Guard enforcement: the wire from a detector finding to pause/stop/kill - #5367

Merged

vivekchand merged 19 commits into

mainfrom

feat/guard-enforcement

Sep 3, 2026

Commits on Sep 3, 2026

Guard control plane: Windows actuators, honest OpenClaw pause, per-session capability, escalation ladders

vivekchand
and
claude
committed
fac0c26
Session rows get Pause/Resume/Stop and a named rogue flag, not just banners

vivekchand
and
claude
committed
8922639
CI fixes: register the guard tab, close the CodeQL findings the PR introduced

vivekchand
and
claude
committed
b40eff6
ci: re-run after the check group was cancelled by a racing branch update

vivekchand
and
claude
committed
5f2b51c
CodeQL: fixed-token actuator errors, log-safe ids, realpath containment in the qwen resolver

vivekchand
and
claude
committed
e014431
CodeQL: sanitize actuator detail strings and log tokens on the control path

vivekchand
and
claude
committed
2e8b766
CodeQL: coerce the unsupported field through the same sanitizer

vivekchand
and
claude
committed
2e5e806
fix(process_control): allowlist ntdll function names before getattr
claude
committed
bf97c31
fix(security): resolve CodeQL alerts in guard-enforcement

vivekchand
and
claude
committed
70848b1
security: harden guard control endpoint against path traversal

vivekchand
authored and
claude
committed
70b2b23
security: fix XSS in Guard tab control buttons and policy table

vivekchand
authored and
claude
committed
17547d9
security: fix TOCTOU temp-file exec and PowerShell injection risk

Vivek Chand
authored and
claude
committed
41a9ce2
fix: YAML/JS formatting in pr-screenshots and visual-diff after merge
claude
committed
fcf022c
fix: remove orphan merge-conflict separator from app.js line 30164
claude
committed
21daeb7
fix: address 7 CodeQL security alerts in guard enforcement path
claude
committed
ca9465e
fix: bind github.repository to env var in pr-screenshots workflow

vivekchand
and
claude
committed
c90d50d
Merge branch 'main' into feat/guard-enforcement
vivekchand
authored
1e22ad3
Guard control acts on the stored session; one actuator module; fixed-token errors

vivekchand
and
claude
committed
790dedb
ci: re-run drift-bot, whose "no drift detected" verdict never updated its commit status

vivekchand
and
claude
committed
8de8673

Navigation Menu

Guard enforcement: the wire from a detector finding to pause/stop/kill - #5367

Guard enforcement: the wire from a detector finding to pause/stop/kill#5367
vivekchand merged 19 commits into
mainfrom
feat/guard-enforcement

Commits on Sep 3, 2026

Guard control plane: Windows actuators, honest OpenClaw pause, per-session capability, escalation ladders

Session rows get Pause/Resume/Stop and a named rogue flag, not just banners

CI fixes: register the guard tab, close the CodeQL findings the PR introduced

ci: re-run after the check group was cancelled by a racing branch update

CodeQL: fixed-token actuator errors, log-safe ids, realpath containment in the qwen resolver

CodeQL: sanitize actuator detail strings and log tokens on the control path

CodeQL: coerce the unsupported field through the same sanitizer

fix(process_control): allowlist ntdll function names before getattr

fix(security): resolve CodeQL alerts in guard-enforcement

security: harden guard control endpoint against path traversal

security: fix XSS in Guard tab control buttons and policy table

security: fix TOCTOU temp-file exec and PowerShell injection risk

fix: YAML/JS formatting in pr-screenshots and visual-diff after merge

fix: remove orphan merge-conflict separator from app.js line 30164

fix: address 7 CodeQL security alerts in guard enforcement path

fix: bind github.repository to env var in pr-screenshots workflow

Merge branch 'main' into feat/guard-enforcement

Guard control acts on the stored session; one actuator module; fixed-token errors

ci: re-run drift-bot, whose "no drift detected" verdict never updated its commit status