Conversation
Documented findings from probing SRP crypto, mycelium channels, CC endpoints, WASM module analysis, JS bundle crypto patterns, and API endpoint mapping against bugbounty-ctf.1password.com. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add full Anthropic Claude Code OAuth flow (PKCE browser login, token exchange, dual-endpoint refresh, credential storage with Claude CLI fallback) - Fix OpenAI Codex 404: bypass genai-pyo3's reqwest/HTTP2 transport with aiohttp-based Responses API client (Cloudflare rejects HTTP/2) - Fix Anthropic OAuth auth: use genai-pyo3 Client.with_request_override to send Bearer token directly instead of the adapter's ANTHROPIC_API_KEY env lookup - Upgrade genai-pyo3 0.1.16 → 0.5.2 for with_request_override support - Add both OAuth providers to top of setup menu - Fix Codex headers: ChatGPT-Account-ID casing, originator=codex_cli_rs Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…iants Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When the browser callback server receives the auth code, any text the user pasted into stdin (the redirect URL) remains buffered. Subsequent Rich prompts (model selection, config confirmation) consume these leftover lines as empty input, causing the wizard to silently hang or skip steps. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…penClaw patterns OpenAI Codex flow: - Never read stdin while callback server is running (root cause of hangs) - Open browser silently, show "Waiting for sign-in..." — no confusing multi-step instructions - Only show paste fallback AFTER callback server times out (120s) - Detect SSH/remote sessions and use paste-only flow automatically - Handle port conflicts by sending /cancel to stale callback servers - Flush stdin with termios.tcflush after callback (not select loop) - Styled HTML success page in browser Anthropic flow: - No localhost callback server — use hosted callback page at console.anthropic.com (paste-only, matching Claude Code/Hermes/ReCursor) - Clean messaging: "Opening browser..." then "Paste code:" prompt - SSH/remote detection Setup wizard: - Cleaner credential reuse prompts - Remove redundant "Starting OAuth..." preamble Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Provider and model selection now use simple-term-menu for interactive arrow-key navigation instead of IntPrompt/Prompt number entry. Flushes stdin via termios.tcflush after menu returns to prevent escape-sequence leakage into subsequent prompts. Also bumps genai-pyo3 minimum to >=0.5.0 (for with_request_override). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The callback server was silently failing to bind when a previous stuck clearwing process held port 1455. The browser callback hit the OLD server (showing success HTML) while the new process waited forever on an empty queue. - Kill stale port holders via lsof + SIGTERM before binding - Use allow_reuse_address=True to handle TIME_WAIT sockets - Narrow except clause on put_nowait to queue.Full only Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Setup and doctor test invokes for openai_codex and anthropic_oauth were using the LangChain ChatModel path, which goes through genai-pyo3's reqwest/HTTP2 transport — blocked by Cloudflare with 403. Now uses AsyncLLMClient directly, which routes through the aiohttp transport that works. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…self Setup was storing base_url=https://chatgpt.com/backend-api in config, which made the request hit /backend-api/responses (403) instead of /backend-api/codex/responses (200). The AsyncLLMClient already appends /codex/ when base_url is None, so don't override it. Confirmed: /backend-api/responses → 403, /backend-api/codex/responses → 200. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The ChatGPT Codex backend rejects max_output_tokens with HTTP 400. The test invoke doesn't need a token limit — it's just a PONG check. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…properties genai-pyo3 0.5.2 changed ChatResponse.first_text, .texts, and .tool_calls from methods to properties. Updated all call sites across the codebase (15 files). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Three root causes prevented sourcehunt from using the configured OpenAI Codex (gpt-5.5) provider: 1. CLEARWING_HOME override (blind-test sandbox) bypassed ~/.clearwing/ config.yaml — Config now falls back to user's home config for provider credentials even when CLEARWING_HOME points elsewhere. 2. Multiple SourceHuntRunner construction sites (agent tool, campaign, commit monitor) omitted provider_manager, causing silent fallthrough to hardcoded Anthropic defaults. Runner's _get_llm/_get_native_client now propagate provider_manager errors instead of swallowing them. 3. Codex Responses API compatibility: /codex/ URL path not appended when base_url was set by endpoint resolver; text.format schema used Chat Completions structure instead of Responses API structure (name at top level); chunk_size=150 too large for Codex throughput (now 30). Also fixes test FakeResponse mocks for genai-pyo3 0.5.2 (properties not methods, adds reasoning_content), updates docs/FFmpeg.md to current CLI. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
… nested in function Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Check Docker runtimes at startup and warn once instead of failing every sandbox creation. The container layer also retries without the runtime if Docker rejects it. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The Responses API uses function_call_output/function_call item types instead of role:"tool" and role:"assistant" with tool_calls. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Local/small models driving the hunter via native tool-calling don't reliably populate every field a JSON schema marks required, unlike stricter engines. record_finding already tolerated missing values for every other optional field (code_snippet, confidence, evidence_level, the crypto_* fields all default), but cwe was left as a bare required argument. A hunter reporting a finding before it had settled on a CWE classification hit a bare TypeError, dropping the finding entirely instead of degrading gracefully. Give cwe a "" default in both the handler and the JSON schema, drop it from the schema's required list, and add a regression test that reproduces the crash on the old signature. Co-authored-by: 清水正一 <shoichi.shimizu@digitalian.info> Co-authored-by: Eric Hartford <eric.hartford@lazarusai.com>
Expose typed descriptor protocols on the canonical operate and sourcehunt commands, install host provider routing once per subprocess, and thread explicit provider managers into Operator and SourceHunt. Keep interactive command initialization lazy and emit bounded public results and semantic progress for supervisors.
# Conflicts: # clearwing/llm/chat.py # clearwing/llm/native.py # clearwing/providers/openai_oauth.py # clearwing/sourcehunt/commit_monitor.py # clearwing/sourcehunt/exploiter.py # clearwing/sourcehunt/hunter.py # clearwing/sourcehunt/mechanism_memory.py # clearwing/sourcehunt/patcher.py # clearwing/sourcehunt/runner.py # clearwing/sourcehunt/stability.py # clearwing/sourcehunt/validator.py # clearwing/sourcehunt/variant_loop.py # clearwing/sourcehunt/verifier.py # clearwing/ui/commands/doctor.py # docs/FFmpeg.md # pyproject.toml # tests/test_llm_openai_fallback.py
- Switch from Docker SDK images.build() to subprocess docker CLI to avoid credential helper failures (docker-credential-gcloud, etc.) - Use gcc:12-bullseye base image for C/C++ (ltrace available on x86_64) - Make ltrace a best-effort optional install (missing on arm64/all Debian) - Add platform-aware builds: native arm64 for C/C++, amd64 for others - Update unit tests to mock subprocess.run instead of SDK calls
ropoctl
approved these changes
Jul 30, 2026
whatever
force-pushed
the
master
branch
2 times, most recently
from
August 3, 2026 18:38
04b85a1 to
f344f38
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.