### 亮点
- **更强的安全性与内容边界**：群组提示文本被隔离在系统提示之外，重复点号的主机名被标准化，副作用命令包装器被阻止，不安全的 Node 运行时环境覆盖被拒绝，无认证的 Tailscale 暴露被拒绝，节点/设备角色审批现在需要管理员权限。（#87144, #87305, #87292, #87308, #87146）感谢 @eleqtrizit 和 @pgondhi987。
- **更可靠的 Codex 应用服务器运行**：Codex 运行时模型首先解析，工作区内存通过工具路由，共享的应用服务器客户端在启动和衍生辅助进程失败后仍能存活，原生钩子中继生成在重启后仍能保持并在新的回退时轮换，避免虚假的运行时实时切换。（#87383, #87403, #87375, #72574, #87428）感谢 @yetval。
- **更快的网关与回复路径**：会话读取、插件元数据指纹、认证环境快照、自动启用的插件配置、工具搜索目录和稳定的元数据缓存减少了热点重新发现，同时可见的回复不再继承隐藏的清理超时。（#86439, #87044）感谢 @keshavbotagent。
- **更好的提供商与模型覆盖**：兼容 OpenAI 的嵌入提供商成为核心，DeepInfra 目录浏览加载了完整的凭据感知模型集，Pixverse 添加了视频生成和 API 区域选择，VLLM 思考参数已接入，Claude CLI OAuth 覆盖为 PI 认证配置文件加载，裸直接 Anthropic 模型 ID 也可用。（#85269, #84549, #87167）感谢 @dutifulbob, @ats3v 和 @joshavant。
- **频道投递更稳定**：Telegram 的 `sendMessage` 操作使用持久化出站投递，iMessage 抑制重复的原生执行审批提示和发送，Slack 在延迟清理期间保留已投递的最终回复，Matrix 提及预览/最终版更严格，QQBot 回退审批按钮遵循斜杠命令认证，Discord 公会请求者检查更严格，恢复的 Discord 工具警告产物不会出现在成功回复中，Google Chat 在私聊中停止线程发送。（#87261, #87154）感谢 @mbelinky 和 @eleqtrizit。
- **发布、包和 CI 验证路径更难以阻塞**：npm/包清单遵循分发排除规则，缩包装覆盖引脚正确合并，Docker 运行时工作区模板已打包并经过冒烟测试，发布后检查更严格，Beta 冒烟测试拒绝空运行，E2E 日志/探测等待有界。
### 变更
- **内存**：为本地和托管的 OpenAI 风格端点添加了一个核心的兼容 OpenAI 的嵌入提供商，支持配置、诊断和文档。（#85269）感谢 @dutifulbob。
- **插件 SDK**：将内存特定的嵌入提供商注册标记为已弃用的兼容性，并在插件兼容性诊断中显示非捆绑用法。（#85072）感谢 @mbelinky。
- **提供商**：添加了 Pixverse 视频生成提供商、API 区域选择、文档和外部插件打包支持。
- **DeepInfra**：用户在上线过程中浏览模型时加载完整模型目录，保留已配置的 API 密钥目录，刷新媒体/视频默认值，并保持定价/默认模型元数据一致。（#84549）感谢 @ats3v。
- **插件 SDK**：公开插件审批操作元数据，并停止从公共 SDK 表面导出 Vitest 测试助手。（#87120）感谢 @RomneyDa。
- **频道 SDK**：将频道消息兼容性移入核心，移除旧的频道轮次运行时别名，并为插件保留运行时目录 Markdown 元数据。
- **ClawHub**：添加插件显示元数据，以便目录/包列表使用更清晰的名称。（#87354）感谢 @thewilloftheshadow。
- **代理**：将心跳运行时模板从文档资产中拆分出来，并为旧的心跳模板内容添加兼容性修复。（#85416）感谢 @hxy91819。
### 修复
- **安全/内容边界**：将不可信的群组提示元数据路由到系统提示之外，标准化重复的尾部主机名点，阻止副作用命令包装器，拒绝不安全的 Node 运行时环境覆盖，拒绝无认证的 Tailscale 暴露，阻止不可信的 Microsoft Teams 服务 URL，强制执行 `/allowlist configWrites` 来源策略，限制 QQBot 回退审批按钮，并要求管理员权限进行节点/设备角色审批。（#87144, #87305, #87392, #87308, #87146, #87154, #87334）感谢 @eleqtrizit 和 @pgondhi987。
- **Codex**：在通用路由之前解析 Codex 运行时模型，通过工具路由工作区内存，在启动和衍生辅助进程失败后保留共享应用服务器客户端，在重启和新的回退中保留原生钩子中继生成，保持原始推理/来源回复守卫完好，报告隔离的动态工具，保持尝试看门狗为排队的终端轮次启用，并通过 OpenAI-Codex 路由 Codex OAuth 压缩。（#87383, #87403, #87375, #72574, #87428）感谢 @yetval。
- **代理/运行时**：避免会话事件队列自等待，限制压缩唤醒和转向重试，为挂起的错误诊断保留宽限，避免虚假的 Codex 运行时实时切换，避免重用陈旧的重启延续，保留会话回退错误，抑制重复的 Claude CLI 技能提示，在活动用户轮次前保留运行时上下文，剥离陈旧的 Anthropic 思考，隔离不支持的工具架构，安全恢复已完成的写入超时，在超时中止时释放保留的会话写入锁，并在固定前验证强制插件 harness 支持。（#86123, #55424, #86855, #74341, #87278）感谢 @luoyanglang, @cathrynlavery 和 @openperf。
- **回复/会话投递**：保持可见轮次准入无界，保持可见回退投递到最新目标，保留桥接钩子上下文，根据频道语法分类直接回退目标，在桥接模式下报告审批决议，避免陈旧的来源回复产物。（#87044）感谢 @keshavbotagent。
- **频道**：使 Telegram 的 `sendMessage` 操作回复持久化并保留 SecretRef 提示配置，抑制重复的 iMessage 原生执行审批提示和发送，在拒绝反应后保持 iMessage 审批轮询存活，在延迟清理期间保留 Slack 已投递的最终回复，保持 Matrix 提及预览/最终版提及无关并正常投递，忽略嵌入文件名的 Matrix ID，抑制从成功回复中恢复的 Discord 工具警告产物，在私聊中抑制 Google Chat 线程发送，并加强 Discord 公会请求者检查。（#87261, #87452）感谢 @mbelinky。
- **内存**：在非零退出后挽救 QMD 搜索 JSON，并在可能的情况下保持工作区内存通过 Codex 工具路径路由。（#87225, #87383, #87403）感谢 @osolmaz。
- **提供商/模型**：在兼容 OpenAI 的聊天补全中转发缓存令牌使用量，为 PI 认证配置文件加载 Claude CLI OAuth 覆盖，发送裸直接 Anthropic 模型 ID，接入配置的 VLLM 思考参数，尊重兼容 OpenAI 的缓存保留，标准化 OpenAI Responses 重播工具 ID，在没有缓存目录的情况下解析 OpenAI `gpt-5.5`，保留 `retry-after` 回退处理，限制 GitHub Copilot 认证请求，并一致地加载 DeepInfra 自定义/实时目录。（#82062, #87167, #84549）感谢 @caz0075, @joshavant 和 @ats3v。
- **网关/性能**：借用只读会话元数据和活动会话工作存储，缓存当前/稳定插件元数据指纹，缓存自动启用的插件配置，精简元数据身份缓存，信任当前元数据生命周期缓存，稳定隔离的 cron 提示缓存亲和性，持久化模型认证配置文件后缀，排空探测客户端关闭，在认证轮换后过期浏览器令牌，并保持默认状态快速路径有界。感谢 @ferminquant。
- **CLI/帮助/配置**：拒绝网关超时、模型限制、目录限制、消息选项、webhooks 和部分值的松散或格式错误的数字选项；尊重子命令版本选项；正确路由生成/根/插件帮助目标；保持技能 JSON 输出自然刷新；并在根帮助中保持插件描述符加载静默。（#87398）感谢 @Patrick-Erichsen。
- **插件状态/工具搜索**：当插件行达到上限时驱逐当前命名空间，重用未变化的工具搜索目录，对齐发布目录重用包装器，并保持回退工具警告提及无关。
- **安装/包/发布**：匹配 npm globstar 排除规则，在清单中尊重分发包排除，省略未打包的测试助手，跳过 Homebrew 直到 macOS 包需要它，打包 Docker 运行时工作区模板，在完整验证期间对 Docker 运行时模板进行冒烟测试，合并嵌套的缩包装覆盖引脚，保留分叉的缩包装引脚，固定老旧的 `lru-cache`，加强发布后验证，接受主分支完整验证证明，并拒绝空的 Beta 冒烟测试运行。
- **E2E/QA/Crabbox**：限制 Telegram、Open WebUI、ClawHub、Matrix、工具搜索、MCP、网关网络、捆绑运行时、厨房水槽、codex 媒体、配置重载和代理轮次断言等待；Windows 目标优先使用 Azure；重新初始化无效的 changed-gate git 目录；完全同步稀疏容器运行；并使空的显式测试请求失败。（#87186）
### 发布验证
- npm 包：https://www.npmjs.com/package/openclaw/v/2026.5.27
- 注册表压缩包：https://registry.npmjs.org/openclaw/-/openclaw-2026.5.27.tgz
- 完整性校验：`sha512-2N93zhdAo88KAbHt6T7KvYXf4s7XIkYXBgv1npYpn7e1Y9FvrtgtpsA38my9rtFW+70uXEojRPX5/OqnuDqJPw==`
- 完整发布 CI 报告：https://github.com/openclaw/releases/blob/main/evidence/2026.5.27/release-evidence.md
- 发布发布：https://github.com/openclaw/openclaw/actions/runs/26571393853
- npm 预检：https://github.com/openclaw/openclaw/actions/runs/26569630056
- 完整发布验证：https://github.com/openclaw/openclaw/actions/runs/26569544553
- 发布检查：https://github.com/openclaw/openclaw/actions/runs/26569853272
- 产品性能：https://github.com/openclaw/openclaw/actions/runs/26569541556
- 插件 npm 发布：https://github.com/openclaw/openclaw/actions/runs/26571646739
- 插件 ClawHub 发布：https://github.com/openclaw/openclaw/actions/runs/26571650967
- OpenClaw npm 发布：https://github.com/openclaw/openclaw/actions/runs/26572175549
- macOS 预检/签名/公证：https://github.com/openclaw/releases/actions/runs/26572630696
- macOS 验证：https://github.com/openclaw/releases/actions/runs/26573954998
- macOS 发布/应用广播：https://github.com/openclaw/releases/actions/runs/26574441406
- 应用广播：https://raw.githubusercontent.com/openclaw/openclaw/main/appcast.xml
- macOS zip：https://github.com/openclaw/openclaw/releases/download/v2026.5.27/OpenClaw-2026.5.27.zip
- macOS dmg：https://github.com/openclaw/openclaw/releases/download/v2026.5.27/OpenClaw-2026.5.27.dmg
- macOS dSYM：https://github.com/openclaw/openclaw/releases/download/v2026.5.27/OpenClaw-2026.5.27.dSYM.zip
### Highlights
- Stronger security and content boundaries: group prompt text is kept out of the system prompt, repeated-dot hostnames are normalized, side-effecting command wrappers and unsafe Node runtime env overrides are blocked, no-auth Tailscale exposure is rejected, and node/device-role approvals now require admin authority. (#87144, #87305, #87292, #87308, #87146) Thanks @eleqtrizit and @pgondhi987.
- More reliable Codex app-server runs: Codex runtime models resolve first, workspace memory is routed through tools, shared app-server clients survive startup and spawned-helper failures, native hook relay generations survive restarts and rotate on fresh fallbacks, and false runtime live switches are avoided. (#87383, #87403, #87375, #72574, #87428) Thanks @yetval.
- Faster Gateway and reply paths: session reads, plugin metadata fingerprints, auth env snapshots, auto-enabled plugin config, tool-search catalogs, and stable metadata caches do less hot-path rediscovery while visible replies no longer inherit hidden cleanup timeouts. (#86439, #87044) Thanks @keshavbotagent.
- Better provider and model coverage: OpenAI-compatible embedding providers are core, DeepInfra catalog browsing loads the full credential-aware model set, Pixverse adds video generation and API region selection, VLLM thinking params are wired, Claude CLI OAuth overlays load for PI auth profiles, and bare direct Anthropic model ids work. (#85269, #84549, #87167) Thanks @dutifulbob, @ats3v, and @joshavant.
- Channel delivery is steadier: Telegram `sendMessage` actions use durable outbound delivery, iMessage suppresses duplicate native exec approval prompts and sends, Slack keeps delivered final replies during late cleanup, Matrix mention previews/finals are stricter, QQBot fallback approval buttons honor slash-command auth, Discord guild requester checks are tighter, recovered Discord tool-warning artifacts stay out of successful replies, and Google Chat stops thread sends in DMs. (#87261, #87154) Thanks @mbelinky and @eleqtrizit.
- Release, package, and CI proof paths are harder to wedge: npm/package inventory honors dist exclusions, shrinkwrap override pins merge correctly, Docker runtime workspace templates are packaged and smoked, release postpublish checks are stricter, beta smoke rejects empty runs, and E2E log/probe waits are bounded.
### Changes
- Memory: add a core OpenAI-compatible embedding provider for local and hosted OpenAI-style endpoints, with config, doctor, and docs support. (#85269) Thanks @dutifulbob.
- Plugin SDK: mark memory-specific embedding provider registration as deprecated compatibility and surface non-bundled usage in plugin compatibility diagnostics. (#85072) Thanks @mbelinky.
- Providers: add the Pixverse video generation provider, API region selection, docs, and external plugin packaging support.
- DeepInfra: load the full model catalog when users browse models during onboarding, preserve configured API-key catalogs, refresh media/video defaults, and keep pricing/default model metadata aligned. (#84549) Thanks @ats3v.
- Plugin SDK: expose plugin approval action metadata and stop exporting Vitest test helpers from the public SDK surface. (#87120) Thanks @RomneyDa.
- Channel SDK: move channel message compatibility into core, remove old channel turn runtime aliases, and preserve runtime catalog markdown metadata for plugins.
- ClawHub: add plugin display metadata so catalog/package listings use cleaner names. (#87354) Thanks @thewilloftheshadow.
- Agents: split the heartbeat runtime template out of docs assets and add compatibility repair for legacy heartbeat template content. (#85416) Thanks @hxy91819.
### Fixes
- Security/content boundaries: route untrusted group prompt metadata outside system prompts, normalize repeated trailing hostname dots, block side-effecting command wrappers, reject unsafe Node runtime env overrides, reject no-auth Tailscale exposure, block untrusted Microsoft Teams service URLs, enforce `/allowlist configWrites` origin policy, gate QQBot fallback approval buttons, and require admin for node/device-role approvals. (#87144, #87305, #87292, #87308, #87146, #87154, #87334) Thanks @eleqtrizit and @pgondhi987.
- Codex: resolve Codex runtime models before generic routing, route workspace memory through tools, preserve shared app-server clients after startup and spawned-helper failures, preserve native hook relay generations across restarts and fresh fallbacks, keep raw reasoning/source-reply guards intact, report quarantined dynamic tools, keep the attempt watchdog armed for queued terminal turns, and route Codex OAuth compaction through OpenAI-Codex. (#87383, #87403, #87375, #72574, #87428) Thanks @yetval.
- Agents/runtime: avoid session event queue self-waits, bound compaction wake and steering retries, preserve grace for pending error diagnostics, avoid false Codex runtime live switches, avoid stale restart continuation reuse, preserve session fallback errors, suppress duplicate Claude CLI skill prompts, keep runtime context before active user turns, strip stale Anthropic thinking, quarantine unsupported tool schemas, recover completed write timeouts safely, release retained session write locks on timeout abort, and validate forced plugin harness support before pinning. (#86123, #55424, #86855, #74341, #87278) Thanks @luoyanglang, @cathrynlavery, and @openperf.
- Reply/session delivery: keep visible turn admission unbounded, keep visible fallback delivery on latest targets, preserve bridge hook context, classify direct fallback targets by channel grammar, report approval resolutions in bridge mode, and avoid stale source-reply artifacts. (#87044) Thanks @keshavbotagent.
- Channels: make Telegram `sendMessage` action replies durable and preserve SecretRef prompt config, suppress duplicate iMessage native exec approval prompts and sends, keep iMessage approval polling alive after denied reactions, keep Slack delivered final replies during late cleanup, keep Matrix mention previews/finals mention-inert and normally delivered, ignore filename-embedded Matrix IDs, suppress recovered Discord tool-warning artifacts from successful replies, suppress Google Chat thread sends in DMs, and harden Discord guild requester checks. (#87261, #87452) Thanks @mbelinky.
- Memory: salvage QMD search JSON after nonzero exits and keep workspace memory routing through the Codex tool path where possible. (#87225, #87383, #87403) Thanks @osolmaz.
- Providers/models: forward cached token usage in OpenAI-compatible chat completions, load Claude CLI OAuth overlays for PI auth profiles, send bare direct Anthropic model ids, wire configured VLLM thinking params, honor OpenAI-compatible cache retention, normalize OpenAI Responses replay tool ids, resolve OpenAI `gpt-5.5` without a cached catalog, preserve `retry-after` fallback handling, bound GitHub Copilot auth requests, and load DeepInfra custom/live catalogs consistently. (#82062, #87167, #84549) Thanks @caz0075, @joshavant, and @ats3v.
- Gateway/performance: borrow read-only session metadata and active session working stores, cache current/stable plugin metadata fingerprints, cache auto-enabled plugin config, slim metadata identity caches, trust current metadata lifecycle caches, stabilize isolated cron prompt-cache affinity, persist model auth profile suffixes, drain probe client closes, expire browser tokens after auth rotation, and keep default status fast paths bounded. Thanks @ferminquant.
- CLI/help/config: reject loose or malformed numeric options for gateway timeouts, model limits, directory limits, message options, webhooks, and partial values; respect subcommand version options; route generated/root/plugin help targets correctly; keep skills JSON output flushing naturally; and keep plugin descriptor loading quiet in root help. (#87398) Thanks @Patrick-Erichsen.
- Plugin state/tool search: evict the current namespace when plugin rows hit caps, reuse unchanged tool-search catalogs, align the release catalog reuse wrapper, and keep fallback tool warnings mention-inert.
- Install/package/release: match npm globstar exclusions, honor dist package exclusions in inventory, omit unpacked test helpers, skip Homebrew until macOS packages need it, package Docker runtime workspace templates, smoke Docker runtime templates during full validation, merge nested shrinkwrap override pins, preserve forked shrinkwrap pins, pin aged `lru-cache`, harden postpublish verification, accept main full-validation proof, and reject empty beta smoke runs.
- E2E/QA/Crabbox: bound Telegram, Open WebUI, ClawHub, Matrix, Tool Search, MCP, gateway network, bundled runtime, kitchen-sink, codex media, config reload, and agent-turn assertion waits; prefer Azure for Windows targets; reinitialize invalid changed-gate git dirs; full-sync sparse container runs; and fail empty explicit test requests. (#87186)
### Release verification
- npm package: https://www.npmjs.com/package/openclaw/v/2026.5.27
- registry tarball: https://registry.npmjs.org/openclaw/-/openclaw-2026.5.27.tgz
- integrity: `sha512-2N93zhdAo88KAbHt6T7KvYXf4s7XIkYXBgv1npYpn7e1Y9FvrtgtpsA38my9rtFW+70uXEojRPX5/OqnuDqJPw==`
- full release CI report: https://github.com/openclaw/releases/blob/main/evidence/2026.5.27/release-evidence.md
- release publish: https://github.com/openclaw/openclaw/actions/runs/26571393853
- npm preflight: https://github.com/openclaw/openclaw/actions/runs/26569630056
- full release validation: https://github.com/openclaw/openclaw/actions/runs/26569544553
- release checks: https://github.com/openclaw/openclaw/actions/runs/26569853272
- product performance: https://github.com/openclaw/openclaw/actions/runs/26569541556
- plugin npm publish: https://github.com/openclaw/openclaw/actions/runs/26571646739
- plugin ClawHub publish: https://github.com/openclaw/openclaw/actions/runs/26571650967
- OpenClaw npm publish: https://github.com/openclaw/openclaw/actions/runs/26572175549
- macOS preflight/sign/notarize: https://github.com/openclaw/releases/actions/runs/26572630696
- macOS validation: https://github.com/openclaw/releases/actions/runs/26573954998
- macOS publish/appcast: https://github.com/openclaw/releases/actions/runs/26574441406
- appcast: https://raw.githubusercontent.com/openclaw/openclaw/main/appcast.xml
- macOS zip: https://github.com/openclaw/openclaw/releases/download/v2026.5.27/OpenClaw-2026.5.27.zip
- macOS dmg: https://github.com/openclaw/openclaw/releases/download/v2026.5.27/OpenClaw-2026.5.27.dmg
- macOS dSYM: https://github.com/openclaw/openclaw/releases/download/v2026.5.27/OpenClaw-2026.5.27.dSYM.zip