Peter Steinberger
8806ef804e
refactor: remove remaining channel and gateway boundary leaks
2026-04-05 20:48:10 +01:00
Peter Steinberger
801b5d4afa
fix: stabilize isolated gateway test runtime
2026-04-05 06:33:07 +09:00
Nimrod Gutman
69fe999373
fix(pairing): restore qr bootstrap onboarding handoff ( #58382 ) (thanks @ngutman)
...
* fix(pairing): restore qr bootstrap onboarding handoff
* fix(pairing): tighten bootstrap handoff follow-ups
* fix(pairing): migrate legacy gateway device auth
* fix(pairing): narrow qr bootstrap handoff scope
* fix(pairing): clear ios tls trust on onboarding reset
* fix(pairing): restore qr bootstrap onboarding handoff (#58382 ) (thanks @ngutman)
2026-03-31 21:11:35 +03:00
Peter Steinberger
168ab94eee
refactor(config): pin runtime snapshot and drop ttl cache
2026-03-29 22:57:31 +01:00
Peter Steinberger
2833b27f52
test: continue vitest threads migration
2026-03-24 08:37:00 +00:00
Peter Steinberger
383c61e305
test: stabilize gateway thread harness
2026-03-23 05:44:34 -07:00
Peter Steinberger
ec51ee1af5
test: harden gateway no-isolate coverage
2026-03-22 16:08:22 -07:00
Peter Steinberger
6d34d62795
test: harden no-isolate gateway auth and pairing
2026-03-22 15:15:50 -07:00
Luke
ad24fccff5
test(gateway): stabilize suite session-store config ( #52193 )
...
* test(gateway): stabilize suite session-store config
* test(gateway): preserve seeded config semantics
* test(gateway): update seeded session store overrides
2026-03-22 19:18:44 +08:00
Peter Steinberger
3c71e2bd48
refactor(core): extract shared dedup helpers
2026-03-07 10:41:05 +00:00
Peter Steinberger
3cb851be90
test: micro-optimize heavy gateway/browser/telegram suites
2026-03-02 22:29:04 +00:00
Peter Steinberger
3beb1b9da9
test: speed up heavy suites with shared fixtures
2026-03-02 21:58:35 +00:00
Peter Steinberger
7d8aeaaf06
fix(gateway): pin paired reconnect metadata for node policy
2026-02-26 14:11:04 +01:00
Peter Steinberger
2dcb244985
refactor(test): dedupe gateway and web scaffolding
2026-02-22 20:04:51 +00:00
Peter Steinberger
bbdfba5694
fix: harden connect auth flow and exec policy diagnostics
2026-02-22 20:22:00 +01:00
Peter Steinberger
66529c7aa5
refactor(gateway): unify auth credential resolution
2026-02-22 18:23:13 +01:00
Peter Steinberger
3a6e0e70f6
test: make gateway connectReq timeout configurable
2026-02-22 12:18:21 +00:00
Peter Steinberger
aa14835607
test: reclassify gateway local suites from e2e
2026-02-22 11:48:46 +00:00
Peter Steinberger
8887f41d7d
refactor(gateway)!: remove legacy v1 device-auth handshake
2026-02-22 09:27:03 +01:00
Peter Steinberger
577e5cc74b
refactor(test): dedupe gateway env setup and add env util coverage
2026-02-21 12:52:21 +00:00
Peter Steinberger
dcd592a601
refactor: eliminate jscpd clones and boost tests
2026-02-19 15:08:54 +00:00
Peter Steinberger
b8b43175c5
style: align formatting with oxfmt 0.33
2026-02-18 01:34:35 +00:00
Peter Steinberger
31f9be126c
style: run oxfmt and fix gate failures
2026-02-18 01:29:02 +00:00
cpojer
d0cb8c19b2
chore: wtf.
2026-02-17 13:36:48 +09:00
Sebastian
ed11e93cf2
chore(format)
2026-02-16 23:20:16 -05:00
cpojer
b3d9ecf4e4
chore: Fix types that were broken due to reverts.
2026-02-17 10:57:31 +09:00
cpojer
1406b28469
chore: Fix types in tests 3/N.
2026-02-17 10:57:31 +09:00
cpojer
90ef2d6bdf
chore: Update formatting.
2026-02-17 09:18:40 +09:00
Peter Steinberger
31980bcaf1
refactor(test): dedupe gateway env restores
2026-02-15 23:18:16 +00:00
Peter Steinberger
99909f7bc7
refactor(test): share gateway server start helper
2026-02-15 23:02:27 +00:00
Peter Steinberger
98bb4225fd
perf(test): minimize gateway startup in vitest
2026-02-14 05:25:40 +00:00
Peter Steinberger
2378d770d1
perf(test): speed gateway suite resets with unique config roots
2026-02-13 23:33:08 +00:00
Peter Steinberger
fdfc34fa1f
perf(test): stabilize e2e harness and reduce flaky gateway coverage
2026-02-13 17:32:14 +00:00
Peter Steinberger
1eccfa8934
perf(test): trim duplicate e2e suites and harden signal hooks
2026-02-13 16:46:43 +00:00
Peter Steinberger
cfd112952e
fix(gateway): default-deny missing connect scopes
2026-02-11 12:04:30 +01:00
Abdel Sy Fane
0c7fa2b0d5
security: redact credentials from config.get gateway responses ( #9858 )
...
* security: add skill/plugin code safety scanner module
* security: integrate skill scanner into security audit
* security: add pre-install code safety scan for plugins
* style: fix curly brace lint errors in skill-scanner.ts
* docs: add changelog entry for skill code safety scanner
* security: redact credentials from config.get gateway responses
The config.get gateway method returned the full config snapshot
including channel credentials (Discord tokens, Slack botToken/appToken,
Telegram botToken, Feishu appSecret, etc.), model provider API keys,
and gateway auth tokens in plaintext.
Any WebSocket client—including the unauthenticated Control UI when
dangerouslyDisableDeviceAuth is set—could read every secret.
This adds redactConfigSnapshot() which:
- Deep-walks the config object and masks any field whose key matches
token, password, secret, or apiKey patterns
- Uses the existing redactSensitiveText() to scrub the raw JSON5 source
- Preserves the hash for change detection
- Includes 15 test cases covering all channel types
* security: make gateway config writes return redacted values
* test: disable control UI by default in gateway server tests
* fix: redact credentials in gateway config APIs (#9858 ) (thanks @abdelsfane)
---------
Co-authored-by: George Pickett <gpickett00@gmail.com >
2026-02-05 16:34:48 -08:00
Abdel Sy Fane
bc88e58fcf
security: add skill/plugin code safety scanner ( #9806 )
...
* security: add skill/plugin code safety scanner module
* security: integrate skill scanner into security audit
* security: add pre-install code safety scan for plugins
* style: fix curly brace lint errors in skill-scanner.ts
* docs: add changelog entry for skill code safety scanner
* style: append ellipsis to truncated evidence strings
* fix(security): harden plugin code safety scanning
* fix: scan skills on install and report code-safety details
* fix: dedupe audit-extra import
* fix(security): make code safety scan failures observable
* fix(test): stabilize smoke + gateway timeouts (#9806 ) (thanks @abdelsfane)
---------
Co-authored-by: Darshil <ddhameliya@mail.sfsu.edu >
Co-authored-by: Darshil <81693876+dvrshil@users.noreply.github.com >
Co-authored-by: George Pickett <gpickett00@gmail.com >
2026-02-05 16:06:11 -08:00
Peter Steinberger
fe81b1d712
fix(gateway): require shared auth before device bypass
2026-02-02 16:56:38 -08:00
cpojer
f06dd8df06
chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.
2026-02-01 10:03:47 +09:00
cpojer
5ceff756e1
chore: Enable "curly" rule to avoid single-statement if confusion/errors.
2026-01-31 16:19:20 +09:00
Peter Steinberger
9a7160786a
refactor: rename to openclaw
2026-01-30 03:16:21 +01:00
Peter Steinberger
6d16a658e5
refactor: rename clawdbot to moltbot with legacy compat
2026-01-27 12:21:02 +00:00
Peter Steinberger
3314b3996e
fix: harden gateway auth defaults
2026-01-26 18:24:26 +00:00
Peter Steinberger
c4a80f4edb
fix: require gateway auth by default
2026-01-26 12:56:33 +00:00
Peter Steinberger
64be2b2cd1
test: speed up gateway suite setup
2026-01-23 04:28:02 +00:00
Peter Steinberger
f76e3c1419
fix: enforce secure control ui auth
2026-01-21 23:58:42 +00:00
Peter Steinberger
dfbf6ac263
feat: enforce device-bound connect challenge
2026-01-20 13:04:19 +00:00
Peter Steinberger
9dbc1435a6
fix: enforce ws3 roles + node allowlist
2026-01-20 09:24:01 +00:00
Peter Steinberger
9e06d945a2
fix: stabilize gateway tests on windows
2026-01-19 12:12:51 +00:00
Peter Steinberger
2f8206862a
refactor: remove bridge protocol
2026-01-19 10:08:29 +00:00
