vultr/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-07-09 14:03:57 +00:00
Code Issues Packages Projects Releases Wiki Activity
64,631 Commits 1,843 Branches 149 Tags
bc49cb41e976d81fe779c90fbcc7669ff8ae8a86
Commit Graph

51 Commits

Author SHA1 Message Date
Peter Steinberger
f7d7148cf0 docs: rewrite published docs grounded in current source (#100142) 
Source-grounded rewrite of 529 published docs pages with per-unit information-loss verification: 1,713 factual corrections cited to src/**, generated surfaces regenerated, frontmatter titles preserved for i18n, release notes pages untouched. All docs gates green.

Closes #100141
 2026-07-05 00:32:47 -04:00
Peter Steinberger
f4c6c0aec4 refactor: extract net policy package 2026-05-29 09:45:14 +01:00
Matthew Kern
a37ebb2d49 fix(browser): bypass managed proxy for loopback CDP 
Keep browser CDP managed-proxy bypasses on the private bundled-plugin SSRF helper, strip WebSocket URL credentials before registering exact bypass URLs, and document the managed-browser loopback proxy behavior.

Co-authored-by: Matthew Kern <matthew@matthewkern.xyz>
 2026-05-23 23:53:27 +01:00
Kaspre
fd2a9adbe6 fix(ollama): bypass managed proxy for loopback embeddings (#85707) 
* fix(ollama): bypass proxy for local embeddings

* fix(ollama): keep managed proxy bypass loopback-only

* fix(ollama): keep proxy bypass internal

* fix(ollama): keep proxy bypass private

* fix(ollama): harden internal proxy bypass

* chore(plugin-sdk): refresh api baseline

* fix(ollama): keep internal bypass out of qa aliases

* test(ollama): keep ssrf runtime mock complete

* fix(ollama): keep dist sdk aliases public-only

* fix(ollama): keep fetch bypass out of infra runtime

* fix(ollama): preserve packaged private sdk alias

* test(ollama): harden private ssrf alias coverage

* test(ollama): cover private ssrf resolver edges

* fix(ollama): scope private sdk native aliases

* test(ollama): audit blocked loopback bypasses

* fix(plugins): keep staged sdk aliases public-only

* test(ollama): harden proxy bypass proof

* test(ollama): cover origin mismatch proxy path

* test(ollama): cover ipv6 and batch bypass paths

* fix lint findings in Ollama proxy tests

* refactor: tighten Ollama proxy bypass

* fix: widen private sdk owner registry type

* test: stabilize Ollama proxy PR checks

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
 2026-05-23 21:17:55 +01:00
Jesse Merhi
7c2425a518 Support HTTPS managed proxy CA trust (#79171) 
* fix: support HTTPS managed proxy CA trust

* fix: strip IP SNI for HTTPS proxy dispatchers

* fix: harden managed proxy undici dispatchers

* docs: refresh proxy baselines

* fix: drop stale whatsapp undici dependency

* fix: satisfy proxy dispatcher lint and tests

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
 2026-05-17 06:23:30 +01:00
Jesse Merhi
6921d9072e Adopt Proxyline for managed proxy routing 
Route managed HTTP/WebSocket/fetch interception through Proxyline 0.3.0, preserving Gateway loopback bypass behavior and root undici hardening.

Co-authored-by: jesse-merhi <79823012+jesse-merhi@users.noreply.github.com>
 2026-05-15 22:51:36 +01:00
jesse-merhi
f4797921ac lint: classify raw socket callsites 2026-05-08 01:18:04 +10:00
Vincent Koc
74ec956e42 docs: sentence-case 4 stray Title Case headings 2026-05-06 09:22:35 -07:00
Vincent Koc
204971f2a9 docs: remove duplicate body H1s + sentence-case headings across 10 pages 2026-05-06 09:06:11 -07:00
Vincent Koc
963073088d docs: audit and fix 5 pages (sentence-case headings + Related/title) 2026-05-05 21:48:05 -07:00
Jesse Merhi
5b00cd1ae1 fix: narrow Gateway proxy bypass target (#77018) 
* fix: narrow Gateway proxy bypass target

* fix: narrow Gateway proxy bypass target

* fix(clawsweeper): address review for automerge-openclaw-openclaw-77018 (1)

* fix(clawsweeper): address review for automerge-openclaw-openclaw-77018 (2)

* fix(clawsweeper): address review for automerge-openclaw-openclaw-77018 (validation-3)

* fix(clawsweeper): address review for automerge-openclaw-openclaw-77018 (4-final)

* fix: narrow Gateway proxy bypass target

* fix(clawsweeper): address review for automerge-openclaw-openclaw-77018 (1)

* fix(clawsweeper): address review for automerge-openclaw-openclaw-77018 (2)

* fix(clawsweeper): reconcile automerge-openclaw-openclaw-77018 with main (1)

---------

Co-authored-by: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com>
 2026-05-06 14:40:31 +10:00
Vincent Koc
ae9f779e5f docs: typography hygiene + 1 in-body H1 removal across 6 pages 
Replaced 84 typography characters (curly quotes, apostrophes, em/en
dashes, non-breaking hyphens) with ASCII equivalents per
docs/CLAUDE.md heading and content hygiene rules.

- docs/gateway/tools-invoke-http-api.md: 14 chars; removed the
  duplicate '# Tools Invoke (HTTP)' H1 (Mintlify renders title from
  frontmatter; the in-body H1 with parens produced a brittle anchor).
- docs/tools/browser-control.md: 14 chars
- docs/security/formal-verification.md: 14 chars
- docs/gateway/configuration-reference.md: 14 chars
- docs/concepts/agent.md: 14 chars
- docs/channels/qa-channel.md: 14 chars
 2026-05-05 20:26:16 -07:00
Vincent Koc
967c0981e3 docs(help,security): cross-reference auth list and trusted-env-proxy 
Two missing cross-references uncovered by the 24-hour doc audit:

- docs/help/faq-models.md: link to `openclaw models auth list` from the
  "What is an auth profile?" accordion. The command was added in
  23eb44b045 but the FAQ never pointed users at it.
- docs/security/network-proxy.md: list `tools.web.fetch.useTrustedEnvProxy`
  in Related Proxy Terms. The opt-in is fully documented in
  docs/tools/web-fetch.md but the proxy reference page omitted the
  cross-reference, leaving the page incomplete for proxy-state triage.
 2026-05-04 17:43:09 -07:00
Jesse Merhi
d5b0083300 fix: proxy direct APNs HTTP2 sessions (#74905) 
Summary:
- This PR routes direct APNs HTTP/2 sends through an APNs allowlisted managed-proxy CONNECT wrapper, adds APNs proxy validation/docs/guardrails, and expands regression and live-test coverage.
- Reproducibility: yes. source-reproducible: current main `sendApnsRequest()` still uses raw `http2.connect(au ... nly covers HTTP/global-agent/Undici hooks. I did not run a live APNs reproduction in this read-only review.

Automerge notes:
- PR branch already contained follow-up commit before automerge: test: guard raw HTTP2 APNs connections
- PR branch already contained follow-up commit before automerge: test: guard raw HTTP2 with OpenGrep
- PR branch already contained follow-up commit before automerge: lint: ban raw HTTP2 imports
- PR branch already contained follow-up commit before automerge: fix: use managed proxy state for APNs
- PR branch already contained follow-up commit before automerge: test: exercise APNs active proxy state
- PR branch already contained follow-up commit before automerge: fix: reject conflicting managed proxy activation

Validation:
- ClawSweeper review passed for head dab7c86a75.
- Required merge gates passed before the squash merge.

Prepared head SHA: dab7c86a75
Review: https://github.com/openclaw/openclaw/pull/74905#issuecomment-4350181159

Co-authored-by: jesse-merhi <79823012+jesse-merhi@users.noreply.github.com>
Co-authored-by: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com>
 2026-05-04 11:04:17 +00:00
Jesse Merhi
f42a2c738c fix: guard debug proxy CONNECT under managed proxy (#77010) 
Summary:
- The PR adds a managed-proxy-aware debug proxy direct-upstream guard, a diagnostics override env var, regression tests, docs, and a changelog entry.
- Reproducibility: yes. Source inspection on current main shows direct HTTP forwarding and CONNECT net.connect() can run while managed proxy mode is active, against the documented managed-proxy egress guardrail.

Automerge notes:
- Ran the ClawSweeper repair loop before final review.
- Included post-review commit in the final squash: fix(clawsweeper): address review for automerge-openclaw-openclaw-7701…

Validation:
- ClawSweeper review passed for head aaa52a7f5f.
- Required merge gates passed before the squash merge.

Prepared head SHA: aaa52a7f5f
Review: https://github.com/openclaw/openclaw/pull/77010#issuecomment-4367600656

Co-authored-by: jesse-merhi <79823012+jesse-merhi@users.noreply.github.com>
Co-authored-by: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com>
 2026-05-04 03:54:18 +00:00
Jesse Merhi
9c3b7b7b15 docs: clarify IRC managed proxy coverage (#76822) 
Summary:
- The PR adds a changelog note plus IRC and network-proxy documentation stating that IRC raw TCP/TLS egress is outside operator-managed forward proxy routing and should be disabled unless direct egress is approved.
- Reproducibility: not applicable. for this docs-only PR. Source inspection establishes the documented premise ... kets while managed proxy routing covers normal HTTP/WebSocket paths and documents raw-socket bypass limits.

Automerge notes:
- PR branch already contained follow-up commit before automerge: fix(clawsweeper): address review for automerge-openclaw-openclaw-7682…

Validation:
- ClawSweeper review passed for head 7dde35adb9.
- Required merge gates passed before the squash merge.

Prepared head SHA: 7dde35adb9
Review: https://github.com/openclaw/openclaw/pull/76822#issuecomment-4366671907

Co-authored-by: jesse-merhi <79823012+jesse-merhi@users.noreply.github.com>
Co-authored-by: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com>
 2026-05-04 00:52:47 +00:00
Peter Steinberger
79f77d877e docs: move incident response plan 2026-05-03 12:30:11 +01:00
Jesse Merhi
4ea0556f64 feat: add proxy validation command 
Adds `openclaw proxy validate` for operator-managed proxy preflight checks, including allowed/denied destination validation, CLI output, tests, docs, and changelog coverage.

Maintainer follow-ups before landing:
- validate custom allowed URLs before probing;
- use a temporary loopback canary for default denied checks and fail custom denied transport errors as unverifiable;
- redact proxy URL userinfo, query strings, and fragments from text/JSON validation output.

Validation:
- `pnpm test src/infra/net/proxy/proxy-validation.test.ts src/cli/proxy-cli.runtime.test.ts src/cli/proxy-cli.test.ts -- --reporter=verbose`
- `pnpm exec oxfmt --check --threads=1 CHANGELOG.md src/cli/proxy-cli.ts src/cli/proxy-cli.runtime.ts src/cli/proxy-cli.test.ts src/cli/proxy-cli.runtime.test.ts src/infra/net/proxy/proxy-validation.ts src/infra/net/proxy/proxy-validation.test.ts docs/cli/proxy.md docs/security/network-proxy.md`
- `pnpm exec oxlint src/cli/proxy-cli.runtime.ts src/cli/proxy-cli.runtime.test.ts`
- `git diff --check`
- Testbox `pnpm install && OPENCLAW_TESTBOX=1 pnpm check:changed` on `tbx_01kqgz68ff20n3dtrgq0j1mykt`
- GitHub CI success on `321b3aaf2b8be27dec6ce2ac5e4007ed064218b5`
 2026-05-01 00:19:55 -05:00
Peter Steinberger
b113d92c6f docs: clarify managed proxy routing hooks 2026-04-30 00:55:52 +01:00
Jesse Merhi
542821cd1e docs(security): clarify proxy SSRF reporting scope (#74338) 
Merged via squash.

Prepared head SHA: 7dd9fcfade
Co-authored-by: jesse-merhi <79823012+jesse-merhi@users.noreply.github.com>
Co-authored-by: jesse-merhi <79823012+jesse-merhi@users.noreply.github.com>
Reviewed-by: @jesse-merhi
 2026-04-30 00:30:16 +10:00
Peter Steinberger
bdcd543ed7 fix(gateway): bypass proxies for localhost control plane 2026-04-29 11:59:33 +01:00
Jesse Merhi
2633b14914 feat(security): support operator-managed network proxy routing (#70044) 
* feat: support operator-managed proxy routing

* docs: add network proxy changelog entry

* fix(proxy): restrict gateway bypass to loopback IPs

* fix(cli): harden container proxy URL checks

* docs(proxy): clarify gateway bypass scope

* docs: remove proxy changelog entry

* fix(proxy): clear startup CI guard failures

* fix(proxy): harden gateway proxy policy parsing

* fix(proxy): honor update shorthand proxy policy

* fix(cli): redact proxy URL suffixes

* test(proxy): keep gateway help off proxy startup

* fix(proxy): keep overlapping lifecycle active

* docs: add proxy changelog entry

---------

Co-authored-by: joshavant <830519+joshavant@users.noreply.github.com>
 2026-04-28 00:20:47 -05:00
Vincent Koc
baace37fef docs: sentence-case sweep across 10 more pages 
- tools/plugin: Package Entrypoints
- tools/code-execution: How To Use It
- tools/browser-linux-troubleshooting: Root Cause, Config Reference
- install/bun: Lifecycle Scripts
- nodes/audio: Mention Detection in Groups
- nodes/images: Inbound Media to Commands (Pi)
- platforms/android: Connection Runbook
- plugins/building-plugins: Beta Release Testing
- web/control-ui: Content Security Policy
- security/THREAT-MODEL-ATLAS: Framework Attribution
 2026-04-27 00:03:18 -07:00
Vincent Koc
41268ded2d docs: full-page sentence-case sweep across 5 worst-offender pages 
- channels/msteams: 8 H2/H3 (Federated Authentication, Local Development, Known Limitations, Reply Style, Presentation Cards, Private Channels, etc.)
- auth-credential-semantics: 4 H2 (Stable Probe Reason Codes, Token Credentials, Explicit Auth Order Filtering, Probe Target Resolution)
- tools/browser: preserve brand-named headings (Browserless, WebSocket CDP, Chrome MCP, Control API, Brave); minor cleanup
- security/CONTRIBUTING-THREAT-MODEL: 4 H2/H3 (What We Use, Risk Levels, Review Process; Threat IDs preserved as branded label)
- gateway/multiple-gateways: 4 H2 (Best Recommended Setup, Why This Works, General Multi-Gateway Setup, Isolation Checklist)
 2026-04-26 23:58:35 -07:00
Vincent Koc
2fb9c7e3e5 docs: add Related sections to remaining platform, reference template, and misc pages 2026-04-23 20:40:15 -07:00
Vincent Koc
c5c163d078 docs: standardize frontmatter field order (summary before title) 2026-04-23 13:18:17 -07:00
Vincent Koc
2777b089b5 docs: normalize frontmatter titles to sentence case 2026-04-23 13:15:17 -07:00
Vincent Koc
4a2cd533ac docs: remove duplicate H1 where frontmatter title already sets it 2026-04-23 13:11:14 -07:00
Vincent Koc
b970187379 docs: fix oxfmt formatting in remote.md and THREAT-MODEL-ATLAS.md 2026-03-31 14:36:49 +09:00
Vincent Koc
6c6792446b docs: fix THREAT-MODEL-ATLAS pairing TTLs and invalid file paths 2026-03-31 14:24:19 +09:00
Peter Steinberger
c1137ef00d docs(nodes): remove nodes.run references 2026-03-30 00:41:06 +01:00
Vincent Koc
79f2173cd2 docs: add missing frontmatter and title fields 
- Add full frontmatter (title, summary, read_when) to 4 files that
  had none: auth-credential-semantics.md, kilo-gateway-integration.md,
  CONTRIBUTING-THREAT-MODEL.md, THREAT-MODEL-ATLAS.md
- Add missing title field to 3 provider docs: kilocode.md, litellm.md,
  together.md

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 00:02:43 -07:00
Radek Sienkiewicz
4c6a7f84a4 docs: remove dead security README nav entry (#46675) 
Merged via squash.

Prepared head SHA: 63331a54b8
Co-authored-by: velvet-shark <126378+velvet-shark@users.noreply.github.com>
Co-authored-by: velvet-shark <126378+velvet-shark@users.noreply.github.com>
Reviewed-by: @velvet-shark
 2026-03-15 01:40:00 +01:00
Clawdoo
b1a735829d docs: fix Mintlify-incompatible links in security docs (#27698) 
Merged via squash.

Prepared head SHA: 6078cd94ba
Co-authored-by: clawdoo <65667097+clawdoo@users.noreply.github.com>
Co-authored-by: grp06 <1573959+grp06@users.noreply.github.com>
Reviewed-by: @grp06
 2026-03-03 14:51:28 -08:00
Peter Steinberger
e0d4194869 docs: add missing summary/read_when metadata 2026-02-22 20:45:09 +01:00
max
a1123dd9be Centralize date/time formatting utilities (#11831) 2026-02-08 04:53:31 -08:00
theonejvo
74fbbda283 docs: add security & trust documentation 
Add threat model (MITRE ATLAS), contribution guide, and security
directory README. Update SECURITY.md with trust page reporting
instructions and Jamieson O'Reilly as Security & Trust.

Co-Authored-By: theonejvo <theonejvo@users.noreply.github.com>
 2026-02-08 21:53:05 +11:00
cpojer
8cab78abbc chore: Run pnpm format:fix. 2026-01-31 21:13:13 +09:00
Peter Steinberger
9a7160786a refactor: rename to openclaw 2026-01-30 03:16:21 +01:00
vignesh07
0b2b501856 docs: clarify v1++ claims (not just target lists) 2026-01-27 15:35:24 -08:00
vignesh07
ead73f86f0 docs: add v1++ formal model targets (pairing/ingress/routing) 2026-01-27 15:32:37 -08:00
vignesh07
ce5a2add01 docs: fix Moltbot naming consistency on formal verification page 2026-01-27 15:19:34 -08:00
vignesh07
98b136541b docs: fix Moltbot naming in security + formal verification pages 2026-01-27 15:15:18 -08:00
vignesh07
8198e826da docs: update security + formal verification pages for Moltbot rename 2026-01-27 15:12:26 -08:00
Peter Steinberger
6d16a658e5 refactor: rename clawdbot to moltbot with legacy compat 2026-01-27 12:21:02 +00:00
Vignesh
cb770f2cec docs: fix Mintlify MDX autolink (#2584) 2026-01-26 20:58:12 -08:00
Vignesh
f72b881276 docs: fix formal verification route (#2583) 2026-01-26 20:50:11 -08:00
vignesh07
39260e7055 docs(security): publish formal verification page under gateway/security 2026-01-26 20:32:12 -08:00
vignesh07
e487fe2fc4 docs(security): improve formal verification page reproducibility 2026-01-26 20:16:33 -08:00
vignesh07
e03e2ba11a docs(security): clarify formal models caveats and reproduction 2026-01-26 20:13:20 -08:00