wednesdayai 0.4.12-dev.24 → 0.4.12-dev.25
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/build-info.json +3 -3
- package/dist/canvas-host/a2ui/.bundle.hash +1 -1
- package/dist/config.js +2 -2
- package/dist/plugin-sdk/provider-media-understanding.js +7 -7
- package/dist/plugin-sdk/testing.js +4 -4
- package/docs/plans/npm-trusted-publishing/decisions-ledger.md +20 -0
- package/docs/plans/npm-trusted-publishing/phase-6/051-thin-oidc-publish-workflow.md +1 -1
- package/extensions/acpx/package.json +1 -1
- package/extensions/anthropic/package.json +1 -1
- package/extensions/bifrost/package.json +1 -1
- package/extensions/bluebubbles/package.json +1 -1
- package/extensions/copilot-proxy/package.json +1 -1
- package/extensions/deepgram/package.json +1 -1
- package/extensions/deepinfra/package.json +1 -1
- package/extensions/diagnostics-otel/package.json +1 -1
- package/extensions/diffs/package.json +1 -1
- package/extensions/discord/package.json +1 -1
- package/extensions/dream-cycle/package.json +1 -1
- package/extensions/elevenlabs/package.json +1 -1
- package/extensions/feishu/package.json +1 -1
- package/extensions/gemini-search/package.json +1 -1
- package/extensions/google/package.json +1 -1
- package/extensions/google-gemini-cli-auth/package.json +1 -1
- package/extensions/googlechat/package.json +1 -1
- package/extensions/grok-search/package.json +1 -1
- package/extensions/groq/package.json +1 -1
- package/extensions/imessage/package.json +1 -1
- package/extensions/irc/package.json +1 -1
- package/extensions/kimi-search/package.json +1 -1
- package/extensions/learning-core/package.json +1 -1
- package/extensions/line/package.json +1 -1
- package/extensions/llm-task/package.json +1 -1
- package/extensions/lobster/package.json +1 -1
- package/extensions/matrix/CHANGELOG.md +1 -1
- package/extensions/matrix/package.json +1 -1
- package/extensions/mattermost/package.json +1 -1
- package/extensions/memory-core/package.json +1 -1
- package/extensions/memory-lancedb/package.json +1 -1
- package/extensions/minimax/package.json +1 -1
- package/extensions/minimax-portal-auth/package.json +1 -1
- package/extensions/mistral/package.json +1 -1
- package/extensions/moonshot/package.json +1 -1
- package/extensions/msteams/CHANGELOG.md +1 -1
- package/extensions/msteams/package.json +1 -1
- package/extensions/nextcloud-talk/package.json +1 -1
- package/extensions/nostr/CHANGELOG.md +1 -1
- package/extensions/nostr/package.json +1 -1
- package/extensions/open-prose/package.json +1 -1
- package/extensions/openai/package.json +1 -1
- package/extensions/openai-realtime/package.json +1 -1
- package/extensions/openrouter/package.json +1 -1
- package/extensions/perplexity-search/package.json +1 -1
- package/extensions/searxng-search/package.json +1 -1
- package/extensions/signal/package.json +1 -1
- package/extensions/slack/package.json +1 -1
- package/extensions/synology-chat/package.json +1 -1
- package/extensions/telegram/package.json +1 -1
- package/extensions/tlon/package.json +1 -1
- package/extensions/twitch/CHANGELOG.md +1 -1
- package/extensions/twitch/package.json +1 -1
- package/extensions/voice-call/CHANGELOG.md +1 -1
- package/extensions/voice-call/package.json +1 -1
- package/extensions/whatsapp/package.json +1 -1
- package/extensions/zai/package.json +1 -1
- package/extensions/zalo/CHANGELOG.md +1 -1
- package/extensions/zalo/package.json +1 -1
- package/extensions/zalouser/CHANGELOG.md +1 -1
- package/extensions/zalouser/package.json +1 -1
- package/package.json +1 -1
package/dist/build-info.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
|
-
"version": "0.4.12-dev.
|
|
3
|
-
"commit": "
|
|
2
|
+
"version": "0.4.12-dev.25+46769abdb",
|
|
3
|
+
"commit": "46769abdb4aaf2f494e2953158f7a2c34e7e8b37",
|
|
4
4
|
"channel": "dev",
|
|
5
5
|
"forkBase": "openclaw@2026.3.2",
|
|
6
|
-
"builtAt": "2026-09-04T01:
|
|
6
|
+
"builtAt": "2026-09-04T01:44:43.414Z"
|
|
7
7
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
|
|
1
|
+
3587fc4998e911ce9c1ade996f5d7a1b5f8b806c825e1f91f0bbea74d016c9fe
|
package/dist/config.js
CHANGED
|
@@ -7,7 +7,7 @@ import { isDeepStrictEqual, promisify } from "node:util";
|
|
|
7
7
|
import JSON5 from "json5";
|
|
8
8
|
import dotenv from "dotenv";
|
|
9
9
|
import { Logger } from "tslog";
|
|
10
|
-
import
|
|
10
|
+
import fs$1 from "node:fs/promises";
|
|
11
11
|
import zlib from "node:zlib";
|
|
12
12
|
import chalk, { Chalk } from "chalk";
|
|
13
13
|
import { execFile, execFileSync } from "node:child_process";
|
|
@@ -5945,7 +5945,7 @@ async function releaseHeldLock(normalizedSessionFile, held, opts = {}) {
|
|
|
5945
5945
|
await held.handle.close();
|
|
5946
5946
|
} catch {}
|
|
5947
5947
|
try {
|
|
5948
|
-
await
|
|
5948
|
+
await fs$1.rm(held.lockPath, { force: true });
|
|
5949
5949
|
} catch {}
|
|
5950
5950
|
})();
|
|
5951
5951
|
try {
|
|
@@ -4,7 +4,7 @@ import fs, { constants } from "node:fs";
|
|
|
4
4
|
import path from "node:path";
|
|
5
5
|
import { Logger } from "tslog";
|
|
6
6
|
import os, { userInfo } from "node:os";
|
|
7
|
-
import
|
|
7
|
+
import json5 from "json5";
|
|
8
8
|
import fs$1 from "node:fs/promises";
|
|
9
9
|
import { isDeepStrictEqual, promisify } from "node:util";
|
|
10
10
|
import zlib from "node:zlib";
|
|
@@ -1443,7 +1443,7 @@ const defaultResolver = {
|
|
|
1443
1443
|
resolvedPath,
|
|
1444
1444
|
rootRealDir
|
|
1445
1445
|
}),
|
|
1446
|
-
parseJson: (raw) =>
|
|
1446
|
+
parseJson: (raw) => json5.parse(raw)
|
|
1447
1447
|
};
|
|
1448
1448
|
/**
|
|
1449
1449
|
* Resolves all $include directives in a parsed config object.
|
|
@@ -1500,14 +1500,14 @@ function readLoggingConfig() {
|
|
|
1500
1500
|
try {
|
|
1501
1501
|
if (!fs.existsSync(configPath)) return;
|
|
1502
1502
|
const raw = fs.readFileSync(configPath, "utf-8");
|
|
1503
|
-
const resolvedIncludes = resolveConfigIncludes(
|
|
1503
|
+
const resolvedIncludes = resolveConfigIncludes(json5.parse(raw), configPath, {
|
|
1504
1504
|
readFile: (candidate) => fs.readFileSync(candidate, "utf-8"),
|
|
1505
1505
|
readFileWithGuards: ({ includePath, resolvedPath, rootRealDir }) => readConfigIncludeFileWithGuards({
|
|
1506
1506
|
includePath,
|
|
1507
1507
|
resolvedPath,
|
|
1508
1508
|
rootRealDir
|
|
1509
1509
|
}),
|
|
1510
|
-
parseJson: (includeRaw) =>
|
|
1510
|
+
parseJson: (includeRaw) => json5.parse(includeRaw)
|
|
1511
1511
|
});
|
|
1512
1512
|
if (resolvedIncludes && typeof resolvedIncludes === "object" && "env" in resolvedIncludes) applyConfigEnvVars(resolvedIncludes);
|
|
1513
1513
|
const resolvedConfig = resolveConfigEnvVars(resolvedIncludes);
|
|
@@ -16771,7 +16771,7 @@ function resolveConfigPathForDeps(deps) {
|
|
|
16771
16771
|
function normalizeDeps(overrides = {}) {
|
|
16772
16772
|
return {
|
|
16773
16773
|
fs: overrides.fs ?? fs,
|
|
16774
|
-
json5: overrides.json5 ??
|
|
16774
|
+
json5: overrides.json5 ?? json5,
|
|
16775
16775
|
env: overrides.env ?? process.env,
|
|
16776
16776
|
homedir: overrides.homedir ?? (() => resolveRequiredHomeDir(overrides.env ?? process.env, os.homedir)),
|
|
16777
16777
|
configPath: overrides.configPath ?? "",
|
|
@@ -16782,11 +16782,11 @@ function maybeLoadDotEnvForConfig(env) {
|
|
|
16782
16782
|
if (env !== process.env) return;
|
|
16783
16783
|
loadDotEnv({ quiet: true });
|
|
16784
16784
|
}
|
|
16785
|
-
function parseConfigJson5(raw, json5 =
|
|
16785
|
+
function parseConfigJson5(raw, json5$1 = json5) {
|
|
16786
16786
|
try {
|
|
16787
16787
|
return {
|
|
16788
16788
|
ok: true,
|
|
16789
|
-
parsed: json5.parse(raw)
|
|
16789
|
+
parsed: json5$1.parse(raw)
|
|
16790
16790
|
};
|
|
16791
16791
|
} catch (err) {
|
|
16792
16792
|
return {
|
|
@@ -4,7 +4,7 @@ import fs from "node:fs";
|
|
|
4
4
|
import fs$1 from "node:fs/promises";
|
|
5
5
|
import os from "node:os";
|
|
6
6
|
import { Logger } from "tslog";
|
|
7
|
-
import
|
|
7
|
+
import JSON5 from "json5";
|
|
8
8
|
import { promisify } from "node:util";
|
|
9
9
|
import zlib from "node:zlib";
|
|
10
10
|
import chalk, { Chalk } from "chalk";
|
|
@@ -1666,7 +1666,7 @@ const defaultResolver = {
|
|
|
1666
1666
|
resolvedPath,
|
|
1667
1667
|
rootRealDir
|
|
1668
1668
|
}),
|
|
1669
|
-
parseJson: (raw) =>
|
|
1669
|
+
parseJson: (raw) => JSON5.parse(raw)
|
|
1670
1670
|
};
|
|
1671
1671
|
/**
|
|
1672
1672
|
* Resolves all $include directives in a parsed config object.
|
|
@@ -1723,14 +1723,14 @@ function readLoggingConfig() {
|
|
|
1723
1723
|
try {
|
|
1724
1724
|
if (!fs.existsSync(configPath)) return;
|
|
1725
1725
|
const raw = fs.readFileSync(configPath, "utf-8");
|
|
1726
|
-
const resolvedIncludes = resolveConfigIncludes(
|
|
1726
|
+
const resolvedIncludes = resolveConfigIncludes(JSON5.parse(raw), configPath, {
|
|
1727
1727
|
readFile: (candidate) => fs.readFileSync(candidate, "utf-8"),
|
|
1728
1728
|
readFileWithGuards: ({ includePath, resolvedPath, rootRealDir }) => readConfigIncludeFileWithGuards({
|
|
1729
1729
|
includePath,
|
|
1730
1730
|
resolvedPath,
|
|
1731
1731
|
rootRealDir
|
|
1732
1732
|
}),
|
|
1733
|
-
parseJson: (includeRaw) =>
|
|
1733
|
+
parseJson: (includeRaw) => JSON5.parse(includeRaw)
|
|
1734
1734
|
});
|
|
1735
1735
|
if (resolvedIncludes && typeof resolvedIncludes === "object" && "env" in resolvedIncludes) applyConfigEnvVars(resolvedIncludes);
|
|
1736
1736
|
const resolvedConfig = resolveConfigEnvVars(resolvedIncludes);
|
|
@@ -818,3 +818,23 @@ grok's INFO items adjudicated: I1 (heal fail-closed — same item as finding 1);
|
|
|
818
818
|
same item as finding 2, assigned to 055); I3 (Pack WhatsApp in release-please.yml has no consumer
|
|
819
819
|
after the publish steps were removed — the task contract says KEEP; harmless one-step pack, and the
|
|
820
820
|
tarball may still be wanted for the draft release in future; accepted residual).
|
|
821
|
+
|
|
822
|
+
## Dev canary 1 — leakage-audit false positive (issue #419)
|
|
823
|
+
|
|
824
|
+
First OIDC dev publish (run 33825339170, merge commit 711b2c42f8): dev job
|
|
825
|
+
SUCCESS — `wednesdayai@0.4.12-dev.24` and `@wednesdayai/whatsapp@0.4.12-dev.24`
|
|
826
|
+
live on npm `@dev` via trusted publishing, no token. verify-dev FAILED on three
|
|
827
|
+
`leakage-audit:auth-token-key` findings whose JSON pointers are our own published
|
|
828
|
+
manifest keys (`scripts.lint:auth:pairing-account-scope`,
|
|
829
|
+
`scripts.lint:no-pairing-store-group`, `dependencies.google-auth-library`).
|
|
830
|
+
Root cause: the glue fed `npm view --json` registry-manifest stdout into
|
|
831
|
+
auditPublishingOutputs; the audit's auth-key walker correctly matches keys
|
|
832
|
+
containing "auth", but registry data is public and cannot carry CI credentials.
|
|
833
|
+
The `Open failure issue` lane worked end-to-end (auto-created issue #419).
|
|
834
|
+
|
|
835
|
+
Fix (branch fix/verify-leakage-fp): glue excludes `stdout:npm view ` evidence
|
|
836
|
+
from the audit (comment in post-publish-verify.ts); packumentFor test fixture now
|
|
837
|
+
carries the canary's auth-shaped manifest keys so the happy-path test is the
|
|
838
|
+
regression proof; R14-1 glue sha256 updated; 051 doc js block resynced.
|
|
839
|
+
Everything else — poll, install-pair acceptance, OIDC publish — verified green
|
|
840
|
+
by the canary itself.
|
|
@@ -2468,7 +2468,7 @@ void test("R14-1 SHOULD-FIX: security-critical CI files are sha256-pinned", () =
|
|
|
2468
2468
|
],
|
|
2469
2469
|
[
|
|
2470
2470
|
"scripts/npm-publish/post-publish-verify.ts",
|
|
2471
|
-
"
|
|
2471
|
+
"c83ea516aa5e54c69cc90414b69276b49cf4adcab2db15a76252dd5988e8082a",
|
|
2472
2472
|
],
|
|
2473
2473
|
[
|
|
2474
2474
|
"scripts/check-composite-action-input-interpolation.py",
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@wednesdayai/deepinfra",
|
|
3
|
-
"version": "0.4.12-dev.
|
|
3
|
+
"version": "0.4.12-dev.25+46769abdb",
|
|
4
4
|
"private": true,
|
|
5
5
|
"description": "DeepInfra media understanding: Whisper audio transcription via the DeepInfra OpenAI-compatible API.",
|
|
6
6
|
"type": "module",
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@openclaw/dream-cycle",
|
|
3
|
-
"version": "0.4.12-dev.
|
|
3
|
+
"version": "0.4.12-dev.25+46769abdb",
|
|
4
4
|
"private": true,
|
|
5
5
|
"description": "WednesdayAI dream-cycle engine — idle-time sleep stages, contemplation, adaptation, crystallisation",
|
|
6
6
|
"type": "module",
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@wednesdayai/openrouter",
|
|
3
|
-
"version": "0.4.12-dev.
|
|
3
|
+
"version": "0.4.12-dev.25+46769abdb",
|
|
4
4
|
"private": true,
|
|
5
5
|
"description": "OpenRouter media understanding: audio transcription via the OpenRouter OpenAI-compatible API.",
|
|
6
6
|
"type": "module",
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "wednesdayai",
|
|
3
|
-
"version": "0.4.12-dev.
|
|
3
|
+
"version": "0.4.12-dev.25+46769abdb",
|
|
4
4
|
"description": "Multi-channel AI gateway with extensible messaging integrations",
|
|
5
5
|
"keywords": [],
|
|
6
6
|
"homepage": "https://github.com/ExpansionX/WednesdayAI-core#readme",
|