fix: detect joined inline eval flags [AI] by pgondhi987 · Pull Request #101353 · openclaw/openclaw

pgondhi987 · 2026-07-07T04:19:36Z

What Problem This Solves

Fixes an issue where users who allowlist interpreter or runtime binaries could have joined inline-code flags treated as ordinary interpreter invocations when strict inline-eval hardening was enabled.

Why This Change Was Made

The inline-eval detector now recognizes glued single-letter eval flags such as -c... and equals-joined long eval flags such as --eval=..., while keeping unrelated multi-letter flags exact-only unless their spec explicitly declares a prefix form. Regression coverage exercises the parser and the strict allow-always persistence boundary.

User Impact

Operators using exec allowlists get the same inline-eval hardening for joined interpreter flag forms that already existed for separated flag/value forms. Normal script execution and unrelated options remain unchanged.

Evidence

node scripts/run-vitest.mjs src/infra/command-analysis/inline-eval.test.ts src/infra/exec-authorization-allowlist.test.ts passed locally with 2 shards and 48 tests.
Remote validation was attempted first but unavailable in this environment: Blacksmith Testbox requires a newer Crabbox binary, and AWS Crabbox broker login is not configured.

AI-assisted: yes.

pgondhi987 · 2026-07-07T04:33:00Z

@clawsweeper re-review

clawsweeper · 2026-07-07T04:33:02Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

clawsweeper · 2026-07-07T04:58:14Z

Codex review: needs maintainer review before merge. Reviewed July 7, 2026, 10:14 AM ET / 14:14 UTC.

Summary
The branch expands shared inline-eval detection to catch joined and clustered interpreter eval flags, with regression coverage in command-analysis and exec-authorization allowlist tests.

PR surface: Source +182, Tests +100. Total +282 across 3 files.

Reproducibility: yes. from source inspection and contributor proof. Current main lacks joined/clustered matcher paths while strict allow-always persistence depends on detectInlineEvalArgv, and the PR comment shows python3 -xcprint becoming one-shot on the current head.

Review metrics: 1 noteworthy metric.

Inline-eval matcher expansion: 3 matcher paths added. The diff adds joined raw-exact, joined exact, and short-cluster matching inside an exec approval boundary, so maintainers should notice the behavior change before merge.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

Get explicit exec/security owner acceptance for the strictInlineEval compatibility tightening.

Risk before merge

[P1] Merging intentionally tightens strictInlineEval allowlist persistence for joined and clustered interpreter eval forms, so previously reusable operator-approved command shapes can become one-shot approvals.
[P1] The PR carries the protected maintainer label and changes an exec approval boundary, so cleanup automation should not treat it as ready without owner acceptance even with no code findings.

Maintainer options:

Land with explicit compatibility acceptance (recommended)
An exec/security owner can accept that joined and clustered interpreter eval forms become one-shot under strictInlineEval and proceed once normal merge gates pass.
Narrow the detector matrix before merge
Ask for a smaller flag set or additional compatibility notes if maintainers are not ready to change all covered interpreter forms at once.
Pause if the policy is not settled
Pause or close this PR if strictInlineEval should not tighten reusable approvals for joined interpreter eval flags yet.

Next step before merge

[P2] Human review is needed for the protected maintainer label and compatibility/security-boundary acceptance; no narrow code repair remains from this review.

Maintainer decision needed

Question: Should OpenClaw accept stricter strictInlineEval allowlist behavior for joined and clustered interpreter eval flags now that contributor live-output proof is present?
Rationale: The patch closes an approval-boundary gap but intentionally changes upgrade behavior for existing allowlisted interpreter command shapes from durable approval toward one-shot approval.
Likely owner: steipete — He merged the closest prior strict inline-eval approval-boundary change and is the strongest routing signal for compatibility acceptance.
Options:
- Accept hardening after owner review (recommended): Land the PR after an exec/security owner explicitly accepts the compatibility tightening and current-head checks are otherwise acceptable.
- Ask for narrower rollout: Hold the PR if maintainers want a smaller interpreter matrix or additional operator-facing guidance before changing persistence behavior.
- Decline this behavior change: Close or redirect the PR if maintainers decide joined eval forms should keep current allowlist persistence semantics.

Security
Cleared: Cleared: the diff tightens an exec approval boundary and changes only TypeScript source/tests, with no dependency, workflow, secret, package, or supply-chain surface changes.

Review details

Best possible solution:

Land the shared detector hardening with the added regressions after an exec/security owner explicitly accepts the one-shot approval compatibility change.

Do we have a high-confidence way to reproduce the issue?

Yes from source inspection and contributor proof. Current main lacks joined/clustered matcher paths while strict allow-always persistence depends on detectInlineEvalArgv, and the PR comment shows python3 -xcprint becoming one-shot on the current head.

Is this the best way to solve the issue?

Yes, this is the best implementation layer. Gateway, node-host, command explanation, and persistence paths already share detectPolicyInlineEval/detectInlineEvalArgv, so per-host workarounds would duplicate approval-boundary logic.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against c8d95da14c5b.

Label changes

Label changes:

add proof: sufficient: Contributor real behavior proof is sufficient. The contributor provided copied live output for the current head showing the production exec authorization adapter detects python3 -xcprint as inline eval and keeps it one-shot while a benign script invocation remains reusable.
add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The contributor provided copied live output for the current head showing the production exec authorization adapter detects python3 -xcprint as inline eval and keeps it one-shot while a benign script invocation remains reusable.
remove rating: 🧂 unranked krab: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.
remove status: 📣 needs proof: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

P0: The PR addresses a strictInlineEval approval-boundary gap where joined interpreter eval flags can be treated as reusable allowlisted invocations.
merge-risk: 🚨 compatibility: The patch intentionally changes strictInlineEval allowlist persistence for joined and clustered interpreter eval commands from durable approval toward one-shot approval.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The contributor provided copied live output for the current head showing the production exec authorization adapter detects python3 -xcprint as inline eval and keeps it one-shot while a benign script invocation remains reusable.
proof: sufficient: Contributor real behavior proof is sufficient. The contributor provided copied live output for the current head showing the production exec authorization adapter detects python3 -xcprint as inline eval and keeps it one-shot while a benign script invocation remains reusable.

Evidence reviewed

PR surface:

Source +182, Tests +100. Total +282 across 3 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	185	3	+182
Tests	2	100	0	+100
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	3	285	3	+282

What I checked:

Repository policy read and applied: Root AGENTS.md was read fully; its proof, compatibility, security-boundary, and deep-review guidance applies to this exec approval PR. (AGENTS.md:24, c8d95da14c5b)
Current main detector gap: Current main checks raw exact, raw prefix, normalized exact, and declared prefix flags, but has no joined exact or short-cluster matcher before falling through. (src/infra/command-analysis/inline-eval.ts:242, c8d95da14c5b)
PR head adds shared matcher paths: The PR head adds joined raw-exact, joined exact, and short-cluster matching, then calls those matchers from detectInterpreterInlineEvalArgv before normal prefix matching. (src/infra/command-analysis/inline-eval.ts:321, 19524888fca6)
Strict allow-always persistence uses this detector: Reusable allow-always patterns for interpreter-like targets are suppressed in strictInlineEval mode only when detectInlineEvalArgv finds an inline-eval hit. (src/infra/exec-approvals-allowlist.ts:1156, c8d95da14c5b)
Runtime callers share the detector: Gateway and node-host approval paths derive strict inline-eval behavior from detectPolicyInlineEval and resolveAllowAlwaysPersistenceDecision, so the shared detector is the right implementation layer. (src/agents/bash-tools.exec-host-gateway.ts:486, c8d95da14c5b)
Documented behavior contract: The exec docs say strictInlineEval requires approval for inline interpreter eval forms and prevents inline-eval forms from becoming durable allow rules. Public docs: docs/tools/exec.md. (docs/tools/exec.md:133, c8d95da14c5b)

Likely related people:

steipete: Merged the prior strict inline-eval approval-boundary PR and is the strongest routing signal for accepting the compatibility/security-boundary change. (role: recent area merger and likely compatibility decision owner; confidence: high; commits: 3e452f267139, 7c83cae42542; files: src/infra/exec-approvals-allowlist.ts, src/infra/exec-approvals-allow-always.test.ts)
luoyanglang: Authored the merged strict inline-eval interpreter approval reuse fix that this PR extends at the allow-always persistence boundary. (role: prior strictInlineEval fix author; confidence: high; commits: 7c83cae42542; files: src/infra/exec-approvals-allowlist.ts)
jacobtomlinson: Authored and merged the earlier interpreter allow-always non-persistence work that defines the persistence boundary touched here. (role: introduced prior persistence behavior; confidence: high; commits: 1a75906a6fe5; files: src/infra/exec-approvals-allowlist.ts, src/infra/exec-approvals-allow-always.test.ts)
eleqtrizit: Authored and merged recent versioned interpreter detector hardening on the same command-analysis detector surface. (role: recent inline-eval detector contributor; confidence: high; commits: 3168987b288f; files: src/infra/command-analysis/inline-eval.ts, src/infra/command-analysis/inline-eval.test.ts)
pgondhi987: Beyond authoring this PR, has prior merged command-analysis work for carried exec command forms in the same approval-risk area. (role: adjacent command-analysis contributor; confidence: medium; commits: 65d7232218a9; files: src/infra/command-analysis/risks.ts, src/infra/command-analysis/risks.test.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (8 earlier review cycles)

reviewed 2026-07-07T05:03:25.129Z sha bc03c22 :: needs real behavior proof before merge. :: none
reviewed 2026-07-07T05:41:26.448Z sha 6b2a50c :: needs real behavior proof before merge. :: [P2] Replace the string spread in cluster matching
reviewed 2026-07-07T05:55:02.625Z sha 04a9fa4 :: needs real behavior proof before merge. :: none
reviewed 2026-07-07T06:24:13.720Z sha cb3a1cc :: needs real behavior proof before merge. :: none
reviewed 2026-07-07T06:53:48.572Z sha d4fa226 :: needs real behavior proof before merge. :: none
reviewed 2026-07-07T12:26:26.523Z sha 756d41d :: needs real behavior proof before merge. :: none
reviewed 2026-07-07T13:04:50.005Z sha 9db8060 :: needs real behavior proof before merge. :: none
reviewed 2026-07-07T13:39:46.256Z sha 1952488 :: needs real behavior proof before merge. :: none

pgondhi987 · 2026-07-07T05:29:05Z

@clawsweeper re-review

clawsweeper · 2026-07-07T05:29:08Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

pgondhi987 · 2026-07-07T05:44:15Z

@clawsweeper re-review

clawsweeper · 2026-07-07T05:44:17Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

pgondhi987 · 2026-07-07T06:05:55Z

@clawsweeper re-review

clawsweeper · 2026-07-07T06:05:58Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

pgondhi987 · 2026-07-07T06:39:48Z

@clawsweeper re-review

clawsweeper · 2026-07-07T06:39:52Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

pgondhi987 · 2026-07-07T11:57:47Z

@clawsweeper re-review

clawsweeper · 2026-07-07T11:57:50Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

pgondhi987 · 2026-07-07T12:39:15Z

@clawsweeper re-review

clawsweeper · 2026-07-07T12:39:18Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

pgondhi987 · 2026-07-07T13:20:13Z

@clawsweeper re-review

clawsweeper · 2026-07-07T13:20:17Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

pgondhi987 · 2026-07-07T14:00:23Z

ClawSweeper proof for current head 1952488

Behavior proved: joined allowlisted interpreter inline-eval flags are detected by the OpenClaw exec authorization path and remain one-shot under strictInlineEval.

Environment: local PR checkout on Linux Node, plus GitHub Actions PR CI for the same head. Remote Testbox proof was unavailable because the installed Crabbox binary is 0.20.0 and the Testbox path requires 0.22.0.

Command/artifact:

node --import tsx --eval '<imports evaluateShellAllowlistWithAuthorization, detectPolicyInlineEval, resolveAllowAlwaysPersistenceDecision, resolveExecApprovalAllowedDecisions; creates a temp python3 allowlist target; runs fixed and benign scenarios>'
Focused validation: node scripts/run-vitest.mjs src/infra/command-analysis/inline-eval.test.ts src/infra/exec-authorization-allowlist.test.ts
GitHub Actions: current-head PR CI checked; no related failures. An unrelated tooling/native-app i18n check failed after rerun.

Evidence:

fixed/denied: python3 -xcprint returned analysisOk=true, allowlistSatisfied=true, segment ["python3","-xcprint"], inlineEval={executable:"python3",flag:"-c"}, allowAlwaysPersistence={kind:"one-shot",reasons:["no-reusable-pattern"]}, and approval choices ["allow-once","deny"].
control: python3 script.py returned analysisOk=true, allowlistSatisfied=true, segment ["python3","script.py"], inlineEval=null, allowAlwaysPersistence={kind:"patterns",patterns:[{pattern:"<redacted temp path>/python3"}]}, and approval choices ["allow-once","allow-always","deny"].
regression tests: 2 Vitest shards passed, 76 tests.
review gates: review-pr passed with 0 findings; autoreview passed with no accepted/actionable findings.
GHSA dry-run: passed for this head with SOLVES and backward-compatibility PASS.

Protected boundary/sink: reusable allow-always persistence for an allowlisted interpreter path. The fixed scenario proves the joined inline-eval form does not reach the reusable approval sink; the benign control proves ordinary allowlisted script execution still can use the reusable approval path.

Compatibility/operator note: this intentionally tightens strictInlineEval approval behavior for joined and clustered interpreter eval flags. No auth, config, migration, storage, provider, plugin, channel, protocol, or persisted credential surfaces changed.

Live gaps: no live gateway UI or remote Testbox artifact was available in this environment; the proof uses the production exec authorization adapter and redacted terminal output from the current checkout.

pgondhi987 · 2026-07-07T14:00:24Z

@clawsweeper re-review

pgondhi987 · 2026-07-07T14:18:51Z

Verification before merge:

Behavior addressed: joined and clustered interpreter inline-eval flags are now detected by the shared exec authorization path so strictInlineEval keeps them one-shot instead of reusable.
Real environment tested: local PR checkout on Linux Node; GitHub Actions PR CI; ClawSweeper proof re-review for head 19524888fca65b846bb2ee41f18e04e9f9172f3c.
Exact steps or command run after this patch:

node scripts/run-vitest.mjs src/infra/command-analysis/inline-eval.test.ts src/infra/exec-authorization-allowlist.test.ts
node --import tsx --eval '<production exec authorization proof for python3 -xcprint and python3 script.py>'
review-pr artifact validation for PR fix: detect joined inline eval flags [AI] #101353
timeout 1800 .agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main
auto-pr.sh issue 821 --run-stage ghsa_dry_run
auto-pr.sh issue 821 --run-stage ghsa_real_gate
Evidence after fix:
Focused validation passed: 2 Vitest shards, 76 tests.
Behavioral proof passed: python3 -xcprint produced inlineEval={executable:"python3",flag:"-c"} and allowAlwaysPersistence.kind="one-shot"; benign python3 script.py stayed non-inline and allowed reusable patterns.
review-pr passed with 0 findings; autoreview passed with no accepted/actionable findings.
ClawSweeper proof/re-review: proof sufficient, patch quality clean, ready for maintainer look; remaining item is exec/security owner acceptance of the compatibility tightening.
GHSA dry-run: passed with SOLVES; GHSA real gate: passed.
GitHub CI for head 19524888fca65b846bb2ee41f18e04e9f9172f3c: no related failures. One unrelated checks-node-compact-small-whole-2 rerun failed in test/scripts/native-app-i18n.test.ts.
Observed result after fix: the protected reusable allow-always sink is not reached for joined inline eval, while ordinary allowlisted script execution still works.
What was not tested: live Gateway UI/native-client flow and remote Testbox, because the installed Crabbox binary is 0.20.0 and this Testbox path requires 0.22.0.

Regression Risk:
Low to medium. The affected boundary is exec approval/allowlist persistence under strictInlineEval; auth, config, migrations, storage, providers, plugins, channels, protocol, and persisted credentials are unchanged. The main compatibility effect is intentional: previously reusable joined/clustered interpreter eval command shapes become one-shot approval paths.

Best fix verdict: best/appropriate. The shared detector is the right location because gateway, node-host, policy, risk, and persistence callers already consume it; duplicating checks downstream would leave sibling paths easier to miss.

User behavior change:
Before, some allowlisted joined or clustered interpreter eval commands could look reusable under strictInlineEval. After, those forms are detected as inline eval and limited to allow-once/deny, while benign allowlisted script commands can still offer allow-always.

* fix: detect joined inline eval flags * fix: avoid joined eval flag false positives * fix: detect clustered inline eval flags * fix: avoid cluster matcher string spread * fix: cover common eval flag clusters * fix: cover ruby perl eval clusters * fix: detect python x inline eval cluster * fix: detect numeric eval clusters * fix: cover ruby perl eval clusters

fix: detect joined inline eval flags

45b48fe

openclaw-barnacle Bot added size: S maintainer Maintainer-authored PR labels Jul 7, 2026

fix: avoid joined eval flag false positives

bc03c22

fix: detect clustered inline eval flags

6b2a50c

fix: avoid cluster matcher string spread

04a9fa4

fix: cover common eval flag clusters

cb3a1cc

fix: cover ruby perl eval clusters

d4fa226

openclaw-barnacle Bot added size: M and removed size: S labels Jul 7, 2026

fix: detect python x inline eval cluster

756d41d

fix: detect numeric eval clusters

9db8060

fix: cover ruby perl eval clusters

1952488

Merge remote-tracking branch 'origin/main' into fix/fix-821

fc895d9

pgondhi987 merged commit 58891c8 into openclaw:main Jul 8, 2026

Uh oh!

Uh oh!

Conversation

pgondhi987 commented Jul 7, 2026

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Uh oh!

pgondhi987 commented Jul 7, 2026

Uh oh!

clawsweeper Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

clawsweeper Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pgondhi987 commented Jul 7, 2026

Uh oh!

clawsweeper Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pgondhi987 commented Jul 7, 2026

Uh oh!

clawsweeper Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pgondhi987 commented Jul 7, 2026

Uh oh!

clawsweeper Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pgondhi987 commented Jul 7, 2026

Uh oh!

clawsweeper Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pgondhi987 commented Jul 7, 2026

Uh oh!

clawsweeper Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pgondhi987 commented Jul 7, 2026

Uh oh!

clawsweeper Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pgondhi987 commented Jul 7, 2026

Uh oh!

clawsweeper Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pgondhi987 commented Jul 7, 2026

Uh oh!

pgondhi987 commented Jul 7, 2026

Uh oh!

pgondhi987 commented Jul 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

clawsweeper Bot commented Jul 7, 2026 •

edited

Loading

clawsweeper Bot commented Jul 7, 2026 •

edited

Loading

clawsweeper Bot commented Jul 7, 2026 •

edited

Loading

clawsweeper Bot commented Jul 7, 2026 •

edited

Loading

clawsweeper Bot commented Jul 7, 2026 •

edited

Loading

clawsweeper Bot commented Jul 7, 2026 •

edited

Loading

clawsweeper Bot commented Jul 7, 2026 •

edited

Loading

clawsweeper Bot commented Jul 7, 2026 •

edited

Loading

clawsweeper Bot commented Jul 7, 2026 •

edited

Loading