OpenClaw v2026.3.2 - 更新日志

### 变更 - **Secrets/SecretRef 覆盖范围**：将 SecretRef 支持扩展到所有用户提供的凭证表面（共 64 个目标），包括运行时收集器、`openclaw secrets` 的规划/应用/审计流程、SecretInput 用户引导以及相关文档；未解析的引用在活动表面上快速失败，而在非活动表面上报告非阻塞诊断信息。(#29580) 感谢 @joshavant。 - **工具/PDF 分析**：新增一级 `pdf` 工具，原生支持 Anthropic 和 Google PDF 提供商，并为非原生模型提供提取回退；支持可配置默认值（`agents.defaults.pdfModel`、`pdfMaxBytesMb`、`pdfMaxPages`）；包含涵盖路由、验证和注册的文档与测试。(#31319) 感谢 @tyler6204。 - **出站适配器/插件**：在直接文本媒体、Discord、Slack、WhatsApp、Zalo 和 Zalouser 中新增共享 `sendPayload` 支持，具备多媒体迭代和分块感知文本回退功能。(#30144) 感谢 @nohat。 - **模型/MiniMax**：在内置提供商目录、引导流程和 MiniMax OAuth 插件默认设置中新增对 `MiniMax-M2.5-highspeed` 的一级支持，同时保持对现有配置中遗留的 `MiniMax-M2.5-Lightning` 的兼容性。 - **会话/附件**：为 `sessions_spawn`（仅限子代理运行时）新增内联文件附件支持，采用 base64/utf8 编码，支持转录内容脱敏、生命周期清理，以及通过 `tools.sessions_spawn.attachments` 进行可配置限制。(#16761) 感谢 @napetrov。 - **Telegram/流式传输默认值**：将 `channels.telegram.streaming` 的默认值从 `off` 改为 `partial`，使新的 Telegram 设置开箱即用即可获得实时预览流式传输；当原生草稿不可用时，运行时回退到消息编辑预览。 - **Telegram/私信流式传输**：在私信预览流式传输中使用 `sendMessageDraft`；在 DM 推理流模式下，保持推理/答案预览通道分离。(#31824) 感谢 @obviyus。 - **Telegram/语音提及控制**：在群组/主题配置中新增可选的 `disableAudioPreflight`，以跳过 inbound 语音笔记的提及检测预检转录，当操作员希望仅进行文本提及检查时适用。(#23067) 感谢 @yangnim21029。 - **CLI/配置验证**：新增 `openclaw config validate`（带 `--json` 选项），用于在网关启动前验证配置文件，并在启动时的无效配置错误中包含详细的无效键路径信息。(#31220) 感谢 @Sid-Qin。 - **工具/差异**：为生成的差异产物新增 PDF 文件输出支持及渲染质量自定义控件（`fileQuality`、`fileScale`、`fileMaxWidth`）；文档说明当消息通道压缩图像时，PDF 是首选选项。(#31342) 感谢 @gumadeiras。 - **内存/Ollama 嵌入**：新增 `memorySearch.provider = "ollama"` 和 `memorySearch.fallback = "ollama"` 支持；在内存嵌入请求中遵循 `models.providers.ollama` 设置；并记录了 Ollama 嵌入用法。(#26349) 感谢 @nico-hoff。 - **Zalo 个人插件 (`@openclaw/zalouser`)**：重建通道运行时以使用进程内原生的 `zca-js` 集成，移除了外部 CLI 传输的使用，并将 QR/登录 + 发送/监听流程完全保留在 OpenClaw 内部。 - **插件 SDK/通道可扩展性**：在 `ChannelGatewayContext` 上公开 `channelRuntime`，以便外部通道插件无需内部导入即可访问共享运行时辅助功能（回复/路由/会话/文本/媒体/命令）。(#25462) 感谢 @guxiaobo。 - **插件运行时/STT**：新增 `api.runtime.stt.transcribeAudioFile(...)`，使扩展可以通过 OpenClaw 配置的媒体理解音频提供商转录本地音频文件。(#22402) 感谢 @benthecarman。 - **插件钩子/会话生命周期**：在 `session_start`/`session_end` 钩子事件和上下文中包含 `sessionKey`，以便插件可以将生命周期回调与路由身份关联起来。(#26394) 感谢 @tempeste。 - **钩子/消息生命周期**：新增内部钩子事件 `message:transcribed` 和 `message:preprocessed`；为出站 `message:sent` 上下文提供更丰富的信息（`isGroup`、`groupId`），用于群组会话关联和转录后自动化。(#9859) 感谢 @Drickon。 - **媒体理解/音频回显**：新增可选的 `tools.media.audio.echoTranscript` + `echoFormat`，用于向原始聊天发送预代理转录确认消息；默认禁用回显。(#32150) 感谢 @AytuncYildizli。 - **插件运行时/系统**：公开 `runtime.system.requestHeartbeatNow(...)`，使扩展可以在入队系统事件后立即唤醒目标会话。(#19464) 感谢 @AustinEral。 - **插件运行时/事件**：公开 `runtime.events.onAgentEvent` 和 `runtime.events.onSessionTranscriptUpdate` 以供扩展端订阅；隔离转录监听器故障，防止一个有缺陷的监听器破坏整个更新扇出。(#16044) 感谢 @scifantastic。 - **CLI/启动横幅标语**：新增 `cli.banner.taglineMode`（`random` | `default` | `off`）以控制启动输出中有趣的标语行为，并提供文档 + FAQ 指南以及配置覆盖行为的回归测试。 ### 破坏性变更 - **破坏性变更：** 引导现在对新本地安装（交互式和非交互式）默认将 `tools.profile` 设置为 `messaging`。新设置不再默认启动广泛的编码/系统工具，除非明确配置。 - **破坏性变更：** ACP 调度现在默认启用，除非明确禁用（`acp.dispatch.enabled=false`）。如果需要暂停 ACP 转接路由但保留 `/acp` 控制，请设置 `acp.dispatch.enabled=false`。文档：https://docs.openclaw.ai/tools/acp-agents - **破坏性变更：** 插件 SDK 移除了 `api.registerHttpHandler(...)`。插件必须通过 `api.registerHttpRoute({ path, auth, match, handler })` 注册显式 HTTP 路由，动态 Webhook 生命周期应使用 `registerPluginHttpRoute(...)`。 - **破坏性变更：** Zalo 个人插件 (`@openclaw/zalouser`) 不再依赖外部的 `zca` 兼容 CLI 二进制文件（`openzca`、`zca-cli`）进行运行时发送/监听/登录；升级后，操作员应使用 `openclaw channels login --channel zalouser` 在新的 JS 原生路径中刷新会话。 ### 修复 - **插件命令/运行时加固**：在注册边界验证和规范化插件命令名称/描述；防护 Telegram 原生菜单规范化路径，防止格式错误的插件命令规范导致启动崩溃（对 undefined 进行 trim）。(#31997) 修复 #31944。感谢 @liuxiaopai-ai。 - **Telegram**：防护账户令牌缺失时的重复令牌检查和网关启动令牌规范化，防止在状态/启动流程中出现 `token.trim()` 崩溃。(#31973) 感谢 @ningding97。 - **Discord/生命周期启动状态**：当网关在生命周期调试监听器附加之前已连接时，推送即时的 `connected` 状态快照，并带有中止防护，以防止在启动中止期间出现矛盾的状态翻转。(#32336) 感谢 @mitchmcalister。 - **飞书/多应用提及路由**：通过验证提及显示名称与机器人 `open_id` 来防护多机器人群组中的提及检测，防止飞书 WebSocket 重新映射导致的错误自提及，确保仅在 `requireMention` 下实际被提及的机器人响应。(#30315) 感谢 @teaguexiao。 - **飞书/会话内存钩子一致性**：在执行飞书 `/new` 和 `/reset` 命令时触发共享的 `before_reset` 会话内存钩子路径，使重置流程保持与其他通道一致的内存行为。(#31437) 感谢 @Linux2010。 - **飞书/LINE 群组系统提示**：将每组的 `systemPrompt` 配置转发到入站上下文的 `GroupSystemPrompt`（针对飞书和 LINE 群组/房间事件），以便配置的组特定行为实际在调度时生效。(#31713) 感谢 @whiskyboy。 - **提及/Slack 格式化加固**：为运行时文本规范化路径添加空安全防护，防止格式错误/未定义的文本负载导致提及剥离或 mrkdwn 转换崩溃。(#31865) 感谢 @stone-jin。 - **飞书/插件 SDK 兼容性**：在加载飞书监控状态时添加安全的 Webhook 默认回退，使混合版本安装不再因旧版 `openclaw/plugin-sdk` 构建缺少 Webhook 默认常量而崩溃。(#31606) - **飞书/群组广播调度**：新增可配置的多代理群组广播调度，具备观察者会话隔离、跨账户重复数据删除保护以及避免广播/主题工作流中重复重播的非提及历史缓冲规则。(#29575) 感谢 @ohmyskyhigh。 - **网关/子代理 TLS 配对**：允许经过身份验证的本地 `gateway-client` 后端自连接跳过设备配对，同时仍要求非本地/直接主机路径进行配对，在 Docker/LAN 设置中恢复 `sessions_spawn` 配合 `gateway.tls.enabled=true` 的功能。修复 #30740。感谢 @Sid-Qin 和 @vincentkoc。 - **浏览器/CDP 启动诊断**：在启动超时错误中包含 Chrome 标准错误输出和 Linux 无沙盒提示，使失败的启动更易诊断。(#29312) 感谢 @veast。 - **群晖 Chat/Webhook 入口加固**：通过共享请求体防护强制执行有界主体读取（大小 + 超时），防止在令牌验证之前发生未经身份验证的慢速主体挂起。(#25831) 感谢 @bmendonca3。 - **飞书/重复数据删除重启弹性**：在监控启动时将持久化重复数据删除状态预热到内存中，使网关重启后的重试事件保持抑制状态，无需初始磁盘探测未命中。(#31605) - **语音呼叫/运行时生命周期**：通过重置失败的运行时承诺来防止 `EADDRINUSE` 循环，使 Webhook `start()` 对实际绑定的端口是幂等的，并在启动失败后完全清理 Webhook/隧道/Tailscale 资源。(#32395) 感谢 @scoootscooob。 - **网关/安全加固**：将仅允许回环来源的开发权限与实际本地套接字客户端（而非 Host 头声明）绑定；当 `gateway.controlUi.dangerouslyAllowHostHeaderOriginFallback` 接受 WebSocket 来源时添加明确警告/指标；为会话过滤和日志脱敏路径加固安全正则检测（例如 `(a|aa)+` 的量化模糊交替模式）；并为大型正则评估输入设置边界。感谢 @tdjackey 报告。 - **网关/插件 HTTP 加固**：要求插件路由注册必须显式提供 `auth`；为重复的 `path+match` 注册添加路由所有权防护；将插件路径匹配/认证逻辑集中到专用模块；并在通道监控间共享 Webhook 目标路由生命周期连接，以避免陈旧或冲突的注册。感谢 @tdjackey 报告。 - **浏览器/配置文件默认值**：在无头/无沙盒环境中优先使用 `openclaw` 配置文件而非 `chrome`，除非配置了显式的 `defaultProfile`。(#14944) 感谢 @BenediktSchackenberg。 - **网关/WS 安全**：默认保持仅回环的 `ws://`，并通过 `OPENCLAW_ALLOW_INSECURE_PRIVATE_WS=1` 提供明确的断崖式私有网络选择加入；将引导/客户端/调用验证和测试与此严格默认策略对齐。(#28670) 感谢 @dashed、@vincentkoc。 - **OpenAI Codex OAuth/TLS 先决条件**：添加具有可操作修复方案的 OAuth TLS 证书链预检，并将医生 TLS 先决条件探测限制为仅 OpenAI Codex OAuth 配置的安装（或显式的 `doctor --deep`），以避免无条件的出站探测延迟。(#32051) 感谢 @alexfilatov。 - **安全/Webhook 请求加固**：为 BlueBubbles 和 Google Chat Webhook 处理程序强制执行身份验证先于主体解析；为 Webhook 认证路径（包括 LINE 签名验证）添加严格的预认证主体/时间预算；并添加共享的飞行中/请求防护栏以及回归测试/链接检查，防止重新引入未经身份验证的慢速主体 DoS 模式。感谢 @GCXWLP 报告。 - **CLI/配置验证与路由加固**：将 `openclaw config validate` 失败去重为单一权威报告；跨核心 Zod 和插件 AJV 验证（包括 `--json` 字段）公开允许值元数据/提示；净化终端渲染的验证文本；使命令路径解析在预操作/路由/延迟注册（包括带拆分根选项的路由 `config get/unset`）中具有根选项感知能力。感谢 @gumadeiras。 - **浏览器/扩展中继重连容错**：当附加的目标仍然存在时，在短暂的 MV3 工作器断开期间保持 `/json/version` 和 `/cdp` 可达，并在重连宽限期内保留客户端。(#30232) 感谢 @Sid-Qin。 - **CLI/浏览器启动超时**：遵循 `openclaw browser --timeout <ms> start` 并通过移除固定的 15000ms 覆盖来停止，以便较慢的 Chrome 启动可以使用调用者提供的超时。(#22412, #23427) 感谢 @vincentkoc。 - **群晖 Chat/网关生命周期**：在非活动账户路径和活动账户路径中将 `startAccount` 保持为待处理状态，直到中止，以防止网关监管下的 Webhook 路由重启循环。(#23074) 感谢 @druide67。 - **执行批准/允许列表匹配**：在路径模式字面量中转义正则元字符（同时保留通配符），防止在 `/usr/bin/g++` 等已批准的可执行文件上崩溃，并正确匹配混合通配符/字面量令牌路径。(#32162) 感谢 @stakeswky。 - **群晖 Chat/Webhook 兼容性**：接受 JSON 和别名负载字段；允许从主体/查询/标头源解析令牌；并使用 `204` 确认 Webhook 请求，以避免群晖 Chat 客户端中出现持续的 `Processing...` 状态。(#26635) 感谢 @memphislee09-source。 - **语音呼叫/Twilio 签名验证**：在确定性的 URL 端口变体（带/不带端口）上重试签名验证，以处理反向代理和非标准端口后混合的 Twilio 签名行为。(#25140) 感谢 @drvoss。 - **Slack/Bolt 启动兼容性**：移除无效的 `message.channels` 和 `message.groups` 事件注册，使 Slack 提供商不再在 Bolt 4.6+ 启动时崩溃；频道/群组流量继续通过统一的 `message` 处理程序（`channel_type`）进行。(#32033) 感谢 @mahopan。 - **Slack/套接字认证失败处理**：在启动和重连期间对不可恢复的认证错误（`account_inactive`、`invalid_auth` 等）快速失败，而不是无限重试循环，包括传播 `unable_to_socket_mode_start` 错误负载。(#32377) 感谢 @scoootscooob。 - **网关/macOS LaunchAgent 加固**：在生成的网关 LaunchAgent plist 中写入 `Umask=077`，以便 npm 升级为网关创建的状态文件保留仅所有者默认权限。(#31919) 修复 #31905。感谢 @liuxiaopai-ai。 - **macOS/LaunchAgent 安全默认值**：在生成的网关 launchd plist 中写入 `Umask=63`（八进制 `077`），以便更新后服务重新安装保持仅所有者文件权限默认值，而不是回退到系统 `022`。(#32022) 修复 #31905。感谢 @liuxiaopai-ai。 - **媒体理解/提供商 HTTP 代理路由**：将来自 `HTTPS_PROXY`/`HTTP_PROXY` 环境变量的代理感知获取函数传递给音频/视频提供商调用（带有格式错误的代理回退），以便转录/视频请求遵循配置的出站代理。(#27093) 感谢 @mcaxtr。 - **沙盒/工作区挂载权限**：当 `workspaceAccess` 不是 `rw`（包括 `none`）时，使主 `/workspace` 绑定挂载变为只读，涵盖核心沙盒容器和沙盒浏览器创建流程。(#32227) 感谢 @guanyu-zhang。 - **工具/fsPolicy 传播**：在启用了仅工作区模式时，对图像/PDF 本地根允许列表遵循 `tools.fs.workspaceOnly`，因此非沙盒媒体路径在工作区外会被拒绝。(#31882) 感谢 @justinhuangcode。 - **守护进程/Homebrew 运行时固定**：将 Homebrew Cellar Node 路径解析为稳定的 Homebrew 管理的符号链接（包括像 `node@22` 这样的版本化公式），以便网关安装在 brew 升级期间保持预期的运行时。(#32185) 感谢 @scoootscooob。 - **浏览器/安全输出边界加固**：用根绑定 fd 验证写入替换先检查后重命名的输出提交，统一安装/技能规范路径边界检查，并为浏览器输出和共享 fs-safe 写入流程中的符号链接重新绑定竞争路径添加回归覆盖。感谢 @tdjackey 报告。 - **网关/安全规范化加固**：将插件路由路径变体解码为规范化定点（带有限深度），在规范化异常时失败封闭，并对深度编码的 `/api/channels/*` 变体强制执行网关认证，以防止通过插件处理程序的替代路径认证绕过。感谢 @tdjackey 报告。 - **浏览器/网关加固**：在将显式 `--url` 视为仅覆盖认证的同时，保留 `OPENCLAW_GATEWAY_URL` / `CLAWDBOT_GATEWAY_URL` 的环境凭证；并使容器浏览器加固标志可选，并为 Docker/LXC 稳定性提供更安全的默认值。(#31504) 感谢 @vincentkoc。 - **网关/控制 UI basePath Webhook 透传**：让配置的 `controlUiBasePath` 下非读取方法回退到插件路由（而不是返回控制 UI 405），恢复 basePath 挂载后的 Webhook 处理程序。(#32311) 感谢 @ademczuk。 - **控制 UI/旧版浏览器兼容性**：用兼容性辅助函数替换 `app-render` 中依赖 `toSorted` 的 cron 建议排序，使没有 `Array.prototype.toSorted` 的旧版浏览器不再白屏。(#31775) 感谢 @liuxiaopai-ai。 - **macOS/PeekabooBridge**：为遗留的 `clawdbot`、`clawdis` 和 `moltbot` 应用程序支持套接字路径添加兼容性套接字符号链接，以便重命名前的客户端仍可连接。(#6033) 感谢 @lumpinif 和 @vincentkoc。 - **网关/消息工具可靠性**：当 `message.*` 操作接收平台特定频道 ID 时，通过回退到 `toolContext.currentChannelProvider` 避免错误的 `Unknown channel` 失败；并通过添加每频道启动连接宽限期，防止刚（重新）启动的通道出现健康监控重启抖动。（来自 #32367）感谢 @MunemHashmi。 - **Windows/生成规范化**：在 ACP 客户端、QMD/mcporter 内存路径和沙盒 Docker 执行中统一非核心 Windows 生成处理，使用共享的包装器解析策略，并为 `.cmd` 垫片解包和 shell 回退行为提供有针对性的回归覆盖。(#31750) 感谢 @Takhoffman。 - **安全/ACP 沙盒继承**：通过拒绝来自沙盒请求者会话的 `runtime="acp"` 的 ACP 生成，并拒绝 ACP 运行时的 `sandbox="require"`，为 `sessions_spawn` 强制执行失败封闭的运行时防护栏，防止通过主机端 ACP 初始化进行沙盒边界绕过。(#32254) 感谢 @tdjackey 报告，以及 @dutifulbob 提供修复。 - **安全/Web 工具 SSRF 防护**：当设置代理环境变量时，为未信任的 `web_fetch` 和引用重定向 URL 检查保持 DNS 固定；要求在环境代理路由可以绕过受信任/操作员控制端点的固定调度之前，必须明确选择危险加入。感谢 @tdjackey 报告。 - **Gemini 模式净化**：在提供商验证之前将格式错误的 JSON 模式 `properties` 值（`null`、数组、基元）强制转换为 `{}`，防止无效插件/工具模式在严格的验证器下游崩溃。(#32332) 感谢 @webdevtodayjason。 - **媒体理解/格式错误附件防护**：加固附件选择和决策摘要格式化，以抵抗非数组或格式错误的附件负载，防止在无效入站元数据形状上发生运行时崩溃。(#28024) 感谢 @claw9267。 - **浏览器/扩展导航重新附加**：当中继暂时断开时，通过延迟中继附加事件直到重新连接/重新宣布，保留调试器重新附加，减少导航后选项卡丢失。(#28725) 感谢 @stone-jin。 - **浏览器/扩展中继陈旧选项卡**：当扩展目标被销毁/崩溃或命令因缺少目标/会话错误而失败时，从 `/json/list` 中逐出陈旧缓存目标。(#6175) 感谢 @vincentkoc。 - **浏览器/CDP 启动就绪**：在启动 Chrome 后等待 CDP WebSocket 就绪，并在就绪从未到达时干净地停止/重置，减少 `browser start`/`open` 后的后续 `PortInUseError` 竞争。(#29538) 感谢 @AaronWander。 - **OpenAI/响应 WebSocket 工具调用 ID 卫生**：在持久化之前规范化空白/空格流式工具调用 ID，并阻止 WS 转换路径中的空 `function_call_output.call_id` 负载，以避免 OpenAI 400 错误（`Invalid 'input[n].call_id': empty string`），并为入站流规范化和出站负载防护提供回归覆盖。 - **安全/节点摄像头 URL 下载**：将节点 `camera.snap`/`camera.clip` URL 负载下载绑定到解析的节点主机；在节点 `remoteIp` 不可用时强制执行失败封闭行为；并使用带重定向主机/协议检查的 SSRF 防护获取，以防止离节点获取枢纽。感谢 @tdjackey 报告。 - **配置/备份加固**：对轮换的配置备份强制执行仅所有者（`0600`）权限，并清理受管备份环外的孤立 `.bak.*` 文件，降低来自陈旧或宽松备份工件的凭据泄露风险。(#31718) 感谢 @YUJIE2002。 - **Telegram/入站媒体文件名**：为文档/音频/视频/动画下载保留原始 `file_name` 元数据（带有获取/路径回退），因此保存的入站附件保留发送方提供的名称，而不是不透明的 Telegram 文件路径。(#31837) 感谢 @Kay-051。 - **网关/媒体理解 MIME 规范化**：在 `kindFromMime` 中规范化参数化/大小写变体的 MIME 字符串（例如 `Audio/Ogg; codecs=opus`），以便 WhatsApp 语音笔记被分类为音频并通过转录正确路由。(#32280) 感谢 @Lucenx9。 - **Discord/音频预检提及**：通过 Discord `content_type` 检测音频附件，并根据类型文本（而非媒体占位符）对预检转录进行门控，以便公会语音笔记提及被正确转录和匹配。(#32136) 感谢 @jnMetaCode。 - **飞书/主题会话路由**：当 `root_id` 缺失时，使用 `thread_id` 作为主题会话范围回退；在主题创建时保持第一轮主题键稳定；并强制入站事件已携带主题/线程上下文时的线程回复。(#29788) 感谢 @songyaolun。 - **网关/Webchat NO_REPLY 流式传输**：抑制是 `NO_REPLY` 前缀的助手前导片段增量，并保持最终消息缓冲同步，防止在静默响应运行中部分 `NO` 泄漏，同时保留合法的简短回复。(#32073) 感谢 @liuxiaopai-ai。 - **Telegram/模型选择器回调**：通过回退到紧凑的回调负载并在选择时解析提供商 ID（在歧义时重新提示提供商），保持长模型按钮可选，避免 Telegram 64 字节回调截断失败。(#31857) 感谢 @bmendonca3。 - **上下文窗口元数据预热**：添加指数退避的配置加载重试（1s -> 2s -> 4s，上限 60s），以便瞬态启动失败自动恢复，无热循环重试。 - **语音呼叫/Twilio 出站**：自动注册 Webhook 优先的 `outbound-api` 调用（在 OpenClaw 外部发起），以便接受媒体流并保持呼叫方向元数据准确。(#31181) 感谢 @scoootscooob。 - **飞书/主题根回复**：当存在时优先使用 `root_id` 作为出站 `replyTargetMessageId`，并正确解析毫秒 `message_create_time` 值，以便主题回复在分组线程流程中锚定到根消息。(#29968) 感谢 @bmendonca3。 - **飞书/DM 配对回复目标**：将配对挑战回复发送到 `chat:<chat_id>` 而不是 `user:<sender_open_id>`，以便飞书/ Lark 仅含用户 ID 发送方负载的私聊可靠接收配对消息。(#31403) 感谢 @stakeswky。 - **飞书/Lark 私信路由**：将入站 `chat_type: "private"` 视为直接消息上下文，用于配对/提及转发/反应综合处理，以便 Lark 私聊表现得像飞书点对点私信。(#31400) 感谢 @stakeswky。 - **Signal/消息操作**：允许 `react` 在省略 `messageId` 时回退到 `toolContext.currentMessageId`，匹配 Telegram 行为并解除入站回合中代理发起的反应阻塞。(#32217) 感谢 @dunamismax。 - **Discord/消息操作**：允许 `react` 在省略 `messageId` 时回退到 `toolContext.currentMessageId`，匹配 Telegram/Signal 反应人体工程学于入站回合。 - **群晖 Chat/回复传递**：将 Webhook 用户名解析为 Chat API `user_id` 值以进行出站聊天机器人回复，避免在多账户设置中 Webhook 用户 ID 与 `method=chatbot` 收件人 ID 不匹配。(#23709) 感谢 @druide67。 - **Slack/线程上下文负载**：仅在新会话的第一轮线程回合注入线程启动器/历史文本，同时保留线程元数据，减少长期线程会话中重复的上下文令牌膨胀。(#32133) 感谢 @sourman。 - **Slack/会话路由**：当 `replyToMode=off` 时，将顶级频道消息保留在一个共享会话中，同时为真实线程回复和非关闭模式保留线程作用域键。(#32193) 感谢 @bmendonca3。 - **语音呼叫/Webhook 路由**：要求精确的 Webhook 路径匹配（而不是前缀匹配），以便外观相似的路径无法到达提供商验证/调度逻辑。(#31930) 感谢 @afurm。 - **Zalo/配对认证测试**：添加 Webhook 回归覆盖，断言 DM 配对存储读取/写入保持账户范围，防止多账户设置中的跨账户授权泄漏。(#26121) 感谢 @bmendonca3。 - **Zalouser/配对认证测试**：添加账户范围 DM 配对存储回归覆盖（`monitor.account-scope.test.ts`），以防止多账户设置中的跨账户允许列表泄漏。(#26672) 感谢 @bmendonca3。 - **飞书/发送目标前缀**：规范化显式的 `group:`/`dm:` 发送目标，并在解析出站飞书目标时保留显式接收 ID 路由提示。(#31594) 感谢 @liuxiaopai-ai。 - **Webchat/飞书会话延续**：在 `chat.send` 的会话传递上下文中保留可路由的 `OriginatingChannel`/`OriginatingTo` 元数据，并在决定跨通道路由调度时优先使用提供商规范化的频道，以便 Webchat 回复继续在选定的飞书会话上，而不是回退到主/内部会话路由。(#31573) - **Telegram/隐式提及论坛处理**：将 Telegram 论坛系统服务消息（`forum_topic_*`、`general_forum_topic_*`）从回复链隐式提及检测中排除，以便 `requireMention` 不会在机器人创建的话题生命周期事件中被绕过。(#32262) 感谢 @scoootscooob。 - **Slack/入站防抖路由**：通过消息时间戳隔离顶级非 DM 消息防抖键，以避免跨线程冲突；保留 DM 批处理；并在立即非防抖后续操作之前刷新挂起的顶级缓冲区，以保持顺序稳定。(#31951) 感谢 @scoootscooob。 - **飞书/重复回复**：当消息工具使用通用提供商元数据（`provider: "message"`）发送时抑制相同目标回复调度，并在重复目标检查期间规范化 `lark`/`feishu` 提供商别名，防止在飞书会话中重复传递。(#31526) - **Webchat/静默令牌泄漏**：从 `chat.history` 响应中过滤助手 `NO_REPLY` 仅转录条目，并在聊天控制器中添加客户端纵深防护，以便内部静默令牌永不呈现为可见聊天气泡。(#32015) 合并了 #32183、#32082、#32045、#32052、#32172 和 #32112 的重叠。感谢 @ademczuk、@liuxiaopai-ai、@ningding97、@bmendonca3 和 @x4v13r1120。 - **医生/本地内存提供商检查**：当 `provider=local` 且未设置显式 `modelPath` 时，通过遵循默认本地模型回退来停止误报本地提供商警告，同时仍警告网关探测报告本地嵌入未就绪时的情况。(#32014) 修复 #31998。感谢 @adhishthite。 - **媒体理解/parakeet CLI 输出解析**：在请求 txt 输出（或默认）时从 `--output-dir/<media-basename>.txt` 读取 `parakeet-mlx` 转录（非 txt 格式则回退到标准输出）。(#9177) 感谢 @mac-110。 - **媒体理解/音频转录防护**：在提供商/CLI 转录之前跳过微小/空音频文件（<1024 字节），以避免嘈杂的无效音频失败并保持干净的回退行为。(#8388) 感谢 @Glucksberg。 - **网关/插件 HTTP 路由优先级**：在控制 UI SPA 捕获所有之前运行显式插件 HTTP 路由，以便注册的插件 Webhook/自定义路径保持可达，而未匹配的路径仍回退到控制 UI 处理。(#31885) 感谢 @Sid-Qin。 - **网关/节点浏览器代理路由**：当查询参数省略时，遵循 `browser.request` JSON 主体中的 `profile`，同时保留两者都存在时的查询配置文件优先级。(#28852) 感谢 @Sid-Qin。 - **网关/控制 UI basePath POST 处理**：对精确 basePath 路由（例如 `/openclaw`）的 `POST` 返回 405（而不是重定向），并添加端到端回归覆盖，确保根挂载的 Webhook POST 路径仍回退到插件处理程序。(#31349) 感谢 @Sid-Qin。 - **浏览器/默认配置文件选择**：默认 `browser.defaultProfile` 行为现在优先使用 `openclaw`（管理的独立 CDP），除非配置了显式默认值，同时仍为明确选择使用自动配置 `chrome` 中继配置文件。(#32031) 修复 #31907。感谢 @liuxiaopai-ai。 - **沙盒/mkdirp 边界检查**：当目录打开探测返回平台特定 I/O 错误时，允许现有边界内目录通过 mkdirp 边界验证，并为目录安全回退行为提供回归覆盖。(#31547) 感谢 @stakeswky。 - **模型/配置环境传播**：在模型引导中的隐式提供商发现之前应用 `config.env.vars`，以便配置范围的凭据对隐式提供商解析路径可见。(#32295) 感谢 @hsiaoa。 - **模型/Codex 使用标签**：当 API 窗口秒数被模糊报告为 24 小时时，从重置周期推断每周次要使用窗口，以便 `openclaw models status` 不再将每周限制误标为每日。(#31938) 感谢 @bmendonca3。 - **网关/心跳模型重载**：将 `models.*` 和 `agents.defaults.model` 配置更新视为心跳热重载触发器，以便心跳无需完整网关重启即可获取模型更改。(#32046) 感谢 @stakeswky。 - **内存/LanceDB 嵌入**：将配置的 `embedding.dimensions` 转发到 OpenAI 嵌入请求中，以便在显式配置维度时向量大小和 API 输出维度保持一致。(#32036) 感谢 @scotthuang。 - **网关/控制 UI 方法防护**：当未配置基本路径时，允许对非 UI 路由的 POST 请求回退，并为回退和基本路径 405 行为添加 POST 回归覆盖。(#23970) 感谢 @tyler6204。 - **浏览器/CDP 状态准确性**：要求通过 CDP WebSocket（而不仅仅是套接字打开）成功的 `Browser.getVersion` 响应后才报告 `cdpReady`，以便将陈旧空闲命令通道显示为不健康。(#23427) 感谢 @vincentkoc。 - **守护进程/容器中的 systemd 检查**：在 `is-enabled` 检查期间将缺失的 `systemctl` 调用（包括 `spawn systemctl ENOENT`/`EACCES`）视为不可用服务状态，防止容器流程在安装/状态处理可以继续之前失败并显示 `Gateway service check failed`。(#26089) 感谢 @sahilsatralkar 和 @vincentkoc。 - **安全/节点执行批准**：在执行/转发之前立即重新验证批准绑定的 `cwd` 身份，并在 `cwd` 在批准加固后漂移时以明确拒绝失败封闭。 - **安全审计/技能工作区加固**：当工作区 `skills/**/SKILL.md` 解析到工作区根之外（例如符号链接链漂移）时，在 `openclaw security audit` 中添加 `skills.workspace.symlink_escape` 警告，并在安全词汇表中提供文档覆盖。 - **安全/节点执行批准**：在批准加固期间保留 shell/分发包装器 argv 语义，以便批准的包装器命令（例如 `env sh -c ...`）不会漂移到不同的运行时命令形状；并为批准计划生成和批准的运行时执行路径添加回归覆盖。感谢 @tdjackey 报告。 - **安全/fs-safe 写入加固**：使 `writeFileWithinRoot` 使用同目录临时写入加原子重命名；写入后 inode/硬链接重新验证，边界漂移时显示安全警告；并在最终重命名失败时避免截断现有目标。 - **安全/技能归档提取**：在 tar.gz 和 tar.bz2 安装流程中统一 tar 提取安全检查；强制执行 tar 压缩大小限制；并在预检和提取之间如果 tar.bz2 归档发生变化则失败封闭，以防止绕过条目类型/大小防护栏。感谢 @GCXWLP 报告。 - **安全/提示欺骗加固**：停止将排队的运行时事件注入用户角色提示文本，将它们通过受信任的系统提示上下文路由，并中和未信任消息内容中的入站欺骗标记，如 `[System Message]` 和行首 `System:`。(#30448) - **沙盒/Docker 设置命令解析**：将 `agents.*.sandbox.docker.setupCommand` 接受为字符串或字符串数组；将数组规范化为换行分隔的 shell 脚本，以便多步骤设置命令不再无分隔符连接。(#31953) 感谢 @liuxiaopai-ai。 - **沙盒/引导上下文边界加固**：拒绝解析到源工作区之外的符号链接/硬链接别名引导种子文件，并在压缩后切换 `AGENTS.md` 上下文读取为边界验证文件打开，防止通过工作区别名注入主机文件内容。感谢 @tdjackey 报告。 - **代理/沙盒工作目录映射**：在沙盒路径验证之前将容器工作目录路径（例如 `/workspace`）映射回主机工作区，以便执行请求在容器化运行中保持预期的目录，而不是回退到不可用的主机路径。(#31841) 感谢 @liuxiaopai-ai。 - **Docker/沙盒引导加固**：使 `OPENCLAW_SANDBOX` 选择加入解析显式化（`1|true|yes|on`）；通过 `OPENCLAW_DOCKER_SOCKET` 支持自定义 Docker 套接字路径；在沙盒先决条件通过之前延迟 docker.sock 公开；并在设置被跳过或部分失败时将持久化沙盒模式重置/回滚到 `off`，以避免陈旧损坏的沙盒状态。(#29974) 感谢 @jamtujest 和 @vincentkoc。 - **钩子/Webhook ACK 兼容性**：为成功的 `/hooks/agent` 请求返回 `200`（而不是 `202`），以便需要 `200` 的提供商（例如 Forward Email）接受调度的代理钩子传递。(#28204) 感谢 @Glucksberg。 - **飞书/运行通道回退**：在推断排队运行 `messageProvider` 回退（当 `OriginatingChannel` 缺失时）时优先使用 `Provider` 而非 `Surface`，防止飞书回合在混合中继元数据上下文中被错误标记为 `webchat`。(#31880) 修复 #31859。感谢 @liuxiaopai-ai。 - **技能/sherpa-onnx-tts**：在 ESM 下运行 `sherpa-onnx-tts` 二进制文件（替换 CommonJS `require` 导入），并添加回归覆盖以防止 `require is not defined in ES module scope` 启动崩溃。(#31965) 感谢 @bmendonca3。 - **入站元数据/直接中继上下文**：为外部通道（例如 WhatsApp）恢复直接通道会话元数据块，同时保留 Webchat 直接抑制，以便中继代理恢复发送者/消息标识符，而不重新引入内部 Webchat 元数据噪音。(#31969) 修复 #29972。感谢 @Lucenx9。 - **Slack/频道消息订阅**：注册显式的 `message.channels` 和 `message.groups` 监控处理程序（连同通用 `message`），以便当 Slack 调度类型化消息事件名称时，频道/群组事件订阅仍被消费。修复 #31674。 - **钩子/会话作用域内存上下文**：在嵌入式插件工具上下文以及 `before_tool_call`/`after_tool_call` 钩子上下文（包括压缩和客户端工具连接）中公开临时 `sessionId`，以便插件可以在 `/new` 和 `/reset` 之间隔离每个会话状态。相关 #31253 和 #31304。感谢 @Sid-Qin 和 @Servo-AIpex。 - **语音呼叫/Twilio 入站问候**：为 Twilio 运行应答呼叫初始通知问候，而不是跳过管理器说话路径，并为 Twilio 和 Plivo 通知流程提供回归覆盖。(#29121) 感谢 @xinhuagu。 - **语音呼叫/陈旧呼叫水合**：在加载持久化进行中呼叫之前使用提供商验证活跃呼叫，以便在重启后陈旧的本地持久记录不会阻塞或错误路由新呼叫处理。(#4325) 感谢 @garnetlyx。 - **飞书/文件上传文件名**：在飞书多部分上传中对非 ASCII/特殊字符 `file_name` 值进行百分比编码，以便中文/符号繁重的文件名作为正确附件发送，而不是纯文本链接。(#31179) 感谢 @Kay-051。 - **媒体/MIME 通道一致性**：通过规范化的 `kindFromMime` 路由 Telegram/Signal/iMessage 媒体种类检查，以便混合大小写/参数化 MIME 值跨消息通道一致分类。 - **WhatsApp/入站自消息上下文**：通过 Web 收件箱管道传播入站 `fromMe`，并将直接自消息注释为信封中的 `(self)`，以便代理可以区分所有者编写的回合与联系人回合。(#32167) 感谢 @scoootscooob。 - **Webchat/流式最终化**：在最终事件省略 `message` 时持久化流式助手文本，同时保持最终负载优先级并跳过空流缓冲区，以防止工具回合后回复消失。(#31920) 感谢 @Sid-Qin。 - **飞书/入站排序**：按聊天序列化消息处理，同时保留跨聊天并发性，以避免在突发入站流量下同一聊天竞争丢失。(#31807) - **飞书/输入指示器抑制**：当指示器已激活时，跳过输入保持活动反应重新添加，防止重复的相同表情添加导致重复通知 ping。(#31580) - **飞书/探测失败回退**：为每个账户密钥缓存 API 和超时探测失败一分钟，同时保留中止感知探测超时，减少瞬态凭据/网络中断期间的重复健康检查重试。(#29970) - **飞书/流式传输块回退**：当最终负载文本缺失时，将 markdown 块流文本保留为最终流式卡片内容，同时仍抑制非卡片内部块块传递。(#30663) - **飞书/Bitable API 错误**：将飞书 Bitable 工具错误处理与结构化 `LarkApiError` 响应以及 wiki/基础元数据、字段和记录操作的一致 API/上下文属性统一。(#31450) - **飞书/缺失范围授权 URL 修复**：在权限授权链接中将已知无效范围别名（`contact:contact.base:readonly`）重写为有效范围名称，以便修复 URL 使用正确的飞书同意范围打开。(#31943) - **BlueBubbles/消息元数据**：加固发送响应 ID 提取；在 DM 上下文中包含发送者身份；并规范化入站 `message_id` 选择以避免重复 ID 元数据。(#23970) 感谢 @tyler6204。 - **WebChat/markdown 表格**：确保在渲染时明确启用 GitHub 风格 markdown 表格解析，并为宽表格添加水平溢出处理，并为仅表格和混合文本+表格内容提供回归覆盖。(#32365) 感谢 @BlueBirdBack。 - **飞书/默认账户解析**：在出站账户选择期间始终遵循显式的 `channels.feishu.defaultAccount`（包括首选 ID 不在 `accounts` 中的顶级凭据设置），而不是静默回退到另一个账户 ID。(#32253) 感谢 @bmendonca3。 - **飞书/发送者查找权限**：在尽力而为的发送者名称解析期间抑制陈旧不存在范围错误（`contact:contact.base:readonly`）的用户-facing 授权提示，以便入站消息继续而不会重复出现错误的权限通知。(#31761) - **Discord/调度 + Slack 格式化**：恢复跨 Discord 频道的并行出站调度，每个频道有独立队列，同时保持频道内顺序；并运行 Slack 预览/流式更新文本通过 mrkdwn 规范化以实现一致格式化。(#31927) 感谢 @Sid-Qin。 - **飞书/入站防抖**：将快速同一聊天发送者爆发防抖为一个有序调度回合；在组合文本时跳过已处理的重试；并跨合并条目保留机器人提及意图，以减少重复或延迟的入站处理。(#31548) - **测试/沙盒 + 归档可移植性**：在 Windows 上使用连接兼容的目录链接设置，并在符号链接不可用的无特权文件符号链接测试中显式文件符号链接平台防护，减少 Windows CI 的误报失败，同时保留支持路径上的遍历检查。(#28747) 感谢 @arosstale。 - **浏览器/扩展重新宣布可靠性**：当重新宣布转发失败时保持中继状态为 `connecting`，并在导航后延长调试器重新附加重试，以减少错误的附加状态和导航后断开循环。(#27630) 感谢 @markmusson。 - **浏览器/Act 请求兼容性**：除了 `request={...}` 之外，还接受遗留的扁平化 `action="act"` 参数（`kind/ref/text/...`），以便浏览器 act 调用不再因 `request required` 失败。(#15120) 感谢 @vincentkoc。 - **OpenRouter/x-ai 兼容性**：跳过 `x-ai/*` 模型（例如 Grok）的 `reasoning.effort` 注入，以便 OpenRouter 请求不再因不支持的推理参数而失败并出现无效参数错误。(#32054) 感谢 @scoootscooob。 - **模型/openai-completions 开发者角色兼容性**：对非原生端点强制 `supportsDeveloperRole=false`；将无法解析的 `baseUrl` 值视为非原生；并为空/格式错误的 baseUrl 以及显式 true 覆盖行为添加回归覆盖。(#29479) 感谢 @akramcodez。 - **浏览器/配置文件仅附加覆盖**：支持 `browser.profiles.<name>.attachOnly`（回退到全局 `browser.attachOnly`），以便回环代理配置文件可以跳过本地启动/端口所有权检查，而不必为每个配置文件强制仅附加模式。(#20595) 感谢 @unblockedgamesstudio 和 @vincentkoc。 - **会话/锁恢复**：通过比较锁文件 `starttime` 与 `/proc/<pid>/stat` starttime 来检测回收的 Linux PID，以便在容器化 PID 重用场景中立即回收陈旧的 `.jsonl.lock` 文件，同时保持旧锁文件的活动锁安全检查兼容性。(#26443) 修复 #27252。感谢 @HirokiKobayashi-R 和 @vincentkoc。 - **Cron/隔离交付目标回退**：移除早期未解析目标返回，以便当 `delivery.to` 省略时，cron 交付可以流经共享出站目标解析（包括每频道 `resolveDefaultTo` 回退）。(#32364) 感谢 @hclsys。 - **OpenAI 媒体能力**：在 OpenAI 提供商能力列表中包含 `audio`，以便音频转录模型在媒体理解提供商选择中合格。(#12717) 感谢 @openjay。 - **浏览器/管理选项卡上限**：通过选项卡打开后尽力清理，将回环管理的 `openclaw` 页面选项卡限制为 8 个，以减少长期运行的渲染器积累，同时保留仅附加和远程配置文件行为。(#29724) 感谢 @pandego。 - **Docker/镜像健康检查**：添加探测网关 `GET /healthz` 的 Dockerfile `HEALTHCHECK`，以便容器运行时可以在不需要认证凭据的情况下将不健康的实例标记为不健康。(#11478) 感谢 @U-C4N 和 @vincentkoc。 - **网关/节点危险命令一致性**：在默认引导节点 `denyCommands` 中包含 `sms.send`，与网关危险命令真相源共享引导拒绝默认值，并在手机控制 `/phone arm writes` 中包含 `sms.send`，以便 SMS 遵循与其他危险节点命令相同的断崖式流程。感谢 @zpbrent。 - **配对/AllowFrom 账户回退**：在 `readChannelAllowFromStore` 和 `readChannelAllowFromStoreSync` 中将省略的 `accountId` 值处理为 `default`，同时为默认账户流程保留遗留的无范围 AllowFrom 合并。感谢 @Sid-Qin 和 @vincentkoc。 - **浏览器/远程 CDP 所有权检查**：当 HTTP 可达但 WebSocket 握手失败时，跳过非回环远程 CDP 配置文件的本地进程所有权错误，并显示远程 WebSocket 附加/重试路径而不是。(#15582) 来自贡献者 (#28780) 合并。感谢 @stubbi、@bsormagec、@unblockedgamesstudio 和 @vincentkoc。 - **浏览器/CDP 代理绕过**：当设置代理环境变量时，强制为 localhost CDP HTTP/WS 连接使用直接回环代理路径和范围 `NO_PROXY` 扩展，以便浏览器中继/控制在全局代理设置后仍能工作。(#31469) 感谢 @widingmarcus-cyber。 - **会话/空闲重置正确性**：在入站元数据仅写入期间保留现有的 `updatedAt`，以免空闲重置边界在实际用户回合之前被无意刷新。(#32379) 感谢 @romeodiaz。 - **会话/锁恢复**：当不存在进程内锁所有权时，回收缺少 `starttime` 的遗留同 PID 锁文件，避免 PID 重用后的错误锁超时，同时保持活动锁安全检查。(#32081) 感谢 @bmendonca3。 - **会话/存储缓存失效**：通过将缓存验证键控在单个文件状态快照（`mtimeMs` + `sizeBytes`）上，在相同 mtime 刻度内文件大小变化时重新加载缓存的会话存储，并为相同刻度重写提供回归覆盖。(#32191) 感谢 @jalehman。 - **代理/子代理 `sessions_spawn`**：在规范化之前拒绝格式错误的 `agentId` 输入（例如错误消息/路径类字符串），以防止意外的合成代理 ID 和幽灵工作区/会话路径；包括严格验证回归覆盖。(#31381) 感谢 @openperf。 - **CLI/安装程序 Node 预检**：在 `openclaw.mjs` 运行时引导和安装程序活动 shell 检查中一致强制执行 Node.js `v22.12+`，并为不匹配的 shell PATH/默认值提供可操作的 nvm 恢复指南。(#32356) 感谢 @jasonhargrove。 - **Web UI/配置表单**：在映射 `additionalProperties` 中支持 SecretInput 字符串或秘密引用联合，以便提供商 API 密钥字段保持可编辑，而不是被标记为不支持。(#31866) 感谢 @ningding97。 - **自动回复/内联命令清理**：在剥离内联 `/status` 和提取内联斜杠命令时保留换行结构，仅折叠水平空白，防止多行回复中的段落扁平化。(#32224) 感谢 @scoootscooob。 - **配置/原始脱敏安全**：在原始脱敏往返中保留非敏感字面量；将 SecretRef 脱敏范围限定为秘密 ID（而不是 `source`/`provider` 等结构字段）；并在文本替换无法恢复原始配置形状时回退到结构化原始脱敏。(#32174) 感谢 @bmendonca3。 - **钩子/运行时稳定性**：将内部钩子处理程序注册表保留在 `globalThis` 单例上，以便在捆绑发出重复模块副本时钩子注册/调度保持一致。(#32292) 感谢 @Drickon。 - **钩子/after_tool_call**：在嵌入式工具执行上下文中包含嵌入的会话上下文（`sessionKey`、`agentId`），并通过移除嵌入式运行中的重复适配器路径调度，每个工具执行恰好触发一次钩子。(#32201) 感谢 @jbeno、@scoootscooob、@vincentkoc。 - **钩子/工具调用关联**：在插件工具钩子负载/上下文中包含 `runId` 和 `toolCallId`，并将工具开始/调整参数跟踪按运行范围限定，以防止 `before_tool_call` 和 `after_tool_call` 中的跨运行冲突。(#32360) 感谢 @vincentkoc。 - **插件/安装诊断**：拒绝没有 `openclaw.extensions` 的遗留插件包形状，并返回带有故障排除文档的明确升级提示。(#32055) 感谢 @liuxiaopai-ai。 - **钩子/插件上下文一致性**：确保嵌入式尝试中的 `llm_input` 钩子接收与其他钩子阶段相同的 `trigger` 和 `channelId` 感知 `hookCtx`，保留频道/触发器范围的插件行为。(#28623) 感谢 @davidrudduck 和 @vincentkoc。 - **插件/硬链接安装兼容性**：允许通过基于硬链接的包管理器（`pnpm`、`bun`）安装的捆绑插件清单和入口文件加载，同时保持对非捆绑插件源的硬链接拒绝启用。(#32119) 修复 #28175、#28404、#29455。感谢 @markfietje。 - **Cron/会话清理器可靠性**：将 cron 会话清理器扫描移至 `onTimer` `finally` 中，即使计时器刻度提前失败（例如 cron 存储解析失败）也保持修剪活动，防止孤立的隔离运行会话无限积累。(#31996) 修复 #31946。感谢 @scoootscooob。 - **Cron/HEARTBEAT_OK 摘要泄漏**：在隔离公告模式中，当任何负载是心跳确认令牌且没有负载具有媒体时，抑制回退主会话入队，以便 `HEARTBEAT_OK` 噪音永远不会传递给用户，而真实摘要仍会转发。(#32093) 感谢 @scoootscooob。 - **认证**：将 `permission_error` 分类为 `auth_permanent` 以进行配置文件回退。(#31324) 感谢 @Sid-Qin。 - **代理/主机编辑可靠性**：仅当磁盘后检查确认替换可能发生（`newText` 存在且 `oldText` 不存在）时，才将主机编辑工具抛出视为成功，防止错误失败报告，同时避免写入前误报。(#32383) 感谢 @polooooo。 - **插件/安装回退安全**：在 npm 查找之前将裸安装规范解析为捆绑插件 ID（例如 `diffs` -> 捆绑的 `@openclaw/diffs`）；将 npm 回退限制为真正的包未找到错误；并继续拒绝未能通过清单验证的非插件 npm 包。(#32096) 感谢 @scoootscooob。 - **Web UI/内联代码复制保真度**：禁用内联 `<code>` 跨度上的强制中间标记换行，以便复制的 UUID/哈希/令牌字符串保留确切内容，而不是插入换行空格。(#32346) 感谢 @hclsys。 - **重启信标格式化**：当重启消息文本已匹配 `stats.reason` 时，避免重复的 `Reason:` 行，为用户和下游解析器保持重启通知简洁。(#32083) 感谢 @velamints2。 - **自动回复/后续队列**：通过仅在实际开始排空时缓存后续运行器，避免空闲窗口重启之间的陈旧回调重用，在空最终化路径后保留入队顺序。(#31902) 感谢 @Lanfei。 - **代理/工具结果防护**：即使在禁用合成工具结果时，也在中断时始终清除挂起的工具调用状态，防止孤立的工具使用转录导致后续提供商请求失败。(#32120) 感谢 @jnMetaCode。 - **故障转移/错误分类**：将 HTTP `529`（提供商过载，常见于 Anthropic 兼容 API）视为 `rate_limit`，以便模型故障转移可以介入，而不是错误分类错误路径。(#31854) 感谢 @bugkill3r。 - **日志记录**：使用本地时间记录时间戳而不是 UTC，使日志输出与文档化的本地时区行为一致，并在本地诊断期间避免混淆。(#28434) 感谢 @liuy。 - **代理/子代理公告清理**：在后代稳定期间保持完成消息运行待处理，添加 30 分钟硬过期后备以避免无限待处理状态，并保持重试簿记在延迟唤醒后可恢复。(#23970) 感谢 @tyler6204。 - **Secrets/执行解析器超时默认值**：使用提供商 `timeoutMs` 作为执行秘密提供商的默认非活动（`noOutputTimeoutMs`）看门狗，防止对于 2 秒后开始产生输出的解析器过早无输出终止。(#32235) 感谢 @bmendonca3。 - **自动回复/提醒防护注释抑制**：当回合做出类似提醒的承诺但未安排新的 cron 作业时，仅当同一会话存在已启用的 cron 才抑制未安排提醒警告注释；为无关会话、禁用作业或不可读 cron 存储路径保留警告。(#32255) 感谢 @scoootscooob。 - **Cron/隔离公告心跳抑制**：当任何负载是心跳确认令牌且没有负载具有媒体时，将多负载运行视为可跳过，防止内部旁白 + 尾随 `HEARTBEAT_OK` 传递给用户。(#32131) 感谢 @adhishthite。 - **Cron/存储迁移**：在加载时将遗留 cron 作业（具有字符串 `schedule` 和顶级 `command`/`timeout` 字段）规范化为规范的计划/负载/会话目标形状，防止旧持久存储上的计划错误循环。(#31926) 感谢 @bmendonca3。 - **测试/Windows 备份轮换**：在 Windows 上跳过仅 chmod 的备份权限断言，同时保留跨平台的组合/轮换/修剪覆盖，以避免 Windows 非 POSIX 模式语义的误报 CI 失败。(#32286) 感谢 @jalehman。 - **测试/子代理公告**：在导入 `subagent-announce` 格式套件之前设置 `OPENCLAW_TEST_FAST=1`，以便模块级快速模式常量在 Windows CI 上确定性地捕获，防止嵌套完成公告覆盖中的超时波动。(#31370) 感谢 @zwffff。

### Changes - Secrets/SecretRef coverage: expand SecretRef support across the full supported user-supplied credential surface (64 targets total), including runtime collectors, `openclaw secrets` planning/apply/audit flows, onboarding SecretInput UX, and related docs; unresolved refs now fail fast on active surfaces while inactive surfaces report non-blocking diagnostics. (#29580) Thanks @joshavant. - Tools/PDF analysis: add a first-class `pdf` tool with native Anthropic and Google PDF provider support, extraction fallback for non-native models, configurable defaults (`agents.defaults.pdfModel`, `pdfMaxBytesMb`, `pdfMaxPages`), and docs/tests covering routing, validation, and registration. (#31319) Thanks @tyler6204. - Outbound adapters/plugins: add shared `sendPayload` support across direct-text-media, Discord, Slack, WhatsApp, Zalo, and Zalouser with multi-media iteration and chunk-aware text fallback. (#30144) Thanks @nohat. - Models/MiniMax: add first-class `MiniMax-M2.5-highspeed` support across built-in provider catalogs, onboarding flows, and MiniMax OAuth plugin defaults, while keeping legacy `MiniMax-M2.5-Lightning` compatibility for existing configs. - Sessions/Attachments: add inline file attachment support for `sessions_spawn` (subagent runtime only) with base64/utf8 encoding, transcript content redaction, lifecycle cleanup, and configurable limits via `tools.sessions_spawn.attachments`. (#16761) Thanks @napetrov. - Telegram/Streaming defaults: default `channels.telegram.streaming` to `partial` (from `off`) so new Telegram setups get live preview streaming out of the box, with runtime fallback to message-edit preview when native drafts are unavailable. - Telegram/DM streaming: use `sendMessageDraft` for private preview streaming, keep reasoning/answer preview lanes separated in DM reasoning-stream mode. (#31824) Thanks @obviyus. - Telegram/voice mention gating: add optional `disableAudioPreflight` on group/topic config to skip mention-detection preflight transcription for inbound voice notes where operators want text-only mention checks. (#23067) Thanks @yangnim21029. - CLI/Config validation: add `openclaw config validate` (with `--json`) to validate config files before gateway startup, and include detailed invalid-key paths in startup invalid-config errors. (#31220) thanks @Sid-Qin. - Tools/Diffs: add PDF file output support and rendering quality customization controls (`fileQuality`, `fileScale`, `fileMaxWidth`) for generated diff artifacts, and document PDF as the preferred option when messaging channels compress images. (#31342) Thanks @gumadeiras. - Memory/Ollama embeddings: add `memorySearch.provider = "ollama"` and `memorySearch.fallback = "ollama"` support, honor `models.providers.ollama` settings for memory embedding requests, and document Ollama embedding usage. (#26349) Thanks @nico-hoff. - Zalo Personal plugin (`@openclaw/zalouser`): rebuilt channel runtime to use native `zca-js` integration in-process, removing external CLI transport usage and keeping QR/login + send/listen flows fully inside OpenClaw. - Plugin SDK/channel extensibility: expose `channelRuntime` on `ChannelGatewayContext` so external channel plugins can access shared runtime helpers (reply/routing/session/text/media/commands) without internal imports. (#25462) Thanks @guxiaobo. - Plugin runtime/STT: add `api.runtime.stt.transcribeAudioFile(...)` so extensions can transcribe local audio files through OpenClaw's configured media-understanding audio providers. (#22402) Thanks @benthecarman. - Plugin hooks/session lifecycle: include `sessionKey` in `session_start`/`session_end` hook events and contexts so plugins can correlate lifecycle callbacks with routing identity. (#26394) Thanks @tempeste. - Hooks/message lifecycle: add internal hook events `message:transcribed` and `message:preprocessed`, plus richer outbound `message:sent` context (`isGroup`, `groupId`) for group-conversation correlation and post-transcription automations. (#9859) Thanks @Drickon. - Media understanding/audio echo: add optional `tools.media.audio.echoTranscript` + `echoFormat` to send a pre-agent transcript confirmation message to the originating chat, with echo disabled by default. (#32150) Thanks @AytuncYildizli. - Plugin runtime/system: expose `runtime.system.requestHeartbeatNow(...)` so extensions can wake targeted sessions immediately after enqueueing system events. (#19464) Thanks @AustinEral. - Plugin runtime/events: expose `runtime.events.onAgentEvent` and `runtime.events.onSessionTranscriptUpdate` for extension-side subscriptions, and isolate transcript-listener failures so one faulty listener cannot break the entire update fanout. (#16044) Thanks @scifantastic. - CLI/Banner taglines: add `cli.banner.taglineMode` (`random` | `default` | `off`) to control funny tagline behavior in startup output, with docs + FAQ guidance and regression tests for config override behavior. ### Breaking - **BREAKING:** Onboarding now defaults `tools.profile` to `messaging` for new local installs (interactive + non-interactive). New setups no longer start with broad coding/system tools unless explicitly configured. - **BREAKING:** ACP dispatch now defaults to enabled unless explicitly disabled (`acp.dispatch.enabled=false`). If you need to pause ACP turn routing while keeping `/acp` controls, set `acp.dispatch.enabled=false`. Docs: https://docs.openclaw.ai/tools/acp-agents - **BREAKING:** Plugin SDK removed `api.registerHttpHandler(...)`. Plugins must register explicit HTTP routes via `api.registerHttpRoute({ path, auth, match, handler })`, and dynamic webhook lifecycles should use `registerPluginHttpRoute(...)`. - **BREAKING:** Zalo Personal plugin (`@openclaw/zalouser`) no longer depends on external `zca`-compatible CLI binaries (`openzca`, `zca-cli`) for runtime send/listen/login; operators should use `openclaw channels login --channel zalouser` after upgrade to refresh sessions in the new JS-native path. ### Fixes - Plugin command/runtime hardening: validate and normalize plugin command name/description at registration boundaries, and guard Telegram native menu normalization paths so malformed plugin command specs cannot crash startup (`trim` on undefined). (#31997) Fixes #31944. Thanks @liuxiaopai-ai. - Telegram: guard duplicate-token checks and gateway startup token normalization when account tokens are missing, preventing `token.trim()` crashes during status/start flows. (#31973) Thanks @ningding97. - Discord/lifecycle startup status: push an immediate `connected` status snapshot when the gateway is already connected before lifecycle debug listeners attach, with abort-guarding to avoid contradictory status flips during pre-aborted startup. (#32336) Thanks @mitchmcalister. - Feishu/multi-app mention routing: guard mention detection in multi-bot groups by validating mention display name alongside bot `open_id`, preventing false-positive self-mentions from Feishu WebSocket remapping so only the actually mentioned bot responds under `requireMention`. (#30315) Thanks @teaguexiao. - Feishu/session-memory hook parity: trigger the shared `before_reset` session-memory hook path when Feishu `/new` and `/reset` commands execute so reset flows preserve memory behavior consistent with other channels. (#31437) Thanks @Linux2010. - Feishu/LINE group system prompts: forward per-group `systemPrompt` config into inbound context `GroupSystemPrompt` for Feishu and LINE group/room events so configured group-specific behavior actually applies at dispatch time. (#31713) Thanks @whiskyboy. - Mentions/Slack formatting hardening: add null-safe guards for runtime text normalization paths so malformed/undefined text payloads do not crash mention stripping or mrkdwn conversion. (#31865) Thanks @stone-jin. - Feishu/Plugin sdk compatibility: add safe webhook default fallbacks when loading Feishu monitor state so mixed-version installs no longer crash if older `openclaw/plugin-sdk` builds omit webhook default constants. (#31606) - Feishu/group broadcast dispatch: add configurable multi-agent group broadcast dispatch with observer-session isolation, cross-account dedupe safeguards, and non-mention history buffering rules that avoid duplicate replay in broadcast/topic workflows. (#29575) Thanks @ohmyskyhigh. - Gateway/Subagent TLS pairing: allow authenticated local `gateway-client` backend self-connections to skip device pairing while still requiring pairing for non-local/direct-host paths, restoring `sessions_spawn` with `gateway.tls.enabled=true` in Docker/LAN setups. Fixes #30740. Thanks @Sid-Qin and @vincentkoc. - Browser/CDP startup diagnostics: include Chrome stderr output and a Linux no-sandbox hint in startup timeout errors so failed launches are easier to diagnose. (#29312) Thanks @veast. - Synology Chat/webhook ingress hardening: enforce bounded body reads (size + timeout) via shared request-body guards to prevent unauthenticated slow-body hangs before token validation. (#25831) Thanks @bmendonca3. - Feishu/Dedup restart resilience: warm persistent dedup state into memory on monitor startup so retry events after gateway restart stay suppressed without requiring initial on-disk probe misses. (#31605) - Voice-call/runtime lifecycle: prevent `EADDRINUSE` loops by resetting failed runtime promises, making webhook `start()` idempotent with the actual bound port, and fully cleaning up webhook/tunnel/tailscale resources after startup failures. (#32395) Thanks @scoootscooob. - Gateway/Security hardening: tie loopback-origin dev allowance to actual local socket clients (not Host header claims), add explicit warnings/metrics when `gateway.controlUi.dangerouslyAllowHostHeaderOriginFallback` accepts websocket origins, harden safe-regex detection for quantified ambiguous alternation patterns (for example `(a|aa)+`), and bound large regex-evaluation inputs for session-filter and log-redaction paths. - Gateway/Plugin HTTP hardening: require explicit `auth` for plugin route registration, add route ownership guards for duplicate `path+match` registrations, centralize plugin path matching/auth logic into dedicated modules, and share webhook target-route lifecycle wiring across channel monitors to avoid stale or conflicting registrations. Thanks @tdjackey for reporting. - Browser/Profile defaults: prefer `openclaw` profile over `chrome` in headless/no-sandbox environments unless an explicit `defaultProfile` is configured. (#14944) Thanks @BenediktSchackenberg. - Gateway/WS security: keep plaintext `ws://` loopback-only by default, with explicit break-glass private-network opt-in via `OPENCLAW_ALLOW_INSECURE_PRIVATE_WS=1`; align onboarding/client/call validation and tests to this strict-default policy. (#28670) Thanks @dashed, @vincentkoc. - OpenAI Codex OAuth/TLS prerequisites: add an OAuth TLS cert-chain preflight with actionable remediation for cert trust failures, and gate doctor TLS prerequisite probing to OpenAI Codex OAuth-configured installs (or explicit `doctor --deep`) to avoid unconditional outbound probe latency. (#32051) Thanks @alexfilatov. - Security/Webhook request hardening: enforce auth-before-body parsing for BlueBubbles and Google Chat webhook handlers, add strict pre-auth body/time budgets for webhook auth paths (including LINE signature verification), and add shared in-flight/request guardrails plus regression tests/lint checks to prevent reintroducing unauthenticated slow-body DoS patterns. Thanks @GCXWLP for reporting. - CLI/Config validation and routing hardening: dedupe `openclaw config validate` failures to a single authoritative report, expose allowed-values metadata/hints across core Zod and plugin AJV validation (including `--json` fields), sanitize terminal-rendered validation text, and make command-path parsing root-option-aware across preaction/route/lazy registration (including routed `config get/unset` with split root options). Thanks @gumadeiras. - Browser/Extension relay reconnect tolerance: keep `/json/version` and `/cdp` reachable during short MV3 worker disconnects when attached targets still exist, and retain clients across reconnect grace windows. (#30232) Thanks @Sid-Qin. - CLI/Browser start timeout: honor `openclaw browser --timeout <ms> start` and stop by removing the fixed 15000ms override so slower Chrome startups can use caller-provided timeouts. (#22412, #23427) Thanks @vincentkoc. - Synology Chat/gateway lifecycle: keep `startAccount` pending until abort for inactive and active account paths to prevent webhook route restart loops under gateway supervision. (#23074) Thanks @druide67. - Exec approvals/allowlist matching: escape regex metacharacters in path-pattern literals (while preserving glob wildcards), preventing crashes on allowlisted executables like `/usr/bin/g++` and correctly matching mixed wildcard/literal token paths. (#32162) Thanks @stakeswky. - Synology Chat/webhook compatibility: accept JSON and alias payload fields, allow token resolution from body/query/header sources, and ACK webhook requests with `204` to avoid persistent `Processing...` states in Synology Chat clients. (#26635) Thanks @memphislee09-source. - Voice-call/Twilio signature verification: retry signature validation across deterministic URL port variants (with/without port) to handle mixed Twilio signing behavior behind reverse proxies and non-standard ports. (#25140) Thanks @drvoss. - Slack/Bolt startup compatibility: remove invalid `message.channels` and `message.groups` event registrations so Slack providers no longer crash on startup with Bolt 4.6+; channel/group traffic continues through the unified `message` handler (`channel_type`). (#32033) Thanks @mahopan. - Slack/socket auth failure handling: fail fast on non-recoverable auth errors (`account_inactive`, `invalid_auth`, etc.) during startup and reconnect instead of retry-looping indefinitely, including `unable_to_socket_mode_start` error payload propagation. (#32377) Thanks @scoootscooob. - Gateway/macOS LaunchAgent hardening: write `Umask=077` in generated gateway LaunchAgent plists so npm upgrades preserve owner-only default file permissions for gateway-created state files. (#31919) Fixes #31905. Thanks @liuxiaopai-ai. - macOS/LaunchAgent security defaults: write `Umask=63` (octal `077`) into generated gateway launchd plists so post-update service reinstalls keep owner-only file permissions by default instead of falling back to system `022`. (#32022) Fixes #31905. Thanks @liuxiaopai-ai. - Media understanding/provider HTTP proxy routing: pass a proxy-aware fetch function from `HTTPS_PROXY`/`HTTP_PROXY` env vars into audio/video provider calls (with graceful malformed-proxy fallback) so transcription/video requests honor configured outbound proxies. (#27093) Thanks @mcaxtr. - Sandbox/workspace mount permissions: make primary `/workspace` bind mounts read-only whenever `workspaceAccess` is not `rw` (including `none`) across both core sandbox container and sandbox browser create flows. (#32227) Thanks @guanyu-zhang. - Tools/fsPolicy propagation: honor `tools.fs.workspaceOnly` for image/pdf local-root allowlists so non-sandbox media paths outside workspace are rejected when workspace-only mode is enabled. (#31882) Thanks @justinhuangcode. - Daemon/Homebrew runtime pinning: resolve Homebrew Cellar Node paths to stable Homebrew-managed symlinks (including versioned formulas like `node@22`) so gateway installs keep the intended runtime across brew upgrades. (#32185) Thanks @scoootscooob. - Browser/Security output boundary hardening: replace check-then-rename output commits with root-bound fd-verified writes, unify install/skills canonical path-boundary checks, and add regression coverage for symlink-rebind race paths across browser output and shared fs-safe write flows. Thanks @tdjackey for reporting. - Gateway/Security canonicalization hardening: decode plugin route path variants to canonical fixpoint (with bounded depth), fail closed on canonicalization anomalies, and enforce gateway auth for deeply encoded `/api/channels/*` variants to prevent alternate-path auth bypass through plugin handlers. Thanks @tdjackey for reporting. - Browser/Gateway hardening: preserve env credentials for `OPENCLAW_GATEWAY_URL` / `CLAWDBOT_GATEWAY_URL` while treating explicit `--url` as override-only auth, and make container browser hardening flags optional with safer defaults for Docker/LXC stability. (#31504) Thanks @vincentkoc. - Gateway/Control UI basePath webhook passthrough: let non-read methods under configured `controlUiBasePath` fall through to plugin routes (instead of returning Control UI 405), restoring webhook handlers behind basePath mounts. (#32311) Thanks @ademczuk. - Control UI/Legacy browser compatibility: replace `toSorted`-dependent cron suggestion sorting in `app-render` with a compatibility helper so older browsers without `Array.prototype.toSorted` no longer white-screen. (#31775) Thanks @liuxiaopai-ai. - macOS/PeekabooBridge: add compatibility socket symlinks for legacy `clawdbot`, `clawdis`, and `moltbot` Application Support socket paths so pre-rename clients can still connect. (#6033) Thanks @lumpinif and @vincentkoc. - Gateway/message tool reliability: avoid false `Unknown channel` failures when `message.*` actions receive platform-specific channel ids by falling back to `toolContext.currentChannelProvider`, and prevent health-monitor restart thrash for channels that just (re)started by adding a per-channel startup-connect grace window. (from #32367) Thanks @MunemHashmi. - Windows/Spawn canonicalization: unify non-core Windows spawn handling across ACP client, QMD/mcporter memory paths, and sandbox Docker execution using the shared wrapper-resolution policy, with targeted regression coverage for `.cmd` shim unwrapping and shell fallback behavior. (#31750) Thanks @Takhoffman. - Security/ACP sandbox inheritance: enforce fail-closed runtime guardrails for `sessions_spawn` with `runtime="acp"` by rejecting ACP spawns from sandboxed requester sessions and rejecting `sandbox="require"` for ACP runtime, preventing sandbox-boundary bypass via host-side ACP initialization. (#32254) Thanks @tdjackey for reporting, and @dutifulbob for the fix. - Security/Web tools SSRF guard: keep DNS pinning for untrusted `web_fetch` and citation-redirect URL checks when proxy env vars are set, and require explicit dangerous opt-in before env-proxy routing can bypass pinned dispatch for trusted/operator-controlled endpoints. Thanks @tdjackey for reporting. - Gemini schema sanitization: coerce malformed JSON Schema `properties` values (`null`, arrays, primitives) to `{}` before provider validation, preventing downstream strict-validator crashes on invalid plugin/tool schemas. (#32332) Thanks @webdevtodayjason. - Media understanding/malformed attachment guards: harden attachment selection and decision summary formatting against non-array or malformed attachment payloads to prevent runtime crashes on invalid inbound metadata shapes. (#28024) Thanks @claw9267. - Browser/Extension navigation reattach: preserve debugger re-attachment when relay is temporarily disconnected by deferring relay attach events until reconnect/re-announce, reducing post-navigation tab loss. (#28725) Thanks @stone-jin. - Browser/Extension relay stale tabs: evict stale cached targets from `/json/list` when extension targets are destroyed/crashed or commands fail with missing target/session errors. (#6175) Thanks @vincentkoc. - Browser/CDP startup readiness: wait for CDP websocket readiness after launching Chrome and cleanly stop/reset when readiness never arrives, reducing follow-up `PortInUseError` races after `browser start`/`open`. (#29538) Thanks @AaronWander. - OpenAI/Responses WebSocket tool-call id hygiene: normalize blank/whitespace streamed tool-call ids before persistence, and block empty `function_call_output.call_id` payloads in the WS conversion path to avoid OpenAI 400 errors (`Invalid 'input[n].call_id': empty string`), with regression coverage for both inbound stream normalization and outbound payload guards. - Security/Nodes camera URL downloads: bind node `camera.snap`/`camera.clip` URL payload downloads to the resolved node host, enforce fail-closed behavior when node `remoteIp` is unavailable, and use SSRF-guarded fetch with redirect host/protocol checks to prevent off-node fetch pivots. Thanks @tdjackey for reporting. - Config/backups hardening: enforce owner-only (`0600`) permissions on rotated config backups and clean orphan `.bak.*` files outside the managed backup ring, reducing credential leakage risk from stale or permissive backup artifacts. (#31718) Thanks @YUJIE2002. - Telegram/inbound media filenames: preserve original `file_name` metadata for document/audio/video/animation downloads (with fetch/path fallbacks), so saved inbound attachments keep sender-provided names instead of opaque Telegram file paths. (#31837) Thanks @Kay-051. - Gateway/OpenAI chat completions: honor `x-openclaw-message-channel` when building `agentCommand` input for `/v1/chat/completions`, preserving caller channel identity instead of forcing `webchat`. (#30462) Thanks @bmendonca3. - Plugin SDK/runtime hardening: add package export verification in CI/release checks to catch missing runtime exports before publish-time regressions. (#28575) Thanks @Glucksberg. - Media/MIME normalization: normalize parameterized/case-variant MIME strings in `kindFromMime` (for example `Audio/Ogg; codecs=opus`) so WhatsApp voice notes are classified as audio and routed through transcription correctly. (#32280) Thanks @Lucenx9. - Discord/audio preflight mentions: detect audio attachments via Discord `content_type` and gate preflight transcription on typed text (not media placeholders), so guild voice-note mentions are transcribed and matched correctly. (#32136) Thanks @jnMetaCode. - Feishu/topic session routing: use `thread_id` as topic session scope fallback when `root_id` is absent, keep first-turn topic keys stable across thread creation, and force thread replies when inbound events already carry topic/thread context. (#29788) Thanks @songyaolun. - Gateway/Webchat NO_REPLY streaming: suppress assistant lead-fragment deltas that are prefixes of `NO_REPLY` and keep final-message buffering in sync, preventing partial `NO` leaks on silent-response runs while preserving legitimate short replies. (#32073) Thanks @liuxiaopai-ai. - Telegram/models picker callbacks: keep long model buttons selectable by falling back to compact callback payloads and resolving provider ids on selection (with provider re-prompt on ambiguity), avoiding Telegram 64-byte callback truncation failures. (#31857) Thanks @bmendonca3. - Context-window metadata warmup: add exponential config-load retry backoff (1s -> 2s -> 4s, capped at 60s) so transient startup failures recover automatically without hot-loop retries. - Voice-call/Twilio external outbound: auto-register webhook-first `outbound-api` calls (initiated outside OpenClaw) so media streams are accepted and call direction metadata stays accurate. (#31181) Thanks @scoootscooob. - Feishu/topic root replies: prefer `root_id` as outbound `replyTargetMessageId` when present, and parse millisecond `message_create_time` values correctly so topic replies anchor to the root message in grouped thread flows. (#29968) Thanks @bmendonca3. - Feishu/DM pairing reply target: send pairing challenge replies to `chat:<chat_id>` instead of `user:<sender_open_id>` so Lark/Feishu private chats with user-id-only sender payloads receive pairing messages reliably. (#31403) Thanks @stakeswky. - Feishu/Lark private DM routing: treat inbound `chat_type: "private"` as direct-message context for pairing/mention-forward/reaction synthetic handling so Lark private chats behave like Feishu p2p DMs. (#31400) Thanks @stakeswky. - Signal/message actions: allow `react` to fall back to `toolContext.currentMessageId` when `messageId` is omitted, matching Telegram behavior and unblocking agent-initiated reactions on inbound turns. (#32217) Thanks @dunamismax. - Discord/message actions: allow `react` to fall back to `toolContext.currentMessageId` when `messageId` is omitted, matching Telegram/Signal reaction ergonomics in inbound turns. - Synology Chat/reply delivery: resolve webhook usernames to Chat API `user_id` values for outbound chatbot replies, avoiding mismatches between webhook user IDs and `method=chatbot` recipient IDs in multi-account setups. (#23709) Thanks @druide67. - Slack/thread context payloads: only inject thread starter/history text on first thread turn for new sessions while preserving thread metadata, reducing repeated context-token bloat on long-lived thread sessions. (#32133) Thanks @sourman. - Slack/session routing: keep top-level channel messages in one shared session when `replyToMode=off`, while preserving thread-scoped keys for true thread replies and non-off modes. (#32193) Thanks @bmendonca3. - Voice-call/webhook routing: require exact webhook path matches (instead of prefix matches) so lookalike paths cannot reach provider verification/dispatch logic. (#31930) Thanks @afurm. - Zalo/Pairing auth tests: add webhook regression coverage asserting DM pairing-store reads/writes remain account-scoped, preventing cross-account authorization bleed in multi-account setups. (#26121) Thanks @bmendonca3. - Zalouser/Pairing auth tests: add account-scoped DM pairing-store regression coverage (`monitor.account-scope.test.ts`) to prevent cross-account allowlist bleed in multi-account setups. (#26672) Thanks @bmendonca3. - Feishu/Send target prefixes: normalize explicit `group:`/`dm:` send targets and preserve explicit receive-id routing hints when resolving outbound Feishu targets. (#31594) Thanks @liuxiaopai-ai. - Webchat/Feishu session continuation: preserve routable `OriginatingChannel`/`OriginatingTo` metadata from session delivery context in `chat.send`, and prefer provider-normalized channel when deciding cross-channel route dispatch so Webchat replies continue on the selected Feishu session instead of falling back to main/internal session routing. (#31573) - Telegram/implicit mention forum handling: exclude Telegram forum system service messages (`forum_topic_*`, `general_forum_topic_*`) from reply-chain implicit mention detection so `requireMention` does not get bypassed inside bot-created topic lifecycle events. (#32262) Thanks @scoootscooob. - Slack/inbound debounce routing: isolate top-level non-DM message debounce keys by message timestamp to avoid cross-thread collisions, preserve DM batching, and flush pending top-level buffers before immediate non-debounce follow-ups to keep ordering stable. (#31951) Thanks @scoootscooob. - Feishu/Duplicate replies: suppress same-target reply dispatch when message-tool sends use generic provider metadata (`provider: "message"`) and normalize `lark`/`feishu` provider aliases during duplicate-target checks, preventing double-delivery in Feishu sessions. (#31526) - Webchat/silent token leak: filter assistant `NO_REPLY`-only transcript entries from `chat.history` responses and add client-side defense-in-depth guards in the chat controller so internal silent tokens never render as visible chat bubbles. (#32015) Consolidates overlap from #32183, #32082, #32045, #32052, #32172, and #32112. Thanks @ademczuk, @liuxiaopai-ai, @ningding97, @bmendonca3, and @x4v13r1120. - Doctor/local memory provider checks: stop false-positive local-provider warnings when `provider=local` and no explicit `modelPath` is set by honoring default local model fallback while still warning when gateway probe reports local embeddings not ready. (#32014) Fixes #31998. Thanks @adhishthite. - Media understanding/parakeet CLI output parsing: read `parakeet-mlx` transcripts from `--output-dir/<media-basename>.txt` when txt output is requested (or default), with stdout fallback for non-txt formats. (#9177) Thanks @mac-110. - Media understanding/audio transcription guard: skip tiny/empty audio files (<1024 bytes) before provider/CLI transcription to avoid noisy invalid-audio failures and preserve clean fallback behavior. (#8388) Thanks @Glucksberg. - Gateway/Plugin HTTP route precedence: run explicit plugin HTTP routes before the Control UI SPA catch-all so registered plugin webhook/custom paths remain reachable, while unmatched paths still fall through to Control UI handling. (#31885) Thanks @Sid-Qin. - Gateway/Node browser proxy routing: honor `profile` from `browser.request` JSON body when query params omit it, while preserving query-profile precedence when both are present. (#28852) Thanks @Sid-Qin. - Gateway/Control UI basePath POST handling: return 405 for `POST` on exact basePath routes (for example `/openclaw`) instead of redirecting, and add end-to-end regression coverage that root-mounted webhook POST paths still pass through to plugin handlers. (#31349) Thanks @Sid-Qin. - Browser/default profile selection: default `browser.defaultProfile` behavior now prefers `openclaw` (managed standalone CDP) when no explicit default is configured, while still auto-provisioning the `chrome` relay profile for explicit opt-in use. (#32031) Fixes #31907. Thanks @liuxiaopai-ai. - Sandbox/mkdirp boundary checks: allow existing in-boundary directories to pass mkdirp boundary validation when directory open probes return platform-specific I/O errors, with regression coverage for directory-safe fallback behavior. (#31547) Thanks @stakeswky. - Models/config env propagation: apply `config.env.vars` before implicit provider discovery in models bootstrap so config-scoped credentials are visible to implicit provider resolution paths. (#32295) Thanks @hsiaoa. - Models/Codex usage labels: infer weekly secondary usage windows from reset cadence when API window seconds are ambiguously reported as 24h, so `openclaw models status` no longer mislabels weekly limits as daily. (#31938) Thanks @bmendonca3. - Gateway/Heartbeat model reload: treat `models.*` and `agents.defaults.model` config updates as heartbeat hot-reload triggers so heartbeat picks up model changes without a full gateway restart. (#32046) Thanks @stakeswky. - Memory/LanceDB embeddings: forward configured `embedding.dimensions` into OpenAI embeddings requests so vector size and API output dimensions stay aligned when dimensions are explicitly configured. (#32036) Thanks @scotthuang. - Gateway/Control UI method guard: allow POST requests to non-UI routes to fall through when no base path is configured, and add POST regression coverage for fallthrough and base-path 405 behavior. (#23970) Thanks @tyler6204. - Browser/CDP status accuracy: require a successful `Browser.getVersion` response over the CDP websocket (not just socket-open) before reporting `cdpReady`, so stale idle command channels are surfaced as unhealthy. (#23427) Thanks @vincentkoc. - Daemon/systemd checks in containers: treat missing `systemctl` invocations (including `spawn systemctl ENOENT`/`EACCES`) as unavailable service state during `is-enabled` checks, preventing container flows from failing with `Gateway service check failed` before install/status handling can continue. (#26089) Thanks @sahilsatralkar and @vincentkoc. - Security/Node exec approvals: revalidate approval-bound `cwd` identity immediately before execution/forwarding and fail closed with an explicit denial when `cwd` drifts after approval hardening. - Security audit/skills workspace hardening: add `skills.workspace.symlink_escape` warning in `openclaw security audit` when workspace `skills/**/SKILL.md` resolves outside the workspace root (for example symlink-chain drift), plus docs coverage in the security glossary. - Security/Node exec approvals: preserve shell/dispatch-wrapper argv semantics during approval hardening so approved wrapper commands (for example `env sh -c ...`) cannot drift into a different runtime command shape, and add regression coverage for both approval-plan generation and approved runtime execution paths. Thanks @tdjackey for reporting. - Security/fs-safe write hardening: make `writeFileWithinRoot` use same-directory temp writes plus atomic rename, add post-write inode/hardlink revalidation with security warnings on boundary drift, and avoid truncating existing targets when final rename fails. - Security/Skills archive extraction: unify tar extraction safety checks across tar.gz and tar.bz2 install flows, enforce tar compressed-size limits, and fail closed if tar.bz2 archives change between preflight and extraction to prevent bypasses of entry-type/size guardrails. Thanks @GCXWLP for reporting. - Security/Prompt spoofing hardening: stop injecting queued runtime events into user-role prompt text, route them through trusted system-prompt context, and neutralize inbound spoof markers like `[System Message]` and line-leading `System:` in untrusted message content. (#30448) - Sandbox/Docker setup command parsing: accept `agents.*.sandbox.docker.setupCommand` as either a string or a string array, and normalize arrays to newline-delimited shell scripts so multi-step setup commands no longer concatenate without separators. (#31953) Thanks @liuxiaopai-ai. - Sandbox/Bootstrap context boundary hardening: reject symlink/hardlink alias bootstrap seed files that resolve outside the source workspace and switch post-compaction `AGENTS.md` context reads to boundary-verified file opens, preventing host file content from being injected via workspace aliasing. Thanks @tdjackey for reporting. - Agents/Sandbox workdir mapping: map container workdir paths (for example `/workspace`) back to the host workspace before sandbox path validation so exec requests keep the intended directory in containerized runs instead of falling back to an unavailable host path. (#31841) Thanks @liuxiaopai-ai. - Docker/Sandbox bootstrap hardening: make `OPENCLAW_SANDBOX` opt-in parsing explicit (`1|true|yes|on`), support custom Docker socket paths via `OPENCLAW_DOCKER_SOCKET`, defer docker.sock exposure until sandbox prerequisites pass, and reset/roll back persisted sandbox mode to `off` when setup is skipped or partially fails to avoid stale broken sandbox state. (#29974) Thanks @jamtujest and @vincentkoc. - Hooks/webhook ACK compatibility: return `200` (instead of `202`) for successful `/hooks/agent` requests so providers that require `200` (for example Forward Email) accept dispatched agent hook deliveries. (#28204) Thanks @Glucksberg. - Feishu/Run channel fallback: prefer `Provider` over `Surface` when inferring queued run `messageProvider` fallback (when `OriginatingChannel` is missing), preventing Feishu turns from being mislabeled as `webchat` in mixed relay metadata contexts. (#31880) Fixes #31859. Thanks @liuxiaopai-ai. - Skills/sherpa-onnx-tts: run the `sherpa-onnx-tts` bin under ESM (replace CommonJS `require` imports) and add regression coverage to prevent `require is not defined in ES module scope` startup crashes. (#31965) Thanks @bmendonca3. - Inbound metadata/direct relay context: restore direct-channel conversation metadata blocks for external channels (for example WhatsApp) while preserving webchat-direct suppression, so relay agents recover sender/message identifiers without reintroducing internal webchat metadata noise. (#31969) Fixes #29972. Thanks @Lucenx9. - Slack/Channel message subscriptions: register explicit `message.channels` and `message.groups` monitor handlers (alongside generic `message`) so channel/group event subscriptions are consumed even when Slack dispatches typed message event names. Fixes #31674. - Hooks/session-scoped memory context: expose ephemeral `sessionId` in embedded plugin tool contexts and `before_tool_call`/`after_tool_call` hook contexts (including compaction and client-tool wiring) so plugins can isolate per-conversation state across `/new` and `/reset`. Related #31253 and #31304. Thanks @Sid-Qin and @Servo-AIpex. - Voice-call/Twilio inbound greeting: run answered-call initial notify greeting for Twilio instead of skipping the manager speak path, with regression coverage for both Twilio and Plivo notify flows. (#29121) Thanks @xinhuagu. - Voice-call/stale call hydration: verify active calls with the provider before loading persisted in-progress calls so stale locally persisted records do not block or misroute new call handling after restarts. (#4325) Thanks @garnetlyx. - Feishu/File upload filenames: percent-encode non-ASCII/special-character `file_name` values in Feishu multipart uploads so Chinese/symbol-heavy filenames are sent as proper attachments instead of plain text links. (#31179) Thanks @Kay-051. - Media/MIME channel parity: route Telegram/Signal/iMessage media-kind checks through normalized `kindFromMime` so mixed-case/parameterized MIME values classify consistently across message channels. - WhatsApp/inbound self-message context: propagate inbound `fromMe` through the web inbox pipeline and annotate direct self messages as `(self)` in envelopes so agents can distinguish owner-authored turns from contact turns. (#32167) Thanks @scoootscooob. - Webchat/stream finalization: persist streamed assistant text when final events omit `message`, while keeping final payload precedence and skipping empty stream buffers to prevent disappearing replies after tool turns. (#31920) Thanks @Sid-Qin. - Feishu/Inbound ordering: serialize message handling per chat while preserving cross-chat concurrency to avoid same-chat race drops under bursty inbound traffic. (#31807) - Feishu/Typing notification suppression: skip typing keepalive reaction re-adds when the indicator is already active, preventing duplicate notification pings from repeated identical emoji adds. (#31580) - Feishu/Probe failure backoff: cache API and timeout probe failures for one minute per account key while preserving abort-aware probe timeouts, reducing repeated health-check retries during transient credential/network outages. (#29970) - Feishu/Streaming block fallback: preserve markdown block stream text as final streaming-card content when final payload text is missing, while still suppressing non-card internal block chunk delivery. (#30663) - Feishu/Bitable API errors: unify Feishu Bitable tool error handling with structured `LarkApiError` responses and consistent API/context attribution across wiki/base metadata, field, and record operations. (#31450) - Feishu/Missing-scope grant URL fix: rewrite known invalid scope aliases (`contact:contact.base:readonly`) to valid scope names in permission grant links, so remediation URLs open with correct Feishu consent scopes. (#31943) - BlueBubbles/Message metadata: harden send response ID extraction, include sender identity in DM context, and normalize inbound `message_id` selection to avoid duplicate ID metadata. (#23970) Thanks @tyler6204. - WebChat/markdown tables: ensure GitHub-flavored markdown table parsing is explicitly enabled at render time and add horizontal overflow handling for wide tables, with regression coverage for table-only and mixed text+table content. (#32365) Thanks @BlueBirdBack. - Feishu/default account resolution: always honor explicit `channels.feishu.defaultAccount` during outbound account selection (including top-level-credential setups where the preferred id is not present in `accounts`), instead of silently falling back to another account id. (#32253) Thanks @bmendonca3. - Feishu/Sender lookup permissions: suppress user-facing grant prompts for stale non-existent scope errors (`contact:contact.base:readonly`) during best-effort sender-name resolution so inbound messages continue without repeated false permission notices. (#31761) - Discord/dispatch + Slack formatting: restore parallel outbound dispatch across Discord channels with per-channel queues while preserving in-channel ordering, and run Slack preview/stream update text through mrkdwn normalization for consistent formatting. (#31927) Thanks @Sid-Qin. - Feishu/Inbound debounce: debounce rapid same-chat sender bursts into one ordered dispatch turn, skip already-processed retries when composing merged text, and preserve bot-mention intent across merged entries to reduce duplicate or late inbound handling. (#31548) - Tests/Sandbox + archive portability: use junction-compatible directory-link setup on Windows and explicit file-symlink platform guards in symlink escape tests where unprivileged file symlinks are unavailable, reducing false Windows CI failures while preserving traversal checks on supported paths. (#28747) Thanks @arosstale. - Browser/Extension re-announce reliability: keep relay state in `connecting` when re-announce forwarding fails and extend debugger re-attach retries after navigation to reduce false attached states and post-nav disconnect loops. (#27630) Thanks @markmusson. - Browser/Act request compatibility: accept legacy flattened `action="act"` params (`kind/ref/text/...`) in addition to `request={...}` so browser act calls no longer fail with `request required`. (#15120) Thanks @vincentkoc. - OpenRouter/x-ai compatibility: skip `reasoning.effort` injection for `x-ai/*` models (for example Grok) so OpenRouter requests no longer fail with invalid-arguments errors on unsupported reasoning params. (#32054) Thanks @scoootscooob. - Models/openai-completions developer-role compatibility: force `supportsDeveloperRole=false` for non-native endpoints, treat unparseable `baseUrl` values as non-native, and add regression coverage for empty/malformed baseUrl plus explicit-true override behavior. (#29479) thanks @akramcodez. - Browser/Profile attach-only override: support `browser.profiles.<name>.attachOnly` (fallback to global `browser.attachOnly`) so loopback proxy profiles can skip local launch/port-ownership checks without forcing attach-only mode for every profile. (#20595) Thanks @unblockedgamesstudio and @vincentkoc. - Sessions/Lock recovery: detect recycled Linux PIDs by comparing lock-file `starttime` with `/proc/<pid>/stat` starttime, so stale `.jsonl.lock` files are reclaimed immediately in containerized PID-reuse scenarios while preserving compatibility for older lock files. (#26443) Fixes #27252. Thanks @HirokiKobayashi-R and @vincentkoc. - Cron/isolated delivery target fallback: remove early unresolved-target return so cron delivery can flow through shared outbound target resolution (including per-channel `resolveDefaultTo` fallback) when `delivery.to` is omitted. (#32364) Thanks @hclsys. - OpenAI media capabilities: include `audio` in the OpenAI provider capability list so audio transcription models are eligible in media-understanding provider selection. (#12717) Thanks @openjay. - Browser/Managed tab cap: limit loopback managed `openclaw` page tabs to 8 via best-effort cleanup after tab opens to reduce long-running renderer buildup while preserving attach-only and remote profile behavior. (#29724) Thanks @pandego. - Docker/Image health checks: add Dockerfile `HEALTHCHECK` that probes gateway `GET /healthz` so container runtimes can mark unhealthy instances without requiring auth credentials in the probe command. (#11478) Thanks @U-C4N and @vincentkoc. - Gateway/Node dangerous-command parity: include `sms.send` in default onboarding node `denyCommands`, share onboarding deny defaults with the gateway dangerous-command source of truth, and include `sms.send` in phone-control `/phone arm writes` handling so SMS follows the same break-glass flow as other dangerous node commands. Thanks @zpbrent. - Pairing/AllowFrom account fallback: handle omitted `accountId` values in `readChannelAllowFromStore` and `readChannelAllowFromStoreSync` as `default`, while preserving legacy unscoped allowFrom merges for default-account flows. Thanks @Sid-Qin and @vincentkoc. - Browser/Remote CDP ownership checks: skip local-process ownership errors for non-loopback remote CDP profiles when HTTP is reachable but the websocket handshake fails, and surface the remote websocket attach/retry path instead. (#15582) Landed from contributor (#28780) Thanks @stubbi, @bsormagec, @unblockedgamesstudio and @vincentkoc. - Browser/CDP proxy bypass: force direct loopback agent paths and scoped `NO_PROXY` expansion for localhost CDP HTTP/WS connections when proxy env vars are set, so browser relay/control still works behind global proxy settings. (#31469) Thanks @widingmarcus-cyber. - Sessions/idle reset correctness: preserve existing `updatedAt` during inbound metadata-only writes so idle-reset boundaries are not unintentionally refreshed before actual user turns. (#32379) Thanks @romeodiaz. - Sessions/lock recovery: reclaim orphan legacy same-PID lock files missing `starttime` when no in-process lock ownership exists, avoiding false lock timeouts after PID reuse while preserving active lock safety checks. (#32081) Thanks @bmendonca3. - Sessions/store cache invalidation: reload cached session stores when file size changes within the same mtime tick by keying cache validation on a single file-stat snapshot (`mtimeMs` + `sizeBytes`), with regression coverage for same-tick rewrites. (#32191) Thanks @jalehman. - Agents/Subagents `sessions_spawn`: reject malformed `agentId` inputs before normalization (for example error-message/path-like strings) to prevent unintended synthetic agent IDs and ghost workspace/session paths; includes strict validation regression coverage. (#31381) Thanks @openperf. - CLI/installer Node preflight: enforce Node.js `v22.12+` consistently in both `openclaw.mjs` runtime bootstrap and installer active-shell checks, with actionable nvm recovery guidance for mismatched shell PATH/defaults. (#32356) Thanks @jasonhargrove. - Web UI/config form: support SecretInput string-or-secret-ref unions in map `additionalProperties`, so provider API key fields stay editable instead of being marked unsupported. (#31866) Thanks @ningding97. - Auto-reply/inline command cleanup: preserve newline structure when stripping inline `/status` and extracting inline slash commands by collapsing only horizontal whitespace, preventing paragraph flattening in multi-line replies. (#32224) Thanks @scoootscooob. - Config/raw redaction safety: preserve non-sensitive literals during raw redaction round-trips, scope SecretRef redaction to secret IDs (not structural fields like `source`/`provider`), and fall back to structured raw redaction when text replacement cannot restore the original config shape. (#32174) Thanks @bmendonca3. - Hooks/runtime stability: keep the internal hook handler registry on a `globalThis` singleton so hook registration/dispatch remains consistent when bundling emits duplicate module copies. (#32292) Thanks @Drickon. - Hooks/after_tool_call: include embedded session context (`sessionKey`, `agentId`) and fire the hook exactly once per tool execution by removing duplicate adapter-path dispatch in embedded runs. (#32201) Thanks @jbeno, @scoootscooob, @vincentkoc. - Hooks/tool-call correlation: include `runId` and `toolCallId` in plugin tool hook payloads/context and scope tool start/adjusted-param tracking by run to prevent cross-run collisions in `before_tool_call` and `after_tool_call`. (#32360) Thanks @vincentkoc. - Plugins/install diagnostics: reject legacy plugin package shapes without `openclaw.extensions` and return an explicit upgrade hint with troubleshooting docs for repackaging. (#32055) Thanks @liuxiaopai-ai. - Hooks/plugin context parity: ensure `llm_input` hooks in embedded attempts receive the same `trigger` and `channelId`-aware `hookCtx` used by the other hook phases, preserving channel/trigger-scoped plugin behavior. (#28623) Thanks @davidrudduck and @vincentkoc. - Plugins/hardlink install compatibility: allow bundled plugin manifests and entry files to load when installed via hardlink-based package managers (`pnpm`, `bun`) while keeping hardlink rejection enabled for non-bundled plugin sources. (#32119) Fixes #28175, #28404, #29455. Thanks @markfietje. - Cron/session reaper reliability: move cron session reaper sweeps into `onTimer` `finally` and keep pruning active even when timer ticks fail early (for example cron store parse failures), preventing stale isolated run sessions from accumulating indefinitely. (#31996) Fixes #31946. Thanks @scoootscooob. - Cron/HEARTBEAT_OK summary leak: suppress fallback main-session enqueue for heartbeat/internal ack summaries in isolated announce mode so `HEARTBEAT_OK` noise never appears in user chat while real summaries still forward. (#32093) Thanks @scoootscooob. - Authentication: classify `permission_error` as `auth_permanent` for profile fallback. (#31324) Thanks @Sid-Qin. - Agents/host edit reliability: treat host edit-tool throws as success only when on-disk post-check confirms replacement likely happened (`newText` present and `oldText` absent), preventing false failure reports while avoiding pre-write false positives. (#32383) Thanks @polooooo. - Plugins/install fallback safety: resolve bare install specs to bundled plugin ids before npm lookup (for example `diffs` -> bundled `@openclaw/diffs`), keep npm fallback limited to true package-not-found errors, and continue rejecting non-plugin npm packages that fail manifest validation. (#32096) Thanks @scoootscooob. - Web UI/inline code copy fidelity: disable forced mid-token wraps on inline `<code>` spans so copied UUID/hash/token strings preserve exact content instead of inserting line-break spaces. (#32346) Thanks @hclsys. - Restart sentinel formatting: avoid duplicate `Reason:` lines when restart message text already matches `stats.reason`, keeping restart notifications concise for users and downstream parsers. (#32083) Thanks @velamints2. - Auto-reply/followup queue: avoid stale callback reuse across idle-window restarts by caching the followup runner only when a drain actually starts, preserving enqueue ordering after empty-finalize paths. (#31902) Thanks @Lanfei. - Agents/tool-result guard: always clear pending tool-call state on interruptions even when synthetic tool results are disabled, preventing orphaned tool-use transcripts that cause follow-up provider request failures. (#32120) Thanks @jnMetaCode. - Failover/error classification: treat HTTP `529` (provider overloaded, common with Anthropic-compatible APIs) as `rate_limit` so model failover can engage instead of misclassifying the error path. (#31854) Thanks @bugkill3r. - Logging: use local time for logged timestamps instead of UTC, aligning log output with documented local timezone behavior and avoiding confusion during local diagnostics. (#28434) Thanks @liuy. - Agents/Subagent announce cleanup: keep completion-message runs pending while descendants settle, add a 30 minute hard-expiry backstop to avoid indefinite pending state, and keep retry bookkeeping resumable across deferred wakes. (#23970) Thanks @tyler6204. - Secrets/exec resolver timeout defaults: use provider `timeoutMs` as the default inactivity (`noOutputTimeoutMs`) watchdog for exec secret providers, preventing premature no-output kills for resolvers that start producing output after 2s. (#32235) Thanks @bmendonca3. - Auto-reply/reminder guard note suppression: when a turn makes reminder-like commitments but schedules no new cron jobs, suppress the unscheduled-reminder warning note only if an enabled cron already exists for the same session; keep warnings for unrelated sessions, disabled jobs, or unreadable cron store paths. (#32255) Thanks @scoootscooob. - Cron/isolated announce heartbeat suppression: treat multi-payload runs as skippable when any payload is a heartbeat ack token and no payload has media, preventing internal narration + trailing `HEARTBEAT_OK` from being delivered to users. (#32131) Thanks @adhishthite. - Cron/store migration: normalize legacy cron jobs with string `schedule` and top-level `command`/`timeout` fields into canonical schedule/payload/session-target shape on load, preventing schedule-error loops on old persisted stores. (#31926) Thanks @bmendonca3. - Tests/Windows backup rotation: skip chmod-only backup permission assertions on Windows while retaining compose/rotation/prune coverage across platforms to avoid false CI failures from Windows non-POSIX mode semantics. (#32286) Thanks @jalehman. - Tests/Subagent announce: set `OPENCLAW_TEST_FAST=1` before importing `subagent-announce` format suites so module-level fast-mode constants are captured deterministically on Windows CI, preventing timeout flakes in nested completion announce coverage. (#31370) Thanks @zwffff.