Zee Zheng 8be581cbf8 fix(browser): allow inbound media uploads ... Allow the browser upload tool to resolve OpenClaw-managed inbound media refs such as `media://inbound/<id>` and sandbox-relative `media/inbound/<id>` while preserving the existing upload-root path contract. Keep upload-root files ahead of sandbox-relative inbound fallback, reject nested absolute inbound media files, and validate raw `media://` paths before URL normalization so traversal-shaped refs cannot resolve to direct media ids. Verification: - `OPENCLAW_VITEST_MAX_WORKERS=1 node scripts/run-vitest.mjs extensions/browser/src/browser/paths.test.ts --reporter=verbose` - `OPENCLAW_VITEST_MAX_WORKERS=1 node scripts/run-vitest.mjs extensions/browser/src/browser/paths.test.ts --reporter=dot` - `OPENCLAW_HEAVY_CHECK_LOCK_SCOPE=worktree node scripts/run-tsgo.mjs -p test/tsconfig/tsconfig.extensions.test.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/extensions-test.tsbuildinfo` - `pnpm lint --threads=8` - `.agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main` - `git diff --check` - GitHub PR checks on be08e6c8a8: dependency-guard, check-lint, check-test-types, check-additional-extension-bundled, checks-fast-contracts-plugins-a, checks-fast-contracts-plugins-b all passed. Fixes #83544. Co-authored-by: Zee Zheng <zheng.zuo0@gmail.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>		2026-05-30 23:49:07 +01:00
..
acpx	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
active-memory	fix(active-memory): bound recall cache clocks	2026-05-30 11:13:04 -04:00
admin-http-rpc	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
alibaba	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
amazon-bedrock	fix(bedrock): bound discovery cache expiry	2026-05-30 12:33:07 -04:00
amazon-bedrock-mantle	fix(bedrock): bound mantle runtime token expiry	2026-05-30 14:09:59 -04:00
anthropic	fix(anthropic): bound setup token expiry	2026-05-30 14:14:13 -04:00
anthropic-vertex	perf(extensions): cache provider runtime imports	2026-05-30 13:00:30 +02:00
arcee	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
azure-speech	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
bonjour	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
brave	refactor: share web search time filters	2026-05-30 07:53:51 +02:00
browser	fix(browser): allow inbound media uploads	2026-05-30 23:49:07 +01:00
byteplus	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
canvas	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
cerebras	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
chutes	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
clickclack	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
cloudflare-ai-gateway	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
codex	fix(codex): keep app-server continuation turns alive	2026-05-30 20:41:04 +01:00
codex-supervisor	fix(codex-supervisor): satisfy release lint	2026-05-30 23:03:32 +01:00
comfy	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
copilot	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
copilot-proxy	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
deepgram	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
deepinfra	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
deepseek	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
device-pair	fix(gateway): gate talk secret bootstrap handoff (#85690)	2026-05-25 11:34:12 +03:00
diagnostics-otel	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
diagnostics-prometheus	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
diffs	fix(diffs): cap artifact expiry overflow	2026-05-30 08:54:56 -04:00
diffs-language-pack	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
discord	fix(feishu): use full gateway channel runtime	2026-05-30 23:46:04 +01:00
document-extract	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
duckduckgo	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
elevenlabs	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
exa	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
fal	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
feishu	fix(feishu): use full gateway channel runtime	2026-05-30 23:46:04 +01:00
file-transfer	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
firecrawl	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
fireworks	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
github-copilot	fix(github-copilot): bound device code expiry	2026-05-30 14:49:34 -04:00
gmi	feat: add hosted model providers (#88247)	2026-05-30 08:26:16 +02:00
google	fix(google): bound realtime browser session expiry	2026-05-30 13:16:22 -04:00
google-meet	fix(google-meet): bound oauth fallback expiry clocks	2026-05-30 10:26:07 -04:00
googlechat	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
gradium	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
groq	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
huggingface	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
image-generation-core	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
imessage	fix(imessage): bound private api negative cache expiry	2026-05-30 13:28:17 -04:00
inworld	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
irc	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
kilocode	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
kimi-coding	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
line	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
litellm	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
llm-task	refactor: unify OpenAI provider identity	2026-05-30 11:48:41 +02:00
lmstudio	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
lobster	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
matrix	refactor(agents): bind subagent threads in core (#88416)	2026-05-30 21:19:09 +01:00
mattermost	refactor: extract model catalog core package	2026-05-30 16:33:45 +01:00
media-understanding-core	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
memory-core	fix(memory): bound qmd embed backoff	2026-05-30 14:39:33 -04:00
memory-lancedb	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
memory-wiki	fix(memory-wiki): guard injected timestamps	2026-05-30 08:02:26 -04:00
microsoft	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
microsoft-foundry	fix(foundry): bound entra token expiry clocks	2026-05-30 10:29:26 -04:00
migrate-claude	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
migrate-hermes	refactor: unify OpenAI provider identity	2026-05-30 11:48:41 +02:00
minimax	fix(minimax): validate oauth authorization expiry	2026-05-30 05:23:53 -04:00
mistral	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
moonshot	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
msteams	refactor(msteams): persist conversation and poll stores in sqlite	2026-05-30 21:08:39 +01:00
nextcloud-talk	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
nostr	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
novita	feat: add hosted model providers (#88247)	2026-05-30 08:26:16 +02:00
nvidia	fix(nvidia): bound featured model cache expiry	2026-05-30 12:34:53 -04:00
oc-path	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
ollama	feat: add hosted model providers (#88247)	2026-05-30 08:26:16 +02:00
open-prose	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
openai	refactor: unify OpenAI provider identity	2026-05-30 11:48:41 +02:00
opencode	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
opencode-go	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
openrouter	refactor: share OpenRouter video mode capabilities	2026-05-30 08:28:41 +02:00
openshell	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
perplexity	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
phone-control	fix(phone-control): bound arm expiry timestamps	2026-05-30 11:24:36 -04:00
pixverse	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
policy	perf(policy): cache doctor file reads	2026-05-30 13:00:31 +02:00
qa-channel	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
qa-lab	fix(runtime): centralize timeout grace clamping	2026-05-30 03:15:50 -04:00
qa-matrix	fix(qa-matrix): cap live timeout env	2026-05-30 03:47:22 -04:00
qianfan	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
qqbot	fix(qqbot): bound reminder schedule time	2026-05-30 14:41:39 -04:00
qwen	feat: add hosted model providers (#88247)	2026-05-30 08:26:16 +02:00
runway	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
searxng	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
senseaudio	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
sglang	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
signal	fix(signal): bound api mode cache clocks	2026-05-30 10:50:44 -04:00
slack	fix(slack): preserve assistant DM root thread context (#63840)	2026-05-30 22:28:49 +01:00
stepfun	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
synology-chat	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
synthetic	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
talk-voice	fix(talk-voice): parse signed list limits	2026-05-29 06:08:50 -04:00
tavily	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
telegram	fix(telegram): bound transport cooldown expiry	2026-05-30 14:16:57 -04:00
tencent	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
test-support	refactor: internalize OpenClaw agent runtime (#85341)	2026-05-27 19:24:04 +01:00
thread-ownership
tlon	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
together	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
tokenjuice	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
tts-local-cli	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
twitch	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
venice	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
vercel-ai-gateway	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
video-generation-core	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
vllm	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
voice-call	fix(voice-call): bound webhook replay cache expiry	2026-05-30 13:51:12 -04:00
volcengine	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
voyage	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
vydra	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
web-readability	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
webhooks	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
whatsapp	fix(whatsapp): bound group metadata cache expiry	2026-05-30 11:45:05 -04:00
workboard	feat: expand workboard orchestration metadata (#88408)	2026-05-30 19:22:19 +01:00
xai	refactor: move model catalog normalization into core package	2026-05-30 20:51:11 +01:00
xiaomi	feat(xiaomi): add Token Plan provider support	2026-05-30 11:37:36 +02:00
zai	chore(release): bump version to 2026.5.30	2026-05-30 06:49:13 +01:00
zalo	fix(zalo): bound hosted media expiry clocks	2026-05-30 11:29:33 -04:00
zalouser	fix(zalouser): bound group context cache expiry	2026-05-30 12:52:24 -04:00
.npmignore
AGENTS.md	docs: prefer clean refactors over compat shims	2026-05-16 12:38:51 +01:00
CLAUDE.md
music-generation-providers.live.test.ts	fix(gateway): reject RPCs from invalidated device-token clients durin… (#70707)	2026-05-26 23:09:56 +01:00
tsconfig.package-boundary.base.json
tsconfig.package-boundary.paths.json	refactor: move model catalog normalization into core package	2026-05-30 20:51:11 +01:00
video-generation-providers.live.test.ts	feat(pixverse): add video generation provider	2026-05-27 12:41:10 +02:00