Samuel Judson 6ccc57b331 fix: add ssrf protection to Beam fetches (#123848) ...

* Add ssrf protection to Beam fetches.

* Additional robustness following initial comments.

* fix(beam): make redirect failures terminal

* chore(plugin-sdk): refresh surface budget

* docs(beam): define redirect restart behavior

* docs(beam): align redirect config help

* test(beam): cover warning before redirect block

* fix(beam): always report terminal redirect blocks

---------

Co-authored-by: joshavant <830519+joshavant@users.noreply.github.com>

2026-08-18 18:00:58 -07:00

..

reference

chore(release): refresh generated preflight artifacts (#125586)

2026-08-18 07:10:49 -07:00

adding-capabilities.md

refactor: retire August compat windows (embedding API, pi aliases, target parser, spawning hook, setup exports, WhatsApp inbound aliases) (#124416)

2026-08-15 22:43:47 -07:00

admin-http-rpc.md

fix(gateway): restart after prepared maintenance suspension (#124157)

2026-08-15 04:53:38 -07:00

agent-tools.md

…

architecture-internals.md

fix: correct setup provider drift diagnostics (#125523)

2026-08-18 03:54:47 +01:00

architecture.md

refactor(gateway): remove deferred channel load flag; 503 plugin routes until runtime ready (#117852)

2026-08-02 00:36:21 -07:00

beam.md

fix: add ssrf protection to Beam fetches (#123848)

2026-08-18 18:00:58 -07:00

building-extensions.md

docs: rewrite published docs grounded in current source (#100142)

2026-07-05 00:32:47 -04:00

building-plugins.md

fix: plugin tools disappear from Codex and restricted profiles (#124947)

2026-08-16 19:38:07 -07:00

bundles.md

feat(plugins): read the ai.openclaw Agent Plugins extension namespace (#120214)

2026-08-07 03:49:12 -07:00

cli-backend-plugins.md

fix(compaction): allow Claude CLI sessions to compact without API keys (#120496)

2026-08-14 09:30:15 -07:00

codex-computer-use.md

docs: fix stale cua-computer section link on the Codex Computer Use page (#123892)

2026-08-14 17:33:23 -07:00

codex-harness-reference.md

feat(agents): unify agent status into a durable progress_card (#125125)

2026-08-17 09:44:04 -07:00

codex-harness-runtime.md

fix(codex): restore connected apps for token-authenticated runs (#115075)

2026-07-29 06:21:25 -04:00

codex-harness.md

fix(codex): preserve native approval scope (#125995)

2026-08-18 16:18:01 -07:00

codex-native-plugins.md

fix(codex): let owners install plugins from discovered marketplaces (#122389)

2026-08-12 20:29:40 +00:00

codex-supervision.md

fix(session-catalog): preserve explicit agent ownership across UI and CLI (#123899)

2026-08-15 04:47:28 -07:00

community.md

docs: rewrite published docs grounded in current source (#100142)

2026-07-05 00:32:47 -04:00

compatibility.md

fix(auth): surface revoked OAuth state without masking provider failures (#125515)

2026-08-18 00:35:06 -07:00

copilot.md

docs: repair spellcheck and anchor drift (#122960)

2026-08-12 20:50:56 -07:00

dependency-resolution.md

fix(update): support npm before lifecycle allowlists (#125452)

2026-08-17 17:01:23 -07:00

google-meet.md

feat(meetings): enable Linux Chrome talk-back (#118451)

2026-08-09 02:13:17 -07:00

hooks.md

refactor(config): consolidate context budget to one per-model knob (#124665)

2026-08-16 10:05:01 -07:00

install-overrides.md

docs: rewrite published docs grounded in current source (#100142)

2026-07-05 00:32:47 -04:00

llama-cpp.md

feat(llama-cpp): raise default context size to 64K (#123701)

2026-08-14 08:26:41 -07:00

logbook.md

refactor(config): config-surface reduction tranche 3 — product consolidations (review request) (#111527)

2026-07-21 20:28:43 -07:00

manage-plugins.md

fix(claws): recover lifecycle state safely (#123254)

2026-08-14 20:52:45 -07:00

manifest.md

feat(ui): show machine CPU and RAM in the cloud picker (#125696)

2026-08-18 15:38:15 -07:00

meeting-plugins.md

feat(meetings): enable Linux Chrome talk-back (#118451)

2026-08-09 02:13:17 -07:00

memory-lancedb.md

fix(memory): bound LanceDB prompts and reload embedding config (#125567)

2026-08-17 22:55:20 -07:00

memory-wiki.md

docs: replace retired config keys with canonical schema keys (#121330)

2026-08-09 20:30:43 -07:00

message-presentation.md

feat(status): render /status as a native rich card and declutter the plain body (#120167)

2026-08-07 20:46:52 +05:30

oc-path.md

docs: rewrite published docs grounded in current source (#100142)

2026-07-05 00:32:47 -04:00

onepassword.md

fix(onepassword): make SecretRef setup production-safe

2026-07-25 06:03:30 -05:00

plugin-inventory.md

chore(release): refresh generated preflight artifacts (#125586)

2026-08-18 07:10:49 -07:00

plugin-permission-requests.md

fix(plugins): enforce hook security invariants (#115701)

2026-07-29 16:10:34 +08:00

reference.md

fix(plugins): surface manifest-only bundled capabilities (#121354)

2026-08-09 19:43:49 -07:00

sdk-agent-harness.md

fix(codex): preserve harness trajectories (#125941)

2026-08-18 11:47:09 -07:00

sdk-channel-inbound.md

feat: audit admitted channel participant identity (#122863)

2026-08-14 08:57:01 -05:00

sdk-channel-ingress.md

feat: audit admitted channel participant identity (#122863)

2026-08-14 08:57:01 -05:00

sdk-channel-message.md

refactor: remove expired plugin compatibility surfaces (#111451)

2026-07-19 11:04:48 -07:00

sdk-channel-outbound.md

fix(discord): unblock ingress after retry exhaustion

2026-08-13 01:34:05 -05:00

sdk-channel-plugins.md

fix: keep doctor security conditions as single findings (#124666)

2026-08-16 10:24:40 -07:00

sdk-channel-turn.md

refactor: remove channel turn runtime aliases

2026-05-27 11:37:23 +01:00

sdk-entrypoints.md

refactor(plugin-sdk): consolidate session catalog families (#124801)

2026-08-16 13:25:11 -07:00

sdk-migration.md

refactor(plugin-sdk): discriminate delivery and exec results (#124979)

2026-08-16 22:55:41 -07:00

sdk-overview.md

feat(ui): show machine CPU and RAM in the cloud picker (#125696)

2026-08-18 15:38:15 -07:00

sdk-provider-plugins.md

Revert "fix(providers): report request acceptance consistently (#125807)" (#126021)

2026-08-19 00:16:09 +03:00

sdk-runtime.md

fix(workboard): prevent orphaned runs and overwritten cards (#125951)

2026-08-18 13:50:17 -07:00

sdk-setup.md

fix(channels): fail-fast headless channel setup with plugin-declared env contracts (#122530)

2026-08-12 17:12:15 +00:00

sdk-subpaths.md

fix: add ssrf protection to Beam fetches (#123848)

2026-08-18 18:00:58 -07:00

sdk-testing.md

perf(test): move direct import smoke to test fixtures (#123923)

2026-08-14 19:07:48 -07:00

teams-meetings.md

feat(meetings): enable Linux Chrome talk-back (#118451)

2026-08-09 02:13:17 -07:00

tool-plugins.md

docs(plugins): link setup-input deprecations to the migration pattern and document reader sweeps (#112692)

2026-07-22 11:04:19 -07:00

vault.md

Add Vault SecretRef plugin (#89255)

2026-07-09 05:30:12 -05:00

voice-call.md

fix(voice-call): keep Funnel off occupied HTTPS ports (#125552)

2026-08-17 21:04:17 -07:00

webhooks.md

feat(secrets): add SQLite-backed secret store (#121559)

2026-08-10 07:08:40 -07:00

workboard.md

fix(workboard): prevent orphaned runs and overwritten cards (#125951)

2026-08-18 13:50:17 -07:00

zalouser.md

docs: rewrite published docs grounded in current source (#100142)

2026-07-05 00:32:47 -04:00

zoom-meetings.md

feat(meetings): enable Linux Chrome talk-back (#118451)

2026-08-09 02:13:17 -07:00