OpenClaw

2026.6.11

Highlights

• More capable channel control: Slack relay mode, native Mattermost /oc_queue, and per-DM model overrides make channel operations easier to automate and tune. (#94707, #95546, #95120) Thanks @sjf-oa, @amknight, @xydigit-zt, @thomaszta, and @gandalf-at-lerian.
• Richer operator workflows: openclaw agent --message-file and the RAFT CLI wake bridge add practical file-driven and remote wake-up paths. (#93351, #95497) Thanks @ooiuuii and @vincentkoc.
• Safer plugin distribution: additional official plugins are externalized cleanly, with bundled plugin icon metadata available to installed clients. (#95683, #95845) Thanks @vincentkoc and @Patrick-Erichsen.
• Stronger mobile operations: Android settings detail panels improve configuration visibility and control on mobile. (#95148) Thanks @Tosko4.
• More reliable agent turns: Codex partial deltas, harness activation, and long-context prompt-cache stability reduce lost progress and inconsistent runs. (#95404, #95652, #95624) Thanks @agonza1 and @vincentkoc.

Changes

• Gateway and plugin tooling: channel identity hook context and per-agent usage-cost reporting give integrations and operators more precise routing and accounting. (#91903, #94483) Thanks @lanzhi-lee, @vincentkoc, and @ly-wang19.
• Provider and model coverage: catalog parsing, reasoning controls, provider model resolution, and encrypted reasoning support now handle more live provider variants. (#95283, #95710, #95268, #95744, #95686, #93956) Thanks @ZengWen-DT, @vincentkoc, @Marvinthebored, @Darren2030, @daniel-alejandro-t, @parveshsaini, @geraint0923, @fuller-stack-dev, and @jason-allen-oneal.

Fixes

• Channel delivery: Telegram progress rendering, webhook lifecycle, reaction directives, duplicate mirror writes, queued update draining, and WhatsApp durable reply targets are now more reliable. (#95532, #93002, #95183, #94506, #94977, #95069, #95577, #95007, #95914) Thanks @amknight, @snowzlmbot, @zhangguiping-xydt, @shadow-enthusiast, @xialonglee, @travellingsoldier85, @obviyus, @hugenshen, @Cuttingwater, @heichaowo, @LiuwqGit, @freidrich-goldenflow, @mcaxtr, and @vincentkoc.
• WhatsApp and message identity: native quotes, Baileys group reliability, and approval reactions across JID drift now preserve the intended conversation context. (#95483, #94338, #95935) Thanks @mcaxtr, @xialonglee, and @octopuslabs-fl.
• Gateway and session safety: stuck release claims, draining-state reporting, remote probe timeouts, malformed paired access lists, and non-delivery session identity are handled without silent routing loss. (#95299, #94915, #89859, #92178, #95467) Thanks @mikasa0818, @kriegerbangerz-ship-it, @markoub, @vincentkoc, @maxschachere, @mushuiyu886, @gozzbb2, @wangmiao0668000666, @ly-wang19, @EmilioNicolas, and @yetval.
• Agent and fallback behavior: aborted runs stop cleanly, provider response bodies stay bounded, Claude CLI credit failures continue through fallback, and Codex usage-limit responses classify correctly. (#94412, #95218, #95508, #95420, #95418, #95417, #95400) Thanks @szsip239, @vincentkoc, @Alix-007, @mikasa0818, @sallyom, @riazrahaman, and @jason-allen-oneal.
• Provider and model edge cases: OpenRouter IDs, Ollama discovery and embeddings, Gemini freshness, and model-catalog prefixes now resolve against the right runtime metadata. (#95268, #94811, #93956, #95682, #95744) Thanks @Darren2030, @daniel-alejandro-t, @mushuiyu886, @jason-allen-oneal, @Sunjae-k, @parveshsaini, @vincentkoc, and @shakkernerd.
• Configuration and UI guardrails: non-interactive configure fails closed, TLS paths reject empty values, memory artifacts are sanitized, and the UI uses the patched DOMPurify release. (#94238, #94054, #95791, #95691) Thanks @ruomuxydt, @NianJiuZst, @miorbnli, @vincentkoc, @SweetSophia, and @YB0y.
• Cron and delivery validation: no-config delivery checks, thread-aware dedupe, and pending recurring runs retain their intended destinations. (#95754, #95794, #94323) Thanks @vincentkoc and @yetval.

Complete contribution record

This audited record covers the complete v2026.6.10..ee421ef7da7edf152ab911d74ffcfd852ecf43e2 history: 305 merged PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact.

Pull requests

• PR #95406 test(qa): make release scorecard categories explicit. Thanks @RomneyDa.
• PR #94700 test: fold HTTP API script proof into QA Lab. Thanks @RomneyDa.
• PR #95499 fix(test): unit-fast flow mocks. Thanks @RomneyDa.
• PR #95308 fix(ci): filter ClawSweeper comment dispatches before token minting. Thanks @vincentkoc.
• PR #95532 fix(telegram): materialize rich message line breaks as <br>. Related #95409. Thanks @amknight and @snowzlmbot.
• PR #91786 fix(plugins): reconcile managed npm root overrides with managed peer pins. Related #91772. Thanks @amknight and @mkdelta221.
• PR #93002 Fix Telegram progress draft cleanup before tool output. Related #90753. Thanks @zhangguiping-xydt and @shadow-enthusiast.
• PR #95175 fix: route mobile exec approvals to reviewer device. Thanks @joshavant.
• PR #94506 fix(telegram): stop clearing registered webhook on channel restart. Related #90254. Thanks @xialonglee and @travellingsoldier85.
• PR #95183 fix(telegram): materialize streaming progress placeholders. Related #95004. Thanks @snowzlmbot and @obviyus.
• PR #95483 fix(whatsapp): preserve native quote replies. Thanks @mcaxtr.
• PR #94338 fix(whatsapp): wire missing Baileys retry/cache hooks for group message reliability. Related #7433. Thanks @xialonglee and @mcaxtr and @octopuslabs-fl.
• PR #94707 feat(slack): add relay mode for incoming messages. Thanks @sjf-oa.
• PR #94977 fix(telegram): honor outbound reaction directives. Related #71140. Thanks @hugenshen and @Cuttingwater.
• PR #95069 fix(telegram): skip mirror write when primary reply already exists (#94930). Thanks @heichaowo.
• PR #95550 Preserve inherited channel account policies during migration. Thanks @amknight.
• PR #95390 fix #95378: https://github.com/openclaw/openclaw/issues/95378. Thanks @mikasa0818 and @obviyus and @MaiDuy708.
• PR #93143 fix(imessage): keep split-send coalescing opt-in. Thanks @omarshahine.
• PR #95008 fix(claude-cli): also disable native background Bash and Monitor in --print runs. Thanks @anagnorisis2peripeteia.
• PR #94545 fix: keep trusted policies with hook registry. Thanks @jesse-merhi.
• PR #95007 fix(telegram): render progress draft rows as plain readable text. Related #95002. Thanks @snowzlmbot.
• PR #95624 fix(agents): keep long-context tool-result prompts cache-stable. Thanks @vincentkoc.
• PR #95625 fix(ci): smooth PR runner-registration bursts. Thanks @vincentkoc.
• PR #95572 fix(agents): reject bind specs with extra colon segments. Thanks @ly-wang19.
• PR #95653 test(agents): add large prompt cache coverage. Thanks @vincentkoc.
• PR #95640 Consolidate iOS notification permission UX. Thanks @joshavant.
• PR #95546 feat(mattermost): register /oc_queue as a native slash command. Thanks @amknight.
• PR #95019 fix(skills): point gog brew install at homebrew-core gogcli (#95017). Thanks @ZengWen-DT and @vincentkoc and @Sedrak-Hovhannisyan.
• PR #93378 test(telegram): keep live polling leases protected. Related #93375. Thanks @mmyzwl and @Yachiyo1680.
• PR #95084 fix(googlechat): sanitize internal tool-trace lines from outbound text (#90684). Thanks @jailbirt and @studentzhou-svg.
• PR #95278 Avoid copying process.env in ingress queue state DB opens. Related #94571. Thanks @kaka-srp.
• PR #95577 fix #86957: drain worker-spooled Telegram updates immediately. Thanks @LiuwqGit and @freidrich-goldenflow.
• PR #95128 fix(compaction): count user-message image blocks in cut-point estimator. Thanks @yetval.
• PR #93887 fix(ssh): reject hostnames with stray leading or trailing colons in parseSshTarget. Thanks @miorbnli.
• PR #95191 docs(plugins): document subagent_ended hook fields. Related #95186. Thanks @MaHaoHao-ch and @ken-jo.
• PR #95102 fix(config): add stdio to McpServerSchema transport union. Related #95082. Thanks @lzyyzznl and @ken-jo.
• PR #95465 fix(sdk): type-narrow manifest.files in pack staging root helper. Thanks @wangmiao0668000666.
• PR #95664 refactor(plugins): move owner skills into plugins. Thanks @vincentkoc.
• PR #95299 fix #95248: OpenClaw release_lane is a no-op when claim is held by a live worker; stuck Telegram inbound events block agent response until gateway restart. Thanks @mikasa0818 and @kriegerbangerz-ship-it.
• PR #94687 fix(gateway): accept port for health and probe. Related #79100. Thanks @BryanTegomoh and @ozthedivine.
• PR #95649 fix(ci): bundle test shards and right-size runners. Thanks @vincentkoc.
• PR #95243 fix(docs): show inline read_when hints in docs:list. Thanks @hugenshen and @vincentkoc.
• PR #95283 fix(openai-completions): seal native reasoning before the answer under /reasoning on. Related #95280. Thanks @ZengWen-DT and @vincentkoc and @Marvinthebored.
• PR #95497 feat(raft): add CLI wake bridge channel. Thanks @vincentkoc.
• PR #95459 fix(cron): use main-session systemEvent for silent quick-create preset. Related #95073. Thanks @ZOOWH and @vincentkoc and @vporton.
• PR #95503 fix #89466: [Bug]: Control UI chat input text not cleared after sending. Thanks @zhangguiping-xydt and @vincentkoc and @zhong18804784882.
• PR #95684 fix(skills): harden ClawHub update policy. Thanks @vincentkoc.
• PR #95683 feat(plugins): externalize additional official plugins. Thanks @vincentkoc.
• PR #95681 fix(ci): debounce canonical main runner admission. Thanks @vincentkoc.
• PR #95652 fix(agents): activate selected harness plugins. Thanks @vincentkoc.
• PR #95404 fix(codex): stream non-final-answer assistant deltas as partials. Related #95422. Thanks @agonza1 and @vincentkoc.
• PR #58993 fix(googlechat): support spaceType field for DM vs Space detection. Thanks @Starhappysh and @vincentkoc.
• PR #94148 fix(doctor): prevent non-interactive --fix from auto-restarting gateway. Related #78217. Thanks @zhangguiping-xydt and @esqandil.
• PR #89859 fix(gateway): honor remote status probe timeout. Related #65355. Thanks @mushuiyu886 and @gozzbb2.
• PR #95466 fix(ci): increase timeouts in flaky process-group signal test. Thanks @jason-allen-oneal.
• PR #95720 fix(matrix): prevent double bootstrapCrossSigning reset in forced reset. Related #78396. Thanks @vincentkoc and @jteddy.
• PR #95707 fix(synology-chat): remove duplicate local deliver timeout. Thanks @vincentkoc.
• PR #95706 fix(whatsapp): remove dead watchdog timeout clamp. Thanks @vincentkoc.
• PR #95719 fix(cli): sync capability inspect metadata flags with registered options. Thanks @vincentkoc.
• PR #95721 fix(active-memory): exclude dreaming-narrative session keys from eligibility gate. Related #78500. Thanks @vincentkoc and @vishutdhar.
• PR #95602 test: save ~79 CI hours/mo in gateway session utils. Thanks @zats and @vincentkoc.
• PR #94412 fix(agent-core): stop loop after aborted tool run. Thanks @szsip239 and @vincentkoc.
• PR #94915 fix(gateway): report draining state in readiness. Related #78136. Thanks @markoub and @vincentkoc and @maxschachere.
• PR #95691 fix(ui): bump dompurify to patched release. Thanks @vincentkoc.
• PR #95710 fix(vercel-ai-gateway): resolve dynamic model selections. Thanks @vincentkoc.
• PR #94072 fix(agents): count message-tool source reply as user-facing reply for tool error warnings. Related #93875. Thanks @chenyangjun-xy and @vincentkoc and @hoyanhan.
• PR #94784 fix(doctor): stop promising --fix for working isolated shell-prompt cron jobs (#94655). Thanks @ZengWen-DT and @altaywtf and @geekoagent.
• PR #93504 fix(device-pairing): guard role normalization against non-string entries. Thanks @ly-wang19.
• PR #92178 fix(gateway): normalize malformed paired access lists. Related #90654. Thanks @wangmiao0668000666 and @ly-wang19 and @EmilioNicolas.
• PR #83041 Fix config patch restart-required notices. Related #46797. Thanks @xuruiray and @Stache73.
• PR #95754 fix(cron): preserve no-config delivery validation. Thanks @vincentkoc.
• PR #93351 feat(cli): add --message-file to openclaw agent. Thanks @ooiuuii.
• PR #95485 fix(ui): roll values near 1M over from k to M in compact token format. Thanks @NarahariRaghava and @vincentkoc.
• PR #94622 fix(build): allow tsdown heap override. Thanks @tayoun.
• PR #76668 meta(issue-template): add dedicated docs bug report form. Related #76664. Thanks @WadydX.
• PR #91193 fix(cli): document Commander rawArgs internal API dependency in action-reparse.ts. Related #83893. Thanks @whiteyzy and @davinci282828.
• PR #77339 fix(auto-reply): clear runtime model cache on reset. Related #77322. Thanks @mjamiv and @ZaynL.
• PR #89628 Speed up precomputed command help startup. Thanks @yyzquwu.
• PR #95087 refactor: add memory and QMD session identity mapping. Thanks @jalehman.
• PR #89323 fix(web-ui): skip hidden subagent picker pages. Related #89249. Thanks @giodl73-repo and @originsecured-do.
• PR #84794 Clean up isolated cron sessions after runs. Related #84707. Thanks @TurboTheTurtle and @bottenbenny.
• PR #95794 fix(cron): compare thread IDs when deduping failure destinations. Thanks @vincentkoc.
• PR #95791 fix(session-memory): sanitize model artifacts before saving memory. Thanks @vincentkoc and @SweetSophia and @YB0y.
• PR #95805 fix(agents): normalize hallucinated Office file extensions. Related #93326. Thanks @vincentkoc and @lzyyzznl and @xzh-icenter and @bhnan.
• PR #89612 fix: include persisted plugin contracts for migrations. Related #89609. Thanks @zerone0x and @mugabuga.
• PR #89981 fix(diagnostics-otel): keep full model id on spans instead of collapsing to "unknown". Thanks @mycarrysun and @vincentkoc.
• PR #90489 fix(sessions): clarify cross-agent visibility guidance. Related #90443. Thanks @sahibzada-allahyar and @vincentkoc and @ramitrkar-hash.
• PR #95383 fix(sdk): classify failed/blocked tool events as tool.call.failed. Thanks @ly-wang19.
• PR #95827 fix(plugin-sdk): bound live model catalog success body.
• PR #95792 fix(onboard): refresh provider plugin registry after setup installs. Related #95765. Thanks @snowzlmbot.
• PR #93943 fix(provider-usage): honor proxy env for usage fetch. Related #78714. Thanks @TurboTheTurtle and @TnzGit.
• PR #89648 fix(agents): restore model-fetch info logs. Related #89300. Thanks @xiaobao-k8s and @Enominera.
• PR #93841 fix(ui): render persisted history text blocks. Related #90241. Thanks @mushuiyu886 and @pronzcw.
• PR #93502 docs: fix docs metadata spellcheck. Thanks @harjothkhara.
• PR #86608 docs: add existing-solutions preflight guardrail. Thanks @cablackmon.
• PR #95322 fix(reply): preserve usage footer across rollover. Thanks @litang9.
• PR #91559 fix(agents): clean Gemini tool schemas by model id. Related #91542. Thanks @Pick-cat and @qiukui666.
• PR #94701 Fix embedded-run recovery after refreshed session activity. Thanks @imadal1n.
• PR #95472 [AI] fix(main-session): skip current-gen abort controllers for completed sessions. Thanks @xydt-tanshanshan.
• PR #95401 fix(lmstudio): canonicalize variant model keys. Thanks @MonkeyLeeT.
• PR #94323 fix(cron): stop add/remove from dropping a due recurring job's pending run. Thanks @yetval.
• PR #94443 fix(memory-wiki): retry transient source-page rewrite race instead of aborting wiki_status. Related #92134. Thanks @ZengWen-DT and @cknzraposo.
• PR #95120 feat(channels): add directUserId support for per-DM model override. Related #53638. Thanks @xydigit-zt and @thomaszta and @gandalf-at-lerian.
• PR #91049 fix: handle terminal chat send acknowledgements. Related #91048. Thanks @nxmxbbd.
• PR #95081 fix: keep text transform runtime imports hashed. Related #95057. Thanks @849261680 and @YvesLaRose.
• PR #93356 fix(plugins): cache plugin setup registry to kill the /models CPU storm. Thanks @obuchowski.
• PR #85341 refactor: internalize OpenClaw agent runtime.
• PR #94233 fix(model-fallback): coalesce auth decision logs. Related #56979. Thanks @goutamadwant and @yanan1991.
• PR #92399 fix(llm): collapse cumulative openai-responses message snapshots instead of concatenating [AI-assisted]. Related #91959. Thanks @amersheeny and @phoenixyy.
• PR #94811 fix(ollama): honor memory embedding output dimensionality. Thanks @mushuiyu886.
• PR #84708 fix(agents): recover message-tool mirror replay poison. Thanks @anyech.
• PR #95274 fix(memory): preserve Windows QMD command paths. Related #92302. Thanks @ly85206559 and @Ardooken.
• PR #95686 fix(xai): request encrypted reasoning include for all reasoning models. Thanks @geraint0923 and @fuller-stack-dev.
• PR #82909 fix(telegram): repair message cache reply types. Thanks @lidge-jun.
• PR #94942 fix(matrix): prune finished fake-indexeddb transactions to prevent OOM. Related #90455. Thanks @xzh-icenter and @yar-sh.
• PR #93994 fix(setup): point non-interactive health hints at onboard flags. Related #93947. Thanks @zhouhe-xydt and @NianJiuZst.
• PR #93956 fix(ollama): skip auto-discovery for remote/cloud base URLs. Thanks @jason-allen-oneal.
• PR #93547 fix(acp): recover stale persistent sessions by structured resume-required code [AI-assisted]. Related #87830. Thanks @amersheeny and @chouzz.
• PR #94204 fix(control-ui): rewrite manifest hrefs for configured base path. Related #94157. Thanks @hugenshen and @xrow.
• PR #95637 fix(qqbot): recognize GFM table separators with one or two dashes. Thanks @ly-wang19.
• PR #95467 fix(sessions): keep bound channel identity across non-delivery turns. Thanks @yetval.
• PR #93919 perf(plugins): cache existence probes within bundle manifest scan [AI-assisted]. Related #76209. Thanks @ml12580 and @shenhonglong456-ai.
• PR #94726 fix(google): add gemini-3.5-flash model catalog entry. Related #94723. Thanks @ajwan8998 and @anguslogan01.
• PR #94238 fix(config): fail closed when configure runs without an interactive TTY (#93953). Thanks @ruomuxydt and @NianJiuZst.
• PR #89949 fix(media): pin requester delivery route when task starts. Related #86034. Thanks @wangwllu and @tianxiaochannel-oss88.
• PR #94470 chore: sync yuanbao plugin catalog to 2.15.0. Thanks @jase-283.
• PR #93585 fix(daemon): keep systemd gateway running after child OOM. Thanks @snowzlm.
• PR #94442 fix(imessage): strip leading echo corruption markers in the persisted echo cache. Thanks @ly-wang19.
• PR #93511 fix(imessage): normalize leading NUL echo-cache prefixes. Thanks @vincentkoc and @ly-wang19.
• PR #87121 test(cli): add banner emission reset helper. Related #83903. Thanks @lizuju and @davinci282828.
• PR #89172 fix(feishu): show voice message duration via upload duration. Related #53798. Thanks @areslp and @kinrocW.
• PR #95118 fix: bound agents load their own inbound workspace context. Related #92903. Thanks @849261680 and @axjing.
• PR #94752 fix(reply): clarify stale model override resets. Related #94713. Thanks @snowzlmbot and @Gr4via.
• PR #89716 fix(providers): strip cache-boundary marker from non-Anthropic prompts. Thanks @masatohoshino.
• PR #95268 fix(openrouter): expand short canonical model IDs to upstream API slugs (fixes #95198). Thanks @Darren2030 and @daniel-alejandro-t.
• PR #90475 fix(telegram): keep bot reply answers anchored to current message. Thanks @moeedahmed.
• PR #94219 fix(control-ui): restore provider usage quota pill in sidebar session switcher (fixes #93041). Thanks @Pick-cat and @jazzroutine.
• PR #93369 fix(cron): expose per-job fallbacks in CLI. Related #90302. Thanks @849261680 and @Walliiee.
• PR #87912 Handle Codex toolResult blocks in tool-result truncation. Thanks @AdrianIp0204.
• PR #95744 fix(model-catalog): strip manifest model-id prefixes by the matched length. Related #95743. Thanks @parveshsaini.
• PR #95300 fix(cli): expose --count on infer image edit, matching image generate. Thanks @ly-wang19.
• PR #94156 fix: expose OpenAI image quality and moderation CLI options. Thanks @lastguru-net and @ly-wang19.
• PR #94062 fix(agents): classify generic "LLM request failed." as transient time…. Related #93931. Thanks @hugenshen and @hyphae-bot.
• PR #93965 fix(opencode-go): streaming completes when provider ends responses. Related #93610. Thanks @zhangguiping-xydt and @ForceConstant.
• PR #89017 fix(webchat): sessions persist after reconnects. Related #87700. Thanks @zhangguiping-xydt and @asicoe.
• PR #94627 fix(ios): centralize app accent colors. Thanks @zats.
• PR #94054 fix(gateway.tls): reject empty/whitespace certPath and keyPath. Thanks @miorbnli.
• PR #95674 fix(cron): trim trailing whitespace from recognized job object keys. Related #95407. Thanks @zw-xysk and @Nassiel.
• PR #95857 Fix SQLite user version guardrail allowlist. Thanks @RomneyDa.
• PR #95858 feat(qa): expose active memory toggles to scenarios. Thanks @RomneyDa.
• PR #84326 Doctor: expose sandbox registry findings. Thanks @giodl73-repo.
• PR #73079 fix(minimax): request hex TTS output explicitly. Thanks @efe-arv.
• PR #94483 feat(gateway-cli): scope usage-cost by agent. Thanks @ly-wang19.
• PR #91502 feat(qa): crabline channel driver. Thanks @RomneyDa.
• PR #95872 Move TUI PTY tests into CI node shard. Thanks @RomneyDa.
• PR #89800 fix(agents): resolve webchat current session status. Related #89773. Thanks @sweetcornna and @killo3967.
• PR #95870 fix(ci): restore macOS and Windows QA gates. Thanks @vincentkoc.
• PR #94445 fix(agents): keep cron cloud idle watchdog enabled. Thanks @bek91.
• PR #91506 fix(qa): reserve shared QA suite flags across runners. Thanks @RomneyDa.
• PR #95876 ci: add manual release QA profile evidence workflow. Thanks @RomneyDa.
• PR #95879 fix(ci): use workflow revision for proof checks. Thanks @vincentkoc.
• PR #93113 fix(memory-core): report active dreaming phases in status. Related #67868. Thanks @AgentArcLab and @mrossit.
• PR #95837 Simplify color mode button labels. Thanks @SannidhyaSah and @hannesrudolph.
• PR #95797 fix: /status is too verbose for pinned model sessions. Thanks @Solvely-Colin.
• PR #90223 test: make qqbot symlinked media helper test robust on Windows. Thanks @aniruddhaadak80.
• PR #95557 improve: refresh Android overview control surface. Thanks @Solvely-Colin and @joshavant.
• PR #95593 fix: route Android exec approvals to in-app inbox. Thanks @Solvely-Colin.
• PR #95570 fix(cli): resolve trajectory export stores consistently. Related #95568. Thanks @youngting520.
• PR #95880 ci: generalize QA profile evidence workflow. Thanks @RomneyDa.
• PR #95218 fix(agents): bound provider JSON response reads. Thanks @Alix-007.
• PR #95614 fix(memory-wiki): preserve human notes block on source re-ingest. Thanks @yetval.
• PR #95148 feat(android): add settings detail panels. Thanks @Tosko4.
• PR #95893 Add iOS push sandbox profiles and relay tooling. Thanks @joshavant.
• PR #95723 fix(control-ui): exclude disabled cron jobs from Overview failed count. Related #95716. Thanks @ZengWen-DT and @voytas75.
• PR #78715 Fix minor grammar issue in plugin documentation (capabilities plural). Thanks @mehrazmorshed.
• PR #95890 fix(ci): restore QA workflow gates. Thanks @vincentkoc.
• PR #95661 fix(discord): reserve closing-fence space on fence-closing lines. Thanks @ly-wang19.
• PR #94272 ci: add maturity scorecard renderer. Thanks @RomneyDa.
• PR #95901 ci: add maturity scorecard renderer. Thanks @RomneyDa.
• PR #95914 fix(whatsapp): preserve durable reply target. Thanks @mcaxtr.
• PR #95697 improve: reduce hot-path linear scans and redundant I/O. Thanks @vincentkoc.
• PR #95916 fix(memory): improve node:sqlite unavailable guidance. Thanks @vincentkoc and @rrrrrredy.
• PR #78884 docs: document local avatar file size limit. Related #65312. Thanks @wangjieweb3-design and @wraxle-geargrind.
• PR #95909 fix(ci): use available Android SDK platform. Thanks @vincentkoc.
• PR #68389 plugins: clarify allowlist warning when entries don't match discovered ids. Related #68352. Thanks @lyfuci and @JIRBOY.
• PR #95898 ci: simplify maturity scorecard QA evidence inputs. Thanks @RomneyDa.
• PR #95928 fix(ci): honor reusable QA evidence failure policy. Thanks @vincentkoc.
• PR #95508 fix #95489: [Bug]: claude-cli out-of-credits error bypasses model fallback chain — error text delivered as final response. Thanks @mikasa0818 and @sallyom and @riazrahaman.
• PR #95420 fix(agents): bound OpenRouter model catalog response reads. Thanks @Alix-007 and @sallyom.
• PR #95103 fix(gateway): bound pricing catalog streams. Thanks @vincentkoc and @sallyom.
• PR #95108 fix(agents): bound Anthropic error streams. Thanks @vincentkoc and @sallyom.
• PR #95418 fix(agents): bound OpenRouter model-scan catalog success body. Thanks @Alix-007.
• PR #95922 fix(ci): finalize testbox sessions after setup failures. Thanks @vincentkoc.
• PR #95417 fix(agents): bound Google prompt cache response reads. Thanks @Alix-007.
• PR #95935 fix(whatsapp): resolve approval reactions across JID drift. Thanks @mcaxtr.
• PR #84340 Doctor: expose extra gateway service findings. Thanks @giodl73-repo.
• PR #95946 fix(ci): finalize Windows Testbox after setup failures. Thanks @vincentkoc.
• PR #95947 feat(qa): add "all" taxonomy profile. Thanks @RomneyDa.
• PR #91903 feat(plugin-sdk): add extensible channel identity hook context. Thanks @lanzhi-lee and @vincentkoc.
• PR #95930 docs(copilot): refresh harness parity notes. Thanks @vincentkoc.
• PR #95952 fix(ci): require QA live evidence artifacts. Thanks @vincentkoc.
• PR #95666 Fix memory-wiki bridge self-import loop. Related #95657. Thanks @TurboTheTurtle and @vincentkoc and @Johannes0402.
• PR #91724 fix(agents): infer runtime provider from qualified model ids. Thanks @yu-xin-c and @vincentkoc.
• PR #95957 improve: speed up provider tool-call streaming. Thanks @vincentkoc.
• PR #95541 fix(cli): show working commands for pinned plugin drift. Thanks @ooiuuii and @vincentkoc.
• PR #95933 docs: update maturity scorecard. Thanks @RomneyDa.
• PR #78105 fix(plugins): make empty-allowlist actionable for new users. Related #68780. Thanks @pahuchi-joe and @JIRBOY.
• PR #95961 fix(ci): require live proof evidence artifacts. Thanks @vincentkoc.
• PR #95400 fix(model-fallback): classify Codex usage-limit payloads. Thanks @jason-allen-oneal and @sallyom.
• PR #95944 perf(qa-lab): speed up unified QA suites. Thanks @RomneyDa.
• PR #95971 ci: fail QA profile evidence on QA failures. Thanks @RomneyDa.
• PR #95845 feat: add bundled plugin icon manifest URLs. Thanks @Patrick-Erichsen.
• PR #95975 fix(ci): require iOS Periphery evidence artifact. Thanks @vincentkoc.
• PR #95972 docs: update ClawHub skill route references. Thanks @Patrick-Erichsen.
• PR #90537 Warn on generated wrapper overwrites and status diagnostics. Related #90518. Thanks @TurboTheTurtle and @vincentkoc.
• PR #93567 fix(cron): normalize run-log jobId on write to match read-side validation. Thanks @Alix-007 and @vincentkoc.
• PR #95967 perf(ci): widen main test fanout and move codeql off blacksmith. Thanks @vincentkoc.
• PR #95983 fix(ci): require OpenGrep SARIF artifacts. Thanks @vincentkoc.
• PR #64490 CLI: escape zsh completion descriptions. Thanks @EdenKangdw.
• PR #95682 Fix Gemini day freshness time range handling. Thanks @Sunjae-k and @vincentkoc.
• PR #93374 fix(agents): suggest recovery for unknown tool ids. Related #92273. Thanks @mushuiyu886 and @vincentkoc and @poison.
• PR #95991 fix(ci): require release QA evidence artifacts. Thanks @vincentkoc.
• PR #89886 fix(context-engine): forward abortSignal through delegation bridge to runtime compaction. Related #89868. Thanks @openperf and @vincentkoc and @lykeion-dev.
• PR #95999 fix(release): require postpublish evidence artifact. Thanks @vincentkoc.
• PR #96003 test(qa): harden all-profile QA evidence scenarios. Thanks @RomneyDa.
• PR #95860 fix(compaction): trim prefix when transcript ends in an oversized tool result. Related #78478. Thanks @yetval and @wzhgba.
• PR #95934 fix(xiaomi): correct mimo-v2.5 and mimo-v2.5-pro max output tokens to 128K. Thanks @idootop.
• PR #95782 fix(sessions): honor configured store for outbound transcript mirrors. Related #95781. Thanks @youngting520.
• PR #96005 feat(copilot): wire harness parity helpers. Thanks @vincentkoc.
• PR #95886 fix: avoid false macOS update failures during gateway shutdown. Thanks @fuller-stack-dev.
• PR #91906 perf: skip subagent live stream parsing. Thanks @lanzhi-lee.
• PR #87861 fix(model-usage): coerce numeric-string costs and ignore non-finite values. Related #37878. Thanks @coder999999999 and @vincentkoc and @shuofengzhang.
• PR #96030 fix(qa-lab): avoid duplicate child evidence files. Thanks @RomneyDa.
• PR #94369 fix(memory-wiki): exclude durable reference pages from stale report. Thanks @SunnyShu0925 and @vincentkoc.
• PR #94578 Fix recent session resume with long headers. Related #94577. Thanks @rohitjavvadi and @vincentkoc.
• PR #95919 ci: add Codex maturity scorecard agent. Thanks @RomneyDa.
• PR #92356 fix(heartbeat): skip reasoning payloads when selecting heartbeat reply. Related #92260. Thanks @tangtaizong666 and @vincentkoc and @jmpei.
• PR #94328 fix(agents): keep post-compaction user re-issue of a kept-tail prompt during compaction rotation. Thanks @yetval and @vincentkoc.
• PR #95432 fix(reply): suppress per-message finals across multi-message block streaming. Thanks @yetval and @vincentkoc.
• PR #95431 fix(auto-reply): keep drain/restart-abort reply paths silent. Thanks @moeedahmed and @vincentkoc.
• PR #96017 test(qa): gate maturity docs on passing evidence. Thanks @RomneyDa.
• PR #95552 feat(mattermost): persist participated threads for mention-free follow-ups. Thanks @amknight.
• PR #95480 fix #89231: [Bug]: Windows installer-created scheduled task launches gateway.cmd with visible console — should use windowless launcher. Thanks @mikasa0818 and @vincentkoc and @CameronWeller.
• PR #96049 fix(copilot): preserve compaction metadata. Thanks @vincentkoc.
• PR #96044 docs: rename top maturity tier to Clawesome. Thanks @RomneyDa.
• PR #92154 Gate private QQBot group commands. Thanks @sliverp.
• PR #95484 fix: assistant reply lost between compaction summary and first kept user in successor transcript. Related #76729. Thanks @maweibin and @vincentkoc and @njuboy11.
• PR #95094 ci: add release QA profile evidence. Thanks @RomneyDa.
• PR #96057 docs: redesign maturity scorecard pages. Thanks @vincentkoc.
• PR #96014 perf(agents): index displaced tool results. Thanks @vincentkoc.
• PR #96019 perf(usage): bound session log retention. Thanks @vincentkoc.
• PR #96013 perf(anthropic): index active stream blocks. Thanks @vincentkoc.
• PR #96061 docs: place maturity pages under release reference. Thanks @vincentkoc.
• PR #95589 fix: npm plugin updates break running gateway imports. Thanks @ooiuuii and @vincentkoc.
• PR #96068 fix(acpx): consume acpx 0.11.1 model capability errors. Related #95869. Thanks @vincentkoc and @SabaTech-dev.
• PR #89912 refactor: add transcript update identity contract. Thanks @jalehman.
• PR #96055 fix(maint): use rebase PR landing. Thanks @vincentkoc.
• PR #96062 feat(copilot): mirror native plan and subagent events. Thanks @vincentkoc.
• PR #96032 fix(acpx): detect wrapper orphan on any PPID change, not just init reparenting. Thanks @t2wei and @vincentkoc.
• PR #96124 chore(acpx): bump bundled client to 0.11.2. Thanks @vincentkoc.
• PR #84352 Fix WebChat dispatch failure session status. Thanks @jesse-merhi.
• PR #89518 refactor: migrate plugin transcript mirrors. Thanks @jalehman.
• PR #90439 refactor: add embedded run session target seam. Thanks @jalehman.
• PR #95699 perf(gateway): drop redundant per-access session-key case scan. Thanks @jzakirov and @jalehman.
• PR #95992 fix(skills): accept owner-qualified verify refs. Thanks @Patrick-Erichsen.
• PR #95987 fix(plugins): remove Simple Icons color paths. Thanks @Patrick-Erichsen.
• PR #96162 refactor: use accessor-backed transcript corpus for memory. Thanks @jalehman.
• PR #96181 Defer iOS local network permission until onboarding. Thanks @joshavant.
• PR #95475 test(cli): isolate service env in run and update suites. Thanks @kklouzal.
• PR #95226 fix(infra): bound ClawHub fetchJson and error response bodies. Thanks @Alix-007.
• PR #95240 fix(matrix): bound non-raw JSON response body in transport. Thanks @Alix-007.
• PR #91742 fix(memory): abort orphaned embedding work when memory_search times out. Related #91718. Thanks @dreamhunter2333 and @NOVA-Openclaw.
• PR #93394 fix(memory): abort orphaned qmd search subprocess when memory_search times out. Thanks @Alix-007.
• PR #89911 refactor: migrate bundled transcript target lookups. Thanks @jalehman.
• PR #96191 refactor: route plugin host hook state through accessor. Thanks @jalehman.
• PR #96179 fix: route gateway history through session accessor target. Thanks @jalehman.
• PR #96201 refactor: add abort target session accessor. Thanks @jalehman.
• PR #96193 fix(memory-core): migrate dreaming cleanup lifecycle. Thanks @jalehman.
• PR #96195 fix: bridge ACP metadata to session accessors. Thanks @jalehman.
• PR #96182 refactor: migrate agent session accessors. Thanks @jalehman.
• PR #96218 refactor: guard reply session initialization. Thanks @jalehman.
• PR #96213 refactor(gateway): add alias mutation accessor. Thanks @jalehman.
• PR #96204 refactor: migrate command session persistence to accessor. Thanks @jalehman.
• PR #96206 refactor: route live model fresh reads through session accessor. Thanks @jalehman.
• PR #96220 fix(whatsapp): quote current follow-up in durable replies. Thanks @mcaxtr.
• PR #96226 fix(macos): drop Textual from chat packaging. Thanks @vincentkoc.
• PR #96212 fix(codex): deliver generated images from remote app-server. Thanks @sjf-oa.
• PR #96235 fix(crabbox): require Xcode for macOS proof. Thanks @vincentkoc.
• PR #96145 fix: UI glitch: config is not visible. Related #94202. Thanks @sunlit-deng and @vporton.
• PR #96072 perf(browser): index role snapshot references. Thanks @vincentkoc.
• PR #96085 perf(codex): index rollout transcript ids. Thanks @vincentkoc.
• PR #96087 perf(reply): hoist direct-send fragment index. Thanks @vincentkoc.
• PR #94154 fix(gateway): resolve plugin-registered gateway methods through live registry. Related #94127. Thanks @Pick-cat and @vincentkoc and @BryceMurray.
• PR #95393 fix #92582: Bug: doctor falsely warns local memory embeddings are not ready. Thanks @mikasa0818 and @vincentkoc and @neekolascmd.
• PR #96246 fix(qa): accept pnpm separator for lab up. Thanks @vincentkoc.
• PR #94949 fix(ports): route isPortBusy through checkPortInUse to catch IPv4-only occupants. Related #94426. Thanks @sunlit-deng and @vincentkoc and @wangwllu.
• PR #94562 fix(workboard): hide archived cards in CLI list by default. Related #94555. Thanks @ZengWen-DT and @vincentkoc and @ecican.
• PR #96243 fix(nextcloud-talk): ignore signed non-message webhook events. Related #81566. Thanks @arkyu2077 and @vincentkoc and @rafaelmgbh.
• PR #96140 fix(exec): preserve turn-source routing target in approval followups for plugin channels. Related #96103. Thanks @yetval and @vincentkoc and @lansenger-pm.
• PR #96258 ci: move CodeQL quality scans to hosted runners. Thanks @vincentkoc.
• PR #96271 chore(release): close out 2026.6.10 on main. Thanks @vincentkoc.
• PR #96233 fix(agents): run heartbeatpromptcontribution on harness prompt builds. Thanks @azogheb and @vincentkoc.
• PR #55018 fix: avoid O(N²) shallow-copy in mapSensitivePaths schema traversal. Thanks @xdhuangyandi and @vincentkoc and @huangyandi-red.
• PR #95831 fix: compact Codex OAuth OpenAI sessions without API keys. Related #95693. Thanks @sallyom and @YUI-TIEN.
• PR #96244 fix(auto-reply): align channel intro wording with chat_type. Related #95645. Thanks @arkyu2077 and @vincentkoc and @iloveleon19.

Release verification

• npm package: https://www.npmjs.com/package/openclaw/v/2026.6.11-beta.1
• release SHA: c862a644bff366599ead53df81f452aa913497ae
• full release validation: https://github.com/openclaw/openclaw/actions/runs/28123941058
• npm preflight: https://github.com/openclaw/openclaw/actions/runs/28130211221
• npm publish: https://github.com/openclaw/openclaw/actions/runs/28136271139
• ClawHub follow-up: four existing code-plugin family conflicts and the pre-claimed tencent id remain in the child publish runs; OpenClaw npm and GitHub beta publication are unaffected.

2026.6.10

Highlights

• Automatic fast mode for talks: OpenClaw can enable fast mode for short conversational turns, then return to normal mode for longer runs with bounded fallback and delivery behavior. (#85104) Thanks @alexph-dev and @vincentkoc.
• More reliable model routing: Zai model synthesis, GLM overload failover, and native reasoning-level selection now follow the active model catalog more consistently. (#94461, #93241, #94067, #94136) Thanks @Pandah97, @chrysb, @0xghost42, @zhengli0922, @openperf, @civiltox, and @BorClaw.
• Safer session and channel state: channel switches reset stale origin fields, and cron delivery awareness stays attached to the target session. (#95328, #93580) Thanks @ZengWen-DT, @jalehman, @gorkem2020, and @scotthuang.
• Trusted policies survive hook composition: composed hook registries keep the trusted tool policies required by approval-sensitive flows. (#94545) Thanks @jesse-merhi.

Changes

• Agent and channel runtime: fast-mode state now survives retries, fallback transitions, progress events, and embedded/CLI/ACP normalization; session and channel routing retain the current target and delivery context. (#85104, #93580, #95328) Thanks @alexph-dev, @vincentkoc, @scotthuang, @ZengWen-DT, @jalehman, and @gorkem2020.
• Provider behavior: model catalogs now supply the correct Zai base URL, overload classification, and native reasoning controls for live-discovered models. (#94461, #93241, #94067, #94136) Thanks @Pandah97, @chrysb, @0xghost42, @zhengli0922, @openperf, @civiltox, and @BorClaw.

Fixes

• Fast-mode and policy correctness: fallback cutoffs and reset notices are bounded, repeated progress events remain visible, Codex service-tier state is normalized, and trusted policies are not lost when hook registries are composed. (#85104, #94545) Thanks @alexph-dev, @vincentkoc, and @jesse-merhi.
• Model and delivery edge cases: Zai and GLM failover paths use the right runtime metadata, while stale channel-origin state no longer leaks across session changes. (#94461, #93241, #95328) Thanks @Pandah97, @chrysb, @0xghost42, @zhengli0922, @ZengWen-DT, @jalehman, and @gorkem2020.

Complete contribution record

This audited record covers the complete v2026.6.9..HEAD history: 11 merged PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact.

Pull requests

• PR #86627 Keep core doctor health in contribution order. Thanks @giodl73-repo.
• PR #93580 fix: preserve cron delivery awareness for target sessions. Thanks @scotthuang and @jalehman.
• PR #95030 refactor: add SDK transcript identity target API. Thanks @jalehman.
• PR #94838 refactor(copilot): complete harness lifecycle parity. Thanks @vincentkoc.
• PR #95328 fix(sessions): reset stale per-channel origin fields on channel switch. Related #95325. Thanks @ZengWen-DT and @jalehman and @gorkem2020.
• PR #94461 fix(zai): fall back to manifest baseUrl for synthesized GLM-5 models. Related #94269. Thanks @Pandah97 and @chrysb.
• PR #93241 fix(agents): classify Zhipu GLM overload as overloaded for failover. Related #93211. Thanks @0xghost42 and @zhengli0922.
• PR #94067 fix(channels): resolve native /think menu levels via runtime catalog for live-discovered models. Related #93835. Thanks @openperf and @civiltox.
• PR #94136 fix(zai): expose GLM-5.2 reasoning levels [AI-assisted]. Thanks @BorClaw.
• PR #85104 feat: fast talks auto mode. Related #85087. Thanks @alexph-dev.
• PR #94545 fix: keep trusted policies with hook registry. Thanks @jesse-merhi.

Release verification

• npm package: https://www.npmjs.com/package/openclaw/v/2026.6.10-beta.2
• registry tarball: https://registry.npmjs.org/openclaw/-/openclaw-2026.6.10-beta.2.tgz
• integrity: sha512-fOz52YzVw3MhQjQ5qqfPsfSbaMWOM62DNCxDsO/wZXvgvgrqPdZuNEPQokjFX9J7QXDeidl2uMBCnXRxynMzRg==
• release SHA: 87b40c7160da1e9d470f86520f64ff1642a55b66
• full release CI report: https://github.com/openclaw/releases/blob/main/evidence/2026.6.10-beta.2/release-evidence.md
• release publish: https://github.com/openclaw/openclaw/actions/runs/27942155128
• npm preflight: https://github.com/openclaw/openclaw/actions/runs/27938779493
• full release validation: https://github.com/openclaw/openclaw/actions/runs/27938779833
• plugin npm publish: https://github.com/openclaw/openclaw/actions/runs/27942563340
• plugin ClawHub publish: https://github.com/openclaw/openclaw/actions/runs/27942565547
• plugin ClawHub bootstrap: not needed
• OpenClaw npm publish: https://github.com/openclaw/openclaw/actions/runs/27943117132
• npm Telegram beta E2E: https://github.com/openclaw/openclaw/actions/runs/27941744910

Highlights

• More reliable agent turns and session state: OpenClaw now preserves pending subagent completion announcements, keeps chat history transcripts non-empty, maintains media index alignment, restarts dormant follow-up drains, and resolves compaction model aliases consistently. (#94349, #92383, #94257, #95039, #90885) Thanks @sallyom, @oiGaDio, @Hidetsugu55, @Nas01010101, @SFVVC, @Pick-cat, and @vincentkoc.
• Stronger Codex and approval flows: Codex app-server SecretRefs, thread context, bounded turn text, routed approval context, and typed SDK approval/session helpers now work together more predictably. (#94093, #94324, #94756, #90918, #95144, #95188, #95196, #95169) Thanks @VACInc, @kevinlin-openai, @kevinslin, @Nas01010101, @849261680, @choury, and @vincentkoc.
• Richer channel delivery: Telegram, Discord, and Slack now preserve richer progress/reasoning/thread output, handle structured send errors, support Slack shortcuts, and record canonical sent threads more reliably. (#94891, #94856, #94810, #95029, #94881, #78536, #95250) Thanks @obviyus, @zhangqueping, @jairrab, @ZOOWH, @parveshsaini, @vincentkoc, @Marvinthebored, @chrisbaker2000, @KennanHoa, @bek91, and @rockyloveswine.
• Safer release and network boundaries: SSH tunnel preflight is loopback-scoped, device-backed node pairings are removed, volatile SQLite state is surfaced by doctor, and legacy Codex routes are repaired instead of silently persisting stale state. (#94607, #90373, #94725, #94478) Thanks @wangwllu, @Alix-007, @manju-rn, @vincentkoc, @TurboTheTurtle, and @Sleepyarno.
• Useful new CLI and status workflows: Rename sessions from chat, compact sessions explicitly, show session duration, preserve command progress detail, and preview message sends/polls with dry-run output. (#88581, #91378, #88988, #94868, #94684) Thanks @BSG2000, @Alix-007, @sallyom, @redasadki, @marshall-gordfam, @vincentkoc, @lzyyzznl, and @YB0y.
• More capable mobile and desktop clients: Android settings are grouped by intent, iOS notification state is cleaner, the Watch app uses the Xcode 27-compatible target layout, and macOS file inputs open through the native panel. (#94539, #91923, #92477, #94612) Thanks @Tosko4, @zats, @joshavant, @bbblending, @DINGDANGMAOUP, and @vincentkoc.
• Broader plugin and skill coverage: Zalo is available as an external channel entry, Trello skills declare their curl dependency, stale managed skill links are retargeted, and tool discovery no longer clears active providers. (#89586, #94729, #86719, #93276) Thanks @ken-kuro, @liuhao1024, @berkgungor, @stevenepalmer, @shakkernerd, @medns, and @vincentkoc.

Changes

• Agent and provider behavior: Codex turn limits, CLI-owned auth, provider-internal error wording, recurring cron backoff, explicit cron delivery targets, and isolated cron key requirements now fail or recover more clearly. (#94756, #88551, #94737, #93051, #94453, #92318, #91685) Thanks @Nas01010101, @yu-xin-c, @snowzlmbot, @Alix-007, @jincheng-xydt, @sallyom, @davectr, @hxy91819, @nxmxbbd, and @vincentkoc.
• Channels and integrations: WhatsApp retries the opening text chunk after media failure, Feishu avoids axios internals, Slack records inbound mentions and preserves buffered streams, and external Zalo/Slack shortcuts are wired through the current channel seams. (#93823, #89806, #94790, #78536, #89586, #94881) Thanks @yetval, @sweetcornna, @davinci282828, @ZengWen-DT, @BryceMurray, @vincentkoc, @KennanHoa, @ken-kuro, and @chrisbaker2000.
• Skills and setup: OnePassword auth no longer forces tmux when the desktop app is available, stale plugin skill symlinks are repaired, and Trello requirements match their examples. (#81825, #86719, #94729) Thanks @koshaji, @tylerbittner, @stevenepalmer, @shakkernerd, @liuhao1024, @berkgungor, and @vincentkoc.
• Apps and platform support: iOS notification cleanup, the single-target Watch migration, Android intent grouping, native macOS file panels, and explicit realtime SDP bounds keep the app surfaces aligned with the Gateway. (#91923, #92477, #94539, #94612, #95093) Thanks @zats, @joshavant, @Tosko4, @bbblending, @DINGDANGMAOUP, and @vincentkoc.
• Operator diagnostics: Gateway probes now distinguish reachable-but-errored from unreachable, plugin methods authorize through the attached registry, session status exposes duration, and provider pricing streams are bounded. (#93948, #94343, #88988, #95103) Thanks @xialonglee, @MAdArab872, @wangmiao0668000666, @RDavies8, @Alix-007, @marshall-gordfam, @vincentkoc, @ozthedivine, and @shakkernerd.

Fixes

• Reply and transcript correctness: OpenClaw now keeps pending completions, non-empty histories, media fields, queued follow-ups, buffered Slack replies, and reasoning deliveries intact across retries and partial turns. (#94349, #92383, #94257, #95039, #78536, #95029, #84292) Thanks @sallyom, @oiGaDio, @Hidetsugu55, @Nas01010101, @SFVVC, @vincentkoc, @KennanHoa, @Marvinthebored, @zerone0x, and @pearl-dot.
• Security and bounded input handling: SSH tunnel checks stay on loopback, unsafe chat/tool/package/response lengths are rejected, device-backed pairings are removed, and stale abort markers no longer affect fresh chat events. (#94607, #95066, #95078, #95085, #95090, #90373, #91013) Thanks @wangwllu, @vincentkoc, @Alix-007, @manju-rn, and @nxmxbbd.
• Telegram, WhatsApp, and Slack delivery: Rich progress previews, structured Telegram errors, WhatsApp listener recovery, and canonical Slack thread/send behavior now survive the edge cases covered by the new release. (#94891, #94856, #94810, #93873, #95250) Thanks @obviyus, @zhangqueping, @jairrab, @ZOOWH, @parveshsaini, @xialonglee, @octaivermatt, @bek91, and @rockyloveswine.
• Cron and queue safety: Recurring error backoff honors configured floors, implicit isolated delivery requires an explicit target, and dormant follow-up drains restart instead of disappearing. (#93051, #91685, #92318, #95039) Thanks @Alix-007, @nxmxbbd, @hxy91819, and @SFVVC.
• Provider, auth, and migration repair: CLI-owned transports skip the wrong auth gate, compaction aliases resolve canonically, legacy Codex routes are repaired, and tool discovery no longer clears active providers. (#88551, #90885, #94478, #93276) Thanks @yu-xin-c, @Pick-cat, @TurboTheTurtle, @Sleepyarno, @medns, and @vincentkoc.
• SDK and release tooling: Approval/session RPC params are typed more strictly, stale packed tarballs are ignored, and DMG output directories are created reliably. (#95144, #95152, #95188, #95196, #95169, #95126, #95133) Thanks @vincentkoc.

Complete contribution record

This audited record covers the complete v2026.6.9-beta.1..HEAD history: 109 merged PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact.

Pull requests

• PR #93685 refactor(auto-reply): add lifecycle storage seams. Thanks @jalehman.
• PR #94349 fix(agents): preserve pending subagent completion announces. Related #93323. Thanks @sallyom and @oiGaDio.
• PR #93174 test: fold channel message flows into qa e2e. Thanks @RomneyDa.
• PR #94093 Prevent Codex thread rotation from losing next-step context. Thanks @VACInc.
• PR #53920 fix(scripts): avoid mutating tracked auth-monitor template during setup. Thanks @JackWuGlobal.
• PR #94702 Standardize QA coverage IDs on dotted names. Thanks @RomneyDa.
• PR #81825 fix(skills/1password): stop forcing tmux for desktop app auth (#52540). Thanks @koshaji and @tylerbittner.
• PR #94725 fix(doctor): warn on volatile SQLite state. Thanks @vincentkoc.
• PR #88551 fix(agents): skip auth gate for CLI-owned transport. Thanks @yu-xin-c.
• PR #88581 feat(commands): add /name to rename the current session from chat. Thanks @BSG2000.
• PR #94324 feat(codex): support app-server SecretRefs. Thanks @kevinlin-openai and @kevinslin.
• PR #90882 fix: add self-knowledge docs rule to system prompt. Related #90713. Thanks @SutraHsing.
• PR #94684 fix: #80507 show dry-run output for message send/poll. Thanks @lzyyzznl and @YB0y.
• PR #93823 fix(whatsapp): keep opening text chunk when first media fails on multi-chunk reply. Thanks @yetval.
• PR #89203 refactor: route SDK session compatibility through seam. Thanks @jalehman.
• PR #94453 fix: default cron runMode to "due" instead of "force" (#94270). Thanks @jincheng-xydt and @sallyom and @davectr.
• PR #94746 fix(note): prevent clack from re-breaking copy-sensitive tokens. Related #94730. Thanks @xzh-icenter and @berkgungor.
• PR #89904 refactor: route sdk session compatibility through accessor. Thanks @jalehman.
• PR #86719 fix(skills): retarget stale plugin skill symlinks. Related #85925. Thanks @stevenepalmer and @shakkernerd.
• PR #94337 fix(tui): show 0 not ? for fresh-session context tokens in footer. Thanks @mushuiyu886.
• PR #94539 fix(android): group settings by intent. Thanks @Tosko4.
• PR #92383 fix(gateway): never return an empty chat.history transcript. Thanks @Hidetsugu55.
• PR #92574 test(browser): cover action-input CLI request bodies. Related #83877. Thanks @yu-xin-c and @davinci282828.
• PR #92873 test(diffs): add viewerState, toolbar toggle, shadow root, and hydrateProps tests (fixes #83915). Thanks @liuhao1024 and @davinci282828.
• PR #94257 fix(sessions): preserve Media\* index alignment when reading user-turn fields. Thanks @Nas01010101.
• PR #94756 fix(codex): bound turn/start text when context budget is non-positive. Related #94748. Thanks @Nas01010101.
• PR #94729 fix(skills/trello): add curl to requires.bins to match body examples (fixes #94727). Thanks @liuhao1024 and @berkgungor.
• PR #94790 feat(slack): log INFO receipt for inbound app_mention events. Related #94691. Thanks @ZengWen-DT and @BryceMurray.
• PR #81696 fix: guard tool event callbacks (AI-assisted). Thanks @enjoylife1243.
• PR #94809 chore: forward-port alpha release fixes.
• PR #94612 fix(macos): open NSOpenPanel for embedded Control UI file inputs (#94468). Thanks @bbblending and @DINGDANGMAOUP.
• PR #89806 fix(feishu): avoid axios interceptor internals. Related #83913. Thanks @sweetcornna and @davinci282828.
• PR #91923 fix(ios): clean up notification settings state. Thanks @zats.
• PR #91345 fix: suggest close CLI commands. Related #83999. Thanks @glenn-agent and @HannesOberreiter.
• PR #94561 Add stdout diagnostics OTEL log exporter. Thanks @jesse-merhi.
• PR #91013 fix(gateway): ignore stale abort markers for fresh chat events. Related #91012. Thanks @nxmxbbd.
• PR #89279 fix(tasks): deliver ACP completions to bound Discord threads. Related #84022. Thanks @anyech and @h-mascot.
• PR #91656 test(cron): expand parseAbsoluteTimeMs test coverage to 39 cases. Related #91654. Thanks @SpecialLeon.
• PR #94810 fix(telegram): classify sendChatAction 401 by structured error_code, not bare substring match. Related #94787. Thanks @ZOOWH and @parveshsaini.
• PR #94737 fix(reply): clarify provider internal error copy. Thanks @snowzlmbot.
• PR #94868 fix(channels): preserve command progress detail. Thanks @vincentkoc.
• PR #94891 fix(telegram): send progress previews as html text. Thanks @obviyus.
• PR #94683 fix(outbound): keep direct-only targets out of group sessions. Related #92384. Thanks @scotthuang and @haiwei01.
• PR #92477 fix: migrate watch app to single-target app (Xcode 27+ compat). Thanks @zats and @joshavant.
• PR #94812 test(perf): compare saved CLI startup benchmarks. Thanks @FelixIsaac.
• PR #94856 fix(telegram): normalize all HTML tables before entity-escaping in rich messages. Related #94317. Thanks @zhangqueping and @jairrab.
• PR #91685 fix(cron): refuse keyless implicit isolated cron delivery inherited from shared agent-main bucket. Thanks @nxmxbbd.
• PR #88988 feat(status): show session duration in footer. Related #68226. Thanks @Alix-007 and @marshall-gordfam.
• PR #94020 docs(browser): resolve networkidle contradiction across browser docs. Related #80587. Thanks @ZengWen-DT and @esqandil.
• PR #93948 fix(gateway): distinguish reachable-but-errored from unreachable in probe diagnostics. Related #79099. Thanks @xialonglee and @ozthedivine.
• PR #93276 fix(plugins): stop tool-discovery loads from clearing active providers. Thanks @medns.
• PR #94343 fix(gateway): authorize plugin methods from attached registry. Related #92044. Thanks @wangmiao0668000666 and @RDavies8.
• PR #94589 fix(channels): stop duplicating inbound previews in system events. Related #94549. Thanks @hugenshen and @gorkem2020.
• PR #93873 fix(whatsapp): restart listener on selfChatMode config change. Related #86888. Thanks @xialonglee and @octaivermatt.
• PR #93969 fix(xai): reject unsupported multi-agent model refs before runtime fallback. Related #85106. Thanks @xialonglee and @tess020126-cmyk.
• PR #89586 feat(channels): add Zalo ClawBot external channel entry and documenta…. Thanks @ken-kuro.
• PR #78536 fix(slack): preserve buffered thread stream replies. Related #78061. Thanks @vincentkoc and @KennanHoa.
• PR #89236 fix(slack): default member-info userId to inbound sender. Thanks @stroupaloop.
• PR #94881 feat(slack): handle global and message shortcuts. Related #63920. Thanks @chrisbaker2000.
• PR #90885 fix(agent): resolve compaction model alias to canonical model ref. Thanks @Pick-cat.
• PR #90918 fix(agents): forward turn-source routing fields to plugin.approval.request. Related #74003. Thanks @849261680 and @choury.
• PR #95029 fix(discord): deliver reasoning replies. Related #94936. Thanks @vincentkoc and @Marvinthebored.
• PR #89581 refactor: use canonical transcript reader identity. Thanks @jalehman.
• PR #94607 fix(ssh): scope tunnel port preflight to loopback (#94603). Thanks @wangwllu.
• PR #95060 fix(test): harden script probe bounds. Thanks @vincentkoc.
• PR #95066 fix(e2e): reject unsafe chat tools body lengths. Thanks @vincentkoc.
• PR #93941 docs: fix two broken cross-reference anchors. Thanks @Alix-007.
• PR #92996 fix(cli): reject present-but-invalid --timeout on status/health fast path. Thanks @Alix-007.
• PR #94314 refactor(policy): split doctor modules. Thanks @giodl73-repo.
• PR #93051 fix(cron): honor configured retry.backoffMs for recurring error backoff floor. Thanks @Alix-007.
• PR #95078 fix(scripts): reject unsafe package download lengths. Thanks @vincentkoc.
• PR #91378 feat(cli): add openclaw sessions compact and fail loudly on CLI /compact (fixes #90640). Thanks @Alix-007 and @sallyom and @redasadki.
• PR #94676 improve: simplify PR context and evidence. Thanks @hannesrudolph.
• PR #95085 fix(scripts): reject unsafe bounded response lengths. Thanks @vincentkoc.
• PR #95090 fix(e2e): reject unsafe bounded response text lengths. Thanks @vincentkoc.
• PR #95076 [codex] docs: clarify PR body evidence updates. Thanks @brokemac79.
• PR #84292 fix(agents): preserve delivered message send results. Related #84271. Thanks @zerone0x and @pearl-dot.
• PR #95039 fix(queue): restart dormant followup drains. Related #91909. Thanks @SFVVC.
• PR #90373 fix(gateway): remove device-backed node pairings. Related #88488. Thanks @Alix-007 and @manju-rn.
• PR #95093 fix(dev): bound realtime SDP answer reads. Thanks @vincentkoc.
• PR #95103 fix(gateway): bound pricing catalog streams. Thanks @vincentkoc.
• PR #95108 fix(agents): bound Anthropic error streams. Thanks @vincentkoc.
• PR #95111 fix(memory): abort batch upload response reads. Thanks @vincentkoc.
• PR #95105 fix(ci): cancel stale Testbox PR runs. Thanks @RomneyDa.
• PR #95114 fix(test): stabilize tooling guard probes. Thanks @vincentkoc.
• PR #94478 fix(doctor): repair legacy Codex route persistence. Related #94184. Thanks @TurboTheTurtle and @Sleepyarno.
• PR #95119 fix(test): stream QA Lab stdout artifacts. Thanks @vincentkoc.
• PR #95116 fix(ci): cancel stale CodeQL runs. Thanks @RomneyDa.
• PR #95126 fix(package): ignore stale packed tarballs. Thanks @vincentkoc.
• PR #95133 fix(macos): create DMG output directories. Thanks @vincentkoc.
• PR #95137 test(docker): stabilize build signal probe. Thanks @vincentkoc.
• PR #95144 fix(sdk): send exec approval resolve id. Thanks @vincentkoc.
• PR #95152 fix(sdk): list helpers work without filters. Thanks @vincentkoc.
• PR #95207 fix(scripts): preserve kitchen sink RPC request errors. Thanks @vincentkoc.
• PR #95203 fix(scripts): guard reused testbox keys. Thanks @vincentkoc.
• PR #95188 fix(sdk): type agent mutation RPC params. Thanks @vincentkoc.
• PR #95196 fix(sdk): tighten approval response params. Thanks @vincentkoc.
• PR #95169 fix(sdk): require session key for effective tools. Thanks @vincentkoc.
• PR #95250 fix(slack): record canonical sent thread. Related #95235. Thanks @bek91 and @rockyloveswine.
• PR #86627 Keep core doctor health in contribution order. Thanks @giodl73-repo.
• PR #93580 fix: preserve cron delivery awareness for target sessions. Thanks @scotthuang and @jalehman.
• PR #95030 refactor: add SDK transcript identity target API. Thanks @jalehman.
• PR #94838 refactor(copilot): complete harness lifecycle parity. Thanks @vincentkoc.
• PR #95328 fix(sessions): reset stale per-channel origin fields on channel switch. Related #95325. Thanks @ZengWen-DT and @jalehman and @gorkem2020.
• PR #94461 fix(zai): fall back to manifest baseUrl for synthesized GLM-5 models. Related #94269. Thanks @Pandah97 and @chrysb.
• PR #93241 fix(agents): classify Zhipu GLM overload as overloaded for failover. Related #93211. Thanks @0xghost42 and @zhengli0922.
• PR #94067 fix(channels): resolve native /think menu levels via runtime catalog for live-discovered models. Related #93835. Thanks @openperf and @civiltox.
• PR #94136 fix(zai): expose GLM-5.2 reasoning levels [AI-assisted]. Thanks @BorClaw.
• PR #92318 fix(cron): require explicit message target proof. Thanks @hxy91819.

Release verification

• npm package: https://www.npmjs.com/package/openclaw/v/2026.6.10-beta.1
• registry tarball: https://registry.npmjs.org/openclaw/-/openclaw-2026.6.10-beta.1.tgz
• integrity: sha512-OgdN7P0Scm8rNgcXUrCGFyrMPJGdC3TdMxdS95jPbEzws9tp3CgZnehcmBNyBqCc9QU4uK0QUk7bnNSW+3ohbw==
• release SHA: d91c1607c4d254b6dafa2ea052aef82e68b0c1b0
• full release CI report: https://github.com/openclaw/releases/blob/main/evidence/2026.6.10-beta.1/release-evidence.md
• release publish: https://github.com/openclaw/openclaw/actions/runs/27898612086
• npm preflight: https://github.com/openclaw/openclaw/actions/runs/27897098428
• full release validation: https://github.com/openclaw/openclaw/actions/runs/27897098492
• plugin npm publish: https://github.com/openclaw/openclaw/actions/runs/27898772805
• plugin ClawHub publish: dispatched separately, not awaited by this proof: https://github.com/openclaw/openclaw/actions/runs/27898773498
• plugin ClawHub bootstrap: not needed
• OpenClaw npm publish: https://github.com/openclaw/openclaw/actions/runs/27899322972
• npm Telegram beta E2E: not supplied

2026.6.9

Highlights

• Richer Telegram delivery: Telegram now sends rich HTML, preserves rich markdown and sticker paths, renders progress drafts and command output more faithfully, and keeps mentions and spooled handlers on the right delivery path. (#93286, #93164, #93124, #93364, #93130, #93088, #93281) Thanks @obviyus, @vincentkoc, @goutamadwant, @kesslerio, @NianJiuZst, @SweetSophia, @Marvinthebored, and @aaajiao.
• More dependable agent recovery: retries, terminal outcomes, usage after compaction, session history repair, and reply reconciliation now keep more interrupted or partial turns moving toward a visible final result. (#92191, #93073, #93228, #93084, #93469, #93291, #90943) Thanks @ai-hpc, @lml2468, @fuller-stack-dev, @Hollychou924, @leno23, @de1tydev, @425072024, @wuwahe3, @drvoss, @yetval, @sandieman2, and @vincentkoc.
• A stronger Codex integration: Codex gains automatic plugin approvals, GPT-5.3 Spark OAuth routing, remote-node exec as a dynamic tool, and more reliable app-server teardown and terminal outcomes. (#92625, #89133, #93654, #91767, #93287) Thanks @kevinslin, @VACInc, @vincentkoc, @JPKay-AI, and @aliahnaf2013-max.
• Standalone official provider plugins: external provider packages are now first-class npm releases, externally installed channel plugins load at Gateway startup, and StepFun is intentionally npm-only because its ClawHub package name is unavailable. (#93470) Thanks @sunlit-deng, @cxdnicole, and @vincentkoc.
• More capable web and native clients: the Control UI adds a session workspace rail and extension health, iOS adds Watch controls, and Android shows chat context. (#92856, #91952, #93387, #92837) Thanks @Solvely-Colin, @jalehman, @joshavant, and @Tosko4.
• More useful search and skills: Codex Hosted Search is available, key-free search providers remain deliberate opt-ins, and ClawHub skill installs retain verified source provenance. (#93446, #93616, #93283, #93506) Thanks @fuller-stack-dev, @davemorin, @momothemage, @nmccready-tars, and @vincentkoc.

Changes

• Providers and auth: add Codex Hosted Search, improve Gemini CLI OAuth behind proxies, and keep external provider onboarding on current choices and package metadata. (#93446, #92815) Thanks @fuller-stack-dev, @yetval, @EvetteYoung, and @vincentkoc.
• Plugins and installs: externalized official providers publish as independent npm packages, Gateway discovers installed channel plugins at startup, and StepFun installs exclusively from npm. (#93470) Thanks @sunlit-deng, @cxdnicole, and @vincentkoc.
• Dashboard and mobile: add a session workspace rail, plugin health in status, compact cron lists, and iOS Watch controls. (#92856, #91952, #93395, #93387) Thanks @Solvely-Colin, @jalehman, @yu-xin-c, @centralpc, @joshavant, and @vincentkoc.
• Codex and skills: add automatic plugin approvals, preserve ClawHub skill provenance, and expose remote-node execution to Codex when a node is connected. (#92625, #93283, #93654) Thanks @kevinslin, @momothemage, @nmccready-tars, @vincentkoc, and @JPKay-AI.
• QA and release engineering: QA scenarios now use YAML, with broader profile evidence and release coverage for the plugin and channel matrix.

Fixes

• Security and privacy: redact secrets from debug/config output, block internal HTTP session overrides, audit open-DM tool exposure, and retain plugin write ownership checks. (#93333, #88496, #93443, #92883, #93353) Thanks @Alix-007, @jason-allen-oneal, @coygeek, @RichardCao, @yu-xin-c, @cjg20ss, @eleqtrizit, and @vincentkoc.
• Agent and session runtime: retry thinking-only and empty post-tool turns, prevent duplicate hook execution, preserve fresh usage through compaction, and repair partial JSON/history artifacts. (#92191, #93073, #93009, #93084, #93469) Thanks @ai-hpc, @lml2468, @fuller-stack-dev, @zenglingbiao, @dertbv, @Hollychou924, @leno23, @de1tydev, @425072024, @wuwahe3, @drvoss, and @vincentkoc.
• Channels and replies: fix Telegram rich delivery and ingress recovery, preserve WhatsApp auth and media error reporting, keep Mattermost thread replies intact, and harden Discord action handling. (#93286, #93364, #93281, #93076, #93334, #93424, #93488) Thanks @obviyus, @NianJiuZst, @mcaxtr, @rushindrasinha, @amknight, @lzyyzznl, @darealgege, and @vincentkoc.
• Storage and migrations: avoid SQLite WAL on network filesystems, clean reindex artifacts, keep setup state out of workspace dot-directories, and import default-agent auth profiles into SQLite. (#93454, #92891, #93182, #93295, #93520, #93156) Thanks @vincentkoc, @ZengWen-DT, @Zeng-wen, @potterdigital, @Alix-007, @Pick-cat, @sallyom, @1qh, and @Tazio7.
• Provider and model behavior: fix Gemini CLI proxy OAuth, restore Codex Spark OAuth routing, correct Bedrock embedding model IDs, and preserve configured defaults in embedded runs. (#92815, #89133, #93452, #93428) Thanks @yetval, @EvetteYoung, @VACInc, @LiuwqGit, @aleck31, @zenglingbiao, @danielgerlag, and @vincentkoc.
• CLI, TUI, and apps: accept global flags after subcommands, keep terminal output and activity indicators visible, preserve CJK IME composition, and refresh stale UI state. (#93455, #93460, #93006, #93427, #93498, #93606) Thanks @ooiuuii, @Alix-007, @ZengWen-DT, @Zeng-wen, @AlethiaQuizForge, @Zhaoqj2016, @liuhao1024, @BrianClaw1955, @vincentkoc, and @NicoBoom13.
• Operations and updates: harden official plugin recovery, restart managed Gateways after failed update handoff, avoid Node-specific npm prefixes, and keep package validation paths reliable. (#93325, #92111, #93650) Thanks @vincentkoc, @yetval, @ofan, and @yaanfpv.

Complete contribution record

This audited record covers the complete v2026.6.8..HEAD~1 history: 375 merged PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact.

Pull requests

• PR #90463 refactor: add session accessor seam with gateway consumer. Thanks @jalehman.
• PR #88656 Drop reasoning-only length turns from replay. Thanks @abel-zer0.
• PR #92856 feat(webui): add session workspace rail. Thanks @Solvely-Colin.
• PR #92845 docs(browser-control): document OPENCLAWEAGERBROWSERCONTROLSERVER requirement. Related #92841. Thanks @liuhao1024 and @jeugregg.
• PR #82366 fix: use passive periodic sqlite wal checkpoints. Related #81715. Thanks @honor2030 and @KrasimirKralev.
• PR #92815 fix(google): route Gemini CLI OAuth through the env proxy (#46184). Thanks @yetval and @EvetteYoung.
• PR #91331 fix(mattermost): merge progress preview lines by identity. Related #89761. Thanks @iloveleon19 and @leonthe8th and @vincentkoc.
• PR #92909 fix(tui): keep spinner active when toggling tools. Related #49763. Thanks @ZengWen-DT and @Zeng-wen and @vincentkoc and @CrimsonDump.
• PR #92904 fix(elevenlabs): use current TTS model ids. Thanks @vortexopenclaw and @vincentkoc.
• PR #92642 fix #86872: Subagent run reports success but fails to write output file. Thanks @zhangguiping-xydt and @vincentkoc and @zapper35.
• PR #89122 refactor: route command session reads through seam. Thanks @jalehman.
• PR #90943 fix(reply): deliver final reply when queued follow-up claims session; scope dedupe to routed thread. Thanks @sandieman2 and @vincentkoc.
• PR #92894 fix(skills): keep managed prompt paths readable. Related #92875. Thanks @kesslerio and @sallyom.
• PR #39617 fix: reload config in slash command routing so dmScope is respected. Related #39605. Thanks @Ciward.
• PR #92191 fix(agents): retry thinking-only errored turns. Related #91953. Thanks @ai-hpc and @lml2468.
• PR #92891 fix(memory): clean stale reindex temp files. Related #92874. Thanks @ZengWen-DT and @Zeng-wen and @vincentkoc and @potterdigital.
• PR #93005 Add OpenRouter Fusion guidance and prompt context. Related #92984. Thanks @sallyom.
• PR #88792 fix(state): harden sqlite path caching. Thanks @vincentkoc.
• PR #93022 fix(gateway): repair usage cost aggregation across agents. Thanks @luke-skywalker-open-claw and @stablegenius49.
• PR #93020 fix(telegram): cool down transient sendChatAction failures. Related #56096. Thanks @Boulea7 and @sumaiazaman and @Pick-cat and @cal-rufus.
• PR #89160 fix(agents): detect truncated API responses to prevent silent session hang. Related #89051. Thanks @joelnishanth and @ArthurusDent.
• PR #93009 fix(agents): make wrapToolWithBeforeToolCallHook idempotent to prevent double hook execution (fixes #92973). Thanks @zenglingbiao and @dertbv.
• PR #92991 fix(agents): tolerate missing attribution baseUrl. Related #92974. Thanks @samrusani and @Haderach-Ram.
• PR #92913 fix(opencode-go): register model catalog to fix context window detection. Related #92912. Thanks @kumaxs.
• PR #89129 refactor: route bundled plugin session callers through seam. Thanks @jalehman.
• PR #93084 fix(agents): preserve fresh usage after compaction. Related #50795. Thanks @Hollychou924 and @leno23 and @de1tydev and @425072024 and @vincentkoc and @wuwahe3.
• PR #92869 fix #90333: [Bug]: Discord image build aborts at step 66 — openclaw-build-messaging-plugins.py exits 1. Thanks @zhangguiping-xydt and @vincentkoc and @chriskosys.
• PR #93011 fix(gateway): accept file-only input on /v1/responses (parity with image-only). Thanks @yetval and @vincentkoc.
• PR #92915 Convert QA scenarios to YAML files. Thanks @RomneyDa.
• PR #91767 Fix one-shot Codex app-server teardown. Thanks @aliahnaf2013-max.
• PR #92625 feat(codex): add auto plugin approvals. Thanks @kevinslin.
• PR #91587 test(qa): add qa run --qa-profile and unified output summary/evidence. Thanks @RomneyDa.
• PR #93104 test(reply): seed channel fixtures for dedupe tests. Thanks @RomneyDa.
• PR #93107 test(reply): preserve telegram dedupe fallback. Thanks @RomneyDa.
• PR #92954 fix(memory): accept local default model path migration. Thanks @mushuiyu886 and @vincentkoc.
• PR #90936 fix(agents): do not misclassify client-disconnect abort as run timeout. Related #90764. Thanks @openperf and @reginaldomarcilon.
• PR #90812 fix(voice-call): preserve live Twilio streams in stale reaper. Related #79121. Thanks @Takhoffman and @sahibzada-allahyar and @donkeykong91.
• PR #93094 fix(whatsapp): bound socket operations. Thanks @mcaxtr.
• PR #91629 fix(scripts): add database-first legacy store guard. Related #91628. Thanks @galiniliev.
• PR #93124 fix(telegram): render progress drafts as rich previews. Thanks @Marvinthebored.
• PR #93109 test(qa): embed profile scorecard evidence. Thanks @RomneyDa.
• PR #87298 test: add temp directory helper guidance. Thanks @hxy91819.
• PR #92318 fix(cron): require explicit message target proof. Thanks @hxy91819.
• PR #93137 fix(imessage): honor disabled reply actions. Related #92142. Thanks @omarshahine and @dprev.
• PR #93134 fix(feishu): pass cardmsgcontent_type to get full card content (fixes #78289). Thanks @liuhao1024 and @vincentkoc and @longdoubled7.
• PR #93138 fix(agents): preserve literal current session resolution. Thanks @liuhao1024 and @vincentkoc.
• PR #91225 fix #83830: [Bug]: Dreaming diary repeats "first day" narrative every sweep — same early memories dominate snippets. Thanks @mushuiyu886 and @YinLiuLiu66.
• PR #93153 simplify QA evidence profile and mappings/coverage shape. Thanks @RomneyDa.
• PR #93164 fix(telegram): preserve rich markdown line breaks. Thanks @vincentkoc.
• PR #93119 fix: accept mixed source/dist bundled roots. Related #87730. Thanks @arkyu2077 and @vincentkoc and @jasonftl.
• PR #93130 fix(telegram): preserve sticker media paths. Related #83748. Thanks @goutamadwant and @vincentkoc and @aaajiao.
• PR #93073 fix(agents): retry empty post-tool final turns. Thanks @fuller-stack-dev.
• PR #91784 fix(voice-call): require realtime websocket path boundary. Thanks @jason-allen-oneal.
• PR #89133 Restore GPT-5.3 Codex Spark OAuth routing. Thanks @VACInc.
• PR #91996 refactor: prune unused iOS code. Thanks @zats.
• PR #90231 fix #69443: [Bug] Subagent RPC callback to WeChat session key routed to main session instead. Thanks @zhangguiping-xydt and @sliverp and @chen11221.
• PR #89920 fix(matrix): replace recovered command progress lines. Thanks @bdjben and @jesse-merhi.
• PR #93159 fix(tui): keep parent stdin paused after exit. Thanks @fuller-stack-dev.
• PR #93201 fix(auto-reply): clear pending-final state before honoring post-send abort (#89115). Thanks @amknight and @danashburn.
• PR #93228 fix(agents): replace prose terminal classifiers. Thanks @fuller-stack-dev.
• PR #93231 fix(status): correct pinned model clear hint. Thanks @hxy91819.
• PR #92428 fix(qqbot): keep markdown table chunks valid. Thanks @sliverp.
• PR #93220 fix(status): avoid stale session context windows. Thanks @hxy91819.
• PR #91957 perf(sessions): share one enumeration across archive retention sweeps. Thanks @amknight.
• PR #93281 fix(telegram): recover pid-reused ingress claims. Thanks @obviyus.
• PR #93287 fix(codex): preserve terminal outcome ordering.
• PR #93182 fix(memory): clean rollback-journal reindex temp sidecar on NFS stores. Thanks @Alix-007.
• PR #93283 Persist ClawHub skill install provenance. Related #92077. Thanks @momothemage and @nmccready-tars.
• PR #88872 fix: attribute spawned task runs to child agent. Related #66670. Thanks @Alix-007 and @Neomail2.
• PR #92837 fix(android): show live chat context usage. Thanks @Tosko4.
• PR #93325 fix(cli): harden official plugin recovery. Thanks @vincentkoc.
• PR #93286 feat(telegram): send rich messages as rich html. Thanks @obviyus.
• PR #92910 fix(memory-core): safely refresh qmd index during collection repair.
• PR #93329 fix(cli): allow zero Discord timeout duration. Related #93327. Thanks @rohitjavvadi.
• PR #91625 fix(cron): add cron edit --clear-model to clear a job's model override. Thanks @ly-wang19.
• PR #91691 [AI] fix(memory): prevent empty-string expectedModel in resolveMemory…. Thanks @xydt-tanshanshan.
• PR #93006 fix(tui): keep stderr visible when local shell stdout fills the output cap. Thanks @Alix-007.
• PR #93001 fix(daemon): prefer stderr over stale stdout in gateway restart diagnostics. Thanks @Alix-007.
• PR #91117 refactor: remove dead code and improve string concatenation. Thanks @Pommelle.
• PR #90893 fix(models): mask paste-token input in CLI auth prompt. Thanks @anurag-bg-neu.
• PR #90571 fix(configure): mask gateway password input in CLI wizard prompt. Thanks @anurag-bg-neu.
• PR #91768 fix(ios): respect chat header safe area. Thanks @zats.
• PR #93245 fix(cron): resolve lastRunStatus in cron list/show human output. Thanks @ly-wang19.
• PR #78765 fix(tui): avoid inserting spaces into long CJK text. Thanks @hpt.
• PR #91776 fix(ios): refresh permission rows after grants. Thanks @zats.
• PR #92817 fix(cron): trust agent output when channel is unresolved without explicit delivery. Related #90664. Thanks @fsdwen and @dertbv.
• PR #93297 fix(control-ui): respect agents.defaults.timeFormat for timestamps. Related #58147. Thanks @ZengWen-DT and @Zeng-wen and @TommoT2.
• PR #93364 Fix Telegram rich progress command output. Thanks @obviyus.
• PR #91952 feat(status): surface plugin health. Thanks @jalehman.
• PR #75025 fix(heartbeat): refresh stale Current time line on every helper call (#44993). Thanks @MoerAI and @mclee1975.
• PR #90992 docs(windows): fix WSL gateway-autostart recipe for WSL ≥ 2.6.1.0 idle-termination. Thanks @spencer2211.
• PR #86544 fix(cli): show Gemini CLI runtime auth status. Related #79585. Thanks @giodl73-repo and @fabricefoy.
• PR #88945 fix(plugins): serialize binding approval saves. Related #64065. Thanks @Alix-007 and @lihaokun.
• PR #90115 fix(gateway): pass managed inbound PDFs through chat.send. Related #90097. Thanks @harjothkhara and @joeykrug.
• PR #74613 docs(cli): add agent selector to CLI backend quick start. Related #68940. Thanks @vyctorbrzezowski and @drmarcopapa.
• PR #89121 refactor: add transcript reader seam. Thanks @jalehman.
• PR #84434 fix(cli): disable ScheduleWakeup/CronCreate in --print claude runs. Thanks @SkyWolfDreamer.
• PR #66985 fix(agents): resolve requestedNode to canonical ID before boundNode comparison. Related #87213. Thanks @mujiannan.
• PR #91488 fix(reply): project preflight compaction gate by next-input size on fresh tokens. Thanks @yetval.
• PR #93353 fix(plugins): require owner for plugin writes. Thanks @eleqtrizit.
• PR #91499 fix(cron): preserve scheduled turn tool policy [AI]. Thanks @mmaps.
• PR #90412 fix(sessions): cache warm transcript reads to avoid per-turn re-parse. Related #83943. Thanks @Alix-007 and @yyds-xxxx.
• PR #93118 fix(gateway): guard fast-path startup migrations. Related #93032. Thanks @openperf and @Haderach-Ram.
• PR #93355 fix(ci): verify performance workflow downloads. Thanks @eleqtrizit.
• PR #93358 fix(outbound): guard cross-context message mutations. Thanks @eleqtrizit.
• PR #93362 fix(flock): bind allow-always to wrapped command. Thanks @eleqtrizit.
• PR #92578 refactor(whatsapp): add inbound admission foundation. Thanks @mcaxtr.
• PR #89547 Control Telegram group history context. Thanks @mmaps.
• PR #89201 refactor: add transcript runtime identity contract. Thanks @jalehman.
• PR #93357 fix(plugins): enforce install policy in wrappers. Thanks @eleqtrizit.
• PR #93156 fix(doctor): import default-agent auth profiles into sqlite. Related #93145. Thanks @Pick-cat and @sallyom and @Tazio7.
• PR #93179 Add slim evidence mode for QA profile evidence. Thanks @RomneyDa.
• PR #93349 fix(control-ui): keep workboard card titles visible in overflowing columns (fixes #91717). Thanks @Pick-cat and @NicoBoom13.
• PR #93324 fix(cli): accept --no-color after subcommands. Thanks @ooiuuii.
• PR #89621 Return Google Chat thread metadata from message sends. Thanks @franco-viotti.
• PR #82458 fix(infra): drop duplicated "restart" word in restart-sentinel summary. Thanks @jameswniu.
• PR #85471 Suppress cron announce control replies. Related #85421. Thanks @TurboTheTurtle and @leatherneck-33.
• PR #85316 fix(auth): keep alias-compatible auth-profile overrides instead of clearing them. Thanks @SkyWolfDreamer.
• PR #89260 fix(doctor): separate platform-incompatible skills from missing requirements. Related #89232. Thanks @Alix-007 and @CameronWeller.
• PR #90846 fix(media): stop pruning media on write; let the configured timer do it. Thanks @lundog.
• PR #88062 fix(logging): avoid stalled warnings for active model calls. Thanks @litang9.
• PR #93308 fix(discord): reject malformed realtime consult calls. Thanks @khoek.
• PR #93334 fix(whatsapp): notify user when trailing media send fails instead of silent drop. Thanks @rushindrasinha.
• PR #92575 fix(sessions): preserve user behavior overrides across daily/idle rollover (#92562) [AI-assisted]. Thanks @harjothkhara and @civiltox.
• PR #89124 refactor: route auto-reply sessions through session seam. Thanks @jalehman.
• PR #93431 fix: stabilize transcript cache and CLI env isolation. Thanks @shakkernerd.
• PR #93412 fix(discord): suppress tool progress for message-tool replies. Thanks @mgunnin and @vincentkoc.
• PR #93409 fix(whatsapp): stop markdownToWhatsApp dropping code spans followed by a digit. Thanks @rushindrasinha.
• PR #93295 fix(memory): swap rollback-journal sidecar during atomic reindex. Thanks @Alix-007.
• PR #93076 fix(whatsapp): preserve auth on terminal disconnects. Thanks @mcaxtr.
• PR #93435 fix(agents): bound autoreview scope. Thanks @vincentkoc.
• PR #93279 fix(telegram): restore readable default text sends. Related #93263. Thanks @NianJiuZst and @SweetSophia.
• PR #93429 fix(line): cap carousel column text at 60 chars when a title or image is set. Thanks @harjothkhara and @vincentkoc.
• PR #93428 fix(agents): resolve configured default model in runEmbeddedAgent (fixes #93419). Thanks @zenglingbiao and @vincentkoc and @danielgerlag.
• PR #93427 fix(tui): show activity indicator for system-injected runs. Related #51825. Thanks @ZengWen-DT and @vincentkoc and @Zeng-wen and @AlethiaQuizForge.
• PR #90003 feat(policy): cover exec approvals artifact. Thanks @giodl73-repo.
• PR #93448 fix(guards): allow auth profile sqlite reader. Thanks @amknight.
• PR #93424 fix(mattermost): keep message tool replies in threads. Thanks @amknight and @vincentkoc.
• PR #93418 fix(telegram): forward Bot API 10.1 rich_message content to agent. Related #93410. Thanks @xzh-xydt and @vincentkoc and @0pen7ech.
• PR #93175 test(qa): taxonomy profiles: includeAllCategories for release profile, update some coverage. Thanks @RomneyDa.
• PR #93456 fix(agents): handle string assistant message content. Thanks @vincentkoc.
• PR #93441 fix(outbound): ignore schema-padded poll metadata on send. Related #43015. Thanks @weichengdeng and @charzhou.
• PR #93443 fix(gateway): block internal HTTP session overrides. Thanks @RichardCao.
• PR #93454 fix(sqlite): disable WAL on network filesystems. Thanks @vincentkoc.
• PR #90275 test: make install-safe-path symlink tests compatible with Windows. Thanks @aniruddhaadak80.
• PR #93464 fix(qa): suppress empty WhatsApp debug artifacts. Thanks @vincentkoc.
• PR #90861 fix(cli): preserve sessions_yield over MCP. Related #77426. Thanks @zhangguiping-xydt and @jarvisagimuspicard-hub.
• PR #90946 fix(infra): preserve inherited gateway PID across reparent during cleanup. Thanks @amittell.
• PR #92220 fix(media): extract large managed inbound PDFs via media-understanding. Related #90096, #90097. Thanks @amknight and @joeykrug.
• PR #91208 fix #91047: Plugin session-extension registry not pinned; sessions.pluginPatch fails after agent/subagent plugin-load churn. Thanks @mushuiyu886 and @teamadams.
• PR #92111 fix(update): restart managed gateway when update handoff fails after stop. Related #92088. Thanks @yetval and @ofan.
• PR #93238 fix(agents): honor disabled envelope timestamps at model boundary. Thanks @osolmaz.
• PR #93343 fix(codex): de-duplicate commentary notes across the raw response lane. Related #93296. Thanks @Marvinthebored and @Peetiegonzalez.
• PR #93361 fix(openshell): pin mirror remote mutations. Thanks @eleqtrizit.
• PR #93354 fix(discord): block cross-provider guild admin actions. Thanks @eleqtrizit.
• PR #92178 fix(gateway): normalize malformed paired access lists. Related #90654. Thanks @wangmiao0668000666 and @EmilioNicolas.
• PR #85254 perf(plugins): thread prepared manifestPlugins through runtime model-id normalize chain. Thanks @zeroaltitude.
• PR #93489 Add ClawHub content rights docs to sidebar. Thanks @Patrick-Erichsen.
• PR #93466 [AI] fix(feishu): guard against missing inbound in channelRuntime fallback. Thanks @xydt-tanshanshan.
• PR #93460 fix(cli): honor --log-level in route-first commands. Related #93457. Thanks @ooiuuii.
• PR #93495 fix(cron): clear delivery routing fields from cron edit. Thanks @ly-wang19 and @vincentkoc.
• PR #93494 docs: point PR landing at maintainer workflow. Thanks @fuller-stack-dev and @vincentkoc.
• PR #93487 fix(ui): add agent selector to skills page. Related #78553. Thanks @goutamadwant and @vincentkoc and @xiaobu1112.
• PR #93488 fix(discord): apply tool status emojis immediately to avoid override by thinking reactions. Related #92715. Thanks @lzyyzznl and @vincentkoc and @darealgege.
• PR #93055 fix(ui): restore provider usage pill in desktop chat composer [AI]. Thanks @harjothkhara.
• PR #83156 fix(matrix): accept bracketed display-name mentions. Related #83142. Thanks @wdx-agent-io and @wdongxv.
• PR #93333 fix(auto-reply): redact secrets in /debug show and /debug set output. Thanks @Alix-007.
• PR #88496 fix(auto-reply): redact secrets in config show output. Related #65623. Thanks @jason-allen-oneal and @coygeek.
• PR #93105 fix(doctor): repair null agents.list[].workspace values. Related #77718. Thanks @xydigit-sj and @slideshow-dingo.
• PR #73923 fix(ui): preserve gateway token during safe websocket url edits. Related #41545. Thanks @wsyjh8.
• PR #88970 fix #85871: [Bug]: Heartbeat scheduler silently fails to fire on 5.20 and all 5.x versions (regression from 4.23). Thanks @zhangguiping-xydt and @vincentkoc and @carlbjson.
• PR #93511 fix(imessage): normalize leading NUL echo-cache prefixes. Thanks @vincentkoc and @drvoss.
• PR #92594 [Bug]: ollama-cloud runtime fails DNS lookup for ai.ollama.com, while ollama/<model>:cloud works. Related #92391. Thanks @zhangguiping-xydt and @vincentkoc and @kvzsolt.
• PR #93512 build(docs): finish PowerShell-safe docs formatting. Related #44293. Thanks @vincentkoc and @yil337 and @aniruddhaadak80.
• PR #93513 fix(skills): refresh persisted snapshots after restart. Thanks @vincentkoc and @fif911 and @skadauke.
• PR #93517 fix(skills): quote skill-creator template description. Thanks @vincentkoc and @parubets.
• PR #73976 fix(memory): use per-keyword FTS search in hybrid mode #39484. Thanks @joshuakeithpa-sudo.
• PR #93520 fix(workspace): store setup state outside workspace dot-dir. Thanks @vincentkoc and @1qh.
• PR #93521 fix(onboard): skip Homebrew prompt on unsupported platforms. Related #68893. Thanks @vincentkoc and @yurivict.
• PR #93522 fix(feishu): send post mentions as native at elements. Thanks @vincentkoc and @gavin-ali and @YizukiAme and @Panniantong.
• PR #93496 fix(gateway): rotate already-stale generated transcript filename on /reset. Thanks @harjothkhara and @vincentkoc.
• PR #93471 fix(cron): preserve aborted isolated-run failure. Thanks @BhargavSatya and @vincentkoc.
• PR #93473 fix(memory): report skipped QMD embedding probe. Related #77645. Thanks @TurboTheTurtle and @vincentkoc and @aderius.
• PR #93498 fix(ui): preserve CJK IME composition. Related #86035. Thanks @Zhaoqj2016 and @vincentkoc.
• PR #93088 fix(telegram): bind bot mentions to assistant identity. Thanks @kesslerio and @vincentkoc.
• PR #93499 fix(nodes): return screen snapshots as media. Related #90126. Thanks @zenglingbiao and @vincentkoc and @JeffSteinbok.
• PR #93506 fix(skills): trust verified ClawHub source provenance. Thanks @vincentkoc.
• PR #93525 agents: notify chat exec empty-success completions. Thanks @vincentkoc and @wenkang-xie.
• PR #93446 feat: add Codex hosted web search. Thanks @fuller-stack-dev.
• PR #92883 fix(security): audit open dm tool exposure. Related #55612. Thanks @yu-xin-c and @vincentkoc and @cjg20ss.
• PR #93476 fix(mattermost): preserve Codex progress preview. Related #88766. Thanks @goutamadwant and @vincentkoc and @KelTech-Services.
• PR #93395 feat(cron): add compact list responses. Related #93366. Thanks @yu-xin-c and @vincentkoc and @centralpc.
• PR #93527 fix(cron): preserve model overrides for text payloads. Thanks @vincentkoc and @liaoandi.
• PR #90487 fix: harden ChatGPT Responses missing content-type streams. Thanks @anyech and @vincentkoc.
• PR #93528 fix(gateway): tolerate transient pre-hello clean closes. Thanks @vincentkoc and @ruanrrn.
• PR #93529 fix(auto-reply): allow message tool for group attachments. Related #43146. Thanks @vincentkoc and @Robcis.
• PR #93291 fix(reply): preserve pending thread evidence when reconciling partial send results. Thanks @yetval and @vincentkoc.
• PR #90572 fix(feishu): drop self-authored receive echoes. Thanks @baskduf.
• PR #93455 fix(cli): accept --log-level after subcommands. Thanks @ooiuuii and @vincentkoc.
• PR #93452 fix(bedrock): strip inference profile prefix from model ID in embedding adapter. Related #79212. Thanks @LiuwqGit and @vincentkoc and @aleck31.
• PR #89799 fix(cli): skip compile cache on early Node 24.x to avoid startup deadlock. Related #86550. Thanks @zhangguiping-xydt and @vincentkoc and @renyuliang000.
• PR #93469 fix(agents): drop partialJson streaming artifacts from session history repair. Thanks @drvoss and @vincentkoc.
• PR #93463 fix(codex): log app-server compaction completion. Related #83932. Thanks @goutamadwant and @vincentkoc and @aounakram.
• PR #93562 fix(tui): refresh after external session reset. Related #38966. Thanks @vincentkoc and @wsyjh8 and @yizhanzjz.
• PR #93470 fix(plugins): load externally-installed channel plugins at gateway startup. Related #93219. Thanks @sunlit-deng and @vincentkoc and @cxdnicole.
• PR #88796 fix(discord): resolve guildId from session channel for search actions. Related #88790. Thanks @SebTardif and @vincentkoc and @mugabuga.
• PR #93194 fix(agents): preserve prompt-released session metadata. Related #93193. Thanks @snowzlm.
• PR #89483 fix(gateway): project failed agent turns in chat history. Related #89197. Thanks @IWhatsskill and @vincentkoc and @yangiit.
• PR #93434 fix: avoid parent group allowlist false positive. Related #92684. Thanks @kingrubic and @vincentkoc and @motteman.
• PR #93449 fix(feishu): dedupe redelivered text by stable retry identity. Related #46778. Thanks @ZengWen-DT and @vincentkoc and @kingcuty.
• PR #93407 AGT-80 AGT-81 Fix Discord ingress ack ordering. Thanks @mgunnin and @vincentkoc.
• PR #93439 fix(agents): honor embedded run default model. Related #93419. Thanks @harjothkhara and @vincentkoc and @danielgerlag.
• PR #93565 fix(cli): summarize cleanup dry-run by label. Related #76826. Thanks @AgentArcLab and @vincentkoc and @renatomaluhy.
• PR #93509 fix(skills): clear orphaned idempotency pointer on corrupt-metadata re-begin. Thanks @Alix-007 and @vincentkoc.
• PR #93274 Clarify plugin channel config additional-property errors. Thanks @zhangguiping-xydt and @vincentkoc.
• PR #93555 fix(read): route text decoding through shared Windows codepage fallba…. Thanks @zhanxingxin1998 and @vincentkoc.
• PR #93314 fix(skills): preserve ClawHub origin provenance on readback. Thanks @Alix-007 and @vincentkoc.
• PR #93573 fix(acp): keep bridge sessions out of stale ACP classification [AI-assisted]. Related #38907. Thanks @eldar702 and @vincentkoc and @ninaopenclaw.
• PR #93398 fix(cron): emit isolated model usage diagnostics. Related #92338. Thanks @849261680 and @vincentkoc and @niks999.
• PR #93367 Fix SSH sandbox remote directory args. Related #93344. Thanks @dmorn and @vincentkoc.
• PR #93574 fix(feishu): suppress log noise for botp2pchatenteredv1 event [AI-assisted]. Related #42351. Thanks @eldar702 and @vincentkoc and @sunking0223.
• PR #93269 Fix tokenjuice bash results without details. Thanks @moeedahmed and @vincentkoc.
• PR #93575 fix(telegram): hydrate group reply-chain media into model context [AI-assisted]. Thanks @eldar702 and @vincentkoc.
• PR #93261 fix(plugins): resolve provider policy surface for plugin-owned CLI backends. Related #93259. Thanks @BitmapAsset and @vincentkoc.
• PR #93303 fix(whatsapp): bound stalled read-receipt socket operations. Thanks @Alix-007 and @vincentkoc.
• PR #93242 fix(mattermost): keep bare @mention with empty body instead of dropping it. Related #93205. Thanks @iloveleon19 and @vincentkoc.
• PR #93606 fix(ui): clear stale Talk error when session transitions to non-error state (fixes #88176). Thanks @liuhao1024 and @vincentkoc and @BrianClaw1955.
• PR #93607 perf(tasks): memoize reconcileInspectableTasks for same-tick calls (fixes #73531). Thanks @liuhao1024 and @vincentkoc and @slideshow-dingo.
• PR #93612 fix(gateway): compute sessions.usage aggregate totals from all sessions, not just the limited page (fixes #76496). Thanks @liuhao1024 and @vincentkoc and @bobsahur-robot.
• PR #93615 fix(telegram): recover lone active spooled handler on timeout (#84158). Thanks @0xghost42 and @vincentkoc and @crash2kx.
• PR #93616 Keep key-free web search providers opt-in. Thanks @davemorin and @vincentkoc.
• PR #93298 fix #93044: control-ui webchat double-renders agent replies when dmScope=main. Thanks @zhangguiping-xydt and @vincentkoc and @cfmilam.
• PR #93618 fix(feishu): filter temporary card-action-c-\* IDs from reply target to prevent Invalid openmessageid errors (fixes #56818). Thanks @liuhao1024 and @vincentkoc and @SwordImmortal.
• PR #93387 feat(ios): add watch action surface. Thanks @Solvely-Colin and @joshavant.
• PR #93648 fix(doctor): archive superseded plugin install index conflicts. Related #90418. Thanks @vincentkoc and @ramitrkar-hash.
• PR #93649 fix(qwen): place DashScope image prompts in user content. Related #92688. Thanks @vincentkoc and @Yachiyo404.
• PR #93650 fix(update): avoid per-Node npm prefixes during self-update. Related #80387. Thanks @vincentkoc and @yaanfpv.
• PR #93653 fix(skill-workshop): skip helper sessions during auto-capture. Thanks @vincentkoc and @zhangguiping-xydt.
• PR #93654 fix(codex): expose remote node exec as a Codex dynamic tool. Related #92141. Thanks @vincentkoc and @JPKay-AI.
• PR #93662 fix(discord): protect mention aliases in code fences. Thanks @vincentkoc and @rohitjavvadi.
• PR #93663 fix(clawdock): open dashboard on published port without starting deps. Related #77344. Thanks @vincentkoc and @dhoman.
• PR #93670 fix(browser): recover stale managed Chrome CDP listener. Related #41750. Thanks @vincentkoc and @rohitjavvadi and @kissman911.
• PR #93672 fix(commands): preserve multiline slash skill args. Related #79155. Thanks @vincentkoc and @web3blind.
• PR #93674 fix(browser): accept top-level act fields with nested requests. Related #38762. Thanks @vincentkoc and @angelusbr and @Lumos-789.
• PR #93678 fix(plugins): allow Dreaming sidecar through restrictive memory allowlists. Related #92536. Thanks @vincentkoc and @pradeep7127 and @resYuto.
• PR #93306 fix(status): ignore stale context after model switch. Thanks @hxy91819.
• PR #93666 fix(control-ui): copy code blocks over plain HTTP via clipboard fallback. Related #93628. Thanks @Pick-cat and @pjq2926.
• PR #93629 fix(reply): preserve unsent text-only finals after block pipeline streamed partial content (fixes #81078). Thanks @liuhao1024 and @Jackten.
• PR #93690 fix(telegram): dispatch MEDIA directives as attachments. Related #77702. Thanks @vincentkoc and @butttersbot.
• PR #93693 fix(gateway): ignore stale sudo scope for root user services. Related #81410. Thanks @vincentkoc and @Ericksza.
• PR #93646 fix(agents): return string assistant content in getLastAssistantText. Thanks @Alix-007 and @vincentkoc.
• PR #93687 fix(i18n): retain Codex error tails in logs. Thanks @hxy91819.
• PR #93630 fix(heartbeat): bootstrap plugin session targets. Thanks @ZengWen-DT and @vincentkoc.
• PR #93658 fix(wizard): preserve existing default model during setup auth choice [AI-assisted]. Related #64129. Thanks @ml12580 and @vegapunk9527.
• PR #93671 fix(respawn): rewrite pnpm versioned entry paths to stable wrapper (fixes #52313). Thanks @liuhao1024 and @vincentkoc and @RichardCao.
• PR #93698 Fix Telegram rich progress detail updates. Thanks @obviyus.
• PR #93656 fix(gateway): send approval route notices with write scope. Related #93563. Thanks @mushuiyu886 and @vincentkoc and @clawbot247-commits.
• PR #93665 fix(gateway): surface codex app-server returned failures. Thanks @litang9 and @vincentkoc.
• PR #93727 fix(context-engine): avoid turn-maintenance lane livelock. Related #77340. Thanks @vincentkoc and @baghvn and @Veda-openclaw.
• PR #93681 fix(llm): handle string assistant content on the OpenAI-compatible completion path. Thanks @Alix-007.
• PR #93722 chore(release): update appcast for 2026.6.8. Thanks @vincentkoc.
• PR #93677 fix(google-meet): declare realtime provider secret inputs. Related #81891. Thanks @goutamadwant and @vincentkoc and @chachi-max.
• PR #92947 fix(qqbot): deliver cron auto-TTS voice by trusting OpenClaw temp root. Related #92816. Thanks @ZengWen-DT and @Zeng-wen and @lewiswu1209.
• PR #93679 fix(whatsapp): extract GIF metadata and distinguish gifPlayback in media placeholders (fixes #49099). Thanks @liuhao1024 and @vincentkoc and @bugkill3r.
• PR #93688 fix(minimax): check base_resp envelope errors in TTS provider. Related #76904. Thanks @dwc1997 and @najef1979-code.
• PR #93714 fix: isolate async model resolution mock from sync mock in flaky test. Related #92117. Thanks @lsr911 and @wangwllu.
• PR #93705 test(macos): cover root command dispatch. Related #83879. Thanks @markoub and @vincentkoc and @davinci282828.
• PR #93711 Keep command text in progress drafts. Thanks @keshavbotagent and @vincentkoc.
• PR #93712 fix: scope assistant avatar override to agent ID. Related #90890. Thanks @lsr911 and @vincentkoc and @najef1979-code.
• PR #93725 fix(usage): prune stale usage cache temp files. Related #78939. Thanks @markoub and @Tramsrepus.
• PR #93726 fix(typing): start typing on reasoning deltas in thinking mode before visible text. Related #79681. Thanks @xialonglee and @novaflash82.
• PR #93716 fix(discord): propagate timeout through channel capabilities diagnostics. Related #77040. Thanks @xialonglee and @vincentkoc and @unicebondoc.
• PR #93729 fix(ollama): preserve configured API during discovery. Related #93710. Thanks @zhangguiping-xydt and @vincentkoc and @obnoxious2011-cmd.
• PR #93719 fix: pin plugin workspace dir for sessions.list to avoid O(rows) memo busting. Related #90814. Thanks @lsr911 and @vincentkoc and @k-l-lambda.
• PR #93732 fix(agents): preserve re-sent user prompt during compaction transcript rotation. Thanks @yetval.
• PR #93738 fix: break plugin registry type import cycle. Thanks @giodl73-repo.
• PR #93740 fix(sessions): release retained locks after takeover. Thanks @TurboTheTurtle.
• PR #93745 fix(usage): reject invalid explicit dates in usage RPC date parsing. Thanks @harjothkhara and @vincentkoc.
• PR #93746 fix(ui): populate realtime talk provider and transport options from talk.catalog. Thanks @shushushv and @vincentkoc.
• PR #93751 fix(ios): fix quick setup sheet layout design. Thanks @zats.
• PR #93749 fix(compaction): ignore stale persisted totalTokens in preflight gate. Thanks @yetval.
• PR #93753 fix: correct tautological uppercase check in tool description summarizer. Thanks @GautamKumarOffical.
• PR #89123 refactor: route transcript writers through session seam. Thanks @jalehman.
• PR #93758 feat(memory): apply outputDimensionality truncation to local GGUF embeddings (fixes #58765). Thanks @liuhao1024 and @vincentkoc and @losz5000.
• PR #93754 feat(inbound-meta): expose per-turn source modality. Related #50482. Thanks @liuhao1024 and @vincentkoc and @JTOrca.
• PR #93767 fix(reasoning-tags): strip MiniMax mm: namespaced reasoning tags. Thanks @DrHack1 and @vincentkoc.
• PR #93772 fix(feishu): recover CJK filenames from JSON file_name field (fixes #81103). Thanks @liuhao1024 and @vincentkoc and @pjuneye.
• PR #93773 fix(ui): scope Skill Workshop proposals to selected agent. Related #93760. Thanks @TurboTheTurtle and @vincentkoc and @hannesrudolph.
• PR #88750 feat(context-engine): pass runtime settings into lifecycle. Thanks @ragesaq and @jalehman.
• PR #93763 fix(agents): use neutral billing copy for subscription auth. Related #80877. Thanks @eldar702 and @vincentkoc and @22kyasue.
• PR #93818 List all ClawHub docs in sidebar. Thanks @Patrick-Erichsen.
• PR #93779 fix(webchat): skip textarea resize during IME composition to eliminate typing lag. Related #90800. Thanks @joelnishanth and @vincentkoc and @w10497-create.
• PR #93786 fix(plugins): treat refreshable catalogs as requiring runtime discovery (fixes #93775). Thanks @liuhao1024 and @St0rmz1.
• PR #93791 fix(memory): await search-sync before returning results to prevent stale index (fixes #52115). Thanks @liuhao1024 and @vincentkoc and @FicheallADa.
• PR #93780 fix(google): keep parallel Gemini tool responses in the turn after the model. Thanks @yetval and @vincentkoc.
• PR #93789 fix(agents): make lane suspension consistent across cooldown-precheck and embedded-runner paths. Related #93036. Thanks @joelnishanth and @vincentkoc and @kumaxs.
• PR #93798 fix(status): show 0 (not ?) for fresh-session context tokens. Related #93771. Thanks @Alix-007 and @vincentkoc and @anarchia-99.
• PR #93810 fix(cron): preserve startup overflow catch-up deferrals in start() maintenance pass. Thanks @yetval.
• PR #93811 Strip UTF-8 BOM when reading SKILL.md in quick_validate. Thanks @HrachShah.
• PR #93803 fix(ui): preserve WebChat visible messages across session switches. Related #80855. Thanks @LiuwqGit and @vincentkoc and @viagarsuker.
• PR #93792 fix(android): wait for node capability approval before onboarding. Thanks @Solvely-Colin and @vincentkoc.
• PR #93796 fix(feishu): paginate wiki node and space listing (#37626). Thanks @ZengWen-DT and @vincentkoc and @ritou11.
• PR #93797 fix(browser): use openTab return value to prevent wsUrl race in ensureTabAvailable (fixes #63343). Thanks @liuhao1024 and @vincentkoc and @OpenCodeEngineer.
• PR #93806 fix(reasoning-tags): strip MiniMax mm: tags on silent-reply and streaming paths missed by #93767. Thanks @Alix-007 and @vincentkoc.
• PR #93691 refactor: add gateway sessions.create lifecycle seam. Thanks @jalehman.
• PR #88748 fix(gemini): bridge OAuth profiles into CLI runtime. Related #88742. Thanks @jason-allen-oneal.
• PR #93857 fix(deps): remediate Dependabot alerts. Thanks @vincentkoc.
• PR #93874 fix(slack): recognize MiniMax mm: namespaced reasoning tags in monitor preview. Thanks @Alix-007.
• PR #93832 feat(providers): add ClawRouter managed proxy. Thanks @vincentkoc.
• PR #93880 fix(macos): preserve approvals migration data. Thanks @vincentkoc.
• PR #93903 fix(cron): reject invalid absolute timestamps. Thanks @Alix-007 and @vincentkoc.
• PR #93879 fix(update): use configured npm registry for update metadata. Related #79140. Thanks @vincentkoc and @sixerLiu.
• PR #93924 revert(providers): remove ClawRouter provider. Thanks @vincentkoc.
• PR #93955 fix(telegram): surface rich-message disabled state. Thanks @obviyus.
• PR #93881 fix(agents): route BTW through canonical Codex runtime. Related #88902. Thanks @vincentkoc and @TurboTheTurtle and @khalil-omer.
• PR #90192 fix(feishu): fetch quoted content before empty-message guard. Related #90177. Thanks @bladin and @sliverp and @lkxlaz.
• PR #93237 Fix Mattermost open DM validation. Thanks @amknight.
• PR #93945 feat(diagnostics): add SIEM security events. Thanks @vincentkoc.
• PR #87487 fix(cli): clarify mcp list registry scope. Related #65209. Thanks @Alix-007 and @slideshow-dingo.
• PR #24661 feat(cohere): add provider plugin. Thanks @vincentkoc.
• PR #93532 Expose verified ClawHub source in skill verify output. Thanks @momothemage.
• PR #93538 feat(codex): support app-server network proxy profiles. Thanks @vincentkoc.
• PR #93938 fix(telegram): guard UTF-16 surrogate pairs in outbound chunkers. Related #93921. Thanks @Nas01010101 and @vincentkoc.
• PR #94104 feat(agents): trace compaction summarization model calls. Thanks @amknight.
• PR #94108 Fix package Telegram temp root. Thanks @obviyus.
• PR #94113 Fix Telegram package output mount. Thanks @obviyus.
• PR #89062 feat(docker): support offline setup reruns. Related #70443. Thanks @Alix-007 and @safrano9999.
• PR #93929 fix(secrets): explicitly pass BWSSERVERURL to resolver for self-hosted instances. Related #93851. Thanks @Pandah97 and @vincentkoc and @AdoShan.
• PR #90057 Polish Workboard operations view. Thanks @fuller-stack-dev.
• PR #89396 fix(doctor): drop inert legacy cron notify when cron.webhook is unset. Related #44460. Thanks @Alix-007.
• PR #94138 fix(session): prevent stale finalizer from recreating deleted session rows. Related #40840. Thanks @xialonglee and @vincentkoc and @AL-knows.
• PR #93739 refactor: add session patch projection seam. Thanks @jalehman.
• PR #94178 fix(workspace): skip optional bootstrap files when workspace setup is already completed. Related #83593. Thanks @dwc1997 and @jsompis.
• PR #93363 fix(feishu): enforce account tool family gates. Thanks @eleqtrizit.
• PR #93813 fix(codex): keep message registered for internal turns. Related #93750. Thanks @jalehman and @hannesrudolph.
• PR #93659 refactor: add session reset delete lifecycle seam. Thanks @jalehman.
• PR #93852 ci(release): harden release controls. Thanks @vincentkoc.
• PR #94203 feat(codex): support remote app-server plugins. Thanks @kevinslin.
• PR #94263 chore: migrate claw-score skill. Thanks @RomneyDa and @kevinslin.
• PR #93695 refactor: add compact trim lifecycle seam. Thanks @jalehman.
• PR #93114 test: fold lifecycle and package proof into QA Lab. Thanks @RomneyDa.
• PR #93181 test: fold otel smoke into qa e2e. Thanks @RomneyDa.
• PR #93178 test: fold gateway smoke into qa e2e. Thanks @RomneyDa.
• PR #94276 qa-lab: support script-backed evidence scenarios. Thanks @Solvely-Colin and @RomneyDa.
• PR #94282 Support owner-qualified ClawHub skill installs. Thanks @Patrick-Erichsen.
• PR #93704 refactor: add session cleanup lifecycle seam. Thanks @jalehman.
• PR #94296 fix: require all taxonomy coverage ids for a feature - AND not OR. Thanks @RomneyDa.
• PR #92016 fix(plugins): compose live hook registry view for tool-call hooks. Related #91918. Thanks @amknight and @vokaplok.
• PR #89596 fix(policy): recognize declared tool allowlists. Thanks @giodl73-repo.
• PR #93713 fix: route deleted-agent session purge through lifecycle seam. Thanks @jalehman.
• PR #84172 fix(exec): rebuild command authorization on the Tree-sitter command planner. Thanks @jesse-merhi.
• PR #94332 docs: add ClawHub namespace claims to sidebar. Thanks @Patrick-Erichsen.
• PR #86360 fix(codex): honor bound agent exec host policy. Thanks @jesse-merhi.
• PR #73162 fix(slack): remove socket reconnect attempt cap so gateway stays connected indefinitely. Related #72808. Thanks @suboss87 and @tleyden.
• PR #94156 fix: expose OpenAI image quality and moderation CLI options. Thanks @lastguru-net and @fuller-stack-dev.
• PR #94350 feat: externalize GMI provider plugin. Thanks @Patrick-Erichsen and @vincentkoc.
• PR #94543 fix(gateway): bound config.get middleware results. Related #94265. Thanks @vincentkoc and @v-s-gusev.
• PR #91409 fix(update): run plugin convergence after RPC git updates. Thanks @masatohoshino.
• PR #94556 chore(extensions): bump tokenjuice to 0.8.1. Thanks @vincentkoc.
• PR #94580 fix(ci): stabilize update run gates.
• PR #94394 fix(infra): probe 127.0.0.1 in ensurePortAvailable to detect IPv4-only occupants. Related #94379. Thanks @Pandah97 and @wangwllu.
• PR #94421 fix(agents): preserve active compaction retries. Related #94391. Thanks @dexiosmb.
• PR #94428 fix(feishu): preserve replies before error finals. Related #94360. Thanks @xunx33.
• PR #93735 refactor: add restart recovery lifecycle seam. Thanks @jalehman.
• PR #94591 docs(release): backfill complete contribution records. Thanks @vincentkoc.
• PR #94588 fix(cron): retry isolated setup timeouts. Thanks @aaroneden.
• PR #94082 fix(cron): prevent lane timeout during long tool execution. Related #94033. Thanks @ajwan8998 and @JingWang-Star996.
• PR #94551 feat(firecrawl): add keyless scrape support. Thanks @vincentkoc and @developersdigest.
• PR #94619 test(ci): stabilize timeout-sensitive shards. Thanks @vincentkoc.
• PR #94048 fix(telegram): set richMessages default to false explicitly in schema. Related #93770, #93794. Thanks @Monkey-wusky and @obviyus and @Nardoa375 and @laurenceputra.
• PR #94118 [codex] Fix Telegram rich local Markdown link hrefs. Related #94117. Thanks @dankarization and @obviyus.
• PR #94646 refactor(sqlite): land database-first memory and proxy alignment. Thanks @vincentkoc.
• PR #94658 test(sqlite): use shared temp directory helper. Thanks @vincentkoc.
• PR #92135 fix(openai-embedding): preserve openai/ prefix for non-native base URLs. Related #92124. Thanks @xialonglee and @Kambrian.
• PR #93737 refactor: add session maintenance transaction seam. Thanks @jalehman.

Release verification

• npm package: https://www.npmjs.com/package/openclaw/v/2026.6.9-beta.1
• registry tarball: https://registry.npmjs.org/openclaw/-/openclaw-2026.6.9-beta.1.tgz
• integrity: sha512-V50OMp+liBbw/soP1SxhZ04yXUGy3VsfVccI5I1oQCfdBGHNoTLtbvuQ44oaOY/C/CdTcmFvMDt2IzWmB9jQRw==
• release SHA: 687234af56e1f7c2b4037faa9ab2041b159dccf1
• full release CI report: https://github.com/openclaw/releases/blob/main/evidence/2026.6.9-beta.1/release-evidence.md
• release publish: https://github.com/openclaw/openclaw/actions/runs/27805906361
• npm preflight: https://github.com/openclaw/openclaw/actions/runs/27799737148
• full release validation: https://github.com/openclaw/openclaw/actions/runs/27801668529
• plugin npm publish: https://github.com/openclaw/openclaw/actions/runs/27806014895
• plugin ClawHub publish recovery: https://github.com/openclaw/openclaw/actions/runs/27806975206, https://github.com/openclaw/openclaw/actions/runs/27807226080, https://github.com/openclaw/openclaw/actions/runs/27807501599, https://github.com/openclaw/openclaw/actions/runs/27807783949
• plugin ClawHub bootstrap: not needed
• OpenClaw npm publish: https://github.com/openclaw/openclaw/actions/runs/27806117514
• npm Telegram beta E2E: not supplied

2026.6.8

Highlights

• Richer channel delivery: Telegram and WhatsApp are less brittle: Telegram renders structured text with tables, lists, expandable blockquotes, preserved intentional line breaks, and CLI-backed replies, while WhatsApp now honors configured ACP bindings. (#92679, #93164, #84082, #89421, #92513) Thanks @obviyus, @vincentkoc, @jzakirov, @spacegeologist, @TurboTheTurtle, @mcaxtr, @myrzka, and @dmorn.
• More reliable agent runs: account-scoped DM sends, generated media completions, auto-reply message-tool final replies, reset archive fallback reads, restart shutdown aborts, yielded subagent pauses, and session identity prompts all stay on the correct recovery path. (#92788, #91246, #92879, #91357, #92631, #92468) Thanks @yetval, @TurboTheTurtle, @masatohoshino, @CadanHu, @vincentkoc, @ooiuuii, @openperf, @zhangguiping-xydt, @QQSHI13, @kumaxs, and @aleps001.
• Safer model routing: new GLM-5.2 and Claude Haiku 4.5 catalog support arrives with normalized provider IDs, managed SecretRef auth, bounded model browsing, and safer OpenAI/Anthropic tool-schema recovery. (#92796, #90116, #92627, #90686, #92247, #92941) Thanks @arkyu2077, @liuhao1024, @lijenhsin, @rohitjavvadi, @samson910022, @maaron34, @syfvb, and @samson1357924.
• Useful usage footers: /usage and reply payload hooks now have a native full footer renderer, default template, fixed-decimal formatting, credential-aware limits, better partial-count handling, and warnings for broken templates instead of silent bad output. (#92657, #89835, #89629) Thanks @Marvinthebored.
• Predictable web search defaults: key-free providers such as Parallel Free, DuckDuckGo, Ollama, and Codex Hosted Search remain explicit opt-ins rather than surprising automatic fallbacks. (#93616) Thanks @davemorin and @vincentkoc.
• Calmer UI and mobile sessions: workspace files start collapsed, WebChat backscroll survives streaming, the desktop session picker remains interactive, reset arguments survive dispatch, and iOS reconnects stale foreground Gateways. (#92779, #92622, #92705, #91353, #92552) Thanks @shakkernerd, @TurboTheTurtle, @NianJiuZst, @zhouhe-xydt, @Solvely-Colin, @MaBeitian, @vincentkoc, @Chang2020618, and @DrtyMorty.
• Resilient memory and state: oversized OpenAI embedding batches split before 431s, QMD search stays available in transient mode, SQLite avoids WAL on NFS volumes, and full reindexes preserve rollback/cache recovery. (#92650, #92618, #92639, #91247, #92881) Thanks @mushuiyu886, @BrettHamlin, @zhbcher, @TurboTheTurtle, @Takhoffman, @849261680, @TSHOGX, @vincentkoc, and @AFabyTWE.

Changes

• Providers/models: add GLM-5.2 support and Claude Haiku 4.5 catalog entries while keeping provider-qualified model IDs normalized across OpenRouter and Google Vertex paths. (#92796, #90116, #92627, #91218) Thanks @arkyu2077, @liuhao1024, @bymle, @maaron34, @lijenhsin, @davemorin, and @vincentkoc.
• Web search: keep key-free providers such as Parallel Free, DuckDuckGo, Ollama, and Codex Hosted Search as explicit opt-ins instead of selecting them automatically when no API-backed provider is configured. (#93616) Thanks @davemorin and @vincentkoc.
• Channel plugins: ship Telegram rich-message delivery and WhatsApp ACP binding support, including preserved intentional line breaks, rich prompt handoff to CLI backends, and transport fixtures for richer drafts. (#92679, #93164, #92513) Thanks @obviyus, @TurboTheTurtle, @vincentkoc, @mcaxtr, and @dmorn.
• Agent commands: support /btw in CLI-backed sessions and keep CLI usage-error exits classified as usage failures instead of successful runs. (#92669, #92162) Thanks @joshavant, @Pandah97, @marcospaulo, @davemorin, and @vincentkoc.
• Usage hooks: add built-in full footer rendering, default footer templates, per-turn usage state, credential-aware limits, and fixed-decimal formatting for usage-bar templates. (#92657, #89835, #89629) Thanks @Marvinthebored.

Fixes

• Channels and delivery: preserve account-scoped DM channel send policy, intentional rich-message line breaks in Telegram and status output, rich Telegram final replies, rich Telegram tables and lists, Telegram thread-create CLI remapping, Feishu dynamic-agent routes after persisted binding reuse, Slack outbound message_sent hooks, contributed message-tool schema optionality, same-channel generated media completions, and channel chunking around surrogate pairs and Infinity limits. (#92788, #93164, #92679, #89421, #89943, #42837, #92814, #91137, #91246, #92735) Thanks @yetval, @obviyus, @spacegeologist, @rishitamrakar, @liuhao1024, @lundog, @TurboTheTurtle, @yhterrance, @vincentkoc, @myrzka, @cwlong163-afk, @kumaxs, @shakkernerd, and @RewardsPal.
• Gemini CLI: use the selected OpenClaw OAuth/API-key auth profile in an isolated Gemini CLI runtime home, preventing ambient Google machine credentials from overriding the chosen profile. (#88748) Thanks @jason-allen-oneal and @shakkernerd.
• Discord: give generated auto-thread titles a 60-second timeout and 4,096-token reasoning-model output budget, clamped to the selected model output cap. (#64734) Thanks @hanamizuki.
• Agent, cron, and Gateway runtime: mark active main sessions before restart shutdown aborts, pause yielded subagent runs whose terminal also signals abort, clamp trusted subagent thinking overrides through provider/model fallback, preserve yielded media completions, deliver channel message-tool final replies through auto-reply while hiding internal delivery hints, restore reset archive fallback reads when active async transcripts are missing, de-duplicate main-session heartbeat events, expose session identity in runtime prompts, reject unknown OpenAI agent selectors, keep generated media completions, slash-command block replies, and trajectory export commands in WebChat, and require admin privileges for HTTP session/model override surfaces. (#91357, #92631, #92412, #92146, #92879, #91287, #92468, #92510, #91246, #92651, #92646) Thanks @ooiuuii, @openperf, @IWhatsskill, @masatohoshino, @CadanHu, @ZengWen-DT, @zhangguiping-xydt, @TurboTheTurtle, @oiGaDio, @aleps001, @vincentkoc, @GSL-R, @QQSHI13, @ryanhelms, @kumaxs, @steipete-oai, @hxy91819, @davemorin, and @nailujac.
• Providers and model replay: preserve storeless OpenAI Responses replay compatibility, recover invalid OpenAI reasoning signatures and genericized Anthropic thinking-signature replay errors, route OAuth image defaults through Codex for eligible OpenAI profiles, avoid eager tool streaming for Claude 4.5 in Copilot, quarantine unreadable and post-hook OpenAI/Anthropic-family tool schemas without broadening allowed tool choices, deliver explicit thinking-off requests to LM Studio binary-thinking models, honor profile auth for SecretRef model entries, bound model browsing, strip provider prefixes where runtimes need bare IDs, and surface nested embedding fetch failures. (#90706, #92941, #92201, #92916, #92824, #75393, #92908, #92921, #92928, #92002, #90686, #92247, #92627, #91218, #92628) Thanks @snowzlm, @mmyzwl, @CarlCapital, @bek91, @Kailigithub, @vincentkoc, @rohitjavvadi, @samson910022, @nxmxbbd, @liuhao1024, @bymle, @mushuiyu886, @finchinslc, @syfvb, @lijenhsin, @crsnpalmer-art, @samson1357924, @shakkernerd, and @mlaihk.
• Memory, state, diagnostics, and config: split header-too-large embedding batches, keep QMD memory search enabled in transient mode, avoid SQLite WAL on NFS volumes, preserve recovery scheduling outside stuck-session warning backoff, preserve full-reindex rollback/cache recovery, and treat raw Memory Wiki source pages as source evidence. (#92650, #92618, #92639, #91247, #92752, #92881, #59137, #92876) Thanks @mushuiyu886, @TurboTheTurtle, @849261680, @gnanam1990, @TSHOGX, @vincentkoc, @arlen8411, @BrettHamlin, @zhbcher, @Takhoffman, @AFabyTWE, @davemorin, and @zhuyankarl.
• UI/mobile/TUI: preserve dashboard session parent lineage, WebChat backscroll, reset soft command args, sidebar session picker interactivity, collapsed workspace files, resolved /model confirmation refs, stale foreground iOS Gateway reconnects, and paused setup-parent stdin after inherited-stdio child exit. (#90658, #92622, #91353, #92705, #92779, #92773, #92552, #93159) Thanks @luoyanglang, @TurboTheTurtle, @zhouhe-xydt, @NianJiuZst, @shakkernerd, @NarahariRaghava, @Solvely-Colin, @fuller-stack-dev, @lily-oc, @MaBeitian, @vincentkoc, @obviyus, @DrtyMorty, and @Chang2020618.
• Plugins and updates: repair missing required platform packages during managed plugin installs and updates, including omitted Codex platform binaries. Thanks @vincentkoc.
• Dependencies: update Hono to 4.12.25 so published OpenClaw and ACPX packages use the patched runtime. Thanks @vincentkoc.
• Updates: avoid a false downgrade prompt when the latest tag cannot resolve. (#92911) Thanks @Andy312432 and @vincentkoc.

Complete contribution record

This audited record covers the complete v2026.6.6..v2026.6.8 history: 192 merged PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact.

Pull requests

• PR #92144 fix(cron): report SQLite storage path in cron.status instead of legacy jobs.json. Related #91766. Thanks @liuhao1024 and @AaronFaby.
• PR #92175 fix(channel): harden local setup trust. Thanks @hxy91819.
• PR #91528 fix #73837: stop after failed Node package installs. Thanks @mushuiyu886 and @ItsMeForLua.
• PR #91561 fix(wizard): report keyless web_search providers as ready, not missing a key. Thanks @NormallyGaussian.
• PR #92073 fix: handle explicit silent assistant replies. Related #92038. Thanks @sallyom and @vultusv.
• PR #91311 Allow Skill Workshop apply through trusted skill symlinks. Thanks @abnershang.
• PR #88245 refactor(whatsapp): introduce inbound message contexts. Thanks @mcaxtr.
• PR #92212 refactor: move workspace skill writes to lifecycle. Thanks @shakkernerd.
• PR #92248 Remove ClawHub owner preflight. Thanks @Patrick-Erichsen.
• PR #91617 test(sqlite): add state perf query plan harness. Related #91616. Thanks @galiniliev.
• PR #91626 fix(daemon): keep status readable on unsupported services. Related #25621. Thanks @mushuiyu886 and @kucharskim.
• PR #92295 fix(cron): preserve tz and staggerMs when --cron replaces expression. Related #92291. Thanks @liuhao1024 and @dcapclaw.
• PR #92087 fix(docker): bundle QA Lab runtime in the image. Thanks @jesse-merhi.
• PR #92004 fix(telegram): classify streaming preview edit failures instead of killing the draft. Thanks @obviyus.
• PR #91997 fix(telegram): survive getUpdates conflicts in isolated polling ingress. Thanks @obviyus.
• PR #92387 fix(anthropic-vertex): stop re-marking cache_control on transport-budgeted payloads. Related #91982. Thanks @openperf and @Takhoffman and @danieljimz.
• PR #92229 Fix doctor preview channel SecretRef resolution. Related #91939. Thanks @joshavant and @Niriakot.
• PR #92225 Fix disabled heartbeat one-shot cron retries. Related #91775. Thanks @joshavant and @A1fred-AI.
• PR #92265 Fix configured DeepSeek model transport inheritance. Related #92148. Thanks @joshavant and @marcoraepple-sys.
• PR #92226 Fail closed for CLI-backed /btw fallback. Related #92168. Thanks @joshavant and @wangwllu.
• PR #92231 Fix suppressed heartbeat commitment delivery. Related #91948. Thanks @joshavant and @bizzle12368239.
• PR #92280 fix(agents): classify structured unsupported model errors. Related #92118. Thanks @joshavant and @pikaqqqqqq.
• PR #92276 Fix OTLP log trace correlation. Related #91865. Thanks @joshavant and @sinzin91.
• PR #92282 fix(update): hand off Linux service auto-updates. Related #91823. Thanks @joshavant and @hanyizuo.
• PR #92235 fix: resolve managed SecretRef provider auth. Related #92097. Thanks @joshavant and @LINSUISHENG034.
• PR #92293 Fix provider static model fallback resolution. Related #92009. Thanks @joshavant and @mattsfraser.
• PR #92343 fix(agent): continue after source message tool replies. Related #92169. Thanks @joshavant and @elyalvarado.
• PR #92350 fix(codex): preserve memory prompt registration. Thanks @rubencu and @sallyom.
• PR #92290 fix: clarify gateway SecretRef auth diagnostics. Related #91815. Thanks @joshavant and @mattsfraser.
• PR #92286 fix: repair rejected Anthropic thinking replay. Related #91983. Thanks @joshavant and @reginaldomarcilon.
• PR #92281 Fix Telegram spooled buffered replay. Related #92129. Thanks @joshavant and @riseandshinefutures.
• PR #47493 fix(doctor): show per-step progress spinners during update. Thanks @amersheeny.
• PR #92416 fix(outbound): honor top-level image param as send media source (#92407). Thanks @xydigit-sj and @ichirokyoto.
• PR #92508 fix(sandbox): render CLI skill prompts from materialized paths. Thanks @brokemac79.
• PR #92540 chore: fix esbuild production audit failure. Thanks @RomneyDa.
• PR #91484 Add QA evidence artifact output. Thanks @RomneyDa.
• PR #91500 Add QA scorecard taxonomy validation. Thanks @RomneyDa.
• PR #84082 fix(telegram): allow expandable blockquotes. Thanks @jzakirov.
• PR #92554 feat(moonshot): add Kimi K2.7 Code support.
• PR #92396 fix(moonshot): backfill reasoning_content on assistant tool-call replay messages. Related #71491. Thanks @xialonglee and @RoseKongPS.
• PR #92566 Fix lifecycle timeout cleanup after leader exit. Thanks @RomneyDa.
• PR #92311 ci: split plugin ClawHub publishing paths. Thanks @Patrick-Erichsen.
• PR #92216 fix(gateway): mirror hidden commentary-phase assistant events. Thanks @ragesaq.
• PR #87596 fix(moonshot): rewrite duplicate native Kimi tool_call ids on replay. Related #51593. Thanks @Pluviobyte and @Faaab84.
• PR #88993 Expose paged channel action results. Thanks @fuller-stack-dev.
• PR #90326 fix(fireworks): resolve catalog model params from plugin.json via core. Thanks @obuchowski.
• PR #86629 fix(doctor): warn for untrusted external Discord plugin. Related #83212. Thanks @brokemac79 and @ooiuuii and @cdeyoung67.
• PR #90242 fix(providers): skip unreadable Mistral tool schemas. Thanks @vincentkoc.
• PR #92498 fix(reply): mirror same-channel Slack final replies. Related #92489. Thanks @TurboTheTurtle and @TalkingHeadsJed.
• PR #92083 fix(channels): default boundary logger for swallowed progress-draft start errors. Thanks @hansraj316.
• PR #92564 fix(agents): isolate invalid plugin model catalogs [AI-assisted]. Related #92553. Thanks @tangtaizong666 and @fxstein.
• PR #89827 docs: UX-013 — design system documentation. Thanks @BunsDev.
• PR #89615 feat(ui): hide empty workboard columns. Thanks @BunsDev.
• PR #89822 fix(a11y): B-1+B-2+B-3 — contrast, focus states, minimum font sizes. Thanks @BunsDev.
• PR #92618 fix #92218: memory_search tool disabled with QMD backend. Thanks @mushuiyu886 and @zhbcher.
• PR #92608 docs(gateway): add uptime monitoring guidance to health check docs (fixes #55768). Thanks @liuhao1024 and @faahim.
• PR #92605 fix(docs): pin Windows Hub download links to v2026.6.5. Related #92470. Thanks @lzyyzznl and @arjkul.
• PR #92593 #92589: fix(internal-runtime-context): wrap prompt-preface runtime context body in delimiters. Thanks @zhangqueping and @jovi2014-cyber.
• PR #92606 Run Vitest and Playwright scenarios from qa suite. Thanks @RomneyDa.
• PR #89629 feat(hooks): per-turn usageState on replypayloadsending. Thanks @Marvinthebored.
• PR #89835 feat(usage): native templated /usage full footer renderer. Thanks @Marvinthebored.
• PR #92247 fix(models): bound /models and models list catalog loading. Related #91809. Thanks @samson910022 and @samson1357924 and @syfvb.
• PR #92646 fix: require admin for HTTP model overrides. Thanks @steipete-oai.
• PR #90686 fix(gateway): honor profile auth for SecretRef model entries. Related #90685. Thanks @rohitjavvadi.
• PR #92651 fix: require admin for HTTP session kills. Thanks @steipete-oai.
• PR #92652 test(models): stabilize plugin auth marker fixtures.
• PR #89438 fix(slack): warn when channels map is keyed by name instead of channel ID. Related #81665. Thanks @Alix-007 and @cjalden.
• PR #92631 fix(agents): pause yielded subagent runs whose terminal also signals abort. Related #92448. Thanks @openperf and @vincentkoc and @aleps001.
• PR #92622 fix(ui): preserve WebChat backscroll during streaming. Related #92386. Thanks @TurboTheTurtle and @vincentkoc and @DrtyMorty.
• PR #92627 fix(openrouter): strip openrouter/ prefix from model ID in normalizeResolvedModel hook (fixes #92611). Thanks @liuhao1024 and @lijenhsin.
• PR #92146 fix(cron): preserve yielded media completions. Related #92120. Thanks @IWhatsskill and @nailujac.
• PR #90116 fix: add Claude Haiku 4.5 static catalog entries. Related #90088. Thanks @arkyu2077 and @maaron34.
• PR #91137 fix(channels): keep contributed message-tool schema properties optional. Related #67852. Thanks @lundog and @RewardsPal.
• PR #75393 fix(copilot): disable eager tool streaming for Claude 4.5. Related #75348. Thanks @Kailigithub and @finchinslc.
• PR #92628 fix #73713: surface nested embedding fetch failures. Thanks @mushuiyu886 and @crsnpalmer-art.
• PR #92510 fix(gateway): reject unknown OpenAI agent selectors. Related #92504. Thanks @zhangguiping-xydt and @ryanhelms.
• PR #91453 fix #91420: [Bug]: Delivery retry loop corrupts active sessions (R-004) — retry selector bypasses delivery.mode=none. Thanks @zhangguiping-xydt and @CarotaWealth.
• PR #92468 fix #92453: add session identity to runtime prompt. Thanks @zhangguiping-xydt and @QQSHI13.
• PR #89943 fix(slack): emit message_sent hook on outbound delivery (mirror Telegram). Related #89942. Thanks @rishitamrakar.
• PR #92668 fix(docs): finalize i18n postprocess before skip. Thanks @hxy91819.
• PR #92673 fix: split image setup and request timeout semantics. Thanks @hxy91819.
• PR #92162 #92069: fix(cli): usage errors exit 0. Thanks @Pandah97 and @marcospaulo.
• PR #91185 fix(browser): remove dead requireRef import and void expression in register.navigation.ts. Related #83878. Thanks @whiteyzy and @davinci282828.
• PR #90706 fix(OpenAI Responses): disable item id replay for storeless providers. Related #89728. Thanks @snowzlm.
• PR #90247 fix(disk-space): promote 1024 MiB to 1.0 GiB in disk warnings. Related #90245. Thanks @jbetala7.
• PR #92657 feat(usage): ship built-in /usage full footer. Thanks @Marvinthebored.
• PR #90464 perf(terminal): reuse ANSI scanner during truncation. Thanks @yyzquwu.
• PR #91281 fix(feishu): clear client cache when SDK is replaced via setFeishuClientRuntimeForTest. Related #83911. Thanks @whiteyzy and @davinci282828.
• PR #92639 fix(memory): keep memory_search in transient qmd mode. Related #92464. Thanks @TurboTheTurtle and @Takhoffman and @BrettHamlin.
• PR #91287 fix(cron): de-duplicate main-session systemEvent in heartbeat model input. Related #44922. Thanks @ZengWen-DT and @GSL-R.
• PR #91246 Fix webchat media completion handoff. Related #91003. Thanks @TurboTheTurtle and @kumaxs.
• PR #91353 fix(ui): preserve /reset soft args in Control UI dispatch. Related #91316. Thanks @zhouhe-xydt and @MaBeitian.
• PR #92679 feat(telegram): send rich message text. Thanks @obviyus.
• PR #92705 fix(ui): restore sidebar session picker interactivity above desktop workbench. Related #92707. Thanks @NianJiuZst and @vincentkoc.
• PR #91218 fix(google): strip provider prefix from Vertex model path. Thanks @bymle.
• PR #92669 feat: support /btw in CLI-backed sessions. Thanks @joshavant.
• PR #91357 fix(gateway): mark active main sessions before restart shutdown aborts. Related #91355. Thanks @ooiuuii.
• PR #91066 fix(parallel): send openclaw-parallel User-Agent on free Search MCP requests. Thanks @NormallyGaussian.
• PR #90658 fix(ui): preserve dashboard session parent lineage when session list is stale. Related #90623. Thanks @luoyanglang and @lily-oc.
• PR #92552 fix(ios): force stale foreground gateway reconnects. Thanks @Solvely-Colin.
• PR #89421 fix(telegram): expose thread create CLI remap. Related #81581. Thanks @spacegeologist and @myrzka.
• PR #92779 fix: start workspace files collapsed. Related #90359. Thanks @shakkernerd and @Chang2020618.
• PR #91247 fix(state): avoid sqlite wal on nfs state volumes. Related #90491. Thanks @849261680 and @AFabyTWE.
• PR #92773 fix(tui): show resolved canonical model ref in /model confirmation. Thanks @NarahariRaghava.
• PR #92752 fix(diagnostics): keep recovery scheduling out of the stuck-session warning backoff. Related #92742. Thanks @gnanam1990 and @Takhoffman and @zhuyankarl.
• PR #92735 fix(markdown-core): treat Infinity chunk limit as unbounded, not 1. Related #92734. Thanks @yhterrance.
• PR #92695 docs(config): correct maxConcurrent default in agent-defaults type comments (AI-assisted). Thanks @ArielSmoliar.
• PR #92766 clarify before_install hook scope. Related #91593. Thanks @sallyom and @Trump-last.
• PR #92677 docs(nodes): add openclaw.json config example to Nodes overview. Related #92662. Thanks @liuhao1024 and @Casper-Mars.
• PR #92513 Honor WhatsApp configured ACP bindings. Related #92449. Thanks @TurboTheTurtle and @mcaxtr and @dmorn.
• PR #92650 fix #92465: split OpenAI 431 embedding batches. Thanks @mushuiyu886 and @BrettHamlin.
• PR #92796 feat(providers): add GLM-5.2 support.
• PR #92788 fix(sessions): derive channel from account-scoped DM session keys in send-policy. Thanks @yetval.
• PR #92590 Docker image ships an extraneous stale openclaw in /app/node_modules (extensions pin the published release). Related #92551. Thanks @lzyyzznl and @fxstein.
• PR #92393 chore(deps): bump the swift-deps group across 1 directory with 3 updates.
• PR #92476 fix(agents): preserve compatible CLI session runtime pins. Thanks @yu-xin-c.
• PR #92483 fix(matrix): validate CLI numeric option ranges. Related #92482. Thanks @rohitjavvadi.
• PR #92490 fix(canvas): validate CLI numeric options. Related #92487. Thanks @rohitjavvadi.
• PR #92802 fix(ui): reflow composer beside workspace rail. Thanks @Solvely-Colin and @shakkernerd.
• PR #91059 fix(configure): mask gateway token input in CLI wizard prompt. Thanks @anurag-bg-neu.
• PR #91143 fix(ports): only classify SSH -L/-R tunnels on the queried port as ssh. Related #91142. Thanks @jbetala7.
• PR #91110 fix(tavily): keep web_search contract executable. Related #91096. Thanks @extrasmall0 and @xucongyuan98-sys.
• PR #91181 fix(daemon): strip schtasks backslash prefix when matching gateway task name. Related #90494. Thanks @425072024 and @Darnellicious.
• PR #91187 fix(cron): isolate auth profile failure policy so cron runs don't pollute shared cooldowns. Related #90991. Thanks @openperf and @cx306806112.
• PR #92807 fix(heartbeat): route outbound mirror to isolated session key. Thanks @agent-merkava.
• PR #92745 fix(memory): explain skipped short-term recall hits. Related #92706. Thanks @mushuiyu886 and @armarinho.
• PR #92488 fix(gateway): forward image-only input on /v1/responses (parity with chat completions). Thanks @s554097550 and @cursoragent.
• PR #92604 fix(status): avoid cumulative usage for context percent. Related #83526. Thanks @ashishpatel26 and @darconadalabarga.
• PR #92810 fix: reject unvalidated voice media streams. Thanks @steipete-oai.
• PR #92800 fix(telegram): answer callback queries before sequentialize delays them. Related #42156. Thanks @liuhao1024 and @Diaspar4u.
• PR #92547 fix(nodes): surface pending reapproval diagnostics. Thanks @fuller-stack-dev.
• PR #92690 fix(doctor): avoid false-positive legacy cron store warning when store was already migrated (fixes #92683). Thanks @liuhao1024 and @motteman.
• PR #92806 fix(telegram): skip IPv4 fallback when user explicitly configures non-ipv4first dnsResultOrder (fixes #41671). Thanks @liuhao1024 and @vincentkoc and @leandroirani933-ctrl.
• PR #92778 fix(macos): defer isOverflowing mutation to break SwiftUI render loop (fixes #43480). Thanks @liuhao1024 and @vincentkoc and @gdiab.
• PR #92795 fix(gateway): use resolveNonNegativeNumber for totalTokens to display 0 instead of ? (fixes #43009). Thanks @liuhao1024 and @vincentkoc and @ltxy12138-ai.
• PR #92746 fix(gateway): preserve active runs during plugin finalization. Thanks @scotthuang and @vincentkoc.
• PR #92820 UI: localize Logs tab labels. Thanks @rubensfox20.
• PR #92825 fix(telegram): preserve command callbacks while prefixing generic callback data. Related #54909. Thanks @hnshah and @timt80.
• PR #90889 fix: cap session context overrides by model window. Related #39857. Thanks @xdanger.
• PR #92830 fix(copilot): strip replayed thinking blocks. Related #81520. Thanks @giodl73-repo and @warcold.
• PR #92834 feat(browser): extend --labels overlay to full-page and element captures. Thanks @hxy91819 and @FMLS and @cursoragent.
• PR #92836 fix(discord): raise thread title timeout and tokens to fit reasoning models. Thanks @hanamizuki.
• PR #92095 fix #92039: [Bug]: WhatsApp login reports success before auth is durably persisted, so Docker rebuilds/upgrades can force relink. Thanks @zhangguiping-xydt and @dinorastoder.
• PR #92801 fix(stale): exempt ClawSweeper actionable labels from stale lifecycle (fixes #89564). Thanks @liuhao1024 and @brokemac79.
• PR #89736 fix(status): render sub-1000 token counts as plain integers. Related #89735. Thanks @jbetala7 and @vincentkoc.
• PR #92792 fix(agents): catch malformed image blocks in sanitizeContentBlocksImages. Thanks @LowCode191 and @vincentkoc.
• PR #92555 ci: gate stable releases on Windows companion assets. Thanks @fuller-stack-dev.
• PR #91824 fix(agents): add usage guidance to sessions_spawn tool description (fixes #91814). Thanks @zenglingbiao and @vincentkoc and @cattails-lgao.
• PR #92840 fix(feishu): await HTTP server shutdown during monitor cleanup. Related #48183. Thanks @alex-xuweilong and @ai-nurmamat.
• PR #91632 feat: add tool search directory mode. Thanks @fuller-stack-dev.
• PR #92823 fix(qqbot): surface failed media sends. Thanks @zhangguiping-xydt and @vincentkoc.
• PR #92849 fix(tailscale): preserve parse errors for malformed JSON. Thanks @franciscomaestre.
• PR #92045 Fix diagnostics OTEL runtime install trust. Thanks @efpiva.
• PR #92853 fix(acp): accept MCP date protocolVersion in ACP server. Related #56102. Thanks @bugkill3r and @moliveto.
• PR #92854 fix(hooks): reject slug-generator error payloads. Thanks @Cypherm.
• PR #92855 fix(ui): repair iOS Safari chat viewport handling. Thanks @macdao.
• PR #91586 fix(update): continue after package doctor warnings. Thanks @fuller-stack-dev.
• PR #92862 fix(feishu): target typing reaction on inbound message. Thanks @huiwen01.
• PR #92861 fix(lobster): surface workflow path errors. Related #68101. Thanks @vvitovec and @MPC7500.
• PR #69975 fix(cli): clarify --tz help text for offset-less --at values. Related #59456. Thanks @rrrrrredy.
• PR #90682 fix(openai): preserve opaque reasoning transcript fields. Related #90093. Thanks @toruvieI and @richardmqq.
• PR #92373 fix(anthropic): strip thinking blocks from history when thinking is disabled (fixes #92360). Thanks @liuhao1024 and @notnaji.
• PR #87346 fix(anthropic): merge consecutive assistant turns in turn validation. Related #87329. Thanks @Jefsky and @travellingsoldier85.
• PR #92896 fix(anthropic): quarantine invalid direct tool schemas. Thanks @vincentkoc.
• PR #90739 fix(active-memory): preserve verbose recall summaries. Related #90454. Thanks @brokemac79 and @nocode-ananas.
• PR #92558 Simplify QA scorecard mapping shape. Thanks @RomneyDa.
• PR #92876 fix(memory-wiki): stop flagging raw source pages as malformed. Thanks @vincentkoc.
• PR #92908 fix(providers): quarantine unreadable Anthropic payload tools. Thanks @vincentkoc.
• PR #92881 fix(memory): preserve reindex rollback recovery. Thanks @TSHOGX and @vincentkoc.
• PR #92921 fix(openai): quarantine unreadable tool schemas. Thanks @vincentkoc.
• PR #92550 Fold Telegram RTT sampling into live QA evidence. Thanks @RomneyDa.
• PR #92824 fix(media): route OAuth image defaults through Codex. Related #87168. Thanks @bek91.
• PR #92928 fix(openai): guard post-hook tool payloads. Thanks @vincentkoc.
• PR #92814 fix(feishu): re-resolve route when dynamic agent binding already exists in runtime config (fixes #42837). Thanks @liuhao1024 and @vincentkoc and @cwlong163-afk.
• PR #89055 fix: restart gateway after isolated cron setup timeout. Thanks @ghitafilali.
• PR #90574 fix(openai): omit gpt-5.5 tool reasoning effort. Thanks @BSG2000.
• PR #92941 fix(openai): recover invalid reasoning signatures.
• PR #92914 fix(agents): clamp unsupported thinking for subagent spawns instead of hard-failing. Related #92412. Thanks @openperf and @oiGaDio.
• PR #92573 fix: preserve config-selected subagent model overrides. Related #92486. Thanks @arkyu2077 and @PatrickTrent.
• PR #92852 fix(gateway): fall back to polling when config watcher exhausts inotify retries. Related #92851. Thanks @danbao.
• PR #92362 fix(gateway): build row metadata context for single session lists. Thanks @anyech.
• PR #92897 fix(memory-wiki): tolerate public artifacts without agent ids. Related #92207. Thanks @yu-xin-c and @qq230849622-a11y.
• PR #92002 fix(lmstudio): deliver thinking "off" to binary-thinking models. Related #91913. Thanks @nxmxbbd and @mlaihk.
• PR #92738 Forward suppressed-source progress for message-tool channel replies. Thanks @ragesaq.
• PR #92916 #92201: Embedded runner: freshly streamed thinking signatures intermittently invalid on replay (Anthropic); recovery wrapper never fires because error text is genericized. Thanks @mmyzwl and @CarlCapital.
• PR #90936 fix(agents): do not misclassify client-disconnect abort as run timeout. Related #90764. Thanks @openperf and @reginaldomarcilon.
• PR #93009 fix(agents): make wrapToolWithBeforeToolCallHook idempotent to prevent double hook execution (fixes #92973). Thanks @zenglingbiao and @dertbv.
• PR #92318 fix(cron): require explicit message target proof. Thanks @hxy91819.
• PR #93022 fix(gateway): repair usage cost aggregation across agents. Thanks @luke-skywalker-open-claw and @stablegenius49.
• PR #93159 fix(tui): keep parent stdin paused after exit. Thanks @fuller-stack-dev.
• PR #93616 Keep key-free web search providers opt-in. Thanks @davemorin and @vincentkoc.
• PR #93164 fix(telegram): preserve rich markdown line breaks. Thanks @vincentkoc.

Release verification

• npm package: https://www.npmjs.com/package/openclaw/v/2026.6.8-beta.2
• registry tarball: https://registry.npmjs.org/openclaw/-/openclaw-2026.6.8-beta.2.tgz
• integrity: sha512-44ab7b24zUY14dpEVt9TZpd6o6PfbYfnNjSbALHULsCkE7e1ju+ZOia46EawvRLqbYqOwjM9oucnbk7P9/eWsQ==
• release SHA: b1736723d716b1abe1f8d324772371661146f3b8
• release publish: https://github.com/openclaw/openclaw/actions/runs/27587320308
• postpublish recovery: exact npm install, 35 npm plugins, and 35 ClawHub packages verified after registry propagation
• npm preflight: https://github.com/openclaw/openclaw/actions/runs/27582865457
• full release validation: https://github.com/openclaw/openclaw/actions/runs/27584541070
• plugin npm publish: https://github.com/openclaw/openclaw/actions/runs/27587508776
• plugin ClawHub publish: https://github.com/openclaw/openclaw/actions/runs/27587512198
• plugin ClawHub bootstrap: not needed
• OpenClaw npm publish: https://github.com/openclaw/openclaw/actions/runs/27587814328
• npm Telegram beta E2E: https://github.com/openclaw/openclaw/actions/runs/27588410701

2026.6.8

Highlights

• Richer channel delivery: Telegram and WhatsApp are less brittle: Telegram renders structured text with tables, lists, expandable blockquotes, preserved intentional line breaks, and CLI-backed replies, while WhatsApp now honors configured ACP bindings. (#92679, #93164, #84082, #89421, #92513) Thanks @obviyus, @vincentkoc, @jzakirov, @spacegeologist, @TurboTheTurtle, @mcaxtr, @myrzka, and @dmorn.
• More reliable agent runs: account-scoped DM sends, generated media completions, auto-reply message-tool final replies, reset archive fallback reads, restart shutdown aborts, yielded subagent pauses, and session identity prompts all stay on the correct recovery path. (#92788, #91246, #92879, #91357, #92631, #92468) Thanks @yetval, @TurboTheTurtle, @masatohoshino, @CadanHu, @vincentkoc, @ooiuuii, @openperf, @zhangguiping-xydt, @QQSHI13, @kumaxs, and @aleps001.
• Safer model routing: new GLM-5.2 and Claude Haiku 4.5 catalog support arrives with normalized provider IDs, managed SecretRef auth, bounded model browsing, and safer OpenAI/Anthropic tool-schema recovery. (#92796, #90116, #92627, #90686, #92247, #92941) Thanks @arkyu2077, @liuhao1024, @lijenhsin, @rohitjavvadi, @samson910022, @maaron34, @syfvb, and @samson1357924.
• Useful usage footers: /usage and reply payload hooks now have a native full footer renderer, default template, fixed-decimal formatting, credential-aware limits, better partial-count handling, and warnings for broken templates instead of silent bad output. (#92657, #89835, #89629) Thanks @Marvinthebored.
• Predictable web search defaults: key-free providers such as Parallel Free, DuckDuckGo, Ollama, and Codex Hosted Search remain explicit opt-ins rather than surprising automatic fallbacks. (#93616) Thanks @davemorin and @vincentkoc.
• Calmer UI and mobile sessions: workspace files start collapsed, WebChat backscroll survives streaming, the desktop session picker remains interactive, reset arguments survive dispatch, and iOS reconnects stale foreground Gateways. (#92779, #92622, #92705, #91353, #92552) Thanks @shakkernerd, @TurboTheTurtle, @NianJiuZst, @zhouhe-xydt, @Solvely-Colin, @MaBeitian, @vincentkoc, @Chang2020618, and @DrtyMorty.
• Resilient memory and state: oversized OpenAI embedding batches split before 431s, QMD search stays available in transient mode, SQLite avoids WAL on NFS volumes, and full reindexes preserve rollback/cache recovery. (#92650, #92618, #92639, #91247, #92881) Thanks @mushuiyu886, @BrettHamlin, @zhbcher, @TurboTheTurtle, @Takhoffman, @849261680, @TSHOGX, @vincentkoc, and @AFabyTWE.

Changes

• Providers/models: add GLM-5.2 support and Claude Haiku 4.5 catalog entries while keeping provider-qualified model IDs normalized across OpenRouter and Google Vertex paths. (#92796, #90116, #92627, #91218) Thanks @arkyu2077, @liuhao1024, @bymle, @maaron34, @lijenhsin, @davemorin, and @vincentkoc.
• Web search: keep key-free providers such as Parallel Free, DuckDuckGo, Ollama, and Codex Hosted Search as explicit opt-ins instead of selecting them automatically when no API-backed provider is configured. (#93616) Thanks @davemorin and @vincentkoc.
• Channel plugins: ship Telegram rich-message delivery and WhatsApp ACP binding support, including preserved intentional line breaks, rich prompt handoff to CLI backends, and transport fixtures for richer drafts. (#92679, #93164, #92513) Thanks @obviyus, @TurboTheTurtle, @vincentkoc, @mcaxtr, and @dmorn.
• Agent commands: support /btw in CLI-backed sessions and keep CLI usage-error exits classified as usage failures instead of successful runs. (#92669, #92162) Thanks @joshavant, @Pandah97, @marcospaulo, @davemorin, and @vincentkoc.
• Usage hooks: add built-in full footer rendering, default footer templates, per-turn usage state, credential-aware limits, and fixed-decimal formatting for usage-bar templates. (#92657, #89835, #89629) Thanks @Marvinthebored.

Fixes

• Channels and delivery: preserve account-scoped DM channel send policy, intentional rich-message line breaks in Telegram and status output, rich Telegram final replies, rich Telegram tables and lists, Telegram thread-create CLI remapping, Feishu dynamic-agent routes after persisted binding reuse, Slack outbound message_sent hooks, contributed message-tool schema optionality, same-channel generated media completions, and channel chunking around surrogate pairs and Infinity limits. (#92788, #93164, #92679, #89421, #89943, #42837, #92814, #91137, #91246, #92735) Thanks @yetval, @obviyus, @spacegeologist, @rishitamrakar, @liuhao1024, @lundog, @TurboTheTurtle, @yhterrance, @vincentkoc, @myrzka, @cwlong163-afk, @kumaxs, @shakkernerd, and @RewardsPal.
• Gemini CLI: use the selected OpenClaw OAuth/API-key auth profile in an isolated Gemini CLI runtime home, preventing ambient Google machine credentials from overriding the chosen profile. (#88748) Thanks @jason-allen-oneal and @shakkernerd.
• Discord: give generated auto-thread titles a 60-second timeout and 4,096-token reasoning-model output budget, clamped to the selected model output cap. (#64734) Thanks @hanamizuki.
• Agent, cron, and Gateway runtime: mark active main sessions before restart shutdown aborts, pause yielded subagent runs whose terminal also signals abort, clamp trusted subagent thinking overrides through provider/model fallback, preserve yielded media completions, deliver channel message-tool final replies through auto-reply while hiding internal delivery hints, restore reset archive fallback reads when active async transcripts are missing, de-duplicate main-session heartbeat events, expose session identity in runtime prompts, reject unknown OpenAI agent selectors, keep generated media completions, slash-command block replies, and trajectory export commands in WebChat, and require admin privileges for HTTP session/model override surfaces. (#91357, #92631, #92412, #92146, #92879, #91287, #92468, #92510, #91246, #92651, #92646) Thanks @ooiuuii, @openperf, @IWhatsskill, @masatohoshino, @CadanHu, @ZengWen-DT, @zhangguiping-xydt, @TurboTheTurtle, @oiGaDio, @aleps001, @vincentkoc, @GSL-R, @QQSHI13, @ryanhelms, @kumaxs, @steipete-oai, @hxy91819, @davemorin, and @nailujac.
• Providers and model replay: preserve storeless OpenAI Responses replay compatibility, recover invalid OpenAI reasoning signatures and genericized Anthropic thinking-signature replay errors, route OAuth image defaults through Codex for eligible OpenAI profiles, avoid eager tool streaming for Claude 4.5 in Copilot, quarantine unreadable and post-hook OpenAI/Anthropic-family tool schemas without broadening allowed tool choices, deliver explicit thinking-off requests to LM Studio binary-thinking models, honor profile auth for SecretRef model entries, bound model browsing, strip provider prefixes where runtimes need bare IDs, and surface nested embedding fetch failures. (#90706, #92941, #92201, #92916, #92824, #75393, #92908, #92921, #92928, #92002, #90686, #92247, #92627, #91218, #92628) Thanks @snowzlm, @mmyzwl, @CarlCapital, @bek91, @Kailigithub, @vincentkoc, @rohitjavvadi, @samson910022, @nxmxbbd, @liuhao1024, @bymle, @mushuiyu886, @finchinslc, @syfvb, @lijenhsin, @crsnpalmer-art, @samson1357924, @shakkernerd, and @mlaihk.
• Memory, state, diagnostics, and config: split header-too-large embedding batches, keep QMD memory search enabled in transient mode, avoid SQLite WAL on NFS volumes, preserve recovery scheduling outside stuck-session warning backoff, preserve full-reindex rollback/cache recovery, and treat raw Memory Wiki source pages as source evidence. (#92650, #92618, #92639, #91247, #92752, #92881, #59137, #92876) Thanks @mushuiyu886, @TurboTheTurtle, @849261680, @gnanam1990, @TSHOGX, @vincentkoc, @arlen8411, @BrettHamlin, @zhbcher, @Takhoffman, @AFabyTWE, @davemorin, and @zhuyankarl.
• UI/mobile/TUI: preserve dashboard session parent lineage, WebChat backscroll, reset soft command args, sidebar session picker interactivity, collapsed workspace files, resolved /model confirmation refs, stale foreground iOS Gateway reconnects, and paused setup-parent stdin after inherited-stdio child exit. (#90658, #92622, #91353, #92705, #92779, #92773, #92552, #93159) Thanks @luoyanglang, @TurboTheTurtle, @zhouhe-xydt, @NianJiuZst, @shakkernerd, @NarahariRaghava, @Solvely-Colin, @fuller-stack-dev, @lily-oc, @MaBeitian, @vincentkoc, @obviyus, @DrtyMorty, and @Chang2020618.
• Plugins and updates: repair missing required platform packages during managed plugin installs and updates, including omitted Codex platform binaries. Thanks @vincentkoc.
• Dependencies: update Hono to 4.12.25 so published OpenClaw and ACPX packages use the patched runtime. Thanks @vincentkoc.
• Updates: avoid a false downgrade prompt when the latest tag cannot resolve. (#92911) Thanks @Andy312432 and @vincentkoc.

Complete contribution record

This audited record covers the complete v2026.6.6..v2026.6.8 history: 192 merged PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact.

Pull requests

• PR #92144 fix(cron): report SQLite storage path in cron.status instead of legacy jobs.json. Related #91766. Thanks @liuhao1024 and @AaronFaby.
• PR #92175 fix(channel): harden local setup trust. Thanks @hxy91819.
• PR #91528 fix #73837: stop after failed Node package installs. Thanks @mushuiyu886 and @ItsMeForLua.
• PR #91561 fix(wizard): report keyless web_search providers as ready, not missing a key. Thanks @NormallyGaussian.
• PR #92073 fix: handle explicit silent assistant replies. Related #92038. Thanks @sallyom and @vultusv.
• PR #91311 Allow Skill Workshop apply through trusted skill symlinks. Thanks @abnershang.
• PR #88245 refactor(whatsapp): introduce inbound message contexts. Thanks @mcaxtr.
• PR #92212 refactor: move workspace skill writes to lifecycle. Thanks @shakkernerd.
• PR #92248 Remove ClawHub owner preflight. Thanks @Patrick-Erichsen.
• PR #91617 test(sqlite): add state perf query plan harness. Related #91616. Thanks @galiniliev.
• PR #91626 fix(daemon): keep status readable on unsupported services. Related #25621. Thanks @mushuiyu886 and @kucharskim.
• PR #92295 fix(cron): preserve tz and staggerMs when --cron replaces expression. Related #92291. Thanks @liuhao1024 and @dcapclaw.
• PR #92087 fix(docker): bundle QA Lab runtime in the image. Thanks @jesse-merhi.
• PR #92004 fix(telegram): classify streaming preview edit failures instead of killing the draft. Thanks @obviyus.
• PR #91997 fix(telegram): survive getUpdates conflicts in isolated polling ingress. Thanks @obviyus.
• PR #92387 fix(anthropic-vertex): stop re-marking cache_control on transport-budgeted payloads. Related #91982. Thanks @openperf and @Takhoffman and @danieljimz.
• PR #92229 Fix doctor preview channel SecretRef resolution. Related #91939. Thanks @joshavant and @Niriakot.
• PR #92225 Fix disabled heartbeat one-shot cron retries. Related #91775. Thanks @joshavant and @A1fred-AI.
• PR #92265 Fix configured DeepSeek model transport inheritance. Related #92148. Thanks @joshavant and @marcoraepple-sys.
• PR #92226 Fail closed for CLI-backed /btw fallback. Related #92168. Thanks @joshavant and @wangwllu.
• PR #92231 Fix suppressed heartbeat commitment delivery. Related #91948. Thanks @joshavant and @bizzle12368239.
• PR #92280 fix(agents): classify structured unsupported model errors. Related #92118. Thanks @joshavant and @pikaqqqqqq.
• PR #92276 Fix OTLP log trace correlation. Related #91865. Thanks @joshavant and @sinzin91.
• PR #92282 fix(update): hand off Linux service auto-updates. Related #91823. Thanks @joshavant and @hanyizuo.
• PR #92235 fix: resolve managed SecretRef provider auth. Related #92097. Thanks @joshavant and @LINSUISHENG034.
• PR #92293 Fix provider static model fallback resolution. Related #92009. Thanks @joshavant and @mattsfraser.
• PR #92343 fix(agent): continue after source message tool replies. Related #92169. Thanks @joshavant and @elyalvarado.
• PR #92350 fix(codex): preserve memory prompt registration. Thanks @rubencu and @sallyom.
• PR #92290 fix: clarify gateway SecretRef auth diagnostics. Related #91815. Thanks @joshavant and @mattsfraser.
• PR #92286 fix: repair rejected Anthropic thinking replay. Related #91983. Thanks @joshavant and @reginaldomarcilon.
• PR #92281 Fix Telegram spooled buffered replay. Related #92129. Thanks @joshavant and @riseandshinefutures.
• PR #47493 fix(doctor): show per-step progress spinners during update. Thanks @amersheeny.
• PR #92416 fix(outbound): honor top-level image param as send media source (#92407). Thanks @xydigit-sj and @ichirokyoto.
• PR #92508 fix(sandbox): render CLI skill prompts from materialized paths. Thanks @brokemac79.
• PR #92540 chore: fix esbuild production audit failure. Thanks @RomneyDa.
• PR #91484 Add QA evidence artifact output. Thanks @RomneyDa.
• PR #91500 Add QA scorecard taxonomy validation. Thanks @RomneyDa.
• PR #84082 fix(telegram): allow expandable blockquotes. Thanks @jzakirov.
• PR #92554 feat(moonshot): add Kimi K2.7 Code support.
• PR #92396 fix(moonshot): backfill reasoning_content on assistant tool-call replay messages. Related #71491. Thanks @xialonglee and @RoseKongPS.
• PR #92566 Fix lifecycle timeout cleanup after leader exit. Thanks @RomneyDa.
• PR #92311 ci: split plugin ClawHub publishing paths. Thanks @Patrick-Erichsen.
• PR #92216 fix(gateway): mirror hidden commentary-phase assistant events. Thanks @ragesaq.
• PR #87596 fix(moonshot): rewrite duplicate native Kimi tool_call ids on replay. Related #51593. Thanks @Pluviobyte and @Faaab84.
• PR #88993 Expose paged channel action results. Thanks @fuller-stack-dev.
• PR #90326 fix(fireworks): resolve catalog model params from plugin.json via core. Thanks @obuchowski.
• PR #86629 fix(doctor): warn for untrusted external Discord plugin. Related #83212. Thanks @brokemac79 and @ooiuuii and @cdeyoung67.
• PR #90242 fix(providers): skip unreadable Mistral tool schemas. Thanks @vincentkoc.
• PR #92498 fix(reply): mirror same-channel Slack final replies. Related #92489. Thanks @TurboTheTurtle and @TalkingHeadsJed.
• PR #92083 fix(channels): default boundary logger for swallowed progress-draft start errors. Thanks @hansraj316.
• PR #92564 fix(agents): isolate invalid plugin model catalogs [AI-assisted]. Related #92553. Thanks @tangtaizong666 and @fxstein.
• PR #89827 docs: UX-013 — design system documentation. Thanks @BunsDev.
• PR #89615 feat(ui): hide empty workboard columns. Thanks @BunsDev.
• PR #89822 fix(a11y): B-1+B-2+B-3 — contrast, focus states, minimum font sizes. Thanks @BunsDev.
• PR #92618 fix #92218: memory_search tool disabled with QMD backend. Thanks @mushuiyu886 and @zhbcher.
• PR #92608 docs(gateway): add uptime monitoring guidance to health check docs (fixes #55768). Thanks @liuhao1024 and @faahim.
• PR #92605 fix(docs): pin Windows Hub download links to v2026.6.5. Related #92470. Thanks @lzyyzznl and @arjkul.
• PR #92593 #92589: fix(internal-runtime-context): wrap prompt-preface runtime context body in delimiters. Thanks @zhangqueping and @jovi2014-cyber.
• PR #92606 Run Vitest and Playwright scenarios from qa suite. Thanks @RomneyDa.
• PR #89629 feat(hooks): per-turn usageState on replypayloadsending. Thanks @Marvinthebored.
• PR #89835 feat(usage): native templated /usage full footer renderer. Thanks @Marvinthebored.
• PR #92247 fix(models): bound /models and models list catalog loading. Related #91809. Thanks @samson910022 and @samson1357924 and @syfvb.
• PR #92646 fix: require admin for HTTP model overrides. Thanks @steipete-oai.
• PR #90686 fix(gateway): honor profile auth for SecretRef model entries. Related #90685. Thanks @rohitjavvadi.
• PR #92651 fix: require admin for HTTP session kills. Thanks @steipete-oai.
• PR #92652 test(models): stabilize plugin auth marker fixtures.
• PR #89438 fix(slack): warn when channels map is keyed by name instead of channel ID. Related #81665. Thanks @Alix-007 and @cjalden.
• PR #92631 fix(agents): pause yielded subagent runs whose terminal also signals abort. Related #92448. Thanks @openperf and @vincentkoc and @aleps001.
• PR #92622 fix(ui): preserve WebChat backscroll during streaming. Related #92386. Thanks @TurboTheTurtle and @vincentkoc and @DrtyMorty.
• PR #92627 fix(openrouter): strip openrouter/ prefix from model ID in normalizeResolvedModel hook (fixes #92611). Thanks @liuhao1024 and @lijenhsin.
• PR #92146 fix(cron): preserve yielded media completions. Related #92120. Thanks @IWhatsskill and @nailujac.
• PR #90116 fix: add Claude Haiku 4.5 static catalog entries. Related #90088. Thanks @arkyu2077 and @maaron34.
• PR #91137 fix(channels): keep contributed message-tool schema properties optional. Related #67852. Thanks @lundog and @RewardsPal.
• PR #75393 fix(copilot): disable eager tool streaming for Claude 4.5. Related #75348. Thanks @Kailigithub and @finchinslc.
• PR #92628 fix #73713: surface nested embedding fetch failures. Thanks @mushuiyu886 and @crsnpalmer-art.
• PR #92510 fix(gateway): reject unknown OpenAI agent selectors. Related #92504. Thanks @zhangguiping-xydt and @ryanhelms.
• PR #91453 fix #91420: [Bug]: Delivery retry loop corrupts active sessions (R-004) — retry selector bypasses delivery.mode=none. Thanks @zhangguiping-xydt and @CarotaWealth.
• PR #92468 fix #92453: add session identity to runtime prompt. Thanks @zhangguiping-xydt and @QQSHI13.
• PR #89943 fix(slack): emit message_sent hook on outbound delivery (mirror Telegram). Related #89942. Thanks @rishitamrakar.
• PR #92668 fix(docs): finalize i18n postprocess before skip. Thanks @hxy91819.
• PR #92673 fix: split image setup and request timeout semantics. Thanks @hxy91819.
• PR #92162 #92069: fix(cli): usage errors exit 0. Thanks @Pandah97 and @marcospaulo.
• PR #91185 fix(browser): remove dead requireRef import and void expression in register.navigation.ts. Related #83878. Thanks @whiteyzy and @davinci282828.
• PR #90706 fix(OpenAI Responses): disable item id replay for storeless providers. Related #89728. Thanks @snowzlm.
• PR #90247 fix(disk-space): promote 1024 MiB to 1.0 GiB in disk warnings. Related #90245. Thanks @jbetala7.
• PR #92657 feat(usage): ship built-in /usage full footer. Thanks @Marvinthebored.
• PR #90464 perf(terminal): reuse ANSI scanner during truncation. Thanks @yyzquwu.
• PR #91281 fix(feishu): clear client cache when SDK is replaced via setFeishuClientRuntimeForTest. Related #83911. Thanks @whiteyzy and @davinci282828.
• PR #92639 fix(memory): keep memory_search in transient qmd mode. Related #92464. Thanks @TurboTheTurtle and @Takhoffman and @BrettHamlin.
• PR #91287 fix(cron): de-duplicate main-session systemEvent in heartbeat model input. Related #44922. Thanks @ZengWen-DT and @GSL-R.
• PR #91246 Fix webchat media completion handoff. Related #91003. Thanks @TurboTheTurtle and @kumaxs.
• PR #91353 fix(ui): preserve /reset soft args in Control UI dispatch. Related #91316. Thanks @zhouhe-xydt and @MaBeitian.
• PR #92679 feat(telegram): send rich message text. Thanks @obviyus.
• PR #92705 fix(ui): restore sidebar session picker interactivity above desktop workbench. Related #92707. Thanks @NianJiuZst and @vincentkoc.
• PR #91218 fix(google): strip provider prefix from Vertex model path. Thanks @bymle.
• PR #92669 feat: support /btw in CLI-backed sessions. Thanks @joshavant.
• PR #91357 fix(gateway): mark active main sessions before restart shutdown aborts. Related #91355. Thanks @ooiuuii.
• PR #91066 fix(parallel): send openclaw-parallel User-Agent on free Search MCP requests. Thanks @NormallyGaussian.
• PR #90658 fix(ui): preserve dashboard session parent lineage when session list is stale. Related #90623. Thanks @luoyanglang and @lily-oc.
• PR #92552 fix(ios): force stale foreground gateway reconnects. Thanks @Solvely-Colin.
• PR #89421 fix(telegram): expose thread create CLI remap. Related #81581. Thanks @spacegeologist and @myrzka.
• PR #92779 fix: start workspace files collapsed. Related #90359. Thanks @shakkernerd and @Chang2020618.
• PR #91247 fix(state): avoid sqlite wal on nfs state volumes. Related #90491. Thanks @849261680 and @AFabyTWE.
• PR #92773 fix(tui): show resolved canonical model ref in /model confirmation. Thanks @NarahariRaghava.
• PR #92752 fix(diagnostics): keep recovery scheduling out of the stuck-session warning backoff. Related #92742. Thanks @gnanam1990 and @Takhoffman and @zhuyankarl.
• PR #92735 fix(markdown-core): treat Infinity chunk limit as unbounded, not 1. Related #92734. Thanks @yhterrance.
• PR #92695 docs(config): correct maxConcurrent default in agent-defaults type comments (AI-assisted). Thanks @ArielSmoliar.
• PR #92766 clarify before_install hook scope. Related #91593. Thanks @sallyom and @Trump-last.
• PR #92677 docs(nodes): add openclaw.json config example to Nodes overview. Related #92662. Thanks @liuhao1024 and @Casper-Mars.
• PR #92513 Honor WhatsApp configured ACP bindings. Related #92449. Thanks @TurboTheTurtle and @mcaxtr and @dmorn.
• PR #92650 fix #92465: split OpenAI 431 embedding batches. Thanks @mushuiyu886 and @BrettHamlin.
• PR #92796 feat(providers): add GLM-5.2 support.
• PR #92788 fix(sessions): derive channel from account-scoped DM session keys in send-policy. Thanks @yetval.
• PR #92590 Docker image ships an extraneous stale openclaw in /app/node_modules (extensions pin the published release). Related #92551. Thanks @lzyyzznl and @fxstein.
• PR #92393 chore(deps): bump the swift-deps group across 1 directory with 3 updates.
• PR #92476 fix(agents): preserve compatible CLI session runtime pins. Thanks @yu-xin-c.
• PR #92483 fix(matrix): validate CLI numeric option ranges. Related #92482. Thanks @rohitjavvadi.
• PR #92490 fix(canvas): validate CLI numeric options. Related #92487. Thanks @rohitjavvadi.
• PR #92802 fix(ui): reflow composer beside workspace rail. Thanks @Solvely-Colin and @shakkernerd.
• PR #91059 fix(configure): mask gateway token input in CLI wizard prompt. Thanks @anurag-bg-neu.
• PR #91143 fix(ports): only classify SSH -L/-R tunnels on the queried port as ssh. Related #91142. Thanks @jbetala7.
• PR #91110 fix(tavily): keep web_search contract executable. Related #91096. Thanks @extrasmall0 and @xucongyuan98-sys.
• PR #91181 fix(daemon): strip schtasks backslash prefix when matching gateway task name. Related #90494. Thanks @425072024 and @Darnellicious.
• PR #91187 fix(cron): isolate auth profile failure policy so cron runs don't pollute shared cooldowns. Related #90991. Thanks @openperf and @cx306806112.
• PR #92807 fix(heartbeat): route outbound mirror to isolated session key. Thanks @agent-merkava.
• PR #92745 fix(memory): explain skipped short-term recall hits. Related #92706. Thanks @mushuiyu886 and @armarinho.
• PR #92488 fix(gateway): forward image-only input on /v1/responses (parity with chat completions). Thanks @s554097550 and @cursoragent.
• PR #92604 fix(status): avoid cumulative usage for context percent. Related #83526. Thanks @ashishpatel26 and @darconadalabarga.
• PR #92810 fix: reject unvalidated voice media streams. Thanks @steipete-oai.
• PR #92800 fix(telegram): answer callback queries before sequentialize delays them. Related #42156. Thanks @liuhao1024 and @Diaspar4u.
• PR #92547 fix(nodes): surface pending reapproval diagnostics. Thanks @fuller-stack-dev.
• PR #92690 fix(doctor): avoid false-positive legacy cron store warning when store was already migrated (fixes #92683). Thanks @liuhao1024 and @motteman.
• PR #92806 fix(telegram): skip IPv4 fallback when user explicitly configures non-ipv4first dnsResultOrder (fixes #41671). Thanks @liuhao1024 and @vincentkoc and @leandroirani933-ctrl.
• PR #92778 fix(macos): defer isOverflowing mutation to break SwiftUI render loop (fixes #43480). Thanks @liuhao1024 and @vincentkoc and @gdiab.
• PR #92795 fix(gateway): use resolveNonNegativeNumber for totalTokens to display 0 instead of ? (fixes #43009). Thanks @liuhao1024 and @vincentkoc and @ltxy12138-ai.
• PR #92746 fix(gateway): preserve active runs during plugin finalization. Thanks @scotthuang and @vincentkoc.
• PR #92820 UI: localize Logs tab labels. Thanks @rubensfox20.
• PR #92825 fix(telegram): preserve command callbacks while prefixing generic callback data. Related #54909. Thanks @hnshah and @timt80.
• PR #90889 fix: cap session context overrides by model window. Related #39857. Thanks @xdanger.
• PR #92830 fix(copilot): strip replayed thinking blocks. Related #81520. Thanks @giodl73-repo and @warcold.
• PR #92834 feat(browser): extend --labels overlay to full-page and element captures. Thanks @hxy91819 and @FMLS and @cursoragent.
• PR #92836 fix(discord): raise thread title timeout and tokens to fit reasoning models. Thanks @hanamizuki.
• PR #92095 fix #92039: [Bug]: WhatsApp login reports success before auth is durably persisted, so Docker rebuilds/upgrades can force relink. Thanks @zhangguiping-xydt and @dinorastoder.
• PR #92801 fix(stale): exempt ClawSweeper actionable labels from stale lifecycle (fixes #89564). Thanks @liuhao1024 and @brokemac79.
• PR #89736 fix(status): render sub-1000 token counts as plain integers. Related #89735. Thanks @jbetala7 and @vincentkoc.
• PR #92792 fix(agents): catch malformed image blocks in sanitizeContentBlocksImages. Thanks @LowCode191 and @vincentkoc.
• PR #92555 ci: gate stable releases on Windows companion assets. Thanks @fuller-stack-dev.
• PR #91824 fix(agents): add usage guidance to sessions_spawn tool description (fixes #91814). Thanks @zenglingbiao and @vincentkoc and @cattails-lgao.
• PR #92840 fix(feishu): await HTTP server shutdown during monitor cleanup. Related #48183. Thanks @alex-xuweilong and @ai-nurmamat.
• PR #91632 feat: add tool search directory mode. Thanks @fuller-stack-dev.
• PR #92823 fix(qqbot): surface failed media sends. Thanks @zhangguiping-xydt and @vincentkoc.
• PR #92849 fix(tailscale): preserve parse errors for malformed JSON. Thanks @franciscomaestre.
• PR #92045 Fix diagnostics OTEL runtime install trust. Thanks @efpiva.
• PR #92853 fix(acp): accept MCP date protocolVersion in ACP server. Related #56102. Thanks @bugkill3r and @moliveto.
• PR #92854 fix(hooks): reject slug-generator error payloads. Thanks @Cypherm.
• PR #92855 fix(ui): repair iOS Safari chat viewport handling. Thanks @macdao.
• PR #91586 fix(update): continue after package doctor warnings. Thanks @fuller-stack-dev.
• PR #92862 fix(feishu): target typing reaction on inbound message. Thanks @huiwen01.
• PR #92861 fix(lobster): surface workflow path errors. Related #68101. Thanks @vvitovec and @MPC7500.
• PR #69975 fix(cli): clarify --tz help text for offset-less --at values. Related #59456. Thanks @rrrrrredy.
• PR #90682 fix(openai): preserve opaque reasoning transcript fields. Related #90093. Thanks @toruvieI and @richardmqq.
• PR #92373 fix(anthropic): strip thinking blocks from history when thinking is disabled (fixes #92360). Thanks @liuhao1024 and @notnaji.
• PR #87346 fix(anthropic): merge consecutive assistant turns in turn validation. Related #87329. Thanks @Jefsky and @travellingsoldier85.
• PR #92896 fix(anthropic): quarantine invalid direct tool schemas. Thanks @vincentkoc.
• PR #90739 fix(active-memory): preserve verbose recall summaries. Related #90454. Thanks @brokemac79 and @nocode-ananas.
• PR #92558 Simplify QA scorecard mapping shape. Thanks @RomneyDa.
• PR #92876 fix(memory-wiki): stop flagging raw source pages as malformed. Thanks @vincentkoc.
• PR #92908 fix(providers): quarantine unreadable Anthropic payload tools. Thanks @vincentkoc.
• PR #92881 fix(memory): preserve reindex rollback recovery. Thanks @TSHOGX and @vincentkoc.
• PR #92921 fix(openai): quarantine unreadable tool schemas. Thanks @vincentkoc.
• PR #92550 Fold Telegram RTT sampling into live QA evidence. Thanks @RomneyDa.
• PR #92824 fix(media): route OAuth image defaults through Codex. Related #87168. Thanks @bek91.
• PR #92928 fix(openai): guard post-hook tool payloads. Thanks @vincentkoc.
• PR #92814 fix(feishu): re-resolve route when dynamic agent binding already exists in runtime config (fixes #42837). Thanks @liuhao1024 and @vincentkoc and @cwlong163-afk.
• PR #89055 fix: restart gateway after isolated cron setup timeout. Thanks @ghitafilali.
• PR #90574 fix(openai): omit gpt-5.5 tool reasoning effort. Thanks @BSG2000.
• PR #92941 fix(openai): recover invalid reasoning signatures.
• PR #92914 fix(agents): clamp unsupported thinking for subagent spawns instead of hard-failing. Related #92412. Thanks @openperf and @oiGaDio.
• PR #92573 fix: preserve config-selected subagent model overrides. Related #92486. Thanks @arkyu2077 and @PatrickTrent.
• PR #92852 fix(gateway): fall back to polling when config watcher exhausts inotify retries. Related #92851. Thanks @danbao.
• PR #92362 fix(gateway): build row metadata context for single session lists. Thanks @anyech.
• PR #92897 fix(memory-wiki): tolerate public artifacts without agent ids. Related #92207. Thanks @yu-xin-c and @qq230849622-a11y.
• PR #92002 fix(lmstudio): deliver thinking "off" to binary-thinking models. Related #91913. Thanks @nxmxbbd and @mlaihk.
• PR #92738 Forward suppressed-source progress for message-tool channel replies. Thanks @ragesaq.
• PR #92916 #92201: Embedded runner: freshly streamed thinking signatures intermittently invalid on replay (Anthropic); recovery wrapper never fires because error text is genericized. Thanks @mmyzwl and @CarlCapital.
• PR #90936 fix(agents): do not misclassify client-disconnect abort as run timeout. Related #90764. Thanks @openperf and @reginaldomarcilon.
• PR #93009 fix(agents): make wrapToolWithBeforeToolCallHook idempotent to prevent double hook execution (fixes #92973). Thanks @zenglingbiao and @dertbv.
• PR #92318 fix(cron): require explicit message target proof. Thanks @hxy91819.
• PR #93022 fix(gateway): repair usage cost aggregation across agents. Thanks @luke-skywalker-open-claw and @stablegenius49.
• PR #93159 fix(tui): keep parent stdin paused after exit. Thanks @fuller-stack-dev.
• PR #93616 Keep key-free web search providers opt-in. Thanks @davemorin and @vincentkoc.
• PR #93164 fix(telegram): preserve rich markdown line breaks. Thanks @vincentkoc.

Release verification

• npm package: https://www.npmjs.com/package/openclaw/v/2026.6.8-beta.1
• registry tarball: https://registry.npmjs.org/openclaw/-/openclaw-2026.6.8-beta.1.tgz
• integrity: sha512-m1SHMi+aFaQnlAczgBvUgKA9mgL1Td3WnySoaf8X9Uy5SOLbBzdJ1miBV7NnINTVE+ec6Rb+jfXCGlEspthX/g==
• release SHA: 43d00c7724b5b4856ad4055b2dcd21ce6ef61550
• npm preflight: https://github.com/openclaw/openclaw/actions/runs/27505699831
• full release validation: https://github.com/openclaw/openclaw/actions/runs/27504321919
• release publish orchestration: https://github.com/openclaw/openclaw/actions/runs/27513932430 (failed after plugin publish verification; direct OpenClaw npm recovery used)
• plugin npm publish: https://github.com/openclaw/openclaw/actions/runs/27514038012 (published; one post-publish metadata verifier failed for @openclaw/llama-cpp-provider readme metadata)
• OpenClaw npm publish: https://github.com/openclaw/openclaw/actions/runs/27514298229
• postpublish verifier: node --import tsx scripts/openclaw-npm-postpublish-verify.ts 2026.6.8-beta.1 passed
• clean npm smoke: npm exec --package openclaw@2026.6.8-beta.1 -- openclaw --version returned OpenClaw 2026.6.8-beta.1 (43d00c7)
• ClawHub plugin publish: https://github.com/openclaw/openclaw/actions/runs/27514039764 failed plugin-inspector on packaged transport plugin setupEntry metadata; follow-up required
• dependency evidence asset: openclaw-2026.6.8-beta.1-dependency-evidence.zip
• npm Telegram beta E2E: https://github.com/openclaw/openclaw/actions/runs/27514468230 (running)

2026.6.7

Highlights

• Durable channel replies: Telegram polling and preview failures recover instead of ending a stream, Slack keeps delivered replies in the transcript, and top-level image sends retain their intended media source. (#92281, #92498, #92416) Thanks @joshavant, @TurboTheTurtle, @xydigit-sj, @ichirokyoto, @TalkingHeadsJed, and @riseandshinefutures.
• More dependable provider sessions: SecretRef-backed profiles, configured DeepSeek transports, static model fallback, Anthropic thinking replay, and Codex prompt memory all recover cleanly instead of leaving a turn unusable. (#92265, #92235, #92293, #92286, #92350) Thanks @joshavant, @rubencu, @sallyom, @marcoraepple-sys, @LINSUISHENG034, @mattsfraser, and @reginaldomarcilon.
• Kimi K2.7 Code support: the provider catalog now includes the new Kimi coding model, with replay handling that preserves its reasoning content across tool turns. (#92554, #92396) Thanks @xialonglee and @RoseKongPS.
• Safer operations: SQLite-backed cron status, disabled heartbeat retries, Linux service updates, and external-plugin diagnosis now expose clearer, actionable state to operators. (#92144, #92225, #92282, #86629) Thanks @liuhao1024, @joshavant, @brokemac79, @AaronFaby, @cdeyoung67, @ooiuuii, @shakkernerd, @A1fred-AI, and @hanyizuo.
• Guarded skill installs: Skill Workshop support-file targets now go through trusted lifecycle writes instead of unbounded filesystem updates, while ClawHub package checks stay on the current release path. (#91311) Thanks @abnershang.

Changes

• Skills and plugin workflows now permit trusted Skill Workshop support-file targets only through guarded lifecycle writes, and package publishing uses the current ClawHub plugin checks. (#91311) Thanks @abnershang and @vincentkoc.
• Providers: add Kimi K2.7 Code support. (#92554)

Fixes

• Channels and delivery: recover Telegram preview and polling failures, retain Slack final replies in transcripts, preserve top-level outbound image parameters, and make channel-action result pages available to callers. (#92281, #92498, #92407, #88993) Thanks @joshavant, @TurboTheTurtle, @xydigit-sj, @fuller-stack-dev, @TalkingHeadsJed, and @riseandshinefutures.
• Agent/provider reliability: preserve configured model transport/auth resolution, fail closed for unsupported CLI-backed /btw fallback, continue after source message-tool replies, repair Anthropic thinking replay, and keep Codex memory prompts registered. (#92265, #92226, #92343, #92286, #92350) Thanks @joshavant, @rubencu, @sallyom, @marcoraepple-sys, @wangwllu, @elyalvarado, and @reginaldomarcilon.
• Operations: make cron and daemon status resilient, preserve disabled heartbeat one-shot retries, hand off Linux service auto-updates, and keep lifecycle timeout cleanup alive after leader exit. (#92144, #92225, #92282, #92566) Thanks @liuhao1024, @joshavant, @RomneyDa, @AaronFaby, @A1fred-AI, and @hanyizuo.

Complete contribution record

This audited record covers the complete v2026.6.6..v2026.6.7-beta.1 history: 59 merged PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact.

Pull requests

• PR #92144 fix(cron): report SQLite storage path in cron.status instead of legacy jobs.json. Related #91766. Thanks @liuhao1024 and @AaronFaby.
• PR #92175 fix(channel): harden local setup trust. Thanks @hxy91819.
• PR #91528 fix #73837: stop after failed Node package installs. Thanks @mushuiyu886 and @ItsMeForLua.
• PR #91561 fix(wizard): report keyless web_search providers as ready, not missing a key. Thanks @NormallyGaussian.
• PR #92073 fix: handle explicit silent assistant replies. Related #92038. Thanks @sallyom and @vultusv.
• PR #91311 Allow Skill Workshop apply through trusted skill symlinks. Thanks @abnershang.
• PR #88245 refactor(whatsapp): introduce inbound message contexts. Thanks @mcaxtr.
• PR #92212 refactor: move workspace skill writes to lifecycle. Thanks @shakkernerd.
• PR #92248 Remove ClawHub owner preflight. Thanks @Patrick-Erichsen.
• PR #91617 test(sqlite): add state perf query plan harness. Related #91616. Thanks @galiniliev.
• PR #91626 fix(daemon): keep status readable on unsupported services. Related #25621. Thanks @mushuiyu886 and @kucharskim.
• PR #92295 fix(cron): preserve tz and staggerMs when --cron replaces expression. Related #92291. Thanks @liuhao1024 and @dcapclaw.
• PR #92087 fix(docker): bundle QA Lab runtime in the image. Thanks @jesse-merhi.
• PR #92004 fix(telegram): classify streaming preview edit failures instead of killing the draft. Thanks @obviyus.
• PR #91997 fix(telegram): survive getUpdates conflicts in isolated polling ingress. Thanks @obviyus.
• PR #92387 fix(anthropic-vertex): stop re-marking cache_control on transport-budgeted payloads. Related #91982. Thanks @openperf and @Takhoffman and @danieljimz.
• PR #92229 Fix doctor preview channel SecretRef resolution. Related #91939. Thanks @joshavant and @Niriakot.
• PR #92225 Fix disabled heartbeat one-shot cron retries. Related #91775. Thanks @joshavant and @A1fred-AI.
• PR #92265 Fix configured DeepSeek model transport inheritance. Related #92148. Thanks @joshavant and @marcoraepple-sys.
• PR #92226 Fail closed for CLI-backed /btw fallback. Related #92168. Thanks @joshavant and @wangwllu.
• PR #92231 Fix suppressed heartbeat commitment delivery. Related #91948. Thanks @joshavant and @bizzle12368239.
• PR #92280 fix(agents): classify structured unsupported model errors. Related #92118. Thanks @joshavant and @pikaqqqqqq.
• PR #92276 Fix OTLP log trace correlation. Related #91865. Thanks @joshavant and @sinzin91.
• PR #92282 fix(update): hand off Linux service auto-updates. Related #91823. Thanks @joshavant and @hanyizuo.
• PR #92235 fix: resolve managed SecretRef provider auth. Related #92097. Thanks @joshavant and @LINSUISHENG034.
• PR #92293 Fix provider static model fallback resolution. Related #92009. Thanks @joshavant and @mattsfraser.
• PR #92343 fix(agent): continue after source message tool replies. Related #92169. Thanks @joshavant and @elyalvarado.
• PR #92350 fix(codex): preserve memory prompt registration. Thanks @rubencu and @sallyom.
• PR #92290 fix: clarify gateway SecretRef auth diagnostics. Related #91815. Thanks @joshavant and @mattsfraser.
• PR #92286 fix: repair rejected Anthropic thinking replay. Related #91983. Thanks @joshavant and @reginaldomarcilon.
• PR #92281 Fix Telegram spooled buffered replay. Related #92129. Thanks @joshavant and @riseandshinefutures.
• PR #47493 fix(doctor): show per-step progress spinners during update. Thanks @amersheeny.
• PR #92416 fix(outbound): honor top-level image param as send media source (#92407). Thanks @xydigit-sj and @ichirokyoto.
• PR #92508 fix(sandbox): render CLI skill prompts from materialized paths. Thanks @brokemac79.
• PR #92540 chore: fix esbuild production audit failure. Thanks @RomneyDa.
• PR #91484 Add QA evidence artifact output. Thanks @RomneyDa.
• PR #91500 Add QA scorecard taxonomy validation. Thanks @RomneyDa.
• PR #84082 fix(telegram): allow expandable blockquotes. Thanks @jzakirov.
• PR #92554 feat(moonshot): add Kimi K2.7 Code support.
• PR #92396 fix(moonshot): backfill reasoning_content on assistant tool-call replay messages. Related #71491. Thanks @xialonglee and @RoseKongPS.
• PR #92566 Fix lifecycle timeout cleanup after leader exit. Thanks @RomneyDa.
• PR #92311 ci: split plugin ClawHub publishing paths. Thanks @Patrick-Erichsen.
• PR #92216 fix(gateway): mirror hidden commentary-phase assistant events. Thanks @ragesaq.
• PR #87596 fix(moonshot): rewrite duplicate native Kimi tool_call ids on replay. Related #51593. Thanks @Pluviobyte and @Faaab84.
• PR #88993 Expose paged channel action results. Thanks @fuller-stack-dev.
• PR #90326 fix(fireworks): resolve catalog model params from plugin.json via core. Thanks @obuchowski.
• PR #86629 fix(doctor): warn for untrusted external Discord plugin. Related #83212. Thanks @brokemac79 and @ooiuuii and @cdeyoung67.
• PR #90242 fix(providers): skip unreadable Mistral tool schemas. Thanks @vincentkoc.
• PR #92498 fix(reply): mirror same-channel Slack final replies. Related #92489. Thanks @TurboTheTurtle and @TalkingHeadsJed.
• PR #92083 fix(channels): default boundary logger for swallowed progress-draft start errors. Thanks @hansraj316.
• PR #92564 fix(agents): isolate invalid plugin model catalogs [AI-assisted]. Related #92553. Thanks @tangtaizong666 and @fxstein.
• PR #89827 docs: UX-013 — design system documentation. Thanks @BunsDev.
• PR #89615 feat(ui): hide empty workboard columns. Thanks @BunsDev.
• PR #89822 fix(a11y): B-1+B-2+B-3 — contrast, focus states, minimum font sizes. Thanks @BunsDev.
• PR #92618 fix #92218: memory_search tool disabled with QMD backend. Thanks @mushuiyu886 and @zhbcher.
• PR #92608 docs(gateway): add uptime monitoring guidance to health check docs (fixes #55768). Thanks @liuhao1024 and @faahim.
• PR #92605 fix(docs): pin Windows Hub download links to v2026.6.5. Related #92470. Thanks @lzyyzznl and @arjkul.
• PR #92593 #92589: fix(internal-runtime-context): wrap prompt-preface runtime context body in delimiters. Thanks @zhangqueping and @jovi2014-cyber.
• PR #92606 Run Vitest and Playwright scenarios from qa suite. Thanks @RomneyDa.

2026.6.6

Highlights

• Tighter security boundaries: transcript, sandbox, MCP, browser, channel, and exec-approval paths now fail closed around unsafe access, timed-out approvals, and malformed boundary input. (#91529, #91618, #91741, #91750, #89938) Thanks @joshavant, @pgondhi987, @mmaps, @eleqtrizit, @drobison00, @vincentkoc, and @devinkuhn.
• Reliable Telegram delivery: account-scoped topics route to the correct agent, streamed text survives tool calls, callbacks and draft chunks stay coherent, and unauthorized DM text does not enter cache or prompt context. (#91189, #88682, #90212, #91478, #91915) Thanks @codysai001, @alexzhu0, @snowzlm, @obviyus, @sallyom, @AbdelftahZowail, @producedbysavant, @shakkernerd, @vincentkoc, and @BSG2000.
• iMessage stays connected: always-on inbound recovery, durable echo markers, block streaming, idle approval discovery, and outbound transport now survive restarts and idle periods. (#91335, #91449, #88969, #91783) Thanks @omarshahine, @jmissig, @dwonshin, @colmbrogan, @vincentkoc, and @TurboTheTurtle.
• Better browser and MCP connectivity: existing browser sessions, CDP/WebSocket discovery, default-profile URLs, OAuth/SSE transport, and tool schemas now connect through clearer, safer paths. (#91422, #89851, #91736, #91451) Thanks @pgondhi987, @anagnorisis2peripeteia, @eleqtrizit, @LiuwqGit, @lifuyue, @marcusbsorensen, @cursoragent, @vincentkoc, @849261680, and @mgrandau.
• Faster first replies: Control UI startup no longer waits on broad model loading, while cached metadata, lazy slash-command work, and first-event tracing make slow initial responses visible. (#91531, #91538, #91568, #91583) Thanks @vincentkoc and @BSG2000.
• Broader provider support: OpenRouter OAuth and Claude Fable 5 land alongside correct Codex compaction ownership, local-model execution, normalized tool progress, and Gemma 4 reasoning replay. (#91830, #91882, #91590, #88630, #91696) Thanks @Patrick-Erichsen, @joshavant, @bdjben, @Coder-Wangyankun, @vincentkoc, @bfox55, @shakkernerd, and @NOVA-Openclaw.

Changes

• CLI progress: emit Claude CLI commentary progress events and bridge inter-tool commentary into channel progress without exposing internal protocol scaffolding. (#89834, #90883) Thanks @anagnorisis2peripeteia, @AbdelftahZowail, @kentuscn, and @vincentkoc.
• Observability: allow trusted diagnostics channels to capture tool input/output content, add first-assistant-event traces, and warn on slow initial replies. (#91256, #91568, #91583) Thanks @amknight, @mjunaidca, and @vincentkoc.
• Plugins/ClawHub: dogfood reusable package publishing, let dry runs skip publish approval, allow declared installed trusted hooks, report managed plugin version drift, and warn instead of failing on retired Skill Workshop configuration. (#91574, #91591, #90004, #90927, #90838) Thanks @Patrick-Erichsen, @brokemac79, @lonexreb, @rogerallen1, @vincentkoc, and @ryanhelms.
• Memory/providers: move the local llama.cpp runtime into its provider plugin, batch embeddings across files, persist the agent model catalog cache, and keep QMD JSON search one-shot while filtering stale REM recall previews. (#91324, #89138, #90457, #91837, #91851) Thanks @osolmaz, @mushuiyu886, @ai-hpc, @TurboTheTurtle, @jalehman, @hartmark, @vincentkoc, @rudi193-cmd, @Peilsender, and @xpysgdhr.
• Channels/mobile: add the QQBot group mention toggle, improve iPad and iPhone control surfaces, and expose the active connection host in the TUI footer. (#91423, #91557, #89909) Thanks @cxyhhhhh, @Solvely-Colin, @baskduf, @joshavant, @sliverp, and @deuxksy.
• Performance: prewarm TUI runtime plugins, deduplicate plugin auto-enable fanout, trim dense text-delta snapshots, and reuse prepared startup model metadata. (#90782, #89978, #91580, #91531) Thanks @RomneyDa, @ai-hpc, @vincentkoc, and @JakeBiggs.

Fixes

• Agent/session recovery: drop stale approval follow-ups after session rebind, remove drained reply-queue items by identity, recover stale main and visible replies, preserve Codex context-engine compaction ownership, lower the default compaction timeout to 180 seconds while respecting explicit configuration, and keep provider-failure terminal lifecycle state correct. (#85679, #91450, #91566, #91840, #91590, #91361, #91895) Thanks @openperf, @yetval, @joshavant, @wangmiao0668000666, @TurboTheTurtle, @two3pro, @velvet-shark, @sallyom, @849261680, @vincentkoc, @Tony-ooo, @Jerry-Xin, @olveww-dot, and @nikhilmaddirala.
• User-visible content boundaries: suppress Codex/Harmony protocol artifacts, neutralize browser and LanceDB memory media directives, redact transcript images, and preserve native /compact replies through source suppression. (#89151, #91422, #91425, #91529, #90212) Thanks @joelnishanth, @pgondhi987, @joshavant, @snowzlm, @reslp, @vincentkoc, and @devinkuhn.
• Channel delivery: keep WhatsApp captured replies attached to the successor controller after restart, retry Feishu rate limits, preserve Mattermost thread replies, canonicalize LINE webhook paths, restore Discord reply hydration and runtime timeout exports, and show OpenAI Realtime WebRTC assistant transcripts. (#85823, #89659, #91684, #91649, #90263, #91686, #90426) Thanks @itsuzef, @ladygege, @jacobtomlinson, @fuller-stack-dev, @shushushv, @mcaxtr, @AxelHu, @vincentkoc, @marshallm-create, @sliverp, and @dahifi.
• Cron: cancel active task runs cleanly, preserve terminal timeout/cancel state, and recover no-deliver tool warnings instead of silently losing the outcome. (#90666, #90678) Thanks @ai-hpc.
• Gateway/config/auth: share the approval runtime socket token, replace arrays explicitly in config.patch, skip the deleted-agent guard only for valid ACP harness sessions, surface headless LaunchAgent state, verify SQLite auth migration before cleanup, and arm QMD startup maintenance. (#87105, #91551, #91219, #91614, #91740, #91978) Thanks @fuller-stack-dev, @scotthuang, @joshavant, @velvet-shark, @vincentkoc, and @dahifi.
• Providers/Codex: clarify quota errors, restore the Codex synthetic usage line, canonicalize Codex protocol assets, require API-key auth for realtime voice, normalize ACP model refs, preserve Gemma 4 reasoning_content, and avoid guardian review for local models. (#91390, #91709, #91507, #91567, #88630, #91696) Thanks @hxy91819, @brokemac79, @RomneyDa, @joshavant, @Coder-Wangyankun, @vincentkoc, @bfox55, @shakkernerd, and @sergiopesch.
• Updates/builds: recover package Gateway restarts after refresh failure, expose plugin convergence repair, fall back to Corepack in PATH-less pnpm environments, seed the correct Docker store packages, and keep ClawHub dry-run and publish paths reusable. (#91581, #91599, #91547, #91591) Thanks @fuller-stack-dev, @sallyom, @Patrick-Erichsen, @vincentkoc, and @laurenceputra.
• UI: require explicit user intent before opening chat sessions and drain restored chat queues after session switches. (#91480) Thanks @TurboTheTurtle, @Takhoffman, and @zdwalter.
• Android: avoid the dataSync foreground-service type for persistent nodes. (#80082) Thanks @davelutztx.
• Native hooks: bound relay lifetimes so abandoned native hook connections cannot linger indefinitely. (#91550) Thanks @joshavant and @clem-git.

Complete contribution record

This audited record covers the complete v2026.6.5..v2026.6.6 history: 198 merged PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact.

Pull requests

• PR #91335 fix(imessage): always-on inbound recovery and dedupe. Related #89237. Thanks @omarshahine and @vincentkoc and @dwonshin.
• PR #91189 fix(telegram): route account-scoped topic agents. Thanks @codysai001.
• PR #88682 Preserve Telegram streamed text blocks between tool calls. Related #87326. Thanks @alexzhu0 and @AbdelftahZowail.
• PR #91390 fix: clarify provider quota errors. Thanks @hxy91819.
• PR #90883 fix(cli): bridge inter-tool commentary events to channel progress. Thanks @anagnorisis2peripeteia.
• PR #91419 docs: preserve channel brand terms in Chinese i18n. Thanks @hxy91819.
• PR #87105 fix(gateway): share approval runtime socket token. Thanks @fuller-stack-dev.
• PR #80082 fix(android): avoid dataSync FGS for persistent node. Thanks @davelutztx.
• PR #91442 docs: preserve LINE across localized docs glossaries. Thanks @hxy91819.
• PR #88768 fix(codex): normalize dynamic tool progress results. Thanks @bdjben.
• PR #91422 fix(browser): neutralize media directives in browser output [AI]. Thanks @pgondhi987.
• PR #89834 feat(cli): emit commentary progress events from Claude CLI parser. Related #87326. Thanks @anagnorisis2peripeteia and @AbdelftahZowail.
• PR #85679 fix(agents): drop stale exec approval followups after session rebind. Related #59349. Thanks @openperf and @two3pro.
• PR #91450 fix(reply-queue): remove the drained item by reference instead of front index. Thanks @yetval.
• PR #89151 fix(delivery): suppress Codex/Harmony internal protocol artifacts from user-facing channels. Related #88128. Thanks @joelnishanth and @reslp.
• PR #90678 fix(cron): recover no-deliver tool warnings. Thanks @ai-hpc.
• PR #91449 fix(imessage): honor block streaming config. Thanks @jmissig and @omarshahine.
• PR #91508 Revert "docs: add maturity scorecard mirror". Thanks @kevinslin.
• PR #91364 build(deps): bump github.com/steipete/peekaboo from 3.3.0 to 3.4.0 in /apps/macos in the swift-deps group.
• PR #91368 build(deps): bump actions/github-script from 8 to 9.
• PR #91512 chore: add taxonomy file. Thanks @kevinslin.
• PR #91369 build(deps): bump actions/cache from 4 to 5.
• PR #91367 build(deps): bump the actions group with 2 updates.
• PR #91365 build(deps): bump the android-deps group in /apps/android with 3 updates.
• PR #91496 chore: bump Codex app-server to 0.137.0. Thanks @RomneyDa.
• PR #90666 fix(cron): cancel active cron task runs. Thanks @ai-hpc.
• PR #90927 fix(doctor): report managed plugin version drift. Related #90891. Thanks @brokemac79.
• PR #91531 perf(control-ui): reuse startup model metadata. Thanks @vincentkoc.
• PR #91538 perf(control-ui): avoid startup catalog wait. Thanks @vincentkoc.
• PR #91507 feat: canonicalize Codex protocol JSON asset ordering. Thanks @RomneyDa.
• PR #91550 fix: bound native hook relay lifetime. Related #90993. Thanks @joshavant and @clem-git.
• PR #89588 fix(telegram): restore /compact on generic message ingress. Related #89525. Thanks @joelnishanth and @cursoragent and @bomberluke37-prog.
• PR #91529 Fix transcript image redaction. Related #90760. Thanks @joshavant and @devinkuhn.
• PR #91551 Fix config.patch explicit array replacement. Thanks @joshavant.
• PR #91568 perf(control-ui): trace first assistant event. Thanks @vincentkoc.
• PR #85823 fix(whatsapp): route captured replies through successor controller after restart. Thanks @itsuzef and @mcaxtr.
• PR #91574 feat: dogfood reusable ClawHub package publish. Thanks @Patrick-Erichsen.
• PR #91583 perf(control-ui): warn on slow first replies. Thanks @vincentkoc.
• PR #89659 fix(feishu): retry on send rate-limit errors (230020/230006). Related #70879. Thanks @ladygege and @marshallm-create and @sliverp and @AxelHu.
• PR #91547 Fix Docker store seed target packages. Related #91035. Thanks @sallyom and @laurenceputra.
• PR #91578 fix: make docs i18n frontmatter translation resilient. Thanks @hxy91819.
• PR #91567 fix(openai): require api-key auth for realtime voice. Related #90456. Thanks @joshavant and @sergiopesch.
• PR #91591 fix: let ClawHub dry runs skip publish approval. Thanks @Patrick-Erichsen.
• PR #91598 perf(control-ui): lazy load slash commands. Thanks @vincentkoc.
• PR #91580 fix(agents): trim dense text delta snapshots. Related #86599. Thanks @vincentkoc and @JakeBiggs.
• PR #91425 fix(memory-lancedb): guard memory recall output [AI]. Thanks @pgondhi987.
• PR #88969 fix(imessage): persist echo markers before send. Thanks @colmbrogan.
• PR #91566 Fix stale main session startup recovery. Related #90525. Thanks @joshavant and @Tony-ooo.
• PR #91324 fix(memory): move local llama.cpp runtime to provider plugin. Related #88705. Thanks @osolmaz and @Peilsender.
• PR #91637 docs: include plugin prerelease in release validation approval.
• PR #91649 fix(line): canonicalize trailing-slash webhook paths.
• PR #91423 feat(qqbot): add /bot-group-allways command to toggle mention requirement. Thanks @cxyhhhhh and @sliverp.
• PR #91642 fix(docs): continue partial i18n batches after file errors. Thanks @hxy91819.
• PR #91661 chore(plugin-sdk): refresh API baseline hash.
• PR #91665 docs: fix release CI Android dispatch guidance.
• PR #89138 fix #88009: [Feature]: batched memory embedding should batch over files. Thanks @mushuiyu886 and @jalehman and @hartmark.
• PR #91679 fix(plugin-sdk): align Discord component edit facade types. Thanks @vincentkoc.
• PR #91686 fix(discord): restore runtime timeout compatibility exports. Thanks @vincentkoc.
• PR #90212 fix(agents): deliver native /compact replies through source suppression. Thanks @snowzlm.
• PR #91618 fix: expand unsafe host env denylist. Thanks @pgondhi987.
• PR #91615 fix: block rustup toolchain env overrides [AI]. Thanks @pgondhi987.
• PR #89851 fix(gateway): support Streamable HTTP MCP transport on loopback server. Thanks @anagnorisis2peripeteia.
• PR #91619 fix: block git protocol env controls [AI]. Thanks @pgondhi987.
• PR #91684 fix(mattermost): keep default replies in existing threads. Thanks @jacobtomlinson.
• PR #90457 fix(models): persist agent catalog cache. Thanks @ai-hpc.
• PR #91709 fix(status): restore Codex synthetic usage line. Related #91694. Thanks @brokemac79.
• PR #89909 fix(tui): show connection host in footer. Related #56276. Thanks @baskduf and @deuxksy.
• PR #89978 perf(config): dedupe plugin auto-enable fanout work. Thanks @ai-hpc.
• PR #91219 fix(gateway): skip deleted-agent guard for ACP harness session keys. Thanks @scotthuang.
• PR #90782 perf(tui): prewarm runtime plugins before first send. Thanks @RomneyDa.
• PR #90838 fix(config): warn for retired skill-workshop plugin entry instead of failing validation (#90244). Thanks @lonexreb and @rogerallen1.
• PR #91753 docs: clarify Matrix plugin upgrade repair. Thanks @RomneyDa.
• PR #91755 docs: align Feishu DM policy defaults. Thanks @RomneyDa.
• PR #91745 fix(discord): require sender for moderation actions [AI]. Thanks @eleqtrizit.
• PR #85950 docs: clarify trusted-proxy Control UI scope behavior. Related #80063. Thanks @nielskaspers and @longstoryscott.
• PR #91746 fix(msteams): require admin for group actions. Thanks @eleqtrizit.
• PR #91256 feat(diagnostics-otel): capture tool input/output content via trusted channel. Thanks @amknight.
• PR #91749 fix(gateway): restrict non-owner loopback tools. Thanks @eleqtrizit.
• PR #91748 fix(elevated): reject group ids as senders. Thanks @eleqtrizit.
• PR #91752 fix(codex): guard sandbox http requests. Thanks @eleqtrizit.
• PR #91763 fix: require ACP metadata for deleted-agent bypass. Thanks @shakkernerd.
• PR #91751 fix(mcp): harden stdio env filtering. Thanks @eleqtrizit.
• PR #91765 Clarify env-var executable behavior reports in SECURITY.md. Thanks @jacobtomlinson.
• PR #91480 fix(ui): require user intent for chat sessions. Related #89760. Thanks @TurboTheTurtle and @Takhoffman and @zdwalter.
• PR #91777 docs: remove superpowers spec draft. Thanks @Patrick-Erichsen.
• PR #91773 fix(mcp): lowercase SSE event-source header keys to prevent duplicate Authorization (401). Thanks @Takhoffman.
• PR #91741 Validate sandbox bind parent paths [AI]. Thanks @mmaps.
• PR #88530 fix(imessage): skip idle approval discovery scans. Thanks @colmbrogan and @omarshahine.
• PR #91780 fix(ui): drain restored chat queue after session switch. Thanks @tmimmanuel.
• PR #91750 fix(search): enforce native web search tool policy. Thanks @eleqtrizit.
• PR #91757 fix(config): clarify retired skill workshop plugin warning. Thanks @RomneyDa.
• PR #91787 fix(doctor): keep TTS legacy migration on supported paths.
• PR #91783 fix(imessage): harden outbound send transport. Related #84329. Thanks @omarshahine and @TurboTheTurtle.
• PR #91785 fix(imessage): surface inbound startup diagnostics. Thanks @omarshahine.
• PR #91590 Fix context-engine compaction ownership for Codex sessions. Thanks @joshavant.
• PR #91557 Improve iPad and iPhone control surfaces. Thanks @Solvely-Colin and @joshavant.
• PR #91666 chore(deps): bump useblacksmith/setup-docker-builder from 1.8.0 to 1.9.0 in the actions group.
• PR #91819 docs: link ClawHub plugin validation fixes guide. Thanks @Patrick-Erichsen.
• PR #88630 fix(codex): avoid guardian review for local models. Thanks @vincentkoc.
• PR #91830 feat: add OpenRouter OAuth to onboarding. Thanks @Patrick-Erichsen.
• PR #91842 fix(plugin-sdk): refresh API baseline hash.
• PR #91614 fix(gateway): surface headless LaunchAgent state. Thanks @fuller-stack-dev.
• PR #91851 fix(memory-core): filter stale recall entries in REM harness preview. Thanks @vincentkoc.
• PR #91859 fix(ci): disable memory slot in release smoke config. Thanks @vincentkoc.
• PR #90004 [plugin sdk] Allow declared installed trusted hooks. Related #87735. Thanks @brokemac79 and @ryanhelms.
• PR #91837 fix(memory-core): keep QMD JSON search one-shot. Related #91821. Thanks @TurboTheTurtle and @xpysgdhr.
• PR #91871 Remove bundled channel contract fallbacks. Thanks @obviyus.
• PR #91879 fix(ci): include ACPX in shared live-test image.
• PR #91840 Fix stale visible reply recovery. Related #90535. Thanks @joshavant and @Jerry-Xin.
• PR #91876 Fix Telegram callback API handling. Thanks @obviyus.
• PR #91874 Share channel draft chunking resolver. Thanks @obviyus.
• PR #91599 fix(update): expose plugin convergence repair. Thanks @fuller-stack-dev.
• PR #91581 fix(update): recover package gateway restart after refresh failure. Thanks @fuller-stack-dev.
• PR #91904 fix(telegram): use SDK dispatch dedupe. Thanks @obviyus.
• PR #90263 fix(discord): hydrate reply context metadata. Thanks @fuller-stack-dev.
• PR #91478 block unauthorized Telegram DM text from prompt context. Related #91209. Thanks @sallyom and @producedbysavant.
• PR #91915 fix(telegram): audit follow-ups — block-mode chunk config, dedupe bucket cleanup, grammy contract trust. Thanks @obviyus.
• PR #91361 fix(compaction): lower default timeout from 900s to 180s, preserve explicit config. Related #91358. Thanks @wangmiao0668000666 and @velvet-shark and @olveww-dot.
• PR #91791 fix(sandbox): use materialized skill paths in startup prompts. Related #91761. Thanks @brokemac79 and @vincentkoc and @gbb-netizen.
• PR #91736 Support existing-session browser CDP endpoints. Related #56118. Thanks @lifuyue and @mgrandau.
• PR #91747 fix(browser): validate discovered CDP websocket URLs. Thanks @eleqtrizit.
• PR #91882 feat(anthropic): support Claude Fable 5 adaptive thinking. Related #91805. Thanks @NOVA-Openclaw.
• PR #91884 fix(memory): keep ignored-name QMD roots watchable. Thanks @vincentkoc.
• PR #91740 fix(auth): verify SQLite auth migration before cleanup. Thanks @fuller-stack-dev and @velvet-shark.
• PR #91451 fix(mcp): repair OAuth redirect, errors, and unicode schema patterns. Related #91433. Thanks @LiuwqGit and @cursoragent and @vincentkoc and @marcusbsorensen.
• PR #91978 fix(gateway): arm qmd startup maintenance. Thanks @vincentkoc.
• PR #90426 fix(talk): show OpenAI Realtime WebRTC assistant transcripts. Thanks @shushushv and @vincentkoc.
• PR #91696 fix(agents): preserve reasoning_content replay for Gemma 4 openai-completions models. Related #91645. Thanks @Coder-Wangyankun and @bfox55.
• PR #89938 Fail closed on exec approval timeout. Thanks @drobison00.
• PR #91895 fix(webchat): finalize provider failure lifecycle. Related #91730. Thanks @TurboTheTurtle and @sallyom and @nikhilmaddirala.
• PR #80143 fix(browser): honor cdpUrl for user default profile. Related #48042. Thanks @HemantSudarshan and @Max-Resilient.
• PR #91688 fix(cron): reject cron expressions that have no reachable run time. Thanks @yetval and @vincentkoc.
• PR #91737 fix(cron): use final-call usage for session token totals. Related #91716. Thanks @MonkeyLeeT and @vincentkoc and @yetval.
• PR #89605 fix(process): return timeout code for killed commands. Thanks @ai-hpc.
• PR #80013 perf(usage-cost-cache): throttle full-cache rewrites during refresh. Thanks @zeroaltitude.
• PR #76731 Fix mobile Control UI chat layout. Thanks @Solvely-Colin.
• PR #83738 fix(cron): capture originating session/agent on the cron wake tool call. Thanks @anagnorisis2peripeteia.
• PR #85196 Redact tool output secrets. Thanks @amknight.
• PR #92007 fix(security): block build tool env overrides. Thanks @eleqtrizit.
• PR #91891 fix: preserve non-oneOf protocol schema array order. Thanks @RomneyDa.
• PR #91754 fix(macos): hide unsupported Voice Wake controls. Related #89575. Thanks @RomneyDa and @cwhyhy.
• PR #92049 test(ci): restore upgrade survivor session fixture. Thanks @vincentkoc.
• PR #89670 fix: keep skill toggles keyed by skill identity. Related #89661. Thanks @s-moffett.
• PR #91934 fix(state): tolerate chmod failures when opening the state database. Related #91919. Thanks @truffle-dev and @david-garcia-garcia.
• PR #92051 fix(fal): parse raw completed queue results. Related #91989. Thanks @harjothkhara and @oswaldyeo.
• PR #92047 fix(agents): prefer explicit sessions_send keys. Related #64699. Thanks @vincentkoc and @sunxq1017-hash.
• PR #92020 fix(memory-core): check SQLite plugin state for dreaming ingestion audit after JSON migration (fixes #92017). Thanks @zenglingbiao and @JUMPUNDER.
• PR #92032 fix(mcp): always log channel-bridge notification failures. Thanks @hansraj316.
• PR #92033 fix(gateway): log swallowed background-task finalization errors. Thanks @hansraj316.
• PR #92022 fix(sessions): derive channel from direct-chat session keys in send-policy. Thanks @hansraj316.
• PR #91163 fix(xai): clarify x_search query guidance. Thanks @rubencu.
• PR #90121 fix(memory): write dream fallback without subagent runtime. Thanks @a-m-a-r-a.
• PR #91215 fix(ui): show prompt progress while sending. Related #91199. Thanks @zhangguiping-xydt and @vincentkoc and @Monniasza.
• PR #92029 fix(tools): surface unsupported-signal in anyOf availability. Thanks @hansraj316.
• PR #92034 perf(agents): memoize XML attribute regex in DSML stream parser. Thanks @hansraj316.
• PR #92026 perf(agents): sanitize compaction messages once for token estimation. Thanks @hansraj316.
• PR #91351 fix(opencode-go): add qwen plus tiered pricing. Related #91238. Thanks @849261680 and @vincentkoc and @samson910022.
• PR #92027 fix(gateway): recover config hot-reload after watcher errors. Thanks @hansraj316.
• PR #91471 feat(cron): add readable ISO time fields to cron runs JSON output. Thanks @FMLS and @cursoragent.
• PR #91711 :bug: fix(agents): classify harness provider mismatch as format error (#91710). Thanks @a-tokyo.
• PR #91292 fix(models): keep bundled provider catalog when configured base URL is blank (#91270). Thanks @yetval and @vincentkoc and @resYuto.
• PR #91720 :bug: fix(openai): remove chatgpt-responses transport override from gpt-5.3-codex catalog entry. Related #91710. Thanks @a-tokyo.
• PR #91305 fix(control-ui): make Control UI bootstrap config endpoint base-path-relative (#66946). Thanks @Alix-007 and @vincentkoc and @yndwx01.
• PR #92056 fix(exec): honor state dir approvals. Thanks @vincentkoc.
• PR #91897 fix(memory): self-heal missing index identity by initializing provider during sync. Thanks @xydt-tanshanshan and @vincentkoc.
• PR #91802 fix(diagnostics): release wedged session lane when stuck-session recovery aborts a run with queued session work. Related #91700. Thanks @openperf and @infocus13.
• PR #92030 fix(cron): structural top-of-hour match in stagger heuristic. Thanks @hansraj316 and @vincentkoc.
• PR #92055 fix(media): resolve state-relative inbound attachments. Thanks @sercada and @vincentkoc.
• PR #91962 fix(agent): dampen Discord stale thread replies. Thanks @RomneyDa.
• PR #90912 fix(agents): honor configured CLI resume timeouts. Thanks @ai-hpc and @vincentkoc.
• PR #91296 fix: hand off supervised git updates. Thanks @abnershang.
• PR #91950 fix(web_fetch): sanitize URL whitespace from LLM tool call arguments (fixes #91651). Thanks @zenglingbiao and @vincentkoc and @akang1798.
• PR #77367 fix(discord): scope command-deploy cache by application id. Related #77359. Thanks @lonexreb and @sallyom and @igmarketing.
• PR #91976 feat(auto-reply): durable inter-tool commentary via verbose standalone progress (supersedes #89850/#89890). Thanks @anagnorisis2peripeteia.
• PR #90128 fix(sessions): preserve user /model override across daily/idle session rollover (#90119). Thanks @Marvinthebored.
• PR #92084 fix(clickclack): allow explicit enable through plugin allowlist.
• PR #92092 fix(auto-reply): stop dropping claude-cli narration when commentary lane is off. Thanks @ragesaq.
• PR #92123 #92109: [Bug]: EmbeddedAttemptSessionTakeoverError caused by Btrfs ctimeNs instability. Thanks @lzyyzznl and @vincentkoc and @recruits.
• PR #92136 fix(feishu): reply inside P2P direct-message threads. Thanks @LiaoyuanNing and @vincentkoc.
• PR #92121 fix(memory): preserve live SQLite index during swaps. Related #91216. Thanks @xydt-tanshanshan and @chrisreddington.
• PR #90173 fix(agents): stabilize a2a prompt cache context. Thanks @Sunjae-k and @sunjae-1.
• PR #91974 fix(cli-runner): scope claude-cli queue to live-session owner identity (#91946). Thanks @wangwllu.
• PR #92053 fix(thinking): apply Claude profile to anthropic-messages catalog rows. Related #91975. Thanks @wangwllu.
• PR #41991 Google: show detailed Gemini CLI OAuth extraction failures. Thanks @bgmbgm94.
• PR #92074 fix(qqbot): flush tool output before silent non-streaming final. Thanks @sliverp.
• PR #89508 fix(models): clarify provider model registration hint. Related #89192. Thanks @sweetcornna and @aaajiao.
• PR #89085 fix(agents): keep migrated session entry ids unique on v1 upgrade. Thanks @yetval.
• PR #89552 fix(discord): clean migrated thread binding state. Thanks @SYU8384.
• PR #89448 fix(cron): reject durations that overflow to a non-finite value. Related #83906. Thanks @Alix-007 and @davinci282828.
• PR #89319 fix(doctor): warn on unsupported hook entry loaders. Related #89309. Thanks @leno23 and @vincentkoc and @CameronWeller.
• PR #91966 fix(config): stop config.patch replacePaths index suffix from widening array consent. Thanks @yetval and @vincentkoc.
• PR #92127 fix(plugins): rescan storm in "/models" call (regression shipped since v2026.5.18). Thanks @obuchowski.
• PR #91657 fix(ollama): use provider thinking default in SDK session factory. Related #91428. Thanks @openperf and @vincentkoc and @anijatsu.
• PR #91742 fix(memory): abort orphaned embedding work when memory_search times out. Related #91718. Thanks @dreamhunter2333 and @vincentkoc and @NOVA-Openclaw.
• PR #89091 fix(memory-core): retry narrative message reads. Thanks @bennewell35.
• PR #92150 fix(release): gate beta publish on plugin verification. Thanks @vincentkoc.
• PR #92158 fix(cli): validate gateway RPC timeout inputs. Thanks @ruanrrn and @comeran.
• PR #91911 fix(agents): retry same model across short rate-limit windows. Thanks @lanzhi-lee.

Release verification

• npm package: https://www.npmjs.com/package/openclaw/v/2026.6.6-beta.2
• registry tarball: https://registry.npmjs.org/openclaw/-/openclaw-2026.6.6-beta.2.tgz
• integrity: sha512-617ITjTL0UxtQK4qGOc248nQBJjExX43/RR7CBr+0rEpqnA88i/VWABfTPrUnNT25181uZkOyzgguZjMW0u4Ug==
• release SHA: 3129eed4de92d0ddc0209fbf195c790c3d73ab03
• full release CI report: https://github.com/openclaw/releases/blob/main/evidence/2026.6.6-beta.2/release-evidence.md
• release publish: https://github.com/openclaw/openclaw/actions/runs/27392222148
• npm preflight: https://github.com/openclaw/openclaw/actions/runs/27390602410
• full release validation: https://github.com/openclaw/openclaw/actions/runs/27390601362
• plugin npm publish: https://github.com/openclaw/openclaw/actions/runs/27392305214
• plugin ClawHub publish: dispatched separately, not awaited by this proof: https://github.com/openclaw/openclaw/actions/runs/27392308021
• OpenClaw npm publish: https://github.com/openclaw/openclaw/actions/runs/27392531757
• npm Telegram beta E2E: https://github.com/openclaw/openclaw/actions/runs/27392727108
• postpublish package acceptance: https://github.com/openclaw/openclaw/actions/runs/27392843057

2026.6.6

Highlights

• Tighter security boundaries: transcript, sandbox, MCP, browser, channel, and exec-approval paths now fail closed around unsafe access, timed-out approvals, and malformed boundary input. (#91529, #91618, #91741, #91750, #89938) Thanks @joshavant, @pgondhi987, @mmaps, @eleqtrizit, @drobison00, @vincentkoc, and @devinkuhn.
• Reliable Telegram delivery: account-scoped topics route to the correct agent, streamed text survives tool calls, callbacks and draft chunks stay coherent, and unauthorized DM text does not enter cache or prompt context. (#91189, #88682, #90212, #91478, #91915) Thanks @codysai001, @alexzhu0, @snowzlm, @obviyus, @sallyom, @AbdelftahZowail, @producedbysavant, @shakkernerd, @vincentkoc, and @BSG2000.
• iMessage stays connected: always-on inbound recovery, durable echo markers, block streaming, idle approval discovery, and outbound transport now survive restarts and idle periods. (#91335, #91449, #88969, #91783) Thanks @omarshahine, @jmissig, @dwonshin, @colmbrogan, @vincentkoc, and @TurboTheTurtle.
• Better browser and MCP connectivity: existing browser sessions, CDP/WebSocket discovery, default-profile URLs, OAuth/SSE transport, and tool schemas now connect through clearer, safer paths. (#91422, #89851, #91736, #91451) Thanks @pgondhi987, @anagnorisis2peripeteia, @eleqtrizit, @LiuwqGit, @lifuyue, @marcusbsorensen, @cursoragent, @vincentkoc, @849261680, and @mgrandau.
• Faster first replies: Control UI startup no longer waits on broad model loading, while cached metadata, lazy slash-command work, and first-event tracing make slow initial responses visible. (#91531, #91538, #91568, #91583) Thanks @vincentkoc and @BSG2000.
• Broader provider support: OpenRouter OAuth and Claude Fable 5 land alongside correct Codex compaction ownership, local-model execution, normalized tool progress, and Gemma 4 reasoning replay. (#91830, #91882, #91590, #88630, #91696) Thanks @Patrick-Erichsen, @joshavant, @bdjben, @Coder-Wangyankun, @vincentkoc, @bfox55, @shakkernerd, and @NOVA-Openclaw.

Changes

• CLI progress: emit Claude CLI commentary progress events and bridge inter-tool commentary into channel progress without exposing internal protocol scaffolding. (#89834, #90883) Thanks @anagnorisis2peripeteia, @AbdelftahZowail, @kentuscn, and @vincentkoc.
• Observability: allow trusted diagnostics channels to capture tool input/output content, add first-assistant-event traces, and warn on slow initial replies. (#91256, #91568, #91583) Thanks @amknight, @mjunaidca, and @vincentkoc.
• Plugins/ClawHub: dogfood reusable package publishing, let dry runs skip publish approval, allow declared installed trusted hooks, report managed plugin version drift, and warn instead of failing on retired Skill Workshop configuration. (#91574, #91591, #90004, #90927, #90838) Thanks @Patrick-Erichsen, @brokemac79, @lonexreb, @rogerallen1, @vincentkoc, and @ryanhelms.
• Memory/providers: move the local llama.cpp runtime into its provider plugin, batch embeddings across files, persist the agent model catalog cache, and keep QMD JSON search one-shot while filtering stale REM recall previews. (#91324, #89138, #90457, #91837, #91851) Thanks @osolmaz, @mushuiyu886, @ai-hpc, @TurboTheTurtle, @jalehman, @hartmark, @vincentkoc, @rudi193-cmd, @Peilsender, and @xpysgdhr.
• Channels/mobile: add the QQBot group mention toggle, improve iPad and iPhone control surfaces, and expose the active connection host in the TUI footer. (#91423, #91557, #89909) Thanks @cxyhhhhh, @Solvely-Colin, @baskduf, @joshavant, @sliverp, and @deuxksy.
• Performance: prewarm TUI runtime plugins, deduplicate plugin auto-enable fanout, trim dense text-delta snapshots, and reuse prepared startup model metadata. (#90782, #89978, #91580, #91531) Thanks @RomneyDa, @ai-hpc, @vincentkoc, and @JakeBiggs.

Fixes

• Agent/session recovery: drop stale approval follow-ups after session rebind, remove drained reply-queue items by identity, recover stale main and visible replies, preserve Codex context-engine compaction ownership, lower the default compaction timeout to 180 seconds while respecting explicit configuration, and keep provider-failure terminal lifecycle state correct. (#85679, #91450, #91566, #91840, #91590, #91361, #91895) Thanks @openperf, @yetval, @joshavant, @wangmiao0668000666, @TurboTheTurtle, @two3pro, @velvet-shark, @sallyom, @849261680, @vincentkoc, @Tony-ooo, @Jerry-Xin, @olveww-dot, and @nikhilmaddirala.
• User-visible content boundaries: suppress Codex/Harmony protocol artifacts, neutralize browser and LanceDB memory media directives, redact transcript images, and preserve native /compact replies through source suppression. (#89151, #91422, #91425, #91529, #90212) Thanks @joelnishanth, @pgondhi987, @joshavant, @snowzlm, @reslp, @vincentkoc, and @devinkuhn.
• Channel delivery: keep WhatsApp captured replies attached to the successor controller after restart, retry Feishu rate limits, preserve Mattermost thread replies, canonicalize LINE webhook paths, restore Discord reply hydration and runtime timeout exports, and show OpenAI Realtime WebRTC assistant transcripts. (#85823, #89659, #91684, #91649, #90263, #91686, #90426) Thanks @itsuzef, @ladygege, @jacobtomlinson, @fuller-stack-dev, @shushushv, @mcaxtr, @AxelHu, @vincentkoc, @marshallm-create, @sliverp, and @dahifi.
• Cron: cancel active task runs cleanly, preserve terminal timeout/cancel state, and recover no-deliver tool warnings instead of silently losing the outcome. (#90666, #90678) Thanks @ai-hpc.
• Gateway/config/auth: share the approval runtime socket token, replace arrays explicitly in config.patch, skip the deleted-agent guard only for valid ACP harness sessions, surface headless LaunchAgent state, verify SQLite auth migration before cleanup, and arm QMD startup maintenance. (#87105, #91551, #91219, #91614, #91740, #91978) Thanks @fuller-stack-dev, @scotthuang, @joshavant, @velvet-shark, @vincentkoc, and @dahifi.
• Providers/Codex: clarify quota errors, restore the Codex synthetic usage line, canonicalize Codex protocol assets, require API-key auth for realtime voice, normalize ACP model refs, preserve Gemma 4 reasoning_content, and avoid guardian review for local models. (#91390, #91709, #91507, #91567, #88630, #91696) Thanks @hxy91819, @brokemac79, @RomneyDa, @joshavant, @Coder-Wangyankun, @vincentkoc, @bfox55, @shakkernerd, and @sergiopesch.
• Updates/builds: recover package Gateway restarts after refresh failure, expose plugin convergence repair, fall back to Corepack in PATH-less pnpm environments, seed the correct Docker store packages, and keep ClawHub dry-run and publish paths reusable. (#91581, #91599, #91547, #91591) Thanks @fuller-stack-dev, @sallyom, @Patrick-Erichsen, @vincentkoc, and @laurenceputra.
• UI: require explicit user intent before opening chat sessions and drain restored chat queues after session switches. (#91480) Thanks @TurboTheTurtle, @Takhoffman, and @zdwalter.
• Android: avoid the dataSync foreground-service type for persistent nodes. (#80082) Thanks @davelutztx.
• Native hooks: bound relay lifetimes so abandoned native hook connections cannot linger indefinitely. (#91550) Thanks @joshavant and @clem-git.

Complete contribution record

This audited record covers the complete v2026.6.5..v2026.6.6 history: 198 merged PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact.

Pull requests

• PR #91335 fix(imessage): always-on inbound recovery and dedupe. Related #89237. Thanks @omarshahine and @vincentkoc and @dwonshin.
• PR #91189 fix(telegram): route account-scoped topic agents. Thanks @codysai001.
• PR #88682 Preserve Telegram streamed text blocks between tool calls. Related #87326. Thanks @alexzhu0 and @AbdelftahZowail.
• PR #91390 fix: clarify provider quota errors. Thanks @hxy91819.
• PR #90883 fix(cli): bridge inter-tool commentary events to channel progress. Thanks @anagnorisis2peripeteia.
• PR #91419 docs: preserve channel brand terms in Chinese i18n. Thanks @hxy91819.
• PR #87105 fix(gateway): share approval runtime socket token. Thanks @fuller-stack-dev.
• PR #80082 fix(android): avoid dataSync FGS for persistent node. Thanks @davelutztx.
• PR #91442 docs: preserve LINE across localized docs glossaries. Thanks @hxy91819.
• PR #88768 fix(codex): normalize dynamic tool progress results. Thanks @bdjben.
• PR #91422 fix(browser): neutralize media directives in browser output [AI]. Thanks @pgondhi987.
• PR #89834 feat(cli): emit commentary progress events from Claude CLI parser. Related #87326. Thanks @anagnorisis2peripeteia and @AbdelftahZowail.
• PR #85679 fix(agents): drop stale exec approval followups after session rebind. Related #59349. Thanks @openperf and @two3pro.
• PR #91450 fix(reply-queue): remove the drained item by reference instead of front index. Thanks @yetval.
• PR #89151 fix(delivery): suppress Codex/Harmony internal protocol artifacts from user-facing channels. Related #88128. Thanks @joelnishanth and @reslp.
• PR #90678 fix(cron): recover no-deliver tool warnings. Thanks @ai-hpc.
• PR #91449 fix(imessage): honor block streaming config. Thanks @jmissig and @omarshahine.
• PR #91508 Revert "docs: add maturity scorecard mirror". Thanks @kevinslin.
• PR #91364 build(deps): bump github.com/steipete/peekaboo from 3.3.0 to 3.4.0 in /apps/macos in the swift-deps group.
• PR #91368 build(deps): bump actions/github-script from 8 to 9.
• PR #91512 chore: add taxonomy file. Thanks @kevinslin.
• PR #91369 build(deps): bump actions/cache from 4 to 5.
• PR #91367 build(deps): bump the actions group with 2 updates.
• PR #91365 build(deps): bump the android-deps group in /apps/android with 3 updates.
• PR #91496 chore: bump Codex app-server to 0.137.0. Thanks @RomneyDa.
• PR #90666 fix(cron): cancel active cron task runs. Thanks @ai-hpc.
• PR #90927 fix(doctor): report managed plugin version drift. Related #90891. Thanks @brokemac79.
• PR #91531 perf(control-ui): reuse startup model metadata. Thanks @vincentkoc.
• PR #91538 perf(control-ui): avoid startup catalog wait. Thanks @vincentkoc.
• PR #91507 feat: canonicalize Codex protocol JSON asset ordering. Thanks @RomneyDa.
• PR #91550 fix: bound native hook relay lifetime. Related #90993. Thanks @joshavant and @clem-git.
• PR #89588 fix(telegram): restore /compact on generic message ingress. Related #89525. Thanks @joelnishanth and @cursoragent and @bomberluke37-prog.
• PR #91529 Fix transcript image redaction. Related #90760. Thanks @joshavant and @devinkuhn.
• PR #91551 Fix config.patch explicit array replacement. Thanks @joshavant.
• PR #91568 perf(control-ui): trace first assistant event. Thanks @vincentkoc.
• PR #85823 fix(whatsapp): route captured replies through successor controller after restart. Thanks @itsuzef and @mcaxtr.
• PR #91574 feat: dogfood reusable ClawHub package publish. Thanks @Patrick-Erichsen.
• PR #91583 perf(control-ui): warn on slow first replies. Thanks @vincentkoc.
• PR #89659 fix(feishu): retry on send rate-limit errors (230020/230006). Related #70879. Thanks @ladygege and @marshallm-create and @sliverp and @AxelHu.
• PR #91547 Fix Docker store seed target packages. Related #91035. Thanks @sallyom and @laurenceputra.
• PR #91578 fix: make docs i18n frontmatter translation resilient. Thanks @hxy91819.
• PR #91567 fix(openai): require api-key auth for realtime voice. Related #90456. Thanks @joshavant and @sergiopesch.
• PR #91591 fix: let ClawHub dry runs skip publish approval. Thanks @Patrick-Erichsen.
• PR #91598 perf(control-ui): lazy load slash commands. Thanks @vincentkoc.
• PR #91580 fix(agents): trim dense text delta snapshots. Related #86599. Thanks @vincentkoc and @JakeBiggs.
• PR #91425 fix(memory-lancedb): guard memory recall output [AI]. Thanks @pgondhi987.
• PR #88969 fix(imessage): persist echo markers before send. Thanks @colmbrogan.
• PR #91566 Fix stale main session startup recovery. Related #90525. Thanks @joshavant and @Tony-ooo.
• PR #91324 fix(memory): move local llama.cpp runtime to provider plugin. Related #88705. Thanks @osolmaz and @Peilsender.
• PR #91637 docs: include plugin prerelease in release validation approval.
• PR #91649 fix(line): canonicalize trailing-slash webhook paths.
• PR #91423 feat(qqbot): add /bot-group-allways command to toggle mention requirement. Thanks @cxyhhhhh and @sliverp.
• PR #91642 fix(docs): continue partial i18n batches after file errors. Thanks @hxy91819.
• PR #91661 chore(plugin-sdk): refresh API baseline hash.
• PR #91665 docs: fix release CI Android dispatch guidance.
• PR #89138 fix #88009: [Feature]: batched memory embedding should batch over files. Thanks @mushuiyu886 and @jalehman and @hartmark.
• PR #91679 fix(plugin-sdk): align Discord component edit facade types. Thanks @vincentkoc.
• PR #91686 fix(discord): restore runtime timeout compatibility exports. Thanks @vincentkoc.
• PR #90212 fix(agents): deliver native /compact replies through source suppression. Thanks @snowzlm.
• PR #91618 fix: expand unsafe host env denylist. Thanks @pgondhi987.
• PR #91615 fix: block rustup toolchain env overrides [AI]. Thanks @pgondhi987.
• PR #89851 fix(gateway): support Streamable HTTP MCP transport on loopback server. Thanks @anagnorisis2peripeteia.
• PR #91619 fix: block git protocol env controls [AI]. Thanks @pgondhi987.
• PR #91684 fix(mattermost): keep default replies in existing threads. Thanks @jacobtomlinson.
• PR #90457 fix(models): persist agent catalog cache. Thanks @ai-hpc.
• PR #91709 fix(status): restore Codex synthetic usage line. Related #91694. Thanks @brokemac79.
• PR #89909 fix(tui): show connection host in footer. Related #56276. Thanks @baskduf and @deuxksy.
• PR #89978 perf(config): dedupe plugin auto-enable fanout work. Thanks @ai-hpc.
• PR #91219 fix(gateway): skip deleted-agent guard for ACP harness session keys. Thanks @scotthuang.
• PR #90782 perf(tui): prewarm runtime plugins before first send. Thanks @RomneyDa.
• PR #90838 fix(config): warn for retired skill-workshop plugin entry instead of failing validation (#90244). Thanks @lonexreb and @rogerallen1.
• PR #91753 docs: clarify Matrix plugin upgrade repair. Thanks @RomneyDa.
• PR #91755 docs: align Feishu DM policy defaults. Thanks @RomneyDa.
• PR #91745 fix(discord): require sender for moderation actions [AI]. Thanks @eleqtrizit.
• PR #85950 docs: clarify trusted-proxy Control UI scope behavior. Related #80063. Thanks @nielskaspers and @longstoryscott.
• PR #91746 fix(msteams): require admin for group actions. Thanks @eleqtrizit.
• PR #91256 feat(diagnostics-otel): capture tool input/output content via trusted channel. Thanks @amknight.
• PR #91749 fix(gateway): restrict non-owner loopback tools. Thanks @eleqtrizit.
• PR #91748 fix(elevated): reject group ids as senders. Thanks @eleqtrizit.
• PR #91752 fix(codex): guard sandbox http requests. Thanks @eleqtrizit.
• PR #91763 fix: require ACP metadata for deleted-agent bypass. Thanks @shakkernerd.
• PR #91751 fix(mcp): harden stdio env filtering. Thanks @eleqtrizit.
• PR #91765 Clarify env-var executable behavior reports in SECURITY.md. Thanks @jacobtomlinson.
• PR #91480 fix(ui): require user intent for chat sessions. Related #89760. Thanks @TurboTheTurtle and @Takhoffman and @zdwalter.
• PR #91777 docs: remove superpowers spec draft. Thanks @Patrick-Erichsen.
• PR #91773 fix(mcp): lowercase SSE event-source header keys to prevent duplicate Authorization (401). Thanks @Takhoffman.
• PR #91741 Validate sandbox bind parent paths [AI]. Thanks @mmaps.
• PR #88530 fix(imessage): skip idle approval discovery scans. Thanks @colmbrogan and @omarshahine.
• PR #91780 fix(ui): drain restored chat queue after session switch. Thanks @tmimmanuel.
• PR #91750 fix(search): enforce native web search tool policy. Thanks @eleqtrizit.
• PR #91757 fix(config): clarify retired skill workshop plugin warning. Thanks @RomneyDa.
• PR #91787 fix(doctor): keep TTS legacy migration on supported paths.
• PR #91783 fix(imessage): harden outbound send transport. Related #84329. Thanks @omarshahine and @TurboTheTurtle.
• PR #91785 fix(imessage): surface inbound startup diagnostics. Thanks @omarshahine.
• PR #91590 Fix context-engine compaction ownership for Codex sessions. Thanks @joshavant.
• PR #91557 Improve iPad and iPhone control surfaces. Thanks @Solvely-Colin and @joshavant.
• PR #91666 chore(deps): bump useblacksmith/setup-docker-builder from 1.8.0 to 1.9.0 in the actions group.
• PR #91819 docs: link ClawHub plugin validation fixes guide. Thanks @Patrick-Erichsen.
• PR #88630 fix(codex): avoid guardian review for local models. Thanks @vincentkoc.
• PR #91830 feat: add OpenRouter OAuth to onboarding. Thanks @Patrick-Erichsen.
• PR #91842 fix(plugin-sdk): refresh API baseline hash.
• PR #91614 fix(gateway): surface headless LaunchAgent state. Thanks @fuller-stack-dev.
• PR #91851 fix(memory-core): filter stale recall entries in REM harness preview. Thanks @vincentkoc.
• PR #91859 fix(ci): disable memory slot in release smoke config. Thanks @vincentkoc.
• PR #90004 [plugin sdk] Allow declared installed trusted hooks. Related #87735. Thanks @brokemac79 and @ryanhelms.
• PR #91837 fix(memory-core): keep QMD JSON search one-shot. Related #91821. Thanks @TurboTheTurtle and @xpysgdhr.
• PR #91871 Remove bundled channel contract fallbacks. Thanks @obviyus.
• PR #91879 fix(ci): include ACPX in shared live-test image.
• PR #91840 Fix stale visible reply recovery. Related #90535. Thanks @joshavant and @Jerry-Xin.
• PR #91876 Fix Telegram callback API handling. Thanks @obviyus.
• PR #91874 Share channel draft chunking resolver. Thanks @obviyus.
• PR #91599 fix(update): expose plugin convergence repair. Thanks @fuller-stack-dev.
• PR #91581 fix(update): recover package gateway restart after refresh failure. Thanks @fuller-stack-dev.
• PR #91904 fix(telegram): use SDK dispatch dedupe. Thanks @obviyus.
• PR #90263 fix(discord): hydrate reply context metadata. Thanks @fuller-stack-dev.
• PR #91478 block unauthorized Telegram DM text from prompt context. Related #91209. Thanks @sallyom and @producedbysavant.
• PR #91915 fix(telegram): audit follow-ups — block-mode chunk config, dedupe bucket cleanup, grammy contract trust. Thanks @obviyus.
• PR #91361 fix(compaction): lower default timeout from 900s to 180s, preserve explicit config. Related #91358. Thanks @wangmiao0668000666 and @velvet-shark and @olveww-dot.
• PR #91791 fix(sandbox): use materialized skill paths in startup prompts. Related #91761. Thanks @brokemac79 and @vincentkoc and @gbb-netizen.
• PR #91736 Support existing-session browser CDP endpoints. Related #56118. Thanks @lifuyue and @mgrandau.
• PR #91747 fix(browser): validate discovered CDP websocket URLs. Thanks @eleqtrizit.
• PR #91882 feat(anthropic): support Claude Fable 5 adaptive thinking. Related #91805. Thanks @NOVA-Openclaw.
• PR #91884 fix(memory): keep ignored-name QMD roots watchable. Thanks @vincentkoc.
• PR #91740 fix(auth): verify SQLite auth migration before cleanup. Thanks @fuller-stack-dev and @velvet-shark.
• PR #91451 fix(mcp): repair OAuth redirect, errors, and unicode schema patterns. Related #91433. Thanks @LiuwqGit and @cursoragent and @vincentkoc and @marcusbsorensen.
• PR #91978 fix(gateway): arm qmd startup maintenance. Thanks @vincentkoc.
• PR #90426 fix(talk): show OpenAI Realtime WebRTC assistant transcripts. Thanks @shushushv and @vincentkoc.
• PR #91696 fix(agents): preserve reasoning_content replay for Gemma 4 openai-completions models. Related #91645. Thanks @Coder-Wangyankun and @bfox55.
• PR #89938 Fail closed on exec approval timeout. Thanks @drobison00.
• PR #91895 fix(webchat): finalize provider failure lifecycle. Related #91730. Thanks @TurboTheTurtle and @sallyom and @nikhilmaddirala.
• PR #80143 fix(browser): honor cdpUrl for user default profile. Related #48042. Thanks @HemantSudarshan and @Max-Resilient.
• PR #91688 fix(cron): reject cron expressions that have no reachable run time. Thanks @yetval and @vincentkoc.
• PR #91737 fix(cron): use final-call usage for session token totals. Related #91716. Thanks @MonkeyLeeT and @vincentkoc and @yetval.
• PR #89605 fix(process): return timeout code for killed commands. Thanks @ai-hpc.
• PR #80013 perf(usage-cost-cache): throttle full-cache rewrites during refresh. Thanks @zeroaltitude.
• PR #76731 Fix mobile Control UI chat layout. Thanks @Solvely-Colin.
• PR #83738 fix(cron): capture originating session/agent on the cron wake tool call. Thanks @anagnorisis2peripeteia.
• PR #85196 Redact tool output secrets. Thanks @amknight.
• PR #92007 fix(security): block build tool env overrides. Thanks @eleqtrizit.
• PR #91891 fix: preserve non-oneOf protocol schema array order. Thanks @RomneyDa.
• PR #91754 fix(macos): hide unsupported Voice Wake controls. Related #89575. Thanks @RomneyDa and @cwhyhy.
• PR #92049 test(ci): restore upgrade survivor session fixture. Thanks @vincentkoc.
• PR #89670 fix: keep skill toggles keyed by skill identity. Related #89661. Thanks @s-moffett.
• PR #91934 fix(state): tolerate chmod failures when opening the state database. Related #91919. Thanks @truffle-dev and @david-garcia-garcia.
• PR #92051 fix(fal): parse raw completed queue results. Related #91989. Thanks @harjothkhara and @oswaldyeo.
• PR #92047 fix(agents): prefer explicit sessions_send keys. Related #64699. Thanks @vincentkoc and @sunxq1017-hash.
• PR #92020 fix(memory-core): check SQLite plugin state for dreaming ingestion audit after JSON migration (fixes #92017). Thanks @zenglingbiao and @JUMPUNDER.
• PR #92032 fix(mcp): always log channel-bridge notification failures. Thanks @hansraj316.
• PR #92033 fix(gateway): log swallowed background-task finalization errors. Thanks @hansraj316.
• PR #92022 fix(sessions): derive channel from direct-chat session keys in send-policy. Thanks @hansraj316.
• PR #91163 fix(xai): clarify x_search query guidance. Thanks @rubencu.
• PR #90121 fix(memory): write dream fallback without subagent runtime. Thanks @a-m-a-r-a.
• PR #91215 fix(ui): show prompt progress while sending. Related #91199. Thanks @zhangguiping-xydt and @vincentkoc and @Monniasza.
• PR #92029 fix(tools): surface unsupported-signal in anyOf availability. Thanks @hansraj316.
• PR #92034 perf(agents): memoize XML attribute regex in DSML stream parser. Thanks @hansraj316.
• PR #92026 perf(agents): sanitize compaction messages once for token estimation. Thanks @hansraj316.
• PR #91351 fix(opencode-go): add qwen plus tiered pricing. Related #91238. Thanks @849261680 and @vincentkoc and @samson910022.
• PR #92027 fix(gateway): recover config hot-reload after watcher errors. Thanks @hansraj316.
• PR #91471 feat(cron): add readable ISO time fields to cron runs JSON output. Thanks @FMLS and @cursoragent.
• PR #91711 :bug: fix(agents): classify harness provider mismatch as format error (#91710). Thanks @a-tokyo.
• PR #91292 fix(models): keep bundled provider catalog when configured base URL is blank (#91270). Thanks @yetval and @vincentkoc and @resYuto.
• PR #91720 :bug: fix(openai): remove chatgpt-responses transport override from gpt-5.3-codex catalog entry. Related #91710. Thanks @a-tokyo.
• PR #91305 fix(control-ui): make Control UI bootstrap config endpoint base-path-relative (#66946). Thanks @Alix-007 and @vincentkoc and @yndwx01.
• PR #92056 fix(exec): honor state dir approvals. Thanks @vincentkoc.
• PR #91897 fix(memory): self-heal missing index identity by initializing provider during sync. Thanks @xydt-tanshanshan and @vincentkoc.
• PR #91802 fix(diagnostics): release wedged session lane when stuck-session recovery aborts a run with queued session work. Related #91700. Thanks @openperf and @infocus13.
• PR #92030 fix(cron): structural top-of-hour match in stagger heuristic. Thanks @hansraj316 and @vincentkoc.
• PR #92055 fix(media): resolve state-relative inbound attachments. Thanks @sercada and @vincentkoc.
• PR #91962 fix(agent): dampen Discord stale thread replies. Thanks @RomneyDa.
• PR #90912 fix(agents): honor configured CLI resume timeouts. Thanks @ai-hpc and @vincentkoc.
• PR #91296 fix: hand off supervised git updates. Thanks @abnershang.
• PR #91950 fix(web_fetch): sanitize URL whitespace from LLM tool call arguments (fixes #91651). Thanks @zenglingbiao and @vincentkoc and @akang1798.
• PR #77367 fix(discord): scope command-deploy cache by application id. Related #77359. Thanks @lonexreb and @sallyom and @igmarketing.
• PR #91976 feat(auto-reply): durable inter-tool commentary via verbose standalone progress (supersedes #89850/#89890). Thanks @anagnorisis2peripeteia.
• PR #90128 fix(sessions): preserve user /model override across daily/idle session rollover (#90119). Thanks @Marvinthebored.
• PR #92084 fix(clickclack): allow explicit enable through plugin allowlist.
• PR #92092 fix(auto-reply): stop dropping claude-cli narration when commentary lane is off. Thanks @ragesaq.
• PR #92123 #92109: [Bug]: EmbeddedAttemptSessionTakeoverError caused by Btrfs ctimeNs instability. Thanks @lzyyzznl and @vincentkoc and @recruits.
• PR #92136 fix(feishu): reply inside P2P direct-message threads. Thanks @LiaoyuanNing and @vincentkoc.
• PR #92121 fix(memory): preserve live SQLite index during swaps. Related #91216. Thanks @xydt-tanshanshan and @chrisreddington.
• PR #90173 fix(agents): stabilize a2a prompt cache context. Thanks @Sunjae-k and @sunjae-1.
• PR #91974 fix(cli-runner): scope claude-cli queue to live-session owner identity (#91946). Thanks @wangwllu.
• PR #92053 fix(thinking): apply Claude profile to anthropic-messages catalog rows. Related #91975. Thanks @wangwllu.
• PR #41991 Google: show detailed Gemini CLI OAuth extraction failures. Thanks @bgmbgm94.
• PR #92074 fix(qqbot): flush tool output before silent non-streaming final. Thanks @sliverp.
• PR #89508 fix(models): clarify provider model registration hint. Related #89192. Thanks @sweetcornna and @aaajiao.
• PR #89085 fix(agents): keep migrated session entry ids unique on v1 upgrade. Thanks @yetval.
• PR #89552 fix(discord): clean migrated thread binding state. Thanks @SYU8384.
• PR #89448 fix(cron): reject durations that overflow to a non-finite value. Related #83906. Thanks @Alix-007 and @davinci282828.
• PR #89319 fix(doctor): warn on unsupported hook entry loaders. Related #89309. Thanks @leno23 and @vincentkoc and @CameronWeller.
• PR #91966 fix(config): stop config.patch replacePaths index suffix from widening array consent. Thanks @yetval and @vincentkoc.
• PR #92127 fix(plugins): rescan storm in "/models" call (regression shipped since v2026.5.18). Thanks @obuchowski.
• PR #91657 fix(ollama): use provider thinking default in SDK session factory. Related #91428. Thanks @openperf and @vincentkoc and @anijatsu.
• PR #91742 fix(memory): abort orphaned embedding work when memory_search times out. Related #91718. Thanks @dreamhunter2333 and @vincentkoc and @NOVA-Openclaw.
• PR #89091 fix(memory-core): retry narrative message reads. Thanks @bennewell35.
• PR #92150 fix(release): gate beta publish on plugin verification. Thanks @vincentkoc.
• PR #92158 fix(cli): validate gateway RPC timeout inputs. Thanks @ruanrrn and @comeran.
• PR #91911 fix(agents): retry same model across short rate-limit windows. Thanks @lanzhi-lee.

2026.6.5

Highlights

• Safer channel output: QQBot strips model reasoning and thinking scaffolding before native delivery, so users see the final answer rather than raw internal markup. (#89913, #90132) Thanks @openperf, @dygg2001, @Takhoffman, and @vincentkoc.
• MCP results no longer poison sessions: resource_link, audio, malformed images, and future non-text blocks are normalized before provider conversion, avoiding Anthropic 400s and broken follow-up history. (#90710, #90728) Thanks @RanSHammer, @849261680, and @Takhoffman.
• Anthropic extended thinking recovers after restarts: prompt-cache expiry and early-signature failures wait for a real message start, so they reach the existing retry path rather than ending a turn. (#90667, #90697) Thanks @openperf, @MIHHHMIH, @Takhoffman, @vincentkoc, @itsuzef, and @mcaxtr.
• Parallel web search is bundled: API-key discovery, guarded endpoint handling, cache-safe session IDs, onboarding, and documentation make it a first-class search provider. (#85158) Thanks @NormallyGaussian.
• Better Matrix and Vertex reliability: Matrix voice notes and threaded conversations retain their context, while Google Vertex ADC models regain static catalog and runtime resolution. (#78016, #90415, #90506, #90609) Thanks @849261680, @frankdierolf, and @paulogogs.
• Safer upgrades and restarts: cron JSON stores migrate before runtime, service env placeholders stop masking secrets, and macOS avoids unnecessary direct-Gateway reconnect churn. (#90072, #90208, #90668, #90815) Thanks @MonkeyLeeT, @sallyom, @vrurg, @wlassalle724, @jalehman, @Takhoffman, @zhangguiping-xydt, @joshavant, and @vincentkoc.

Changes

• Search/providers: add the Parallel bundled web-search plugin, registration contracts, onboarding integration, and guarded api.parallel.ai/v1/search support. (#85158) Thanks @NormallyGaussian and @vincentkoc.
• Matrix/channels: add voice-message preflight and thread-aware read/reply behavior. (#78016, #90415) Thanks @frankdierolf.
• Skills/ClawHub: install ClawHub skills backed by GitHub repositories through the resolved install API, download the pinned GitHub commit, keep install-policy checks, and report install telemetry after success. (#90478) Thanks @Patrick-Erichsen, @vincentkoc, @itsuzef, and @mcaxtr.
• Google Chat/channels: add native approval card actions and click handling so Google Chat approvals use platform-native cards instead of generic message flow.
• Mobile: Android provider/model screens now surface expiring, unavailable, unresolved, and attention states more clearly, while iOS settings and Talk tabs keep diagnostics, gateway rows, attachment labels, and unavailable Talk controls reachable. Thanks @joshavant and @shakkernerd.
• Memory: QMD search can use the new rerank toggle, and memory adapter status uses the resolved default model identity when checking plain status. (#61834) Thanks @kouka-t0yohei and @vincentkoc.
• QQBot: add /bot-group-allways on|off slash command (with named-account and default-account support) to toggle whether group messages require an @mention before the bot replies, and clear the runtime config snapshot after the write so the new account-level defaultRequireMention takes effect immediately without restart. (#91423) Thanks @cxyhhhhh, @joshavant, @vincentkoc, @itsuzef, @mcaxtr, and @jacobtomlinson.

Fixes

• Agents: sessions_send now honors an explicit sessionKey when stale label metadata is also present, and denied session-id sends no longer echo the resolved canonical session key. Fixes #64699; refs #74009 and #41199 Thanks @Mintalix, @RevisitMoon, @Mocha-s, @chouxiaozi1989, @sunxq1017-hash, @vincentkoc, and @joshavant.
• Channel content boundaries: QQBot now strips reasoning/thinking tags before sending, preserving final answers while hiding internal model narration from users. (#89913, #90132) Thanks @openperf, @Takhoffman, @dygg2001, and @vincentkoc.
• Agents/MCP/providers: coerce non-text/image MCP tool-result blocks before they reach provider converters, preserving valid images and turning richer MCP content into text instead of malformed image blocks. (#90710, #90728) Thanks @RanSHammer, @849261680, @Takhoffman, @vincentkoc, and @LiuwqGit.
• Anthropic/Codex/ACP/agent recovery: defer Anthropic stream start events until message_start, strip stale compaction thinking signatures before Anthropic replay, detect unsigned thinking-only stalls, refresh prompt fences after compaction writes, reject empty completion handoffs, preserve parent streaming-off overrides/shared progress commentary, forward heartbeat metadata to context-engine hooks, and cover Codex session/thread migration edge cases. (#90667, #90697, #90163, #90108, #89874, #89505, #90632, #89302, #90729, #90317, #90319) Thanks @openperf, @100yenadmin, @ooiuuii, @johnib, @Takhoffman, @MIHHHMIH, @dexiosmb, @zenglingbiao, @jalehman, @huangxun375-stack, @holgergruenhagen, @vincentkoc, @joshavant, and @ArthurusDent.
• Provider/model resolution: preserve Google Vertex ADC auth markers in generated catalogs, re-probe a single-provider primary after cooldown, share Codex model visibility, fail closed for unknown model auth, preserve Codex alias availability, keep unresolved profile refs unknown, and avoid resolving auth while listing models. (#90506, #90609, #90717, #90702) Thanks @849261680, @paulogogs, @brtkwr, and @vincentkoc.
• Gateway/macOS/mobile: avoid duplicate Gateway probe warnings by identity, rate-limit node pairing requests while preserving paired-node reconnects, keep macOS node mode on a healthy direct Gateway session, keep iOS diagnostics and gateway rows reachable, and avoid Linux ARM Gradle resource tasks during Android builds. (#85791, #90147, #90668, #90815) Thanks @giodl73-repo, @vrurg, @pgondhi987, @Takhoffman, @zhangguiping-xydt, @vincentkoc, @joshavant, and @shakkernerd.
• TUI/chat/Workboard/auto-reply: optimistic user messages stay stable across stale history reloads, runId reassignment, and abort windows instead of disappearing, jumping, or lingering as ghost rows; Workboard stale lifecycle bulk updates no longer overwrite newer status/provenance; message-tool sends now count as delivery. (#86205, #89600, #88592, #90123) Thanks @RomneyDa, @BunsDev, @kzclaw, @mcaxtr, @vincentkoc, @joshavant, and @LiuwqGit.
• Cron/update/service env: doctor config preflight now migrates legacy cron JSON stores into SQLite before runtime reads, service env planning skips unresolved placeholders that would mask state-dir .env values, and session transcript rewrites keep registry markers/discriminants consistent. (#90072, #90208, #90277, #90488) Thanks @MonkeyLeeT, @sallyom, @Kvikkulf, @jalehman, @wlassalle724, @shakkernerd, and @vincentkoc.
• Security/config/tooling: guard MCP HTTP redirects, protect global agent config defaults, and keep malformed operational limits bounded and explicit. (#89732, #90145) Thanks @pgondhi987, @vincentkoc, and @joshavant.
• Channels: WhatsApp restarts when per-account config changes, bounds background startup waits, closes failed sockets, and preserves reconnect behavior; Mattermost slash commands keep their state on globalThis; Feishu streaming cards preserve full merged content; voice-call tracks Twilio streams after connect; ClickClack reply tools respect toolsAllow. (#87951, #87965, #90486, #68113, #90534, #90181, #90607, #89500) Thanks @MukundaKatta, @mcaxtr, @infoanton, @mushuiyu886, @sahibzada-allahyar, @borntobefree2-cmyk, @Takhoffman, @mmaps, @MMMMSSSS8899, @ly85206559, @sliverp, @vincentkoc, @joshavant, @LiuwqGit, @itsuzef, @wjm7220, and @donkeykong91.
• Feishu: retry transient send rate-limit errors (HTTP 429, per-chat code 230020, tenant-level code 11232) with linear backoff, including SDK responses that fulfill with rate-limit bodies instead of throwing, and route streaming-card sends through the retry wrapper. (#89659) Thanks @ladygege, @AxelHu, @marshallm-create, @sliverp, @joshavant, @vincentkoc, @itsuzef, and @mcaxtr.
• Memory: keep doctor REM harness previews aligned with live REM by dropping short-term recall snippets whose source files disappeared before rendering preview output. Thanks @samzong, @frankekn, and @vincentkoc.

Complete contribution record

This audited record covers the complete v2026.6.2-beta.1..v2026.6.5 history: 142 merged PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact.

Pull requests

• PR #89102 refactor(auth): store auth profiles in SQLite.
• PR #90028 docs: clarify legacy openai-codex auth. Thanks @jalehman.
• PR #89600 Fix Workboard status persistence. Related #88592. Thanks @BunsDev and @kzclaw.
• PR #90067 fix(workboard): isolate stale lifecycle bulk patches. Thanks @BunsDev.
• PR #88585 Pin official npm plugin install records. Thanks @zhuisDEV.
• PR #90053 fix: hide Skill Workshop revision handoff from chat. Thanks @shakkernerd.
• PR #90123 fix(auto-reply): count message tool sends as delivery. Thanks @mcaxtr.
• PR #87965 fix(whatsapp): restart channel when a per-account config field changes so disabled accounts are torn down. Related #87951. Thanks @MukundaKatta and @mcaxtr and @borntobefree2-cmyk.
• PR #90145 fix: protect global agent config defaults [AI]. Thanks @pgondhi987.
• PR #90147 Rate limit node pairing requests [AI]. Thanks @pgondhi987.
• PR #89732 fix: guard MCP HTTP redirects [AI]. Thanks @pgondhi987.
• PR #90181 fix(feishu): preserve streaming card content. Related #90164. Thanks @mushuiyu886 and @sliverp and @wjm7220.
• PR #90058 fix(docker): qualify base image refs for podman short-name mode. Thanks @mrunalp and @sallyom.
• PR #89488 fix: stabilize Anthropic cache marker through tool loops. Thanks @Marvinthebored.
• PR #89505 fix(acp): re-add opt-in parent commentary progress. Related #89501. Thanks @100yenadmin.
• PR #90341 fix(acp): default parent commentary in progress mode. Thanks @obviyus.
• PR #90351 fix(message-tool): stabilize send idempotency keys. Thanks @jesse-merhi.
• PR #90375 refactor: remove Feishu runtime dedupe JSON fallback.
• PR #90385 refactor: move MS Teams state migration to doctor.
• PR #90287 fix(ci): scope PR merge diff checks to first parent. Thanks @hxy91819.
• PR #90436 Add NVIDIA Nemotron 3 Ultra default. Thanks @jacobtomlinson.
• PR #90205 fix: tolerate missing streamed response content type. Thanks @jalehman.
• PR #90163 fix(agents): strip stale compaction thinking signatures before Anthropic replay. Related #90108. Thanks @openperf and @dexiosmb.
• PR #90486 fix(whastapp): bound connection startup waits. Thanks @mcaxtr and @MMMMSSSS8899.
• PR #90488 fix service env placeholder collection. Thanks @sallyom.
• PR #90478 feat: install GitHub-backed ClawHub skills. Thanks @Patrick-Erichsen.
• PR #90304 feat(memory): support qmd query rerank toggle. Related #61834. Thanks @osolmaz and @kouka-t0yohei.
• PR #90532 Fix main CI guard drift. Thanks @RomneyDa.
• PR #90534 fix(mattermost): anchor slash state on globalThis (#68113). Thanks @Takhoffman and @ly85206559 and @infoanton.
• PR #89502 feat(googlechat): add native approval cards. Thanks @kevinslin.
• PR #90317 Add Codex multi-agent config migration coverage. Thanks @ooiuuii.
• PR #90319 Add Codex session route migration coverage. Thanks @ooiuuii.
• PR #90132 fix(qqbot): sanitize outbound text to strip reasoning/thinking content. Related #89913. Thanks @openperf and @Takhoffman and @dygg2001.
• PR #89874 fix(agents): detect unsigned thinking-only stall when reasoning payload inflates payloadCount. Related #89787. Thanks @openperf and @Takhoffman and @ArthurusDent.
• PR #90594 fix(android): align provider readiness with available models. Thanks @Tosko4.
• PR #90576 fix(sessions): reconcile stale terminal main transcripts. Related #60542. Thanks @ferminquant and @kAIborg24.
• PR #90405 Fix ClickClack toolsAllow reply dispatch. Thanks @mmaps.
• PR #90415 feat(matrix): handle voice preflight and threads. Related #78016. Thanks @frankdierolf.
• PR #90208 fix(cron): auto-migrate legacy cron store. Related #90072. Thanks @MonkeyLeeT and @jalehman and @wlassalle724.
• PR #85791 fix(gateway): dedupe probe warnings by gateway identity. Thanks @giodl73-repo.
• PR #90632 fix(context-engine): forward isHeartbeat to afterTurn (fixes #89302). Thanks @zenglingbiao and @jalehman and @huangxun375-stack.
• PR #90250 docs: prefer web_fetch in weather skill. Thanks @fuller-stack-dev.
• PR #85158 feat(parallel): add Parallel as a bundled web_search provider. Thanks @NormallyGaussian.
• PR #86205 fix(tui): stabilize optimistic user messages across history reloads, runId reassignment, and abort. Thanks @RomneyDa.
• PR #86483 chore(deps): bump the swift-deps group across 1 directory with 3 updates.
• PR #90601 chore(deps): bump the actions group across 1 directory with 4 updates.
• PR #81757 chore(deps): bump github.com/apple/swift-testing from 6.3.1 to 6.3.2 in /apps/swabble in the swift-deps group across 1 directory.
• PR #86481 chore(deps): bump the android-deps group across 1 directory with 9 updates.
• PR #74980 build(deps): bump docker/login-action from 3.6.0 to 4.1.0.
• PR #90717 fix(agents): re-probe single-provider primary during cooldown. Related #90702. Thanks @849261680 and @brtkwr.
• PR #90609 fix(google): preserve Vertex ADC catalog auth. Related #90506. Thanks @849261680 and @paulogogs.
• PR #90775 fix: refresh prompt fence after compaction writes. Related #90729. Thanks @jalehman and @johnib.
• PR #90027 test(codex): pin completion-idle timeout thread reset. Thanks @harjothkhara.
• PR #89566 fix(telegram): suppress post-final tool error noise. Thanks @keshavbotagent.
• PR #90607 fix(voice-call): track Twilio streams after connect. Related #81122. Thanks @sahibzada-allahyar and @Takhoffman and @donkeykong91.
• PR #90728 fix(agents): coerce non-text/image MCP tool-result blocks to text (fixes #90710). Thanks @849261680 and @Takhoffman and @RanSHammer.
• PR #90697 fix(llm): defer Anthropic stream start event until after message_start. Related #90667. Thanks @openperf and @Takhoffman and @MIHHHMIH.
• PR #90816 fix(memory): resolve adapter default model in plain status identity check. Related #90413. Thanks @849261680 and @Takhoffman and @colinmac-boop.
• PR #90815 fix #90668: [Bug]: macOS node mode can silently self-reconnect in a healthy direct gateway session. Thanks @Takhoffman and @zhangguiping-xydt and @vrurg.
• PR #90793 Fix OpenAI audio auth to use API keys. Thanks @Glucksberg and @sallyom.
• PR #90790 fix(codex): preserve completed replies after client close. Related #90771. Thanks @brokemac79 and @jalehman.
• PR #90820 fix(codex): report completion timeout diagnostics. Thanks @kevinslin.
• PR #90845 fix(imessage): frame rpc stdout on LF only. Related #89830. Thanks @omarshahine and @mmartoccia.
• PR #90813 fix(uninstall): refuse to remove current working directory during cleanup. Related #90806. Thanks @xydigit-sj and @sallyom and @brandondube.
• PR #90336 fix(memory): fail fast when embeddings provider is unavailable. Related #89691. Thanks @osolmaz and @joeykrug.
• PR #90914 fix(talk): resolve realtime provider secret refs. Thanks @ngutman.
• PR #88771 fix(agents): stream phased text deltas incrementally. Thanks @vincentkoc.
• PR #87856 fix(agents): count streamed model deltas incrementally. Thanks @vincentkoc.
• PR #88882 test(gateway): add small model live profile. Thanks @vincentkoc.
• PR #90919 [codex] Add iOS Apple Review demo mode. Thanks @ngutman.
• PR #90954 fix(cron): require HTTP context for server_error retry classification. Related #90947. Thanks @Nas01010101.
• PR #90854 fix(build): copy export-html assets to dist/export-html matching runtime path (fixes #90843). Thanks @zenglingbiao and @Tank-x3.
• PR #90922 docs: improve plugin inventory layout. Thanks @joshp123.
• PR #89652 fix(plugins): load owning plugin for configured memory embedding provider at startup. Related #89651. Thanks @joeykrug.
• PR #90811 fix(agents): stabilize user-turn serialization across turns to preserve prompt cache. Related #90810. Thanks @Marvinthebored and @jalehman.
• PR #90853 fix(imessage): send TTS audio as voice messages. Thanks @omarshahine.
• PR #90995 fix(release): use monthly patch versions. Thanks @vincentkoc.
• PR #91030 fix: store device-pair notify state in sqlite.
• PR #91034 fix: store acpx process state in sqlite.
• PR #90849 feat(parallel): add free Parallel Search MCP as the zero-config default web_search provider. Thanks @NormallyGaussian.
• PR #91056 fix: store memory-core dreams state in sqlite.
• PR #89918 fix(vertex): route eu/us multi-region to .rep.googleapis.com host. Related #89891. Thanks @alkor2000 and @Wimcomander.
• PR #91058 fix(gemini): accept empty grounding metadata. Related #88528. Thanks @TarsTriggerBot.
• PR #91072 refactor(memory-wiki): store source sync state in sqlite.
• PR #91073 fix(openrouter): reconcile streamed generation cost. Related #68066. Thanks @chrispatil.
• PR #91032 docs(imessage): require DisableLibraryValidation on modern macOS; document macOS 26 injection gates. Thanks @omarshahine.
• PR #87933 fix(agents): suppress DeepSeek thinking for Foundry aliases. Related #90520. Thanks @MukundaKatta and @wlassalle724.
• PR #91037 fix(config): allow thinkingLevelMap in persisted model schema. Related #91011. Thanks @wsyjh8 and @chrisreddington.
• PR #89832 fix(config): allow requiresReasoningContentOnAssistantMessages in ModelCompatSchema. Related #89660. Thanks @KrasimirKralev and @kyKKK.
• PR #91088 refactor(matrix): store sync cache in sqlite.
• PR #90138 fix(minimax): exempt M3 from thinking-disabled wrapper. Thanks @IamVNIE.
• PR #91053 refactor: store Zalo hosted media in plugin state.
• PR #91098 fix(test): type overflow resolver mock. Thanks @RomneyDa.
• PR #81277 fix(google): handle compressed Vertex ADC token refresh responses. Thanks @liaoandi.
• PR #91100 refactor(matrix): store crypto sidecars in sqlite.
• PR #90260 fix(agents): decode xai and venice tool-call arguments exactly once. Thanks @yetval.
• PR #90593 fix: preserve LM Studio Responses tool arguments. Related #90585. Thanks @849261680 and @ceo-nada.
• PR #89109 fix(agents): block message-tool spam loops defeated by volatile message ids. Related #89090. Thanks @openperf and @wujiaming88.
• PR #90429 Fix LM Studio wizard prompter binding. Thanks @christineyan4.
• PR #90780 perf(qqbot): narrow tool discovery cold load. Thanks @RomneyDa.
• PR #90504 fix(codex): preserve post-tool reasoning liveness. Thanks @fuller-stack-dev.
• PR #91113 fix: align Xiaomi completions replay compat. Related #91106. Thanks @KrasimirKralev.
• PR #91108 refactor(memory-wiki): store import runs in sqlite.
• PR #91118 fix: preserve Foundry Responses reasoning replay ids. Related #91033. Thanks @chrisreddington.
• PR #91125 fix: strip Google provider prefix from Gemini paths. Related #71932. Thanks @soumoucookie.
• PR #90056 fix(doctor): merge disjoint openai-codex model entries into canonical openai provider. Related #90047. Thanks @openperf and @holgergruenhagen.
• PR #91127 refactor: store sandbox registry in sqlite.
• PR #91131 fix: migrate legacy agent registry schema via doctor.
• PR #91119 fix(outbound): keep Discord runtime adapters resolvable. Related #90162. Thanks @TurboTheTurtle and @thewilloftheshadow and @hoyanhan.
• PR #91128 fix(qqbot): migrate group tool policy config.
• PR #91133 refactor(plugin-sdk): persist dedupe state in sqlite.
• PR #90612 fix(agents): dispatch subagent spawn in process. Thanks @lanzhi-lee.
• PR #87323 fix(infra/agents): session-routing guard for coalesced gateway restart continuations (#86742). Thanks @openperf and @songshikang0111.
• PR #91101 fix(inbound-meta): apply head+tail body truncation to ReplyChain and ReplyToBody JSON paths (fixes #91042). Thanks @zenglingbiao and @wangwllu.
• PR #91201 feat(ios): clarify talk realtime fallback. Thanks @ngutman.
• PR #91233 fix(agents): prevent ReDoS in background-session name derivation. Thanks @Takhoffman and @yetval.
• PR #90798 fix(agents): materialize sandbox skills for rw sandboxes. Related #90410. Thanks @brokemac79 and @gbb-netizen.
• PR #91248 fix: preserve live Ollama catalog metadata. Related #90315. Thanks @civiltox.
• PR #91041 fix(imessage): self-explaining private-API failures and dedicated send timeout. Thanks @omarshahine.
• PR #90029 feat: add live provider model catalog helper. Thanks @fuller-stack-dev.
• PR #90752 feat(android): add theme mode selection. Thanks @Tosko4 and @joshavant.
• PR #90261 fix: gate owner-only HTTP tools. Thanks @pgondhi987 and @joshavant.
• PR #90022 fix(codex): quarantine unreadable dynamic tools. Thanks @vincentkoc.
• PR #88822 fix(agents): compact lean local tool catalogs. Thanks @vincentkoc.
• PR #89350 fix(agents): guard prompt cache tool names. Thanks @vincentkoc.
• PR #91241 fix(outbound): preserve retries for budget-deferred deliveries. Thanks @849261680 and @Takhoffman.
• PR #91124 fix(agents): do not refresh lastUsedAt on MCP lease release. Related #91075. Thanks @openperf and @Takhoffman and @Atlas-crete.
• PR #90858 fix(imessage): gate split-send coalescing on imsg metadata. Thanks @omarshahine.
• PR #91235 fix(codex): preserve native subagent completion results. Related #91120. Thanks @849261680 and @Takhoffman and @jinon86.
• PR #91230 fix(cron): preserve isolated agent turn payload message. Related #91228. Thanks @849261680 and @Takhoffman and @AgentXaGent.
• PR #90480 feat(whatsapp): expand live QA coverage. Thanks @mcaxtr.
• PR #89712 feat(cron): support command jobs. Thanks @mbelinky.
• PR #90937 fix(gateway): preserve stale channel restart diagnostics. Related #90901. Thanks @snowzlm and @Takhoffman and @Tony-ooo.
• PR #91231 fix(anthropic): drop reasoning_content replay signatures. Related #91205. Thanks @849261680 and @Takhoffman and @bobgitmcgrath.
• PR #90897 fix #90452: Regression: Heartbeat exec completion still shows generic fallback text instead of actual output. Thanks @mushuiyu886 and @Takhoffman and @bizzle12368239.
• PR #91322 refactor: move session metadata to SQLite.
• PR #91529 Fix transcript image redaction. Related #90760. Thanks @joshavant and @devinkuhn.
• PR #91551 Fix config.patch explicit array replacement. Thanks @joshavant.
• PR #85823 fix(whatsapp): route captured replies through successor controller after restart. Thanks @itsuzef and @mcaxtr.
• PR #89659 fix(feishu): retry on send rate-limit errors (230020/230006). Related #70879. Thanks @ladygege and @marshallm-create and @sliverp and @AxelHu.
• PR #91547 Fix Docker store seed target packages. Related #91035. Thanks @sallyom and @laurenceputra.
• PR #91423 feat(qqbot): add /bot-group-allways command to toggle mention requirement. Thanks @cxyhhhhh.

Release verification

• npm package: https://www.npmjs.com/package/openclaw/v/2026.6.5-beta.6
• registry tarball: https://registry.npmjs.org/openclaw/-/openclaw-2026.6.5-beta.6.tgz
• integrity: sha512-jwz9IP/LbR6qgS5SUTpgeBArNf2eIM+8jc7LCEMAMQznsznjml/7IrsxBn2S89XieEX6BEhGVtjspOOJt0jVXg==
• full release CI report: https://github.com/openclaw/releases/blob/main/evidence/2026.6.5-beta.6/release-evidence.md
• release publish: https://github.com/openclaw/openclaw/actions/runs/27193326577
• npm preflight: https://github.com/openclaw/openclaw/actions/runs/27191457144
• full release validation: https://github.com/openclaw/openclaw/actions/runs/27191453479
• plugin npm publish: https://github.com/openclaw/openclaw/actions/runs/27193511392
• plugin ClawHub publish: dispatched separately, not awaited by this proof: https://github.com/openclaw/openclaw/actions/runs/27193515101
• OpenClaw npm publish: https://github.com/openclaw/openclaw/actions/runs/27193906215
• npm Telegram beta E2E: not supplied

2026.6.5

Highlights

• Safer channel output: QQBot strips model reasoning and thinking scaffolding before native delivery, so users see the final answer rather than raw internal markup. (#89913, #90132) Thanks @openperf, @dygg2001, @Takhoffman, and @vincentkoc.
• MCP results no longer poison sessions: resource_link, audio, malformed images, and future non-text blocks are normalized before provider conversion, avoiding Anthropic 400s and broken follow-up history. (#90710, #90728) Thanks @RanSHammer, @849261680, and @Takhoffman.
• Anthropic extended thinking recovers after restarts: prompt-cache expiry and early-signature failures wait for a real message start, so they reach the existing retry path rather than ending a turn. (#90667, #90697) Thanks @openperf, @MIHHHMIH, @Takhoffman, @vincentkoc, @itsuzef, and @mcaxtr.
• Parallel web search is bundled: API-key discovery, guarded endpoint handling, cache-safe session IDs, onboarding, and documentation make it a first-class search provider. (#85158) Thanks @NormallyGaussian.
• Better Matrix and Vertex reliability: Matrix voice notes and threaded conversations retain their context, while Google Vertex ADC models regain static catalog and runtime resolution. (#78016, #90415, #90506, #90609) Thanks @849261680, @frankdierolf, and @paulogogs.
• Safer upgrades and restarts: cron JSON stores migrate before runtime, service env placeholders stop masking secrets, and macOS avoids unnecessary direct-Gateway reconnect churn. (#90072, #90208, #90668, #90815) Thanks @MonkeyLeeT, @sallyom, @vrurg, @wlassalle724, @jalehman, @Takhoffman, @zhangguiping-xydt, @joshavant, and @vincentkoc.

Changes

• Search/providers: add the Parallel bundled web-search plugin, registration contracts, onboarding integration, and guarded api.parallel.ai/v1/search support. (#85158) Thanks @NormallyGaussian and @vincentkoc.
• Matrix/channels: add voice-message preflight and thread-aware read/reply behavior. (#78016, #90415) Thanks @frankdierolf.
• Skills/ClawHub: install ClawHub skills backed by GitHub repositories through the resolved install API, download the pinned GitHub commit, keep install-policy checks, and report install telemetry after success. (#90478) Thanks @Patrick-Erichsen, @vincentkoc, @itsuzef, and @mcaxtr.
• Google Chat/channels: add native approval card actions and click handling so Google Chat approvals use platform-native cards instead of generic message flow.
• Mobile: Android provider/model screens now surface expiring, unavailable, unresolved, and attention states more clearly, while iOS settings and Talk tabs keep diagnostics, gateway rows, attachment labels, and unavailable Talk controls reachable. Thanks @joshavant and @shakkernerd.
• Memory: QMD search can use the new rerank toggle, and memory adapter status uses the resolved default model identity when checking plain status. (#61834) Thanks @kouka-t0yohei and @vincentkoc.
• QQBot: add /bot-group-allways on|off slash command (with named-account and default-account support) to toggle whether group messages require an @mention before the bot replies, and clear the runtime config snapshot after the write so the new account-level defaultRequireMention takes effect immediately without restart. (#91423) Thanks @cxyhhhhh, @joshavant, @vincentkoc, @itsuzef, @mcaxtr, and @jacobtomlinson.

Fixes

• Agents: sessions_send now honors an explicit sessionKey when stale label metadata is also present, and denied session-id sends no longer echo the resolved canonical session key. Fixes #64699; refs #74009 and #41199 Thanks @Mintalix, @RevisitMoon, @Mocha-s, @chouxiaozi1989, @sunxq1017-hash, @vincentkoc, and @joshavant.
• Channel content boundaries: QQBot now strips reasoning/thinking tags before sending, preserving final answers while hiding internal model narration from users. (#89913, #90132) Thanks @openperf, @Takhoffman, @dygg2001, and @vincentkoc.
• Agents/MCP/providers: coerce non-text/image MCP tool-result blocks before they reach provider converters, preserving valid images and turning richer MCP content into text instead of malformed image blocks. (#90710, #90728) Thanks @RanSHammer, @849261680, @Takhoffman, @vincentkoc, and @LiuwqGit.
• Anthropic/Codex/ACP/agent recovery: defer Anthropic stream start events until message_start, strip stale compaction thinking signatures before Anthropic replay, detect unsigned thinking-only stalls, refresh prompt fences after compaction writes, reject empty completion handoffs, preserve parent streaming-off overrides/shared progress commentary, forward heartbeat metadata to context-engine hooks, and cover Codex session/thread migration edge cases. (#90667, #90697, #90163, #90108, #89874, #89505, #90632, #89302, #90729, #90317, #90319) Thanks @openperf, @100yenadmin, @ooiuuii, @johnib, @Takhoffman, @MIHHHMIH, @dexiosmb, @zenglingbiao, @jalehman, @huangxun375-stack, @holgergruenhagen, @vincentkoc, @joshavant, and @ArthurusDent.
• Provider/model resolution: preserve Google Vertex ADC auth markers in generated catalogs, re-probe a single-provider primary after cooldown, share Codex model visibility, fail closed for unknown model auth, preserve Codex alias availability, keep unresolved profile refs unknown, and avoid resolving auth while listing models. (#90506, #90609, #90717, #90702) Thanks @849261680, @paulogogs, @brtkwr, and @vincentkoc.
• Gateway/macOS/mobile: avoid duplicate Gateway probe warnings by identity, rate-limit node pairing requests while preserving paired-node reconnects, keep macOS node mode on a healthy direct Gateway session, keep iOS diagnostics and gateway rows reachable, and avoid Linux ARM Gradle resource tasks during Android builds. (#85791, #90147, #90668, #90815) Thanks @giodl73-repo, @vrurg, @pgondhi987, @Takhoffman, @zhangguiping-xydt, @vincentkoc, @joshavant, and @shakkernerd.
• TUI/chat/Workboard/auto-reply: optimistic user messages stay stable across stale history reloads, runId reassignment, and abort windows instead of disappearing, jumping, or lingering as ghost rows; Workboard stale lifecycle bulk updates no longer overwrite newer status/provenance; message-tool sends now count as delivery. (#86205, #89600, #88592, #90123) Thanks @RomneyDa, @BunsDev, @kzclaw, @mcaxtr, @vincentkoc, @joshavant, and @LiuwqGit.
• Cron/update/service env: doctor config preflight now migrates legacy cron JSON stores into SQLite before runtime reads, service env planning skips unresolved placeholders that would mask state-dir .env values, and session transcript rewrites keep registry markers/discriminants consistent. (#90072, #90208, #90277, #90488) Thanks @MonkeyLeeT, @sallyom, @Kvikkulf, @jalehman, @wlassalle724, @shakkernerd, and @vincentkoc.
• Security/config/tooling: guard MCP HTTP redirects, protect global agent config defaults, and keep malformed operational limits bounded and explicit. (#89732, #90145) Thanks @pgondhi987, @vincentkoc, and @joshavant.
• Channels: WhatsApp restarts when per-account config changes, bounds background startup waits, closes failed sockets, and preserves reconnect behavior; Mattermost slash commands keep their state on globalThis; Feishu streaming cards preserve full merged content; voice-call tracks Twilio streams after connect; ClickClack reply tools respect toolsAllow. (#87951, #87965, #90486, #68113, #90534, #90181, #90607, #89500) Thanks @MukundaKatta, @mcaxtr, @infoanton, @mushuiyu886, @sahibzada-allahyar, @borntobefree2-cmyk, @Takhoffman, @mmaps, @MMMMSSSS8899, @ly85206559, @sliverp, @vincentkoc, @joshavant, @LiuwqGit, @itsuzef, @wjm7220, and @donkeykong91.
• Feishu: retry transient send rate-limit errors (HTTP 429, per-chat code 230020, tenant-level code 11232) with linear backoff, including SDK responses that fulfill with rate-limit bodies instead of throwing, and route streaming-card sends through the retry wrapper. (#89659) Thanks @ladygege, @AxelHu, @marshallm-create, @sliverp, @joshavant, @vincentkoc, @itsuzef, and @mcaxtr.
• Memory: keep doctor REM harness previews aligned with live REM by dropping short-term recall snippets whose source files disappeared before rendering preview output. Thanks @samzong, @frankekn, and @vincentkoc.

Complete contribution record

This audited record covers the complete v2026.6.2-beta.1..v2026.6.5 history: 142 merged PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact.

Pull requests

• PR #89102 refactor(auth): store auth profiles in SQLite.
• PR #90028 docs: clarify legacy openai-codex auth. Thanks @jalehman.
• PR #89600 Fix Workboard status persistence. Related #88592. Thanks @BunsDev and @kzclaw.
• PR #90067 fix(workboard): isolate stale lifecycle bulk patches. Thanks @BunsDev.
• PR #88585 Pin official npm plugin install records. Thanks @zhuisDEV.
• PR #90053 fix: hide Skill Workshop revision handoff from chat. Thanks @shakkernerd.
• PR #90123 fix(auto-reply): count message tool sends as delivery. Thanks @mcaxtr.
• PR #87965 fix(whatsapp): restart channel when a per-account config field changes so disabled accounts are torn down. Related #87951. Thanks @MukundaKatta and @mcaxtr and @borntobefree2-cmyk.
• PR #90145 fix: protect global agent config defaults [AI]. Thanks @pgondhi987.
• PR #90147 Rate limit node pairing requests [AI]. Thanks @pgondhi987.
• PR #89732 fix: guard MCP HTTP redirects [AI]. Thanks @pgondhi987.
• PR #90181 fix(feishu): preserve streaming card content. Related #90164. Thanks @mushuiyu886 and @sliverp and @wjm7220.
• PR #90058 fix(docker): qualify base image refs for podman short-name mode. Thanks @mrunalp and @sallyom.
• PR #89488 fix: stabilize Anthropic cache marker through tool loops. Thanks @Marvinthebored.
• PR #89505 fix(acp): re-add opt-in parent commentary progress. Related #89501. Thanks @100yenadmin.
• PR #90341 fix(acp): default parent commentary in progress mode. Thanks @obviyus.
• PR #90351 fix(message-tool): stabilize send idempotency keys. Thanks @jesse-merhi.
• PR #90375 refactor: remove Feishu runtime dedupe JSON fallback.
• PR #90385 refactor: move MS Teams state migration to doctor.
• PR #90287 fix(ci): scope PR merge diff checks to first parent. Thanks @hxy91819.
• PR #90436 Add NVIDIA Nemotron 3 Ultra default. Thanks @jacobtomlinson.
• PR #90205 fix: tolerate missing streamed response content type. Thanks @jalehman.
• PR #90163 fix(agents): strip stale compaction thinking signatures before Anthropic replay. Related #90108. Thanks @openperf and @dexiosmb.
• PR #90486 fix(whastapp): bound connection startup waits. Thanks @mcaxtr and @MMMMSSSS8899.
• PR #90488 fix service env placeholder collection. Thanks @sallyom.
• PR #90478 feat: install GitHub-backed ClawHub skills. Thanks @Patrick-Erichsen.
• PR #90304 feat(memory): support qmd query rerank toggle. Related #61834. Thanks @osolmaz and @kouka-t0yohei.
• PR #90532 Fix main CI guard drift. Thanks @RomneyDa.
• PR #90534 fix(mattermost): anchor slash state on globalThis (#68113). Thanks @Takhoffman and @ly85206559 and @infoanton.
• PR #89502 feat(googlechat): add native approval cards. Thanks @kevinslin.
• PR #90317 Add Codex multi-agent config migration coverage. Thanks @ooiuuii.
• PR #90319 Add Codex session route migration coverage. Thanks @ooiuuii.
• PR #90132 fix(qqbot): sanitize outbound text to strip reasoning/thinking content. Related #89913. Thanks @openperf and @Takhoffman and @dygg2001.
• PR #89874 fix(agents): detect unsigned thinking-only stall when reasoning payload inflates payloadCount. Related #89787. Thanks @openperf and @Takhoffman and @ArthurusDent.
• PR #90594 fix(android): align provider readiness with available models. Thanks @Tosko4.
• PR #90576 fix(sessions): reconcile stale terminal main transcripts. Related #60542. Thanks @ferminquant and @kAIborg24.
• PR #90405 Fix ClickClack toolsAllow reply dispatch. Thanks @mmaps.
• PR #90415 feat(matrix): handle voice preflight and threads. Related #78016. Thanks @frankdierolf.
• PR #90208 fix(cron): auto-migrate legacy cron store. Related #90072. Thanks @MonkeyLeeT and @jalehman and @wlassalle724.
• PR #85791 fix(gateway): dedupe probe warnings by gateway identity. Thanks @giodl73-repo.
• PR #90632 fix(context-engine): forward isHeartbeat to afterTurn (fixes #89302). Thanks @zenglingbiao and @jalehman and @huangxun375-stack.
• PR #90250 docs: prefer web_fetch in weather skill. Thanks @fuller-stack-dev.
• PR #85158 feat(parallel): add Parallel as a bundled web_search provider. Thanks @NormallyGaussian.
• PR #86205 fix(tui): stabilize optimistic user messages across history reloads, runId reassignment, and abort. Thanks @RomneyDa.
• PR #86483 chore(deps): bump the swift-deps group across 1 directory with 3 updates.
• PR #90601 chore(deps): bump the actions group across 1 directory with 4 updates.
• PR #81757 chore(deps): bump github.com/apple/swift-testing from 6.3.1 to 6.3.2 in /apps/swabble in the swift-deps group across 1 directory.
• PR #86481 chore(deps): bump the android-deps group across 1 directory with 9 updates.
• PR #74980 build(deps): bump docker/login-action from 3.6.0 to 4.1.0.
• PR #90717 fix(agents): re-probe single-provider primary during cooldown. Related #90702. Thanks @849261680 and @brtkwr.
• PR #90609 fix(google): preserve Vertex ADC catalog auth. Related #90506. Thanks @849261680 and @paulogogs.
• PR #90775 fix: refresh prompt fence after compaction writes. Related #90729. Thanks @jalehman and @johnib.
• PR #90027 test(codex): pin completion-idle timeout thread reset. Thanks @harjothkhara.
• PR #89566 fix(telegram): suppress post-final tool error noise. Thanks @keshavbotagent.
• PR #90607 fix(voice-call): track Twilio streams after connect. Related #81122. Thanks @sahibzada-allahyar and @Takhoffman and @donkeykong91.
• PR #90728 fix(agents): coerce non-text/image MCP tool-result blocks to text (fixes #90710). Thanks @849261680 and @Takhoffman and @RanSHammer.
• PR #90697 fix(llm): defer Anthropic stream start event until after message_start. Related #90667. Thanks @openperf and @Takhoffman and @MIHHHMIH.
• PR #90816 fix(memory): resolve adapter default model in plain status identity check. Related #90413. Thanks @849261680 and @Takhoffman and @colinmac-boop.
• PR #90815 fix #90668: [Bug]: macOS node mode can silently self-reconnect in a healthy direct gateway session. Thanks @Takhoffman and @zhangguiping-xydt and @vrurg.
• PR #90793 Fix OpenAI audio auth to use API keys. Thanks @Glucksberg and @sallyom.
• PR #90790 fix(codex): preserve completed replies after client close. Related #90771. Thanks @brokemac79 and @jalehman.
• PR #90820 fix(codex): report completion timeout diagnostics. Thanks @kevinslin.
• PR #90845 fix(imessage): frame rpc stdout on LF only. Related #89830. Thanks @omarshahine and @mmartoccia.
• PR #90813 fix(uninstall): refuse to remove current working directory during cleanup. Related #90806. Thanks @xydigit-sj and @sallyom and @brandondube.
• PR #90336 fix(memory): fail fast when embeddings provider is unavailable. Related #89691. Thanks @osolmaz and @joeykrug.
• PR #90914 fix(talk): resolve realtime provider secret refs. Thanks @ngutman.
• PR #88771 fix(agents): stream phased text deltas incrementally. Thanks @vincentkoc.
• PR #87856 fix(agents): count streamed model deltas incrementally. Thanks @vincentkoc.
• PR #88882 test(gateway): add small model live profile. Thanks @vincentkoc.
• PR #90919 [codex] Add iOS Apple Review demo mode. Thanks @ngutman.
• PR #90954 fix(cron): require HTTP context for server_error retry classification. Related #90947. Thanks @Nas01010101.
• PR #90854 fix(build): copy export-html assets to dist/export-html matching runtime path (fixes #90843). Thanks @zenglingbiao and @Tank-x3.
• PR #90922 docs: improve plugin inventory layout. Thanks @joshp123.
• PR #89652 fix(plugins): load owning plugin for configured memory embedding provider at startup. Related #89651. Thanks @joeykrug.
• PR #90811 fix(agents): stabilize user-turn serialization across turns to preserve prompt cache. Related #90810. Thanks @Marvinthebored and @jalehman.
• PR #90853 fix(imessage): send TTS audio as voice messages. Thanks @omarshahine.
• PR #90995 fix(release): use monthly patch versions. Thanks @vincentkoc.
• PR #91030 fix: store device-pair notify state in sqlite.
• PR #91034 fix: store acpx process state in sqlite.
• PR #90849 feat(parallel): add free Parallel Search MCP as the zero-config default web_search provider. Thanks @NormallyGaussian.
• PR #91056 fix: store memory-core dreams state in sqlite.
• PR #89918 fix(vertex): route eu/us multi-region to .rep.googleapis.com host. Related #89891. Thanks @alkor2000 and @Wimcomander.
• PR #91058 fix(gemini): accept empty grounding metadata. Related #88528. Thanks @TarsTriggerBot.
• PR #91072 refactor(memory-wiki): store source sync state in sqlite.
• PR #91073 fix(openrouter): reconcile streamed generation cost. Related #68066. Thanks @chrispatil.
• PR #91032 docs(imessage): require DisableLibraryValidation on modern macOS; document macOS 26 injection gates. Thanks @omarshahine.
• PR #87933 fix(agents): suppress DeepSeek thinking for Foundry aliases. Related #90520. Thanks @MukundaKatta and @wlassalle724.
• PR #91037 fix(config): allow thinkingLevelMap in persisted model schema. Related #91011. Thanks @wsyjh8 and @chrisreddington.
• PR #89832 fix(config): allow requiresReasoningContentOnAssistantMessages in ModelCompatSchema. Related #89660. Thanks @KrasimirKralev and @kyKKK.
• PR #91088 refactor(matrix): store sync cache in sqlite.
• PR #90138 fix(minimax): exempt M3 from thinking-disabled wrapper. Thanks @IamVNIE.
• PR #91053 refactor: store Zalo hosted media in plugin state.
• PR #91098 fix(test): type overflow resolver mock. Thanks @RomneyDa.
• PR #81277 fix(google): handle compressed Vertex ADC token refresh responses. Thanks @liaoandi.
• PR #91100 refactor(matrix): store crypto sidecars in sqlite.
• PR #90260 fix(agents): decode xai and venice tool-call arguments exactly once. Thanks @yetval.
• PR #90593 fix: preserve LM Studio Responses tool arguments. Related #90585. Thanks @849261680 and @ceo-nada.
• PR #89109 fix(agents): block message-tool spam loops defeated by volatile message ids. Related #89090. Thanks @openperf and @wujiaming88.
• PR #90429 Fix LM Studio wizard prompter binding. Thanks @christineyan4.
• PR #90780 perf(qqbot): narrow tool discovery cold load. Thanks @RomneyDa.
• PR #90504 fix(codex): preserve post-tool reasoning liveness. Thanks @fuller-stack-dev.
• PR #91113 fix: align Xiaomi completions replay compat. Related #91106. Thanks @KrasimirKralev.
• PR #91108 refactor(memory-wiki): store import runs in sqlite.
• PR #91118 fix: preserve Foundry Responses reasoning replay ids. Related #91033. Thanks @chrisreddington.
• PR #91125 fix: strip Google provider prefix from Gemini paths. Related #71932. Thanks @soumoucookie.
• PR #90056 fix(doctor): merge disjoint openai-codex model entries into canonical openai provider. Related #90047. Thanks @openperf and @holgergruenhagen.
• PR #91127 refactor: store sandbox registry in sqlite.
• PR #91131 fix: migrate legacy agent registry schema via doctor.
• PR #91119 fix(outbound): keep Discord runtime adapters resolvable. Related #90162. Thanks @TurboTheTurtle and @thewilloftheshadow and @hoyanhan.
• PR #91128 fix(qqbot): migrate group tool policy config.
• PR #91133 refactor(plugin-sdk): persist dedupe state in sqlite.
• PR #90612 fix(agents): dispatch subagent spawn in process. Thanks @lanzhi-lee.
• PR #87323 fix(infra/agents): session-routing guard for coalesced gateway restart continuations (#86742). Thanks @openperf and @songshikang0111.
• PR #91101 fix(inbound-meta): apply head+tail body truncation to ReplyChain and ReplyToBody JSON paths (fixes #91042). Thanks @zenglingbiao and @wangwllu.
• PR #91201 feat(ios): clarify talk realtime fallback. Thanks @ngutman.
• PR #91233 fix(agents): prevent ReDoS in background-session name derivation. Thanks @Takhoffman and @yetval.
• PR #90798 fix(agents): materialize sandbox skills for rw sandboxes. Related #90410. Thanks @brokemac79 and @gbb-netizen.
• PR #91248 fix: preserve live Ollama catalog metadata. Related #90315. Thanks @civiltox.
• PR #91041 fix(imessage): self-explaining private-API failures and dedicated send timeout. Thanks @omarshahine.
• PR #90029 feat: add live provider model catalog helper. Thanks @fuller-stack-dev.
• PR #90752 feat(android): add theme mode selection. Thanks @Tosko4 and @joshavant.
• PR #90261 fix: gate owner-only HTTP tools. Thanks @pgondhi987 and @joshavant.
• PR #90022 fix(codex): quarantine unreadable dynamic tools. Thanks @vincentkoc.
• PR #88822 fix(agents): compact lean local tool catalogs. Thanks @vincentkoc.
• PR #89350 fix(agents): guard prompt cache tool names. Thanks @vincentkoc.
• PR #91241 fix(outbound): preserve retries for budget-deferred deliveries. Thanks @849261680 and @Takhoffman.
• PR #91124 fix(agents): do not refresh lastUsedAt on MCP lease release. Related #91075. Thanks @openperf and @Takhoffman and @Atlas-crete.
• PR #90858 fix(imessage): gate split-send coalescing on imsg metadata. Thanks @omarshahine.
• PR #91235 fix(codex): preserve native subagent completion results. Related #91120. Thanks @849261680 and @Takhoffman and @jinon86.
• PR #91230 fix(cron): preserve isolated agent turn payload message. Related #91228. Thanks @849261680 and @Takhoffman and @AgentXaGent.
• PR #90480 feat(whatsapp): expand live QA coverage. Thanks @mcaxtr.
• PR #89712 feat(cron): support command jobs. Thanks @mbelinky.
• PR #90937 fix(gateway): preserve stale channel restart diagnostics. Related #90901. Thanks @snowzlm and @Takhoffman and @Tony-ooo.
• PR #91231 fix(anthropic): drop reasoning_content replay signatures. Related #91205. Thanks @849261680 and @Takhoffman and @bobgitmcgrath.
• PR #90897 fix #90452: Regression: Heartbeat exec completion still shows generic fallback text instead of actual output. Thanks @mushuiyu886 and @Takhoffman and @bizzle12368239.
• PR #91322 refactor: move session metadata to SQLite.
• PR #91529 Fix transcript image redaction. Related #90760. Thanks @joshavant and @devinkuhn.
• PR #91551 Fix config.patch explicit array replacement. Thanks @joshavant.
• PR #85823 fix(whatsapp): route captured replies through successor controller after restart. Thanks @itsuzef and @mcaxtr.
• PR #89659 fix(feishu): retry on send rate-limit errors (230020/230006). Related #70879. Thanks @ladygege and @marshallm-create and @sliverp and @AxelHu.
• PR #91547 Fix Docker store seed target packages. Related #91035. Thanks @sallyom and @laurenceputra.
• PR #91423 feat(qqbot): add /bot-group-allways command to toggle mention requirement. Thanks @cxyhhhhh.

Release verification

• npm package: https://www.npmjs.com/package/openclaw/v/2026.6.5-beta.5
• registry tarball: https://registry.npmjs.org/openclaw/-/openclaw-2026.6.5-beta.5.tgz
• integrity: sha512-xyh5/CLaxdm9Zh2VBnmS2wxYR6kcqIrMFXNTWklJbVHSmmkLy7HRH6Rnw0cm4pRUXOvh3WQUDJgOqQOjjxG6PQ==
• full release CI report: https://github.com/openclaw/releases/blob/main/evidence/2026.6.5-beta.5/release-evidence.md
• release publish: https://github.com/openclaw/openclaw/actions/runs/27171268701
• npm preflight: https://github.com/openclaw/openclaw/actions/runs/27169704715
• full release validation: https://github.com/openclaw/openclaw/actions/runs/27169706642
• plugin npm publish: https://github.com/openclaw/openclaw/actions/runs/27171395546
• plugin ClawHub publish: https://github.com/openclaw/openclaw/actions/runs/27171399026
• OpenClaw npm publish: https://github.com/openclaw/openclaw/actions/runs/27171782461
• npm Telegram beta E2E: not supplied

2026.6.5

Highlights

• Safer channel output: QQBot strips model reasoning and thinking scaffolding before native delivery, so users see the final answer rather than raw internal markup. (#89913, #90132) Thanks @openperf, @dygg2001, @Takhoffman, and @vincentkoc.
• MCP results no longer poison sessions: resource_link, audio, malformed images, and future non-text blocks are normalized before provider conversion, avoiding Anthropic 400s and broken follow-up history. (#90710, #90728) Thanks @RanSHammer, @849261680, and @Takhoffman.
• Anthropic extended thinking recovers after restarts: prompt-cache expiry and early-signature failures wait for a real message start, so they reach the existing retry path rather than ending a turn. (#90667, #90697) Thanks @openperf, @MIHHHMIH, @Takhoffman, @vincentkoc, @itsuzef, and @mcaxtr.
• Parallel web search is bundled: API-key discovery, guarded endpoint handling, cache-safe session IDs, onboarding, and documentation make it a first-class search provider. (#85158) Thanks @NormallyGaussian.
• Better Matrix and Vertex reliability: Matrix voice notes and threaded conversations retain their context, while Google Vertex ADC models regain static catalog and runtime resolution. (#78016, #90415, #90506, #90609) Thanks @849261680, @frankdierolf, and @paulogogs.
• Safer upgrades and restarts: cron JSON stores migrate before runtime, service env placeholders stop masking secrets, and macOS avoids unnecessary direct-Gateway reconnect churn. (#90072, #90208, #90668, #90815) Thanks @MonkeyLeeT, @sallyom, @vrurg, @wlassalle724, @jalehman, @Takhoffman, @zhangguiping-xydt, @joshavant, and @vincentkoc.

Changes

• Search/providers: add the Parallel bundled web-search plugin, registration contracts, onboarding integration, and guarded api.parallel.ai/v1/search support. (#85158) Thanks @NormallyGaussian and @vincentkoc.
• Matrix/channels: add voice-message preflight and thread-aware read/reply behavior. (#78016, #90415) Thanks @frankdierolf.
• Skills/ClawHub: install ClawHub skills backed by GitHub repositories through the resolved install API, download the pinned GitHub commit, keep install-policy checks, and report install telemetry after success. (#90478) Thanks @Patrick-Erichsen, @vincentkoc, @itsuzef, and @mcaxtr.
• Google Chat/channels: add native approval card actions and click handling so Google Chat approvals use platform-native cards instead of generic message flow.
• Mobile: Android provider/model screens now surface expiring, unavailable, unresolved, and attention states more clearly, while iOS settings and Talk tabs keep diagnostics, gateway rows, attachment labels, and unavailable Talk controls reachable. Thanks @joshavant and @shakkernerd.
• Memory: QMD search can use the new rerank toggle, and memory adapter status uses the resolved default model identity when checking plain status. (#61834) Thanks @kouka-t0yohei and @vincentkoc.
• QQBot: add /bot-group-allways on|off slash command (with named-account and default-account support) to toggle whether group messages require an @mention before the bot replies, and clear the runtime config snapshot after the write so the new account-level defaultRequireMention takes effect immediately without restart. (#91423) Thanks @cxyhhhhh, @joshavant, @vincentkoc, @itsuzef, @mcaxtr, and @jacobtomlinson.

Fixes

• Agents: sessions_send now honors an explicit sessionKey when stale label metadata is also present, and denied session-id sends no longer echo the resolved canonical session key. Fixes #64699; refs #74009 and #41199 Thanks @Mintalix, @RevisitMoon, @Mocha-s, @chouxiaozi1989, @sunxq1017-hash, @vincentkoc, and @joshavant.
• Channel content boundaries: QQBot now strips reasoning/thinking tags before sending, preserving final answers while hiding internal model narration from users. (#89913, #90132) Thanks @openperf, @Takhoffman, @dygg2001, and @vincentkoc.
• Agents/MCP/providers: coerce non-text/image MCP tool-result blocks before they reach provider converters, preserving valid images and turning richer MCP content into text instead of malformed image blocks. (#90710, #90728) Thanks @RanSHammer, @849261680, @Takhoffman, @vincentkoc, and @LiuwqGit.
• Anthropic/Codex/ACP/agent recovery: defer Anthropic stream start events until message_start, strip stale compaction thinking signatures before Anthropic replay, detect unsigned thinking-only stalls, refresh prompt fences after compaction writes, reject empty completion handoffs, preserve parent streaming-off overrides/shared progress commentary, forward heartbeat metadata to context-engine hooks, and cover Codex session/thread migration edge cases. (#90667, #90697, #90163, #90108, #89874, #89505, #90632, #89302, #90729, #90317, #90319) Thanks @openperf, @100yenadmin, @ooiuuii, @johnib, @Takhoffman, @MIHHHMIH, @dexiosmb, @zenglingbiao, @jalehman, @huangxun375-stack, @holgergruenhagen, @vincentkoc, @joshavant, and @ArthurusDent.
• Provider/model resolution: preserve Google Vertex ADC auth markers in generated catalogs, re-probe a single-provider primary after cooldown, share Codex model visibility, fail closed for unknown model auth, preserve Codex alias availability, keep unresolved profile refs unknown, and avoid resolving auth while listing models. (#90506, #90609, #90717, #90702) Thanks @849261680, @paulogogs, @brtkwr, and @vincentkoc.
• Gateway/macOS/mobile: avoid duplicate Gateway probe warnings by identity, rate-limit node pairing requests while preserving paired-node reconnects, keep macOS node mode on a healthy direct Gateway session, keep iOS diagnostics and gateway rows reachable, and avoid Linux ARM Gradle resource tasks during Android builds. (#85791, #90147, #90668, #90815) Thanks @giodl73-repo, @vrurg, @pgondhi987, @Takhoffman, @zhangguiping-xydt, @vincentkoc, @joshavant, and @shakkernerd.
• TUI/chat/Workboard/auto-reply: optimistic user messages stay stable across stale history reloads, runId reassignment, and abort windows instead of disappearing, jumping, or lingering as ghost rows; Workboard stale lifecycle bulk updates no longer overwrite newer status/provenance; message-tool sends now count as delivery. (#86205, #89600, #88592, #90123) Thanks @RomneyDa, @BunsDev, @kzclaw, @mcaxtr, @vincentkoc, @joshavant, and @LiuwqGit.
• Cron/update/service env: doctor config preflight now migrates legacy cron JSON stores into SQLite before runtime reads, service env planning skips unresolved placeholders that would mask state-dir .env values, and session transcript rewrites keep registry markers/discriminants consistent. (#90072, #90208, #90277, #90488) Thanks @MonkeyLeeT, @sallyom, @Kvikkulf, @jalehman, @wlassalle724, @shakkernerd, and @vincentkoc.
• Security/config/tooling: guard MCP HTTP redirects, protect global agent config defaults, and keep malformed operational limits bounded and explicit. (#89732, #90145) Thanks @pgondhi987, @vincentkoc, and @joshavant.
• Channels: WhatsApp restarts when per-account config changes, bounds background startup waits, closes failed sockets, and preserves reconnect behavior; Mattermost slash commands keep their state on globalThis; Feishu streaming cards preserve full merged content; voice-call tracks Twilio streams after connect; ClickClack reply tools respect toolsAllow. (#87951, #87965, #90486, #68113, #90534, #90181, #90607, #89500) Thanks @MukundaKatta, @mcaxtr, @infoanton, @mushuiyu886, @sahibzada-allahyar, @borntobefree2-cmyk, @Takhoffman, @mmaps, @MMMMSSSS8899, @ly85206559, @sliverp, @vincentkoc, @joshavant, @LiuwqGit, @itsuzef, @wjm7220, and @donkeykong91.
• Feishu: retry transient send rate-limit errors (HTTP 429, per-chat code 230020, tenant-level code 11232) with linear backoff, including SDK responses that fulfill with rate-limit bodies instead of throwing, and route streaming-card sends through the retry wrapper. (#89659) Thanks @ladygege, @AxelHu, @marshallm-create, @sliverp, @joshavant, @vincentkoc, @itsuzef, and @mcaxtr.
• Memory: keep doctor REM harness previews aligned with live REM by dropping short-term recall snippets whose source files disappeared before rendering preview output. Thanks @samzong, @frankekn, and @vincentkoc.

Complete contribution record

This audited record covers the complete v2026.6.2-beta.1..v2026.6.5 history: 142 merged PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact.

Pull requests

• PR #89102 refactor(auth): store auth profiles in SQLite.
• PR #90028 docs: clarify legacy openai-codex auth. Thanks @jalehman.
• PR #89600 Fix Workboard status persistence. Related #88592. Thanks @BunsDev and @kzclaw.
• PR #90067 fix(workboard): isolate stale lifecycle bulk patches. Thanks @BunsDev.
• PR #88585 Pin official npm plugin install records. Thanks @zhuisDEV.
• PR #90053 fix: hide Skill Workshop revision handoff from chat. Thanks @shakkernerd.
• PR #90123 fix(auto-reply): count message tool sends as delivery. Thanks @mcaxtr.
• PR #87965 fix(whatsapp): restart channel when a per-account config field changes so disabled accounts are torn down. Related #87951. Thanks @MukundaKatta and @mcaxtr and @borntobefree2-cmyk.
• PR #90145 fix: protect global agent config defaults [AI]. Thanks @pgondhi987.
• PR #90147 Rate limit node pairing requests [AI]. Thanks @pgondhi987.
• PR #89732 fix: guard MCP HTTP redirects [AI]. Thanks @pgondhi987.
• PR #90181 fix(feishu): preserve streaming card content. Related #90164. Thanks @mushuiyu886 and @sliverp and @wjm7220.
• PR #90058 fix(docker): qualify base image refs for podman short-name mode. Thanks @mrunalp and @sallyom.
• PR #89488 fix: stabilize Anthropic cache marker through tool loops. Thanks @Marvinthebored.
• PR #89505 fix(acp): re-add opt-in parent commentary progress. Related #89501. Thanks @100yenadmin.
• PR #90341 fix(acp): default parent commentary in progress mode. Thanks @obviyus.
• PR #90351 fix(message-tool): stabilize send idempotency keys. Thanks @jesse-merhi.
• PR #90375 refactor: remove Feishu runtime dedupe JSON fallback.
• PR #90385 refactor: move MS Teams state migration to doctor.
• PR #90287 fix(ci): scope PR merge diff checks to first parent. Thanks @hxy91819.
• PR #90436 Add NVIDIA Nemotron 3 Ultra default. Thanks @jacobtomlinson.
• PR #90205 fix: tolerate missing streamed response content type. Thanks @jalehman.
• PR #90163 fix(agents): strip stale compaction thinking signatures before Anthropic replay. Related #90108. Thanks @openperf and @dexiosmb.
• PR #90486 fix(whastapp): bound connection startup waits. Thanks @mcaxtr and @MMMMSSSS8899.
• PR #90488 fix service env placeholder collection. Thanks @sallyom.
• PR #90478 feat: install GitHub-backed ClawHub skills. Thanks @Patrick-Erichsen.
• PR #90304 feat(memory): support qmd query rerank toggle. Related #61834. Thanks @osolmaz and @kouka-t0yohei.
• PR #90532 Fix main CI guard drift. Thanks @RomneyDa.
• PR #90534 fix(mattermost): anchor slash state on globalThis (#68113). Thanks @Takhoffman and @ly85206559 and @infoanton.
• PR #89502 feat(googlechat): add native approval cards. Thanks @kevinslin.
• PR #90317 Add Codex multi-agent config migration coverage. Thanks @ooiuuii.
• PR #90319 Add Codex session route migration coverage. Thanks @ooiuuii.
• PR #90132 fix(qqbot): sanitize outbound text to strip reasoning/thinking content. Related #89913. Thanks @openperf and @Takhoffman and @dygg2001.
• PR #89874 fix(agents): detect unsigned thinking-only stall when reasoning payload inflates payloadCount. Related #89787. Thanks @openperf and @Takhoffman and @ArthurusDent.
• PR #90594 fix(android): align provider readiness with available models. Thanks @Tosko4.
• PR #90576 fix(sessions): reconcile stale terminal main transcripts. Related #60542. Thanks @ferminquant and @kAIborg24.
• PR #90405 Fix ClickClack toolsAllow reply dispatch. Thanks @mmaps.
• PR #90415 feat(matrix): handle voice preflight and threads. Related #78016. Thanks @frankdierolf.
• PR #90208 fix(cron): auto-migrate legacy cron store. Related #90072. Thanks @MonkeyLeeT and @jalehman and @wlassalle724.
• PR #85791 fix(gateway): dedupe probe warnings by gateway identity. Thanks @giodl73-repo.
• PR #90632 fix(context-engine): forward isHeartbeat to afterTurn (fixes #89302). Thanks @zenglingbiao and @jalehman and @huangxun375-stack.
• PR #90250 docs: prefer web_fetch in weather skill. Thanks @fuller-stack-dev.
• PR #85158 feat(parallel): add Parallel as a bundled web_search provider. Thanks @NormallyGaussian.
• PR #86205 fix(tui): stabilize optimistic user messages across history reloads, runId reassignment, and abort. Thanks @RomneyDa.
• PR #86483 chore(deps): bump the swift-deps group across 1 directory with 3 updates.
• PR #90601 chore(deps): bump the actions group across 1 directory with 4 updates.
• PR #81757 chore(deps): bump github.com/apple/swift-testing from 6.3.1 to 6.3.2 in /apps/swabble in the swift-deps group across 1 directory.
• PR #86481 chore(deps): bump the android-deps group across 1 directory with 9 updates.
• PR #74980 build(deps): bump docker/login-action from 3.6.0 to 4.1.0.
• PR #90717 fix(agents): re-probe single-provider primary during cooldown. Related #90702. Thanks @849261680 and @brtkwr.
• PR #90609 fix(google): preserve Vertex ADC catalog auth. Related #90506. Thanks @849261680 and @paulogogs.
• PR #90775 fix: refresh prompt fence after compaction writes. Related #90729. Thanks @jalehman and @johnib.
• PR #90027 test(codex): pin completion-idle timeout thread reset. Thanks @harjothkhara.
• PR #89566 fix(telegram): suppress post-final tool error noise. Thanks @keshavbotagent.
• PR #90607 fix(voice-call): track Twilio streams after connect. Related #81122. Thanks @sahibzada-allahyar and @Takhoffman and @donkeykong91.
• PR #90728 fix(agents): coerce non-text/image MCP tool-result blocks to text (fixes #90710). Thanks @849261680 and @Takhoffman and @RanSHammer.
• PR #90697 fix(llm): defer Anthropic stream start event until after message_start. Related #90667. Thanks @openperf and @Takhoffman and @MIHHHMIH.
• PR #90816 fix(memory): resolve adapter default model in plain status identity check. Related #90413. Thanks @849261680 and @Takhoffman and @colinmac-boop.
• PR #90815 fix #90668: [Bug]: macOS node mode can silently self-reconnect in a healthy direct gateway session. Thanks @Takhoffman and @zhangguiping-xydt and @vrurg.
• PR #90793 Fix OpenAI audio auth to use API keys. Thanks @Glucksberg and @sallyom.
• PR #90790 fix(codex): preserve completed replies after client close. Related #90771. Thanks @brokemac79 and @jalehman.
• PR #90820 fix(codex): report completion timeout diagnostics. Thanks @kevinslin.
• PR #90845 fix(imessage): frame rpc stdout on LF only. Related #89830. Thanks @omarshahine and @mmartoccia.
• PR #90813 fix(uninstall): refuse to remove current working directory during cleanup. Related #90806. Thanks @xydigit-sj and @sallyom and @brandondube.
• PR #90336 fix(memory): fail fast when embeddings provider is unavailable. Related #89691. Thanks @osolmaz and @joeykrug.
• PR #90914 fix(talk): resolve realtime provider secret refs. Thanks @ngutman.
• PR #88771 fix(agents): stream phased text deltas incrementally. Thanks @vincentkoc.
• PR #87856 fix(agents): count streamed model deltas incrementally. Thanks @vincentkoc.
• PR #88882 test(gateway): add small model live profile. Thanks @vincentkoc.
• PR #90919 [codex] Add iOS Apple Review demo mode. Thanks @ngutman.
• PR #90954 fix(cron): require HTTP context for server_error retry classification. Related #90947. Thanks @Nas01010101.
• PR #90854 fix(build): copy export-html assets to dist/export-html matching runtime path (fixes #90843). Thanks @zenglingbiao and @Tank-x3.
• PR #90922 docs: improve plugin inventory layout. Thanks @joshp123.
• PR #89652 fix(plugins): load owning plugin for configured memory embedding provider at startup. Related #89651. Thanks @joeykrug.
• PR #90811 fix(agents): stabilize user-turn serialization across turns to preserve prompt cache. Related #90810. Thanks @Marvinthebored and @jalehman.
• PR #90853 fix(imessage): send TTS audio as voice messages. Thanks @omarshahine.
• PR #90995 fix(release): use monthly patch versions. Thanks @vincentkoc.
• PR #91030 fix: store device-pair notify state in sqlite.
• PR #91034 fix: store acpx process state in sqlite.
• PR #90849 feat(parallel): add free Parallel Search MCP as the zero-config default web_search provider. Thanks @NormallyGaussian.
• PR #91056 fix: store memory-core dreams state in sqlite.
• PR #89918 fix(vertex): route eu/us multi-region to .rep.googleapis.com host. Related #89891. Thanks @alkor2000 and @Wimcomander.
• PR #91058 fix(gemini): accept empty grounding metadata. Related #88528. Thanks @TarsTriggerBot.
• PR #91072 refactor(memory-wiki): store source sync state in sqlite.
• PR #91073 fix(openrouter): reconcile streamed generation cost. Related #68066. Thanks @chrispatil.
• PR #91032 docs(imessage): require DisableLibraryValidation on modern macOS; document macOS 26 injection gates. Thanks @omarshahine.
• PR #87933 fix(agents): suppress DeepSeek thinking for Foundry aliases. Related #90520. Thanks @MukundaKatta and @wlassalle724.
• PR #91037 fix(config): allow thinkingLevelMap in persisted model schema. Related #91011. Thanks @wsyjh8 and @chrisreddington.
• PR #89832 fix(config): allow requiresReasoningContentOnAssistantMessages in ModelCompatSchema. Related #89660. Thanks @KrasimirKralev and @kyKKK.
• PR #91088 refactor(matrix): store sync cache in sqlite.
• PR #90138 fix(minimax): exempt M3 from thinking-disabled wrapper. Thanks @IamVNIE.
• PR #91053 refactor: store Zalo hosted media in plugin state.
• PR #91098 fix(test): type overflow resolver mock. Thanks @RomneyDa.
• PR #81277 fix(google): handle compressed Vertex ADC token refresh responses. Thanks @liaoandi.
• PR #91100 refactor(matrix): store crypto sidecars in sqlite.
• PR #90260 fix(agents): decode xai and venice tool-call arguments exactly once. Thanks @yetval.
• PR #90593 fix: preserve LM Studio Responses tool arguments. Related #90585. Thanks @849261680 and @ceo-nada.
• PR #89109 fix(agents): block message-tool spam loops defeated by volatile message ids. Related #89090. Thanks @openperf and @wujiaming88.
• PR #90429 Fix LM Studio wizard prompter binding. Thanks @christineyan4.
• PR #90780 perf(qqbot): narrow tool discovery cold load. Thanks @RomneyDa.
• PR #90504 fix(codex): preserve post-tool reasoning liveness. Thanks @fuller-stack-dev.
• PR #91113 fix: align Xiaomi completions replay compat. Related #91106. Thanks @KrasimirKralev.
• PR #91108 refactor(memory-wiki): store import runs in sqlite.
• PR #91118 fix: preserve Foundry Responses reasoning replay ids. Related #91033. Thanks @chrisreddington.
• PR #91125 fix: strip Google provider prefix from Gemini paths. Related #71932. Thanks @soumoucookie.
• PR #90056 fix(doctor): merge disjoint openai-codex model entries into canonical openai provider. Related #90047. Thanks @openperf and @holgergruenhagen.
• PR #91127 refactor: store sandbox registry in sqlite.
• PR #91131 fix: migrate legacy agent registry schema via doctor.
• PR #91119 fix(outbound): keep Discord runtime adapters resolvable. Related #90162. Thanks @TurboTheTurtle and @thewilloftheshadow and @hoyanhan.
• PR #91128 fix(qqbot): migrate group tool policy config.
• PR #91133 refactor(plugin-sdk): persist dedupe state in sqlite.
• PR #90612 fix(agents): dispatch subagent spawn in process. Thanks @lanzhi-lee.
• PR #87323 fix(infra/agents): session-routing guard for coalesced gateway restart continuations (#86742). Thanks @openperf and @songshikang0111.
• PR #91101 fix(inbound-meta): apply head+tail body truncation to ReplyChain and ReplyToBody JSON paths (fixes #91042). Thanks @zenglingbiao and @wangwllu.
• PR #91201 feat(ios): clarify talk realtime fallback. Thanks @ngutman.
• PR #91233 fix(agents): prevent ReDoS in background-session name derivation. Thanks @Takhoffman and @yetval.
• PR #90798 fix(agents): materialize sandbox skills for rw sandboxes. Related #90410. Thanks @brokemac79 and @gbb-netizen.
• PR #91248 fix: preserve live Ollama catalog metadata. Related #90315. Thanks @civiltox.
• PR #91041 fix(imessage): self-explaining private-API failures and dedicated send timeout. Thanks @omarshahine.
• PR #90029 feat: add live provider model catalog helper. Thanks @fuller-stack-dev.
• PR #90752 feat(android): add theme mode selection. Thanks @Tosko4 and @joshavant.
• PR #90261 fix: gate owner-only HTTP tools. Thanks @pgondhi987 and @joshavant.
• PR #90022 fix(codex): quarantine unreadable dynamic tools. Thanks @vincentkoc.
• PR #88822 fix(agents): compact lean local tool catalogs. Thanks @vincentkoc.
• PR #89350 fix(agents): guard prompt cache tool names. Thanks @vincentkoc.
• PR #91241 fix(outbound): preserve retries for budget-deferred deliveries. Thanks @849261680 and @Takhoffman.
• PR #91124 fix(agents): do not refresh lastUsedAt on MCP lease release. Related #91075. Thanks @openperf and @Takhoffman and @Atlas-crete.
• PR #90858 fix(imessage): gate split-send coalescing on imsg metadata. Thanks @omarshahine.
• PR #91235 fix(codex): preserve native subagent completion results. Related #91120. Thanks @849261680 and @Takhoffman and @jinon86.
• PR #91230 fix(cron): preserve isolated agent turn payload message. Related #91228. Thanks @849261680 and @Takhoffman and @AgentXaGent.
• PR #90480 feat(whatsapp): expand live QA coverage. Thanks @mcaxtr.
• PR #89712 feat(cron): support command jobs. Thanks @mbelinky.
• PR #90937 fix(gateway): preserve stale channel restart diagnostics. Related #90901. Thanks @snowzlm and @Takhoffman and @Tony-ooo.
• PR #91231 fix(anthropic): drop reasoning_content replay signatures. Related #91205. Thanks @849261680 and @Takhoffman and @bobgitmcgrath.
• PR #90897 fix #90452: Regression: Heartbeat exec completion still shows generic fallback text instead of actual output. Thanks @mushuiyu886 and @Takhoffman and @bizzle12368239.
• PR #91322 refactor: move session metadata to SQLite.
• PR #91529 Fix transcript image redaction. Related #90760. Thanks @joshavant and @devinkuhn.
• PR #91551 Fix config.patch explicit array replacement. Thanks @joshavant.
• PR #85823 fix(whatsapp): route captured replies through successor controller after restart. Thanks @itsuzef and @mcaxtr.
• PR #89659 fix(feishu): retry on send rate-limit errors (230020/230006). Related #70879. Thanks @ladygege and @marshallm-create and @sliverp and @AxelHu.
• PR #91547 Fix Docker store seed target packages. Related #91035. Thanks @sallyom and @laurenceputra.
• PR #91423 feat(qqbot): add /bot-group-allways command to toggle mention requirement. Thanks @cxyhhhhh.

Release verification

• npm package: openclaw@2026.6.5-beta.3 on dist-tag beta.
• npm tarball: https://registry.npmjs.org/openclaw/-/openclaw-2026.6.5-beta.3.tgz
• npm integrity: sha512-OUmv5kb3nEa9DZsnF4dVhwKlSApzr7KNgN+PCO7U5pbEQBlemAyLEgZDruiKmmoS6wlPjq73+PdD9i9c5zihOA==
• npm preflight: https://github.com/openclaw/openclaw/actions/runs/27165128882
• Docker release: https://github.com/openclaw/openclaw/actions/runs/27165128944
• full release validation: https://github.com/openclaw/openclaw/actions/runs/27165128963
• plugin npm publish: https://github.com/openclaw/openclaw/actions/runs/27167497019
• plugin ClawHub publish: https://github.com/openclaw/openclaw/actions/runs/27168216099
• OpenClaw npm publish: https://github.com/openclaw/openclaw/actions/runs/27167084540
• release publish wrapper recovery: https://github.com/openclaw/openclaw/actions/runs/27167309611 was cancelled after its rerun hit the already-published npm guard; release proof was completed from the successful beta.3 publish runs above.
• postpublish verification: passed with OpenClaw npm, plugin npm, and ClawHub included; evidence assets are attached to this release.

2026.6.5

Highlights

• Safer channel output: QQBot strips model reasoning and thinking scaffolding before native delivery, so users see the final answer rather than raw internal markup. (#89913, #90132) Thanks @openperf, @dygg2001, @Takhoffman, and @vincentkoc.
• MCP results no longer poison sessions: resource_link, audio, malformed images, and future non-text blocks are normalized before provider conversion, avoiding Anthropic 400s and broken follow-up history. (#90710, #90728) Thanks @RanSHammer, @849261680, and @Takhoffman.
• Anthropic extended thinking recovers after restarts: prompt-cache expiry and early-signature failures wait for a real message start, so they reach the existing retry path rather than ending a turn. (#90667, #90697) Thanks @openperf, @MIHHHMIH, @Takhoffman, @vincentkoc, @itsuzef, and @mcaxtr.
• Parallel web search is bundled: API-key discovery, guarded endpoint handling, cache-safe session IDs, onboarding, and documentation make it a first-class search provider. (#85158) Thanks @NormallyGaussian.
• Better Matrix and Vertex reliability: Matrix voice notes and threaded conversations retain their context, while Google Vertex ADC models regain static catalog and runtime resolution. (#78016, #90415, #90506, #90609) Thanks @849261680, @frankdierolf, and @paulogogs.
• Safer upgrades and restarts: cron JSON stores migrate before runtime, service env placeholders stop masking secrets, and macOS avoids unnecessary direct-Gateway reconnect churn. (#90072, #90208, #90668, #90815) Thanks @MonkeyLeeT, @sallyom, @vrurg, @wlassalle724, @jalehman, @Takhoffman, @zhangguiping-xydt, @joshavant, and @vincentkoc.

Changes

• Search/providers: add the Parallel bundled web-search plugin, registration contracts, onboarding integration, and guarded api.parallel.ai/v1/search support. (#85158) Thanks @NormallyGaussian and @vincentkoc.
• Matrix/channels: add voice-message preflight and thread-aware read/reply behavior. (#78016, #90415) Thanks @frankdierolf.
• Skills/ClawHub: install ClawHub skills backed by GitHub repositories through the resolved install API, download the pinned GitHub commit, keep install-policy checks, and report install telemetry after success. (#90478) Thanks @Patrick-Erichsen, @vincentkoc, @itsuzef, and @mcaxtr.
• Google Chat/channels: add native approval card actions and click handling so Google Chat approvals use platform-native cards instead of generic message flow.
• Mobile: Android provider/model screens now surface expiring, unavailable, unresolved, and attention states more clearly, while iOS settings and Talk tabs keep diagnostics, gateway rows, attachment labels, and unavailable Talk controls reachable. Thanks @joshavant and @shakkernerd.
• Memory: QMD search can use the new rerank toggle, and memory adapter status uses the resolved default model identity when checking plain status. (#61834) Thanks @kouka-t0yohei and @vincentkoc.
• QQBot: add /bot-group-allways on|off slash command (with named-account and default-account support) to toggle whether group messages require an @mention before the bot replies, and clear the runtime config snapshot after the write so the new account-level defaultRequireMention takes effect immediately without restart. (#91423) Thanks @cxyhhhhh, @joshavant, @vincentkoc, @itsuzef, @mcaxtr, and @jacobtomlinson.

Fixes

• Agents: sessions_send now honors an explicit sessionKey when stale label metadata is also present, and denied session-id sends no longer echo the resolved canonical session key. Fixes #64699; refs #74009 and #41199 Thanks @Mintalix, @RevisitMoon, @Mocha-s, @chouxiaozi1989, @sunxq1017-hash, @vincentkoc, and @joshavant.
• Channel content boundaries: QQBot now strips reasoning/thinking tags before sending, preserving final answers while hiding internal model narration from users. (#89913, #90132) Thanks @openperf, @Takhoffman, @dygg2001, and @vincentkoc.
• Agents/MCP/providers: coerce non-text/image MCP tool-result blocks before they reach provider converters, preserving valid images and turning richer MCP content into text instead of malformed image blocks. (#90710, #90728) Thanks @RanSHammer, @849261680, @Takhoffman, @vincentkoc, and @LiuwqGit.
• Anthropic/Codex/ACP/agent recovery: defer Anthropic stream start events until message_start, strip stale compaction thinking signatures before Anthropic replay, detect unsigned thinking-only stalls, refresh prompt fences after compaction writes, reject empty completion handoffs, preserve parent streaming-off overrides/shared progress commentary, forward heartbeat metadata to context-engine hooks, and cover Codex session/thread migration edge cases. (#90667, #90697, #90163, #90108, #89874, #89505, #90632, #89302, #90729, #90317, #90319) Thanks @openperf, @100yenadmin, @ooiuuii, @johnib, @Takhoffman, @MIHHHMIH, @dexiosmb, @zenglingbiao, @jalehman, @huangxun375-stack, @holgergruenhagen, @vincentkoc, @joshavant, and @ArthurusDent.
• Provider/model resolution: preserve Google Vertex ADC auth markers in generated catalogs, re-probe a single-provider primary after cooldown, share Codex model visibility, fail closed for unknown model auth, preserve Codex alias availability, keep unresolved profile refs unknown, and avoid resolving auth while listing models. (#90506, #90609, #90717, #90702) Thanks @849261680, @paulogogs, @brtkwr, and @vincentkoc.
• Gateway/macOS/mobile: avoid duplicate Gateway probe warnings by identity, rate-limit node pairing requests while preserving paired-node reconnects, keep macOS node mode on a healthy direct Gateway session, keep iOS diagnostics and gateway rows reachable, and avoid Linux ARM Gradle resource tasks during Android builds. (#85791, #90147, #90668, #90815) Thanks @giodl73-repo, @vrurg, @pgondhi987, @Takhoffman, @zhangguiping-xydt, @vincentkoc, @joshavant, and @shakkernerd.
• TUI/chat/Workboard/auto-reply: optimistic user messages stay stable across stale history reloads, runId reassignment, and abort windows instead of disappearing, jumping, or lingering as ghost rows; Workboard stale lifecycle bulk updates no longer overwrite newer status/provenance; message-tool sends now count as delivery. (#86205, #89600, #88592, #90123) Thanks @RomneyDa, @BunsDev, @kzclaw, @mcaxtr, @vincentkoc, @joshavant, and @LiuwqGit.
• Cron/update/service env: doctor config preflight now migrates legacy cron JSON stores into SQLite before runtime reads, service env planning skips unresolved placeholders that would mask state-dir .env values, and session transcript rewrites keep registry markers/discriminants consistent. (#90072, #90208, #90277, #90488) Thanks @MonkeyLeeT, @sallyom, @Kvikkulf, @jalehman, @wlassalle724, @shakkernerd, and @vincentkoc.
• Security/config/tooling: guard MCP HTTP redirects, protect global agent config defaults, and keep malformed operational limits bounded and explicit. (#89732, #90145) Thanks @pgondhi987, @vincentkoc, and @joshavant.
• Channels: WhatsApp restarts when per-account config changes, bounds background startup waits, closes failed sockets, and preserves reconnect behavior; Mattermost slash commands keep their state on globalThis; Feishu streaming cards preserve full merged content; voice-call tracks Twilio streams after connect; ClickClack reply tools respect toolsAllow. (#87951, #87965, #90486, #68113, #90534, #90181, #90607, #89500) Thanks @MukundaKatta, @mcaxtr, @infoanton, @mushuiyu886, @sahibzada-allahyar, @borntobefree2-cmyk, @Takhoffman, @mmaps, @MMMMSSSS8899, @ly85206559, @sliverp, @vincentkoc, @joshavant, @LiuwqGit, @itsuzef, @wjm7220, and @donkeykong91.
• Feishu: retry transient send rate-limit errors (HTTP 429, per-chat code 230020, tenant-level code 11232) with linear backoff, including SDK responses that fulfill with rate-limit bodies instead of throwing, and route streaming-card sends through the retry wrapper. (#89659) Thanks @ladygege, @AxelHu, @marshallm-create, @sliverp, @joshavant, @vincentkoc, @itsuzef, and @mcaxtr.
• Memory: keep doctor REM harness previews aligned with live REM by dropping short-term recall snippets whose source files disappeared before rendering preview output. Thanks @samzong, @frankekn, and @vincentkoc.

Complete contribution record

This audited record covers the complete v2026.6.2-beta.1..v2026.6.5 history: 142 merged PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact.

Pull requests

• PR #89102 refactor(auth): store auth profiles in SQLite.
• PR #90028 docs: clarify legacy openai-codex auth. Thanks @jalehman.
• PR #89600 Fix Workboard status persistence. Related #88592. Thanks @BunsDev and @kzclaw.
• PR #90067 fix(workboard): isolate stale lifecycle bulk patches. Thanks @BunsDev.
• PR #88585 Pin official npm plugin install records. Thanks @zhuisDEV.
• PR #90053 fix: hide Skill Workshop revision handoff from chat. Thanks @shakkernerd.
• PR #90123 fix(auto-reply): count message tool sends as delivery. Thanks @mcaxtr.
• PR #87965 fix(whatsapp): restart channel when a per-account config field changes so disabled accounts are torn down. Related #87951. Thanks @MukundaKatta and @mcaxtr and @borntobefree2-cmyk.
• PR #90145 fix: protect global agent config defaults [AI]. Thanks @pgondhi987.
• PR #90147 Rate limit node pairing requests [AI]. Thanks @pgondhi987.
• PR #89732 fix: guard MCP HTTP redirects [AI]. Thanks @pgondhi987.
• PR #90181 fix(feishu): preserve streaming card content. Related #90164. Thanks @mushuiyu886 and @sliverp and @wjm7220.
• PR #90058 fix(docker): qualify base image refs for podman short-name mode. Thanks @mrunalp and @sallyom.
• PR #89488 fix: stabilize Anthropic cache marker through tool loops. Thanks @Marvinthebored.
• PR #89505 fix(acp): re-add opt-in parent commentary progress. Related #89501. Thanks @100yenadmin.
• PR #90341 fix(acp): default parent commentary in progress mode. Thanks @obviyus.
• PR #90351 fix(message-tool): stabilize send idempotency keys. Thanks @jesse-merhi.
• PR #90375 refactor: remove Feishu runtime dedupe JSON fallback.
• PR #90385 refactor: move MS Teams state migration to doctor.
• PR #90287 fix(ci): scope PR merge diff checks to first parent. Thanks @hxy91819.
• PR #90436 Add NVIDIA Nemotron 3 Ultra default. Thanks @jacobtomlinson.
• PR #90205 fix: tolerate missing streamed response content type. Thanks @jalehman.
• PR #90163 fix(agents): strip stale compaction thinking signatures before Anthropic replay. Related #90108. Thanks @openperf and @dexiosmb.
• PR #90486 fix(whastapp): bound connection startup waits. Thanks @mcaxtr and @MMMMSSSS8899.
• PR #90488 fix service env placeholder collection. Thanks @sallyom.
• PR #90478 feat: install GitHub-backed ClawHub skills. Thanks @Patrick-Erichsen.
• PR #90304 feat(memory): support qmd query rerank toggle. Related #61834. Thanks @osolmaz and @kouka-t0yohei.
• PR #90532 Fix main CI guard drift. Thanks @RomneyDa.
• PR #90534 fix(mattermost): anchor slash state on globalThis (#68113). Thanks @Takhoffman and @ly85206559 and @infoanton.
• PR #89502 feat(googlechat): add native approval cards. Thanks @kevinslin.
• PR #90317 Add Codex multi-agent config migration coverage. Thanks @ooiuuii.
• PR #90319 Add Codex session route migration coverage. Thanks @ooiuuii.
• PR #90132 fix(qqbot): sanitize outbound text to strip reasoning/thinking content. Related #89913. Thanks @openperf and @Takhoffman and @dygg2001.
• PR #89874 fix(agents): detect unsigned thinking-only stall when reasoning payload inflates payloadCount. Related #89787. Thanks @openperf and @Takhoffman and @ArthurusDent.
• PR #90594 fix(android): align provider readiness with available models. Thanks @Tosko4.
• PR #90576 fix(sessions): reconcile stale terminal main transcripts. Related #60542. Thanks @ferminquant and @kAIborg24.
• PR #90405 Fix ClickClack toolsAllow reply dispatch. Thanks @mmaps.
• PR #90415 feat(matrix): handle voice preflight and threads. Related #78016. Thanks @frankdierolf.
• PR #90208 fix(cron): auto-migrate legacy cron store. Related #90072. Thanks @MonkeyLeeT and @jalehman and @wlassalle724.
• PR #85791 fix(gateway): dedupe probe warnings by gateway identity. Thanks @giodl73-repo.
• PR #90632 fix(context-engine): forward isHeartbeat to afterTurn (fixes #89302). Thanks @zenglingbiao and @jalehman and @huangxun375-stack.
• PR #90250 docs: prefer web_fetch in weather skill. Thanks @fuller-stack-dev.
• PR #85158 feat(parallel): add Parallel as a bundled web_search provider. Thanks @NormallyGaussian.
• PR #86205 fix(tui): stabilize optimistic user messages across history reloads, runId reassignment, and abort. Thanks @RomneyDa.
• PR #86483 chore(deps): bump the swift-deps group across 1 directory with 3 updates.
• PR #90601 chore(deps): bump the actions group across 1 directory with 4 updates.
• PR #81757 chore(deps): bump github.com/apple/swift-testing from 6.3.1 to 6.3.2 in /apps/swabble in the swift-deps group across 1 directory.
• PR #86481 chore(deps): bump the android-deps group across 1 directory with 9 updates.
• PR #74980 build(deps): bump docker/login-action from 3.6.0 to 4.1.0.
• PR #90717 fix(agents): re-probe single-provider primary during cooldown. Related #90702. Thanks @849261680 and @brtkwr.
• PR #90609 fix(google): preserve Vertex ADC catalog auth. Related #90506. Thanks @849261680 and @paulogogs.
• PR #90775 fix: refresh prompt fence after compaction writes. Related #90729. Thanks @jalehman and @johnib.
• PR #90027 test(codex): pin completion-idle timeout thread reset. Thanks @harjothkhara.
• PR #89566 fix(telegram): suppress post-final tool error noise. Thanks @keshavbotagent.
• PR #90607 fix(voice-call): track Twilio streams after connect. Related #81122. Thanks @sahibzada-allahyar and @Takhoffman and @donkeykong91.
• PR #90728 fix(agents): coerce non-text/image MCP tool-result blocks to text (fixes #90710). Thanks @849261680 and @Takhoffman and @RanSHammer.
• PR #90697 fix(llm): defer Anthropic stream start event until after message_start. Related #90667. Thanks @openperf and @Takhoffman and @MIHHHMIH.
• PR #90816 fix(memory): resolve adapter default model in plain status identity check. Related #90413. Thanks @849261680 and @Takhoffman and @colinmac-boop.
• PR #90815 fix #90668: [Bug]: macOS node mode can silently self-reconnect in a healthy direct gateway session. Thanks @Takhoffman and @zhangguiping-xydt and @vrurg.
• PR #90793 Fix OpenAI audio auth to use API keys. Thanks @Glucksberg and @sallyom.
• PR #90790 fix(codex): preserve completed replies after client close. Related #90771. Thanks @brokemac79 and @jalehman.
• PR #90820 fix(codex): report completion timeout diagnostics. Thanks @kevinslin.
• PR #90845 fix(imessage): frame rpc stdout on LF only. Related #89830. Thanks @omarshahine and @mmartoccia.
• PR #90813 fix(uninstall): refuse to remove current working directory during cleanup. Related #90806. Thanks @xydigit-sj and @sallyom and @brandondube.
• PR #90336 fix(memory): fail fast when embeddings provider is unavailable. Related #89691. Thanks @osolmaz and @joeykrug.
• PR #90914 fix(talk): resolve realtime provider secret refs. Thanks @ngutman.
• PR #88771 fix(agents): stream phased text deltas incrementally. Thanks @vincentkoc.
• PR #87856 fix(agents): count streamed model deltas incrementally. Thanks @vincentkoc.
• PR #88882 test(gateway): add small model live profile. Thanks @vincentkoc.
• PR #90919 [codex] Add iOS Apple Review demo mode. Thanks @ngutman.
• PR #90954 fix(cron): require HTTP context for server_error retry classification. Related #90947. Thanks @Nas01010101.
• PR #90854 fix(build): copy export-html assets to dist/export-html matching runtime path (fixes #90843). Thanks @zenglingbiao and @Tank-x3.
• PR #90922 docs: improve plugin inventory layout. Thanks @joshp123.
• PR #89652 fix(plugins): load owning plugin for configured memory embedding provider at startup. Related #89651. Thanks @joeykrug.
• PR #90811 fix(agents): stabilize user-turn serialization across turns to preserve prompt cache. Related #90810. Thanks @Marvinthebored and @jalehman.
• PR #90853 fix(imessage): send TTS audio as voice messages. Thanks @omarshahine.
• PR #90995 fix(release): use monthly patch versions. Thanks @vincentkoc.
• PR #91030 fix: store device-pair notify state in sqlite.
• PR #91034 fix: store acpx process state in sqlite.
• PR #90849 feat(parallel): add free Parallel Search MCP as the zero-config default web_search provider. Thanks @NormallyGaussian.
• PR #91056 fix: store memory-core dreams state in sqlite.
• PR #89918 fix(vertex): route eu/us multi-region to .rep.googleapis.com host. Related #89891. Thanks @alkor2000 and @Wimcomander.
• PR #91058 fix(gemini): accept empty grounding metadata. Related #88528. Thanks @TarsTriggerBot.
• PR #91072 refactor(memory-wiki): store source sync state in sqlite.
• PR #91073 fix(openrouter): reconcile streamed generation cost. Related #68066. Thanks @chrispatil.
• PR #91032 docs(imessage): require DisableLibraryValidation on modern macOS; document macOS 26 injection gates. Thanks @omarshahine.
• PR #87933 fix(agents): suppress DeepSeek thinking for Foundry aliases. Related #90520. Thanks @MukundaKatta and @wlassalle724.
• PR #91037 fix(config): allow thinkingLevelMap in persisted model schema. Related #91011. Thanks @wsyjh8 and @chrisreddington.
• PR #89832 fix(config): allow requiresReasoningContentOnAssistantMessages in ModelCompatSchema. Related #89660. Thanks @KrasimirKralev and @kyKKK.
• PR #91088 refactor(matrix): store sync cache in sqlite.
• PR #90138 fix(minimax): exempt M3 from thinking-disabled wrapper. Thanks @IamVNIE.
• PR #91053 refactor: store Zalo hosted media in plugin state.
• PR #91098 fix(test): type overflow resolver mock. Thanks @RomneyDa.
• PR #81277 fix(google): handle compressed Vertex ADC token refresh responses. Thanks @liaoandi.
• PR #91100 refactor(matrix): store crypto sidecars in sqlite.
• PR #90260 fix(agents): decode xai and venice tool-call arguments exactly once. Thanks @yetval.
• PR #90593 fix: preserve LM Studio Responses tool arguments. Related #90585. Thanks @849261680 and @ceo-nada.
• PR #89109 fix(agents): block message-tool spam loops defeated by volatile message ids. Related #89090. Thanks @openperf and @wujiaming88.
• PR #90429 Fix LM Studio wizard prompter binding. Thanks @christineyan4.
• PR #90780 perf(qqbot): narrow tool discovery cold load. Thanks @RomneyDa.
• PR #90504 fix(codex): preserve post-tool reasoning liveness. Thanks @fuller-stack-dev.
• PR #91113 fix: align Xiaomi completions replay compat. Related #91106. Thanks @KrasimirKralev.
• PR #91108 refactor(memory-wiki): store import runs in sqlite.
• PR #91118 fix: preserve Foundry Responses reasoning replay ids. Related #91033. Thanks @chrisreddington.
• PR #91125 fix: strip Google provider prefix from Gemini paths. Related #71932. Thanks @soumoucookie.
• PR #90056 fix(doctor): merge disjoint openai-codex model entries into canonical openai provider. Related #90047. Thanks @openperf and @holgergruenhagen.
• PR #91127 refactor: store sandbox registry in sqlite.
• PR #91131 fix: migrate legacy agent registry schema via doctor.
• PR #91119 fix(outbound): keep Discord runtime adapters resolvable. Related #90162. Thanks @TurboTheTurtle and @thewilloftheshadow and @hoyanhan.
• PR #91128 fix(qqbot): migrate group tool policy config.
• PR #91133 refactor(plugin-sdk): persist dedupe state in sqlite.
• PR #90612 fix(agents): dispatch subagent spawn in process. Thanks @lanzhi-lee.
• PR #87323 fix(infra/agents): session-routing guard for coalesced gateway restart continuations (#86742). Thanks @openperf and @songshikang0111.
• PR #91101 fix(inbound-meta): apply head+tail body truncation to ReplyChain and ReplyToBody JSON paths (fixes #91042). Thanks @zenglingbiao and @wangwllu.
• PR #91201 feat(ios): clarify talk realtime fallback. Thanks @ngutman.
• PR #91233 fix(agents): prevent ReDoS in background-session name derivation. Thanks @Takhoffman and @yetval.
• PR #90798 fix(agents): materialize sandbox skills for rw sandboxes. Related #90410. Thanks @brokemac79 and @gbb-netizen.
• PR #91248 fix: preserve live Ollama catalog metadata. Related #90315. Thanks @civiltox.
• PR #91041 fix(imessage): self-explaining private-API failures and dedicated send timeout. Thanks @omarshahine.
• PR #90029 feat: add live provider model catalog helper. Thanks @fuller-stack-dev.
• PR #90752 feat(android): add theme mode selection. Thanks @Tosko4 and @joshavant.
• PR #90261 fix: gate owner-only HTTP tools. Thanks @pgondhi987 and @joshavant.
• PR #90022 fix(codex): quarantine unreadable dynamic tools. Thanks @vincentkoc.
• PR #88822 fix(agents): compact lean local tool catalogs. Thanks @vincentkoc.
• PR #89350 fix(agents): guard prompt cache tool names. Thanks @vincentkoc.
• PR #91241 fix(outbound): preserve retries for budget-deferred deliveries. Thanks @849261680 and @Takhoffman.
• PR #91124 fix(agents): do not refresh lastUsedAt on MCP lease release. Related #91075. Thanks @openperf and @Takhoffman and @Atlas-crete.
• PR #90858 fix(imessage): gate split-send coalescing on imsg metadata. Thanks @omarshahine.
• PR #91235 fix(codex): preserve native subagent completion results. Related #91120. Thanks @849261680 and @Takhoffman and @jinon86.
• PR #91230 fix(cron): preserve isolated agent turn payload message. Related #91228. Thanks @849261680 and @Takhoffman and @AgentXaGent.
• PR #90480 feat(whatsapp): expand live QA coverage. Thanks @mcaxtr.
• PR #89712 feat(cron): support command jobs. Thanks @mbelinky.
• PR #90937 fix(gateway): preserve stale channel restart diagnostics. Related #90901. Thanks @snowzlm and @Takhoffman and @Tony-ooo.
• PR #91231 fix(anthropic): drop reasoning_content replay signatures. Related #91205. Thanks @849261680 and @Takhoffman and @bobgitmcgrath.
• PR #90897 fix #90452: Regression: Heartbeat exec completion still shows generic fallback text instead of actual output. Thanks @mushuiyu886 and @Takhoffman and @bizzle12368239.
• PR #91322 refactor: move session metadata to SQLite.
• PR #91529 Fix transcript image redaction. Related #90760. Thanks @joshavant and @devinkuhn.
• PR #91551 Fix config.patch explicit array replacement. Thanks @joshavant.
• PR #85823 fix(whatsapp): route captured replies through successor controller after restart. Thanks @itsuzef and @mcaxtr.
• PR #89659 fix(feishu): retry on send rate-limit errors (230020/230006). Related #70879. Thanks @ladygege and @marshallm-create and @sliverp and @AxelHu.
• PR #91547 Fix Docker store seed target packages. Related #91035. Thanks @sallyom and @laurenceputra.
• PR #91423 feat(qqbot): add /bot-group-allways command to toggle mention requirement. Thanks @cxyhhhhh.