openclaw v2026.8.1-beta.2

2026.8.1

Highlights

• Secret egress host binding: bind each shared-store secret to exact HTTPS destination hosts across CLI, Gateway RPC, and Control UI so unbound sentinel substitution fails closed before plaintext egress. Thanks @shakkernerd.
• GPT-5.6 Ultra and runtime switching: support Sol, Terra, and Luna across OpenClaw and Codex engines; keep model, runtime, and thinking selection atomic through /model and fallback; and add live matrix coverage for both harnesses. Thanks @anyech and @vincentkoc.
• Channel plugin ingress monitors: add a shared plugin SDK monitor for durable admission, polling, pruning, claim identity validation, adoption handoff, and shutdown, and migrate IRC, Synology Chat, and Google Chat to the shared lifecycle. Thanks @vincentkoc and @shakkernerd.
• SQLite snapshots: add openclaw backup sqlite create|list|verify|restore for compact, verified global and per-agent database artifacts with fresh-target-only restore. Thanks @giodl73-repo.
• macOS app profiles: isolate named app instances across state, preferences, Keychain, Gateway services, and duplicate-instance ownership while keeping host-global login and node services untouched. Thanks @shakkernerd and @vincentkoc.
• Plugin install provenance warnings: require explicit --force acknowledgement for arbitrary executable plugin sources in CLI and chat installs, keep trusted ClawHub, bundled, official-catalog, and tracked-update flows frictionless, and restrict Crestodian installs to trusted sources. Thanks @jesse-merhi and @vincentkoc.
• Control UI update recovery: the "A new version is available" Reload button now waits out the gateway restart that stranded the chunk and reloads as soon as it answers, instead of silently doing nothing and leaving a manual hard reload as the only way out. Thanks @vincentkoc.

Changes

• Secret egress host binding: bind each shared-store secret to exact HTTPS destination hosts across CLI, Gateway RPC, and Control UI so unbound sentinel substitution fails closed before plaintext egress. Thanks @shakkernerd.

• Release validation: defer beta candidate Parallels smoke to postpublish release:beta-smoke by default, keep stable/full prepublish coverage, and bound nested release workflow monitors with explicit job timeouts. Thanks @vincentkoc.

• macOS app profiles: isolate named app instances across state, preferences, Keychain, Gateway services, and duplicate-instance ownership while keeping host-global login and node services untouched. Thanks @shakkernerd and @vincentkoc.

• Developer workflow: remove the obsolete scoped-commit helper and use standard Git commands in isolated worktrees.

• Plugin uninstall cleanup: remove exact recorded install paths from plugins.load.paths for marketplace, npm, and other managed installs while preserving parent, child, prefix, and unrelated paths. Thanks @vincentkoc.

• Fixed Crabbox hydration on unprivileged cloud sandboxes by falling back to a user-writable pnpm store when the shared /var/cache/crabbox cache is unavailable, preserving the hardlink import mode after hydration, and making Docker an explicit routed capability instead of an implicit install requirement. Thanks @vincentkoc and @joshavant.

• Browser extension relay CDP compat: answer Target.getBrowserContexts so Puppeteer-based clients (chrome-devtools-mcp) can drive the paired Chrome without the remote-debugging permission prompt, serve DevTools-style /json/list target descriptors, and add openclaw browser extension cdp to print the relay endpoint plus auth header for external CDP clients. Thanks @vincentkoc.

• Local model setup: advertise provider-owned Ollama, llama.cpp, and LM Studio setup choices to Control UI and macOS, retry unavailable LM Studio services in place, and verify the exact prepared model before showing success. Thanks @vincentkoc.

• Control UI first-run setup: continue verified model setup into Custodian, explain that the web app is ready without a channel, and offer an optional dismissible path to Channels.

• Fish Audio speech: add hosted S2.1 synthesis with streaming, voice notes, voice discovery, and telephony, plus local Fish S2 Pro reference-voice streaming in native macOS Talk. Thanks @Conan-Scott, @vincentkoc, and @Patrick-Erichsen.

• Control UI cloud workspace conflicts: surface staged-ref guidance, bounded conflicted paths, structured transcript events, and sidebar attention for cloud worker results that kept local versions. Thanks @vincentkoc.

• Control UI update recovery: the "A new version is available" Reload button now waits out the gateway restart that stranded the chunk and reloads as soon as it answers, instead of silently doing nothing and leaving a manual hard reload as the only way out. Thanks @vincentkoc.

• Control UI sender identity polish: attributed user messages show the author's real avatar in an always-visible gutter on identity-resolving gateways, sender labels drop the opaque profile-UUID suffix (new and historical transcripts), and profile-id senders resolve avatars through the canonical gateway route. Thanks @shakkernerd and @vincentkoc.

• Control UI who's-online roster: click the sidebar footer facepile to open a scrollable roster of everyone online, showing each person's avatar, name, and email with your own entry pinned first.

• Discord and Slack native login: register /login in native command menus while keeping pairing-code issuance limited to private chats and the Web UI.

• Control UI user profiles: let trusted-proxy users manage their own display name and avatar, resolve attributed chat and presence identities through uploaded avatars or a private cached Gravatar proxy, and keep other users' profiles admin-only. Thanks @vincentkoc.

• Trusted-proxy browser pairing: optionally auto-approve new Control UI and WebChat devices from allowlisted proxy identities with non-admin scope caps, while keeping existing-device upgrades manual. Thanks @vincentkoc.

• Channel plugin ingress monitors: add a shared plugin SDK monitor for durable admission, polling, pruning, claim identity validation, adoption handoff, and shutdown, and migrate IRC, Synology Chat, and Google Chat to the shared lifecycle. Thanks @vincentkoc and @shakkernerd.

• Dashboard MCP apps: pin originating-session MCP app views as living dashboard widgets, renew their sandboxed view leases, and keep tool interactivity behind revision-bound grants with graceful stale-state recovery. Thanks @vincentkoc.

• External gateway supervision: add OPENCLAW_SUPERVISOR_MODE=external for lifecycle owners such as OCM, preserving verified restart and deferral behavior without exposing native service authority, blocking native service mutation and self-update, and providing a versioned atomic restart-handoff consume contract. Thanks @shakkernerd.

• Buzz message fidelity: preserve Markdown output and accept Buzz normal, rich-content, and structured-diff room messages through the existing authorized inbound path. Thanks @shakkernerd, @vincentkoc, and @zw-xysk.

• Buzz typing indicators: show room- and thread-scoped typing during agent replies and heartbeat deliveries, refresh through the active authenticated connection without waiting for relay acknowledgement, and drop ephemeral updates safely during disconnects or shutdown. Thanks @shakkernerd and @vincentkoc.

• Buzz sender directory: expose current bot, member, room, and room-member directory entries from bounded relay state; use current Buzz profile and room names in inbound context while preserving public keys and UUIDs as stable authorization and routing identities. Thanks @shakkernerd and @vincentkoc.

• Buzz native mentions: resolve unique current room-member names and explicit NIP-27 identities into native p tags for replies, proactive sends, and bounded standalone delivery; reject out-of-room identities and unresolved labels without an explicit identity, and preserve Buzz reply-thread session parsing during maintenance and heartbeat runs. Thanks @shakkernerd, @vincentkoc, and @joshavant.

• ClickClack guided setup: configure ClickClack from openclaw onboard or openclaw channels add clickclack with URL, token, and workspace prompts, default-account env fallback, nonfatal live connection validation, and gateway-aware next steps that connect automatically when OpenClaw is already running. Thanks @shakkernerd and @vincentkoc.

• ClickClack command menus: publish each bot's native OpenClaw commands to ClickClack composer autocomplete at gateway startup, with per-account opt-out and nonfatal compatibility handling for older tokens and servers. Thanks @shakkernerd and @vincentkoc.

• ClickClack bot collaboration: add opt-in bot-authored inbound dispatch with explicit sender authorization, mention gating, retry-safe loop protection, and independent thread budgets while keeping bot traffic denied by default. Thanks @jjjhenriksen, @shakkernerd, and @vincentkoc.

• Skill Workshop approvals: run agent-initiated apply, reject, and quarantine actions without an additional approval prompt by default while preserving skills.workshop.approvalPolicy: "pending" as an opt-in approval gate. Thanks @shakkernerd and @vincentkoc.

• TUI fuzzy selectors: delegate list matching to pi-tui, adding slash-token and alpha-number matching while removing the local matcher fork.

• macOS paired-node terminals: advertise duplex Codex and Claude terminal resume commands from the embedded node host and forward interactive input and cancellation through the native app bridge. (#107335) Thanks @vincentkoc.

• Control UI catalog terminals: open eligible Codex and Claude Code sessions in the native CLI on their Gateway or paired-node host, with viewer-versus-terminal preferences, validated resume commands, and an interactive PTY relay. Thanks @vincentkoc.

• Control UI coding catalogs: show provider brand icons beside Claude Code and Codex session catalog headings in the sidebar. Thanks @vincentkoc.

• Skill Workshop history review: add a manual, newest-first session scan that progressively searches older substantial work for conservative skill ideas, stores only SQLite cursor metadata, and leaves up to three results as pending proposals even when autonomous self-learning is disabled. (#106182) Thanks @vincentkoc and @shakkernerd.

• SQLite snapshots: add openclaw backup sqlite create|list|verify|restore for compact, verified global and per-agent database artifacts with fresh-target-only restore. Thanks @giodl73-repo.

• GPT-5.6 Ultra and runtime switching: support Sol, Terra, and Luna across OpenClaw and Codex engines; keep model, runtime, and thinking selection atomic through /model and fallback; and add live matrix coverage for both harnesses. Thanks @anyech and @vincentkoc.

• OpenAI GPT-5.6 defaults: use openai/gpt-5.6 (Sol alias) for fresh API-key setup and exact openai/gpt-5.6-sol for fresh Codex/OAuth setup, default Sol to medium reasoning across both runtimes, and preserve existing primaries, fallbacks, aliases, and explicit GPT-5.5 selections. (#103234) Thanks @shakkernerd and @vincentkoc.

• Meta provider: add bundled muse-spark-1.1 model support with Responses API streaming, tool calls, encrypted reasoning replay, onboarding, and standalone npm/ClawHub distribution. Thanks @HamidShojanazeri and @vincentkoc.

• Android chat agent selector: switch the active agent directly from the live chat screen while keeping chat, Talk mode, and home canvas on the same canonical session. Thanks @bcperry and @joshavant.

• Gateway host status: show the connected Gateway's host, network address, OS, runtime, uptime, CPU, memory, and disk details in Control UI Settings. Thanks @vincentkoc.

• iOS offline chat: pre-paint recent sessions and canonical transcripts from a protected, bounded per-gateway cache, keep sending disabled offline, and purge cached conversation text when pairing is reset. (#100194) Thanks @vincentkoc.

• Slack progress indicators: use Slack's native assistant thread status and rotating loading messages by default while keeping acknowledgement reactions static; lifecycle reaction updates now require messages.statusReactions.enabled: true. Thanks @vincentkoc.

• Control UI Talk controls: keep voice, model, sensitivity, and other realtime defaults in Settings → Communications → Talk, and use the composer microphone caret to select any browser audio input. (#101046) Thanks @vincentkoc.

• Control UI session workspace shortcut: expand or collapse the active Chat pane's session workspace rail with ⇧⌘B without changing the main app sidebar or the separate detail and Canvas preview panel. Thanks @shakkernerd and @vincentkoc.

• Control UI Settings shortcut: open Settings with ⇧⌘, while leaving the browser-owned ⌘, shortcut unchanged. Thanks @shakkernerd.

• Control UI chat layout: center the transcript on the composer axis, keep assistant and tool output left and user bubbles right within the same readable frame, and preserve custom message-width overrides. (#104474) Thanks @shakkernerd, @vincentkoc, and @zw-xysk.

• Control UI composer footer: center the chat settings chip and model controls between the divider and the card edge instead of pinning them to the divider. (#105866)

• Control UI assistant actions: keep assistant name and time first while placing hover actions beside them on the left instead of at the far edge. Thanks @shakkernerd.

• Cron model selection: choose an agent-turn model in Control UI Quick Create and show configured or default models in cron job rows and details. Thanks @ly85206559, @joshavant, and @vincentkoc.

• Control UI GitHub previews: show issue and pull request state, title, author, activity, comments, and change statistics in hover and keyboard-focus cards.

• Logbook work journal: add a disabled-by-default bundled plugin that turns paired-node screen snapshots into a private timeline, daily standup, and timeline-grounded Q&A in a plugin-contributed Control UI tab. Thanks @vincentkoc.

• Control UI message context: reveal per-message token, context, and model details from the timestamp on hover or activation instead of showing a separate Context button.

• Control UI session titles: reveal truncated recent-session names with a reduced-motion-safe hover animation.

• Control UI sidebar navigation: show a small customizable pinned destination set, keep the remaining pages under More, move Settings to the footer, and persist sidebar customization in the browser. Thanks @vincentkoc.

• Control UI sidebar usage: remove the provider usage quota row from the expanded sidebar while keeping usage details available in the chat composer and Usage page. Thanks @shakkernerd and @vincentkoc.

• Android chat code highlighting: render fenced Kotlin, Swift, TypeScript, JavaScript, Python, Bash, and JSON blocks with bounded, theme-aware syntax colors while preserving plain rendering for unknown, partial, or oversized blocks.

• Gateway TTS playback: add an operator-scoped tts.speak RPC that returns configured-provider speech as inline whole-clip audio for remote clients. (#100708)

• Workboard dispatch cap: add a request-scoped --max-starts override while preserving the default cap, sequential starts, and one-card-per-owner guard. (#100174) Thanks @souvikDevloper, @Souvikalp, and @jwest75674.

• Plugin install provenance warnings: require explicit --force acknowledgement for arbitrary executable plugin sources in CLI and chat installs, keep trusted ClawHub, bundled, official-catalog, and tracked-update flows frictionless, and restrict Crestodian installs to trusted sources. Thanks @jesse-merhi and @vincentkoc.

• Custodian rich setup controls: render the Gateway's sanitized wizard steps as native selects, multiselects, text fields, and masked secret inputs while preserving text-only chat compatibility. (#114631) Thanks @jesse-merhi and @shakkernerd.

Fixes

• Codex subagent fan-out: settle successful terminal yields immediately and preserve requester ownership so completed children reliably resume their parent. Thanks @vincentkoc.

• Control UI session companion: load bounded visible session context before answering, keep unavailable questions retryable, and prevent private companion reference wrappers from appearing as answers. Fixes #120746 Thanks @shakkernerd and @maweibin.

• Telegram live locations: expose initial, moving, and stopped live-location updates through the channel-neutral message_received hook without starting agent turns for edits.

• Updater plugin convergence: keep pre-plugin doctor passes from installing configured plugins before the updater's plugin sweep, while preserving the final post-plugin migration pass and preventing ambient update-phase state from leaking into fresh doctor processes. Thanks @vincentkoc.

• Control UI browser tab identity: keep selected tab styling, accessibility, focus, address, and page snapshot aligned across in-place navigation and tab reordering. Fixes #120745 Thanks @shakkernerd and @vincentkoc.

• Control UI staged attachments: preserve unsent images, files, pasted images, and large pasted text across same-tab route and narrow split-pane remounts while keeping pane close, mismatched pane/session/Gateway remounts, application shutdown, and hard reload as cleanup boundaries. Fixes #121519 Thanks @shakkernerd and @vincentkoc.

• Control UI browser annotations: keep marked screenshots and generated page context together in structured composer cards, preserve user-written drafts when annotations are removed or replaced, retain complete unsent annotation packages across same-tab route and active split-pane remounts, and offer bounded Undo without restoring removed context into another session. Fixes #120744 Thanks @shakkernerd and @vincentkoc.

• Control UI profile avatar refreshes: carry canonical content revisions through mutation responses and live presence so rapid replacements refresh every connected browser without stale cache rollback. Thanks @shakkernerd and @vincentkoc.

• Control UI appearance accessibility: keep the unavailable custom-theme card announced as an Import command while preserving selected-state semantics for selectable themes and text sizes. Thanks @shakkernerd.

• Control UI dashboard index refresh: keep an open Dashboards page current after session changes, agent-scope updates, and Gateway reconnects while preserving the last safe list until replacement hydration completes. Fixes #120602 Thanks @shakkernerd and @vincentkoc.

• Browser extension relay security: require canonical 64-character relay secrets and safe WebSocket pairing URLs, and recheck OpenClaw tab-group consent at the extension edge before every authority-bearing existing-tab command. Thanks @vincentkoc and @joshavant.

• Control UI debug diagnostics: keep last-good status, health, model, and heartbeat snapshots visible when refreshes fail, show the failure inside Snapshots, isolate it from Manual RPC state, and prevent older manual calls from overwriting newer ones. Thanks @shakkernerd, @vincentkoc, and @maweibin.

• Control UI read-only preferences: keep personal preference edits browser-local without attempting unauthorized config writes or claiming server sync, preserve offline intent for a later authorized reconnect, and restore the current server value on local reset. Thanks @shakkernerd and @vincentkoc.

• Control UI owner handoff: give browsers opened by host-issued dashboard and graphical onboarding links durable administrator access, including same-browser recovery from a limited credential, while keeping generic, Telegram, mobile, and ordinary scope-upgrade paths bounded. Thanks @shakkernerd and @vincentkoc.

• Control UI agent and skill permissions: gate Agents, Skills, Skill Workshop, and delayed mutation dispatches by the current Gateway method catalog and operator scopes while preserving read-only browsing and legacy Gateway compatibility. Fixes #119176 Thanks @shakkernerd and @vincentkoc.

• Guided onboarding skip-UI routing: keep openclaw onboard --skip-ui and openclaw setup --skip-ui on guided onboarding while skipping both browser and terminal handoffs, instead of silently switching to the classic wizard. Thanks @shakkernerd.

• Telegram durable ingress: preserve pre-identity control-lane ownership during replay and attempt each drain snapshot row only once per pass, preventing targeted commands from spinning the spool and blocking polling shutdown. Thanks @vincentkoc.

• Control UI operator session permissions: honor Gateway-advertised operator scopes for new-thread creation, thread management, checkpoints, and sharing controls while preserving read-only navigation and legacy Gateway compatibility. Fixes #117786 Thanks @shakkernerd and @vincentkoc.

• Control UI delayed session commands: bind slash-command mutations and confirmed resets to their originating Gateway, recheck current operator scopes after asynchronous work, and retain reset authorization through queued delivery so reconnects cannot target a replacement connection. Thanks @shakkernerd and @vincentkoc.

• Control UI archived session deletion: send archive-gated delete requests from Sessions-page row and mixed-selection actions so write-scoped operators can remove archived threads while active-session deletion remains admin-only. Thanks @shakkernerd, @joshavant, and @vincentkoc.

• Control UI command recovery: keep delayed detached and immediate command failures scoped to their submitting session, preserving failed drafts and attachments for that pane without overwriting the active session. Fixes #116846 Thanks @shakkernerd and @vincentkoc.

• Microsoft Teams message-tool replies: keep automatic live previews from duplicating a message already delivered to the current Teams conversation, while preserving distinct follow-up text and cross-conversation sends. Fixes #116397. (#116398) Thanks @a-tokyo, @vincentkoc, and @maweibin.

• Buzz plugin packaging: keep the live QA runner on the shipped QA runner SDK surface and remove the obsolete package shrinkwrap so standalone npm and ClawHub package builds use current host exports and dependency resolutions. Thanks @shakkernerd and @vincentkoc.

• Control UI sharing connection isolation: discard stale visibility and membership mutation results after switching gateways or accounts so previous-connection refreshes and errors cannot update the replacement connection. Fixes #116800 Thanks @shakkernerd and @vincentkoc.

• Control UI session refreshes: preserve explicitly queued list filters and background hydration across later Gateway event invalidation, while keeping append pagination followed by a canonical refresh. Fixes #116697 Thanks @shakkernerd and @vincentkoc.

• Gateway device clock skew: sign device proofs with the Gateway-issued challenge timestamp across TypeScript, Control UI, browser extension, Android, Apple, Linux, and watchOS clients so incorrect local clocks no longer block authentication, while retaining no-challenge compatibility for pre-challenge Control UI servers and older watch-node HTTP endpoints and keeping nonce binding and freshness checks enforced. Fixes #103455 Thanks @joshavant and @vincentkoc.

• Control UI dynamic deep links: reuse the initial route loader result when publishing real agent, session, dashboard, Workboard, Memory, and Plugins paths, avoiding redundant route-loader work during startup. Thanks @shakkernerd and @vincentkoc.

• Linux gateway service ownership: refuse user-scope systemd publication and activation when the same gateway unit name is already owned or cannot be verified in the system scope, including --force, with actionable recovery guidance instead of creating restart-looping dual managers. Fixes #116129 Thanks @vincentkoc Thanks @obviyus and @vincentkoc.

• macOS remote tunnel lifecycle: prevent cancelled or superseded restart backoffs from recreating SSH tunnels, and join a tunnel create that another caller started while the actor was suspended.

• macOS location permission requests: coalesce concurrent prompts so every caller resumes, and stop cancelled timeouts from opening Settings or completing a newer request. Thanks @vincentkoc.

• macOS Voice Wake cancellation: stop superseded silence, capture, and recognizer-restart timers immediately so cancelled work cannot restart the microphone pipeline or keep stale monitor loops alive.

• Meeting node audio retention: bound captured audio and terminal retention for Google Meet, Teams, and Zoom node-host sessions, make close idempotent, and force stalled bridge processes down after the graceful shutdown window. Thanks @vincentkoc and @obviyus.

• Control UI update reconciliation: preserve an unresolved managed-update request across disconnects, accept the replacement Gateway version when it proves success, and otherwise show explicit recovery guidance instead of trusting an unrelated cached update result or failing silently. Fixes #116075 Thanks @shakkernerd and @vincentkoc.

• Control UI model readiness: put AI setup first when no model is selectable, distinguish signed-in credentials from ready providers, and route accounts with no exposed models directly to provider recovery instead of leading with disabled default controls. Thanks @shakkernerd and @vincentkoc.

• Control UI Talk session isolation: stop active realtime Talk media and retire its callbacks before chat session changes, Gateway disconnects, or pane disposal so previous-session audio, transcript, camera, and status updates cannot leak into the next view. Thanks @shakkernerd and @vincentkoc.

• Control UI Realtime tool calls: execute OpenAI WebRTC tools only from completed responses, bound retained call identities and UTF-8 arguments, and ignore provisional or late duplicate events so long Talk sessions cannot grow tool state without limit. Thanks @vincentkoc and @maweibin.

• Gateway reconnect event ordering: reset the shared TypeScript client's outer event-sequence baseline for each replacement WebSocket, preventing gap recovery from comparing unrelated connection generations across Control UI, TUI, SDK, and browser extension clients. Thanks @shakkernerd and @vincentkoc.

• Skill Workshop offline apply: preserve configless local proposal apply after upgrades under exclusive Gateway startup ownership, while keeping running Gateway snapshot invalidation fail-closed when CLI credentials are unavailable. Thanks @vincentkoc.

• macOS and Control UI keyboard navigation: let Tab traverse links and controls inside embedded Dashboard, browser, and Canvas web views, and keep shortcuts working on non-Latin keyboard layouts without firing during IME composition.

• Control UI session diffs: hide unchanged checkout modifications and untracked files that already existed when a thread started, so the diff panel attributes only files touched by that session. Fixes #115628. Thanks @vincentkoc.

• Code Mode small-model repair: give malformed pre-dispatch exec calls one bounded correction turn, expose typed failure-phase and bridge-dispatch evidence, and stop retries after nested tools begin. Fixes #115311 Thanks @vincentkoc.

• Shared state corruption recovery: evict only the exact cached SQLite owner after proven read or write corruption so a repaired database recovers without a Gateway restart while caller-injected handles remain untouched. Fixes #114269 Thanks @rizquuula and @vincentkoc.

• Dev-channel updates: finish package-to-git switches in a fresh CLI process even when source SHA and version metadata are unchanged, preventing stale hashed chunks from loading after the global package root changes. Thanks @joshavant and @vincentkoc.

• Parallels release smoke: preserve Windows installer reboot results across Parallels, wait for WSL MSI/default-version readiness, force explicit test-owned gateway stops, and reset Linux package, config, and cache state before install lanes, preventing false prerequisite, safety-gate, and stale-config failures. Thanks @vincentkoc, @joshavant, and @shakkernerd.

• OpenAI Realtime Talk auth: remove the non-public Codex OAuth realtime fallback and require an OpenAI Platform API key for Talk, Voice Call, and Discord realtime voice, preventing OAuth-only gateways from advertising a browser session that the live service rejects. Fixes #115021 Thanks @shakkernerd, @vincentkoc, @maweibin, and @joshavant.

• Codex native subagent handoff: tell Codex harness turns to use sessions_yield for later-turn child completion delivery, reserve wait_agent for immediately blocked same-turn steps, and omit the guidance when yielding is unavailable. Fixes #115443 Thanks @shakkernerd and @vincentkoc Thanks @bek91, @vincentkoc, and @shakkernerd.

• Codex native controls: stop misclassifying valid thinking/fast runtime controls as provider overrides so Codex routes keep their native controls, while provider-native objects and invalid values stay fail-closed. Thanks @VACInc, @vincentkoc, and @shakkernerd.

• State snapshot verification: run SQLite snapshot verification in a separate process so worker-thread file closes no longer drop the Gateway's POSIX WAL locks, eliminating spurious WAL misses and I/O errors. Thanks @VACInc, @vincentkoc, and @zw-xysk.

• Reply latency with model policies: reuse one immutable plugin-metadata snapshot per model-selection run instead of repeating plugin discovery, cutting reply delay when a model policy is configured. Thanks @VACInc, @vincentkoc, and @shakkernerd.

• Claude cache after stalls: recover stalled Claude CLI sessions by forking from the last pre-turn checkpoint so native cache continuity survives without duplicating the pending prompt, with a cold reseed fallback for CLIs without checkpoint support. Thanks @VACInc, @vincentkoc, and @obviyus.

• Control UI initial prompts: keep accepted first messages visible across Gateway transport reconnects by binding the process-local handoff to the logical browser client instead of the per-handshake hello snapshot. Thanks @vincentkoc.

• Gateway exec deny fallback: fail closed immediately when shell-expanded arguments prevent an allowlisted command from producing an enforceable execution plan and effective policy is ask=off with askFallback=deny, instead of registering an approval that can only time out. Fixes #113191 Thanks @shakkernerd and @vincentkoc Thanks @jrvanwinkle and @vincentkoc.

• Cron local-provider preflight: report the guarded-fetch deadline as a bounded preflight timeout, preserve concrete nested non-timeout errors, and carry the failure reason into fallback warnings. Thanks @shakkernerd, @vincentkoc, and @zw-xysk.

• Buzz lifecycle recovery: isolate relay and room-role failures to the Buzz account reconnect loop, prevent subscription cleanup from terminating the Gateway, and clear stale channel errors after successful reconnects. Thanks @shakkernerd and @vincentkoc.

• Buzz standalone sends: let openclaw message send and other non-Gateway processes open a bounded authenticated relay connection, publish the message, and close cleanly while running Gateways continue to reuse their active connection. Thanks @shakkernerd.

• Buzz presence: publish nonblocking online presence when the Gateway connects, refresh it without overlapping heartbeat writes, and let Buzz's final-connection cleanup provide accurate offline state across reconnects and multiple Gateway instances. Thanks @shakkernerd and @vincentkoc.

• Buzz bot profiles: persist optional Buzz account names, publish them as bot display names without delaying Gateway startup, preserve existing profile metadata, and include configured owner attestations so Buzz can show verified provenance. Thanks @shakkernerd, @vincentkoc, and @joshavant.

• Buzz agent identity: register connected bots in Buzz's agent directory without overwriting existing profile policy, so later room invitations retain the Bot role instead of downgrading the identity to a normal member. Thanks @shakkernerd.

• Buzz guided setup: reuse or generate the bot identity automatically, wait for Bot-role approval before falling back to identity-preserving Retry/Back controls, select single-room defaults, preserve advanced access settings, accept normal room messages by default without relying on composer mentions, verify setup without posting test messages, finish targeted channel setup directly, derive new bot profiles from the routed agent identity, and authorize fresh setups from Buzz's live room roster without per-message relay queries. Thanks @shakkernerd, @vincentkoc, and @joshavant.

• Buzz resumable setup: persist paused bot identities, resume disabled setup in place, retry authenticated room discovery without rotating keys, require verified Bot-role room membership instead of accepting unverified room UUIDs, and give accurate CLI authorization guidance for generated identities that Buzz desktop cannot discover. Thanks @shakkernerd.

• Buzz inbound authorization: apply shared room sender and command authorization before agent dispatch, allow authorized control commands to bypass mention gating, and preserve Buzz thread/reply identifiers through delivery. Thanks @shakkernerd and @vincentkoc.

• ClickClack split-origin setup codes: consume versioned exact claim endpoints without appending a second claim path, validate the returned canonical API base, preserve private API transport overrides, and keep legacy setup URLs working. Fixes #111919 Thanks @shakkernerd and @vincentkoc.

• Standalone plugin files: let manifestless files explicitly listed in plugins.load.paths pass config validation and load independently when several files share a directory. Thanks @vincentkoc.

• Control UI terminal error messages: preserve message-only assistant output beginning with Error: or a warning marker instead of treating text prefixes as synthetic failures. Thanks @shakkernerd, @vincentkoc, and @zw-xysk.

• Channel outbound echo suppression: drop recently emitted platform message and source identities at shared inbound admission and migrate Discord thread unbinds off channel-local expiry state, preventing delayed webhook copies from re-entering agents. Thanks @vincentkoc.

• Reef startup reconciliation: contain retryable relay failures during startup without supervisor restart loops, while preserving definitive-error and cancellation handling. Thanks @Yigtwxx and @vincentkoc.

• Codex stale-session replies: stop model fallback after another gateway supersedes a Codex session generation and deliver a safe retry notice instead of abandoning the message silently. Thanks @vincentkoc, @shakkernerd, and @obviyus.

• Bounded input and provider responses: cap pasted auth/config input and enforce wall-clock deadlines across generated-media downloads, polling JSON, and failed response details so oversized or slow-drip streams cannot exceed resource budgets (thanks @Pick-cat). Thanks @vincentkoc.

• LINE durable inbound media: retry transient content preparation, network, and response-stream failures through durable ingress so media-only messages are not acknowledged before their attachment is saved. Thanks @edenfunf, @vincentkoc, and @shakkernerd.

• Cloud worker derived workspace caches: exclude Python caches, dependency trees, and macOS metadata symmetrically from outbound sync and inbound reconciliation so local cache rewrites cannot fence later cloud results or worker reclaim. Thanks @vincentkoc.

• Codex model status diagnostics: report a configured Codex route as unavailable when its harness plugin is disabled, missing, or quarantined, while preserving the separate credential result and making models status --check fail instead of silently treating fallback execution as healthy. Thanks @shakkernerd and @vincentkoc.

• Gateway control-plane rate limiting: use per-method buckets with a 30-per-minute budget so interactive admin writes remain responsive while retaining runaway-loop protection.

• External supervisor restart health: accept device-identity policy closes only when the replacement gateway lock and listener PID agree, preventing OCM-managed restarts from timing out after a successful handoff. Thanks @shakkernerd, @vincentkoc, and @joshavant.

• ACPX cleanup process inspection: bound host process-table reads so stalled ps calls cannot hang gateway startup or session cleanup while retaining fail-closed ownership checks. Thanks @Alix-007 and @vincentkoc.

• Cron lifecycle conflict retries: preserve execution-phase retry decisions across scheduled, manual, and startup-recovered runs so post-execution claim conflicts cannot replay completed messages or tools. Fixes #108428 Thanks @yetval and @vincentkoc.

• Discord gateway metadata deadline: carry the existing lookup deadline through DNS and proxy preflight, request headers, and response bodies so stalled gateway startup aborts cleanly. Thanks @hugenshen, @vincentkoc, and @shakkernerd.

• Control UI cloud session thinking: expose reasoning level in the New Session model picker and persist the selected level before cloud dispatch. Thanks @vincentkoc.

• iOS fresh-install setup: atomically redact spent setup credentials before Keychain cleanup so a deferred item deletion no longer disconnects a successfully paired device. Fixes #107591 Thanks @dagmarjeeves-lab and @vincentkoc.

• Tlon SSE connect cleanup: disarm opening deadlines after failed HTTP responses and rejected stream opens so reconnect attempts cannot leave stale timers behind. Thanks @hugenshen and @vincentkoc.

• LINE reply-token media kinds: honor video and audio metadata on inbound replies, share the canonical media builder with proactive sends, and fail visibly instead of recording empty media-only deliveries. Thanks @edenfunf and @vincentkoc.

• Mattermost websocket connection deadlines: bound opening handshakes so stalled TCP peers cannot hang channel startup indefinitely and reconnect control resumes after timeout. Thanks @hugenshen, @vincentkoc, and @obviyus.

• Queued TTS retries: copy local outbound media into queue-owned storage before enqueueing so voice replies survive producer temp cleanup and restart recovery, retain referenced artifacts through retry backoff, and prune unreferenced spool files after one day. Fixes #108501 Thanks @masatohoshino, @vincentkoc, and @obviyus.

• Feishu app registration deadlines: bound OAuth device-registration requests to 10 seconds through the guarded fetch boundary so setup cannot hang indefinitely on stalled response headers. Thanks @hugenshen, @shakkernerd, and @vincentkoc.

• LINE control-command mentions: detect authorized slash commands before mention stripping so inline group and direct-message controls preserve the original ingress metadata. Thanks @edenfunf and @vincentkoc.

• Feishu document image reads: bound remote document-image headers and stalled bodies with the selected account timeout, parse document Markdown through the plugin's MDAST pipeline, preserve image/block alignment, and reject failed upload input before creating empty image blocks. Thanks @Alix-007 and @vincentkoc.

• ClawHub registry reads: retry bounded HTTP 500 responses alongside other transient gateway failures so multi-package release scans survive isolated registry errors. Thanks @vincentkoc.

• Slack Socket Mode health: report connected Socket Mode transports as degraded when auth.test fails or the configured bot token resolves to a user without bot_id, while preserving healthy enterprise-org installs. Thanks @zw-xysk and @vincentkoc.

• Synology Chat response limits: bound user-list response reads, stop oversized streams immediately, and retain stale cached identities when a NAS exceeds the supported envelope. Thanks @zw-xysk and @vincentkoc.

• Usage date ranges: exclude legacy transcript rows without timestamps from finite session ranges while preserving them in all-time totals, and rebuild older usage caches before serving the new semantics. Fixes #89709 Thanks @TurboTheTurtle, @shakkernerd, and @vincentkoc Thanks @syfvb, @shakkernerd, and @vincentkoc.

• LINE group history races: retain ambient group messages received during an active mention turn for the next turn while consuming the pre-turn snapshot exactly once. Thanks @edenfunf and @vincentkoc.

• Mattermost progress command details: accept the documented streaming.preview.commandText and streaming.progress.commandText modes in channel config validation and bundled metadata. Thanks @shakkernerd and @vincentkoc.

• 1Password authorization handoff: persist nonce-bound pending approvals in shared plugin state so hook and tool execution across broker instances remain single-use and fail closed. Thanks @vincentkoc and @obviyus.

• Control UI chat transcripts: preserve loaded history across session and pane returns, bound automatic backscroll loading, virtualize long transcripts, retain hidden native run boundaries, and keep prepends, streaming, and responsive layouts from flickering or jumping. Thanks @shakkernerd and @vincentkoc.

• Codex dynamic tool outcomes: use the shared tool-result failure contract for arbitrary lifecycle metadata, preventing successful Skill Workshop results from being displayed and persisted as failed calls. Fixes #107684 Thanks @shakkernerd, @vincentkoc, @maweibin, and @obviyus.

• Codex /status context freshness: consume exact per-response usage from Codex app servers that emit rawResponse/completed; when exact usage is unavailable or omitted, keep context unknown instead of reusing cumulative lifetime totals. Thanks @wuqxuan and @vincentkoc.

• Codex resumed permissions: apply stored per-session approval and sandbox overrides to primary resumed harness turns so /codex permissions survives later messages and gateway restarts. Thanks @shakkernerd.

• Nested resource ignores: honor slash-free patterns and escaped literal exclamation marks in nested ignore files during skill and resource discovery. Thanks @moguangyu5-design and @vincentkoc.

• Proxy bypass precedence: honor blank lower-case no_proxy values shadowing upper-case NO_PROXY consistently with Undici, and reuse the canonical matcher for Telegram fallback selection. Thanks @vincentkoc.

• Tokenjuice exec compaction: avoid retaining raw command output inside compacted middleware metadata, preventing large successful compactions from failing the middleware details-size guard. Thanks @vincentkoc.

• Agent git package identities: strip refs before hosted-repository parsing and reject traversal segments so GitLab branch refs resolve to the canonical managed install path. Thanks @vincentkoc.

• Tlon custom S3 uploads: pass storage endpoints through the AWS SDK's native parser so custom S3-compatible uploads no longer fail before presigning.

• Signal active-run controls: keep authorized stop, status, approval, and queue-read controls responsive during active turns while preserving ordinary and stateful turns in canonical session admission, and cancel every pending group sender lane on stop. Thanks @arduano and @vincentkoc.

• Agent auth storage locks: surface normal release failures while avoiding redundant release attempts after proper-lockfile reports a compromised lock. Thanks @vincentkoc and @joshavant.

• Paired-node session catalogs: authorize bundled Anthropic and Codex catalog requests to invoke their read-only node commands from Control UI read flows, restoring remote Claude/Codex rows and terminal resume availability. Fixes #107406 Thanks @vincentkoc.

• Sandbox recreate confirmation: treat Clack cancellation as a decline so Ctrl-C cannot proceed with container removal.

• Microsoft Teams HTML text: decode HTML5 entities consistently in quoted and Graph-fetched messages while preserving literal escaped entity text. Thanks @vincentkoc.

• ClawHub plugin API ranges: delegate each supported comparator to semver so tilde, partial-wildcard, and prerelease caret bounds are correct while preserving OpenClaw version normalization and the existing restricted range grammar. (#106877) Thanks @vincentkoc.

• Web Readability relative links: seed parsed documents with the request URL so article links resolve correctly while removing the plugin's duplicate lazy-loader facade. (#106860) Thanks @vincentkoc and @shakkernerd.

• Browser auto-routing: fall back to the Gateway host when an implicitly selected browser node reports that its control host is unreachable, while preserving explicit node pins and ambiguous action failures. Thanks @vincentkoc and @shakkernerd.

• Discord voice participant context: maintain the live Gateway voice-state roster and include current channel participants in authorized voice agent turns so agents can answer who is present. Thanks @vincentkoc and @shakkernerd.

• OC Path JSONC insertion: patch object and array insertions through jsonc-parser so comments, trailing commas, and CRLF formatting survive. (#106847)

• Windows winget installs: continue in the current PowerShell session when winget installs Node.js before the machine PATH update becomes visible, avoiding a false Node.js not found failure. (#106862) Thanks @vincentkoc.

• Control UI realtime Talk feedback: request browser echo cancellation, noise suppression, and automatic gain control for every microphone transport, and keep PCM capture processors connected through zero-gain sinks so microphone input cannot play locally. Thanks @vincentkoc.

• Agent source-reply recovery: preserve current-chat delivery evidence for message sends executed through Code Mode, preventing successful replies from triggering a redundant retry and misleading delivery-failure diagnostic. Thanks @vincentkoc and @joshavant.

• Gateway in-process restarts: clear stale SIGUSR1 restart state and resume prepared host suspensions before rebuilding runtime admission, preventing restart cooldowns or paused scheduling from leaking into the next lifecycle. Thanks @vincentkoc and @shakkernerd.

• ClickClack durable media delivery: route media replies through required delivery, reuse owner-scoped upload and message nonces across retries, repair persisted attachment state without rereading source media, fail closed when an older ClickClack server cannot prove an unknown send, and use the selected provider and model's runtime output budget instead of a channel-level token cap. Thanks @jjjhenriksen, @shakkernerd, and @vincentkoc.

• Deepgram realtime custom endpoints: validate Voice Call streaming base URLs with secret-safe errors, preserve explicit ws:// and wss:// endpoints, and map HTTP schemes to their matching WebSocket transport for dedicated and self-hosted deployments. (#105334) Thanks @dwc1997, @vincentkoc, and @zw-xysk.

• Control UI New Session reconnects: rediscover agents, nodes, repository branches, and folder-browser state, refresh derived workspaces, gate unvalidated devices, and block ambiguous retries after Gateway client replacement while preserving the typed task and explicit choices. Fixes #106372 Thanks @vincentkoc and @shakkernerd.

• macOS remote node readiness: take the main-session key from the node hello snapshot instead of opening an operator connection during node admission, preventing remote tunnel recovery from leaving Computer Use and node exec stuck in lifecycle transition. Thanks @vincentkoc.

• Claude CLI context budgets: honor Anthropic model and per-agent contextTokens limits by passing the effective limit to Claude Code's native auto-compactor and persisting the same prepared budget in OpenClaw session state. Fixes #80933. (#93198) Thanks @mushuiyu886, @gorkem2020, @vincentkoc, and @shakkernerd.

• Transcript read failures: propagate permission and I/O failures from streaming JSONL session reads instead of treating unreadable transcripts as empty. Thanks @zenglingbiao, @shakkernerd, and @vincentkoc.

• Restart sentinel diagnostics: report SQLite read/write and legacy-file cleanup failures while preserving best-effort restart recovery behavior. Thanks @zenglingbiao, @wendy-chsy, @vincentkoc, and @shakkernerd.

• Native app connection and relay reliability: keep Android disconnects stopped across Activity recreation, fail remote camera commands without opening permission prompts, refresh mobile node registration after capability changes, surface iOS onboarding connection failures, cancel stale Talk owners on session switches, reject invalid Watch acknowledgments, preserve Watch events received during startup, and prevent older agent overview requests from replacing newer gateway state. Thanks @vincentkoc and @joshavant.

• Gateway source watch: hand the configured port off from the installed service before starting the tmux watcher, preserve failed panes for attach/capture, and keep explicit alternate-port watches side by side with the managed Gateway. Thanks @vincentkoc.

• Claude CLI max-turn diagnostics: preserve terminal max-turn results with OpenClaw and Claude session context, warn when tool actions may already have run, and stop unsafe auth-profile or model replay for potentially side-effecting turns. (#94130) Thanks @zhangguiping-xydt, @tdrose01, @vincentkoc, and @shakkernerd.

• Provider network retries: align provider read/poll/download and agent-wait recovery for transient connection errors, retry bounded provider ENOTFOUND failures while leaving gateway ENOTFOUND and non-idempotent create operations fail-fast. (#101496) Thanks @xialonglee, @joshavant, and @vincentkoc.

• Session retry classification: stop permanent provider errors whose identifiers or payload details merely contain 429/5xx digit sequences from re-sending full context, and share bounded rate-limit-window parsing across retry paths. (#105258) Thanks @destire-mio, @yetval, and @vincentkoc.

• LINE directive templates: suppress confirms and buttons with blank required fields or unlabeled actions while preserving valid titleless buttons and surrounding reply text. (#105520) Thanks @edenfunf.

• SQLite maintenance schema validation: reject current-version global and agent databases with missing or drifted canonical tables, constraints, indexes, triggers, or table options before compaction, while accepting supported additive-migration layouts. Thanks @vincentkoc.

• Matrix bootstrap diagnostics: preserve complete UTF-8 code points in bounded stdout and stderr tails so crypto dependency failures do not show replacement characters at retention boundaries. (#105475) Thanks @qingminlong and @vincentkoc.

• iOS Watch relay commands: allow paired iPhone nodes to advertise and invoke watch.status and watch.notify through the default Gateway policy while preserving the direct watchOS node's fixed minimal command surface. Thanks @vincentkoc and @shakkernerd.

• Swabble status config: honor the global --config path when reading service status instead of silently using the default configuration. Thanks @vincentkoc and @shakkernerd.

• Gradium TTS credential egress: reject non-HTTPS, foreign-host, and hostname-lookalike base URLs before dispatching API keys, and pin guarded transport to Gradium's documented API hostname. Thanks @zhangguiping-xydt and @vincentkoc.

• ClawHub retry timing: reject fractional delay-seconds and calendar-normalized invalid Retry-After dates so runtime and release reads stay on their bounded fallback schedule. (#105479) Thanks @qingminlong, @masatohoshino, @CadanHu, @vincentkoc, and @obviyus.

• Gateway command SecretRefs: preserve authoritative active-snapshot values when another command secret remains unresolved, falling back locally only for missing paths instead of emitting a per-turn secrets.resolve failure. Thanks @SunnyShu0925 and @vincentkoc.

• Cron delivery status: keep successful isolated agent turns at status=ok when downstream delivery fails, while preserving the send failure separately in delivery state and run logs. Thanks @Alix-007 and @vincentkoc.

• Channel ingress recovery: tombstone and scrub malformed durable ingress payloads without letting corrupt rows hide or starve later valid messages. Thanks @Pick-cat.

• Discord thread archive defaults: inherit each parent channel's configured auto-archive duration for binding-created threads instead of forcing 60 minutes, while preserving explicit overrides. (#103413) Thanks @wings1029.

• Installed plugin loading: make native-module fallback use jiti's transform path instead of retrying the same synchronous ESM load, preventing Node 24 startup races when official plugins import SDK contract modules. Thanks @vincentkoc.

• QA profile channel execution: partition mixed Crabline channel scenarios into one aggregate host suite so taxonomy-backed profile commands and evidence workflows no longer abort before execution.

• Plugin SDK API baseline: cover every public entrypoint, preserve complete declaration shapes without source-line churn, and run baseline and export-surface guards from changed-file validation. Thanks @vincentkoc and @zw-xysk.

• Official plugin beta compatibility: keep the exact beta.5 session-store helper imports working over SQLite through the documented deprecation window, preventing installed Codex and Feishu plugins from failing during package acceptance and upgrades. Thanks @vincentkoc and @shakkernerd.

• SQLite terminal session recovery: track physical transcript mutation time in the agent database so killed or timed-out main sessions rotate when transcript writes outlive the registry update, while preserving legacy transcript mtimes during doctor import. Thanks @vincentkoc and @shakkernerd.

• Gateway chat typecheck: import chat event types from their owning protocol schema after the retired aggregate type module was removed, restoring full project typechecks. Thanks @vincentkoc.

• Packaged Crabbox commands: include the lease-freshness helper imported by the published wrapper so crabbox:* commands do not fail with ERR_MODULE_NOT_FOUND in npm installs. Thanks @shakkernerd and @vincentkoc.

• Plugin session catalogs: reject unknown catalog filters, report catalogs as plugin capabilities, and preserve them in SDK registration captures instead of silently returning empty results or classifying catalog-only plugins as capability-free. Thanks @vincentkoc.

• Gateway service audit: treat POSIX shell -c wrappers as opaque for the gateway-subcommand check, avoiding false missing-command warnings for shell-wrapped macOS LaunchAgents without parsing inner commands or ports. Fixes #81751. (#81778) Thanks @liaoandi and @vincentkoc.

• Memory filename search: index paths separately from chunk bodies so exact full-path, basename, and stem queries rank the intended memory file first without changing body BM25 scores, snippets, or embeddings. (#94102) Thanks @Pick-cat and @vincentkoc.

• Outbound channel bootstrap: suppress repeated failed plugin activation for the same channel, config, and registry generation while retrying after config or registry reloads. (#100377) Thanks @xialonglee and @vincentkoc.

• OpenAI Realtime client-secret deadlines: bound voice and transcription secret acquisition to 30 seconds through the guarded fetch boundary while preserving authentication and bounded response parsing. (#102860) Thanks @Alix-007, @Leon-SK668, @vincentkoc, and @shakkernerd.

• Gateway client watchdog: keep transport-stall detection active for unbounded and mixed pending requests so dead sockets reject pending requests, reconnect, and never replay rejected requests. (#103407) Thanks @NianJiuZst and @vincentkoc.

• iOS Share Extension drafts: preserve legitimate shared text beginning with scaffold-like prefixes, remove only exact legacy scaffold lines, avoid treating scheme-like prose as a URL, and deduplicate host-mirrored content. (#103453) Thanks @lin-hongkuan, @harjothkhara, @vincentkoc, and @joshavant.

• Telegram reasoning previews: reposition split reasoning previews through deferred deletion so prior preview messages do not remain stale while preserving client scroll position. (#97828) Thanks @ly-wang19 and @kyle20026.

• Feishu native-card threading: normalize whitespace reply targets once and reuse the shared reply mode for card and media parts so native-card topic replies stay in their thread. (#102804) Thanks @sunlit-deng and @vincentkoc.

• Plain-text XML tool calls: repair zero-argument calls and keep byte/character-bounded stream normalization from leaking incomplete or oversized tool syntax while preserving visible suffix text. (#102933, #103220, #103585) Thanks @wangyan2026, @qingminglong, @wuqxuan, @ZOOWH, @aniruddhaadak80, @vincentkoc, and @maweibin.

• QQBot token requests: bound token acquisition with the shared 30-second guarded-fetch deadline so stalled singleflight callers fail together, clean up, and can retry. (#102897) Thanks @maweibin, @vincentkoc, and @obviyus.

• Canvas A2UI validation: reject malformed or unsupported JSONL at CLI, agent-tool, and final node-invoke boundaries while preserving native v0.8 dispatch. (#103713) Thanks @qingminglong and @vincentkoc.

• Twilio RCS inbound routing: normalize RCS consumer addresses only after signed webhook validation so sender matching and sessions work without changing outbound RCS semantics. (#102373) Thanks @clawSean and @vincentkoc.

• ClickClack output sanitization: strip internal tool and XML scaffolding at the sender boundary, suppress scaffold-only sends, and preserve optional modern delivery IDs. (#103142) Thanks @masatohoshino, @vincentkoc, @maweibin, and @zw-xysk.

• CLI installer cleanup: remove Node staging directories and pnpm workspace-rewrite temporary files on failure. Thanks @SebTardif and @vincentkoc.

• Agent-core truncation: avoid empty-output crashes when head truncation receives negative line or byte ceilings. (#103425) Thanks @qingminglong and @vincentkoc.

• Windows Node resolution: preserve the current executable when resolving bare case-insensitive node.exe entries under hostile PATH values. (#103907) Thanks @soldforaloss and @vincentkoc.

• Codex runtime switching: accept the bundled Codex runtime for both codex/* and openai/* model routes while keeping unsupported provider/runtime pairs rejected. (#103762) Thanks @vincentkoc and @shakkernerd.

• Agent abort cleanup: serialize prompt lock reacquisition with terminal cleanup so canceled embedded runs do not self-contend on session locks for up to 60 seconds. Thanks @vincentkoc.

• Chutes OAuth deadlines: bound token exchange, profile lookup, and refresh requests, and keep issued tokens when optional userinfo enrichment stalls. (#102026) Thanks @Alix-007 and @vincentkoc.

• Control UI workspace avatars: inline validated agent avatar files in bootstrap and identity responses so Personal card images render without unauthenticated avatar-route requests, while preserving configured emoji precedence. (#102892, #97602) Thanks @LZY3538, @mtuwei, and @vincentkoc.

• Exec safe-bin flags: auto-approve curated read-only boolean flags for default stdin-only filters while keeping unknown flags, tail follow/retry modes, file operands, and custom profiles fail-closed. (#88953) Thanks @yetval and @vincentkoc.

• iOS session mutations: scope rename, archive, pin, delete, and fork requests to the selected agent, preserving the parent agent for forked sessions so multi-agent chat actions cannot mutate or create sessions under the wrong agent. (#103366, #103415) Thanks @lin-hongkuan and @harjothkhara.

• Model pin hot reload and fallback: keep explicit /model selections authoritative across Telegram config reloads and model fallback, capture one live config snapshot per assembled turn, and leave fallback candidates turn-local instead of persisting them over the user's pin. (#103324) Thanks @obviyus and @vincentkoc.

• Swift protocol initializers: default every schema-optional generated initializer parameter to nil so additive protocol fields no longer break SDK construction call sites.

• Telegram DM conversation context: correlate rendered outbound messages with stable transcript identities across chunked, rich-fallback, media, and streamed delivery, preventing Markdown replies from appearing twice while retaining the full transcript when a cached multipart projection is incomplete. (#102257, #102469) Thanks @crabkun, @consoleaf, @chenyangjun-xy, and @vincentkoc.

• OpenCode Go MiMo catalog: stop exposing the deprecated mimo-v2-omni and mimo-v2-pro aliases that reject agent requests, and keep release validation on the active MiMo V2.5 routes. (#103311, #103329) Thanks @krissding, @vincentkoc, and @joshavant.

• Audit time filters: reject impossible calendar dates for openclaw audit --after and --before instead of rolling them into unintended intervals, while preserving timezone-less timestamp semantics. (#103433) Thanks @qingminglong and @vincentkoc.

• OpenAI-compatible streamed tool calls: execute complete native tool calls from streams that end with SSE data: [DONE] but omit finish_reason, while keeping transport EOF and visible-text cases fail-closed. (#98124, #97994) Thanks @SunnyShu0925, @wszhhx, @vincentkoc, and @maweibin.

• xAI provider aliases: preserve Grok 4.3 and Grok 4.5 thinking profiles, fast-model routing, and encrypted reasoning replay when models use the shipped x-ai provider alias instead of clamping valid thinking requests to minimal. (#103315) Thanks @vincentkoc and @shakkernerd.

• Doctor state isolation: prevent automated update and Gateway watch repair from importing and archiving default-home exec or plugin-binding approvals when OPENCLAW_STATE_DIR points elsewhere, keep implicit CLI preflight notice-only, and reserve cross-state imports for direct operator doctor runs. (#103247, #103317) Thanks @vincentkoc.

• Doctor clean-state guidance: stop suggesting openclaw doctor --fix after a clean run with no config changes while preserving targeted repair hints. (#103233) Thanks @kewang-pika, @nonplace, and @vincentkoc.

• Google music generation: retry one unblocked Lyria response that omits its contractually required audio while keeping prompt blocks and terminal generation stops non-retryable. (#103318) Thanks @shakkernerd.

• OpenCode Zen model catalog: refresh the provider-owned static seed for Claude Sonnet 5, Grok 4.5, Hy3 Free, Kimi K2.7 Code, and MiniMax M3 with verified routing, pricing, limits, and input capabilities, remove retired free-tier rows, and expose the same catalog through unauthenticated model listing. (#103184) Thanks @vincentkoc, @shakkernerd, and @joshavant.

• Managed browser launch: surface asynchronous Chrome bootstrap and runtime spawn failures as browser errors while keeping Gateway alive, and retain process error handling through later lifecycle failures. Thanks @vincentkoc and @shakkernerd.

• Browser node-proxy downloads: transfer every action-produced download to the Gateway media store, align a 10 MiB per-file and 16 MiB aggregate transport budget, and rewrite plural download paths to Gateway-local files without traversing page-controlled result data. Thanks @vincentkoc.

• Gateway startup migrations: release the shared migration lease before exiting when the selected config changes during startup, allowing immediate retries instead of blocking readiness until the five-minute lease expires. (#103145) Thanks @joshavant, @vincentkoc, and @shakkernerd.

• Apple timeout recovery: return promptly from shared operation deadlines and caller cancellation even when platform work ignores cancellation, while isolating late Gateway handshakes and cleaning up location and permission waiters. (#103066) Thanks @NianJiuZst and @vincentkoc.

• Claude CLI warm sessions: preserve managed stdio continuity when Claude writes no native transcript, fall back to bounded OpenClaw history only when the exact live child disappears or changes, and keep stateless runs from persisting CLI bindings. (#96841) Thanks @bradreaves, @vincentkoc, and @shakkernerd.

• CLI plugin listing: skip state-migration runtime loading when no legacy inputs exist, reducing packaged cold-start memory while preserving migrations for legacy plugin indexes and configured session stores. Thanks @vincentkoc.

• Unicode-safe bounded text: preserve complete UTF-16 surrogate pairs when shortening previews, prompts, diagnostics, labels, session keys, link metadata, and identity values across Control UI, CLI, Gateway, plugins, QA, memory, and Android surfaces. (#102625, #102626, #102627, #102816, #102823, #102833, #102877, #102949, #102963, #102969, #102988, #103010, #103034, #103210, #103341, #103487, #103543, #103580, #103646) Thanks @zhangguiping-xydt, @wings1029, @wangyan2026, @Pandah97, @MoerAI, @SunnyShu0925, @zhangqueping, @zw-xysk, @cxbAsDev, @lzyyzznl, @coder-master-0915, @LeonidasLux, @mushuiyu886, @ly85206559, @Simon-XYDT, @lsr911, @vincentkoc, @cursoragent, @chengzhichao-xydt, and @wangmiao0668000666.

• Cron list table: sanitize and size bounded cells by terminal display width so CJK, emoji, combining marks, and terminal-control input cannot corrupt alignment or output. (#103616) Thanks @mushuiyu886 and @vincentkoc.

• CLI model tables: sanitize, truncate, and pad model-list cells by rendered terminal width so emoji, CJK, and other wide graphemes keep columns aligned. (#102819) Thanks @Kevin23-design and @vincentkoc.

• Skills prompt compaction: preserve every included skill identity before using the remaining prompt budget for shortened, UTF-16-safe descriptions, retaining trigger guidance without exceeding the hard limit. (#88426) Thanks @abel-zer0, @vincentkoc, @mushuiyu886, @cursoragent, @chengzhichao-xydt, @wangmiao0668000666, and @Pandah97.

• Channel Markdown code tables: size columns by rendered display width so CJK, emoji, and mixed-width cells stay aligned across shared Telegram and Discord output. (#55596, #55512) Thanks @sparkyrider and @zjy282.

• QQ Bot approval previews: wrap long sanitized commands and metadata at grapheme boundaries with visible continuation markers and safe fences, keeping desktop QQ reviews readable without changing command content. (#102119, #101979) Thanks @Bartok9, @xuzhi5858, @vincentkoc, @maweibin, @mushuiyu886, and @cursoragent.

• Codex computer control: publish fixed-length coordinate pairs as homogeneous array schemas so Codex app-server can start threads with the computer tool instead of rejecting tuple-valued items. Thanks @vincentkoc.

• Google Chat request deadlines: bound control calls to 30 seconds while giving media transfers size-aware total budgets and a separate 30-second stalled-body guard, preventing hung Chat API requests without breaking large attachment uploads. (#102227) Thanks @hugenshen, @vincentkoc, and @shakkernerd.

• Google Gemini prefixed model IDs: recognize google/gemini-* and models/gemini-* when selecting multimodal function-response behavior, preserving the Gemini 2 image fallback without regressing Gemini 3 inline image responses. (#102382) Thanks @LiLan0125, @yetval, and @vincentkoc.

• Generated provider model catalogs: keep MiniMax and NVIDIA catalog rows when they advertise audio or video metadata while projecting runtime model inputs to text/image, preventing configured multimodal primaries from being dropped and falling back. (#97858, #97048) Thanks @ly-wang19, @zackchiutw, @shakkernerd, and @vincentkoc.

• DeepSeek catalog metadata: align V4 Flash and Pro pricing with DeepSeek's current cache-hit, cache-miss, and output rates; refresh exact catalog metadata written by older onboarding flows; and document the July 24 retirement of the legacy deepseek-chat and deepseek-reasoner compatibility names. (#103192) Thanks @vincentkoc.

• CLI audio transcript files: treat inferred Whisper and Parakeet text files as authoritative so empty or missing output cannot expose progress/status stdout as user speech. (#87393, #87384) Thanks @kesslerio.

• Browser actions on Node 24: keep browser request cancellation bound to the client and response lifetime instead of Node 24.16+'s prematurely aborted body-stream signal, preventing valid POST actions from failing after JSON parsing. Thanks @obviyus and @vincentkoc.

• SecretRef model credentials: keep resolved provider secrets behind process-local sentinels through auth storage, stream setup, SDK configuration, and managed local-provider probing, then inject plaintext only at the final network or provider-plugin boundary while retaining exact-value log redaction. (#102008) Thanks @vincentkoc and @shakkernerd.

• Lean local model shell access: keep exec directly visible beside the default structured Tool Search controls so coding-tuned local models can use their shell fallback instead of searching for missing domain tools. Thanks @vincentkoc and @maweibin.

• OAuth refresh contention diagnostics: keep local lock paths out of user-facing refresh failures and avoid duplicate failure prefixes while preserving structured provider and profile classification. Thanks @vincentkoc and @shakkernerd.

• Exec approval prompts: keep background-disabled fallback warnings out of pending gateway/node approvals and show them only after a command actually runs in the foreground. Thanks @vincentkoc.

• Direct poll delivery: route direct and hybrid channel polls through the owning outbound adapter while preserving gateway-mode routing and channel option checks. Thanks @NianJiuZst, @vincentkoc, and @shakkernerd.

• Agent wait hard-timeout snapshots: preserve canonical hard-timeout phase and timestamps when the outer agent.wait timer wins the retry-grace race, while leaving queue, draining, and restart-cancelled waits correctable. Thanks @Pick-cat and @vincentkoc.

• Control UI typed approvals: send /approve commands immediately through the authorized Gateway command path while an agent run is blocked instead of queueing the command behind that run. Thanks @vincentkoc and @shakkernerd.

• Microsoft Teams Graph response bounds: cap successful file-upload and chat JSON reads so oversized Microsoft Graph responses cannot be buffered without limit. Thanks @Alix-007 and @vincentkoc.

• Packaged speech runtime: stop treating package-backed speech-core as a bundled plugin sidecar, restoring TTS startup in npm installs while release checks keep true activation-bypassing facades package-complete. (#89425) Thanks @zhangguiping-xydt and @vincentkoc Thanks @ant1b0t and @vincentkoc.

• Codex app-server protocol: require app-server 0.142 or newer, remove pre-0.142 wire-shape compatibility, and teach Codex to retrieve deferred native spawn_agent through tool_search so native subagent task mirroring works on search-capable models. Thanks @vincentkoc and @shakkernerd.

• Android hardware keyboard chat: send with unmodified Enter on physical keyboards while preserving Shift+Enter and other modified Enter combinations for multiline input. (#101239) Thanks @3ninyt3nin-creator and @vincentkoc.

• CJK Markdown emphasis: render adjacent Chinese, Japanese, and Korean emphasis punctuation through the shared Markdown pipeline instead of leaking literal markers across channels. (#101120) Thanks @nicknmorty. Thanks @j08577600-jpg.

• Backup retry cleanup: close partial archive output handles and isolate each retry path after live-write failures, preventing Windows EBUSY locks from cascading across attempts or leaving stale temp archives. . Thanks @ZOOWH, @LiLan0125, @vincentkoc, @joshavant, @shakkernerd, and @obviyus.

• Codex yielded native subagents: keep the parent app-server subscription and shared client alive until yielded native subagent completion delivery settles, preventing lost wakeups and leaked one-shot cleanup. Thanks @vincentkoc.

• Delivery recovery pacing: pace eligible outbound and restart-continuation replays after gateway startup so outage backlogs do not burst into channel rate limits, while preserving the wall-clock recovery budget. (#101058) Thanks @ZengWen-DT, @vincentkoc, and @obviyus Thanks @aniruddhaadak80, @vincentkoc, and @obviyus.

• Outbound pre-connect recovery: clear stale platform-send evidence atomically when a connect or DNS failure proves no request was sent, allowing queued Discord and other channel messages to replay after connectivity returns without weakening the unknown-send duplicate guard. (#100979) Thanks @SunnyShu0925 and @vincentkoc Thanks @tiffanychum and @vincentkoc.

• Discord streamed finals: send completion replies as fresh messages so inactive channels become unread, while preserving targeted mentions without escalating @everyone or @here. (#99662) Thanks @davelutztx and @vincentkoc.

• OpenAI-compatible SSE parsing: recognize event streams mislabeled as JSON without prepending a second data: prefix, preserving valid streamed responses from non-conforming providers. Thanks @ZengWen-DT and @vincentkoc.

• LM Studio embedding preload: honor model- and provider-level context-window limits when preloading embedding models, preventing avoidable GPU out-of-memory failures. Thanks @zak-li, @ZOOWH, and @hxz398.

• Provider overload messaging: keep rate-limited responses classified for retry and fallback behavior while using overload wording when the provider supplies no explicit retry detail. Thanks @SunnyShu0925 and @vincentkoc.

• Microsoft Teams attachment metadata: bound Bot Framework attachmentInfo JSON reads and cancel oversized streams before they can exhaust Gateway memory. Thanks @ly85206559 and @vincentkoc.

• Agent auth copy order: preserve the source agent's portable auth-profile precedence when copying credentials to a new agent while excluding skipped profiles and transient auth state. Thanks @machine3at, @vincentkoc, and @shakkernerd.

• Memory session repair: keep daily dreaming ingestion bookkeeping outside session-corpus audit and repair so memory status --fix preserves healthy daily state. Thanks @Alix-007 and @vincentkoc.

• Remote browser CDP policy: allow the configured CDP control host through an existing hostname allowlist without widening page navigation policy, while keeping strict-policy discovery bound to the configured control authority. (#100819) Thanks @NianJiuZst and @vincentkoc Thanks @SarinV and @vincentkoc.

• Config unset diagnostics: explain when an inherited or default configuration value cannot be unset instead of reporting a misleading successful deletion. Thanks @moeghashim.

• Crestodian command probes: contain stdout and stderr stream failures while keeping child-process close and spawn errors authoritative, preventing unhandled probe crashes. Thanks @lsr911, @vincentkoc, and @zw-xysk.

• Feishu mention forwarding: fail closed when the bot Open ID is unavailable so group messages cannot be misclassified as explicit bot mentions. Thanks @zhangguiping-xydt.

• Cron edit delivery: preserve each job's implicit delivery mode when applying partial delivery updates, so disabling best-effort delivery no longer turns detached job announcements off. Thanks @machine3at, @vincentkoc, and @shakkernerd.

• Control UI session creation: keep newly created sessions at the front of the stable sidebar order after selecting another session. Thanks @shakkernerd.

• Control UI file previews: keep large Skill Workshop files responsive with cached, offscreen-contained text chunks while preserving wrapped content, stable file switching, full-file copy, and clean focus behavior. Thanks @xianshishan, @shakkernerd, and @vincentkoc.

• FTS-only memory startup: skip plugin capability discovery when memorySearch.provider is explicitly none, avoiding an unnecessary cold-start scan. Thanks @vincentkoc.

• Control UI agent model labels: show each selected agent's effective model in the Default picker option instead of the global model. (#77440) Thanks @hyspacex and @vincentkoc Thanks @jwong-art and @vincentkoc.

• Control UI inbound image previews: render canonical inbound media references through the authenticated ticket route after chat-history reloads. (#89591) Thanks @sweetcornna and @shakkernerd Thanks @vergissberlin and @shakkernerd.

• Small-context compaction: cap the effective reserve against the known model context window so small local models do not enter compaction from the first token. Thanks @vincentkoc.

• Detail-less provider failures: keep opaque upstream failures from cooling API-key auth profiles while preserving WHAM-backed OpenAI OAuth health checks and configured model fallback. (#100600) Thanks @fengjikui, @shakkernerd, and @vincentkoc Thanks @fabasi, @shakkernerd, and @vincentkoc.

• Plugin install diagnostics: suppress the misleading hook-pack fallback after plugin install failures only when the hook manifest is absent, while preserving actionable malformed hook-pack errors. Thanks @vincentkoc and @obviyus.

• Config validation diagnostics: emit each unchanged sanitized validation-warning payload once per config path, reset deduplication after a clean validation, and preserve the warning fingerprint across transient invalid reads and failed refreshes. (#25574) Thanks @vincentkoc, @masatohoshino, @CadanHu, and @shakkernerd Thanks @mcaxtr, @masatohoshino, @CadanHu, @vincentkoc, and @shakkernerd.

• Config size-drop guard: compare writes against canonical bytes for parseable object configs instead of raw BOM and indentation overhead, while preserving raw audit telemetry and the conservative malformed-input fallback. (#71865) Thanks @vincentkoc. Thanks @balric-seo.

• Control UI coalesced updates: show a clear queued-restart completion banner when an update joins an already-running Gateway restart. Thanks @goutamadwant and @vincentkoc.

• Control UI connection errors: preserve structured pairing and authentication failures for pending RPC callers while keeping generic disconnect behavior unchanged. Thanks @ruanrrn, @vincentkoc, and @zw-xysk.

• iOS embedded terminal: open the terminal-only Control surface directly while native Gateway authentication connects instead of exposing the Web UI login screen.

• TUI startup status: show starting up during post-connect initialization without overwriting active-run or reconnect state. Thanks @ml12580 and @vincentkoc.

• Control UI restart recovery: recover stale bundle pages through a bounded whole-document refresh after Gateway updates or restarts. Thanks @ZengWen-DT, @vincentkoc, and @shakkernerd.

• TUI active Gateway ports: follow the verified active local Gateway port when no explicit URL, port, or remote target is configured. (#42461) Thanks @haishmg and @vincentkoc Thanks @jackm1688 and @vincentkoc.

• Apple chat run recovery: restore active responses from canonical Gateway history after reconnects, foreground resumes, and event gaps, while preserving gateway user-turn identity across Codex and Copilot transcript mirrors to prevent duplicate rows. Thanks @vincentkoc.

• Claude CLI streamed replies: preserve assistant text already received from Claude CLI when its terminal result envelope is empty, preventing false empty-response failover after a complete streamed answer. Thanks @totobusnello, @vincentkoc, and @shakkernerd.

• Phone identity normalization: canonicalize stray plus signs, preserve non-phone iMessage handles, and reject digit-free Signal identities across shared channel routing. Thanks @morluto and @vincentkoc.

• Tlon scry response bounds: cap successful Urbit scry JSON reads and cancel oversized streams instead of buffering unbounded peer responses. Thanks @hugenshen and @vincentkoc.

• Source build portability: keep tsdown configuration self-contained so builds do not depend on resolving the tsdown package from unrun's temporary module directory. Thanks @vincentkoc.

• Agent tool-call decoding: preserve surrogate-range numeric HTML entities as literal text while still decoding valid supplementary-plane values, preventing malformed model output from injecting lone UTF-16 surrogates into tool arguments. Thanks @mikasa0818, @vincentkoc, @shakkernerd, @maweibin, and @zw-xysk.

• Gateway event dispatch: catch and log lazy subscriber setup and handler failures instead of leaking unhandled promise rejections. Thanks @cxbAsDev, @vincentkoc, and @shakkernerd.

• Ollama fallback routing: classify incomplete native streams through the Ollama provider hook so configured model fallbacks can advance. Thanks @TurboTheTurtle and @vincentkoc.

• Diffs rendering: render viewer and image output from one SSR preload, preserve language-pack highlighting through hydration, normalize language hints case-insensitively, skip identical before/after inputs with an explicit changed result, report truthful file-render and input errors, cache hash-pinned viewer runtimes, and prefer canonical file settings over stale aliases. Thanks @vincentkoc, @joshavant, and @zw-xysk.

• Remote browser reliability: bound persistent Playwright tab enumeration by the existing remote CDP timeout budget and retire timed-out connection attempts so late completions cannot restore a stuck connection. (#58968) Thanks @HemantSudarshan and @KeaneYan.

• Browser tab adoption: preserve the prior implicit tab and stable aliases when new MCP, Playwright, or CDP targets fail final safety validation, abort after creation, or cannot be rediscovered; validate labels before creating tabs and limit managed cleanup to adopted targets. Thanks @hugenshen and @vincentkoc.

• Browser attachment downloads: return managed URL, filename, and path metadata when direct Playwright navigation starts an attachment download, while validating final URLs before saving bytes and preserving single-owner explicit downloads. (#48045) Thanks @zhangguiping-xydt and @vincentkoc Thanks @roinou532 and @vincentkoc.

• Browser action downloads: return managed URL, filename, and path metadata when agent actions trigger downloads, while preserving explicit ownership, validating final URLs before saving bytes, and quarantining policy-denied tabs without closing them. (#93250) Thanks @sunlit-deng and @vincentkoc Thanks @scorpiord and @vincentkoc.

• Managed browser cookie persistence: initialize new isolated macOS headless profiles with a non-interactive encryption key while preserving existing profile keys, and close Chromium through CDP before bounded signal fallback so persistent logins survive graceful browser and Gateway restarts. (#96704) Thanks @TurboTheTurtle, @vincentkoc, and @shakkernerd.

• MCP OAuth response bounds: reject body-less foreign error bodies without calling their inherently unbounded text fallback, while preserving HTTP status and headers for safe SDK diagnostics. Thanks @Pick-cat, @shakkernerd, and @vincentkoc.

• Tlon image upload bounds: cap remote image fetches before upload and fail closed on oversized or stalled responses instead of buffering them without a limit. Thanks @hugenshen and @vincentkoc.

• Mattermost block streaming: preserve complete, non-duplicated text and tool blocks in draft preview mode, and honor normal block streaming when preview streaming is disabled. (#87449) Thanks @yetval, @Senseonics-AI, and @vincentkoc.

• Control UI approval prompts: keep stale resolve failures and busy-state cleanup from leaking across newer approvals or Gateway reconnects. Thanks @haruaiclone-droid and @vincentkoc.

• macOS service SecretRefs: preserve generated env-file values for SecretRefs that remain in config when stale Gateway LaunchAgents are repaired or reinstalled without those variables in the invoking shell. Thanks @mushuiyu886, @vincentkoc, and @zw-xysk.

• Anthropic OAuth callbacks: keep the provider-required localhost redirect URI stable while allowing the local callback listener to bind an explicit loopback host. Thanks @xialonglee and @vincentkoc.

• Prompt-release media delivery: accept active-leaf-preserving side appends while an embedded run temporarily releases its session lock, so successive message-tool media replies merge without a false session-takeover failure. . Thanks @scotthuang, @vincentkoc, @Andy312432, and @shakkernerd.

• Control UI Skills filters: align agent and search controls, use translated labels, and preserve native checkbox and radio sizing. . Thanks @evan-YM, @joshavant, and @vincentkoc.

• Control UI completed-run state: bind active and completed updates to run identities so stale completions keep Send available while newer runs remain active. . Thanks @tiffanychum, @vincentkoc, and @shakkernerd.

• Control UI context usage: keep stale cached totals visible as approximate without triggering warning styling or Compact actions. Thanks @bladin.

• Control UI file previews: remove the duplicate Escape header hint while retaining the Close-button shortcut hint and Escape behavior. . Thanks @xianshishan and @vincentkoc.

• Control UI autonomous tool failures: preserve an earlier Tool error outcome across later autonomous recovery turns. . Thanks @qingminglong and @vincentkoc.

• Agent empty replies: surface a visible failure when a completed interactive turn has no deliverable reply, including queued follow-ups, while preserving explicit silence, pending continuations, and committed side effects, honoring queued send policies, and treating compaction notices as progress. Thanks @mushuiyu886 and @vincentkoc.

• Child process output safety: prevent stdout/stderr pipe failures from crashing agent exec sessions, local TUI shell commands, and bounded process execution. . Thanks @cxbAsDev and @vincentkoc.

• Docker sandbox command output: fail and terminate Docker sandbox operations when stdout/stderr capture breaks instead of returning success with incomplete output. Thanks @cxbAsDev and @vincentkoc.

• Background refresh isolation: keep remote skill-bin refreshes running when one node fails, and contain periodic subagent-sweeper failures without hiding errors from direct callers. . Thanks @cxbAsDev and @vincentkoc.

• Skill scan diagnostics: report directory enumeration failures through the existing resource diagnostics instead of silently dropping affected skills. Thanks @wendy-chsy.

• Exec output sanitization: remove complete ANSI sequences and render residual C0/C1 controls as visible escapes instead of silently discarding output bytes. Thanks @LavyaTandel.

• Assistant visible text: unwrap leaked standalone <parameter> tags while preserving their content and literal code/XML examples. Thanks @nankingjing and @maweibin.

• Android microphone capture: treat negative AudioRecord.read results as fatal shared-session errors so both transcription and Talk capture stop cleanly after device loss. Thanks @NianJiuZst and @vincentkoc.

• Android push-to-talk lifecycle: serialize gateway PTT preparation with app foreground and Manual Mic ownership so stale background or retry work cannot restart, replace, or tear down a newer capture. (#99840) Thanks @xialonglee and @joshavant.

• Lean local-model tools: trim media generation, TTS, and PDF tools from lean agent surfaces while preserving explicit config and runtime opt-ins. Thanks @vincentkoc.

• iOS development app identity: keep the development app labeled OpenClaw while using its distinct debug icon to differentiate it from release builds. Thanks @joshavant.

• Android chat recovery: preserve optimistic user messages and locally owned runs while reconnect and sequence-gap history snapshots catch up, preventing sent messages from disappearing or stale runs from taking ownership. (#100197) Thanks @vincentkoc.

• iOS QR gateway handoff: stop VisionKit before delivering scanned setup codes, and keep deferred auth, approval, Watch, and foreground-node work bound to its originating gateway across reconnects. Thanks @PollyBot13, @vincentkoc, and @shakkernerd.

• Agent terminal failures: surface a safe interactive reply when an agent run ends without visible output, while preserving completed message-tool delivery and heartbeat-specific guidance. Thanks @moeedahmed, @vincentkoc, and @maweibin.

• MCP loopback tool results: preserve schema-valid text, image, and embedded-resource content through HTTP tool calls while rendering malformed or protocol-incompatible blocks as safe text. Thanks @tzy-17, @vincentkoc, @shakkernerd, and @maweibin.

• Control UI tool-result images: render direct image content blocks from Gateway history and make the delayed-send scroll E2E setup deterministic. Thanks @lzyyzznl, @vincentkoc, @shakkernerd, and @maweibin.

• Control UI live tool ordering: keep assistant stream text before its matching tool card when browser and Gateway timestamps disagree. Thanks @Pick-cat and @vincentkoc.

• Plugin approval diagnostics: distinguish request validation rejections, expired wait decisions, and unavailable Gateways while keeping approval failures fail-closed. Thanks @tzy-17 and @vincentkoc.

• IRC Unicode messages: split outbound PRIVMSG payloads on UTF-16 code-point boundaries so emoji cannot be cut into lone surrogates. Thanks @llagy009, @vincentkoc, @mushuiyu886, and @cursoragent.

• OpenAI realtime voice greetings: prevent server VAD from creating a second outbound greeting while an explicit greeting response owns the turn, without disabling caller interruption. Thanks @giodl73-repo.

• Realtime voice tools: filter malformed tool names at each OpenAI, Azure, and Google realtime payload boundary while preserving provider-specific valid names. Thanks @vincentkoc.

• Discord voice status: treat Discord error 10065 as a normal disconnected state while preserving unrelated REST failures. Thanks @asock and @vincentkoc.

• Discord voice accounts: isolate @discordjs/voice connections by Discord account and recover auto-join when gateway readiness predates listener registration. Thanks @geekhuashan and @vincentkoc.

• iOS Voice Wake cleanup: avoid initializing the microphone audio pipeline while disabling inactive Voice Wake, preventing simulator launch aborts and unnecessary audio setup.

• Cron duration validation: reject positive durations that truncate below one millisecond instead of silently scheduling a zero-duration interval. Thanks @qingminglong and @vincentkoc.

• Skill workshop proposals: preserve the terminal newline in generated proposal Markdown while still rejecting blank raw content. Thanks @anyech.

• Agent tool inputs and LSP startup: treat blank optional integer arguments as absent, and fail embedded LSP startup immediately when its child process cannot spawn. . Thanks @snotty, @cxbAsDev, and @vincentkoc.

• Gateway and memory diagnostics: report failed start-session persistence and close-time memory work instead of silently discarding those failures. . Thanks @masatohoshino, @lin-hongkuan, and @vincentkoc.

• Unicode and plugin package verification: match native slice semantics for reversed UTF-16 bounds, and reject published plugin packages that omit openclaw.plugin.json. . Thanks @Simon-XYDT, @849261680, and @vincentkoc.

• Android invoke cancellation: preserve coroutine cancellation through camera handlers and the Gateway invoke boundary so cancelled work cannot emit a stale result. Thanks @xialonglee, @vincentkoc, and @shakkernerd.

• Codex native hook relay diagnostics: avoid bridge registry writes before the local relay server begins listening. Thanks @nankingjing, @joshavant, and @vincentkoc.

• Voice Call completed status: resolve finalized calls from the full retained event store across Gateway, tool, and CLI status paths while preserving active-call lookup performance. Thanks @Darren2030, @vincentkoc, and @maweibin.

• Agent stop recovery: prevent late-aborting prompts from reacquiring orphaned session locks after teardown, so /stop leaves the conversation ready for the next turn.

• Message delivery status: report failed and partially failed best-effort channel delivery instead of returning a success-shaped message-tool result. Thanks @masatohoshino, @vincentkoc, and @shakkernerd.

• WhatsApp credential recovery: restore malformed primary auth state from a valid backup during startup. Thanks @LeonidasLux and @shakkernerd.

• WhatsApp quoted replies: preserve bot-authored outbound quote metadata so replies to those messages keep their reply bubble in WhatsApp Desktop. Thanks @Bartok9 and @vincentkoc.

• WhatsApp reconnect catch-up: admit recently missed Baileys append messages during a bounded reconnect window while preserving startup stale-history guards. Thanks @VishalJ99 and @vincentkoc.

• WhatsApp restart recovery: stop automatic restart loops after logged-out or connection-replaced disconnects until the account reconnects. Thanks @openperf.

• Local Gateway CLI auth: keep loopback CLI token/password calls off durable device scopes so read probes cannot block later write/admin commands behind a stale pairing baseline. (#95997) Thanks @vincentkoc.

• Plugin module identity: keep OpenClaw package chunks on Node's native module graph when jiti transforms plugin entries, preventing duplicate evaluation and class identity drift. Thanks @vincentkoc.

• Shell completion repair: generate core-only caches during doctor and update repair while preserving full plugin command completion for onboarding and explicit user rebuilds. Thanks @joshavant.

• MCP schema diagnostics: attribute draft-2020-12 compiler failures to the external MCP schema so malformed patterns produce actionable setup errors. Thanks @vincentkoc.

• Windows Scheduled Task recovery: keep clean early exits inside the existing bounded launch poll, falling back only when neither the task process nor Gateway listener becomes observable. Thanks @vincentkoc.

• iMessage group warnings: suppress the false drop-all startup warning when an effective group sender allowlist can admit groups, and point true empty-allowlist configurations at the correct remedy. Thanks @vincentkoc.

• Control UI mobile login: keep Gateway recovery guidance visible after connection failures, make the disconnected gate scroll safely on constrained screens, and improve mobile keyboard and tap-target behavior. Thanks @vincentkoc.

• TUI streaming: render delta-only assistant events in live Gateway and embedded TUI sessions instead of waiting for the final response. Thanks @flashosophy.

• Model aliases: resolve provider-qualified aliases during session and chat-command model switches without collisions when providers share a display alias. Thanks @sahilsatralkar, @vincentkoc, and @shakkernerd.

• TUI new-session hooks: create /new sessions through the shared Gateway lifecycle so command and session hooks receive the completed parent transcript in both Gateway and embedded modes, while preventing rollover during an active turn. (#49918) Thanks @BingqingLyu, @vincentkoc, and @shakkernerd Thanks @LonExplorer-coder, @vincentkoc, and @shakkernerd.

• TUI abort diagnostics: show sanitized tool argument-validation summaries for aborted runs in both Gateway and local TUI modes without exposing raw model arguments. Thanks @wsyjh8.

• iOS Watch replies: persist queued quick replies in the gateway-scoped chat outbox and submit them through idempotent chat delivery, preventing losses, duplicates, and cross-gateway sends after reconnects. Thanks @NianJiuZst, @vincentkoc, and @shakkernerd.

• iOS Gateway auth retry: restrict stored device-token retry to parsed loopback hosts and reject wildcard bind addresses, preventing remote lookalike hostnames from receiving trusted retry credentials. Thanks @ly85206559 and @vincentkoc.

• Amazon Bedrock control-plane deadlines: bound model discovery and application inference-profile lookups, preserve caller cancellation, and close short-lived SDK clients after each request path. Thanks @Alix-007, @vincentkoc, @shakkernerd, and @obviyus.

• Bedrock Mantle discovery: bound model-catalog fetch time and response size, and release rejected response bodies so stalled, oversized, or failed provider responses fall back safely. Thanks @zhangguiping-xydt, @vincentkoc, and @shakkernerd.

• Discord thread-title prompts: truncate generated-title message and channel context on UTF-16 boundaries so emoji cannot leave malformed model prompt text. Thanks @Alix-007, @vincentkoc, @mushuiyu886, and @cursoragent.

• Task state migration: canonicalize legacy not-requested delivery statuses during sidecar import and existing shared-database open so upgraded task registries and linked TaskFlows recover without manual SQL, and surface rejected persisted values in compact console diagnostics. Thanks @bek91, @shakkernerd, and @vincentkoc.

• Reply pre-delivery recovery: bound each pre-delivery callback with an owner-overridable deadline, release serialized reply lanes after hung plugin work, and preserve durable final-delivery retry state only when transport never started. (#104256) Thanks @NianJiuZst, @BenjaminBrossi, @vincentkoc, and @obviyus.

• Signal native quote replies: preserve the active inbound message as a native quote across agent, explicit, durable, and chunked sends while keeping reply-mode policy inside the Signal plugin. (#105347) Thanks @jesse-merhi and @vincentkoc.

• Media-store remote downloads: bound response-header waits and stalled bodies, close abandoned redirect and error responses, and remove partial temp files so hung sources cannot pin callers. (#104624) Thanks @hugenshen and @vincentkoc.

• Cron llama.cpp tool schemas: keep the model-facing cron declaration schema compatible with llama.cpp while retaining gateway and runtime nonblank validation. Fixes #107449. Thanks @lee-xydt. Thanks @Patt92.

• System-agent recovery guidance: direct browser and app users to Settings or the OpenClaw host instead of terminal-only exit guidance while preserving the required stop, onboard, and restart lifecycle. (#114633) Thanks @jesse-merhi.

Complete contribution record

The full contribution record is available in the tag-pinned CHANGELOG.md.

Release verification

• npm package: https://www.npmjs.com/package/openclaw/v/2026.8.1-beta.2
• Registry tarball: https://registry.npmjs.org/openclaw/-/openclaw-2026.8.1-beta.2.tgz
• npm integrity: sha512-k4cwlyFOuXN5wN6NOH/gqxupGuvMkOr5OV2Eh7MJmmGFh86wvWSTrGBkL4XkNTg/kszWzGbotI8wKlZ468EjsQ==
• Exact-SHA npm preflight: https://github.com/openclaw/openclaw/actions/runs/31865167546
• Official npm plugin publication: https://github.com/openclaw/openclaw/actions/runs/31863860804 and https://github.com/openclaw/openclaw/actions/runs/31864674947; independent registry/runtime verification passed for the effective 89-package external set.
• Signed tag target: 8f382a202ff1e15833394b481615dcdda99b04d7
• Publication provenance: the core publisher timed out while fetching the prior beta tag, and Fish Audio's package-level trusted publisher rejected OIDC. Their exact preflight tarballs were published through credential-isolated fallbacks. Registry signatures and tarball identities verify, but npm OIDC provenance is unavailable for openclaw, the three core subpackages, and @openclaw/fish-audio-speech.
• ClawHub was not published by this limited npm-only beta path; existing ClawHub selectors remain on the previous release.

…