Devin Robison 6a79324802 Filter untrusted CWD .env entries before OpenClaw startup (#54631) ...

* Filter untrusted CWD .env entries before OpenClaw startup

* Add missing test file

* Fix missing and updated files

* Address feedback

* Feedback updates

* Feedback update

* Add test coverage

* Unit test fix

2026-03-25 15:49:26 -06:00

..

acp

test: speed up targeted unit suites

2026-03-24 19:36:08 +00:00

agents

fix(ci): restore main green

2026-03-25 16:17:42 -05:00

auto-reply

Trigger preflight compaction from transcript estimates when usage is stale (#49479)

2026-03-25 13:22:16 -07:00

bindings

…

bootstrap

…

browser

Block reset-profile on lower-privilege browser request surfaces (#54618)

2026-03-25 13:36:59 -06:00

canvas-host

test: harden canvas host undici isolation

2026-03-23 11:54:49 -07:00

channels

Fix/telegram writeback admin scope gate (#54561)

2026-03-25 12:12:09 -06:00

cli

Filter untrusted CWD .env entries before OpenClaw startup (#54631)

2026-03-25 15:49:26 -06:00

commands

refactor(sandbox): remove tool policy facade (#54684)

2026-03-25 23:03:24 +02:00

compat

…

config

build: prepare 2026.3.24 release

2026-03-25 09:31:05 -07:00

context-engine

…

cron

cron: queue isolated delivery awareness

2026-03-25 15:21:14 +05:30

daemon

fix(runtime): support Node 22.14 installs

2026-03-25 06:22:18 -07:00

docs

…

extensions

refactor: polish trigger and manifest seams

2026-03-23 22:22:48 -07:00

gateway

Block reset-profile on lower-privilege browser request surfaces (#54618)

2026-03-25 13:36:59 -06:00

hooks

fix: skip session:patch hook clone without listeners

2026-03-25 16:12:39 +05:30

i18n

…

image-generation

test: speed up media and image-generation suites

2026-03-24 23:45:33 +00:00

infra

Filter untrusted CWD .env entries before OpenClaw startup (#54631)

2026-03-25 15:49:26 -06:00

interactive

…

line

refactor(plugins): move remaining channel and provider ownership out of src

2026-03-22 19:13:25 -07:00

link-understanding

…

logging

fix: unify log timestamp offsets (#38904) (thanks @sahilsatralkar)

2026-03-25 16:06:33 +05:30

markdown

…

media

fix: reject path traversal and home-dir patterns in media parse layer (#54642)

2026-03-25 13:35:16 -06:00

media-understanding

test: finish no-isolate suite hardening

2026-03-23 02:02:03 -07:00

memory

fix: trigger compaction on LLM timeout with high context usage (#46417)

2026-03-25 12:51:36 -07:00

node-host

Block reset-profile on lower-privilege browser request surfaces (#54618)

2026-03-25 13:36:59 -06:00

pairing

refactor: align pairing replies, daemon hints, and feishu mention policy

2026-03-25 04:22:53 -07:00

plugin-sdk

fix: stop leaking reply tags in iMessage outbound text (#39512) (thanks @mvanhorn)

2026-03-25 23:00:16 +05:30

plugins

plugin-runtime: expose runHeartbeatOnce in system API (#40299)

2026-03-25 10:47:01 -07:00

process

fix: trigger compaction on LLM timeout with high context usage (#46417)

2026-03-25 12:51:36 -07:00

routing

…

scripts

fix(image): deprecate legacy skill and clarify auth

2026-03-22 18:42:18 -07:00

secrets

fix(slack): trim DM reply overhead and restore Codex auto transport (#53957)

2026-03-24 15:03:40 -07:00

security

refactor(sandbox): remove tool policy facade (#54684)

2026-03-25 23:03:24 +02:00

sessions

…

shared

refactor: tighten split-runtime live-state guardrails

2026-03-24 21:58:50 -07:00

terminal

…

test-helpers

test: harden threaded shared-worker suites

2026-03-24 08:37:00 +00:00

test-utils

refactor: dedupe test helpers and harnesses

2026-03-24 21:41:46 +00:00

tts

chore(tts): rename VOICE_BUBBLE identifiers to OPUS and update docs

2026-03-25 10:49:21 +05:30

tui

fix(ci): restore main green

2026-03-25 16:17:42 -05:00

types

fix(types): add workspace module shims

2026-03-24 10:07:14 -07:00

utils

fix: stop leaking reply tags in iMessage outbound text (#39512) (thanks @mvanhorn)

2026-03-25 23:00:16 +05:30

web-search

fix(slack): trim DM reply overhead and restore Codex auto transport (#53957)

2026-03-24 15:03:40 -07:00

wizard

refactor: dedupe test helpers and harnesses

2026-03-24 21:41:46 +00:00

bundled-web-search-registry.ts

feat(web-search): add DuckDuckGo bundled plugin (#52629)

2026-03-22 22:05:33 -07:00

channel-web.ts

…

docker-build-cache.test.ts

fix(ci): restore stale guardrails and baselines

2026-03-23 06:50:23 +00:00

docker-image-digests.test.ts

…

docker-setup.e2e.test.ts

refactor: clarify docker setup cli phases

2026-03-24 16:46:12 -07:00

dockerfile.test.ts

…

entry.respawn.test.ts

…

entry.respawn.ts

…

entry.test.ts

feat(cli): support targeting running containerized openclaw instances (#52651)

2026-03-24 10:17:17 -04:00

entry.ts

fixes for cli-containerized (#54223)

2026-03-25 00:51:55 -04:00

entry.version-fast-path.test.ts

fixes for cli-containerized (#54223)

2026-03-25 00:51:55 -04:00

extensionAPI.test.ts

…

extensionAPI.ts

…

global-state.ts

fix: stabilize logging config imports

2026-03-24 17:21:28 +00:00

globals.ts

fix: stabilize logging config imports

2026-03-24 17:21:28 +00:00

index.test.ts

…

index.ts

…

install-sh-version.test.ts

…

library.ts

…

logger.test.ts

…

logger.ts

…

logging.ts

…

param-key.ts

…

poll-params.test.ts

…

poll-params.ts

…

polls.test.ts

…

polls.ts

…

runtime.ts

…

utils.test.ts

…

utils.ts

refactor!: drop legacy CLAWDBOT env compatibility

2026-03-22 22:13:39 -07:00

version.test.ts

…

version.ts

…