### 亮点
- 安全边界在以下方面显著收紧：转录记录、沙箱绑定、主机环境继承、MCP stdio、Codex HTTP 访问、原生搜索策略、增强的发送者检查、已删除代理的 ACP 绕过、回环工具、Discord 审核以及 Teams 群组操作；执行审批现在超时时默认拒绝。（#91529、#91618、#91615、#91619、#91741、#91745、#91746、#91748、#91749、#91750、#91751、#91752、#91763、#89938）感谢 @joshavant、@pgondhi987、@mmaps、@eleqtrizit、@shakkernerd 和 @drobison00。
- Telegram 投递更加安全且连贯：按账户范围划分的主题会路由到正确的代理，流式文本在工具调用后仍能存活，`/compact` 命令适用于通用入口，回调处理使用具体 API，草稿分块逻辑共享，持久派发去重已移入 SDK，未经授权的私信文本不会进入缓存和提示上下文。（#91189、#88682、#89588、#90212、#91876、#91874、#91904、#91478、#91915）感谢 @codysai001、@alexzhu0、@joelnishanth、@snowzlm、@obviyus 和 @sallyom。
- iMessage 的恢复与投递现已覆盖：常开入站重启、持久回显标记、阻塞流式传输、空闲审批发现、强化出站传输以及可操作的入站启动诊断。（#91335、#91449、#88969、#88530、#91783、#91785）感谢 @omarshahine、@jmissig 和 @colmbrogan。
- 浏览器与 MCP 连接新增：现有会话的 CDP 支持、已发现的 WebSocket 验证、默认配置文件的 `cdpUrl` 处理、更安全的浏览器输出边界、可流式 HTTP 回环传输、修正的 OAuth/SSE 授权处理以及更广泛的架构兼容性。（#91422、#89851、#91736、#91747、#91451、#80143）感谢 @pgondhi987、@anagnorisis2peripeteia、@lifuyue、@eleqtrizit、@LiuwqGit 和 @HemantSudarshan。
- 控制界面的启动和首次回复延迟降低，方法包括：缓存模型元数据、移除启动时的目录等待、延迟加载斜杠命令、首次事件追踪以及慢回复诊断。（#91531、#91538、#91568、#91583、#91598）
- 提供商支持扩展：新增 OpenRouter OAuth 接入流程和 Claude Fable 5 自适应思考，同时 Codex 会话保持正确的压缩所有权、本地模型跳过守护者审查、动态工具进度正常清理、Gemma 4 推理回放得以保留。（#91830、#91882、#91590、#88630、#88768、#91696）感谢 @Patrick-Erichsen、@joshavant、@bdjben 和 @Coder-Wangyankun。
### 更改
- CLI 进度：发出 Claude CLI 注释进度事件，并将工具间注释桥接到频道进度中，而无需暴露内部协议脚手架。（#89834、#90883）感谢 @anagnorisis2peripeteia。
- 可观测性：允许受信任的诊断频道捕获工具输入/输出内容，添加首次助手事件追踪，并在初始回复较慢时发出警告。（#91256、#91568、#91583）感谢 @amknight。
- 插件/ClawHub：内部试用可复用包发布，允许试运行跳过发布审批，允许声明已安装的受信任钩子，报告托管插件的版本漂移，并对已废弃的 Skill Workshop 配置发出警告而非报错。（#91574、#91591、#90004、#90927、#90838）感谢 @Patrick-Erichsen、@brokemac79 和 @lonexreb。
- 内存/提供商：将本地 llama.cpp 运行时移至其提供商插件，跨文件批量处理嵌入，持久化代理模型目录缓存，并保持 QMD JSON 搜索为一次性操作，同时过滤过时的 REM 回忆预览。（#91324、#89138、#90457、#91837、#91851）感谢 @osolmaz、@mushuiyu886、@ai-hpc 和 @TurboTheTurtle。
- 频道/移动端：新增 QQBot 群组提及开关，改进 iPad 和 iPhone 控制界面，并在 TUI 底部栏中暴露活动连接主机。（#91423、#91557、#89909）感谢 @cxyhhhhh、@Solvely-Colin 和 @baskduf。
- 性能：预加载 TUI 运行时插件，去重插件自动启用扇出，停止 `/models` 派生注册表的重新扫描风暴，修剪密集的文本增量快照，并复用已准备的启动模型元数据。（#90782、#89978、#92127、#91580、#91531）感谢 @RomneyDa、@obuchowski 和 @ai-hpc。
### 修复
- 代理/会话恢复：在会话重新绑定后丢弃过时的审批后续操作，按身份删除已排空的回复队列项，恢复过时的主回复和可见回复，保留 Codex 上下文引擎的压缩所有权，通过 SDK 会话投射思维目录兼容性，在短限速窗口内重试同模型助手调用，将默认压缩超时设为 180 秒并尊重显式配置，保持提供商故障终端生命周期状态的正确性。（#85679、#91450、#91566、#91840、#91590、#91911、#91361、#91895）感谢 @openperf、@yetval、@joshavant、@lanzhi-lee、@wangmiao0668000666 和 @TurboTheTurtle。
- 用户可见内容边界：抑制 Codex/Harmony 协议制品，中和浏览器与 LanceDB 内存媒体指令，编辑转录图像中的内容，并在源抑制时保留原生 `/compact` 回复。（#89151、#91422、#91425、#91529、#90212）感谢 @joelnishanth、@pgondhi987、@joshavant 和 @snowzlm。
- 频道投递：重启后将 WhatsApp 捕获的回复附加到后续控制器，重试飞书限流，保留 Mattermost 线程回复，规范化 LINE webhook 路径，恢复 Discord 回复填充和运行时超时导出，并显示 OpenAI Realtime WebRTC 助手转录文本。（#85823、#89659、#91684、#91649、#90263、#91686、#90426）感谢 @itsuzef、@ladygege、@jacobtomlinson、@fuller-stack-dev 和 @shushushv。
- Cron：干净地取消正在运行的任务，保留终端超时/取消状态，并恢复未投递的工具警告而非静默丢失结果。（#90666、#90678）感谢 @ai-hpc。
- 网关/配置/认证：共享审批运行时套接字令牌，在 `config.patch` 中用数组显式替换，防止索引化的 `replacePaths` 同意从扩展到整个数组，拒绝格式错误的网关 RPC 超时输入，仅对有效的 ACP 挂具会话跳过已删除代理守卫，显示无头 LaunchAgent 状态，在清理前验证 SQLite 认证迁移，并执行 QMD 启动维护。（#87105、#91551、#91966、#54646、#40953、#91219、#91614、#91740、#91978）感谢 @fuller-stack-dev、@yetval、@ruanrrn、@comeran 和 @scotthuang。
- 提供商/Codex：澄清配额错误，恢复 Codex 合成用量行，规范 Codex 协议资产，要求实时语音使用 API 密钥认证，规范化 ACP 模型引用，保留 Gemma 4 的 `reasoning_content`，在 SDK 会话中尊重 Ollama 提供商声明的思考默认值，并避免对本地模型进行守护者审查。（#91390、#91709、#91507、#91567、#88630、#91657、#91696）感谢 @hxy91819、@brokemac79、@RomneyDa、@joshavant、@openperf 和 @Coder-Wangyankun。
- 更新/构建：在刷新失败后恢复包网关的重启，暴露插件收敛修复，在无 PATH 的 pnpm 环境中回退到 Corepack，植入正确的 Docker 存储包，保持 ClawHub 试运行和发布路径可复用，并将测试版 GitHub 发布页面保持为草稿，直到 OpenClaw npm、依赖证明、发布后验证以及必要插件发布全部通过。（#91581、#91599、#91547、#91591）感谢 @fuller-stack-dev、@sallyom 和 @Patrick-Erichsen。
- UI：在打开聊天会话前要求显式用户意图，并在会话切换后清空已恢复的聊天队列。（#91480）感谢 @TurboTheTurtle。
- Android：避免对持久节点使用 `dataSync` 前台服务类型。（#80082）感谢 @davelutztx。
- 原生钩子：限定中继生命周期，使废弃的原生钩子连接无法无限期存在。（#91550）感谢 @joshavant。
### 发布验证
- npm 包：https://www.npmjs.com/package/openclaw/v/2026.6.6
- 注册表 tarball：https://registry.npmjs.org/openclaw/-/openclaw-2026.6.6.tgz
- 完整性校验：`sha512-oMYoQ8a7zummw1tD+AX98yYLzqoq0tQmYWHG65AA0ZivgzmOb2oD0cVdhcWP9IT3opkHdJ5vBdWywUe6xWQXtw==`
- 发布 SHA：`8c802aa683510c7f7503597b54c3021733245e59`
- 完整发布 CI 报告：https://github.com/openclaw/releases/blob/main/evidence/2026.6.6/release-evidence.md
- 发布流程：https://github.com/openclaw/openclaw/actions/runs/27411250030
- npm 预检：https://github.com/openclaw/openclaw/actions/runs/27396521799
- 完整发布验证：https://github.com/openclaw/openclaw/actions/runs/27396520911
- 插件 npm 发布：https://github.com/openclaw/openclaw/actions/runs/27411419408
- 插件 ClawHub 发布：已单独派发，不被此证明等待：https://github.com/openclaw/openclaw/actions/runs/27411423316
- OpenClaw npm 发布：https://github.com/openclaw/openclaw/actions/runs/27411547994
- npm Telegram 测试版端到端：未提供
### Highlights
- Security boundaries are substantially tighter across transcripts, sandbox binds, host environment inheritance, MCP stdio, Codex HTTP access, native search policy, elevated sender checks, deleted-agent ACP bypasses, loopback tools, Discord moderation, and Teams group actions; exec approvals now fail closed on timeout. (#91529, #91618, #91615, #91619, #91741, #91745, #91746, #91748, #91749, #91750, #91751, #91752, #91763, #89938) Thanks @joshavant, @pgondhi987, @mmaps, @eleqtrizit, @shakkernerd, and @drobison00.
- Telegram delivery is safer and more coherent: account-scoped topics route to the right agent, streamed text survives tool calls, `/compact` works on generic ingress, callback handling uses concrete APIs, draft chunking is shared, durable dispatch dedupe moved into the SDK, and unauthorized DM text stays out of cache and prompt context. (#91189, #88682, #89588, #90212, #91876, #91874, #91904, #91478, #91915) Thanks @codysai001, @alexzhu0, @joelnishanth, @snowzlm, @obviyus, and @sallyom.
- iMessage recovery and delivery now cover always-on inbound restart, durable echo markers, block streaming, idle approval discovery, hardened outbound transport, and actionable inbound startup diagnostics. (#91335, #91449, #88969, #88530, #91783, #91785) Thanks @omarshahine, @jmissig, and @colmbrogan.
- Browser and MCP connectivity gained existing-session CDP support, discovered WebSocket validation, default-profile `cdpUrl` handling, safer browser-output boundaries, Streamable HTTP loopback transport, corrected OAuth/SSE authorization handling, and broader schema compatibility. (#91422, #89851, #91736, #91747, #91451, #80143) Thanks @pgondhi987, @anagnorisis2peripeteia, @lifuyue, @eleqtrizit, @LiuwqGit, and @HemantSudarshan.
- Control UI startup and first-reply latency are lower through cached model metadata, removal of the startup catalog wait, lazy slash-command loading, and first-event tracing with slow-reply diagnostics. (#91531, #91538, #91568, #91583, #91598)
- Provider support expands with OpenRouter OAuth onboarding and Claude Fable 5 adaptive thinking, while Codex sessions keep correct compaction ownership, local models skip guardian review, dynamic tool progress normalizes cleanly, and Gemma 4 reasoning replay is preserved. (#91830, #91882, #91590, #88630, #88768, #91696) Thanks @Patrick-Erichsen, @joshavant, @bdjben, and @Coder-Wangyankun.
### Changes
- CLI progress: emit Claude CLI commentary progress events and bridge inter-tool commentary into channel progress without exposing internal protocol scaffolding. (#89834, #90883) Thanks @anagnorisis2peripeteia.
- Observability: allow trusted diagnostics channels to capture tool input/output content, add first-assistant-event traces, and warn on slow initial replies. (#91256, #91568, #91583) Thanks @amknight.
- Plugins/ClawHub: dogfood reusable package publishing, let dry runs skip publish approval, allow declared installed trusted hooks, report managed plugin version drift, and warn instead of failing on retired Skill Workshop configuration. (#91574, #91591, #90004, #90927, #90838) Thanks @Patrick-Erichsen, @brokemac79, and @lonexreb.
- Memory/providers: move the local llama.cpp runtime into its provider plugin, batch embeddings across files, persist the agent model catalog cache, and keep QMD JSON search one-shot while filtering stale REM recall previews. (#91324, #89138, #90457, #91837, #91851) Thanks @osolmaz, @mushuiyu886, @ai-hpc, and @TurboTheTurtle.
- Channels/mobile: add the QQBot group mention toggle, improve iPad and iPhone control surfaces, and expose the active connection host in the TUI footer. (#91423, #91557, #89909) Thanks @cxyhhhhh, @Solvely-Colin, and @baskduf.
- Performance: prewarm TUI runtime plugins, deduplicate plugin auto-enable fanout, stop `/models` derived-registry rescan storms, trim dense text-delta snapshots, and reuse prepared startup model metadata. (#90782, #89978, #92127, #91580, #91531) Thanks @RomneyDa, @obuchowski, and @ai-hpc.
### Fixes
- Agent/session recovery: drop stale approval follow-ups after session rebind, remove drained reply-queue items by identity, recover stale main and visible replies, preserve Codex context-engine compaction ownership, project thinking catalog compatibility through SDK sessions, retry same-model assistant calls across short rate-limit windows, lower the default compaction timeout to 180 seconds while respecting explicit configuration, and keep provider-failure terminal lifecycle state correct. (#85679, #91450, #91566, #91840, #91590, #91911, #91361, #91895) Thanks @openperf, @yetval, @joshavant, @lanzhi-lee, @wangmiao0668000666, and @TurboTheTurtle.
- User-visible content boundaries: suppress Codex/Harmony protocol artifacts, neutralize browser and LanceDB memory media directives, redact transcript images, and preserve native `/compact` replies through source suppression. (#89151, #91422, #91425, #91529, #90212) Thanks @joelnishanth, @pgondhi987, @joshavant, and @snowzlm.
- Channel delivery: keep WhatsApp captured replies attached to the successor controller after restart, retry Feishu rate limits, preserve Mattermost thread replies, canonicalize LINE webhook paths, restore Discord reply hydration and runtime timeout exports, and show OpenAI Realtime WebRTC assistant transcripts. (#85823, #89659, #91684, #91649, #90263, #91686, #90426) Thanks @itsuzef, @ladygege, @jacobtomlinson, @fuller-stack-dev, and @shushushv.
- Cron: cancel active task runs cleanly, preserve terminal timeout/cancel state, and recover no-deliver tool warnings instead of silently losing the outcome. (#90666, #90678) Thanks @ai-hpc.
- Gateway/config/auth: share the approval runtime socket token, replace arrays explicitly in `config.patch`, keep indexed `replacePaths` consent from widening to whole arrays, reject malformed Gateway RPC timeout inputs, skip the deleted-agent guard only for valid ACP harness sessions, surface headless LaunchAgent state, verify SQLite auth migration before cleanup, and arm QMD startup maintenance. (#87105, #91551, #91966, #54646, #40953, #91219, #91614, #91740, #91978) Thanks @fuller-stack-dev, @yetval, @ruanrrn, @comeran, and @scotthuang.
- Providers/Codex: clarify quota errors, restore the Codex synthetic usage line, canonicalize Codex protocol assets, require API-key auth for realtime voice, normalize ACP model refs, preserve Gemma 4 `reasoning_content`, honor Ollama's provider-declared thinking default in SDK sessions, and avoid guardian review for local models. (#91390, #91709, #91507, #91567, #88630, #91657, #91696) Thanks @hxy91819, @brokemac79, @RomneyDa, @joshavant, @openperf, and @Coder-Wangyankun.
- Updates/builds: recover package Gateway restarts after refresh failure, expose plugin convergence repair, fall back to Corepack in PATH-less pnpm environments, seed the correct Docker store packages, keep ClawHub dry-run and publish paths reusable, and keep beta GitHub release pages draft until OpenClaw npm, dependency evidence, postpublish verification, and required plugin publishes pass. (#91581, #91599, #91547, #91591) Thanks @fuller-stack-dev, @sallyom, and @Patrick-Erichsen.
- UI: require explicit user intent before opening chat sessions and drain restored chat queues after session switches. (#91480) Thanks @TurboTheTurtle.
- Android: avoid the `dataSync` foreground-service type for persistent nodes. (#80082) Thanks @davelutztx.
- Native hooks: bound relay lifetimes so abandoned native hook connections cannot linger indefinitely. (#91550) Thanks @joshavant.
### Release verification
- npm package: https://www.npmjs.com/package/openclaw/v/2026.6.6
- registry tarball: https://registry.npmjs.org/openclaw/-/openclaw-2026.6.6.tgz
- integrity: `sha512-oMYoQ8a7zummw1tD+AX98yYLzqoq0tQmYWHG65AA0ZivgzmOb2oD0cVdhcWP9IT3opkHdJ5vBdWywUe6xWQXtw==`
- release SHA: `8c802aa683510c7f7503597b54c3021733245e59`
- full release CI report: https://github.com/openclaw/releases/blob/main/evidence/2026.6.6/release-evidence.md
- release publish: https://github.com/openclaw/openclaw/actions/runs/27411250030
- npm preflight: https://github.com/openclaw/openclaw/actions/runs/27396521799
- full release validation: https://github.com/openclaw/openclaw/actions/runs/27396520911
- plugin npm publish: https://github.com/openclaw/openclaw/actions/runs/27411419408
- plugin ClawHub publish: dispatched separately, not awaited by this proof: https://github.com/openclaw/openclaw/actions/runs/27411423316
- OpenClaw npm publish: https://github.com/openclaw/openclaw/actions/runs/27411547994
- npm Telegram beta E2E: not supplied