OpenClaw v2026.4.23-beta.4

### 变更 - **Providers/OpenAI**：通过 Codex OAuth 添加图像生成和参考图像编辑功能，使 `openai/gpt-image-2` 无需 `OPENAI_API_KEY` 即可运行。修复 #70703。 - **Providers/OpenRouter**：通过 `image_generate` 添加图像生成和参考图像编辑功能，使 OpenRouter 图像模型能配合 `OPENROUTER_API_KEY` 使用。通过 #67668 修复 #55066。感谢 @notamicrodose。 - **图像生成**：允许智能体请求提供商支持的质量和输出格式提示，并通过 `image_generate` 工具传递 OpenAI 特有的背景、审核、压缩和用户提示。(#70503) 感谢 @ottodeng。 - **Agents/subagents**：为原生 `sessions_spawn` 运行添加可选的 fork 上下文，使智能体能在需要时让子进程继承请求者会话，同时默认保持干净的隔离会话；包含提示指南、上下文引擎钩子元数据、文档和 QA 覆盖。 - **Agents/tools**：为图像、视频、音乐和 TTS 生成工具添加可选的每调用 `timeoutMs` 支持，使智能体仅在特定生成需要时扩展提供商请求超时。 - **Memory/local embeddings**：添加可配置的 `memorySearch.local.contextSize`（默认 4096），使本地嵌入上下文可在不修补内存主机的情况下为受限主机进行调整。(#70544) 感谢 @aalekh-sarvam。 - **Dependencies/Pi**：将捆绑的 Pi 包更新至 `0.70.0`，使用 Pi 上游 `gpt-5.5` 目录元数据支持 OpenAI 和 OpenAI Codex，并仅保留本地 `gpt-5.5-pro` 前向兼容处理。 - **Codex harness**：为嵌入式 harness 选择决策添加结构化调试日志，使 `/status` 保持简洁，而网关日志可解释自动选择和 Pi 回退原因。(#70760) 感谢 @100yenadmin。 ### 修复 - **Codex harness**：将原生 `request_user_input` 提示路由回原始聊天，保留排队的后续答案，并遵循更新的应用服务器命令批准修订决策。 - **Codex harness/context-engine**：在日志记录前对上下文引擎组装失败进行脱敏，防止回退警告序列化原始错误对象。(#70809) 感谢 @jalehman。 - **WhatsApp/onboarding**：将首次运行设置条目加载保持在 Baileys 运行时依赖路径之外，使打包的 QuickStart 安装可在运行时依赖就位前显示 WhatsApp 设置。修复 #70932。 - **Block streaming**：在部分块传递中止且已发送文本块完全覆盖最终回复时，抑制最终组装的文本，防止重复回复且不丢弃无关短消息。修复 #70921。 - **Codex harness/Windows**：在启动原生应用服务器前通过 PATHEXT 解析 npm 安装的 `codex.cmd` 填充，使 `codex/*` 模型无需手动 `.exe` 填充即可工作。修复 #70913。 - **Slack/groups**：将 MPIM 群组 DM 分类为群组聊天上下文，并在 Slack 非 DM 界面抑制详细工具/计划进度，使内部“工作中…”跟踪不再泄露到房间。修复 #70912。 - **Agents/replay**：停止 OpenAI/Codex 会话重放在 Anthropic、Gemini 和 Bedrock 传输拥有的会话中合成缺失工具结果，同时保留合成修复。(#61556) 感谢 @VictorJeon 和 @vincentkoc。 - **Telegram/media replies**：在最终回复路径将远程 Markdown 图像语法解析为出站媒体负载，使 Telegram 群聊在模型或工具输出 `![...](...)` 而非 `MEDIA:` 标记时不再回退到纯文本图像 URL。(#66191) 感谢 @apezam 和 @vincentkoc。 - **Agents/WebChat**：从嵌入式运行器暴露不可重试的提供商故障（如计费、认证和速率限制错误），而非记录 `surface_error` 且让 WebChat 无渲染错误。修复 #70124。(#70848) 感谢 @truffle-dev。 - **WhatsApp**：统一直接发送和自动回复的出站媒体规范化。感谢 @mcaxtr。 - **Memory/CLI**：在内存核心清单中声明内置 `local` 嵌入提供商，使独立 `openclaw memory status`、`index` 和 `search` 能像网关运行时一样解析本地嵌入。修复 #70836。(#70873) 感谢 @mattznojassist。 - **Gateway/WebChat**：通过将图像附件卸载为媒体引用而非丢弃，为仅文本主模型保留图像附件，使配置的图像工具仍可检查原始文件。修复 #68513、#44276、#51656、#70212。 - **Plugins/Google Meet**：在离开时挂断委托的 Twilio 调用，在启动失败时清理 Chrome 实时音频桥，并使用扁平的提供商安全工具架构。 - **Media understanding**：在原生视觉跳过前遵循显式图像模型配置，包括 `agents.defaults.imageModel`、`tools.media.image.models` 以及 MiniMax VL 等提供商图像默认值（当活动聊天模型为纯文本时）。修复 #47614、#63722、#69171。 - **Codex/media understanding**：通过受限 Codex 应用服务器图像回合支持 `codex/*` 图像模型，同时保持 `openai-codex/*` 在 OpenAI Codex OAuth 路由上，并验证应用服务器响应是否符合生成的协议合约。修复 #70201。 - **Providers/OpenAI Codex**：在 Codex 目录发现遗漏时合成 `openai-codex/gpt-5.5` OAuth 模型行，使 cron 和子代理运行在认证期间不会因“未知模型”失败。 - **Models/Codex**：在从聊天或 CLI 命令添加模型时保留 Codex 提供商元数据，使手动添加的 Codex 模型保持正确的认证和路由行为。(#70820) 感谢 @Takhoffman。 - **Providers/OpenAI**：当激活 `openai-codex` 配置集时，直接将 `openai/gpt-image-2` 路由通过配置的 Codex OAuth，而非先探测 `OPENAI_API_KEY`。 - **Providers/OpenAI**：强化图像生成认证路由和 Codex OAuth 响应解析，使回退仅适用于公共 OpenAI API 路由和受限 SSE 结果。感谢 @Takhoffman。 - **OpenAI/image generation**：将参考图像编辑作为受保护的多部分上传发送而非 JSON 数据 URL，恢复复杂的多参考 `gpt-image-2` 编辑。修复 #70642。感谢 @dashhuang。 - **Providers/OpenRouter**：在图像部分前将图像理解提示作为用户文本发送，恢复 OpenRouter 多模态模型的非空视觉响应。修复 #70410。 - **Providers/Google**：遵循 Gemini 图像生成请求的私有网络 SSRF 选择加入，使将 Google API 主机解析为私有地址的可信代理设置可使用 `image_generate`。修复 #67216。 - **Agents/transport**：停止嵌入式运行降低进程级 undici 流超时，使慢速 Gemini 图像生成和其他长时间提供商请求不再继承短暂的运行尝试标头超时。修复 #70423。感谢 @giangthb。 - **Providers/OpenAI**：遵循 OpenAI 兼容图像生成端点的私有网络 SSRF 选择加入，使可信 LocalAI/LAN `image_generate` 路由无需全局禁用 SSRF 检查即可工作。修复 #62879。感谢 @seitzbg。 - **Providers/OpenAI**：停止通过回退目录播报已移除的 `gpt-5.3-codex-spark` Codex 模型，并用 GPT-5.5 恢复提示抑制过时行。 - **Control UI/chat**：将助手生成的图像持久化为经过身份验证的托管媒体，并接受助手媒体获取的配对设备令牌，使 WebChat 历史重载保持显示生成的图像。(#70719、#70741) 感谢 @Patrick-Erichsen。 - **Control UI/chat**：在网关重连时队列停止按钮中止，使断开连接的活跃运行在重连时被取消，而非仅清除本地 UI 状态。(#70673) 感谢 @chinar-amrutkar。 - **Memory/QMD**：在启动修复发现集合名称已存在时重建过时的托管 QMD 集合，使根内存重新窄化到 `MEMORY.md` 而非保持宽泛的工作区 Markdown 索引。 - **Agents/OpenAI**：从 PI、Codex 和自动回复 harness 路径暴露所选模型容量故障，并附带模型切换提示而非通用空响应错误。感谢 @vincentkoc。 - **Plugins/QR**：用受限的 `qrcode-tui` 助手替换遗留的 `qrcode-terminal` QR 渲染，用于插件登录/设置流程。(#65969) 感谢 @vincentkoc。 - **Voice-call/realtime**：在问候或转发缓冲音频前等待 OpenAI 会话配置，并在流设置前拒绝未列入允许名单的 Twilio 呼叫者。(#43501) 感谢 @forrestblount。 - **ACPX/Codex**：停止为 Codex ACP、Codex 应用服务器和 Codex CLI 运行具体化 `auth.json` 桥接文件；Codex 拥有的运行时现在直接使用其正常的 `CODEX_HOME`/`~/.codex` 认证路径。 - **Auto-reply/system events**：通过持久会话传递上下文路由异步执行事件完成回复，使长时间命令结果返回到原始频道，而非在实时原始元数据缺失时被丢弃。(#70258) 感谢 @wzfukui。 - **Gateway/sessions**：将 WebChat 会话变更保护扩展到 `sessions.compact` 和 `sessions.compaction.restore`，使 `WEBCHAT_UI` 客户端被一致拒绝于压缩侧会话变更，与现有补丁/删除保护相同。(#70716) 感谢 @drobison00。 - **QA channel/security**：在媒体获取前拒绝非 HTTP(S) 入站附件 URL，并记录被拒绝的方案，使可疑或错误配置的负载在调试时可见。(#70708) 感谢 @vincentkoc。 - **Plugins/install**：将主机 OpenClaw 包链接到声明 `openclaw` 对等依赖的外部插件，使仅对等插件 SDK 导入在安装后解析且不捆绑重复主机包。(#70462) 感谢 @anishesg。 - **Plugins/Windows**：在打包运行时依赖修复期间就位刷新打包插件 SDK 别名，使网关和 CLI 插件启动不再在相同访客 npm 更新后因 `ENOTEMPTY`/`EPERM` 竞争而失败。 - **Teams/security**：要求共享 Bot Framework 受众令牌通过验证的 `appid` 或 `azp` 命名配置的 Teams 应用，阻止全局受众上的跨机器人令牌重放。(#70724) 感谢 @vincentkoc。 - **Plugins/startup**：相对于目标插件模块而非中央加载器解析打包插件 Jiti 加载，使 Bun 全局安装在发现打包图像提供商时不再挂起。(#70073) 感谢 @yidianyiko。 - **Anthropic/CLI security**：从 OpenClaw 现有 YOLO 执行策略派生 Claude CLI `bypassPermissions`，保留显式原始 Claude `--permission-mode` 覆盖，并剥离格式错误的权限模式参数而非静默回退到绕过。(#70723) 感谢 @vincentkoc。 - **Android/security**：要求 Android 手动和扫描路由仅环回明文网关连接，使私有 LAN 和链路本地 `ws://` 端点现在失败关闭，除非启用 TLS。(#70722) 感谢 @vincentkoc。 - **Pairing/security**：要求私有 IP 或环回主机用于明文移动配对，并停止将 `.local` 或无点主机名视为安全明文端点。(#70721) 感谢 @vincentkoc。 - **Plugins/security**：停止设置 API 查找回退到启动目录，使工作区本地 `extensions/<plugin>/setup-api.*` 文件在提供商设置解析期间无法执行。(#70718) 感谢 @drobison00。 - **Approvals/security**：要求显式聊天执行批准启用，而非因批准者从配置或所有者允许列表解析而自动启用批准客户端。(#70715) 感谢 @vincentkoc。 - **Discord/security**：保持原生斜杠命令频道策略不绕过配置的所有者或成员限制，同时在没有更严格访问规则时保留频道策略回退。(#70711) 感谢 @vincentkoc。 - **Android/security**：停止 `ASK_OPENCLAW` 意图自动发送注入的提示，使外部应用操作仅预填充草稿而非立即调度它。(#70714) 感谢 @vincentkoc。 - **Secrets/Windows**：从文件支持的机密剥离 UTF-8 BOM，并使不可用 ACL 检查失败关闭，除非受信任的文件或执行提供商明确选择加入 `allowInsecurePath`。(#70662) 感谢 @zhanggpcsu。 - **Agents/image generation**：转义工具警告中被忽略的覆盖值，使解析的 `MEDIA:` 指令无法通过不支持的模型选项注入。(#70710) 感谢 @vincentkoc。 - **QQBot/security**：要求框架认证用于 `/bot-approve`，使未经授权的 QQ 发送者无法通过未认证的预分发斜杠命令路径更改执行批准设置。(#70706) 感谢 @vincentkoc。 - **MCP/tools**：停止 ACPX OpenClaw 工具桥列出或调用仅所有者工具（如 `cron`），关闭非所有者 MCP 调用者的权限提升路径。(#70698) 感谢 @vincentkoc。 - **Feishu/onboarding**：通过仅设置的 barrel 加载 Feishu 设置界面，使首次运行设置不再在打包运行时依赖就位前导入 Feishu 的 Lark SDK。(#70339) 感谢 @andrejtr。 - **Approvals/startup**：允许原生批准处理器在网关认证后报告就绪，同时在后台重放待处理批准，使缓慢或失败的重放传递不再阻止处理器启动或放大重连风暴。 - **WhatsApp/security**：将联系人/vCard/位置结构化对象自由文本保留在行内消息体之外，并通过围栏不受信任的元数据 JSON 渲染，限制名称、电话字段和位置标签/注释中的隐藏提示注入负载。 - **Group-chat/security**：将频道来源的群组名称和参与者标签保留在行内群组系统提示之外，并通过围栏不受信任的元数据 JSON 渲染。 - **Agents/replay**：在严格重放消毒过程中保留 Kimi 风格 `functions.<name>:<index>` 工具调用 ID，使自定义 OpenAI 兼容 Kimi 路由保持多轮工具使用完整。(#70693) 感谢 @geri4。 - **Discord/replies**：通过出站传递保留最终回复权限上下文，使 Discord 回复在发送时保持相同的频道/成员路由规则。 - **Plugins/startup**：从打包安装和外部运行时依赖阶段根恢复打包插件 `openclaw/plugin-sdk/*` 解析，使 Telegram/Discord 在缺失依赖修复后不再因 `Cannot find package 'openclaw'` 崩溃循环。(#70852) 感谢 @simonemacario。 - **CLI/Claude**：在 `claude-cli` 回合上运行与直接嵌入式运行相同的提示构建钩子和触发/频道上下文，保持 Claude Code 会话与 OpenClaw 工作区身份、路由和钩子驱动提示突变一致。(#70625) 感谢 @mbelinky。 - **Discord/plugin startup**：将子代理钩子保留在 Discord 频道条目后的惰性位置，使打包条目导入保持狭窄，并用频道 ID 和条目路径报告导入失败。 - **Memory/doctor**：将根持久内存规范化为 `MEMORY.md`，停止将小写 `memory.md` 视为运行时回退，并让 `openclaw doctor --fix` 将真正的分裂脑根文件合并到 `MEMORY.md` 并备份。(#70621) 感谢 @mbelinky。 - **Providers/Anthropic Vertex**：通过解决发出的发现条目恢复轻量级提供商发现路径后的 ADC 支持模型发现，在引导发现上暴露合成认证，并在探测默认 GCP ADC 路径时遵循复制的环境快照。修复 #65715。(#65716) 感谢 @feiskyer。 - **Codex harness/status**：每个会话固定嵌入式 harness 选择，在 `/status` 中显示活动的非 PI harness ID（如 `codex``），并保持 PI 上的遗留会话直到 `/new` 或 `/reset`，使配置更改无法热切换现有会话。 - **Gateway/security**：通过允许列表一组狭窄的代理可调提示、模型和提及门控路径（包括 Telegram 主题级 `requireMention`），对代理驱动的 `gateway config.apply`/`config.patch` 运行时编辑失败关闭，而非依赖可能遗漏新敏感配置键的手动维护的保护子树拒绝列表。(#70726) 感谢 @drobison00。 - **Webhooks/security**：在每个请求上重新解析 `SecretRef` 支持的 webhook 路由机密，使 `openclaw secrets reload` 立即撤销先前机密，而非等待网关重启。(#70727) 感谢 @drobison00。

### Changes - Providers/OpenAI: add image generation and reference-image editing through Codex OAuth, so `openai/gpt-image-2` works without an `OPENAI_API_KEY`. Fixes #70703. - Providers/OpenRouter: add image generation and reference-image editing through `image_generate`, so OpenRouter image models work with `OPENROUTER_API_KEY`. Fixes #55066 via #67668. Thanks @notamicrodose. - Image generation: let agents request provider-supported quality and output format hints, and pass OpenAI-specific background, moderation, compression, and user hints through the `image_generate` tool. (#70503) Thanks @ottodeng. - Agents/subagents: add optional forked context for native `sessions_spawn` runs so agents can let a child inherit the requester transcript when needed, while keeping clean isolated sessions as the default; includes prompt guidance, context-engine hook metadata, docs, and QA coverage. - Agents/tools: add optional per-call `timeoutMs` support for image, video, music, and TTS generation tools so agents can extend provider request timeouts only when a specific generation needs it. - Memory/local embeddings: add configurable `memorySearch.local.contextSize` with a 4096 default so local embedding contexts can be tuned for constrained hosts without patching the memory host. (#70544) Thanks @aalekh-sarvam. - Dependencies/Pi: update bundled Pi packages to `0.70.0`, use Pi's upstream `gpt-5.5` catalog metadata for OpenAI and OpenAI Codex, and keep only local `gpt-5.5-pro` forward-compat handling. - Codex harness: add structured debug logging for embedded harness selection decisions so `/status` stays simple while gateway logs explain auto-selection and Pi fallback reasons. (#70760) Thanks @100yenadmin. ### Fixes - Codex harness: route native `request_user_input` prompts back to the originating chat, preserve queued follow-up answers, and honor newer app-server command approval amendment decisions. - Codex harness/context-engine: redact context-engine assembly failures before logging, so fallback warnings do not serialize raw error objects. (#70809) Thanks @jalehman. - WhatsApp/onboarding: keep first-run setup entry loading off the Baileys runtime dependency path, so packaged QuickStart installs can show WhatsApp setup before runtime deps are staged. Fixes #70932. - Block streaming: suppress final assembled text after partial block-delivery aborts when the already-sent text chunks exactly cover the final reply, preventing duplicate replies without dropping unrelated short messages. Fixes #70921. - Codex harness/Windows: resolve npm-installed `codex.cmd` shims through PATHEXT before starting the native app-server, so `codex/*` models work without a manual `.exe` shim. Fixes #70913. - Slack/groups: classify MPIM group DMs as group chat context and suppress verbose tool/plan progress on Slack non-DM surfaces, so internal "Working…" traces no longer leak into rooms. Fixes #70912. - Agents/replay: stop OpenAI/Codex transcript replay from synthesizing missing tool results while still preserving synthetic repair on Anthropic, Gemini, and Bedrock transport-owned sessions. (#61556) Thanks @VictorJeon and @vincentkoc. - Telegram/media replies: parse remote markdown image syntax into outbound media payloads on the final reply path, so Telegram group chats stop falling back to plain-text image URLs when the model or a tool emits `![...](...)` instead of a `MEDIA:` token. (#66191) Thanks @apezam and @vincentkoc. - Agents/WebChat: surface non-retryable provider failures such as billing, auth, and rate-limit errors from the embedded runner instead of logging `surface_error` and leaving webchat with no rendered error. Fixes #70124. (#70848) Thanks @truffle-dev. - WhatsApp: unify outbound media normalization across direct sends and auto-replies. Thanks @mcaxtr. - Memory/CLI: declare the built-in `local` embedding provider in the memory-core manifest, so standalone `openclaw memory status`, `index`, and `search` can resolve local embeddings just like the gateway runtime. Fixes #70836. (#70873) Thanks @mattznojassist. - Gateway/WebChat: preserve image attachments for text-only primary models by offloading them as media refs instead of dropping them, so configured image tools can still inspect the original file. Fixes #68513, #44276, #51656, #70212. - Plugins/Google Meet: hang up delegated Twilio calls on leave, clean up Chrome realtime audio bridges when launch fails, and use a flat provider-safe tool schema. - Media understanding: honor explicit image-model configuration before native-vision skips, including `agents.defaults.imageModel`, `tools.media.image.models`, and provider image defaults such as MiniMax VL when the active chat model is text-only. Fixes #47614, #63722, #69171. - Codex/media understanding: support `codex/*` image models through bounded Codex app-server image turns, while keeping `openai-codex/*` on the OpenAI Codex OAuth route and validating app-server responses against generated protocol contracts. Fixes #70201. - Providers/OpenAI Codex: synthesize the `openai-codex/gpt-5.5` OAuth model row when Codex catalog discovery omits it, so cron and subagent runs do not fail with `Unknown model` while the account is authenticated. - Models/Codex: preserve Codex provider metadata when adding models from chat or CLI commands, so manually added Codex models keep the right auth and routing behavior. (#70820) Thanks @Takhoffman. - Providers/OpenAI: route `openai/gpt-image-2` through configured Codex OAuth directly when an `openai-codex` profile is active, instead of probing `OPENAI_API_KEY` first. - Providers/OpenAI: harden image generation auth routing and Codex OAuth response parsing so fallback only applies to public OpenAI API routes and bounded SSE results. Thanks @Takhoffman. - OpenAI/image generation: send reference-image edits as guarded multipart uploads instead of JSON data URLs, restoring complex multi-reference `gpt-image-2` edits. Fixes #70642. Thanks @dashhuang. - Providers/OpenRouter: send image-understanding prompts as user text before image parts, restoring non-empty vision responses for OpenRouter multimodal models. Fixes #70410. - Providers/Google: honor the private-network SSRF opt-in for Gemini image generation requests, so trusted proxy setups that resolve Google API hosts to private addresses can use `image_generate`. Fixes #67216. - Agents/transport: stop embedded runs from lowering the process-wide undici stream timeouts, so slow Gemini image generation and other long-running provider requests no longer inherit short run-attempt headers timeouts. Fixes #70423. Thanks @giangthb. - Providers/OpenAI: honor the private-network SSRF opt-in for OpenAI-compatible image generation endpoints, so trusted LocalAI/LAN `image_generate` routes work without disabling SSRF checks globally. Fixes #62879. Thanks @seitzbg. - Providers/OpenAI: stop advertising the removed `gpt-5.3-codex-spark` Codex model through fallback catalogs, and suppress stale rows with a GPT-5.5 recovery hint. - Control UI/chat: persist assistant-generated images as authenticated managed media and accept paired-device tokens for assistant media fetches, so webchat history reloads keep showing generated images. (#70719, #70741) Thanks @Patrick-Erichsen. - Control UI/chat: queue Stop-button aborts across Gateway reconnects so a disconnected active run is canceled on reconnect instead of only clearing local UI state. (#70673) Thanks @chinar-amrutkar. - Memory/QMD: recreate stale managed QMD collections when startup repair finds the collection name already exists, so root memory narrows back to `MEMORY.md` instead of staying on broad workspace markdown indexing. - Agents/OpenAI: surface selected-model capacity failures from PI, Codex, and auto-reply harness paths with a model-switch hint instead of the generic empty-response error. Thanks @vincentkoc. - Plugins/QR: replace legacy `qrcode-terminal` QR rendering with bounded `qrcode-tui` helpers for plugin login/setup flows. (#65969) Thanks @vincentkoc. - Voice-call/realtime: wait for OpenAI session configuration before greeting or forwarding buffered audio, and reject non-allowlisted Twilio callers before stream setup. (#43501) Thanks @forrestblount. - ACPX/Codex: stop materializing `auth.json` bridge files for Codex ACP, Codex app-server, and Codex CLI runs; Codex-owned runtimes now use their normal `CODEX_HOME`/`~/.codex` auth path directly. - Auto-reply/system events: route async exec-event completion replies through the persisted session delivery context, so long-running command results return to the originating channel instead of being dropped when live origin metadata is missing. (#70258) Thanks @wzfukui. - Gateway/sessions: extend the webchat session-mutation guard to `sessions.compact` and `sessions.compaction.restore`, so `WEBCHAT_UI` clients are rejected from compaction-side session mutations consistently with the existing patch/delete guards. (#70716) Thanks @drobison00. - QA channel/security: reject non-HTTP(S) inbound attachment URLs before media fetch, and log rejected schemes so suspicious or misconfigured payloads are visible during debugging. (#70708) Thanks @vincentkoc. - Plugins/install: link the host OpenClaw package into external plugins that declare `openclaw` as a peer dependency, so peer-only plugin SDK imports resolve after install without bundling a duplicate host package. (#70462) Thanks @anishesg. - Plugins/Windows: refresh the packaged plugin SDK alias in place during bundled runtime dependency repair, so gateway and CLI plugin startup no longer race on `ENOTEMPTY`/`EPERM` after same-guest npm updates. - Teams/security: require shared Bot Framework audience tokens to name the configured Teams app via verified `appid` or `azp`, blocking cross-bot token replay on the global audience. (#70724) Thanks @vincentkoc. - Plugins/startup: resolve bundled plugin Jiti loads relative to the target plugin module instead of the central loader, so Bun global installs no longer hang while discovering bundled image providers. (#70073) Thanks @yidianyiko. - Anthropic/CLI security: derive Claude CLI `bypassPermissions` from OpenClaw's existing YOLO exec policy, preserve explicit raw Claude `--permission-mode` overrides, and strip malformed permission-mode args instead of silently falling back to a bypass. (#70723) Thanks @vincentkoc. - Android/security: require loopback-only cleartext gateway connections on Android manual and scanned routes, so private-LAN and link-local `ws://` endpoints now fail closed unless TLS is enabled. (#70722) Thanks @vincentkoc. - Pairing/security: require private-IP or loopback hosts for cleartext mobile pairing, and stop treating `.local` or dotless hostnames as safe cleartext endpoints. (#70721) Thanks @vincentkoc. - Plugins/security: stop setup-api lookup from falling back to the launch directory, so workspace-local `extensions/<plugin>/setup-api.*` files cannot be executed during provider setup resolution. (#70718) Thanks @drobison00. - Approvals/security: require explicit chat exec-approval enablement instead of auto-enabling approval clients just because approvers resolve from config or owner allowlists. (#70715) Thanks @vincentkoc. - Discord/security: keep native slash-command channel policy from bypassing configured owner or member restrictions, while preserving channel-policy fallback when no stricter access rule exists. (#70711) Thanks @vincentkoc. - Android/security: stop `ASK_OPENCLAW` intents from auto-sending injected prompts, so external app actions only prefill the draft instead of dispatching it immediately. (#70714) Thanks @vincentkoc. - Secrets/Windows: strip UTF-8 BOMs from file-backed secrets and keep unavailable ACL checks fail-closed unless trusted file or exec providers explicitly opt into `allowInsecurePath`. (#70662) Thanks @zhanggpcsu. - Agents/image generation: escape ignored override values in tool warnings so parsed `MEDIA:` directives cannot be injected through unsupported model options. (#70710) Thanks @vincentkoc. - QQBot/security: require framework auth for `/bot-approve` so unauthorized QQ senders cannot change exec approval settings through the unauthenticated pre-dispatch slash-command path. (#70706) Thanks @vincentkoc. - MCP/tools: stop the ACPX OpenClaw tools bridge from listing or invoking owner-only tools such as `cron`, closing a privilege-escalation path for non-owner MCP callers. (#70698) Thanks @vincentkoc. - Feishu/onboarding: load Feishu setup surfaces through a setup-only barrel so first-run setup no longer imports Feishu's Lark SDK before bundled runtime deps are staged. (#70339) Thanks @andrejtr. - Approvals/startup: let native approval handlers report ready after gateway authentication while replaying pending approvals in the background, so slow or failing replay delivery no longer blocks handler startup or amplifies reconnect storms. - WhatsApp/security: keep contact/vCard/location structured-object free text out of the inline message body and render it through fenced untrusted metadata JSON, limiting hidden prompt-injection payloads in names, phone fields, and location labels/comments. - Group-chat/security: keep channel-sourced group names and participant labels out of inline group system prompts and render them through fenced untrusted metadata JSON. - Agents/replay: preserve Kimi-style `functions.<name>:<index>` tool-call IDs during strict replay sanitization so custom OpenAI-compatible Kimi routes keep multi-turn tool use intact. (#70693) Thanks @geri4. - Discord/replies: preserve final reply permission context through outbound delivery so Discord replies keep the same channel/member routing rules at send time. - Plugins/startup: restore bundled plugin `openclaw/plugin-sdk/*` resolution from packaged installs and external runtime-deps stage roots, so Telegram/Discord no longer crash-loop with `Cannot find package 'openclaw'` after missing dependency repair. (#70852) Thanks @simonemacario. - CLI/Claude: run the same prompt-build hooks and trigger/channel context on `claude-cli` turns as on direct embedded runs, keeping Claude Code sessions aligned with OpenClaw workspace identity, routing, and hook-driven prompt mutations. (#70625) Thanks @mbelinky. - Discord/plugin startup: keep subagent hooks lazy behind Discord's channel entry so packaged entry imports stay narrow and report import failures with the channel id and entry path. - Memory/doctor: keep root durable memory canonicalized on `MEMORY.md`, stop treating lowercase `memory.md` as a runtime fallback, and let `openclaw doctor --fix` merge true split-brain root files into `MEMORY.md` with a backup. (#70621) Thanks @mbelinky. - Providers/Anthropic Vertex: restore ADC-backed model discovery after the lightweight provider-discovery path by resolving emitted discovery entries, exposing synthetic auth on bootstrap discovery, and honoring copied env snapshots when probing the default GCP ADC path. Fixes #65715. (#65716) Thanks @feiskyer. - Codex harness/status: pin embedded harness selection per session, show active non-PI harness ids such as `codex` in `/status`, and keep legacy transcripts on PI until `/new` or `/reset` so config changes cannot hot-switch existing sessions. - Gateway/security: fail closed on agent-driven `gateway config.apply`/`config.patch` runtime edits by allowlisting a narrow set of agent-tunable prompt, model, and mention-gating paths (including Telegram topic-level `requireMention`) instead of relying on a hand-maintained denylist of protected subtrees that could miss new sensitive config keys. (#70726) Thanks @drobison00. - Webhooks/security: re-resolve `SecretRef`-backed webhook route secrets on each request so `openclaw secrets reload` revokes the previous secret immediately instead of waiting for a gateway restart. (#70727) Thanks @drobison00.

OpenClaw v2026.4.23-beta.4 预发布