OpenClaw v2026.4.7 - 更新日志

### 变更 - CLI/infer：新增一流的 `openclaw infer ...` 中心，支持跨模型、媒体、网络和嵌入任务的提供程序支持推理工作流。感谢 @Takhoffman。 - 工具/媒体生成：默认在需身份验证的图像、音乐和视频提供程序间自动回退，在提供程序切换时保留用户意图，将尺寸/纵横比/分辨率/时长提示重新映射到最接近的受支持选项，并呈现提供程序能力及支持模式感知的视频到视频功能。 - Memory/wiki：恢复捆绑的 `memory-wiki` 技术栈，包含插件、CLI、同步/查询/应用工具、memory-host 集成、结构化声明/证据字段、编译摘要检索、声明健康检查、矛盾聚类、过期仪表板和按新鲜度加权的搜索功能。感谢 @vincentkoc。 - 插件/webhooks：新增捆绑的 webhook 入口插件，使外部自动化可通过每路由共享密钥端点创建并驱动绑定的 TaskFlow。（#61892）感谢 @mbelinky。 - Gateway/sessions：新增持久化压缩检查点及 Sessions UI 分支/恢复操作，使操作员可检查并恢复压缩前的会话状态。（#62146）感谢 @scoootscooob。 - Compaction：新增可插拔压缩提供程序注册表，使插件可替换内置摘要管道。通过 `agents.defaults.compaction.provider` 配置；提供程序失败时回退到 LLM 摘要。（#56224）感谢 @DhruvBhatia0。 - Agents/system prompt：新增 `agents.defaults.systemPromptOverride` 以控制提示词实验，以及心跳提示词段控制，使心跳运行时行为可在不每轮注入心跳指令的情况下保持启用。 - Providers/Google：新增 Gemma 4 模型支持，并在请求的提供程序路径上保持 Google 回退解析，使原生 Google Gemma 路由恢复正常。（#61507）感谢 @eyjohn。 - Providers/Google：在兼容性封装中为 Gemma 4 保留显式禁用推理的语义，同时启用 Gemma 推理支持。（#62127）感谢 @romgenie。 - Providers/Arcee AI：新增捆绑的 Arcee AI 提供程序插件，包含 Trinity 目录条目、OpenRouter 支持及更新的入门/身份验证指南。（#62068）感谢 @arthurbr11。 - Providers/Anthropic：在入门引导、模型身份验证指南、doctor 流程及 Docker Claude CLI 实时通道中恢复 Claude CLI 作为首选本地 Anthropic 路径。 - Providers/Ollama：从 `/api/show` 响应检测视觉能力，并为支持视觉的模型设置图像输入，使 Ollama 视觉模型可接受图像附件。（#62193）感谢 @BruceMacD。 - Memory/dreaming：将编辑后的会话记录摄入梦境语料库，包含按天的会话-语料笔记、游标检查点及推广/doctor 支持。（#62227）感谢 @vignesh07。 - Providers/inferrs：为更严格的 OpenAI 兼容聊天后端添加字符串内容兼容性，通过完整配置示例记录 `inferrs` 设置，并为通过直接探测但在完整代理运行时提示上失败的本地后端添加故障排除指南。 - Agents/context engine：向上下文引擎公开提示词缓存运行时上下文，并使当前轮提示词缓存使用与当前尝试而非过时的前一轮助手状态保持一致。（#62179）感谢 @jalehman。 - Plugin SDK/context engines：向 `assemble()` 传递 `availableTools` 和 `citationsMode`，并公开内存工件和内存提示词接缝，使配套插件和非传统上下文引擎可在不触及内部结构的情况下使用活动内存状态。感谢 @vincentkoc。 - ACP/ACPX plugin：将捆绑的 `acpx` 固定版本提升至 `0.5.1`，使插件本地安装和严格版本检查可获取最新发布的运行时版本。（#62148）感谢 @onutc。 - Discord/events：允许 `event-create` 接受封面图片 URL 或本地文件路径，加载并验证 PNG/JPG/GIF 事件封面媒体，并将编码的图像负载通过 Discord 管理操作/运行时路径传递。（#60883）感谢 @bittoby。 ### 修复 - CLI/infer：通过修复显式 TTS 覆盖处理、配置文件感知的网关 TTS 偏好解析、每请求转录 `prompt`/`language` 覆盖、图像输出 MIME/扩展名不匹配、配置的网络搜索回退行为以及代理与 CLI 网络搜索执行偏差，使提供程序支持的 infer 行为与实际运行时执行保持一致。 - 插件/media：当设置 `plugins.allow` 时，能力回退现在将捆绑的能力插件 ID 合并到允许列表中（不仅限于 `plugins.entries`），因此 OpenAI 兼容 STT 等媒体理解提供程序可在无需在 `plugins.allow` 中包含 `openai` 的情况下加载用于语音转录。（#62205）感谢 @neeravmakwana。 - Agents/history 和 replies：缓冲无阶段 OpenAI WS 文本直至真实助手阶段到达，保持回放和 SSE 历史序列跟踪一致，隐藏评论和泄露的工具 XML 以免显示在用户可见历史中，并保持基于历史的后续回复仅针对 `final_answer` 文本。（#61729、#61747、#61829、#61855、#61954）感谢 @100yenadmin 及贡献者。 - Control UI：在 webchat 中显示 `/tts` 音频回复，检测带有正确 `#token=` 提示的错误 `?token=` 身份验证链接，并保持 Copy、Canvas 和移动端执行批准 UI 不在窄屏幕上覆盖聊天内容。（#54842、#61514、#61598）感谢 @neeravmakwana。 - iOS/gateway：用结构化的网关连接问题替换字符串匹配连接错误 UI，在后续通用断开噪音中保留可操作的配对/身份验证失败，并在入门引导、设置和根状态界面呈现可复用的问题横幅和详情。（#62650）感谢 @ngutman。 - TUI：通过共享会话状态命令路由 `/status`，在历史中隐藏评论，从异步命令通知中剥离原始信封元数据，在每次尝试失败最终确定前保持回退流，并在退出或致命崩溃时恢复 Kitty 键盘状态。（#49130、#59985、#60043、#61463）感谢 @biefan 及贡献者。 - iOS/Watch exec approvals：在 iPhone 锁定或后台时保持 Apple Watch 审查和批准恢复工作，包括重新连接恢复、待批准持久化、通知清理及 APNs 支持的 Watch 刷新恢复。（#61757）感谢 @ngutman。 - Agents/context overflow：合并超大和聚合工具结果恢复为单次传递，并恢复总上下文溢出后备方案，使可恢复会话重试而非提前失败。（#61651）感谢 @Takhoffman。 - Auth/OpenAI Codex OAuth：在锁定刷新路径内重新加载磁盘上的新鲜凭证，并在 `refresh_token_reused` 仅轮换存储的刷新令牌后重试一次，使重新登录/重启恢复不再因过时缓存身份验证状态而卡住。感谢 @owen-ever。 - Auth/OpenAI Codex OAuth：在目标会话上保留原生 `/model ...@profile` 选择，并尊重显式用户锁定的身份验证配置文件，即使每代理身份验证顺序排除它们。（#62744）感谢 @jalehman。 - Providers/Anthropic：为 Claude Opus 4.5+、Sonnet 4.5+ 及更新的 Claude 4 系列模型保留推理块，使提示词缓存前缀保持匹配，并在 OAuth 身份验证的流封装请求上跳过 `service_tier` 注入，使 Claude OAuth 流不再因 HTTP 401 失败。（#60356、#61793） - Agents/Claude CLI：从结构化 CLI 输出呈现嵌套 API 错误消息，使计费/身份验证/提供程序失败显示真实提供程序错误而非模糊的 CLI 失败。 - Agents/exec：在 `tools.exec.host=auto` 下提升的默认值时保留显式 `host=node` 路由，对无效的提升跨主机覆盖大声失败，并在批准超时后保持 `strictInlineEval` 命令被阻止而非回退到自动执行。（#61739）感谢 @obviyus。 - Nodes/exec approvals：使 `host=node` POSIX 传输 shell 封装（`/bin/sh -lc ...`）与内部命令允许列表分析保持一致，使允许列表脚本不再不必要地提示，而 Windows `cmd.exe` 封装运行保持批准门控。（#62401）感谢 @ngutman。 - Nodes/exec approvals：即使 `env` 载体（包括环境赋值载体）封装 shell 调用，Windows `cmd.exe /c` 封装运行也保持批准门控。（#62439）感谢 @ngutman。 - Gateway tool/exec config：阻止面向模型的 `gateway config.apply` 和 `config.patch` 写入更改执行批准路径（如 `safeBins`、`safeBinProfiles`、`safeBinTrustedDirs`、`strictInlineEval`），同时允许未更改的结构化值通过。（#62001）感谢 @eleqtrizit。 - Host exec/env 清理：阻止危险的 Java、Rust、Cargo、Git、Kubernetes、云凭证、配置路径和 Helm 环境覆盖，使主机运行工具无法被重定向到攻击者选择的代码、配置、凭证或仓库状态。（#59119、#62002、#62291）感谢 @eleqtrizit 及贡献者。 - Commands/allowlist：在频道解析前要求 `/allowlist add` 和 `/allowlist remove` 的所有者授权，使非所有者但命令授权的发送者无法再持久重写允许列表策略状态。（#62383）感谢 @pgondhi987。 - Feishu/docx 上传：通过将工作区约束的 `localRoots` 转发到媒体加载器，使本地 `upload_file` 和 `upload_image` 路径尊重 `tools.fs.workspaceOnly`，因此在工作区仅模式激活时，docx 上传无法读取工作区外的主机本地文件。（#62369）感谢 @pgondhi987。 - Network/fetch guard：默认在跨源 `307` 和 `308` 重定向上丢弃请求体和描述请求体的头部，使攻击者控制的重定向跳跃无法从 SSRF 防护的获取流接收携带秘密的 POST 负载，除非调用者明确选择加入。（#62357）感谢 @pgondhi987。 - Browser/SSRF：将主框架 `document` 重定向跳跃视为导航，即使 Playwright 未将其标记为 `isNavigationRequest()`，使严格的私有网络阻止仍可在浏览器到达内部目标前阻止禁止的重定向枢轴。（#62355）感谢 @pgondhi987。 - Browser/node invoke：通过 `browser.proxy` 阻止持久浏览器配置文件创建、重置和删除变更，在网关转发的 `node.invoke` 和节点主机代理路径上均生效，即使未配置配置文件允许列表。（#60489） - Gateway/node pairing：当先前配对的节点重新连接并声明额外命令时要求新的配对请求，并将实时会话固定到早期批准的命令集，直到升级获得批准。（#62658）感谢 @eleqtrizit。 - Gateway/auth：当配置的密钥轮换时使现有共享令牌和密码 WebSocket 会话失效，使过时认证的套接字无法在令牌或密码更改后保持连接。（#62350）感谢 @pgondhi987。 - MS Teams/security：在上传附件前针对 HTTPS、Microsoft/SharePoint 主机允许列表和私有 IP DNS 检查验证文件同意上传 URL，阻止 SSRF 风格同意上传滥用。（#23596） - Media/base64 解码防护：在解码前对 Teams、Signal、QQ Bot 和图像工具负载中遗漏的 base64 强制字节限制，使过大的入站媒体和数据 URL 不再绕过解码前大小检查。（#62007）感谢 @eleqtrizit。 - Runtime event trust：将后台 `notifyOnExit` 摘要、ACP 父流中继和唤醒钩子负载标记为不可信系统事件，使较低信任的运行时输出不再在后续轮次中作为受信的 `System:` 文本重新进入。 - Auto-reply/media：允许管理生成的媒体 `MEDIA:` 路径来自正常回复文本，同时阻止任意主机本地媒体和文档路径，使生成的媒体可继续传递而不重新开放主机路径注入漏洞。 - Gateway/status 和 containers：在 Docker 和 Podman 环境中自动绑定到 `0.0.0.0`，并通过转发自签名指纹通过 `wss://` 探测本地 TLS 网关，使容器启动和环回 TLS 状态检查恢复正常。（#61818、#61935）感谢 @openperf 及贡献者。 - Gateway/OpenAI-compatible HTTP：在客户端断开连接时中止飞行中的 `/v1/chat/completions` 和 `/v1/responses` 轮次，使废弃的 HTTP 请求不再浪费代理运行时。（#54388）感谢 @Lellansin。 - macOS/gateway 版本：在语义版本解析前从 CLI 版本输出中剥离尾随提交元数据，使 Mac 应用再次识别类似 `OpenClaw 2026.4.2 (d74a122)` 的已安装网关版本。（#61111）感谢 @oliviareid-svg。 - Sessions/model selection：将显式选择的会话模型与运行时回退解析分开解析，使会话状态和实时模型切换与所选模型保持一致。 - Discord/ACP 绑定：跨入站消息、组件交互、原生命令和当前对话绑定解析规范化 DM 对话身份，使 Discord DM 中的 `--bind here` 将后续回复路由到绑定的代理而非回退到默认代理。 - Discord：在快照缺失时恢复转发的引用消息文本和附件，对网关监控套接字重新使用 `ws://`，停止为 Codex 支持的自动线程标题强制硬编码温度，并强化语音接收恢复使快速说话者重启保持其下一话语。（#41536、#61670）感谢 @artwalker 及贡献者。 - Slack/thread mentions：新增 `channels.slack.thread.requireExplicitMention`，使已要求提及的 Slack 频道也可要求机器人在机器人参与的线程内显式 `@bot` 提及。（#58276）感谢 @praktika-engineer。 - Slack/threading：当较旧调用者省略 `isThreadReply` 时保持传统线程粘性以用于真实回复，同时为 Slack 自动创建的顶层 `thread_ts` 尊重 `replyToMode`。（#61835）感谢 @kaonash。 - Slack/media：使附件下载保持在 SSRF 防护的调度程序路径上，使 Slack 媒体获取在 Node 22 上工作且不丢弃固定的传输强制。（#62239）感谢 @openperf。 - Matrix/onboarding：添加邀请自动加入设置步骤，包含显式关闭警告和严格稳定目标验证，使新 Matrix 账户不再静默忽略邀请房间和新鲜 DM 风格邀请，除非操作员选择加入。（#62168）感谢 @gumadeiras。 - Matrix/formatting：在 Element 中保留多段落和松散列表渲染，使编号和项目符号 Markdown 内容保持附加到正确的列表项。（#60997）感谢 @gucasbrg。 - Telegram/doctor：在多账户规范化期间保持顶层访问控制回退，同时将遗留默认身份验证提升到 `accounts.default`，使现有命名机器人保留继承的允许列表而不丢弃遗留默认机器人。（#62263）感谢 @obviyus。 - Plugins/loaders：集中捆绑 `dist/**` Jiti 原生加载策略，并使通道、公共表面、外观和配置元数据加载器接缝在 Windows 上远离原生 Jiti，使入门引导和配置流程不再触发 `ERR_UNSUPPORTED_ESM_URL_SCHEME`。（#62286）感谢 @chen-zhang-cs-code。 - Plugins/channels：在延迟加载下保持捆绑通道工件和秘密合约加载稳定，在安装期间保留插件模式默认值，并修复 Windows `file://` 和原生 Jiti 插件加载器路径，使入门引导、doctor、`openclaw secret` 和捆绑插件安装恢复正常。（#61832、#61836、#61853、#61856）感谢 @Zeesejo 及贡献者。 - Plugins/ClawHub：根据版本元数据 SHA-256 验证下载的插件归档，在归档完整性元数据缺失或格式错误时失败封闭，并收紧回退 ZIP 验证，使插件安装在 ClawHub 包元数据不匹配或不完整时无法继续。（#60517）感谢 @mappel-nv。 - Plugins/provider hooks：在插件初始化期间阻止递归提供程序快照加载堆栈溢出，同时保留缓存的嵌套提供程序钩子结果。（#61922、#61938、#61946、#61951） - Docker/plugins：停止在运行时镜像中强制捆绑插件发现到 `/app/extensions`，使打包安装再次使用编译的 `dist/extensions` 工件，且 Node 24 容器不再通过仅源插件入口路径启动。修复 #62044。（#62316）感谢 @gumadeiras。 - Providers/Ollama：在流式传输期间尊重选定提供程序的 `baseUrl`，使多 Ollama 设置不再将每个流路由到第一个配置的 Ollama 端点。 - Providers/Ollama：停止在发现仅看到空默认本地存根时警告无法访问 Ollama，同时保持对不可达端点的真实显式 Ollama 覆盖警告。 - Providers/xAI：将 `api.grok.x.ai` 识别为 xAI 原生端点，并保持遗留 `x_search` 身份验证解析工作，使旧 xAI 网络搜索配置继续加载。（#61377）感谢 @jjjojoj。 - Providers/Mistral：为 `mistral/mistral-small-latest`（Mistral Small 4）发送 `reasoning_effort` 及推理级别映射，并将目录条目标记为推理能力，使可调推理与 Mistral 聊天补全 API 匹配。（#62162）感谢 @neeravmakwana。 - OpenAI TTS/Groq：向 Groq 兼容语音端点发送 `wav`，尊重 OpenAI 兼容路径上的显式 `responseFormat` 覆盖，且仅当实际格式为 `opus` 时将语音笔记输出标记为语音兼容。（#62233）感谢 @neeravmakwana。 - Tools/web_fetch 和 web_search：修复因 undici 8.0 默认启用 HTTP/2 导致的 `TypeError: fetch failed`；固定 SSRF 防护调度程序现在显式设置 `allowH2: false` 以恢复 HTTP/1.1 行为并保持自定义 DNS 固定查找兼容。（#61738、#61777）感谢 @zozo123。 - Tools/web search/Exa：通过将捆绑 Exa 提供程序标记为设置可见，在入门引导中显示 Exa Search 并重新配置提供程序选择器。感谢 @vincentkoc。 - Memory/vector recall：在 `sqlite-vec` 不可用或向量写入降级时呈现显式警告，并在每日笔记摄入前剥离管理的浅睡眠和 REM 块，使内存索引和梦境停止报告虚假成功或重新摄入暂存输出。（#61720）感谢 @MonkeyLeeT。 - Memory/dreaming：使 Dreams 配置读写尊重选定的内存槽插件而非始终目标 `memory-core`。（#62275）感谢 @SnowSky1。 - QQ Bot/media：通过受保护的 QQ/Tencent HTTPS 获取路由网关侧附件和回退下载，使 QQ 媒体处理不再遵循任意远程主机。 - Browser/remote CDP：远程浏览器重启后重试 DevTools websocket 一次，使健康的远程浏览器配置文件在 CDP 预热期间不失败可用性检查。（#57397）感谢 @ThanhNguyxn07。 - UI/light mode：针对浅色主题中的根和嵌套 WebKit 滚动条拇指，使页面级和容器滚动条在浅色背景上保持可见。（#61753）感谢 @chziyue。 - Agents/subagents：通过网关和嵌入式运行器保留轻量级引导上下文而非静默回退到完整工作区引导注入，使 `sessions_spawn(lightContext: true)` 对生成的子代理运行生效。（#62264）感谢 @theSamPadilla。 - Cron：当磁盘存储省略 `id` 时将 `jobId` 加载到 `id`，匹配 doctor 迁移并修复手动编辑 `jobs.json` 的 `unknown cron job id`。（#62246）感谢 @neeravmakwana。 - Agents/model fallback：将最小 HTTP 404 API 错误（例如 `404 status code (no body)`）分类为 `model_not_found`，使助手失败抛入回退链而非在第一个回退候选处停止。（#62119）感谢 @neeravmakwana。 - BlueBubbles/network：跨账户解析、状态探测、监控启动和附件下载尊重显式私有网络退出，同时保持公共主机附件主机名固定。（#59373）感谢 @jpreagan。 - Agents/heartbeat：将心跳运行固定到主会话，使活动子代理记录不被心跳状态消息覆盖。（#61803）感谢 @100yenadmin。 - Agents/heartbeat：尊重禁用心跳提示词引导，使操作员可在不禁用心跳运行时行为的情况下抑制心跳提示词指令。 - Agents/compaction：停止压缩等待中止重新进入提示词故障转移和重放完成的工具轮次。（#62600）感谢 @i-dentifier。 - Approvals/runtime：将原生批准生命周期组装移至由通道能力和运行时上下文驱动的共享核心引导/运行时接缝，并移除遗留捆绑批准回退布线。（#62135）感谢 @gumadeiras。 - Security/fetch-guard：停止在 SSRF 防护获取中针对目标范围主机名允许列表拒绝操作员配置的代理主机名，恢复 Telegram 和其他通道的基于代理媒体下载。（#62312）感谢 @ademczuk。 - Logging：使 `logging.level` 和 `logging.consoleLevel` 再次尊重文档的严重性阈值排序，并保持子记录器继承父 `minLevel`。（#44646）感谢 @zhumengzhu。 - Agents/sessions_send：通过公告传递传递 `threadId`，使跨会话通知进入正确的 Telegram 论坛主题而非群组的一般线程。（#62758）感谢 @jalehman。 - Daemon/systemd：当机器范围 systemctl 失败时保持 sudo systemctl 调用范围到调用用户，同时避免权限被拒用户总线错误的机器回退。（#62337）感谢 @Aftabbs。 - Docs/i18n：翻译后重新本地化最终本地化页面链接，并移除 zh-CN 主页重定向覆盖，使本地化 Mintlify 页面再次解析到正确的语言根。（#61796）感谢 @hxy91819。 - Agents/exec：保持超时的 shell 后台命令在失败路径上，并将长时间运行作业指向 exec 后台/产生会话，使进程轮询仅建议用于注册会话。（#62264）感谢 @theSamPadilla。

### Changes - CLI/infer: add a first-class `openclaw infer ...` hub for provider-backed inference workflows across model, media, web, and embedding tasks. Thanks @Takhoffman. - Tools/media generation: auto-fallback across auth-backed image, music, and video providers by default, preserve intent during provider switches, remap size/aspect/resolution/duration hints to the closest supported option, and surface provider capabilities plus mode-aware video-to-video support. - Memory/wiki: restore the bundled `memory-wiki` stack with plugin, CLI, sync/query/apply tooling, memory-host integration, structured claim/evidence fields, compiled digest retrieval, claim-health linting, contradiction clustering, staleness dashboards, and freshness-weighted search. Thanks @vincentkoc. - Plugins/webhooks: add a bundled webhook ingress plugin so external automation can create and drive bound TaskFlows through per-route shared-secret endpoints. (#61892) Thanks @mbelinky. - Gateway/sessions: add persisted compaction checkpoints plus Sessions UI branch/restore actions so operators can inspect and recover pre-compaction session state. (#62146) Thanks @scoootscooob. - Compaction: add pluggable compaction provider registry so plugins can replace the built-in summarization pipeline. Configure via `agents.defaults.compaction.provider`; falls back to LLM summarization on provider failure. (#56224) Thanks @DhruvBhatia0. - Agents/system prompt: add `agents.defaults.systemPromptOverride` for controlled prompt experiments plus heartbeat prompt-section controls so heartbeat runtime behavior can stay enabled without injecting heartbeat instructions every turn. - Providers/Google: add Gemma 4 model support and keep Google fallback resolution on the requested provider path so native Google Gemma routes work again. (#61507) Thanks @eyjohn. - Providers/Google: preserve explicit thinking-off semantics for Gemma 4 while still enabling Gemma reasoning support in compatibility wrappers. (#62127) Thanks @romgenie. - Providers/Arcee AI: add a bundled Arcee AI provider plugin with Trinity catalog entries, OpenRouter support, and updated onboarding/auth guidance. (#62068) Thanks @arthurbr11. - Providers/Anthropic: restore Claude CLI as the preferred local Anthropic path in onboarding, model-auth guidance, doctor flows, and Docker Claude CLI live lanes again. - Providers/Ollama: detect vision capability from the `/api/show` response and set image input on models that support it so Ollama vision models accept image attachments. (#62193) Thanks @BruceMacD. - Memory/dreaming: ingest redacted session transcripts into the dreaming corpus with per-day session-corpus notes, cursor checkpointing, and promotion/doctor support. (#62227) Thanks @vignesh07. - Providers/inferrs: add string-content compatibility for stricter OpenAI-compatible chat backends, document `inferrs` setup with a full config example, and add troubleshooting guidance for local backends that pass direct probes but fail on full agent-runtime prompts. - Agents/context engine: expose prompt-cache runtime context to context engines and keep current-turn prompt-cache usage aligned with the active attempt instead of stale prior-turn assistant state. (#62179) Thanks @jalehman. - Plugin SDK/context engines: pass `availableTools` and `citationsMode` into `assemble()`, and expose memory-artifact and memory-prompt seams so companion plugins and non-legacy context engines can consume active memory state without reaching into internals. Thanks @vincentkoc. - ACP/ACPX plugin: bump the bundled `acpx` pin to `0.5.1` so plugin-local installs and strict version checks pick up the latest published runtime release. (#62148) Thanks @onutc. - Discord/events: allow `event-create` to accept a cover image URL or local file path, load and validate PNG/JPG/GIF event cover media, and pass the encoded image payload through Discord admin action/runtime paths. (#60883) Thanks @bittoby. ### Fixes - CLI/infer: keep provider-backed infer behavior aligned with actual runtime execution by fixing explicit TTS override handling, profile-aware gateway TTS prefs resolution, per-request transcription `prompt`/`language` overrides, image output MIME/extension mismatches, configured web-search fallback behavior, and agent-vs-CLI web-search execution drift. - Plugins/media: when `plugins.allow` is set, capability fallback now merges bundled capability plugin ids into the allowlist (not only `plugins.entries`), so media understanding providers such as OpenAI-compatible STT load for voice transcription without requiring `openai` in `plugins.allow`. (#62205) Thanks @neeravmakwana. - Agents/history and replies: buffer phaseless OpenAI WS text until a real assistant phase arrives, keep replay and SSE history sequence tracking aligned, hide commentary and leaked tool XML from user-visible history, and keep history-based follow-up replies on `final_answer` text only. (#61729, #61747, #61829, #61855, #61954) Thanks @100yenadmin and contributors. - Control UI: show `/tts` audio replies in webchat, detect mistaken `?token=` auth links with the correct `#token=` hint, and keep Copy, Canvas, and mobile exec-approval UI from covering chat content on narrow screens. (#54842, #61514, #61598) Thanks @neeravmakwana. - iOS/gateway: replace string-matched connection error UI with structured gateway connection problems, preserve actionable pairing/auth failures over later generic disconnect noise, and surface reusable problem banners and details across onboarding, settings, and root status surfaces. (#62650) Thanks @ngutman. - TUI: route `/status` through the shared session-status command, keep commentary hidden in history, strip raw envelope metadata from async command notices, preserve fallback streaming before per-attempt failures finalize, and restore Kitty keyboard state on exit or fatal crashes. (#49130, #59985, #60043, #61463) Thanks @biefan and contributors. - iOS/Watch exec approvals: keep Apple Watch review and approval recovery working while the iPhone is locked or backgrounded, including reconnect recovery, pending approval persistence, notification cleanup, and APNs-backed watch refresh recovery. (#61757) Thanks @ngutman. - Agents/context overflow: combine oversized and aggregate tool-result recovery in one pass and restore a total-context overflow backstop so recoverable sessions retry instead of failing early. (#61651) Thanks @Takhoffman. - Auth/OpenAI Codex OAuth: reload fresh on-disk credentials inside the locked refresh path and retry once after `refresh_token_reused` rotates only the stored refresh token, so relogin/restart recovery stops getting stuck on stale cached auth state. Thanks @owen-ever. - Auth/OpenAI Codex OAuth: keep native `/model ...@profile` selections on the target session and honor explicit user-locked auth profiles even when per-agent auth order excludes them. (#62744) Thanks @jalehman. - Providers/Anthropic: preserve thinking blocks for Claude Opus 4.5+, Sonnet 4.5+, and newer Claude 4-family models so prompt-cache prefixes keep matching, and skip `service_tier` injection on OAuth-authenticated stream wrapper requests so Claude OAuth streaming stops failing with HTTP 401. (#60356, #61793) - Agents/Claude CLI: surface nested API error messages from structured CLI output so billing/auth/provider failures show the real provider error instead of an opaque CLI failure. - Agents/exec: preserve explicit `host=node` routing under elevated defaults when `tools.exec.host=auto`, fail loud on invalid elevated cross-host overrides, and keep `strictInlineEval` commands blocked after approval timeouts instead of falling through to automatic execution. (#61739) Thanks @obviyus. - Nodes/exec approvals: keep `host=node` POSIX transport shell wrappers (`/bin/sh -lc ...`) aligned with inner-command allowlist analysis so allowlisted scripts stop prompting unnecessarily, while Windows `cmd.exe` wrapper runs stay approval-gated. (#62401) Thanks @ngutman. - Nodes/exec approvals: keep Windows `cmd.exe /c` wrapper runs approval-gated even when `env` carriers, including env-assignment carriers, wrap the shell invocation. (#62439) Thanks @ngutman. - Gateway tool/exec config: block model-facing `gateway config.apply` and `config.patch` writes from changing exec approval paths such as `safeBins`, `safeBinProfiles`, `safeBinTrustedDirs`, and `strictInlineEval`, while still allowing unchanged structured values through. (#62001) Thanks @eleqtrizit. - Host exec/env sanitization: block dangerous Java, Rust, Cargo, Git, Kubernetes, cloud credential, config-path, and Helm env overrides so host-run tools cannot be redirected to attacker-chosen code, config, credentials, or repository state. (#59119, #62002, #62291) Thanks @eleqtrizit and contributors. - Commands/allowlist: require owner authorization for `/allowlist add` and `/allowlist remove` before channel resolution, so non-owner but command-authorized senders can no longer persistently rewrite allowlist policy state. (#62383) Thanks @pgondhi987. - Feishu/docx uploads: honor `tools.fs.workspaceOnly` for local `upload_file` and `upload_image` paths by forwarding workspace-constrained `localRoots` into the media loader, so docx uploads can no longer read host-local files outside the workspace when workspace-only mode is active. (#62369) Thanks @pgondhi987. - Network/fetch guard: drop request bodies and body-describing headers on cross-origin `307` and `308` redirects by default, so attacker-controlled redirect hops cannot receive secret-bearing POST payloads from SSRF-guarded fetch flows unless a caller explicitly opts in. (#62357) Thanks @pgondhi987. - Browser/SSRF: treat main-frame `document` redirect hops as navigations even when Playwright does not flag them as `isNavigationRequest()`, so strict private-network blocking still stops forbidden redirect pivots before the browser reaches the internal target. (#62355) Thanks @pgondhi987. - Browser/node invoke: block persistent browser profile create, reset, and delete mutations through `browser.proxy` on both gateway-forwarded `node.invoke` and the node-host proxy path, even when no profile allowlist is configured. (#60489) - Gateway/node pairing: require a fresh pairing request when a previously paired node reconnects with additional declared commands, and keep the live session pinned to the earlier approved command set until the upgrade is approved. (#62658) Thanks @eleqtrizit. - Gateway/auth: invalidate existing shared-token and password WebSocket sessions when the configured secret rotates, so stale authenticated sockets cannot stay attached after token or password changes. (#62350) Thanks @pgondhi987. - MS Teams/security: validate file-consent upload URLs against HTTPS, Microsoft/SharePoint host allowlists, and private-IP DNS checks before uploading attachments, blocking SSRF-style consent-upload abuse. (#23596) - Media/base64 decode guards: enforce byte limits before decoding missed base64-backed Teams, Signal, QQ Bot, and image-tool payloads so oversized inbound media and data URLs no longer bypass pre-decode size checks. (#62007) Thanks @eleqtrizit. - Runtime event trust: mark background `notifyOnExit` summaries, ACP parent-stream relays, and wake-hook payloads as untrusted system events so lower-trust runtime output no longer re-enters later turns as trusted `System:` text. (#62003) - Auto-reply/media: allow managed generated-media `MEDIA:` paths from normal reply text again while still blocking arbitrary host-local media and document paths, so generated media keep delivering without reopening host-path injection holes. - Gateway/status and containers: auto-bind to `0.0.0.0` inside Docker and Podman environments, and probe local TLS gateways over `wss://` with self-signed fingerprint forwarding so container startup and loopback TLS status checks work again. (#61818, #61935) Thanks @openperf and contributors. - Gateway/OpenAI-compatible HTTP: abort in-flight `/v1/chat/completions` and `/v1/responses` turns when clients disconnect so abandoned HTTP requests stop wasting agent runtime. (#54388) Thanks @Lellansin. - macOS/gateway version: strip trailing commit metadata from CLI version output before semver parsing so the Mac app recognizes installed gateway versions like `OpenClaw 2026.4.2 (d74a122)` again. (#61111) Thanks @oliviareid-svg. - Sessions/model selection: resolve the explicitly selected session model separately from runtime fallback resolution so session status and live model switching stay aligned with the chosen model. - Discord/ACP bindings: canonicalize DM conversation identity across inbound messages, component interactions, native commands, and current-conversation binding resolution so `--bind here` in Discord DMs keeps routing follow-up replies to the bound agent instead of falling back to the default agent. - Discord: recover forwarded referenced message text and attachments when snapshots are missing, use `ws://` again for gateway monitor sockets, stop forcing a hardcoded temperature for Codex-backed auto-thread titles, and harden voice receive recovery so rapid speaker restarts keep their next utterance. (#41536, #61670) Thanks @artwalker and contributors. - Slack/thread mentions: add `channels.slack.thread.requireExplicitMention` so Slack channels that already require mentions can also require explicit `@bot` mentions inside bot-participated threads. (#58276) Thanks @praktika-engineer. - Slack/threading: keep legacy thread stickiness for real replies when older callers omit `isThreadReply`, while still honoring `replyToMode` for Slack's auto-created top-level `thread_ts`. (#61835) Thanks @kaonash. - Slack/media: keep attachment downloads on the SSRF-guarded dispatcher path so Slack media fetching works on Node 22 without dropping pinned transport enforcement. (#62239) Thanks @openperf. - Matrix/onboarding: add an invite auto-join setup step with explicit off warnings and strict stable-target validation so new Matrix accounts stop silently ignoring invited rooms and fresh DM-style invites unless operators opt in. (#62168) Thanks @gumadeiras. - Matrix/formatting: preserve multi-paragraph and loose-list rendering in Element so numbered and bulleted Markdown keeps their content attached to the correct list item. (#60997) Thanks @gucasbrg. - Telegram/doctor: keep top-level access-control fallback in place during multi-account normalization while still promoting legacy default auth into `accounts.default`, so existing named bots keep inherited allowlists without dropping the legacy default bot. (#62263) Thanks @obviyus. - Plugins/loaders: centralize bundled `dist/**` Jiti native-load policy and keep channel, public-surface, facade, and config-metadata loader seams off native Jiti on Windows so onboarding and configure flows stop tripping `ERR_UNSUPPORTED_ESM_URL_SCHEME`. (#62286) Thanks @chen-zhang-cs-code. - Plugins/channels: keep bundled channel artifact and secret-contract loading stable under lazy loading, preserve plugin-schema defaults during install, and fix Windows `file://` plus native-Jiti plugin loader paths so onboarding, doctor, `openclaw secret`, and bundled plugin installs work again. (#61832, #61836, #61853, #61856) Thanks @Zeesejo and contributors. - Plugins/ClawHub: verify downloaded plugin archives against version metadata SHA-256, fail closed when archive integrity metadata is missing or malformed, and tighten fallback ZIP verification so plugin installs cannot proceed on mismatched or incomplete ClawHub package metadata. (#60517) Thanks @mappel-nv. - Plugins/provider hooks: stop recursive provider snapshot loads from overflowing the stack during plugin initialization, while still preserving cached nested provider-hook results. (#61922, #61938, #61946, #61951) - Docker/plugins: stop forcing bundled plugin discovery to `/app/extensions` in runtime images so packaged installs use compiled `dist/extensions` artifacts again and Node 24 containers do not boot through source-only plugin entry paths. Fixes #62044. (#62316) Thanks @gumadeiras. - Providers/Ollama: honor the selected provider's `baseUrl` during streaming so multi-Ollama setups stop routing every stream to the first configured Ollama endpoint. (#61678) - Providers/Ollama: stop warning that Ollama could not be reached when discovery only sees empty default local stubs, while still keeping real explicit Ollama overrides loud when the endpoint is unreachable. - Providers/xAI: recognize `api.grok.x.ai` as an xAI-native endpoint again and keep legacy `x_search` auth resolution working so older xAI web-search configs continue to load. (#61377) Thanks @jjjojoj. - Providers/Mistral: send `reasoning_effort` for `mistral/mistral-small-latest` (Mistral Small 4) with thinking-level mapping, and mark the catalog entry as reasoning-capable so adjustable reasoning matches Mistral’s Chat Completions API. (#62162) Thanks @neeravmakwana. - OpenAI TTS/Groq: send `wav` to Groq-compatible speech endpoints, honor explicit `responseFormat` overrides on OpenAI-compatible paths, and only mark voice-note output as voice-compatible when the actual format is `opus`. (#62233) Thanks @neeravmakwana. - Tools/web_fetch and web_search: fix `TypeError: fetch failed` caused by undici 8.0 enabling HTTP/2 by default; pinned SSRF-guard dispatchers now explicitly set `allowH2: false` to restore HTTP/1.1 behavior and keep the custom DNS-pinning lookup compatible. (#61738, #61777) Thanks @zozo123. - Tools/web search/Exa: show Exa Search in onboarding and configure provider pickers again by marking the bundled Exa provider as setup-visible. Thanks @vincentkoc. - Memory/vector recall: surface explicit warnings when `sqlite-vec` is unavailable or vector writes are degraded, and strip managed Light Sleep and REM blocks before daily-note ingestion so memory indexing and dreaming stop reporting false-success or re-ingesting staged output. (#61720) Thanks @MonkeyLeeT. - Memory/dreaming: make Dreams config reads and writes respect the selected memory slot plugin instead of always targeting `memory-core`. (#62275) Thanks @SnowSky1. - QQ Bot/media: route gateway-side attachment and fallback downloads through guarded QQ/Tencent HTTPS fetches so QQ media handling no longer follows arbitrary remote hosts. - Browser/remote CDP: retry the DevTools websocket once after remote browser restarts so healthy remote browser profiles do not fail availability checks during CDP warm-up. (#57397) Thanks @ThanhNguyxn07. - UI/light mode: target both root and nested WebKit scrollbar thumbs in the light theme so page-level and container scrollbars stay visible on light backgrounds. (#61753) Thanks @chziyue. - Agents/subagents: honor `sessions_spawn(lightContext: true)` for spawned subagent runs by preserving lightweight bootstrap context through the gateway and embedded runner instead of silently falling back to full workspace bootstrap injection. (#62264) Thanks @theSamPadilla. - Cron: load `jobId` into `id` when the on-disk store omits `id`, matching doctor migration and fixing `unknown cron job id` for hand-edited `jobs.json`. (#62246) Thanks @neeravmakwana. - Agents/model fallback: classify minimal HTTP 404 API errors (for example `404 status code (no body)`) as `model_not_found` so assistant failures throw into the fallback chain instead of stopping at the first fallback candidate. (#62119) Thanks @neeravmakwana. - BlueBubbles/network: respect explicit private-network opt-out for loopback and private `serverUrl` values across account resolution, status probes, monitor startup, and attachment downloads, while keeping public-host attachment hostname pinning intact. (#59373) Thanks @jpreagan. - Agents/heartbeat: keep heartbeat runs pinned to the main session so active subagent transcripts are not overwritten by heartbeat status messages. (#61803) Thanks @100yenadmin. - Agents/heartbeat: respect disabled heartbeat prompt guidance so operators can suppress heartbeat prompt instructions without disabling heartbeat runtime behavior. - Agents/compaction: stop compaction-wait aborts from re-entering prompt failover and replaying completed tool turns. (#62600) Thanks @i-dentifier. - Approvals/runtime: move native approval lifecycle assembly into shared core bootstrap/runtime seams driven by channel capabilities and runtime contexts, and remove the legacy bundled approval fallback wiring. (#62135) Thanks @gumadeiras. - Security/fetch-guard: stop rejecting operator-configured proxy hostnames against the target-scoped hostname allowlist in SSRF-guarded fetches, restoring proxy-based media downloads for Telegram and other channels. (#62312) Thanks @ademczuk. - Logging: make `logging.level` and `logging.consoleLevel` honor the documented severity threshold ordering again, and keep child loggers inheriting the parent `minLevel`. (#44646) Thanks @zhumengzhu. - Agents/sessions_send: pass `threadId` through announce delivery so cross-session notifications land in the correct Telegram forum topic instead of the group's general thread. (#62758) Thanks @jalehman. - Daemon/systemd: keep sudo systemctl calls scoped to the invoking user when machine-scoped systemctl fails, while still avoiding machine fallback for permission-denied user bus errors. (#62337) Thanks @Aftabbs. - Docs/i18n: relocalize final localized-page links after translation and remove the zh-CN homepage redirect override so localized Mintlify pages resolve to the correct language roots again. (#61796) Thanks @hxy91819. - Agents/exec: keep timed-out shell-backgrounded commands on the failed path and point long-running jobs to exec background/yield sessions so process polling is only suggested for registered sessions.