OpenClaw v2026.2.23-beta.1

### 变更 - Providers/Kilo Gateway：增加对一级 `kilocode` 提供商的支持（认证、引导、隐式提供商检测、模型默认值、转录/cache-ttl 处理及文档），默认模型为 `kilocode/anthropic/claude-opus-4.6`。(#20212) 感谢 @jrf0110 和 @markijbema。 - Providers/Vercel AI Gateway：通过规范为标准的 Anthropic 路由模型 ID，接受 Claude 简写模型引用（`vercel-ai-gateway/claude-*`）。(#23985) 感谢 @sallyom、@markbooch 和 @vincentkoc。 - Docs/Prompt caching：增加专门的提示词缓存参考文档，涵盖 `cacheRetention`、每代理 `params` 合并优先级、Bedrock/OpenRouter 行为以及 cache-ttl + 心跳调优。感谢 @svenssonaxel。 - Gateway/HTTP 安全头：增加可选的 `gateway.http.securityHeaders.strictTransportSecurity` 支持，用于在直接 HTTPS 部署时发出 `Strict-Transport-Security`，包含运行时连接、验证、测试和加固文档。 - Sessions/Cron：强化会话维护，包括 `openclaw sessions cleanup`、每代理存储目标定位、磁盘预算控制（`session.maintenance.maxDiskBytes` / `highWaterBytes`），以及更安全的转录/归档清理和运行日志保留行为。(#24753) 感谢 @gumadeiras。 - Tools/web_search：增加对 `provider: "kimi"` (Moonshot) 的支持，包含密钥/配置架构连接，并修正了两步 `$web_search` 工具流程，在最终综合前回显工具结果，包括从搜索结果中提取引用。(#16616, #18822) 感谢 @adshine。 - Media understanding/Video：增加原生的 Moonshot 视频提供商，并将 Moonshot 纳入自动视频密钥检测，同时重构视频执行以遵循 `entry/config/provider` 的 baseUrl+header 优先级（匹配音频行为）。(#12063) 感谢 @xiaoyaner0201。 - Agents/Config：支持基于模型默认值（包括 `cacheRetention`）进行合并的每代理 `params` 覆盖，使混合流量代理能够独立调整缓存行为。(#17470, #17112) 感谢 @rrenamed。 - Agents/Bootstrap：按会话密钥缓存引导文件快照，并在会话重置/删除时清除它们，减少因会话内 `AGENTS.md`/`MEMORY.md` 写入导致的提示词缓存失效。(#22220) 感谢 @anisoptera。 - Auto-reply/Abort 快捷方式：扩展独立停止短语（`stop openclaw`、`stop action`、`stop run`、`stop agent`、`please stop` 及相关变体），并接受尾随标点（例如 `STOP OPENCLAW!!!`），使紧急停止消息能被更可靠地捕获。 ### 修复 - Security/Config：在 `config.get` 快照中编辑敏感外观的动态通配符密钥（例如 `env.*` 和 `skills.entries.*.env.*`），并为这些编辑后的标记保留往返恢复行为。感谢 @merc1305。 - Tests/Vitest：按主机内存对本地并行工作器默认值进行分级，在非高内存主机上默认保持网关串行，并为内存受限的 land/gate 运行记录低配置文件回退命令，以防止本地内存不足。(#24719) 感谢 @ngutman。 - WhatsApp/Group policy：修复当 `groupPolicy: "allowlist"` 设置为未明确指定 `groups` 时的 `groupAllowFrom` 发件人过滤问题——此前即使对于允许列表中的发件人，所有群组消息也会被阻止。(#24670) - Agents/Context pruning：将 `cache-ttl` 资格扩展到 Moonshot/Kimi 和 ZAI/GLM 提供商（包括 OpenRouter 模型引用），因此 `contextPruning.mode: "cache-ttl"` 不再对这些会话被静默跳过。(#24497) 感谢 @lailoo。 - Doctor/Memory：在 `openclaw doctor` 期间查询网关侧默认代理内存嵌入准备情况（而非从通用网关健康状态推断），并在网关内存探测不可用或未就绪时发出警告，同时保留 `openclaw configure` 修复指导。(#22327) 感谢 @therk。 - Sessions/Store：为元数据和路由更新规范化传入的混合大小写会话密钥，并将遗留的大小写变体条目迁移到单个小写密钥，以防止重复会话和缺失 TUI/WebUI 历史记录。(#9561) 感谢 @hillghost86。 - Telegram/Reactions：对反应操作错误（策略/令牌/表情符号/API）进行软失败，接受蛇形命名 `message_id`，并在省略显式 `messageId` 时回退到入站消息 ID 上下文，使 DM 反应保持稳定且无再生循环。(#20236, #21001) 感谢 @PeterShanxin 和 @vincentkoc。 - Telegram/Polling：将持久化的轮询偏移量范围限定于机器人身份，并在中止/重试时重用单个等待的 runner-stop 路径，防止跨令牌偏移泄漏和重启/错误恢复期间轮询器重叠。(#10850, #11347) 感谢 @talhaorak、@anooprdawar 和 @vincentkoc。 - Telegram/Reasoning：当 `/reasoning off` 处于活动状态时，抑制仅推理传递片段并阻止已抑制 `Reasoning:`` 文本的原始回发重发，防止遗留会话中的内部推理泄漏，同时保留答案传递。(#24626, #24518) - Agents/Reasoning：当模型默认思考处于活动状态（例如 `thinking=low`）时，保持自动推理禁用，除非显式启用，防止频道回复中的 `Reasoning:` 思考块泄漏。(#24335, #24290) 感谢 @Kay-051。 - Agents/Reasoning：避免将提供商推理必需错误分类为上下文溢出，因此这些失败不再触发压缩式溢出恢复。(#24593) 感谢 @vincentkoc。 - Agents/Models：将 `agents.defaults.model` / `agents.defaults.imageModel` 配置边界输入规范化为 `string | {primary,fallbacks}`，拆分显式与有效模型解析，并修复 `models status --agent` 源归属，使继承默认值的代理标记为 `defaults`，而运行时选择仍遵循默认值回退。(#24210) 感谢 @bianbiandashen。 - Agents/Compaction：将 `agentDir` 传入手动 `/compact` 命令运行，使压缩认证/配置文件解析保持限定于活动代理。(#24133) 感谢 @Glucksberg。 - Agents/Compaction：通过嵌入式运行时传递模型元数据，以便在 `ctx.model` 不可用时运行保护性摘要，避免重复出现“由于上下文限制摘要不可用”的回退摘要。(#3479) 感谢 @battman21、@hanxiao 和 @vincentkoc。 - Agents/Compaction：当摘要生成无法运行时（缺少模型/API 密钥或摘要失败）取消保护性压缩，保留历史记录而非截断为回退“摘要不可用”文本。(#10711) 感谢 @DukeDeSouth 和 @vincentkoc。 - Agents/Tools：使 `session_status` 在回合内读取转录衍生的使用情况，并尾读会话日志以实现感知缓存的上下文报告，无需完整日志扫描。(#22387) 感谢 @1ucian。 - Agents/Overflow：检测额外的提供商上下文溢出错误形态（包括 `input length` + `max_tokens` 超出上下文变体），因此失败通过压缩/恢复路径路由，而非将原始提供商错误泄露给用户。(#9951) 感谢 @echoVic 和 @Glucksberg。 - Agents/Overflow：在 `isContextOverflowError` 中添加中文上下文溢出模式检测，使本地化提供商错误通过溢出恢复路径路由。(#22855) 感谢 @Clawborn。 - Agents/Failover：将 HTTP 502/503/504 错误视为可故障转移的暂时超时，因此回退链可在上游中断期间切换提供商/模型，而非重试同一失败目标。(#20999) 感谢 @taw0002 和 @vincentkoc。 - Auto-reply/Inbound metadata：仅从规范化聊天类型（而非发件人 ID 标记）隐藏直接聊天 `message_id`/`message_id_full` 和发件人元数据，保留群组元数据可见性并防止发件人 ID 欺骗的直接模式分类。(#24373) 感谢 @jd316。 - Auto-reply/Inbound metadata：将动态入站 `flags`（回复/转发/线程/历史）从系统元数据移至用户上下文对话信息，防止标志切换导致的逐回合提示词缓存失效。(#21785) 感谢 @aidiffuser。 - Auto-reply/Sessions：从 `/new` 和 `/reset` 确认消息中移除认证密钥标签，因此会话重置通知从不在聊天输出中暴露 API 密钥前缀或 env-key 标签。(#24384, #24409) 感谢 @Clawborn。 - Slack/Group policy：将 Slack 账户 `groupPolicy` 默认移至提供商级架构默认值，使多账户配置继承顶层 `channels.slack.groupPolicy`，而非通过每账户 `allowlist` 静默覆盖继承。(#17579) 感谢 @ZetiMente。 - Providers/Anthropic：对 OAuth/订阅令牌（`sk-ant-oat-*`）跳过 `context-1m-*` beta 注入，同时保留 OAuth 必需的 beta，避免在启用 `params.context1m` 时出现 Anthropic 401 认证失败。(#10647, #20354) 感谢 @ClumsyWizardHands 和 @dcruver。 - Providers/DashScope：将 DashScope 兼容的 `openai-completions` 端点标记为 `supportsDeveloperRole=false`，因此 OpenClaw 在 Qwen/DashScope API 上发送 `system` 而非不支持的 `developer` 角色。(#19130) 感谢 @Putzhuawa 和 @vincentkoc。 - Providers/Bedrock：对非 Anthropic Bedrock 模型禁用提示词缓存保留，因此 Nova/Mistral 请求不发送不支持的缓存元数据。(#20866) 感谢 @pierreeurope。 - Providers/Bedrock：对 `amazon-bedrock/*anthropic.claude*` 模型引用应用 Anthropic-Claude cacheRetention 默认值和运行时透传，同时保持非 Anthropic Bedrock 模型排除。(#22303) 感谢 @snese。 - Providers/OpenRouter：在注入嵌套 `reasoning.effort` 时移除冲突的顶层 `reasoning_effort`，防止推理模型出现 OpenRouter 400 负载验证失败。(#24120) 感谢 @tenequm。 - Providers/Groq：避免将 Groq TPM 限制错误分类为上下文溢出，因此节流路径不再触发溢出恢复逻辑。(#16176) 感谢 @dddabtc。 - Gateway/WS：关闭每个连接上重复的握手后 `unauthorized role:*` 请求洪泛，并对重复拒绝日志采样，防止单个行为不当的客户端降低网关响应能力。(#20168) 感谢 @acy103、@vibecodooor 和 @vincentkoc。 - Gateway/Restart：在重启健康检查期间将子监听 PID 视为由服务运行时 PID 拥有，避免在 launchd/systemd 上错误的陈旧进程终止和重启超时。(#24696) 感谢 @gumadeiras。 - Config/Write：应用具有不可变路径复制更新的 `unsetPaths`，因此配置写入从不修改调用者提供的对象，并通过拒绝原型键段和继承属性遍历来加固 `openclaw config get/set/unset` 路径遍历。(#24134) 感谢 @frankekn。 - Channels/WhatsApp：在配置验证中接受 `channels.whatsapp.enabled` 以匹配内置频道自动启用行为，防止频道设置期间出现“无法识别的键：'enabled'”失败。(#24263) - Security/Exec：在执行允许列表决策前检测混淆命令，并要求对混淆模式进行明确批准。(#8592) 感谢 @CornBrother0x 和 @vincentkoc。 - Security/ACP：加固 ACP 客户端权限自动批准，要求受信任的核心工具 ID，忽略不受信任的 `toolCall.kind` 提示，并将 `read` 自动批准范围限定于活动工作目录，因此未知工具名称和范围外文件读取始终提示。此功能将在下一个 npm 版本中发布。感谢 @nedlir 报告。 - Security/Skills：在 `openai-image-gen` HTML 图库生成中转义用户控制的提示词、文件名和输出路径值，防止生成的 `index.html` 输出中出现存储型 XSS。(#12538) 感谢 @CornBrother0x。 - Security/Skills：加固 `skill-creator` 打包，跳过符号链接条目并拒绝已解析路径逃逸所选技能根目录的文件。(#24260, #16959) 感谢 @CornBrother0x 和 @vincentkoc。 - Security/OTEL：在诊断 OTEL 日志正文、日志属性以及错误/原因跨度字段中编辑敏感值（API 密钥、令牌、凭据字段），然后再进行 OTLP 导出。(#12542) 感谢 @brandonwise。 - Security/CI：为私有密钥检测和生产依赖审计增加预提交安全钩子覆盖范围，并在 CI 中与基线秘密扫描一起强制执行这些检查。感谢 @vincentkoc。 - Skills/Python：加固技能脚本打包和验证边缘情况（自包含 `.skill` 输出、CRLF 前言解析、严格的 `--days` 验证以及更安全的图像文件加载），并扩展 Python 回归覆盖范围。感谢 @vincentkoc。 - Skills/Python：为 `skills/` 下的 Python 脚本/测试增加 CI + 预提交 linting (`ruff`) 和 pytest 发现覆盖范围，包括从仓库根目录执行包测试。感谢 @vincentkoc。

### Changes - Providers/Kilo Gateway: add first-class `kilocode` provider support (auth, onboarding, implicit provider detection, model defaults, transcript/cache-ttl handling, and docs), with default model `kilocode/anthropic/claude-opus-4.6`. (#20212) Thanks @jrf0110 and @markijbema. - Providers/Vercel AI Gateway: accept Claude shorthand model refs (`vercel-ai-gateway/claude-*`) by normalizing to canonical Anthropic-routed model ids. (#23985) Thanks @sallyom, @markbooch, and @vincentkoc. - Docs/Prompt caching: add a dedicated prompt-caching reference covering `cacheRetention`, per-agent `params` merge precedence, Bedrock/OpenRouter behavior, and cache-ttl + heartbeat tuning. Thanks @svenssonaxel. - Gateway/HTTP security headers: add optional `gateway.http.securityHeaders.strictTransportSecurity` support to emit `Strict-Transport-Security` for direct HTTPS deployments, with runtime wiring, validation, tests, and hardening docs. - Sessions/Cron: harden session maintenance with `openclaw sessions cleanup`, per-agent store targeting, disk-budget controls (`session.maintenance.maxDiskBytes` / `highWaterBytes`), and safer transcript/archive cleanup + run-log retention behavior. (#24753) thanks @gumadeiras. - Tools/web_search: add `provider: "kimi"` (Moonshot) support with key/config schema wiring and a corrected two-step `$web_search` tool flow that echoes tool results before final synthesis, including citation extraction from search results. (#16616, #18822) Thanks @adshine. - Media understanding/Video: add a native Moonshot video provider and include Moonshot in auto video key detection, plus refactor video execution to honor `entry/config/provider` baseUrl+header precedence (matching audio behavior). (#12063) Thanks @xiaoyaner0201. - Agents/Config: support per-agent `params` overrides merged on top of model defaults (including `cacheRetention`) so mixed-traffic agents can tune cache behavior independently. (#17470, #17112) Thanks @rrenamed. - Agents/Bootstrap: cache bootstrap file snapshots per session key and clear them on session reset/delete, reducing prompt-cache invalidations from in-session `AGENTS.md`/`MEMORY.md` writes. (#22220) Thanks @anisoptera. - Auto-reply/Abort shortcuts: expand standalone stop phrases (`stop openclaw`, `stop action`, `stop run`, `stop agent`, `please stop`, and related variants) and accept trailing punctuation (for example `STOP OPENCLAW!!!`) so emergency stop messages are caught more reliably. ### Fixes - Security/Config: redact sensitive-looking dynamic catchall keys in `config.get` snapshots (for example `env.*` and `skills.entries.*.env.*`) and preserve round-trip restore behavior for those redacted sentinels. Thanks @merc1305. - Tests/Vitest: tier local parallel worker defaults by host memory, keep gateway serial by default on non-high-memory hosts, and document a low-profile fallback command for memory-constrained land/gate runs to prevent local OOMs. (#24719) Thanks @ngutman. - WhatsApp/Group policy: fix `groupAllowFrom` sender filtering when `groupPolicy: "allowlist"` is set without explicit `groups` — previously all group messages were blocked even for allowlisted senders. (#24670) - Agents/Context pruning: extend `cache-ttl` eligibility to Moonshot/Kimi and ZAI/GLM providers (including OpenRouter model refs), so `contextPruning.mode: "cache-ttl"` is no longer silently skipped for those sessions. (#24497) Thanks @lailoo. - Doctor/Memory: query gateway-side default-agent memory embedding readiness during `openclaw doctor` (instead of inferring from generic gateway health), and warn when the gateway memory probe is unavailable or not ready while keeping `openclaw configure` remediation guidance. (#22327) thanks @therk. - Sessions/Store: canonicalize inbound mixed-case session keys for metadata and route updates, and migrate legacy case-variant entries to a single lowercase key to prevent duplicate sessions and missing TUI/WebUI history. (#9561) Thanks @hillghost86. - Telegram/Reactions: soft-fail reaction action errors (policy/token/emoji/API), accept snake_case `message_id`, and fallback to inbound message-id context when explicit `messageId` is omitted so DM reactions stay stable without regeneration loops. (#20236, #21001) Thanks @PeterShanxin and @vincentkoc. - Telegram/Polling: scope persisted polling offsets to bot identity and reuse a single awaited runner-stop path on abort/retry, preventing cross-token offset bleed and overlapping pollers during restart/error recovery. (#10850, #11347) Thanks @talhaorak, @anooprdawar, and @vincentkoc. - Telegram/Reasoning: when `/reasoning off` is active, suppress reasoning-only delivery segments and block raw fallback resend of suppressed `Reasoning:`/`<think>` text, preventing internal reasoning leakage in legacy sessions while preserving answer delivery. (#24626, #24518) - Agents/Reasoning: when model-default thinking is active (for example `thinking=low`), keep auto-reasoning disabled unless explicitly enabled, preventing `Reasoning:` thinking-block leakage in channel replies. (#24335, #24290) thanks @Kay-051. - Agents/Reasoning: avoid classifying provider reasoning-required errors as context overflows so these failures no longer trigger compaction-style overflow recovery. (#24593) Thanks @vincentkoc. - Agents/Models: codify `agents.defaults.model` / `agents.defaults.imageModel` config-boundary input as `string | {primary,fallbacks}`, split explicit vs effective model resolution, and fix `models status --agent` source attribution so defaults-inherited agents are labeled as `defaults` while runtime selection still honors defaults fallback. (#24210) thanks @bianbiandashen. - Agents/Compaction: pass `agentDir` into manual `/compact` command runs so compaction auth/profile resolution stays scoped to the active agent. (#24133) thanks @Glucksberg. - Agents/Compaction: pass model metadata through the embedded runtime so safeguard summarization can run when `ctx.model` is unavailable, avoiding repeated `"Summary unavailable due to context limits"` fallback summaries. (#3479) Thanks @battman21, @hanxiao and @vincentkoc. - Agents/Compaction: cancel safeguard compaction when summary generation cannot run (missing model/API key or summarization failure), preserving history instead of truncating to fallback `"Summary unavailable"` text. (#10711) Thanks @DukeDeSouth and @vincentkoc. - Agents/Tools: make `session_status` read transcript-derived usage mid-turn and tail-read session logs for cache-aware context reporting without full-log scans. (#22387) Thanks @1ucian. - Agents/Overflow: detect additional provider context-overflow error shapes (including `input length` + `max_tokens` exceed-context variants) so failures route through compaction/recovery paths instead of leaking raw provider errors to users. (#9951) Thanks @echoVic and @Glucksberg. - Agents/Overflow: add Chinese context-overflow pattern detection in `isContextOverflowError` so localized provider errors route through overflow recovery paths. (#22855) Thanks @Clawborn. - Agents/Failover: treat HTTP 502/503/504 errors as failover-eligible transient timeouts so fallback chains can switch providers/models during upstream outages instead of retrying the same failing target. (#20999) Thanks @taw0002 and @vincentkoc. - Auto-reply/Inbound metadata: hide direct-chat `message_id`/`message_id_full` and sender metadata only from normalized chat type (not sender-id sentinels), preserving group metadata visibility and preventing sender-id spoofed direct-mode classification. (#24373) thanks @jd316. - Auto-reply/Inbound metadata: move dynamic inbound `flags` (reply/forward/thread/history) from system metadata to user-context conversation info, preventing turn-by-turn prompt-cache invalidation from flag toggles. (#21785) Thanks @aidiffuser. - Auto-reply/Sessions: remove auth-key labels from `/new` and `/reset` confirmation messages so session reset notices never expose API key prefixes or env-key labels in chat output. (#24384, #24409) Thanks @Clawborn. - Slack/Group policy: move Slack account `groupPolicy` defaulting to provider-level schema defaults so multi-account configs inherit top-level `channels.slack.groupPolicy` instead of silently overriding inheritance with per-account `allowlist`. (#17579) Thanks @ZetiMente. - Providers/Anthropic: skip `context-1m-*` beta injection for OAuth/subscription tokens (`sk-ant-oat-*`) while preserving OAuth-required betas, avoiding Anthropic 401 auth failures when `params.context1m` is enabled. (#10647, #20354) Thanks @ClumsyWizardHands and @dcruver. - Providers/DashScope: mark DashScope-compatible `openai-completions` endpoints as `supportsDeveloperRole=false` so OpenClaw sends `system` instead of unsupported `developer` role on Qwen/DashScope APIs. (#19130) Thanks @Putzhuawa and @vincentkoc. - Providers/Bedrock: disable prompt-cache retention for non-Anthropic Bedrock models so Nova/Mistral requests do not send unsupported cache metadata. (#20866) Thanks @pierreeurope. - Providers/Bedrock: apply Anthropic-Claude cacheRetention defaults and runtime pass-through for `amazon-bedrock/*anthropic.claude*` model refs, while keeping non-Anthropic Bedrock models excluded. (#22303) Thanks @snese. - Providers/OpenRouter: remove conflicting top-level `reasoning_effort` when injecting nested `reasoning.effort`, preventing OpenRouter 400 payload-validation failures for reasoning models. (#24120) thanks @tenequm. - Providers/Groq: avoid classifying Groq TPM limit errors as context overflow so throttling paths no longer trigger overflow recovery logic. (#16176) Thanks @dddabtc. - Gateway/WS: close repeated post-handshake `unauthorized role:*` request floods per connection and sample duplicate rejection logs, preventing a single misbehaving client from degrading gateway responsiveness. (#20168) Thanks @acy103, @vibecodooor, and @vincentkoc. - Gateway/Restart: treat child listener PIDs as owned by the service runtime PID during restart health checks to avoid false stale-process kills and restart timeouts on launchd/systemd. (#24696) Thanks @gumadeiras. - Config/Write: apply `unsetPaths` with immutable path-copy updates so config writes never mutate caller-provided objects, and harden `openclaw config get/set/unset` path traversal by rejecting prototype-key segments and inherited-property traversal. (#24134) thanks @frankekn. - Channels/WhatsApp: accept `channels.whatsapp.enabled` in config validation to match built-in channel auto-enable behavior, preventing `Unrecognized key: "enabled"` failures during channel setup. (#24263) - Security/Exec: detect obfuscated commands before exec allowlist decisions and require explicit approval for obfuscation patterns. (#8592) Thanks @CornBrother0x and @vincentkoc. - Security/ACP: harden ACP client permission auto-approval to require trusted core tool IDs, ignore untrusted `toolCall.kind` hints, and scope `read` auto-approval to the active working directory so unknown tool names and out-of-scope file reads always prompt. This ships in the next npm release. Thanks @nedlir for reporting. - Security/Skills: escape user-controlled prompt, filename, and output-path values in `openai-image-gen` HTML gallery generation to prevent stored XSS in generated `index.html` output. (#12538) Thanks @CornBrother0x. - Security/Skills: harden `skill-creator` packaging by skipping symlink entries and rejecting files whose resolved paths escape the selected skill root. (#24260, #16959) Thanks @CornBrother0x and @vincentkoc. - Security/OTEL: redact sensitive values (API keys, tokens, credential fields) from diagnostics-otel log bodies, log attributes, and error/reason span fields before OTLP export. (#12542) Thanks @brandonwise. - Security/CI: add pre-commit security hook coverage for private-key detection and production dependency auditing, and enforce those checks in CI alongside baseline secret scanning. Thanks @vincentkoc. - Skills/Python: harden skill script packaging and validation edge cases (self-including `.skill` outputs, CRLF frontmatter parsing, strict `--days` validation, and safer image file loading), with expanded Python regression coverage. Thanks @vincentkoc. - Skills/Python: add CI + pre-commit linting (`ruff`) and pytest discovery coverage for Python scripts/tests under `skills/`, including package test execution from repo root. Thanks @vincentkoc.

OpenClaw v2026.2.23-beta.1 预发布