Garry Tan 12b29c7518 merge: origin/main into garrytan/injection-tuning; bump v1.5.2.0 → v1.6.2.0 ...

Main shipped v1.6.0.0 (security tunnel dual-listener + SSRF + envelope wave) and v1.6.1.0 (Opus 4.7 migration) while this branch was developing injection-tuning. Merging to keep the branch in sync.

CHANGELOG: reverse-chronological order preserved — v1.6.1.0 > v1.6.0.0 > v1.5.2.0 (our branch entry) > v1.5.1.0 > ...
VERSION: bumped to 1.6.2.0 per CLAUDE.md "branch always ahead of main after merge" discipline.
package.json: synced to 1.6.2.0.

Auto-merged: 58+ files (skill docs regenerated from .tmpl changes, routing injection, preamble resolvers). No real conflicts in security-related source files.

Security test suite: 231 pass, 1 skip, 0 fail post-merge. Detection/FP numbers unchanged (56.2% / 22.9%).

2026-04-22 17:00:33 -07:00

..

designs

feat(security): ML prompt injection defense for sidebar (v1.4.0.0) (#1089)

2026-04-20 22:18:37 +08:00

evals

test(security): live + fixture-replay bench harness with 500-case capture

2026-04-21 20:32:15 -07:00

images

feat: Completeness Principle — Boil the Lake (v0.6.1) (#140)

2026-03-17 16:34:08 -05:00

ADDING_A_HOST.md

feat: declarative multi-host platform + OpenCode, Slate, Cursor, OpenClaw (v0.15.5.0) (#793)

2026-04-04 15:32:20 -07:00

ON_THE_LOC_CONTROVERSY.md

feat: gstack v1 — simpler prompts + real LOC receipts (v1.0.0.0) (#1039)

2026-04-18 15:05:42 +08:00

OPENCLAW.md

feat: native OpenClaw skills + ClaHub publishing (v0.15.10.0) (#832)

2026-04-05 10:07:03 -07:00

REMOTE_BROWSER_ACCESS.md

security: tunnel dual-listener + SSRF + envelope + path wave (v1.6.0.0) (#1137)

2026-04-21 21:58:27 -07:00

skills.md

feat(security): ML prompt injection defense for sidebar (v1.4.0.0) (#1089)

2026-04-20 22:18:37 +08:00