Vincent Koc 084dfd2ecc Media: reject spoofed input_image MIME payloads (#38289) ...

* Media: reject spoofed input image MIME types

* Media: cover spoofed input image MIME regressions

* Changelog: note input image MIME hardening

2026-03-06 14:34:28 -05:00

..

acp

ACP: add persistent Discord channel and Telegram topic bindings (#34873)

2026-03-05 09:38:12 +01:00

agents

feat(onboarding): add web search to onboarding flow (#34009)

2026-03-06 13:09:00 -06:00

auto-reply

fix(session): tighten direct-session webchat routing matching (#37867)

2026-03-06 08:53:16 -05:00

browser

fix(browser): close tracked tabs on session cleanup (#36666)

2026-03-05 16:40:52 -08:00

canvas-host

refactor(tests): dedupe canvas host server setup

2026-03-03 02:53:13 +00:00

channels

CLI: make read-only SecretRef status flows degrade safely (#37023)

2026-03-05 23:07:13 -06:00

cli

chore: code/dead tests cleanup (#38286)

2026-03-06 14:27:02 -05:00

commands

feat(onboarding): add web search to onboarding flow (#34009)

2026-03-06 13:09:00 -06:00

compat

…

config

feat(onboarding): add web search to onboarding flow (#34009)

2026-03-06 13:09:00 -06:00

context-engine

feature(context): extend plugin system to support custom context management (#22201)

2026-03-06 05:31:59 -08:00

cron

feature(context): extend plugin system to support custom context management (#22201)

2026-03-06 05:31:59 -08:00

daemon

Fix Linux daemon install checks when systemd user bus env is missing (#34884)

2026-03-04 11:54:03 -08:00

discord

chore: code/dead tests cleanup (#38286)

2026-03-06 14:27:02 -05:00

docs

…

gateway

fix(gateway): keep probe routes reachable with root-mounted control ui (#38199)

2026-03-06 12:13:20 -05:00

hooks

Infra: require explicit opt-in for prerelease npm installs (#38117)

2026-03-06 11:13:30 -05:00

i18n

ACP: add persistent Discord channel and Telegram topic bindings (#34873)

2026-03-05 09:38:12 +01:00

imessage

refactor: unify inbound debounce policy and split gateway/models helpers

2026-03-03 00:54:33 +00:00

infra

Infra: require explicit opt-in for prerelease npm installs (#38117)

2026-03-06 11:13:30 -05:00

line

fix(outbound): unify resolved cfg threading across send paths (#33987)

2026-03-04 00:20:44 -06:00

link-understanding

…

logging

build: fix ineffective dynamic imports with lazy boundaries (#33690)

2026-03-03 20:14:41 -05:00

markdown

refactor: dedupe gateway config and infra flows

2026-03-03 00:15:14 +00:00

media

Media: reject spoofed input_image MIME payloads (#38289)

2026-03-06 14:34:28 -05:00

media-understanding

build: prevent mixed static/dynamic pi-model-discovery imports

2026-03-03 21:27:14 -05:00

memory

fix(memory): retry mcporter after Windows EINVAL spawn

2026-03-05 22:27:37 -08:00

node-host

fix(node-host): sync rawCommand with hardened argv after executable path pinning (#33137)

2026-03-04 11:30:33 -05:00

pairing

Gateway: add SecretRef support for gateway.auth.token with auth-mode guardrails (#35094)

2026-03-05 12:53:56 -06:00

plugin-sdk

feature(context): extend plugin system to support custom context management (#22201)

2026-03-06 05:31:59 -08:00

plugins

Infra: require explicit opt-in for prerelease npm installs (#38117)

2026-03-06 11:13:30 -05:00

process

fix: Windows: openclaw plugins install fails with spawn EINVAL

2026-03-06 22:19:16 +05:30

providers

refactor: dedupe agent and browser cli helpers

2026-03-03 00:15:00 +00:00

routing

fix(routing): avoid full binding rescans in resolveAgentRoute (#36915)

2026-03-05 16:49:29 -08:00

scripts

CI: cover skill and extension tests

2026-03-06 11:21:03 -05:00

secrets

CLI: make read-only SecretRef status flows degrade safely (#37023)

2026-03-05 23:07:13 -06:00

security

CLI: make read-only SecretRef status flows degrade safely (#37023)

2026-03-05 23:07:13 -06:00

sessions

fix: add runtime.events regression tests (#16044) (thanks @scifantastic)

2026-03-03 01:37:56 +00:00

shared

add prependSystemContext and appendSystemContext to before_prompt_build (fixes #35131) (#35177)

2026-03-05 13:06:59 -05:00

signal

fix(outbound): unify resolved cfg threading across send paths (#33987)

2026-03-04 00:20:44 -06:00

slack

CLI: make read-only SecretRef status flows degrade safely (#37023)

2026-03-05 23:07:13 -06:00

telegram

chore: prep #38056 for landing (thanks @0xlin2023)

2026-03-06 22:19:16 +05:30

terminal

CLI: dedupe config validate errors and expose allowed values

2026-03-02 20:05:12 -05:00

test-helpers

refactor: dedupe media and request-body test scaffolding

2026-02-22 18:37:25 +00:00

test-utils

fix(agents): honor explicit rate-limit cooldown probes in fallback runs

2026-03-05 20:03:06 -08:00

tts

TTS: add baseUrl support to OpenAI TTS config (#34321)

2026-03-05 07:25:04 +00:00

tui

fix(tui): accept canonical session-key aliases in chat event routing

2026-03-05 22:01:06 -08:00

types

Memory: handle SecretRef keys in doctor embeddings (#36835)

2026-03-05 20:05:59 -06:00

utils

fix(secrets): harden api key normalization for ByteString headers

2026-03-05 18:31:45 -08:00

web

WhatsApp: honor outbound mediaMaxMb (#38097)

2026-03-06 11:08:15 -05:00

whatsapp

refactor: dedupe channel outbound and monitor tests

2026-03-03 00:15:15 +00:00

wizard

feat(onboarding): add web search to onboarding flow (#34009)

2026-03-06 13:09:00 -06:00

channel-web.ts

…

docker-image-digests.test.ts

container builds: opt-in extension deps via OPENCLAW_EXTENSIONS build arg (#32223)

2026-03-06 12:18:42 -05:00

docker-setup.e2e.test.ts

feat(docker): add opt-in sandbox support for Docker deployments (#29974)

2026-03-01 23:06:10 -08:00

dockerfile.test.ts

fix(docker): correct awk quoting in Docker GPG fingerprint check (#32153)

2026-03-03 02:32:46 +00:00

entry.ts

CLI: add root --help fast path and lazy channel option resolution (#30975)

2026-03-01 14:23:46 -08:00

extensionAPI.ts

…

globals.ts

…

index.ts

…

logger.test.ts

…

logger.ts

refactor: dedupe agent and reply runtimes

2026-03-02 19:57:33 +00:00

logging.ts

…

poll-params.test.ts

Harden Telegram poll gating and schema consistency (#36547)

2026-03-05 19:24:43 -05:00

poll-params.ts

Harden Telegram poll gating and schema consistency (#36547)

2026-03-05 19:24:43 -05:00

polls.test.ts

…

polls.ts

Harden Telegram poll gating and schema consistency (#36547)

2026-03-05 19:24:43 -05:00

runtime.ts

…

utils.test.ts

…

utils.ts

…

version.test.ts

Gateway: fix stale self version in status output (#32655)

2026-03-03 02:41:52 -05:00

version.ts

Gateway: fix stale self version in status output (#32655)

2026-03-03 02:41:52 -05:00