Skip to content

fix(agents): separate heartbeat runtime template#85416

Merged
clawsweeper[bot] merged 4 commits into
mainfrom
fix/heartbeat-template-doc-separation
May 27, 2026
Merged

fix(agents): separate heartbeat runtime template#85416
clawsweeper[bot] merged 4 commits into
mainfrom
fix/heartbeat-template-doc-separation

Conversation

@hxy91819

@hxy91819 hxy91819 commented May 22, 2026

Copy link
Copy Markdown
Member

Summary

  • Move the runtime HEARTBEAT.md bootstrap template to src/agents/templates/ so docs edits no longer change heartbeat behavior.
  • Keep non-heartbeat workspace templates loading from docs templates, and update package/release guards so the new runtime template is shipped.
  • Add doctor repair for legacy fenced/Related heartbeat templates while preserving user-authored content.

Verification

  • pnpm docs:list
  • node scripts/run-vitest.mjs src/agents/workspace-templates.test.ts src/commands/doctor-heartbeat-template-repair.test.ts src/flows/doctor-health-contributions.test.ts src/auto-reply/heartbeat.test.ts
  • node scripts/run-vitest.mjs test/openclaw-npm-release-check.test.ts
  • node scripts/run-vitest.mjs src/commands/doctor-heartbeat-template-repair.test.ts
  • node scripts/run-vitest.mjs src/flows/doctor-health-conversion-plan.test.ts
  • pnpm exec node scripts/test-projects.mjs test/vitest/vitest.unit-src.config.ts test/vitest/vitest.unit-security.config.ts
  • npm pack --dry-run --json --ignore-scripts confirmed src/agents/templates/HEARTBEAT.md is included
  • git diff --check

Real behavior proof

Behavior addressed: Default heartbeat workspaces no longer receive docs-only HEARTBEAT.md content that makes an otherwise empty heartbeat file trigger model calls.
Real environment tested: Local Linux worktree with Node 22.21.1 using repo test wrappers.
Exact steps or command run after this patch: Ran the verification commands listed above, including targeted runtime-template, doctor-repair, heartbeat empty-content, release pack guard, and npm dry-run package inclusion checks.
Evidence after fix: Runtime template tests assert src/agents/templates/HEARTBEAT.md has no frontmatter and is effectively empty; doctor repair tests cover legacy fenced/Related templates and user-authored fenced content; npm dry-run includes the runtime heartbeat template path.
Observed result after fix: Targeted Vitest checks passed, the core src/security shard passed after adding the doctor conversion-plan entry, the npm dry-run pack list included src/agents/templates/HEARTBEAT.md, and git diff --check passed.
What was not tested: Full pnpm check/full suite and installed package smoke were not run locally.


Package/doctor black-box verification (v2 — updated)

  • Provider: docker via Crabbox
  • CrabBox run ID: cbx_6dadb5d505eb
  • PR head SHA: 6e9d23e
  • Tarball filename: openclaw-2026.5.25.tgz

Commands run

Clone at SHA 6e9d23eef3b047f3a50f396e1cf7f4c2f0c2be56pnpm install --frozen-lockfilepnpm packnpm install -g <tarball>openclaw doctor --fix (8 workspace variants) → openclaw doctor (diagnostic mode)

Evidence

  • Tarball includes package/src/agents/templates/HEARTBEAT.md
  • Installed package bootstrap creates clean HEARTBEAT.md
  • Bootstrap does not emit "Missing workspace template"
  • Doctor repairs fenced+Related legacy heartbeat template (VAL-VRFY-004)
  • Doctor repairs plain fenced legacy heartbeat template (VAL-VRFY-008)
  • Doctor repairs heading+fenced docs boilerplate heartbeat template (VAL-VRFY-009)
  • Doctor preserves user-authored heartbeat content (fenced + - Check email) (VAL-VRFY-005)
  • Doctor preserves user-authored heartbeat content (prose + - Run daily check) (VAL-VRFY-010)
  • Doctor no-op on clean template (VAL-VRFY-006)
  • Doctor diagnostic mode detects legacy template without modifying it (VAL-VRFY-007)

Result: PASS

Gaps/blockers

None

@github-actions github-actions Bot added the dependencies-changed PR changes dependency-related files label May 22, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Dependency Changes Detected

This PR changes dependency-related files. Maintainers should confirm these changes are intentional.

Changed files:

  • package.json

Maintainer follow-up:

  • Review whether the dependency changes are intentional.
  • Inspect resolved package deltas when lockfile, shrinkwrap, or workspace dependency policy changes are present.
  • Treat package-lock.json and npm-shrinkwrap.json diffs as security-review surfaces.
  • Run pnpm deps:changes:report -- --base-ref origin/main --markdown /tmp/dependency-changes.md --json /tmp/dependency-changes.json locally for detailed release-style evidence.

@openclaw-barnacle openclaw-barnacle Bot added docs Improvements or additions to documentation cli CLI command changes scripts Repository scripts commands Command implementations agents Agent runtime and tooling size: M maintainer Maintainer-authored PR labels May 22, 2026
@socket-security

socket-security Bot commented May 22, 2026

Copy link
Copy Markdown

No dependency changes detected. Learn more about Socket for GitHub.

👍 No dependency changes detected in pull request

@clawsweeper

clawsweeper Bot commented May 22, 2026

Copy link
Copy Markdown
Contributor

Codex review: passed. Reviewed May 27, 2026, 8:29 AM ET / 12:29 UTC.

Summary
The PR moves the runtime HEARTBEAT.md bootstrap template into src/agents/templates, keeps docs templates as secondary roots for other workspace files, adds a legacy heartbeat-template doctor repair, and updates package guards/tests.

PR surface: Source +281, Tests +283, Docs +11, Config +1, Other 0. Total +576 across 15 files.

Reproducibility: yes. from source inspection: current main loads HEARTBEAT.md from the docs template, and that template includes docs-only lines that make an otherwise empty heartbeat file non-empty to the runtime. I did not run a live heartbeat repro in this read-only review.

Review metrics: 1 noteworthy metric.

  • Compatibility Surfaces: 1 default workspace template split, 1 doctor repair added, 1 package files allowlist changed. These surfaces affect fresh installs, packaged runtime bootstrap, and upgrade repair behavior, so they need maintainer-visible compatibility review before merge.

Merge readiness
Overall: 🦞 diamond lobster
Proof: 🦞 diamond lobster
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Risk before merge

  • Compatibility remains the main merge risk: openclaw doctor --fix may rewrite existing default-agent HEARTBEAT.md files that exactly match known legacy docs templates, so maintainers should intentionally accept that upgrade behavior and keep exact-head package/doctor checks green.

Maintainer options:

  1. Accept With Exact-Head Gates (recommended)
    Merge after required CI confirms the current head, accepting the tested doctor repair for pure legacy heartbeat templates.
  2. Refresh Package/Doctor Proof
    If maintainers want stricter upgrade evidence, rerun the package install plus openclaw doctor --fix matrix on the current head before merge.
  3. Pause If Rewrite Policy Is Unwanted
    Pause or close this branch if maintainers do not want doctor to rewrite legacy heartbeat files automatically, even for exact template matches.

Next step before merge
No ClawSweeper repair is indicated; keep merge gated on exact-head CI/automerge and maintainer acceptance of the compatibility-sensitive doctor repair.

Security
Cleared: No concrete security or supply-chain regression found; the package.json change only expands the npm files allowlist for a runtime template and no lockfile, dependency, script, permission, or download path is changed.

Review details

Best possible solution:

Land the template split with the narrow doctor repair if maintainers accept the compatibility behavior; otherwise keep the runtime/docs separation and revise the repair policy before merge.

Do we have a high-confidence way to reproduce the issue?

Yes from source inspection: current main loads HEARTBEAT.md from the docs template, and that template includes docs-only lines that make an otherwise empty heartbeat file non-empty to the runtime. I did not run a live heartbeat repro in this read-only review.

Is this the best way to solve the issue?

Yes. Separating the runtime template from the docs page and adding a narrow doctor repair is the maintainable fix; the compatibility-sensitive part is the exact policy for rewriting legacy user files.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 3e351b718e28.

Label changes

Label justifications:

  • P2: This is a normal-priority runtime/doctor bug fix with limited blast radius but real upgrade behavior.
  • merge-risk: 🚨 compatibility: Merging changes the shipped heartbeat template source and adds a doctor repair that can rewrite existing legacy workspace files.
  • rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
  • status: 🚀 automerge armed: This PR is in ClawSweeper's automerge lane. Sufficient (terminal): The PR body includes targeted local verification plus a Crabbox docker package/doctor black-box run showing package inclusion, clean bootstrap, legacy repair, diagnostic detection, and user-authored content preservation.
  • proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes targeted local verification plus a Crabbox docker package/doctor black-box run showing package inclusion, clean bootstrap, legacy repair, diagnostic detection, and user-authored content preservation.
Evidence reviewed

PR surface:

Source +281, Tests +283, Docs +11, Config +1, Other 0. Total +576 across 15 files.

View PR surface stats
Area Files Added Removed Net
Source 6 306 25 +281
Tests 5 289 6 +283
Docs 2 11 0 +11
Config 1 1 0 +1
Generated 0 0 0 0
Other 1 1 1 0
Total 15 608 32 +576

What I checked:

  • Current-main behavior still uses docs template source: On current main, workspace bootstrap template loading still resolves a single docs template directory and docs/reference/templates/HEARTBEAT.md includes fenced docs content plus a Related link, matching the reported coupling between docs edits and runtime heartbeat content. (src/agents/workspace.ts:111, 3e351b718e28)
  • PR separates heartbeat runtime loading from docs fallback: The proposed loader uses the runtime template directory for HEARTBEAT.md while searching runtime plus docs directories for non-heartbeat workspace templates. (src/agents/workspace.ts:113, e34e85864c57)
  • PR adds bounded doctor repair: The new repair recognizes known legacy docs-wrapped heartbeat templates, leaves custom/unrecognized content unchanged, and only writes the clean runtime template for pure legacy wrappers. (src/commands/doctor-heartbeat-template-repair.ts:98, e34e85864c57)
  • Regression tests cover repair and preservation cases: The added tests cover legacy prose, fenced docs templates, current docs-page boilerplate, user-authored fenced content, custom tasks, unrecognized dirty shapes, and pure-template rewrite behavior. (src/commands/doctor-heartbeat-template-repair.test.ts:44, e34e85864c57)
  • Package guard includes the new runtime template: The PR allowlists src/agents/templates/ in package.json and updates the npm release check to require src/agents/templates/HEARTBEAT.md rather than the docs heartbeat page. (package.json:118, e34e85864c57)
  • Whitespace check passed for the proposed diff: git diff --check produced no output for the PR diff against its recorded base. (e34e85864c57)

Likely related people:

  • Peter Steinberger: History shows Peter introduced the docs-backed workspace-template loader and later moved doctor orchestration into flow contributions, both central to this PR's surface. (role: introduced adjacent behavior; confidence: high; commits: 319b4d02a0ab, 7d6d642cb825; files: src/agents/workspace.ts, src/flows/doctor-health-contributions.ts)
  • JustYannicc: The effectively-empty heartbeat behavior that makes docs boilerplate matter traces to the heartbeat skip feature commit. (role: introduced heartbeat skip behavior; confidence: medium; commits: dd060288273d; files: src/auto-reply/heartbeat.ts, docs/reference/templates/HEARTBEAT.md)
  • Vincent Koc: Current main blame and history show recent broad maintenance on the workspace-template, heartbeat, and doctor-flow files, plus packaged-template release checks. (role: recent area contributor; confidence: medium; commits: 4dfc2cf14a3f, e3c58e04c9; files: src/agents/workspace.ts, src/agents/workspace-templates.ts, src/flows/doctor-health-contributions.ts)
  • hxy91819: The PR author also appears in prior merged history as Mason Huang on command/test/dependency surfaces, so they are relevant beyond merely opening this PR. (role: recent contributor on adjacent command/test surfaces; confidence: medium; commits: fbccc18e74, edfa074e0f, d2edb559b9; files: src/commands, test/openclaw-npm-release-check.test.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. P2 Normal backlog priority with limited blast radius. labels May 22, 2026
@clawsweeper

clawsweeper Bot commented May 22, 2026

Copy link
Copy Markdown
Contributor

ClawSweeper PR egg

✨ Hatched: ✨ glimmer Cosmic Proofling

Hatch command

Comment @clawsweeper hatch when this PR is hatchable.

Hatchability rules:

  • Merged PRs are hatchable.
  • Open PRs are hatchable when they are status: 👀 ready for maintainer look, status: 🚀 automerge armed, or labeled clawsweeper:automerge.
  • Closed unmerged PRs are hatchable only when one of those hatchable labels is still present in the durable record.

Rarity: ✨ glimmer.
Trait: collects tiny proofs.
Image traits: location CI tidepool; accessory tiny test log scroll; palette charcoal, cyan, and signal green; mood sparkly; pose holding its accessory up for inspection; shell paper lantern shell; lighting moonlit rim light; background small green status lights.
Share on X: post this hatch
Copy: My PR egg hatched a ✨ glimmer Cosmic Proofling in ClawSweeper.

What is this egg doing here?
  • Eggs appear after the PR passes real-behavior proof. It is here for vibes, not verdicts: it does not change labels, ratings, merge decisions, or automation.
  • The shell reacts to review momentum: open follow-up work warms it up, re-review makes it wobble, and a clean final review lets it hatch.
  • Hatchability usually comes from sufficient real-behavior proof, no blocking P0/P1/P2 findings, no security attention needed, and clean correctness. A merged PR is already final, so merge makes the egg hatchable independently.
  • The hatch is seeded from this repository and PR number, so the same PR keeps the same creature; the reviewed head SHA can only change safe visual details.
  • Rarity is just collectible sparkle: 🥚 common, 🌱 uncommon, 💎 rare, ✨ glimmer, and 🌈 legendary.

@hxy91819 hxy91819 force-pushed the fix/heartbeat-template-doc-separation branch 2 times, most recently from d51ef17 to 20ffaf2 Compare May 25, 2026 11:43
@clawsweeper clawsweeper Bot added rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. and removed rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. labels May 25, 2026
@clawsweeper clawsweeper Bot added rating: 🦞 diamond lobster Very strong PR readiness with only minor maintainer review expected. and removed rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. labels May 25, 2026
@hxy91819 hxy91819 requested review from steipete and vincentkoc May 25, 2026 14:45
@hxy91819

Copy link
Copy Markdown
Member Author

@clawsweeper automerge

@clawsweeper

clawsweeper Bot commented May 27, 2026

Copy link
Copy Markdown
Contributor

🦞✅
ClawSweeper merged this PR after the passing review.

Source: clawsweeper[bot]
Feedback: structured ClawSweeper verdict: pass (sha=e34e85864c5743692a230020328e84462e8caf05)
Merge status: merged by ClawSweeper automerge
Merged at: 2026-05-27T12:30:24Z
Merge commit: 75221e0550ec

What merged:

  • The PR moves the runtime HEARTBEAT.md bootstrap template into src/agents/templates, keeps docs templates ... or other workspace files, adds a legacy heartbeat-template doctor repair, and updates package guards/tests.
  • PR surface: Source +281, Tests +283, Docs +11, Config +1, Other 0. Total +576 across 15 files.
  • Reproducibility: yes. from source inspection: current main loads HEARTBEAT.md from the docs template, and ... pty heartbeat file non-empty to the runtime. I did not run a live heartbeat repro in this read-only review.

Automerge notes:

  • PR branch already contained follow-up commit before automerge: fix(doctor): recognize heartbeat docs boilerplate
  • PR branch already contained follow-up commit before automerge: fix(agents): update heartbeat workspace test
  • PR branch already contained follow-up commit before automerge: fix(doctor): tighten heartbeat template repair

The automerge loop is complete.

Automerge progress:

  • 2026-05-27 09:21:07 UTC review queued 6e9d23eef3b0 (queued)
  • 2026-05-27 09:38:50 UTC review queued e34e85864c57 (after repair)
  • 2026-05-27 12:30:06 UTC review passed e34e85864c57 (structured ClawSweeper verdict: pass (sha=e34e85864c5743692a230020328e84462e8ca...)
  • 2026-05-27 12:22:22 UTC review queued e34e85864c57 (queued)
  • 2026-05-27 12:30:27 UTC merged e34e85864c57 (merged by ClawSweeper automerge)

@clawsweeper clawsweeper Bot added the clawsweeper:automerge Maintainer opted this PR into bounded ClawSweeper-reviewed automerge label May 27, 2026
@clawsweeper clawsweeper Bot force-pushed the fix/heartbeat-template-doc-separation branch from 6e9d23e to e34e858 Compare May 27, 2026 09:38
@clawsweeper clawsweeper Bot added status: 🚀 automerge armed This PR is in ClawSweeper's automerge lane. and removed status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels May 27, 2026
@clawsweeper clawsweeper Bot merged commit 75221e0 into main May 27, 2026
110 of 112 checks passed
@clawsweeper clawsweeper Bot deleted the fix/heartbeat-template-doc-separation branch May 27, 2026 12:30
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request May 28, 2026
Summary:
- The PR moves the runtime `HEARTBEAT.md` bootstrap template into `src/agents/templates`, keeps docs templates ... or other workspace files, adds a legacy heartbeat-template doctor repair, and updates package guards/tests.
- PR surface: Source +281, Tests +283, Docs +11, Config +1, Other 0. Total +576 across 15 files.
- Reproducibility: yes. from source inspection: current main loads `HEARTBEAT.md` from the docs template, and  ... pty heartbeat file non-empty to the runtime. I did not run a live heartbeat repro in this read-only review.

Automerge notes:
- PR branch already contained follow-up commit before automerge: fix(doctor): recognize heartbeat docs boilerplate
- PR branch already contained follow-up commit before automerge: fix(agents): update heartbeat workspace test
- PR branch already contained follow-up commit before automerge: fix(doctor): tighten heartbeat template repair

Validation:
- ClawSweeper review passed for head e34e858.
- Required merge gates passed before the squash merge.

Prepared head SHA: e34e858
Review: openclaw#85416 (comment)

Co-authored-by: Mason Huang <masonxhuang@tencent.com>
Co-authored-by: clawsweeper[bot] <274271284+clawsweeper[bot]@users.noreply.github.com>
Approved-by: hxy91819
Co-authored-by: hxy91819 <8814856+hxy91819@users.noreply.github.com>
eleboucher pushed a commit to eleboucher/homelab that referenced this pull request May 28, 2026
…026.5.27) (#698)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.5.26` → `2026.5.27` |

---

### Release Notes

<details>
<summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary>

### [`v2026.5.27`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#2026527)

[Compare Source](openclaw/openclaw@v2026.5.26...v2026.5.27)

##### Highlights

- Safer local/runtime boundaries: OpenClaw now rejects unsafe command wrappers, malformed CLI numeric options, unsafe Node runtime env overrides, no-auth Tailscale exposure, and non-admin device-role pairing approvals before they can affect live runs. ([#&#8203;87308](openclaw/openclaw#87308), [#&#8203;87305](openclaw/openclaw#87305), [#&#8203;87292](openclaw/openclaw#87292), [#&#8203;87146](openclaw/openclaw#87146))
- Matrix and auto-reply delivery are steadier: mention previews stay inert, final mention replies deliver normally, shared-DM notices are awaited, MXID parsing ignores filenames, and reasoning-prefixed `NO_REPLY` responses stay suppressed.
- Provider and agent reliability improved across OpenAI-compatible embeddings, cached token usage, Anthropic/Codex/Claude runtime state, unsupported tool-schema quarantine, heartbeat templates, and session fallback errors. ([#&#8203;85269](openclaw/openclaw#85269), [#&#8203;82062](openclaw/openclaw#82062), [#&#8203;85416](openclaw/openclaw#85416), [#&#8203;86855](openclaw/openclaw#86855))
- Plugin and package release paths got tighter: Pixverse ships as an external video plugin with region selection, package exclusions and shrinkwrap inventory match the published npm shape, and release/package smoke commands fail bounded instead of hanging.
- Gateway hot paths do less rediscovery by reusing current plugin metadata fingerprints, stable plugin index fingerprints, read-only session metadata, active working stores, status fast paths, and auth/env snapshots. ([#&#8203;86439](openclaw/openclaw#86439))

##### Changes

- Memory: add a core OpenAI-compatible embedding provider for local and hosted OpenAI-style endpoints, with config, doctor, and docs support. ([#&#8203;85269](openclaw/openclaw#85269)) Thanks [@&#8203;dutifulbob](https://github.com/dutifulbob).
- Plugin SDK: mark memory-specific embedding provider registration as deprecated compatibility and surface non-bundled usage in plugin compatibility diagnostics. ([#&#8203;85072](openclaw/openclaw#85072)) Thanks [@&#8203;mbelinky](https://github.com/mbelinky).
- Pixverse: add video generation provider support, API region selection, and external plugin publishing.
- Plugins: expose approval action metadata for plugin-driven approval surfaces.

##### Fixes

- Security/CLI/runtime: harden hostname normalization for repeated trailing dots, block side-effecting command wrappers, reject unsafe Node runtime env overrides, reject loose numeric CLI and gateway options, require admin approval for node device-role pairing, and reject no-auth Tailscale exposure. ([#&#8203;87305](openclaw/openclaw#87305), [#&#8203;87292](openclaw/openclaw#87292), [#&#8203;87308](openclaw/openclaw#87308), [#&#8203;87146](openclaw/openclaw#87146)) Thanks [@&#8203;pgondhi987](https://github.com/pgondhi987).
- Doctor: validate runtime tool schemas for every configured embedded agent while skipping ACP-only profiles, so bad non-default plugin or MCP tools are reported before assistant turns.
- Telegram: route `sendMessage` action replies through durable outbound delivery so completed agent responses remain retryable when the gateway send path times out. ([#&#8203;87261](openclaw/openclaw#87261)) Thanks [@&#8203;mbelinky](https://github.com/mbelinky).
- Matrix/auto-reply: keep draft previews mention-inert, preserve final mention delivery, send mention finals normally, await shared DM notices, ignore filename-embedded MXIDs, and suppress reasoning-prefixed `NO_REPLY` responses.
- Agents/providers: add OpenAI-compatible cache retention, forward cached token usage in chat completions, preserve runtime context before active user turns, strip stale Anthropic thinking, load Claude CLI OAuth for Pi auth profiles, avoid false Codex runtime live switches, and quarantine unsupported tool schemas. ([#&#8203;82062](openclaw/openclaw#82062), [#&#8203;87167](openclaw/openclaw#87167), [#&#8203;86855](openclaw/openclaw#86855))
- Gateway/performance: cache plugin metadata fingerprints and stable plugin index fingerprints, borrow read-only session metadata safely, keep the active session working store hot, keep status on a bounded fast path, and preserve model auth profile suffixes. ([#&#8203;86439](openclaw/openclaw#86439))
- Package/install/release: align npm package exclusions and inventory, omit unpacked test helpers, skip Homebrew until macOS packages need it, cap tsdown heap in containers, bound install/release smoke waits, and harden post-publish verification.
- Codex/Auth: bound ChatGPT OAuth token exchange and refresh requests, and honor cancellation across Codex and Anthropic OAuth login flows.
- QA/E2E/CI: bound Telegram, kitchen-sink, Open WebUI, ClawHub, MCP, Discord, realtime, labeler, and GitHub API waits; fail empty explicit test, live-media, gateway CPU, startup benchmark, plugin gauntlet, and beta-smoke runs instead of false-greening.
- Agents/Codex: keep spawned agent bootstrap files rooted in the agent workspace while running task commands, transcripts, and compaction from the requested cwd. ([#&#8203;87218](openclaw/openclaw#87218)) Thanks [@&#8203;mbelinky](https://github.com/mbelinky).

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEwMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9jb250YWluZXIiLCJ0eXBlL3BhdGNoIl19-->

Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/698
SYU8384 pushed a commit to SYU8384/openclaw that referenced this pull request Jun 3, 2026
Summary:
- The PR moves the runtime `HEARTBEAT.md` bootstrap template into `src/agents/templates`, keeps docs templates ... or other workspace files, adds a legacy heartbeat-template doctor repair, and updates package guards/tests.
- PR surface: Source +281, Tests +283, Docs +11, Config +1, Other 0. Total +576 across 15 files.
- Reproducibility: yes. from source inspection: current main loads `HEARTBEAT.md` from the docs template, and  ... pty heartbeat file non-empty to the runtime. I did not run a live heartbeat repro in this read-only review.

Automerge notes:
- PR branch already contained follow-up commit before automerge: fix(doctor): recognize heartbeat docs boilerplate
- PR branch already contained follow-up commit before automerge: fix(agents): update heartbeat workspace test
- PR branch already contained follow-up commit before automerge: fix(doctor): tighten heartbeat template repair

Validation:
- ClawSweeper review passed for head e34e858.
- Required merge gates passed before the squash merge.

Prepared head SHA: e34e858
Review: openclaw#85416 (comment)

Co-authored-by: Mason Huang <masonxhuang@tencent.com>
Co-authored-by: clawsweeper[bot] <274271284+clawsweeper[bot]@users.noreply.github.com>
Approved-by: hxy91819
Co-authored-by: hxy91819 <8814856+hxy91819@users.noreply.github.com>
sablehead pushed a commit to sablehead/openclaw that referenced this pull request Jun 10, 2026
Summary:
- The PR moves the runtime `HEARTBEAT.md` bootstrap template into `src/agents/templates`, keeps docs templates ... or other workspace files, adds a legacy heartbeat-template doctor repair, and updates package guards/tests.
- PR surface: Source +281, Tests +283, Docs +11, Config +1, Other 0. Total +576 across 15 files.
- Reproducibility: yes. from source inspection: current main loads `HEARTBEAT.md` from the docs template, and  ... pty heartbeat file non-empty to the runtime. I did not run a live heartbeat repro in this read-only review.

Automerge notes:
- PR branch already contained follow-up commit before automerge: fix(doctor): recognize heartbeat docs boilerplate
- PR branch already contained follow-up commit before automerge: fix(agents): update heartbeat workspace test
- PR branch already contained follow-up commit before automerge: fix(doctor): tighten heartbeat template repair

Validation:
- ClawSweeper review passed for head e34e858.
- Required merge gates passed before the squash merge.

Prepared head SHA: e34e858
Review: openclaw#85416 (comment)

Co-authored-by: Mason Huang <masonxhuang@tencent.com>
Co-authored-by: clawsweeper[bot] <274271284+clawsweeper[bot]@users.noreply.github.com>
Approved-by: hxy91819
Co-authored-by: hxy91819 <8814856+hxy91819@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

agents Agent runtime and tooling clawsweeper:automerge Maintainer opted this PR into bounded ClawSweeper-reviewed automerge cli CLI command changes commands Command implementations dependencies-changed PR changes dependency-related files docs Improvements or additions to documentation maintainer Maintainer-authored PR merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. P2 Normal backlog priority with limited blast radius. proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🦞 diamond lobster Very strong PR readiness with only minor maintainer review expected. scripts Repository scripts size: L status: 🚀 automerge armed This PR is in ClawSweeper's automerge lane.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant