OpenClaw v2026.4.15-beta.1

### 变更 - **控制 UI/概览**：新增模型认证状态卡片，可直观展示 OAuth 令牌健康度及提供商速率限制压力；当 OAuth 令牌即将过期或已过期时，会突出显示警告。由新的 `models.authStatus` 网关方法提供支持，该方法会剥离凭据并缓存 60 秒。(#66211) 感谢 @omarshahine。 - **Memory/LanceDB**：为 `memory-lancedb` 添加云存储支持，使持久化内存索引可运行在远程对象存储而非仅限本地磁盘。(#63502) 感谢 @rugvedS07。 - **GitHub Copilot/记忆搜索**：为记忆搜索新增 GitHub Copilot 嵌入提供商，并公开专用的 Copilot 嵌入主机辅助工具，使插件可复用传输层，同时尊重远程覆盖、令牌刷新及更安全的负载验证。(#61718) 感谢 @feiskyer 和 @vincentkoc。 - **Agents/本地模型**：新增实验性配置 `agents.defaults.experimental.localModelLean: true`，用于移除 `browser`、`cron`、`message` 等重型默认工具，在不改变常规路径的前提下减小弱本地模型环境的提示词体积。(#66495) 感谢 @ImLukeF。 - **Packaging/插件**：将捆绑插件的运行时依赖本地化至其所属扩展，精简发布文档包体积，并强化安装/包管理器防护，使发布构建更精简，核心不再承载扩展所属的运行时负担。(#67099) 感谢 @vincentkoc。 - **QA/Matrix**：将 Matrix 实时 QA 拆分为源码关联的 `qa-matrix` 运行器，并确保仓库私有的 `qa-*` 界面不出现在打包及发布构建中。(#66723) 感谢 @gumadeiras。 - **Docs/展示**：新增可扫描的 Hero 区域、完整的章节跳转链接，以及社区示例的响应式视频网格。(#48493) 感谢 @jchopard69。 ### 修复 - **Security/审批**：在执行审批提示中脱敏密钥，防止内联审批审查在渲染的提示内容中泄露凭据材料。(#61077, #64790) - **CLI/配置**：写入配置后重新读取持久化的配置哈希，解决因哈希陈旧竞争导致的配置更新失败问题。(#64188, #66528) - **CLI/更新**：npm 升级后清理过时的打包 `dist` 分块，并保持降级/验证清单检查的兼容安全性，防止全局升级因陈旧分块导入而失败。(#66959) 感谢 @obviyus。 - **Onboarding/CLI**：修复全局安装 CLI 环境下 onboarding 阶段的频道选择崩溃问题。(#66736) - **Video generation/实时测试**：限制提供商实时视频冒烟测试的轮询，默认使用快速非 FAL 文生视频路径，并采用一秒钟龙虾提示词，使发布验证不再因缓慢的提供商队列而无限等待。 - **Memory-core/QMD `memory_get`**：拒绝读取任意工作区 Markdown 路径，仅允许规范内存文件（`MEMORY.md`、`memory.md`、`DREAMS.md`、`dreams.md`、`memory/**`）及活动索引 QMD 工作区文档的精确路径，防止 QMD 内存后端被滥用作绕过 `read` 工具策略拒绝的通用工作区文件读取代理。(#66026) 感谢 @eleqtrizit。 - **Cron/agents**：将嵌入式运行工具策略及内部事件参数转发至尝试层，使 `--tools` 允许列表、cron 拥有的消息工具抑制、显式消息定位及命令路径内部事件在运行时重新生效。(#62675) 感谢 @hexsprite。 - **Setup/providers**：在设置过程中防护首选提供商查找，防止格式错误的插件元数据（缺少提供商 ID）导致向导崩溃于 `Cannot read properties of undefined (reading 'trim')`。(#66649) 感谢 @Tianworld。 - **Matrix/security**：规范化沙盒配置文件头像参数，保留 `mxc://` 头像 URL，并在重载期间暴露 Gmail 观察器停止失败。(#64701) 感谢 @slepybear。 - **Telegram/documents**：从入站 Telegram 文本处理中丢弃泄露的二进制标题字节，防止 `.mobi` 或 `.epub` 等文档上传导致提示词令牌计数爆炸。(#66663) 感谢 @joelnishanth。 - **Gateway/auth**：在 HTTP 服务器及 HTTP 升级处理器中通过 `getResolvedAuth()` 按请求解析活跃网关 bearer，与 WebSocket 路径保持一致，使通过 `secrets.reload` 或配置热重载轮换的密钥能立即在 `/v1/*`、`/tools/invoke`、插件 HTTP 路由及画布升级路径上停止认证，而非在网关重启前在 HTTP 上保持有效。(#66651) 感谢 @mmaps。 - **Agents/compaction**：将压缩保留令牌下限限制为模型上下文窗口，防止小上下文本地模型（如 16K 令牌的 Ollama）在每个提示词上触发上下文溢出错误或无限压缩循环。(#65671) 感谢 @openperf。 - **Agents/OpenAI Responses**：将精确的 `Unknown error (no error details in response)` 传输故障归类为故障转移原因 `unknown`，使助手/模型回退仍对该无详情失败路径生效。(#65254) 感谢 @OpenCodeEngineer。 - **Models/probe**：在 `models list --probe` 中将无效模型探测失败显示为 `format` 而非 `unknown`，并为无效模型回退路径添加回归覆盖锁定。(#50028) 感谢 @xiwuqi。 - **Agents/failover**：将 OpenAI 兼容的 `finish_reason: network_error` 流故障归类为超时，使模型故障转移重试继续而非因未知故障转移原因停止。(#61784) 感谢 @lawrence3699。 - **Onboarding/channels**：在发现及验证前规范化频道设置元数据，防止格式错误或形状混杂的频道插件元数据破坏设置及 onboarding 频道列表。(#66706) 感谢 @darkamenosa。 - **Slack/native commands**：修复 Slack 渲染原生按钮时斜杠命令（如 `/verbose`）的选项菜单，通过为每个按钮分配唯一操作 ID 同时仍通过共享 `openclaw_cmdarg*` 监听器路由，感谢 @Wangmerlyn。 - **Feishu/webhook**：强化 webhook 传输及卡片操作重放防护，在缺少 `encryptKey` 时失败关闭——无 `encryptKey` 拒绝启动 webhook 传输，无密钥时拒绝未签名请求而非接受，并在去重声明及分发器前丢弃空白卡片操作令牌。在已关闭的监控账户层之上提供深度防御。(#66707) 感谢 @eleqtrizit。 - **Agents/workspace files**：将 `agents.files.get`、`agents.files.set` 及工作区列表路由至共享 `fs-safe` 辅助工具（`openFileRoot`/`readFileWithinRoot`/`writeFileWithinRoot`），拒绝允许列表 agent 文件的符号链接别名，并让 `fs-safe` 在回退至基于路径的 `realpath` 前从文件描述符解析打开文件的实际路径，防止 `open` 与 `realpath` 间的符号链接交换将验证路径重定向至预期 inode 之外。(#66636) 感谢 @eleqtrizit。 - **Gateway/MCP 环回**：将 `/mcp` bearer 比较从普通 `!==` 切换为恒定时间 `safeEqualSecret`（匹配代码库所有其他认证表面的惯例），并在认证门运行前通过 `checkBrowserOrigin` 拒绝非环回浏览器来源请求。环回来源（`127.0.0.1:*`、`localhost:*`、同源）仍可通过，包括浏览器标记为 `Sec-Fetch-Site: cross-site` 的 `localhost`↔`127.0.0.1` 主机不匹配。(#66665) 感谢 @eleqtrizit。 - **Auto-reply/billing**：从结构化故障原因中分类纯计费冷却回退摘要，使用户看到计费指引而非通用故障回复。(#66363) 感谢 @Rohan5commit。 - **Agents/fallback**：在模型故障转移重试时保留原始提示词正文及会话历史，使重试模型保持活跃任务而非仅看到通用继续消息。(#66029) 感谢 @WuKongAI-CMU。 - **Reply/secrets**：在回复运行消息操作发现前解析活跃回复频道/账户 SecretRefs，防止频道令牌 SecretRefs（如 Discord）降级为发现时未解析密钥故障。(#66796) 感谢 @joshavant。 - **Agents/Anthropic**：忽略非正 Anthropic 消息令牌覆盖，无正令牌预算时本地失败，防止无效 `max_tokens` 值抵达提供商 API。(#66664) 感谢 @jalehman。 - **Agents/context engines**：在延迟维护重用轮次后运行时上下文时保留仅提示词令牌计数而非完整请求总数，使后台压缩记账与活跃提示词窗口匹配。(#66820) 感谢 @jalehman。 - **BlueBubbles/入站**：添加持久化文件支持的 GUID 去重，使 MessagePoller webhook 在 BB Server 重启或重连后重放不再导致 agent 对已处理消息重复回复。(#19176, #12053, #66816) 感谢 @omarshahine。 - **Secrets/plugins/status**：对齐插件预加载、只读状态/agents 表面及运行时认证路径间的 SecretRef 检查与严格处理，防止未解析引用使只读 CLI 流程崩溃，同时保持运行时必需的非环境引用为严格模式。(#66818) 感谢 @joshavant。 - **Memory/dreaming**：停止将仅引用梦境日记提示词的普通记录分类为内部梦境运行并静默丢弃会话回忆摄取。(#66852) 感谢 @gumadeiras。 - **Telegram/documents**：清理二进制回复上下文及类 ZIP 归档提取，防止 `.epub` 和 `.mobi` 上传通过回复元数据或归档到 `text/plain` 的强制转换泄露原始二进制至提示词上下文。(#66877) 感谢 @martinfrancois。 - **Telegram/native commands**：恢复插件注册表支持的原生命令及原生技能自动默认值，使 Telegram 斜杠命令在 `commands.native` 和 `commands.nativeSkills` 保持 `auto` 时继续注册。(#66843) 感谢 @kashevk0。 - **OpenRouter/Qwen3**：将 `reasoning_details` 流增量解析为思考内容而不跳过同块工具调用，使 Qwen3 回复在 OpenRouter 上不再为空返回，且混合推理/工具调用块仍正常执行。(#66905) 感谢 @bladin。 - **fix(bluebubbles)**：通过持久化每账户游标及 `/api/v1/message/query?after=<ts>` 传递，在网关重启后重放丢失的 webhook 消息，防止网关宕机期间传递的消息丢失。使用现有 `processMessage` 路径并由 #66816 的入站 GUID 缓存去重。(#66857, #66721) 感谢 @omarshahine。 - **Telegram/native commands**：保持 Telegram 命令同步缓存进程本地，使网关重启后重新注册菜单，而非信任 Telegram 带外清除命令后的陈旧磁盘同步状态。(#66730) 感谢 @nightq。 - **Audio/自托管 STT**：为音频转录恢复 `models.providers.*.request.allowPrivateNetwork`，使私有或局域网语音转文本端点不再在 v2026.4.14 回归后触发 SSRF 阻止。(#66692) 感谢 @jhsmith409。 - **Auto-reply/media**：在自动回复发送流程中允许工作区根目录绝对媒体路径，使有效本地媒体引用不再失败路径验证。(#66689) - **WhatsApp/Baileys media upload**：强化加密上传处理，使大型出站媒体发送避免缓冲峰值及可靠性回归。(#65966) 感谢 @frankekn。 - **QQBot/cron**：防护 `parseFaceTags` 及 `filterInternalMarkers` 中未定义的 `event.content`，使无内容负载的 cron 触发 agent 轮次不再崩溃于 `TypeError: Cannot read properties of undefined (reading 'startsWith')`。(#66302) 感谢 @xinmotlanthua。 - **CLI/plugins**：阻止 `--dangerously-force-unsafe-install` 插件安装在安全扫描失败后回退至 hook-pack 安装，同时为真实 hook packs 保留非安全回退行为。(#58909) 感谢 @hxy91819。 - **Claude CLI/sessions**：将 `No conversation found with session ID` 分类为 `session_expired`，使过期的 CLI 支持会话清除陈旧绑定并在下一轮恢复。(#65028) 感谢 @Ivan-Fn。 - **Context Engine**：当第三方上下文引擎插件在解析时失败（未注册 ID、工厂抛出或合约违反）时优雅回退至旧引擎，防止每个频道出现完整网关中断。(#66930) 感谢 @openperf。 - **Control UI/chat**：通过延迟同会话历史重载至活跃运行结束（包括中止及错误运行），在活跃发送期间保持乐观用户消息卡片可见。(#66997) 感谢 @scotthuang 和 @vincentkoc。 - **Media/Slack**：仅当回退缓冲实际解码为文本时允许主机本地 CSV 及 Markdown 上传，使真实纯文本文件可用，同时防止重命名为 `.csv` 或 `.md` 的不透明非文本 blob 通过主机读取防护。(#67047) 感谢 @Unayung。 - **Ollama/onboarding**：拆分设置为 `Cloud + Local`、`Cloud only` 及 `Local only`，支持无本地守护进程的直接 `OLLAMA_API_KEY` 云设置，并保持 Ollama 网页搜索在本地主机路径。(#67005) 感谢 @obviyus。 - **Docker/build**：在 `node_modules` 下使用 `find` 验证 `@matrix-org/matrix-sdk-crypto-nodejs` 原生绑定，而非硬编码 `.pnpm/...` 路径，使 pnpm v10+ 虚拟存储布局不再失败镜像构建。(#67143) 感谢 @ly85206559。 - **Matrix/E2EE**：对无密码令牌认证机器人保持启动引导保守，仍尝试 guarded repair 传递且不要求 `channels.matrix.password`，并记录剩余密码-UIA 限制。(#66228) 感谢 @SARAMALI15792。 - **Cron/announce delivery**：抑制以 `NO_REPLY` 结尾的混合内容隔离 cron 公告回复，防止尾部静默标记泄露摘要文本至目标频道。(#65004) 感谢 @neo1027144-creator。 - **Plugins/bundled channels**：按活跃捆绑根分区捆绑频道延迟缓存，使 `OPENCLAW_BUNDLED_PLUGINS_DIR` 切换停止重用陈旧插件、设置、密钥及运行时状态。(#67200) 感谢 @gumadeiras。 - **Packaging/plugins**：从捆绑插件运行时依赖中修剪通用测试/规范货物，若打包测试货物重现则失败 npm 发布验证，在不需插件特定特例的情况下保持发布压缩包精简。(#67275) 感谢 @gumadeiras。 - **Agents/context + Memory**：修剪默认启动/技能提示词预算，默认带显式延续元数据限制 `memory_get` 摘录，并保持 QMD 读取与相同 bounded excerpt 合约对齐，使长会话默认拉取更少上下文而不丢失确定性后续读取。 - **Matrix/commands**：由于房间控制命令授权忽略配对存储条目，现在跳过房间流量上的 DM 配对存储读取，保持房间路径更窄且不改变房间授权行为。(#67325) 感谢 @gumadeiras。 - **Matrix/security**：阻止 DM 配对存储条目授权房间控制命令。(#67294) 感谢 @pgondhi987。 - **Gateway/security**：在 webchat 音频嵌入路径强制执行 `localRoots` containment。(#67298) 感谢 @pgondhi987。 - **Webchat/security**：在媒体嵌入路径拒绝远程主机 `file://` URL。(#67293) 感谢 @pgondhi987。 - **Dreaming/memory-core**：对每日回忆去重使用摄取日而非源文件日，使相同每日笔记的重复扫描可在多日间递增 `dailyCount` 而非停滞在 `1`。(#67091) 感谢 @Bartok9。

### Changes - Control UI/Overview: add a Model Auth status card showing OAuth token health and provider rate-limit pressure at a glance, with attention callouts when OAuth tokens are expiring or expired. Backed by a new `models.authStatus` gateway method that strips credentials and caches for 60s. (#66211) Thanks @omarshahine. - Memory/LanceDB: add cloud storage support to `memory-lancedb` so durable memory indexes can run on remote object storage instead of local disk only. (#63502) Thanks @rugvedS07. - GitHub Copilot/memory search: add a GitHub Copilot embedding provider for memory search, and expose a dedicated Copilot embedding host helper so plugins can reuse the transport while honoring remote overrides, token refresh, and safer payload validation. (#61718) Thanks @feiskyer and @vincentkoc. - Agents/local models: add experimental `agents.defaults.experimental.localModelLean: true` to drop heavyweight default tools like `browser`, `cron`, and `message`, reducing prompt size for weaker local-model setups without changing the normal path. (#66495) Thanks @ImLukeF. - Packaging/plugins: localize bundled plugin runtime deps to their owning extensions, trim the published docs payload, and tighten install/package-manager guardrails so published builds stay leaner and core stops carrying extension-owned runtime baggage. (#67099) Thanks @vincentkoc. - QA/Matrix: split Matrix live QA into a source-linked `qa-matrix` runner and keep repo-private `qa-*` surfaces out of packaged and published builds. (#66723) Thanks @gumadeiras. - Docs/showcase: add a scannable hero, complete section jump links, and a responsive video grid for community examples. (#48493) Thanks @jchopard69. ### Fixes - Security/approvals: redact secrets in exec approval prompts so inline approval review can no longer leak credential material in rendered prompt content. (#61077, #64790) - CLI/configure: re-read the persisted config hash after writes so config updates stop failing with stale-hash races. (#64188, #66528) - CLI/update: prune stale packaged `dist` chunks after npm upgrades and keep downgrade/verify inventory checks compat-safe so global upgrades stop failing on stale chunk imports. (#66959) Thanks @obviyus. - Onboarding/CLI: fix channel-selection crashes on globally installed CLI setups during onboarding. (#66736) - Video generation/live tests: bound provider polling for live video smoke, default to the fast non-FAL text-to-video path, and use a one-second lobster prompt so release validation no longer waits indefinitely on slow provider queues. - Memory-core/QMD `memory_get`: reject reads of arbitrary workspace markdown paths and only allow canonical memory files (`MEMORY.md`, `memory.md`, `DREAMS.md`, `dreams.md`, `memory/**`) plus exact paths of active indexed QMD workspace documents, so the QMD memory backend can no longer be used as a generic workspace-file read shim that bypasses `read` tool-policy denials. (#66026) Thanks @eleqtrizit. - Cron/agents: forward embedded-run tool policy and internal event params into the attempt layer so `--tools` allowlists, cron-owned message-tool suppression, explicit message targeting, and command-path internal events all take effect at runtime again. (#62675) Thanks @hexsprite. - Setup/providers: guard preferred-provider lookup during setup so malformed plugin metadata with a missing provider id no longer crashes the wizard with `Cannot read properties of undefined (reading 'trim')`. (#66649) Thanks @Tianworld. - Matrix/security: normalize sandboxed profile avatar params, preserve `mxc://` avatar URLs, and surface gmail watcher stop failures during reload. (#64701) Thanks @slepybear. - Telegram/documents: drop leaked binary caption bytes from inbound Telegram text handling so document uploads like `.mobi` or `.epub` no longer explode prompt token counts. (#66663) Thanks @joelnishanth. - Gateway/auth: resolve the active gateway bearer per-request on the HTTP server and the HTTP upgrade handler via `getResolvedAuth()`, mirroring the WebSocket path, so a secret rotated through `secrets.reload` or config hot-reload stops authenticating on `/v1/*`, `/tools/invoke`, plugin HTTP routes, and the canvas upgrade path immediately instead of remaining valid on HTTP until gateway restart. (#66651) Thanks @mmaps. - Agents/compaction: cap the compaction reserve-token floor to the model context window so small-context local models (e.g. Ollama with 16K tokens) no longer trigger context-overflow errors or infinite compaction loops on every prompt. (#65671) Thanks @openperf. - Agents/OpenAI Responses: classify the exact `Unknown error (no error details in response)` transport failure as failover reason `unknown` so assistant/model fallback still runs for that no-details failure path. (#65254) Thanks @OpenCodeEngineer. - Models/probe: surface invalid-model probe failures as `format` instead of `unknown` in `models list --probe`, and lock the invalid-model fallback path in with regression coverage. (#50028) Thanks @xiwuqi. - Agents/failover: classify OpenAI-compatible `finish_reason: network_error` stream failures as timeout so model fallback retries continue instead of stopping with an unknown failover reason. (#61784) thanks @lawrence3699. - Onboarding/channels: normalize channel setup metadata before discovery and validation so malformed or mixed-shape channel plugin metadata no longer breaks setup and onboarding channel lists. (#66706) Thanks @darkamenosa. - Slack/native commands: fix option menus for slash commands such as `/verbose` when Slack renders native buttons by giving each button a unique action ID while still routing them through the shared `openclaw_cmdarg*` listener. Thanks @Wangmerlyn. - Feishu/webhook: harden the webhook transport and card-action replay guards to fail closed on missing `encryptKey` and blank callback tokens — refuse to start the webhook transport without an `encryptKey`, reject unsigned requests when no key is present instead of accepting them, and drop blank card-action tokens before the dedupe claim and dispatcher. Defense-in-depth over the already-closed monitor-account layer. (#66707) Thanks @eleqtrizit. - Agents/workspace files: route `agents.files.get`, `agents.files.set`, and workspace listing through the shared `fs-safe` helpers (`openFileWithinRoot`/`readFileWithinRoot`/`writeFileWithinRoot`), reject symlink aliases for allowlisted agent files, and have `fs-safe` resolve opened-file real paths from the file descriptor before falling back to path-based `realpath` so a symlink swap between `open` and `realpath` can no longer redirect the validated path off the intended inode. (#66636) Thanks @eleqtrizit. - Gateway/MCP loopback: switch the `/mcp` bearer comparison from plain `!==` to constant-time `safeEqualSecret` (matching the convention every other auth surface in the codebase uses), and reject non-loopback browser-origin requests via `checkBrowserOrigin` before the auth gate runs. Loopback origins (`127.0.0.1:*`, `localhost:*`, same-origin) still go through, including the `localhost`↔`127.0.0.1` host mismatch that browsers flag as `Sec-Fetch-Site: cross-site`. (#66665) Thanks @eleqtrizit. - Auto-reply/billing: classify pure billing cooldown fallback summaries from structured fallback reasons so users see billing guidance instead of the generic failure reply. (#66363) Thanks @Rohan5commit. - Agents/fallback: preserve the original prompt body on model fallback retries with session history so the retrying model keeps the active task instead of only seeing a generic continue message. (#66029) Thanks @WuKongAI-CMU. - Reply/secrets: resolve active reply channel/account SecretRefs before reply-run message-action discovery so channel token SecretRefs (for example Discord) do not degrade into discovery-time unresolved-secret failures. (#66796) Thanks @joshavant. - Agents/Anthropic: ignore non-positive Anthropic Messages token overrides and fail locally when no positive token budget remains, so invalid `max_tokens` values no longer reach the provider API. (#66664) thanks @jalehman - Agents/context engines: preserve prompt-only token counts, not full request totals, when deferred maintenance reuses after-turn runtime context so background compaction bookkeeping matches the active prompt window. (#66820) thanks @jalehman. - BlueBubbles/inbound: add a persistent file-backed GUID dedupe so MessagePoller webhook replays after BB Server restart or reconnect no longer cause the agent to re-reply to already-handled messages. (#19176, #12053, #66816) Thanks @omarshahine. - Secrets/plugins/status: align SecretRef inspect-vs-strict handling across plugin preload, read-only status/agents surfaces, and runtime auth paths so unresolved refs no longer crash read-only CLI flows while runtime-required non-env refs stay strict. (#66818) Thanks @joshavant. - Memory/dreaming: stop ordinary transcripts that merely quote the dream-diary prompt from being classified as internal dreaming runs and silently dropped from session recall ingestion. (#66852) Thanks @gumadeiras. - Telegram/documents: sanitize binary reply context and ZIP-like archive extraction so `.epub` and `.mobi` uploads can no longer leak raw binary into prompt context through reply metadata or archive-to-`text/plain` coercion. (#66877) Thanks @martinfrancois. - Telegram/native commands: restore plugin-registry-backed auto defaults for native commands and native skills so Telegram slash commands keep registering when `commands.native` and `commands.nativeSkills` stay on `auto`. (#66843) Thanks @kashevk0. - OpenRouter/Qwen3: parse `reasoning_details` stream deltas as thinking content without skipping same-chunk tool calls, so Qwen3 replies no longer fail empty on OpenRouter and mixed reasoning/tool-call chunks still execute normally. (#66905) Thanks @bladin. - fix(bluebubbles): replay missed webhook messages after gateway restart via a persistent per-account cursor and `/api/v1/message/query?after=<ts>` pass, so messages delivered while the gateway was down no longer disappear. Uses the existing `processMessage` path and is deduped by #66816's inbound GUID cache. (#66857, #66721) Thanks @omarshahine. - Telegram/native commands: keep Telegram command-sync cache process-local so gateway restarts re-register the menu instead of trusting stale on-disk sync state after Telegram cleared commands out-of-band. (#66730) Thanks @nightq. - Audio/self-hosted STT: restore `models.providers.*.request.allowPrivateNetwork` for audio transcription so private or LAN speech-to-text endpoints stop tripping SSRF blocks after the v2026.4.14 regression. (#66692) Thanks @jhsmith409. - Auto-reply/media: allow workspace-rooted absolute media paths in auto-reply send flows so valid local media references no longer fail path validation. (#66689) - WhatsApp/Baileys media upload: harden encrypted upload handling so large outbound media sends avoid buffer spikes and reliability regressions. (#65966) Thanks @frankekn. - QQBot/cron: guard against undefined `event.content` in `parseFaceTags` and `filterInternalMarkers` so cron-triggered agent turns with no content payload no longer crash with `TypeError: Cannot read properties of undefined (reading 'startsWith')`. (#66302) Thanks @xinmotlanthua. - CLI/plugins: stop `--dangerously-force-unsafe-install` plugin installs from falling back to hook-pack installs after security scan failures, while still preserving non-security fallback behavior for real hook packs. (#58909) Thanks @hxy91819. - Claude CLI/sessions: classify `No conversation found with session ID` as `session_expired` so expired CLI-backed conversations clear the stale binding and recover on the next turn. (#65028) thanks @Ivan-Fn. - Context Engine: gracefully fall back to the legacy engine when a third-party context engine plugin fails at resolution time (unregistered id, factory throw, or contract violation), preventing a full gateway outage on every channel. (#66930) Thanks @openperf. - Control UI/chat: keep optimistic user message cards visible during active sends by deferring same-session history reloads until the active run ends, including aborted and errored runs. (#66997) Thanks @scotthuang and @vincentkoc. - Media/Slack: allow host-local CSV and Markdown uploads only when the fallback buffer actually decodes as text, so real plain-text files work without letting opaque non-text blobs renamed to `.csv` or `.md` slip past the host-read guard. (#67047) Thanks @Unayung. - Ollama/onboarding: split setup into `Cloud + Local`, `Cloud only`, and `Local only`, support direct `OLLAMA_API_KEY` cloud setup without a local daemon, and keep Ollama web search on the local-host path. (#67005) Thanks @obviyus. - Docker/build: verify `@matrix-org/matrix-sdk-crypto-nodejs` native bindings with `find` under `node_modules` instead of a hardcoded `.pnpm/...` path so pnpm v10+ virtual-store layouts no longer fail the image build. (#67143) Thanks @ly85206559. - Matrix/E2EE: keep startup bootstrap conservative for passwordless token-auth bots, still attempt the guarded repair pass without requiring `channels.matrix.password`, and document the remaining password-UIA limitation. (#66228) Thanks @SARAMALI15792. - Cron/announce delivery: suppress mixed-content isolated cron announce replies that end with `NO_REPLY` so trailing silent sentinels no longer leak summary text to the target channel. (#65004) Thanks @neo1027144-creator. - Plugins/bundled channels: partition bundled channel lazy caches by active bundled root so `OPENCLAW_BUNDLED_PLUGINS_DIR` flips stop reusing stale plugin, setup, secrets, and runtime state. (#67200) Thanks @gumadeiras. - Packaging/plugins: prune common test/spec cargo from bundled plugin runtime dependencies and fail npm release validation if packaged test cargo reappears, keeping published tarballs leaner without plugin-specific special cases. (#67275) Thanks @gumadeiras. - Agents/context + Memory: trim default startup/skills prompt budgets, cap `memory_get` excerpts by default with explicit continuation metadata, and keep QMD reads aligned with the same bounded excerpt contract so long sessions pull less context by default without losing deterministic follow-up reads. - Matrix/commands: skip DM pairing-store reads on room traffic now that room control-command authorization ignores pairing-store entries, keeping the room path narrower without changing room auth behavior. (#67325) Thanks @gumadeiras. - Matrix/security: block DM pairing-store entries from authorizing room control commands. (#67294) Thanks @pgondhi987. - Gateway/security: enforce `localRoots` containment on the webchat audio embedding path. (#67298) Thanks @pgondhi987. - Webchat/security: reject remote-host `file://` URLs in the media embedding path. (#67293) Thanks @pgondhi987. - Dreaming/memory-core: use the ingestion day, not the source file day, for daily recall dedupe so repeat sweeps of the same daily note can increment `dailyCount` across days instead of stalling at `1`. (#67091) Thanks @Bartok9.

OpenClaw v2026.4.15-beta.1 预发布