Conversation
…le pass Three medium-priority docs tickets in one batch: - BEDU-1012: new MCP Quick Start page consolidating setup for Claude Code, Claude Desktop, Cursor, Codex, OpenCode, and Antigravity into one per-client table with shared config blocks, namespace guidance, and a three-step verification; added to navigation after the MCP overview. - BEDU-854: the Claude Code page gains concrete prerequisites (Node and plugin-support checks, where credentials live), a three-layer verification sequence, and a troubleshooting FAQ grounded in the MCP package source: failed-server diagnosis with the --help and MEMWAL_MCP_DEBUG paths, headless sign-in through credentials.json, account switching with memwal_logout, namespace-scoped recall, hook installation, credential expiry, and proxy allowlisting. - BEDU-845: style and accuracy pass on the existing Cloudflare Workers page: Seal casing, the guide preamble, and the manual footer folded into a See also block. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WoBWxqLzd9hAxrhoqv3iSv
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WoBWxqLzd9hAxrhoqv3iSv
The MCP config blocks in docs/mcp/ are copies of the canonical server entry in the packages/mcp README, because Mintlify cannot import code from repository files at build time. Make that relationship explicit and enforced: cite the canonical source on the quickstart page, and add scripts/check-mcp-docs-sync.mjs, which parses every mcpServers, Codex TOML, and OpenCode block across docs/mcp/ and fails CI when a copy drifts from the README's command or arguments. URL-based Streamable HTTP entries are exempt because they are a different transport, not a copy of the stdio command. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WoBWxqLzd9hAxrhoqv3iSv
…ocks Per review: - Replace the MCP-only script with check-docs-code-sync.mjs, which derives canonical facts from the workspace (package names and exports from every packages/*/package.json, the MCP server entry from the packages/mcp README) and validates every page under docs/, not just docs/mcp. It now covers 85 pages: import specifiers must name a real package and a declared entry point, install and npx commands must name a real package, and MCP config blocks must match the canonical entry. One check serves every section, so no per-section scripts are needed. - The check exits non-zero and fails the job, so a drifted snippet blocks the merge and is fixed in the same pull request rather than tracked separately; the failure message says so. - Present the client config blocks as tabs so the formats sit side by side, and repoint the setup table's anchors at the new section. - Drop the See also lists from both pages. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WoBWxqLzd9hAxrhoqv3iSv
Completes the previous commit, which landed the quickstart page and the deletion of the old script but not its replacement: adds check-docs-code-sync.mjs, repoints the workflow job at it, and drops the See also list from the Workers page. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WoBWxqLzd9hAxrhoqv3iSv
…redential transfer Engineering review found three issues. An unauthenticated memory-tool call returns sign-in instructions rather than opening a browser, since auth-required.ts sets openBrowser false, so both pages now say to ask the agent to run memwal_login and open the URL it returns. check-docs-code-sync.mjs trusted the MCP README as the docs baseline without checking it against the package manifest, so a rename could leave the README and every page consistently wrong with CI still green. It now fails unless the README args name the published package. The headless credential copy moves a file holding the raw delegate private key, so the guidance now requires a secure transfer and 0600 permissions. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WoBWxqLzd9hAxrhoqv3iSv
…h reference Walrus Memory now speaks OAuth 2.1 on the hosted MCP endpoint, so Claude can add it through the native custom connector flow. Adds a user-facing guide covering the connector steps, what the consent screen grants, and the two-step disconnect, since revoking OAuth tokens leaves the onchain delegate key in place. Also corrects the reference page. The configuration section described the browser as generating the delegate keypair and never releasing the private key, but the relayer generates the keypair itself and stores the encrypted private key, which is why it needs a symmetric encryption key at all. The optional-overrides table was missing MCP_OAUTH_REGISTRATION_TRUSTED_CIDRS. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WoBWxqLzd9hAxrhoqv3iSv
Mechanical pass over the page the previous commit corrected: bold table headers, sentence-case fixes, Seal casing, onchain as one word, active voice, unwrapped prose, and body text between stacked headings. No behavior claims changed here. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WoBWxqLzd9hAxrhoqv3iSv
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WoBWxqLzd9hAxrhoqv3iSv
Add client-side token budgeting so callers can fit recalled context to a
model budget without hand-rolling a tokenizer:
- estimateTokens / countTokens: zero-dep character approximation (~chars/4),
code-point aware; a custom exact counter can be injected via recall options.
- recall({ maxTokens, truncationStrategy }): trims the (distance-sorted)
results client-side. Strategies: high-relevance-only (whole hits), drop-tail
(partial boundary hit), per-hit-cap (equal share per hit).
- RecallResult.meta { tokenEstimate, truncated }: the returned payload's
estimated cost + whether anything was dropped/shortened. Attached only when
maxTokens is supplied, so budget-less recalls are byte-identical to before.
Applied at the existing client-side post-filter seam (alongside maxDistance);
no relayer, privacy, or on-chain surface. Non-finite budgets are treated as
no-budget (never a false truncated flag).
Unit tests for the estimator and each truncation strategy (exact/over/under budget, Unicode/surrogate pairs, mixed-size, single oversized fact, malformed NaN/Infinity/fractional budgets, injected custom counter), plus end-to-end recall() tests proving the wiring: maxTokens honored, total recomputed, meta present, and byte-identical output when maxTokens is omitted.
Production engineering review found both. The block parser matched a fixed three backticks and read the info string with \w+, so a jsonc fence, a four-backtick fence, or a config containing a // comment fell out of the checks without a word. A deliberately wrong block in any of those forms reported success. The parser now takes three or more backticks and closes on a fence at least as long, treats jsonc and json5 as JSON, and strips comments and trailing commas outside strings before parsing. Nothing asserted the check still found anything, so a docs change that moved the config blocks out of reach would leave it green forever. It now requires a floor per config shape rather than in aggregate, because the docs carry three shapes and a break in one hides behind the other two. Verified: the three evasion forms are each caught with the right file and line; breaking the search for any one of the three shapes exits 2 naming that shape; the clean tree still reports the same 32 specifiers, 7 commands, and 9 config blocks. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WoBWxqLzd9hAxrhoqv3iSv
Production is not enabled. Both production discovery routes return 404, so the environment table now leads with staging and dev, marks production as pending with the curl to confirm it, and the citable answer no longer points readers at the production URL. Claude Code over OAuth has redirect-allowlist and unit coverage but no end-to-end test, so the client table recommends header authentication and the loopback path is described as supported by the implementation and unverified in practice. Delegate reuse is per account. find_reusable_oauth_delegate selects on account_id and status alone, so the guide no longer implies the relayer reuses a delegate minted for one particular client, and says a second connector can share the first one's delegate. Scopes are requested, not fixed. The authorization server grants the requested subset, so the page describes the three as supported and tells the reader to read the consent screen for what a client actually asked for. Connector removal in Claude is not documented to revoke tokens, so that step now says what it is known to do and states the relayer's revoke semantics separately. Also corrects two reference claims the review caught: MCP_OAUTH_REGISTRATION_TRUSTED_CIDRS exempts addresses from the per-IP registration throttle rather than gating who may register at all, and memwal_restore clamps limit to 1-100 and returns truncated, which callers need in order to know a bounded restore left the index incomplete. Troubleshooting now uses the FAQ format the other MCP pages use. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WoBWxqLzd9hAxrhoqv3iSv
Header authentication stays the documented path for Claude Code. The loopback redirect is supported by the implementation and covered by unit tests, which the page now says, but nobody has completed a Claude Code OAuth connection end to end, so the page no longer presents the two as equally verified. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WoBWxqLzd9hAxrhoqv3iSv
The production-status update introduced "may", which the style guide replaces with "might". Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WoBWxqLzd9hAxrhoqv3iSv
…lerts Feat/enoki sponsored walrus alerts
Promote dev to staging
Collaborator
Author
|
Hi @harrymove-ctrl, could you please help review and approve this PR to promote the validated staging changes to main? Staging deployment has been verified and all checks are green. Thank you! |
- Link OAuth 2.1 and the Sui wallet docs on first mention, and link
"Walrus Memory account" to the ownership concept page.
- Drop "the verified path" from the client table and cut the paragraph
about Claude Code OAuth over a loopback callback. That state is
engineering's to change, not ours to track in docs.
- Put the link on the question itself ("who holds the delegate key")
rather than on a trailing clause.
- Convert Disconnect to <Steps> so it matches "Add the connector", and
link "stdio client" in both places it appears.
- Switch Troubleshooting to the bullet format the other MCP pages use.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WoBWxqLzd9hAxrhoqv3iSv
The final step told you to state a durable fact and check that Claude called memwal_remember on its own. That verifies proactive tool use, which is the behavior currently under investigation after the reported Claude and Codex regression, and it is not what this page documents. The page documents the OAuth grant. Verify that instead: the delegate appears in the Walrus Memory dashboard at the address the consent screen showed. That check holds whatever the investigation concludes, and it matches the delegate the Disconnect section tells you to remove later. Listing the memwal_* tools stays as a check, since a completed handshake does establish that the server is reachable. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WoBWxqLzd9hAxrhoqv3iSv
…cp-docs-batch # Conflicts: # .github/workflows/test.yml
Same two classes the reviewer raised on #603, fixed here before they get raised again: - "Walrus Memory account" appeared unlinked in the prerequisites on both pages. Both now link the ownership concept page on first mention. - The Verify section wrote its three checks as a bolded numbered list while the page uses <Steps> for Installation. Converted to <Steps>. The wording of the end-to-end check is unchanged. It describes proactive tool use, which is under investigation after the reported Claude and Codex regression, and that wording is on hold rather than in scope here. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WoBWxqLzd9hAxrhoqv3iSv
The `instructions` field is an optional McpServer constructor argument, so dropping it fails no type check and breaks no other test. That is exactly how the proactive save/recall contract went missing in the first place: the guidance lived only in tool descriptions, which lazy-loading clients never put in context. Drives the real mounted routes over loopback HTTP and asserts the handshake names memwal_recall/memwal_remember, keeps the "not currently loaded" rebuttal that counters the reported symptom, and reports the real package version rather than a hardcoded stub. Verified to fail when the constructor argument is removed. Refs WALM-324
Re-reviewing this branch, the comments overstated the gap. `recall()` does have a client-side abort at 15s. What has none is `analyze()`, which goes through `signedRequest` without a signal, and the compatibility preflight (`GET /version`, falling back to `/health`) that runs ahead of every protected request. That preflight is where the mock relayer actually hung, before `recall()`'s own abort could apply. The fix is unchanged and still correct, since it bounds the whole call whichever leg stalls. Only the reasoning was wrong, and it would have shipped an inaccurate claim about the SDK.
Now that #668 has landed, I measured its filter against a corpus of realistic developer statements: 7 of 12 were flagged as injection and silently dropped, against 4 of 12 before that PR. Nothing is surfaced to the user, so a memory simply never appears. Two patterns cause it, and both match ordinary speech as readily as attacks. `run|execute|call|invoke ... tool|command|shell|bash` catches "I need to run the deploy command before standup", and `forget ... everything ... before` catches "I forget everything before my first coffee". The regex alone cannot separate the two readings. What separates them is who is being addressed. Injection has to reach the model, so it either names it ("you", "your") or leads with a bare injection verb. A sentence doing neither is someone describing their own workflow. Those two patterns now live in a contextual set that only counts when the text addresses the model; every explicit-attack pattern still fires unconditionally. False positives fall from 7 of 12 to 1 of 12. The remaining one is a bare "system prompt" mention, which predates #668 and stays flagged. The 15-payload attack set from #639 is unchanged at 4 bypasses, so the relief does not come at the cost of coverage. Both corpora are pinned as tests.
fix(openclaw): align plugin docs with actual runtime output
The bridge answers `initialize` itself at cold start and SUPPRESSES the relayer's reply, so the relayer's instructions never reached a stdio client. Every signed-in user went through that path, which meant the previous commit fixed the field on a response nobody sees. Caught by end-to-end probing against a deployed relayer: build metadata confirmed the relayer was running this branch, yet the handshake still reported version 0.0.1 with no instructions. That value could only come from buildLocalInitializeResult in bridge.ts. The relayer copy still matters: it serves the direct HTTP/OAuth connector path, which does not go through the bridge. Both are needed. Extracts both payloads into instructions.ts so bridge and auth-required share one definition, and asserts the local initialize carries them in coldstart-init, where the gap was previously invisible to every assertion. Refs WALM-324
ci(python-sdk): build, unit test and e2e workflow against the dev relayer
…it (#652) MemWalSync._run() and the sync OpenAI middleware wrapper cleared `_client` before every asyncio.run() path so a client would be rebuilt inside the loop that uses it, but never closed the one they replaced. Every sync call therefore orphaned an open httpx.AsyncClient and its connection pool until GC, which shows up in notebooks and long-running scripts as resource warnings, stale sockets, and needless connection churn. Route both sites through _with_fresh_http_client(), which closes at both ends: on entry for whatever an earlier event loop left behind (a caller mixing `await memwal.recall()` with the sync wrapper), and in `finally` for the client this call created, while the loop that owns it is still alive. Closing on the way out is what actually removes the leak — closing only on the way in would still leave one open client between calls. Fixes #606
…ning loop (#653) with_memwal_langchain() advertises recall-before-call, but the sync _generate() wrapper appended the untouched message list whenever an event loop was already running — the normal case in notebooks and async application hosts. The LLM call still succeeded, so callers got a plain answer with no memory context and no warning: Walrus Memory looked connected while recall never ran. Route injection through the module's existing _run_blocking() helper, which moves the coroutine onto a worker thread, so the sync LangChain wrapper now behaves like the sync OpenAI one instead of silently degrading. Fixes #607
Patch bump for @mysten-incubation/memwal-mcp. The published package changes here are the bridge and auth-required initialize responders; the relayer-side change ships with the service, not npm. Requested in review on #681.
Follows the manual release flow used by #678, not changesets: bump every MCP/plugin manifest together, add the version section to both changelogs, and move the verifier's expected version forward. `verify-manual-sdk-release.mjs` reports "MCP package 0.0.10: manifests and changelogs synchronized". Drops the changeset added earlier in this PR. Leaving it alongside a manual bump would have double-bumped on main, since release-mcp.yml runs `changeset version` there and would have taken 0.0.10 to 0.0.11 while rewriting the changelog section added here. Replaces the review request on #681 for a changeset or changelog update.
A limit=5 recall on a real account returned the same fact five times, so one preference consumed the entire retrieval budget and crowded out every other memory the query should have surfaced. Storing a fact repeatedly is legitimate: each remember is a distinct event with its own blob and timestamp, and there is no content-level uniqueness constraint by design (the sole unique index is request idempotency on remember_jobs (owner, idempotency_key), which guards retries, not content). Deduping on write would silently discard a genuine re-statement, so the fix belongs on the read side. Collapses results whose text matches after trimming, whitespace collapsing, and case folding, keeping the highest scoring copy since rows arrive ranked. Matching is exact-after-normalization rather than fuzzy: merging facts that merely resemble each other would hide real information. The reply reports how many copies were folded so nothing disappears silently.
fix(mcp): send proactive-usage instructions in the initialize handshake
…issing scope Second remediation item from #659. #665 stops a client smuggling x-memwal-internal-* through the relayer, but the sidecar still trusted the header from any caller and treated its absence as unrestricted access. Relayer: apply_oauth_headers becomes apply_internal_headers, called on all three proxy handlers including the legacy Passthrough arm that previously set nothing. It states both internal headers explicitly — the sidecar shared secret, and the granted scope (the resolved grant for OAuth callers, full read+write for legacy delegate-key callers). Both are written with insert, so a client-supplied value is always overwritten. Header-build failures now return 500 instead of being silently skipped, which previously left an authenticated request with no scope. Sidecar: new verifyInternalOrigin() compares the token with timingSafeEqual and runs first in resolveAuth, so an unverified caller gets a 401 before any internal header is read. registerTools drops the `unrestricted` branch — an absent or empty scope now registers no tools rather than every tool. No new environment variables: SIDECAR_AUTH_TOKEN is already mandatory and already shared by both processes. Resolves #685
Addresses review on #688. The tool set is bound at session-open time, so a session opened with write scope keeps its write tools for its whole life. sessionKey was built from {accountId, delegatePubKey} only, so a later request with a narrower or absent scope passed the session-binding check and drove that write-capable transport — the fail-closed guarantee held only until initialization. Delegate keys are reused across grants for the same account (find_reusable_oauth_delegate keys on account_id alone), so {account, delegate} does not distinguish two grants of differing scope. The key now includes the normalized scope: deduplicated and sorted, so reordering a grant does not fork the session. Also fixes the stdio bridge test, which had stopped exercising a successful upstream connection. Its /api mount has no Rust proxy, so nothing supplied the internal headers and the bridge fell back to its local tool list. The fallback advertises the same tool names as the relayer, so no assertion on tool names could detect this. The mount now simulates the proxy's apply_internal_headers, and the test waits for the upstream SSE and asserts it returned 200 before requesting tools — the earlier list was answered by the bridge's coldstart path while the connection was still in flight.
The bridge had no deadline of its own for a request. Its only timer watches for silence on the SSE stream, and the relayer's 3s keepalive keeps that stream looking healthy, so a reply lost while the connection is still up trips nothing: no watchdog, therefore no reconnect, therefore no replay. The request sat in `inFlight` forever and the caller could only report a bare timeout with nothing to act on. Stamp each in-flight entry with `startedAt` and sweep for expired ones. The stamp is never refreshed, not even by a replay, since a reconnect loop would otherwise keep pushing the deadline out and reintroduce the same indefinite wait. The sweep period is capped at 5s so the deadline is honoured closely rather than drifting by a quarter of itself. Expired calls close out through the existing `failRequest` path, which already adds the id to `closedOutIds` so a late genuine reply is dropped rather than becoming a second response for that id. `failRequest` gains optional wording because its "relayer unavailable" text would be wrong here: the relayer is fine, one reply just went missing, and saying otherwise sends whoever debugs it next in the wrong direction. The default of 240s clears the slowest server-side tool deadline (`analyze` at 180s) so a healthy request is never called orphaned while the relayer is still working on it. `MEMWAL_MCP_CALL_TIMEOUT_MS` overrides it. Also log the in-flight ids and methods at reconnect rather than just the count. The reported `replayCount: 0` could not be reproduced from the code — all three `inFlight.delete` sites require an actual response frame, and `inFlight.clear()` only runs on an account switch — so the next occurrence needs to show whether the map was empty or the entry was removed early. Refs WALM-328
…r-injection fix(mcp): block inbound internal header injection in reverse proxy
…eader-verification fix(mcp): verify internal headers at the sidecar and fail closed on missing scope
…ge-idle-close-orphans-in-flight-remember-calls fix(mcp): answer a tool call whose response never arrives
Promote OpenClaw 0.0.6 into the release verifier instead of pinning it as unchanged, restore the lazy-loading clause in the docs answer, and drop the private Linear ticket plus the inaccurate late-reply claim from the 0.0.10 notes.
fix(mcp): inject default namespace for memwal_remember_bulk calls
Record the merged remember_bulk default-namespace fix alongside the existing 0.0.10 notes so the GitHub Release body includes it.
chore(release): include WALM-328 fix in MCP 0.0.10 changelog
Promote dev to staging
Collaborator
Style Guide AuditAudited 12 file(s) against the Sui Documentation Style Guide. 7 violation(s) found. All must be fixed before merge.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
9 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Promote the latest validated
stagingchanges tomain.Includes #663 / #664:
Promotion Path
fbb966891ddeacd75cff98adae6dca41f2b9a3b4Staging Evidence
fbb966891ddeacd75cff98adae6dca41f2b9a3b4.GET https://relayer.staging.memwal.ai/healthreports build commitfbb966891ddeacd75cff98adae6dca41f2b9a3b4and statusok.interval=900s,wallet_threshold_wal=10000000000,wallet_threshold_sui=2000000000,sponsor_threshold_sui=2000000000)."sponsored": true).Validation