### 亮点
- QQBot 现在在原生发送前会剥离模型推理/思考脚手架，防止原始的 `<thinking>` 内容泄露到频道回复中。（#89913, #90132）感谢 @openperf。
- MCP 工具结果现在会在物化边界强制转换 `resource_link`、`resource`、`audio`、格式错误的图像以及未来的非文本/图像块，防止工具返回更丰富的 MCP 内容后出现 Anthropic 400 错误和中毒的会话历史。（#90710, #90728）感谢 @RanSHammer 和 @849261680。
- Anthropic 扩展思考会话在提示缓存过期或网关重启后能够恢复，因为流启动事件会等待 `message_start`，让预生成签名错误触发现有的恢复重试。（#90667, #90697）感谢 @openperf。
- Parallel 现在是一个捆绑的 `web_search` 提供商，支持 `PARALLEL_API_KEY` 发现、有防护的端点处理、缓存安全的会话 ID、入门选择器支持以及文档。（#85158）感谢 @NormallyGaussian。
- Google Vertex ADC 用户再次获得静态目录行和运行时模型解析，同时单一提供商冷却恢复和内存适配器状态检查更加可靠。（#90506, #90609, #90717, #90816）感谢 @849261680。
- Matrix 可以在提及门控前预检语音笔记，通过 Matrix 关系分页保留线程读取/回复，并为语音和线程流程提供质量保证覆盖。（#78016, #90415）
- 身份验证和插件安装状态更加持久：身份验证配置文件现在存储在 SQLite 中，官方 npm 插件安装记录保留其受信任的固定版本，预发布回退完整性检查避免携带过时的完整性信息。（#89102, #88585）
- macOS 节点模式不再静默地从健康的直接网关会话自动重新连接，减少了意外的配套应用程序会话抖动。（#90668, #90815）感谢 @vrurg。
- 升级和服务路径更安全：cron 遗留 JSON 存储在 doctor 预检期间迁移，服务环境占位符不再掩盖状态目录秘密，WhatsApp 启动等待有界，禁用的 WhatsApp 账户在配置重新加载时拆除。（#90072, #90208, #90277, #90488, #90486, #87951, #87965）感谢 @MonkeyLeeT、@sallyom、@mcaxtr 和 @MukundaKatta。
### 变更
- 搜索/提供商：添加了 Parallel 捆绑的 web 搜索插件、实时提供商测试、注册合同、入门/文档接线以及有防护的 `api.parallel.ai/v1/search` 支持。（#85158）感谢 @NormallyGaussian。
- Matrix/频道：添加了语音消息预检和线程感知的读取/回复行为，包括 Matrix QA 场景接线和语音消息行为文档。（#78016, #90415）
- Skills/ClawHub：通过已解析的安装 API 安装由 GitHub 仓库支持的 ClawHub 技能，下载固定的 GitHub 提交，保持安装策略检查，并在成功后报告安装遥测。（#90478）感谢 @Patrick-Erichsen。
- Google Chat/频道：添加了原生审批卡片操作和点击处理，使 Google Chat 审批使用平台原生卡片而非通用消息流程。
- 移动端：Android 提供商/模型屏幕现在更清晰地显示过期、不可用、未解析和注意状态，而 iOS 设置和 Talk 标签页保持诊断、网关行、附件标签和不可用的 Talk 控件可访问。
- 内存：QMD 搜索可以使用新的重新排序切换，内存适配器状态在检查普通状态时使用已解析的默认模型标识。（#61834）
- 文档/工具：添加了 Parallel 搜索文档，更新了天气技能指南以使用 `web_fetch`，澄清了遗留的 `openai-codex` 身份验证，记录了发布/测试辅助脚本，并为 CI/调试工作收紧更改测试路由文档。（#90028, #90250）感谢 @fuller-stack-dev。
- 发布/流程：将发布列车切换为 `YYYY.M.PATCH` 月度补丁编号，保持过渡前标签兼容，并在已发布测试版后将 2026 年 6 月的最低版本固定为 `2026.6.5`。
- 平台维护：为此发布列车刷新了 Android、Swift/macOS、Docker、CodeQL、Buildx、Docker 构建/推送和 Codex 操作依赖。（#74980, #81757, #86481, #86483, #90601）
### 修复
- 频道内容边界：QQBot 现在在发送前剥离推理/思考标签，在向用户隐藏内部模型叙述的同时保留最终答案。（#89913, #90132）感谢 @openperf。
- 代理/MCP/提供商：在非文本/图像 MCP 工具结果块到达提供商转换器之前强制转换它们，保留有效图像并将更丰富的 MCP 内容转换为文本而非格式错误的图像块。（#90710, #90728）感谢 @RanSHammer 和 @849261680。
- Anthropic/Codex/ACP/代理恢复：将 Anthropic 流启动事件推迟到 `message_start`，在 Anthropic 重放前剥离过时的压缩思考签名，检测未签名的仅思考停滞，在压缩写入后刷新提示围栏，拒绝空的完成交接，保留父流覆盖/共享进度评论，将心跳元数据转发到上下文引擎钩子，并覆盖 Codex 会话/线程迁移边缘情况。（#90667, #90697, #90163, #90108, #89874, #89505, #90632, #89302, #90729, #90317, #90319）感谢 @openperf、@100yenadmin 和 @ooiuuii。
- 提供商/模型解析：在生成的目录中保留 Google Vertex ADC 身份验证标记，在冷却后重新探测单一提供商主节点，共享 Codex 模型可见性，对未知模型身份验证关闭失败，保留 Codex 别名可用性，保持未解析的配置文件引用未知，并在列出模型时避免解析身份验证。（#90506, #90609, #90717, #90702）感谢 @849261680。
- 网关/macOS/移动端：按身份避免重复的网关探测警告，在保留配对节点重新连接的同时限制节点配对请求速率，保持 macOS 节点模式在健康的直接网关会话上，保持 iOS 诊断和网关行可访问，并在 Android 构建期间避免 Linux ARM Gradle 资源任务。（#85791, #90147, #90668, #90815）感谢 @giodl73-repo 和 @vrurg。
- TUI/聊天/Workboard/自动回复：乐观用户消息在过时历史重新加载、runId 重新分配和中断窗口期间保持稳定，不会消失、跳动或作为幽灵行残留；Workboard 过时生命周期批量更新不再覆盖较新的状态/来源；消息工具发送现在算作投递。（#86205, #89600, #88592, #90123）感谢 @RomneyDa。
- Cron/更新/服务环境：doctor 配置预检现在在运行时读取前将遗留的 cron JSON 存储迁移到 SQLite，服务环境规划跳过会掩盖状态目录 `.env` 值的未解析占位符，会话转录重写保持注册表标记/判别符一致。（#90072, #90208, #90277, #90488）感谢 @MonkeyLeeT 和 @sallyom。
- 安全/配置/工具：防护 MCP HTTP 重定向，保护全局代理配置默认值，并使发布/测试/工具证明失败有界且明确。（#89732, #90145）
- 频道：WhatsApp 在每账户配置更改时重启，限制后台启动等待，关闭失败的套接字，并保持重新连接行为；Mattermost 斜杠命令将其状态保留在 `globalThis` 上；飞书流式卡片保留完整合并内容；语音通话在连接后跟踪 Twilio 流；ClickClack 回复工具尊重 `toolsAllow`。（#87951, #87965, #90486, #68113, #90534, #90181, #90607, #89500）感谢 @MukundaKatta、@mcaxtr、@infoanton、@mushuiyu886 和 @sahibzada-allahyar。
- 发布/CI/E2E：主 CI 守卫漂移、PR 合并差异范围、实时 Docker 凭据暂存、基础镜像资格、安装程序 Docker 分类、Playwright 依赖安装恢复、Codex 实时 Docker 通道的 API 密钥身份验证、Parallels 选项终止符和 JSON 模式进度处理更加严格，因此发布证明失败更清晰。（#90532, #90287, #90058）感谢 @RomneyDa、@hxy91819 和 @mrunalp。
- 测试/状态隔离：提供商、媒体、身份验证、cron、任务、会话、沙箱、网关和 Codex 超时装置现在每次测试限定更多 home/state/env 数据范围，减少跨测试泄漏，并使发布验证失败更少噪音。（#90027, #89974）
### 发布验证
- npm 包：https://www.npmjs.com/package/openclaw/v/2026.6.5-beta.2
- 注册表压缩包：https://registry.npmjs.org/openclaw/-/openclaw-2026.6.5-beta.2.tgz
- 完整性校验：`sha512-6Bmx2rlReO1MOEi9ehuhsVO59keQ1xQQ8/PvwbNq0CatJkNwyCX/MBlhWrscByYAmBl6JCOSr+cLejoDk1sDBA==`
- 完整发布 CI 报告：https://github.com/openclaw/releases/blob/main/evidence/2026.6.5-beta.2/release-evidence.md
- 发布发布：https://github.com/openclaw/openclaw/actions/runs/27077488131
- npm 预检：https://github.com/openclaw/openclaw/actions/runs/27076839788
- 完整发布验证：https://github.com/openclaw/openclaw/actions/runs/27076840299
- 插件 npm 发布：https://github.com/openclaw/openclaw/actions/runs/27077565695
- 插件 ClawHub 发布：单独分发，此证明不等待：https://github.com/openclaw/openclaw/actions/runs/27077567167
- OpenClaw npm 发布：https://github.com/openclaw/openclaw/actions/runs/27077747897
- npm Telegram 测试版 E2E：未提供
### Highlights
- QQBot now strips model reasoning/thinking scaffolding before native delivery, preventing raw `<thinking>` content from leaking into channel replies. (#89913, #90132) Thanks @openperf.
- MCP tool results now coerce `resource_link`, `resource`, `audio`, malformed image, and future non-text/image blocks at the materialize boundary, preventing Anthropic 400s and poisoned session history after a tool returns richer MCP content. (#90710, #90728) Thanks @RanSHammer and @849261680.
- Anthropic extended-thinking sessions recover after prompt-cache expiry or Gateway restart because stream start events wait for `message_start`, letting pre-generation signature errors trigger the existing recovery retry. (#90667, #90697) Thanks @openperf.
- Parallel is now a bundled `web_search` provider with `PARALLEL_API_KEY` discovery, guarded endpoint handling, cache-safe session ids, onboarding picker support, and docs. (#85158) Thanks @NormallyGaussian.
- Google Vertex ADC users get static catalog rows and runtime model resolution again, while single-provider cooldown recovery and memory adapter status checks are more reliable. (#90506, #90609, #90717, #90816) Thanks @849261680.
- Matrix can preflight voice notes before mention gating, preserve thread reads/replies through Matrix relations pagination, and carry QA coverage for voice and thread flows. (#78016, #90415)
- Auth and plugin install state is more durable: auth profiles now live in SQLite, official npm plugin install records keep their trusted pins, and prerelease fallback integrity checks avoid carrying stale integrity forward. (#89102, #88585)
- macOS node mode no longer silently self-reconnects away from a healthy direct Gateway session, reducing unexpected companion app session churn. (#90668, #90815) Thanks @vrurg.
- Upgrade and service paths are safer: cron legacy JSON stores migrate during doctor preflight, service env placeholders no longer mask state-dir secrets, WhatsApp startup waits are bounded, and disabled WhatsApp accounts tear down on config reload. (#90072, #90208, #90277, #90488, #90486, #87951, #87965) Thanks @MonkeyLeeT, @sallyom, @mcaxtr, and @MukundaKatta.
### Changes
- Search/providers: add the Parallel bundled web-search plugin, live provider tests, registration contracts, onboarding/docs wiring, and guarded `api.parallel.ai/v1/search` support. (#85158) Thanks @NormallyGaussian.
- Matrix/channels: add voice-message preflight and thread-aware read/reply behavior, including Matrix QA scenario wiring and docs for voice-message behavior. (#78016, #90415)
- Skills/ClawHub: install ClawHub skills backed by GitHub repositories through the resolved install API, download the pinned GitHub commit, keep install-policy checks, and report install telemetry after success. (#90478) Thanks @Patrick-Erichsen.
- Google Chat/channels: add native approval card actions and click handling so Google Chat approvals use platform-native cards instead of generic message flow.
- Mobile: Android provider/model screens now surface expiring, unavailable, unresolved, and attention states more clearly, while iOS settings and Talk tabs keep diagnostics, gateway rows, attachment labels, and unavailable Talk controls reachable.
- Memory: QMD search can use the new rerank toggle, and memory adapter status uses the resolved default model identity when checking plain status. (#61834)
- Docs/tooling: add Parallel search docs, refresh weather-skill guidance toward `web_fetch`, clarify legacy `openai-codex` auth, document release/test helper scripts, and tighten changed-test routing docs for CI/debugging work. (#90028, #90250) Thanks @fuller-stack-dev.
- Release/process: switch release trains to `YYYY.M.PATCH` monthly patch numbering, keep pre-transition tags compatible, and pin the June 2026 floor at `2026.6.5` after the published beta.
- Platform maintenance: refresh Android, Swift/macOS, Docker, CodeQL, Buildx, Docker build/push, and Codex Action dependencies for this release train. (#74980, #81757, #86481, #86483, #90601)
### Fixes
- Channel content boundaries: QQBot now strips reasoning/thinking tags before sending, preserving final answers while hiding internal model narration from users. (#89913, #90132) Thanks @openperf.
- Agents/MCP/providers: coerce non-text/image MCP tool-result blocks before they reach provider converters, preserving valid images and turning richer MCP content into text instead of malformed image blocks. (#90710, #90728) Thanks @RanSHammer and @849261680.
- Anthropic/Codex/ACP/agent recovery: defer Anthropic stream start events until `message_start`, strip stale compaction thinking signatures before Anthropic replay, detect unsigned thinking-only stalls, refresh prompt fences after compaction writes, reject empty completion handoffs, preserve parent streaming-off overrides/shared progress commentary, forward heartbeat metadata to context-engine hooks, and cover Codex session/thread migration edge cases. (#90667, #90697, #90163, #90108, #89874, #89505, #90632, #89302, #90729, #90317, #90319) Thanks @openperf, @100yenadmin, and @ooiuuii.
- Provider/model resolution: preserve Google Vertex ADC auth markers in generated catalogs, re-probe a single-provider primary after cooldown, share Codex model visibility, fail closed for unknown model auth, preserve Codex alias availability, keep unresolved profile refs unknown, and avoid resolving auth while listing models. (#90506, #90609, #90717, #90702) Thanks @849261680.
- Gateway/macOS/mobile: avoid duplicate Gateway probe warnings by identity, rate-limit node pairing requests while preserving paired-node reconnects, keep macOS node mode on a healthy direct Gateway session, keep iOS diagnostics and gateway rows reachable, and avoid Linux ARM Gradle resource tasks during Android builds. (#85791, #90147, #90668, #90815) Thanks @giodl73-repo and @vrurg.
- TUI/chat/Workboard/auto-reply: optimistic user messages stay stable across stale history reloads, runId reassignment, and abort windows instead of disappearing, jumping, or lingering as ghost rows; Workboard stale lifecycle bulk updates no longer overwrite newer status/provenance; message-tool sends now count as delivery. (#86205, #89600, #88592, #90123) Thanks @RomneyDa.
- Cron/update/service env: doctor config preflight now migrates legacy cron JSON stores into SQLite before runtime reads, service env planning skips unresolved placeholders that would mask state-dir `.env` values, and session transcript rewrites keep registry markers/discriminants consistent. (#90072, #90208, #90277, #90488) Thanks @MonkeyLeeT and @sallyom.
- Security/config/tooling: guard MCP HTTP redirects, protect global agent config defaults, and keep release/test/tooling proof failures bounded and explicit. (#89732, #90145)
- Channels: WhatsApp restarts when per-account config changes, bounds background startup waits, closes failed sockets, and preserves reconnect behavior; Mattermost slash commands keep their state on `globalThis`; Feishu streaming cards preserve full merged content; voice-call tracks Twilio streams after connect; ClickClack reply tools respect `toolsAllow`. (#87951, #87965, #90486, #68113, #90534, #90181, #90607, #89500) Thanks @MukundaKatta, @mcaxtr, @infoanton, @mushuiyu886, and @sahibzada-allahyar.
- Release/CI/E2E: main CI guard drift, PR merge diff scoping, live Docker credential staging, base-image qualification, installer Docker classification, Playwright dependency install recovery, API-key auth for Codex live Docker lanes, Parallels option terminators, and JSON-mode progress handling are tighter so release proof fails cleaner. (#90532, #90287, #90058) Thanks @RomneyDa, @hxy91819, and @mrunalp.
- Tests/state isolation: provider, media, auth, cron, task, session, sandbox, Gateway, and Codex timeout fixtures now scope more home/state/env data per test, reducing cross-test leakage and making release validation failures less noisy. (#90027, #89974)
### Release verification
- npm package: https://www.npmjs.com/package/openclaw/v/2026.6.5-beta.2
- registry tarball: https://registry.npmjs.org/openclaw/-/openclaw-2026.6.5-beta.2.tgz
- integrity: `sha512-6Bmx2rlReO1MOEi9ehuhsVO59keQ1xQQ8/PvwbNq0CatJkNwyCX/MBlhWrscByYAmBl6JCOSr+cLejoDk1sDBA==`
- full release CI report: https://github.com/openclaw/releases/blob/main/evidence/2026.6.5-beta.2/release-evidence.md
- release publish: https://github.com/openclaw/openclaw/actions/runs/27077488131
- npm preflight: https://github.com/openclaw/openclaw/actions/runs/27076839788
- full release validation: https://github.com/openclaw/openclaw/actions/runs/27076840299
- plugin npm publish: https://github.com/openclaw/openclaw/actions/runs/27077565695
- plugin ClawHub publish: dispatched separately, not awaited by this proof: https://github.com/openclaw/openclaw/actions/runs/27077567167
- OpenClaw npm publish: https://github.com/openclaw/openclaw/actions/runs/27077747897
- npm Telegram beta E2E: not supplied