Five OpenClaw Main Security Changes Need Operator Attention

OpenClaw merged five distinct security-boundary changes into main: the browser relay stops transmitting its reusable key, subagent tool denials become non-overridable, Gateway diagnostics redact credential-bearing URLs, assistants receive a shared credential-handling rule, and a retired inline hook configuration is finally rejected.

They are best understood together because each moves authority back to the component that owns it. They are merged source changes, not proof that every current package is protected. Track the release that carries them.

1. Browser Relay Authentication v2 keeps the key off the wire

The old browser relay could reuse a per-host key as Bearer, Basic or WebSocket-token authentication. If the trusted relay stopped and an unverified loopback listener occupied the endpoint, a client could send that long-lived credential to the wrong process.

PR #120526 introduces nonce-bound mutual HMAC proofs. The reusable key is not transmitted; proofs bind freshness, replay protection, path, method, flow and the exact socket used for the HTTP-to-CDP upgrade. Legacy authentication survives only behind an explicit temporary migration gate.

A companion hardening change, PR #120390, rechecks that a tab still belongs to the OpenClaw tab group before authority-bearing actions. It also limits plain WebSocket pairing to loopback, requires TLS remotely and rejects embedded URL credentials or ambiguous query parameters.

Action: upgrade the relay server and clients together. Direct reverse proxies must preserve /browser/extension. Do not leave legacy auth enabled as a permanent compatibility setting.

2. Subagent hard denial is now a boundary, not a default

Before PR #120025, an allow or alsoAllow entry could re-enable tools that the subagent layer intended to deny unconditionally, including direct session communication. Resumed or dashboard-visible subagents could also regain the message tool.

The deny list is now derived from the persisted subagent role on every turn and cannot be overridden by ordinary allow configuration. message joins the hard-deny set.

Action: audit subagent profiles that explicitly allow session, messaging, Gateway or automation tools. If a workflow depended on that bypass, redesign it around the parent/announce chain rather than trying to recreate direct delivery.

3. Gateway diagnostics redact URL credentials

PR #120024 routes status, status JSON, logs errors and transport diagnostics through one redaction projection. Probe code retains the real URL internally, while displayed output no longer prints basic-auth userinfo or token query parameters verbatim.

Action: still rotate any credentials previously embedded in remote Gateway URLs if status output, logs or bug reports may have exposed them. A future redaction fix cannot retract old terminal scrollback or uploaded diagnostics.

4. Credential-safe prompts reduce solicitation, not runtime leakage

PR #120728 gives ordinary agents, Codex, Copilot and the system agent a shared rule: do not solicit or echo credentials, authentication codes or pairing codes in transcripts or visible command text; hand entry to a masked host-owned setup flow instead.

The boundary is narrower than a secret scanner. Raw promptMode: none remains unchanged, tool authority is unchanged, and the patch does not add runtime credential detection.

Action: provide protected setup surfaces and keep secret scanning, log controls and incident response. Prompt guidance is defence in depth, not a data-loss-prevention system.

5. Retired inline hook handlers require migration before cleanup

The most immediately actionable compatibility change is PR #120851. The removed hooks.internal.handlers shape could still load workspace-relative JavaScript and open internal hook discovery. Normal validation now rejects it; Doctor removes the retired registrations.

Doctor does not convert an arbitrary JavaScript path into a canonical hook package. Operators must first move each handler into a managed or workspace hook directory with HOOK.md and its handler file, verify the canonical named allowlist, and only then run openclaw doctor --fix.

The separate Plugin SDK api.registerHook compatibility path is unchanged.

Recommended order

1. Inventory browser-relay clients, direct proxies, subagent allowlists and legacy hook keys.
2. Migrate inline handlers before running Doctor cleanup.
3. Upgrade a test Gateway and matching browser clients.
4. Prove remote relay pairing over TLS and confirm unshared tabs are inaccessible.
5. Resume an existing subagent and verify denied communication tools stay absent.
6. Inspect status and logs with synthetic credential-shaped URLs; never test with a live secret.
7. Exercise credential setup and confirm the assistant hands off to protected entry.

Bottom line

These fixes close different versions of the same mistake: treating a convenience path as an authority boundary. The hook migration is the only one that demands file reorganisation, but browser clients, subagent policy and historical credential exposure all deserve explicit checks before rollout.