v0.7.85 — Security & correctness hardening

⚠️ SUPERSEDED by v0.7.86. This tag has two known issues fixed in v0.7.86: a Windows-only absolute-path-denial gap (sandbox-less file tools could read rooted paths) and the quinn-proto RUSTSEC-2026-0185 advisory. Use v0.7.86.

v0.7.85 — Security & correctness hardening

Two adversarial audit sweeps over v0.7.84 (each finding gated behind a 3-vote
independent refute panel) plus a prior deep-verify batch. 84 verifier-confirmed
bug fixes (21 HIGH). 1748 tests passing, clippy clean, cargo fmt clean.

⚠️ Breaking

• RHP wire PROTOCOL_VERSION 1 → 2. The P2P handshake HMAC now signs a
  length-framed (nonce, node_id, timestamp) payload (was nonce + node_id)
  and the receiver enforces a freshness window + seen-nonce cache to reject
  replays. P2P federation peers must all run ≥ 0.7.85 — v1 peers are
  rejected with VersionMismatch. Single-node and non-federation deployments
  are unaffected.

Security

• SSRF: the pre-flight check is no longer bypassable via HTTP redirect — the
  web-fetch/browser clients re-validate every redirect hop against the SSRF
  rules, and the resolver now fails closed on DNS-resolution error (was
  fail-open). WASM net_fetch SSRF parity; symlink-safe file copy; secret
  newline-injection guard.
• RHP P2P: replay-proof handshake (above) + pre-auth DoS hardening — bounded
  pre-auth reads (no up-front allocation of the attacker-declared frame length),
  read/connect timeouts, and a concurrent-connection cap.
• WASM sandbox: shell_exec now scrubs the environment (no more leaking the
  daemon's provider keys / vault / OAuth tokens), runs under a timeout, caps
  output, and enforces the operator's ExecSecurityMode; net_fetch caps the
  response body.
• Supply-chain: ClawHub slug and CLI skill install name are validated as a
  single safe path component (was arbitrary file write/overwrite, e.g. into
  ~/.ssh); native skill.toml prompt_context is now scanned for injection;
  allowlist exec mode fails closed on shell metacharacters; manifest signing uses
  an honest trust model with trust-anchored verification.
• CLI: secrets are no longer echoed to the terminal during entry.

Correctness

• Streaming UTF-8 corruption in the Anthropic/OpenAI SSE decoders fixed —
  multi-byte characters (Cyrillic/CJK/emoji) split across TCP chunk boundaries
  were silently mangled in both streamed deltas and the persisted message.
• UTF-8 panics removed in html_to_markdown (a remote DoS via any fetched
  page) and the session compactor.
• LLM retry now honors the transient-error classifier (5xx / network errors
  were computed-as-retryable but never retried).
• Loop guard outcome-aware blocking and poll backoff are now actually wired
  into the agent loop (was dead code).
• apply_patch: pure-insertion hunks anchor on trailing context instead of
  always appending at EOF; CRLF line endings are preserved (no silent LF
  rewrite); files_moved is counted once after a successful move.
• MCP tool failures (isError) now propagate as errors; vector recall no
  longer silently degrades to recency order on an embedding-dimension change.

DoS / resource limits

• Fixed an infinite loop in doc_ingest chunking (chunk_size=0); leaked SSE
  poller tasks on client disconnect; unbounded reads in file_read, media
  tools, MCP stdio/SSE, A2A, the Python runtime, marketplace/ClawHub downloads,
  and provider health probes; added entry/eviction bounds to WebCache and the
  A2A task store; enforced global + per-agent cost quotas.

Verification

• cargo build --workspace ✓ · cargo test --workspace → 1748 passing, 0 failed ✓
• cargo clippy --workspace --all-targets -- -D warnings → 0 warnings ✓
• cargo fmt --check ✓

Note: a third audit sweep (API auth/IDOR, channels, kernel scheduler/RBAC/
workflows) surfaced further candidate findings still pending verification; those
will land in a follow-up release.