OpenClaw v2026.5.16-beta.5

### 变更 - Mac 应用：重新设计设置页面，采用一致的卡片布局、缓存导航，更清晰的权限/语音/技能/cron/执行/调试面板，以及原生侧边栏周围更稳定的间距。 - 技能：将仓库本地的 Codex 结案审查技能和辅助工具重命名为 `autoreview`，同时保留以 Codex 优先的回退行为。 - 技能：新增表情包制作技能，支持精选模板搜索、本地 SVG/PNG 渲染、Imgflip 托管渲染以及 Know Your Meme 出处链接。 - 智能体/工具：缩短内置工具描述和媒体、消息、会话、cron、网关、Web、图片/PDF、TTS、节点和计划工具的 schema 提示，同时保留路由护栏。 - 技能：新增节点检查器调试、融合图表生成以及一次性尖峰工作流技能。 - CLI/插件：新增 `defineToolPlugin` 以及 `openclaw plugins build`、`validate` 和 `init` 命令，用于生成清单元数据、可选工具声明和上下文工厂的类型化简单工具插件。 - 智能体/技能：收紧捆绑技能提示和元数据，引用技能描述，刷新当前 CLI/API 指南，并更新嵌入式 sherpa-onnx 运行时下载。 - 技能：更新 Obsidian 技能，使其指向官方 `obsidian` CLI 并要求其已注册的二进制文件，而非第三方 `obsidian-cli`。 - 技能：新增 Python 调试技能，支持 pdb、breakpoint()、事后检查以及 debugpy 远程附加。 - 插件/消息：为频道渲染器添加演示能力限制，在原生渲染前适配富消息控件，并将旧版 `interactive`/Slack 指令生产者 API 标记为已弃用。 - 代理：支持 HTTPS 托管正向代理端点以及作用域化的 `proxy.tls.caFile` CA 信任用于代理端点 TLS。（#79171）感谢 @jesse-merhi。 - QA-Lab：新增首小时 20 轮和可选的 100 轮运行时一致性场景，附带标准门控和浸泡 QA 门控的层级元数据。修复 #80338；关联 #80337。感谢 @100yenadmin。 - QA-Lab：新增 `openclaw qa suite --runtime-parity-tier` 命令，并将标准 Codex-vs-Pi 层级与可选/仅直播/浸泡通道分别关联到发布检查中。修复 #80337。感谢 @100yenadmin。 - QA-Lab：新增仅直播的 Codex Pi 形 Read 词汇金丝雀，使运行时一致性能够捕获原生工作区读取提示兼容性漂移。（#80323）感谢 @100yenadmin。 - QA-Lab：新增仅直播的框架自检场景，用于插件钩子崩溃、清单契约错误以及 WebChat 直接回复自消息路由。（#80323）感谢 @100yenadmin。 - QA-Lab：新增运行时工具夹具场景和覆盖率报告，涵盖 Codex 原生工作区工具、OpenClaw 动态工具和可选插件后端工具。修复 #80173。感谢 @100yenadmin。 - QA-Lab：通过 `openclaw qa coverage --tools` 公开运行时工具夹具覆盖率，并提供可选的套件摘要评估用于一致性门控产物。感谢 @100yenadmin。 - QA-Lab：新增个人智能体批准-拒绝场景，使基准测试包能够验证被拒绝的本地读取在无工具进度或夹具泄漏的情况下干净停止。（#83150）感谢 @iFiras-Max1。 ### 修复 - CLI/更新：根据平台定制更新后的网关恢复提示，显示 systemd、LaunchAgent、计划任务或通用服务管理器指南，而非仅限 macOS 的恢复文本。（#83096）感谢 @rubencu。 - 插件：为旧版 `before_agent_start` 钩子应用默认 15 秒超时，使挂起的插件处理程序不再阻塞智能体启动。修复 #48534。（#83136）感谢 @therahul-yo。 - 飞书：刷新入站会话投递上下文（DM、群组和广播轮次），使后续回复不再继承过时的 WebChat 路由。修复 #78274。 - QA-Lab/qa-channel：将经过编辑的智能体工具启动追踪附加到出站 `QaBusMessage` 记录中，使场景能够断言实际工具使用情况，而不仅仅依赖回复文本。修复 #67637。感谢 @100yenadmin。 - QA-Lab：在缺少助手消息使用量时使直播运行时一致性报告失败，防止 `0 vs 0` 的直播令牌行被报告为通过证明。修复 #80411。感谢 @100yenadmin。 - QA-Lab：在无可用便携 Codex 认证时，在启动隔离工作线程前使 Codex 后端的 OpenAI 直播运行时配对运行失败，同时暂存 API 密钥回退和已配置的 Codex 密钥用于隔离的 QA 智能体。修复 #80412。感谢 @100yenadmin。 - QA-Lab：刷新一致性门控、模拟前沿夹具、模型场景和工作流产物通道，以将 GPT-5.5 与 Claude Opus 4.7 进行对比。修复 #74262。感谢 @100yenadmin。 - QA-Lab：使模拟一致性分发具有提供者感知能力，用于源发现和子智能体场景，使 OpenAI 和 Anthropic 通道不再共享相同的固定计划。修复 #64879。感谢 @100yenadmin。 - QA-Lab：停止从未经认证的引导负载返回 Control UI 持有者令牌，并将 Docker 框架端口绑定到仅回环主机地址。（#66355）感谢 @pgondhi987。 - Mac 应用：避免在渲染 Cron 作业设置面板时出现 SwiftUI 元数据崩溃。 - 智能体/OpenAI 流：在爆发式 Responses 块之间使用 `setTimeout(0)` 而非 `setImmediate` 进行 yield，使中止定时器能在 yield 期间触发，保持取消超时在热流中的响应性。关联 #82462。 - CLI/配置：将 SecretRef 诊断信息发送到 stderr，使 JSON 命令的 stdout 保持可解析。 - CLI/插件：将捆绑的内存 CLI 作为包入口发布，使通过包安装的 `openclaw memory` 命令能正确注册。 - CLI/更新：在包交换期间推迟检查插件包安装，并从更新后的安装注册表种子核心修复，防止重复的重新安装失败。 - 飞书：将 SecretRef 顶层凭据检测为已配置的默认账户，而非将对象支持的应用密钥视为缺失。 - CLI/补全：在设置和 doctor 补全安装期间解析具体的 PowerShell 配置文件路径并重新加载命令。修复 #44296。（#83059）感谢 @yu-xin-c。 - 提供者/Google：在原生回放期间保留并恢复 Gemini 3 工具调用思想签名，使函数调用轮次不再因缺少 `thought_signature` 而失败（400 错误）。修复 #72879。（#80358）感谢 @abnershang。 - 内存核心：在降级的 `memory index` 警告中区分 sqlite-vec 加载失败与缺失语义向量嵌入，使向量召回诊断指向未解析的维度，而非在存储就绪时归咎于 sqlite-vec。修复 #75624。（#83056）感谢 @xuruiray 和 @Noah3521。 - 智能体/子智能体：在将完成公告路由回原始运行会话时保留沙箱对等控制器所有权，使子智能体控制和完成投递作用域正确。修复 #80201。（#80242）感谢 @Jerry-Xin。 - 网关：当一个热重载通道重启失败时，继续重启其余通道，同时报告聚合重启失败并回滚插件预替换停止。修复 #83054。感谢 @zqchris。 - 网关/密钥：将轻量级密钥运行时状态和认证存储缓存与完整密钥运行时分离，并在网关启动配置无 SecretRef 值时走启动快路径，加速密钥启动同时保留清理和刷新语义。 - Codex 应用服务器：在恢复前轮换过大的原生 Codex 线程，并限制进入原生 Codex 会话的动态工具结果文本，防止过大的过时上下文在 OpenClaw 压缩后仍存在。（#82981）感谢 @hansolo949。 - 网关/重启：在重启关闭期间，在套接字和通道关闭前排空待处理回复和活跃聊天运行，通过正常清理路径中止超时的聊天运行。（#69121）感谢 @alexlomt。 - 智能体/Codex：使用 Codex 运行时上下文窗口进行 OpenAI 模型预检压缩和内存刷新检查，使 GPT-5.5 Codex 会话在触及更小的原生上下文限制前进行压缩。修复 #82982。感谢 @vliuyt。 - QA-Lab：在套件父进程退出时清理孤立的网关临时根目录，并在配置重启后等待网关及传输就绪，减少因中断运行产生的过时 `qa-channel` 噪音。修复 #65506。感谢 @100yenadmin。 - QA-Lab：唤醒在总线重启后携带过时未来游标到达的 qa-bus 长轮询，保持框架客户端的重新连接就绪性。（#67142）感谢 @hxy91819。 - QA-Lab：将 Multipass 传输脚本置于 OpenClaw 首选的临时根目录下，而非原始操作系统临时路径，使 VM 运行器保持在临时路径护栏内。（#64098）感谢 @ImLukeF。 - 智能体/回复：保留幸存的回复媒体，并在其他媒体引用失败时附加警告，使部分媒体规范化不再静默丢弃失败。感谢 @Jerry-Xin。 - 配置/模型：在模型兼容配置中接受 `thinkingFormat: "together"`，使 Together 路由可选择 Together 特有的思考响应形状。 - 插件/tokenjuice：将捆绑的 tokenjuice 运行时升级至 0.7.1，为 OpenClaw 插件带来 Codex 钩子批准兼容性、工具前命令包装修复以及 Rolldown/Vitest 输出压缩改进。 - 智能体/OpenAI：停止使用硬编码的简洁上限对 GPT-5 最终回复进行后处理，保留完整通道响应而非附加合成省略号，并在严格智能体 GPT-5 执行激活时记录日志。修复 #82910。 - Mac 应用：优化设置常规和连接面板，提供更清晰的状态面板、卡片行以及单个原生标题栏侧边栏切换开关。 - 智能体/媒体：当请求者会话完成交接失败时，直接投递失败的异步图片、音乐和视频生成完成状态，使频道用户看到提供者错误而非静默回退停滞。 - 智能体/音乐：将歌曲、短曲、节拍、颂歌和器乐请求导向 `music_generate` 音频创作而非仅歌词回复，并保留 `lyrics` 用于精确演唱歌词。 - Codex 应用服务器：将原生 Codex 工具调用和结果记录到轨迹产物中，使调试/轨迹导出捕获完整的 Codex 原生工具历史，而不仅仅是 OpenClaw 桥接的轮次。感谢 @vyctorbrzezowski。 - Codex/应用服务器：将绑定的对话会话保留在所属智能体运行时上，使原生 Codex 控制和后续轮次不会回退到默认智能体客户端。修复 #82954。（#82993） - CLI/infer：在全新显式会话中运行网关模型探测，使一次性提供者检查不会继承默认智能体转录状态。（#82861）感谢 @Kaspre。 - 提供者/Together：即使共享文本模型配置仍指向 v1 基础 URL，也将视频生成请求发送到 Together 的 v2 视频 API。（#82992） - Browser CLI：在嵌套命令上保留浏览器级选项，在延迟命令注册期间跳过选项值，并保持长时间运行的等待/下载/对话框钩子在其广告等待窗口内打开。 - CLI/会话：接受 `openclaw sessions list` 作为 `openclaw sessions` 的别名，与其他列表式命令保持一致。修复 #81139。（#81163）感谢 @YB0y。 - 通道/流预览：加宽紧凑进度草稿行，在单词边界处截断文本，同时保留命令/路径后缀，并通过 `streaming.progress.maxLineChars` 支持通道特定调优。 - CLI/插件：使 `openclaw plugins doctor` 在配置的运行时需要缺失的所属插件时发出警告，共享与 `openclaw doctor --fix` 相同的安装映射。修复 #81326。（#81674）感谢 @Zavianx。 - 智能体/Codex：将解析为 `openai-codex` 的 OpenAI 运行通过 Codex 提供者路由，并在框架拥有传输时，将 OpenClaw 存储的 OAuth 配置文件引导到 Codex 框架中，使 `openai/*` 模型引用不再因 `No API key found for openai-codex` 而失败（尽管已有 Codex OAuth 配置文件）。（#82864）感谢 @ragesaq。 - 智能体/ACP：区分提示提交的和运行时活跃的子停滞与真正的交互式等待，包括针对 Codex ACP 无输出运行的红acted 代理环境诊断。修复 #44810。 - 智能体/内存：解释内存触发的压缩暴露的仅为 `read` 和仅追加 `write`（当配置的核心工具在 `tools.allow` 警告中不可用时）。修复 #82941。感谢 @galiniliev。 - 智能体/OpenAI：为跨 OpenAI Responses 和聊天完成调用的提示缓存重用保留确定性工具负载排序。（#82940）感谢 @galiniliev。 - ACP/Codex：尊重终端 ACP 轮次结果，使失败的 Codex/acpx 运行不会在仅含进度文本后被记录为成功。修复 #79522。感谢 @dudaefj。 - Telegram：当媒体组丢弃下载失败的图片时发出警告，包括每张图片都被跳过的相册。修复 #55216。（#82987）感谢 @eldar702。 - 智能体/技能：将完整的有效工具策略管道应用于内联 `command-dispatch: tool` 技能分派（在仅属主过滤之前），保留配置的允许、拒绝、沙箱、发送者、群组和子智能体限制。（#78525） - Codex：避免为无注册钩子处理程序的后工具/结束事件生成原生钩子中继子进程，同时保留前工具安全性和批准中继。修复 #76552。（#78004）感谢 @evgyur。 - 通道账户：当命名账户与默认凭据材料一起添加时，保留顶层默认通道账户可见，使混合旧/新账户配置继续解析 `default` 而非静默丢弃它。 - Codex/Telegram：从最终轮次快照合成原生 Codex 工具进度，使 Telegram `/verbose` 在命令事件仅在完成时到达时保持可见。 - Mac 应用：通过推迟配置架构工作、避免启动通道探测、缓存解码的通道状态行以及仅显示紧凑快速设置（而非完整生成的通道架构）来加快通道设置打开速度。 - Control UI：在协议不匹配错误中包含 Control UI 和网关协议版本，使过时的应用/仪表板配对能够识别哪一侧需要重建或重启。 - 网关/协议：恢复网关 WS 协议 v4，并将 `message.action` 房间事件元数据保留在现有 `inboundTurnKind` 线字段上，同时保留内部入站事件分类。 - 智能体/工具：当消息工具存在过时的 webchat 上下文时，优先使用非 webchat 会话密钥路由，使仅消息工具回复继续投递到原始通道。修复 #82911。（#83004）感谢 @joshavant。 - 通道：将直接消息最后路由写入隔离的 `per-channel-peer` 会话，而非用通道投递上下文污染智能体主会话。修复 #36614。感谢 @aspenas。 - Mac 应用：将设置侧边栏切换开关移至原生标题栏，并收紧常规面板宽度。 - Mac 应用：保持已访问的设置面板挂载，使切换标签不再清空并重新加载其内容。 - Mac 应用：使配置设置从浅层架构查找中打开，并按需加载所选路径，而非预先获取并渲染完整的生成配置架构。 - Codex：在 Codex 应用服务器和 OpenAI Responses 回放前清理内联图像负载，并在无效图像错误后清除中毒的 Codex 线程绑定。修复 #82878。 - 提供者/GitHub Copilot：在令牌交换、目录、模型调用、使用量和嵌入中请求身份编码的 Copilot API 响应，使压缩的 Business 账户错误负载不再作为 gzip 字节到达 JSON 解析器。修复 #82871。感谢 @tonyfe01。 - Telegram：在群组回复链中保留被回复的机器人消息、标题和媒体元数据，使后续回复理解用户正在回复的内容。（#82863） - 提供者/Together：将 PI 运行时包更新至 0.74.1，并为支持推理的 OpenAI 补全模型发出 Together 风格的 `reasoning.enabled`/`max_tokens` 控制。 - 智能体/诊断：将缓慢的嵌入式运行 `attempt-dispatch` 启动摘要拆分为工作区、提示、运行时计划和最终分派子跨度，使追踪识别延迟的设置阶段。修复 #82782。（#82783）感谢 @galiniliev。 - 智能体/Codex：将嵌套的工具结果中间件块展平为有界文本，使成功的消息发送不再被替换为 `Tool output unavailable due to post-processing error`。修复 #82912。感谢 @joeykrug。 - CLI/媒体：在 `openclaw infer image describe --file` 中接受 HTTP(S) URL，通过受保护的媒体路径获取远程图片，而非将 URL 视为本地文件。修复 #82837。（#82854）感谢 @neeravmakwana。 - 智能体/子智能体：当子等待调用在子会话实际稳定前超时时，保持会话后端的父运行活跃，使延迟的子智能体完成被协调而非丢失。修复 #82787。感谢 @ramitrkar-hash。 - Control UI：在浏览器连接帧中通告共享的网关协议常量，修复协议常量漂移后的协议不匹配握手。修复 #82882。感谢 @galiniliev。 - 网关：添加回退协议不匹配诊断，包括网关日志中的客户端协议范围以及针对过时客户端进程的深度状态/医生提示。修复 #82841。（#82908） - 智能体/子智能体：在最终投递重试用尽后保留成功保持模式的完成负载，使请求者恢复不再丢失最终子智能体结果。修复 #82583。（#82999）感谢 @joshavant。 - 网关/认证：在重新审视 #78684 故障关闭策略后，允许同主机可信代理调用者使用文档化的本地直接 `gateway.auth.password` 回退，同时保持令牌回退被拒绝以及转发头部请求走可信代理路径。修复 #82607。（#82953）感谢 @joshavant。 - 智能体/子智能体：等待排队的完成交接到达父转录后再将其标记为已宣布，防止繁忙的父运行在观察到子结果前清理。修复 #82913。（#83039）感谢 @joshavant。 - 智能体/子智能体：在需要时将群组/通道子智能体完成通过仅消息工具交接路由，并保持活跃请求者唤醒失败不会丢弃完成投递。修复 #82803。感谢 @galiniliev、@yozakura-ava 和 @moeedahmed。 - 内存核心：在启动时扫描持久化内存源会话，将磁盘上的转录与索引进行比较，仅将缺失/更新/调整大小的文件标记为脏文件以进行增量同步。修复 #82341。（#82341）感谢 @giodl73-repo。 - Telegram：当命名账户或绑定与顶层凭据一起添加时，保持顶层默认账户在账户列表中，保留默认轮询，同时仍允许仅命名配置解析到单个账户。修复 #82794。（#82794）感谢 @giodl73-repo。 - CLI/模型：在模型列表、提供者目录、认证和合成认证检查中重用命令作用域的插件元数据，恢复插件繁重安装的快速 `openclaw models` 运行。修复 #82881。（#83033）感谢 @joshavant。 - CLI/通道：当官方外部通道（如 Discord）的插件包缺失时，在 `openclaw channels list` 中显示已配置的官方外部通道，包括安装和医生修复命令，而非报告无已配置通道。修复 #82813。 - Signal：通过路由和会话持久化保留混合大小写的群组 ID，使群组自动回复在更新后继续投递。修复 #82827。 - 智能体/工具：当 `message` 工具通过 `tools.alsoAllow` 或运行时工具允许列表被显式允许时，在嵌入式运行中保持其可用，使具有自定义回复投递的通道插件仍能使用已配置的消息发送。修复 #82833。感谢 @cn1313113。 - WhatsApp：对出站图片、GIF 和视频媒体强制执行文档投递，使 `forceDocument`/`asDocument` 发送保留原始媒体字节，而非使用压缩媒体负载。（#79272）感谢 @itsuzef。 - WhatsApp：当未提供文件名时，根据 MIME 类型命名出站文档附件，使 PDF 和 CSV 发送以 `file.pdf` 和 `file.csv` 到达，而非无扩展名的 `file`。感谢 @mcaxtr。 - 进程/诊断：在通道等待警告中报告活跃通道阻塞器，使 `queueAhead=0` 不再隐藏正在等待活跃工作的命令。修复 #82791。（#82792）感谢 @galiniliev。 - 进程/诊断：停止将活跃处理轮次计数为存活警告中的排队积压，使瞬态最大仅事件循环峰值不再表现为网关警告。 - 智能体/回复：将提供者对话状态拒绝分类，并返回清晰的消息通道错误，而非自动重置或回退到通用运行器失败。（#82616）感谢 @dutifulbob。 - 浏览器插件：当启动 HTTP 探测与冷启动就绪竞争时，信任受管 Chrome CDP 诊断，避免虚假启动失败。修复 #82904。（#82986）感谢 @kmanan 和 @hclsys。 - Android：在替换已更改的网关 TLS 指纹前提示，显示旧的和新的 SHA-256 指纹，使用户能够接受预期的证书轮换，而非在引脚不匹配时硬失败。（#83077）感谢 @sliekens。 - CLI/状态：将额外的网关类服务诊断渲染为警告/信息输出，而非错误输出。修复 #46930。（#82922）感谢 @giodl73-repo。 - 智能体/故障转移：将 Moonshot/Kimi 余额用尽 HTTP 429 负载分类为计费而非通用速率限制，保留计费指导和回退行为。修复 #43447。（#83079）感谢 @leno23。 - 插件 SDK：将 `openclaw/plugin-sdk/zod` 捆绑到发布的包产物中，并验证打包的 zod 子路径保持自包含，使 pnpm 全局安装能够注册插件而无需包本地的 `zod` 符号链接。修复 #78398。（#78515）感谢 @ggzeng。

### Changes - Mac app: redesign Settings pages with consistent card layouts, cached navigation, cleaner permissions/voice/skills/cron/exec/debug panes, and steadier spacing around the native sidebar. - Skills: rename the repo-local Codex closeout review skill and helper to `autoreview` while preserving the Codex-first fallback behavior. - Skills: add a meme-maker skill for curated template search, local SVG/PNG rendering, Imgflip hosted rendering, and Know Your Meme provenance links. - Agents/tools: shorten built-in tool descriptions and schema hints across media, messaging, sessions, cron, Gateway, web, image/PDF, TTS, nodes, and plan tools while preserving routing guardrails. - Skills: add node inspector debugging, fused diagram generation, and throwaway spike workflow skills. - CLI/plugins: add `defineToolPlugin` plus `openclaw plugins build`, `validate`, and `init` for typed simple tool plugins with generated manifest metadata, optional tool declarations, and context factories. - Agents/skills: tighten bundled skill prompts and metadata, quote skill descriptions, refresh current CLI/API guidance, and update embedded sherpa-onnx runtime downloads. - Skills: update the Obsidian skill to target the official `obsidian` CLI and require its registered binary instead of the third-party `obsidian-cli`. - Skills: add a Python debugging skill for pdb, breakpoint(), post-mortem inspection, and debugpy remote attach. - Plugins/messages: add presentation capability limits for channel renderers, adapt rich message controls before native rendering, and mark legacy `interactive`/Slack directive producer APIs as deprecated. - Proxy: support HTTPS managed forward-proxy endpoints and scoped `proxy.tls.caFile` CA trust for proxy endpoint TLS. (#79171) Thanks @jesse-merhi. - QA-Lab: add first-hour 20-turn and optional 100-turn runtime parity scenarios, with tier metadata for standard and soak QA gates. Fixes #80338; refs #80337. Thanks @100yenadmin. - QA-Lab: add `openclaw qa suite --runtime-parity-tier` and wire the standard Codex-vs-Pi tier into release checks separately from optional/live-only/soak lanes. Fixes #80337. Thanks @100yenadmin. - QA-Lab: add a live-only Codex Pi-shaped Read vocabulary canary so runtime parity catches native workspace-read prompt compatibility drift. (#80323) Thanks @100yenadmin. - QA-Lab: add live-only harness self-health scenarios for plugin hook crashes, manifest contract errors, and WebChat direct-reply self-message routing. (#80323) Thanks @100yenadmin. - QA-Lab: add runtime tool fixture scenarios and coverage reporting for Codex-native workspace tools, OpenClaw dynamic tools, and optional plugin-backed tools. Fixes #80173. Thanks @100yenadmin. - QA-Lab: expose runtime tool fixture coverage through `openclaw qa coverage --tools`, with optional suite-summary evaluation for parity gate artifacts. Thanks @100yenadmin. - QA-Lab: add the personal-agent approval-denial scenario so the benchmark pack verifies denied local reads stop cleanly without tool progress or fixture leaks. (#83150) Thanks @iFiras-Max1. ### Fixes - CLI/update: tailor post-update Gateway recovery hints by platform, showing systemd, LaunchAgent, Scheduled Task, or generic service-manager guidance instead of macOS-only recovery text. (#83096) Thanks @rubencu. - Plugins: apply a default 15-second timeout to legacy `before_agent_start` hooks so hung plugin handlers no longer block agent startup. Fixes #48534. (#83136) Thanks @therahul-yo. - Feishu: refresh inbound session delivery context for DM, group, and broadcast turns so later replies do not inherit stale WebChat routing. Fixes #78274. - QA-Lab/qa-channel: attach redacted agent tool-start traces to outbound `QaBusMessage` records so scenarios can assert actual tool use instead of relying only on reply text. Fixes #67637. Thanks @100yenadmin. - QA-Lab: fail live runtime parity reports when assistant-message usage is missing, preventing `0 vs 0` live token rows from being reported as passing proof. Fixes #80411. Thanks @100yenadmin. - QA-Lab: fail Codex-backed OpenAI live runtime-pair runs before launching isolated workers when no portable Codex auth is available, while staging API-key fallbacks and configured Codex keys for isolated QA agents. Fixes #80412. Thanks @100yenadmin. - QA-Lab: refresh parity gates, mock frontier fixtures, model scenarios, and workflow artifact lanes to compare GPT-5.5 against Claude Opus 4.7. Fixes #74262. Thanks @100yenadmin. - QA-Lab: make mock parity dispatch provider-aware for source discovery and subagent scenarios so OpenAI and Anthropic lanes no longer share identical canned plans. Fixes #64879. Thanks @100yenadmin. - QA-Lab: stop returning Control UI bearer tokens from unauthenticated bootstrap payloads and bind Docker harness ports to loopback-only host addresses. (#66355) Thanks @pgondhi987. - Mac app: avoid a SwiftUI metadata crash when rendering the Cron Jobs settings pane. - Agents/OpenAI streams: yield via `setTimeout(0)` instead of `setImmediate` between bursty Responses chunks so abort timers can fire during the yield, keeping cancel-on-timeout responsive on hot streams. Refs #82462. - CLI/config: send SecretRef diagnostics to stderr so JSON command stdout remains parseable. - CLI/plugins: ship the bundled memory CLI as a package entry so package-installed `openclaw memory` commands register correctly. - CLI/update: defer doctor-time plugin package installs during package swaps and seed post-core repair from the updated install registry, preventing duplicate reinstall failures. - Feishu: detect SecretRef top-level credentials as a configured default account instead of treating object-backed app secrets as missing. - CLI/completion: resolve concrete PowerShell profile paths and reload commands during setup and doctor completion installation. Fixes #44296. (#83059) Thanks @yu-xin-c. - Providers/Google: preserve and recover Gemini 3 tool-call thought signatures during native replay so function-calling turns no longer fail with missing `thought_signature` 400s. Fixes #72879. (#80358) Thanks @abnershang. - Memory-core: distinguish sqlite-vec load failures from missing semantic vector embeddings in degraded `memory index` warnings, so vector recall diagnostics point at unresolved dimensions instead of blaming sqlite-vec when the store is ready. Fixes #75624. (#83056) Thanks @xuruiray and @Noah3521. - Agents/subagents: preserve sandbox-peer controller ownership while routing completion announcements back to the originating run session, keeping subagent control and completion delivery scoped correctly. Fixes #80201. (#80242) Thanks @Jerry-Xin. - Gateway: continue restarting remaining channels when one hot-reload channel restart fails, while still reporting aggregate reload failure and rolling back plugin pre-replace stops. Fixes #83054. Thanks @zqchris. - Gateway/secrets: split the lightweight secrets runtime state and auth-store cache from the full secrets runtime and take a startup fast path when the gateway startup config has no SecretRef values, speeding up secrets startup while preserving cleanup and refresh semantics. - Codex app-server: rotate oversized native Codex threads before resume and cap dynamic tool-result text entering native Codex sessions, preventing stale oversized context from surviving OpenClaw compaction. (#82981) Thanks @hansolo949. - Gateway/restart: drain pending replies and active chat runs during restart shutdown before sockets and channels close, aborting timed-out chat runs through the normal cleanup path. (#69121) Thanks @alexlomt. - Agents/Codex: use the Codex runtime context window for OpenAI-model preflight compaction and memory flush checks, so GPT-5.5 Codex sessions compact before hitting the smaller native context limit. Fixes #82982. Thanks @vliuyt. - QA-Lab: clean orphaned gateway temp roots when a suite parent exits and wait on gateway plus transport readiness after config restarts, reducing stale `qa-channel` noise from interrupted runs. Fixes #65506. Thanks @100yenadmin. - QA-Lab: wake qa-bus long polls that arrive with stale future cursors after a bus restart, preserving reconnect readiness for harness clients. (#67142) Thanks @hxy91819. - QA-Lab: stage Multipass transfer scripts under OpenClaw's preferred temp root instead of raw OS temp paths, keeping the VM runner inside temp-path guardrails. (#64098) Thanks @ImLukeF. - Agents/replies: keep surviving reply media and append a warning when other media references fail, so partial media normalization no longer drops failures silently. Thanks @Jerry-Xin. - Config/models: accept `thinkingFormat: "together"` in model compat config so Together routes can opt into the Together-specific thinking response shape. - Plugins/tokenjuice: bump the bundled tokenjuice runtime to 0.7.1, bringing Codex hook approval compatibility, pre-tool command wrapping fixes, and Rolldown/Vitest output compaction improvements into the OpenClaw plugin. - Agents/OpenAI: stop post-processing GPT-5 final replies with hardcoded brevity caps, preserving full channel responses instead of appending synthetic ellipses, and log when strict-agentic GPT-5 execution activates. Fixes #82910. - Mac app: refine the Settings General and Connection panes with cleaner status panels, card rows, and a single native titlebar sidebar toggle. - Agents/media: deliver failed async image, music, and video generation completions directly when requester-session completion handoff fails, so channel users see provider errors instead of silent fallback stalls. - Agents/music: steer song, jingle, beat, anthem, and instrumental requests toward `music_generate` audio creation instead of lyric-only replies, and reserve `lyrics` for exact sung words. - Codex app-server: record native Codex tool calls and results into trajectory artifacts so debug/trajectory exports capture the full Codex-native tool history, not just OpenClaw-bridged turns. Thanks @vyctorbrzezowski. - Codex/app-server: keep bound conversation sessions on the owning agent runtime so native Codex control and follow-up turns do not fall back to the default agent client. Fixes #82954. (#82993) - CLI/infer: run gateway model probes in fresh explicit sessions so one-shot provider checks do not inherit default agent transcript state. (#82861) Thanks @Kaspre. - Providers/Together: send video-generation requests to Together's v2 video API even when shared text-model config still points at the v1 base URL. (#82992) - Browser CLI: preserve browser-level options on nested commands, skip option values during lazy command registration, and keep long-running wait/download/dialog hooks open for their advertised wait window. - CLI/sessions: accept `openclaw sessions list` as an alias for `openclaw sessions`, matching other list-style commands. Fixes #81139. (#81163) Thanks @YB0y. - Channels/stream previews: widen compact progress draft lines and cut prose at word boundaries while preserving command/path suffixes, with `streaming.progress.maxLineChars` for channel-specific tuning. - CLI/plugins: have `openclaw plugins doctor` warn when a configured runtime needs a missing owner plugin, sharing the same install mapping as `openclaw doctor --fix`. Fixes #81326. (#81674) Thanks @Zavianx. - Agents/Codex: route OpenAI runs that resolve to `openai-codex` through the Codex provider and bootstrap OpenClaw's stored OAuth profile into the Codex harness when the harness owns transport, so `openai/*` model refs no longer fail with `No API key found for openai-codex` despite an existing Codex OAuth profile. (#82864) Thanks @ragesaq. - Agents/ACP: distinguish prompt-submitted and runtime-active child stalls from true interactive waits, including redacted proxy-env diagnostics for Codex ACP no-output runs. Fixes #44810. - Agents/memory: explain that memory-triggered compaction exposes only `read` and append-only `write` when configured core tools are unavailable in `tools.allow` warnings. Fixes #82941. Thanks @galiniliev. - Agents/OpenAI: preserve deterministic tool payload ordering for prompt-cache reuse across OpenAI Responses and chat completions calls. (#82940) Thanks @galiniliev. - ACP/Codex: honor terminal ACP turn results so failed Codex/acpx runs are not recorded as successful after only progress text. Fixes #79522. Thanks @dudaefj. - Telegram: warn when a media group drops photos that fail to download, including albums where every photo is skipped. Fixes #55216. (#82987) Thanks @eldar702. - Agents/skills: apply the full effective tool policy pipeline to inline `command-dispatch: tool` skill dispatch before owner-only filtering, preserving configured allow, deny, sandbox, sender, group, and subagent restrictions. (#78525) - Codex: avoid spawning native hook relay subprocesses for post-tool/finalize events with no registered hook handlers while preserving pre-tool safety and approval relays. Fixes #76552. (#78004) Thanks @evgyur. - Channel accounts: keep top-level default channel accounts visible when named accounts are added alongside default credential material, so mixed legacy/new account configs keep resolving `default` instead of silently dropping it. - Codex/Telegram: synthesize native Codex tool progress from final turn snapshots so Telegram `/verbose` stays visible when command events arrive only at completion. - Mac app: make Channels settings open faster by deferring config-schema work, avoiding startup channel probes, caching decoded channel status rows, and showing only compact quick settings instead of the full generated channel schema. - Control UI: include the Control UI and Gateway protocol versions in protocol-mismatch errors so stale app/dashboard pairings identify which side needs rebuilding or restarting. - Gateway/protocol: restore Gateway WS protocol v4 and keep `message.action` room-event metadata on the existing `inboundTurnKind` wire field while preserving internal inbound-event classification. - Agents/tools: prefer non-webchat session-key routes when the message tool has stale webchat context, so message-tool-only replies keep delivering to the originating channel. Fixes #82911. (#83004) Thanks @joshavant. - Channels: keep direct-message last-route writes on isolated `per-channel-peer` sessions instead of contaminating the agent main session with channel delivery context. Fixes #36614. Thanks @aspenas. - Mac app: move the Settings sidebar toggle into the native titlebar and tighten the General pane width. - Mac app: keep visited Settings panes mounted so switching tabs no longer blanks and reloads their content. - Mac app: make Config settings open from shallow schema lookups and load selected paths on demand instead of fetching and rendering the full generated config schema up front. - Codex: sanitize inline image payloads before Codex app-server and OpenAI Responses replay, and clear poisoned Codex thread bindings after invalid image errors. Fixes #82878. - Providers/GitHub Copilot: request identity-encoded Copilot API responses across token exchange, catalog, model calls, usage, and embeddings so compressed Business-account error payloads no longer reach JSON parsers as gzip bytes. Fixes #82871. Thanks @tonyfe01. - Telegram: preserve replied-to bot messages, captions, and media metadata in group reply chains so follow-up replies understand what the user is reacting to. (#82863) - Providers/Together: update PI runtime packages to 0.74.1 and emit Together-style `reasoning.enabled`/`max_tokens` controls for reasoning-capable OpenAI-completions models. - Agents/diagnostics: split slow embedded-run `attempt-dispatch` startup summaries into workspace, prompt, runtime-plan, and final dispatch subspans so traces identify the delayed setup phase. Fixes #82782. (#82783) Thanks @galiniliev. - Agents/Codex: flatten nested tool-result middleware blocks into bounded text so successful message sends are no longer replaced with `Tool output unavailable due to post-processing error`. Fixes #82912. Thanks @joeykrug. - CLI/media: accept HTTP(S) URLs in `openclaw infer image describe --file`, fetching remote images through the guarded media path instead of treating URLs as local files. Fixes #82837. (#82854) Thanks @neeravmakwana. - Agents/subagents: keep session-backed parent runs active when the child wait call times out before the child session has actually settled, so late subagent completions are reconciled instead of being lost. Fixes #82787. Thanks @ramitrkar-hash. - Control UI: advertise shared Gateway protocol constants in browser connect frames, fixing protocol mismatch handshakes after protocol constant drift. Fixes #82882. Thanks @galiniliev. - Gateway: add rollback protocol-mismatch diagnostics, including client protocol ranges in Gateway logs and deep status/doctor hints for stale client processes. Fixes #82841. (#82908) - Agents/subagents: keep successful keep-mode completion payloads pending after final-delivery retry exhaustion, so requester recovery no longer loses final subagent results. Fixes #82583. (#82999) Thanks @joshavant. - Gateway/auth: allow same-host trusted-proxy callers to use the documented local direct `gateway.auth.password` fallback after revisiting the #78684 fail-closed policy, while keeping token fallback rejected and forwarded-header requests on the trusted-proxy path. Fixes #82607. (#82953) Thanks @joshavant. - Agents/subagents: wait for queued completion handoffs to reach the parent transcript before marking them announced, preventing busy parent runs from cleaning up before observing child results. Fixes #82913. (#83039) Thanks @joshavant. - Agents/subagents: route group/channel subagent completions through message-tool-only handoffs when required and keep active-requester wake failures from dropping completion delivery. Fixes #82803. Thanks @galiniliev, @yozakura-ava, and @moeedahmed. - Memory-core: scan persisted memory source sessions on startup, comparing on-disk transcripts against the index and marking only missing/newer/resized files dirty for incremental sync. Fixes #82341. (#82341) Thanks @giodl73-repo. - Telegram: keep the top-level default account in the account list when named accounts or bindings are added alongside top-level credentials, preserving default polling while still letting named-only configs resolve to a single account. Fixes #82794. (#82794) Thanks @giodl73-repo. - CLI/models: reuse command-scoped plugin metadata across model listing, provider catalog, auth, and synthetic-auth checks, restoring fast `openclaw models` runs for plugin-heavy installs. Fixes #82881. (#83033) Thanks @joshavant. - CLI/channels: show configured official external channels such as Discord in `openclaw channels list` when their plugin package is missing, including the install and doctor repair command instead of reporting no configured channels. Fixes #82813. - Signal: preserve mixed-case group IDs through routing and session persistence so group auto-replies keep delivering after updates. Fixes #82827. - Agents/tools: keep the `message` tool available in embedded runs when it is explicitly allowed through `tools.alsoAllow` or runtime tool allowlists, so channel plugins with custom reply delivery can still use configured message sends. Fixes #82833. Thanks @cn1313113. - WhatsApp: honor forced document delivery for outbound image, GIF, and video media so `forceDocument`/`asDocument` sends preserve original media bytes instead of using compressed media payloads. (#79272) Thanks @itsuzef. - WhatsApp: name outbound document attachments from their MIME type when no filename is provided, so PDF and CSV sends arrive as `file.pdf` and `file.csv` instead of an extensionless `file`. Thanks @mcaxtr. - Process/diagnostics: report active lane blockers in lane wait warnings so `queueAhead=0` no longer hides commands waiting behind active work. Fixes #82791. (#82792) Thanks @galiniliev. - Process/diagnostics: stop counting the active processing turn as queued backlog in liveness warnings so transient max-only event-loop spikes do not surface as gateway warnings. - Agents/replies: classify provider conversation-state rejections and return a clear message-channel error instead of auto-resetting or falling back to a generic runner failure. (#82616) Thanks @dutifulbob. - Browser plugin: trust managed Chrome CDP diagnostics when launch HTTP probes race cold-start readiness, avoiding false startup failures. Fixes #82904. (#82986) Thanks @kmanan and @hclsys. - Android: prompt before replacing a changed Gateway TLS thumbprint, showing the old and new SHA-256 fingerprints so users can accept expected certificate rotations instead of hard failing on pin mismatch. (#83077) Thanks @sliekens. - CLI/status: render extra gateway-like service diagnostics as warning/info output instead of error output. Fixes #46930. (#82922) thanks @giodl73-repo. - Agents/failover: classify Moonshot/Kimi exhausted-balance HTTP 429 payloads as billing instead of generic rate limits, preserving billing guidance and fallback behavior. Fixes #43447. (#83079) Thanks @leno23. - Plugin SDK: bundle `openclaw/plugin-sdk/zod` into the published package artifact and verify the packed zod subpath stays self-contained, so pnpm global installs can register plugins without a package-local `zod` symlink. Fixes #78398. (#78515) Thanks @ggzeng.

OpenClaw v2026.5.16-beta.5 预发布