OpenClaw v2026.3.11-beta.1

### 安全 - **网关/WebSocket**：对所有浏览器发起的连接实施浏览器源验证，无论是否存在代理标头。这关闭了在 `trusted-proxy` 模式下可能授予不受信源 `operator.admin` 访问权限的跨站 WebSocket 劫持路径。(GHSA-5wcw-8jjv-m286) ### 变更 - **OpenRouter/models**：在内置目录中添加临时的 Hunter Alpha 和 Healer Alpha 条目，以便 OpenRouter 用户可以在这些免费隐形模型约一周的可用期内进行试用。(#43642) 感谢 @ping-Toven。 - **iOS/主画布**：添加一个包含实时代理概览的捆绑欢迎屏幕，该屏幕在连接、重连和返回前台时刷新，并将紧凑的连接胶囊从左上角画布覆盖层移开。(#42456) 感谢 @ngutman。 - **iOS/主画布**：用停靠的工具栏替换浮动控件，使捆绑的主支架适应更小的手机，并在已解析的主会话（而非合成的 `ios` 会话）中打开聊天。(#42456) 感谢 @ngutman。 - **macOS/聊天界面**：添加聊天模型选择器，在重新启动间持久化明确的思考级别选择，并为共享聊天编辑器强化提供程序感知的会话模型同步。(#42314) 感谢 @ImLukeF。 - **引导/Ollama**：添加一流的 Ollama 设置，支持“本地”或“云端+本地”模式，基于浏览器的云端登录，精选模型建议，以及跳过不必要本地拉取的云端模型处理。(#41529) 感谢 @BruceMacD。 - **OpenCode/引导**：添加新的 OpenCode Go 提供程序，在向导/文档中将 Zen 和 Go 视为一个 OpenCode 设置（同时保持运行时提供程序分离），为两个配置文件存储一个共享的 OpenCode 密钥，并停止覆盖内置的 `opencode-go` 目录路由。(#42313) 感谢 @ImLukeF 和 @vincentkoc。 - **记忆**：使用 Gemini `gemini-embedding-2-preview` 为 `memorySearch.extraPaths` 添加可选的多模态图像和音频索引，严格的回退门控以及基于范围的重新索引。(#43460) 感谢 @gumadeiras。 - **记忆/Gemini**：添加 `gemini-embedding-2-preview` 记忆搜索支持，支持可配置的输出维度，并在配置的维度更改时自动重新索引。(#42501) 感谢 @BillChirico 和 @gumadeiras。 - **macOS/引导**：检测远程网关何时需要共享身份验证令牌，解释如何在网关主机上找到它，并阐明成功的检查何时使用了配对设备身份验证而非其他方式。(#43100) 感谢 @ngutman。 - **Discord/自动线程**：为自动创建的线程添加 `autoArchiveDuration` 频道配置，使 Discord 线程归档可以保持为 1 小时、1 天、3 天或 1 周，而不是始终使用 1 小时的默认值。(#35065) 感谢 @davidguttman。 - **iOS/TestFlight**：添加带有 Fastlane 准备/归档/上传支持、规范测试版捆绑 ID 和手表应用归档修复的本地测试版发布流程。(#42991) 感谢 @ngutman。 - **ACP/sessions_spawn**：为 `runtime: "acp"` 添加可选的 `resumeSessionId`，以便生成的 ACP 会话可以恢复现有的 ACPX/Codex 对话，而不是总是全新开始。(#41847) 感谢 @pejmanjohn。 - **网关/节点待处理工作**：添加窄内存待处理工作队列原语 (`node.pending.enqueue` / `node.pending.drain`) 并重用唤醒助手，作为休眠节点工作传递的基础。(#41409) 感谢 @mbelinky。 - **Git/运行时状态**：忽略网关生成的 `.dev-state` 文件，以便本地运行时状态不会显示为未跟踪的仓库噪音。(#41848) 感谢 @smysle。 - **Exec/子命令**：使用 `OPENCLAW_CLI` 标记子命令环境，以便子进程可以检测它们是否是从 OpenClaw CLI 启动的。(#41411) 感谢 @vincentkoc。 ### 重大变更 - **Cron/doctor**：收紧隔离的 cron 传递，使 cron 作业不再能通过临时代理发送或回退主会话摘要进行通知，并为遗留 cron 存储和遗留通知/webhook 传递元数据添加 `openclaw doctor --fix` 迁移。(#40998) 感谢 @mbelinky。 ### 修复 - **代理/文本消毒**：从面向用户的助手文本中剥离泄漏的模型控制令牌 (`<|...|>` 和全角 `<｜...｜>` 变体)，防止 GLM-5 和 DeepSeek 内部分隔符到达最终用户。(#42173) 感谢 @imwyvern。 - **iOS/网关前台恢复**：在后台套接字被拆除后，于返回前台时立即重新连接，因此应用不再保持断开状态，直到稍后的唤醒路径发生。(#41384) 感谢 @mbelinky。 - **网关/控制界面**：将仪表板身份验证令牌保留在会话范围的浏览器存储中，以便同标签页刷新能保留远程令牌身份验证，而无需恢复长期存在的 localStorage 令牌持久性，同时将令牌范围限定于选定的网关 URL 和仅片段引导流程。(#40892) 感谢 @velvet-shark。 - **网关/macOS launchd 重启**：在显式重启期间保持 LaunchAgent 已注册，通过分离的 launchd 助手传递自重启，并在不卸载服务的情况下恢复配置/热重载重启路径。修复 #43311, #43406, #43035 和 #43049。 - **macOS/LaunchAgent 安装**：在安装期间收紧 LaunchAgent 目录和 plist 权限，以便当目标主路径或生成的 plist 继承了组/全局可写模式时，launchd 引导不会失败。 - **Discord/回复分块**：在实时回复路径中解析有效的 `maxLinesPerMessage` 配置，并在快速发送路径中保留 `chunkMode`，以便长的 Discord 回复不再在默认的 17 行限制处意外拆分。(#40133) 感谢 @rbutera。 - **飞书/本地图像自动转换**：通过 `sendText` 本地图像填充程序传递 `mediaLocalRoots`，以便允许的本地图像路径再次作为飞书图像上传，而不是回退到原始路径文本。(#40623) 感谢 @ayanesakura。 - **模型/Kimi 编码**：再次以原生 Anthropic 格式发送 `anthropic-messages` 工具，以便 `kimi-coding` 停止将工具调用降级为 XML/纯文本伪调用，而不是真正的 `tool_use` 块。(#38669, #39907, #40552) 感谢 @opriz。 - **Telegram/出站 HTML 发送**：对长 HTML 模式消息进行分块，在重试间保留纯文本回退和静默传递参数，并在 HTML 分块规划无法安全保留完整消息时切换到纯文本。(#42240) 感谢 @obviyus。 - **Telegram/最终预览传递**：将活动预览生命周期与清理保留分离，以便缺失的已归档预览编辑避免重复回退发送，同时不清除实时预览或阻止稍后的就位最终化。(#41662) 感谢 @hougangdev。 - **Telegram/最终预览传递跟进**：仅当预览已可见时才保留模糊的缺失 `message_id` 最终消息，而首次预览/无 ID 情况仍回退，以便 Telegram 用户不会丢失最终回复。(#41932) 感谢 @hougangdev。 - **Telegram/最终预览清理跟进**：仅对瞬态预览最终消息清除陈旧的清理保留状态，以便已归档预览保留不再在稍后的回退发送最终消息旁留下陈旧的部分气泡。(#41763) 感谢 @obviyus。 - **网关/身份验证**：在共享令牌不匹配时允许一次受信设备令牌重试，并提供恢复提示，以防止令牌漂移期间的重新连接颠簸。(#42507) 感谢 @joshavant。 - **网关/配置错误**：在顶级 `config.set`、`config.patch` 和 `config.apply` 错误消息中最多显示三个验证问题，同时保留结构化问题详情。(#42664) 感谢 @huntharo。 - **代理/Azure OpenAI 响应**：在响应 API 存储覆盖中包含 `azure-openai` 提供程序，以便 Azure OpenAI 多轮 cron 作业和嵌入式代理运行不再因 HTTP 400 “store is set to false” 而失败。(#42934, 修复 #42800) 感谢 @ademczuk。 - **代理/错误渲染**：在成功轮次上忽略陈旧的助手 `errorMessage` 字段，以便后台/工具端失败不再在有效回复前添加合成的账单错误。(#40616) 感谢 @ingyukoh。 - **代理/账单恢复**：在现有节流上探测单提供程序账单冷却，以便充值信用额度可以在无需手动网关重启的情况下恢复。(#41422) 感谢 @altaywtf。 - **代理/回退**：在原始文本和结构化故障转移路径中将 HTTP 499 响应视为瞬态，以便 Anthropic 样式的客户端关闭过载响应可靠地触发模型回退。(#41468) 感谢 @zeroasterisk。 - **代理/回退**：识别 Venice `402 Insufficient USD or Diem balance` 账单错误，以便配置的模型回退被触发，而不是显示原始提供程序错误。(#43205) 感谢 @Squabble9。 - **代理/回退**：识别 Poe `402 You've used up your points!` 账单错误，以便配置的模型回退被触发，而不是显示原始提供程序错误。(#42278) 感谢 @CryUshio。 - **代理/故障转移**：将 Gemini `MALFORMED_RESPONSE` 停止原因视为可重试超时，以便预览模型枚举漂移干净地回退，而不会导致运行崩溃，同时不再将格式错误的函数调用错误重新分类。(#42292) 感谢 @jnMetaCode。 - **代理/冷却**：将没有记录失败历史的冷却窗口默认为 `unknown` 而不是 `rate_limit`，避免错误的 API 速率限制警告，同时保留冷却恢复探测。(#42911) 感谢 @VibhorGautam。 - **身份验证/冷却**：在计算下一个退避之前重置过期的身份验证配置文件冷却错误计数器，以便陈旧的磁盘计数器在过期后不会重新升级为长冷却循环。(#41028) 感谢 @zerone0x。 - **代理/记忆刷新**：通过 `runEmbeddedPiAgent` 转发 `memoryFlushWritePath`，以便记忆触发的刷新轮次保持仅追加写入保护，而不会在工具设置前中止。跟进 #38574。(#41761) 感谢 @frankekn。 - **代理/上下文修剪**：在软修剪期间修剪仅图像工具结果，使上下文修剪覆盖范围与新的工具结果契约保持一致，并将历史图像清理扩展到相同的屏幕截图密集型会话路径。(#43045) 感谢 @MoerAI。 - **会话/重置模型重新计算**：在会话重置重新计算替换会话之前清除陈旧的运行时模型、上下文令牌和系统提示元数据，以便重置选取当前默认值和显式覆盖，而不是重用旧的运行时模型状态。(#41173) 感谢 @PonyX-lab。 - **频道/允许列表**：移除陈旧的匹配器缓存，以便相同数组允许列表编辑和通配符替换立即生效，并为就位突变情况提供回归覆盖。 - **Discord/Telegram 出站运行时配置**：将运行时解析的配置线程化到 Discord 和 Telegram 发送路径，以便基于 SecretRef 的凭据在消息传递期间保持解析状态。(#42352) 感谢 @joshavant。 - **工具/网络搜索**：将 Brave `llm-context` 基础片段视为纯字符串，以便 `web_search` 在 LLM 上下文模式下不再返回空片段数组。(#41387) 感谢 @zheliu2。 - **工具/网络搜索**：当聊天完成响应省略顶级引用时，从 `message.annotations` 恢复 OpenRouter Perplexity 引用提取。(#40881) 感谢 @laurieluo。 - **CLI/技能 JSON**：从 `skills list --json`、`skills info --json` 和 `skills check --json` 中剥离 ANSI 和 C1 控制字节，以便机器可读输出对终端和嵌入控制字符的技能元数据保持有效。修复 #27530。相关 #27557。感谢 @Jimmy-xuzimo 和 @vincentkoc。 - **CLI/表格**：在传统 Windows 控制台上将共享表格默认为 ASCII 边框，同时在现代 Windows 终端上保留 Unicode 边框，以便 `openclaw skills` 等命令在 GBK/936 控制台下停止渲染乱码。修复 #40853。相关 #41015。感谢 @ApacheBin 和 @vincentkoc。 - **CLI/记忆拆除**：在一次性 CLI 关闭路径中关闭缓存的记忆搜索/索引管理器，以便监视器支持的记忆缓存在输出完成后不再保持已完成的 CLI 运行存活。(#40389) 感谢 @Julbarth。 - **控制界面/会话**：通过将响应式表格覆盖移到基础网格规则旁边并启用内联大小容器查询，在窄视口或容器宽度上恢复单列表会表格折叠。(#12175) 感谢 @benjipeng。 - **Telegram/网络环境代理**：将配置的传输策略应用于代理的 HTTPS 调度器以及直接的 `NO_PROXY` 绕过，以便解析器范围的 IPv4 回退和网络设置对通过环境代理的 Telegram 流量一致工作。(#40740) 感谢 @sircrumpet。 - **Mattermost/Markdown 格式**：在剥离机器人提及时保留首行缩进，以便嵌套列表项和缩进代码块保持其结构，并默认原生渲染 Mattermost 表格而不是围栏代码回退。(#18655) 感谢 @echo931。 - **Mattermost/插件发送操作**：规范化直接 `replyTo` 回退处理，以便线程化插件发送修剪空白 ID 并再次重用正确的回复目标。(#41176) 感谢 @hnykda。 - **MS Teams/允许列表解析**：使用 General 频道对话 ID 作为已解析的团队密钥（带 Graph GUID 回退），以便 Bot Framework 运行时 `channelData.team.id` 匹配对团队和团队/频道允许列表条目有效。(#41838) 感谢 @BradGroux。 - **Signal/配置架构**：在严格配置验证中接受 `channels.signal.accountUuid`，以便循环保护配置不再因未识别的键而失败。(#35578) 感谢 @ingyukoh。 - **Telegram/配置架构**：在严格配置验证中接受 `channels.telegram.actions.editMessage` 和 `createForumTopic`，以便现有的 Telegram 操作切换不再作为未识别的键失败。(#35498) 感谢 @ingyukoh。 - **Telegram/文档**：阐明 `channels.telegram.groups` 允许列表聊天，而 `groupAllowFrom` 允许列表那些聊天内的用户，并将无效的负聊天 ID 指向正确的配置键。(#42451) 感谢 @altaywtf。 - **Discord/配置类型**：在规范的行会-频道配置类型上公开频道级 `autoThread`，以便严格配置加载与现有的 Discord 架构和运行时行为匹配。(#35608) 感谢 @ingyukoh。 - **修复(模型)**：保护可选的模型.input 能力检查 (#42096) 感谢 @andyliu - **模型/阿里云模型工作室**：通过共享环境身份验证、隐式提供程序发现和 shell 环境回退连接 `MODELSTUDIO_API_KEY`，以便引导在向导之外也能工作。(#40634) 感谢 @pomelo-nwu。 - **在运行时原子化解析 Web 工具 SecretRefs**。(#41599) 感谢 @joshavant。 - **Secret 文件**：通过要求 `*File` secret 输入的直接常规文件并拒绝基于符号链接的 secret 文件，加固 CLI 和频道凭据文件读取以防范路径交换竞争。 - **归档提取**：通过首先提取到暂存区并以安全文件打开合并到规范目标，加固 TAR 和外部 `tar.bz2` 安装以防范目标符号链接和预存在的子符号链接逃逸。 - **Secrets/SecretRef**：在架构、运行时和网关上拒绝 exec SecretRef 遍历 ID。(#42370) 感谢 @joshavant。 - **沙盒/fs 桥**：将暂存写入固定到已验证的父目录，以便临时写入文件在原子替换之前无法在允许的挂载外实体化。感谢 @tdjackey。 - **网关/身份验证**：当配置了本地 `gateway.auth.*` SecretRef 但不可用时失败关闭，而不是在本地模式下静默回退到 `gateway.remote.*` 凭据。(#42672) 感谢 @joshavant。 - **命令/配置写入**：对 `/config` 和基于配置的 `/allowlist` 编辑，对来源账户和目标账户范围都强制执行 `configWrites`，阻止同级账户突变，同时保留网关 `operator.admin` 流程。感谢 @tdjackey 报告。 - **安全/system.run**：当 OpenClaw 无法绑定恰好一个具体的本地文件操作数时，对基于批准的解释器/运行时命令失败关闭，同时将尽力而为的直接文件绑定扩展到额外的运行时形式。感谢 @tdjackey 报告。 - **网关/会话重置身份验证**：将对话 `/new` 和 `/reset` 处理与仅限管理员的 `sessions.reset` 控制平面 RPC 分离，以便写入范围的网关调用者不再能通过 `agent` 达到特权重置路径。感谢 @tdjackey 报告。 - **安全/插件运行时**：停止未身份验证的插件 HTTP 路由在调用 `runtime.subagent.*` 时继承合成的管理员网关范围，以便 `sessions.delete` 等仅限管理员的方法在没有网关身份验证的情况下保持阻止。 - **安全/session_status**：在读取或变异目标会话状态之前强制执行沙盒会话树可见性和共享代理到代理访问守卫，以便沙盒子代理不再能检查父会话元数据或通过 `session_status` 写入父模型覆盖。 - **安全/节点**：将 `nodes` 代理工具视为仅所有者回退策略，以便非所有者发送者无法通过共享工具集到达配对节点批准或调用路径。 - **安全/外部内容**：将空格分隔的 `EXTERNAL UNTRUSTED CONTENT` 边界标记视为下划线分隔的变体，以便提示填充程序不能绕过标记消毒。(#35983) 感谢 @urianpaul94。 - **Telegram/执行批准**：拒绝针对其他机器人的 `/approve` 命令，在工具结果传递失败时保持确定性批准提示可见，并停止已解析的确切 ID 通过前缀匹配其他挂起批准。(#37233) 感谢 @huntharo。 - **子代理/权威**：在生成时持久化叶与编排器控制范围，并通过共享所有权检查路由工具加斜杠命令控制，以便叶会话在恢复或平面键查找后无法重新获得编排特权。感谢 @tdjackey。 - **ACP/ACPX 插件**：将捆绑的 `acpx` 固定 bumped 到 `0.1.16`，以便插件本地安装和严格版本检查与最新发布的 CLI 匹配。(#41975) 感谢 @dutifulbob。 - **ACP/sessions.patch**：在 ACP 会话键上允许 `spawnedBy` 和 `spawnDepth` 谱系字段，以便 `runtime: "acp"` 的 `sessions_spawn` 在子会话设置期间不再失败。修复 #40971。(#40995) 感谢 @xaeon2026。 - **ACP/停止原因映射**：将网关聊天 `state: "error"` 完成解析为 ACP `end_turn` 而不是 `refusal`，以便瞬态后端失败不会作为故意拒绝呈现。(#41187) 感谢 @pejmanjohn。 - **ACP/setSessionMode**：将网关 `sessions.patch` 失败传播回 ACP 客户端，以便被拒绝的模式更改不再返回静默成功。(#41185) 感谢 @pejmanjohn。 - **ACP/桥接模式**：拒绝每个会话不支持的 MCP 服务器设置并传播被拒绝的会话模式更改，以便 IDE 客户端看到明确的桥接限制而不是静默成功。(#41424) 感谢 @mbelinky。 - **ACP/会话 UX**：在 `loadSession` 上重放存储的用户和助手文本，公开网关支持的会话控制和元数据，并发出近似会话使用情况更新，以便 IDE 客户端更忠实地恢复上下文。(#41425) 感谢 @mbelinky。 - **ACP/工具流**：用尽力而为的文本内容和文件位置提示丰富 `tool_call` 和 `tool_call_update` 事件，以便 IDE 客户端可以更自然地跟随桥接工具活动。(#41442) 感谢 @mbelinky。 - **ACP/运行时附件**：将规范化的入站图像附件转发到 ACP 运行时轮次，以便 ACPX 会话可以在运行时路径上保留图像提示内容。(#41427) 感谢 @mbelinky。 - **ACP/回归**：为 ACP 谱系修补、ACPX 运行时覆盖的图像提示序列化以及实时 ACP 生成验证的操作员冒烟测试程序添加网关 RPC 覆盖。(#41456) 感谢 @mbelinky。 - **ACP/后续加固**：使会话恢复和提示完成对转录/更新失败优雅降级，强制执行有界工具位置遍历，并跳过运行时无法序列化的非图像 ACPX 轮次。(#41464) 感谢 @mbelinky。 - **ACP/sessions_spawn**：仅对符合条件的子代理编排器会话（心跳 `target: "last"` 且具有可用的会话本地路由）隐式流式传输 `mode="run"` ACP 生成到父级，恢复父级进度中继而无需线程绑定。(#42404) 感谢 @davidguttman。 - **ACP/主会话别名**：在 ACP 会话查找前规范化 `main`，以便重启的 ACP 主会话重新水合而不是以 `Session is not ACP-enabled: main` 失败关闭。(#43285, 修复 #25692) - **插件/上下文引擎模型身份验证**：公开 `runtime.modelAuth` 和插件 SDK 身份验证助手，以便插件可以通过正常身份验证管道解析提供程序/模型 API 密钥。(#41090) 感谢 @xinhuagu。 - **钩子/插件上下文奇偶后续**：通过嵌入式 `llm_input`、`agent_end` 和 `llm_output` 钩子上下文传递 `trigger` 和 `channelId`，以便插件在钩子阶段接收相同的代理元数据。(#42362) 感谢 @zhoulf1006。 - **插件/全局钩子运行器**：加固单例状态处理，以便共享全局钩子运行器重用不会跨执行泄漏或损坏运行器状态。(#40184) 感谢 @vincentkoc。 - **上下文引擎/测试**：为跨块解析、插件 SDK 重新导出和并发块注册添加捆绑注册表回归覆盖。(#40460) 感谢 @dsantoreis。 - **代理/嵌入式运行器**：绑定压缩重试等待并在 SIGUSR1 重启期间排空嵌入式运行，以便会话通道恢复而不是在压缩后保持阻塞。(#40324) 感谢 @cgdusek。 - **代理/嵌入式日志**：添加结构化的、消毒的生命周期和故障转移观察事件，以便过载和提供程序失败更容易被跟踪和过滤。(#41336) 感谢 @altaywtf。 - **代理/嵌入式过载日志**：在错误路径控制台输出中包含失败的模型和提供程序，并为渲染和消毒的 `consoleMessage` 提供生命周期回归覆盖。(#41236) 感谢 @jiarung。 - **代理/回退可观察性**：添加结构化的、消毒的模型回退决策和身份验证配置文件失败状态事件，并附带关联的运行 ID，以便冷却探测和故障转移路径在日志中更容易追踪。(#41337) 感谢 @altaywtf。 - **日志记录/探测观察**：在控制台上抑制结构化的嵌入和模型回退探测警告，同时不隐藏错误或致命输出。(#41338) 感谢 @altaywtf。 - **代理/上下文引擎压缩**：保护抛出的引擎拥有的溢出压缩尝试并为 `ownsCompaction` 引擎触发压缩钩子，以便溢出恢复不再崩溃，插件订阅者仍能观察压缩运行。(#41361) 感谢 @davidrudduck。 - **网关/节点待处理排空后续**：当延迟的基线状态项目仍需传递时保持 `hasMore` 为 true，并避免为没有排队工作的仅排空节点分配空待处理工作状态。(#41429) 感谢 @mbelinky。 - **协议/Swift 模型同步**：在已着陆的 `node.pending.*` 架构添加后重新生成待处理节点工作 Swift 绑定，以便生成的协议工件再次一致。(#41477) 感谢 @mbelinky。 - **Cron/子代理后续**：不要将空或 `NO_REPLY` cron 响应错误分类为需要重新运行的临时确认，以便故意静默的 cron 作业不再被重试。(#41383) 感谢 @jackal092927。 - **Cron/状态错误**：在 cron 作业状态中记录 `lastErrorReason` 并使网关架构与完整的故障转移原因集保持一致，包括协议符合性的回归覆盖。(#14382) 感谢 @futuremind2026。 - **浏览器/Browserbase 429 处理**：提供稳定的无重试速率限制指导，而不缓冲来自远程浏览器服务的丢弃的 HTTP 429 响应体。(#40491) 感谢 @mvanhorn。 - **CI/CodeQL Swift 工具链**：在安装 Swift 构建工具之前选择 Xcode 26.1，以便 CodeQL Swift 作业在 `macos-latest` 上使用 Swift 工具 6.2。(#41787) 感谢 @BunsDev。 - **沙盒/子代理**：当父代理在复制工作区沙盒中运行时，通过 `sessions_spawn` 继承传递真实配置的工作区，以便子 `/agent` 挂载指向配置的工作区而不是父沙盒副本。(#40757) 感谢 @dsantoreis。 - **代理/回退冷却探测**：将冷却绕过探测限制为每个提供程序在每个回退运行中仅一次尝试，以便多模型相同提供程序冷却链可以继续跨提供程序回退，而不是在重复冷却探测上反复停滞。(#41711) 感谢 @cgdusek。 - **Telegram/直接传递**：将直接传递发送桥接到内部 `message:sent` 钩子，以便内部钩子监听器观察成功的 Telegram 传递。(#40185) 感谢 @vincentkoc。 - **依赖项**：刷新工作区依赖项（固定的 Carbon 包除外），并加固 ACP 会话配置写入以防范非字符串 SDK 值，以便较新的 ACP 客户端快速失败而不是触发类型/运行时不匹配。 - **Telegram/轮询重启**：在 `runner.stop()` 和 `bot.stop()` 解决后清除有界清理超时句柄，以便停滞恢复不再在干净关闭后留下散落的 15 秒计时器。(#43188) 感谢 @kyohwang。

### Security - Gateway/WebSocket: enforce browser origin validation for all browser-originated connections regardless of whether proxy headers are present, closing a cross-site WebSocket hijacking path in `trusted-proxy` mode that could grant untrusted origins `operator.admin` access. (GHSA-5wcw-8jjv-m286) ### Changes - OpenRouter/models: add temporary Hunter Alpha and Healer Alpha entries to the built-in catalog so OpenRouter users can try the new free stealth models during their roughly one-week availability window. (#43642) Thanks @ping-Toven. - iOS/Home canvas: add a bundled welcome screen with a live agent overview that refreshes on connect, reconnect, and foreground return, and move the compact connection pill off the top-left canvas overlay. (#42456) Thanks @ngutman. - iOS/Home canvas: replace floating controls with a docked toolbar, make the bundled home scaffold adapt to smaller phones, and open chat in the resolved main session instead of a synthetic `ios` session. (#42456) Thanks @ngutman. - macOS/chat UI: add a chat model picker, persist explicit thinking-level selections across relaunch, and harden provider-aware session model sync for the shared chat composer. (#42314) Thanks @ImLukeF. - Onboarding/Ollama: add first-class Ollama setup with Local or Cloud + Local modes, browser-based cloud sign-in, curated model suggestions, and cloud-model handling that skips unnecessary local pulls. (#41529) Thanks @BruceMacD. - OpenCode/onboarding: add new OpenCode Go provider, treat Zen and Go as one OpenCode setup in the wizard/docs while keeping the runtime providers split, store one shared OpenCode key for both profiles, and stop overriding the built-in `opencode-go` catalog routing. (#42313) Thanks @ImLukeF and @vincentkoc. - Memory: add opt-in multimodal image and audio indexing for `memorySearch.extraPaths` with Gemini `gemini-embedding-2-preview`, strict fallback gating, and scope-based reindexing. (#43460) Thanks @gumadeiras. - Memory/Gemini: add `gemini-embedding-2-preview` memory-search support with configurable output dimensions and automatic reindexing when the configured dimensions change. (#42501) Thanks @BillChirico and @gumadeiras. - macOS/onboarding: detect when remote gateways need a shared auth token, explain where to find it on the gateway host, and clarify when a successful check used paired-device auth instead. (#43100) Thanks @ngutman. - Discord/auto threads: add `autoArchiveDuration` channel config for auto-created threads so Discord thread archiving can stay at 1 hour, 1 day, 3 days, or 1 week instead of always using the 1-hour default. (#35065) Thanks @davidguttman. - iOS/TestFlight: add a local beta release flow with Fastlane prepare/archive/upload support, canonical beta bundle IDs, and watch-app archive fixes. (#42991) Thanks @ngutman. - ACP/sessions_spawn: add optional `resumeSessionId` for `runtime: "acp"` so spawned ACP sessions can resume an existing ACPX/Codex conversation instead of always starting fresh. (#41847) Thanks @pejmanjohn. - Gateway/node pending work: add narrow in-memory pending-work queue primitives (`node.pending.enqueue` / `node.pending.drain`) and wake-helper reuse as a foundation for dormant-node work delivery. (#41409) Thanks @mbelinky. - Git/runtime state: ignore the gateway-generated `.dev-state` file so local runtime state does not show up as untracked repo noise. (#41848) Thanks @smysle. - Exec/child commands: mark child command environments with `OPENCLAW_CLI` so subprocesses can detect when they were launched from the OpenClaw CLI. (#41411) Thanks @vincentkoc. ### Breaking - Cron/doctor: tighten isolated cron delivery so cron jobs can no longer notify through ad hoc agent sends or fallback main-session summaries, and add `openclaw doctor --fix` migration for legacy cron storage and legacy notify/webhook delivery metadata. (#40998) Thanks @mbelinky. ### Fixes - Agents/text sanitization: strip leaked model control tokens (`<|...|>` and full-width `<｜...｜>` variants) from user-facing assistant text, preventing GLM-5 and DeepSeek internal delimiters from reaching end users. (#42173) Thanks @imwyvern. - iOS/gateway foreground recovery: reconnect immediately on foreground return after stale background sockets are torn down, so the app no longer stays disconnected until a later wake path happens. (#41384) Thanks @mbelinky. - Gateway/Control UI: keep dashboard auth tokens in session-scoped browser storage so same-tab refreshes preserve remote token auth without restoring long-lived localStorage token persistence, while scoping tokens to the selected gateway URL and fragment-only bootstrap flow. (#40892) thanks @velvet-shark. - Gateway/macOS launchd restarts: keep the LaunchAgent registered during explicit restarts, hand off self-restarts through a detached launchd helper, and recover config/hot reload restart paths without unloading the service. Fixes #43311, #43406, #43035, and #43049. - macOS/LaunchAgent install: tighten LaunchAgent directory and plist permissions during install so launchd bootstrap does not fail when the target home path or generated plist inherited group/world-writable modes. - Discord/reply chunking: resolve the effective `maxLinesPerMessage` config across live reply paths and preserve `chunkMode` in the fast send path so long Discord replies no longer split unexpectedly at the default 17-line limit. (#40133) thanks @rbutera. - Feishu/local image auto-convert: pass `mediaLocalRoots` through the `sendText` local-image shim so allowed local image paths upload as Feishu images again instead of falling back to raw path text. (#40623) Thanks @ayanesakura. - Models/Kimi Coding: send `anthropic-messages` tools in native Anthropic format again so `kimi-coding` stops degrading tool calls into XML/plain-text pseudo invocations instead of real `tool_use` blocks. (#38669, #39907, #40552) Thanks @opriz. - Telegram/outbound HTML sends: chunk long HTML-mode messages, preserve plain-text fallback and silent-delivery params across retries, and cut over to plain text when HTML chunk planning cannot safely preserve the full message. (#42240) thanks @obviyus. - Telegram/final preview delivery: split active preview lifecycle from cleanup retention so missing archived preview edits avoid duplicate fallback sends without clearing the live preview or blocking later in-place finalization. (#41662) thanks @hougangdev. - Telegram/final preview delivery followup: keep ambiguous missing-`message_id` finals only when a preview was already visible, while first-preview/no-id cases still fall back so Telegram users do not lose the final reply. (#41932) thanks @hougangdev. - Telegram/final preview cleanup follow-up: clear stale cleanup-retain state only for transient preview finals so archived-preview retains no longer leave a stale partial bubble beside a later fallback-sent final. (#41763) Thanks @obviyus. - Gateway/auth: allow one trusted device-token retry on shared-token mismatch with recovery hints to prevent reconnect churn during token drift. (#42507) Thanks @joshavant. - Gateway/config errors: surface up to three validation issues in top-level `config.set`, `config.patch`, and `config.apply` error messages while preserving structured issue details. (#42664) Thanks @huntharo. - Agents/Azure OpenAI Responses: include the `azure-openai` provider in the Responses API store override so Azure OpenAI multi-turn cron jobs and embedded agent runs no longer fail with HTTP 400 "store is set to false". (#42934, fixes #42800) Thanks @ademczuk. - Agents/error rendering: ignore stale assistant `errorMessage` fields on successful turns so background/tool-side failures no longer prepend synthetic billing errors over valid replies. (#40616) Thanks @ingyukoh. - Agents/billing recovery: probe single-provider billing cooldowns on the existing throttle so topping up credits can recover without a manual gateway restart. (#41422) thanks @altaywtf. - Agents/fallback: treat HTTP 499 responses as transient in both raw-text and structured failover paths so Anthropic-style client-closed overload responses trigger model fallback reliably. (#41468) thanks @zeroasterisk. - Agents/fallback: recognize Venice `402 Insufficient USD or Diem balance` billing errors so configured model fallbacks trigger instead of surfacing the raw provider error. (#43205) Thanks @Squabble9. - Agents/fallback: recognize Poe `402 You've used up your points!` billing errors so configured model fallbacks trigger instead of surfacing the raw provider error. (#42278) Thanks @CryUshio. - Agents/failover: treat Gemini `MALFORMED_RESPONSE` stop reasons as retryable timeouts so preview-model enum drift falls back cleanly instead of crashing the run, without also reclassifying malformed function-call errors. (#42292) Thanks @jnMetaCode. - Agents/cooldowns: default cooldown windows with no recorded failure history to `unknown` instead of `rate_limit`, avoiding false API rate-limit warnings while preserving cooldown recovery probes. (#42911) Thanks @VibhorGautam. - Auth/cooldowns: reset expired auth-profile cooldown error counters before computing the next backoff so stale on-disk counters do not re-escalate into long cooldown loops after expiry. (#41028) thanks @zerone0x. - Agents/memory flush: forward `memoryFlushWritePath` through `runEmbeddedPiAgent` so memory-triggered flush turns keep the append-only write guard without aborting before tool setup. Follows up on #38574. (#41761) Thanks @frankekn. - Agents/context pruning: prune image-only tool results during soft-trim, align context-pruning coverage with the new tool-result contract, and extend historical image cleanup to the same screenshot-heavy session path. (#43045) Thanks @MoerAI. - Sessions/reset model recompute: clear stale runtime model, context-token, and system-prompt metadata before session resets recompute the replacement session, so resets pick up current defaults and explicit overrides instead of reusing old runtime model state. (#41173) thanks @PonyX-lab. - Channels/allowlists: remove stale matcher caching so same-array allowlist edits and wildcard replacements take effect immediately, with regression coverage for in-place mutation cases. - Discord/Telegram outbound runtime config: thread runtime-resolved config through Discord and Telegram send paths so SecretRef-based credentials stay resolved during message delivery. (#42352) Thanks @joshavant. - Tools/web search: treat Brave `llm-context` grounding snippets as plain strings so `web_search` no longer returns empty snippet arrays in LLM Context mode. (#41387) thanks @zheliu2. - Tools/web search: recover OpenRouter Perplexity citation extraction from `message.annotations` when chat-completions responses omit top-level citations. (#40881) Thanks @laurieluo. - CLI/skills JSON: strip ANSI and C1 control bytes from `skills list --json`, `skills info --json`, and `skills check --json` so machine-readable output stays valid for terminals and skill metadata with embedded control characters. Fixes #27530. Related #27557. Thanks @Jimmy-xuzimo and @vincentkoc. - CLI/tables: default shared tables to ASCII borders on legacy Windows consoles while keeping Unicode borders on modern Windows terminals, so commands like `openclaw skills` stop rendering mojibake under GBK/936 consoles. Fixes #40853. Related #41015. Thanks @ApacheBin and @vincentkoc. - CLI/memory teardown: close cached memory search/index managers in the one-shot CLI shutdown path so watcher-backed memory caches no longer keep completed CLI runs alive after output finishes. (#40389) thanks @Julbarth. - Control UI/Sessions: restore single-column session table collapse on narrow viewport or container widths by moving the responsive table override next to the base grid rule and enabling inline-size container queries. (#12175) Thanks @benjipeng. - Telegram/network env-proxy: apply configured transport policy to proxied HTTPS dispatchers as well as direct `NO_PROXY` bypasses, so resolver-scoped IPv4 fallback and network settings work consistently for env-proxied Telegram traffic. (#40740) Thanks @sircrumpet. - Mattermost/Markdown formatting: preserve first-line indentation when stripping bot mentions so nested list items and indented code blocks keep their structure, and render Mattermost tables natively by default instead of fenced-code fallback. (#18655) thanks @echo931. - Mattermost/plugin send actions: normalize direct `replyTo` fallback handling so threaded plugin sends trim blank IDs and reuse the correct reply target again. (#41176) Thanks @hnykda. - MS Teams/allowlist resolution: use the General channel conversation ID as the resolved team key (with Graph GUID fallback) so Bot Framework runtime `channelData.team.id` matching works for team and team/channel allowlist entries. (#41838) Thanks @BradGroux. - Signal/config schema: accept `channels.signal.accountUuid` in strict config validation so loop-protection configs no longer fail with an unrecognized-key error. (#35578) Thanks @ingyukoh. - Telegram/config schema: accept `channels.telegram.actions.editMessage` and `createForumTopic` in strict config validation so existing Telegram action toggles no longer fail as unrecognized keys. (#35498) Thanks @ingyukoh. - Telegram/docs: clarify that `channels.telegram.groups` allowlists chats while `groupAllowFrom` allowlists users inside those chats, and point invalid negative chat IDs at the right config key. (#42451) Thanks @altaywtf. - Discord/config typing: expose channel-level `autoThread` on the canonical guild-channel config type so strict config loading matches the existing Discord schema and runtime behavior. (#35608) Thanks @ingyukoh. - fix(models): guard optional model.input capability checks (#42096) thanks @andyliu - Models/Alibaba Cloud Model Studio: wire `MODELSTUDIO_API_KEY` through shared env auth, implicit provider discovery, and shell-env fallback so onboarding works outside the wizard too. (#40634) Thanks @pomelo-nwu. - Resolve web tool SecretRefs atomically at runtime. (#41599) Thanks @joshavant. - Secret files: harden CLI and channel credential file reads against path-swap races by requiring direct regular files for `*File` secret inputs and rejecting symlink-backed secret files. - Archive extraction: harden TAR and external `tar.bz2` installs against destination symlink and pre-existing child-symlink escapes by extracting into staging first and merging into the canonical destination with safe file opens. - Secrets/SecretRef: reject exec SecretRef traversal ids across schema, runtime, and gateway. (#42370) Thanks @joshavant. - Sandbox/fs bridge: pin staged writes to verified parent directories so temporary write files cannot materialize outside the allowed mount before atomic replace. Thanks @tdjackey. - Gateway/auth: fail closed when local `gateway.auth.*` SecretRefs are configured but unavailable, instead of silently falling back to `gateway.remote.*` credentials in local mode. (#42672) Thanks @joshavant. - Commands/config writes: enforce `configWrites` against both the originating account and the targeted account scope for `/config` and config-backed `/allowlist` edits, blocking sibling-account mutations while preserving gateway `operator.admin` flows. Thanks @tdjackey for reporting. - Security/system.run: fail closed for approval-backed interpreter/runtime commands when OpenClaw cannot bind exactly one concrete local file operand, while extending best-effort direct-file binding to additional runtime forms. Thanks @tdjackey for reporting. - Gateway/session reset auth: split conversation `/new` and `/reset` handling away from the admin-only `sessions.reset` control-plane RPC so write-scoped gateway callers can no longer reach the privileged reset path through `agent`. Thanks @tdjackey for reporting. - Security/plugin runtime: stop unauthenticated plugin HTTP routes from inheriting synthetic admin gateway scopes when they call `runtime.subagent.*`, so admin-only methods like `sessions.delete` stay blocked without gateway auth. - Security/session_status: enforce sandbox session-tree visibility and shared agent-to-agent access guards before reading or mutating target session state, so sandboxed subagents can no longer inspect parent session metadata or write parent model overrides via `session_status`. - Security/nodes: treat the `nodes` agent tool as owner-only fallback policy so non-owner senders cannot reach paired-node approval or invoke paths through the shared tool set. - Security/external content: treat whitespace-delimited `EXTERNAL UNTRUSTED CONTENT` boundary markers like underscore-delimited variants so prompt wrappers cannot bypass marker sanitization. (#35983) Thanks @urianpaul94. - Telegram/exec approvals: reject `/approve` commands aimed at other bots, keep deterministic approval prompts visible when tool-result delivery fails, and stop resolved exact IDs from matching other pending approvals by prefix. (#37233) Thanks @huntharo. - Subagents/authority: persist leaf vs orchestrator control scope at spawn time and route tool plus slash-command control through shared ownership checks, so leaf sessions cannot regain orchestration privileges after restore or flat-key lookups. Thanks @tdjackey. - ACP/ACPX plugin: bump the bundled `acpx` pin to `0.1.16` so plugin-local installs and strict version checks match the latest published CLI. (#41975) Thanks @dutifulbob. - ACP/sessions.patch: allow `spawnedBy` and `spawnDepth` lineage fields on ACP session keys so `sessions_spawn` with `runtime: "acp"` no longer fails during child-session setup. Fixes #40971. (#40995) thanks @xaeon2026. - ACP/stop reason mapping: resolve gateway chat `state: "error"` completions as ACP `end_turn` instead of `refusal` so transient backend failures are not surfaced as deliberate refusals. (#41187) thanks @pejmanjohn. - ACP/setSessionMode: propagate gateway `sessions.patch` failures back to ACP clients so rejected mode changes no longer return silent success. (#41185) thanks @pejmanjohn. - ACP/bridge mode: reject unsupported per-session MCP server setup and propagate rejected session-mode changes so IDE clients see explicit bridge limitations instead of silent success. (#41424) Thanks @mbelinky. - ACP/session UX: replay stored user and assistant text on `loadSession`, expose Gateway-backed session controls and metadata, and emit approximate session usage updates so IDE clients restore context more faithfully. (#41425) Thanks @mbelinky. - ACP/tool streaming: enrich `tool_call` and `tool_call_update` events with best-effort text content and file-location hints so IDE clients can follow bridge tool activity more naturally. (#41442) Thanks @mbelinky. - ACP/runtime attachments: forward normalized inbound image attachments into ACP runtime turns so ACPX sessions can preserve image prompt content on the runtime path. (#41427) Thanks @mbelinky. - ACP/regressions: add gateway RPC coverage for ACP lineage patching, ACPX runtime coverage for image prompt serialization, and an operator smoke-test procedure for live ACP spawn verification. (#41456) Thanks @mbelinky. - ACP/follow-up hardening: make session restore and prompt completion degrade gracefully on transcript/update failures, enforce bounded tool-location traversal, and skip non-image ACPX turns the runtime cannot serialize. (#41464) Thanks @mbelinky. - ACP/sessions_spawn: implicitly stream `mode="run"` ACP spawns to parent only for eligible subagent orchestrator sessions (heartbeat `target: "last"` with a usable session-local route), restoring parent progress relays without thread binding. (#42404) Thanks @davidguttman. - ACP/main session aliases: canonicalize `main` before ACP session lookup so restarted ACP main sessions rehydrate instead of failing closed with `Session is not ACP-enabled: main`. (#43285, fixes #25692) - Plugins/context-engine model auth: expose `runtime.modelAuth` and plugin-sdk auth helpers so plugins can resolve provider/model API keys through the normal auth pipeline. (#41090) thanks @xinhuagu. - Hooks/plugin context parity followup: pass `trigger` and `channelId` through embedded `llm_input`, `agent_end`, and `llm_output` hook contexts so plugins receive the same agent metadata across hook phases. (#42362) Thanks @zhoulf1006. - Plugins/global hook runner: harden singleton state handling so shared global hook runner reuse does not leak or corrupt runner state across executions. (#40184) Thanks @vincentkoc. - Context engine/tests: add bundled-registry regression coverage for cross-chunk resolution, plugin-sdk re-exports, and concurrent chunk registration. (#40460) thanks @dsantoreis. - Agents/embedded runner: bound compaction retry waiting and drain embedded runs during SIGUSR1 restart so session lanes recover instead of staying blocked behind compaction. (#40324) thanks @cgdusek. - Agents/embedded logs: add structured, sanitized lifecycle and failover observation events so overload and provider failures are easier to tail and filter. (#41336) thanks @altaywtf. - Agents/embedded overload logs: include the failing model and provider in error-path console output, with lifecycle regression coverage for the rendered and sanitized `consoleMessage`. (#41236) thanks @jiarung. - Agents/fallback observability: add structured, sanitized model-fallback decision and auth-profile failure-state events with correlated run IDs so cooldown probes and failover paths are easier to trace in logs. (#41337) thanks @altaywtf. - Logging/probe observations: suppress structured embedded and model-fallback probe warnings on the console without hiding error or fatal output. (#41338) thanks @altaywtf. - Agents/context-engine compaction: guard thrown engine-owned overflow compaction attempts and fire compaction hooks for `ownsCompaction` engines so overflow recovery no longer crashes and plugin subscribers still observe compact runs. (#41361) thanks @davidrudduck. - Gateway/node pending drain followup: keep `hasMore` true when the deferred baseline status item still needs delivery, and avoid allocating empty pending-work state for drain-only nodes with no queued work. (#41429) Thanks @mbelinky. - Protocol/Swift model sync: regenerate pending node work Swift bindings after the landed `node.pending.*` schema additions so generated protocol artifacts are consistent again. (#41477) Thanks @mbelinky. - Cron/subagent followup: do not misclassify empty or `NO_REPLY` cron responses as interim acknowledgements that need a rerun, so deliberately silent cron jobs are no longer retried. (#41383) thanks @jackal092927. - Cron/state errors: record `lastErrorReason` in cron job state and keep the gateway schema aligned with the full failover-reason set, including regression coverage for protocol conformance. (#14382) thanks @futuremind2026. - Browser/Browserbase 429 handling: surface stable no-retry rate-limit guidance without buffering discarded HTTP 429 response bodies from remote browser services. (#40491) thanks @mvanhorn. - CI/CodeQL Swift toolchain: select Xcode 26.1 before installing Swift build tools so the CodeQL Swift job uses Swift tools 6.2 on `macos-latest`. (#41787) thanks @BunsDev. - Sandbox/subagents: pass the real configured workspace through `sessions_spawn` inheritance when a parent agent runs in a copied-workspace sandbox, so child `/agent` mounts point at the configured workspace instead of the parent sandbox copy. (#40757) Thanks @dsantoreis. - Agents/fallback cooldown probing: cap cooldown-bypass probing to one attempt per provider per fallback run so multi-model same-provider cooldown chains can continue to cross-provider fallbacks instead of repeatedly stalling on duplicate cooldown probes. (#41711) Thanks @cgdusek. - Telegram/direct delivery: bridge direct delivery sends to internal `message:sent` hooks so internal hook listeners observe successful Telegram deliveries. (#40185) Thanks @vincentkoc. - Dependencies: refresh workspace dependencies except the pinned Carbon package, and harden ACP session-config writes against non-string SDK values so newer ACP clients fail fast instead of tripping type/runtime mismatches. - Telegram/polling restarts: clear bounded cleanup timeout handles after `runner.stop()` and `bot.stop()` settle so stall recovery no longer leaves stray 15-second timers behind on clean shutdown. (#43188) thanks @kyohwang.

OpenClaw v2026.3.11-beta.1 预发布