Skip to content

Commit 0938413

Browse files
PluviobytePluviobyte
committed
Merge remote-tracking branch 'upstream/main' into fix/context-engine-assemble-guard
2 parents a584972 + f212176 commit 0938413

20 files changed

Lines changed: 478 additions & 164 deletions

‎.github/actions/ensure-base-commit/action.yml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,9 +38,15 @@ runs:
3838
exit 0
3939
fi
4040
41+
fetch_base_ref() {
42+
timeout --signal=TERM --kill-after=10s 30s git \
43+
-c protocol.version=2 \
44+
fetch "$@"
45+
}
46+
4147
for deepen_by in 25 100 300; do
4248
echo "Base commit missing; deepening $FETCH_REF by $deepen_by."
43-
if ! git fetch --no-tags --deepen="$deepen_by" origin -- "$FETCH_REF"; then
49+
if ! fetch_base_ref --no-tags --deepen="$deepen_by" origin -- "$FETCH_REF"; then
4450
echo "::warning title=ensure-base-commit fetch failed::Failed to deepen $FETCH_REF by $deepen_by while looking for $BASE_SHA"
4551
fi
4652
if git rev-parse --verify "$BASE_SHA^{commit}" >/dev/null 2>&1; then
@@ -50,7 +56,7 @@ runs:
5056
done
5157
5258
echo "Base commit still missing; fetching full history for $FETCH_REF."
53-
if ! git fetch --no-tags origin -- "$FETCH_REF"; then
59+
if ! fetch_base_ref --no-tags origin -- "$FETCH_REF"; then
5460
echo "::warning title=ensure-base-commit fetch failed::Failed to fetch full history for $FETCH_REF while looking for $BASE_SHA"
5561
fi
5662
if git rev-parse --verify "$BASE_SHA^{commit}" >/dev/null 2>&1; then

‎.github/workflows/ci-build-artifacts-testbox.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -188,7 +188,10 @@ jobs:
188188
run: |
189189
set -euo pipefail
190190
191-
git fetch --no-tags --depth=50 origin "+refs/heads/main:refs/remotes/origin/main"
191+
timeout --signal=TERM --kill-after=10s 30s git \
192+
-c protocol.version=2 \
193+
fetch --no-tags --prune --no-recurse-submodules --depth=50 origin \
194+
"+refs/heads/main:refs/remotes/origin/main"
192195
193196
node_bin="$(dirname "$(node -p 'process.execPath')")"
194197
sudo ln -sf "$node_bin/node" /usr/local/bin/node

‎.github/workflows/ci-check-testbox.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,10 @@ jobs:
8989
run: |
9090
set -euo pipefail
9191
92-
git fetch --no-tags --depth=50 origin "+refs/heads/main:refs/remotes/origin/main"
92+
timeout --signal=TERM --kill-after=10s 30s git \
93+
-c protocol.version=2 \
94+
fetch --no-tags --prune --no-recurse-submodules --depth=50 origin \
95+
"+refs/heads/main:refs/remotes/origin/main"
9396
9497
node_bin="$(dirname "$(node -p 'process.execPath')")"
9598
sudo ln -sf "$node_bin/node" /usr/local/bin/node

‎.github/workflows/ci.yml‎

Lines changed: 101 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -86,12 +86,26 @@ jobs:
8686
git init "$GITHUB_WORKSPACE"
8787
git -C "$GITHUB_WORKSPACE" config gc.auto 0
8888
git -C "$GITHUB_WORKSPACE" remote add origin "https://github.com/${CHECKOUT_REPO}.git"
89-
if ! git -C "$GITHUB_WORKSPACE" fetch --no-tags --depth=1 origin "+${CHECKOUT_REF}:refs/remotes/origin/checkout"; then
89+
fetch_checkout_ref() {
90+
local ref="$1"
91+
timeout --signal=TERM --kill-after=10s 30s git -C "$GITHUB_WORKSPACE" \
92+
-c protocol.version=2 \
93+
fetch --no-tags --prune --no-recurse-submodules --depth=1 origin \
94+
"+${ref}:refs/remotes/origin/checkout"
95+
}
96+
if fetch_checkout_ref "$CHECKOUT_REF"; then
97+
:
98+
else
99+
fetch_status="$?"
100+
if [ "$fetch_status" = "124" ] || [ "$fetch_status" = "137" ]; then
101+
echo "::error::checkout fetch for '$CHECKOUT_REF' timed out"
102+
exit "$fetch_status"
103+
fi
90104
if [ "$GITHUB_EVENT_NAME" != "workflow_dispatch" ] || [ "$CHECKOUT_REF" = "$CHECKOUT_FALLBACK_REF" ]; then
91-
exit 1
105+
exit "$fetch_status"
92106
fi
93107
echo "::warning::workflow_dispatch target_ref '$CHECKOUT_REF' is unavailable; falling back to head SHA '$CHECKOUT_FALLBACK_REF'"
94-
git -C "$GITHUB_WORKSPACE" fetch --no-tags --depth=1 origin "+${CHECKOUT_FALLBACK_REF}:refs/remotes/origin/checkout"
108+
fetch_checkout_ref "$CHECKOUT_FALLBACK_REF"
95109
fi
96110
git -C "$GITHUB_WORKSPACE" checkout --detach refs/remotes/origin/checkout
97111
@@ -321,12 +335,26 @@ jobs:
321335
git init "$GITHUB_WORKSPACE"
322336
git -C "$GITHUB_WORKSPACE" config gc.auto 0
323337
git -C "$GITHUB_WORKSPACE" remote add origin "https://github.com/${CHECKOUT_REPO}.git"
324-
if ! git -C "$GITHUB_WORKSPACE" fetch --no-tags --depth=1 origin "+${CHECKOUT_REF}:refs/remotes/origin/checkout"; then
338+
fetch_checkout_ref() {
339+
local ref="$1"
340+
timeout --signal=TERM --kill-after=10s 30s git -C "$GITHUB_WORKSPACE" \
341+
-c protocol.version=2 \
342+
fetch --no-tags --prune --no-recurse-submodules --depth=1 origin \
343+
"+${ref}:refs/remotes/origin/checkout"
344+
}
345+
if fetch_checkout_ref "$CHECKOUT_REF"; then
346+
:
347+
else
348+
fetch_status="$?"
349+
if [ "$fetch_status" = "124" ] || [ "$fetch_status" = "137" ]; then
350+
echo "::error::checkout fetch for '$CHECKOUT_REF' timed out"
351+
exit "$fetch_status"
352+
fi
325353
if [ "$GITHUB_EVENT_NAME" != "workflow_dispatch" ] || [ "$CHECKOUT_REF" = "$CHECKOUT_FALLBACK_REF" ]; then
326-
exit 1
354+
exit "$fetch_status"
327355
fi
328356
echo "::warning::workflow_dispatch target_ref '$CHECKOUT_REF' is unavailable; falling back to head SHA '$CHECKOUT_FALLBACK_REF'"
329-
git -C "$GITHUB_WORKSPACE" fetch --no-tags --depth=1 origin "+${CHECKOUT_FALLBACK_REF}:refs/remotes/origin/checkout"
357+
fetch_checkout_ref "$CHECKOUT_FALLBACK_REF"
330358
fi
331359
git -C "$GITHUB_WORKSPACE" checkout --detach refs/remotes/origin/checkout
332360
@@ -1555,7 +1583,10 @@ jobs:
15551583
git init "$GITHUB_WORKSPACE"
15561584
git -C "$GITHUB_WORKSPACE" config gc.auto 0
15571585
git -C "$GITHUB_WORKSPACE" remote add origin "https://github.com/${CHECKOUT_REPO}.git"
1558-
git -C "$GITHUB_WORKSPACE" fetch --no-tags --depth=1 origin "+${CHECKOUT_SHA}:refs/remotes/origin/checkout"
1586+
timeout --signal=TERM --kill-after=10s 30s git -C "$GITHUB_WORKSPACE" \
1587+
-c protocol.version=2 \
1588+
fetch --no-tags --prune --no-recurse-submodules --depth=1 origin \
1589+
"+${CHECKOUT_SHA}:refs/remotes/origin/checkout"
15591590
git -C "$GITHUB_WORKSPACE" checkout --detach refs/remotes/origin/checkout
15601591
15611592
- name: Setup Python
@@ -1603,7 +1634,27 @@ jobs:
16031634
git init "$GITHUB_WORKSPACE"
16041635
git -C "$GITHUB_WORKSPACE" config gc.auto 0
16051636
git -C "$GITHUB_WORKSPACE" remote add origin "https://github.com/${CHECKOUT_REPO}.git"
1606-
git -C "$GITHUB_WORKSPACE" fetch --no-tags --depth=1 origin "+${CHECKOUT_SHA}:refs/remotes/origin/checkout"
1637+
fetch_checkout_ref() {
1638+
git -C "$GITHUB_WORKSPACE" \
1639+
-c protocol.version=2 \
1640+
fetch --no-tags --prune --no-recurse-submodules --depth=1 origin \
1641+
"+${CHECKOUT_SHA}:refs/remotes/origin/checkout" &
1642+
local fetch_pid="$!"
1643+
local elapsed=0
1644+
while kill -0 "$fetch_pid" 2>/dev/null; do
1645+
if [ "$elapsed" -ge 30 ]; then
1646+
kill -TERM "$fetch_pid" 2>/dev/null || true
1647+
sleep 10
1648+
kill -KILL "$fetch_pid" 2>/dev/null || true
1649+
wait "$fetch_pid" || true
1650+
return 124
1651+
fi
1652+
sleep 1
1653+
elapsed=$((elapsed + 1))
1654+
done
1655+
wait "$fetch_pid"
1656+
}
1657+
fetch_checkout_ref
16071658
git -C "$GITHUB_WORKSPACE" checkout --detach refs/remotes/origin/checkout
16081659
16091660
- name: Try to exclude workspace from Windows Defender (best-effort)
@@ -1703,7 +1754,27 @@ jobs:
17031754
git init "$GITHUB_WORKSPACE"
17041755
git -C "$GITHUB_WORKSPACE" config gc.auto 0
17051756
git -C "$GITHUB_WORKSPACE" remote add origin "https://github.com/${CHECKOUT_REPO}.git"
1706-
git -C "$GITHUB_WORKSPACE" fetch --no-tags --depth=1 origin "+${CHECKOUT_SHA}:refs/remotes/origin/checkout"
1757+
fetch_checkout_ref() {
1758+
git -C "$GITHUB_WORKSPACE" \
1759+
-c protocol.version=2 \
1760+
fetch --no-tags --prune --no-recurse-submodules --depth=1 origin \
1761+
"+${CHECKOUT_SHA}:refs/remotes/origin/checkout" &
1762+
local fetch_pid="$!"
1763+
local elapsed=0
1764+
while kill -0 "$fetch_pid" 2>/dev/null; do
1765+
if [ "$elapsed" -ge 30 ]; then
1766+
kill -TERM "$fetch_pid" 2>/dev/null || true
1767+
sleep 10
1768+
kill -KILL "$fetch_pid" 2>/dev/null || true
1769+
wait "$fetch_pid" || true
1770+
return 124
1771+
fi
1772+
sleep 1
1773+
elapsed=$((elapsed + 1))
1774+
done
1775+
wait "$fetch_pid"
1776+
}
1777+
fetch_checkout_ref
17071778
git -C "$GITHUB_WORKSPACE" checkout --detach refs/remotes/origin/checkout
17081779
17091780
- name: Setup Node environment
@@ -1749,7 +1820,27 @@ jobs:
17491820
git init "$GITHUB_WORKSPACE"
17501821
git -C "$GITHUB_WORKSPACE" config gc.auto 0
17511822
git -C "$GITHUB_WORKSPACE" remote add origin "https://github.com/${CHECKOUT_REPO}.git"
1752-
git -C "$GITHUB_WORKSPACE" fetch --no-tags --depth=1 origin "+${CHECKOUT_SHA}:refs/remotes/origin/checkout"
1823+
fetch_checkout_ref() {
1824+
git -C "$GITHUB_WORKSPACE" \
1825+
-c protocol.version=2 \
1826+
fetch --no-tags --prune --no-recurse-submodules --depth=1 origin \
1827+
"+${CHECKOUT_SHA}:refs/remotes/origin/checkout" &
1828+
local fetch_pid="$!"
1829+
local elapsed=0
1830+
while kill -0 "$fetch_pid" 2>/dev/null; do
1831+
if [ "$elapsed" -ge 30 ]; then
1832+
kill -TERM "$fetch_pid" 2>/dev/null || true
1833+
sleep 10
1834+
kill -KILL "$fetch_pid" 2>/dev/null || true
1835+
wait "$fetch_pid" || true
1836+
return 124
1837+
fi
1838+
sleep 1
1839+
elapsed=$((elapsed + 1))
1840+
done
1841+
wait "$fetch_pid"
1842+
}
1843+
fetch_checkout_ref
17531844
git -C "$GITHUB_WORKSPACE" checkout --detach refs/remotes/origin/checkout
17541845
17551846
- name: Install XcodeGen / SwiftLint / SwiftFormat

‎.github/workflows/crabbox-hydrate.yml‎

Lines changed: 26 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -137,7 +137,10 @@ jobs:
137137
set -euo pipefail
138138
139139
if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
140-
git fetch --no-tags --depth=50 origin "+refs/heads/main:refs/remotes/origin/main"
140+
timeout --signal=TERM --kill-after=10s 30s git \
141+
-c protocol.version=2 \
142+
fetch --no-tags --prune --no-recurse-submodules --depth=50 origin \
143+
"+refs/heads/main:refs/remotes/origin/main"
141144
fi
142145
143146
- name: Prepare Crabbox shell
@@ -318,7 +321,24 @@ jobs:
318321
$ErrorActionPreference = "Stop"
319322
320323
if (git rev-parse --is-inside-work-tree 2>$null) {
321-
git fetch --no-tags --depth=50 origin "+refs/heads/main:refs/remotes/origin/main"
324+
$fetch = Start-Process git -NoNewWindow -PassThru -ArgumentList @(
325+
"-c",
326+
"protocol.version=2",
327+
"fetch",
328+
"--no-tags",
329+
"--prune",
330+
"--no-recurse-submodules",
331+
"--depth=50",
332+
"origin",
333+
"+refs/heads/main:refs/remotes/origin/main"
334+
)
335+
if (-not $fetch.WaitForExit(30000)) {
336+
Stop-Process -Id $fetch.Id -Force -ErrorAction SilentlyContinue
337+
throw "git fetch timed out after 30 seconds"
338+
}
339+
if ($fetch.ExitCode -ne 0) {
340+
throw "git fetch failed with exit code $($fetch.ExitCode)"
341+
}
322342
}
323343
324344
- name: Setup pnpm and dependencies
@@ -513,7 +533,10 @@ jobs:
513533
set -euo pipefail
514534
515535
if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
516-
git fetch --no-tags --depth=50 origin "+refs/heads/main:refs/remotes/origin/main"
536+
timeout --signal=TERM --kill-after=10s 30s git \
537+
-c protocol.version=2 \
538+
fetch --no-tags --prune --no-recurse-submodules --depth=50 origin \
539+
"+refs/heads/main:refs/remotes/origin/main"
517540
fi
518541
519542
node_bin="$(dirname "$(node -p 'process.execPath')")"

‎.github/workflows/workflow-sanity.yml‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,10 @@ jobs:
3434
git init "$GITHUB_WORKSPACE"
3535
git -C "$GITHUB_WORKSPACE" config gc.auto 0
3636
git -C "$GITHUB_WORKSPACE" remote add origin "https://github.com/${CHECKOUT_REPO}.git"
37-
git -C "$GITHUB_WORKSPACE" fetch --no-tags --depth=1 origin "+${CHECKOUT_SHA}:refs/remotes/origin/checkout"
37+
timeout --signal=TERM --kill-after=10s 30s git -C "$GITHUB_WORKSPACE" \
38+
-c protocol.version=2 \
39+
fetch --no-tags --prune --no-recurse-submodules --depth=1 origin \
40+
"+${CHECKOUT_SHA}:refs/remotes/origin/checkout"
3841
git -C "$GITHUB_WORKSPACE" checkout --detach refs/remotes/origin/checkout
3942
4043
- name: Fail on tabs in workflow files
@@ -75,7 +78,10 @@ jobs:
7578
git init "$GITHUB_WORKSPACE"
7679
git -C "$GITHUB_WORKSPACE" config gc.auto 0
7780
git -C "$GITHUB_WORKSPACE" remote add origin "https://github.com/${CHECKOUT_REPO}.git"
78-
git -C "$GITHUB_WORKSPACE" fetch --no-tags --depth=1 origin "+${CHECKOUT_SHA}:refs/remotes/origin/checkout"
81+
timeout --signal=TERM --kill-after=10s 30s git -C "$GITHUB_WORKSPACE" \
82+
-c protocol.version=2 \
83+
fetch --no-tags --prune --no-recurse-submodules --depth=1 origin \
84+
"+${CHECKOUT_SHA}:refs/remotes/origin/checkout"
7985
git -C "$GITHUB_WORKSPACE" checkout --detach refs/remotes/origin/checkout
8086
8187
- name: Install actionlint
@@ -116,7 +122,10 @@ jobs:
116122
git init "$GITHUB_WORKSPACE"
117123
git -C "$GITHUB_WORKSPACE" config gc.auto 0
118124
git -C "$GITHUB_WORKSPACE" remote add origin "https://github.com/${CHECKOUT_REPO}.git"
119-
git -C "$GITHUB_WORKSPACE" fetch --no-tags --depth=1 origin "+${CHECKOUT_SHA}:refs/remotes/origin/checkout"
125+
timeout --signal=TERM --kill-after=10s 30s git -C "$GITHUB_WORKSPACE" \
126+
-c protocol.version=2 \
127+
fetch --no-tags --prune --no-recurse-submodules --depth=1 origin \
128+
"+${CHECKOUT_SHA}:refs/remotes/origin/checkout"
120129
git -C "$GITHUB_WORKSPACE" checkout --detach refs/remotes/origin/checkout
121130
122131
- name: Setup Node environment

‎extensions/browser/src/browser/client-fetch.loopback-auth.test.ts‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,13 @@
11
import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
22
import "../test-support/browser-security.mock.js";
33
import type { OpenClawConfig } from "../config/config.js";
4+
import type { BrowserControlAuth } from "./control-auth.js";
45
import type { BrowserDispatchResponse } from "./routes/dispatcher.js";
56

7+
type BridgeAuth = NonNullable<
8+
ReturnType<typeof import("./bridge-auth-registry.js").getBridgeAuthForPort>
9+
>;
10+
611
vi.mock("openclaw/plugin-sdk/ssrf-runtime", async () => {
712
const actual = await vi.importActual<typeof import("openclaw/plugin-sdk/ssrf-runtime")>(
813
"openclaw/plugin-sdk/ssrf-runtime",
@@ -36,11 +41,10 @@ const mocks = vi.hoisted(() => ({
3641
},
3742
},
3843
})),
39-
resolveBrowserControlAuth: vi.fn(() => ({
44+
resolveBrowserControlAuth: vi.fn<() => BrowserControlAuth>(() => ({
4045
token: "loopback-token",
41-
password: undefined,
4246
})),
43-
getBridgeAuthForPort: vi.fn(() => null),
47+
getBridgeAuthForPort: vi.fn<(port: number) => BridgeAuth | undefined>(() => undefined),
4448
startBrowserControlServiceFromConfig: vi.fn(async () => ({ ok: true })),
4549
dispatch: vi.fn(async (): Promise<BrowserDispatchResponse> => okDispatchResponse()),
4650
}));
@@ -143,9 +147,8 @@ describe("fetchBrowserJson loopback auth", () => {
143147
mocks.dispatch.mockReset().mockResolvedValue(okDispatchResponse());
144148
mocks.resolveBrowserControlAuth.mockReset().mockReturnValue({
145149
token: "loopback-token",
146-
password: undefined,
147150
});
148-
mocks.getBridgeAuthForPort.mockReset().mockReturnValue(null);
151+
mocks.getBridgeAuthForPort.mockReset().mockReturnValue(undefined);
149152
});
150153

151154
afterEach(() => {
@@ -209,10 +212,7 @@ describe("fetchBrowserJson loopback auth", () => {
209212
});
210213

211214
it("does not treat explicit port zero as the default loopback bridge port", async () => {
212-
mocks.resolveBrowserControlAuth.mockReturnValueOnce({
213-
token: undefined,
214-
password: undefined,
215-
});
215+
mocks.resolveBrowserControlAuth.mockReturnValueOnce({});
216216
mocks.getBridgeAuthForPort.mockReturnValueOnce({ token: "bridge-token" });
217217
const fetchMock = stubJsonFetchOk();
218218

0 commit comments

Comments
 (0)