holetron-lab/fleet-memory
1
0
Fork 0
Code Releases Packages Activity Actions
fleet-memory/skills/hindsight-docs/references/changelog/integrations/openclaw.md
Nicolò Boschi e22ae05f47
refactor(openclaw)!: read config from plugin config instead of process.env (#974) 
* refactor(openclaw)!: read config from plugin config instead of process.env

The plugin loaded credentials and runtime settings from environment
variables (HINDSIGHT_API_LLM_*, HINDSIGHT_EMBED_API_*, HINDSIGHT_BANK_ID)
plus auto-detection of OPENAI_API_KEY / ANTHROPIC_API_KEY / GEMINI_API_KEY
/ GROQ_API_KEY. That tripped OpenClaw's install-scanner env-harvesting
rule and bypassed the framework's first-class SecretRef resolution.
Switch to reading from the plugin config exclusively, with secrets
configured via 'openclaw config set ... --ref-source env|file|exec'.

Combined with the daemon lifecycle extraction in #949, this closes the
remaining install-scanner findings the 0.5.x plugin was hitting. The
plugin source now contains neither process.env nor child_process; the
former moved to plugin config (resolved by OpenClaw before the plugin
loads), and the latter lives in @vectorize-io/hindsight-all under
node_modules where the scanner's directory walker skips it. The plugin
can be installed without --dangerously-force-unsafe-install.

BREAKING CHANGE: drops the llmApiKeyEnv plugin config field along with
the HINDSIGHT_API_LLM_*, HINDSIGHT_EMBED_API_*, and HINDSIGHT_BANK_ID
environment variables. Users must now configure llmProvider and
llmApiKey explicitly via 'openclaw config set'. Migration guide is in
hindsight-docs/docs-integrations/openclaw.md and the integration
changelog.

* chore(openclaw): pin published versions of hindsight-all and hindsight-client

Phase 2 (#949) introduced @vectorize-io/hindsight-all and
@vectorize-io/hindsight-client as plugin dependencies using 'file:'
workspace paths. Those paths resolve inside the monorepo but break when
the published tarball is installed outside it — 'openclaw plugins
install @vectorize-io/hindsight-openclaw' failed with 'Cannot find
module @vectorize-io/hindsight-all' because npm could not resolve the
file: path from the extracted extension directory.

Replace both with semver ranges targeting the published versions:

  @vectorize-io/hindsight-all   ^0.1.0
  @vectorize-io/hindsight-client ^0.5.0

Verified end-to-end: 'openclaw plugins install <local-tarball>' now
succeeds without --dangerously-force-unsafe-install and without the
workspace-symlink hack. npm pulls both dependencies from the registry
into the extracted extension's node_modules, the plugin loads cleanly,
and 'openclaw plugins doctor' reports no issues.
2026-04-10 18:27:28 +02:00

5.6 KiB
Raw Blame History

hide_table_of_contents
true

import PageHero from '@site/src/components/PageHero';

← OpenClaw integration

0.6.0 (Unreleased)

Breaking Changes

  • The plugin no longer reads any configuration from process environment variables. All settings — including the LLM provider, model, API key, base URL, external Hindsight API URL/token, and bank ID — must now be set through OpenClaw's plugin config (e.g. openclaw config set plugins.entries.hindsight-openclaw.config.<field> <value>). API keys and other secrets should be configured as SecretRef values via --ref-source env|file|exec so they're resolved from your secret store at runtime instead of being stored in plaintext on disk.
  • Removed the llmApiKeyEnv plugin config field. Use the new llmApiKey field configured as a SecretRef instead (e.g. openclaw config set plugins.entries.hindsight-openclaw.config.llmApiKey --ref-source env --ref-id OPENAI_API_KEY).
  • Removed automatic LLM provider detection from OPENAI_API_KEY / ANTHROPIC_API_KEY / GEMINI_API_KEY / GROQ_API_KEY. Set llmProvider and llmApiKey explicitly via openclaw config set.
  • Removed support for the HINDSIGHT_API_LLM_PROVIDER, HINDSIGHT_API_LLM_MODEL, HINDSIGHT_API_LLM_API_KEY, HINDSIGHT_API_LLM_BASE_URL, HINDSIGHT_EMBED_API_URL, HINDSIGHT_EMBED_API_TOKEN, and HINDSIGHT_BANK_ID environment variables. The same values now live in plugin config — see the migration guide.

Features

  • Added the llmApiKey plugin config field, marked as a sensitive field so OpenClaw resolves it as a SecretRef from env, file, or exec sources.
  • Added the llmBaseUrl plugin config field for OpenAI-compatible endpoint overrides (OpenRouter, Azure OpenAI, vLLM, etc.).
  • Marked hindsightApiToken as a sensitive field — it can now be configured as a SecretRef the same way as llmApiKey.

0.5.1

Bug Fixes

  • Fixed JSON manifest formatting issues in the OpenClaw plugin to prevent manifest parsing/loading problems. (704e41fa)

0.5.0

Breaking Changes

  • Removed hardcoded default model settings from integrations so model/provider must be configured explicitly. (58e68f3e)

Features

  • Added configurable, structured logging for the OpenClaw integration. (d441ab81)
  • Added an auto-recall toggle and support for excluding specific providers from recall/retention. (3f9eb27c)
  • Added configuration to skip recall/retention for selected providers. (fb7be3ec)
  • Added dynamic per-channel memory banks to isolate memory across channels. (9a776e9f)
  • Added support for using an external Hindsight API backend. (6b346925)
  • Added plugin configuration options to select the LLM provider and model. (8564135b)

Improvements

  • Added control over where recalled memories are injected to better preserve prompt caching. (200bab23)
  • Improved recall/retention controls and scalability, and added Gemini safety settings support. (d425e93c)
  • Memory retention now periodically keeps recent conversation turns (default every 10 turns) to improve continuity. (ad1660b3)
  • Improved OpenClaw and embedding parameters for better integration behavior and configuration. (749478d9)
  • Improved OpenClaw configuration setup and initialization behavior. (27498f99)

Bug Fixes

  • Added a configurable auto-recall timeout to prevent recalls from hanging or taking too long. (cd4d449f)
  • Recalled memories are now injected as system context for more reliable behavior. (b17f338e)
  • Health check requests now include the auth token to avoid unauthorized failures. (40b02645)
  • Improved stability and safety with better shell handling, HTTP mode support, lazy reinitialization, and per-user memory banks. (c4610130)
  • Fixed failures when ingesting very large content (E2BIG). (6bad6673)
  • Prevented memory retention from recursing indefinitely. (4f112101)
  • Prevented user memories from being wiped on every new session. (981cf605)
  • Improved shell argument escaping to prevent command failures with special characters. (63e2964a)
  • Renamed the OpenClaw binary to the correct name to avoid invocation/config mismatches. (b364bc34)