$ the-wire · showcase
ClawScan security classification now flows through Codex
By RepoJournal · Filed · About OpenClaw
ClawScan security classification now routes through a queued Codex worker that overrides VirusTotal decisions, making telemetry-only and trusting verified @openclaw/* packages by default.
ClawScan security classification now routes through a queued GitHub Actions Codex worker [1]. VirusTotal becomes telemetry-only, so it no longer hides or blocks downloads, and waits are capped at 10 minutes. Verified `@openclaw/*` plugin packages are trusted by default, and the UI/API/download status align with Codex, static, and manual decisions. Two follow-up fixes landed to authenticate the Codex security worker in CI and make it executable in Actions [2] [3].
OpenClaw traces now attribute ACPX startup probe cost to ACPX-owned subspans during gateway restarts [4]. Scoped `startupTrace` is threaded into plugin service context, with restart resource-count metrics and instrumentation for ACPX config, filesystem, and runtime creation. Meanwhile, Telegram verbose raw-update logs no longer write private payload values [5]; the new formatter redacts sensitive fields while preserving update shape, and bounds strings and arrays.
Two supporting fixes: OpenClaw `sessions_spawn` remains searchable in Codex dynamic tool payloads, with docs routing Codex subagents to `spawn_agent` [6], and a new E2E regression test covers gateway exec approval runtime flow [7]. On crabbox, AWS macOS image runs are now supported with provider-neutral admin commands and guarded quota remediation helpers [8]; the supporting PR merge also landed [9].
Action items
- → Review ClawScan Codex worker and VirusTotal telemetry behavior before next upload pipeline run openclaw/clawhub [immediate]
- → Update any Telegram verbose log parsing that depended on raw ctx.update serialization to use the new redacted format openclaw/openclaw [plan]
- → Assess ACPX restart trace attributions after the new instrumentation to plan performance work openclaw/openclaw [plan]
References
- [1] Run ClawScan security classification through Codex ↗ openclaw/clawhub
- [2] fix: authenticate Codex security worker in CI ↗ openclaw/clawhub
- [3] fix: make Codex security worker executable in Actions ↗ openclaw/clawhub
- [4] [Feat] Attribute ACPX startup probe cost in restart traces ↗ openclaw/openclaw
- [5] fix(telegram): redact raw update logs ↗ openclaw/openclaw
- [6] fix(codex): keep OpenClaw session spawn searchable ↗ openclaw/openclaw
- [7] test: cover gateway exec approval runtime flow ↗ openclaw/openclaw
- [8] feat(macos): support AWS macOS image runs ↗ openclaw/crabbox
- [9] Merge pull request #114 from openclaw/ops/macos-quota-remediation ↗ openclaw/crabbox
