Skip to content

Validate sandbox bind parent paths [AI]#91741

Merged
eleqtrizit merged 1 commit into
openclaw:mainfrom
mmaps:maintenance/update-20260609-175713-cd6530
Jun 9, 2026
Merged

Validate sandbox bind parent paths [AI]#91741
eleqtrizit merged 1 commit into
openclaw:mainfrom
mmaps:maintenance/update-20260609-175713-cd6530

Conversation

@mmaps

@mmaps mmaps commented Jun 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

  • Validate sandbox bind sources in both path directions, so a bind source that contains a blocked descendant is rejected.
  • Keep project-specific parent mounts such as /var/data valid when they do not cover blocked paths.
  • Add focused regression coverage for parent bind sources and the Docker create-args validation path.
  • AI-assisted.

Linked context

No public issue is linked.

Real behavior proof (required for external PRs)

  • Behavior or issue addressed: Docker sandbox bind source validation now rejects parent sources that cover blocked descendants.

  • Real environment tested: Local Linux checkout using the actual Docker create-args runtime path plus the repo Vitest wrapper.

  • Exact steps or command run after this patch: node --import tsx script importing buildSandboxCreateArgs from src/agents/sandbox/docker.ts, plus node scripts/run-vitest.mjs src/agents/sandbox/validate-sandbox-security.test.ts src/agents/sandbox-create-args.test.ts

  • Evidence after fix:

    broad-var-parent: BLOCKED Sandbox security: bind mount "/var:/mnt/var:ro" covers blocked path "/var/run". Mounting system directories, credential paths, or Docker socket paths into sandbox containers is not allowed. Use project-specific paths instead (e.g. /home/user/myproject).
project-var-data: ALLOWED ["/var/data/myapp:/data:ro"]
tmp-project: ALLOWED ["/tmp/openclaw-bind-proof-0UVoq1:/data:ro"]

  • Observed result after fix: The real Docker argument builder rejects a broad parent bind before container creation and still emits -v arguments for narrower project-specific binds.

  • What was not tested: Full Docker daemon container startup and broad CI have not completed yet.

  • Proof limitations or environment constraints: The real proof covers the runtime validation path that runs immediately before Docker container creation; it does not start a Docker container.

  • Before evidence (optional but encouraged): Existing tests allowed /var as a parent source; the updated regression now expects that source to be rejected.

Tests and validation

  • node scripts/run-vitest.mjs src/agents/sandbox/validate-sandbox-security.test.ts src/agents/sandbox-create-args.test.ts
  • pnpm format:check -- src/agents/sandbox/validate-sandbox-security.ts src/agents/sandbox/validate-sandbox-security.test.ts src/agents/sandbox-create-args.test.ts
  • node scripts/run-oxlint.mjs src/agents/sandbox/validate-sandbox-security.ts src/agents/sandbox/validate-sandbox-security.test.ts src/agents/sandbox-create-args.test.ts
  • git diff --check

Regression coverage was added for parent sources that cover blocked descendants and for the Docker create-args path that runs sandbox validation.

Risk checklist

  • Did user-visible behavior change? Yes
  • Did config, environment, or migration behavior change? No
  • Did security, auth, secrets, network, or tool execution behavior change? Yes
  • Highest-risk area: Existing sandbox configs that bind broad host parent directories may now fail validation.
  • Risk mitigation: The change is limited to blocked-path coverage checks, keeps narrower project paths valid, and is covered by focused regression tests.

Current review state

  • Next action: Run automated review, private completeness gates, and CI checks.
  • Waiting on: Review refresh, post-solve gates, and CI.
  • Bot or reviewer comments addressed: Added real Docker create-args behavior proof for the parent-bind rejection and narrow-bind allow case.

@mmaps mmaps requested a review from a team as a code owner June 9, 2026 18:06
@openclaw-barnacle openclaw-barnacle Bot added docker Docker and sandbox tooling agents Agent runtime and tooling size: S proof: supplied External PR includes structured after-fix real behavior proof. labels Jun 9, 2026
@clawsweeper

clawsweeper Bot commented Jun 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed June 9, 2026, 2:27 PM ET / 18:27 UTC.

Summary
The PR changes shared sandbox bind validation to reject host bind sources that cover blocked descendants and adds validator/create-args regression tests.

PR surface: Source +4, Tests +36. Total +40 across 3 files.

Reproducibility: yes. from source inspection: current main only checks whether the source is equal to or under a blocked path, and its tests explicitly allowed /var:/var. The PR updates those expectations to reject parent sources covering blocked descendants.

Review metrics: 1 noteworthy metric.

  • Sandbox validation policy: 1 fail-closed parent-bind rule added; 0 config flags added. The change tightens runtime acceptance of existing sandbox bind configs without adding an upgrade switch.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • none.

Risk before merge

  • [P1] Existing sandbox or browser configs that bind broad host parents such as /var or a whole home directory can now fail before Docker create instead of starting.
  • [P1] The PR body proves the changed pre-create argument builder path, but not a full Docker daemon container startup; that is acceptable for this specific validation path but still leaves broader runtime smoke coverage to CI or maintainer testing.

Maintainer options:

  1. Accept documented fail-closed hardening (recommended)
    Treat broad parent binds that expose blocked descendants as unsupported and carry release-note context for users who need narrower project-specific binds.
  2. Add an upgrade-safe alternative
    If maintainers consider broad parent binds a supported upgrade contract, add an explicit reviewed compatibility path before merging this fail-closed change.
  3. Pause until secops reviews the policy
    If ownership approval is unclear, hold the PR for the CODEOWNERS security reviewers instead of merging a sandbox policy change by automation.

Next step before merge

  • [P2] Manual review is needed for compatibility acceptance and normal merge readiness; there is no narrow automated repair to request.

Security
Cleared: The diff tightens sandbox bind validation and adds focused regression coverage; no supply-chain, secret-handling, or security-boundary weakening concern was found.

Review details

Best possible solution:

Land the shared-validator hardening after maintainer acceptance of the fail-closed upgrade impact and normal CI, with release-note context for broad bind configs.

Do we have a high-confidence way to reproduce the issue?

Yes from source inspection: current main only checks whether the source is equal to or under a blocked path, and its tests explicitly allowed /var:/var. The PR updates those expectations to reject parent sources covering blocked descendants.

Is this the best way to solve the issue?

Yes, this is the right layer because the shared validator gates Docker create args and security audit diagnostics, and the docs already describe parent mounts exposing blocked paths as blocked. The remaining decision is whether maintainers accept the upgrade impact of enforcing that documented policy.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 52154eda0dd1.

Label changes

Label changes:

  • add proof: sufficient: Contributor real behavior proof is sufficient. The PR body supplies after-fix live output from the actual buildSandboxCreateArgs path showing the broad parent bind rejected and narrower binds accepted before Docker create arguments are emitted.
  • add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
  • add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body supplies after-fix live output from the actual buildSandboxCreateArgs path showing the broad parent bind rejected and narrower binds accepted before Docker create arguments are emitted.
  • remove rating: 🦪 silver shellfish: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.
  • remove status: 📣 needs proof: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

  • P2: This is a normal-priority sandbox hardening fix with limited but real compatibility impact for broad bind configurations.
  • merge-risk: 🚨 compatibility: Merging can make existing sandbox configs that bind broad host parent directories fail during Docker sandbox startup.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body supplies after-fix live output from the actual buildSandboxCreateArgs path showing the broad parent bind rejected and narrower binds accepted before Docker create arguments are emitted.
  • proof: sufficient: Contributor real behavior proof is sufficient. The PR body supplies after-fix live output from the actual buildSandboxCreateArgs path showing the broad parent bind rejected and narrower binds accepted before Docker create arguments are emitted.
Evidence reviewed

PR surface:

Source +4, Tests +36. Total +40 across 3 files.

View PR surface stats
Area Files Added Removed Net
Source 1 14 10 +4
Tests 2 40 4 +36
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 3 54 14 +40

What I checked:

Likely related people:

  • openclaw/openclaw-secops: The sandbox validator and sandbox directory are security-sensitive paths assigned to this owner group in CODEOWNERS. (role: CODEOWNERS review owner; confidence: high; files: .github/CODEOWNERS, src/agents/sandbox/validate-sandbox-security.ts, src/agents/sandbox/docker.ts)
  • cxy: Local blame for the relevant current-main validator and Docker create-args lines points to d12b7b0, though the grafted checkout makes this a weak ownership signal. (role: current-main snapshot carrier; confidence: low; commits: d12b7b055189; files: src/agents/sandbox/validate-sandbox-security.ts, src/agents/sandbox/docker.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. labels Jun 9, 2026
@mmaps

mmaps commented Jun 9, 2026

Copy link
Copy Markdown
Contributor Author

Real create-args proof has been added to the PR body. It shows the broad parent bind rejected before Docker arguments are emitted and narrower project-specific binds still allowed.

@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented Jun 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. and removed rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. labels Jun 9, 2026
@mmaps

mmaps commented Jun 9, 2026

Copy link
Copy Markdown
Contributor Author

Verification before merge:

Behavior addressed: Sandbox bind validation now rejects broad host parent sources that contain blocked descendants while keeping narrower project-specific binds allowed.
Real environment tested: Local Linux checkout, real Docker create-args runtime path, repo Vitest wrapper, repo formatting/lint wrappers, GitHub PR checks, repo-local autoreview, ClawSweeper re-review, and private completeness gates.
Exact steps or commands run after this patch:

  • node scripts/run-vitest.mjs src/agents/sandbox/validate-sandbox-security.test.ts src/agents/sandbox-create-args.test.ts
  • pnpm format:check -- src/agents/sandbox/validate-sandbox-security.ts src/agents/sandbox/validate-sandbox-security.test.ts src/agents/sandbox-create-args.test.ts
  • node scripts/run-oxlint.mjs src/agents/sandbox/validate-sandbox-security.ts src/agents/sandbox/validate-sandbox-security.test.ts src/agents/sandbox-create-args.test.ts
  • git diff --check
  • node --import tsx inline proof importing buildSandboxCreateArgs from src/agents/sandbox/docker.ts
  • .agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main
    Evidence after fix:
  • Runtime proof showed /var:/mnt/var:ro rejected with covers blocked path "/var/run".
  • Runtime proof showed /var/data/myapp:/data:ro and a temp project bind allowed and emitted as -v bind args.
  • Focused Vitest passed: 2 shards, 52 tests.
  • Private dry-run gate: passed for head 5441c032b1e5c421a8f28f3c2df46912b8b8f568.
  • Real private gate: passed for head 5441c032b1e5c421a8f28f3c2df46912b8b8f568.
  • Repo-local autoreview: clean, no accepted/actionable findings.
  • ClawSweeper re-review: proof: sufficient, status: ready for maintainer look.
  • GitHub PR checks: 134 pass, 30 skipped, 0 active/failing for head 5441c032b1e5c421a8f28f3c2df46912b8b8f568.
    Observed result after fix: The runtime validation gate stops broad parent binds before Docker bind args are appended, and narrower safe bind sources still pass.
    What was not tested: Full Docker daemon container startup was not run locally; the runtime gate immediately before Docker container creation was tested directly.

Regression Risk:
Medium. Existing sandbox or browser configs that bind broad host parents such as /var or a whole home directory may now fail closed; no config keys, defaults, schemas, or wire formats changed.

Best fix verdict:
Appropriate layer and scope. The shared sandbox bind validator owns this decision, so normal Docker sandbox creation, browser sandbox creation, create-args tests, and audit checks share the same corrected path relation.

User behavior change:
Before, broad parent bind sources could be accepted even when they exposed blocked descendants. After, those broad binds are rejected with covers blocked path; project-specific binds such as /var/data/myapp:/data:ro remain allowed.

@eleqtrizit eleqtrizit self-requested a review June 9, 2026 19:31
@eleqtrizit eleqtrizit merged commit a90eb93 into openclaw:main Jun 9, 2026
261 of 276 checks passed
@eleqtrizit

eleqtrizit commented Jun 9, 2026

Copy link
Copy Markdown
Contributor

Summary of Checks Completed

This PR hardens the sandbox bind-mount validator to reject host source paths that contain blocked descendant paths (e.g., mounting /var to expose /var/run/docker.sock). Here is a plain-English summary of every check performed to ensure the change is correct, compatible, and safe.

Relevance

The issue is a real security vulnerability — a sandbox bypass where the bind-mount validator only checked if a source path was inside a blocked path, but never checked if the source path contained a blocked path. This allowed mounting broad parent directories like /var or $HOME to expose the Docker socket, credentials, SSH keys, and other sensitive paths the denylist exists to protect. The fix closes that gap by adding a reverse containment check.

Compatibility

The fix is minimal and targeted. Narrow project-specific mounts like /var/data/myapp:/data:ro remain allowed. Only unsafe broad mounts that previously bypassed the denylist are now blocked — this is the intended security hardening. No config keys, defaults, schemas, wire formats, or environment variables changed. Existing configs that bind broad host parents will now fail closed before container creation, which is the correct security behavior.

ClawSweeper

ClawSweeper reviewed the PR and rated it ready for maintainer look with proof sufficient. The review confirmed the fix is correct, the security boundary is properly tightened, and no correctness issues exist. The only noted items are documented risks (fail-closed for broad bind configs, needs maintainer compatibility acceptance) — not problems with the fix itself.

Code Reviews Completed

The code was reviewed through multiple automated passes covering correctness, security, compatibility, and completeness. All reviews converged on the same conclusion: the fix is correct, well-scoped, and the right hardening for this vulnerability.

Checks Completed

Check Status
Local unit tests — sandbox validation and Docker create-args test suites ✅ Passed (52 tests across 2 shards)
Real runtime proof — live Docker create-args validation with broad parent bind (/var:/mnt/var) rejected and narrow bind (/var/data:/data) allowed ✅ Verified
Formatting check — oxfmt on all changed files ✅ Passed
Linting — oxlint on all changed files ✅ Passed
Git diff whitespace check ✅ Passed
Import cycle check ✅ Passed
Shrinkwrap integrity check ✅ Passed
Production type check ✅ Passed
Test type check ✅ Passed
Dependency guard ✅ Passed
Dependency guard (detect) ✅ Passed
Security fast scan ✅ Passed
Security high — core auth/secrets ✅ Passed
Security high — channel runtime boundary ✅ Passed
Security high — network SSRF boundary ✅ Passed
Security high — MCP process tool boundary ✅ Passed
Security high — plugin trust boundary ✅ Passed
Security high — actions ✅ Passed
Critical Quality — core auth/secrets ✅ Passed
Critical Quality shard selection ✅ Passed
CodeQL analysis ✅ Passed
Opengrep OSS analysis ✅ Passed
Socket Security — project report ✅ Passed
Socket Security — PR alerts ✅ Passed
Actionlint (GitHub Actions) ✅ Passed
Build artifacts ✅ Passed
No tabs check ✅ Passed
Preflight ✅ Passed
pnpm store warmup ✅ Passed
Fast checks — bundled protocol ✅ Passed
Fast checks — bun launcher ✅ Passed
Fast checks — contracts plugins (A, B) ✅ Passed
Fast checks — contracts channels (A, B) ✅ Passed
Node core fast checks ✅ Passed
Node core source security ✅ Passed
Node core UI ✅ Passed
Node core support ✅ Passed
Node core runtime hooks ✅ Passed
Node core runtime infrastructure — approval/exec, channel/plugin, CLI/UI, device, diagnostics/state, core utils, env/auth, events/runtime, file safety, files/commands, gateway/lock/argv, gateway/processes, gateway/watch, heartbeat/core, heartbeat/runner, misc/dedupe/disk, misc/OS, misc/values, net/install, network/node, network/platform, outbound/actions, outbound/core, provider/push, repo/tooling, storage/state, system/runtime, process ✅ All passed
Node core runtime secrets ✅ Passed
Node core runtime media UI ✅ Passed
Node core runtime shared ✅ Passed
Node core runtime cron — core, isolated agent, service ✅ All passed
Node agentic control plane — agent chat, auth/node, HTTP models, HTTP plugin/WS, runtime, runtime config, runtime cron, runtime events, runtime network, runtime server, runtime shared token, runtime state, runtime UI tools, startup config, startup core, startup health/runtime, startup restart/close ✅ All passed
Node agentic CLI ✅ Passed
Node agentic command support ✅ Passed
Node agentic commands — agent/channel, doctor, doctor/auth, doctor/config/state, doctor/device, doctor/gateway, doctor/platform, doctor/plugins/tools, doctor/sessions/cron, doctor/shared, doctor/whatsapp, doctor/workspace, models, onboard/config, status/tools ✅ All passed
Node agentic agents — core auth, core models, core tools, core subagents, core runner, core runtime, embedded, support, tools ✅ All passed
Node agentic gateway — core, methods ✅ All passed
Node agentic plugin SDK ✅ Passed
Node auto-reply — core top-level, reply agent runner, reply commands, reply dispatch, reply session, reply state/routing ✅ All passed
Check guards ✅ Passed
Check additional boundaries (A, BCD) ✅ All passed
Check additional extensions — channels, bundled, package boundary ✅ All passed
Check additional runtime topology/architecture ✅ Passed
CI timings summary ✅ Passed
Repo-local autoreview — no accepted/actionable findings ✅ Clean
ClawSweeper review — proof sufficient, ready for maintainer look ✅ Reviewed
Private completeness gates — dry run and real run ✅ Both passed
GitHub CI checks — 134 passed, 30 skipped, 0 active/failing ✅ Clean

Abbreviations

Abbreviation Definition
CI Continuous Integration — automated build, test, and validation pipelines
CLI Command-Line Interface
CVE Common Vulnerabilities and Exposures — a standard for identifying security vulnerabilities
CVSS Common Vulnerability Scoring System — a standard for rating severity of security vulnerabilities
E2E End-to-End testing
GHSA GitHub Security Advisory
HTTP Hypertext Transfer Protocol
MCP Model Context Protocol
OSS Open-Source Software
PR Pull Request
SDK Software Development Kit
SQL Structured Query Language
SSRF Server-Side Request Forgery
UI User Interface
WS / WebSocket WebSocket protocol

@github-actions github-actions Bot mentioned this pull request Jun 9, 2026
Open
@Haderach-Ram Haderach-Ram mentioned this pull request Jun 10, 2026
Open
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jun 10, 2026
@mmaps
Harden sandbox bind source validation (openclaw#91741)
d875395
eleboucher pushed a commit to eleboucher/homelab that referenced this pull request Jun 12, 2026
@eleboucher
fix(container): update image ghcr.io/openclaw/openclaw (2026.6.5 ➔ 20…
bb872cc 
…26.6.6) (#1040)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.6.5` → `2026.6.6` |

---

### Release Notes

<details>
<summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary>

### [`v2026.6.6`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#202666)

[Compare Source](openclaw/openclaw@v2026.6.5...v2026.6.6)

##### Highlights

- Security boundaries are substantially tighter across transcripts, sandbox binds, host environment inheritance, MCP stdio, Codex HTTP access, native search policy, elevated sender checks, deleted-agent ACP bypasses, loopback tools, Discord moderation, and Teams group actions; exec approvals now fail closed on timeout. ([#&#8203;91529](openclaw/openclaw#91529), [#&#8203;91618](openclaw/openclaw#91618), [#&#8203;91615](openclaw/openclaw#91615), [#&#8203;91619](openclaw/openclaw#91619), [#&#8203;91741](openclaw/openclaw#91741), [#&#8203;91745](openclaw/openclaw#91745), [#&#8203;91746](openclaw/openclaw#91746), [#&#8203;91748](openclaw/openclaw#91748), [#&#8203;91749](openclaw/openclaw#91749), [#&#8203;91750](openclaw/openclaw#91750), [#&#8203;91751](openclaw/openclaw#91751), [#&#8203;91752](openclaw/openclaw#91752), [#&#8203;91763](openclaw/openclaw#91763), [#&#8203;89938](openclaw/openclaw#89938)) Thanks [@&#8203;joshavant](https://github.com/joshavant), [@&#8203;pgondhi987](https://github.com/pgondhi987), [@&#8203;mmaps](https://github.com/mmaps), [@&#8203;eleqtrizit](https://github.com/eleqtrizit), [@&#8203;shakkernerd](https://github.com/shakkernerd), and [@&#8203;drobison00](https://github.com/drobison00).
- Telegram delivery is safer and more coherent: account-scoped topics route to the right agent, streamed text survives tool calls, `/compact` works on generic ingress, callback handling uses concrete APIs, draft chunking is shared, durable dispatch dedupe moved into the SDK, and unauthorized DM text stays out of cache and prompt context. ([#&#8203;91189](openclaw/openclaw#91189), [#&#8203;88682](openclaw/openclaw#88682), [#&#8203;89588](openclaw/openclaw#89588), [#&#8203;90212](openclaw/openclaw#90212), [#&#8203;91876](openclaw/openclaw#91876), [#&#8203;91874](openclaw/openclaw#91874), [#&#8203;91904](openclaw/openclaw#91904), [#&#8203;91478](openclaw/openclaw#91478), [#&#8203;91915](openclaw/openclaw#91915)) Thanks [@&#8203;codysai001](https://github.com/codysai001), [@&#8203;alexzhu0](https://github.com/alexzhu0), [@&#8203;joelnishanth](https://github.com/joelnishanth), [@&#8203;snowzlm](https://github.com/snowzlm), [@&#8203;obviyus](https://github.com/obviyus), and [@&#8203;sallyom](https://github.com/sallyom).
- iMessage recovery and delivery now cover always-on inbound restart, durable echo markers, block streaming, idle approval discovery, hardened outbound transport, and actionable inbound startup diagnostics. ([#&#8203;91335](openclaw/openclaw#91335), [#&#8203;91449](openclaw/openclaw#91449), [#&#8203;88969](openclaw/openclaw#88969), [#&#8203;88530](openclaw/openclaw#88530), [#&#8203;91783](openclaw/openclaw#91783), [#&#8203;91785](openclaw/openclaw#91785)) Thanks [@&#8203;omarshahine](https://github.com/omarshahine), [@&#8203;jmissig](https://github.com/jmissig), and [@&#8203;colmbrogan](https://github.com/colmbrogan).
- Browser and MCP connectivity gained existing-session CDP support, discovered WebSocket validation, default-profile `cdpUrl` handling, safer browser-output boundaries, Streamable HTTP loopback transport, corrected OAuth/SSE authorization handling, and broader schema compatibility. ([#&#8203;91422](openclaw/openclaw#91422), [#&#8203;89851](openclaw/openclaw#89851), [#&#8203;91736](openclaw/openclaw#91736), [#&#8203;91747](openclaw/openclaw#91747), [#&#8203;91451](openclaw/openclaw#91451), [#&#8203;80143](openclaw/openclaw#80143)) Thanks [@&#8203;pgondhi987](https://github.com/pgondhi987), [@&#8203;anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia), [@&#8203;lifuyue](https://github.com/lifuyue), [@&#8203;eleqtrizit](https://github.com/eleqtrizit), [@&#8203;LiuwqGit](https://github.com/LiuwqGit), and [@&#8203;HemantSudarshan](https://github.com/HemantSudarshan).
- Control UI startup and first-reply latency are lower through cached model metadata, removal of the startup catalog wait, lazy slash-command loading, and first-event tracing with slow-reply diagnostics. ([#&#8203;91531](openclaw/openclaw#91531), [#&#8203;91538](openclaw/openclaw#91538), [#&#8203;91568](openclaw/openclaw#91568), [#&#8203;91583](openclaw/openclaw#91583), [#&#8203;91598](openclaw/openclaw#91598))
- Provider support expands with OpenRouter OAuth onboarding and Claude Fable 5 adaptive thinking, while Codex sessions keep correct compaction ownership, local models skip guardian review, dynamic tool progress normalizes cleanly, and Gemma 4 reasoning replay is preserved. ([#&#8203;91830](openclaw/openclaw#91830), [#&#8203;91882](openclaw/openclaw#91882), [#&#8203;91590](openclaw/openclaw#91590), [#&#8203;88630](openclaw/openclaw#88630), [#&#8203;88768](openclaw/openclaw#88768), [#&#8203;91696](openclaw/openclaw#91696)) Thanks [@&#8203;Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@&#8203;joshavant](https://github.com/joshavant), [@&#8203;bdjben](https://github.com/bdjben), and [@&#8203;Coder-Wangyankun](https://github.com/Coder-Wangyankun).

##### Changes

- CLI progress: emit Claude CLI commentary progress events and bridge inter-tool commentary into channel progress without exposing internal protocol scaffolding. ([#&#8203;89834](openclaw/openclaw#89834), [#&#8203;90883](openclaw/openclaw#90883)) Thanks [@&#8203;anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia).
- Observability: allow trusted diagnostics channels to capture tool input/output content, add first-assistant-event traces, and warn on slow initial replies. ([#&#8203;91256](openclaw/openclaw#91256), [#&#8203;91568](openclaw/openclaw#91568), [#&#8203;91583](openclaw/openclaw#91583)) Thanks [@&#8203;amknight](https://github.com/amknight).
- Plugins/ClawHub: dogfood reusable package publishing, let dry runs skip publish approval, allow declared installed trusted hooks, report managed plugin version drift, and warn instead of failing on retired Skill Workshop configuration. ([#&#8203;91574](openclaw/openclaw#91574), [#&#8203;91591](openclaw/openclaw#91591), [#&#8203;90004](openclaw/openclaw#90004), [#&#8203;90927](openclaw/openclaw#90927), [#&#8203;90838](openclaw/openclaw#90838)) Thanks [@&#8203;Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@&#8203;brokemac79](https://github.com/brokemac79), and [@&#8203;lonexreb](https://github.com/lonexreb).
- Memory/providers: move the local llama.cpp runtime into its provider plugin, batch embeddings across files, persist the agent model catalog cache, and keep QMD JSON search one-shot while filtering stale REM recall previews. ([#&#8203;91324](openclaw/openclaw#91324), [#&#8203;89138](openclaw/openclaw#89138), [#&#8203;90457](openclaw/openclaw#90457), [#&#8203;91837](openclaw/openclaw#91837), [#&#8203;91851](openclaw/openclaw#91851)) Thanks [@&#8203;osolmaz](https://github.com/osolmaz), [@&#8203;mushuiyu886](https://github.com/mushuiyu886), [@&#8203;ai-hpc](https://github.com/ai-hpc), and [@&#8203;TurboTheTurtle](https://github.com/TurboTheTurtle).
- Channels/mobile: add the QQBot group mention toggle, improve iPad and iPhone control surfaces, and expose the active connection host in the TUI footer. ([#&#8203;91423](openclaw/openclaw#91423), [#&#8203;91557](openclaw/openclaw#91557), [#&#8203;89909](openclaw/openclaw#89909)) Thanks [@&#8203;cxyhhhhh](https://github.com/cxyhhhhh), [@&#8203;Solvely-Colin](https://github.com/Solvely-Colin), and [@&#8203;baskduf](https://github.com/baskduf).
- Performance: prewarm TUI runtime plugins, deduplicate plugin auto-enable fanout, trim dense text-delta snapshots, and reuse prepared startup model metadata. ([#&#8203;90782](openclaw/openclaw#90782), [#&#8203;89978](openclaw/openclaw#89978), [#&#8203;91580](openclaw/openclaw#91580), [#&#8203;91531](openclaw/openclaw#91531)) Thanks [@&#8203;RomneyDa](https://github.com/RomneyDa) and [@&#8203;ai-hpc](https://github.com/ai-hpc).

##### Fixes

- Agent/session recovery: drop stale approval follow-ups after session rebind, remove drained reply-queue items by identity, recover stale main and visible replies, preserve Codex context-engine compaction ownership, lower the default compaction timeout to 180 seconds while respecting explicit configuration, and keep provider-failure terminal lifecycle state correct. ([#&#8203;85679](openclaw/openclaw#85679), [#&#8203;91450](openclaw/openclaw#91450), [#&#8203;91566](openclaw/openclaw#91566), [#&#8203;91840](openclaw/openclaw#91840), [#&#8203;91590](openclaw/openclaw#91590), [#&#8203;91361](openclaw/openclaw#91361), [#&#8203;91895](openclaw/openclaw#91895)) Thanks [@&#8203;openperf](https://github.com/openperf), [@&#8203;yetval](https://github.com/yetval), [@&#8203;joshavant](https://github.com/joshavant), [@&#8203;wangmiao0668000666](https://github.com/wangmiao0668000666), and [@&#8203;TurboTheTurtle](https://github.com/TurboTheTurtle).
- User-visible content boundaries: suppress Codex/Harmony protocol artifacts, neutralize browser and LanceDB memory media directives, redact transcript images, and preserve native `/compact` replies through source suppression. ([#&#8203;89151](openclaw/openclaw#89151), [#&#8203;91422](openclaw/openclaw#91422), [#&#8203;91425](openclaw/openclaw#91425), [#&#8203;91529](openclaw/openclaw#91529), [#&#8203;90212](openclaw/openclaw#90212)) Thanks [@&#8203;joelnishanth](https://github.com/joelnishanth), [@&#8203;pgondhi987](https://github.com/pgondhi987), [@&#8203;joshavant](https://github.com/joshavant), and [@&#8203;snowzlm](https://github.com/snowzlm).
- Channel delivery: keep WhatsApp captured replies attached to the successor controller after restart, retry Feishu rate limits, preserve Mattermost thread replies, canonicalize LINE webhook paths, restore Discord reply hydration and runtime timeout exports, and show OpenAI Realtime WebRTC assistant transcripts. ([#&#8203;85823](openclaw/openclaw#85823), [#&#8203;89659](openclaw/openclaw#89659), [#&#8203;91684](openclaw/openclaw#91684), [#&#8203;91649](openclaw/openclaw#91649), [#&#8203;90263](openclaw/openclaw#90263), [#&#8203;91686](openclaw/openclaw#91686), [#&#8203;90426](openclaw/openclaw#90426)) Thanks [@&#8203;itsuzef](https://github.com/itsuzef), [@&#8203;ladygege](https://github.com/ladygege), [@&#8203;jacobtomlinson](https://github.com/jacobtomlinson), [@&#8203;fuller-stack-dev](https://github.com/fuller-stack-dev), and [@&#8203;shushushv](https://github.com/shushushv).
- Cron: cancel active task runs cleanly, preserve terminal timeout/cancel state, and recover no-deliver tool warnings instead of silently losing the outcome. ([#&#8203;90666](openclaw/openclaw#90666), [#&#8203;90678](openclaw/openclaw#90678)) Thanks [@&#8203;ai-hpc](https://github.com/ai-hpc).
- Gateway/config/auth: share the approval runtime socket token, replace arrays explicitly in `config.patch`, skip the deleted-agent guard only for valid ACP harness sessions, surface headless LaunchAgent state, verify SQLite auth migration before cleanup, and arm QMD startup maintenance. ([#&#8203;87105](openclaw/openclaw#87105), [#&#8203;91551](openclaw/openclaw#91551), [#&#8203;91219](openclaw/openclaw#91219), [#&#8203;91614](openclaw/openclaw#91614), [#&#8203;91740](openclaw/openclaw#91740), [#&#8203;91978](openclaw/openclaw#91978)) Thanks [@&#8203;fuller-stack-dev](https://github.com/fuller-stack-dev) and [@&#8203;scotthuang](https://github.com/scotthuang).
- Providers/Codex: clarify quota errors, restore the Codex synthetic usage line, canonicalize Codex protocol assets, require API-key auth for realtime voice, normalize ACP model refs, preserve Gemma 4 `reasoning_content`, and avoid guardian review for local models. ([#&#8203;91390](openclaw/openclaw#91390), [#&#8203;91709](openclaw/openclaw#91709), [#&#8203;91507](openclaw/openclaw#91507), [#&#8203;91567](openclaw/openclaw#91567), [#&#8203;88630](openclaw/openclaw#88630), [#&#8203;91696](openclaw/openclaw#91696)) Thanks [@&#8203;hxy91819](https://github.com/hxy91819), [@&#8203;brokemac79](https://github.com/brokemac79), [@&#8203;RomneyDa](https://github.com/RomneyDa), [@&#8203;joshavant](https://github.com/joshavant), and [@&#8203;Coder-Wangyankun](https://github.com/Coder-Wangyankun).
- Updates/builds: recover package Gateway restarts after refresh failure, expose plugin convergence repair, fall back to Corepack in PATH-less pnpm environments, seed the correct Docker store packages, and keep ClawHub dry-run and publish paths reusable. ([#&#8203;91581](openclaw/openclaw#91581), [#&#8203;91599](openclaw/openclaw#91599), [#&#8203;91547](openclaw/openclaw#91547), [#&#8203;91591](openclaw/openclaw#91591)) Thanks [@&#8203;fuller-stack-dev](https://github.com/fuller-stack-dev), [@&#8203;sallyom](https://github.com/sallyom), and [@&#8203;Patrick-Erichsen](https://github.com/Patrick-Erichsen).
- UI: require explicit user intent before opening chat sessions and drain restored chat queues after session switches. ([#&#8203;91480](openclaw/openclaw#91480)) Thanks [@&#8203;TurboTheTurtle](https://github.com/TurboTheTurtle).
- Android: avoid the `dataSync` foreground-service type for persistent nodes. ([#&#8203;80082](openclaw/openclaw#80082)) Thanks [@&#8203;davelutztx](https://github.com/davelutztx).
- Native hooks: bound relay lifetimes so abandoned native hook connections cannot linger indefinitely. ([#&#8203;91550](openclaw/openclaw#91550)) Thanks [@&#8203;joshavant](https://github.com/joshavant).

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEwMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9jb250YWluZXIiLCJ0eXBlL3BhdGNoIl19-->

Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/1040
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@eleqtrizit eleqtrizit Awaiting requested review from eleqtrizit

Assignees

No one assigned

Labels

agents Agent runtime and tooling docker Docker and sandbox tooling merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. P2 Normal backlog priority with limited blast radius. proof: sufficient ClawSweeper judged the real behavior proof convincing. proof: supplied External PR includes structured after-fix real behavior proof. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. size: S status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@mmaps @eleqtrizit