Vincent Koc a19a7f5e6e feat(security): Harden Docker browser container chromium flags (#23889) (#31504) ...

* Gateway: honor OPENCLAW_GATEWAY_URL override for remote/local calls

* Agents: fix sandbox sessionKey usage for PI embedded subagent calls

* Sandbox: tighten browser container Chromium runtime flags

* fix: add sandbox browser defaults for container hardening

* docs: expand sandbox browser default flags list

* fix: make sandbox browser flags optional and preserve gateway env auth overrides

* docs: scope PR 31504 changelog entry

* style: format gateway call override handling

* fix: dedupe sandbox browser chrome args

* fix: preserve remote tls fingerprint for env gateway override

* fix: enforce auth for env gateway URL override

* chore: document gateway override auth security expectations

2026-03-02 11:28:27 -08:00

..

acp

windows: unify non-core spawn handling across acp qmd and docker (openclaw#31750) thanks @Takhoffman

2026-03-02 08:05:39 -06:00

agents

feat(security): Harden Docker browser container chromium flags (#23889) (#31504)

2026-03-02 11:28:27 -08:00

auto-reply

fix(slack): guard against undefined text in includes calls during mention handling

2026-03-02 19:00:08 +00:00

browser

fix(browser): default to openclaw profile when unspecified (#32031)

2026-03-02 18:34:37 +00:00

canvas-host

refactor(agents): centralize tool display definitions

2026-03-02 12:13:45 +00:00

channels

sendPayload: add chunking, empty-payload guard, and tests

2026-03-02 15:35:47 +00:00

cli

fix(cli): apply --profile before dotenv bootstrap in runCli (#31950)

2026-03-02 18:09:45 +00:00

commands

perf(test): speed up setup and config path resolution

2026-03-02 18:41:58 +00:00

compat

…

config

test(perf): trim repeated setup in cron memory and config suites

2026-03-02 19:16:46 +00:00

cron

test(perf): trim repeated setup in cron memory and config suites

2026-03-02 19:16:46 +00:00

daemon

fix(launchd): set restrictive umask in gateway plist

2026-03-02 18:38:56 +00:00

discord

refactor(security): split safe-regex parse and bounded matching

2026-03-02 16:47:00 +00:00

docs

…

gateway

feat(security): Harden Docker browser container chromium flags (#23889) (#31504)

2026-03-02 11:28:27 -08:00

hooks

refactor(security): unify hardened install and fs write flows

2026-03-02 17:23:29 +00:00

i18n

fix(ci): resolve i18n typing and generated-policy drift

2026-03-02 04:29:18 +00:00

imessage

refactor(extensions): dedupe channel config, onboarding, and monitors

2026-03-02 08:54:20 +00:00

infra

refactor(security): split gateway auth suites and share safe write path checks

2026-03-02 18:07:03 +00:00

line

fix: harden webhook auth-before-body handling

2026-03-02 17:21:09 +00:00

link-understanding

…

logging

perf(logging): skip config/fs work in default silent test path

2026-03-02 18:41:58 +00:00

markdown

refactor: split telegram delivery and unify media/frontmatter/i18n pipelines

2026-03-02 04:14:06 +00:00

media

refactor(net): unify proxy env checks and guarded fetch modes

2026-03-02 16:24:26 +00:00

media-understanding

test(perf): align media auto-detect no-key mock with scenario

2026-03-02 12:20:51 +00:00

memory

test(perf): trim repeated setup in cron memory and config suites

2026-03-02 19:16:46 +00:00

node-host

refactor(security): table-drive wrapper approval pinning tests

2026-03-02 17:30:48 +00:00

pairing

fix(pairing): handle missing accountId in allowFrom reads (#31369)

2026-03-01 23:24:33 -08:00

plugin-sdk

refactor: split webhook ingress and policy guards

2026-03-02 18:02:21 +00:00

plugins

fix: harden plugin command registration + telegram menu guard (#31997) (thanks @liuxiaopai-ai)

2026-03-02 19:04:56 +00:00

process

test(process): replace no-output timer subprocess with spawn mock

2026-03-02 19:16:46 +00:00

providers

…

routing

fix(agents): validate sessions_spawn agentId format (#31381)

2026-03-02 15:59:45 +00:00

scripts

…

secrets

fix(secrets): ignore stdin EPIPE from fast-exit exec resolvers

2026-03-02 15:47:21 +00:00

security

refactor(security): split safe-regex parse and bounded matching

2026-03-02 16:47:00 +00:00

sessions

test(integration): dedupe messaging, secrets, and plugin test suites

2026-03-02 07:13:11 +00:00

shared

refactor(ui): share channel config extras and hint types

2026-03-02 15:21:19 +00:00

signal

fix(signal): land #31138 syncMessage presence filtering (@Sid-Qin)

2026-03-02 03:28:25 +00:00

slack

fix: harden slack debounce key routing and ordering (#31951) (thanks @scoootscooob)

2026-03-02 19:18:25 +00:00

telegram

fix(telegram): scope command-sync hash cache by bot identity (#32059)

2026-03-02 19:25:19 +00:00

terminal

fix(cli): preserve json stdout while keeping doctor migration (#24368) (thanks @altaywtf)

2026-03-02 03:10:02 +00:00

test-helpers

…

test-utils

test(guardrails): exclude suite files and harden auth temp identity naming

2026-03-02 18:21:13 +00:00

tts

fix(tts): use opus format and enable voice bubbles for feishu and whatsapp (#27366)

2026-02-27 23:41:22 -06:00

tui

test(integration): dedupe messaging, secrets, and plugin test suites

2026-03-02 07:13:11 +00:00

types

…

utils

fix(agents): add forward-compat fallback for google-gemini-cli gemini-3.1-pro/flash-preview (#26570)

2026-02-26 18:39:13 -05:00

web

test: move integration-heavy suites to e2e lane

2026-03-02 05:33:07 +00:00

whatsapp

…

wizard

fix(security): harden sms.send dangerous-node defaults

2026-03-02 16:06:52 +00:00

channel-web.ts

…

docker-image-digests.test.ts

…

docker-setup.e2e.test.ts

feat(docker): add opt-in sandbox support for Docker deployments (#29974)

2026-03-01 23:06:10 -08:00

dockerfile.test.ts

fix(docker): harden /app/extensions permissions to 755 (#30191)

2026-03-01 15:45:21 -08:00

entry.ts

CLI: add root --help fast path and lazy channel option resolution (#30975)

2026-03-01 14:23:46 -08:00

extensionAPI.ts

…

globals.ts

…

index.ts

…

logger.test.ts

…

logger.ts

…

logging.ts

…

polls.test.ts

…

polls.ts

…

runtime.ts

…

utils.test.ts

…

utils.ts

…

version.test.ts

refactor: centralize delivery/path/media/version lifecycle

2026-03-02 04:04:36 +00:00

version.ts

refactor: centralize delivery/path/media/version lifecycle

2026-03-02 04:04:36 +00:00