- Plugins/CLI: load the install-records ledger when listing channel-catalog entries, so npm-installed third-party channel plugins resolve through `openclaw channels login`/`channels add` instead of failing with `Unsupported channel`. (#77269) Thanks @pumpkinxing1.

- Memory wiki/Security: enforce session visibility on shared-memory `wiki_search` and `wiki_get` so sandboxed subagents cannot read transcript content from sibling or parent sessions. Fixes GHSA-72fw-cqh5-f324. Thanks @zsxsoft.

- Exec approvals: enforce allowlist `argPattern` argument restrictions on Linux and macOS as well as Windows, so an entry like `{ pattern: "python3", argPattern: "^safe\.py$" }` no longer silently relaxes to a path-only match on non-Windows hosts. (#75143) Thanks @eleqtrizit.

- Security/exec allowlist: collapse `.` and `..` segments in wildcard exec allowlist match targets and canonicalize absolute executable path candidates before regex matching, so a target like `/usr/bin/../../bin/sh` no longer string-matches a `/usr/bin/**` allowlist entry while resolving outside the declared root. (#75723) Thanks @eleqtrizit and @zsxsoft.

- Agents/compaction: disable Pi auto-compaction whenever OpenClaw effectively owns safeguard compaction, including provider-backed safeguard mode, so Pi and OpenClaw no longer fight over long-session compaction. Fixes #73003. (#73839) Thanks @bradhallett.

- Telegram/streaming: finalize text replies by stopping the edited stream message instead of sending a second answer bubble, so Telegram turns cannot duplicate the streamed final response. (#77947) Thanks @obviyus.

- web_search/Brave: fix provider selection when Brave is installed as an external plugin and `tools.web.search.provider: "brave"` is explicitly configured — a redundant provider re-resolution at startup could race and return an empty list, causing a spurious `WEB_SEARCH_PROVIDER_INVALID_AUTODETECT` warning and treating the explicitly configured provider as absent. Fixes #77676. Thanks @openperf.

}

});

it.runIf(process.platform !== "win32")(

"rejects wildcard path matches that escape through dot segments",

() => {

expect(

matchAllowlist([{ pattern: "/usr/bin/**" }], {

rawExecutable: "/usr/bin/../../bin/sh",

resolvedPath: "/usr/bin/../../bin/sh",

executableName: "sh",

}),

).toBeNull();

expect(

matchAllowlist([{ pattern: "/usr/bin/**" }], {

rawExecutable: "/usr/bin/sub/../env",

resolvedPath: "/usr/bin/sub/../env",

executableName: "env",

})?.pattern,

).toBe("/usr/bin/**");

},

);

it("matches absolute paths containing regex metacharacters literally", () => {

const plusPathCases = ["/usr/bin/g++", "/usr/bin/clang++"] as const;

for (const candidatePath of plusPathCases) {

expect(matchesExecAllowlistPattern(pattern, target)).toBe(expected);

});

it.runIf(process.platform !== "win32")(

"matches wildcard paths after collapsing dot segments",

() => {

expect(matchesExecAllowlistPattern("/usr/bin/**", "/usr/bin/../../bin/sh")).toBe(false);

expect(

matchesExecAllowlistPattern("/trusted/tools/**", "/trusted/tools/../../etc/shadow"),

).toBe(false);

expect(matchesExecAllowlistPattern("/usr/bin/**", "../../etc/shadow")).toBe(false);

expect(matchesExecAllowlistPattern("/usr/bin/**", "/usr/bin/./env")).toBe(true);

expect(matchesExecAllowlistPattern("/usr/bin/**", "/usr/./bin/./env")).toBe(true);

expect(matchesExecAllowlistPattern("/usr/bin/**", "/usr/bin/sub/../env")).toBe(true);

expect(matchesExecAllowlistPattern("/usr/bin/*", "/usr/bin/sub/../env")).toBe(true);

expect(matchesExecAllowlistPattern("/usr/bin/**", "/usr/bin/sub/tool")).toBe(true);

},

);

it.runIf(process.platform !== "win32")(

"keeps wildcard dot-segment matches inside the declared POSIX root",

() => {

const bases = ["/usr/bin", "/opt/tools", "/srv/bin"] as const;

for (const base of bases) {

const pattern = `${base}/**`;

expect(matchesExecAllowlistPattern(pattern, `${base}/inside/file`)).toBe(true);

expect(matchesExecAllowlistPattern(pattern, `${base}/sub/../inside`)).toBe(true);

expect(matchesExecAllowlistPattern(pattern, `${base}/../escape`)).toBe(false);

expect(matchesExecAllowlistPattern(pattern, `${base}/sub/../../escape`)).toBe(false);

}

},

);

it("expands home-prefix patterns", () => {

const prevOpenClawHome = process.env.OPENCLAW_HOME;

const prevHome = process.env.HOME;

true,

);

});

it.runIf(process.platform === "win32")(

"matches Windows wildcard paths after collapsing dot segments",

() => {

expect(

matchesExecAllowlistPattern("C:/Tools/**", "C:/Tools/../../Windows/System32/cmd.exe"),

).toBe(false);

expect(matchesExecAllowlistPattern("C:/Tools/**", String.raw`..\..\Windows\cmd.exe`)).toBe(

false,

);

expect(matchesExecAllowlistPattern("C:/Tools/**", "C:/Tools/bin/../runner.exe")).toBe(true);

},

);

});

import fs from "node:fs";

import path from "node:path";

import { normalizeLowercaseStringOrEmpty } from "../shared/string-coerce.js";

import { expandHomePrefix } from "./home-dir.js";

}

}

function hasDotPathSegment(value: string): boolean {

return value

.replace(/\\/g, "/")

.split("/")

.some((segment) => segment === "." || segment === "..");

}

function normalizeDotPathSegments(value: string): string {

const normalized =

process.platform === "win32" ? path.win32.normalize(value) : path.posix.normalize(value);

return normalizeMatchTarget(normalized);

}

function escapeRegExpLiteral(input: string): string {

return input.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");

}

}

normalizedPattern = normalizeMatchTarget(normalizedPattern);

normalizedTarget = normalizeMatchTarget(normalizedTarget);

// Normalize only the target. Glob patterns are operator-authored strings, and

// normalizing them can change wildcard structure such as `*/..`.

if (hasWildcard && hasDotPathSegment(normalizedTarget)) {

normalizedTarget = normalizeDotPathSegments(normalizedTarget);

}

return compileGlobRegex(normalizedPattern).test(normalizedTarget);

}

resolveExecutable,

resolveExecutableFromPathEnv,

resolveExecutablePath,

resolveExecutablePathCandidate,

} from "./executable-path.js";

function restoreEnvValue(name: string, value: string | undefined): void {

});

});

it.runIf(process.platform !== "win32")("normalizes POSIX absolute executable candidates", () => {

expect(resolveExecutablePathCandidate("/usr/bin/../../bin/sh")).toBe("/bin/sh");

expect(resolveExecutablePathCandidate("/usr/bin/./env")).toBe("/usr/bin/env");

});

it.runIf(process.platform === "win32")(

"normalizes Windows absolute executable candidates",

() => {

expect(

resolveExecutablePathCandidate(String.raw`C:\Tools\..\..\Windows\System32\cmd.exe`),

).toBe(String.raw`C:\Windows\System32\cmd.exe`);

expect(resolveExecutablePathCandidate(String.raw`C:\Tools\.\runner.exe`)).toBe(

String.raw`C:\Tools\runner.exe`,

);

},

);

it("does not treat drive-less rooted windows paths as cwd-relative executables", () => {

if (process.platform !== "win32") {

return;

return expanded;

}

if (path.isAbsolute(expanded)) {

return expanded;

return path.resolve(expanded);

}

const base = options?.cwd && options.cwd.trim() ? options.cwd.trim() : process.cwd();

return path.resolve(base, expanded);