openclaw/extensions at 4e9b1f4775b0724cc7f28cfe6db79baec8f7fa62 - openclaw - Gitea: Git with a cup of tea

vultr/openclaw

mirror of https://github.com/openclaw/openclaw.git synced 2026-08-05 23:31:39 +00:00

Files

History

LZY3538 4e9b1f4775 fix(tlon): bound Urbit auth response body drain to prevent OOM (#109697 )

* fix(tlon): bound Urbit auth response body drain to prevent OOM

Replace the unbounded response.text() body drain (discarded after reading
to finalize set-cookie headers) with a streaming reader capped at 64 KiB.
When no body stream is available, fall back to text() for compatibility.
A hostile or misconfigured Urbit endpoint could previously stream an
arbitrarily large body into memory during login.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(tlon): add curly braces to drain loop for lint compliance

* fix(tlon): remove unbounded text() fallback, cancel reader in finally

Remove the unbounded response.text() body-less fallback path. When no body
stream is available, there is nothing to drain — cookie headers are already
finalised. Move reader.cancel() into a finally block so the reader is
released even when read() throws.

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>

2026-07-20 20:05:36 -07:00

..

fix(acpx): verify native platform packages (#111682 )

2026-07-20 12:57:54 -06:00

feat: bound transcript reads across replacements (#110374 )

2026-07-18 11:41:39 -07:00

…

…

refactor(agents): make API registry ownership lifecycle-local (#111137 )

2026-07-18 20:55:07 -07:00

amazon-bedrock-mantle

fix(amazon-bedrock): ignore blank region env overrides (#110676 )

2026-07-18 22:38:51 +01:00

feat(anthropic): import Claude Desktop custom groups (#111644 )

2026-07-20 00:30:37 -07:00

anthropic-vertex

fix: reject oversized credential files in remaining readers (#109260 )

2026-07-16 11:33:18 -07:00

fix(models): refresh bundled provider catalogs (#109410 )

2026-07-16 16:47:25 -07:00

refactor: reduce plugin SDK test import overhead (#109333 )

2026-07-16 13:55:23 -07:00

refactor: reduce plugin SDK test import overhead (#109333 )

2026-07-16 13:55:23 -07:00

…

refactor: remove expired plugin compatibility surfaces (#111451 )

2026-07-19 11:04:48 -07:00

test(browser): add cross-operation tab reference parity contract (#111375 )

2026-07-20 11:56:57 +08:00

fix: bound pasted input and provider response bodies (#110627 )

2026-07-18 13:54:56 +01:00

fix(canvas): reject malformed snapshot base64 (#108987 )

2026-07-20 19:32:25 -07:00

fix(models): refresh bundled provider catalogs (#109410 )

2026-07-16 16:47:25 -07:00

fix(chutes): report cache-read pricing from live catalog (#111253 )

2026-07-19 19:56:42 -07:00

fix(clawrouter): sanitize attribution headers to ByteString (#106454 )

2026-07-18 02:12:53 +01:00

fix: consume ClickClack v1 setup claim contract (#111927 )

2026-07-20 18:50:30 +01:00

cloudflare-ai-gateway

…

fix(agents): keep sender-scoped tools in delegated runs (#110345 )

2026-07-20 19:42:06 -05:00

…

refactor: reduce plugin SDK test import overhead (#109333 )

2026-07-16 13:55:23 -07:00

refactor: remove expired plugin compatibility surfaces (#111451 )

2026-07-19 11:04:48 -07:00

fix(models): refresh bundled provider catalogs (#109410 )

2026-07-16 16:47:25 -07:00

…

refactor: reduce plugin SDK test import overhead (#109333 )

2026-07-16 13:55:23 -07:00

refactor: remove expired plugin compatibility surfaces (#111451 )

2026-07-19 11:04:48 -07:00

refactor: reduce plugin SDK test import overhead (#109333 )

2026-07-16 13:55:23 -07:00

…

diagnostics-otel

fix(diagnostics-otel): classify model calls as client spans (#104211 )

2026-07-18 18:21:45 -07:00

diagnostics-prometheus

feat: trace Claude Code CLI model calls (#108304 )

2026-07-18 06:23:49 +10:00

refactor(diffs): move ephemeral artifacts to SQLite (#109328 )

2026-07-16 16:47:19 -07:00

diffs-language-pack

…

fix(discord): cancel unread voice CDN upload bodies (#111269 )

2026-07-20 19:25:11 -07:00

document-extract

…

fix(duckduckgo): preserve words around highlighted matches (#111460 )

2026-07-19 19:09:09 -07:00

fix(stt-live-audio): cancel ElevenLabs error response body (#110759 )

2026-07-18 21:48:04 +01:00

refactor: remove expired plugin compatibility surfaces (#111451 )

2026-07-19 11:04:48 -07:00

…

refactor: reduce plugin SDK test import overhead (#109333 )

2026-07-16 13:55:23 -07:00

fix(deps): update axios past proxy advisory (#111984 )

2026-07-21 09:21:14 +09:00

fix(file-transfer): denyPaths does not deny listing the denied directory itself (#109233 )

2026-07-16 22:22:01 -07:00

fix(firecrawl): reject malformed 2xx response envelopes (#111210 )

2026-07-19 20:41:48 -07:00

fix(models): refresh bundled provider catalogs (#109410 )

2026-07-16 16:47:25 -07:00

fix: keep memory SecretRef failures agent-scoped (#109977 )

2026-07-17 14:44:03 +01:00

…

fix(google): keep embedding batch waits within timeout (#111674 )

2026-07-20 11:46:06 +03:00

fix: honor configured default agent in consults (#111749 )

2026-07-20 01:43:00 -07:00

refactor: remove expired plugin compatibility surfaces (#111451 )

2026-07-19 11:04:48 -07:00

refactor: reduce plugin SDK test import overhead (#109333 )

2026-07-16 13:55:23 -07:00

fix(groq): keep default Llama agent turns within TPM limit (#104904 )

2026-07-18 20:00:12 -04:00

fix(huggingface): discover models when HTTP proxy is required (#110924 )

2026-07-18 21:31:24 +01:00

image-generation-core

…

feat(channels): batch 3 producers drop media placeholder bodies (#111800 )

2026-07-20 04:22:44 -07:00

fix(inworld): reject malformed base64 TTS audio (#111197 )

2026-07-19 20:48:46 -04:00

refactor: remove expired plugin compatibility surfaces (#111451 )

2026-07-19 11:04:48 -07:00

fix(kilocode): cancel failed model discovery bodies (#109950 )

2026-07-20 19:09:34 -07:00

fix(providers): refresh zai/kimi/moonshot/xai catalogs against July 2026 vendor docs (#109666 )

2026-07-16 22:41:03 -07:00

refactor: remove expired plugin compatibility surfaces (#111451 )

2026-07-19 11:04:48 -07:00

…

…

fix(litellm): guard loopback hostname auto-allow with isIP to prevent DNS SSRF bypass (#110693 )

2026-07-19 00:51:50 +01:00

fix(llama-cpp): preserve runtime asset paths (#110233 )

2026-07-17 16:36:05 -07:00

…

fix(lmstudio): cancel model discovery response body on non-ok (#109718 )

2026-07-17 01:12:23 -07:00

…

fix: prevent SQLite lock stalls and schema drift (#108663 )

2026-07-16 01:45:06 -07:00

…

refactor: remove expired plugin compatibility surfaces (#111451 )

2026-07-19 11:04:48 -07:00

fix(mattermost): probe hangs past deadline when DNS preflight stalls (#111314 )

2026-07-19 21:31:05 -07:00

media-understanding-core

…

fix(test): bound Matrix test process memory (#111607 )

2026-07-19 20:04:14 -07:00

refactor: remove expired plugin compatibility surfaces (#111451 )

2026-07-19 11:04:48 -07:00

fix(memory-wiki): preserve unavailable source pages (#111034 )

2026-07-19 00:39:23 +01:00

refactor: reduce plugin SDK test import overhead (#109333 )

2026-07-16 13:55:23 -07:00

fix(microsoft): keep valid voices from malformed catalogs (#110784 )

2026-07-20 18:56:52 -07:00

microsoft-foundry

fix(microsoft-foundry): keep spawn pipe streams UTF-8 safe across chunk splits (#109499 )

2026-07-20 18:51:12 -07:00

fix(migrate): harden importer path resolution and memory copy safety (#109314 )

2026-07-16 12:56:43 -07:00

refactor(config): config-surface reduction tranche 1 — retire dead keys, dedupe channel schemas, add growth ratchet (#111142 )

2026-07-19 00:52:37 -07:00

refactor: remove expired plugin compatibility surfaces (#111451 )

2026-07-19 11:04:48 -07:00

refactor: reduce plugin SDK test import overhead (#109333 )

2026-07-16 13:55:23 -07:00

refactor: remove expired plugin compatibility surfaces (#111451 )

2026-07-19 11:04:48 -07:00

fix(deps): update axios past proxy advisory (#111984 )

2026-07-21 09:21:14 +09:00

improve(mxc): document sandbox config options and flag network access as dangerous (#110256 )

2026-07-21 08:59:51 +09:00

refactor: remove expired plugin compatibility surfaces (#111451 )

2026-07-19 11:04:48 -07:00

fix(nostr): prefixed targets fail to send (#110881 )

2026-07-20 04:21:49 -07:00

…

fix(models): refresh bundled provider catalogs (#109410 )

2026-07-16 16:47:25 -07:00

fix(oc-path): reject oversized multibyte JSONC input (#104140 )

2026-07-18 17:47:15 -07:00

refactor: remove expired plugin compatibility surfaces (#111451 )

2026-07-19 11:04:48 -07:00

fix(onepassword): disable desktop-app integration on broker op calls (#109157 )

2026-07-16 09:15:03 -07:00

…

fix(openai): reject malformed Codex image base64 (#111235 )

2026-07-19 20:40:18 -04:00

refactor(protocol): pre-publish cheat-window cleanup and vintage tracking (#111041 )

2026-07-19 04:07:15 -07:00

…

refactor: remove expired plugin compatibility surfaces (#111451 )

2026-07-19 11:04:48 -07:00

…

refactor: remove expired plugin compatibility surfaces (#111451 )

2026-07-19 11:04:48 -07:00

refactor: remove expired plugin compatibility surfaces (#111451 )

2026-07-19 11:04:48 -07:00

…

refactor: remove expired plugin compatibility surfaces (#111451 )

2026-07-19 11:04:48 -07:00

feat(policy): check authored message routing (#111087 )

2026-07-20 17:31:29 -07:00

fix(qa): repair WhatsApp live scenario regressions (#110754 )

2026-07-19 01:43:38 -03:00

fix(qa): run independent evidence channels concurrently (#112008 )

2026-07-21 11:25:46 +09:00

…

fix(qqbot): avoid memory spikes from oversized client secret files (#110002 )

2026-07-20 19:00:28 -07:00

fix(models): refresh bundled provider catalogs (#109410 )

2026-07-16 16:47:25 -07:00

refactor: remove expired plugin compatibility surfaces (#111451 )

2026-07-19 11:04:48 -07:00

fix: make Back work within channel setup (#108007 )

2026-07-20 14:34:05 +10:00

fix: bound pasted input and provider response bodies (#110627 )

2026-07-18 13:54:56 +01:00

…

refactor: reduce plugin SDK test import overhead (#109333 )

2026-07-16 13:55:23 -07:00

…

fix(signal): report malformed release metadata cleanly (#110824 )

2026-07-20 05:19:34 -07:00

fix(deps): update axios past proxy advisory (#111984 )

2026-07-21 09:21:14 +09:00

fix(sms): trim prefixed phone number spacing (#111111 )

2026-07-20 02:29:06 -07:00

…

fix(synology-chat): ignore blank env fallbacks (#109495 )

2026-07-20 19:40:45 -07:00

fix(models): refresh bundled provider catalogs (#109410 )

2026-07-16 16:47:25 -07:00

…

refactor: remove expired plugin compatibility surfaces (#111451 )

2026-07-19 11:04:48 -07:00

fix(teams-meetings): expose listening probe timeout (#111486 )

2026-07-20 23:39:27 +08:00

feat(channels): batch 4 Telegram drops media placeholder bodies (#111855 )

2026-07-20 07:31:10 -07:00

…

refactor: reduce plugin SDK test import overhead (#109333 )

2026-07-16 13:55:23 -07:00

thread-ownership

fix(thread-ownership): cancel unread ownership response bodies (#111231 )

2026-07-19 20:48:44 -07:00

fix(tlon): bound Urbit auth response body drain to prevent OOM (#109697 )

2026-07-20 20:05:36 -07:00

fix: bound pasted input and provider response bodies (#110627 )

2026-07-18 13:54:56 +01:00

…

…

refactor: remove expired plugin compatibility surfaces (#111451 )

2026-07-19 11:04:48 -07:00

fix(vault): aggregate provider outage diagnostics (#110908 )

2026-07-18 22:44:06 +01:00

fix(models): refresh bundled provider catalogs (#109410 )

2026-07-16 16:47:25 -07:00

vercel-ai-gateway

…

video-generation-core

…

…

fix: honor configured default agent in consults (#111749 )

2026-07-20 01:43:00 -07:00

fix(models): refresh bundled provider catalogs (#109410 )

2026-07-16 16:47:25 -07:00

…

fix(ci): restore plugin prerelease validation (#110787 )

2026-07-18 17:00:15 +01:00

web-readability

…

fix(webhooks): keep routes cold when SecretRefs are unavailable (#109715 )

2026-07-16 23:56:59 -07:00

feat(channels): batch 3 producers drop media placeholder bodies (#111800 )

2026-07-20 04:22:44 -07:00

fix(workboard): avoid duplicate proof entries on completion (#111324 )

2026-07-19 03:00:37 -07:00

fix(xai): reject malformed streamed TTS base64 (#111201 )

2026-07-19 20:40:53 -04:00

refactor: remove expired plugin compatibility surfaces (#111451 )

2026-07-19 11:04:48 -07:00

fix(errors): recover from Z.AI token-limit errors (#111744 )

2026-07-20 17:11:40 +03:00

refactor: remove expired plugin compatibility surfaces (#111451 )

2026-07-19 11:04:48 -07:00

perf(state): cap the per-agent SQLite handle cache with LRU eviction (#111411 )

2026-07-19 13:58:01 -07:00

fix: honor configured default agent in consults (#111749 )

2026-07-20 01:43:00 -07:00

.npmignore

…

AGENTS.md

…

CLAUDE.md

…

music-generation-providers.live.test.ts

refactor: reduce plugin SDK test import overhead (#109333 )

2026-07-16 13:55:23 -07:00

tsconfig.package-boundary.base.json

…

tsconfig.package-boundary.paths.json

refactor: remove expired plugin compatibility surfaces (#111451 )

2026-07-19 11:04:48 -07:00

video-generation-providers.live.test.ts

refactor: reduce plugin SDK test import overhead (#109333 )

2026-07-16 13:55:23 -07:00