openclaw/CHANGELOG/2026.3.31-beta.1.md

2026.3.31-beta.1

Fixes

• Agents/compaction: keep late compaction-retry rejections handled after the aggregate timeout path wins without swallowing real pre-timeout wait failures, so timed-out retries no longer surface an unhandled rejection on later unsubscribe. (#57451) Thanks @mpz4life and @vincentkoc.
• Agents/context pruning: count supplementary-plane CJK characters with the shared code-point-aware estimator so context pruning stops underestimating Japanese and Chinese text that uses Extension B ideographs. (#39985) Thanks @Edward-Qiang-2024.
• Agents/Kimi: preserve already-valid Anthropic-compatible tool call argument objects while still clearing cached repairs when later trailing junk exceeds the repair allowance. (#54491) Thanks @yuanaichi.
• Agents/MCP: dispose bundled MCP runtimes after one-shot openclaw agent --local runs finish, while preserving bundled MCP state across in-run retries so local JSON runs exit cleanly without restarting stateful MCP tools mid-run (#57816). Thanks @ForestDengHK.
• Agents/MCP: reuse bundled MCP runtimes across turns in the same session, while recreating them when MCP config changes and disposing stale runtimes cleanly on session rollover. (#55090) Thanks @allan0509.
• Agents/memory flush: keep daily memory flush files append-only during embedded attempts so compaction writes do not overwrite earlier notes. (#53725) Thanks @HPluseven.
• Agents/sandbox: honor tools.sandbox.tools.alsoAllow, let explicit sandbox re-allows remove matching built-in default-deny tools, and keep sandbox explain/error guidance aligned with the effective sandbox tool policy. (#54492) Thanks @ngutman.
• Agents/sandbox: make remote FS bridge reads pin the parent path and open the file atomically in the helper so read access cannot race path resolution. Thanks @AntAISecurityLab and @vincentkoc.
• Agents/silent turns: fail closed on silent memory-flush runs so narrated NO_REPLY self-talk cannot stream or finalize into external replies even when block streaming is enabled. (#52593) Thanks @ForestDengHK.
• Agents/subagents: fix interim subagent runtime display so /subagents list and /subagents info stop inflating short runtimes and show second-level durations correctly. (#57739) Thanks @samzong.
• Anthropic/OAuth: inject /fast service_tier hints for direct sk-ant-oat-* requests so OAuth-authenticated Anthropic runs stop missing the same overload-routing signal as API-key traffic. Fixes #55758. Thanks @Cypherm and @vincentkoc.
• Anthropic/service tiers: support explicit serviceTier model params for direct Anthropic requests and let them override /fast defaults when both are set. (#45453) Thanks @vincentkoc.
• Auto-reply/fast: accept /fast status on the directive-only path, align help/status text with the documented status|on|off syntax, and keep current-state replies consistent across command surfaces. Fixes #46095. Thanks @weissfl and @vincentkoc.
• Azure OpenAI/custom providers: use the azure-openai-responses path for Azure custom providers so Azure OpenAI endpoints stay on the correct Responses integration surface. (#50851) Thanks @kunalk16.
• BlueBubbles/iMessage: coalesce URL-only inbound messages with their link-preview balloon again so sharing a bare link no longer drops the URL from agent context. Thanks @vincentkoc.
• Browser/plugins: auto-enable the bundled browser plugin when browser config or browser tool policy already references it, and show a clearer CLI error when plugins.allow excludes browser (#57816). Thanks @ForestDengHK.
• CI/dev checks: default local pnpm check to a lower-memory typecheck/lint path while keeping CI on the normal parallel path, and harden Telegram test typing/literals around native TypeScript-Go tooling crashes. Thanks @vincentkoc.
• Tasks: add a small task-flow runtime substrate for authoring layers with persisted wait targets and output bags, plus bundled skills/Lobster examples and richer flows show / doctor recovery hints for multi-task flow state. (#58336) Thanks @mbelinky and @vincentkoc.
• Config/legacy cleanup: stop probing obsolete alternate legacy config names and service labels during local config/service detection, while keeping the active ~/.openclaw/openclaw.json path canonical (#57816). Thanks @ForestDengHK.
• Config/runtime: pin the first successful config load in memory for the running process and refresh that snapshot on successful writes/reloads, so hot paths stop reparsing openclaw.json between watcher-driven swaps (#57816). Thanks @ForestDengHK.
• LINE/status: stop openclaw status from warning about missing credentials when sanitized LINE snapshots are already configured, while still surfacing whether the missing field is the token or secret. (#45701) Thanks @tamaosamu.
• macOS/local gateway: stop OpenClaw.app from killing healthy local gateway listeners after startup by recognizing the current openclaw-gateway process title and using the current openclaw gateway launch shape (#57816). Thanks @ForestDengHK.
• macOS/wide-area discovery: switch gateway discovery to Tailscale MagicDNS names so Mac clients recover more reliably across changing tailnet IPs. (#57833) Thanks @jacobtomlinson.
• Matrix/CLI send: start one-off Matrix send clients before outbound delivery so openclaw message send --channel matrix restores E2EE in encrypted rooms instead of sending plain events. (#57936) Thanks @gumadeiras.
• Matrix/context: filter fetched room context by sender allowlists so reply and thread context lookup no longer pulls non-allowlisted messages into agent context. (#58376) Thanks @jacobtomlinson.
• Matrix/delivery recovery: treat Synapse User not in room replay failures as permanent during startup recovery so poisoned queued messages move to failed/ instead of crash-looping Matrix after restart. (#57426) thanks @dlardo.
• Matrix/direct rooms: recover fresh auto-joined 1:1 DMs without eagerly persisting invite-only m.direct mappings, while keeping named, aliased, and explicitly configured rooms on the room path. (#58024) Thanks @gumadeiras.
• Matrix/direct rooms: stop trusting remote is_direct, honor explicit local is_direct: false for discovered DM candidates, and avoid extra member-state lookups for shared rooms so DM routing and repair stay aligned. (#57124) Thanks @w-sss.
• Matrix/DM threads: keep strict unnamed fresh-invite rooms promotable even when Matrix omits the optional direct hint, preserve repair-failed local DM promotions while still revalidating later room metadata, and keep both bound and thread-isolated Matrix sessions reporting the correct route policy. (#58099) Thanks @gumadeiras.
• Matrix/plugin loading: ship and source-load the crypto bootstrap runtime sidecar correctly so current main stops warning about failed Matrix bootstrap loads and matrix/index plugin-id mismatches on every invocation. (#53298) thanks @keithce.
• Mattermost/websocket: detect stale Mattermost WebSocket sessions after bot disable/enable cycles so monitoring reconnects cleanly instead of silently staying stale. (#53604) Thanks @Qinsam.
• Media/downloads: stop forwarding auth and cookie headers across cross-origin redirects during media saves, while preserving safe request headers for same-origin redirect chains. Thanks @AntAISecurityLab and @vincentkoc.
• Media/images: reject oversized decoded image inputs before metadata and resize backends run, so tiny compressed image bombs fail early instead of exhausting gateway memory. (#58226) Thanks @AntAISecurityLab and @vincentkoc.
• Memory/doctor: probe QMD availability from the agent workspace too, so openclaw doctor no longer falsely reports relative memory.qmd.command configs as broken while runtime search still works. Thanks @vincentkoc.
• Memory/doctor: suppress the orphan transcript cleanup warning when QMD session indexing is enabled, so doctor no longer suggests deleting transcript history that QMD still uses for recall. (#40584) Thanks @Gyarados4157 and @vincentkoc.
• Memory/FTS: add configurable trigram tokenization plus short-CJK substring fallback so memory search can find Chinese, Japanese, and Korean text without breaking mixed long-and-short queries. Thanks @carrotRakko.
• Memory/FTS: keep provider-less keyword hits visible at the default memory-search threshold, so FTS-only recall works without requiring --min-score 0. (#56473) Thanks @opriz.
• Memory/LanceDB: resolve runtime dependency manifest lookup from the bundled extensions/memory-lancedb path (including flattened dist chunks) so startup no longer fails with a missing @lancedb/lancedb dependency error. (#56623) Thanks @LUKSOAgent.
• Memory/QMD: add memory.qmd.searchTool as an exact mcporter tool override, so custom QMD MCP tools such as hybrid_search can be used without weakening the validated searchMode config surface. (#27801) Thanks @keramblock.
• Memory/QMD: honor memory.qmd.update.embedInterval even when regular QMD update cadence is disabled or slower by arming a dedicated embed-cadence maintenance timer, while avoiding redundant timers when regular updates are already frequent enough. (#37326) Thanks @barronlroth.
• Memory/QMD: include deduplicated default plus per-agent memorySearch.extraPaths when building QMD custom collections, so shared and agent-specific extra roots both get indexed consistently. (#57315) Thanks @Vitalcheffe and @vincentkoc.
• Memory/QMD: keep memory_search session-hit paths roundtrip-safe when exported session markdown lives under the workspace qmd/ directory, so memory_get can read the exact returned path instead of failing on the generic qmd/sessions/... alias. (#43519) Thanks @holgergruenhagen and @vincentkoc.
• Memory/QMD: keep qmd embed active in search mode too, so BM25-first setups still build a complete index for later vector and hybrid retrieval. (#54509) Thanks @hnshah and @vincentkoc.
• Memory/QMD: keep reset and deleted session transcripts in QMD session export so daily session resets do not silently drop most historical recall from memory_search. (#30220) Thanks @pushkarsingh32.
• Memory/QMD: pass a direct-session key on openclaw memory search so CLI QMD searches no longer get denied as session=<none> under direct-only scope defaults. (#43517) Thanks @waynecc-at and @vincentkoc.
• Memory/QMD: point QMD_CONFIG_DIR at the nested xdg-config/qmd directory so per-agent collection config resolves correctly. (#39078) Thanks @smart-tinker and @vincentkoc.
• Memory/QMD: preserve explicit start_line and end_line metadata from mcporter query results so memory search hits keep the real snippet offsets instead of falling back to the snippet header. (#47960) Thanks @vincentkoc.
• Memory/QMD: rebind collections when QMD reports a changed pattern but omits path metadata, so config pattern changes stop being silently ignored on restart. (#49897) Thanks @Madruru.
• Memory/QMD: resolve slugified memory_search file hints back to the indexed filesystem path before returning search hits, so memory_get works again for mixed-case and spaced paths. (#50313) Thanks @erra9x.
• Memory/QMD: send MCP query collection filters as the upstream collections array instead of the legacy singular collection field, so mcporter-backed QMD 1.1+ searches still scope correctly after the unified query tool migration. (#54728) Thanks @armanddp and @vincentkoc.
• Memory/QMD: serialize cross-process qmd embed runs behind a shared lock and stagger periodic embed timers so multi-agent QMD collections stop thundering-herding on startup and every maintenance interval. Thanks @vincentkoc.
• Memory/QMD: stop rewriting Han/CJK BM25 queries before qmd search, so OpenClaw search semantics match direct QMD results for mixed and spaced Chinese queries. Thanks @vincentkoc.
• Memory/QMD: surface degraded vector status from qmd status so openclaw memory status --deep warns when semantic search is unavailable because the index still has 0 vectors. Fixes #28169. Thanks @vincentkoc.
• Memory/QMD: treat null-byte collection corruption the same when QMD surfaces it as ENOENT, so managed-collection repair still rebuilds and retries instead of leaving QMD stuck on a broken path. Thanks @vincentkoc.
• Memory/QMD: warn explicitly when memory.backend=qmd is configured but the qmd binary is missing, so doctor and runtime fallback no longer fail as a silent builtin downgrade. (#50439) Thanks @Jimmy-xuzimo and @vincentkoc.
• Memory/QMD: weight CJK-heavy text correctly when estimating chunk sizes, preserve surrogate-pair characters during fine splits, and keep long Latin lines on the old chunk boundaries so memory indexing produces better-sized chunks for CJK notes. (#40271) Thanks @AaronLuo00.
• Memory/session indexer: include .jsonl.reset.* and .jsonl.deleted.* transcripts in the memory host session scan while still excluding .jsonl.bak.* compaction backups and lock files, so memory search sees archived session history without duplicating stale snapshots. Thanks @hclsys and @vincentkoc.
• Microsoft Teams/threads: filter fetched thread history by sender allowlists so thread context seeding no longer pulls messages from disallowed users. (#57723) Thanks @jacobtomlinson.
• OpenAI/Codex fast mode: map /fast to priority processing on native OpenAI and Codex Responses endpoints instead of rewriting reasoning settings, and document the exact endpoint and override behavior (#57816). Thanks @ForestDengHK.
• Outbound media/local files: piggyback host-local MEDIA: reads on the configured fs policy instead of a separate media-root check, so generated files outside the workspace can send when tools.fs.workspaceOnly=false while plaintext-like host files stay blocked by the outbound media allowlist. Thanks @vincentkoc.
• Pairing: enforce pending request limits per account instead of per shared channel queue, so one account's outstanding pairing challenges no longer block new pairing on other accounts. Thanks @smaeljaish771 and @vincentkoc.
• Plugins/ClawHub: sanitize temporary archive filenames for scoped package names and slash-containing skill slugs so openclaw plugins install @scope/name no longer fails with ENOENT during archive download. (#56452) Thanks @soimy.
• Plugins/CLI: add descriptor-backed lazy plugin CLI registration so Matrix can keep its CLI module lazy-loaded without dropping openclaw matrix ... from parse-time command registration. (#57165) Thanks @gumadeiras.
• Plugins/CLI: collect root-help plugin descriptors through a dedicated non-activating CLI metadata path so enabled plugins keep validated config semantics without triggering runtime-only plugin registration work, while preserving runtime CLI command registration for legacy channel plugins that still wire commands from full registration. (#57294) thanks @gumadeiras.
• Plugins/facades: guard bundled plugin facade loads with a cache-first sentinel so circular re-entry stops crashing xai, sglang, and vllm during gateway plugin startup. (#57508) Thanks @openperf.
• Plugins/Matrix: mirror the Matrix crypto WASM runtime dependency into the root packaged install and enforce root/plugin dependency parity so bundled Matrix E2EE crypto resolves correctly in shipped builds. (#57163) Thanks @gumadeiras.
• Plugins/startup: block workspace .env from overriding OPENCLAW_BUNDLED_PLUGINS_DIR, so bundled plugin trust roots only come from inherited runtime env or package resolution instead of repo-local dotenv files. Thanks @nexrin and @vincentkoc.
• Sandbox/browser: install fonts-noto-cjk in the sandbox browser image so screenshots render Chinese, Japanese, and Korean text correctly instead of tofu boxes. Fixes #35597. Thanks @carrotRakko and @vincentkoc.
• Security/LINE: make webhook signature validation run the timing-safe compare even when the supplied signature length is wrong, closing a small timing side-channel. (#55663) Thanks @gavyngong.
• Sessions/Feishu: preserve conversation ids that legitimately embed :topic: in shared session helper parsing, while keeping Telegram topic session parsing intact. (#58100) Thanks @gumadeiras.
• Slack/status reactions: add a reaction lifecycle for queued, thinking, tool, done, and error phases in Slack monitors, with safer cleanup so queued ack reactions stay correct across silent runs, pre-reply failures, and delayed transitions. (#56430) Thanks @hsiaoa.
• Status/node-only hosts: teach openclaw status to handle node-only hosts on current main without the old mixed gateway assumptions. (#56718) Thanks @ImLukeF.
• Status: fix cache hit rate exceeding 100% by deriving denominator from prompt-side token fields instead of potentially undersized totalTokens. Fixes #26643 (#57816). Thanks @ForestDengHK.
• Telegram/audio: transcode Telegram voice-note .ogg attachments before the local whisper-cli auto fallback runs, and keep mention-preflight transcription enabled in auto mode when tools.media.audio is unset (#65984). Thanks @mbelinky.
• Telegram/forum topics: restore reply routing to the active topic and keep ACP sessions_spawn(..., thread=true, mode="session") bound to that same topic instead of falling back to root chat or losing follow-up routing. (#56060) Thanks @one27001.
• Telegram/media: allow RFC 2544 benchmark-range Telegram CDN resolutions during media downloads, so voice messages, PDFs, and other attachments no longer fail with Failed to download media. (#57624) Thanks @MoerAI.
• Telegram/native commands: prefix native command menu callback payloads and preserve CommandSource: "native" when Telegram replays them through callback queries, so /fast and other native command menus keep working even when text-command routing is disabled. Thanks @vincentkoc.
• Telegram/polling: keep the watchdog from aborting long-running reply delivery by treating recent non-polling API activity as bounded liveness instead of a hard stall. (#56343) Thanks @openperf.
• Tools/web_fetch: add an explicit trusted env-proxy path for proxy-only installs while keeping strict SSRF fetches on the pinned direct path, so trusted proxy routing does not weaken strict destination binding. (#50650) Thanks @kkav004.
• Tools/web_search: localize the shared search cache to module scope so same-process global symbol lookups can no longer inspect or mutate cached web-search responses. Thanks @vincentkoc.
• TTS/Microsoft: auto-switch the default Edge voice to Chinese for CJK-dominant text without overriding explicitly selected Microsoft voices. (#52355) Thanks @extrasmall0.
• TTS: Restore 3.28 schema compatibility and fallback observability. (#57953) Thanks @joshavant.
• TUI/chat: keep optimistic outbound user messages visible during active runs by deferring local-run binding until the first gateway chat event reveals the real run id, preventing premature history reloads from wiping pending local sends. (#54722) Thanks @seanturner001.
• TUI/model picker: keep searchable /model and /models input mode from hijacking j/k as navigation keys, and harden width bounds under m-filtered model lists so search no longer crashes on long rows. (#30156) Thanks @briannicholls.
• Discord/exec approvals: stop mixing native interactive approvals with extra plain /approve narration, so Discord approval prompts stay button-driven instead of showing both manual and interactive flows. Thanks @vincentkoc.
• Telegram/exec approvals: normalize 1:1 approval routing and suppress duplicate approval prompts, so Telegram direct chats show a single working interactive approval instead of multiple conflicting approval messages. Thanks @vincentkoc.
• Voice Call/media stream: cap inbound WebSocket frame size before start validation so oversized pre-start frames are dropped before JSON parsing. Thanks @Kazamayc and @vincentkoc.
• Voice call/Plivo: pin stored callback bases to the configured public webhook URL so later call-control redirects stay on the intended origin even if webhook transport metadata differs. Thanks @zsxsoft and @vincentkoc.
• Web UI/markdown: stop bare auto-links from swallowing adjacent CJK text while preserving valid mixed-script path and query characters in rendered links. (#48410) Thanks @jnuyao.
• Approvals/UI: keep the newest pending approval at the front of the Control UI queue so approving one request does not accidentally target an older expired id. Thanks @vincentkoc.
• Auth profiles/OAuth: refresh runtime auth snapshots when saving rotated credentials so OAuth providers do not reuse consumed refresh tokens after the first token rotation. Fixes #55389. Thanks @sam26880 and @vincentkoc.
• Browser/screenshot: use fromSurface: false in raw CDP screenshots to avoid a Chromium compositor bug that drops cross-origin image textures (QR codes, CDN assets), and preserve pre-existing device emulation state across full-page viewport expansion. (#54358) Thanks @FMLS.
• ClawDock/docs: move the helper scripts to scripts/clawdock, publish ClawDock as a first-class docs page on the docs site, and document reinstalling local helper copies from the new raw GitHub path. (#23912) thanks @Olshansk.
• Control UI/gateway: clear queued browser connect timeouts on client stop so aborted or replaced gateway clients do not send delayed connect requests after shutdown. (#57338) thanks @gumadeiras.
• Control UI/gateway: reconnect the browser client when gateway event sequence gaps are detected, so stale non-chat state recovers automatically instead of only telling the user to refresh. (#23912) thanks @Olshansk.
• Exec approvals/channels: unify Discord and Telegram exec approval runtime handling, move approval buttons onto the shared interactive reply model, and fix Telegram approval buttons and typed /approve commands so configured approvers can resolve requests reliably again. (#57516) Thanks @scoootscooob.
• Gateway/SQLite transient handling: keep unhandled SQLITE_CANTOPEN, SQLITE_BUSY, SQLITE_LOCKED, and SQLITE_IOERR failures non-fatal in the global rejection handler so macOS LaunchAgent restarts do not enter a crash-throttle loop. (#57018).
• Hooks/plugins/skills: block workspace .env overrides for bundled root directories so workspace startup cannot redirect bundled trust roots away from the packaged defaults. Thanks @nexrin and @vincentkoc.
• LINE/webhooks: cap shared concurrent pre-verify webhook body reads so excess requests are rejected before entering the LINE body handler. Thanks @nexrin and @vincentkoc.
• Memory/QMD: preserve explicit custom collection names for shared paths outside the agent workspace so memory_search stops appending -<agentId> to externally managed QMD collections. (#52539) Thanks @lobsrice and @vincentkoc.
• Memory/builtin: keep memory-file indexing active in FTS-only mode (no embedding provider) so forced reindexes no longer swap in an empty index and wipe existing memory chunks. (#42714) Thanks @asamimei.
• Nostr/config: redact channels.nostr.privateKey in config snapshots and Control UI config views, so Nostr signing keys no longer appear in plain text. Thanks @ccreater222.
• Plugin approvals: accept unique short approval-id prefixes on plugin.approval.resolve, matching exec approvals and restoring /approve fallback flows on chat approval surfaces. Thanks @vincentkoc.
• SSH sandbox/upload: reject workspace symlinks that resolve outside the uploaded tree before syncing to the remote sandbox, so later agent writes cannot be redirected through escaped links. Thanks @AntAISecurityLab and @vincentkoc.
• Slack/interactive replies: resolve Slack Block Kit reply delivery from both authored channelData.slack.blocks payloads and directive-generated interactive replies, and keep Slack button styles mapped onto valid Block Kit button rendering so interactive replies stop dropping on Slack-specific delivery paths. Thanks @vincentkoc.
• Subagents/announcements: preserve the requester agent id for inline deterministic tool spawns so named agents without channel bindings can still announce completions through the correct owner session. (#55437) Thanks @kAIborg24.
• Telegram/Anthropic streaming: replace raw invalid stream-order provider errors with a safe retry message so internal message_start/message_stop failures do not leak into chats. (#55408) Thanks @imydal.
• Tlon/media: route inbound image downloads through the shared media store, cap each download at 6 MB, and stop after 8 images per message so large Tlon posts no longer balloon local media storage. Thanks @AntAISecurityLab and @vincentkoc.
• Agents/live switch: stop transient cron and subagent model overrides from being misread as persisted live-session switches, so isolated runs no longer fail with LiveSessionModelSwitchError. Thanks @vincentkoc.
• Agents/tool-call repair: recover malformed Kimi/OpenRouter tool-call argument streams when provider preambles appear before JSON payloads, and fail closed on non-tool leading text so fragment strings do not leak into filesystem path arguments during sub-agent runs. (#56560) Thanks @Originalwhite.
• Gateway/startup: keep configured primary-model warmup on the static model path so container boots do not snapshot-load provider runtime graphs just to validate a configured model. Thanks @vincentkoc.
• OpenAI/Responses: omit disabled reasoning payloads across OpenAI, Codex, and Azure OpenAI request builders so GPT-5 endpoints no longer reject reasoning.effort: "none". (#58208) Thanks @jalehman.
• WhatsApp/outbound: restore runtime send/action routing and outbound compatibility after the recent channel seam refactor so outbound sends, reactions, and related media actions keep reaching the active session. Thanks @vincentkoc.
• xAI/Responses: normalize image-bearing tool results for xAI responses payloads, including OpenResponses-style input_image.source parts, so image tool replays no longer 422 on the follow-up turn. (#58017) Thanks @neeravmakwana.
• Zalo/webhooks: scope replay dedupe to the authenticated target so one configured account can no longer cause same-id inbound events for another target to be dropped. Thanks @smaeljaish771 and @vincentkoc.
• Plugins/prompt build: preserve the highest-priority systemPrompt when merging before_prompt_build hook results instead of letting lower-priority hooks overwrite it. (#58375) Thanks @jacobtomlinson.
• Tlon/settings migration: preserve explicit empty-array settings during migration so restart-time reseeding no longer restores older file-config values. (#58370) Thanks @jacobtomlinson.
• Plugins/marketplace: harden marketplace archive installs by surfacing guarded download failures as structured install errors and deriving temp filenames from the final resolved URL. (#58267) Thanks @jacobtomlinson.
• UI/DOM safety: build the chat delete-confirm popover and Canvas Host fallback status line with DOM nodes instead of injected HTML strings. (#58269, #58266) Thanks @jacobtomlinson.
• Media/file handling: create image temp work directories under the shared OpenClaw temp root and stop widening allowed local media roots from reply or tool source paths, keeping local media access limited to configured and agent-scoped roots. (#58270, #57770) Thanks @jacobtomlinson.
• Telegram/security: migrate legacy pairing allowFrom state to the default account only and gate group voice-message preflight transcription on sender authorization so unauthorized senders cannot trigger paid transcription before being dropped. (#58165, #57566) Thanks @jacobtomlinson.
• Exec approvals: stop shell init-file flags from matching persisted script-path approvals, detect command-carrier inline eval in tools like awk, find, xargs, make, and sed, and treat the awk family as interpreter-like so allow-always decisions no longer persist interpreter paths. (#58369, #57842, #57772) Thanks @jacobtomlinson.
• Voice call/Telnyx: canonicalize verified webhook signatures before deriving replay keys so equivalent Base64 and Base64URL encodings dedupe correctly. (#57829) Thanks @jacobtomlinson.
• Gateway/HTTP trust boundaries: ignore self-declared bearer scopes, deny dangerous HTTP tool-invoke paths by default, require write scope on /v1/embeddings, and bind OpenAI-compatible /v1/chat/completions plus /v1/responses ingress as non-owner so external HTTP callers cannot self-upgrade access. (#57783, #57771, #57721, #57769, #57778) Thanks @jacobtomlinson.
• Gateway/trusted config and bootstrap: clear self-declared scopes for device-less trusted-proxy WebSocket connects and trim the Control UI bootstrap payload to only the fields needed before the normal handshake. (#57692, #57727) Thanks @jacobtomlinson.
• Skills and workspace safety: replace raw skill-file reads with a symlink-safe, root-confined loader and pin workspace-only apply_patch delete and directory-creation mutations to verified workspace roots so path rebind races fail closed. (#57519, #56016) Thanks @jacobtomlinson.
• Env and filesystem hardening: block credential and gateway auth env vars from workspace .env files, always strip dangerous inherited host env vars such as BROWSER and GIT_EDITOR, and keep sensitive host paths and OpenClaw state roots blocked even when external sandbox bind sources are allowed. (#57767, #57559, #56024) Thanks @jacobtomlinson.
• OpenShell and ACP file boundaries: skip symlinks and preserve trusted host-only directories during OpenShell mirror sync, and route ACP attachment reads through the shared attachment cache so local files outside allowed roots are no longer forwarded. (#57693, #57690) Thanks @jacobtomlinson.
• Channel/webhook authorization: skip Discord audio preflight transcription for unauthorized guild senders, add a shared pre-auth in-flight guard to Synology Chat webhooks, and validate Microsoft Teams bearer auth before JSON body parsing. (#57695, #57722, #57686) Thanks @jacobtomlinson.
• Infra/randomness: replace Math.random() in affected identifier and delay-jitter paths with shared secure-random helpers, including UI UUID generation. (#57744) Thanks @jacobtomlinson.