The previous default of true was overly restrictive. false is the correct
default — tool-like prompts fall through to native handling only when
explicitly enabled.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add AbortSignal support to startCallbackServer and loginAnthropicOAuth
so that pressing Ctrl+C during the browser OAuth flow immediately closes
the HTTP server and 5-minute timer instead of leaving the process hung.
Wire up an AbortController in the TUI browser OAuth path so the cancel
callback aborts the signal on Ctrl+C.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add openBrowser, exchangeCodeForToken, and loginAnthropicOAuth to
src/auth/anthropic.ts, completing the full PKCE OAuth flow. Includes
5 new tests covering happy path, state mismatch, 403 subscription
error, 500 error, and missing access_token cases.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Introduce a `credentialStored` flag in all 4 credential paths (OpenAI
API key, OpenAI OAuth, Anthropic auth token, Anthropic API key). The
auth_mode prompt is now gated on `credentialStored`, so a failed store
call no longer falls through to prompt the user for an auth mode that
was never set.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Export AUTH_MODE_PROVIDERS and applyAuthModeToConfig from minimal.ts.
Wire mode fast-path into handleLoginCommand so /login anthropic mode oauth
persists auth_mode to config without entering the credential flow.
After successful credential entry for anthropic/openai, prompt to set
auth_mode immediately.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add support for `/login <provider> mode <api_key|oauth|auto>` syntax to allow
switching authentication mode per provider in the TUI. The Command union type
now includes an optional mode field, and parseCommand handles regex matching
for the "mode" subcommand pattern while maintaining backward compatibility.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Key changes from review:
- Use separate _sessionContext field instead of mutating _systemPromptBase
- Parameterize compaction prompt via buildCompactionPrompt() instead of duplicating
- Fix flaky TTL=0 test to use hardcoded past expiry date
- Route memory extraction to {userNamespace}/facts when namespace is set
- Document future considerations (config refactor, concurrent writes, token counting)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Two-tier memory model (working memory + long-term store) with a unified
user namespace across all channels. Addresses four gaps: cross-session
forgetting, compaction context loss, no proactive recall, and channel
fragmentation.
Key design decisions:
- user/working namespace written on every compaction (TTL-based expiry)
- user/profile + user/patterns as shared identity across channels
- Session-start injection before first turn (one-time, idempotent)
- Opt-in via memory.user_namespace config; default is unchanged behavior
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The scorecard claimed 128/128 (100%) which was never accurate — the
2026-02-06 gap analysis listed 16 MISSING features that remain
deferred. Updated to ~114/130 (~88%) with explicit list of deferred
items: channel adapters (Matrix/Zalo/LINE/Feishu/Mattermost), providers
(MiniMax/Moonshot/Vercel AI/OAuth), native companion apps, ClawHub,
Bonjour/mDNS, skill safety scanner, and elevated mode.
Also added missing progress entries for Phase 3 (companion/canvas/voice
deepening), Phase 4 (rollout/operator readiness), and the post-phase
test fixes.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- platformClients.integration: iOS/Android push tests lacked
setStatus() call before listNodes(), so platform filter excluded
nodes. Added publishHeartbeat() to set platform on connection state.
- server.test: agent.send now emits run_state events before done (Phase
1). Added sendAndWaitForDone() helper and updated test to find done
event rather than assuming index 0.
- handlers.test: updated agent.send/cancel assertions to use find()
and pass send arg to agent.cancel, consistent with run_state events.
- httpBody: req.destroy() closed socket before 413 response could be
sent. Removed socket destruction from body reader; 413 responses now
send Connection: close so Node closes the connection cleanly.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
William Valentin