OpenClaw v2026.3.2-beta.1

### 变更 - **文档/飞书 webhook 配置**：澄清 `verificationToken` 配置，补充开放平台导航步骤，并同步飞书发送方允许列表指南及中文频道文档与当前运行时行为。 (#31555) - **密钥/SecretRef 覆盖范围**：将 SecretRef 支持扩展至所有用户提供的凭证表面（共 64 个目标），包括运行时采集器、`openclaw secrets` 的规划/应用/审计流程、新手上路 SecretInput 用户体验及相关文档；未解析的引用在活跃表面快速失败，非活跃表面则报告非阻塞诊断信息。 (#29580) 感谢 @joshavant。 - **工具/PDF 分析**：新增原生 `pdf` 工具，支持 Anthropic 和 Google 的 PDF 提供商，为非原生模型提供提取回退，支持可配置默认值（`agents.defaults.pdfModel`、`pdfMaxBytesMb`、`pdfMaxPages`），并包含涵盖路由、验证和注册的文档与测试。 (#31319) 感谢 @tyler6204。 - **出站适配器/插件**：为直接文本媒体、Discord、Slack、WhatsApp、Zalo 和 Zalouser 添加共享 `sendPayload` 支持，具备多媒体迭代和分块感知文本回退能力。 (#30144) 感谢 @nohat。 - **模型/MiniMax**：在内置提供商目录、新手上路流程及 MiniMax OAuth 插件默认设置中，新增对 `MiniMax-M2.5-highspeed` 的一流支持，同时保持对现有配置中遗留的 `MiniMax-M2.5-Lightning` 的兼容性。 - **会话/附件**：为 `sessions_spawn`（仅子代理运行时）添加内联文件附件支持，具备 base64/utf8 编码、转录内容脱敏、生命周期清理功能，并可通过 `tools.sessions_spawn.attachments` 配置限制。 (#16761) 感谢 @napetrov。 - **Telegram/流式传输默认值**：将 `channels.telegram.streaming` 默认值从 `off` 改为 `partial`，使新 Telegram 配置开箱即用即可获得实时预览流式传输，并在原生草稿不可用时通过运行时回退至消息编辑预览。 - **Telegram/私信流式传输**：对私密预览流式传输使用 `sendMessageDraft`，在 DM 推理流模式下保持推理/答案预览通道分离。 (#31824) 感谢 @obviyus。 - **Telegram/语音提及控制**：在群组/主题配置中添加可选的 `disableAudioPreflight`，以跳过提及检测预检转录，使操作员仅需文本提及检查即可处理入站语音笔记。 (#23067) 感谢 @yangnim21029。 - **CLI/配置验证**：新增 `openclaw config validate`（带 `--json` 选项），可在网关启动前验证配置文件，并在启动时的无效配置错误中包含详细的无效键路径信息。 (#31220) 感谢 @Sid-Qin。 - **工具/差异对比**：为生成的差异产物添加 PDF 文件输出支持和渲染质量自定义控件（`fileQuality`、`fileScale`、`fileMaxWidth`），并记录文档说明当消息通道压缩图像时 PDF 为首选选项。 (#31342) 感谢 @gumadeiras。 - **内存/Ollama 嵌入**：新增 `memorySearch.provider = "ollama"` 和 `memorySearch.fallback = "ollama"` 支持，在内存嵌入请求中遵循 `models.providers.ollama` 设置，并记录 Ollama 嵌入使用文档。 (#26349) 感谢 @nico-hoff。 - **Zalo 个人插件（`@openclaw/zalouser`）**：重建频道运行时以使用进程内原生的 `zca-js` 集成，移除外部的 CLI 传输使用，并保持 QR/登录 + 发送/监听流程完全在 OpenClaw 内部。 - **插件 SDK/频道可扩展性**：在 `ChannelGatewayContext` 上公开 `channelRuntime`，使外部频道插件无需内部导入即可访问共享运行时辅助功能（回复/路由/会话/文本/媒体/命令）。 (#25462) 感谢 @guxiaobo。 - **插件运行时/STT**：新增 `api.runtime.stt.transcribeAudioFile(...)`，使扩展可通过 OpenClaw 配置的媒体理解音频提供商转录本地音频文件。 (#22402) 感谢 @benthecarman。 - **插件钩子/会话生命周期**：在 `session_start`/`session_end` 钩子事件和上下文中包含 `sessionKey`，使插件能够将生命周期回调与路由身份关联。 (#26394) 感谢 @tempeste。 - **钩子/消息生命周期**：新增内部钩子事件 `message:transcribed` 和 `message:preprocessed`，并为出站 `message:sent` 提供更丰富的上下文（`isGroup`、`groupId`），以支持群组会话关联和转录后自动化。 (#9859) 感谢 @Drickon。 - **媒体理解/音频回显**：新增可选的 `tools.media.audio.echoTranscript` + `echoFormat`，用于向原始聊天发送预代理转录确认消息，默认禁用回显。 (#32150) 感谢 @AytuncYildizli。 - **插件运行时/系统**：公开 `runtime.system.requestHeartbeatNow(...)`，使扩展在将系统事件入队后能立即唤醒目标会话。 (#19464) 感谢 @AustinEral。 - **插件运行时/事件**：公开 `runtime.events.onAgentEvent` 和 `runtime.events.onSessionTranscriptUpdate` 供扩展端订阅，并隔离转录监听器故障，防止一个有缺陷的监听器破坏整个更新扇出。 (#16044) 感谢 @scifantastic。 - **CLI/启动横幅标语**：新增 `cli.banner.taglineMode`（`random` | `default` | `off`）以控制启动输出中的趣味标语行为，并提供文档 + FAQ 指南及配置覆盖行为的回归测试。 - **文档/模型**：更新 MiniMax、Moonshot（Kimi）、GLM/Z.AI 模型文档以对齐最新默认值（`MiniMax-M2.5`、`MiniMax-M2.5-highspeed`、`moonshot/kimi-k2.5`、`zai/glm-5`），并保持 Moonshot 模型列表从共享源数据同步。 - **README/贡献者**：按综合分数（提交数 + 合并的 PR 数 + 代码 LOC）对贡献者头像进行排名，排除仅文档 LOC 以防止批量生成文件扭曲排名。 (#23970) 感谢 @tyler6204。 ### 破坏性变更 - **破坏性变更：** 新本地安装（交互式和非交互式）现在默认将 `tools.profile` 设为 `messaging`。新配置不再默认启动广泛的编码/系统工具，除非明确配置。 - **破坏性变更：** ACP 调度现默认启用，除非明确禁用（`acp.dispatch.enabled=false`）。若需在保持 `/acp` 控制的同时暂停 ACP 转向路由，请设置 `acp.dispatch.enabled=false`。文档：https://docs.openclaw.ai/tools/acp-agents - **破坏性变更：** 插件 SDK 已移除 `api.registerHttpHandler(...)`。插件必须通过 `api.registerHttpRoute({ path, auth, match, handler })` 注册明确的 HTTP 路由，动态 webhook 生命周期应使用 `registerPluginHttpRoute(...)`。 - **破坏性变更：** Zalo 个人插件（`@openclaw/zalouser`）不再依赖外部的 `zca` 兼容 CLI 二进制文件（`openzca`、`zca-cli`）进行运行时发送/监听/登录；升级后操作员应使用 `openclaw channels login --channel zalouser` 以刷新新的 JS 原生路径中的会话。 ### 修复 - **插件命令/运行时加固**：在注册边界验证和规范化插件命令名称/描述，并保护 Telegram 原生菜单规范化路径，防止格式错误的插件命令规范在启动时崩溃（对 undefined 执行 `trim`）。 (#31997) 修复 #31944。感谢 @liuxiaopai-ai。 - **Telegram**：在账户令牌缺失时保护重复令牌检查和网关启动令牌规范化，防止在状态/启动流程中出现 `token.trim()` 崩溃。 (#31973) 感谢 @ningding97。 - **Discord/生命周期启动状态**：当网关在生命周期调试监听器附加前已连接时，推送即时的 `connected` 状态快照，并带有中止保护以防止在启动中止期间出现矛盾的状态翻转。 (#32336) 感谢 @mitchmcalister。 - **提及/Slack 格式化加固**：为运行时文本规范化路径添加空安全保护，防止格式错误/未定义的文本负载在提及剥离或 mrkdwn 转换时崩溃。 (#31865) 感谢 @stone-jin。 - **飞书/插件 SDK 兼容性**：加载飞书监控状态时添加安全的 webhook 默认回退，使混合版本安装不再因旧版 `openclaw/plugin-sdk` 构建省略 webhook 默认常量而崩溃。 (#31606) - **飞书/群组广播调度**：添加可配置的多代理群组广播调度，具备观察者会话隔离、跨账户重复数据删除保护以及避免广播/主题工作流中重复重播的非提及历史缓冲规则。 (#29575) 感谢 @ohmyskyhigh。 - **网关/子代理 TLS 配对**：允许经过身份验证的本地 `gateway-client` 后端自连接跳过设备配对，同时仍要求非本地/直接主机路径进行配对，在 Docker/LAN 设置中恢复 `sessions_spawn` 配合 `gateway.tls.enabled=true`。修复 #30740。感谢 @Sid-Qin 和 @vincentkoc。 - **浏览器/CDP 启动诊断**：在启动超时错误中包含 Chrome 标准错误输出和 Linux 无沙盒提示，使失败的启动更易诊断。 (#29312) 感谢 @veast。 - **群晖 Chat/webhook 入口加固**：通过共享请求体保护措施强制执行有界主体读取（大小 + 超时），防止在令牌验证前发生未经身份验证的慢速主体挂起。 (#25831) 感谢 @bmendonca3。 - **飞书/重复回复弹性**：在监控启动时将持久化重复数据删除状态预热到内存中，使网关重启后的重试事件保持抑制状态，无需初始磁盘探测遗漏。 (#31605) - **语音通话/运行时生命周期**：通过重置失败的运行时承诺防止 `EADDRINUSE` 循环，使 webhook `start()` 对实际绑定的端口具备幂等性，并在启动失败后完全清理 webhook/隧道/tailscale 资源。 (#32395) 感谢 @scoootscooob。 - **网关/安全加固**：将仅环回来源的开发允许与实际本地套接字客户端（而非 Host 头声明）绑定，当 `gateway.controlUi.dangerouslyAllowHostHeaderOriginFallback` 接受 websocket 来源时添加明确警告/指标，为会话筛选和日志脱敏路径加固安全正则检测（例如 `(a|aa)+`），并为大型正则评估输入设置边界。感谢 @tdjackey 报告。 - **网关/插件 HTTP 加固**：要求插件路由注册必须显式 `auth`，为重复 `path+match` 注册添加路由所有权保护，将插件路径匹配/认证逻辑集中到专用模块，并跨频道监控共享 webhook 目标路由生命周期连接，避免陈旧或冲突的注册。感谢 @tdjackey 报告。 - **浏览器/配置文件默认值**：在无头/无沙盒环境中优先使用 `openclaw` 配置文件而非 `chrome`，除非配置了显式 `defaultProfile`。 (#14944) 感谢 @BenediktSchackenberg。 - **网关/WS 安全**：默认保持仅环回的 `ws://`，并通过 `OPENCLAW_ALLOW_INSECURE_PRIVATE_WS=1` 提供明确的断点私有网络选择加入；对新上手/客户端/调用验证和测试对齐此严格默认策略。 (#28670) 感谢 @dashed、@vincentkoc。 - **OpenAI Codex OAuth/TLS 先决条件**：添加具有可操作修复方案的 OAuth TLS 证书链预检，并将医生 TLS 先决条件探测限制为 OpenAI Codex OAuth 配置的安装（或显式 `doctor --deep`），避免无条件出站探测延迟。 (#32051) 感谢 @alexfilatov。 - **安全/Webhook 请求加固**：对 BlueBubbles 和 Google Chat webhook 处理程序强制执行认证先于主体解析，为 webhook 认证路径（包括 LINE 签名验证）添加严格的预认证主体/时间预算，并添加共享飞行中/请求防护栏以及回归测试/链接检查，防止重新引入未经认证的慢速主体 DoS 模式。感谢 @GCXWLP 报告。 - **CLI/配置验证与路由加固**：将 `openclaw config validate` 失败去重为单一权威报告，跨核心 Zod 和插件 AJV 验证公开允许值元数据/提示（包括 `--json` 字段），净化终端渲染的验证文本，并使命令路径解析在预操作/路由/延迟注册中感知根选项（包括带拆分根选项的路由 `config get/unset`）。感谢 @gumadeiras。 - **浏览器/扩展中继重连容错**：当附加目标仍存在时，在短暂的 MV3 工作器断开期间保持 `/json/version` 和 `/cdp` 可达，并在重连宽限期内保留客户端。 (#30232) 感谢 @Sid-Qin。 - **CLI/浏览器启动超时**：遵循 `openclaw browser --timeout <ms> start` 并通过移除固定的 15000ms 覆盖来停止，使较慢的 Chrome 启动可使用调用方提供的超时。 (#22412, #23427) 感谢 @vincentkoc。 - **群晖 Chat/网关生命周期**：在非活跃和活跃账户路径中将 `startAccount` 保持待处理直至中止，防止网关监管下 webhook 路由重启循环。 (#23074) 感谢 @druide67。 - **执行批准/允许列表匹配**：在路径模式字面量中转义正则元字符（同时保留通配符），防止在 `/usr/bin/g++` 等已批准可执行文件上崩溃，并正确匹配混合通配符/字面量令牌路径。 (#32162) 感谢 @stakeswky。 - **群晖 Chat/webhook 兼容性**：接受 JSON 和别名负载字段，允许从主体/查询/头来源解析令牌，并使用 `204` 确认 webhook 请求以避免群晖 Chat 客户端中持续的“处理中...”状态。 (#26635) 感谢 @memphislee09-source。 - **语音通话/Twilio 签名验证**：在确定性的 URL 端口变体（带/不带端口）上重试签名验证，以处理反向代理和非标准端口后混合的 Twilio 签名行为。 (#25140) 感谢 @drvoss。 - **Slack/Bolt 启动兼容性**：移除无效的 `message.channels` 和 `message.groups` 事件注册，使 Slack 提供商在 Bolt 4.6+ 启动时不崩溃；频道/群组流量继续通过统一 `message` 处理程序（`channel_type`）进行。 (#32033) 感谢 @mahopan。 - **Slack/套接字认证失败处理**：在启动和重连期间对不可恢复的认证错误（`account_inactive`、`invalid_auth` 等）快速失败，而非无限重试循环，包括传播 `unable_to_socket_mode_start` 错误负载。 (#32377) 感谢 @scoootscooob。 - **网关/macOS LaunchAgent 加固**：在生成的网关 LaunchAgent plist 中写入 `Umask=077`，使 npm 升级为网关创建的状态文件保留仅所有者默认权限。 (#31919) 修复 #31905。感谢 @liuxiaopai-ai。 - **macOS/LaunchAgent 安全默认值**：在生成的网关 launchd plist 中写入 `Umask=63`（八进制 `077`），使更新后服务重新安装默认保持仅所有者文件权限，而非回退到系统 `022`。 (#32022) 修复 #31905。感谢 @liuxiaopai-ai。 - **媒体理解/提供商 HTTP 代理路由**：将来自 `HTTPS_PROXY`/`HTTP_PROXY` 环境变量的代理感知获取函数传递给音频/视频提供商调用（具备格式错误代理回退），使转录/视频请求遵循配置的出站代理。 (#27093) 感谢 @mcaxtr。 - **沙盒/工作区挂载权限**：当 `workspaceAccess` 不是 `rw`（包括 `none`）时，使主 `/workspace` 绑定挂载在所有核心沙盒容器和沙盒浏览器创建流程中均为只读。 (#32227) 感谢 @guanyu-zhang。 - **工具/fsPolicy 传播**：在启用了仅工作区模式时，对图像/PDF 本地根允许列表遵循 `tools.fs.workspaceOnly`，拒绝工作区外部的非沙盒媒体路径。 (#31882) 感谢 @justinhuangcode。 - **守护进程/Homebrew 运行时固定**：将 Homebrew Cellar Node 路径解析为稳定的 Homebrew 管理的符号链接（包括 `node@22` 等版本化公式），使网关安装在 brew 升级期间保持预期运行时。 (#32185) 感谢 @scoootscooob。 - **浏览器/安全输出边界加固**：用根绑定 fd 验证写入替换先检查后重命名的输出提交，统一安装/技能规范路径边界检查，并为浏览器输出和共享 fs-safe 写入流程中的符号链接重新绑定竞争路径添加回归覆盖。感谢 @tdjackey 报告。 - **网关/安全规范化加固**：将插件路由路径变体解码为规范化不动点（带边界深度），在规范化异常时失败封闭，并为深度编码的 `/api/channels/*` 变体强制执行网关认证，防止通过插件处理程序的替代路径认证绕过。感谢 @tdjackey 报告。 - **浏览器/网关加固**：在将显式 `--url` 视为仅覆盖认证的同时，为 `OPENCLAW_GATEWAY_URL` / `CLAWDBOT_GATEWAY_URL` 保留环境凭证，并使容器浏览器加固标志可选，为 Docker/LXC 稳定性提供更安全的默认值。 (#31504) 感谢 @vincentkoc。 - **网关/控制 UI basePath webhook 透传**：让配置的 `controlUiBasePath` 下非读取方法回退到插件路由（而非返回控制 UI 405），恢复 basePath 挂载后的 webhook 处理程序。 (#32311) 感谢 @ademczuk。 - **控制 UI/遗留浏览器兼容性**：用兼容性辅助函数替换 `app-render` 中依赖 `toSorted` 的 cron 建议排序，使没有 `Array.prototype.toSorted` 的旧浏览器不再白屏。 (#31775) 感谢 @liuxiaopai-ai。 - **macOS/PeekabooBridge**：为遗留的 `clawdbot`、`clawdis` 和 `moltbot` 应用程序支持套接字路径添加兼容性套接字符号链接，使重命名前的客户端仍可连接。 (#6033) 感谢 @lumpinif 和 @vincentkoc。 - **网关/消息工具可靠性**：当 `message.*` 操作接收平台特定频道 ID 时，通过回退到 `toolContext.currentChannelProvider` 避免错误的“未知频道”失败，并通过添加每频道启动连接宽限期防止刚（重新）启动的频道出现健康监控重启抖动。 (来自 #32367) 感谢 @MunemHashmi。 - **Windows/生成规范化**：跨 ACP 客户端、QMD/mcporter 内存路径和沙盒 Docker 执行统一非核心 Windows 生成处理，使用共享包装器解析策略，并为 `.cmd` 垫片展开和 shell 回退行为提供针对性回归覆盖。 (#31750) 感谢 @Takhoffman。 - **安全/ACP 沙盒继承**：通过拒绝来自沙盒请求者会话的 ACP 生成，并拒绝 ACP 运行时的 `sandbox="require"`，为 `runtime="acp"` 的 `sessions_spawn` 强制执行失败封闭运行时防护栏，防止通过主机端 ACP 初始化进行沙盒边界绕过。 (#32254) 感谢 @tdjackey 报告，以及 @dutifulbob 提供修复。 - **安全/Web 工具 SSRF 防护**：在设置代理环境变量时，为不受信任的 `web_fetch` 和引用重定向 URL 检查保持 DNS 固定，并要求在环境代理路由可绕过受信任/操作员控制端点的固定调度之前明确危险选择加入。感谢 @tdjackey 报告。 - **Gemini 架构净化**：在提供商验证前将格式错误的 JSON Schema `properties` 值（`null`、数组、基元）强制转换为 `{}`，防止无效插件/工具架构在严格验证器下游崩溃。 (#32332) 感谢 @webdevtodayjason。 - **媒体理解/格式错误附件防护**：加固附件选择和决策摘要格式化，以抵抗非数组或格式错误的附件负载，防止无效入站元数据形状上的运行时崩溃。 (#28024) 感谢 @claw9267。 - **浏览器/扩展导航重新附加**：通过将中继附加事件推迟到重新连接/重新公告，在短暂 MV3 工作器断开期间保持调试器重新附加，减少导航后选项卡丢失。 (#28725) 感谢 @stone-jin。 - **浏览器/扩展中继陈旧选项卡**：当扩展目标被销毁/崩溃或命令因缺少目标/会话错误失败时，从 `/json/list` 逐出陈旧缓存目标。 (#6175) 感谢 @vincentkoc。 - **浏览器/CDP 启动就绪**：启动 Chrome 后等待 CDP websocket 就绪，并在就绪从未到达时干净地停止/重置，减少 `browser start`/`open` 后的后续 `PortInUseError` 竞争。 (#29538) 感谢 @AaronWander。 - **OpenAI/响应 WebSocket 工具调用 ID 卫生**：在持久化前规范化空白/空格流式工具调用 ID，并阻止 WS 转换路径中的空 `function_call_output.call_id` 负载，避免 OpenAI 400 错误（`Invalid 'input[n].call_id': empty string`），并为入站流规范化和出站负载防护提供回归覆盖。 - **安全/节点摄像头 URL 下载**：将节点 `camera.snap`/`camera.clip` URL 负载下载绑定到解析的节点主机，在节点 `remoteIp` 不可用时强制执行失败封闭行为，并使用带重定向主机/协议检查的 SSRF 防护获取以防止离节点获取枢纽。感谢 @tdjackey 报告。 - **配置/备份加固**：对轮换的配置备份强制执行仅所有者（`0600`）权限，并清理受管备份环外的孤立 `.bak.*` 文件，降低陈旧或宽松备份工件的凭据泄露风险。 (#31718) 感谢 @YUJIE2002。 - **Telegram/入站媒体文件名**：为文档/音频/视频/动画下载保留原始 `file_name` 元数据（具备获取/路径回退），使保存的入站附件保留发送方提供的名称而非不透明的 Telegram 文件路径。 (#31837) 感谢 @Kay-051。 - **网关/OpenAI 聊天补全**：在构建 `/v1/chat/completions` 的 `agentCommand` 输入时遵循 `x-openclaw-message-channel`，保留调用方频道身份而非强制 `webchat`。 (#30462) 感谢 @bmendonca3。 - **插件 SDK/运行时加固**：在 CI/发布检查中添加包导出验证，以在发布前回归前捕获缺失的运行时导出。 (#28575) 感谢 @Glucksberg。 - **媒体/MIME 规范化**：在 `kindFromMime` 中规范化参数化/大小写变体的 MIME 字符串（例如 `Audio/Ogg; codecs=opus`），使 WhatsApp 语音笔记被分类为音频并通过转录正确路由。 (#32280) 感谢 @Lucenx9。 - **Discord/音频预检提及**：通过 Discord `content_type` 检测音频附件，并根据类型化文本（而非媒体占位符）对预检转录进行门控，使公会语音笔记提及得以转录和匹配。 (#32136) 感谢 @jnMetaCode。 - **飞书/主题会话路由**：当 `root_id` 缺失时，使用 `thread_id` 作为主题会话范围回退，在主题创建期间保持首转主题键稳定，并强制入站事件已携带主题/线程上下文时的线程回复。 (#29788) 感谢 @songyaolun。 - **网关/Webchat NO_REPLY 流式传输**：抑制作为 `NO_REPLY` 前缀的助手前导片段增量，并保持最终消息缓冲同步，防止静默响应运行中部分 `NO` 泄漏，同时保留合法的简短回复。 (#32073) 感谢 @liuxiaopai-ai。 - **Telegram/模型选择器回调**：通过回退到紧凑回调负载并在选择时解析提供商 ID（歧义时重新提示提供商），保持长模型按钮可选，避免 Telegram 64 字节回调截断失败。 (#31857) 感谢 @bmendonca3。 - **上下文窗口元数据预热**：添加指数配置加载重试退避（1s -> 2s -> 4s，上限 60s），使瞬态启动失败自动恢复而无热循环重试。 - **语音通话/Twilio 外部出站**：自动注册 webhook 优先 `outbound-api` 调用（在 OpenClaw 外部发起），使媒体流被接受且呼叫方向元数据保持准确。 (#31181) 感谢 @scoootscooob。 - **飞书/运行频道回退**：在推断排队运行 `messageProvider` 回退（当 `OriginatingChannel` 缺失）时优先使用 `Provider` 而非 `Surface`，防止混合中继元数据上下文中的飞书轮次被错误标记为 `webchat`。 (#31880) 修复 #31859。感谢 @liuxiaopai-ai。 - **飞书/DM 配对回复目标**：将配对挑战回复发送至 `chat:<chat_id>` 而非 `user:<sender_open_id>`，使仅含用户 ID 发送方负载的 Lark/飞书私聊能可靠接收配对消息。 (#31403) 感谢 @stakeswky。 - **飞书/Lark 私聊路由**：将入站 `chat_type: "private"` 视为直接消息上下文，用于配对/提及转发/反应综合处理，使 Lark 私聊行为类似飞书点对点私聊。 (#31400) 感谢 @stakeswky。 - **Signal/消息操作**：允许 `react` 在 `messageId` 被省略时回退到 `toolContext.currentMessageId`，匹配 Telegram 行为并解除入站轮次中代理发起反应的阻塞。 (#32217) 感谢 @dunamismax。 - **Discord/消息操作**：允许 `react` 在 `messageId` 被省略时回退到 `toolContext.currentMessageId`，匹配 Telegram/Signal 入站轮次反应人体工程学。 - **群晖 Chat/回复投递**：将 webhook 用户名解析为 Chat API `user_id` 值以进行出站聊天机器人回复，避免多账户设置中 webhook 用户 ID 与 `method=chatbot` 收件人 ID 不匹配。 (#23709) 感谢 @druide67。 - **Slack/线程上下文负载**：仅在新会话的首轮线程中注入线程启动器/历史文本，同时保留线程元数据，减少长寿命线程会话中重复上下文令牌膨胀。 (#32133) 感谢 @sourman。 - **Slack/会话路由**：当 `replyToMode=off` 时，将顶级频道消息保留在一个共享会话中，同时为真实线程回复和非关闭模式保留线程范围键。 (#32193) 感谢 @bmendonca3。 - **语音通话/webhook 路由**：要求精确的 webhook 路径匹配（而非前缀匹配），防止相似路径到达提供商验证/调度逻辑。 (#31930) 感谢 @afurm。 - **Zalo/配对认证测试**：添加 webhook 回归覆盖，断言 DM 配对存储读/写保持账户范围，防止多账户设置中的跨账户授权泄露。 (#26121) 感谢 @bmendonca3。 - **Zalouser/配对认证测试**：添加账户范围 DM 配对存储回归覆盖（`monitor.account-scope.test.ts`），防止多账户设置中的跨账户允许列表泄露。 (#26672) 感谢 @bmendonca3。 - **飞书/发送目标前缀**：规范化显式 `group:`/`dm:` 发送目标，并在解析出站飞书目标时保留显式接收 ID 路由提示。 (#31594) 感谢 @liuxiaopai-ai。 - **Webchat/飞书会话延续**：在 `chat.send` 的会话投递上下文中保留可路由的 `OriginatingChannel`/`OriginatingTo` 元数据，并在决定跨频道路由调度时优先使用提供商规范化频道，使 Webchat 回复继续在选定的飞书会话上而非回退到主/内部会话路由。 (#31573) - **Telegram/隐式提及论坛处理**：将 Telegram 论坛系统服务消息（`forum_topic_*`、`general_forum_topic_*`）排除在回复链隐式提及检测之外，使 `requireMention` 在机器人创建主题生命周期事件中不被绕过。 (#32262) 感谢 @scoootscooob。 - **Slack/入站防抖路由**：通过消息时间戳隔离顶级非 DM 消息防抖键，避免跨线程冲突，保留 DM 批处理，并在立即非防抖后续之前刷新挂起的顶级缓冲区，以保持顺序稳定。 (#31951) 感谢 @scoootscooob。 - **飞书/重复回复**：当消息工具发送使用通用提供商元数据（`provider: "message"`）时抑制相同目标回复调度，并在重复目标检查期间规范化 `lark`/`feishu` 提供商别名，防止飞书会话中重复投递。 (#31526) - **Webchat/静默令牌泄露**：从 `chat.history` 响应中过滤助手 `NO_REPLY` 仅转录条目，并在聊天控制器中添加客户端纵深防护，使内部静默令牌永不呈现为可见聊天气泡。 (#32015) 合并 #32183、#32082、#32045、#32052、#32172 和 #32112 的重叠。感谢 @ademczuk、@liuxiaopai-ai、@ningding97、@bmendonca3 和 @x4v13r1120。 - **医生/本地内存提供商检查**：当 `provider=local` 且未设置显式 `modelPath` 时，通过遵循默认本地模型回退来停止误报本地提供商警告，同时仍警告网关探测报告本地嵌入未就绪。 (#32014) 修复 #31998。感谢 @adhishthite。 - **媒体理解/parakeet CLI 输出解析**：在请求 txt 输出（或默认）时从 `--output-dir/<media-basename>.txt` 读取 `parakeet-mlx` 转录，非 txt 格式则回退到标准输出。 (#9177) 感谢 @mac-110。 - **媒体理解/音频转录防护**：在提供商/CLI 转录前跳过微小/空音频文件（<1024 字节），避免嘈杂的无效音频失败并保持干净的回退行为。 (#8388) 感谢 @Glucksberg。 - **网关/插件 HTTP 路由优先级**：在控制 UI SPA 捕获全部之前运行显式插件 HTTP 路由，使已注册的插件 webhook/自定义路径保持可达，而未匹配路径仍回退到控制 UI 处理。 (#31885) 感谢 @Sid-Qin。 - **网关/节点浏览器代理路由**：当查询参数省略时，遵循 `browser.request` JSON 主体中的 `profile`，同时保留两者均存在时的查询配置文件优先级。 (#28852) 感谢 @Sid-Qin。 - **网关/控制 UI basePath POST 处理**：对精确 basePath 路由（例如 `/openclaw`）的 `POST` 返回 405 而非重定向，并添加端到端回归覆盖，确保根挂载 webhook POST 路径仍回退到插件处理程序。 (#31349) 感谢 @Sid-Qin。 - **浏览器/默认配置文件选择**：默认 `browser.defaultProfile` 行为现在在未配置显式默认时优先 `openclaw`（托管独立 CDP），同时仍为明确选择使用自动配置 `chrome` 中继配置文件。 (#32031) 修复 #31907。感谢 @liuxiaopai-ai。 - **沙盒/mkdirp 边界检查**：当目录打开探测返回平台特定 I/O 错误时，允许现有边界内目录通过 mkdirp 边界验证，并为目录安全回退行为提供回归覆盖。 (#31547) 感谢 @stakeswky。 - **模型/配置环境传播**：在模型引导中的隐式提供商发现前应用 `config.env.vars`，使配置范围的凭据对隐式提供商解析路径可见。 (#32295) 感谢 @hsiaoa。 - **模型/Codex 使用标签**：当 API 窗口秒数被模糊报告为 24 小时时，从重置周期推断每周次要使用窗口，使 `openclaw models status` 不再将每周限制误标为每日。 (#31938) 感谢 @bmendonca3。 - **网关/心跳模型重载**：将 `models.*` 和 `agents.defaults.model` 配置更新视为心跳热重载触发器，使心跳无需完整网关重启即可获取模型更改。 (#32046) 感谢 @stakeswky。 - **内存/LanceDB 嵌入**：将配置的 `embedding.dimensions` 转发到 OpenAI 嵌入请求，使向量大小和 API 输出维度在显式配置时保持对齐。 (#32036) 感谢 @scotthuang。 - **网关/控制 UI 方法防护**：当未配置 base path 时，允许 `POST` 请求到非 UI 路由回退，并为回退和 base-path 405 行为添加 POST 回归覆盖。 (#23970) 感谢 @tyler6204。 - **浏览器/CDP 状态准确性**：要求通过 CDP websocket（而非仅套接字打开）成功的 `Browser.getVersion` 响应后才报告 `cdpReady`，使陈旧空闲命令通道被标记为不健康。 (#23427) 感谢 @vincentkoc。 - **守护进程/容器中的 systemd 检查**：在 `is-enabled` 检查期间将缺失的 `systemctl` 调用（包括 `spawn systemctl ENOENT`/`EACCES`）视为不可用服务状态，防止容器流程在安装/状态处理继续前因“网关服务检查失败”而失败。 (#26089) 感谢 @sahilsatralkar 和 @vincentkoc。 - **安全/节点执行批准**：在执行/转发前立即重新验证批准绑定的 `cwd` 身份，并在批准加固后 `cwd` 漂移时以明确拒绝失败封闭。 - **安全审计/技能工作区加固**：当工作区 `skills/**/SKILL.md` 解析到工作区根外部（例如符号链接链漂移）时，在 `openclaw security audit` 中添加 `skills.workspace.symlink_escape` 警告，并在安全词汇表中提供文档覆盖。 - **安全/节点执行批准**：在批准加固期间保留 shell/分发包装器 argv 语义，使已批准的包装器命令（例如 `env sh -c ...`）不会漂移到不同的运行时命令形状，并为批准计划生成和已批准运行时执行路径添加回归覆盖。感谢 @tdjackey 报告。 - **安全/fs-safe 写入加固**：使 `writeFileWithinRoot` 使用同目录临时写入加原子重命名，添加写入后 inode/硬链接重新验证并在边界漂移时发出安全警告，并在最终重命名失败时避免截断现有目标。 - **安全/技能归档提取**：跨 tar.gz 和 tar.bz2 安装流程统一 tar 提取安全检查，强制执行 tar 压缩大小限制，并在预检和提取之间 tar.bz2 归档更改时失败封闭，防止绕过条目类型/大小防护栏。感谢 @GCXWLP 报告。 - **安全/提示欺骗加固**：停止将排队的运行时事件注入用户角色提示文本，通过受信任的系统提示上下文路由它们，并中和不受信任消息内容中的入站欺骗标记（如 `[System Message]` 和行首 `System:`）。 (#30448) - **沙盒/Docker 设置命令解析**：接受 `agents.*.sandbox.docker.setupCommand` 为字符串或字符串数组，并将数组规范化为换行分隔的 shell 脚本，使多步骤设置命令不再无分隔符连接。 (#31953) 感谢 @liuxiaopai-ai。 - **沙盒/引导上下文边界加固**：拒绝解析到源工作区外部的符号链接/硬链接别名引导种子文件，并在压缩后切换 `AGENTS.md` 上下文读取为边界验证文件打开，防止通过工作区别名注入主机文件内容。感谢 @tdjackey 报告。 - **代理/沙盒工作目录映射**：将容器工作目录路径（例如 `/workspace`）映射回主机工作区，再进行沙盒路径验证，使执行请求在容器化运行中保持预期目录而非回退到不可用的主机路径。 (#31841) 感谢 @liuxiaopai-ai。 - **Docker/沙盒引导加固**：使 `OPENCLAW_SANDBOX` 选择加入解析显式化（`1|true|yes|on`），通过 `OPENCLAW_DOCKER_SOCKET` 支持自定义 Docker 套接字路径，在沙盒先决条件通过前延迟 docker.sock 暴露，并在设置被跳过或部分失败时重置/回滚持久化沙盒模式为 `off` 以避免陈旧损坏的沙盒状态。 (#29974) 感谢 @jamtujest 和 @vincentkoc。 - **钩子/webhook ACK 兼容性**：对成功的 `/hooks/agent` 请求返回 `200`（而非 `202`），使需要 `200` 的提供商（例如 Forward Email）接受调度的代理钩子投递。 (#28204) 感谢 @Glucksberg。 - **飞书/运行频道回退**：在推断排队运行 `messageProvider` 回退（当 `OriginatingChannel` 缺失）时优先使用 `Provider` 而非 `Surface`，防止混合中继元数据上下文中的飞书轮次被错误标记为 `webchat`。 (#31880) 修复 #31859。感谢 @liuxiaopai-ai。 - **技能/sherpa-onnx-tts**：在 ESM 下运行 `sherpa-onnx-tts` 二进制（替换 CommonJS `require` 导入）并添加回归覆盖，防止启动时出现 `require is not defined in ES module scope` 崩溃。 (#31965) 感谢 @bmendonca3。 - **入站元数据/直接中继上下文**：为外部频道（例如 WhatsApp）恢复直接频道对话元数据块，同时保留 webchat 直接抑制，使中继代理在不重新引入内部 webchat 元数据噪音的情况下恢复发送方/消息标识符。 (#31969) 修复 #29972。感谢 @Lucenx9。 - **Slack/频道消息订阅**：注册显式的 `message.channels` 和 `message.groups` 监控处理程序（连同通用 `message`），使频道/群组事件订阅在 Slack 调度类型化消息事件名称时仍被消费。修复 #31674。 - **钩子/会话范围内存上下文**：在嵌入式插件工具上下文以及 `before_tool_call`/`after_tool_call` 钩子上下文（包括压缩和客户端工具连接）中公开临时 `sessionId`，使插件能够跨 `/new` 和 `/reset` 隔离每会话状态。相关 #31253 和 #31304。感谢 @Sid-Qin 和 @Servo-AIpex。 - **语音通话/Twilio 入站问候**：为 Twilio 运行应答呼叫初始通知问候，而非跳过管理器说话路径，并为 Twilio 和 Plivo 通知流程提供回归覆盖。 (#29121) 感谢 @xinhuagu。 - **语音通话/陈旧呼叫水合**：在加载持久化进行中呼叫前使用提供商验证活跃呼叫，使重启后陈旧的本地持久记录不会阻塞或错误路由新呼叫处理。 (#4325) 感谢 @garnetlyx。 - **飞书/文件上传文件名**：在飞书多部分上传中对非 ASCII/特殊字符 `file_name` 值进行百分号编码，使中文/符号丰富的文件名作为正确附件发送而非纯文本链接。 (#31179) 感谢 @Kay-051。 - **媒体/MIME 频道奇偶性**：通过规范化 `kindFromMime` 路由 Telegram/Signal/iMessage 媒体种类检查，使混合大小写/参数化 MIME 值跨消息频道一致分类。 - **WhatsApp/入站自消息上下文**：通过 web 收件箱管道传播入站 `fromMe`，并将直接自消息注释为信封中的 `(self)`，使代理能够区分所有者发起的轮次与联系人轮次。 (#32167) 感谢 @scoootscooob。 - **Webchat/流式传输最终化**：在最终事件省略 `message` 时持久化流式助手文本，同时保持最终负载优先级并跳过空流缓冲区，防止工具轮次后回复消失。 (#31920) 感谢 @Sid-Qin。 - **飞书/入站排序**：按聊天序列化消息处理，同时保留跨聊天并发性，避免突发入站流量下同一聊天竞争丢失。 (#31807) - **飞书/输入指示器抑制**：当指示器已激活时跳过输入保持活动反应重新添加，防止重复相同表情添加导致重复通知 ping。 (#31580) - **飞书/探测失败退避**：为每个账户密钥缓存 API 和超时探测失败一分钟，同时保留中止感知探测超时，减少瞬态凭据/网络中断期间的重复健康检查重试。 (#29970) - **飞书/流式传输块回退**：当最终负载文本缺失时，将 markdown 块流文本保留为最终流式卡片内容，同时仍抑制非卡片内部块块投递。 (#30663) - **飞书/Bitable API 错误**：将飞书 Bitable 工具错误处理与结构化 `LarkApiError` 响应统一，并在 wiki/基础元数据、字段和记录操作中保持一致的 API/上下文归属。 (#31450) - **BlueBubbles/消息元数据**：加固发送响应 ID 提取，在 DM 上下文中包含发送方身份，并规范化入站 `message_id` 选择以避免重复 ID 元数据。 (#23970) 感谢 @tyler6204。 - **WebChat/markdown 表格**：确保 GitHub 风格 markdown 表格解析在渲染时明确启用，并为宽表格添加水平溢出处理，为仅表格和混合文本+表格内容提供回归覆盖。 (#32365) 感谢 @BlueBirdBack。 - **飞书/默认账户解析**：在出站账户选择期间始终遵循显式 `channels.feishu.defaultAccount`（包括首选 ID 不在 `accounts` 中的顶级凭据设置），而非静默回退到其他账户 ID。 (#32253) 感谢 @bmendonca3。 - **飞书/发送方查找权限**：在尽力发送方名称解析期间抑制陈旧不存在范围错误（`contact:contact.base:readonly`）的用户-facing 授权提示，使入站消息继续而无重复错误权限通知。 (#31761) - **Discord/调度 + Slack 格式化**：恢复跨 Discord 频道的并行出站调度，每频道队列同时保持频道内顺序，并运行 Slack 预览/流式更新文本通过 mrkdwn 规范化以实现一致格式化。 (#31927) 感谢 @Sid-Qin。 - **飞书/入站防抖**：将快速同一聊天发送方爆发防抖为一个有序调度轮次，合并文本时跳过已处理重试，并跨合并条目保留机器人提及意图，减少重复或延迟入站处理。 (#31548) - **测试/沙盒 + 归档可移植性**：在 Windows 上使用连接兼容目录链接设置，并在无特权文件符号链接不可用的平台对符号链接转义测试使用显式文件符号链接平台保护，减少错误 Windows CI 失败同时保留支持路径上的遍历检查。 (#28747) 感谢 @arosstale。 - **浏览器/扩展重新公告可靠性**：当重新公告转发失败时保持中继状态为 `connecting`，并在导航后扩展调试器重新附加重试，减少错误附加状态和导航后断开循环。 (#27630) 感谢 @markmusson。 - **浏览器/Act 请求兼容性**：除 `request={...}` 外还接受遗留扁平 `action="act"` 参数（`kind/ref/text/...`），使浏览器 act 调用不再因“需要 request”而失败。 (#15120) 感谢 @vincentkoc。 - **OpenRouter/x-ai 兼容性**：跳过 `x-ai/*` 模型（例如 Grok）的 `reasoning.effort` 注入，使 OpenRouter 请求不再因不支持的推理参数而失败。 (#32054) 感谢 @scoootscooob。 - **模型/openai-completions 开发者角色兼容性**：对非原生端点强制 `supportsDeveloperRole=false`，将不可解析的 `baseUrl` 值视为非原生，并为空/格式错误 baseUrl 加显式 true 覆盖行为添加回归覆盖。 (#29479) 感谢 @akramcodez。 - **浏览器/配置文件仅附加覆盖**：支持 `browser.profiles.<name>.attachOnly`（回退到全局 `browser.attachOnly`），使环回代理配置文件可跳过本地启动/端口所有权检查，而无需为每个配置文件强制仅附加模式。 (#20595) 感谢 @unblockedgamesstudio 和 @vincentkoc。 - **会话/锁恢复**：通过比较锁文件 `starttime` 与 `/proc/<pid>/stat` starttime 检测回收的 Linux PID，使容器化 PID 重用场景中陈旧的 `.jsonl.lock` 文件立即被回收，同时保持旧锁文件兼容性。 (#26443) 修复 #27252。感谢 @HirokiKobayashi-R 和 @vincentkoc。 - **Cron/隔离投递目标回退**：移除早期未解析目标返回，使 cron 投递在 `delivery.to` 被省略时能流经共享出站目标解析（包括每频道 `resolveDefaultTo` 回退）。 (#32364) 感谢 @hclsys。 - **OpenAI 媒体能力**：在 OpenAI 提供商能力列表中包含 `audio`，使音频转录模型在媒体理解提供商选择中合格。 (#12717) 感谢 @openjay。 - **浏览器/托管选项卡上限**：通过选项卡打开后尽力清理，将环回托管 `openclaw` 页面选项卡限制为 8 个，减少长期运行的渲染器积累，同时保留仅附加和远程配置文件行为。 (#29724) 感谢 @pandego。 - **Docker/镜像健康检查**：添加探测网关 `GET /healthz` 的 Dockerfile `HEALTHCHECK`，使容器运行时可在不需要认证凭据的情况下标记不健康实例。 (#11478) 感谢 @U-C4N 和 @vincentkoc。 - **网关/节点危险命令奇偶性**：在默认新手上路节点 `denyCommands` 中包含 `sms.send`，与网关危险命令真相源共享新手上路拒绝默认值，并在电话控制 `/phone arm writes` 中包含 `sms.send`，使 SMS 遵循与其他危险节点命令相同的断点流程。感谢 @zpbrent。 - **配对/AllowFrom 账户回退**：在 `readChannelAllowFromStore` 和 `readChannelAllowFromStoreSync` 中将省略的 `accountId` 值处理为 `default`，同时为默认账户流保留遗留无范围 AllowFrom 合并。感谢 @Sid-Qin 和 @vincentkoc。 - **浏览器/远程 CDP 所有权检查**：当 HTTP 可达但 websocket 握手失败时，跳过非环回远程 CDP 配置文件的本地进程所有权错误，并显示远程 websocket 附加/重试路径。 (#15582) 来自贡献者 (#28780) 合并。感谢 @stubbi、@bsormagec、@unblockedgamesstudio 和 @vincentkoc。 - **浏览器/CDP 代理绕过**：在设置代理环境变量时，对 localhost CDP HTTP/WS 连接强制直接环回代理路径和范围 `NO_PROXY` 扩展，使浏览器中继/控制在全局代理设置后仍能工作。 (#31469) 感谢 @widingmarcus-cyber。 - **会话/空闲重置正确性**：在入站元数据仅写入期间保留现有 `updatedAt`，防止实际用户轮次前意外刷新空闲重置边界。 (#32379) 感谢 @romeodiaz。 - **会话/锁恢复**：当不存在进程内锁所有权时，回收缺少 `starttime` 的遗留同 PID 锁文件，避免 PID 重用后的错误锁超时，同时保持活动锁安全检查。 (#32081) 感谢 @bmendonca3。 - **会话/存储缓存失效**：通过将缓存验证键控在单个文件统计快照（`mtimeMs` + `sizeBytes`）上，在同一 mtime 刻度内文件大小变化时重新加载缓存的会话存储，为同刻度重写提供回归覆盖。 (#32191) 感谢 @jalehman。 - **代理/子代理 `sessions_spawn`**：在规范化前拒绝格式错误的 `agentId` 输入（例如错误消息/路径类字符串），防止意外合成代理 ID 和幽灵工作区/会话路径；包含严格验证回归覆盖。 (#31381) 感谢 @openperf。 - **CLI/安装程序 Node 预检**：在 `openclaw.mjs` 运行时引导和安装程序活动 shell 检查中一致强制执行 Node.js `v22.12+`，并为不匹配的 shell PATH/默认值提供可操作的 nvm 恢复指南。 (#32356) 感谢 @jasonhargrove。 - **Web UI/配置表单**：在映射 `additionalProperties` 中支持 SecretInput 字符串或秘密引用联合，使提供商 API 密钥字段保持可编辑而非被标记为不支持。 (#31866) 感谢 @ningding97。 - **自动回复/内联命令清理**：在剥离内联 `/status` 和提取内联斜杠命令时保留换行结构，仅折叠水平空白，防止多行回复中的段落扁平化。 (#32224) 感谢 @scoootscooob。 - **配置/原始脱敏安全**：在原始脱敏往返中保留非敏感字面量，将 SecretRef 脱敏范围限定为秘密 ID（而非 `source`/`provider` 等结构字段），并在文本替换无法恢复原始配置形状时回退到结构化原始脱敏。 (#32174) 感谢 @bmendonca3。 - **钩子/运行时稳定性**：将内部钩子处理程序注册表保留在 `globalThis` 单例上，使钩子注册/调度在捆绑发出重复模块副本时保持一致。 (#32292) 感谢 @Drickon。 - **钩子/after_tool_call**：在嵌入式工具执行上下文中包含嵌入式会话上下文（`sessionKey`、`agentId`），并通过移除嵌入式运行中的重复适配器路径调度，使钩子恰好为每次工具执行触发一次。 (#32201) 感谢 @jbeno、@scoootscooob、@vincentkoc。 - **钩子/工具调用关联**：在插件工具钩子负载/上下文中包含 `runId` 和 `toolCallId`，并将工具开始/调整参数跟踪范围限定为运行，防止 `before_tool_call` 和 `after_tool_call` 中的跨运行冲突。 (#32360) 感谢 @vincentkoc。 - **插件/安装诊断**：拒绝没有 `openclaw.extensions` 的遗留插件包形状，并返回带有故障排除文档的明确升级提示。 (#32055) 感谢 @liuxiaopai-ai。 - **钩子/插件上下文奇偶性**：确保嵌入式尝试中的 `llm_input` 钩子接收其他钩子阶段使用的相同 `trigger` 和 `channelId` 感知 `hookCtx`，保留频道/触发器范围插件行为。 (#28623) 感谢 @davidrudduck 和 @vincentkoc。 - **插件/硬链接安装兼容性**：允许通过硬链接包管理器（`pnpm`、`bun`）安装的捆绑插件清单和入口文件加载，同时保持对非捆绑插件源的硬链接拒绝启用。 (#32119) 修复 #28175、#28404、#29455。感谢 @markfietje。 - **Cron/会话清理器可靠性**：将 cron 会话清理器扫描移至 `onTimer` `finally`，并在计时器刻度早期失败（例如 cron 存储解析失败）时保持修剪活动，防止孤立的隔离运行会话无限累积。 (#31996) 修复 #31946。感谢 @scoootscooob。 - **Cron/HEARTBEAT_OK 摘要泄露**：在隔离公告模式中，当任何负载是心跳确认令牌且无负载含媒体时，抑制回退主会话入队，防止内部旁白 + 尾随 `HEARTBEAT_OK` 被投递给用户。 (#32093) 感谢 @scoootscooob。 - **认证**：将 `permission_error` 分类为 `auth_permanent` 以用于配置文件回退。 (#31324) 感谢 @Sid-Qin。 - **代理/主机编辑可靠性**：仅当磁盘后检查确认替换可能发生（`newText` 存在且 `oldText` 缺失）时将主机编辑工具抛出视为成功，防止错误失败报告同时避免写入前误报。 (#32383) 感谢 @polooooo。 - **插件/安装回退安全**：将裸安装规范解析为捆绑插件 ID 后再进行 npm 查找（例如 `diffs` -> 捆绑 `@openclaw/diffs`），将 npm 回退限制为真正的包未找到错误，并继续拒绝未能通过清单验证的非插件 npm 包。 (#32096) 感谢 @scoootscooob。 - **Web UI/内联代码复制保真度**：禁用内联 `<code>` 跨度上的强制中间标记换行，使复制的 UUID/哈希/令牌字符串保留精确内容而非插入换行空格。 (#32346) 感谢 @hclsys。 - **重启信标格式化**：当重启消息文本已匹配 `stats.reason` 时避免重复 `Reason:` 行，使用户和下游解析器保持重启通知简洁。 (#32083) 感谢 @velamints2。 - **自动回复/后续队列**：通过仅在排空实际开始时缓存后续运行器，避免空闲窗口重启间的陈旧回调重用，在空最终化路径后保持入队顺序。 (#31902) 感谢 @Lanfei。 - **代理/工具结果防护**：即使禁用合成工具结果，也在中断时始终清除挂起的工具调用状态，防止孤立的工具使用转录导致后续提供商请求失败。 (#32120) 感谢 @jnMetaCode。 - **故障转移/错误分类**：将 HTTP `529`（提供商过载，常见于 Anthropic 兼容 API）视为 `rate_limit`，使模型故障转移可介入而非错误分类该路径。 (#31854) 感谢 @bugkill3r。 - **日志记录**：使用本地时间记录日志时间戳而非 UTC，使日志输出与文档化的本地时区行为对齐，避免本地诊断期间混淆。 (#28434) 感谢 @liuy。 - **代理/子代理公告清理**：在后代稳定期间保持完成消息运行待处理，添加 30 分钟硬过期后备以避免无限待处理状态，并保持重试簿记在延迟唤醒后可恢复。 (#23970) 感谢 @tyler6204。 - **密钥/执行解析器超时默认值**：使用提供商 `timeoutMs` 作为执行密钥提供商的默认非活动（`noOutputTimeoutMs`）看门狗，防止对 2 秒后开始产生输出的解析器过早无输出终止。 (#32235) 感谢 @bmendonca3。 - **自动回复/提醒防护说明抑制**：当轮次做出类似提醒的承诺但未调度新 cron 作业时，仅当同一会话存在已启用的 cron 才抑制未调度提醒警告说明；为无关会话、禁用作业或不可读 cron 存储路径保留警告。 (#32255) 感谢 @scoootscooob。 - **Cron/隔离公告心跳抑制**：当任何负载是心跳确认令牌且无负载含媒体时，将多负载运行视为可跳过，防止内部旁白 + 尾随 `HEARTBEAT_OK` 被投递给用户。 (#32131) 感谢 @adhishthite。 - **Cron/存储迁移**：在加载时将遗留 cron 作业（字符串 `schedule` 和顶级 `command`/`timeout` 字段）规范化为规范的计划/负载/会话目标形状，防止旧持久存储上的计划错误循环。 (#31926) 感谢 @bmendonca3。 - **测试/Windows 备份轮换**：在 Windows 上跳过仅 chmod 备份权限断言，同时保留跨平台的组合/轮换/修剪覆盖，避免 Windows 非 POSIX 模式语义导致的错误 CI 失败。 (#32286) 感谢 @jalehman。 - **测试/子代理公告**：在导入 `subagent-announce` 格式套件前设置 `OPENCLAW_TEST_FAST=1`，使模块级快速模式常量在 Windows CI 上确定性地捕获，防止嵌套完成公告覆盖中的超时波动。 (#31370) 感谢 @zwffff。

### Changes - Docs/Feishu webhook setup: clarify `verificationToken` configuration with Open Platform navigation steps, and align Feishu sender-allowlist guidance plus zh-CN channel documentation with current runtime behavior. (#31555) - Secrets/SecretRef coverage: expand SecretRef support across the full supported user-supplied credential surface (64 targets total), including runtime collectors, `openclaw secrets` planning/apply/audit flows, onboarding SecretInput UX, and related docs; unresolved refs now fail fast on active surfaces while inactive surfaces report non-blocking diagnostics. (#29580) Thanks @joshavant. - Tools/PDF analysis: add a first-class `pdf` tool with native Anthropic and Google PDF provider support, extraction fallback for non-native models, configurable defaults (`agents.defaults.pdfModel`, `pdfMaxBytesMb`, `pdfMaxPages`), and docs/tests covering routing, validation, and registration. (#31319) Thanks @tyler6204. - Outbound adapters/plugins: add shared `sendPayload` support across direct-text-media, Discord, Slack, WhatsApp, Zalo, and Zalouser with multi-media iteration and chunk-aware text fallback. (#30144) Thanks @nohat. - Models/MiniMax: add first-class `MiniMax-M2.5-highspeed` support across built-in provider catalogs, onboarding flows, and MiniMax OAuth plugin defaults, while keeping legacy `MiniMax-M2.5-Lightning` compatibility for existing configs. - Sessions/Attachments: add inline file attachment support for `sessions_spawn` (subagent runtime only) with base64/utf8 encoding, transcript content redaction, lifecycle cleanup, and configurable limits via `tools.sessions_spawn.attachments`. (#16761) Thanks @napetrov. - Telegram/Streaming defaults: default `channels.telegram.streaming` to `partial` (from `off`) so new Telegram setups get live preview streaming out of the box, with runtime fallback to message-edit preview when native drafts are unavailable. - Telegram/DM streaming: use `sendMessageDraft` for private preview streaming, keep reasoning/answer preview lanes separated in DM reasoning-stream mode. (#31824) Thanks @obviyus. - Telegram/voice mention gating: add optional `disableAudioPreflight` on group/topic config to skip mention-detection preflight transcription for inbound voice notes where operators want text-only mention checks. (#23067) Thanks @yangnim21029. - CLI/Config validation: add `openclaw config validate` (with `--json`) to validate config files before gateway startup, and include detailed invalid-key paths in startup invalid-config errors. (#31220) thanks @Sid-Qin. - Tools/Diffs: add PDF file output support and rendering quality customization controls (`fileQuality`, `fileScale`, `fileMaxWidth`) for generated diff artifacts, and document PDF as the preferred option when messaging channels compress images. (#31342) Thanks @gumadeiras. - Memory/Ollama embeddings: add `memorySearch.provider = "ollama"` and `memorySearch.fallback = "ollama"` support, honor `models.providers.ollama` settings for memory embedding requests, and document Ollama embedding usage. (#26349) Thanks @nico-hoff. - Zalo Personal plugin (`@openclaw/zalouser`): rebuilt channel runtime to use native `zca-js` integration in-process, removing external CLI transport usage and keeping QR/login + send/listen flows fully inside OpenClaw. - Plugin SDK/channel extensibility: expose `channelRuntime` on `ChannelGatewayContext` so external channel plugins can access shared runtime helpers (reply/routing/session/text/media/commands) without internal imports. (#25462) Thanks @guxiaobo. - Plugin runtime/STT: add `api.runtime.stt.transcribeAudioFile(...)` so extensions can transcribe local audio files through OpenClaw's configured media-understanding audio providers. (#22402) Thanks @benthecarman. - Plugin hooks/session lifecycle: include `sessionKey` in `session_start`/`session_end` hook events and contexts so plugins can correlate lifecycle callbacks with routing identity. (#26394) Thanks @tempeste. - Hooks/message lifecycle: add internal hook events `message:transcribed` and `message:preprocessed`, plus richer outbound `message:sent` context (`isGroup`, `groupId`) for group-conversation correlation and post-transcription automations. (#9859) Thanks @Drickon. - Media understanding/audio echo: add optional `tools.media.audio.echoTranscript` + `echoFormat` to send a pre-agent transcript confirmation message to the originating chat, with echo disabled by default. (#32150) Thanks @AytuncYildizli. - Plugin runtime/system: expose `runtime.system.requestHeartbeatNow(...)` so extensions can wake targeted sessions immediately after enqueueing system events. (#19464) Thanks @AustinEral. - Plugin runtime/events: expose `runtime.events.onAgentEvent` and `runtime.events.onSessionTranscriptUpdate` for extension-side subscriptions, and isolate transcript-listener failures so one faulty listener cannot break the entire update fanout. (#16044) Thanks @scifantastic. - CLI/Banner taglines: add `cli.banner.taglineMode` (`random` | `default` | `off`) to control funny tagline behavior in startup output, with docs + FAQ guidance and regression tests for config override behavior. - Docs/Models: refresh MiniMax, Moonshot (Kimi), GLM/Z.AI model docs to align with latest defaults (`MiniMax-M2.5`, `MiniMax-M2.5-highspeed`, `moonshot/kimi-k2.5`, `zai/glm-5`) and keep Moonshot model lists synced from shared source data. - README/Contributors: rank contributor avatars by composite score (commits + merged PRs + code LOC), excluding docs-only LOC to prevent bulk-generated files from inflating rankings. (#23970) Thanks @tyler6204. ### Breaking - **BREAKING:** Onboarding now defaults `tools.profile` to `messaging` for new local installs (interactive + non-interactive). New setups no longer start with broad coding/system tools unless explicitly configured. - **BREAKING:** ACP dispatch now defaults to enabled unless explicitly disabled (`acp.dispatch.enabled=false`). If you need to pause ACP turn routing while keeping `/acp` controls, set `acp.dispatch.enabled=false`. Docs: https://docs.openclaw.ai/tools/acp-agents - **BREAKING:** Plugin SDK removed `api.registerHttpHandler(...)`. Plugins must register explicit HTTP routes via `api.registerHttpRoute({ path, auth, match, handler })`, and dynamic webhook lifecycles should use `registerPluginHttpRoute(...)`. - **BREAKING:** Zalo Personal plugin (`@openclaw/zalouser`) no longer depends on external `zca`-compatible CLI binaries (`openzca`, `zca-cli`) for runtime send/listen/login; operators should use `openclaw channels login --channel zalouser` after upgrade to refresh sessions in the new JS-native path. ### Fixes - Plugin command/runtime hardening: validate and normalize plugin command name/description at registration boundaries, and guard Telegram native menu normalization paths so malformed plugin command specs cannot crash startup (`trim` on undefined). (#31997) Fixes #31944. Thanks @liuxiaopai-ai. - Telegram: guard duplicate-token checks and gateway startup token normalization when account tokens are missing, preventing `token.trim()` crashes during status/start flows. (#31973) Thanks @ningding97. - Discord/lifecycle startup status: push an immediate `connected` status snapshot when the gateway is already connected before lifecycle debug listeners attach, with abort-guarding to avoid contradictory status flips during pre-aborted startup. (#32336) Thanks @mitchmcalister. - Mentions/Slack formatting hardening: add null-safe guards for runtime text normalization paths so malformed/undefined text payloads do not crash mention stripping or mrkdwn conversion. (#31865) Thanks @stone-jin. - Feishu/Plugin sdk compatibility: add safe webhook default fallbacks when loading Feishu monitor state so mixed-version installs no longer crash if older `openclaw/plugin-sdk` builds omit webhook default constants. (#31606) - Feishu/group broadcast dispatch: add configurable multi-agent group broadcast dispatch with observer-session isolation, cross-account dedupe safeguards, and non-mention history buffering rules that avoid duplicate replay in broadcast/topic workflows. (#29575) Thanks @ohmyskyhigh. - Gateway/Subagent TLS pairing: allow authenticated local `gateway-client` backend self-connections to skip device pairing while still requiring pairing for non-local/direct-host paths, restoring `sessions_spawn` with `gateway.tls.enabled=true` in Docker/LAN setups. Fixes #30740. Thanks @Sid-Qin and @vincentkoc. - Browser/CDP startup diagnostics: include Chrome stderr output and a Linux no-sandbox hint in startup timeout errors so failed launches are easier to diagnose. (#29312) Thanks @veast. - Synology Chat/webhook ingress hardening: enforce bounded body reads (size + timeout) via shared request-body guards to prevent unauthenticated slow-body hangs before token validation. (#25831) Thanks @bmendonca3. - Feishu/Dedup restart resilience: warm persistent dedup state into memory on monitor startup so retry events after gateway restart stay suppressed without requiring initial on-disk probe misses. (#31605) - Voice-call/runtime lifecycle: prevent `EADDRINUSE` loops by resetting failed runtime promises, making webhook `start()` idempotent with the actual bound port, and fully cleaning up webhook/tunnel/tailscale resources after startup failures. (#32395) Thanks @scoootscooob. - Gateway/Security hardening: tie loopback-origin dev allowance to actual local socket clients (not Host header claims), add explicit warnings/metrics when `gateway.controlUi.dangerouslyAllowHostHeaderOriginFallback` accepts websocket origins, harden safe-regex detection for quantified ambiguous alternation patterns (for example `(a|aa)+`), and bound large regex-evaluation inputs for session-filter and log-redaction paths. - Gateway/Plugin HTTP hardening: require explicit `auth` for plugin route registration, add route ownership guards for duplicate `path+match` registrations, centralize plugin path matching/auth logic into dedicated modules, and share webhook target-route lifecycle wiring across channel monitors to avoid stale or conflicting registrations. Thanks @tdjackey for reporting. - Browser/Profile defaults: prefer `openclaw` profile over `chrome` in headless/no-sandbox environments unless an explicit `defaultProfile` is configured. (#14944) Thanks @BenediktSchackenberg. - Gateway/WS security: keep plaintext `ws://` loopback-only by default, with explicit break-glass private-network opt-in via `OPENCLAW_ALLOW_INSECURE_PRIVATE_WS=1`; align onboarding/client/call validation and tests to this strict-default policy. (#28670) Thanks @dashed, @vincentkoc. - OpenAI Codex OAuth/TLS prerequisites: add an OAuth TLS cert-chain preflight with actionable remediation for cert trust failures, and gate doctor TLS prerequisite probing to OpenAI Codex OAuth-configured installs (or explicit `doctor --deep`) to avoid unconditional outbound probe latency. (#32051) Thanks @alexfilatov. - Security/Webhook request hardening: enforce auth-before-body parsing for BlueBubbles and Google Chat webhook handlers, add strict pre-auth body/time budgets for webhook auth paths (including LINE signature verification), and add shared in-flight/request guardrails plus regression tests/lint checks to prevent reintroducing unauthenticated slow-body DoS patterns. Thanks @GCXWLP for reporting. - CLI/Config validation and routing hardening: dedupe `openclaw config validate` failures to a single authoritative report, expose allowed-values metadata/hints across core Zod and plugin AJV validation (including `--json` fields), sanitize terminal-rendered validation text, and make command-path parsing root-option-aware across preaction/route/lazy registration (including routed `config get/unset` with split root options). Thanks @gumadeiras. - Browser/Extension relay reconnect tolerance: keep `/json/version` and `/cdp` reachable during short MV3 worker disconnects when attached targets still exist, and retain clients across reconnect grace windows. (#30232) Thanks @Sid-Qin. - CLI/Browser start timeout: honor `openclaw browser --timeout <ms> start` and stop by removing the fixed 15000ms override so slower Chrome startups can use caller-provided timeouts. (#22412, #23427) Thanks @vincentkoc. - Synology Chat/gateway lifecycle: keep `startAccount` pending until abort for inactive and active account paths to prevent webhook route restart loops under gateway supervision. (#23074) Thanks @druide67. - Exec approvals/allowlist matching: escape regex metacharacters in path-pattern literals (while preserving glob wildcards), preventing crashes on allowlisted executables like `/usr/bin/g++` and correctly matching mixed wildcard/literal token paths. (#32162) Thanks @stakeswky. - Synology Chat/webhook compatibility: accept JSON and alias payload fields, allow token resolution from body/query/header sources, and ACK webhook requests with `204` to avoid persistent `Processing...` states in Synology Chat clients. (#26635) Thanks @memphislee09-source. - Voice-call/Twilio signature verification: retry signature validation across deterministic URL port variants (with/without port) to handle mixed Twilio signing behavior behind reverse proxies and non-standard ports. (#25140) Thanks @drvoss. - Slack/Bolt startup compatibility: remove invalid `message.channels` and `message.groups` event registrations so Slack providers no longer crash on startup with Bolt 4.6+; channel/group traffic continues through the unified `message` handler (`channel_type`). (#32033) Thanks @mahopan. - Slack/socket auth failure handling: fail fast on non-recoverable auth errors (`account_inactive`, `invalid_auth`, etc.) during startup and reconnect instead of retry-looping indefinitely, including `unable_to_socket_mode_start` error payload propagation. (#32377) Thanks @scoootscooob. - Gateway/macOS LaunchAgent hardening: write `Umask=077` in generated gateway LaunchAgent plists so npm upgrades preserve owner-only default file permissions for gateway-created state files. (#31919) Fixes #31905. Thanks @liuxiaopai-ai. - macOS/LaunchAgent security defaults: write `Umask=63` (octal `077`) into generated gateway launchd plists so post-update service reinstalls keep owner-only file permissions by default instead of falling back to system `022`. (#32022) Fixes #31905. Thanks @liuxiaopai-ai. - Media understanding/provider HTTP proxy routing: pass a proxy-aware fetch function from `HTTPS_PROXY`/`HTTP_PROXY` env vars into audio/video provider calls (with graceful malformed-proxy fallback) so transcription/video requests honor configured outbound proxies. (#27093) Thanks @mcaxtr. - Sandbox/workspace mount permissions: make primary `/workspace` bind mounts read-only whenever `workspaceAccess` is not `rw` (including `none`) across both core sandbox container and sandbox browser create flows. (#32227) Thanks @guanyu-zhang. - Tools/fsPolicy propagation: honor `tools.fs.workspaceOnly` for image/pdf local-root allowlists so non-sandbox media paths outside workspace are rejected when workspace-only mode is enabled. (#31882) Thanks @justinhuangcode. - Daemon/Homebrew runtime pinning: resolve Homebrew Cellar Node paths to stable Homebrew-managed symlinks (including versioned formulas like `node@22`) so gateway installs keep the intended runtime across brew upgrades. (#32185) Thanks @scoootscooob. - Browser/Security output boundary hardening: replace check-then-rename output commits with root-bound fd-verified writes, unify install/skills canonical path-boundary checks, and add regression coverage for symlink-rebind race paths across browser output and shared fs-safe write flows. Thanks @tdjackey for reporting. - Gateway/Security canonicalization hardening: decode plugin route path variants to canonical fixpoint (with bounded depth), fail closed on canonicalization anomalies, and enforce gateway auth for deeply encoded `/api/channels/*` variants to prevent alternate-path auth bypass through plugin handlers. Thanks @tdjackey for reporting. - Browser/Gateway hardening: preserve env credentials for `OPENCLAW_GATEWAY_URL` / `CLAWDBOT_GATEWAY_URL` while treating explicit `--url` as override-only auth, and make container browser hardening flags optional with safer defaults for Docker/LXC stability. (#31504) Thanks @vincentkoc. - Gateway/Control UI basePath webhook passthrough: let non-read methods under configured `controlUiBasePath` fall through to plugin routes (instead of returning Control UI 405), restoring webhook handlers behind basePath mounts. (#32311) Thanks @ademczuk. - Control UI/Legacy browser compatibility: replace `toSorted`-dependent cron suggestion sorting in `app-render` with a compatibility helper so older browsers without `Array.prototype.toSorted` no longer white-screen. (#31775) Thanks @liuxiaopai-ai. - macOS/PeekabooBridge: add compatibility socket symlinks for legacy `clawdbot`, `clawdis`, and `moltbot` Application Support socket paths so pre-rename clients can still connect. (#6033) Thanks @lumpinif and @vincentkoc. - Gateway/message tool reliability: avoid false `Unknown channel` failures when `message.*` actions receive platform-specific channel ids by falling back to `toolContext.currentChannelProvider`, and prevent health-monitor restart thrash for channels that just (re)started by adding a per-channel startup-connect grace window. (from #32367) Thanks @MunemHashmi. - Windows/Spawn canonicalization: unify non-core Windows spawn handling across ACP client, QMD/mcporter memory paths, and sandbox Docker execution using the shared wrapper-resolution policy, with targeted regression coverage for `.cmd` shim unwrapping and shell fallback behavior. (#31750) Thanks @Takhoffman. - Security/ACP sandbox inheritance: enforce fail-closed runtime guardrails for `sessions_spawn` with `runtime="acp"` by rejecting ACP spawns from sandboxed requester sessions and rejecting `sandbox="require"` for ACP runtime, preventing sandbox-boundary bypass via host-side ACP initialization. (#32254) Thanks @tdjackey for reporting, and @dutifulbob for the fix. - Security/Web tools SSRF guard: keep DNS pinning for untrusted `web_fetch` and citation-redirect URL checks when proxy env vars are set, and require explicit dangerous opt-in before env-proxy routing can bypass pinned dispatch for trusted/operator-controlled endpoints. Thanks @tdjackey for reporting. - Gemini schema sanitization: coerce malformed JSON Schema `properties` values (`null`, arrays, primitives) to `{}` before provider validation, preventing downstream strict-validator crashes on invalid plugin/tool schemas. (#32332) Thanks @webdevtodayjason. - Media understanding/malformed attachment guards: harden attachment selection and decision summary formatting against non-array or malformed attachment payloads to prevent runtime crashes on invalid inbound metadata shapes. (#28024) Thanks @claw9267. - Browser/Extension navigation reattach: preserve debugger re-attachment when relay is temporarily disconnected by deferring relay attach events until reconnect/re-announce, reducing post-navigation tab loss. (#28725) Thanks @stone-jin. - Browser/Extension relay stale tabs: evict stale cached targets from `/json/list` when extension targets are destroyed/crashed or commands fail with missing target/session errors. (#6175) Thanks @vincentkoc. - Browser/CDP startup readiness: wait for CDP websocket readiness after launching Chrome and cleanly stop/reset when readiness never arrives, reducing follow-up `PortInUseError` races after `browser start`/`open`. (#29538) Thanks @AaronWander. - OpenAI/Responses WebSocket tool-call id hygiene: normalize blank/whitespace streamed tool-call ids before persistence, and block empty `function_call_output.call_id` payloads in the WS conversion path to avoid OpenAI 400 errors (`Invalid 'input[n].call_id': empty string`), with regression coverage for both inbound stream normalization and outbound payload guards. - Security/Nodes camera URL downloads: bind node `camera.snap`/`camera.clip` URL payload downloads to the resolved node host, enforce fail-closed behavior when node `remoteIp` is unavailable, and use SSRF-guarded fetch with redirect host/protocol checks to prevent off-node fetch pivots. Thanks @tdjackey for reporting. - Config/backups hardening: enforce owner-only (`0600`) permissions on rotated config backups and clean orphan `.bak.*` files outside the managed backup ring, reducing credential leakage risk from stale or permissive backup artifacts. (#31718) Thanks @YUJIE2002. - Telegram/inbound media filenames: preserve original `file_name` metadata for document/audio/video/animation downloads (with fetch/path fallbacks), so saved inbound attachments keep sender-provided names instead of opaque Telegram file paths. (#31837) Thanks @Kay-051. - Gateway/OpenAI chat completions: honor `x-openclaw-message-channel` when building `agentCommand` input for `/v1/chat/completions`, preserving caller channel identity instead of forcing `webchat`. (#30462) Thanks @bmendonca3. - Plugin SDK/runtime hardening: add package export verification in CI/release checks to catch missing runtime exports before publish-time regressions. (#28575) Thanks @Glucksberg. - Media/MIME normalization: normalize parameterized/case-variant MIME strings in `kindFromMime` (for example `Audio/Ogg; codecs=opus`) so WhatsApp voice notes are classified as audio and routed through transcription correctly. (#32280) Thanks @Lucenx9. - Discord/audio preflight mentions: detect audio attachments via Discord `content_type` and gate preflight transcription on typed text (not media placeholders), so guild voice-note mentions are transcribed and matched correctly. (#32136) Thanks @jnMetaCode. - Feishu/topic session routing: use `thread_id` as topic session scope fallback when `root_id` is absent, keep first-turn topic keys stable across thread creation, and force thread replies when inbound events already carry topic/thread context. (#29788) Thanks @songyaolun. - Gateway/Webchat NO_REPLY streaming: suppress assistant lead-fragment deltas that are prefixes of `NO_REPLY` and keep final-message buffering in sync, preventing partial `NO` leaks on silent-response runs while preserving legitimate short replies. (#32073) Thanks @liuxiaopai-ai. - Telegram/models picker callbacks: keep long model buttons selectable by falling back to compact callback payloads and resolving provider ids on selection (with provider re-prompt on ambiguity), avoiding Telegram 64-byte callback truncation failures. (#31857) Thanks @bmendonca3. - Context-window metadata warmup: add exponential config-load retry backoff (1s -> 2s -> 4s, capped at 60s) so transient startup failures recover automatically without hot-loop retries. - Voice-call/Twilio external outbound: auto-register webhook-first `outbound-api` calls (initiated outside OpenClaw) so media streams are accepted and call direction metadata stays accurate. (#31181) Thanks @scoootscooob. - Feishu/topic root replies: prefer `root_id` as outbound `replyTargetMessageId` when present, and parse millisecond `message_create_time` values correctly so topic replies anchor to the root message in grouped thread flows. (#29968) Thanks @bmendonca3. - Feishu/DM pairing reply target: send pairing challenge replies to `chat:<chat_id>` instead of `user:<sender_open_id>` so Lark/Feishu private chats with user-id-only sender payloads receive pairing messages reliably. (#31403) Thanks @stakeswky. - Feishu/Lark private DM routing: treat inbound `chat_type: "private"` as direct-message context for pairing/mention-forward/reaction synthetic handling so Lark private chats behave like Feishu p2p DMs. (#31400) Thanks @stakeswky. - Signal/message actions: allow `react` to fall back to `toolContext.currentMessageId` when `messageId` is omitted, matching Telegram behavior and unblocking agent-initiated reactions on inbound turns. (#32217) Thanks @dunamismax. - Discord/message actions: allow `react` to fall back to `toolContext.currentMessageId` when `messageId` is omitted, matching Telegram/Signal reaction ergonomics in inbound turns. - Synology Chat/reply delivery: resolve webhook usernames to Chat API `user_id` values for outbound chatbot replies, avoiding mismatches between webhook user IDs and `method=chatbot` recipient IDs in multi-account setups. (#23709) Thanks @druide67. - Slack/thread context payloads: only inject thread starter/history text on first thread turn for new sessions while preserving thread metadata, reducing repeated context-token bloat on long-lived thread sessions. (#32133) Thanks @sourman. - Slack/session routing: keep top-level channel messages in one shared session when `replyToMode=off`, while preserving thread-scoped keys for true thread replies and non-off modes. (#32193) Thanks @bmendonca3. - Voice-call/webhook routing: require exact webhook path matches (instead of prefix matches) so lookalike paths cannot reach provider verification/dispatch logic. (#31930) Thanks @afurm. - Zalo/Pairing auth tests: add webhook regression coverage asserting DM pairing-store reads/writes remain account-scoped, preventing cross-account authorization bleed in multi-account setups. (#26121) Thanks @bmendonca3. - Zalouser/Pairing auth tests: add account-scoped DM pairing-store regression coverage (`monitor.account-scope.test.ts`) to prevent cross-account allowlist bleed in multi-account setups. (#26672) Thanks @bmendonca3. - Feishu/Send target prefixes: normalize explicit `group:`/`dm:` send targets and preserve explicit receive-id routing hints when resolving outbound Feishu targets. (#31594) Thanks @liuxiaopai-ai. - Webchat/Feishu session continuation: preserve routable `OriginatingChannel`/`OriginatingTo` metadata from session delivery context in `chat.send`, and prefer provider-normalized channel when deciding cross-channel route dispatch so Webchat replies continue on the selected Feishu session instead of falling back to main/internal session routing. (#31573) - Telegram/implicit mention forum handling: exclude Telegram forum system service messages (`forum_topic_*`, `general_forum_topic_*`) from reply-chain implicit mention detection so `requireMention` does not get bypassed inside bot-created topic lifecycle events. (#32262) Thanks @scoootscooob. - Slack/inbound debounce routing: isolate top-level non-DM message debounce keys by message timestamp to avoid cross-thread collisions, preserve DM batching, and flush pending top-level buffers before immediate non-debounce follow-ups to keep ordering stable. (#31951) Thanks @scoootscooob. - Feishu/Duplicate replies: suppress same-target reply dispatch when message-tool sends use generic provider metadata (`provider: "message"`) and normalize `lark`/`feishu` provider aliases during duplicate-target checks, preventing double-delivery in Feishu sessions. (#31526) - Webchat/silent token leak: filter assistant `NO_REPLY`-only transcript entries from `chat.history` responses and add client-side defense-in-depth guards in the chat controller so internal silent tokens never render as visible chat bubbles. (#32015) Consolidates overlap from #32183, #32082, #32045, #32052, #32172, and #32112. Thanks @ademczuk, @liuxiaopai-ai, @ningding97, @bmendonca3, and @x4v13r1120. - Doctor/local memory provider checks: stop false-positive local-provider warnings when `provider=local` and no explicit `modelPath` is set by honoring default local model fallback while still warning when gateway probe reports local embeddings not ready. (#32014) Fixes #31998. Thanks @adhishthite. - Media understanding/parakeet CLI output parsing: read `parakeet-mlx` transcripts from `--output-dir/<media-basename>.txt` when txt output is requested (or default), with stdout fallback for non-txt formats. (#9177) Thanks @mac-110. - Media understanding/audio transcription guard: skip tiny/empty audio files (<1024 bytes) before provider/CLI transcription to avoid noisy invalid-audio failures and preserve clean fallback behavior. (#8388) Thanks @Glucksberg. - Gateway/Plugin HTTP route precedence: run explicit plugin HTTP routes before the Control UI SPA catch-all so registered plugin webhook/custom paths remain reachable, while unmatched paths still fall through to Control UI handling. (#31885) Thanks @Sid-Qin. - Gateway/Node browser proxy routing: honor `profile` from `browser.request` JSON body when query params omit it, while preserving query-profile precedence when both are present. (#28852) Thanks @Sid-Qin. - Gateway/Control UI basePath POST handling: return 405 for `POST` on exact basePath routes (for example `/openclaw`) instead of redirecting, and add end-to-end regression coverage that root-mounted webhook POST paths still pass through to plugin handlers. (#31349) Thanks @Sid-Qin. - Browser/default profile selection: default `browser.defaultProfile` behavior now prefers `openclaw` (managed standalone CDP) when no explicit default is configured, while still auto-provisioning the `chrome` relay profile for explicit opt-in use. (#32031) Fixes #31907. Thanks @liuxiaopai-ai. - Sandbox/mkdirp boundary checks: allow existing in-boundary directories to pass mkdirp boundary validation when directory open probes return platform-specific I/O errors, with regression coverage for directory-safe fallback behavior. (#31547) Thanks @stakeswky. - Models/config env propagation: apply `config.env.vars` before implicit provider discovery in models bootstrap so config-scoped credentials are visible to implicit provider resolution paths. (#32295) Thanks @hsiaoa. - Models/Codex usage labels: infer weekly secondary usage windows from reset cadence when API window seconds are ambiguously reported as 24h, so `openclaw models status` no longer mislabels weekly limits as daily. (#31938) Thanks @bmendonca3. - Gateway/Heartbeat model reload: treat `models.*` and `agents.defaults.model` config updates as heartbeat hot-reload triggers so heartbeat picks up model changes without a full gateway restart. (#32046) Thanks @stakeswky. - Memory/LanceDB embeddings: forward configured `embedding.dimensions` into OpenAI embeddings requests so vector size and API output dimensions stay aligned when dimensions are explicitly configured. (#32036) Thanks @scotthuang. - Gateway/Control UI method guard: allow POST requests to non-UI routes to fall through when no base path is configured, and add POST regression coverage for fallthrough and base-path 405 behavior. (#23970) Thanks @tyler6204. - Browser/CDP status accuracy: require a successful `Browser.getVersion` response over the CDP websocket (not just socket-open) before reporting `cdpReady`, so stale idle command channels are surfaced as unhealthy. (#23427) Thanks @vincentkoc. - Daemon/systemd checks in containers: treat missing `systemctl` invocations (including `spawn systemctl ENOENT`/`EACCES`) as unavailable service state during `is-enabled` checks, preventing container flows from failing with `Gateway service check failed` before install/status handling can continue. (#26089) Thanks @sahilsatralkar and @vincentkoc. - Security/Node exec approvals: revalidate approval-bound `cwd` identity immediately before execution/forwarding and fail closed with an explicit denial when `cwd` drifts after approval hardening. - Security audit/skills workspace hardening: add `skills.workspace.symlink_escape` warning in `openclaw security audit` when workspace `skills/**/SKILL.md` resolves outside the workspace root (for example symlink-chain drift), plus docs coverage in the security glossary. - Security/Node exec approvals: preserve shell/dispatch-wrapper argv semantics during approval hardening so approved wrapper commands (for example `env sh -c ...`) cannot drift into a different runtime command shape, and add regression coverage for both approval-plan generation and approved runtime execution paths. Thanks @tdjackey for reporting. - Security/fs-safe write hardening: make `writeFileWithinRoot` use same-directory temp writes plus atomic rename, add post-write inode/hardlink revalidation with security warnings on boundary drift, and avoid truncating existing targets when final rename fails. - Security/Skills archive extraction: unify tar extraction safety checks across tar.gz and tar.bz2 install flows, enforce tar compressed-size limits, and fail closed if tar.bz2 archives change between preflight and extraction to prevent bypasses of entry-type/size guardrails. Thanks @GCXWLP for reporting. - Security/Prompt spoofing hardening: stop injecting queued runtime events into user-role prompt text, route them through trusted system-prompt context, and neutralize inbound spoof markers like `[System Message]` and line-leading `System:` in untrusted message content. (#30448) - Sandbox/Docker setup command parsing: accept `agents.*.sandbox.docker.setupCommand` as either a string or a string array, and normalize arrays to newline-delimited shell scripts so multi-step setup commands no longer concatenate without separators. (#31953) Thanks @liuxiaopai-ai. - Sandbox/Bootstrap context boundary hardening: reject symlink/hardlink alias bootstrap seed files that resolve outside the source workspace and switch post-compaction `AGENTS.md` context reads to boundary-verified file opens, preventing host file content from being injected via workspace aliasing. Thanks @tdjackey for reporting. - Agents/Sandbox workdir mapping: map container workdir paths (for example `/workspace`) back to the host workspace before sandbox path validation so exec requests keep the intended directory in containerized runs instead of falling back to an unavailable host path. (#31841) Thanks @liuxiaopai-ai. - Docker/Sandbox bootstrap hardening: make `OPENCLAW_SANDBOX` opt-in parsing explicit (`1|true|yes|on`), support custom Docker socket paths via `OPENCLAW_DOCKER_SOCKET`, defer docker.sock exposure until sandbox prerequisites pass, and reset/roll back persisted sandbox mode to `off` when setup is skipped or partially fails to avoid stale broken sandbox state. (#29974) Thanks @jamtujest and @vincentkoc. - Hooks/webhook ACK compatibility: return `200` (instead of `202`) for successful `/hooks/agent` requests so providers that require `200` (for example Forward Email) accept dispatched agent hook deliveries. (#28204) Thanks @Glucksberg. - Feishu/Run channel fallback: prefer `Provider` over `Surface` when inferring queued run `messageProvider` fallback (when `OriginatingChannel` is missing), preventing Feishu turns from being mislabeled as `webchat` in mixed relay metadata contexts. (#31880) Fixes #31859. Thanks @liuxiaopai-ai. - Skills/sherpa-onnx-tts: run the `sherpa-onnx-tts` bin under ESM (replace CommonJS `require` imports) and add regression coverage to prevent `require is not defined in ES module scope` startup crashes. (#31965) Thanks @bmendonca3. - Inbound metadata/direct relay context: restore direct-channel conversation metadata blocks for external channels (for example WhatsApp) while preserving webchat-direct suppression, so relay agents recover sender/message identifiers without reintroducing internal webchat metadata noise. (#31969) Fixes #29972. Thanks @Lucenx9. - Slack/Channel message subscriptions: register explicit `message.channels` and `message.groups` monitor handlers (alongside generic `message`) so channel/group event subscriptions are consumed even when Slack dispatches typed message event names. Fixes #31674. - Hooks/session-scoped memory context: expose ephemeral `sessionId` in embedded plugin tool contexts and `before_tool_call`/`after_tool_call` hook contexts (including compaction and client-tool wiring) so plugins can isolate per-conversation state across `/new` and `/reset`. Related #31253 and #31304. Thanks @Sid-Qin and @Servo-AIpex. - Voice-call/Twilio inbound greeting: run answered-call initial notify greeting for Twilio instead of skipping the manager speak path, with regression coverage for both Twilio and Plivo notify flows. (#29121) Thanks @xinhuagu. - Voice-call/stale call hydration: verify active calls with the provider before loading persisted in-progress calls so stale locally persisted records do not block or misroute new call handling after restarts. (#4325) Thanks @garnetlyx. - Feishu/File upload filenames: percent-encode non-ASCII/special-character `file_name` values in Feishu multipart uploads so Chinese/symbol-heavy filenames are sent as proper attachments instead of plain text links. (#31179) Thanks @Kay-051. - Media/MIME channel parity: route Telegram/Signal/iMessage media-kind checks through normalized `kindFromMime` so mixed-case/parameterized MIME values classify consistently across message channels. - WhatsApp/inbound self-message context: propagate inbound `fromMe` through the web inbox pipeline and annotate direct self messages as `(self)` in envelopes so agents can distinguish owner-authored turns from contact turns. (#32167) Thanks @scoootscooob. - Webchat/stream finalization: persist streamed assistant text when final events omit `message`, while keeping final payload precedence and skipping empty stream buffers to prevent disappearing replies after tool turns. (#31920) Thanks @Sid-Qin. - Feishu/Inbound ordering: serialize message handling per chat while preserving cross-chat concurrency to avoid same-chat race drops under bursty inbound traffic. (#31807) - Feishu/Typing notification suppression: skip typing keepalive reaction re-adds when the indicator is already active, preventing duplicate notification pings from repeated identical emoji adds. (#31580) - Feishu/Probe failure backoff: cache API and timeout probe failures for one minute per account key while preserving abort-aware probe timeouts, reducing repeated health-check retries during transient credential/network outages. (#29970) - Feishu/Streaming block fallback: preserve markdown block stream text as final streaming-card content when final payload text is missing, while still suppressing non-card internal block chunk delivery. (#30663) - Feishu/Bitable API errors: unify Feishu Bitable tool error handling with structured `LarkApiError` responses and consistent API/context attribution across wiki/base metadata, field, and record operations. (#31450) - BlueBubbles/Message metadata: harden send response ID extraction, include sender identity in DM context, and normalize inbound `message_id` selection to avoid duplicate ID metadata. (#23970) Thanks @tyler6204. - WebChat/markdown tables: ensure GitHub-flavored markdown table parsing is explicitly enabled at render time and add horizontal overflow handling for wide tables, with regression coverage for table-only and mixed text+table content. (#32365) Thanks @BlueBirdBack. - Feishu/default account resolution: always honor explicit `channels.feishu.defaultAccount` during outbound account selection (including top-level-credential setups where the preferred id is not present in `accounts`), instead of silently falling back to another account id. (#32253) Thanks @bmendonca3. - Feishu/Sender lookup permissions: suppress user-facing grant prompts for stale non-existent scope errors (`contact:contact.base:readonly`) during best-effort sender-name resolution so inbound messages continue without repeated false permission notices. (#31761) - Discord/dispatch + Slack formatting: restore parallel outbound dispatch across Discord channels with per-channel queues while preserving in-channel ordering, and run Slack preview/stream update text through mrkdwn normalization for consistent formatting. (#31927) Thanks @Sid-Qin. - Feishu/Inbound debounce: debounce rapid same-chat sender bursts into one ordered dispatch turn, skip already-processed retries when composing merged text, and preserve bot-mention intent across merged entries to reduce duplicate or late inbound handling. (#31548) - Tests/Sandbox + archive portability: use junction-compatible directory-link setup on Windows and explicit file-symlink platform guards in symlink escape tests where unprivileged file symlinks are unavailable, reducing false Windows CI failures while preserving traversal checks on supported paths. (#28747) Thanks @arosstale. - Browser/Extension re-announce reliability: keep relay state in `connecting` when re-announce forwarding fails and extend debugger re-attach retries after navigation to reduce false attached states and post-nav disconnect loops. (#27630) Thanks @markmusson. - Browser/Act request compatibility: accept legacy flattened `action="act"` params (`kind/ref/text/...`) in addition to `request={...}` so browser act calls no longer fail with `request required`. (#15120) Thanks @vincentkoc. - OpenRouter/x-ai compatibility: skip `reasoning.effort` injection for `x-ai/*` models (for example Grok) so OpenRouter requests no longer fail with invalid-arguments errors on unsupported reasoning params. (#32054) Thanks @scoootscooob. - Models/openai-completions developer-role compatibility: force `supportsDeveloperRole=false` for non-native endpoints, treat unparseable `baseUrl` values as non-native, and add regression coverage for empty/malformed baseUrl plus explicit-true override behavior. (#29479) thanks @akramcodez. - Browser/Profile attach-only override: support `browser.profiles.<name>.attachOnly` (fallback to global `browser.attachOnly`) so loopback proxy profiles can skip local launch/port-ownership checks without forcing attach-only mode for every profile. (#20595) Thanks @unblockedgamesstudio and @vincentkoc. - Sessions/Lock recovery: detect recycled Linux PIDs by comparing lock-file `starttime` with `/proc/<pid>/stat` starttime, so stale `.jsonl.lock` files are reclaimed immediately in containerized PID-reuse scenarios while preserving compatibility for older lock files. (#26443) Fixes #27252. Thanks @HirokiKobayashi-R and @vincentkoc. - Cron/isolated delivery target fallback: remove early unresolved-target return so cron delivery can flow through shared outbound target resolution (including per-channel `resolveDefaultTo` fallback) when `delivery.to` is omitted. (#32364) Thanks @hclsys. - OpenAI media capabilities: include `audio` in the OpenAI provider capability list so audio transcription models are eligible in media-understanding provider selection. (#12717) Thanks @openjay. - Browser/Managed tab cap: limit loopback managed `openclaw` page tabs to 8 via best-effort cleanup after tab opens to reduce long-running renderer buildup while preserving attach-only and remote profile behavior. (#29724) Thanks @pandego. - Docker/Image health checks: add Dockerfile `HEALTHCHECK` that probes gateway `GET /healthz` so container runtimes can mark unhealthy instances without requiring auth credentials in the probe command. (#11478) Thanks @U-C4N and @vincentkoc. - Gateway/Node dangerous-command parity: include `sms.send` in default onboarding node `denyCommands`, share onboarding deny defaults with the gateway dangerous-command source of truth, and include `sms.send` in phone-control `/phone arm writes` handling so SMS follows the same break-glass flow as other dangerous node commands. Thanks @zpbrent. - Pairing/AllowFrom account fallback: handle omitted `accountId` values in `readChannelAllowFromStore` and `readChannelAllowFromStoreSync` as `default`, while preserving legacy unscoped allowFrom merges for default-account flows. Thanks @Sid-Qin and @vincentkoc. - Browser/Remote CDP ownership checks: skip local-process ownership errors for non-loopback remote CDP profiles when HTTP is reachable but the websocket handshake fails, and surface the remote websocket attach/retry path instead. (#15582) Landed from contributor (#28780) Thanks @stubbi, @bsormagec, @unblockedgamesstudio and @vincentkoc. - Browser/CDP proxy bypass: force direct loopback agent paths and scoped `NO_PROXY` expansion for localhost CDP HTTP/WS connections when proxy env vars are set, so browser relay/control still works behind global proxy settings. (#31469) Thanks @widingmarcus-cyber. - Sessions/idle reset correctness: preserve existing `updatedAt` during inbound metadata-only writes so idle-reset boundaries are not unintentionally refreshed before actual user turns. (#32379) Thanks @romeodiaz. - Sessions/lock recovery: reclaim orphan legacy same-PID lock files missing `starttime` when no in-process lock ownership exists, avoiding false lock timeouts after PID reuse while preserving active lock safety checks. (#32081) Thanks @bmendonca3. - Sessions/store cache invalidation: reload cached session stores when file size changes within the same mtime tick by keying cache validation on a single file-stat snapshot (`mtimeMs` + `sizeBytes`), with regression coverage for same-tick rewrites. (#32191) Thanks @jalehman. - Agents/Subagents `sessions_spawn`: reject malformed `agentId` inputs before normalization (for example error-message/path-like strings) to prevent unintended synthetic agent IDs and ghost workspace/session paths; includes strict validation regression coverage. (#31381) Thanks @openperf. - CLI/installer Node preflight: enforce Node.js `v22.12+` consistently in both `openclaw.mjs` runtime bootstrap and installer active-shell checks, with actionable nvm recovery guidance for mismatched shell PATH/defaults. (#32356) Thanks @jasonhargrove. - Web UI/config form: support SecretInput string-or-secret-ref unions in map `additionalProperties`, so provider API key fields stay editable instead of being marked unsupported. (#31866) Thanks @ningding97. - Auto-reply/inline command cleanup: preserve newline structure when stripping inline `/status` and extracting inline slash commands by collapsing only horizontal whitespace, preventing paragraph flattening in multi-line replies. (#32224) Thanks @scoootscooob. - Config/raw redaction safety: preserve non-sensitive literals during raw redaction round-trips, scope SecretRef redaction to secret IDs (not structural fields like `source`/`provider`), and fall back to structured raw redaction when text replacement cannot restore the original config shape. (#32174) Thanks @bmendonca3. - Hooks/runtime stability: keep the internal hook handler registry on a `globalThis` singleton so hook registration/dispatch remains consistent when bundling emits duplicate module copies. (#32292) Thanks @Drickon. - Hooks/after_tool_call: include embedded session context (`sessionKey`, `agentId`) and fire the hook exactly once per tool execution by removing duplicate adapter-path dispatch in embedded runs. (#32201) Thanks @jbeno, @scoootscooob, @vincentkoc. - Hooks/tool-call correlation: include `runId` and `toolCallId` in plugin tool hook payloads/context and scope tool start/adjusted-param tracking by run to prevent cross-run collisions in `before_tool_call` and `after_tool_call`. (#32360) Thanks @vincentkoc. - Plugins/install diagnostics: reject legacy plugin package shapes without `openclaw.extensions` and return an explicit upgrade hint with troubleshooting docs for repackaging. (#32055) Thanks @liuxiaopai-ai. - Hooks/plugin context parity: ensure `llm_input` hooks in embedded attempts receive the same `trigger` and `channelId`-aware `hookCtx` used by the other hook phases, preserving channel/trigger-scoped plugin behavior. (#28623) Thanks @davidrudduck and @vincentkoc. - Plugins/hardlink install compatibility: allow bundled plugin manifests and entry files to load when installed via hardlink-based package managers (`pnpm`, `bun`) while keeping hardlink rejection enabled for non-bundled plugin sources. (#32119) Fixes #28175, #28404, #29455. Thanks @markfietje. - Cron/session reaper reliability: move cron session reaper sweeps into `onTimer` `finally` and keep pruning active even when timer ticks fail early (for example cron store parse failures), preventing stale isolated run sessions from accumulating indefinitely. (#31996) Fixes #31946. Thanks @scoootscooob. - Cron/HEARTBEAT_OK summary leak: suppress fallback main-session enqueue for heartbeat/internal ack summaries in isolated announce mode so `HEARTBEAT_OK` noise never appears in user chat while real summaries still forward. (#32093) Thanks @scoootscooob. - Authentication: classify `permission_error` as `auth_permanent` for profile fallback. (#31324) Thanks @Sid-Qin. - Agents/host edit reliability: treat host edit-tool throws as success only when on-disk post-check confirms replacement likely happened (`newText` present and `oldText` absent), preventing false failure reports while avoiding pre-write false positives. (#32383) Thanks @polooooo. - Plugins/install fallback safety: resolve bare install specs to bundled plugin ids before npm lookup (for example `diffs` -> bundled `@openclaw/diffs`), keep npm fallback limited to true package-not-found errors, and continue rejecting non-plugin npm packages that fail manifest validation. (#32096) Thanks @scoootscooob. - Web UI/inline code copy fidelity: disable forced mid-token wraps on inline `<code>` spans so copied UUID/hash/token strings preserve exact content instead of inserting line-break spaces. (#32346) Thanks @hclsys. - Restart sentinel formatting: avoid duplicate `Reason:` lines when restart message text already matches `stats.reason`, keeping restart notifications concise for users and downstream parsers. (#32083) Thanks @velamints2. - Auto-reply/followup queue: avoid stale callback reuse across idle-window restarts by caching the followup runner only when a drain actually starts, preserving enqueue ordering after empty-finalize paths. (#31902) Thanks @Lanfei. - Agents/tool-result guard: always clear pending tool-call state on interruptions even when synthetic tool results are disabled, preventing orphaned tool-use transcripts that cause follow-up provider request failures. (#32120) Thanks @jnMetaCode. - Failover/error classification: treat HTTP `529` (provider overloaded, common with Anthropic-compatible APIs) as `rate_limit` so model failover can engage instead of misclassifying the error path. (#31854) Thanks @bugkill3r. - Logging: use local time for logged timestamps instead of UTC, aligning log output with documented local timezone behavior and avoiding confusion during local diagnostics. (#28434) Thanks @liuy. - Agents/Subagent announce cleanup: keep completion-message runs pending while descendants settle, add a 30 minute hard-expiry backstop to avoid indefinite pending state, and keep retry bookkeeping resumable across deferred wakes. (#23970) Thanks @tyler6204. - Secrets/exec resolver timeout defaults: use provider `timeoutMs` as the default inactivity (`noOutputTimeoutMs`) watchdog for exec secret providers, preventing premature no-output kills for resolvers that start producing output after 2s. (#32235) Thanks @bmendonca3. - Auto-reply/reminder guard note suppression: when a turn makes reminder-like commitments but schedules no new cron jobs, suppress the unscheduled-reminder warning note only if an enabled cron already exists for the same session; keep warnings for unrelated sessions, disabled jobs, or unreadable cron store paths. (#32255) Thanks @scoootscooob. - Cron/isolated announce heartbeat suppression: treat multi-payload runs as skippable when any payload is a heartbeat ack token and no payload has media, preventing internal narration + trailing `HEARTBEAT_OK` from being delivered to users. (#32131) Thanks @adhishthite. - Cron/store migration: normalize legacy cron jobs with string `schedule` and top-level `command`/`timeout` fields into canonical schedule/payload/session-target shape on load, preventing schedule-error loops on old persisted stores. (#31926) Thanks @bmendonca3. - Tests/Windows backup rotation: skip chmod-only backup permission assertions on Windows while retaining compose/rotation/prune coverage across platforms to avoid false CI failures from Windows non-POSIX mode semantics. (#32286) Thanks @jalehman. - Tests/Subagent announce: set `OPENCLAW_TEST_FAST=1` before importing `subagent-announce` format suites so module-level fast-mode constants are captured deterministically on Windows CI, preventing timeout flakes in nested completion announce coverage. (#31370) Thanks @zwffff.

OpenClaw v2026.3.2-beta.1 预发布