Mariano 5544646a09 security: block apply_patch path traversal outside workspace (#16405) ...

Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 0fcd3f8c3a15993980eb89ecdae3e76de4f3f72d
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Reviewed-by: @mbelinky

2026-02-14 19:11:12 +00:00

..

acp

fix: harden exec PATH handling

2026-02-14 19:53:04 +01:00

agents

security: block apply_patch path traversal outside workspace (#16405)

2026-02-14 19:11:12 +00:00

auto-reply

refactor(test): dedupe trigger-handling e2e setup

2026-02-14 19:04:39 +00:00

browser

refactor(test): reuse browser control server harness

2026-02-14 19:04:39 +00:00

canvas-host

refactor(canvas-host): share static file resolver

2026-02-14 15:39:45 +00:00

channels

feat(telegram): add sendPoll support (#16193) (#16209)

2026-02-14 18:34:30 +01:00

cli

perf(test): use tiny fixture for browser extension install test

2026-02-14 18:46:24 +00:00

commands

Fix: Add type safety to models status command (#16395)

2026-02-14 14:07:38 -05:00

compat

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

config

fix(sessions): resolve transcript paths with explicit agent context (#16288)

2026-02-14 13:44:51 -05:00

cron

fix: deliver cron output to explicit targets (#16360) (thanks @rubyrunsstuff)

2026-02-14 12:43:11 -06:00

daemon

refactor(daemon): share schtasks exec helper

2026-02-14 15:39:45 +00:00

discord

fix: add discord exec approval channel targeting (#16051) (thanks @leonnardo)

2026-02-14 12:05:53 -06:00

docs

Docs: landing page revamp (#8885)

2026-02-04 10:37:14 -05:00

gateway

perf(test): mock config stack in tools invoke http tests

2026-02-14 18:46:24 +00:00

hooks

perf(test): cache hook installer fixtures

2026-02-14 16:36:15 +00:00

imessage

refactor(test): share iMessage monitor test harness

2026-02-14 19:04:39 +00:00

infra

refactor(security): refine safeBins hardening

2026-02-14 19:59:13 +01:00

line

perf(test): speed up line, models list, and memory batch

2026-02-14 16:36:15 +00:00

link-understanding

fix(security): block private/loopback/metadata IPs in link-understanding URL detection (#15604)

2026-02-13 18:38:40 +01:00

logging

perf(test): reduce vitest logging overhead and media fixture cost

2026-02-14 00:59:53 +00:00

macos

refactor: unify gateway restart deferral and dispatcher cleanup

2026-02-14 00:38:18 +01:00

markdown

fix(signal): outbound formatting and markdown IR rendering improvements (#9781)

2026-02-14 16:57:20 +01:00

media

fix(security): reject oversized base64 before decode

2026-02-14 15:45:41 +01:00

media-understanding

refactor(media-understanding): share gemini inline-data helper

2026-02-14 15:39:46 +00:00

memory

perf(test): mock chokidar in memory tests

2026-02-14 18:46:24 +00:00

node-host

fix: harden exec PATH handling

2026-02-14 19:53:04 +01:00

pairing

perf: replace proper-lockfile with lightweight file locks

2026-02-13 17:57:30 +00:00

plugin-sdk

fix(security): harden tlon Urbit requests against SSRF

2026-02-14 18:42:10 +01:00

plugins

perf(test): speed up compaction hook wiring tests

2026-02-14 18:46:24 +00:00

process

perf(test): trim duplicate gateway and auto-reply test overhead

2026-02-13 23:40:38 +00:00

providers

perf(test): eliminate resetModules via injectable seams

2026-02-13 16:20:37 +00:00

routing

fix: add discord routing debug logging (#16202) (thanks @jayleekr)

2026-02-14 11:03:30 -06:00

scripts

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

security

refactor(config): share include scan helper

2026-02-14 15:39:45 +00:00

sessions

fix: preserve inter-session input provenance (thanks @anbecker)

2026-02-13 02:02:01 +01:00

shared

perf(test): reduce skills + update + memory suite overhead

2026-02-14 16:36:15 +00:00

signal

fix(signal): outbound formatting and markdown IR rendering improvements (#9781)

2026-02-14 16:57:20 +01:00

slack

fix(slack): gate DM slash command authorization

2026-02-14 19:10:29 +01:00

telegram

refactor(tui): clarify searchable select list width layout (#16378)

2026-02-14 19:15:38 +01:00

terminal

fix: Docker installation keeps hanging on MacOS (#12972)

2026-02-14 19:46:07 +01:00

test-helpers

fix: use STATE_DIR instead of hardcoded ~/.openclaw for identity and canvas (#4824)

2026-02-07 22:16:59 -05:00

test-utils

refactor(tui): clarify searchable select list width layout (#16378)

2026-02-14 19:15:38 +01:00

tts

perf(test): speed up Vitest bootstrap

2026-02-14 12:13:27 +00:00

tui

refactor(tui): clarify searchable select list width layout (#16378)

2026-02-14 19:15:38 +01:00

types

fix: update pi packages to 0.51.0, remove bogus type augmentation

2026-02-02 01:52:33 +01:00

utils

refactor(utils): share safe json stringify

2026-02-14 15:39:46 +00:00

web

refactor(test): migrate web auto-reply tests to harness

2026-02-14 19:04:39 +00:00

whatsapp

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

wizard

fix: Docker installation keeps hanging on MacOS (#12972)

2026-02-14 19:46:07 +01:00

channel-web.barrel.test.ts

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

channel-web.ts

…

docker-setup.test.ts

perf(test): speed up hot test files

2026-02-14 02:55:39 +00:00

entry.ts

refactor(cli): share windows argv normalization

2026-02-14 15:39:46 +00:00

extensionAPI.ts

chore: Migrate to tsdown, speed up JS bundling by ~10x (thanks @hyf0).

2026-02-03 20:18:16 +09:00

globals.test.ts

…

globals.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

index.test.ts

…

index.ts

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

logger.test.ts

perf(test): reduce vitest logging overhead and media fixture cost

2026-02-14 00:59:53 +00:00

logger.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

logging.ts

perf(test): eliminate resetModules via injectable seams

2026-02-13 16:20:37 +00:00

polls.test.ts

refactor(outbound): dedupe poll threading + tighten duration semantics

2026-02-14 19:03:46 +01:00

polls.ts

refactor(outbound): dedupe poll threading + tighten duration semantics

2026-02-14 19:03:46 +01:00

runtime.ts

fix: Docker installation keeps hanging on MacOS (#12972)

2026-02-14 19:46:07 +01:00

utils.test.ts

fix(paths): structurally resolve home dir to prevent Windows path bugs (#12125)

2026-02-08 20:06:29 -05:00

utils.ts

Deduplicate more

2026-02-09 18:56:58 -08:00

version.test.ts

fix: CLI harden update restart imports and fix nested bundle version resolution

2026-02-06 00:09:48 -05:00

version.ts

fix: CLI harden update restart imports and fix nested bundle version resolution

2026-02-06 00:09:48 -05:00