chore: prepare 0.8.0 notes and refresh pnpm setup

[steipete]

Prepare the complete 0.8.0 Unreleased notes and repair source packaging when pnpm 12 is installed globally: use pnpm run build instead of the removed -s alias. Update pnpm/action-setup to its verified v6.1.0 commit.

Merge after #199 and #200. This is the only PR in this group that edits CHANGELOG.md. It credits @Tanmay-008 for the HTTP context proposal and includes all user-visible changes since v0.7.3. Package version and published release sections are unchanged; this PR does not publish a release.

Keep pnpm 11.25.0 and the original single-document lockfile. pnpm 12.3.4 passed a frozen install, the full suite, and package smoke, but generated an environment document before the project dependency graph. The dependency-graph parser fix in dependabot/dependabot-core#15968 merged on September 2; hosted rollout could not be verified, and dependabot/dependabot-core#15904 remains open. Do not introduce a scanning policy workaround as part of this refresh. All direct dependencies remain current, and the 48-hour release-age policy is unchanged.

Validation: typecheck, lint, formatting, full suite (924 passed, 2 platform skips), build, and packaged CLI smoke (13 features, including 3 CUDA). Codex local autoreview is clean at P2; exact-head CI and final branch review are recorded in the proof comment before handoff.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs changes before merge. Reviewed September 7, 2026, 7:27 AM ET / 11:27 UTC.

ClawSweeper review

What this changes

Prepares the 0.8.0 unreleased notes, updates pnpm setup across three workflows, and makes source packaging use the portable build command.

Merge readiness

⛔ Needs changes before merge - 1 item remains

This remains useful: current main and v0.7.3 retain the old prepack command, and neither related PR replaces this tooling change. No actionable patch defect was found.

Likely related people: steipete is an unverified routing candidate based on recent release and tooling history.

Priority: P2
Reviewed head: 8deddcbeb71d1aa7bb6c3ec168e81c8f30a8e815

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused maintenance patch with relevant real packaging results and no identified correctness or security defect.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (live_output): The captured body reports pnpm 12.3.4 package smoke producing an installed CLI that mapped 13 features, including 3 CUDA; the inspected harness invokes the changed prepack lifecycle and then executes the packed artifact.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (live_output): The captured body reports pnpm 12.3.4 package smoke producing an installed CLI that mapped 13 features, including 3 CUDA; the inspected harness invokes the changed prepack lifecycle and then executes the packed artifact.
Evidence reviewed	8 items	Repository policy and scope: Read the complete root AGENTS.md and all five changed files. No nested AGENTS.md or matching maintainer-note files were found under .github or .agents. Applied the repository’s packaging, validation, generated-file, and release-documentation guidance. Verified introduced scope: The local diff matches the host’s complete merge-base-to-head patch: four action-pin replacements, one prepack command replacement, and unreleased notes. Package version, dependency declarations, lockfile, release permissions, and release-age policy are unchanged. Still necessary on main: The fetched main revision still uses pnpm -s build for prepack.
Findings	None	None.
Security	None	None.

How this fits together

Clawpatch’s packaging pipeline compiles the TypeScript CLI before creating its npm archive. GitHub workflows install the pinned package manager before validation, remote workspace preparation, and release publishing.

flowchart TD
  A[Workflow starts] --> B[Pinned pnpm setup]
  B --> C[Install and validate]
  D[Source package request] --> E[Prepack build]
  C --> E
  E --> F[Compiled CLI archive]
  F --> G[Installed CLI smoke check]

Loading

Before merge

• Complete next step (P2) - Honor the stated merge order: land test: allow scheduling headroom in timeout regressions #199 and feat: add opt-in HTTP context for Node and Rust #200 before this PR so its unreleased notes describe landed changes.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Workflow dependency refresh	4 pinned references across 3 workflows	The same verified action update covers Linux and Windows CI, remote hydration, and publishing.

Technical review

Best possible solution:

Retain the existing package-manager and lockfile contracts while using portable packaging and release notes that match the landed release contents.

Do we have a high-confidence way to reproduce the issue?

Yes: packaging current main with globally installed pnpm 12 reaches the reported unsupported -s invocation through prepack. The linked discussion reports that failure; this review traced the source path without executing it.

Is this the best way to solve the issue?

Yes: using pnpm run build preserves the existing build lifecycle while avoiding the incompatible shorthand, and the action update retains the existing package-manager pin.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 9f71d92f0069.

Labels

Label changes:

• add P2: The patch repairs a bounded source-packaging compatibility problem and prepares release tooling without evidence of an urgent runtime regression.
• add proof: sufficient: Contributor real behavior proof is sufficient. The captured body reports pnpm 12.3.4 package smoke producing an installed CLI that mapped 13 features, including 3 CUDA; the inspected harness invokes the changed prepack lifecycle and then executes the packed artifact.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The captured body reports pnpm 12.3.4 package smoke producing an installed CLI that mapped 13 features, including 3 CUDA; the inspected harness invokes the changed prepack lifecycle and then executes the packed artifact.

Label justifications:

• P2: The patch repairs a bounded source-packaging compatibility problem and prepares release tooling without evidence of an urgent runtime regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The captured body reports pnpm 12.3.4 package smoke producing an installed CLI that mapped 13 features, including 3 CUDA; the inspected harness invokes the changed prepack lifecycle and then executes the packed artifact.
• proof: sufficient: Contributor real behavior proof is sufficient. The captured body reports pnpm 12.3.4 package smoke producing an installed CLI that mapped 13 features, including 3 CUDA; the inspected harness invokes the changed prepack lifecycle and then executes the packed artifact.

Evidence

What I checked:

• Repository policy and scope: Read the complete root AGENTS.md and all five changed files. No nested AGENTS.md or matching maintainer-note files were found under .github or .agents. Applied the repository’s packaging, validation, generated-file, and release-documentation guidance. (AGENTS.md:1, 8deddcbeb71d)
• Verified introduced scope: The local diff matches the host’s complete merge-base-to-head patch: four action-pin replacements, one prepack command replacement, and unreleased notes. Package version, dependency declarations, lockfile, release permissions, and release-age policy are unchanged. (package.json:22, 8deddcbeb71d)
• Still necessary on main: The fetched main revision still uses pnpm -s build for prepack. (package.json:22, 9f71d92f0069)
• Latest release comparison: The supplied latest release is v0.7.3; its package manifest also retains pnpm -s build. No shipped replacement for this change was established. (package.json:22, 734f81bc1514)
• Upstream action provenance: The workflows directly execute this dependency. The official v6.1.0 release points to the exact proposed SHA; its change adds pnpm 12 support while preserving older-version bootstrap paths. Sources: release and commit. (ea17c68df891)
• Real packaging result and production path: The captured PR body reports successful pnpm 12.3.4 frozen installation and package smoke, with the installed CLI mapping 13 features including 3 CUDA features. Inspection of scripts/package-smoke.mjs confirms it runs npm pack with lifecycle scripts enabled, installs the archive, then executes the installed CLI. This exercises package.json prepack rather than merely checking source or help output. The reviewer did not execute it. (scripts/package-smoke.mjs:141, 8deddcbeb71d)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

Prepared head: 8deddcbeb71d1aa7bb6c3ec168e81c8f30a8e815.

With the retained pnpm 11.25.0 pin: frozen install, typecheck, lint, formatting, full suite (924 passed, 2 platform skips), build, and normal package smoke all passed. The installed package CLI mapped 13 synthetic features, including 3 CUDA features. The portable prepack command works with pnpm 12 installed globally. The application lockfile is byte-identical to main.

Exact-head CI: https://github.com/openclaw/clawpatch/actions/runs/34116488705 — success, including the Linux full suite/package smoke and Windows execution tests. Dependency review, CodeQL, and secret scans also passed. Codex branch autoreview against origin/main is scoped-clean at P2.

Merge this PR after #199 and #200. It contains the only changelog edits in the group. Recommend 0.8.0 after the merged-head release gates pass; no version bump, tag, merge, or publication has been performed here.