Commit Graph
18 Commits
Author SHA1 Message Date
23d0b5eb0b fix(providers): auto-clamp max_tokens on model rejection (#267)
* fix(providers): auto-clamp max_tokens on model rejection + fix verify for reasoning models

When OpenAI-compat models reject max_tokens as too large (e.g. gpt-3.5-turbo
supports 4096 but we send 8192), parse the model's stated limit from the 400
error, clamp the value, and retry once. This fixes agent creation for models
with lower output token limits without hardcoding model names.

Also increase the provider verify endpoint's max_tokens from 1 to 50 so
reasoning models (gpt-5, o-series) have enough headroom for internal
reasoning during the check call.

Closes #248, closes #245

* refactor(providers): extract chat retry closure + fix clamp log key

- Extract duplicate retry closure into chatRequestFn() to follow DRY
- Fix slog logging wrong key: body["max_tokens"] was nil for reasoning
  models that use max_completion_tokens — now uses clampedLimit() helper
- Remove unnecessary _ = resp in provider verify endpoint

---------

Co-authored-by: viettranx <viettranx@gmail.com>
2026-03-19 08:41:20 +07:00
badgerbeesandGitHub 5c0612a07f fix(providers): prevent Gemini thought_signature from leaking to other providers and breaking validation (#230)
* fix: prevent gemini thought_signature from leaking to other providers

* test: refine gemini model detection for robust provider multiplexing
2026-03-16 22:53:21 +07:00
viettranx 50a42ad110 feat(agent): team workspace resolution for lead/member agents
- Lead agents: auto-resolve team workspace as default (relative paths)
- Dispatched members: team workspace as default via req.TeamWorkspace
- Direct-chat members: own workspace default, team workspace accessible
- Add dataDir field to Loop/LoopConfig for global workspace root
- System prompt shows team workspace absolute path for model guidance
- Remove orphan task detector (superseded by post-turn dispatch)
- Log warning on OpenAI tool call argument parse failures
2026-03-16 20:06:01 +07:00
e5f8a2a7da fix(openai): use max_completion_tokens and skip temperature for GPT-5/o-series models (#213)
GPT-5 and o-series models reject the legacy max_tokens parameter and
require max_completion_tokens instead. Additionally, gpt-5-mini,
gpt-5-nano, and o-series models only support the default temperature (1).

This patch adds model-aware branching in buildRequestBody() to:
- Send max_completion_tokens instead of max_tokens for gpt-5*/o1/o3/o4
- Skip temperature parameter for gpt-5-mini/gpt-5-nano/o-series

Co-authored-by: Marcelo Emmerich <marcelo@agenticsystems.de>
2026-03-15 19:39:39 +07:00
405a753239 fix: resolve media provider type from DB instead of guessing from name (#154)
Media tools (create_image, create_video, create_audio, read_audio,
read_video, read_document) routed API calls based on provider name
pattern matching (e.g. strings.HasPrefix(name, "gemini")). This breaks
when users give custom names to DB providers — a Gemini provider named
"chatgpt-sap-het" would be misrouted to the OpenAI-compat endpoint,
causing 404 errors.

Fix: carry the DB provider_type through OpenAIProvider, resolve it via
typedProvider interface in ExecuteWithChain, and inject as _provider_type
param for callProvider routing. Name-based heuristic kept as fallback
for config-file providers that don't have a DB type.

Co-authored-by: Luvu182 <208665161+Luvu182@users.noreply.github.com>
2026-03-11 18:32:51 +07:00
viettranx bdb60de7ae chore: upgrade Go 1.25 → 1.26 and apply go fix modernizations
- Update go.mod and Dockerfile to Go 1.26
- Apply `go fix ./...` stdlib modernizations across 170+ files
- Add `go fix` to post-implementation checklist in CLAUDE.md
- Fix go fix misapplied rewrite in loop_history.go
2026-03-10 00:09:15 +07:00
Viet TranandGitHub 6041c683cb fix(summoner): sequential file generation with progress + HTTP timeout (#74)
Split agent summoning into two sequential LLM calls:
- Step 1: Generate SOUL.md (personality)
- Step 2: Generate IDENTITY.md + USER_PREDEFINED.md using SOUL.md as context

This enables real-time progress updates in the UI as each file completes.
On retry, previously generated files are detected by comparing against
the default template and skipped, so only missing files are regenerated.

Also increase HTTP client timeout from 120s to 300s for both OpenAI and
Anthropic providers. Some models (e.g. Kimi) with deep reasoning can
take 160s+ for non-streaming requests, which exceeded the 120s limit
and caused cascading retry failures until the context deadline expired.
2026-03-06 22:39:33 +07:00
Viet TranandGitHub 3dcbc72ddd fix(openai): increase SSE scanner buffer to 1MB and remove duplicate error check (#72)
Default bufio.Scanner limit (64KB) can truncate large SSE lines from
tool call arguments or thinking content, causing silent parse failures.
Set buffer to 1MB to match the scale of extended thinking responses.

Also remove a duplicate scanner.Err() check that was accidentally left in.
2026-03-06 22:39:21 +07:00
ab9f582de6 fix: OpenAI-compat SSE streaming drops usage data (tokens always 0) (#52)
When stream_options.include_usage is enabled, the OpenAI API sends the
final usage chunk with an empty choices array. The streaming parser
skipped chunks with no choices before checking for usage data, causing
token counts to always be 0 in traces.

Fix: extract usage data before the empty-choices skip.

Also fixes two related SSE parsing issues:
- SSE data prefix now handles both "data: " and "data:" (some providers
  like Kimi omit the space after the colon, per SSE spec)
- Added scanner.Err() check to surface stream read errors (timeout,
  connection reset) instead of silently returning partial results

Co-authored-by: Luvu182 <208665161+Luvu182@users.noreply.github.com>
2026-03-04 23:20:27 +07:00
Luvu182 1c9e8db8e4 fix: OpenAI-compat SSE parsing, scanner error check, reasoning passback, and env var parity
- SSE: handle "data:" without space (Kimi and other providers)
- Add scanner.Err() check to detect stream read failures
- Echo reasoning_content for thinking models (Kimi, DeepSeek)
- Add Thinking field to Message struct for reasoning passback
- Add GOCLAW_OPENAI_BASE_URL env var override (parity with Anthropic)
2026-03-04 09:38:38 +07:00
viettranxandClaude Opus 4.6 73b46c3634 feat(security): apply upstream TS OpenClaw security and core engine fixes
Port 8 fixes from upstream TypeScript OpenClaw (4 CRITICAL + 4 HIGH):

CRITICAL:
1. Tool call name trimming — add strings.TrimSpace() to all provider
   response parsers (Anthropic 2 locations, OpenAI 3 locations) to
   prevent registry lookup failures from LLM whitespace-padded names
2. Shell env injection deny patterns — block GIT_EXTERNAL_DIFF,
   GIT_DIFF_OPTS, BASH_ENV, and ENV=.*sh to prevent code execution
   via environment variable injection during git/shell operations
3. Broken symlink escape — recursive target resolution via
   resolveThroughExistingAncestors() to catch chained symlinks
   that escape workspace (e.g. link1→link2→/etc/passwd)
4. Mutable parent-symlink TOCTOU check — hasMutableSymlinkParent()
   detects symlinks in writable parent dirs that could be rebound
   between path validation and file operation

HIGH:
5. Model fallback thinking preservation — add ThinkingCapable interface
   to providers/types.go, implement on Anthropic/OpenAI/DashScope,
   check before injecting thinking_level in agent loop, warn on
   fallback when thinking is configured
6. Cron session-key double-prefix guard — prevent agent:X:cron:agent:X
   duplication in BuildCronSessionKey()
7. Webhook rate limiter — bounded WebhookRateLimiter (4096 keys max,
   60s window, 30 hits/window) to prevent memory exhaustion DoS
8. DM policy allowlist validation — warn at startup when
   dmPolicy=allowlist with empty allowFrom (silent message drop)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-28 16:52:37 +07:00
viettranxandClaude Opus 4.6 552ddc059e feat(thinking): add per-agent extended thinking with Anthropic, OpenAI, and DashScope support
Implement full thinking mode system: per-agent thinking_level config (off/low/medium/high)
stored in other_config JSONB, per-provider param injection (Anthropic budget_tokens, OpenAI
reasoning_effort, DashScope enable_thinking+thinking_budget), Anthropic extended thinking with
streaming parse and tool use block preservation via RawAssistantContent, thinking token tracking
in trace spans, and Web UI with agent config selector, chat thinking block rendering, and trace
thinking token display. No DB migration needed.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-28 15:45:34 +07:00
viettranxandClaude Opus 4.6 d913f29c69 feat(providers): add DashScope and Bailian Coding providers with reasoning_content support
- Add DashScope (Qwen) native provider with tools+streaming fallback
- Add Bailian Coding provider with hardcoded model list (no /v1/models API)
- Parse reasoning_content in OpenAI-compat streaming/non-streaming responses
- Emit ChatEventThinking events in agent loop for thinking models
- Add vision support for DashScope (qwen3-vl)
- Fix provider form dialog not updating API base URL when switching types
- Update README provider count from 11+ to 13+

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-28 14:56:14 +07:00
viettranxandClaude Opus 4.6 42263e5cc5 feat: Add tool loop detection, negative context injection, and fix Docker workspace permissions
- Add tool loop detection (toolloop.go): tracks repeated no-progress tool calls
  using SHA256 hashing of args+results. Warning at 5 identical calls, force stop
  at 10. Prevents Gemini models from burning tokens in infinite loops.
- Inject AVAILABILITY.md negative context when agent has no team/delegation
  targets, so models don't waste iterations probing unavailable capabilities.
- Fix Dockerfile: create /app/.goclaw directory so Docker volume initializes
  with correct goclaw:goclaw ownership instead of root:root.
- Update collapseToolCallsWithoutSig comments for clarity.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-27 22:00:50 +07:00
viettranx 0844969819 feat: Add thought_signature support for Gemini tool calls, including a compatibility function for old sessions and refactoring OpenAI types. 2026-02-27 18:46:01 +07:00
viettranx d5cc5a745d feat: Implement vision capabilities and image generation tools, adding media handling, dedicated configurations, and trace optimization for image data. 2026-02-26 22:28:27 +07:00
viettranx 6066adc15a feat: Implement agent delegation, quality gates, and a new hooks evaluation system. 2026-02-26 10:15:07 +07:00
Viet TranandClaude Opus 4.6 f3f4c67b36 Initial commit: GoClaw AI agent gateway
Multi-agent AI gateway with WebSocket RPC, HTTP API, and messaging channel integrations.
Go port of OpenClaw with multi-tenant PostgreSQL, per-user isolation, security hardening,
and production observability.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-22 14:58:07 +07:00