Benedikt Johannes b81e1b902d Fixes minor security vulnerability (#30948) (#30951) ...

Merged via squash.

Prepared head SHA: cfbe5fe830
Co-authored-by: benediktjohannes <253604130+benediktjohannes@users.noreply.github.com>
Co-authored-by: shakkernerd <165377636+shakkernerd@users.noreply.github.com>
Reviewed-by: @shakkernerd

2026-03-02 00:38:01 +00:00

..

acp

ACP: carry dedupe/projector updates onto configurable acpx branch

2026-03-01 20:39:24 +01:00

agents

fix(agents): harden tool-name normalization and transcript repair

2026-03-01 23:51:54 +00:00

auto-reply

fix(session): retire stale dm main route after dmScope migration (#31010)

2026-03-02 00:33:54 +00:00

browser

fix(browser): harden writable output paths

2026-03-01 23:25:13 +00:00

canvas-host

test: tighten canvas host websocket watchdog timeouts

2026-02-21 23:02:44 +00:00

channels

fix(discord): unify reconnect watchdog and land #31025/#30530

2026-03-02 00:24:15 +00:00

cli

CLI: add root --help fast path and lazy channel option resolution (#30975)

2026-03-01 14:23:46 -08:00

commands

Doctor: warn when Linux state dir is on SD/eMMC mounts (#31033)

2026-03-01 16:36:01 -08:00

compat

…

config

refactor(config): share byte-size parsing for memory flush

2026-03-02 00:32:33 +00:00

cron

fix(gateway): prevent /api/* routes from returning SPA HTML when basePath is empty (#30333)

2026-03-01 22:23:54 +01:00

daemon

fix(gateway): shorten manual reinstall/restart delays

2026-02-28 20:46:11 -05:00

discord

fix(discord): unify reconnect watchdog and land #31025/#30530

2026-03-02 00:24:15 +00:00

docs

…

gateway

refactor(diagnostics): hot-reload stuck warning threshold

2026-03-02 00:32:33 +00:00

hooks

refactor: unify boundary hardening for file reads

2026-02-26 13:04:37 +01:00

imessage

refactor(security): enforce account-scoped pairing APIs

2026-02-26 21:57:52 +01:00

infra

refactor: simplify sandbox boundary open flow

2026-03-01 21:49:42 +00:00

line

refactor(security): enforce account-scoped pairing APIs

2026-02-26 21:57:52 +01:00

link-understanding

chore: remove verified dead code paths

2026-02-22 09:21:09 +01:00

logging

refactor(diagnostics): hot-reload stuck warning threshold

2026-03-02 00:32:33 +00:00

markdown

fix(markdown): require paired || delimiters for spoiler detection (#26105)

2026-02-25 04:54:51 +00:00

media

test: add outside-workspace error mapping coverage

2026-02-28 18:08:10 +05:30

media-understanding

fix(security): lock sandbox tmp media paths to openclaw roots

2026-02-24 23:10:19 +00:00

memory

fix(memory): discard stdout for qmd update/embed to prevent output cap failure (openclaw#28900) thanks @Glucksberg

2026-03-01 12:16:50 -06:00

node-host

refactor(gateway): share node command catalog

2026-02-26 22:01:06 +01:00

pairing

refactor(channels): unify dm pairing policy flows

2026-02-26 22:36:20 +01:00

plugin-sdk

refactor(security): unify webhook guardrails across channels

2026-03-02 00:31:42 +00:00

plugins

fix(plugins): prioritize bundled duplicates in auto-discovery

2026-03-01 23:48:30 +00:00

process

test: harden flaky timeout and resolver specs

2026-03-01 21:30:07 +00:00

providers

Config: expand Kilo catalog and persist selected Kilo models (#24921)

2026-02-23 21:17:37 -05:00

routing

fix(core): unify session-key normalization and plugin boundary checks

2026-02-26 12:41:23 +00:00

scripts

test(scripts): dedupe a2ui temp fixture and cover skip-missing env path

2026-02-21 21:40:39 +00:00

secrets

test: harden flaky timeout and resolver specs

2026-03-01 21:30:07 +00:00

security

Fixes minor security vulnerability (#30948) (#30951)

2026-03-02 00:38:01 +00:00

sessions

TUI: sync /model status immediately

2026-02-28 14:02:56 -08:00

shared

Web UI: strip relevant-memories scaffolding

2026-02-28 13:20:50 -08:00

signal

fix(channels): align command-body parsing sources

2026-03-01 23:11:48 +00:00

slack

fix(channels): align command-body parsing sources

2026-03-01 23:11:48 +00:00

telegram

feat(diagnostics): add configurable stuck-session warning threshold

2026-03-02 00:07:29 +00:00

terminal

test(core): use lightweight clears in runtime and telegram setup

2026-02-22 08:09:14 +00:00

test-helpers

refactor: dedupe media and request-body test scaffolding

2026-02-22 18:37:25 +00:00

test-utils

diffs plugin

2026-02-28 18:38:00 -05:00

tts

fix(tts): use opus format and enable voice bubbles for feishu and whatsapp (#27366)

2026-02-27 23:41:22 -06:00

tui

TUI: guard SIGTERM shutdown against setRawMode EBADF

2026-02-28 14:56:01 -08:00

types

…

utils

fix(agents): add forward-compat fallback for google-gemini-cli gemini-3.1-pro/flash-preview (#26570)

2026-02-26 18:39:13 -05:00

web

refactor(security): enforce account-scoped pairing APIs

2026-02-26 21:57:52 +01:00

whatsapp

WhatsApp: enforce allowFrom for explicit outbound sends (#20921)

2026-02-22 18:13:23 -05:00

wizard

fix(gateway): land access/auth/config migration cluster

2026-03-02 00:10:51 +00:00

channel-web.ts

…

docker-image-digests.test.ts

…

docker-setup.test.ts

fix: harden Docker/GCP onboarding flow (#26253) (thanks @pandego)

2026-02-26 04:46:18 +00:00

dockerfile.test.ts

fix(docker): harden /app/extensions permissions to 755 (#30191)

2026-03-01 15:45:21 -08:00

entry.ts

CLI: add root --help fast path and lazy channel option resolution (#30975)

2026-03-01 14:23:46 -08:00

extensionAPI.ts

…

globals.ts

…

index.ts

…

logger.test.ts

…

logger.ts

…

logging.ts

…

polls.test.ts

…

polls.ts

…

runtime.ts

…

utils.test.ts

fix(utils): guard resolveUserPath for missing workspace input

2026-02-22 13:19:25 +01:00

utils.ts

fix(utils): guard resolveUserPath for missing workspace input

2026-02-22 13:19:25 +01:00

version.test.ts

test(core): increase coverage for sessions, auth choice, and model listing

2026-02-22 14:08:51 +00:00

version.ts

…