### 亮点
- **更强的安全性与内容边界**：组提示文本被排除在系统提示之外，重复点号的主机名被规范化，带副作用的命令包装器和不安全的 Node 运行时环境覆盖被阻止，无认证的 Tailscale 暴露被拒绝，节点/设备角色的审批现在需要管理员权限。（#87144、#87305、#87292、#87308、#87146）感谢 @eleqtrizit 和 @pgondhi987。
- **更可靠的 Codex 应用服务器运行**：Codex 运行时模型优先解析，工作区内存通过工具路由，共享的应用服务器客户端在启动和衍生辅助程序故障后仍能存活，原生钩子中继生成在重启和全新回退时保持存活并轮换，避免虚假的运行时实时切换。（#87383、#87403、#87375、#72574、#87428）感谢 @yetval。
- **更快的网关和回复路径**：会话读取、插件元数据指纹、认证环境快照、自动启用的插件配置、工具搜索目录和稳定的元数据缓存在热路径上减少重新发现，可见回复不再继承隐藏的清理超时。（#86439、#87044）感谢 @keshavbotagent。
- **更好的提供商和模型覆盖**：兼容 OpenAI 的嵌入提供商成为核心，DeepInfra 目录浏览加载完整的凭据感知模型集，Pixverse 增加视频生成和 API 区域选择，VLLM 思考参数已接入，Claude CLI OAuth 覆盖层为 PI 认证配置文件加载，裸的直接 Anthropic 模型 ID 正常工作。（#85269、#84549、#87167）感谢 @dutifulbob、@ats3v 和 @joshavant。
- **频道投递更稳定**：Telegram 的 `sendMessage` 操作使用持久化的出站投递，iMessage 抑制重复的原生执行审批提示和发送，Slack 在后期清理期间保留已投递的最终回复，Matrix 提及预览/最终更严格，QQBot 回退审批按钮遵从斜杠命令认证，Discord 公会请求者检查更严格，已恢复的 Discord 工具警告工件不会出现在成功回复中，Google Chat 在 DM 中停止线程发送。（#87261、#87154）感谢 @mbelinky 和 @eleqtrizit。
- **发布、包和 CI 证明路径更难被楔入**：npm/包清单遵守分发排除规则，收缩包装覆盖固定合并正确，Docker 运行时工作区模板已打包并冒烟测试，发布后发布检查更严格，Beta 冒烟测试拒绝空运行，E2E 日志/探针等待有界。
### 变更
- **内存**：为核心添加一个兼容 OpenAI 的嵌入提供商，用于本地和托管式 OpenAI 风格端点，支持配置、诊断和文档。（#85269）感谢 @dutifulbob。
- **插件 SDK**：将内存专用的嵌入提供商注册标记为已弃用的兼容性，并在插件兼容性诊断中显示非捆绑使用情况。（#85072）感谢 @mbelinky。
- **提供商**：添加 Pixverse 视频生成提供商、API 区域选择、文档和外部插件打包支持。
- **DeepInfra**：在用户入职期间浏览模型时加载完整模型目录，保留配置的 API 密钥目录，刷新媒体/视频默认值，保持价格/默认模型元数据对齐。（#84549）感谢 @ats3v。
- **插件 SDK**：公开插件审批操作元数据，并停止从公共 SDK 表面导出 Vitest 测试助手。（#87120）感谢 @RomneyDa。
- **频道 SDK**：将频道消息兼容性移入核心，移除旧的频道轮次运行时别名，并为插件保留运行时目录 Markdown 元数据。
- **ClawHub**：添加插件显示元数据，使目录/包列表使用更清晰的名称。（#87354）感谢 @thewilloftheshadow。
- **代理**：将心跳运行时模板从文档资源中拆分出来，并为遗留心跳模板内容添加兼容性修复。（#85416）感谢 @hxy91819。
### 修复
- **安全/内容边界**：将不受信任的组提示元数据路由到系统提示之外，规范化重复的尾部主机名点，阻止带副作用的命令包装器，拒绝不安全的 Node 运行时环境覆盖，拒绝无认证的 Tailscale 暴露，阻止不受信任的 Microsoft Teams 服务 URL，强制执行 `/allowlist configWrites` 来源策略，限制 QQBot 回退审批按钮，并要求管理员才能进行节点/设备角色审批。（#87144、#87305、#87292、#87308、#87146、#87154、#87334）感谢 @eleqtrizit 和 @pgondhi987。
- **Codex**：在通用路由之前解析 Codex 运行时模型，通过工具路由工作区内存，在启动和衍生辅助程序故障后保留共享的应用服务器客户端，在重启和全新回退时保留原生钩子中继生成，保持原始推理/来源回复守卫完好，报告隔离的动态工具，保持尝试看门狗为排队的终端轮次武装，并通过 OpenAI-Codex 路由 Codex OAuth 压缩。（#87383、#87403、#87375、#72574、#87428）感谢 @yetval。
- **代理/运行时**：避免会话事件队列自等待，限制压缩唤醒和转向重试，为挂起的错误诊断保留宽限，避免虚假的 Codex 运行时实时切换，避免重用过时的重启延续，保留会话回退错误，抑制重复的 Claude CLI 技能提示，在活跃用户轮次前保留运行时上下文，剥离过时的 Anthropic 思考，隔离不支持的工具体系，安全恢复已完成的写入超时，在超时中止时释放保留的会话写入锁，并在固定前验证强制的插件工具包支持。（#86123、#55424、#86855、#74341、#87278）感谢 @luoyanglang、@cathrynlavery 和 @openperf。
- **回复/会话投递**：保持可见轮次准入无界，保持可见回退投递到最新目标，保留桥接钩子上下文，按频道语法分类直接回退目标，在桥接模式下报告审批决议，并避免过时的来源回复工件。（#87044）感谢 @keshavbotagent。
- **频道**：使 Telegram `sendMessage` 操作回复持久化并保留 SecretRef 提示配置，抑制重复的 iMessage 原生执行审批提示和发送，在拒绝反应后保持 iMessage 审批轮询存活，在后期清理期间保留 Slack 已投递的最终回复，保持 Matrix 提及预览/最终为提及惰性并正常投递，忽略嵌入文件名的 Matrix ID，从成功回复中抑制已恢复的 Discord 工具警告工件，在 DM 中抑制 Google Chat 线程发送，并加强 Discord 公会请求者检查。（#87261、#87452）感谢 @mbelinky。
- **内存**：在非零退出后抢救 QMD 搜索 JSON，并在可能的情况下通过 Codex 工具路径保留工作区内存路由。（#87225、#87383、#87403）感谢 @osolmaz。
- **提供商/模型**：在兼容 OpenAI 的聊天补全中转发缓存的 token 使用量，为 PI 认证配置文件加载 Claude CLI OAuth 覆盖层，发送裸的直接 Anthropic 模型 ID，接入配置的 VLLM 思考参数，遵守兼容 OpenAI 的缓存保留，规范化 OpenAI Responses 重放工具 ID，在没有缓存目录的情况下解析 OpenAI `gpt-5.5`，保留 `retry-after` 回退处理，限制 GitHub Copilot 认证请求，并一致地加载 DeepInfra 自定义/实时目录。（#82062、#87167、#84549）感谢 @caz0075、@joshavant 和 @ats3v。
- **网关/性能**：借用只读会话元数据和活动会话工作存储，缓存当前/稳定的插件元数据指纹，缓存自动启用的插件配置，精简元数据身份缓存，信任当前元数据生命周期缓存，稳定隔离的 cron 提示缓存亲和性，持久化模型认证配置文件后缀，耗尽探针客户端关闭，在认证轮换后过期浏览器令牌，并保持默认状态快速路径有界。感谢 @ferminquant。
- **CLI/帮助/配置**：拒绝网关超时、模型限制、目录限制、消息选项、webhook 和部分值的松散或格式错误的数字选项；尊重子命令版本选项；正确路由生成/根/插件帮助目标；保持技能 JSON 输出自然刷新；并在根帮助中保持插件描述符加载静默。（#87398）感谢 @Patrick-Erichsen。
- **插件状态/工具搜索**：当插件行达到上限时驱逐当前命名空间，重用未更改的工具搜索目录，对齐发布目录重用包装器，并保持回退工具警告为提及惰性。
- **安装/包/发布**：匹配 npm globstar 排除规则，在清单中遵守分发包排除，省略未打包的测试助手，跳过 Homebrew 直到 macOS 包需要为止，打包 Docker 运行时工作区模板，在完整验证期间冒烟测试 Docker 运行时模板，合并嵌套的收缩包装覆盖固定，保留分支的收缩包装固定，固定老化的 `lru-cache`，加强发布后验证，接受主分支完整验证证明，并拒绝空 Beta 冒烟运行。
- **E2E/QA/Crabbox**：限制 Telegram、Open WebUI、ClawHub、Matrix、工具搜索、MCP、网关网络、捆绑运行时、厨房水槽、codex 媒体、配置重载和代理轮次断言等待；优先为 Windows 目标使用 Azure；重新初始化无效的 changed-gate git 目录；全同步稀疏容器运行；并失败空的显式测试请求。（#87186）
### 发布验证
- npm 包：https://www.npmjs.com/package/openclaw/v/2026.5.27-beta.1
- 注册表 tarball：https://registry.npmjs.org/openclaw/-/openclaw-2026.5.27-beta.1.tgz
- 完整性：`sha512-Bwc1x2bsmmjgc/zfKrZZTUCVKSwc29WJ96RxKb6xvR/3/ISvBjmMGa1goJuJi2Po+oqrD3IJ8zdbxcGSY7Woww==`
- 完整发布验证：https://github.com/openclaw/openclaw/actions/runs/26555534701
- npm 预检：https://github.com/openclaw/openclaw/actions/runs/26555537448
- 发布父级：https://github.com/openclaw/openclaw/actions/runs/26556941655
- OpenClaw npm 发布：https://github.com/openclaw/openclaw/actions/runs/26557350528
- 插件 npm 发布：https://github.com/openclaw/openclaw/actions/runs/26557065983 在 Actions 中发布了除 @openclaw/pixverse-provider 外的所有插件；@openclaw/pixverse-provider 已通过 npm 维护者认证手动恢复。
- 插件 ClawHub 发布：https://github.com/openclaw/openclaw/actions/runs/26557068673 在 Actions 中发布了除 @openclaw/pixverse-provider 外的所有工作流候选；@openclaw/pixverse-provider 在包行启动后已在 ClawHub 上手动恢复。
- 发布后验证器：`fnm exec --using 24.15.0 -- node --import tsx scripts/openclaw-npm-postpublish-verify.ts 2026.5.27-beta.1` 通过。
- Beta 发布验证器：`fnm exec --using 24.15.0 -- pnpm release:verify-beta -- 2026.5.27-beta.1 ... --skip-clawhub --plugins <除 @openclaw/pixverse-provider 外所有可发布插件>` 核心 npm、GitHub 发布、30 个插件 npm 包、完整验证和 OpenClaw npm 发布均通过。
- @openclaw/pixverse-provider 恢复验证器：`node --import tsx scripts/release-verify-beta.ts 2026.5.27-beta.1 --plugins @openclaw/pixverse-provider --skip-postpublish` 对 GitHub 发布、核心 npm、插件 npm 和 ClawHub 均通过。
- Beta 冒烟测试：由于此主机缺少 Parallels VM `Ubuntu 26.04`，已在本地被阻止。
- @openclaw/pixverse-provider：https://www.npmjs.com/package/@openclaw/pixverse-provider/v/2026.5.27-beta.1
- @openclaw/pixverse-provider tarball：https://registry.npmjs.org/@openclaw/pixverse-provider/-/pixverse-provider-2026.5.27-beta.1.tgz
- @openclaw/pixverse-provider 完整性：`sha512-9rfWZ4GcKSd9sFrdfI9jncRKWvdtGLjNVWZdbJ+6ztd3WRyxSJTFfj/i9Py8Qj0gr3mDCiQqQXceFA0l7DW2Rg==`
- @openclaw/pixverse-provider ClawHub：https://clawhub.ai/plugins/%40openclaw%2Fpixverse-provider
- @openclaw/pixverse-provider ClawHub API：https://clawhub.ai/api/v1/packages/%40openclaw%2Fpixverse-provider/versions/2026.5.27-beta.1
### Highlights
- Stronger security and content boundaries: group prompt text is kept out of the system prompt, repeated-dot hostnames are normalized, side-effecting command wrappers and unsafe Node runtime env overrides are blocked, no-auth Tailscale exposure is rejected, and node/device-role approvals now require admin authority. (#87144, #87305, #87292, #87308, #87146) Thanks @eleqtrizit and @pgondhi987.
- More reliable Codex app-server runs: Codex runtime models resolve first, workspace memory is routed through tools, shared app-server clients survive startup and spawned-helper failures, native hook relay generations survive restarts and rotate on fresh fallbacks, and false runtime live switches are avoided. (#87383, #87403, #87375, #72574, #87428) Thanks @yetval.
- Faster Gateway and reply paths: session reads, plugin metadata fingerprints, auth env snapshots, auto-enabled plugin config, tool-search catalogs, and stable metadata caches do less hot-path rediscovery while visible replies no longer inherit hidden cleanup timeouts. (#86439, #87044) Thanks @keshavbotagent.
- Better provider and model coverage: OpenAI-compatible embedding providers are core, DeepInfra catalog browsing loads the full credential-aware model set, Pixverse adds video generation and API region selection, VLLM thinking params are wired, Claude CLI OAuth overlays load for PI auth profiles, and bare direct Anthropic model ids work. (#85269, #84549, #87167) Thanks @dutifulbob, @ats3v, and @joshavant.
- Channel delivery is steadier: Telegram `sendMessage` actions use durable outbound delivery, iMessage suppresses duplicate native exec approval prompts and sends, Slack keeps delivered final replies during late cleanup, Matrix mention previews/finals are stricter, QQBot fallback approval buttons honor slash-command auth, Discord guild requester checks are tighter, recovered Discord tool-warning artifacts stay out of successful replies, and Google Chat stops thread sends in DMs. (#87261, #87154) Thanks @mbelinky and @eleqtrizit.
- Release, package, and CI proof paths are harder to wedge: npm/package inventory honors dist exclusions, shrinkwrap override pins merge correctly, Docker runtime workspace templates are packaged and smoked, release postpublish checks are stricter, beta smoke rejects empty runs, and E2E log/probe waits are bounded.
### Changes
- Memory: add a core OpenAI-compatible embedding provider for local and hosted OpenAI-style endpoints, with config, doctor, and docs support. (#85269) Thanks @dutifulbob.
- Plugin SDK: mark memory-specific embedding provider registration as deprecated compatibility and surface non-bundled usage in plugin compatibility diagnostics. (#85072) Thanks @mbelinky.
- Providers: add the Pixverse video generation provider, API region selection, docs, and external plugin packaging support.
- DeepInfra: load the full model catalog when users browse models during onboarding, preserve configured API-key catalogs, refresh media/video defaults, and keep pricing/default model metadata aligned. (#84549) Thanks @ats3v.
- Plugin SDK: expose plugin approval action metadata and stop exporting Vitest test helpers from the public SDK surface. (#87120) Thanks @RomneyDa.
- Channel SDK: move channel message compatibility into core, remove old channel turn runtime aliases, and preserve runtime catalog markdown metadata for plugins.
- ClawHub: add plugin display metadata so catalog/package listings use cleaner names. (#87354) Thanks @thewilloftheshadow.
- Agents: split the heartbeat runtime template out of docs assets and add compatibility repair for legacy heartbeat template content. (#85416) Thanks @hxy91819.
### Fixes
- Security/content boundaries: route untrusted group prompt metadata outside system prompts, normalize repeated trailing hostname dots, block side-effecting command wrappers, reject unsafe Node runtime env overrides, reject no-auth Tailscale exposure, block untrusted Microsoft Teams service URLs, enforce `/allowlist configWrites` origin policy, gate QQBot fallback approval buttons, and require admin for node/device-role approvals. (#87144, #87305, #87292, #87308, #87146, #87154, #87334) Thanks @eleqtrizit and @pgondhi987.
- Codex: resolve Codex runtime models before generic routing, route workspace memory through tools, preserve shared app-server clients after startup and spawned-helper failures, preserve native hook relay generations across restarts and fresh fallbacks, keep raw reasoning/source-reply guards intact, report quarantined dynamic tools, keep the attempt watchdog armed for queued terminal turns, and route Codex OAuth compaction through OpenAI-Codex. (#87383, #87403, #87375, #72574, #87428) Thanks @yetval.
- Agents/runtime: avoid session event queue self-waits, bound compaction wake and steering retries, preserve grace for pending error diagnostics, avoid false Codex runtime live switches, avoid stale restart continuation reuse, preserve session fallback errors, suppress duplicate Claude CLI skill prompts, keep runtime context before active user turns, strip stale Anthropic thinking, quarantine unsupported tool schemas, recover completed write timeouts safely, release retained session write locks on timeout abort, and validate forced plugin harness support before pinning. (#86123, #55424, #86855, #74341, #87278) Thanks @luoyanglang, @cathrynlavery, and @openperf.
- Reply/session delivery: keep visible turn admission unbounded, keep visible fallback delivery on latest targets, preserve bridge hook context, classify direct fallback targets by channel grammar, report approval resolutions in bridge mode, and avoid stale source-reply artifacts. (#87044) Thanks @keshavbotagent.
- Channels: make Telegram `sendMessage` action replies durable and preserve SecretRef prompt config, suppress duplicate iMessage native exec approval prompts and sends, keep iMessage approval polling alive after denied reactions, keep Slack delivered final replies during late cleanup, keep Matrix mention previews/finals mention-inert and normally delivered, ignore filename-embedded Matrix IDs, suppress recovered Discord tool-warning artifacts from successful replies, suppress Google Chat thread sends in DMs, and harden Discord guild requester checks. (#87261, #87452) Thanks @mbelinky.
- Memory: salvage QMD search JSON after nonzero exits and keep workspace memory routing through the Codex tool path where possible. (#87225, #87383, #87403) Thanks @osolmaz.
- Providers/models: forward cached token usage in OpenAI-compatible chat completions, load Claude CLI OAuth overlays for PI auth profiles, send bare direct Anthropic model ids, wire configured VLLM thinking params, honor OpenAI-compatible cache retention, normalize OpenAI Responses replay tool ids, resolve OpenAI `gpt-5.5` without a cached catalog, preserve `retry-after` fallback handling, bound GitHub Copilot auth requests, and load DeepInfra custom/live catalogs consistently. (#82062, #87167, #84549) Thanks @caz0075, @joshavant, and @ats3v.
- Gateway/performance: borrow read-only session metadata and active session working stores, cache current/stable plugin metadata fingerprints, cache auto-enabled plugin config, slim metadata identity caches, trust current metadata lifecycle caches, stabilize isolated cron prompt-cache affinity, persist model auth profile suffixes, drain probe client closes, expire browser tokens after auth rotation, and keep default status fast paths bounded. Thanks @ferminquant.
- CLI/help/config: reject loose or malformed numeric options for gateway timeouts, model limits, directory limits, message options, webhooks, and partial values; respect subcommand version options; route generated/root/plugin help targets correctly; keep skills JSON output flushing naturally; and keep plugin descriptor loading quiet in root help. (#87398) Thanks @Patrick-Erichsen.
- Plugin state/tool search: evict the current namespace when plugin rows hit caps, reuse unchanged tool-search catalogs, align the release catalog reuse wrapper, and keep fallback tool warnings mention-inert.
- Install/package/release: match npm globstar exclusions, honor dist package exclusions in inventory, omit unpacked test helpers, skip Homebrew until macOS packages need it, package Docker runtime workspace templates, smoke Docker runtime templates during full validation, merge nested shrinkwrap override pins, preserve forked shrinkwrap pins, pin aged `lru-cache`, harden postpublish verification, accept main full-validation proof, and reject empty beta smoke runs.
- E2E/QA/Crabbox: bound Telegram, Open WebUI, ClawHub, Matrix, Tool Search, MCP, gateway network, bundled runtime, kitchen-sink, codex media, config reload, and agent-turn assertion waits; prefer Azure for Windows targets; reinitialize invalid changed-gate git dirs; full-sync sparse container runs; and fail empty explicit test requests. (#87186)
### Release verification
- npm package: https://www.npmjs.com/package/openclaw/v/2026.5.27-beta.1
- registry tarball: https://registry.npmjs.org/openclaw/-/openclaw-2026.5.27-beta.1.tgz
- integrity: `sha512-Bwc1x2bsmmjgc/zfKrZZTUCVKSwc29WJ96RxKb6xvR/3/ISvBjmMGa1goJuJi2Po+oqrD3IJ8zdbxcGSY7Woww==`
- full release validation: https://github.com/openclaw/openclaw/actions/runs/26555534701
- npm preflight: https://github.com/openclaw/openclaw/actions/runs/26555537448
- release publish parent: https://github.com/openclaw/openclaw/actions/runs/26556941655
- OpenClaw npm publish: https://github.com/openclaw/openclaw/actions/runs/26557350528
- plugin npm publish: https://github.com/openclaw/openclaw/actions/runs/26557065983 published all plugins except @openclaw/pixverse-provider in Actions; @openclaw/pixverse-provider was recovered manually via npm maintainer auth.
- plugin ClawHub publish: https://github.com/openclaw/openclaw/actions/runs/26557068673 published all workflow candidates except @openclaw/pixverse-provider in Actions; @openclaw/pixverse-provider was recovered manually on ClawHub after package-row bootstrap.
- postpublish verifier: `fnm exec --using 24.15.0 -- node --import tsx scripts/openclaw-npm-postpublish-verify.ts 2026.5.27-beta.1` passed.
- beta release verifier: `fnm exec --using 24.15.0 -- pnpm release:verify-beta -- 2026.5.27-beta.1 ... --skip-clawhub --plugins <all publishable except @openclaw/pixverse-provider>` passed for core npm, GitHub release, 30 plugin npm packages, full validation, and OpenClaw npm publish.
- @openclaw/pixverse-provider recovery verifier: `node --import tsx scripts/release-verify-beta.ts 2026.5.27-beta.1 --plugins @openclaw/pixverse-provider --skip-postpublish` passed for GitHub release, core npm, plugin npm, and ClawHub.
- beta smoke: blocked locally because Parallels VM `Ubuntu 26.04` is missing on this host.
- @openclaw/pixverse-provider: https://www.npmjs.com/package/@openclaw/pixverse-provider/v/2026.5.27-beta.1
- @openclaw/pixverse-provider tarball: https://registry.npmjs.org/@openclaw/pixverse-provider/-/pixverse-provider-2026.5.27-beta.1.tgz
- @openclaw/pixverse-provider integrity: `sha512-9rfWZ4GcKSd9sFrdfI9jncRKWvdtGLjNVWZdbJ+6ztd3WRyxSJTFfj/i9Py8Qj0gr3mDCiQqQXceFA0l7DW2Rg==`
- @openclaw/pixverse-provider ClawHub: https://clawhub.ai/plugins/%40openclaw%2Fpixverse-provider
- @openclaw/pixverse-provider ClawHub API: https://clawhub.ai/api/v1/packages/%40openclaw%2Fpixverse-provider/versions/2026.5.27-beta.1