Peter Steinberger 20b453f155 fix(agents): reject forged plugin owner authority (#104872) ...

* fix(security): bind channel owner authority to trusted runtime

* fix(plugins): preserve untrusted channel guest ingress

* fix(plugins): snapshot channel ingress authority once

2026-08-25 20:36:05 -07:00

..

reference

fix(crabbox): preserve Machine0 provisioning budget (#128185)

2026-08-25 03:41:06 -07:00

adding-capabilities.md

refactor: retire August compat windows (embedding API, pi aliases, target parser, spawning hook, setup exports, WhatsApp inbound aliases) (#124416)

2026-08-15 22:43:47 -07:00

admin-http-rpc.md

fix(gateway): restart after prepared maintenance suspension (#124157)

2026-08-15 04:53:38 -07:00

agent-tools.md

…

architecture-internals.md

refactor(providers): return prepared dynamic models directly (#126574)

2026-08-21 11:40:52 -07:00

architecture.md

refactor(gateway): remove deferred channel load flag; 503 plugin routes until runtime ready (#117852)

2026-08-02 00:36:21 -07:00

beam.md

fix: add ssrf protection to Beam fetches (#123848)

2026-08-18 18:00:58 -07:00

building-extensions.md

docs: rewrite published docs grounded in current source (#100142)

2026-07-05 00:32:47 -04:00

building-plugins.md

fix(plugins): bind tool delivery to current turn (#127098)

2026-08-21 23:16:04 +05:30

bundles.md

feat(plugins): read the ai.openclaw Agent Plugins extension namespace (#120214)

2026-08-07 03:49:12 -07:00

cli-backend-plugins.md

docs(plugins): use public sdk types in backend example (#129646)

2026-08-25 16:40:51 -07:00

codex-computer-use.md

fix(codex): keep Computer Use working after desktop updates (#127778)

2026-08-24 23:20:18 -07:00

codex-harness-reference.md

feat(workers): run OpenClaw and Codex on the same cloud profile (#127752)

2026-08-25 00:13:29 -07:00

codex-harness-runtime.md

refactor(agents): remove redundant heartbeat system prompts (#129642)

2026-08-25 16:10:22 -07:00

codex-harness.md

refactor(agents): remove redundant heartbeat system prompts (#129642)

2026-08-25 16:10:22 -07:00

codex-native-plugins.md

feat(codex): upgrade main to app-server 0.149.1 (#128370)

2026-08-24 19:50:22 -07:00

codex-supervision.md

fix(session-catalog): preserve explicit agent ownership across UI and CLI (#123899)

2026-08-15 04:47:28 -07:00

community.md

docs: rewrite published docs grounded in current source (#100142)

2026-07-05 00:32:47 -04:00

compatibility.md

fix(auth): surface revoked OAuth state without masking provider failures (#125515)

2026-08-18 00:35:06 -07:00

copilot.md

[AI-assisted] docs(copilot): describe the transcript journal, not the removed dual-write mirror (#125599)

2026-08-25 00:04:32 -07:00

dependency-resolution.md

fix(update): support npm before lifecycle allowlists (#125452)

2026-08-17 17:01:23 -07:00

geolocation.md

feat(geolocation): resolve client addresses to a coarse city via a bundled plugin (#128546)

2026-08-24 04:56:03 -07:00

google-meet.md

feat(meetings): enable Linux Chrome talk-back (#118451)

2026-08-09 02:13:17 -07:00

hooks.md

fix(memory): honor turn tool policy during automatic recall (#126482)

2026-08-19 19:21:51 -07:00

install-overrides.md

docs: rewrite published docs grounded in current source (#100142)

2026-07-05 00:32:47 -04:00

llama-cpp.md

fix(llama-cpp): make endpoint auth transitions reproducible (#126498)

2026-08-19 18:37:28 -07:00

logbook.md

refactor(config): config-surface reduction tranche 3 — product consolidations (review request) (#111527)

2026-07-21 20:28:43 -07:00

manage-plugins.md

fix(claws): recover lifecycle state safely (#123254)

2026-08-14 20:52:45 -07:00

manifest.md

feat(workers): run OpenClaw and Codex on the same cloud profile (#127752)

2026-08-25 00:13:29 -07:00

meeting-plugins.md

docs: consolidate setup and plugin references (#126132)

2026-08-18 20:00:05 -07:00

memory-lancedb.md

fix(memory): bound LanceDB prompts and reload embedding config (#125567)

2026-08-17 22:55:20 -07:00

memory-wiki.md

fix(memory-wiki): honor configured state directory (#122591)

2026-08-25 01:10:40 -07:00

message-presentation.md

feat(status): render /status as a native rich card and declutter the plain body (#120167)

2026-08-07 20:46:52 +05:30

oc-path.md

docs: rewrite published docs grounded in current source (#100142)

2026-07-05 00:32:47 -04:00

onepassword.md

fix(onepassword): make SecretRef setup production-safe

2026-07-25 06:03:30 -05:00

plugin-inventory.md

feat(geolocation): resolve client addresses to a coarse city via a bundled plugin (#128546)

2026-08-24 04:56:03 -07:00

plugin-permission-requests.md

fix(plugins): enforce hook security invariants (#115701)

2026-07-29 16:10:34 +08:00

reference.md

feat(geolocation): resolve client addresses to a coarse city via a bundled plugin (#128546)

2026-08-24 04:56:03 -07:00

sdk-agent-harness.md

feat(audit): explain plugin and remote actions (#126027)

2026-08-22 14:06:54 -07:00

sdk-channel-inbound.md

feat: audit admitted channel participant identity (#122863)

2026-08-14 08:57:01 -05:00

sdk-channel-ingress.md

feat: audit admitted channel participant identity (#122863)

2026-08-14 08:57:01 -05:00

sdk-channel-message.md

refactor: remove expired plugin compatibility surfaces (#111451)

2026-07-19 11:04:48 -07:00

sdk-channel-outbound.md

fix: stop routing IDs from masquerading as delivery receipts (#126385)

2026-08-19 11:33:16 -07:00

sdk-channel-plugins.md

fix gateway conversation route ownership (#126424)

2026-08-21 12:20:21 -07:00

sdk-channel-turn.md

…

sdk-entrypoints.md

refactor(plugin-sdk): consolidate session catalog families (#124801)

2026-08-16 13:25:11 -07:00

sdk-migration.md

fix(talk): isolate cancellation ownership contract (#127186)

2026-08-23 03:58:00 -07:00

sdk-overview.md

feat(workers): run OpenClaw and Codex on the same cloud profile (#127752)

2026-08-25 00:13:29 -07:00

sdk-provider-plugins.md

fix(plugins): scope runtime catalog discovery by provider (#129624)

2026-08-25 17:37:31 -07:00

sdk-runtime.md

fix(agents): reject forged plugin owner authority (#104872)

2026-08-25 20:36:05 -07:00

sdk-setup.md

fix(channels): fail-fast headless channel setup with plugin-declared env contracts (#122530)

2026-08-12 17:12:15 +00:00

sdk-subpaths.md

refactor: share media and process runtime helpers (#126490)

2026-08-19 17:48:49 -07:00

sdk-testing.md

perf(test): move direct import smoke to test fixtures (#123923)

2026-08-14 19:07:48 -07:00

teams-meetings.md

docs: consolidate setup and plugin references (#126132)

2026-08-18 20:00:05 -07:00

tool-plugins.md

docs(plugins): note the factory tool execute signature (#120097)

2026-08-23 16:08:08 -07:00

vault.md

Add Vault SecretRef plugin (#89255)

2026-07-09 05:30:12 -05:00

voice-call.md

fix(voice-call): keep Funnel off occupied HTTPS ports (#125552)

2026-08-17 21:04:17 -07:00

webhooks.md

feat(secrets): add SQLite-backed secret store (#121559)

2026-08-10 07:08:40 -07:00

workboard.md

fix(workboard): prevent orphaned runs and overwritten cards (#125951)

2026-08-18 13:50:17 -07:00

zalouser.md

docs: rewrite published docs grounded in current source (#100142)

2026-07-05 00:32:47 -04:00

zoom-meetings.md

docs: consolidate setup and plugin references (#126132)

2026-08-18 20:00:05 -07:00