fix(config): use Object.hasOwn instead of in operator for provider validation by zenglingbiao · Pull Request #99849 · openclaw/openclaw

zenglingbiao · 2026-07-04T06:29:03Z

Summary

Use Object.hasOwn() instead of the in operator in TalkRealtimeSchema, TalkSchema superRefine validators, and activeProviderFromTalk runtime resolver to prevent prototype chain pollution when validating and resolving provider keys.

What Problem This Solves

When a user sets talk.provider or talk.realtime.provider to an Object.prototype key like constructor or __proto__, the in operator traverses the prototype chain and incorrectly reports the key as present in the providers object — even though no such provider is configured.

Consequence:

Schema path: The Zod schema validation passes for an invalid provider value, accepting config with provider: "constructor" when it should be rejected.
Runtime resolver path: activeProviderFromTalk would incorrectly resolve "constructor" as a valid active provider, returning it as the active provider for downstream config responses.

Code evidence:

src/config/zod-schema.ts:329 — !(provider in realtime.providers!) in superRefine
src/config/zod-schema.ts:365 — !(provider in talk.providers!) in superRefine
src/config/talk.ts:160 — !(provider in providers) in activeProviderFromTalk

Root Cause

The in operator checks the entire prototype chain, not just own properties
Object.hasOwn() (ES2022+) correctly checks only the object's own properties
Object.hasOwn is already used 30+ times across src/config/ — these three sites were the remaining in operator usages on plain objects with variable keys

Why This Fix

Minimal: 3-line change across 2 files, no behavioral impact on normal provider keys
Complete: covers both schema validation (Zod superRefine) and runtime resolution (activeProviderFromTalk)
Consistent: matches existing Object.hasOwn usage pattern throughout src/config/
Regression-safe: normal provider keys pass unchanged; only prototype keys are affected

Evidence

Before: provider: "constructor" / provider: "__proto__" → validation incorrectly passes (prototype keys bypass both schema and resolver)
After: provider: "constructor" / provider: "__proto__" → validation correctly rejects with "missing" error; runtime resolver returns undefined
Normal provider keys regression: passed
Non-existent provider keys: still correctly rejected

Real Behavior Proof

Before (on main)

$ node --import tsx scripts/proof-zod-hasown.mjs
FAIL: talk.provider="constructor" rejected (not a real provider) — validation incorrectly passed (should have been rejected)
FAIL: talk.provider="__proto__" rejected (not a real provider) — validation incorrectly passed (should have been rejected)
FAIL: talk.realtime.provider="constructor" rejected (not a real provider) — validation incorrectly passed (should have been rejected)
FAIL: talk.realtime.provider="__proto__" rejected (not a real provider) — validation incorrectly passed (should have been rejected)
PASS: valid talk.provider matches talk.providers key
PASS: valid talk.realtime.provider matches providers key
PASS: talk.provider="acme" rejected (not in providers)
PASS: talk.provider="nonexistent" rejected (not in providers)

4 FAILED, 4 PASSED

After (with fix)

$ node --import tsx scripts/proof-zod-hasown.mjs
PASS: talk.provider="constructor" rejected (not a real provider)
PASS: talk.provider="__proto__" rejected (not a real provider)
PASS: talk.realtime.provider="constructor" rejected (not a real provider)
PASS: talk.realtime.provider="__proto__" rejected (not a real provider)
PASS: valid talk.provider matches talk.providers key
PASS: valid talk.realtime.provider matches providers key
PASS: talk.provider="acme" rejected (not in providers)
PASS: talk.provider="nonexistent" rejected (not in providers)

0 FAILED, 8 PASSED

Tests and Validation

Schema tests: constructor and __proto__ rejection in both talk.provider and talk.realtime.provider
Resolver tests: buildTalkConfigResponse with prototype keys returns no resolved provider
pnpm check: passed (only pre-existing npm shrinkwrap guard failure, unrelated)
Diff: 3 lines changed across 2 source files, tests added in 2 test files

clawsweeper · 2026-07-04T06:30:25Z

Codex review: needs real behavior proof before merge. Reviewed July 4, 2026, 6:02 AM ET / 10:02 UTC.

Summary
This PR changes Talk provider resolution from in to Object.hasOwn, adds resolver coverage, and also changes the agent web response text fallback under maxBytes.

PR surface: Source +5, Tests +54. Total +59 across 4 files.

Reproducibility: yes. source-reproducible: OpenClawSchema still uses prototype-chain in checks for both Talk provider validators. I did not run tests because this was a read-only review.

Review metrics: 2 noteworthy metrics.

Talk own-key validation coverage: 1 resolver changed, 2 schema validators unchanged. The PR body claims both schema and runtime provider validation are fixed, but the current diff only covers the runtime response resolver.
Unrelated web fallback surface: 1 agent web helper changed outside the config fix. The extra helper change has separate availability semantics and should not ride along with the Talk config validation repair.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🦪 silver shellfish
Patch quality: 🧂 unranked krab
Result: blocked until stronger real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P1] Update both Talk schema validators and add schema/config-load prototype-key regression tests.
Remove or split the web fallback change, or make it truly bounded under maxBytes.
Refresh current-head real behavior proof after the code matches the claimed validation behavior.

Proof guidance:

[P1] Needs stronger real behavior proof before merge: The PR body includes copied terminal output, but it claims schema rejection on the current fix while the current diff leaves the schema validators unchanged. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Risk before merge

[P1] The schema validation path still accepts prototype-chain provider names, so merging would not complete the config boundary the PR says it fixes.
[P2] The web fallback change still buffers the full .text() response and then allocates a full UTF-8 copy under maxBytes, which is an availability-sensitive side change outside the config fix.
[P1] The copied proof output claims schema rejection after the fix, but the current head does not modify the schema validators.

Maintainer options:

Narrow and complete the config fix (recommended)
Update the two Talk schema validators to use own-key checks, keep the resolver test, and remove the unrelated web fallback diff unless it is separately fixed and proven.
Split web fallback hardening
Move the readResponseText fallback change to its own PR where maintainers can decide whether to fail closed or accept a documented unbounded fallback.

Next step before merge

[P1] The contributor needs to revise the PR and refresh real behavior proof; automation cannot supply contributor-side proof for the current head.

Security
Needs attention: The patch is security-adjacent and incomplete because schema-side provider validation still uses prototype lookup.

Review findings

[P2] Complete own-key validation in the schema path — src/config/talk.ts:160
[P2] Avoid buffering the fallback body under maxBytes — src/agents/tools/web-shared.ts:316-320

Review details

Best possible solution:

Narrow this PR to the Talk config fix by updating both Zod validators and the runtime resolver with matching tests, and either remove the web fallback changes or move a truly bounded version to a separate PR with current-head proof.

Do we have a high-confidence way to reproduce the issue?

Yes, source-reproducible: OpenClawSchema still uses prototype-chain in checks for both Talk provider validators. I did not run tests because this was a read-only review.

Is this the best way to solve the issue?

No. The resolver change is necessary, but the best fix must also update the schema validators and avoid bundling the unrelated unbounded web fallback change.

Full review comments:

[P2] Complete own-key validation in the schema path — src/config/talk.ts:160
The PR body says talk.provider and talk.realtime.provider are rejected by schema validation, but this patch only changes activeProviderFromTalk. Current src/config/zod-schema.ts still uses provider in ... in both superRefine checks, so a prototype-key provider can still pass config validation before the runtime response resolver sees it.
Confidence: 0.93
[P2] Avoid buffering the fallback body under maxBytes — src/agents/tools/web-shared.ts:316-320
This fallback still calls res.text() before checking maxBytes, then encodes the entire string just to truncate it. For Response-like objects without a readable stream or arrayBuffer, a large body can still be fully buffered and copied despite the caller's cap; either fail closed when no bounded byte source exists or remove this unrelated web helper change from the config PR.
Confidence: 0.88

Overall correctness: patch is incorrect
Overall confidence: 0.9

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 79d2e568a0aa.

Label changes

Label changes:

add merge-risk: 🚨 auth-provider: The PR changes Talk provider resolution while leaving schema validation on a different provider-key rule.
add merge-risk: 🚨 availability: The web fallback diff can still fully buffer and copy a large response despite a maxBytes cap.
add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🦪 silver shellfish and patch quality is 🧂 unranked krab.
add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The PR body includes copied terminal output, but it claims schema rejection on the current fix while the current diff leaves the schema validators unchanged. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

P2: This is a normal-priority security-adjacent config validation bugfix with limited blast radius, but the current PR is incomplete.
merge-risk: 🚨 auth-provider: The PR changes Talk provider resolution while leaving schema validation on a different provider-key rule.
merge-risk: 🚨 availability: The web fallback diff can still fully buffer and copy a large response despite a maxBytes cap.
rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🦪 silver shellfish and patch quality is 🧂 unranked krab.
status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The PR body includes copied terminal output, but it claims schema rejection on the current fix while the current diff leaves the schema validators unchanged. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence reviewed

PR surface:

Source +5, Tests +54. Total +59 across 4 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	2	7	2	+5
Tests	2	54	0	+54
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	4	61	2	+59

Security concerns:

[medium] Schema-side provider validation still uses prototype lookup — src/config/zod-schema.ts:329
The current PR fixes the runtime resolver but leaves the two Zod provider validators using in, so the claimed provider-validation hardening is incomplete.
Confidence: 0.92

What I checked:

Repository policy read: Root AGENTS.md was read fully, plus the scoped src/agents/AGENTS.md and src/agents/tools/AGENTS.md; the review applied the config/security-boundary and agent-tool guidance. (AGENTS.md:1, 79d2e568a0aa)
Current PR diff scope: The live PR diff changes src/config/talk.ts and src/config/talk.normalize.test.ts, but does not change src/config/zod-schema.ts despite the PR body claiming schema validation is fixed. (src/config/talk.ts:160, 1387ce9ce220)
Schema validators still use prototype-chain membership: Current main still checks provider in realtime.providers and provider in talk.providers in the Zod superRefine validators. (src/config/zod-schema.ts:329, 79d2e568a0aa)
Runtime resolver path: The runtime response resolver currently uses activeProviderFromTalk() before materializing buildTalkConfigResponse, so the PR's resolver change is on a real output path. (src/config/talk.ts:247, 79d2e568a0aa)
Unbounded fallback side change: The PR diff leaves the fallback calling res.text() before enforcing maxBytes, then allocates a full encoded copy before truncation. (src/agents/tools/web-shared.ts:315, 1387ce9ce220)
History signal: GitHub path history shows recent Talk/config ownership through feat: forward-port fast talks auto mode and voice provider refactors, and web helper history through bounded response reader work. (src/config/talk.ts, 2b75806197ab)

Likely related people:

vincentkoc: Recent Talk/provider work touched src/config/talk.ts, src/config/zod-schema.ts, Talk tests, and speech-provider config in the voice provider refactor and fast Talk forward-port history. (role: recent Talk provider/config contributor; confidence: medium; commits: 2b75806197ab, 27b15a19e84c; files: src/config/talk.ts, src/config/zod-schema.ts, src/config/talk.normalize.test.ts)
steipete: Recent commits touched config schema helpers and the shared web helper path, including normalization extraction and web timeout/caching fixes. (role: recent config/schema and web helper contributor; confidence: medium; commits: 43190f5248b5, 00d8d7ead059, fbee4d56c4ca; files: src/config/zod-schema.ts, src/agents/tools/web-shared.ts)
amknight: The legacy charset decoding PR touched src/agents/tools/web-shared.ts, which is the same helper affected by the unrelated fallback change in this PR. (role: adjacent web response helper contributor; confidence: low; commits: 7a23b2d945cc; files: src/agents/tools/web-shared.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (8 earlier review cycles)

reviewed 2026-07-04T07:06:24.951Z sha eb69c12 :: needs real behavior proof before merge. :: [P1] Gate the legacy value read on the own-key check
reviewed 2026-07-04T08:44:29.413Z sha 79ac2a2 :: needs real behavior proof before merge. :: [P1] Reject the non-streaming fallback entirely
reviewed 2026-07-04T08:49:13.329Z sha 79ac2a2 :: needs real behavior proof before merge. :: [P1] Reject the non-streaming fallback entirely
reviewed 2026-07-04T09:09:33.634Z sha 698c99d :: needs real behavior proof before merge. :: [P2] Apply own-key selection to the Talk resolver too
reviewed 2026-07-04T09:26:35.558Z sha 751ff65 :: needs changes before merge. :: [P2] Carry the own-key check into the Talk resolver
reviewed 2026-07-04T09:33:34.892Z sha 34ae29c :: needs real behavior proof before merge. :: [P2] Avoid buffering the text fallback under a byte cap
reviewed 2026-07-04T09:39:58.257Z sha 34ae29c :: needs real behavior proof before merge. :: [P2] Avoid buffering the text fallback under a byte cap
reviewed 2026-07-04T09:49:15.340Z sha 97cca0d :: found issues before merge. :: [P2] Carry own-key validation into Talk provider resolution

zenglingbiao · 2026-07-04T06:56:43Z

@clawsweeper re-review

clawsweeper · 2026-07-04T06:56:45Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

readResponseText's .text() fallback path ignored the maxBytes option, reading the full body unbounded. When a foreign Response lacks a body stream (no getReader) and no arrayBuffer(), the .text() call was the last resort — but maxBytes was never applied. - Honor maxBytes in the .text() fallback: truncate + set truncated=true - Under-cap responses pass through unchanged - No maxBytes set → original behavior preserved (regression safe)

zenglingbiao · 2026-07-04T08:40:35Z

@clawsweeper re-review

clawsweeper · 2026-07-04T08:40:37Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Replace text.length/text.slice (character-level) with TextEncoder/ TextDecoder (byte-level) so the maxBytes cap is respected at byte granularity, consistent with the bounded-stream path at lines 240-298. - bytes.byteLength > maxBytes instead of text.length > maxBytes - TextDecoder().decode(bytes.slice(0, maxBytes)) for byte-safe truncation - bytesRead reports actual bytes, not character count

zenglingbiao · 2026-07-04T09:43:51Z

@clawsweeper re-review

clawsweeper · 2026-07-04T09:43:53Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

…lidation

zenglingbiao · 2026-07-04T09:57:00Z

@clawsweeper re-review

clawsweeper · 2026-07-04T09:57:03Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Source: #99849 Co-authored-by: zenglingbiao <[email protected]>

* fix(agents): harden LSP process failures Source: #100450 Co-authored-by: morluto <[email protected]> * fix(sandbox): report effective workspace layout Sources: #100435, #100439 Co-authored-by: Aniruddha Adak <[email protected]> Co-authored-by: ZengWen-DT <[email protected]> * fix(security): fail install checks on stream errors Source: #100413 Co-authored-by: 陈宪彪0668000387 <[email protected]> * fix(android): normalize all-day calendar events Source: #100032 Co-authored-by: NianJiuZst <[email protected]> * fix(ios): serialize push-to-talk lifecycle Source: #99942 Co-authored-by: NianJiuZst <[email protected]> * fix(talk): reject inherited provider names Source: #99849 Co-authored-by: zenglingbiao <[email protected]> * fix(android): stop voice capture in background Source: #99840 Co-authored-by: xialonglee <[email protected]> * fix(cron): preserve fallback result classification Source: #99913 Co-authored-by: jincheng-xydt <[email protected]> * fix(google): bound Vertex response decompression Source: #99812 Co-authored-by: 黄剑雄0668001315 <[email protected]> * fix(plugins): report malformed discovery JSON Source: #99892 Co-authored-by: 陈宪彪0668000387 <[email protected]> * test(sandbox): configure non-default workspace fixture * test: fix small-fix batch validation --------- Co-authored-by: morluto <[email protected]> Co-authored-by: ZengWen-DT <[email protected]> Co-authored-by: 陈宪彪0668000387 <[email protected]> Co-authored-by: NianJiuZst <[email protected]> Co-authored-by: zenglingbiao <[email protected]> Co-authored-by: xialonglee <[email protected]> Co-authored-by: jincheng-xydt <[email protected]> Co-authored-by: 黄剑雄0668001315 <[email protected]>

steipete · 2026-07-05T23:10:36Z

Thanks @zenglingbiao — your prototype-chain provider validation fix was incorporated into #100483, landed as aaf5ab9. The landed version applies own-property checks at all three sibling Talk boundaries and covers both constructor and __proto__. Contributor credit is preserved. Closing this superseded PR.

* fix(agents): harden LSP process failures Source: openclaw#100450 Co-authored-by: morluto <[email protected]> * fix(sandbox): report effective workspace layout Sources: openclaw#100435, openclaw#100439 Co-authored-by: Aniruddha Adak <[email protected]> Co-authored-by: ZengWen-DT <[email protected]> * fix(security): fail install checks on stream errors Source: openclaw#100413 Co-authored-by: 陈宪彪0668000387 <[email protected]> * fix(android): normalize all-day calendar events Source: openclaw#100032 Co-authored-by: NianJiuZst <[email protected]> * fix(ios): serialize push-to-talk lifecycle Source: openclaw#99942 Co-authored-by: NianJiuZst <[email protected]> * fix(talk): reject inherited provider names Source: openclaw#99849 Co-authored-by: zenglingbiao <[email protected]> * fix(android): stop voice capture in background Source: openclaw#99840 Co-authored-by: xialonglee <[email protected]> * fix(cron): preserve fallback result classification Source: openclaw#99913 Co-authored-by: jincheng-xydt <[email protected]> * fix(google): bound Vertex response decompression Source: openclaw#99812 Co-authored-by: 黄剑雄0668001315 <[email protected]> * fix(plugins): report malformed discovery JSON Source: openclaw#99892 Co-authored-by: 陈宪彪0668000387 <[email protected]> * test(sandbox): configure non-default workspace fixture * test: fix small-fix batch validation --------- Co-authored-by: morluto <[email protected]> Co-authored-by: ZengWen-DT <[email protected]> Co-authored-by: 陈宪彪0668000387 <[email protected]> Co-authored-by: NianJiuZst <[email protected]> Co-authored-by: zenglingbiao <[email protected]> Co-authored-by: xialonglee <[email protected]> Co-authored-by: jincheng-xydt <[email protected]> Co-authored-by: 黄剑雄0668001315 <[email protected]>

zenglingbiao requested a review from a team as a code owner July 4, 2026 06:29

openclaw-barnacle Bot added the size: S label Jul 4, 2026

zenglingbiao force-pushed the fix/cron-job-patch-hasown branch from 17e6a10 to eb69c12 Compare July 4, 2026 06:55

zenglingbiao changed the title ~~fix(cron): use Object.hasOwn instead of in operator in job patch helpers~~ fix(cron): use Object.hasOwn instead of in operator in normalizeCronJobIdentityFields Jul 4, 2026

openclaw-barnacle Bot added size: XS and removed size: S labels Jul 4, 2026

zenglingbiao force-pushed the fix/cron-job-patch-hasown branch from eb69c12 to 79ac2a2 Compare July 4, 2026 08:40

zenglingbiao changed the title ~~fix(cron): use Object.hasOwn instead of in operator in normalizeCronJobIdentityFields~~ fix(plugin-catalog): require Content-Length for non-streaming catalog responses Jul 4, 2026

clawsweeper Bot added the merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. label Jul 4, 2026

zenglingbiao force-pushed the fix/cron-job-patch-hasown branch from 79ac2a2 to 698c99d Compare July 4, 2026 09:03

clawsweeper Bot added P2 Normal backlog priority with limited blast radius. and removed P1 High-priority user-facing bug, regression, or broken workflow. labels Jul 4, 2026

openclaw-barnacle Bot added scripts Repository scripts size: S and removed size: XS labels Jul 4, 2026

zenglingbiao changed the title ~~fix(plugin-catalog): require Content-Length for non-streaming catalog responses~~ fix(config): use Object.hasOwn instead of in operator for provider validation Jul 4, 2026

zenglingbiao force-pushed the fix/cron-job-patch-hasown branch from 34ae29c to 97cca0d Compare July 4, 2026 09:43

openclaw-barnacle Bot removed the agents Agent runtime and tooling label Jul 4, 2026

fix(config): use Object.hasOwn instead of in operator for provider va…

1387ce9

…lidation

zenglingbiao force-pushed the fix/cron-job-patch-hasown branch from 97cca0d to 1387ce9 Compare July 4, 2026 09:56

openclaw-barnacle Bot added agents Agent runtime and tooling size: S and removed size: XS labels Jul 4, 2026

clawsweeper Bot removed proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. labels Jul 4, 2026

clawsweeper Bot removed merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. labels Jul 4, 2026

steipete self-assigned this Jul 5, 2026

steipete mentioned this pull request Jul 5, 2026

fix: land ten small reliability fixes #100483

Merged

steipete added a commit that referenced this pull request Jul 5, 2026

fix(talk): reject inherited provider names

a023d7e

Source: #99849 Co-authored-by: zenglingbiao <[email protected]>

steipete closed this Jul 5, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(config): use Object.hasOwn instead of in operator for provider validation#99849

fix(config): use Object.hasOwn instead of in operator for provider validation#99849
zenglingbiao wants to merge 4 commits into
openclaw:mainfrom
zenglingbiao:fix/cron-job-patch-hasown

zenglingbiao commented Jul 4, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jul 4, 2026 •

edited

Loading

Uh oh!

zenglingbiao commented Jul 4, 2026

Uh oh!

clawsweeper Bot commented Jul 4, 2026 •

edited

Loading

Uh oh!

zenglingbiao commented Jul 4, 2026

Uh oh!

clawsweeper Bot commented Jul 4, 2026 •

edited

Loading

Uh oh!

zenglingbiao commented Jul 4, 2026

Uh oh!

clawsweeper Bot commented Jul 4, 2026 •

edited

Loading

Uh oh!

zenglingbiao commented Jul 4, 2026

Uh oh!

clawsweeper Bot commented Jul 4, 2026 •

edited

Loading

Uh oh!

steipete commented Jul 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

zenglingbiao commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What Problem This Solves

Root Cause

Why This Fix

Evidence

Real Behavior Proof

Before (on main)

After (with fix)

Tests and Validation

Uh oh!

clawsweeper Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zenglingbiao commented Jul 4, 2026

Uh oh!

clawsweeper Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zenglingbiao commented Jul 4, 2026

Uh oh!

clawsweeper Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zenglingbiao commented Jul 4, 2026

Uh oh!

clawsweeper Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zenglingbiao commented Jul 4, 2026

Uh oh!

clawsweeper Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

steipete commented Jul 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

zenglingbiao commented Jul 4, 2026 •

edited

Loading

clawsweeper Bot commented Jul 4, 2026 •

edited

Loading

clawsweeper Bot commented Jul 4, 2026 •

edited

Loading

clawsweeper Bot commented Jul 4, 2026 •

edited

Loading

clawsweeper Bot commented Jul 4, 2026 •

edited

Loading

clawsweeper Bot commented Jul 4, 2026 •

edited

Loading