v2026.3.1

Sync with upstream OpenClaw v2026.3.1

Changes

• Thin wrapper refactoring — complex Mac commands (openclaw-update, openclaw-config, openclaw-telegram, openclaw-sandbox-rebuild) are now thin shells that exec into scripts/commands/*.sh in the repo. openclaw-update auto-pulls the orchestrator repo before executing, so future logic changes take effect without manual refresh-mac-commands.sh. Simple commands (status, logs, restart, etc.) resolve VM name at runtime instead of baking it in at generation time.
• Eliminate setup.sh duplication — Step 8 now delegates to refresh-mac-commands.sh instead of duplicating ~320 lines of wrapper generation
• Filter out beta/rc/alpha tags — tag selection now uses git tag -l | grep -vE '-(beta|rc|alpha)' | sort -V instead of git describe --tags, ensuring only stable upstream releases are installed or updated
• Remove browser --no-sandbox Docker overlay — upstream v2026.3.1 (PR #29879) now passes OPENCLAW_BROWSER_NO_SANDBOX=1 to browser containers at runtime, so our image overlay workaround is no longer needed
• Update docs — fix sandbox.md and troubleshooting.md to reflect upstream fix

Upgrade for existing users

One last manual refresh (after this, openclaw-update handles everything):

cd openclaw-orbstack && git pull && bash scripts/refresh-mac-commands.sh

Upstream highlights (v2026.3.1)

• Agent thinking defaults (Claude 4.6 → adaptive, others → low)
• Gateway health endpoints (/health, /healthz, /ready, /readyz)
• Discord thread inactivity-based lifecycle (idleHours)
• Telegram per-DM topic configuration
• OpenAI WebSocket-first transport
• openclaw config file CLI command
• Browser sandbox OPENCLAW_BROWSER_NO_SANDBOX passed at runtime (fixes OrbStack crash)
• Security: webhook rate-limit pruning, SSRF protection for RFC2544 ranges

Full upstream release notes: https://github.com/openclaw/openclaw/releases/tag/v2026.3.1