OpenClaw v2026.4.2 - 更新日志

### 重大变更 - **Plugins/xAI**：将 `x_search` 设置从旧版核心路径 `tools.web.x_search.*` 迁移至插件自有路径 `plugins.entries.xai.config.xSearch.*`，在 `plugins.entries.xai.config.webSearch.apiKey` / `XAI_API_KEY` 上标准化 `x_search` 认证，并通过 `openclaw doctor --fix` 迁移旧版配置。（#59674）感谢 @vincentkoc。 - **Plugins/web fetch**：将 Firecrawl `web_fetch` 配置从旧版核心路径 `tools.web.fetch.firecrawl.*` 迁移至插件自有路径 `plugins.entries.firecrawl.config.webFetch.*`，通过新的获取提供者边界而非仅限 Firecrawl 的核心分支路由 `web_fetch` 回退，并通过 `openclaw doctor --fix` 迁移旧版配置。（#59465）感谢 @vincentkoc。 ### 功能变更 - **Tasks/Task Flow**：恢复核心 Task Flow 底层，支持托管与镜像同步模式、持久化流状态/修订跟踪，以及 `openclaw flows` 检查/恢复原语，使后台编排可持久化并独立于插件创作层操作。（#58930）感谢 @mbelinky。 - **Tasks/Task Flow**：新增托管子任务生成及粘性取消意图，使外部编排器可立即停止调度，并在活动子任务完成后让父 Task Flow 稳定至 `cancelled` 状态。（#59610）感谢 @mbelinky。 - **Plugins/Task Flow**：新增绑定的 `api.runtime.taskFlow` 接缝，使插件及可信创作层能通过主机解析的 OpenClaw 上下文创建并驱动托管 Task Flow，而无需每次调用传递所有者标识符。（#59622）感谢 @mbelinky。 - **Android/assistant**：新增助手角色入口点及 Google Assistant App Actions 元数据，使 Android 能通过助手触发器启动 OpenClaw 并将提示词传入聊天组合器。（#59596）感谢 @obviyus。 - **Exec 默认值**：使网关/节点主机执行默认以 YOLO 模式运行，通过请求 `security=full` 并设置 `ask=off`，并对主机批准文件回退及文档/doctor 报告与该无提示默认值对齐。 - **Providers/runtime**：新增提供者拥有的回放钩子表面，用于转录策略、回放清理及推理模式分发。（#59143）感谢 @jalehman。 - **Plugins/hooks**：新增 `before_agent_reply`，使插件能在内联操作后通过合成回复截断 LLM。（#20067）感谢 @JoshuaLelon。 - **Channels/session routing**：将提供者特定会话会话语法移至插件拥有的会话键表面，在引导、模型覆盖、重启及工具策略路径中保留 Telegram 话题路由与飞书作用域继承。 - **Feishu/comments**：新增专用 Drive 评论事件流，支持评论线程上下文解析、线程内回复及 `feishu_drive` 评论操作，用于文档协作工作流。（#58497）感谢 @wittam-01。 - **Matrix/plugin**：在文本发送、媒体字幕、编辑、轮询回退文本及操作驱动编辑中发出符合规范的 `m.mentions` 元数据，使 Matrix 提及在 Element 等客户端中可靠通知。（#59323）感谢 @gumadeiras。 - **Diffs**：新增插件拥有的 `viewerBaseUrl`，使查看器链接可使用稳定代理/公共源，而无需每次工具调用传递 `baseUrl`。（#59341）关联 #59227。感谢 @gumadeiras。 - **Agents/compaction**：在手动 `/compact` 及其他上下文引擎压缩路径中一致解析 `agents.defaults.compaction.model`，使引擎拥有的压缩在所有运行时入口点使用配置的覆盖模型。（#56710）感谢 @oliviareid-svg。 - **Agents/compaction**：新增 `agents.defaults.compaction.notifyUser`，使 `🧹 Compacting context...` 开始通知变为可选而非始终显示。（#54251）感谢 @oguricap0327。 - **WhatsApp/reactions**：为代理反应新增 `reactionLevel` 指导。感谢 @mcaxtr。 - **Exec approvals/channels**：当支持通道能从现有所有者配置推断批准者时，自动启用 DM 优先原生聊天批准，同时保持通道扇出显式并澄清转发与原生批准客户端配置。 ### 问题修复 - **Providers/transport policy**：在共享 HTTP、流及 WebSocket 路径中集中请求认证、代理、TLS 及头部塑形，阻止不安全的 TLS/运行时传输覆盖，并将代理跳 TLS 与目标 mTLS 设置分离。（#59682）感谢 @vincentkoc。 - **Providers/Copilot**：在共享提供者端点解析器中对原生 GitHub Copilot API 主机进行分类，并强化令牌派生代理端点解析，使 Copilot 基础 URL 路由保持集中，并在格式错误提示时安全失败。（#59644）感谢 @vincentkoc。 - **Providers/streaming headers**：在 OpenAI WebSocket、嵌入式运行器及代理流路径中集中默认及归属头部合并，使提供者特定头部保持一致，且调用者覆盖仅在预期位置生效。（#59542）感谢 @vincentkoc。 - **Providers/media HTTP**：在共享 OpenAI 兼容音频、Deepgram 音频、Gemini 媒体/图像及 Moonshot 视频请求路径中集中基础 URL 标准化、默认认证/头部注入及显式头部覆盖处理。（#59469）感谢 @vincentkoc。 - **Providers/OpenAI-compatible routing**：集中原生与代理请求策略，使隐藏归属及相关 OpenAI 系列默认值仅在流、WebSocket 及共享音频 HTTP 路径的验证原生端点上应用。（#59433）感谢 @vincentkoc。 - **Providers/Anthropic routing**：集中原生与代理端点分类，用于直接 Anthropic `service_tier` 处理，使仿冒或代理主机不继承原生 Anthropic 默认值。（#59608）感谢 @vincentkoc。 - **Gateway/exec loopback**：为空配对设备令牌映射恢复旧版角色回退，并允许静默本地角色升级，使本地执行和节点客户端在 `2026.3.31` 后不再因配对要求错误失败。（#59092）感谢 @openperf。 - **Agents/subagents**：将仅管理员子代理网关调用固定至 `operator.admin`，同时保持 `agent` 至少特权，使 `sessions_spawn` 不再在循环作用域升级配对中因 `close(1008) "pairing required"` 失败。（#59555）感谢 @openperf。 - **Exec approvals/config**：在规范化期间从 `~/.openclaw/exec-approvals.json` 剥离无效 `security`、`ask` 及 `askFallback` 值，使格式错误的策略枚举干净回退至文档默认值，而非损坏运行时策略解析。（#59112）感谢 @openperf。 - **Exec approvals/doctor**：从真实批准文件路径报告主机策略来源，并在归属有效策略冲突时忽略格式错误的主机覆盖值。（#59367）感谢 @gumadeiras。 - **Exec/runtime**：将 `tools.exec.host=auto` 视为仅路由，在沙箱可用时保留隐式无配置执行，否则使用网关，并拒绝会绕过配置沙箱或主机目标的每次调用主机覆盖。（#58897）感谢 @vincentkoc。 - **Slack/mrkdwn formatting**：在入站上下文中添加内置 Slack mrkdwn 指导，使 Slack 回复不再回退到在 Slack 中渲染不佳的通用 Markdown 模式。（#59100）感谢 @jadewon。 - **WhatsApp/presence**：在自聊天模式连接时发送 `unavailable` 状态，使个人手机用户不再在网关运行时丢失所有推送通知。（#59410）感谢 @mcaxtr。 - **WhatsApp/media**：将 HTML、XML 及 CSS 加入 MIME 映射，并对未知媒体类型优雅回退，而非丢弃附件。（#51562）感谢 @bobbyt74。 - **Matrix/onboarding**：在 `openclaw channels add` 及 `openclaw configure --section channels` 中恢复引导设置，同时保持共享 `setupWizard` 接缝上的自定义插件向导。（#59462）感谢 @gumadeiras。 - **Matrix/streaming**：当启用 `channels.matrix.blockStreaming` 时，为当前助手块保留实时部分预览，同时将完成的块更新作为单独消息保留。（#59384）感谢 @gumadeiras。 - **Feishu/comment threads**：强化文档评论线程传递，使整文档评论回退至 `add_comment`，延迟回复查找更可靠重试，且用户可见回复避免推理/规划溢出。（#59129）感谢 @wittam-01。 - **MS Teams/streaming**：当回复超过 4000 字符流限制时，从回退块传递中剥离已流式文本，使长响应不再重复内容。（#59297）感谢 @bradgroux。 - **Slack/thread context**：按有效对话允许列表过滤线程发起者及历史，而不丢弃有效的开放房间、DM 或群组 DM 上下文。（#58380）感谢 @jacobtomlinson。 - **Mattermost/probes**：通过 SSRF 保护路由状态探测，并遵守 `allowPrivateNetwork`，使自托管 Mattermost 部署的连接检查保持安全。（#58529）感谢 @mappel-nv。 - **Zalo/webhook replay**：按聊天及发送者限定回退去重键，使不同聊天或发送者间重复消息 ID 不再冲突，并强化部分缺失负载的元数据读取。（#58444） - **QQBot/structured payloads**：将本地文件路径限制为 QQ Bot 拥有的媒体存储，阻止遍历该根目录外，减少日志中的路径泄露，并保持内联图像数据 URL 工作。（#58453）感谢 @jacobtomlinson。 - **Image generation/providers**：将 OpenAI、MiniMax 及 fal 图像请求路由至共享提供者 HTTP 传输路径，使自定义基础 URL、受保护的私有网络路由及提供者请求默认值与其余提供者 HTTP 对齐。感谢 @vincentkoc。 - **Image generation/providers**：停止从配置的 OpenAI、MiniMax 及 fal 图像基础 URL 推断私有网络访问，并限制共享 HTTP 错误体读取，使敌对或配置错误端点安全失败，而不放宽 SSRF 策略或缓冲无界错误负载。感谢 @vincentkoc。 - **Browser/host inspection**：使静态 Chrome 检查辅助程序不在激活的浏览器运行时中加载，使 `openclaw doctor browser` 及相关检查不急切加载捆绑浏览器插件。（#59471）感谢 @vincentkoc。 - **Browser/CDP**：在循环检查前规范化尾随点 localhost 绝对形式主机，使远程 CDP WebSocket URL（如 `ws://localhost.:...`）重写回配置的远程主机。（#59236）感谢 @mappel-nv。 - **Agents/output sanitization**：从用户可见文本中剥离命名空间 `antml:thinking` 块，使 Anthropic 风格内部独白标签不泄露到回复中。（#59550）感谢 @obviyus。 - **Kimi Coding/tools**：将 Anthropic 工具负载规范化为 OpenAI 兼容函数形状（Kimi Coding 预期），使工具调用不再丢失必需参数。（#59440）感谢 @obviyus。 - **Image tool/paths**：相对于代理 `workspaceDir` 而非 `process.cwd()` 解析相对本地媒体路径，使 `inbox/receipt.png` 等输入可靠通过本地路径允许列表。（#57222）感谢 Priyansh Gupta。 - **Podman/launch**：从 `scripts/run-openclaw-podman.sh` 移除嘈杂容器输出，并使 Podman 安装指南与更安静启动流对齐。（#59368）感谢 @sallyom。 - **Plugins/runtime**：即使禁用插件，也保持 LINE 回复指令及浏览器支持的清理/重置流工作，同时收紧捆绑插件激活守卫。（#59412）感谢 @vincentkoc。 - **ACP/gateway reconnects**：在瞬态 WebSocket 丢失期间保持 ACP 提示活跃，同时在重新连接恢复未完成时仍有界失败。（#59473）感谢 @obviyus。 - **ACP/gateway reconnects**：在重新连接宽限期后拒绝过时预确认 ACP 提示，使调用者干净失败而非网关永不确认运行时无限挂起。 - **Gateway/session kill**：对会话终止请求强制 HTTP 操作者作用域，并在会话查找前授权，使未认证调用者无法探测会话存在。（#59128）感谢 @jacobtomlinson。 - **MS Teams/logging**：使用共享未知错误辅助程序格式化非 `Error` 失败，使日志不再将捕获的 SDK 或 Axios 对象折叠为 `[object Object]`。（#59321）感谢 @bradgroux。 - **Channels/setup**：在设置解析期间忽略不受信任的工作区通道插件，使阴影工作区插件无法覆盖内置通道设置/登录流，除非在配置中明确信任。（#59158）感谢 @mappel-nv。 - **Exec/Windows**：在网关和节点执行中恢复带引号感知 `argPattern` 匹配的允许列表执行，并在执行工具描述中显示准确动态预批准可执行提示。（#56285）感谢 @kpngr。 - **Gateway**：在显式确认及自然过期后清理空的 `node-pending-work` 状态条目，使每节点状态映射不再无限增长。（#58179）感谢 @gavyngong。 - **Webhooks/secret comparison**：在 BlueBubbles、飞书、Mattermost、Telegram、Twilio 及 Zalo Webhook 处理程序中用共享 `safeEqualSecret` 辅助程序替换临时安全秘密比较，并拒绝 BlueBubbles 中的空认证令牌。（#58432）感谢 @eleqtrizit。 - **OpenShell/mirror**：将 `remoteWorkspaceDir` 及 `remoteAgentWorkspaceDir` 限制为管理的 `/sandbox` 及 `/agent` 根，并在配置同步期间防止镜像同步覆盖或移除用户添加的 shell 根。（#58515）感谢 @eleqtrizit。 - **Plugins/activation**：在 CLI、网关引导及状态表面中保留显式、自动启用及默认激活来源及原因元数据，使插件启用状态在自动启用解析后保持准确。（#59641）感谢 @vincentkoc。 - **Exec/env**：阻止包根、语言运行时、编译器包含路径及凭证/配置位置的额外主机环境覆盖转移，使请求范围执行无法重定向受信任工具链或配置查找。（#59233）感谢 @drobison00。 - **Dotenv/workspace overrides**：阻止工作区 `.env` 文件覆盖 `OPENCLAW_PINNED_PYTHON` 及 `OPENCLAW_PINNED_WRITE_PYTHON`，使受信任辅助解释器不被仓库本地环境注入重定向。（#58473）感谢 @eleqtrizit。 - **Plugins/install**：在 `openclaw.plugin.json` 中接受 JSON5 语法，并在安装/验证期间捆绑 `plugin.json` 清单，使带尾随逗号、注释或未加引号键的第三方插件不再安装失败。（#59084）感谢 @singleGanghood。 - **Telegram/exec approvals**：在 Telegram 按钮渲染前将共享 `/approve … allow-always` 回调负载重写为 `/approve … always`，使插件批准 ID 仍符合 Telegram `callback_data` 限制并保持 "Allow Always" 操作可见。（#59217）感谢 @jameslcowan。 - **Cron/exec timeouts**：在隔离 cron 运行中（包括自定义会话目标 cron 作业）即使 `verbose: off` 也显示超时 `exec` 及 `bash` 失败，使计划作业不再静默失败。（#58247）感谢 @skainguyen1412。 - **Telegram/exec approvals**：对异步批准后续操作回退到原始会话键，并保持恢复失败状态传递消毒，使 Telegram 后续操作仍能送达而不泄露原始执行元数据。（#59351）感谢 @seonang。 - **Node-host/exec approvals**：通过批准计划器的可变脚本路径绑定 `pnpm dlx` 调用，使有效运行时命令被解析用于批准而非未绑定。（#58374） - **Exec/node hosts**：当未明确请求工作目录时，停止将网关工作目录 cwd 转发到远程节点执行，使跨平台节点批准回退到节点默认 cwd 而非以 `SYSTEM_RUN_DENIED` 失败。（#58977）感谢 @Starhappysh。 - **Exec approvals/channels**：将发起表面批准可用性与原生传递启用解耦，使 Telegram、Slack 及 Discord 在存在批准者且原生目标路由单独配置时仍暴露批准。（#59776）感谢 @joelnishanth。

### Breaking - Plugins/xAI: move `x_search` settings from the legacy core `tools.web.x_search.*` path to the plugin-owned `plugins.entries.xai.config.xSearch.*` path, standardize `x_search` auth on `plugins.entries.xai.config.webSearch.apiKey` / `XAI_API_KEY`, and migrate legacy config with `openclaw doctor --fix`. (#59674) Thanks @vincentkoc. - Plugins/web fetch: move Firecrawl `web_fetch` config from the legacy core `tools.web.fetch.firecrawl.*` path to the plugin-owned `plugins.entries.firecrawl.config.webFetch.*` path, route `web_fetch` fallback through the new fetch-provider boundary instead of a Firecrawl-only core branch, and migrate legacy config with `openclaw doctor --fix`. (#59465) Thanks @vincentkoc. ### Changes - Tasks/Task Flow: restore the core Task Flow substrate with managed-vs-mirrored sync modes, durable flow state/revision tracking, and `openclaw flows` inspection/recovery primitives so background orchestration can persist and be operated separately from plugin authoring layers. (#58930) Thanks @mbelinky. - Tasks/Task Flow: add managed child task spawning plus sticky cancel intent, so external orchestrators can stop scheduling immediately and let parent Task Flows settle to `cancelled` once active child tasks finish. (#59610) Thanks @mbelinky. - Plugins/Task Flow: add a bound `api.runtime.taskFlow` seam so plugins and trusted authoring layers can create and drive managed Task Flows from host-resolved OpenClaw context without passing owner identifiers on each call. (#59622) Thanks @mbelinky. - Android/assistant: add assistant-role entrypoints plus Google Assistant App Actions metadata so Android can launch OpenClaw from the assistant trigger and hand prompts into the chat composer. (#59596) Thanks @obviyus. - Exec defaults: make gateway/node host exec default to YOLO mode by requesting `security=full` with `ask=off`, and align host approval-file fallbacks plus docs/doctor reporting with that no-prompt default. - Providers/runtime: add provider-owned replay hook surfaces for transcript policy, replay cleanup, and reasoning-mode dispatch. (#59143) Thanks @jalehman. - Plugins/hooks: add `before_agent_reply` so plugins can short-circuit the LLM with synthetic replies after inline actions. (#20067) Thanks @JoshuaLelon. - Channels/session routing: move provider-specific session conversation grammar into plugin-owned session-key surfaces, preserving Telegram topic routing and Feishu scoped inheritance across bootstrap, model override, restart, and tool-policy paths. - Feishu/comments: add a dedicated Drive comment-event flow with comment-thread context resolution, in-thread replies, and `feishu_drive` comment actions for document collaboration workflows. (#58497) Thanks @wittam-01. - Matrix/plugin: emit spec-compliant `m.mentions` metadata across text sends, media captions, edits, poll fallback text, and action-driven edits so Matrix mentions notify reliably in clients like Element. (#59323) Thanks @gumadeiras. - Diffs: add plugin-owned `viewerBaseUrl` so viewer links can use a stable proxy/public origin without passing `baseUrl` on every tool call. (#59341) Related #59227. Thanks @gumadeiras. - Agents/compaction: resolve `agents.defaults.compaction.model` consistently for manual `/compact` and other context-engine compaction paths, so engine-owned compaction uses the configured override model across runtime entrypoints. (#56710) Thanks @oliviareid-svg. - Agents/compaction: add `agents.defaults.compaction.notifyUser` so the `🧹 Compacting context...` start notice is opt-in instead of always being shown. (#54251) Thanks @oguricap0327. - WhatsApp/reactions: add `reactionLevel` guidance for agent reactions. Thanks @mcaxtr. - Exec approvals/channels: auto-enable DM-first native chat approvals when supported channels can infer approvers from existing owner config, while keeping channel fanout explicit and clarifying forwarding versus native approval client config. ### Fixes - Providers/transport policy: centralize request auth, proxy, TLS, and header shaping across shared HTTP, stream, and websocket paths, block insecure TLS/runtime transport overrides, and keep proxy-hop TLS separate from target mTLS settings. (#59682) Thanks @vincentkoc. - Providers/Copilot: classify native GitHub Copilot API hosts in the shared provider endpoint resolver and harden token-derived proxy endpoint parsing so Copilot base URL routing stays centralized and fails closed on malformed hints. (#59644) Thanks @vincentkoc. - Providers/streaming headers: centralize default and attribution header merging across OpenAI websocket, embedded-runner, and proxy stream paths so provider-specific headers stay consistent and caller overrides only win where intended. (#59542) Thanks @vincentkoc. - Providers/media HTTP: centralize base URL normalization, default auth/header injection, and explicit header override handling across shared OpenAI-compatible audio, Deepgram audio, Gemini media/image, and Moonshot video request paths. (#59469) Thanks @vincentkoc. - Providers/OpenAI-compatible routing: centralize native-vs-proxy request policy so hidden attribution and related OpenAI-family defaults only apply on verified native endpoints across stream, websocket, and shared audio HTTP paths. (#59433) Thanks @vincentkoc. - Providers/Anthropic routing: centralize native-vs-proxy endpoint classification for direct Anthropic `service_tier` handling so spoofed or proxied hosts do not inherit native Anthropic defaults. (#59608) Thanks @vincentkoc. - Gateway/exec loopback: restore legacy-role fallback for empty paired-device token maps and allow silent local role upgrades so local exec and node clients stop failing with pairing-required errors after `2026.3.31`. (#59092) Thanks @openperf. - Agents/subagents: pin admin-only subagent gateway calls to `operator.admin` while keeping `agent` at least privilege, so `sessions_spawn` no longer dies on loopback scope-upgrade pairing with `close(1008) "pairing required"`. (#59555) Thanks @openperf. - Exec approvals/config: strip invalid `security`, `ask`, and `askFallback` values from `~/.openclaw/exec-approvals.json` during normalization so malformed policy enums fall back cleanly to the documented defaults instead of corrupting runtime policy resolution. (#59112) Thanks @openperf. - Exec approvals/doctor: report host policy sources from the real approvals file path and ignore malformed host override values when attributing effective policy conflicts. (#59367) Thanks @gumadeiras. - Exec/runtime: treat `tools.exec.host=auto` as routing-only, keep implicit no-config exec on sandbox when available or gateway otherwise, and reject per-call host overrides that would bypass the configured sandbox or host target. (#58897) Thanks @vincentkoc. - Slack/mrkdwn formatting: add built-in Slack mrkdwn guidance in inbound context so Slack replies stop falling back to generic Markdown patterns that render poorly in Slack. (#59100) Thanks @jadewon. - WhatsApp/presence: send `unavailable` presence on connect in self-chat mode so personal-phone users stop losing all push notifications while the gateway is running. (#59410) Thanks @mcaxtr. - WhatsApp/media: add HTML, XML, and CSS to the MIME map and fall back gracefully for unknown media types instead of dropping the attachment. (#51562) Thanks @bobbyt74. - Matrix/onboarding: restore guided setup in `openclaw channels add` and `openclaw configure --section channels`, while keeping custom plugin wizards on the shared `setupWizard` seam. (#59462) Thanks @gumadeiras. - Matrix/streaming: keep live partial previews for the current assistant block while preserving completed block updates as separate messages when `channels.matrix.blockStreaming` is enabled. (#59384) Thanks @gumadeiras. - Feishu/comment threads: harden document comment-thread delivery so whole-document comments fall back to `add_comment`, delayed reply lookups retry more reliably, and user-visible replies avoid reasoning/planning spillover. (#59129) Thanks @wittam-01. - MS Teams/streaming: strip already-streamed text from fallback block delivery when replies exceed the 4000-character streaming limit so long responses stop duplicating content. (#59297) Thanks @bradgroux. - Slack/thread context: filter thread starter and history by the effective conversation allowlist without dropping valid open-room, DM, or group DM context. (#58380) Thanks @jacobtomlinson. - Mattermost/probes: route status probes through the SSRF guard and honor `allowPrivateNetwork` so connectivity checks stay safe for self-hosted Mattermost deployments. (#58529) Thanks @mappel-nv. - Zalo/webhook replay: scope replay dedupe key by chat and sender so reused message IDs across different chats or senders no longer collide, and harden metadata reads for partially missing payloads. (#58444) - QQBot/structured payloads: restrict local file paths to QQ Bot-owned media storage, block traversal outside that root, reduce path leakage in logs, and keep inline image data URLs working. (#58453) Thanks @jacobtomlinson. - Image generation/providers: route OpenAI, MiniMax, and fal image requests through the shared provider HTTP transport path so custom base URLs, guarded private-network routing, and provider request defaults stay aligned with the rest of provider HTTP. Thanks @vincentkoc. - Image generation/providers: stop inferring private-network access from configured OpenAI, MiniMax, and fal image base URLs, and cap shared HTTP error-body reads so hostile or misconfigured endpoints fail closed without relaxing SSRF policy or buffering unbounded error payloads. Thanks @vincentkoc. - Browser/host inspection: keep static Chrome inspection helpers out of the activated browser runtime so `openclaw doctor browser` and related checks do not eagerly load the bundled browser plugin. (#59471) Thanks @vincentkoc. - Browser/CDP: normalize trailing-dot localhost absolute-form hosts before loopback checks so remote CDP websocket URLs like `ws://localhost.:...` rewrite back to the configured remote host. (#59236) Thanks @mappel-nv. - Agents/output sanitization: strip namespaced `antml:thinking` blocks from user-visible text so Anthropic-style internal monologue tags do not leak into replies. (#59550) Thanks @obviyus. - Kimi Coding/tools: normalize Anthropic tool payloads into the OpenAI-compatible function shape Kimi Coding expects so tool calls stop losing required arguments. (#59440) Thanks @obviyus. - Image tool/paths: resolve relative local media paths against the agent `workspaceDir` instead of `process.cwd()` so inputs like `inbox/receipt.png` pass the local-path allowlist reliably. (#57222) Thanks Priyansh Gupta. - Podman/launch: remove noisy container output from `scripts/run-openclaw-podman.sh` and align the Podman install guidance with the quieter startup flow. (#59368) Thanks @sallyom. - Plugins/runtime: keep LINE reply directives and browser-backed cleanup/reset flows working even when those plugins are disabled while tightening bundled plugin activation guards. (#59412) Thanks @vincentkoc. - ACP/gateway reconnects: keep ACP prompts alive across transient websocket drops while still failing boundedly when reconnect recovery does not complete. (#59473) Thanks @obviyus. - ACP/gateway reconnects: reject stale pre-ack ACP prompts after reconnect grace expiry so callers fail cleanly instead of hanging indefinitely when the gateway never confirms the run. - Gateway/session kill: enforce HTTP operator scopes on session kill requests and gate authorization before session lookup so unauthenticated callers cannot probe session existence. (#59128) Thanks @jacobtomlinson. - MS Teams/logging: format non-`Error` failures with the shared unknown-error helper so logs stop collapsing caught SDK or Axios objects into `[object Object]`. (#59321) Thanks @bradgroux. - Channels/setup: ignore untrusted workspace channel plugins during setup resolution so a shadowing workspace plugin cannot override built-in channel setup/login flows unless explicitly trusted in config. (#59158) Thanks @mappel-nv. - Exec/Windows: restore allowlist enforcement with quote-aware `argPattern` matching across gateway and node exec, and surface accurate dynamic pre-approved executable hints in the exec tool description. (#56285) Thanks @kpngr. - Gateway: prune empty `node-pending-work` state entries after explicit acknowledgments and natural expiry so the per-node state map no longer grows indefinitely. (#58179) Thanks @gavyngong. - Webhooks/secret comparison: replace ad-hoc timing-safe secret comparisons across BlueBubbles, Feishu, Mattermost, Telegram, Twilio, and Zalo webhook handlers with the shared `safeEqualSecret` helper and reject empty auth tokens in BlueBubbles. (#58432) Thanks @eleqtrizit. - OpenShell/mirror: constrain `remoteWorkspaceDir` and `remoteAgentWorkspaceDir` to the managed `/sandbox` and `/agent` roots, and keep mirror sync from overwriting or removing user-added shell roots during config synchronization. (#58515) Thanks @eleqtrizit. - Plugins/activation: preserve explicit, auto-enabled, and default activation provenance plus reason metadata across CLI, gateway bootstrap, and status surfaces so plugin enablement state stays accurate after auto-enable resolution. (#59641) Thanks @vincentkoc. - Exec/env: block additional host environment override pivots for package roots, language runtimes, compiler include paths, and credential/config locations so request-scoped exec cannot redirect trusted toolchains or config lookups. (#59233) Thanks @drobison00. - Dotenv/workspace overrides: block workspace `.env` files from overriding `OPENCLAW_PINNED_PYTHON` and `OPENCLAW_PINNED_WRITE_PYTHON` so trusted helper interpreters cannot be redirected by repo-local env injection. (#58473) Thanks @eleqtrizit. - Plugins/install: accept JSON5 syntax in `openclaw.plugin.json` and bundle `plugin.json` manifests during install/validation, so third-party plugins with trailing commas, comments, or unquoted keys no longer fail to install. (#59084) Thanks @singleGanghood. - Telegram/exec approvals: rewrite shared `/approve … allow-always` callback payloads to `/approve … always` before Telegram button rendering so plugin approval IDs still fit Telegram's `callback_data` limit and keep the Allow Always action visible. (#59217) Thanks @jameslcowan. - Cron/exec timeouts: surface timed-out `exec` and `bash` failures in isolated cron runs even when `verbose: off`, including custom session-target cron jobs, so scheduled runs stop failing silently. (#58247) Thanks @skainguyen1412. - Telegram/exec approvals: fall back to the origin session key for async approval followups and keep resume-failure status delivery sanitized so Telegram followups still land without leaking raw exec metadata. (#59351) Thanks @seonang. - Node-host/exec approvals: bind `pnpm dlx` invocations through the approval planner's mutable-script path so the effective runtime command is resolved for approval instead of being left unbound. (#58374) - Exec/node hosts: stop forwarding the gateway workspace cwd to remote node exec when no workdir was explicitly requested, so cross-platform node approvals fall back to the node default cwd instead of failing with `SYSTEM_RUN_DENIED`. (#58977) Thanks @Starhappysh. - Exec approvals/channels: decouple initiating-surface approval availability from native delivery enablement so Telegram, Slack, and Discord still expose approvals when approvers exist and native target routing is configured separately. (#59776) Thanks @joelnishanth.