917 Commits

Author	SHA1	Message	Date
HAL9000	66850665b7	fix(sandbox): split oversized step file and update CONTRIBUTORS.md ... Split checkpoint_manager_coverage_steps.py (692 lines) into three focused modules to comply with the 500-line file limit: - checkpoint_manager_coverage_steps.py: model, protocol, manager init, create_checkpoint, _snapshot_directory, and _cleanup_snapshot steps (408 lines) - checkpoint_manager_rollback_steps.py: rollback_to, list_checkpoints, and delete_checkpoint branch steps (283 lines) - checkpoint_manager_bug7488_steps.py: Bug #7488 sandbox_path auto-stored-in-metadata steps (59 lines) Also updated CONTRIBUTORS.md to document HAL 9000's contribution for bug fix #7488 as required by CONTRIBUTING.md guidelines. ISSUES CLOSED: #7488	2026-04-17 18:34:16 +00:00
HAL9000	beceb183d0	fix(sandbox): store sandbox_path in checkpoint metadata to enable rollback ... CheckpointManager.create_checkpoint() computed sandbox_path from sandbox.context.sandbox_path but never stored it in the metadata dict. This caused rollback_to() to always find metadata.get('sandbox_path') returning None, silently skip the rollback, and return False. The fix adds sandbox_path to the metadata dict immediately after it is resolved from the sandbox context, before the SandboxCheckpoint is constructed. rollback_to() can now retrieve the path and correctly restore the sandbox filesystem state. Added two new BDD scenarios to checkpoint_manager_coverage.feature: - Verifies sandbox_path is automatically stored in metadata on create - Verifies rollback succeeds without manually supplying sandbox_path ISSUES CLOSED: #7488	2026-04-17 18:33:39 +00:00
CoreRasurae	0c5b140d29	fix(database): include alembic files in package distribution ... Move alembic configuration and migration files from repository root into the Python package structure to ensure they are included in the wheel distribution. This fix resolves the FileNotFoundError when running `agents init` in Docker containers or any environment using the built wheel distribution. Changes: - Move alembic/ directory from repo root to src/cleveragents/infrastructure/database/migrations/ - Move alembic.ini to the same new location and update script_location setting - Update MigrationRunner._find_alembic_ini() to search from the new canonical location within the package - Update create_template_db.py to point to the new alembic.ini location - Update documentation references to reflect new migration file locations - Create __init__.py for migrations package - The env.py file is imported when running tests that verify all modules can be imported without errors. However, context.config is only available when alembic is actually running migrations, not during normal module imports. This caused an AttributeError when the test tried to import the migrations.env module. - Fix by using getattr() with a default value to safely access context.config, and guard all code that uses config with None checks. This allows the module to be safely imported while still functioning correctly during migrations. Testing: - Verified MigrationRunner can locate alembic.ini in new location - Tested agents init succeeds in creating project with database - Template database creation works correctly - All migration tests should pass without changes Alembic files now follow standard Python packaging conventions, making them automatically included in wheel distributions without special configuration. ISSUES CLOSED: #4180	2026-04-17 17:40:00 +00:00
hamza.khyari	bdd1ea4f3a	fix(checkpoint): wire CheckpointManager into PlanExecutor execution path ... CheckpointManager was never wired into PlanExecutor — the CLI factory constructed PlanExecutor without a checkpoint_manager (defaulted to None), silently skipping all checkpoint hooks. Fix: - Register CheckpointManager as Singleton in DI container - Resolve container singleton in _get_plan_executor() and pass to PlanExecutor constructor - Bridge infra→domain: _try_create_checkpoint() now persists last_checkpoint_id on the plan via _commit_plan(), raises PlanError if persistence fails - Default checkpointable=True for writable+sandboxable resources and write-capable tools (model_validators on ResourceCapabilities and ToolCapability) - Validate that non-writable/non-sandboxable resources cannot be checkpointable (ValueError guard) - Add post-execute A2A facade notification using plan.status to avoid duplicate execute→execute transition errors Tests: - 10 Behave scenarios covering DI wiring, singleton identity, checkpoint creation, plan metadata update, rollback, graceful fallback, no-arg constructor, capability defaults (positive + 2 negative) - Updated consolidated_resource, consolidated_skill, and Robot helper_skill_flatten for new checkpointable defaults ISSUES CLOSED: #1253	2026-04-17 11:46:38 +00:00
hurui200320	80c8636c4a	Revert "feat: add fallback to Anthropic Sonnet when OpenAI quota is exhausted" ... This reverts commit f5712787e0.	2026-04-17 18:00:47 +08:00
hurui200320	ed7276773e	Merge branch 'master' into fix/plan-diff-correction-stub	2026-04-17 09:38:13 +00:00
hurui200320	1fda56b778	fix(cli): implement plan diff --correction to show real correction attempt diff ... Implement spec-compliant correction diff output for `agents plan diff --correction <CORRECTION_ATTEMPT_ID>`. Fixes the following issues from the cycle-1 PR review: - C1/M1: Replace direct `unit_of_work.correction_attempts` access with the proper `unit_of_work.transaction()` context manager, eliminating the AttributeError crash and the resource (session) leak. - C2: Add `unit_of_work: UnitOfWork | None = None` constructor parameter to `PlanApplyService` and wire it in `_get_apply_service()` via `container.unit_of_work()`, removing the illegal `get_container()` call inside the method body (ADR-003 DI violation). - C3: Replace metadata serialization stub with a three-section structured diff (Correction Diff summary, Comparison table, Patch Preview) as specified in §agents plan diff of the specification. - C4/M2: Add `features/plan_correction_diff.feature` with 6 BDD scenarios covering all 4 output formats plus plan-not-found and correction-not-found error paths. - C5: Update the three existing BDD scenarios that tested old stub behavior to mock `_get_apply_service()` and assert the new output. - C6: Rename branch to `bugfix/m4-plan-diff-correction-stub` per CONTRIBUTING.md convention. - C7: Amend commit message with body and ISSUES CLOSED footer. - C8: Narrow `except Exception` to `except CorrectionAttemptNotFoundError` to avoid masking programming errors. - M3: Add `robot/plan_correction_diff.robot` and `robot/helper_plan_correction_diff.py` integration test covering rich, plain, and JSON formats and the not-found error path. - M4: Type `_build_correction_diff_dict` parameter as `CorrectionAttemptRecord` instead of `Any`. - M5: Change `fmt: str` to `fmt: Literal["rich", "plain", "json", "yaml"]` on both `diff()` and `correction_diff()`, with a `cast()` call in the CLI layer where Typer supplies a plain `str`. - M6: Add `ValueError` guards for empty `plan_id` and `correction_attempt_id` at the top of `correction_diff()`. - M7: Add blank line between `diff()` and `correction_diff()` method definitions. - M8: Update PR description to reflect actual implementation. - m1: Remove unused `plan` variable in `correction_diff()`. - m2: Reduce three blank lines to two between top-level definitions in `plan_apply_service.py`. - n1: Remove trailing whitespace from blank line in `plan.py`. Quality gates: lint (ruff), typecheck (pyright strict), unit_tests (Behave 632 features / 0 failures) all pass. ISSUES CLOSED: #9085	2026-04-17 08:34:33 +00:00
hurui200320	8953449dc2	fix(actor): validate v3 YAML via ActorConfigSchema in agents actor add CLI ... - schema.py: provider field changed to Optional[str] with model validator validate_provider_required_for_llm_graph() that requires it only for LLM and GRAPH actor types; TOOL actors do not require provider - schema.py: is_v3_yaml() uses version_str == "3" or version_str.startswith("3.") to avoid false positives from "30" or "300" version strings - schema.py: tool namespace validation uses strict 2-part split to reject empty namespace or empty name (e.g. "/tool", "ns/", "a/b/c") - cli/commands/actor.py: schema_version extraction uses raw_version pattern (no # type: ignore[assignment]) for clean static typing - actor/__init__.py: is_v3_yaml removed from __all__ and _LAZY_IMPORTS since it is a module-private helper, not a public API - robot/actor_add_v3_schema_validation.robot: YAML fixtures for 'Reject v3 LLM Actor Without Model Field' and 'Reject v3 TOOL Actor Without Tools Field' now include required provider field (and model for TOOL fixture) - robot/helper_actor_add_v3_schema_validation.py: except clauses unified to catch (subprocess.TimeoutExpired, FileNotFoundError) in both add_actor() and update_actor() functions - features/actor_add_v3_schema_validation.feature: 'Update a v3 actor with valid YAML succeeds' scenario now includes 'And the actor should be validated via ActorConfigSchema'; error assertions tightened to exact messages (e.g. "Input should be 'llm', 'tool' or 'graph'", "Node ID must be alphanumeric", "must be namespaced") - features/steps/actor_add_v3_schema_validation_steps.py: step_run_actor_update now spies on ActorConfigSchema.model_validate; failure paths assert isinstance(result.exception, SystemExit) ISSUES CLOSED: #5869	2026-04-17 16:28:45 +08:00
HAL9000	e18ac5f23c	fix(security): replace startswith sandbox check with Path.relative_to() in validate_path #7558 ... The validate_path() function in file_tools.py used str.startswith() to verify that a resolved path stays within the sandbox root. This allowed sibling directories whose names share a string prefix with the sandbox (e.g. /tmp/sandbox-escape/ bypassing /tmp/sandbox/) to escape the containment check. Replace the string prefix check with Path.relative_to(root), which performs a proper OS-level path prefix comparison using path separators. Add a Behave regression scenario tagged @tdd_issue @tdd_issue_7558 that exercises the prefix-collision bypass to prevent regressions. ISSUES CLOSED: #7558	2026-04-17 04:50:55 +00:00
CoreRasurae	f5712787e0	feat: add fallback to Anthropic Sonnet when OpenAI quota is exhausted ... Implements graceful degradation for E2E robot integration tests that hit OpenAI 429 quota limit errors. Changes: - Add _is_quota_error() helper to detect quota-specific API errors (429, insufficient_quota, rate_limit) - Modify _execute_with_llm() in StrategyActor to catch quota errors and attempt fallback to Anthropic Haiku - Configure fallback provider as 'anthropic/claude-sonnet-4-20250514' - Add comprehensive logging for quota error detection and provider fallback - Add E2E test scenarios for quota fallback verification When quota errors occur on both OpenAI and Anthropic fallback, tests now fail with a clear message explaining that the test outcome cannot be verified when no LLM provider is available. This ensures CI/CD pipelines properly track which tests could not be executed due to quota constraints, rather than silently skipping them and creating false confidence in test coverage. This ensures CI/CD pipelines can complete E2E tests even when the primary provider (OpenAI) hits quota limits, improving pipeline reliability and reducing false negatives caused by provider-specific issues. 1. **Cache fallback_llm instance** - Instead of recreating the fallback LLM every time a quota error occurs, cache it as an instance variable (self._fallback_llm). This avoids unnecessary re-initialization overhead. 2. **Implement quota recovery logic** - Add intelligent recovery behavior: - Track last quota error timestamp (self._last_quota_error_time) - Track fallback mode state (self._using_fallback) - Once quota error detected, switch to fallback provider - Only attempt to recover primary provider every 5 minutes (_QUOTA_RECOVERY_INTERVAL) - This avoids hammering primary provider with repeated quota errors 3. **Add detailed recovery logging** - Log quota fallback transitions and recovery attempts to improve observability and debugging. Benefits: - Reduced latency: No redundant primary provider calls after quota error - Reduced overhead: Cached fallback LLM instance, no per-call recreation - Better observability: Clear logging of fallback mode entry/exit - Intelligent recovery: Automatic recovery attempt after 5-minute interval Updated tests: - M6 E2E Event Queue Via Plan Lifecycle Transitions - M6 E2E Hierarchical Decomposition Via Plan Tree - M6 E2E Full Autonomy Acceptance Flow Fixes: #10042	2026-04-17 03:56:35 +00:00
HAL9000	cef70ff98a	fix(security): add Robot integration test and CONTRIBUTORS for #7476 ... Add Robot Framework integration test verifying that load_from_entry_points does not call ep.load() for entry points with disallowed module prefixes (security regression test for issue #7476). Also add HAL 9000 to CONTRIBUTORS.md per CONTRIBUTING.md process rules. ISSUES CLOSED: #7476	2026-04-15 06:37:18 +00:00
HAL9000	717a05f604	fix(security): fix plugins/loader.py load_from_entry_point security #7476 ... Parse entry point targets before import so allowlist enforcement happens prior to execution and add a Behave regression scenario covering the disallowed-prefix path. ISSUES CLOSED: #7476	2026-04-15 06:37:18 +00:00
hurui200320	f67e8a2e07	fix(testing): document and harden non-AssertionError guard in apply_tdd_inversion to reduce flaky CI ... Surface the non-AssertionError guard warning in standard Behave output by emitting to stderr in addition to the structured logger, and add infrastructure coverage that asserts this guard path is visible during test runs. Document the @tdd_expected_fail expectation that bug-signaling failures must use AssertionError so infrastructure exceptions are not accidentally treated as expected bug failures. ISSUES CLOSED: #8294	2026-04-15 13:37:16 +08:00
hurui200320	8b2e0c81c5	fix(testing): print behave-parallel worker logs only for failed chunks ... In parallel mode, the behave runner previously replayed captured stdout/stderr for every worker chunk, creating noisy output that obscured failure diagnostics in CI and local runs. Changes to scripts/run_behave_parallel.py: - Added _chunk_has_failures() and _chunk_no_scenarios_ran() helpers to evaluate individual chunk summaries for failure/error/crash conditions. - Updated the aggregation loop in main() to conditionally replay captured stdout/stderr only for chunks whose summary indicates failures, errors, or no scenarios ran (crash detection). Passing chunks now suppress their output entirely. - Added robust exception handling in _worker_run_features() so that worker crashes produce a full traceback in stderr and return a crash summary with features.errors = 1, enabling the parent to detect the crash via _chunk_has_failures (and also _chunk_no_scenarios_ran, since no scenarios reached a terminal state) and replay the diagnostics. - The conditional replay uses summary-based checks rather than the raw runner.run() boolean, consistent with the existing exit-code logic. This avoids spurious log replay for @tdd_expected_fail scenarios whose runner.run() returns True even though the TDD inversion handler has corrected the scenario status to passed. - Existing summary merge, exit semantics, and the no-scenarios safety net are fully preserved. New Behave unit tests (17 scenarios) cover the chunk-level helpers, the conditional aggregation loop, the pure no-scenarios-ran path, stderr replay for non-crash failed chunks, and the worker crash path. New Robot integration tests (6 test cases) verify the same behavior end-to-end via the helper_behave_parallel_log_filtering.py script. Also updated: - CHANGELOG.md: add unreleased entry for this behavioral change. - features/steps/behave_parallel_log_filtering_steps.py: use contextlib.redirect_stdout/redirect_stderr instead of manual sys.stdout assignment; register module in sys.modules; document CWD requirement in _load_runner_module(). - robot/helper_behave_parallel_log_filtering.py: move import io to top-level; remove redundant inline imports; use contextlib for output capture; register module in sys.modules; document CWD requirement. Branch note: the canonical branch for this fix is bugfix/m3-behave-parallel-failed-chunk-logs. The PR head branch (bugfix/mX-behave-parallel-failed-chunk-logs) cannot be renamed via the Forgejo API; both branches are kept in sync at the same SHA. ISSUES CLOSED: #8351	2026-04-15 03:21:05 +00:00
HAL9000	0f75429253	fix(concurrency): add thread safety to ContextTierService ... Implemented thread-safety improvements for ContextTierService by introducing a re-entrant lock and guarding all critical sections with self._lock. This prevents RuntimeError: dictionary changed size during iteration under concurrent plan execution. - Added threading.RLock to ContextTierService.__init__ as self._lock - Wrapped all public methods (store, get, promote, demote, evict_lru, get_metrics, get_all_fragments, get_hot_fragments, get_for_actor, get_scoped_view) with with self._lock: - Added _lock: threading.RLock type stub to TierRuntimeMixin and ScopedTierMixin - Wrapped enforce_staleness in TierRuntimeMixin with self._lock - Wrapped get_scoped_by_resource and get_scoped_metrics in ScopedTierMixin with self._lock - Extracted settings helpers to new context_tier_settings.py to keep context_tiers.py under 500 lines - Added BDD feature file context_tier_thread_safety.feature with 10 thread-safety scenarios - Added step definitions context_tier_thread_safety_steps.py - Updated CHANGELOG.md with fix entry ISSUES CLOSED: #7547	2026-04-15 00:24:13 +00:00
HAL9000	9aad085b74	fix(cli): add missing "✓ OK" footer to agents plan errors rich output ... ISSUES CLOSED: #9355	2026-04-14 21:36:35 +00:00
CoreRasurae	d3cb534caf	feat(plan): implement LLM-powered strategy actor ... Implement StrategyActor class for the plan strategize phase that uses an LLM to produce hierarchical execution strategies with dependencies, resource requirements, estimated complexity, and risk scores. Key components: - StrategyActor: Core actor with LLM prompt construction, response parsing (JSON and numbered-list fallback), and graceful degradation to StrategizeStubActor when no LLM provider is configured - StrategyAction/StrategyTree: Pydantic models for the hierarchical action tree with dependency links - validate_no_cycles(): Kahns algorithm (deque-based) for dependency graph cycle detection, raising PlanError on circular dependencies - build_strategy_prompt(): Context-aware prompt construction using definition_of_done, resources, project context, and ACMS analysis with XML-delimited user content sections for prompt injection hardening - parse_strategy_response(): Robust LLM output parsing with JSON extraction and numbered-list fallback - resolve_strategy_actor(): Integration point for the existing actor.default.strategy config key (CLEVERAGENTS_DEFAULT_STRATEGY_ACTOR) - Decision conversion producing strategy_choice Decision objects - build_decisions() preserves tree hierarchy via parent_id mapping, populates downstream_decision_ids from dependency edges, and validates plan_id Structural tree hierarchy (B2 review fix): - _build_tree infers parent_id from the dependency graph: each actions first resolved dependency becomes its structural parent. Actions with no dependencies fall back to the root. This produces hierarchical trees for agents plan tree rendering per spec Plan Decision Tree. Downstream decision tracking (B3 review fix): - build_decisions populates downstream_decision_ids from the strategy trees dependency edges using a pre-generated decision_id map so influence relationships between decisions are recorded per the spec Decision Record Structure. Post code-review hardening (PR #1175): - Broadened exception handling in execute() and ACMS retrieval to catch all LLM provider errors (openai, httpx, anthropic, etc.) with graceful fallback to stub mode (H1, H2) - Added warning log for unresolvable dependency references so dropped edges are visible in structured logs (H3) - Added XML-delimited user content sections and explicit data-only instructions in system prompt for prompt injection hardening (H4) - Switched prompt truncation to word-boundary-safe _truncate_at_word() for all prompt input sections (M1) - Fixed _parse_actor_name to preserve user-specified provider or model when only one segment is empty, instead of discarding both (M2) - Annotated _build_invariant_records as placeholder pending the Invariant Reconciliation Actor implementation (M5) - Documented resources/project_context params as future-wired through PlanExecutor.run_strategize() (M8) - Added docstring noting supersession relationship with LLMStrategizeActor in llm_actors.py (M9) - Added __all__ export definition (L2) - Improved validate_no_cycles docstring edge direction semantics (L7) - Cap JSON parse retry loop at _MAX_JSON_PARSE_RETRIES (10) Post second code-review hardening (PR #1175, review cycle 2): - Fixed _truncate_at_word docstring: documented max_chars >= 3 precondition for the result-length guarantee (R-H1) - Added warning log in build_decisions for unresolvable parent_id references, matching the existing _build_tree warning for unresolvable dependency references (R-H2) - Fixed _parse_actor_name to handle whitespace-only input by adding actor_name.strip() check alongside the emptiness check (R-M1) - Tightened ACMS scenario assertions from non-empty to expected count of 5 decisions (R-L3) - Added timeout=60s on_timeout=kill to all Robot test cases for consistency with project patterns (R-M5) Post third code-review hardening (PR #1175, review cycle 3): - Added _sanitize_xml_content() to escape XML special characters (<, >, &) in user content before embedding into XML-delimited prompt sections, preventing prompt injection via forged closing tags (spec Prompt Injection Mitigation) (CR3-M1) - Upgraded _try_parse_json() to multi-anchor retry: collects all [{ positions left-to-right and tries each as a candidate start, fixing false-start anchoring when LLM preamble contains [{ fragments before the real JSON array (CR3-M2) - Added _truncate_at_word() guard for max_chars < 3: returns a hard slice instead of word-boundary truncation when the ellipsis would exceed the limit (CR3-L2) - Changed _build_tree collision fallback key from -(idx+1) to -(1_000_000+idx) to eliminate theoretical collision with LLM-produced negative step numbers (CR3-L3) - Added forward-looking API docstring note to build_decisions() documenting that it is not yet wired into PlanExecutor and will be integrated once Decision persistence lands (CR3-M3) Post fourth code-review hardening (PR #1175, review cycle 4): - Fixed _try_parse_json per-anchor retry counter: reset retries=0 at the start of each anchor iteration so false-start [{ anchors in LLM preamble text no longer exhaust the retry budget for the correct anchor (CR4-B1) - Added known-limitations docstring to module header documenting missing decision types (resource_selection, subplan_spawn, invariant_enforced) as future work (CR4-D1) - Rewrote XML injection assertion in test to use regex extraction instead of fragile chained .split() calls that could IndexError on structural changes (CR4-T5) Post fifth code-review hardening (PR #1175, review cycle 5): - Added warning log in build_decisions for empty-string parent_id (distinct from None) so the silent fallback to root is visible in structured logs for debuggability (CR5-B1) - Added plan_id propagation assertion to build_decisions test scenarios verifying decision.plan_id matches the input (CR5-T1) - Added sequence_number monotonicity assertion verifying decision sequence_numbers are zero-indexed and monotonically increasing (CR5-T2) - Added _truncate_at_word boundary test for max_chars=3 (exactly ellipsis length) verifying correct "..." output (CR5-T3) - Tightened false-start anchor test from permissive len>=1 to specific description match "Sole real action" (CR5-T4) - Added word-boundary truncation test using space-separated input to exercise the rfind(" ") path under oversized DoD (CR5-T5) Post sixth code-review hardening (PR #1175, review cycle 6): - Added _MAX_INVARIANTS cap (100) for invariant list truncation in prompt to prevent token limit overflows, consistent with other prompt section caps (CR6-M4) - Added negative max_chars guard in _truncate_at_word returning empty string instead of slicing from end (CR6-M5) - Added global JSON parse attempt cap _MAX_GLOBAL_JSON_ATTEMPTS (50) across all anchors in _try_parse_json (CR6-L3) - Moved re import to module level in strategy_parsing.py per CONTRIBUTING import guidelines (CR6-L4) - Extracted _DEFAULT_DESCRIPTION constant to eliminate duplication between _default_action() and _build_tree() (CR6-L5) Post seventh code-review hardening (PR #1175, review cycle 7): - Decoupled _execute_stub from StrategizeStubActor._parse_steps private method by delegating to parse_strategy_response, removing cross-class private method dependency (CR7-M1) - Added ULID format validation on plan_id in execute() and build_decisions() for spec-consistent argument validation per §Plan glossary and CONTRIBUTING §Argument Validation (CR7-M2) - Constrained StrategyAction.estimated_complexity to Literal["low", "medium", "high"] at Pydantic model level per CONTRIBUTING §Type Safety (CR7-M5) - Documented XML-tag prompt boundary deviation from spec [USER_CONTENT_START]/[USER_CONTENT_END] markers with rationale for the more structured approach (CR7-M6) - Added _build_tree empty-input guard comment documenting orphaned root_id semantics (CR7-L1) - Added _truncate_at_word > 0 intent comment explaining why position-0 space is intentionally excluded (CR7-L2) - Added build_decisions context_snapshot future-work comment referencing spec §Decision Record Structure (CR7-L5) - Used enumerate() in _build_tree first loop for idiomatic Python (CR7-L7) - Fixed false-start anchor test (CR5-T4) broken by CR6-L3 global cap: reduced preamble fragments from 15 to 3 so total attempts stay within _MAX_GLOBAL_JSON_ATTEMPTS (CR7-T1) - Fixed test plan_ids containing non-Crockford-Base32 characters (L→K) to pass ULID format validation (CR7-T2) Tests: - 105 Behave BDD scenarios in features/strategy_actor_llm.feature adding: global JSON attempt cap exhaustion (CR7-L3), orphaned dependency edge silent drop (CR7-L4), non-ULID plan_id rejection in execute() and build_decisions() (CR7-M2) - 101 Behave BDD scenarios in features/strategy_actor_llm.feature including new scenarios for _truncate_at_word edge cases (L3), create_llm argument verification (L4), non-numeric step field fallback (L5), updated assertions for XML-delimited prompts and _parse_actor_name partial-segment preservation (M2), lifecycle exception fallback (R1), PydanticValidationError re-raise verification (R2), self-loop cycle detection (R3), whitespace-only actor name (R4), XML tag injection sanitisation (CR3-M1), preamble bracket fragment parsing (CR3-M2), _truncate_at_word sub-3 limit (CR3-L2), resolve_strategy_actor with both llm config and registry (CR3-L5), build_decisions unresolvable parent_id fallback (CR3-L7), XML injection in resources/project_context/acms_context fields (CR4-S1), ampersand escaping (CR4-S1d), false-start anchor retry budget (CR4-T3), non-sequential step edge specificity (CR4-T4), plan_id propagation (CR5-T1), sequence_number monotonicity (CR5-T2), max_chars=3 boundary (CR5-T3), false-start anchor specificity (CR5-T4), word-boundary truncation (CR5-T5), invariant prompt constraints (CR6-M2), invariant XML sanitisation (CR6-M3), invariant truncation cap (CR6-M4), negative max_chars (CR6-M5), and no-space truncation (CR6-L8) - 7 Robot Framework integration tests in robot/strategy_actor.robot - Mock LLM provider in features/mocks/mock_strategy_llm.py All nox stages pass: lint, typecheck, unit_tests (13789 scenarios), integration_tests (1863 passed). integration_tests (1863 passed, 2 pre-existing TDD failures unrelated to this change). ISSUES CLOSED: #828	2026-04-14 19:26:49 +00:00
HAL9000	3cfa24854a	fix(concurrency): fix SubplanExecutionService._execute_parallel() #7582 ... Ensure fail_fast cancels in-flight futures and reports them as CANCELLED. Add Behave coverage that reproduces the concurrency regression. ISSUES CLOSED: #7582	2026-04-14 02:51:16 +00:00
HAL9000	c0d631b6cc	fix: custom automation profiles silently fall back to manual ... _resolve_profile_for_plan in PlanLifecycleService now raises a clear ValidationError when a plan's automation profile name is not a known built-in profile, instead of silently falling back to 'manual'. Users who configured custom automation profiles (e.g. 'semi-auto', 'acme/strict') will now receive an actionable error message listing available built-in profiles. The resolved profile name is also logged at debug level for observability. Added BDD regression tests (8 scenarios) covering: - Built-in profiles resolve correctly - Plans with no profile set resolve to 'manual' - Custom/unknown profile names raise ValidationError - Error message mentions the unknown profile name - Error message lists available built-in profiles - Debug log records the resolved profile name ISSUES CLOSED: #8232	2026-04-13 21:16:55 +00:00
hurui200320	2005b8ef82	feat(tests): replace all @skip tags with proper @tdd_expected_fail tags or remove them across the entire codebase (#7221) ... ## Summary Replaces all 234 bare `@skip` occurrences across 82 Behave feature files with the correct TDD issue-capture tagging system described in CONTRIBUTING.md § Bug Fix Workflow. Previously, the noxfile ran Behave with `--tags=not @skip`, silently excluding all `@skip`-tagged scenarios from every CI run. These tests never ran, never inverted results via the `@tdd_expected_fail` mechanism, and never contributed to coverage — defeating the purpose of TDD issue-capture testing. Every `@skip` occurrence had a commented-out hint line immediately above it showing the intended proper tags (e.g., `# @tdd_issue @tdd_issue_4272 @tdd_expected_fail @skip`), confirming they were all intended for conversion. ## Changes ### Mechanical conversion (234 replacements across 82 files) - Extracted the proper TDD tags from the comment hint above each `@skip` line, removed `@skip` from the tag set, and replaced the `@skip` line with those tags. - Removed the now-redundant comment hint lines alongside each replacement. ### Bug-fixed scenarios — `@tdd_expected_fail` removed (84 scenarios) - After conversion, ran `nox -s unit_tests` to identify which newly-enabled `@tdd_expected_fail` scenarios now **pass** (their referenced bugs have already been fixed). Removed `@tdd_expected_fail` from those 84 scenarios and their corresponding feature-level tags, leaving only the permanent `@tdd_issue @tdd_issue_<N>` regression-guard tags. - Affected features include: `tdd_tool_runner_env_precedence`, `tdd_automation_profile_session_leak`, `tls_certificate_check`, `project_create_persist`, `resource_type_bootstrap_*`, and 18 others. ### Noxfile cleanup - Removed all four `--tags=not @skip` arguments from `noxfile.py` (unit_tests and coverage sessions). With zero `@skip` tags remaining in the codebase, this filter was dead code and its presence would mislead future maintainers into thinking `@skip` is still a supported escape mechanism. ### Regression guard files - Split the regression guards into two focused files: - `tdd_regression_guards_exec_env.feature` for bug #4281 (exec-env precedence) - `tdd_regression_guards_session_list.feature` for bug #4271 (session list summary) - Each file carries only its own `@tdd_issue` tags at the feature level, avoiding cross-contamination via Behave tag inheritance. The `Background` step (`session-list-summary mock`) only appears in the session-list file where it is actually needed. ### Duplicate tag cleanup - Removed duplicate `@tdd_issue @tdd_issue_4287` tag lines in `tdd_skill_add_regression.feature` (lines 20 and 29). ### Inline comment for retained `@tdd_expected_fail` - Added inline comment in `ci_workflow_validation.feature:134` explaining why this specific #4227 scenario retains `@tdd_expected_fail` despite #4227 being closed (CI YAML does not encode threshold as a machine-readable value). ### Known edge cases — `@tdd_expected_fail` retained (closed issues, fix on master, scenarios still fail) The following issues are **closed** and their fixes **are on master**, but the specific test assertions still fail because the fixes address other aspects of the bugs. The `@tdd_expected_fail` tags are functionally correct and must remain until the specific scenario assertions pass: - `tdd_exec_env_resolution_precedence.feature` — bug #1080 (closed 2026-03-31). The precedence-level-2-vs-4 scenario still fails. - `session_list_summary_dedup.feature` — bug #3046 (closed 2026-04-05). The dedup-consistency scenarios still fail. - `actor_add_update_enforcement.feature` — bug #2609 (closed 2026-04-05). The enforcement scenarios still fail. - `ci_workflow_validation.feature:134` — #4227 (closed 2026-04-08). The CI YAML threshold assertion still fails. ## Verification - `grep -r "@skip" features/ --include="*.feature"` → **zero results** ✓ - `grep -n "tags=not @skip" noxfile.py` → **zero results** ✓ - `nox -s unit_tests` → **629 features passed, 0 failed** ✓ (up from ~545 before this PR) - CI all green (coverage ≥ 97%) ✓ - Integration tests (Robot Framework) do not use `@skip` — confirmed no action needed ✓ - E2E tests (Robot Framework) do not use `@skip` — confirmed no action needed ✓ - `CHANGELOG.md` updated with entry for this change ✓ - `CONTRIBUTORS.md` — Rui Hu already listed ✓ ## Issues Addressed Closes #7025 Co-authored-by: CleverThis <hal9000@cleverthis.com> Reviewed-on: #7221 Reviewed-by: HAL 9000 <HAL9000@cleverthis.com> Reviewed-by: HAL9001 <hal9001@cleverthis.com> Co-authored-by: Rui Hu <rui.hu@cleverthis.com> Co-committed-by: Rui Hu <rui.hu@cleverthis.com>	2026-04-13 04:56:01 +00:00
HAL9000	8402279596	fix(data-integrity): fix validation_apply.py all_required_ fields #7508 ... ISSUES CLOSED: #7508	2026-04-12 08:15:49 +00:00
HAL9000	e19c6a203c	fix(cli): add deleted_at field to project delete JSON/YAML output (#6314) ... ISSUES CLOSED: #6314	2026-04-10 18:59:10 +00:00
CoreRasurae	527c5903a0	fix(cli): display full ULIDs in plan tree output for CLI usability ... Modified the agents plan tree command to display full 26-character ULIDs instead of truncating them to 8 characters. This enables users to copy decision IDs directly from the tree output and use them in follow-up CLI commands without manual ID reconstruction. Key changes: - Removed [:8] truncation from all decision ID displays (table, tree) - Updated table column width from 8 to 26 characters for full ULID display - Removed [...] truncation from plan ID in tree title - Added 'Decision IDs (for correction)' section listing all decision ULIDs with human-readable labels for easy reference - Supports both rich (with panel) and plain text formatting - Helper function _get_decision_label() generates appropriate labels based on decision type - Updated CHANGELOG.md per CONTRIBUTING.md requirements ISSUES CLOSED: #5825	2026-04-10 18:57:41 +01:00
hurui200320	51aab18411	fix(testing): add guard logic to Robot tdd_expected_fail listener to prevent flaky CI ... Add three guard conditions to the Robot Framework tdd_expected_fail_listener end_test() function, paralleling the Behave apply_tdd_inversion() guards in features/environment.py. These guards prevent the listener from blindly inverting ALL test failures to passes, which was masking infrastructure errors and causing flaky CI behavior. Guards added: 1. Setup/teardown error guard (_has_setup_teardown_failure): checks result.setup/teardown status and message prefix to detect infrastructure failures where the test body never executed. 2. Non-assertion failure guard (_is_infrastructure_error): checks result.message against known infrastructure error patterns (keyword resolution errors, Python exception types, network errors) to avoid inverting failures that are not the captured bug. 3. Dry-run guard: detects Robot Framework dry-run mode by checking if all body keywords have status NOT RUN, preventing meaningless inversions when no test actually executed. Also fixes collateral issues exposed by the guards: - Fixed Variable Should Exist syntax error in e2e test files (single space was being parsed as part of keyword name instead of separator) - Removed tdd_expected_fail from 4 context assembly e2e tests where the bugs appear to be fixed (previously masked by syntax error + blind inversion) ISSUES CLOSED: #5436	2026-04-10 05:21:24 +00:00
HAL9000	03e56f9e34	Merge branch 'master' into fix/container-instance-stop	2026-04-10 00:18:30 +00:00
hamza.khyari	06428a5db6	feat(plan): implement git worktree sandbox for execute and merge-based apply ... Replace flat shutil.copy2 apply with spec-aligned git worktree flow (specification.md §13225-13276): Execute phase: creates an isolated git worktree via GitWorktreeSandbox for the plan's linked git-checkout resource. LLM file output is written to the worktree and committed on branch cleveragents/plan-<plan_id> — no merge yet. Apply phase: merges the worktree branch into the project's current branch via git merge. Prints spec-aligned panels: - Apply Summary: Plan ID, artifacts count, insertions/deletions, project name, applied-at timestamp - Sandbox Cleanup: worktree removed, branch merged to main - Footer: ✓ OK Changes applied Non-git projects (fs-directory resources) fall back to the original flat directory sandbox with shutil.copy2. Also fixes: - context_tier_hydrator metadata types (int/float → string) that caused Pydantic validation errors during context assembly - A2A facade duplicate execute dispatch (idempotent handler) - Logs actual error from context assembly failures ISSUES CLOSED: #4454	2026-04-09 14:17:50 +00:00
hamza.khyari	5d0e739e43	fix(acms): wire ACMS indexing pipeline into CLI so ContextTierService is populated during plan execution ... ContextTierService started empty on every CLI invocation, so the LLM received zero file context during plan execution (bug #1028). - Add context_tier_hydrator.py: reads files from linked project resources (via git ls-files or os.walk) and stores them as TieredFragment objects in the tier service. Respects max file size (256 KB), total budget (10 MB), binary exclusion, and .git/node_modules/__pycache__ skipping. - Wire hydration into LLMExecuteActor.execute() via lazy import (avoids M1 E2E regression from top-level import). - Inject tier_service, project_repository, resource_registry into LLMExecuteActor from the DI container in _get_plan_executor(). - Add tier_service property to ExecutePhaseContextAssembler. - Suppress exc_info traceback rendering in context warnings to prevent false-positive crash detection in M1 E2E tests. - Add sandbox file-writing support in plan apply (path traversal guards, protected directory skipping). - Add 6 Behave scenarios for context tier hydration. Closes #1028	2026-04-09 13:00:47 +00:00
hurui200320	ee2024046f	fix(plan): upsert action arguments during plan use to avoid UNIQUE constraint violation (#4197) ... ## Summary `agents plan use` crashed with `sqlite3.IntegrityError: UNIQUE constraint failed: action_arguments.action_name, action_arguments.name` when the action had arguments already registered via `action create`. The root cause was `ActionRepository.update()` using SQLAlchemy's relationship `.clear()` + `.append()` pattern, which deferred the DELETE and processed the INSERT first — triggering a UNIQUE constraint violation when the same `(action_name, name)` pair was being re-inserted. ## Approach Replace the `.clear()` + `.append()` pattern with explicit bulk `sa_delete()` + `session.flush()` before re-inserting child rows for both `action_arguments` and `action_invariants`. After the flush, expire the relationship collections with `session.expire(row, ["arguments_rel", "invariants_rel"])` so SQLAlchemy reloads from the now-empty database state before appending replacements. This avoids stale identity map references and guarantees the DELETE is committed before any INSERT. ## Key Changes ### Bug fix (`src/cleveragents/infrastructure/database/repositories.py`) - `ActionRepository.update()` now uses `sa_delete(ActionArgumentModel)` and `sa_delete(ActionInvariantModel)` with `synchronize_session=False`, followed by `session.flush()`, before re-inserting child rows. - Targeted `session.expire(row, ["arguments_rel", "invariants_rel"])` replaces the removed `.clear()` calls to force collection reload. ### Schema parity (`src/cleveragents/infrastructure/database/models.py`) - Added `UniqueConstraint("action_name", "position")` to `ActionInvariantModel`. - Added `UniqueConstraint("action_name", "name")`, `CheckConstraint` for `arg_type`, and `CheckConstraint` for `requirement` to `ActionArgumentModel`. ### Alembic migration (`alembic/versions/a5_006_action_invariants_unique_constraint.py`) - New migration adds all four constraints to both `action_invariants` and `action_arguments` tables. - Includes deduplication guards and data normalization so the upgrade succeeds on existing databases with invalid or duplicate rows. - Uses `batch_alter_table` for SQLite compatibility. ### Tests - **Behave** (`features/plan_use_action_args_integrity.feature`): 6 scenarios covering the core bug path, zero-argument regression, multiple arguments, reusable action double-use, non-reusable action archival with invariants, and direct repository update. - **Robot** (`robot/plan_use_action_args_integrity.robot`): Integration test mirroring the Behave scenarios via a helper script. - **Shared factory** (`features/mocks/test_uow_factory.py`): Extracted `build_test_uow()` from both test suites into a single shared module to eliminate duplication (DRY). ### Minor - Updated `src/cleveragents/domain/repositories/__init__.py` docstring from table format to bullet list (conflict resolution from rebase). Closes #4174 Reviewed-on: #4197 Reviewed-by: HAL 9000 <HAL9000@cleverthis.com> Co-authored-by: Rui Hu <rui.hu@cleverthis.com> Co-committed-by: Rui Hu <rui.hu@cleverthis.com>	2026-04-09 06:11:39 +00:00
freemo	8ea00f5185	fix: restore CI quality tests to passing state (#4175) ... Co-authored-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me> Co-committed-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>	2026-04-08 11:02:14 +00:00
freemo	225eab25b1	fix(cli): change agents validation attach extra args to use --key value named option format (#3837) ... Co-authored-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me> Co-committed-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>	2026-04-06 07:55:09 +00:00
freemo	36fb867830	fix(acms): invoke SkeletonCompressor in ContextAssembler.assemble() to propagate skeleton context to child plans ... Reviewed and APPROVED. Critical bug fix. Closes #3563.	2026-04-05 21:31:14 +00:00
freemo	ca3399e177	fix(acms): invoke SkeletonCompressor in ContextAssembler.assemble() to propagate skeleton context to child plans ... Added skeleton_fragments: tuple[ContextFragment, ...] field to ContextPayload in context_fragment.py - Enables carrying compressed skeleton fragments along with normal context. Extended ACMSPipeline.assemble() in acms_service.py - Introduced skeleton_ratio: float = 0.15 (default matching spec) and parent_fragments: tuple[ContextFragment, ...] | None = None parameters. - These same parameters are also added to ContextAssemblyPipeline.assemble() in acms_pipeline.py for consistency. Skeleton compression integration - In Phase 3 of both assemble() methods, computed skeleton_budget = int(budget.available_tokens * skeleton_ratio) and invoked self._skeleton_compressor.compress(parent_fragments, skeleton_budget). - Compressed skeleton fragments are included in the returned ContextPayload.skeleton_fragments, enabling propagation of skeleton context to child plans. Tests and behavior coverage - Added a TDD issue-capture Behave scenario (@tdd_issue @tdd_issue_3563) to demonstrate the fix. - Added four Behave unit test scenarios asserting: compressor invocation, correct arguments, skeleton presence in output, and skeleton_ratio budget enforcement. - Added a Robot Framework integration test: parent plan accumulates context → child plan spawned → child plan context contains non-empty skeleton. - Added skeleton-context-inheritance command to helper_acms_pipeline.py to support testing and manual verification. Key design decisions - skeleton_ratio defaults to 0.15 to align with the spec's --skeleton-ratio default. - parent_fragments is None by default to maintain backward compatibility (no skeleton compression when no parent context). - skeleton_budget is computed as skeleton_budget = int(budget.available_tokens * skeleton_ratio), deriving the skeleton budget from the total token budget. - Both ACMSPipeline and ContextAssemblyPipeline are fixed to maintain consistency across the codepath. ISSUES CLOSED: #3563	2026-04-05 21:26:33 +00:00
freemo	201868afd8	fix(cli): route 'agents actor add' through ActorRegistry YAML-first path with all CLI flags preserved ... Reviewed and APPROVED. All blocking issues addressed. Closes #3426.	2026-04-05 21:20:20 +00:00
freemo	99b4067ec2	fix(cli): extend agents diagnostics to check all 9 supported providers ... Reviewed and APPROVED. All blocking issues addressed. Closes #3422.	2026-04-05 21:19:43 +00:00
freemo	62ded31c24	fix(cli): route 'agents actor add' through ActorRegistry.add() YAML-first path ... Route the 'agents actor add' CLI command through ActorRegistry.add() instead of the legacy registry.upsert_actor() path. This ensures the original YAML text, schema_version, and compiled_metadata are preserved in the database. Changes: - src/cleveragents/cli/commands/actor.py: Add _load_config_text() helper that returns both raw text and parsed dict. Refactor add() to call registry.add() with the raw yaml_text and update=update_existing flag when a registry is available. The service fallback path (no registry) is unchanged. - features/steps/actor_cli_steps.py: Update add command step definitions to mock registry.add() instead of registry.upsert_actor(). Update 'the actor add should pass the loaded config' assertion to verify registry.add() is called with a non-empty yaml_text string. - features/steps/actor_cli_yaml_steps.py: Update add command steps to mock registry.add() instead of registry.upsert_actor(). - features/steps/actor_add_rich_output_steps.py: Update add command steps to mock registry.add() instead of registry.upsert_actor(). - robot/helper_actor_add_rich_output.py: Update helper to mock registry.add() instead of registry.upsert_actor(). - features/actor_add_yaml_first_path.feature: New Behave feature verifying the YAML-first persistence path is used by actor add. - features/steps/actor_add_yaml_first_path_steps.py: Step definitions for the new YAML-first path feature. - robot/actor_add_yaml_first_path.robot: New Robot integration tests verifying yaml_text is preserved and upsert_actor is not called. - robot/helper_actor_add_yaml_first_path.py: Helper script for Robot tests. Fixes #3426 ISSUES CLOSED: #3426	2026-04-05 21:19:40 +00:00
freemo	234d71560d	fix(executor): implement automatic per-tool-write and event-based checkpoint triggers ... Reviewed and APPROVED. All blocking issues addressed. Closes #3439.	2026-04-05 21:19:18 +00:00
freemo	461adcdb2a	fix(cli): correct automation-profile list output structure and rich table rendering ... Reviewed and APPROVED. Closes #2064.	2026-04-05 21:16:24 +00:00
freemo	fa0dd3594f	fix(mcp): correct MCPToolResult.data type annotation for MCP 1.4.0 content list format ... Reviewed and APPROVED. Closes #2743.	2026-04-05 21:16:21 +00:00
freemo	fdb3787fe3	feat(cli): add --container-id flag to agents resource add for container-instance ... Reviewed and APPROVED. Closes #2598.	2026-04-05 21:16:18 +00:00
freemo	97a90e59c4	fix(domain): add missing execute hook to ToolLifecycle model to satisfy spec four-stage lifecycle ... Reviewed and APPROVED. Closes #2820.	2026-04-05 21:16:05 +00:00
freemo	098955693d	fix(tool-registry): reject plain Tools in attach_validation type-discriminator check ... Reviewed and APPROVED. Closes #2826.	2026-04-05 21:14:58 +00:00
freemo	ce4dbdb53f	fix(domain): add repository protocol interfaces to domain layer ... Reviewed and APPROVED. Closes #2873.	2026-04-05 21:14:56 +00:00
freemo	181ec4d2c2	fix(concurrency): protect CostTracker._daily_costs with a threading.Lock ... Reviewed and APPROVED. Closes #1919.	2026-04-05 21:14:08 +00:00
freemo	4b03d69770	refactor(tests): improve data variation in existing tests using factory and fixture system ... Reviewed and APPROVED. Closes #2772.	2026-04-05 21:14:05 +00:00
freemo	b565d86847	fix(cli): raise on subcommand registration failure instead of silently returning ... Reviewed and APPROVED. Closes #2604.	2026-04-05 21:13:58 +00:00
freemo	c92a65bc92	fix(resource): use namespace column instead of name heuristic in db_to_spec() for built_in field ... Reviewed and APPROVED. Closes #3013.	2026-04-05 21:13:56 +00:00
freemo	c3b2f59772	fix(sandbox): remove type: ignore in SandboxManager strategy assignment ... Reviewed and APPROVED. Closes #2828.	2026-04-05 21:13:07 +00:00
freemo	78e146d169	fix(executor): implement automatic per-tool-write and event-based checkpoint triggers ... Implements all four automatic checkpoint triggers defined in the specification for the Execute phase of the plan lifecycle: - before_tool_execute: Checkpoint created before any tool with writes=True runs - after_tool_execute: Checkpoint created after a write tool completes successfully - on_subplan_spawn: Checkpoint created immediately after a child plan is spawned - on_error: Checkpoint created after any unrecoverable error in the Execute phase Changes: - tool/runner.py: Added optional CheckpointService and auto_checkpoint_triggers parameters to ToolRunner. Checkpoint hooks fire around write-tool execution when a CheckpointService is wired. Exported DEFAULT_AUTO_TRIGGERS as a public constant (single source of truth). Made is_trigger_active() public so callers can query the active trigger set without accessing private attributes. - application/services/subplan_execution_service.py: Added optional CheckpointService, auto_checkpoint_triggers, and parent_plan_id parameters. on_subplan_spawn checkpoint fires in _execute_one_with_retry before the first execution attempt. Now imports DEFAULT_AUTO_TRIGGERS from runner.py (DRY fix). - application/services/plan_executor.py: Added _is_auto_trigger_active() helper and on_error checkpoint hooks in both _run_execute_with_stub() and _run_execute_with_runtime() error paths. Delegates to ToolRunner.is_trigger_active() instead of accessing private attributes (module boundary fix). - application/services/config_service.py: Registered new config key core.checkpoints.auto_create_on (default: all four triggers enabled) with env var CLEVERAGENTS_CHECKPOINT_AUTO_CREATE_ON. - application/services/llm_actors.py: Replaced Any type for lifecycle_service with PlanLifecycleProtocol (typed Protocol) and tool_runner with ToolRunner type annotation. Eliminates Any usage for injected dependencies. Tests: - features/checkpoint_auto_triggers.feature: 15 Behave scenarios covering all four triggers, disable-trigger behavior, no-checkpoint-service fallback, and config key registration. - features/steps/checkpoint_auto_triggers_tool_steps.py: Step definitions for ToolRunner and config service scenarios (split from original 519-line file). - features/steps/checkpoint_auto_triggers_executor_steps.py: Step definitions for SubplanExecutionService and PlanExecutor scenarios (split from original). Closes #3439 ISSUES CLOSED: #3439	2026-04-05 21:13:07 +00:00
freemo	a3eb9ea9d1	fix(cli): add missing _log.debug call to session export/import/tell DatabaseError handlers ... Reviewed and APPROVED. Closes #2788.	2026-04-05 21:13:04 +00:00
freemo	188ea031eb	fix(resources): register fs-mount built-in resource type at startup ... Reviewed and APPROVED. Closes #2911.	2026-04-05 21:13:02 +00:00