0.38.0 (2026-09-21)
Features
- beacon: schema v2 — routing/compression training signal, gzip transport (#3253) (67eb910)
- cache: add the headroom-cache-ttl offline TTL estimator the docs reference (#2670) (52c7aa2)
- dashboard: Cost Saved headline card; label per-row savings as message-only (#3353) (17b0412)
- dashboard: show routing savings for this session and all time (#3362) (a811984)
- proxy/model-router: add require_tools route condition (#2362) (ae75ca4)
- proxy: accept the OpenAI Responses shape on the gateway turn (#3661) (be00a79)
- proxy: full-savings cost card, cache-aware tool-schema pricing, routing-stats seam (#3351) (b8fa3ad)
- router: elide dense machine-generated lines no compressor can shrink (#3685) (9263b42)
- vertex: add Gemini 3.8 Flash agent benchmark suite (#3371) (e67b3c8)
Bug Fixes
- attach stdin for docker-native MCP stdio (#3447) (a490bba)
- auth: match the Bearer auth scheme case-insensitively (RFC 7235) (#3219) (75105e2)
- cache: keep cached-prefix replay after background recompression (#3380) (aebe989)
- ccr: log the exception type when a CCR continuation call fails (#3137) (9f75f91)
- changelog-gen: raise on git failure and remove unreachable fallback regex (#1247) (4e1f776)
- compression: compress cache_control blocks in the request's final message (#3483) (55d7e64)
- compression: pause AST compression per language after repeated invalid-syntax discards (#3387) (dde83c9)
- compression: preserve Bash control flow (#3425) (ee90207)
- compression: protect Bash before the tree-sitter guard, not after (#3435) (ee6f9db)
- dashboard: make every control keyboard operable and name icon-only controls (#3434) (15debbe)
- dashboard: report Headroom-attributable cost savings, not the provider cache discount (#3356) (bfe3c78)
- deps: bump anyio to 4.14.2 for CVE-2026-63374 and CVE-2026-64847 (#3662) (bc21c93)
- deps: install on Python 3.14 from prebuilt wheels only (#3631) (b8b222f)
- deps: remediate vulnerable CLI and plugin dependency trees (#3521) (4263da1)
- deps: upgrade rustls to 0.23.45 for RUSTSEC-2026-0285 (#3584) (b256d25)
- doctor: detect Codex routing via active provider base_url (#2618) (4794d68)
- e2e: lock CLI dependencies for reproducible wrap builds (#3512) (5abcdbd)
- fix security issue in server.py (#3593) (97aa949)
- hold Cursor's read_file byte-exact too (d02e7df)
- keep dashboard route boundaries out of upstream passthrough (#3324) (213b371)
- keep file-read tool output byte-exact through the lossless fold (59499f7)
- kompress: append the CCR marker whenever the saving pays for it (#3484) (7bd4dba)
- kompress: bound download retry backoff before overflow (#3630) (a7858fd)
- langchain: implement get_metrics() on HeadroomChatModel (#3446) (#3459) (dba5d2f)
- langchain: make the integration work on LangChain 1.x, and document it (#3399) (5d025f7)
- learn: count each tool call once per tool_call_id when detecting loops (#3462) (4088a65)
- learn: derive loop signature from tool input identity, not display summary (#3461) (f6b9fc0)
- learn: distinguish Grep and Glob searches by path (#3455) (f302a38)
- learn: echo live progress during claude-cli analysis (#3158) (4c6bd3e)
- learn: guard session-derived path checks against PermissionError in gemini/grok plugins (#2522) (60bfe8b)
- learn: prevent Windows CRLF accumulation in context writers (#3594) (3c1a901)
- learn: prevent Windows CRLF accumulation in context writers (#3594) (abde3e6)
- learn: retry LLM analysis with a smaller digest when the prompt overflows the context window (#3404) (d329a04)
- learn: show both ends of CLI output on a parse failure (#3517) (cb3ab61)
- litellm: preserve Anthropic thinking blocks; fix OpenAI-in reasoning passthrough (#3586) (9f32800)
- mcp: report a plugin-provided Serena that reconcile cannot see (#3578) (35b1156)
- memory: honor project root override for Anthropic CCR (#3606) (91fd58d)
- never grep-fold timestamped logs, size-weight savings, warn on no-op model limits (#3419) (73a6edb)
- openclaw: delegate native compaction (#2304) (eb4da64)
- output-savings: count conversations, not requests, in the holdout gate (#3460) (53631ad)
- perf: a bad savings row must not take down the whole report (7b3d226)
- preserve JSON object fields in SmartCrusher (#3648) (545f544)
- pricing: price savings against the cache mix, not flat list price (#3699) (89a58fd)
- protect Cursor's read_file in the core, not only in the plugin (e23e739)
- proxy/memory: fail open when backend init errors instead of 500ing the request (#3257) (3eba2d6)
- proxy/openai: keep /v1/responses savings triple coherent when schema savings exceed message tokens (#3106) (7278b5c)
- proxy: bound decompressed request bodies to close a zip-bomb DoS (#3325) (25a4e71)
- proxy: enforce budget limits on OpenAI and Gemini routes (#3579) (f734c57)
- proxy: gateway turn contract for /v1/compress behind a compress-turn seam (#3605) (d9757dc)
- proxy: gateway turn fixes found by benchmarking behind a gateway (#3619) (aceff2e)
- proxy: honor compression controls for Anthropic auxiliary passes (#3400) (fb79055)
- proxy: keep json_bloat waste signals out of the catch-all lifetime bucket (#3430) (e59cf10)
- proxy: keep non text blocks in place when relocating system sections (#3553) (964671d)
- proxy: keep OpenCode Zen /responses requests streaming (#3659) (6f404de)
- proxy: prefer explicit proxy auth header (#3422) (f3965f7)
- proxy: protect Codex exec file reads on the Responses path (#3621) (2c56a1b)
- proxy: record streaming upstream 5xx as failed instead of success (#2682) (4949cd5)
- proxy: repair tool-search history in place so signed thinking blocks keep their coordinates (#3457) (68359c0)
- proxy: stop get_recent deep-copying dropped message payloads (#3613) (44b8e7b)
- proxy: support Codex Live HTTP call creation (#3464) (53982ae)
- proxy: write per-port proxy logs so concurrent instances stop truncating each other (#3204) (3d3c629)
- read-maturation: book matured Read savings once, not on every replay (#3414) (85f58a9)
- release: use Node 24 for npm packaging and publishing (#3516) (aab500b)
- route_advice: per-inbound-protocol native providers (enable OpenAI-in → Claude-out) (#3585) (dc28413)
- savings: count compression savings once per conversation, not once per turn (#3480) (427fa76)
- sdk: emit the final SSE event when the stream has no trailing newline (#3581) (ebc0b36)
- serialize PyTorch device transfers with Kompress execution (#3601) (3dfa7da)
- shaper: measure output-token steering, and stop claiming savings we did not measure (#3377) (1390d89)
- spreadsheet: render an .xls cell the way the .xlsx loader renders it (#3616) (261796f)
- stabilize release checks and consolidate dependency updates (#3531) (04cdf79)
- stats: gate the output-shaping claim on the shaper being active (#3386) (074f0ae)
- stats: stop rejected upstream turns from feeding the savings funnel (#3615) (85fac8c)
- storage: parse absolute Windows paths from URLs (#3475) (db5ed58)
- tabular: pass a table through when one cell is past the csv field limit (#3618) (334317d)
- tests: isolate persisted settings from developer state (#3449) (0d99e55)
- tokenizers: estimate replayed thinking from text and signature size (#3482) (9ed95c3)
- transforms: classify grep -A/-B/-C context lines as search results (#3599) (f085c47)
- transforms: isolate ContentRouter per-request runtime state across concurrent requests (#3556) (0bef398)
Performance Improvements
- cache: purge expired CCR rows by deadline instead of decoding every payload (#3465) (389e45c)
- ccr: bound retrieval history with a deque instead of reslicing (#3471) (3169935)
- dashboard: poll once at a time and initialize once (#3470) (3201bab)
- render the savings each source actually reported (56f809c)
Dependencies
- bump baseline-browser-mapping from 2.10.16 to 2.11.21 in /docs (#3501) (0fcdf21)
- bump next from 16.3.0 to 16.3.4 in /docs (#3499) (2503bd7)
- bump sharp from 0.35.3 to 0.35.4 in /docs (#3500) (d6ad35d)
- bump the cargo-minor-patch group across 1 directory with 5 updates (#3642) (e326dd7)
- bump the npm-minor-patch group across 3 directories with 6 updates (#3622) (2d5909c)
- bump vitest from 4.1.10 to 5.0.0 in /plugins/openclaw (#3498) (bb057d2)
- bump vitest from 4.1.10 to 5.0.0 in /sdk/typescript (#3496) (6f1251f)