82d1a03f25
refactor(agents): move implicit-main fallback into load-time roster injection ( #112678 )
...
* refactor(agents): require explicit roster defaults
* feat(onboard): create named first roster agent
* refactor(agents): remove runtime main fallbacks
* style(agents): apply roster refactor formatting
* refactor(agents): finish roster-only runtime sweep
* fix(doctor): migrate legacy main session sqlite
* fix(doctor): harden roster session migrations
* fix(onboard): commit first agent atomically
* fix(config): support empty-roster analysis
* fix(agents): preserve legacy main state during creation
* fix(setup): materialize baseline agent roster
* fix(agents): harden legacy default transfer recovery
* fix(agents): simplify roster-only legacy compatibility
* fix(agents): preserve staged first-agent entries
* fix(config): migrate persisted implicit-main rosters
* fix(config): preserve staged empty rosters
* fix(agents): finalize roster-only upgrade paths
* fix(sessions): close legacy main migration outcomes
* fix(config): migrate legacy roster markers at load
* fix(sessions): preserve roster upgrade history
* refactor(sessions): restore lean legacy main compatibility
* fix(setup): prepare first-agent credentials before publish
* fix(config): stabilize roster snapshot migration
* refactor(sessions): shrink legacy main compatibility
* fix(agents): restore roster compatibility fidelity
* fix(sessions): preserve divergent legacy history
* refactor(agents): narrow roster-only scope
* fix(config): isolate roster migration
* test(agents): align roster-only fixtures
* fix(agents): keep main agent undeletable
* fix(agents): harden roster migration invariants
* fix(agents): close setup and audit scope gaps
* fix(cron): scope session reaper throttles by agent
* fix(agents): preserve scoped owner precedence
* fix(config): preserve authored config ownership
* fix(setup): keep default workspace and roster in sync
* fix(setup): preserve default entry workspace on bare runs
* fix(agents): adapt roster rebase to keyed entries
* fix(agents): honor both roster representations
* fix(agents): route roster reads through shared helpers
* fix(config): preserve canonical roster writes
* fix(cron): resolve dynamic default for session reaper
* fix(agents): close dynamic default migration gaps
* fix(agents): align scoped session ownership
* fix(sessions): preserve legacy main directory casing
* fix(agents): align cron and legacy auth ownership
* fix(setup): provision the committed default workspace
* fix(cron): align scoped ownership and reaping
* fix(cron): treat blank agent ids as absent
* fix(cron): retain configured session-store owners
* fix(agents): repair roster-aware CI boundaries
* fix(cron): preserve scoped ownership resolution
* fix(agents): preserve rosterless maintenance paths
* fix(agents): propagate roster ownership through runtime boundaries
* fix(agents): preserve roster ownership across runtime paths
* fix(agents): harden roster diagnostics and legacy routing
* fix(agents): remove redundant diagnostic import
* test(agents): type CLI policy fixture explicitly
* fix(config): preserve canonical roster mutation identity
* fix(doctor): read canonical agent rosters consistently
* fix(config): resolve compound roster unsets safely
* fix(config): finalize main-session reconciliation
* fix(doctor): read canonical session state safely
* fix(sessions): preserve current visibility alias
* fix(config): track roster include provenance
* test(config): type roster provenance cases
* fix(config): refine roster include ownership
* fix(agents): preserve staged roster invariants
* test(config): align fixtures with explicit roster ownership
* test(node-host): preserve optional plan typing
* fix(config): preserve authored roster projections
* test(config): keep raw roster fixtures explicit
* test(config): normalize rosters at runtime fixtures
* fix(config): protect authored roster ownership
* fix(agents): require explicit session ownership
* fix(agents): enforce scoped roster ownership
* fix(sessions): merge fixed-store agent partitions
* fix(agents): harden roster ownership boundaries
* fix(config): reject ambiguous roster projections
* fix(sessions): preserve persisted store ownership
* fix(sessions): keep collision diagnostics additive
* fix(security): scan malformed roster workspaces
* test(config): align snapshot fixtures after rebase
* test(agents): use explicit roster fixtures
* fix(config): harden roster diagnostic boundaries
* fix(sessions): isolate fixed-store agent databases
* test(agents): type malformed default markers
* refactor(sessions): extract store collision resolution
* test(system-agent): split oversized setup coverage
* style(system-agent): format split setup suite
* fix(sessions): preserve promoted store ownership
* fix(sessions): derive scoped owner before target
* fix(sessions): preserve explicit sqlite ownership
* fix(agents): restore roster compatibility across CI
* fix(agents): enforce roster-owned runtime boundaries
* fix(agents): satisfy default lookup lint
* test(sessions): split known-owner coverage
* fix(state): satisfy path identity lint
* fix(agents): preserve malformed roster safety boundaries
* fix(agents): restore roster compatibility at runtime boundaries
* fix(config): satisfy roster boundary type checks
* fix(agents): preserve roster ownership across runtime probes
Setup inference probes now execute as the configured roster owner. Malformed agent-prefixed session rows are intentionally omitted by the fail-closed visibility contract rather than normalized by tests.
* fix(agents): satisfy session list owner lint
* fix(agents): preserve roster-owned runtime boundaries
Restore shared logical rows for exact SQLite session locators while keeping their physical database owner separate. The ownership regression test now constructs an explicit sole-owner database directly instead of relying on first-touch capture, matching the intentional shared-store contract.
* fix(sessions): preserve multiply owned exact stores
* fix(sessions): restore runtime owner boundaries
Keep incognito sentinels agent-owned, fold default-agent approvals into the global snapshot, and preserve the configless legacy-main CLI policy fallback. Also repair the existing CLI watchdog test lifecycle so the compact shard observes its timeout without an unawaited assertion or async timer stall; product behavior is unchanged by that test-only fix.
* test(ci): align owner-scoped fixtures
These assertions are unchanged. The fixtures now declare the intended non-default runner, expose the session-key constant imported by production status code, and select the main approvals bucket explicitly on Windows.
* fix(agents): close final roster ownership gaps
2026-07-24 22:38:09 -07:00
8dfb310b56
fix(infra): bound three warning dedupe caches with createDedupeCache ( #101746 )
...
* fix(infra): bound three warning dedupe caches with createDedupeCache
Replace unbounded Set<string> warning dedupe caches with the shared
createDedupeCache helper (ttlMs=0, maxSize=4096) to prevent unbounded
memory growth:
- safeBinTrustedDirWarningCache in invoke-system-run.ts
- chmodWarnedTargets in openclaw-state-db.ts
- clobberCapWarnedPaths in io.clobber-snapshot.ts
All three follow the same anti-pattern: .has()/.add() only, no eviction,
no size cap. Matches the fix pattern from #101696 and #101738 .
Co-Authored-By: Claude <noreply@anthropic.com >
* chore: refresh PR body evidence for ClawSweeper re-review
* test(io.clobber-snapshot): add clobber-cap warning deduplication test
Exercises warnClobberCapReached through the production API
(persistBoundedClobberedConfigSnapshot) to prove that
clobberCapWarnedPaths.check() suppresses duplicate warnings
on the same config path.
Co-Authored-By: Claude <noreply@anthropic.com >
* test(infra): tighten warning cache coverage
---------
Co-authored-by: Claude <noreply@anthropic.com >
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-16 12:45:51 -07:00
f81f9d8570
chore: enforce max-lines suppression ratchet ( #107315 )
...
* ci: enforce max-lines suppression ratchet
* chore: prune stale max-lines suppression
* fix: close max-lines ratchet enforcement gaps
* fix: harden max-lines ratchet checks
* fix(ci): satisfy max-lines ratchet checks
* style: format max-lines declarations
* fix(ci): match oxlint suppression grammar
* test: isolate max-lines git fixtures
* chore: prune resolved max-lines debt
* test: skip newline path fixture on Windows
* fix: harden max-lines suppression ratchet
* chore: refresh max-lines baseline
* fix: close max-lines ratchet bypasses
* fix: derive ratchet base from PR merge tree
* fix: support older Git in staged ratchet
* fix: align max-lines declarations and baseline
* chore: refresh max-lines baseline for current main
* fix: exclude generated wizard locales from max-lines
* chore: prune resolved max-lines debt
2026-07-14 09:27:02 -07:00
4dff4e95b1
refactor(node-host): trim internal exports ( #107270 )
2026-07-14 00:49:54 -07:00
d287c9b414
refactor(mac): make app node a CLI capability superset ( #105642 )
...
* refactor(mac): reuse CLI node-host runtime
* fix(mac): prefer checkout CLI in debug builds
* chore: leave release notes to release automation
* chore(mac): sync native string inventory
* chore(mac): refresh native locale artifacts
* fix(node): satisfy native and deadcode gates
2026-07-12 13:16:07 -07:00
425c5b9f26
fix(macos): reject revoked forwarded exec approvals ( #103968 )
...
* fix(macos): reject revoked forwarded exec approvals
* fix(macos): split approval plan validation
* chore(i18n): refresh native source lines
2026-07-10 19:01:17 -07:00
3ec2a50d6c
fix(exec): prevent revoked policy from authorizing delayed node runs ( #103950 )
...
* fix(cli): fail closed on exec policy rollback races
* refactor(cli): reuse canonical exec policy ordering
* fix(exec): bind delayed approvals to prepared policy
* fix(macos): revalidate delayed exec approvals
* fix(exec): align approval snapshot validation gates
2026-07-11 01:37:37 +01:00
9b1c36d23c
fix: prevent exec approval revocation races ( #103515 )
...
* fix(security): serialize exec approval mutations
* fix(security): preserve additive approval writes
* test(cli): expect normalized approval shape
* fix(security): preserve exec approval compatibility
* test(security): exercise locked approval initialization
* test(security): mock serialized approval helpers
* test(exec): derive enforced command path from plan
* fix(gateway): always return approval CAS conflicts
* fix(macos): serialize exec approvals writes
* fix(security): repair approval build errors
* fix(security): serialize exec approval mutations
* fix(security): fail closed on approval persistence errors
* test(security): cover detached approval persistence failures
* fix(security): harden exec approval state
* style(macos): format exec approval sources
* fix(security): complete exec approval hardening
Co-authored-by: Coy Geek <65363919+coygeek@users.noreply.github.com >
* fix(macos): preserve approved login-shell semantics
* fix(macos): keep login shell approvals one-shot
* fix(security): linearize exec authorization
Co-authored-by: Coy Geek <65363919+coygeek@users.noreply.github.com >
* fix(security): preserve durable approval basis
Co-authored-by: Coy Geek <65363919+coygeek@users.noreply.github.com >
* fix(security): bind exec grants to current policy
Co-authored-by: Coy Geek <65363919+coygeek@users.noreply.github.com >
* test(security): fix exec revocation fixtures
* test(security): align gateway approval fixtures
* fix(macos): return approval decisions
* chore(i18n): sync native approval strings
* test(security): align approval hardening fixtures
* test(node): authorize completed event fixture
* test(security): fix approval decision fixtures
* test(security): await durable approval visibility
* fix(exec): preserve concurrent approval grants
* fix(exec): address exact-head CI failures
* fix(exec): preserve concurrent approval promotions
* fix(exec): make Swift shutdown state explicit
* test(macos): handle approval read failures
* fix(macos): harden approval socket paths
* fix(macos): preserve exact shell payload bytes
* test(macos): make approval fixtures explicit
* test(macos): fix approval suite compilation
* fix(macos): bound approval socket JSONL reads
* chore: move exec approval note to release process
* chore: move exec approval note to release process
---------
Co-authored-by: Coy Geek <65363919+coygeek@users.noreply.github.com >
2026-07-10 21:35:05 +01:00
9d4fb60e90
fix: harden exec auto-review approvals ( #103430 )
2026-07-10 06:44:03 +01:00
b60f63150f
refactor(exec): share policy layer merging
2026-06-23 08:27:23 +08:00
c9707ab635
fix(exec): rebuild command authorization on the Tree-sitter command planner
...
Replace the exec approval parser/planner path with Tree-sitter-backed authorization planning, carrying planner decisions through node and gateway execution.
This keeps unpersistable shell shapes one-shot, adds typed `unavailableDecisions` for approval prompts, and refreshes coverage for allowlist matching, command rendering, durable allow-always persistence, and host approval paths.
Verification:
- GitHub PR checks for ce2381192d
2026-06-18 10:12:48 +10:00
5a869eea5a
docs: document node host runtime
2026-06-04 05:06:54 -04:00
c208a10619
Harden node exec approval precheck env [AI] ( #81488 )
...
* fix: align node exec approval precheck env
* addressing ci
* fix: preserve node allow-always prechecks
* fix: finalize node exec approval port
* fix: align node prepare approval env
* test: tighten node marker reuse coverage proof
* test: fix node allow-always coverage mock typing
---------
Co-authored-by: Devin Robison <drobison@nvidia.com >
Co-authored-by: Devin Robison <drobison00@users.noreply.github.com >
2026-06-02 13:15:41 -06:00
f5eca3f84c
chore(lint): enable object and reassignment rules
2026-05-31 09:32:52 +01:00
00d8d7ead0
refactor: extract normalization core package
...
Extract shared normalization/coercion helpers into private @openclaw/normalization-core workspace package while preserving existing plugin SDK helper subpaths.\n\nAlso keeps direct normalization-core imports internal, wires UI/build/loader resolution, and replaces the slow PR network CodeQL lane with a fast added-line boundary scan while retaining full CodeQL for scheduled/manual runs.\n\nVerification: local moved tests, plugin SDK boundary tests, extension loader tests, agents-support shard, UI build/test, build artifacts, lint, workflow guards, autoreview, and GitHub CI passed on PR head 963d893715
2026-05-31 01:33:00 +01:00
c82d7011b5
fix(exec): honor node runtime policy for auto-review
...
Co-authored-by: Vincent Koc <25068+vincentkoc@users.noreply.github.com >
Co-authored-by: jesse-merhi <79823012+jesse-merhi@users.noreply.github.com >
2026-05-30 00:04:06 +10:00
80227005a0
feat(exec): add normalized auto mode
...
Co-authored-by: Vincent Koc <25068+vincentkoc@users.noreply.github.com >
Co-authored-by: jesse-merhi <79823012+jesse-merhi@users.noreply.github.com >
2026-05-30 00:04:06 +10:00
4d6593642e
fix(exec): avoid default approval store writes ( #86964 )
...
* fix(exec): avoid default approval store writes
* fix(exec): harden token approvals on default policy
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-05-26 20:59:24 +01:00
e98760a1bf
Recheck rebuilt system.run argv [AI] ( #84090 )
...
* fix: recheck rebuilt system run argv
* docs: add changelog entry for PR merge
2026-05-20 12:30:26 +05:30
524185a68e
fix(exec): bind approval trust to realpaths ( #82825 )
2026-05-17 03:41:50 +01:00
9ac4272b35
fix: harden safe-bin argument validation [AI] ( #80999 )
...
* fix: reject shell expansion in safe-bin tokens
* fix: complete safe-bin shell payload handling
* addressing codex review
* addressing ci
* addressing ci
* addressing codex review
* docs: add changelog entry for PR merge
2026-05-12 20:37:58 +05:30
bd0e10a2f6
refactor: route inline eval through command analysis
2026-05-03 18:06:10 +01:00
3f7e6eebc2
refactor: unify command analysis for exec approvals
2026-05-03 18:06:10 +01:00
42d73fd955
refactor: remove dead private helpers
2026-05-01 06:55:26 +01:00
53d213f9cc
perf: lazy load hot test imports
2026-04-28 01:57:22 +01:00
7f3f108521
refactor(config): migrate plugin config access
2026-04-27 12:35:58 +01:00
087f1584df
test: streamline system run hotspot coverage
2026-04-17 20:18:01 +01:00
7b27d08e56
perf: lazy load system run config
2026-04-17 16:39:24 +01:00
8f8492d172
fix(security): broaden shell-wrapper detection and block env-argv assignment injection [AI-assisted] ( #65717 )
...
* fix: address issue
* fix: address PR review feedback
* fix: address PR review feedback
* docs: add changelog entry for PR merge
2026-04-13 11:48:42 +05:30
de6bac331c
fix(exec): detect cmd wrapper carriers ( #62439 )
...
* fix(exec): detect cmd wrapper carriers
* fix(exec): block env cmd wrapper carriers
* fix: keep cmd wrapper carriers approval-gated (#62439 ) (thanks @ngutman)
2026-04-07 14:27:06 +03:00
d008e2d015
fix(exec): align node shell allowlist wrappers ( #62401 )
...
* fix(exec): align node shell allowlist wrappers
* fix: align node shell allowlist wrappers (#62401 ) (thanks @ngutman)
2026-04-07 13:05:57 +03:00
679a393f6d
refactor: dedupe metadata readers
2026-04-07 07:36:11 +01:00
3e452f2671
fix: preserve strict inline-eval approval boundaries ( #59780 ) (thanks @luoyanglang)
2026-04-02 18:30:29 +01:00
990545181b
fix(ci): preserve strict inline-eval denial after durable awk trust
2026-04-03 01:55:01 +09:00
fff6333773
fix(exec): implement Windows argPattern allowlist flow
2026-04-03 00:09:28 +09:00
2d53ffdec1
fix(exec): resolve remote approval regressions ( #58792 )
...
* fix(exec): restore remote approval policy defaults
* fix(exec): handle headless cron approval conflicts
* fix(exec): make allow-always durable
* fix(exec): persist exact-command shell trust
* fix(doctor): match host exec fallback
* fix(exec): preserve blocked and inline approval state
* Doctor: surface allow-always ask bypass
* Doctor: match effective exec policy
* Exec: match node durable command text
* Exec: tighten durable approval security
* Exec: restore owner approver fallback
* Config: refresh Slack approval metadata
---------
Co-authored-by: scoootscooob <zhentongfan@gmail.com >
2026-04-01 02:07:20 -07:00
5e30da3cad
fix(exec): restore strict inline-eval allow-always reuse
2026-03-31 23:45:22 +09:00
7f373823b0
refactor: separate exec policy and execution targets
2026-03-23 19:36:44 -07:00
d8cef14eb1
fix: split exec and policy resolution for wrapper trust ( #53134 ) (thanks @vincentkoc)
2026-03-23 19:04:04 -07:00
a94ec3b79b
fix(security): harden exec approval boundaries
2026-03-22 09:35:25 -07:00
7abfff756d
Exec: harden host env override handling across gateway and node ( #51207 )
...
* Exec: harden host env override enforcement and fail closed
* Node host: enforce env override diagnostics before shell filtering
* Env overrides: align Windows key handling and mac node rejection
2026-03-20 15:44:15 -05:00
d0337a18b6
fix: clear typecheck backlog
2026-03-13 22:09:06 +00:00
8f852ef82f
refactor: share system run success delivery
2026-03-13 21:40:54 +00:00
b7a37c2023
fix(node-host): extend script-runner set and add fail-closed guard for mutable-file approval
...
tsx, jiti, ts-node, ts-node-esm, vite-node, and esno were not recognized
as interpreter-style script runners in invoke-system-run-plan.ts. These
runners produced mutableFileOperand: null, causing invoke-system-run.ts
to skip revalidation entirely. A mutated script payload would execute
without the approval binding check that node ./run.js already enforced.
Two-part fix:
- Add tsx, jiti, and related TypeScript/ESM loaders to the known script
runner set so they produce a valid mutableFileOperand from the planner
- Add a fail-closed runtime guard in invoke-system-run.ts that denies
execution when a script run should have a mutable-file binding but the
approval plan is missing it, preventing unknown future runners from
silently bypassing revalidation
Fixes GHSA-qc36-x95h-7j53
2026-03-12 01:34:35 +01:00
68c674d37c
refactor(security): simplify system.run approval model
2026-03-11 01:43:06 +00:00
de49a8b72c
Telegram: exec approvals for OpenCode/Codex ( #37233 )
...
Merged via squash.
Prepared head SHA: f2433790945617868+huntharo@users.noreply.github.com >
Co-authored-by: huntharo <5617868+huntharo@users.noreply.github.com >
Reviewed-by: @huntharo
2026-03-09 23:04:35 -04:00
c76d29208b
fix(node-host): bind approved script operands
2026-03-07 23:04:00 +00:00
dc825e59f5
refactor: unify system.run approval cwd revalidation
2026-03-02 23:46:54 +00:00
500d7cb107
fix: revalidate approval cwd before system.run execution
2026-03-02 23:42:10 +00:00
9617ac9dd5
refactor: dedupe agent and reply runtimes
2026-03-02 19:57:33 +00:00
Peter Steinberger