OpenClaw v2026.4.20 - 更新日志

## 2026.4.20 ### 变更 - **初始化/向导**：重新设计安装安全免责声明，采用单一黄色警告横幅、分节标题和项目符号清单，并取消注释区域的淡化效果，使关键指引更易扫描；在初始模型目录加载期间添加加载动画，避免向导在运行时出现空白；在提供商API密钥提示中添加“API密钥”占位符。(#69553) 感谢 @Patrick-Erichsen。 - **代理/提示词**：强化默认系统提示词和OpenAI GPT-5覆盖层，加入更清晰的补全偏差、实时状态检查、弱结果恢复以及验证后最终指导。 - **模型/成本**：支持来自缓存目录和配置模型的分层模型定价，并为令牌使用报告包含捆绑的Moonshot Kimi K2.6/K2.5成本估算。(#67605) 感谢 @sliverp。 - **会话/维护**：默认强制执行内置的条目上限和时效性修剪，并在加载时修剪超大的存储，以免累积的cron/执行器会话积压导致网关在写入路径运行前发生内存溢出。(#69404) 感谢 @bobrenze-bot。 - **插件/测试**：在重复的相同上下文加载中复用插件加载器别名和Jiti配置解析，减少导入密集型测试开销。(#69316) 感谢 @amknight。 - **Cron**：将运行时执行状态拆分为 `jobs-state.json`，使 `jobs.json` 保持稳定以用于git跟踪的作业定义。(#63105) 感谢 @Feelw00。 - **代理/压缩**：在上下文压缩期间发送选择加入的开始和完成通知。(#67830) 感谢 @feniix。 - **Moonshot/Kimi**：默认将捆绑的Moonshot设置、网络搜索和媒体理解界面设为 `kimi-k2.6`，同时保留 `kimi-k2.5` 以兼容旧版本。(#69477) 感谢 @scoootscooob。 - **Moonshot/Kimi**：允许在 `moonshot/kimi-k2.6` 上设置 `thinking.keep = "all"`，并为其他Moonshot模型或固定了 `tool_choice` 而禁用思考的请求剥离该设置。(#68816) 感谢 @aniaan。 - **BlueBubbles/群组**：将每组的 `systemPrompt` 配置转发到入站上下文的 `GroupSystemPrompt` 中，以便配置的群组特定行为指令（例如线程回复和tapback约定）在每一轮都被注入。支持 `"*"` 通配符回退匹配现有的 `requireMention` 模式。关闭 #60665。(#69198) 感谢 @omarshahine。 - **插件/任务**：添加分离的运行时注册合约，使插件执行器可以拥有分离的任务生命周期和取消功能，而无需触及核心任务内部结构。(#68915) 感谢 @mbelinky。 - **终端/日志**：通过用单个正则表达式替换迭代控制字符剥离循环来优化 `sanitizeForLog()`，同时保留现有的ANSI优先消毒行为。(#67205) 感谢 @bulutmuf。 - **QA/CI**：使 `openclaw qa suite` 和 `openclaw qa telegram` 在场景失败时默认失败，为仅生成产物的运行添加 `--allow-failures`，并为CI自动化收紧实时通道默认值。(#69122) 感谢 @joshavant。 - **Mattermost**：将思考过程、工具活动和部分回复文本流式传输到单个草稿预览帖子中，并在安全时原地定稿。(#47838) 感谢 @ninjaa。 ### 修复 - **Exec/YOLO**：通过Python/Node脚本预飞行强化路径，停止在 `security=full` 加 `ask=off` 模式下拒绝网关主机执行，使无提示词的YOLO执行能再次直接运行解释器stdin和heredoc形式（如 `node <<'NODE' ... NODE`）。 - **OpenAI Codex**：将默认OpenAI/Codex和GitHub Copilot兼容主机上的遗留 `openai-completions` 传输覆盖项规范化为原生Codex Responses传输，同时保持自定义代理不变。(#45304, #42194) 感谢 @dyss1992 和 @DeadlySilent。 - **Anthropic/插件**：将Anthropic `api: "anthropic-messages"` 默认范围限定为Anthropic拥有的提供商，因此 `openai-codex` 和其他没有显式 `api` 的提供商不再被重写到错误的传输。修复 #64534。 - **fix(qqbot)**：在 uploadC2CMedia 和 uploadGroupMedia 中为直接上传URL路径添加SSRF防护 [AI辅助]。(#69595) 感谢 @pgondhi987。 - **fix(gateway)**：在模板渲染的映射 sessionKeys 上强制执行 allowRequestSessionKey 门控。(#69381) 感谢 @pgondhi987。 - **Browser/Chrome MCP**：将 `DevToolsActivePort` 附加失败作为浏览器连接错误而非通用的“等待标签页”超时抛出，并引导签出回退到托管的 `openclaw` 配置文件。 - **Webchat/图像**：将内联图像附件视为媒体以进行空回合门控，同时仍忽略仅元数据的空白回合。(#69474) 感谢 @Jaswir。 - **Discord/think**：仅在 `/think` 自动补全中为实际支持提供商托管自适应思考的提供商/模型对显示 `adaptive`，因此GPT/OpenAI模型不再广告Anthropic专属选项。 - **Thinking**：仅为显式支持提供商最大推理的模型暴露 `max`，并在用户切换到其他模型时将存储的 `max` 设置重新映射到支持的最大思考模式。 - **Gateway/使用情况**：使用FIFO逐出限制成本使用缓存，以免日期/范围查找无限制增长。(#68842) 感谢 @Feelw00。 - **OpenAI/Responses**：针对每个GPT模型支持的推理工作量解析 `/think` 级别，因此 `/think off` 不再变为高推理或发送不支持的 `reasoning.effort: "none"` 负载。 - **Lobster/TaskFlow**：允许管理的批准恢复在不使用恢复令牌的情况下使用 `approvalId`，并在批准等待状态中持久化该ID。(#69559) 感谢 @kirkluokun。 - **插件/启动**：将捆绑的运行时依赖安装到每个插件自己的运行时目录中，在重建后复用源代码检出修复缓存，并且仅记录实际安装的包，以便在依赖存在后重复的网关启动保持安静。 - **插件/启动**：在修复捆绑插件运行时依赖时忽略pnpm的 `npm_execpath`，并跳过仅工作区的包规范，因此仅npm安装标志或本地工作区链接不会破坏打包的插件启动。 - **MCP**：为stdio服务器阻止解释器启动环境键（如 `NODE_OPTIONS`），同时保留普通凭据和代理环境变量。(#69540) 感谢 @drobison00。 - **代理/shell**：忽略非交互式占位符shell（如 `/usr/bin/false` 和 `/sbin/nologin`），回退到 `sh`，以便服务用户执行运行不再立即退出。(#69308) 感谢 @sk7n4k3d。 - **Setup/TUI**：在保留配置的网关目标和认证源的同时，在新进程中重新启动安装hatch TUI，以便 onboarding 干净地恢复终端状态，而不会在命令行参数上暴露网关密钥。(#69524) 感谢 @shakkernerd。 - **Codex**：避免在具有入站图像的本地视觉回合中重新公开图像生成工具，并保持配置的图像提供程序上的裸图像模型覆盖。(#65061) 感谢 @zhulijin1991。 - **会话/重置**：在 `/new` 和 `/reset` 上清除自动 sourced 模型、提供商和认证配置文件覆盖，同时保留显式用户选择，以便频道会话停止固定到运行时回退选择。(#69419) 感谢 @sk7n4k3d。 - **会话/成本**：像令牌计数器一样快照 `estimatedCostUsd`，以便重复的持久化路径不再将同一运行成本累积多达数十次。(#69403) 感谢 @MrMiaigi。 - **OpenAI Codex**：将ChatGPT/Codex OAuth Responses请求通过 `/backend-api/codex` 端点路由，因此 `openai-codex/gpt-5.4` 不再命中已移除的 `/backend-api/responses` 别名。(#69336) 感谢 @mzogithub。 - **OpenAI/Responses**：在出站Responses API调用前剥离孤立推理块，因此压缩或恢复的历史记录不再因独立的推理项而失败。(#55787) 感谢 @suboss87。 - **Cron/CLI**：以与逗号分隔输入相同的方式解析PowerShell风格的 `--tools` 允许列表，因此 `cron add` 和 `cron edit` 不再在Windows上将 `exec read write` 持久化为一个组合工具条目。(#68858) 感谢 @chen-zhang-cs-code。 - **Browser/user-profile**：允许现有会话 `profile="user"` 工具调用自动路由到连接的浏览器节点或使用显式 `target="node"`，同时仍遵守显式 `target="host"` 固定。(#48677) - **Discord/斜杠命令**：容忍斜杠命令和模型选择器流程中的部分Discord频道元数据，因此当频道名称、主题或线程父元数据不可用时，部分频道对象不再崩溃。(#68953) 感谢 @dutifulbob。 - **BlueBubbles**：合并出站HTTP通过类型化的 `BlueBubblesClient`，在构造时解析一次SSRF策略，因此图像附件不再因本地主机而被阻止，反应不再因私有IP BB部署而被阻止。修复 #34749 和 #59722。(#68234) 感谢 @omarshahine。 - **Cron/gateway**：在添加/更新时拒绝模糊的公告传递配置，因此无效的多频道或目标ID提供商设置会提前失败，而不是持久化损坏的cron作业。(#69015) 感谢 @obviyus。 - **Cron/main-session delivery**：通过延迟唤醒排队、网关唤醒转发和相同目标唤醒合并保留 `heartbeat.target="last"`，因此排队的cron回复仍返回到最后活跃聊天。(#69021) 感谢 @obviyus。 - **Cron/gateway**：在检查公告传递模糊性时忽略禁用频道，并针对实时cron服务默认代理验证主会话传递补丁，因此热重载的代理配置不会错误拒绝有效更新。(#69040) 感谢 @obviyus。 - **Matrix/允许列表**：在入站消息上热重载 `dm.allowFrom` 和 `groupAllowFrom` 条目，同时保持配置删除的权威性，因此Matrix允许列表更改不再需要频道重启来添加或撤销发送者。(#68546) 感谢 @johnlanni。 - **BlueBubbles**：始终在出站文本发送上显式设置 `method`（可用时为 `"private-api"`，否则为 `"apple-script"`），并在macOS 26上即使对于纯文本也优先使用Private API。修复了macOS上无Private API的设置中因省略 `method` 导致BB Server回退到版本相关默认行为而静默丢失消息的问题(#64480)，以及macOS 26 Tahoe纯文本发送的AppleScript `-1700` 错误。(#69070) 感谢 @xqing3。 - **Matrix/命令**：识别以机器人Matrix提及为前缀的斜杠命令，因此 `@bot:server /new` 等房间消息触发命令路径而无需自定义提及正则表达式。(#68570) 感谢 @nightq 和 @johnlanni。 - **Gateway/配对**：返回原因特定的 `PAIRING_REQUIRED` 详情、修复提示和请求ID，因此未批准设备和范围升级失败在CLI和控制UI中显示可操作的恢复指导。(#69227) 感谢 @obviyus。 - **代理/子代理**：在子代理失败负载中包含请求的角色和运行时计时，以便父代理可以关联失败或超时的子工作。(#68726) 感谢 @BKF-Gitty。 - **Gateway/会话**：在代理从配置中移除后拒绝过时的代理作用域会话，同时保留遗留默认代理主会话别名。(#65986) 感谢 @bittoby。 - **Doctor/gateway**：显示待处理的设备配对请求、范围升级批准漂移和过时的设备令牌不匹配修复步骤，因此 `openclaw doctor --fix` 不再留下未解释的配对/认证设置失败。(#69210) 感谢 @obviyus。 - **Cron/isolated-agent**：为隔离运行保留显式 `delivery.mode: "none"` 消息目标，而不继承隐式 `last` 路由，因此代理发起的Telegram发送保留其作者指定的目的地，而裸 `mode:none` 作业保持无目标。(#69153) 感谢 @obviyus。 - **Cron/isolated-agent**：防止 `delivery.mode: "none"` 仅账户或仅线程配置继承过时的隐式接收者，因此隔离运行仅在作业 authored 显式 `to` 目标时解析消息路由。(#69163) 感谢 @obviyus。 - **Gateway/TUI**：在本地网关仍在完成启动时重试会话历史，因此 `openclaw tui` 重新连接不再因瞬态 `chat.history unavailable during gateway startup` 错误而失败。(#69164) 感谢 @shakkernerd。 - **BlueBubbles/反应**：当代理使用iMessage tapback集（`love`/`like`/`dislike`/`laugh`/`emphasize`/`question`）之外的emoji反应时，回退到 `love`，因此词汇更广的模型反应（如 `👀`）仍产生可见的tapback而不是失败整个反应请求。配置的确认反应仍通过新的 `normalizeBlueBubblesReactionInputStrict` 路径严格验证。(#64693) 感谢 @zqchris。 - **BlueBubbles**：当同一句柄存在iMessage和SMS聊天时优先使用iMessage，遵守显式 `sms:` 目标，并且绝不静默降级可用的iMessage接收者。(#61781) 感谢 @rmartin。 - **Telegram/设置**：在设置期间要求数字 `allowFrom` 用户ID，而不是提供不支持的 `@username` DM解析，并引导操作员到 `from.id`/`getUpdates` 进行发现。(#69191) 感谢 @obviyus。 - **GitHub Copilot/onboarding**：将GitHub Copilot安装默认设为 `claude-opus-4.6` 并保持捆绑默认模型列表一致，因此新的Copilot安装不再以较旧的 `gpt-4o` 默认开始。(#69207) 感谢 @obviyus。 - **Gateway/状态**：分离可达性、能力和读取探测报告，因此仅连接或范围受限的会话不再看起来完全健康，并规范以 `ssh user@host` 格式输入的SSH目标。(#69215) 感谢 @obviyus。 - **Slack**：修复通过 `file` 或 `exec` 密钥源配置的账户出站回复失败“未解析的SecretRef”的问题；发送路径现在容忍运行时快照保留未解析的频道SecretRef，当引导解析的令牌覆盖已可用时。(#68954) 感谢 @openperf。 - **Control UI/设备配对**：在重新连接期间解释范围和角色批准升级，并在控制UI和 `openclaw devices` 中显示请求与批准的访问，因此更广泛的重新连接不再看起来像丢失的配对。(#69221) 感谢 @obviyus。 - **Gateway/Control UI**：在认证错误和控制UI提示中显示待处理的范围、角色和设备元数据配对批准，因此更广泛的重新连接不再看起来像随机的认证中断。(#69226) 感谢 @obviyus。 ### 其他修复 - **代理/压缩**：重命名嵌入式Pi压缩生命周期事件为 `compaction_start` / `compaction_end`，使OpenClaw与 `pi-coding-agent` 0.66.1事件命名保持一致。(#67713) 感谢 @mpz4life。 - **Security/dotenv**：阻止所有 `OPENCLAW_*` 键从未受信任的工作区 `.env` 文件加载，因此工作区本地环境加载对新运行时控制变量失败关闭，而不是静默继承它们。(#473) - **Gateway/设备配对**：将非管理员配对设备会话（设备令牌认证）限制在其自己的配对列表、批准和拒绝操作，因此配对设备无法枚举其他设备或批准/拒绝另一设备授权的配对请求。管理员和共享密钥操作员会话保留完全可见性。(#69375) 感谢 @eleqtrizit。 - **代理/gateway工具**：扩展面向代理的 `gateway` 工具的配置变更防护，因此模型驱动的 `config.patch` 和 `config.apply` 无法重写操作员受信任的路径（沙箱、插件信任、网关认证/TLS、钩子路由和令牌、SSRF策略、MCP服务器、工作区文件系统强化），并且无法通过就地编辑每个代理沙箱、工具或嵌入式Pi覆盖在 `agents.list[]` 下绕过防护。(#69377) 感谢 @eleqtrizit。 - **Gateway/websocket广播**：要求 `operator.read`（或更高）用于聊天、代理和工具结果事件帧，因此配对作用域和节点角色会话不再被动接收会话聊天内容，并默认范围门控未知广播事件。插件定义的 `plugin.*` 广播范围限于 operator.write/admin，状态/传输事件（`heartbeat`、`presence`、`tick` 等）保持无限制。每客户端序列号保留每连接单调性。(#69373) 感谢 @eleqtrizit。 - **代理/压缩**：始终通过显式加载器重新加载嵌入式Pi资源并重新应用保留令牌覆盖，因此没有扩展工厂的运行不再在会话开始前静默丢失压缩设置。(#67146) 感谢 @ly85206559。 - **Memory-core/dreaming**：规范化扫描时间戳并重用哈希的叙述会话键进行回退清理，因此Dreaming叙述子会话停止泄漏。(#67023) 感谢 @chiyouYCH。 - **Gateway/启动**：延迟HTTP绑定直到附加websocket处理器，因此启动后立即的websocket健康/连接探测不再命中启动竞争窗口。(#43392) 感谢 @dalefrieswthat。 - **Codex/app-server**：当下游使用者在排空 `turn/completed` 通知时抛出，释放会话通道，因此Codex插件回复后的后续消息停止在陈旧通道锁后排队。修复 #67996。(#69072) 感谢 @ayeshakhalid192007-dev。 - **Codex/app-server**：将默认批准处理设为 `on-request`，因此Codex harness会话不会以过度宽松的工具批准开始。(#68721) 感谢 @Lucenx9。 - **Cron/delivery**：保持隔离的cron聊天传递工具可用，从网关解析 `channel: "last"` 目标，在 `cron list/show` 中显示传递预览，并避免直接消息工具传递后的重复回退发送。(#69587) 感谢 @obviyus。 - **Cron/Telegram**：将隔离直接传递去重键设为每个cron执行而非重用的会话ID，因此重复的Telegram公告运行不再报告传递而静默跳过后续发送。(#69000) 感谢 @obviyus。 - **Models/Kimi**：默认捆绑Kimi思考关闭并规范化Anthropic兼容 `thinking` 负载，因此过时会话 `/think` 状态不再在Kimi运行上静默重新启用推理。(#68907) 感谢 @frankekn。 - **Control UI/cron**：防止运行时仅 `last` 传递哨兵在作业创建或编辑时物化为持久化的cron传递和失败警报频道配置。(#68829) 感谢 @tianhaocui。 - **OpenAI/Responses**：在出站Responses API调用前剥离孤立推理块，因此压缩或恢复的历史记录不再因独立推理项而失败。(#55787) 感谢 @suboss87。 - **Cron/CLI**：以与逗号分隔输入相同的方式解析PowerShell风格的 `--tools` 允许列表，因此 `cron add` 和 `cron edit` 不再在Windows上将 `exec read write` 持久化为一个组合工具条目。(#68858) 感谢 @chen-zhang-cs-code。 - **Browser/user-profile**：允许现有会话 `profile="user"` 工具调用自动路由到连接的浏览器节点或使用显式 `target="node"`，同时仍遵守显式 `target="host"` 固定。(#48677) - **Discord/斜杠命令**：容忍斜杠命令和模型选择器流程中的部分Discord频道元数据，因此当频道名称、主题或线程父元数据不可用时，部分频道对象不再崩溃。(#68953) 感谢 @dutifulbob。 - **BlueBubbles**：合并出站HTTP通过类型化的 `BlueBubblesClient`，在构造时解析一次SSRF策略，因此图像附件不再因本地主机而被阻止，反应不再因私有IP BB部署而被阻止。修复 #34749 和 #59722。(#68234) 感谢 @omarshahine。 - **Cron/gateway**：在添加/更新时拒绝模糊的公告传递配置，因此无效的多频道或目标ID提供商设置会提前失败，而不是持久化损坏的cron作业。(#69015) 感谢 @obviyus。 - **Cron/main-session delivery**：通过延迟唤醒排队、网关唤醒转发和相同目标唤醒合并保留 `heartbeat.target="last"`，因此排队的cron回复仍返回到最后活跃聊天。(#69021) 感谢 @obviyus。 - **Cron/gateway**：在检查公告传递模糊性时忽略禁用频道，并针对实时cron服务默认代理验证主会话传递补丁，因此热重载的代理配置不会错误拒绝有效更新。(#69040) 感谢 @obviyus。 - **Matrix/允许列表**：在入站消息上热重载 `dm.allowFrom` 和 `groupAllowFrom` 条目，同时保持配置删除的权威性，因此Matrix允许列表更改不再需要频道重启来添加或撤销发送者。(#68546) 感谢 @johnlanni。 - **BlueBubbles**：始终在出站文本发送上显式设置 `method`（可用时为 `"private-api"`，否则为 `"apple-script"`），并在macOS 26上即使对于纯文本也优先使用Private API。修复了macOS上无Private API的设置中因省略 `method` 导致BB Server回退到版本相关默认行为而静默丢失消息的问题(#64480)，以及macOS 26 Tahoe纯文本发送的AppleScript `-1700` 错误。(#69070) 感谢 @xqing3。 - **Matrix/命令**：识别以机器人Matrix提及为前缀的斜杠命令，因此 `@bot:server /new` 等房间消息触发命令路径而无需自定义提及正则表达式。(#68570) 感谢 @nightq 和 @johnlanni。 - **Gateway/配对**：返回原因特定的 `PAIRING_REQUIRED` 详情、修复提示和请求ID，因此未批准设备和范围升级失败在CLI和控制UI中显示可操作的恢复指导。(#69227) 感谢 @obviyus。 - **代理/子代理**：在子代理失败负载中包含请求的角色和运行时计时，以便父代理可以关联失败或超时的子工作。(#68726) 感谢 @BKF-Gitty。 - **Gateway/会话**：在代理从配置中移除后拒绝过时的代理作用域会话，同时保留遗留默认代理主会话别名。(#65986) 感谢 @bittoby。 - **Doctor/gateway**：显示待处理的设备配对请求、范围升级批准漂移和过时的设备令牌不匹配修复步骤，因此 `openclaw doctor --fix` 不再留下未解释的配对/认证设置失败。(#69210) 感谢 @obviyus。 - **Cron/isolated-agent**：为隔离运行保留显式 `delivery.mode: "none"` 消息目标，而不继承隐式 `last` 路由，因此代理发起的Telegram发送保留其作者指定的目的地，而裸 `mode:none` 作业保持无目标。(#69153) 感谢 @obviyus。 - **Cron/isolated-agent**：防止 `delivery.mode: "none"` 仅账户或仅线程配置继承过时的隐式接收者，因此隔离运行仅在作业 authored 显式 `to` 目标时解析消息路由。(#69163) 感谢 @obviyus。 - **Gateway/TUI**：在本地网关仍在完成启动时重试会话历史，因此 `openclaw tui` 重新连接不再因瞬态 `chat.history unavailable during gateway startup` 错误而失败。(#69164) 感谢 @shakkernerd。 - **BlueBubbles/反应**：当代理使用iMessage tapback集（`love`/`like`/`dislike`/`laugh`/`emphasize`/`question`）之外的emoji反应时，回退到 `love`，因此词汇更广的模型反应（如 `👀`）仍产生可见的tapback而不是失败整个反应请求。配置的确认反应仍通过新的 `normalizeBlueBubblesReactionInputStrict` 路径严格验证。(#64693) 感谢 @zqchris。 - **BlueBubbles**：当同一句柄存在iMessage和SMS聊天时优先使用iMessage，遵守显式 `sms:` 目标，并且绝不静默降级可用的iMessage接收者。(#61781) 感谢 @rmartin。 - **Telegram/设置**：在设置期间要求数字 `allowFrom` 用户ID，而不是提供不支持的 `@username` DM解析，并引导操作员到 `from.id`/`getUpdates` 进行发现。(#69191) 感谢 @obviyus。 - **GitHub Copilot/onboarding**：将GitHub Copilot安装默认设为 `claude-opus-4.6` 并保持捆绑默认模型列表一致，因此新的Copilot安装不再以较旧的 `gpt-4o` 默认开始。(#69207) 感谢 @obviyus。 - **Gateway/状态**：分离可达性、能力和读取探测报告，因此仅连接或范围受限的会话不再看起来完全健康，并规范以 `ssh user@host` 格式输入的SSH目标。(#69215) 感谢 @obviyus。 - **Slack**：修复通过 `file` 或 `exec` 密钥源配置的账户出站回复失败“未解析的SecretRef”的问题；发送路径现在容忍运行时快照保留未解析的频道SecretRef，当引导解析的令牌覆盖已可用时。(#68954) 感谢 @openperf。 - **Control UI/设备配对**：在重新连接期间解释范围和角色批准升级，并在控制UI和 `openclaw devices` 中显示请求与批准的访问，因此更广泛的重新连接不再看起来像丢失的配对。(#69221) 感谢 @obviyus。 - **Gateway/Control UI**：在认证错误和控制UI提示中显示待处理的范围、角色和设备元数据配对批准，因此更广泛的重新连接不再看起来像随机的认证中断。(#69226) 感谢 @obviyus。

## 2026.4.20 ### Changes - Onboard/wizard: restyle the setup security disclaimer with a single yellow warning banner, section headings and bulleted checklists, and un-dim the note body so key guidance is easy to scan; add a loading spinner during the initial model catalog load so the wizard no longer goes blank while it runs; add an "API key" placeholder to provider API key prompts. (#69553) Thanks @Patrick-Erichsen. - Agents/prompts: strengthen the default system prompt and OpenAI GPT-5 overlay with clearer completion bias, live-state checks, weak-result recovery, and verification-before-final guidance. - Models/costs: support tiered model pricing from cached catalogs and configured models, and include bundled Moonshot Kimi K2.6/K2.5 cost estimates for token-usage reports. (#67605) Thanks @sliverp. - Sessions/Maintenance: enforce the built-in entry cap and age prune by default, and prune oversized stores at load time so accumulated cron/executor session backlogs cannot OOM the gateway before the write path runs. (#69404) Thanks @bobrenze-bot. - Plugins/tests: reuse plugin loader alias and Jiti config resolution across repeated same-context loads, reducing import-heavy test overhead. (#69316) Thanks @amknight. - Cron: split runtime execution state into `jobs-state.json` so `jobs.json` stays stable for git-tracked job definitions. (#63105) Thanks @Feelw00. - Agents/compaction: send opt-in start and completion notices during context compaction. (#67830) Thanks @feniix. - Moonshot/Kimi: default bundled Moonshot setup, web search, and media-understanding surfaces to `kimi-k2.6` while keeping `kimi-k2.5` available for compatibility. (#69477) Thanks @scoootscooob. - Moonshot/Kimi: allow `thinking.keep = "all"` on `moonshot/kimi-k2.6`, and strip it for other Moonshot models or requests where pinned `tool_choice` disables thinking. (#68816) Thanks @aniaan. - BlueBubbles/groups: forward per-group `systemPrompt` config into inbound context `GroupSystemPrompt` so configured group-specific behavioral instructions (for example threaded-reply and tapback conventions) are injected on every turn. Supports `"*"` wildcard fallback matching the existing `requireMention` pattern. Closes #60665. (#69198) Thanks @omarshahine. - Plugins/tasks: add a detached runtime registration contract so plugin executors can own detached task lifecycle and cancellation without reaching into core task internals. (#68915) Thanks @mbelinky. - Terminal/logging: optimize `sanitizeForLog()` by replacing the iterative control-character stripping loop with a single regex pass while preserving the existing ANSI-first sanitization behavior. (#67205) Thanks @bulutmuf. - QA/CI: make `openclaw qa suite` and `openclaw qa telegram` fail by default when scenarios fail, add `--allow-failures` for artifact-only runs, and tighten live-lane defaults for CI automation. (#69122) Thanks @joshavant. - Mattermost: stream thinking, tool activity, and partial reply text into a single draft preview post that finalizes in place when safe. (#47838) thanks @ninjaa. ### Fixes - Exec/YOLO: stop rejecting gateway-host exec in `security=full` plus `ask=off` mode via the Python/Node script preflight hardening path, so promptless YOLO exec once again runs direct interpreter stdin and heredoc forms such as `node <<'NODE' ... NODE`. - OpenAI Codex: normalize legacy `openai-completions` transport overrides on default OpenAI/Codex and GitHub Copilot-compatible hosts back to the native Codex Responses transport while leaving custom proxies untouched. (#45304, #42194) Thanks @dyss1992 and @DeadlySilent. - Anthropic/plugins: scope Anthropic `api: "anthropic-messages"` defaulting to Anthropic-owned providers, so `openai-codex` and other providers without an explicit `api` no longer get rewritten to the wrong transport. Fixes #64534. - fix(qqbot): add SSRF guard to direct-upload URL paths in uploadC2CMedia and uploadGroupMedia [AI-assisted]. (#69595) Thanks @pgondhi987. - fix(gateway): enforce allowRequestSessionKey gate on template-rendered mapping sessionKeys. (#69381) Thanks @pgondhi987. - Browser/Chrome MCP: surface `DevToolsActivePort` attach failures as browser-connectivity errors instead of a generic "waiting for tabs" timeout, and point signed-out fallbacks toward the managed `openclaw` profile. - Webchat/images: treat inline image attachments as media for empty-turn gating while still ignoring metadata-only blank turns. (#69474) Thanks @Jaswir. - Discord/think: only show `adaptive` in `/think` autocomplete for provider/model pairs that actually support provider-managed adaptive thinking, so GPT/OpenAI models no longer advertise an Anthropic-only option. - Thinking: only expose `max` for models that explicitly support provider max reasoning, and remap stored `max` settings to the largest supported thinking mode when users switch to another model. - Gateway/usage: bound the cost usage cache with FIFO eviction so date/range lookups cannot grow unbounded. (#68842) Thanks @Feelw00. - OpenAI/Responses: resolve `/think` levels against each GPT model's supported reasoning efforts so `/think off` no longer becomes high reasoning or sends unsupported `reasoning.effort: "none"` payloads. - Lobster/TaskFlow: allow managed approval resumes to use `approvalId` without a resume token, and persist that id in approval wait state. (#69559) Thanks @kirkluokun. - Plugins/startup: install bundled runtime dependencies into each plugin's own runtime directory, reuse source-checkout repair caches after rebuilds, and log only packages that were actually installed so repeated Gateway starts stay quiet once deps are present. - Plugins/startup: ignore pnpm's `npm_execpath` when repairing bundled plugin runtime dependencies and skip workspace-only package specs so npm-only install flags or local workspace links do not break packaged plugin startup. - MCP: block interpreter-startup env keys such as `NODE_OPTIONS` for stdio servers while preserving ordinary credential and proxy env vars. (#69540) Thanks @drobison00. - Agents/shell: ignore non-interactive placeholder shells like `/usr/bin/false` and `/sbin/nologin`, falling back to `sh` so service-user exec runs no longer exit immediately. (#69308) Thanks @sk7n4k3d. - Setup/TUI: relaunch the setup hatch TUI in a fresh process while preserving the configured gateway target and auth source, so onboarding recovers terminal state cleanly without exposing gateway secrets on command-line args. (#69524) Thanks @shakkernerd. - Codex: avoid re-exposing the image-generation tool on native vision turns with inbound images, and keep bare image-model overrides on the configured image provider. (#65061) Thanks @zhulijin1991. - Sessions/reset: clear auto-sourced model, provider, and auth-profile overrides on `/new` and `/reset` while preserving explicit user selections, so channel sessions stop staying pinned to runtime fallback choices. (#69419) Thanks @sk7n4k3d. - Sessions/costs: snapshot `estimatedCostUsd` like token counters so repeated persist paths no longer compound the same run cost by up to dozens of times. (#69403) Thanks @MrMiaigi. - OpenAI Codex: route ChatGPT/Codex OAuth Responses requests through the `/backend-api/codex` endpoint so `openai-codex/gpt-5.4` no longer hits the removed `/backend-api/responses` alias. (#69336) Thanks @mzogithub. - OpenAI/Responses: omit disabled reasoning payloads when `/think off` is active, so GPT reasoning models no longer receive unsupported `reasoning.effort: "none"` requests. (#61982) Thanks @a-tokyo. - Gateway/pairing: treat loopback shared-secret node-host, TUI, and gateway clients as local for pairing decisions, so trusted local tools no longer reconnect as remote clients and fail with `pairing required`. (#69431) Thanks @SARAMALI15792. - Active Memory: degrade gracefully when memory recall fails during prompt building, logging a warning and letting the reply continue without memory context instead of failing the whole turn. (#69485) Thanks @Magicray1217. - Ollama: add provider-policy defaults for `baseUrl` and `models` so implicit local discovery can run before config validation rejects a minimal Ollama provider config. (#69370) Thanks @PratikRai0101. - Agents/model selection: clear transient auto-failover session overrides before each turn so recovered primary models are retried immediately without emitting user-override reset warnings. (#69365) Thanks @hitesh-github99. - Auto-reply: apply silent `NO_REPLY` policy per conversation type, so direct chats get a helpful rewritten reply while groups and internal deliveries can remain quiet. (#68644) Thanks @Takhoffman. - Telegram/status reactions: honor `messages.removeAckAfterReply` when lifecycle status reactions are enabled, clearing or restoring the reaction after success/error using the configured hold timings. (#68067) Thanks @poiskgit. - Web search/plugins: resolve plugin-scoped SecretRef API keys for bundled Exa, Firecrawl, Gemini, Kimi, Perplexity, Tavily, and Grok web-search providers when they are selected through the shared web-search config. (#68424) Thanks @afurm. - Telegram/polling: raise the default polling watchdog threshold from 90s to 120s and add configurable `channels.telegram.pollingStallThresholdMs` (also per-account) so long-running Telegram work gets more room before polling is treated as stalled. (#57737) Thanks @Vitalcheffe. - Telegram/polling: bound the persisted-offset confirmation `getUpdates` probe with a client-side timeout so a zombie socket cannot hang polling recovery before the runner watchdog starts. (#50368) Thanks @boticlaw. - Agents/Pi runner: retry silent `stopReason=error` turns with no output when no side effects ran, so non-frontier providers that briefly return empty error turns get another chance instead of ending the session early. (#68310) Thanks @Chased1k. - Plugins/memory: preserve the active memory capability when read-only snapshot plugin loads run, so status and provider discovery paths no longer wipe memory public artifacts. (#69219) Thanks @zeroaltitude. - Plugins: keep only the highest-precedence manifest when distinct discovered plugins share an id, so lower-precedence global or workspace duplicates no longer load beside bundled or config-selected plugins. (#41626) Thanks @Tortes. - fix(security): block MINIMAX_API_HOST workspace env injection and remove env-driven URL routing [AI-assisted]. (#67300) Thanks @pgondhi987. - Cron/delivery: treat explicit `delivery.mode: "none"` runs as not requested even if the runner reports `delivered: false`, so no-delivery cron jobs no longer persist false delivery failures or errors. (#69285) Thanks @matsuri1987. - Plugins/install: repair active and default-enabled bundled plugin runtime dependencies before import in packaged installs, so bundled Discord, WhatsApp, Slack, Telegram, and provider plugins work without putting their dependency trees in core. - BlueBubbles: raise the outbound `/api/v1/message/text` send timeout default from 10s to 30s, and add a configurable `channels.bluebubbles.sendTimeoutMs` (also per-account) so macOS 26 setups where Private API iMessage sends stall for 60+ seconds no longer silently lose messages at the 10s abort. Probes, chat lookups, and health checks keep the shorter 10s default. Fixes #67486. (#69193) Thanks @omarshahine. - Agents/bootstrap: budget truncation markers against per-file caps, preserve source content instead of silently wasting bootstrap bytes, and avoid marker-only output in tiny-budget truncation cases. (#69114) Thanks @BKF-Gitty. - Context engine/plugins: stop rejecting third-party context engines whose `info.id` differs from the registered plugin slot id. The strict-match contract added in 2026.4.14 broke `lossless-claw` and other plugins whose internal engine id does not equal the slot id they are registered under, producing repeated `info.id must match registered id` lane failures on every turn. Fixes #66601. (#66678) Thanks @GodsBoy. - Agents/compaction: rename embedded Pi compaction lifecycle events to `compaction_start` / `compaction_end` so OpenClaw stays aligned with `pi-coding-agent` 0.66.1 event naming. (#67713) Thanks @mpz4life. - Security/dotenv: block all `OPENCLAW_*` keys from untrusted workspace `.env` files so workspace-local env loading fails closed for new runtime-control variables instead of silently inheriting them. (#473) - Gateway/device pairing: restrict non-admin paired-device sessions (device-token auth) to their own pairing list, approve, and reject actions so a paired device cannot enumerate other devices or approve/reject pairing requests authored by another device. Admin and shared-secret operator sessions retain full visibility. (#69375) Thanks @eleqtrizit. - Agents/gateway tool: extend the agent-facing `gateway` tool's config mutation guard so model-driven `config.patch` and `config.apply` cannot rewrite operator-trusted paths (sandbox, plugin trust, gateway auth/TLS, hook routing and tokens, SSRF policy, MCP servers, workspace filesystem hardening) and cannot bypass the guard by editing per-agent sandbox, tools, or embedded-Pi overrides in place under `agents.list[]`. (#69377) Thanks @eleqtrizit. - Gateway/websocket broadcasts: require `operator.read` (or higher) for chat, agent, and tool-result event frames so pairing-scoped and node-role sessions no longer passively receive session chat content, and scope-gate unknown broadcast events by default. Plugin-defined `plugin.*` broadcasts are scoped to operator.write/admin, and status/transport events (`heartbeat`, `presence`, `tick`, etc.) remain unrestricted. Per-client sequence numbers preserve per-connection monotonicity. (#69373) Thanks @eleqtrizit. - Agents/compaction: always reload embedded Pi resources through an explicit loader and reapply reserve-token overrides so runs without extension factories no longer silently lose compaction settings before session start. (#67146) Thanks @ly85206559. - Memory-core/dreaming: normalize sweep timestamps and reuse hashed narrative session keys for fallback cleanup so Dreaming narrative sub-sessions stop leaking. (#67023) Thanks @chiyouYCH. - Gateway/startup: delay HTTP bind until websocket handlers are attached, so immediate post-startup websocket health/connect probes no longer hit the startup race window. (#43392) Thanks @dalefrieswthat. - Codex/app-server: release the session lane when a downstream consumer throws while draining the `turn/completed` notification, so follow-up messages after a Codex plugin reply stop queueing behind a stale lane lock. Fixes #67996. (#69072) Thanks @ayeshakhalid192007-dev. - Codex/app-server: default approval handling to `on-request` so Codex harness sessions do not start with overly permissive tool approvals. (#68721) Thanks @Lucenx9. - Cron/delivery: keep isolated cron chat delivery tools available, resolve `channel: "last"` targets from the gateway, show delivery previews in `cron list/show`, and avoid duplicate fallback sends after direct message-tool delivery. (#69587) Thanks @obviyus. - Cron/Telegram: key isolated direct-delivery dedupe to each cron execution instead of the reused session id, so recurring Telegram announce runs no longer report delivered while silently skipping later sends. (#69000) Thanks @obviyus. - Models/Kimi: default bundled Kimi thinking to off and normalize Anthropic-compatible `thinking` payloads so stale session `/think` state no longer silently re-enables reasoning on Kimi runs. (#68907) Thanks @frankekn. - Control UI/cron: keep the runtime-only `last` delivery sentinel from being materialized into persisted cron delivery and failure-alert channel configs when jobs are created or edited. (#68829) Thanks @tianhaocui. - OpenAI/Responses: strip orphaned reasoning blocks before outbound Responses API calls so compacted or restored histories no longer fail on standalone reasoning items. (#55787) Thanks @suboss87. - Cron/CLI: parse PowerShell-style `--tools` allow-lists the same way as comma-separated input, so `cron add` and `cron edit` no longer persist `exec read write` as one combined tool entry on Windows. (#68858) Thanks @chen-zhang-cs-code. - Browser/user-profile: let existing-session `profile="user"` tool calls auto-route to a connected browser node or use explicit `target="node"`, while still honoring explicit `target="host"` pinning. (#48677) - Discord/slash commands: tolerate partial Discord channel metadata in slash-command and model-picker flows so partial channel objects no longer crash when channel names, topics, or thread parent metadata are unavailable. (#68953) Thanks @dutifulbob. - BlueBubbles: consolidate outbound HTTP through a typed `BlueBubblesClient` that resolves the SSRF policy once at construction so image attachments stop getting blocked on localhost and reactions stop getting blocked on private-IP BB deployments. Fixes #34749 and #59722. (#68234) Thanks @omarshahine. - Cron/gateway: reject ambiguous announce delivery config at add/update time so invalid multi-channel or target-id provider settings fail early instead of persisting broken cron jobs. (#69015) Thanks @obviyus. - Cron/main-session delivery: preserve `heartbeat.target="last"` through deferred wake queuing, gateway wake forwarding, and same-target wake coalescing so queued cron replies still return to the last active chat. (#69021) Thanks @obviyus. - Cron/gateway: ignore disabled channels when announce delivery ambiguity is checked, and validate main-session delivery patches against the live cron service default agent so hot-reloaded agent config does not falsely reject valid updates. (#69040) Thanks @obviyus. - Matrix/allowlists: hot-reload `dm.allowFrom` and `groupAllowFrom` entries on inbound messages while keeping config removals authoritative, so Matrix allowlist changes no longer require a channel restart to add or revoke a sender. (#68546) Thanks @johnlanni. - BlueBubbles: always set `method` explicitly on outbound text sends (`"private-api"` when available, `"apple-script"` otherwise), and prefer Private API on macOS 26 even for plain text. Fixes silent delivery failure on macOS setups without Private API where an omitted `method` let BB Server fall back to version-dependent default behavior that silently drops the message (#64480), and the AppleScript `-1700` error on macOS 26 Tahoe plain text sends (#53159). (#69070) Thanks @xqing3. - Matrix/commands: recognize slash commands that are prefixed with the bot's Matrix mention, so room messages like `@bot:server /new` trigger the command path without requiring custom mention regexes. (#68570) Thanks @nightq and @johnlanni. - Gateway/pairing: return reason-specific `PAIRING_REQUIRED` details, remediation hints, and request ids so unapproved-device and scope-upgrade failures surface actionable recovery guidance in the CLI and Control UI. (#69227) Thanks @obviyus. - Agents/subagents: include requested role and runtime timing on subagent failure payloads so parent agents can correlate failed or timed-out child work. (#68726) Thanks @BKF-Gitty. - Gateway/sessions: reject stale agent-scoped sessions after an agent is removed from config while preserving legacy default-agent main-session aliases. (#65986) Thanks @bittoby. - Doctor/gateway: surface pending device pairing requests, scope-upgrade approval drift, and stale device-token mismatch repair steps so `openclaw doctor --fix` no longer leaves pairing/auth setup failures unexplained. (#69210) Thanks @obviyus. - Cron/isolated-agent: preserve explicit `delivery.mode: "none"` message targets for isolated runs without inheriting implicit `last` routing, so agent-initiated Telegram sends keep their authored destination while bare `mode:none` jobs stay targetless. (#69153) Thanks @obviyus. - Cron/isolated-agent: keep `delivery.mode: "none"` account-only or thread-only configs from inheriting a stale implicit recipient, so isolated runs only resolve message routing when the job authored an explicit `to` target. (#69163) Thanks @obviyus. - Gateway/TUI: retry session history while the local gateway is still finishing startup, so `openclaw tui` reconnects no longer fail on transient `chat.history unavailable during gateway startup` errors. (#69164) Thanks @shakkernerd. - BlueBubbles/reactions: fall back to `love` when an agent reacts with an emoji outside the iMessage tapback set (`love`/`like`/`dislike`/`laugh`/`emphasize`/`question`), so wider-vocabulary model reactions like `👀` still produce a visible tapback instead of failing the whole reaction request. Configured ack reactions still validate strictly via the new `normalizeBlueBubblesReactionInputStrict` path. (#64693) Thanks @zqchris. - BlueBubbles: prefer iMessage over SMS when both chats exist for the same handle, honor explicit `sms:` targets, and never silently downgrade iMessage-available recipients. (#61781) Thanks @rmartin. - Telegram/setup: require numeric `allowFrom` user IDs during setup instead of offering unsupported `@username` DM resolution, and point operators to `from.id`/`getUpdates` for discovery. (#69191) Thanks @obviyus. - GitHub Copilot/onboarding: default GitHub Copilot setup to `claude-opus-4.6` and keep the bundled default model list aligned, so new Copilot setups no longer start on the older `gpt-4o` default. (#69207) Thanks @obviyus. - Gateway/status: separate reachability, capability, and read-probe reporting so connect-only or scope-limited sessions no longer look fully healthy, and normalize SSH targets entered as `ssh user@host`. (#69215) Thanks @obviyus. - Slack: fix outbound replies failing with "unresolved SecretRef" for accounts configured via `file` or `exec` secret sources; the send path now tolerates the runtime snapshot retaining an unresolved channel SecretRef when a boot-resolved token override is already available. (#68954) Thanks @openperf. - Control UI/device pairing: explain scope and role approval upgrades during reconnects, and show requested versus approved access in the Control UI and `openclaw devices` so broader reconnects no longer look like lost pairings. (#69221) Thanks @obviyus. - Gateway/Control UI: surface pending scope, role, and device-metadata pairing approvals in auth errors and Control UI hints so broader reconnects no longer look like random auth breakage. (#69226) Thanks @obviyus.