RepoJournal
OpenClaw @openclaw
106 wires and counting

$ follow OpenClaw

Keep up with OpenClaw in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-08-07
stories 79
GitHub RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

Clawsweeper shields against forged reviews, process crash fix

By RepoJournal · Filed · About OpenClaw

steipete openclaw-docs-sync[bot] YangManBOBO jjjhenriksen giodl73-repo dwin-gharibi metaforismo
9 people shipped this
steipete @steipete 3 cited openclaw-docs-sync[bot] @openclaw-docs-sync[bot] 3 cited YangManBOBO @YangManBOBO 1 cited jjjhenriksen @jjjhenriksen 1 cited giodl73-repo @giodl73-repo 1 cited dwin-gharibi @dwin-gharibi 1 cited metaforismo @metaforismo vincentkoc @vincentkoc vyctorbrzezowski @vyctorbrzezowski

Critical fixes prevent process crashes on stream errors and stop forged proof headings from corrupting PR verdicts.

OpenClaw patched a process crash when a raw stream write fails: the try/catch wrapper around `void appendRegularFile()` could not catch async rejections because `void` evaluates the Promise to undefined synchronously, so a disk-full or permission-denied rejection escalated to the unhandled rejection handler, classified as FATAL, and exited the process with code 1. [1] Additionally, a one-shot `openclaw message send` could race the running Gateway's delivery recovery over shared SQLite state, potentially losing queue entries or, under unlucky timing, duplicating the outbound message; concurrent recovery now prevents duplicate outbound delivery. [2]

Clawsweeper closed a review security hole: forged proof headings in model-authored prose (echoed from attacker-controlled PR bodies) could flip a PR's proof verdict from blocked to sufficient, routing unproven external PRs into the automated repair lane. The fix covers all four report shapes, bare, fenced, details, and HTML comment, and is verified against shipped `dist/` entry points. [3] Related work also addresses the same attack surface, using a fail-closed reader-side detector without any module to the report format, requiring no bulk invalidation. [4] The repair router now retries throttled public OpenClaw read-only requests with the target GitHub App token, while preserving explicit credential, mutation, and request-body boundaries; it keeps fail-closed `GitHubRateLimitError` behavior when both credentials are throttled. [5]

Clawsweeper also fixed the scheduler stranding duplicate candidates: sweeps could review fewer items than capacity allowed when the same item appeared twice in the due list, a normal GitHub pagination artifact from `GET /issues` sorting by `updated`. The fix ensures capacity is fully used, so sweeps no longer silently under-review. [6]

OpenClaw's ClickClack adapter now publishes best-effort `agent.progress` events when an account enables `nativeProgress: true`, so users see agent progress during replies instead of an idle interface; durable activity remains opt-in. [7] Docs mirrored three upstream commits into the docs site. [8][9][10]

Action items

References

  1. [1] fix: unhandled rejection crashes process when raw stream write fails (#119400) ↗ openclaw/openclaw
  2. [2] fix: prevent duplicate outbound delivery during concurrent recovery ↗ openclaw/openclaw
  3. [3] fix(review): stop forged proof headings in model prose from flipping PR verdicts (#1048) ↗ openclaw/clawsweeper
  4. [4] fix(review): fail closed on out-of-block report metadata (no format migration) ↗ openclaw/clawsweeper
  5. [5] fix(router): fall back when public reads are throttled ↗ openclaw/clawsweeper
  6. [6] Fix/scheduler duplicate candidate stranding ↗ openclaw/clawsweeper
  7. [7] fix(clickclack): show native agent progress while replying ↗ openclaw/openclaw
  8. [8] chore(sync): mirror docs from openclaw/openclaw@1f10ef8050a95aa98a19ec49bd5c9d81aea46ed6 ↗ openclaw/docs
  9. [9] chore(sync): mirror docs from openclaw/openclaw@e4968af845ec0a6041c98925c6a142dcf4b01ad1 ↗ openclaw/docs
  10. [10] chore(sync): mirror docs from openclaw/openclaw@ed40d0599b31c88eb20e0aacf7f005355355f022 ↗ openclaw/docs
Topics: AI Agents AI / ML Full archive →

Quick answers

What shipped in OpenClaw on August 7, 2026?
Critical fixes prevent process crashes on stream errors and stop forged proof headings from corrupting PR verdicts. In total, 51 commits and 28 pull requests landed.
Who contributed to OpenClaw on August 7, 2026?
9 developers shipped this update, including YangManBOBO, metaforismo, vincentkoc, steipete, jjjhenriksen, giodl73-repo, dwin-gharibi, and vyctorbrzezowski, and 1 more.
What were the notable OpenClaw updates?
fix: unhandled rejection crashes process when raw stream write fails (#119400), fix: prevent duplicate outbound delivery during concurrent recovery, and fix(review): stop forged proof headings in model prose from flipping PR verdicts (#1048).
♥

$ log @openclaw --recent

Gesture update rollback guard fixed; Slack slackens redundant work 150 shipped Security audit fixes align with runtime semantics 78 shipped OpenClaw 2026.8.1-beta.2 tightens secret egress and model runtime switching 128 shipped Fix explicit-agent fleets, remove payload timing race 114 shipped

$ log --all # elsewhere on the wire

Meta React Native adds Stable API guards to renderer attributed string FastAPI & Pydantic Pydantic fixes Mypy plugin crash, tightens datetime constraints

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.