OpenClaw

2026.2.3

Wed, 04 Feb 2026 17:47:10 -0800

OpenClaw 2026.2.3

Changes

Telegram: remove last @ts-nocheck from bot-handlers.ts, use Grammy types directly, deduplicate StickerMetadata. Zero @ts-nocheck remaining in src/telegram/. (#9206)
Telegram: remove @ts-nocheck from bot-message.ts, type deps via Omit, widen allMedia to TelegramMediaRef[]. (#9180)
Telegram: remove @ts-nocheck from bot.ts, fix duplicate bot.catch error handler (Grammy overrides), remove dead reaction message_thread_id routing, harden sticker cache guard. (#9077)
Onboarding: add Cloudflare AI Gateway provider setup and docs. (#7914) Thanks @roerohan.
Onboarding: add Moonshot (.cn) auth choice and keep the China base URL when preserving defaults. (#7180) Thanks @waynelwz.
Docs: clarify tmux send-keys for TUI by splitting text and Enter. (#7737) Thanks @Wangnov.
Docs: mirror the landing page revamp for zh-CN (features, quickstart, docs directory, network model, credits). (#8994) Thanks @joshp123.
Messages: add per-channel and per-account responsePrefix overrides across channels. (#9001) Thanks @mudrii.
Cron: add announce delivery mode for isolated jobs (CLI + Control UI) and delivery mode config.
Cron: default isolated jobs to announce delivery; accept ISO 8601 schedule.at in tool inputs.
Cron: hard-migrate isolated jobs to announce/none delivery; drop legacy post-to-main/payload delivery fields and atMs inputs.
Cron: delete one-shot jobs after success by default; add --keep-after-run for CLI.
Cron: suppress messaging tools during announce delivery so summaries post consistently.
Cron: avoid duplicate deliveries when isolated runs send messages directly.

Fixes

Heartbeat: allow explicit accountId routing for multi-account channels. (#8702) Thanks @lsh411.
TUI/Gateway: handle non-streaming finals, refresh history for non-local chat runs, and avoid event gap warnings for targeted tool streams. (#8432) Thanks @gumadeiras.
Shell completion: auto-detect and migrate slow dynamic patterns to cached files for faster terminal startup; add completion health checks to doctor/update/onboard.
Telegram: honor session model overrides in inline model selection. (#8193) Thanks @gildo.
Web UI: fix agent model selection saves for default/non-default agents and wrap long workspace paths. Thanks @Takhoffman.
Web UI: resolve header logo path when gateway.controlUi.basePath is set. (#7178) Thanks @Yeom-JinHo.
Web UI: apply button styling to the new-messages indicator.
Security: keep untrusted channel metadata out of system prompts (Slack/Discord). Thanks @KonstantinMirin.
Security: enforce sandboxed media paths for message tool attachments. (#9182) Thanks @victormier.
Security: require explicit credentials for gateway URL overrides to prevent credential leakage. (#8113) Thanks @victormier.
Security: gate whatsapp_login tool to owner senders and default-deny non-owner contexts. (#8768) Thanks @victormier.
Voice call: harden webhook verification with host allowlists/proxy trust and keep ngrok loopback bypass.
Voice call: add regression coverage for anonymous inbound caller IDs with allowlist policy. (#8104) Thanks @victormier.
Cron: accept epoch timestamps and 0ms durations in CLI --at parsing.
Cron: reload store data when the store file is recreated or mtime changes.
Cron: deliver announce runs directly, honor delivery mode, and respect wakeMode for summaries. (#8540) Thanks @tyler6204.
Telegram: include forward_from_chat metadata in forwarded messages and harden cron delivery target checks. (#8392) Thanks @Glucksberg.
macOS: fix cron payload summary rendering and ISO 8601 formatter concurrency safety.

View full changelog

2026.2.2

Tue, 03 Feb 2026 17:04:17 -0800

OpenClaw 2026.2.2

Changes

Feishu: add Feishu/Lark plugin support + docs. (#7313) Thanks @jiulingyun (openclaw-cn).
Web UI: add Agents dashboard for managing agent files, tools, skills, models, channels, and cron jobs.
Memory: implement the opt-in QMD backend for workspace memory. (#3160) Thanks @vignesh07.
Security: add healthcheck skill and bootstrap audit guidance. (#7641) Thanks @Takhoffman.
Config: allow setting a default subagent thinking level via agents.defaults.subagents.thinking (and per-agent agents.list[].subagents.thinking). (#7372) Thanks @tyler6204.
Docs: zh-CN translations seed + polish, pipeline guidance, nav/landing updates, and typo fixes. (#8202, #6995, #6619, #7242, #7303, #7415) Thanks @AaronWander, @taiyi747, @Explorer1092, @rendaoyuan, @joshp123, @lailoo.

Fixes

Security: require operator.approvals for gateway /approve commands. (#1) Thanks @mitsuhiko, @yueyueL.
Security: Matrix allowlists now require full MXIDs; ambiguous name resolution no longer grants access. Thanks @MegaManSec.
Security: enforce access-group gating for Slack slash commands when channel type lookup fails.
Security: require validated shared-secret auth before skipping device identity on gateway connect.
Security: guard skill installer downloads with SSRF checks (block private/localhost URLs).
Security: harden Windows exec allowlist; block cmd.exe bypass via single &. Thanks @simecek.
fix(voice-call): harden inbound allowlist; reject anonymous callers; require Telnyx publicKey for allowlist; token-gate Twilio media streams; cap webhook body size (thanks @simecek)
Media understanding: apply SSRF guardrails to provider fetches; allow private baseUrl overrides explicitly.
fix(webchat): respect user scroll position during streaming and refresh (#7226) (thanks @marcomarandiz)
Telegram: recover from grammY long-poll timed out errors. (#7466) Thanks @macmimi23.
Agents: repair malformed tool calls and session transcripts. (#7473) Thanks @justinhuangcode.
fix(agents): validate AbortSignal instances before calling AbortSignal.any() (#7277) (thanks @Elarwei001)
Media understanding: skip binary media from file text extraction. (#7475) Thanks @AlexZhangji.
Onboarding: keep TUI flow exclusive (skip completion prompt + background Web UI seed); completion prompt now handled by install/update.
TUI: block onboarding output while TUI is active and restore terminal state on exit.
CLI/Zsh completion: cache scripts in state dir and escape option descriptions to avoid invalid option errors.
fix(ui): resolve Control UI asset path correctly.
fix(ui): refresh agent files after external edits.
Docs: finish renaming the QMD memory docs to reference the OpenClaw state dir.
Tests: stub SSRF DNS pinning in web auto-reply + Gemini video coverage. (#6619) Thanks @joshp123.

View full changelog

2026.2.1

Mon, 02 Feb 2026 03:53:03 -0800

OpenClaw 2026.2.1

Changes

Docs: onboarding/install/i18n/exec-approvals/Control UI/exe.dev/cacheRetention updates + misc nav/typos. (#3050, #3461, #4064, #4675, #4729, #4763, #5003, #5402, #5446, #5474, #5663, #5689, #5694, #5967, #6270, #6300, #6311, #6416, #6487, #6550, #6789)
Telegram: use shared pairing store. (#6127) Thanks @obviyus.
Agents: add OpenRouter app attribution headers. Thanks @alexanderatallah.
Agents: add system prompt safety guardrails. (#5445) Thanks @joshp123.
Agents: update pi-ai to 0.50.9 and rename cacheControlTtl -> cacheRetention (with back-compat mapping).
Agents: extend CreateAgentSessionOptions with systemPrompt/skills/contextFiles.
Agents: add tool policy conformance snapshot (no runtime behavior change). (#6011)
Auth: update MiniMax OAuth hint + portal auth note copy.
Discord: inherit thread parent bindings for routing. (#3892) Thanks @aerolalit.
Gateway: inject timestamps into agent and chat.send messages. (#3705) Thanks @conroywhitney, @CashWilliams.
Gateway: require TLS 1.3 minimum for TLS listeners. (#5970) Thanks @loganaden.
Web UI: refine chat layout + extend session active duration.
CI: add formal conformance + alias consistency checks. (#5723, #5807)

Fixes

Plugins: validate plugin/hook install paths and reject traversal-like names.
Telegram: add download timeouts for file fetches. (#6914) Thanks @hclsys.
Telegram: enforce thread specs for DM vs forum sends. (#6833) Thanks @obviyus.
Streaming: flush block streaming on paragraph boundaries for newline chunking. (#7014)
Streaming: stabilize partial streaming filters.
Auto-reply: avoid referencing workspace files in /new greeting prompt. (#5706) Thanks @bravostation.
Tools: align tool execute adapters/signatures (legacy + parameter order + arg normalization).
Tools: treat "*" tool allowlist entries as valid to avoid spurious unknown-entry warnings.
Skills: update session-logs paths from .clawdbot to .openclaw. (#4502)
Slack: harden media fetch limits and Slack file URL validation. (#6639) Thanks @davidiach.
Lint: satisfy curly rule after import sorting. (#6310)
Process: resolve Windows spawn() failures for npm-family CLIs by appending .cmd when needed. (#5815) Thanks @thejhinvirtuoso.
Discord: resolve PluralKit proxied senders for allowlists and labels. (#5838) Thanks @thewilloftheshadow.
Tlon: add timeout to SSE client fetch calls (CWE-400). (#5926)
Memory search: L2-normalize local embedding vectors to fix semantic search. (#5332)
Agents: align embedded runner + typings with pi-coding-agent API updates (pi 0.51.0).
Agents: ensure OpenRouter attribution headers apply in the embedded runner.
Agents: cap context window resolution for compaction safeguard. (#6187) Thanks @iamEvanYT.
System prompt: resolve overrides and hint using session_status for current date/time. (#1897, #1928, #2108, #3677)
Agents: fix Pi prompt template argument syntax. (#6543)
Subagents: fix announce failover race (always emit lifecycle end; timeout=0 means no-timeout). (#6621)
Teams: gate media auth retries.
Telegram: restore draft streaming partials. (#5543) Thanks @obviyus.
Onboarding: friendlier Windows onboarding message. (#6242) Thanks @shanselman.
TUI: prevent crash when searching with digits in the model selector.
Agents: wire before_tool_call plugin hook into tool execution. (#6570, #6660) Thanks @ryancnelson.
Browser: secure Chrome extension relay CDP sessions.
Docker: use container port for gateway command instead of host port. (#5110) Thanks @mise42.
fix(lobster): block arbitrary exec via lobsterPath/cwd injection (GHSA-4mhr-g7xj-cg8j). (#5335) Thanks @vignesh07.
Security: sanitize WhatsApp accountId to prevent path traversal. (#4610)
Security: restrict MEDIA path extraction to prevent LFI. (#4930)
Security: validate message-tool filePath/path against sandbox root. (#6398)
Security: block LD*/DYLD* env overrides for host exec. (#4896) Thanks @HassanFleyah.
Security: harden web tool content wrapping + file parsing safeguards. (#4058) Thanks @VACInc.
Security: enforce Twitch allowFrom allowlist gating (deny non-allowlisted senders). Thanks @MegaManSec.

View full changelog