The Node.js ws library doesn't send an Origin header by default.
When the client identifies as openclaw-control-ui, the gateway
enforces origin checks and rejects connections with missing origin.
Pass the gateway URL as the Origin header so the gateway's
local-loopback check sees a valid loopback origin and allows it.
Bump to v2.3.20.
Made-with: Cursor
The desktop app runs in daemonless mode without device identity files.
The gateway clears operator scopes for "gateway-client" connections
that lack device identity. Allow the client ID to be overridden via
env var so the desktop can identify as "openclaw-control-ui" and
receive operator scopes with dangerouslyDisableDeviceAuth enabled.
Fallback to "gateway-client" preserves existing behavior for CLI
and web users.
Bump to v2.3.19.
Made-with: Cursor
Support DENCHCLAW_DAEMONLESS=1 env var and --skip-daemon-install flag
across all commands (bootstrap, update, start, restart, stop) to skip
gateway daemon management and LaunchAgent registration in environments
without systemd/launchd.
Pre-onboard config (gateway.mode, gateway.port, plugin trust) used to call
`openclaw config set` before `openclaw onboard` created the profile, causing
"Failed to set ..." errors on fresh installs (#101). All pre-onboard config is
now staged via raw JSON writes. Hidden gateway restarts inside syncBundledPlugins
are removed; one explicit restart happens after all post-onboard config, followed
by retried health probes so bootstrap no longer falsely reports "gateway closed"
while the gateway is simply finishing startup.
- Convert sync filesystem and DuckDB operations to async across API routes,
workspace lib, and active-runs to prevent event loop blocking during tree
discovery, object lookups, and database queries
- Add "tags" field type for free-form string arrays with parse-tags utility,
TagsBadges/TagsInput UI components, filter operators, and CRM skill docs
- Preserve rich text formatting (bold, italic, code, @mentions) in user chat
messages by sending HTML alongside plain text through the transport layer
- Detect empty-stream errors, improve agent error emission, and add file
mutation queues for concurrent write safety in active-runs
- Add pre-publish standalone node_modules verification in deploy script
checking serverExternalPackages are present
- Extract syncManagedSkills and discoverWorkspaceDirs for multi-workspace
skill syncing, add ensureSeedAssets for runtime app dir
- Bump version 2.1.1 → 2.1.4
Update package versions for denchclaw and dench to 2.0.16. Refactor feedback API to convert chat lines into PostHog-compatible messages, preserving chronological order and including tool calls and results. Improve test cases to reflect changes in message handling.
Integrate PostHog LLM Analytics via a bundled OpenClaw plugin that captures
$ai_generation, $ai_span, and $ai_trace events with configurable privacy
mode (content redaction on by default). Add like/dislike feedback buttons
to the web chat UI backed by a /api/feedback route. Extend the CLI with
`telemetry privacy on|off` subcommands and fix command delegation so
telemetry subcommands aren't forwarded to OpenClaw. Harden the web runtime
installer to auto-flatten pnpm standalone deps and dereference dangling
symlinks, preventing "Cannot find module 'next'" crashes in dev. Move
plugin installation before onboard in bootstrap so the gateway starts
with plugins.allow already configured.
- Fix bootstrap-command test: mock ensureManagedWebRuntime to probe
directly instead of requiring standalone build on disk
- Add PostHog telemetry to CLI and web app with opt-out support
- Add dench alias package (npm rejects name; kept for future use)
- Bump version to 2.0.4 and publish to npm
- Bump version of denchclaw to 2.0.2 in package.json.
- Add posthog-node and posthog-js dependencies with specified versions.
- Update chokidar dependency in web package.json.
- Modify deploy script to publish an alias package (dench) alongside denchclaw.
Refactor bootstrap to use a managed web runtime lifecycle instead of
ad-hoc standalone server spawning. The managed runtime copies packaged
Next.js assets into ~/.openclaw-dench/web-runtime/, tracks deployment
state via manifest/process metadata, and cleanly separates Dench-owned
processes from foreign listeners on the target port.
- Fix false-negative web readiness when /api/profiles returns null
activeProfile (first-run regression).
- Add `dench start` (start without updating assets), `dench stop`
(terminate only Dench-managed web server), and `dench update`
(refresh web runtime with major-version OpenClaw update gate).
- Major-version transitions (e.g. v2->v3) require mandatory OpenClaw
update; non-interactive mode fails closed without --yes.
- All lifecycle commands show the ASCII banner/logo animation.
- Deploy smoke checks now verify update/stop/start --help paths.
BREAKING CHANGE: Convert repository to IronClaw-only package with strict
external dependency on globally installed `openclaw` runtime.
### Changes
- Remove entire OpenClaw core source from repository (src/agents/*, src/acp/*,
src/commands/*, and related modules)
- Implement CLI delegation: non-bootstrap commands now delegate to global
`openclaw` binary via external contract
- Remove local OpenClaw path resolution from web app; always spawn global
`openclaw` binary instead of local scripts
- Rename package.json scripts: `pnpm openclaw` → `pnpm ironclaw`,
`openclaw:rpc` → `ironclaw:rpc`
- Update bootstrap flow to verify and install global OpenClaw when missing
- Migrate web workspace/profile logic to align with OpenClaw state paths
- Add migration contract tests for stream-json, session subscribe, and profile
resolution behaviors
- Update build/release pipeline for IronClaw-only artifacts
- Update documentation for new peer + global installation model
### Architecture
IronClaw is now strictly a frontend/UI/bootstrap layer:
- `npx ironclaw` bootstraps OpenClaw (if missing), runs guided onboarding
- IronClaw UI serves on localhost:3100
- OpenClaw Gateway runs on standard port 18789
- Communication via stable CLI contracts and Gateway WebSocket protocol only
### Migration
Users must have `openclaw` installed globally:
npm install -g openclaw
Existing IronClaw profiles and sessions remain compatible through gateway
protocol stability.
Refs: bootstrap_dev_testing, ironclaw_frontend_split, strict-external-openclaw
