embedding generation

[BUG] Distribution `lancedb==0.30.1 can't be installed because it doesn't have a source distribution or wheel for the current platform

Run >crewai install error Resolved 149 packages in 107ms error: Distribution `lancedb==0.30.1 @ registry+https://pypi.org/simple` can't be installed because it doesn't have a source distribution or wheel for the current platform hint: You're on Windows (`win_amd64`), but `lancedb` (v0.30.1) only has wheels for the following platforms: `manylinux_2_17_aarch64`, `manylinux_2_28_aarch64`, `manylinux_2_28_x86_64`, `manylinux2014_aarch64`, `macosx_11_0_arm64`; consider adding "sys_platform == 'win32' and platform_machine == 'AMD64'" to `tool.uv.required-environments` to ensure uv resolves to a version with compatible wheels An error occurred while running the crew: Command '['uv', 'sync']' returned non-zero exit status 2.

openclaw update does not sync embedded openclaw copy in ~/.openclaw/extensions/node_modules/

[Bug] iMessage inbound messages not received - watch stream not working

mlx runner failed: Error: unsupported architecture: Gemma4ForConditionalGeneration

[Bug] memory-lancedb-pro and memory-openviking plugin config rejected by gateway validator

The `memory-lancedb-pro` and `memory-openviking` plugins' `config` fields are rejected by OpenClaw's gateway-level config validator with "must NOT have additional properties" error, preventing the gateway from starting when these configs are present in `openclaw.json`.

[Bug]: Windows: allowFrom + security: standard does not enable auto-approval for remote commands

Environment | Component | Value | | ---------------- | ------------- | | OS | Windows 10/11 | | OpenClaw Version | 2026.4.1 | | Node.js | v25.7.0 | | Platform | win32 (x64) | ─── Description On Windows, even with security: standard and allowFrom configured, OpenClaw requires explicit approval for every command executed via Telegram. This makes remote management impractical. ─── Configuration { "security": "standard", "channels": { "telegram": { "enabled": true, "dmPolicy": "allowlist", "allowFrom": ["<telegram_user_id>"] } } } ─── Error Message Warning: allowlist auto-execution is unavailable on win32; explicit approval is required. Root Cause The restriction appears to be hardcoded: allowlist auto-execution is unavailable on win32; explicit approval is required ─── Impact • Remote management is impractical on Windows • Every command requires explicit approval • Telegram bot utility is severely limited ─── Suggested Fix

[Bug]: plugins install ignores --dangerously-force-unsafe-install (2026.4.2 d74a122)

`openclaw plugins install` still blocks installation on dangerous-code findings even when `--dangerously-force-unsafe-install` is provided. Plugin Github: https://github.com/albertbuchard/forge

CLI WebSocket handshake timeout - all CLI commands fail to connect gateway

All CLI commands (cron, config, doctor, etc.) fail to connect to the gateway via WebSocket with handshake timeout. The gateway itself runs normally - channel messaging (Feishu) and browser dashboard both work. Only CLI-gateway RPC connections are broken.

Integration: Cryptographic audit trails for agent actions with asqav

[Bug]: qmd boot update failed: Error: qmd update failed (code 1): file:///C:/software/nvm/v25.8.2/node_modules/@tobilu/qmd/bin/qmd:2 # Resolve symlinks so global installs (npm link / npm install -g) can find the ^

qmd版本2.0.1，openclaw版本20260401.集成qmd后运行报错qmd boot update failed: Error: qmd update failed (code 1): file:///C:/software/nvm/v25.8.2/node_modules/@tobilu/qmd/bin/qmd:2 # Resolve symlinks so global installs (npm link / npm install -g) can find the ^

ollama generate images failed in cuda 13.1

WebSocket handshake timeout (3000ms) causes CLI commands to fail intermittently

[BUG] Cowork fails with HRESULT 0x80310000 when second physical drive is BitLocker-locked — hard failure with no fallback

npm install -g shows deprecation warning for [email protected]

[Security] Memory content injected into system prompt without sanitization enables indirect prompt injection

The `LiteAgent` concatenates retrieved memory content directly into the system prompt without sanitization. If memory entries have been poisoned (e.g., via indirect prompt injection through tool outputs), an attacker can inject arbitrary instructions into the system prompt of future agent interactions. **Severity**: MEDIUM **Rule**: AGENT-010 — Unsanitized External Content in Agent Prompt **OWASP Agentic Security Index**: ASI-01 — Prompt Injection **Affected files**: - `lib/crewai/src/crewai/lite_agent.py` (lines 568-581)

[Security] crewai create ships template with eval() on unsanitized LLM input

The `AGENTS.md` template bundled with CrewAI's project scaffolding (`crewai create`) includes a Calculator tool example that uses `eval()` on LLM-provided input, creating a remote code execution vulnerability in every new CrewAI project that follows the template. **Severity**: MEDIUM **Rule**: AGENT-053 — Unsafe Code Execution Pattern in Template **OWASP Agentic Security Index**: ASI-09 — Improper Output Handling **Affected files**: - `lib/crewai/src/crewai/cli/templates/AGENTS.md` (line 773)

[FEATURE] Support using Dispatch in Claude Desktop

Bug: Anthropic OAuth refresh intermittently fails across chats/topics

lossless-claw: orphaned tool_use blocks in lcm.db after model switch cause permanent Anthropic API failures

When switching from a non-Anthropic model (e.g. MiniMax M2.7) to an Anthropic model (e.g. Claude Sonnet) mid-conversation, an orphaned \`tool_use\` block gets written to \`lcm.db\` without a corresponding \`tool_result\`. Every subsequent Anthropic API request for that channel then fails permanently with: \`\`\` LLM request rejected: messages.N: tool_use ids were found without tool_result blocks immediately after: <id>. Each tool_use block must have a corresponding tool_result block in the next message. \`\`\`

[Bug] Anthropic API Error: Extra usage required for non-1M context model