Hunter Miller
85cb714407
fix(tlon): restore DM partner ship extraction for proper routing
...
- Add extractDmPartnerShip() to extract partner from 'whom' field
- Use partner ship for routing (more reliable than essay.author)
- Explicitly ignore bot's own outbound DM events
- Log mismatch between author and partner for debugging
2026-03-02 15:46:35 -08:00
Hunter Miller
c7901587e9
test(tlon): restore security, sse-client, and upload tests
...
- security.test.ts: DM allowlist, group invite, bot mention detection, ship normalization
- sse-client.test.ts: subscription handling, cookie updates, reconnection params
- upload.test.ts: image upload with SSRF protection, error handling
2026-03-02 15:46:35 -08:00
Hunter Miller
62fa5a96e2
fix(tlon): add infinite reconnect with reset after max attempts
...
Instead of giving up after maxReconnectAttempts, wait 10 seconds then
reset the counter and keep trying. This ensures the monitor never
permanently disconnects due to temporary network issues.
2026-03-02 15:46:34 -08:00
Hunter Miller
94501d3310
fix(tlon): restore auth retry and add reauth on SSE reconnect
...
- Add authenticateWithRetry() helper with exponential backoff (restores lost logic from #39 )
- Add onReconnect callback to re-authenticate when SSE stream reconnects
- Add UrbitSSEClient.updateCookie() method for proper cookie normalization on reauth
2026-03-02 15:46:34 -08:00
Hunter Miller
01715182e1
fix(tlon): address security review issues
...
- Fix SSRF in upload.ts: use urbitFetch with SSRF protection
- Fix SSRF in media.ts: use urbitFetch with SSRF protection
- Add command whitelist to tlon tool to prevent command injection
- Add getDefaultSsrFPolicy() helper for uploads/downloads
2026-03-02 15:46:34 -08:00
Hunter Miller
c629b27d97
chore(tlon): lower ack threshold to 5 for testing
2026-03-02 15:46:34 -08:00
Hunter Miller
2525498fea
chore(tlon): add logging for event acks
2026-03-02 15:46:34 -08:00
Hunter Miller
a0c3339c75
refactor(tlon): simplify probeAccount to direct /~/name request
...
No channel needed - just authenticate and GET /~/name.
Removes UrbitChannelClient, keeping only UrbitSSEClient for monitor.
2026-03-02 15:46:34 -08:00
Hunter Miller
a1106fd50c
chore(tlon): remove unused http-api.ts
...
After restoring SSRF protection, probeAccount uses UrbitChannelClient
instead of @urbit/http-api. The http-api.ts wrapper is no longer needed.
2026-03-02 15:46:34 -08:00
Hunter Miller
89ec723ec9
feat(tlon): add ownerShip to setup flow
...
ownerShip should always be set as it controls who receives
approval requests and can approve/deny actions.
2026-03-02 15:46:34 -08:00
Hunter Miller
a7f3113d63
fix(tlon): restore SSRF protection in probeAccount
...
- Restore channel-client.ts for UrbitChannelClient
- Use UrbitChannelClient with ssrfPolicy in probeAccount
- Ensures account probe respects allowPrivateNetwork setting
2026-03-02 15:46:34 -08:00
Hunter Miller
3876597621
fix(tlon): restore buildTlonAccountFields for allowPrivateNetwork
...
The inlined payload building was missing allowPrivateNetwork field,
which would prevent the setting from being persisted to config.
2026-03-02 15:46:33 -08:00
Hunter Miller
bb8547e9b8
fix(tlon): restore SSRF protection with event ack tracking
...
- Restore context.ts and channel-ops.ts for SSRF support
- Restore sse-client.ts with urbitFetch for SSRF-protected requests
- Add event ack tracking from openclaw-tlon (acks every 20 events)
- Pass ssrfPolicy through authenticate() and UrbitSSEClient
- Fixes security regression from sync with openclaw-tlon
2026-03-02 15:46:33 -08:00
Hunter Miller
0995118ec6
feat(tlon): add image upload support via @tloncorp/api
...
- Import configureClient and uploadFile from @tloncorp/api
- Implement uploadImageFromUrl using uploadFile
- Configure API client before media uploads
- Update dependency to github:tloncorp/api-beta#main
2026-03-02 15:46:27 -08:00
Hunter Miller
7bbf711302
chore(tlon): remove dead code
...
Remove unused Urbit channel client files:
- channel-client.ts
- channel-ops.ts
- context.ts
These were not imported anywhere in the extension.
2026-03-02 15:46:27 -08:00
Hunter Miller
6d1fafd3d2
feat(tlon): sync with openclaw-tlon master
...
- Add tlon CLI tool registration with binary lookup
- Add approval, media, settings, foreigns, story, upload modules
- Add http-api wrapper for Urbit connection patching
- Update types for defaultAuthorizedShips support
- Fix type compatibility with core plugin SDK
- Stub uploadFile (API not yet available in @tloncorp/api-beta)
- Remove incompatible test files (security, sse-client, upload)
2026-03-02 15:46:16 -08:00
Peter Steinberger
6ba7238ac6
build: bump versions to 2026.3.2
2026-03-02 04:55:53 +00:00
Agent
e7cafed424
chore(release): bump version to 2026.3.1
2026-03-01 21:14:17 +00:00
Peter Steinberger
fe807e4bed
chore(release): bump 2026.2.27 and split changelog
2026-02-27 16:09:28 +01:00
Peter Steinberger
caace61ba1
chore: bump versions to 2026.2.26
2026-02-26 12:11:02 +01:00
Shakker
2652bb1d7d
Release: sync plugin versions to 2026.2.25
2026-02-25 04:19:59 +00:00
Shakker
955cc9029f
chore: sync plugin versions to 2026.2.24
2026-02-24 22:45:46 +00:00
Peter Steinberger
0183610db3
refactor: de-duplicate channel runtime and payload helpers
2026-02-23 21:25:28 +00:00
Peter Steinberger
75423a00d6
refactor: deduplicate shared helpers and test setup
2026-02-23 20:40:44 +00:00
边黎安
a4c373935f
fix(agents): fall back to agents.defaults.model when agent has no model config ( #24210 )
...
Merged via /review-pr -> /prepare-pr -> /merge-pr.
Prepared head SHA: 0f272b102716240681+bianbiandashen@users.noreply.github.com >
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com >
Reviewed-by: @gumadeiras
2026-02-23 03:18:55 -05:00
Vignesh Natarajan
8d9d01447e
chore: align plugin versions and harden outbound cross-provider test
2026-02-22 23:04:17 -08:00
Peter Steinberger
59807efa31
refactor(plugin-sdk): unify channel dedupe primitives
2026-02-22 10:46:34 +01:00
Peter Steinberger
ae8d4a8eec
fix(security): harden channel token and id generation
2026-02-22 10:16:02 +01:00
Peter Steinberger
549549f6a0
fix(ci): sync plugin versions and harden install smoke
2026-02-21 20:18:37 +01:00
Peter Steinberger
bdfb97afad
chore: prep 2026.2.22 unreleased and publish new npm plugins
2026-02-21 19:05:35 +01:00
Peter Steinberger
9231d7d30f
chore: bump version to 2026.2.21
2026-02-21 11:02:30 +01:00
Peter Steinberger
f66b23de75
chore(release): bump versions to 2026.2.20
2026-02-20 00:02:53 +01:00
Peter Steinberger
b0e55283d5
chore: bump release metadata to 2026.2.19
2026-02-19 16:17:34 +01:00
Peter Steinberger
d51929ecb5
fix: block ISATAP SSRF bypass via shared host/ip guard
2026-02-19 09:59:47 +01:00
Peter Steinberger
4bf3338834
chore: bump version to 2026.2.18 unreleased
2026-02-18 04:40:06 +01:00
Peter Steinberger
b8b43175c5
style: align formatting with oxfmt 0.33
2026-02-18 01:34:35 +00:00
Peter Steinberger
31f9be126c
style: run oxfmt and fix gate failures
2026-02-18 01:29:02 +00:00
Peter Steinberger
9a2c39419e
chore(release): bump version to 2026.2.17
2026-02-17 23:08:55 +01:00
cpojer
d0cb8c19b2
chore: wtf.
2026-02-17 13:36:48 +09:00
Sebastian
ed11e93cf2
chore(format)
2026-02-16 23:20:16 -05:00
cpojer
72f00df95a
chore: Fix more extension test type 1/N.
2026-02-17 10:14:01 +09:00
cpojer
90ef2d6bdf
chore: Update formatting.
2026-02-17 09:18:40 +09:00
Peter Steinberger
544ffbcf7b
refactor(extensions): dedupe connector helper usage
2026-02-16 14:59:30 +00:00
Peter Steinberger
39fa81dc96
chore: bump version to 2026.2.16
2026-02-16 06:08:47 +01:00
Peter Steinberger
de103773c7
refactor(tlon): share urbit poke/scry ops
2026-02-15 19:21:42 +00:00
Peter Steinberger
379b445582
chore: bump version to 2026.2.15
2026-02-15 04:50:31 +01:00
Peter Steinberger
1ff15e60d3
chore(release): bump versions to 2026.2.14
2026-02-15 02:53:35 +01:00
Peter Steinberger
d0f64c955e
refactor(tlon): centralize Urbit request helpers
2026-02-14 19:22:29 +01:00
Peter Steinberger
bfa7d21e99
fix(security): harden tlon Urbit requests against SSRF
2026-02-14 18:42:10 +01:00
Peter Steinberger
67251e97bd
fix(ci): sync extension versions to root release ( #15199 )
2026-02-13 05:54:03 +01:00
