Who contributed to OpenClaw on August 26, 2026?

3 developers shipped this update, including Peter Steinberger, xialonglee, and openclaw-docs-sync[bot].

What were the notable OpenClaw updates?

fix(xcp-ng): fence VM lifecycle with exact pool claims, fix(providers): fence Sprites and Tenki lifecycle claims, and fix(namespace): require exact claims for provider lifecycle.

Aug 26, 2026

$ the-wire · showcase

Crabbox provider lifecycle now requires exact ownership claims

By RepoJournal · Filed 20:14 UTC on September 7, 2026 · About OpenClaw · Composed from the cited sources · methodology

3 people shipped this

Peter Steinberger @steipete 8 cited

xialonglee @xialonglee 1 cited

openclaw-docs-sync[bot] @openclaw-docs-sync[bot]

Crabbox hardened XCP-ng, Sprites, Tenki, and Namespace lifecycle operations against cross-account and cross-region VM deletion.

Crabbox lifecycle operations across XCP-ng, Sprites, Tenki, and Namespace now require exact, provider-scoped ownership claims before deletion or shutdown. XCP-ng release and cleanup revalidates the live VM UUID, lease, slug, and canonical ownership labels under the shared claim lock, and rolls back newly created VMs when claims cannot be persisted [1]. Sprites deletion and Tenki sandbox termination bind claims to the canonical endpoint and immutable provider identity, preserving failed-cleanup claims [2]. Namespace Devbox shutdown and Compute Instance release enforce an explicitly empty provider scope to prevent cross-region or cross-endpoint claim reuse [3].

Two security fixes in Crabbox redact sensitive data: coordinator run diagnostics are redacted before coordinator attachment [4], and credentials are stripped from browser portal links [5].

The OpenClaw CLI now rejects Infinity, -Infinity, and NaN in `config set`, `--batch-*`, and `config patch` inputs. Those values used to be accepted and later written as null, silently corrupting the config; they are now rejected up front [6]. The cloud worker profile editor no longer assumes every provider is Crabbox, which previously let edits corrupt other providers' configuration and stale Crabbox forms persist after a provider change [7]. Operator diagnostics were repaired across automation stream failures, Tailscale status, migration warnings, node-location accuracy validation, and case-sensitive model aliases [8], and Codex protocol JSON was regenerated without changing parsed schemas [9].

Action items

→ Upgrade Crabbox to include the redaction and lifecycle fencing fixes before exposing portals or running cross-account cleanup openclaw/crabbox [immediate]
→ Audit cloud worker profile editing and Config CLI usage for earlier silent corruption from Infinity/NaN writes openclaw/openclaw [plan]

References

[1] fix(xcp-ng): fence VM lifecycle with exact pool claims ↗ openclaw/crabbox
[2] fix(providers): fence Sprites and Tenki lifecycle claims ↗ openclaw/crabbox
[3] fix(namespace): require exact claims for provider lifecycle ↗ openclaw/crabbox
[4] fix(security): redact coordinator run diagnostics ↗ openclaw/crabbox
[5] fix(security): strip credentials from browser portal links ↗ openclaw/crabbox
[6] fix(cli): reject Infinity/NaN in config set/batch/patch values ↗ openclaw/openclaw
[7] fix(ui): cloud worker profile edits corrupt other providers ↗ openclaw/openclaw
[8] fix(cli): restore accurate operator diagnostics and safe input handling ↗ openclaw/openclaw
[9] refactor(codex): compact generated protocol JSON ↗ openclaw/openclaw