v5.17.2 - Security fixes (GHSA-jw52-p54c-w7hj, CodeQL, ClawScan)

GHSA-jw52-p54c-w7hj (Low): McpStreamableServer CORS reflection. The Streamable HTTP MCP transport reflected a localhost / 127.0.0.1 Origin on any bind interface, so on a 0.0.0.0 bind a local page could read GET /tools an

Security fixes

• GHSA-jw52-p54c-w7hj (Low): McpStreamableServer CORS reflection. The Streamable HTTP MCP transport reflected a localhost / 127.0.0.1 Origin on any bind interface, so on a 0.0.0.0 bind a local page could read GET /tools and GET /health cross-origin. The localhost Origin is now reflected only on loopback binds, matching the v5.15.2 fix for McpSseServer (GHSA-4pvg-m42h-c3x2). Reported by @mgjxwmxhn.
• Egress proxy upstream URL (CodeQL js/request-forgery). Upstream URLs are built from the operator's route origin; the agent only supplies the path and query.
• Key-file creation (CodeQL js/file-system-race). perpetual keygen claims both key files with an exclusive create before writing; bounded reads use a single file descriptor.
• ClawHub skill: Windows locking (SkillSpector / ClawScan). blackboard.py now uses the OS byte-range lock (msvcrt.locking) instead of a check-then-write marker. It is exclusive across processes and released automatically if the holder dies.
• ClawHub skill: unsigned grants (ClawScan). validate_token.py rejects unsigned grants and grants it cannot verify, and rejects malformed records instead of crashing.

Changed

• The scrubSecretEnv pattern is now grouped explicitly (CodeQL js/regex/missing-regexp-anchor); matching is unchanged.
• 4,190 tests across 43 suites.

Full details: CHANGELOG