RepoJournal
OpenClaw @openclaw
43 wires and counting

$ follow OpenClaw

Keep up with OpenClaw in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-05-21
stories 70
GitHub RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

Doctor warns on plaintext secrets, remote TUI startup skips plugin load

By RepoJournal · Filed · About OpenClaw

Dallin Romney Peter Steinberger openclaw-docs-sync[bot] lukaIvanic clawsweeper[bot] zozo123 clawsweeper
7 people shipped this
Dallin Romney @RomneyDa 2 cited Peter Steinberger @steipete 2 cited openclaw-docs-sync[bot] @openclaw-docs-sync[bot] 2 cited lukaIvanic @lukaIvanic 1 cited clawsweeper[bot] @clawsweeper[bot] 1 cited zozo123 @zozo123 1 cited clawsweeper @clawsweeper

openclaw's doctor now flags plaintext secrets in config and the remote TUI skips plugin-heavy startup work, trimming cold start.

openclaw doctor gained a security warning for plaintext secret-bearing fields in openclaw.json, reusing the secrets target registry and shared model-provider header sensitivity policy. Run doctor before shipping configs that embed credentials: plaintext secrets now surface in audit output instead of passing silently [1].

Two TUI startup performance changes cut cold openclaw tui work against a remote gateway. The startup path no longer synchronously pulls the full plugin metadata snapshot (200k+ file reads) when running in remote mode, since the TUI never consumes plugin metadata there and instead queries the gateway [2]. A follow-up defers the EmbeddedTuiBackend import and drops dead warmup helpers, with the PR showing a visible load-time before/after improvement [3].

First-class RunPod support lands in crabbox: a new runpod SSH-lease provider deploys a CPU pod via the GraphQL deployCpuPod call, polls pod runtime ports for the public TCP mapping to port 22, and returns a normal SSH lease so sync, run, ssh, status, and stop reuse existing transports [4]. "Adds provider: runpod as an SSH-lease provider." A follow-up fix switches the provider to the REST public SSH endpoint, and GCP direct lease expiry is now enforced [5][6].

Elsewhere, minimax capabilities no longer advertise music duration control: the feature is removed from provider capabilities and docs, and duration hints are no longer prompt-injected [7]. Docs received routine mirror syncs from openclaw/openclaw [8][9].

Action items

References

  1. [1] Warn on plaintext secret config in doctor (#84718) ↗ openclaw/openclaw
  2. [2] perf(tui): skip plugin metadata + provider catalog on remote TUI startup (#84686) ↗ openclaw/openclaw
  3. [3] perf(tui): defer EmbeddedTuiBackend import, drop dead warmup helpers ↗ openclaw/openclaw
  4. [4] feat: add runpod provider ↗ openclaw/crabbox
  5. [5] fix: make runpod provider use REST public SSH ↗ openclaw/crabbox
  6. [6] fix: enforce GCP direct lease expiry ↗ openclaw/crabbox
  7. [7] fix(minimax): stop advertising music duration control (#84765) ↗ openclaw/openclaw
  8. [8] chore(sync): mirror docs from openclaw/openclaw@c0312748c4f75047d3cf11a997b4d365f5d2c0d0 ↗ openclaw/docs
  9. [9] chore(sync): mirror docs from openclaw/openclaw@86ebceeb2e2e78dd644d768324e1e6968729e9ee ↗ openclaw/docs
Topics: AI Agents AI / ML Full archive →

Quick answers

What shipped in OpenClaw on May 21, 2026?
openclaw's doctor now flags plaintext secrets in config and the remote TUI skips plugin-heavy startup work, trimming cold start. In total, 44 commits and 26 pull requests landed.
Who contributed to OpenClaw on May 21, 2026?
7 developers shipped this update, including lukaIvanic, Dallin Romney, clawsweeper, clawsweeper[bot], zozo123, Peter Steinberger, and openclaw-docs-sync[bot].
What were the notable OpenClaw updates?
Warn on plaintext secret config in doctor (#84718), perf(tui): skip plugin metadata + provider catalog on remote TUI startup (#84686), and perf(tui): defer EmbeddedTuiBackend import, drop dead warmup helpers.
♥

$ log @openclaw --recent

Gesture update rollback guard fixed; Slack slackens redundant work 150 shipped Gateway mirrors commentary events, docs builder reusable for ClawHub 88 shipped Crabbox gains Hyper-V and OpenComputer providers, Islo adds Tailscale egress 87 shipped ClickClack explicit enable, durable auto-reply summaries 174 shipped

$ log --all # elsewhere on the wire

Meta React Native adds Stable API guards to renderer attributed string FastAPI & Pydantic Pydantic fixes Mypy plugin crash, tightens datetime constraints

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.