OpenClaw v2026.4.15-beta.1

### 变更 - **控制 UI/概览**：新增模型认证状态卡片，可一目了然地显示 OAuth 令牌健康状况和提供商速率限制压力，并在 OAuth 令牌即将过期或已过期时发出提醒。由新的 `models.authStatus` 网关方法提供支持，该方法会剥离凭据并缓存 60 秒。(#66211) 感谢 @omarshahine。 - **内存/LanceDB**：为 `memory-lancedb` 添加云存储支持，使持久化内存索引可在远程对象存储上运行，而不仅限于本地磁盘。(#63502) 感谢 @rugvedS07。 - **GitHub Copilot/内存搜索**：添加用于内存搜索的 GitHub Copilot 嵌入提供程序，并公开专用的 Copilot 嵌入主机辅助工具，以便插件可重用传输层，同时尊重远程覆盖、令牌刷新和更安全的负载验证。(#61718) 感谢 @feiskyer 和 @vincentkoc。 - **代理/本地模型**：添加实验性配置 `agents.defaults.experimental.localModelLean: true`，以移除 `browser`、`cron` 和 `message` 等重型默认工具，从而在不改变常规路径的情况下减少较弱本地模型设置的提示词大小。(#66495) 感谢 @ImLukeF。 - **打包/插件**：将捆绑的插件运行时依赖项本地化到其所属扩展，精简已发布的文档负载，并加强安装/包管理器防护措施，使已发布的构建保持精简，核心不再承载扩展拥有的运行时负担。(#67099) 感谢 @vincentkoc。 - **QA/Matrix**：将 Matrix 实时 QA 拆分为源代码链接的 `qa-matrix` 运行器，并将仓库私有的 `qa-*` 界面排除在打包和发布构建之外。(#66723) 感谢 @gumadeiras。 - **文档/展示**：添加可扫描的横幅、完整的章节跳转链接以及社区示例的响应式视频网格。(#48493) 感谢 @jchopard69。 ### 修复 - **安全/审批**：在执行审批提示中隐藏密钥，防止内联审批审查在渲染的提示内容中泄露凭据材料。(#61077, #64790) - **CLI/配置**：写入后重新读取持久化的配置哈希，使配置更新不再因陈旧哈希竞争而失败。(#64188, #66528) - **CLI/更新**：在 npm 升级后清理陈旧的打包 `dist` 块，并保持降级/验证清单检查的兼容安全性，使全局升级不再因陈旧块导入而失败。(#66959) 感谢 @obviyus。 - **入门/CLI**：修复全局安装的 CLI 设置在上手过程中出现的频道选择崩溃问题。(#66736) - **内存核心/QMD `memory_get`**：拒绝读取任意工作区 Markdown 路径，仅允许规范的内存文件（`MEMORY.md`、`memory.md`、`DREAMS.md`、`dreams.md`、`memory/**`）以及活动索引 QMD 工作区文档的精确路径，使 QMD 内存后端不再能作为绕过 `read` 工具策略拒绝的通用工作区文件读取代理。(#66026) 感谢 @eleqtrizit。 - **Cron/代理**：将嵌入式运行工具策略和内部事件参数转发到尝试层，使 `--tools` 允许列表、cron 拥有的消息工具抑制、显式消息 targeting 和命令路径内部事件全部在运行时再次生效。(#62675) 感谢 @hexsprite。 - **设置/提供商**：在设置过程中保护首选提供商查找，防止格式错误的插件元数据（缺少提供商 ID）导致向导因 `Cannot read properties of undefined (reading 'trim')` 而崩溃。(#66649) 感谢 @Tianworld。 - **Matrix/安全**：标准化沙盒配置文件头像参数，保留 `mxc://` 头像 URL，并在重新加载期间暴露 Gmail 观察程序停止失败。(#64701) 感谢 @slepybear。 - **Telegram/文档**：从入站 Telegram 文本处理中丢弃泄露的二进制标题字节，使 `.mobi` 或 `.epub` 等文档上传不再导致提示词令牌计数爆炸。(#66663) 感谢 @joelnishanth。 - **网关/认证**：在 HTTP 服务器和 HTTP 升级处理程序中通过 `getResolvedAuth()` 按请求解析活动网关持有者令牌，与 WebSocket 路径保持一致，使通过 `secrets.reload` 或配置热重载轮换的密钥能立即在 `/v1/*`、`/tools/invoke`、插件 HTTP 路由和画布升级路径上停止认证，而不再在 HTTP 上保持有效直到网关重启。(#66651) 感谢 @mmaps。 - **代理/压缩**：将压缩保留令牌下限限制为模型上下文窗口，使小上下文本地模型（例如 16K 令牌的 Ollama）不再在每个提示词上触发上下文溢出错误或无限压缩循环。(#65671) 感谢 @openperf。 - **代理/OpenAI 响应**：将确切的 `Unknown error (no error details in response)` 传输故障分类为失败原因 `unknown`，以便助理/模型回退仍对该无详情失败路径运行。(#65254) 感谢 @OpenCodeEngineer。 - **模型/探测**：在 `models list --probe` 中将无效模型探测失败显示为 `format` 而非 `unknown`，并用回归覆盖锁定无效模型回退路径。(#50028) 感谢 @xiwuqi。 - **代理/故障转移**：将 OpenAI 兼容的 `finish_reason: network_error` 流故障分类为超时，使模型故障转移重试继续而非因未知故障原因停止。(#61784) 感谢 @lawrence3699。 - **入门/频道**：在发现和验证前标准化频道设置元数据，使格式错误或形状混合的频道插件元数据不再破坏设置和入门频道列表。(#66706) 感谢 @darkamenosa。 - **Slack/原生命令**：通过为每个按钮分配唯一操作 ID 来修复 Slack 原生按钮渲染的斜杠命令（如 `/verbose`）选项菜单，同时仍通过共享的 `openclaw_cmdarg*` 监听器路由它们。感谢 @Wangmerlyn。 - **飞书/Webhook**：强化 Webhook 传输和卡片操作重放防护，在缺少 `encryptKey` 时失败关闭，在无密钥时拒绝未签名请求而非接受，并在去重声明和调度器之前丢弃空白卡片操作令牌。在已关闭的监控账户层之上提供深度防御。(#66707) 感谢 @eleqtrizit。 - **代理/工作区文件**：将 `agents.files.get`、`agents.files.set` 和工作区列表通过共享的 `fs-safe` 辅助工具（`openFileWithinRoot`/`readFileWithinRoot`/`writeFileWithinRoot`）路由，拒绝允许列表代理文件的符号链接别名，并让 `fs-safe` 在回退到基于路径的 `realpath` 之前从文件描述符解析打开文件的真实路径，使 `open` 和 `realpath` 之间的符号链接交换不再将验证后的路径重定向到预期 inode 之外。(#66636) 感谢 @eleqtrizit。 - **网关/MCP 环回**：将 `/mcp` 持有者比较从普通 `!==` 切换为恒定时间 `safeEqualSecret`（匹配代码库中每其他认证表面的惯例），并在认证门运行前通过 `checkBrowserOrigin` 拒绝非环回浏览器来源请求。环回来源（`127.0.0.1:*`、`localhost:*`、同源）仍可通过，包括浏览器标记为 `Sec-Fetch-Site: cross-site` 的 `localhost`↔`127.0.0.1` 主机不匹配。(#66665) 感谢 @eleqtrizit。 - **自动回复/计费**：将纯计费冷却回退摘要从结构化回退原因中分类，以便用户看到计费指导而非通用失败回复。(#66363) 感谢 @Rohan5commit。 - **代理/故障转移**：在模型故障转移重试时保留原始提示词正文和会话历史，使重试模型保持活动任务而非仅看到通用继续消息。(#66029) 感谢 @WuKongAI-CMU。 - **回复/密钥**：在回复运行消息操作发现前解析活动回复频道/账户 SecretRefs，使频道令牌 SecretRefs（例如 Discord）不会降级为发现时未解析密钥失败。(#66796) 感谢 @joshavant。 - **代理/Anthropic**：忽略非正 Anthropic 消息令牌覆盖，并在无正令牌预算时本地失败，使无效的 `max_tokens` 值不再到达提供商 API。(#66664) 感谢 @jalehman。 - **代理/上下文引擎**：在延迟维护重用轮次后运行时上下文时保留仅提示词令牌计数而非完整请求总数，使后台压缩簿记与活动提示词窗口匹配。(#66820) 感谢 @jalehman。 - **BlueBubbles/入站**：添加持久化文件支持的 GUID 去重，使 MessagePoller webhook 在 BB 服务器重启或重连后重放不再导致代理重新回复已处理消息。(#19176, #12053, #66816) 感谢 @omarshahine。 - **密钥/插件/状态**：对齐插件预加载、只读状态/代理表面和运行时认证路径中的 SecretRef 检查与严格处理，使未解析引用不再使只读 CLI 流程崩溃，而运行时必需的非环境引用保持严格。(#66818) 感谢 @joshavant。 - **内存/做梦**：停止将仅引用梦境日记提示词的普通记录分类为内部梦境运行并静默从会话回忆摄入中丢弃。(#66852) 感谢 @gumadeiras。 - **Telegram/文档**：清理二进制回复上下文和 ZIP 类存档提取，使 `.epub` 和 `.mobi` 上传不再通过回复元数据或存档到 `text/plain` 的强制转换将原始二进制泄露到提示词上下文。(#66877) 感谢 @martinfrancois。 - **Telegram/原生命令**：恢复插件注册表支持的自动默认原生命令和原生技能，使 Telegram 斜杠命令在 `commands.native` 和 `commands.nativeSkills` 保持 `auto` 时继续注册。(#66843) 感谢 @kashevk0。 - **OpenRouter/Qwen3**：将 `reasoning_details` 流增量解析为思考内容而不跳过同块工具调用，使 Qwen3 回复在 OpenRouter 上不再为空失败，且混合推理/工具调用块仍正常执行。(#66905) 感谢 @bladin。 - **fix(bluebubbles)**：通过持久化每帐户游标和 `/api/v1/message/query?after=<ts>` 传递，在网关重启后重放丢失的 webhook 消息，使网关停机时传递的消息不再丢失。使用现有的 `processMessage` 路径，并由 #66816 的入站 GUID 缓存去重。(#66857, #66721) 感谢 @omarshahine。 - **Telegram/原生命令**：保持 Telegram 命令同步缓存进程本地，使网关重启重新注册菜单，而非信任 Telegram 带外清除命令后的陈旧磁盘同步状态。(#66730) 感谢 @nightq。 - **音频/自托管 STT**：为音频转录恢复 `models.providers.*.request.allowPrivateNetwork`，使私有或局域网语音转文本端点不再在 v2026.4.14 回归后触发 SSRF 阻止。(#66692) 感谢 @jhsmith409。 - **自动回复/媒体**：在自动回复发送流程中允许工作区根目录的绝对媒体路径，使有效的本地媒体引用不再路径验证失败。(#66689) - **WhatsApp/Baileys 媒体上传**：强化加密上传处理，使大型出站媒体发送避免缓冲区峰值和可靠性回归。(#65966) 感谢 @frankekn。 - **QQBot/cron**：在 `parseFaceTags` 和 `filterInternalMarkers` 中防御未定义的 `event.content`，使无内容负载的 cron 触发代理回合不再因 `TypeError: Cannot read properties of undefined (reading 'startsWith')` 崩溃。(#66302) 感谢 @xinmotlanthua。 - **CLI/插件**：停止 `--dangerously-force-unsafe-install` 插件安装在安全扫描失败后回退到钩子包安装，同时为真实钩子包保留非安全回退行为。(#58909) 感谢 @hxy91819。 - **Claude CLI/会话**：将 `No conversation found with session ID` 分类为 `session_expired`，使过期的 CLI 支持对话清除陈旧绑定并在下一回合恢复。(#65028) 感谢 @Ivan-Fn。 - **上下文引擎**：当第三方上下文引擎插件在解析时失败（未注册 ID、工厂抛出或合约违反）时优雅回退到旧引擎，防止每个频道的完整网关中断。(#66930) 感谢 @openperf。 - **控制 UI/聊天**：通过将同会话历史重载推迟到活动运行结束（包括中止和错误运行），在活动发送期间保持乐观用户消息卡片可见。(#66997) 感谢 @scotthuang 和 @vincentkoc。 - **媒体/Slack**：仅当回退缓冲区实际解码为文本时才允许主机本地 CSV 和 Markdown 上传，使真实纯文本文件正常工作，同时防止重命名为 `.csv` 或 `.md` 的不透明非文本 blob 通过主机读取防护。(#67047) 感谢 @Unayung。 - **Ollama/入门**：将设置拆分为 `Cloud + Local`、`Cloud only` 和 `Local only`，支持无本地守护进程的直接 `OLLAMA_API_KEY` 云设置，并保持 Ollama 网络搜索在本地主机路径上。(#67005) 感谢 @obviyus。

### Changes - Control UI/Overview: add a Model Auth status card showing OAuth token health and provider rate-limit pressure at a glance, with attention callouts when OAuth tokens are expiring or expired. Backed by a new `models.authStatus` gateway method that strips credentials and caches for 60s. (#66211) Thanks @omarshahine. - Memory/LanceDB: add cloud storage support to `memory-lancedb` so durable memory indexes can run on remote object storage instead of local disk only. (#63502) Thanks @rugvedS07. - GitHub Copilot/memory search: add a GitHub Copilot embedding provider for memory search, and expose a dedicated Copilot embedding host helper so plugins can reuse the transport while honoring remote overrides, token refresh, and safer payload validation. (#61718) Thanks @feiskyer and @vincentkoc. - Agents/local models: add experimental `agents.defaults.experimental.localModelLean: true` to drop heavyweight default tools like `browser`, `cron`, and `message`, reducing prompt size for weaker local-model setups without changing the normal path. (#66495) Thanks @ImLukeF. - Packaging/plugins: localize bundled plugin runtime deps to their owning extensions, trim the published docs payload, and tighten install/package-manager guardrails so published builds stay leaner and core stops carrying extension-owned runtime baggage. (#67099) Thanks @vincentkoc. - QA/Matrix: split Matrix live QA into a source-linked `qa-matrix` runner and keep repo-private `qa-*` surfaces out of packaged and published builds. (#66723) Thanks @gumadeiras. - Docs/showcase: add a scannable hero, complete section jump links, and a responsive video grid for community examples. (#48493) Thanks @jchopard69. ### Fixes - Security/approvals: redact secrets in exec approval prompts so inline approval review can no longer leak credential material in rendered prompt content. (#61077, #64790) - CLI/configure: re-read the persisted config hash after writes so config updates stop failing with stale-hash races. (#64188, #66528) - CLI/update: prune stale packaged `dist` chunks after npm upgrades and keep downgrade/verify inventory checks compat-safe so global upgrades stop failing on stale chunk imports. (#66959) Thanks @obviyus. - Onboarding/CLI: fix channel-selection crashes on globally installed CLI setups during onboarding. (#66736) - Memory-core/QMD `memory_get`: reject reads of arbitrary workspace markdown paths and only allow canonical memory files (`MEMORY.md`, `memory.md`, `DREAMS.md`, `dreams.md`, `memory/**`) plus exact paths of active indexed QMD workspace documents, so the QMD memory backend can no longer be used as a generic workspace-file read shim that bypasses `read` tool-policy denials. (#66026) Thanks @eleqtrizit. - Cron/agents: forward embedded-run tool policy and internal event params into the attempt layer so `--tools` allowlists, cron-owned message-tool suppression, explicit message targeting, and command-path internal events all take effect at runtime again. (#62675) Thanks @hexsprite. - Setup/providers: guard preferred-provider lookup during setup so malformed plugin metadata with a missing provider id no longer crashes the wizard with `Cannot read properties of undefined (reading 'trim')`. (#66649) Thanks @Tianworld. - Matrix/security: normalize sandboxed profile avatar params, preserve `mxc://` avatar URLs, and surface gmail watcher stop failures during reload. (#64701) Thanks @slepybear. - Telegram/documents: drop leaked binary caption bytes from inbound Telegram text handling so document uploads like `.mobi` or `.epub` no longer explode prompt token counts. (#66663) Thanks @joelnishanth. - Gateway/auth: resolve the active gateway bearer per-request on the HTTP server and the HTTP upgrade handler via `getResolvedAuth()`, mirroring the WebSocket path, so a secret rotated through `secrets.reload` or config hot-reload stops authenticating on `/v1/*`, `/tools/invoke`, plugin HTTP routes, and the canvas upgrade path immediately instead of remaining valid on HTTP until gateway restart. (#66651) Thanks @mmaps. - Agents/compaction: cap the compaction reserve-token floor to the model context window so small-context local models (e.g. Ollama with 16K tokens) no longer trigger context-overflow errors or infinite compaction loops on every prompt. (#65671) Thanks @openperf. - Agents/OpenAI Responses: classify the exact `Unknown error (no error details in response)` transport failure as failover reason `unknown` so assistant/model fallback still runs for that no-details failure path. (#65254) Thanks @OpenCodeEngineer. - Models/probe: surface invalid-model probe failures as `format` instead of `unknown` in `models list --probe`, and lock the invalid-model fallback path in with regression coverage. (#50028) Thanks @xiwuqi. - Agents/failover: classify OpenAI-compatible `finish_reason: network_error` stream failures as timeout so model fallback retries continue instead of stopping with an unknown failover reason. (#61784) thanks @lawrence3699. - Onboarding/channels: normalize channel setup metadata before discovery and validation so malformed or mixed-shape channel plugin metadata no longer breaks setup and onboarding channel lists. (#66706) Thanks @darkamenosa. - Slack/native commands: fix option menus for slash commands such as `/verbose` when Slack renders native buttons by giving each button a unique action ID while still routing them through the shared `openclaw_cmdarg*` listener. Thanks @Wangmerlyn. - Feishu/webhook: harden the webhook transport and card-action replay guards to fail closed on missing `encryptKey` and blank callback tokens — refuse to start the webhook transport without an `encryptKey`, reject unsigned requests when no key is present instead of accepting them, and drop blank card-action tokens before the dedupe claim and dispatcher. Defense-in-depth over the already-closed monitor-account layer. (#66707) Thanks @eleqtrizit. - Agents/workspace files: route `agents.files.get`, `agents.files.set`, and workspace listing through the shared `fs-safe` helpers (`openFileWithinRoot`/`readFileWithinRoot`/`writeFileWithinRoot`), reject symlink aliases for allowlisted agent files, and have `fs-safe` resolve opened-file real paths from the file descriptor before falling back to path-based `realpath` so a symlink swap between `open` and `realpath` can no longer redirect the validated path off the intended inode. (#66636) Thanks @eleqtrizit. - Gateway/MCP loopback: switch the `/mcp` bearer comparison from plain `!==` to constant-time `safeEqualSecret` (matching the convention every other auth surface in the codebase uses), and reject non-loopback browser-origin requests via `checkBrowserOrigin` before the auth gate runs. Loopback origins (`127.0.0.1:*`, `localhost:*`, same-origin) still go through, including the `localhost`↔`127.0.0.1` host mismatch that browsers flag as `Sec-Fetch-Site: cross-site`. (#66665) Thanks @eleqtrizit. - Auto-reply/billing: classify pure billing cooldown fallback summaries from structured fallback reasons so users see billing guidance instead of the generic failure reply. (#66363) Thanks @Rohan5commit. - Agents/fallback: preserve the original prompt body on model fallback retries with session history so the retrying model keeps the active task instead of only seeing a generic continue message. (#66029) Thanks @WuKongAI-CMU. - Reply/secrets: resolve active reply channel/account SecretRefs before reply-run message-action discovery so channel token SecretRefs (for example Discord) do not degrade into discovery-time unresolved-secret failures. (#66796) Thanks @joshavant. - Agents/Anthropic: ignore non-positive Anthropic Messages token overrides and fail locally when no positive token budget remains, so invalid `max_tokens` values no longer reach the provider API. (#66664) thanks @jalehman - Agents/context engines: preserve prompt-only token counts, not full request totals, when deferred maintenance reuses after-turn runtime context so background compaction bookkeeping matches the active prompt window. (#66820) thanks @jalehman. - BlueBubbles/inbound: add a persistent file-backed GUID dedupe so MessagePoller webhook replays after BB Server restart or reconnect no longer cause the agent to re-reply to already-handled messages. (#19176, #12053, #66816) Thanks @omarshahine. - Secrets/plugins/status: align SecretRef inspect-vs-strict handling across plugin preload, read-only status/agents surfaces, and runtime auth paths so unresolved refs no longer crash read-only CLI flows while runtime-required non-env refs stay strict. (#66818) Thanks @joshavant. - Memory/dreaming: stop ordinary transcripts that merely quote the dream-diary prompt from being classified as internal dreaming runs and silently dropped from session recall ingestion. (#66852) Thanks @gumadeiras. - Telegram/documents: sanitize binary reply context and ZIP-like archive extraction so `.epub` and `.mobi` uploads can no longer leak raw binary into prompt context through reply metadata or archive-to-`text/plain` coercion. (#66877) Thanks @martinfrancois. - Telegram/native commands: restore plugin-registry-backed auto defaults for native commands and native skills so Telegram slash commands keep registering when `commands.native` and `commands.nativeSkills` stay on `auto`. (#66843) Thanks @kashevk0. - OpenRouter/Qwen3: parse `reasoning_details` stream deltas as thinking content without skipping same-chunk tool calls, so Qwen3 replies no longer fail empty on OpenRouter and mixed reasoning/tool-call chunks still execute normally. (#66905) Thanks @bladin. - fix(bluebubbles): replay missed webhook messages after gateway restart via a persistent per-account cursor and `/api/v1/message/query?after=<ts>` pass, so messages delivered while the gateway was down no longer disappear. Uses the existing `processMessage` path and is deduped by #66816's inbound GUID cache. (#66857, #66721) Thanks @omarshahine. - Telegram/native commands: keep Telegram command-sync cache process-local so gateway restarts re-register the menu instead of trusting stale on-disk sync state after Telegram cleared commands out-of-band. (#66730) Thanks @nightq. - Audio/self-hosted STT: restore `models.providers.*.request.allowPrivateNetwork` for audio transcription so private or LAN speech-to-text endpoints stop tripping SSRF blocks after the v2026.4.14 regression. (#66692) Thanks @jhsmith409. - Auto-reply/media: allow workspace-rooted absolute media paths in auto-reply send flows so valid local media references no longer fail path validation. (#66689) - WhatsApp/Baileys media upload: harden encrypted upload handling so large outbound media sends avoid buffer spikes and reliability regressions. (#65966) Thanks @frankekn. - QQBot/cron: guard against undefined `event.content` in `parseFaceTags` and `filterInternalMarkers` so cron-triggered agent turns with no content payload no longer crash with `TypeError: Cannot read properties of undefined (reading 'startsWith')`. (#66302) Thanks @xinmotlanthua. - CLI/plugins: stop `--dangerously-force-unsafe-install` plugin installs from falling back to hook-pack installs after security scan failures, while still preserving non-security fallback behavior for real hook packs. (#58909) Thanks @hxy91819. - Claude CLI/sessions: classify `No conversation found with session ID` as `session_expired` so expired CLI-backed conversations clear the stale binding and recover on the next turn. (#65028) thanks @Ivan-Fn. - Context Engine: gracefully fall back to the legacy engine when a third-party context engine plugin fails at resolution time (unregistered id, factory throw, or contract violation), preventing a full gateway outage on every channel. (#66930) Thanks @openperf. - Control UI/chat: keep optimistic user message cards visible during active sends by deferring same-session history reloads until the active run ends, including aborted and errored runs. (#66997) Thanks @scotthuang and @vincentkoc. - Media/Slack: allow host-local CSV and Markdown uploads only when the fallback buffer actually decodes as text, so real plain-text files work without letting opaque non-text blobs renamed to `.csv` or `.md` slip past the host-read guard. (#67047) Thanks @Unayung. - Ollama/onboarding: split setup into `Cloud + Local`, `Cloud only`, and `Local only`, support direct `OLLAMA_API_KEY` cloud setup without a local daemon, and keep Ollama web search on the local-host path. (#67005) Thanks @obviyus.

OpenClaw v2026.4.15-beta.1 预发布