OpenClaw v2026.4.10 - 更新日志

## 2026.4.10 ### 变更 - **Models/Codex**：添加捆绑的 Codex 提供商和插件拥有的应用服务器测试工具，使 `codex/gpt-*` 模型使用 Codex 管理的认证、原生线程、模型发现和压缩，而 `openai/gpt-*` 保持正常的 OpenAI 提供商路径。(#64298) - **Memory/Active Memory**：添加一个新的可选 Active Memory 插件，为 OpenClaw 在主回复前提供一个专用的内存子代理，使持续对话能自动拉取相关的偏好、上下文和过往细节，无需用户手动说“记住这个”或“搜索内存”。包括可配置的消息/最近/完整上下文模式、实时 `/verbose` 检查、用于调优的高级提示/思考覆盖，以及可选的转录持久化用于调试。文档：https://docs.openclaw.ai/concepts/active-memory。(#63286) 感谢 @Takhoffman。 - **macOS/Talk**：为 Talk Mode 添加实验性的本地 MLX 语音提供商，支持显式提供商选择、本地语音播放、中断处理和系统语音回退。(#63539) 感谢 @ImLukeF。 - **Tools/video generation**：在捆绑的 fal 提供商中添加 Seedance 2.0 模型引用，并提交提供商特定的持续时间、分辨率、音频和种子元数据字段，以支持实时的 Seedance 2.0 运行。 - **Microsoft Teams**：添加固定、取消固定、已读、反应和列出反应的消息操作。(#53432) 感谢 @sudie-codes。 - **QA/Matrix**：添加由一次性 Matrix 主服务器支持的实时 `openclaw qa matrix` 通道、共享的实时传输接缝，以及针对线程、反应、重启和允许列表行为的 Matrix 特定传输覆盖。(#64489) 感谢 @gumadeiras。 - **QA/Telegram**：添加用于私有群组机器人对机器人检查的实时 `openclaw qa telegram` 通道，强化其工件处理，并保留原生 Telegram 命令回复线程以进行 QA 验证。(#64303) 感谢 @obviyus。 - **QA/testing**：为 `openclaw qa suite` 添加 `--runner multipass` 通道，使基于仓库的 QA 场景可在一次性 Linux 虚拟机中运行，并写入常规报告、摘要和虚拟机日志。(#63426) 感谢 @shakkernerd。 - **CLI/exec policy**：添加本地 `openclaw exec-policy` 命令，包含 `show`、`preset` 和 `set` 子命令，用于同步请求的 `tools.exec.*` 配置与本地执行批准文件，以及后续针对节点主机拒绝、回滚安全和同步冲突检测的强化。(#64050) - **Gateway**：添加 `commands.list` RPC，以便远程网关客户端可以发现运行时原生、文本、技能和插件命令，并具备表面感知的命名和序列化参数元数据。(#62656) 感谢 @samzong。 - **Models/providers**：为受信任的自托管 OpenAI 兼容端点添加每提供商 `models.providers.*.request.allowPrivateNetwork`，将选择加入范围限定为模型请求表面，并在请求传输覆盖更改时刷新缓存的 WebSocket 管理器。(#63671) 感谢 @qas。 - **Feishu**：标准化请求用户代理并将机器人注册为 AI 代理，以便 Feishu 部署一致地识别 OpenClaw。(#63835) 感谢 @evandance。 - **Matrix/partial streaming**：在草稿预览发送和编辑中添加 MSC4357 实时标记，以便支持的 Matrix 客户端可以呈现实时/打字机动画，并在最终编辑落地时停止它。(#63513) 感谢 @TigerInYourDream。 - **Control UI/dreaming**：简化 Scene 和 Diary 表面，为部分状态负载保留未知阶段状态，并稳定等待条目最近排序，使 Dreaming 状态和审查列表保持清晰和确定。(#64035) 感谢 @davemorin。 - **Agents**：为 GPT-5 系列运行添加可选的严格代理嵌入式 Pi 执行合同，使仅计划或填充回合继续执行，直到遇到真正的阻塞。(#64241) 感谢 @100yenadmin。 - **Agents/OpenAI**：添加提供商拥有的 OpenAI/Codex 工具架构兼容性，并为长时间运行暴露嵌入式运行重放/活跃状态。(#64300) 感谢 @100yenadmin。 - **Docs i18n**：分块原始文档翻译，拒绝截断的标记输出，避免模糊的仅主体包装器解包，并在不更改默认 `openai/gpt-5.4` 路径的情况下从终止的 Pi 翻译会话中恢复。(#62969, #63808) 感谢 @hxy91819。 ### 修复 - **Browser/security**：在严格 SSRF 默认值、主机名允许列表、交互驱动重定向、子框架、CDP 发现、现有会话、标签页操作、noVNC、标记跨度清理和 Docker CDP 源范围强制等方面，加强浏览器和沙箱导航防御。(#61404, #63332, #63882, #63885, #63889, #64367, #64370, #64371) - **Security/tools**：强化执行预检读取、主机环境拒绝列表、节点输出边界、出站主机媒体读取、配置文件变更授权、插件安装依赖扫描、ACPX 工具钩子、Gmail 监视器令牌编辑和过大的实时 WebSocket 帧处理。(#62333, #62661, #62662, #63277, #63551, #63553, #63886, #63890, #63891, #64459) - **OpenAI/Codex**：添加必需的 Codex OAuth 范围，更清晰地分类提供商/运行时故障，在自动批准的主机执行不可用时停止建议 `/elevated full`，添加 OpenAI/Codex 工具架构兼容性，并在压缩重试和变异副作用期间保留嵌入式运行重放/活跃真实性。(#64300, #64439) 感谢 @100yenadmin。 - **CLI/WhatsApp media sends**：通过通道 `sendMedia` 路径路由网关模式出站发送并保留媒体访问上下文，使 WhatsApp 文档和附件发送不再静默丢弃文件，同时仍传递标题。(#64478, #64492) 感谢 @ShionEria。 - **Microsoft Teams**：恢复个人 DM、Bot Framework `a:` 对话、OneDrive/SharePoint 共享文件和 Graph 支持的聊天 ID 的媒体下载；接受 Bot Framework 受众令牌；防止反馈学习文件名冲突；通过输入指示器保持长工具链活跃；添加 SSO 登录回调；为线程回复注入父上下文；并向 Teams 对话 ID 传递 cron 公告。(#54932, #55383, #55386, #58001, #58249, #58774, #59731, #60956, #62219, #62674, #63063, #63942, #63945, #63949, #63951, #63953, #64087, #64088, #64089) - **Gateway/tailscale**：在等待通道和插件边车启动之前开始 Tailscale 公开和网关更新检查，以便在启动边车停滞时远程操作员不会被锁定。 - **Gateway/startup**：在通道和插件边车启动期间保持 WebSocket RPC 可用，在启动边车完成前保持 `chat.history` 不可用，以便同步历史读取不会停滞启动（在 #63450 中报告），在延迟插件重新加载后刷新广告网关方法，并在无处理器 503 路径之前强制预认证 WebSocket 升级预算，以便升级洪水无法在该窗口期间绕过连接限制。(#63480) 感谢 @neeravmakwana。 - **WhatsApp**：在重连间隙期间，将入站回复、媒体、编写指示符和排队的出站传递保持附加到当前套接字，包括监听器返回后的新鲜重试合格发送。(#30806, #46299, #62892, #63916) 感谢 @mcaxtr。 - **Gateway/thread routing**：保留 Slack、Telegram、Mattermost、Matrix、ACP、重启哨兵和代理公告传递目标，以便子代理、cron、流中继、会话回退和重启消息返回到原始线程、主题或房间大小写。(#54840, #57056, #63143, #63228, #63506, #64343, #64391) - **Models/fallback**：在瞬态主模型故障和配置重新加载期间保留 `/models` 选择，允许超时冷却探测，分类 OpenRouter 无端点响应，检测 llama.cpp 上下文溢出，并在重新加载期间保持提供商/运行时上下文元数据稳定。(#61472, #64196, #64471) - **Agents/BTW**：在工具使用回合后通过剥离重放工具块、隐藏推理和格式错误的图像负载，省略空工具数组，允许 Bedrock `auth: "aws-sdk"`，以及通过有界带外通道路由 Feishu `/btw` 和 `/stop`，使 `/btw` 侧问题继续工作。(#64218, #64219, #64225, #64324) 感谢 @ngutman。 - **Control UI/BTW**：在浏览器中将 `/btw` 侧结果渲染为可关闭的临时卡片，在活动运行期间立即发送 `/btw`，并在重置流程中清除陈旧的 BTW 卡片，以便 webchat 匹配预期的分离侧问题行为。(#64290) 感谢 @ngutman。 - **Commands/targeting**：对命令输出、发送策略、使用/成本、上下文报告、模型列表、bash 沙箱提示、BTW/压缩工作目录、插件命令和会话导出使用选定的代理或会话，以便多代理命令描述和变更预期目标而不是请求者。 - **Conversation bindings**：规范化聚焦/当前对话 ID，在帐户和 Discord 重新绑定时保留绑定元数据，避免陈旧的 Discord 生命周期窗口，并保持通用活动触摸持久化，以便回复路由在重新绑定和重启后继续。(#61619, #63868, #63980, #63989, #64000) 感谢 @neeravmakwana。 - **iMessage/self-chat**：使用 `destination_caller_id` 加聊天参与者区分正常 DM 出站行与真实自聊，保留多处理程序自聊别名，删除模糊反射回声，并剥离包装的 imsg RPC 文本字段。(#61619, #63868, #63980, #63989, #64000) 感谢 @neeravmakwana。 - **Matrix**：保持多帐户房间范围一致，在适当时将打包的加密迁移保持为仅警告，保留有序块流，添加显式 Matrix 块流选择加入，并从打包运行时入口解决验证/引导。(#58449, #59249, #59266, #64373) 感谢 @gumadeiras。 - **Telegram/security**：收紧 Telegram `allowFrom` 发送者验证，并保持 `/whoami` 允许列表报告与命令授权检查同步。 - **Agents/timeouts**：将默认 LLM 空闲窗口延长到 120 秒，并在恢复路径上保持静默无令牌空闲超时，以便慢速模型可以在用户看到错误前重试或回退。 - **Gateway/agents**：在代理创建/更新流程和工作区移动期间保留配置的模型选择和更丰富的 `IDENTITY.md` 内容，并安全失败而不是静默覆盖不可读的身份文件。(#61577) 感谢 @samzong。 - **Skills/TaskFlow**：恢复捆绑的 `taskflow` 和 `taskflow-inbox-triage` 技能的有效 frontmatter 围栏，并将捆绑的 `SKILL.md` 文件复制为硬分发运行时副本，以便技能在更新后保持可发现和可加载。(#64166, #64469) 感谢 @extrasmall0。 - **Skills**：在加载个人技能时尊重覆盖的主目录，以便服务、测试和自定义启动环境读取预期的用户技能目录而不是进程主目录。 - **Windows/exec**：即使在 `close` 从未到达的情况下，也在 stdout 和 stderr 排出后解决子退出状态的监管等待，以便 CLI 命令在 Windows 上停止挂起或死于强制 `SIGKILL`。(#64072) 感谢 @obviyus。 - **Browser/sandbox**：通过浏览器安全哈希更改时重新创建容器以及等待正确的沙箱浏览器生命周期，防止沙箱浏览器 CDP 启动挂起。(#62873) 感谢 @Syysean。 - **QQBot/streaming**：通过 `streaming.mode`（`"partial"` | `"off"`，默认 `"partial"`）使块流对每个 QQ 机器人帐户可配置，而不是硬编码关闭，以便响应可以增量传递。(#63746) - **QQBot/config**：允许 `channels.qqbot` 和 `channels.qqbot.accounts.*` 中的额外字段，以便扩展的 qqbot 构建可以添加新配置选项，而不会因架构验证导致网关启动失败。(#64075) 感谢 @WideLee。 - **Dreaming/gateway**：对持久 `/dreaming on|off` 更改要求 `operator.admin`，并将缺少的网关客户端范围视为非特权而不是静默允许配置写入。(#63872) 感谢 @mbelinky。 - **Gateway/pairing**：优先选择显式 QR 引导身份验证而不是更早的 Tailscale 身份验证分类，以便 iOS `/pair qr` 静默引导配对不会降级到 `pairing required`。(#59232) 感谢 @ngutman。 - **Browser/control**：为 `none` 和 `trusted-proxy` 模式自动生成浏览器控制身份验证令牌，并通过公共浏览器插件外观路由浏览器身份验证/配置文件/医生助手。(#63280, #63957) 感谢 @pgondhi987。 - **Browser/act**：集中 `/act` 请求规范化和执行调度，同时添加稳定的机器可读路由级错误代码，用于无效请求、选择器误用、评估禁用门控、目标不匹配和现有会话不支持的操作。(#63977) 感谢 @joshavant。 - **Security/QQBot**：对所有出站本地文件路径强制执行媒体存储边界，并通过 SSRF 保护的媒体获取路由图像大小探测，而不是原始 `fetch()`。(#63271, #63495) 感谢 @pgondhi987。 - **Channel setup**：在解析受信任的通道设置目录条目时忽略工作区插件阴影，以便引导和设置流程继续使用捆绑的受信任设置合同。 - **Gateway/memory startup**：在网关启动期间加载显式选择的内存槽插件，同时保持限制性允许列表和隐式默认内存槽不自动启动不相关的内存插件。(#64423) 感谢 @EronFan。 - **Config/plugins**：让配置写入保留禁用的插件条目，而不强制要求插件配置架构或崩溃原始插件验证，并避免在架构检查期间重新激活插件注册表状态。(#54971, #63296) 感谢 @fuller-stack-dev。 - **Config validation**：在绑定中为严格架构联合失败暴露实际的有问题字段，包括匹配 ACP 分支上顶级意外键。(#40841) 感谢 @Hollychou924。 - **Wizard/plugin config**：从交互式文本输入强制转换整数类型的插件配置字段，以便整数架构值作为数字持久化，而不是验证失败。(#63346) 感谢 @jalehman。 - **Daemon/gateway install**：在强制重新安装时保留安全自定义服务环境变量，在托管服务 PATH 之后合并先前的自定义 PATH 段，并停止移除的托管环境键作为自定义携带者持久化。(#63136) 感谢 @WarrenJones。 - **Cron/scheduling**：在 cron 更新、维护、计时器和陈旧传递路径中将 `nextRunAtMs <= 0` 视为无效，以便损坏的零时间戳自我修复而不是导致立即运行或跳过传递。(#63507) 感谢 @WarrenJones。 - **Cron/auth**：为隔离的 cron 作业一致地解析身份验证配置文件，以便计划运行使用与交互式会话相同的配置提供商凭据。(#62797) 感谢 @neeravmakwana。 - **Tasks**：让 `openclaw tasks cancel` 取消从未达到正常终端状态的卡住后台任务。(#62506) 感谢 @neeravmakwana。 - **Sessions/model selection**：在目录元数据不可用时保留目录支持的会话模型标签、提供商限定的上下文限制和已经限定的会话模型引用，以便模型选择和内存/上下文预算在重新加载期间没有虚假提供商前缀的情况下继续。(#61382, #62493) 感谢 @Mule-ME。 - **Status**：在 `/status` 和共享会话状态卡片中显示配置的回退模型，以便在实时故障转移之前可以看到每代理回退配置。(#33111) 感谢 @AnCoSONG。 - **`/context detail`** 现在将跟踪的提示估计与缓存的上下文使用情况进行比较，并在存在时暴露未跟踪的提供商/运行时开销。(#28391) 感谢 @ImLukeF。 - **Gateway/sessions**：将裸 `sessions.create` 别名（如 `main`）范围限定到请求的代理，同时保留规范 `global` 和 `unknown` 哨兵键。(#58207) 感谢 @jalehman。 - **Gateway/session reset**：为网关 `/new` 和 `/reset` 发出类型化的 `before_reset` 钩子，即使先前转录已归档也保留重置钩子行为。(#53872) 感谢 @VACInc。 - **Plugins/commands**：将活动主机 `sessionKey` 传递到插件命令上下文，并在活动会话条目中已有 `sessionId` 时包含它，以便捆绑和第三方命令可以可靠地解析当前对话。(#59044) 感谢 @jalehman。 - **Agents/auth**：通过注入 `Authorization: Bearer <apiKey>` 来尊重 pi 嵌入式运行器模型请求的 `models.providers.*.authHeader`。(#54390) 感谢 @lndyzwdxhs。 - **Claude CLI**：在生成 Claude Code 之前清除继承的 Anthropic 身份验证/头环境别名，并添加消毒的 CLI 后端身份验证环境诊断以调试网关运行提供商选择。 - **Agents/failover**：将 AbortError 和流中止消息分类为超时，以便 Ollama NDJSON 流中止停止在模型回退日志中显示 `reason=unknown`。(#58324) 感谢 @yelog。 - **Fireworks/FirePass**：通过在 FirePass 路径上强制关闭思考并强化提供商包装器，禁用 Kimi K2.5 Turbo 推理输出，以便隐藏推理不再泄漏到可见回复中。(#63607) 感谢 @frankekn。 - **Discord**：将 Carbon 更新到 v0.15.0。感谢 @thewilloftheshadow。 - **Config/Discord**：在配置验证期间将安全整数数值 Discord ID 强制转换为字符串，拒绝不安全或精度丢失的数字雪花，并使 `openclaw doctor` 修复指导与相同的失败封闭行为一致。(#45125) 感谢 @moliendocode。 - **BlueBubbles/config**：接受核心严格配置架构中的 `enrichGroupParticipantsFromContacts`，以便网关在 BlueBubbles 插件写入该字段时不再失败验证或启动。(#56889) 感谢 @zqchris。 - **Feishu/webhooks**：通过预认证守卫读取 webhook 正文，以便未经身份验证的 webhook 流量保持在与其他受保护通道入口路径相同的正文预算下。 - **Tools/web_fetch**：添加可选的 `tools.web.fetch.ssrfPolicy.allowRfc2544BenchmarkRange` 配置，以便将公共站点解析为 `198.18.0.0/15` 的假 IP 代理环境可以使用 `web_fetch` 而不削弱默认 SSRF 阻止。(#61830) 感谢 @xing-xing-coder。 - **Dreaming/cron**：从启动配置和运行时生命周期变化协调管理的 dreaming cron，但仅在心跳触发的 dreaming 检查期间恢复管理的 dreaming cron 状态，以便普通聊天流量不会重新创建移除的作业。(#63873, #63929, #63938) 感谢 @mbelinky。 - **Memory/lancedb**：当 `memory-lancedb` 拥有内存槽时接受 `dreaming` 配置，以便 Dreaming 表面可以在没有架构拒绝的情况下读取槽所有者设置。(#63874) 感谢 @mbelinky。 - **Control UI/dreaming**：保持 Dreaming 跟踪区域包含和可滚动，以便叠加不再覆盖标签页或破坏页面布局。(#63875) 感谢 @mbelinky。 - **Dreaming/narrative**：强化请求作用域的日记回退，以便计划的 dreaming 仅在专用子代理运行时错误时回退，停止信任可欺骗的原始错误代码对象，并避免在本地回退写入失败时泄漏工作区路径。(#64156) 感谢 @mbelinky。 - **Dreaming/diary**：添加幂等叙述子代理运行，在原子写入期间保留限制性 `DREAMS.md` 权限，并暴露临时清理失败，以便重复扫描不会双重运行相同的叙述请求或静默削弱日记安全。(#63876) 感谢 @mbelinky。 - **Heartbeats/sessions**：当下一个刻度将它们收敛回规范兄弟时，移除陈旧的累积隔离心跳会话键，以便修复的会话停止在会话列表中显示孤立的 `:heartbeat:heartbeat` 变体。(#59606) 感谢 @rogerdigital。 - **Gateway/run cleanup**：修复陈旧的运行上下文 TTL 清理，以便新的维护扫描重置孤立的运行序列状态并防止无界的运行上下文增长。(#52731) 感谢 @artwalker。 - **UI/compaction**：在运行实际完成之前保持压缩指示器处于重试挂起状态，以便 UI 不会在实际压缩完成之前显示 `Context compacted`。(#55132) 感谢 @mpz4life。 - **Cron/tool schemas**：保持 cron 工具架构严格模型友好，同时仍然保留 `failureAlert=false`、可为空的 `agentId`/`sessionKey` 以及新暴露的 cron 作业字段的扁平化添加/更新恢复。(#55043) 感谢 @brunolorente。 - **Git metadata**：从打包的引用以及松散引用读取提交 ID，以便版本和状态元数据在仓库维护后保持准确。(#63943) - **Gateway**：保持 `commands.list` 技能条目分类在工具下，并在 `scope=text` 时包含提供商感知的插件 `nativeName` 元数据，以便远程客户端可以正确分组技能并将文本表面插件命令映射回原生别名。(#64147) - **TUI**：在切换会话时将页脚活动重置为空闲，以便陈旧的流式指示器在选择更改后不能持久。(#63988) 感谢 @neeravmakwana。 - **Claude CLI**：停止将生成的 Claude Code 运行标记为主机管理，以便它们继续使用正常的 CLI 订阅行为。(#64023) 感谢 @Alex-Alaniz。 - **Codex auth**：在用户可见的身份验证提示和诊断中将 Codex OAuth 流程品牌化为 OpenClaw。 - **Gateway/pairing**：对于没有设备令牌的配对设备记录失败封闭，并拒绝请求范围与请求设备角色不匹配的配对批准。 - **ACP/gateway chat**：在将生命周期错误转发到 ACP 客户端之前对其进行分类，以便拒绝使用 ACP 的拒绝停止原因，而瞬态后端错误继续作为正常回合完成。 - **Claude CLI/skills**：将符合条件的 OpenClaw 技能传递到 CLI 运行，包括通过临时插件和每运行技能环境/API 密钥注入的原生 Claude Code 技能解析。(#62686, #62723) 感谢 @zomars。 - **Discord**：通过为思考加可见标题文本提供足够的输出预算，使生成的自动线程名称与推理模型一起工作。(#64172) 感谢 @hanamizuki。 - **Heartbeat**：在默认 `HEARTBEAT.md` 模板中忽略仅文档 Markdown 围栏标记，以便仅注释的心跳脚手架再次跳过 API 调用。(#61690, #63434) 感谢 @ravyg。 - **Reply/skills**：在嵌入式回复运行期间保持解析的技能和内存秘密配置稳定，以便在网关已有实时环境时，次要技能设置中的原始 SecretRef 不再崩溃回复。(#64249) 感谢 @mbelinky。 - **Dreaming/startup**：在工作区钩子重新加载期间保持插件注册的启动钩子活跃，并将 dreaming 启动所有者包括在网关启动插件范围中，以便管理的 Dreaming cron 注册在网关启动后可靠返回。(#62327, #64258) 感谢 @mbelinky。 - **Plugins**：将来自同一插件 ID 的重复 `registerService` 调用视为幂等，以便快照和激活加载不再发出虚假的 `service already registered` 诊断。(#62033, #64128) 感谢 @ly85206559。 - **Discord/TTS**：通过原生语音笔记路径路由自动语音回复，以便 Discord 接收 Opus 语音消息而不是常规音频附件。(#64096) 感谢 @LiuHuaize。 - **Config/plugins**：当 `plugins.allow` 包含 `dreaming` 等运行时命令名称时使用插件拥有的命令别名元数据，并将用户指向拥有插件而不是陈旧的插件未找到指导。(#64191, #64242) 感谢 @feiskyer。 - **Agents/Gemini**：从 Gemini 工具架构中剥离孤立的 `required` 条目，以便提供商验证在架构清理或联合扁平化后不再拒绝工具。(#64284) 感谢 @xxxxxmax。 - **Assistant text**：从可见回复中剥离 Qwen 风格 XML 工具调用负载，以便 web 和频道消息不再显示原始 `<tool_call><function=...>` 输出。(#63999, #64214) 感谢 @MoerAI。 - **Daemon/gateway**：通过以 `EX_CONFIG` 退出并添加生成的单元重启预防保护，防止配置错误的 systemd 重启风暴。(#63913) 感谢 @neo1027144-creator。 - **Agents/exec**：防止网关崩溃（“Agent listener invoked outside active run”），当子代理执行工具在代理运行结束或中止后产生 stdout/stderr 时。(#62821) 感谢 @openperf。 - **Gateway/OpenAI compat**：为非流 `/v1/chat/completions` 响应返回真实 `usage`，在 `stream_options.include_usage=true` 时发出最终使用块，并在生命周期结束后绑定使用门控流完成。(#62986) 感谢 @Lellansin。 - **Agents/subagents**：去重传递的完成公告，以便重试或重新进入清理不会将重复的内部上下文完成回合注入父会话。(#61525) 感谢 @100yenadmin。 - **Agents/exec**：保持沙箱 `tools.exec.host=auto` 会话在沙箱运行时活动期间不遵守每调用 `host=node` 或 `host=gateway` 覆盖，并停止在该状态下广告节点路由，以便执行保持在沙箱主机上。(#63880) - **Agents/subagents**：保留存档删除模式运行直到 `sessions.delete` 成功，并防止重叠存档扫描重复进行中的清理尝试。(#61801) 感谢 @100yenadmin。 - **Cron/isolated agent**：作为非所有者发送者运行计划的代理回合，以便所有者专用工具在 cron 执行期间不可用。(#63878) - **Discord/sandbox**：在沙箱媒体参数规范化中包含 `image`，以便 Discord 事件封面图像不能绕过沙箱路径重写。(#64377) 感谢 @mmaps。 - **Agents/exec**：将执行完成检测扩展到本地后台执行格式，以便所有者降级对所有执行路径正确触发。(#64376) 感谢 @mmaps。 - **Hooks/security**：将代理钩子系统事件标记为不受信任，并在 cron 元数据重用之前清理钩子显示名称。(#64372) 感谢 @eleqtrizit。 - **Daemon/launchd**：保持 `openclaw gateway stop` 持久而不卸载 macOS LaunchAgent，在显式重启或修复时重新启用它，并强化 launchd 标签处理。(#64447) 感谢 @ngutman。 - **Plugins/context engines**：通过规范化保留 `plugins.slots.contextEngine` 并保持显式选择的工作区上下文引擎插件启用，以便加载器诊断和插件激活停止丢弃该槽选择。(#64192) 感谢 @hclsys。 - **Heartbeat**：停止默认 `HEARTBEAT.md` 模板中顶级 `interval:` 和 `prompt:` 字段渗入最后解析的心跳任务。(#64488) 感谢 @Rahulkumar070。 - **Agents/OpenAI replay**：在存储的助手历史中保留格式错误的函数调用参数，避免在重放时双重编码保留的原始字符串，并在 Anthropic 和 Google 提供商边界将重放的字符串参数强制回对象。(#61956) 感谢 @100yenadmin。 - **Heartbeat/config**：接受并遵守 `agents.defaults.heartbeat.timeoutSeconds` 和每代理心跳超时覆盖用于心跳代理回合。(#64491) 感谢 @cedillarack。 - **CLI/devices**：使隐式 `openclaw devices approve` 选择仅预览，并要求批准确切的请求 ID，防止设备配对期间的最新请求竞争。(#64160) 感谢 @coygeek。 - **Media/security**：遵守出站主机媒体读取的发送者范围 `toolsBySender` 策略，以便被拒绝的发送者不能通过附件水合触发主机文件泄露。(#64459) 感谢 @eleqtrizit。 - **Browser/security**：拒绝严格策略的主机名导航，除非主机名是显式允许列表例外或 IP 文字，并通过固定的 SSRF 获取路径路由 CDP HTTP 发现。(#64367) 感谢 @eleqtrizit。 - **Models/vLLM**：忽略推理模型 OpenAI 兼容回复中的空 `tool_calls` 数组，在没有实际工具调用解析时重置错误的 `toolUse` 停止原因，并且仅在存在工具时发送 `tool_choice`，以便 vLLM 推理响应不再无限挂起。(#61197, #61534) 感谢 @balajisiva。

## 2026.4.10 ### Changes - Models/Codex: add the bundled Codex provider and plugin-owned app-server harness so `codex/gpt-*` models use Codex-managed auth, native threads, model discovery, and compaction while `openai/gpt-*` stays on the normal OpenAI provider path. (#64298) - Memory/Active Memory: add a new optional Active Memory plugin that gives OpenClaw a dedicated memory sub-agent right before the main reply, so ongoing chats can automatically pull in relevant preferences, context, and past details without making users remember to manually say "remember this" or "search memory" first. Includes configurable message/recent/full context modes, live `/verbose` inspection, advanced prompt/thinking overrides for tuning, and opt-in transcript persistence for debugging. Docs: https://docs.openclaw.ai/concepts/active-memory. (#63286) Thanks @Takhoffman. - macOS/Talk: add an experimental local MLX speech provider for Talk Mode, with explicit provider selection, local utterance playback, interruption handling, and system-voice fallback. (#63539) Thanks @ImLukeF. - Tools/video generation: add Seedance 2.0 model refs to the bundled fal provider and submit the provider-specific duration, resolution, audio, and seed metadata fields needed for live Seedance 2.0 runs. - Microsoft Teams: add message actions for pin, unpin, read, react, and listing reactions. (#53432) Thanks @sudie-codes. - QA/Matrix: add a live `openclaw qa matrix` lane backed by a disposable Matrix homeserver, shared live-transport seams, and Matrix-specific transport coverage for threading, reactions, restart, and allowlist behavior. (#64489) Thanks @gumadeiras. - QA/Telegram: add a live `openclaw qa telegram` lane for private-group bot-to-bot checks, harden its artifact handling, and preserve native Telegram command reply threading for QA verification. (#64303) Thanks @obviyus. - QA/testing: add a `--runner multipass` lane for `openclaw qa suite` so repo-backed QA scenarios can run inside a disposable Linux VM and write back the usual report, summary, and VM logs. (#63426) Thanks @shakkernerd. - CLI/exec policy: add a local `openclaw exec-policy` command with `show`, `preset`, and `set` subcommands for synchronizing requested `tools.exec.*` config with the local exec approvals file, plus follow-up hardening for node-host rejection, rollback safety, and sync conflict detection. (#64050) - Gateway: add a `commands.list` RPC so remote gateway clients can discover runtime-native, text, skill, and plugin commands with surface-aware naming and serialized argument metadata. (#62656) Thanks @samzong. - Models/providers: add per-provider `models.providers.*.request.allowPrivateNetwork` for trusted self-hosted OpenAI-compatible endpoints, keep the opt-in scoped to model request surfaces, and refresh cached WebSocket managers when request transport overrides change. (#63671) Thanks @qas. - Feishu: standardize request user agents and register the bot as an AI agent so Feishu deployments identify OpenClaw consistently. (#63835) Thanks @evandance. - Matrix/partial streaming: add MSC4357 live markers to draft preview sends and edits so supporting Matrix clients can render a live/typewriter animation and stop it when the final edit lands. (#63513) Thanks @TigerInYourDream. - Control UI/dreaming: simplify the Scene and Diary surfaces, preserve unknown phase state for partial status payloads, and stabilize waiting-entry recency ordering so Dreaming status and review lists stay clear and deterministic. (#64035) Thanks @davemorin. - Agents: add an opt-in strict-agentic embedded Pi execution contract for GPT-5-family runs so plan-only or filler turns keep acting until they hit a real blocker. (#64241) Thanks @100yenadmin. - Agents/OpenAI: add provider-owned OpenAI/Codex tool schema compatibility and surface embedded-run replay/liveness state for long-running runs. (#64300) Thanks @100yenadmin. - Docs i18n: chunk raw doc translation, reject truncated tagged outputs, avoid ambiguous body-only wrapper unwrapping, and recover from terminated Pi translation sessions without changing the default `openai/gpt-5.4` path. (#62969, #63808) Thanks @hxy91819. ### Fixes - Browser/security: tighten browser and sandbox navigation defenses across strict SSRF defaults, hostname allowlists, interaction-driven redirects, subframes, CDP discovery, existing sessions, tab actions, noVNC, marker-span sanitization, and Docker CDP source-range enforcement. (#61404, #63332, #63882, #63885, #63889, #64367, #64370, #64371) - Security/tools: harden exec preflight reads, host env denylisting, node output boundaries, outbound host-media reads, profile-mutation authorization, plugin install dependency scanning, ACPX tool hooks, Gmail watcher token redaction, and oversized realtime WebSocket frame handling. (#62333, #62661, #62662, #63277, #63551, #63553, #63886, #63890, #63891, #64459) - OpenAI/Codex: add required Codex OAuth scopes, classify provider/runtime failures more clearly, stop suggesting `/elevated full` when auto-approved host exec is unavailable, add OpenAI/Codex tool-schema compatibility, and preserve embedded-run replay/liveness truth across compaction retries and mutating side effects. (#64300, #64439) Thanks @100yenadmin. - CLI/WhatsApp media sends: route gateway-mode outbound sends with `--media` through the channel `sendMedia` path and preserve media access context, so WhatsApp document and attachment sends stop silently dropping the file while still delivering the caption. (#64478, #64492) Thanks @ShionEria. - Microsoft Teams: restore media downloads for personal DMs, Bot Framework `a:` conversations, OneDrive/SharePoint shared files, and Graph-backed chat IDs; accept Bot Framework audience tokens; prevent feedback-learning filename collisions; keep long tool chains alive with typing indicators; add SSO sign-in callbacks; inject parent context for thread replies; and deliver cron announcements to Teams conversation IDs. (#54932, #55383, #55386, #58001, #58249, #58774, #59731, #60956, #62219, #62674, #63063, #63942, #63945, #63949, #63951, #63953, #64087, #64088, #64089) - Gateway/tailscale: start Tailscale exposure and the gateway update check before awaiting channel and plugin sidecar startup so remote operators are not locked out when startup sidecars stall. - Gateway/startup: keep WebSocket RPC available while channels and plugin sidecars start, hold `chat.history` unavailable until startup sidecars finish so synchronous history reads cannot stall startup (reported in #63450), refresh advertised gateway methods after deferred plugin reloads, and enforce the pre-auth WebSocket upgrade budget before the no-handler 503 path so upgrade floods cannot bypass connection limits during that window. (#63480) Thanks @neeravmakwana. - WhatsApp: keep inbound replies, media, composing indicators, and queued outbound deliveries attached to the current socket across reconnect gaps, including fresh retry-eligible sends after the listener comes back. (#30806, #46299, #62892, #63916) Thanks @mcaxtr. - Gateway/thread routing: preserve Slack, Telegram, Mattermost, Matrix, ACP, restart-sentinel, and agent announce delivery targets so subagent, cron, stream-relay, session fallback, and restart messages land back in the originating thread, topic, or room casing. (#54840, #57056, #63143, #63228, #63506, #64343, #64391) - Models/fallback: preserve `/models` selection across transient primary-model failures and config reloads, allow timeout cooldown probes, classify OpenRouter no-endpoints responses, detect llama.cpp context overflows, and keep provider/runtime context metadata stable through reloads. (#61472, #64196, #64471) - Agents/BTW: keep `/btw` side questions working after tool-use turns by stripping replayed tool blocks, hidden reasoning, and malformed image payloads, omitting empty tool arrays, allowing Bedrock `auth: "aws-sdk"`, and routing Feishu `/btw` plus `/stop` through bounded out-of-band lanes. (#64218, #64219, #64225, #64324) Thanks @ngutman. - Control UI/BTW: render `/btw` side results as dismissible ephemeral cards in the browser, send `/btw` immediately during active runs, and clear stale BTW cards on reset flows so webchat matches the intended detached side-question behavior. (#64290) Thanks @ngutman. - Commands/targeting: use the selected agent or session for command output, send policy, usage/cost, context reports, model lists, bash sandbox hints, BTW/compact working directories, plugin commands, and session exports so multi-agent commands describe and mutate the intended target instead of the requester. - Conversation bindings: normalize focused/current conversation ids, preserve binding metadata on account and Discord rebinds, avoid stale Discord lifecycle windows, and keep generic activity touches persisted so reply routing survives rebinds and restarts. - iMessage/self-chat: distinguish normal DM outbound rows from true self-chat using `destination_caller_id` plus chat participants, preserve multi-handle self-chat aliases, drop ambiguous reflected echoes, and strip wrapped imsg RPC text fields. (#61619, #63868, #63980, #63989, #64000) Thanks @neeravmakwana. - Matrix: keep multi-account room scoping consistent, keep packaged crypto migrations warning-only when appropriate, preserve ordered block streaming, add explicit Matrix block-streaming opt-in, and resolve verification/bootstrap from the packaged runtime entry. (#58449, #59249, #59266, #64373) Thanks @gumadeiras. - Telegram/security: tighten Telegram `allowFrom` sender validation and keep `/whoami` allowlist reporting in sync with command auth checks. - Agents/timeouts: extend the default LLM idle window to 120s and keep silent no-token idle timeouts on recovery paths, so slow models can retry or fall back before users see an error. - Gateway/agents: preserve configured model selection and richer `IDENTITY.md` content across agent create/update flows and workspace moves, and fail safely instead of silently overwriting unreadable identity files. (#61577) Thanks @samzong. - Skills/TaskFlow: restore valid frontmatter fences for the bundled `taskflow` and `taskflow-inbox-triage` skills and copy bundled `SKILL.md` files as hard dist-runtime copies so skills stay discoverable and loadable after updates. (#64166, #64469) Thanks @extrasmall0. - Skills: respect overridden home directories when loading personal skills so service, test, and custom launch environments read the intended user skill directory instead of the process home. - Windows/exec: settle supervisor waits from child exit state after stdout and stderr drain even when `close` never arrives, so CLI commands stop hanging or dying with forced `SIGKILL` on Windows. (#64072) Thanks @obviyus. - Browser/sandbox: prevent sandbox browser CDP startup hangs by recreating containers when the browser security hash changes and by waiting on the correct sandbox browser lifecycle. (#62873) Thanks @Syysean. - QQBot/streaming: make block streaming configurable per QQ bot account via `streaming.mode` (`"partial"` | `"off"`, default `"partial"`) instead of hardcoding it off, so responses can be delivered incrementally. (#63746) - QQBot/config: allow extra fields in `channels.qqbot` and `channels.qqbot.accounts.*` so extended qqbot builds can add new config options without gateway startup failing on schema validation. (#64075) Thanks @WideLee. - Dreaming/gateway: require `operator.admin` for persistent `/dreaming on|off` changes and treat missing gateway client scopes as unprivileged instead of silently allowing config writes. (#63872) Thanks @mbelinky. - Gateway/pairing: prefer explicit QR bootstrap auth over earlier Tailscale auth classification so iOS `/pair qr` silent bootstrap pairing does not fall through to `pairing required`. (#59232) Thanks @ngutman. - Browser/control: auto-generate browser-control auth tokens for `none` and `trusted-proxy` modes, and route browser auth/profile/doctor helpers through the public browser plugin facades. (#63280, #63957) Thanks @pgondhi987. - Browser/act: centralize `/act` request normalization and execution dispatch while adding stable machine-readable route-level error codes for invalid requests, selector misuse, evaluate-disabled gating, target mismatch, and existing-session unsupported actions. (#63977) Thanks @joshavant. - Security/QQBot: enforce media storage boundaries for all outbound local file paths and route image-size probes through SSRF-guarded media fetching instead of raw `fetch()`. (#63271, #63495) Thanks @pgondhi987. - Channel setup: ignore workspace plugin shadows when resolving trusted channel setup catalog entries so onboarding and setup flows keep using the bundled, trusted setup contract. - Gateway/memory startup: load the explicitly selected memory-slot plugin during gateway startup, while keeping restrictive allowlists and implicit default memory slots from auto-starting unrelated memory plugins. (#64423) Thanks @EronFan. - Config/plugins: let config writes keep disabled plugin entries without forcing required plugin config schemas or crashing raw plugin validation, and avoid re-activating plugin registry state during schema checks. (#54971, #63296) Thanks @fuller-stack-dev. - Config validation: surface the actual offending field for strict-schema union failures in bindings, including top-level unexpected keys on the matching ACP branch. (#40841) Thanks @Hollychou924. - Wizard/plugin config: coerce integer-typed plugin config fields from interactive text input so integer schema values persist as numbers instead of failing validation. (#63346) Thanks @jalehman. - Daemon/gateway install: preserve safe custom service env vars on forced reinstall, merge prior custom PATH segments behind the managed service PATH, and stop removed managed env keys from persisting as custom carryover. (#63136) Thanks @WarrenJones. - Cron/scheduling: treat `nextRunAtMs <= 0` as invalid across cron update, maintenance, timer, and stale-delivery paths so corrupted zero timestamps self-heal instead of causing immediate runs or skipped deliveries. (#63507) Thanks @WarrenJones. - Cron/auth: resolve auth profiles consistently for isolated cron jobs so scheduled runs use the same configured provider credentials as interactive sessions. (#62797) Thanks @neeravmakwana. - Tasks: let `openclaw tasks cancel` cancel stuck background tasks that never reached a normal terminal state. (#62506) Thanks @neeravmakwana. - Sessions/model selection: preserve catalog-backed session model labels, provider-qualified context limits, and already-qualified session model refs when catalog metadata is unavailable, so model selection and memory/context budgets survive reloads without bogus provider prefixes. (#61382, #62493) Thanks @Mule-ME. - Status: show configured fallback models in `/status` and shared session status cards so per-agent fallback configuration is visible before a live failover happens. (#33111) Thanks @AnCoSONG. - `/context detail` now compares the tracked prompt estimate with cached context usage and surfaces untracked provider/runtime overhead when present. (#28391) Thanks @ImLukeF. - Gateway/sessions: scope bare `sessions.create` aliases like `main` to the requested agent while preserving the canonical `global` and `unknown` sentinel keys. (#58207) Thanks @jalehman. - Gateway/session reset: emit the typed `before_reset` hook for gateway `/new` and `/reset`, preserving reset-hook behavior even when the previous transcript has already been archived. (#53872) Thanks @VACInc. - Plugins/commands: pass the active host `sessionKey` into plugin command contexts, and include `sessionId` when it is already available from the active session entry, so bundled and third-party commands can resolve the current conversation reliably. (#59044) Thanks @jalehman. - Agents/auth: honor `models.providers.*.authHeader` for pi embedded runner model requests by injecting `Authorization: Bearer <apiKey>` when requested. (#54390) Thanks @lndyzwdxhs. - Claude CLI: clear inherited Anthropic auth/header environment aliases before spawning Claude Code and add sanitized CLI backend auth-env diagnostics for debugging gateway-run provider selection. - Agents/failover: classify AbortError and stream-abort messages as timeout so Ollama NDJSON stream aborts stop showing `reason=unknown` in model fallback logs. (#58324) Thanks @yelog. - Fireworks/FirePass: disable Kimi K2.5 Turbo reasoning output by forcing thinking off on the FirePass path and hardening the provider wrapper so hidden reasoning no longer leaks into visible replies. (#63607) Thanks @frankekn. - Discord: update Carbon to v0.15.0. Thanks @thewilloftheshadow. - Config/Discord: coerce safe integer numeric Discord IDs to strings during config validation, keep unsafe or precision-losing numeric snowflakes rejected, and align `openclaw doctor` repair guidance with the same fail-closed behavior. (#45125) Thanks @moliendocode. - BlueBubbles/config: accept `enrichGroupParticipantsFromContacts` in the core strict config schema so gateways no longer fail validation or startup when the BlueBubbles plugin writes that field. (#56889) Thanks @zqchris. - Feishu/webhooks: read webhook bodies through the pre-auth guard so unauthenticated webhook traffic stays under the same body budget as other protected channel ingress paths. - Tools/web_fetch: add an opt-in `tools.web.fetch.ssrfPolicy.allowRfc2544BenchmarkRange` config so fake-IP proxy environments that resolve public sites into `198.18.0.0/15` can use `web_fetch` without weakening the default SSRF block. (#61830) Thanks @xing-xing-coder. - Dreaming/cron: reconcile managed dreaming cron from startup config and runtime lifecycle changes, but only recover managed dreaming cron state during heartbeat-triggered dreaming checks so ordinary chat traffic does not recreate removed jobs. (#63873, #63929, #63938) Thanks @mbelinky. - Memory/lancedb: accept `dreaming` config when `memory-lancedb` owns the memory slot so Dreaming surfaces can read slot-owner settings without schema rejection. (#63874) Thanks @mbelinky. - Control UI/dreaming: keep the Dreaming trace area contained and scrollable so overlays no longer cover tabs or blow out the page layout. (#63875) Thanks @mbelinky. - Dreaming/narrative: harden request-scoped diary fallback so scheduled dreaming only falls back on the dedicated subagent-runtime error, stop trusting spoofable raw error-code objects, and avoid leaking workspace paths when local fallback writes fail. (#64156) Thanks @mbelinky. - Dreaming/diary: add idempotent narrative subagent runs, preserve restrictive `DREAMS.md` permissions during atomic writes, and surface temp cleanup failures so repeated sweeps do not double-run the same narrative request or silently weaken diary safety. (#63876) Thanks @mbelinky. - Heartbeats/sessions: remove stale accumulated isolated heartbeat session keys when the next tick converges them back to the canonical sibling, so repaired sessions stop showing orphaned `:heartbeat:heartbeat` variants in session listings. (#59606) Thanks @rogerdigital. - Gateway/run cleanup: fix stale run-context TTL cleanup so the new maintenance sweep resets orphaned run sequence state and prevents unbounded run-context growth. (#52731) Thanks @artwalker. - UI/compaction: keep the compaction indicator in a retry-pending state until the run actually finishes, so the UI does not show `Context compacted` before compaction actually finishes. (#55132) Thanks @mpz4life. - Cron/tool schemas: keep cron tool schemas strict-model-friendly while still preserving `failureAlert=false`, nullable `agentId`/`sessionKey`, and flattened add/update recovery for the newly exposed cron job fields. (#55043) Thanks @brunolorente. - Git metadata: read commit ids from packed refs as well as loose refs so version and status metadata stay accurate after repository maintenance. (#63943) - Gateway: keep `commands.list` skill entries categorized under tools and include provider-aware plugin `nativeName` metadata even when `scope=text`, so remote clients can group skills correctly and map text-surface plugin commands back to native aliases. (#64147) - TUI: reset footer activity to idle when switching sessions so a stale streaming indicator cannot persist after the selection changes. (#63988) Thanks @neeravmakwana. - Claude CLI: stop marking spawned Claude Code runs as host-managed so they keep using normal CLI subscription behavior. (#64023) Thanks @Alex-Alaniz. - Codex auth: brand Codex OAuth flows as OpenClaw in user-visible auth prompts and diagnostics. - Gateway/pairing: fail closed for paired device records that have no device tokens, and reject pairing approvals whose requested scopes do not match the requested device roles. - ACP/gateway chat: classify lifecycle errors before forwarding them to ACP clients so refusals use ACP's refusal stop reason while transient backend errors continue to finish as normal turns. - Claude CLI/skills: pass eligible OpenClaw skills into CLI runs, including native Claude Code skill resolution via a temporary plugin plus per-run skill env/API key injection. (#62686, #62723) Thanks @zomars. - Discord: keep generated auto-thread names working with reasoning models by giving title generation enough output budget for thinking plus visible title text. (#64172) Thanks @hanamizuki. - Heartbeat: ignore doc-only Markdown fence markers in the default `HEARTBEAT.md` template so comment-only heartbeat scaffolds skip API calls again. (#61690, #63434) Thanks @ravyg. - Reply/skills: keep resolved skill and memory secret config stable through embedded reply runs so raw SecretRefs in secondary skill settings no longer crash replies when the gateway already has the live env. (#64249) Thanks @mbelinky. - Dreaming/startup: keep plugin-registered startup hooks alive across workspace hook reloads and include dreaming startup owners in the gateway startup plugin scope, so managed Dreaming cron registration comes back reliably after gateway boot. (#62327, #64258) Thanks @mbelinky. - Plugins: treat duplicate `registerService` calls from the same plugin id as idempotent so snapshot and activation loads no longer emit spurious `service already registered` diagnostics. (#62033, #64128) Thanks @ly85206559. - Discord/TTS: route auto voice replies through the native voice-note path so Discord receives Opus voice messages instead of regular audio attachments. (#64096) Thanks @LiuHuaize. - Config/plugins: use plugin-owned command alias metadata when `plugins.allow` contains runtime command names like `dreaming`, and point users at the owning plugin instead of stale plugin-not-found guidance. (#64191, #64242) Thanks @feiskyer. - Agents/Gemini: strip orphaned `required` entries from Gemini tool schemas so provider validation no longer rejects tools after schema cleanup or union flattening. (#64284) Thanks @xxxxxmax. - Assistant text: strip Qwen-style XML tool call payloads from visible replies so web and channel messages no longer show raw `<tool_call><function=...>` output. (#63999, #64214) Thanks @MoerAI. - Daemon/gateway: prevent systemd restart storms on configuration errors by exiting with `EX_CONFIG` and adding generated unit restart-prevention guards. (#63913) Thanks @neo1027144-creator. - Agents/exec: prevent gateway crash ("Agent listener invoked outside active run") when a subagent exec tool produces stdout/stderr after the agent run has ended or been aborted. (#62821) Thanks @openperf. - Gateway/OpenAI compat: return real `usage` for non-stream `/v1/chat/completions` responses, emit the final usage chunk when `stream_options.include_usage=true`, and bound usage-gated stream finalization after lifecycle end. (#62986) Thanks @Lellansin. - Agents/subagents: deduplicate delivered completion announces so retry or re-entry cleanup does not inject duplicate internal-context completion turns into the parent session. (#61525) Thanks @100yenadmin. - Agents/exec: keep sandboxed `tools.exec.host=auto` sessions from honoring per-call `host=node` or `host=gateway` overrides while a sandbox runtime is active, and stop advertising node routing in that state so exec stays on the sandbox host. (#63880) - Agents/subagents: preserve archived delete-mode runs until `sessions.delete` succeeds and prevent overlapping archive sweeps from duplicating in-flight cleanup attempts. (#61801) Thanks @100yenadmin. - Cron/isolated agent: run scheduled agent turns as non-owner senders so owner-only tools stay unavailable during cron execution. (#63878) - Discord/sandbox: include `image` in sandbox media param normalization so Discord event cover images cannot bypass sandbox path rewriting. (#64377) Thanks @mmaps. - Agents/exec: extend exec completion detection to cover local background exec formats so the owner-downgrade fires correctly for all exec paths. (#64376) Thanks @mmaps. - Hooks/security: mark agent hook system events as untrusted and sanitize hook display names before cron metadata reuse. (#64372) Thanks @eleqtrizit. - Daemon/launchd: keep `openclaw gateway stop` persistent without uninstalling the macOS LaunchAgent, re-enable it on explicit restart or repair, and harden launchd label handling. (#64447) Thanks @ngutman. - Plugins/context engines: preserve `plugins.slots.contextEngine` through normalization and keep explicitly selected workspace context-engine plugins enabled, so loader diagnostics and plugin activation stop dropping that slot selection. (#64192) Thanks @hclsys. - Heartbeat: stop top-level `interval:` and `prompt:` fields outside the `tasks:` block from bleeding into the last parsed heartbeat task. (#64488) Thanks @Rahulkumar070. - Agents/OpenAI replay: preserve malformed function-call arguments in stored assistant history, avoid double-encoding preserved raw strings on replay, and coerce replayed string args back to objects at Anthropic and Google provider boundaries. (#61956) Thanks @100yenadmin. - Heartbeat/config: accept and honor `agents.defaults.heartbeat.timeoutSeconds` and per-agent heartbeat timeout overrides for heartbeat agent turns. (#64491) Thanks @cedillarack. - CLI/devices: make implicit `openclaw devices approve` selection preview-only and require approving the exact request ID, preventing latest-request races during device pairing. (#64160) Thanks @coygeek. - Media/security: honor sender-scoped `toolsBySender` policy for outbound host-media reads so denied senders cannot trigger host file disclosure via attachment hydration. (#64459) Thanks @eleqtrizit. - Browser/security: reject strict-policy hostname navigation unless the hostname is an explicit allowlist exception or IP literal, and route CDP HTTP discovery through the pinned SSRF fetch path. (#64367) Thanks @eleqtrizit. - Models/vLLM: ignore empty `tool_calls` arrays from reasoning-model OpenAI-compatible replies, reset false `toolUse` stop reasons when no actual tool calls were parsed, and stop sending `tool_choice` unless tools are present so vLLM reasoning responses no longer hang indefinitely. (#61197, #61534) Thanks @balajisiva.