Fix all 7 issues identified in the ChatGPT audit of transformation work:
1. Android build break: Remove duplicate normalizeMainKey/isCanonicalMainSessionKey
from NodeGatewaySync.kt (they're already in SessionKey.kt). Align both Android
and iOS implementations to use "main" as canonical (case-insensitive match).
2. Rate limiting: Wire rateLimiter through GatewayRequestContext and enforce:
- Auth failure backoff (recordAuthFailure on auth failure, clearAuthFailure on success)
- Request rate limiting before handleGatewayRequest
- Channel message rate limiting in send handler
- Add TOO_MANY_REQUESTS error code
3. Injection defenses: Call sanitizeIncomingMessage in chat.send and chat.inject
handlers to detect prompt injection attempts.
4. RBAC enforcement: Add canAccessAgent check in chat.send handler and
canExecuteCommand check in node-host runner for exec commands.
5. WhatsApp encrypted backup restore: Update maybeRestoreCredsFromBackup to
handle encrypted backup files (.bak.enc -> .json.enc restoration).
6. Exec blocklist bypass: Add evaluateBlocklist check in argv-only code path
in runner.ts (previously only checked for rawCommand path).
7. iOS voice transcript: Fix line 329 in NodeAppModel.swift to use computed
'key' variable instead of original 'sessionKey' parameter.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Disable Talk mode start on iOS simulator (no audio input)
- Validate audio input format before installing tap to avoid
AVFAudio assertion crashes on misconfigured devices.
Tested:
- Launched app on iOS simulator and tapping Talk no longer crashes
(shows error path instead).
Applies the same Swift 6 compatibility patterns from PR #166 (macOS) to the iOS app.
Changes:
- LocationService.swift: Added Sendable constraint to withTimeout<T> generic,
made CLLocationManagerDelegate methods nonisolated with Task { @MainActor in }
pattern to safely access MainActor state
- TalkModeManager.swift: Fixed OSLog string interpolation to avoid operator
overload issues with OSLogMessage in Swift 6
Addresses #164
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Replace app icons with new Clawdbot branding (lobster-in-phone-booth design) across iOS, Android, and macOS.
Changes:
- iOS: Updated all 14 icon sizes in AppIcon.appiconset (20px to 1024px)
- Android: Updated launcher icons for all density buckets (mdpi to xxxhdpi)
- macOS: Updated Icon.icon bundle and regenerated Clawdbot.icns
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
