v0.4.2 — Security, capability resolution, and MCP workflows

OpenClaw.NET v0.4.2 brings security hardening, vendor-neutral capability execution, and expanded MCP and memory workflows. Upgrading from v0.3.0 includes intentional authorization and configuration changes.

The v0.4.0 and v0.4.1 tags were unpublished release candidates; v0.4.2 is the first public release in the 0.4 line.

Highlights

• Gateway security: require the operator role for agent execution, bind turns to authenticated accounts, enforce owned-session writes, serialize and persist MCP App chat turns, and close the MCP App loopback/proxy authorization bypass.
• Capability execution: shared local capability resolution for native and Microsoft Agent Framework runtimes, bounded binding caches, retry/fallback handling, and binding trajectory evidence. Nacos Router and SDK events remain explicitly optional adapters; the default gateway has no Nacos SDK dependency.
• MCP workflows: per-call delegated credentials, meta-skill invocation idempotency, session metadata forwarding, structured MCP responses, and improved protocol/bridge failure handling. MCP packages are aligned at 2.2.0.
• Memory and routing: optional Fractal Memory capture/resume workflows, hosted Jev turn-routing evaluation, and local Laya tooling. Decision routing remains opt-in; local model execution and passing tests do not establish production routing quality.
• Companion and operations: the welcome tagline is “A little help. A lot of possibilities.”; consistent AgentQi Companion branding, audience controls, remote device enrollment, managed-update primitives, and refreshed MiniMax bundled profiles.
• Security maintenance and builds: fix the Go advisory GO-2026-6617 and use Go 1.26.10 for GO-2026-6809, update SignalR and PKCS dependencies for CVE-2026-70159, CVE-2026-70162, and CVE-2026-84008, centralize fixed NuGet versions, and update pinned GitHub Actions dependencies.

Upgrade notes

1. Back up configuration and durable state before upgrading. Use the normal offline backup/restore flow for installations with persistent state.
2. Grant operator to accounts that need Companion/CLI chat, agent execution, or mutating APIs. Newly created operator-account records default to the viewer role; authenticated viewers retain read-only access. Owned sessions accept writes only from their owner or an administrator.
3. Remove OpenClaw:Security:AllowViewerAgentExecution from JSON, command-line arguments, and environment variables (OpenClaw__Security__AllowViewerAgentExecution), even when set to false. Its temporary bypass has been removed; a stale key prevents startup and produces migration instructions.
4. The default capability provider is local. Existing Nacos integrations need the explicit adapter build and provider: nacos; consult the capability migration guide.
5. Vault/OpenBao secret resolution is opt-in and available in JIT gateway builds. The distributed NativeAOT gateway excludes the VaultSharp backend; vault: references fail closed there. See the Vault guide.
6. Audience restrictions apply to model context and tool dispatch; enabling them requires fresh sessions for the new policy. Managed-update rollback selects older binaries and does not downgrade persisted data. See audience, updates, and enrollment.

Downloads and distribution boundaries

Start with the desktop bundle for your platform:

Platform	Desktop archive
Windows x64	openclaw-desktop-win-x64.zip
Apple Silicon macOS	openclaw-desktop-osx-arm64.zip
Linux x64	openclaw-desktop-linux-x64.zip

Each bundle contains AgentQi Companion, the NativeAOT gateway, and the NativeAOT CLI. Standalone gateway and CLI ZIP files are also supplied. Every archive has a matching .sha256 file.

Windows and macOS signing/notarization secrets are not configured for this release, so these archives are unsigned and the macOS archive is not notarized. See the first-run and release guide for platform prompts and instructions.

Managed-update support does not imply a publisher feed is available: UPDATE_SIGNING_KEY is not configured, so this release does not publish a signed update manifest. Use the release archives directly. Dynamically loaded native .NET plugins still require JIT, and optional integrations retain their documented runtime boundaries.

Source-only optional worker advisory

The separately installed Node.js Baileys WhatsApp worker has open dependency advisories for sharp and music-metadata. That worker and its npm dependencies are not included in these desktop, gateway, or CLI archives. Operators building the optional worker from source should review the repository dependency alerts before enabling it.

Validation

Artifacts were built from 5c42ae9e5045d078ca18aceec01015701d466ec6 and verified against the identical source tree of merged main 108eb8c321dd29ee7216ce27dd234b7401ab5a74. The release tag points to that main merge commit.

• Candidate CI passed the full solution build (zero warnings/errors), 3,284 standard tests and 3,297 optional-integration tests (11 opt-in/live tests skipped in each run), 67 Laya service tests, HelloAgent, dependency isolation, patched Go vulnerability scanning, and code analysis. Pinned public compatibility, JIT/NativeAOT publishing, and the macOS modern-linker probe all passed on the candidate commit. Live Nacos acceptance passed on the base main commit; the final changes affect only Companion copy and the Go toolchain pin.
• Current NuGet audit: 43 projects checked, no vulnerable direct or transitive packages reported.
• Release documentation and the packaged-smoke fixture checks passed locally.
• Release workflow passed on all three platforms. All nine archive checksums match GitHub asset digests; downloaded macOS archives also passed SHA-256 and ZIP CRC checks, and the extracted CLI reports 0.4.2.0.
• The extracted macOS Companion visibly shows the corrected tagline and passed isolated setup, a real memory-tool round trip, stop/start reconnect, corrupt-config failure and recovery, and managed-gateway shutdown on quit.
• The full candidate CI workflow passed. Post-merge solution tests and security checks also passed; remaining post-merge publishing jobs run independently.

What's Changed

• fix: correct Companion tagline and update Go security toolchain by @Telli in #283
• fix: use supported model presets in companion setup by @Telli in #226
• Enforce AgentQi Companion desktop release contract by @Telli in #227
• Fix MCP failure propagation and add Nacos Router PoC foundation by @Telli in #235
• Enforce desktop release contract and improve MCP failure handling by @geffzhang in #236
• Secrectprovider by @geffzhang in #241
• feat: add vendor-neutral capabilities and optional Nacos adapters by @Telli in #240
• fix: enable NativeAOT Nacos events and verify live capability binding by @Telli in #242
• chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 by @dependabot[bot] in #248
• chore(deps): bump actions/setup-java from 5.7.0 to 6.0.1 by @dependabot[bot] in #249
• chore(deps): bump docker/build-push-action from 7.3.0 to 7.4.0 by @dependabot[bot] in #250
• chore(deps): bump docker/setup-buildx-action from 4.3.0 to 4.4.1 by @dependabot[bot] in #251
• feat: integrate Fractal Memory capture and resume workflows by @Telli in #243
• feat: add hosted Jev and local Laya decision routing by @Telli in #246
• feat: add audience controls, verified updates, and device enrollment by @Telli in #247
• fix: include routing rubric in Docker build inputs by @Telli in #253
• Replace Nacos live harness with .NET by @geffzhang in #254
• Laya to dotnet by @geffzhang in #255
• fix(gateway): role-gate agent execution and close /apps loopback bypass by @Telli in #256
• perf(gateway): verify each request's account token once by @Telli in #261
• test: make meta-step timeout tests independent of timer ordering by @Telli in #262
• perf(gateway): hash each account token with PBKDF2 once per process by @Telli in #264
• fix(plugins): fail bridge requests when the child exits instead of cancelling by @Telli in #265
• fix(gateway,companion): role-gate /ws/live and check role before Companion connects by @Telli in #257
• fix(gateway): run turns as the signed-in account, not a claimed sender by @Telli in #259
• feat(gateway): record session owners and restrict writes to owner or admin by @Telli in #260
• fix(gateway): run /apps/chat turns one at a time and save them by @Telli in #263
• Forward MCP app session metadata in tool calls by @geffzhang in #268
• Forward MCP app session metadata in tool calls by @geffzhang in #269
• Directory packages props by @geffzhang in #270
• fix(security): remove temporary viewer agent execution bypass by @Telli in #267
• Add repository agent guidance by @geffzhang in #271
• Stabilize Nacos retry timing assertion by @Telli in #272
• Mcp per call delegated credentials by @geffzhang in #273
• Metaskill idempotency by @geffzhang in #274
• fix: update Go dependencies for GO-2026-6617 by @Telli in #275
• fix(security): update vulnerable .NET dependencies by @Telli in #277
• chore(deps): update GitHub Actions dependencies by @dependabot[bot] in #278
• chore(deps): bump actions/setup-node from 7.0.0 to 7.1.0 by @dependabot[bot] in #279
• chore(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 by @dependabot[bot] in #280
• fix(models): prefer MiniMax M3.1 Flash in bundled profiles by @octo-patch in #281
• chore(deps): bump actions/setup-java from 6.0.1 to 6.1.0 by @dependabot[bot] in #282

Full Changelog: v0.3.0...v0.4.2