RepoJournal
OpenClaw @openclaw
55 wires and counting

$ follow OpenClaw

Keep up with OpenClaw in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-06-20
stories 58
GitHub RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

Crabbox revokes Code viewer sessions on logout, adds Scaleway SSH leases

By RepoJournal · Filed · About OpenClaw

Vincent Koc openclaw-docs-sync[bot] steipete TurboTheTurtle coygeek
5 people shipped this
Vincent Koc @vincentkoc 5 cited openclaw-docs-sync[bot] @openclaw-docs-sync[bot] 5 cited steipete @steipete 3 cited TurboTheTurtle @TurboTheTurtle 1 cited coygeek @coygeek

Crabbox now revokes Code viewer sessions server-side on GitHub portal logout and adds a direct Scaleway SSH-lease provider, with Cloudflare Access key fetches bounded behind admin auth.

Crabbox closes a session-leak hole: Code viewer tickets and sessions are now bound to the authenticated GitHub portal session, and logout triggers bounded server-side revocation that rejects stale viewer cookies, pending bootstraps, and remint attempts. Active and hibernated Code viewer WebSockets close atomically, the Code agent is notified, and post-logout frame forwarding is blocked. Every newly issued GitHub user token gets a distinct session identity while existing tokens remain accepted. This change fails closed through the ticket validation path [1].

Crabbox adds a direct Scaleway SSH-lease provider built on the official SDK, implementing acquire, resolve, touch, release, cleanup, doctor, claim recovery, per-lease IAM SSH keys, ownership tags, and all-pages inventory. It propagates command contexts into every SDK request, redacts both environment and SDK-profile credentials from validation errors, and preserves ambiguous-create access while reconciling proven key-only rollback claims [2]. Separately, Cloudflare Access JWT verification is deferred until a valid Crabbox admin/shared bearer token is presented, with JWK sets cached per normalized team domain under bounded TTL/LRU storage, single-flight loads, and short failure throttling. One bounded refresh on cached key misses keeps signing-key rotation transparent, and pre-auth, unknown-key, concurrency, rotation, and oversized-input cases are covered [3].

For local benchmarking, Crabbox now offers an opt-in timing ledger around existing TimingReport payloads. New `run --timing-record` plus `bench run`, `bench record`, and evidence-aware `bench report --json` keep observations local, report successful sample and failure counts, and mark insufficient evidence instead of ranking providers globally, while preserving delegated providers' complete timing metadata [4]. In openclaw/openclaw, housekeeping removed two stale shims: the dead qwen model shim [5] and the copied copilot token shim [6]. QA fixes strip control-ui API key params [7] and preserve adjacent control-ui redaction [8], and the SDK now types agent mutation RPC params [9]. The docs repo mirrored five upstream doc states [10][11][12][13][14].

Action items

References

  1. [1] fix: revoke Code viewer sessions on logout ↗ openclaw/crabbox
  2. [2] feat(scaleway): add direct SSH lease provider ↗ openclaw/crabbox
  3. [3] fix: bound Cloudflare Access key fetches ↗ openclaw/crabbox
  4. [4] feat: add local benchmark timing ledger ↗ openclaw/crabbox
  5. [5] chore(deadcode): remove stale qwen model shim ↗ openclaw/openclaw
  6. [6] chore(deadcode): remove copied copilot token shim ↗ openclaw/openclaw
  7. [7] fix(qa): strip control ui api key params ↗ openclaw/openclaw
  8. [8] fix(qa): preserve adjacent control ui redaction ↗ openclaw/openclaw
  9. [9] fix(sdk): type agent mutation RPC params ↗ openclaw/openclaw
  10. [10] chore(sync): mirror docs from openclaw/openclaw@4a0f497f167fe547c961e1014cafa1ba5768ccac ↗ openclaw/docs
  11. [11] chore(sync): mirror docs from openclaw/openclaw@e35e5f123ddae0fbcef1d578ada7c06b1647017b ↗ openclaw/docs
  12. [12] chore(sync): mirror docs from openclaw/openclaw@3fa4fdaec1249752a93d19ddf0fc4f9967b36d82 ↗ openclaw/docs
  13. [13] chore(sync): mirror docs from openclaw/openclaw@8aa58c5fb0b4c85722a05d4bcf0984808f230d32 ↗ openclaw/docs
  14. [14] chore(sync): mirror docs from openclaw/openclaw@b677ea6726d7db93cae201fc288ca96f124a1f84 ↗ openclaw/docs
Topics: AI Agents AI / ML Full archive →

Quick answers

What shipped in OpenClaw on June 20, 2026?
Crabbox now revokes Code viewer sessions server-side on GitHub portal logout and adds a direct Scaleway SSH-lease provider, with Cloudflare Access key fetches bounded behind admin auth. In total, 46 commits and 12 pull requests landed.
Who contributed to OpenClaw on June 20, 2026?
5 developers shipped this update, including Vincent Koc, steipete, TurboTheTurtle, coygeek, and openclaw-docs-sync[bot].
What were the notable OpenClaw updates?
fix: revoke Code viewer sessions on logout, feat(scaleway): add direct SSH lease provider, and fix: bound Cloudflare Access key fetches.
♥

$ log @openclaw --recent

Gesture update rollback guard fixed; Slack slackens redundant work 150 shipped HTTP agent traffic now emits model.usage diagnostics, auth failures surface in channels 55 shipped Heartbeat hook now fires on harness prompts 70 shipped Gateway install warns on wrapper overwrite, status hints for missing-secret diagnostics 73 shipped

$ log --all # elsewhere on the wire

Meta React Native adds Stable API guards to renderer attributed string FastAPI & Pydantic Pydantic fixes Mypy plugin crash, tightens datetime constraints

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.