The session_list and session_destroy functions used crate::daemon directly
without #[cfg(unix)] guards, causing compilation failure on Windows (E0433
unresolved import, E0282 type annotations needed). Daemon functionality
relies on Unix sockets and is unavailable on Windows.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
npm publish does not resolve workspace:* dependencies, causing
@actionbookdev/openclaw-plugin to ship with unresolvable deps on npm.
Switch to pnpm publish --no-git-checks which auto-resolves workspace
references to actual version numbers.
- Add integrity and crossorigin attributes to all Prism.js CDN links
- Addresses CodeQL security warning about external resource loading
- Ensures CDN resources cannot be tampered with (supply chain security)
- Uses SHA-384 hashes for all CSS and JS resources
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
* chore: align dify plugin manifest and privacy policy
* [packages/dify-plugin]refactor: replace hyperbrowser SDK with direct HTTP API
Remove hyperbrowser Python SDK dependency and use requests to call
Hyperbrowser REST API directly. This eliminates an extra dependency
that may not install cleanly in Dify Cloud's serverless runtime.
- providers/hyperbrowser.py: HTTP POST/PUT instead of SDK client
- pyproject.toml: drop hyperbrowser>=0.1.0 dependency
- requirements.txt: add explicit requirements file
- tests/test_providers.py: mock requests instead of SDK classes
* [packages/dify-plugin]feat: add HTML misroute guard and simplify tool error handling
Add utils/http_guard.py to detect when API responses return HTML
instead of expected text/JSON — a common symptom of ACTIONBOOK_API_URL
pointing to a non-Actionbook endpoint (e.g. Dify app API).
- Integrate HTML guard into search_actions, get_action_by_area_id, provider
- Simplify verbose error branches into concise messages
- Remove debug-level logging from hot paths
- Update all related tests with Content-Type headers and new assertions
* [packages/dify-plugin]refactor: lazy-load browser deps for serverless compatibility
Defer importing playwright and connection_pool until first browser
tool invocation. This allows search_actions and get_action_by_area_id
to work even when playwright binaries are unavailable (e.g. Dify
Cloud serverless runtime).
- tools/__init__.py: lazy __getattr__ for browser tool classes
- browser_create_session.py: thread-safe lazy pool import
- browser_operator.py: lazy import with stub exception fallbacks
* [packages/dify-plugin]fix: review fixes — dead code, lazy import, session recovery
- Remove unreachable except BaseException blocks in search_actions
and get_action_by_area_id (dead code: only re-raised what it caught)
- Apply lazy connection_pool import in browser_stop_session, matching
browser_create_session and browser_operator pattern for serverless
- Preserve provider_name/api_key on session recovery reconnect to
prevent remote session leaks when browser_stop_session runs later
- Update tests accordingly
* [root]chore: use changeset for dify-plugin version bump
Revert manual 0.1.1 bump back to 0.1.0 and add a changeset file
so CI handles versioning through the standard two-phase flow.
Also extend sync-versions.js to run `uv lock` after updating
pyproject.toml to keep uv.lock in sync automatically.
* [root]fix: add workflow permissions and restrict changeset scope
- Add contents:write and pull-requests:write permissions to release
workflow so changesets/action can create PRs and push commits
- Expand ignore list to exclude all non-releasable packages (services,
playground) to prevent accidental npm publishes
- Add build:release script that only builds changeset-managed packages
to avoid CI failures from unrelated build errors
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* [root]feat: unify CLI & extension releases under changeset workflow
Replace 3 separate release flows (changesets for JS, tag-triggered for
CLI, tag-triggered for extension) with a single unified workflow driven
by Version PRs.
- Add scripts/sync-versions.js to sync CLI version to platform packages
and extension version to manifest.json after changeset version
- Rewrite release.yml with 5 conditional jobs: version-or-release,
publish-js, build-cli, publish-cli, release-extension
- Remove platform binary packages from pnpm workspace (pure containers)
- Enable privatePackages versioning for extension in changeset config
- Delete release-cli.yml and release-extension.yml
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* [root]chore: ignore json-ui-site and knowledge-builder-any in changesets
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
github-actions[bot]