- Create analyze.py (profile, describe, groupby, pivot, filter)
- Create excel.py (read, write, list-sheets, merge/VLOOKUP)
- Create visualize.py (bar, line, scatter, heatmap, histogram, pie, box)
- Update SKILL.md with venv instructions
- Mark openclaw#14 Blogwatcher RESOLVED (installed)
- Mark openclaw#15 Data Analytics RESOLVED
- Mark openclaw#17 Calendar CANCELLED (using GOG)
- Mark openclaw#18 Edison PAUSED
- Mark openclaw#23 Network Fallback PAUSED

UI orbital revamp

…w-unconfigured flag (use env vars)

Tasks completed: 2/2
- Port PR/issue guides + Install sharpening (commits #15, #17, #23)
- Port PR sign-off + guide revisions + markdownlint fixes (commits #24, #26, #35)

SUMMARY: .planning/phases/17-docs/17-03-SUMMARY.md

Fixes XSS and HTTP proxy bypass vulnerabilities (Dependabot openclaw#17, openclaw#18)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Fixes XSS and HTTP proxy bypass vulnerabilities (Dependabot openclaw#17, openclaw#18)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Fixes XSS and HTTP proxy bypass vulnerabilities (Dependabot openclaw#17, openclaw#18)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…penclaw#17)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…penclaw#17)

Co-authored-by: Cursor <cursoragent@cursor.com>

HEARTBEAT.md is a workspace file that can be written by any tool, hook,
or external content landing in the workspace. Before this change, its
content was injected directly into the cron agent prompt without any
security scanning.

This change wires detectSuspiciousPatterns() into the heartbeat preflight
check (runHeartbeatPreflight) so that suspicious content is logged at
warn level before the heartbeat proceeds. The scan runs after the file is
read but before isHeartbeatContentEffectivelyEmpty() — meaning it fires
even when the file would otherwise be skipped, giving early visibility.

Fixes improvement item openclaw#17 from openclaw-improvement-ideas.md.

CRITICAL fixes:
- openclaw#1-2: HITL race conditions — _inFlight lock on Telegram + Dashboard API (409 Conflict)
- openclaw#3: Storage JSON.parse crash protection — backup corrupt files + reset to defaults
- openclaw#4: Lead Enrich waterfall — Apollo fallback when FullEnrich fails + email validation
- openclaw#5: Meeting Scheduler — remove hardcoded fallback, require CALCOM_USERNAME env
- openclaw#6: Self-Improve — clamp scoring weights 0-2.0
- openclaw#7: IMAP connection leak — destroy client on connect timeout

HIGH fixes:
- openclaw#8: Resend retry jitter — prevent thundering herd
- openclaw#9: Gmail SMTP circuit breaker per mailbox — 3 errors → 5min cooldown
- openclaw#10: Honeypot list reduced — keep real system addresses only
- openclaw#11: CRM pipeline cache TTL 30min
- openclaw#12: CRM contact dedup — check HubSpot before createContact
- openclaw#13: HubSpot 429 rate limit handling
- openclaw#14: Inbox UID marked AFTER classification (prevent data loss)
- openclaw#15: FlowFast leads cap 5000 with auto-purge
- openclaw#16: Brain action lock — _actionsInFlight Set
- openclaw#17: Self-Improve p-value threshold raised to 20 minimum samples
- openclaw#18: System Advisor disk parsing — numeric GB values
- openclaw#19: Invoice EUR format — fr-FR locale (12,50 €)
- openclaw#20: Draft quality gate — spam words, link check, min length

17 files changed, +248/-38 lines

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- workspace.ts: call scanSource() on SKILL.md content during loadSkillEntries,
  warn on critical findings (dangerous-exec, dynamic-code-execution, etc.)
- heartbeat-runner.ts: call detectSuspiciousPatterns() on HEARTBEAT.md content
  before injecting into agent prompt, warn on suspicious patterns

Both checks are warn-only (non-blocking), purely additive.

Fixes openclaw#21 (detectSkillPatterns wired into load flow)
Fixes openclaw#17 (HEARTBEAT.md injection scan)

Add the following audit findings:
- gateway.token_no_expiry (T-PERSIST-004)
- fs.config.inside_git_repo (T-ACCESS-003)
- env.dangerous_vars_set (T-DISC-004)
- tools.web_fetch.no_url_allowlist (T-EXFIL-001)
- gateway.no_message_rate_limit (T-IMPACT-002)

17 new tests, 91 existing tests pass (0 regressions).

Fixes openclaw#16, openclaw#17, openclaw#18, openclaw#19, openclaw#20

…law#17)

Webchat text streaming was chunky — 150ms between delta broadcasts
made text appear to 'jump' in blocks. Reduced to 50ms for smoother
character-level streaming. Only affects WS broadcast frequency,
not model inference speed.

MOYENS (16):
- openclaw#1 generateReactiveFollowUp maxLength string vs number — aligne sur string
- openclaw#2 Multi-threading mort — filtre sur mappedLeads (avec score) au lieu de result.leads
- openclaw#3 _checkEmailSpecificity null safety — (prospectIntel || '').match()
- openclaw#4 totalContacts pre-dedup — utilise addedCount
- openclaw#5 Bounces tous hard_bounce — distinction soft/hard, soft = retry pas blacklist
- openclaw#8 _isSystemEmail includes() trop large — exact match + prefix patterns
- openclaw#10 sendBatch bypass warmup — recordSend dans domain-manager apres chaque envoi
- openclaw#11 Domain manager parsing ':' dans password — split limite a 4 segments
- openclaw#12 prospectDomains jamais nettoye — cleanup LRU max 2000 entries
- openclaw#13 trackNicheEvent('clicked') ignore — ajout compteur clicked
- openclaw#14 apStorage.getLeads() inexistant — utilise automailer storage.getEmails()
- openclaw#25 Interval HITL drafts jamais cleared — clearInterval dans gracefulShutdown

FAIBLES (9):
- openclaw#17 Retry skip prompt 25-35 mots → aligne sur 50-65 mots 4-blocs
- openclaw#18 _scoreAndFilter gate 60 mots → 80 mots (coherent avec prompts)
- openclaw#19 "curieux d'avoir ton retour" autorise dans follow-ups → remplace
- openclaw#20 seniorities priorite inversee → brain > config
- openclaw#21 data.growth jamais active → detecte via employee count + multi-country
- openclaw#23 Fallback plan non-pondere → utilise icp-loader.getNicheForCycle()
- campaign-engine: double updateEmailStatus pour opened → supprime appel redondant

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…rror

Fix build crash when RESEND_API_KEY is missing