RepoJournal
OpenClaw @openclaw
44 wires and counting

$ follow OpenClaw

Keep up with OpenClaw in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-05-17
stories 163
GitHub RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

Harden skill transfers and sanitize Codex payloads

By RepoJournal · Filed · About OpenClaw

steipete giodl73-repo Vyctor H. Brzezowski Vincent Koc zozo123
5 people shipped this
steipete @steipete 4 cited giodl73-repo @giodl73-repo 3 cited Vyctor H. Brzezowski @vyctorbrzezowski 2 cited Vincent Koc @vincentkoc 2 cited zozo123 @zozo123 1 cited

OpenClaw hardens skill transfer acceptance against banned requesters and sanitizes Codex image payloads against replay attacks.

OpenClaw's ClawHub hardened skill transfer acceptance [1][2]: the acceptTransferInternal mutation now validates the requester before accepting, closing a race condition where a pending transfer could be accepted after the requester was banned, letting the skill escape the ban batch. Also, pending transfers are cancelled before returning a rejection so the cancellation commits instead of being rolled back. This is a breaking change for any code that relied on accepting transfers from banned or inactive users.

OpenClaw also sanitized inline image data URLs before Codex app-server replay [3], replacing invalid inline images with text placeholders to prevent malformed base64 from being resent as Responses image_url content. Additionally, thread bindings are cleared only for invalid or malformed image payloads, while healthy bindings are preserved for transient or unsupported-image failures.

OpenClaw fixed MCP tool schemas by inlining local $ref references during tool-parameter normalization [4], preventing bundled tools like Notion API-post-page from exposing local $ref parameters that could fail before reaching the server. Gateway protocol mismatch diagnostics were improved with richer logs and doctor commands [5]. Claude CLI sessions that fail with AbortError or non-session_expired FailoverError are now cleared to avoid resuming poisoned sessions [6]. Windows node installs opt into a hidden launcher to avoid persistent command windows [7].

Crabbox expanded its run capabilities with profile presets and proof artifacts [8], preflight checks for raw JS command runtimes [9], and a new capsule command group for capturing GitHub Actions failures [10]. macOS images can now run end-to-end on EC2 Mac [11], though this is tagged as breaking. The docs site merged updates to the shell, code blocks, and mobile navigation [12].

Action items

References

  1. [1] fix: harden skill transfer acceptance (#2276) ↗ openclaw/clawhub
  2. [2] fix: harden skill transfer acceptance ↗ openclaw/clawhub
  3. [3] fix: sanitize Codex image payload replay ↗ openclaw/openclaw
  4. [4] fix(mcp): inline local refs in bundled tool schemas ↗ openclaw/openclaw
  5. [5] fix: improve gateway protocol mismatch diagnostics ↗ openclaw/openclaw
  6. [6] fix(agents): clear poisoned claude cli sessions ↗ openclaw/openclaw
  7. [7] fix(node): hide Windows node task launcher ↗ openclaw/openclaw
  8. [8] feat: add profile presets and proof artifacts ↗ openclaw/crabbox
  9. [9] fix: preflight raw JS command runtimes ↗ openclaw/crabbox
  10. [10] Add Actions-first failure capsules ↗ openclaw/crabbox
  11. [11] feat(aws): run macOS images on EC2 Mac ↗ openclaw/crabbox
  12. [12] Merge docs elements lab ↗ openclaw/docs
Topics: AI Agents AI / ML Full archive →

Quick answers

What shipped in OpenClaw on May 17, 2026?
OpenClaw hardens skill transfer acceptance against banned requesters and sanitizes Codex image payloads against replay attacks. In total, 147 commits and 16 pull requests landed.
Who contributed to OpenClaw on May 17, 2026?
5 developers shipped this update, including Vyctor H. Brzezowski, steipete, giodl73-repo, Vincent Koc, and zozo123.
What were the notable OpenClaw updates?
fix: harden skill transfer acceptance (#2276), fix: harden skill transfer acceptance, and fix: sanitize Codex image payload replay.
♥

$ log @openclaw --recent

Gesture update rollback guard fixed; Slack slackens redundant work 150 shipped Copilot replay thinking blocks stripped, WhatsApp login persistence fixed 160 shipped Gateway mirrors commentary events, docs builder reusable for ClawHub 88 shipped Crabbox gains Hyper-V and OpenComputer providers, Islo adds Tailscale egress 87 shipped

$ log --all # elsewhere on the wire

Meta React Native adds Stable API guards to renderer attributed string FastAPI & Pydantic Pydantic fixes Mypy plugin crash, tightens datetime constraints

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.