OpenClaw v2026.6.9

### Highlights - **Richer Telegram delivery:** Telegram now sends rich HTML, preserves rich markdown and sticker paths, renders progress drafts and command output more faithfully, normalizes HTML tables safely, and keeps mentions and spooled handlers on the right delivery path. (#93286, #93164, #93124, #93364, #93130, #93088, #93281, #94891, #94856) Thanks @obviyus, @vincentkoc, @goutamadwant, @kesslerio, @NianJiuZst, @SweetSophia, @Marvinthebored, @aaajiao, @zhangqueping, and @jairrab. - **More dependable agent recovery:** retries, terminal outcomes, usage after compaction, session history repair, and reply reconciliation now keep more interrupted or partial turns moving toward a visible final result. (#92191, #93073, #93228, #93084, #93469, #93291, #90943) Thanks @ai-hpc, @lml2468, @fuller-stack-dev, @Hollychou924, @leno23, @de1tydev, @425072024, @wuwahe3, @drvoss, @yetval, @sandieman2, and @vincentkoc. - **A stronger Codex integration:** Codex gains automatic plugin approvals, GPT-5.3 Spark OAuth routing, remote-node `exec` as a dynamic tool, and more reliable app-server teardown and terminal outcomes. (#92625, #89133, #93654, #91767, #93287) Thanks @kevinslin, @VACInc, @vincentkoc, @JPKay-AI, and @aliahnaf2013-max. - **Standalone official provider plugins:** external provider packages are now first-class npm releases, externally installed channel plugins load at Gateway startup, and StepFun is available from npm and ClawHub. (#93470) Thanks @sunlit-deng, @cxdnicole, and @vincentkoc. - **More capable web and native clients:** the Control UI adds a session workspace rail and extension health, iOS adds Watch controls, and Android shows chat context. (#92856, #91952, #93387, #92837) Thanks @Solvely-Colin, @jalehman, @joshavant, and @Tosko4. - **More useful search and skills:** Codex Hosted Search is available, key-free search providers remain deliberate opt-ins, and ClawHub skill installs retain verified source provenance. (#93446, #93616, #93283, #93506) Thanks @fuller-stack-dev, @davemorin, @momothemage, @nmccready-tars, and @vincentkoc. ### Changes - Providers and auth: add Codex Hosted Search, improve Gemini CLI OAuth behind proxies, and keep external provider onboarding on current choices and package metadata. (#93446, #92815) Thanks @fuller-stack-dev, @yetval, @EvetteYoung, and @vincentkoc. - Plugins and installs: externalized official providers publish as independent npm packages, Gateway discovers installed channel plugins at startup, and StepFun installs from npm or ClawHub. (#93470) Thanks @sunlit-deng, @cxdnicole, and @vincentkoc. - Dashboard and mobile: add a session workspace rail, plugin health in status, compact cron lists, and iOS Watch controls. (#92856, #91952, #93395, #93387) Thanks @Solvely-Colin, @jalehman, @yu-xin-c, @centralpc, @joshavant, and @vincentkoc. - Codex, observability, and skills: add automatic plugin approvals and SecretRefs, preserve ClawHub skill provenance, add OpenTelemetry log export, and expose remote-node execution to Codex when a node is connected. (#92625, #94324, #93283, #94561, #93654) Thanks @kevinslin, @kevinlin-openai, @momothemage, @nmccready-tars, @jesse-merhi, @vincentkoc, and @JPKay-AI. - QA and release engineering: QA scenarios now use YAML, with broader profile evidence and release coverage for the plugin and channel matrix. Thanks @vincentkoc. ### Fixes - Security and privacy: redact secrets from debug/config output, block internal HTTP session overrides, audit open-DM tool exposure, and retain plugin write ownership checks. (#93333, #88496, #93443, #92883, #93353) Thanks @Alix-007, @jason-allen-oneal, @coygeek, @RichardCao, @yu-xin-c, @cjg20ss, @eleqtrizit, and @vincentkoc. - Agent and session runtime: retry thinking-only and empty post-tool turns, prevent duplicate hook execution, preserve pending subagent delivery, preserve fresh usage through compaction, and repair partial JSON/history artifacts. (#92191, #93073, #93009, #93084, #93469, #94349, #92383, #94257) Thanks @ai-hpc, @lml2468, @fuller-stack-dev, @zenglingbiao, @dertbv, @Hollychou924, @leno23, @de1tydev, @425072024, @wuwahe3, @drvoss, @vincentkoc, @sallyom, @oiGaDio, @Hidetsugu55, and @Nas01010101. - Channels and replies: fix Telegram rich delivery, table rendering, action-error handling, and ingress recovery; preserve command progress detail across channel adapters; retain WhatsApp opening text after a media failure; keep Mattermost thread replies intact; and harden Discord action handling. (#93286, #93364, #93281, #93076, #93334, #93424, #93488, #94868, #94891, #94856, #94810, #93823) Thanks @obviyus, @NianJiuZst, @mcaxtr, @rushindrasinha, @amknight, @lzyyzznl, @darealgege, @vincentkoc, @zhangqueping, @jairrab, @ZOOWH, @parveshsaini, and @yetval. - Storage and migrations: avoid SQLite WAL on network filesystems, clean reindex artifacts, keep setup state out of workspace dot-directories, and import default-agent auth profiles into SQLite. (#93454, #92891, #93182, #93295, #93520, #93156) Thanks @vincentkoc, @ZengWen-DT, @Zeng-wen, @potterdigital, @Alix-007, @Pick-cat, @sallyom, @1qh, and @Tazio7. - Provider and model behavior: fix Gemini CLI proxy OAuth, restore Codex Spark OAuth routing, correct Bedrock embedding model IDs, and preserve configured defaults in embedded runs. (#92815, #89133, #93452, #93428) Thanks @yetval, @EvetteYoung, @VACInc, @LiuwqGit, @aleck31, @zenglingbiao, @danielgerlag, and @vincentkoc. - CLI, TUI, and apps: accept global flags after subcommands, keep terminal output and activity indicators visible, preserve CJK IME composition, and refresh stale UI state. (#93455, #93460, #93006, #93427, #93498, #93606) Thanks @ooiuuii, @Alix-007, @ZengWen-DT, @Zeng-wen, @AlethiaQuizForge, @Zhaoqj2016, @liuhao1024, @BrianClaw1955, @vincentkoc, and @NicoBoom13. - Operations and updates: harden official plugin recovery, restart managed Gateways after failed update handoff, keep safe cron delivery defaults, avoid Node-specific npm prefixes, and keep package validation paths reliable. (#93325, #92111, #93650, #94453, #91685) Thanks @vincentkoc, @yetval, @ofan, @yaanfpv, @jincheng-xydt, @sallyom, @davectr, and @nxmxbbd. ### Complete contribution record This audited record covers the complete v2026.6.8..HEAD history: 422 merged PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact. #### Pull requests - **PR #90463** refactor: add session accessor seam with gateway consumer. Thanks @jalehman. - **PR #88656** Drop reasoning-only length turns from replay. Thanks @abel-zer0. - **PR #92856** feat(webui): add session workspace rail. Thanks @Solvely-Colin. - **PR #92845** docs(browser-control): document OPENCLAW_EAGER_BROWSER_CONTROL_SERVER requirement. Related #92841. Thanks @liuhao1024 and @jeugregg. - **PR #82366** fix: use passive periodic sqlite wal checkpoints. Related #81715. Thanks @honor2030 and @KrasimirKralev. - **PR #92815** fix(google): route Gemini CLI OAuth through the env proxy (#46184). Thanks @yetval and @EvetteYoung. - **PR #91331** fix(mattermost): merge progress preview lines by identity. Related #89761. Thanks @iloveleon19 and @leonthe8th and @vincentkoc. - **PR #92909** fix(tui): keep spinner active when toggling tools. Related #49763. Thanks @ZengWen-DT and @Zeng-wen and @vincentkoc and @CrimsonDump. - **PR #92904** fix(elevenlabs): use current TTS model ids. Thanks @vortexopenclaw and @vincentkoc. - **PR #92642** fix #86872: Subagent run reports success but fails to write output file. Thanks @zhangguiping-xydt and @vincentkoc and @zapper35. - **PR #89122** refactor: route command session reads through seam. Thanks @jalehman. - **PR #90943** fix(reply): deliver final reply when queued follow-up claims session; scope dedupe to routed thread. Thanks @sandieman2 and @vincentkoc. - **PR #92894** fix(skills): keep managed prompt paths readable. Related #92875. Thanks @kesslerio and @sallyom. - **PR #39617** fix: reload config in slash command routing so dmScope is respected. Related #39605. Thanks @Ciward. - **PR #92191** fix(agents): retry thinking-only errored turns. Related #91953. Thanks @ai-hpc and @lml2468. - **PR #92891** fix(memory): clean stale reindex temp files. Related #92874. Thanks @ZengWen-DT and @Zeng-wen and @vincentkoc and @potterdigital. - **PR #93005** Add OpenRouter Fusion guidance and prompt context. Related #92984. Thanks @sallyom. - **PR #88792** fix(state): harden sqlite path caching. Thanks @vincentkoc. - **PR #93022** fix(gateway): repair usage cost aggregation across agents. Thanks @luke-skywalker-open-claw and @stablegenius49. - **PR #93020** fix(telegram): cool down transient sendChatAction failures. Related #56096. Thanks @Boulea7 and @sumaiazaman and @Pick-cat and @cal-rufus. - **PR #89160** fix(agents): detect truncated API responses to prevent silent session hang. Related #89051. Thanks @joelnishanth and @ArthurusDent. - **PR #93009** fix(agents): make wrapToolWithBeforeToolCallHook idempotent to prevent double hook execution (fixes #92973). Thanks @zenglingbiao and @dertbv. - **PR #92991** fix(agents): tolerate missing attribution baseUrl. Related #92974. Thanks @samrusani and @Haderach-Ram. - **PR #92913** fix(opencode-go): register model catalog to fix context window detection. Related #92912. Thanks @kumaxs. - **PR #89129** refactor: route bundled plugin session callers through seam. Thanks @jalehman. - **PR #93084** fix(agents): preserve fresh usage after compaction. Related #50795. Thanks @Hollychou924 and @leno23 and @de1tydev and @425072024 and @vincentkoc and @wuwahe3. - **PR #92869** fix #90333: [Bug]: Discord image build aborts at step 66 — openclaw-build-messaging-plugins.py exits 1. Thanks @zhangguiping-xydt and @vincentkoc and @chriskosys. - **PR #93011** fix(gateway): accept file-only input on /v1/responses (parity with image-only). Thanks @yetval and @vincentkoc. - **PR #92915** Convert QA scenarios to YAML files. Thanks @RomneyDa. - **PR #91767** Fix one-shot Codex app-server teardown. Thanks @aliahnaf2013-max. - **PR #92625** feat(codex): add auto plugin approvals. Thanks @kevinslin. - **PR #91587** test(qa): add qa run --qa-profile and unified output summary/evidence. Thanks @RomneyDa. - **PR #93104** test(reply): seed channel fixtures for dedupe tests. Thanks @RomneyDa. - **PR #93107** test(reply): preserve telegram dedupe fallback. Thanks @RomneyDa. - **PR #92954** fix(memory): accept local default model path migration. Thanks @mushuiyu886 and @vincentkoc. - **PR #90936** fix(agents): do not misclassify client-disconnect abort as run timeout. Related #90764. Thanks @openperf and @reginaldomarcilon. - **PR #90812** fix(voice-call): preserve live Twilio streams in stale reaper. Related #79121. Thanks @Takhoffman and @sahibzada-allahyar and @donkeykong91. - **PR #93094** fix(whatsapp): bound socket operations. Thanks @mcaxtr. - **PR #91629** fix(scripts): add database-first legacy store guard. Related #91628. Thanks @galiniliev. - **PR #93124** fix(telegram): render progress drafts as rich previews. Thanks @Marvinthebored. - **PR #93109** test(qa): embed profile scorecard evidence. Thanks @RomneyDa. - **PR #87298** test: add temp directory helper guidance. Thanks @hxy91819. - **PR #92318** fix(cron): require explicit message target proof. Thanks @hxy91819. - **PR #93137** fix(imessage): honor disabled reply actions. Related #92142. Thanks @omarshahine and @dprev. - **PR #93134** fix(feishu): pass card_msg_content_type to get full card content (fixes #78289). Thanks @liuhao1024 and @vincentkoc and @longdoubled7. - **PR #93138** fix(agents): preserve literal current session resolution. Thanks @liuhao1024 and @vincentkoc. - **PR #91225** fix #83830: [Bug]: Dreaming diary repeats "first day" narrative every sweep — same early memories dominate snippets. Thanks @mushuiyu886 and @YinLiuLiu66. - **PR #93153** simplify QA evidence profile and mappings/coverage shape. Thanks @RomneyDa. - **PR #93164** fix(telegram): preserve rich markdown line breaks. Thanks @vincentkoc. - **PR #93119** fix: accept mixed source/dist bundled roots. Related #87730. Thanks @arkyu2077 and @vincentkoc and @jasonftl. - **PR #93130** fix(telegram): preserve sticker media paths. Related #83748. Thanks @goutamadwant and @vincentkoc and @aaajiao. - **PR #93073** fix(agents): retry empty post-tool final turns. Thanks @fuller-stack-dev. - **PR #91784** fix(voice-call): require realtime websocket path boundary. Thanks @jason-allen-oneal. - **PR #89133** Restore GPT-5.3 Codex Spark OAuth routing. Thanks @VACInc. - **PR #91996** refactor: prune unused iOS code. Thanks @zats. - **PR #90231** fix #69443: [Bug] Subagent RPC callback to WeChat session key routed to main session instead. Thanks @zhangguiping-xydt and @sliverp and @chen11221. - **PR #89920** fix(matrix): replace recovered command progress lines. Thanks @bdjben and @jesse-merhi. - **PR #93159** fix(tui): keep parent stdin paused after exit. Thanks @fuller-stack-dev. - **PR #93201** fix(auto-reply): clear pending-final state before honoring post-send abort (#89115). Thanks @amknight and @danashburn. - **PR #93228** fix(agents): replace prose terminal classifiers. Thanks @fuller-stack-dev. - **PR #93231** fix(status): correct pinned model clear hint. Thanks @hxy91819. - **PR #92428** fix(qqbot): keep markdown table chunks valid. Thanks @sliverp. - **PR #93220** fix(status): avoid stale session context windows. Thanks @hxy91819. - **PR #91957** perf(sessions): share one enumeration across archive retention sweeps. Thanks @amknight. - **PR #93281** fix(telegram): recover pid-reused ingress claims. Thanks @obviyus. - **PR #93287** fix(codex): preserve terminal outcome ordering. - **PR #93182** fix(memory): clean rollback-journal reindex temp sidecar on NFS stores. Thanks @Alix-007. - **PR #93283** Persist ClawHub skill install provenance. Related #92077. Thanks @momothemage and @nmccready-tars. - **PR #88872** fix: attribute spawned task runs to child agent. Related #66670. Thanks @Alix-007 and @Neomail2. - **PR #92837** fix(android): show live chat context usage. Thanks @Tosko4. - **PR #93325** fix(cli): harden official plugin recovery. Thanks @vincentkoc. - **PR #93286** feat(telegram): send rich messages as rich html. Thanks @obviyus. - **PR #92910** fix(memory-core): safely refresh qmd index during collection repair. - **PR #93329** fix(cli): allow zero Discord timeout duration. Related #93327. Thanks @rohitjavvadi. - **PR #91625** fix(cron): add cron edit --clear-model to clear a job's model override. Thanks @ly-wang19. - **PR #91691** [AI] fix(memory): prevent empty-string expectedModel in resolveMemory…. Thanks @xydt-tanshanshan. - **PR #93006** fix(tui): keep stderr visible when local shell stdout fills the output cap. Thanks @Alix-007. - **PR #93001** fix(daemon): prefer stderr over stale stdout in gateway restart diagnostics. Thanks @Alix-007. - **PR #91117** refactor: remove dead code and improve string concatenation. Thanks @Pommelle. - **PR #90893** fix(models): mask paste-token input in CLI auth prompt. Thanks @anurag-bg-neu. - **PR #90571** fix(configure): mask gateway password input in CLI wizard prompt. Thanks @anurag-bg-neu. - **PR #91768** fix(ios): respect chat header safe area. Thanks @zats. - **PR #93245** fix(cron): resolve lastRunStatus in cron list/show human output. Thanks @ly-wang19. - **PR #78765** fix(tui): avoid inserting spaces into long CJK text. Thanks @hpt. - **PR #91776** fix(ios): refresh permission rows after grants. Thanks @zats. - **PR #92817** fix(cron): trust agent output when channel is unresolved without explicit delivery. Related #90664. Thanks @fsdwen and @dertbv. - **PR #93297** fix(control-ui): respect agents.defaults.timeFormat for timestamps. Related #58147. Thanks @ZengWen-DT and @Zeng-wen and @TommoT2. - **PR #93364** Fix Telegram rich progress command output. Thanks @obviyus. - **PR #91952** feat(status): surface plugin health. Thanks @jalehman. - **PR #75025** fix(heartbeat): refresh stale Current time line on every helper call (#44993). Thanks @MoerAI and @mclee1975. - **PR #90992** docs(windows): fix WSL gateway-autostart recipe for WSL ≥ 2.6.1.0 idle-termination. Thanks @spencer2211. - **PR #86544** fix(cli): show Gemini CLI runtime auth status. Related #79585. Thanks @giodl73-repo and @fabricefoy. - **PR #88945** fix(plugins): serialize binding approval saves. Related #64065. Thanks @Alix-007 and @lihaokun. - **PR #90115** fix(gateway): pass managed inbound PDFs through chat.send. Related #90097. Thanks @harjothkhara and @joeykrug. - **PR #74613** docs(cli): add agent selector to CLI backend quick start. Related #68940. Thanks @vyctorbrzezowski and @drmarcopapa. - **PR #89121** refactor: add transcript reader seam. Thanks @jalehman. - **PR #84434** fix(cli): disable ScheduleWakeup/CronCreate in --print claude runs. Thanks @SkyWolfDreamer. - **PR #66985** fix(agents): resolve requestedNode to canonical ID before boundNode comparison. Related #87213. Thanks @mujiannan. - **PR #91488** fix(reply): project preflight compaction gate by next-input size on fresh tokens. Thanks @yetval. - **PR #93353** fix(plugins): require owner for plugin writes. Thanks @eleqtrizit. - **PR #91499** fix(cron): preserve scheduled turn tool policy [AI]. Thanks @mmaps. - **PR #90412** fix(sessions): cache warm transcript reads to avoid per-turn re-parse. Related #83943. Thanks @Alix-007 and @yyds-xxxx. - **PR #93118** fix(gateway): guard fast-path startup migrations. Related #93032. Thanks @openperf and @Haderach-Ram. - **PR #93355** fix(ci): verify performance workflow downloads. Thanks @eleqtrizit. - **PR #93358** fix(outbound): guard cross-context message mutations. Thanks @eleqtrizit. - **PR #93362** fix(flock): bind allow-always to wrapped command. Thanks @eleqtrizit. - **PR #92578** refactor(whatsapp): add inbound admission foundation. Thanks @mcaxtr. - **PR #89547** Control Telegram group history context. Thanks @mmaps. - **PR #89201** refactor: add transcript runtime identity contract. Thanks @jalehman. - **PR #93357** fix(plugins): enforce install policy in wrappers. Thanks @eleqtrizit. - **PR #93156** fix(doctor): import default-agent auth profiles into sqlite. Related #93145. Thanks @Pick-cat and @sallyom and @Tazio7. - **PR #93179** Add slim evidence mode for QA profile evidence. Thanks @RomneyDa. - **PR #93349** fix(control-ui): keep workboard card titles visible in overflowing columns (fixes #91717). Thanks @Pick-cat and @NicoBoom13. - **PR #93324** fix(cli): accept --no-color after subcommands. Thanks @ooiuuii. - **PR #89621** Return Google Chat thread metadata from message sends. Thanks @franco-viotti. - **PR #82458** fix(infra): drop duplicated "restart" word in restart-sentinel summary. Thanks @jameswniu. - **PR #85471** Suppress cron announce control replies. Related #85421. Thanks @TurboTheTurtle and @leatherneck-33. - **PR #85316** fix(auth): keep alias-compatible auth-profile overrides instead of clearing them. Thanks @SkyWolfDreamer. - **PR #89260** fix(doctor): separate platform-incompatible skills from missing requirements. Related #89232. Thanks @Alix-007 and @CameronWeller. - **PR #90846** fix(media): stop pruning media on write; let the configured timer do it. Thanks @lundog. - **PR #88062** fix(logging): avoid stalled warnings for active model calls. Thanks @litang9. - **PR #93308** fix(discord): reject malformed realtime consult calls. Thanks @khoek. - **PR #93334** fix(whatsapp): notify user when trailing media send fails instead of silent drop. Thanks @rushindrasinha. - **PR #92575** fix(sessions): preserve user behavior overrides across daily/idle rollover (#92562) [AI-assisted]. Thanks @harjothkhara and @civiltox. - **PR #89124** refactor: route auto-reply sessions through session seam. Thanks @jalehman. - **PR #93431** fix: stabilize transcript cache and CLI env isolation. Thanks @shakkernerd. - **PR #93412** fix(discord): suppress tool progress for message-tool replies. Thanks @mgunnin and @vincentkoc. - **PR #93409** fix(whatsapp): stop markdownToWhatsApp dropping code spans followed by a digit. Thanks @rushindrasinha. - **PR #93295** fix(memory): swap rollback-journal sidecar during atomic reindex. Thanks @Alix-007. - **PR #93076** fix(whatsapp): preserve auth on terminal disconnects. Thanks @mcaxtr. - **PR #93435** fix(agents): bound autoreview scope. Thanks @vincentkoc. - **PR #93279** fix(telegram): restore readable default text sends. Related #93263. Thanks @NianJiuZst and @SweetSophia. - **PR #93429** fix(line): cap carousel column text at 60 chars when a title or image is set. Thanks @harjothkhara and @vincentkoc. - **PR #93428** fix(agents): resolve configured default model in runEmbeddedAgent (fixes #93419). Thanks @zenglingbiao and @vincentkoc and @danielgerlag. - **PR #93427** fix(tui): show activity indicator for system-injected runs. Related #51825. Thanks @ZengWen-DT and @vincentkoc and @Zeng-wen and @AlethiaQuizForge. - **PR #90003** feat(policy): cover exec approvals artifact. Thanks @giodl73-repo. - **PR #93448** fix(guards): allow auth profile sqlite reader. Thanks @amknight. - **PR #93424** fix(mattermost): keep message tool replies in threads. Thanks @amknight and @vincentkoc. - **PR #93418** fix(telegram): forward Bot API 10.1 rich_message content to agent. Related #93410. Thanks @xzh-icenter and @vincentkoc and @0pen7ech. - **PR #93175** test(qa): taxonomy profiles: includeAllCategories for release profile, update some coverage. Thanks @RomneyDa. - **PR #93456** fix(agents): handle string assistant message content. Thanks @vincentkoc. - **PR #93441** fix(outbound): ignore schema-padded poll metadata on send. Related #43015. Thanks @weichengdeng and @charzhou. - **PR #93443** fix(gateway): block internal HTTP session overrides. Thanks @RichardCao. - **PR #93454** fix(sqlite): disable WAL on network filesystems. Thanks @vincentkoc. - **PR #90275** test: make install-safe-path symlink tests compatible with Windows. Thanks @aniruddhaadak80. - **PR #93464** fix(qa): suppress empty WhatsApp debug artifacts. Thanks @vincentkoc. - **PR #90861** fix(cli): preserve sessions_yield over MCP. Related #77426. Thanks @zhangguiping-xydt and @jarvisagimuspicard-hub. - **PR #90946** fix(infra): preserve inherited gateway PID across reparent during cleanup. Thanks @amittell. - **PR #92220** fix(media): extract large managed inbound PDFs via media-understanding. Related #90096, #90097. Thanks @amknight and @joeykrug. - **PR #91208** fix #91047: Plugin session-extension registry not pinned; sessions.pluginPatch fails after agent/subagent plugin-load churn. Thanks @mushuiyu886 and @teamadams. - **PR #92111** fix(update): restart managed gateway when update handoff fails after stop. Related #92088. Thanks @yetval and @ofan. - **PR #93238** fix(agents): honor disabled envelope timestamps at model boundary. Thanks @osolmaz. - **PR #93343** fix(codex): de-duplicate commentary notes across the raw response lane. Related #93296. Thanks @Marvinthebored and @Peetiegonzalez. - **PR #93361** fix(openshell): pin mirror remote mutations. Thanks @eleqtrizit. - **PR #93354** fix(discord): block cross-provider guild admin actions. Thanks @eleqtrizit. - **PR #92178** fix(gateway): normalize malformed paired access lists. Related #90654. Thanks @wangmiao0668000666 and @EmilioNicolas. - **PR #85254** perf(plugins): thread prepared manifestPlugins through runtime model-id normalize chain. Thanks @zeroaltitude. - **PR #93489** Add ClawHub content rights docs to sidebar. Thanks @Patrick-Erichsen. - **PR #93466** [AI] fix(feishu): guard against missing inbound in channelRuntime fallback. Thanks @xydt-tanshanshan. - **PR #93460** fix(cli): honor --log-level in route-first commands. Related #93457. Thanks @ooiuuii. - **PR #93495** fix(cron): clear delivery routing fields from cron edit. Thanks @ly-wang19 and @vincentkoc. - **PR #93494** docs: point PR landing at maintainer workflow. Thanks @fuller-stack-dev and @vincentkoc. - **PR #93487** fix(ui): add agent selector to skills page. Related #78553. Thanks @goutamadwant and @vincentkoc and @xiaobu1112. - **PR #93488** fix(discord): apply tool status emojis immediately to avoid override by thinking reactions. Related #92715. Thanks @lzyyzznl and @vincentkoc and @darealgege. - **PR #93055** fix(ui): restore provider usage pill in desktop chat composer [AI]. Thanks @harjothkhara. - **PR #83156** fix(matrix): accept bracketed display-name mentions. Related #83142. Thanks @wdx-agent-io and @wdongxv. - **PR #93333** fix(auto-reply): redact secrets in /debug show and /debug set output. Thanks @Alix-007. - **PR #88496** fix(auto-reply): redact secrets in config show output. Related #65623. Thanks @jason-allen-oneal and @coygeek. - **PR #93105** fix(doctor): repair null agents.list[].workspace values. Related #77718. Thanks @xydigit-sj and @slideshow-dingo. - **PR #73923** fix(ui): preserve gateway token during safe websocket url edits. Related #41545. Thanks @wsyjh8. - **PR #88970** fix #85871: [Bug]: Heartbeat scheduler silently fails to fire on 5.20 and all 5.x versions (regression from 4.23). Thanks @zhangguiping-xydt and @vincentkoc and @carlbjson. - **PR #93511** fix(imessage): normalize leading NUL echo-cache prefixes. Thanks @vincentkoc and @drvoss. - **PR #92594** [Bug]: ollama-cloud runtime fails DNS lookup for ai.ollama.com, while ollama/<model>:cloud works. Related #92391. Thanks @zhangguiping-xydt and @vincentkoc and @kvzsolt. - **PR #93512** build(docs): finish PowerShell-safe docs formatting. Related #44293. Thanks @vincentkoc and @yil337 and @aniruddhaadak80. - **PR #93513** fix(skills): refresh persisted snapshots after restart. Thanks @vincentkoc and @fif911 and @skadauke. - **PR #93517** fix(skills): quote skill-creator template description. Thanks @vincentkoc and @parubets. - **PR #73976** fix(memory): use per-keyword FTS search in hybrid mode #39484. Thanks @joshuakeithpa-sudo. - **PR #93520** fix(workspace): store setup state outside workspace dot-dir. Thanks @vincentkoc and @1qh. - **PR #93521** fix(onboard): skip Homebrew prompt on unsupported platforms. Related #68893. Thanks @vincentkoc and @yurivict. - **PR #93522** fix(feishu): send post mentions as native at elements. Thanks @vincentkoc and @gavin-ali and @YizukiAme and @Panniantong. - **PR #93496** fix(gateway): rotate already-stale generated transcript filename on /reset. Thanks @harjothkhara and @vincentkoc. - **PR #93471** fix(cron): preserve aborted isolated-run failure. Thanks @BhargavSatya and @vincentkoc. - **PR #93473** fix(memory): report skipped QMD embedding probe. Related #77645. Thanks @TurboTheTurtle and @vincentkoc and @aderius. - **PR #93498** fix(ui): preserve CJK IME composition. Related #86035. Thanks @Zhaoqj2016 and @vincentkoc. - **PR #93088** fix(telegram): bind bot mentions to assistant identity. Thanks @kesslerio and @vincentkoc. - **PR #93499** fix(nodes): return screen snapshots as media. Related #90126. Thanks @zenglingbiao and @vincentkoc and @JeffSteinbok. - **PR #93506** fix(skills): trust verified ClawHub source provenance. Thanks @vincentkoc. - **PR #93525** agents: notify chat exec empty-success completions. Thanks @vincentkoc and @wenkang-xie. - **PR #93446** feat: add Codex hosted web search. Thanks @fuller-stack-dev. - **PR #92883** fix(security): audit open dm tool exposure. Related #55612. Thanks @yu-xin-c and @vincentkoc and @cjg20ss. - **PR #93476** fix(mattermost): preserve Codex progress preview. Related #88766. Thanks @goutamadwant and @vincentkoc and @KelTech-Services. - **PR #93395** feat(cron): add compact list responses. Related #93366. Thanks @yu-xin-c and @vincentkoc and @centralpc. - **PR #93527** fix(cron): preserve model overrides for text payloads. Thanks @vincentkoc and @liaoandi. - **PR #90487** fix: harden ChatGPT Responses missing content-type streams. Thanks @anyech and @vincentkoc. - **PR #93528** fix(gateway): tolerate transient pre-hello clean closes. Thanks @vincentkoc and @ruanrrn. - **PR #93529** fix(auto-reply): allow message tool for group attachments. Related #43146. Thanks @vincentkoc and @Robcis. - **PR #93291** fix(reply): preserve pending thread evidence when reconciling partial send results. Thanks @yetval and @vincentkoc. - **PR #90572** fix(feishu): drop self-authored receive echoes. Thanks @baskduf. - **PR #93455** fix(cli): accept --log-level after subcommands. Thanks @ooiuuii and @vincentkoc. - **PR #93452** fix(bedrock): strip inference profile prefix from model ID in embedding adapter. Related #79212. Thanks @LiuwqGit and @vincentkoc and @aleck31. - **PR #89799** fix(cli): skip compile cache on early Node 24.x to avoid startup deadlock. Related #86550. Thanks @zhangguiping-xydt and @vincentkoc and @renyuliang000. - **PR #93469** fix(agents): drop partialJson streaming artifacts from session history repair. Thanks @drvoss and @vincentkoc. - **PR #93463** fix(codex): log app-server compaction completion. Related #83932. Thanks @goutamadwant and @vincentkoc and @aounakram. - **PR #93562** fix(tui): refresh after external session reset. Related #38966. Thanks @vincentkoc and @wsyjh8 and @yizhanzjz. - **PR #93470** fix(plugins): load externally-installed channel plugins at gateway startup. Related #93219. Thanks @sunlit-deng and @vincentkoc and @cxdnicole. - **PR #88796** fix(discord): resolve guildId from session channel for search actions. Related #88790. Thanks @SebTardif and @vincentkoc and @mugabuga. - **PR #93194** fix(agents): preserve prompt-released session metadata. Related #93193. Thanks @snowzlm. - **PR #89483** fix(gateway): project failed agent turns in chat history. Related #89197. Thanks @IWhatsskill and @vincentkoc and @yangiit. - **PR #93434** fix: avoid parent group allowlist false positive. Related #92684. Thanks @kingrubic and @vincentkoc and @motteman. - **PR #93449** fix(feishu): dedupe redelivered text by stable retry identity. Related #46778. Thanks @ZengWen-DT and @vincentkoc and @kingcuty. - **PR #93407** AGT-80 AGT-81 Fix Discord ingress ack ordering. Thanks @mgunnin and @vincentkoc. - **PR #93439** fix(agents): honor embedded run default model. Related #93419. Thanks @harjothkhara and @vincentkoc and @danielgerlag. - **PR #93565** fix(cli): summarize cleanup dry-run by label. Related #76826. Thanks @AgentArcLab and @vincentkoc and @renatomaluhy. - **PR #93509** fix(skills): clear orphaned idempotency pointer on corrupt-metadata re-begin. Thanks @Alix-007 and @vincentkoc. - **PR #93274** Clarify plugin channel config additional-property errors. Thanks @zhangguiping-xydt and @vincentkoc. - **PR #93555** fix(read): route text decoding through shared Windows codepage fallba…. Thanks @zhanxingxin1998 and @vincentkoc. - **PR #93314** fix(skills): preserve ClawHub origin provenance on readback. Thanks @Alix-007 and @vincentkoc. - **PR #93573** fix(acp): keep bridge sessions out of stale ACP classification [AI-assisted]. Related #38907. Thanks @eldar702 and @vincentkoc and @ninaopenclaw. - **PR #93398** fix(cron): emit isolated model usage diagnostics. Related #92338. Thanks @849261680 and @vincentkoc and @niks999. - **PR #93367** Fix SSH sandbox remote directory args. Related #93344. Thanks @dmorn and @vincentkoc. - **PR #93574** fix(feishu): suppress log noise for bot_p2p_chat_entered_v1 event [AI-assisted]. Related #42351. Thanks @eldar702 and @vincentkoc and @sunking0223. - **PR #93269** Fix tokenjuice bash results without details. Thanks @moeedahmed and @vincentkoc. - **PR #93575** fix(telegram): hydrate group reply-chain media into model context [AI-assisted]. Thanks @eldar702 and @vincentkoc. - **PR #93261** fix(plugins): resolve provider policy surface for plugin-owned CLI backends. Related #93259. Thanks @BitmapAsset and @vincentkoc. - **PR #93303** fix(whatsapp): bound stalled read-receipt socket operations. Thanks @Alix-007 and @vincentkoc. - **PR #93242** fix(mattermost): keep bare @mention with empty body instead of dropping it. Related #93205. Thanks @iloveleon19 and @vincentkoc. - **PR #93606** fix(ui): clear stale Talk error when session transitions to non-error state (fixes #88176). Thanks @liuhao1024 and @vincentkoc and @BrianClaw1955. - **PR #93607** perf(tasks): memoize reconcileInspectableTasks for same-tick calls (fixes #73531). Thanks @liuhao1024 and @vincentkoc and @slideshow-dingo. - **PR #93612** fix(gateway): compute sessions.usage aggregate totals from all sessions, not just the limited page (fixes #76496). Thanks @liuhao1024 and @vincentkoc and @bobsahur-robot. - **PR #93615** fix(telegram): recover lone active spooled handler on timeout (#84158). Thanks @0xghost42 and @vincentkoc and @crash2kx. - **PR #93616** Keep key-free web search providers opt-in. Thanks @davemorin and @vincentkoc. - **PR #93298** fix #93044: control-ui webchat double-renders agent replies when dmScope=main. Thanks @zhangguiping-xydt and @vincentkoc and @cfmilam. - **PR #93618** fix(feishu): filter temporary card-action-c-\* IDs from reply target to prevent Invalid open_message_id errors (fixes #56818). Thanks @liuhao1024 and @vincentkoc and @SwordImmortal. - **PR #93387** feat(ios): add watch action surface. Thanks @Solvely-Colin and @joshavant. - **PR #93648** fix(doctor): archive superseded plugin install index conflicts. Related #90418. Thanks @vincentkoc and @ramitrkar-hash. - **PR #93649** fix(qwen): place DashScope image prompts in user content. Related #92688. Thanks @vincentkoc and @Yachiyo404. - **PR #93650** fix(update): avoid per-Node npm prefixes during self-update. Related #80387. Thanks @vincentkoc and @yaanfpv. - **PR #93653** fix(skill-workshop): skip helper sessions during auto-capture. Thanks @vincentkoc and @zhangguiping-xydt. - **PR #93654** fix(codex): expose remote node exec as a Codex dynamic tool. Related #92141. Thanks @vincentkoc and @JPKay-AI. - **PR #93662** fix(discord): protect mention aliases in code fences. Thanks @vincentkoc and @rohitjavvadi. - **PR #93663** fix(clawdock): open dashboard on published port without starting deps. Related #77344. Thanks @vincentkoc and @dhoman. - **PR #93670** fix(browser): recover stale managed Chrome CDP listener. Related #41750. Thanks @vincentkoc and @rohitjavvadi and @kissman911. - **PR #93672** fix(commands): preserve multiline slash skill args. Related #79155. Thanks @vincentkoc and @web3blind. - **PR #93674** fix(browser): accept top-level act fields with nested requests. Related #38762. Thanks @vincentkoc and @angelusbr and @Lumos-789. - **PR #93678** fix(plugins): allow Dreaming sidecar through restrictive memory allowlists. Related #92536. Thanks @vincentkoc and @pradeep7127 and @resYuto. - **PR #93306** fix(status): ignore stale context after model switch. Thanks @hxy91819. - **PR #93666** fix(control-ui): copy code blocks over plain HTTP via clipboard fallback. Related #93628. Thanks @Pick-cat and @pjq2926. - **PR #93629** fix(reply): preserve unsent text-only finals after block pipeline streamed partial content (fixes #81078). Thanks @liuhao1024 and @Jackten. - **PR #93690** fix(telegram): dispatch MEDIA directives as attachments. Related #77702. Thanks @vincentkoc and @butttersbot. - **PR #93693** fix(gateway): ignore stale sudo scope for root user services. Related #81410. Thanks @vincentkoc and @Ericksza. - **PR #93646** fix(agents): return string assistant content in getLastAssistantText. Thanks @Alix-007 and @vincentkoc. - **PR #93687** fix(i18n): retain Codex error tails in logs. Thanks @hxy91819. - **PR #93630** fix(heartbeat): bootstrap plugin session targets. Thanks @ZengWen-DT and @vincentkoc. - **PR #93658** fix(wizard): preserve existing default model during setup auth choice [AI-assisted]. Related #64129. Thanks @ml12580 and @vegapunk9527. - **PR #93671** fix(respawn): rewrite pnpm versioned entry paths to stable wrapper (fixes #52313). Thanks @liuhao1024 and @vincentkoc and @RichardCao. - **PR #93698** Fix Telegram rich progress detail updates. Thanks @obviyus. - **PR #93656** fix(gateway): send approval route notices with write scope. Related #93563. Thanks @mushuiyu886 and @vincentkoc and @clawbot247-commits. - **PR #93665** fix(gateway): surface codex app-server returned failures. Thanks @litang9 and @vincentkoc. - **PR #93727** fix(context-engine): avoid turn-maintenance lane livelock. Related #77340. Thanks @vincentkoc and @baghvn and @Veda-openclaw. - **PR #93681** fix(llm): handle string assistant content on the OpenAI-compatible completion path. Thanks @Alix-007. - **PR #93722** chore(release): update appcast for 2026.6.8. Thanks @vincentkoc. - **PR #93677** fix(google-meet): declare realtime provider secret inputs. Related #81891. Thanks @goutamadwant and @vincentkoc and @chachi-max. - **PR #92947** fix(qqbot): deliver cron auto-TTS voice by trusting OpenClaw temp root. Related #92816. Thanks @ZengWen-DT and @Zeng-wen and @lewiswu1209. - **PR #93679** fix(whatsapp): extract GIF metadata and distinguish gifPlayback in media placeholders (fixes #49099). Thanks @liuhao1024 and @vincentkoc and @bugkill3r. - **PR #93688** fix(minimax): check base_resp envelope errors in TTS provider. Related #76904. Thanks @dwc1997 and @najef1979-code. - **PR #93714** fix: isolate async model resolution mock from sync mock in flaky test. Related #92117. Thanks @lsr911 and @wangwllu. - **PR #93705** test(macos): cover root command dispatch. Related #83879. Thanks @markoub and @vincentkoc and @davinci282828. - **PR #93711** Keep command text in progress drafts. Thanks @keshavbotagent and @vincentkoc. - **PR #93712** fix: scope assistant avatar override to agent ID. Related #90890. Thanks @lsr911 and @vincentkoc and @najef1979-code. - **PR #93725** fix(usage): prune stale usage cache temp files. Related #78939. Thanks @markoub and @Tramsrepus. - **PR #93726** fix(typing): start typing on reasoning deltas in thinking mode before visible text. Related #79681. Thanks @xialonglee and @novaflash82. - **PR #93716** fix(discord): propagate timeout through channel capabilities diagnostics. Related #77040. Thanks @xialonglee and @vincentkoc and @unicebondoc. - **PR #93729** fix(ollama): preserve configured API during discovery. Related #93710. Thanks @zhangguiping-xydt and @vincentkoc and @obnoxious2011-cmd. - **PR #93719** fix: pin plugin workspace dir for sessions.list to avoid O(rows) memo busting. Related #90814. Thanks @lsr911 and @vincentkoc and @k-l-lambda. - **PR #93732** fix(agents): preserve re-sent user prompt during compaction transcript rotation. Thanks @yetval. - **PR #93738** fix: break plugin registry type import cycle. Thanks @giodl73-repo. - **PR #93740** fix(sessions): release retained locks after takeover. Thanks @TurboTheTurtle. - **PR #93745** fix(usage): reject invalid explicit dates in usage RPC date parsing. Thanks @harjothkhara and @vincentkoc. - **PR #93746** fix(ui): populate realtime talk provider and transport options from talk.catalog. Thanks @shushushv and @vincentkoc. - **PR #93751** fix(ios): fix quick setup sheet layout design. Thanks @zats. - **PR #93749** fix(compaction): ignore stale persisted totalTokens in preflight gate. Thanks @yetval. - **PR #93753** fix: correct tautological uppercase check in tool description summarizer. Thanks @GautamKumarOffical. - **PR #89123** refactor: route transcript writers through session seam. Thanks @jalehman. - **PR #93758** feat(memory): apply outputDimensionality truncation to local GGUF embeddings (fixes #58765). Thanks @liuhao1024 and @vincentkoc and @losz5000. - **PR #93754** feat(inbound-meta): expose per-turn source modality. Related #50482. Thanks @liuhao1024 and @vincentkoc and @JTOrca. - **PR #93767** fix(reasoning-tags): strip MiniMax `mm:` namespaced reasoning tags. Thanks @DrHack1 and @vincentkoc. - **PR #93772** fix(feishu): recover CJK filenames from JSON file_name field (fixes #81103). Thanks @liuhao1024 and @vincentkoc and @pjuneye. - **PR #93773** fix(ui): scope Skill Workshop proposals to selected agent. Related #93760. Thanks @TurboTheTurtle and @vincentkoc and @hannesrudolph. - **PR #88750** feat(context-engine): pass runtime settings into lifecycle. Thanks @ragesaq and @jalehman. - **PR #93763** fix(agents): use neutral billing copy for subscription auth. Related #80877. Thanks @eldar702 and @vincentkoc and @22kyasue. - **PR #93818** List all ClawHub docs in sidebar. Thanks @Patrick-Erichsen. - **PR #93779** fix(webchat): skip textarea resize during IME composition to eliminate typing lag. Related #90800. Thanks @joelnishanth and @vincentkoc and @w10497-create. - **PR #93786** fix(plugins): treat refreshable catalogs as requiring runtime discovery (fixes #93775). Thanks @liuhao1024 and @St0rmz1. - **PR #93791** fix(memory): await search-sync before returning results to prevent stale index (fixes #52115). Thanks @liuhao1024 and @vincentkoc and @FicheallADa. - **PR #93780** fix(google): keep parallel Gemini tool responses in the turn after the model. Thanks @yetval and @vincentkoc. - **PR #93789** fix(agents): make lane suspension consistent across cooldown-precheck and embedded-runner paths. Related #93036. Thanks @joelnishanth and @vincentkoc and @kumaxs. - **PR #93798** fix(status): show 0 (not ?) for fresh-session context tokens. Related #93771. Thanks @Alix-007 and @vincentkoc and @anarchia-99. - **PR #93810** fix(cron): preserve startup overflow catch-up deferrals in start() maintenance pass. Thanks @yetval. - **PR #93811** Strip UTF-8 BOM when reading SKILL.md in quick_validate. Thanks @HrachShah. - **PR #93803** fix(ui): preserve WebChat visible messages across session switches. Related #80855. Thanks @LiuwqGit and @vincentkoc and @viagarsuker. - **PR #93792** fix(android): wait for node capability approval before onboarding. Thanks @Solvely-Colin and @vincentkoc. - **PR #93796** fix(feishu): paginate wiki node and space listing (#37626). Thanks @ZengWen-DT and @vincentkoc and @ritou11. - **PR #93797** fix(browser): use openTab return value to prevent wsUrl race in ensureTabAvailable (fixes #63343). Thanks @liuhao1024 and @vincentkoc and @OpenCodeEngineer. - **PR #93806** fix(reasoning-tags): strip MiniMax mm: tags on silent-reply and streaming paths missed by #93767. Thanks @Alix-007 and @vincentkoc. - **PR #93691** refactor: add gateway sessions.create lifecycle seam. Thanks @jalehman. - **PR #88748** fix(gemini): bridge OAuth profiles into CLI runtime. Related #88742. Thanks @jason-allen-oneal. - **PR #93857** fix(deps): remediate Dependabot alerts. Thanks @vincentkoc. - **PR #93874** fix(slack): recognize MiniMax mm: namespaced reasoning tags in monitor preview. Thanks @Alix-007. - **PR #93832** feat(providers): add ClawRouter managed proxy. Thanks @vincentkoc. - **PR #93880** fix(macos): preserve approvals migration data. Thanks @vincentkoc. - **PR #93903** fix(cron): reject invalid absolute timestamps. Thanks @Alix-007 and @vincentkoc. - **PR #93879** fix(update): use configured npm registry for update metadata. Related #79140. Thanks @vincentkoc and @sixerLiu. - **PR #93924** revert(providers): remove ClawRouter provider. Thanks @vincentkoc. - **PR #93955** fix(telegram): surface rich-message disabled state. Thanks @obviyus. - **PR #93881** fix(agents): route BTW through canonical Codex runtime. Related #88902. Thanks @vincentkoc and @TurboTheTurtle and @khalil-omer. - **PR #90192** fix(feishu): fetch quoted content before empty-message guard. Related #90177. Thanks @bladin and @sliverp and @lkxlaz. - **PR #93237** Fix Mattermost open DM validation. Thanks @amknight. - **PR #93945** feat(diagnostics): add SIEM security events. Thanks @vincentkoc. - **PR #87487** fix(cli): clarify mcp list registry scope. Related #65209. Thanks @Alix-007 and @slideshow-dingo. - **PR #24661** feat(cohere): add provider plugin. Thanks @vincentkoc. - **PR #93532** Expose verified ClawHub source in skill verify output. Thanks @momothemage. - **PR #93538** feat(codex): support app-server network proxy profiles. Thanks @vincentkoc. - **PR #93938** fix(telegram): guard UTF-16 surrogate pairs in outbound chunkers. Related #93921. Thanks @Nas01010101 and @vincentkoc. - **PR #94104** feat(agents): trace compaction summarization model calls. Thanks @amknight. - **PR #94108** Fix package Telegram temp root. Thanks @obviyus. - **PR #94113** Fix Telegram package output mount. Thanks @obviyus. - **PR #89062** feat(docker): support offline setup reruns. Related #70443. Thanks @Alix-007 and @safrano9999. - **PR #93929** fix(secrets): explicitly pass BWS_SERVER_URL to resolver for self-hosted instances. Related #93851. Thanks @Pandah97 and @vincentkoc and @AdoShan. - **PR #90057** Polish Workboard operations view. Thanks @fuller-stack-dev. - **PR #89396** fix(doctor): drop inert legacy cron notify when cron.webhook is unset. Related #44460. Thanks @Alix-007. - **PR #94138** fix(session): prevent stale finalizer from recreating deleted session rows. Related #40840. Thanks @xialonglee and @vincentkoc and @AL-knows. - **PR #93739** refactor: add session patch projection seam. Thanks @jalehman. - **PR #94178** fix(workspace): skip optional bootstrap files when workspace setup is already completed. Related #83593. Thanks @dwc1997 and @jsompis. - **PR #93363** fix(feishu): enforce account tool family gates. Thanks @eleqtrizit. - **PR #93813** fix(codex): keep message registered for internal turns. Related #93750. Thanks @jalehman and @hannesrudolph. - **PR #93659** refactor: add session reset delete lifecycle seam. Thanks @jalehman. - **PR #93852** ci(release): harden release controls. Thanks @vincentkoc. - **PR #94203** feat(codex): support remote app-server plugins. Thanks @kevinslin. - **PR #94263** chore: migrate claw-score skill. Thanks @RomneyDa and @kevinslin. - **PR #93695** refactor: add compact trim lifecycle seam. Thanks @jalehman. - **PR #93114** test: fold lifecycle and package proof into QA Lab. Thanks @RomneyDa. - **PR #93181** test: fold otel smoke into qa e2e. Thanks @RomneyDa. - **PR #93178** test: fold gateway smoke into qa e2e. Thanks @RomneyDa. - **PR #94276** qa-lab: support script-backed evidence scenarios. Thanks @Solvely-Colin and @RomneyDa. - **PR #94282** Support owner-qualified ClawHub skill installs. Thanks @Patrick-Erichsen. - **PR #93704** refactor: add session cleanup lifecycle seam. Thanks @jalehman. - **PR #94296** fix: require all taxonomy coverage ids for a feature - AND not OR. Thanks @RomneyDa. - **PR #92016** fix(plugins): compose live hook registry view for tool-call hooks. Related #91918. Thanks @amknight and @vokaplok. - **PR #89596** fix(policy): recognize declared tool allowlists. Thanks @giodl73-repo. - **PR #93713** fix: route deleted-agent session purge through lifecycle seam. Thanks @jalehman. - **PR #84172** fix(exec): rebuild command authorization on the Tree-sitter command planner. Thanks @jesse-merhi. - **PR #94332** docs: add ClawHub namespace claims to sidebar. Thanks @Patrick-Erichsen. - **PR #86360** fix(codex): honor bound agent exec host policy. Thanks @jesse-merhi. - **PR #73162** fix(slack): remove socket reconnect attempt cap so gateway stays connected indefinitely. Related #72808. Thanks @suboss87 and @tleyden. - **PR #94156** fix: expose OpenAI image quality and moderation CLI options. Thanks @lastguru-net and @fuller-stack-dev. - **PR #94350** feat: externalize GMI provider plugin. Thanks @Patrick-Erichsen and @vincentkoc. - **PR #94543** fix(gateway): bound config.get middleware results. Related #94265. Thanks @vincentkoc and @v-s-gusev. - **PR #91409** fix(update): run plugin convergence after RPC git updates. Thanks @masatohoshino. - **PR #94556** chore(extensions): bump tokenjuice to 0.8.1. Thanks @vincentkoc. - **PR #94580** fix(ci): stabilize update run gates. - **PR #94394** fix(infra): probe 127.0.0.1 in ensurePortAvailable to detect IPv4-only occupants. Related #94379. Thanks @Pandah97 and @wangwllu. - **PR #94421** fix(agents): preserve active compaction retries. Related #94391. Thanks @dexiosmb. - **PR #94428** fix(feishu): preserve replies before error finals. Related #94360. Thanks @xunx33. - **PR #93735** refactor: add restart recovery lifecycle seam. Thanks @jalehman. - **PR #94591** docs(release): backfill complete contribution records. Thanks @vincentkoc. - **PR #94588** fix(cron): retry isolated setup timeouts. Thanks @aaroneden. - **PR #94082** fix(cron): prevent lane timeout during long tool execution. Related #94033. Thanks @ajwan8998 and @JingWang-Star996. - **PR #94551** feat(firecrawl): add keyless scrape support. Thanks @vincentkoc and @developersdigest. - **PR #94619** test(ci): stabilize timeout-sensitive shards. Thanks @vincentkoc. - **PR #94048** fix(telegram): set richMessages default to false explicitly in schema. Related #93770, #93794. Thanks @Monkey-wusky and @obviyus and @Nardoa375 and @laurenceputra. - **PR #94118** [codex] Fix Telegram rich local Markdown link hrefs. Related #94117. Thanks @dankarization and @obviyus. - **PR #94646** refactor(sqlite): land database-first memory and proxy alignment. Thanks @vincentkoc. - **PR #94658** test(sqlite): use shared temp directory helper. Thanks @vincentkoc. - **PR #92135** fix(openai-embedding): preserve openai/ prefix for non-native base URLs. Related #92124. Thanks @xialonglee and @Kambrian. - **PR #93737** refactor: add session maintenance transaction seam. Thanks @jalehman. - **PR #93685** refactor(auto-reply): add lifecycle storage seams. Thanks @jalehman. - **PR #94349** fix(agents): preserve pending subagent completion announces. Related #93323. Thanks @sallyom and @oiGaDio. - **PR #93174** test: fold channel message flows into qa e2e. Thanks @RomneyDa. - **PR #94093** Prevent Codex thread rotation from losing next-step context. Thanks @VACInc. - **PR #53920** fix(scripts): avoid mutating tracked auth-monitor template during setup. Thanks @JackWuGlobal. - **PR #94702** Standardize QA coverage IDs on dotted names. Thanks @RomneyDa. - **PR #81825** fix(skills/1password): stop forcing tmux for desktop app auth (#52540). Thanks @koshaji and @tylerbittner. - **PR #94725** fix(doctor): warn on volatile SQLite state. Thanks @vincentkoc. - **PR #88551** fix(agents): skip auth gate for CLI-owned transport. Thanks @yu-xin-c. - **PR #88581** feat(commands): add /name to rename the current session from chat. Thanks @BSG2000. - **PR #94324** feat(codex): support app-server SecretRefs. Thanks @kevinlin-openai and @kevinslin. - **PR #90882** fix: add self-knowledge docs rule to system prompt. Related #90713. Thanks @SutraHsing. - **PR #94684** fix: #80507 show dry-run output for message send/poll. Thanks @lzyyzznl and @YB0y. - **PR #93823** fix(whatsapp): keep opening text chunk when first media fails on multi-chunk reply. Thanks @yetval. - **PR #89203** refactor: route SDK session compatibility through seam. Thanks @jalehman. - **PR #94453** fix: default cron runMode to "due" instead of "force" (#94270). Thanks @jincheng-xydt and @sallyom and @davectr. - **PR #94746** fix(note): prevent clack from re-breaking copy-sensitive tokens. Related #94730. Thanks @xzh-icenter and @berkgungor. - **PR #89904** refactor: route sdk session compatibility through accessor. Thanks @jalehman. - **PR #86719** fix(skills): retarget stale plugin skill symlinks. Related #85925. Thanks @stevenepalmer and @shakkernerd. - **PR #94337** fix(tui): show 0 not ? for fresh-session context tokens in footer. Thanks @mushuiyu886. - **PR #94539** fix(android): group settings by intent. Thanks @Tosko4. - **PR #92383** fix(gateway): never return an empty chat.history transcript. Thanks @Hidetsugu55. - **PR #92574** test(browser): cover action-input CLI request bodies. Related #83877. Thanks @yu-xin-c and @davinci282828. - **PR #92873** test(diffs): add viewerState, toolbar toggle, shadow root, and hydrateProps tests (fixes #83915). Thanks @liuhao1024 and @davinci282828. - **PR #94257** fix(sessions): preserve Media\* index alignment when reading user-turn fields. Thanks @Nas01010101. - **PR #94756** fix(codex): bound turn/start text when context budget is non-positive. Related #94748. Thanks @Nas01010101. - **PR #94729** fix(skills/trello): add curl to requires.bins to match body examples (fixes #94727). Thanks @liuhao1024 and @berkgungor. - **PR #94790** feat(slack): log INFO receipt for inbound app_mention events. Related #94691. Thanks @ZengWen-DT and @BryceMurray. - **PR #81696** fix: guard tool event callbacks (AI-assisted). Thanks @enjoylife1243. - **PR #94809** chore: forward-port alpha release fixes. - **PR #94612** fix(macos): open NSOpenPanel for embedded Control UI file inputs (#94468). Thanks @bbblending and @DINGDANGMAOUP. - **PR #89806** fix(feishu): avoid axios interceptor internals. Related #83913. Thanks @sweetcornna and @davinci282828. - **PR #91923** fix(ios): clean up notification settings state. Thanks @zats. - **PR #91345** fix: suggest close CLI commands. Related #83999. Thanks @glenn-agent and @HannesOberreiter. - **PR #94561** Add stdout diagnostics OTEL log exporter. Thanks @jesse-merhi. - **PR #91013** fix(gateway): ignore stale abort markers for fresh chat events. Related #91012. Thanks @nxmxbbd. - **PR #89279** fix(tasks): deliver ACP completions to bound Discord threads. Related #84022. Thanks @anyech and @h-mascot. - **PR #91656** test(cron): expand parseAbsoluteTimeMs test coverage to 39 cases. Related #91654. Thanks @SpecialLeon. - **PR #94810** fix(telegram): classify sendChatAction 401 by structured error_code, not bare substring match. Related #94787. Thanks @ZOOWH and @parveshsaini. - **PR #94737** fix(reply): clarify provider internal error copy. Thanks @snowzlmbot. - **PR #94868** fix(channels): preserve command progress detail. Thanks @vincentkoc. - **PR #94891** fix(telegram): send progress previews as html text. Thanks @obviyus. - **PR #94683** fix(outbound): keep direct-only targets out of group sessions. Related #92384. Thanks @scotthuang and @haiwei01. - **PR #92477** fix: migrate watch app to single-target app (Xcode 27+ compat). Thanks @zats and @joshavant. - **PR #94812** test(perf): compare saved CLI startup benchmarks. Thanks @FelixIsaac. - **PR #94856** fix(telegram): normalize all HTML tables before entity-escaping in rich messages. Related #94317. Thanks @zhangqueping and @jairrab. - **PR #91685** fix(cron): refuse keyless implicit isolated cron delivery inherited from shared agent-main bucket. Thanks @nxmxbbd. ### Release verification - npm package: https://www.npmjs.com/package/openclaw/v/2026.6.9 - registry tarball: https://registry.npmjs.org/openclaw/-/openclaw-2026.6.9.tgz - integrity: `sha512-y0PGUdE87S8QtQXABPDL0CjNKhH3q/R1h9/WiRQkhVCGSBVhs63/M1iZn2DYVyJCAbDyMz3KNyAE0WzSQIWCRg==` - release SHA: `c645ec4555c017931de0e35ad9847dffae2741ef` - full release CI report: https://github.com/openclaw/releases/blob/main/evidence/2026.6.9/release-evidence.md - release publish: https://github.com/openclaw/openclaw/actions/runs/27889455826 - npm preflight: https://github.com/openclaw/openclaw/actions/runs/27879798419 - full release validation: https://github.com/openclaw/openclaw/actions/runs/27879798405 - plugin npm publish: https://github.com/openclaw/openclaw/actions/runs/27889611545 - plugin ClawHub publish: https://github.com/openclaw/openclaw/actions/runs/27889612007 - plugin ClawHub bootstrap: not needed - OpenClaw npm publish: https://github.com/openclaw/openclaw/actions/runs/27889785109 - npm Telegram beta E2E: not supplied - Windows Hub promotion: https://github.com/openclaw/openclaw/actions/runs/27890002427 from openclaw/[email protected]