OpenClaw Release Notes

2026.6.34

Highlights

Safer browser and network boundaries: sandboxed browser routes, trusted DNS targets, custom browser origins, and loopback provider endpoints now reject unsafe access paths. (#97958, #38290, #103075, #110693) Thanks @eleqtrizit, @brunowowk, @mosidevv, @pgondhi987, and @lsr911.

More resilient agent and provider runs: retained session writes, provider fallbacks, stream progress handling, and stdio failures now recover without silently ending active work. (#96100, #97128, #90908, #99803, #100521) Thanks @xialonglee, @sallyom, @richwilson-bloom, @LiuwqGit, @vincentkoc, @yetval, @shengting, and @cxbAsDev.

Stronger channel recovery: pending channel work resumes after recovery, acknowledgements are idempotent, and sustained Discord gateway bursts stay bounded. (#79811, #97041, #104919, #109108, #110954, #103793, #94016) Thanks @indulgeback, @cuiyuxin-gif, @Pick-cat, @Glucksberg, @evan-YM, @zhangguiping-xydt, @yetval, @sheyanmin, and @thomasthelen-kibeauftragter.

Safer operator diagnostics: command and status surfaces keep owner-only actions protected and prevent credentials from appearing in account URLs or summaries. (#98260, #107754, #105017) Thanks @eleqtrizit, @joshavant, @ooiuuii, @aniruddhaadak80, and @tzy-17.

More robust local runtime state: SQLite checkpoints, workspace reads, gateway process signalling, plugin HTTP responses, and dependency handling no longer turn transient host conditions into failed runs. (#99067, #100910, #102125, #109590, #112406) Thanks @ooiuuii, @masatohoshino, @vincentkoc, @mushuiyu886, and @krissding.

Changes

Extended-stable hardening: this maintenance release carries targeted security and reliability repairs without adding new release-line features.

Fixes

OpenCode Go: use the documented hy3 model identifier instead of the failing hy3-preview alias.

Codex native subagents: retain the parent app-server subscription and recognize multi-agent V2 child activity until a yielded child completion reaches its requester.

Dependency security: updates production dependency resolutions for patched brace-expansion, PostCSS, fast-uri, ip-address, and Undici versions. (#113428, #118804)

Execution and transport safety: browser, sandbox, exec, MCP, and secret-resolution paths reject unsafe inputs and handle stream failures without crashing the host process.

Delivery and channel stability: outbound receipts, delivery evidence, channel lifecycle, health monitoring, and gateway queues recover cleanly under retries, restarts, and overload.

Gateway and storage reliability: plugin responses, process probes, workspace bootstrap reads, and SQLite writes tolerate expected transient failures while preserving correct state.

Upcoming deprecations

Plugin SDK migration: before_agent_start, root openclaw/plugin-sdk imports, providerAuthEnvVars, and channelEnvVars are scheduled for removal after July 24. Migrate to the modern hook stages, focused SDK subpath imports, and manifest setup descriptors. See Plugin SDK migration and plugin manifests.

Complete contribution record

This audited record covers the complete v2026.6.33..496c84b history plus release-validation backports: 25 merged PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact.

Pull requests

PR #96100 Related #95915. Thanks @xialonglee, @sallyom, and @richwilson-bloom.

PR #79811 Related #79753. Thanks @indulgeback and @cuiyuxin-gif.

PR #97041 Thanks @Pick-cat and @vincentkoc.

PR #97128 Related #96518. Thanks @LiuwqGit, @vincentkoc, and @yetval.

PR #90908 Thanks @shengting.

PR #97958 Thanks @eleqtrizit.

PR #98260 Thanks @eleqtrizit.

PR #99803 Thanks @cxbAsDev and @vincentkoc.

PR #99067 Related #99066. Thanks @ooiuuii.

PR #100521 Thanks @cxbAsDev.

PR #100910 Thanks @masatohoshino and @vincentkoc.

PR #102125 Thanks @mushuiyu886.

PR #38290 Related #46520. Thanks @brunowowk and @mosidevv.

PR #103075 Thanks @pgondhi987.

PR #104919 Related #104903. Thanks @Glucksberg and @evan-YM.

PR #107754 Related #98633, #102932, #105427. Thanks @joshavant, @ooiuuii, and @aniruddhaadak80.

PR #109108 Thanks @zhangguiping-xydt.

PR #105017 Thanks @tzy-17.

PR #109590 Thanks @krissding.

PR #110693 Thanks @lsr911.

PR #110954 Thanks @zhangguiping-xydt.

PR #103793 Thanks @yetval.

PR #94016 Related #94008. Thanks @sheyanmin and @thomasthelen-kibeauftragter.

PR #112406 Thanks @vincentkoc.

PR #107938.

Release verification

Extended-stable Gateway release: npm and container images only. GitHub Releases has one repository-wide Latest flag, not a per-channel Latest; this page is intentionally not Latest. The npm and container extended-stable selectors currently resolve to 2026.6.34.

npm package: [email protected]

npm registry tarball: openclaw-2026.6.34.tgz

npm integrity: sha512-Rm4khBrWn9HYqE99NBryCFgjwlsIuwBqK5jIANn2773CGXJ1JIZkDn5twEHB+8SVFdh0FPNPHRVgZepzNJDfHg==

npm signatures and SLSA provenance attestation are published

Container images: GHCR and Docker Hub, with exact tags 2026.6.34, 2026.6.34-slim, and 2026.6.34-browser for amd64 and arm64

Container manifest digests: default/slim sha256:47d342bafe83bd3b2dca6f1d8d8b608ba7b542a1952564960648943346206759; browser sha256:55203a7abced818c0378aac0a128a2fceee5448c08f36be7e0058762a3b3ff41. The matching extended-stable, extended-stable-slim, and extended-stable-browser aliases resolve to those same digests in both registries.

Release commit: 5c38f996d4059ebd9080cf74dc611ec3a17f4d50

Successful release workflows: npm preflight, Full Release Validation, plugin npm publish, and Docker Release

Fixes

Codex progress replies: keep app-server turns running after delivered progress messages so GPT/Codex reaches its authoritative terminal response instead of stopping mid-turn. (#106961, #108487) Thanks @joshavant.

Memory Core startup repair: recover derived legacy-index and cache-sidecar conflicts without trapping the Gateway in a fatal restart loop, while keeping structural vector-store corruption retryable. (#107220, #108652) Thanks @goutam-adwant.

WSL state permissions: tolerate EROFS from guarded chmod operations only when the existing state path is already private, preserving fail-closed handling for broad permissions. (#108250, #108258)

Legacy migration recovery: keep reviewed migration residue nonfatal during startup instead of blocking otherwise healthy upgrades. (#106101)

Managed plugin updates: recover stale npm lock metadata so official managed plugins can update cleanly. (#107294, #107866)

2026.7.2

Highlights

State safety and recovery: protect persisted data with a quarantine store that survives primary-database damage, crash-recoverable SQLite snapshots, crash-durable filesystem publication, schema-upgrade data-loss rejection, and rollback-writer snapshot recovery. (#110453, #113367, #113453, #113473, #113580) Thanks @vincentkoc.

Durable channel delivery: keep accepted messages recoverable across gateway restarts and local crashes through the shared ingress drain and dead-letter recovery, covering Telegram, Signal, Slack, QQBot, Twitch, Synology Chat, Tlon, IRC, and Zalo User. #108656, #107246, #109911 (#108924, #107288, #109907, #109910, #110844, #110852, #110899, #110910, #110914, #110916, #111029) Thanks @obviyus and @edenfunf.

Session rewind and branching: rewind or fork conversations from individual messages, switch transcript branches across web and native apps, fork upstream Codex sessions, preserve branch-safe queued sends, reject stale-pane writes, and restore prompt images after a fork. (#110660, #110857, #110886, #111149, #112056, #112284, #113073, #113945) Thanks @vincentkoc.

Interactive MCP Apps and dashboards: host ticketed MCP Apps with bound tools, resources, and bounded context updates; open them from channel replies, pin them to durable dashboards, harden their shared sandbox, and let native plugins declare them directly. #109851, #110451, #113218 (#109861, #109807, #110515, #111211, #111212, #111524, #111687, #111748, #113224) Thanks @fuller-stack-dev.

Questions and approvals everywhere: let agents ask structured questions with option cards across web, channels, macOS, and native apps, while approvals gain push notifications, history, fair queuing, headless resolution, Claude tool-request relay, reviewer detail, and clearer formatted prompts. #85954 (#108505, #108709, #108776, #109922, #110242, #110372, #110584, #110681, #110989, #111060, #112918, #113027, #113193) Thanks @omarshahine.

Meetings and realtime Talk: join Teams, Zoom, and Google Meet calls with default-enabled meeting plugins and durable transcript collection, while realtime Talk adds OpenAI and Gemini video and requires a supported OpenAI Platform API key instead of the rejected Codex OAuth fallback. #86425, #113353, #115021 (#109579, #109719, #109964, #111048, #113022, #113053, #113122, #113354, #115211) Thanks @shushushv, @Solvely-Colin, and @vincentkoc.

Wear OS companion: add the phone-proxied Wear companion with home-screen agent/session/model selection, realtime Talk controls, audio-reactive playback, and an instant-talk tile. #108781 (#108835, #109341, #109433, #109483, #110661, #111516, #112721) Thanks @sibbl, @IWhatsskill, and @Solvely-Colin.

Guided setup and local inference: guide setup across browser, Linux, and macOS with local-provider detection, strongest-model selection, downloadable models, lean mode, memory imports, and an in-process RAM-gated llama.cpp/Gemma path. #108604 (#108605, #108868, #108977, #109250, #109444, #109585, #110054, #110141, #110596, #113476)

Changes

Models and providers: add Claude Opus 5 across catalog and runtime, Kimi K3, and GPT Live realtime support with the supported Platform API authentication path. (#113391, #113392, #113633; related #113412; #113909, #113354; related #113353) Thanks @fuller-stack-dev, @vincentkoc, and @Solvely-Colin.

Local inference and setup: detect local inference providers during onboarding, add in-process llama.cpp GGUF inference and Baseten Model API support, discover models from live provider catalogs, and offer model downloads from web and macOS setup. (#108605; related #108604; #109444, #108708; related #108665; #112412; related #112405; #113476) Thanks @fuller-stack-dev.

Sessions and dashboards: add rewind/fork and branch switching across web and native chat, session boards and dashboards, archived/visibility/draft/incognito session states, and suggestion queues with typing indicators. (#110660, #110857, #110886, #111149, #110644, #110960, #112554, #112787, #113006, #113127, #113173)

Native apps: bring Quick Chat to macOS and Linux with streaming, routing, context capture, dictation, and model controls; add Linux desktop integration and signed updates; add multi-gateway apps and mobile dashboards; and expand Wear OS companion/Talk support. (#109720, #109947, #110285, #110631, #110632, #110635, #110994, #109236, #108770, #111932; related #111931; #112163, #109341, #109433; related #108781; #109483, #112721) Thanks @sibbl, @IWhatsskill, @Solvely-Colin, and @vincentkoc.

Meetings: add Teams and Zoom meeting guests, enable Teams, Zoom, and Google Meet plugins by default, and automatically collect durable meeting transcripts. (#109964, #111048, #113022, #113053, #113122)

Channels: add the Buzz plugin, Slack user-identity and Agent View modes, Telegram Bot API rich blocks and native Markdown lists, and richer Matrix formatting. (#113419, #109837, #103895; related #103673; #107986, #113158, #113199) Thanks @Patrick-Erichsen and @obviyus.

Browser and MCP Apps: add a secure per-tab browser copilot, batch browser CLI, bounded page-question extraction, a ticketed MCP App host and Control UI bridge, and manifest-declared MCP Apps for native plugins. (#109817, #111457, #113861, #109861; related #109851; #109807, #113224; related #113218) Thanks @anagnorisis2peripeteia, @FMLS, @cursoragent, @hxy91819, and @fuller-stack-dev.

Memory: add fast active-memory recall, default cross-conversation recall for personal installs, guided imports from Claude Code/Codex/Hermes, and a dedicated Memory settings page. (#108043, #110597, #108977, #114037)

Scheduling: add per-job dynamic cadence, gated script payloads, durable schedule-source streaming, cron-backed heartbeat monitors, heartbeat-task conversion, current-conversation defaults, and /loop. (#110978, #111112, #112387, #112585, #113165, #114328)

Fish Audio speech: add hosted S2.1 synthesis with streaming, voice notes, voice discovery, and telephony, plus local Fish S2 Pro reference-voice streaming in native macOS Talk. (#115790) Thanks @Rheingold777, @ImLukeF, and @Conan-Scott.

Control UI setup: continue verified model setup into Custodian, explain that the web app is ready without a channel, and offer an optional dismissible path to Channels. (#116078, #116079) Thanks @vincentkoc.

Buzz messaging: preserve Markdown and structured room content, then add room- and thread-scoped typing indicators with reconnect-safe lifecycle handling. (#116096, #116194) Thanks @shakkernerd.

Automations naming: rename the scheduler-facing cron agent tool and visible CLI/UI surfaces to Automations while retaining the compatible CLI alias. (#114841, #114854, #114853) Thanks @omarshahine.

DuckDuckGo search: move DuckDuckGo search into the plugin boundary so provider ownership, installation, and runtime behavior stay outside core. (#116740) Thanks @vincentkoc.

Fixes

Security and authorization: prevent channel allowlists from granting owner access, keep session exports inside the workspace, close a forged-marker/web-search boundary bypass, prevent non-owner ACP session exposure, reject unsafe explicit approval IDs, harden secret redaction and exec/OAuth approvals, validate downloaded install scripts, and prevent insecure secrets-plan writes. (#107403; related #104984; #104708; related #102391; #110417, #110745; related #103055; #111055, #112947, #112952, #112953, #112956, #112946, #112957, #113307; related #90013; #113707) Thanks @obviyus, @yetval, @VACInc, @pgondhi987, and @SebTardif.

SQLite and data safety: commit session indexes before transcript eviction, preserve state through maintenance races and live-WAL verification, reject invalid backups and schema data loss, make snapshot publication crash-recoverable, retain complete backups after interrupted commits, and evict only the exact corrupted cached database owner so repairs recover without a Gateway restart. (#108378, #113216; related #113209, #113210, #113211; #113287; related #113265; #113367, #113473, #113607, #114016, #114278) Thanks @yetval, @vincentkoc, @VACInc, and @rizquuula.

Channel delivery: stop Telegram durable-ingress loss across restarts and persist offsets only after spool writes, preserve Discord/iMessage/WhatsApp traffic across crashes or restarts, restore assistant context and interrupted turns after restart, suppress outbound echoes, deliver ingress retries whose queued run was dropped, report finalized Telegram previews to plugins, explain invalid native queue arguments instead of false model-failure fallbacks, validate native settings, and preserve Telegram ingress outcomes. (#107288; related #107246; #113368; related #113315; #110274, #110409, #110418, #112548; related #112520; #112562, #114058, #114531, #111341, #115891; related #115888; #116214; related #116171; #116726; related #116688; #116773) Thanks @obviyus, @carlosjarenom, @JesusSerrano-Seimako, @vincentkoc, @edenfunf, @joshavant, and @hannesrudolph.

Sessions and transcripts: preserve final replies, active turns, Codex-bound history, and transcript cursors; prevent repeated tool-call IDs from poisoning sessions; close lifecycle races and cross-agent deadlocks; keep migrated transcripts usable after restart; keep restart prompts on the active transcript tail; and preserve TUI session state across switches and reconnects. (#107799; related #106594; #110389, #110518; related #109443; #112016, #112988, #114477; related #103077, #103089, #113005, #114187; #114524, #114504, #116077, #116399, #117260) Thanks @joshavant, @lockhartheavyindustries, @flashosophy, @yetval, @realaudreyserber-afk, @hvhoon, and @vincentkoc.

Install and upgrade: preserve working installs on unsupported Node and npm 12, isolate source postinstall state, repair missing native adapters, keep versioned plugins off source paths, avoid dirty source builds, repair plugin config during upgrades, stabilize package-to-dev switches, restore production installs after the TypeBox package removal, ship documented plugin SDK typings, and discover external web-search plugins on fresh installs. (#106994; related #106870; #108100; related #107290; #111514; related #111513; #111682, #112829; related #112827; #113094, #113324, #113856, #113821, #114090, #114215; related #113975; #114327, #115292, #116333, #116345) Thanks @woohahahaaa, @fuller-stack-dev, @vincentkoc, @sallyom, @alxfyvwebaccts-png, and @pash-openai.

Provider reliability: prevent false Codex exhaustion and silent replies, honor Anthropic Retry-After, preserve selected Claude CLI profiles and adopted chats, remove the rejected Codex OAuth realtime fallback, recover stalled Claude CLI sessions without losing native cache continuity, reuse plugin metadata during model selection, bound stalled provider response bodies, and stabilize Ollama/LM Studio/local-model discovery. (#110381; related #96815; #110980, #111072; related #103849; #112458; related #95612, #107668; #113078, #113393, #114397, #114094; related #114086; #114288, #114405, #114582, #115211; related #115021; #113866, #114117, #109088) Thanks @xxw77, @yetval, @fuller-stack-dev, @cstreeter, @josh-cornelius, @lanyoung, @LeonidasLux, @BomBastikDE, @vincentkoc, @VACInc, and @SunnyShu0925.

Agent and Codex runtime: bound malformed Code Mode repair to one correction turn, preserve valid native Codex controls, keep promoted approvals from blocking unattended runs, and retain the original requester when an approval is promoted. (#115729; related #115311; #107588, #116117, #116152) Thanks @vincentkoc and @VACInc.

Cron reliability: restore one-shot and startup catch-up jobs, preserve script state and scheduled authority across restarts, accept benign same-generation updates, bind jobs to the durable store session, unblock completed jobs behind slower batches, and trim job IDs before exact lookup. (#107236, #110351; related #102236; #111292; related #111271, #111272, #111273, #111274; #112483, #113088; related #113085; #114421, #114441, #110849) Thanks @SL4N, @yetval, @joshavant, @metahacker, @efpiva, @nocodet888-arch, and @vincentkoc.

Compaction and response delivery: account for CJK text in compaction estimates and treat no_compactable_entries as a benign skip. (#114386; related #103930; #114449; related #114385) Thanks @qingminglong, @revision-co-ltd, @loulanyue, and @alfredjbclaw.

Platform and transport reliability: respect debug-proxy response backpressure, cancel early-woken meeting audio timers, preserve Windows PATH delimiters in node status, and prevent duplicate user/system systemd Gateway ownership with actionable recovery guidance. (#114076; related #105701; #114526, #114505, #116162; related #116129) Thanks @qingminglong, @aniruddhaadak80, @IWhatsskill, @vincentkoc, and @obviyus.

Channel edge cases: settle Feishu outbound delivery, surface Signal recipient failures, and support reverse-proxy paths in Matrix homeserver URLs. (#113152, #111960; related #111959; #93516; related #102885) Thanks @joshavant, @ooiuuii, and @Papilionidae.

Complete contribution record

The full contribution record is available in the tag-pinned CHANGELOG.md.

Release verification

npm package: https://www.npmjs.com/package/openclaw/v/2026.7.2-beta.7

registry tarball: https://registry.npmjs.org/openclaw/-/openclaw-2026.7.2-beta.7.tgz

integrity: sha512-raD4Z96RcZ5XY0cdtqsRRQVhPv8JOHgA4vK/0D2/BsF9czI3d5w9O1xhYGKGsNKXp+3A0HipL6oeV0zKRK/lAA==

release SHA: dabe1915362e20c25704af91612a32a8f4c96e83

full release CI report: https://github.com/openclaw/releases/blob/main/evidence/2026.7.2-beta.7/release-evidence.md

release publish: https://github.com/openclaw/openclaw/actions/runs/30738213764

npm preflight: https://github.com/openclaw/openclaw/actions/runs/30714148718

full release validation: https://github.com/openclaw/openclaw/actions/runs/30714067986

plugin npm publish: https://github.com/openclaw/openclaw/actions/runs/30738340512

plugin ClawHub publish: no normal OIDC candidates

plugin ClawHub bootstrap: dispatched separately, not awaited by this proof: https://github.com/openclaw/openclaw/actions/runs/30738341581

npm Telegram beta E2E: not supplied