Skip to content

🦞 OpenClaw Ecosystem Digest 2026-03-25 #284

@github-actions

Description

@github-actions

OpenClaw Ecosystem Digest 2026-03-25

Issues: 500 | PRs: 500 | Projects covered: 13 | Generated: 2026-03-25 00:09 UTC


OpenClaw Deep Dive

OpenClaw Project Digest — 2026-03-25

1. Today's Overview

OpenClaw shows exceptionally high community activity with 500 issues and 500 PRs updated in the last 24 hours, indicating a mature, actively maintained project under significant user demand. The project is in a stabilization phase following the problematic 2026.3.22 release, with multiple regression fixes in flight and no new version published today. Platform expansion is accelerating with major PRs for Linux GTK4 companion app, Wear OS, and QQ channel support. The maintainer team appears responsive with 71 issues and 97 PRs closed, though the 429 open issues suggest backlog pressure. Critical stability concerns persist around OAuth token handling, plugin API compatibility, and memory indexing regressions.


2. Releases

No new releases (2026-03-25).

The project remains on 2026.3.23-2 (released 2026-03-24 per issue timestamps). The 2026.3.22 release introduced significant regressions (Control UI assets missing, WhatsApp plugin crashes, QMD memory index failures) that are driving today's urgent fix activity.


3. Project Progress

Merged/Closed PRs Today

PR Description Impact
#108 UI: Update connections UIs for Discord, Signal, iMessage Closed — Connection node parity across platforms
#54097 Fix: require operator.admin for mutating /allowlist commands Closed — Security hardening for internal channel commands
#43788 Fix: prevent silent Feishu group message drops on bot-info timeout Closed — Reliability for enterprise messaging
#53715 Fix: mark card field as optional in message tool schema Closed — Unblocks Feishu/media-only sends
#53992 Feat: add missing OpenAI-compatible endpoints (/v1/models, /v1/embeddings) Closed — Major compatibility win for Open WebUI, LobeChat, LibreChat
#44969 Fix: normalize baseUrl for custom Google Generative AI providers Closed — Enables provider isolation for Google AI
#44083 Gateway: parse Compose-style gateway port env values Closed — Fixes Docker/env port parsing bugs

Significant Open PRs Advancing

PR Description Stage
#53905 Linux: Introduce native GTK4 companion app (v1) Implements #75 — Major platform gap closure
#47604 Android: add Wear OS app MVP XL feature — Wearable expansion
#52986 Feature: add QQ channel XL feature — China market expansion
#54088 Feat: add /tools runtime availability view XL — Critical UX improvement for tool transparency
#53520 Feat: migrate export/import for cross-device migration XL — Data portability, user retention
#53948 Local models: standardize tool calling with ReAct fallback L — Addresses "infinite recursion" with small models

4. Community Hot Topics

Most Active Issues (by engagement)

Issue Comments 👍 Topic Underlying Need
#75 Linux/Windows Clawdbot Apps 48 65 Platform parity Users demand desktop apps matching macOS feature set; Linux PR #53905 in progress, Windows still unaddressed
#49836 Phishing scam — fake airdrop 33 18 Security/brand protection Project popularity attracting scammers; need proactive monitoring
#52885 WeChat plugin incompatible with 2026.3.22+ 31 0 Plugin API stability Third-party plugins breaking on SDK changes; ESM/CJS migration pain
#52823 Control UI assets not found (regression) 31 12 Release quality Build process gaps; fix PR #53373 adds release checks
#52808 dist/control-ui/ missing from npm package 30 61 Critical regression Packaging pipeline failure; highest user impact

Analysis

The top issues reveal tension between rapid iteration and stability: users want new platforms (Linux/Windows) but core functionality broke in 2026.3.22. The WeChat plugin incompatibility (#52885) signals ecosystem fragility — third-party developers struggle to track internal API changes. The phishing issue (#49836) suggests the project has reached visibility threshold requiring security operations investment.


5. Bugs & Stability

Critical (Data Loss / Security / Complete Failure)

Issue Description Fix Status
#53955 QMD Memory Index Bug: 0/10 files indexed after 2026.3.23-2memory_search returns empty REGRESSION — No fix PR identified
#53317 Gateway overwrites fresh OAuth token with stale cache on startup (openai-codex) REGRESSION — No fix PR identified
#53247 WhatsApp plugin crashes agent — missing light-runtime-api REGRESSION — Plugin files incomplete in package
#52037 OpenAI Codex OAuth token refresh not persisting to disk Open — Token lifecycle reliability

High (Feature Broken / Workaround Required)

Issue Description Fix Status
#53644 Discord WebSocket 1006 crashes gateway instead of reconnecting Open — Crash resilience
#52875 session_send gives "no session found" — agent-to-agent communication broken REGRESSION 2026.3.22
#52081 Feishu plugin fails: buildChannelConfigSchema is not a function REGRESSION — Runtime API change
#54039 read tool prepends workspace root to absolute Windows paths Open — Path handling bug

Medium (Degraded Experience)

Issue Description
#53363 Mistral AI still fails with 422 (supposedly fixed)
#51629 Gemini 2.5 Flash model_not_found in embedded runtime
#50999 Telegram polling stall/restart loop on macOS
#52116 Telegram polling client permanently stuck after network failure

Stability Assessment

Concerning pattern: Three "REGRESSION" labels in 2026.3.22/2026.3.23 releases affecting core features (Control UI, WhatsApp, Feishu, memory search, agent communication). The OAuth token handling has multiple related issues (#53317, #52037, #26322) suggesting systemic auth state management problems.


6. Feature Requests & Roadmap Signals

Likely Next Version (2026.3.24+)

Feature Signal Strength Evidence
Linux GTK4 companion app ⭐⭐⭐ HIGH PR #53905 open, implements #75 (48 comments, 65👍)
Runtime tools visibility (/tools) ⭐⭐⭐ HIGH PR #54088 XL priority — addresses user confusion
Cross-device migration ⭐⭐⭐ HIGH PR #53520 XL — user retention critical
Wear OS support ⭐⭐ MEDIUM PR #47604 active, builds on prior Android work
QQ channel ⭐⭐ MEDIUM PR #52986 XL — market expansion
Local model ReAct fallback ⭐⭐ MEDIUM PR #53948 — addresses small model reliability

User-Requested (Not Yet PR'd)

Issue Request Predicted Priority
#75 Windows desktop app High — Linux in progress, Windows logical next
#21097 thinkingDefault per-agent config Medium — cost optimization use case
#50096 Long-term memory & knowledge management High — "agent value proportional to memory"
#41553 Layer-specific diagnostics for WSL2 + Windows CDP Medium — developer experience

7. User Feedback Summary

Pain Points

Theme Evidence Severity
Release quality regressions Multiple "worked before, now fails" labels; 2026.3.22 broke Control UI, WhatsApp, memory 🔴 Critical
OAuth/auth reliability Token refresh races, persistence failures, cache corruption 🔴 Critical
Plugin API instability WeChat, Feishu, WhatsApp plugins breaking on SDK changes 🟡 High
Platform gaps No Linux/Windows desktop apps (macOS only) 🟡 High
Memory/knowledge limitations "Agent starts every conversation from zero" — #50096 🟡 High
Windows path handling Multiple path-related bugs (#54039) 🟢 Medium

Positive Signals

  • Responsive maintainers: 97 PRs merged/closed in 24h
  • Platform expansion momentum: Linux, Wear OS, QQ all in active development
  • OpenAI compatibility investment: #53992 adds endpoints for major third-party UIs
  • Security awareness: Phishing scam (#49836) rapidly flagged and closed

Use Cases Emerging

  • Enterprise messaging: Feishu/Lark, WeChat, QQ — China/Asia market focus
  • Multi-agent orchestration: PRs #54090, #54089 for agent.abort, runId in hooks
  • Local/self-hosted AI: ReAct fallback for small models (#53948), memory indexing (#53955)

8. Backlog Watch

Stale Important Issues (Updated but long-running)

Issue Age Problem Risk
#25215 ~1 month SSRF check blocks Clash/mihomo fake-ip range VPN/proxy users affected; networking compatibility
#10386 ~1.5 months Workspace/extraDirs skills not discovered Custom skill development blocked
#27473 ~1 month Gateway fails to start: non-loopback Control UI requires allowedOrigins Docker/Podman deployment friction
#23829 ~1 month Fallback chain doesn't traverse across providers Reliability/cost optimization gap

Needs Maintainer Decision

Issue/PR Status Action Needed
#50096 10 comments Memory architecture roadmap — user retention critical
#26322 8 comments, 9👍 OAuth token refresh race — systemic fix needed
#45153 8 comments SSRF policy configuration ignored — security/compliance

Recommendation

The project should consider a stability sprint before 2026.4.x feature development. The concentration of OAuth, memory indexing, and plugin API regressions suggests architectural debt in state management and release testing. PR #53373 (release check for Control UI assets) is a good start but needs expansion to plugin validation and token lifecycle testing.


Cross-Ecosystem Comparison

Cross-Project Comparison Report: Personal AI Agent Ecosystem

Community Digest Analysis — 2026-03-25


1. Ecosystem Overview

The personal AI assistant open-source ecosystem is experiencing intense parallel development across 11+ active projects, with aggregate daily activity exceeding 800 PR/issue updates. The landscape shows clear bifurcation: mature platforms (OpenClaw, LobsterAI, Moltis) are stabilizing enterprise features while emerging projects (TinyClaw, EasyClaw, ZeptoClaw) rapidly iterate on core orchestration. A critical supply chain security incident (NanoBot's litellm compromise) has triggered industry-wide dependency audits. Voice/multimodal integration, memory architecture, and enterprise channel support (WeChat, DingTalk, WeCom) are universal priorities, with most projects racing toward production readiness ahead of anticipated H2 2026 commercial deployments.


2. Activity Comparison

Project Issues (24h) PRs (24h) Releases Health Score Status
OpenClaw 500 500 None (stabilizing) ⭐⭐⭐⭐☆ High volume, regression recovery
NanoBot 21 51 None ⭐⭐⭐☆☆ Security crisis response
Zeroclaw 50 50 v0.6.0→v0.6.2 ⭐⭐⭐⭐☆ Rapid patch cycle, branch chaos
PicoClaw 17 68 v0.2.3-nightly ⭐⭐⭐⭐☆ Feature expansion, config debt
NanoClaw 13 50 None ⭐⭐⭐☆☆ High velocity, low community voice
NullClaw 0 6 None ⭐⭐⭐☆☆ Maintainer-driven, zero backlog
IronClaw 14 49 None ⭐⭐⭐⭐☆ Enterprise pivot, pre-release push
LobsterAI 23 50 None (post-v2026.3.24) ⭐⭐⭐⭐⭐ Performance focus, MCP maturation
TinyClaw 0 8 v0.0.17→v0.0.19 ⭐⭐⭐⭐☆ Solo sprint, zero community
Moltis 4 17 None ⭐⭐⭐⭐⭐ Surgical precision, infrastructure
CoPaw 50 50 v0.2.0 ⭐⭐⭐☆☆ Release stress, regression cluster
ZeptoClaw 2 29 v0.8.1→v0.8.2 ⭐⭐⭐⭐☆ Telegram hardening, protocol work
EasyClaw 0 3 None ⭐⭐☆☆☆ UI polish, insular development

3. OpenClaw's Position

Advantages vs. Peers

Dimension OpenClaw Position Peer Gap
Platform coverage macOS (mature), Linux GTK4 (PR #53905), Wear OS, QQ Most peers: 2-3 channels; OpenClaw: 8+
OpenAI compatibility /v1/models, /v1/embeddings endpoints (#53992) LobsterAI building; others fragmented
Community scale 500 issues/PRs daily = 10x median project ZeptoClaw: 29 PRs; Moltis: 17
Enterprise messaging Feishu, WeChat plugin ecosystem, Signal, iMessage IronClaw: NEAR-coupled; NanoClaw: messenger-only

Technical Approach Differences

  • OpenClaw: Plugin-centric architecture with formalized SDK; third-party WeChat/Feishu plugins create ecosystem network effects
  • IronClaw: WASM extension model with NEAR blockchain integration; heavier runtime, different trust model
  • Moltis: Rust-native, memory-system-first; tiered recall architecture vs. OpenClaw's QMD indexing
  • NanoBot: Direct SDK migration post-litellm; simpler stack, fewer abstractions

Community Size Comparison

OpenClaw operates at ecosystem scale (500 daily items) comparable to combined activity of NanoBot + Zeroclaw + PicoClaw + CoPaw. This creates feedback velocity advantages (71 issues closed in 24h) but also backlog pressure (429 open issues). Only LobsterAI matches per-contributor efficiency (50 PRs with 23 issues).


4. Shared Technical Focus Areas

Requirement Projects Specific Evidence
Memory architecture overhaul OpenClaw, Moltis, NullClaw, NanoClaw, PicoClaw OpenClaw #53955 QMD regression; Moltis #483 tiered recall; NullClaw #711/#712 cross-sync + knowledge graph; PicoClaw #1919 "Seahorse" biological memory
Voice/ASR-TTS integration PicoClaw, LobsterAI, Moltis PicoClaw #1648 (22 comments); LobsterAI #722 voice input request; Moltis Matrix voice STT (#482)
Enterprise channel hardening OpenClaw, PicoClaw, CoPaw, IronClaw, ZeptoClaw WeCom WebSocket (PicoClaw #1408), WeChat QR login (CoPaw #2123), DingTalk robustness (LobsterAI #751/#691), Telegram multimodal (ZeptoClaw #420)
MCP ecosystem integration LobsterAI, Moltis, NanoClaw LobsterAI #728/#724 MCP onboarding pain; Moltis #479 Docker+Node.js for MCP; NanoClaw native SDK pivot
Cost/token optimization NanoBot, OpenClaw, CoPaw NanoBot #2375 560k token/heartbeat; OpenClaw local model ReAct fallback (#53948); CoPaw #2215 compaction skip-summary
Multi-agent orchestration CoPaw, Zeroclaw, IronClaw, NanoClaw CoPaw v0.2.0 inter-agent; Zeroclaw #4166 A2A protocol; IronClaw #1557 engine v2; NanoClaw #1273 multi-session web

5. Differentiation Analysis

Project Core Differentiator Target User Architecture Signature
OpenClaw Universal channel reach + plugin ecosystem Power users, cross-platform deployers TypeScript/Node.js, plugin SDK, multi-runtime
IronClaw NEAR AI integration + WASM extensions Blockchain-adjacent developers, decentralized apps Rust + WASM, libsql/PostgreSQL, crypto-native auth
Moltis Performance-optimized local LLM inference Self-hosters, latency-sensitive deployments Rust-native, KV cache optimization, SQLite knowledge graph
LobsterAI Polished desktop UX + enterprise observability Knowledge workers, team collaboration Electron + React, Opik/LangFuse tracing, Youdao ecosystem
NanoBot Minimal abstraction, rapid security response Security-conscious operators, cost-optimizers Direct SDK calls, stateless architecture, Honcho memory
Zeroclaw Agent self-improvement + memory isolation Experimenters, multi-agent researchers SkillImprover pipeline, MuninnDB backend, per-agent memory
CoPaw Inter-agent communication foundation Enterprise teams, workflow automation Built-in QA agent, local judge routing, skill marketplace
TinyClaw Extreme minimalism + rapid iteration Embedded/edge deployers, solo operators Single-maintainer velocity, zero backlog, grammY Telegram
PicoClaw Biological memory inspiration Research-oriented builders, long-horizon agents Seahorse hippocampus-inspired architecture

6. Community Momentum & Maturity

Tier 1: Rapid Iteration (Pre-1.0 Velocity)

Project Signal Risk
TinyClaw 3 releases/24h, 8 PRs solo Zero community validation
Zeroclaw v0.6.0→v0.6.2 same day Branch management failures (#4093, #4537)
CoPaw v0.2.0 major release CPU spin regression (#2218), Docker data loss

Tier 2: Stabilization with Feature Expansion

Project Signal Focus
OpenClaw No release, 500 items, regression fixes Platform parity (Linux, Wear OS), OAuth hardening
LobsterAI Post-release polish, performance PRs Virtual scroll, MCP reliability, Copilot integration
ZeptoClaw Patch releases, Telegram hardening Multimodal support, ACP protocol standardization
PicoClaw Nightly builds, WeCom consolidation Voice integration, config durability

Tier 3: Architectural/Foundation Work

Project Signal Trajectory
Moltis 17 PRs, 4 issues, 100% merge rate Infrastructure maturity; awaiting macOS signing (#422)
NullClaw 6 open PRs, 0 issues, no releases Memory system unification; pre-community
IronClaw Enterprise P1/P2 issues filed by maintainer NEAR→enterprise pivot; SSO/RBAC buildout

Tier 4: Insular/Pre-Launch

Project Signal Concern
EasyClaw 3 UI PRs, zero issues/comments No external feedback loops; test coverage unknown
NanoClaw 50 PRs, zero reactions/comments Self-merging pattern; messenger-centric limits adoption

7. Trend Signals

For AI Agent Developers

Trend Evidence Actionable Insight
Supply chain security as first-class concern NanoBot litellm incident → #2448 native SDK migration; Moltis #419 configurable MCP timeouts Audit abstraction layers; prefer direct SDKs; implement dependency pinning + SBOM
Local-first AI acceleration Moltis #476 KV cache optimization (2-3x speedup); OpenClaw #53948 local model ReAct; IronClaw #1611 Ollama instability priority Design for offline operation; expect provider-agnostic tooling demand
Memory as competitive moat "Agent value proportional to memory" — OpenClaw #50096; tiered recall (Moltis #483); biological memory (PicoClaw #1919); cross-instance sync (NullClaw #711) Invest in memory architecture early; vector → graph → sync is emerging stack
Enterprise messaging as distribution channel WeChat ClawBot urgency (CoPaw #2043: 9👍); DingTalk/WeCom/QQ across all China-facing projects Prioritize official IM SDKs over webhooks; expect QR-login patterns
Cost predictability as UX requirement NanoBot #2375 "$10+ per heartbeat" shock; CoPaw #2215 compaction cost control Implement token budgets, visibility tools; stateless background operations
MCP as table stakes, configuration as friction LobsterAI #728/#724 MCP "0 tools" confusion; Moltis #479 Docker+Node.js for MCP Simplify MCP onboarding; consider hosted MCP marketplaces
Agent-to-agent protocols emerging CoPaw v0.2.0 inter-agent; Zeroclaw #4166 A2A; ZeptoClaw #356 ACP; NanoClaw #1273 multi-session Design for composability; expect ACP/MCP convergence

Report compiled from 11 project digests covering 1,000+ GitHub items, 24-hour window ending 2026-03-25.


Peer Project Reports

NanoBotHKUDS/nanobot

NanoBot Project Digest — 2026-03-25

1. Today's Overview

NanoBot shows extremely high community activity with 51 PRs and 21 issues updated in 24 hours, indicating a rapidly evolving codebase under active development. However, no new releases were published today, leaving users exposed to critical security vulnerabilities in the wild. The project is experiencing a supply chain security crisis following the discovery of malicious code in the litellm dependency, with the community scrambling to respond. Multiple architectural fixes are in flight for memory/heartbeat token bloat issues that cause catastrophic cost spikes. Overall project health is stressed but responsive — high velocity with urgent security and stability challenges requiring immediate maintainer attention.


2. Releases

None today.


3. Project Progress

Merged/Closed PRs (11 total)

PR Description Impact
#2448 refactor: replace litellm with native openai + anthropic SDKs — Complete removal of litellm dependency, replaced with direct SDK calls Critical security response — eliminates compromised dependency entirely
#2441 security: prevent litellm 1.82.7+ — Version pinning to block poisoned releases Short-term mitigation, superseded by #2448
#2428 Fix/Feat(WeiXin): Adapt to WeChat plugin 1.0.3routeTag/SKRouteTag header support, QR code auto-refresh, persistent context_token Enterprise WeChat integration stability
#2423 fix: cherry-pick shell zombie process reaping from upstream — Prevents zombie process accumulation on long-running agents Infrastructure reliability
#2426 (Issue closed) SkillHub installation crash resolved User support

Key Advances

  • Security architecture overhaul: Native SDK migration (#2448) represents a major architectural pivot away from abstraction-layer dependencies
  • Enterprise channel hardening: WeChat plugin modernization for production deployments
  • Process management: Zombie reaping fix addresses operational issues in daemonized deployments

4. Community Hot Topics

Most Active by Engagement

Rank Item Comments/Reactions Analysis
1 #2375 Heartbeat session history causes 560k token usage per heartbeat 9 comments, 👍1 Cost catastrophe — users face $10+ per automated check; architectural flaw in session persistence
2 #2443 LiteLLM quarantined — credential stealer discovered 5 comments Supply chain attack — PyPI security incident affecting entire dependency tree
3 #2439 Critical: Malicious litellm_init.pth data-exfiltration code in nanobot-ai v0.1.4.post5 4 comments, 👍3 Active malware in distributed package — immediate user action required
4 #2329 Custom model provider works in CLI but fails in Feishu channel 5 comments Configuration propagation inconsistency across channels
5 #2442 Cannot perform continuous/autonomous actions 3 comments Core agent autonomy limitations — user expectation vs. architecture gap

Underlying Needs

  • Cost control: Users need predictable, bounded token usage for background operations
  • Security transparency: Dependency auditing and reproducible builds
  • Cross-channel parity: Configuration behavior must be identical across all interfaces
  • Agent autonomy: Users expect "set and forget" continuous operation, not turn-based interaction

5. Bugs & Stability

Severity Issue Description Fix Status
🔴 Critical #2439 Malicious code in distributed PyPI package (nanobot-ai v0.1.4.post5) Mitigated by #2448 (remove litellm), #2441 (version block)
🔴 Critical #2443 LiteLLM supply chain compromise — credential stealing Same root cause, same fixes
🟡 High #2375 Unbounded token consumption (560k/heartbeat) due to session history accumulation PR #2430 in review — makes heartbeat stateless
🟡 High #2369 Cron reminders silently dropped by evaluator PR #2449 open — fixes notification logic
🟡 High #2437 Tool output truncation inconsistency — 16k disk vs. full context in LLM request No fix yet — architectural mismatch
🟡 High #2450 minimax-m2.7 via Ollama Cloud fails on 2nd+ request No fix yet — provider-specific
🟡 High #2432 'NoneType' object is not subscriptable — null handling in agent loop No fix yet — user-provided patch unverified
🟠 Medium #2298 Infinite tool calling loops with smaller/local models No fix yet — needs loop detection
🟠 Medium #2440 openai_codex prompt cache key changes every turn — no actual caching No fix yet — provider implementation bug
🟠 Medium #2373 MiniMax API error on invalid function arguments JSON No fix yet — provider/tool interface issue

6. Feature Requests & Roadmap Signals

Request Issue/PR Likelihood in Next Release Rationale
Stateless heartbeat / token optimization #2430, #2435 Very High Critical cost issue, multiple PRs in flight, user pain extreme
Native SDK provider architecture #2448 Merged Already landed — will be in next release
Long-term memory (Honcho integration) #2183 High Roadmap item #39, substantial PR open, opt-in design reduces risk
Event-driven hook system + skill disable #1934 Medium Large architectural change, needs review bandwidth
Gateway Web UI #1650 Medium Demo video provided, fixes #510, UI completeness unclear
OpenAI-compatible endpoint channel #1861 Medium Enables external integrations, significant new surface area
Sandboxed exec (bubblewrap) #1940 Medium Security improvement, ~50 lines, needs testing
MCP ImageContent support #2438 Medium Specific capability gap, well-scoped
VOIP memory context #2444 Low New PR, unclear scope
Matrix streaming support #2447 Low New PR, niche channel

Predicted v0.1.5 contents: LiteLLM removal, stateless heartbeat, Honcho memory (opt-in), security hardening, WeChat fixes.


7. User Feedback Summary

Pain Points

Category Specific Feedback Frequency
Cost shock "560k tokens in ONE go" — heartbeat costs exceeding human conversation budgets Repeated, urgent
Security fear Active malware discovery erodes trust in package distribution Acute, today
Silent failures Cron reminders, tool errors fail without user notification Multiple reports
Channel inconsistency CLI works, Feishu/WeChat/Discord behave differently Recurring pattern
Autonomy gap Cannot delegate continuous background tasks Expectation mismatch
Model-specific fragility Smaller models cause loops; specific providers (MiniMax, Ollama Cloud) fail Integration depth issues

Use Cases Emerging

  • Email monitoring agent: Automated inbox checking with skill installation (blocked by cost/token issues)
  • Log analysis assistant: Reading application logs (blocked by truncation/context mismatch)
  • Voice transcription: Whisper integration working but needs language specification
  • Enterprise messaging: WeChat/Feishu/QQ as primary interfaces (active development)

Satisfaction Signals

  • Transcription skill "not fast but very accurate" — capability appreciation
  • Active PR contributions — engaged developer community
  • Rapid security response — organizational responsiveness

8. Backlog Watch

Item Age Issue Risk
Matrix auth encryption 18 days #1681 E2EE broken — privacy-sensitive users affected
Gemini API key handling 48 days #144 Provider support gap
OAuth subscription alternatives 8 days #2170 Business model flexibility
Vietnamese README 28 days #1164 Localization contribution stalled
OpenAI Codex Docker auth 25 days #1358 Deployment friction

Maintainer Attention Needed

  1. Immediate: Security incident coordination — advisory, release timeline, migration guide
  2. This week: Token/cost architecture review — #2375, #2430, #2435, #2437 are related
  3. Ongoing: Channel parity testing framework — prevent CLI vs. channel divergence

Digest generated from 51 PRs and 21 issues updated 2026-03-24. Data source: github.com/HKUDS/nanobot

Zeroclawzeroclaw-labs/zeroclaw

Zeroclaw Project Digest — 2026-03-25

1. Today's Overview

Zeroclaw shows exceptional velocity with 100 items updated in 24 hours (50 issues, 50 PRs) and 4 rapid-fire releases (v0.6.0 → v0.6.2). The project is in active stabilization mode following the v0.6.x series launch, with maintainers aggressively triaging user-reported regressions. A critical pattern emerges: branch management failures — multiple PRs merged to deleted dev branches never reached master, causing feature loss and user confusion. Community engagement is strong with multilingual participation (Chinese, English), though severity S0/S1 bugs indicate production-readiness gaps.


2. Releases

Version Date Notes
v0.6.2 2026-03-24 Incremental polish; no breaking changes
v0.6.1 2026-03-24 Incremental polish
v0.6.1-beta.637 2026-03-24 Pre-release; no changelog
v0.6.0 2026-03-24 Incremental polish

Assessment: Rapid patch releases suggest hotfix mode. Changelogs are concerningly sparse ("incremental improvements and polish" repeated verbatim) — users cannot assess upgrade risk. No migration notes provided despite v0.5 → v0.6 behavioral changes reported (see #4496).


3. Project Progress

Merged/Closed PRs Today (31 total, selected highlights)

PR Author Summary Impact
#4619 @​theonlyhennygod Skill self-improvement + pipeline toolSkillImprover with cooldown tracking, atomic writes Major agent autonomy feature
#4615 @​theonlyhennygod Safety prompt rewrite — reduces AI conservatism, "Execute tools directly" vs. restrictive language Fixes #4496 "IQ drop" complaints
#4614 @​theonlyhennygod Media marker leak detection fix — exempts [IMAGE:...] etc. from false "high-entropy token" redaction Fixes #4604 image delivery breakage
#4613 @​theonlyhennygod Windows sync_directory implementation Cross-platform parity
#4611 @​theonlyhennygod WhatsApp Web in Docker/releases — adds feature to official builds Eliminates custom build need
#4618 @​theonlyhennygod Onboarding fixes--quick flag, ZEROCLAW_INTERACTIVE env override Fixes #3658 regression
#4620 @​joehoyle Streaming REPL + Ctrl+C cancellation UX improvement for zeroclaw agent
#4424 @​aecs4u Daemon hot-reload on SIGHUP CLOSED unmerged Lost to branch mishap?

Pattern: @​theonlyhennygod is carrying critical stabilization work (6 PRs merged today). @​aecs4u's hot-reload and compaction engine PRs (#4424, #4423) were closed without merge — potential feature loss.


4. Community Hot Topics

Issue/PR Comments 🔍 Underlying Need
#2487 — Invalid schema for channel_ack_config 7 Runtime stability — function schema validation failing with OpenAI
#1518 — Inter-process communication for agents 7 Multi-agent orchestration — users want distributed agent systems on single host
#1924 — FreeBSD platform support 6 Enterprise/server deployment — TrueNAS, jails, BSD infrastructure
#3454 — Web Dashboard 404 5 First-run experience — dashboard assets missing in fresh installs
#4093 — Streaming work stranded on deleted dev branch 4 Process failure — critical feature loss due to branch management

Analysis: Users are pushing Zeroclaw into production environments (FreeBSD servers, multi-agent setups, IDE integrations via ACP #2456). The "stranded code" issue (#4093) reveals infrastructure debt threatening feature reliability.


5. Bugs & Stability

Severity Issue Status Fix PR
S0 — Data loss/security #3664 — (unspecified, image-only report) OPEN None
S0 — Data loss/security #4532.secret_key wrong owner CLOSED #4613 area
S0 — Data loss/security #4445 — Docker/Podman file I/O denied CLOSED
S0 — Data loss/security #4576 — WhatsApp Web Docker hardcoded CLOSED #4611
S1 — Workflow blocked #4496 — "IQ drop" in v0.5+, over-conservative AI CLOSED #4615
S1 — Workflow blocked #4485 — Security policy ignored CLOSED #4615 related
S1 — Workflow blocked #4604 — Image delivery broken by leak detector CLOSED #4614
S1 — Workflow blocked #4567 — Azure AI streaming error CLOSED
S1 — Workflow blocked #4523 — Web chat "unknown does not support streaming" CLOSED
S1 — Workflow blocked #4550 — QQ channel websocket loop CLOSED
S1 — Workflow blocked #4623 — ARMv6 binary segfault OPEN #4569 insufficient
S1 — Workflow blocked #4537 — WhatsApp cron delivery broken (PR to wrong branch) OPEN Needs re-merge

Critical Concern: Two S1 bugs remain open with infrastructure-level failures — ARMv6 support broken despite CI fix, and WhatsApp cron delivery stranded by branch mishap (echo of #4093 pattern).


6. Feature Requests & Roadmap Signals

Request Issue/PR Likelihood in v0.7
A2A (Agent-to-Agent) protocol #4166 — OPEN High — PR active, multi-agent demand confirmed
ACP Server Mode (Zed/IDE integration) #2456 — CLOSED Medium — closed but not implemented? Needs verification
MuninnDB memory backend #4607 — OPEN High — PR active, external memory demand
Per-agent memory isolation #4626 — OPEN High — PR active today
Discord streaming #4551 — OPEN Medium — UX improvement, community PR
Claude Code full agent mode #3911 — OPEN Medium — stalled? Last update 6 days
FreeBSD binaries #1924 — CLOSED Unclear — closed without merge? User may reopen
Autonomous skill creation/self-improvement #3683 — CLOSED Shipped#4619 merged

7. User Feedback Summary

😤 Pain Points

  • "IQ drop" regression (#4496): v0.5+ default prompts made AI "极度保守" (extremely conservative), refusing basic commands like ls / despite full autonomy settings — fixed in #4615
  • Branch management chaos: Users discovering features were "merged" but never shipped (#4093, #4537)
  • Windows friction: Setup complexity, npm path errors (#4494), missing feishu in prerelease (#3693)
  • Docker gaps: Missing WhatsApp Web support, file I/O permission issues

✅ Satisfaction Drivers

  • Rapid maintainer response: Critical bugs closed same day (#4604, #4485)
  • Memory/skill system maturation: Self-improvement, pipeline tools, MuninnDB integration
  • Multi-platform expansion: FreeBSD request shows enterprise interest

🎯 Use Cases Emerging

  • Raspberry Pi multi-agent clusters (#4166: "8 MB each, different personas")
  • IDE-integrated coding agents (#2456: ACP for Zed)
  • Enterprise messaging (WhatsApp Web, QQ, Discord with streaming)

8. Backlog Watch

Item Age Risk Action Needed
#3664 — S0 bug (image-only, no text) 8 days High — S0 open with no assignee Maintainer triage, request info
#4298 — Partnership inquiry 1 day Low Commercial decision, not technical
#4363 — Push fixups vs. superseding PRs 1 day Medium — contributor experience Process adoption
#4623 — ARMv6 segfault 0 days High — CI fix failed Hardware-specific debugging
#4537 — WhatsApp cron to wrong branch 0 days High — feature regression Re-merge #2116 or equivalent

Infrastructure Debt Alert: The "merged to wrong branch" pattern (#4093, #4537) suggests Git workflow review needed to prevent feature loss.

PicoClawsipeed/picoclaw

PicoClaw Project Digest — 2026-03-25


1. Today's Overview

PicoClaw shows high development velocity with 68 PRs updated in 24 hours (44 merged/closed, 24 open) and 17 active issues. The project is in active feature expansion mode, particularly around voice/ASR-TTS integration, WeCom channel consolidation, and configuration system hardening. A nightly build for v0.2.3 was released, indicating preparation for a stable release. The community is actively engaged with substantial technical discussions on architecture proposals. However, configuration persistence bugs and WebSocket/port detection issues remain pain points affecting user experience.


2. Releases

Version Type Notes
v0.2.3-nightly.20260324.4d7a629b Nightly Automated build; may be unstable. No breaking changes documented.

Migration/Usage: Caution advised for production deployments. Full changelog compares against v0.2.3 stable.


3. Project Progress

Merged/Closed PRs Today (44 total, key highlights)

PR Type Description Impact
#1929 Bug Fix Security credentials now applied before config validation in web handlers Fixes config save failures when tokens stored in .security.yml
#1979 Bug Fix Skip heartbeat when agent has active turn Prevents conversation interruption by autonomous heartbeat
#1967 Feature Web authentication to prevent LLM sandbox bypass Security hardening for HTTP API
#1787 Feature WeCom media upload via WebSocket API Enables rich media in Enterprise WeChat
#1408 Feature WeCom WebSocket (wecom_ws) channel support Stable 2-day tested channel with auto-reconnect
#1955 Refactor Unified channels.wecom replacing legacy split Consolidates wecom/wecom_app/wecom_aibot into single channel
#1977 Bug Fix Prevent virtual models from being persisted Fixes multi-key model expansion pollution
#1902 Bug Fix Persist disabled placeholder settings Resolves #1774
#1975 Build Fix Exclude matrix on unsupported mipsle/netbsd targets CI stability
#1241 Bug Fix WeCom bot XML message parsing Channel reliability

Key Advancement: WeCom ecosystem is being completely rebuilt around WebSocket with unified architecture, replacing fragmented legacy implementations.


4. Community Hot Topics

Rank Item Comments Analysis
1 #1648 TTS/ASR Support 22 Highest community interest. Architecture proposal for voice interaction; PR #1642 exists but needs gateway integration. Underlying need: multimodal AI agents for voice-enabled applications.
2 #1941 Config Wiped 11 Critical user pain. Configuration loss on Telegram channel setup. Suggests state management fragility in config system.
3 #1737 Missing port 18800 docs 7 Documentation gap causing WebSocket connection failures. Underlying need: better launcher mode documentation for Docker/networked deployments.

Emerging Pattern: Users are pushing for production-ready deployment (voice, stable config, documented networking), moving beyond hobbyist use.


5. Bugs & Stability

Severity Issue Status Fix PR Description
🔴 High #1941 Config Wiped Open None Complete configuration loss; affects Telegram users specifically
🔴 High #1058 Cron deliver=false discards LLM response Open None Silent message loss; root cause identified in pkg/tools/cron.go
🟡 Medium #1737 Port 18800 undocumented Open #1957 WebSocket port detection fix in progress
🟡 Medium #1901 No API key for model mode Open None Startup crash with Step model; config validation issue
🟡 Medium #1936 Telegram failing in Termux Open None Mobile/ARM deployment issue
🟡 Medium #1946 Cron not working Open None Time-range scheduling fails; immediate scheduling works
🟢 Low #1973 Missing restart indicator Open #1978 UX inconsistency; unified fix proposed

Stability Assessment: Config system reliability is the primary risk area. Multiple related bugs suggest architectural tension between .security.yml, web UI, and runtime config.


6. Feature Requests & Roadmap Signals

Feature Issue/PR Likelihood v0.2.3+ Rationale
TTS/ASR Voice Integration #1648, #1939 ⭐⭐⭐⭐⭐ PR exists, tested in Discord/Telegram/WeChat; aligns with "PicoClaw Audio" architecture
Biological Memory System (Seahorse) #1919 ⭐⭐⭐⭐☆ Research-stage but high ambition; hippocampus-inspired short/long-term memory
Web Chat Streaming #1950 ⭐⭐⭐⭐☆ Marked roadmap-aligned; common user expectation
Line-based File Reading #1974, #1981 ⭐⭐⭐⭐⭐ PR open; addresses LLM-usability of byte-based pagination
Azure Skills Whitelisting #1963 ⭐⭐⭐⭐☆ Security hardening + provider expansion; enterprise-ready
Web Authentication #1967 ⭐⭐⭐⭐⭐ Merged; security-critical for sandboxed deployments

Prediction: v0.2.3 stable will likely include voice (TTS/ASR), unified WeCom, web auth, and line-based file reading.


7. User Feedback Summary

Pain Points

Issue Frequency User Impact
Configuration loss/corruption Multiple reports Production blocker; destroys trust
WebSocket port detection Docker/Tailscale users Deployment friction
Cron scheduling reliability Automation users Core feature unreliable
Missing restart notifications All web UI users Confusion about config application

Positive Signals

  • WeCom WebSocket stability: "stable communication for two days" (#1408)
  • Voice feature enthusiasm: 22 comments on architecture proposal
  • Security appreciation: Authentication PR addresses sandbox bypass concerns

Use Case Evolution

Users are deploying PicoClaw in enterprise contexts (WeCom, Azure, scheduled automation) rather than just personal Telegram bots. This demands config durability, observability, and documentation.


8. Backlog Watch

Issue/PR Age Risk Action Needed
#1058 Cron message loss 21 days Data loss Maintainer review; fix PR welcome
#1648 TTS/ASR 9 days High interest, integration blocked Decision on #1642 vs #1939 approach
#1919 Seahorse memory 2 days Research scope Architecture feedback from maintainers
#1936 Termux Telegram 2 days Mobile platform gap ARM/Android testing resources

Recommendation: Prioritize #1058 cron fix and #1941 config durability before v0.2.3 stable release.


Digest generated from GitHub activity 2026-03-24. All links: https://github​.com/sipeed/picoclaw

NanoClawqwibitai/nanoclaw

NanoClaw Project Digest — 2026-03-25

1. Today's Overview

NanoClaw shows high development velocity with 50 PRs and 13 issues updated in the last 24 hours, though no new releases were cut. The project is experiencing active feature expansion alongside recurring infrastructure pain points—particularly around skill branch maintenance automation, which generated 8 nearly identical bot-created issues for merge-forward failures. Community interest remains strong with cross-platform compatibility (OpenCode, GitHub Copilot) and alternative deployment modes (web UI, native credential proxy) emerging as key themes. The maintainer team appears responsive with 15 PRs merged/closed, but the backlog of 35 open PRs suggests review bandwidth constraints.


2. Releases

No new releases (v0.0.0 or otherwise).


3. Project Progress

Merged/Closed PRs (15 total, key items):

PR Description Significance
#799 Timezone-aware context for LLM agents Fixes agents reporting wrong day of week on UTC servers
#1397 Fix IPC permission errors when host runs as root Critical stability fix—prevented infinite EACCES loops
#1410 Skill: add log analyzer New operational capability
#1072 /remote-control command for host-level Claude Code Feature completed
#1372 Fix diagnostics prompt never shown to user UX improvement
#1400 Document OneCLI secrets management Security documentation
#1399 Skill: /use-native-credential-proxy Alternative to OneCLI gateway

Key advancement: Root-cause fixes for production reliability (timezone, IPC permissions) landed alongside security-hardening documentation.


4. Community Hot Topics

Item Activity Analysis
#1273 — Multi-session web channel 3 comments, 👍×2 Strong demand for non-messenger UIs. User built working alternative; signals messenger-centric design limits adoption in educational/enterprise contexts
#1163 — OpenCode/JS SDK support 1 comment, 👍×3 Vendor lock-in concern. Enterprises need multi-provider flexibility; author has working parallel implementation to contribute

Underlying needs:

  • Deployment flexibility (web UI, not just Telegram/WhatsApp/Slack/Discord)
  • AI backend portability (beyond Claude Code/Anthropic)
  • Simplified installation (reducing OneCLI dependency)

5. Bugs & Stability

Severity Issue Status Fix PR?
🔴 High #1391, #1390CLAUDE.md never created for new groups Open, 0 comments ❌ No PR yet
🟡 Medium #1412, #1411, #1406, #1405, #1404, #1403, #1396, #1395 — Skill branch merge-forward failures Open, bot-created ❌ Requires manual resolution
🟢 Low #1407 — Telegram emoji reaction MCP tool Open, feature request ❌ No PR yet

Critical gap: The CLAUDE.md creation bug (#1390/#1391) breaks agent identity initialization for new groups—reported twice independently, indicating real user impact. No fix PR exists.

Infrastructure debt: 8 identical merge-forward failure issues suggest the skill branch automation is noisy and potentially ignored by maintainers.


6. Feature Requests & Roadmap Signals

Feature Request Likelihood in Next Version
Multi-provider AI backends #1163 OpenCode, #1351 GitHub Copilot SDK High — PR #1351 already open
Web-based channel/UI #1273 Medium — external implementation exists, needs upstreaming decision
Plugin system #1387 Medium — PR open, architecture review needed
Persistent graph memory #1256 mem0 integration Medium — leverages existing infrastructure
Security policy enforcement #1380 agentsh integration Medium — security-focused, v0.16.6 dependency
Container management CLI #1408 clawps utility High — operational necessity, small scope
CJK name support #1340 High — fix PR ready, Unicode regex

Prediction: Next release likely includes Copilot SDK support (#1351), clawps utility (#1408), and CJK trigger fixes (#1340).


7. User Feedback Summary

Pain Points

Issue Evidence
Messenger-only operation limiting "I personally have no use for an agent system that can only be operated from a messenger" — #1273
Claude Code vendor lock-in "many companies have other AI providers for different reasons" — #1163
OneCLI complexity Native credential proxy skill (#1399) created as escape hatch
Production reliability Timezone bugs, stuck sessions, IPC permission errors — all recently fixed

Satisfaction Drivers

  • Extensibility: Users building and contributing skills (log analyzer, mem0, Tirith security scan)
  • Container isolation: Security-conscious deployments with agentsh integration
  • Active maintenance: Rapid fixes for production blockers

8. Backlog Watch

Item Age Risk Action Needed
#1273 Web channel 6 days High — addresses adoption barrier Maintainer decision on upstreaming external implementation
#1163 OpenCode support 9 days Medium — PR-ready contribution available Review author's parallel implementation approach
#1390/#1391 CLAUDE.md bug 1 day High — breaks new group setup Assign fix or request PR from reporter
Skill branch merge-forward failures (×8) 1 day Medium — noise vs. signal Tune automation threshold or batch notifications

Recommendation: The CLAUDE.md creation bug should be prioritized as it affects first-time user experience. The web channel (#1273) represents the largest strategic opportunity for user base expansion.

NullClawnullclaw/nullclaw

NullClaw Project Digest — 2026-03-25


1. Today's Overview

NullClaw shows moderate development velocity with 6 active pull requests updated in the last 24 hours, though no issues activity or releases. The project appears healthy with sustained engineering focus on memory systems, multi-agent synchronization, cron reliability, and documentation polish. Notably, all 6 PRs remain open, suggesting either active review cycles or a maintainer bottleneck. The absence of bug reports indicates either stability or underreporting. Development is internationalized (Chinese/English bilingual PRs), reflecting a global contributor base.


2. Releases

No new releases — latest release data unavailable.


3. Project Progress

No merged or closed PRs today. All 6 PRs remain in open state, indicating active development but pending integration:

PR Focus Area Status
#689 Cron scheduler stability (race conditions, memory leaks) Awaiting review
#711 Cross-agent memory synchronization Awaiting review
#669 vLLM/Qwen reasoning compatibility Awaiting review
#712 Knowledge Graph memory backend (SQLite) Awaiting review
#707 Pushover environment credential support Awaiting review
#713 Documentation navigation improvements Awaiting review

Technical momentum areas:

  • Memory architecture: Two complementary PRs (#711 cross-instance sync, #712 knowledge graph backend) suggest major memory subsystem expansion
  • Production hardening: #689 addresses critical daemon reliability issues
  • Ecosystem compatibility: #669 extends reasoning support to popular open-source inference stacks

4. Community Hot Topics

No commented or reacted items — all PRs show 0 comments and 0 reactions. This indicates:

  • Either early-stage PRs not yet under community scrutiny
  • Or low community engagement with the review process
  • Possible maintainer-driven development with external contributors awaiting feedback

Most technically significant open PRs by scope:

PR Link Underlying Need
#711 Cross-memory synchronization PR #711 Multi-agent deployment — users need agent state portability across instances for production scaling and failover
#689 Cron reliability fixes PR #689 Production stability — scheduler races and memory leaks blocking reliable background job execution
#712 Knowledge Graph memory PR #712 Structured memory retrieval — moving beyond vector search to relational/semantic entity traversal

5. Bugs & Stability

Severity Item Description Fix Status
High #689 Scheduler/worker race condition, memory leak, mutex lifetime issues Fix proposed, awaiting merge
Medium #669 Reasoning disabled for custom vLLM/Qwen endpoints (regression/compat gap) Fix proposed, awaiting merge

No new bug reports filed today — stability assessment relies entirely on PR-authored fixes.


6. Feature Requests & Roadmap Signals

Signal PR Likelihood in Next Release
Cross-agent memory sync #711 High — foundational for enterprise/multi-instance deployments
Knowledge Graph memory backend #712 High — SQLite-based, low operational overhead
Enhanced reasoning for open models #669 High — addresses #698, community-requested
Environment-based secrets #707 Medium — operational improvement, resolves #698
Documentation restructuring #713 Medium — user experience, not blocking

Predicted vNext themes: Memory system unification (vector + graph + sync), production reliability, open-source LLM ecosystem parity.


7. User Feedback Summary

Explicit feedback channels: Minimal — no issues filed, no PR comments.

Inferred from PR content:

Pain Point Evidence Satisfaction Indicator
Cron job reliability in production #689's comprehensive race/leak fixes 🔴 Dissatisfied — systemic issues being patched
Need for stateful multi-agent deployments #711's "Agent B knows your preferences" use case 🟡 Unmet need — infrastructure gap being filled
Documentation discoverability #713's navigation restructuring 🟡 Friction acknowledged — being addressed
Open-source model compatibility #669's vLLM/Qwen reasoning fix 🟡 Partial support — gaps being closed
Secrets management in containerized environments #707's envir

⚠️ 内容超过 GitHub Issue 上限,完整报告见提交的 Markdown 文件。

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions