Skip to content

v2026.2.21 — Gemini 3.1, Volcengine/BytePlus, Discord voice & thread-bound subagents, 40+ security fixes

Choose a tag to compare

View all tags
@mudrii mudrii released this 22 Feb 20:03
· 90 commits to main since this release
v2026.2.21
0752d69

OpenClaw Documentation — v2026.2.21

Covers the v2026.2.19 → v2026.2.21 window (~290 commits, 832 files changed).

See CHANGELOG-v2026.2.21.md for the full synthesized review with operational impact notes.

Four major themes

  1. New model providers & per-channel routing — Gemini 3.1, Volcengine/BytePlus (Doubao), channels.modelByChannel, per-account defaultTo routing fallback. Kimi-coding implicit provider template fixed (resolves 403 errors for kimi-coding/k2p5).

  2. Discord platform maturity — Thread-bound subagents, voice channel join/leave/status (/vc), stream preview mode, configurable lifecycle status reactions (queued/thinking/tool/done/error), ephemeral slash-command defaults, forum tag management, channel topic metadata in inbound sessions.

  3. Security breadth (40+ fixes) — Heredoc allowlist bypass, shell startup-file injection, WhatsApp JID allowlist enforcement on all send paths, sandbox --no-sandbox disabled by default, noVNC observer token auth, prototype-chain traversal in webhook templates blocked, compaction retry amplification blocked (OC-65), SHA-1 → SHA-256 synthetic IDs, grep safe-bin file-read bypass blocked.

  4. Telegram, memory & cron reliability — Streaming simplified to boolean config + reasoning/answer lane split, maxConcurrentRuns now enforced in cron timer loop, QMD memory search with multilingual FTS (Korean, Japanese, Spanish, Portuguese), compaction safeguard now loads in production builds.

Documents updated

Document What changed
CHANGELOG-v2026.2.21.md New — full synthesized review with 20 numbered impact items
ARCHITECTURE.md New modules, BlueBubbles channel, Gemini 3.1 + Volcengine providers, security hardening section
DEVELOPER-REFERENCE.md 10 new gotchas (#49–58), 4 new modules in dependency map
README.md Version bump, changelog table entry
analysis/channels.md Telegram streaming, Discord voice/thread-bindings/model-picker, BlueBubbles, Volcengine
analysis/core-engine.md commands-subagents refactor, compound command display fix, invoke-system-run extraction, status-reactions
analysis/agent-system.md Thread-bound subagents, sessions-spawn-hooks, subagent-registry retry/backoff, per-channel model overrides
analysis/security-web-browser.md SHA-256 migration, --no-sandbox, noVNC auth, browser scheme blocking, WhatsApp JID
analysis/security-plugins.md system.run centralization, heredoc blocking, grep bypass, compaction counter, prototype-chain
analysis/gateway-config-infra.md Tailscale WS-only scope, unified credential resolver, BlueBubbles webhook auth
analysis/memory-cron-media.md maxConcurrentRuns fix, QMD reliability, multilingual FTS
analysis/cli-config-infra.md Auto-updater, update --dry-run, channels.defaultTo, channels.modelByChannel
analysis/cli-tools-media.md Compound command display fix, senderIsOwner propagation
analysis/utils-support.md Shared status-reactions controller, TTS opt-in, inbound metadata stripping

Covers: OpenClaw v2026.2.21

Assets 2
Loading