Repository navigation

Security hardening phase 1 + Foundry integration improvements - #15

Merged

Pal Lakatos-Toth (pallakatos) merged 38 commits into

mainfrom

security/hardening-phase1

Apr 1, 2026

Commits on Mar 31, 2026
- security: harden secrets, auth, injection, crypto, and fail-closed gates
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  5d32e09
- security: phase 2 — crypto, policy, logging, and validation hardening
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  579ba28
- fix: sidecar admin token race — generate before sidecar starts, pass via env
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  3a951d9
- fix: spawn latency ~2min→~15s + registry path allowlist
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  5b9a4ca
- fix: router→sidecar auth for trust/audit endpoints
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  e904d06
- feat: image generation via standard OpenAI Images API
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  7ee0676
- Feat: unified /openai/v1/ proxy + Responses API + auto-fallback
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  c13f302
- Fix: secure parent-mediated trust delegation for mesh siblings
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  7c7b14b
- Perf: cache Responses-only models to skip redundant chat/completions attempts
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  fd3e065
- Fix: complete chat↔Responses API format translation
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  42f6223
- Fix: don't force-kill running sub-agent containers on re-spawn
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  e504597
- Fix: reuse existing sandbox on AKS instead of erroring on 409
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  d0387ff
- Perf: optimize mesh handshake latency (no crypto changes)
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  0826e48
- Fix: responses_to_chat_body skipped conversion due to 'error: null'
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  8dcaa39
- Fix: SSE keepalive for Responses API to prevent client timeouts
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  bc4b6cc
- Fix sub-agent task execution: bypass OpenClaw gateway, add mesh_send + image_gen
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  e157a0f
Commits on Apr 1, 2026
- Fix: entrypoint crash when /sandbox/.bashrc missing on AKS
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  877388b
- Fix: enable azureclaw plugin in OpenClaw config entries
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  c14e618
- Fix: Foundry project endpoint lost on cache reload
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  be80eef
- feat: AzureClaw identity via OpenClaw config + MEMORY.md
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  9207851
- feat: unified secrets store for all credentials
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  d4f0622
- feat: azureclaw add resolves tokens from secrets.json
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  1ce43e6
- feat: guided credential wizard + multi-token + operator integration
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  89d2c38
- feat: add discover + mesh_inbox to sub-agents, guided credentials wizard
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  23be185
- fix: restore delegateToNativeAgent as primary sub-agent path
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  301e980
- feat: AGT as sole policy authority for sub-agent tasks
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  b9162e1
- fix: use max_completion_tokens for AOAI compatibility
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  47b5170
- fix: build errors in credentials wizard and exec_command handler
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  ad31dc5
- fix: resolveSecret falls back to dot-suffixed variants
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  58e75f7
- feat: channel variant syntax for credential selection
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  92cef1c
- fix: image generation timeout + Go 1.25 + npm audit fix
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  aed4e1d
- fix: disable OpenClaw exec approvals via config
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  bce1a5d
- feat: register image generation provider for inline rendering
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  ca169af
- feat: inline image rendering via OpenClaw's native image_generate
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  3f279a9
- style: cargo fmt
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  ab1f215
- fix: address code quality review comments
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  211fe88
- feat: operator spawn UX — show token variant names and allow-from support
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  1f0b170
- ci: use larger runner for container image scan
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  e0aeff2

Commits

Commits on Mar 31, 2026

Commits on Apr 1, 2026