Coy Geek 647d929c9d fix: Unauthenticated Nostr profile API allows remote config tampering (#13719) ...

* fix(an-07): apply security fix

Generated by staged fix workflow.

* fix(an-07): apply security fix

Generated by staged fix workflow.

* fix(an-07): satisfy lint in plugin auth regression test

Replace unsafe unknown-to-string coercion in the gateway plugin auth test helper with explicit string/null/JSON handling so pnpm check passes.

2026-02-12 07:55:22 -06:00

..

acp

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

agents

feat(provider): Z.AI endpoints + model catalog (#13456) (thanks @tomsun28) (#13456)

2026-02-12 07:01:48 -06:00

auto-reply

fix(tests): update thread ID handling in Slack message collection tests (#14108)

2026-02-12 00:13:15 -06:00

browser

fix: prevent act:evaluate hangs from getting browser tool stuck/killed (#13498)

2026-02-11 07:54:48 +08:00

canvas-host

fix: use STATE_DIR instead of hardcoded ~/.openclaw for identity and canvas (#4824)

2026-02-07 22:16:59 -05:00

channels

feat: IRC — add first-class channel support

2026-02-10 17:33:57 -06:00

cli

fix(gateway): drain active turns before restart to prevent message loss (#13931)

2026-02-12 07:55:19 -06:00

commands

fix: prevent undefined token in gateway auth config (#13809)

2026-02-12 07:45:38 -06:00

compat

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

config

fix: exclude maxTokens from config redaction + honor deleteAfterRun on skipped cron jobs (#13342)

2026-02-12 07:55:05 -06:00

cron

fix: exclude maxTokens from config redaction + honor deleteAfterRun on skipped cron jobs (#13342)

2026-02-12 07:55:05 -06:00

daemon

fix(runtime): bump minimum Node.js version to 22.12.0 (#5370)

2026-02-05 13:42:52 -08:00

discord

fix(discord): use partial mock for @buape/carbon in slash test

2026-02-11 13:10:37 -06:00

docs

Docs: landing page revamp (#8885)

2026-02-04 10:37:14 -05:00

gateway

fix: Unauthenticated Nostr profile API allows remote config tampering (#13719)

2026-02-12 07:55:22 -06:00

hooks

fix(plugins): ignore install scripts during plugin/hook install

2026-02-11 12:04:30 +01:00

imessage

fix(auto-reply): prevent sender spoofing in group prompts

2026-02-10 00:44:38 -06:00

infra

fix(whatsapp): allow media-only sends and normalize leading blank payloads (#14408)

2026-02-11 23:21:21 -06:00

line

fix(auto-reply): prevent sender spoofing in group prompts

2026-02-10 00:44:38 -06:00

link-understanding

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

logging

fix(gateway): handle async EPIPE on stdout/stderr during shutdown (#13414)

2026-02-12 07:45:36 -06:00

macos

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

markdown

feat(telegram): render blockquotes as native <blockquote> tags (#14608) (#14626)

2026-02-12 08:11:57 -05:00

media

fix(media): strip MEDIA: lines with local paths instead of leaking as text (#14399)

2026-02-12 07:45:22 -06:00

media-understanding

refactor: consolidate fetchWithTimeout into shared utility

2026-02-09 20:34:56 -08:00

memory

(fix): handle Cloudflare 521 and transient 5xx errors gracefully (#13500)

2026-02-11 21:42:33 -06:00

node-host

fix: prevent act:evaluate hangs from getting browser tool stuck/killed (#13498)

2026-02-11 07:54:48 +08:00

pairing

fix(pairing): use actual code in pairing approval text

2026-02-10 19:48:02 -05:00

plugin-sdk

Update contributing, deduplicate more functions

2026-02-09 19:21:33 -08:00

plugins

fix(plugins): ignore install scripts during plugin/hook install

2026-02-11 12:04:30 +01:00

process

fix(gateway): drain active turns before restart to prevent message loss (#13931)

2026-02-12 07:55:19 -06:00

providers

chore: Fix failing test.

2026-02-09 09:58:58 +09:00

routing

refactor: unify peer kind to ChatType, rename dm to direct (#11881)

2026-02-09 09:20:52 +09:00

scripts

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

security

refactor(security,config): split oversized files (#13182)

2026-02-09 22:22:29 -08:00

sessions

fix: unify session maintenance and cron run pruning (#13083)

2026-02-09 20:42:35 -08:00

shared/text

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

signal

fix(auto-reply): prevent sender spoofing in group prompts

2026-02-10 00:44:38 -06:00

slack

fix(slack): change default replyToMode from "off" to "all" (#14364)

2026-02-12 00:13:07 -06:00

telegram

feat(telegram): render blockquotes as native <blockquote> tags (#14608) (#14626)

2026-02-12 08:11:57 -05:00

terminal

fix: error handling in restore failure reporting

2026-02-03 06:22:51 +00:00

test-helpers

fix: use STATE_DIR instead of hardcoded ~/.openclaw for identity and canvas (#4824)

2026-02-07 22:16:59 -05:00

test-utils

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

tts

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

tui

Centralize date/time formatting utilities (#11831)

2026-02-08 04:53:31 -08:00

types

fix: update pi packages to 0.51.0, remove bogus type augmentation

2026-02-02 01:52:33 +01:00

utils

refactor: consolidate fetchWithTimeout into shared utility

2026-02-09 20:34:56 -08:00

web

fix: default MIME type for WhatsApp voice messages when Baileys omits it (#14444)

2026-02-11 23:09:09 -06:00

whatsapp

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

wizard

feat(onboard): add custom/local API configuration flow (#11106)

2026-02-10 07:31:02 -05:00

channel-web.barrel.test.ts

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

channel-web.ts

…

docker-setup.test.ts

test(docker): make bash 3.2 compatibility check portable

2026-02-10 18:04:48 -05:00

entry.ts

Centralize date/time formatting utilities (#11831)

2026-02-08 04:53:31 -08:00

extensionAPI.ts

chore: Migrate to tsdown, speed up JS bundling by ~10x (thanks @hyf0).

2026-02-03 20:18:16 +09:00

globals.test.ts

…

globals.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

index.test.ts

…

index.ts

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

logger.test.ts

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

logger.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

logging.ts

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

polls.test.ts

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

polls.ts

…

runtime.ts

CLI: restore terminal state on exit

2026-02-03 06:10:19 +00:00

utils.test.ts

fix(paths): structurally resolve home dir to prevent Windows path bugs (#12125)

2026-02-08 20:06:29 -05:00

utils.ts

Deduplicate more

2026-02-09 18:56:58 -08:00

version.test.ts

fix: CLI harden update restart imports and fix nested bundle version resolution

2026-02-06 00:09:48 -05:00

version.ts

fix: CLI harden update restart imports and fix nested bundle version resolution

2026-02-06 00:09:48 -05:00