fix(tools-manager): replace spawnSync extraction with safe extractArchive API by LeonidasLux · Pull Request #98988 · openclaw/openclaw

LeonidasLux · 2026-07-02T07:32:05Z

Summary

Problem: tools-manager.ts uses spawnSync("unzip"/"tar") for archive extraction without any size limits, entry caps, or timeout protection, making the process vulnerable to ZIP bombs / decompression bombs if a malicious or corrupted archive is provided.

Solution: Replace the synchronous spawnSync-based extraction with the safe extractArchive API from @openclaw/fs-safe (re-exported from src/infra/archive.ts), which enforces size limits, entry count caps, timeout, and path traversal protection.

What changed: Removed 5 functions and 3 unused imports; added a single extractArchiveSafe async wrapper with explicit limits (maxArchiveBytes: 100MB, maxExtractedBytes: 500MB, maxEntries: 1000, timeoutMs: 60000). Updated tests to mock the new API.

What did NOT change: Extraction behavior for legitimate archives, binary discovery and installation logic, error handling for unsupported archive formats.

What Problem This Solves

Problem: The tool manager's archive extraction had no bounds on input size or output volume, creating a denial-of-service surface through decompression bombs.

Why This Change Was Made: The existing @openclaw/fs-safe infrastructure already provides all necessary protections -- reusing it is the correct pattern rather than re-implementing limits on raw spawnSync calls.

User Impact: No user-visible change. Tool binaries (fd/rg) continue to download and install as before. Users and operators gain protection against oversized or malicious archives.

Root Cause

Trigger condition: Any download of a fd or ripgrep archive from GitHub releases (or any future tool) that is corrupted or maliciously oversized.

Root cause analysis: extractTarGzArchive() and extractZipArchive() in tools-manager.ts directly shelled out to system tar/unzip without any pre-flight size check, extraction budget, or timeout. OpenClaw had a safe archive layer but the tool manager bypassed it.

Affected scope: All platforms (Linux, macOS, Windows). Only the tool manager (src/agents/utils/tools-manager.ts) -- other extraction paths already use @openclaw/fs-safe.

Linked context

Related analysis: Defensive programming audit Section 3.4
In scope: Replacement of extraction logic in tools-manager.ts
Out of scope: Other extraction sites, linting of future spawnSync extraction patterns
Design doc: docs/.local/defensive-archive-extraction/design.md

Real behavior proof

Behavior addressed: Safe archive extraction with size limits, entry caps, and timeout for tool manager downloads. The download stream byte cap now uses a Transform to reject overflow chunks before forwarding them to disk, and partial downloads are cleaned up on failure.

Real environment tested: Windows 10, Node 24, @openclaw/fs-safe@0.3.0

Exact steps or command run after this patch:

pnpm test -- src/agents/utils/tools-manager.test.ts
npx tsx _evidence_collect.mjs

After-fix evidence:

=== Tool Download & Extraction Evidence ===
Date: 2026-07-02T09:34:23.813Z

--- Initial state ---
Bin dir: C:\Users\Administrator\.openclaw\agent\bin
Existing fd: null
Existing rg: null

--- Download & extract fd ---
fd not found. Downloading...
fd installed to C:\Users\Administrator\.openclaw\agent\bin\fd.exe

--- Verify fd binary ---
fd --version: fd 10.4.2

--- Download & extract rg ---
ripgrep not found. Downloading...
ripgrep installed to C:\Users\Administrator\.openclaw\agent\bin\rg.exe

--- Verify rg binary ---
rg --version: ripgrep 15.1.0 (rev af60c2de9d)

=== Both fd and rg downloaded and extracted successfully ===

Observed result after the fix: Both fd and rg downloaded and extracted via extractArchiveSafe (wraps @openclaw/fs-safe with 100 MB maxArchiveBytes, 500 MB maxExtractedBytes, 1000 maxEntries, 60s timeout). Both binaries verified as executable. Unit tests pass (7/7). The Transform-based stream limiter rejects overflow chunks before forwarding them, and partial downloads are cleaned up. This closes both the proof gap and the stream-cap defect identified in review.

What was not tested: Extraction from a deliberately oversized/malicious archive (the stream cap and archive limits are unit-tested; extraction limits are independently verified in @openclaw/fs-safe tests).

Tests and validation

Unit tests

 RUN  v4.1.8

 Test Files  1 passed (1)
      Tests  5 passed (5)

Integration / E2E

The @openclaw/fs-safe package's extractArchive is independently tested in src/infra/archive.test.ts for: archive size limits, entry count limits, symlink/hardlink traversal protection, absolute entry path rejection, staged extraction with safe merge.

Risk checklist

This change is backwards compatible
This change has been tested with existing configurations
I have updated relevant documentation (N/A -- no docs reference the old extraction functions)
Breaking changes (if any) are documented in Summary
Merge-risk explanation: Low risk. The extractArchive API is already used by src/infra/install-flow.ts and extensions/signal/src/install-signal-cli.ts in production. The replacement is mechanical -- same archive formats, same extraction semantics, with additional safety bounds.

🔧 Post-review fix (2026-07-02)

Problem: The PR HEAD (9077b05) replaced src/agents/utils/tools-manager.ts with a one-line placeholder, removing ensureTool/getToolPath exports.

Fix: Restored the full implementation via the correct Transform-stream-limit commit. The branch now contains:

Full tools-manager.ts implementation with all exports restored
Transform stream cap that rejects overflow chunks before they reach disk
Completion-guarded pipeline with partial download cleanup
Safe extractArchive API from @openclaw/fs-safe with size limits

Verification: ✅ 7/7 unit tests passed | ✅ Type check clean | ✅ Both exports (ensureTool, getToolPath) confirmed

LeonidasLux · 2026-07-02T07:51:27Z

@clawsweeper re-review

clawsweeper · 2026-07-02T07:51:33Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

clawsweeper · 2026-07-02T07:59:17Z

Codex review: needs maintainer review before merge. Reviewed July 2, 2026, 9:34 PM ET / 01:34 UTC.

Summary
The PR replaces tools-manager archive extraction with shared extractArchive, adds a compressed download byte cap with partial-file cleanup, and updates focused tests.

PR surface: Source +7, Tests +44. Total +51 across 2 files.

Reproducibility: yes. Source inspection of current main shows the tool manager writes the release asset to disk and extracts with unbounded tar/unzip subprocesses; I did not run a malicious decompression payload.

Review metrics: 1 noteworthy metric.

Archive safety gates: 3 extraction limits and 1 download byte cap added. The security hardening depends on covering both the downloaded compressed bytes and the extracted archive contents.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

none.

Next step before merge

No automated repair is needed because the prior stream-cap and proof blockers are addressed; the remaining path is ordinary maintainer and CI review.

Security
Cleared: No concrete security or supply-chain regression was found; the diff reduces the existing archive extraction DoS surface without adding new dependencies or privileged execution paths.

Review details

Best possible solution:

Merge the shared fs-safe extraction path after normal maintainer and CI review, keeping the download cap aligned with the extraction compressed-size limit.

Do we have a high-confidence way to reproduce the issue?

Yes. Source inspection of current main shows the tool manager writes the release asset to disk and extracts with unbounded tar/unzip subprocesses; I did not run a malicious decompression payload.

Is this the best way to solve the issue?

Yes. Reusing the shared fs-safe archive boundary plus adding the compressed download stream cap is the narrowest maintainable fix; wrapping raw subprocess extraction would duplicate security policy and keep more platform-specific behavior.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 4440226d52c2.

Label changes

Label changes:

add proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes copied live Windows output showing fd and rg downloaded, extracted, and executed after the patch; unit tests and fs-safe dependency tests cover the limit paths.
add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body includes copied live Windows output showing fd and rg downloaded, extracted, and executed after the patch; unit tests and fs-safe dependency tests cover the limit paths.
remove rating: 🦪 silver shellfish: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.
remove status: 🔁 re-review loop: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

P2: This is a bounded security hardening fix for agent helper tool downloads with limited product blast radius.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body includes copied live Windows output showing fd and rg downloaded, extracted, and executed after the patch; unit tests and fs-safe dependency tests cover the limit paths.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes copied live Windows output showing fd and rg downloaded, extracted, and executed after the patch; unit tests and fs-safe dependency tests cover the limit paths.

Evidence reviewed

PR surface:

Source +7, Tests +44. Total +51 across 2 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	103	96	+7
Tests	1	85	41	+44
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	2	188	137	+51

What I checked:

Current main behavior: Current main downloads the release archive to disk with downloadFile(downloadUrl, archivePath) and then extracts .tar.gz/.zip assets via spawnSync-backed tar/unzip helpers without archive byte, extracted byte, entry count, or extraction timeout budgets. (src/agents/utils/tools-manager.ts:330, 4440226d52c2)
PR head download guard: PR head checks Content-Length, streams through a Transform that rejects overflow chunks before forwarding them to disk, and removes partial downloads when the pipeline fails. (src/agents/utils/tools-manager.ts:170, 800fad779a25)
PR head extraction guard: PR head sends both supported archive suffixes through extractArchive with 100 MB compressed, 500 MB extracted, 1000 entry, and 60s timeout limits. (src/agents/utils/tools-manager.ts:290, 800fad779a25)
Focused PR tests: The updated test file asserts Windows zip extraction uses the safe archive API and covers both over-limit and under-limit Content-Length download paths. (src/agents/utils/tools-manager.test.ts:97, 800fad779a25)
Shared archive dependency contract: The inspected @openclaw/fs-safe@0.3.0 package exposes extractArchive({ archivePath, destDir, timeoutMs, limits }), rejects archives over maxArchiveBytes, tracks extracted bytes and entry counts, and stages extraction before merging into the destination. (@openclaw/fs-safe@0.3.0 package/dist/archive.js:52)
Tar gzip compatibility contract: The inspected tar@7.5.16 parser sniffs gzip headers on first write, so .tar.gz assets remain compatible when extractArchive resolves them as tar without setting an explicit gzip flag. (tar@7.5.16 package/dist/esm/parse.js:382)

Likely related people:

vincentkoc: Recent commits added tools-manager guarded-fetch cleanup and Windows archive extraction behavior that this PR replaces. (role: recent area contributor; confidence: high; commits: bbe96699265d, a5fde9119c9c; files: src/agents/utils/tools-manager.ts, src/agents/utils/tools-manager.test.ts)
steipete: Commit history shows substantial work hardening archive extraction and later moving that implementation behind the @openclaw/fs-safe facade consumed by this PR. (role: archive infrastructure owner by history; confidence: high; commits: 658cf4bd9488, 538605ff44d2; files: src/infra/archive.ts, src/infra/archive.test.ts)
miorbnli: Authored the recent tools-manager availability fallback fix, so they are adjacent to the same helper-binary install path even though not the extraction owner. (role: recent adjacent contributor; confidence: medium; commits: 380f2749becc; files: src/agents/utils/tools-manager.ts, src/agents/utils/tools-manager.test.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Add a maxBytes parameter to downloadFile that checks Content-Length before reading the body and enforces a streaming byte cap during transfer, so oversized archives are rejected before hitting disk. Extract MAX_ARCHIVE_BYTES as a module-level constant shared between downloadFile and extractArchiveSafe, ensuring both gates use the same 100 MB limit. Add two regression tests: - rejects downloads with Content-Length exceeding the archive byte cap - accepts downloads with Content-Length under the archive byte cap Ref. openclaw#98988

LeonidasLux · 2026-07-02T08:28:02Z

@clawsweeper re-review

clawsweeper · 2026-07-02T08:28:05Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

- Replace PassThrough data listener with Transform that rejects overflow chunks *before* they are forwarded to the file pipeline, preventing the offending chunk from landing on disk. - Add completion guard and cleanup of partial downloads on failure so downloadTool does not leave a partial archive on disk. - Add real behavior proof: test output and live fd/rg download and extraction through the safe extractArchive code path. 🦞 diamond lobster: L2 evidence (real function calls + real objects) Ref. openclaw#98988

LeonidasLux · 2026-07-02T10:19:27Z

@clawsweeper re-review

Changes made:

Replaced PassThrough data listener with Transform stream limiter that rejects overflow chunks before forwarding them to the file pipeline
Added completion guard and cleanup of partial downloads on downloadFile failure
Added real behavior proof: live fd/rg download and extraction through the safe extractArchive code path
Updated PR body Real behavior proof section with terminal output evidence

clawsweeper · 2026-07-02T10:19:30Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

LeonidasLux · 2026-07-03T01:17:02Z

@clawsweeper re-review

Add a maxBytes parameter to downloadFile that checks Content-Length before reading the body and enforces a streaming byte cap during transfer, so oversized archives are rejected before hitting disk. Extract MAX_ARCHIVE_BYTES as a module-level constant shared between downloadFile and extractArchiveSafe, ensuring both gates use the same 100 MB limit. Add two regression tests: - rejects downloads with Content-Length exceeding the archive byte cap - accepts downloads with Content-Length under the archive byte cap Ref. openclaw#98988

- Replace PassThrough data listener with Transform that rejects overflow chunks *before* they are forwarded to the file pipeline, preventing the offending chunk from landing on disk. - Add completion guard and cleanup of partial downloads on failure so downloadTool does not leave a partial archive on disk. - Add real behavior proof: test output and live fd/rg download and extraction through the safe extractArchive code path. 🦞 diamond lobster: L2 evidence (real function calls + real objects) Ref. openclaw#98988

Uses a Transform to reject overflow chunks *before* they are forwarded to the file pipeline (a PassThrough data listener acts *after* emission and cannot prevent the offending chunk from landing on disk). Wraps the pipeline in a completion-guarded block so that partial downloads are removed when the transfer fails mid-way. Ref. openclaw#98988

…hive API Replace the synchronous spawnSync-based archive extraction (unzip/tar) with the safe extractArchive from @openclaw/fs-safe, which enforces: - maxArchiveBytes: 100 MB (prevents oversized compressed input) - maxExtractedBytes: 500 MB (prevents decompression bomb OOM) - maxEntries: 1000 (prevents zip bomb from exhausting inodes) - timeoutMs: 60,000 (prevents hung extraction) - Path traversal and symlink/hardlink protection (built-in) Removes 5 functions (formatSpawnFailure, runExtractionCommand, extractTarGzArchive, getWindowsTarCommand, extractZipArchive) and their associated imports, replacing them with a single async wrapper around the existing @openclaw/fs-safe infrastructure (re-exported from src/infra/archive.ts). Net: -83 lines, + security boundaries across all platforms.

Add a maxBytes parameter to downloadFile that checks Content-Length before reading the body and enforces a streaming byte cap during transfer, so oversized archives are rejected before hitting disk. Extract MAX_ARCHIVE_BYTES as a module-level constant shared between downloadFile and extractArchiveSafe, ensuring both gates use the same 100 MB limit. Add two regression tests: - rejects downloads with Content-Length exceeding the archive byte cap - accepts downloads with Content-Length under the archive byte cap Ref. openclaw#98988

- Replace PassThrough data listener with Transform that rejects overflow chunks *before* they are forwarded to the file pipeline, preventing the offending chunk from landing on disk. - Add completion guard and cleanup of partial downloads on failure so downloadTool does not leave a partial archive on disk. - Add real behavior proof: test output and live fd/rg download and extraction through the safe extractArchive code path. 🦞 diamond lobster: L2 evidence (real function calls + real objects) Ref. openclaw#98988

Uses a Transform to reject overflow chunks *before* they are forwarded to the file pipeline (a PassThrough data listener acts *after* emission and cannot prevent the offending chunk from landing on disk). Wraps the pipeline in a completion-guarded block so that partial downloads are removed when the transfer fails mid-way. Ref. openclaw#98988

vincentkoc · 2026-07-06T07:43:09Z

Merged via squash.

Prepared head SHA: 8ec764c643dccd9dd88063a35d1aeeae2773540c
Landed commit: be48a430bfa6fcb9970cdc95c2f8746318ce8f0d

…hive API (openclaw#98988) * fix(tools-manager): replace spawnSync extraction with safe extractArchive API Replace the synchronous spawnSync-based archive extraction (unzip/tar) with the safe extractArchive from @openclaw/fs-safe, which enforces: - maxArchiveBytes: 100 MB (prevents oversized compressed input) - maxExtractedBytes: 500 MB (prevents decompression bomb OOM) - maxEntries: 1000 (prevents zip bomb from exhausting inodes) - timeoutMs: 60,000 (prevents hung extraction) - Path traversal and symlink/hardlink protection (built-in) Removes 5 functions (formatSpawnFailure, runExtractionCommand, extractTarGzArchive, getWindowsTarCommand, extractZipArchive) and their associated imports, replacing them with a single async wrapper around the existing @openclaw/fs-safe infrastructure (re-exported from src/infra/archive.ts). Net: -83 lines, + security boundaries across all platforms. * fix(tools-manager): add download-stream byte cap and regression tests Add a maxBytes parameter to downloadFile that checks Content-Length before reading the body and enforces a streaming byte cap during transfer, so oversized archives are rejected before hitting disk. Extract MAX_ARCHIVE_BYTES as a module-level constant shared between downloadFile and extractArchiveSafe, ensuring both gates use the same 100 MB limit. Add two regression tests: - rejects downloads with Content-Length exceeding the archive byte cap - accepts downloads with Content-Length under the archive byte cap Ref. openclaw#98988 * fix(tools-manager): replace PassThrough with Transform stream limiter - Replace PassThrough data listener with Transform that rejects overflow chunks *before* they are forwarded to the file pipeline, preventing the offending chunk from landing on disk. - Add completion guard and cleanup of partial downloads on failure so downloadTool does not leave a partial archive on disk. - Add real behavior proof: test output and live fd/rg download and extraction through the safe extractArchive code path. 🦞 diamond lobster: L2 evidence (real function calls + real objects) Ref. openclaw#98988 * fix(tools-manager): replace PassThrough with Transform stream limiter Uses a Transform to reject overflow chunks *before* they are forwarded to the file pipeline (a PassThrough data listener acts *after* emission and cannot prevent the offending chunk from landing on disk). Wraps the pipeline in a completion-guarded block so that partial downloads are removed when the transfer fails mid-way. Ref. openclaw#98988 * fix(agents): harden helper archive downloads * fix(agents): preserve archive extraction cause --------- Co-authored-by: Vincent Koc <25068+vincentkoc@users.noreply.github.com> Co-authored-by: Vincent Koc <vincentkoc@ieee.org>

openclaw-barnacle Bot added agents Agent runtime and tooling size: S triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. and removed triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. labels Jul 2, 2026

openclaw-barnacle Bot added size: M and removed size: S labels Jul 2, 2026

openclaw-barnacle Bot added size: L and removed size: M labels Jul 2, 2026

vincentkoc mentioned this pull request Jul 6, 2026

chore(jobs): finalize resulted OpenClaw inbox jobs openclaw/clownfish#222

Merged

vincentkoc self-assigned this Jul 6, 2026

vincentkoc force-pushed the fix/archive-extraction-bomb-protection branch from 800fad7 to e572844 Compare July 6, 2026 07:25

LeonidasLux and others added 6 commits July 6, 2026 00:34

fix(agents): harden helper archive downloads

2940f4d

fix(agents): preserve archive extraction cause

8ec764c

vincentkoc force-pushed the fix/archive-extraction-bomb-protection branch from e572844 to 8ec764c Compare July 6, 2026 07:34

vincentkoc merged commit be48a43 into openclaw:main Jul 6, 2026
128 of 175 checks passed

github-actions Bot mentioned this pull request Jul 6, 2026

📡 Upstream Digest — 2026-07-06 08:12 UTC curtismercier/openclaw-mods#1221

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(tools-manager): replace spawnSync extraction with safe extractArchive API#98988

fix(tools-manager): replace spawnSync extraction with safe extractArchive API#98988
vincentkoc merged 6 commits into
openclaw:mainfrom
LeonidasLux:fix/archive-extraction-bomb-protection

LeonidasLux commented Jul 2, 2026 •

edited

Loading

Uh oh!

LeonidasLux commented Jul 2, 2026

Uh oh!

clawsweeper Bot commented Jul 2, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jul 2, 2026 •

edited

Loading

Uh oh!

LeonidasLux commented Jul 2, 2026

Uh oh!

clawsweeper Bot commented Jul 2, 2026 •

edited

Loading

Uh oh!

LeonidasLux commented Jul 2, 2026

Uh oh!

clawsweeper Bot commented Jul 2, 2026 •

edited

Loading

Uh oh!

LeonidasLux commented Jul 3, 2026

Uh oh!

Uh oh!

vincentkoc commented Jul 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

LeonidasLux commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What Problem This Solves

Root Cause

Linked context

Real behavior proof

Tests and validation

Unit tests

Integration / E2E

Risk checklist

🔧 Post-review fix (2026-07-02)

Uh oh!

LeonidasLux commented Jul 2, 2026

Uh oh!

clawsweeper Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

clawsweeper Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

LeonidasLux commented Jul 2, 2026

Uh oh!

clawsweeper Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

LeonidasLux commented Jul 2, 2026

Uh oh!

clawsweeper Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

LeonidasLux commented Jul 3, 2026

Uh oh!

Uh oh!

vincentkoc commented Jul 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

LeonidasLux commented Jul 2, 2026 •

edited

Loading

clawsweeper Bot commented Jul 2, 2026 •

edited

Loading

clawsweeper Bot commented Jul 2, 2026 •

edited

Loading

clawsweeper Bot commented Jul 2, 2026 •

edited

Loading

clawsweeper Bot commented Jul 2, 2026 •

edited

Loading