6 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
4 people	4f9e2ff281	feat(server): OCP_LOCAL_TOOLS — positive local-tools system-prompt wrapper (single-user, default off) (#182) ... Motivation (the OpenClaw case). OCP's `-p` path prepends OCP_SYSTEM_PROMPT_WRAPPER, which tells the model it has NO local filesystem/shell/env access. Correct for a shared/multi-tenant gateway. But an OpenClaw agent pointed at its own local OCP runs the model SERVER-SIDE via `claude -p`, which already passes --allowedTools and has the CLI's built-in tools — and on a loopback instance the OCP host IS the operator's machine, so those are local tools. The wrapper gags them: the agent replies "I don't have filesystem access" for tools it actually holds. OCP_LOCAL_TOOLS=1 swaps in a positive wrapper for that case. (It does NOT enable client-side tool_calls for OpenClaw/Cline — that remains unsupported by design; OCP is a text-prompt bridge.) Safety: changes ONLY the system-prompt text, never the tool surface. Tools are governed solely by --allowedTools/--disallowedTools; AUTH_MODE=multi still --disallowedTools the whole FS/web/agent surface regardless of the wrapper. Fail-closed boot gate mirroring OCP_TUI_FULL_TOOLS (ADR 0007): refuse to start when =1 is combined with CLAUDE_AUTH_MODE=multi, a non-loopback bind, or PROXY_ANONYMOUS_KEY. Scope/alignment: no new endpoint/header/field/wire operation. The wrapper text is OCP-owned prompt composition (same class as OCP_SYSTEM_PROMPT_WRAPPER and CLAUDE_SYSTEM_PROMPT), passed via the already-cited `claude --system-prompt` flag (unchanged). ALIGNMENT.md Rule 2: nothing invented on the wire. - lib/prompt.mjs: pure selectPromptWrapper() + localToolsSafetyError() (unit-tested). - server.mjs: single hoisted flag LOCAL_TOOLS_ACTIVE = OCP_LOCAL_TOOLS && !TUI_MODE (the wrapper is only applied on the -p path; TUI composes its own prompt, so the flag is inert under TUI — announced with a warning rather than a misleading "ON"). Wrapper selection, boot gate, and the CONFIG_EPOCH fold all key off it, so toggling the flag + restarting invalidates the standard response cache (#177). Default path byte-for-byte unchanged. - README env-var row + tool-model note; CHANGELOG Unreleased entry. Tests (+14): unit-test both ternary branches and every gate condition; plus an INTEGRATION harness that boots real server.mjs with a fake `claude` capturing the --system-prompt — asserting the POSITIVE wrapper reaches a request under =1 and the EXACT negative wrapper when unset, the boot gate refuses all three unsafe configs, the safe config boots, TUI announces inert, and toggling the flag re-spawns (cache invalidated). Mutation-verified: reverting the wiring / neutering the gate / reverting the epoch fold each turns a test RED. 443 passed, 0 failed. Noticed but scoped out (Iron Rule 11): the structured-output cache path (handleChatCompletions, the response_format branch) does not fold CONFIG_EPOCH at all — a pre-existing gap from #177/#153, independent of this flag. Happy to fix in a follow-up. Co-authored-by: vvlasy-openclaw <vvlasy@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-21 21:05:38 +10:00
5 people	47e324b68f	fix(server): assemble every assistant message so agentic turns return the final answer (#183) ... * fix(server): assemble every assistant message so agentic turns return the final answer `/v1/chat/completions` returned only the agent's opening preamble ("I'll find the repo…") and silently dropped the post-tool-use final answer on every tool-using (agentic) turn. The work still ran; OpenAI-compat clients (OpenClaw via ocp-connect, OpenAI-SDK scripts) just received the preamble — the turn looked like it "did nothing." Root cause: `parseStreamJsonEvent` extracted aggregate `assistant` text only when `isFirstDelta` was true, and `isFirstDelta` flips false after the first text. Run without `--include-partial-messages` the claude CLI emits NO content_block_delta events — each assistant message arrives as its own aggregate `assistant` event — and an agentic turn emits SEVERAL (preamble → one per tool round → final answer). So only the first message's text survived; every later message, including the final answer, was discarded. Fix: guard on `sawTextDelta` (set only by a real content_block_delta) instead of `isFirstDelta`. In aggregate mode (no deltas) accumulate the text of EVERY `assistant` event, joined with a blank line; the delta+aggregate double-count case is still deduped (a delta was seen ⇒ ignore the aggregate). Applied to both the buffered (`-p`) and SSE-streaming paths, plus the mirrored parser + tests in test-features.mjs. 430 passed, 0 failed; added a multi-message agentic regression test. Evidence — verified live, claude CLI 2.1.206 (`-p --output-format stream-json --verbose --allowedTools Bash`): a preamble+tool+answer turn emits four `assistant` events, two carrying text — #2 "Starting the task now." (preamble) and #4 "It printed AGG_EVIDENCE_99." (final answer, after the Bash tool). Old code returned only #2; new code returns both. Endpoint class: B.1 (OpenAI-compatibility surface, `/v1/chat/completions`). Specification: OpenAI chat/completions — the assistant `message.content` (and the concatenation of streamed `choices[].delta.content`) carries the model's full response text (https://platform.openai.com/docs/api-reference/chat/create). Authorizing ADR: ADR 0006 — OpenAI shim scope. cli.js does NOT perform this operation (it speaks Anthropic's protocol, not OpenAI's); scope is justified under ADR 0006 Class B.1. No new endpoint, header, request field, or response field — this only fixes how OCP assembles claude CLI stream-json output into the existing `content` field. No Class A (cli.js-mirror) surface is touched. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Merge origin/main into #183 + align streaming-path separator to the buffered guard (reviewer LOW-cosmetic parity) --------- Co-authored-by: vvlasy-openclaw <vvlasy@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: dtzp555 <dtzp555@gmail.com>	2026-07-21 19:58:09 +10:00
5 people	788cbbcd99	feat(server): honor OpenAI response_format for structured-output clients (#153) ... * feat(server): honor OpenAI response_format for structured-output clients `/v1/chat/completions` advertises OpenAI compatibility but ignored `response_format`, so clients requiring machine-parseable JSON (Home Assistant AI Tasks, Honcho, OpenAI-SDK scripts) received free-form assistant prose — markdown tables, ```json fences, trailing commentary — that fails JSON.parse. This honors the OpenAI `response_format` contract on the `-p` path: - New `lib/structured-output.mjs` (pure, unit-tested): `detectStructuredOutput` (json_schema / json_object), `structuredSystemInstruction` (strict JSON-only steering, escalated on retry), `extractJsonPayload` (string-aware balanced slice that unwraps fences/prose), and a minimal JSON-Schema `validateJsonSchema` (types, required, enum, const, additionalProperties, nullability, items, min/maxItems). - `server.mjs`: `runStructuredCompletion` retries up to `OCP_STRUCTURED_MAX_ATTEMPTS` (default 3), returns the canonical JSON string as `message.content`, and yields HTTP 422 (`invalid_response_error`) if no valid JSON can be produced. Structured requests take their own path (bypass the cache, which does not key on response_format). Non-structured requests are byte-for-byte unchanged, streaming included. - Nullability precedence: a `null` value is accepted whenever the schema permits null (`type:["x","null"]` / `nullable:true`), even if a bare `enum` omits null — matches OpenAI behaviour and fixes real Home Assistant schemas (`type:["string","null"], enum:["Loxone"]`) that otherwise 422 on null. - README: Structured Outputs section + `OCP_STRUCTURED_MAX_ATTEMPTS` env row. - 18 new unit tests (281 passed, 0 failed). Endpoint class: B.1 (OpenAI-compatibility surface, `/v1/chat/completions`). Specification: OpenAI chat/completions `response_format` (https://platform.openai.com/docs/api-reference/chat/create#chat-create-response_format). Authorizing ADR: ADR 0006 — OpenAI shim scope. cli.js does NOT perform this operation (it speaks Anthropic's protocol, not OpenAI's); scope is justified under ADR 0006 Class B.1 (OpenAI spec as protocol authority). Revives closed PR #99. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(server): structured-output caching + json_mode alias Follow-up on the response_format path, closing the two gaps vs closed PR #99: - **Validated caching (improves on #99).** Structured responses now use the OCP cache when CLAUDE_CACHE_TTL>0, on a structured-keyed hash: cacheHash gains an `structured` marker folding the detected response_format/schema into the key, so a JSON reply never collides with the conversational answer to the same prompt and different schemas never share a slot. Only a *validated* result is written back — a 422 is never cached. (#99 cached the fence-stripped but *unvalidated* output; this caches only schema-valid JSON.) The marker is absent for normal requests, so existing cache hashes are byte-identical. - **json_mode alias.** Honor the non-standard top-level `json_mode: true` flag as a json_object alias, matching #99's activation set. Disclosed as non-spec. - README: json_mode shape + caching note. +2 unit tests (283 passed, 0 failed). Endpoint class: B.1 (/v1/chat/completions), ADR 0006. json_mode is a non-OpenAI convenience alias (disclosed); everything else stays within OpenAI's response_format spec. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(server): address PR #153 review — $ref/strict, extraction safety, refusal, singleflight Remediates the maintainer's merge-blocking findings on the structured-output PR, and rebases onto current main (the one-hunk test-features.mjs conflict — both sides appended tests — resolved by keeping both blocks). Class B.1 (OpenAI-compat): spec authority is OpenAI chat/completions `response_format` (https://platform.openai.com/docs/api-reference/chat/create#chat-create-response_format), authorized by ADR 0006. No cli.js analogue (claude -p has no native response_format); scope is the B.1 shim, not a Class A forward. Finding 1 (correctness gate) — strict:true + $ref/$defs rejected valid objects 100% of the time. `noExtra = addl === false || (strict && addl === undefined)` treated a nested {$ref:"#/$defs/step"} as an empty-properties object and, under strict, rejected every real key as "additional property not allowed" — exactly the shape the OpenAI SDK emits (zodResponseFormat / client.beta.chat.completions.parse) and OpenAI's own docs example. Fix: validateJsonSchema now resolves same-document $ref against the root $defs/definitions, handles allOf/anyOf/oneOf composition, and only infers additionalProperties:false from strict when the object actually declares its own non-empty properties and is not a composite. Explicit additionalProperties:false is always honoured, so validation is not weakened (tests prove an extra key and a missing required key still fail under strict). Finding 2 (correctness gate) — the extractor served JSON the model did not mean. json_object mode had no validation at all: a refusal like `I can't. The schema is {"type":"object"}` returned the embedded object as the answer. Now json_object requires the WHOLE reply to parse as a single JSON value, and schema mode rejects a reply carrying more than one top-level JSON value (Schema:{}/Answer:{}, Option A/Option B) rather than silently picking the first. The schema-validated value is still returned; nothing unvalidated is served. Finding 3 — replaced the invented `invalid_response_error` 422 with OpenAI's assistant `refusal` field (200, content:null, refusal:<reason>, finish_reason:"stop"), streaming and non-streaming, so SDK clients take their refusal branch instead of throwing an opaque UnprocessableEntityError. Finding 5 — runStructuredCompletion no longer bypasses stampede protection. Identical concurrent one-off structured requests now share one singleflight (independent of cache enablement), so N callers no longer cost N × up-to-3 spawns. Cache read/write still gated on CLAUDE_CACHE_TTL; refusals are never cached. Docs: README structured-output § updated (refusal field, $ref/composition support, whole-reply json_object rule, ambiguous-multi-value rejection) plus a Caching & cost paragraph stating the post-2026-06-15 model, the up-to-N-spawn worst case, the singleflight + validated-cache guards, and the OCP_STRUCTURED_MAX_ATTEMPTS=1 / per-key quota levers. Tests: +11 (all pure-module) — OpenAI's doc $ref/$defs schema under strict:true accepts a conforming reply and still rejects extra/missing keys; anyOf/allOf; unresolvable $ref skipped; json_object refusal-embedded-json rejected; >1-top-level-value rejected. 360 passed, 0 failed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(server): address PR #153 review round 2 — cyclic-$ref guard + NaN attempts guard Remediates the two remaining merge-blocking findings from the round-2 review. Class B.1 (OpenAI-compat): spec authority is OpenAI chat/completions `response_format` (https://platform.openai.com/docs/api-reference/chat/create#chat-create-response_format), authorized by ADR 0006. No cli.js analogue (claude -p has no native response_format, and the retry cap OCP_STRUCTURED_MAX_ATTEMPTS is OCP's own coercion loop, not a cli.js operation); scope stays the B.1 shim, not a Class A forward. BLOCKER — cyclic $ref stack-overflowed the validator. resolveRef + the $ref branch of validateJsonSchema had no cycle detection: a pure ref→ref cycle ({$defs:{a:{$ref:b},b:{$ref:a}},$ref:a}) recursed independent of the data and threw RangeError for ANY reply value (even `5`), caught upstream as a 500 but only after 1–3 metered spawns — a request-controlled cost-amplification / grief vector on an authed path. Fix: validateJsonSchema now threads a `refChain` of the $ref pointers resolved on the current path WITHOUT consuming data (a $ref hop, or an allOf/anyOf/oneOf branch — all re-validate the same value); a pointer reappearing on that chain fails closed with a `cyclic $ref detected` error. Data-consuming recursion (properties/items/ additionalProperties) deliberately resets the chain, because a JSON value is a finite tree so those always terminate — a legitimately recursive schema (Node→child:Node) must NOT be flagged. A REF_DEPTH_CAP backstops any threading mistake. MUST-FIX — OCP_STRUCTURED_MAX_ATTEMPTS NaN guard was broken. `Math.max(1, parseInt(env ||"3",10))` === `Math.max(1, NaN)` === NaN for a non-integer value, so the retry loop `attempt < NaN` never ran → 0 spawns, every structured request silently refused (fails closed on cost but bricks the feature and ignores the intended floor). Fix: extracted a pure fail-closed resolveMaxAttempts() into lib/structured-output.mjs — rejects NaN/non-finite/<1, keeps the documented default of 3, and warns at startup. server.mjs now derives STRUCTURED_MAX_ATTEMPTS through it. Tests: +8 (all pure-module) — a→b→a and self (a→a) cyclic $ref fail closed without overflowing the stack; a cycle routed through anyOf; a legitimate recursive Node schema is NOT flagged; resolveMaxAttempts honors valid integers, defaults on unset/empty/null, and fails closed (not NaN, not 0) on abc/0/-1/NaN/Infinity/blank with a startup warn. 368 passed, 0 failed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: vvlasy-openclaw <vvlasy@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: dtzp555 <dtzp555@gmail.com>	2026-07-20 07:55:40 +10:00
6 people	ac81badda1	feat(chat): forward OpenAI image_url parts to Claude (multimodal vision) (#154) ... * feat(chat): forward OpenAI image_url parts to Claude (multimodal vision) `POST /v1/chat/completions` previously flattened every message to plain text via contentToText(), replacing image_url parts with "[non-text content omitted]" — so images were silently dropped (issue #110). This adds real multimodal support: OpenAI `image_url` content parts are translated to Anthropic image blocks and fed to the Claude CLI over `--input-format stream-json`, keeping subscription auth (the reason OCP routes through the CLI rather than the API). Class B.1 (OpenAI-compatibility surface), authorized by ADR 0006. Request shape follows OpenAI's published vision / chat-completions spec (https://platform.openai.com/docs/guides/vision and the chat/completions `content` image_url part) — no field is introduced beyond OpenAI's shape. The CLI's `--input-format stream-json` is the transport for this Class B endpoint, not a forwarded cli.js operation, so there is no Class A cli.js citation to make; scope is justified under the ALIGNMENT.md Class B mapping of Rule 2 (no invention beyond the cited OpenAI spec). Mechanism (verified empirically against the installed CLI, v2.1.206): a user message whose `content` is an Anthropic block array including `{type:"image",source:{type:"base64",media_type,data}}` fed to `claude -p --input-format stream-json` is correctly described by the model. Confirmed live end-to-end through this endpoint (a base64 PNG returns the correct color). Design: - New pure module `lib/multimodal.mjs` (mirrors the lib/*.mjs pattern; unit- testable without a live server): hasImageContent, buildImageBlocks, buildStreamJsonInput, MultimodalError. - server.mjs: text path is byte-for-byte unchanged. Only when a request carries an image_url part does spawnClaudeProcess switch stdin to a stream-json user envelope and buildCliArgs add `--input-format stream-json`. Image parsing runs before any stats mutation so a validation failure never leaks counters/slots. - Images bypass the text char budget (CLAUDE_MAX_PROMPT_CHARS) and are bounded by explicit byte/count caps with clear 4xx errors (413 for size/count, 400 for malformed/unsupported/disabled-remote), never a silent drop. Scope decisions (v1): - Base64 data URIs supported by default (image/jpeg,png,gif,webp). - Remote http(s) image URLs OFF by default behind CLAUDE_IMAGE_ALLOW_URL; when enabled they are passed through as an Anthropic url-source (OCP never fetches the URL itself, so no OCP-side SSRF surface). - Audio/file parts deferred: existing placeholder behavior preserved. - Images anywhere in multi-turn history, not just the last message. New env vars (documented in README Environment Variables table): CLAUDE_IMAGE_ALLOW_URL, CLAUDE_MAX_IMAGE_BYTES, CLAUDE_MAX_IMAGES, CLAUDE_MAX_IMAGE_TOTAL_BYTES, CLAUDE_MAX_BODY_SIZE (now configurable; default 5 MB unchanged). Tests: 26 unit tests in test-features.mjs covering data-URI parse, multiple images, text/image ordering, multi-turn history images, malformed/oversized/ too-many handling, remote-URL policy, and text-path parity. `npm test` green (289 passed). `node --check` clean. No alignment-blacklist tokens added. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(chat): address PR #154 review blockers — TUI guard, fail-closed caps, text budget Remediates the three merge-blocking findings from the maintainer's review of the multimodal vision PR. Class B.1 (OpenAI-compat surface): request shape per OpenAI vision spec (image_url content parts), authorized by ADR 0006. No new wire shape and no cli.js surface change — the stream-json image contract is the CLI's native input format (already cited in the base commit); these are correctness fixes on the OCP-owned validation/dispatch layer. F1 — TUI mode silently dropped images and returned 200. callClaudeTui() renders every non-text part as "[non-text content omitted]", so a vision request in CLAUDE_TUI_MODE=true was answered about an image the model never saw. Now handleChatCompletions fails loudly with 400 images_unsupported_in_tui_mode instead of a silent drop (ALIGNMENT.md forbids serving text the model did not mean). Documented in README § Images / Multimodal. F3 — NaN env parsing failed open. CLAUDE_MAX_BODY_SIZE=unlimited -> NaN -> `body.length > NaN` always false -> body cap gone (OOM DoS); =5MB -> 5 bytes -> proxy bricked; same on CLAUDE_MAX_IMAGES / _IMAGE_BYTES / _IMAGE_TOTAL_BYTES. Added lib/env.mjs parsePositiveInt (pure, fail-closed) + a thin parseIntEnv warn wrapper; a malformed cap now keeps the safe default and warns at startup. F2 — images let unbounded text bypass MAX_PROMPT_CHARS. buildImageBlocks only counted textChars and never truncated; the budget was never passed in. Threaded maxTextChars (= MAX_PROMPT_CHARS) into the multimodal transform, which now truncates text tail-first (mirroring messagesToPrompt) while preserving image blocks, and logs prompt_truncated. Tests: +11 in test-features.mjs (all pure-module, per the repo's no-server-import pattern) covering the text-budget enforcement and the fail-closed cap parsing, including the exact F2 (500k chars + 1 image) and F3 (unlimited/5MB/0/20.5) scenarios. 300 passed, 0 failed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(server): address PR #154 review round 2 — MAX_PROMPT_CHARS fail-closed + system-only image guard Closes the two residual gaps from the round-2 review, both traced to the same root as the already-fixed blockers. Class B.1 (OpenAI-compat vision): authorized by ADR 0006; request shape is the OpenAI `image_url` content part. No new wire shape — the Anthropic image block over `--input-format stream-json` is the CLI's native contract (cli.js buildStreamJsonInput path, verified live in round 1). MAX_PROMPT_CHARS is OCP's own truncation guard, not a cli.js operation. Gap (a) — MAX_PROMPT_CHARS was left on the raw parseInt while every other cap moved to the fail-closed helper. `let MAX_PROMPT_CHARS = parseInt(env||"150000",10)` sat five lines above the parseIntEnv helper this PR added, so CLAUDE_MAX_PROMPT_CHARS=unlimited → NaN → enforceTextBudget's `!(NaN > 0)` early-return → 500k chars passed unbounded, truncated:false, silently defeating F2's text-budget guarantee under a plausible operator config. Fix: hoist parseIntEnv above the declaration and derive MAX_PROMPT_CHARS through it (keeps `let` for the settings API). A misconfigured value now keeps the 150k default and warns, like the other caps. Gap (b) — an image present ONLY in a system message silently dropped in non-TUI mode. Detection runs on the full message list, but extraction/spawn filter role==="system" out, so a system-only image was detected as multimodal, survived no filter, fell to the text path, and rendered as "[non-text content omitted]" → 200 with a hallucinated answer — the one silent-drop outcome F1 exists to forbid. Fix: after filtering, if hasImageContent(full) is true but no image survives, return `400 images_unsupported_in_system_messages`. Narrow (OpenAI disallows images in the system role) so no legitimate request is rejected. Documented in README § Images. Tests: +4 (all pure-module) — parsePositiveInt('unlimited') keeps the 150k default (gap a) and a valid override is honored; hasImageContent proves the guard predicate fires for a system-only image (true on full list, false after the system filter) and does NOT fire for a user-message image. 304 passed, 0 failed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: vvlasy-openclaw <vvlasy-openclaw@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: vvlasy-openclaw <vvlasy@gmail.com> Co-authored-by: dtzp555 <dtzp555@gmail.com>	2026-07-20 07:50:17 +10:00
5 people	0c3e42b2e4	feat(models): repoint default sonnet alias to claude-sonnet-5 (#168) ... * feat(models): add Claude Sonnet 5 to models.json SPOT Adds `claude-sonnet-5` (the latest Sonnet, supported by claude CLI >= 2.1.206) to models.json — the single source of truth (ADR 0003). Both the /v1/models endpoint and setup.mjs OpenClaw registration derive from it automatically. - New model entry `claude-sonnet-5` (reasoning, 200k ctx, 16k max tokens), mirroring the existing Sonnet entry shape. - Point the `sonnet` alias at `claude-sonnet-5` (newest Sonnet), consistent with `opus` -> `claude-opus-4-8`. Previous `claude-sonnet-4-6` is retained for pinning. - README "Available Models" table updated (release-kit 5.3). - Update the aliases.sonnet SPOT test to the new default. Endpoint class: B.1 (/v1/models), data-only via the models.json SPOT. Authorized by ADR 0006 (OpenAI shim scope) + ADR 0003 (models.json SPOT). Verified: `claude --model claude-sonnet-5 -p` returns a valid response on a current subscription CLI (2.1.206); npm test green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(models): make PR #152 purely additive + close ocp-connect drift + real SPOT test Addresses the maintainer's review. Rescopes this PR to the additive change only — adding claude-sonnet-5 to models.json — and defers the `sonnet` alias repoint to its own PR per Iron Rule 11 (the alias is the default for every request that omits `model`; repointing it is a behavior change that deserves separate review + a CHANGELOG entry). No server.mjs change, so no cli.js citation required. Metadata confirmed unchanged: contextWindow 200000 / maxTokens 16384 stay, per the maintainer's correction (OCP truncates at MAX_PROMPT_CHARS, and contextWindow feeds OpenClaw's compaction budget — advertising a larger window than OCP delivers just makes OpenClaw overshoot). Fixes vs review: 1. Reverted `aliases.sonnet` back to claude-sonnet-4-6 — this PR only *adds* the model; the repoint ships separately. README updated to match (5 is available by full ID; 4-6 remains the alias default). 2. Replaced the tautological SPOT test. The old assertion read a literal out of models.json and asserted it equalled the same literal — it passed even with a dangling alias. Added referential-integrity tests: every aliases/legacyAliases value must resolve to a real models[].id, plus an explicit assertion that claude-sonnet-5 exists in models[]. This is the guard that actually catches an alias pointing at a non-existent model (VALID_MODELS keys on alias names, never targets, so nothing else checks this). 3. Fixed ocp-connect classification drift. Its prefix table pinned "claude-sonnet-4", which misses "claude-sonnet-5" and falls through to the non-reasoning / 8k-output default. Broadened both the model_meta and alias_prefixes tables to family prefixes (claude-opus / claude-sonnet / claude-haiku) so any future versioned ID classifies correctly with no per-model edit. /v1/models does not expose reasoning/maxTokens (OpenAI /v1/models schema has no such fields — adding them would be a Rule 2 invention), so family classification stays in ocp-connect. primary_model stays claude-sonnet-4-6, matching the (unchanged) sonnet alias — it moves with the alias in the repoint PR. Tests: 266 passed, 0 failed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(models): repoint default `sonnet` alias to claude-sonnet-5 Split out from #152 per Iron Rule 11: the additive model entry (#152) lands the claude-sonnet-5 metadata; this PR makes the behavior change — moving the default `sonnet` alias from claude-sonnet-4-6 to claude-sonnet-5. `aliases.sonnet` is the model used for every /v1/chat/completions request that omits `model` (server.mjs default) and, via ocp-connect, OpenClaw's OCP primary. Repointing it changes behavior for every such client, so it gets its own PR + CHANGELOG entry separate from the additive entry. - models.json: aliases.sonnet -> claude-sonnet-5 (claude-sonnet-4-6 kept by full ID for pinning). Both are pricing tier_3_15 — no cost regression. - ocp-connect: primary_model now prefers claude-sonnet-5 (falls back to 4-6, then first model), tracking the alias default so OpenClaw's primary matches. - README: swap the "default for sonnet alias" annotation onto claude-sonnet-5. - CHANGELOG: Unreleased § Changed entry documenting the default change + how to pin. - test: SPOT assertion updated to claude-sonnet-5; referential-integrity tests from #152 continue to guard that the alias target actually exists in models[]. No server.mjs change, so no cli.js citation required. Depends on #152 (needs the claude-sonnet-5 models[] entry to exist, else the referential-integrity test fails). Rebase/merge after #152 lands. Tests: 266 passed, 0 failed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: vvlasy-openclaw <vvlasy@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: dtzp555 <dtzp555@gmail.com>	2026-07-17 08:10:33 +10:00
4 people	27216646c8	feat(models): add Claude Sonnet 5 to models.json SPOT (#152) ... * feat(models): add Claude Sonnet 5 to models.json SPOT Adds `claude-sonnet-5` (the latest Sonnet, supported by claude CLI >= 2.1.206) to models.json — the single source of truth (ADR 0003). Both the /v1/models endpoint and setup.mjs OpenClaw registration derive from it automatically. - New model entry `claude-sonnet-5` (reasoning, 200k ctx, 16k max tokens), mirroring the existing Sonnet entry shape. - Point the `sonnet` alias at `claude-sonnet-5` (newest Sonnet), consistent with `opus` -> `claude-opus-4-8`. Previous `claude-sonnet-4-6` is retained for pinning. - README "Available Models" table updated (release-kit 5.3). - Update the aliases.sonnet SPOT test to the new default. Endpoint class: B.1 (/v1/models), data-only via the models.json SPOT. Authorized by ADR 0006 (OpenAI shim scope) + ADR 0003 (models.json SPOT). Verified: `claude --model claude-sonnet-5 -p` returns a valid response on a current subscription CLI (2.1.206); npm test green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(models): make PR #152 purely additive + close ocp-connect drift + real SPOT test Addresses the maintainer's review. Rescopes this PR to the additive change only — adding claude-sonnet-5 to models.json — and defers the `sonnet` alias repoint to its own PR per Iron Rule 11 (the alias is the default for every request that omits `model`; repointing it is a behavior change that deserves separate review + a CHANGELOG entry). No server.mjs change, so no cli.js citation required. Metadata confirmed unchanged: contextWindow 200000 / maxTokens 16384 stay, per the maintainer's correction (OCP truncates at MAX_PROMPT_CHARS, and contextWindow feeds OpenClaw's compaction budget — advertising a larger window than OCP delivers just makes OpenClaw overshoot). Fixes vs review: 1. Reverted `aliases.sonnet` back to claude-sonnet-4-6 — this PR only *adds* the model; the repoint ships separately. README updated to match (5 is available by full ID; 4-6 remains the alias default). 2. Replaced the tautological SPOT test. The old assertion read a literal out of models.json and asserted it equalled the same literal — it passed even with a dangling alias. Added referential-integrity tests: every aliases/legacyAliases value must resolve to a real models[].id, plus an explicit assertion that claude-sonnet-5 exists in models[]. This is the guard that actually catches an alias pointing at a non-existent model (VALID_MODELS keys on alias names, never targets, so nothing else checks this). 3. Fixed ocp-connect classification drift. Its prefix table pinned "claude-sonnet-4", which misses "claude-sonnet-5" and falls through to the non-reasoning / 8k-output default. Broadened both the model_meta and alias_prefixes tables to family prefixes (claude-opus / claude-sonnet / claude-haiku) so any future versioned ID classifies correctly with no per-model edit. /v1/models does not expose reasoning/maxTokens (OpenAI /v1/models schema has no such fields — adding them would be a Rule 2 invention), so family classification stays in ocp-connect. primary_model stays claude-sonnet-4-6, matching the (unchanged) sonnet alias — it moves with the alias in the repoint PR. Tests: 266 passed, 0 failed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: vvlasy-openclaw <vvlasy@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 07:35:42 +10:00