@@ -18,7 +18,7 @@ Docs: https://docs.openclaw.ai
1818- Canvas: return not found for malformed percent-encoded Canvas/A2UI/document asset paths and keep decoded parent traversal blocked before path normalization.
1919- Telegram: allow trusted local Bot API media files whose filenames start with dots instead of falling back to remote download.
2020- Agents/Codex app-server: remap injected context files under dot-dot-prefixed workspace directories when a run switches to an effective sandbox workspace.
21-- Control UI/i18n: use the installed workspace pi runtime for locale refreshes and update the fallback package pin, restoring the scheduled locale refresh workflow.
21+- Control UI/i18n: use the installed workspace pi runtime for locale refreshes, update the fallback package pin, and prefer the Anthropic CI provider when available, restoring the scheduled locale refresh workflow.
2222- Agents: allow dot-dot-prefixed filenames such as `..note.txt` through sandbox FS bridge, remote sandbox reads, and apply_patch summaries without mistaking the name for parent traversal.
2323- CLI/migrate: hide per-item source/plugin hints on non-conflicting Codex skill and plugin selection prompts, keeping the hint text reserved for rows that actually need attention. Thanks @sjf.
2424- Codex harness: treat high-confidence app-server OAuth refresh invalidation as a terminal auth-profile failure, stopping repeated raw token-refresh errors without turning entitlement or usage-limit payloads into re-auth prompts.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。