RepoJournal
OpenClaw @openclaw
56 wires and counting

$ follow OpenClaw

Keep up with OpenClaw in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-06-18
stories 105
GitHub RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

OpenClaw prunes stale agent APIs, Clownfish tightens security review routing

By RepoJournal · Filed · About OpenClaw

Vincent Koc openclaw-docs-sync[bot]
2 people shipped this
Vincent Koc @vincentkoc 12 cited openclaw-docs-sync[bot] @openclaw-docs-sync[bot]

OpenClaw dropped five stale agent APIs while Clownfish hardened its security review pipeline against false positives and Clownfish docs replaced a vulnerable parser.

OpenClaw removed a set of stale agent-facing APIs in one cleanup pass, deleting the live model switch API [1], exec helpers [2], the subagent depth policy [3], the ACP error alias [4], and runner aliases [5]. Anything still calling these names after the next upgrade will break, so check agent integrations against current docs.

Clownfish review and routing logic changed in three places that affect how security findings are handled. Security guard check names are now ignored [6], false security routing is rejected [7], and negated security item evidence is ignored [8]. The earlier behavior could route or report on signals that masqueraded as security evidence; these commits stop that, so review output should more accurately reflect real risks.

Docs took a security fix by removing the vulnerable parser [9][10]. The PR replaces gray-matter with yaml 2.9.0 for frontmatter parsing, removing js-yaml 3.x from the dependency graph, and refreshes the Mermaid DOMPurify lockfile entry to 3.4.10. It resolves open Dependabot alerts for js-yaml and dompurify, so update docs dependencies before the next deploy if you vendor them.

Elsewhere, Clownfish preserved executed apply actions so a later post-flight idempotency replay cannot overwrite an earlier executed closure in run summaries [11], and the executor captures a `check:changed` baseline before Codex edits to keep unchanged diagnostics from blocking repair [12].

Action items

References

  1. [1] refactor(agents): remove stale live model switch api ↗ openclaw/openclaw
  2. [2] refactor(agents): remove stale exec helpers ↗ openclaw/openclaw
  3. [3] refactor(agents): remove stale subagent depth policy ↗ openclaw/openclaw
  4. [4] refactor(agents): remove stale acp error alias ↗ openclaw/openclaw
  5. [5] refactor(agents): remove stale runner aliases ↗ openclaw/openclaw
  6. [6] fix(review): ignore security guard check names (#97) ↗ openclaw/clownfish
  7. [7] fix: reject false security routing (#86) ↗ openclaw/clownfish
  8. [8] fix(review): ignore negated security item evidence (#91) ↗ openclaw/clownfish
  9. [9] fix(security): replace vulnerable docs parser (#53) ↗ openclaw/docs
  10. [10] fix(security): remove vulnerable docs parser ↗ openclaw/docs
  11. [11] fix(results): preserve executed apply actions ↗ openclaw/clownfish
  12. [12] fix(executor): preserve unchanged changed-gate diagnostics ↗ openclaw/clownfish
Topics: AI Agents AI / ML Full archive →

Quick answers

What shipped in OpenClaw on June 18, 2026?
OpenClaw dropped five stale agent APIs while Clownfish hardened its security review pipeline against false positives and Clownfish docs replaced a vulnerable parser. In total, 75 commits and 30 pull requests landed.
Who contributed to OpenClaw on June 18, 2026?
2 developers shipped this update, including Vincent Koc and openclaw-docs-sync[bot].
What were the notable OpenClaw updates?
refactor(agents): remove stale live model switch api, refactor(agents): remove stale exec helpers, and refactor(agents): remove stale subagent depth policy.
♥

$ log @openclaw --recent

Gesture update rollback guard fixed; Slack slackens redundant work 150 shipped Exec workdir checks fail early, Telegram reply loops capped 62 shipped HTTP agent traffic now emits model.usage diagnostics, auth failures surface in channels 55 shipped Heartbeat hook now fires on harness prompts 70 shipped

$ log --all # elsewhere on the wire

Meta React Native adds Stable API guards to renderer attributed string FastAPI & Pydantic Pydantic fixes Mypy plugin crash, tightens datetime constraints

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.