Commit graph

152 commits

Author SHA1 Message Date
nayihz
76f2b42d5b feat: improve web proxy handling and coverage 2026-02-24 17:17:14 +08:00
mosir
c56fcedcb1 refactor(pkg/utils): add unified atomic file write utility 2026-02-24 13:22:52 +08:00
Goksu Ceylan
09b1992dd7
fix(security): ensure custom deny patterns extend defaults instead of replacing them (#479)
* fix (security): custom deny patterns denying default patterns

* fix formatting whitespace
2026-02-24 09:02:44 +11:00
Hoshina
6852f24025 fix: address PR #662 review comments (bus drain, context timeouts, onebot leak)
- Drain buffered messages in MessageBus.Close() so they aren't silently lost
- Replace all context.TODO() with context.WithTimeout(5s) across 7 call sites
- Fix OneBot pending channel leak: send nil sentinel in Stop() and handle
  nil response in sendAPIRequest() to unblock waiting goroutines
2026-02-23 21:34:37 +08:00
0x5487
19c698356c
fix(security): workspace sandbox avoid time-of-check/time-of-use (TOCTOU) races (#464)
* chore: Update default host bindings from 0.0.0.0 to 127.0.0.1 for various services and examples.

* config: Update default host bindings to 0.0.0.0 for improved Docker accessibility and add related documentation.

* refactor: reimplement filesystem tools with `os.OpenRoot` for enhanced security and simplified path validation.

* chore: revert other PR content from this branch

* docs: Update Chinese README.

* docs: Update Chinese README.

* docs: Update Chinese README.

* refactor: Reorder filesystem helper functions, extract directory entry formatting logic, and enhance `WriteFileTool`'s result message.

* feat: Enhance `mkdirAllInRoot` to prevent creating directories over existing files and add tests for directory creation functionality.

* Refactor filesystem tools to use a `fileReadWriter` interface for both host and sandboxed I/O, improving atomic writes and error handling.

* refactor: unify filesystem read/write operations with atomic write guarantees and clearer naming.

* refactor: rename `appendFileWithRW` function to `appendFile`

* refactor: unify filesystem access by introducing a `fileSystem` interface and updating tools to use it directly, removing `os.Root` dependency from `sandboxFs`.

* chore: run make fmt

* fix: `validatePath` now returns an error when the workspace is empty.
2026-02-23 20:09:53 +11:00
Vidish
4cc8b90da9
Fix: missing Tavily config in loop.go, and the invalid config param in web_search (#660) 2026-02-23 12:12:34 +08:00
Hoshina
e10b1e1fd4 feat(channels): add MediaSender optional interface for outbound media
Add outbound media sending capability so the agent can publish media
attachments (images, files, audio, video) through channels via the bus.

- Add MediaPart and OutboundMediaMessage types to bus
- Add PublishOutboundMedia/SubscribeOutboundMedia bus methods
- Add MediaSender interface discovered via type assertion by Manager
- Add media dispatch/worker in Manager with shared retry logic
- Extend ToolResult with Media field and MediaResult constructor
- Publish outbound media from agent loop on tool results
- Implement SendMedia for Telegram, Discord, Slack, LINE, OneBot, WeCom
2026-02-23 03:10:57 +08:00
Hoshina
afc7a1988f refactor(bus): fix deadlock and concurrency issues in MessageBus
PublishInbound/PublishOutbound held RLock during blocking channel sends,
deadlocking against Close() which needs a write lock when the buffer is
full. ConsumeInbound/SubscribeOutbound used bare receives instead of
comma-ok, causing zero-value processing or busy loops after close.

Replace sync.RWMutex+bool with atomic.Bool+done channel so Publish
methods use a lock-free 3-way select (send / done / ctx.Done). Add
context.Context parameter to both Publish methods so callers can cancel
or timeout blocked sends. Close() now only sets the atomic flag and
closes the done channel—never closes the data channels—eliminating
send-on-closed-channel panics.

- Remove dead code: RegisterHandler, GetHandler, handlers map,
  MessageHandler type (zero callers across the whole repo)
- Add ErrBusClosed sentinel error
- Update all 10 caller sites to pass context
- Add msgBus.Close() to gateway and agent shutdown flows
- Add pkg/bus/bus_test.go with 11 test cases covering basic round-trip,
  context cancellation, closed-bus behavior, concurrent publish+close,
  full-buffer timeout, and idempotent Close
2026-02-23 00:44:45 +08:00
Vidish
c6865fe852
feat: integrate Tavily search (#340)
* feat: integrate Tavily search

* fix: set include_raw_content to false in Tavily search as wealready get relevant data inside content

* refactor: update Go type declarations to `any`, apply formatting fixes.
2026-02-23 00:30:14 +08:00
King Tai
cb0c8703fb
test(tools,utils): add ToolRegistry unit tests and fix Truncate panic on negative maxLen (#517)
Add comprehensive unit tests for the ToolRegistry covering registration,
lookup, execution, context injection, async callbacks, schema generation,
provider definition conversion, and concurrent access.

Fix a defensive edge case in Truncate where a negative maxLen would cause
a slice bounds panic, and add table-driven tests covering boundary
conditions, zero/negative lengths, and Unicode handling.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-22 21:40:59 +11:00
yuchou87
672da984e5 Merge branch 'main' into mcp-tools-support 2026-02-22 14:48:07 +08:00
Hoshina
0066602294 fix: golangci-lint run --fix 2026-02-21 16:20:15 +08:00
Hoshina
3df7f70540 fix: golangci-lint fmt 2026-02-21 16:05:39 +08:00
yuchou87
246fdf3f33 fix(mcp): guard against nil result from CallTool
CallTool can return (nil, nil) if the underlying MCP library misbehaves.
Without a nil check, result.IsError would panic. Return an explicit error
ToolResult instead.
2026-02-21 13:40:55 +08:00
yuchou87
d867e86dbe Merge branch 'main' into mcp-tools-support
# Conflicts:
#	config/config.example.json
#	pkg/config/config.go
2026-02-21 13:28:15 +08:00
Meng Zhuo
273a8a2318
Merge pull request #550 from mymmrac/govet-linter
feat(linter): Fix govet linter
2026-02-21 08:20:35 +08:00
Goksu Ceylan
244eb0b47d
fix (security): ExecTool working_dir sandbox escape (#478)
* fix (security) Shell working_dir bypass

* Feedback from @mengzhuo & Discord
- reuse internal security package to validate path
- add tests for workspace escape
2026-02-21 08:15:46 +08:00
Artem Yadelskyi
02b4d9fbe2
feat(linter): Fix govet linter 2026-02-20 22:35:16 +02:00
Artem Yadelskyi
0675ce7c38
feat(fmt): Fix formatting 2026-02-20 20:03:11 +02:00
Artem Yadelskyi
ad8c2d48c8
Merge branch 'main' into fix-formatting
# Conflicts:
#	cmd/picoclaw/main.go
#	pkg/agent/context.go
#	pkg/agent/loop.go
#	pkg/channels/dingtalk.go
#	pkg/channels/feishu_64.go
#	pkg/channels/line.go
#	pkg/channels/manager.go
#	pkg/config/config.go
#	pkg/migrate/migrate_test.go
#	pkg/providers/anthropic/provider_test.go
#	pkg/providers/claude_provider_test.go
#	pkg/providers/http_provider.go
#	pkg/providers/openai_compat/provider.go
#	pkg/providers/protocoltypes/types.go
#	pkg/providers/types.go
2026-02-20 20:02:53 +02:00
Meng Zhuo
5b525f6139
Merge pull request #378 from lunareed720/fix/exec-timeout-process-tree
fix(exec): kill child process tree on timeout to prevent orphaned tasks
2026-02-20 23:32:05 +08:00
Truong Vinh Tran
e7d8975f1c feat: Add SearXNG search provider support
Implements SearXNG as a third web search provider to address Oracle Cloud
datacenter IP blocking issues and provide a cost-free, self-hosted alternative
to commercial search APIs.

Changes:
- Add SearXNGConfig struct with Enabled, BaseURL, and MaxResults fields
- Implement SearXNGSearchProvider with JSON API integration
- Update provider priority: Perplexity > Brave > SearXNG > DuckDuckGo
- Wire SearXNG configuration through agent tool registration
- Add default config values (disabled by default, empty BaseURL)

Benefits:
- Solves DuckDuckGo datacenter IP blocking (138 bytes redirect responses)
- Zero-cost alternative to Brave Search API ($5/1000 queries)
- Self-hosted solution with 70+ aggregated search engines
- Privacy-focused with no rate limits or API keys required
- Ideal for Oracle Cloud, GCP, AWS, and Azure VM deployments

The implementation follows the existing provider interface pattern and
maintains backward compatibility with all existing search providers.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-02-20 12:02:00 +01:00
Harsh Bansal
d692cc0cc6
Feature: Implement Skill Discovery - With Clawhub Integration and Caching (#332)
* Add Find Skills and Install Skills

* Improvements

* fix file name

* Update pkg/skills/clawhub_registry.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* fix

* Comments addressed

* Resolve comments

* fix tests

* fixes

* Comments resolved

* Update pkg/skills/search_cache_repro_test.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* minor fix

* fix test

* fixes

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2026-02-20 18:55:04 +08:00
yinwm
23c39f41df Merge upstream main into feat/refactor-provider-by-protocol
Resolved conflicts:
- pkg/config/config.go: Removed duplicate DefaultConfig() (already in defaults.go)
- pkg/config/defaults.go: Updated Temperature to *float64 (nil default)

Upstream changes included:
- Temperature changed from float64 to *float64 (nil means use provider default)
- New HeartbeatConfig and DevicesConfig
- Various agent and tool improvements

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-20 13:25:26 +08:00
Artem Yadelskyi
a896831903
feat(fmt): Fix formatting 2026-02-19 22:05:15 +02:00
Artem Yadelskyi
2038f04d0d
Merge branch 'main' into fix-formatting
# Conflicts:
#	pkg/agent/loop.go
#	pkg/agent/loop_test.go
#	pkg/channels/discord.go
#	pkg/channels/onebot.go
#	pkg/config/config.go
#	pkg/tools/subagent_tool_test.go
2026-02-19 22:04:48 +02:00
cointem
394d1d1197
fix: Templates update (#485)
* fix: add MaxTokens and Temperature fields to AgentInstance and update related logic

* feat: add MaxTokens and Temperature options to SubagentManager and update tool loop logic

* feat: add default temperature handling and update related tests

* feat: allow temperature 0 and distinguish unset

* fix: format MockLLMProvider struct in subagent_tool_test.go
2026-02-19 19:16:37 +01:00
yinwm
68cdafc5f2 refactor(providers): restructure provider creation with protocol-based configuration
- Move provider creation logic to factory_provider.go with protocol-based approach
- Add OpenAIProviderConfig with WebSearch support and embedded ProviderConfig
- Add maxTokensField to OpenAI-compatible provider for configurable token field
- Introduce new providers: Ollama, DeepSeek, GitHubCopilot, Antigravity, Qwen
- Remove redundant CreateProvider function from factory.go
- Add ThoughtSignature field to FunctionCall for tool response handling
- Remove duplicate Name field assignment in tool loop
- Update tests to reflect new provider configuration structure
2026-02-20 00:12:01 +08:00
yinwm
f8f1d539d4 Merge remote-tracking branch 'origin/main' into feat/refactor-provider-by-protocol 2026-02-20 00:11:46 +08:00
yuchou87
a5d2e109bf chore: merge main branch into mcp-tools-support
Resolved conflicts in:
- config/config.example.json: Added empty MCP config block
- pkg/config/config.go: Added MCP config structures to new ToolsConfig
- pkg/agent/loop.go: Integrated MCP tools with new AgentRegistry architecture

MCP tools now register to all agents in the registry during startup.
2026-02-19 19:06:37 +08:00
tpkeeper
12f0c4a6cf
fix: ensure tool name is correctly assigned in LLM iteration(missing tool call name in debug mode logs) (#454)
* fix: ensure tool name is correctly assigned in LLM iteration

* fix: ensure tool name is correctly included in assistant message
2026-02-19 12:06:09 +01:00
yuchou87
47533a00cd style: format code with gofmt 2026-02-19 18:53:24 +08:00
yinwm
ec86b21d3f fix: improve migration logic and reduce code duplication
- Preserve user's configured model during config migration (issue #5)
- Simplify ExtractProtocol using strings.Cut
- Extract NormalizeToolCall to shared utility, removing ~70 lines of duplicate code
- Clean up unused fields in providerMigrationConfig struct

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-19 09:22:39 +08:00
mattn
e8afd31b28
Replace \s+ with [^\S\n]+ to preserve newlines (#299) 2026-02-19 02:02:28 +01:00
Artem Yadelskyi
9e120f90ea
feat(fmt): Run formatters 2026-02-18 21:48:23 +02:00
Leandro Barbosa
b1e3b11a5d
Merge pull request #304 from mymmrac/golangci-lint
feat(linters): Added golangci-lint config & CI job
2026-02-18 12:16:58 -03:00
Leandro Barbosa
447c17aeb1 merge: sync upstream/main (PR #213) into feat/multi-agent-routing
Resolve conflicts in pkg/providers/types.go and pkg/agent/loop.go:
- types.go: use protocoltypes aliases from PR #213, keep fallback types
- loop.go: drop old single-agent createToolRegistry (replaced by multi-agent pattern)

Refactor to align with PR #213 patterns:
- instance.go: use NewExecToolWithConfig (accept full config for deny patterns)
- registry.go: pass full config to NewAgentInstance
- loop.go: add Perplexity web search options to registerSharedTools
2026-02-18 11:39:14 -03:00
Artem Yadelskyi
b88f4c9ab5
feat(linters): Fix linter 2026-02-18 16:24:55 +02:00
lxowalle
eda6e37332
feat: Support modifying the command filtering list of the exec tool (#410) 2026-02-18 19:31:15 +08:00
lxowalle
01d694b998
fix: Add comprehensive command injection and system abuse prevention patterns (#401)
* Add comprehensive command injection and system abuse prevention patterns

* fix: Container running as root
2026-02-18 15:33:34 +08:00
Luna Reed
acac1972e6 fix(exec): terminate process tree on timeout 2026-02-18 02:01:29 +08:00
mrbeandev
caf3913347 fix(antigravity): normalize tool calls to avoid empty function names 2026-02-17 20:05:35 +05:30
daming大铭
7b9b8104c8
Merge pull request #225 from yinwm/feat/cron-exec-timeout-config
feat(cron): add configurable execution timeout for cron jobs
2026-02-17 21:12:59 +08:00
yinwm
881999aceb refactor(shell): interpret zero timeout as unlimited execution
Replace unconditional WithTimeout usage with conditional context creation
based on timeout configuration. Zero values now bypass timeout enforcement,
using WithCancel for graceful cancellation while preserving existing timeout
behavior for positive values. Simplifies CronTool initialization by removing
unnecessary conditional timeout assignment.
2026-02-17 21:10:20 +08:00
Hua Audio
f929268ab2
feat: Add Perplexity search provider integration (#138)
* feat: Add Perplexity search provider integration

- Add PerplexityConfig struct to config package
- Add PerplexitySearchProvider implementing SearchProvider interface
- Update WebSearchTool to support Perplexity with priority system (Perplexity > Brave > DuckDuckGo)
- Update agent loop to pass Perplexity config options
- Update config.example.json with Perplexity configuration template
- Uses Perplexity's 'sonar' model for web search capabilities

* Edit config example

* make fmt

---------

Co-authored-by: Hua <zhangmikoto@gmail.com>
2026-02-17 21:02:56 +08:00
yinwm
684e7413e1 Merge remote-tracking branch 'origin/main' into feat/cron-exec-timeout-config 2026-02-17 20:53:31 +08:00
Leandro Barbosa
12007b5670 merge: sync upstream/main into feat/multi-agent-routing
Resolve conflicts:
- pkg/agent/loop.go: integrate context compression, command handling,
  utf8 token estimation, and summarization notification into
  multi-agent routing architecture
- pkg/config/config_test.go: merge imports from both branches
- pkg/agent/loop_test.go: update test to use registry-based sessions
2026-02-16 10:34:55 -03:00
yuchou87
02c1792015 fix(tools): preserve MCP tool InputSchema via JSON marshal/unmarshal
- Handle json.RawMessage and []byte types by direct unmarshal
- Use JSON marshal/unmarshal for struct types to preserve schema
- Add test case for json.RawMessage schema
- Fixes issue where non-map schemas returned empty object

This fixes GitHub Copilot feedback that Parameters() was dropping
tool schema when InputSchema wasn't already map[string]interface{}
2026-02-16 19:50:00 +08:00
yuchou87
20f8bb200b refactor(tools): use MCPManager interface in NewMCPTool constructor
- Change NewMCPTool to accept MCPManager interface instead of concrete *mcp.Manager
- Remove unused mcpPkg import from mcp_tool.go
- Remove newMCPToolForTest helper function as NewMCPTool now accepts interface
- Update all tests to use NewMCPTool directly with MockMCPManager
- Improves testability and follows dependency inversion principle
2026-02-16 19:43:05 +08:00
yuchou87
acb974fcf1 Merge branch 'main' into mcp-tools-support 2026-02-16 16:37:24 +08:00