3 people bde0b77a86 fix(security): prevent metadata spoofing of internal job monitor flag (#1195) ...

The `__internal_job_monitor` metadata key that bypassed the entire
agent pipeline (hooks, safety checks, LLM processing) was spoofable
by external channels — WASM channel plugins could inject arbitrary
metadata including this key, causing attacker-controlled content to be
forwarded directly as assistant responses.

Replace the metadata-based check with a dedicated `is_internal` field
on `IncomingMessage` that can only be set via `into_internal()` by
trusted in-process code. Both the field and setter are `pub(crate)` to
prevent external crates from spoofing the flag. Also remove
`notify_metadata` forwarding (the monitor only needs channel/user/thread
routing) and the unused `__job_monitor_job_id` metadata key.

Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>

2026-03-15 21:33:04 +00:00

..

e2e

fix(web-chat): normalize chat copy to plain text (#1114)

2026-03-15 05:52:47 +00:00

fixtures

tools: improve routine schema guidance (#1089)

2026-03-13 11:24:45 -07:00

support

fix(mcp): open MCP OAuth in same browser as gateway (#951)

2026-03-12 11:16:23 -07:00

test-pages

test(html_to_markdown): refresh golden files after renderer bump (#1016)

2026-03-11 20:28:38 -07:00

batch_query_tests.rs

fix: N+1 query pattern in event trigger loop (routine_engine) (#1163)

2026-03-14 13:06:59 -07:00

config_round_trip.rs

refactor: centralize test credential constants into testing::credentials (#829)

2026-03-10 13:25:32 -07:00

e2e_advanced_traces.rs

test: add event-trigger routine e2e coverage (#1088)

2026-03-13 11:24:25 -07:00

e2e_attachments.rs

feat: WASM channel attachments with LLM pipeline integration (#596)

2026-03-07 18:01:40 +00:00

e2e_builtin_tool_coverage.rs

tools: improve routine schema guidance (#1089)

2026-03-13 11:24:45 -07:00

e2e_metrics_test.rs

Add generic host-verified /webhook/tools/{tool} ingress (#757)

2026-03-11 03:36:25 +00:00

e2e_recorded_trace.rs

feat: merge http/web_fetch tools, add tool output stash for large responses (#578)

2026-03-06 00:49:10 +00:00

e2e_routine_heartbeat.rs

fix(security): prevent metadata spoofing of internal job monitor flag (#1195)

2026-03-15 21:33:04 +00:00

e2e_safety_layer.rs

Trajectory benchmarks and e2e trace test rig (#553)

2026-03-05 09:13:09 +00:00

e2e_spot_checks.rs

perf: build system prompt once per turn, skip tools on force-text (#583)

2026-03-07 09:15:00 +00:00

e2e_status_events.rs

Trajectory benchmarks and e2e trace test rig (#553)

2026-03-05 09:13:09 +00:00

e2e_thread_id_isolation.rs

fix(agent): block thread_id-based context pollution across users (#760)

2026-03-11 16:52:31 -07:00

e2e_thread_scheduling.rs

test: add 29 E2E trace tests for issues #571-575 (#593)

2026-03-06 08:12:56 +00:00

e2e_tool_coverage.rs

perf: build system prompt once per turn, skip tools on force-text (#583)

2026-03-07 09:15:00 +00:00

e2e_tool_param_coercion.rs

Fix schema-guided tool parameter coercion (#1143)

2026-03-14 16:27:18 -07:00

e2e_trace_error_path.rs

Trajectory benchmarks and e2e trace test rig (#553)

2026-03-05 09:13:09 +00:00

e2e_trace_file_tools.rs

perf: build system prompt once per turn, skip tools on force-text (#583)

2026-03-07 09:15:00 +00:00

e2e_trace_memory.rs

Trajectory benchmarks and e2e trace test rig (#553)

2026-03-05 09:13:09 +00:00

e2e_worker_coverage.rs

perf: build system prompt once per turn, skip tools on force-text (#583)

2026-03-07 09:15:00 +00:00

e2e_workspace_coverage.rs

test: add 29 E2E trace tests for issues #571-575 (#593)

2026-03-06 08:12:56 +00:00

gateway_workflow_integration.rs

fix(web): recompute cron next_fire_at when re-enabling routines (#1080)

2026-03-12 15:03:38 -07:00

heartbeat_integration.rs

feat: add AWS Bedrock LLM provider via native Converse API (#713)

2026-03-09 07:10:25 +00:00

html_to_markdown.rs

feat: hot-activate WASM channels, channel-first prompts, unified artifact resolution (#297)

2026-02-22 08:09:56 +00:00

import_openclaw_comprehensive.rs

fix(ci): WASM WIT compat sqlite3 duplicate symbol conflict (#953)

2026-03-11 11:48:24 -07:00

import_openclaw_e2e.rs

fix(ci): WASM WIT compat sqlite3 duplicate symbol conflict (#953)

2026-03-11 11:48:24 -07:00

import_openclaw_errors.rs

fix(ci): WASM WIT compat sqlite3 duplicate symbol conflict (#953)

2026-03-11 11:48:24 -07:00

import_openclaw_idempotency.rs

fix(ci): WASM WIT compat sqlite3 duplicate symbol conflict (#953)

2026-03-11 11:48:24 -07:00

import_openclaw_integration.rs

fix(ci): WASM WIT compat sqlite3 duplicate symbol conflict (#953)

2026-03-11 11:48:24 -07:00

import_openclaw.rs

feat: Import OpenClaw memory, history and settings (#903)

2026-03-10 18:37:10 -07:00

module_init_integration.rs

refactor: encapsulate leaked abstractions into owning modules (#778)

2026-03-10 04:39:51 +00:00

openai_compat_integration.rs

fix(test): stabilize openai compat oversized-body regression (#839)

2026-03-11 17:03:12 -07:00

pairing_integration.rs

ci: Added CI/CD and release pipelines (#45)

2026-02-12 12:25:36 +01:00

provider_chaos.rs

feat: enable Anthropic prompt caching via automatic cache_control injection (#660)

2026-03-07 09:10:05 +00:00

relay_integration.rs

feat: add channel-relay integration for Slack (#790)

2026-03-10 16:34:54 -07:00

sighup_reload_integration.rs

fix: Channel HTTP: server doesn't start after config change (no hot-r… (#779)

2026-03-10 08:11:21 -07:00

support_unit_tests.rs

fix(config): init_secrets no longer overwrites entire config (#726)

2026-03-08 13:32:42 -07:00

telegram_auth_integration.rs

fix(ci): fix three coverage workflow failures (#597)

2026-03-06 05:59:01 +00:00

tool_schema_validation.rs

test: add 26 tests for multi-thread safety, db CRUD, concurrency, errors (#442)

2026-03-06 04:39:04 +00:00

trace_format.rs

Trajectory benchmarks and e2e trace test rig (#553)

2026-03-05 09:13:09 +00:00

trace_llm_tests.rs

Trajectory benchmarks and e2e trace test rig (#553)

2026-03-05 09:13:09 +00:00

wasm_channel_integration.rs

feat(routines): deliver notifications to all installed channels (#398)

2026-02-27 12:01:32 -08:00

wit_compat.rs

feat: WASM channel attachments with LLM pipeline integration (#596)

2026-03-07 18:01:40 +00:00

workspace_integration.rs

perf: build system prompt once per turn, skip tools on force-text (#583)

2026-03-07 09:15:00 +00:00

ws_gateway_integration.rs

feat: add channel-relay integration for Slack (#790)

2026-03-10 16:34:54 -07:00