Multi-Agent Tenant Upgrade

Multi-agent UX for OpenClaw Control UI — agent selector, per-agent sessions, session history viewer with search, agent-filtered Sessions tab with friendly na...

This skill appears to do what it says, but take these precautions before applying it: - Review the patches before applying (git apply) — examine every changed file to ensure nothing outside the listed UI/gateway files is modified. Backup your repo or create a branch. - The skill adds a sessions.history RPC that reads session transcript files and returns message text. Limit who can call the gateway RPCs (ensure proper auth/ACLs) because transcript data can contain sensitive user content. - The AI Wizard will call external model endpoints and will resolve API keys from your auth profile store or from ANTHROPIC_API_KEY / OPENAI_API_KEY if present. If you do not want the wizard to read your auth profiles, configure an explicit env var as described or verify the auth-store contents first. - Test in a staging environment first (especially the sessions.history behavior and agents.update identity writes) to confirm the patch does not introduce access-control or config hash issues. - After applying, verify that the gateway only exposes the new RPCs to authorized clients and consider rotating any keys you set for testing. If you want, I can: (a) produce a concise checklist of files/lines to inspect in the patches, (b) summarize exactly where session transcripts are read and what fields are returned, or (c) help craft a minimal ACL policy to protect the new RPCs.

Type: OpenClaw Skill Name: multi-agent-tenant-upgrade Version: 1.5.2 The multi-agent-tenant-upgrade skill bundle (v1.5.2) provides a comprehensive set of UI and backend enhancements for OpenClaw, including a session history viewer, an AI-powered agent creation wizard, and authentication status badges. While the skill performs high-risk operations—such as modifying the application source code via git patches, reading API keys from the auth store, and making outbound network calls to LLM providers—these actions are explicitly documented in SKILL.md and are strictly necessary for the described features. The implementation includes robust validation for LLM-generated content in server-agents.ts and uses standard RPC patterns for session and agent management without any evidence of malicious intent or unauthorized data exfiltration.