Skip to content

perf(config): dedupe plugin auto-enable fanout work#89978

Merged
shakkernerd merged 3 commits into
openclaw:mainfrom
ai-hpc:fix/plugin-auto-enable-fanout-cache
Jun 9, 2026
Merged

perf(config): dedupe plugin auto-enable fanout work#89978
shakkernerd merged 3 commits into
openclaw:mainfrom
ai-hpc:fix/plugin-auto-enable-fanout-cache

Conversation

@ai-hpc

@ai-hpc ai-hpc commented Jun 3, 2026

Copy link
Copy Markdown
Member

Summary

Fixes the plugin auto-enable recomputation side of #81355.

applyPluginAutoEnable can be called repeatedly during the same cold-start RPC fanout with the same runtime config and environment inputs. This adds a same-turn cache keyed by config, env, manifest registry, and discovery identity so identical fanout calls reuse the computed result instead of re-running detection/materialization.

The cache is cleared on the next event-loop turn so mutable inputs such as process.env and plugin discovery state are not held as long-lived stale keys.

Verification

  • pnpm test src/config/plugin-auto-enable.core.test.ts src/config/plugin-auto-enable.providers.test.ts src/config/plugin-auto-enable.channels.test.ts src/config/plugin-auto-enable.model-support.test.ts src/config/plugin-auto-enable.prefer-over.test.ts src/plugins/web-search-providers.runtime.test.ts
  • pnpm exec oxfmt --check --threads=1 src/config/plugin-auto-enable.apply.ts src/config/plugin-auto-enable.core.test.ts
  • git diff --check
  • pnpm ui:build
  • Full local browser E2E proof with a real gateway, production Control UI, throwaway state, token auth, and Chromium.

Real behavior proof

Behavior or issue addressed: Dashboard cold-start fanout no longer repeats the plugin auto-enable recomputation path across concurrent Control UI requests.

Real environment tested: Local OpenClaw checkout at 638b1e8ef5b0814f31f5652fb2ac3a053e4f129d, Node 22.22.2, production Control UI build, real local gateway with throwaway OpenClaw state, token auth, and Chromium.

Exact steps or command run after this patch:

  1. Built the production Control UI with pnpm ui:build.
  2. Started a real local gateway from this PR branch with throwaway state and token auth.
  3. Opened the served Control UI in Chromium using the tokenized dashboard URL.
  4. Loaded /overview and waited for the dashboard fanout.
  5. Loaded /agents, selected the ops agent, opened Tools, and waited for tools.catalog.
  6. Loaded /debug and invoked tts.status through the rendered manual RPC form.

Evidence after fix:
Terminal output from the full local browser E2E proof:

{
  "head": "638b1e8ef5b0814f31f5652fb2ac3a053e4f129d",
  "browserRendered": true,
  "routes": [
    "/overview",
    "/agents",
    "/debug"
  ],
  "okMethods": {
    "agent.identity.get": 6,
    "agents.files.list": 2,
    "agents.list": 4,
    "channels.status": 1,
    "config.get": 1,
    "connect": 3,
    "cron.list": 1,
    "cron.status": 1,
    "health": 5,
    "last-heartbeat": 2,
    "logs.tail": 1,
    "models.authStatus": 1,
    "models.list": 2,
    "sessions.list": 1,
    "sessions.messages.subscribe": 3,
    "sessions.subscribe": 3,
    "sessions.usage": 1,
    "skills.status": 1,
    "status": 2,
    "system-presence": 1,
    "tools.catalog": 1,
    "tts.status": 1,
    "usage.cost": 1
  },
  "errorMethods": {},
  "gatewayReady": true
}

Observed result after fix: The rendered dashboard completed overview cold-start fanout, agent tools loading, and the UI-invoked tts.status call without browser RPC errors.

What was not tested: No known gaps.

@clawsweeper

clawsweeper Bot commented Jun 3, 2026

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed June 5, 2026, 3:50 AM ET / 07:50 UTC.

Summary
Adds a same-turn WeakMap cache to applyPluginAutoEnable keyed by config, env, manifest registry, and discovery identity, plus regression tests for cache reuse and stale-input avoidance.

PR surface: Source +112, Tests +135. Total +247 across 2 files.

Reproducibility: yes. from source rather than a local timing run: the linked report identifies repeated cold-start fanout calls, and current code shows tools.catalog and plugin runtime load paths reach applyPluginAutoEnable. I did not run the live dashboard timing scenario in this read-only review.

Review metrics: none identified.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • [P2] Add a latest-head cold-start call-count or timing snippet if maintainers want the performance magnitude proven before merge.

Risk before merge

  • [P1] The live browser proof in the PR body is from earlier head 638b1e8 and does not measure cold-start latency or cache-hit counts on the current head; this is not a correctness blocker, but maintainers may want latest-head timing if the performance claim is merge-critical.

Maintainer options:

  1. Decide the mitigation before merge
    Land the focused same-turn cache after normal maintainer review if CI remains healthy; request a small latest-head timing or call-count snippet only if the performance magnitude needs merge-time proof.
  2. Pause or close
    Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

  • No automated repair is needed; the remaining action is ordinary maintainer review and merge validation.

Security
Cleared: The diff adds in-process memoization and tests only; it does not change dependencies, CI, packaging, secrets, permissions, or downloaded code execution.

Review details

Best possible solution:

Land the focused same-turn cache after normal maintainer review if CI remains healthy; request a small latest-head timing or call-count snippet only if the performance magnitude needs merge-time proof.

Do we have a high-confidence way to reproduce the issue?

Yes, from source rather than a local timing run: the linked report identifies repeated cold-start fanout calls, and current code shows tools.catalog and plugin runtime load paths reach applyPluginAutoEnable. I did not run the live dashboard timing scenario in this read-only review.

Is this the best way to solve the issue?

Yes. The latest implementation is a narrow owner-boundary fix because it caches only explicit metadata snapshots, fingerprints mutable config/env inputs, and leaves omitted metadata on the current uncached path; broader gateway-level caching would be higher risk.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 1a3ce7c2a8da.

Label changes

Label changes:

  • add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
  • add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body includes live local gateway, production Control UI, token auth, and Chromium output exercising the dashboard routes and RPCs after the central behavior change, though it does not measure the latency claim on the latest head.
  • remove rating: 🧂 unranked krab: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.
  • remove merge-risk: 🚨 compatibility: Current PR review selected no merge-risk labels.
  • remove status: ⏳ waiting on author: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

  • P2: This is a normal-priority gateway/plugin config performance fix with limited blast radius and no blocking correctness finding in the latest head.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body includes live local gateway, production Control UI, token auth, and Chromium output exercising the dashboard routes and RPCs after the central behavior change, though it does not measure the latency claim on the latest head.
  • proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes live local gateway, production Control UI, token auth, and Chromium output exercising the dashboard routes and RPCs after the central behavior change, though it does not measure the latency claim on the latest head.
Evidence reviewed

PR surface:

Source +112, Tests +135. Total +247 across 2 files.

View PR surface stats
Area Files Added Removed Net
Source 1 112 0 +112
Tests 1 135 0 +135
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 2 247 0 +247

What I checked:

  • Repository policy read: Read the full root AGENTS.md and found no scoped AGENTS.md under src/config; the root policy makes config/plugin metadata cache changes compatibility-sensitive and requires whole-path review. (AGENTS.md:31, 1a3ce7c2a8da)
  • Current main lacks the PR cache: Current main still computes candidates and immediately materializes them on each applyPluginAutoEnable call, so the central PR work is not already implemented on main. (src/config/plugin-auto-enable.apply.ts:52, 1a3ce7c2a8da)
  • Latest PR cache is scoped to explicit metadata identities: At PR head, the cache path only runs when config, manifestRegistry, and discovery are all present, then keys through config, env, registry, and discovery WeakMap identities and checks config/env fingerprints before reuse. (src/config/plugin-auto-enable.apply.ts:130, d937944e7081)
  • Implicit metadata path remains uncached: Current main resolves omitted manifest registries from the current plugin metadata snapshot or a loaded snapshot, and the latest PR bypasses caching when explicit registry/discovery inputs are missing. (src/config/plugin-auto-enable.shared.ts:958, 1a3ce7c2a8da)
  • Gateway fanout callers can supply stable metadata: The runtime plugin load context resolves a metadata snapshot and passes its manifest registry plus discovery into applyPluginAutoEnable, which is the explicit-input path the PR optimizes. (src/plugins/runtime/load-context.ts:92, 1a3ce7c2a8da)
  • Regression tests cover prior cache freshness risks: The PR adds tests for same-turn reuse, current snapshot replacement when metadata is omitted, explicit registry/env separation, config mutation, and env mutation. (src/config/plugin-auto-enable.core.test.ts:1032, d937944e7081)

Likely related people:

  • Peter Steinberger: Blame for applyPluginAutoEnable, implicit manifest registry resolution, and the runtime config hash helper points to 82710b4; recent history also shows adjacent plugin runtime/context work. (role: current implementation and recent area contributor; confidence: high; commits: 82710b4f1f10, 1a63f5b972f6, 58f4099a4fb0; files: src/config/plugin-auto-enable.apply.ts, src/config/plugin-auto-enable.shared.ts, src/config/runtime-snapshot.ts)
  • Vincent Koc: Recent history on the related plugin runtime and release baseline paths includes plugin SDK baseline and gateway/plugin hot-path commits near the affected surface. (role: recent plugin/runtime baseline contributor; confidence: medium; commits: 2e08f0f4221f, 9b25c8f8e1b8, d2ce3e9accc6; files: src/config/plugin-auto-enable.apply.ts, src/config/plugin-auto-enable.shared.ts, src/gateway/server-plugins.ts)
  • Tak Hoffman: History on gateway plugin loading and tool registry reuse includes multiple regression fixes around auto-enabled plugin loads and stale registries. (role: adjacent gateway plugin auto-enable contributor; confidence: medium; commits: 1b5043f47bed, 36ac9224cc92, cfd1e94e6101; files: src/gateway/server-plugins.ts, src/plugins/tools.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. labels Jun 3, 2026
@ai-hpc ai-hpc force-pushed the fix/plugin-auto-enable-fanout-cache branch from 66e14ed to 02b24d6 Compare June 3, 2026 20:04
@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. and removed rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. labels Jun 3, 2026
@ai-hpc ai-hpc force-pushed the fix/plugin-auto-enable-fanout-cache branch from 02b24d6 to 9e56cb0 Compare June 3, 2026 20:27
@clawsweeper clawsweeper Bot added rating: 🌊 off-meta tidepool PR readiness rating does not apply to this item. and removed proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. labels Jun 3, 2026
@ai-hpc ai-hpc force-pushed the fix/plugin-auto-enable-fanout-cache branch from 9e56cb0 to 0c67dea Compare June 3, 2026 20:52
@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. and removed rating: 🌊 off-meta tidepool PR readiness rating does not apply to this item. labels Jun 3, 2026
@ai-hpc ai-hpc force-pushed the fix/plugin-auto-enable-fanout-cache branch 2 times, most recently from 78078d7 to 638b1e8 Compare June 3, 2026 23:38
@ai-hpc

ai-hpc commented Jun 4, 2026

Copy link
Copy Markdown
Member Author

@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented Jun 4, 2026

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

@clawsweeper clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. and removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. labels Jun 5, 2026
@clawsweeper clawsweeper Bot removed the merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. label Jun 5, 2026
@shakkernerd shakkernerd force-pushed the fix/plugin-auto-enable-fanout-cache branch from d937944 to 7179cf5 Compare June 9, 2026 17:03
@shakkernerd

Copy link
Copy Markdown
Member

Land-ready verification for rebase merge:

  • Rebases onto current origin/main; final PR head is 7179cf54e6580a2f181e24002f7858da949f5522.
  • Preserved GitHub-resolvable PR author identity on all commits: ai-hpc / NVIDIAN <183861985+ai-hpc@users.noreply.github.com>.
  • Local proof after author repair: git diff --check; node scripts/run-vitest.mjs src/config/plugin-auto-enable.core.test.ts (51 passed).
  • Auto review: .agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main returned clean with no accepted/actionable findings.
  • Crabbox proof: AWS Crabbox cbx_a145a2dbe32d, run run_b48b365efdb0; passed diff-check, format check, pnpm check:changed, and related Vitest (95 tests).
  • GitHub CI: live PR rollup is clean: 160 checks, 0 pending, 0 failed.

@shakkernerd shakkernerd merged commit 2da7dc9 into openclaw:main Jun 9, 2026
160 checks passed
eleboucher pushed a commit to eleboucher/homelab that referenced this pull request Jun 12, 2026
…26.6.6) (#1040)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.6.5` → `2026.6.6` |

---

### Release Notes

<details>
<summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary>

### [`v2026.6.6`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#202666)

[Compare Source](openclaw/openclaw@v2026.6.5...v2026.6.6)

##### Highlights

- Security boundaries are substantially tighter across transcripts, sandbox binds, host environment inheritance, MCP stdio, Codex HTTP access, native search policy, elevated sender checks, deleted-agent ACP bypasses, loopback tools, Discord moderation, and Teams group actions; exec approvals now fail closed on timeout. ([#&#8203;91529](openclaw/openclaw#91529), [#&#8203;91618](openclaw/openclaw#91618), [#&#8203;91615](openclaw/openclaw#91615), [#&#8203;91619](openclaw/openclaw#91619), [#&#8203;91741](openclaw/openclaw#91741), [#&#8203;91745](openclaw/openclaw#91745), [#&#8203;91746](openclaw/openclaw#91746), [#&#8203;91748](openclaw/openclaw#91748), [#&#8203;91749](openclaw/openclaw#91749), [#&#8203;91750](openclaw/openclaw#91750), [#&#8203;91751](openclaw/openclaw#91751), [#&#8203;91752](openclaw/openclaw#91752), [#&#8203;91763](openclaw/openclaw#91763), [#&#8203;89938](openclaw/openclaw#89938)) Thanks [@&#8203;joshavant](https://github.com/joshavant), [@&#8203;pgondhi987](https://github.com/pgondhi987), [@&#8203;mmaps](https://github.com/mmaps), [@&#8203;eleqtrizit](https://github.com/eleqtrizit), [@&#8203;shakkernerd](https://github.com/shakkernerd), and [@&#8203;drobison00](https://github.com/drobison00).
- Telegram delivery is safer and more coherent: account-scoped topics route to the right agent, streamed text survives tool calls, `/compact` works on generic ingress, callback handling uses concrete APIs, draft chunking is shared, durable dispatch dedupe moved into the SDK, and unauthorized DM text stays out of cache and prompt context. ([#&#8203;91189](openclaw/openclaw#91189), [#&#8203;88682](openclaw/openclaw#88682), [#&#8203;89588](openclaw/openclaw#89588), [#&#8203;90212](openclaw/openclaw#90212), [#&#8203;91876](openclaw/openclaw#91876), [#&#8203;91874](openclaw/openclaw#91874), [#&#8203;91904](openclaw/openclaw#91904), [#&#8203;91478](openclaw/openclaw#91478), [#&#8203;91915](openclaw/openclaw#91915)) Thanks [@&#8203;codysai001](https://github.com/codysai001), [@&#8203;alexzhu0](https://github.com/alexzhu0), [@&#8203;joelnishanth](https://github.com/joelnishanth), [@&#8203;snowzlm](https://github.com/snowzlm), [@&#8203;obviyus](https://github.com/obviyus), and [@&#8203;sallyom](https://github.com/sallyom).
- iMessage recovery and delivery now cover always-on inbound restart, durable echo markers, block streaming, idle approval discovery, hardened outbound transport, and actionable inbound startup diagnostics. ([#&#8203;91335](openclaw/openclaw#91335), [#&#8203;91449](openclaw/openclaw#91449), [#&#8203;88969](openclaw/openclaw#88969), [#&#8203;88530](openclaw/openclaw#88530), [#&#8203;91783](openclaw/openclaw#91783), [#&#8203;91785](openclaw/openclaw#91785)) Thanks [@&#8203;omarshahine](https://github.com/omarshahine), [@&#8203;jmissig](https://github.com/jmissig), and [@&#8203;colmbrogan](https://github.com/colmbrogan).
- Browser and MCP connectivity gained existing-session CDP support, discovered WebSocket validation, default-profile `cdpUrl` handling, safer browser-output boundaries, Streamable HTTP loopback transport, corrected OAuth/SSE authorization handling, and broader schema compatibility. ([#&#8203;91422](openclaw/openclaw#91422), [#&#8203;89851](openclaw/openclaw#89851), [#&#8203;91736](openclaw/openclaw#91736), [#&#8203;91747](openclaw/openclaw#91747), [#&#8203;91451](openclaw/openclaw#91451), [#&#8203;80143](openclaw/openclaw#80143)) Thanks [@&#8203;pgondhi987](https://github.com/pgondhi987), [@&#8203;anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia), [@&#8203;lifuyue](https://github.com/lifuyue), [@&#8203;eleqtrizit](https://github.com/eleqtrizit), [@&#8203;LiuwqGit](https://github.com/LiuwqGit), and [@&#8203;HemantSudarshan](https://github.com/HemantSudarshan).
- Control UI startup and first-reply latency are lower through cached model metadata, removal of the startup catalog wait, lazy slash-command loading, and first-event tracing with slow-reply diagnostics. ([#&#8203;91531](openclaw/openclaw#91531), [#&#8203;91538](openclaw/openclaw#91538), [#&#8203;91568](openclaw/openclaw#91568), [#&#8203;91583](openclaw/openclaw#91583), [#&#8203;91598](openclaw/openclaw#91598))
- Provider support expands with OpenRouter OAuth onboarding and Claude Fable 5 adaptive thinking, while Codex sessions keep correct compaction ownership, local models skip guardian review, dynamic tool progress normalizes cleanly, and Gemma 4 reasoning replay is preserved. ([#&#8203;91830](openclaw/openclaw#91830), [#&#8203;91882](openclaw/openclaw#91882), [#&#8203;91590](openclaw/openclaw#91590), [#&#8203;88630](openclaw/openclaw#88630), [#&#8203;88768](openclaw/openclaw#88768), [#&#8203;91696](openclaw/openclaw#91696)) Thanks [@&#8203;Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@&#8203;joshavant](https://github.com/joshavant), [@&#8203;bdjben](https://github.com/bdjben), and [@&#8203;Coder-Wangyankun](https://github.com/Coder-Wangyankun).

##### Changes

- CLI progress: emit Claude CLI commentary progress events and bridge inter-tool commentary into channel progress without exposing internal protocol scaffolding. ([#&#8203;89834](openclaw/openclaw#89834), [#&#8203;90883](openclaw/openclaw#90883)) Thanks [@&#8203;anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia).
- Observability: allow trusted diagnostics channels to capture tool input/output content, add first-assistant-event traces, and warn on slow initial replies. ([#&#8203;91256](openclaw/openclaw#91256), [#&#8203;91568](openclaw/openclaw#91568), [#&#8203;91583](openclaw/openclaw#91583)) Thanks [@&#8203;amknight](https://github.com/amknight).
- Plugins/ClawHub: dogfood reusable package publishing, let dry runs skip publish approval, allow declared installed trusted hooks, report managed plugin version drift, and warn instead of failing on retired Skill Workshop configuration. ([#&#8203;91574](openclaw/openclaw#91574), [#&#8203;91591](openclaw/openclaw#91591), [#&#8203;90004](openclaw/openclaw#90004), [#&#8203;90927](openclaw/openclaw#90927), [#&#8203;90838](openclaw/openclaw#90838)) Thanks [@&#8203;Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@&#8203;brokemac79](https://github.com/brokemac79), and [@&#8203;lonexreb](https://github.com/lonexreb).
- Memory/providers: move the local llama.cpp runtime into its provider plugin, batch embeddings across files, persist the agent model catalog cache, and keep QMD JSON search one-shot while filtering stale REM recall previews. ([#&#8203;91324](openclaw/openclaw#91324), [#&#8203;89138](openclaw/openclaw#89138), [#&#8203;90457](openclaw/openclaw#90457), [#&#8203;91837](openclaw/openclaw#91837), [#&#8203;91851](openclaw/openclaw#91851)) Thanks [@&#8203;osolmaz](https://github.com/osolmaz), [@&#8203;mushuiyu886](https://github.com/mushuiyu886), [@&#8203;ai-hpc](https://github.com/ai-hpc), and [@&#8203;TurboTheTurtle](https://github.com/TurboTheTurtle).
- Channels/mobile: add the QQBot group mention toggle, improve iPad and iPhone control surfaces, and expose the active connection host in the TUI footer. ([#&#8203;91423](openclaw/openclaw#91423), [#&#8203;91557](openclaw/openclaw#91557), [#&#8203;89909](openclaw/openclaw#89909)) Thanks [@&#8203;cxyhhhhh](https://github.com/cxyhhhhh), [@&#8203;Solvely-Colin](https://github.com/Solvely-Colin), and [@&#8203;baskduf](https://github.com/baskduf).
- Performance: prewarm TUI runtime plugins, deduplicate plugin auto-enable fanout, trim dense text-delta snapshots, and reuse prepared startup model metadata. ([#&#8203;90782](openclaw/openclaw#90782), [#&#8203;89978](openclaw/openclaw#89978), [#&#8203;91580](openclaw/openclaw#91580), [#&#8203;91531](openclaw/openclaw#91531)) Thanks [@&#8203;RomneyDa](https://github.com/RomneyDa) and [@&#8203;ai-hpc](https://github.com/ai-hpc).

##### Fixes

- Agent/session recovery: drop stale approval follow-ups after session rebind, remove drained reply-queue items by identity, recover stale main and visible replies, preserve Codex context-engine compaction ownership, lower the default compaction timeout to 180 seconds while respecting explicit configuration, and keep provider-failure terminal lifecycle state correct. ([#&#8203;85679](openclaw/openclaw#85679), [#&#8203;91450](openclaw/openclaw#91450), [#&#8203;91566](openclaw/openclaw#91566), [#&#8203;91840](openclaw/openclaw#91840), [#&#8203;91590](openclaw/openclaw#91590), [#&#8203;91361](openclaw/openclaw#91361), [#&#8203;91895](openclaw/openclaw#91895)) Thanks [@&#8203;openperf](https://github.com/openperf), [@&#8203;yetval](https://github.com/yetval), [@&#8203;joshavant](https://github.com/joshavant), [@&#8203;wangmiao0668000666](https://github.com/wangmiao0668000666), and [@&#8203;TurboTheTurtle](https://github.com/TurboTheTurtle).
- User-visible content boundaries: suppress Codex/Harmony protocol artifacts, neutralize browser and LanceDB memory media directives, redact transcript images, and preserve native `/compact` replies through source suppression. ([#&#8203;89151](openclaw/openclaw#89151), [#&#8203;91422](openclaw/openclaw#91422), [#&#8203;91425](openclaw/openclaw#91425), [#&#8203;91529](openclaw/openclaw#91529), [#&#8203;90212](openclaw/openclaw#90212)) Thanks [@&#8203;joelnishanth](https://github.com/joelnishanth), [@&#8203;pgondhi987](https://github.com/pgondhi987), [@&#8203;joshavant](https://github.com/joshavant), and [@&#8203;snowzlm](https://github.com/snowzlm).
- Channel delivery: keep WhatsApp captured replies attached to the successor controller after restart, retry Feishu rate limits, preserve Mattermost thread replies, canonicalize LINE webhook paths, restore Discord reply hydration and runtime timeout exports, and show OpenAI Realtime WebRTC assistant transcripts. ([#&#8203;85823](openclaw/openclaw#85823), [#&#8203;89659](openclaw/openclaw#89659), [#&#8203;91684](openclaw/openclaw#91684), [#&#8203;91649](openclaw/openclaw#91649), [#&#8203;90263](openclaw/openclaw#90263), [#&#8203;91686](openclaw/openclaw#91686), [#&#8203;90426](openclaw/openclaw#90426)) Thanks [@&#8203;itsuzef](https://github.com/itsuzef), [@&#8203;ladygege](https://github.com/ladygege), [@&#8203;jacobtomlinson](https://github.com/jacobtomlinson), [@&#8203;fuller-stack-dev](https://github.com/fuller-stack-dev), and [@&#8203;shushushv](https://github.com/shushushv).
- Cron: cancel active task runs cleanly, preserve terminal timeout/cancel state, and recover no-deliver tool warnings instead of silently losing the outcome. ([#&#8203;90666](openclaw/openclaw#90666), [#&#8203;90678](openclaw/openclaw#90678)) Thanks [@&#8203;ai-hpc](https://github.com/ai-hpc).
- Gateway/config/auth: share the approval runtime socket token, replace arrays explicitly in `config.patch`, skip the deleted-agent guard only for valid ACP harness sessions, surface headless LaunchAgent state, verify SQLite auth migration before cleanup, and arm QMD startup maintenance. ([#&#8203;87105](openclaw/openclaw#87105), [#&#8203;91551](openclaw/openclaw#91551), [#&#8203;91219](openclaw/openclaw#91219), [#&#8203;91614](openclaw/openclaw#91614), [#&#8203;91740](openclaw/openclaw#91740), [#&#8203;91978](openclaw/openclaw#91978)) Thanks [@&#8203;fuller-stack-dev](https://github.com/fuller-stack-dev) and [@&#8203;scotthuang](https://github.com/scotthuang).
- Providers/Codex: clarify quota errors, restore the Codex synthetic usage line, canonicalize Codex protocol assets, require API-key auth for realtime voice, normalize ACP model refs, preserve Gemma 4 `reasoning_content`, and avoid guardian review for local models. ([#&#8203;91390](openclaw/openclaw#91390), [#&#8203;91709](openclaw/openclaw#91709), [#&#8203;91507](openclaw/openclaw#91507), [#&#8203;91567](openclaw/openclaw#91567), [#&#8203;88630](openclaw/openclaw#88630), [#&#8203;91696](openclaw/openclaw#91696)) Thanks [@&#8203;hxy91819](https://github.com/hxy91819), [@&#8203;brokemac79](https://github.com/brokemac79), [@&#8203;RomneyDa](https://github.com/RomneyDa), [@&#8203;joshavant](https://github.com/joshavant), and [@&#8203;Coder-Wangyankun](https://github.com/Coder-Wangyankun).
- Updates/builds: recover package Gateway restarts after refresh failure, expose plugin convergence repair, fall back to Corepack in PATH-less pnpm environments, seed the correct Docker store packages, and keep ClawHub dry-run and publish paths reusable. ([#&#8203;91581](openclaw/openclaw#91581), [#&#8203;91599](openclaw/openclaw#91599), [#&#8203;91547](openclaw/openclaw#91547), [#&#8203;91591](openclaw/openclaw#91591)) Thanks [@&#8203;fuller-stack-dev](https://github.com/fuller-stack-dev), [@&#8203;sallyom](https://github.com/sallyom), and [@&#8203;Patrick-Erichsen](https://github.com/Patrick-Erichsen).
- UI: require explicit user intent before opening chat sessions and drain restored chat queues after session switches. ([#&#8203;91480](openclaw/openclaw#91480)) Thanks [@&#8203;TurboTheTurtle](https://github.com/TurboTheTurtle).
- Android: avoid the `dataSync` foreground-service type for persistent nodes. ([#&#8203;80082](openclaw/openclaw#80082)) Thanks [@&#8203;davelutztx](https://github.com/davelutztx).
- Native hooks: bound relay lifetimes so abandoned native hook connections cannot linger indefinitely. ([#&#8203;91550](openclaw/openclaw#91550)) Thanks [@&#8203;joshavant](https://github.com/joshavant).

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEwMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9jb250YWluZXIiLCJ0eXBlL3BhdGNoIl19-->

Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/1040
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

P2 Normal backlog priority with limited blast radius. proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. size: M status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants