel survives fallback chain; HTTP 422 mapping + locale-translated ForLLM in agent tool (EN/VI/ZH catalogs). - Default Gemini model bumped to gemini-3.1-flash-tts-preview.	2026-04-23 08:31:53 +07:00
Kai (Tam Nhu) Tran	4b02c27307	feat: native image_generation for Codex + OpenAI-compat providers (#1002) ... * refactor(providers): migrate ToolDefinition.Function to pointer + add image response fields ToolDefinition.Function becomes *ToolFunctionSchema with omitempty so native tool types (image_generation, web_search, etc.) can be declared without a function body. All 9 internal construction sites updated. CleanToolSchemas refactored — function-shape cleaning extracted into cleanFunctionSchema helper, outer pass-through handles native tools. Added image response fields needed by the next commits: ChatResponse.Images, StreamChunk.Images, ImageContent.Partial (distinguishes partial frames from final images). * feat(providers): native image_generation for Codex + OpenAI-compat tracks Codex native (POST /codex/responses): emit image_generation tool object in request tools[] (type, action, model, output_format, partial_images). Handle SSE events response.image_generation_call.partial_image + response.output_item.done (type image_generation_call) + response.completed output[] walk for non-stream. Dedup per item_id. Extend codexSSEEvent/codexItem with output_format, result, partial_image_b64, partial_image_index. OpenAI-compat (/v1/chat/completions): serialize ToolDefinition{Type:'image_generation'} as {type:'image_generation'} pass-through. Parse choices[0].message.images[] + delta.images[] (data URLs) via new parseDataURL helper; append to ChatResponse.Images. ProviderCapabilities.ImageGeneration flag; Codex provider + adapter set true. Other providers default false. * feat(agent,http,store): persist assistant images + tri-level image_generation gate Agent loop tri-level gate: (provider capability) AND (AgentConfig.AllowImageGeneration, default true, stored in other_config.allow_image_generation) AND (request lacks x-goclaw-no-image-gen header). Gate in loop_tool_filter.go appends ToolDefinition{Type:'image_generation'} only when all three pass. Per-request opt-out parsed in chat_completions.go and propagated via RunRequest.NoImageGen. Media persistence: persistAssistantImages writes final images (Partial:false) to {workspace}/media/{sha256}.{ext}, returns MediaRef entries, clears inline Images[] from the message. Idempotent on hash, traversal-safe, symlink-guarded. Invoked from pipeline.FinalizeStage via new Deps.PersistAssistantImages callback — covers both stream-final and non-stream paths. Agent store reads AllowImageGeneration from other_config JSONB with absent/nil = true default (matches V3Flags pattern). No DB migration — code-only default. * feat(ui/web): image_generation toggle + streaming placeholder + download filename Composer chip 'Images' visible only when active agent's provider has ImageGeneration capability. Per-agent localStorage persistence via useImageGenToggle hook. When off, sends noImageGen:true to WS chat method (maps to x-goclaw-no-image-gen on upstream HTTP call path). ActiveRunZone renders a skeleton placeholder while streaming partial_image frames arrive. MediaGallery assigns generated-YYYYMMDD-HHmmss.png as the download filename for hex/UUID PNGs. i18n keys added to en/vi/zh chat.json: imageGenToggle, imageGenGenerating, imageGenDownloadName. 8 vitest tests for the toggle hook. * docs: add Image Generation section to codebase-summary + changelog entry Documents the new native image_generation pipeline across providers layer (Codex + OpenAI-compat), agent gate, media persistence, and web UI surface. * fix(ui/web): match Codex-routed providers for image_generation toggle Image-gen toggle visibility was hard-coded to provider id 'chatgpt_oauth' but real Codex-routed agents in production use provider ids like 'cliproxy-codex'. The toggle never rendered. Replace the Set-has check with a small helper that accepts the literal ids plus any provider string containing 'codex' (case-insensitive). Same logic applied in both chat-input.tsx (composer chip) and chat-page.tsx (streaming placeholder gate). Verified against a live Codex-routed agent: toggle now renders, noImageGen:true propagates on toggle-off. * docs(pr-1002): targeted-mode UX evidence report Captures the UI integration surface for native image_generation against a live Codex-routed agent on the remote dev backend. Includes: composer toggle chip (rendered), streaming skeleton placeholder, and honest failure-path capture showing the legacy create_image builtin fallback. Self-contained HTML report in .github/pr-assets/1002/index.html. * fix(permissions): classify sessions.compact as write method CI RBAC-drift test (TestMethodRole_DriftCoverage_AllProtocolMethodsClassified) was failing because the new sessions.compact method added upstream was not classified in any of isPublicMethod / isAdminMethod / isWriteMethod / isReadMethod. Sessions compaction mutates session history (compacts messages into summaries), so it belongs with the other sessions.* write methods. * fix(tests): remove duplicate contains() in integration package Both tts_gemini_live_test.go and mcp_grant_revoke_test.go declared a file-local func contains(s, substr string) bool with identical bodies, causing 'contains redeclared in this block' at compile time in the integration job. Replace all call sites with strings.Contains (same semantics, stdlib) and drop the duplicates. No behavior change. * feat(providers): NativeImageProvider interface + Codex implementation Defines a provider-level contract (NativeImageProvider.GenerateImage) that OAuth-backed providers can implement to serve image generation without exposing static API credentials. Re-uses the PR's Track A native wire format (POST /codex/responses with image_generation tool, item.result decoding, SSE fallback). CodexProvider + CodexAdapter implement it. Also adds MediaRef.Prompt field so downstream layers can propagate the generating prompt alongside the asset. * feat(tools): route create_image through NativeImageProvider for OAuth providers create_image.callProvider now checks for a NativeImageProvider implementation before the credentialProvider interface. When the provider chain points at a Codex-family provider (no static API key), the tool delegates to the provider's GenerateImage which executes the native ChatGPT Responses API image_generation flow. Resolves 'provider X does not expose API credentials required for image generation' errors for openai-codex / cliproxy-codex chains. On success the tool embeds the user's prompt as a PNG tEXt 'Description' chunk (file-local pngEmbedPrompt helper to avoid tools→agent import cycle), writes the image to /tmp, and threads the prompt through result.MediaPrompts for downstream MediaRef propagation. * feat(agent,pipeline): propagate image prompt through MediaRef + PNG tEXt embed helper Adds EmbedPNGPrompt public helper in internal/agent/png_metadata.go that inserts a tEXt 'Description' chunk (plus 'Software: goclaw') into PNG byte streams before the IEND chunk. Non-PNG inputs are passed through unchanged — the helper never errors on unknown formats. FinalizeStage wires MediaResult.Prompt (from create_image tool output) onto MediaRef.Prompt so the UI can render the generating prompt alongside the image. Per-image prompt list threaded via pipeline RunState. * feat(ui/web): show generating prompt as caption under each image in MediaGallery When a MediaRef carries a prompt, MediaGallery renders it as a muted italic caption (line-clamp-2) beneath the image with the full text in the title tooltip. Caption is hidden when the prompt is absent so non-assistant images (user uploads, legacy data) look unchanged. MediaItem + session media_refs types extended with an optional prompt field; the chat-message adapter threads ref.prompt through when converting WS payloads to UI state. * fix(providers/codex): stream:true + instructions for native image_generation The ChatGPT Responses API on /codex/responses rejects two things hard: - stream:false → HTTP 400 "Stream must be set to true" - missing instructions → HTTP 400 "Instructions are required" buildNativeImageRequestBody now sets stream:true and a purpose-specific instructions string ("Generate an image matching the user's description using the image_generation tool. Return only the image; do not describe it in text."). The existing parseNativeImageSSE path was already in place for stream parsing; routing changed from the non-stream branch to the SSE branch. Regression assertions added to TestCodexGenerateImage_BuildsNativeRequest so these two fields can't silently regress. * feat(providers,tools,ui): image_model whitelist (gpt-image-2 default, gpt-image-1.5 legacy) Replaces the hardcoded "gpt-image-2" literal in buildNativeImageRequestBody with a user-configurable field threaded through NativeImageRequest.ImageModel. The whitelist is enforced by ValidateImageModel which rejects anything outside {gpt-image-2, gpt-image-1.5} with a clear error — prevents silent upstream 400s from model names the Responses API would reject. create_image.callProvider reads params.image_model from the chain entry and threads it through. Empty / absent falls back to DefaultImageModel (gpt-image-2). UI: added an 'Image model' select inside the existing openai-codex Settings panel on the Create Image Provider Chain dialog. Options: Default · gpt-image-2 (recommended) and Legacy · gpt-image-1.5. i18n keys in en/vi/zh tools.json under builtin.mediaChain. Tests: TestCodexGenerateImage covers default/legacy/rejected model cases; TestCreateImageTool_ThreadsImageModel covers params→request threading with empty/legacy/explicit sub-cases. * fix(tools): raise media chain default timeout to 600s/1 retry for image gen gpt-image-2 on complex prompts (dense Vietnamese text, infographic layouts) legitimately takes 4–8 minutes to complete. The previous default of 120s × 2 retries routinely died mid-generation with 'context deadline exceeded' — the upstream run was still producing bytes when our ctx cancelled. Default is now Timeout: 600 / MaxRetries: 1. Retries dropped to 1 because image generation is stateful per upstream run: a mid-flight timeout leaves orphan server work, and retrying a fresh generation doubles cost for no gain. Surface the failure fast so operators can widen the timeout instead. Operators can still set a tighter value explicitly via the Chain dialog. * refactor: remove user-facing Images toggle, keep admin-level AllowImageGeneration The per-request opt-out toggle (composer chip + streaming placeholder + noImageGen header plumbing) was a support footgun — users toggle OFF, forget, then can't generate images and think it's broken. Removed in full. Kept: AgentConfig.AllowImageGeneration (admin kill-switch, stored in other_config.allow_image_generation, default true). Tri-level gate simplifies to two tiers: provider capability AND agent config allows. Removed: useImageGenToggle hook, IMAGE_GEN_PROVIDER_IDS set in chat-input, supportsImageGenProvider helper, agentProvider/agentKey props on ChatInput, showImageGenPlaceholder prop on MessageBubble/ActiveRunZone/ChatThread, noImageGen param on use-chat-send, parseNoImageGen in chat_completions.go, NoImageGen on RunRequest, no_image_gen_header_test.go, imageGenToggle/imageGenGenerating i18n keys. Kept imageGenDownloadName — used by MediaGallery for generated-\*.png filename resolution. * docs(pr-1002): refreshed UX trace + updated codebase notes Replaces the earlier stealth-state evidence with a clean three-capture trace from a real successful run: inline image + prompt caption, MediaGallery lightbox expansion, Chain dialog with the new Image model dropdown open. Skill-routing rows scrubbed from the capture — they reflect per-agent skill setup, not anything this PR introduces. codebase-summary + changelog: reflect final state (toggle removed, image_model selector, 600s default chain timeout, gpt-image-2 as quality baseline). * fix(pipeline): preserve mid-loop image_generation output across iterations FinalizeStage previously read state.Think.LastResponse.Images, which holds only the last iteration's response. If the LLM emitted image_generation_call in iteration N alongside a function_call, then responded text-only in N+1, the image from N was silently dropped on finalize. Accumulate final (non-partial) images into state.Observe.AssistantImages across every iteration via ObserveStage, and source FinalizeStage from the accumulator instead of LastResponse. Partial streaming frames are filtered defensively; response.Images is cleared on drain to prevent double-counting on re-exec. * test(pipeline): regression coverage for mid-loop image accumulation Six ObserveStage cases covering image accumulation semantics: - single-iter image-only, image+tool_call same iter, mid-loop image surviving text-only final iter, multiple images across iters, partial frame filtering, nil-response safety. Two FinalizeStage cases verifying accumulator is the source of truth: - PersistsFromObserveAccumulator: image in Observe + empty LastResponse must still be persisted via PersistAssistantImages. - NoPersistWhenAccumulatorEmpty: no call when no images were emitted. --------- Co-authored-by: viettranx <viettranx@gmail.com>	2026-04-23 08:22:39 +07:00
viettranx	613b6e38d7	feat(tts): provider capabilities schema + Gemini TTS + dynamic param forms ... Baseline groundwork for TTS expansion plan. Introduces a capabilities system that the follow-up plan (phase-01..04) builds on. Backend: - `audio.ParamSchema` / `ProviderCapabilities` types + per-provider capabilities.go for edge, elevenlabs, minimax, openai, gemini. - Gemini TTS provider (client, models, voices, wav encoder, multi-speaker via SpeakerVoice, audio-tag aware prompts). - TTSOptions gains `Params map[string]any` (read-only) + `Speakers`. - `VoiceListProvider` interface decouples HTTP voice handler from provider-specific impls. - `nested_keys.go` resolves dot-separated param paths for nested provider bodies (voice_settings.stability etc.). - Characterization + defaults-invariant tests per provider lock nil-params byte-equivalence before new params land. - `/v1/tts/capabilities` HTTP endpoint + integration coverage. - Dual-read tests (PG + SQLite) for tts_config. Frontend (web + desktop): - `DynamicParamForm` with depends-on evaluation, split into fields/logic modules. Slider primitive added. - `AudioTagPicker` + `MultiSpeakerEditor` for Gemini. - `voice-picker` refactored toward portal UX; combobox tightened. - tts-capabilities API client + typed hooks. - i18n catalogs (en/vi/zh) expanded; parity tests guard key drift. - TTS page reorganised (voice-model-section removed; playground + credentials + provider-setup split cleanly). Docs: codebase-summary, project-changelog, tts-provider-capabilities.	2026-04-20 00:05:19 +07:00