OpenClaw v2026.4.20-beta.2

## 2026.4.20 ### 变更 - **引导/向导**：重新设计安装安全免责声明，采用单一黄色警告横幅、分节标题和项目符号清单，并取消注释主体的淡化效果，使关键指引更易于扫描；在初始模型目录加载期间添加加载动画，避免向导在运行时出现空白；在提供商 API 密钥提示中添加“API 密钥”占位符。(#69553) 感谢 @Patrick-Erichsen。 - **代理/提示词**：强化默认系统提示词和 OpenAI GPT-5 覆盖层，包含更清晰的补全偏好、实时状态检查、弱结果恢复以及验证后最终指导。 - **模型/成本**：支持来自缓存目录和配置模型的分层模型定价，并为令牌使用情况报告包含捆绑的 Moonshot Kimi K2.6/K2.5 成本估算。(#67605) 感谢 @sliverp。 - **会话/维护**：默认强制执行内置条目上限和时效性修剪，并在加载时修剪过大存储，确保累积的 cron/执行器会话积压不会在写入路径运行前导致网关内存溢出。(#69404) 感谢 @bobrenze-bot。 - **插件/测试**：在重复的相同上下文加载中复用插件加载器别名和 Jiti 配置解析，减少导入密集型测试开销。(#69316) 感谢 @amknight。 - **Cron**：将运行时执行状态拆分为 `jobs-state.json`，使 `jobs.json` 保持稳定以进行 git 跟踪的作业定义。(#63105) 感谢 @Feelw00。 - **代理/压缩**：在上下文压缩期间发送选择加入的开始和完成通知。(#67830) 感谢 @feniix。 - **Moonshot/Kimi**：默认将捆绑的 Moonshot 安装、网络搜索和媒体理解界面设为 `kimi-k2.6`，同时保留 `kimi-k2.5` 以保持兼容性。(#69477) 感谢 @scoootscooob。 - **Moonshot/Kimi**：允许在 `moonshot/kimi-k2.6` 上设置 `thinking.keep = "all"`，并为其他 Moonshot 模型或固定 `tool_choice` 禁用思考的请求剥离该设置。(#68816) 感谢 @aniaan。 - **BlueBubbles/群组**：将每群组 `systemPrompt` 配置转发到入站上下文 `GroupSystemPrompt`，使配置的群组特定行为指令（例如线程回复和 tapback 约定）在每轮中注入。支持 `"*"` 通配符回退匹配现有的 `requireMention` 模式。关闭 #60665。(#69198) 感谢 @omarshahine。 - **插件/任务**：添加分离的运行时注册合约，使插件执行器可以拥有分离的任务生命周期和取消功能，而无需触及核心任务内部结构。(#68915) 感谢 @mbelinky。 - **终端/日志**：通过用单个正则表达式传递替换迭代控制字符剥离循环来优化 `sanitizeForLog()`，同时保留现有的 ANSI 优先消毒行为。(#67205) 感谢 @bulutmuf。 - **QA/CI**：使 `openclaw qa suite` 和 `openclaw qa telegram` 在场景失败时默认失败，为仅工件运行添加 `--allow-failures`，并为 CI 自动化收紧实时通道默认值。(#69122) 感谢 @joshavant。 - **Mattermost**：将思考、工具活动和部分回复文本流式传输到单个草稿预览帖子，并在安全时原地完成。(#47838) 感谢 @ninjaa。 ### 修复 - **Exec/YOLO**：通过 Python/Node 脚本预飞行强化路径，停止在 `security=full` 加 `ask=off` 模式下拒绝网关主机执行，因此无提示 YOLO 执行可再次直接运行解释器 stdin 和 heredoc 形式，如 `node <<'NODE' ... NODE`。 - **OpenAI Codex**：将默认 OpenAI/Codex 和 GitHub Copilot 兼容主机上的遗留 `openai-completions` 传输覆盖归一化为原生 Codex 响应传输，同时保持自定义代理不变。(#45304, #42194) 感谢 @dyss1992 和 @DeadlySilent。 - **Anthropic/插件**：将 Anthropic `api: "anthropic-messages"` 默认范围限定为 Anthropic 拥有的提供商，因此 `openai-codex` 和其他没有显式 `api` 的提供商不再被重写为错误的传输。修复 #64534。 - **fix(qqbot)**：在 uploadC2CMedia 和 uploadGroupMedia 中添加 SSRF 防护以保护直接上传 URL 路径 [AI 辅助]。(#69595) 感谢 @pgondhi987。 - **fix(gateway)**：在模板渲染的映射 sessionKeys 上强制执行 allowRequestSessionKey 门控。(#69381) 感谢 @pgondhi987。 - **Browser/Chrome MCP**：将 `DevToolsActivePort` 附加失败作为浏览器连接错误而非通用“等待标签页”超时呈现，并将已注销回退指向托管的 `openclaw` 配置。 - **Webchat/图像**：将内联图像附件视为媒体以进行空轮门控，同时仍忽略仅元数据的空白轮次。(#69474) 感谢 @Jaswir。 - **Discord/think**：仅在 `/think` 自动完成中为实际支持提供商管理自适应思考的提供商/模型对显示 `adaptive`，因此 GPT/OpenAI 模型不再广告 Anthropic 专属选项。 - **Thinking**：仅为显式支持提供商最大推理的模型公开 `max`，并在用户切换到其他模型时将存储的 `max` 设置重新映射到支持的最大思考模式。 - **Gateway/usage**：使用 FIFO 驱逐限制成本使用缓存，使日期/范围查找不会无限增长。(#68842) 感谢 @Feelw00。 - **OpenAI/Responses**：针对每个 GPT 模型支持的推理工作量解析 `/think` 级别，因此 `/think off` 不再变为高推理或发送不支持的 `reasoning.effort: "none"` 负载。 - **Lobster/TaskFlow**：允许管理的批准恢复使用无恢复令牌的 `approvalId`，并在批准等待状态中持久化该 ID。(#69559) 感谢 @kirkluokun。 - **Plugins/startup**：将捆绑的运行时依赖安装到每个插件自己的运行时目录中，在重建后复用源代码检出修复缓存，并且仅记录实际安装的包，以便在依赖存在后重复的网关启动保持安静。 - **Plugins/startup**：修复捆绑插件运行时依赖时忽略 pnpm 的 `npm_execpath`，并跳过仅工作区包规范，因此仅 npm 安装标志或本地工作区链接不会破坏打包的插件启动。 - **MCP**：为标准输入服务器阻止解释器启动环境键（如 `NODE_OPTIONS`），同时保留普通凭据和代理环境变量。(#69540) 感谢 @drobison00。 - **Agents/shell**：忽略非交互式占位符 shell（如 `/usr/bin/false` 和 `/sbin/nologin`），回退到 `sh`，因此服务用户执行运行不再立即退出。(#69308) 感谢 @sk7n4k3d。 - **Setup/TUI**：在保留配置的网关目标和认证源的同时，在新进程中重新启动安装 hatch TUI，以便 onboarding 干净地恢复终端状态，而不会在命令行参数上暴露网关密钥。(#69524) 感谢 @shakkernerd。 - **Codex**：避免在具有入站图像的本地视觉轮次上重新公开图像生成工具，并保持配置图像提供程序上的裸图像模型覆盖。(#65061) 感谢 @zhulijin1991。 - **Sessions/reset**：在 `/new` 和 `/reset` 上清除自动 sourced 模型、提供商和认证配置文件覆盖，同时保留显式用户选择，因此通道会话停止固定到运行时回退选择。(#69419) 感谢 @sk7n4k3d。 - **Sessions/costs**：像令牌计数器一样快照 `estimatedCostUsd`，因此重复持久路径不再将同一运行成本累积多达数十次。(#69403) 感谢 @MrMiaigi。 - **OpenAI Codex**：将 ChatGPT/Codex OAuth 响应请求通过 `/backend-api/codex` 端点路由，因此 `openai-codex/gpt-5.4` 不再命中已移除的 `/backend-api/responses` 别名。(#69336) 感谢 @mzogithub。 - **OpenAI/Responses**：在出站响应 API 调用前剥离孤立推理块，因此压缩或恢复的历史记录不再因独立推理项而失败。(#55787) 感谢 @suboss87。 - **Gateway/pairing**：将环回共享密钥节点主机、TUI 和网关客户端视为本地以进行配对决策，因此受信任的本地工具不再作为远程客户端重新连接并以 `pairing required` 失败。(#69431) 感谢 @SARAMALI15792。 - **Active Memory**：在提示词构建期间内存召回失败时优雅降级，记录警告并让回复在无内存上下文的情况下继续，而不是使整轮失败。(#69485) 感谢 @Magicray1217。 - **Ollama**：为 `baseUrl` 和 `models` 添加提供商策略默认值，因此隐式本地发现可在配置验证拒绝最小 Ollama 提供商配置之前运行。(#69370) 感谢 @PratikRai0101。 - **Agents/model selection**：在每轮前清除瞬态自动故障转移会话覆盖，因此恢复的主模型立即重试而不发出用户覆盖重置警告。(#69365) 感谢 @hitesh-github99。 - **Auto-reply**：按对话类型应用静默 `NO_REPLY` 策略，因此直接聊天获得有用的重写回复，而群组和内部传递可以保持安静。(#68644) 感谢 @Takhoffman。 - **Telegram/status reactions**：当生命周期状态反应启用时，遵守 `messages.removeAckAfterReply`，在成功/错误后使用配置的保持时间清除或恢复反应。(#68067) 感谢 @poiskgit。 - **Web search/plugins**：当通过共享网络搜索配置选择时，为捆绑的 Exa、Firecrawl、Gemini、Kimi、Perplexity、Tavily 和 Grok 网络搜索提供商解析插件范围 SecretRef API 密钥。(#68424) 感谢 @afurm。 - **Telegram/polling**：将默认轮询监视器阈值从 90 秒提高到 120 秒，并添加可配置的 `channels.telegram.pollingStallThresholdMs`（也按账户），因此长时间运行的 Telegram 工作有更多空间，然后轮询被视为停滞。(#57737) 感谢 @Vitalcheffe。 - **Telegram/polling**：使用客户端超时限制持久偏移确认 `getUpdates` 探测，因此僵尸套接字无法在运行程序监视器启动前挂起轮询恢复。(#50368) 感谢 @boticlaw。 - **Agents/Pi runner**：当无副作用运行时，重试无输出的静默 `stopReason=error` 轮次，因此短暂返回空错误轮次的非前沿提供商获得另一次机会而不是过早结束会话。(#68310) 感谢 @Chased1k。 - **Plugins/memory**：在只读快照插件加载运行时保留活动内存能力，因此状态和提供商发现路径不再清除内存公共产物。(#69219) 感谢 @zeroaltitude。 - **Plugins**：当不同发现的插件共享 ID 时仅保留最高优先级的清单，因此较低优先级的全局或工作区重复项不再与捆绑或配置选择的插件一起加载。(#41626) 感谢 @Tortes。 - **fix(security)**：阻止 MINIMAX_API_HOST 工作区环境注入并移除环境驱动的 URL 路由 [AI 辅助]。(#67300) 感谢 @pgondhi987。 - **Cron/delivery**：将显式 `delivery.mode: "none"` 运行视为未请求，即使运行程序报告 `delivered: false`，因此无交付 cron 作业不再持久化错误的交付失败或错误。(#69285) 感谢 @matsuri1987。 - **Plugins/install**：在打包安装中的导入前修复活动和默认启用的捆绑插件运行时依赖，因此捆绑的 Discord、WhatsApp、Slack、Telegram 和提供商插件无需将其依赖树放入核心即可工作。 - **BlueBubbles**：将出站 `/api/v1/message/text` 发送超时默认值从 10 秒提高到 30 秒，并添加可配置的 `channels.bluebubbles.sendTimeoutMs`（也按账户），因此私有 API iMessage 发送停滞 60+ 秒的 macOS 26 设置不再在 10 秒中止时静默丢失消息。探测、聊天查找和健康检查保持较短的 10 秒默认值。修复 #67486。(#69193) 感谢 @omarshahine。 - **Agents/bootstrap**：针对每文件上限预算截断标记，保留源内容而不是静默浪费引导字节，并避免极小预算截断情况下的仅标记输出。(#69114) 感谢 @BKF-Gitty。 - **Context engine/plugins**：停止拒绝 `info.id` 与注册插件槽 ID 不同的第三方上下文引擎。2026.4.14 添加的严格匹配合约破坏了 `lossless-claw` 和其他内部引擎 ID 不等于其注册下的槽 ID 的插件，在每轮产生重复的 `info.id must match registered id` 通道失败。修复 #66601。(#66678) 感谢 @GodsBoy。 - **Agents/compaction**：将嵌入式 Pi 压缩生命周期事件重命名为 `compaction_start` / `compaction_end`，使 OpenClaw 与 `pi-coding-agent` 0.66.1 事件命名保持一致。(#67713) 感谢 @mpz4life。 - **Security/dotenv**：阻止来自不受信任工作区 `.env` 文件的所有 `OPENCLAW_*` 键，因此工作区本地环境加载对新运行时控制变量失败关闭，而不是静默继承它们。(#473) - **Gateway/device pairing**：将非管理员配对设备会话（设备令牌认证）限制到它们自己的配对列表、批准和拒绝操作，因此配对设备无法枚举其他设备或批准/拒绝另一设备授权的配对请求。管理员和共享密钥操作员会话保留完全可见性。(#69375) 感谢 @eleqtrizit。 - **Agents/gateway tool**：扩展面向代理的 `gateway` 工具的配置变异保护，因此模型驱动的 `config.patch` 和 `config.apply` 无法重写操作员受信任的路径（沙箱、插件信任、网关认证/TLS、钩子路由和令牌、SSRF 策略、MCP 服务器、工作区文件系统强化），并且无法通过在 `agents.list[]` 下编辑每代理沙箱、工具或嵌入式 Pi 覆盖来绕过保护。(#69377) 感谢 @eleqtrizit。 - **Gateway/websocket broadcasts**：为聊天、代理和工具结果事件帧要求 `operator.read`（或更高），因此配对范围和节点角色会话不再被动接收会话聊天内容，并默认范围门控未知广播事件。插件定义的 `plugin.*` 广播范围限定为 operator.write/admin，状态/传输事件（`heartbeat`、`presence`、`tick` 等）保持无限制。每客户端序列号保持每连接单调性。(#69373) 感谢 @eleqtrizit。 - **Agents/compaction**：始终通过显式加载器重新加载嵌入式 Pi 资源并重新应用保留令牌覆盖，因此无扩展工厂的运行在会话开始前不再静默丢失压缩设置。(#67146) 感谢 @ly85206559。 - **Memory-core/dreaming**：归一化扫描时间戳并为回退清理复用哈希叙述会话密钥，因此 Dreaming 叙述子会话停止泄漏。(#67023) 感谢 @chiyouYCH。 - **Gateway/startup**：延迟 HTTP 绑定直到附加 websocket 处理程序，因此启动后立即的 websocket 健康/连接探测不再命中启动竞争窗口。(#43392) 感谢 @dalefrieswthat。 - **Codex/app-server**：当下游使用者在排空 `turn/completed` 通知时抛出，释放会话通道，因此 Codex 插件回复后的后续消息停止在陈旧通道锁后排队。修复 #67996。(#69072) 感谢 @ayeshakhalid192007-dev。 - **Codex/app-server**：将默认批准处理设为 `on-request`，因此 Codex harness 会话不会以过于宽松的工具批准开始。(#68721) 感谢 @Lucenx9。 - **Cron/delivery**：保持隔离的 cron 聊天交付工具可用，从网关解析 `channel: "last"` 目标，在 `cron list/show` 中显示交付预览，并避免直接消息工具交付后的重复回退发送。(#69587) 感谢 @obviyus。 - **Cron/Telegram**：将隔离直接交付去重键设为每个 cron 执行而不是重复使用的会话 ID，因此重复的 Telegram 公告运行不再报告已交付而静默跳过后续发送。(#69000) 感谢 @obviyus。 - **Models/Kimi**：默认捆绑 Kimi 思考关闭并归一化 Anthropic 兼容 `thinking` 负载，因此过时会话 `/think` 状态不再静默在 Kimi 运行上重新启用推理。(#68907) 感谢 @frankekn。 - **Control UI/cron**：在创建或编辑作业时，防止运行时仅 `last` 交付哨兵被物化为持久化 cron 交付和失败警报通道配置。(#68829) 感谢 @tianhaocui。 - **OpenAI/Responses**：在出站响应 API 调用前剥离孤立推理块，因此压缩或恢复的历史记录不再因独立推理项失败。(#55787) 感谢 @suboss87。 - **Cron/CLI**：以与逗号分隔输入相同的方式解析 PowerShell 风格 `--tools` 允许列表，因此 `cron add` 和 `cron edit` 不再在 Windows 上将 `exec read write` 持久化为一个组合工具条目。(#68858) 感谢 @chen-zhang-cs-code。 - **Browser/user-profile**：让现有会话 `profile="user"` 工具调用自动路由到连接的浏览器节点或使用显式 `target="node"`，同时仍遵守显式 `target="host"` 固定。(#48677) - **Discord/slash commands**：容忍斜杠命令和模型选择器流程中的部分 Discord 频道元数据，因此部分频道对象在频道名称、主题或线程父元数据不可用时不再崩溃。(#68953) 感谢 @dutifulbob。 - **BlueBubbles**：通过一次在构造时解析 SSRF 策略的类型化 `BlueBubblesClient` 整合出站 HTTP，因此图像附件停止在 localhost 上被阻止，反应停止在私有 IP BB 部署上被阻止。修复 #34749 和 #59722。(#68234) 感谢 @omarshahine。 - **Cron/gateway**：在添加/更新时拒绝模糊的公告交付配置，因此无效的多通道或目标 ID 提供商设置提前失败而不是持久化损坏的 cron 作业。(#69015) 感谢 @obviyus。 - **Cron/main-session delivery**：通过延迟唤醒排队、网关唤醒转发和相同目标唤醒合并保留 `heartbeat.target="last"`，因此排队的 cron 回复仍返回到最后活跃聊天。(#69021) 感谢 @obviyus。 - **Cron/gateway**：检查公告交付歧义时忽略禁用通道，并针对实时 cron 服务默认代理验证主会话交付补丁，因此热重载代理配置不会错误拒绝有效更新。(#69040) 感谢 @obviyus。 - **Matrix/allowlists**：在入站消息上热重载 `dm.allowFrom` 和 `groupAllowFrom` 条目，同时保持配置删除的权威性，因此 Matrix 允许列表更改不再需要通道重启来添加或撤销发送者。(#68546) 感谢 @johnlanni。 - **BlueBubbles**：始终在出站文本发送上显式设置 `method`（可用时为 `"private-api"`，否则为 `"apple-script"`），并在 macOS 26 上即使对于纯文本也优先使用私有 API。修复 macOS 设置无私有 API 时静默交付失败（省略的 `method` 让 BB 服务器回退到版本相关默认行为静默丢弃消息 (#64480)）和 macOS 26 Tahoe 纯文本发送的 AppleScript `-1700` 错误 (#53159)。(#69070) 感谢 @xqing3。 - **Matrix/commands**：识别以 bot 的 Matrix 提及为前缀的斜杠命令，因此 `@bot:server /new` 等房间消息触发命令路径而无需自定义提及正则表达式。(#68570) 感谢 @nightq 和 @johnlanni。 - **Gateway/pairing**：返回原因特定的 `PAIRING_REQUIRED` 详情、修复提示和请求 ID，因此未批准设备和范围升级失败在 CLI 和控制 UI 中显示可操作的恢复指导。(#69227) 感谢 @obviyus。 - **Agents/subagents**：在子代理失败负载中包含请求的角色和运行时计时，因此父代理可以关联失败或超时的子工作。(#68726) 感谢 @BKF-Gitty。 - **Gateway/sessions**：在代理从配置中移除后拒绝过时的代理范围会话，同时保留遗留默认代理主会话别名。(#65986) 感谢 @bittoby。 - **Doctor/gateway**：显示待处理设备配对请求、范围升级批准漂移和陈旧设备令牌不匹配修复步骤，因此 `openclaw doctor --fix` 不再让配对/认证设置失败 unexplained。(#69210) 感谢 @obviyus。 - **Cron/isolated-agent**：为隔离运行保留显式 `delivery.mode: "none"` 消息目标，而不继承隐式 `last` 路由，因此代理发起的 Telegram 发送保留其作者目的地，而裸 `mode:none` 作业保持无目标。(#69153) 感谢 @obviyus。 - **Cron/isolated-agent**：防止 `delivery.mode: "none"` 仅账户或仅线程配置继承过时隐式收件人，因此隔离运行仅在作业作者显式 `to` 目标时解析消息路由。(#69163) 感谢 @obviyus。 - **Gateway/TUI**：在本地网关仍在完成启动时重试会话历史，因此 `openclaw tui` 重新连接不再因瞬态 `chat.history unavailable during gateway startup` 错误失败。(#69164) 感谢 @shakkernerd。 - **BlueBubbles/reactions**：当代理使用 iMessage tapback 集（`love`/`like`/`dislike`/`laugh`/`emphasize`/`question`）外的表情符号反应时回退到 `love`，因此更广泛词汇的模型反应（如 `👀`）仍产生可见 tapback 而不是失败整个反应请求。配置的 ack 反应仍通过新的 `normalizeBlueBubblesReactionInputStrict` 路径严格验证。(#64693) 感谢 @zqchris。 - **BlueBubbles**：当同一句柄存在两者时优先选择 iMessage 而非 SMS，遵守显式 `sms:` 目标，并且从不静默降级可用的 iMessage 收件人。(#61781) 感谢 @rmartin。 - **Telegram/setup**：在安装期间要求数字 `allowFrom` 用户 ID 而不是提供不支持的 `@username` DM 解析，并将操作员指向 `from.id`/`getUpdates` 进行发现。(#69191) 感谢 @obviyus。 - **GitHub Copilot/onboarding**：将 GitHub Copilot 安装默认设为 `claude-opus-4.6` 并保持捆绑默认模型列表对齐，因此新的 Copilot 安装不再以较旧的 `gpt-4o` 默认开始。(#69207) 感谢 @obviyus。 - **Gateway/status**：分离可达性、能力和读取探测报告，因此仅连接或范围受限的会话不再看起来完全健康，并归一化以 `ssh user@host` 输入的 SSH 目标。(#69215) 感谢 @obviyus。 - **Slack**：修复通过 `file` 或 `exec` 密钥源配置的账户出站回复失败“未解析 SecretRef”；发送路径现在容忍运行时快照保留未解析通道 SecretRef，当启动解析的令牌覆盖已可用时。(#68954) 感谢 @openperf。 - **Control UI/device pairing**：在重新连接期间解释范围和角色批准升级，并在控制 UI 和 `openclaw devices` 中显示请求与批准访问，因此更广泛的重新连接不再看起来像丢失配对。(#69221) 感谢 @obviyus。 - **Gateway/Control UI**：在认证错误和控制 UI 提示中显示待处理范围、角色和设备元数据配对批准，因此更广泛的重新连接不再看起来像随机认证中断。(#69226) 感谢 @obviyus。

## 2026.4.20 ### Changes - Onboard/wizard: restyle the setup security disclaimer with a single yellow warning banner, section headings and bulleted checklists, and un-dim the note body so key guidance is easy to scan; add a loading spinner during the initial model catalog load so the wizard no longer goes blank while it runs; add an "API key" placeholder to provider API key prompts. (#69553) Thanks @Patrick-Erichsen. - Agents/prompts: strengthen the default system prompt and OpenAI GPT-5 overlay with clearer completion bias, live-state checks, weak-result recovery, and verification-before-final guidance. - Models/costs: support tiered model pricing from cached catalogs and configured models, and include bundled Moonshot Kimi K2.6/K2.5 cost estimates for token-usage reports. (#67605) Thanks @sliverp. - Sessions/Maintenance: enforce the built-in entry cap and age prune by default, and prune oversized stores at load time so accumulated cron/executor session backlogs cannot OOM the gateway before the write path runs. (#69404) Thanks @bobrenze-bot. - Plugins/tests: reuse plugin loader alias and Jiti config resolution across repeated same-context loads, reducing import-heavy test overhead. (#69316) Thanks @amknight. - Cron: split runtime execution state into `jobs-state.json` so `jobs.json` stays stable for git-tracked job definitions. (#63105) Thanks @Feelw00. - Agents/compaction: send opt-in start and completion notices during context compaction. (#67830) Thanks @feniix. - Moonshot/Kimi: default bundled Moonshot setup, web search, and media-understanding surfaces to `kimi-k2.6` while keeping `kimi-k2.5` available for compatibility. (#69477) Thanks @scoootscooob. - Moonshot/Kimi: allow `thinking.keep = "all"` on `moonshot/kimi-k2.6`, and strip it for other Moonshot models or requests where pinned `tool_choice` disables thinking. (#68816) Thanks @aniaan. - BlueBubbles/groups: forward per-group `systemPrompt` config into inbound context `GroupSystemPrompt` so configured group-specific behavioral instructions (for example threaded-reply and tapback conventions) are injected on every turn. Supports `"*"` wildcard fallback matching the existing `requireMention` pattern. Closes #60665. (#69198) Thanks @omarshahine. - Plugins/tasks: add a detached runtime registration contract so plugin executors can own detached task lifecycle and cancellation without reaching into core task internals. (#68915) Thanks @mbelinky. - Terminal/logging: optimize `sanitizeForLog()` by replacing the iterative control-character stripping loop with a single regex pass while preserving the existing ANSI-first sanitization behavior. (#67205) Thanks @bulutmuf. - QA/CI: make `openclaw qa suite` and `openclaw qa telegram` fail by default when scenarios fail, add `--allow-failures` for artifact-only runs, and tighten live-lane defaults for CI automation. (#69122) Thanks @joshavant. - Mattermost: stream thinking, tool activity, and partial reply text into a single draft preview post that finalizes in place when safe. (#47838) thanks @ninjaa. ### Fixes - Exec/YOLO: stop rejecting gateway-host exec in `security=full` plus `ask=off` mode via the Python/Node script preflight hardening path, so promptless YOLO exec once again runs direct interpreter stdin and heredoc forms such as `node <<'NODE' ... NODE`. - OpenAI Codex: normalize legacy `openai-completions` transport overrides on default OpenAI/Codex and GitHub Copilot-compatible hosts back to the native Codex Responses transport while leaving custom proxies untouched. (#45304, #42194) Thanks @dyss1992 and @DeadlySilent. - Anthropic/plugins: scope Anthropic `api: "anthropic-messages"` defaulting to Anthropic-owned providers, so `openai-codex` and other providers without an explicit `api` no longer get rewritten to the wrong transport. Fixes #64534. - fix(qqbot): add SSRF guard to direct-upload URL paths in uploadC2CMedia and uploadGroupMedia [AI-assisted]. (#69595) Thanks @pgondhi987. - fix(gateway): enforce allowRequestSessionKey gate on template-rendered mapping sessionKeys. (#69381) Thanks @pgondhi987. - Browser/Chrome MCP: surface `DevToolsActivePort` attach failures as browser-connectivity errors instead of a generic "waiting for tabs" timeout, and point signed-out fallbacks toward the managed `openclaw` profile. - Webchat/images: treat inline image attachments as media for empty-turn gating while still ignoring metadata-only blank turns. (#69474) Thanks @Jaswir. - Discord/think: only show `adaptive` in `/think` autocomplete for provider/model pairs that actually support provider-managed adaptive thinking, so GPT/OpenAI models no longer advertise an Anthropic-only option. - Thinking: only expose `max` for models that explicitly support provider max reasoning, and remap stored `max` settings to the largest supported thinking mode when users switch to another model. - Gateway/usage: bound the cost usage cache with FIFO eviction so date/range lookups cannot grow unbounded. (#68842) Thanks @Feelw00. - OpenAI/Responses: resolve `/think` levels against each GPT model's supported reasoning efforts so `/think off` no longer becomes high reasoning or sends unsupported `reasoning.effort: "none"` payloads. - Lobster/TaskFlow: allow managed approval resumes to use `approvalId` without a resume token, and persist that id in approval wait state. (#69559) Thanks @kirkluokun. - Plugins/startup: install bundled runtime dependencies into each plugin's own runtime directory, reuse source-checkout repair caches after rebuilds, and log only packages that were actually installed so repeated Gateway starts stay quiet once deps are present. - Plugins/startup: ignore pnpm's `npm_execpath` when repairing bundled plugin runtime dependencies and skip workspace-only package specs so npm-only install flags or local workspace links do not break packaged plugin startup. - MCP: block interpreter-startup env keys such as `NODE_OPTIONS` for stdio servers while preserving ordinary credential and proxy env vars. (#69540) Thanks @drobison00. - Agents/shell: ignore non-interactive placeholder shells like `/usr/bin/false` and `/sbin/nologin`, falling back to `sh` so service-user exec runs no longer exit immediately. (#69308) Thanks @sk7n4k3d. - Setup/TUI: relaunch the setup hatch TUI in a fresh process while preserving the configured gateway target and auth source, so onboarding recovers terminal state cleanly without exposing gateway secrets on command-line args. (#69524) Thanks @shakkernerd. - Codex: avoid re-exposing the image-generation tool on native vision turns with inbound images, and keep bare image-model overrides on the configured image provider. (#65061) Thanks @zhulijin1991. - Sessions/reset: clear auto-sourced model, provider, and auth-profile overrides on `/new` and `/reset` while preserving explicit user selections, so channel sessions stop staying pinned to runtime fallback choices. (#69419) Thanks @sk7n4k3d. - Sessions/costs: snapshot `estimatedCostUsd` like token counters so repeated persist paths no longer compound the same run cost by up to dozens of times. (#69403) Thanks @MrMiaigi. - OpenAI Codex: route ChatGPT/Codex OAuth Responses requests through the `/backend-api/codex` endpoint so `openai-codex/gpt-5.4` no longer hits the removed `/backend-api/responses` alias. (#69336) Thanks @mzogithub. - OpenAI/Responses: omit disabled reasoning payloads when `/think off` is active, so GPT reasoning models no longer receive unsupported `reasoning.effort: "none"` requests. (#61982) Thanks @a-tokyo. - Gateway/pairing: treat loopback shared-secret node-host, TUI, and gateway clients as local for pairing decisions, so trusted local tools no longer reconnect as remote clients and fail with `pairing required`. (#69431) Thanks @SARAMALI15792. - Active Memory: degrade gracefully when memory recall fails during prompt building, logging a warning and letting the reply continue without memory context instead of failing the whole turn. (#69485) Thanks @Magicray1217. - Ollama: add provider-policy defaults for `baseUrl` and `models` so implicit local discovery can run before config validation rejects a minimal Ollama provider config. (#69370) Thanks @PratikRai0101. - Agents/model selection: clear transient auto-failover session overrides before each turn so recovered primary models are retried immediately without emitting user-override reset warnings. (#69365) Thanks @hitesh-github99. - Auto-reply: apply silent `NO_REPLY` policy per conversation type, so direct chats get a helpful rewritten reply while groups and internal deliveries can remain quiet. (#68644) Thanks @Takhoffman. - Telegram/status reactions: honor `messages.removeAckAfterReply` when lifecycle status reactions are enabled, clearing or restoring the reaction after success/error using the configured hold timings. (#68067) Thanks @poiskgit. - Web search/plugins: resolve plugin-scoped SecretRef API keys for bundled Exa, Firecrawl, Gemini, Kimi, Perplexity, Tavily, and Grok web-search providers when they are selected through the shared web-search config. (#68424) Thanks @afurm. - Telegram/polling: raise the default polling watchdog threshold from 90s to 120s and add configurable `channels.telegram.pollingStallThresholdMs` (also per-account) so long-running Telegram work gets more room before polling is treated as stalled. (#57737) Thanks @Vitalcheffe. - Telegram/polling: bound the persisted-offset confirmation `getUpdates` probe with a client-side timeout so a zombie socket cannot hang polling recovery before the runner watchdog starts. (#50368) Thanks @boticlaw. - Agents/Pi runner: retry silent `stopReason=error` turns with no output when no side effects ran, so non-frontier providers that briefly return empty error turns get another chance instead of ending the session early. (#68310) Thanks @Chased1k. - Plugins/memory: preserve the active memory capability when read-only snapshot plugin loads run, so status and provider discovery paths no longer wipe memory public artifacts. (#69219) Thanks @zeroaltitude. - Plugins: keep only the highest-precedence manifest when distinct discovered plugins share an id, so lower-precedence global or workspace duplicates no longer load beside bundled or config-selected plugins. (#41626) Thanks @Tortes. - fix(security): block MINIMAX_API_HOST workspace env injection and remove env-driven URL routing [AI-assisted]. (#67300) Thanks @pgondhi987. - Cron/delivery: treat explicit `delivery.mode: "none"` runs as not requested even if the runner reports `delivered: false`, so no-delivery cron jobs no longer persist false delivery failures or errors. (#69285) Thanks @matsuri1987. - Plugins/install: repair active and default-enabled bundled plugin runtime dependencies before import in packaged installs, so bundled Discord, WhatsApp, Slack, Telegram, and provider plugins work without putting their dependency trees in core. - BlueBubbles: raise the outbound `/api/v1/message/text` send timeout default from 10s to 30s, and add a configurable `channels.bluebubbles.sendTimeoutMs` (also per-account) so macOS 26 setups where Private API iMessage sends stall for 60+ seconds no longer silently lose messages at the 10s abort. Probes, chat lookups, and health checks keep the shorter 10s default. Fixes #67486. (#69193) Thanks @omarshahine. - Agents/bootstrap: budget truncation markers against per-file caps, preserve source content instead of silently wasting bootstrap bytes, and avoid marker-only output in tiny-budget truncation cases. (#69114) Thanks @BKF-Gitty. - Context engine/plugins: stop rejecting third-party context engines whose `info.id` differs from the registered plugin slot id. The strict-match contract added in 2026.4.14 broke `lossless-claw` and other plugins whose internal engine id does not equal the slot id they are registered under, producing repeated `info.id must match registered id` lane failures on every turn. Fixes #66601. (#66678) Thanks @GodsBoy. - Agents/compaction: rename embedded Pi compaction lifecycle events to `compaction_start` / `compaction_end` so OpenClaw stays aligned with `pi-coding-agent` 0.66.1 event naming. (#67713) Thanks @mpz4life. - Security/dotenv: block all `OPENCLAW_*` keys from untrusted workspace `.env` files so workspace-local env loading fails closed for new runtime-control variables instead of silently inheriting them. (#473) - Gateway/device pairing: restrict non-admin paired-device sessions (device-token auth) to their own pairing list, approve, and reject actions so a paired device cannot enumerate other devices or approve/reject pairing requests authored by another device. Admin and shared-secret operator sessions retain full visibility. (#69375) Thanks @eleqtrizit. - Agents/gateway tool: extend the agent-facing `gateway` tool's config mutation guard so model-driven `config.patch` and `config.apply` cannot rewrite operator-trusted paths (sandbox, plugin trust, gateway auth/TLS, hook routing and tokens, SSRF policy, MCP servers, workspace filesystem hardening) and cannot bypass the guard by editing per-agent sandbox, tools, or embedded-Pi overrides in place under `agents.list[]`. (#69377) Thanks @eleqtrizit. - Gateway/websocket broadcasts: require `operator.read` (or higher) for chat, agent, and tool-result event frames so pairing-scoped and node-role sessions no longer passively receive session chat content, and scope-gate unknown broadcast events by default. Plugin-defined `plugin.*` broadcasts are scoped to operator.write/admin, and status/transport events (`heartbeat`, `presence`, `tick`, etc.) remain unrestricted. Per-client sequence numbers preserve per-connection monotonicity. (#69373) Thanks @eleqtrizit. - Agents/compaction: always reload embedded Pi resources through an explicit loader and reapply reserve-token overrides so runs without extension factories no longer silently lose compaction settings before session start. (#67146) Thanks @ly85206559. - Memory-core/dreaming: normalize sweep timestamps and reuse hashed narrative session keys for fallback cleanup so Dreaming narrative sub-sessions stop leaking. (#67023) Thanks @chiyouYCH. - Gateway/startup: delay HTTP bind until websocket handlers are attached, so immediate post-startup websocket health/connect probes no longer hit the startup race window. (#43392) Thanks @dalefrieswthat. - Codex/app-server: release the session lane when a downstream consumer throws while draining the `turn/completed` notification, so follow-up messages after a Codex plugin reply stop queueing behind a stale lane lock. Fixes #67996. (#69072) Thanks @ayeshakhalid192007-dev. - Codex/app-server: default approval handling to `on-request` so Codex harness sessions do not start with overly permissive tool approvals. (#68721) Thanks @Lucenx9. - Cron/delivery: keep isolated cron chat delivery tools available, resolve `channel: "last"` targets from the gateway, show delivery previews in `cron list/show`, and avoid duplicate fallback sends after direct message-tool delivery. (#69587) Thanks @obviyus. - Cron/Telegram: key isolated direct-delivery dedupe to each cron execution instead of the reused session id, so recurring Telegram announce runs no longer report delivered while silently skipping later sends. (#69000) Thanks @obviyus. - Models/Kimi: default bundled Kimi thinking to off and normalize Anthropic-compatible `thinking` payloads so stale session `/think` state no longer silently re-enables reasoning on Kimi runs. (#68907) Thanks @frankekn. - Control UI/cron: keep the runtime-only `last` delivery sentinel from being materialized into persisted cron delivery and failure-alert channel configs when jobs are created or edited. (#68829) Thanks @tianhaocui. - OpenAI/Responses: strip orphaned reasoning blocks before outbound Responses API calls so compacted or restored histories no longer fail on standalone reasoning items. (#55787) Thanks @suboss87. - Cron/CLI: parse PowerShell-style `--tools` allow-lists the same way as comma-separated input, so `cron add` and `cron edit` no longer persist `exec read write` as one combined tool entry on Windows. (#68858) Thanks @chen-zhang-cs-code. - Browser/user-profile: let existing-session `profile="user"` tool calls auto-route to a connected browser node or use explicit `target="node"`, while still honoring explicit `target="host"` pinning. (#48677) - Discord/slash commands: tolerate partial Discord channel metadata in slash-command and model-picker flows so partial channel objects no longer crash when channel names, topics, or thread parent metadata are unavailable. (#68953) Thanks @dutifulbob. - BlueBubbles: consolidate outbound HTTP through a typed `BlueBubblesClient` that resolves the SSRF policy once at construction so image attachments stop getting blocked on localhost and reactions stop getting blocked on private-IP BB deployments. Fixes #34749 and #59722. (#68234) Thanks @omarshahine. - Cron/gateway: reject ambiguous announce delivery config at add/update time so invalid multi-channel or target-id provider settings fail early instead of persisting broken cron jobs. (#69015) Thanks @obviyus. - Cron/main-session delivery: preserve `heartbeat.target="last"` through deferred wake queuing, gateway wake forwarding, and same-target wake coalescing so queued cron replies still return to the last active chat. (#69021) Thanks @obviyus. - Cron/gateway: ignore disabled channels when announce delivery ambiguity is checked, and validate main-session delivery patches against the live cron service default agent so hot-reloaded agent config does not falsely reject valid updates. (#69040) Thanks @obviyus. - Matrix/allowlists: hot-reload `dm.allowFrom` and `groupAllowFrom` entries on inbound messages while keeping config removals authoritative, so Matrix allowlist changes no longer require a channel restart to add or revoke a sender. (#68546) Thanks @johnlanni. - BlueBubbles: always set `method` explicitly on outbound text sends (`"private-api"` when available, `"apple-script"` otherwise), and prefer Private API on macOS 26 even for plain text. Fixes silent delivery failure on macOS setups without Private API where an omitted `method` let BB Server fall back to version-dependent default behavior that silently drops the message (#64480), and the AppleScript `-1700` error on macOS 26 Tahoe plain text sends (#53159). (#69070) Thanks @xqing3. - Matrix/commands: recognize slash commands that are prefixed with the bot's Matrix mention, so room messages like `@bot:server /new` trigger the command path without requiring custom mention regexes. (#68570) Thanks @nightq and @johnlanni. - Gateway/pairing: return reason-specific `PAIRING_REQUIRED` details, remediation hints, and request ids so unapproved-device and scope-upgrade failures surface actionable recovery guidance in the CLI and Control UI. (#69227) Thanks @obviyus. - Agents/subagents: include requested role and runtime timing on subagent failure payloads so parent agents can correlate failed or timed-out child work. (#68726) Thanks @BKF-Gitty. - Gateway/sessions: reject stale agent-scoped sessions after an agent is removed from config while preserving legacy default-agent main-session aliases. (#65986) Thanks @bittoby. - Doctor/gateway: surface pending device pairing requests, scope-upgrade approval drift, and stale device-token mismatch repair steps so `openclaw doctor --fix` no longer leaves pairing/auth setup failures unexplained. (#69210) Thanks @obviyus. - Cron/isolated-agent: preserve explicit `delivery.mode: "none"` message targets for isolated runs without inheriting implicit `last` routing, so agent-initiated Telegram sends keep their authored destination while bare `mode:none` jobs stay targetless. (#69153) Thanks @obviyus. - Cron/isolated-agent: keep `delivery.mode: "none"` account-only or thread-only configs from inheriting a stale implicit recipient, so isolated runs only resolve message routing when the job authored an explicit `to` target. (#69163) Thanks @obviyus. - Gateway/TUI: retry session history while the local gateway is still finishing startup, so `openclaw tui` reconnects no longer fail on transient `chat.history unavailable during gateway startup` errors. (#69164) Thanks @shakkernerd. - BlueBubbles/reactions: fall back to `love` when an agent reacts with an emoji outside the iMessage tapback set (`love`/`like`/`dislike`/`laugh`/`emphasize`/`question`), so wider-vocabulary model reactions like `👀` still produce a visible tapback instead of failing the whole reaction request. Configured ack reactions still validate strictly via the new `normalizeBlueBubblesReactionInputStrict` path. (#64693) Thanks @zqchris. - BlueBubbles: prefer iMessage over SMS when both chats exist for the same handle, honor explicit `sms:` targets, and never silently downgrade iMessage-available recipients. (#61781) Thanks @rmartin. - Telegram/setup: require numeric `allowFrom` user IDs during setup instead of offering unsupported `@username` DM resolution, and point operators to `from.id`/`getUpdates` for discovery. (#69191) Thanks @obviyus. - GitHub Copilot/onboarding: default GitHub Copilot setup to `claude-opus-4.6` and keep the bundled default model list aligned, so new Copilot setups no longer start on the older `gpt-4o` default. (#69207) Thanks @obviyus. - Gateway/status: separate reachability, capability, and read-probe reporting so connect-only or scope-limited sessions no longer look fully healthy, and normalize SSH targets entered as `ssh user@host`. (#69215) Thanks @obviyus. - Slack: fix outbound replies failing with "unresolved SecretRef" for accounts configured via `file` or `exec` secret sources; the send path now tolerates the runtime snapshot retaining an unresolved channel SecretRef when a boot-resolved token override is already available. (#68954) Thanks @openperf. - Control UI/device pairing: explain scope and role approval upgrades during reconnects, and show requested versus approved access in the Control UI and `openclaw devices` so broader reconnects no longer look like lost pairings. (#69221) Thanks @obviyus. - Gateway/Control UI: surface pending scope, role, and device-metadata pairing approvals in auth errors and Control UI hints so broader reconnects no longer look like random auth breakage. (#69226) Thanks @obviyus.

OpenClaw v2026.4.20-beta.2 预发布