chore: promote staging to staging-promote/4353493a-24449434063 (2026-04-15 11:21 UTC)

[ironclaw-ci]

Auto-promotion from staging CI

Batch range: a53eac5c2dec6b6cd5c08189086093fde64aa9cb..be0b33b2a373e7b1e66cb9a587c181a19654eedc
Promotion branch: staging-promote/be0b33b2-24451653982
Base: staging-promote/4353493a-24449434063
Triggered by: Staging CI batch at 2026-04-15 11:21 UTC

Commits in this batch (46):

• a7401ec fix(gateway): scope chat approvals to the active thread (fix(gateway): scope chat approvals to the active thread #2267)
• 4032f6d Fix paired Telegram owner scope routine visibility (Fix paired Telegram owner scope routine visibility #2258)
• 7d66d83 fix(engine): always append ActionResult for every tool call (fix(engine): always append ActionResult for every tool call #2322)
• 764e586 feat(engine): LLM council via per-call model override in CodeAct (feat(engine): LLM council via per-call model override in CodeAct #2320)
• 70862ed feat(config): default CLI_MODE to TUI instead of REPL (feat(config): default CLI_MODE to TUI #2329)
• 207c4d4 ci: build docker image in release process (ci: build docker image in release process #2321)
• cd9b60c fix: re-apply Telegram UTF-16 splitting and DB MIGRATION label (fix: re-apply Telegram UTF-16 splitting and DB MIGRATION label #2304)
• 88b87c0 feat: user-facing temperature setting (feat: user-facing temperature setting #2275)
• fdb0a13 chore: sync staging and main (chore: sync staging and main #2337)
• 3cb77fe fix: resolve cargo-deny failures (wildcard deps + rand advisory) (fix: resolve cargo-deny failures (wildcard deps + rand advisory) #2370)
• ed2d6dc fix web chat refresh active thread ([codex] Fix web chat refresh active thread #2330)
• 66ccafb chore(engine): update monty to v0.0.11 (chore(engine): update monty to v0.0.11 #2364)
• 4529f00 fix(engine): track consecutive action errors in orchestrator Tier 0 path (Orchestrator: add action error counting to Python execution loop #2325) (fix(engine): track consecutive action errors in orchestrator (#2325) #2340)
• 50fc280 fix(agent): detect and escalate repeated identical failing tool calls (Agent retries same failing tool call up to 50 times with no duplicate detection #2240) (fix(agent): detect and escalate repeated identical failing tool calls #2338)
• 3f6149c feat(cli): add ironclaw profile list subcommand (feat(cli): add ironclaw profile list subcommand #2288)
• 625cd85 Suppress LLM_BACKEND warning when config.toml and .env values match (Suppress LLM_BACKEND warning when config.toml and .env values match #2388)
• a9cea6c fix(ci): skip NearAI URL DNS validation for non-NearAI backends (fix(ci): skip NearAI URL DNS validation for non-NearAI backends #2080)
• 160a75e fix(llm): image detail field + /v1 base URL normalization (fix(llm): image detail field + /v1 base URL normalization #2380)
• 4dbb44c fix(docker): make runtime-staging the default Docker target for Railway (fix(docker): make runtime-staging the default Docker target for Railway #2244)
• 532fc61 feat: admin management panel — web UI for users and usage monitoring (feat: admin management panel — web UI for users and usage monitoring #1963)
• 16b7b06 feat(web): add ironclaw docs link (feat(web): add ironclaw docs link #2398)
• ba81044 fix(mcp): Install NEAR AI MCP server from environment config (fix(mcp): Install NEAR AI MCP server from environment config #2181)
• 57d7b54 Fix Feishu webhook auth refresh and extension card overflow (fix: Feishu webhook auth refresh and extension card overflow #2443)
• 7425dc0 fix(security): harden approval thread safety (TOCTOU + error handling) (fix(security): harden approval thread safety (TOCTOU + error handling) #2366)
• 86a9d0b fix: image generation with nearai models (fix: image generation with nearai models #1819)
• 46ff740 docs(setup): warn that Telegram open mode splits history (docs(setup): warn that Telegram open mode splits history #2427)
• aea2e87 fix(ux): actionable auth errors and improved CLI help for new users (should make it easy to use #1852) (fix(ux): actionable auth errors and improved CLI help for new users (#1852) #2315)
• ab1f279 fix: more strict check for registry to avoid false positives (fix: more strict check for registry to avoid false positives #2222)
• 019c048 refactor(llm): promote decorator chain settings from NearAiConfig to top-level LlmConfig (refactor(llm): promote decorator chain settings from NearAiConfig to top-level LlmConfig #1749)
• b6f5da8 perf(tunnel): reuse HTTP client in CustomTunnel health checks (perf(tunnel): reuse HTTP client in CustomTunnel health checks #1201)
• fe2b134 fix(engine): guard consecutive-error checks against None limit (fix(engine): guard consecutive-error checks against None limit #2460)
• 37669e6 fix(web): prevent browser crash from timer leaks, DOM growth, SSE buffer ([QA] Pages Unresponsive dialog and black screen crashes #2406) (fix(web): prevent browser crash from timer leaks, DOM growth, SSE buffer (#2406) #2441)
• 1041094 style: fix cargo fmt line wrapping in thread_ops.rs (style: fix cargo fmt in thread_ops.rs #2451)
• 0a9d816 fix(responses-api): thread creation, GET by ID, streaming delta, context injection (fix(responses-api): thread creation, GET by ID, streaming delta, context injection #2167)
• 1fa73a4 docs: add Responses API section to USER_MANAGEMENT_API (docs: add Responses API reference #2440)
• 5140279 docs: guide how to host ironclaw on google cloud (docs: add google tutorial #2262)
• d85c11d fix(telegram): route WASM owner_id fallback (fix(telegram): route WASM owner_id fallback #2349)
• 28c6a15 fix(ci): exclude test files from PR size classification (fix(ci): exclude test files from PR size classification #2387)
• d63601e fix(security): gate test URL rewriters behind #[cfg(test)] (fixes SECURITY: Remove env-var-controlled API URL rewriters from production WASM channel wrapper (Telegram & Slack) #2056) (fix(security): gate test URL rewriters behind #[cfg(test)] (fixes #2056) #2401)
• 82d341d fix(sandbox): try Docker socket before CLI binary check (fix(sandbox): try Docker socket before CLI binary check #2467)
• 2dc78b2 feat(db): add per-user CachedSettingsStore decorator (feat(db): add per-user CachedSettingsStore decorator #2425)
• 8973d1b fix: use gateway owner_id for relay OAuth nonce storage (fix: use gateway owner_id for relay OAuth nonce storage #2473)
• 16a0731 test(e2e): add Playwright persistence happy-path test (test(e2e): add Playwright persistence happy-path test #2475)
• ae1f698 fix(llm): map HTTP 413 to ContextLengthExceeded for auto-compaction (fix(llm): map HTTP 413 to ContextLengthExceeded for auto-compaction #2339)
• 4353493 fix(gateway): resolve assistant thread for threadless broadcasts (fix(gateway): resolve assistant thread for threadless broadcasts #2444)
• be0b33b fix: duplicate reasoning_content fields in chat completions response (fix: duplicate reasoning_content fields in chat completions response #2493)

Current commits in this promotion (0)

Current base: main
Current head: staging-promote/be0b33b2-24451653982
Current range: origin/main..origin/staging-promote/be0b33b2-24451653982

• (no non-merge commits in range)

Auto-updated by staging promotion metadata workflow

Waiting for gates:

• Tests: pending
• E2E: pending
• Claude Code review: pending (will post comments on this PR)

---

Auto-created by staging-ci workflow

[claude]

Code review

Found 5 issues:

1. [HIGH:100] Duplicate RUSTSEC-2026-0098 in deny.toml

RUSTSEC-2026-0098 is listed twice in the ignore array (line 16 and line 21). This creates maintenance confusion and should be deduplicated. The new PR additions at line 20-22 inadvertently re-added an advisory already present.

https://github.com/anthropics/ironclaw/blob/1e16b8085a0a0a37734e76c8a7b09e474aec3ac5/deny.toml#L14-L22

2. [MEDIUM:HIGH] Inconsistent fallback logic between complete() and complete_with_tools()

The two methods implement subtly different semantics for fallback handling:

• complete() (line 532-534): applies fallback chain unconditionally
• complete_with_tools() (line 616, 639-643): only applies fallback when tool_calls.is_empty()

This violates the DRY principle and creates a maintainability hazard. Per CLAUDE.md ("extract helpers when logic is reused"), the fallback selection should be extracted to a single source of truth.

https://github.com/anthropics/ironclaw/blob/1e16b8085a0a0a37734e76c8a7b09e474aec3ac5/src/llm/nearai_chat.rs#L532-L534
https://github.com/anthropics/ironclaw/blob/1e16b8085a0a0a37734e76c8a7b09e474aec3ac5/src/llm/nearai_chat.rs#L639-L643

3. [MEDIUM:HIGH] Missing caller-level regression tests

Per CLAUDE.md's "Test Through the Caller, Not Just the Helper" rule, the new test test_both_reasoning_fields_parse_with_defined_precedence() only validates ChatCompletionResponseMessage deserialization in isolation. It does not verify:

• Fallback behavior when content is null but reasoning fields are present (through the actual complete() / complete_with_tools() methods)
• That reasoning_content is preferred over reasoning in the full methods
• That the tool-call suppression logic still applies when reasoning field is present

These gaps should be addressed with integration tests driving the full LLM provider methods.

https://github.com/anthropics/ironclaw/blob/1e16b8085a0a0a37734e76c8a7b09e474aec3ac5/src/llm/nearai_chat.rs#L1687-L1749

4. [MEDIUM:MEDIUM] Missing abstraction for reasoning field priority

The fallback precedence (content -> reasoning_content -> reasoning) is hardcoded at each call site. Consider extracting to a method on ChatCompletionResponseMessage to maintain a single source of truth:

impl ChatCompletionResponseMessage {
    fn get_text_content(&self, include_reasoning_fallback: bool) -> Option<String> {
        self.content.clone()
            .or_else(|| {
                if include_reasoning_fallback {
                    self.reasoning_content.clone().or(self.reasoning.clone())
                } else {
                    None
                }
            })
    }
}

This would unify logic across both methods and make the behavioral difference between complete() and complete_with_tools() explicit and maintainable.

https://github.com/anthropics/ironclaw/blob/1e16b8085a0a0a37734e76c8a7b09e474aec3ac5/src/llm/nearai_chat.rs#L1083-L1091

5. [LOW:HIGH] Field aliasing documentation gap

The comment at line 1083-1085 explains that models return reasoning in different field names, but now that the serde alias is removed and reasoning is a separate field, the documentation should clarify the new behavior: "The reasoning field is preferred by vLLM/SGLang; reasoning_content by GLM-5/DeepSeek. Both are fallbacks to content."

https://github.com/anthropics/ironclaw/blob/1e16b8085a0a0a37734e76c8a7b09e474aec3ac5/src/llm/nearai_chat.rs#L1083-L1091