* fix(ollama): bound model-discovery JSON response reads
The /api/tags and /api/show discovery reads in extensions/ollama/src/provider-models.ts
parsed their HTTP responses with an unbounded await response.json(). Ollama base URLs
are user-supplied and can point at remote/cloud endpoints, so a hostile or buggy server
(or one reachable via SSRF) could stream an unbounded or never-ending JSON body and drive
model discovery into OOM.
Route both reads through the shared @openclaw/media-core byte-bounded reader
(readResponseWithLimit, re-exported via openclaw/plugin-sdk/response-limit-runtime) under
a single 16 MiB cap before JSON.parse, cancelling the stream on overflow. Overflow throws a
bounded error that the existing fail-soft handlers swallow, so a capped endpoint degrades
gracefully: /api/tags returns { reachable: false, models: [] } and /api/show returns {}.
Symmetric counterpart to the #95103/#95108 response-limit campaign.
AI-assisted.
* fix(ollama): reuse shared bounded JSON reader for model discovery
Replace the local readOllamaDiscoveryJson helper with the shared
readProviderJsonResponse (from openclaw/plugin-sdk/provider-http), which
already enforces the 16 MiB cap, cancels the stream on overflow, and wraps
malformed JSON with the caller label. The /api/tags and /api/show discovery
reads now go through it directly while keeping the existing fail-soft
handlers ({ reachable: false, models: [] } and {}).
Add a focused regression test: when a discovery stream exceeds the JSON byte
cap, fetchOllamaModels returns { reachable: false, models: [] },
queryOllamaModelShowInfo returns {}, and the bounded reader cancels the body
mid-flight so less than the full advertised stream is read.
(cherry picked from commit d1c2934d0d)
Exa search success responses were read via an unbounded `await
response.json()`, so a misbehaving or hostile endpoint could stream an
arbitrarily large body into memory before parsing. Read the success
body through the shared bounded reader (16 MiB cap, the same limit other
bundled providers use) and cancel the stream on overflow. This mirrors
the error-body bound already in place and the #95103/#95108 response
-limit campaign on the success-JSON side.
AI-assisted.
(cherry picked from commit 605aede38c)
* fix(parallel): bound successful web-search JSON response reads
The Parallel web_search provider parsed its /v1/search success body with an
unbounded await res.json(). The body comes from an external web-search
upstream, so a hostile or malfunctioning endpoint streaming an unbounded JSON
payload could force the runtime to buffer the whole response before parsing,
creating memory pressure or a hang on the provider path.
Read the success body through the shared readProviderJsonResponse helper with a
16 MiB cap (matching the provider JSON cap from #95218); on overflow the stream
is cancelled and a bounded error is thrown. The error-body path was already
bounded (readResponseTextLimited, 8 KiB). Symmetric follow-up to the
#95103/#95108 response-limit campaign.
* docs(parallel): drop upstream PR ref from response-cap comment
Replace the PR-specific '#95218' annotation with a neutral description of
the shared provider JSON cap so the comment stays accurate independent of
upstream PR numbering.
(cherry picked from commit 6163b1977b)
The /api/v1/models/load success path read the response with an unbounded
await response.json(), so a misbehaving or compromised LM Studio server
could stream an arbitrarily large JSON body that is fully buffered into
memory before any size check. Read it through the shared byte-capped
readProviderJsonResponse helper instead (16 MiB provider-JSON cap, cancels
the stream on overflow, wraps malformed JSON), matching the discovery path
and the already-bounded error body.
Migrate the model fetch/load test mocks to real Response objects (the
bounded readers need a real body stream) and add a regression test that
streams an oversized success body and asserts a bounded error plus stream
cancellation.
Label: security
(cherry picked from commit 7844b08445)
* fix(wiki): discover nested source files in QUERY_DIRS
Two functions in the memory-wiki extension — listWikiMarkdownFiles
(wiki_get runtime lookup) and collectMarkdownFiles (wiki compile
indexing) — used fs.readdir without { recursive: true }. Nested
source files (e.g. sources/audi/car.md) were silently invisible to
both wiki_get and wiki compile.
Add recursive: true and adjust path construction using
entry.parentPath so nested .md files in all QUERY_DIRS are
discovered while preserving the index.md exclusion and backward
compatibility with flat vaults.
* fix(wiki): remove entry.path fallback, only parentPath is typed on Dirent
* fix(wiki): add recursive scan to status.ts and add nested-file regression tests
* fix(wiki): use toSorted instead of sort to pass lint
* style(memory-wiki): format recursive discovery fix
---------
Co-authored-by: Vincent Koc <25068+vincentkoc@users.noreply.github.com>
(cherry picked from commit 63ee4cd240)
* fix: gate diagnostics command to owners
(cherry picked from commit 170bf72e64)
* fix(agent): replace self-wait with deferred release in retained-lock abort cleanup (#96100)
* fix(agent): wait for retained session write before releasing held lock on abort
* fix(agent): replace self-wait with deferred release in retained-lock abort cleanup
* fix(test): reject fallback acquire with SessionWriteLockTimeoutError in active-scope cleanup test
* fix(agent): trim retained-lock comments
Signed-off-by: sallyom <somalley@redhat.com>
---------
Signed-off-by: sallyom <somalley@redhat.com>
Co-authored-by: sallyom <somalley@redhat.com>
(cherry picked from commit 0a042f68df)
* fix(gateway): resume channel after pending task recovery
(cherry picked from commit 6039da3ed6)
* fix(gateway): resume channel after pending task recovery
(cherry picked from commit ecd29fe572)
* fix(outbound): ignore empty delivery receipts (#79811)
(cherry picked from commit 9a735bea03)
* fix(agents): guard delivery-evidence attachment recursion against cycles (#97041)
* fix(agents): guard delivery-evidence attachment recursion against cycles
* fix(agents): guard delivery-evidence attachment recursion against cycles
* fix(agents): guard delivery-evidence attachment recursion against cycles
---------
Co-authored-by: Pick-cat <266665499+Pick-cat@users.noreply.github.com>
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
(cherry picked from commit 498567190d)
* fix(opencode-go): re-arm idle timer on block-boundary events to prevent false stalled-stream abort (#97128)
* fix(opencode-go): re-arm idle timer on block-boundary events to prevent false stalled-stream abort
When the opencode-go model finalizes a tool call and deliberates before
the next one, the provider emits real block-boundary SSE events
(text_end, thinking_end, toolcall_start, toolcall_end) that prove the
socket is alive, but the watchdog's isProviderProgressEvent only
returned true for token deltas (text_delta, thinking_delta,
toolcall_delta). This caused the idle timer to fire and falsely abort a
live stream, replacing a completed answer with a stalled error and
dropping the provider's real done event.
Fix: include block-boundary events in isProviderProgressEvent so the
idle timer is re-armed on any forward-progress provider event.
text_start and thinking_start are intentionally excluded because they
are synthetic preamble events that should not shorten the first-event
window.
Closes#96518
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* test(opencode-go): satisfy lint in stream regression
* test(opencode-go): satisfy lint in stream regression
* test(opencode-go): satisfy lint in stream regression
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
(cherry picked from commit 552ec2b49d)
* fix(model-fallback): don't rethrow provider-side AbortErrors as user cancellations (#90908)
* fix(model-fallback): don't rethrow provider-side AbortErrors as user cancellations
When the LLM API closes the connection mid-stream, the fetch layer
surfaces AbortError("This operation was aborted") with no external
abort signal triggered. The old guard `shouldRethrowAbort()` returned
false for these errors (because isTimeoutError matched the message),
so they fell through to the fallback loop but were never retried —
the error propagated up and produced SILENT_REPLY_TOKEN in group
sessions, permanently silencing the topic.
Replace the guard with a direct check: only rethrow AbortError when
the external abort signal is actually set (user/gateway cancellation).
Provider-side AbortErrors without an external signal now fall through
to the next fallback candidate, giving the system a chance to recover.
* fix(cron): forward abort signal into runWithModelFallback
Thread the cron executor's abort signal into the shared
runWithModelFallback call so that cron timeouts and cancellations
stop the fallback chain instead of retrying with the next candidate.
Previously, the run callback checked params.abortSignal?.aborted and
threw, but runWithModelFallback itself had no signal — so the new
guard in model-fallback.ts could not distinguish a caller abort from
a provider-side AbortError and would retry silently.
Also adds a focused regression test verifying the signal is forwarded.
---------
Co-authored-by: Shengting Xie <shengting@openclaw.ai>
Co-authored-by: yayu <yayu@yayuMacStudio.local>
(cherry picked from commit 98ed83f848)
* fix(browser): block node routes when sandbox host control is disabled (#97958)
(cherry picked from commit 2cf765f732)
* fix(exec): bind Windows allowlist execution path (#98260)
* fix(exec): bind windows allowlist execution path
* fix(exec): add windows shadow execution proof
* fix(exec): preserve wildcard allowlist behavior
* fix(exec): correct blocked plan test fixture
(cherry picked from commit 3811001d27)
* fix(mcp): suppress unhandled error on stderr pipe in stdio transport (#99803)
* fix(mcp): suppress unhandled error on stderr pipe in stdio transport
When child.stderr is piped to stderrStream without an error
handler, a stream-level error (EPIPE, I/O failure) crashes the
process. Add a noop error handler before the pipe, consistent
with the error handlers already present on stdin and stdout.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(mcp): add regression test for stderr pipe error suppression
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(mcp): report stderr stream errors
* fix(mcp): report stderr stream errors
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
(cherry picked from commit 1b84316a91)
* Harden macOS SQLite WAL checkpoints (#99067)
(cherry picked from commit f7f1be276a)
* fix(secrets): suppress unhandled stdout/stderr stream errors in exec resolver (#100521)
* fix(secrets): suppress unhandled stdout/stderr stream errors in exec resolver
* proof(secrets): add real behavior proof script for exec resolver stream error catch
* proof(secrets): replace wrapper with real exec resolver stream error proof
* style: apply oxfmt to changed files
(cherry picked from commit c9a0783922)
* fix(agents): retry transient filesystem races when reading workspace bootstrap files (#100910)
* fix(agents): retry transient filesystem races when reading workspace bootstrap files
* fix(agents): retry transient boundary resolution
---------
Co-authored-by: Vincent Koc <25068+vincentkoc@users.noreply.github.com>
(cherry picked from commit f36d170bc6)
* fix(gateway): finish plugin HTTP responses after post-header failures (#102125)
* fix(gateway): finish plugin HTTP responses after post-header failures
* test(gateway): satisfy plugin HTTP regression lint
* fix(gateway): skip ending destroyed plugin responses
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
(cherry picked from commit 240d350c7f)
* fix(gateway): validate exact custom browser origins (#38290)
Co-authored-by: Peter Steinberger <steipete@gmail.com>
(cherry picked from commit fa0349aa44)
* fix: block unspecified trusted DNS targets (#103075)
(cherry picked from commit c70f3d0dae)
* fix(channels): make nack callbacks idempotent (#104919)
* fix(channels): make nack callbacks idempotent
* fix(channels): coalesce overlapping nack callbacks
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
(cherry picked from commit 02d307e1b8)
* fix(channels): prevent base URL credentials in status output (#107754)
* fix(channels): redact credentials in account URLs
* fix(channels): sanitize final status summaries
(cherry picked from commit 210340fe93)
* fix(channels): prevent lifecycle listener buildup (#109108)
(cherry picked from commit 0e1fad711c)
* fix(sandbox): use Buffer.byteLength for env var value size limit (#105017)
* fix(sandbox): use Buffer.byteLength for env var value size limit
validateEnvVarValue checked value.length (UTF-16 code units) against
the 32768-byte limit, so multi-byte CJK values like "值".repeat(11000)
passed the check despite exceeding 33 KB in UTF-8. Switch to
Buffer.byteLength(value, "utf8") so the limit matches the actual byte
count the OS and child processes see.
* test(sandbox): simplify env byte-limit coverage
Co-authored-by: 唐梓夷0668001293 <tang.ziyi@xydigit.com>
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
(cherry picked from commit 84fb48c3be)
* fix(gateway): guard process.kill ESRCH race in signalVerifiedGatewayPidSync (#109590)
* fix(gateway): guard process.kill ESRCH race in signalVerifiedGatewayPidSync
A verified gateway process can exit between the argv validation check and
the process.kill call, causing an unhandled ESRCH error. Wrap the kill in
try-catch and silently swallow ESRCH (process already gone = signal
already delivered).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* docs(gateway): explain ESRCH signal race
Co-authored-by: 丁宇婷0668001435 <ding.yuting@xydigit.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
(cherry picked from commit 853b1a8d11)
* fix(litellm): guard loopback hostname auto-allow with isIP to prevent DNS SSRF bypass (#110693)
* fix(litellm): guard loopback hostname auto-allow with isIP to prevent DNS bypass
The isAutoAllowedLitellmHostname helper auto-enables private-network access
for loopback-style hosts. Before this fix, lowered.startsWith("127.")
matched DNS hostnames like 127.evil.com, letting remote endpoints bypass
the explicit allowPrivateNetwork opt-in — a SSRF risk.
Add isIP(host)===4 guard so only literal IPv4 loopback addresses qualify.
Same canonical pattern as extensions/slack/src/monitor/relay-source.ts:271
and the codex loopback fix.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(litellm): cover loopback endpoint policy
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
(cherry picked from commit 3d03b60da9)
* fix(discord): sustained gateway bursts stop growing memory (#110954)
* fix(discord): sustained gateway bursts stop growing memory
* fix(discord): contain gateway queue overflow
* fix(discord): drop oldest saturated gateway sends
Co-authored-by: 张贵萍0668001030 <zhang.guiping@xydigit.com>
* fix(discord): surface gateway overflow warnings
Co-authored-by: 张贵萍0668001030 <zhang.guiping@xydigit.com>
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
(cherry picked from commit 69aeba9d86)
* fix(gateway): bound busy channel health by real run age (#103793)
* fix(gateway): bound busy channel health by real run age
The channel health policy treats a channel as healthy-busy even while
disconnected, bounded only by a 25 minute stale ceiling measured from
lastRunActivityAt. The run-state heartbeat refreshes lastRunActivityAt
every 60 seconds for as long as any run is active, so a run that hangs
forever (for example a send blocking on a dead socket after the
transport already reported connected:false) keeps that timestamp fresh
and the stuck ceiling is never reached. The account is then reported
healthy forever by the health monitor, readiness probe, and health CLI,
and no restart ever fires.
createRunStateMachine now tracks each in-flight run's start time keyed by
an opaque run handle and publishes the oldest still-active run's start as
activeRunStartedAt. The health policy busy override keys its ceiling off
the real run age, so a run stuck longer than the threshold reports stuck
and the monitor can restart it. Because the reported start is the oldest
active run and advances to the next-oldest as runs complete, a channel
churning through many short overlapping runs (activeRuns above 1 across
concurrent queue keys) stays healthy; only a genuinely hung run breaches
the ceiling. Short and active runs stay healthy and the existing
lastRunActivityAt fallback is preserved for snapshots without a start
time.
* fix(channels): retain run-state callback compatibility
Keep the released zero-argument onRunEnd callback source-compatible while allowing internal queue callers to pass a run handle for exact concurrent-run accounting. The compatibility path closes the oldest active run, preserving existing lifecycle behavior for consumers that do not use handles.
* fix(channels): keep anonymous runs out of age tracking
The zero-argument lifecycle callbacks cannot identify which concurrent run completed, so they must not update the identity-sensitive run start used by channel health. Keep their busy count separately and reserve exact start tracking for the shared queue's handle-aware lifecycle path.
* fix(channels): keep tracked runs internal
Keep the public run-state lifecycle callbacks unchanged. The channel queue now owns opaque run identity and augments its status updates with the oldest active queue run, so implementation details do not expand the SDK surface.
* fix(channels): type queue run start status
Keep activeRunStartedAt in the internal status patch type so the queue can publish its private tracked-run age through the existing status sink.
* fix(channels): wrap isActive to satisfy unbound-method lint
* fix(gateway): gate busy run-age ceiling on disconnected transport
(cherry picked from commit 18b79d99ab)
* fix(deps): update fast-uri past advisory
(cherry picked from commit 1be9db038f)
* fix(release): adapt maintenance-line hardening
Backport/adapt 18ec9ce8f7, dea1fe1f11, 7f32b6c984, 1da345e9d3, 931ac3e2b5, 89780d5a60, and c0d99ed26e for the 2026.6 extended-stable maintenance line.
* fix(deps): bump protobufjs to 7.6.5
Backport-adapted from a230f742f2.
* test(gateway): cover bounded macOS process probe
* chore(release): prepare 2026.6.34
* test(dotenv): share path override environment assertions
* fix(release): resolve 2026.6.34 CI blockers
---------
Signed-off-by: sallyom <somalley@redhat.com>
Co-authored-by: joshavant <830519+joshavant@users.noreply.github.com>
Co-authored-by: Peter Lee <li.xialong@xydigit.com>
Co-authored-by: sallyom <somalley@redhat.com>
Co-authored-by: openclaw-clownfish[bot] <280122609+openclaw-clownfish[bot]@users.noreply.github.com>
Co-authored-by: Liu Wenyu <117838866+indulgeback@users.noreply.github.com>
Co-authored-by: pick-cat <huang.ting3@xydigit.com>
Co-authored-by: Pick-cat <266665499+Pick-cat@users.noreply.github.com>
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
Co-authored-by: weiqinl <liu.weiqin@xydigit.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: shengting <xieyayu@163.com>
Co-authored-by: Shengting Xie <shengting@openclaw.ai>
Co-authored-by: yayu <yayu@yayuMacStudio.local>
Co-authored-by: Agustin Rivera <31522568+eleqtrizit@users.noreply.github.com>
Co-authored-by: cxbAsDev <chen.xianbiao@xydigit.com>
Co-authored-by: ooiuuii <al3060388206@gmail.com>
Co-authored-by: Masato Hoshino <g515hoshino@gmail.com>
Co-authored-by: Vincent Koc <25068+vincentkoc@users.noreply.github.com>
Co-authored-by: mushuiyu886 <yang.haoyu@xydigit.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Co-authored-by: Bruno Wowk (Volky) <bruno.wowk@gmail.com>
Co-authored-by: Pavan Kumar Gondhi <pavangondhi@gmail.com>
Co-authored-by: Glucksberg <80581902+Glucksberg@users.noreply.github.com>
Co-authored-by: xingzhou <zhang.guiping@xydigit.com>
Co-authored-by: tzy-17 <tang.ziyi@xydigit.com>
Co-authored-by: krissding <ding.yuting@xydigit.com>
Co-authored-by: lsr911 <liao.shirong@xydigit.com>
Co-authored-by: Yuval Dinodia <102706514+yetval@users.noreply.github.com>
Backport the applicable run-lifecycle stack from #102160 onto the 2026.6.33 extended-stable line based on 2026.6.11. This includes bounded reply-operation recovery, finite LLM silence guards under unlimited run budgets, Claude CLI quiet-tool handling, and Codex app-server suspect-client retirement. Preserve the 6.33 diagnostics steering adaptation and Codex 0.139 fixture baseline.
The upstream LTS probe assumes main's always-on group history. Select recent history explicitly without importing that broader runtime change.
Adaptation of commit b68060a7cb.
Keep the v6.11 sibling tests consistent with the approved loopback-rebinding security backport.
Companion to commit a00e9fc228d65db9d6b49aa5b307eac15cad607e.
* fix(infra): guard channel ingress queue parseJson against corrupted JSON
* fix(infra): fix type assertion in ingress queue test
* fix(infra): use tagged parse result and validate payload before claiming
* fix(infra): remove unnecessary non-null assertion in ingress queue test
* fix(infra): scan corrupt ingress rows in claimNext
* test(gateway): avoid typed empty mock call tuple access
* fix(infra): tombstone corrupt ingress rows on duplicate enqueue and stale recovery
Two P1 gaps: enqueue() threw on duplicate when the existing row had corrupt
payload_json, and recoverStaleClaims() silently skipped corrupt claimed rows,
leaving them invisible to recovery. Both paths now tombstone the unrecoverable
row as failed with reason "corrupt_payload" and return a proper result.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(infra): resolve lint shadow and await-thenable in recoverStaleClaims
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(channels): tombstone corrupt ingress rows
* test(channels): use explicit placeholder claim tokens
* refactor(channels): name claim token values
* refactor(channels): keep claim projection direct
* fix(channels): preserve active ingress claims
* fix(channels): make corrupt recovery policy-aware
* refactor(channels): name corrupt claim token
* fix(channels): bound corrupt ingress reconciliation
* fix(channels): paginate pending ingress by key
* refactor(telegram): return live owner check directly
* build(plugin-sdk): refresh public export budget
---------
Co-authored-by: Pick-cat <huang.ting3@xydigit.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
(cherry picked from commit a824078101)
Dallin Romney