Cherry-pick batch: security FS write hardening#1588
Merged
alexey-pelykh merged 15 commits intomainfrom Mar 17, 2026
Merged
Conversation
(cherry picked from commit 0dbb92d)
(cherry picked from commit 18f8393)
(cherry picked from commit 4a80311)
(cherry picked from commit 07b16d5)
(cherry picked from commit d3e8b17)
(cherry picked from commit d4bf07d)
(cherry picked from commit 7dac9b0)
…th checks (cherry picked from commit 83c8406)
* fix(daemon): add launchd umask hardening * fix: finalize launchd umask changelog + thanks (openclaw#31919) (thanks @liuxiaopai-ai) --------- Co-authored-by: Peter Steinberger <[email protected]> (cherry picked from commit 718d418)
…aming (cherry picked from commit a8fe8b6)
…aw#31997) (thanks @liuxiaopai-ai) (cherry picked from commit ee68fa8)
- bluebubbles/monitor.test.ts: OpenClawConfig → RemoteClawConfig (rebrand miss) - bluebubbles/monitor.ts, googlechat/monitor.ts: registerWebhookTargetWithPluginRoute → registerWebhookTarget (upstream refactored function not in fork plugin-sdk) - sandbox/workspace.test.ts: remove orphaned test for gutted sandbox workspace module - skills-install-extract.ts: fix hasBinary import from deleted skills.js → shared/config-eval.js - fs-safe.ts: add missing pipeline import, OPEN_WRITE_*_FLAGS constants, assertNoPathAliasEscape stub, and openVerifiedLocalFile options parameter - fs-safe.test.ts: add missing writeFileWithinRoot/copyFileWithinRoot/writeFileFromPathWithinRoot imports from fs-safe.js - install-safe-path.ts: add assertCanonicalPathWithinBase (upstream definition from unmerged PR) - install-package-dir.ts: add missing assertCanonicalPathWithinBase import Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
(cherry picked from commit 104d32b)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cherry-pick batch from upstream
Issue: #732
Commits: 14 evaluated, 11 cherry-picked, 3 skipped
17ede52a40dbb92dd218f8393b614c93d2644a803116207b16d5ad104d32bb6d3e8b17aad4bf07d077dac9b05d83c8406f0718d418b3a8fe8b6bfee68fa86b🤖 Generated with Claude Code