OpenClaw v2026.3.31-beta.1

### 重大变更 - **节点/执行**：从 CLI 和代理 `nodes` 工具中移除重复的 `nodes.run` shell 包装器，使节点 shell 执行始终通过 `exec host=node` 进行，从而在 `nodes invoke` 和专用媒体/位置/通知操作上保持节点特定功能。 - **插件 SDK**：弃用传统的提供程序兼容子路径以及较旧的捆绑提供程序设置和通道运行时兼容性填充程序，发出迁移警告，并保留当前文档化的 `openclaw/plugin-sdk/*` 入口点以及本地的 `api.ts` / `runtime-api.ts` barrel 文件作为未来主版本移除前的前进路径。 - **技能/安装与插件/安装**：内置的危险代码 `critical` 发现和安装时扫描失败现在默认以“失败封闭”方式运行，因此之前成功的插件安装和网关支持技能依赖安装现在可能需要显式的危险覆盖（如 `--dangerously-force-unsafe-install`）才能继续。 - **网关/认证**：`trusted-proxy` 现在拒绝混合共享令牌配置，本地直连回退需要配置的令牌，而不是隐式认证同一主机调用者。感谢 @zhangning-agent, @jacobtomlinson, 和 @vincentkoc。 - **网关/节点命令**：节点命令现在在节点配对获批前保持禁用状态，因此仅设备配对已不再足以暴露已声明的节点命令。(#57777) 感谢 @jacobtomlinson。 - **网关/节点事件**：节点发起的运行现在保持在缩减的受信表面上，因此之前依赖更广泛主机/会话工具访问权限的通知驱动或节点触发流程可能需要调整。(#57691) 感谢 @jacobtomlinson。 ### 变更 - **ACP/插件**：添加一个显式的默认关闭的 ACPX 插件工具 MCP 桥接配置，记录信任边界，并加固内置桥接打包/日志路径，使全局安装和 stdio MCP 会话能够可靠运行。(#56867) 感谢 @joe2643。 - **代理/LLM**：为嵌入式运行器请求添加可配置的空闲流超时，以便停滞的模型流干净中止，而不是挂起直到更广泛的运行超时触发。(#55072) 感谢 @liuy。 - **代理/MCP**：使用提供程序安全名称（`serverName__toolName`）具体化捆绑 MCP 工具，支持可选的 `streamable-http` 传输选择以及每服务器连接超时，并在截断明确丢弃它们之前保留来自中止/错误回合的真实工具结果。(#49505) 感谢 @ziomancer。 - **Android/通知**：添加带有包过滤、安静时段、速率限制以及转发通知事件更安全选择器行为的通知转发控制。(#40175) 感谢 @nimbleenigma。 - **后台任务**：将任务转变为真正的共享后台运行控制平面，而不仅仅是 ACP 簿记，通过将 ACP、子代理、cron 和后台 CLI 执行统一在一个 SQLite 支持的账本下，将分离的生命周期更新通过执行器接缝路由，添加审计/维护/状态可见性，收紧自动清理和丢失运行恢复，改进内部状态/工具表面的任务感知，并澄清心跳/主会话自动化与分离计划运行之间的区别。感谢 @mbelinky 和 @vincentkoc。 - **后台任务**：添加第一个线性任务流控制面，使用 `openclaw flows list|show|cancel`，将手动多任务流与单任务自动同步流分开，并为明显孤立或损坏的流/任务链接提供医生恢复提示。感谢 @mbelinky 和 @vincentkoc。 - **通道/QQ Bot**：添加 QQ Bot 作为捆绑通道插件，支持多账户设置、SecretRef 感知凭据、斜杠命令、提醒以及媒体发送/接收支持。(#52986) 感谢 @sliverp。 - **差异**：跳过未使用的查看器与文件 SSR 预加载工作，以便 `diffs` 仅查看和仅文件运行减少渲染工作，同时保持模式输出对齐。(#57909) 感谢 @gumadeiras。 - **任务**：添加一个最小的 SQLite 支持的任务流注册表以及任务到流链接脚手架，因此编排工作可以开始获得一个一级父记录，而无需更改当前任务传递行为。感谢 @mbelinky 和 @vincentkoc。 - **任务**：在单任务流上持久化阻塞状态，并让同一流在重试时干净地重新打开，因此阻塞的分离工作可以携带父级原因并继续，而不会碎片化为新作业。感谢 @mbelinky 和 @vincentkoc。 - **任务**：将单任务 ACP 和子代理更新通过父任务流所有者上下文路由，因此分离工作可以通过预期的父线程/会话重新浮现，而不是仅作为原始子任务发言。感谢 @mbelinky 和 @vincentkoc。 - **LINE/出站媒体**：在 LINE 特定传递路径上添加 LINE 图像、视频和音频出站发送，包括视频的显式预览/跟踪处理，同时将通用媒体发送保留在现有仅图像路径上。(#45826) 感谢 @masatohoshino。 - **Matrix/历史**：通过 `channels.matrix.historyLimit` 为 Matrix 组触发器添加可选房间历史上下文，具有每代理水印和重试安全快照，因此失败触发器重试不会漂移到更新的房间消息中。(#57022) 感谢 @chain710。 - **Matrix/网络**：添加显式的 `channels.matrix.proxy` 配置以通过 HTTP(S) 代理路由 Matrix 流量，包括账户级别覆盖和匹配探测/运行时行为。(#56931) 感谢 @patrick-yingxi-pan。 - **Matrix/流式**：添加草稿流式传输，因此部分 Matrix 回复就位更新同一消息，而不是为每个块发送新消息。(#56387) 感谢 @jrusz。 - **Matrix/线程**：添加每 DM `threadReplies` 覆盖，并保持线程会话隔离与触发消息起的有效房间或 DM 线程策略对齐。(#57995) 感谢 @teconomix。 - **MCP**：为 `mcp.servers` URL 配置添加远程 HTTP/SSE 服务器支持，包括认证头以及 MCP 凭据更安全的配置编辑。(#50396) 感谢 @dhananjai1729。 - **内存/QMD**：添加每代理 `memorySearch.qmd.extraCollections`，以便代理可以选择加入跨代理会话搜索，而无需将每个转录集合扁平化为一个共享 QMD 命名空间。感谢 @vincentkoc。 - **Microsoft Teams/成员信息**：添加 Graph 支持的成员信息操作，以便 Teams 自动化和工具可以直接从 Microsoft Graph 解析频道成员详细信息。(#57528) 感谢 @sudie-codes。 - **Nostr/入站 DM**：在配对或发送者授权副作用之前验证入站事件签名，因此伪造的 DM 事件不再创建配对请求或触发回复尝试。感谢 @smaeljaish771 和 @vincentkoc。 - **OpenAI/响应**：在 Responses HTTP 和 WebSocket 传输上转发配置的 `text.verbosity`，在 `/status` 中公开，并保持每代理详细级别优先级与运行时行为对齐。(#47106) 感谢 @merc1305 和 @vincentkoc。 - **Pi/Codex**：为嵌入式 Pi 运行添加原生 Codex 网络搜索支持，包括配置/文档/向导覆盖以及原生 Codex 搜索激活时管理的工具抑制。(#46579) 感谢 @Evizero。 - **Slack/执行审批**：添加原生 Slack 审批路由和审批者授权，因此执行审批提示可以保留在 Slack 中，而不是回退到 Web UI 或终端。感谢 @vincentkoc。 - **TTS**：添加结构化提供程序诊断和回退尝试分析。(#57954) 感谢 @joshavant。 - **WhatsApp/反应**：代理现在可以对传入的 WhatsApp 消息做出表情反应，从而实现更自然的对话交互，例如用 ❤️ 确认照片而不是打字回复。感谢 @mcaxtr。 - **代理/BTW**：强制 `/btw` 侧问题禁用提供程序推理，因此 Anthropic 自适应思维会话停止因 `No BTW response generated` 而失败。修复 #55376。感谢 @Catteres 和 @vincentkoc。 - **CLI/引导**：在拒绝发现的端点后将远程网关 URL 提示重置为安全回环默认值，因此引导不会保留先前拒绝的远程 URL。(#57828) - **代理/执行默认值**：当没有内联指令或会话覆盖时，尊重每代理 `tools.exec` 默认值，因此配置的执行主机、安全、询问和节点设置实际应用。(#57689) - **沙箱/网络**：通过共享沙箱策略清理 SSH 子进程环境变量，并将市场存档下载以及 Ollama 发现、认证和拉取请求通过受保护的获取路径路由，因此沙箱化执行和远程获取遵循仓库的信任边界。(#57848, #57850) ### 修复 - **代理/OpenAI 响应**：在 WebSocket/响应路径上规范化原始捆绑 MCP 工具架构，因此裸对象、类对象和顶层联合 MCP 工具不再被 OpenAI 在工具注册期间拒绝。(#58299) 感谢 @yelog。 - **ACP/安全**：用语义审批类替换 ACP 的危险工具名称覆盖，因此只有狭窄的只读读取/搜索可以自动批准，而间接执行能力和控制平面工具始终需要显式提示批准。感谢 @vincentkoc。 - **ACP/sessions_spawn**：注册 ACP 子运行以进行完成跟踪和生命周期清理，并使注册失败清理明确为尽力而为，因此调用者不会假设已启动的 ACP 回合已完全中止。(#40885) 感谢 @xaeon2026 和 @vincentkoc。 - **ACP/任务**：当 ACP 运行在确定性写入或授权阻止程序上干净退出时将其标记为阻塞，并通过后续唤醒父会话，而不是错误报告成功。 - **ACPX/运行时**：从扩展包元数据推导捆绑 ACPX 的预期版本，而不是硬编码单独的文本字面量，因此插件本地 ACPX 安装在版本提升后停止漂移出健康检查对等性。(#49089) 感谢 @jiejiesks 和 @vincentkoc。 - **代理/Anthropic 故障转移**：将带有 `An unexpected error occurred while processing the response` 的 Anthropic `api_error` 负载视为暂时性，因此重试/故障转移可以介入，而不是呈现终端失败。(#57441) 感谢 @zijiess 和 @vincentkoc。 - **代理/压缩**：在聚合超时路径获胜后保持后期压缩重试拒绝得到处理，而不吞咽真正超时前的等待失败，因此超时的重试不再在后续取消订阅时呈现未处理的拒绝。(#57451) 感谢 @mpz4life 和 @vincentkoc。 - **代理/上下文修剪**：使用共享代码点感知估计器计算补充平面 CJK 字符，因此上下文修剪停止低估使用扩展 B 表意文字的日语和中文文本。(#39985) 感谢 @Edward-Qiang-2024。 - **代理/Kimi**：在清除缓存修复时保留已有效 Anthropic 兼容工具调用参数对象，而稍后尾部垃圾超过修复配额。感谢 @yuanaichi。 - **代理/MCP**：在一次性 `openclaw agent --local` 运行完成后处置捆绑 MCP 运行时，同时在运行内重试期间保留捆绑 MCP 状态，因此本地 JSON 运行干净退出，而无需在运行中途重启有状态 MCP 工具。 - **代理/MCP**：在同一会话的回合间重用捆绑 MCP 运行时，同时在 MCP 配置更改时重新创建它们，并在会话滚动时干净处置陈旧的运行时。(#55090) 感谢 @allan0509。 - **代理/内存刷新**：在嵌入式尝试期间保持每日内存刷新文件仅追加，因此压缩写入不会覆盖较早的笔记。(#53725) 感谢 @HPluseven。 - **代理/沙箱**：尊重 `tools.sandbox.tools.alsoAllow`，让显式沙箱重新允许移除匹配的内置默认拒绝工具，并保持沙箱解释/错误指导与有效沙箱工具策略对齐。(#54492) 感谢 @ngutman。 - **代理/沙箱**：使远程 FS 桥接读取固定父路径并在帮助程序中原子性打开文件，因此读取访问不能竞争路径解析。感谢 @AntAISecurityLab 和 @vincentkoc。 - **代理/静音回合**：在静默内存刷新运行上失败封闭，因此叙述的 `NO_REPLY` 自言自语即使启用块流式传输也不能流式传输或最终化为外部回复。(#52593) - **代理/子代理**：修复中间子代理运行时显示，因此 `/subagents list` 和 `/subagents info` 停止膨胀短运行时并正确显示秒级持续时间。(#57739) 感谢 @samzong。 - **Anthropic/OAuth**：为直接 `sk-ant-oat-*` 请求注入 `/fast` `service_tier` 提示，因此 OAuth 认证的 Anthropic 运行停止缺失与 API 密钥流量相同的过载路由信号。修复 #55758。感谢 @Cypherm 和 @vincentkoc。 - **Anthropic/服务层级**：支持直接 Anthropic 请求的显式 `serviceTier` 模型参数，并让它们在两者都设置时覆盖 `/fast` 默认值。(#45453) 感谢 @vincentkoc。 - **自动回复/快速**：在仅指令路径上接受 `/fast status`，使帮助/状态文本与文档化的 `status|on|off` 语法对齐，并跨命令面保持当前状态回复一致。修复 #46095。感谢 @weissfl 和 @vincentkoc。 - **Azure OpenAI/自定义提供程序**：对 Azure 自定义提供程序使用 `azure-openai-responses` 路径，因此 Azure OpenAI 端点保持在正确的响应集成面上。(#50851) 感谢 @kunalk16。 - **BlueBubbles/iMessage**：再次合并仅 URL 的入站消息与其链接预览气球，因此共享裸链接不再从代理上下文中删除 URL。感谢 @vincentkoc。 - **浏览器/插件**：当浏览器配置或浏览器工具策略已引用它时自动启用捆绑浏览器插件，并在 `plugins.allow` 排除 `browser` 时显示更清晰的 CLI 错误。 - **CI/开发检查**：将本地 `pnpm check` 默认为较低内存的类型检查/锁路径，同时保持 CI 在正常并行路径上，并加固 Telegram 测试打字/文字，防止原生 TypeScript-Go 工具崩溃。 - **任务**：添加一个小任务流运行时基板，用于编写具有持久等待目标和输出包的层，加上捆绑技能/Lobster 示例以及更丰富的 `flows show` / `doctor` 恢复提示，用于多任务流状态。(#58336) 感谢 @mbelinky 和 @vincentkoc。 - **配置/遗留清理**：在本地配置/服务检测期间停止探测过时的替代遗留配置名称和服务标签，同时保持活动 `~/.openclaw/openclaw.json` 路径规范。 - **配置/运行时**：在内存中固定运行进程的第一次成功配置加载，并在成功写入/重新加载时刷新该快照，因此热路径停止在监视器驱动的交换之间重新解析 `openclaw.json`。 - **配置/SecretRef + 控制 UI**：加固 SecretRef 编辑往返恢复，阻止不安全的原始回退（当原始不可用时强制表单模式），并在配置写入 RPC 持久化之前预检提交的配置 SecretRefs。(#58044) 感谢 @joshavant。 - **配置/Telegram**：在加载时将移除的 `channels.telegram.groupMentionsOnly` 迁移到 `channels.telegram.groups["*"].requireMention`，因此遗留配置不再在启动时崩溃。(#55336) 感谢 @jameslcowan。 - **配置/更新**：停止 `openclaw doctor` 写回持久化插件注入的通道默认值，因此 `openclaw update` 不再播种稍后破坏服务刷新验证的配置键。(#56834) 感谢 @openperf。 - **控制 UI/代理**：在初始文件面板打开时自动加载代理工作区文件，并从有效运行时代理元数据填充概览模型/工作区/回退，因此默认模型不再显示为 `未设置`。(#56637) 感谢 @dxsx84。 - **控制 UI/斜杠命令**：使 `/steer` 和 `/redirect` 从聊天命令面板工作，具有活动运行 `/steer` 的可见挂起状态，正确的重定向运行跟踪，以及命令菜单中的单个规范 `/steer` 条目。(#54625) 感谢 @fuller-stack-dev。 - **Cron/公告**：保留公告模式的所有可交付文本负载，而不是折叠到最后一块，因此多行 cron 报告完整传递到 Telegram 论坛主题。 - **Cron/隔离会话**：跨重试重启携带完整的实时会话提供程序、模型和认证配置文件选择，因此具有模型覆盖的 cron 作业不再在运行中途模型切换请求时失败或循环。(#57972) 感谢 @issaba1。 - **差异/配置**：从 `diffsPluginConfigSchema.safeParse()` 保留架构形状的插件配置解析，因此直接调用者保留 `defaults` 和 `security` 部分，而不是接收扁平化的工具默认值。(#57904) 感谢 @gumadeiras。 - **差异**：当 `lang` 提示在差异渲染和查看器水合期间无效时回退到纯文本，因此不良或过时的语言值不再破坏差异查看器。(#57902) 感谢 @gumadeiras。 - **Discord/语音**：在转录前对语音入口实施相同的公会频道和成员允许列表检查，因此加入的语音频道不再接受来自配置的 Discord 访问策略之外用户的语音。感谢 @cyjhhh 和 @vincentkoc。 - **Docker/设置**：为本地镜像构建（包括沙箱镜像构建）强制 BuildKit，因此 `./docker-setup.sh` 不再在主机默认为 Docker 遗留构建器时在 `RUN --mount=...` 上失败。(#56681) 感谢 @zhanghui-china。 - **文档/锚点**：修复损坏的英文文档链接，并使 Mint 锚点审计针对英文源文档树运行。(#57039) 感谢 @velvet-shark。 - **医生/插件**：当没有迁移计划时跳过错误的 Matrix 遗留助手警告，并保持捆绑的 `enabledByDefault` 插件在网关启动集中。(#57931) 感谢 @dinakars777。 - **执行审批/macOS**：在推导 shell 负载和始终允许模式之前展开 `arch` 和 `xcrun`，因此包装器审批保持绑定到携带的命令而不是外部载体。感谢 @tdjackey 和 @vincentkoc。 - **执行审批**：在持久化始终允许信任之前展开 `caffeinate` 和 `sandbox-exec`，因此稍后 shell 负载更改仍需要新鲜审批。感谢 @tdjackey 和 @vincentkoc。 - **执行/审批**：当 `execApprovals.approvers` 未设置时从现有所有者配置推断 Discord 和 Telegram 执行审批者，将默认审批窗口延长到 30 分钟，并澄清审批不可用指导，因此审批不会显得静默消失。 - **执行/审批**：将 `awk` 和 `sed` 系列二进制文件保留在低风险 `safeBins` 快速路径之外，并停止医生配置文件脚手架将它们视为普通自定义过滤器。感谢 @vincentkoc。 - **执行/环境**：在主机执行中阻止代理、TLS 和 Docker 端点环境覆盖，因此请求范围的命令不能静默重路由出站流量或信任攻击者提供的证书设置。感谢 @AntAISecurityLab。 - **执行/环境**：阻止 Python 包索引覆盖变量来自请求范围的主机执行环境清理，因此包获取不能通过调用者提供的索引重定向。感谢 @nexrin 和 @vincentkoc。 - **执行/节点**：停止网关端工作目录回退重写显式 `host=node` cwd 值到网关文件系统，因此远程节点执行审批和运行保持使用预期的节点本地目录。(#50961) 感谢 @openperf。 - **执行/运行时**：将隐式执行默认为 `host=auto`，仅当存在沙箱运行时将该目标解析为沙箱，保持显式 `host=sandbox` 在没有沙箱时失败封闭，并在运行时状态/文档中显示 `/exec` 有效主机状态。 - **执行**：当隐式沙箱主机没有沙箱运行时失败封闭，并阻止已拒绝的异步审批后续从同一会话重复使用先前的命令输出。(#56800) 感谢 @scoootscooob。 - **Feishu/组**：保持引用回复和主题引导上下文与组发送者允许列表对齐，因此仅允许列表的线程消息种子代理上下文。感谢 @AntAISecurityLab 和 @vincentkoc。 - **网关/附件**：将大型入站图像卸载到文本仅运行而不泄漏 `media://` 标记，为模型输入/转录保留混合附件顺序，以及当无法解析模型图像能力时失败封闭。(#55513) 感谢 @Syysean。 - **网关/认证**：在 WebSocket 握手尝试期间，即使调用者也发送设备令牌候选，保持共享认证速率限制活动，因此虚假设备令牌字段不再抑制共享秘密暴力跟踪。感谢 @kexinoh 和 @vincentkoc。 - **网关/认证**：在受信代理 HTTP 操作员请求上拒绝不匹配的浏览器 `Origin` 头，同时保持无来源的无头代理客户端工作。感谢 @AntAISecurityLab 和 @vincentkoc。 - **网关/设备令牌**：令牌轮换后断开活动设备会话，因此新轮换的凭据立即撤销现有实时连接，而不是等待这些套接字自然关闭。感谢 @zsxsoft 和 @vincentkoc。 - **网关/健康**：将通道描述符中的网络钩子与轮询账户模式携带到运行时快照，因此像 LINE 和 BlueBubbles 这样的被动通道跳过错误的陈旧套接字健康失败。(#47488) 感谢 @karesansui-u。 - **网关/配对**：恢复 QR 引导引导交接，因此新鲜 `/pair qr` iPhone 设置可以自动批准初始节点配对，接收可重用节点设备令牌，并停止重试已用引导认证。(#58382) 感谢 @ngutman。 - **网关/OpenAI 兼容性**：在 `/v1/responses` 上接受扁平响应 API 函数工具定义，并在将托管工具规范化为嵌入式运行器时保留 `strict`，因此像 Codex 这样的规范兼容客户端不再失败验证或静默丢失严格工具强制。(#49089) 感谢 @malaiwah 和 @vincentkoc。 - **网关/OpenAI HTTP**：恢复对省略 `x-openclaw-scopes` 的承载认证请求的默认操作员范围，因此无头 `/v1/chat/completions` 和会话历史调用者在最近的方法范围强化后再次工作。(#57596) 感谢 @openperf。 - **网关/插件**：将插件认证 HTTP 路由运行时客户端范围限定为只读访问，并保持网关认证插件路由在写入范围上，因此插件拥有的网络钩子处理程序默认不继承写入能力的运行时访问。感谢 @davidluzsilva 和 @vincentkoc。 - **网关/SecretRef**：通过合并服务/运行时环境源解决重启令牌漂移检查，并对不支持的易变 SecretRef 加 OAuth 配置文件组合硬失败，因此重启警告和政策执行与运行时行为匹配。(#58141) 感谢 @joshavant。 - **网关/工具 HTTP**：收紧 HTTP 工具调用授权，因此仅所有者工具保持在 HTTP 调用路径之外。(#57773) 感谢 @jacobtomlinson。 - **强化异步审批后续在仅 webchat 会话中的传递**(#57359) 感谢 @joshavant。 - **心跳/认证**：防止执行事件心跳运行从会话传递目标继承仅所有者工具访问，因此节点执行输出保持在非所有者工具面上，即使目标会话属于所有者。感谢 @AntAISecurityLab 和 @vincentkoc。 - **钩子/配置**：在 `hooks.mappings[].channel` 中接受运行时通道插件 ID（例如 `feishu`），而不是在配置验证期间拒绝非核心通道。(#56226) 感谢 @AiKrai001。 - **钩子/会话路由**：在隔离调度之前将钩子触发的 `agent:` 会话键重新绑定到实际目标代理，因此专用钩子代理保持其自己的会话范围工具和插件身份。感谢 @kexinoh 和 @vincentkoc。 - **主机执行/环境**：阻止可以重定向 Docker 端点、信任根、编译器包含路径、包解析或 Python 环境根的请求范围环境覆盖在批准的主机运行期间。感谢 @tdjackey 和 @vincentkoc。 - **图像生成/构建**：将稳定的运行时别名文件写入 `dist/` 并通过这些别名路由提供程序认证运行时查找，因此图像生成提供程序在重建后保持解析认证/运行时模块，而不是在缺失哈希块文件时崩溃。 - **iOS/Live Activities**：在 `LiveActivityManager.swift` 中将 `ActivityKit` 导入标记为 `@preconcurrency`，因此 Xcode 26.4 / Swift 6 构建在严格并发检查上停止失败。(#57180) 感谢 @ngutman。 - **LINE/ACP**：添加当前会话绑定和入站绑定路由对等，因此 `/acp spawn ... --thread here`、配置的 ACP 绑定和活动会话绑定的 ACP 会话在 LINE 上像其他会话通道一样工作。 - **LINE/Markdown**：在剥离 markdown 时保留拉丁、西里尔和 CJK 单词内的下划线，同时仍移除共享文本运行时路径（LINE 和 TTS 使用）上的独立 `_italic_` 标记。(#47465) 感谢 @jackjin1997。 - **LINE/状态**：停止 `openclaw status` 在已配置消毒的 LINE 快照时警告缺少凭据，同时仍公开缺失字段是令牌还是密钥。(#45701) 感谢 @tamaosamu。 - **macOS/本地网关**：通过识别当前 `openclaw-gateway` 进程标题并使用当前 `openclaw gateway` 启动形状，停止 OpenClaw.app 在启动后杀死健康的本地网关监听器。 - **macOS/广域发现**：将网关发现切换到 Tailscale MagicDNS 名称，因此 Mac 客户端在变化的 tailnet IP 上更可靠恢复。(#57833) 感谢 @jacobtomlinson。 - **Matrix/CLI 发送**：在出站传递之前启动一次性 Matrix 发送客户端，因此 `openclaw message send --channel matrix` 在加密房间中恢复 E2EE，而不是发送普通事件。(#57936) 感谢 @gumadeiras。 - **Matrix/上下文**：按发送者允许列表过滤获取的房间上下文，因此回复和线程上下文查找不再将非允许列表消息拉入代理上下文。(#58376) 感谢 @jacobtomlinson。 - **Matrix/传递恢复**：在启动恢复期间将 Synapse `User not in room` 重放失败视为永久性，因此中毒的排队消息移动到 `failed/`，而不是在重启后使 Matrix 崩溃循环。(#57426) 感谢 @dlardo。 - **Matrix/直接房间**：恢复新鲜自动加入的 1:1 DM，而不急切持久化仅邀请的 `m.direct` 映射，同时保持命名、别名和显式配置的房间在房间路径上。(#58024) 感谢 @gumadeiras。 - **Matrix/直接房间**：停止信任远程 `is_direct`，为发现的 DM 候选者尊重显式本地 `is_direct: false`，并避免共享房间的额外成员状态查找，因此 DM 路由和修复保持对齐。(#57124) 感谢 @w-sss。 - **Matrix/DM 线程**：保持严格的无名新鲜邀请房间可提升，即使 Matrix 省略可选直接提示，保留修复失败本地 DM 提升同时仍重新验证稍后房间元数据，并保持绑定和线程隔离 Matrix 会话报告正确的路由策略。(#58099) 感谢 @gumadeiras。 - **Matrix/插件加载**：正确打包和源加载加密引导运行时辅助程序，因此当前 `main` 停止警告失败的 Matrix 引导加载和每次调用时的 `matrix/index` 插件 ID 不匹配。(#53298) 感谢 @keithce。 - **Mattermost/WebSocket**：在机器人禁用/启用周期后检测陈旧的 Mattermost WebSocket 会话，因此监控干净重新连接而不是静默保持陈旧。(#53604) 感谢 @Qinsam。 - **媒体/下载**：在媒体保存期间停止跨跨源重定向转发认证和 cookie 头，同时为同源重定向链保留安全请求头。感谢 @AntAISecurityLab 和 @vincentkoc。 - **媒体/图像**：在元数据和调整大小后端运行之前拒绝过大的解码图像输入，因此微小的压缩图像炸弹早期失败，而不是耗尽网关内存。(#58226) 感谢 @AntAISecurityLab 和 @vincentkoc。 - **内存/医生**：也从代理工作区探测 QMD 可用性，因此 `openclaw doctor` 不再错误报告相对 `memory.qmd.command` 配置为损坏，而运行时搜索仍然工作。感谢 @vincentkoc。 - **内存/医生**：当 QMD 会话索引启用时抑制孤立转录清理警告，因此医生不再建议删除 QMD 仍用于回忆的转录历史。(#40584) 感谢 @Gyarados4157 和 @vincentkoc。 - **内存/FTS**：添加可配置的三元组分词加上短 CJK 子串回退，因此内存搜索可以找到中文、日文和韩文文本，而不破坏混合长和短查询。感谢 @carrotRakko。 - **内存/FTS**：在默认内存搜索阈值保持提供程序-less 关键字命中可见，因此仅 FTS 回忆工作而不需要 `--min-score 0`。(#56473) 感谢 @opriz。 - **内存/LanceDB**：从捆绑的 `extensions/memory-lancedb` 路径（包括扁平化 dist 块）解析运行时依赖清单查找，因此启动不再以缺失 `@lancedb/lancedb` 依赖错误失败。(#56623) 感谢 @LUKSOAgent。 - **内存/QMD**：添加 `memory.qmd.searchTool` 作为精确 mcporter 工具覆盖，因此自定义 QMD MCP 工具（如 `hybrid_search`）可以在不削弱验证的 `searchMode` 配置面的情况下使用。(#27801) 感谢 @keramblock。 - **内存/QMD**：即使常规 QMD 更新节奏被禁用或更慢，也尊重 `memory.qmd.update.embedInterval`，通过武装专用嵌入节奏维护计时器，同时当常规更新已经足够频繁时避免冗余计时器。(#37326) 感谢 @barronlroth。 - **内存/QMD**：在构建 QMD 自定义集合时包括去重复的默认值加每代理 `memorySearch.extraPaths`，因此共享和代理特定额外根都一致索引。(#57315) 感谢 @Vitalcheffe 和 @vincentkoc。 - **内存/QMD**：当导出会话 markdown 位于工作区 `qmd/` 目录下时，保持 `memory_search` 会话命中路径往返安全，因此 `memory_get` 可以读取精确返回路径而不是在通用 `qmd/sessions/...` 别名上失败。(#43519) 感谢 @holgergruenhagen 和 @vincentkoc。 - **内存/QMD**：在 `search` 模式中也保持 `qmd embed` 活动，因此 BM25 优先设置仍为稍后向量和混合检索构建完整索引。(#54509) 感谢 @hnshah 和 @vincentkoc。 - **内存/QMD**：在 QMD 会话导出中保持重置和删除的会话转录，因此每日会话重置不静默丢弃 `memory_search` 中的大部分历史回忆。(#30220) 感谢 @pushkarsingh32。 - **内存/QMD**：在 `openclaw memory search` 上传递直接会话密钥，因此 CLI QMD 搜索不再在仅直接范围默认下被拒绝为 `session=<none>`。(#43517) 感谢 @waynecc-at 和 @vincentkoc。 - **内存/QMD**：将 `QMD_CONFIG_DIR` 指向嵌套的 `xdg-config/qmd` 目录，因此每代理集合配置正确解析。(#39078) 感谢 @smart-tinker 和 @vincentkoc。 - **内存/QMD**：从 mcporter 查询结果保留显式 `start_line` 和 `end_line` 元数据，因此 `memory search` 命中保持真实片段偏移而不是回退到片段头。(#47960) 感谢 @vincentkoc。 - **内存/QMD**：当 QMD 报告更改的模式但省略路径元数据时重新绑定集合，因此配置模式更改在重启时停止被静默忽略。(#49897) 感谢 @Madruru。 - **内存/QMD**：在返回搜索命中之前将别名化 `memory_search` 文件提示解析回索引文件系统路径，因此 `memory_get` 对混合大小写和带空格路径再次工作。(#50313) 感谢 @erra9x。 - **内存/QMD**：将 MCP `query` 集合过滤器作为上游 `collections` 数组发送，而不是遗留单数 `collection` 字段，因此 mcporter 支持的 QMD 1.1+ 搜索在统一 `query` 工具迁移后仍正确范围。(#54728) 感谢 @armanddp 和 @vincentkoc。 - **内存/QMD**：跨进程 `qmd embed` 运行序列化在共享锁后并交错定期嵌入计时器，因此多代理 QMD 集合在启动和每个维护间隔停止雷群。(#57744) 感谢 @vincentkoc。 - **内存/QMD**：停止在 `qmd search` 之前重写 Han/CJK BM25 查询，因此 OpenClaw 搜索语义匹配混合和带空格中文查询的直接 QMD 结果。感谢 @vincentkoc。 - **内存/QMD**：从 `qmd status` 公开降级向量状态，因此 `openclaw memory status --deep` 在索引仍有 `0` 向量时警告语义搜索不可用。修复 #28169。感谢 @vincentkoc。 - **内存/QMD**：将空字节集合损坏视为 QMD 将其公开为 `ENOENT` 时相同，因此托管集合修复仍重建和重试，而不是让 QMD 卡在损坏路径上。感谢 @vincentkoc。 - **内存/QMD**：当配置 `memory.backend=qmd` 但 `qmd` 二进制文件缺失时明确警告，因此医生和运行时回退不再作为静默内置降级失败。(#50439) 感谢 @Jimmy-xuzimo 和 @vincentkoc。 - **内存/QMD**：在估计块大小时正确加权 CJK 重型文本，在精细分割期间保留代理对字符，并保持长拉丁行在旧块边界上，因此内存索引为 CJK 笔记产生更好大小的块。(#40271) 感谢 @AaronLuo00。 - **内存/会话索引器**：在内存主机会话扫描中包含 `.jsonl.reset.*` 和 `.jsonl.deleted.*` 转录，同时仍排除 `.jsonl.bak.*` 压缩备份和锁文件，因此内存搜索看到存档会话历史而不复制陈旧快照。感谢 @hclsys 和 @vincentkoc。 - **Microsoft Teams/线程**：按发送者允许列表过滤获取的线程历史，因此线程上下文播种不再从不允许用户拉取消息。(#57723) 感谢 @jacobtomlinson。 - **OpenAI/Codex 快速模式**：将 `/fast` 映射到原生 OpenAI 和 Codex 响应端点上的优先级处理，而不是重写推理设置，并记录确切端点和覆盖行为。 - **出站媒体/本地文件**：在配置的 fs 策略上搭载主机本地 `MEDIA:` 读取，而不是单独的媒体根检查，因此生成在工作区外的文件可以在 `tools.fs.workspaceOnly=false` 时发送，而纯文本类主机文件仍被出站媒体允许列表阻止。 - **配对**：对每个账户而不是每个共享通道队列强制执行挂起请求限制，因此一个账户的未决配对挑战不再阻止其他账户的新配对。感谢 @smaeljaish771 和 @vincentkoc。 - **插件/ClawHub**：为范围包名称和斜杠包含的技能别名清理临时存档文件名，因此 `openclaw plugins install @scope/name` 不再在存档下载期间以 `ENOENT` 失败。(#56452) 感谢 @soimy。 - **插件/CLI**：添加描述符支持延迟插件 CLI 注册，因此 Matrix 可以保持其 CLI 模块延迟加载而不从解析时命令注册中删除 `openclaw matrix ...`。(#57165) 感谢 @gumadeiras。 - **插件/CLI**：通过专用非激活 CLI 元数据路径收集根帮助插件描述符，因此启用的插件保持验证的配置语义而不触发仅运行时插件注册工作，同时为仍从完整注册连线命令的遗留通道插件保留运行时 CLI 命令注册。(#57294) 感谢 @gumadeiras。 - **插件/外观**：用缓存优先信号保护捆绑插件外观加载，因此循环重新进入停止在网关插件启动期间崩溃 `xai`、`sglang` 和 `vllm`。(#57508) 感谢 @openperf。 - **插件/Matrix**：将 Matrix 加密 WASM 运行时依赖镜像到根打包安装并强制根/插件依赖对等，因此捆绑 Matrix E2EE 加密在 shipped 构建中正确解析。(#57163) 感谢 @gumadeiras。 - **插件/启动**：阻止工作区 `.env` 覆盖 `OPENCLAW_BUNDLED_PLUGINS_DIR`，因此捆绑插件信任根仅来自继承的运行时环境或包解析，而不是 repo 本地 dotenv 文件。感谢 @nexrin 和 @vincentkoc。 - **沙箱/浏览器**：在沙箱浏览器镜像中安装 `fonts-noto-cjk`，因此截图正确渲染中文、日文和韩文文本，而不是豆腐块。修复 #35597。感谢 @carrotRakko 和 @vincentkoc。 - **安全/LINE**：使网络钩子签名验证在提供的签名长度错误时也运行定时安全比较，关闭小定时侧信道。(#55663) 感谢 @gavyngong。 - **会话/Feishu**：在共享会话助手解析中保留合法嵌入 `:topic:` 的会话 ID，同时保持 Telegram 主题会话解析完整。(#58100) 感谢 @gumadeiras。 - **Slack/状态反应**：在 Slack 监视器中为排队、思考、工具、完成和错误阶段添加反应生命周期，具有更安全的清理，因此排队确认反应在静默运行、回复前失败和延迟转换期间保持正确。(#56430) 感谢 @hsiaoa。 - **状态/仅节点主机**：教导 `openclaw status` 处理当前 `main` 上仅节点主机而没有旧混合网关假设。(#56718) 感谢 @ImLukeF。 - **状态**：通过从提示侧令牌字段推导分母而不是潜在过小的 totalTokens 修复缓存命中率超过 100%。修复 #26643。 - **Telegram/音频**：在本地 `whisper-cli` 自动回退运行之前转码 Telegram 语音笔记 `.ogg` 附件，并在 `tools.media.audio` 未设置时在自动模式保持提及预飞转录启用。 - **Telegram/论坛主题**：恢复回复路由到活动主题并将 ACP `sessions_spawn(..., thread=true, mode="session")` 绑定到同一主题，而不是回退到根聊天或丢失后续路由。(#56060) 感谢 @one27001。 - **Telegram/媒体**：在媒体下载期间允许 RFC 2544 基准范围 Telegram CDN 分辨率，因此语音消息、PDF 和其他附件不再以 `Failed to download media` 失败。(#57624) 感谢 @MoerAI。 - **Telegram/原生命令**：前缀原生命令菜单回调负载并在 Telegram 通过回调查询重放它们时保留 `CommandSource: "native"`，因此即使文本命令路由被禁用，`/fast` 和其他原生命令菜单也保持工作。感谢 @vincentkoc。 - **Telegram/轮询**：通过将最近非轮询 API 活动视为有界活跃而不是硬停顿，使看门狗不中止长时间回复传递。(#56343) 感谢 @openperf。 - **工具/web_fetch**：为仅代理安装添加显式受信环境代理路径，同时保持严格 SSRF 获取在固定直接路径上，因此受信代理路由不削弱严格目的地绑定。(#50650) 感谢 @kkav004。 - **工具/web_search**：将共享搜索缓存本地化到模块范围，因此相同进程全局符号查找不能再检查或突变缓存的网络搜索响应。感谢 @vincentkoc。 - **TTS/Microsoft**：对于 CJK 主导文本自动切换默认 Edge 语音为中文，而不覆盖显式选择的 Microsoft 语音。(#52355) 感谢 @extrasmall0。 - **TTS**：恢复 3.28 架构兼容性和回退可观测性。(#57953) 感谢 @joshavant。 - **TUI/聊天**：通过延迟本地运行绑定直到第一个网关聊天事件揭示真实运行 ID，在活动运行期间保持乐观出站用户消息可见，防止过早历史重新加载擦除挂起的本地发送。(#54722) 感谢 @seanturner001。 - **TUI/模型选择器**：保持可搜索 `/model` 和 `/models` 输入模式不劫持 `j`/`k` 作为导航键，并在 `m` 过滤模型列表下硬化宽度边界，因此搜索不再在长行上崩溃。(#30156) 感谢 @briannicholls。 - **语音呼叫/媒体流**：在 `start` 验证之前限制入站 WebSocket 帧大小，因此过大的启动前帧在 JSON 解析之前被丢弃。感谢 @Kazamayc 和 @vincentkoc。 - **语音呼叫/Plivo**：将存储的回调基础固定到配置的公共网络钩子 URL，因此稍后呼叫控制重定向保持在预期源上，即使网络钩子传输元数据不同。感谢 @zsxsoft 和 @vincentkoc。 - **Web UI/Markdown**：停止裸自动链接吞并相邻 CJK 文本，同时在渲染链接中保留有效的混合脚本路径和查询字符。(#48410) 感谢 @jnuyao。 - **审批/UI**：将最新挂起审批保持在控制 UI 队列前端，因此批准一个请求不意外目标更早过期的 ID。感谢 @vincentkoc。 - **认证配置文件/OAuth**：在保存轮换凭据时刷新运行时认证快照，因此 OAuth 提供程序不在第一次令牌轮换后重用消耗的刷新令牌。修复 #55389。感谢 @sam26880 和 @vincentkoc。 - **浏览器/截图**：在原始 CDP 截图中使用 `fromSurface: false` 以避免 Chromium 合成器错误，该错误丢弃跨源图像纹理（QR 码、CDN 资产），并在完整页面视口扩展期间保留预存在设备仿真状态。(#54358) 感谢 @FMLS。 - **ClawDock/文档**：将帮助脚本移动到 `scripts/clawdock`，将 ClawDock 作为文档站点上的第一类文档页面发布，并记录从新原始 GitHub 路径重新安装本地帮助副本。(#23912) 感谢 @Olshansk。 - **控制 UI/网关**：在客户端停止时清除排队的浏览器连接超时，因此中止或替换的网关客户端在关闭后不发送延迟连接请求。(#57338) 感谢 @gumadeiras。 - **控制 UI/网关**：当检测到网关事件序列间隙时重新连接浏览器客户端，因此陈旧非聊天状态自动恢复而不是仅仅告诉用户刷新。(#23912) 感谢 @Olshansk。 - **执行审批/通道**：统一 Discord 和 Telegram 执行审批运行时处理，将审批按钮移动到共享交互式回复模型上，并修复 Telegram 审批按钮和键入 `/approve` 命令，因此配置的审批者可以再次可靠解决请求。(#57516) 感谢 @scoootscooob。 - **网关/SQLite 瞬态处理**：在全局拒绝处理器中保持未处理的 `SQLITE_CANTOPEN`、`SQLITE_BUSY`、`SQLITE_LOCKED` 和 `SQLITE_IOERR` 失败非致命，因此 macOS LaunchAgent 重启不进入崩溃限制循环。(#57018) - **钩子/插件/技能**：阻止工作区 `.env` 覆盖捆绑根目录，因此工作区启动不能将捆绑信任根重定向离开打包默认值。感谢 @nexrin 和 @vincentkoc。 - **LINE/网络钩子**：限制共享并发预验证网络钩子体读取，因此过多请求在进入 LINE 体处理程序之前被拒绝。感谢 @nexrin 和 @vincentkoc。 - **内存/QMD**：为工作区外的共享路径保留显式自定义集合名称，因此 `memory_search` 停止为外部管理的 QMD 集合追加 `-<agentId>`。(#52539) 感谢 @lobsrice 和 @vincentkoc。 - **内存/内置**：在仅 FTS 模式（无嵌入提供程序）中保持内存文件索引活动，因此强制重新索引不再交换进空索引并擦除现有内存块。(#42714) 感谢 @asamimei。 - **Nostr/配置**：在配置快照和控制 UI 配置视图中编辑 `channels.nostr.privateKey`，因此 Nostr 签名密钥不再以明文显示。感谢 @ccreater222。 - **插件审批**：在 `plugin.approval.resolve` 上接受唯一短审批 ID 前缀，匹配执行审批并恢复聊天审批面上的 `/approve` 回退流程。感谢 @vincentkoc。 - **SSH 沙箱/上传**：在同步到远程沙箱之前拒绝解析到上传树之外的 workspace 符号链接，因此稍后代理写入不能通过逃逸链接重定向。感谢 @AntAISecurityLab 和 @vincentkoc。 - **Slack/交互式回复**：从两者解析 Slack Block Kit 回复传递：作者 `channelData.slack.blocks` 负载和指令生成的交互式回复，并保持 Slack 按钮样式映射到有效 Block Kit 按钮渲染，因此交互式回复停止在 Slack 特定传递路径上丢弃。感谢 @vincentkoc。 - **子代理/公告**：为内联确定性工具生成保留请求代理 ID，因此没有通道绑定的命名代理仍可以通过正确的所有者会话公告完成。(#55437) 感谢 @kAIborg24。 - **Telegram/Anthropic 流式**：用安全重试消息替换原始无效流顺序提供程序错误，因此内部 `message_start/message_stop` 失败不泄漏到聊天中。(#55408) 感谢 @imydal。 - **Tlon/媒体**：将入站图像下载路由到共享媒体存储，将每个下载限制在 6 MB，并在每条消息后 8 张图像停止，因此大型 Tlon 帖子不再膨胀本地媒体存储。感谢 @AntAISecurityLab 和 @vincentkoc。 - **代理/实时切换**：停止瞬态 cron 和子代理模型覆盖被误读为持久实时会话切换，因此隔离运行不再以 `LiveSessionModelSwitchError` 失败。感谢 @vincentkoc。 - **代理/工具调用修复**：当提供程序前导码出现在 JSON 负载之前时恢复格式错误的 Kimi/OpenRouter 工具调用参数流，并在非工具前导文本上失败封闭，因此片段字符串在子代理运行期间不泄漏到文件系统路径参数中。(#56560) 感谢 @Originalwhite。 - **网关/启动**：在静态模型路径上保持配置的主模型预热，因此容器引导不快照加载提供程序运行时图，只是为了验证配置的模型。感谢 @vincentkoc。 - **OpenAI/响应**：在 OpenAI、Codex 和 Azure OpenAI 请求构建器上省略禁用的推理负载，因此 GPT-5 端点不再拒绝 `reasoning.effort: "none"`。(#58208) 感谢 @jalehman。 - **WhatsApp/出站**：在最近的通道接缝重构后恢复运行时发送/操作路由和出站兼容性，因此出站发送、反应和相关媒体操作保持到达活动会话。 - **xAI/响应**：为 xAI 响应负载规范图像承载工具结果，包括 OpenResponses 风格 `input_image.source` 部分，因此图像工具重放不再在后续回合上 422。(#58017) 感谢 @neeravmakwana。 - **Zalo/网络钩子**：将重放去重范围限定到认证目标，因此一个配置的账户不再导致另一个目标的相同 ID 入站事件被丢弃。感谢 @smaeljaish771 和 @vincentkoc。 - **插件/提示构建**：在合并 `before_prompt_build` 钩子结果时保留最高优先级的 `systemPrompt`，而不是让较低优先级钩子覆盖它。(#58375) - **Tlon/设置迁移**：在迁移期间保留显式空数组设置，因此重启时重新播种不再恢复较旧的文件配置值。(#58370) - **插件/市场**：通过公开受保护的下载失败为结构化安装错误并从最终解析的 URL 派生临时文件名来加固市场存档安装。(#58267) - **UI/DOM 安全**：使用 DOM 节点而不是注入的 HTML 字符串构建聊天删除确认弹出窗口和 Canvas Host 回退状态行。(#58269, #58266) - **媒体/文件处理**：在共享 OpenClaw 临时根下创建图像临时工作目录，并停止从回复或工具源路径放宽允许的本地媒体根，保持本地媒体访问限制到配置的和代理范围的根。(#58270, #57770) - **Telegram/安全**：将遗留配对 `allowFrom` 状态迁移到仅 `default` 账户，并门控组语音消息预飞转录在发送者授权上，因此未经授权的发送者不能在丢弃前触发付费转录。(#58165, #57566) - **执行审批**：停止 shell 初始化文件标志匹配持久化脚本路径审批，检测工具如 `awk`、`find`、`xargs`、`make` 和 `sed` 中的命令载体内联求值，并将 awk 系列视为解释器类，因此始终允许决定不再持久化解释器路径。(#58369, #57842, #57772) - **语音呼叫/Telnyx**：在派生重放键之前规范化验证的网络钩子签名，因此等效 Base64 和 Base64URL 编码正确去重。(#57829) - **网关/HTTP 信任边界**：忽略自声明承载范围，默认拒绝危险 HTTP 工具调用路径，在 `/v1/embeddings` 上需要写入范围，并将 OpenAI 兼容 `/v1/chat/completions` 加 `/v1/responses` 入口绑定为非所有者，因此外部 HTTP 调用者不能自我升级访问。(#57783, #57771, #57721, #57769, #57778) - **网关/受信配置和引导**：清除无设备 `trusted-proxy` WebSocket 连接的自声明范围，并将控制 UI 引导负载修剪到正常握手之前仅需要的字段。(#57692, #57727) - **技能和工作区安全**：用 symlink 安全、根限制加载器替换原始技能文件读取，并将仅工作区 `apply_patch` 删除和目录创建突变固定到验证的工作区根，因此路径重绑定竞争失败封闭。(#57519, #56016) - **环境和文件系统强化**：阻止工作区 `.env` 文件中的凭据和网关认证环境变量，始终剥离危险继承的主机环境变量如 `BROWSER` 和 `GIT_EDITOR`，并保持敏感主机路径和 OpenClaw 状态根被阻止，即使外部沙箱绑定源被允许。(#57767, #57559, #56024) - **OpenShell 和 ACP 文件边界**：在 OpenShell 镜像同步期间跳过符号链接并保留仅主机受信目录，并将 ACP 附件读取通过共享附件缓存路由，因此允许根之外的本地文件不再被转发。(#57693, #57690) - **通道/网络钩子授权**：跳过 Discord 音频预飞转录用于未授权公会发送者，为 Synology Chat 网络钩子添加共享预认证飞行中保护，并在 JSON 体解析之前验证 Microsoft Teams 承载认证。(#57695, #57722, #57686) - **基础架构/随机性**：在受影响的标识符和延迟抖动路径中用共享安全随机助手替换 `Math.random()`，包括 UI UUID 生成。(#57744)

### Breaking - Nodes/exec: remove the duplicated `nodes.run` shell wrapper from the CLI and agent `nodes` tool so node shell execution always goes through `exec host=node`, keeping node-specific capabilities on `nodes invoke` and the dedicated media/location/notify actions. - Plugin SDK: deprecate the legacy provider compat subpaths plus the older bundled provider setup and channel-runtime compatibility shims, emit migration warnings, and keep the current documented `openclaw/plugin-sdk/*` entrypoints plus local `api.ts` / `runtime-api.ts` barrels as the forward path ahead of a future major-release removal. - Skills/install and Plugins/install: built-in dangerous-code `critical` findings and install-time scan failures now fail closed by default, so plugin installs and gateway-backed skill dependency installs that previously succeeded may now require an explicit dangerous override such as `--dangerously-force-unsafe-install` to proceed. - Gateway/auth: `trusted-proxy` now rejects mixed shared-token configs, and local-direct fallback requires the configured token instead of implicitly authenticating same-host callers. Thanks @zhangning-agent, @jacobtomlinson, and @vincentkoc. - Gateway/node commands: node commands now stay disabled until node pairing is approved, so device pairing alone is no longer enough to expose declared node commands. (#57777) Thanks @jacobtomlinson. - Gateway/node events: node-originated runs now stay on a reduced trusted surface, so notification-driven or node-triggered flows that previously relied on broader host/session tool access may need adjustment. (#57691) Thanks @jacobtomlinson. ### Changes - ACP/plugins: add an explicit default-off ACPX plugin-tools MCP bridge config, document the trust boundary, and harden the built-in bridge packaging/logging path so global installs and stdio MCP sessions work reliably. (#56867) Thanks @joe2643. - Agents/LLM: add a configurable idle-stream timeout for embedded runner requests so stalled model streams abort cleanly instead of hanging until the broader run timeout fires. (#55072) Thanks @liuy. - Agents/MCP: materialize bundle MCP tools with provider-safe names (`serverName__toolName`), support optional `streamable-http` transport selection plus per-server connection timeouts, and preserve real tool results from aborted/error turns unless truncation explicitly drops them. (#49505) Thanks @ziomancer. - Android/notifications: add notification-forwarding controls with package filtering, quiet hours, rate limiting, and safer picker behavior for forwarded notification events. (#40175) Thanks @nimbleenigma. - Background tasks: turn tasks into a real shared background-run control plane instead of ACP-only bookkeeping by unifying ACP, subagent, cron, and background CLI execution under one SQLite-backed ledger, routing detached lifecycle updates through the executor seam, adding audit/maintenance/status visibility, tightening auto-cleanup and lost-run recovery, improving task awareness in internal status/tool surfaces, and clarifying the split between heartbeat/main-session automation and detached scheduled runs. Thanks @mbelinky and @vincentkoc. - Background tasks: add the first linear task flow control surface with `openclaw flows list|show|cancel`, keep manual multi-task flows separate from one-task auto-sync flows, and surface doctor recovery hints for obviously orphaned or broken flow/task linkage. Thanks @mbelinky and @vincentkoc. - Channels/QQ Bot: add QQ Bot as a bundled channel plugin with multi-account setup, SecretRef-aware credentials, slash commands, reminders, and media send/receive support. (#52986) Thanks @sliverp. - Diffs: skip unused viewer-versus-file SSR preload work so `diffs` view-only and file-only runs do less render work while keeping mode outputs aligned. (#57909) thanks @gumadeiras. - Tasks: add a minimal SQLite-backed task flow registry plus task-to-flow linkage scaffolding, so orchestrated work can start gaining a first-class parent record without changing current task delivery behavior. Thanks @mbelinky and @vincentkoc. - Tasks: persist blocked state on one-task task flows and let the same flow reopen cleanly on retry, so blocked detached work can carry a parent-level reason and continue without fragmenting into a new job. Thanks @mbelinky and @vincentkoc. - Tasks: route one-task ACP and subagent updates through a parent task-flow owner context, so detached work can emerge back through the intended parent thread/session instead of speaking only as a raw child task. Thanks @mbelinky and @vincentkoc. - LINE/outbound media: add LINE image, video, and audio outbound sends on the LINE-specific delivery path, including explicit preview/tracking handling for videos while keeping generic media sends on the existing image-only route. (#45826) Thanks @masatohoshino. - Matrix/history: add optional room history context for Matrix group triggers via `channels.matrix.historyLimit`, with per-agent watermarks and retry-safe snapshots so failed trigger retries do not drift into newer room messages. (#57022) thanks @chain710. - Matrix/network: add explicit `channels.matrix.proxy` config for routing Matrix traffic through an HTTP(S) proxy, including account-level overrides and matching probe/runtime behavior. (#56931) thanks @patrick-yingxi-pan. - Matrix/streaming: add draft streaming so partial Matrix replies update the same message in place instead of sending a new message for each chunk. (#56387) Thanks @jrusz. - Matrix/threads: add per-DM `threadReplies` overrides and keep thread session isolation aligned with the effective room or DM thread policy from the triggering message onward. (#57995) thanks @teconomix. - MCP: add remote HTTP/SSE server support for `mcp.servers` URL configs, including auth headers and safer config redaction for MCP credentials. (#50396) Thanks @dhananjai1729. - Memory/QMD: add per-agent `memorySearch.qmd.extraCollections` so agents can opt into cross-agent session search without flattening every transcript collection into one shared QMD namespace. Thanks @vincentkoc. - Microsoft Teams/member info: add a Graph-backed member info action so Teams automations and tools can resolve channel member details directly from Microsoft Graph. (#57528) Thanks @sudie-codes. - Nostr/inbound DMs: verify inbound event signatures before pairing or sender-authorization side effects, so forged DM events no longer create pairing requests or trigger reply attempts. Thanks @smaeljaish771 and @vincentkoc. - OpenAI/Responses: forward configured `text.verbosity` across Responses HTTP and WebSocket transports, surface it in `/status`, and keep per-agent verbosity precedence aligned with runtime behavior. (#47106) Thanks @merc1305 and @vincentkoc. - Pi/Codex: add native Codex web search support for embedded Pi runs, including config/docs/wizard coverage and managed-tool suppression when native Codex search is active. (#46579) Thanks @Evizero. - Slack/exec approvals: add native Slack approval routing and approver authorization so exec approval prompts can stay in Slack instead of falling back to the Web UI or terminal. Thanks @vincentkoc. - TTS: Add structured provider diagnostics and fallback attempt analytics. (#57954) Thanks @joshavant. - WhatsApp/reactions: agents can now react with emoji on incoming WhatsApp messages, enabling more natural conversational interactions like acknowledging a photo with ❤️ instead of typing a reply. Thanks @mcaxtr. - Agents/BTW: force `/btw` side questions to disable provider reasoning so Anthropic adaptive-thinking sessions stop failing with `No BTW response generated`. Fixes #55376. Thanks @Catteres and @vincentkoc. - CLI/onboarding: reset the remote gateway URL prompt to the safe loopback default after declining a discovered endpoint, so onboarding does not keep a previously rejected remote URL. (#57828) - Agents/exec defaults: honor per-agent `tools.exec` defaults when no inline directive or session override is present, so configured exec host, security, ask, and node settings actually apply. (#57689) - Sandbox/networking: sanitize SSH subprocess env vars through the shared sandbox policy and route marketplace archive downloads plus Ollama discovery, auth, and pull requests through the guarded fetch path so sandboxed execution and remote fetches follow the repo's trust boundaries. (#57848, #57850) ### Fixes - Agents/OpenAI Responses: normalize raw bundled MCP tool schemas on the WebSocket/Responses path so bare-object, object-ish, and top-level union MCP tools no longer get rejected by OpenAI during tool registration. (#58299) Thanks @yelog. - ACP/security: replace ACP's dangerous-tool name override with semantic approval classes, so only narrow readonly reads/searches can auto-approve while indirect exec-capable and control-plane tools always require explicit prompt approval. Thanks @vincentkoc. - ACP/sessions_spawn: register ACP child runs for completion tracking and lifecycle cleanup, and make registration-failure cleanup explicitly best-effort so callers do not assume an already-started ACP turn was fully aborted. (#40885) Thanks @xaeon2026 and @vincentkoc. - ACP/tasks: mark cleanly exited ACP runs as blocked when they end on deterministic write or authorization blockers, and wake the parent session with a follow-up instead of falsely reporting success. - ACPX/runtime: derive the bundled ACPX expected version from the extension package metadata instead of hardcoding a separate literal, so plugin-local ACPX installs stop drifting out of health-check parity after version bumps. (#49089) Thanks @jiejiesks and @vincentkoc. - Agents/Anthropic failover: treat Anthropic `api_error` payloads with `An unexpected error occurred while processing the response` as transient so retry/fallback can engage instead of surfacing a terminal failure. (#57441) Thanks @zijiess and @vincentkoc. - Agents/compaction: keep late compaction-retry rejections handled after the aggregate timeout path wins without swallowing real pre-timeout wait failures, so timed-out retries no longer surface an unhandled rejection on later unsubscribe. (#57451) Thanks @mpz4life and @vincentkoc. - Agents/context pruning: count supplementary-plane CJK characters with the shared code-point-aware estimator so context pruning stops underestimating Japanese and Chinese text that uses Extension B ideographs. (#39985) Thanks @Edward-Qiang-2024. - Agents/Kimi: preserve already-valid Anthropic-compatible tool call argument objects while still clearing cached repairs when later trailing junk exceeds the repair allowance. (#54491) Thanks @yuanaichi. - Agents/MCP: dispose bundled MCP runtimes after one-shot `openclaw agent --local` runs finish, while preserving bundled MCP state across in-run retries so local JSON runs exit cleanly without restarting stateful MCP tools mid-run. - Agents/MCP: reuse bundled MCP runtimes across turns in the same session, while recreating them when MCP config changes and disposing stale runtimes cleanly on session rollover. (#55090) Thanks @allan0509. - Agents/memory flush: keep daily memory flush files append-only during embedded attempts so compaction writes do not overwrite earlier notes. (#53725) Thanks @HPluseven. - Agents/sandbox: honor `tools.sandbox.tools.alsoAllow`, let explicit sandbox re-allows remove matching built-in default-deny tools, and keep sandbox explain/error guidance aligned with the effective sandbox tool policy. (#54492) Thanks @ngutman. - Agents/sandbox: make remote FS bridge reads pin the parent path and open the file atomically in the helper so read access cannot race path resolution. Thanks @AntAISecurityLab and @vincentkoc. - Agents/silent turns: fail closed on silent memory-flush runs so narrated `NO_REPLY` self-talk cannot stream or finalize into external replies even when block streaming is enabled. (#52593) - Agents/subagents: fix interim subagent runtime display so `/subagents list` and `/subagents info` stop inflating short runtimes and show second-level durations correctly. (#57739) Thanks @samzong. - Anthropic/OAuth: inject `/fast` `service_tier` hints for direct `sk-ant-oat-*` requests so OAuth-authenticated Anthropic runs stop missing the same overload-routing signal as API-key traffic. Fixes #55758. Thanks @Cypherm and @vincentkoc. - Anthropic/service tiers: support explicit `serviceTier` model params for direct Anthropic requests and let them override `/fast` defaults when both are set. (#45453) Thanks @vincentkoc. - Auto-reply/fast: accept `/fast status` on the directive-only path, align help/status text with the documented `status|on|off` syntax, and keep current-state replies consistent across command surfaces. Fixes #46095. Thanks @weissfl and @vincentkoc. - Azure OpenAI/custom providers: use the `azure-openai-responses` path for Azure custom providers so Azure OpenAI endpoints stay on the correct Responses integration surface. (#50851) Thanks @kunalk16. - BlueBubbles/iMessage: coalesce URL-only inbound messages with their link-preview balloon again so sharing a bare link no longer drops the URL from agent context. Thanks @vincentkoc. - Browser/plugins: auto-enable the bundled browser plugin when browser config or browser tool policy already references it, and show a clearer CLI error when `plugins.allow` excludes `browser`. - CI/dev checks: default local `pnpm check` to a lower-memory typecheck/lint path while keeping CI on the normal parallel path, and harden Telegram test typing/literals around native TypeScript-Go tooling crashes. - Tasks: add a small task-flow runtime substrate for authoring layers with persisted wait targets and output bags, plus bundled skills/Lobster examples and richer `flows show` / `doctor` recovery hints for multi-task flow state. (#58336) Thanks @mbelinky and @vincentkoc. - Config/legacy cleanup: stop probing obsolete alternate legacy config names and service labels during local config/service detection, while keeping the active `~/.openclaw/openclaw.json` path canonical. - Config/runtime: pin the first successful config load in memory for the running process and refresh that snapshot on successful writes/reloads, so hot paths stop reparsing `openclaw.json` between watcher-driven swaps. - Config/SecretRef + Control UI: harden SecretRef redaction round-trip restore, block unsafe raw fallback (force Form mode when raw is unavailable), and preflight submitted-config SecretRefs before config write RPC persistence. (#58044) Thanks @joshavant. - Config/Telegram: migrate removed `channels.telegram.groupMentionsOnly` into `channels.telegram.groups["*"].requireMention` on load so legacy configs no longer crash at startup. (#55336) thanks @jameslcowan. - Config/update: stop `openclaw doctor` write-backs from persisting plugin-injected channel defaults, so `openclaw update` no longer seeds config keys that later break service refresh validation. (#56834) Thanks @openperf. - Control UI/agents: auto-load agent workspace files on initial Files panel open, and populate overview model/workspace/fallbacks from effective runtime agent metadata so defaulted models no longer show as `Not set`. (#56637) Thanks @dxsx84. - Control UI/slash commands: make `/steer` and `/redirect` work from the chat command palette with visible pending state for active-run `/steer`, correct redirected-run tracking, and a single canonical `/steer` entry in the command menu. (#54625) Thanks @fuller-stack-dev. - Cron/announce: preserve all deliverable text payloads for announce mode instead of collapsing to the last chunk, so multi-line cron reports deliver in full to Telegram forum topics. - Cron/isolated sessions: carry the full live-session provider, model, and auth-profile selection across retry restarts so cron jobs with model overrides no longer fail or loop on mid-run model-switch requests. (#57972) Thanks @issaba1. - Diffs/config: preserve schema-shaped plugin config parsing from `diffsPluginConfigSchema.safeParse()`, so direct callers keep `defaults` and `security` sections instead of receiving flattened tool defaults. (#57904) Thanks @gumadeiras. - Diffs: fall back to plain text when `lang` hints are invalid during diff render and viewer hydration, so bad or stale language values no longer break the diff viewer. (#57902) Thanks @gumadeiras. - Discord/voice: enforce the same guild channel and member allowlist checks on spoken voice ingress before transcription, so joined voice channels no longer accept speech from users outside the configured Discord access policy. Thanks @cyjhhh and @vincentkoc. - Docker/setup: force BuildKit for local image builds (including sandbox image builds) so `./docker-setup.sh` no longer fails on `RUN --mount=...` when hosts default to Docker's legacy builder. (#56681) Thanks @zhanghui-china. - Docs/anchors: fix broken English docs links and make Mint anchor audits run against the English-source docs tree. (#57039) thanks @velvet-shark. - Doctor/plugins: skip false Matrix legacy-helper warnings when no migration plans exist, and keep bundled `enabledByDefault` plugins in the gateway startup set. (#57931) Thanks @dinakars777. - Exec approvals/macOS: unwrap `arch` and `xcrun` before deriving shell payloads and allow-always patterns, so wrapper approvals stay bound to the carried command instead of the outer carrier. Thanks @tdjackey and @vincentkoc. - Exec approvals: unwrap `caffeinate` and `sandbox-exec` before persisting allow-always trust so later shell payload changes still require a fresh approval. Thanks @tdjackey and @vincentkoc. - Exec/approvals: infer Discord and Telegram exec approvers from existing owner config when `execApprovals.approvers` is unset, extend the default approval window to 30 minutes, and clarify approval-unavailable guidance so approvals do not appear to silently disappear. - Exec/approvals: keep `awk` and `sed` family binaries out of the low-risk `safeBins` fast path, and stop doctor profile scaffolding from treating them like ordinary custom filters. Thanks @vincentkoc. - Exec/env: block proxy, TLS, and Docker endpoint env overrides in host execution so request-scoped commands cannot silently reroute outbound traffic or trust attacker-supplied certificate settings. Thanks @AntAISecurityLab. - Exec/env: block Python package index override variables from request-scoped host exec environment sanitization so package fetches cannot be redirected through a caller-supplied index. Thanks @nexrin and @vincentkoc. - Exec/node: stop gateway-side workdir fallback from rewriting explicit `host=node` cwd values to the gateway filesystem, so remote node exec approval and runs keep using the intended node-local directory. (#50961) Thanks @openperf. - Exec/runtime: default implicit exec to `host=auto`, resolve that target to sandbox only when a sandbox runtime exists, keep explicit `host=sandbox` fail-closed without sandbox, and show `/exec` effective host state in runtime status/docs. - Exec: fail closed when the implicit sandbox host has no sandbox runtime, and stop denied async approval followups from reusing prior command output from the same session. (#56800) Thanks @scoootscooob. - Feishu/groups: keep quoted replies and topic bootstrap context aligned with group sender allowlists so only allowlisted thread messages seed agent context. Thanks @AntAISecurityLab and @vincentkoc. - Gateway/attachments: offload large inbound images without leaking `media://` markers into text-only runs, preserve mixed attachment order for model input/transcripts, and fail closed when model image capability cannot be resolved. (#55513) Thanks @Syysean. - Gateway/auth: keep shared-auth rate limiting active during WebSocket handshake attempts even when callers also send device-token candidates, so bogus device-token fields no longer suppress shared-secret brute-force tracking. Thanks @kexinoh and @vincentkoc. - Gateway/auth: reject mismatched browser `Origin` headers on trusted-proxy HTTP operator requests while keeping origin-less headless proxy clients working. Thanks @AntAISecurityLab and @vincentkoc. - Gateway/device tokens: disconnect active device sessions after token rotation so newly rotated credentials revoke existing live connections immediately instead of waiting for those sockets to close naturally. Thanks @zsxsoft and @vincentkoc. - Gateway/health: carry webhook-vs-polling account mode from channel descriptors into runtime snapshots so passive channels like LINE and BlueBubbles skip false stale-socket health failures. (#47488) Thanks @karesansui-u. - Gateway/pairing: restore QR bootstrap onboarding handoff so fresh `/pair qr` iPhone setup can auto-approve the initial node pairing, receive a reusable node device token, and stop retrying with spent bootstrap auth. (#58382) Thanks @ngutman. - Gateway/OpenAI compatibility: accept flat Responses API function tool definitions on `/v1/responses` and preserve `strict` when normalizing hosted tools into the embedded runner, so spec-compliant clients like Codex no longer fail validation or silently lose strict tool enforcement. Thanks @malaiwah and @vincentkoc. - Gateway/OpenAI HTTP: restore default operator scopes for bearer-authenticated requests that omit `x-openclaw-scopes`, so headless `/v1/chat/completions` and session-history callers work again after the recent method-scope hardening. (#57596) Thanks @openperf. - Gateway/plugins: scope plugin-auth HTTP route runtime clients to read-only access and keep gateway-authenticated plugin routes on write scope, so plugin-owned webhook handlers do not inherit write-capable runtime access by default. Thanks @davidluzsilva and @vincentkoc. - Gateway/SecretRef: resolve restart token drift checks with merged service/runtime env sources and hard-fail unsupported mutable SecretRef plus OAuth-profile combinations so restart warnings and policy enforcement match runtime behavior. (#58141) Thanks @joshavant. - Gateway/tools HTTP: tighten HTTP tool-invoke authorization so owner-only tools stay off HTTP invoke paths. (#57773) Thanks @jacobtomlinson. - Harden async approval followup delivery in webchat-only sessions (#57359) Thanks @joshavant. - Heartbeat/auth: prevent exec-event heartbeat runs from inheriting owner-only tool access from the session delivery target, so node exec output stays on the non-owner tool surface even when the target session belongs to the owner. Thanks @AntAISecurityLab and @vincentkoc. - Hooks/config: accept runtime channel plugin ids in `hooks.mappings[].channel` (for example `feishu`) instead of rejecting non-core channels during config validation. (#56226) Thanks @AiKrai001. - Hooks/session routing: rebind hook-triggered `agent:` session keys to the actual target agent before isolated dispatch so dedicated hook agents keep their own session-scoped tool and plugin identity. Thanks @kexinoh and @vincentkoc. - Host exec/env: block additional request-scoped env overrides that can redirect Docker endpoints, trust roots, compiler include paths, package resolution, or Python environment roots during approved host runs. Thanks @tdjackey and @vincentkoc. - Image generation/build: write stable runtime alias files into `dist/` and route provider-auth runtime lookups through those aliases so image-generation providers keep resolving auth/runtime modules after rebuilds instead of crashing on missing hashed chunk files. - iOS/Live Activities: mark the `ActivityKit` import in `LiveActivityManager.swift` as `@preconcurrency` so Xcode 26.4 / Swift 6 builds stop failing on strict concurrency checks. (#57180) Thanks @ngutman. - LINE/ACP: add current-conversation binding and inbound binding-routing parity so `/acp spawn ... --thread here`, configured ACP bindings, and active conversation-bound ACP sessions work on LINE like the other conversation channels. - LINE/markdown: preserve underscores inside Latin, Cyrillic, and CJK words when stripping markdown, while still removing standalone `_italic_` markers on the shared text-runtime path used by LINE and TTS. (#47465) Thanks @jackjin1997. - LINE/status: stop `openclaw status` from warning about missing credentials when sanitized LINE snapshots are already configured, while still surfacing whether the missing field is the token or secret. (#45701) Thanks @tamaosamu. - macOS/local gateway: stop OpenClaw.app from killing healthy local gateway listeners after startup by recognizing the current `openclaw-gateway` process title and using the current `openclaw gateway` launch shape. - macOS/wide-area discovery: switch gateway discovery to Tailscale MagicDNS names so Mac clients recover more reliably across changing tailnet IPs. (#57833) Thanks @jacobtomlinson. - Matrix/CLI send: start one-off Matrix send clients before outbound delivery so `openclaw message send --channel matrix` restores E2EE in encrypted rooms instead of sending plain events. (#57936) Thanks @gumadeiras. - Matrix/context: filter fetched room context by sender allowlists so reply and thread context lookup no longer pulls non-allowlisted messages into agent context. (#58376) Thanks @jacobtomlinson. - Matrix/delivery recovery: treat Synapse `User not in room` replay failures as permanent during startup recovery so poisoned queued messages move to `failed/` instead of crash-looping Matrix after restart. (#57426) thanks @dlardo. - Matrix/direct rooms: recover fresh auto-joined 1:1 DMs without eagerly persisting invite-only `m.direct` mappings, while keeping named, aliased, and explicitly configured rooms on the room path. (#58024) Thanks @gumadeiras. - Matrix/direct rooms: stop trusting remote `is_direct`, honor explicit local `is_direct: false` for discovered DM candidates, and avoid extra member-state lookups for shared rooms so DM routing and repair stay aligned. (#57124) Thanks @w-sss. - Matrix/DM threads: keep strict unnamed fresh-invite rooms promotable even when Matrix omits the optional direct hint, preserve repair-failed local DM promotions while still revalidating later room metadata, and keep both bound and thread-isolated Matrix sessions reporting the correct route policy. (#58099) Thanks @gumadeiras. - Matrix/plugin loading: ship and source-load the crypto bootstrap runtime sidecar correctly so current `main` stops warning about failed Matrix bootstrap loads and `matrix/index` plugin-id mismatches on every invocation. (#53298) thanks @keithce. - Mattermost/websocket: detect stale Mattermost WebSocket sessions after bot disable/enable cycles so monitoring reconnects cleanly instead of silently staying stale. (#53604) Thanks @Qinsam. - Media/downloads: stop forwarding auth and cookie headers across cross-origin redirects during media saves, while preserving safe request headers for same-origin redirect chains. Thanks @AntAISecurityLab and @vincentkoc. - Media/images: reject oversized decoded image inputs before metadata and resize backends run, so tiny compressed image bombs fail early instead of exhausting gateway memory. (#58226) Thanks @AntAISecurityLab and @vincentkoc. - Memory/doctor: probe QMD availability from the agent workspace too, so `openclaw doctor` no longer falsely reports relative `memory.qmd.command` configs as broken while runtime search still works. Thanks @vincentkoc. - Memory/doctor: suppress the orphan transcript cleanup warning when QMD session indexing is enabled, so doctor no longer suggests deleting transcript history that QMD still uses for recall. (#40584) Thanks @Gyarados4157 and @vincentkoc. - Memory/FTS: add configurable trigram tokenization plus short-CJK substring fallback so memory search can find Chinese, Japanese, and Korean text without breaking mixed long-and-short queries. Thanks @carrotRakko. - Memory/FTS: keep provider-less keyword hits visible at the default memory-search threshold, so FTS-only recall works without requiring `--min-score 0`. (#56473) Thanks @opriz. - Memory/LanceDB: resolve runtime dependency manifest lookup from the bundled `extensions/memory-lancedb` path (including flattened dist chunks) so startup no longer fails with a missing `@lancedb/lancedb` dependency error. (#56623) Thanks @LUKSOAgent. - Memory/QMD: add `memory.qmd.searchTool` as an exact mcporter tool override, so custom QMD MCP tools such as `hybrid_search` can be used without weakening the validated `searchMode` config surface. (#27801) Thanks @keramblock. - Memory/QMD: honor `memory.qmd.update.embedInterval` even when regular QMD update cadence is disabled or slower by arming a dedicated embed-cadence maintenance timer, while avoiding redundant timers when regular updates are already frequent enough. (#37326) Thanks @barronlroth. - Memory/QMD: include deduplicated default plus per-agent `memorySearch.extraPaths` when building QMD custom collections, so shared and agent-specific extra roots both get indexed consistently. (#57315) Thanks @Vitalcheffe and @vincentkoc. - Memory/QMD: keep `memory_search` session-hit paths roundtrip-safe when exported session markdown lives under the workspace `qmd/` directory, so `memory_get` can read the exact returned path instead of failing on the generic `qmd/sessions/...` alias. (#43519) Thanks @holgergruenhagen and @vincentkoc. - Memory/QMD: keep `qmd embed` active in `search` mode too, so BM25-first setups still build a complete index for later vector and hybrid retrieval. (#54509) Thanks @hnshah and @vincentkoc. - Memory/QMD: keep reset and deleted session transcripts in QMD session export so daily session resets do not silently drop most historical recall from `memory_search`. (#30220) Thanks @pushkarsingh32. - Memory/QMD: pass a direct-session key on `openclaw memory search` so CLI QMD searches no longer get denied as `session=<none>` under direct-only scope defaults. (#43517) Thanks @waynecc-at and @vincentkoc. - Memory/QMD: point `QMD_CONFIG_DIR` at the nested `xdg-config/qmd` directory so per-agent collection config resolves correctly. (#39078) Thanks @smart-tinker and @vincentkoc. - Memory/QMD: preserve explicit `start_line` and `end_line` metadata from mcporter query results so `memory search` hits keep the real snippet offsets instead of falling back to the snippet header. (#47960) Thanks @vincentkoc. - Memory/QMD: rebind collections when QMD reports a changed pattern but omits path metadata, so config pattern changes stop being silently ignored on restart. (#49897) Thanks @Madruru. - Memory/QMD: resolve slugified `memory_search` file hints back to the indexed filesystem path before returning search hits, so `memory_get` works again for mixed-case and spaced paths. (#50313) Thanks @erra9x. - Memory/QMD: send MCP `query` collection filters as the upstream `collections` array instead of the legacy singular `collection` field, so mcporter-backed QMD 1.1+ searches still scope correctly after the unified `query` tool migration. (#54728) Thanks @armanddp and @vincentkoc. - Memory/QMD: serialize cross-process `qmd embed` runs behind a shared lock and stagger periodic embed timers so multi-agent QMD collections stop thundering-herding on startup and every maintenance interval. Thanks @vincentkoc. - Memory/QMD: stop rewriting Han/CJK BM25 queries before `qmd search`, so OpenClaw search semantics match direct QMD results for mixed and spaced Chinese queries. Thanks @vincentkoc. - Memory/QMD: surface degraded vector status from `qmd status` so `openclaw memory status --deep` warns when semantic search is unavailable because the index still has `0` vectors. Fixes #28169. Thanks @vincentkoc. - Memory/QMD: treat null-byte collection corruption the same when QMD surfaces it as `ENOENT`, so managed-collection repair still rebuilds and retries instead of leaving QMD stuck on a broken path. Thanks @vincentkoc. - Memory/QMD: warn explicitly when `memory.backend=qmd` is configured but the `qmd` binary is missing, so doctor and runtime fallback no longer fail as a silent builtin downgrade. (#50439) Thanks @Jimmy-xuzimo and @vincentkoc. - Memory/QMD: weight CJK-heavy text correctly when estimating chunk sizes, preserve surrogate-pair characters during fine splits, and keep long Latin lines on the old chunk boundaries so memory indexing produces better-sized chunks for CJK notes. (#40271) Thanks @AaronLuo00. - Memory/session indexer: include `.jsonl.reset.*` and `.jsonl.deleted.*` transcripts in the memory host session scan while still excluding `.jsonl.bak.*` compaction backups and lock files, so memory search sees archived session history without duplicating stale snapshots. Thanks @hclsys and @vincentkoc. - Microsoft Teams/threads: filter fetched thread history by sender allowlists so thread context seeding no longer pulls messages from disallowed users. (#57723) Thanks @jacobtomlinson. - OpenAI/Codex fast mode: map `/fast` to priority processing on native OpenAI and Codex Responses endpoints instead of rewriting reasoning settings, and document the exact endpoint and override behavior. - Outbound media/local files: piggyback host-local `MEDIA:` reads on the configured fs policy instead of a separate media-root check, so generated files outside the workspace can send when `tools.fs.workspaceOnly=false` while plaintext-like host files stay blocked by the outbound media allowlist. - Pairing: enforce pending request limits per account instead of per shared channel queue, so one account's outstanding pairing challenges no longer block new pairing on other accounts. Thanks @smaeljaish771 and @vincentkoc. - Plugins/ClawHub: sanitize temporary archive filenames for scoped package names and slash-containing skill slugs so `openclaw plugins install @scope/name` no longer fails with `ENOENT` during archive download. (#56452) Thanks @soimy. - Plugins/CLI: add descriptor-backed lazy plugin CLI registration so Matrix can keep its CLI module lazy-loaded without dropping `openclaw matrix ...` from parse-time command registration. (#57165) Thanks @gumadeiras. - Plugins/CLI: collect root-help plugin descriptors through a dedicated non-activating CLI metadata path so enabled plugins keep validated config semantics without triggering runtime-only plugin registration work, while preserving runtime CLI command registration for legacy channel plugins that still wire commands from full registration. (#57294) thanks @gumadeiras. - Plugins/facades: guard bundled plugin facade loads with a cache-first sentinel so circular re-entry stops crashing `xai`, `sglang`, and `vllm` during gateway plugin startup. (#57508) Thanks @openperf. - Plugins/Matrix: mirror the Matrix crypto WASM runtime dependency into the root packaged install and enforce root/plugin dependency parity so bundled Matrix E2EE crypto resolves correctly in shipped builds. (#57163) Thanks @gumadeiras. - Plugins/startup: block workspace `.env` from overriding `OPENCLAW_BUNDLED_PLUGINS_DIR`, so bundled plugin trust roots only come from inherited runtime env or package resolution instead of repo-local dotenv files. Thanks @nexrin and @vincentkoc. - Sandbox/browser: install `fonts-noto-cjk` in the sandbox browser image so screenshots render Chinese, Japanese, and Korean text correctly instead of tofu boxes. Fixes #35597. Thanks @carrotRakko and @vincentkoc. - Security/LINE: make webhook signature validation run the timing-safe compare even when the supplied signature length is wrong, closing a small timing side-channel. (#55663) Thanks @gavyngong. - Sessions/Feishu: preserve conversation ids that legitimately embed `:topic:` in shared session helper parsing, while keeping Telegram topic session parsing intact. (#58100) Thanks @gumadeiras. - Slack/status reactions: add a reaction lifecycle for queued, thinking, tool, done, and error phases in Slack monitors, with safer cleanup so queued ack reactions stay correct across silent runs, pre-reply failures, and delayed transitions. (#56430) Thanks @hsiaoa. - Status/node-only hosts: teach `openclaw status` to handle node-only hosts on current `main` without the old mixed gateway assumptions. (#56718) Thanks @ImLukeF. - Status: fix cache hit rate exceeding 100% by deriving denominator from prompt-side token fields instead of potentially undersized totalTokens. Fixes #26643. - Telegram/audio: transcode Telegram voice-note `.ogg` attachments before the local `whisper-cli` auto fallback runs, and keep mention-preflight transcription enabled in auto mode when `tools.media.audio` is unset. - Telegram/forum topics: restore reply routing to the active topic and keep ACP `sessions_spawn(..., thread=true, mode="session")` bound to that same topic instead of falling back to root chat or losing follow-up routing. (#56060) Thanks @one27001. - Telegram/media: allow RFC 2544 benchmark-range Telegram CDN resolutions during media downloads, so voice messages, PDFs, and other attachments no longer fail with `Failed to download media`. (#57624) Thanks @MoerAI. - Telegram/native commands: prefix native command menu callback payloads and preserve `CommandSource: "native"` when Telegram replays them through callback queries, so `/fast` and other native command menus keep working even when text-command routing is disabled. Thanks @vincentkoc. - Telegram/polling: keep the watchdog from aborting long-running reply delivery by treating recent non-polling API activity as bounded liveness instead of a hard stall. (#56343) Thanks @openperf. - Tools/web_fetch: add an explicit trusted env-proxy path for proxy-only installs while keeping strict SSRF fetches on the pinned direct path, so trusted proxy routing does not weaken strict destination binding. (#50650) Thanks @kkav004. - Tools/web_search: localize the shared search cache to module scope so same-process global symbol lookups can no longer inspect or mutate cached web-search responses. Thanks @vincentkoc. - TTS/Microsoft: auto-switch the default Edge voice to Chinese for CJK-dominant text without overriding explicitly selected Microsoft voices. (#52355) Thanks @extrasmall0. - TTS: Restore 3.28 schema compatibility and fallback observability. (#57953) Thanks @joshavant. - TUI/chat: keep optimistic outbound user messages visible during active runs by deferring local-run binding until the first gateway chat event reveals the real run id, preventing premature history reloads from wiping pending local sends. (#54722) Thanks @seanturner001. - TUI/model picker: keep searchable `/model` and `/models` input mode from hijacking `j`/`k` as navigation keys, and harden width bounds under `m`-filtered model lists so search no longer crashes on long rows. (#30156) Thanks @briannicholls. - Voice Call/media stream: cap inbound WebSocket frame size before `start` validation so oversized pre-start frames are dropped before JSON parsing. Thanks @Kazamayc and @vincentkoc. - Voice call/Plivo: pin stored callback bases to the configured public webhook URL so later call-control redirects stay on the intended origin even if webhook transport metadata differs. Thanks @zsxsoft and @vincentkoc. - Web UI/markdown: stop bare auto-links from swallowing adjacent CJK text while preserving valid mixed-script path and query characters in rendered links. (#48410) Thanks @jnuyao. - Approvals/UI: keep the newest pending approval at the front of the Control UI queue so approving one request does not accidentally target an older expired id. Thanks @vincentkoc. - Auth profiles/OAuth: refresh runtime auth snapshots when saving rotated credentials so OAuth providers do not reuse consumed refresh tokens after the first token rotation. Fixes #55389. Thanks @sam26880 and @vincentkoc. - Browser/screenshot: use `fromSurface: false` in raw CDP screenshots to avoid a Chromium compositor bug that drops cross-origin image textures (QR codes, CDN assets), and preserve pre-existing device emulation state across full-page viewport expansion. (#54358) Thanks @FMLS. - ClawDock/docs: move the helper scripts to `scripts/clawdock`, publish ClawDock as a first-class docs page on the docs site, and document reinstalling local helper copies from the new raw GitHub path. (#23912) thanks @Olshansk. - Control UI/gateway: clear queued browser connect timeouts on client stop so aborted or replaced gateway clients do not send delayed connect requests after shutdown. (#57338) thanks @gumadeiras. - Control UI/gateway: reconnect the browser client when gateway event sequence gaps are detected, so stale non-chat state recovers automatically instead of only telling the user to refresh. (#23912) thanks @Olshansk. - Exec approvals/channels: unify Discord and Telegram exec approval runtime handling, move approval buttons onto the shared interactive reply model, and fix Telegram approval buttons and typed `/approve` commands so configured approvers can resolve requests reliably again. (#57516) Thanks @scoootscooob. - Gateway/SQLite transient handling: keep unhandled `SQLITE_CANTOPEN`, `SQLITE_BUSY`, `SQLITE_LOCKED`, and `SQLITE_IOERR` failures non-fatal in the global rejection handler so macOS LaunchAgent restarts do not enter a crash-throttle loop. (#57018) - Hooks/plugins/skills: block workspace `.env` overrides for bundled root directories so workspace startup cannot redirect bundled trust roots away from the packaged defaults. Thanks @nexrin and @vincentkoc. - LINE/webhooks: cap shared concurrent pre-verify webhook body reads so excess requests are rejected before entering the LINE body handler. Thanks @nexrin and @vincentkoc. - Memory/QMD: preserve explicit custom collection names for shared paths outside the agent workspace so `memory_search` stops appending `-<agentId>` to externally managed QMD collections. (#52539) Thanks @lobsrice and @vincentkoc. - Memory/builtin: keep memory-file indexing active in FTS-only mode (no embedding provider) so forced reindexes no longer swap in an empty index and wipe existing memory chunks. (#42714) Thanks @asamimei. - Nostr/config: redact `channels.nostr.privateKey` in config snapshots and Control UI config views, so Nostr signing keys no longer appear in plain text. Thanks @ccreater222. - Plugin approvals: accept unique short approval-id prefixes on `plugin.approval.resolve`, matching exec approvals and restoring `/approve` fallback flows on chat approval surfaces. Thanks @vincentkoc. - SSH sandbox/upload: reject workspace symlinks that resolve outside the uploaded tree before syncing to the remote sandbox, so later agent writes cannot be redirected through escaped links. Thanks @AntAISecurityLab and @vincentkoc. - Slack/interactive replies: resolve Slack Block Kit reply delivery from both authored `channelData.slack.blocks` payloads and directive-generated interactive replies, and keep Slack button styles mapped onto valid Block Kit button rendering so interactive replies stop dropping on Slack-specific delivery paths. Thanks @vincentkoc. - Subagents/announcements: preserve the requester agent id for inline deterministic tool spawns so named agents without channel bindings can still announce completions through the correct owner session. (#55437) Thanks @kAIborg24. - Telegram/Anthropic streaming: replace raw invalid stream-order provider errors with a safe retry message so internal `message_start/message_stop` failures do not leak into chats. (#55408) Thanks @imydal. - Tlon/media: route inbound image downloads through the shared media store, cap each download at 6 MB, and stop after 8 images per message so large Tlon posts no longer balloon local media storage. Thanks @AntAISecurityLab and @vincentkoc. - Agents/live switch: stop transient cron and subagent model overrides from being misread as persisted live-session switches, so isolated runs no longer fail with `LiveSessionModelSwitchError`. Thanks @vincentkoc. - Agents/tool-call repair: recover malformed Kimi/OpenRouter tool-call argument streams when provider preambles appear before JSON payloads, and fail closed on non-tool leading text so fragment strings do not leak into filesystem path arguments during sub-agent runs. (#56560) Thanks @Originalwhite. - Gateway/startup: keep configured primary-model warmup on the static model path so container boots do not snapshot-load provider runtime graphs just to validate a configured model. Thanks @vincentkoc. - OpenAI/Responses: omit disabled reasoning payloads across OpenAI, Codex, and Azure OpenAI request builders so GPT-5 endpoints no longer reject `reasoning.effort: "none"`. (#58208) Thanks @jalehman. - WhatsApp/outbound: restore runtime send/action routing and outbound compatibility after the recent channel seam refactor so outbound sends, reactions, and related media actions keep reaching the active session. - xAI/Responses: normalize image-bearing tool results for xAI responses payloads, including OpenResponses-style `input_image.source` parts, so image tool replays no longer 422 on the follow-up turn. (#58017) Thanks @neeravmakwana. - Zalo/webhooks: scope replay dedupe to the authenticated target so one configured account can no longer cause same-id inbound events for another target to be dropped. Thanks @smaeljaish771 and @vincentkoc. - Plugins/prompt build: preserve the highest-priority `systemPrompt` when merging `before_prompt_build` hook results instead of letting lower-priority hooks overwrite it. (#58375) - Tlon/settings migration: preserve explicit empty-array settings during migration so restart-time reseeding no longer restores older file-config values. (#58370) - Plugins/marketplace: harden marketplace archive installs by surfacing guarded download failures as structured install errors and deriving temp filenames from the final resolved URL. (#58267) - UI/DOM safety: build the chat delete-confirm popover and Canvas Host fallback status line with DOM nodes instead of injected HTML strings. (#58269, #58266) - Media/file handling: create image temp work directories under the shared OpenClaw temp root and stop widening allowed local media roots from reply or tool source paths, keeping local media access limited to configured and agent-scoped roots. (#58270, #57770) - Telegram/security: migrate legacy pairing `allowFrom` state to the `default` account only and gate group voice-message preflight transcription on sender authorization so unauthorized senders cannot trigger paid transcription before being dropped. (#58165, #57566) - Exec approvals: stop shell init-file flags from matching persisted script-path approvals, detect command-carrier inline eval in tools like `awk`, `find`, `xargs`, `make`, and `sed`, and treat the awk family as interpreter-like so allow-always decisions no longer persist interpreter paths. (#58369, #57842, #57772) - Voice call/Telnyx: canonicalize verified webhook signatures before deriving replay keys so equivalent Base64 and Base64URL encodings dedupe correctly. (#57829) - Gateway/HTTP trust boundaries: ignore self-declared bearer scopes, deny dangerous HTTP tool-invoke paths by default, require write scope on `/v1/embeddings`, and bind OpenAI-compatible `/v1/chat/completions` plus `/v1/responses` ingress as non-owner so external HTTP callers cannot self-upgrade access. (#57783, #57771, #57721, #57769, #57778) - Gateway/trusted config and bootstrap: clear self-declared scopes for device-less `trusted-proxy` WebSocket connects and trim the Control UI bootstrap payload to only the fields needed before the normal handshake. (#57692, #57727) - Skills and workspace safety: replace raw skill-file reads with a symlink-safe, root-confined loader and pin workspace-only `apply_patch` delete and directory-creation mutations to verified workspace roots so path rebind races fail closed. (#57519, #56016) - Env and filesystem hardening: block credential and gateway auth env vars from workspace `.env` files, always strip dangerous inherited host env vars such as `BROWSER` and `GIT_EDITOR`, and keep sensitive host paths and OpenClaw state roots blocked even when external sandbox bind sources are allowed. (#57767, #57559, #56024) - OpenShell and ACP file boundaries: skip symlinks and preserve trusted host-only directories during OpenShell mirror sync, and route ACP attachment reads through the shared attachment cache so local files outside allowed roots are no longer forwarded. (#57693, #57690) - Channel/webhook authorization: skip Discord audio preflight transcription for unauthorized guild senders, add a shared pre-auth in-flight guard to Synology Chat webhooks, and validate Microsoft Teams bearer auth before JSON body parsing. (#57695, #57722, #57686) - Infra/randomness: replace `Math.random()` in affected identifier and delay-jitter paths with shared secure-random helpers, including UI UUID generation. (#57744)

OpenClaw v2026.3.31-beta.1 预发布