Agustin Rivera b860a0d4d0 fix: harden qqbot direct media uploads ...

Harden QQBot direct media URL uploads by downloading through the local SSRF guard before QQ upload, disabling redirects, bounding fetch/setup and body reads, and routing downloaded buffers through the existing one-shot/chunked size gate.

Co-authored-by: Agustin Rivera <agustin@rivera-web.com>

2026-05-28 04:21:46 +01:00

..

reply

fix(discord): fence tool warning fallback delivery (#87465)

2026-05-28 01:39:14 +01:00

test-helpers

refactor: reuse shared coercion helpers (#86419)

2026-05-25 21:20:41 +01:00

chunk.test.ts

fix(auto-reply): honor webchat textChunkLimit/chunkMode config overrides [AI-assisted] (#83742)

2026-05-18 20:09:40 +00:00

chunk.ts

refactor: centralize inbound supplemental context

2026-05-27 09:26:06 +01:00

command-auth.owner-default.test.ts

…

command-auth.ts

refactor: remove sender owner tool gating

2026-05-21 15:14:48 +01:00

command-control.test.ts

refactor: remove sender owner tool gating

2026-05-21 15:14:48 +01:00

command-detection.runtime-types.ts

…

command-detection.ts

…

command-status-builders.ts

…

command-turn-context.test.ts

fix(reply): derive explicit control command turns

2026-05-27 05:57:04 +01:00

command-turn-context.ts

fix(reply): derive explicit control command turns

2026-05-27 05:57:04 +01:00

command-turn-detection.ts

fix(reply): derive explicit control command turns

2026-05-27 05:57:04 +01:00

commands-args.test.ts

…

commands-args.ts

…

commands-args.types.ts

…

commands-registry-list.ts

…

commands-registry-normalize.ts

…

commands-registry.data.ts

…

commands-registry.runtime-types.ts

…

commands-registry.runtime.ts

…

commands-registry.shared.ts

refactor: reuse shared coercion helpers (#86419)

2026-05-25 21:20:41 +01:00

commands-registry.test.ts

fix(telegram): preserve command slots for aliases (#85270)

2026-05-26 22:24:03 +01:00

commands-registry.ts

fix(telegram): preserve command slots for aliases (#85270)

2026-05-26 22:24:03 +01:00

commands-registry.types.ts

fix(telegram): preserve command slots for aliases (#85270)

2026-05-26 22:24:03 +01:00

commands-text-routing.ts

…

dispatch-dispatcher.ts

…

dispatch.freshness.test.ts

fix: harden qqbot direct media uploads

2026-05-28 04:21:46 +01:00

dispatch.test.ts

fix(status): add gateway delivery health telemetry (#85016)

2026-05-21 16:55:29 +00:00

dispatch.ts

fix(discord): fence tool warning fallback delivery (#87465)

2026-05-28 01:39:14 +01:00

envelope.test.ts

fix(inbound-meta): include seconds in timestamps

2026-05-27 21:18:08 +01:00

envelope.ts

fix(inbound-meta): include seconds in timestamps

2026-05-27 21:18:08 +01:00

fallback-state.test.ts

refactor: internalize OpenClaw agent runtime (#85341)

2026-05-27 19:24:04 +01:00

fallback-state.ts

refactor: internalize OpenClaw agent runtime (#85341)

2026-05-27 19:24:04 +01:00

get-reply-options.types.ts

refactor: internalize OpenClaw agent runtime (#85341)

2026-05-27 19:24:04 +01:00

group-activation.ts

…

handoff-summarizer.ts

refactor: internalize OpenClaw agent runtime (#85341)

2026-05-27 19:24:04 +01:00

heartbeat-filter.browser-import.test.ts

…

heartbeat-filter.test.ts

fix(codex): keep WebChat delivery hints out of user requests

2026-05-27 03:44:27 +01:00

heartbeat-filter.ts

fix(codex): keep WebChat delivery hints out of user requests

2026-05-27 03:44:27 +01:00

heartbeat-reply-payload.ts

…

heartbeat-tool-response.ts

refactor: reuse shared coercion helpers (#86419)

2026-05-25 21:20:41 +01:00

heartbeat.test.ts

…

heartbeat.ts

…

inbound-debounce.ts

fix(telegram): dedupe replayed message dispatches (#85208)

2026-05-21 22:14:16 -07:00

inbound.group-require-mention-test-plugins.ts

…

inbound.test.ts

fix(prompt): route untrusted group prompts outside system prompt [AI] (#87144)

2026-05-26 22:47:54 -07:00

media-note.test.ts

fix(qa-lab): stabilize mock qa-channel regressions

2026-05-17 08:50:31 +08:00

media-note.ts

fix(qa-lab): stabilize mock qa-channel regressions

2026-05-17 08:50:31 +08:00

media-understanding.test-fixtures.ts

…

model-runtime.ts

…

model.test.ts

…

model.ts

refactor: reuse shared coercion helpers (#86419)

2026-05-25 21:20:41 +01:00

reply-payload.ts

fix(discord): suppress recovered tool warnings (#87451)

2026-05-28 00:32:28 +01:00

reply.block-streaming.test.ts

test: keep slow tests under duration cap

2026-05-18 00:26:44 +01:00

reply.directive.directive-behavior.e2e-harness.ts

refactor: internalize OpenClaw agent runtime (#85341)

2026-05-27 19:24:04 +01:00

reply.directive.directive-behavior.e2e-mocks.ts

refactor: internalize OpenClaw agent runtime (#85341)

2026-05-27 19:24:04 +01:00

reply.directive.directive-behavior.prefers-alias-matches-fuzzy-selection-is-ambiguous.test.ts

…

reply.directive.directive-behavior.shows-current-verbose-level-verbose-has-no.test.ts

refactor: internalize OpenClaw agent runtime (#85341)

2026-05-27 19:24:04 +01:00

reply.directive.parse.test.ts

…

reply.media-note.test.ts

…

reply.raw-body.test.ts

fix: keep inter-session provenance out of transcripts (#83755)

2026-05-18 14:02:25 -07:00

reply.runtime.ts

…

reply.stage-sandbox-media.scp-remote-path.test.ts

…

reply.test-harness.ts

refactor: internalize OpenClaw agent runtime (#85341)

2026-05-27 19:24:04 +01:00

reply.triggers.group-intro-prompts.cases.ts

…

reply.triggers.trigger-handling.filters-usage-summary-current-model-provider.cases.ts

refactor: internalize OpenClaw agent runtime (#85341)

2026-05-27 19:24:04 +01:00

reply.triggers.trigger-handling.stages-inbound-media-into-sandbox-workspace.test.ts

…

reply.triggers.trigger-handling.targets-active-session-native-stop.e2e.test.ts

refactor: internalize OpenClaw agent runtime (#85341)

2026-05-27 19:24:04 +01:00

reply.ts

…

send-policy.ts

…

skill-commands-base.ts

…

skill-commands.runtime.ts

…

skill-commands.test.ts

chore(lint): remove underscore-dangle allow list (#83542)

2026-05-18 14:56:06 +01:00

skill-commands.ts

refactor: reuse shared coercion helpers (#86419)

2026-05-25 21:20:41 +01:00

stage-sandbox-media.test-harness.ts

…

status.runtime.ts

…

status.test.ts

refactor: internalize OpenClaw agent runtime (#85341)

2026-05-27 19:24:04 +01:00

status.tools.test.ts

…

status.ts

…

templating.ts

refactor: centralize inbound supplemental context

2026-05-27 09:26:06 +01:00

thinking.shared.ts

fix(vllm): wire configured thinking params

2026-05-27 13:32:18 +01:00

thinking.test.ts

refactor: internalize OpenClaw agent runtime (#85341)

2026-05-27 19:24:04 +01:00

thinking.ts

fix(vllm): wire configured thinking params

2026-05-27 13:32:18 +01:00

tokens.test.ts

fix(auto-reply): suppress reasoning-prefixed NO_REPLY

2026-05-27 15:09:56 +01:00

tokens.ts

fix(auto-reply): suppress reasoning-prefixed NO_REPLY

2026-05-27 15:09:56 +01:00

tool-meta.test.ts

…

tool-meta.ts

…

types.ts

…