- advance the disabled-dream cursor before touching the cron store so
the #4242 fix still applies when jobs.json is corrupt
- pin the gateway wiring: the disabled-path test now asserts both
dream and heartbeat are retired, not just unregistered
- cover remove_system_job on a fresh install with no store file
Disabling gateway.heartbeat (or agents.defaults.dream) only skipped
job registration on startup; the previously persisted system job in
<workspace>/cron/jobs.json kept firing, and remove_job refuses to
touch protected system jobs. Add CronService.remove_system_job for
startup reconciliation and call it from the gateway disabled branches
so the config toggle takes effect after restart.
_download_slack_file fetched url_private_download with follow_redirects=True
and no SSRF validation, unlike the shared network guard used across other
channels (napcat/dingtalk/qq) and the maintainer's recent image-download
hardening. A file URL that pointed at — or redirected to — an internal
address let the bot server issue requests to loopback/RFC1918/cloud-metadata
targets, and cross-host redirects could carry the request off Slack.
Validate the URL through validate_url_target before requesting, stop
following redirects, and reject a redirect response. Authorized Slack file
downloads return 200 directly, so normal downloads (which still send the bot
token) are unaffected; the HTML-login guard already handled the redirect-to-
login case.
Matrix error logs used printf-style placeholders with Loguru, leaving filenames, room IDs, and chat IDs out of diagnostic output. Use Loguru placeholders and cover each affected failure path with focused regression assertions.
Signed-off-by: Lanre Shittu <136805224+Shizoqua@users.noreply.github.com>
Mid-stream response.failed events from OpenAI carry
'server_error' (underscore), but the transient-error marker
list only had 'server error' (space). is_transient_response
missed it, so the retry loop gave up on the first attempt
instead of using its normal 1s/2s/4s backoff.
Xubin Ren
chengyongruandchengyongru
aiguozhi123456andchengyongru
flobo3andchengyongru
KDBandchengyongru
chengyongruandchengyongru
Lanre Shittuandchengyongru
akinolurandchengyongru