cpojer
15792b153f
chore: Enable more lint rules, disable some that trigger a lot. Will clean up later.
2026-01-31 16:04:04 +09:00
Peter Steinberger
9a7160786a
refactor: rename to openclaw
2026-01-30 03:16:21 +01:00
Ayaan Zaidi
b6a3a91edf
fix: wire per-account dm scope guidance ( #3095 ) (thanks @jarvis-sam)
2026-01-28 11:42:33 +05:30
Peter Steinberger
6d16a658e5
refactor: rename clawdbot to moltbot with legacy compat
2026-01-27 12:21:02 +00:00
Gustavo Madeira Santana
c2a4863b15
Build: stop tracking bundled artifacts ( #2455 ) (thanks @0oAstro)
...
Co-authored-by: 0oAstro <0oAstro@users.noreply.github.com >
2026-01-26 23:08:25 -05:00
Peter Steinberger
e7fdccce39
refactor: route browser control via gateway/node
2026-01-27 03:24:54 +00:00
vignesh07
343882d45c
feat(telegram): add edit message action ( #2394 ) (thanks @marcelomar21)
2026-01-26 15:34:47 -08:00
Peter Steinberger
ab73aceb27
fix: use Windows ACLs for security audit
2026-01-26 18:19:58 +00:00
Peter Steinberger
e6bdffe568
feat: add control ui device auth bypass
2026-01-26 17:40:28 +00:00
Peter Steinberger
c4a80f4edb
fix: require gateway auth by default
2026-01-26 12:56:33 +00:00
Peter Steinberger
885167dd58
fix: tighten security audit for loopback auth
2026-01-25 15:16:40 +00:00
Jamieson O'Reilly
6aec34bc60
fix(gateway): prevent auth bypass when behind unconfigured reverse proxy ( #1795 )
...
* fix(gateway): prevent auth bypass when behind unconfigured reverse proxy
When proxy headers (X-Forwarded-For, X-Real-IP) are present but
gateway.trustedProxies is not configured, the gateway now treats
connections as non-local. This prevents a scenario where all proxied
requests appear to come from localhost and receive automatic trust.
Previously, running behind nginx/Caddy without configuring trustedProxies
would cause isLocalClient=true for all external connections, potentially
bypassing authentication and auto-approving device pairing.
The gateway now logs a warning when this condition is detected, guiding
operators to configure trustedProxies for proper client IP detection.
Also adds documentation for reverse proxy security configuration.
* fix: harden reverse proxy auth (#1795 ) (thanks @orlyjamie)
---------
Co-authored-by: orlyjamie <orlyjamie@users.noreply.github.com >
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-01-25 15:08:03 +00:00
Peter Steinberger
f76e3c1419
fix: enforce secure control ui auth
2026-01-21 23:58:42 +00:00
Peter Steinberger
51dfd6efdb
fix: tighten small-model audit guardrails
2026-01-20 23:52:26 +00:00
Peter Steinberger
6d5195c890
refactor: normalize cli command hints
2026-01-20 07:43:00 +00:00
Peter Steinberger
c7ea47e886
feat(channels): add resolve command + defaults
2026-01-18 01:00:24 +00:00
Peter Steinberger
7cebe7a506
style: run oxfmt
2026-01-17 08:00:05 +00:00
Peter Steinberger
6a3ed5c850
fix(security): gate slash/control commands
2026-01-17 06:49:34 +00:00
Peter Steinberger
e59d8c5436
style: oxfmt format
2026-01-17 05:48:56 +00:00
Peter Steinberger
a624878973
fix(security): gate slash commands by sender
2026-01-17 05:25:42 +00:00
Ivan Pereira
be9aa5494a
fix(security): resolve local auth for gateway probe
2026-01-16 13:19:55 +00:00
Ubuntu
ca9688b5cc
feat(session): add dmScope for multi-user DM isolation
...
Co-authored-by: Alphonse-arianee <Alphonse-arianee@users.noreply.github.com >
2026-01-16 04:13:10 +00:00
Peter Steinberger
ca1902fb4e
feat(security): expand audit and safe --fix
2026-01-15 05:31:43 +00:00
Peter Steinberger
139f80a291
chore: format sources and update protocol outputs
2026-01-15 05:17:19 +00:00
Peter Steinberger
ef78b198cb
feat: add Chrome extension browser relay
2026-01-15 04:52:28 +00:00
Peter Steinberger
edd8c613d6
feat(security): add audit --fix
2026-01-15 04:50:06 +00:00
Peter Steinberger
1b79730db8
style: apply oxfmt fixes
2026-01-15 01:53:14 +00:00
Peter Steinberger
c2a4f256c8
feat: add security audit + onboarding checkpoint
2026-01-15 01:25:11 +00:00
