Skip to content

sync: upstream to v2026.2.25 (111 commits)#2071

Merged
alexey-pelykh merged 1 commit intomainfrom
sync/v2026.2.25
Apr 5, 2026
Merged

sync: upstream to v2026.2.25 (111 commits)#2071
alexey-pelykh merged 1 commit intomainfrom
sync/v2026.2.25

Conversation

@alexey-pelykh
Copy link
Copy Markdown

@alexey-pelykh alexey-pelykh commented Apr 5, 2026

Summary

DIFF-SYNC batch 1: applies upstream changes from fork-base to v2026.2.25 (111 commits, 251 files).

187 files changed, +9,379 / -2,886 lines.

Disposition breakdown:

  • 145 INCLUDE -- applied with rebrand transforms
  • 62 EXCLUDE -- dropped (gutted subsystems)
  • 21 EXTRACT -- safe upstream changes ported hunk-by-hunk, gutted-module imports skipped
  • 10 PROTECTED -- reviewed for security; browser hardening + line lifecycle ported
  • 3 COLLISION adopted -- imports resolve in fork (line test, browser hooks, doctor-auth test)
  • 2 COLLISION skipped -- deps on structurally-diverged code
  • 8 upstream deletions -- applied (Anthropic OAuth, PR_STATUS.md)

Security hardening ported:

  • Browser symlink-safe path resolution (resolveWritablePathWithinRoot, resolveStrictExistingPathsWithinRoot)
  • Tmp dir trust validation (ensureTrustedFallbackDir)
  • CWD symlink denial + exec path canonicalization
  • Workspace file symlink traversal protection
  • Discord reaction ingress authorization
  • Gateway early error guard

Channel improvements:

  • Telegram centralized event authorization + webhook refactoring
  • Group allow separated from DM pairing store
  • Cron deliveryAttempted tracking
  • AccountId auto-resolve from channel-account bindings
  • Line abort lifecycle hardening
  • Context overflow error surfacing

Cleanup:

  • macOS dead Anthropic OAuth code stripped (224 lines)
  • Stale docs updated (heartbeat DM policy, reaction auth)
  • Doctor-auth resolveUnusableProfileHint utility ported

Test plan

  • pnpm check passes (format + typecheck + lint)
  • Zero openclaw leakage (rebrand gate)
  • EXTRACT changes verified hunk-by-hunk (verification audit)
  • Adversarial disposition audit (92 items, all WRONG verdicts addressed)
  • CI green

Generated with Claude Code

@alexey-pelykh alexey-pelykh changed the title sync: DIFF-SYNC B1 ��� fork-base to v2026.2.25 sync: DIFF-SYNC B1 -- fork-base to v2026.2.25 Apr 5, 2026
@alexey-pelykh alexey-pelykh changed the title sync: DIFF-SYNC B1 -- fork-base to v2026.2.25 sync: DIFF-SYNC B1 (fork-base to v2026.2.25, 111 commits) Apr 5, 2026
@alexey-pelykh alexey-pelykh force-pushed the sync/v2026.2.25 branch 2 times, most recently from ffd581e to 660f871 Compare April 5, 2026 20:26
@alexey-pelykh alexey-pelykh changed the title sync: DIFF-SYNC B1 (fork-base to v2026.2.25, 111 commits) sync: upstream to v2026.2.25 (111 commits) Apr 5, 2026
Disposition-filtered sync of 251 upstream files:
- 145 INCLUDE files applied (with rebrand transforms)
- 62 EXCLUDE files dropped (gutted subsystems)
- 21 EXTRACT files: safe upstream changes ported, gutted-module imports skipped
- 5 COLLISION files: 3 adopted (imports resolve), 2 skipped (deps on diverged code)
- 8 upstream deletions applied (Anthropic OAuth removed, PR_STATUS.md)
- 10 PROTECTED files reviewed for security: browser hardening + line lifecycle ported

Key upstream changes ported:
- Security: browser symlink-safe path resolution, tmp dir trust validation,
  CWD symlink denial, exec path canonicalization, workspace file symlink safety
- Telegram: webhook refactoring, centralized event authorization, group allow
  separated from DM pairing store
- Discord: reaction ingress authorization, gateway early error guard
- Cron: deliveryAttempted tracking, session maintenance
- Line: abort lifecycle hardening
- Android: voice tab, mic capture, startup benchmarks
- macOS: Anthropic OAuth removed (upstream + fork dead code cleanup)
- Infra: accountId auto-resolve, context overflow surfacing
- Config: agent runtime, session schema updates
- Docs: heartbeat DM policy, reaction auth controls

EXTRACT skipped (upstream changes depend on gutted modules):
- subagent-announce: dispatch extraction to subagent-announce-dispatch.js
- nodes-tool: formatExecCommand from system-run-command.js
- cron/run: model override fallback resolution
- doctor-auth: noteAuthProfileHealth refactoring (resolveUnusableProfileHint ported)

Upstream-range: ed34129..4b5d4a4
Upstream-boundary: v2026.2.25
Cherry-picked-from: @b3f46f0e2891621467061e4c24851882609b2cbd
Cherry-picked-from: @97eb5542e816cb76fb38f07abfb87693159ca55c
Cherry-picked-from: @ae658aa84c298f51ef490cdcc0dde29d788ec152
Cherry-picked-from: @a182afcf976e7456711f10c83789cae89ef4ea20
Cherry-picked-from: @3607b733cb439681c2d9c77e1b39d8ca0f99cff1
Cherry-picked-from: @90ddb3f271c8180760eac30cf0375c9a6edc7513
Cherry-picked-from: @3d29233babf9906a24a981afd5c1eec550a05b01
Cherry-picked-from: @6798330c24cad83a3688379b43afca2bc602931f
Cherry-picked-from: @73677f2707e1478859ee838f2352b84bbecfc94b
Cherry-picked-from: @434dc46531a50a9ec0ca3a781fb680627a5f04dd
Cherry-picked-from: @f9c3fdba458ebf8aac9502df11afa50f5cd0b046
Cherry-picked-from: @10a1593e0c61cfa3242c9205e098ec17c872fca2
Cherry-picked-from: @f729cc7b078f17ca4137e92a8d19d65a899bdeca
Cherry-picked-from: @285a0f48e57a3f04da39fa2829b2da6650c38b12
Cherry-picked-from: @2b7db53d0686d18ac5040995f2b84f2dafee3514
Cherry-picked-from: @b12216af93c97c7eac947670d5ad38105d69f5dc
Cherry-picked-from: @975c9f4b5457afbdf54c86ece31dcf80e4a585e0
Cherry-picked-from: @15240bdbfe05e6a34e570334248ec7e74498f5ba
Cherry-picked-from: @c7f88e85b7a3b72ac0039b9b884afe49092e0402
Cherry-picked-from: @98292331d50949bfb880b341e4ebd1f275da0358
Cherry-picked-from: @a898acbd55c1ef267f1f4cf858d03ee76129d0f1
Cherry-picked-from: @8f3310000a8b0c11eced054c2cdb6fb27803511a
Cherry-picked-from: @d512163d686ad6741783e7119ddb3437f493dbbc
Cherry-picked-from: @f60d9591efccc8d201e271061de2b331b9b6f5e6
Cherry-picked-from: @5325ed90b294ac01e35e744d900a4db9cefc4c2b
Cherry-picked-from: @45d59971e66f38651f2f72a6818deb854b1eb85f
Cherry-picked-from: @125f4071bcbc0de32e769940d07967db47f09d3d
Cherry-picked-from: @2011edc9e505ffa59949fb63f2c54a50f6400671
Cherry-picked-from: @15cfba7075ac9e3de7444a466281561a2e983ab6
Cherry-picked-from: @ef326f5cd0f761e02d5a02339be64ccfe1b96102
Cherry-picked-from: @2aa7842adeedef423be7ce283a9144b9f1a0a669
Cherry-picked-from: @8d1481cb4a9d31bd617e52dc8c392c35689d9dea
Cherry-picked-from: @eb73e87f18d1e94ff240c419ffcff6776f551a3d
Cherry-picked-from: @42f455739f03c553bb0d7014e8152078b85d8e54
Cherry-picked-from: @b090d6019b9e540c280ea30900fb4bf71a4fafca
Cherry-picked-from: @39cc547f74f137b563cbfb46cf027768ad2fd2a4
Cherry-picked-from: @a0a229a3bb92e57fae8be82706187fdd11448693
Cherry-picked-from: @f83719937afbade398284a06752270d73d8f5efc
Cherry-picked-from: @c6dfa26f037977b82e91648bee47d99360d604d4
Cherry-picked-from: @e56b0cf1a04f992ac6ebc775899f48ea31687640
Cherry-picked-from: @496a76c03ba85e15ea715e5a583e498ae04d36e3
Cherry-picked-from: @046feb6b0eee7ec4984a9840ae3c7da982f4c081
Cherry-picked-from: @f41715a18f74d44154c78df2447dc34a347eeee7
Cherry-picked-from: @c736f11a16d6bc27ea62a0fe40fffae4cb071fdb
Cherry-picked-from: @aedf62ac7e669a89c7b299201bf6537dc6b12e0e
Cherry-picked-from: @4258a3307f5a616c26c5bd63e108d918b71a9217
Cherry-picked-from: @876018f322b7f4388985fe9d14f73b8296d40072
Cherry-picked-from: @8f8e46d898c55a5b37d4b6d6f1b446e04f104a4e
Cherry-picked-from: @20c2db21035e8706ccbd63d553e8042c19bbf8f1
Cherry-picked-from: @aaeed3c4ea2a166dc31bf7a67c40425ac27a9bfe
Cherry-picked-from: @f312222159a6ef4921c4d3bd5c8e4b2bc21d2a23
Cherry-picked-from: @c0026274d9cafcfaf5c84bf4b6a5386755099b30
Cherry-picked-from: @70e31c6f68b88bcf91f6df827a0ea05bb90ab112
Cherry-picked-from: @6fb082e13160cfa7282c587a225d80b0e8c770bd
Cherry-picked-from: @ec45c317f5d0631a3d333b236da58c4749ede2a3
Cherry-picked-from: @3cd3d489f4ea9ceb03be41d17d8259f17bbb38b8
Cherry-picked-from: @8c701ba1ffb8907002e0370e99dd0e3ec8da79ba
Cherry-picked-from: @5e1bfb2ce2b73a27d04e03c5049910753f09aa3f
Cherry-picked-from: @ce8c67c314b93f570f53c2a9abc124e1e3a54715
Cherry-picked-from: @95c6b3a912a1a02b70913df5e6d7bdabed32cb24
Cherry-picked-from: @0cc3e8137c3c71f1585522141c15ff1386a58935
Cherry-picked-from: @acbb93be489d4a98518c151be823fc582e0c370a
Cherry-picked-from: @1f004e6640006fb7ce53f03f116e1a8b89598416
Cherry-picked-from: @347f7b9550064f5f5b33c6e07f64e85b9657b6f1
Cherry-picked-from: @b8bb8ab3ca421ed1405833c8c3e134d3ab2236e8
Cherry-picked-from: @00fc1f56f1a0dc675efd02414ea1315fab686668
Cherry-picked-from: @8d681997930c547aef407447f152e83d3b0a6772
Cherry-picked-from: @4a07c89816db0ab67b2e6a5d2a669b5c73afe82a
Cherry-picked-from: @b49c2cbdd9c3108ae665e48d23be9dc31ff39f56
Cherry-picked-from: @3175640ea2dee69f9f2a5bc25c8183cebf23846f
Cherry-picked-from: @410ba918fb7b60b9a777b20589d9494683ae9456
Cherry-picked-from: @958cafc54f8d0638cf3342a7b2c453aebec1fc7d
Cherry-picked-from: @069bbf9741bcbcad2db54349bf02668f66cf5eb0
Cherry-picked-from: @b786d11fea377d97d5c07cadee7a0f8bc8e0a168
Cherry-picked-from: @7b4fe6d9bc85483c1820b33548e80715cc4cb64b
Cherry-picked-from: @260bec5985008e33529a8c10ea1126a80a635535
Cherry-picked-from: @baf656bc6fd7f83b6033e6dbc2548ec75028641f
Cherry-picked-from: @03e689fc89bbecbcd02876a95957ef1ad9caa176
Cherry-picked-from: @53fcfdf794bb3e001bea542fe597847529e2f05e
Cherry-picked-from: @04d91d0319b82fd4de91ed05e9fc5219ff2ab64e
Cherry-picked-from: @61b3246a7f44d2da498844e4cb448e5574253d0e
Cherry-picked-from: @75dfb71e4e8b7c2feba5a8ca662f92ea840e0147
Cherry-picked-from: @92eb3dfc9d25ca2600d6687cd025922193d3dba5
Cherry-picked-from: @1e7ec8bfd2e7e5e689c6e5b6f1808b3251a5fe0d
Cherry-picked-from: @ee594e2fdb718da52e87a41d0414b16c322a9af6
Cherry-picked-from: @8a006a32603b0a2cd7ecd9cb7f858e1b96332035
Cherry-picked-from: @de61e9c9771899d76710251c2f445a75d6488644
Cherry-picked-from: @4ada143794789dd8ee7eff523ae520034f321ae1
Cherry-picked-from: @e16e8f5af2ce51565d39e9a56c6e5247b07a32b6
Cherry-picked-from: @b37dc42240726c4778ea193d172cfbb74bfa9912
Cherry-picked-from: @8a97803474fb4589e377e51dd724c48e4ea36403
Cherry-picked-from: @8f8e2b13b47b48762e0d288e588f9805a37b3265
Cherry-picked-from: @f789f880c934caa8be25b38832f27f90f37903db
Cherry-picked-from: @e4d62c21be2f5454749d1a22b11f8f2dd6594d7f
Cherry-picked-from: @f55238e72a61a839d585364c689c6fa006136289
Cherry-picked-from: @243e28df4fb087869bc80946a2ad23b5db4b5075
Cherry-picked-from: @9b81a530161cfb54d75fbf15e21a85808b87a48e
Cherry-picked-from: @7af6849c2f85e212dfcdeeabc7b1b4b82939db0e
Cherry-picked-from: @e35fe7888b98e31715b95c3b425510189618a07f
Cherry-picked-from: @02c731826a036b7be49fe516436173554a1488f0
Cherry-picked-from: @e915b4c64a774365fafbb8558b94373c8c0cad2d
Cherry-picked-from: @fdea7415ccd4a6de5deeea70f7cc97721b469fdb
Cherry-picked-from: @550000049298c1f00c41cbdbc8c6de491aecb235
Cherry-picked-from: @c7352f6b3f0ddd7b9c56cbeb2ef5355dc9b5ff39
Cherry-picked-from: @470c606dac1c9a2fd7333e1a5800c25680012af5
Cherry-picked-from: @3b0298562b7105c276380f26d966a10216c3f4de
Cherry-picked-from: @bf70614943fe932b49e6071790ef7d464711db60
Cherry-picked-from: @41314c691dcc905d39d1bf8ce215ad3c63180471
Cherry-picked-from: @7493f11b406588cbf0a861154efc123d278d30ee
Cherry-picked-from: @04870a552882c3946aeb3dc790aea55aa9290f7d
Cherry-picked-from: @4b5d4a4c660d05e4bd73f0e11123e68fd9664432
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant