v2026.4.29

Changelog

• 1842a70 Release v2026.4.29: cron sidecar + /api/system cold-path hardening (#27)
• 9f2d484 Update GitHub Actions to Node 24 majors (#24)

v2026.4.13

OpenClaw Dashboard v2026.4.13

This release focuses on diagnostics delivery, lifecycle hardening, packaging confidence, and release readiness.

Highlights

• Implements the diagnostics request from #14 by @agrr971
• Fixes the remaining Linux service backend compile issue
• Cleans up refresh and shutdown lifecycle handling so subprocesses follow cancellation more consistently
• Tightens gateway timeout handling and local CORS behavior, including IPv6 loopback support
• Fixes subagent run counting and log-feed merge correctness issues
• Reuses HTTP clients in system probes to reduce transport churn
• Refreshes release-facing documentation to match current runtime behavior and command surface

Included merged PRs

• #19 by @SweetSophia — consolidate escaping helpers for consistent HTML escaping
• #20 by @SweetSophia — use structuredClone for state snapshots
• #21 by @SweetSophia — reduce lock churn in latest-version cache refresh
• #22 by @SweetSophia — fix refresh shutdown semantics safely

Thanks

• Thanks @SweetSophia for the merged improvements in #19, #20, #21, and #22.
• Thanks @agrr971 for opening #14 and documenting the diagnostics use case clearly enough to drive implementation.

Artifacts

Published for:

• macOS amd64
• macOS arm64
• Linux amd64
• Linux arm64

Each archive includes:

• openclaw-dashboard
• runtime assets under assets/runtime/
• install.sh / uninstall.sh
• docs/CONFIGURATION.md
• example configs
• README.md, LICENSE, and VERSION

Checksums are in checksums-sha256.txt.

Recommended post-release smoke test

1. Verify archive checksum
2. Run ./openclaw-dashboard --version
3. Run ./openclaw-dashboard --refresh
4. Start ./openclaw-dashboard --port 9090
5. Verify /, /api/refresh, /api/system, /api/logs, and /api/errors
6. Smoke-test install.sh
7. Smoke-test brew install mudrii/tap/openclaw-dashboard

v2026.4.8

Changelog

• 114b205 Add service management updates
• 19de05e Harden service command validation
• 3e483ca chore(appservice): fix imports, go fix modernizers, lint clean
• 6018899 feat(appservice): add Backend interface, types, FormatStatus, unsupported stub
• 2cd268d feat(appservice): launchd backend with plist generation, lifecycle ops, status
• 65428f5 feat(appservice): systemd backend with unit file generation, lifecycle ops, status
• 4fd6c94 feat(dashboard): add service subcommand dispatch to Main()
• 8ecfb32 fix(appservice): add HTTP liveness probe to launchd Status, fix plist index guards
• 9703f57 fix(appservice): inject probeFunc for testability, fix journalctl flags and mock dispatch
• 4aff998 fix(appservice): use errors.Is in test assertions for consistency
• 10de661 fix(appservice): use errors.Is, add probeFunc to Uninstall test, scope probe.go build tag
• a069af6 fix(appservice): use errors.New for sentinel, harden formatUptime edge cases
• 8b4ad0f fix(dashboard): respect config/env defaults in service install, normalize normaliseCmd rest slice
• 33ce414 fix: add default dispatch error, errors.Is in main, wrap os.Remove in launchd
• dc72c91 fix: harden service environment and install health checks
• 48f18c3 fix: safe defer Close, guard normaliseCmd against flag args, add Uptime assertion
• 062b038 merge: service management and v2026.4.8 release prep
• c6c41c9 refactor: CLAUDE.md + go-rigor compliance pass on appservice
• ed0fb02 test(appservice): add AutoStart assertion and probeFunc in systemd tests
• d609e2d test(appservice): add FormatStatus and formatUptime table tests
• 209a623 test(appservice): use t.Run in TestFormatUptime, consistent assertion style
• 0063101 test(dashboard): acceptance tests for service subcommand routing (failing)
• 19910b4 test(dashboard): fix wantRest comparison, remove fmt alias, use errors.New, assert Status called

v2026.4.4

Changelog

• df0a1c3 fix: use GoReleaser v2 formats array to restore tar.gz release packaging

v2026.4.3 — Code Quality Audit

What's Changed

Fixed

• M1: Exact path match for /api/refresh — strings.HasPrefix replaced with ==; previously any path beginning with /api/refresh (e.g. /api/refreshXXX) would incorrectly match the refresh handler
• M2: serverCtx renamed to shutdownCtx in SystemService — clarifies that this context is the server lifecycle context and must not be used for per-request operations
• M3: Linux CPU dual-sample sleep is context-aware — time.Sleep(200ms) replaced with select { case <-time.After: case <-ctx.Done(): } so graceful shutdown is not blocked by the inter-sample gap
• M4: 404 responses include CORS headers — all http.NotFound call sites in ServeHTTP and HandleStaticFile now go through a new notFound helper that sets CORS headers first; browser clients no longer receive a misleading CORS error instead of a clean 404
• L3: npm registry response cap tightened — io.LimitReader in FetchLatestNpmVersion reduced from 1 MiB to 64 KiB; sufficient for any npm metadata response

Documentation

• CHANGELOG backfilled with missing v2026.3.6 and v2026.3.7 entries

Install

```bash

macOS Apple Silicon

curl -L https://github.com/mudrii/openclaw-dashboard/releases/download/v2026.4.3/openclaw-dashboard-darwin-arm64 -o openclaw-dashboard
chmod +x openclaw-dashboard

macOS Intel

curl -L https://github.com/mudrii/openclaw-dashboard/releases/download/v2026.4.3/openclaw-dashboard-darwin-amd64 -o openclaw-dashboard
chmod +x openclaw-dashboard

Linux amd64

curl -L https://github.com/mudrii/openclaw-dashboard/releases/download/v2026.4.3/openclaw-dashboard-linux-amd64 -o openclaw-dashboard
chmod +x openclaw-dashboard

Linux arm64

curl -L https://github.com/mudrii/openclaw-dashboard/releases/download/v2026.4.3/openclaw-dashboard-linux-arm64 -o openclaw-dashboard
chmod +x openclaw-dashboard
```

SHA256 Checksums

```
aeec5ea115f015dd72ede54fe4cc0a577974916098697f68ad4d794ae6039b4d openclaw-dashboard-darwin-amd64
85001f3df72fabfdc3506c950b1bf815dffc21b5c279d19fb07658eeba24a1cd openclaw-dashboard-darwin-arm64
2d5409bc2555ce00d4443bcda7951e84c868f30b0ad2d3ca5862df4be87986a9 openclaw-dashboard-linux-amd64
249e9f72fd1f6e84ea75c9e83416028d288ccd458d5120e3453a779fe98a176e openclaw-dashboard-linux-arm64
```

v2026.3.23

Changelog

• cf53bf5 Merge pull request #12 from mudrii/remove-python-dependency
• dc00c51 Remove Python dependency and harden Go dashboard
• fa136d5 feat: add runtime badge to header + fix sysOclaw duplicate prefix
• 378e712 feat: remove Python dependency, Go-only codebase
• b1fe6a5 fix: add cmd/openclaw-dashboard entry point and fix .gitignore
• afff37b fix: cache refresh metadata and harden version lookups
• 7813ac0 fix: comprehensive audit — error handling, linting, tests, docs
• c1a2e06 fix: harden runtime, improve perf, add missing refresh tests
• fd5173b fix: normalize version comparison to ignore commit hash parenthetical
• 02a977d fix: resolve data race, broken Dockerfile, and minor issues
• 336ed37 refactor: reorganize dashboard into internal packages

v2026.3.8

Runtime Observability + Runtime Readiness Fixes (v2026.3.8)

Features

• Add gateway runtime observability to /api/system with structured openclaw block (runtime, readiness, live status, failing deps, PID, memory, config snapshots).
• Split System Settings section into Gateway Runtime and Gateway Config cards.
• Add readiness alerts from runtime state in Alerts (Gateway not ready: <dependency> when available).
• Include openclaw runtime data parity for Go and Python servers.

Improvements

• Replace binary/asset path handling to resolve repo root for dist/-launched binaries.
• Improve version detection to prefer VERSION from binary or parent directory.
• Improve system refresh behavior with stale-while-revalidate and overlap prevention.
• Simplify and stabilize runtime collection/error mapping (gatewayError typed handling, 502/504 behavior).
• Remove legacy channels/bindings references from runtime status output and tighten Gateway Runtime/Config split.

Bug Fixes

• Parse readyz payload even on HTTP 503 so failing dependencies remain visible in runtime state.
• Preserve and display failing list consistently in API payloads.
• Ensure localStorage key migration for configuration collapse defaults.

Internal / UI

• Fine-tune Alerts/health behavior (Online/Offline) with readiness details in dedicated alert surface.
• Reworked Agent & Model Configuration section layout (2-row config panel arrangement).
• Updated docs for new runtime features and install command examples.
• Expanded Go and Python tests around system/runtime contract and frontend rendering.

Release

• Release version: v2026.3.8
• Build artifacts:
  • Go binaries: openclaw-dashboard-v2026.3.8-{darwin-amd64,darwin-arm64,linux-amd64,linux-arm64}
  • Python bundles: openclaw-dashboard-v2026.3.8-python.zip and .tar.gz
  • checksums-sha256.txt

v2026.3.7 — Security Hardening & Performance

Security Hardening & Performance — Audit v2026.3.6 (4 rounds)

This release addresses all findings from 4 consecutive security/performance audit rounds (Sonnet + Opus deep-dives).

🔒 P0 Security Fixes

• Rate limiting — 10 req/min per-IP token-bucket on /api/chat in both Go and Python
  Returns 429 Too Many Requests with Retry-After: 60 header when exceeded
• HTTP server timeouts — Go server now enforces Read 30s / Write 90s / Idle 120s
  Prevents slow-client and resource exhaustion attacks
• Path traversal guard — Static file handler validates resolved path stays inside serve root
• Goroutine cleanup — Server lifecycle context propagated to all goroutines; clean shutdown on SIGTERM
• Unbounded read protection — Gateway client capped at 1MB response (Go + Python)

🔧 P1 Parity Fixes

• Python → ThreadingDashboardServer — Python server upgraded from single-threaded to ThreadingHTTPServer; long refresh no longer blocks all clients
• CORS on error paths — CORS headers now included on 4xx/5xx responses in both servers (previously only on 2xx)
• Timeout-bounded gateway client — Python gateway requests now use explicit connect + read timeouts

⚡ Performance & Medium Fixes

• Unified cache layer — loadData() fills raw bytes + parsed map atomically under one lock; eliminates double-stat/double-read on concurrent requests (Go)
• Mtime-based Python cache — Python /api/chat now re-reads data.json only when mtime changes (was per-request)
• Pre-rendered index — Go server pre-renders index.html embed at startup; zero per-request disk reads
• Static file allowlist — Python server now restricts static file serving to an explicit allowlist (index.html, themes.json, data.json) — previously served any repo file including .git/
• Linux CPU sample — Dual-sample interval reduced from 200ms → 50ms for faster /api/system response

🧪 Tests

• 87 Go tests pass (go test -race ./...)
• 165 Python tests pass (pytest tests/)
• New test files: system_test.go, tests/test_server.py, tests/test_system_metrics.py
• 21 new Go tests covering: cache coherence, HEAD suppression, rate limiting, favicon allowlist, CORS, error parity
• CI reorganized: critical integration tests moved to final phase

📋 Deferred Items

See docs/audit-followups.md for 4 items deferred to future releases:

• Extract embedded Python from refresh.sh → refresh_data.py (MAINT-1)
• Python stale-while-revalidate for /api/refresh (match Go behavior)
• Browser E2E tests (Playwright)
• Go/Python parity test suite

📦 Binaries

Platform	File
macOS Apple Silicon	openclaw-dashboard-darwin-arm64
macOS Intel	openclaw-dashboard-darwin-amd64
Linux x86_64	openclaw-dashboard-linux-amd64
Linux ARM64	openclaw-dashboard-linux-arm64

Verify integrity:

shasum -a 256 -c checksums-sha256.txt

Full changelog: v2026.3.6...v2026.3.7

v2026.3.6 — Collapsible Sections & Security Audit

What's New

🎯 Collapsible Sections

• 9 collapsible sections with chevron toggles (right-aligned)
• localStorage persistence — remembers your layout
• FOUC prevention (no flash of uncollapsed content on load)
• Expand All / Collapse All buttons
• Full a11y: aria-expanded, aria-controls, keyboard navigation

📊 System Metrics Bar

• OpenClaw version pill with freshness coloring:
  • 🟢 Green = up to date
  • 🟡 Yellow = 1 release behind
  • 🔴 Red = 2+ releases behind
• CPU, RAM, Swap, Disk pills in header
• Latest version checked from npm registry (best-effort)
• GW pill removed — gateway status in System Health panel

🔒 Security Hardening (Multi-Model Audit)

30+ fixes from parallel Opus + Sonnet + Codex audits:

• Python static file allowlist (was exposing repo files)
• CORS preflight handlers (Go + Python)
• HEAD body suppression on all endpoints
• UTF-8 rune-safe truncation in Go chat handler
• XSS defense: theme buttons use data attributes + event delegation
• CSS --glass variable properly defined and themed

🏗️ Layout

• Models, Skills, Git Log panels moved inside Agent Configuration section
• All panels properly collapse with Collapse All

✅ Tests

• 87 Go tests pass
• 149 Python tests pass
• 6 rounds of multi-model verification (Opus + Sonnet + Codex)

v2026.3.5 — Docs polish + correct release assets

Changes

Fixed

• README panel numbering — clean 1–12, no duplicates
• README test counts — 123 Python tests, 57 Go tests (race detector)
• README config example — includes full system block with per-metric thresholds
• README Architecture table — added /api/system row for both backends
• All 4 platform binaries now built from source and attached (darwin-arm64, darwin-amd64, linux-amd64, linux-arm64)

Install

# macOS (Apple Silicon)
curl -L https://github.com/mudrii/openclaw-dashboard/releases/latest/download/openclaw-dashboard-darwin-arm64.tar.gz | tar xz
chmod +x openclaw-dashboard-darwin-arm64 && ./openclaw-dashboard-darwin-arm64 --port 8080

# macOS (Intel)
curl -L https://github.com/mudrii/openclaw-dashboard/releases/latest/download/openclaw-dashboard-darwin-amd64.tar.gz | tar xz
chmod +x openclaw-dashboard-darwin-amd64 && ./openclaw-dashboard-darwin-amd64 --port 8080

# Linux (x86_64)
curl -L https://github.com/mudrii/openclaw-dashboard/releases/latest/download/openclaw-dashboard-linux-amd64.tar.gz | tar xz
chmod +x openclaw-dashboard-linux-amd64 && ./openclaw-dashboard-linux-amd64 --port 8080

# Linux (ARM64)
curl -L https://github.com/mudrii/openclaw-dashboard/releases/latest/download/openclaw-dashboard-linux-arm64.tar.gz | tar xz
chmod +x openclaw-dashboard-linux-arm64 && ./openclaw-dashboard-linux-arm64 --port 8080

Verify integrity:

curl -L https://github.com/mudrii/openclaw-dashboard/releases/latest/download/checksums-sha256.txt -o checksums-sha256.txt
shasum -a 256 -c checksums-sha256.txt

Full changelog: CHANGELOG.md