Pavan Kumar Gondhi

fix: isolate Synology webhook preauth throttling [AI] · fix: isolate Synology webhook preauth throttling [AI] (#103619) · fix: protect SMS webhook callback quota [AI]

fix: protect SMS webhook callback quota [AI] · fix: isolate Synology webhook preauth throttling [AI] · fix: block unspecified DNS targets in trusted network fetches [AI] · fix: enforce sandbox tool policy for loopback tools [AI]

fix: block unspecified DNS targets in trusted network fetches [AI] · fix: enforce sandbox tool policy for loopback tools [AI] · fix: redact diagnostic config fields with schema hints [AI] · fix: keep mapped hook content provenance scoped [AI]

fix: bind package-manager exec approvals to inner commands [AI] · fix: harden web fetch HTML conversion [AI] · Harden jq safe-bin semantics · fix: gate Gateway message action requester provenance [AI]

fix: detect joined inline eval flags [AI] · fix: block mixed-case cron shell jobs from agent tool [AI] · fix: block mixed-case cron shell jobs from agent tool [AI] (#101350)

test: cover versioned inline eval approval [AI]

fix: block channel reads outside allowlists [AI]

fix: block channel reads outside allowlists [AI] · fix(discord): gate guild metadata reads [AI] · fix(discord): gate guild metadata reads [AI] (#98966)

fix: gate Active Memory global toggles [AI] · fix: restrict trajectory export to owners [AI] · fix: keep group activation owner controlled [AI] · fix: require owner for trajectory export (#97840)

fix: gate Active Memory global toggles [AI] · fix: restrict trajectory export to owners [AI] · fix: keep group activation owner controlled [AI] · test: cover versioned inline eval approval [AI]

fix: block cargo executable env overrides

fix: block cargo executable env overrides · fix: block git protocol env controls [AI] · fix: block rustup toolchain env overrides [AI] · fix: expand unsafe host env denylist

fix(memory-lancedb): guard memory recall output [AI] · fix(browser): neutralize media directives in browser output [AI] · fix: neutralize browser media directives (#91422)

fix: gate owner-only HTTP tools (#90261)

fix: gate owner-only HTTP tools · Remove local install-time code scanner for skills and plugins · fix: protect global agent config defaults [AI] · Rate limit node pairing requests [AI]

fix: guard MCP HTTP redirects [AI] · fix(skills): remove local install scanner · fix(qqbot): block file URI media tags [AI] · fix(telegram): require admin for target writeback [AI]

Remove install-time code scanning [AI] · Remove local install-time code scanner for skills and plugins · fix: redact trajectory exports consistently · fix: redact trajectory exports consistently (#89354)

fix(telegram): require admin for target writeback [AI] · fix: bound remote media reference reads [AI] · fix(qqbot): block file URI media tags [AI] · fix: bound remote media reference reads [AI] (#88974)

fix(msteams): pin attachment fetch DNS · Pin Microsoft Teams attachment fetch DNS [AI]

Tighten phone-control mutation authorization [AI] · Clarify directive persistence authorization policy [AI] · Tighten phone-control mutation authorization [AI] (#87150) · Clarify directive persistence authorization policy [AI] (#86369)

Harden hostname normalization for repeated trailing dots [AI] · fix: block side-effecting command wrappers [AI] · Block unsafe Node runtime env overrides [AI] · fix: sanitize group prompt inbound text [AI]

Restore Control UI gateway token pairing [AI] · fix(integrations): enforce channel read target allowlists [AI] · fix: constrain Windows task script names [AI] · Restore Control UI gateway token pairing [AI] (#85459)

fix(integrations): enforce channel read target allowlists [AI] · fix: constrain Windows task script names [AI] · doctor: constrain legacy plugin cleanup paths [AI] · fix(config): validate browser sandbox bind sources [AI]

fix(mattermost): fail closed on missing channel type [AI] · Recheck rebuilt system.run argv [AI] · fix(mattermost): fail closed on missing channel type [AI] (#84091) · Recheck rebuilt system.run argv [AI] (#84090)

fix: sanitize group prompt inbound text [AI] · harden update restart script creation [AI] · fix(mattermost): fail closed on missing channel type [AI] · Recheck rebuilt system.run argv [AI]

fix(qa-lab): remove token from bootstrap response and bind Docker ports to loopback [AI]

fix(gateway): scope session data lookups by agent [AI] · fix(gateway): scope session data lookups by agent [AI] (#81386)

Bind shell script operands after combined options [AI] · fix(canvas): validate snapshot response formats [AI] · Constrain provider catalog entry paths [AI] · Require canonical node platform IDs [AI]

Bind shell script operands after combined options [AI] · fix(canvas): validate snapshot response formats [AI] · Constrain provider catalog entry paths [AI] · Require canonical node platform IDs [AI]

fix(gateway): scope session data lookups by agent [AI] · Bind gateway approval access to requester metadata [AI] · gateway: pass Talk session scope to resolver [AI] · Require approval for setup-code device pairing [AI]

Require device key proof for bootstrap token binding [AI] · Inherit tool restrictions for delegated sessions [AI] · fix(plugins): scan installed dependency runtime code [AI] · browser: enforce navigation checks for act interactions [AI]

Redact persisted secret-shaped payloads [AI] · fix(matrix): gate name-based allowlist resolution [AI]

fix(discord): gate user allowlist name resolution [AI] · fix(msteams): gate startup user allowlist resolution [AI] · Harden macOS shell wrapper allowlist parsing [AI]

Redact persisted secret-shaped payloads [AI] · fix(matrix): gate name-based allowlist resolution [AI] · fix(discord): gate user allowlist name resolution [AI] · fix(msteams): gate startup user allowlist resolution [AI]

Harden macOS shell wrapper allowlist parsing [AI] · Gate Slack startup user allowlist resolution [AI] · Gate Slack startup user allowlist resolution [AI] (#77898)

fix(gateway): clamp unbound websocket auth scopes [AI] · fix(qqbot): keep private commands off framework surface [AI] · Gate zalouser startup name matching [AI] · fix(device-pair): require pairing scope for pair command [AI]

fix(device-pair): require pairing scope for pair command [AI] · fix: harden backend message action gateway routing [AI] · Gate QQBot streaming command auth [AI] · fix(qqbot): constrain framework admin commands [AI]

fix(infra): block workspace state-directory env override [AI]

fix: block STATE_DIRECTORY from workspace .env and reject relative systemd state paths [AI] · fix: block workspace CLOUDSDK_PYTHON override and always set trusted interpreter for gcloud · fix(infra): block Windows system path env vars from workspace .env injection · fix(infra): block ambient Homebrew env vars from brew resolution

fix(synology-chat): default allowInsecureSsl to false to enforce TLS cert validation [AI]

fix: block STATE_DIRECTORY from workspace .env and reject relative systemd state paths [AI] · fix: block workspace CLOUDSDK_PYTHON override and always set trusted interpreter for gcloud · fix(infra): block Windows system path env vars from workspace .env injection · fix(infra): block ambient Homebrew env vars from brew resolution

fix(plugins): restrict bundled plugin dir resolution to trusted package roots · fix(security): prevent workspace PATH injection via service env and trash helpers · fix(security): block npm_execpath injection from workspace .env [AI-assisted] · fix(device-pairing): validate callerScopes against resolved token scopes on repair [AI]

fix(agents): validate caller groupId against session context in resolveGroupToolPolicy · fix(device-pairing): validate callerScopes against resolved token scopes on repair [AI] · fix(agents): canonicalize provider aliases in byProvider tool policy lookup [AI] · fix(node-host): forward systemRunPlan to system.run invoke in async approval path [AI]

[Bug]: openclaw onboard QuickStart WhatsApp fails on fresh install with missing @whiskeysockets/baileys

fix: preserve nvidia-prefixed model refs in session overrides and config writes

fix(synology-chat): add SSRF guard to sendFileUrl [AI-assisted] · fix(synology-chat): block SSRF in sendFileUrl file_url parameter [AI-assisted] · fix(agents): enforce subagent envelope inheritance on ACP child sessions [AI-assisted] · fix(zalo): add SSRF guard on outbound photo URLs [AI-assisted]

fix(security): block MINIMAX_API_HOST workspace env injection and remove env-driven URL routing [AI-assisted]

fix(webchat): reject remote-host file:// URLs in media embedding path [AI-assisted] · fix(terminal): tolerate undefined path in formatDocsLink · fix(gateway): enforce localRoots containment on webchat audio embedding path [AI-assisted] · fix(matrix): block DM pairing-store entries from authorizing room control commands [AI-assisted]

fix(qa-lab): remove token from bootstrap response and bind Docker ports to loopback [AI]

fix(skills): pin targetDir by inode identity to close TOCTOU window during download and extraction [AI-assisted] · fix(heartbeat): force owner downgrade for untrusted hook:wake system events [AI-assisted] · fix(browser): enforce SSRF policy on snapshot, screenshot, and tab routes [AI] · fix(msteams): enforce sender allowlist checks on SSO signin invokes [AI]

fix(nostr): require operator.admin scope for profile mutation routes [AI] · fix(infra): expand host env security policy denylist [AI]

fix(agents): guard nodes tool outPath against workspace boundary [AI-assisted] · fix(qqbot): enforce media storage boundary for all outbound local file paths [AI] · fix(browser): auto-generate browser control auth token for none/trusted-proxy modes [AI] · fix(exec): replace TOCTOU check-then-read with atomic pinned-fd open in script preflight [AI]

fix(plugins): prevent untrusted workspace plugins from hijacking bundled provider auth choices [AI] · fix(plugins): prevent untrusted workspace plugins from hijacking bundled provider auth choices [AI] (#62368)

fix: expand host-exec env blocklist for Java, Rust, and Cargo toolchains [AI-assisted] (#62291) · fix(fetch-guard): drop request body on cross-origin unsafe-method redirects [AI-assisted] (#62357) · fix(browser): harden SSRF redirect guard against non-navigation document hops [AI] (#62355) · fix(allowlist): gate write commands behind owner check before channel resolution [AI] (#62383)

fix: require explicit approval before silent local pairing grants operator scopes

fix(exec): prevent symlink and hardlink path traversal in script preflight reads · fix(infra): expand host-env security blocklist for toolchain injection vectors [AI] · fix(sandbox): prevent OS command injection in Docker exec bootstrap [AI] · fix(hooks): harden before_tool_call hook runner to fail-closed on error [AI] (#59822)

fix(node-host): forward systemRunPlan to system.run invoke in async approval path [AI] · fix(slack): enforce sender allowlists on thread history and starter context [AI] · fix(infra): align env key normalization in approval binding path (#59182) · fix(security): close fail-open bypass in exec script preflight [AI] (#59398)

fix(synology-chat): default allowInsecureSsl to false to enforce TLS cert validation [AI] · fix: security hardening and tests · fix(browser): close SSRF bypass — request-time redirect guard and follow-up action gates

fix(zalo): isolate replay dedupe across webhook paths · fix(browser): close SSRF bypass — request-time redirect guard and follow-up action gates · fix(gateway): harden control UI HTTP host header validation against DNS rebinding

fix(skills): replace readFileSync with symlink-safe, root-confined skill file loader (#57519) · fix(auto-reply): thread per-agent tools.exec defaults into reply directives (#57689) · fix(infra): block BROWSER, GIT_EDITOR, GIT_SEQUENCE_EDITOR from inherited host env (#57559) · fix(telegram): gate audio preflight transcription on sender authorization (#57566)