Vendor OpenClaw source as Adolf fork baseline

Adolf is a fork/vendored clone of github.com/openclaw/openclaw (v2026.6.11),
free to diverge. Tree copied sans upstream .git; upstream remote added for
future syncs. Node pinned to 24 (.nvmrc); engines already require >=22.19.
Preserves docs/ARCHITECTURE.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LeqyaxJF2nbRXJtae2kNB2

.github/codeql/codeql-actions-critical-security.yml

@@ -0,0 +1,21 @@
+name: openclaw-codeql-actions-critical-security
+
+disable-default-queries: true
+
+queries:
+  - uses: security-extended
+
+query-filters:
+  - include:
+      precision:
+        - high
+        - very-high
+      tags contain: security
+      security-severity: /([7-9]|10)\.(\d)+/
+
+paths:
+  - .github/actions
+  - .github/workflows
+
+paths-ignore:
+  - .github/workflows/stale.yml

.github/codeql/codeql-agent-runtime-boundary-critical-quality.yml

@@ -0,0 +1,54 @@
+name: openclaw-codeql-agent-runtime-boundary-critical-quality
+
+disable-default-queries: true
+
+queries:
+  - uses: security-and-quality
+
+query-filters:
+  - include:
+      problem.severity:
+        - error
+  - exclude:
+      tags:
+        - security
+
+paths:
+  - src/acp/control-plane
+  - src/agents/command
+  - src/agents/cli-runner
+  - src/agents/embedded-agent-runner
+  - src/agents/sessions
+  - src/agents/tools
+  - src/agents/*completion*.ts
+  - src/agents/*transport*.ts
+  - src/agents/model-*.ts
+  - src/agents/openclaw-tools*.ts
+  - src/agents/provider-*.ts
+  - src/agents/session*.ts
+  - src/agents/tool-call*.ts
+  - src/auto-reply/reply/agent-runner*.ts
+  - src/auto-reply/reply/commands*.ts
+  - src/auto-reply/reply/directive-handling*.ts
+  - src/auto-reply/reply/dispatch-*.ts
+  - src/auto-reply/reply/get-reply-run*.ts
+  - src/auto-reply/reply/provider-dispatcher*.ts
+  - src/auto-reply/reply/queue*.ts
+  - src/auto-reply/reply/reply-run-registry*.ts
+  - src/auto-reply/reply/session*.ts
+
+paths-ignore:
+  - "**/node_modules"
+  - "**/coverage"
+  - "**/*.generated.ts"
+  - "**/*.bundle.js"
+  - "**/*-runtime.js"
+  - "**/*.test.ts"
+  - "**/*.test.tsx"
+  - "**/*.e2e.test.ts"
+  - "**/*.e2e.test.tsx"
+  - "**/*test-support*"
+  - "**/*test-helper*"
+  - "**/*mock*"
+  - "**/*fixture*"
+  - "**/*bench*"

.github/codeql/codeql-android-critical-security.yml

@@ -0,0 +1,30 @@
+name: openclaw-codeql-android-critical-security
+
+disable-default-queries: true
+
+queries:
+  - uses: security-extended
+
+query-filters:
+  # Android canvas intentionally runs trusted A2UI JavaScript; keep this profile focused on exploitable WebView edges.
+  - exclude:
+      id: java/android/websettings-javascript-enabled
+  # Gateway TLS already pins verified certificate SHA-256 fingerprints. OkHttp CertificatePinner pins SPKI hashes,
+  # so this query is noisy for OpenClaw's TOFU/local-gateway trust model and does not belong in the critical profile.
+  - exclude:
+      id: java/android/missing-certificate-pinning
+
+paths:
+  - apps/android/app/src/main
+
+paths-ignore:
+  - "**/.gradle"
+  - "**/build"
+  - "**/node_modules"
+  - "**/coverage"
+  - "**/*.generated.*"
+  - "**/*Test.kt"
+  - "**/*Test.java"
+  - "**/*Benchmark.kt"
+  - apps/android/app/src/test
+  - apps/android/benchmark

.github/codeql/codeql-channel-runtime-boundary-critical-quality.yml

@@ -0,0 +1,55 @@
+name: openclaw-codeql-channel-runtime-boundary-critical-quality
+
+disable-default-queries: true
+
+queries:
+  - uses: security-and-quality
+
+query-filters:
+  - include:
+      problem.severity:
+        - error
+  - exclude:
+      tags:
+        - security
+
+paths:
+  - extensions/discord/src
+  - extensions/feishu/src
+  - extensions/googlechat/src
+  - extensions/imessage/src
+  - extensions/irc/src
+  - extensions/line/src
+  - extensions/matrix/src
+  - extensions/mattermost/src
+  - extensions/msteams/src
+  - extensions/nextcloud-talk/src
+  - extensions/nostr/src
+  - extensions/qa-channel/src
+  - extensions/qqbot/src
+  - extensions/signal/src
+  - extensions/slack/src
+  - extensions/synology-chat/src
+  - extensions/telegram/src
+  - extensions/tlon/src
+  - extensions/twitch/src
+  - extensions/whatsapp/src
+  - extensions/zalo/src
+  - extensions/zalouser/src
+  - src/channels
+
+paths-ignore:
+  - "**/node_modules"
+  - "**/coverage"
+  - "**/*.generated.ts"
+  - "**/*.bundle.js"
+  - "**/*-runtime.js"
+  - "**/*.test.ts"
+  - "**/*.test.tsx"
+  - "**/*.e2e.test.ts"
+  - "**/*.e2e.test.tsx"
+  - "**/*test-support*"
+  - "**/*test-helper*"
+  - "**/*mock*"
+  - "**/*fixture*"
+  - "**/*bench*"

.github/codeql/codeql-channel-runtime-boundary-critical-security.yml

@@ -0,0 +1,48 @@
+name: openclaw-codeql-channel-runtime-boundary-critical-security
+
+disable-default-queries: true
+
+queries:
+  - uses: security-extended
+
+query-filters:
+  - include:
+      precision:
+        - high
+        - very-high
+      tags contain: security
+      security-severity: /([7-9]|10)\.(\d)+/
+
+paths:
+  - src/channels
+  - src/config/channel-*.ts
+  - src/config/types.channel*.ts
+  - src/gateway/server-channel*.ts
+  - src/gateway/server-methods/channels.ts
+  - packages/gateway-protocol/src/schema/channels.ts
+  - src/infra/channel-*.ts
+  - src/infra/exec-approval-channel-runtime.ts
+  - src/infra/outbound/channel-*.ts
+  - src/plugin-sdk/channel-*.ts
+  - src/plugins/channel-*.ts
+  - src/plugins/bundled-channel-*.ts
+  - src/plugins/runtime/*channel*.ts
+  - src/secrets/channel-*.ts
+  - src/secrets/runtime-config-collectors-channels.ts
+  - src/security/audit-channel*.ts
+
+paths-ignore:
+  - "**/node_modules"
+  - "**/coverage"
+  - "**/*.generated.ts"
+  - "**/*.bundle.js"
+  - "**/*-runtime.js"
+  - "**/*.test.ts"
+  - "**/*.test.tsx"
+  - "**/*.e2e.test.ts"
+  - "**/*.e2e.test.tsx"
+  - "**/*test-support*"
+  - "**/*test-helper*"
+  - "**/*mock*"
+  - "**/*fixture*"
+  - "**/*bench*"

.github/codeql/codeql-config-boundary-critical-quality.yml

@@ -0,0 +1,33 @@
+name: openclaw-codeql-config-boundary-critical-quality
+
+disable-default-queries: true
+
+queries:
+  - uses: security-and-quality
+
+query-filters:
+  - include:
+      problem.severity:
+        - error
+  - exclude:
+      tags:
+        - security
+
+paths:
+  - src/config
+
+paths-ignore:
+  - "**/node_modules"
+  - "**/coverage"
+  - "**/*.generated.ts"
+  - "**/*.bundle.js"
+  - "**/*-runtime.js"
+  - "**/*.test.ts"
+  - "**/*.test.tsx"
+  - "**/*.e2e.test.ts"
+  - "**/*.e2e.test.tsx"
+  - "**/*test-support*"
+  - "**/*test-helper*"
+  - "**/*mock*"
+  - "**/*fixture*"
+  - "**/*bench*"

.github/codeql/codeql-core-auth-secrets-critical-quality.yml

@@ -0,0 +1,55 @@
+name: openclaw-codeql-core-auth-secrets-critical-quality
+
+disable-default-queries: true
+
+queries:
+  - uses: security-and-quality
+
+query-filters:
+  - include:
+      problem.severity:
+        - error
+  - exclude:
+      tags:
+        - security
+
+paths:
+  - src/agents/*auth*.ts
+  - src/agents/**/*auth*.ts
+  - src/agents/auth-health*.ts
+  - src/agents/auth-profiles
+  - src/agents/bash-tools.exec-host-shared.ts
+  - src/agents/sandbox
+  - src/agents/sandbox.ts
+  - src/agents/sandbox-*.ts
+  - src/agents/sessions/*auth*.ts
+  - src/agents/sessions/**/*auth*.ts
+  - src/cron/service/jobs.ts
+  - src/cron/stagger.ts
+  - src/gateway/*auth*.ts
+  - src/gateway/**/*auth*.ts
+  - src/gateway/*secret*.ts
+  - src/gateway/**/*secret*.ts
+  - packages/gateway-protocol/src/**/*secret*.ts
+  - src/gateway/resolve-configured-secret-input-string*.ts
+  - src/gateway/security-path*.ts
+  - src/gateway/server-methods/secrets*.ts
+  - src/infra/secret-file*.ts
+  - src/secrets
+  - src/security
+
+paths-ignore:
+  - "**/node_modules"
+  - "**/coverage"
+  - "**/*.generated.ts"
+  - "**/*.bundle.js"
+  - "**/*-runtime.js"
+  - "**/*.test.ts"
+  - "**/*.test.tsx"
+  - "**/*.e2e.test.ts"
+  - "**/*.e2e.test.tsx"
+  - "**/*test-support*"
+  - "**/*test-helper*"
+  - "**/*mock*"
+  - "**/*fixture*"
+  - "**/*bench*"

.github/codeql/codeql-core-auth-secrets-critical-security.yml

@@ -0,0 +1,55 @@
+name: openclaw-codeql-core-auth-secrets-critical-security
+
+disable-default-queries: true
+
+queries:
+  - uses: security-extended
+
+query-filters:
+  - include:
+      precision:
+        - high
+        - very-high
+      tags contain: security
+      security-severity: /([7-9]|10)\.(\d)+/
+
+paths:
+  - src/agents/*auth*.ts
+  - src/agents/**/*auth*.ts
+  - src/agents/auth-health*.ts
+  - src/agents/auth-profiles
+  - src/agents/bash-tools.exec-host-shared.ts
+  - src/agents/sandbox
+  - src/agents/sandbox.ts
+  - src/agents/sandbox-*.ts
+  - src/config/*secret*.ts
+  - src/config/**/*secret*.ts
+  - src/cron/service/jobs.ts
+  - src/cron/stagger.ts
+  - src/gateway/*auth*.ts
+  - src/gateway/**/*auth*.ts
+  - src/gateway/*secret*.ts
+  - src/gateway/**/*secret*.ts
+  - packages/gateway-protocol/src/**/*secret*.ts
+  - src/gateway/resolve-configured-secret-input-string*.ts
+  - src/gateway/security-path*.ts
+  - src/gateway/server-methods/secrets*.ts
+  - src/infra/secret-file*.ts
+  - src/secrets
+  - src/security
+
+paths-ignore:
+  - "**/node_modules"
+  - "**/coverage"
+  - "**/*.generated.ts"
+  - "**/*.bundle.js"
+  - "**/*-runtime.js"
+  - "**/*.test.ts"
+  - "**/*.test.tsx"
+  - "**/*.e2e.test.ts"
+  - "**/*.e2e.test.tsx"
+  - "**/*test-support*"
+  - "**/*test-helper*"
+  - "**/*mock*"
+  - "**/*fixture*"
+  - "**/*bench*"

.github/codeql/codeql-gateway-runtime-boundary-critical-quality.yml

@@ -0,0 +1,37 @@
+name: openclaw-codeql-gateway-runtime-boundary-critical-quality
+
+disable-default-queries: true
+
+queries:
+  - uses: security-and-quality
+
+query-filters:
+  - include:
+      problem.severity:
+        - error
+  - exclude:
+      tags:
+        - security
+
+paths:
+  - src/gateway/method-scopes.ts
+  - packages/gateway-protocol/src
+  - src/gateway/server-methods
+  - src/gateway/server-methods.ts
+  - src/gateway/server-methods-list.ts
+
+paths-ignore:
+  - "**/node_modules"
+  - "**/coverage"
+  - "**/*.generated.ts"
+  - "**/*.bundle.js"
+  - "**/*-runtime.js"
+  - "**/*.test.ts"
+  - "**/*.test.tsx"
+  - "**/*.e2e.test.ts"
+  - "**/*.e2e.test.tsx"
+  - "**/*test-support*"
+  - "**/*test-helper*"
+  - "**/*mock*"
+  - "**/*fixture*"
+  - "**/*bench*"

.github/codeql/codeql-macos-critical-security.yml

@@ -0,0 +1,17 @@
+name: openclaw-codeql-macos-critical-security
+
+disable-default-queries: true
+
+queries:
+  - uses: security-extended
+
+paths:
+  - apps/macos/Sources
+
+paths-ignore:
+  - "**/.build"
+  - "**/.build/**"
+  - "**/DerivedData"
+  - "**/DerivedData/**"
+  - "**/*.generated.swift"
+  - "**/*Tests.swift"

.github/codeql/codeql-mcp-process-runtime-boundary-critical-quality.yml

@@ -0,0 +1,35 @@
+name: openclaw-codeql-mcp-process-runtime-boundary-critical-quality
+
+disable-default-queries: true
+
+queries:
+  - uses: security-and-quality
+
+query-filters:
+  - include:
+      problem.severity:
+        - error
+  - exclude:
+      tags:
+        - security
+
+paths:
+  - src/mcp
+  - src/process
+  - src/infra/outbound
+
+paths-ignore:
+  - "**/node_modules"
+  - "**/coverage"
+  - "**/*.generated.ts"
+  - "**/*.bundle.js"
+  - "**/*-runtime.js"
+  - "**/*.test.ts"
+  - "**/*.test.tsx"
+  - "**/*.e2e.test.ts"
+  - "**/*.e2e.test.tsx"
+  - "**/*test-support*"
+  - "**/*test-helper*"
+  - "**/*mock*"
+  - "**/*fixture*"
+  - "**/*bench*"

.github/codeql/codeql-mcp-process-tool-boundary-critical-security.yml

@@ -0,0 +1,57 @@
+name: openclaw-codeql-mcp-process-tool-boundary-critical-security
+
+disable-default-queries: true
+
+queries:
+  - uses: security-extended
+
+query-filters:
+  - include:
+      precision:
+        - high
+        - very-high
+      tags contain: security
+      security-severity: /([7-9]|10)\.(\d)+/
+
+paths:
+  - src/mcp
+  - src/process
+  - src/infra/outbound
+  - src/agents/bash-tools.exec*.ts
+  - src/agents/bash-tools.process*.ts
+  - src/agents/exec-*.ts
+  - src/agents/execution-contract.ts
+  - src/agents/openclaw-plugin-tools.ts
+  - src/agents/openclaw-tools.runtime.ts
+  - src/agents/openclaw-tools.registration.ts
+  - src/agents/agent-tool-definition-adapter.ts
+  - src/agents/agent-tools.abort.ts
+  - src/agents/agent-tools.before-tool-call*.ts
+  - src/agents/agent-tools.read.ts
+  - packages/ai/src/providers/agent-tools-parameter-schema.ts
+  - src/agents/sessions/tools/**
+  - src/agents/embedded-agent-runner/effective-tool-policy.ts
+  - src/agents/embedded-agent-runner/tool-name-allowlist.ts
+  - src/agents/embedded-agent-runner/tool-schema-runtime.ts
+  - src/agents/tools/gateway-tool.ts
+  - src/agents/tools/message-tool.ts
+  - src/agents/tools/sessions-send-tool.ts
+  - src/agents/tools/sessions-spawn-tool.ts
+  - src/agents/tools/subagents-tool.ts
+  - src/agents/tools/tool-runtime.helpers.ts
+
+paths-ignore:
+  - "**/node_modules"
+  - "**/coverage"
+  - "**/*.generated.ts"
+  - "**/*.bundle.js"
+  - "**/*-runtime.js"
+  - "**/*.test.ts"
+  - "**/*.test.tsx"
+  - "**/*.e2e.test.ts"
+  - "**/*.e2e.test.tsx"
+  - "**/*test-support*"
+  - "**/*test-helper*"
+  - "**/*mock*"
+  - "**/*fixture*"
+  - "**/*bench*"

.github/codeql/codeql-memory-runtime-boundary-critical-quality.yml

@@ -0,0 +1,41 @@
+name: openclaw-codeql-memory-runtime-boundary-critical-quality
+
+disable-default-queries: true
+
+queries:
+  - uses: security-and-quality
+
+query-filters:
+  - include:
+      problem.severity:
+        - error
+  - exclude:
+      tags:
+        - security
+
+paths:
+  - packages/memory-host-sdk/src
+  - src/memory
+  - src/memory-host-sdk
+  - src/plugin-sdk/memory-*.ts
+  - src/plugin-sdk/memory-core-host-*.ts
+  - src/plugins/memory-*.ts
+  - src/gateway/server-startup-memory.ts
+  - src/commands/doctor-memory-search.ts
+  - src/commands/doctor/cron/dreaming-payload-migration.ts
+
+paths-ignore:
+  - "**/node_modules"
+  - "**/coverage"
+  - "**/*.generated.ts"
+  - "**/*.bundle.js"
+  - "**/*-runtime.js"
+  - "**/*.test.ts"
+  - "**/*.test.tsx"
+  - "**/*.e2e.test.ts"
+  - "**/*.e2e.test.tsx"
+  - "**/*test-support*"
+  - "**/*test-helper*"
+  - "**/*mock*"
+  - "**/*fixture*"
+  - "**/*bench*"

.github/codeql/codeql-network-runtime-boundary-critical-quality.yml

@@ -0,0 +1,37 @@
+name: openclaw-codeql-network-runtime-boundary-critical-quality
+
+disable-default-queries: true
+
+queries:
+  - uses: ./.github/codeql/openclaw-boundary/queries/raw-socket-callsite-classification.ql
+  - uses: ./.github/codeql/openclaw-boundary/queries/managed-proxy-runtime-mutation.ql
+
+paths:
+  - src/cli/gateway-cli/run-loop.ts
+  - src/infra/gateway-lock.ts
+  - src/infra/jsonl-socket.ts
+  - src/infra/net
+  - src/infra/push-apns-http2.ts
+  - src/infra/ssh-tunnel.ts
+  - src/proxy-capture
+  - extensions/codex-supervisor/src/json-rpc-client.ts
+  - extensions/irc/src
+  - extensions/qa-lab/src
+  - packages/net-policy/src
+
+paths-ignore:
+  - "**/node_modules"
+  - "**/coverage"
+  - "**/*.generated.ts"
+  - "**/*.bundle.js"
+  - "**/*-runtime.js"
+  - "**/*.test.ts"
+  - "**/*.test.tsx"
+  - "**/*.e2e.test.ts"
+  - "**/*.e2e.test.tsx"
+  - "**/*test-support*"
+  - "**/*test-helper*"
+  - "**/*mock*"
+  - "**/*fixture*"
+  - "**/*bench*"
+  - "extensions/diffs/assets/**"

.github/codeql/codeql-network-ssrf-boundary-critical-security.yml

@@ -0,0 +1,41 @@
+name: openclaw-codeql-network-ssrf-boundary-critical-security
+
+disable-default-queries: true
+
+queries:
+  - uses: security-extended
+
+query-filters:
+  - include:
+      precision:
+        - high
+        - very-high
+      tags contain: security
+      security-severity: /([7-9]|10)\.(\d)+/
+
+paths:
+  - src/infra/net
+  - src/agents/tools/web-fetch.ts
+  - src/agents/tools/web-guarded-fetch.ts
+  - src/agents/tools/web-shared.ts
+  - src/plugin-sdk/ssrf-policy.ts
+  - src/web-fetch
+  - packages/web-content-core/src/provider-runtime-shared.ts
+  - packages/memory-host-sdk/src/host/ssrf-policy.ts
+  - packages/net-policy/src
+
+paths-ignore:
+  - "**/node_modules"
+  - "**/coverage"
+  - "**/*.generated.ts"
+  - "**/*.bundle.js"
+  - "**/*-runtime.js"
+  - "**/*.test.ts"
+  - "**/*.test.tsx"
+  - "**/*.e2e.test.ts"
+  - "**/*.e2e.test.tsx"
+  - "**/*test-support*"
+  - "**/*test-helper*"
+  - "**/*mock*"
+  - "**/*fixture*"
+  - "**/*bench*"

.github/codeql/codeql-plugin-boundary-critical-quality.yml

@@ -0,0 +1,73 @@
+name: openclaw-codeql-plugin-boundary-critical-quality
+
+disable-default-queries: true
+
+queries:
+  - uses: security-and-quality
+
+query-filters:
+  - include:
+      problem.severity:
+        - error
+  - exclude:
+      tags:
+        - security
+
+paths:
+  - src/plugins/activation-planner.ts
+  - src/plugins/api-builder.ts
+  - src/plugins/bundled-compat.ts
+  - src/plugins/bundled-dir.ts
+  - src/plugins/bundled-plugin-metadata.ts
+  - src/plugins/plugin-sdk-dist-alias.ts
+  - src/plugins/captured-registration.ts
+  - src/plugins/config-activation-shared.ts
+  - src/plugins/config-contracts.ts
+  - src/plugins/config-normalization-shared.ts
+  - src/plugins/config-policy.ts
+  - src/plugins/config-schema.ts
+  - src/plugins/config-state.ts
+  - src/plugins/discovery.ts
+  - src/plugins/effective-plugin-ids.ts
+  - src/plugins/externalized-bundled-plugins.ts
+  - src/plugins/installed-plugin-index*.ts
+  - src/plugins/loader*.ts
+  - src/plugins/manifest*.ts
+  - src/plugins/module-export.ts
+  - src/plugins/package-entrypoints.ts
+  - src/plugins/plugin-registry*.ts
+  - src/plugins/provider-contract-public-artifacts.ts
+  - src/plugins/provider-public-artifacts.ts
+  - src/plugins/public-surface*.ts
+  - src/plugins/registry.ts
+  - src/plugins/registry-types.ts
+  - src/plugins/runtime
+  - src/plugins/runtime-state.ts
+  - src/plugins/runtime.ts
+  - src/plugins/sdk-alias.ts
+  - src/plugins/types.ts
+  - src/plugins/validation-diagnostics.ts
+  - src/plugins/web-provider-public-artifacts*.ts
+  - src/plugin-sdk/*entry*.ts
+  - src/plugin-sdk/*facade*.ts
+  - src/plugin-sdk/api-baseline.ts
+  - src/plugin-sdk/config-schema.ts
+  - src/plugin-sdk/config-types.ts
+  - src/plugin-sdk/core.ts
+  - src/plugin-sdk/extension-shared.ts
+
+paths-ignore:
+  - "**/node_modules"
+  - "**/coverage"
+  - "**/*.generated.ts"
+  - "**/*.bundle.js"
+  - "**/*-runtime.js"
+  - "**/*.test.ts"
+  - "**/*.test.tsx"
+  - "**/*.e2e.test.ts"
+  - "**/*.e2e.test.tsx"
+  - "**/*test-support*"
+  - "**/*test-helper*"
+  - "**/*mock*"
+  - "**/*fixture*"
+  - "**/*bench*"

.github/codeql/codeql-plugin-sdk-package-contract-critical-quality.yml

@@ -0,0 +1,36 @@
+name: openclaw-codeql-plugin-sdk-package-contract-critical-quality
+
+disable-default-queries: true
+
+queries:
+  - uses: security-and-quality
+
+query-filters:
+  - include:
+      problem.severity:
+        - error
+  - exclude:
+      tags:
+        - security
+
+paths:
+  - packages/plugin-sdk/src
+  - packages/plugin-package-contract/src
+
+paths-ignore:
+  - "**/node_modules"
+  - "**/coverage"
+  - "**/*.generated.ts"
+  - "**/*.bundle.js"
+  - "**/*-runtime.js"
+  - "**/*.test.ts"
+  - "**/*.test.tsx"
+  - "**/*.spec.ts"
+  - "**/*.spec.tsx"
+  - "**/*.e2e.test.ts"
+  - "**/*.e2e.test.tsx"
+  - "**/*test-support*"
+  - "**/*test-helper*"
+  - "**/*mock*"
+  - "**/*fixture*"
+  - "**/*bench*"

.github/codeql/codeql-plugin-sdk-reply-runtime-critical-quality.yml

@@ -0,0 +1,44 @@
+name: openclaw-codeql-plugin-sdk-reply-runtime-critical-quality
+
+disable-default-queries: true
+
+queries:
+  - uses: security-and-quality
+
+query-filters:
+  - include:
+      problem.severity:
+        - error
+  - exclude:
+      tags:
+        - security
+
+paths:
+  - src/plugin-sdk/inbound-envelope.ts
+  - src/plugin-sdk/inbound-reply-dispatch.ts
+  - src/plugin-sdk/reply-*.ts
+  - src/plugin-sdk/channel-reply-*.ts
+  - src/plugin-sdk/delivery-queue-runtime.ts
+  - src/plugin-sdk/outbound-runtime.ts
+  - src/plugin-sdk/outbound-send-deps.ts
+  - src/plugin-sdk/model-session-runtime.ts
+  - src/plugin-sdk/session-*.ts
+  - src/plugin-sdk/thread-bindings-runtime.ts
+  - src/plugin-sdk/thread-bindings-session-runtime.ts
+  - src/plugin-sdk/conversation-binding-runtime.ts
+
+paths-ignore:
+  - "**/node_modules"
+  - "**/coverage"
+  - "**/*.generated.ts"
+  - "**/*.bundle.js"
+  - "**/*-runtime.js"
+  - "**/*.test.ts"
+  - "**/*.test.tsx"
+  - "**/*.e2e.test.ts"
+  - "**/*.e2e.test.tsx"
+  - "**/*test-support*"
+  - "**/*test-helper*"
+  - "**/*mock*"
+  - "**/*fixture*"
+  - "**/*bench*"

.github/codeql/codeql-plugin-trust-boundary-critical-security.yml

@@ -0,0 +1,85 @@
+name: openclaw-codeql-plugin-trust-boundary-critical-security
+
+disable-default-queries: true
+
+queries:
+  - uses: security-extended
+
+query-filters:
+  - include:
+      precision:
+        - high
+        - very-high
+      tags contain: security
+      security-severity: /([7-9]|10)\.(\d)+/
+
+paths:
+  - src/cli/plugin-install-config-policy.ts
+  - src/cli/plugin-registry-loader.ts
+  - src/cli/plugins-command-helpers.ts
+  - src/cli/plugins-install-command.ts
+  - src/cli/plugins-install-record-commit.ts
+  - src/plugins/activation-planner.ts
+  - src/plugins/bundle-manifest.ts
+  - src/plugins/bundled-compat.ts
+  - src/plugins/bundled-dir.ts
+  - src/plugins/bundled-plugin-metadata.ts
+  - src/plugins/bundled-plugin-scan.ts
+  - src/plugins/plugin-sdk-dist-alias.ts
+  - src/plugins/cli-registry-loader.ts
+  - src/plugins/config-activation-shared.ts
+  - src/plugins/config-contracts.ts
+  - src/plugins/config-policy.ts
+  - src/plugins/config-schema.ts
+  - src/plugins/dependency-denylist.ts
+  - src/plugins/discovery.ts
+  - src/plugins/effective-plugin-ids.ts
+  - src/plugins/externalized-bundled-plugins.ts
+  - src/plugins/install.runtime.ts
+  - src/plugins/install-source-info.ts
+  - src/plugins/installed-plugin-index*.ts
+  - src/plugins/loader*.ts
+  - src/plugins/manifest*.ts
+  - src/plugins/marketplace.ts
+  - src/plugins/module-export.ts
+  - src/plugins/package-entrypoints.ts
+  - src/plugins/plugin-config-trust.ts
+  - src/plugins/plugin-origin.types.ts
+  - src/plugins/plugin-registry*.ts
+  - src/plugins/public-surface*.ts
+  - src/plugins/registry*.ts
+  - src/plugins/runtime
+  - src/plugins/runtime-state.ts
+  - src/plugins/runtime.ts
+  - src/plugins/update.ts
+  - src/plugins/validation-diagnostics.ts
+  - src/plugin-sdk/*entry*.ts
+  - src/plugin-sdk/*facade*.ts
+  - src/plugin-sdk/api-baseline.ts
+  - src/plugin-sdk/config-schema.ts
+  - src/plugin-sdk/config-types.ts
+  - src/plugin-sdk/core.ts
+  - src/plugin-sdk/extension-shared.ts
+  - packages/plugin-package-contract/src
+  - packages/plugin-sdk/src/plugin-entry.ts
+  - packages/plugin-sdk/src/plugin-runtime.ts
+  - packages/plugin-sdk/src/runtime-env.ts
+  - packages/plugin-sdk/src/security-runtime.ts
+
+paths-ignore:
+  - "**/node_modules"
+  - "**/coverage"
+  - "**/*.generated.ts"
+  - "**/*.bundle.js"
+  - "**/*-runtime.js"
+  - "**/*.test.ts"
+  - "**/*.test.tsx"
+  - "**/*.spec.ts"
+  - "**/*.spec.tsx"
+  - "**/*.e2e.test.ts"
+  - "**/*.e2e.test.tsx"
+  - "**/*test-support*"
+  - "**/*test-helper*"
+  - "**/*mock*"
+  - "**/*fixture*"
+  - "**/*bench*"

.github/codeql/codeql-process-exec-boundary-critical-security.yml

@@ -0,0 +1,61 @@
+name: openclaw-codeql-process-exec-boundary-critical-security
+
+disable-default-queries: true
+
+queries:
+  - uses: security-extended
+
+query-filters:
+  - include:
+      precision:
+        - high
+        - very-high
+      tags contain: security
+      security-severity: /([7-9]|10)\.(\d)+/
+
+paths:
+  - src/process
+  - src/tui/tui-local-shell.ts
+  - src/tui/tui.ts
+  - src/plugin-sdk/windows-spawn.ts
+  - packages/agent-core/src/harness/env
+  - packages/memory-host-sdk/src/host
+  - extensions/acpx/src
+  - extensions/bonjour/src/advertiser.ts
+  - extensions/browser/src/browser/chrome-mcp.ts
+  - extensions/browser/src/browser/chrome.executables.ts
+  - extensions/browser/src/browser/chrome.ts
+  - extensions/codex/src/app-server/sandbox-exec-server
+  - extensions/codex/src/app-server/transport-stdio.ts
+  - extensions/codex/src/node-cli-sessions.ts
+  - extensions/codex-supervisor/src/json-rpc-client.ts
+  - extensions/file-transfer/src
+  - extensions/google-meet/src
+  - extensions/imessage/src
+  - extensions/memory-core/src/memory/qmd-manager.ts
+  - extensions/memory-wiki/src/obsidian.ts
+  - extensions/microsoft-foundry/cli.ts
+  - extensions/ollama/src/wsl2-crash-loop-check.ts
+  - extensions/qa-lab/src
+  - extensions/signal/src/daemon.ts
+  - extensions/tts-local-cli/speech-provider.ts
+  - extensions/voice-call/src
+  - scripts
+
+paths-ignore:
+  - "**/node_modules"
+  - "**/coverage"
+  - "**/*.generated.ts"
+  - "**/*.bundle.js"
+  - "**/*-runtime.js"
+  - "**/*.test.ts"
+  - "**/*.test.tsx"
+  - "**/*.spec.ts"
+  - "**/*.spec.tsx"
+  - "**/*.e2e.test.ts"
+  - "**/*.e2e.test.tsx"
+  - "**/*test-support*"
+  - "**/*test-helper*"
+  - "**/*mock*"
+  - "**/*fixture*"
+  - "**/*bench*"

.github/codeql/codeql-provider-runtime-boundary-critical-quality.yml

@@ -0,0 +1,44 @@
+name: openclaw-codeql-provider-runtime-boundary-critical-quality
+
+disable-default-queries: true
+
+queries:
+  - uses: security-and-quality
+
+query-filters:
+  - include:
+      problem.severity:
+        - error
+  - exclude:
+      tags:
+        - security
+
+paths:
+  - src/model-catalog
+  - src/plugins/provider-*.ts
+  - src/plugins/providers*.ts
+  - src/plugins/*provider*.ts
+  - src/plugins/capability-provider-runtime.ts
+  - src/plugins/compaction-provider.ts
+  - src/plugins/memory-embedding-provider*.ts
+  - src/plugins/memory-embedding-providers*.ts
+  - src/plugins/migration-provider-runtime.ts
+  - src/plugins/synthetic-auth.runtime.ts
+  - src/plugins/web-fetch-providers*.ts
+  - src/plugins/web-search-providers*.ts
+
+paths-ignore:
+  - "**/node_modules"
+  - "**/coverage"
+  - "**/*.generated.ts"
+  - "**/*.bundle.js"
+  - "**/*-runtime.js"
+  - "**/*.test.ts"
+  - "**/*.test.tsx"
+  - "**/*.e2e.test.ts"
+  - "**/*.e2e.test.tsx"
+  - "**/*test-support*"
+  - "**/*test-helper*"
+  - "**/*mock*"
+  - "**/*fixture*"
+  - "**/*bench*"

.github/codeql/codeql-session-diagnostics-boundary-critical-quality.yml

@@ -0,0 +1,48 @@
+name: openclaw-codeql-session-diagnostics-boundary-critical-quality
+
+disable-default-queries: true
+
+queries:
+  - uses: security-and-quality
+
+query-filters:
+  - include:
+      problem.severity:
+        - error
+  - exclude:
+      tags:
+        - security
+
+paths:
+  - src/auto-reply/reply/queue
+  - src/auto-reply/reply/post-compaction-context.ts
+  - src/auto-reply/reply/startup-context.ts
+  - src/infra/diagnostic-*.ts
+  - src/infra/diagnostics-timeline.ts
+  - src/infra/session-delivery-queue*.ts
+  - src/infra/outbound/base-session-key.ts
+  - src/infra/outbound/delivery-queue*.ts
+  - src/infra/outbound/outbound-session.ts
+  - src/infra/outbound/session-binding*.ts
+  - src/infra/outbound/session-context.ts
+  - src/infra/outbound/targets-session.ts
+  - src/logging/diagnostic*.ts
+  - src/commands/doctor-session-*.ts
+  - src/commands/session-store-targets.ts
+  - src/commands/sessions*.ts
+
+paths-ignore:
+  - "**/node_modules"
+  - "**/coverage"
+  - "**/*.generated.ts"
+  - "**/*.bundle.js"
+  - "**/*-runtime.js"
+  - "**/*.test.ts"
+  - "**/*.test.tsx"
+  - "**/*.e2e.test.ts"
+  - "**/*.e2e.test.tsx"
+  - "**/*test-support*"
+  - "**/*test-helper*"
+  - "**/*mock*"
+  - "**/*fixture*"
+  - "**/*bench*"

.github/codeql/codeql-ui-control-plane-critical-quality.yml

@@ -0,0 +1,36 @@
+name: openclaw-codeql-ui-control-plane-critical-quality
+
+disable-default-queries: true
+
+queries:
+  - uses: security-and-quality
+
+query-filters:
+  - include:
+      problem.severity:
+        - error
+  - exclude:
+      tags:
+        - security
+
+paths:
+  - ui/src/main.ts
+  - ui/src/local-storage.ts
+  - ui/src/ui
+  - src/tasks/task-registry-control*.ts
+
+paths-ignore:
+  - "**/node_modules"
+  - "**/coverage"
+  - "**/*.generated.ts"
+  - "**/*.bundle.js"
+  - "**/*-runtime.js"
+  - "**/*.test.ts"
+  - "**/*.test.tsx"
+  - "**/*.e2e.test.ts"
+  - "**/*.e2e.test.tsx"
+  - "**/*test-support*"
+  - "**/*test-helper*"
+  - "**/*mock*"
+  - "**/*fixture*"
+  - "**/*bench*"

.github/codeql/codeql-web-media-runtime-boundary-critical-quality.yml

@@ -0,0 +1,39 @@
+name: openclaw-codeql-web-media-runtime-boundary-critical-quality
+
+disable-default-queries: true
+
+queries:
+  - uses: security-and-quality
+
+query-filters:
+  - include:
+      problem.severity:
+        - error
+  - exclude:
+      tags:
+        - security
+
+paths:
+  - src/web-fetch
+  - src/web-search
+  - packages/web-content-core/src/provider-runtime-shared.ts
+  - src/media
+  - src/media-understanding
+  - src/image-generation
+  - src/media-generation
+
+paths-ignore:
+  - "**/node_modules"
+  - "**/coverage"
+  - "**/*.generated.ts"
+  - "**/*.bundle.js"
+  - "**/*-runtime.js"
+  - "**/*.test.ts"
+  - "**/*.test.tsx"
+  - "**/*.e2e.test.ts"
+  - "**/*.e2e.test.tsx"
+  - "**/*test-support*"
+  - "**/*test-helper*"
+  - "**/*mock*"
+  - "**/*fixture*"
+  - "**/*bench*"

.github/codeql/openclaw-boundary/codeql-pack.lock.yml

@@ -0,0 +1,30 @@
+---
+lockVersion: 1.0.0
+dependencies:
+  codeql/concepts:
+    version: 0.0.22
+  codeql/controlflow:
+    version: 2.0.32
+  codeql/dataflow:
+    version: 2.1.4
+  codeql/javascript-all:
+    version: 2.6.28
+  codeql/mad:
+    version: 1.0.48
+  codeql/regex:
+    version: 1.0.48
+  codeql/ssa:
+    version: 2.0.24
+  codeql/threat-models:
+    version: 1.0.48
+  codeql/tutorial:
+    version: 1.0.48
+  codeql/typetracking:
+    version: 2.0.32
+  codeql/util:
+    version: 2.0.35
+  codeql/xml:
+    version: 1.0.48
+  codeql/yaml:
+    version: 1.0.48
+compiled: false

.github/codeql/openclaw-boundary/qlpack.yml

@@ -0,0 +1,6 @@
+name: openclaw/codeql-boundary-queries
+version: 0.0.0
+library: false
+dependencies:
+  codeql/javascript-all: 2.6.28
+extractor: javascript

.github/codeql/openclaw-boundary/queries/managed-proxy-runtime-mutation.ql

@@ -0,0 +1,325 @@
+/**
+ * @name Managed proxy runtime mutation
+ * @description Proxy-related process.env and GLOBAL_AGENT runtime mutations must stay in managed proxy owner scopes.
+ * @kind problem
+ * @problem.severity error
+ * @precision high
+ * @id js/openclaw/managed-proxy-runtime-mutation
+ * @tags maintainability
+ *       security
+ *       external/cwe/cwe-441
+ */
+
+import javascript
+
+predicate forbiddenEnvKey(string key) {
+  key =
+    [
+      "HTTP_PROXY",
+      "HTTPS_PROXY",
+      "http_proxy",
+      "https_proxy",
+      "NO_PROXY",
+      "no_proxy",
+      "GLOBAL_AGENT_HTTP_PROXY",
+      "GLOBAL_AGENT_HTTPS_PROXY",
+      "GLOBAL_AGENT_NO_PROXY",
+      "GLOBAL_AGENT_FORCE_GLOBAL_AGENT",
+      "OPENCLAW_PROXY_ACTIVE",
+      "OPENCLAW_PROXY_LOOPBACK_MODE"
+    ]
+}
+
+predicate forbiddenGlobalAgentKey(string key) { key = ["HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY"] }
+
+predicate relevantSourceFile(File file) {
+  exists(string path |
+    path = file.getRelativePath() and
+    path.regexpMatch("^(src|extensions)/.*\\.(ts|mts|js|mjs)$") and
+    not path.regexpMatch(".*\\.(test|spec)\\.(ts|mts|js|mjs)$") and
+    not path.regexpMatch(".*\\.(test-utils|test-harness|e2e-harness)\\.ts$") and
+    not path.regexpMatch(".*/test-support/.*") and
+    not path.regexpMatch(".*/vendor/.*") and
+    not path.regexpMatch(".*\\.min\\.js$") and
+    not path.regexpMatch("^extensions/diffs/assets/.*")
+  )
+}
+
+predicate namedExpr(Expr expr, string name) {
+  expr.getUnderlyingValue().(Identifier).getName() = name
+}
+
+predicate directProcessEnvExpr(Expr expr) {
+  exists(PropAccess access |
+    expr.getUnderlyingValue() = access and
+    access.getPropertyName() = "env" and
+    namedExpr(access.getBase(), "process")
+  )
+}
+
+predicate envAlias(Variable variable) {
+  exists(VariableDeclarator decl |
+    decl.getBindingPattern().getAVariable() = variable and
+    directProcessEnvExpr(decl.getInit())
+  )
+  or
+  exists(VariableDeclarator decl, ObjectPattern pattern, PropertyPattern property |
+    decl.getBindingPattern() = pattern and
+    namedExpr(decl.getInit(), "process") and
+    property = pattern.getAPropertyPattern() and
+    property.getName() = "env" and
+    property.getValuePattern().(BindingPattern).getAVariable() = variable
+  )
+}
+
+predicate processEnvExpr(Expr expr) {
+  directProcessEnvExpr(expr)
+  or
+  exists(VarAccess access |
+    expr.getUnderlyingValue() = access and
+    envAlias(access.getVariable())
+  )
+}
+
+predicate stringConst(Variable variable, string value) {
+  exists(VariableDeclarator decl |
+    decl.getBindingPattern().getAVariable() = variable and
+    value = decl.getInit().getStringValue()
+  )
+}
+
+predicate stringArrayContains(Variable variable, string value) {
+  exists(VariableDeclarator decl, ArrayExpr array, Expr element |
+    decl.getBindingPattern().getAVariable() = variable and
+    decl.getInit().getUnderlyingValue() = array and
+    element = array.getAnElement().getUnderlyingValue() and
+    value = element.getStringValue()
+  )
+  or
+  exists(VariableDeclarator decl, ArrayExpr array, SpreadElement spread, VarAccess access |
+    decl.getBindingPattern().getAVariable() = variable and
+    decl.getInit().getUnderlyingValue() = array and
+    spread = array.getAnElement().getUnderlyingValue() and
+    spread.getOperand().getUnderlyingValue() = access and
+    stringArrayContains(access.getVariable(), value)
+  )
+}
+
+predicate forbiddenEnvLoopVariable(Variable variable) {
+  exists(ForOfStmt loop, VarAccess domain, string key |
+    variable = loop.getAnIterationVariable() and
+    loop.getIterationDomain().getUnderlyingValue() = domain and
+    stringArrayContains(domain.getVariable(), key) and
+    forbiddenEnvKey(key)
+  )
+}
+
+predicate envKeyExprForbidden(Expr keyExpr) {
+  forbiddenEnvKey(keyExpr.getStringValue())
+  or
+  exists(VarAccess access, string key |
+    keyExpr.getUnderlyingValue() = access and
+    stringConst(access.getVariable(), key) and
+    forbiddenEnvKey(key)
+  )
+  or
+  exists(VarAccess access |
+    keyExpr.getUnderlyingValue() = access and
+    forbiddenEnvLoopVariable(access.getVariable())
+  )
+}
+
+predicate globalAgentKeyExprForbidden(Expr keyExpr) {
+  forbiddenGlobalAgentKey(keyExpr.getStringValue())
+  or
+  exists(VarAccess access, string key |
+    keyExpr.getUnderlyingValue() = access and
+    stringConst(access.getVariable(), key) and
+    forbiddenGlobalAgentKey(key)
+  )
+}
+
+predicate directGlobalExpr(Expr expr) {
+  namedExpr(expr, "global")
+  or
+  namedExpr(expr, "globalThis")
+}
+
+predicate globalAlias(Variable variable) {
+  exists(VariableDeclarator decl |
+    decl.getBindingPattern().getAVariable() = variable and
+    directGlobalExpr(decl.getInit())
+  )
+}
+
+predicate globalExpr(Expr expr) {
+  directGlobalExpr(expr)
+  or
+  exists(VarAccess access |
+    expr.getUnderlyingValue() = access and
+    globalAlias(access.getVariable())
+  )
+}
+
+predicate directGlobalAgentExpr(Expr expr) {
+  exists(PropAccess access |
+    expr.getUnderlyingValue() = access and
+    access.getPropertyName() = "GLOBAL_AGENT" and
+    globalExpr(access.getBase())
+  )
+}
+
+predicate globalAgentAlias(Variable variable) {
+  exists(VariableDeclarator decl |
+    decl.getBindingPattern().getAVariable() = variable and
+    directGlobalAgentExpr(decl.getInit())
+  )
+}
+
+predicate globalAgentExpr(Expr expr) {
+  directGlobalAgentExpr(expr)
+  or
+  exists(VarAccess access |
+    expr.getUnderlyingValue() = access and
+    globalAgentAlias(access.getVariable())
+  )
+}
+
+predicate envMutationTarget(Expr target) {
+  exists(PropAccess access |
+    target.getUnderlyingReference() = access and
+    processEnvExpr(access.getBase()) and
+    (
+      forbiddenEnvKey(access.getPropertyName())
+      or
+      envKeyExprForbidden(access.getPropertyNameExpr())
+    )
+  )
+}
+
+predicate globalAgentMutationTarget(Expr target) {
+  globalAgentExpr(target)
+  or
+  exists(PropAccess access |
+    target.getUnderlyingReference() = access and
+    globalAgentExpr(access.getBase()) and
+    (
+      forbiddenGlobalAgentKey(access.getPropertyName())
+      or
+      globalAgentKeyExprForbidden(access.getPropertyNameExpr())
+    )
+  )
+}
+
+predicate objectPropertyWithKey(Expr expr, string key) {
+  exists(ObjectExpr object, Property property |
+    expr.getUnderlyingValue() = object and
+    property = object.getAProperty() and
+    property.getName() = key
+  )
+}
+
+Expr managedProxyRuntimeMutation() {
+  exists(Assignment assignment |
+    result = assignment and
+    (
+      envMutationTarget(assignment.getTarget())
+      or
+      globalAgentMutationTarget(assignment.getTarget())
+    )
+  )
+  or
+  exists(DeleteExpr delete |
+    result = delete and
+    (
+      envMutationTarget(delete.getOperand())
+      or
+      globalAgentMutationTarget(delete.getOperand())
+    )
+  )
+  or
+  exists(MethodCallExpr call |
+    result = call and
+    namedExpr(call.getReceiver(), "Object") and
+    call.getMethodName() = "assign" and
+    (
+      processEnvExpr(call.getArgument(0)) and
+      exists(string key |
+        forbiddenEnvKey(key) and
+        objectPropertyWithKey(call.getArgument(1), key)
+      )
+      or
+      globalAgentExpr(call.getArgument(0)) and
+      exists(string key |
+        forbiddenGlobalAgentKey(key) and
+        objectPropertyWithKey(call.getArgument(1), key)
+      )
+    )
+  )
+  or
+  exists(MethodCallExpr call |
+    result = call and
+    namedExpr(call.getReceiver(), "Object") and
+    call.getMethodName() = "defineProperty" and
+    (
+      processEnvExpr(call.getArgument(0)) and
+      envKeyExprForbidden(call.getArgument(1))
+      or
+      globalAgentExpr(call.getArgument(0)) and
+      globalAgentKeyExprForbidden(call.getArgument(1))
+    )
+  )
+}
+
+predicate allowedFunctionOwnerScope(Expr mutation, string path, string functionName) {
+  exists(Function owner |
+    mutation.getFile().getRelativePath() = path and
+    owner.getFile() = mutation.getFile() and
+    owner.getName() = functionName and
+    mutation.getParent*() = owner.getBody()
+  )
+}
+
+predicate allowedMethodOwnerScope(Expr mutation, string path, string methodName) {
+  exists(MethodDeclaration method |
+    mutation.getFile().getRelativePath() = path and
+    method.getFile() = mutation.getFile() and
+    method.getDeclaringType().getName() + "." + method.getName() = methodName and
+    mutation.getParent*() = method.getBody().getBody()
+  )
+}
+
+predicate allowedManagedProxyRuntimeMutation(Expr mutation) {
+  allowedFunctionOwnerScope(mutation, "src/infra/net/proxy/proxy-lifecycle.ts", "applyProxyEnv")
+  or
+  allowedFunctionOwnerScope(mutation, "src/infra/net/proxy/proxy-lifecycle.ts", "restoreProxyEnv")
+  or
+  allowedFunctionOwnerScope(mutation, "src/infra/net/proxy/proxy-lifecycle.ts",
+    "restoreGlobalAgentRuntime")
+  or
+  allowedFunctionOwnerScope(mutation, "src/infra/net/proxy/proxy-lifecycle.ts",
+    "restoreNodeHttpStack")
+  or
+  allowedFunctionOwnerScope(mutation, "src/infra/net/proxy/proxy-lifecycle.ts",
+    "bootstrapNodeHttpStack")
+  or
+  allowedFunctionOwnerScope(mutation, "src/infra/net/proxy/proxy-lifecycle.ts",
+    "writeGlobalAgentNoProxy")
+  or
+  allowedFunctionOwnerScope(mutation, "src/infra/net/proxy/proxy-lifecycle.ts",
+    "disableGlobalAgentProxyForIpv6GatewayLoopback")
+  or
+  allowedMethodOwnerScope(mutation, "extensions/browser/src/browser/cdp-proxy-bypass.ts",
+    "NoProxyLeaseManager.acquire")
+  or
+  allowedMethodOwnerScope(mutation, "extensions/browser/src/browser/cdp-proxy-bypass.ts",
+    "NoProxyLeaseManager.release")
+}
+
+from Expr mutation
+where
+  managedProxyRuntimeMutation() = mutation and
+  relevantSourceFile(mutation.getFile()) and
+  not allowedManagedProxyRuntimeMutation(mutation)
+select mutation,
+  "Only managed proxy owner scopes may mutate proxy-related process.env or GLOBAL_AGENT runtime state."

.github/codeql/openclaw-boundary/queries/raw-socket-callsite-classification.ql

@@ -0,0 +1,94 @@
+/**
+ * @name Raw socket client callsite classification
+ * @description Raw net/tls/http2 client egress must be classified before landing.
+ * @kind problem
+ * @problem.severity error
+ * @precision high
+ * @id js/openclaw/raw-socket-callsite-classification
+ * @tags maintainability
+ *       security
+ *       external/cwe/cwe-441
+ */
+
+import javascript
+
+predicate rawModule(string moduleName) {
+  moduleName = ["net", "node:net", "tls", "node:tls", "http2", "node:http2"]
+}
+
+predicate netModule(string moduleName) { moduleName = ["net", "node:net"] }
+
+predicate rawConnectMember(string memberName) { memberName = ["connect", "createConnection"] }
+
+predicate relevantSourceFile(File file) {
+  exists(string path |
+    path = file.getRelativePath() and
+    path.regexpMatch("^(src|extensions)/.*\\.ts$") and
+    not path.regexpMatch(".*\\.(test|spec|test-utils|test-harness|e2e-harness)\\.ts$") and
+    not path.regexpMatch(".*/test-support/.*") and
+    not path.regexpMatch("^extensions/diffs/assets/.*")
+  )
+}
+
+Expr rawSocketClientCall() {
+  exists(API::CallNode call, string moduleName, string memberName |
+    rawModule(moduleName) and
+    rawConnectMember(memberName) and
+    call = API::moduleImport(moduleName).getMember(memberName).getACall() and
+    result = call.asExpr()
+  )
+  or
+  exists(string moduleName |
+    netModule(moduleName) and
+    result =
+      DataFlow::moduleMember(moduleName, "Socket")
+          .getAnInstantiation()
+          .getAMethodCall("connect")
+          .asExpr()
+  )
+}
+
+predicate allowedOwnerScope(Expr call, string path, string functionName) {
+  exists(Function owner |
+    call.getFile().getRelativePath() = path and
+    owner.getFile() = call.getFile() and
+    owner.getName() = functionName and
+    call.getParent*() = owner.getBody()
+  )
+}
+
+predicate allowedRawSocketClientCall(Expr call) {
+  allowedOwnerScope(call, "src/cli/gateway-cli/run-loop.ts", "waitForGatewayPortReady")
+  or
+  allowedOwnerScope(call, "src/infra/ssh-tunnel.ts", "canConnectLocal")
+  or
+  allowedOwnerScope(call, "src/infra/gateway-lock.ts", "checkPortFree")
+  or
+  allowedOwnerScope(call, "src/infra/jsonl-socket.ts", "requestJsonlSocketWithMaxLineBytes")
+  or
+  allowedOwnerScope(call, "src/infra/net/http-connect-tunnel.ts", "connectToProxy")
+  or
+  allowedOwnerScope(call, "src/infra/net/http-connect-tunnel.ts", "startTargetTls")
+  or
+  allowedOwnerScope(call, "src/infra/push-apns-http2.ts", "openProxiedApnsHttp2Session")
+  or
+  allowedOwnerScope(call, "src/infra/push-apns-http2.ts", "connectApnsHttp2Session")
+  or
+  allowedOwnerScope(call, "src/proxy-capture/proxy-server.ts", "startDebugProxyServer")
+  or
+  allowedOwnerScope(call, "extensions/codex-supervisor/src/json-rpc-client.ts", "connectCodexSupervisorUnixSocket")
+  or
+  allowedOwnerScope(call, "extensions/irc/src/client.ts", "connectIrcClient")
+  or
+  allowedOwnerScope(call, "extensions/qa-lab/src/lab-server-capture.ts", "probeTcpReachability")
+  or
+  allowedOwnerScope(call, "extensions/qa-lab/src/lab-server-ui.ts", "proxyUpgradeRequest")
+}
+
+from Expr call
+where
+  rawSocketClientCall() = call and
+  relevantSourceFile(call.getFile()) and
+  not allowedRawSocketClientCall(call)
+select call,
+  "Classify raw net/tls/http2 client egress as managed/proxied, local-only, diagnostic guarded, or documented unsupported before adding this callsite."