Peter Steinberger
dc825e59f5
refactor: unify system.run approval cwd revalidation
2026-03-02 23:46:54 +00:00
Peter Steinberger
500d7cb107
fix: revalidate approval cwd before system.run execution
2026-03-02 23:42:10 +00:00
Peter Steinberger
9617ac9dd5
refactor: dedupe agent and reply runtimes
2026-03-02 19:57:33 +00:00
Peter Steinberger
aee27d0e38
refactor(security): table-drive wrapper approval pinning tests
2026-03-02 17:30:48 +00:00
Peter Steinberger
dded569626
fix(security): preserve system.run wrapper approval semantics
2026-03-02 17:20:52 +00:00
Peter Steinberger
18f8393b6c
fix: harden sandbox writes and centralize atomic file writes
2026-03-02 16:45:12 +00:00
Sid
7b5a410b83
fix(node-host): decode Windows exec output with active code page (openclaw#30652) thanks @Sid-Qin
...
Verified:
- pnpm vitest run src/node-host/invoke.sanitize-env.test.ts src/node-host/invoke-system-run.test.ts
Co-authored-by: Sid-Qin <53659198+Sid-Qin@users.noreply.github.com >
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com >
2026-03-02 07:50:17 -06:00
Peter Steinberger
b02b94673f
refactor: dedupe runtime and helper flows
2026-03-02 12:55:47 +00:00
Vincent Koc
29c3ce9454
[AI-assisted] test: fix typing and test fixture issues ( #31444 )
...
* test: fix typing and test fixture issues
* Fix type-test harness issues from session routing and mock typing
* Add routing regression test for session.mainKey precedence
2026-03-02 00:41:21 -08:00
Gustavo Madeira Santana
1443bb9a84
chore(tsgo/lint): fix CI errors
2026-03-02 03:03:11 -05:00
Peter Steinberger
d3e0c0b29c
test(gateway): dedupe gateway and infra test scaffolds
2026-03-02 07:13:10 +00:00
Peter Steinberger
155118751f
refactor!: remove versioned system-run approval contract
2026-03-02 01:12:53 +00:00
Peter Steinberger
d06632ba45
refactor(gateway): share node command catalog
2026-02-26 22:01:06 +01:00
Peter Steinberger
d82c042b09
refactor(node-host): split system.run plan and allowlist internals
2026-02-26 22:01:01 +01:00
Peter Steinberger
78a7ff2d50
fix(security): harden node exec approvals against symlink rebind
2026-02-26 21:47:45 +01:00
Peter Steinberger
f789f880c9
fix(security): harden approval-bound node exec cwd handling
2026-02-26 04:14:11 +01:00
Peter Steinberger
42f455739f
fix(security): clarify denyCommands exact-match guidance
2026-02-26 00:55:35 +01:00
Peter Steinberger
a9ce6bd79b
refactor: dedupe exec wrapper denial plan and test setup
2026-02-25 00:43:29 +00:00
Peter Steinberger
3c95f89662
refactor(exec): split system.run phases and align ts/swift validator contracts
2026-02-25 00:35:06 +00:00
Peter Steinberger
57c9a18180
fix(security): block env depth-overflow approval bypass
2026-02-25 00:14:13 +00:00
Peter Steinberger
55cf92578d
fix(security): harden system.run companion command binding
2026-02-25 00:02:03 +00:00
Peter Steinberger
4355e08262
refactor: harden safe-bin trusted dir diagnostics
2026-02-24 23:29:44 +00:00
Peter Steinberger
ffd63b7a2c
fix(security): trust resolved skill-bin paths in allowlist auto-allow
2026-02-24 03:12:43 +00:00
Peter Steinberger
60f1d1959a
test: stabilize invoke-system-run env-wrapper assertion on Windows
2026-02-24 03:02:38 +00:00
Peter Steinberger
3f923e8313
test: add env -S allowlist bypass regressions
2026-02-24 02:28:00 +00:00
Peter Steinberger
0026255def
refactor(security): harden system.run wrapper enforcement
2026-02-24 02:17:41 +00:00
Peter Steinberger
a1c4bf07c6
fix(security): harden exec wrapper allowlist execution parity
2026-02-24 01:52:17 +00:00
Peter Steinberger
1c753ea786
test: dedupe fixtures and test harness setup
2026-02-23 05:45:54 +00:00
Peter Steinberger
e16f93af0c
fix: stabilize ci test typings and mocks
2026-02-22 21:38:47 +00:00
Peter Steinberger
3f0b9dbb36
fix(security): block shell-wrapper line-continuation allowlist bypass
2026-02-22 22:36:29 +01:00
Peter Steinberger
e4d67137db
fix(node): default mac headless system.run to local host
...
Co-authored-by: aethnova <262512133+aethnova@users.noreply.github.com >
2026-02-22 22:24:28 +01:00
Peter Steinberger
bbdfba5694
fix: harden connect auth flow and exec policy diagnostics
2026-02-22 20:22:00 +01:00
Peter Steinberger
0c1f491a02
fix(gateway): clarify pairing and node auth guidance
2026-02-22 19:50:29 +01:00
Peter Steinberger
0d0f4c6992
refactor(exec): centralize safe-bin policy checks
2026-02-22 13:18:25 +01:00
Peter Steinberger
47c3f742b6
fix(exec): require explicit safe-bin profiles
2026-02-22 12:58:55 +01:00
Peter Steinberger
e80c803fa8
fix(security): block shell env allowlist bypass in system.run
2026-02-22 12:47:05 +01:00
Peter Steinberger
c2c7114ed3
fix(security): block HOME and ZDOTDIR env override injection
2026-02-22 09:42:55 +01:00
Peter Steinberger
b25fd03b8c
refactor(node-host): share invoke type definitions
2026-02-22 07:44:57 +00:00
Vignesh Natarajan
98b2b16ac3
Security/Exec: persist inner commands for shell-wrapper approvals
2026-02-21 21:26:20 -08:00
Peter Steinberger
e588e3cc20
refactor(test): standardize env helpers across suites
2026-02-21 19:13:46 +00:00
Peter Steinberger
6007941f04
fix(security): harden and refactor system.run command resolution
2026-02-21 11:49:38 +01:00
Peter Steinberger
2cdbadee1f
fix(security): block startup-file env injection across host execution paths
2026-02-21 11:44:20 +01:00
Peter Steinberger
fec48a5006
refactor(exec): split host flows and harden safe-bin trust
2026-02-19 14:22:01 +01:00
Peter Steinberger
3267f09264
refactor(node-host): extract invoke result helpers
2026-02-18 23:48:32 +00:00
Peter Steinberger
9386075b7b
perf(test): fold node-host runner tests into sanitize env suite
2026-02-16 02:45:00 +00:00
Peter Steinberger
a0e763168f
refactor(exec-approvals): share socket default merge
2026-02-15 17:36:08 +00:00
Peter Steinberger
18342b0a5b
refactor(node-host): dedupe exec finished event emission
2026-02-15 13:35:37 +00:00
Bin Deng
c0cd3c3c08
fix: add safety timeout to session.compact() to prevent lane deadlock ( #16533 )
...
Merged via /review-pr -> /prepare-pr -> /merge-pr.
Prepared head SHA: 21e4045addca7a424828478d84dd5e4b202cbcfd
Co-authored-by: BinHPdev <219093083+BinHPdev@users.noreply.github.com >
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com >
Reviewed-by: @gumadeiras
2026-02-14 17:54:12 -05:00
Peter Steinberger
013e8f6b3b
fix: harden exec PATH handling
2026-02-14 19:53:04 +01:00
Peter Steinberger
cb3290fca3
fix(node-host): enforce system.run rawCommand/argv consistency
2026-02-14 18:53:23 +01:00
