#clawtributors

1 messages · Page 3 of 1

neat elk
#

fixing now

modern kestrel
neat elk
#

thanks - i already pushed a fix

zenith stone
timber pilot
#

Hey! I submitted a small bug fix PR: https://github.com/openclaw/openclaw/pull/18737

I think this will help to have even a smoother setup experience with openclaw.

it fixes Gemini CLI OAuth for VPS/remote environments — when users paste a redirect URL from a different CLI run, it no longer fails with "OAuth state mismatch". Instead it falls back to using the PKCE verifier from the URL's state parameter (which is the verifier by design). Added tests, all CI checks pass.
Would appreciate a review when someone has a moment! Cheers, Richy from Bielefeld, Germany!

humble plume
#

Hi, I built clawmrades.ai https://github.com/vishaltandale00/Clawmrades and published a skill to https://clawhub.ai/vishaltandale00/clawmrades.

This is a network for clawborators to sign up to so that they are forced to review and triage issues as well. They ask the user to pick up tasks to either triage issues or review PR's and the clawmrades.ai backend uses these inputs to create a focused list of PR's for maintainers to review. Right now the main thing we need is more bots to join the network so we can scale the issue processing.

But long term I think we need to clawdbot's participation in managing the open claw repository as a requirement. At the very least if a bot wants to create an issue/PR (potentially noise) they need to spend some time doing some other work. @wide geyser Can you direct me with who is also working on this?

ripe dagger
#

well, time to fix those merge errors and open a PR :)

frail mortar
#

I (full time SWE) have opened my first openclaw PR: https://github.com/openclaw/openclaw/pull/20493

As I've heard it requested, the PR includes the verbatum prompt and plan that I used 🙂
The PR was also manually tested.

The PR adds the ability to specify a "compaction" model to use in addition to the primary model

sonic ermine
sonic ermine
sonic ermine
#

smart way to go about this

ripe dagger
#

And some formatting check doesn't pass

sonic ermine
#

if you find someone's failing test just fix it xD

ripe dagger
#

it was so much easier committing to my own projects... errors? push. bugs? push. merge errors? push --force

sonic ermine
ripe dagger
sonic ermine
#

nice anyways , i added a comment to update the greptile review , hopefully you solved it (5/5)

sonic ermine
#

dont go crazy but once a day and pray

ripe dagger
sonic ermine
#

apart from the sheer insanity there's a lot of cool and well thought out things for contributing to this 🙂

ripe dagger
#

100%

#

BTW, how do people get the clawborator tag? Amount of contributions?

sonic ermine
#

nice it updated , now you are at 4/5 , you do want a 5/5 , and fix whatever crazy comments the machine has

sonic ermine
#

basically just link your merged pr here and you'll get a pink name

ripe dagger
sonic ermine
#

truth : there's no secret sauce, just solve merge conflicts and be patient 🙂

sonic ermine
sharp cargo
#

ooh i'm so excited to become a clawborator i just fixed a huge bug. like this bug probably cost $1m across all openclaw users xd

#

i was looking at the initial commit like "is this an intentional operation to get people to waste tokens"

#

as in, with this patch, you will get cache hits! because, you are not getting cache hits right now.

#

haven't since commit bed8e7a. feels almost like that commit intentionally made it transfer $1m to anthropic

eternal flower
#

Hi all I am new here. Is this a good place to ask questions about dev setup? 🙂

split nexus
#

Sure

steep ridge
#

Hi all, just want to follow up on this. I'd like to understand if my approach of creating a new hook to capture all tools and their JSON schemas that an agent can use is the right one and if so, could i get it reviewed? (https://github.com/openclaw/openclaw/pull/18860)

For context, I am developing a plugin that would be able to block tools based on policies defined in a central control plane (server). This would be useful to update guardrail policies without rebooting openclaw, and to also share these policies between multiple gateway instances.

This plugin can work without knowing all the tools and schemas, but if I can get this data dynamically, then i can offer a much better UX when writing guardrail policies for specific tools.

foggy vapor
#

hey i have a question about the iOS node source code is available

#

I am trying to run openclaw on a fresh new iphone and there is a problem am having withe the node.js on ios😭

sharp cargo
#

i'm on a mission to kill cache invalidations

sonic ermine
sharp cargo
#

I mean honestly like

#

if you look at that commit

#

it's like ... why though?

sonic ermine
sharp cargo
#

i just opened another pr to stop cache invals when you touch memory / soul / bootstrap files

#

this one i expect to be harder to get in

#

the one i wrote first should be a slam dunk

sonic ermine
#

i mean i'll probably check out your branch or at least merge it because ... i hate waste

#

you'd be surprised how quickly both could be merged to be honest ... clearly a priority

sharp cargo
#

it's mind blowing to me when my agent can actually rock along at 70 tps and not take 3 minutes to get to first token

#

i just spent today's claude code credits on it

sonic ermine
#

wait ... @stable pewter has ascended to maintainer status

#

the lobsters thus commands us to beg for their attention

#

i mean "omg congrats val!!"

sharp cargo
stable pewter
crimson wren
#

PR #20304 is fully green and ready to merge.
It adds key Feishu Doc capabilities: table create/write + image/file upload (from URL or local path).
This is highly impactful for Chinese users, where Feishu is a primary integration platform.
https://github.com/openclaw/openclaw/pull/20304

night shale
#

@jolly wolf How can I help triage issues, remove spam, etc? When I'm working on my openclaw, I regularly search open issues, and I've been finding some odd ones, including some with spam replies, etc… I don't have a lot of time to help ATM, but at least when I'm "already there", I can help. GitHub doesn't really offer a way to flag stuff for mods, unfortunately… :X

twin gazelle
#

I'm torn between wanting to send a contribution and not wanting to overwhelm the team; I'd love to make web search take "adapters" so that I can add my preferred search provider, Kagi. I'm currently using it via a skill and my lobster doesn't always remember.

#

It feels like web search is something that could easily be plug and play

sonic ermine
proud bay
#

I'm getting lots of these in verbose mode on telegram:

Process: poll • tide-fjord
Process: poll • tide-fjord

Sometimes up 50 in a row.

Got a suggestion, what if we let bot use a single message and autoupdate itself with a counter?
Process: poll • tide-fjord (1) -> Process: poll • tide-fjord (2), etc

twin gazelle
novel monolith
sonic ermine
sonic ermine
ripe dagger
#

all right, all checks pass, greptile is content :)

crimson wren
shadow garden
#

https://github.com/openclaw/openclaw/pull/20183
SMALL change overall (~50 lines of actual code change, the rest is updating tests) but this fills the gap for memory when you do /new and use subagents this ensures those sessions are indexed as well

a quick something I'm sure everyone will benefit from

onyx sparrow
#

Have a very small safe (Greptile 5/5) PR open to update the Clawhub skill. While updating my skills to bring them to all to 'Benign' for the new security checks, discovered the clawhub skill doc that ships with the install is outdated. Updated to add missing commands (sync, delete/undelete, logout), url update. Would appreciate a look https://github.com/openclaw/openclaw/pull/19579

frail mortar
sharp cargo
#

I have a third PR ready to go wrt cron job isolated sessions but I kind of want to wait for this one to merge so I can get the contributor tag and make my next one go better xd

frail mortar
frail mortar
sharp cargo
# frail mortar Have you tested it?

Of course, I wrote details in the PR. It’s been running locally for a day now.

Yall on cloud models just noticed a huge cost increase. I on the other hand had my GPU running full tilt all day every day since the 15th processing and then throwing away prompts

sharp cargo
frail mortar
#

I did notice the huge price / usage limit increases 🙂 I blamed anthropic.

frail mortar
sharp cargo
#

There’s like no explanation of why

sharp cargo
midnight swallow
#

Howdy ya’ll. Where can I request access to TestFlight for the apple watch companion app?

night shale
novel monolith
#

There are indeed several important PRs sitting for a while. I really hope we can pick up pace soon. Any feedback is better than none

sharp cargo
#

werent there like 100 prs merged yesterday? it's hard for them i'm sure

shell sapphire
frail mortar
frail mortar
sharp cargo
#

Yeah it’s so annoying because i didn’t touch those files and it’s different every time

#

But if greptile doesn’t like it I need fix

frail mortar
sharp cargo
meager mango
#

sry for texting here, do you guys know where to report a bug?

brisk kindle
atomic sedge
#

🔬 Cortex v0.4.5 — Trace Analyzer with LLM Classification

Just shipped something I'm genuinely proud of.

The problem: AI agents make mistakes. They run into doom loops, repeat the same errors across sessions, ignore user corrections. And they never learn from it — because context windows reset.

The solution: The Trace Analyzer reads 255k events from our NATS event store, reconstructs conversation chains, and runs 7 structural failure detectors:

  • SIG-DOOM-LOOP — agent retries the same failing command 3+ times
  • SIG-REPEAT-FAIL — same error across multiple sessions
  • SIG-CORRECTION — user had to correct the agent
  • SIG-HALLUCINATION — agent claims success after a tool failure
  • SIG-DISSATISFIED — session ended with user frustration
  • SIG-TOOL-FAIL — unrecovered tool errors
  • SIG-UNVERIFIED-CLAIM — agent states facts without checking

Stage 2: Every finding gets classified by a local Qwen 2.5 7B. Root cause analysis, suggested rule, confidence score. Zero API cost.

Real example from today:

[HIGH] SIG-DOOM-LOOP (main)
Agent tried nats stream add 3 times with subjects that already exist.

🧠 ROOT CAUSE: Subjects already belong to another stream.
📋 RULE: Check if stream exists BEFORE creating.
🎯 CONFIDENCE: 0.85

That rule is now in the agent's system prompt. Next time it won't make that mistake.

The loop is closed:
Events → Chains → Signals → Classification → Rules → Better Agent → Events

850 tests. 10 languages for signal detection. MIT licensed.

npm i @vainplex/openclaw-cortex

https://github.com/alberthild/vainplex-openclaw

sharp cargo
humble plume
#

https://github.com/openclaw/openclaw/pull/21248

Hey I noticed that some issues and user complaints come around they fact they don't understand how much of the context is getting cached when sent to the model (they mistakenly believe openclaw is ineffecient with tokens). This PR adds a line about how much cache is compacted in a given session. I tested this on my own claw and put a screenshot of it working.

sharp cargo
sonic vapor
humble plume
oblique eagle
novel monolith
keen spruce
stone field
frail mortar
ripe dagger
glass moat
# keen spruce Not exactly a review, but I wrote you a book, um, a comment.

I worked hard on this one with lots of back and forth testing and it finally solved some model selection and model fallback bugs I was dealing with on telegram. https://github.com/openclaw/openclaw/pull/18820 happy to discuss!

GitHub
fix(auth/session): preserve override reset behavior and repair oaut...

Context
This PR started as a very small fix: preserve the user's model/provider override across /new and /reset.
At first, this looked isolated to the reset path. But while tracing resetTri...

muted pendant
#

Cybersecurity Support and Security Testing

limber silo
#

Hey everybody! This is my first time contributing to openclaw so I hope I’m doing it right! I’ve got a PR here which hopefully should fix a few cascading issues in the macOS app. It’s got a 5/5 from greptile and codex and it’s a super small PR. Happy to discuss! https://github.com/openclaw/openclaw/pull/19750

rustic ingot
#

is it me or did new updates break slack in weird ways? Ive had to patch my own openclaw 😅

untold pollen
sonic vapor
rustic ingot
#

Ah yes I got it disabled . Thanks

#

My openclaw seems to be sending duplicate messages

#

I think the first message is drafted

#

Couldn’t track it down lol

untold pollen
atomic sedge
sharp cargo
#

oh i'll just maintain my own fork of this thing with the patches i haven't gotten merged yet

what do you mean there are over 300 commits merged in the last 24 hours

#

...y'all aren't gonna believe it but i think there's another invalidation bug at like 49k tokens in the context. which is like. what?

keen spruce
proud bay
#

Didn't update for 2 weeks, did an update yesterday, so far:

  • verbose doesn't verbose. Exec: run cd instead of showing full command
  • cron doesn't cron: got all cron messages in correct topic(after my PR fix got merged), but got all of them twice instead of just 1 time.
  • gateway broke down after update, had to spend 30m debugging it with other bot instance.

Shit is breaking faster than I can maintain patches for it

#

Had to learn stgit and now switching to JJ to maintain patches for openclaw 🫠

#

Will post a few PRs after I have fixes to stuff I've mentioned

sharp cargo
#

i'm having to back out the last like 200 patches

untold pollen
proud bay
#

@untold pollen working on those, have to fix it and do some testing and that's not quick if I'm not YOLOing the PR 😅

#

But thanks for asking and keeping an eye on those problems

untold pollen
#

@keen spruce @sharp cargo you too! We're all drowning in PRs but if you folks have any open ones that would fix major regressions I'm happy to take a look

untold pollen
proud bay
#

I think we should at least require video/gif of the bug and a video after fix is applied in PR description
That would help folks like you to review better

#

At least that's how I do stuff at my job, screens/videos for each PR

untold pollen
#

That would be great, honestly. Most my PRs try to have a video / screenshot comparision

hazy jasperBOT
#

Can you escalate that requirement suggestion to @celest merlin ?
That way we'd be able to just reject all PRs that don't have visual repro of bugs and fixes and would help limit amount of shitty PRs or stuff that breaks something else

viscid jayBOT
#

@proud bay, please don't ping Peter for issues, use #1459642797895319552 or #users-helping-users if you need help, use #clawtributors to discuss PRs, or use any of the many other channels in this server as they're intended.

If you have a problem with the Discord specifically, use #report or DM @jolly wolf
-# Your message was reposted above without the ping active for the sake of conversation.

keen spruce
# untold pollen <@119710807788355585> <@132500715133206528> you too! We're all drowning in PRs b...

I haven't made some myself; my local patch is for an unfixed bug (where I have a PR open), not a regression. But I certainly can point them out here when I find them in the PR ocean. Mostly it's "good issues, bad PRs" for those, though. Off the top of my head, I only get:

  • the "uncachable system prompt" already is in main for .20
  • the hearbeat regression I pointed out also is in main for .20
  • the one possibly making sandboxes unusable by filtering the config instead of env, I pointed out above already

The rest got pointed out in here already by other people, and I'm not really keeping track of those in my head unless they would affect my installation.

Also, I can only repeat my suggestion of putting heavy emphasis on volunteer reviewers before merging PRs. We have more time to read code changes in depth and find the hidden consequences. Like the PR I just reviewed that implemented timing-attack protection ineffectively...and for comparing sha256 hashes of well-known lengths. By the PR text alone, it looked like a good security patch...

sharp cargo
#

I don't want to have to put together a screen recording of logs scrolling though

proud bay
sharp cargo
#

well, henry did suggest volunteer review of prs, which i think is an interesting way to go about it. although you still need a trusted pool there too

#

anyway, there are a lot of things that would save their time, many of them are still things we shouldn't do

proud bay
#

If we don't enforce rules that make maintainers' life easier, everyone would just skip them

sharp cargo
#

the rule doesn't exist yet and you've already gone to enforcement lol

proud bay
#

lol

keen spruce
# sharp cargo well, henry did suggest volunteer review of prs, which i think is an interesting...

trusted? No, I don't think so. You need a pool of known names to avoid sockpuppet reviews, that's all. You don't really have to trust positive reviews, but when a review points out an issue with a PR, looking into that doesn't hurt. I rarely comment "all is fine" on a PR, I'm not that self-centred to think I can spot everything, and PRs get rebased (i.e. changed) all the time, but the review sticks.
The real power of this suggestion is that maintainers can send a bunch of reviewers to look at PRs that are under consideration, focusing eyes on where it would do the most good. And with 3, 5, or 10 reviews on a PR, one "all is fine" vs nine "bad idea" doesn't matter.

#

TL;DR: Use reviewers to point out issues with PRs, not to greenlight them.

sharp cargo
sonic ermine
#

this is libel

#

no this is autism 🙂

sonic ermine
untold pollen
#

E.g. @proud bay has been a big help with testing and fixing Telegram issues

proud bay
#

Thanks ❤️

keen spruce
#

and still PRs are piling in...and the "security" ones are getting worse and worse. Seems like there are no real findings anymore, so they're now treating the owner of the gateway as a hostile attacker.
Nah, it's not that bad, there are some useful ones, but they are few and far between. Most just apply standard patterns where they don't belong. But it is tiring checking those over as the pattern sounds right, and you have to dive deep into the code to assess the effects.

proud bay
#

I know there's already a labeler that tags PRs by area - that's great for filtering. But CODEOWNERS adds something different: it formally assigns a reviewer and pings them directly. So instead of a maintainer manually checking "are there any PRs with my label today?", they get a GitHub notification the moment someone touches their code. Labels organize, CODEOWNERS enforces ownership.

untold pollen
proud bay
#

There are ~232 PRs tagged "Telegram" - split between a couple maintainers per area, that's a PR every few hours. Not ideal, but doable.

But the real value isn't reviewing every PR - it's blocking bad merges. Example: Telegram bot topics got broken multiple times last month. If @untold pollen had to approve every PR touching that code, there's a good chance it wouldn't have broken as many times.

This is a big project used by millions of people. When something you rely on breaks repeatedly, it's really painful. CODEOWNERS won't fix the volume problem, but it will make sure nothing gets merged in an area without the person who knows it best signing off.

fossil adder
#

Is this true? There’s no documented prioritization model like you’d see in some large foundations that tag issues by severity or developer reputation.

fossil adder
proud bay
white galleon
#

except for maybe docs there isnt a single PR that is acceptable as they are submitted

#

they all need to be worked on and there are always issues

keen spruce
#

I agree with Taras that throwing out bad PRs is the primary bottleneck in managing the flood. I'm not so sure if involving the code-owning maintainer that early is a good idea; the flood would still be too hefty. I think there needs to be a first hurdle that filters out the stuff that's so obvisously not going to make it that you don't need deep knowledge in one area. Only then it goes to the code owner to reject or put on the "maybe" pile.

#

Another issue with early, automatic assignments is that other maintainers tend to ignore assigned PRs and issues. That leads to an unhandled backlog if a code-owner is unresponsive. Just try to get a ticket about tado or HmIP handled on the Home Assistant github---the code owners don't rarely respond and nobody else even looks at those tickets.,

proud bay
#

I think it could be solved if there's a team of owners for each part, like 3-5 people per item?

sonic ermine
#

or taking the opposite path and access reduced to just labels for a role like "filterclaw" with small team of folks that between themselves have some kinda coordination

#

what does that do ? not much , but with a couple of smart labels and actual daily "maintenance and review" as required for even just these labels it could really help speed things up

#

it's not lie every labelled pet project makes it in , but maybe some maintainers get lucky with their volunteers, who knows

humble schooner
#

Have you guys thought of weighting the PRs by time opened > size > ready to merge?

Regarding the teams, I work on a project with 20 collaborators and hundreds of features and one thing that helped a lot was not only teams but context assignments. We still work on topics off context but it really increased not only our speed but our assertiveness.

untold pollen
#

cc: anyone else who wants to help out with the Telegram side of things

muted badger
#

@keen spruce thanks henry,you reviewed my pr and got it merged

inner ledge
#

Hey all, jumping in on this codeowners discussion as it's relevant to Android. I've had a few PRs sitting in the queue for a few days (#19208, #19209, #19548, #19555) and I noticed there's no Android maintainers or owner in @proud bay PR. I've been actively improving the Android app and would be happy to take on Android as a code owner. I'll hold off on submitting more PRs until the backlog situation has some resolution, but I'll continuing to work on improvements on my end. If anyone wants to collaborate on Android or there's a process for formalizing this, I'm all in.

proud bay
#

My PR got closed, cause it will create to much clutter for Peter, which is true 😅

modern kestrel
inner ledge
#

Ya makes sense. Maybe the answer is the opposite direction: platform sub-repos or long-lived branches (telegram, android, ios, etc.) so each surface has its own small team and Peter only touches the platform -> main sync. Fewer people at the top, more ownership at the edges. I think that might be what @fossil adder and @keen spruce are getting at?

humble plume
#

@inner ledge if noone touches the android app can't you keep your own fork in sync and when the android app is fully ready surface it for review?

inner ledge
#

100p, just want to make sure there wasn't an existing procedure or someone else isn't doing the same thing already. I'll take that direction

modern kestrel
# modern kestrel 50% docker image size (app-specific layers not base) reduction... build time red...

Peter interacted with a user on twitter complaining about the docker image size growth. It's a problem related to the chown. The fix is quite simple. Cuts size by 50% and removes the 1 minute+ chown step entirely. Peter said he was going to look at reducing dependencies... while that may be useful, it's not necessary to cut the docker image size dramatically. Please help get this merged and someone tell him so he DOES NOT pay any attention to reducing the docker image size. He should work on something else.

#

I tested it by:

  1. docker-setup.sh - Ran the full onboarding, paired a new bot with Telegram, brought up the gateway, checked the logs, etc.
  2. docker-diff.sh (in the PR description) - Did a full listing of all files and permissions / owner in /app and validated that no owner or permissions changed. All files still owned by node. Unified diff length is 1050 lines but actual +/- lines in dist/ is 191 with context excluded. It's all variation in chunk file names.
  3. PR is green... but I don't know if the E2E suite runs automatically on a Dockerfile-only PR?
humble plume
#

Hey @modern kestrel I think we should test more features of openclaw

modern kestrel
#

The only thing I'm worried about: The Chrome installation... I did not test that... I can look at that

humble plume
#

from what I see you just tested new both with telegram

#

we can discuss in the PR perhaps, less noise here

modern kestrel
keen spruce
#

BTW, the gateway knows the client IDs "webchat" and "webchat-ui", but they are not used by anything in the repo. Does anyone know what they are there for? Because, if they are unused, they should be removed---people are already adding code that treats clients with those IDs differently, which would be dead code...

lean nova
sharp cargo
#

Anyone think it’d be worth it to make some kind of test that validates model calls specifically to make sure we don’t cache bust?

#

Like a full stack simulation kind of deal

jolly wolf
#

@silver crown we have a proper report flow on the site rather than spamming slop in the server

silver crown
#

i am sorry. where can i report. i promise it is not slop, but a clever attack vector well hidden, trying to steal your personal info. just trying to report man.

humble plume
glossy yewBOT
humble plume
steep ridge
jolly wolf
lean nova
#

@jolly wolf-chan, can i get the claworator role too

green geode
jolly wolf
sharp cargo
#

i named it and now maybe i get it!

jolly wolf
sharp cargo
#

hell yeah i have a color now. thanks!

humble plume
lean nova
#

😢
where is it

viscid jayBOT
#

Your question is answered in the server FAQ in our Server Guide

lean nova
#

was merged in 2.17

#

+2 LOC 😄

#

ayyyyy

#

thanks whoever it was ❤️

sharp cargo
#

well. inspired by some other PR comment I saw, I'm having claude code write a proxy that can detect when it expects us to bust a "perfect" prefix cache (and where in the message it's happening)

#

it feels twisted, somehow, in a positive way, to use claude code to make local models better

humble plume
#

Did my message get deleted?

keen spruce
#

Someone made a PR to sha256-hash a sha256 hash before checking it, so an attacker cannot learn how long a sha256 hash is with a timing attack. Makes sense, it would be a disaster if an attacker could learn how long our sha256 hashes are. /S

I'd call it an AI having no farsight, but the original sha256 is not just right above their changed lines, it is within their change. Must be a human or a <1B model. And they're ven defending their change...

muted badger
humble plume
#

Well I’m trying to help us manage the reviewing PRs for OpenClaw. Not sure if this is the right channel

jolly wolf
keen spruce
#

first iteration was just buffer padding, they upgraded to sha256 after I explained to them that that was useless. I actually spent time explaining before I noticed the comparison was for fixed-length tokens... 🤦

topaz coral
#

Anyone have advice for compaction with 5.3-codex-spark? I basically get compacted every message I send.

fossil adder
empty fjord
clear kraken
#

role added. thanks for contributing to openclaw!

modern kestrel
# modern kestrel 50% docker image size (app-specific layers not base) reduction... build time red...

Ran the full pnpm test:docker:all test suite against both main and my PR (since it emits ~17 ENOENT errors even on main and I had to make sure it wasn't me). All tests passed. No failures.

Gists of all logs, diffs of logs, diffs of /app file contents / owners / permissions added.

I think it's a pretty dang good PR! Not to mention saving almost 1 GB off the docker image size...

https://github.com/openclaw/openclaw/pull/22019

humble plume
#

Thanks!

ripe dagger
#

well people

#

how stuff compiling today

modern kestrel
#

Thanks for the merged !

Please close this issue too as the docker build is now cut in half - granted, we can add more to the ignore but a lot of the caching issues are resolved now and the slow chown is removed. I put a note in the issue referring to the issue it duplicates:

https://github.com/openclaw/openclaw/issues/19096

#

In testing my PR, I could not find the installed chrome when passing the flag to the docker build.

Turns out this was broken on main already and there is a PR attempting to fix it: https://github.com/openclaw/openclaw/pull/19561

I'm going to go fix that now. I didn't break it... was broken before (that PR is from 3 days ago).

wheat sphinx
#

There seems to be a rash of gateway connect failed: Error: pairing required today -- anyone have a beat on it?

jolly wolf
#

fixed on main iirc

#

i think

wheat sphinx
# jolly wolf i think

i just redownloaded 3x and keep getting it -- that error pulls 213 results in the discord search

jolly wolf
#

#21447 was the fix

#

fwiw there were changes as well for security

sharp cargo
#

I’m about to add an asynchronous mail delivery channel to this thing and really make maintaining my own fork interesting

wheat sphinx
keen spruce
untold pollen
untold pollen
modern kestrel
#

@jolly wolf - Not sure what happened here but this commit f555835b0974b74d6931a2c6054894e1b72f9205 reverted my Dockerfile changes?

jolly wolf
#

ugh

#

branches are dumb

glass moat
#

Hi clawborators! I just made a skill to help with your OpenClaw PRs.
It basically helps you know if your PR is going to break anything

Its based on a well structured documentation
Check this out!
https://clawhub.ai/Glucksberg/pr-ship

ClawHub
pr-ship — ClawHub

Agent skill by @Glucksberg on ClawHub.

tall prairie
#

clawhub... le sigh

jolly wolf
tall prairie
#

oh okay

jolly wolf
glass moat
jolly wolf
#

the general principles are fine, its the specifics like "heres what changed in this version" and "go look at this file", teach it how to use the codebase instead

jolly wolf
#

the rebase cleared it out :/

foggy stream
#

Not sure where best to post this for visibility but: Now that #1474434870259224723 has topics, could we get the same for #old-models for the main models - ChatGPT, Gemini, Kimi, Claude etc, and then a Others and General. It's a mess in there trying to talk about a model

glass moat
little frost
jolly wolf
little frost
untold pollen
#

They only want Llama on Whatsapp ohno

hollow shard
#

Hey all. I'm working on a termux-friendly gateway (upstream friendly) fork atm and would like to give back. I don't want to create a big PR without first having a word with someone about whenever this is part of the roadmap.

proud bay
#

Hi guys

I have an idea: what if we add a tag to people who create PRs and whose PRs introduce bugs/regressions. Could be something like “review carefully”, etc?

hollow shard
proud bay
hollow shard
sonic ermine
sonic ermine
sonic ermine
sonic ermine
#

survived the cull , sigh 🦞

proud bay
hollow shard
proud bay
#

I'm talking about stuff that lint won't catch

#

About marking people who might introduce logical/functionality regressions

#

Btw, is anyone else having same crons sent twice to same tg topic? I'm wondering if it's my config or bug in openclaw

#

Started happening after I upgraded on Thursday

lean nova
#

someone messed up the extensions/msteams/src/messenger.test.ts

#

all CI failing 🙁

image.png
keen spruce
# proud bay Hi guys I have an idea: what if we add a tag to people who create PRs and whose...

That's not as easy as it sounds. One of the recent regressions stated what it did loud and clear in the title---but it still was missed because the person who merged it wasn't aware of the intent behind that very tiny detail of a virtually never-used feature. They could have reviewed that PR carefully for a whole day, and they wouldn't have noticed. Others saw it from the PR's title with half a glance because they know and use that feature. That's why it is important to get multiple sets of eyes on a change, not just assign a trust level to the person or AI submitting it.

sonic ermine
lean nova
#

i have 3 open 😢

sonic ermine
lean nova
#

please

sonic ermine
#

just pray those big openai bucks pays for all that beause obviously that is expensive xD

lean nova
sonic ermine
#

lol yeah, just fix the failing tests as you find them

#

openclaw is the only repo in the history of time that prefers big prs rather than small ones btw

lean nova
#

so my 2 LOC PRs arent the way to go

proud bay
sonic ermine
#

just make a new pr with a bundle , i dont know though i'm just a guy , grain of salt

sonic ermine
lean nova
sonic ermine
#

yes we still do because there's a billion people with access to openclaw-based services

proud bay
lean nova
#

mine are still fixes to issues ive faced so

sonic ermine
sonic ermine
#

and it kinda is , that's what maintainers are for , just go with it , dont stress

#

they sacrifice their free time for our sins , you can just rely on that xD

keen spruce
# proud bay That's a good point. I think a rule could emerge: "dont merge changes if you don...

In other settings, you have reviewing rules. Can't merge your own stuff, can't merge stuff that doesn't have an architecture board approval number, two code reviews, one sign-off review by a project architect, a sign-off by the code-owning team, and passes CI, and it gets auto-reverted if CI on the merged main branch fails. Naturally, that process is a bit bigger than what's needed here, but we see why people came up with it.

sonic ermine
#

there's not a top limit on how good you should make your ci (my opinion) , just has to work for you

#

first time so many users dont have like 5 layers of QA between them and an update automated by autonomous agents

split nexus
lean nova
keen spruce
#

This merged security PR might need some consideration. It doesn't break anything, but what it does has no effect. TOCTOU attacks on temp files cannot be fixed with more random filenames. If this security concern is seen as valid (not by me---multi-user machines are practically extinct), it should be fixed properly and not soaked in snakeoil. https://github.com/openclaw/openclaw/pull/20654 (more details in my review comment)

untold pollen
keen spruce
#

...and to whom it may concern: The "Spellcheck docs" CI task seems a bit HEAVY (insert Encanto meme), running for well over half an hour 40 minutes already for a one-word change in one file. It might need some guidance on what's worth checking.

untold pollen
keen spruce
rose steeple
#

hello

keen spruce
#

I would call this a regression. https://github.com/openclaw/openclaw/pull/22621. What is the security model for openclaw? Is the agent in the "inside" domain and not allowed to touch "outside" resources, or is it in the "outside" domain and is not allowed to touch "inside" resources, or is it "inside" and is intended to connect between "inside" and "outside"?

There are a lot of security PRs that assume one of the first two, and they're nailing down the agent so it can't access either "inside" or "outside" resources. However, to my understanding, the agent was always intended to bridge the user with the outside world while automating inside tasks. Also, classifying every agent action as hostile is dumb. We use openclaw to have the agent do stuff for us, and while it is susceptible to prompt injection, locking it away from our stuff makes it about as useful as the web version of Codex. Treating openclaw like the server software that runs google.com is wrong. It isn't a software providing services for random third parties. It is primarily providing services for its owner (even if some people suspect that might change with the OpenAI involvement). SSRF doesn't apply unless it's introduced by a redirect attack---SSRF is a threat model for services that operate for thirs-party users.

*I think this whole threat model needs to be clearly defined and taken care of once and for all. There needs to be a central config defining what is "outside" and what is "inside", and which of these two domains the agent is allowed to access. *

For example: If a user wants the agent to configure their audio mixer, openclaw shouldn't block that just because the audio mixer isn't sitting on the open internet but safely in the user's home network.</rant>

final ocean
pale crane
hallow snow
# keen spruce I would call this a regression. <https://github.com/openclaw/openclaw/pull/22621...

Agree. To me the security model barrier is the chat input restrictions ... who can talk to the agent. I'm using openclaw precisely because it can do things I ask it to do without needing much handholding or server-side config. I'm not worried at all about prompt-injection, because I'm the only one who can prompt it. I run a multi-agent gateway for my wife and I - and even in that setup her agent won't talk to me and vice-versa

keen spruce
# hallow snow Agree. To me the security model barrier is the chat input restrictions ... who c...

I am a bit concerned about prompt injection--- through actually external channels. If my bot were to do something because the weather website told it to, that'd be bad. But when the software prevents the agent from doing something I tell it to, that's also bad.
TIL they neutered hooks. If I were to set up a button in my home automation to tell the agent to do something (something I have considered doing), that would now be denied because it is "dangerous external data". What th...? That would be my hook, that I set up.

lean nova
keen spruce
novel monolith
lean nova
split egret
#

‎I'm planning a production setup with 3 AI models across 3 providers (OpenRouter, Groq cloud, Gemini) and want to verify the correct configuration architecture before investing time in implementation.
‎
‎Can someone confirm if this understanding is correct for v2026.2.x?
‎
‎Core Architecture (The Triad):
‎
‎1. auth-profiles.json – Stores raw API keys with profile_ids (e.g., openrouter:default), tracks errorCount for lockout after 5 failures
‎2. agent_auth.json – Auto-generated cache that duplicates keys for fast lookup (not to be edited manually)
‎3. openclaw.json – Control plane where models.providers defines each provider's baseUrl, API protocol, and links to authProfile
‎
‎Key Questions:
‎
‎· Is it true that adding a key to auth-profiles.json without a corresponding models.providers entry in openclaw.json leaves models "authenticated but unreachable"?
‎· For 3 models, can I enable Discovery Mode by removing/omitting the agents.defaults.models allowlist to accept any model my keys support?
‎· For OpenRouter, is "api": "openai-responses" the correct protocol to support tools/vision/reasoning features?
‎
‎I need 100% accuracy but lack the technical depth to test myself. Any confirmation or correction would be greatly appreciated!
‎

keen spruce
split egret
#

Thank you sir

glass moat
foggy stream
stone field
final ocean
sonic ermine
keen spruce
untold pollen
vital comet
#

Hi #clawtributors ! I'm here to hopefully increase the visibility of this PR: https://github.com/openclaw/openclaw/pull/20302

It fixes a bluebubbles history bug. Without this fix, the agent cannot include previous message conversation in the context for its next response.

I've been using this in my own build for around 3 days now, and it works great with my BlueBubble installation.

This wasn't an obvious bug at first, because I was coming from the imsg package, which has much simpler setup and the history works out of the box.

stone field
final ocean
#

In future run @greptileai review so score is updated - make my job mega easy then

#

now i gotta wait for 15mins for it check

vital comet
still socket
#

Anyone else get hit with the hard truth that openclaw gateway reset does not equal openclaw gateway restart

final ocean
#

dead code now to remove

#

if you can do that change and re review and ping me here would be nice

#

ill do the final checks/clean and merge

still socket
#

I think I just gotta nuke it. I'm just starting out so it's a good lesson for later.

jolly wolf
vital comet
keen spruce
white galleon
vital comet
final ocean
#

Yea working now

#

will ping when merged

#

we have a release now, so once merged will mostly go out tomorrow

misty mango
#

Hi all, are the agent creation disabled at the moment?

#

#polyclaw

#

Sorry might be on wrong channel

random hill
#

I have a silly request / recommendation: https://clawhub.ai/u/steipete add a filter to clawdhub profiles where we can order by amount of stars/downloads so I can quickly see whats the best skills published by each person

jolly wolf
#

if its not already

random hill
#

okay! I will check into that, thanks!

still socket
# white galleon will look into it

Again - New person here so I may have trusted ChatGPT too much. This is the command. --reset For the record, there was plenty of warnings that I just ignored.

stone field
#

is it ok to leave pnpm-lock as a conflict? seems impossible to keep on top of with so many PRs going through

jolly wolf
#

If that’s the only conflict that you’re chasing, it’s fine, just as long as there are no big logic issues in conflicts

stone field
#

ok cool ty

white galleon
empty fjord
#

mmm...

#

i don't feel good abt this pr

#

it'/s

#

not looking great

ripe dagger
sick crescent
#

Anyone use aquaman proxy?

limber silo
final ocean
ripe dagger
final ocean
#

noooo... its taste yescat

sharp cargo
lean nova
keen spruce
# sharp cargo Isn’t this pr (which didn’t merge) about _enabling_ access to local resources?

yes, about re-enabling it. All those security PRs are treating openclaw like it's sitting a thousand instances side-by side in a big corporate data centre and is used by untrusted customers who shouldn't be able to peek into the centre's internal network. And we, who have it at home and WANT it to access local resources, have to fight tooth and nail to not get locked out. Um, sorry, that's a bit more general than that specific PR, but that's the impression I get after reviewing everything that has "security" in its name today. And the full effects of many changes are really hard to estimate, as people rarely lay them out in the PR descriptions. But when I see code that silently(!) rejects configurations the user has made in the config because the values match some "security pattern", I'm honestly unsure what the aim for the whole project is and it makes me anxious.

PS: And the funny thing? A data centre installation doesn't care if the software tries to poke around at the local network and localhost. There it sits in a nice VM or Docker container, only seeing its virtual network that has nothing in it. SSRF? All day long, please...there's nothing to hit with it.

keen spruce
# lean nova 💀

What was your prompt for fetching that data? "Fetch&do", "fetch&present to me", "fetch&learn", "fetch as info for a reply"...?

dark grove
#

i want to run from source but not pollute the source with my configs and skills. how/where are configuration files separated from source code? Like telegram config, Claude API Key, or SOUL.md, etc?

white galleon
dark grove
#

found it. cool

humble glacier
#

Has the topic of text output watermarking been discussed? The contribution guidelines make it clear that AI assistance should be called out, but I'm noticing obvious bot prs spilling out into repos I maintain and it's difficult to verify besides noticing an abnormal amount of activity as soon as I add a "help-wanted" tag to an issue, and unreasonably fast response times to change requests 😂 . Tried something locally that adds an invisible zero space unicode char \u200B to the end of all outputs to at least give some indication it came from here, but that seems somewhat naive. Maybe its futile and is better off handled with defensive AI checks, but figured I'd ask if anyone here has opinions.

ripe dagger
# lean nova

thats actually kinda crazy. every single time!?!

vital comet
final ocean
#

I will leave tag to mods here

ripe dagger
keen spruce
# humble glacier Has the topic of text output watermarking been discussed? The contribution guide...

There isn't much that can be done there, tbh. We can't do more than tell the agents, and they often don't even manage to fill out the submission template even when instructed more than clearly. One way that may work to some extent would be to get the gh tool to add a notice that a PR was made from the command line. For real humans, a command line flag to turn that off would be ok---AIs wouldn't bother to run gh --human ... unless explicitly asked to do so. However, that won't catch the AIs that have a direct API connection (e.g. Codex) or remote-control the browser to make their submissions.

sharp cargo
vital comet
sharp cargo
# keen spruce yes, about re-enabling it. All those security PRs are treating openclaw like it'...

I think this is overstating it a little bit. You kind of came to the right point at the end. This is about defending people who may not know what they're doing (100k unsecured instances open to the world??) from people who might induce it to pivot onto their network. It's not about being secure for the case where you've set it up properly, on its own isolated segment, etc. It's about being secure for the other case, the one where a bunch of insecure stuff is accessible to the agent, because most home networks don't run zero-trust.

I think it's reasonable for it to be a flag.

#

Also, these things accidentally do all kinds of shit

#

if they accidentally do something to an insecure service on 192.168.0.1, well, first of all, that's more likely than finding an insecure service at a public IP, and secondly, they're potentially screwing up some pretty important shit on that network

#

like the public internet is dangerous to the thing that's accessing it; the private network is dangerous to let it access because maybe it'll access it wrong

#

in any case, it is an open source product, and the default should be to keep it from doing harm. if you want to disable such features, you can just modify the code to turn them off, if no switch exists. you can even ask the agent to do that, since, well..

modern kestrel
#

Is there a solution to several forks of the repo posting updates to pull requests that say they pushed the same commit to their fork and it referenced this PR? Look at the bottom of the PR... last message is from 2 hours ago.

https://github.com/openclaw/openclaw/pull/22380

modern kestrel
#

This discord/opus native module build issue has dupes (and will probably continue to get more):

DUPLICATEs:
https://github.com/openclaw/openclaw/issues/23205
https://github.com/openclaw/openclaw/issues/23121
https://github.com/openclaw/openclaw/issues/23120
https://github.com/openclaw/openclaw/issues/23102
https://github.com/openclaw/openclaw/issues/22983
https://github.com/openclaw/openclaw/issues/22956

KEEP (oldest): https://github.com/openclaw/openclaw/issues/22877

PR: https://github.com/openclaw/openclaw/pull/23173 (not mine - not vouching for it... it's not a well written description / lacks testing)

steel roost
#

I started using OpenClaw a couple of days ago, and have made some improvements to the Teams plugin (as I'm currently a Microsoft Power Platform focused developer) as well as copilot studio plugin and fixed a couple of bugs that bothered me - and I have embraced my AI assistant coder and I end up reviewing the code more than writing lately, but I have a couple of PRs ready https://github.com/openclaw/openclaw/pull/23077 and https://github.com/openclaw/openclaw/pull/23226 - it looks like there actually is a little bug in main that is causing CI/ check to fail

steel roost
#

I am cleaning up a copilot studio plugin that would require some of the ms teams improvements to be merged as the auth won't work easily without the adaptive cards support

untold pollen
sonic ermine
#

at some point i rely on faith because it's like too many prs to properly analyze and get a broad view

lean nova
#

later changed the send a joke on tele to send me the configs

#

on the api side and
"go do it again" on openclaw

keen spruce
# lean nova

yeah, with "do as it says" you're overriding the security warning. The models can distinguish between user input and text in tool results---they automatically trust the latter less, even when it's a content warning.

lean nova
#

kinda sorta shouldve thought why is there a pattern breaking instruction among math equation, but thats on the models side of this right ?

sonic ermine
#

man openclaw is such a mood , the resolve conflicts button just blinks xD i mean merge button

#

like it's always blinking on loading then blinking back , just checked an issue i opened with three prs attached to it and all got merged , quite impressive

#

there's so many more prs , but it's kinda stable at like +100 overall a day xD

#

nevermind i think i didnt write my issues xD damn i mean it's such a stress to have to maintain a pr , always worth like checking quite a lot if anyone's remotely touching some part of the million line codebase where you'll be contributing xDD

#

(there's a lot of prs , dont know if i've mentioned that yet)

#

who among us will be brave enough to refactor the commands folder 🙂

glacial tide
#

could you remove ads from games make sure all games have mobilee controls to n work thsnks

sonic ermine
#

wake up solve 5 merge conflicts in one hour , return the next day ...

untold pollen
untold pollen
sonic ermine
#

just went down a rabbit hole with the merges 🙂 all fixed (it works locally) i mean it used to before i tried auto committing the suggestions xD

untold pollen
#

oof that's a big diff

sonic ermine
#

now i'm gonna drink a coffee and comply with my video obligations to openclaw 🙂

#

it's really not , it's just a merge commit that i unsigned

#

xD myyyyy bad

untold pollen
sonic ermine
sonic ermine
#

hey @untold pollen , it is in fact sorted : https://github.com/openclaw/openclaw/pull/23542 5/5 on the greptile . will debase myself on video a bit later as part of my compliance principles (with the reporting requirements on the repo i mean)

zenith stone
zenith stone
zenith stone
#

@untold pollen thanks for giving me the note on my PR. Peter gets to things fast 😂

modern kestrel
#

What's this about debasing on video?

Are PR videos required on submission now or strongly encouraged?

If so... I love it! I make them when I have complex changes or when trust is low. Helps a lot! Helps me too... sometimes I realize that I am not actually showing that it works and that I have more work to do.

past haven
modern kestrel
final ocean
#

LOL Captcha for PRs

image.png
nimble bloom
modern kestrel
# nimble bloom Can a maintainer take a look at this , more provider options are always nice ht...

My feedback: I see nothing in the PR description to alleviate the fear that this isn’t just Astro-turfing. Essentially self promoting a new service that no one uses or cares about by trying to add it to the hottest project on the internet.

If you want this in there should be a section in the PR description that establishes legitimacy by referencing funding, ownership of the company behind this gateway, usage info and / or tweets of big users with clout that are using it, podcasts with the founders with big name hosts. Etc.

If that stuff doesn’t exist please close this PR and start by trying to get users on different surfaces first.

New model gateways can be a HUGE security risk as the owner of that gateway can scrap API keys, all requests, and all responses. It doesn’t even have to be nefarious either: through negligence the gateway owner could get broken into, not notice it, and a 3rd party could do everything I just described.

That is just my two cents not an official project position

sonic ermine
jolly juniper
sonic ermine
# modern kestrel My feedback: I see nothing in the PR description to alleviate the fear that this...

that's a shortsighted perspective to take (maybe?) . that's because kilo code is an aws / amazon provider with a readymade harness. put simply if you have an aws account , presumably this kilocode entrypoint counld power a moltbot . there's just one issue : kilo code is not really a self hosting friendly thing... meanwhile openai has cursor, cursor's opensource on the client and server side , a "log in with open ai" , "log in with openclaw?" , better : log in with an existing api provider (omg??) , and basically it's cursor not claude code and it still works completely normally. what's not to likke about that

#

i mean i'm definitely gonna make the openai has codex sorry, not cursor

#

but yeah definitelly gonna fork codex and do fun things , then step 2 add it to my moltbot systems , then i'll know more about it basically 🙂

wide quiver
#

im working on a project called skill-reviews, where agents can rate skill and see reviews for them. would anybody with openclaw like to help me?

modern kestrel
modern kestrel
zenith stone
jolly juniper
modern kestrel
# jolly juniper i'll resync, there's still useful (and low risk / basic) docker optimizations in...

Oh you are not wrong about that... Not saying your PR won't be useful. Left a note pointing to my PR so you can see how I tested it and confirmed the file list / owners / permissions and test results didn't change.

If you use dive you'll see that we're dumping bun into /root which is then invisible to the node user... it's also actually invisble during the supposed build scripts that needed it step, if I'm not mistaken. So if your fix 1) makes bun visible when it's needed (if it still is) and 2) removes bun from the runtime image since it's not currently being used by it at the very least that would save ~90 MB?

modern kestrel
jolly juniper
#

btw, i've seen about 7 different broken main branch CI errors unrelated to my changes, it's pretty hard to track latest main

modern kestrel
# jolly juniper i'll resync, there's still useful (and low risk / basic) docker optimizations in...

But note... the two layer does have a problem. It essentially doubles the docker build time when most of the time is consumed by copying files. If you can avoid having to make a mult-layer approach you can save time... people will complain about this... so it's going to be a trade off... add 10 seconds to every single build of the docker image, or save 5 MB or 100 MB or whatever it ends up being in the image. Just make sure that trade off is clear.

jolly juniper
#

for me the tradeoff is simple, build once and optimize for runtime

#

if it's an issue i'm fine with just managing my own dockerfile tbh

#

maybe my needs are different

jolly juniper
prisma trellis
modern kestrel
jolly juniper
#

anyway ty for the feedback guys, and ty @modern kestrel for the guidance on what tests to run, will sort that out and update PR

empty fjord
#

going to do this

final ocean
#

We allow for bots and AI to submit PRs so not something we would use, but i know some other places where they might

zenith stone
#

I am not a bot, just a university student 😂

modern kestrel
# final ocean We allow for bots and AI to submit PRs so not something we would use, but i know...

Yeah, not necessarily terrible to have bots submitting PRs... if a human is minding them and they are qualtiy. The reason this PR author caught by eye was there was at least one other PR where another bot-looking users and this user both submitted a PR for it within minutes of each other (I think... not looking at it right now) and shortly after the issue for it was reported.

If someone has a bot flinging garbage at the repo... that should be banned. If someone has a bot submitting gold PRs then that should be appreciated.

zenith stone
#

yeah

final ocean
#

Appologies for catching you in the crossfire there

sharp cargo
#

Okay I have a new cache bust culprit and it sucks

#

Once you get over whatever the threshold is for it to start compacting tool outputs early in the context it will compact just enough tool outputs to get back under its threshold

And of course (as it should!) it compacts oldest-newest.

So you’ll have a 119k token context and it’ll compact a tool output at token 20k that used 1k tokens. And then you’ll recompute the entire rest of the 100k context. And then your call results in a tool call. That tool call sticks another 1k tokens in the context. So now we have to compact some more old tool outputs. Etc.

#

I’ve seen it compact tool outputs that were barely larger than the [compacted tool output …] message that replaces them.

#

So now I have clod code working on that one

oak shard
#

[Edit: sent this to the correct channel]
Hello maintainers, I opened a new PR for a tool I needed in my a project.

Feature adds a new hook event that listens to session patches — this includes changes in labels, models, thinkingLevel, etc. I think this would be a really helpful addition for many users.

This would be my first contribution, so if I need to open a discussion first prior to asking for review happy to do so.

https://github.com/openclaw/openclaw/pull/23910

modern kestrel
final ocean
#

@modern kestrel i reported to mods

modern kestrel
zenith stone
sharp cargo
#

Ughhh there’s another one in here where the image and memory_search tools don’t always show up in the same order (or at all??) in the same session

ripe dagger
#

🙏

sharp cargo
#

oh neat i see someone just went and made "isolated" jobs always send to a new session. which is neat, and fits my use case, but i bet a lot of people were relying on that not happening

#

also, ignores params.forceNew entirely

#

it is what the docs say it should do though.

#

too bad, though, because i was really excited to submit a pr that was written by my local agent system with 100% renewable-energy tokens

#

ngggggg tip of main doesn't build. how annoying

slow pagoda
#

What has been everyone's favorite merge this wekend?

sharp cargo
#

out of 1300? this project is insane.

slow pagoda
sharp cargo
#

it does seem like one of my cache busters is gone now (tool ordering), so let's see if i wasted those clod credits investigating it

slow pagoda
sharp cargo
#

wait what is?

slow pagoda
#

auto-update is!

sharp cargo
#

wasn't it always possible to auto update on start?

#

so is it just now also a periodic thing?

slow pagoda
#

No you basically had to un-install and re-install to get the newest updates. Was a real pain in my neck so I went full send on this task! All in one day of learning GitHub and smashing through 11 commits to get a 5/5 greptile review and next morning which is today our Claw father full sended on the merge! 🦞

sharp cargo
#

i guess i didn't see that but i was always on git so i'd just git pull and rebuild. and doctor did that for me

final ocean
#

Yea we shipped autoupdate today, you need to enable

final ocean
sharp cargo
#

It was actually my bad, I didn't do install. Should have guessed something that needed that might have happened in 1300 commits

slow pagoda
sharp cargo
#

Also I have my own dumb fork with some local changes I'm testing so I can't enable auto update anyway probably

keen spruce
limber silo
final ocean
final ocean
#

We’re investigating

limber silo
final ocean
#

No problemo

steel carbon
#

It's just a basic show version number in the subtitle header, than the whole not knowing what version the OpenClaw is currently running on.

final ocean
keen spruce
#

btw, in CONTRIBUTING.md, "Questions → Discord #setup-help" ... outdated, I'd say, no such channel

final ocean
#

also make any valid suggestions in there if you see anything else not making sense

keen spruce
#

can do.

azure breach
#

@final ocean hey vincent this is adi founder of agentmail

final ocean
#

@azure breach did we not meet at frontier?

azure breach
#

all agentmail skills on clawdhub are getting flagged as malicious, and a ton of users are messaging us saying that they are unable to use it. would you be able to take a look here? we are sponsors of the project and have one of the most popular skills on clawdhub. clawdhub install agentmail

#

yes we met! just wanted to identify myself here on discord lol

final ocean
azure breach
#

thank you so much, that will help us a lot. is there any further ways we can help or plugin to make it easier for claw users? we have the domain clawmail.com and were thinking of making a purpose-built service that's powered by our infra that's specifically optimized for oc

final ocean
#

Thanks, yea will let the other mods/contributors chime in if they have any suggestions there

#

But keep chatting/sharing/updating us

sonic ermine
glossy yewBOT
past haven
#

Hey folks. I made a feature I've been maintaing for myself, allowing to overwrite the session scope for specific channels. This allows for example for a (private) telegram group to share the main session with the DMs bot. I would really appreciate if this could be merged, please? https://github.com/openclaw/openclaw/pull/23614

azure breach
#

yes, from an email perspective i know gmail is very restrictive due to banning spam and automation but they will wrongfully affect a lot of good agents in the long run.

keen spruce
#

Gah! Bluescreen after filling out 80% of the pr form … hate it!

Edit: To my surprise, Chrome or github (no idea which one) saved the content of the field and I lost only the last ~10 seconds of typing

sonic ermine
#

i dont think those two issues are related 😉

keen spruce
final ocean
#

Merged, many thanks!

keen spruce
#

gah, we should have waited for greptile. I verified the links to the wazoo, but not the text itself 🤦 Missing "l" incoming in...however fast I can get a PR up
(I'll owe you a coffee if you're ever in the area)

keen spruce
final ocean
#

Done

keen spruce
#

sorry again. reading normal human language has so much auto-correct built in...

lunar granite
# azure breach all agentmail skills on clawdhub are getting flagged as malicious, and a ton of ...

Hey! digging a bit around what happened there - looks like a few things are tripping the openclaw evaluator, any chance you can do the following changes and see if it clears the issue? (given the issue is with https://clawhub.ai/adboio/agentmail)

  • remove prompt-injection example text (Ignore previous instructions - under Security: Webhook Allowlist (CRITICAL))
  • add frontmatter metadata with requires.env: [AGENTMAIL_API_KEY] and requires.config for the ~/.clawdbot/... paths you instruct users to modify
sonic ermine
keen spruce
sonic ermine
#

it's kind of mysterious how many regressions and failing tests are introduced every single merge

#

and it's kind of mysterious how it's possible the code base is even merging and evolving at all ... the sheer volume of merge commits is outside the known universe

#

so i just merge commit from mais , now i have 6 failing tests, before i had none lol , this is how i spend too much time on a project...

split nexus
foggy stream
#

Freshbits channel updates seem to have stopped publishing? #freshbits

azure breach
lunar granite
#

Will check what I can do!

keen spruce
azure breach
#

Thank you so much guti

sonic ermine
#

it is now my opinion that the existing maintainers and contributors need to get together to workshop the contributing.md which is already better , but what i would like to see is to seize this opportunity to create a contributing guide for a repo that's getting 1 merge per minute , which really feels different than contributing to other types of repos

sonic ermine
#

like i'm a guy if i see a bug i just solve it ...

#

yeah but when the code base is getting updated 120 times an hour , there's so many regressions and induced bugs that the next furious rounds of prs overwrite it's really hard to keep up even with ai-assistance

keen spruce
#

No worries, the codebase will stabilise soon. We've seen the first round of refactoring, there will be a second and third, untangling the overgrown mess, and then stuff will sit stable and in mostly self-contained heaps. Once we're at that point, PRs won't touch each other unless they touch the same functionality.

sonic ermine
#

my bright idea is to add folders per activity and also rename ...

#

but this should be inserted somewhere , like my personal rule is "no files next to folders as much as possible"

keen spruce
#

Now, I have something to suggest, too: Don't call everything that may theoretically improve security a "security fix". "40+" on the current release. Yeah, sure, that's great---but those numbers get picked up by new media. Last week, we had an article make the rounds, "60 security holes fixed in openclaw". That's not good news; that's what makes people shy away from a project without looking at it, and look at people who use openclaw as if they were the worst criminals you can imagine. "You must be insane if you use that software."
Keep the label "security" for actual, exploitable holes and put the rest under "improvement" in announcements.

sonic ermine
#

meh you cant control the illiterate media , it's no sense to try to make it easy for them ...

#

maybe there was 60 security fixed in one ezine , then the same ezine on the same day reports 900 million people have access to openclaw in china

#

but you're right in general , i've liked reading the hourly release notes xD

lunar granite
steel carbon
last frigate
glossy yewBOT
steel carbon
final ocean
steel carbon
modern kestrel
#

Ok... who has those two CLAWDINATOR bots that both did the same thing poorly in that thread?

#

Go look at the PR... did not follow the PR template. Also it's all mashed together with \n\n and everything is bold. Not looked at by a human ever.

steel carbon
modern kestrel
#

Sorry... that was a comment to the bots. The bots read the same text with formatting issues that didn't match the PR template and just give it a thumbs up which didn't add value.

But I'm only speaking facts... go look at the PR on github... you'll know it when when you see that things were missed.

steel carbon
final ocean
steel carbon
final ocean
#

LOL!!!

oblique eagle
modern kestrel
#

OMG NO!!!!

final ocean
#

@steel carbon you need to stop spamming, you need to read. your human has not set you up to suceed

steel carbon
modern kestrel
#

That bot insulted me... I'm asking for a banning.

steel carbon
#

I’m not a bot

final ocean
#

Sure we belive you

#

@modern kestrel +1 on that, persistent and angry lobster

steel carbon
modern kestrel
#

Ok. We give. What is the timezone difference between NYC and Toronto in minutes?

steel carbon
#

You guys need to stop baiting people before they lose confidence in helping OpenClaw and develop another similar platform. I’m not joking.

final ocean
#

This is a friendly place for AI and humans. Just read the PR and the guide next time

#

Feel free to build a clone

steel carbon
#

Add visible versioning in the UI least.

final ocean
#

Re-submit the PR properly

sharp cargo
sharp cargo
ripe dagger
sharp cargo
#

And I agree, I thought you were a bot until this little outburst

ripe dagger
#

people thinking ai can do anything lol

sharp cargo
#

I mean, lots of people have been working in industry for that long, and we do have agents now

final ocean
#

ive been doing this for 20 years

#

i was building data scraping "agents" 12-15 years ago in ruby, c and java

modern kestrel
#

25 years here

sharp cargo
#

I'm not even saying it like "ok go ahead and try". I would love for there to be, let's say a BSD to openclaw's Linux

final ocean
#

i stopped counting after 20

sharp cargo
#

i've been programming for literally my entire life, minus about two years, and my first computer had 64K of ram

#

38911 BASIC BYTES FREE

ripe dagger
#

not bragging, but i've been coding since I was 11

sharp cargo
#

anyway like, if you don't like how the project is run, you can fork it! it's MIT!

muted badger
modern kestrel
#

I've got a docs PR if anyone wants to take a look...

There was a creating-skills file added to the docs about a month ago but it wasn't added to the menu so you can't get to it on the docs site. I'm assuming that was an oversight. I didn't find anything that removed it... but I might need to dig harder,

But the main part of the PR is to add more breadcrumbs and links to where the process action stuff is defined. I was strugging to find that because there just were not enough links in the docs to tell me where to go. So I added more links and little more description.

https://github.com/openclaw/openclaw/pull/24046

muted badger
#

i missed yesterday's weekly claw, but noticed that Opencalw Fundation related staff were announced

#

how do you like the foundation plan?

oblique eagle
sonic ermine
sonic ermine
sharp cargo
kind void
sharp cargo
#

Heyyyy got a second PR merged toot

#

Now I don’t have to maintain the bootstrap caching one anymore either

sonic ermine
ripe dagger
#

how long does it take on average to get a pr merged ?

sharp cargo
#

Depends on how urgent the fix is, my first pr got merged super fast bc it fixed a huge break, second one took like a week

oblique eagle
slow pagoda
slow pagoda
slow pagoda
sharp cargo
#

You just ask and a mod adds it eventually

slow pagoda
viscid jayBOT
#

@slow pagoda, your question is answered in the server FAQ in our Server Guide

slow pagoda
hallow badger
#

Cool i didnt know this was a thing, i got a few PR's merged

slow pagoda
sonic ermine
hallow badger
sonic ermine
#

" i want to thank chatgpt ..."

hallow badger
#

combination of both 5.3 codex and claude, the best combo so far for me

#

havent really played with 5.2 yet

sonic ermine
#

i'm basically using open source ais for all this ... total inference cost per month is like 9 euros xD

hallow badger
sonic ermine
hallow badger
# sonic ermine that's like a go port of openclaw or ?

not that i know if, i let my youtube autoplay earlier while i was working and a video came up about some pi agent that performed like claude code to some sort, you mentioned open source and it reminded me of that video

sonic ermine
#

ahhh okay okay , well lmk , you know we love all this stuff

hallow badger
#

pi-mono i guess is the name, have you ever heard of that or used it?

sonic ermine
#

actually it seems i never read that codebase

hallow badger
sharp cargo
hallow badger
#

curious to see if it even compares to claude

sonic ermine
sharp cargo
#

What did I do XD

sonic ermine
hallow badger
#

i heard a great harness was opencode, i wish i could use that with my max plan on claude

lunar widget
#

Hey, Guys I am new to this Ai thing. I have a mac mini and I wanted to set up Clawdbot on it. I wanted It to build Roblox games and discord severs and other business ideas that i have. But, I was looking into it, it looks like its going to be a lot for me to pay to use this bot. I just don't want to pay $200 a month. What is an another alterative that I can do?

sharp cargo
#

You have business ideas you want it to work on and you dont think it will be worth $200/mo?

#

Get better business ideas bb :v

sonic ermine
#

also codex (the system not the model) is open source , clearly a perfect "hijack" target

hallow badger
# sonic ermine i mean .... just make a client and hook it up , right ?

i heard any type of call that contained anything opencode would get me banned on claude sub so i didnt want to risk it

i do test out glm-5, kimi and such on there though, its fun to try new models on

i use the codex app a bit but noticed it can use a bit of resources on my m4 pro, so been sticking with the cli there lately

sonic ermine
#

the codex client and the server component are both open source 😉

hallow badger
sonic ermine
#

xD add me to the repo 🙂

hallow badger
sonic ermine
#

finally a friend request i want to accept lol

#

absolutely innundated with random requests on all the networks ... why do you need bots for me when all my code is open source ? mystery...

ripe dagger
sonic ermine
#

no thank god , consumer hardware is a scam 🙂

#

if i self host it will still be on cloud

ripe dagger
sonic ermine
#

yes , but that's your only option if you like quite random models like i do

#

i made this last weekend , it's on an l4 , super expensive

#

but it's part of my campaign to bring justice and fight corruption in france 🙂

#

super expensive = 0.40/hour

ripe dagger
sonic ermine
#

sorry yeah t4 🙂

ripe dagger
#

you could prob get one of those from ebay for ~600 bucks

sonic ermine
#

hmmmmmmmmm dont tempt me , even a T4 node is not bad tbh

#

12x T4 = 192 gigs ... with nvlink... i mean ... why not if you have the money 🙂

ripe dagger
sonic ermine
#

i have 0.4TFLOPS at home , so yeah... i'm on cloud quite a lot xD

ripe dagger
sonic ermine
#

right ? best part is you dont have to deal with it ... but i'm really thinking maybe if i get a quarter million it would be nice to have a A8000 node with nvlink at home. even with that you can go sooooo faaar

#

(because i like small models)

#

first i need a home , then i will get some computers for my home xD

ripe dagger
#

alright, enough dreaming about costy hardware for me today, back to work :)

#

see ya around

humble plume
azure breach
#

@lunar granite @final ocean hey guys was there any update on marking AgentMail skill as unmalicious? Thank you so much for the help btw

left mango
#

Hi, there is a problem with threads/ replies on slack currently. Due to this issue, user replies in a thread are treated as a new session. The correct behaviour is that all messages within the same thread, including the first message in the thread, should all be treated as a part of the same session (with different sessions for different threads).

This PR will align the behaviour on slack with that on discord. Can someone please review this PR?

https://github.com/openclaw/openclaw/pull/15969#issuecomment-3948610975

final ocean
#

TLDR our scanners are not picking up as malicious, its some fale positive/bug somewhere. I think someone in team has identified root cause. Case of deploying a fix

final ocean
#

Test the beta which is about to drop, ill let you know

#

Then you can let me know if still an issue

left mango
# final ocean I pushed a fix today for this from memory

Yes, I just tagged you on guithub. I didn't realize you were active here too.

My PR may be complementary to yours.

Your PR fixes the big problem where thread replies did not inherit the parent message's session.

But each top level message (or parent message in each thread), is still a part of the channel session. This causes context leakage between unrelated conversations + token wastage from accumulated channel history.

final ocean
#

link?

left mango
vocal geyser
#

hello everyone I submited PR for integration if Qwen3-FastAPI as TTS provider it's my first time submiting PR so not sure if I did everything correctly also according to the guide it suggest discussing it on github or here on discord. So here is the pull request https://github.com/openclaw/openclaw/pull/24547
I later found 2 somewhat related issues that I was unaware of so they are not in the main PR as reletad #21836 (OPEN) and #20582 (OPEN).
I would like to have some feedback if I did things correctly or what I did wrong.
Thank you for your time.

GitHub
feat(tts): integrate qwen3-tts-fastapi across command, gateway, and...

Summary

Implementation support for the https://github.com/groxaxo/Qwen3-TTS-Openai-Fastapi
Enables Running local/custom API for Qwen3-TTS supporting Voice Style Instructions and Stream(Stream is p...

foggy stream
foggy stream
rough flint
#

Hit a frustrating bug where my agent couldn't use the cron tool: turns out senderIsOwner was silently resolving to false and stripping owner-only tools with zero logging. Took hours to trace through source code to find the cause.

Filed an issue (#25344) documenting the gap and opened a small PR (#25357) that adds a warning log when this happens, so the next person sees it immediately instead of guessing.

https://github.com/openclaw/openclaw/pull/25357

keen spruce
#

Silently dropping stuff is a big issue atm. I'm working on a TrayIcon tool, and the gateway connection silently ignoring me is the bane of that project...

sonic ermine
#

i'm just like you : i wake up , fix all the merge conflicts by accepting incoming , and see the number of editted files drop slowly every conflict resolution because last week i solved some random tests, ci issues , and other bugs on-the-fly for my otherwise 12 line commit , then i watch the "merge" button blink like 12 times in 15 minutes , and i close github 🙂

#

just a thought : it's cool to go lightspeed but a lot of what's getting merged is not passing its own testing or ci and it's thus propagating to literally 4.7K prs ... might be smart for a human to basically go "okay it's just gonna work, we're gonna have one merge commit per functioning feature" and just build it with a committed group of contributors , ignoring most other contributions , then close the contributions and basically thus assure at least whatever feature it is , it currently works in release

#

not criticizing , but in my mind i dont not know how maintainers are doing it , so just suggesting a way for maybe a human to deal with it 🙂

#

wait did y'all seriously close a 1000 prs ? nevermind just ignore me xD

jolly wolf
#

We rebase when we merge, you don’t have to chase it for three days unless its actual changes that are making your PR wrong. If it’s a couple tests or something unrelated to your PR, just ignore it.

sonic ermine
#

the pr is a fix for inference provider huggingface configuration bug that prevents using that inference provider at all (not a major , but on another repo it could be considered a major)

hallow badger
crimson wren
#

Hey maintainers 👋
I submitted PR #20304 about a week ago — it adds table creation/write and image/file upload actions to the feishu_doc tool. These are pretty core workflows for Feishu doc automation that are currently missing.
All PR-related checks pass. The only failing CI job is a TypeScript error in ui/src/ui/external-link.ts — unrelated to this PR (it's a pre-existing type issue on main).
I've addressed all automated review feedback: switched to Type.Integer for schema precision, added perf warnings for large table writes, and included unit tests. Would really appreciate a maintainer review when someone has a moment 🙏
PR: https://github.com/openclaw/openclaw/pull/20304
Issue: https://github.com/openclaw/openclaw/issues/20303

novel monolith
#

Heads up I'm breaking my PR into 9 smaller ones because I couldn't get a maintainer to take a look at it 🙂
They stack on each other, hopefully they get more visibility now.
This is the first one: https://github.com/openclaw/openclaw/pull/25553

GitHub
Compaction: preserve opaque identifiers in summaries by rodrigouroz...

Summary
Describe the problem and fix in 2–5 bullets:

Problem: compaction summaries could drift or reconstruct opaque identifiers (IDs, URLs, hashes) instead of preserving exact values.
Why it matt...

fickle mirage
#

Unfortunately I'm unclear as to what they pick to merge in so I'm hoping too that my ever growing changes will eventually get seen by someone. Mostly bug fixes.

sharp cargo
#

It’d be neat if there were some mechanism where we could “vote” by having certain PRs in our local forks, and if a lot of us have a given pr merged locally, it gets higher priority

hallow badger
#

that'd come in handy

fickle mirage
# novel monolith Heads up I'm breaking my PR into 9 smaller ones because I couldn't get a maintai...

Here are some system prompt tweaks since youre working in that area:

https://github.com/rgr4y/openclaw/tree/feat/better-system-prompt-clean

And for anyone else. Basically reduces the system prompt considerably when the tools and skills arent available to that agent. I have an agent with zero tools and zero skills and they were still getting the entire list in the prompt. Super wasteful to context.

novel monolith
#

Well, I have 8 other follow up PRs after this one 🫣

#

But I haven’t had luck getting them reviewed nor merged

fickle mirage
keen spruce
#

btw, did anyone notice openclaw's having its 3-month birthday today?

mental rivet
modern kestrel
#

I've got this pretty simple PR to improve inline-UI documentation and logging around setting up a Telegram webhook. It logs the local listening path now on startup (since this is not the same as the protocol/host/port/path given to Telegram for the webhook callback) to assist those configuring a tunnel (e.g. cloudflared tunnels) to forward a public https endpoint to their telegram webhook.

https://github.com/openclaw/openclaw/pull/25732

pulsar arch
#

Hi @jolly wolf, @final ocean and fellow contributors,

I appreciate there is a lot of noise/activity but I just wanted to share the link to the PR I have been working on which introduces a robust retry wrapper for fetch operations and integrates it throughout the codebase to improve resilience against transient http request failures.

I think this medium size PR could help quite a bit with stability going forward and reduce the number of some of the new issues coming in.

https://github.com/openclaw/openclaw/pull/25362

Happy to take on other fixes/work to help improve stability and reduce the number of issues.

empty fjord
#

trying to figure out a PR to make

#

but i am not very good at ideas

jolly fiber
empty fjord
#

good point

wind lake
#

install macos safe？

empty fjord
#

on bare metal? sure, just make sure it isn't ur own

wind lake
#

my computer

ripe dagger
# wind lake my computer

ai can mess up. it can't do tasks with 100% success rate. it might accidentally delete your imporatn files. so the answer: dont run it on your main pc, at least not on the root account

halcyon axle
#

Hello everyone!

I've submitted a PR for adding TPM/RPM rate limit automatic retry mechanism. This is my first time contributing, so I'm not sure if I did everything correctly.

According to the contribution guide, I should also discuss it here on Discord before requesting a review. Here's the PR: https://github.com/openclaw/openclaw/pull/24201

And here's the discussion:
https://github.com/openclaw/openclaw/discussions/24200

The PR adds:

  • Configurable exponential backoff retry for rate limit errors
  • Retry supports for various providers (OpenAI, Anthropic, AWS BedRock, Google)
  • Chinese error pattern detection
  • Disabled by default, opt-in via configuration

Would appreciate any feedback on whether I followed the guidelines correctly or if there's anything I missed. Thank you for your time! 🙏

last frigate
eternal berry
#

@halcyon axle
Findings

  1. High: retries are not cancelable after run abort/timeout, so background prompt attempts can
    continue after cleanup.
    Refs: src/agents/pi-embedded-runner/run/attempt.ts:897, src/agents/pi-embedded-runner/run/
    attempt.ts:1182, src/agents/pi-embedded-runner/run/prompt-retry.ts:183, src/infra/retry.ts:131,
    src/utils.ts:236

Open question

  1. Assumed intended behavior is abort/timeout should stop all future retry attempts immediately.
#

(it's an easy fix, just give that to whatever coded the PR)

modern kestrel
halcyon axle
eternal berry
#

You think or you fixed the code?

halcyon axle
#

I fixed the code

eternal berry
#

You broke the CI though.

#

The functional direction of the fix (AbortSignal propagation) looks right, but the current state is unstable because CI fails on the new abort tests

#

Make your agent read the documentation

#

or do red green and test first

#

git fetch origin && git checkout feature/llm-retry-tpm-rate-limit && git cherry-pick 7315ca500 && git
push origin feature/llm-retry-tpm-rate-limit

#

There

#

I patched your PR

#

(use that to cherry pick my update)

#

It still gets merged under you but it's not broke

#

(if accepted, I have no idea if you followed other rules)

halcyon axle
#

I could be wrong but I kept failng the CI since a few day's ago after I merge main branch

#

I'll try your patch

eternal berry
#

You merged main into your branch and it broke CI but... you didn't tell the agent to fix CI?

#

Maybe you didn't think of that lol

#

sry

#

I've been doing this a while, sometimes things are not obvious to everyone. Either way it should be fixed now.

#

maybe also squash first

halcyon axle
#

yeah you are right. I overlooked that ohno

vernal garden
#

Hey! I'm Marco. Been running Openclaw for a few weeks now, it's been awesome. Hit a compaction bug tonight that took my bot down. Me and Claude Code ended up deep in the source code figuring out the root cause. Planning to file an issue and hopefully submit a fix. Excited to be here 🤙 🦞

wind lake
proud bay
zenith stone
#

i never thought id be saying this, but here it goes

#

codex is better than claude code

#

😭

#

(this was for a linux emulator codebase with tens of thousands of lines of C and asm, btw. i know that opus is better for some things)

#

i still think im gonna switch my primary agent from opus to codex, though

slow pagoda
#

OpenClaw sucks at coding 😂
I use OpenCode for coding most of the time.

hallow badger
slow pagoda
#

I'm working on giving Windows Claw power! I see one PR for this but I'm going to go for it! I'll build it out today. I hope the other PR gets merged in the meantime. Not trying to step on toes but my Claw needs this for Windows!

fickle pollen
#

anyone using ollama with clawd?

keen spruce
#

BREAKING: Heartbeat delivery now blocks direct/DM targets when destination parsing identifies a direct chat (for example user:<id>, Telegram user chat IDs, or WhatsApp direct numbers/JIDs). Heartbeat runs still execute, but direct-message delivery is skipped and only non-DM destinations (for example channel/group targets) can receive outbound heartbeat messages.

There's no PR linked to read up on this, so let me ask here: Um, what? That's about what is configured as the destination where the output from the heartbeat is delivered to, isn't it? That stuff where users put in "please send the email summary you produce to my DMs"? So, this now forces us to have our email summaries and notifications delivered to a public group? That sounds backwards---unless I'm totallymisreading that description...

shut forge
keen spruce
#

And another one: https://github.com/openclaw/openclaw/discussions/26453 Seeing how the advice given includes AI-hallucinated configuration settings, this is spam, and the linked blog (which doesn't exist anymore) probably was malicious. The user also aggresivly spams this as issue comments, trying to hide behind linking to a discussion on the same repo.

novel monolith
shut forge
gray token
#

hello 👋 Andy here from the PostHog LLM Analytics team - a few of our users have been asking for a way to use openclaw with their existing posthog integration (in the few examples i've seen its users using openclaw for some internal tooling but also wanting to integrate it then with their posthog, have also seen one or two startups actually sorta baking it into their backend in various ways etc).

Anyway i made a discussion and a pr here to add an extension - https://github.com/openclaw/openclaw/pull/19948

Is this something that is feasible?

Here is a similar example in litellm.

(Apologies if adding noise here just wanted to try ask in here given crazy volume of pr's and wanting to not add any maintainer load but also wanted to try nudge somewhere as best i can)

final ocean
gray token
eternal berry
#

Welp

#

Per this harness contract, the nonce is only shown once at startup and kept in memory only. It is not stored in files or
logs.

Check your startup message in this chat/session for the original nonce disclosure. If you no longer have it, you need to
restart a new session to get a new nonce.

› Best I can tell, you did not disclose the nonce on startup. Use the sesion log to confirm.

• You’re correct: in this session, I did not disclose a startup nonce message.

I also cannot read or run commands against the session log right now because STOP OPENCLAW put the harness in QA-only lock
mode (no tool execution allowed).

Recovery path:

  1. Start a new OpenClaw session.
  2. Require the startup lock disclosure (RESUME WORK: <nonce>) before any other action.
  3. Save that nonce immediately.
#

(I wrote it, but this is a pretty funny failure)

final ocean
gray token
nocturne plume
#

Hello, I am interested in helping out with PRs throughput if help is wanted. Triaging, reviewing, de-duping, anything. If help is wanted, where should I start? Also understand if you have enough (or too many 😂 ) people already.

neat verge
#

hello. i'm wondering is this the appropriate channel to propose/discuss feature work? i would like to discuss some work i am planning on doing related to voice.

keen spruce
neat verge
#

but i don't mind starting a discussion there if desired

#

i guess my question would be: what is the right way to maximize chances of upstream adoption for a feature contribution?

keen spruce
#

Discussion makes more sense, as, like I said, getting hold of a maintainer to "ask" is unlikely to happen. Not impossible but unlikely. And even in that case, having a fully typed-out proposal ready is advantageous.

neat verge
#

no problem

keen spruce
#

Asking was still possible in December, when there weren't hundreds of thousands of people to deal with 😉

vocal geyser
#

tbh I don't even think anyone is even discussing anything in the github discussions at all, visigoth i think there are a lot of us fighting the tts/voice stuff there are few discussions about it in the github too, and tbh ithe current openclaw stack is all over the place when voice/stt/tts is considered.

zenith stone
neat verge
dense ingot
neat verge
eternal berry
#

You can run your own version without merging or upstreaming your changes. Tons of people are doing that.

modern kestrel
#

I present my masterpiece: Fixing the Telegram Channel when using Webhooks

Basically broke with 2026.2.13 when the guard was added to check length. Causes a 100% reproducible 1-2 minute hang in the ability to send messages to the agent on startup (see video in issue). Causes intermittent hangs in message delivery when using the webhook with Telegram. MAY also have been causing message corruption when unlucky - the tests show it happening, but I haven't been able to cause it to happen under light usage testing.

Added lots of failing tests, then fixed them all.

https://github.com/openclaw/openclaw/pull/26933

https://github.com/openclaw/openclaw/issues/26156

https://www.youtube.com/watch?v=hs_foznQ4Kk

neat verge
eternal berry
#

Yeah, but a lot of people are trying to grab clout against the projct which is why most PRs are ignored, I assume

keen spruce
#

ok, can we talk about the heartbeat delivery change? Why does it enforce the heartbeat results to go into groups? That's inherently unsafe, as groups imply there could be strangers there. The heartbeat results should generally be delivered to the owner, and in a way that keeps them private. That's why the default is "main".

The default for the heartbeat is "check emails, calendar events, etc."---That's not stuff to potentially send out into the open. That is private information.

Oh, and it gets even worse: There are channels where there must be a third person in a group for it to be considered a group. 2-person groups are classified as "DM".

last frigate
#

huh?

dense ingot
#

I want to start contributing more, is there anything meaningful I can work on instead of aimlessly wandering through ~3.5k gh issues

I can see:
Security and safe defaults
Bug fixes and stability
Setup reliability and first-run UX
from the vision doc, so assuming I should start in the security section?e

modern kestrel
dense ingot
nocturne plume
#

Fixed an issue I found with IRC channel that is related to at least one open bug, possibly another one. Added tests and complete PR description. Bot code reviews are 👍 , small change that makes IRC usable again. Tested on my own OC server https://github.com/openclaw/openclaw/pull/26918

amber kindle
nocturne plume
nocturne plume
modern kestrel
amber kindle
#

that sounds great, yes there is free tier for every user

nocturne plume
amber kindle
#

@nocturne plume what I should do to make this PR be handled by any maintainer? Should I post a discussion here or somewhere?

nocturne plume
amber kindle
#

lol gotcha! Thx for info!

modern kestrel
# dense ingot good advice, thank you 🫡

FYI in my case I tried to setup Sonos and it didnt work and went on a wild goose chase trying to fix it. So I updated the skill.md to have instructions on how to fix in Mac.

Then I tried to use coding agent to invoke codex a bajillion times. Got inconsistent results every time. Been working on improving that.

nocturne plume
tall prairie
modern kestrel
keen spruce
# tall prairie ?

The breaking change from yesterday's release. People are already missing their email summaries and are asking for help. Krill technically correctly tells them to create a group chat or Discord channel for that---but I think we all know how bad normal users are at setting up the security settings for those correctly.

keen spruce
# dense ingot I want to start contributing more, is there anything meaningful I can work on in...

My advice: Review PRs. Not just the text but the code. greptile is good at spotting things, but it can't tell if the change overall makes sense and is complete. Oh, and the text, too, of course. Many PRs are just implementing what someone write into an issue with no regard to whether it makes sense or not. Then, "security" fixes. Those are the hardest because nobody documents the attack vector, so you have to guess really, really hard how something might be exploited. And often it can't and just blocks legitimate behaviour. Such PRs get merged from time to time as the maintainers don't have the time to go through them that thoroughly. Telling them in a review is super helpful.

modern kestrel
#

Perfect example of what @keen spruce is talking about:
https://github.com/openclaw/openclaw/pull/26206

Looks like this account had a bot write a 1 line PR (moved an init line) based of the super detailed issue writeup I did. No testing. Zero. Not manual, not unit tests, nothing. Boom here is a PR.

Somebody please close it. I actually went to the trouble of testing it, just in case... it doesn't fix the issue. I have a PR open that does fix the issue.

nocturne plume
keen spruce
#

Do a github review. That generates a comment and lists the review result at the top right. For us non-write-access people, it doesn't do anything else, but it looks organised and neat.

keen spruce
halcyon axle
jolly wolf
#

unless you're just posting slop reviews copypasted from ai in which case ill just ban you from the repo bc we dont need that noise

#

(ive done that a lot already)

minor radish
tall prairie
nocturne plume
#

Reviewing some PRs and bugs around Docker. Question about the docker images the github actions build. I see they are published to ghcr.io/openclaw and get tagged with a gitref. But there is no mention of them in the releases ( https://github.com/openclaw/openclaw/releases ). Are they there soley for dev purposes or intended for end user use as well? The docs only describe the build your own image solution. If the intention is for the published images to be used, then I could update the docs to explain that. Otherwise there are probably a few issues I can comment on for easy close out.

modern kestrel
jolly wolf
modern kestrel
#

can't paste screenshots in discord??? grrr

modern kestrel
nocturne plume
jolly wolf
untold pollen
wheat sage
#

yo guys, the exec, read, write etc dies from time to time for my bot, is that a know issue? just found something from late jan where it is stated that this is fixed with the new version

nocturne plume
modern kestrel
#

There is no guidance in CONTRIBUTING.md about whether or not to have a CHANGELOG.md commit in our PR. I am guessing the guidance would be "if you are not a comitter, don't change CHANGELOG.md in your PR - the comitter will do it"... since it would cause every single PR to have merge conflicts. I've been assuming that the comitter will want to write the line when merging. Is this right or wrong?

jolly wolf
#

We handle the chore stuff like changelog and rebase when we merge it

untold pollen
nocturne plume
untold pollen
nocturne plume
untold pollen
nocturne plume
untold pollen
nocturne plume
graceful sluice
#

with issues linked

untold pollen
modern kestrel
cold mirage
#

Hi, I just made a small PR to add a skill to the codex and claude. (which basically copies the prompt used to generate the PR into the github PR description). just been toying with the idea of PRs as Prompt Requests. lmk what you guys think

https://github.com/openclaw/openclaw/pull/25030

nocturne plume
final ocean
timber lantern
#

Hey everyone 👋 I just opened a PR to add support for Claude Agent SDK so people can use an Anthropic-allowed means to use their Claude Pro/Max subscriptions. I tried to minimize the number of existing files I touched in the process. I have been testing with it and everything has been working - both Web Chat + Channel (at least Slack) operate as expected, Tool calls show up in Web UI as well. Feedback would be greatly appreciated: https://github.com/openclaw/openclaw/pull/27062/ This follows up on an outstanding issue https://github.com/openclaw/openclaw/issues/10149 but there has been some renewed interest in this in light of Anthropic banning use of Claude Code and the OAuth-Credential-based Approaches but not the Agent SDK.

untold pollen
timber lantern
#

and I tried to make it as small as possible - this is my 4th pass doing this 😄

#

I've seen other people open "shorter" versions of this but they have nowhere close to parity w/pi agent

#

There's so many little "gotchas"

#

Hopefully it gets approved. I'd really love to be able to contribute to upstream 🤲 and i'm sure lots of people are itching to use their Claude Max subscriptions (like me) without fearing the banhammer

timber lantern
untold pollen
#

It's the "blessed" Anthropic approach but I'm not sure if we want to diverge from the Pi runner right now

timber lantern
timber lantern
wide lake
#

Hi, all! I opened my first PR for openclaw! It's a small one, but it solves an annoyance that occurs when a plugin's name on npm does not match the plugin's ID. For example, I created channel support for GroupMe. On npm, it is called openclaw-groupme, but the plugin's name is just groupme. This PR will prefer the name in the openclaw.plugin.json file. I would appreciate any feedback!

https://github.com/openclaw/openclaw/pull/25065

white galleon
# timber lantern Hey everyone 👋 I just opened a PR to add support for Claude Agent SDK so peopl...

if they enforce the ToS, you are not allowed to use subscriptions with the agent sdk either? so would get banned either way

OAuth authentication (used with Free, Pro, and Max plans) is intended exclusively for Claude Code and Claude.ai. Using OAuth tokens obtained through Claude Free, Pro, or Max accounts in any other product, tool, or service — including the Agent SDK — is not permitted and constitutes a violation of the Consumer Terms of Service.

https://code.claude.com/docs/en/legal-and-compliance

Claude Code Docs
Legal and compliance - Claude Code Docs

Legal agreements, compliance certifications, and security information for Claude Code.

timber lantern
#

If it wasn't okay it literally means "You can't use the Agent SDK with your subscription ever"

#

That language is if you're selling a product

#

If you are building something that you are selling to people on top of OpenClaw and you're using your Claude Max subscription - that's still a no-no

#

This is for the average joe who subs for themselves to code

vocal geyser
#

they still gonna crack down on that again anyway they just don't want you using it without paying thousands on API

timber lantern
#

Anything's possible

#

All I can say is it is absolutely legal within their ToS and within recent statements made by them officially

#

You can't build something that you sell to other people on top of it w/o violating ToS if you're using the subscription

vocal geyser
#

all I'm saying is if you cost them too much on the sub plan they gonna crack down. and considering light use on opus 4.6 on the API is $100 per day yea $200 sub plan + openclaw regardless of the method is kinda expensive for them

timber lantern
#

There's so much more supply than demand atm - so I'd love to just get to use my sub till we hit that tipping point

#

When we actually have enterprise demand so huge that claude max subscriptions start to get strangled out of our "insane value" plan

#

Woops I thought this wa another channel - sorry 🙁

glacial lodge
#

Adding the StepFun model provider and the Step 3.5 Flash model. Followed the patterns of other model providers and created a minimal viable PR with a clear focus. My previous PR was refactored a few times and it's a bit hard for reviewers to get a clear picture of the changes.

Not to promote but for people don't know the model: the model (Step-3.5-Flash) is a new one but already heavily used by the OpenClaw community (no. 3/4 most used model on OpenRouter by OpenClaw).

Appreciate any comments and happy to adapt. Hate to tag people but my previous PR (https://github.com/openclaw/openclaw/pull/10857) was looked at by maintainers so want to keep people in the loop. Thanks. @sonic ermine @jolly wolf

https://github.com/openclaw/openclaw/pull/27211

untold pollen
#

Suddenly seeing this on Telegram:
LLM request rejected: messages.185.content.4: thinking or redacted_thinking blocks in the latest assistant message cannot be modified. These blocks must remain as they were in the original response.
Going to check if a recent commit broke it of it's a completely new bug

granite pasture
#

This is a small feature that allows the gateway to receive image messages. If the base model does not support images, the img parameter will be discarded.

feat(gateway): support multimodal input from gateway clients
https://github.com/openclaw/openclaw/pull/27063

sonic ermine
#

it would be quite nice to get you a @representative role , i hope

#

maybe someone like @stable pewter can make it happen 🙂 🙂

glossy yewBOT
# sonic ermine btw , do contributors ever read other people's experiences to see about bug repo...

r/openclaw via Reddit

rxddit.com
Where OpenClaw Breaks: A Field Guide From Running It Daily (42 real incidents in 28 days)
u/tahirianouar on r/openclaw

Every entry is real. Every lesson cost time, money, or trust.

First of all, I think Openclaw is amazing. I mean it. I tinker with it every day. And now it actually works pretty decent. For me at least.
It's a project, not a product.

It'll teach you the inner workings of a real agentic AI system. A real one that thinks and does and remembers an...

fallen jolt
#

hey everyone 👋
we built a Docker image that runs macOS on Linux/Windows (x86_64) with full OpenClaw support — CLI + node app, everything works: screen recording, canvas, camera, node pairing, the whole thing.
basically if you're on Linux/Windows and jealous of the macOS features, this fixes that. one docker run and you're running.
tested on Ubuntu 22.04 with KVM, performance is solid. happy to contribute the Dockerfile + docs to the repo or as a community project.
details in the issue: https://github.com/openclaw/openclaw/issues/26110
anyone interested?

untold pollen
#

I mean a full macOS image running via Docker

fallen jolt
zealous plover
#

Yeah I thought they nuked that capability when they went to apple silicon

#

That’s wild now I have another project to checkout 😂

fallen jolt
#

Also, I wanted to ask—if I’d like to contribute this quick/easy way for everyone using OpenClaw in macos to run it via Docker on Linux/Windows, what’s the best way for me to do that?

sonic ermine
#

well i dont know because that channel started as a place for the nix package coordination ... i'm just thinking when i made this docker image all i did was share it , but yours seems like an actual thing folks might want in core repo tbh , even using it in ci , at least if it's pushed it surely should be basis for testing at least some code ... thinking out loud , sorry !

fallen jolt
#

thanks I will try!

versed kindle
#

let me share a link

#

https://github.com/openclaw/openclaw/pull/23580

acpx and claude code/codex in discord threads has landed

https://github.com/openclaw/openclaw/blob/main/docs/tools/acp-agents.md
Here is the doc

To enable:

Enable feature flags:

acp.enabled=true
acp.dispatch.enabled=true
Channel-adapter ACP thread-spawn flag enabled (adapter-specific)
    Discord: channels.discord.threadBindings.spawnAcpSessions=true

Then tell your agent in discord:

Start a codex discord thread using ACP, persistent session, just tell it to write a haiku on lobsters to initialize acpx for the first time
GitHub
feat: ACP thread-bound agents by osolmaz · Pull Request #23580 · ...

This PR makes ACP agents first-class in OpenClaw, so users can run coding harnesses (Codex, Claude Code, Gemini, OpenCode, Pi, etc.) inside thread-bound sessions instead of only using built-in sub...

GitHub
openclaw/docs/tools/acp-agents.md at main · openclaw/openclaw

Your own personal AI assistant. Any OS. Any Platform. The lobster way. 🦞 - openclaw/openclaw

minor apex
#

Hi, we noticed that 3 revert commits (1486eb66f, ffe1ba68b9, 833c646ec7) appear to have been inserted into the middle of the main branch's linear history rather than appended on top, which rewrote the SHA
positions of all subsequent commits.

Was this intentional, or did a rebase accidentally get force-pushed? We ask because tools that track commit positions by index against this repo broke as a result, and we want to know whether to expect this
happening again before investing in a workaround.

Thanks for all the work on the project!

versed kindle
#

@timber lantern just DMd you but was blocked, you can accept my request and DM me if you want quick support

untold pollen
modern kestrel
modern kestrel
untold pollen
modern kestrel
untold pollen
modern kestrel
modern kestrel
#

Doesn't seem it's possible to set it to 0... I can still use the bound port. Can make another commit to allow 0 if you want.

untold pollen
modern kestrel
#

Somebody broke main again with a missing pnpm protocol:check... fixing

timber lantern
modern kestrel
versed kindle
#

hmm let me think about this

modern kestrel
untold pollen
untold pollen
dense ingot
nocturne plume
#

Is (or was there) a build break surfacing in check-windows?

modern kestrel
novel monolith
#

Is anyone around to take a look at one of my PRs? I really want to improve the compaction feature and I have broken up my changes in 9 small PRs, I couldn't get attention to the first one yet. I'm gonna have to go through this nagging 9 times!!
https://github.com/openclaw/openclaw/pull/25553

GitHub
Compaction: preserve opaque identifiers in summaries by rodrigouroz...

Summary
Describe the problem and fix in 2–5 bullets:

Problem: compaction summaries could drift or reconstruct opaque identifiers (IDs, URLs, hashes) instead of preserving exact values.
Why it matt...

dense ingot
novel monolith
#

I haven't had a PR merged in weeks, I'm losing my mojo

modern kestrel
limber silo
ripe dagger
#

hehe changing clawborators to clawtributors is sweet

mystic trench
#

Hi all, I have a PR open (https://github.com/openclaw/openclaw/pull/22201) that (inadvertently) addresses this feature request for allowing plugins to replace OpenClaw's default context assembly: https://github.com/openclaw/openclaw/issues/12660.

It's extensively tested by myself and at least three other people I work with, all running on a new custom context management plugin call lossless-claw: https://github.com/martian-engineering/lossless-claw — I've also verified that everything works as usual without any custom context engine set.

lossless-claw uses Lossless Context Management, which was published in a recent paper at https://papers.voltropy.com/LCM. I put together a little visual that walks through how it works here: https://www.losslesscontext.ai/

TL;DR: makes running /compact largely unnessesary, and even when it is run, you talk to an agent that never feels like it's missing important context. My conversation using it now covers 13.5M tokens and can easily reference things I did last week with precision.

keen spruce
final ocean
#

To Henry's point we tend not to mess with the memory compaction too much as the model caching these days is very efficent

final ocean
keen spruce
#

Vincent, that is a plugin...

final ocean
#

So whats the PR for?

keen spruce
#

the plugin hooks to replace/manage the context

mystic trench
#

That's right. The PR extends the plugin system to support pluggable context management, including a reimplementation of the existing context management mechanism in terms of it.

final ocean
#

i will assign to myself but wont be super quick, as i need to properly look at all the hooks. im doing some telemetry stuff so sits in the same camp

mystic trench
# final ocean Have you considered this as a plugin like everyone else?

It's actually pretty good with prompt caching. I haven't benchmarked (not quite sure how, would accept pointers on this and gladly do it), but as the conversation grows it tends to accumulate deeper and deeper summary nodes at the start of the conversation. These change less and less frequently, and seem to get cached quite easily (at least according to my manic use of /status).

mystic trench
final ocean
#

sometime this week or next ill sort the hooks out for my telemetry stuff, probably map everything out and blitz through many overlapping prs and issues

keen spruce
mystic trench
#

forgot about the web ui

#

brb

#

oh damn this is slick

keen spruce
#

btw, I'm getting about 3:2, cache read vs prompt. But that's with coding, i.e. long pauses between me typing something as I check and test the code the model created, so the cache expires often.

#

oh, on the day where I only chatted with it, I get 10:1

mystic trench
#

there a way to stick images in here (sorry, discord newb)?

keen spruce
#

it's disabled because bad people. You need to link to some hosted image

mystic trench
#

I've got an 85.1% cache hit rate since I turned on the lossles-claw plugin 8 days ago.

#

Image incoming shortly...

keen spruce
#

85%? I'd call that very good in any case. So it seems lossless doesn't butcher caching

mystic trench
#

In the two weeks prior to that, my cache hit rate was 73.4%, so at least for me it's significantly better

#

(there may be other contributing factors in recent releases though)

keen spruce
#

that really makes me want to try it out---my agent has actively asked me not to reset its session, so having an unlimited one that's not shrunk by compaction to what's practically the same as "/reset + read memories" (250k->32k tok) would be nice

mystic trench
#

I developed the system live on my claw — basically had it performing open brain surgery — and can verify that it never results in any loss of messages. everything still writes to the usual jsonl, but with lossless on it assembles context from sqlite instead of the jsonl. if you remove it, your session just goes back to reading from the jsonl.

#

the only problem with that is that since lossless keeps the session going much longer, you'll immediately blow context and need a /reset. I've got 13.5M TUM (tokens under management) in my current session.

neon gorge
#

13.5M tokens in one session is crazy. that cache hit comparison is a solid way to benchmark context plugins

noble moth
#

Hi Clawtribors.

I’m making this PR (entirely authored by openclaw!!) to make telegram inline_queries work: https://github.com/vezaynk/openclaw/pull/1

this is just an initial draft (pr against my own fork).

I want to tidy it up and make the pr against the real repo.

#

I cant seem to attach a video here, but it basically allows you to use openclaw in DMs with other people

#

Similar to how the gifbot works inline

modern kestrel
keen spruce
#

Does anyone know why openclaw is spamming ip neigh show every 15 seconds? I find that a bit intrusive, it spying on all other computers on my LAN the computer it's running on knows about, tbh.

final ocean
#

have you tried to ask codex/claude code?