- New ai.openclaw.tool package: Tool interface, ToolResult, CodeExecutionTool
- CodeExecutionTool runs shell commands via ProcessBuilder with timeout
- LlmResponse structured response type for Anthropic content blocks
- LlmProvider.completeWithTools() for tool-use API integration
- AnthropicProvider supports full Anthropic tool-use protocol
- AgentExecutor agentic loop: call LLM -> execute tools -> loop (max 10)
- Message extended with toolUseId, toolError, contentBlocks fields
- System prompt updated with code execution instructions
- 5 new unit tests for CodeExecutionTool

New tools:
- FileReadTool: reads files, lists directories
- FileWriteTool: writes/creates files with auto-created dirs
- WebSearchTool: fetches URLs, strips HTML to text

Infrastructure:
- Dockerfile: multi-stage build (Gradle 8 + JDK 21 → Alpine JRE)
- .github/workflows/ci.yml: build+test + Docker build verification
- .dockerignore: excludes build artifacts from Docker context

Tests:
- FileReadToolTest: 4 tests (read, missing, directory, metadata)
- FileWriteToolTest: 4 tests (create, nested dirs, overwrite, metadata)
- WebSearchToolTest: 4 tests (strip HTML, scripts, invalid URL, metadata)

…ol message persistence

- AnthropicProvider: merge consecutive tool_result messages into a single
  user message with multiple content blocks (Anthropic API requirement)
- FileReadTool: close Files.list() stream with try-with-resources to
  prevent file descriptor leak on directory listings
- GatewayE2ETest: use random available port instead of hardcoded 18790
  to prevent BindException when tests run in quick succession
- AgentExecutor: persist intermediate tool messages (assistant_tool_use
  and tool_result) via sessionStore.appendMessage() so they survive
  process restarts and session replay is complete

Docker:
- Run as non-root 'openclaw' user with dedicated /home/openclaw/workspace
- Install bash/curl for tool execution

Tool confinement:
- CodeExecutionTool: default working directory changed to ~/workspace
- FileReadTool: workspace-confined with path normalization validation,
  rejects paths outside workspace root (../escape and absolute paths)
- FileWriteTool: same workspace confinement as FileReadTool
- FileReadTool: large file read now uses bounded BufferedReader instead
  of Files.readString() to prevent OOM on multi-GB files

Tests (22 total):
- FileReadToolTest: 7 tests (read, relative, missing, dir, path escape,
  absolute outside, metadata)
- FileWriteToolTest: 6 tests (create, dirs, overwrite, path escape,
  absolute outside, metadata)
- CodeExecutionToolTest: uses explicit temp dir for working directory

- CodeExecutionTool: replace StringBuilder with StringBuffer for the
  shared output buffer accessed by both main and reader threads
- Use untimed readerThread.join() in non-timeout path to guarantee
  the reader finishes before accessing the buffer

The regex now matches -r anywhere in a combined flag group, not just as
a separate flag. Catches rm -fr /, rm -fir /, rm -fr * etc.
Added regression tests for these bypass variants.

- Validate URL before making request: resolve hostname to IP(s) and
  reject loopback, site-local (private), link-local (cloud metadata),
  any-local, and multicast addresses via InetAddress built-in checks
- Block non-http/https schemes (file://, ftp://, etc.)
- Disable redirect-following to prevent redirect-based bypass
- 6 new tests: loopback, localhost-by-name, cloud metadata (169.254.x.x),
  private ranges, non-HTTP schemes, public URL allowed