$ cat openclaw/week/2026-09-14.log
the week in review · Sep 14 – Sep 20, 2026
fs-safe 0.14.0 sets new guest listing rules
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
The period's security work ran alongside startup-cost and session-write performance fixes across openclaw and clowfish.
fs-safe 0.14.0 openclaw/fs-safe
Descriptor-relative listings now report regular files alongside directories without following symlinks, so consumers can pick files without reopening path-type checks. The scanner keeps its existing metering on every logical boundary.
fix(security): use effective POSIX identity (#369) openclaw/fs-safe
Identity checks now run against effective POSIX credentials, with temp access verified under those same effective credentials. This is the security change that anchors the rest of the fs-safe work this period.
improve: reduce package metadata startup cost openclaw/openclaw
An isolated Node/tsx settings helper was loading the full runtime configuration when it only needed package metadata: importing FileSettingsStorage took 3.146 seconds before its first write in the matched measurement. The helper's startup path now skips that load.
fix(memory): read the searched workspace for explicit agents (#147072) openclaw/openclaw
When an explicitly owned multi-agent roster inherits workspace paths, memory_get could return a different file than memory_search for the same query. The read now resolves against the searched workspace; expect behavior changes if you depend on the old path resolution.
fix(openai): withdraw unsupported subscription onboarding openclaw/clawrouter
The bundled OpenAI provider offered Connect with provider using a fixed Codex OAuth client and the deployment's own callback URI, which sent custom-domain operators into invalid_authorize_request. That browser onboarding is gone; wire up your own verified client and redirect contract instead.
fix(fusion): finalize discarded adviser responses openclaw/clawrouter
Adviser responses that arrived after the deadline, or that came back as HTTP errors, were left out of proxy accounting, so audit events stayed pending and failed-adviser reservations stayed charged until lease expiry. Finalizing those discarded responses closes the leak.
fix(matrix): recover encryption in previously joined rooms openclaw/openclaw
Replies failed in previously joined encrypted rooms when a resumed sync had no local encryption state. Affected rooms now recover encrypted sending during startup; unknown or failed encryption stays opt-in as before.
fix(doctor): defer missing-plugin migrations with a warning instead of blocking openclaw/openclaw
Doctor could hit a configured plugin's migrations before its package was available and block the whole update plus Gateway startup. Missing plugins now produce an actionable warning while the update and available services proceed.
$ ls openclaw/week/ # the briefings behind this review
Keep up with OpenClaw in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.