Zee Zheng 8be581cbf8 fix(browser): allow inbound media uploads ...

Allow the browser upload tool to resolve OpenClaw-managed inbound media refs such as `media://inbound/<id>` and sandbox-relative `media/inbound/<id>` while preserving the existing upload-root path contract.

Keep upload-root files ahead of sandbox-relative inbound fallback, reject nested absolute inbound media files, and validate raw `media://` paths before URL normalization so traversal-shaped refs cannot resolve to direct media ids.

Verification:
- `OPENCLAW_VITEST_MAX_WORKERS=1 node scripts/run-vitest.mjs extensions/browser/src/browser/paths.test.ts --reporter=verbose`
- `OPENCLAW_VITEST_MAX_WORKERS=1 node scripts/run-vitest.mjs extensions/browser/src/browser/paths.test.ts --reporter=dot`
- `OPENCLAW_HEAVY_CHECK_LOCK_SCOPE=worktree node scripts/run-tsgo.mjs -p test/tsconfig/tsconfig.extensions.test.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/extensions-test.tsbuildinfo`
- `pnpm lint --threads=8`
- `.agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main`
- `git diff --check`
- GitHub PR checks on be08e6c8a8: dependency-guard, check-lint, check-test-types, check-additional-extension-bundled, checks-fast-contracts-plugins-a, checks-fast-contracts-plugins-b all passed.

Fixes #83544.

Co-authored-by: Zee Zheng <zheng.zuo0@gmail.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

2026-05-30 23:49:07 +01:00

..

acpx

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

active-memory

fix(active-memory): bound recall cache clocks

2026-05-30 11:13:04 -04:00

admin-http-rpc

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

alibaba

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

amazon-bedrock

fix(bedrock): bound discovery cache expiry

2026-05-30 12:33:07 -04:00

amazon-bedrock-mantle

fix(bedrock): bound mantle runtime token expiry

2026-05-30 14:09:59 -04:00

anthropic

fix(anthropic): bound setup token expiry

2026-05-30 14:14:13 -04:00

anthropic-vertex

perf(extensions): cache provider runtime imports

2026-05-30 13:00:30 +02:00

arcee

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

azure-speech

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

bonjour

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

brave

refactor: share web search time filters

2026-05-30 07:53:51 +02:00

browser

fix(browser): allow inbound media uploads

2026-05-30 23:49:07 +01:00

byteplus

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

canvas

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

cerebras

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

chutes

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

clickclack

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

cloudflare-ai-gateway

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

codex

fix(codex): keep app-server continuation turns alive

2026-05-30 20:41:04 +01:00

codex-supervisor

fix(codex-supervisor): satisfy release lint

2026-05-30 23:03:32 +01:00

comfy

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

copilot

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

copilot-proxy

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

deepgram

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

deepinfra

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

deepseek

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

device-pair

fix(gateway): gate talk secret bootstrap handoff (#85690)

2026-05-25 11:34:12 +03:00

diagnostics-otel

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

diagnostics-prometheus

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

diffs

fix(diffs): cap artifact expiry overflow

2026-05-30 08:54:56 -04:00

diffs-language-pack

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

discord

fix(feishu): use full gateway channel runtime

2026-05-30 23:46:04 +01:00

document-extract

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

duckduckgo

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

elevenlabs

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

exa

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

fal

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

feishu

fix(feishu): use full gateway channel runtime

2026-05-30 23:46:04 +01:00

file-transfer

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

firecrawl

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

fireworks

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

github-copilot

fix(github-copilot): bound device code expiry

2026-05-30 14:49:34 -04:00

gmi

feat: add hosted model providers (#88247)

2026-05-30 08:26:16 +02:00

google

fix(google): bound realtime browser session expiry

2026-05-30 13:16:22 -04:00

google-meet

fix(google-meet): bound oauth fallback expiry clocks

2026-05-30 10:26:07 -04:00

googlechat

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

gradium

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

groq

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

huggingface

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

image-generation-core

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

imessage

fix(imessage): bound private api negative cache expiry

2026-05-30 13:28:17 -04:00

inworld

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

irc

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

kilocode

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

kimi-coding

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

line

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

litellm

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

llm-task

refactor: unify OpenAI provider identity

2026-05-30 11:48:41 +02:00

lmstudio

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

lobster

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

matrix

refactor(agents): bind subagent threads in core (#88416)

2026-05-30 21:19:09 +01:00

mattermost

refactor: extract model catalog core package

2026-05-30 16:33:45 +01:00

media-understanding-core

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

memory-core

fix(memory): bound qmd embed backoff

2026-05-30 14:39:33 -04:00

memory-lancedb

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

memory-wiki

fix(memory-wiki): guard injected timestamps

2026-05-30 08:02:26 -04:00

microsoft

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

microsoft-foundry

fix(foundry): bound entra token expiry clocks

2026-05-30 10:29:26 -04:00

migrate-claude

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

migrate-hermes

refactor: unify OpenAI provider identity

2026-05-30 11:48:41 +02:00

minimax

fix(minimax): validate oauth authorization expiry

2026-05-30 05:23:53 -04:00

mistral

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

moonshot

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

msteams

refactor(msteams): persist conversation and poll stores in sqlite

2026-05-30 21:08:39 +01:00

nextcloud-talk

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

nostr

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

novita

feat: add hosted model providers (#88247)

2026-05-30 08:26:16 +02:00

nvidia

fix(nvidia): bound featured model cache expiry

2026-05-30 12:34:53 -04:00

oc-path

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

ollama

feat: add hosted model providers (#88247)

2026-05-30 08:26:16 +02:00

open-prose

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

openai

refactor: unify OpenAI provider identity

2026-05-30 11:48:41 +02:00

opencode

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

opencode-go

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

openrouter

refactor: share OpenRouter video mode capabilities

2026-05-30 08:28:41 +02:00

openshell

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

perplexity

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

phone-control

fix(phone-control): bound arm expiry timestamps

2026-05-30 11:24:36 -04:00

pixverse

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

policy

perf(policy): cache doctor file reads

2026-05-30 13:00:31 +02:00

qa-channel

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

qa-lab

fix(runtime): centralize timeout grace clamping

2026-05-30 03:15:50 -04:00

qa-matrix

fix(qa-matrix): cap live timeout env

2026-05-30 03:47:22 -04:00

qianfan

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

qqbot

fix(qqbot): bound reminder schedule time

2026-05-30 14:41:39 -04:00

qwen

feat: add hosted model providers (#88247)

2026-05-30 08:26:16 +02:00

runway

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

searxng

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

senseaudio

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

sglang

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

signal

fix(signal): bound api mode cache clocks

2026-05-30 10:50:44 -04:00

slack

fix(slack): preserve assistant DM root thread context (#63840)

2026-05-30 22:28:49 +01:00

stepfun

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

synology-chat

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

synthetic

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

talk-voice

fix(talk-voice): parse signed list limits

2026-05-29 06:08:50 -04:00

tavily

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

telegram

fix(telegram): bound transport cooldown expiry

2026-05-30 14:16:57 -04:00

tencent

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

test-support

refactor: internalize OpenClaw agent runtime (#85341)

2026-05-27 19:24:04 +01:00

thread-ownership

…

tlon

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

together

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

tokenjuice

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

tts-local-cli

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

twitch

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

venice

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

vercel-ai-gateway

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

video-generation-core

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

vllm

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

voice-call

fix(voice-call): bound webhook replay cache expiry

2026-05-30 13:51:12 -04:00

volcengine

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

voyage

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

vydra

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

web-readability

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

webhooks

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

whatsapp

fix(whatsapp): bound group metadata cache expiry

2026-05-30 11:45:05 -04:00

workboard

feat: expand workboard orchestration metadata (#88408)

2026-05-30 19:22:19 +01:00

xai

refactor: move model catalog normalization into core package

2026-05-30 20:51:11 +01:00

xiaomi

feat(xiaomi): add Token Plan provider support

2026-05-30 11:37:36 +02:00

zai

chore(release): bump version to 2026.5.30

2026-05-30 06:49:13 +01:00

zalo

fix(zalo): bound hosted media expiry clocks

2026-05-30 11:29:33 -04:00

zalouser

fix(zalouser): bound group context cache expiry

2026-05-30 12:52:24 -04:00

.npmignore

…

AGENTS.md

docs: prefer clean refactors over compat shims

2026-05-16 12:38:51 +01:00

CLAUDE.md

…

music-generation-providers.live.test.ts

fix(gateway): reject RPCs from invalidated device-token clients durin… (#70707)

2026-05-26 23:09:56 +01:00

tsconfig.package-boundary.base.json

…

tsconfig.package-boundary.paths.json

refactor: move model catalog normalization into core package

2026-05-30 20:51:11 +01:00

video-generation-providers.live.test.ts

feat(pixverse): add video generation provider

2026-05-27 12:41:10 +02:00