feat(kiloclaw): bump openclaw to version 2026.3.31

[kilo-code-bot]

Summary

Bumps the pinned openclaw version in kiloclaw/Dockerfile from 2026.3.13 to 2026.3.31.

Verification

• Confirmed current version (2026.3.13) is older than the target (2026.3.31), so the bump is required per policy.
• Pre-push hooks passed: format check, lint (oxlint), and incremental typecheck all clean.

Visual Changes

N/A

Reviewer Notes

Release notes analysis — items that may affect our deployment

The following breaking changes from the v2026.3.31 release notes are worth reviewing in the context of KiloClaw:

High priority:

• Gateway/auth — trusted-proxy now rejects mixed shared-token configs, and local-direct fallback requires the configured token instead of implicitly authenticating same-host callers.
  Our controller (controller/src/bootstrap.ts) patches gateway auth config and the gateway runs with --bind loopback. Verify the patched config does not inadvertently mix shared-token and trusted-proxy settings, and that same-host loopback calls still pass after this tightening.

• Gateway/auth — trusted-proxy mixed shared-token validation now also covers WebSocket handshake rate limiting; bogus device-token fields no longer suppress shared-secret brute-force tracking.
  Low direct risk but worth confirming the gateway token the controller injects (OPENCLAW_GATEWAY_TOKEN) is not inadvertently classified as a shared-token.

Medium priority:

• Gateway/node commands — node commands now stay disabled until node pairing is approved; device pairing alone is no longer enough.
  If any KiloClaw flows rely on node commands becoming available immediately after device pairing (e.g., automation or skill flows that assume node tools are available post-pair), those flows will now silently stall until an explicit node pairing approval step.

• Gateway/node events — node-originated runs now stay on a reduced trusted surface.
  Notification-driven or node-triggered flows that previously relied on broader host/session tool access may need adjustment.

• Nodes/exec — the duplicated nodes.run shell wrapper is removed from the CLI and agent nodes tool; node shell execution always goes through exec host=node.
  If any bundled skills or the controller trigger node shell execution via the old wrapper path, those calls will break silently.

Lower priority / informational:

• Plugin SDK — legacy provider compat subpaths deprecated with migration warnings. Not an immediate break but emitted warnings may surface in logs.
• Skills/install and Plugins/install — dangerous-code critical findings now fail closed by default. Plugin or skill installs that previously succeeded may now require --dangerously-force-unsafe-install. Verify no automated install flows in bootstrap are affected.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (1 files)

• kiloclaw/Dockerfile

---

_{Reviewed by gpt-5.4-20260305 · 489,390 tokens}