Devin Robison

Fail closed on exec approval timeout · Fail closed on exec approval timeout (#89938)

Fail closed on exec approval timeout

Harden node exec approval precheck env [AI] · Harden node exec approval precheck env [AI] (#81488)

Block provider credentials from workspace dotenv [AI]

fix(exec): enforce allowlist argument patterns · fix(memory): enforce wiki session visibility

Harden config backup restore permissions · Harden config backup restore permissions (#77488)

Harden config backup restore permissions · Harden Windows command wrapper resolution · Harden update environment path resolution · Guard current browser tab exports

fix(dotenv): block Windows shell trust-root vars from workspace .env [AI-assisted] · Mattermost: refresh slash callback command validation

fix(auth): bound bootstrap handoff scopes · fix(commands): scope owner allowlist prefixes · fix(agents): move groupId trust check into resolveGroupToolPolicy for all callers [AI-assisted] · fix: gate startup context for sandboxed spawned sessions

fix: gate startup context for sandboxed spawned sessions · fix: enforce focus subagent scope

fix(gateway): restart channels after secret reload · fix(gateway): enforce owner-only tool policy and before-tool-call hook on MCP loopback surface · fix(gateway): restart channels after secret reload (#70720)

fix(gateway): restart channels after secret reload · fix(webhooks): reload route secrets per request · fix(gateway): fail closed on runtime config edits · fix(gateway): block webchat session compaction mutations

fix(gateway): require auth for control ui bootstrap config · fix(openshell): pin sandbox file reads · fix(gateway): reauthorize session history SSE updates · telegram: align model picker callback auth

fix(tlon): guard memex upload target · fix(openshell): pin host writes to sandbox root · fix(gateway): derive loopback owner context from token · fix(exec): block heredoc parameter expansion

fix(gateway): require read scope for chat websocket broadcasts · fix(gateway): tighten gateway config mutation guard · Limit paired-device pairing actions to the caller device · fix(dotenv): reserve workspace OPENCLAW env namespace

fix(exec-approvals): escape control characters in display sanitizers · fix(gateway): require read scope for assistant media · Fix macos ssh host checking · fix(agents): filter bundled tools through final policy

fix(compaction): stop retaining credential-like values · fix(compaction): stop retaining credential-like values (#67801)

fix: tighten trusted tool media passthrough · fix: tighten trusted tool media passthrough (#67303)

Harden MCP loopback request validation · fix(agents): tighten workspace file opens · Harden Feishu webhook replay guards · fix(gateway): re-resolve HTTP auth per-request to honor credential rotation [AI]

Feishu: tighten allowlist target canonicalization · fix(stream): tighten voice stream ingress guards · fix(queue): split collect batches by auth context · fix(outbound): replay queued session context

fix(sandbox): enforce CDP source-range restriction by default · Ensure ACPX plugin-tools bridge honors before_tool_call · Redact Gmail watcher startup args from log tail · fix(browser): tighten strict browser hostname navigation

fix: the nostr plugin exposes gateway authenticated h (#347) · fix: openclaw accepts remote media urls from normal q (#344) · fix(browser): re-check interaction-driven navigations · fix(browser): harden browser control override loading

Require re-pairing for node reconnect command upgrades · fix(env): align inherited host exec env filtering · fix(git): expand host env denylist coverage · Guard missed base64 decode paths

fix: openclaw allows normal reply text to carry media (#345) · fix: lower trust background runtime output is injecte (#327) · fix(hooks): mark wake hook events untrusted · fix: the bundled qq bot extension extensions qqbot pe (#329)

Fix/device pair approve admin scope

Gateway: refresh websocket auth after secrets reload · fix(hooks): harden before_tool_call hook runner to fail-closed on error [AI]

fix: loopback rate limit exemption allows unlimited r (#258) · fix(policy): preserve restrictive tool allowlists · fix(tailscale): gate test binary override · iOS: restrict A2UI action dispatch to trusted canvas URLs

Discord: fix Group DM component interaction routing and auth · Gateway: open config files without shell interpolation · fix(diffs): harden viewer proxy access · Fix Discord native commands bypassing group DM channel allowlist