openclaw

mirror of https://github.com/openclaw/openclaw.git synced 2026-08-02 13:51:33 +00:00

Files

Peter Steinberger ea967be0df feat(gateway): add loopback locality controls (#115959 )

* feat(gateway): add loopback locality controls

* fix(gateway): keep loopback auth delays enforced under concurrency

The pending-timer cap let an attacker park cheap failures in every slot and then guess without penalty. Delays now key off a per-key deadline, so parallel guesses wait out the same escalating penalty and are still bounded by the max delay.

* fix(gateway): share one loopback penalty timer per key

Concurrent failures on a key now share a single timer and deadline instead of allocating one per in-flight request. Also corrects the security doc: the delay raises the cost of repeated guessing from one source, but credentials are compared before the failure response is delayed, so it is not a defense against parallel fan-out.

* docs(gateway): record why loopback delay stays post-verification

* docs: refresh generated docs map

* docs: refresh plugin SDK API baseline

* test: update loopback locality CI expectations

2026-07-29 12:25:57 -04:00

audit-checks.md

docs: retire config keys that strict validation rejects (#113956 )

2026-07-25 18:24:02 -07:00

dependency-locking.md

build(deps): remove npm shrinkwrap; mirror pnpm lock into transient package locks (#114006 )

2026-07-26 01:29:55 -04:00

exposure-runbook.md

docs: rewrite published docs grounded in current source (#100142 )

2026-07-05 00:32:47 -04:00

index.md

feat(gateway): add loopback locality controls (#115959 )