A single OSError from _save_store() (disk full, permission change, locked
file) escaped _on_timer's try/finally and killed the asyncio timer task,
because _arm_timer() sits outside the block. All scheduled jobs silently
stopped until restart or a manual re-arm via add_job/update_job/remove_job.
Move _arm_timer() into the finally block and guard the whole tick body
(including _load_store, which can persist during agent-binding migrations)
so a transient persistence failure is logged and retried on the next tick
instead of killing the scheduler.
Add test_save_store_failure_does_not_kill_scheduler to cover the failure
path that existing tests (which mock _arm_timer) never exercised.
When config.json has no channels configuration, the WebUI QR login
connect flow obtained a token but only saved it to account.json (state
file). The subsequent post-connect enable step (set_channel_config_enabled)
read config.json, found no weixin section, and wrote back a default
config with token="" - silently losing the freshly obtained credential.
Add _persist_connect_credentials to _commit_account so the token and
base_url are written to config.json before the enable step runs. This
covers both the WebUI connect flow and the CLI QR login path, mirroring
the established Feishu save_registration_result pattern.
Session files lived under <workspace>/sessions/ (since #713), which is the
on-disk scope of the agent's filesystem tools. With restrict_to_workspace
enabled, an agent could read_file / list_dir every session transcript —
including other users' or channels' conversations — bypassing the scoped
sessions.py access layer entirely.
Move session storage to ~/.nanobot/sessions/<sha256-of-resolved-workspace>[:16]/,
outside the workspace. Per-workspace isolation (the goal of #713) is preserved
via a hash of the resolved workspace path, so different workspaces keep
independent session stores. A one-shot, idempotent migration moves legacy
in-workspace *.jsonl files into the new location at store init.
Scope note: this protects sessions whenever restrict_to_workspace=true. The
default restrict_to_workspace=false leaves read_file unrestricted in general
(not only sessions) and is a separate concern.
Refs #5278
yu-xin-candXubin Ren
f10renceandXubin Ren
shen0122andchengyongru
dajiaohuangandchengyongru
Bobbyandchengyongru
aiguozhi123456andchengyongru
arcdrake22andXubin Ren
yorkhellenandXubin Ren
shixi-liandXubin Ren
chengyongruandchengyongru
李明振andXubin Ren
chengyongruandchengyongru