$ the-wire · showcase
OpenClaw ships crabbox v0.44.0, fixes UI credential leak
By RepoJournal · Filed · About OpenClaw
OpenClaw's gateway now loads workspace icons without sharing secrets, while crabbox v0.44.0 adds credential-free provider discovery and a Telegram Desktop recorder.
crabbox v0.44.0 adds credential-free `crabbox providers describe` discovery for canonical provider-scoped run flags and compiled defaults, versioned `go install` as a CLI-only installation channel, and an opt-in Linux/WSL2 `raw_socket` preflight probe [1]. The `--class` standard, fast, large, and beast intent labels now resolve to concrete instance types in `crabbox providers --json`, reporting primary instance type, nominal vCPU, and RAM per provider [2].
OpenClaw changes how the dashboard authenticates device credentials. Paired Control UI device credentials now share the canonical same-origin read authorizer, while session-derived routes retain read+owner policy. Fresh dashboard handoffs and reloads can therefore render workspace, channel, and plugin icons without exposing or persisting the shared Gateway secret, which the release notes call "Remove the old shared-secret-first UI workaround" [3].
Gateway performance work removes repeated logging and delivery scans: exact session-delivery retries no longer scan the full queue, and uninterested projections are skipped during logging and diagnostics. Outbound WebSocket summaries are built only after recipient admission [4]. A standalone Telegram Desktop recorder now starts from a digest-pinned prebaked image, providing a ready desktop in about 12 seconds with no per-lease apt installs, and removing dpkg-lock failures; it is not yet invoked by anything in the repository [5].
Action items
- → Upgrade crabbox to v0.44.0 for credential-free provider discovery and versioned go install openclaw/crabbox [plan]
- → Review dashboard icon loading changes for security implications; deploy OpenClaw commit 49231ff openclaw/openclaw [immediate]
- → Monitor gateway logging performance; no action needed now openclaw/openclaw [monitor]
References
- [1] v0.44.0 ↗ openclaw/crabbox
- [2] feat(providers): report machine class shapes in the provider matrix ↗ openclaw/crabbox
- [3] fix(ui): load workspace icons after dashboard bootstrap (#126200) ↗ openclaw/openclaw
- [4] improve(gateway): avoid repeated logging and delivery scans (#126147) ↗ openclaw/openclaw
- [5] feat(qa): add a standalone Telegram Desktop recorder with a prebaked desktop image (#125186) ↗ openclaw/openclaw