From 6aec76ffd68730fb160f9afcf2fad84c49d4045b Mon Sep 17 00:00:00 2001 From: Ziy1-Tan Date: Thu, 16 Apr 2026 20:57:14 +0800 Subject: [PATCH] docs: add CHANGELOG entry for cdpUrl config redaction fix --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 996dd8f9b3f..c2baa9f7ec7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -61,6 +61,7 @@ Docs: https://docs.openclaw.ai ### Fixes +- Config/redaction: redact credentials embedded in `browser.cdpUrl` and `browser.profiles.*.cdpUrl` config paths so query tokens and HTTP Basic auth userinfo are no longer returned in plaintext by `config.get` responses. (#67656) Thanks @Ziy1-Tan. - Gateway/tools: anchor trusted local `MEDIA:` tool-result passthrough on the exact raw name of this run's registered built-in tools, and reject client tool definitions whose names normalize-collide with a built-in or with another client tool in the same request (`400 invalid_request_error` on both JSON and SSE paths), so a client-supplied tool named like a built-in can no longer inherit its local-media trust. (#67303) - Agents/replay recovery: classify the provider wording `401 input item ID does not belong to this connection` as replay-invalid, so users get the existing `/new` session reset guidance instead of a raw 401-style failure. (#66475) Thanks @dallylee. - Gateway/webchat: enforce localRoots containment on webchat audio embedding path [AI-assisted]. (#67298) Thanks @pgondhi987.