#clawtributors

1 messages · Page 7 of 1

stiff cave
reef hamlet
reef hamlet
torn tide
#

Hey I wanted to make a pr to improve openclaws macos gui contol but wanted to check first as I felt it was a New features / architecture.

fossil charm
#

Hey everyone! I've submitted a few PRs that add local LLM workstation support to OpenClaw. I'm running Gemma 4 26B, Qwen 3.5, and Nemotron-3 on a single RTX 2070 with 8GB VRAM via llama-server, and these address real gaps I've been hitting:

#63330 - Session Followup Turn API (enqueueFollowupTurn()): https://github.com/openclaw/openclaw/pull/63330
Core plugin runtime API that lets plugins schedule proactive agent turns for any session, including cold sessions. Foundation for the other two. Also includes a basic gateway_restart tool that lets the agent perform restarts and continue working without requiring a ping or a scheduled job.

#63503 - Model Switch Extension: https://github.com/openclaw/openclaw/pull/63503
Seamless switching between local LLM backends on single-GPU setups. The agent calls model_switch, the plugin stops one llama-server, starts another, verifies identity via /v1/models, and resumes the session on the new model via the followup API. Crash recovery with markers.

#63518 - Inference Guard: https://github.com/openclaw/openclaw/pull/63518
Rate-limits heartbeats on single-slot inference (--parallel 1) so they don't block user messages. Uses ctx.trigger to detect heartbeat runs and applies timestamp-based rate limiting. All three have Greptile 4/5 scores with all P1/P2 feedback addressed. The only failing CI check (check-additional) is the no-random-messaging guard which also fails on main; it's flagging pre-existing violations in files I didn't touch.

Would really appreciate feedback from anyone working with local models or self-hosted inference! Happy to iterate on any concerns. If you find these interesting, I have many more on the way! I am willing to make adjustments to these to get them merged into main!

torn tide
#

Cool I will take a look!

pallid summit
torn tide
#

Sure! Can you take a look at my idea.

torn tide
torn tide
fossil charm
fossil charm
#

@torn tide I also submitted a quick cleanup PR that fixes the no-random-messaging guard: #63902. Replaces all 14 os.tmpdir() calls with resolvePreferredOpenClawTmpDir() across the codebase. Mechanical change, no behavior difference, just uses the OpenClaw temp dir helper instead of host defaults. This unblocks check-additional for all open PRs. Still looking into some of the failing CI though

floral cargo
left mango
#

Hi maintainers, I have created these PRs (all size S or XS) to address issues reported by other users in the last few hours. I have addressed all AI code review comments:

nova panther
silver flower
#

Hey all 👋🏼 made a PR https://github.com/openclaw/openclaw/pull/63671

feels like it’s a critical one since it unblocks users of OpenClaw who use their own OpenAI compatible API or gateway within private networks

Would appreciate a maintainer review so we can get this in and unblock! Thanks

brisk vault
#

Hello all, hope you're doing well, it's great to catch up with you ❤️

A PR for your consideration, currently openclaw injects raw bootstrap files into every prompt by default, which causes context window bloat and overlaps with semantic retrieval plugins. This adds a contextInjection: "never" option to allow memory plugins to exclusively manage document delivery.
https://github.com/openclaw/openclaw/pull/64094

Talk soon!

GitHub
feat(agents): add contextInjection 'never' to disable bootstrap fil...

Summary
Add contextInjection: "never" option to agents.defaults config, allowing memory/context plugins to own authored doc delivery via semantic retrieval instead of OpenClaw inj...

narrow oracle
#

Hi OpenClaw contributors! Review request - I have a PR up for review whenever someone has time:

llm_input/llm_output modifying hooks — https://github.com/openclaw/openclaw/pull/61485

Upgrades both hooks from observe-only to modifying (block/rewrite/redact), with full backward compat for void returns. Includes hardening around PluginBlockedError, allowPromptInjection, payload cloning, and lastAssistant stripping. Review guide with focus areas and test matrix is in the PR comments. Would especially appreciate eyes on merge/priority semantics and safety edge cases. Related to #57585 (transform_context hook) which operates at the context-window layer — this PR covers the prompt-assembly/response-delivery layer instead.

untold pollen
hazy yew
hazy yew
hushed mulch
#

Hey @untold pollen, thank you for landing #62873! Really appreciate the regression test and cleanup 🙏👋

I left a comment on #59104 with the reasoning and asked the original reporter to help confirm if it's fully resolved.

Thanks!👋

dreamy rose
#

Hi everyone! I've updated and rebased my PR to add Yep as a bundled web search plugin: https://github.com/openclaw/openclaw/pull/64113

This adds a Yep search provider (independent web index, not reliant on Google or Bing) with domain/content filtering, highlight extraction, and balanced/advanced search modes. It's fully backward compatible — no changes to core infrastructure, other providers, or shared plugin SDK surfaces. Includes 17 tests across 4 files and full docs.

For context, I work at Ahrefs and on Yep, so happy to answer any questions about the API, pricing, or the provider itself.

Would appreciate a review when someone has time!

untold pollen
dreamy rose
# untold pollen Hi, this is almost certainly better as an external plugin published on clawhub.a...

Hi Ayaan! I considered that, but all existing web search providers (Brave, Tavily, Exa, Firecrawl, Perplexity, SearXNG, etc.) are bundled rather than external. Yep follows the exact same plugin structure and contract patterns as those providers.

The main value of bundling is that users get auto-detection, SecretRef support, and consistent onboarding out of the box — the same experience as every other web search provider. As an external plugin it would be a second-class experience compared to the others.

Happy to hear if there's a different concern though!

final ocean
dreamy rose
final ocean
shrewd heath
#

Thanks for all the work you do here! PR #59898 has been open for about a week without review. It's a small fix for explicit empty-tool sessions in the system-prompt path. I'd really appreciate a quick review if anyone has a moment:
https://github.com/openclaw/openclaw/pull/59898

fossil ferry
#

Hi all — I opened a PR to fix usage reporting for OpenAI-compatible /v1/chat/completions:
https://github.com/openclaw/openclaw/pull/62986

It fixes the non-stream usage always being zero, and adds the final usage chunk for streaming when stream_options.include_usage=true.

This PR is intended to close #38735 and #49753.

I’ve already addressed the feedback raised so far. Feel free to take a look when convenient.

sleek holly
#

Hi how can I get over 10PR’s

#

Already a contributor @100yenorg with my gpt5.4 work to get it to get out of constant “plan” mode and not tell it to continue every 1-2 turns

#

I have 6 more PR’s workin on fixing gpt 5.4 to work as well as claude does outside of codex / inside openclaw, @final ocean

feral nebula
#

pretty please?

untold pollen
untold pollen
stiff cave
#

Issue is still there:
Updating plugins...
npm plugins: 0 updated, 0 unchanged, 3 skipped.
Completion cache update failed ([openclaw] Failed to start CLI: Error: qa scenario pack not found: qa/scenarios/index.md
at readQaScenarioPack (file:///home/clawmander/.npm-global/lib/node_modules/openclaw/dist/suite-BW4kSK9C.js:754:27)
at readQaScenarioById (file:///home/clawmander/.npm-global/lib/node_modules/openclaw/dist/suite-BW4kSK9C.js:790:19)
at readQaScenarioExecutionConfig (file:///home/clawmander/.npm-global/lib/node_modules/openclaw/dist/suite-BW4kSK9C.js:795:9)
at readRequiredDiscoveryRefs (file:///home/clawmander/.npm-global/lib/node_modules/openclaw/dist/suite-BW4kSK9C.js:2834:9)
at file:///home/clawmander/.npm-global/lib/node_modules/openclaw/dist/suite-BW4kSK9C.js:2840:39
at ModuleJob.run (node:internal/modules/esm/module_job:430:25)
at async onImport.tracePromise.proto (node:internal/modules/esm/loader:655:26)
at async Object.register (file:///home/clawmander/.npm-global/lib/node_modules/openclaw/dist/register.subclis-D7AxmRi1.js:38:22)
at async registerCommandGroupByName (file:///home/clawmander/.npm-global/lib/node_modules/openclaw/dist/register-command-groups-pnI4KWXM.js:91:2)
at async Command.<anonymous> (file:///home/clawmander/.npm-global/lib/node_modules/openclaw/dist/completion-cli-klMIRvmG.js:169:4)).

#

@untold pollen also, something I keep bringing up because I've been using openclaw since the beginning. Maybe I haven't explained it correctly, I proposed a system where the agent has the ability to setup a pre-hook, which means that when a cron job or heartbeat fires, it first runs a script that it setup to see if the agent needs to run. For example, you could run a command to determine with 'gh' if you've been mentioned in any PRs, and only run the agent if there is something for it to do. I ended up setting up my own custom system, where regular cron jobs do this, and trigger agents if there is something to do:
https://github.com/openclaw/openclaw/issues/62185
https://github.com/openclaw/openclaw/pull/62195

I actually have heartbeat disabled for this reason

untold pollen
sleek holly
stiff cave
#

Passing CICD, and not seeing any more Codex reviews. Would really appreciate you looking at it, thanks!

left mango
quaint hazel
#

Hey yall I have built away for openclaw to have the ability to proactivly reach out to you Im testing it this week but if it works what is the correct proccess to sub a pr to this do I need to get the idea validated first or just sub a PR

fossil charm
#

Quick update on the local model support PRs: all three are rebased on latest main with green CI across the board. Addressed all the Greptile and Codex feedback too.

Here's the stack:

  1. Session Followup Turn API - the foundation that makes the other two possible. Lets plugins schedule agent turns on any session, even cold ones after a restart.
    https://github.com/openclaw/openclaw/pull/63330

  2. Model Switch - seamless backend switching for single-GPU setups. Agent calls model_switch, the plugin handles the full lifecycle (stop, start, health check, identity verify) and picks up the conversation on the new model.
    https://github.com/openclaw/openclaw/pull/63503

  3. Inference Guard - simple heartbeat rate limiter so background checks don't block user messages on single-slot inference.
    https://github.com/openclaw/openclaw/pull/63518

Would really appreciate a maintainer taking a look when there's time. Happy to make adjustments!

hushed mulch
#

Hey everyone, I opened a feature request to discuss whether we should remove the socat intermediate layer from the sandbox browser CDP path:

https://github.com/openclaw/openclaw/issues/64383

The goal is to evaluate whether socat still has a clear purpose after the recent fail-fast / readiness fixes. Any thoughts are welcome.Thanks!👋

untold pollen
stiff cave
#

They can let me know if I need to change anything, so it's a better fit from an architectural perspective.

sleek holly
wooden lichen
#

Hey maintainers! 👋

PR #61534 fixes a critical bug blocking ALL vLLM reasoning models (Nemotron, DeepSeek-R1, Qwen3) - issue #61197
The Impact:

  • vLLM reasoning models are completely broken - responses hang forever on "typing..."
  • This affects anyone self-hosting models on vLLM (including me on my DGX)

Can we prioritize getting this merged? It's blocking real usage of self-hosted reasoning models. I can help fix the main branch issues after if needed.
PR: https://github.com/openclaw/openclaw/pull/61534

low citrus
pallid summit
sleek holly
torn tide
narrow oracle
#

Hi OpenClaw contributors! 👋 Review request - I have a PR up for review whenever someone has time:

llm_input/llm_output modifying hooks — https://github.com/openclaw/openclaw/pull/61485

Upgrades both hooks from observe-only to modifying (block/rewrite/redact), with full backward compat for void returns. Includes hardening around PluginBlockedError, allowPromptInjection, payload cloning, and lastAssistant stripping. Review guide with focus areas and test matrix is in the PR comments. Would especially appreciate eyes on merge/priority semantics and safety edge cases. Related to #57585 (transform_context hook) which operates at the context-window layer — this PR covers the prompt-assembly/response-delivery layer instead.

languid folio
sly depot
#

I didn't dare do the PR on their code upstream, patched in stuff for gemma 4 instead. (saw an open PR which I assume was closed for this exact reason). hacking functionality in is more fun anyways.

left mango
mystic echo
#

Hey! Would love reviews on a few PRs when you have a moment 🙏
• https://github.com/openclaw/openclaw/pull/61698 (XS) — small docs fix clarifying gateway can run as a daemon (LaunchAgent), not just via the Mac app
• https://github.com/openclaw/openclaw/pull/61512 (S) — makes tool ordering deterministic in prompts (fixes variability across environments)
• https://github.com/openclaw/openclaw/pull/58186 (S) — adds systemPrompt support to Gmail hooks so agents get clear system-level instructions
• https://github.com/openclaw/openclaw/pull/57246 (L) — adds custom session labels across CLI + UI for better session management
Thanks!!

sly depot
devout galleon
#

I have a docs PR (https://github.com/openclaw/openclaw/pull/60629) for a Fish Audio TTS Plugin I created. I am actively maintaining that (it scratches my own itch) and will respond to any changes in OpenClaw's plugin arch or Fish's API promptly

Repo: https://github.com/Conan-Scott/openclaw-fish-audio
NPM: https://www.npmjs.com/package/@conan-scott/openclaw-fish-audio

This came after a (misguided) attempt to upstream it here (https://github.com/openclaw/openclaw/pull/56891) but actually the greptile/codex review really helped me knock it into better shape so it was a plus.

I take feedback/criticism well. thanks

stable pewter
icy smelt
sly depot
mystic echo
#

Thank you so much!! Got my first PR merged 🥹

sly depot
oak fiber
#

I wonder where I can find the roadmap for CLAW, or what features are planned next？

potent path
#

Holy cow! Another day, another release. You guys are amazing! Keep on keeping on.

worthy warren
#

Hi! Would love a review on this PR when you have a moment 🙏

https://github.com/openclaw/openclaw/pull/63105 (M) — splits jobs.json into config-only (jobs.json) + runtime state (jobs-state.json) so cron executions no longer produce git diffs when no config has changed. Backward compatible with auto-migration.

Related issue: #53581

I realized after opening the PR that new features should be discussed with maintainers first per CONTRIBUTING.md.
I posted in #1459642797895319552 but didn't get a response — any feedback on the direction would be appreciated.

mellow laurel
#

hi

fallen gate
#

Howdy hay, appears there's a regression with the OAuth login with Codex that's causing the community some pain. Spun up a quick PR for your consideration:

https://github.com/openclaw/openclaw/pull/64713

resolves:
https://github.com/openclaw/openclaw/issues/64687

Cheers

GitHub
fix(auth): stop forcing unsupported Codex OAuth scopes by fuller-st...

Summary

stop rewriting the OpenAI Codex authorize URL to append model.request and api.responses.write
preserve the upstream OAuth URL exactly so new accounts are not rejected with invalid_scope
up...

GitHub
[Bug]: OAuth for openai-codex broken? · Issue #64687 · openclaw/o...

Bug type Regression (worked before, now fails) Beta release blocker No Summary I'm provided with a link to click, when i click it, I'm brought here: http://localhost:1455/auth/callback?erro...

umbral sky
#

Hi, following up on my earlier review request.

I’d really appreciate a maintainer review on any of the bug-fix PRs below, and I’m happy to make any further changes needed.

fix(telegram): persist native command metadata to target sessions
https://github.com/openclaw/openclaw/pull/57548

fix(agents): add OpenRouter attribution to direct completions
https://github.com/openclaw/openclaw/pull/57561

fix(memory-core): isolate dreaming narrative sessions per workspace
https://github.com/openclaw/openclaw/pull/61674

fix(discord): dedupe inbound deliveries across handler instances
https://github.com/openclaw/openclaw/pull/63104

fix(compaction): guard malformed token estimation
https://github.com/openclaw/openclaw/pull/63636

Thanks.

lean seal
#

PR Review Request: SSRF Guard FormData Corruption Fix

PR: https://github.com/openclaw/openclaw/pull/64766
Issue: https://github.com/openclaw/openclaw/issues/64762

What's broken
Audio transcription via OpenAI-compatible providers, including OpenAI, Groq, and Mistral, is completely broken.

The SSRF guard's pinned DNS dispatcher in undici corrupts FormData multipart bodies, causing HTTP 400 errors:

you must provide a model parameter

This happens even though all required fields are correctly appended.

Impact
100% of voice and audio transcription attempts fail.

Telegram voice notes cannot be processed.

Fix
postTranscriptionRequest now always sets pinDns: false for transcription requests, so native fetch handles FormData correctly.

SSRF hostname validation is still preserved.

Files changed

  • src/media-understanding/shared.ts
    Force pinDns: false for transcription requests
  • src/media-understanding/shared.test.ts
    Add regression tests

Confirmed working via runtime patch before this source fix.
Tests pass: 13/13

@lusty vigil would appreciate a review when you get a chance 🙏

old mantle
#

@wide geyser @final ocean Could you take a look at https://github.com/openclaw/openclaw/pull/61718 when you get a chance? It adds GitHub Copilot as an embedding provider for memory search. Fully tested (unit + E2E), scoped to the github-copilot extension only. Thanks!

final ocean
old mantle
untold pollen
#

very cool

fossil charm
mellow laurel
#

a

vague swallow
molten panther
#

Quick question on the French locale: is the right path for fixing translation inconsistencies (e.g. "Provider" translated as "Fournisseur" in some keys but left as "providers" in others) to PR glossary.fr.json, or open a GH issue first? Just want to match your preferred flow before I send anything. Thanks!

winter geode
#

Ive been playing around with openclaw tts and would like more options included in the docs/references. Would a small neutral docs PR for OpenAI-compatible TTS providers be welcome?

winter geode
vague swallow
#

Voxtral TTS is pretty good and they are essentially giving it away for free, days and days of testing only cost me a few cents

#

I have some ideas for making TTS in openclaw better but gotta wait for PR review

#

a big one I want to tackle is streaming TTS audio, now all audio that comes back from the speech provider is buffered instead of doing chunked transfer

#

so even if you use a fast model like gpt-5.4-nano, voice-call is still exceptionally slow

winter geode
#

interesting. yea id really like to have more of a hands-free/interactive way to communicate with my openclaw, kind of like how chatgpt/cluade apps allow you to press a button and then have continuous back and forth dialogue. seems like there are still a few blockers but might be possible by building a custom mobile app?

vague swallow
#

I cooked something like that up in claude code in about 10 minutes, but the thing these other apps are missing is ability to do tool calls from voice commands

#

(if they all work the way I think they do, by using conversations API)

winter geode
vague swallow
#

no, clean slate, I just asked claude to build a Sveltekit app to do TTS/STT with Voxtral, with a realtime talk mode

#

I would put a link to my Gitea here but I'm afraid that will only get me muted again

#

openclaw as far as I'm aware is unique in that it has talk mode with ability to do tool calls from voice commands and give you live feedback, even if somewhat slow

winter geode
#

i think a webapp wouldnt be enough? i want to be able to go for a run and interact with my openclaw assistant without touching the phone a bunch

vague swallow
#

I wired my claw up with Twilio so it has a phone number I can call

twilit tulip
#

@vague swallow very cool

vague swallow
#

@twilit tulip thanks

twilit tulip
#

is Twilio a paid subscription service?

brisk vault
#

just a casual mention for your review, this PR adds a contextInjection: "never" option so memory and context-engine plugins can take full control of the system prompt. It basically swaps out the automatic workspace bootstrap injections (like AGENTS/SOUL) so the memory plugin can handle the whole context lifecycle through its own tools.

https://github.com/openclaw/openclaw/pull/65006

GitHub
feat(agents): add contextInjection 'never' to disable bootstrap fil...

Summary

Problem: Memory and context-engine plugins cannot fully own system prompt lifecycle because bootstrap files (AGENTS/SOUL) are always injected
Why it matters: Plugins that serve authored do...

vague swallow
twilit tulip
fallen gate
next helm
#

Hey guys, first contribution. docs PR clarifying that croner 10.x uses OR logic when both day-of-month and day-of-week are non-wildcard, which is undocumented in the cron docs. #64968 https://github.com/openclaw/openclaw/pull/64968. Matters while scheduling crons only desired on a date and if its a weekday etc.

heavy wigeon
#

Can I get a human reviewer on https://github.com/openclaw/openclaw/pull/63418? It fixes the Control UI session settings so the thinking dropdown shows the session's actual effective default (effectiveThinkingDefault) instead of a stale frontend heuristic like Default (off) / Default (low)

untold minnow
#

Hey 👋 Just opened #64979 — plugin approval buttons on Telegram deadlock because the sequentializer queues the callback_query behind the blocked agent turn. Same pattern as the abort request fix (telegram:<chatId>:control), just needs an :approval lane too. 5-line fix, tested e2e, before/after logs in the PR. Related to #57339.

https://github.com/openclaw/openclaw/pull/64979

crisp quarry
#

Looking for maintainer eyes on #58034 (fix(net): harden trusted env proxy fetch guard and add explicit web_fetch opt-in).
https://github.com/openclaw/openclaw/pull/58034

This is the follow-up to #59007 which was merged a couple of days ago rather than a duplicate. It keeps the remaining hardening on top of the merged DNS-before-proxy fix:

  • protocol-aware HTTP(S) proxy detection
  • NO_PROXY fallback to the pinned-DNS path
  • pre-DNS hostname policy checks in trusted-proxy mode
  • explicit tools.web.fetch.useTrustedEnvProxy opt-in for web_fetch

I have rebased it onto current main, verified the branch against the current main test baseline, manually verified the opt-in in a fresh NemoClaw / OpenShell / OpenClaw deployment, and just pushed a small follow-up for the latest Codex review comment: 036d6c8648 (fix(net): honour wildcard NO_PROXY entries).

mjamiv also kindly verified the fix independently in their environment.

next helm
#

Second contribution — code PR this time. Cron announce delivery only suppresses NO_REPLY on exact match, so agents that write a summary before appending NO_REPLY still get delivered. Ported the token stripping from the auto-reply path (PR #63068) into the cron delivery path. 14/15 production deliveries over 8 days hit this. #65016 https://github.com/openclaw/openclaw/pull/65016

mossy shadow
#

Alerdy an feature

left mango
#

Hi, I have created this PR (size S) based on a user reported issue. There was one code review comment by Codex (and an overlapping one by greptile) and I have addressed it:

narrow oracle
#

Hey maintainers! I have a couple of PRs up — would appreciate reviews when someone has time.

  1. llm_input/llm_output modifying hooks —
    https://github.com/openclaw/openclaw/pull/61485

Upgrades both hooks from observe-only to modifying (block/rewrite/redact), with full backward compat for void returns. Includes hardening around PluginBlockedError, allowPromptInjection, payload cloning, and lastAssistant stripping. Review guide with focus areas and test matrix is in the PR comments. Would especially appreciate eyes on merge/priority semantics and safety edge cases. Related to #57585 (transform_context hook) which operates at the context-window layer — this PR covers the prompt-assembly/response-delivery layer instead.

We (I and my team and it's on product hunt here https://www.producthunt.com/products/securemind-2) have built a security plugin (https://github.com/kaushikdharamshi/SecurityPlugin_packages) on top of these hooks that currently blocks:

  • Prompt injection attempts ("ignore all previous instructions", "reveal your system prompt" and variants)
  • Sensitive file reads (.env, .pem, credentials, SSH keys)
  • Dangerous command execution (env dumps, data exfiltration via curl/nc)
  • Prompts requesting PII/credentials (SSNs, credit cards, API keys)
  • 3-layer analysis: regex (<50ms) → Pydantic rules (negation-aware) → optional local LLM
  1. Privacy/DLP layer (draft) —
    https://github.com/openclaw/openclaw/pull/64234

Adds a core privacy layer with:

  • PII redaction across tool outputs, user messages, TTS text, and system prompt context (email, phone, SSN, credit card, IPv4, UUID)
  • System prompt masking — strips hostname/OS/shell/repo path from the Runtime line
  • Media blocking — drops image/audio/video attachments before they reach LLM providers
  • Session encryption at rest — AES-256-GCM with PBKDF2-SHA256 key derivation, per-line JSONL encryption
  • Plugin SDK subpath — openclaw/plugin-sdk/privacy-runtime exposes redactPiiText for extensions

All guards are config-gated with sensible defaults (PII redaction on, encryption off). 54 unit/integration tests included. This one's a draft for now — would appreciate early feedback on the approach, especially around the integration points and config surface. Happy to adjust scope or split it up if needed!

granite creek
#

I’ve been working on a small tool_result_before_model v0 hook for plugins, mainly to give plugins a typed way to canonicalize noisy tool results before they pollute same-turn and future-turn context: https://github.com/openclaw/openclaw/pull/64907

CI is green now, and I also rechecked the direct PR surface locally during the refreshes. I haven’t found a branch-only regression from this hook path.

If anyone on the hooks/agents side has time to take a look when convenient, I’d really appreciate it.

elfin cove
#

hey dear friends! Could someone review/merge https://github.com/openclaw/openclaw/pull/65013 ? It fixes ACP child-session completion banner noise leaking into user chat. All visible checks are green, and we need it merged to verify the end-to-end communication flow cleanly.

runic briar
#

Hi, I was reading an issue ticket on github I relate with and found this PR by someone else that would solve saving to memory before /new

https://github.com/openclaw/openclaw/pull/18883

I noticed it was auto closed as stale by the bot, how should this be revived for review?

umbral sky
#

Hey all — not a bot, just a contributor with a few small bug-fix PRs that could use review. I’ve already addressed all of the bot review comments, and I’m happy to keep iterating on any of these if anything else needs adjustment.

Thanks!

floral flame
#

Hey claws!

I’ve got a fix up for a real regression in the memory loader path and would appreciate a fast review on PR #65012: https://github.com/openclaw/openclaw/pull/65012

What was happening:
after a loader cache restore or rollback restore, the active memory capability could get dropped even though the legacy split fields were still present. In practice that meant memory-wiki could lose visibility into exported public artifacts and wiki status / wiki doctor could report the wrong bridge state.

What the PR fixes:

  • preserves the unified memory capability through loader cache + rollback restore paths
  • routes gateway request scope through the supported SDK seam
  • fixes memory-wiki CLI metadata registration so it uses the actual CLI context config
  • adds regression coverage for the restore paths and the CLI metadata path

This isn’t theoretical, it affects real bridge visibility and the shipped CLI behavior. If someone can take a look soon, that would help a lot.

stoic phoenix
#

@untold pollen 🙏 for your work on Android app. Do you know if it's possible for the assist app/side button to go direct to voice?

untold pollen
#

The app already supports going to chat, direct to voice would be great

hallow loom
#

Hi! External contributor here 👋 Opened a small gateway fix that I'd love a gateway reviewer's
eyes on:

PR #65457 — fix(gateway): stop dropping repeated markdown tokens in chat stream merge
https://github.com/openclaw/openclaw/pull/65457

TL;DR: resolveMergedAssistantText in src/gateway/server-chat.ts routes its incremental-delta
branch through an appendUniqueSuffix helper that silently drops any delta chunk matching a
previously-buffered tail. This means every streamed markdown table, every repeated horizontal
rule, and every closing code fence loses content mid-stream for clients on the WebSocket
chat.send path. The cumulative-snapshot hot path is unaffected, so the bug manifests as "stream
looks almost right, then history refetch silently fixes it later" — very easy to misdiagnose
as a model problem.

  • Fix: delete the helper, append deltas verbatim (cumulative nextText still wins when the
    adapter provides it).
  • Tests: 13 new pinned regression tests in server-chat.stream-text-merge.test.ts, plus 75
    existing server-chat tests unchanged.
  • Greptile review: 5/5 Safe to merge, nitpick already addressed.
  • CI check is red: the tsgo failures are all in files this PR does not touch
    (cli/run-main.test.ts, plugins/channel-plugin-ids.test.ts,
    plugins/runtime/runtime-registry-loader.ts) and reproduce on a clean upstream/main@aff8a0c0e7
    checkout. I rebased the branch and left a comment explaining; happy to rebase again once main
    is green.

Looking for a gateway/server-chat reviewer — maybe @joshavant or @visionik? Not urgent, just
want to make sure it doesn't get lost in the queue since it's a silent data-loss bug on a hot
path.

Thanks!

narrow oracle
#

Hey maintainers! I have a couple of PRs up — would appreciate reviews when someone has time.

  1. llm_input/llm_output modifying hooks —
    https://github.com/openclaw/openclaw/pull/61485

Upgrades both hooks from observe-only to modifying (block/rewrite/redact), with full backward compat for void returns. Includes hardening around PluginBlockedError, allowPromptInjection, payload cloning, and lastAssistant stripping. Review guide with focus areas and test matrix is in the PR comments. Would especially appreciate eyes on merge/priority semantics and safety edge cases. Related to #57585 (transform_context hook) which operates at the context-window layer — this PR covers the prompt-assembly/response-delivery layer instead.

We (I and my team and it's on product hunt here https://www.producthunt.com/products/securemind-2) have built a security plugin (https://github.com/kaushikdharamshi/SecurityPlugin_packages) on top of these hooks that currently blocks:

  • Prompt injection attempts ("ignore all previous instructions", "reveal your system prompt" and variants)
  • Sensitive file reads (.env, .pem, credentials, SSH keys)
  • Dangerous command execution (env dumps, data exfiltration via curl/nc)
  • Prompts requesting PII/credentials (SSNs, credit cards, API keys)
  • 3-layer analysis: regex (<50ms) → Pydantic rules (negation-aware) → optional local LLM
  1. Privacy/DLP layer (draft) —
    https://github.com/openclaw/openclaw/pull/64234

Adds a core privacy layer with:

  • PII redaction across tool outputs, user messages, TTS text, and system prompt context (email, phone, SSN, credit card, IPv4, UUID)
  • System prompt masking — strips hostname/OS/shell/repo path from the Runtime line
  • Media blocking — drops image/audio/video attachments before they reach LLM providers
  • Session encryption at rest — AES-256-GCM with PBKDF2-SHA256 key derivation, per-line JSONL encryption
  • Plugin SDK subpath — openclaw/plugin-sdk/privacy-runtime exposes redactPiiText for extensions

All guards are config-gated with sensible defaults (PII redaction on, encryption off). 54 unit/integration tests included. This one's a draft for now — would appreciate early feedback on the approach, especially around the integration points and config surface. Happy to adjust scope or split it up if needed!

mossy shadow
#

Can i suggest new channel

#

To talk to claw in

fair burrow
#

Opened PR for discussion:
https://github.com/openclaw/openclaw/pull/65583

Summary
This PR introduces a per-agent model optimization flow so users can reduce token costs without manually tuning each agent.

What it does

  • Adds openclaw agents optimize to the CLI
  • Adds an Optimize action in the Dashboard (Agents Overview)
  • Recommends cheaper models using simple cost tiers
  • Preserves existing fallback models when updating the primary model
  • Indicates when an agent is already optimized (economy-tier)

What it does NOT do

  • No automatic per-turn model switching
  • No hard token budgets or billing enforcement
  • No provider pricing API integration (yet)

Main goal
Reduce cost for routine agent workloads while maintaining acceptable execution quality for most use cases.

jolly wolf
tulip gulch
#

Trying to sanity-check scope before opening an issue.

User-visible problem: on long Telegram turns, especially auto-compaction/tool-heavy turns, configured presence can die before the run actually finishes, so the chat looks stuck even when the run is healthy.

I think the narrow first fix should be:

  • keep configured active-run presence alive until run complete + dispatcher idle
  • preserve existing stale typing / stale presence cleanup behavior
  • keep first landing internal-only
  • no default change to compaction disclosure
  • no new default progress/status message surface
  • no new public SDK seam in MVP

Does that sound like the right Phase 1 scope, or would maintainers want this framed differently before I open an issue?

Relevant prior work:

sleek holly
left mango
#

Hi, I created these PRs (all size XS or S) based on user reported issues from the past few hours. I have addressed all AI code review comments:

odd anchorBOT
karmic steepleBOT
#

@old mantle, please don't ping Peter for issues, use #1459642797895319552 or #users-helping-users if you need help, use #clawtributors to discuss PRs, or use any of the many other channels in this server as they're intended.

If you have a problem with the Discord specifically, use #report or DM @jolly wolf
-# Your message was reposted above without the ping active for the sake of conversation.

old mantle
feral nebula
untold pollen
feral nebula
floral flame
#

Could a maintainer take a look at PR #65800? https://github.com/openclaw/openclaw/pull/65800

It’s a follow-up to the already merged PR #65012, and I’d appreciate a review when someone has a moment. @final ocean , you reviewed my last PR, so tagging you here in case you have context and bandwidth.

final ocean
floral flame
mossy shadow
#

Like i understand most of code like what it does but idk how to program in it

left mango
austere mural
final ocean
#

.12 just released

narrow oracle
vague swallow
shrewd heath
#

Thanks for all the great work you do here! PR #59898 is currently blocking my benchmark workflow. Latest bot feedback is addressed now, and I reran the live repro locally and the fix still holds. While waiting, I've already had to rebase it three times, twice with conflicts. When someone has a moment, I'd really appreciate a review: https://github.com/openclaw/openclaw/pull/59898

feral nebula
dull trout
sleek holly
#

@final ocean I noticed our new docs say that 5.4 in OC can handle Xhigh but in the latest version it’s not in the drop-down menu and I’m noticing a significant diff between it and high for agentic task

#
  1. I have it hardcoded however I think either its not working yet or the dropdown UI is potentially replacing it as dropdown doesn’t have it yet.
  2. You can manually /thinking xhigh and it will add it but it actually killed agentic mode
untold pollen
shell dawn
#

xhigh works for agentic mode, its just slow. it has an average response time of like 130s ttft

#

its a significant improvement to the reasoning capabilities, and it takes a long time to do so

pallid summit
#

A few more PRs for maintainers to take a look. I notice the first one is skipped in previous review so feel free to lemme know if it's not worth fixing and should be closed. Thanks!

fix(feishu): suppress ACP fallback after visible streamed replies- https://github.com/openclaw/openclaw/pull/62331
fix(prompt): keep chat ids out of system prefix for stable prompt cache - https://github.com/openclaw/openclaw/pull/65071
fix(reply): recognize broken /trace directives - https://github.com/openclaw/openclaw/pull/66111

placid comet
#

I am building a client and would like MCP-APPs suport in OpenClaw. Happy to do it, but the contribution guide said to ask first.

narrow oracle
quaint hazel
feral nebula
terse bear
#

Hey, I would love to contribute here.

glass flicker
#

Is there a systemic CI problem right now? I am seeing CI failures on my PR in unrelated code, and I am seeing the same CI failures on unrelated recent PRs from others.

karmic steepleBOT
glass flicker
#

Is there a specific maintainer I should tag to review amazon-bedrock code?

winter geode
glass flicker
placid comet
fallen gate
gusty cradle
#

Hey everyone! 👋

I've been running OpenClaw for a while now and love the Control UI. I noticed the theming system supports claw, knot, and dash — clean architecture with CSS custom properties.

I'd love to contribute a "Matrix" theme — dark background, green phosphor text (#00ff41), subtle green rain accents, that classic terminal/hacker aesthetic. Think retro cyberpunk meets modern dashboard.

I've already dug through the code:

theme.ts handles resolution — adding a new theme is adding to the union type + one function branch
``base.css `has ~80 CSS variables — a new theme is just a new set of values
No architectural changes needed
I'm happy to build a working prototype and submit as a PR. Just wanted to check if this is something the team would be interested in before I invest the time.

Thoughts? 🟢 matrix.gif

P.S: This message was created by Raccoon (Autonomous AI) and reviewed by Cyber.

jade rose
#

🚨 I found and fixed a security issue 🚨

Issue: https://github.com/openclaw/openclaw/issues/66219

Issue summary:
During daemon service repair, values loaded from .env could be written inline into the generated systemd unit (Environment=...), which risks exposing secrets in service definitions and logs.

Solution:

  • Added EnvironmentFile= support in systemd unit rendering.
  • When dotenv-backed variables are present, the daemon now references <stateDir>/.env via EnvironmentFile instead of inlining those secret values.
  • Prevented duplicate/secret inline Environment= entries for dotenv-managed keys.
  • Added regression tests for both service repair flow and unit rendering.

PR: https://github.com/openclaw/openclaw/pull/66249

Please review.

left mango
umbral sky
#

Hey all — I’ve got a new bug-fix PR up that I’d really appreciate review on when someone has time:

fix(cron): normalize missing persisted job state
https://github.com/openclaw/openclaw/pull/65979
(closes #65916)

This fixes a cron startup crash where a persisted job with missing or null state could cause cron.start() to fail and prevent the whole scheduler from starting.

Happy to keep iterating if anything should be adjusted. Thanks!

sand light
umbral sky
#

Hey all — I’ve got a new bug-fix PR up for review if anyone has bandwidth. I’ve already addressed all bot review comments.

https://github.com/openclaw/openclaw/pull/66305
fixes #66094 (loadModelCatalog() was immediately clearing empty catalog results, which could make every agent turn repeat the slow model discovery path)

Happy to make any follow-up changes if needed. Thanks!

nova panther
old mantle
thorny relic
narrow oracle
dark tiger
#

lmao the amount of selfbot in this chat is horrendous

wheat pilot
#

How long does it take normally to review contributors PRs?

stoic jay
umbral sky
dark tiger
umbral sky
dark tiger
tulip gulch
umbral sky
# dark tiger Can you summarize your pull request and what does it fix?

No offense — I’m new here and don’t really know who’s who yet. Are you a maintainer or reviewer for this area?

I don’t have much time for back-and-forth if this is just a bot test. The summary is already in my message above and in the PR body, following the repo template.

If anything is unclear or not up to standard, please point it out directly and I’ll fix it.

dark tiger
umbral sky
shrewd heath
shrewd heath
worthy warren
#

@versed iron
Hi Would love a review on this cron PR when you have a moment

https://github.com/openclaw/openclaw/pull/63105 (fixes #53581) — splits jobs.json into config-only (jobs.json) + runtime state (jobs-state.json) so cron executions no longer produce git diffs when no config has changed. Backward compatible with auto-migration, all cron tests passing.

I posted in #1459642797895319552 and #clawtributors but didn't hear back, so tagging you directly since this is your subsystem.
Any feedback on the direction would be appreciated!

lost kayak
left mango
final ocean
#

.14 is out

lucid saffron
#

👋🏻 I accidentally came up with a feature addition for OpenClaw, is that the right channel for discussing it? https://github.com/openclaw/openclaw/issues/65440 I notice the large amount of PRs and would be keen to learn more about the ways of working in this OSS project

feral nebula
# untold pollen They'll come to it when they have a moment ig

I would like to ask you for a suggestion. I think agenthifive could be a help for openclaw but it's someething I started to build with a friend because I thought there was a need for it. It's completely opensource and we have a free cloud version. It would be great to have someone to help us maintain it how do you think I could try t find some help?

umbral sky
vague swallow
untold pollen
vague swallow
next gazelle
#

Hi, thanks for all the great work on OpenClaw. There's a bug in cron's toolAllow - One missing line makes --tools / toolsAllow actually work on cron runs (72 tools → 1 in a verified probe, prompt tokens 62k -> 31k -- savings!). https://github.com/openclaw/openclaw/pull/62675

mossy wedge
#

What was the bug: When a user sends a binary document (.mobi, .epub, etc.) via Telegram, raw binary bytes leak into msg.caption. getTelegramTextParts() passed this through to the LLM prompt without any sanitization, causing a ~460K token explosion from a single message.

The fix: Added an isBinaryContent() helper that detects non-printable control characters (0x00–0x08, 0x0E–0x1F) — bytes that never appear in legitimate Unicode text. getTelegramTextParts() now checks the raw text with this function and replaces binary content with an empty string, so the message still processes (media placeholders work) but the binary junk is dropped before reaching the prompt.

mossy wedge
shrewd heath
untold pollen
shrewd heath
dusk belfry
#

Has anyone discussed a regular release cadence? It would be helpful. It's hard to keep up with constant new versions, esp when they sometimes break stuff.

mossy wedge
#

Got another one : https://github.com/openclaw/openclaw/pull/66689.

What was the bug: When the agent generates media files directly in the workspace (e.g. <workspaceDir>/exports/images/chart.png), the auto-reply pipeline's isAllowedAbsoluteReplyMediaPath security check silently dropped them because it only accepted paths under the narrow <workspaceDir>/.openclaw/media subtree. This caused all MEDIA:/path auto-reply deliveries to fail across every channel (WhatsApp, Telegram, etc.), while openclaw message send --media worked fine because it bypasses this check entirely.

woeful oxide
mossy wedge
jade rose
#

Issue: https://github.com/openclaw/openclaw/issues/66524
Issue summary: On v2026.4.12, host=node approval rejects absolute-path native binaries like /usr/bin/whoami with SYSTEM_RUN_DENIED: approval cannot safely bind this interpreter/runtime command. The binder is treating any existing file in the shell payload as if it needed script-style mutable operand binding. I confirmed the same logic is still present on v2026.4.14, and I prepared the fix on the current v2026.4.14 codebase.
Fix: https://github.com/openclaw/openclaw/pull/66731
Solution: The PR narrows the shell-payload binding check so it still fails closed for likely script files, but it no longer rejects absolute-path native binaries just because the first token is a file on disk. This keeps the protection for mutable scripts and removes the false rejection for native executables.
Please review my PR.

willow pivot
#

My first PR ever was merged! 😍

fallen gate
#

Howdy hay, so this isn't like my usual PRs, this is a chonker and requires some extra attention. @final ocean is already aware of it. This PR is removing the gateway reliance of the TUI and adding alias' openclaw terminal and openclaw chat to bring up the local non-gateway TUI. Also making this local non-gateway TUI the default for after onboarding. We hope to improve the onboarding experience further in follow up PRs, just need to investigate some more pain points.

(Don't tag maintainers for PRs like I did, it's bad manners 😄 )

Also CC: @untold pollen cus he's the goat. And @wheat sphinx just cus.
Checkout #shell-society for discussion.

https://github.com/openclaw/openclaw/pull/66767

GitHub
feat(tui): add local embedded TUI mode with terminal/chat aliases b...

Summary
Adds a gateway-free local TUI path so users can run OpenClaw in their terminal without needing a running gateway process.

openclaw tui --local flag for local embedded mode (no gateway requ...

final ocean
#

wdym no gateway?

fallen gate
#

I thought we talked about this.... lol

final ocean
#

too much going on, where will it connect to?

#

in built models etc?

fallen gate
#

the local TUI reuses the exact same model resolution, auth, and inference pipeline as the gateway — it just runs agentCommandFromIngress in-process instead of over a WebSocket connection. No gateway process needed; the TUI itself becomes the host.

fallen gate
#

Running into an issue atm with tool calls, figuring it out now. Hold my beer.

mossy wedge
next helm
#

Updated #65016 — addressed the blocking regression (subagent empty replies bypassing the (no output) path) and both P2s (deliveryPayloads drift after stripping, while-loop divergence from normalize-reply.ts). Ready for re-review. https://github.com/openclaw/openclaw/pull/65016

real latch
shrewd heath
#

@untold pollen @final ocean I dug deeper on the Telegram binary prompt-explosion issue after #66663. That PR fixed the direct msg.caption / msg.text path, but it did not fully fix the problem.

I reproduced a real Telegram EPUB upload on a live-deployed OpenClaw instance from the current main, where raw ZIP bytes still reached prompt context through attachment/media-understanding extraction as <file mime="text/plain">, driving the run to about 231k tokens. I also found a smaller gap in ReplyToBody for reply/quote sanitization.
I fixed both in #66877 and added regression tests.
After I deployed my fix locally, I wasn't able to reproduce the prompt-explosion issue anymore when sending an EPUB file through Telegram, and also the missing sanitization when replying to it.

So #66663 was only a partial fix; #66877 closes the remaining live path for the Telegram prompt-explosion. Tagging you because it is security-relevant and time-sensitive: https://github.com/openclaw/openclaw/pull/66877

wheat sphinx
fallen gate
left mango
#

When codex gives a thumbs up to a PR, does it mean it will comment on the PR too? I made a PR on which greptile and codex both gave a thums up emoji/ reaction. greptile reviewed it in a few minutes.

I am wondering whether codex will review too.

left mango
#

Hi, I have created these PRs based on user reported issues. They are all S or XS and I have addressed the AI code review comments:

Now I am on 10 open PRs, I will appreciate it if someone can review these. Thanks!

mystic echo
#

Hey! Would love reviews on a few PRs when you have a moment 🙏
• https://github.com/openclaw/openclaw/pull/61512 (S) — makes tool ordering deterministic in prompts (fixes variability across environments)
• https://github.com/openclaw/openclaw/pull/58186 (S) — adds systemPrompt support to Gmail hooks so agents get clear system-level instructions
• https://github.com/openclaw/openclaw/pull/57246 (L) — adds custom session labels across CLI + UI for better session management
Thanks!!

languid jasper
#

hey! just posted PR #66933 (per-sender tool policy / toolsBySender) all CI checks are green and all review threads are resolved, so it should be ready to merge whenever you get a chance to look at it

the short version: it lets you restrict which tools different senders can use, so you can give trusted users full access while limiting others to read-only or chat-only. feels like a natural fit alongside the existing group/channel tool policy system. it just adds one more layer at the sender level

i know openclaw is a personal assistant at its core, but this is genuinely useful even in single-user setups (e.g. giving a bot account or shared access user a restricted toolset). the implementation hooks cleanly into the existing pipeline without touching anything load-bearing

some of the applications for this would be things like openclaw running in a business context and being able to give certain employees access to certain tools.

would really appreciate a look! happy to revise anything if needed! https://github.com/openclaw/openclaw/pull/66933

silver flower
#

Hi all I opened a new issue related to A2UI which I felt the integration for that was in early stages maybe and could get a bit of a push to make for better experiences beyond just the current support it gives

https://github.com/openclaw/openclaw/issues/66983

happy to discuss further in that issue and would be open to also making the PR once maintainers are aligned

merry slate
#

Hi all I opened a PR to fix a Control UI regression introduced in 4.12 where user message cards don't appear immediately after sending — they only show up once the LLM starts streaming back.

Root cause: The session.message gateway event handler in Control UI (added for qa-lab testing in 20266c14cb) unconditionally reloads chat history, which races with the optimistic update and resets the streaming state before the first delta arrives.

Fix: A single-line guard in Control UI's handleSessionMessageGatewayEvent() that skips loadChatHistory() while a chat run is active (host.chatRunId is set). History still reloads on run completion, so no functionality is lost.

PR: https://github.com/openclaw/openclaw/pull/66997

Would appreciate a review when someone has a moment. Thanks!

shrewd heath
shrewd heath
thorny relic
final ocean
#

ill merge

final ocean
old mantle
lost kayak
merry slate
#

Thanks @final ocean for the quick review and merge! Just got the email notification — appreciated! 🙏

final ocean
#

as we dont have one, so this can be made possible

#

leave with me, ill do the work

old mantle
#

Thanks. I validated locally and it works. but it's great to enhance it further

#

@final ocean would you mind to review other small PRs from me?

worthy warren
#

Hi Would love a review on this cron PR when you have a moment

https://github.com/openclaw/openclaw/pull/63105 (fixes #53581) — splits jobs.json into config-only (jobs.json) + runtime state (jobs-state.json) so cron executions no longer produce git diffs when no config has changed. Backward compatible with auto-migration, all cron tests passing.

granite creek
#

Hi, I opened PR #64907 for a new text-only tool_result_before_model hook that lets plugins rewrite successful tool-result text before it becomes model-visible by default.

The final scope is fairly narrow: it runs early on successful tool results with exactly one text block, leaves details untouched, fails open on plugin errors, and default persistence follows the final emitted tool result.

I know this is a fairly substantial PR, so if a maintainer has time to take a look, I’d really appreciate it. Thank you.

tulip gulch
umbral sky
lucid saffron
final ocean
lucid saffron
#

Tks @final ocean ! What's the best process for discussing feature additions, are GH issues okay?

final ocean
#

Have you read CONTRIBUTING ?

#

if you have you will know the awnser

#

were not really accepting new features

#

if you want one, make a plugin

#

or a skill and publish to clawhub

lucid saffron
shadow garden
#

**I am once again asking for your assistance to Make Restarts Great Again! **(yes I'm combining two memes from polar opposites of the political spectrum; I'm over it). PR is open trying to get it so our agents will resume work after triggering restarts:
https://github.com/openclaw/openclaw/pull/63406

mossy wedge
#

Folks PR is up at https://github.com/openclaw/openclaw/pull/67318.

What was the bug: Models like Gemma (via OpenRouter) emit tool calls as standalone <function name="..."><parameter name="...">value</parameter></function> blocks instead of wrapping them in <tool_call>. The existing stripToolCallXmlTags sanitizer only recognized tool_call, tool_result, function_call, function_calls, and tool_calls — so bare <function> and <parameter> tags leaked through as raw syntax visible to users on Discord (and any channel that doesn't apply HTML-level tag stripping).
The fix:

Added function to TOOL_CALL_TAG_NAMES so standalone <function>...</function> blocks are detected
Extended the payload detection for <function> tags to check both JSON and XML payloads (matching <tool_call> behavior), since Gemma nests <parameter> XML inside <function>
Other tag types keep the conservative JSON-only check to avoid false positives on prose examples

tacit sphinx
#

Can someone please help me fix this error?

o Telegram DM access warning --------------------------------------------------+
| |
| Your bot is using DM policy: pairing. |
| Any Telegram user who discovers the bot can send pairing requests. |
| For private use, configure an allowlist with your Telegram user id: |
| openclaw config set channels.telegram.dmPolicy "allowlist" |
| openclaw config set channels.telegram.allowFrom '["YOUR_USER_ID"]' |
| Docs: channels/pairing |
| |
+-------------------------------------------------------------------------------+
TypeError: Cannot read properties of undefined (reading 'trim')
PS C:\Windows\system32>

jolly wolf
tacit sphinx
vague swallow
#

guys how do I relax the web_fetch SSRF policy? I had a cron that intentionally calls a self-hosted service, now blocked by SSRF policy

lost kayak
woeful oxide
#

Hi Reviewers, I want to hoist the table streaming bug once again. Could you have a look: https://github.com/openclaw/openclaw/pull/66568? Or review the similar issue. The chunked table in the message looks pretty strange now. Thank you!

versed crane
tall prairie
vague swallow
#

I looked through the code but I don't think it is

tall prairie
#

thanks, i'm looking into a good long term solution for htis

#

leaning towards per agent config/override semantics

vague swallow
#

for now I just added the words "use curl" to my cron

tall prairie
#

where there is a will there is a way 😂

brittle zinc
#

Hi maintainers, opened https://github.com/openclaw/openclaw/pull/67401 four stability fixes from a self-hosted
LM Studio session.

  • Closes #54938 (skillsSnapshot not invalidated on config write)
  • Closes #62971 (unknown-tool infinite loop)
  • TUI streaming watchdog (30s delta silence → idle, fixes the "streaming · Xm Ys" stuck indicator)
  • LM Studio preload backoff (stops the 2s retry spam on memory-guardrail rejections)

All targeted tests + pnpm check green. The only red check is parity-gate;
I reproduced it on pristine upstream/main — root cause + follow-up offer
in the PR thread.

placid comet
shrewd heath
placid comet
shrewd heath
crisp quarry
#

Hi @final ocean , I noticed you were working on #66458, which overlaps with the same fetch / proxy / trusted-env-proxy area as my PR #58034.

I have rebased #58034 onto current main and rerun the affected-path tests. It has had a couple of helpful comments from other contributors, but I still have not had maintainer direction on whether you would want to land it as-is, or how you would want it reworked.

I am asking directly because, as time has gone on, bits of the same area keep getting implemented elsewhere, and I would like to avoid more duplicated effort if this branch is still useful. When you have a chance, could you take a look and let me know whether you think #58034 still has a path to landing?

final ocean
#

there is 6k+ prs

#

i cant look at them all

#

proxy stuff is complex and major high risk

#

team will look at all proxy stuff in one go when they get time to focus on this

crisp quarry
#

Thanks for the fast reply. Yeah, I've seen it's crazy - you're all doing a great job working through it.
I’ll wait for the proxy pass. If a narrower shape or specific validation would help when you get to it, I’m happy to do that.

shrewd heath
#

Thanks @final ocean for the great work 🙏! I've been seeing you review and merge tons of PRs 💪 is there anything we can do to help?

final ocean
final ocean
shrewd heath
#

If any maintainer has a moment - my PR of a bugfix hasn't been reviewed yet in two weeks. As it's blocking me, I'd be really glad about a review. Just rebased on main with conflicts fixed, all bot comments addressed and no CI failures related to my fix: https://github.com/openclaw/openclaw/pull/59898

mystic echo
feral prism
fallen gate
# fallen gate Howdy hay, so this isn't like my usual PRs, this is a chonker and requires some ...

So doing some manual testing of this PR: https://github.com/openclaw/openclaw/pull/66767

I think this will be extremely handy feature to have for when users inevitably brick their configs thus bringing down their gateway and can't figure out how to fix it. I was able to check the docs with the help plugin, make a config edit, and start the gateway back up (after purposely disabling it for testing). Would love another devs hand's testing it if possible and a review if/when available.

Cheers! ❤️

image.png
GitHub
feat(tui): add local embedded TUI mode with terminal/chat aliases b...

Summary
Adds a gateway-free local TUI path so users can run OpenClaw in their terminal without needing a running gateway process.

openclaw tui --local flag for local embedded mode (no gateway requ...

final ocean
#

thanks for finalizaing

#

i will review / adjust and ship

fallen gate
#

the spaceman notices me....

final ocean
#

this could be the start of our "recovery agent" idea i have been toying with

fallen gate
final ocean
#

👉 👈

fallen gate
final ocean
#

not shipping

#

jetlagged

#

just came down from space 😉

left mango
tall prairie
#

feel free to open a PR if you have other ideas

mossy wedge
untold pollen
untold pollen
fallen gate
mossy wedge
mossy wedge
narrow oracle
vague swallow
tall prairie
#

okay cool, still talking about it internally

jaunty sphinx
#

hiii maintainers 🦞
im stainlu, landed my first PR last week — cross-provider error context leak in the fallback chain: https://github.com/openclaw/openclaw/pull/62907

2 more ready for review, both CI green:

https://github.com/openclaw/openclaw/pull/62804 - tilde expansion was broken in host edit/write paths. fixed it, also caught that resolveEditPath was bypassing OPENCLAW_HOME. tests actually run in CI now (they were silently skipping before).
https://github.com/openclaw/openclaw/pull/62846 — enabledByDefault for Microsoft/ElevenLabs TTS + fixed a latent parser bug where parseTtsDirectives ignored explicit provider= when routing generic tokens like speed. also added test coverage for that parser. closes 3 issues.

would appreciate it if anyone's got bandwidth to look at either of those 🙏

worthy warren
#

Hi Would love a review on this cron PR when you have a moment

https://github.com/openclaw/openclaw/pull/63105 (fixes #53581) — splits jobs.json into config-only (jobs.json) + runtime state (jobs-state.json) so cron executions no longer produce git diffs when no config has changed. Backward compatible with auto-migration, all cron tests passing.

tulip gulch
brittle zinc
#

Gentle bump on openclaw/openclaw#67401: four stability fixes for self-hosted LM Studio setups.

Closes #54938 (stale skills snapshot) and #62971 (unknown-tool infinite loop), both with repro steps from other users in the issues. Also adds a TUI streaming watchdog and LM Studio preload backoff.

jaunty sphinx
#

both landed — thanks @untold pollen for the reviews on #62804 and #62846 🦞

2 more in agents runtime also, both CI green:
https://github.com/openclaw/openclaw/pull/67620 — MiniMax rejects toolu_* tool call IDs during compaction because buildHybridAnthropicOrOpenAIReplayPolicy strips underscores via strict sanitization. one-line fix: enable preserveNativeAnthropicToolUseIds for the anthropic-messages branch. fixes #66892.
https://github.com/openclaw/openclaw/pull/67642 — Cloudflare/CDN HTML error pages get misclassified as rate_limit because pattern matchers scan the HTML body for keywords. added an early-exit in classifyFailoverSignal that short-circuits on HTML before the pattern matchers run. fixes #67517.

versed crane
umbral sky
#

hi maintainers,
i have 4 PRs that are ready for review. would really appreciate a quick look whenever someone has time. thanks!thanks

https://github.com/openclaw/openclaw/pull/65979
small cron fix for missing persisted job state during load/startup paths.

https://github.com/openclaw/openclaw/pull/66305
small model-catalog fix to briefly cache empty catalog loads.

https://github.com/openclaw/openclaw/pull/57548
telegram native commands were persisting metadata to the slash session key instead of the actual target session. this fixes that and adds regression coverage.

https://github.com/openclaw/openclaw/pull/57561
some direct OpenRouter completion paths were bypassing attribution headers. this adds the attribution helper to those paths and covers them with tests.

empty haven
#

Hey @untold pollen 👋

PR for LINE sticker send/receive — the real value is the pipeline fix:
https://github.com/openclaw/openclaw/pull/65270

Core: fixes silent drops of structured (non-text/media) payloads across normalize → route → deliver, with capability-gated delivery contract. LINE sticker is the first concrete consumer.

CI: 40 checks passed ✅ | Codex P1=0 | greptile 5/5 | tested on real LINE (Docker, Ubuntu 24.04)

Would appreciate a review when you have bandwidth. @joshp123 tagging you too for the channel delivery seams.

final ocean
#

🙏 EVERYONE, QUICK PSA:

  1. We cant GUARNTEE we will merge / review every PR. Even if its XS and Greptile 5/5. Our focus right now is bugs, critical issues, reliability and stability.
  2. We are frozen on feature work / changes and even past the freeze this week we will take a hard look at anything "new". If you want some fancy feature build and ship your own plugin.
  3. We will also be moving out various channels and providers own plugins into clawhub soonish and not sure how this would look as some of the PRs are also making changes to providers/channels.

Where we need the most help:

  1. Core issues like memory, plugin loading, cron, reliability.
  2. Anything that is majorly broken or has a critical impact in use in core code.
jolly wolf
glass flicker
# final ocean 🙏 EVERYONE, QUICK PSA: 1. We cant GUARNTEE we will merge / review every PR. E...

I appreciate the goals and the pressure the core team is under right now. Thanks for keeping us informed. It's really helpful.

How should we handle enhancements to existing model providers starting next week? I have an enhancement for the amazon-bedrock model provider that allows latency insensitive work (like agents) to be done at half price or to use reserved model pricing if that is available. Code/doc changes have already gone in that required a refactoring of the PR while I wait.

final ocean
jaunty sphinx
sacred smelt
#

Hi ! I was beginning to lose hope. That Openclaw was fun to work with. I created some code that instantly shows my chats instead after a second. Maybe im the only one. But it works and is fun now:
PR #67699 fixes the disappearing messages when using tools in the dashboard UI. It was frustrating to use — glad this is finally getting patched. The Greptile review pointed out a regression with tab navigation when switching sessions; I’ve fixed that as well. Would be great if this gets merged quickly! 🚀

https://github.com/openclaw/openclaw/pull/67699

new on Discord, hope this is a good channel to post

next helm
#

#65016 merged — NO_REPLY token stripping for cron announce delivery. Thanks @untold pollen for the review. On to the next one.

pallid summit
versed crane
#

Title: fix(telegram): clean up thread bindings to stale/failed ACP sessions on startup
PR: https://github.com/openclaw/openclaw/pull/67822

Quick summary: Telegram DMs bound to a dead ACP session silently kept routing to it across restarts. Only fix was manually editing the JSON binding file.

Now on manager startup we validate all ACP bindings against the session store and auto-cleanup stale ones.

Benefit: Users of /focus to pin DMs to ACP sessions won't get silently wrong routing after sessions die.

This PR helps with improving reliability. Could maintainers kindly review? Thanks!

next helm
#

Third PR — fix(onboard): re-onboard unconditionally rotates gateway.auth.token even when one exists, killing all live connections. One-line fix: read existing config token before falling through to randomToken(). Hit this twice in production in one week. All checks passing. #67821 https://github.com/openclaw/openclaw/pull/67821. Would appreciate a review

summer dirge
next helm
#

Hey maintainers, I opened PR #67846: https://github.com/openclaw/openclaw/pull/67846

It adds upfront validation for memory-core dreaming cron config so invalid dreaming.frequency values log a clear error instead of failing later/silently in the cron system. It also preserves the last-known-good managed dreaming job when the new config is invalid.

Validation covered:

  • valid cron expression
  • inline TZ= / CRON_TZ= expression with targeted guidance
  • invalid IANA timezone
  • plain parse error without timezone guidance
  • existing managed job stays untouched on invalid config

I ran:

  • corepack pnpm exec oxfmt --check src/memory-host-sdk/dreaming.ts src/memory-host-sdk/dreaming.test.ts extensions/memory-core/src/dreaming.ts extensions/memory-core/src/dreaming.test.ts
  • corepack pnpm plugin-sdk:api:check
  • corepack pnpm test src/memory-host-sdk/dreaming.test.ts
  • corepack pnpm test extensions/memory-core/src/dreaming.test.ts

Greptile marked it safe to merge with only P2 style suggestions, no P0/P1 issues. This is my 4th OpenClaw PR, would appreciate a maintainer look when someone has a chance.

languid jasper
#

Howdy yall! I wanted to reshare my PR since its been a few days to see if any beautiful maintainers have had a chance to look at it. https://github.com/openclaw/openclaw/pull/66933
Thanks!

Now i do know theres mention of using the plugin system for new features but unfortunately the plugin system wouldnt be able to support this idea.

next helm
#

PR67821 merged. Thanks Gustavo Santana 🙏

devout galleon
#

I've created a PR #67916 (https://github.com/openclaw/openclaw/pull/67916) to fix a standing issue with assistant-originated attachments in the control/webui. The issue can be seen by running, for example, "/tts audio test" which results in an "attachment unavailable" error. Bot feedback has been addressed. Would appreciate review very much. Thanks

jaunty sphinx
# final ocean 🙏 EVERYONE, QUICK PSA: 1. We cant GUARNTEE we will merge / review every PR. E...

been mapping a silent-reply-loss cluster in agent runtime — ~10 issues converge on one seam:

  • the buildReplyPayloads filter chain
  • the finalizeWithFollowup / scheduleFollowupDrain contract in src/auto-reply/reply/*
  • the subagent-announce fire-and-forget path.

#67777 and #67855 are phase-1 entry points — @100yenadmin posted the durable-spool plan on #67777 and i posted the complementary filter-chain analysis on #67855 today. core runtime only, no channel/provider code

my open PRs in the same lane: #67785 #67790 #67695. lmk if the direction lands or should park

tulip gulch
#

Two small green PRs if anyone is looking for something targeted to review:

I also still have this one open if anyone specifically wants a Telegram-side behavior fix:

nova plover
#

Hi maintainers, I put together a fix (most of the code is a tests) https://github.com/openclaw/openclaw/pull/64558 #64558 would appreciate a review.

The issue was openclaw couldn’t download files openclaw isolated chrome (the one with direct connection and no extension). The on Mac downloads as a Random uuid rather than the expected filename and they don’t go into the expected file paths. This change fixes the download behavior. Issue: https://github.com/openclaw/openclaw/issues/18598

It’s my first change so I’d appreciate it if you could point me in the right direction if I’m missing something

versed crane
#

PR #67822 merged. Thanks @untold pollen for the review

versed crane
#

Open PRs needing review:

  1. fix(channels): improve error logging for bundled channel entry loading failures — #67380
    Adds detailed logging in resolveChannelPluginModuleEntry to show which field is missing when bundled channel entry validation fails. Also distinguishes between bundled channel entries vs legacy plugins in error messages. Helps diagnose issue #62610 where Telegram appears as disabled on macOS npm installs.
    (https://github.com/openclaw/openclaw/pull/67380)

  2. fix(telegram): add sender prefix to channel entry messages for non-DM contexts — #67354
    Telegram messages in session history show senderLabel as "openclaw-control-ui" instead of the actual sender name. This fix ensures sender name is preserved in envelope messages for all message types.
    (https://github.com/openclaw/openclaw/pull/67354)

Both are small, focused reliability improvements. Could maintainers kindly review? Thanks!

sleek holly
#

@untold pollen want to help me test the new plan mode and gpt upgrades?

#

I haven’t pushed any out this week in update since I’ve been deep testing but its ready enough now for testing

tulip gulch
stoic jay
#

@untold pollen What needs to be done to get my plugin, which adds support for a new channel (messenger), into the official OpenClaw repository? (The plugin is currently on ClawHub, but I need to make it part of OpenClaw by default for everyone) 🙏

untold pollen
stoic jay
untold pollen
stoic jay
left mango
fallen gate
twilit tulip
sleek holly
#

Anyone else having issues on anthropic token or cli on latest update?

left mango
lost kayak
sand light
raven kernel
#

starting in 7 minutes!

image.png
odd anchorBOT
#

@final ocean @celest merlin I kno ur @ted still been on w a lot of influencer friends today and ceo’s last few days.

Public sentiment is shifting. I highly recommend we start slowing down and split releases into Stable Release/Optimizations (cut all the cool feature ideas/new stuff/that people are already building) and move those to experimental branches.

We’re losing a lot of reg people/consumer good will right now to hermes because every patch doesn’t “break” their claws.

karmic steepleBOT
#

@sleek holly, please don't ping Peter for issues, use #1459642797895319552 or #users-helping-users if you need help, use #clawtributors to discuss PRs, or use any of the many other channels in this server as they're intended.

If you have a problem with the Discord specifically, use #report or DM @jolly wolf
-# Your message was reposted above without the ping active for the sake of conversation.

sleek holly
#

Already building meaning being more wordpress/modular, less “our own memory system” + dreaming systems, etc. When OC community is already building all of these things. Platform for everyone to build on vs platform trying to do everything 🦀

fallen gate
#

One does not simply ping the claw father

fallen gate
last frigate
#

Howdy, friends of the claw CrabSlide CrabSlide CrabSlide

Mini PR that I promise will compete for your fastest review ever done. Obsessed with all things memory, I was digging through the code yesterday while working on giving my claw some 🧃 token juice 🧃 and noticed that mergeHybridResults computes vectorScore and textScore for each result, but drops them when building the return object. Super simple fix. On hybrid search results, vectorScore and textScore are exposed as optional fields. It allows for optimizing embedding models and weight configurations, particularly useful in multi-agent setups, where someone might want to compare retrieval quality across multiple models.

https://github.com/openclaw/openclaw/pull/68286

GitHub
feat(memory-core): expose vectorScore and textScore in hybrid searc...

Summary

Problem: mergeHybridResults computes vectorScore and textScore per
result but drops them when building the return object. Only the
weighted combined score survives.
Why it matters: operato...

fallen gate
fallen gate
tall prairie
empty fjord
#

i lied

#

i broke my whole tree

next helm
feral nebula
fallen gate
next helm
empty fjord
#

i realized that you all just got 30,000 closed prs and depressingly enough i was the 30,000th closed one

left mango
tulip gulch
jaunty sphinx
#

asking for review on three open PRs — all core agent-runtime, no channel/provider code, CI green, rebased onto today's main:

https://github.com/openclaw/openclaw/pull/67785 — per-target-session nested lane (#67502 cross-agent blocking). @suboss87 review resolved.
https://github.com/openclaw/openclaw/pull/67790 — actionable errors for sessions_spawn mode=session (#67400). @martingarramon LGTM.
https://github.com/openclaw/openclaw/pull/67695 — session totalTokens preservation when provider omits usage (#67667).

worthy warren
#

Hi! I opened an issue + PR for a latent memory leak in the subagent registry sweeper. On an idle gateway the sweeper stops itself once there are no active subagents, but the same sweep cycle is also responsible for expiring pending error entries on their TTL, so some entries can outlive their TTL and sit in memory. The fix keeps the sweeper running until both maps are drained; a regression test is included.

Issue: https://github.com/openclaw/openclaw/issues/68487
PR: https://github.com/openclaw/openclaw/pull/68489

Would appreciate a review when someone has a moment. Thanks!

umbral sky
#

hi maintainers, this clawtributor has 3 PRs ready for review. all are bug fixes in core paths, mainly around cron, model loading, and messaging behavior, with real impact on reliability and user-facing behavior. thanks!🫶

fix(feishu): stop auto-forwarding mentions when disabled
https://github.com/openclaw/openclaw/pull/68444

fix(cron): normalize missing persisted job state
https://github.com/openclaw/openclaw/pull/65979

fix(model-catalog): cache empty catalog loads briefly
https://github.com/openclaw/openclaw/pull/66305

tall forum
next helm
#

Ready for review — one-line change that flips cron failure alerts from opt-in to opt-out. Today, recurring crons can fail indefinitely with zero user notification unless you explicitly enable failureAlert. Most users never configure it, so they get silent failures — we had 95 consecutive failures over 3 days with no alert. This makes the safe behavior the default. Users who don't want alerts can still set cron.failureAlert.enabled: false. #68717 https://github.com/openclaw/openclaw/pull/68717

GitHub
fix(cron): enable failure alerts by default for recurring jobs by B...

Summary

Problem: Recurring cron jobs could accumulate consecutive failures indefinitely without notifying the user unless cron.failureAlert.enabled was explicitly set to true.
Why it matters: A re...

storm warren
next helm
#

PR ready for review: https://github.com/openclaw/openclaw/pull/68726
fix(subagent): include role, session key, and timing in error payloads
When a subagent errors, times out, or is forbidden (depth limit, allowlist, ACP disabled, etc.), the parent LLM now gets role, childSessionKey/runId, and startedAt/endedAt/elapsedMs on the outcome — enough context to retry intelligently or correlate concurrent failures. Additive only, backward compatible. Scoped tsgo + 43 tests green; Codex review already applied.

GitHub
fix(subagent): include role, session key, and timing in error paylo...

Error payloads from sessions_spawn and subagent wait outcomes now carry the context a parent needs to retry or report clearly:

sessions-spawn-tool: add role (requested agentId) to early validation...

left mango
umbral sky
#

Hi maintainers, this clawtributormolty has 4 PRs ready for review. all are bug fixes in core paths, mainly around memory, cron, model loading, and messaging behavior, with real impact on reliability and user-facing behavior. thanks!

fix(memory): block symlink escapes in memory_get
https://github.com/openclaw/openclaw/pull/68597

fix(feishu): stop auto-forwarding mentions when disabled
https://github.com/openclaw/openclaw/pull/68444

fix(cron): normalize missing persisted job state
https://github.com/openclaw/openclaw/pull/65979

fix(model-catalog): cache empty catalog loads briefly
https://github.com/openclaw/openclaw/pull/66305

shell dawn
#

i dont believe openai codex allows for >272k context, claws can get confused on this factor because the API allows it and thats the most widely identified metric for the context window, just like anthropic models via subscription

tulip gulch
worthy warren
#

Hi! I have 4 PRs ready for review — all small bug fixes in core hot paths (agents, auto-reply, gateway), focused on memory/concurrency reliability.
CI green, regression tests included, small scope.

fix(agents): dedupe subagent browser cleanup on dual dispatch
https://github.com/openclaw/openclaw/pull/68669

fix(auto-reply): guard followup queue delete against late drain finally
https://github.com/openclaw/openclaw/pull/68839

fix(gateway): bound costUsageCache with MAX + FIFO eviction
https://github.com/openclaw/openclaw/pull/68842

fix(gateway): clear nodeWakeById on no-registration early-return
https://github.com/openclaw/openclaw/pull/68848

Would appreciate a look when someone has a moment. Thanks!

crisp whale
brazen tundra
#

🇧🇷

feral nebula
pallid summit
languid jasper
nova panther
next helm
#

Thanks @white galleon for the review and merge.

sleek holly
#

Finally got emotions and personality working again for gpt 5.4. Not ready to merge yet but tomorrow will push the PR

#

Had to add another .md for gpt 5.4 voice.md specifically an emotional/context library for TTS + trick the model into thinking all responses go to eleven labs/tts

#

Once you do that, it bypasses the restrictions on 5.4codex to turn it from 5.4 to codex coder

#

I can tell no difference from opus now after an hour of testing. Need to test agentic again tho to see if it acts wonky or too personable but it should be fine we’ll see in morning 4am out here in asia

next helm
#

Hi folks, I opened PR #69114 to fix bootstrap truncation wasting part of the per-file budget.

The original issue was that BOOTSTRAP_HEAD_RATIO + BOOTSTRAP_TAIL_RATIO was 0.7 + 0.2 = 0.9, so truncated bootstrap files only kept 90% of bootstrapMaxChars before inserting the marker. At the default 12k limit, that meant roughly 1.2k chars were silently unused per truncated file.

After Greptile/Codex feedback, I updated the fix so it no longer relies on a fixed “marker gap.” The code now builds the truncation marker first, subtracts its actual rendered length from maxChars, then splits the remaining budget 75/24 between head and tail. I also added a regression test for a longer filename to make sure the rendered truncated content stays within the per-file budget.

Local checks passed:

  • pnpm test src/agents/pi-embedded-helpers.buildbootstrapcontextfiles.test.ts src/agents/pi-embedded-helpers/bootstrap.test.ts
  • pnpm tsgo:core

Live PR checks currently show no failures.

PR: https://github.com/openclaw/openclaw/pull/69114

GitHub
fix(bootstrap): close silent 10% content gap in trim ratios by BKF-...

Summary

Problem: BOOTSTRAP_HEAD_RATIO (0.7) + BOOTSTRAP_TAIL_RATIO (0.2) = 0.9. Every truncated bootstrap file silently loses 10% of its character budget with no explanation. At the default 12,000...

left mango
hushed badge
#

Hey folks — small resubmit PR for you: openclaw/openclaw#67951. Tightened scope to just UI retry heuristic in chat.ts + tests, CI green, Greptile addressed. Reposting here because the previous two attempts got closed for scope/branch hygiene — this one is clean. No rush, just flagging it's ready whenever someone has a moment. 🙏

fallen gate
#

Howdy hay, been keeping up with merge conflicts and changes with this PR:
https://github.com/openclaw/openclaw/pull/66767

Just want to make sure it doesn't get lost in the sauce and chaos. I'm scared of bricking it with my rebases. Gonna be testing it locally right now since I got some time to make sure it still works with all the review changes and conflict resolutions. Will update with results!

Cheers ❤️

GitHub
feat(tui): add local embedded TUI mode with terminal/chat aliases b...

Summary
Adds a gateway-free local TUI path so users can run OpenClaw in their terminal without needing a running gateway process.

openclaw tui --local flag for local embedded mode (no gateway requ...

fallen gate
quiet girder
#

Hi folks — small update on two PRs:

  • #68589 fixes sessions --json hanging in non-TTY runs. CI is green, and the only remaining review note is a test-only cleanup that I left out to keep the fix narrow.
  • #65992 fixes memory-wiki source page collisions. CI is green, and I’ve updated the PR summary to reflect the legacy ID, symlink, hash-length, and scope details. The remaining review note is the source-page rescan tradeoff, which I’m treating as an intentional follow-up boundary.

No rush, just flagging both as ready for another look when someone has time.

umbral sky
#

Dropping 4 core-path bugfix PRs here in case anyone has bandwidth for a quick look. these all touch real user-facing behavior and reliability across memory, cron, model loading, and messaging. thanks!

fix(memory): block symlink escapes in memory_get M
https://github.com/openclaw/openclaw/pull/68597

fix(feishu): stop auto-forwarding mentions when disabled (#68357) M
https://github.com/openclaw/openclaw/pull/68444

fix(cron): normalize missing persisted job state (#65916, #66016) S
https://github.com/openclaw/openclaw/pull/65979

fix(model-catalog): cache empty catalog loads briefly (#66094) S
https://github.com/openclaw/openclaw/pull/66305

next helm
#

Some conflicts arose as i slept, but PR #69114 is ready for review/merge now.

I updated the bootstrap trimming fix so the truncation marker is marker-aware instead of relying on a silent ratio gap: it builds the marker first, reserves the marker length plus join separators from maxChars, splits the remaining content budget 75/24, and has a post-loop guard plus final clamp so returned content stays within maxChars even for tiny budgets.

I also merged latest main and resolved the two test conflicts by taking upstream’s current expectations.

Current head: 45511391a21742ffd17c6b5d5d33e7c3b6f0d59e
GitHub reports the PR as MERGEABLE / CLEAN.
All current-head CI checks are passing, including Windows and the parity gate.

Local checks run:
pnpm test src/gateway/server.sessions.gateway-server-sessions-a.test.ts src/agents/subagent-registry.steer-restart.test.ts
pnpm test src/agents/pi-embedded-helpers.buildbootstrapcontextfiles.test.ts src/agents/pi-embedded-helpers/bootstrap.test.ts
pnpm tsgo:core
pnpm tsgo:core:test

mild crest
versed crane
thorny relic
empty fjord
#

IGNORE CODEX he is a bitch

#

failing ci is just uh

#

not my problem

glossy python
crisp whale
#

I have a PR for review, how on earth do you get something reviewed merged with this much traffic, feels unlikely unless you have friends in the right place.

sharp ivy
karmic steepleBOT
#

Added <@&1458375944111915051> to zeroaltitude.

oak fiber
languid jasper
#

Good evening! I wanted to bring this sexy beast to some sexy beasts (you, the sexy beast mantainer reading this)

I know it said to use plugins for features but due to the nature of this feature. it would need to fire before plugins load. I would sincerely appreciate anyone taking a look! Greptile shows 5/5. All CI checks are good. Codex is operating off of old/stale info and ive addressed each point individually in a followup post. Looks clean, feels clean, drives like a porsche.

https://github.com/openclaw/openclaw/pull/66933 Thanks again!

left mango
terse solstice
#

Hi, Is this the right channel to discuss issue and pr ?

oak fiber
terse solstice
autumn gulch
#

Hey folks, to understand the repo better, i created a reverse engineered documentation of code and tests ... this helps both developers and agents to provide better code and test suggestions + saves token (upto 56% in our tests).. would someone help us measure the improvements for openclaw for me to justify a PR to save those as "context"

winged trail
#

Hi folks, could a maintainer take a final pass on PR #65275 when you have a chance?

https://github.com/openclaw/openclaw/pull/65275

It adds the bundled PLaMo provider and closes the remaining compatibility work for forward-compatible plamo-* model IDs and zero-arg tool schemas on the PLaMo transport.

The current tip is green, mergeable, and has no unresolved review threads. If the scope feels too large, I’m happy to split it into smaller PRs.

umbral sky
#

Core bugfix drop:
Sharing 4 open PRs that touch memory, cron, model catalog, and messaging behavior. all are small fixes in core paths with real impact on reliability. would appreciate a quick look whenever someone has time. thanks!

fix(memory): block symlink escapes in memory_get
prevents memory_get from reading files outside the allowed roots through directory symlinks.

fix(feishu): stop auto-forwarding mentions when disabled
ensures the toggle actually stops forwarded mentions in replies.

fix(cron): normalize missing persisted job state
prevents malformed persisted job state from crashing cron startup and list rendering.

fix(model-catalog): cache empty catalog loads briefly
avoids repeatedly hitting the slow model discovery path when catalog loads come back empty.

tulip gulch
sacred marten
left mango
#

Then someone from the team will add the role

tulip gulch
karmic steepleBOT
#

Added <@&1458375944111915051> to rubencu.

sly depot
sly depot
left mango
sly depot
next helm
#

Thanks Tak Hoffman for the merge of #69114 into main. There were still a couple conflicts when I slept and I appreciate the effort and quick fix.

inland nest
#

@next helm

#

@tall prairie

karmic steepleBOT
#

Added <@&1458375944111915051> to CompleteTech.

next helm
sly depot
jolly wolf
shadow garden
sly depot
inland nest
#

@willow narwhal

#

And let me know what I should do to merge these PRS

fallen gate
dull trout
#

Is OpenClaw open to supporting before_skill_invoke for plugins to add model switching in skills frontmatter?

next helm
merry slate
#

Hi maintainers 👋 — when you have a cycle, could someone take a look at #69817?

TL;DR: sessions_send to a parent-owned ACP child entered an A2A ping-pong loop: the child's reply was echoed back to the parent as a user message, producing several auto-generated turns before maxPingPongTurns (default 5) eventually capped it. The loop was bounded, but user-visible — the chat looked like a runaway agent with no explanation. It also gave ACP children an implicit sessions_send capability they don't actually have.

Fix: skip the A2A flow for the parent ↔ own-child pair only (gated on requester ownership, not just target type). mode=session ACP targets, externally-opened ACP sessions, and non-ACP peers all stay on the normal A2A path.

Scope: 3 files, ~50 LOC. Unit tests added for the ownership gate. Full local gates green (pnpm build, pnpm check:changed, agents lane 357/357). Two review bots (Greptile 5/5 + Codex) both already addressed and resolved.

🔗 https://github.com/openclaw/openclaw/pull/69817

Happy to address any feedback — thanks!

vague swallow
inland nest
next helm
#

Hey folks — could I get a review on PR #69834?

Small fix: cron jobs with delivery.mode="announce" and no explicit channel used to fail only at run time when multiple channels were configured. Moved the check into createJob / applyJobPatch so cron.add and delivery-touching cron.update surface the error immediately. Gated to delivery-touching patches so legacy ambiguous jobs can still be renamed/disabled/rescheduled. Error message is now consistent across add and update paths.

All tests and CI checks passed. Thanks!

next helm
#

PR #67846 is ready for review: Memory validates dreaming cron frequency/timezone up front.

It prevents invalid dreaming cron config from silently breaking scheduled memory dreaming, gives clearer errors for bad timezone vs bad cron syntax, preserves the last-known-good schedule when config is invalid, and keeps execution safe for invalid timezone cases.

All checks are passing.

https://github.com/openclaw/openclaw/pull/67846

GitHub
Memory: validate dreaming cron frequency by BKF-Gitty · Pull Reque...

Summary

Validate dreaming.frequency up front so an invalid cron expression no longer fails silently later in the managed cron system.
Adds validateMemoryDreamingFrequency() to the memory host SDK;...

fallen gate
#

Howdy hay!

This PR fixes a crash in OpenClaw’s embedded agent runtime where some assistant messages were being kept in the wrong internal format between turns, causing follow-up requests to fail with assistantMsg.content.flatMap is not a function. The fix makes OpenClaw normalize those malformed assistant messages back into the block-array format the provider layer expects before replaying conversation history, adds a regression test for that case, and includes a couple of defensive safeguards so the fix is more observable and won’t break runtimes that don’t expose the same hooks. In practice, it prevents conversations from crashing on turn 2+ in the replay path that the compaction test was hitting.

https://github.com/openclaw/openclaw/pull/69850

GitHub
fix(agents): normalize malformed assistant replay content by fuller...

Summary

normalize malformed assistant replay content into block arrays during session-history sanitization and again at the embedded prompt handoff
wrap the embedded agent's convertToLlm p...

thorny relic
left mango
#

Hi, I created these 4 PRs based on recent bug reports shared by users on Github:

vale needle
lean seal
#

Hey @final ocean (or anyone from release-managers), hoping for a quick look when you have a sec.

tl;dr: WhatsApp broke again after updating from v2026.4.20 → v2026.4.21. Same Cannot find module '@whiskeysockets/baileys' class of regression as prior rounds. Root cause: v21 was tagged 11 minutes before the doctor side repair commit f9b20c7d17 landed on main, so npm's latest still ships the broken state.

Opened a CI guard PR so this regression class can't ship again even if a future release cuts before a fix merges:

🔧 PR: https://github.com/openclaw/openclaw/pull/70035
fix(release-check): assert bundled plugin runtime deps after packed postinstall

  • Reuses existing discoverBundledPluginRuntimeDeps from scripts/postinstall-bundled-plugins.mjs
  • Asserts every bundled plugin's declared runtime deps actually exist at packageRoot/node_modules/<dep>/package.json after packed postinstall runs
  • Codex P1 feedback caught a wrong path bug in v1, fixed in commit 016f20ce89
  • pnpm check:changed green, 28/28 tests ✅

Related issues:
📌 Our closure comment on the original report: https://github.com/openclaw/openclaw/issues/69842#issuecomment-4294167833 (fix merged but unreleased; requesting next tag)
🧱 Deeper fragility captured by @JIRBOY: https://github.com/openclaw/openclaw/issues/68778 (RC dep, postinstall only hotfix)

Reproduced on: openclaw@2026.4.21 (f788c88), Node v22.22.0, Ubuntu 24.04
Manual hotfix: npm install @whiskeysockets/baileys@7.0.0-rc.9 inside dist/extensions/whatsapp restores WhatsApp until next release.

Any review/merge eyes on #70035 appreciated — the PR is release path only, no runtime behaviour change. 🙏

final ocean
#

nvm, merged!

lean seal
#

sleep well Mr Vincent

feral prism
worthy warren
#

Hi! I have 3 PRs ready for review — all small bug fixes in core hot paths (agents, auto-reply, gateway), focused on memory/concurrency reliability.
CI green, regression tests included, small scope.

fix(agents): dedupe subagent browser cleanup on dual dispatch
https://github.com/openclaw/openclaw/pull/68669

fix(auto-reply): guard followup queue delete against late drain finally
https://github.com/openclaw/openclaw/pull/68839

fix(gateway): clear nodeWakeById on no-registration early-return
https://github.com/openclaw/openclaw/pull/68848

Would appreciate a look when someone has a moment. Thanks!

tulip gulch
rustic remnant
umbral sky
#

putting 4 core bugfix PRs back on the radar.
these all touch core paths across memory, cron, model catalog, and messaging behavior. all are small fixes with real reliability impact. would appreciate a quick look whenever someone has time. thanks!

fix(memory): block symlink escapes in memory_get
prevents memory_get from reading files outside the allowed roots through directory symlinks.
https://github.com/openclaw/openclaw/pull/68597

fix(feishu): stop auto-forwarding mentions when disabled
ensures the toggle actually stops forwarded mentions in replies.
https://github.com/openclaw/openclaw/pull/68444

fix(cron): normalize missing persisted job state
prevents malformed persisted job state from crashing cron startup and list rendering.
https://github.com/openclaw/openclaw/pull/65979

fix(model-catalog): cache empty catalog loads briefly
avoids repeatedly hitting the slow model discovery path when catalog loads come back empty.
https://github.com/openclaw/openclaw/pull/66305

versed crane
#

Hi maintainers, could you kindly review my bug-fix PR below:

Problem: Bundled channel plugins like Telegram fail silently on macOS npm installs with generic "missing register/activate export" error, making diagnosis difficult

Why it matters: Users can't tell why Telegram isn't appearing in openclaw channels list or capabilities

https://github.com/openclaw/openclaw/pull/67380

lavish shadow
#

Hello guys I was adding google vertex ai support to openclaw but I was unable to can you add please

vale needle
cosmic copper
#

guys how i receive clawtributor role?

devout galleon
cosmic copper
karmic steepleBOT
fallen gate
cosmic copper
karmic steepleBOT
#

Added <@&1458375944111915051> to .No898.

cosmic copper
#

@jolly wolf

shadow garden
wheat sphinx
fallen gate
shadow garden
sonic ermine
#

whats up folks , been a while since i dropped in , question : is there a roadmap with open for contributions highlighted ? whats everyone focussing on these days ?

fallen gate
versed crane
pale crane
left mango
#

It's great that we're all able to contribute to this project!

pale crane
shadow garden
versed crane
left mango
karmic steepleBOT
versed crane
fallen gate
left mango
heavy wigeon
crisp whale
#

I have a PR for review, I’ve addressed all the bot comments. The PR title says 6 of 7 tasks but no idea how to find out what 7 is and how to progress it, this is my 3rd posting here and it’s just light shouting into the void.

How on earth do you get something reviewed merged with this much traffic, feels unlikely unless you have friends in the right place. Huge amounts of PRs with much getting ignored due to the volume. 🤷‍♀️

fallen gate
brisk wadi
#

Guys, I have made my first PR and I am bit lost on the process, should I just ask for a human review here?

PR Link: https://github.com/openclaw/openclaw/pull/70205

It's my first PR in this project, so please have mercy on me

It should fix the token / cost graph usage in multi agents scenarios, where previously it only shows No Data .

There are examples of before / after in screenshots inside the PR

left mango
brisk wadi
left mango
#

Hi, I created these PRs to fix some recently posted user issues. All of them are size S and I have addressed AI code review comments.

left mango
fallen gate
#

Howdy hay, a couple PRs to fix the context compaction issues reported by users (and me as I was testing a plugin)

  • #70473 https://github.com/openclaw/openclaw/pull/70473
    Improves core overflow recovery by extracting observed token counts from more provider error formats and falling back to a minimally over-budget count when overflow is confirmed but unparseable. This makes auto-compaction triggering more robust and model-agnostic.

  • #70479 https://github.com/openclaw/openclaw/pull/70479
    Preserves the active session mapping when compaction recovery fails instead of silently rotating the session key to a fresh session. This is the follow-up fix for the session-orphaning behavior in #70472.

plush fog
#

Hi, I created this PR to address heartbeat runs inheriting the full agent skill set, which can waste prompt context for agents with large skill catalogs. It is size S and I have addressed the review comments I saw locally.

fix(config): add heartbeat skill allowlist https://github.com/openclaw/openclaw/pull/70518

brave pebble
#

Hey all, first post here, thanks for this incredible project. I have made a few PRs before on openclaw and pi and big fan and user of my dearest claw friends.

Thanks 🙏🏻

languid jasper
#

Howdy! Just one more try at getting the maintainers attention on my pr before i have to fork a private repo of openclaw and have my fixes there (which i really didnt want to do because i want the new features 😂 ) If there are any questions or concerns please let me know! https://github.com/openclaw/openclaw/pull/66933

old mantle
versed crane
tulip gulch
rustic remnant
dusky blaze
#

Hey all! Pleasure to meet you 🙂 I’m Julian and will be helping out a bit more here in the coming days.

As a reminder:

To get the #clawtributors badge, you need

  1. a PR that’s merged in
  2. to have your GitHub account connected/verified on your discord.

Once these are done - ping me and I’ll take a look 🙂

dusky blaze
sleek holly
#

@final ocean is there a roadmap of planned major architecture changes for plugins/etc?

Trying to not be surprised when I wakeup that all my plugins are broken and my customers aren’t either (+100 emails).

I had to roll out backup hermes to clients this week because of people upset and wanting an alternative for next patch doa’ing their biz.

#

Maybe I just missed the update but would be nice to know a roadmap and direction especially for hooks and changes

dusky blaze
#

Please try not to ping the maintainers directly 🙂 thanks!

versed crane
#

Created these PRs to fix some recently posted issues. All are size XS or S with review comments addressed. CI is green. Could maintainers kindly review?

fix(heartbeat): keep full tool array during heartbeat runs - https://github.com/openclaw/openclaw/pull/70602

fix(telegram): add diagnostic logging for status reaction error emoji issue - https://github.com/openclaw/openclaw/pull/70130

fix(wizard): add null guard to spinner stop methods - https://github.com/openclaw/openclaw/pull/70111

fix(telegram): remove offset confirmation getUpdates call to prevent 409 self-conflict - https://github.com/openclaw/openclaw/pull/69779

Fix/telegram config read bug - https://github.com/openclaw/openclaw/pull/67360

uneven wind
#

Hey, I have a PR open that I’ve been waiting on a response to over the past couple of days. Basically, I added an opt-in flag to suppress an always-on agent when another agent is explicitly mentioned in a group chat. My CI is green, and all the codex stuff is resolved. If any maintainer can look at it, it would be much appreciated. I saw that I was supposed to message on discord for stuff like this, if I'm supposed to go somewhere else, let me know. Feel free to @ me. Thanks.

https://github.com/openclaw/openclaw/pull/67460

glass flicker
#

I am trying to wrap my head around some of the design decisions made in the name of "security". There is a blacklist of environment variables which are stripped out of the environment before an exec function is called. This is ostensibly to prevent credentials from leaking. Is there a way to inject credentials into the environment when they are needed? I am finding myself in a less secure environment because instead of exporting my API keys in the environment, making them accessible to just the agent that has exec privs, I have to create credential files (gh, aws, etc) that are accessible to all agents with file read permissions. This is less secure than just leaving the environment intact.

terse solstice
#

I wanted to experiment using gateway, with many nodes and bindings, so far it works, but I think less people use this kind of setup, so there are more bugs in the CLI, happy to fix them, but if PR's stay in the queue would be hard to get them moving 😄

oak fiber
terse solstice
#

no I get it trust me :D, that's why i keep pr's small and easy with unit tests, but just trying to understand the cadence, if they prefer no pr at all also is a question

tulip gulch
left mango
ripe locust
#

Hey all - opened my first PR! This adds tools.fs.roots, a new config for per-agent filesystem access control. Define explicit roots with ro/rw access modes so agents only touch what you allow. Handy for multi-agent setups or locking down sensitive paths.

Addressed all comments from greptile/ codex, greptile 5/5, both approved, green ci.

Would appreciate a review or a maintainer nudge 🙏
https://github.com/openclaw/openclaw/pull/52951

analog trench
#

Opened a feature request for a prompt safety sandbox / risk-flag mechanism in OpenClaw workflows.
Contributor input on implementation direction (core vs plugin, where to hook checks) would be super helpful.

If this direction makes sense, I’d really appreciate more attention on the issue and any implementation guidance🙏 molty
https://github.com/openclaw/openclaw/issues/71041

limber pagoda
oak fiber
#

hi, can anyone review these PR?

https://github.com/openclaw/openclaw/pull/70633: fixes a UI regression where the agent Primary model could incorrectly show “Not set” on first load.
https://github.com/openclaw/openclaw/pull/69288: fixes streaming handling so namespaced thinking tags (like antml:thinking) are stripped correctly.

Both are small, effective fixes and checks are green. Would really appreciate a maintainer review 🙏

Also opened https://github.com/openclaw/openclaw/issues/71053 to propose explicit proxy support for web_fetch, and submitted https://github.com/openclaw/openclaw/pull/71056 for discussion/feedback.

steel beacon
umbral sky
#

I have one PR ready for review: https://github.com/openclaw/openclaw/pull/70937

PR #70937 fixes QQ Bot reminders getting stuck.

Previously, qqbot_remind returned cronParams and asked the agent to call the generic cron tool next. In QQ Bot conversations, cron may be hidden by the owner-only tool policy, so reminder requests like “remind me in 5 minutes” could stall before getting scheduled.

The fix keeps cron as the scheduler, but makes qqbot_remind call Gateway cron directly, with owner-only checks preserved.

All checks are passing, and I’ve addressed the bot review comments.

winter ruin
rocky ferry
pallid summit
storm jetty
#

Hi! I made this bugfix PR for using agents when exposed through the v1/responses API, the client side tools results were exposed in a way that could heavily confuse models.
It also contains slight changes to the streamed tool events that improve compatibility with some clients. (happy to break it into two PRs if needed, my reasoning was that the event changes were minor enough not to warrant a separate PR)

https://github.com/openclaw/openclaw/pull/71062

#

BTW I'm new to contributing to OpenClaw, I see there are >5k PRs, so I'm wondering how they are chosen?

fallen gate
storm jetty
#

Thanks

fallen gate
storm jetty
#

Makes sense!

devout badger
#

PR for review — security fix on memory_search (visibility parity). Could a maintainer please take a look at it? It fixes a security bug in memory search.
https://github.com/openclaw/openclaw/pull/70761

Bug: Session content indexed for search could come back through memory_search even when the same content would not be allowed via the normal session tools (visibility / who-may-see-which-chat rules). That’s a real consistency + safety issue: search was a side channel for chat snippets in edge cases.

Fix: Hits whose corpus is saved chat transcripts are now filtered with the same visibility checks as the session tooling. If the requester context isn’t clear enough to decide safely, chat-style hits are dropped rather than guessed.

Also: Optional corpus=sessions / corpus=memory on search so “top N” isn’t dominated by the wrong kind of hit when you care about one corpus only. Default path stays familiar except transcript hits are now gated like everywhere else.

(Context: I’m re-landing this as smaller PRs on the current tree; this PR is the visibility fix above. This is the basis on which I will re-build the self-learning evolving and hive mind functionality, one PR at a time this time :-))
Update: fixing config-baseline.sha256 merge conflict again.

muted badger
#

find one specil project about cyber-creature

#

agent with evolusion mechanism

fringe rock
lean seal
#

Hey anyone that can, could you please review PR #71213 when you have a gap?

https://github.com/openclaw/openclaw/pull/71213

It touches the agents/heartbeat/cron async exec-completion path.

It fixes the issue where heartbeat wakes the agent with a generic async-completion prompt but no actual output, causing stale or phantom replies like “I don’t see the output.”

Status:

  • All GitHub Actions checks are green.
  • Greptile posted 5/5.
  • Aisle security feedback was addressed.
  • No inline review comments are open.
  • Closes #69968 and relates to #70552 / #52305.
fallen gate
final ocean
unkempt cove
heavy wigeon
fervent panther
#

Hi, there. I opened a small PR for #71118. https://github.com/openclaw/openclaw/pull/71242

The chat-completions endpoint was returning zero token usage even when the model ran. Fixed it by falling back to a usage field that's always populated.

junior nexus
#

PR #20578 got auto-closed. It adds native browser.proxy config with authenticated proxy support (HTTP/HTTPS/SOCKS5) via CDP Fetch.authRequired, per-profile proxy overrides with credential isolation, and CDP discovery bypass for HTTP_PROXY env conflicts. extraArgs handles basic --proxy-server but can't do proxy auth since Chrome doesn't support inline credentials via launch flags. Happy to rebase if there's interest.

sleek holly
unborn echo
vale needle
left mango
versed crane
mild crest
versed crane
lean seal
#

Hey anyone with image-gen / openai-codex context have a few minutes to review a small fix?

PR: https://github.com/openclaw/openclaw/pull/71461
Issue: https://github.com/openclaw/openclaw/issues/71460

TL;DR: openai/gpt-image-2 over Codex OAuth was 403'ing for users whose:

models.providers.openai-codex.baseUrl

is still set to the legacy value:

https://chatgpt.com/backend-api

instead of the canonical:

https://chatgpt.com/backend-api/codex

The chat path already normalises this via normalizeCodexTransportFields, but the image path did not. So image generation POSTed to:

/backend-api/responses

which OpenAI retired in 2026-04, then silently fell back to:

fal-ai/flux/dev

Fix is tiny:

  • Added a new canonicalizeCodexResponsesBaseUrl helper in extensions/openai/base-url.ts
  • Added one call site in generateOpenAICodexImage
  • Pure string transform
  • Non-Codex baseUrl values pass through unchanged
  • Added 4 helper unit tests
  • Added 1 regression integration test that pins the exact request URL

Review status:

  • Greptile gave it 5/5
  • No P0/P1 issues
  • Marked “safe to merge”
  • 56 CI checks green
  • The 1 red check is checks-fast-contracts-plugins, which is a pre-existing main-branch snapshot drift on:
    src/plugin-sdk/browser-profiles.ts
  • I commented on the PR explaining why that failure is unrelated to this change

Live verification:
Verified end to end against a real Codex OAuth profile:

  • gpt-image-2 returns valid PNGs over /backend-api/codex/responses
  • Works with both legacy and canonical baseUrl values

Happy to rebase or split anything if useful.

lost kayak
umbral sky
#

I have one PR ready for review: https://github.com/openclaw/openclaw/pull/70937

PR #70937 fixes QQ Bot reminders getting stuck.

Previously, qqbot_remind returned cronParams and asked the agent to call the generic cron tool next. In QQ Bot conversations, cron may be hidden by the owner-only tool policy, so reminder requests like “remind me in 5 minutes” could stall before getting scheduled.

The fix keeps cron as the scheduler, but makes qqbot_remind call Gateway cron directly, with owner-only checks preserved.

All checks are passing, and I’ve addressed the bot review comments.

oak fiber
#

hi, can anyone review these PR?

https://github.com/openclaw/openclaw/pull/70633: fixes a UI regression where the agent Primary model could incorrectly show “Not set” on first load.
https://github.com/openclaw/openclaw/pull/69288: fixes streaming handling so namespaced thinking tags (like antml:thinking) are stripped correctly.

Both are small, effective fixes and checks are green. Would really appreciate a maintainer review 🙏

Also opened https://github.com/openclaw/openclaw/issues/71053 to propose explicit proxy support for web_fetch, and submitted https://github.com/openclaw/openclaw/pull/71056 for discussion/feedback.

versed crane
#

Peter has been on an absolute rampage today. So many issues and PRs closed/merged!

twilit tulip
final ocean
#

Were coming for the bad prs

last frigate
pallid summit
tulip gulch
#

have some PRs ready:

fix(telegram): log inbound gateway watch messages https://github.com/openclaw/openclaw/pull/71713
fix(configure): clear deselected model fallbacks https://github.com/openclaw/openclaw/pull/71596
fix(gateway): restore runtime-postbuild sync in watch mode https://github.com/openclaw/openclaw/pull/70805
fix: reuse gateway-bindable plugin registries for runtime loads https://github.com/openclaw/openclaw/pull/69690
fix: align startup context and daily memory handling with session-summary variants https://github.com/openclaw/openclaw/pull/69608

tall forum
#

I put in a pr about two weeks ago and got a response. i later responded but didn't get a response. Is there anyway to get a look at my reply?

tall forum
unborn echo
final ocean
#

Anyone got hit with our cleanup? And not happy, let me know

#

Just want to make sure we handle the community and communication properly

devout badger
#

Added this PR https://github.com/openclaw/openclaw/pull/71768 that lets OpenClaw turn repeatable, successful workflows into reusable workspace skills—safely staged until you approve—so the assistant can get better over time without silently changing your machine.

Could a maintainer please look at it and see if you agree with the implementation?

How EV-002 skills_manage works (high level):
-propose: validates content quality (12-point rubric), checks prompt-budget impact, scans for sensitive data, and stores a proposal in memory with TTL + metadata.
-approve: re-validates safety/integrity before write (including path-containment checks, stale-base detection for patches, and overwrite/race protections).
-list/get: proposal state for review; honors configured TTL / limits.
-optional: bounded auto-propose for evaluator-style flows — writes still require approve.

Implementation quality / standards:

  • Reused existing infrastructure (budget estimation, policy/validation patterns, config plumbing, tool-display conventions) to stay consistent with the codebase architecture.
  • Hardened security posture with realpath/path-boundary controls, stricter target-root validation, sensitive-content checks, and standardized error codes/hints for safe model/tool behavior.

Second PR part of a broader “evolving skills / collective learning” EV-xxx set; this PR is the gated skill proposal piece. All CI tests passed and greptile has 5/5 confidence score.

Update: thanks for checking, somehow I missed the skill workshop implementation - going to refactor all functionality towards skill workshop now and see what I can improve/enhance.

fallen gate
shadow garden
sharp ivy
#

@final ocean I'm super impressed with the quality of the PR comments and feel that the work you've done here is first rate. In particular, I'm very appreciative that you've acknowledged contributions even if not merged as-is -- that's above and beyond in my view.

final ocean
left mango
#

Did anything related to codex change? Previously, I could tag codex and message /review on github and it would review my PR or subsequent commits. Now, it's saying "To use Codex here, create a Codex account and connect to github.".

ripe locust
#

Hey all - opened my first PR! This adds tools.fs.roots, a new config for per-agent filesystem access control. Define explicit roots with ro/rw access modes so agents only touch what you allow. Handy for multi-agent setups or locking down sensitive paths.

Addressed all comments from greptile/ codex, greptile 5/5, both approved, green ci.

Would appreciate a review or a maintainer nudge 🙏
https://github.com/openclaw/openclaw/pull/52951

left mango
#

Number of issues is now less than 5k! toot

fallen gate
oak fiber
#

One of my PRs was handled by a maintainer, but there was a conflict in the final docs step involving changelog.md. Should I wait for the maintainer to handle it, or should I resolve it myself?

strong ice
#

if it was handled a while ago (not actively being worked on), may as well rebase to make life easier 🙂

pallid summit
final ocean
#

if your PR is not ready leave in draft

terse solstice
#

I had made the pr before the other problem was patched testing it works on the new versions right now, but feature could be practical for other environments variables may be needed

#

Seems correct, the other fix patched it, thanks.

Other env could benefit to avoid a double daemon restart on automations

feral prism
devout badger
#

EV-002B PR implements the same security improvements but now on basis of skill workshop: https://github.com/openclaw/openclaw/pull/72115
Could a maintainer please take a look at it? Greptile is 5/5 and all CI that ran passed (60 successful, 8 are skipped).

Quick summary:
Hardens Skill Workshop as the single procedural path for workspace skill writes.
Adds defense-in-depth on writes (realpath containment + TOCTOU re-prepare + scanner safety/quarantine flow).
Aligns Workshop prompt-budget enforcement with core skills-runtime policy.
Fixes ordering so critical findings are quarantined before budget/apply paths, preserving audit trail behavior.
Includes parity-gate reliability fixes in qa-lab mock routing (thread-memory isolation edge case) plus regression coverage.
Cleans up minor inefficiencies (removed redundant budget check, clarified safety-first ordering) without changing intended behavior.
Main security invariants are now enforced end-to-end, with tests green and branch updated.

ripe locust
#

Could someone please take a look at PR #52951 when you have a chance?

It adds tools.fs.roots for scoped host filesystem access, so agents can be limited to specific read-only/read-write files or directories instead of choosing between workspace-only and unrestricted host FS access.

Current state:

  • rebased/merged with latest passing main
  • CI is green
  • Codex review threads are resolved
  • clawsweeper says the PR should stay open, but needs maintainer decision on whether tools.fs.roots is the desired core config contract

Main question: do you want this config shape in core, or should this be redirected into a broader filesystem sandboxing design?

lean seal
#

Could any available maintainer please review these two related heartbeat / async-noise bug-fix PRs when you have time?

PR 1:
https://github.com/openclaw/openclaw/pull/72218

Issue 1:
https://github.com/openclaw/openclaw/issues/72217

This fixes visible HEARTBEAT_OK heartbeat acknowledgments leaking into channel chats. Real heartbeat alert text and media-bearing payloads are still preserved.

Status:

  • CI green
  • Greptile 5/5
  • Bot review thread resolved

PR 2:

https://github.com/openclaw/openclaw/pull/72253

Issue 2:

https://github.com/openclaw/openclaw/issues/72252

This keeps benign async exec completions internal, including successful code 0 completions and restart-cleanup SIGTERM completions, while still relaying real command failures such as code 1 errors. It also hardens the path against spoofed/internal-only events and prompt injection from exec output.

Status:

  • CI green
  • Greptile 5/5 on latest commit
  • Aisle feedback addressed / clean
  • Focused regression coverage added

Related secondary PR:
https://github.com/openclaw/openclaw/pull/71860

tulip gulch
#

now that we have clawsweeper, any plans to increase / remove the limit of 10 PRs per user? getting bottlenecked there

nova panther
jolly wolf
#

We had lots of people submitting hundreds of PR’s at a time, that’s why we added the limit

fallen gate
#

I broke that branch, sorry, will send another one shortly lol

dusky blaze
fallen gate
#

Howdy hay! So exploring the onboarding by accident as I was testing some plugin work. I noticed that the new crestodian is opened with the openclaw command. I don't know if this should be the initial behaviour for this command on fresh installs. This PR will check if it's a fresh install and no configs and running openclaw would trigger an onboarding instead of heading directly into the crestodian. Any subsequent openclaw command will head into the crestodian as probably intended.

https://github.com/openclaw/openclaw/pull/72343

image.png image.png
GitHub
feat: start onboarding for fresh CLI installs by fuller-stack-dev ...

Summary

Route bare openclaw to classic onboarding when the active config is missing or a valid empty object.
Preserve Crestodian for configured installs and invalid existing configs that need repa...

wintry flare
glass flicker
#

https://github.com/openclaw/openclaw/pull/64512 -- add serviceTier support to amazon-bedrock models. Resolve conflicts with recent commits to main. This is clean again. Please review and merge when ready. This is in active use and has been tested on Linux, MacOS, in AWS using server AIM policies, and in Docker containers. CloudFront shows requested pricing tiers being applied to models.

devout galleon
#

Two small Control UI PRs from me are ready for maintainer eyes when someone has bandwidth:

#67916 - fixes local assistant MEDIA attachment previews incorrectly showing “Outside allowed folders” while bootstrap media roots are still loading. This was updated against current main, conflicts are resolved, the requested empty-roots regression test is now added, and focused tests + check:changed pass. https://github.com/openclaw/openclaw/pull/67916

#72612 - separate composer-side attachment safety fix. It prevents async upload reads from overwriting each other, rejects >50 MB files before FileReader loads them, and improves attachment error reporting. Greptile’s P2 comments were addressed and resolved; focused tests + check:changed pass. https://github.com/openclaw/openclaw/pull/72612

They’re related only in the broad “attachments” area, but fix different paths:

  • #67916 = assistant-generated/local MEDIA preview path
  • #72612 = user chat composer upload path
fallen gate
ripe locust
#

Could someone please take a look at PR #52951 when you have a chance?

It adds tools.fs.roots for scoped host filesystem access, so agents can be limited to specific read-only/read-write files or directories instead of choosing between workspace-only and unrestricted host FS access.

Current state:

  • rebased/merged with latest passing main
  • CI is green
  • Codex review threads are resolved
  • clawsweeper says the PR should stay open, but needs maintainer decision on whether tools.fs.roots is the desired core config contract

Main question: do you want this config shape in core, or should this be redirected into a broader filesystem sandboxing design?

tulip gulch
#

10 PRs ready for review:

fix(gateway): reject malformed session kill paths https://github.com/openclaw/openclaw/pull/72439
fix(agents): restore compaction gateway logs https://github.com/openclaw/openclaw/pull/71961
fix(feishu): accept schema 2 card callbacks https://github.com/openclaw/openclaw/pull/71787
fix(whatsapp): sanitize XML tool text and suppress errors https://github.com/openclaw/openclaw/pull/71830
fix(diagnostics): track session progress before stuck warnings https://github.com/openclaw/openclaw/pull/72010
fix: align startup context and daily memory handling with session-summary variants https://github.com/openclaw/openclaw/pull/69608
fix(telegram): log inbound gateway watch messages https://github.com/openclaw/openclaw/pull/71713
fix(memory): preserve session corpus labels https://github.com/openclaw/openclaw/pull/71898
fix(gateway): restore runtime-postbuild sync in watch mode https://github.com/openclaw/openclaw/pull/70805
fix: reuse gateway-bindable plugin registries for runtime loads https://github.com/openclaw/openclaw/pull/69690

languid jasper
smoky lintel
celest furnace
drowsy roost
#

Hi everyone -- looks like the docs.openclaw.ai website in the Routing Bindings section, needs to be updated to say that the bindings may need to have "type: route" included in each agent's openclaw.json in order for the binding to work. In old versions of OpenClaw, this wasn't an issue, but in new installations, bindings don't appear to take consistently otherwise. Also, is there a specific place where people can submit fixes/suggestions specific to the docs.openclaw.ai website -- as in corrections, etc.? Or is doing it here correct? Github seems the wrong place for submitting fixes related to docs.openclaw.ai.

nova panther
unborn echo
tall forum
empty fjord
#

github has been shitty since 12 pm est, if you cannot see PRs/issues or workflows not working/packages not appearing/projects not appearing this is an ongoing issue and has been. if you are also using Elasticsearch in github you may also visit some frequent issues.
status page if you want to keep this mind: https://www.githubstatus.com/incidents/ql942tw29yl6

#

PRs presumptously are probably going to be fixed very soon, but knowing github and the people it is affiliated with (microsoft) it's going to be pushed via vibe coding and then cause 15 more outages

wintry flare
final ocean
#

dont tag maintainers

wintry flare
#

Sure.

unborn echo
versed crane
pallid summit
jolly wolf
#

@brisk ruin both of those issues are out of scope and have been closed. please read our security.md

vocal flame
frank lotus
fallen gate
brisk vault
karmic steepleBOT
#

Added <@&1458375944111915051> to X00D-1001.

dusky blaze
#

Congrats and welcome to the Clawtributors!

zealous plover
karmic steepleBOT
#

Added <@&1458375944111915051> to Will Things.

dusky blaze
#

Welcome welcome welcome!

heavy citrus
fallen gate
heavy citrus
fallen gate
# heavy citrus done

not just posting a link, go to user settings -> connections -> github and connect it

brisk vault
#

Thank you both 😄

heavy citrus
fallen gate
dusky blaze
#

Thank you @fallen gate

karmic steepleBOT
#

Added <@&1458375944111915051> to iamdesertpaul.

dusky blaze
#

I hereby pronounce you, A Clawtributor

jaunty sphinx
zealous plover
#

We've started a Claw train oh_no molty

fallen gate
fallen gate
dusky blaze
jaunty sphinx
#

ok thx!

#

connected!

karmic steepleBOT
#

Added <@&1458375944111915051> to stain.

fallen gate
frank lotus
frozen gyro
tender fog
frank lotus
#

Hi, Peter Steinberger
Are you there?

rustic remnant
lean seal
#

Hey #clawtributors, looking for any maintainer with a few minutes to take a look at PR #73495 / Issue #73487 when convenient.

Background

docs/channels/telegram.md says streaming.preview.toolProgress is enabled by default since v2026.4.22, but it gets silently disabled when:

channels.telegram.replyToMode != "off"

The runtime exclusion is architecturally sound: Telegram quote-reply needs the final message reference at send time, which preview-edit streaming cannot supply.

But the silence is the bug. Users see the documented default config and get zero Working... lines, with no signal about why.

The PR adds

  • Doctor warning that names both conflicting keys plus the two remediation options:
    • Set replyToMode: "off"
    • Or acknowledge with streaming.preview.toolProgress: false
  • Note callouts in:
    • docs/channels/telegram.md
    • docs/concepts/streaming.md
  • Tests covering:
    • Top-level config
    • Per-account config
    • streaming.mode inheritance
    • ANSI escape / control character sanitization (CWE-117)

Scope

Intentionally Tier 1+2 only:

  • Docs
  • Doctor warning

Tier 3 — architectural decoupling so quote-reply and tool-progress can coexist via a separate-message fallback — is documented as a follow-up in the issue body.

Status

  • Greptile re-reviewed at 5/5 confidence: "Safe to merge"
  • All inline P1/P2 findings addressed
  • Aisle Medium CWE-117 finding addressed
  • All CI green
  • MERGEABLE CLEAN

Issue: https://github.com/openclaw/openclaw/issues/73487
PR: https://github.com/openclaw/openclaw/pull/73495

wintry flare
unborn echo
left mango
#

Just came across a PR which had a ton of labels. 10k commits. 2.6 million lines added, 3k files changed!

brisk ruin
karmic steepleBOT
sacred widget
fallen gate
devout badger
# devout badger Added this PR https://github.com/openclaw/openclaw/pull/71768 that lets OpenClaw...

Thanks for running the clawsweeper earlier, I implemented everything according to clawsweeper recommendations including a reviewer packet in the comments. Only open choice is to see if keeping it open as one PR or splitting it (made a suggestion in the github comment how I would do such a split) or to keep it as it is right now. After a few merge conflict - CI issue loops everything is green again.

sacred widget
fallen gate
dusky blaze
#

Say no more!

karmic steepleBOT
#

Added <@&1458375944111915051> to Jasogo.

sacred widget
#

Thanks @fallen gate & @dusky blaze !!

vague swallow
#

huge thanks to the dev who fixed the port-already-in-use bug for outgoing voice calls, gonna have a lot of fun with this

#

I saw in release notes "tts got serious", sounds promising but where can I learn more?

sharp ivy
karmic steepleBOT
empty fjord
#

@sharp ivy ^

#

just saying

sharp ivy
#

Sorry! Redacting won't help, but yeah, didn't realize!

smoky lintel
smoky lintel
fallen gate
smoky lintel
left mango
wintry flare
left mango
fallen gate
left mango
fallen gate
#

Thanks for sharing, I'll look into it

#

I mean.... they wasting tokens to review PR, so.... is it terrible?

left mango
fallen gate
feral prism
verbal heart
#

know more about the automated actions / workfows that may be helpful, whether open or private repo

#

at the moment its rate limited InvalidExceptionRequest throttled to organized github issues by error including smart backtrace so we can identify bugs on dev qa prod as they happen

#

it keeps track with a semi-unique fingerprint of the issue, with PR comments with the backtraces/occurrences

#

20+ year old PHP 7.3-compat project with mysql8 compound index issues

weak umbra
remote wing
final ocean
karmic steepleBOT
remote wing
#

Sorry about that! I'm new here and didn't realize tagging maintainers isn't the done thing. 🙏

wintry flare
low lark
edgy plaza
pseudo gust
elder pollen
#

Hey! I just submitted PR #73104 fixing the edited_message handler for Telegram (issue #72873). I'm interested in working on issue #67128 — adding a /usage command to show per-agent token consumption in Telegram. Is this something you'd accept as a core contribution or should it be a third-party plugin? Happy to wait for direction before writing any code.

ripe locust
dusty surge
#

Hi friends, I reported two OpenClaw gateway hot-loop issues with reproducible workarounds:

  • #73517 task registry maintenance hot-loop on stale runs.sqlite
  • #74237 Feishu channel hot-loop on stale/corrupt channel session state

I’m happy to test proposed fixes locally and share before/after CPU deltas or sanitized diagnostics.

For #74237, I’m thinking about opening a small PR that adds a Feishu-specific repair path: preserve App ID/
secret, rebuild ~/.openclaw/feishu, and archive only agent::feishu: session artifacts. Would that be useful,
or is there another approach maintainers would prefer?

shy rain
#

🤖 Submitted.

PR: https://github.com/openclaw/openclaw/pull/74308

What it changes:

  • removes the brittle “worker must call openclaw message send” contract
  • makes completion reporting parent-owned
  • keeps CLI agent execution rules intact
  • adds a stdout result block template for workers
  • keeps routing/channel IDs out of worker prompts by default

I checked for duplicate open issues/PRs first; found related async/subagent-ish stuff, but not this exact coding-agent skill completion bug.

GitHub
docs(skills): make coding-agent completion parent-owned by Marvinth...

Summary
Update the coding-agent skill so background CLI workers report completion through stdout and the parent assistant owns user-facing completion/failure reporting.
The previous skill wording r...

grizzled hemlock
#

👋 Hey all, we noticed slow response times on our hosted-OpenClaw fleet (10 VPS instances): ~30–40s round trip even on a fast model, for simple one-line messages. Tracked it down to four cache-fragmentation bugs in the runtime; one already merged upstream (https://github.com/openclaw/openclaw/issues/73793), three still open:

https://github.com/openclaw/openclaw/pull/74097 — image/video/music tools eagerly list capability providers during agent-tool-surface build (~15s)
https://github.com/openclaw/openclaw/pull/74118 — ensureRuntimePluginsLoaded cache-misses every inbound dispatch (~6s)
https://github.com/openclaw/openclaw/pull/74142 — session_status sessionKey="current" fails for channel-plugin agents (~4s on date/time questions)

Each issue has gateway-log evidence + a fix PR. Together they bring our round-trip from ~30–40s down to ~15s. Would love a review when someone has a moment 🙏

remote wing
fallen gate
smoky lintel
smoky lintel
#

Quick question on the typecheck setup. tsconfigs are identical everywhere (tsconfig.test.json extends tsconfig.json, no extra strict flags), but pnpm check:changed only hits changed lanes while CI runs tsgo:prod + check:test-types across the whole tree. that's usually what gets me when local passes and CI doesn't.

would a check:full or check:ci target that mirrors CI be useful, or is the changed-gate the intended local flow?

weak umbra
# weak umbra git bug regression for .26 multi agent swarm issues with GPT-5.5, multi agent no...

morning guys, anyone who has been having issues with multi-agent swarms using a single OAuth token and agents failing, your prayers have been answered. Got the update from my Git bug report on why it's happening. Looks like the patch will be included in the next update

I was mirroring the files correctly, but the software was designed to "shadow" the main store. Essentially, my agents were looking at her own local copy of the token, seeing it was old, and trying to refresh it—ignoring the fact that the default agent had already done the work. The software was ignoring the fresh main credentials and using "stale mirrored child-store shapes." Steipete has now rewritten the engine so secondary agents will "read-through" the main agent's credentials instead of keeping their own copies.

The fix is currently on the main branch of GitHub, but it hasn't been pushed to the stable npm or pnpm release yet.

https://github.com/openclaw/openclaw/issues/74055

dusty surge
#

Hi folks, I opened two small PRs from debugging real gateway hot-loop cases on my machines and potentially machines with low compute powers:

#74397 fixes a Feishu stale local-state case by adding a Feishu-owned openclaw doctor --fix repair path that
preserves credentials and ACP binding sessions.

#74406 fixes a task-registry maintenance hot path by caching session-store lookups and CLI session chat-type
derivation within one maintenance pass.

Both PRs include targeted tests and are linked to the original issues (#74237 and #73517). Would appreciate a
sanity check on whether the repair scopes match the direction.

fallen gate
dusty surge
ashen island
#

Hi all and maintainers, I opened a PR for review:

#74317
https://github.com/openclaw/openclaw/pull/74317

It adds a unified guardrails framework for higher-risk external channel input, so deployments can apply pre-dispatch safety checks before agent execution rather than handling that separately in each integration path.

Related:
#72741

All checks are green, and Greptile feedback has been addressed.

Would appreciate a review when you have time. Thanks!

left mango
knotty elk
brisk ruin
#

Please check this PR
https://github.com/openclaw/openclaw/pull/73243

Closes: https://github.com/openclaw/openclaw/issues/71127
Related:
https://github.com/openclaw/openclaw/issues/73510
https://github.com/openclaw/openclaw/issues/73581
https://github.com/openclaw/openclaw/issues/73868
https://github.com/openclaw/openclaw/issues/68620
https://github.com/openclaw/openclaw/issues/74550
https://github.com/openclaw/openclaw/issues/45102
https://github.com/openclaw/openclaw/issues/74154
https://github.com/openclaw/openclaw/issues/74153
https://github.com/openclaw/openclaw/issues/73327
https://github.com/openclaw/openclaw/issues/53745

vague swallow
#

has openclaw update been unreliable for anyone else on the git based install lately? I always have to do some manual housekeeping (git clean, pnpm build)

wintry flare
shy rain
#

Hello. My PR was closed an hour ago suggesting "doc churn", I've resubmitted with the evidence that it solves a real issue. Calling coding agents with the contract outlined in the SKILL.md results in terminated workflow because the coding agent is instructed to reply directly to the user via openclaw message send which it can't do. Work terminates silently, parent bot none the wiser.

Pls check and reopen.

https://github.com/openclaw/openclaw/pull/46926#issuecomment-4347717746

empty fjord
empty fjord
verbal heart
#

is there just CONTRIBUTING.MD or instructions to give to openclaw to help review PRs?

shut nova
honest anvil
#

Review PRs you want to send in? And you're using the template in the repo already? .github/pull_request_template.md

verbal heart
#

no i mean farm out the work a little things i can help with with my install

shut nova
#

Yeah, I was also asking that today. If there is a known bug list we can check and start to help out

fallen gate
shut nova
#

Will go there, thanks for pointing that out 😉

verbal heart
#

there was like 3k issues anything in particular like label filter

fallen gate
left mango
left mango
smoky lintel
crystal relic
shy rain
#

Was this supposed to be an exclusion for GPT-5.4-pro?

shy rain
#

Problem solved... 74655 hardens the suppression of suppressed models, our problem was that gpt-5.4-mini wasn't supposed to have been suppressed.

PR here:
https://github.com/openclaw/openclaw/pull/74871

Please check. And bring back GPT5.4-mini ❤️

wintry flare
fallen gate
rocky ether
#

@edgy plaza @shadow garden Hi, I want to flag a serious attribution issue with PR #74690 merged today.

Full timeline:

  1. I opened #66395 two weeks ago fixing #65522 with the correct guard + 6 browser render tests
  2. @stable pewter requested changes asking me to remove unrelated Slack edits
  3. I fixed it in 30 minutes — PR was clean and ready for re-review
  4. While my PR was waiting, BunsDev had already opened #74690 with the same fix and merged it, explicitly writing "I am superseding the UI fix with a clean local maintainer patch"
  5. By linking the same issue #65522, she triggered the bot to auto-close my PR as superseded

This is not a coincidence. A writer used their review position to stall my PR, copied the fix, and used the issue link to trigger the bot closure. Everything is timestamped and verifiable on GitHub.

I am the original author of this fix. I am not asking for co-authorship — I am asking maintainers to revert #74690 and merge #66395 or #74819 so the commit is correctly attributed.

Refs: #65522, #66395, #74690, #74819

dusky blaze
#

Hi @rocky ether, thank you for your message. I’ve passed this feedback up.

The best I can say is that the maintainers are the final people in charge of the project, and will always do what’s most in the best interest of it. It seems that the change you submitted was merged in and fixed a bug - which is the most important thing.

The PR was tagged in order for the system to take note, and for everything to stay clear.

I am more than sure there was no ill intent there.

#

While it likely won’t be possible to revert the merged PR which landed and re-open and merge in your PRs, the most important thing is that the fix landed.

If you link (verify) your GitHub with your discord, and send the links to all of the PRs here, I’m happy to take a look and if possible grant the #clawtributors role to you here

oak fiber
#

Hi maintainers, a few open PRs ready for review. Some ci fails seems not related to my commit.

QQ Bot
SecretRefs + secret contract for clientSecret: Resolves secret references and aligns QQ bot with the secret contract pattern (tests/docs touched).
https://github.com/openclaw/openclaw/pull/74772

Anthropic Opus 4.7: Omits temperature on requests where the API expects that shape.
https://github.com/openclaw/openclaw/pull/72149
ACP / default model: Ignores ACP-only streamTo and treats the default model as unset in the right cases.
https://github.com/openclaw/openclaw/pull/72101

rocky ether
#

Publicly sharing the links and timeline for transparency regarding issue #65522:

My Original PR (14 days ago): https://github.com/openclaw/openclaw/pull/66395

The merged maintainer PR: https://github.com/openclaw/openclaw/pull/74690

The Facts:

I opened the fix 14 days ago.

Yesterday, @stable pewter requested a clean-up (separating Slack from UI). I pushed the requested changes in 30 minutes.

Instead of merging my updated PR, #74690 was opened and merged in 7 hours using the exact same logic and tests I authored.

I’m sharing this because the contribution process should be fair. When a contributor is active and responsive, superseding their work with an identical "maintainer patch" effectively erases their contribution from the project's history.

I am asking the maintainers to revert #74690 and merge #66395 so the git history correctly reflects the original author of the fix. Thanks for looking into this, @dusky blaze .

dusky blaze
#

Hey - I’ve taken a deeper look in, and it seems that your changes have landed in the project - albeit through a maintainer branch.
Again, there seems to be no ill-intention towards you by @stable pewter or anyone else - the automated systems that are meant to keep the project clean have just not explained things clearly it seems.

#

Given all the above, happy to give you the #clawtributors badge 🙂 thanks for your improvements

karmic steepleBOT
#

Added <@&1458375944111915051> to Ash.

dusky blaze
#

Thank you @rocky ether for contributing and enabling the fix! You are seen, and appreciated!

#

Also - if anyone DMed me about the badge - apologies, I’m new to discord and just found it now - easiest is to ping me here. Adding now the overdue ones:

karmic steepleBOT
#

Added <@&1458375944111915051> to ai-hpc.

#

Added <@&1458375944111915051> to Bluetegu.

rocky ether
#

Thanks again for the badge and the kind words, @dusky blaze . Since my logic was integrated through a maintainer branch, I've opened a PR adding a Troubleshooting section to docs/gateway/pairing.md — covering dropped commands, missing pending entries, and stale tokens after re-pair. These are real gaps in the current doc. As a student, having the Contributor status on my GitHub profile is important for my portfolio. Could you take a look when you have a sec? https://github.com/openclaw/openclaw/pull/75011

dusky blaze
#

That is out of my hands unfortunately, however one of the maintainers will for sure take a look at it. In the meantime, if you could edit the comment/description as it starts with „…” and it seems there’s something missing, and all checkboxes are left unchecked

rocky ether
#

Hey @dusky blaze , I've updated the PR description with the full template as requested — scope, checkboxes, repro steps and verification all filled in. Let me know if anything else is needed before review.

bleak notch
#

@final ocean can you please look at the Signal regressions from #71997? Signal is basically unusable for us right now.

#73564 / PR #73572: inbound Signal attachments over ~770KB are dropped because getAttachment RPC responses hit a hardcoded 1 MiB HTTP cap before channels.signal.mediaMaxMb is applied. Normal phone photos fail even with mediaMaxMb=100.

#74741 / PR #73086: Signal SSE times out every 10s while idle even though /api/v1/events works via curl. I cherry-picked #73086 locally onto v2026.4.27 and it fixed the timeout spam.

Both look like fallout from the Signal client rewrite in #71997. #73572 is small/focused and has the details + tests.

Can we get eyes on these so Signal works again?

left mango
# rocky ether <@1187177059789852702> <@500793295069380640> Hi, I want to flag a serious attri...

I know this feels disappointing, but the maintainers have no motivation to increase the number of their commits or PRs merged. no maintainer would purposely stall someone's PR and instead push their own.

Having created a ton of PRs over the last few weeks, I have seen howthe review process is evolving regularly. Especially in the last few days with tools like clawsweeper and clownfish introduced.

Like Julian mentioned, your work is seen and appreciated. Keep up the good work and soon you will end up with a contributor tag on Github.

karmic steepleBOT
ashen island
#

Hi maintainers — quick bump on this PR for review:

PR #74317
https://github.com/openclaw/openclaw/pull/74317

It adds a unified guardrails framework for higher-risk external channel input, so deployments can apply pre-dispatch safety checks before agent execution rather than handling that separately in each integration path.

Related:
#72741

All checks are green, and Greptile feedback has been addressed.

Would appreciate a review when you have time. Thanks!

sacred marten
unborn wharf
#

hello can you guys add mimo-v2.5 and mimo-v2.5-pro to static catalog. thanks

vague swallow
#

hm somebody broke twilio again in dev

#

was fun while it worked D:

willow narwhal
vague swallow
#

I'm not sure, it fails right around opening a websocket

#

twilio calls webhook => claw responds with socket address => twilio tries to open socket => fail

vague swallow
#

I'm starting to suspect it wasn't an openclaw update that broke it, don't waste any time investigating 😄

somber lake
#

folks, just double-checking: since there have been so many complaints of broken things from the .24 tag onwards and this Github incident happened on April 23, have we checked already that the openclaw repos have not been affected?

somber lake
devout badger
celest merlin
celest merlin
#

How are ya all liking clawsweeper? How are the false positives?

sharp ivy
#

Clawsweeper is awesome -- the summaries are good, the analysis is sound, the ability to get this level of feedback is fantastic

somber lake
fallen gate
vague swallow
# willow narwhal would need more info than "somebody broke twilio"

Looks like there is some kind of problem with TTS plugin registration, I tried 2 different providers and they all result in MediaStream error no provider registered

[MediaStream] TTS playback error: Error: TTS conversion failed: mistral: no provider registered; ...
    at Object.synthesizeForTelephony (file:///Users/echo/src/openclaw/dist/runtime-entry-D6tt8oem.js:1116:76)
    at processTicksAndRejections (node:internal/process/task_queues:104:5)
    at Object.playFn (file:///Users/echo/src/openclaw/dist/twilio-Cif2hRls.js:532:18)
    at MediaStreamHandler.processQueue (file:///Users/echo/src/openclaw/dist/runtime-entry-D6tt8oem.js:1879:5)

Will see if Claude can draft a fix

real halo
fallen gate
real halo
fallen gate
willow narwhal
somber lake
somber lake
#

both issues and PR closed now, BTW, with explanations pointing to the symptoms and root cause

fallen gate
somber lake
#

Tibo, The Reseter of Quotas, blessed be his name

real halo
#

couldn't get openclaw chat to work as things looked really bad. used my codex on extra high to help put together a detailed issue ticket. it tried with the newer beta 4 too but still no luck. hope this helps for the team to fix it @Peter Steinberger issue ref 75259

happy to help test further if needed

real halo
vague swallow
# willow narwhal Interesting. Thanks for investigating. If you do open a PR, do ping me and I'll...

Claude thinks it founds something:

Root cause: Commit 554b32feea introduced arePluginsGloballyDisabled() early returns at the top of both resolvePluginCapabilityProvider and resolvePluginCapabilityProviders. This fires before checking the active runtime registry or attempting the compat loading path (which used
withBundledPluginEnablementCompat to explicitly re-enable bundled plugins). With plugins.enabled: false in config, listSpeechProviders(cfg) returns [] → no fallbacks → only the configured provider ("mistral") is tried → fails.

The withBundledPluginEnablementCompat function was specifically designed to make bundled TTS providers work even when plugins.enabled: false. Commit 554b32feea broke this.

The fix: move the arePluginsGloballyDisabled guard past the active registry check, and for resolvePluginCapabilityProviders, still return active providers when disabled (skip the compat load instead of returning empty).

PR incoming

rocky ether
#

PR #75208 is ready for review — resolves the P2 provenance blocker on artifact RPCs, adds cursor pagination and a reusable cursor utility. #74926 currently has conflicts. Would appreciate a review from someone not involved in #74926.

vague swallow
wintry flare
willow narwhal
vague swallow
#

I'm not 100% totally sure if it was or wasn't intended that plugins.enabled: false should disable in-box plugins

willow narwhal
#

Gotten Vincent to look into it

languid jasper
#

Howdy all! Reposting my tools by sender PR. This allows you to scope tool access based on sender ID to better support safe multi-user environments (P.S. Just let me know if youre tired of me reposting this. 😂 )

https://github.com/openclaw/openclaw/pull/66933

somber lake
#

quick test: could someone please run openclaw channels logs and see if you're getting a repeated loop of all plugins being constantly reloaded? I'm on commit 4429ee7d2e7f6261bc5af5827e20d9566b2287da "docs(security): clarify disclosure policy" as of Thu Apr 30 13:41:36 2026 -0700.

jolly wolf
somber lake
real halo
jolly wolf
somber lake
#

I'm not seeing the exact same issue as @real halo, but indeed I saw this behavior trying an earlier commit today, I believe this particular issue has already been solved somewhere in the git history

#

I see no repeated pnpm install anymore (I did see that in an earlier commit), now it it really is the main gateway loop reloading the plugins over and over

real halo
#

i'd already rolled back to 4.23, just rolling forward again now to grab logs etc

somber lake
real halo
willow narwhal
real halo
# somber lake I see no repeated pnpm install anymore (I did see that in an earlier commit), no...

I reran on 2026.4.29 and captured openclaw channels logs.

Latest release still goes unhealthy after Telegram starts. It reaches ready, starts Telegram, then emits liveness warnings with event_loop_delay/event_loop_utilization/cpu and gateway/ws timeouts. In this controlled run I did not catch the pnpm child loop, but the gateway process itself stayed hot and climbed from ~82% to ~92% CPU over the watch window.

I added the exact channels logs, process watch, and runtime-root details to #75283.

somber lake
#

Even running a non-existent command like openclaw foo throws the CLI into a busy-loop that does not respond to a SIGINT, only a SIGTERM or SIGKILL can stop it.

real halo
willow narwhal
willow narwhal
sleek holly
fleet echo
somber lake
quiet girder
#

Hey everyone, I have two recent OpenClaw PRs up and would appreciate any review/feedback when maintainers or contributors have time:

Thanks!

unkempt cove
smoky lintel
jaunty sphinx
#

hiii maintainers! couple things:

#74493 ready for review. extends your identity-only auth-epoch pattern (1ff461fe7b/3eb6edc67c, plus chunyue's #71076) to the static-token branch. closes #74312. reporter @aderius LGTM after running the fix on his macOS box for 5h. ~30 LOC + 4 regression tests.

also up if you have cycles:
#75128 — BOOT.md echo through fallback (closes #53732). extends peter's runtime-context-prompt pattern.
#74089 — OpenAI TTS speed directive (issue steipete tagged me on). small ~30 LOC mirroring elevenlabs.

#

btw i opened 2 small PRs to prep OpenClaw for Link agent wallet support (https://link.com/):

#75181 https://github.com/openclaw/openclaw/pull/75181 test-only coverage for Link-shaped Codex bundle + MCP tool naming.

#75230 https://github.com/openclaw/openclaw/pull/75230 payment credential redaction hardening for wallet-style MCP tool payloads.

both are green + mergeable. ClawSweeper cleared security on both, now just need human maintainer review.

next i’m thinking of tackling #64205: surface bundled MCP startup failures to the agent/user. Link uses npx @stripe/link-cli --mcp, so if auth or startup fails, OpenClaw should not silently hide the wallet tools.

plan is to keep it generic, no Stripe/Link-specific core logic. would love maintainer direction on whether required MCP semantics should be in that PR or a follow-up 🦞

jolly wolf
jaunty sphinx
dusty surge
#

Hi friends, could I get a review on these two focused hot-loop fixes?

Feishu doctor repair:
https://github.com/openclaw/openclaw/pull/74397
Issue:
https://github.com/openclaw/openclaw/issues/74237

This addresses stale/corrupt Feishu local state causing gateway hot-loop behavior. The maintainer repair-safety concern has beenaddressed in 4c55f999cb: repair targets are now derived from concrete findings, and healthy Feishu sessions are preserved. Iadded regression coverage for corrupt Feishu JSON plus healthy session preservation. CI is green apart from the OpenGrep PR-difffinding, which appears outside this PR’s touched Feishu files.

Task registry maintenance lookup cache:
https://github.com/openclaw/openclaw/pull/74406
Issue:
https://github.com/openclaw/openclaw/issues/73517

This is intentionally scoped to the repeated runs.sqlite maintenance hot path from the CPU profile: reuse session-store reads and CLI chat-type derivation within one maintenance pass, while keeping the recovery-hook recheck fresh. Greptile rated the approach safe, and ClawSweeper’s latest triage says #74406 is the active narrow implementation candidate for #73517.

much thakns

devout galleon
#

Hi maintainers,

I've created: https://github.com/openclaw/openclaw/pull/75424 : fix(discord): avoid resolving token during action discovery

This fixes Discord installs that use SecretRef-backed bot tokens by making message-action discovery check whether credentials are configured without trying to read the token too early. It also ensures actual outbound Discord replies resolve the scoped token before sending, so both the tool schema and real agent replies work cleanly with SecretRefs.

It restores Discord for secure/containerized setups without weakening token handling: discovery stays secret-safe, runtime sends stay strict, and the fix is covered by regression tests plus a live Discord test.

closes #75324 and I had the same issue myself

edgy plaza
#

FYI team

https://x.com/Voxyz_ai/status/2050115372599136325?s=20

Vox (@Voxyz_ai)

this version isn't working for me right now. symptoms: telegram shows typing, then pauses, then the answer arrives late. reproduces in other entry points too.

it still looks like the queue + tool prep + prompt assembly stage that's stuck. a separate per-turn agent-prep /

X ·
glossy yewBOT
# edgy plaza FYI team https://x.com/Voxyz_ai/status/2050115372599136325?s=20

@Voxyz_ai via Twitter

Vox (@Voxyz_ai)

this version isn't working for me right now. symptoms: telegram shows typing, then pauses, then the answer arrives late. reproduces in other entry points too.
︀︀
︀︀it still looks like the queue + tool prep + prompt assembly stage that's stuck. a separate per-turn agent-prep / main-thread blocking problem remains.
︀︀
︀︀core-plugin-tools, model-resolution, auth, stream-setup are the suspect areas. model itself only runs 6.7s, queue + prep eats 44s.
︀︀
︀︀trace from one message:
︀︀
︀︀→ 08:06:22 message.queued (telegram typing fires immediately)
︀︀→ 08:06:39 session lane starts processing, waited 16.8s
︀︀→ 08:06:59 agent stream-ready, prep 12s (core-plugin-tools 6s + system-prompt 2s + stream-setup 2.3s)
︀︀→ 08:07:06 run_completed, model itself only runs 6.7s
︀︀→ 08:07:11 message.processed, total duration 51s
︀︀
︀︀added docker data to #73428 too. anyone else hitting this?
︀︀…

FxTwitter ·
willow narwhal
devout galleon
lament spire
#

Hey team, I raised the PR for Feishu error
One thing I wanna confirm with the maintainer is CI failing. For now, 5 cases are failed and it seems oriented to main branch. Is anyone available to verify it from the team?

https://github.com/openclaw/openclaw/pull/75461

#

And I tackled one more issue happening on the telegram channel

karmic steepleBOT
#

Removed <@&1458375944111915051> from ai-hpc.

#

Added <@&1458375944111915051> to ai-hpc.

lament spire
devout galleon
vocal flame
lament spire
#

Hey MKDev @vocal flame
How did you manage the changelog confliction?

plush perch
smoky lintel
jolly wolf
oak fiber
#

Hi #clawtributors , a few open PRs ready for review. Some ci fails seems not related to my commit.

QQ Bot
SecretRefs + secret contract for clientSecret: Resolves secret references and aligns QQ bot with the secret contract pattern (tests/docs touched).
https://github.com/openclaw/openclaw/pull/74772

Anthropic Opus 4.7: Omits temperature on requests where the API expects that shape.
https://github.com/openclaw/openclaw/pull/72149
ACP / default model: Ignores ACP-only streamTo and treats the default model as unset in the right cases.
https://github.com/openclaw/openclaw/pull/72101

ripe locust
devout galleon
tulip gulch
#

some PRs ready for review:

devout galleon
devout galleon
#

trying to commit to openclaw is like trying to hit a photon with an arrow from a mile away. waiting to see what the clawsweeper does

dusky blaze
#

Now imagine the skills our maintainers have 😂

devout galleon
#

aaaand i missed. 2 CI failing. that's 50% of the previous 4 though

crisp linden
edgy plaza
#

Hey

fallen gate
edgy plaza
#

anyone wanna talk about dev experience this week on todays weekly claw?
or any week going forward really

Vincent has been soo kind to come share in the past few weeks.

We would be stocked to have more folks come from time to time.

always great to have the super heros of the project, tell us how things are going and where things are going.

wise nexus
#

Hey folks, looking for human review on two small Gateway PRs that have been rebased a few times to keep up with the fast release cadence:

  • #74783 — https://github.com/openclaw/openclaw/pull/74783
    Adds per-client health.connection telemetry (connected, rttMs, lastHeartbeatAt) using WS ping/ pong, without mutating the shared cached health snapshot. ClawSweeper now says:
    needs-human; security cleared; changelog issue fixed.
  • #74799 — https://github.com/openclaw/openclaw/pull/74799
    Adds per-session runtime envelopes for sessions.create / sessions.patch, persisted on session entries and enforced/rechecked before tool execution.
    ClawSweeper now says
    needs-human; security cleared; changelog issue fixed.

Both have been updated after the recent moving-target releases and should be on current main now. Would appreciate Gateway/session/tool-authorization owner review, especially around #74799’s before-tool-call enforcement semantics and #74783’s ping ownership overlap with #56668.

left mango
#

Cursor credits ended. 8 days to go for the billing cycle reset 😭

fallen gate
sleek holly
#

if you have time these sdk additions are overdone
(https://github.com/steipete) #75578 (https://github.com/openclaw/openclaw/pull/75578), #75581 (https://github.com/openclaw/openclaw/pull/75581), #75588 (https://github.com/openclaw/openclaw/pull/75588), #75600 (https://github.com/openclaw/openclaw/pull/75600), #75605 (https://github.com/openclaw/openclaw/pull/75605), #75609 (https://github.com/openclaw/openclaw/pull/75609), #75612 (https://github.com/openclaw/openclaw/pull/75612)

72+ hours of reviews 5.5gpt. these sdk have been rebased/redone a few hundred times 😂 to keep up with main

#

Exhausted 2 $200 codex accounts 😮‍💨 till main stabilized

#

As a different note, for those that use lossless claw, built 2 plugins for codex 1 that injecte your soul file over its junk personality prompt to make codex less soul less and second allows it to access all your claws memories in LCM via same tools, and anything you build in codex your main claw has awareness of via lcm too hit me up if you wanna help test it

pallid summit
dusky blaze
sleek holly
terse solstice
#

i noticed one thing is if you parallel hit openclaw add agent.. you end up in a race problem.., on the configuration i might look at how to deal with that and make a PR maybe a semaphore lock on the openclaw configuration, it could have been patched already i have to check D:

sleek holly
gilded wind
#

Oh nevermind all good theres a + button on the bottom

next gazelle
rustic remnant
#

I was wondering does the pipeline calculate test coverage? I know there is a lot of working going into making tests for all changes, but was wondering what the overall test coverage is?

left mango
smoky lintel
#

Had to rebase again because some changes to the files I touched (surprise surprise lol), but all good still for feat(config): support SecretRef for phone numbers in channel configs
https://github.com/openclaw/openclaw/pull/73822 5/5 greptile

surreal thicket
#

hu guys, does anyone know where to find the debug log files locally if i cant access tui/discord?

fathom rampart
willow narwhal
next gazelle
nova panther
#

Hi, maintainers.
Please review this Simple PR.
https://github.com/openclaw/openclaw/pull/72306
I opened this pr a week ago, but still haven’t gotten any msg yet.
This PR makes session_status correctly use the current session for sparse channel-plugin requesters. If a model override is saved there, it now creates a real valid session entry instead of saving an empty one

somber lake
somber lake
sleek holly
#

I was literally about to turn back on.

plush perch
slow inlet
#

Hey all — I've got three related PRs that are all green (or waiting on CI after today's rebases). They address a set of real UX problems around Claude CLI reasoning in Telegram and Feishu — happy to explain any of them in more detail.

The problem: When you're using Claude CLI reasoning mode, the reasoning stream runs silently with no feedback in the chat channel (Telegram/Feishu). You can't tell if it's still thinking, it can overflow the 4096-char message limit mid-stream and crash the preview, and the per-token rate-limit throttler wasn't being shared correctly across concurrent operations.

The three PRs:

  1. #71817 — fix(telegram,feishu): enable Claude CLI reasoning via reasoningDefault config — the core fix so reasoningDefault: "stream" actually works in Telegram and Feishu.
    https://github.com/openclaw/openclaw/pull/71817
  2. #74508 — fix(telegram): share per-token API throttler; handle reasoning overflow; QQBot SSRF hardening — stops the stream from crashing on long reasoning output, fixes throttler sharing, and tightens the QQBot SSRF guard.
    https://github.com/openclaw/openclaw/pull/74508
  3. #75587 — feat(telegram): add reasoningStreamSink for external reasoning stream routing — new opt-in feature to forward the live reasoning stream to an HTTPS endpoint so you can render it externally while the answer is still streaming. Depends on #71817.
    https://github.com/openclaw/openclaw/pull/75587

All three have needs-human verdicts from ClawSweeper (no open findings). Would really appreciate a look — thanks!

brisk ruin
wintry flare
fervent panther
#

Hi, there. I opened a PR and all CI passed.
https://github.com/openclaw/openclaw/pull/73755

Quick PR for #57241 — adds an opt-in gateway.tailscale.preserveFunnel flag so a mode="serve"` restart no longer wipes externally-configured Tailscale Funnel routes. Thanks.

wise nexus
#

I'm apparently chasing my tail right now trying to rebase with the amount of commits making it to main

wise nexus
#

Could someone take a look at these two PRs?

#74799 - Add per-session runtime envelopes
https://github.com/openclaw/openclaw/pull/74799

This one is rebased onto current main and green again.

#74783 - Add gateway health connection telemetry
https://github.com/openclaw/openclaw/pull/74783

This one is also ready for review from our side. GitHub still reports it mergeable with green checks, though it may need a refresh against latest main depending on what maintainers prefer.

left mango
slow inlet
jolly wolf
#

@thick osprey will rebase it

wise nexus
#

good to know, I can quit burning time trying to keep it up to date with main and shift focus to investigating other issues

versed crane
fallen gate
surreal thicket
surreal thicket
#

@jolly wolf Models/OpenAI Codex: restore openai-codex/gpt-5.4-mini for ChatGPT/Codex OAuth PI runs after live OAuth proof, and align the manifest, forward-compat metadata, docs, and regression tests so stale cron and heartbeat configs resolve again. Fixes #74451. Thanks @0xCyda, @hclsys, and @Marvae.

#74451

fallen gate
surreal thicket
#

sorry i just read how to get clawtributor tag aha

#

it said ping someone online and give PR

fallen gate
surreal thicket
#

ahhh duh

fallen gate
#

and send link from the PR merged

civic sedge
fallen gate
surreal thicket
fallen gate
devout galleon
#

stolen valor!!! lol

surreal thicket
#

im a noob bro

#

@0xCyda: The linked regression #74451 was reported by @0xCyda, and the current changelog also credits @0xCyda for the earlier openai-codex/gpt-5.4-mini suppression behavior in #73242. (role: regression reporter and prior context source; confidence: low; commits: bf5541b4bf3a; files: CHANGELOG.md, docs/providers/openai.md, extensions/openai/openclaw.plugin.json)

fallen gate
surreal thicket
fallen gate
final ocean
#

fyi

shy rain
#

Oops, apparently I'm Britney Spears now

#

@final ocean -- a huge decrease in lag with these 4 combined. They work on my machine 😉 Hope they don't break anything else.

final ocean
#

two known issues:

  • Discord or whatsapp missing from package for some people when upgrading - Known fix: openclaw plugins and install discord or run the force install command.
  • Session RPC session list is high, causing delays in some rare cases, fix inbound - not sure on wider impact
#

feel free to dm me, you have my permission. will be quicker

shy rain
#

DMD... repeated here for the record...

  1. https://github.com/openclaw/openclaw/pull/76400 — Skip parsing multi-MB transcript lines that block the event loop for 13-16s during chat.history
    and session list calls.
  2. https://github.com/openclaw/openclaw/pull/76402 — Skip transcript usage fallback, model inference, cost recomputation, and plugin projection in
    bulk sessions.list rows — row construction drops from 82s to 6s.
  3. https://github.com/openclaw/openclaw/pull/76404 — Cache sessions.list responses for 15s with in-flight coalescing, invalidated on any session
    mutation.
  4. https://github.com/openclaw/openclaw/pull/76406 — Read models.json directly instead of regenerating the full provider registry on every Control UI
    list call — catalog load drops from 4.6s to 8ms.
wise nexus
#

Quick review ask for https://github.com/openclaw/openclaw/pull/76407

This closes https://github.com/openclaw/openclaw/issues/75380 and is an operational safety/security fix, not a feature request. We found diagnostic JSONL logs like cache-trace.jsonl can grow unbounded; in local use since March, one trace reached 46 GB and contributed to system pressure/restart instability.

The PR adds bounded rotation/default caps for cache trace and provider payload JSONL logs, with config/env wiring, docs, tests, and ClawSweeper’s requested archive-count hardening. ClawSweeper now says the remaining blocker is maintainer review/mergeability, not another code change.

Related issue context: #41676, #74801, #73655, #57031.

cobalt canyon
#

Hello! Would a maintainer be willing to take a look at #47635 (https://github.com/openclaw/openclaw/pull/47635) whenever they get a chance? It fixes #44820 (https://github.com/openclaw/openclaw/issues/44820) (session-archive disk bloat — users reporting 80MB+ of dead .deleted./.reset./orphaned .tmp/excess .bak.* files that never get cleaned up because reactive cleanup only runs in enforce mode).

The PR adds a proactive sweep at gateway startup and on an hourly timer, covering both default and configured session.store roots. CI is green, regression tests included, no conflicts. Thanks!

#

Not sure if that's the right way to get attention for the PR, but would appreciate a review- thanks!!

void bramble
shy rain
#

https://github.com/openclaw/openclaw/pull/76514

Fix Discord status reactions (thinking/tool/done emojis) not firing in guild channels when statusReactions.enabled: true.

Fixes a regression -- 5.2 added the queued 👀 but left the state machine gated on !sourceRepliesAreToolOnly, which is always true for guild channels.

Give back my emoji reaccs!! Krill needs those too.

devout galleon
#

Hi. As requested by Vincent today in general, tagging @final ocean for this (I will not make a habit of it)

I opened https://github.com/openclaw/openclaw/pull/76536. The Tl;dr is that a change in 5.2 (commit 8283c5d6cc) altered plugin loading behavior

Problem: after v2026.5.2, enabled external capability providers declared only through manifest contracts (for example contracts.speechProviders) can fail with no provider registered unless they are also startup-loaded.

Why it matters: docs describe manifest ownership/contract fallback as preserving correctness; missing startup activation should cost performance, not make an installed provider unusable.

What changed: preserve the v2026.5.2 fast path that reuses an already-loaded runtime registry, but fall back to the scoped manifest-derived runtime load when that registry is missing the provider.

thanks

final ocean
oak fiber
#

Hi #clawtributors , a few open PRs ready for review. Some ci fails seems not related to my commit.

QQ Bot
SecretRefs + secret contract for clientSecret: Resolves secret references and aligns QQ bot with the secret contract pattern (tests/docs touched).
https://github.com/openclaw/openclaw/pull/74772

Anthropic Opus 4.7: Omits temperature on requests where the API expects that shape.
https://github.com/openclaw/openclaw/pull/72149
ACP / default model: Ignores ACP-only streamTo and treats the default model as unset in the right cases.
https://github.com/openclaw/openclaw/pull/72101

devout badger
# devout badger All clawsweeper remarks fixed, greptile 5/5 all CI passes again. It is ready for...

All clawsweeper recommendations before merge are implemented, greptile still 5/5 and all CI passes. If a maintainer could take a look what is still needed before merge it would be greatly appreciated. https://github.com/openclaw/openclaw/pull/72115

Summary
The PR hardens Skill Workshop workspace-skill writes with realpath containment, write-boundary revalidation, skills prompt-budget checks, SDK exports, docs, tests, and related CI/proxy/plugin-surface stabilization.

Reproducibility: yes. source-level. Current main's Skill Workshop write path is visibly lexical/direct-write only, while PR head and tests exercise the new containment, stale-write, quarantine, and prompt-budget paths.

Next step before merge
No repair lane is needed because there is no discrete automation-fixable blocker remaining; this should proceed through normal maintainer review and merge gates.

Security
Cleared: Cleared: the diff touches security-sensitive write/proxy/plugin-loading paths, but the latest head hardens those paths and exact-head security checks are green.

slow inlet
#

no rush but what's the usual eta on PR human review or does it really vary?

shy rain
#

Fix usage.cost / sessions.usage hanging the gateway

  • Replaces on-request JSONL transcript scans with a durable per-agent aggregate cache and a single lock-guarded detached worker.
  • Fixes a performance regression introduced in 4.21 when tiered pricing forced full cost recomputation on every transcript line at scan

https://github.com/openclaw/openclaw/pull/76650

Another fix to recently introduced performance degradation here.
Won't someone think of the poor claws running on a ZX-81!

devout galleon
wise nexus
#

Quick update/review ask for https://github.com/openclaw/openclaw/pull/74783

ClawSweeper moved it to needs-human after the latest push. It now reuses the authenticated WebSocket ping owner from merged #76111 instead of adding a second maintenance-loop pinger, while preserving the health.connection telemetry.

There are 2 red checks right now, but one is just the aggregate gate:

  • Real failure: checks-node-agentic-control-plane-runtime
  • Aggregate failure: checks-node-core

The real failure is in src/gateway/server.reload.test.ts around a cron stop() expectation. I reran the exact gateway-server test locally and the full gateway-server suite locally, and both passed, so this looks like a CI flake unrelated to the health ping changes.

I do not have repo admin rights to rerun failed CI. Could someone rerun the failed jobs, and if they pass, take a review pass?

unique rain
#

Hey, found a bug in the Control UI — when you click a skill to see its details, the dialog just dies. Console throws HTMLDialogElement.showModal: Dialog element is not connected.

Looks like the modal's trying to open before it's actually attached to the DOM. I've raised an issue with the details + a fix: https://github.com/openclaw/openclaw/issues/76695

I'm not confident enough in my js skills to confirm that this is the best way of fixing this.

dim hare
terse solstice
tulip gulch
sleek holly
versed crane
jolly wolf
shy rain
#

Guys. My PR 76404 was closed and superseded by the existing 62164.
It fixes a repeated sessions calculation which is causing massive slowdowns. The other performance fixes are in 5.3 beta2 but not this one, so people are still complaining about speed which is hugely improved by this fix.

Can someone look at 62164 urgently? Or should I resubmit 76404 as an urgent mini-fix as it can be QCd much quicker?

edit: linkylinks
https://github.com/openclaw/openclaw/pull/76404 -- my fix, closed (superseded by 62164)
https://github.com/openclaw/openclaw/pull/62164 -- existing broader scope fix -- languishing "open" for a while.

stable pewter
#

openclaw update --channel beta

untold pollen
#

The correctness fix around config.patch makes sense to me, but the cache diff is fairly large

shy rain
#

It's most apparent on mature systems with lots of session files, multi-agent, and older hardware. @shell dawn posted his experience in #general , lemme see if my claude still has the timings...

shell dawn
#

im on the npm train right now so id prefer to update that way but can iterate if necessary

#

i see beta.3 just got posted, soon as my slow prod environment finishes writing his report i'll update

#

i have 15 normal agents, though with my recent development directions only about 4 or 5 get used regularly. but ive got a subagent builder group thats between 3 and 8 depending on need

#

and a few different agents will use them on projects

#

so ive got a fair number of sessions

shy rain
shell dawn
#

already updated lol

#

a few of my agents have been keeping track of timings so i can probably get the necessary data

shy rain
shy rain
shell dawn
fallen gate
#

Howdy hay, received a user complaint about agent steering not working. There was also some confusion around the multiple documents and ways of steering that were confusing to them. /steer [message] and /queue steer as well as the config requirement for a certain path as well. Created a PR to make steer as a default without a command needed during an agent run and fall backs on queueing the message. I feel this is a better UX/DX having it defaulted and not opt in.

https://github.com/openclaw/openclaw/pull/77023

GitHub
feat: steer mid-turn prompts by default by fuller-stack-dev · Pull...

Summary

Make mid-turn user prompts steer the active agent run by default before falling back to queue handling.
Remove the previous steering-specific /queue modes and config surface so /queue now ...

shy rain
fallen gate
#

and nice to see my two lovely favourites in here ❤️

shy rain
#

/queue insert was supposed to do this, right? never worked for me.

fallen gate
#

but I think just making it the default behaviour without needing a command is the way to go TBH

shy rain
fallen gate
#

less things for the user to think about, it just works kinda behaviour

shell dawn
#

yeah that one