OpenClaw 2026.3.31-beta.1

Breaking

• Nodes/exec: remove the duplicated nodes.run shell wrapper from the CLI and agent nodes tool so node shell execution always goes through exec host=node, keeping node-specific capabilities on nodes invoke and the dedicated media/location/notify actions.
• Plugin SDK: deprecate the legacy provider compat subpaths plus the older bundled provider setup and channel-runtime compatibility shims, emit migration warnings, and keep the current documented openclaw/plugin-sdk/* entrypoints plus local api.ts / runtime-api.ts barrels as the forward path ahead of a future major-release removal.
• Skills/install and Plugins/install: built-in dangerous-code critical findings and install-time scan failures now fail closed by default, so plugin installs and gateway-backed skill dependency installs that previously succeeded may now require an explicit dangerous override such as --dangerously-force-unsafe-install to proceed.
• Gateway/auth: trusted-proxy now rejects mixed shared-token configs, and local-direct fallback requires the configured token instead of implicitly authenticating same-host callers. Thanks @zhangning-agent, @jacobtomlinson, and @vincentkoc.
• Gateway/node commands: node commands now stay disabled until node pairing is approved, so device pairing alone is no longer enough to expose declared node commands. (#57777) Thanks @jacobtomlinson.
• Gateway/node events: node-originated runs now stay on a reduced trusted surface, so notification-driven or node-triggered flows that previously relied on broader host/session tool access may need adjustment. (#57691) Thanks @jacobtomlinson.

Changes

• ACP/plugins: add an explicit default-off ACPX plugin-tools MCP bridge config, document the trust boundary, and harden the built-in bridge packaging/logging path so global installs and stdio MCP sessions work reliably. (#56867) Thanks @joe2643.
• Agents/LLM: add a configurable idle-stream timeout for embedded runner requests so stalled model streams abort cleanly instead of hanging until the broader run timeout fires. (#55072) Thanks @liuy.
• Agents/MCP: materialize bundle MCP tools with provider-safe names (serverName__toolName), support optional streamable-http transport selection plus per-server connection timeouts, and preserve real tool results from aborted/error turns unless truncation explicitly drops them. (#49505) Thanks @ziomancer.
• Android/notifications: add notification-forwarding controls with package filtering, quiet hours, rate limiting, and safer picker behavior for forwarded notification events. (#40175) Thanks @nimbleenigma.
• Background tasks: turn tasks into a real shared background-run control plane instead of ACP-only bookkeeping by unifying ACP, subagent, cron, and background CLI execution under one SQLite-backed ledger, routing detached lifecycle updates through the executor seam, adding audit/maintenance/status visibility, tightening auto-cleanup and lost-run recovery, improving task awareness in internal status/tool surfaces, and clarifying the split between heartbeat/main-session automation and detached scheduled runs. Thanks @mbelinky and @vincentkoc.
• Background tasks: add the first linear task flow control surface with openclaw flows list|show|cancel, keep manual multi-task flows separate from one-task auto-sync flows, and surface doctor recovery hints for obviously orphaned or broken flow/task linkage. Thanks @mbelinky and @vincentkoc.
• Channels/QQ Bot: add QQ Bot as a bundled channel plugin with multi-account setup, SecretRef-aware credentials, slash commands, reminders, and media send/receive support. (#52986) Thanks @sliverp.
• Diffs: skip unused viewer-versus-file SSR preload work so diffs view-only and file-only runs do less render work while keeping mode outputs aligned. (#57909) thanks @gumadeiras.
• Tasks: add a minimal SQLite-backed task flow registry plus task-to-flow linkage scaffolding, so orchestrated work can start gaining a first-class parent record without changing current task delivery behavior. Thanks @mbelinky and @vincentkoc.
• Tasks: persist blocked state on one-task task flows and let the same flow reopen cleanly on retry, so blocked detached work can carry a parent-level reason and continue without fragmenting into a new job. Thanks @mbelinky and @vincentkoc.
• Tasks: route one-task ACP and subagent updates through a parent task-flow owner context, so detached work can emerge back through the intended parent thread/session instead of speaking only as a raw child task. Thanks @mbelinky and @vincentkoc.
• LINE/outbound media: add LINE image, video, and audio outbound sends on the LINE-specific delivery path, including explicit preview/tracking handling for videos while keeping generic media sends on the existing image-only route. (#45826) Thanks @masatohoshino.
• Matrix/history: add optional room history context for Matrix group triggers via channels.matrix.historyLimit, with per-agent watermarks and retry-safe snapshots so failed trigger retries do not drift into newer room messages. (#57022) thanks @chain710.
• Matrix/network: add explicit channels.matrix.proxy config for routing Matrix traffic through an HTTP(S) proxy, including account-level overrides and matching probe/runtime behavior. (#56931) thanks @patrick-yingxi-pan.
• Matrix/streaming: add draft streaming so partial Matrix replies update the same message in place instead of sending a new message for each chunk. (#56387) Thanks @jrusz.
• Matrix/threads: add per-DM threadReplies overrides and keep thread session isolation aligned with the effective room or DM thread policy from the triggering message onward. (#57995) thanks @teconomix.
• MCP: add remote HTTP/SSE server support for mcp.servers URL configs, including auth headers and safer config redaction for MCP credentials. (#50396) Thanks @dhananjai1729.
• Memory/QMD: add per-agent memorySearch.qmd.extraCollections so agents can opt into cross-agent session search without flattening every transcript collection into one shared QMD namespace. Thanks @vincentkoc.
• Microsoft Teams/member info: add a Graph-backed member info action so Teams automations and tools can resolve channel member details directly from Microsoft Graph. (#57528) Thanks @sudie-codes.
• Nostr/inbound DMs: verify inbound event signatures before pairing or sender-authorization side effects, so forged DM events no longer create pairing requests or trigger reply attempts. Thanks @smaeljaish771 and @vincentkoc.
• OpenAI/Responses: forward configured text.verbosity across Responses HTTP and WebSocket transports, surface it in /status, and keep per-agent verbosity precedence aligned with runtime behavior. (#47106) Thanks @merc1305 and @vincentkoc.
• Pi/Codex: add native Codex web search support for embedded Pi runs, including config/docs/wizard coverage and managed-tool suppression when native Codex search is active. (#46579) Thanks @Evizero.
• Slack/exec approvals: add native Slack approval routing and approver authorization so exec approval prompts can stay in Slack instead of falling back to the Web UI or terminal. Thanks @vincentkoc.
• TTS: Add structured provider diagnostics and fallback attempt analytics. (#57954) Thanks @joshavant.
• WhatsApp/reactions: agents can now react with emoji on incoming WhatsApp messages, enabling more natural conversational interactions like acknowledging a photo with ❤️ instead of typing a reply. Thanks @mcaxtr.
• Agents/BTW: force /btw side questions to disable provider reasoning so Anthropic adaptive-thinking sessions stop failing with No BTW response generated. Fixes #55376. Thanks @Catteres and @vincentkoc.
• CLI/onboarding: reset the remote gateway URL prompt to the safe loopback default after declining a discovered endpoint, so onboarding does not keep a previously rejected remote URL. (#57828)
• Agents/exec defaults: honor per-agent tools.exec defaults when no inline directive or session override is present, so configured exec host, security, ask, and node settings actually apply. (#57689)
• Sandbox/networking: sanitize SSH subprocess env vars through the shared sandbox policy and route marketplace archive downloads plus Ollama discovery, auth, and pull requests through the guarded fetch path so sandboxed execution and remote fetches follow the repo's trust boundaries. (#57848, #57850)

Fixes

• Agents/OpenAI Responses: normalize raw bundled MCP tool schemas on the WebSocket/Responses path so bare-object, object-ish, and top-level union MCP tools no longer get rejected by OpenAI during tool registration. (#58299) Thanks @yelog.
• ACP/security: replace ACP's dangerous-tool name override with semantic approval classes, so only narrow readonly reads/searches can auto-approve while indirect exec-capable and control-plane tools always require explicit prompt approval. Thanks @vincentkoc.
• ACP/sessions_spawn: register ACP child runs for completion tracking and lifecycle cleanup, and make registration-failure cleanup explicitly best-effort so callers do not assume an already-started ACP turn was fully aborted. (#40885) Thanks @xaeon2026 and @vincentkoc.
• ACP/tasks: mark cleanly exited ACP runs as blocked when they end on deterministic write or authorization blockers, and wake the parent session with a follow-up instead of falsely reporting success.
• ACPX/runtime: derive the bundled ACPX expected version from the extension package metadata instead of hardcoding a separate literal, so plugin-local ACPX installs stop drifting out of health-check parity after version bumps. (#49089) Thanks @jiejiesks and @vincentkoc.
• Agents/Anthropic failover: treat Anthropic api_error payloads with An unexpected error occurred while processing the response as transient so retry/fallback can engage instead of surfacing a terminal failure. (#57441) Thanks @zijiess and @vincentkoc.
• Agents/compaction: keep late compaction-retry rejections handled after the aggregate timeout path wins without swallowing real pre-timeout wait failures, so timed-out retries no longer surface an unhandled rejection on later unsubscribe. (#57451) Thanks @mpz4life and @vincentkoc.
• Agents/context pruning: count supplementary-plane CJK characters with the shared code-point-aware estimator so context pruning stops underestimating Japanese and Chinese text that uses Extension B ideographs. (#39985) Thanks @Edward-Qiang-2024.
• Agents/Kimi: preserve already-valid Anthropic-compatible tool call argument objects while still clearing cached repairs when later trailing junk exceeds the repair allowance. (#54491) Thanks @yuanaichi.
• Agents/MCP: dispose bundled MCP runtimes after one-shot openclaw agent --local runs finish, while preserving bundled MCP state across in-run retries so local JSON runs exit cleanly without restarting stateful MCP tools mid-run.
• Agents/MCP: reuse bundled MCP runtimes across turns in the same session, while recreating them when MCP config changes and disposing stale runtimes cleanly on session rollover. (#55090) Thanks @allan0509.
• Agents/memory flush: keep daily memory flush files append-only during embedded attempts so compaction writes do not overwrite earlier notes. (#53725) Thanks @HPluseven.
• Agents/sandbox: honor tools.sandbox.tools.alsoAllow, let explicit sandbox re-allows remove matching built-in default-deny tools, and keep sandbox explain/error guidance aligned with the effective sandbox tool policy. (#54492) Thanks @ngutman.
• Agents/sandbox: make remote FS bridge reads pin the parent path and open the file atomically in the helper so read access cannot race path resolution. Thanks @AntAISecurityLab and @vincentkoc.
• Agents/silent turns: fail closed on silent memory-flush runs so narrated NO_REPLY self-talk cannot stream or finalize into external replies even when block streaming is enabled. (#52593)
• Agents/subagents: fix interim subagent runtime display so /subagents list and /subagents info stop inflating short runtimes and show second-level durations correctly. (#57739) Thanks @samzong.
• Anthropic/OAuth: inject /fast service_tier hints for direct sk-ant-oat-* requests so OAuth-authenticated Anthropic runs stop missing the same overload-routing signal as API-key traffic. Fixes #55758. Thanks @Cypherm and @vincentkoc.
• Anthropic/service tiers: support explicit serviceTier model params for direct Anthropic requests and let them override /fast defaults when both are set. (#45453) Thanks @vincentkoc.
• Auto-reply/fast: accept /fast status on the directive-only path, align help/status text with the documented status|on|off syntax, and keep current-state replies consistent across command surfaces. Fixes #46095. Thanks @weissfl and @vincentkoc.
• Azure OpenAI/custom providers: use the azure-openai-responses path for Azure custom providers so Azure OpenAI endpoints stay on the correct Responses integration surface. (#50851) Thanks @kunalk16.
• BlueBubbles/iMessage: coalesce URL-only inbound messages with their link-preview balloon again so sharing a bare link no longer drops the URL from agent context. Thanks @vincentkoc.
• Browser/plugins: auto-enable the bundled browser plugin when browser config or browser tool policy already references it, and show a clearer CLI error when plugins.allow excludes browser.
• CI/dev checks: default local pnpm check to a lower-memory typecheck/lint path while keeping CI on the normal parallel path, and harden Telegram test typing/literals around native TypeScript-Go tooling crashes.
• Tasks: add a small task-flow runtime substrate for authoring layers with persisted wait targets and output bags, plus bundled skills/Lobster examples and richer flows show / doctor recovery hints for multi-task flow state. (#58336) Thanks @mbelinky and @vincentkoc.
• Config/legacy cleanup: stop probing obsolete alternate legacy config names and service labels during local config/service detection, while keeping the active ~/.openclaw/openclaw.json path canonical.
• Config/runtime: pin the first successful config load in memory for the running process and refresh that snapshot on successful writes/reloads, so hot paths stop reparsing openclaw.json between watcher-driven swaps.
• Config/SecretRef + Control UI: harden SecretRef redaction round-trip restore, block unsafe raw fallback (force Form mode when raw is unavailable), and preflight submitted-config SecretRefs before config write RPC persistence. (#58044) Thanks @joshavant.
• Config/Telegram: migrate removed channels.telegram.groupMentionsOnly into channels.telegram.groups["*"].requireMention on load so legacy configs no longer crash at startup. (#55336) thanks @jameslcowan.
• Config/update: stop openclaw doctor write-backs from persisting plugin-injected channel defaults, so openclaw update no longer seeds config keys that later break service refresh validation. (#56834) Thanks @openperf.
• Control UI/agents: auto-load agent workspace files on initial Files panel open, and populate overview model/workspace/fallbacks from effective runtime agent metadata so defaulted models no longer show as Not set. (#56637) Thanks @dxsx84.
• Control UI/slash commands: make /steer and /redirect work from the chat command palette with visible pending state for active-run /steer, correct redirected-run tracking, and a single canonical /steer entry in the command menu. (#54625) Thanks @fuller-stack-dev.
• Cron/announce: preserve all deliverable text payloads for announce mode instead of collapsing to the last chunk, so multi-line cron reports deliver in full to Telegram forum topics.
• Cron/isolated sessions: carry the full live-session provider, model, and auth-profile selection across retry restarts so cron jobs with model overrides no longer fail or loop on mid-run model-switch requests. (#57972) Thanks @issaba1.
• Diffs/config: preserve schema-shaped plugin config parsing from diffsPluginConfigSchema.safeParse(), so direct callers keep defaults and security sections instead of receiving flattened tool defaults. (#57904) Thanks @gumadeiras.
• Diffs: fall back to plain text when lang hints are invalid during diff render and viewer hydration, so bad or stale language values no longer break the diff viewer. (#57902) Thanks @gumadeiras.
• Discord/voice: enforce the same guild channel and member allowlist checks on spoken voice ingress before transcription, so joined voice channels no longer accept speech from users outside the configured Discord access policy. Thanks @cyjhhh and @vincentkoc.
• Docker/setup: force BuildKit for local image builds (including sandbox image builds) so ./docker-setup.sh no longer fails on RUN --mount=... when hosts default to Docker's legacy builder. (#56681) Thanks @zhanghui-china.
• Docs/anchors: fix broken English docs links and make Mint anchor audits run against the English-source docs tree. (#57039) thanks @velvet-shark.
• Doctor/plugins: skip false Matrix legacy-helper warnings when no migration plans exist, and keep bundled enabledByDefault plugins in the gateway startup set. (#57931) Thanks @dinakars777.
• Exec approvals/macOS: unwrap arch and xcrun before deriving shell payloads and allow-always patterns, so wrapper approvals stay bound to the carried command instead of the outer carrier. Thanks @tdjackey and @vincentkoc.
• Exec approvals: unwrap caffeinate and sandbox-exec before persisting allow-always trust so later shell payload changes still require a fresh approval. Thanks @tdjackey and @vincentkoc.
• Exec/approvals: infer Discord and Telegram exec approvers from existing owner config when execApprovals.approvers is unset, extend the default approval window to 30 minutes, and clarify approval-unavailable guidance so approvals do not appear to silently disappear.
• Exec/approvals: keep awk and sed family binaries out of the low-risk safeBins fast path, and stop doctor profile scaffolding from treating them like ordinary custom filters. Thanks @vincentkoc.
• Exec/env: block proxy, TLS, and Docker endpoint env overrides in host execution so request-scoped commands cannot silently reroute outbound traffic or trust attacker-supplied certificate settings. Thanks @AntAISecurityLab.
• Exec/env: block Python package index override variables from request-scoped host exec environment sanitization so package fetches cannot be redirected through a caller-supplied index. Thanks @nexrin and @vincentkoc.
• Exec/node: stop gateway-side workdir fallback from rewriting explicit host=node cwd values to the gateway filesystem, so remote node exec approval and runs keep using the intended node-local directory. (#50961) Thanks @openperf.
• Exec/runtime: default implicit exec to host=auto, resolve that target to sandbox only when a sandbox runtime exists, keep explicit host=sandbox fail-closed without sandbox, and show /exec effective host state in runtime status/docs.
• Exec: fail closed when the implicit sandbox host has no sandbox runtime, and stop denied async approval followups from reusing prior command output from the same session. (#56800) Thanks @scoootscooob.
• Feishu/groups: keep quoted replies and topic bootstrap context aligned with group sender allowlists so only allowlisted thread messages seed agent context. Thanks @AntAISecurityLab and @vincentkoc.
• Gateway/attachments: offload large inbound images without leaking media:// markers into text-only runs, preserve mixed attachment order for model input/transcripts, and fail closed when model image capability cannot be resolved. (#55513) Thanks @Syysean.
• Gateway/auth: keep shared-auth rate limiting active during WebSocket handshake attempts even when callers also send device-token candidates, so bogus device-token fields no longer suppress shared-secret brute-force tracking. Thanks @kexinoh and @vincentkoc.
• Gateway/auth: reject mismatched browser Origin headers on trusted-proxy HTTP operator requests while keeping origin-less headless proxy clients working. Thanks @AntAISecurityLab and @vincentkoc.
• Gateway/device tokens: disconnect active device sessions after token rotation so newly rotated credentials revoke existing live connections immediately instead of waiting for those sockets to close naturally. Thanks @zsxsoft and @vincentkoc.
• Gateway/health: carry webhook-vs-polling account mode from channel descriptors into runtime snapshots so passive channels like LINE and BlueBubbles skip false stale-socket health failures. (#47488) Thanks @karesansui-u.
• Gateway/pairing: restore QR bootstrap onboarding handoff so fresh /pair qr iPhone setup can auto-approve the initial node pairing, receive a reusable node device token, and stop retrying with spent bootstrap auth. (#58382) Thanks @ngutman.
• Gateway/OpenAI compatibility: accept flat Responses API function tool definitions on /v1/responses and preserve strict when normalizing hosted tools into the embedded runner, so spec-compliant clients like Codex no longer fail validation or silently lose strict tool enforcement. Thanks @malaiwah and @vincentkoc.
• Gateway/OpenAI HTTP: restore default operator scopes for bearer-authenticated requests that omit x-openclaw-scopes, so headless /v1/chat/completions and session-history callers work again after the recent method-scope hardening. (#57596) Thanks @openperf.
• Gateway/plugins: scope plugin-auth HTTP route runtime clients to read-only access and keep gateway-authenticated plugin routes on write scope, so plugin-owned webhook handlers do not inherit write-capable runtime access by default. Thanks @davidluzsilva and @vincentkoc.
• Gateway/SecretRef: resolve restart token drift checks with merged service/runtime env sources and hard-fail unsupported mutable SecretRef plus OAuth-profile combinations so restart warnings and policy enforcement match runtime behavior. (#58141) Thanks @joshavant.
• Gateway/tools HTTP: tighten HTTP tool-invoke authorization so owner-only tools stay off HTTP invoke paths. (#57773) Thanks @jacobtomlinson.
• Harden async approval followup delivery in webchat-only sessions (#57359) Thanks @joshavant.
• Heartbeat/auth: prevent exec-event heartbeat runs from inheriting owner-only tool access from the session delivery target, so node exec output stays on the non-owner tool surface even when the target session belongs to the owner. Thanks @AntAISecurityLab and @vincentkoc.
• Hooks/config: accept runtime channel plugin ids in hooks.mappings[].channel (for example feishu) instead of rejecting non-core channels during config validation. (#56226) Thanks @AiKrai001.
• Hooks/session routing: rebind hook-triggered agent: session keys to the actual target agent before isolated dispatch so dedicated hook agents keep their own session-scoped tool and plugin identity. Thanks @kexinoh and @vincentkoc.
• Host exec/env: block additional request-scoped env overrides that can redirect Docker endpoints, trust roots, compiler include paths, package resolution, or Python environment roots during approved host runs. Thanks @tdjackey and @vincentkoc.
• Image generation/build: write stable runtime alias files into dist/ and route provider-auth runtime lookups through those aliases so image-generation providers keep resolving auth/runtime modules after rebuilds instead of crashing on missing hashed chunk files.
• iOS/Live Activities: mark the ActivityKit import in LiveActivityManager.swift as @preconcurrency so Xcode 26.4 / Swift 6 builds stop failing on strict concurrency checks. (#57180) Thanks @ngutman.
• LINE/ACP: add current-conversation binding and inbound binding-routing parity so /acp spawn ... --thread here, configured ACP bindings, and active conversation-bound ACP sessions work on LINE like the other conversation channels.
• LINE/markdown: preserve underscores inside Latin, Cyrillic, and CJK words when stripping markdown, while still removing standalone _italic_ markers on the shared text-runtime path used by LINE and TTS. (#47465) Thanks @jackjin1997.
• LINE/status: stop openclaw status from warning about missing credentials when sanitized LINE snapshots are already configured, while still surfacing whether the missing field is the token or secret. (#45701) Thanks @tamaosamu.
• macOS/local gateway: stop OpenClaw.app from killing healthy local gateway listeners after startup by recognizing the current openclaw-gateway process title and using the current openclaw gateway launch shape.
• macOS/wide-area discovery: switch gateway discovery to Tailscale MagicDNS names so Mac clients recover more reliably across changing tailnet IPs. (#57833) Thanks @jacobtomlinson.
• Matrix/CLI send: start one-off Matrix send clients before outbound delivery so openclaw message send --channel matrix restores E2EE in encrypted rooms instead of sending plain events. (#57936) Thanks @gumadeiras.
• Matrix/context: filter fetched room context by sender allowlists so reply and thread context lookup no longer pulls non-allowlisted messages into agent context. (#58376) Thanks @jacobtomlinson.
• Matrix/delivery recovery: treat Synapse User not in room replay failures as permanent during startup recovery so poisoned queued messages move to failed/ instead of crash-looping Matrix after restart. (#57426) thanks @dlardo.
• Matrix/direct rooms: recover fresh auto-joined 1:1 DMs without eagerly persisting invite-only m.direct mappings, while keeping named, aliased, and explicitly configured rooms on the room path. (#58024) Thanks @gumadeiras.
• Matrix/direct rooms: stop trusting remote is_direct, honor explicit local is_direct: false for discovered DM candidates, and avoid extra member-state lookups for shared rooms so DM routing and repair stay aligned. (#57124) Thanks @w-sss.
• Matrix/DM threads: keep strict unnamed fresh-invite rooms promotable even when Matrix omits the optional direct hint, preserve repair-failed local DM promotions while still revalidating later room metadata, and keep both bound and thread-isolated Matrix sessions reporting the correct route policy. (#58099) Thanks @gumadeiras.
• Matrix/plugin loading: ship and source-load the crypto bootstrap runtime sidecar correctly so current main stops warning about failed Matrix bootstrap loads and matrix/index plugin-id mismatches on every invocation. (#53298) thanks @keithce.
• Mattermost/websocket: detect stale Mattermost WebSocket sessions after bot disable/enable cycles so monitoring reconnects cleanly instead of silently staying stale. (#53604) Thanks @Qinsam.
• Media/downloads: stop forwarding auth and cookie headers across cross-origin redirects during media saves, while preserving safe request headers for same-origin redirect chains. Thanks @AntAISecurityLab and @vincentkoc.
• Media/images: reject oversized decoded image inputs before metadata and resize backends run, so tiny compressed image bombs fail early instead of exhausting gateway memory. (#58226) Thanks @AntAISecurityLab and @vincentkoc.
• Memory/doctor: probe QMD availability from the agent workspace too, so openclaw doctor no longer falsely reports relative memory.qmd.command configs as broken while runtime search still works. Thanks @vincentkoc.
• Memory/doctor: suppress the orphan transcript cleanup warning when QMD session indexing is enabled, so doctor no longer suggests deleting transcript history that QMD still uses for recall. (#40584) Thanks @Gyarados4157 and @vincentkoc.
• Memory/FTS: add configurable trigram tokenization plus short-CJK substring fallback so memory search can find Chinese, Japanese, and Korean text without breaking mixed long-and-short queries. Thanks @carrotRakko.
• Memory/FTS: keep provider-less keyword hits visible at the default memory-search threshold, so FTS-only recall works without requiring --min-score 0. (#56473) Thanks @opriz.
• Memory/LanceDB: resolve runtime dependency manifest lookup from the bundled extensions/memory-lancedb path (including flattened dist chunks) so startup no longer fails with a missing @lancedb/lancedb dependency error. (#56623) Thanks @LUKSOAgent.
• Memory/QMD: add memory.qmd.searchTool as an exact mcporter tool override, so custom QMD MCP tools such as hybrid_search can be used without weakening the validated searchMode config surface. (#27801) Thanks @keramblock.
• Memory/QMD: honor memory.qmd.update.embedInterval even when regular QMD update cadence is disabled or slower by arming a dedicated embed-cadence maintenance timer, while avoiding redundant timers when regular updates are already frequent enough. (#37326) Thanks @barronlroth.
• Memory/QMD: include deduplicated default plus per-agent memorySearch.extraPaths when building QMD custom collections, so shared and agent-specific extra roots both get indexed consistently. (#57315) Thanks @Vitalcheffe and @vincentkoc.
• Memory/QMD: keep memory_search session-hit paths roundtrip-safe when exported session markdown lives under the workspace qmd/ directory, so memory_get can read the exact returned path instead of failing on the generic qmd/sessions/... alias. (#43519) Thanks @holgergruenhagen and @vincentkoc.
• Memory/QMD: keep qmd embed active in search mode too, so BM25-first setups still build a complete index for later vector and hybrid retrieval. (#54509) Thanks @hnshah and @vincentkoc.
• Memory/QMD: keep reset and deleted session transcripts in QMD session export so daily session resets do not silently drop most historical recall from memory_search. (#30220) Thanks @pushkarsingh32.
• Memory/QMD: pass a direct-session key on openclaw memory search so CLI QMD searches no longer get denied as session=<none> under direct-only scope defaults. (#43517) Thanks @waynecc-at and @vincentkoc.
• Memory/QMD: point QMD_CONFIG_DIR at the nested xdg-config/qmd directory so per-agent collection config resolves correctly. (#39078) Thanks @smart-tinker and @vincentkoc.
• Memory/QMD: preserve explicit start_line and end_line metadata from mcporter query results so memory search hits keep the real snippet offsets instead of falling back to the snippet header. (#47960) Thanks @vincentkoc.
• Memory/QMD: rebind collections when QMD reports a changed pattern but omits path metadata, so config pattern changes stop being silently ignored on restart. (#49897) Thanks @Madruru.
• Memory/QMD: resolve slugified memory_search file hints back to the indexed filesystem path before returning search hits, so memory_get works again for mixed-case and spaced paths. (#50313) Thanks @erra9x.
• Memory/QMD: send MCP query collection filters as the upstream collections array instead of the legacy singular collection field, so mcporter-backed QMD 1.1+ searches still scope correctly after the unified query tool migration. (#54728) Thanks @armanddp and @vincentkoc.
• Memory/QMD: serialize cross-process qmd embed runs behind a shared lock and stagger periodic embed timers so multi-agent QMD collections stop thundering-herding on startup and every maintenance interval. Thanks @vincentkoc.
• Memory/QMD: stop rewriting Han/CJK BM25 queries before qmd search, so OpenClaw search semantics match direct QMD results for mixed and spaced Chinese queries. Thanks @vincentkoc.
• Memory/QMD: surface degraded vector status from qmd status so openclaw memory status --deep warns when semantic search is unavailable because the index still has 0 vectors. Fixes #28169. Thanks @vincentkoc.
• Memory/QMD: treat null-byte collection corruption the same when QMD surfaces it as ENOENT, so managed-collection repair still rebuilds and retries instead of leaving QMD stuck on a broken path. Thanks @vincentkoc.
• Memory/QMD: warn explicitly when memory.backend=qmd is configured but the qmd binary is missing, so doctor and runtime fallback no longer fail as a silent builtin downgrade. (#50439) Thanks @Jimmy-xuzimo and @vincentkoc.
• Memory/QMD: weight CJK-heavy text correctly when estimating chunk sizes, preserve surrogate-pair characters during fine splits, and keep long Latin lines on the old chunk boundaries so memory indexing produces better-sized chunks for CJK notes. (#40271) Thanks @AaronLuo00.
• Memory/session indexer: include .jsonl.reset.* and .jsonl.deleted.* transcripts in the memory host session scan while still excluding .jsonl.bak.* compaction backups and lock files, so memory search sees archived session history without duplicating stale snapshots. Thanks @hclsys and @vincentkoc.
• Microsoft Teams/threads: filter fetched thread history by sender allowlists so thread context seeding no longer pulls messages from disallowed users. (#57723) Thanks @jacobtomlinson.
• OpenAI/Codex fast mode: map /fast to priority processing on native OpenAI and Codex Responses endpoints instead of rewriting reasoning settings, and document the exact endpoint and override behavior.
• Outbound media/local files: piggyback host-local MEDIA: reads on the configured fs policy instead of a separate media-root check, so generated files outside the workspace can send when tools.fs.workspaceOnly=false while plaintext-like host files stay blocked by the outbound media allowlist.
• Pairing: enforce pending request limits per account instead of per shared channel queue, so one account's outstanding pairing challenges no longer block new pairing on other accounts. Thanks @smaeljaish771 and @vincentkoc.
• Plugins/ClawHub: sanitize temporary archive filenames for scoped package names and slash-containing skill slugs so openclaw plugins install @scope/name no longer fails with ENOENT during archive download. (#56452) Thanks @soimy.
• Plugins/CLI: add descriptor-backed lazy plugin CLI registration so Matrix can keep its CLI module lazy-loaded without dropping openclaw matrix ... from parse-time command registration. (#57165) Thanks @gumadeiras.
• Plugins/CLI: collect root-help plugin descriptors through a dedicated non-activating CLI metadata path so enabled plugins keep validated config semantics without triggering runtime-only plugin registration work, while preserving runtime CLI command registration for legacy channel plugins that still wire commands from full registration. (#57294) thanks @gumadeiras.
• Plugins/facades: guard bundled plugin facade loads with a cache-first sentinel so circular re-entry stops crashing xai, sglang, and vllm during gateway plugin startup. (#57508) Thanks @openperf.
• Plugins/Matrix: mirror the Matrix crypto WASM runtime dependency into the root packaged install and enforce root/plugin dependency parity so bundled Matrix E2EE crypto resolves correctly in shipped builds. (#57163) Thanks @gumadeiras.
• Plugins/startup: block workspace .env from overriding OPENCLAW_BUNDLED_PLUGINS_DIR, so bundled plugin trust roots only come from inherited runtime env or package resolution instead of repo-local dotenv files. Thanks @nexrin and @vincentkoc.
• Sandbox/browser: install fonts-noto-cjk in the sandbox browser image so screenshots render Chinese, Japanese, and Korean text correctly instead of tofu boxes. Fixes #35597. Thanks @carrotRakko and @vincentkoc.
• Security/LINE: make webhook signature validation run the timing-safe compare even when the supplied signature length is wrong, closing a small timing side-channel. (#55663) Thanks @gavyngong.
• Sessions/Feishu: preserve conversation ids that legitimately embed :topic: in shared session helper parsing, while keeping Telegram topic session parsing intact. (#58100) Thanks @gumadeiras.
• Slack/status reactions: add a reaction lifecycle for queued, thinking, tool, done, and error phases in Slack monitors, with safer cleanup so queued ack reactions stay correct across silent runs, pre-reply failures, and delayed transitions. (#56430) Thanks @hsiaoa.
• Status/node-only hosts: teach openclaw status to handle node-only hosts on current main without the old mixed gateway assumptions. (#56718) Thanks @ImLukeF.
• Status: fix cache hit rate exceeding 100% by deriving denominator from prompt-side token fields instead of potentially undersized totalTokens. Fixes #26643.
• Telegram/audio: transcode Telegram voice-note .ogg attachments before the local whisper-cli auto fallback runs, and keep mention-preflight transcription enabled in auto mode when tools.media.audio is unset.
• Telegram/forum topics: restore reply routing to the active topic and keep ACP sessions_spawn(..., thread=true, mode="session") bound to that same topic instead of falling back to root chat or losing follow-up routing. (#56060) Thanks @one27001.
• Telegram/media: allow RFC 2544 benchmark-range Telegram CDN resolutions during media downloads, so voice messages, PDFs, and other attachments no longer fail with Failed to download media. (#57624) Thanks @MoerAI.
• Telegram/native commands: prefix native command menu callback payloads and preserve CommandSource: "native" when Telegram replays them through callback queries, so /fast and other native command menus keep working even when text-command routing is disabled. Thanks @vincentkoc.
• Telegram/polling: keep the watchdog from aborting long-running reply delivery by treating recent non-polling API activity as bounded liveness instead of a hard stall. (#56343) Thanks @openperf.
• Tools/web_fetch: add an explicit trusted env-proxy path for proxy-only installs while keeping strict SSRF fetches on the pinned direct path, so trusted proxy routing does not weaken strict destination binding. (#50650) Thanks @kkav004.
• Tools/web_search: localize the shared search cache to module scope so same-process global symbol lookups can no longer inspect or mutate cached web-search responses. Thanks @vincentkoc.
• TTS/Microsoft: auto-switch the default Edge voice to Chinese for CJK-dominant text without overriding explicitly selected Microsoft voices. (#52355) Thanks @extrasmall0.
• TTS: Restore 3.28 schema compatibility and fallback observability. (#57953) Thanks @joshavant.
• TUI/chat: keep optimistic outbound user messages visible during active runs by deferring local-run binding until the first gateway chat event reveals the real run id, preventing premature history reloads from wiping pending local sends. (#54722) Thanks @seanturner001.
• TUI/model picker: keep searchable /model and /models input mode from hijacking j/k as navigation keys, and harden width bounds under m-filtered model lists so search no longer crashes on long rows. (#30156) Thanks @briannicholls.
• Voice Call/media stream: cap inbound WebSocket frame size before start validation so oversized pre-start frames are dropped before JSON parsing. Thanks @Kazamayc and @vincentkoc.
• Voice call/Plivo: pin stored callback bases to the configured public webhook URL so later call-control redirects stay on the intended origin even if webhook transport metadata differs. Thanks @zsxsoft and @vincentkoc.
• Web UI/markdown: stop bare auto-links from swallowing adjacent CJK text while preserving valid mixed-script path and query characters in rendered links. (#48410) Thanks @jnuyao.
• Approvals/UI: keep the newest pending approval at the front of the Control UI queue so approving one request does not accidentally target an older expired id. Thanks @vincentkoc.
• Auth profiles/OAuth: refresh runtime auth snapshots when saving rotated credentials so OAuth providers do not reuse consumed refresh tokens after the first token rotation. Fixes #55389. Thanks @sam26880 and @vincentkoc.
• Browser/screenshot: use fromSurface: false in raw CDP screenshots to avoid a Chromium compositor bug that drops cross-origin image textures (QR codes, CDN assets), and preserve pre-existing device emulation state across full-page viewport expansion. (#54358) Thanks @FMLS.
• ClawDock/docs: move the helper scripts to scripts/clawdock, publish ClawDock as a first-class docs page on the docs site, and document reinstalling local helper copies from the new raw GitHub path. (#23912) thanks @Olshansk.
• Control UI/gateway: clear queued browser connect timeouts on client stop so aborted or replaced gateway clients do not send delayed connect requests after shutdown. (#57338) thanks @gumadeiras.
• Control UI/gateway: reconnect the browser client when gateway event sequence gaps are detected, so stale non-chat state recovers automatically instead of only telling the user to refresh. (#23912) thanks @Olshansk.
• Exec approvals/channels: unify Discord and Telegram exec approval runtime handling, move approval buttons onto the shared interactive reply model, and fix Telegram approval buttons and typed /approve commands so configured approvers can resolve requests reliably again. (#57516) Thanks @scoootscooob.
• Gateway/SQLite transient handling: keep unhandled SQLITE_CANTOPEN, SQLITE_BUSY, SQLITE_LOCKED, and SQLITE_IOERR failures non-fatal in the global rejection handler so macOS LaunchAgent restarts do not enter a crash-throttle loop. (#57018)
• Hooks/plugins/skills: block workspace .env overrides for bundled root directories so workspace startup cannot redirect bundled trust roots away from the packaged defaults. Thanks @nexrin and @vincentkoc.
• LINE/webhooks: cap shared concurrent pre-verify webhook body reads so excess requests are rejected before entering the LINE body handler. Thanks @nexrin and @vincentkoc.
• Memory/QMD: preserve explicit custom collection names for shared paths outside the agent workspace so memory_search stops appending -<agentId> to externally managed QMD collections. (#52539) Thanks @lobsrice and @vincentkoc.
• Memory/builtin: keep memory-file indexing active in FTS-only mode (no embedding provider) so forced reindexes no longer swap in an empty index and wipe existing memory chunks. (#42714) Thanks @asamimei.
• Nostr/config: redact channels.nostr.privateKey in config snapshots and Control UI config views, so Nostr signing keys no longer appear in plain text. Thanks @ccreater222.
• Plugin approvals: accept unique short approval-id prefixes on plugin.approval.resolve, matching exec approvals and restoring /approve fallback flows on chat approval surfaces. Thanks @vincentkoc.
• SSH sandbox/upload: reject workspace symlinks that resolve outside the uploaded tree before syncing to the remote sandbox, so later agent writes cannot be redirected through escaped links. Thanks @AntAISecurityLab and @vincentkoc.
• Slack/interactive replies: resolve Slack Block Kit reply delivery from both authored channelData.slack.blocks payloads and directive-generated interactive replies, and keep Slack button styles mapped onto valid Block Kit button rendering so interactive replies stop dropping on Slack-specific delivery paths. Thanks @vincentkoc.
• Subagents/announcements: preserve the requester agent id for inline deterministic tool spawns so named agents without channel bindings can still announce completions through the correct owner session. (#55437) Thanks @kAIborg24.
• Telegram/Anthropic streaming: replace raw invalid stream-order provider errors with a safe retry message so internal message_start/message_stop failures do not leak into chats. (#55408) Thanks @imydal.
• Tlon/media: route inbound image downloads through the shared media store, cap each download at 6 MB, and stop after 8 images per message so large Tlon posts no longer balloon local media storage. Thanks @AntAISecurityLab and @vincentkoc.
• Agents/live switch: stop transient cron and subagent model overrides from being misread as persisted live-session switches, so isolated runs no longer fail with LiveSessionModelSwitchError. Thanks @vincentkoc.
• Agents/tool-call repair: recover malformed Kimi/OpenRouter tool-call argument streams when provider preambles appear before JSON payloads, and fail closed on non-tool leading text so fragment strings do not leak into filesystem path arguments during sub-agent runs. (#56560) Thanks @Originalwhite.
• Gateway/startup: keep configured primary-model warmup on the static model path so container boots do not snapshot-load provider runtime graphs just to validate a configured model. Thanks @vincentkoc.
• OpenAI/Responses: omit disabled reasoning payloads across OpenAI, Codex, and Azure OpenAI request builders so GPT-5 endpoints no longer reject reasoning.effort: "none". (#58208) Thanks @jalehman.
• WhatsApp/outbound: restore runtime send/action routing and outbound compatibility after the recent channel seam refactor so outbound sends, reactions, and related media actions keep reaching the active session.
• xAI/Responses: normalize image-bearing tool results for xAI responses payloads, including OpenResponses-style input_image.source parts, so image tool replays no longer 422 on the follow-up turn. (#58017) Thanks @neeravmakwana.
• Zalo/webhooks: scope replay dedupe to the authenticated target so one configured account can no longer cause same-id inbound events for another target to be dropped. Thanks @smaeljaish771 and @vincentkoc.
• Plugins/prompt build: preserve the highest-priority systemPrompt when merging before_prompt_build hook results instead of letting lower-priority hooks overwrite it. (#58375)
• Tlon/settings migration: preserve explicit empty-array settings during migration so restart-time reseeding no longer restores older file-config values. (#58370)
• Plugins/marketplace: harden marketplace archive installs by surfacing guarded download failures as structured install errors and deriving temp filenames from the final resolved URL. (#58267)
• UI/DOM safety: build the chat delete-confirm popover and Canvas Host fallback status line with DOM nodes instead of injected HTML strings. (#58269, #58266)
• Media/file handling: create image temp work directories under the shared OpenClaw temp root and stop widening allowed local media roots from reply or tool source paths, keeping local media access limited to configured and agent-scoped roots. (#58270, #57770)
• Telegram/security: migrate legacy pairing allowFrom state to the default account only and gate group voice-message preflight transcription on sender authorization so unauthorized senders cannot trigger paid transcription before being dropped. (#58165, #57566)
• Exec approvals: stop shell init-file flags from matching persisted script-path approvals, detect command-carrier inline eval in tools like awk, find, xargs, make, and sed, and treat the awk family as interpreter-like so allow-always decisions no longer persist interpreter paths. (#58369, #57842, #57772)
• Voice call/Telnyx: canonicalize verified webhook signatures before deriving replay keys so equivalent Base64 and Base64URL encodings dedupe correctly. (#57829)
• Gateway/HTTP trust boundaries: ignore self-declared bearer scopes, deny dangerous HTTP tool-invoke paths by default, require write scope on /v1/embeddings, and bind OpenAI-compatible /v1/chat/completions plus /v1/responses ingress as non-owner so external HTTP callers cannot self-upgrade access. (#57783, #57771, #57721, #57769, #57778)
• Gateway/trusted config and bootstrap: clear self-declared scopes for device-less trusted-proxy WebSocket connects and trim the Control UI bootstrap payload to only the fields needed before the normal handshake. (#57692, #57727)
• Skills and workspace safety: replace raw skill-file reads with a symlink-safe, root-confined loader and pin workspace-only apply_patch delete and directory-creation mutations to verified workspace roots so path rebind races fail closed. (#57519, #56016)
• Env and filesystem hardening: block credential and gateway auth env vars from workspace .env files, always strip dangerous inherited host env vars such as BROWSER and GIT_EDITOR, and keep sensitive host paths and OpenClaw state roots blocked even when external sandbox bind sources are allowed. (#57767, #57559, #56024)
• OpenShell and ACP file boundaries: skip symlinks and preserve trusted host-only directories during OpenShell mirror sync, and route ACP attachment reads through the shared attachment cache so local files outside allowed roots are no longer forwarded. (#57693, #57690)
• Channel/webhook authorization: skip Discord audio preflight transcription for unauthorized guild senders, add a shared pre-auth in-flight guard to Synology Chat webhooks, and validate Microsoft Teams bearer auth before JSON body parsing. (#57695, #57722, #57686)
• Infra/randomness: replace Math.random() in affected identifier and delay-jitter paths with shared secure-random helpers, including UI UUID generation. (#57744)