openclaw-v1.0.9

mem0ai/mem0openclaw-v1.0.9Apr 22, 2026by whysosaket

AI Summary

Security and compliance improvements for the plugin manifest, including declaration of required environment variables and sensitive data handling.

Key Highlights

Added top-level requiredEnvVars to plugin manifest for all modes
Added sensitive: true and descriptions to apiKey and userEmail in configSchema
Added dataLocations and privacy fields to manifest
Fixed static analysis flags for environment variable access in tests

Full Release Notes

## Mem0 OpenClaw Plugin (v1.0.9)

**Security & Compliance:**
- Added top-level `requiredEnvVars` to plugin manifest, declaring env vars per mode (platform, OSS OpenAI, OSS Anthropic, OSS Ollama). Fixes ClaHub scanner "required env vars: none" mismatch
- Added `sensitive: true` and descriptions to `apiKey` and `userEmail` in `configSchema` — previously only declared in `uiHints`
- Added `default: false` with descriptions to `autoCapture` and `autoRecall` in `configSchema` so scanner can confirm opt-in defaults
- Added `dataLocations` field to manifest declaring all persistence paths (config, vectorStore, historyDb, dreamState)
- Added `privacy` field to manifest documenting data flow for platform vs open-source mode and credential storage guidance
- Added `externalEndpoints` to `setup` section declaring api.mem0.ai and app.mem0.ai with purpose and requirement context

**Tests:**
- Replaced direct `process.env` access in `tests/cli-commands.test.ts` and `tests/fs-safe.test.ts` with `vi.stubEnv`/`vi.unstubAllEnvs`. Fixes ClaHub static analysis flag for "environment variable access combined with network send"
- 421 tests across 15 test files