npm openclaw 2026.10.5-beta.2
openclaw 2026.10.5-beta.2
on Node.js NPM

4 hours ago

2026.10.5-beta.2

Highlights

  • Updates finish and recover: openclaw update settles stale handoff leases, completed receipts, and legacy 2026.9.8 recovery records instead of stopping on update-recovery-pending, keeps the service heap limit and webhook listeners, handles Windows short-name paths, and no longer reports accepted handoffs or successful updates as failures. (#169038, #169027, #168388, #168889, #169035, #169292, #168927, #168993, #169037, #169454, #168905) Thanks @mkdelta221, @waynegault, @chedong, @k94118, @bluet, @sirius1024, @RomneyDa, @sayitfast, and @hannesrudolph.
  • Doctor keeps your plugins and data: Doctor preserves installed plugins' configuration when path safety checks block them, leaves malformed UTF-8 root memory files untouched, and recovery copies capture Canvas and Memory Core files before migrations move them, including on installs with no configured agents. (#168111, #169029, #169436, #169516) Thanks @obviyus, @wangmiao0668000666, and @RomneyDa.
  • Approved tool calls stay as approved: hooks can no longer change tool arguments after a trusted inline approval; plugins that transform arguments must request approval for their final arguments. (#142700) Thanks @giodl73-repo and @giodl73.
  • Subagent message provenance: inter-session messages keep their [Inter-session message] safety envelope from the first request and through replay, so parent-sent instructions are never presented to a child as direct user instructions. (#169130, #169238) Thanks @RomneyDa.
  • Control UI turns keep running: chat turns from paired devices survive ordinary pairing activity such as node heartbeats, other devices' updates, and tab reconnects; real revocations still stop them. (#169457, #169134) Thanks @Oldrich333.

Changes

  • Tool approval hooks: ordinary hooks can no longer rewrite trusted-inline-approved tool arguments without another approval, and transforming plugins must request separate approval for their final arguments or the call is blocked; see docs/plugins/hooks/tool-policy.md for migration. (#142700) Thanks @giodl73-repo and @giodl73.
  • Codex runtime compatibility: plugin admission rejects official Codex runtimes below 2026.9.7 with update and repair guidance, and incompatible plugins stay inspectable without being imported. (#168930, #168748, #168749, #168977) Thanks @ezimerman.
  • Session notices: creating many sessions gives the main session one summary of new sessions instead of separate notices that crowd out reminders and wakes. (#168239)
  • Update performance: updates stop rehashing unchanged runtime files while retaining the running updater and publishing the candidate, reducing update I/O. (#168958)

Fixes

  • Tool Search provenance: network results reached through Tool Search and Code Mode now taint the turn the same way direct network tool calls do. (#169560, #169332) Thanks @RomneyDa and @farisoftfry.
  • Subagent provenance: child sessions keep the inter-session safety envelope on every replayed turn, and inter-session turns keep a stable provider prompt prefix across later turns and Gateway restarts. (#169130, #169238) Thanks @RomneyDa.
  • Node commands and approvals: approved node commands replay when their prepared plan omitted session identity, Windows node shell commands keep quoted arguments, safe-bin commands accept trailing whitespace, and the Linux node service keeps its PATH when the login shell resets it. (#161980, #151622, #158160, #142847, #168120, #136677, #134354) Thanks @Program-123, @gaojian125, @Dimitri-lcht, @igs-rogenlo, @yetval, @harjothkhara, and @abacha.
  • Private reasoning: unfinished model reasoning stays private when a reply hits a token limit or content filter after a tool call. (#168294)
  • Doctor data safety: Doctor keeps blocked plugins' authored entries, enablement, policy, and slots; refuses to merge malformed UTF-8 root memory; captures Canvas and Memory Core files in new recovery copies (and works on installs with no configured agents); skips redundant cron backups for unchanged one-shot jobs; and honors Windows permissions for SQLite recovery snapshots. (#168111, #168066, #169029, #168567, #169436, #169516, #168938, #168838, #169397) Thanks @obviyus, @wangmiao0668000666, @RomneyDa, @harshitgupta31415, and @WG-Mojo.
  • Memory: daily-note flushes reject copied saved content instead of repeating blocks, and correcting an embedding provider's endpoint or credential refreshes cached index managers without a Gateway restart. (#168123, #151263, #151055) Thanks @ruel225 and @Mirksen.
  • Restart recovery: main sessions that were mid-turn during a Gateway restart resume on the next boot, interrupted completion replies are delivered instead of lost, and new replies wait for their agent to finish starting instead of failing with prepared reply dispatch runtime owner was not published. (#168651, #167814, #167766, #168826, #157814) Thanks @goutamadwant, @marknilsn, and @xiaozishan.
  • Reply routing: WebChat task completions stay in WebChat, mirrored external sends no longer change a transcript's reply destination, and Reef carries GitHub commit links without flagging their revision IDs as credentials. (#168248)
  • Prompt caching: conversations whose first message ends in whitespace keep a byte-stable prompt prefix, and OpenAI-compatible and local endpoints keep runtime context in a user-role message. (#168725, #168546, #164791) Thanks @flanker-stack.
  • Compaction: sessions skip a redundant host compaction after native-only compaction, safeguard compaction keeps configured AGENTS.md sections, and memory-flush runs keep provider-native compaction off. (#168051, #168015, #168446, #168131, #168164) Thanks @ruel225, @xydigitLybnnnn, @robertoronderosjr, @jakeaadams, and @obviyus.
  • Control UI: chat turns survive unrelated pairing activity, typed /stop also cancels queued turns for the session, and open chats recover after a Gateway update or recovery reload instead of sticking on Server updated → Retry now, keeping their place. (#169457, #169134, #167860, #167859, #168941, #169194) Thanks @Oldrich333 and @masatohoshino.
  • Telegram: polling connects again when the ingress worker runs from a source checkout or packaged plugin build, and tables next to quotes or lists keep their boundaries and values. (#154286, #154180, #168383, #168366) Thanks @xydt-juyaohui, @markfietje, @dhruv1220, and @barry-ssb.
  • Channels and voice: channels start again after a stopped-Tailscale failure, the Matrix probe stops its client after checking identity, and openclaw voicecall steer keeps stdout machine-readable JSON. (#162266, #168587) Thanks @RomneyDa.
  • Agent turns: scheduled and ordinary turns reach the configured fallback after a provider timeout, queued follow-ups that switch model clear the auto-fallback probe, cancelled queued CLI work never runs, empty stream heartbeats no longer count as model progress, malformed tool calls whose argument length is 401 or 403 are not reported as auth failures, valid tool argument union values keep their type, and plugin completions keep working after another plugin reloads. (#168605, #160440, #160428, #169303, #145850, #168500, #168450, #158974, #168916, #156026) Thanks @hxy91819, @changeroa, @RileyJJY, @TYY-2005, @r3n3x, @Shenrui-Ma, and @jalehman.
  • Claude CLI: Claude CLI models stay listed after another plugin's config changes, exec-completion turns keep their native and MCP tools, and saved session MCP server selections apply on the next turn. (#168315, #168670, #168342, #168393, #168207) Thanks @obviyus, @Oldrich333, and @dprev.
  • OpenRouter prompt caching: cache-TTL context pruning now arms for Grok and Gemini 2.5+ models on OpenRouter. (#169548, #169133) Thanks @RomneyDa and @gregb100.
  • Models and providers: API-key sign-in discovers the provider's models immediately, shared OAuth credentials refresh with historical agent stores, switching back to an OpenAI model works without the Codex plugin, timed-out Codex discovery clients are reaped, LM Studio waits for slow model loads instead of overflowing a fresh session, and credential removal during a model reload no longer leaves a restart warning. (#168617, #168957, #169412, #168365, #168044) Thanks @obviyus.
  • Model catalog memory: a long-running Gateway's model-catalog worker evaluates an unchanged installed native ESM plugin once per workspace instead of retaining another copy of its module graph on every config change, and a failed native refresh re-registers the requested config on the next request. (#169272, #169321, #159662) Thanks @obviyus, @mcooks-cmd, @RomneyDa, and @svdinu-jpg.
  • MCP computer control: computer control is released with its run, so later calls no longer fail with COMPUTER_HOST_BUSY. (#151127, #147420) Thanks @ylcn91 and @vovarbv.
  • Automations: cron target and payload validation errors are reported as invalid requests, and Workboard fallback runs stay active until the overall outcome settles. (#169102, #168215, #167574) Thanks @obviyus, @skyzhao1223, and @asikorskiy.
  • Agents API sessions: saved remote sessions continue with the same session ID across binding upgrades. (#168150)
  • Large Gateways: large fleets reserve session stores without stack overflows, and process-owning Gateway stops no longer wait on native skills watcher cleanup. (#168354, #168160, #168273) Thanks @609NFT and @obviyus.
  • Updates and recovery: managed updates settle eligible stale package recovery after a lost or replaced handoff lease database and archive completed receipts before the next preparation; --dry-run only reports the planned settlement. (#169038, #167506, #167771) Thanks @mkdelta221 and @waynegault.
  • Legacy update records: 2026.9.8 package recovery records settle by identity and version after metadata drift, completed-receipt identity drift no longer blocks updates, and public repair exits nonzero with guidance when a journal stays pending. (#169027, #168856, #168388, #168092) Thanks @chedong, @k94118, and @RomneyDa.
  • Update outcomes: accepted Gateway update handoffs are not reported as failures, recorded successes stay successful with a warning about stopped channels, original failures survive unavailable cleanup reporting, repaired migrations stop producing stale warnings, package verification tolerates clock jumps, and migrated-state failures point to openclaw update repair. (#168993, #168870, #169037, #169454, #169004, #168835, #168905) Thanks @sayitfast, @hannesrudolph, and @WG-Mojo.
  • Update memory and webhooks: update children inherit the managed service's heap limits so Doctor finishes on large agent databases, and official webhook plugins deferred during candidate Doctor keep their listeners, including Teams' historical port 3978. (#168889, #168729, #169035, #168872) Thanks @bluet and @sirius1024.
  • Update runtimes: updater workers stay on the retained runtime and openclaw doctor --fix reclaims retained runtimes when the install path uses a Windows short (8.3) name or different casing, and updates no longer copy unrelated dependencies into the retained runtime. (#169292, #168927) Thanks @RomneyDa.
  • Update diagnostics: an unsealed original-state capture warning names the affected database, and a candidate config read failure warning includes its reason. (#169282, #169259, #169284, #169261) Thanks @DonnieFi.
  • Codex Ultrafast: ChatGPT sign-in sessions keep Ultrafast on resumed turns instead of dropping to Fast after the first turn. (#169265, #169264) Thanks @SanderHelgesen.
  • npm-global updates: the updater runtime keeps only OpenClaw's own dependencies instead of every unrelated package in the global node_modules. (#169551, #169373) Thanks @RomneyDa and @holgergruenhagen.
  • Update exit handling: a completed update whose result reporting fails exits with its warning instead of opening interactive failure triage. (#168587)
  • Doctor maintenance: Doctor and update repair enter maintenance on a running systemd Gateway even when checking a large state database is slow. (#168161, #168031) Thanks @obviyus and @Tosko4.

Complete contribution record

This audited record covers the complete v2026.10.5-beta.1..8ed6123 history: 91 in-range PRs + 0 retained seed-only PRs = 91 unique PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact.

Shipped baseline exclusions: v2026.10.5-beta.1 (3 PRs: #134837, #144420, #167460).

Pull requests

Release verification

Check out latest releases or
releases around openclaw 2026.10.5-beta.2

Don't miss a new openclaw release

NewReleases is sending notifications on new releases.

Get notifications