The independent operator desk
Three merges on OpenClaw main rework how reusable exec approvals, recurring cron automations, and MCP App grants hold authority — with one breaking change that deactivates older generated approvals until you re-approve in the intended directory.
Two P0 fixes landed on OpenClaw main within hours of each other: public plugin ingress could claim owner privileges, and agents could spin up Gateway terminals that ignored session permissions. Here is what changed and what operators should do.
Merged main-branch fixes cover stale mutable hook handlers after same-size edits, external agent databases left behind by offline deletes, and browser actions that hang forever after a failed dialog handling.
Main-branch fixes stop Ollama cloud credentials being forwarded to loopback aliases, redact reflected API keys from provider errors, and keep ngrok auth tokens out of process arguments.
Merged main-branch fix forces rollback journaling on Docker Desktop, OrbStack and Podman bind mounts, ending silent WAL-over-cross-filesystem corruption risk for containerized OpenClaw state.
The newest beta channel prerelease bundles model-runtime updates, first-run setup continuation, CDP relay for paired Chrome sessions, verified external Gateway supervision, and compact SQLite backup and restore commands — with publication evidence operators can check themselves.
Long-lived Codex child agents lost OpenClaw hook policy when their parent turn ended, failing later tool calls with 'native hook relay not found'. The merged fix introduces per-turn immutable relay bindings that survive cross-turn polling without granting session-wide authority.
Merged PR #128476 replaces the startup npm-registry lookup with a ping to telemetry.openclaw.ai. Feature statistics stay opt-in, but the version ping is default-on with two documented kill switches. Here is the exact behavior and how to control it.
A merged PR deletes the hardcoded two-session cap per paired node. Capacity now defaults to one worker session per available CPU core (clamped to 1024) with an explicit config override — a significant change for anyone distributing session load across machines.
Session sharing changes, suggestion resolutions, and display-only UI activity used to reach the model as user messages or consume context budget. A merged fix routes administrative events through structured state and honors excludeFromContext everywhere.
A merged fix stops ambient environment variables from silently satisfying Feishu provider authorization when the configured SecretRef policy disallows them — closing a gap that let denied credentials reach document comments and directory lookups.
Agents could not discover platform custom emojis: the reaction emoji parameter was undocumented and emoji-list was invisible to the model. A merged feature makes custom-emoji discovery a first-class, gate-aware capability across the three major channels.
Merged PR #127699 makes Gateway runtime snapshots the sole owner of memory SecretRef materialization and stops embedding credentials, Authorization headers, and tenant headers from following requests to different endpoints — including query-distinct tenants on the same host.
A merged fix closes a Discord delivery-authority gap where canceled, suppressed, or retired replies could still emit later message parts or retry after custody changed — including caption overflow sends and every retry factory.
Backward NTP corrections could make Gateway shutdown wait indefinitely for automation runs; forward jumps could cut grace periods short. A merged fix bounds drain waits with native timers instead of the adjustable wall clock.
August 23 merges add a macOS-only realtime Gateway relay for Talk, surface its settings in the Control UI, and fix a /v1/responses defect that returned blank or clipped assistant output while chat-completions stayed correct.
When the message tool failed with proven-not-sent evidence, both the durable outbound queue and the model held the same retry, so recipients got two copies seconds apart. Merged fixes make the queue the single retry owner, including remote Gateway deployments.
August 23 merges fix cross-agent live-session stalls, transcript loss on session delete, queued replies lost during credential reloads, cron results silently dropped on network failure, and health probes that trusted a rolled-back clock.
Automatic context assembly could pull memory entries without honoring their provenance rules. A merged fix enforces provenance for automatic context, repairs legacy records before recall, and fails closed on unsupported memory runtimes.
Four merged fixes change how OpenClaw resolves secrets: configured references now fail closed, env-shorthand provenance survives gateway reads, the UI blocks empty protected secrets before save, and unused speech secrets stop blocking startup.
Heartbeat-scheduled runs no longer compete with your interactive session for the agent lane, and exec completion notifications now arrive even when the recurring heartbeat cadence is disabled. Both fixes are merged and documented in the official gateway docs.
A preflight failure or an unrelated failed wait could leave Code Mode tools restricted, blocked, or — worse — unlocked. Three merged fixes add tracked repair provenance, a read-only reconciliation turn, and tool-call-bound recovery.
A bare suffix match treated look-alike hosts such as evil1drv.ms as OneDrive and SharePoint share links, routing them into Graph authentication. Merged fixes require a dot boundary, HTTPS, and keep look-alike downloads out of the Graph auth path.
OpenClaw main adds plugin-declared selectable context windows with a 200K/1M switch in the Control UI model picker for Claude 5-series models, session-level validation, and explicit argv/env mapping.
openclaw skills update passed force:true unconditionally, replacing locally modified skill directories and deleting their backups. A merged fix verifies digests first and preserves local changes.
Broad diagnostic redaction rewrote source code inside tool results, corrupting later reads and edits. A merged fix confines redaction to diagnostics while preserving the security boundary.
Streaming OpenAI-compatible responses returned successful completions even when the agent run failed, and openclaw status printed a healthy Overview while silently substituting defaults for an invalid config.
A same-day trio on main and the pinned release: Codex sessions gain approved paired-device support, newly available account models work before the provider catalog updates, and the release branch gets the backport.
Compaction dropped real user turns, a watchdog killed active turns mid-flush and forgot queued replies, and /restart looped forever — all three merged to main on August 21.
Merged main fixes stop approvals --json from printing the exec-approvals socket token in cleartext and stop removed Claw agents from leaving their approval policies behind for the next agent with the same id.
A pruning inversion deleted eligible sessions, an ingress watchdog dead-letted timed-out Telegram messages with attempts=0, and recovery erased queued deliveries during transient adapter outages — all three are fixed on main.
The managed @openai/codex runtime floor moves to 0.149.0 with Doctor as the sole migration owner for the retired untrusted approval policy, alongside same-channel durable async delivery and three release-branch backports.
Merged main change stops external plugin tools from reaching the raw outbound adapter, adds an optional current-turn-only delivery.send capability, and revokes send authority at turn closure.
Three merged OpenClaw fixes close plaintext gateway credential writes, silent ref-mode token leaks, and secret exposure in onboarding failure output. Here is what operators should audit on installs made before the fixes.
Merged PR #122578 gives node-hosted session workers a reserved WebSocket route on the public Gateway endpoint. Operators gain an alternative to SSH tunnels and inherit a new surface to review.
The Control UI can deep-link retained run evidence, keep new-session preferences private to an identified operator and clone GitHub repositories into Gateway-managed projects.
New suspend/resume CLI controls remove a control-plane dead end, while /startupz separates traffic admission from downstream channel health and repairs bundled deployment templates.
Shared bots can isolate MCP credentials by trusted sender, but operators must explicitly choose the new identity mode, configure a public callback origin and accept a shared-channel sign-in-link tradeoff.
Provider cooldown is now scoped to the failed auth profile, user pins can rotate to sibling credentials, and cosmetic title/catalog work moves off the first-turn critical path.
A recurring no-payload Telegram failure is still unresolved; separately, main now prevents provider-confirmed exact sends from remaining ambiguous and replaying after restart.
Document, image, audio and video intake now records bounded model-visible outcomes when an attachment is unsupported, unselected, disabled, unreadable or fails processing.
A same-day routing correction makes an unset heartbeat target resolve to a configured operator DM, never a group, while failed work remains pending and stream history is finalized before alerts.
A security-boundary fix stops stored MCP refresh tokens being replayed to a different authorization server; older token-only rows may require one clean reauthorization.
The Meta provider gains Muse Spark 1.2 and a discounted Contributor variant; operators must keep confidential and personal data off the Contributor tier.
Merged fixes stop blind final-reply replay, record ambiguous delivery as durable notice debt, resume interrupted main sessions and preserve long-session context progress.
The extension is now browser-automation infrastructure with a local native-messaging bootstrap; Linux and macOS operators still load it once, while Windows keeps manual pairing.
Cloud-worker agents and operators can share a visible lease-scoped browser, while cloud sessions can now spawn and message cloud children under explicit placement authority.
Web, Apple and Android clients gain live task rows and edit counters, while the Gateway now records sinkless or requester-settled results as intentional non-delivery.
Operators can start sessions from registered projects, reorder or edit queued messages without losing attachments, and hide machine-created probe sessions from the default sidebar.
The team-scoped store now has Control UI management and stricter value validation; write-only secrets remain separate from env values exposed to agent subprocesses.
Gateway scopes, internal turns, channel approvals and delegated retries now carry canonical owner context instead of reconstructing authority from transport-shaped or client-visible data.
A transcript-backed breakdown of Sharbel's Max, Sage, Knox and Nova setup: architecture, schedules, cost claims, feedback loops and safety trade-offs.
A merged CLI feature accepts dashboard URLs, gateway shorthand and session refs in TUI and attach flows, with a new guide explaining Gateway-owned continuation boundaries.
The update path now handles live terminals deliberately, avoids duplicate plugin installation, verifies launchd restart and reports the real result in Control UI.
Builtin memory now supplements thin searches, enables diversity reranking by default and accepts glob-scoped extra paths with migration support for retired QMD collections.
A P1 fix keeps context-excluded shell output out of replay and compaction, while Telegram now respects disabled tool progress even when verbose mode is on.
Merged Slack changes carry the originating Enterprise Grid workspace through actions, slash commands, events and native approvals instead of trusting ambiguous channel or user IDs.
Two default-off Labs paths make remote coding work visible and easier to launch: a tunneled cloud-worker desktop and Start in terminal for supported Codex and Claude catalogs.
Managed updates could finalise against the caller's profile, chat history could expose raw audio or local paths, and Telegram DM tool policy could be skipped on queued or native runs.
The QMD backend, its configuration and its process/runtime surface are gone from OpenClaw main. Doctor can remove retired settings, while plugin authors also lose the withLease state API.
Steering could acknowledge before the runtime accepted the instruction, while archive could commit around active work. Merged fixes make both controls wait for the owner that must enforce them.
A chain of merged fixes stops aborted agents from restarting queued tools, preserves outbound messages without send evidence and closes duplicate-send races. Operators should test cancellation and recovery together.
OpenClaw can now install portable Agent Plugins bundles containing skills and MCP servers, with an ai.openclaw activation namespace. The portability win still carries executable trust boundaries.
Browser relay auth, subagent tool denial, gateway URL redaction, credential-safe prompts and retirement of inline hook handlers tighten different trust boundaries. One requires a manual migration before Doctor cleanup.
Merged fixes preserve OpenAI Responses compaction state across restarts, rewrites and cloud-worker handoffs, while cron maintenance now archives pruned transcripts. Long sessions need an explicit upgrade and test plan.
A merged OpenClaw change adds idle-aware countdowns, a forced deadline, one-hour holds, dev-channel auto-update and an Updates settings page. Operators should review the restart policy before it ships.
The extended-stable selector moved to 2026.6.34 with security, delivery, provider and local-runtime hardening. Here is the operator decision, the migration warning and what to verify.
Merged fixes close policy-matching, cross-context mutation, quote-attribution, callback-ownership and revoked-node capability gaps.
A P1 bundled-channel repair plus Slack and Telegram fixes change how replies, files, previews and final speech settle.
Embedded agents now block a critical loop batch, permit one corrective model response and terminate a second critical loop in the run.
The package, plugin and provider names are now deliberately distinct, with guarded migration for legacy official installs.
The reviewer now prefers bounded edits to existing skills, drops regex chat capture and keeps risky rewrites pending for operators.
Doctor and status now report redacted exporter health, while plugin-hosted LLM completions gain trusted usage attribution in OTel.
Merged Gateway and Control UI fixes keep generated media alive during long turns, settle successful sessions, and retain truthful history, timing and completed actions.
A merged classifier fix prevents ambiguous bodyless provider 400 responses from being treated as context overflow, avoiding pointless compaction and retry.
Registered Git worktrees placed directly under OpenClaw's worktrees root could be recursively cleaned as orphans; a landed fix now preserves registered checkout roots.
Merged fixes stop short interim updates suppressing full answers, bind image context to the active turn and preserve structured heartbeat replies.
Merged fixes remove unsolicited memory warmup, keep chat startup off model discovery and batch large Workboard reads so optional work cannot starve Gateway RPCs.
A P0 session-maintenance fix makes 0 disable disk cleanup, while a related reset fix prevents old model context returning after inference failure.
Operators can correlate one admitted agent execution without mistaking a multi-turn run ID for an execution ID, with bounded pseudonymized retention.
A merged fix removes post-approval model inference: the verified, hash-bound persistent operation now executes directly and only once.
Merged fixes make fresh CLI processes load the configured memory provider and carry prepared OAuth context into authenticated CLI-agent tool grants.
Merged fixes bound updater child processes, preserve plugin index state on failure and remove provider discovery from the first Control UI request path.
A merged P1 privacy fix keeps workspace-root MEMORY.md out of group and channel bootstrap context, including supported alias and hook paths.
Merged Telegram repairs route reactions through their real forum topic, persist polling progress safely and correlate outbound delivery to the explicit topic.
Two merged TUI security fixes preserve whitespace-prefixed bang messages as chat and neutralize control sequences in system-message rendering.
Merged auth fixes prevent ambient environment keys from silently taking declared-profile traffic and add persistent billing/auth cooldowns for inline provider keys.
Merged channel fixes enforce exact signed webhook targets, fail unhealthy Google Chat setup visibly, unblock durable lanes and normalize sender and owner identity.
Merged CLI fixes make gateway call honor a custom local port and stop externally supervised status checks from being retargeted by unrelated native-service metadata.
Merged liveness fixes renew outbound leases, deliver cron child results, preserve speech answers, bound xAI playback state and propagate provider cancellation.
Merged fixes preserve hostile-data provenance, keep deferred MCP failures honest, isolate oversized stdio frames and adopt canonical untrusted-filename handling.
The SMS plugin can now receive and send MMS, record signed carrier delivery outcomes and retry transient media failures without silently losing attachments.
The workspace override moved from vulnerable 5.0.8 to 5.0.9 after GitHub advisory GHSA-rgw5-rvv9-x895; source-build operators should verify the resolved dependency.
Merged fixes enforce owner-only management and reset commands, deny unauthorized conversation bindings, preserve private Discord replies and block plaintext Matrix media.
Merged agent fixes keep hostile browser and dynamic-tool content inside external-content boundaries and record downstream memory writes as untrusted.
A merged plugin SDK and Gateway change canonicalizes route identity, checks every overlap and lets required webhook owners fail startup explicitly.
Merged fixes isolate OpenRouter, memory, Ollama, LanceDB, Bedrock and Google credentials while preventing referenced secrets and provider keys from reaching plaintext logs.
Headless operators can now dry-run, archive and delete exact session keys through Gateway-backed lifecycle commands without editing SQLite.
Merged Control UI fixes recover interrupted onboarding, repair post-upgrade pairing and enforce origin checks for Tailscale-authenticated avatar reads.
Merged cron changes auto-disable repeated failures, harden delivery and preserve exactly-once scheduling across DST folds and historical timezone transitions.
Merged Memory Wiki fixes enforce conversation visibility in search, preserve handwritten notes during damaged rebuilds and keep QMD available when filesystem watches fail.
Merged agent fixes preserve queued context, fence restart side effects and retain successful child results when requester delivery is blocked or ambiguous.
Three merged browser fixes keep shared-tab sessions alive after extension reloads, wake queued shares without periodic heartbeats and permit page extraction in tab-bound runs.
The seventh 2026.7.2 beta adds Telegram directive validation and concurrent-ingress session repairs, but does not include later Aug 2 main-branch fixes.
Five merged fixes stop equivalent exec failure loops, retain delayed agent replies, protect restart recovery, serialize Discord acknowledgements and isolate transcription reconnects.
Four merged fixes preserve shell profiles, TTS and buffered media files, and node screen output when the final filesystem publication step fails.
Control UI actions now follow Gateway scopes and parameters, while host-issued dashboard handoffs deliberately bootstrap a durable owner credential with administrator access.
Merged cron fixes normalize zoned ISO and end-of-day times, while web and macOS editors preserve advanced delivery settings during clone and save.
Remote setup now probes password-only Gateways with target-bound credentials, while macOS onboarding keeps its auth gate, token recovery and config-conflict protections.
Merged cron fixes restore primary webhook delivery records, replay subsecond restart misses, preserve failure-alert account ownership and link tasks to the right transcript.
Merged fixes preserve Telegram and Zalo partial-delivery receipts, stop swallowed send errors and contain watchdog reporter failures that could terminate the Gateway.
Three merged fixes add deadlines and dispatch provenance to node-hosted exec, then report ambiguous outcomes instead of risking duplicate side effects.
Merged voice fixes preserve turn boundaries and final audio, stop stale work, close failed carrier calls and keep fast-context recall inside session visibility.
Merged session-ownership fixes prevent child completions disappearing, older runs replacing current state and prior TUI sessions interfering after a switch.
Two merged Telegram fixes move account, topic and command authorization ahead of media ingestion so rejected group commands cannot trigger attachment downloads.
Merged fixes preserve host-owned file safeguards through Matrix, Telegram, Slack, iMessage, Discord, Feishu and Teams, while preventing SharePoint filename replacement.
Merged CLI fixes make blocked updates fail, preserve JSON output, expose live channel failures and stop plugin diagnostics claiming success when warnings exist.
Three merged delivery fixes stop delayed iMessage fallback from prompting retries, preserve media paths containing spaces and keep structured Teams replies in their thread.
Merged accounting fixes preserve cached, cache-write and reasoning usage in the Responses API and honour operator-configured Anthropic model pricing.
Two merged Linux service fixes preserve quoted and backslash-containing values and parse every inline Environment assignment before Gateway startup.
The npm beta tag now points to beta.6, packaging more delivery, session and upgrade fixes while later task, memory and realtime repairs remain on main.
Five merged changes isolate hook work from saturated cron lanes, avoid blocking prewarm on large histories and restore native service commands for named profiles.
A P1 Codex repair and four related fixes stop incomplete turns looking successful, destructive steer retries, truncated exec recovery and unsafe terminal tool calls.
Merged fixes protect skill mounts, redact signed URLs, make config and mixed chat updates atomic, reject stale backups and block unsafe reset.
A coordinated main-branch repair covers duplicate session keys, resumed Codex history, persisted turns, terminal OpenAI output and child-agent ownership.
Merged main fixes preserve cancellation and rewrites across restart while waking persisted channel retries after their backoff without duplicate delivery.
A merged P1 edit-tool fix preserves original bytes outside the replacement span instead of rebuilding a matched line from normalized text.
A new operator digest covers legacy SQLite conflicts, custom Docker ports, stale authenticated tools, Code Mode recovery, model-roster startup and npm range updates.
Google startup queue and readiness fixes extend OpenClaw’s merged realtime protections against stale sessions, dropped input and runaway memory growth.
The Automations terminology stack has landed on main with a permanent cron compatibility alias, a new CLI alias and intentionally unchanged RPC, config and schedule syntax.
A new operator digest covers a destructive headless onboarding edge, lost media reply text, discarded Control UI edits and session continuity fixes for Claude CLI and the TUI.
A new main-branch inference contract gives plugins a fresh, text-only model call with zero tools, explicit model authorization and fail-closed runtime support.
A new operator digest covers an apply_patch overwrite bug, missed rollover memories, three startup failures and stricter cron webhook authentication.
A merged scanner fix reports every distinct process-execution match in a plugin file, closing a review gap where only the first executable call was shown.
A merged OpenClaw security fix makes scheduled runs fail closed when their recorded channel account has been removed instead of falling through to unrestricted tools.
Two merged main-branch fixes stop accepted WhatsApp work being deleted under queue pressure and let dropped queued runs return to durable ingress for retry.
Two merged fixes tighten the external-hook boundary: untrusted job names stay inside fenced content, while Codex relay work now follows explicit tool matchers.
Two merged main-branch fixes tighten Gateway service ownership: shell overrides no longer rewrite a managed service, and macOS refuses competing launchd managers.
Merged Memory Core and LanceDB fixes preserve rollback compatibility, make legacy backfills re-applicable, and extend recall cooldown protection to prompt building.
Main now carries four material operational fixes that beta.5 chronology cannot contain. Operators should match the fix to their failure mode, not assume the prerelease has it.
A merged Memory Core change closes cross-project recall leakage in curated files, while a separate fallback keeps keyword recall available when embeddings cannot start.
A main-branch fix replaces multi-megabyte per-session pricing fingerprints after beta.5 Gateways were shown consuming gigabytes while loading Usage rollups.
A merged main-branch fix makes durable-ingress availability part of channel health after a production Slack gateway hid more than 26 hours of dead inbound delivery.
The new OpenClaw beta packages a large state-safety and durable-delivery release. Production operators should stage recovery, channel and schema tests first.
A merged main-branch fix preserves real Promise settlement order, drains dispatched tools safely and keeps suspended Code Mode execution attributable.
A breaking main-branch change removes /phone arm leases and makes node-local enablement plus pairing the durable gate for interactive control.
A merged main-branch fix stops Matrix rooms or Signal groups whose opaque IDs differ only by case from sharing transcripts and control state in the web UI.
A merged main-branch P1 fix detects stable no-progress tool output across changing arguments, closing a gap in exact-call loop detection.
A merged main-branch P1 fix stops automatic execution review from approving Windows cmd launches that can run hidden AutoRun or persistent-shell commands.
A merged main-branch security fix stops exec allowlist analysis from approving a shell word whose escaped newline can create a different POSIX command boundary.
A merged main-branch fix adds bounded retention for trajectory runtime events after live rows consumed 85% of one long-lived agent database.
Two merged main-branch changes retire legacy auth and exec-approval JSON runtime stores, add fail-closed migration gates and make Doctor the supported importer.
A merged Control UI change makes the admin-scoped host terminal default-on. Operators who do not want browser PTY access should set the explicit opt-out before upgrading.
A merged browser automation contract prevents stale-document actions, marks snapshot deltas and exposes structured output. The safer behavior still requires caller changes.
A main-branch fix restores global webhook and chat failure destinations while preventing duplicate or cross-channel notifications. Operators should test forced failures after upgrade.
A security fix on OpenClaw main makes Vault and 1Password secret-plan writes exclusive and owner-only. Operators should protect old plans and verify the containing release.
Merged main-branch work brings Ollama and llama.cpp preparation into web/macOS onboarding and constrains setup-planner JSON on supported backends.
A merged main-branch fix makes normal routed agent replies pass through plugin rewrite and cancellation hooks before channel delivery.
Four merged main-branch changes tighten read-only diagnostics, verifier quarantine, schema upgrades and filesystem durability around OpenClaw state.
Claude CLI sessions under restrictive policy can now request human approval for native and extension tools instead of silently denying them, with Bash and timeout paths kept fail-closed.
OpenClaw now defaults GPT-5.5 and GPT-5.6 sessions to a 272,000-token runtime budget while preserving a deliberate long-context path for operators who accept the higher tier.
OpenClaw's new session model separates ephemeral chats, private drafts, read-only work and named collaboration—with enforcement at the Gateway rather than only in the UI.
Google Meet, Teams and Zoom integrations are becoming default-on, and joined meetings automatically persist speaker-attributed transcripts and summaries in SQLite unless operators opt out.
Main-branch fixes address Matrix key migration, Control UI pairing, concurrent MCP config loss, large-inode startup failures and macOS certificate trust.
A merged OpenClaw fix preserves creator-authorized Cron tool caps across scheduled, CLI and cloud-worker execution without letting the cap override current safety policy.
OpenClaw has tightened reusable command approvals and Discord sender-scoped history on main. Current npm packages predate both fixes.
OpenClaw now supports Claude Opus 5 and promotes it for new Anthropic setups on main. Packaged operators should wait for a release that includes the merge.
New main-branch code converts heartbeat tasks into cron jobs, but adjacent fixes show why source-build operators need a full state backup and a post-fix revision.
Install OpenClaw on macOS, Linux or Windows with current Node requirements, tested version checks, Gateway verification and fixes for common failures.
OpenClaw can be safe for one trusted operator, but not as a hostile shared tenant. Understand the real risks, controls and launch checklist.
OpenClaw is open source, but models, hosting and tools can cost money. Build a realistic budget and monitor token and API usage.
A merged main-branch change replaces workspace HEARTBEAT.md files with revision-safe cron scratch; existing operators should use Doctor rather than migrate by hand.
Build provenance-aware knowledge graphs for multi-agentic systems: structured extraction, entity resolution, graph assembly and grounded multi-hop retrieval.
Combine graph engineering’s durable evidence with loop engineering’s control system to build grounded, auditable OpenClaw agents.
Design reliable OpenClaw agent loops with durable state, independent verification, bounded retries, stop conditions, observability and budgets.
The January 2026 plugin milestone separated extension discovery from code execution, turning manifests, schemas and tool policy into an operator-facing compatibility boundary.
How a five-line fix made daily and idle session rollovers label old JSONL transcripts for recovery.
From late January through February, OpenClaw moved browser control behind the Gateway and tightened bridge, relay, network and token boundaries.
How cron moved from JSON files to SQLite, where the first rollout missed migration, and what the follow-up fixed.
How beta1 through beta3 changed Gateway startup, packaging, supervision, restart, authentication and remote-access operations.
How three 2026 releases separated command location, host policy and operator approval.
OpenClaw’s durable architecture emerged when a WhatsApp relay became one loopback-first owner for channels, sessions, agents and operator clients.
How OpenClaw added channels, staged package swaps and service-aware updates before June 23, 2026.
Between January and March 2026, Telegram topics evolved from reply threads into separate sessions, model routes, agent workspaces and persistent ACP targets.
Between April and June 2026, OpenClaw moved WhatsApp reliability from socket-open optimism to durable credentials, restart-aware recovery, and explicit auth ownership.
Peter Steinberger's GitHub activity across OpenClaw, CodexBar, Oracle, VibeTunnel and 169 repositories—what 64,048 contributions do and do not prove.
Merged Claw work turns experimental packages into portable agent setups with guarded cron and MCP lifecycles plus canonical CLAW.md authoring.
OpenClaw 2026.7.2-beta.3 can delete trimmed transcript rows while printing a nonexistent archive marker; a merged main-branch fix is not packaged yet.
macOS and iOS can now return to earlier transcript branches, while a branch-aware durable outbox prevents most queued-message replays onto the wrong history.
Merged fixes target Linux Codex hook process leaks, tools that ignore aborts, and Gateway RPCs that continued after cancellation—but no current npm channel contains them yet.
Merged session-attention, approval-status and live-dashboard work changes how operators supervise agents—but none of it is in the current beta package yet.
OpenClaw versions before 2026.5.28 could let workspace dotenv files override provider credentials. Here is the real exposure and operator response.
A high-volume 24 hours on OpenClaw main produced three operator-relevant clusters—but the merged work is newer than the current beta package.
OpenClaw 2026.7.2-beta.3 adds remote coding, cloud workers, external Gateway supervision and Linux packaging. Here is what operators should test.
A large SDK cleanup has landed on OpenClaw main. External plugin authors should audit legacy imports now, but packaged users should not mistake the merge for a released update.
A source-grounded account of Peter Steinberger joining OpenAI and OpenClaw moving to nonprofit foundation stewardship while remaining open source.
The source-grounded OpenClaw naming timeline: Warelay, Clawd, Clawdis, Clawdbot, Moltbot and OpenClaw, verified against official posts and Git history.
Prompt injection is not solved. Learn five attack patterns and how OpenClaw reduces blast radius with pairing, sandboxing, agent isolation and strict tool policy.
A current, source-verified OpenClaw security checklist covering trust boundaries, DM pairing, gateway exposure, sandboxing, tool policy, secrets and audits.
OpenClaw is a self-hosted AI gateway that connects models, messaging channels and tools. Learn how it works, what stays local and who it suits.