ewilliams28/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-08-12 21:53:00 -06:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): harden network tool output at canonical owner boundaries (#118984)

Browse Source 
* fix(security): bound external tool content at its canonical owner boundary

* fix(plugin-sdk): document supported security boundary and restore facade parity
This commit is contained in:
Peter Steinberger
2026-08-03 15:34:33 -07:00
committed by GitHub
parent 3d65ea2a1b
commit c83dcc2bc0
51 changed files with 3109 additions and 223 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/plugin-sdk-surface-report.mjs
+4 -2
View File
@@ -218,7 +218,8 @@ export function readPluginSdkSurfaceBudgets(env = process.env) {
// +1: shared inbound-event delivery correlation factory for channel plugins.
// +1: canonical webhook route identity for plugin-owned target registries.
// +3: canonical ready, blocked, and stopped channel lifecycle patch factories.
4829,
// +1: bounded external-content sanitizer for plugin-owned untrusted projections.
4830,
env,
),
publicFunctionExports: readPluginSdkSurfaceBudgetEnv(
@@ -264,7 +265,8 @@ export function readPluginSdkSurfaceBudgets(env = process.env) {
// +1: shared inbound-event delivery correlation factory for channel plugins.
// +1: canonical webhook route identity for plugin-owned target registries.
// +3: canonical ready, blocked, and stopped channel lifecycle patch factories.
2906,
// +1: bounded external-content sanitizer for plugin-owned untrusted projections.
2907,
env,
),
publicDeprecatedExports: readPluginSdkSurfaceBudgetEnv(