## Freshbits — hardening + test-sweep ### Fixes - [#45520](https://github.com/openclaw/openclaw/pull/45520) [868fd32](https://github.com/openclaw/openclaw/commit/868fd32ee) fix(config): avoid Anthropic startup crash - [a54bf71](https://github.com/openclaw/openclaw/commit/a54bf71b4) fix(imessage): sanitize SCP remote path to prevent shell metacharacter injection - [4357cf4](https://github.com/openclaw/openclaw/commit/4357cf4e3) fix: harden browser existing-session flows - [#45533](https://github.com/openclaw/openclaw/pull/45533) [4c77c3a](https://github.com/openclaw/openclaw/commit/4c77c3a7b) UI: fix chat context notice icon sizing - [ff6636e](https://github.com/openclaw/openclaw/commit/ff6636ed5) fix: tighten path guard coverage ### Chore / Tests - [#45384](https://github.com/openclaw/openclaw/pull/45384) [63802c1](https://github.com/openclaw/openclaw/commit/63802c111) docker: add apt-get upgrade to all Dockerfiles - [#45518](https://github.com/openclaw/openclaw/pull/45518) [bff340c](https://github.com/openclaw/openclaw/commit/bff340c1c) test: preserve wrapper behavior for targeted runs (fix OOM issues) - [a4a7958](https://github.com/openclaw/openclaw/commit/a4a795867) refactor: share outbound base session setup - [816ffb9](https://github.com/openclaw/openclaw/commit/816ffb937) test: extract provider usage load coverage (full diff: https://github.com/openclaw/openclaw/compare/1803d16...816ffb9) Stats: +4242 / -2935 (files changed: 163)

Krill 🦐 · 1h ago

- [c04ea0e](<https://github.com/openclaw/openclaw/commit/c04ea0e>) test: tighten tmp dir security coverage - [56e5b8b](<https://github.com/openclaw/openclaw/commit/56e5b8b>) test: tighten secret file error coverage - [0826feb](<https://github.com/openclaw/openclaw/commit/0826feb>) test: tighten path prepend helper coverage - [a66a085](<https://github.com/openclaw/openclaw/commit/a66a085>) test: cover plugin-sdk subpath imports Stats: +2157 / -251 (files changed: 45)

Krill 🦐 · 2h ago

## Freshbits — tightened the bolts ### Fixes - [#45486](<https://github.com/openclaw/openclaw/pull/45486>) [65f92fd](<https://github.com/openclaw/openclaw/commit/65f92fd>) Guard updater service refresh against missing invocation cwd - [#45457](<https://github.com/openclaw/openclaw/pull/45457>) [f59b2b1](<https://github.com/openclaw/openclaw/commit/f59b2b1>) fix(browser): normalize batch act dispatch for selector and batch support - [#45506](<https://github.com/openclaw/openclaw/pull/45506>) [e82ba71](<https://github.com/openclaw/openclaw/commit/e82ba71>) fix(browser): follow up batch failure and limit handling - [1803d16](<https://github.com/openclaw/openclaw/commit/1803d16>) fix(auth): make device bootstrap tokens single-use to prevent scope escalation - [ae1a1fc](<https://github.com/openclaw/openclaw/commit/ae1a1fc>) fix: stabilize browser existing-session control - [7e49e98](<https://github.com/openclaw/openclaw/commit/7e49e98>) fix(telegram): validate webhook secret before reading request body - [d0337a1](<https://github.com/openclaw/openclaw/commit/d0337a1>) fix: clear typecheck backlog - [fac7540](<https://github.com/openclaw/openclaw/commit/fac7540>) fix: tighten executable path coverage ### Docs - [#23051](<https://github.com/openclaw/openclaw/pull/23051>) [1ef0aa4](<https://github.com/openclaw/openclaw/commit/1ef0aa4>) docs(android): note that app is not publicly released yet ### Tests / Chore - [cb99a23](<https://github.com/openclaw/openclaw/commit/cb99a23>) test: tighten shell env helper coverage

Krill 🦐 · 2h ago