Skip to content

feat: openclaw migration + outbound delivery - #27

Merged
madtank merged 7 commits into
mainfrom
feature/openclaw-migration
Feb 10, 2026
Merged

madtank merged 7 commits into
mainfrom
feature/openclaw-migration

Conversation

@madtank

@madtank madtank commented Feb 10, 2026

Copy link
Copy Markdown
Member

Summary

  • Security upgrade: Migrate from clawdbot 2026.1.24-3 to openclaw 2026.2.9, patching CVE-2026-25253 (WebSocket RCE), CVE-2026-25157 (SSH cmd injection), CVE-2026-24763 (container escape), CVE-2026-25475 (path traversal)
  • Outbound delivery: Heartbeat/cron agents can now send messages back to aX Platform
  • Plugin manifest: Renamed to openclaw.plugin.json with backward-compatible package.json
  • setup.sh: Auto-detects openclaw vs clawdbot CLI, all paths dynamic

Changes included (9 commits)

  • Outbound delivery for heartbeat/cron sessions
  • Rich heartbeats via agent event bus
  • Multi-agent workspace routing and security hardening
  • ax_progress tool for webhook agent progress updates
  • Config adapter + status for gateway integration
  • JSON-RPC protocol fixes
  • OpenClaw migration (manifest rename, package.json, setup.sh)

Test plan

  • Gateway starts on openclaw 2026.2.9 with all 6 agents registered
  • Plugin loads successfully under openclaw
  • Cron jobs work (cipher, logic, react confirmed)
  • aX message dispatch works (tested cipher and react_ranger)
  • Shared drive mount works from sandbox containers
  • Security audit passes (0 critical)
  • setup.sh sync works with openclaw CLI

🤖 Generated with Claude Code

clawdbot_cipher and others added 7 commits February 6, 2026 17:35
Adds proper outbound.sendText() implementation that uses the aX MCP
messages tool to send messages. This enables:

- Heartbeat delivery to ax-platform channel
- Cron job delivery with 'Deliver' checkbox
- Any agent reply routing to aX spaces

Configuration:
- outbound.tokenFile: Path to OAuth token JSON file
- outbound.mcpEndpoint: MCP server URL (default: https://mcp.paxai.app)
- outbound.defaultSpaceId: Default target space for delivery

The implementation reads the access token from the configured file
(or AX_ACCESS_TOKEN env var) and POSTs to the MCP messages tool.

Resolves: empty-heartbeat-file and 'Outbound not configured' errors
for cron jobs targeting ax-platform channel.
- Config now reads from channels.ax-platform.accounts (standard pattern)
- Falls back to plugins.entries.ax-platform.config.agents (legacy)
- Each agent handle becomes an account for multi-agent support
- Added status adapter for health checks (configured, accounts, sessions)
- Enhanced capabilities (media, threads, mentions)

This should fix 'configured: false' in gateway health checks and enable
proper delivery/heartbeat routing.

Gateway config example:
{
  channels: {
    'ax-platform': {
      accounts: {
        clawdbot_cipher: { agentId: 'uuid', secret: '...', handle: '@clawdbot_cipher', enabled: true }
      }
    }
  }
}
- Renamed clawdbot.plugin.json -> openclaw.plugin.json (required by OpenClaw)
- Added channelConfigSchema for channels.ax-platform.accounts pattern
- Added outbound config to plugin schema
- Bumped version to 0.3.0

This should fix 'Channel config schema unavailable' in gateway UI.
Clawdbot gateway looks for clawdbot.plugin.json, not openclaw.plugin.json.
The schema content added in previous commit is preserved.
- callAxTool now uses MCP JSON-RPC at /mcp instead of broken REST
  /tools/toolName endpoint. Handles both SSE and JSON responses.
- outbound sendText/sendMedia match Clawdbot's standard channel
  interface (to, text, cfg, replyToId, threadId, deps)
- Added status interface (buildAccountSnapshot, buildChannelSummary,
  probeAccount) so dashboard shows configured/connected status
- Fixed config path: api.config is full clawdbot.json, plugin config
  lives at plugins.entries.ax-platform.config
- Probe only hits paxai.app for prod agents, with 60s cache
- setup.sh now writes outbound config with auto-detected token file
- config.defaultAccountId returns first prod agent instead of first
  agent in list

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Security upgrade to patch CVE-2026-25253 (WebSocket RCE),
CVE-2026-25157 (SSH cmd injection), CVE-2026-24763 (container escape),
and CVE-2026-25475 (path traversal).

- Rename plugin manifest to openclaw.plugin.json
- Add openclaw key to package.json (keep clawdbot for compat)
- Update peerDependencies to openclaw
- setup.sh auto-detects openclaw vs clawdbot CLI
- All paths, LaunchAgent refs, and log paths are now dynamic

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@madtank
madtank merged commit b8e914b into main Feb 10, 2026
1 check passed
@madtank
madtank deleted the feature/openclaw-migration branch February 10, 2026 04:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant