Merge pull request #141 from telnyxpete/security-hardening

Merge branch 'main' into feat/39-structured-logging

feat: add URL-based task deep links and agent task links

feat: add task URL deep-linking and agent task links

fix: resolve cron calendar and auth regressions from open issues

fix: add OpenClaw 3.2 compatibility for spawn and gateway health

feat: upgrade local-mode virtual office and flight deck integration

Merge branch 'main' into feat/39-structured-logging

Merge pull request #138 from bhavikprit/feat/40-accessibility

fix: enable editing identity, sandbox, and tools in agent config UI (#148)

Fix XSS in memory-browser-panel

feat(#39): replace console.log/error/warn with structured client logger

feat(#40): improve frontend accessibility (WCAG 2.1 AA)

fix: stop gateway handshake retry spam and improve origin guidance (#131)

feat(#115): virtual office visualization for agents (#127)

feat: phase 1 workspace isolation across auth and core APIs (#112)

feat: improve agent config tab model editing and display

fix: task board SSE wiring, priority enum, webhook event, auto-advance, parallel broadcast (#73) (#89)

fix: deduplicate sessions by sessionId and add task edit modal (#86)

feat: add local mode auto-detection for no-gateway users (#83)

fix: correct model display logic in session details panel (#69)

feat: add GitHub Issues sync (Phase 1, Issue #58)

feat: add direct CLI integration for gateway-free tool connections

feat: add per-agent cost breakdown panel

fix: send jobId/jobName instead of command when triggering cron jobs

fix: scrub deployment-specific data from public repo

feat: add Docker support, session controls, model catalog, API rate limiting

fix: strict mode, test stubs, pagination counts, N+1 queries, CSP hardening

fix: add auth checks on all GET endpoints, timing-safe comparisons, and XSS sanitization

feat: initial open-source release