Masato Hoshino c9ec548e6f fix(browser): preserve strict CDP discovery policy on target-list lookup (#102328) ...

* fix(browser): preserve strict CDP discovery policy on target-list lookup

findPageByTargetIdViaTargetList fetched the CDP /json/list endpoint without
passing an ssrfPolicy argument, so the caller's discovery policy was dropped at
the fetch layer while the sibling tryTerminateExecutionViaCdp scoped it. Build
the scoped control policy with scopeCdpPolicyToConfiguredEndpoint and pass it to
fetchJson, matching the sibling lookup path.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test(browser): tighten target-list CDP policy test comment

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test(browser): consolidate target-list SSRF coverage

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>

2026-07-09 12:04:39 +01:00

..

acpx

fix(ci): stabilize npm shrinkwrap metadata

2026-07-08 15:55:50 -07:00

active-memory

fix(active-memory): use truncateUtf16Safe for log value truncation (#102551)

2026-07-09 11:10:42 +01:00

admin-http-rpc

…

alibaba

…

amazon-bedrock

fix(anthropic): resolve thinking as disabled when legacy budget is below 1024 (#101415)

2026-07-07 08:42:40 +01:00

amazon-bedrock-mantle

fix(anthropic): resolve thinking as disabled when legacy budget is below 1024 (#101415)

2026-07-07 08:42:40 +01:00

anthropic

test(anthropic): cover Sonnet 5 CLI allowlist

2026-07-08 14:48:50 -07:00

anthropic-vertex

fix(anthropic): resolve thinking as disabled when legacy budget is below 1024 (#101415)

2026-07-07 08:42:40 +01:00

arcee

feat(macos): load provider catalog during AI onboarding (#101132)

2026-07-06 20:57:56 +01:00

azure-speech

…

bonjour

refactor(plugins): localize private declarations (#101406)

2026-07-06 23:26:47 -07:00

brave

refactor(plugins): localize provider internals (#101425)

2026-07-06 23:50:12 -07:00

browser

fix(browser): preserve strict CDP discovery policy on target-list lookup (#102328)

2026-07-09 12:04:39 +01:00

byteplus

feat(macos): load provider catalog during AI onboarding (#101132)

2026-07-06 20:57:56 +01:00

canvas

refactor(deadcode): localize canvas declarations (#101915)

2026-07-07 16:49:22 -07:00

cerebras

feat(macos): load provider catalog during AI onboarding (#101132)

2026-07-06 20:57:56 +01:00

chutes

feat(macos): load provider catalog during AI onboarding (#101132)

2026-07-06 20:57:56 +01:00

clawrouter

feat: show auto-detected provider plans and billing (#100520)

2026-07-06 04:53:09 +01:00

clickclack

refactor(plugins): localize internal helper types (#101922)

2026-07-07 17:11:49 -07:00

cloudflare-ai-gateway

…

codex

fix(codex): use truncateUtf16Safe in trajectory and client parse log truncation (#102576)

2026-07-09 10:53:25 +01:00

codex-supervisor

feat: show Codex sessions across Gateway and paired nodes (#102586)

2026-07-09 03:42:03 -07:00

cohere

feat(cohere): add current Command models (#102563)

2026-07-09 11:07:50 +01:00

comfy

fix(comfy): allow private service hostnames (#99065)

2026-07-08 21:11:08 -05:00

copilot

refactor(copilot): localize internal runtime types (#101379)

2026-07-06 22:33:59 -07:00

copilot-proxy

feat(github-copilot): support GitHub Enterprise data-residency Copilot auth (#99221)

2026-07-08 18:59:41 -07:00

deepgram

…

deepinfra

refactor(plugins): localize provider internals (#101425)

2026-07-06 23:50:12 -07:00

deepseek

feat(macos): load provider catalog during AI onboarding (#101132)

2026-07-06 20:57:56 +01:00

device-pair

refactor(plugins): localize private declarations (#101406)

2026-07-06 23:26:47 -07:00

diagnostics-otel

improve(diagnostics-otel): make agent-duration histograms usable beyond 10s (#96592)

2026-07-07 19:13:05 -07:00

diagnostics-prometheus

fix(diagnostics-prometheus): use truncateUtf16Safe for error message truncation (#102591)

2026-07-09 11:04:47 +01:00

diffs

refactor(plugins): localize internal declarations (#102021)

2026-07-07 21:32:59 -07:00

diffs-language-pack

fix(diffs): share SSR preloads and repair language-pack hydration (#100487)

2026-07-06 00:34:17 +01:00

discord

fix(discord): use truncateUtf16Safe for deploy error body truncation (#102525)

2026-07-09 09:33:46 +01:00

document-extract

…

duckduckgo

…

elevenlabs

…

exa

…

fal

…

featherless

fix(provider): satisfy Featherless release checks

2026-07-06 16:17:44 -07:00

feishu

refactor(feishu): localize internal declarations (#101949)

2026-07-07 18:41:30 -07:00

file-transfer

refactor(plugins): localize internal declarations (#102021)

2026-07-07 21:32:59 -07:00

firecrawl

refactor(plugins): localize provider internals (#101425)

2026-07-06 23:50:12 -07:00

fireworks

feat(macos): load provider catalog during AI onboarding (#101132)

2026-07-06 20:57:56 +01:00

github-copilot

feat(github-copilot): support GitHub Enterprise data-residency Copilot auth (#99221)

2026-07-08 18:59:41 -07:00

gmi

feat(macos): load provider catalog during AI onboarding (#101132)

2026-07-06 20:57:56 +01:00

google

improve(google): identify OpenClaw Gemini API traffic (#101834)

2026-07-07 16:09:02 -06:00

google-meet

fix(google-meet): bound Google API requests (#102149)

2026-07-09 09:39:34 +01:00

googlechat

fix(googlechat): cap approval binding registries (#101744)

2026-07-09 11:12:32 +01:00

gradium

…

groq

feat(macos): load provider catalog during AI onboarding (#101132)

2026-07-06 20:57:56 +01:00

huggingface

fix(extensions/huggingface): bound model discovery JSON response read to prevent OOM (#101079)

2026-07-06 23:26:27 +01:00

image-generation-core

…

imessage

refactor(imessage): localize internal helper symbols (#101936)

2026-07-07 18:00:44 -07:00

inworld

…

irc

fix(agent): preserve explicit recipient sessions (#101507)

2026-07-07 10:07:13 +01:00

kilocode

refactor: localize internal implementation symbols (#101831)

2026-07-07 10:23:36 -07:00

kimi-coding

refactor: localize internal implementation symbols (#101831)

2026-07-07 10:23:36 -07:00

line

fix(channels): keep inbound log previews UTF-16 safe (#102407)

2026-07-09 07:32:55 +01:00

litellm

feat(macos): load provider catalog during AI onboarding (#101132)

2026-07-06 20:57:56 +01:00

llama-cpp

refactor(plugins): localize private declarations (#101406)

2026-07-06 23:26:47 -07:00

llm-task

…

lmstudio

feat(macos): load provider catalog during AI onboarding (#101132)

2026-07-06 20:57:56 +01:00

lobster

fix(lobster): keep ordinary run/resume on default flow fields (#102036)

2026-07-07 23:04:01 -07:00

logbook

refactor(plugins): localize internal helper types (#101922)

2026-07-07 17:11:49 -07:00

longcat

feat(providers): add LongCat API support (#100501)

2026-07-06 10:07:08 -07:00

matrix

fix(channels): keep inbound log previews UTF-16 safe (#102407)

2026-07-09 07:32:55 +01:00

mattermost

fix(mattermost): truncate inbound preview on code-point boundary (#101630)

2026-07-09 04:05:03 +01:00

media-understanding-core

…

memory-core

fix(agent-core,memory-core): keep compaction summary and memory snippet truncation UTF-16 safe (#102542)

2026-07-09 10:08:11 +01:00

memory-lancedb

fix: keep bounded text truncation UTF-16 safe (#101654)

2026-07-07 13:44:32 +01:00

memory-wiki

refactor(memory-wiki): localize internal helper types (#101931)

2026-07-07 17:46:54 -07:00

microsoft

…

microsoft-foundry

fix(microsoft-foundry): keep connection test error truncation UTF-16 safe (#102605)

2026-07-09 11:51:38 +01:00

migrate-claude

…

migrate-hermes

…

minimax

refactor: localize internal implementation symbols (#101831)

2026-07-07 10:23:36 -07:00

mistral

feat(providers): refresh Qwen, Cohere, and Mistral catalogs (#102489)

2026-07-09 08:16:50 +01:00

moonshot

feat(macos): load provider catalog during AI onboarding (#101132)

2026-07-06 20:57:56 +01:00

msteams

fix(msteams): lowercase content type so attachment classification is case-insensitive (#102431)

2026-07-09 09:24:35 +01:00

nextcloud-talk

fix(nextcloud-talk): add timeouts to Talk send requests (#102025)

2026-07-09 11:49:48 +01:00

nostr

fix(agent): preserve explicit recipient sessions (#101507)

2026-07-07 10:07:13 +01:00

novita

feat(macos): load provider catalog during AI onboarding (#101132)

2026-07-06 20:57:56 +01:00

nvidia

test(nvidia): align guided secret metadata

2026-07-08 17:10:21 -07:00

oc-path

fix(oc-path): use truncateUtf16Safe for error message path truncation (#102527)

2026-07-09 09:35:17 +01:00

ollama

fix(ollama): use truncateUtf16Safe for malformed NDJSON log truncation (#102593)

2026-07-09 11:38:54 +01:00

open-prose

…

openai

fix(openai): correct Realtime auth and transcription secrets (#102518)

2026-07-09 08:55:31 +01:00

opencode

feat(macos): load provider catalog during AI onboarding (#101132)

2026-07-06 20:57:56 +01:00

opencode-go

refactor(opencode-go): localize stream internals (#101440)

2026-07-07 00:16:14 -07:00

openrouter

refactor: localize internal implementation constants (#101758)

2026-07-07 08:34:13 -07:00

openshell

…

parallel

fix(parallel): use truncateUtf16Safe for MCP error JSON truncation (#102592)

2026-07-09 11:25:28 +01:00

perplexity

…

phone-control

…

pixverse

…

policy

policy: preview review-required gateway repairs (#99776)

2026-07-08 10:44:56 -07:00

qa-channel

fix(agent): preserve explicit recipient sessions (#101507)

2026-07-07 10:07:13 +01:00

qa-lab

fix(qa-lab): surface gateway child stream failures (#102104)

2026-07-09 10:28:32 +01:00

qa-matrix

test(release): refresh beta plugin expectations

2026-07-08 14:22:22 -07:00

qianfan

feat(macos): load provider catalog during AI onboarding (#101132)

2026-07-06 20:57:56 +01:00

qqbot

fix(qqbot): use truncateUtf16Safe for debug log URL/key truncation (#102572)

2026-07-09 11:20:38 +01:00

qwen

feat(providers): refresh Qwen, Cohere, and Mistral catalogs (#102489)

2026-07-09 08:16:50 +01:00

raft

…

runway

…

searxng

fix(web): mark partial response reads when streams fail (#102550)

2026-07-09 11:58:56 +01:00

senseaudio

…

sglang

…

signal

refactor(signal): localize internal declarations (#102042)

2026-07-07 22:28:42 -07:00

slack

fix: restore release validation on main (#102516)

2026-07-09 09:39:08 +01:00

sms

fix(agent): preserve explicit recipient sessions (#101507)

2026-07-07 10:07:13 +01:00

stepfun

feat(stepfun): add step-3.7-flash model (#88082)

2026-07-09 07:14:46 +01:00

synology-chat

fix(agent): preserve explicit recipient sessions (#101507)

2026-07-07 10:07:13 +01:00

synthetic

feat(macos): load provider catalog during AI onboarding (#101132)

2026-07-06 20:57:56 +01:00

talk-voice

…

tavily

…

telegram

fix(telegram): use truncateUtf16Safe for raw update log truncation (#102567)

2026-07-09 11:11:35 +01:00

tencent

feat(models): add Claude Sonnet 5 support (#98254)

2026-07-07 00:05:35 +01:00

test-support

…

thread-ownership

…

tlon

refactor: localize internal implementation types (#101731)

2026-07-07 07:41:04 -07:00

together

feat(macos): load provider catalog during AI onboarding (#101132)

2026-07-06 20:57:56 +01:00

tokenjuice

…

tts-local-cli

fix(text): keep diagnostic truncation UTF-16 safe

2026-07-09 04:02:39 -07:00

twitch

fix(agent): preserve explicit recipient sessions (#101507)

2026-07-07 10:07:13 +01:00

vault

Add Vault SecretRef plugin (#89255)

2026-07-09 05:30:12 -05:00

venice

feat(macos): load provider catalog during AI onboarding (#101132)

2026-07-06 20:57:56 +01:00

vercel-ai-gateway

feat(macos): load provider catalog during AI onboarding (#101132)

2026-07-06 20:57:56 +01:00

video-generation-core

…

vllm

refactor: localize internal implementation symbols (#101831)

2026-07-07 10:23:36 -07:00

voice-call

fix(twilio): redact webhook turnToken diagnostics (#102089)

2026-07-09 11:19:40 +01:00

volcengine

feat(macos): load provider catalog during AI onboarding (#101132)

2026-07-06 20:57:56 +01:00

voyage

fix(voyage): close response body stream when batch output JSONL parsing throws (#98840)

2026-07-06 06:32:50 +00:00

vydra

…

web-readability

…

webhooks

…

whatsapp

fix(whatsapp): keep echo tracker log truncation UTF-16 safe (#102603)

2026-07-09 11:46:52 +01:00

workboard

fix: preserve emoji at remaining bounded-text edges (#101711)

2026-07-07 15:48:21 +01:00

xai

feat(xai): add Grok 4.5 support (#102316)

2026-07-09 01:39:03 +01:00

xiaomi

refactor: localize internal implementation symbols (#101831)

2026-07-07 10:23:36 -07:00

zai

feat(macos): load provider catalog during AI onboarding (#101132)

2026-07-06 20:57:56 +01:00

zalo

fix(text): keep reachable truncation boundaries UTF-16 safe

2026-07-07 23:37:52 -07:00

zalouser

fix(zalouser): clear probe timeout after auth resolves (#101649)

2026-07-09 08:29:44 +01:00

.npmignore

…

AGENTS.md

…

CLAUDE.md

…

music-generation-providers.live.test.ts

…

tsconfig.package-boundary.base.json

…

tsconfig.package-boundary.paths.json

refactor(qa): add canonical live channel adapters (#99707)

2026-07-06 09:24:34 -07:00

video-generation-providers.live.test.ts

…