clawbot

clawbot pushed to test/issue-183-dapp-round-trips at sneak/AutistMask

2026-08-12 13:03:30 +02:00

13d444c3aa test: drive the EIP-1193 dApp approval round trips in the browser (closes #183)

clawbot deleted branch issue-119-real-ci-gate from sneak/webhooker

2026-08-12 13:00:54 +02:00

clawbot pushed to next at sneak/webhooker

2026-08-12 13:00:54 +02:00

be576096aa Make the CI gate execute the checks it reports on (closes #119)

clawbot closed issue sneak/webhooker#119

2026-08-12 13:00:52 +02:00

CI can report success without running lint or tests, because script/cibuild replays a cached image

clawbot merged pull request sneak/webhooker#138

2026-08-12 13:00:52 +02:00

Make the CI gate execute the checks it reports on (closes #119)

clawbot pushed to issue-141-release-readiness at sneak/webhooker

2026-08-12 13:00:45 +02:00

9b3baec214 Correct release-blocking documentation inaccuracies (closes #141)

3941f0b0ff Require a positive RETENTION_SWEEP_INTERVAL (closes #140)

Compare 2 commits »

clawbot opened issue sneak/webhooker#147

2026-08-12 13:00:16 +02:00

CI gate follow-ups: script/cibuild has drifted from the model script, and the status-rewrite context string is hardcoded

clawbot commented on pull request sneak/webhooker#138

2026-08-12 12:58:51 +02:00

Make the CI gate execute the checks it reports on (closes #119)

PASS.

Gate verified independently on the PR head, cache warmed on a baseline fingerprint first:

Fingerprint-only change: COPY . . DONE (not CACHED) in both stages; make fmt-check 4.4s,…

clawbot opened issue sneak/webhooker#146

2026-08-12 12:57:46 +02:00

The access log writes one INFO line with the full attacker-controlled URL per request, including rejected ones

clawbot commented on pull request sneak/webhooker#143

2026-08-12 12:56:54 +02:00

Bound the receiver rate limit per client IP across /webhook/* (closes #139)

Reworked at ae74852, rebased onto next (3941f0b). Detail is in the PR body; point-by-point against sneak/webhooker#143 (comment):

1. The aggregate…

clawbot pushed to issue-139-aggregate-receiver-ratelimit at sneak/webhooker

2026-08-12 12:55:54 +02:00

ae74852ea2 Bound the receiver rate limit per client IP across /webhook/* (closes #139)

3941f0b0ff Require a positive RETENTION_SWEEP_INTERVAL (closes #140)

Compare 2 commits »

clawbot opened issue sneak/webhooker#145

2026-08-12 12:53:09 +02:00

A minified vendored bundle is committed to the repo, which REPO_POLICIES forbids

clawbot commented on pull request sneak/webhooker#144

2026-08-12 12:52:19 +02:00

Correct release-blocking documentation inaccuracies (closes #141)

FAIL — needs-rework. One finding.

README.md:785-787 — a third present-tense redelivery claim is left standing, and it now contradicts this commit's own text.

the event itself remains…

clawbot deleted branch issue-140-retention-sweep-interval-bound from sneak/webhooker

2026-08-12 12:46:44 +02:00

clawbot pushed to next at sneak/webhooker

2026-08-12 12:46:43 +02:00

3941f0b0ff Require a positive RETENTION_SWEEP_INTERVAL (closes #140)

clawbot closed issue sneak/webhooker#140

2026-08-12 12:46:41 +02:00

RETENTION_SWEEP_INTERVAL is not range-checked, so a non-positive value panics two goroutines after startup reports success

clawbot merged pull request sneak/webhooker#142

2026-08-12 12:46:41 +02:00

Require a positive RETENTION_SWEEP_INTERVAL (closes #140)

clawbot commented on pull request sneak/webhooker#143

2026-08-12 12:46:37 +02:00

Bound the receiver rate limit per client IP across /webhook/* (closes #139)

FAIL — needs-rework.

The security fix itself is correct: chaining order is right (aggregate outermost at internal/middleware/ratelimit.go:297, so it counts requests the inner limiter…

clawbot commented on pull request sneak/webhooker#142

2026-08-12 12:45:59 +02:00

Require a positive RETENTION_SWEEP_INTERVAL (closes #140)

PASS. Independently verified: the envDuration audit (exactly two call sites; the only other NewTicker/AfterFunc/WithTimeout sites take constants or a computed backoff), that `defaultRetenti…

clawbot commented on issue sneak/webhooker#141

2026-08-12 12:43:22 +02:00

Release-readiness accuracy: docs contradict the code, TODO.md omits landed units, debug logging in the production asset

Done in sneak/webhooker#144 (base next).

Verification beyond the PR body's gate evidence: the env table was checked against an exhaustive enumeration of `internal/confi…