Coy Geek 914a7c5359 fix: Device Token Scope Escalation via Rotate Endpoint (#20703) ...

Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 4f2c2ecef4
Co-authored-by: coygeek <65363919+coygeek@users.noreply.github.com>
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Reviewed-by: @mbelinky

2026-02-20 17:38:58 +00:00

..

acp

fix(ci): normalize path assertions across platforms

2026-02-19 15:28:14 +00:00

agents

fix(browser): block upload symlink escapes (#21972)

2026-02-20 16:36:25 +00:00

auto-reply

fix(auth/session): preserve override reset behavior and repair oauth profile-id drift (openclaw#18820) thanks @Glucksberg

2026-02-19 21:16:26 -06:00

browser

fix(browser): block upload symlink escapes (#21972)

2026-02-20 16:36:25 +00:00

canvas-host

fix(gateway): harden canvas auth with session capabilities

2026-02-19 15:51:22 +01:00

channels

fix(signal): preserve case for Base64 group IDs in target normalization (openclaw#10623) thanks @heyhudson

2026-02-19 22:41:55 -06:00

cli

fix(browser): block upload symlink escapes (#21972)

2026-02-20 16:36:25 +00:00

commands

fix(auth): bidirectional mode/type compat + sync OAuth to all agents (#12692)

2026-02-20 16:01:09 +05:30

compat

…

config

Feature/default messenger delivery target (openclaw#16985) thanks @KirillShchetinin

2026-02-19 22:37:19 -06:00

cron

feat: surface cached token counts in /status output (openclaw#21248) thanks @vishaltandale00

2026-02-19 21:06:13 -06:00

daemon

refactor(daemon): extract windows cmd argv helpers

2026-02-19 16:22:28 +01:00

discord

Discord: handle gateway 4014 close

2026-02-19 13:47:28 -06:00

docs

…

gateway

fix: Device Token Scope Escalation via Rotate Endpoint (#20703)

2026-02-20 17:38:58 +00:00

hooks

refactor: eliminate jscpd clones and boost tests

2026-02-19 15:08:54 +00:00

imessage

style: format files and fix safe-bins e2e typing

2026-02-19 14:26:12 +01:00

infra

fix: Device Token Scope Escalation via Rotate Endpoint (#20703)

2026-02-20 17:38:58 +00:00

line

test: dedupe and optimize test suites

2026-02-19 15:19:38 +00:00

link-understanding

fix: block ISATAP SSRF bypass via shared host/ip guard

2026-02-19 09:59:47 +01:00

logging

fix(ui): unblock docker onboarding build

2026-02-19 16:32:33 +01:00

macos

refactor: unify restart gating and update availability sync

2026-02-19 10:00:41 +01:00

markdown

fix(security): use YAML core schema to prevent type coercion (#20857)

2026-02-19 03:15:36 -08:00

media

test: dedupe and optimize test suites

2026-02-19 15:19:38 +00:00

media-understanding

style: format files and fix safe-bins e2e typing

2026-02-19 14:26:12 +01:00

memory

Memory: share ENOENT helpers

2026-02-19 23:33:28 -08:00

node-host

refactor(exec): split host flows and harden safe-bin trust

2026-02-19 14:22:01 +01:00

pairing

fix(cron/whatsapp): route implicit delivery to allowlisted recipients (openclaw#21533) thanks @Takhoffman

2026-02-19 20:33:37 -06:00

plugin-sdk

test: cover plugin status helper branches

2026-02-19 15:09:19 +00:00

plugins

test: dedupe and optimize test suites

2026-02-19 15:19:38 +00:00

process

test: dedupe and optimize test suites

2026-02-19 15:19:38 +00:00

providers

Add Claude Sonnet 4.6 and 4.5 to GitHub Copilot model catalog (openclaw#20270) thanks @Clawborn

2026-02-19 21:54:52 -06:00

routing

refactor(test): dedupe agent harnesses and routing fixtures

2026-02-18 04:49:22 +00:00

scripts

…

security

fix: Control UI Insecure Auth Bypass Allows Token-Only Auth Over HTTP (#20684)

2026-02-20 17:34:34 +00:00

sessions

fix(auth/session): preserve override reset behavior and repair oauth profile-id drift (openclaw#18820) thanks @Glucksberg

2026-02-19 21:16:26 -06:00

shared

Gateway: align pairing scope checks for read access

2026-02-20 05:12:05 +00:00

signal

refactor(signal): reuse shared reaction types

2026-02-18 23:34:15 +00:00

slack

fix(slack): pass recipient_team_id to streaming API calls (#20988)

2026-02-19 14:44:34 -08:00

telegram

fix: split telegram reasoning and answer draft streams (#20774)

2026-02-20 11:14:39 +05:30

terminal

refactor(cli): share styled select prompt helper

2026-02-18 17:48:02 +00:00

test-helpers

refactor(test): simplify state dir env helpers

2026-02-16 00:08:00 +00:00

test-utils

fix(ci): normalize path assertions across platforms

2026-02-19 15:28:14 +00:00

tts

Security: use crypto.randomBytes for temp file names (#20654)

2026-02-19 03:19:29 -08:00

tui

test: dedupe and optimize test suites

2026-02-19 15:19:38 +00:00

types

…

utils

test: dedupe and optimize test suites

2026-02-19 15:19:38 +00:00

web

fix(web): remove unrelated login changes

2026-02-20 14:47:20 +02:00

whatsapp

test: dedupe line and whatsapp target resolution tests

2026-02-18 05:31:13 +00:00

wizard

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

channel-web.ts

…

docker-image-digests.test.ts

fix(docker): pin base images to SHA256 digests (#7734)

2026-02-19 12:42:07 -08:00

docker-setup.test.ts

fix(docker): harden docker-setup mount validation

2026-02-19 10:44:46 +01:00

dockerfile.test.ts

test(docker): cover browser install build arg

2026-02-16 22:35:27 -05:00

entry.ts

…

extensionAPI.ts

…

globals.ts

…

index.ts

…

logger.test.ts

test: merge logger subsystem prefix drop cases

2026-02-19 08:49:52 +00:00

logger.ts

…

logging.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

polls.test.ts

test: table-drive poll duration clamp cases

2026-02-18 23:27:50 +00:00

polls.ts

…

runtime.ts

chore: chore: Fix types in tests 12/N.

2026-02-17 11:22:49 +09:00

utils.test.ts

perf(test): drop redundant index entrypoint tests

2026-02-16 02:45:00 +00:00

utils.ts

refactor: share plain object guard across config and utils

2026-02-19 14:27:36 +00:00

version.test.ts

refactor: centralize presence routing and version precedence coverage (#19609)

2026-02-18 00:02:51 -05:00

version.ts

refactor: centralize presence routing and version precedence coverage (#19609)

2026-02-18 00:02:51 -05:00