ZeroClaw
ZeroClaw makes action budgets atomic across hostile delivery edges
ZeroClaw proposes atomic action-budget accounting, hardened webhook audit exports and bounded QQ and Mattermost downloads. Together the changes close three places where concurrency, exported evidence or remote payload size can outrun policy.
zeroclaw-labs/zeroclaw PR #9996 is the inspected primary source: “fix(security): make action budget accounting atomic.” The related records below were inspected as supporting context rather than independent confirmation.
The facts
- zeroclaw-labs/zeroclaw PR #9996 was created 2026-08-14T16:20:10Z and was open at inspection; its title is “fix(security): make action budget accounting atomic.” - zeroclaw-labs/zeroclaw PR #9995 was created 2026-08-14T16:01:55Z and was open at inspection; its title is “fix(hooks): harden webhook audit exports.” - zeroclaw-labs/zeroclaw PR #10000 was created 2026-08-14T17:43:12Z and was open at inspection; its title is “fix(channels): bound QQ and Mattermost downloads.” - The repository reported 32582 stars, 705 open issues, default branch master, and last push 2026-08-14T18:41:42Z. - The latest tagged-release baseline checked was v0.8.4 published 2026-08-02T21:00:00Z.
What changed
zeroclaw-labs/zeroclaw PR #9996 reports: Summary **Base branch:** master **What changed and why:** Reserve sender-scoped action-budget capacity atomically before a wrapped tool enters its side-effect boundary, so parallel calls cannot jointly exceed max_actions_per_hour. Commit one action only after a successful result and release the reservation on rejection, failure, error, cancellation, or panic. Keep autonomy authorization in the five coding-agent adapters while making RateLimitedTool the sole accounting owner for wrapped tools, preventing one successful call from being charged twice. **Scope boundary:** This does not change action-budget configuration, autonomy modes, tool permissions, or the one-hour accounting window. Direct unwrapped accounting keeps the same configured limit value, but rejected attempts no longer append a timestamp, and both record_action admission and is_rate_limited now count in-flight wrapper reservations. This does not add global eager cleanup of every expired sender bucket. **Blast radius:** Shared action accounting in zeroclaw-config; all tools registered behind RateLimitedTool; the Claude Code, Claude Code runner, Codex CLI, Gemini CLI, and OpenCode CLI adapters; and already-wrapped file read, file delivery, and image-info consumers. **Linked issue(s):** Closes #9594. Closes #9849. **Labels:** bug, config, domain:security, follow-up, risk:high, runtime, security:policy, size:L, tool, tool:file What this does, simply ZeroClaw lets an operator put an hourly limit on an agent's tool actions. Once the allowance is used, another action should not be able
zeroclaw-labs/zeroclaw PR #9995 reports: Summary **Base branch:** master **What changed and why:** Scrub common credentials, provider-token patterns, and recognized inline image markers from webhook audit arguments before applying the configured byte limit. Preserve JSON structure while carrying sensitive-key context through nested objects and arrays, so credentials are not exposed merely because they sit inside a container. Return configuration errors from webhook audit construction instead of panicking on an invalid URL or warning and registering a hook with a missing URL, and disable only the invalid optional hook while preserving other built-ins. **Scope boundary:** This PR does not add shared egress-guard integration, change tool-call correlation, alter glob matching, or redefine the argument-size limit. **Blast radius:** Webhook audit payload preparation, shared structured credential scrubbing used by SOP output data, optional hook startup, and webhook audit config schema wording. **Linked issue(s):** None. **Labels:** bug, risk:high, size:M, agent, runtime, config, domain:security What this does, simply ZeroClaw can optionally send audit records about tool use to another service. When those records include tool inputs, they can also contain passwords, API keys, or inline image data. Previously, the export path did not reliably remove that data before shortening and sending the record. Nested objects and lists could also hide that a child value belonged to a sensitive field. A malformed
zeroclaw-labs/zeroclaw PR #10000 reports: Summary **Base branch:** master **What changed and why:** Add one shared bounded HTTP response reader, use QQ's existing 10 MiB media limit for inbound attachment downloads, and enforce Mattermost's existing 25 MiB audio limit even when Content-Length is missing or dishonest. **Scope boundary:** This does not change configuration, transcription providers, outbound uploads, Email or Telegram handling, or the broader attachment architecture. **Blast radius:** QQ attachments saved into the workspace and Mattermost audio downloaded for transcription. Responses at the limit remain accepted; oversized responses are rejected before persistence or transcription. **Linked issue(s):** Related #9488 What this does, simply QQ and Mattermost download attachments from messaging servers before ZeroClaw can save or transcribe them. Previously, QQ collected the complete response without enforcing its attachment limit, while Mattermost relied on the server's declared size and collected the complete response when that header was absent. A server could therefore make ZeroClaw hold an unexpectedly large response in memory. This PR reads each response in chunks and stops as soon as the applicable limit would be crossed. QQ writes to the workspace only after the complete attachment stays within 10 MiB; Mattermost sends audio to transcription only after the complete body stays within 25 MiB. Oversized responses and response-read errors remain non-fatal to the channel
Why it matters
A budget checked outside its mutation boundary can be overspent concurrently. Audit exports and channel downloads also need explicit size and trust limits or policy becomes advisory under load. The operator test is whether the system remains bounded and its receipts still describe the action after failure, retry or restart.
Current
The primary record was open when captured on 2026-08-15. The tagged-release baseline was v0.8.4 published 2026-08-02T21:00:00Z. Repository metadata, full source bodies, current pull requests and issues, releases, Google News, Hacker News, Lobsters, Metamesh and the rendered ClawCharts row were inspected. ClawCharts selected the subject; it did not prove the claim.
Evidence
The primary URL is https://github.com/zeroclaw-labs/zeroclaw/pull/9996. Supporting records are https://github.com/zeroclaw-labs/zeroclaw/pull/9995 and https://github.com/zeroclaw-labs/zeroclaw/pull/10000. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts and reproductions remain attributed to their authors unless identified as independently rerun.
Source boundary
Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.
Operator take
Make reservation and spend one transaction, sanitize exported audit material, and enforce byte and time ceilings before remote content reaches memory or disk. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently.
Caveat
Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.
Source inspected; source state, environment and release boundary remain explicit.