$ the-wire ยท showcase
Authenticated adapter ingress, release hardening across OpenClaw
By RepoJournal ยท Filed ยท About OpenClaw
12 people shipped this
Vincent Koc
@vincentkoc
3 cited
Peter Steinberger
@steipete-oai
3 cited
steipete
@steipete
2 cited
harjothkhara
@harjothkhara
1 cited
lzyyzznl
@lzyyzznl
1 cited
goutamadwant
@goutamadwant
1 cited
ly-wang19
@ly-wang19
1 cited
Joรฃo Henrique de Almeida Carreiro
@Jhacarreiro
1 cited
anagnorisis2peripeteia
@anagnorisis2peripeteia
1 cited
Yuval Dinodia
@yetval
1 cited
Edward Abrams
@zeroaltitude
brokemac79
@brokemac79
Crabbox shipped an authenticated reverse proxy for loopback services and ClawSweeper cut 0.3.0, while OpenClaw fixed a desktop quota pill regression and a 700ms debounce that was hiding Discord tool emojis.
Crabbox added `crabbox adapter ingress`, a provider-neutral authenticated reverse proxy for loopback HTTP services, supporting streaming HTTP, authenticated WebSocket upgrades, route denials, loopback-only health checks, and sanitized public-origin forwarding. The boundary is hardened against assertion spoofing, TRACE reflection, non-canonical paths, recursive listeners, SSRF, and unsafe private files, and one unreachable network-login wrapper was removed. A new docs guide explains the full runtime adapter stack: `adapter serve`, `adapter ingress`, and `adapter connect`, covering trust boundaries, secret separation, and failure signals. [1] [2] [3]
ClawSweeper shipped 0.3.0 with typed, durable, proposal-only root-cause cluster assessments, a fail-closed `CLAWSWEEPER_CODEX_LOGIN_METHOD=chatgpt` override, and repair-only PR intake. Windows Codex spawn failures for local review runs are fixed, and transport-exhausted re-reviews now run one bounded lower-reasoning-effort fallback that preserves disclosure and confidence limits. [4] [5] [6] [7]
OpenClaw restored the provider usage/quota pill in the desktop chat composer, which had disappeared after 2026.6.6 when composer refactors moved controls into `renderChatControls`; only one orphaned caller remained, so the pill rendered nowhere on desktop. A Discord fix applies intermediate tool status emojis (๐ ๏ธ, ๐, ๐) immediately instead of sharing a 700ms debounced schedule with `setThinking()`, so rapid reasoning callbacks no longer overwrite them with ๐ง . The Skills page gained an agent selector for multi-agent workspace skills, and `openclaw cron edit` now supports clearing delivery routing fields via explicit null to the gateway RPC. [8] [9] [10] [11]
Supply-chain hardening landed across Crabbox and Clownfish. Crabbox pinned every GitHub Actions dependency to immutable commits behind release tags, with structural YAML enforcement; action versions and behavior are unchanged. Clownfish made three breaking fixes to security context routing: ignore separately routed security refs, allow closed security context in reviews, and keep non-security fix lanes moving. [12] [13] [14] [15]
Action items
- โ Review Clownfish security routing changes before deploying, as they break prior behavior openclaw/clownfish [immediate]
- โ Update to ClawSweeper 0.3.0 to get repair-only PR intake and Windows Codex fixes openclaw/clawsweeper [plan]
- โ Mirror Crabbox's pinned GitHub Actions commits in your own workflows openclaw/crabbox [plan]
References
- [1] feat: add authenticated adapter ingress โ openclaw/crabbox
- [2] feat: add authenticated adapter ingress (#398) โ openclaw/crabbox
- [3] docs: explain the runtime adapter stack โ openclaw/crabbox
- [4] ClawSweeper 0.3.0 โ openclaw/clawsweeper
- [5] Add repair-only PR intake (#290) โ openclaw/clawsweeper
- [6] fix: resolve Windows Codex spawn failures for local review runs (#250) โ openclaw/clawsweeper
- [7] fix: recover transport-exhausted re-reviews (#283) โ openclaw/clawsweeper
- [8] fix(ui): restore provider usage pill in desktop chat composer [AI] โ openclaw/openclaw
- [9] fix(discord): apply tool status emojis immediately to avoid override by thinking reactions โ openclaw/openclaw
- [10] fix(ui): add agent selector to skills page โ openclaw/openclaw
- [11] fix(cron): clear delivery routing fields from cron edit โ openclaw/openclaw
- [12] ci: pin GitHub Actions to immutable commits โ openclaw/crabbox
- [13] fix: ignore separately routed security refs โ openclaw/clownfish
- [14] fix: allow closed security context in reviews โ openclaw/clownfish
- [15] fix: keep non-security fix lanes moving โ openclaw/clownfish
