From 98c7ea5d0d5a479e74cae333eabf5cbfaa2d789b Mon Sep 17 00:00:00 2001
From: AlexAlves87 <alexalves87@github.com>
Date: Wed, 8 Apr 2026 16:34:46 +0200
Subject: [PATCH 1/2] chore: gitignore internal fork workflow files

---
 .gitignore | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/.gitignore b/.gitignore
index 6b3d49e7..b42ef02c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -344,3 +344,24 @@ MigrationBackup/
 # Fody - auto-generated XML schema
 FodyWeavers.xsd
 Output/
+
+# Internal fork workflow docs — never reach upstream PRs
+CLAUDE.md
+AGENTS.md
+STYLE.md
+docs/PR_WORKFLOW.md
+docs/CONTRIBUTING.md
+PLAN_*.md
+
+# Internal scratch and analysis files
+diff.txt
+merge-analysis.txt
+*.diff
+pr*.txt
+
+# Development diary — private, never reaches upstream
+DIARY.md
+
+# Internal tooling state
+.claude/
+.serena/

From 6277a919a3f40edffdc7745b73a176b2e77fdb3f Mon Sep 17 00:00:00 2001
From: AlexAlves87 <alexalves87@github.com>
Date: Sun, 26 Apr 2026 15:03:38 +0200
Subject: [PATCH 2/2] eng: add root NuGet.Config with package source mapping

Without a root-level NuGet.Config, machine-level or user-level feeds
could accidentally resolve packages, opening a dependency confusion
vector. The <clear /> + packageSourceMapping locks all resolution
exclusively to nuget.org.

Mirrors the pattern already in src/OpenClaw.CommandPalette/nuget.config.
OpenClaw.CommandPalette is unaffected (its local config also has <clear />).

Closes #214.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 NuGet.Config | 12 ++++++++++++
 1 file changed, 12 insertions(+)
 create mode 100644 NuGet.Config

diff --git a/NuGet.Config b/NuGet.Config
new file mode 100644
index 00000000..4e800bf6
--- /dev/null
+++ b/NuGet.Config
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="utf-8"?>
+<configuration>
+  <packageSources>
+    <clear />
+    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
+  </packageSources>
+  <packageSourceMapping>
+    <packageSource key="nuget.org">
+      <package pattern="*" />
+    </packageSource>
+  </packageSourceMapping>
+</configuration>