Peter Steinberger
da0ba1b73a
fix(security): harden channel auth path checks and exec approval routing
2026-02-26 12:46:05 +01:00
Peter Steinberger
242188b7b1
refactor: unify boundary-safe reads for bootstrap and includes
2026-02-26 12:42:14 +01:00
Peter Steinberger
46003e85bf
fix: unify web tool proxy path ( #27430 ) (thanks @kevinWangSheng)
2026-02-26 11:32:43 +00:00
Peter Steinberger
9925ac6a2d
fix(config): harden include file loading path checks
2026-02-26 12:23:31 +01:00
Onur Solmaz
a7d56e3554
feat: ACP thread-bound agents ( #23580 )
...
* docs: add ACP thread-bound agents plan doc
* docs: expand ACP implementation specification
* feat(acp): route ACP sessions through core dispatch and lifecycle cleanup
* feat(acp): add /acp commands and Discord spawn gate
* ACP: add acpx runtime plugin backend
* fix(subagents): defer transient lifecycle errors before announce
* Agents: harden ACP sessions_spawn and tighten spawn guidance
* Agents: require explicit ACP target for runtime spawns
* docs: expand ACP control-plane implementation plan
* ACP: harden metadata seeding and spawn guidance
* ACP: centralize runtime control-plane manager and fail-closed dispatch
* ACP: harden runtime manager and unify spawn helpers
* Commands: route ACP sessions through ACP runtime in agent command
* ACP: require persisted metadata for runtime spawns
* Sessions: preserve ACP metadata when updating entries
* Plugins: harden ACP backend registry across loaders
* ACPX: make availability probe compatible with adapters
* E2E: add manual Discord ACP plain-language smoke script
* ACPX: preserve streamed spacing across Discord delivery
* Docs: add ACP Discord streaming strategy
* ACP: harden Discord stream buffering for thread replies
* ACP: reuse shared block reply pipeline for projector
* ACP: unify streaming config and adopt coalesceIdleMs
* Docs: add temporary ACP production hardening plan
* Docs: trim temporary ACP hardening plan goals
* Docs: gate ACP thread controls by backend capabilities
* ACP: add capability-gated runtime controls and /acp operator commands
* Docs: remove temporary ACP hardening plan
* ACP: fix spawn target validation and close cache cleanup
* ACP: harden runtime dispatch and recovery paths
* ACP: split ACP command/runtime internals and centralize policy
* ACP: harden runtime lifecycle, validation, and observability
* ACP: surface runtime and backend session IDs in thread bindings
* docs: add temp plan for binding-service migration
* ACP: migrate thread binding flows to SessionBindingService
* ACP: address review feedback and preserve prompt wording
* ACPX plugin: pin runtime dependency and prefer bundled CLI
* Discord: complete binding-service migration cleanup and restore ACP plan
* Docs: add standalone ACP agents guide
* ACP: route harness intents to thread-bound ACP sessions
* ACP: fix spawn thread routing and queue-owner stall
* ACP: harden startup reconciliation and command bypass handling
* ACP: fix dispatch bypass type narrowing
* ACP: align runtime metadata to agentSessionId
* ACP: normalize session identifier handling and labels
* ACP: mark thread banner session ids provisional until first reply
* ACP: stabilize session identity mapping and startup reconciliation
* ACP: add resolved session-id notices and cwd in thread intros
* Discord: prefix thread meta notices consistently
* Discord: unify ACP/thread meta notices with gear prefix
* Discord: split thread persona naming from meta formatting
* Extensions: bump acpx plugin dependency to 0.1.9
* Agents: gate ACP prompt guidance behind acp.enabled
* Docs: remove temp experiment plan docs
* Docs: scope streaming plan to holy grail refactor
* Docs: refactor ACP agents guide for human-first flow
* Docs/Skill: add ACP feature-flag guidance and direct acpx telephone-game flow
* Docs/Skill: add OpenCode and Pi to ACP harness lists
* Docs/Skill: align ACP harness list with current acpx registry
* Dev/Test: move ACP plain-language smoke script and mark as keep
* Docs/Skill: reorder ACP harness lists with Pi first
* ACP: split control-plane manager into core/types/utils modules
* Docs: refresh ACP thread-bound agents plan
* ACP: extract dispatch lane and split manager domains
* ACP: centralize binding context and remove reverse deps
* Infra: unify system message formatting
* ACP: centralize error boundaries and session id rendering
* ACP: enforce init concurrency cap and strict meta clear
* Tests: fix ACP dispatch binding mock typing
* Tests: fix Discord thread-binding mock drift and ACP request id
* ACP: gate slash bypass and persist cleared overrides
* ACPX: await pre-abort cancel before runTurn return
* Extension: pin acpx runtime dependency to 0.1.11
* Docs: add pinned acpx install strategy for ACP extension
* Extensions/acpx: enforce strict local pinned startup
* Extensions/acpx: tighten acp-router install guidance
* ACPX: retry runtime test temp-dir cleanup
* Extensions/acpx: require proactive ACPX repair for thread spawns
* Extensions/acpx: require restart offer after acpx reinstall
* extensions/acpx: remove workspace protocol devDependency
* extensions/acpx: bump pinned acpx to 0.1.13
* extensions/acpx: sync lockfile after dependency bump
* ACPX: make runtime spawn Windows-safe
* fix: align doctor-config-flow repair tests with default-account migration (#23580 ) (thanks @osolmaz)
2026-02-26 11:00:09 +01:00
Ayaan Zaidi
30fd2bbe19
fix(ssrf): honor global family policy for pinned dispatcher
2026-02-26 14:57:15 +05:30
Peter Steinberger
e915b4c64a
refactor: unify monitor abort lifecycle handling
2026-02-26 04:36:25 +01:00
Peter Steinberger
de61e9c977
refactor(security): unify path alias guard policies
2026-02-26 03:59:17 +01:00
Peter Steinberger
8a006a3260
feat(heartbeat): add directPolicy and restore default direct delivery
2026-02-26 03:57:03 +01:00
Peter Steinberger
1e7ec8bfd2
fix(routing): preserve explicit cron account and bound message defaults
...
Co-authored-by: lbo728 <72309817+lbo728@users.noreply.github.com >
Co-authored-by: stakeswky <64798754+stakeswky@users.noreply.github.com >
2026-02-26 02:56:03 +00:00
Peter Steinberger
92eb3dfc9d
refactor(security): unify exec approval request matching
2026-02-26 03:54:37 +01:00
Peter Steinberger
61b3246a7f
fix(ssrf): unify ipv6 special-use blocking
2026-02-26 03:43:42 +01:00
Peter Steinberger
04d91d0319
fix(security): block workspace hardlink alias escapes
2026-02-26 03:42:54 +01:00
Peter Steinberger
03e689fc89
fix(security): bind system.run approvals to argv identity
2026-02-26 03:41:31 +01:00
Peter Steinberger
baf656bc6f
fix: block IPv6 multicast SSRF bypass
2026-02-26 03:35:10 +01:00
Peter Steinberger
1f004e6640
refactor(tmp): simplify trusted tmp dir state checks
2026-02-26 02:46:53 +01:00
Peter Steinberger
aaeed3c4ea
test(agents): add missing announce delivery regressions
2026-02-26 00:38:34 +00:00
Peter Steinberger
4258a3307f
refactor(agents): unify subagent announce delivery pipeline
...
Co-authored-by: Smith Labs <SmithLabsLLC@users.noreply.github.com >
Co-authored-by: Do Cao Hieu <docaohieu2808@users.noreply.github.com >
2026-02-26 00:30:44 +00:00
Peter Steinberger
f41715a18f
refactor(browser): split act route modules and dedupe path guards
2026-02-26 01:21:34 +01:00
Peter Steinberger
496a76c03b
fix(security): harden browser trace/download temp path handling
2026-02-26 01:04:05 +01:00
Peter Steinberger
2011edc9e5
fix(gateway): preserve agentId through gateway send path
...
Landed from #23249 by @Sid-Qin.
Includes extra regression tests for agentId precedence + blank fallback.
Co-authored-by: Sid <201593046+Sid-Qin@users.noreply.github.com >
2026-02-25 23:31:35 +00:00
Peter Steinberger
45b5c35b21
test: fix CI failures in heartbeat and typing tests
2026-02-25 02:28:42 +00:00
Peter Steinberger
24d7612ddf
refactor(heartbeat): harden dm delivery classification
2026-02-25 02:13:07 +00:00
Peter Steinberger
885452f5c1
fix: fail-closed shared-session reply routing ( #24571 ) (thanks @brandonwise)
2026-02-25 02:11:34 +00:00
Peter Steinberger
a805d6b439
fix(heartbeat): block dm targets and internalize blocked prompts
2026-02-25 02:05:45 +00:00
Brandon Wise
389ccda0f6
fix: remove unused DeliverableMessageChannel import
2026-02-25 01:41:31 +00:00
Brandon Wise
f35c902bd6
style: fix oxfmt formatting in targets.test.ts
2026-02-25 01:41:31 +00:00
Brandon Wise
455fbc6b6d
fix(security): prevent cross-channel reply routing in shared sessions
2026-02-25 01:41:31 +00:00
Peter Steinberger
e2362d352d
fix(heartbeat): default target none and internalize relay prompts
2026-02-25 01:28:47 +00:00
Peter Steinberger
2157c490af
test: normalize tmp media path assertion for windows
2026-02-25 00:58:17 +00:00
Peter Steinberger
5c6b2cbc8e
refactor: extract iMessage echo cache and unify suppression guards
2026-02-25 00:53:39 +00:00
Peter Steinberger
2a11c09a8d
fix: harden iMessage echo dedupe and reasoning suppression ( #25897 )
2026-02-25 00:46:56 +00:00
Peter Steinberger
a9ce6bd79b
refactor: dedupe exec wrapper denial plan and test setup
2026-02-25 00:43:29 +00:00
Peter Steinberger
943b8f171a
fix: align windows safe-open file identity checks
2026-02-25 00:42:04 +00:00
shenghui kevin
7455ceecf8
fix(windows): skip unreliable dev comparison in fs-safe openVerifiedLocalFile
...
On Windows, device IDs (dev) returned by handle.stat() and fs.lstat()
may differ even for the same file, causing false-positive 'path-mismatch'
errors when reading local media files.
This fix introduces a statsMatch() helper that:
- Always compares inode (ino) values
- Skips device ID (dev) comparison on Windows where it's unreliable
- Maintains full comparison on Unix platforms
Fixes #25699
2026-02-25 00:42:04 +00:00
Peter Steinberger
3c95f89662
refactor(exec): split system.run phases and align ts/swift validator contracts
2026-02-25 00:35:06 +00:00
Peter Steinberger
57c9a18180
fix(security): block env depth-overflow approval bypass
2026-02-25 00:14:13 +00:00
Peter Steinberger
def993dbd8
refactor(tmp): harden temp boundary guardrails
2026-02-24 23:51:10 +00:00
Peter Steinberger
316fad13aa
refactor(outbound): unify attachment hydration flow
2026-02-24 23:48:43 +00:00
Peter Steinberger
4355e08262
refactor: harden safe-bin trusted dir diagnostics
2026-02-24 23:29:44 +00:00
Peter Steinberger
5c2a483375
refactor(outbound): centralize attachment media policy
2026-02-24 23:29:05 +00:00
Peter Steinberger
9b53102100
test: add routing/session isolation edge-case regressions
2026-02-24 23:28:58 +00:00
Peter Steinberger
ccbeb332e0
fix: harden routing/session isolation for followups and heartbeat
2026-02-24 23:20:27 +00:00
Peter Steinberger
270ab03e37
fix: enforce local media root checks for attachment hydration
2026-02-24 23:17:48 +00:00
Peter Steinberger
b67e600bff
fix(security): restrict default safe-bin trusted dirs
2026-02-24 23:13:37 +00:00
Peter Steinberger
d3da67c7a9
fix(security): lock sandbox tmp media paths to openclaw roots
2026-02-24 23:10:19 +00:00
Peter Steinberger
0f0a680d3d
fix(exec): block shell-wrapper positional argv approval smuggling
2026-02-24 15:17:03 +00:00
Peter Steinberger
d18ae2256f
refactor: unify channel plugin resolution, family ordering, and changelog entry tooling
2026-02-24 15:15:22 +00:00
Glucksberg
dd9ba974d0
fix: sort IPv4 addresses before IPv6 in SSRF pinned DNS to fix Telegram media fetch on IPv6-broken hosts
...
On hosts where IPv6 is configured but not routed (common on cloud VMs),
Telegram media downloads fail because the pinned DNS lookup may return
IPv6 addresses first. Even though autoSelectFamily (Happy Eyeballs) is
enabled, the round-robin pinned lookup serves individual IPv6 addresses
that fail before IPv4 is attempted.
Sort resolved addresses so IPv4 comes first, ensuring both Happy Eyeballs
and single-address round-robin try the working address family first.
Fixes #23975
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-24 14:53:01 +00:00
Peter Steinberger
07f653ffc8
fix: polish bare wildcard allowlist handling ( #25250 ) (thanks @widingmarcus-cyber)
2026-02-24 14:20:11 +00:00
