fix(items): bump openclaw to 2026.8.1 and correct the gateway probe and bind

[justinmerrell]

Bumps the OpenClaw item to the current stable release and fixes two defects found while re-checking the component against upstream's container contract.

Version

ghcr.io/openclaw/openclaw:2026.7.1 → 2026.8.1 (released 2026-08-31; multi-arch linux/amd64 + linux/arm64; index digest sha256:e7849cb6c1ef1ead39ab4be7d85edb2df89611f486e283284c7cf35ce39a20d4). 2026.9.1-beta.1 exists but betas stay unpinned, per the comment already on ref.

Defects fixed

Readiness was on the wrong probe. Upstream defines the three probes precisely:

Endpoint	Meaning	Intended use
/healthz	HTTP server is live	liveness / restart decisions
/startupz	startup complete, not draining; channel health not consulted	orchestrator traffic admission
/readyz	startup complete plus deep per-channel readiness	operator monitoring

The component gated readiness on /readyz, so once a user connects a messaging channel and its credentials lapse, the platform would pull a perfectly healthy Control UI out of service. Upstream is explicit: "A broken Telegram or other channel account can make /readyz return 503 without taking a healthy Control UI out of service through /startupz." The comment defending the old choice was also wrong — /healthz is a dedicated probe answering {"ok":true,"status":"live"}, not the Control UI shell.

The bind was load-bearing but documented as incidental. The envVars comment claimed OPENCLAW_GATEWAY_BIND was "deliberately left at its default (routable) bind". Both halves are false: gateway.bind defaults to loopback (upstream carries a dedicated Docker note that bridge networking is unreachable without bind: "lan"), and OPENCLAW_GATEWAY_BIND is a Compose-level variable the runtime never reads. The deployment was reachable only because config set writes bind: lan to the persisted volume — a single point of failure sitting behind a comment telling the next maintainer it was redundant.

The exec line now carries --bind lan --port 18789, exactly as upstream's own docker-compose.yml does, so the listener no longer depends solely on persisted state. The comment is corrected.

Hardening

Pins the container-side paths upstream pins on its gateway service (HOME, OPENCLAW_HOME, OPENCLAW_STATE_DIR, OPENCLAW_CONFIG_DIR, OPENCLAW_CONFIG_PATH, OPENCLAW_WORKSPACE_DIR, OPENCLAW_GATEWAY_PORT). These already resolved correctly via the image's node passwd entry, but they resolved implicitly; stating them makes the mountPath values and the paths the runtime actually uses the same thing by construction.

Listing

• Version string.
• Tools installed into the container home rather than OpenClaw's state dir — a Claude Code CLI login, a first-run Playwright Chromium — fall outside the two volumes and are reinstalled after a redeploy. Upstream: "Persisting only /home/node/.openclaw is not enough." Documented rather than restructured; widening the config claim to /home/node would nest auth-secrets inside it and deserves its own change.
• 2026.8.1 turns on grounded dreaming and automatic self-learning by default, both of which make background model calls — an idle deployment can bill against the user's own provider keys.

Verified

• npm run typecheck clean; task test:item -- openclaw 25/25; full corpus 377/377 (also on pre-push).
• Parsed the component and confirmed the folded scalar resolves to one well-formed shell string. Ran it against a stub node with and without a trailing slash on OPENCLAW_PUBLIC_ORIGIN: the %/ strip works, --batch-json receives a single argument that parses as valid JSON with exactly the three intended ops, and --bind lan --port 18789 lands on the gateway exec.
• gateway.controlUi.allowedOrigins re-confirmed as still config-file-only at v2026.8.1 and still required for a non-loopback Control UI, so the config set approach stands.

Not verified — needs a host with Docker

No container runtime in the devcontainer, so these did not run and are worth doing before this ships:

• Live smoke test against 2026.8.1 — in particular that config set still exits 0, which the renewed "re-verified against 2026.8.1" comment currently asserts on research rather than an observed run.
• Negative control proving the bind is load-bearing (unset gateway.bind, drop --bind lan, confirm the port is unreachable).
• Control UI check, which would settle whether the listing's standing "messaging-channel onboarding requires the interactive CLI" caveat still holds. Left unchanged rather than softened on a guess.
• 2026.7.1 → 2026.8.1 in-place upgrade on a shared volume. This release carries two breaking migrations (OpenProse plugin removal, codex/* → openai/* model refs). Upstream states routine image upgrades run startup-safe migrations automatically and should not need a separate doctor --fix; if startup cannot repair safely the gateway exits rather than reporting healthy, and recovery is one run of the same image with doctor --fix against the same mounts.

Note for reviewers

The working tree in this devcontainer is CRLF throughout with no .gitattributes, so git status shows every tracked file modified. Only the two files in this PR were staged, and both were converted back to LF to match HEAD — the diff here is purely semantic. The repo-wide line-ending churn is pre-existing and untouched; it likely wants a separate .gitattributes normalisation pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PB8wsC93YQxG8XKNscdY2D