feat(cli): add `azureclaw ingress` command for inter-agent access control#23

Closed

johnsonshi wants to merge 491 commits into

mainfrom

johsh/ingress-command

This pull request is big! We're only showing the most recent 250 commits

Commits on Mar 26, 2026

feat(operator): security controls, token usage, Prometheus metrics

Pal Lakatos-Toth
and
Copilot
committed
fix(operator): arrow key navigation sync

Pal Lakatos-Toth
and
Copilot
committed
feat(router): SSE stream token usage + latency metrics

Pal Lakatos-Toth
and
Copilot
committed
feat(operator): per-agent egress filtering with status indicators

Pal Lakatos-Toth
and
Copilot
committed
feat(operator): cluster health panel with [c] toggle

Pal Lakatos-Toth
and
Copilot
committed
fix(operator): d key deletes agent when on agents panel, denies on egress

Pal Lakatos-Toth
and
Copilot
committed
feat(operator): colored egress domains with status legend

Pal Lakatos-Toth
and
Copilot
committed
fix(operator): delete uses 'destroy' command, navigable confirm dialog

Pal Lakatos-Toth
and
Copilot
committed
fix(operator): pass -y to destroy to skip interactive prompt

Pal Lakatos-Toth
and
Copilot
committed
fix(operator): use --yes flag for destroy command

Pal Lakatos-Toth
and
Copilot
committed
feat(operator): agent hierarchy — controllers vs sub-agents

Pal Lakatos-Toth
and
Copilot
committed
feat(operator): show (sub:parent) label on sub-agent names

Pal Lakatos-Toth
and
Copilot
committed
fix(operator): simplify sub-agent label to just (sub-agent)

Pal Lakatos-Toth
and
Copilot
committed
feat(operator): hierarchy sort + multi-step spawn wizard

Pal Lakatos-Toth
and
Copilot
committed
fix(operator): dialogOpen flag prevents background key handling

Pal Lakatos-Toth
and
Copilot
committed
fix(operator): rewrite spawn wizard, simplify header

Pal Lakatos-Toth
and
Copilot
committed
fix(operator): spawn wizard text input — fresh textbox per edit

Pal Lakatos-Toth
and
Copilot
committed
feat: confidential isolation — fix RuntimeClass + Kata preflight check

Pal Lakatos-Toth
and
Copilot
committed
feat(add): auto-provision Kata nodepool for confidential isolation

Pal Lakatos-Toth
and
Copilot
committed
fix(add): use --labels instead of --node-labels for az aks nodepool add

Pal Lakatos-Toth
and
Copilot
committed
feat(operator): Enter key connects to agent — shell-out with auto-resume

Pal Lakatos-Toth
and
Copilot
committed
feat: enforce confidential isolation inheritance for sub-agents

Pal Lakatos-Toth
and
Copilot
committed
fix(router): route embeddings to correct deployment model

Pal Lakatos-Toth
and
Copilot
committed
fix(operator): connect runs openclaw tui directly with spawnSync

Pal Lakatos-Toth
and
Copilot
committed
fix(operator): persistent sessions + SIGINT handling for connect

Pal Lakatos-Toth
and
Copilot
committed
fix(operator): prevent Enter from connecting when dialog just closed

Pal Lakatos-Toth
and
Copilot
committed
fix(operator): connect drops to bash with banner, not openclaw agent

Pal Lakatos-Toth
and
Copilot
committed
fix(operator): connect runs openclaw tui directly — no bash layer

Pal Lakatos-Toth
and
Copilot
committed
docs: operator dashboard, confidential isolation, embedding routing

Pal Lakatos-Toth
and
Copilot
committed
security: improve OpenSSF Scorecard — pin deps, fix perms, patch CVE

Pal Lakatos-Toth
and
Copilot
committed
docs: operator dashboard, isolation inheritance, embedding routing, Dockerfile fix

Pal Lakatos-Toth
and
Copilot
committed
fix: align architecture diagram box-drawing in README

Pal Lakatos-Toth
and
Copilot
committed
fix(operator): prevent header topline overflow and text melting

Pal Lakatos-Toth
and
Copilot
committed
fix(operator): header character duplication — fix health format and width calc

Pal Lakatos-Toth
and
Copilot
committed
fix(controller): revert RuntimeClass to kata-vm-isolation (AKS auto-created name)

Pal Lakatos-Toth
and
Copilot
committed
fix: use KataVmIsolation (not KataMshvVmIsolation) per AKS docs

Pal Lakatos-Toth
and
Copilot
committed
feat(operator): wider isolation column + detailed AGT governance panel

Pal Lakatos-Toth
and
Copilot
committed
fix(operator): AGT audit invalid date + wider security panel

Pal Lakatos-Toth
and
Copilot
committed
feat(operator): dedicated AGT Governance panel replacing sparkline

Pal Lakatos-Toth
and
Copilot
committed
fix(operator): show trust scores — seed self agent in trust store on startup

Pal Lakatos-Toth
and
Copilot
committed
feat(operator): show both registry reputation and local trust scores

Pal Lakatos-Toth
and
Copilot
committed
fix: dev-mode sub-agent spawning + registry reputation URL

Pal Lakatos-Toth
and
Copilot
committed
feat(operator): add --dev mode for Docker-based agent management

Pal Lakatos-Toth
and
Copilot
committed
fix: use Docker Engine API via socket for dev-mode sub-agent spawn

Pal Lakatos-Toth
and
Copilot
committed
fix: resolve AMID from registry for reputation lookup

Pal Lakatos-Toth
and
Copilot
committed
feat(operator): show agent AMID in AGT panel

Pal Lakatos-Toth
and
Copilot
committed
fix: Docker socket permissions + discover agents tool

Pal Lakatos-Toth
and
Copilot
committed
fix: Docker socket mount + API version for dev-mode spawn

Pal Lakatos-Toth
and
Copilot
committed
fix: sub-agent Docker socket and chmod error handling

Pal Lakatos-Toth
and
Copilot
committed
fix: clean up stale Docker volumes on destroy

Pal Lakatos-Toth
and
Copilot
committed
fix: dev-mode spawn status uses Docker API instead of K8s

Pal Lakatos-Toth
and
Copilot
committed
fix(operator): use Promise.allSettled for resilient refresh

Pal Lakatos-Toth
and
Copilot
committed
fix(operator): add timeouts to all kubectl exec/get calls

Pal Lakatos-Toth
and
Copilot
committed
fix(operator): handle unreachable/terminating pods gracefully

Pal Lakatos-Toth
and
Copilot
committed
fix: sub-agent API key propagation in dev-mode Docker spawn

Pal Lakatos-Toth
and
Copilot
committed
feat: add Foundry tools to sub-agent task processing

Pal Lakatos-Toth
and
Copilot
committed
fix: sub-agent router reads API key from env var fallback

Pal Lakatos-Toth
and
Copilot
committed
fix(operator): show pod age instead of CRD age

Pal Lakatos-Toth
and
Copilot
committed
fix: sub-agent Foundry tools use Node HTTP instead of curl

Pal Lakatos-Toth
and
Copilot
committed
fix: propagate FOUNDRY_PROJECT_ENDPOINT to Docker sub-agents

Pal Lakatos-Toth
and
Copilot
committed
feat: mesh_send auto-waits for sub-agent reply (up to 90s)

Pal Lakatos-Toth
and
Copilot
committed
feat: add foundry_memory tool to sub-agent task processing

Pal Lakatos-Toth
and
Copilot
committed
fix: auto-assign RBAC roles + propagate FOUNDRY_DEPLOYMENTS to sandbox pods

Pal Lakatos-Toth
and
Copilot
committed
fix: fedcred manager uses client_credentials grant type (not token-exchange)

Pal Lakatos-Toth
and
Copilot
committed
fix: fedcred manager falls back to IMDS for ARM tokens

Pal Lakatos-Toth
and
Copilot
committed
security: remove auto-RBAC from controller runtime

Pal Lakatos-Toth
and
Copilot
committed
feat: greenfield fedcred automation for controller SA

Pal Lakatos-Toth
and
Copilot
committed
feat: delegate AGT mesh tasks to native OpenClaw agent loop

Pal Lakatos-Toth
and
Copilot
committed
feat: add Python 3 to sandbox, improve native delegation output parsing

Pal Lakatos-Toth
and
Copilot
committed
fix: read native agent output from stderr, use spawn for robustness

Pal Lakatos-Toth
and
Copilot
committed

Commits on Mar 27, 2026

fix: add controller SA fedcred + MI Contributor to --upgrade path

Pal Lakatos-Toth
and
Copilot
committed
docs: update README and architecture for native delegation + Python

Pal Lakatos-Toth
and
Copilot
committed
docs: fix stale 90s timeout refs, add --upgrade to CLI table

Pal Lakatos-Toth
and
Copilot
committed
fix(entrypoint): pre-create OpenClaw temp dirs and fix router log redirect

authored and
Pal Lakatos-Toth
committed
feat: expand Python to 43 packages, fix AGT trust scoring

Pal Lakatos-Toth
and
Copilot
committed
feat: add 15+ CLI tool dependencies to unlock OpenClaw plugins

Pal Lakatos-Toth
and
Copilot
committed
fix: add timeout guards to prevent tool-call hangs

Pal Lakatos-Toth
and
Copilot
committed
feat: AGT trust bridge, Foundry tool expansion, blocklist retry

Pal Lakatos-Toth
and
Copilot
committed
fix: AGT relay persistence, WS reconnect, and proactive inbox notifications

Pal Lakatos-Toth
and
Copilot
committed
fix: AGT singleton guard, audit entries, and reputation error logging

Pal Lakatos-Toth
and
Copilot
committed
perf: optimize AGT handshake latency

Pal Lakatos-Toth
and
Copilot
committed
fix: AGT metrics pipeline — sessions, interactions, audit visibility

Pal Lakatos-Toth
and
Copilot
committed
fix: unblock AGT relay listener — approvals command was hanging

Pal Lakatos-Toth
and
Copilot
committed
fix: give AGT relay listener its own HOME for device fingerprint

Pal Lakatos-Toth
and
Copilot
committed
fix: single AGT mesh connection — skip init for node host and approvals

Pal Lakatos-Toth
and
Copilot
committed
chore: remove orphaned agt-relay-listener.js

Pal Lakatos-Toth
and
Copilot
committed
fix: operator NaN timestamp — chrono_now was epoch seconds not ISO 8601

Pal Lakatos-Toth
and
Copilot
committed
fix: add fsync/fdatasync/sync to deploy seccomp profile

Pal Lakatos-Toth
and
Copilot
committed
docs: update architecture, security, and E2E docs for AGT mesh fixes

Pal Lakatos-Toth
and
Copilot
committed
Merge feat/python-libs-and-entrypoint-fix: AGT mesh stability, seccomp fix, operator fixes

Pal Lakatos-Toth
and
Copilot
committed

Commits on Mar 28, 2026

feat: enforce E2E-only communication, remove plaintext fallback

Pal Lakatos-Toth
and
Copilot
committed
Merge fix/remove-plaintext-fallback: enforce E2E-only comms

Pal Lakatos-Toth
and
Copilot
committed
docs: update security and architecture for E2E-only enforcement

Pal Lakatos-Toth
and
Copilot
committed
feat: enforce KNOCK protocol — block messages from unaccepted peers

Pal Lakatos-Toth
and
Copilot
committed
Merge feat/knock-enforcement: enforce KNOCK protocol with trust scoring

Pal Lakatos-Toth
and
Copilot
committed
docs: document KNOCK enforcement, trust scoring, spawner affinity

Pal Lakatos-Toth
and
Copilot
committed
feat: add agentic behavior prompt to MEMORY.md and sub-agent system prompt

Pal Lakatos-Toth
and
Copilot
committed
feat: periodic Foundry memory sync — auto-persist agent activity

Pal Lakatos-Toth
and
Copilot
committed
fix: forward proxy tunnel uses activity-based idle timeout

Pal Lakatos-Toth
and
Copilot
committed
security: harden proxy against DNS rebinding, ECH bypass, SSRF, header leaks

Pal Lakatos-Toth
and
Copilot
committed
perf: proxy performance + TTFT optimization

Pal Lakatos-Toth
and
Copilot
committed
fix: model selection + seamless /model switch with memory handoff

Pal Lakatos-Toth
and
Copilot
committed
fix: live Foundry deployment discovery for model selection

Pal Lakatos-Toth
and
Copilot
committed
style: cargo fmt + fix blocklist CI race condition

Pal Lakatos-Toth
and
Copilot
committed
fix: docker build --no-cache for dev builds

Pal Lakatos-Toth
and
Copilot
committed
fix: TCP keepalive on tunnel sockets to detect dead connections

Pal Lakatos-Toth
and
Copilot
committed
fix: explicit proxy for Telegram polling to prevent stalls

Pal Lakatos-Toth
and
Copilot
committed
fix: device pairing conflict + rename /model command

Pal Lakatos-Toth
and
Copilot
committed
security: Telegram DM policy — allowlist or pairing instead of open

Pal Lakatos-Toth
and
Copilot
committed
chore: gitignore internal planning docs

Pal Lakatos-Toth
and
Copilot
committed
fix: replace awk with sed for Telegram allowlist parsing

Pal Lakatos-Toth
and
Copilot
committed
fix: node-host crash loop — give it minimal config without plugins

Pal Lakatos-Toth
and
Copilot
committed
perf: re-enable Docker build cache for dev builds

Pal Lakatos-Toth
and
Copilot
committed
fix: clean up remaining cosmetic warnings

Pal Lakatos-Toth
and
Copilot
committed
docs: clarify isolated filesystems in spawn skill and tool descriptions

Pal Lakatos-Toth
and
Copilot
committed

Commits on Mar 29, 2026

fix: HTTP keep-alive connection leak causing Telegram polling stalls

Pal Lakatos-Toth
and
Copilot
committed
fix: KNOCK race condition — message arriving before KNOCK accepted

Pal Lakatos-Toth
and
Copilot
committed
fix: Docker cache prevents OpenClaw @latest from updating

Pal Lakatos-Toth
and
Copilot
committed
chore: add cache-bust to CI sandbox build

Pal Lakatos-Toth
and
Copilot
committed
fix: stop tsup from overwriting vendored SDK patches

Pal Lakatos-Toth
and
Copilot
committed
fix: add cache-bust to router build so Rust changes deploy

Pal Lakatos-Toth
and
Copilot
committed
fix: add cache-bust to push command for router and sandbox builds

Pal Lakatos-Toth
and
Copilot
committed
fix: registry ghost agents, heartbeat, and search freshness

Pal Lakatos-Toth
and
Copilot
committed
fix: add cache-bust to relay and registry builds (dev + push)

Pal Lakatos-Toth
and
Copilot
committed
chore: add .DS_Store to gitignore

Pal Lakatos-Toth
and
Copilot
committed

Commits on Mar 30, 2026

feat: Phase 1 — AGT governance sidecar + proxy routes (#4)

Pal Lakatos-Toth
and
Copilot
committed
fix: Phase 3 — circuit breaker, queue cap, iptables flush (#5, #13)

Pal Lakatos-Toth
and
Copilot
committed
feat: Phase 2 — wire inference + spawn to AGT sidecar (#7, #8)

Pal Lakatos-Toth
and
Copilot
committed
feat: Phase 4 — AGT policy YAML rules (#9, #10, #12b, #14)

Pal Lakatos-Toth
and
Copilot
committed
feat: Phase 5 — admin token from Secret file mount (#11)

Pal Lakatos-Toth
and
Copilot
committed
feat: SSE streaming token tracking (#12a)

Pal Lakatos-Toth
and
Copilot
committed
feat: Phase 6 — delete governance.rs, sidecar-only governance (#4)

Pal Lakatos-Toth
and
Copilot
committed
fix: normalize sidecar response fields for operator panel

Pal Lakatos-Toth
and
Copilot
committed
fix: split AGT pip install into separate layer with longer timeout

Pal Lakatos-Toth
and
Copilot
committed
fix: vendor AGT wheels from GitHub release — bypass PyPI

Pal Lakatos-Toth
and
Copilot
committed
fix: server.py — use real AGT SDK API (PolicyEngine, FlightRecorder)

Pal Lakatos-Toth
and
Copilot
committed
Rewrite sidecar to use real AGT SDK components

Pal Lakatos-Toth
and
Copilot
committed
Wire response validation (#9) and mesh policy gate (#10)

Pal Lakatos-Toth
and
Copilot
committed
Switch to native AGT TrustPolicy + PolicyEvaluator

Pal Lakatos-Toth
and
Copilot
committed
fix: grant AGT sidecar (UID 1002) read access to policy directory

Pal Lakatos-Toth
and
Copilot
committed
Wire AGT sidecar for AKS production deployment

Pal Lakatos-Toth
and
Copilot
committed
Security hardening: trust mutation auth, file permissions, KNOCK bootstrap

Pal Lakatos-Toth
and
Copilot
committed
fix: mount admin-token in openclaw container for AKS trust bootstrap

Pal Lakatos-Toth
and
Copilot
committed
fix: remove aarch64-only rpds_py wheel, install from PyPI at build time

Pal Lakatos-Toth
and
Copilot
committed
fix: remove rpds-py from pip install (PyPI unreachable, not needed at runtime)

Pal Lakatos-Toth
and
Copilot
committed
feat: azureclaw up reads cached deployment context

Pal Lakatos-Toth
and
Copilot
committed
fix: allow Base58 AMIDs in trust validation (mixed-case agent_id)

Pal Lakatos-Toth
and
Copilot
committed
fix: make builds work when PyPI is unreachable

Pal Lakatos-Toth
and
Copilot
committed
fix: install idna/pyyaml from Azure Linux repos, reduce PyPI dependency

Pal Lakatos-Toth
and
Copilot
committed
feat: vendor all Python deps for fully offline Docker builds

Pal Lakatos-Toth
and
Copilot
committed
fix: add shadow-utils for groupadd/useradd in sidecar Dockerfile

Pal Lakatos-Toth
and
Copilot
committed
fix: skip incompatible wheels in openclaw dev builds (aarch64)

Pal Lakatos-Toth
and
Copilot
committed
fix: pin pydantic-core to 2.41.5 (matches pydantic 2.12.5)

Pal Lakatos-Toth
and
Copilot
committed
Vendor all sandbox Python deps for offline Docker builds

Pal Lakatos-Toth
and
Copilot
committed
Fix prekey_id column ambiguity in consume_one_time_prekey()

Pal Lakatos-Toth
and
Copilot
committed
Add missing greenlet wheel (sqlalchemy dependency)

Pal Lakatos-Toth
and
Copilot
committed
Fix CrashLoopBackOff: move admin-token mount from /run/secrets to /etc/azureclaw/secrets

Pal Lakatos-Toth
and
Copilot
committed
Add push-apply target: build all images, push to ACR, apply to AKS

Pal Lakatos-Toth
and
Copilot
committed
Add AGT sidecar to push command (6th image)

Pal Lakatos-Toth
and
Copilot
committed
fix(sidecar): add missing typing_inspection wheel for pydantic v2

Pal Lakatos-Toth
and
Copilot
committed
fix(sidecar): allow PyPI fallback for transitive deps

Pal Lakatos-Toth
and
Copilot
committed
fix(sidecar): bind to 0.0.0.0 so K8s probes can reach healthz

Pal Lakatos-Toth
and
Copilot
committed
fix(controller): remove explicit host from sidecar probes

Pal Lakatos-Toth
and
Copilot
committed
fix(router): circuit breaker fails open instead of closed

Pal Lakatos-Toth
and
Copilot
committed

Commits on Mar 31, 2026

Merge feat/agt-sidecar-hardening: AGT governance + security hardening

Pal Lakatos-Toth
and
Copilot
committed
fix: resolve AMIDs to display names in trust store

Pal Lakatos-Toth
and
Copilot
committed
Publish readiness: 310 tests, CI/CD, docs, AMID fix, GitHub templates

Pal Lakatos-Toth
and
Copilot
committed
fix(ci): SARIF upload non-fatal, blocklist creates PR, remove setup-bicep

Pal Lakatos-Toth
and
Copilot
committed
fix(ci): add actions:read permission for SARIF upload

Pal Lakatos-Toth
and
Copilot
committed
fix(ci): cargo fmt, ruff lint, hadolint ignores, npm cache

Pal Lakatos-Toth
and
Copilot
committed
fix(ci): clippy warnings, npm ci→install, pytest dep, hadolint rules

Pal Lakatos-Toth
and
Copilot
committed
fix(ci): ensure skills dir exists in sandbox build, fix SARIF condition

Pal Lakatos-Toth
and
Copilot
committed
docs: comprehensive demo guide covering all capabilities

Pal Lakatos-Toth
and
Copilot
committed
feat: configurable image generation model (FLUX.2-pro, gpt-image-1, etc.)

Pal Lakatos-Toth
and
Copilot
committed
docs: rewrite demo guide — conversational style, realistic attack scenario

Pal Lakatos-Toth
and
Copilot
committed
feat: wire AGT sidecar into tool execution + fix Foundry memory

Pal Lakatos-Toth
and
Copilot
committed
feat: replace standalone Content Safety with Foundry guardrail annotations

Pal Lakatos-Toth
and
Copilot
committed
style: cargo fmt

Pal Lakatos-Toth
and
Copilot
committed
fix: clippy is_some_and + vendor aarch64 wheels for local dev

Pal Lakatos-Toth
and
Copilot
committed
fix: evaluate ALL tools through AGT policy gate

Pal Lakatos-Toth
and
Copilot
committed
chore: untrack target/ build artifacts

Pal Lakatos-Toth
and
Copilot
committed
security: harden secrets, auth, injection, crypto, and fail-closed gates

Pal Lakatos-Toth
and
Copilot
committed
security: phase 2 — crypto, policy, logging, and validation hardening

Pal Lakatos-Toth
and
Copilot
committed
fix: sidecar admin token race — generate before sidecar starts, pass via env

Pal Lakatos-Toth
and
Copilot
committed
fix: spawn latency ~2min→~15s + registry path allowlist

Pal Lakatos-Toth
and
Copilot
committed
fix: router→sidecar auth for trust/audit endpoints

Pal Lakatos-Toth
and
Copilot
committed
feat: image generation via standard OpenAI Images API

Pal Lakatos-Toth
and
Copilot
committed
Feat: unified /openai/v1/ proxy + Responses API + auto-fallback

Pal Lakatos-Toth
and
Copilot
committed
Fix: secure parent-mediated trust delegation for mesh siblings

Pal Lakatos-Toth
and
Copilot
committed
Perf: cache Responses-only models to skip redundant chat/completions attempts

Pal Lakatos-Toth
and
Copilot
committed
Fix: complete chat↔Responses API format translation

Pal Lakatos-Toth
and
Copilot
committed
Fix: don't force-kill running sub-agent containers on re-spawn

Pal Lakatos-Toth
and
Copilot
committed
Fix: reuse existing sandbox on AKS instead of erroring on 409

Pal Lakatos-Toth
and
Copilot
committed
Perf: optimize mesh handshake latency (no crypto changes)

Pal Lakatos-Toth
and
Copilot
committed
Fix: responses_to_chat_body skipped conversion due to 'error: null'

Pal Lakatos-Toth
and
Copilot
committed
Fix: SSE keepalive for Responses API to prevent client timeouts

Pal Lakatos-Toth
and
Copilot
committed
Fix sub-agent task execution: bypass OpenClaw gateway, add mesh_send + image_gen

Pal Lakatos-Toth
and
Copilot
committed

Commits on Apr 1, 2026

Fix: entrypoint crash when /sandbox/.bashrc missing on AKS

Pal Lakatos-Toth
and
Copilot
committed
Fix: enable azureclaw plugin in OpenClaw config entries

Pal Lakatos-Toth
and
Copilot
committed
Fix: Foundry project endpoint lost on cache reload

Pal Lakatos-Toth
and
Copilot
committed
feat: AzureClaw identity via OpenClaw config + MEMORY.md

Pal Lakatos-Toth
and
Copilot
committed
feat: unified secrets store for all credentials

Pal Lakatos-Toth
and
Copilot
committed
feat: azureclaw add resolves tokens from secrets.json

Pal Lakatos-Toth
and
Copilot
committed
feat: guided credential wizard + multi-token + operator integration

Pal Lakatos-Toth
and
Copilot
committed
feat: add discover + mesh_inbox to sub-agents, guided credentials wizard

Pal Lakatos-Toth
and
Copilot
committed
fix: restore delegateToNativeAgent as primary sub-agent path

Pal Lakatos-Toth
and
Copilot
committed
feat: AGT as sole policy authority for sub-agent tasks

Pal Lakatos-Toth
and
Copilot
committed
fix: use max_completion_tokens for AOAI compatibility

Pal Lakatos-Toth
and
Copilot
committed
fix: build errors in credentials wizard and exec_command handler

Pal Lakatos-Toth
and
Copilot
committed
fix: resolveSecret falls back to dot-suffixed variants

Pal Lakatos-Toth
and
Copilot
committed
feat: channel variant syntax for credential selection

Pal Lakatos-Toth
and
Copilot
committed
fix: image generation timeout + Go 1.25 + npm audit fix

Pal Lakatos-Toth
and
Copilot
committed
fix: disable OpenClaw exec approvals via config

Pal Lakatos-Toth
and
Copilot
committed
feat: register image generation provider for inline rendering

Pal Lakatos-Toth
and
Copilot
committed
feat: inline image rendering via OpenClaw's native image_generate

Pal Lakatos-Toth
and
Copilot
committed
style: cargo fmt

Pal Lakatos-Toth
and
Copilot
committed
fix: address code quality review comments

Pal Lakatos-Toth
and
Copilot
committed
feat: operator spawn UX — show token variant names and allow-from support

Pal Lakatos-Toth
and
Copilot
committed
ci: use larger runner for container image scan

Pal Lakatos-Toth
and
Copilot
committed
Merge pull request #15 from Azure/security/hardening-phase1
pallakatos
authored
fix: Telegram channel drops azureclaw plugin + broken secret update

Pal Lakatos-Toth
and
Copilot
committed
fix: strip 'bot' prefix from Telegram tokens to prevent 404

Pal Lakatos-Toth
and
Copilot
committed
fix: eliminate prekey race on sub-agent spawn (vendor patch #6)

Pal Lakatos-Toth
and
Copilot
committed

Commits on Apr 2, 2026

fix: patch CJS bundle for prekey race (missed in patch #6)

Pal Lakatos-Toth
and
Copilot
committed
fix: improve sub-agent mesh reliability and peer-to-peer awareness

Pal Lakatos-Toth
and
Copilot
committed
fix: revert prekey order + add send-side retry for prekey race

Pal Lakatos-Toth
and
Copilot
committed
feat: operator TUI overhaul, trust cleanup, mesh health, postgres auto-gen

Pal Lakatos-Toth
and
Copilot
committed
feat: fast AGT poll on every refresh cycle for live mesh data

Pal Lakatos-Toth
and
Copilot
committed
docs: add Mermaid architecture and flow diagrams

Pal Lakatos-Toth
and
Copilot
committed
docs: link architecture diagrams from README

Pal Lakatos-Toth
and
Copilot
committed
fix: run preflight validation in dry-run mode

Pal Lakatos-Toth
and
Copilot
committed

Commits on Apr 6, 2026

fix(cli): add --telegram-allow-from flag to credentials update

Pal Lakatos-Toth
and
Copilot
committed
fix(operator): guard Enter key during dialogs + fix topology box widths

Pal Lakatos-Toth
and
Copilot
committed
fix(router): wire up mesh message counters to /agt/status

Pal Lakatos-Toth
and
Copilot
committed

Commits on Apr 8, 2026

chore(blocklist): auto-refresh seed — 58056 domains
github-actions[bot]
committed
fix(operator): fix garbled emoji rendering, broken learn/enforce toggle, escape during dialog

Pal Lakatos-Toth
and
Copilot
committed
fix(operator): persist egress mode toggle to CRD

Pal Lakatos-Toth
and
Copilot
committed
feat(operator): alert on mode toggle that CRD is patched and may restart

Pal Lakatos-Toth
and
Copilot
committed
fix: track vendored .sqlx cache for offline Docker builds

Pal Lakatos-Toth
and
Copilot
committed
fix: generate unique ACR name per resource group

Pal Lakatos-Toth
and
Copilot
committed
feat: Native AGT governance, reputation system, and operator TUI enhancements (#18)

authored
Merge remote-tracking branch 'origin/chore/blocklist-refresh-20260408'
Pal Lakatos-Toth
committed
fix(ci): blocklist workflow — REST API for PR creation, stale branch cleanup

Pal Lakatos-Toth
and
Copilot
committed
fix(ci): upgrade codeql-action v3→v4, pin trivy-action to v0.35.0

Pal Lakatos-Toth
and
Copilot
committed
fix(sandbox): bump gh CLI 2.88.1→2.89.0, op CLI 2.30.3→2.33.1

Pal Lakatos-Toth
and
Copilot
committed
fix(security): npm audit fix, update npm in container, CodeQL config for vendor exclusion

Pal Lakatos-Toth
and
Copilot
committed
fix(quality): resolve CodeQL quality findings — unused vars, useless conditionals

Pal Lakatos-Toth
and
Copilot
committed
fix(quality): remove always-true routerHealthy guard in dev health loop

Pal Lakatos-Toth
and
Copilot
committed
fix(build): track lock files and migrations, fix AI code suggestions

Pal Lakatos-Toth
and
Copilot
committed
feat(cli): add `azureclaw ingress` command for inter-agent access control

johnsonshi
and
Copilot
committed