openclaw

acp

feat: ACP thread-bound agents (#23580 )

2026-02-26 11:00:09 +01:00

agents

refactor(exec-approvals): unify system.run binding and generate host env policy

2026-02-26 16:58:01 +01:00

auto-reply

fix: harden typing lifecycle and cross-channel suppression

2026-02-26 17:01:09 +01:00

browser

fix(browser): land PR #27617 relay reconnect resilience

2026-02-26 15:08:55 +00:00

canvas-host

…

channels

fix: harden typing lifecycle and cross-channel suppression

2026-02-26 17:01:09 +01:00

cli

docs(secrets): clarify partial migration guidance

2026-02-26 14:47:22 +00:00

commands

fix: set authHeader: true by default for MiniMax API provider (#27622 )

2026-02-26 15:53:51 +00:00

compat

…

config

fix(secrets): harden apply and audit plan handling

2026-02-26 14:47:22 +00:00

cron

refactor(reply): split abort cutoff and timeout policy modules

2026-02-26 14:00:35 +01:00

daemon

fix(gateway): add ThrottleInterval to launchd plist to prevent restart loop

2026-02-26 15:31:04 +00:00

discord

fix(security): bind node system.run approvals to env

2026-02-26 16:38:07 +01:00

docs

…

gateway

fix: harden plugin route auth path canonicalization

2026-02-26 17:02:06 +01:00

hooks

refactor: unify boundary hardening for file reads

2026-02-26 13:04:37 +01:00

imessage

fix(security): centralize dm/group allowlist auth composition

2026-02-26 16:35:33 +01:00

infra

refactor(exec-approvals): unify system.run binding and generate host env policy

2026-02-26 16:58:01 +01:00

line

fix(security): keep DM pairing allowlists out of group auth

2026-02-26 12:58:18 +01:00

link-understanding

…

logging

fix(security): harden regex compilation for filters and redaction

2026-02-23 23:54:50 +00:00

markdown

fix(markdown): require paired || delimiters for spoiler detection (#26105 )

2026-02-25 04:54:51 +00:00

media

refactor(tmp): harden temp boundary guardrails

2026-02-24 23:51:10 +00:00

media-understanding

fix(security): lock sandbox tmp media paths to openclaw roots

2026-02-24 23:10:19 +00:00

memory

refactor: deduplicate shared helpers and test setup

2026-02-23 20:40:44 +00:00

node-host

fix(security): harden approval-bound node exec cwd handling

2026-02-26 04:14:11 +01:00

pairing

pairing: enforce strict account-scoped state

2026-02-26 00:31:24 -05:00

plugin-sdk

refactor: unify channel/plugin ssrf fetch policy and auth fallback

2026-02-26 16:44:13 +01:00

plugins

fix(plugins): fallback bundled channel specs when npm install returns 404 (#12849 )

2026-02-26 08:06:54 -05:00

process

fix(secrets): harden sops migration sops rule matching

2026-02-26 14:47:22 +00:00

providers

Config: expand Kilo catalog and persist selected Kilo models (#24921 )

2026-02-23 21:17:37 -05:00

routing

fix(core): unify session-key normalization and plugin boundary checks

2026-02-26 12:41:23 +00:00

scripts

…

secrets

fix: stabilize secrets land + docs note (#26155 ) (thanks @joshavant)

2026-02-26 14:47:22 +00:00

security

fix(security): centralize dm/group allowlist auth composition

2026-02-26 16:35:33 +01:00

sessions

fix(core): unify session-key normalization and plugin boundary checks

2026-02-26 12:41:23 +00:00

shared

fix(ssrf): unify ipv6 special-use blocking

2026-02-26 03:43:42 +01:00

signal

refactor: unify reaction ingress policy guards across channels

2026-02-26 01:34:47 +01:00

slack

fix(slack): suppress NO_REPLY before Slack API call

2026-02-26 13:40:58 +00:00

fix: set authHeader: true by default for MiniMax API provider (#27622 )

2026-02-26 15:53:51 +00:00

terminal

…

test-helpers

refactor: dedupe media and request-body test scaffolding

2026-02-22 18:37:25 +00:00

test-utils

test: dedupe fixtures and test harness setup

2026-02-23 05:45:54 +00:00

tts

…

tui

test: fix post-merge config and tui command-handler tests

2026-02-24 04:38:21 +00:00

types

…

utils

feat(secrets): finalize external secrets runtime and migration hardening

2026-02-26 14:47:22 +00:00

web

fix: suppress reasoning payload leakage in whatsapp replies

2026-02-25 01:36:37 +00:00

WhatsApp: enforce allowFrom for explicit outbound sends (#20921 )

2026-02-22 18:13:23 -05:00

wizard

feat(secrets): expand onboarding secret-ref flows and custom-provider parity

2026-02-26 14:47:22 +00:00

channel-web.ts

…

docker-image-digests.test.ts

…

docker-setup.test.ts

fix: harden Docker/GCP onboarding flow (#26253 ) (thanks @pandego)

2026-02-26 04:46:18 +00:00

dockerfile.test.ts

fix: harden Docker/GCP onboarding flow (#26253 ) (thanks @pandego)

2026-02-26 04:46:18 +00:00

entry.ts

fix(secrets): make apply idempotent and keep audit read-only

2026-02-26 14:47:22 +00:00

extensionAPI.ts

…

globals.ts

…

index.ts

…

logger.test.ts

…

logger.ts

…

logging.ts

…

polls.test.ts

…

polls.ts

…

runtime.ts

…

utils.test.ts

…

utils.ts

…

version.test.ts

…

version.ts

…