Changelog

Monitors the OpenClaw delivery recovery queue depth in real time. Alerts when entries are stuck in retry backoff — the exact failure mode (11 entries looping) that caused restart storms before 2026.2.26 fixed the retry starvation bug. Essential for users who haven't updated yet.

Tracks sendChatAction 401 error rate on your Telegram bot token. OpenClaw 2026.2.26 added backoff after repeated 401s specifically because unbounded retries can trigger Telegram abuse enforcement and bot deletion. HBG now surfaces this risk before it escalates.

Counts gateway restarts over a rolling 10-minute window. More than 2 restarts = alert. Restart loops were the #1 support issue in the 2026.2.24–2026.2.25 window. Now you know the moment it starts, not after it's been looping for an hour.

OpenClaw shipped 5 typing-indicator fixes in 2026.2.26 — all addressing the same root symptom: stuck typing = unhealthy agent. HBG now watches for typing active >60s with no message delivered and flags it as a delivery stall warning.

Detects when dmPolicy or directPolicy is riding a default value that could silently flip on upgrade (the 2026.2.24 breaking change that caught many users off guard). Flags it before your next update, not after.

Goes beyond "did it fire?" — now tracks whether cron jobs finished within their expected window. Surfaces stale-message-in-queue events and agent turn timeout races, both of which were hardened in 2026.2.26.

Now mirrors the new openclaw secrets audit workflow. Detects hardcoded credentials in agent configs, validates secret refs resolve at runtime, and alerts on stale rotations. Aligns with the External Secrets Management system shipped in 2026.2.26.

New watch rule: slash commands that expose config or credentials executed in shared channels. Inspired by issue #28311 (unpatched as of 2026.2.26) where /models in Telegram leaks truncated API key prefixes to all channel members.

Native Event Log parsing for failed login detection and suspicious activity.

Parse Sysmon logs for suspicious process creation and network events.

Detect unauthorized changes to Windows Firewall rules.

Track certificate expiry across all your domains with 30/14/7-day alert thresholds.

SHA-256 hashing of critical system files with drift alerts on change.