## 2026.6.6
### 亮点
- 转录、沙盒绑定、主机环境继承、MCP stdio、Codex HTTP 访问、原生搜索策略、提升的发件人检查、已删除代理的 ACP 绕过、环回工具、Discord 审核和 Teams 群组操作中的安全边界大幅收紧；执行审批现已在超时时默认拒绝。(#91529, #91618, #91615, #91619, #91741, #91745, #91746, #91748, #91749, #91750, #91751, #91752, #91763, #89938) 感谢 @joshavant, @pgondhi987, @mmaps, @eleqtrizit, @shakkernerd, 和 @drobison00。
- Telegram 投递更安全、更连贯：按账户作用域的话题将路由到正确的代理，流式文本在工具调用后仍能存活，`/compact` 在通用入口上正常工作，回调处理使用具体 API，草稿分块逻辑共享，持久化调度去重移至 SDK，未经授权的私信文本不出现在缓存和提示上下文中。(#91189, #88682, #89588, #90212, #91876, #91874, #91904, #91478, #91915) 感谢 @codysai001, @alexzhu0, @joelnishanth, @snowzlm, @obviyus, 和 @sallyom。
- iMessage 恢复和投递现已涵盖永久在线入站重启、持久化回显标记、块流式传输、空闲审批发现、加固的出站传输以及可操作的入站启动诊断。(#91335, #91449, #88969, #88530, #91783, #91785) 感谢 @omarshahine, @jmissig, 和 @colmbrogan。
- 浏览器和 MCP 连接获得了现有会话的 CDP 支持、已发现的 WebSocket 验证、默认配置文件的 `cdpUrl` 处理、更安全的浏览器输出边界、可流式 HTTP 环回传输、修正的 OAuth/SSE 授权处理以及更广泛的模式兼容性。(#91422, #89851, #91736, #91747, #91451, #80143) 感谢 @pgondhi987, @anagnorisis2peripeteia, @lifuyue, @eleqtrizit, @LiuwqGit, 和 @HemantSudarshan。
- 通过缓存模型元数据、移除启动目录等待、懒加载斜杠命令以及首次事件追踪与慢回复诊断，控制了 UI 启动和首次回复延迟。(#91531, #91538, #91568, #91583, #91598)
- 提供商支持扩展：新增 OpenRouter OAuth 注册和 Claude Fable 5 自适应思考功能；同时 Codex 会话保持正确的压缩所有权、本地模型跳过守护者审查、动态工具进度正常清理、Gemma 4 推理回放得以保留。(#91830, #91882, #91590, #88630, #88768, #91696) 感谢 @Patrick-Erichsen, @joshavant, @bdjben, 和 @Coder-Wangyankun。
### 变更
- CLI 进度：发出 Claude CLI 评论进度事件，并将工具间评论桥接到频道进度中，而不暴露内部协议框架。(#89834, #90883) 感谢 @anagnorisis2peripeteia。
- 可观测性：允许受信任的诊断频道捕获工具输入/输出内容，添加首次助手事件追踪，并对缓慢的初始回复发出警告。(#91256, #91568, #91583) 感谢 @amknight。
- 插件/ClawHub：内部使用可复用包的发布，允许空运行跳过发布审批，允许声明已安装的可信钩子，报告托管插件版本偏差，并对已废弃的 Skill Workshop 配置发出警告而非失败。(#91574, #91591, #90004, #90927, #90838) 感谢 @Patrick-Erichsen, @brokemac79, 和 @lonexreb。
- 记忆/提供商：将本地 llama.cpp 运行时移至其提供商插件中，跨文件批量嵌入，持久化代理模型目录缓存，保持 QMD JSON 搜索为一次性，并过滤过时的 REM 召回预览。(#91324, #89138, #90457, #91837, #91851) 感谢 @osolmaz, @mushuiyu886, @ai-hpc, 和 @TurboTheTurtle。
- 频道/移动端：新增 QQBot 群组提及开关，改进 iPad 和 iPhone 控制界面，并在 TUI 底部显示当前连接主机。(#91423, #91557, #89909) 感谢 @cxyhhhhh, @Solvely-Colin, 和 @baskduf。
- 性能：预热 TUI 运行时插件，去重插件自动启用的扇出，精简密集的文本增量快照，并复用已准备好的启动模型元数据。(#90782, #89978, #91580, #91531) 感谢 @RomneyDa 和 @ai-hpc。
### 修复
- 代理/会话恢复：在会话重新绑定后丢弃过时的审批后续操作，通过身份移除已排空的回复队列项，恢复过时的主回复和可见回复，保留 Codex 上下文引擎的压缩所有权，将默认压缩超时降至 180 秒同时尊重显式配置，并保持提供者故障的终端生命周期状态正确。(#85679, #91450, #91566, #91840, #91590, #91361, #91895) 感谢 @openperf, @yetval, @joshavant, @wangmiao0668000666, 和 @TurboTheTurtle。
- 用户可见内容边界：抑制 Codex/Harmony 协议产物，消除浏览器和 LanceDB 记忆媒体指令，对转录图像进行脱敏，并通过源抑制保留原生 `/compact` 回复。(#89151, #91422, #91425, #91529, #90212) 感谢 @joelnishanth, @pgondhi987, @joshavant, 和 @snowzlm。
- 频道投递：重启后让 WhatsApp 捕获的回复仍附加到后续控制器，重试飞书速率限制，保留 Mattermost 线程回复，规范化 LINE 的 Webhook 路径，恢复 Discord 回复补水和运行时超时导出，并显示 OpenAI Realtime WebRTC 助手转录。(#85823, #89659, #91684, #91649, #90263, #91686, #90426) 感谢 @itsuzef, @ladygege, @jacobtomlinson, @fuller-stack-dev, 和 @shushushv。
- Cron：干净地取消正在运行的任务，保留终端超时/取消状态，并恢复未送达的工具警告而非静默丢失结果。(#90666, #90678) 感谢 @ai-hpc。
- 网关/配置/认证：共享审批运行时套接字令牌，在 `config.patch` 中明确替换数组，仅对有效的 ACP 框架会话跳过已删除代理的防护，展示无头 LaunchAgent 状态，在清理前验证 SQLite 认证迁移，并启用 QMD 启动维护。(#87105, #91551, #91219, #91614, #91740, #91978) 感谢 @fuller-stack-dev 和 @scotthuang。
- 提供商/Codex：澄清配额错误，恢复 Codex 合成使用行，规范化 Codex 协议资产，要求实时语音使用 API 密钥认证，规范化 ACP 模型引用，保留 Gemma 4 的 `reasoning_content`，并避免本地模型经过守护者审查。(#91390, #91709, #91507, #91567, #88630, #91696) 感谢 @hxy91819, @brokemac79, @RomneyDa, @joshavant, 和 @Coder-Wangyankun。
- 更新/构建：在刷新失败后恢复包网关重启，暴露插件收敛修复，在无 PATH 的 pnpm 环境中回退至 Corepack，植入正确的 Docker 商店包，并保持 ClawHub 空运行和发布路径可复用。(#91581, #91599, #91547, #91591) 感谢 @fuller-stack-dev, @sallyom, 和 @Patrick-Erichsen。
- UI：需要明确的用户意图才能打开聊天会话，并在会话切换后排空恢复的聊天队列。(#91480) 感谢 @TurboTheTurtle。
- Android：避免对持久节点使用 `dataSync` 前台服务类型。(#80082) 感谢 @davelutztx。
- 原生钩子：限制中继生命周期，防止废弃的原生钩子连接无限期存活。(#91550) 感谢 @joshavant。
## 2026.6.6
### Highlights
- Security boundaries are substantially tighter across transcripts, sandbox binds, host environment inheritance, MCP stdio, Codex HTTP access, native search policy, elevated sender checks, deleted-agent ACP bypasses, loopback tools, Discord moderation, and Teams group actions; exec approvals now fail closed on timeout. (#91529, #91618, #91615, #91619, #91741, #91745, #91746, #91748, #91749, #91750, #91751, #91752, #91763, #89938) Thanks @joshavant, @pgondhi987, @mmaps, @eleqtrizit, @shakkernerd, and @drobison00.
- Telegram delivery is safer and more coherent: account-scoped topics route to the right agent, streamed text survives tool calls, `/compact` works on generic ingress, callback handling uses concrete APIs, draft chunking is shared, durable dispatch dedupe moved into the SDK, and unauthorized DM text stays out of cache and prompt context. (#91189, #88682, #89588, #90212, #91876, #91874, #91904, #91478, #91915) Thanks @codysai001, @alexzhu0, @joelnishanth, @snowzlm, @obviyus, and @sallyom.
- iMessage recovery and delivery now cover always-on inbound restart, durable echo markers, block streaming, idle approval discovery, hardened outbound transport, and actionable inbound startup diagnostics. (#91335, #91449, #88969, #88530, #91783, #91785) Thanks @omarshahine, @jmissig, and @colmbrogan.
- Browser and MCP connectivity gained existing-session CDP support, discovered WebSocket validation, default-profile `cdpUrl` handling, safer browser-output boundaries, Streamable HTTP loopback transport, corrected OAuth/SSE authorization handling, and broader schema compatibility. (#91422, #89851, #91736, #91747, #91451, #80143) Thanks @pgondhi987, @anagnorisis2peripeteia, @lifuyue, @eleqtrizit, @LiuwqGit, and @HemantSudarshan.
- Control UI startup and first-reply latency are lower through cached model metadata, removal of the startup catalog wait, lazy slash-command loading, and first-event tracing with slow-reply diagnostics. (#91531, #91538, #91568, #91583, #91598)
- Provider support expands with OpenRouter OAuth onboarding and Claude Fable 5 adaptive thinking, while Codex sessions keep correct compaction ownership, local models skip guardian review, dynamic tool progress normalizes cleanly, and Gemma 4 reasoning replay is preserved. (#91830, #91882, #91590, #88630, #88768, #91696) Thanks @Patrick-Erichsen, @joshavant, @bdjben, and @Coder-Wangyankun.
### Changes
- CLI progress: emit Claude CLI commentary progress events and bridge inter-tool commentary into channel progress without exposing internal protocol scaffolding. (#89834, #90883) Thanks @anagnorisis2peripeteia.
- Observability: allow trusted diagnostics channels to capture tool input/output content, add first-assistant-event traces, and warn on slow initial replies. (#91256, #91568, #91583) Thanks @amknight.
- Plugins/ClawHub: dogfood reusable package publishing, let dry runs skip publish approval, allow declared installed trusted hooks, report managed plugin version drift, and warn instead of failing on retired Skill Workshop configuration. (#91574, #91591, #90004, #90927, #90838) Thanks @Patrick-Erichsen, @brokemac79, and @lonexreb.
- Memory/providers: move the local llama.cpp runtime into its provider plugin, batch embeddings across files, persist the agent model catalog cache, and keep QMD JSON search one-shot while filtering stale REM recall previews. (#91324, #89138, #90457, #91837, #91851) Thanks @osolmaz, @mushuiyu886, @ai-hpc, and @TurboTheTurtle.
- Channels/mobile: add the QQBot group mention toggle, improve iPad and iPhone control surfaces, and expose the active connection host in the TUI footer. (#91423, #91557, #89909) Thanks @cxyhhhhh, @Solvely-Colin, and @baskduf.
- Performance: prewarm TUI runtime plugins, deduplicate plugin auto-enable fanout, trim dense text-delta snapshots, and reuse prepared startup model metadata. (#90782, #89978, #91580, #91531) Thanks @RomneyDa and @ai-hpc.
### Fixes
- Agent/session recovery: drop stale approval follow-ups after session rebind, remove drained reply-queue items by identity, recover stale main and visible replies, preserve Codex context-engine compaction ownership, lower the default compaction timeout to 180 seconds while respecting explicit configuration, and keep provider-failure terminal lifecycle state correct. (#85679, #91450, #91566, #91840, #91590, #91361, #91895) Thanks @openperf, @yetval, @joshavant, @wangmiao0668000666, and @TurboTheTurtle.
- User-visible content boundaries: suppress Codex/Harmony protocol artifacts, neutralize browser and LanceDB memory media directives, redact transcript images, and preserve native `/compact` replies through source suppression. (#89151, #91422, #91425, #91529, #90212) Thanks @joelnishanth, @pgondhi987, @joshavant, and @snowzlm.
- Channel delivery: keep WhatsApp captured replies attached to the successor controller after restart, retry Feishu rate limits, preserve Mattermost thread replies, canonicalize LINE webhook paths, restore Discord reply hydration and runtime timeout exports, and show OpenAI Realtime WebRTC assistant transcripts. (#85823, #89659, #91684, #91649, #90263, #91686, #90426) Thanks @itsuzef, @ladygege, @jacobtomlinson, @fuller-stack-dev, and @shushushv.
- Cron: cancel active task runs cleanly, preserve terminal timeout/cancel state, and recover no-deliver tool warnings instead of silently losing the outcome. (#90666, #90678) Thanks @ai-hpc.
- Gateway/config/auth: share the approval runtime socket token, replace arrays explicitly in `config.patch`, skip the deleted-agent guard only for valid ACP harness sessions, surface headless LaunchAgent state, verify SQLite auth migration before cleanup, and arm QMD startup maintenance. (#87105, #91551, #91219, #91614, #91740, #91978) Thanks @fuller-stack-dev and @scotthuang.
- Providers/Codex: clarify quota errors, restore the Codex synthetic usage line, canonicalize Codex protocol assets, require API-key auth for realtime voice, normalize ACP model refs, preserve Gemma 4 `reasoning_content`, and avoid guardian review for local models. (#91390, #91709, #91507, #91567, #88630, #91696) Thanks @hxy91819, @brokemac79, @RomneyDa, @joshavant, and @Coder-Wangyankun.
- Updates/builds: recover package Gateway restarts after refresh failure, expose plugin convergence repair, fall back to Corepack in PATH-less pnpm environments, seed the correct Docker store packages, and keep ClawHub dry-run and publish paths reusable. (#91581, #91599, #91547, #91591) Thanks @fuller-stack-dev, @sallyom, and @Patrick-Erichsen.
- UI: require explicit user intent before opening chat sessions and drain restored chat queues after session switches. (#91480) Thanks @TurboTheTurtle.
- Android: avoid the `dataSync` foreground-service type for persistent nodes. (#80082) Thanks @davelutztx.
- Native hooks: bound relay lifetimes so abandoned native hook connections cannot linger indefinitely. (#91550) Thanks @joshavant.