feat(kiloclaw): bump openclaw to version 2026.6.5 (#3932)

* feat(kiloclaw): bump openclaw to version 2026.6.5

* fix(kiloclaw): adapt controller to OpenClaw 2026.6.x behavior changes

  OpenClaw 2026.6.x changed two behaviors the controller relied on:

  - Auth profiles moved to SQLite: doctor imports legacy auth-profiles.json into
    a per-agent SQLite store and leaves a world-readable (0644) plaintext
    *.sqlite-import.*.bak. Remove that backup in the onboard/doctor path so no
    plaintext provider key remains on disk (chmod 0600 fallback).
  - agents delete now recursively removes the workspace. Verify the CLI-reported
    workspace path and report an accurate filesystemDisposition (deleted/retained)
    instead of a hardcoded 'unverified'; the worker schema accepts all three for
    rollout safety.

  Update controller/entrypoint smoke tests to the new SQLite auth store, backup
  removal, and workspace deletion, with unit coverage for both.

* fix(kiloclaw): convert auth-profiles keyRef before doctor's SQLite import

  OpenClaw 2026.6.1+ `doctor --fix` imports auth-profiles.json into per-agent
  SQLite, storing a plaintext `key` verbatim when no `keyRef` is present. The
  controller's keyRef conversion ran after doctor, so on an upgrade whose JSON
  still held a plaintext kilocode key, doctor baked the plaintext into the SQLite
  auth store (the JSON rewrite afterward only touched the now-ignored backup).

  Run the idempotent keyRef migration once more BEFORE doctor in the existing-
  config path so the SQLite import lands a keyRef, never plaintext. The post-doctor
  call stays for self-healing on versions that still read the JSON.

  Add a bootstrap ordering assertion (migration before doctor) and a smoke
  assertion that no plaintext key survives in the SQLite auth store after an
  upgrade boot.

* fix(kiloclaw): build-local-image --openclaw-tag silently built the wrong version

  The Dockerfile pin is `npm install -g pnpm openclaw@<ver>`, but the patch sed
  anchored on `-g openclaw@` (no `pnpm`), so it matched nothing and built the
  unchanged pin while printing 'Patching Dockerfile…'. Anchor on `openclaw@<ver>`
  directly and fail loudly if the pin isn't rewritten.

* fix(kiloclaw): address SQLite auth-migration review findings

* fix(kiloclaw): migrate auth in env-selected agent dirs (OPENCLAW_AGENT_DIR)

* fix(kiloclaw): harden all auth backup suffixes, on doctor failure, with ~-expanded env
  dirs

* refactor(kiloclaw): scope auth migration to the
  standard agent layout

* fix(kiloclaw): fail closed if a pre-doctor keyRef
  rewrite fails

* docs(claw): announce OpenClaw 2026.6.5 Early Access + SQLite credential migration

* fix(kiloclaw) morning briefing plugin registration with OpenClaw

---------

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: St0rmz1 <astorms@replicated.com>

Author: 3 people

apps/web/src/app/(app)/claw/components/changelog-data.ts

@@ -10,6 +10,13 @@ export type ChangelogEntry = {
 
 // Newest entries first. Developers add new entries to the top of this array.
 export const CHANGELOG_ENTRIES: ChangelogEntry[] = [
+  {
+    date: '2026-06-10',
+    description:
+      'OpenClaw 2026.6.5 is available now as an Early Access upgrade. This release includes a new OpenClaw feature that migrates some credentials stored in JSON files into a SQLite database. The migration runs automatically the first time you upgrade — and once your instance has migrated, there is no automatic way to revert to the previous format.',
+    category: 'feature',
+    deployHint: 'upgrade_required',
+  },
   {
     date: '2026-06-03',
     description:

pnpm-lock.yaml

@@ -64,7 +64,7 @@ RUN git config --system url."https://github.com/".insteadOf "ssh://git@github.co
 # under boot load routinely need 27-35s for the first TLS+fetch to complete.
 # Match the KiloCode chunk explicitly because OpenClaw also ships other provider
 # discovery timeout constants. Remove this patch once the timeout is configurable.
-RUN npm install -g pnpm openclaw@2026.5.26 clawhub mcporter@0.7.3 @steipete/summarize@0.12.0 @kilocode/cli@7.2.31 \
+RUN npm install -g pnpm openclaw@2026.6.5 clawhub mcporter@0.7.3 @steipete/summarize@0.12.0 @kilocode/cli@7.2.31 \
     && OC_DIST=/usr/local/lib/node_modules/openclaw/dist \
     && PM_FILES=$(grep -l 'KILOCODE_MODELS_URL' "$OC_DIST"/provider-models-*.js 2>/dev/null || true) \
     && PM_FILE_COUNT=$(printf '%s\n' "$PM_FILES" | grep -c .) \
@@ -98,7 +98,7 @@ RUN COMPOSIO_INSTALL_TAG="%40composio%2Fcli%40${COMPOSIO_CLI_VERSION}" \
 # Bake bundled plugin runtime deps into OpenClaw's external stage dir so first
 # boot is pure startup — no npm install from `openclaw doctor` or gateway plugin
 # load on shared-cpu Fly machines. The stage-root naming mirrors OpenClaw
-# 2026.5.26's resolveExternalBundledRuntimeDepsInstallRoot().
+# 2026.6.5's resolveExternalBundledRuntimeDepsInstallRoot().
 RUN cd /usr/local/lib/node_modules/openclaw \
     && OPENCLAW_PACKAGE_ROOT="$(pwd -P)" \
     && OPENCLAW_PACKAGE_VERSION="$(node -p "require('./package.json').version")" \
@@ -257,8 +257,8 @@ RUN mkdir -p /root/.openclaw \
     && mkdir -p /root/clawd/skills
 
 # Copy helper scripts (used at runtime by the controller/gateway)
-# Build cache bust: 2026-06-01-v69-openclaw-2026.5.26
-RUN echo "14"
+# Build cache bust: 2026-06-10-v70-openclaw-2026.6.5
+RUN echo "15"
 COPY openclaw-pairing-list.js /usr/local/bin/openclaw-pairing-list.js
 COPY openclaw-device-pairing-list.js /usr/local/bin/openclaw-device-pairing-list.js
 

services/kiloclaw/Dockerfile

@@ -1,6 +1,7 @@
 import { describe, expect, it, vi } from 'vitest';
 import {
   migrateKilocodeAuthProfilesToKeyRef,
+  hardenAuthProfileMigrationBackups,
   type AuthProfilesMigrationDeps,
 } from './auth-profiles-migration';
 
@@ -113,7 +114,12 @@ describe('migrateKilocodeAuthProfilesToKeyRef', () => {
 
     const report = migrateKilocodeAuthProfilesToKeyRef(ROOT, fsDeps(fs));
 
-    expect(report).toEqual({ filesScanned: 1, filesModified: 1, profilesMigrated: 1 });
+    expect(report).toEqual({
+      filesScanned: 1,
+      filesModified: 1,
+      profilesMigrated: 1,
+      filesFailed: 0,
+    });
 
     const written = parseStore(fs.files.get(MAIN));
     expect(written.profiles['kilocode:default']).toEqual({
@@ -133,7 +139,12 @@ describe('migrateKilocodeAuthProfilesToKeyRef', () => {
     const before = fs.files.get(MAIN);
     const report = migrateKilocodeAuthProfilesToKeyRef(ROOT, fsDeps(fs));
 
-    expect(report).toEqual({ filesScanned: 1, filesModified: 0, profilesMigrated: 0 });
+    expect(report).toEqual({
+      filesScanned: 1,
+      filesModified: 0,
+      profilesMigrated: 0,
+      filesFailed: 0,
+    });
     expect(fs.files.get(MAIN)).toBe(before);
   });
 
@@ -205,7 +216,12 @@ describe('migrateKilocodeAuthProfilesToKeyRef', () => {
 
     const report = migrateKilocodeAuthProfilesToKeyRef(ROOT, fsDeps(fs));
 
-    expect(report).toEqual({ filesScanned: 2, filesModified: 2, profilesMigrated: 2 });
+    expect(report).toEqual({
+      filesScanned: 2,
+      filesModified: 2,
+      profilesMigrated: 2,
+      filesFailed: 0,
+    });
   });
 
   it('skips malformed JSON with a warning but does not throw', () => {
@@ -217,7 +233,12 @@ describe('migrateKilocodeAuthProfilesToKeyRef', () => {
 
     const report = migrateKilocodeAuthProfilesToKeyRef(ROOT, fsDeps(fs));
 
-    expect(report).toEqual({ filesScanned: 1, filesModified: 0, profilesMigrated: 0 });
+    expect(report).toEqual({
+      filesScanned: 1,
+      filesModified: 0,
+      profilesMigrated: 0,
+      filesFailed: 0,
+    });
     expect(warnSpy).toHaveBeenCalled();
     warnSpy.mockRestore();
   });
@@ -243,7 +264,38 @@ describe('migrateKilocodeAuthProfilesToKeyRef', () => {
 
     const report = migrateKilocodeAuthProfilesToKeyRef(ROOT, fsDeps(fs));
 
-    expect(report).toEqual({ filesScanned: 0, filesModified: 0, profilesMigrated: 0 });
+    expect(report).toEqual({
+      filesScanned: 0,
+      filesModified: 0,
+      profilesMigrated: 0,
+      filesFailed: 0,
+    });
+  });
+
+  it('reports filesFailed (and migrates nothing) when the rewrite throws', () => {
+    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+    const fs = createFs();
+    seedDir(fs, `${ROOT}/agents`);
+    seedDir(fs, `${ROOT}/agents/main`);
+    seedFile(fs, MAIN, JSON.stringify(plaintextStore()));
+    const deps: AuthProfilesMigrationDeps = {
+      ...fsDeps(fs),
+      writeFileSync: () => {
+        throw new Error('ENOSPC');
+      },
+    };
+
+    const report = migrateKilocodeAuthProfilesToKeyRef(ROOT, deps);
+
+    expect(report).toEqual({
+      filesScanned: 1,
+      filesModified: 0,
+      profilesMigrated: 0,
+      filesFailed: 1,
+    });
+    // The plaintext is still on disk because the write failed.
+    expect(fs.files.get(MAIN)).toContain('secret-literal-key');
+    warnSpy.mockRestore();
   });
 
   it('preserves unrelated profile fields when migrating', () => {
@@ -279,4 +331,133 @@ describe('migrateKilocodeAuthProfilesToKeyRef', () => {
       metadata: { createdBy: 'onboard' },
     });
   });
+
+  it('converts the historical api_key alias (not just key) to a keyRef', () => {
+    const fs = createFs();
+    seedDir(fs, `${ROOT}/agents`);
+    seedDir(fs, `${ROOT}/agents/main`);
+    seedFile(
+      fs,
+      MAIN,
+      JSON.stringify({
+        version: 1,
+        profiles: {
+          'kilocode:default': {
+            type: 'api_key',
+            provider: 'kilocode',
+            api_key: 'legacy-alias-key',
+          },
+        },
+      })
+    );
+
+    const report = migrateKilocodeAuthProfilesToKeyRef(ROOT, fsDeps(fs));
+
+    expect(report.profilesMigrated).toBe(1);
+    const profile = parseStore(fs.files.get(MAIN)).profiles['kilocode:default'];
+    expect(profile).toEqual({
+      type: 'api_key',
+      provider: 'kilocode',
+      keyRef: { source: 'env', provider: 'default', id: 'KILOCODE_API_KEY' },
+    });
+    expect(profile).not.toHaveProperty('api_key');
+    expect(profile).not.toHaveProperty('key');
+  });
+});
+
+describe('hardenAuthProfileMigrationBackups', () => {
+  const ROOT = '/root/.openclaw';
+  const AGENT_DIR = `${ROOT}/agents/main/agent`;
+  const BAK = `${AGENT_DIR}/auth-profiles.json.sqlite-import.1781117548412.bak`;
+
+  function seedAgentDir(fs: InMemoryFs): void {
+    seedDir(fs, `${ROOT}/agents`);
+    seedDir(fs, `${ROOT}/agents/main`);
+    seedDir(fs, AGENT_DIR);
+  }
+
+  it('tightens the sqlite-import backup to 0o600 and retains it (recovery copy)', () => {
+    const fs = createFs();
+    seedAgentDir(fs);
+    seedFile(fs, BAK, JSON.stringify(plaintextStore()));
+    const chmodSync = vi.fn();
+
+    const report = hardenAuthProfileMigrationBackups(ROOT, { ...fsDeps(fs), chmodSync });
+
+    expect(report).toEqual({ dirsScanned: 1, backupsHardened: 1, backupsFailed: 0 });
+    expect(chmodSync).toHaveBeenCalledWith(BAK, 0o600);
+    // The backup is retained, not deleted.
+    expect(fs.files.has(BAK)).toBe(true);
+  });
+
+  it('hardens every known migration backup suffix and leaves unrelated files alone', () => {
+    const fs = createFs();
+    seedAgentDir(fs);
+    const backups = [
+      `${AGENT_DIR}/auth-profiles.json.sqlite-import.1.bak`,
+      `${AGENT_DIR}/auth-profiles.json.legacy-flat.2.bak`,
+      `${AGENT_DIR}/auth-profiles.json.api-key-alias.3.bak`,
+      `${AGENT_DIR}/auth-profiles.json.aws-sdk-profile.4.bak`,
+      `${AGENT_DIR}/auth-profiles.json.openai-provider-unification.5.bak`,
+      `${AGENT_DIR}/auth-profiles.json.oauth-ref.6.bak`,
+    ];
+    for (const b of backups) seedFile(fs, b, JSON.stringify(plaintextStore()));
+    // Not migration backups — must be left untouched.
+    for (const keep of [
+      `${AGENT_DIR}/openclaw-agent.sqlite`,
+      `${AGENT_DIR}/models.json`,
+      `${AGENT_DIR}/unrelated.bak`,
+      `${AGENT_DIR}/auth-profiles.json.unknown-migration.7.bak`,
+    ]) {
+      seedFile(fs, keep, 'x');
+    }
+    const chmodSync = vi.fn();
+
+    const report = hardenAuthProfileMigrationBackups(ROOT, { ...fsDeps(fs), chmodSync });
+
+    expect(report.backupsHardened).toBe(backups.length);
+    expect(chmodSync).toHaveBeenCalledTimes(backups.length);
+    for (const b of backups) expect(chmodSync).toHaveBeenCalledWith(b, 0o600);
+  });
+
+  it('counts a failure when chmod throws, without throwing', () => {
+    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+    const fs = createFs();
+    seedAgentDir(fs);
+    seedFile(fs, BAK, JSON.stringify(plaintextStore()));
+    const deps: AuthProfilesMigrationDeps = {
+      ...fsDeps(fs),
+      chmodSync: () => {
+        throw new Error('EPERM');
+      },
+    };
+
+    const report = hardenAuthProfileMigrationBackups(ROOT, deps);
+
+    expect(report).toEqual({ dirsScanned: 1, backupsHardened: 0, backupsFailed: 1 });
+    warnSpy.mockRestore();
+  });
+
+  it('scans multiple agent directories', () => {
+    const fs = createFs();
+    seedDir(fs, `${ROOT}/agents`);
+    for (const agent of ['main', 'coding']) {
+      seedDir(fs, `${ROOT}/agents/${agent}`);
+      seedDir(fs, `${ROOT}/agents/${agent}/agent`);
+      seedFile(fs, `${ROOT}/agents/${agent}/agent/auth-profiles.json.sqlite-import.99.bak`, 'x');
+    }
+    const chmodSync = vi.fn();
+
+    const report = hardenAuthProfileMigrationBackups(ROOT, { ...fsDeps(fs), chmodSync });
+
+    expect(report).toEqual({ dirsScanned: 2, backupsHardened: 2, backupsFailed: 0 });
+  });
+
+  it('is a no-op when no agent dirs exist', () => {
+    const fs = createFs();
+
+    const report = hardenAuthProfileMigrationBackups(ROOT, fsDeps(fs));
+
+    expect(report).toEqual({ dirsScanned: 0, backupsHardened: 0, backupsFailed: 0 });
+  });
 });