OpenClaw v2026.4.14-beta.1

### 变更 - Telegram/论坛主题：通过从 Telegram 论坛服务消息中学习主题名称，在代理上下文、提示词元数据和插件钩子元数据中展示人类可读的主题名称。（#65973）感谢 @ptahdunbar。 ### 修复 - UI/聊天：使用 markdown-it 替换 marked.js，使恶意构造的 Markdown 无法再通过 ReDoS 冻结控制 UI。（#46707）感谢 @zhangfnf。 - 自动回复/发送策略：保持 `sendPolicy: "deny"` 不阻止入站消息处理，使代理仍能执行本轮处理，同时抑制所有出站投递，以支持观察者模式的部署。（#65461、#53328）感谢 @omarshahine。 - BlueBubbles：当请求了回复线程或消息效果但状态未知时，在发送时延迟刷新 Private API 服务器信息缓存，使 10 分钟缓存过期后发送不再静默降级为普通消息。（#65447、#43764）感谢 @omarshahine。 - 心跳/安全性：强制降低不受信任的 `hook:wake` 系统事件的所有者权限 [AI 辅助]。（#66031）感谢 @pgondhi987。 - 浏览器/安全性：在 snapshot、screenshot 和 tab 路由上强制执行 SSRF 策略 [AI]。（#66040）感谢 @pgondhi987。 - Microsoft Teams/安全性：在 SSO signin 调用上强制执行发送者允许列表检查 [AI]。（#66033）感谢 @pgondhi987。 - 配置/安全性：在 `redactConfigSnapshot` 中对 `sourceConfig` 和 `runtimeConfig` 别名字段进行脱敏 [AI]。（#66030）感谢 @pgondhi987。 - 代理/上下文引擎：将选择启用的回合维护作为具备空闲感知能力的后台工作运行，使下一次前台回合不再等待主动维护完成。（#65233）感谢 @100yenadmin。 - 插件/状态：`plugins inspect` 现在报告已注册的上下文引擎 ID，而不是所属插件 ID，使非匹配的引擎 ID 和多引擎插件能够被正确分类。（#58766）感谢 @zhuisDEV。 - 上下文引擎：拒绝已解析但其 `info.id` 与已注册槽位 ID 不匹配的插件引擎，使格式错误的引擎能够在基于 ID 的运行时分支出现异常前快速失败。（#63222）感谢 @fuller-stack-dev。 - WhatsApp：在 OpenClaw postinstall 期间修补已安装的 Baileys 媒体加密写入逻辑，使默认的 npm/install.sh 投递路径等待加密媒体文件完成刷新后再读取，避免发送图片时出现暂时性的 `ENOENT` 崩溃。（#65896）感谢 @frankekn。 - 网关/更新：围绕规范的捆绑网关入口点统一服务入口解析，使更新、重新安装和 doctor 修复不再在过时的 `dist/entry.js` 与当前的 `dist/index.js` 路径之间产生偏差。（#65984）感谢 @mbelinky。 - 心跳/Telegram 主题：当 `target=last` 时，将隔离的心跳回复保留在绑定的论坛主题中，而不是丢入群组根聊天。（#66035）感谢 @mbelinky。 - 浏览器/CDP：允许受管理的本地 Chrome 就绪检查、状态探测以及受管理的回环 CDP 控制绕过针对其自身回环控制平面的浏览器 SSRF 策略，使 OpenClaw 不再将健康的子浏览器误判为“启动后仍无法访问”。（#65695、#66043）感谢 @mbelinky。 - 网关/会话：阻止心跳、cron-event 和 exec-event 回合覆盖共享会话的路由和来源元数据，防止合成的 `heartbeat` 目标污染后续 cron 或用户投递。（#66073、#63733、#35300）感谢 @mbelinky。 - 浏览器/CDP：允许本地仅附加的 `manual-cdp` 配置在严格默认策略和远程类别探测超时下复用本地回环 CDP 控制平面，使 tabs/snapshot 不再错误地将正在运行的本地浏览器会话报告为未运行。（#65611、#66080）感谢 @mbelinky。 - Cron/调度器：当 cron 下一次运行时间的计算未返回有效的未来时间点时，停止生成短重试；同时保持维护唤醒处于启用状态，使已启用但未排期的任务能够恢复，而不会进入重复触发循环。（#66019、#66083）感谢 @mbelinky。 - Cron/调度器：当维护修复重新计算缺失的 cron 下一次运行时间时，保留当前有效的错误退避下限，避免发生暂时性的下一次运行时间解析失败后，持续出错的任务过早恢复。（#66019、#66083、#66113）感谢 @mbelinky。 - 出站/投递队列：在排队的投递条目中持久化发起该出站操作的 `session` 上下文，并在恢复时重放该上下文，使通过预写日志排队的发送在重启后仍保留原始出站媒体策略上下文，而不是针对缺失的会话进行评估。（#66025）感谢 @eleqtrizit。 - 自动回复/队列：按照每条消息的授权上下文（发送者 ID、所有者状态、exec/bash 提权覆盖设置），将收集模式的后续消息排空拆分为连续分组，使来自不同发送者或不同 exec 配置的排队项目不再使用最后一次排队运行的仅所有者和 exec 审批上下文执行。（#66024）感谢 @eleqtrizit。 - Dreaming/核心记忆：要求存在一个正在排队的 Dreaming cron 事件后，心跳钩子才运行清理；这样，受管理的 Dreaming 不会在计划运行已被消费后，于后续心跳中重复执行。（#66139）感谢 @mbelinky。 - 控制 UI/Dreaming：当插件未启用时，阻止 Imported Insights 和 Memory Palace 调用可选的 `memory-wiki` 网关方法；并在 wiki 重新加载前刷新配置，使 Dreaming 标签页不再显示误导性的未知方法错误。（#66140）感谢 @mbelinky。 - 代理/工具：只有当流式消息确实将某个工具分类为不可用时，才将流式未知工具重试标记为已计数；同时避免在最终 assistant 消息到达前，让不完整的流式工具名称重置重试连续计数。（#66145）感谢 @dutifulbob。 - 记忆/主动记忆：将召回的记忆移至隐藏的不受信任提示词前缀路径，而不是注入系统提示词；为可见的 Active Memory 状态行字段添加标签；并在网关调试日志中记录解析后的召回提供商/模型，使跟踪和调试输出与模型实际看到的内容保持一致。（#66144）感谢 @Takhoffman。 - 记忆/QMD：不再将旧版小写的 `memory.md` 视为第二个默认根集合，使 QMD 召回不再搜索虚假的 `memory-alt-*` 集合，并保持内置根记忆与 QMD 根记忆回退逻辑一致。（#66141）感谢 @mbelinky。 - 代理/OpenAI：将 `minimal` 思考级别映射为 OpenAI 对 GPT-5.4 请求支持的 `low` 推理强度，使嵌入式运行不再因请求校验失败而报错。感谢 @steipete。 - 语音通话/媒体流：当配置了 `webhookSecurity.trustForwardingHeaders` 和 `trustedProxyIPs` 时，从受信任的转发标头解析源 IP，用于按 IP 限制待处理连接数；同时为正在进行的 WebSocket 升级预留 `maxConnections` 容量，使并发握手不再短暂超过操作员设置的上限。（#66027）感谢 @eleqtrizit。 - Feishu/允许列表：按照明确的 `user`/`chat` 类型规范化允许列表条目，去除重复的 `feishu:`/`lark:` 提供商前缀，并停止将不透明的 Feishu ID 转为小写，使允许列表匹配不再跨越用户/聊天命名空间，也不会扩大为操作员未预期的不区分大小写 ID 匹配。（#66021）感谢 @eleqtrizit。 - TTS/回复媒体：将 OpenClaw 的临时语音输出持久化到受管理的出站媒体中，并允许其通过回复媒体规范化流程，使语音消息回复不再被静默丢弃。（#63511）感谢 @jetd1。 - 代理/工具：在解析沙箱和读取工具路径时，将 Windows 驱动器盘符路径（`C:\\...`）视为绝对路径，使工作区根目录不会按照 POSIX 路径规则被错误地追加。（#54039）感谢 @ly85206559 和 @vincentkoc。 - 代理/OpenAI：当仅包含推理或为空的回合需要有限的继续执行时，恢复嵌入式 GPT 风格运行；同时加入可安全重放的重试门控，并在没有可见答案时回退处理不完整回合。（#66167）感谢 @jalehman。 - 出站/中继状态：在发送到频道前，抑制内部中继状态占位内容（`No channel reply.`、`Replied in-thread.`、`Replied in #...`，以及以 `No channel reply.` 结尾的 wiki 更新状态变体），避免内部维护文本泄漏给用户。 - Slack/doctor：增加专用的 doctor 合约旁路，使 `openclaw cron` 等配置预热路径不再回退到 Slack 更广泛的合约表面；在受影响的配置中，这种回退可能触发与 Slack 相关的配置读取崩溃。（#63192）感谢 @shhtheonlyperson。 - 钩子/会话记忆：将解析后的代理工作区传入网关 `/new` 和 `/reset` 会话记忆钩子，使重置快照保持在正确的代理工作区范围内，而不会泄漏到默认工作区。（#64735）感谢 @suboss87 和 @vincentkoc。

### Changes - Telegram/forum topics: surface human topic names in agent context, prompt metadata, and plugin hook metadata by learning names from Telegram forum service messages. (#65973) Thanks @ptahdunbar. ### Fixes - UI/chat: replace marked.js with markdown-it so maliciously crafted markdown can no longer freeze the Control UI via ReDoS. (#46707) Thanks @zhangfnf. - Auto-reply/send policy: keep `sendPolicy: "deny"` from blocking inbound message processing, so the agent still runs its turn while all outbound delivery is suppressed for observer-style setups. (#65461, #53328) Thanks @omarshahine. - BlueBubbles: lazy-refresh the Private API server-info cache on send when reply threading or message effects are requested but status is unknown, so sends no longer silently degrade to plain messages when the 10-minute cache expires. (#65447, #43764) Thanks @omarshahine. - Heartbeat/security: force owner downgrade for untrusted `hook:wake` system events [AI-assisted]. (#66031) Thanks @pgondhi987. - Browser/security: enforce SSRF policy on snapshot, screenshot, and tab routes [AI]. (#66040) Thanks @pgondhi987. - Microsoft Teams/security: enforce sender allowlist checks on SSO signin invokes [AI]. (#66033) Thanks @pgondhi987. - Config/security: redact `sourceConfig` and `runtimeConfig` alias fields in `redactConfigSnapshot` [AI]. (#66030) Thanks @pgondhi987. - Agents/context engines: run opt-in turn maintenance as idle-aware background work so the next foreground turn no longer waits on proactive maintenance. (#65233) Thanks @100yenadmin. - Plugins/status: report the registered context-engine IDs in `plugins inspect` instead of the owning plugin ID, so non-matching engine IDs and multi-engine plugins are classified correctly. (#58766) Thanks @zhuisDEV. - Context engines: reject resolved plugin engines whose reported `info.id` does not match their registered slot id, so malformed engines fail fast before id-based runtime branches can misbehave. (#63222) Thanks @fuller-stack-dev. - WhatsApp: patch installed Baileys media encryption writes during OpenClaw postinstall so the default npm/install.sh delivery path waits for encrypted media files to finish flushing before readback, avoiding transient `ENOENT` crashes on image sends. (#65896) Thanks @frankekn. - Gateway/update: unify service entrypoint resolution around the canonical bundled gateway entrypoint so update, reinstall, and doctor repair stop drifting between stale `dist/entry.js` and current `dist/index.js` paths. (#65984) Thanks @mbelinky. - Heartbeat/Telegram topics: keep isolated heartbeat replies on the bound forum topic when `target=last`, instead of dropping them into the group root chat. (#66035) Thanks @mbelinky. - Browser/CDP: let managed local Chrome readiness, status probes, and managed loopback CDP control bypass browser SSRF policy for their own loopback control plane, so OpenClaw no longer misclassifies a healthy child browser as "not reachable after start". (#65695, #66043) Thanks @mbelinky. - Gateway/sessions: stop heartbeat, cron-event, and exec-event turns from overwriting shared-session routing and origin metadata, preventing synthetic `heartbeat` targets from poisoning later cron or user delivery. (#66073, #63733, #35300) Thanks @mbelinky. - Browser/CDP: let local attach-only `manual-cdp` profiles reuse the local loopback CDP control plane under strict default policy and remote-class probe timeouts, so tabs/snapshot stop falsely reporting a live local browser session as not running. (#65611, #66080) Thanks @mbelinky. - Cron/scheduler: stop inventing short retries when cron next-run calculation returns no valid future slot, and keep a maintenance wake armed so enabled unscheduled jobs recover without entering a refire loop. (#66019, #66083) Thanks @mbelinky. - Cron/scheduler: preserve the active error-backoff floor when maintenance repair recomputes a missing cron next-run, so recurring errored jobs do not resume early after a transient next-run resolution failure. (#66019, #66083, #66113) Thanks @mbelinky. - Outbound/delivery-queue: persist the originating outbound `session` context on queued delivery entries and replay it during recovery, so write-ahead-queued sends keep their original outbound media policy context after restart instead of evaluating against a missing session. (#66025) Thanks @eleqtrizit. - Auto-reply/queue: split collect-mode followup drains into contiguous groups by per-message authorization context (sender id, owner status, exec/bash-elevated overrides), so queued items from different senders or exec configs no longer execute under the last queued run's owner-only and exec-approval context. (#66024) Thanks @eleqtrizit. - Dreaming/memory-core: require a live queued Dreaming cron event before the heartbeat hook runs the sweep, so managed Dreaming no longer replays on later heartbeats after the scheduled run was already consumed. (#66139) Thanks @mbelinky. - Control UI/Dreaming: stop Imported Insights and Memory Palace from calling optional `memory-wiki` gateway methods when the plugin is off, and refresh config before wiki reloads so the Dreaming tab stops showing misleading unknown-method failures. (#66140) Thanks @mbelinky. - Agents/tools: only mark streamed unknown-tool retries as counted when a streamed message actually classifies an unavailable tool, and keep incomplete streamed tool names from resetting the retry streak before the final assistant message arrives. (#66145) Thanks @dutifulbob. - Memory/active-memory: move recalled memory onto the hidden untrusted prompt-prefix path instead of system prompt injection, label the visible Active Memory status line fields, and include the resolved recall provider/model in gateway debug logs so trace/debug output matches what the model actually saw. (#66144) Thanks @Takhoffman. - Memory/QMD: stop treating legacy lowercase `memory.md` as a second default root collection, so QMD recall no longer searches phantom `memory-alt-*` collections and builtin/QMD root-memory fallback stays aligned. (#66141) Thanks @mbelinky. - Agents/OpenAI: map `minimal` thinking to OpenAI's supported `low` reasoning effort for GPT-5.4 requests, so embedded runs stop failing request validation. Thanks @steipete. - Voice-call/media-stream: resolve the source IP from trusted forwarding headers for per-IP pending-connection limits when `webhookSecurity.trustForwardingHeaders` and `trustedProxyIPs` are configured, and reserve `maxConnections` capacity for in-flight WebSocket upgrades so concurrent handshakes can no longer momentarily exceed the operator-set cap. (#66027) Thanks @eleqtrizit. - Feishu/allowlist: canonicalize allowlist entries by explicit `user`/`chat` kind, strip repeated `feishu:`/`lark:` provider prefixes, and stop folding opaque Feishu IDs to lowercase, so allowlist matching no longer crosses user/chat namespaces or widens to case-insensitive ID matches the operator did not intend. (#66021) Thanks @eleqtrizit. - TTS/reply media: persist OpenClaw temp voice outputs into managed outbound media and allow them through reply-media normalization, so voice-note replies stop silently dropping. (#63511) Thanks @jetd1. - Agents/tools: treat Windows drive-letter paths (`C:\\...`) as absolute when resolving sandbox and read-tool paths so workspace root is not prepended under POSIX path rules. (#54039) Thanks @ly85206559 and @vincentkoc. - Agents/OpenAI: recover embedded GPT-style runs when reasoning-only or empty turns need bounded continuation, with replay-safe retry gating and incomplete-turn fallback when no visible answer arrives. (#66167) thanks @jalehman - Outbound/relay-status: suppress internal relay-status placeholder payloads (`No channel reply.`, `Replied in-thread.`, `Replied in #...`, wiki-update status variants ending in `No channel reply.`) before channel delivery so internal housekeeping text does not leak to users. - Slack/doctor: add a dedicated doctor-contract sidecar so config warmup paths such as `openclaw cron` no longer fall back to Slack's broader contract surface, which could trigger Slack-related config-read crashes on affected setups. (#63192) Thanks @shhtheonlyperson. - Hooks/session-memory: pass the resolved agent workspace into gateway `/new` and `/reset` session-memory hooks so reset snapshots stay scoped to the right agent workspace instead of leaking into the default workspace. (#64735) Thanks @suboss87 and @vincentkoc.

OpenClaw v2026.4.14-beta.1 预发布