openclaw 2026.8.1 on Node.js NPM

2026.8.1

2026.8.1 release notes

Update help: If the automatic update fails, use a local coding harness to help complete the update, diagnose any migration errors, and verify that the Gateway starts correctly. Back up your configuration and state before making changes.

Highlights

Find past conversations: search visible conversation text by exact words or phrases and reopen the surrounding messages from a matching result. (#105057, #105635, #105585) Thanks @hercial61.
Sessions beyond your Gateway: run work on paired devices or cloud workers, move the session workspace with it, and reuse warm machines and project seeds for later cloud sessions. (#123280, #127752, #131744, #132374)
Follow work as it happens: keep a durable session progress card through reloads and follow subagent activity and accumulating edits across web and native chat. (#125125, #125438, #125442, #125444, #121549, #121840, #121815, #121813)
Answer clearly: respond to structured agent questions through web and native cards, messaging buttons, or plain text, with free-text alternatives and an explicit Skip path. (#109922, #110372, #130262) Thanks @obviyus.
Interactive results and dashboards: use widgets in chat, pin them to session dashboards, grant specific actions or network origins, and export rendered views as images. (#101840, #108983, #110960, #127315) Thanks @hannesrudolph.
Private credential requests: let your agent request a credential through a masked prompt without putting its value in chat or model context, and use an opt-in proxy to limit protected-secret substitution to approved destinations. (#129670, #123216, #132122)
Approve recurring work once: grant an automation permission for an exact operation, inspect or revoke that permission later, and require a fresh approval when the job or operation changes. (#129526, #131602)
Richer audio and video: keep media attached to the conversation across uploads, generated replies, playback, and reloads, with native playback controls and video uploads on Apple and Android clients. (#115842, #116051, #116037)

Changes

OpenProse migration (breaking): remove the bundled OpenProse plugin and /prose command; run openclaw doctor --fix to clean stale configuration and follow the upstream Agent Skill migration, keeping existing .prose source files. (#128494) Thanks @obviyus and @vincentkoc.
OpenAI route migration (breaking): use openclaw doctor --fix to migrate shipped codex/* and openai-codex/* model refs, provider config, stored sessions, and automation routes to openai/*, retaining Codex runtime intent and flagging conflicts for operator repair. Thanks @vincentkoc.
Upcoming deprecations (2026-09-01): external plugins should migrate ahead of the SDK removal gate: plugin-sdk-config-runtime-subpath moves to api.pluginConfig and the focused openclaw/plugin-sdk/config-mutation, openclaw/plugin-sdk/runtime-config-snapshot, or openclaw/plugin-sdk/config-contracts imports; plugin-sdk-channel-reply-pipeline-subpath and plugin-sdk-channel-lifecycle-subpath move to openclaw/plugin-sdk/channel-outbound; plugin-sdk-channel-message-subpath moves to openclaw/plugin-sdk/channel-outbound and openclaw/plugin-sdk/channel-inbound; plugin-sdk-infra-runtime-subpath moves to focused openclaw/plugin-sdk/ imports such as delivery-queue-runtime, diagnostic-runtime, error-runtime, exec-approvals-runtime, fetch-runtime, and ssrf-runtime, according to the helper used. These are upcoming gates, not removals in this release; see the SDK migration guide for per-helper mappings and remaining compatibility limits.
Official provider packages: install BytePlus, ComfyUI, Mistral, NovitaAI, OpenCode, Synthetic, Volcengine, Vydra, and Xiaomi as needed through onboarding. Recover missing configured packages with openclaw update repair or openclaw doctor --fix; complete requested capability review and restart the Gateway after explicit installation. OpenCode Go remains bundled. (#116866, #116888, #116919, #117007, #117035, #116720, #116854, #116813, #116861) Thanks @vincentkoc.
Additional official packages: install Cohere and Meta providers, DuckDuckGo search, Voyage embeddings, and iMessage messaging as separate official plugins when needed; configured missing owners use the same explicit update, doctor, or install recovery flow. (#116662, #116740, #116785, #117101) Thanks @vincentkoc.
OpenAI long-context opt-in: make expanded active-input context an explicit model configuration choice, keeping the runtime budget distinct from the model's native capacity and preserving configured overrides. (#112916)
Personal conversation recall: with Active Memory enabled, retrieve bounded same-agent private conversation context by default on personal installs without configured DM isolation; explicit controls can disable recall, and groups and channels remain excluded. (#110597)
Grounded dreaming: enable model-backed background memory consolidation by default, promoting provenance-qualified material into long-term memory with a Dream Diary and an explicit disable control. (#114819)
Automatic self-learning: capture strong reusable lessons and automatically apply scanner-approved new or Workshop-owned skills by default, while leaving user-authored skill changes pending and preserving explicit off or propose settings. (#115576)
Session reset default: keep conversations across idle periods and day boundaries when no reset policy is configured; retain explicit daily or idle policies and manual /new or /reset. (#111140)
CPU-scaled foreground concurrency: size default top-level agent concurrency from available CPU parallelism, bounded between 8 and 16 simultaneous runs, while preserving explicit operator limits. (#114047)
Explicit model allowlists: separate aliases and per-model settings from explicit modelPolicy.allow restrictions, with per-agent policies and provider wildcards; doctor migrates valid legacy restrictions without silently opening access when migration is incomplete. (#110888) Thanks @vincentkoc.
Remembered model selection and explicit scopes: choose whether a model change affects this session, its agent, or the shared default; preserve existing surface behavior when no scope is set, including session-only Telegram callback picks and local TUI selection. (#115717, #127813) Thanks @Marvinthebored and @Peetiegonzalez.
Conversation-bound automations and loops: default new agent-turn automations to their originating conversation when creation has session context. Owner-only /loop supports fixed-interval or self-paced checks; context-free CLI/API creation stays isolated. (#114328)
Owner-directed ambient heartbeat: send ambient heartbeat alerts to a resolvable owner DM by default and skip unroutable ambient polls; configure an owner or explicit target instead of relying on a previous group conversation. (#121988) Thanks @obviyus.
Named agent setup: choose the first agent name during interactive onboarding or with --agent-name, migrate legacy main-session history to its clear owner, and reuse main as an ordinary agent ID after required doctor repairs. (#123521, #123609, #123424, #123349)
Clearer plugin trust: review an external plugin's capabilities, source, version, and exact artifact before install or enablement, while keeping the previous plugin unchanged if you decline an update. (#130168) Thanks @vincentkoc.
Plugin install provenance warnings: require --force for arbitrary executable plugin sources in CLI/chat installs. Trusted ClawHub, bundled, official-catalog, and tracked-update sources skip that provenance warning, but retain capability consent. Crestodian installs require trusted sources. (#102197) Thanks @jesse-merhi.
Session permission modes: choose an explicit session permission mode and keep restricted filesystem access anchored to its recorded workspace or worktree, while newly created worktrees inherit configured policy unless a mode is selected. (#124909, #131547, #132989)
Team operator roles: assign verified users named roles that limit accessible agents, other people's sessions, and operator scopes, and optionally require sandboxed execution for newly created sessions; these are collaboration controls, not hostile-tenant isolation. (#128548, #129926)
Shared credential store: manage team-scoped secret and environment entries in SQLite through the CLI and Settings; keep secret values write-only, bind protected egress to declared hosts, and distinguish readable environment values from secrets. (#121559, #121724, #126088)
Optional 1Password broker: resolve curated SecretRefs or read selected 1Password fields with service-account auth, per-secret approval, and value-free audit. Agent-tool reads expose the selected value to the model for that execution. (#106133)
Usage statistics controls: offer opt-in feature statistics with the daily version check. Inspect payloads with openclaw telemetry show; disable statistics or all automatic update requests. Feature statistics default off. (#128476)
Incognito threads: keep Control UI conversation transcripts and compaction state in Gateway memory until restart, with memory flush off. Provider processing, diagnostic logs, and explicit tool writes retain their own behavior. (#113006) Thanks @vincentkoc.
Guided onboarding: guide first-run setup through Custodian with structured option cards and native setup controls. (#109841, #110141, #114631) Thanks @jesse-merhi.
Local model setup: offer model-download actions in web and macOS onboarding, prefer stronger available local models during detection, and provide lean mode for local runtimes. (#113476, #109250, #110596)
Quick Chat and desktop setup: add macOS dictation, paste-to-app and model controls, Linux agent switching and per-agent routing, and a more complete Linux onboarding flow. (#110994, #110285, #129815)
Cloud setup: select project-specific cloud worker defaults and see the active service, profile, machine resources, and worker-slot availability in placement controls. (#126238, #125696, #132405, #132394)
Cloud worker bootstrap: use the running Gateway’s verified runtime artifact for cloud nodes, aligning source builds and worker packages. Images need supported Node.js, npm, and registry access; reverse proxies must forward the authenticated bootstrap-artifact route. (#133037)
External supervision: set OPENCLAW_SUPERVISOR_MODE=external to let an external supervisor own Gateway restarts, service lifecycle, and updates without competing native service changes. (#109162, #119846, #121069) Thanks @shakkernerd and @vincentkoc.
ClickClack setup and commands: connect ClickClack with a one-use expiring setup code, verify the account immediately, and publish native command menus at Gateway startup when the token has commands:write. (#107907, #109398) Thanks @shakkernerd.
Memory migration: offer detected Claude Code, Codex, and Hermes memory imports during CLI, macOS, and Linux onboarding. (#108977)
Plugin uninstall cleanup: remove exact recorded install paths from plugins.load.paths for marketplace, npm, and other managed installs while preserving parent, child, prefix, and unrelated paths. (#118930) Thanks @vincentkoc.
Recoverable backups: schedule recorded database backups, keep versioned snapshots in an operator-owned Git repository, and restore a verified full archive into a fresh staging directory. (#122485, #122750)
Shared Gateway profiles: manage display names and avatars, see who is online, and retain session-creator attribution with person filters. (#111224, #111421, #111501, #112658) Thanks @joshavant.
Cloud lifecycle: suspend idle cloud workers after a configured interval and provision a replacement on the next message, preserving the session and reconciled workspace. (#130242)
Development previews: expose agent-run development servers through authenticated Portals, including supported node-backed cloud workers, without manually opening inbound worker ports. (#122536, #130105)
Device hosting: opt paired machines into session hosting with one-paste onboarding and enable native session hosting from the macOS app. (#122499, #131717)
Daytona sandboxes: add a Daytona backend plugin for isolated cloud execution. (#121554) Thanks @mislavivanda and @Patrick-Erichsen.
Task suggestions: name the suggestion-card tool suggest_task so agents can propose follow-up work without implying that it has started, with doctor migration for persisted references to the old name. (#121694)
Goals: create and manage goals from the Control UI without entering slash commands. (#131370)
Workboard: link boards to owning automations, run attached automations when linked sessions finish, and show complete boards on session dashboards. (#125076, #125170, #125094) Thanks @vincentkoc.
Agent interoperability: add an opt-in A2A 1.0 channel plugin for authenticated text tasks, task polling, and messages to configured peer agents. (#130008)
Email triggers: start agent work from configured inbound IMAP mailboxes through a new plugin. (#130230)
Approval surfaces: show typed operation-scope summaries on channel cards, add native Teams approve/deny controls, and deliver opted-in PWA approval notifications. (#130116, #129997, #129348) Thanks @Takhoffman.
Session organization: carry session colors across web and native apps, group the web sidebar by project, and search sessions and connected catalogs from the command palette. (#132570, #131543, #128356) Thanks @VACInc.
Safer startup repair: apply safe doctor configuration migrations at Gateway startup before normal operation. (#132135)
ClawHub review: show available security-audit information before a plugin install. (#131233) Thanks @Patrick-Erichsen and @vincentkoc.
Debugging handoff: add openclaw triage for sanitized agent-debugging handoffs. (#128756)
Shared conversation terminals: share a conversation terminal across browser viewers, and let the agent inspect or operate an operator-opened terminal within that exact session and its permission policy. (#109005, #129604)
Terminal uploads: drop files into a terminal with per-file upload progress, cancellation, and retry, then insert safely quoted paths without running a command. (#107364, #107789)
Experimental Fleet: provision and manage separate experimental OpenClaw cells on a local Docker or Podman host, with per-cell resources, logs, diagnostics, and backup/restore. (#104527, #104669, #104814, #104828)
Experimental Swarm: enable experimental Swarm in Labs to fan out bounded parallel subagents, await structured results, and follow their progress across web and native chat. (#110932, #111267, #111297, #111298, #113850)
Interactive widgets: present interactive widgets in chat, pin them to session dashboards, export rendered views as PNGs, and grant exact actions or network origins to pinned widgets. (#101840, #108889, #108983, #110960, #110987, #110992, #111030, #125803, #127315) Thanks @100yenadmin and @hannesrudolph.
Editable prompt queues: edit queued prompts in place and reorder pending messages without disturbing work already sent to a running session. (#121682, #121692, #124298) Thanks @vyctorbrzezowski, @jjjhenriksen, and @Patrick-Erichsen.
Structured questions: answer structured agent questions through web and native cards, messaging buttons, or a plain-text reply, with free-text alternatives and an explicit Skip path. (#109922, #110372, #130262) Thanks @obviyus.
Durable progress cards: follow one durable progress card for a session across web, macOS, iOS, Android, and dashboard views, retaining the latest plan or status through reloads. (#125125, #125438, #125442, #125444)
Presence-triggered conversations: optionally wake an agent when an eligible Discord participant comes online or a previously active Slack participant returns, with scoped audiences, cooldowns, and configurable Slack guidance. (#107451, #108510, #123805, #123875) Thanks @sjf-oa and @sjf.
Room introductions: introduce the agent when it joins an allowed Matrix or LINE group, with per-account switches to turn introductions off. (#131128)
Managed local inference: set up managed llama.cpp chat and local embeddings, or connect an existing llama-server, using one model-provider namespace and read-only discovery. (#109444, #109585, #123701, #130883, #125781) Thanks @obviyus, @NovaUnboundAi, and @osolmaz.
Web request customization: configure operator request headers for web_fetch and Gemini web search to work with controlled gateways and upstream requirements. (#115545, #115549) Thanks @jesse-merhi.
SQLite snapshots: create, list, verify, and restore compact global and per-agent database snapshots with openclaw backup sqlite, using fresh restore targets. (#105718) Thanks @giodl73-repo and @vincentkoc.
Workboard dispatch cap: add a request-scoped --max-starts override while preserving the default cap, sequential starts, and one-card-per-owner guard. (#100174) Thanks @souvikDevloper, @Souvikalp, and @jwest75674.
Conversation branches: rewind or fork from a persisted user message, switch among retained transcript branches, and keep earlier conversation paths available; rewind changes chat context without undoing files or other tool effects. (#110660, #110857, #110886, #112056, #112284)
Shared-session participation: set session visibility and membership, assign an owner, and enforce who may view, suggest, or contribute while retaining creator attribution. (#112787, #125057)
Headless agent runs: run openclaw agent exec against a chosen working directory with temporary state, optional retained state, explicit model fallbacks, and machine-readable results while preserving configured security restrictions. (#113988, #116038)
Configuration change history: record configuration changes with writer labels, sensitive-value redaction, and manual-edit detection so operators can inspect what changed. (#111147, #111286)
Memory ownership: inspect the sessions that contributed to memory, exclude selected sources from admission, and remove identifiable derived memory with openclaw memory forget while keeping source transcripts intact. (#130151) Thanks @vincentkoc.
Skill Workshop: consolidate and improve learned skill collections through a recoverable review flow, reuse existing skills during /learn, and schedule collection review through the Gateway's system-owned automation. (#121653, #130030) Thanks @obviyus and @joshavant.
MCP dashboards: pin interactive MCP app views from a conversation to its dashboard, retaining bounded tool grants and restoring the view when reopened. (#111524)
MCP connections: add servers from composer connectors and support per-requester OAuth credentials for shared MCP servers. (#115921, #122166) Thanks @obviyus.
Code Mode selection: configure Code Mode per model while preserving inherited defaults. (#132332)
Model discovery: add Qwen 3.8 Max/Flash, DeepSeek V4 Flash Vision (Experimental), NVIDIA Nemotron 3.5 Lightning, and GLM-5.3/Flash, with provider-owned discovery. (#131294, #123523, #130309) Thanks @oliver-mee and @Marvinthebored.
Conversation search: search past conversations by exact words or phrases and reopen the surrounding messages from a matching hit. (#105057, #105585, #105635, #105831) Thanks @hercial61 and @obviyus.
Baseten and Qwen plans: add Baseten Model APIs and Qwen Token Plan Team Edition as official external plugins with their own setup and authenticated model catalogs; Qwen Token Plan is for interactive use. (#108708, #94419) Thanks @oliver-mee.
Live model discovery: discover available models from supported providers instead of relying solely on built-in catalog snapshots. (#112412, #113757) Thanks @fuller-stack-dev.
Agent-specific provider accounts: manage model-provider credentials for the selected agent in the Control UI, keeping authentication operations scoped to the intended agent. (#111796)
Anthropic server compaction: explicitly opt in to beta provider-managed context compaction for supported direct Anthropic API-key sessions while retaining the complete transcript locally. (#123402) Thanks @GodsBoy.
Utility model defaults: use a provider-declared small model for short title and progress tasks when no utility model is configured. (#103769)
Keyless Firecrawl search: offer an explicit Firecrawl Search Free choice with hosted starter-tier limits and richer Firecrawl-specific search controls. (#97078) Thanks @developersdigest.
Batched tool discovery: search for several independent tool capabilities in one tool_search request, returning ordered results under the same catalog and access policy. (#118623) Thanks @jesse-merhi and @vincentkoc.
Skill Workshop approvals: run agent-initiated apply, reject, and quarantine actions without an additional approval prompt by default while preserving skills.workshop.approvalPolicy: "pending" as an opt-in approval gate. (#107690) Thanks @shakkernerd.
Skill Workshop history review: manually scan sessions newest-first, progressively checking older substantial work for conservative skill ideas. Store only SQLite cursor metadata and keep up to three pending proposals, even with autonomous self-learning off. (#106182, #106766)
OpenAI model selection: use the exact openai/gpt-5.6-sol model for fresh API-key and OAuth setup, remove the duplicate alias from the picker, and preserve existing explicit model choices. (#122178)
xAI context compaction: use native xAI Responses server-side compaction for supported routes while retaining the complete OpenClaw transcript locally. (#123622)
External skill references: install skills-sh: references through ClawHub's mirrored, commit-pinned skill artifacts and normal safety checks instead of downloading directly from the source registry. (#112751) Thanks @Patrick-Erichsen and @vincentkoc.
Browser workflows that stay connected: pair the Chrome extension with less setup, import selected existing browser logins into managed profiles on macOS, and inspect page text, network requests, and emulated devices from the agent. (#121586, #104057, #131592)
Remote browser login sync: opt in to synchronizing selected macOS browser logins into a managed browser profile on a remote Gateway, with an explicit domain allowlist and local cookie decryption. (#123494)
Desktop control: control capable paired desktops through windows, elements, and supported background actions with provider-specific tools. macOS keeps Peekaboo and Allow Computer Control on by default, subject to OS permissions. Windows/Linux CUA remains experimental and opt-in; loading CUA’s Gateway policy on every platform does not enable local control. (#123544, #123604, #123635, #123801, #123949, #115280, #132374)
Cloud desktop control: enable Cloud Worker Desktop and a desktop-enabled Crabbox profile to control the session-bound desktop in its Desktop panel. A vision model and explicit tool access are required; an unavailable bound desktop never falls back to another paired machine. (#132374)
Browser extension CDP clients: use paired Chrome with Puppeteer clients, including browser-context and target discovery. openclaw browser extension cdp shows non-secret endpoint/challenge metadata; relay secrets and auth headers are not printed by default. (#117915)
Trusted-proxy browser pairing: optionally enroll Control UI and WebChat devices and approve same-key scope upgrades within operator-configured scope caps, while keeping key, role, and metadata changes separately approved. (#111189, #111916, #129563)
Node-hosted tools: discover and invoke approved plugin tools and MCP servers on paired nodes without duplicating their server configuration on the Gateway; node-hosted MCP configuration takes effect after restarting the node and does not support OAuth servers yet. (#90431, #114877, #114876)
Slack at scale: support Enterprise Grid identity, direct messages, workspace routing, actions, approvals, and presence. (#121373, #121014) Thanks @sjf-oa and @sjf.
Slack direct conversations: open/reuse a DM or group DM with 1–8 distinct recipients, then send to its returned target. Opening honors configured write identity/workspace but sends nothing and grants no history access. (#132928) Thanks @sjf-oa and @sjf.
Slack progress: show a live session card and compact commentary in the native progress stream. (#122552, #122976, #126480) Thanks @sjf-oa, @fuller-stack-dev, @Adkid-Zephyr, @thostr1, @kiranmagic7, @joshavant, @Chinmayrawat15, @Piyushrathoree, @vyctorbrzezowski, @ampagent, @jjjhenriksen, @jalehman, @vincentkoc, @licheer-zte, @sunlit-deng, @calinilie, @carjes232, @djerez-dot, @Solvely-Colin, @masatohoshino, @Patrick-Erichsen, @IWhatsskill, @ruel225, @VACInc, @edenfunf, @Kailigithub, @shakkernerd, @felirami, @pash-openai, @obviyus, and @sjf.
Telegram presentation: send rich location and video-note messages and render supported Markdown lists natively. (#105142, #113158) Thanks @paulislava.
Feishu collaboration: support bot-to-bot conversations with mention handling and let agents discover and resend received stickers. (#89783, #130374, #130498) Thanks @GeekyMax, @heyumeng154-alt, and @zw-xysk.
Channel emoji: discover custom emoji across Discord, Slack, Telegram, and Matrix. (#128435, #128518)
Buzz conversations: support bounded bot-to-bot room conversations, retain passive context for accepted turns, and allow flat automatic replies with typing indicators. (#130488, #130509, #130511)
ClickClack discussions: open a ClickClack discussion beside an OpenClaw session, with a scoped side agent that can inspect its progress and relay requested changes. (#111503)
Slack user identity: opt in to connecting with an authorized Slack user account and reading or posting as that person, using a companion app for incoming events without requiring a bot identity. (#109837)
Slack Agent View: open separate agent conversations from Slack Agent View and carry its current page context into the correct thread while continuing to support existing Assistant View installations. (#103895) Thanks @Patrick-Erichsen.
Slack charts and tables: render structured charts and tables directly in Slack messages, preserving readable text when a client or workspace cannot display the native blocks. (#102635, #104539)
Discord interactive widgets: open agent-generated HTML widgets inside Discord Activities after configuring the bot application and its public Gateway route. (#107442)
Telegram rich messages: optionally send native tables, headings, details, checklists, formulas, and rich media through Telegram Bot API 10.2, while keeping ordinary HTML messages as the compatibility default. (#107986) Thanks @obviyus.
Telegram dashboard: open the full Control UI as a Telegram Mini App with /dashboard from a bot DM. (#102805) Thanks @obviyus.
Matrix presentation: render spoilers, underline, and native tables in Matrix messages. (#113199)
Teams and Zoom meetings: install the official meeting plugins to join Teams and Zoom meetings as a browser guest, inspect call status and transcripts, and speak through the meeting tools while surfacing host admission or sign-in steps. (#109964, #111048, #116682) Thanks @vincentkoc.
Discord and Slack native login: register /login in native command menus while keeping provider device-login codes limited to private chats and the Web UI. (#111341)
Buzz message fidelity: preserve Markdown output and accept Buzz normal, rich-content, and structured-diff room messages through the existing authorized inbound path. (#116096) Thanks @shakkernerd, @vincentkoc, and @zw-xysk.
Buzz typing indicators: show room- and thread-scoped typing during agent replies and heartbeat deliveries, refresh through the active authenticated connection without waiting for relay acknowledgement, and drop ephemeral updates safely during disconnects or shutdown. (#116194) Thanks @shakkernerd.
Buzz sender directory: expose current bot, member, room, and room-member directory entries from bounded relay state; use current Buzz profile and room names in inbound context while preserving public keys and UUIDs as stable authorization and routing identities. (#116799) Thanks @shakkernerd.
Buzz native mentions: map unique current room-member names and explicit NIP-27 identities to native p tags in replies, proactive sends, and bounded standalone delivery. Reject out-of-room identities and unresolved labels without explicit identity; retain reply-thread sessions in maintenance and heartbeats. (#117927) Thanks @shakkernerd and @joshavant.
ClickClack bot collaboration: add opt-in bot-authored inbound dispatch with explicit sender authorization, mention gating, retry-safe loop protection, and independent thread budgets while keeping bot traffic denied by default. (#119278) Thanks @jjjhenriksen and @shakkernerd.
Discord voice: optionally join occupied voice rooms and keep the agent informed about participant changes. (#125974, #107004)
Native video understanding: send supported video inputs directly to compatible Google and Moonshot models and retain video for subsequent conversation replay. (#122074, #122337, #122257)
Speech: add hosted Fish Audio synthesis and local MLX speech, and allow realtime voice agents to end a completed call. (#115790, #125525) Thanks @Conan-Scott, @Rheingold777, @ImLukeF, and @Patrick-Erichsen.
Talk continuity: use durable client voice sessions and a macOS Gateway relay for realtime conversations. (#111216, #128204) Thanks @clifton, @vincentkoc, and @zhilong1115.
Spoken Slack mentions: let captionless audio clips address an agent by a configured spoken name, checking sender access before transcription and discarding clips that do not qualify. (#103416)
Discord voice activation: adapt supported realtime wake-name gating to room size so one person can speak naturally while shared rooms require the agent name. (#108696)
Feishu meeting invitations: optionally route authorized meeting invitations to the agent so it can join through a configured Feishu VC tool. (#92340) Thanks @Ren1104.
Linux meeting talk-back: use Chrome meeting talk-back on Linux through PipeWire-Pulse, alongside the existing macOS audio path. (#118451) Thanks @fuller-stack-dev, @Adkid-Zephyr, @thostr1, @kiranmagic7, @joshavant, @Chinmayrawat15, @Piyushrathoree, @vyctorbrzezowski, @ampagent, @jjjhenriksen, @jalehman, @vincentkoc, @licheer-zte, @sunlit-deng, @calinilie, @carjes232, @djerez-dot, @Solvely-Colin, @masatohoshino, and @Patrick-Erichsen.
Meeting notes: retain completed meeting captions as durable transcripts and derived summaries that can be inspected or exported after the call. (#113122, #103811) Thanks @lonexreb and @solavrc.
Video Talk: share bounded camera views (on demand for OpenAI, up to one frame per second for Google) with OpenAI Realtime and Google Live from browser Talk, with camera controls and microphone selection. (#109579, #109719, #111042, #111043) Thanks @shushushv.
More realtime voice options: add xAI realtime voice and streaming speech synthesis as provider choices for voice conversations and spoken replies. (#106267, #103993) Thanks @TheAngryPit and @CassieMei.
Spoken reply control: let agents choose separate spoken text, speech provider, and voice for a message while preserving its visible text. (#124913) Thanks @IWhatsskill, @ruel225, @jalehman, @VACInc, @vyctorbrzezowski, @joshavant, @edenfunf, @Kailigithub, @ampagent, @shakkernerd, @felirami, @pash-openai, @obviyus, and @Patrick-Erichsen.
Phone-call continuity: optionally route phone calls into the agent main session so calls and the primary conversation share history. (#124708) Thanks @IWhatsskill, @ruel225, @jalehman, @VACInc, @vyctorbrzezowski, @joshavant, @edenfunf, @Kailigithub, @ampagent, @shakkernerd, @felirami, @pash-openai, @obviyus, and @Patrick-Erichsen.
macOS app profiles: manage multiple Gateway windows and isolate named app profiles across state, preferences, Keychain, and Gateway services. (#111986, #121136) Thanks @vincentkoc.
Mobile navigation: use a draggable web navigation drawer, a more compact composer and top bar, and an Android thread hierarchy with unified agent/session pickers. (#130319, #130308, #130318, #128862, #128309) Thanks @IWhatsskill, @Solvely-Colin, and @vyctorbrzezowski.
Appearance: choose interface and chat fonts, save appearance preferences per user profile, and use the Tide, Beacon, and Phosphor themes. (#131275, #130340, #130232)
Android offline chat: retain queued messages and attachments offline and retire them after canonical history confirms delivery. (#104089)
Linux signed updates: update Linux AppImage installations through signed updates and a user-confirmed restart, while package-managed installations receive a release notice. (#108770)
Native Mac widget panels: present a conversation widget in a connected native Mac panel while retaining its inline chat view; native panels are render-only. (#125818)
Wear OS companion: use the Wear OS companion to pick agents, sessions, and models, read bounded conversation history, send dictated replies, and start realtime Talk through a paired Android phone. (#108835, #109341, #109433, #109483, #112721, #122123, #126863) Thanks @sibbl, @IWhatsskill, and @Solvely-Colin.
Optional Apple Health summaries: opt in to read-only Apple Health summaries for today: aggregate steps, sleep, resting heart rate, and workout totals on-device. Agent-requested summaries may reach the model provider and remain in chat history. (#105616) Thanks @joshavant.
Android sharing: share text, images, audio, and supported documents into the Android composer from other apps. (#104571, #110941, #130156) Thanks @NianJiuZst.
Native catalog terminals: open eligible Codex and Claude Code catalog sessions in their native terminal on the owning Gateway or paired device, while retaining the read-only viewer. (#107086)
Control UI cloud workspace conflicts: surface staged-ref guidance, bounded conflicted paths, structured transcript events, and sidebar attention for cloud worker results that kept local versions. (#111329) Thanks @vincentkoc.
Control UI update recovery: make the "A new version is available" Reload button wait for the restarting Gateway, then reload automatically instead of requiring a hard reload. (#111670) Thanks @vincentkoc.
Control UI sender identity polish: show real user avatars in an always-visible gutter on identity-resolving Gateways, remove profile-UUID suffixes from current and historical sender labels, and fetch profile-ID avatars through the canonical Gateway route. (#111537)
Control UI coding catalogs: show provider brand icons beside Claude Code and Codex session catalog headings in the sidebar. (#115956) Thanks @vincentkoc.
Control UI workspace shortcut: toggle the active session Files panel with Shift+Cmd+B while leaving the main app sidebar unchanged.
Control UI Settings shortcut: open Settings with ⇧⌘, while leaving the browser-owned ⌘, shortcut unchanged. (#103870) Thanks @shakkernerd.
Control UI chat layout: center the transcript on the composer axis, keep assistant and tool output left and user bubbles right within the same readable frame, and preserve custom message-width overrides. (#104474, #104646) Thanks @shakkernerd, @vincentkoc, and @zw-xysk.
Control UI composer footer: center the chat settings chip and model controls between the divider and the card edge instead of pinning them to the divider. (#105866)
Control UI assistant actions: keep assistant name and time first while placing hover actions beside them on the left instead of at the far edge. (#104884) Thanks @shakkernerd.
Linux desktop companion: connect to local or remote Gateways from a tray application with guided setup, private managed CLI prerequisites, systemd service control, LAN discovery, multiple Gateway windows, and desktop integration. (#106352, #106533, #109236, #108115, #111932)
Android Accessibility Control: let agents inspect and operate a paired Android screen through the third-party app build after Accessibility Control is explicitly enabled, with actions bound to observed controls and sensitive-control confirmation. (#112232, #112241, #112255)

Fixes

Paired-device deadline outcomes: surface unavailable paired devices consistently while waiting for reconnection, and preserve launch-timeout or explicit cancellation outcomes when they take precedence.
Offline desktop workers: report worker-offline consistently when a paired desktop disconnects in Computer Use preparation. (#133212)
Database quarantine recovery: keep proven-corruption quarantine decisions in a separate store so damage to the affected database cannot erase the quarantine; restore or repair the database and use doctor to clear the record. (#110453)
Provider migration preservation: keep configured model selections intact while an external provider package is missing or its installation needs retrying, and report recovery steps instead of silently deleting those choices. (#116919) Thanks @vincentkoc.
Provider SecretRefs: keep authored credential references distinct from resolved bytes through model preparation and catalog discovery, including file- or exec-backed auth profiles, without letting an unused account failure block another provider. (#132122)
Auth-profile model selection: keep configured credential profiles separate from model IDs across aliases, subagents, and automations, reject profiles for the wrong provider, and direct ACP profile overrides to runtime-owned credential configuration. (#133175) Thanks @fuller-stack-dev.
SQLite data safety: prevent WAL split-brain cleanup from corrupting a database. (#132844) Thanks @VACInc.
Newer database state: stop restart loops when the installed Gateway encounters a newer schema, refuse competing shared-state schema changes while another Gateway owns the state directory, and fence incompatible cached state with an unhealthy readiness result. (#132916, #133081) Thanks @vincentkoc and @fuller-stack-dev.
Workspace safety: preserve overlapping OpenShell uploads and keep visible spawns tied to their managed parent repository and configured defaults. (#131556, #132364) Thanks @sallyom and @shakkernerd.
Private prompt protection: keep copied private prompt context out of final and streaming replies, including routed ACP replies and decorated or partially streamed copies. (#115745, #130125) Thanks @SnowSky1 and @moeedahmed.
Protected credential egress: close proxy connections, upstream requests, and bypass tunnels when their run ends; replacement runs cannot revive them. Protected subprocess values stay sealed even with provider-auth sentinel masking off. (#132122)
Credential request cards: retain exact secret values, show requester/replacement warnings, allow native host-list edits, and cancel closed-run requests. A committed save stays answered if runtime refresh fails; show reload guidance without requesting resubmission. (#132122)
Human-input waits: keep runs awaiting accepted questions or credential entry out of stale-session recovery, resume progress tracking after resolution, and cancel requests when the exact requesting run loses authority without extending explicit deadlines. (#132122)
File edit safety: reject edits to non-UTF-8 files before invalid bytes can be silently rewritten. (#115088) Thanks @yetval.
File writes: compare persisted bytes before treating a write as unchanged, so invalid UTF-8 cannot cause a requested overwrite to be silently skipped. (#133282)
Configuration identifier integrity: preserve exact long numeric identifiers and explicit field types when saving configuration forms, instead of rounding IDs and breaking allowlists. (#126402) Thanks @solavrc.
Model compatibility configuration: accept the already-declared routing, streaming, session-header, and cache compatibility settings, including structured OpenRouter and Vercel routing options, instead of rejecting them during strict configuration validation. (#118674) Thanks @obviyus and @litianyi-007.
Shared-filesystem SQLite safety: use rollback journaling on detected virtiofs and 9p mounts so cross-VM filesystem behavior does not corrupt SQLite WAL state. (#120597) Thanks @LiuwqGit and @gucasbrg.
Unparseable configuration recovery: preserve an unparseable configuration and stop doctor repairs with an actionable error when no valid recovery copy exists. (#109362)
Control UI config drafts: preserve external changes and newer Form or Raw edits across reconnects, including saves whose acknowledgments were lost, by keeping the draft's original document and write revision together. (#130935)
Session settings: preserve distinct settings written concurrently by separate processes when creating settings files, while keeping reads of missing settings free of filesystem side effects. (#124471) Thanks @MrSwagatRathod, @obviyus, and @yetval.
Shared state corruption recovery: evict only the exact cached SQLite owner after proven read or write corruption so a repaired database recovers without a Gateway restart while caller-injected handles remain untouched. Fixes #114269. (#114278) Thanks @rizquuula and @vincentkoc.
State snapshot verification: run SQLite snapshot verification in a separate process so worker-thread file closes no longer drop the Gateway's POSIX WAL locks, eliminating spurious WAL misses and I/O errors. Thanks @VACInc, @vincentkoc, and @zw-xysk.
Managed skill backups: include valid operator-managed skills reached through direct or grouped directory symlinks, preserving their external targets without broadening backup owner boundaries. (#132973) Thanks @ruel225, @obviyus, and @goslingmanagment.
Claude CLI prompt privacy: keep prompt-build hook context out of visible chat history while preserving ordinary user requests, native session recall, and policy-hook visibility. (#132466) Thanks @RomneyDa.
SQLite maintenance schema validation: reject current-version global and agent databases with missing or drifted canonical tables, constraints, indexes, triggers, or table options before compaction, while accepting supported additive-migration layouts. (#105583) Thanks @vincentkoc.
Gradium TTS credential egress: reject non-HTTPS, foreign-host, and hostname-lookalike base URLs before dispatching API keys, and pin guarded transport to Gradium's documented API hostname. (#105169) Thanks @zhangguiping-xydt.
Gateway command SecretRefs: preserve authoritative active-snapshot values when another command secret remains unresolved, falling back locally only for missing paths instead of emitting a per-turn secrets.resolve failure. (#105160) Thanks @SunnyShu0925 and @willfivestar.
SQLite terminal session recovery: track physical transcript mutation time in the agent database so killed or timed-out main sessions rotate when transcript writes outlive the registry update, while preserving legacy transcript mtimes during doctor import. Thanks @vincentkoc.
Shared history and recovery: preserve shared session history through startup and repairs, recover active sessions across repeated Gateway restarts, and migrate long histories without exhausting the heap. (#127241, #131527, #131276) Thanks @ampagent, @shakkernerd, and @vincentkoc.
Session reset boundaries: preserve departing conversation excerpts before resets, keep reset history closed after compaction, and keep new-turn ordering intact. (#132757, #132606, #132815) Thanks @vincentkoc.
Session cleanup reporting: keep completed cleanup results visible when a later agent store fails, report the failing store and committed work, and return a nonzero CLI result instead of implying full success. Fixes #127583. (#128905) Thanks @MasterSwords1 and @obviyus.
Orphan transcript repair: settle repaired transcript cursors before appending replacement prompts avoiding outdated recovery positions. (#133243)
Transcript rewrites: keep retry deduplication attached to the copied message on the active branch, so retries after a rewrite resolve to the current transcript instead of an obsolete branch. (#126503) Thanks @chelsealong, @obviyus, and @yetval.
Compaction: avoid premature Responses compaction from incomplete usage snapshots, preserve the current user turn through compaction without sending it twice, and record omitted images instead of silently losing them. (#130993, #131977, #133094) Thanks @VACInc, @vincentkoc, and @obviyus.
Compaction recovery and native session accounting: honor Stop before further recovery hooks, maintenance, transcript truncation, or retries; keep committed compactions and counts without late replies. Persist native final usage without context events; keep stale or unknown context marked accordingly through fallbacks, independent of billing. Worker-owned sessions retain their identity. (#133260)
Subagent completions: accept visible session-only replies when yielded children settle, so successfully completed work resumes its requester instead of being reported as undelivered.
Subagent failure notices: send a generic failure notice to a direct requester when a failed delegated task cannot produce its completion reply, while preserving cancellation and source-ownership checks and keeping private failure details out of chat. (#128512) Thanks @Leon-SK668 and @obviyus.
HTTP API failures: report recorded agent failures and whole-agent timeouts as errors in Chat Completions and Responses requests, including streams that have already emitted partial content. (#133275)
Interrupted delivery: resume interrupted delivery settlement without duplicate notices and let follow-up work continue after stuck-session recovery. (#131380, #130911) Thanks @zhangguiping-xydt, @obviyus, and @adrianTroop.
Cross-session messaging: let worker sessions message their Gateway parent and sibling sessions through the supported routing path. (#132818)
Cloud attachments: deliver images and PDFs to remote sessions and retain the prepared input across cloud placement. (#132114, #132358)
Desktop viewers: keep VNC security inspection and the authenticated viewer on the same connection so opening concurrent viewers does not create extra unauthenticated probes, and retain the final stream data during shutdown. (#133226)
Session permissions: preserve stricter execution overrides, qualify creator rights by profile identity, and keep configured permission defaults when starting worktree tasks. (#132675, #132300, #131547)
Group integrity: reject attempts to drop non-empty session groups and preserve distinct rooms during canonical session updates. (#133005, #132242)
Worker and automation input validation: reject inherited worker protocol fields and keep prototype-only scheduling, payload, and authority values out of normalized automation configuration. (#133123, #111728) Thanks @vincentkoc, @bladin, and @obviyus.
Plugin startup and repair: resume sessions whose trusted runtime plugins were absent at startup, respect installed-plugin health capabilities, and repair legacy channel configuration before installing an external plugin. (#132804, #132934, #132446)
Plugin updates and consent: preserve explicit capability consent and complete plugin convergence through a package restart, and record artifact-bound acceptance when plugins enable --accept-capabilities is run for an already-enabled managed plugin. (#131301, #131062, #132805) Thanks @RomneyDa, @vincentkoc, @PollyBot13, and @obviyus.
Plugin approvals: accept explicit null optional metadata, and tell agents that a denied request is closed and its unexecuted tool call must not be retried or presented for approval again. (#133112, #130009) Thanks @obviyus, @sunlit-deng, and @haruaiclone-droid.
Policy diagnostics: derive exec security and approval posture from the configured exec mode, including inherited modes, so Policy and Doctor report the effective configuration correctly. (#125457) Thanks @sunlit-deng, @obviyus, and @omarshahine.
Plugin tool results: honor termination requested by tool-result middleware so a completed tool can end the agent loop without an extra model turn. (#128505) Thanks @gaoanze888, @obviyus, and @krjcolby-svg.
Install resilience: fix low-memory postinstall failures and commit-pinned source installs; preserve bootstrap package-manager metadata. Npm packages retain all release notes and link oversized contribution records to the full tagged source. (#132555, #132458, #132608, #133454) Thanks @vincentkoc.
Update rollback safety: keep a managed Gateway stopped when a rollback rebuild leaves unexpected checkout changes, and show profile-aware repair guidance before the operator retries the update. (#132813) Thanks @PollyBot13 and @obviyus.
Installer completion: finish successful npm-prefix and daemon-status probes immediately instead of waiting through repeated five-second watchdog delays. (#133190)
CLI certificate discovery: treat blank extra-CA environment values as unset so Linux certificate discovery and clean child startup still work, while preserving nonblank operator paths. (#117317) Thanks @zenglingbiao and @obviyus.
Update recovery: restart the Gateway even when interactive completion refresh fails, preserve sealed service definitions during updates, and prevent Git updates from reporting success while serving an old web build. (#131393, #131021, #130957) Thanks @shakkernerd, @jason-allen-oneal, and @Patrick-Erichsen.
Update restart verification: wait for a delayed Gateway to report the expected running build within the restart deadline, while still rejecting outdated, missing, or unverifiable build identities. (#132879) Thanks @goslingmanagment, @dmsrg399, and @obviyus.
Loaded-build diagnostics: report the Gateway's loaded build in status, database-schema refusal, and update-restart validation even after a source checkout moves to another commit. (#132854) Thanks @PollyBot13 and @obviyus.
Small temporary filesystems: keep development upgrades from exhausting constrained POSIX temporary storage. (#132085) Thanks @vyctorbrzezowski.
Windows reliability: expand short directory paths before watching skills to avoid a native filesystem-watcher crash, and keep ACP workers from hanging on service-hosted permission prompts. (#129637) Thanks @laulopezreal and @Yuyorman.
Windows text and arguments: decode PowerShell UTF-16 files according to their byte-order mark and preserve empty arguments, quotes, and trailing backslashes through batch wrappers and terminal launches. (#133130, #133185)
Automation recovery: recover interrupted one-shot jobs after restart, support current-session automations on webchat-only Gateways, exclude reset-session results, and retain bounded best-effort Cron delivery text as context after live chat disappears. (#131473, #131975, #127854, #130551) Thanks @jalehman, @HermanZeng, @obviyus, and @AyitLabs.
Heartbeat delivery: surface delivered alerts in their target sessions, close restart-recovery gaps, and deliver targeted one-shot restart continuations for configured agents even when recurring heartbeat cadence is disabled. (#130871, #131219, #131888) Thanks @scotthuang, @obviyus, and @R0gner.
Chat duplication: prevent repeated Enter presses, cross-client steering, and terminal settlement from duplicating visible messages. (#132310, #131951, #131681)
Assistant text cleanup: preserve punctuation and Markdown formatting when removing leaked model-control tokens, keep adjacent Unicode words separated, and leave code examples intact. (#133287) Thanks @yifanxiong272.
Streamed commentary: preserve Responses message-item identity across tool handoffs so later tool updates do not replay earlier commentary as a combined preamble. (#133247)
Remote-start feedback: retain unsent prompts when cloud startup fails and keep the session's Desktop view attached to the correct machine. (#131594, #132255)
Gateway restart feedback: show “Gateway restarting…” when a restart interrupts an active tool instead of presenting the intentional interruption as a tool failure. (#133119) Thanks @fuller-stack-dev.
Startup responsiveness: avoid repeated CLI plugin preparation and duplicate provider-catalog planning, reduce ordinary Gateway status memory use and the first Grok web-search startup delay, and keep execution machinery out of setup and agent help. (#131503, #132685, #133097, #133114, #133272) Thanks @vincentkoc.
Run preparation performance: reuse catalog policies, route lookups, prompt-context preparation and bootstrap statistics, and reduce repeated SQLite schema metadata scans and index comparisons. (#133276, #133284, #133290)
Large-session maintenance and browsing: reduce repeated transcript import, Doctor, title/preview, and session-list work while keeping bounded reads and current transcript generations. (#133068, #133084, #133100, #133127, #133203) Thanks @gucasbrg.
Chat rendering performance: reuse prepared Markdown parsers, streamed code-span scans, accepted rendered chunks, and repeated history-projection work for long conversations and streamed replies. (#133152, #133244)
Client startup: show iOS sidebar sessions on multi-agent Gateways, preserve the web app's selected agent across restarts, and complete macOS CLI installation even if Gateway startup fails. (#131356, #131549, #128350) Thanks @fuller-stack-dev, @Patrick-Erichsen, @VACInc, and @hannesrudolph.
Media playback: restore inline audio and video readiness checks so playable media does not silently degrade to download cards. (#132832)
Voice-note transcripts: transcribe the first untranscribed voice note for mention checks and retain that transcript when later attachment or link processing enriches the message. (#133261)
Cloud placement selection: keep a selected cloud placement when changing runtime and report an incompatible choice instead of silently executing the task locally. (#129440)
Gateway/subagents: keep plugin completion turns bound to the owning Gateway runtime so successful native subagents can finish delivery without losing the published reply runtime. (#132430)
WebChat attachments: keep managed MEDIA: directives out of the first assistant transcript event while attachments are prepared, preserving raw transcript references, user text, and attachment failure warnings. (#132508)
Local media replies: decode file URLs at the native reply boundary so encoded filenames resolve correctly while browser transcripts retain the original media reference and native file-access checks. (#133146)
Onboarding migration menu: group Claude, Codex, Hermes, and plugin-provided imports under a single Import from another agent setup choice while preserving detected source hints, manual paths, and Back navigation before import begins. Fixes #126440. (#126515) Thanks @shakkernerd and @vincentkoc.
Remote onboarding: preserve the selected Gateway’s pairing and setup-chat identity through loopback tunnels, and wait for a new Gateway boot plus verified inference after restart-dependent setup instead of accepting the old listener. Fixes #133229. (#133257)
Plugin setup diagnostics: stop treating metadata-only provider setup descriptors as missing runtime registrations while retaining undeclared runtime and CLI drift warnings. Fixes #125506. (#125523) Thanks @shakkernerd.
Session controls: keep thinking levels aligned with the selected agent's prepared model and provider policy, including native Ultra. (#132389)
Workboard validation errors: include the rejected normalized length in bounded-string limit errors so agents can trim and retry deterministically. Fixes #118845. (#118888) Thanks @Kailigithub, @shakkernerd, @IWhatsskill, @ruel225, @jalehman, @VACInc, @vyctorbrzezowski, @joshavant, @edenfunf, @ampagent, @felirami, @pash-openai, @obviyus, @Patrick-Erichsen, and @osipovia.
Updater plugin convergence: keep pre-plugin doctor passes from installing configured plugins before the updater's plugin sweep, while preserving the final post-plugin migration pass and preventing ambient update-phase state from leaking into fresh doctor processes. (#122161) Thanks @vincentkoc.
Guided onboarding skip-UI routing: keep openclaw onboard --skip-ui and openclaw setup --skip-ui on guided onboarding while skipping both browser and terminal handoffs, instead of silently switching to the classic wizard. (#118737) Thanks @shakkernerd.
Gateway device clock skew: use Gateway challenge timestamps for device proofs across TypeScript, Control UI, browser extension, Android, Apple, Linux, and watchOS clients, avoiding clock-skew authentication failures. Retain nonce/freshness checks and no-challenge compatibility for pre-challenge Control UI servers and older watch-node HTTP endpoints. Fixes #103455. (#116679) Thanks @vincentkoc and @mahdouzhao-beep.
Gateway reconnect event ordering: reset the shared TypeScript client's outer event-sequence baseline for each replacement WebSocket, preventing gap recovery from comparing unrelated connection generations across Control UI, TUI, SDK, and browser extension clients. (#116043) Thanks @shakkernerd.
Gateway exec deny fallback: fail closed when shell expansion prevents an enforceable allowlisted execution plan under ask=off and askFallback=deny, avoiding approvals that can only time out. Fixes #113191. (#113892) Thanks @shakkernerd and @jrvanwinkle.
Standalone plugin files: let manifestless files explicitly listed in plugins.load.paths pass config validation and load independently when several files share a directory. (#111515)
Cloud worker derived workspace caches: exclude Python caches, dependency trees, and macOS metadata symmetrically from outbound sync and inbound reconciliation so local cache rewrites cannot fence later cloud results or worker reclaim. (#110380)
Gateway control-plane rate limiting: use per-method buckets with a 30-per-minute budget so interactive admin writes remain responsive while retaining runaway-loop protection. (#109557)
ACPX cleanup process inspection: bound host process-table reads so stalled ps calls cannot hang gateway startup or session cleanup while retaining fail-closed ownership checks. (#109146) Thanks @Alix-007.
ACP timeout summaries: retain bounded progress as the terminal summary when OpenClaw's watchdog times out a delegated ACP turn. (#91479) Thanks @obviyus and @moeedahmed.
Cron lifecycle conflict retries: preserve execution-phase retry decisions across scheduled, manual, and startup-recovered runs so post-execution claim conflicts cannot replay completed messages or tools. Fixes #108428. (#108778) Thanks @yetval and @vincentkoc.
Usage date ranges: exclude legacy transcript rows without timestamps from finite session ranges while preserving them in all-time totals, and rebuild older usage caches before serving the new semantics. Fixes #89709. (#89745) Thanks @TurboTheTurtle and @syfvb.
1Password authorization handoff: persist nonce-bound pending approvals in shared plugin state so hook and tool execution across broker instances remain single-use and fail closed.
Nested resource ignores: honor slash-free patterns and escaped literal exclamation marks in nested ignore files during skill and resource discovery. (#106258) Thanks @moguangyu5-design.
Proxy bypass precedence: honor blank lower-case no_proxy values shadowing upper-case NO_PROXY consistently with Undici, and reuse the canonical matcher for Telegram fallback selection. (#107711)
Tokenjuice exec compaction: avoid retaining raw command output inside compacted middleware metadata, preventing large successful compactions from failing the middleware details-size guard. (#107705)
Agent git package identities: strip refs before hosted-repository parsing and reject traversal segments so GitLab branch refs resolve to the canonical managed install path. (#107637) Thanks @vincentkoc.
Agent auth storage locks: surface normal release failures while avoiding redundant release attempts after proper-lockfile reports a compromised lock. (#107427)
Paired-node session catalogs: authorize bundled Anthropic and Codex catalog requests to invoke their read-only node commands from Control UI read flows, restoring remote Claude/Codex rows and terminal resume availability. Fixes #107406. (#107410) Thanks @vincentkoc.
Sandbox recreate confirmation: treat Clack cancellation as a decline so Ctrl-C cannot proceed with container removal. (#107286)
ClawHub plugin API ranges: delegate each supported comparator to semver so tilde, partial-wildcard, and prerelease caret bounds are correct while preserving OpenClaw version normalization and the existing restricted range grammar. (#106877, #106889)
Web Readability relative links: seed parsed documents with the request URL so article links resolve correctly while removing the plugin's duplicate lazy-loader facade. (#106860, #106874)
OC Path JSONC insertion: patch object and array insertions through jsonc-parser so comments, trailing commas, and CRLF formatting survive. (#106847, #106858)
Bounded path reads: reject non-regular files and inputs above 16 MiB before OcPath parsing, preventing hangs and excessive memory use across resolve, find, set, and emit while preserving JSONC size diagnostics. (#110714) Thanks @cxbAsDev and @obviyus.
File search results: return accurate search-relative paths, filename whitespace, and directory markers from both local and custom search backends, including searches whose root ends in a separator. (#133302)
Windows winget installs: continue in the current PowerShell session when winget installs Node.js before the machine PATH update becomes visible, avoiding a false Node.js not found failure. (#106862)
Agent source-reply recovery: preserve current-chat delivery evidence for message sends executed through Code Mode, preventing successful replies from triggering a redundant retry and misleading delivery-failure diagnostic. Thanks @vincentkoc.
Source-reply media: attach outgoing media to its committed transcript message before publishing the reply, preserving attachments and original message content through publication failures and safe retries. (#133237)
Sandbox upload references: resolve current-turn staged upload handles in image, PDF, and media-generation tools without searching unrelated files, while preserving real workspace files and existing sandbox access restrictions. (#129269) Thanks @Finn763, @obviyus, and @shang-go.
Gateway in-process restarts: clear stale SIGUSR1 restart state and resume prepared host suspensions before rebuilding runtime admission, preventing restart cooldowns or paused scheduling from leaking into the next lifecycle. (#106691) Thanks @vincentkoc and @shakkernerd.
Restart recovery delivery: preserve the recovered reply’s channel route when delayed cleanup from the interrupted run reaches storage, so an in-flight conversation can finish after repeated Gateway restarts without asking the user to resend.
Gateway restart cleanup: stop new supervised commands and drain admitted process trees ahead of the next Gateway start, using forced-stop recovery if shutdown cannot confirm cleanup. (#132566) Thanks @Alix-007, @obviyus, and @yozakura-ava.
Transcript read failures: propagate permission and I/O failures from streaming JSONL session reads instead of treating unreadable transcripts as empty. (#106412) Thanks @zenglingbiao.
Restart sentinel diagnostics: report SQLite read/write and legacy-file cleanup failures while preserving best-effort restart recovery behavior. (#106385) Thanks @zenglingbiao and @wendy-chsy.
Session retry classification: stop permanent provider errors whose identifiers or payload details merely contain 429/5xx digit sequences from re-sending full context, and share bounded rate-limit-window parsing across retry paths. (#105258) Thanks @destire-mio and @yetval.
Swabble status config: honor the global --config path when reading service status instead of silently using the default configuration.
ClawHub retry timing: reject fractional delay-seconds and calendar-normalized invalid Retry-After dates so runtime and release reads stay on their bounded fallback schedule. (#105479) Thanks @qingminlong.
Cron delivery status: keep successful isolated agent turns at status=ok when downstream delivery fails, while preserving the send failure separately in delivery state and run logs. (#105215) Thanks @Alix-007, @needtocalmdown, and @vincentkoc.
Plugin SDK: restore shipped resolveStorePath, resolvePluginProviders, and thinking-catalog loadModelCatalog contracts; use jiti transforms for native-module fallback to prevent Node 24 plugin startup races. Thanks @vincentkoc.
Plugin session catalogs: reject unknown catalog filters, report catalogs as plugin capabilities, and preserve them in SDK registration captures instead of silently returning empty results or classifying catalog-only plugins as capability-free. Thanks @vincentkoc.
Plugin inspection: show the owning package's install provenance in CLI and chat inspection, including child plugins contributed by a package, without borrowing records when package ownership is ambiguous. (#133140)
Gateway service audit: treat POSIX shell -c wrappers as opaque for the gateway-subcommand check, avoiding false missing-command warnings for shell-wrapped macOS LaunchAgents without parsing inner commands or ports. Fixes #81751. (#81778) Thanks @liaoandi.
QQBot token requests: bound token acquisition with the shared 30-second guarded-fetch deadline so stalled singleflight callers fail together, clean up, and can retry. (#102897) Thanks @maweibin.
Canvas A2UI validation: reject malformed or unsupported JSONL at CLI, agent-tool, and final node-invoke boundaries while preserving native v0.8 dispatch. (#103713) Thanks @qingminglong.
Twilio RCS inbound routing: normalize RCS consumer addresses only after signed webhook validation so sender matching and sessions work without changing outbound RCS semantics. (#102373) Thanks @clawSean.
Agent-core truncation: avoid empty-output crashes when head truncation receives negative line or byte ceilings. (#103425) Thanks @qingminglong.
Bash output: keep oversized newline-terminated final lines visible without splitting UTF-8 characters, and report output-spill failures without crashing the agent process. (#132906, #133216) Refs #133213.
Exec output retention: keep irreversible output-loss warnings visible through later session-result truncation, and distinguish discarded output from retained output that can still be read with process logs. (#128997) Thanks @Finn763 and @obviyus.
Windows Node resolution: preserve the current executable when resolving bare case-insensitive node.exe entries under hostile PATH values. (#103907) Thanks @soldforaloss and @vincentkoc.
Agent abort cleanup: serialize prompt lock reacquisition with terminal cleanup so canceled embedded runs do not self-contend on session locks for up to 60 seconds.
Chutes OAuth deadlines: bound token exchange, profile lookup, and refresh requests, and keep issued tokens when optional userinfo enrichment stalls. (#102026) Thanks @Alix-007.
Exec safe-bin flags: auto-approve curated read-only boolean flags for default stdin-only filters while keeping unknown flags, tail follow/retry modes, file operands, and custom profiles fail-closed. (#88953) Thanks @yetval.
Python script preflight: catch single-character shell-style variables in executable Python and f-string expressions while preserving literal text, comments, and format strings. (#103535) Thanks @obviyus and @jlzhang274.
OpenCode Go MiMo catalog: stop exposing the deprecated mimo-v2-omni and mimo-v2-pro aliases that reject agent requests, and keep release validation on the active MiMo V2.5 routes. (#103311, #103329) Thanks @krissding.
Audit time filters: reject impossible calendar dates for openclaw audit --after and --before instead of rolling them into unintended intervals, while preserving timezone-less timestamp semantics. (#103433) Thanks @qingminglong.
Doctor state isolation: prevent automated updates and Gateway watch repair from importing/archiving default-home exec or plugin-binding approvals under another OPENCLAW_STATE_DIR. Implicit CLI preflight stays notice-only; cross-state imports require direct operator doctor runs. (#103247, #103317, #103353) Thanks @vincentkoc.
Complete Doctor output: drain JSON and maintenance reports before exiting so pipes and redirected files receive the full result, including failure diagnostics. (#133259)
Google music generation: retry one unblocked Lyria response that omits its contractually required audio while keeping prompt blocks and terminal generation stops non-retryable. (#103318, #103326) Thanks @shakkernerd.
Apple timeout recovery: return promptly from shared operation deadlines and caller cancellation even when platform work ignores cancellation, while isolating late Gateway handshakes and cleaning up location and permission waiters. (#103066) Thanks @NianJiuZst.
Unicode-safe bounded text: preserve complete UTF-16 surrogate pairs when shortening previews, prompts, diagnostics, labels, session keys, link metadata, and identity values across Control UI, CLI, Gateway, plugins, QA, memory, and Android surfaces. (#102625, #102626, #102627, #102816, #102823, #102833, #102877, #102949, #102963, #102969, #102988, #103010, #103034, #103210, #103341, #103487, #103543, #103580, #103646) Thanks @zhangguiping-xydt, @wings1029, @wangyan2026, @Pandah97, @MoerAI, @SunnyShu0925, @zhangqueping, @zw-xysk, @cxbAsDev, @lzyyzznl, @coder-master-0915, @LeonidasLux, @mushuiyu886, @ly85206559, @Simon-XYDT, @lsr911, @vincentkoc, @chengzhichao-xydt, and @wangmiao0668000666.
Cron list table: sanitize and size bounded cells by terminal display width so CJK, emoji, combining marks, and terminal-control input cannot corrupt alignment or output. (#103616, #103889) Thanks @mushuiyu886.
DeepSeek catalog metadata: update V4 Flash/Pro cache-hit, cache-miss, and output pricing; refresh metadata saved by older onboarding; and document the July 24 retirement of deepseek-chat and deepseek-reasoner compatibility names. (#103192, #103241)
Amazon Bedrock control-plane deadlines: bound model discovery and application inference-profile lookups, preserve caller cancellation, and close short-lived SDK clients after each request path. (#108756) Thanks @Alix-007 and @vincentkoc.
Reply pre-delivery recovery: bound each pre-delivery callback with an owner-overridable deadline, release serialized reply lanes after hung plugin work, and preserve durable final-delivery retry state only when transport never started. (#104256) Thanks @NianJiuZst, @BenjaminBrossi, and @vincentkoc.
Media-store remote downloads: bound response-header waits and stalled bodies, close abandoned redirect and error responses, and remove partial temp files so hung sources cannot pin callers. (#104624) Thanks @hugenshen.
System-agent recovery guidance: direct browser and app users to Settings or the OpenClaw host instead of terminal-only exit guidance while preserving the required stop, onboard, and restart lifecycle. (#114633) Thanks @jesse-merhi.
Gateway memory: reduce retained memory with large histories and stop heap growth across in-process restarts. (#131653, #132933)
Local model selection: keep Ollama local-only setup from selecting remote or embedding-only models and retain configured or advertised capabilities when inspection is unavailable. (#130459, #130000, #130240) Thanks @Yigtwxx.
Ollama image history: project retained conversation images into the selected Ollama model input so follow-up image questions can use them. (#132106) Thanks @VACInc.
Ollama discovery credentials: retain configured credential references during self-hosted model discovery and keep ambient cloud credentials out of local discovery requests. (#132122)
Gemini requests: support stable Gemini Embedding 2 with correct query/document instructions and dimensions, and preserve native tool-call identity and stream completion semantics. (#128716, #129038, #116926) Thanks @fr-meyer, @aniruddhaadak80, @vincentkoc, and @zw-xysk.
Web search and fetch freshness: honor zero or shortened cache lifetimes and prevent canceled fetches from returning or caching late provider results. (#131648, #131585)
xAI startup: keep voice capability metadata and plugin-version reads off the full agent runtime import path so the first Grok request does not stall during provider loading. (#132475) Thanks @vincentkoc.
Control UI tool progress: keep error-shaped partial output running until the tool returns its result, with consistent status in collapsed rows, expanded cards, and side-panel details. (#131622)
Control UI tool titles: resume tool-title generation after transcript pruning, bound background title work, and refresh all open panes when titles arrive. (#133078) Thanks @shakkernerd.
Session observer recovery: retry utility-model preparation after transient failures instead of retaining a failed preparation for the rest of the session. (#133178) Thanks @vincentkoc.
MCP Apps: let standalone operations finish across catalog refreshes within per-request server budgets, propagate App cancellation without cancelling shared catalog work, and reload restored history views without replaying interrupted operations. Thanks @tzy-17.
Codex image attachments: decode mixed-case file:// URLs as local image paths while preserving existing file URL validation and platform behavior. (#121611) Thanks @sunlit-deng.
Cold image analysis: initialize only the selected image provider and model so unrelated plugin loading cannot stall setup before the timeout budget starts. (#133045)
Control UI Codex compaction history: preserve successful native context compactions as durable, model-excluded activity inside completed work traces after the composer status clears or the session reloads. Fixes #127206. (#127230) Thanks @shakkernerd and @vincentkoc.
Control UI Codex steering: preserve pre-steer commentary and tool activity in durable transcript order, keep it visible while active, and collapse it before the steering message after completion. Fixes #126938. (#126997) Thanks @shakkernerd.
Onboarding provider hook loading: scope selected-model hook fallback to the chosen provider so metadata-only setup providers do not load unrelated plugins before configuration completes. Fixes #126408. (#126427) Thanks @shakkernerd.
Onboarding model browsing: keep preferred-provider model discovery scoped to the selected provider, preserve route variants, and avoid loading unrelated provider setup surfaces. Fixes #125363. (#125373) Thanks @shakkernerd and @vincentkoc.
Control UI agent and skill permissions: gate Agents, Skills, Skill Workshop, and delayed mutation dispatches by the current Gateway method catalog and operator scopes while preserving read-only browsing and legacy Gateway compatibility. Fixes #119176. (#119286) Thanks @shakkernerd.
Control UI model readiness: put AI setup first when no model is selectable, distinguish signed-in credentials from ready providers, and route accounts with no exposed models directly to provider recovery instead of leading with disabled default controls. (#116079) Thanks @vincentkoc.
Model Setup recovery: wait for verified model settings to become active before reporting success, show when a Gateway restart is required, and keep setup navigation and chat usable while model-authentication status is being prepared. (#133106)
Control UI Realtime tool calls: execute OpenAI WebRTC tools only from completed responses, bound retained call identities and UTF-8 arguments, and ignore provisional or late duplicate events so long Talk sessions cannot grow tool state without limit.
Skill Workshop offline apply: preserve configless local proposal apply after upgrades under exclusive Gateway startup ownership, while keeping running Gateway snapshot invalidation fail-closed when CLI credentials are unavailable. (#115982) Thanks @vincentkoc.
Code Mode small-model repair: give malformed pre-dispatch exec calls one bounded correction turn, expose typed failure-phase and bridge-dispatch evidence, and stop automatic replay of failed programs after nested tools may have changed state. Fixes #115311. (#115729) Thanks @vincentkoc.
Code Mode recovery: inspect partially completed work through read-only tools, then allow at most one mutation attempt using normal tool schemas while blocking exact repeats of calls whose earlier effects were committed or uncertain. (#132583, #133155) Thanks @Marvinthebored, @Peetiegonzalez, @obviyus, and @edenfunf.
Codex native subagent handoff: tell Codex harness turns to use sessions_yield for later-turn child completion delivery, reserve wait_agent for immediately blocked same-turn steps, and omit the guidance when yielding is unavailable. Fixes #115443. (#115466) Thanks @shakkernerd and @bek91.
Codex native controls: stop misclassifying valid thinking/fast runtime controls as provider overrides so Codex routes keep their native controls, while provider-native objects and invalid values stay fail-closed. Thanks @VACInc.
Codex history forks: use the managed Codex 0.151.0 runtime to fork at selected messages in paginated conversations, and release temporary model-probe subscriptions without leaving stored or archived probe threads. (#132908)
Reply latency with model policies: reuse one immutable plugin-metadata snapshot per model-selection run instead of repeating plugin discovery, cutting reply delay when a model policy is configured. Thanks @VACInc and @vincentkoc.
Claude cache after stalls: recover stalled Claude CLI sessions by forking from the last pre-turn checkpoint so native cache continuity survives without duplicating the pending prompt, with a cold reseed fallback for CLIs without checkpoint support. Thanks @VACInc and @vincentkoc.
Cron local-provider preflight: report the guarded-fetch deadline as a bounded preflight timeout, preserve concrete nested non-timeout errors, and carry the failure reason into fallback warnings. (#113409) Thanks @shakkernerd, @timme0126, @vincentkoc, and @zw-xysk.
Codex stale-session replies: stop model fallback after another gateway supersedes a Codex session generation and deliver a safe retry notice instead of abandoning the message silently. (#110980) Thanks @vincentkoc.
Bounded input and provider responses: cap pasted auth/config input and enforce wall-clock deadlines across generated-media downloads, polling JSON, and failed response details so oversized or slow-drip streams cannot exceed resource budgets. Thanks @Pick-cat.
Provider response diagnostics: bound A2A peer JSON responses, identify the provider when a live model catalog returns malformed JSON, and keep reflected request credentials out of malformed-response errors. (#132273, #109754) Thanks @RileyJJY, @obviyus, @krissding, and @vincentkoc.
Codex model status diagnostics: mark configured Codex routes unavailable when the harness plugin is disabled, missing, or quarantined. Keep credential status separate and fail models status --check rather than treating fallback execution as healthy. (#110447) Thanks @shakkernerd.
Codex startup diagnostics: inspect only the registered parent and child processes during startup so unrelated unreadable processes do not block sessions, and distinguish inspection timeouts from permission failures without weakening cleanup identity checks. Fixes #133101. (#133111, #132122)
Codex dynamic tool outcomes: use the shared tool-result failure contract for arbitrary lifecycle metadata, preventing successful Skill Workshop results from being displayed and persisted as failed calls. Fixes #107684. (#107807) Thanks @shakkernerd.
Codex /status context freshness: consume exact per-response usage from Codex app servers that emit rawResponse/completed; when exact usage is unavailable or omitted, keep context unknown instead of reusing cumulative lifetime totals. (#107813) Thanks @wuqxuan.
Codex resumed permissions: apply stored per-session approval and sandbox overrides to primary resumed harness turns so /codex permissions survives later messages and gateway restarts. (#111136)
Claude CLI context budgets: honor Anthropic model and per-agent contextTokens limits by passing the effective limit to Claude Code's native auto-compactor and persisting the same prepared budget in OpenClaw session state. Fixes #80933. (#93198) Thanks @mushuiyu886 and @gorkem2020.
Claude CLI max-turn diagnostics: preserve terminal max-turn results with OpenClaw and Claude session context, warn when tool actions may already have run, and stop unsafe auth-profile or model replay for potentially side-effecting turns. (#94130) Thanks @zhangguiping-xydt and @tdrose01.
CLI agent diagnostics: record one run-correlated terminal warning after recovery is exhausted, making otherwise hard-to-trace CLI agent failures diagnosable. Fixes #126400. (#129481) Thanks @Alix-007, @obviyus, and @bnello2021.
Provider network retries: align provider read/poll/download and agent-wait recovery for transient connection errors, retry bounded provider ENOTFOUND failures while leaving gateway ENOTFOUND and non-idempotent create operations fail-fast. (#101496) Thanks @xialonglee.
Google prompt-cache recovery: continue model requests when automatic cache creation returns malformed or unusable data, retain a still-valid cache when refresh fails, and honor cancellation and primary model errors. (#124479) Thanks @coaiMax and @vincentkoc.
Memory filename search: index paths separately from chunk bodies so exact full-path, basename, and stem queries rank the intended memory file first without changing body BM25 scores, snippets, or embeddings. (#94102, #104449) Thanks @Pick-cat and @alexph-dev.
Memory search: honor configured result limits for primary memory and session searches, and reserve stale-index warnings for failed background refreshes or incompatible indexes rather than routine background indexing. (#133254, #133239) Thanks @obviyus.
Wiki memory in direct agent runs: preserve wiki corpus search, prompt guidance, and configured digest context from eligible plugins already active in the same workspace, while excluding disabled plugins and conflicting sources. (#133234) Thanks @PollyBot13 and @obviyus.
LanceDB memory queries: fix ltm query --cols ... --order-by ... failing when the sort column is omitted from the requested output, while preserving sort order, limits, and exactly the requested columns. Fixes #133115. (#133120) Thanks @MeGaurav4 and @BG3JKC.
Embedding dimensions: honor dimensions supplied to /v1/embeddings even when the selected agent has memory search disabled, while preserving configured or provider defaults when dimensions are omitted. (#133158)
Memory REM topics: share canonical concept normalization across new extraction and stored-tag reflections, reject numeric/date noise, and count normalized spellings once per memory while preserving multilingual and short technical terms. (#117248) Thanks @synthalorian and @makominsk.
Plain-text XML tool calls: repair zero-argument calls and keep byte/character-bounded stream normalization from leaking incomplete or oversized tool syntax while preserving visible suffix text. (#102933, #103220, #103585, #104100) Thanks @wangyan2026, @qingminglong, @wuqxuan, @ZOOWH, and @aniruddhaadak80.
Model selection and runtime: honor explicit /model choices through Telegram reloads and fallback, use one live config snapshot per turn, and make Telegram model buttons select the configured runtime over outdated session overrides. Fallback choices remain turn-local. (#103324, #103510, #133125) Thanks @obviyus.
Native runtime reloads: preserve authored model settings separately from catalog defaults and refresh affected credential references through configuration and secrets reloads, so native sessions do not silently switch runtime or reuse superseded credentials. (#133195, #132122)
OpenAI-compatible streamed tool calls: execute complete native tool calls from streams that end with SSE data: [DONE] but omit finish_reason, while keeping transport EOF and visible-text cases fail-closed. (#98124, #97994) Thanks @SunnyShu0925 and @wszhhx.
Required tool-call streams: return finalized assistant prose with required or function-pinned tool calls instead of replaying provisional streamed text. (#133206)
xAI provider aliases: preserve Grok 4.3 and Grok 4.5 thinking profiles, fast-model routing, and encrypted reasoning replay when models use the shipped x-ai provider alias instead of clamping valid thinking requests to minimal. (#103315, #103340)
Claude CLI warm sessions: preserve managed stdio continuity when Claude writes no native transcript, fall back to bounded OpenClaw history only when the exact live child disappears or changes, and keep stateless runs from persisting CLI bindings. (#96841) Thanks @bradreaves and @vincentkoc.
CLI model tables: sanitize, truncate, and pad model-list cells by rendered terminal width so emoji, CJK, and other wide graphemes keep columns aligned. (#102819) Thanks @Kevin23-design and @vincentkoc.
CLI session tables: align Unicode session keys and wrap long model names and flags in session lists and cleanup previews, while keeping full session keys available through --json. (#133283) Thanks @gildo.
CLI table layout: keep multiline CRLF values and wrapped links aligned instead of splitting or shifting rows. (#133249)
Codex computer control: publish fixed-length coordinate pairs as homogeneous array schemas so Codex app-server can start threads with the computer tool instead of rejecting tuple-valued items. (#102944)
Computer observations: keep window, cursor, browser, dialog-inspection, and cropped-screenshot reads available during recovery without spending a mutation attempt, and return CUA zoom images with their dimensions. (#133188, #133266)
Google Gemini prefixed model IDs: recognize google/gemini-* and models/gemini-* when selecting multimodal function-response behavior, preserving the Gemini 2 image fallback without regressing Gemini 3 inline image responses. (#102382) Thanks @LiLan0125 and @yetval.
Tool-loop detection: when enabled, detect repeated browser/network failures despite new wrapper nonces and terminal failures despite changed timestamps, retry counts, durations, or process IDs. Retain meaningful progress and security markers. Fixes #130210. (#130261, #118402) Thanks @ruel225, @geekforlife, @MoerAI, @obviyus, and @zj0001.
MCP server globs: discover configured MCP tools for narrow runtime allowlists such as server*, using canonical enabled-server names while preserving final tool policy. (#115277) Thanks @ericcaiwx-star.
Native MCP policy: apply conversation and session tool restrictions to OpenClaw-configured MCP servers in Claude, Codex, and Gemini backends, including hidden-tool denials; omit servers with no permitted tools or no usable tool inventory. (#133089) Thanks @obviyus, @joshavant, and @abacha.
MCP startup and cleanup: keep metadata inspection and session cleanup from eagerly loading MCP transports or authentication, and prevent late runtime creation or disposal from reviving retired sessions or replacing newer connections. (#133028)
Cron llama.cpp tool schemas: keep the model-facing cron declaration schema compatible with llama.cpp while retaining gateway and runtime nonblank validation. Fixes #107449. (#108360) Thanks @lee-xydt and @Patt92.
OpenAI browser Talk sign-in: start the voice broker and refresh microphone readiness after sign-in; open neither microphone nor provider session until Talk starts. Platform keys take precedence, unresolved configured credentials fail closed, and ChatGPT sign-in works when no Platform credential is configured. (#115622, #115623, #133048)
OpenAI subscription voice: restore opt-in subscription-backed browser and Gateway-relay call setup and show voices that match the selected model in Talk settings; GA Gateway relay, Voice Call, and Discord backend voice retain their separate Platform-key requirements. (#133079)
Node-hosted tools: return structured deadline failures for plugin tools and prevent browser or other node commands from dispatching after their budget expires during pairing or parameter preparation. (#118720) Thanks @Yigtwxx.
Browser isolation: keep the browser panel on its session's selected profile. (#132159)
Browser extension relay: route Runtime binding callbacks only to registered clients and preserve shared bindings during client cleanup, preventing raw callback payloads from reaching unrelated Playwright sessions. (#132878)
Control UI browser tab identity: keep selected tab styling, accessibility, focus, address, and page snapshot aligned across in-place navigation and tab reordering. Fixes #120745. (#122128) Thanks @shakkernerd.
Control UI browser annotations: keep marked screenshots and page context in composer cards, preserve written drafts when annotations change, and retain complete unsent packages through same-tab routes and active split-pane remounts. Bounded Undo cannot restore removed context into another session. Fixes #120744. (#120848) Thanks @shakkernerd and @vincentkoc.
Browser extension relay security: require canonical 64-character relay secrets and safe WebSocket pairing URLs, and recheck OpenClaw tab-group consent at the extension edge before every authority-bearing existing-tab command. (#120390)
Browser auto-routing: fall back to the Gateway host when an implicitly selected browser node reports that its control host is unreachable, while preserving explicit node pins and ambiguous action failures.
Managed browser launch: surface asynchronous Chrome bootstrap and runtime spawn failures as browser errors while keeping Gateway alive, and retain process error handling through later lifecycle failures. (#103243) Thanks @vincentkoc.
Browser node-proxy downloads: transfer every action-produced download to the Gateway media store, align a 10 MiB per-file and 16 MiB aggregate transport budget, and rewrite plural download paths to Gateway-local files without traversing page-controlled result data. (#103328)
Remote browser CDP policy: preserve strict discovery policy for configured remote CDP endpoints without widening page-navigation authority. Thanks @vincentkoc.
Browser tab adoption: retain the implicit tab and stable aliases when new MCP, Playwright, or CDP targets fail final safety checks, abort after creation, or cannot be rediscovered. Validate labels before creation; clean up only adopted targets. (#105301) Thanks @hugenshen.
Browser snapshots: preserve slash-only control names, keep page text from retaining truncated refs or misplacing child frames, and return selector-scoped no-match results promptly; use an explicit wait action when an element is expected to appear later. Fixes #130571. (#130599, #131441) Thanks @joshavant, @gaoanze888, and @srb11e.
Browser refs: keep unnamed and overlong-named controls distinct from ordinary named controls to prevent wrong-target actions, and initialize raw ARIA DOM markers in their owning CDP session. (#130881)
Browser keyboard aliases: accept Esc, Return, Del, Ctrl, and Cmd in browser actions and shortcuts, and preserve keyboard guidance in compact tool schemas. (#130401) Thanks @geekforlife.
Signal delivery: keep redelivered messages queued behind busy conversations and retry approval reactions after transient Gateway failures. (#128093, #130134) Thanks @sallyom, @yetval, @wangmiao0668000666, and @obviyus.
WhatsApp attachments: retain unmatched attachments when a captioned replacement consumes only part of a pending reply. (#131672)
WhatsApp login ownership: keep QR login and account-changing actions restricted to the owning operator. (#129381) Thanks @joshavant.
Missing channel attachments: tell the agent when Telegram or Slack attachments could not be downloaded, including partially available Slack thread files. (#130849, #130857, #131896) Thanks @vyctorbrzezowski.
Slack conversation routing: let independently routed threads proceed concurrently and retain edited or deleted messages in their original thread context. (#114552, #128768)
Slack rich delivery: preserve table formatting in edits, avoid duplicate or already-consumed attachments, and keep complete multipart send receipts. (#130979, #131586, #129065, #130606)
Discord command feedback: replace a failed deferred-command spinner with a visible failure notice and settle deferred steering interactions. (#128630, #131006) Thanks @Marvinthebored, @Peetiegonzalez, @Alix-007, @Patrick-Erichsen, and @PollyBot13.
Telegram recovery: requeue ingress abandoned during a restart, surface provider failures even for message-tool-only replies, and preserve thread and reply placement receipts so recovery recognizes terminal forum-topic replies already delivered. (#122864, #129311, #133083) Thanks @jchoi-atn, @jisubi, @obviyus, @jalehman, @chelsealong, and @lakemike.
Telegram rich content: retain complete rich-message edits and accepted fallback chunks, keep lists inside details blocks, and preserve literal backticks in incoming code. (#130526, #128622, #131078, #130800) Thanks @Alix-007, @Pluviobyte, @VACInc, @ruel225, @Agi-Asi, @jesse-merhi, @edenfunf, @Finn763, @Grynn, @felirami, @sunlit-deng, @gaoanze888, @omarshahine, @wangmiao0668000666, @Leon-SK668, @zyw02, @nierob-cmd, @Patrick-Erichsen, @vincentkoc, @vyctorbrzezowski, @obviyus, @SunnyShu0925, and @alexph-dev.
Channel reply formatting: preserve overlapping styles, authored links, and code formatting in channel replies, including Telegram rich messages and Google Chat link fallbacks, and prevent empty HTML formatting from generating visible Markdown markers or rules. Fixes #133077. (#133161, #133103) Thanks @SunnyShu0925, @obviyus, and @yifanxiong272.
Plugin media delivery: deliver attachments through plugins that provide a formatted media sender without a plain media sender, including captionless and multiple attachments, and retain the delivered media in transcript bookkeeping instead of silently dropping it. (#133168) Thanks @ruel225.
Feishu documents and cards: split oversized Markdown cards without losing content or delivery receipts, and stop document insertion from looping on repeated child-page tokens. (#131106, #121124) Thanks @Alix-007 and @obviyus.
Matrix conversation context: use edited message content in replies and thread history and normalize encrypted attachment metadata before download. (#128763, #129739)
Teams upgrade safety: retain legacy conversation, poll, and authentication stores until migrated entries are verified, and restore channel-thread context with supported Graph queries. (#131284, #128901)
Telegram live locations: expose initial, moving, and stopped live-location updates through the channel-neutral message_received hook without starting agent turns for edits. (#122185) Thanks @mbelinky.
Telegram send acceptance: keep accepted-message bookkeeping failures out of transport fallback/chunk rejection, preventing duplicate or continued sends after recording fails. Retain inline buttons when rich quotes fall back to ordinary replies. (#130643) Thanks @vincentkoc.
Telegram durable ingress: preserve pre-identity control-lane ownership during replay and attempt each drain snapshot row only once per pass, preventing targeted commands from spinning the spool and blocking polling shutdown. (#118357) Thanks @vincentkoc.
Microsoft Teams message-tool replies: keep automatic live previews from duplicating a message already delivered to the current Teams conversation, while preserving distinct follow-up text and cross-conversation sends. Fixes #116397. (#116398) Thanks @a-tokyo and @vincentkoc.
Dev-channel updates: finish package-to-git switches in a fresh CLI process even when source SHA and version metadata are unchanged, preventing stale hashed chunks from loading after the global package root changes. Thanks @vincentkoc.
Docker correction-release versions: report the complete release version consistently in images, CLI output, the Gateway, and the Control UI so a running correction release does not offer itself as an update. (#129178) Thanks @zhangguiping-xydt, @obviyus, and @enblanco.
Buzz lifecycle recovery: isolate relay and room-role failures to the Buzz account reconnect loop, prevent subscription cleanup from terminating the Gateway, and clear stale channel errors after successful reconnects. (#113419) Thanks @shakkernerd, @Patrick-Erichsen, and @vincentkoc.
ClickClack split-origin setup codes: consume versioned exact claim endpoints without appending a second claim path, validate the returned canonical API base, preserve private API transport overrides, and keep legacy setup URLs working. Fixes #111919. (#111927) Thanks @shakkernerd.
Reef startup reconciliation: contain retryable relay failures during startup without supervisor restart loops, while preserving definitive-error and cancellation handling. (#110918) Thanks @Yigtwxx.
LINE durable inbound media: retry transient content preparation, network, and response-stream failures through durable ingress so media-only messages are not acknowledged before their attachment is saved. (#110921) Thanks @edenfunf and @shakkernerd.
Discord gateway metadata deadline: carry the existing lookup deadline through DNS and proxy preflight, request headers, and response bodies so stalled gateway startup aborts cleanly. (#104580) Thanks @hugenshen.
Tlon SSE connect cleanup: disarm opening deadlines after failed HTTP responses and rejected stream opens so reconnect attempts cannot leave stale timers behind. (#104585) Thanks @hugenshen.
LINE reply-token media kinds: honor video and audio metadata on inbound replies, share the canonical media builder with proactive sends, and fail visibly instead of recording empty media-only deliveries. (#106515) Thanks @edenfunf.
Mattermost websocket connection deadlines: bound opening handshakes so stalled TCP peers cannot hang channel startup indefinitely and reconnect control resumes after timeout. (#105553) Thanks @hugenshen.
Feishu app registration deadlines: bound OAuth device-registration requests to 10 seconds through the guarded fetch boundary so setup cannot hang indefinitely on stalled response headers. (#105549) Thanks @hugenshen.
LINE control-command mentions: detect authorized slash commands before mention stripping so inline group and direct-message controls preserve the original ingress metadata. (#107230) Thanks @edenfunf.
Feishu document image reads: apply the selected account timeout to remote-image headers and stalled bodies, parse Markdown through plugin MDAST, retain image/block alignment, and reject failed upload inputs before creating empty image blocks. (#104663) Thanks @Alix-007.
Slack Socket Mode health: report connected Socket Mode transports as degraded when auth.test fails or the configured bot token resolves to a user without bot_id, while preserving healthy enterprise-org installs. (#105556) Thanks @zw-xysk.
Synology Chat response limits: bound user-list response reads, stop oversized streams immediately, and retain stale cached identities when a NAS exceeds the supported envelope. (#105089) Thanks @zw-xysk.
LINE group history races: retain ambient group messages received during an active mention turn for the next turn while consuming the pre-turn snapshot exactly once. (#107367) Thanks @edenfunf.
Mattermost progress command details: accept the documented streaming.preview.commandText and streaming.progress.commandText modes in channel config validation and bundled metadata. Thanks @shakkernerd.
Tlon custom S3 uploads: pass storage endpoints through the AWS SDK's native parser so custom S3-compatible uploads no longer fail before presigning. (#107567)
Signal active-run controls: keep authorized stop, status, approval, and queue-read controls responsive during active turns while preserving ordinary and stateful turns in canonical session admission, and cancel every pending group sender lane on stop. (#107422) Thanks @arduano.
ClickClack durable media delivery: require media delivery, reuse owner-scoped upload/message nonces on retries, and repair stored attachments without rereading media. Fail closed when older servers cannot prove unknown sends; use the selected provider/model’s runtime output budget instead of a channel token cap. (#105775) Thanks @jjjhenriksen, @shakkernerd, @joshavant, and @vincentkoc.
LINE directive templates: suppress confirms and buttons with blank required fields or unlabeled actions while preserving valid titleless buttons and surrounding reply text. (#105520) Thanks @edenfunf.
Matrix bootstrap diagnostics: preserve complete UTF-8 code points in bounded stdout and stderr tails so crypto dependency failures do not show replacement characters at retention boundaries. (#105475) Thanks @qingminlong.
Channel ingress recovery: tombstone and scrub malformed durable ingress payloads without letting corrupt rows hide or starve later valid messages. (#105259) Thanks @Pick-cat.
Channel backlog and delivery recovery: keep large durable ingress backlogs draining through bounded candidate windows and allow queued session deliveries to be rearmed promptly after wall-clock changes. (#129717, #129913) Thanks @SunnyShu0925, @obviyus, and @Leon-SK668.
Discord thread archive defaults: inherit each parent channel's configured auto-archive duration for binding-created threads instead of forcing 60 minutes, while preserving explicit overrides. (#103413) Thanks @wings1029.
Outbound channel bootstrap: suppress repeated failed plugin activation for the same channel, config, and registry generation while retrying after config or registry reloads. (#100377) Thanks @xialonglee.
Telegram reasoning previews: reposition split reasoning previews through deferred deletion so prior preview messages do not remain stale while preserving client scroll position. (#97828) Thanks @ly-wang19 and @kyle20026.
Feishu native-card threading: normalize whitespace reply targets once and reuse the shared reply mode for card and media parts so native-card topic replies stay in their thread. (#102804) Thanks @sunlit-deng.
ClickClack output sanitization: strip internal tool and XML scaffolding at the sender boundary, suppress scaffold-only sends, and preserve optional modern delivery IDs. (#103142) Thanks @masatohoshino, @vincentkoc, and @zw-xysk.
Telegram DM conversation context: bind rendered outbound messages to transcript identities across chunked, rich-fallback, media, and streamed delivery, preventing duplicate Markdown replies. Retain the full transcript when a cached multipart projection is incomplete. (#102257, #102469) Thanks @crabkun, @consoleaf, and @chenyangjun-xy.
Google Chat request deadlines: bound control calls to 30 seconds while giving media transfers size-aware total budgets and a separate 30-second stalled-body guard, preventing hung Chat API requests without breaking large attachment uploads. (#102227) Thanks @hugenshen.
Mattermost block streaming: preserve complete, non-duplicated text and tool blocks in draft preview mode, and honor normal block streaming when preview streaming is disabled. (#87449) Thanks @yetval and @Senseonics-AI.
Signal native quote replies: preserve the active inbound message as a native quote across agent, explicit, durable, and chunked sends while keeping reply-mode policy inside the Signal plugin. (#105347) Thanks @jesse-merhi and @vincentkoc.
Microsoft Teams caption probes: wait for live captions on reused, manually opened meeting tabs and report a timeout when captions do not arrive. (#111466) Thanks @zhangguiping-xydt.
Discord voice playback: drain queued audio instead of cutting off replies under playback backpressure, and retire voice sessions when the realtime provider closes. (#130346, #131548)
Nextcloud Talk diagnostics: redact reflected credentials before displaying send, reaction, and bot-preflight errors, and suppress incomplete error bodies. (#119976) Thanks @xialonglee.
macOS Voice Wake cancellation: stop superseded silence, capture, and recognizer-restart timers immediately so cancelled work cannot restart the microphone pipeline or keep stale monitor loops alive. (#116189) Thanks @vincentkoc.
Meeting node audio retention: bound captured audio and terminal retention for Google Meet, Teams, and Zoom node-host sessions, make close idempotent, and force stalled bridge processes down after the graceful shutdown window.
Control UI Talk session isolation: stop active realtime Talk media and retire its callbacks before chat session changes, Gateway disconnects, or pane disposal so previous-session audio, transcript, camera, and status updates cannot leak into the next view. (#116067) Thanks @shakkernerd.
Queued TTS retries: copy local outbound media into queue-owned storage before enqueueing so voice replies survive producer temp cleanup and restart recovery, retain referenced artifacts through retry backoff, and prune unreferenced spool files after one day. Fixes #108501. (#108502) Thanks @masatohoshino.
TTS persona selection: reject conflicting --persona and --off arguments instead of silently selecting one. (#133191) Thanks @vincentkoc.
Discord voice participant context: maintain the live Gateway voice-state roster and include current channel participants in authorized voice agent turns so agents can answer who is present. Thanks @vincentkoc.
Control UI realtime Talk feedback: request browser echo cancellation, noise suppression, and automatic gain control for every microphone transport, and keep PCM capture processors connected through zero-gain sinks so microphone input cannot play locally.
Browser Talk recovery and transcripts: show an error and free media when microphone access or the voice connection fails. Retain complete Gemini Live utterances during calls even without explicit transcription-finished flags. (#133157)
Deepgram realtime custom endpoints: validate Voice Call streaming base URLs with secret-safe errors, preserve explicit ws:// and wss:// endpoints, and map HTTP schemes to their matching WebSocket transport for dedicated and self-hosted deployments. (#105334) Thanks @dwc1997, @vincentkoc, and @zw-xysk.
CLI audio transcript files: treat inferred Whisper and Parakeet text files as authoritative so empty or missing output cannot expose progress/status stdout as user speech. (#87393, #87384) Thanks @kesslerio.
Linux sleep recovery: prepare the local Linux Gateway for host sleep and reconnect channels and health promptly after wake. (#122489, #122719)
TUI draft safety: preserve large pasted drafts when a submission is blocked and keep failed attachments visible beside successful reply text. (#132528, #132115)
TUI reconnects: restore authoritative run activity after reconnects, leave completed runs idle, and prevent delayed session events from leaking into another agent conversation. (#131487, #130227, #130147, #129059)
TUI sign-in: surface provider sign-in failures and reload authentication ownership after successful login without restarting the terminal. (#125677, #130349) Thanks @P5ina, @obviyus, and @RomneyDa.
TUI commands: retain slash-command alias completion and stop local shell descendants when leaving the terminal. (#129039, #127652)
Profile-aware help: apply and validate explicit profile or development-mode selection before using cached CLI help. (#133148)
Control UI command palette: keep keyboard selection and Enter usable when reconnects or catalog refreshes replace search results, preserving the selected command while it remains available. (#131520)
Control UI Gateway labels: keep the discovered machine name through recovery initialization and refresh open folder-browser labels when name discovery finishes. (#131118)
Android settings: keep form fields and actions reachable above the keyboard, and respect bottom system insets without duplicating navigation padding. (#130995)
Android gateway discovery: resolve nearby gateways one at a time on Android 12 and 13 so simultaneously advertised gateways are not silently omitted. (#131001)
Control UI agent files: keep confirmed saves and file metadata intact when older reads or list refreshes finish later, preserve newer drafts, and rebuild invalidated file lists without losing the open editor. (#130468) Thanks @vincentkoc and @zw-xysk.
iOS approval navigation: fix opening Notifications from Overview approvals while preserving root-owned navigation and session state. (#130651)
Control UI terminal transcript settlement: retire live commentary, tool, and streamed reply projections atomically when the matching durable terminal message arrives, preventing duplicated final responses and transient row overlap after steering. Fixes #127209. (#127646) Thanks @shakkernerd.
Control UI session companion: load bounded visible session context before answering, keep unavailable questions retryable, and prevent private companion reference wrappers from appearing as answers. Fixes #120746. (#122380) Thanks @shakkernerd.
Control UI durable drafts: recover bounded unsent text and attachments through reloads and browser restarts within the same browser and Gateway credential scope, while keeping Incognito drafts in memory only. (#125332)
Control UI queued attachments: store and read whole attachment batches before sending/steering; retain drafts on payload errors. Binary queues require browser storage and Web Locks over HTTPS/localhost, capped at 25 MiB/message and 250 MiB/origin; restart-recoverable composer drafts remain separate. (#133052)
Control UI queued follow-ups: bind saved messages/drafts to their original conversation and agent through reloads, split panes, and changed main-session defaults. Use Restore here for review for ambiguous older destinations; recovered queues stay paused until explicit Retry. (#133067)
Control UI profile avatar refreshes: carry canonical content revisions through mutation responses and live presence so rapid replacements refresh every connected browser without stale cache rollback. (#120791) Thanks @shakkernerd, @Solvely-Colin, and @vincentkoc.
Control UI appearance accessibility: keep the unavailable custom-theme card announced as an Import command while preserving selected-state semantics for selectable themes and text sizes. (#120836) Thanks @shakkernerd.
Control UI dashboard index refresh: keep an open Dashboards page current after session changes, agent-scope updates, and Gateway reconnects while preserving the last safe list until replacement hydration completes. Fixes #120602. (#120627) Thanks @shakkernerd.
Control UI debug diagnostics: keep last-good status, health, model, and heartbeat snapshots visible when refreshes fail, show the failure inside Snapshots, isolate it from Manual RPC state, and prevent older manual calls from overwriting newer ones. (#117546) Thanks @shakkernerd.
Log-tail notices: distinguish bytes skipped by the configured read budget from file rotation in plain and JSON CLI notices. (#74252) Thanks @BSG2000 and @obviyus.
File logging diagnostics: warn when log appends drop records, redact sensitive path content, and keep forced-exit warnings visible on stderr without flooding repeated failures. (#132672) Thanks @Alix-007 and @obviyus.
Control UI read-only preferences: keep personal preference edits browser-local without attempting unauthorized config writes or claiming server sync, preserve offline intent for a later authorized reconnect, and restore the current server value on local reset. (#120036) Thanks @shakkernerd.
Control UI owner handoff: grant durable browser admin access through host-issued dashboard/graphical-onboarding links, including same-browser recovery from limited credentials. Keep generic, Telegram, mobile, and ordinary scope upgrades bounded. (#119785) Thanks @shakkernerd.
Control UI operator session permissions: honor Gateway-advertised operator scopes for new-thread creation, thread management, checkpoints, and sharing controls while preserving read-only navigation and legacy Gateway compatibility. Fixes #117786. (#117920) Thanks @shakkernerd.
Control UI delayed session commands: bind slash-command changes and confirmed resets to the originating Gateway, recheck operator scopes after async work, and retain reset authorization through queued delivery so reconnects cannot target replacement connections. (#118019) Thanks @shakkernerd.
Control UI archived session deletion: send archive-gated delete requests from Sessions-page row and mixed-selection actions so write-scoped operators can remove archived threads while active-session deletion remains admin-only. (#117468) Thanks @shakkernerd.
Control UI command recovery: keep delayed detached and immediate command failures scoped to their submitting session, preserving failed drafts and attachments for that pane without overwriting the active session. Fixes #116846. (#116947) Thanks @shakkernerd.
Control UI sharing connection isolation: discard stale visibility and membership mutation results after switching gateways or accounts so previous-connection refreshes and errors cannot update the replacement connection. Fixes #116800. (#116837) Thanks @shakkernerd.
Control UI session refreshes: preserve explicitly queued list filters and background hydration across later Gateway event invalidation, while keeping append pagination followed by a canonical refresh. Fixes #116697. (#116713) Thanks @shakkernerd.
Control UI session ownership: keep model controls, context usage, plan quotas, collaboration, and task transcripts attached to the selected agent's session, including global sessions, and refresh its roster immediately without accepting older agent-list results. (#132972, #133085, #133134, #133149, #133133) Thanks @fuller-stack-dev and @vincentkoc.
Control UI dynamic deep links: reuse the initial route loader result when publishing real agent, session, dashboard, Workboard, Memory, and Plugins paths, avoiding redundant route-loader work during startup. (#116197) Thanks @shakkernerd.
Linux gateway service ownership: refuse user-scope systemd publication/activation, even with --force, when the same unit is system-owned or system ownership cannot be verified. Show recovery guidance instead of creating restart-looping dual managers. Fixes #116129. (#116162) Thanks @vincentkoc and @obviyus.
macOS remote tunnel lifecycle: prevent cancelled or superseded restart backoffs from recreating SSH tunnels, and join a tunnel create that another caller started while the actor was suspended. (#116172) Thanks @vincentkoc.
macOS location permission requests: coalesce concurrent prompts so every caller resumes, and stop cancelled timeouts from opening Settings or completing a newer request. (#116183) Thanks @vincentkoc.
Control UI update reconciliation: retain unresolved managed updates through disconnects. Accept a replacement Gateway version only when it proves success; otherwise show recovery guidance rather than trust unrelated cached results or fail silently. Fixes #116075. (#116098) Thanks @shakkernerd and @vincentkoc.
macOS and Control UI keyboard navigation: let Tab traverse links and controls inside embedded Dashboard, browser, and Canvas web views, and keep shortcuts working on non-Latin keyboard layouts without firing during IME composition.
Control UI session diffs: hide unchanged checkout modifications and untracked files that already existed when a thread started, so the diff panel attributes only files touched by that session. Fixes #115628. (#115708) Thanks @vincentkoc.
Control UI initial prompts: keep accepted first messages visible across Gateway transport reconnects by binding the process-local handoff to the logical browser client instead of the per-handshake hello snapshot. (#114042)
Control UI terminal error messages: preserve message-only assistant output beginning with Error: or a warning marker instead of treating text prefixes as synthetic failures. (#111493) Thanks @shakkernerd, @vincentkoc, and @zw-xysk.
External supervisor restart health: accept device-identity policy closes only when the replacement gateway lock and listener PID agree, preventing OCM-managed restarts from timing out after a successful handoff. (#109273) Thanks @shakkernerd.
Control UI cloud session thinking: expose reasoning level in the New Session model picker and persist the selected level before cloud dispatch. (#108679)
iOS fresh-install setup: atomically redact spent setup credentials before Keychain cleanup so a deferred item deletion no longer disconnects a successfully paired device. Fixes #107591. (#108779) Thanks @dagmarjeeves-lab and @vincentkoc.
Control UI chat transcripts: retain loaded history across session/pane returns, bound automatic backscroll, virtualize long transcripts, retain hidden native run boundaries, and prevent flicker/jumps during prepends, streaming, and responsive layout. (#107965) Thanks @shakkernerd and @vincentkoc.
Control UI New Session reconnects: rediscover agents, nodes, branches, and folder state; refresh derived workspaces; gate unvalidated devices; and block ambiguous retries after Gateway-client replacement, retaining the typed task and explicit choices. Fixes #106372. (#106595) Thanks @vincentkoc.
macOS remote node readiness: take the main-session key from the node hello snapshot instead of opening an operator connection during node admission, preventing remote tunnel recovery from leaving Computer Use and node exec stuck in lifecycle transition. (#106481)
Native app connection and relay reliability: keep Android disconnected across Activity recreation; fail remote camera commands without permission prompts; refresh mobile node registration after capability changes; show iOS onboarding failures; cancel stale Talk owners on session switches; reject invalid Watch acknowledgments; retain startup Watch events; and fence stale agent-overview responses. Thanks @vincentkoc.
iOS Watch relay commands: allow paired iPhone nodes to advertise and invoke watch.status and watch.notify through the default Gateway policy while preserving the direct watchOS node's fixed minimal command surface. Thanks @vincentkoc.
iOS Share Extension drafts: preserve legitimate shared text beginning with scaffold-like prefixes, remove only exact legacy scaffold lines, avoid treating scheme-like prose as a URL, and deduplicate host-mirrored content. (#103453) Thanks @lin-hongkuan and @harjothkhara.
Control UI workspace avatars: inline validated agent avatar files in bootstrap and identity responses so Personal card images render without unauthenticated avatar-route requests, while preserving configured emoji precedence. (#102892, #97602, #103657) Thanks @LZY3538 and @mtuwei.
iOS session mutations: scope rename, archive, pin, delete, and fork requests to the selected agent, preserving the parent agent for forked sessions so multi-agent chat actions cannot mutate or create sessions under the wrong agent. (#103366, #103415) Thanks @lin-hongkuan and @harjothkhara.

Complete contribution record

The full contribution record is available in the tag-pinned CHANGELOG.md.

Release verification

Published artifacts verified.

npm 2026.8.1 · tarball. All 93 packages: latest, original prepared bytes, registry signatures and Sigstore provenance verified; 89 plugin runtime checks passed. npm proof · plugin provenance.
Root integrity: sha512-bSaFeaDFnQH/bU1vgKMac6eHkHHPHG0C/uwduXGI3eIS3lyiYSwmDU5ehhBUUhlPeV85tL5/KVwmoH48nX1tWw==. Core run 33350667120 passed. Parent 33348493128 and plugin run 33348804484 remain failed; independent recovery does not relabel them.
FRV 33344016503 attempt 1 passed with changelog-only reuse: immutable manifest. SDK acknowledgement: db305a57.
Exact root+AI downloads and four plugin lifecycles tested before publication. Published Gateway/live-agent smoke passed without embedded fallback; local evidence, not CI attestation.
Windows signed installers verified. Docker images, attestations, aliases and Vercel smoke verified.
ClawHub: 89/89 mirrors verified. Volcengine now resolves to the official plugin; the community package remains owner-qualified. Completion proof.
macOS app/DMG signed and notarized; ZIP/DMG downloads, matching symbols and signed feed verified: Mac proof. Website updated; iOS/Android distribution separate.
Waived, not passed: Telegram, MiniMax and catalog/subprocess flakes. Parallels stopped on guest/snapshot transport before target acceptance; nonblocking, not passed. Higher beta remains 2026.9.1-beta.1.

SDK: Shipped resolveStorePath, resolvePluginProviders, and loadModelCatalog contracts are restored. Intentional import retirements: migration guide. Direct EmbeddedRunAttemptResult construction needs canonical terminal or AgentHarnessAttemptResult; host-owned side-question types also narrow. No external side-question constructor was observed; remaining type findings do not establish runtime outages.

openclaw 2026.8.1 OpenClaw 2026.8.1 on Node.js NPM