OpenClaw v2026.5.14-beta.1

### 变更 - 依赖项：通过 `@openclaw/proxyline` 路由根环境 Node 代理，并移除根 `proxy-agent`、`https-proxy-agent` 和 `minimatch` 依赖。 - 控制 UI/i18n：为硬编码副本重点区域和语言环境回退元数据添加 `pnpm ui:i18n:report` 基线报告。（#81320）感谢 @samzong。 - 维护者工具：添加仓库本地 `codex-review` 技能，用于 Codex 结案审查，包括本地脏工作区和 PR 分支审查助手，这些助手会重新运行直到没有已接受/可操作的结果，并使用 `--base` 避免不受支持的内联提示。 - 维护者工具：当拉取请求添加包补丁文件或 pnpm 修补的依赖项时，CI 失败，保留上游和升级依赖工作流程。 - Codex 应用服务器：将评论前言流式传输到可编辑的频道进度草稿中，而不将其提升为最终答案。 - Codex 迁移：移除捆绑的 `codex-cli` 后端，并将旧的 `codex-cli/*` 模型引用修复为 `openai/*` 上的 Codex 应用服务器路由。 - 网关/启动：为身份验证、插件加载、查找计数和插件 sidecar 服务添加所有者级别的启动跟踪属性。（#81738）感谢 @samzong。 - 频道/状态反应：将 `StatusReactionController` 接入 WhatsApp 消息轮次（排队 → 思考 → 工具 → 完成/错误生命周期，与 Telegram 和 Discord 一致），添加 `deploy`/`build`/`concierge` 表情符号类别并带有工具令牌路由，并将状态反应默认值替换为自解释表情符号（🧠 思考、🛠️ 工具、💻 编程、🌐 网络、⏳ 软停滞、⚠️ 硬停滞、✅ 完成、❌ 错误、🗜️ 压缩），从而使停滞和生命周期反应读作状态指示符而非情感评论。修复 #59077。（#80612）感谢 @gado-ships-it。 - 控制 UI：在“外观”和“快速设置”中添加浏览器本地文本大小设置，缩放聊天和密集 UI 文本，同时将输入框保持在移动 Safari 焦点缩放阈值以上。修复 #8547。感谢 @BunsDev。 - 文档：添加专门的 ds4 提供者页面，包含本地 DeepSeek V4 Flash 配置、按需启动、上下文大小设置和实时验证步骤。 - 发布验证：添加包安装的 Docker 用户旅程通道，验证入门、模拟模型设置、外部插件安装/卸载、ClickClack 出站/入站消息传递、网关重启持久性以及 doctor。 - 发布验证：添加包安装的 Docker 通道，用于真实 TTY 入门、媒体和内存持久性、已发布包升级旅程以及本地市场插件安装/更新/卸载覆盖。 - 维护者：添加 Clawdtributor 技能，用于基于 Discrawl 的贡献者 PR 分类、实时状态检查和紧凑审查格式。 - Telegram：在通用消息呈现负载中支持 Mini App `web_app` 按钮，允许 `openclaw message send --presentation` 为私人聊天渲染 Telegram Web App 内联按钮。（#81356）感谢 @jzakirov。 - 脚本：添加 `OPENCLAW_HEAVY_CHECK_LOCK_SCOPE=worktree`，以便高容量本地工作树可以使用独立的繁重检查锁，而共享锁保持默认。修复 #80729。（#80734）感谢 @samzong。 - 代理/子代理：在子会话的第一个可见 `[Subagent Task]` 消息中交付原生 `sessions_spawn` 任务，而不是将任务隐藏在子代理系统提示中，保持委托可审计而不重复令牌。修复 #78592。感谢 @bradestes 和 @stainlu。 - 消息/队列：使轮次中提示默认通过 `/queue steer` 引导活动运行，保留 `/queue followup` 和 `/queue collect` 供希望消息默认排队的用户使用，并使 `/steer` 在引导不可用时继续作为正常提示。（#77023）感谢 @fuller-stack-dev。 - 语音通话/Telnyx：添加实时媒体流式通话支持，用于对话式语音通话。（#81024）感谢 @dynamite-bud。 - 依赖项：添加发布依赖证据报告、npm 建议门控和 PR 依赖变更感知，以便维护者可以在发布前后审查依赖风险。感谢 @joshavant。 - 网关：在代理事件负载上公开可选的 `isHeartbeat` 元数据，以便客户端区分计划的心跳运行和普通聊天运行。（#80610）感谢 @medns。 - 代理：添加 `agents.defaults.runRetries` 和 `agents.list[].runRetries` 配置，用于嵌入式 Pi 运行器重试循环限制。（#80661）感谢 @medns。 - Codex：添加基于节点的 Codex CLI 会话列表和绑定，以便 OpenClaw 对话可以继续在配对节点上运行的现有 Codex CLI 会话。 ### 修复 - Cron/Codex：将精确命令的计划代理轮次默认为轻量级引导上下文，以便自动化在加载工作区身份或内存上下文之前运行命令。 - Codex 插件/网关：从 Codex 应用服务器 JSON-RPC 负载中剥离未配对的 UTF-16 代理对，并让过期的回复工作恢复中止停滞的回复运行，防止格式错误的媒体轮次卡住网关通道。 - Codex 应用服务器：强制执行 OAuth 刷新请求以执行真正的令牌刷新，而不是在刷新失败后重用未更改的继承身份验证配置文件令牌。（#80738）感谢 @simplyclever914。 - 控制 UI/WebChat：将 `/tts audio` 回复渲染为可通过助手媒体票据路径播放的音频附件，并为较旧的实时负载提供结构化音频兼容性。（#81722）感谢 @Conan-Scott。 - 将网关审批访问绑定到请求者元数据 [AI]。（#81380）感谢 @pgondhi987。 - Telegram：让隔离的轮询同时处理独立主题、直接消息和状态/控制命令，同时保留同通道顺序。（#81849）感谢 @VACInc。 - 构建：将外部化的 Slack、OpenShell 沙箱和 Anthropic Vertex 运行时依赖声明保留在根分发构件构建之外。 - ClawHub：将 Amazon Bedrock 和 Bedrock Mantle 提供者包包含在发布的注册表元数据中，以便外部化提供者可以从 ClawHub 以及 npm 中发现。 - 自动回复/Claude CLI：通过 `onReasoningStream` 将 CLI 运行时助手文本增量代理事件桥接到聊天推理预览中，镜像现有的助手文本（#76914）和工具事件（#80046）桥接，并添加门控，使非 CLI 运行时不受影响。感谢 @anagnorisis2peripeteia 和 @pashpashpash。 - Mantis：仅将 QA 证据保留在 Actions 构件中，并停止将证据文件发布到 Git 备份的工件分支。 - CLI/迁移：处理延迟的 Codex 插件市场响应，以便警告、后续步骤和冲突状态使用 ⚠️ 符号渲染，并且安装后迁移重试市场获取而不是静默跳过插件项。（#81625）感谢 @sjf。 - 频道/微信：将捆绑的 `@tencent-weixin/openclaw-weixin` 外部入口从 `2.4.1` 升级到 `2.4.3`，以便入门和 `openclaw channels add` 安装当前的腾讯微信（个人微信）插件版本。（#81730）感谢 @scotthuang。 - CLI：延迟加载模型、插件和设备运行时助手，并将频道选项帮助保留在生成的启动元数据或通用回退文本上，以便父级/帮助输出无需导入这些运行时路径即可渲染。 - CLI：通过解析的命令快速路径路由 `plugins list --json`，并在响应预算中涵盖它，以便插件 JSON 清单避免完整的 CLI 注册工作。 - 网关/网络：将 OpenClaw 安装的 undici 调度器保留在 HTTP/1.1 上，并将已销毁的 HTTP/2 会话错误视为可恢复的网络拆除，防止 `ERR_HTTP2_INVALID_SESSION` 崩溃活动网关轮次。修复 #81627。（#81838）感谢 @joshavant。 - 内存/每日文件：扩展每日内存文件匹配器，用于 Dreaming、rem-backfill、rem-harness、doctor 扫描和短期提升，以便捆绑的会话内存钩子（以及任何未来的 slug 变体）写入的 `memory/YYYY-MM-DD-<slug>.md` 文件与仅日期 `memory/YYYY-MM-DD.md` 格式一起被发现。日期提取仍然使用前导的 `YYYY-MM-DD` 捕获组，因此现有仅日期文件的每日摄入/提升语义不变；带 slug 的文件现在通过相同路径流动，而不是被静默跳过。修复 #69536。感谢 @jack-stormentswe。 - macOS/网关：当配置的网关端口在清理后仍然繁忙时，使托管的 LaunchAgent 停止和重启失败，而不是在监听器仍然存在时报告成功。修复 #73132。感谢 @BunsDev。 - Telegram：重用粘性 IPv4 Bot API 传输进行定期 getMe 健康检查，以便 IPv4 正常工作的主机在 IPv6 出口出现故障时停止记录重复的探测超时。修复 #76852。（#76856）感谢 @SymbolStar。 - Telegram：将隔离的轮询工作器放置在捆绑工作器加载器使用的根分发路径中，避免因查找 `dist/telegram-ingress-worker.runtime.js` 而启动失败。 - 控制 UI/网关：当没有可用的受信任设备令牌重试时，停止过期的令牌不匹配重连循环，并根据原始工具输出大小限制渲染的聊天历史，以便仪表板身份验证/历史工作不会持续降低频道套接字。修复 #72139。感谢 @BunsDev。 - 内存/每日文件：在限制的实时摄入和历史播种期间，优先使用规范的 `memory/YYYY-MM-DD.md` 每日笔记，而不是同一天带 slug 的会话捕获，从而在带 slug 文件存在时保留现有每日笔记行为。 - 网关/兼容 OpenAI 的 HTTP：解析共享 JSON 端点路径而不信任格式错误的 Host 标头，避免在 `/v1/chat/completions`、`/v1/responses` 和 `/v1/embeddings` 请求处理之前出现 500 错误。 - Telegram：使用活动运行时配置解析插件原生命令，以便像 `/codex ...` 这样的命令保持在原生命令路径上。 - 语音通话 webhook：解析 webhook 和实时升级路径而不信任格式错误的 Host 标头，避免在提供者签名检查或路径拒绝之前出现 500 错误。 - 媒体存储：拒绝格式错误的重定向 `Location` 标头作为媒体下载失败，而不是让 URL 解析逃逸异步响应回调。 - ClickClack：跳过格式错误的实时 websocket 帧，而不是在单个错误 JSON 事件上停止频道监视器。 - 浏览器工具：将格式错误的节点代理 `payloadJSON` 响应视为浏览器代理失败，而不是泄漏原始 JSON 解析器错误。 - 网关 HTTP：匹配模型、会话终止和会话历史路由路径而不信任格式错误的 Host 标头，避免在这些端点上出现预身份验证 500 错误。 - Google Meet/Codex：使用插件拥有的错误报告格式错误的节点代理 `payloadJSON` 响应，而不是泄漏原始 JSON 解析器失败。 - 调试代理：拒绝格式错误的相对形式代理目标，返回受控的 400 响应，而不是让 URL 解析逃逸请求处理程序。 - 文件传输：在计算哈希或调用配对节点之前拒绝格式错误的内联 `file_write` base64，避免 Node 宽松的 base64 解码器。 - QA 频道：跳过格式错误的内联入站附件 base64，而不是为代理轮次暂存静默损坏的媒体。 - Microsoft Teams：拒绝格式错误的内联 HTML 图像 base64 填充，而不是解码损坏的 `data:` 图像附件。 - 语音通话实时：在将音频转发到桥接和转录路径之前忽略格式错误的提供者媒体帧 base64。 - QQBot：在 JSON 解码结构化提醒数据之前拒绝格式错误的存储 cron 负载 base64。 - Telnyx 语音通话：当 webhook 状态为格式错误的 base64 时，使用原始 `client_state` 回退，而不是使用静默损坏的解码文本。 - Google Meet：使用插件拥有的错误报告格式错误的节点主机参数 JSON，而不是泄漏原始 JSON 解析器失败。 - CLI/export-trajectory：使用稳定的 CLI 错误报告格式错误的编码请求 JSON，而不是泄漏原始解析器输出。 - Twilio 语音通话：使用提供者拥有的错误报告格式错误的成功 API JSON 响应，而不是泄漏原始解析器失败。 - 语音通话提供者 API：使用提供者前缀的错误报告格式错误的成功受保护 JSON 响应，而不是泄漏原始解析器失败。 - 实时转录：使用拥有的解析器错误报告格式错误的提供者 websocket JSON 帧，而不是泄漏原始 `SyntaxError` 对象。 - Microsoft Foundry：使用拥有的身份验证错误报告格式错误的 Azure CLI 令牌 JSON，而不是泄漏原始解析器失败。 - 网关/模型定价：使用源拥有的错误报告格式错误的外部定价目录 JSON，而不是泄漏原始解析器失败。 - QA Lab：使用拥有的错误报告格式错误的模型目录子进程 JSON，并忽略无效的目录行。 - Google Meet：使用插件拥有的错误报告格式错误的浏览器控制状态 JSON，而不是泄漏原始解析器失败。 - Google 提供者：使用提供者拥有的错误报告格式错误的 SSE 流 JSON，而不是泄漏原始解析器失败。 - 节点主机：使用稳定的无效请求错误报告格式错误的内置调用 `paramsJSON`，而不是泄漏原始解析器失败。 - Amazon Bedrock 嵌入：使用提供者拥有的错误报告格式错误的提供者响应 JSON，而不是泄漏原始解析器失败。 - QQBot：使用提供者拥有的错误报告格式错误的访问令牌 JSON，而不是泄漏原始解析器失败。 - OpenAI 嵌入：使用提供者拥有的错误报告格式错误的批处理输出 JSONL，而不是泄漏原始解析器失败。 - Synology Chat：使用稳定的频道拥有的解析器错误报告格式错误的 JSON webhook 负载。 - Mattermost：使用稳定的频道拥有的解析器错误报告格式错误的交互回调 JSON。 - Matrix：忽略可选位置 URI 参数中格式错误的百分比编码，而不是让错误的 `geo:` 事件中止入站消息处理。 - 网络搜索：通过其旧的 `tools.web.search.apiKey` 兼容性回退自动检测 Brave，同时保留 doctor 迁移到 `plugins.entries.brave.config.webSearch.apiKey` 作为规范修复，以便允许列表中的孤立 cron 运行在迁移之前不会报告 `web_search` 不可用。修复 #81538。感谢 @atomicmonk。 - 插件：记忆化重复的进程内插件元数据快照，并防止消失的托管安装残留强制完全派生发现，从而减少大型插件集下的网关/状态启动扫描。修复 #81143 和 #79806。（#81570）感谢 @Kaspre、@holgergruenhagen、@JanPlessow 和 @mjamiv。 - CLI/插件：仅在 JSON 输出命令注册期间将延迟插件命令注册闲聊路由到 stderr，使插件支持的 `--json` 标准输出可解析，而不改变仅解析或透传 `--json` 行为。修复 #81535。（#81536）感谢 @ScientificProgrammer 和 @vincentkoc。 - 插件：将 git 插件安装引用视为引用而不是检出标志，因此类似选项的选择器使检出失败，而不是静默安装默认分支。修复 #79898。（#79901）感谢 @afurm 和 @vincentkoc。 - Web：在提供者所有权解析期间尊重显式配置的全局 `web_search` 提供者，同时将沙箱化的 `web_fetch` 限制为捆绑提供者。 - 插件/doctor：通过将它们的 npm 包重新安装到托管插件根目录而不是加载工作区 `node_modules` 来修复已配置的旧 npm 声明存根，并在发现看到这些存根时发出警告。修复 #79632。感谢 @Dylanzhang1128 和 @vincentkoc。 - 频道：当已配置的第三方频道插件在其清单中声明了 `channels` 但尚未添加 `channelConfigs` 元数据时，使其在 `openclaw channels list` 中保持可见。修复 #81334。（#81340）感谢 @AllynSheep 和 @vincentkoc。 - 代理：在完成的 `continuation-skip` 轮次上跳过引导文件和解钩预加载工作（当没有待处理的工作区引导时），减少隔离代理的延迟而不改变首次轮次引导行为。修复 #81548。感谢 @delizaran-unpa。 - 配置：针对插件拥有的通道模式验证 JSON 模拟运行，使外部通道字段不会被过时的捆绑模式拒绝。修复 #77887。（#81504）感谢 @giodl73-repo。 - iOS：恢复首次使用时的联系人、日历和提醒权限提示，并在设置中添加隐私与访问状态/操作。感谢 @BunsDev。 - Canvas：对格式错误的百分比编码的 Canvas/A2UI/文档资产路径返回“未找到”，并在路径规范化之前阻止解码的父级遍历。 - Telegram：允许受信任的本地 Bot API 媒体文件，其文件名以点开头，而不是回退到远程下载。 - 代理/Codex 应用服务器：当运行切换到有效的沙箱工作区时，将注入的上下文文件映射到双点前缀的工作区目录下。 - 控制 UI/i18n：使用已安装的工作区 pi 运行时进行语言环境刷新，更新回退包固定，并跳过具有无效提供者凭据的计划刷新，而不是使主程序失败。 - CI/性能：在检出和发布期间对 clawgrit 报告仓库远程进行身份验证，以便性能报告推送不会在基准测试完成后失败。 - 钩子：从双点前缀目录加载工作区相对路径的旧钩子模块，而不将文件名前缀视为父级遍历。 - 插件：保留已安装包元数据和持久注册表新鲜度检查，用于双点前缀目录下的插件包路径。 - 代理：允许双点前缀文件名（如 `..note.txt`）通过沙箱 FS 桥接、远程沙箱读取和 apply_patch 摘要，而不将名称误认为是父级遍历。 - CLI/迁移：在非冲突的 Codex 技能和插件选择提示中隐藏每项源/插件提示，将提示文本保留给实际需要注意的行。感谢 @sjf。 - Codex 测试框架：将高置信度应用服务器 OAuth 刷新失效视为终端身份验证配置文件失败，停止重复的原始令牌刷新错误，而不将权利或使用限制负载转化为重新身份验证提示。 - CLI/迁移：在迁移 UI 中人性化 Codex 冲突状态消息，使选择提示和计划/结果行显示“Codex 技能已安装在工作区中”，而不是暴露内部 `MIGRATION_REASON_*` 代码。感谢 @sjf。 - CLI/迁移：使用不同的符号渲染迁移结果行：手动审查（🔍）和归档（📖）项，而不是误导性的“已跳过”和“已迁移”勾号，以便用户可以看到哪些条目仍需要关注 vs 哪些已被归档。感谢 @sjf。 - CLI/迁移：将 Codex 迁移输出拆分为单独的预览和结果阶段，以便“之前”计划和“之后”结果通过 clack 渲染，并带有独立可调的文本。感谢 @sjf。 - Codex 应用服务器：将项目捆绑和用户 MCP 服务器投射到 Codex 线程中，在 MCP 服务器被禁用时旋转线程，将捆绑 MCP 注入范围限定到捆绑服务器，并在恢复时重新发送用户 MCP 配置，以便 MCP 更改在会话中期生效而无需重启代理。（#81551）感谢 @jalehman。 - Codex 迁移：调用托管的 Codex 二进制文件而不是过时的系统 `codex` 进行源配置迁移计划，以便运行捆绑 Codex 运行时的用户获得与网关实际将使用的二进制文件匹配的计划输出。（#81582）感谢 @fuller-stack-dev。 - 子代理/维护：在会话存储清理、修剪和磁盘预算强制执行期间保留待处理的子代理注册表会话，以便正在进行的子代理运行不会在完成之前被后台维护删除。（#81498）感谢 @ai-hpc。 - 控制 UI/聊天：协调终端和重新连接运行清理与缓存会话活动、过时压缩/回退指示符以及紧凑的 composer 运行状态芯片，以便已完成或中断的轮次不会留下“停止”活动状态。修复 #76874 和 #64220；参考 #71630。感谢 @BunsDev。 - 维护者工具：阐明哪些 pnpm 测试/检查命令在本地安全 vs 在 Codex 工作树内，通过节点包装器和 Crabbox/Testbox 路由链接工作树门控。 - 自动回复：当去抖的入站工作回退到立即刷新时，保留相同键的顺序，以便后续轮次不能超越活动的缓冲刷新。 - Telegram/WhatsApp：使 Telegram 同聊回复保持有序，位于活动无延迟轮次之后，而不阻塞 WhatsApp 后续消息分发。 - Codex 迁移：当应用服务器插件清单可用时，避免重复的缓存插件包警告。 - 代理：在面向用户交付之前抑制中止的嵌入式助手部分、推理文本、回复指令和过时的先前回复，同时保留干净的超时/错误负载。修复 #48241。感谢 @BunsDev、@andyliu 和 @yassinebkr。 - 代理：允许双点前缀文件名（如 `..file.txt`）位于工作区和沙箱路径策略内，同时仍然拒绝真正的父级遍历。 - 原生图像输入：检测普通提示中的 Windows 驱动器图像路径，以便不会错过 `C:\...\screenshot.png` 引用。 - 媒体：在暂存附件、远程媒体、音频转码和保存的媒体显示名称之前规范化 Windows 风格文件名提示，以便 POSIX 主机不会在生成的文件名中保留驱动器或目录文本。 - 媒体引用：解析 ID 以点开头的一级入站媒体文件，而不是将类似 `..photo.png` 的名称视为父级遍历。 - iOS/聊天：在暂存和发送之前，将 PhotosPicker 图像附件调整为上限 JPEG，剥离源元数据，并将过大的相机照片保持在聊天上传预算内。修复 #68524。感谢 @BunsDev。 - 控制 UI：在触摸优先设备上保持共享表单、配置和使用文本输入控件为 16px，同时保留聊天 composer 输入大小，以便 iOS Safari 不再自动缩放聚焦的字段。修复 #64651；延续 #64673。感谢 @NianJiuZst 和 @BunsDev。 - 代理/轨迹：使轨迹刷新清理超时可配置为 `OPENCLAW_TRAJECTORY_FLUSH_TIMEOUT_MS`，保留 10 秒默认值，同时较慢的存储排出。参考 #75839。感谢 @BunsDev。 - Codex 身份验证：在运行时身份验证选择期间接受由 `oauthRef` 支持的 OAuth 配置文件，以便官方 Codex OAuth 登录被应用服务器代理运行使用。（#81633）感谢 @obviyus。 - Telegram：在网关停止宽限之后释放停止的轮询租约，以便进程内重启可以重用相同的机器人令牌，而不削弱活动的重复轮询保护。修复 #81507。（#81890）感谢 @joshavant。 - ACP：在运行时失败文本中保留经过编辑的数字 JSON-RPC `RequestError` 详细信息，以便后端诊断可见，而不是只有 `Internal error`。修复 #81126。（#81188）感谢 @vyctorbrzezowski。 - 代理：缓存未更改的 PI 模型发现存储和模型查找，减少大型模型配置下重复的模型解析启动延迟。修复 #78851。 - 入门：通过 OpenAI 模型向导携带返回的 Codex 插件迁移配置，以便接受的插件迁移与最终配置写入一起保存。 - 安全/Windows ACL 审计：将匿名登录、来宾、交互式、本地和网络 SID 分类为世界等价主体，以便广泛可写路径保持严重状态，而不是降级为组可写。修复 #74350。（#74383）感谢 @dwc1997。 - 媒体理解：在音频或视觉处理之前重试临时远程附件获取失败，以便 Discord 语音笔记不会在一次网络/CDN 故障后丢失。修复 #74316。感谢 @vyctorbrzezowski 和 @gabrielexito-stack。 - 控制 UI：在无时间戳历史回退之前对带时间戳的实时流和工具项进行排序，保持聊天历史在可见的时间顺序中。修复 #80759。（#81016）感谢 @akrimm702。 - ClawHub：取消技能、包和 ClawPack 下载的停滞主题正文读取，而不是在标头到达后让安装挂起。修复 #52073。参考 #80006。感谢 @xinhuagu 和 @stainlu。 - 控制 UI/配置：在表单模式配置保存中丢弃过时的编辑占位符，同时保留可恢复的已保存密钥，以便不相关的设置更改不再提交 `__OPENCLAW_REDACTED__` 作为真实数据。修复 #60917。感谢 @giodl73-repo 和 @BunsDev。 - OpenAI 插件：阐明远程 Codex OAuth 登录文本，使隧道用户知道在粘贴重定向 URL 之前登录可能自动完成。（#81301）感谢 @rubencu。 - SGLang：为兼容 OpenAI 的聊天补全程保留重放的推理历史，使具有思考能力的本地模型不会丢失先前的推理轮次。（#81091）感谢 @akrimm702。 - 插件/安装：从 npm 的锁定文件规划器派生托管的对等依赖固定，而不是递归扫描 `node_modules`，同时将 OpenClaw 主机对等点排除在托管根所有权之外，并保留活动根托管的运行时。感谢 @fuller-stack-dev。 - 控制 UI/WebChat：通过应用分组聊天渲染器中现有的保留操作间距，使简短的助手回复清除气泡内的复制/打开操作按钮。修复 #79509。（#81244）感谢 @JARVIS-Glasses。 - Codex 测试框架：使实时测试包装器可移植到 Windows，并延迟锁定的临时清理，以便原生 Windows 和 WSL2 实时运行完成。 - 链接理解：在运行配置的 CLI 摘要器之前，通过 SSRF 保护获取页面内容，防止 curl/wget 风格的链接获取器到达私有重定向或 DNS 反弹目标。 - 修复：强化 safe-bin 参数验证 [AI]。（#80999）感谢 @pgondhi987。 - Codex/状态：使 `/codex status` 速率限制措辞与 `/status` 一致，显示剩余配额和紧凑重置持续时间，而不是已使用配额和原始 ISO 时间戳。感谢 @MatthewSchleder。 - Mattermost：当一个实质性的（非推理）最终回复负载到达 `deliverMattermostReplyPayload` 但底层的 `deliverTextOrMediaReply` 返回 `"empty"` 时，记录一个结构化的 `mattermost no-visible-reply` 诊断——以前运行完成时记录误导性的 `delivered reply to <channel>`，即使没有发生 Mattermost API 发送，从而在频道/线程上下文中隐藏了静默完成。行为无变化；诊断揭示了失败，以便操作员可以检测到它，而不是看到代理似乎静默。修复 #80501。感谢 @robbyproc87。 - Telegram：限制多账户机器人之间的并发启动 `getMe` 探测，以便大型 Telegram 配置不会在网关启动期间同时展开所有账户探测。参考 #80695。（#80986）感谢 @stainlu。 - 修复（配置）：在 config set/unset 中拒绝自动管理的 meta.lastTouched* 路径（#80856）。感谢 @ai-hpc - 测试状态：为生成的主目录植入隔离的身份验证配置文件密钥，防止助手支持的证明运行回退到主机钥匙串密钥。（#81393）感谢 @altaywtf。 - 插件/更新：在更新失败后禁用插件时清除过时的允许/拒绝条目和选定的插件槽，使失败的外部插件更新不会留下半禁用配置。（#81512）感谢 @JARVIS-Glasses。 - 内存/LanceDB：使自动捕获识别简短的 CJK 内存短语和可配置的字面触发器，以便中文、日文和韩文用户无需正则表达式或 LLM 意图检测即可捕获内存。修复 #75680。感谢 @vyctorbrzezowski 和 @guokewuming。 - 插件 doctor：报告过时的插件配置警告，并在配置警告仍然存在时避免声称完整的插件健康。（#81515）感谢 @BKF-Gitty。 - 会话：在 `openclaw sessions` 输出中为 ACP 控制平面会话显示 `model: "<agentId>-acp"` / `modelProvider: "acpx"`（ACP 运行时哨兵），而不是代理的配置模型（这具有误导性）。目录发现 20。（#79543） - Slack：在调用 Slack 历史或线程回复 API 之前规范化消息读取的 `before` 和 `after` 时间戳边界。修复 #80835。（#81338）感谢 @honor2030。 - 网关：在流式爆发期间限制助手/思考代理事件扇出，而不丢弃缓冲的增量。（#80335）感谢 @samzong。 - 模型：在 `/models` 选择器中恢复经过身份验证的 CLI 运行时提供者，同时将旧运行时别名隐藏设置/默认模型选择。关闭 #81212。（#81239）感谢 @anagnorisis2peripeteia。 - 变更日志门控：拒绝机器人/应用句柄作为 `Thanks` 归属，并要求对人类编写的变更日志条目给予明确的人工信用。（#81357）感谢 @hxy91819。 - 代理/心跳：修复破坏多代理心跳节奏的七个分层问题——（1）通过 `Promise.all` 并行扇出调度器广播唤醒到所有代理，而不是依次等待每个 `runOnce`，从而一个做实际工作的代理不再使迭代顺序中的每个后续代理饥饿；（2）将 `skipWhenBusy` 范围限定到可通过会话键解析的通道（`session:agent:<id>:…` / `nested:agent:<id>:…` 通道名称），而不是查询全局 `subagent` 通道，从而一个代理上的单个卡住子代理不再静默禁用其他所有代理的心跳；（3）始终将工作区 `HEARTBEAT.md` 指令（可选 `tasks:` 块之外的任何内容）附加到调度提示中，以便散文式运行手册 `HEARTBEAT.md` 文件直接到达模型，而不是除非声明了周期性任务才被静默丢弃；（4）使 `streamWithIdleTimeout` 中的初始流建立承诺与相同的看门狗计时器竞争，该计时器之前仅保护令牌间间隔，从而在 TCP/TLS 握手或第一个响应字节之前卡住的 SDK 请求不再无限挂起（停滞会话诊断的 `recovery=none` 情况）；（5）当 `heartbeat.session` 固定了一个会话键但代理的会话存储中没有该键的条目时，发出 `openclaw doctor` 警告，以便静默丢弃的心跳交付在配置验证时显现；（6）还将仅承诺的任务调度路径（任务已配置，无一到期）通过 `appendHeartbeatFileDirectives` 路由，使 `tasks:` 块之外的散文指令也在此路径上到达模型；（7）将 `streamWithIdleTimeout` 内的同步 `baseFn(...)` 调用包装在 try/catch 中，该 try/catch 在重新抛出之前清除连接看门狗计时器，从而在设置期间抛出的提供者流函数不会留下一个活动计时器，该计时器稍后可能使用过时错误触发 `onIdleTimeout` 并使进程在真正失败后保持打开状态。感谢 @zeroaltitude。 - Matrix：停止从父派生插件路径在运行时运行 `npm install`/`pnpm install`；缺少的 Matrix 运行时依赖现在会失败并带有修复指导，而不是变异错误的 `node_modules` 树。修复 #80758。（#80876）感谢 @kinjitakabe。 - 代理/内存刷新：将非中止的内存刷新失败（提供者超时、传输错误、通用代理失败）呈现为可见的回复负载，以便外部回复循环短路，并且隔离的 cron 运行将错误传播到 `meta.error` 中，而不是以 `status: "ok"` 和空负载静默完成。以前只有特定的“内存刷新写入仅限于 ...”消息被呈现。修复 #80755。感谢 @nailujac。 - 频道/循环防护：在核心频道轮次内核中强制执行共享的每对机器人循环保护，Discord、Slack、Matrix 和 Google Chat 在其可以可靠识别已接受机器人编写的消息时提供机器人对事实。通用防护键控于 `(scope, conversation, participant pair)`，一旦一对超出配置的预算，就抑制任一方向的每一个额外机器人到机器人事件，并在 `cooldownSeconds` 后解除抑制。默认值为 `maxEventsPerWindow: 20`、`windowSeconds: 60` 和 `cooldownSeconds: 60`，只要频道允许机器人编写的消息到达调度；它们可以通过 `channels.defaults.botLoopProtection` 全局设置，并可为每个频道/账户或每个对话配置覆盖。修复 #58789。感谢 @pandadev66。 - 代理/内存刷新：将非中止的内存刷新失败（提供者超时、传输错误、通用代理失败）呈现为可见的回复负载，以便外部回复循环短路，并且隔离的 cron 运行将错误传播到 `meta.error` 中，而不是以 `status: "ok"` 和空负载静默完成。以前只有特定的“内存刷新写入仅限于 ...”消息被呈现。参考 #80755。感谢 @kinjitakabe 和 @nailujac。

### Changes - Dependencies: route root ambient Node proxy agents through `@openclaw/proxyline` and drop root `proxy-agent`, `https-proxy-agent`, and `minimatch` dependencies. - Control UI/i18n: add a `pnpm ui:i18n:report` baseline report for hardcoded-copy focus areas and locale fallback metadata. (#81320) Thanks @samzong. - Maintainer tooling: add a repo-local `codex-review` skill for Codex closeout reviews, including local dirty-work and PR-branch review helpers that rerun until no accepted/actionable findings remain and avoid unsupported inline prompts with `--base`. - Maintainer tooling: fail CI when pull requests add package patch files or pnpm patched dependencies, preserving the upstream-and-bump dependency workflow. - Codex app-server: stream commentary preambles into editable channel progress drafts without promoting them to final answers. - Codex migration: remove the bundled `codex-cli` backend and repair legacy `codex-cli/*` model refs to the Codex app-server route on `openai/*`. - Gateway/startup: add owner-level startup trace attribution for auth, plugin loading, lookup counts, and plugin sidecar services. (#81738) Thanks @samzong. - Channels/status reactions: wire `StatusReactionController` into WhatsApp message turns (queued → thinking → tool → done/error lifecycle, on par with Telegram and Discord), add `deploy`/`build`/`concierge` emoji categories with tool-token routing, and replace the status reaction defaults with self-explanatory emoji (🧠 thinking, 🛠️ tool, 💻 coding, 🌐 web, ⏳ stallSoft, ⚠️ stallHard, ✅ done, ❌ error, 🗜️ compacting) so stall and lifecycle reactions read as status indicators instead of emotional commentary. Fixes #59077. (#80612) Thanks @gado-ships-it. - Control UI: add a browser-local Text size setting in Appearance and Quick Settings, scaling chat and dense UI text while keeping inputs above the mobile Safari focus-zoom threshold. Fixes #8547. Thanks @BunsDev. - Docs: add a dedicated ds4 provider page with local DeepSeek V4 Flash config, on-demand startup, context sizing, and live verification steps. - Release validation: add a package-installed Docker user-journey lane that verifies onboarding, mocked model setup, external plugin install/uninstall, ClickClack outbound/inbound messaging, Gateway restart survival, and doctor. - Release validation: add package-installed Docker lanes for real TTY onboarding, media and memory persistence, published-package upgrade journeys, and local marketplace plugin install/update/uninstall coverage. - Maintainers: add a Clawdtributor skill for Discrawl-backed contributor PR triage, live status checks, and compact review formatting. - Telegram: support Mini App `web_app` buttons in generic message presentation payloads, allowing `openclaw message send --presentation` to render Telegram Web App inline buttons for private chats. (#81356) Thanks @jzakirov. - Scripts: add `OPENCLAW_HEAVY_CHECK_LOCK_SCOPE=worktree` so high-capacity local worktrees can use independent heavy-check locks while shared locks remain the default. Fixes #80729. (#80734) Thanks @samzong. - Agents/subagents: deliver native `sessions_spawn` tasks in the child session's first visible `[Subagent Task]` message instead of hiding the task in the sub-agent system prompt, keeping delegation auditable without duplicating tokens. Fixes #78592. Thanks @bradestes and @stainlu. - Messages/queue: make mid-turn prompts steer active runs by default via `/queue steer`, preserve `/queue followup` and `/queue collect` for users who want messages to queue by default, and make `/steer` continue as a normal prompt when steering is unavailable. (#77023) Thanks @fuller-stack-dev. - Voice Call/Telnyx: add realtime media-streaming call support for conversational voice calls. (#81024) Thanks @dynamite-bud. - Dependencies: add release dependency evidence reports, npm advisory gating, and PR dependency-change awareness so maintainers can review dependency risk before and during releases. Thanks @joshavant. - Gateway: expose optional `isHeartbeat` metadata on agent event payloads so clients can distinguish scheduled heartbeat runs from ordinary chat runs. (#80610) Thanks @medns. - Agents: add `agents.defaults.runRetries` and `agents.list[].runRetries` config for embedded Pi runner retry loop limits. (#80661) Thanks @medns. - Codex: add node-backed Codex CLI session listing and binding so an OpenClaw conversation can continue an existing Codex CLI session running on a paired node. ### Fixes - Cron/Codex: default exact-command scheduled agent turns to lightweight bootstrap context so automation runs the command before loading workspace identity or memory context. - Codex plugin/Gateway: strip unpaired UTF-16 surrogates from Codex app-server JSON-RPC payloads and let stale reply-work recovery abort stalled reply runs, preventing malformed media turns from wedging gateway lanes. - Codex app server: force OAuth refresh requests to perform a real token refresh instead of reusing unchanged inherited auth-profile tokens after refresh failures. (#80738) Thanks @simplyclever914. - Control UI/WebChat: render `/tts audio` replies as playable audio attachments through the assistant-media ticket path, with structured-audio compatibility for older live payloads. (#81722) Thanks @Conan-Scott. - Bind gateway approval access to requester metadata [AI]. (#81380) Thanks @pgondhi987. - Telegram: let isolated polling drain independent topics, DMs, and status/control commands concurrently while preserving same-lane order. (#81849) Thanks @VACInc. - Build: keep externalized Slack, OpenShell sandbox, and Anthropic Vertex runtime dependency declarations out of the root dist artifact build. - ClawHub: include Amazon Bedrock and Bedrock Mantle provider packages in the published registry metadata so the externalized providers are discoverable from ClawHub as well as npm. - Auto-reply/Claude CLI: bridge CLI-runtime assistant text-delta agent events into the chat reasoning preview through `onReasoningStream`, mirroring the existing assistant-text (#76914) and tool-event (#80046) bridges and adding gating so non-CLI runtimes are unaffected. Thanks @anagnorisis2peripeteia and @pashpashpash. - Mantis: keep QA evidence in Actions artifacts only and stop publishing evidence files to Git-backed artifact branches. - CLI/migrate: handle delayed Codex plugin marketplace responses so warnings, next-steps, and conflict states render with ⚠️ glyphs and post-install migration retries the marketplace fetch instead of silently skipping plugin items. (#81625) Thanks @sjf. - Channels/Weixin: bump the bundled `@tencent-weixin/openclaw-weixin` external entry to `2.4.3` (from `2.4.1`) so onboarding and `openclaw channels add` install the current Tencent Weixin (personal WeChat) plugin release. (#81730) Thanks @scotthuang. - CLI: lazy-load model, plugin, and device runtime helpers and keep channel option help on generated startup metadata or generic fallback text so parent/help output renders without importing those runtime paths. - CLI: route `plugins list --json` through the parsed command fast path and cover it in response budgets so plugin JSON inventory avoids full CLI registration work. - Gateway/network: keep OpenClaw-installed undici dispatchers on HTTP/1.1 and treat destroyed HTTP/2 session errors as recoverable network teardown, preventing `ERR_HTTP2_INVALID_SESSION` from crashing active gateway turns. Fixes #81627. (#81838) Thanks @joshavant. - Memory/daily-files: widen the daily-memory file matcher used by Dreaming, rem-backfill, rem-harness, the doctor sweep, and short-term promotion so `memory/YYYY-MM-DD-<slug>.md` files written by the bundled session-memory hook (and any future slugged variants) are discovered alongside the date-only `memory/YYYY-MM-DD.md` shape. Date extraction still uses the leading `YYYY-MM-DD` capture group, so per-day ingestion/promotion semantics are unchanged for existing date-only files; slugged files now flow through the same paths instead of being silently skipped. Fixes #69536. Thanks @jack-stormentswe. - macOS/Gateway: fail managed LaunchAgent stop and restart when the configured gateway port remains busy after cleanup instead of reporting success while a listener survives. Fixes #73132. Thanks @BunsDev. - Telegram: reuse the sticky IPv4 Bot API transport for periodic getMe health checks, so IPv4-working hosts with broken IPv6 egress stop logging repeated probe timeouts. Fixes #76852. (#76856) Thanks @SymbolStar. - Telegram: ship the isolated polling worker at the root dist path used by the bundled worker loader, avoiding startup failures looking for `dist/telegram-ingress-worker.runtime.js`. - Control UI/Gateway: stop stale token-mismatch reconnect loops when no trusted device-token retry is available, and cap rendered chat history by raw tool-output size so dashboard auth/history work cannot keep degrading channel sockets. Fixes #72139. Thanks @BunsDev. - Memory/daily-files: prioritize the canonical `memory/YYYY-MM-DD.md` daily note before same-day slugged session captures during capped live ingestion and historical seeding, preserving existing daily-note behavior when slugged files exist. - Gateway/OpenAI-compatible HTTP: parse shared JSON endpoint paths without trusting malformed Host headers, avoiding 500s before `/v1/chat/completions`, `/v1/responses`, and `/v1/embeddings` request handling. - Telegram: resolve plugin native commands with the active runtime config so commands like `/codex ...` stay on the native command path. - Voice-call webhooks: parse webhook and realtime upgrade paths without trusting malformed Host headers, avoiding 500s before provider signature checks or path rejection. - Media store: reject malformed redirect `Location` headers as media-download failures instead of letting URL parsing escape the async response callback. - ClickClack: skip malformed realtime websocket frames instead of stopping the channel monitor on a single bad JSON event. - Browser tool: treat malformed node proxy `payloadJSON` responses as browser proxy failures instead of leaking raw JSON parser errors. - Gateway HTTP: match models, session kill, and session history route paths without trusting malformed Host headers, avoiding pre-auth 500s on those endpoints. - Google Meet/Codex: report malformed node proxy `payloadJSON` responses with plugin-owned errors instead of leaking raw JSON parser failures. - Debug proxy: reject malformed relative-form proxy targets with a controlled 400 response instead of letting URL parsing escape the request handler. - File transfer: reject malformed inline `file_write` base64 before computing hashes or invoking paired nodes, avoiding Node's lenient base64 decoder. - QA channel: skip malformed inline inbound attachment base64 instead of staging silently corrupted media for agent turns. - Microsoft Teams: reject malformed inline HTML image base64 padding instead of decoding corrupted `data:` image attachments. - Voice-call realtime: ignore malformed provider media-frame base64 before forwarding audio into bridge and transcription paths. - QQBot: reject malformed stored cron payload base64 before JSON decoding structured reminder data. - Telnyx voice-call: use the raw `client_state` fallback when webhook state is malformed base64 instead of using silently corrupted decoded text. - Google Meet: report malformed node-host params JSON with plugin-owned errors instead of leaking raw JSON parser failures. - CLI/export-trajectory: report malformed encoded request JSON with a stable CLI error instead of leaking raw parser output. - Twilio voice-call: report malformed successful API JSON responses with provider-owned errors instead of leaking raw parser failures. - Voice-call provider APIs: report malformed successful guarded JSON responses with provider-prefixed errors instead of leaking raw parser failures. - Realtime transcription: report malformed provider websocket JSON frames with owned parser errors instead of leaking raw `SyntaxError` objects. - Microsoft Foundry: report malformed Azure CLI token JSON with owned auth errors instead of leaking raw parser failures. - Gateway/model pricing: report malformed external pricing catalog JSON with source-owned errors instead of leaking raw parser failures. - QA Lab: report malformed model-catalog subprocess JSON with an owned error and ignore invalid catalog rows. - Google Meet: report malformed browser-control status JSON with plugin-owned errors instead of leaking raw parser failures. - Google provider: report malformed SSE stream JSON with provider-owned errors instead of leaking raw parser failures. - Node host: report malformed built-in invoke `paramsJSON` with stable invalid-request errors instead of leaking raw parser failures. - Amazon Bedrock embeddings: report malformed provider response JSON with provider-owned errors instead of leaking raw parser failures. - QQBot: report malformed access-token JSON with provider-owned errors instead of leaking raw parser failures. - OpenAI embeddings: report malformed batch output JSONL with provider-owned errors instead of leaking raw parser failures. - Synology Chat: report malformed JSON webhook payloads with stable channel-owned parser errors. - Mattermost: report malformed interaction callback JSON with stable channel-owned parser errors. - Matrix: ignore malformed percent-encoding in optional location URI parameters instead of letting a bad `geo:` event abort inbound message handling. - Web search: auto-detect Brave through its legacy `tools.web.search.apiKey` compatibility fallback while keeping doctor migration to `plugins.entries.brave.config.webSearch.apiKey` as the canonical repair, so allowlisted isolated cron runs do not report `web_search` unavailable before migration. Fixes #81538. Thanks @atomicmonk. - Plugins: memoize repeated in-process plugin metadata snapshots and keep vanished managed-install residue from forcing full derived discovery, reducing gateway/status startup scans under large plugin sets. Fixes #81143 and #79806. (#81570) Thanks @Kaspre, @holgergruenhagen, @JanPlessow, and @mjamiv. - CLI/plugins: route lazy plugin command-registration chatter to stderr only during JSON-output command registration, keeping plugin-backed `--json` stdout parseable without changing parse-only or pass-through `--json` behavior. Fixes #81535. (#81536) Thanks @ScientificProgrammer and @vincentkoc. - Plugins: treat git plugin install refs as refs instead of checkout flags, so option-like selectors fail checkout instead of silently installing the default branch. Fixes #79898. (#79901) Thanks @afurm and @vincentkoc. - Web: honor explicitly configured global `web_search` providers during provider ownership resolution while keeping sandboxed `web_fetch` limited to bundled providers. - Plugins/doctor: repair configured legacy npm declaration stubs by reinstalling their npm packages into the managed plugin root instead of loading workspace `node_modules`, and warn when discovery sees those stubs. Fixes #79632. Thanks @Dylanzhang1128 and @vincentkoc. - Channels: keep configured third-party channel plugins visible in `openclaw channels list` when their manifest declares `channels` but has not added `channelConfigs` metadata yet. Fixes #81334. (#81340) Thanks @AllynSheep and @vincentkoc. - Agents: skip bootstrap file and hook preload work on completed `continuation-skip` turns when no workspace bootstrap is pending, reducing isolated-agent prep latency without changing first-turn bootstrap behavior. Fixes #81548. Thanks @delizaran-unpa. - Config: validate JSON dry-runs against plugin-owned channel schemas, so external channel fields are not rejected by stale bundled schemas. Fixes #77887. (#81504) Thanks @giodl73-repo. - iOS: restore first-use Contacts, Calendar, and Reminders permission prompts and add Privacy & Access status/actions in Settings. Thanks @BunsDev. - Canvas: return not found for malformed percent-encoded Canvas/A2UI/document asset paths and keep decoded parent traversal blocked before path normalization. - Telegram: allow trusted local Bot API media files whose filenames start with dots instead of falling back to remote download. - Agents/Codex app-server: remap injected context files under dot-dot-prefixed workspace directories when a run switches to an effective sandbox workspace. - Control UI/i18n: use the installed workspace pi runtime for locale refreshes, update the fallback package pin, and skip scheduled refreshes with invalid provider credentials instead of failing main. - CI/performance: authenticate the clawgrit report repository remote during both checkout and publish so performance report pushes do not fail after benchmarks complete. - Hooks: load workspace-relative legacy hook modules from dot-dot-prefixed directories without treating the filename prefix as parent traversal. - Plugins: preserve installed package metadata and persisted registry freshness checks for plugin package paths under dot-dot-prefixed directories. - Agents: allow dot-dot-prefixed filenames such as `..note.txt` through sandbox FS bridge, remote sandbox reads, and apply_patch summaries without mistaking the name for parent traversal. - CLI/migrate: hide per-item source/plugin hints on non-conflicting Codex skill and plugin selection prompts, keeping the hint text reserved for rows that actually need attention. Thanks @sjf. - Codex harness: treat high-confidence app-server OAuth refresh invalidation as a terminal auth-profile failure, stopping repeated raw token-refresh errors without turning entitlement or usage-limit payloads into re-auth prompts. - CLI/migrate: humanize Codex conflict-status messaging across the migrate UI so selection prompts and plan/result rows say "Codex skill already installed in workspace" instead of surfacing internal `MIGRATION_REASON_*` codes. Thanks @sjf. - CLI/migrate: render migrate result rows with distinct glyphs for manual-review (🔍) and archive (📖) items instead of the misleading "skipped" and "migrated" checkmarks, so users can see which entries still need attention versus which were filed away. Thanks @sjf. - CLI/migrate: split Codex migrate output into separate preview and result phases so the Before plan and After result render through clack with independently tunable copy. Thanks @sjf. - Codex app-server: project bundle and user MCP servers into Codex threads, rotate threads when an MCP server is disabled, scope bundle MCP injection to bundled servers, and resend user MCP config on resume so MCP changes take effect mid-session without restarting the agent. (#81551) Thanks @jalehman. - Codex migration: invoke the managed Codex binary instead of a stale system `codex` for source-config migration plans, so users running the bundled Codex runtime get plan output that matches the binary the gateway will actually use. (#81582) Thanks @fuller-stack-dev. - Subagents/maintenance: preserve pending subagent registry sessions during session-store cleanup, pruning, and disk-budget enforcement so in-flight subagent runs are not deleted by background maintenance before they complete. (#81498) Thanks @ai-hpc. - Control UI/chat: reconcile terminal and reconnect run cleanup with cached session activity, stale compaction/fallback indicators, and a compact composer run-status chip so completed or interrupted turns do not leave Stop active. Fixes #76874 and #64220; refs #71630. Thanks @BunsDev. - Maintainer tooling: clarify which pnpm test/check commands are safe locally versus inside Codex worktrees, routing linked-worktree gates through node wrappers and Crabbox/Testbox. - Auto-reply: preserve same-key ordering when debounced inbound work falls back to immediate flushes, so follow-up turns cannot overtake an active buffered flush. - Telegram/WhatsApp: keep Telegram same-chat replies ordered behind active no-delay turns without blocking WhatsApp follow-up message dispatch. - Codex migration: avoid duplicate cached plugin bundle warnings when app-server plugin inventory is available. - Agents: suppress aborted embedded assistant partials, reasoning text, reply directives, and stale prior replies before user-facing delivery while preserving clean timeout/error payloads. Fixes #48241. Thanks @BunsDev, @andyliu, and @yassinebkr. - Agents: allow dot-dot-prefixed filenames such as `..file.txt` inside workspace and sandbox path policy while still rejecting real parent traversal. - Native image input: detect Windows drive image paths in plain prompts so `C:\...\screenshot.png` references are not missed. - Media: normalize Windows-style filename hints before staging attachments, remote media, audio transcodes, and saved-media display names, so POSIX hosts do not preserve drive or directory text in generated filenames. - Media references: resolve first-level inbound media files whose IDs start with dots instead of treating names like `..photo.png` as parent traversal. - iOS/chat: resize PhotosPicker image attachments to capped JPEGs before staging and sending, stripping source metadata and keeping oversized camera photos under the chat upload budget. Fixes #68524. Thanks @BunsDev. - Control UI: keep shared form, config, and usage text-entry controls at 16px on touch-primary devices while preserving chat composer input sizing, so iOS Safari no longer auto-zooms focused fields. Fixes #64651; carries forward #64673. Thanks @NianJiuZst and @BunsDev. - Agents/trajectory: make the trajectory flush cleanup timeout configurable with `OPENCLAW_TRAJECTORY_FLUSH_TIMEOUT_MS`, preserving the 10s default while slower stores drain. Refs #75839. Thanks @BunsDev. - Codex auth: accept OAuth profiles backed by `oauthRef` during runtime auth selection, so official Codex OAuth logins are used by app-server agent runs. (#81633) Thanks @obviyus. - Telegram: release stopped polling leases after the gateway stop grace so in-process restarts can reuse the same bot token without weakening active duplicate-poller protection. Fixes #81507. (#81890) Thanks @joshavant. - ACP: preserve redacted numeric JSON-RPC `RequestError` details in runtime failure text, so backend diagnostics are visible instead of only `Internal error`. Fixes #81126. (#81188) Thanks @vyctorbrzezowski. - Agents: cache unchanged PI model discovery stores and model lookups, reducing repeated model-resolution startup latency under large model configs. Fixes #78851. - Onboarding: carry returned Codex plugin migration config through the OpenAI model wizard so accepted plugin migrations are saved with the final config write. - Security/Windows ACL audit: classify Anonymous Logon, Guests, Interactive, Local, and Network SIDs as world-equivalent principals so broadly writable paths stay critical instead of being downgraded to group-writable. Fixes #74350. (#74383) Thanks @dwc1997. - Media-understanding: retry transient remote attachment fetch failures before audio or vision processing, so Discord voice notes are not lost after one network/CDN blip. Fixes #74316. Thanks @vyctorbrzezowski and @gabrielexito-stack. - Control UI: order timestamped live stream and tool items before untimestamped history fallbacks, keeping chat history in visible time order. Fixes #80759. (#81016) Thanks @akrimm702. - ClawHub: cancel stalled archive body reads for skill, package, and ClawPack downloads instead of leaving installs hanging after headers arrive. Fixes #52073. Refs #80006. Thanks @xinhuagu and @stainlu. - Control UI/config: discard stale redacted placeholders from form-mode config saves while preserving restorable saved secrets, so unrelated settings changes no longer submit `__OPENCLAW_REDACTED__` as real data. Fixes #60917. Thanks @giodl73-repo and @BunsDev. - OpenAI plugin: clarify remote Codex OAuth login copy so tunneled users know sign-in may finish automatically before they paste the redirect URL. (#81301) Thanks @rubencu. - SGLang: preserve replayed reasoning history for OpenAI-compatible chat completions, keeping thinking-capable local models from losing prior reasoning turns. (#81091) Thanks @akrimm702. - Plugins/install: derive managed peer dependency pins from npm's lockfile planner instead of recursively scanning `node_modules`, while keeping OpenClaw host peers out of managed root ownership and preserving active root-managed runtimes. Thanks @fuller-stack-dev. - Control UI/WebChat: keep short assistant replies clear of in-bubble copy/open action buttons by applying the existing reserved action spacing in the grouped chat renderer. Fixes #79509. (#81244) Thanks @JARVIS-Glasses. - Codex harness: make the live test wrapper portable to Windows and defer locked temp cleanup so native Windows and WSL2 live runs complete. - Link understanding: fetch page content through the SSRF guard before running configured CLI summarizers, preventing curl/wget-style link fetchers from reaching private redirect or DNS-rebound targets. - fix: harden safe-bin argument validation [AI]. (#80999) Thanks @pgondhi987. - Codex/status: align `/codex status` rate-limit wording with `/status` by showing remaining quota and compact reset durations instead of used quota and raw ISO timestamps. Thanks @MatthewSchleder. - Mattermost: log a structured `mattermost no-visible-reply` diagnostic when a substantive (non-reasoning) final reply payload reaches `deliverMattermostReplyPayload` but the underlying `deliverTextOrMediaReply` returns `"empty"` — previously the run completed with a misleading `delivered reply to <channel>` log even though no Mattermost API send happened, masking silent completions in channel/thread contexts. No behavior change; the diagnostic surfaces the failure so operators can detect it instead of seeing the agent appear to go silent. Fixes #80501. Thanks @robbyproc87. - Telegram: limit concurrent startup `getMe` probes across multi-account bots so large Telegram configs do not fan out all account probes at once during gateway startup. Refs #80695. (#80986) Thanks @stainlu. - fix(config): reject auto-managed meta.lastTouched\* paths in config set/unset (#80856). Thanks @ai-hpc - Test state: seed isolated auth-profile secret keys for generated homes, preventing helper-backed proof runs from falling back to host Keychain secrets. (#81393) Thanks @altaywtf. - Plugins/update: clear stale allow/deny entries and selected plugin slots when disabling a plugin after update failure, keeping failed external plugin updates from leaving half-disabled config. (#81512) Thanks @JARVIS-Glasses. - Memory/LanceDB: make auto-capture recognize short CJK memory phrases and configurable literal triggers, so Chinese, Japanese, and Korean users can capture memories without regex or LLM intent detection. Fixes #75680. Thanks @vyctorbrzezowski and @guokewuming. - Plugins doctor: report stale plugin config warnings and avoid claiming full plugin health when config warnings remain. (#81515) Thanks @BKF-Gitty. - Sessions: display `model: "<agentId>-acp"` / `modelProvider: "acpx"` (ACP-runtime sentinel) for ACP control-plane sessions in `openclaw sessions` output, instead of the agent's configured model which was misleading. Catalog finding 20. (#79543) - Slack: normalize message read `before` and `after` timestamp bounds before calling Slack history or thread reply APIs. Fixes #80835. (#81338) Thanks @honor2030. - Gateway: throttle assistant/thinking agent event fanout during streaming bursts without dropping buffered deltas. (#80335) Thanks @samzong. - Models: restore authenticated CLI runtime providers in the `/models` picker while keeping legacy runtime aliases hidden from setup/default model choices. Closes #81212. (#81239) Thanks @anagnorisis2peripeteia. - Changelog gates: reject bot/app handles as `Thanks` attribution and require explicit human credit for bot/app-authored changelog entries. (#81357) Thanks @hxy91819. - Agents/heartbeat: fix seven layered issues that broke multi-agent heartbeat cadence — (1) fan out the scheduler broadcast wake across agents in parallel via `Promise.all` instead of awaiting each `runOnce` sequentially, so one agent doing real work no longer starves every later agent in iteration order; (2) scope `skipWhenBusy` to lanes attributable to the firing agent via session-key parsing of `session:agent:<id>:…` / `nested:agent:<id>:…` lane names, instead of consulting the global `subagent` lane, so a single stuck subagent on one agent no longer silently disables every other agent's heartbeat; (3) always append workspace `HEARTBEAT.md` directives (everything outside an optional `tasks:` block) to the dispatch prompt, so prose-runbook `HEARTBEAT.md` files reach the model directly instead of being silently dropped unless periodic tasks are declared; (4) race the initial stream-establishment promise inside `streamWithIdleTimeout` against the same watchdog timer that previously only guarded inter-token gaps, so SDK requests stuck at TCP/TLS handshake or before the first response byte no longer hang indefinitely (the stalled-session diagnostic's `recovery=none` case); (5) emit an `openclaw doctor` warning when `heartbeat.session` pins a session key that has no entry in the agent's session store, so silently-dropped heartbeat deliveries surface at config-validation time; (6) also route the commitment-only task dispatch path (tasks configured, none due) through `appendHeartbeatFileDirectives` so prose directives outside the `tasks:` block reach the model on this path as well; (7) wrap the synchronous `baseFn(...)` invocation inside `streamWithIdleTimeout` in a try/catch that clears the connect watchdog timer before rethrowing, so a provider stream function that throws during setup no longer leaves a live timer that can fire `onIdleTimeout` later with a stale error and keep the process open past the real failure. Thanks @zeroaltitude. - Matrix: stop running `npm install`/`pnpm install` at runtime from a parent-derived plugin path; missing Matrix runtime dependencies now fail with repair guidance instead of mutating the wrong `node_modules` tree. Fixes #80758. (#80876) Thanks @kinjitakabe. - Agents/memory-flush: surface non-abort memory-flush failures (provider timeout, transport error, generic agent failure) as visible reply payloads so the outer reply loop short-circuits and isolated cron runs propagate the error into `meta.error` instead of completing silently with `status: "ok"` and an empty payload. Previously only the specific "Memory flush writes are restricted to ..." message was surfaced. Fixes #80755. Thanks @nailujac. - Channels/loop-guard: enforce shared per-pair bot loop protection in the core channel-turn kernel, with Discord, Slack, Matrix, and Google Chat supplying bot-pair facts where they can reliably identify accepted bot-authored messages. The generic guard keys on `(scope, conversation, participant pair)`, suppresses every additional bot-to-bot event in either direction once a pair crosses the configured budget, and lifts suppression after `cooldownSeconds`. Defaults are `maxEventsPerWindow: 20`, `windowSeconds: 60`, and `cooldownSeconds: 60` whenever a channel lets bot-authored messages reach dispatch; they can be set globally via `channels.defaults.botLoopProtection` and overridden per channel/account or supported per-conversation config. Fixes #58789. Thanks @pandadev66. - Agents/memory-flush: surface non-abort memory-flush failures (provider timeout, transport error, generic agent failure) as visible reply payloads so the outer reply loop short-circuits and isolated cron runs propagate the error into `meta.error` instead of completing silently with `status: "ok"` and an empty payload. Previously only the specific "Memory flush writes are restricted to ..." message was surfaced. Refs #80755. Thanks @kinjitakabe and @nailujac.

OpenClaw v2026.5.14-beta.1 预发布