RepoJournal
OpenClaw @openclaw
77 wires and counting

$ follow OpenClaw

Keep up with OpenClaw in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-07-09
stories 49
GitHub RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

Surrogate-safe truncation lands across OpenClaw security paths

By RepoJournal · Filed · About OpenClaw

zw-xysk xingzhou steipete xydt-tanshanshan fengjikui
5 people shipped this
zw-xysk @zw-xysk 1 cited xingzhou @zhangguiping-xydt 1 cited steipete @steipete 1 cited xydt-tanshanshan @xydt-tanshanshan 1 cited fengjikui @fengjikui 1 cited

A security fix keeps channel metadata and install policy truncation from splitting surrogate pairs, preventing prompt corruption in LLM contexts.

OpenClaw shipped a security fix [1] replacing unsafe String.prototype.slice(0, N) truncation in channel-metadata.ts and install-policy.ts with surrogate-safe logic. channel-metadata is explicitly user-controlled untrusted content injected into LLM prompt context, so a dangling surrogate could corrupt the prompt. A similar fix [3] applies truncateUtf16Safe() at 5 call sites in memory dreaming snippet truncation to keep complex emoji and surrogate pairs intact.

Discord gateway error listeners no longer go stale after a restart [2]; the fix removes the gateway error listener on dispose while preserving late error guards and diagnostics. Meanwhile, model tools spawn_task and dismiss_task were added to the coding tool group [4], letting models propose follow-up work that operators approve before a fresh, isolated managed-worktree session starts.

On macOS, OpenClaw.app now skips unresolved dashboard auth templates [5], recognizing the same env SecretRef shorthand as core config so the LaunchAgent token fallback works instead of producing a URL with an encoded placeholder.

Action items

References

  1. [1] fix(security): keep channel-metadata and install-policy truncation surrogate-safe (#102266) ↗ openclaw/openclaw
  2. [2] fix(discord): prevent stale gateway error listeners after restart (#101617) ↗ openclaw/openclaw
  3. [3] [AI] fix(memory): use truncateUtf16Safe for dreaming snippet truncation (#101946) ↗ openclaw/openclaw
  4. [4] feat: add follow-up task suggestions ↗ openclaw/openclaw
  5. [5] fix(macos): skip unresolved dashboard auth templates ↗ openclaw/openclaw
Topics: AI Agents AI / ML Full archive →

Quick answers

What shipped in OpenClaw on July 9, 2026?
A security fix keeps channel metadata and install policy truncation from splitting surrogate pairs, preventing prompt corruption in LLM contexts. In total, 25 commits and 24 pull requests landed.
Who contributed to OpenClaw on July 9, 2026?
5 developers shipped this update, including zw-xysk, xingzhou, steipete, xydt-tanshanshan, and fengjikui.
What were the notable OpenClaw updates?
fix(security): keep channel-metadata and install-policy truncation surrogate-safe (#102266), fix(discord): prevent stale gateway error listeners after restart (#101617), and [AI] fix(memory): use truncateUtf16Safe for dreaming snippet truncation (#101946).
♥

$ log @openclaw --recent

Gesture update rollback guard fixed; Slack slackens redundant work 150 shipped Fixes for stale DashScope downloads and Telegram forward origins 117 shipped Plugin approvals now push to iOS devices; uploads and checks stop hanging 116 shipped Smarter CI reuse, tighter Copilot OAuth checks 210 shipped

$ log --all # elsewhere on the wire

Meta React Native adds Stable API guards to renderer attributed string FastAPI & Pydantic Pydantic fixes Mypy plugin crash, tightens datetime constraints

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.