openclaw 2026.10.8

2026.10.8

Highlights

• Updates that finish and recover: an ordinary post-update Doctor failure restarts the Gateway instead of leaving it stopped, an orphaned maintenance worker no longer blocks every CLI command and Gateway start, and updates no longer abort on ACL filesystems, Windows pnpm optional-dependency links, pnpm 10 global installs, debug console logging, or a missing legacy OAuth directory. (#180668, #181695, #181141, #181596, #181456, #182850, #180174) Thanks @hannesrudolph, @SMF12138, @rayluo88, @PonySlayer28, and @VN77-77VN.
• Gateway service installs on every desktop: macOS recovers a loaded launchd registration whose plist was deleted, Linux installs under the Ubuntu default umask create a private state directory instead of being refused, and the macOS updater waits for the serving Gateway to release its databases before Doctor runs. (#180390, #179538, #182055) Thanks @avnishkirnalli and @XiaoPengYouCode.
• Conversations keep accepting messages: killed runs release their restart-recovery fence, interrupted and just-accepted child sessions recover after a Gateway restart, inbound messages stop retrying forever when the reply runtime cannot publish, and the Control UI forgotten-send retry delivers the reply instead of an authoring error. (#181992, #178888, #181871, #181300, #182219) Thanks @najef1979-code, @handcraftrc-pixel, @sukhdeepjohar, and @teddashh.
• Startup and database resilience: startup work no longer inherits a closed SQLite reader scope, so models, chat metadata and channel replies stay available; transient lock contention during agent database startup is retried; and model catalogs stay available during skill runs. (#182615, #182446, #182385)
• Security hardening: exec allowlist mode requires approval for test -v operand expansion, generic node invoke refuses browser proxy commands, sandboxed spawned children cannot run host CLI backends, the secret egress proxy rejects distrusted eMudhra chains, Fish Audio and Gradium errors no longer expose API keys, and deeply nested Tlon content can no longer stall the channel. (#180880, #179880, #178742, #179249, #178877, #177536) Thanks @eleqtrizit and @joshavant.
• Windows exec and plugins: agent exec works under S4U scheduled tasks while Store PowerShell is installed, native plugins load on machines with Endpoint DLP, and Doctor recovers dangling dependency junctions and plugins on another filesystem. (#182898, #179949, #179549, #179445) Fixes #182652 Thanks @RomneyDa, @tre1d, @coaiMax, @paulcam206, @JIRBOY, and @ceckert.
• Provider and model continuity: Codex turns keep their budget with older runtime plugins instead of silently falling back, Codex native child inference works after startup, OpenAI OAuth works with stale catalogs, Anthropic PDF analysis works with setup-token OAuth, a timed-out MCP session close no longer fails the next turn, and CLI history owner changes stop instead of silently replaying on another provider. (#182995, #176311, #181356, #178420, #182189, #180075) Fixes #181619 Thanks @RomneyDa, @kip-claw, @enki, @sasan1200, @sunlit-deng, @khensthoth, @aniketkrs, @goslingmanagment, @wr-web, and @teddashh.

Changes

• Fresh OpenAI setup: first-run model metadata no longer restricts the model picker to one model. (#175945) Thanks @matthematics1137 and @jb-dev1.

Fixes

• Channel accounts: default Slack, Google Chat, X, Nextcloud Talk and Zalo accounts keep starting and keep their secrets after a named account is added. (#176267, #180450, #182608) Thanks @555aaditya, @progerjkd, and @masatohoshino.
• Slack: an isolated invalid_auth is retried before a socket-mode channel is disabled, and silent relay network drops reconnect. (#181056, #182368) Thanks @mushuiyu886 and @marns.
• Matrix, Twitch, Zalo, iMessage and Feishu delivery: ordinary Matrix messages are no longer treated as text commands, Twitch sends normalize channel targets, Zalo DMs with URLs are handled, iMessage recovers after the Messages bridge dies, and Feishu quick-action cards send again. (#179506, #178480, #178938, #180900, #79832) Thanks @xiaopan-xydt, @doomy, @HeZ2z, @Takhoffman, @zzrs-xxxr, @namchamvinhcuu, and @xiabee.
• Agent runs and providers: heartbeat loops stop when background commands finish, temporary Codex probe workers no longer accumulate, Codex native turns stay alive during host work, Claude CLI turns no longer stall 15 minutes when stream output hits its limit, provider stream errors surface immediately, and session admission races no longer trigger model fallback. (#179060, #167390, #181839, #159931, #117397, #179347) Fixes #178937, #181805, and #178000 Thanks @maxdjohnson, @sunlit-deng, @Terwox, @AINCHORS, @robertmsale, and @davidcittadini.
• Voice and meetings: Discord realtime voice consults initialize their runtime, voice calls use the configured agent model, and long meeting talk-back replies keep their audio. (#179462, #181451, #178254) Thanks @shoaibulhaque, @yagizkus, @potoior, @BeyonceBot, and @sukhdeepjohar.
• Remote access and history: Tailscale Serve and Funnel recover after tailscaled restarts, and cron history stays readable after provider changes. (#180081, #181311) Thanks @enki, @saariuslystoned, and @xtimor.
• Doctor repairs: retained transcripts verify after heading repairs, and repair keeps the Codex host compaction model. (#179089, #179914) Thanks @mrsavingsblogspot-rgb and @LiuwqGit.
• Plugins and nodes: older plugin debounce callbacks keep working, computer use accepts input results from older Mac nodes, and Memory Wiki keeps user Notes when OKF concepts disappear. (#118011, #137755, #179657)
• Secrets and hooks: the 1Password secret provider accepts group-writable OpenClaw files, and concurrent session-memory captures no longer overwrite each other. (#181127, #181081) Thanks @jalehman, @jason-allen-oneal, and @yetval.
• Doctor recovery messages: when Doctor cannot restore a Gateway it stopped, it prints the failure and how to start the Gateway. (#181941)
• Codex native children and replies: completed or undeliverable child completions no longer replay or wedge parents, replies unblock after native children finish, are interrupted, or complete follow-ups, final answers survive transient retries, settled turns without a mirrored prompt finalize, native tool declarations stay stable, queued chats recover after plugin reloads, submitted steering commits before terminal release, and Codex accepts managed loopback proxy defaults. (#173018, #175246, #177577, #179099, #179050, #183286, #181779, #183077, #182104, #184062, #183232) Thanks @quqi1599, @Stronggenetics, @linancn, @wtfichigo, @mmartoccia, @Marvinthebored, @sukhdeepjohar, @jjjhenriksen, @aatreya, @ermaxinc, and @RomneyDa.
• Claude CLI sessions: unrelated native tasks no longer hold the final answer, parent replies finish after nested background agents, a stopped first turn keeps its conversation, room events no longer reset sessions, operators can keep native Agent and Workflow tools, resumed sessions see conversation updates, and Claude CLI models stay available with saved subscriptions. (#170322, #182267, #181966, #182273, #183765, #183059, #179203) Thanks @cassthebandit, @VACInc, @goslingmanagment, @holgergruenhagen, @xiaopan-xydt, @Marvinthebored, @scarabone, @atomsmasher81, @josh-cornelius, and @teddashh.
• Subagents and agent turns: model fallback stops after local runtime faults, recovered child results deliver after session reuse, private completion receipts reconcile after a restart, parents keep waiting for active collectors, batched tool calls settle before sessions_yield, delayed sessions_send replies are no longer cut at 4,096 characters, turns finish after tool-result recovery, messages sent during transcript rebuilds are recovered, and completed attempt callbacks are released. (#180042, #184069, #184041, #172959, #184021, #178271, #175685, #182666, #164843, #183884) Thanks @sunlit-deng, @danielsiemers, @johan-eilertsen, @jailbirt, @rjdotdev, @wr-web, @seriouslysean, @MSNexploder, and @PollyBot13.
• Gateway stability and streaming: long HTML and JSX answers, crafted Teams HTML, and replies that look like tool calls no longer stall the Gateway; reasoning tags are withheld before streaming; silent turns no longer send rich payloads; channel restarts survive exited-run cancellation; the Gateway closes after forced plugin retirement; plugin service schedules outlive the scope that created them; and cold tool inventories no longer grow memory. (#175472, #183438, #183252, #182454, #129244, #182433, #181270, #182207, #178596) Thanks @JasonBuildAI, @LeizhenZhang, @zax0rz, @JOY, @0xtc23, @bguliano, @obviyus, and @wuqxuan.
• Updates, installs and Doctor: Windows managed updates no longer lock themselves on TEMP aliases, the Windows installer runs through iex, updates complete during channel outages and keep accepted policy pins, stopped database backups allow readers, Doctor restores the Gateway after SIGHUP, keeps valid reseeded configs and inherited logins, repairs unsupported Node runtimes, recovers agents after deletion journal loss, restores plugin host links, handles very large retained histories, and uses less memory on large fleets. (#183622, #183145, #179471, #180505, #180827, #182901, #183703, #179726, #181618, #181804, #181140, #180414, #180792, #181465) Thanks @ryandle, @duyufansh2008, @waynegault, @csabatatrai, @samueltardieu, @4140leal-cw, @rybing7, @RomneyDa, @LiuwqGit, @sukhdeepjohar, and @teddashh.
• Sessions and storage: relative session stores resolve against the state directory, sessions archive through symlinked state paths, stale restart-recovery sources no longer wedge sessions, cron cleanup keeps live child sessions, archived Discord slash-command sessions restore in place, background plugin work keeps its SQLite reader, and session deletes reuse warm archive workers. (#182444, #181554, #180853, #179057, #168596, #179031, #171156, #175091, #183410) Thanks @erickj92, @Cloud-Ocean, @Oldrich333, and @PollyBot13.
• Auth and providers: rate-limited profiles cool down only as long as the provider asks, shared OAuth refreshes past deleted peers, concurrent agents keep MCP tool access while an OAuth credential is leased, utility models no longer return thinking-only replies, custom GLM providers generate session titles, Kimi K3.1 Pro gets the K3 thinking and video controls, Bedrock Mantle GPT models route through Responses, Google streams recover, and native conversations survive a compaction fallback model. (#180280, #179205, #179997, #169920, #172580, #181923, #182437, #117194, #183282) Thanks @fuller-stack-dev, @WG-Mojo, @maliv2, @danielsiemers, @jacobtomlinson, @TommyLei666, @obviyus, @rayvader, and @pstarkgit.
• Channels: Telegram and Mattermost default accounts keep their tokens after a named account is added, X accounts with capitalized keys can be managed and synced, iMessage stops answering its own self-chat replies, Feishu keeps streamed text across tool calls, Google Chat delivers remote attachments as links, Synology Chat stops reporting false delivery failures, Tlon recovers after network drops, and channel images a turn could not read are retried. (#183618, #182706, #183263, #183461, #183383, #182438, #182416, #177654, #178358, #183390) Thanks @555aaditya, @rodricksz4h5, @wangmiao0668000666, @nxmxbbd, @sukhdeepjohar, @felirami, @kentuscn, @jailbirt, @HootRock, @masatohoshino, @yetval, and @teddashh.
• Voice, apps and browser: realtime Talk survives early output and brief Gateway stalls, GPT-Live Talk and Bun realtime voice use the managed proxy, oversized macOS recordings error instead of disconnecting the node, Android chat binds to an allowed agent, the Tauri app no longer crashes before the dashboard is ready, FaceTime accepts new calls after a disconnect, the Control UI detects dead Gateway links, and browser control no longer rewrites trusted-proxy Gateway auth or holds profile leases after timeouts. (#182919, #180572, #175886, #176567, #182593, #182767, #183841, #154230, #179101, #181620, #154246) Thanks @anmol0b, @StatsR4Losers, @kybrcore, @MertBasar0, @jalehman, @CheatosBu, @xiaopan-xydt, @dawidkulpa, @Solvely-Colin, @fuller-stack-dev, and @LLagoon3.
• Config, cron and workspaces: Control UI saves accept fully masked SecretRefs, short session URLs with navigation hints load, cron jobs keep running after sending to their own target and after a hook plugin is replaced, provisioned workspaces work without templates, Windows workspace sync no longer fails before lease acquisition, trusted-proxy readiness probes succeed without forwarded headers, and restart-recovery notices no longer claim a Gateway restart. (#183571, #183148, #177518, #177825, #120943, #183064, #182823, #172843) Thanks @lonexreb, @Valkster70, @xiaopan-xydt, @2991495215, @masatohoshino, @jlapenna, @shakkernerd, @ericcaiwx-star, @treez-admin, and @obviyus.

Complete contribution record

This audited record covers the complete v2026.10.7..fdd5997 history: 162 in-range PRs + 0 retained seed-only PRs = 162 unique PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact.

Shipped baseline exclusions: v2026.10.7 (5 PRs: #147085, #164823, #165982, #167459, #181801).

Pull requests

• PR #181465 Thanks @RomneyDa.
• PR #182898 Related #182652. Thanks @RomneyDa and @tre1d.
• PR #178480 Thanks @HeZ2z and @Takhoffman.
• PR #179506 Related #179441. Thanks @xiaopan-xydt and @doomy.
• PR #180174 Related #179769. Thanks @VN77-77VN.
• PR #179949 Related #179923. Thanks @coaiMax and @paulcam206.
• PR #180880 Thanks @eleqtrizit.
• PR #181456 Related #180688. Thanks @rayluo88.
• PR #181056 Related #180942. Thanks @mushuiyu886 and @marns.
• PR #181127 Related #181115. Thanks @jalehman.
• PR #176311 Thanks @enki.
• PR #181356 Related #181353. Thanks @sasan1200.
• PR #178420 Related #178387. Thanks @sunlit-deng and @khensthoth.
• PR #182189 Related #182174. Thanks @aniketkrs and @goslingmanagment.
• PR #182446
• PR #179089 Related #178960. Thanks @LiuwqGit and @mrsavingsblogspot-rgb.
• PR #182055
• PR #179445 Thanks @ceckert.
• PR #179914
• PR #137755
• PR #179657
• PR #179462 Related #179398. Thanks @shoaibulhaque and @yagizkus.
• PR #181451 Related #181345. Thanks @potoior and @BeyonceBot.
• PR #79832 Related #79824. Thanks @xiabee.
• PR #178254 Related #178275. Thanks @sukhdeepjohar.
• PR #179549 Related #179404. Thanks @JIRBOY.
• PR #181300 Related #181152. Thanks @handcraftrc-pixel.
• PR #181695 Related #181649. Thanks @PonySlayer28.
• PR #181596 Related #181577. Thanks @SMF12138.
• PR #181141 Related #181050. Thanks @hannesrudolph.
• PR #182995 Related #181619. Thanks @RomneyDa and @kip-claw.
• PR #179880 Thanks @eleqtrizit.
• PR #178742 Thanks @eleqtrizit.
• PR #181081 Related #159826. Thanks @jason-allen-oneal and @yetval.
• PR #175945 Related #175533. Thanks @matthematics1137 and @jb-dev1.
• PR #181311 Related #180920. Thanks @xtimor.
• PR #180081 Related #148308. Thanks @enki and @saariuslystoned.
• PR #180900
• PR #180075 Thanks @wr-web.
• PR #181992 Related #181952. Thanks @najef1979-code.
• PR #182615
• PR #178888
• PR #181871
• PR #182385
• PR #182219 Related #182206. Thanks @sukhdeepjohar.
• PR #180668
• PR #180390 Related #180301. Thanks @avnishkirnalli.
• PR #179538 Related #179493. Thanks @XiaoPengYouCode.
• PR #182850
• PR #181941
• PR #177536 Thanks @eleqtrizit.
• PR #179249 Thanks @joshavant.
• PR #178877
• PR #178938 Related #175421. Thanks @zzrs-xxxr and @namchamvinhcuu.
• PR #118011
• PR #176267 Related #121446. Thanks @555aaditya and @progerjkd.
• PR #180450 Thanks @555aaditya.
• PR #182608 Related #179472. Thanks @555aaditya and @masatohoshino.
• PR #182368
• PR #179060 Related #178937. Thanks @AINCHORS.
• PR #167390 Thanks @maxdjohnson.
• PR #159931 Thanks @Terwox.
• PR #117397
• PR #181839 Related #181805. Thanks @sunlit-deng and @robertmsale.
• PR #179347 Related #178000. Thanks @davidcittadini.
• PR #180042 Related #179979. Thanks @sunlit-deng and @danielsiemers.
• PR #171156
• PR #175091
• PR #183410
• PR #169920 Thanks @jacobtomlinson.
• PR #172580 Related #171068. Thanks @TommyLei666.
• PR #173018 Thanks @quqi1599 and @Stronggenetics.
• PR #175246 Thanks @quqi1599 and @Stronggenetics.
• PR #179050 Related #178395. Thanks @mmartoccia.
• PR #179099 Thanks @wtfichigo.
• PR #170322 Thanks @cassthebandit and @VACInc.
• PR #182267 Related #182175. Thanks @goslingmanagment.
• PR #181966 Related #181945. Thanks @holgergruenhagen.
• PR #182273 Related #182177. Thanks @xiaopan-xydt and @goslingmanagment.
• PR #183765 Related #183638. Thanks @VACInc and @holgergruenhagen.
• PR #179726 Thanks @sukhdeepjohar.
• PR #179471 Thanks @duyufansh2008.
• PR #180827
• PR #182444 Related #181660. Thanks @erickj92.
• PR #179031
• PR #181270 Related #181106. Thanks @0xtc23.
• PR #179997 Related #179980. Thanks @maliv2 and @danielsiemers.
• PR #179205 Related #178908. Thanks @WG-Mojo.
• PR #179203 Related #178549. Thanks @josh-cornelius.
• PR #175472 Related #175439. Thanks @JasonBuildAI and @obviyus.
• PR #129244
• PR #182454 Related #89473. Thanks @zax0rz.
• PR #182433 Related #109659. Thanks @wuqxuan and @JOY.
• PR #181620 Thanks @fuller-stack-dev.
• PR #180505 Related #180474. Thanks @waynegault.
• PR #180792
• PR #177518 Thanks @masatohoshino and @obviyus.
• PR #177825 Thanks @jlapenna.
• PR #178271 Related #175597. Thanks @rjdotdev and @wr-web and @seriouslysean.
• PR #175685 Thanks @wr-web and @rjdotdev.
• PR #120943
• PR #182207
• PR #177654 Thanks @HootRock.
• PR #178358 Related #178357. Thanks @rodricksz4h5.
• PR #117194
• PR #154246 Thanks @LLagoon3.
• PR #175886 Related #175794. Thanks @MertBasar0 and @jalehman and @CheatosBu.
• PR #180572 Related #180426. Thanks @kybrcore.
• PR #179101
• PR #183622
• PR #183703 Related #183641. Thanks @csabatatrai.
• PR #172959 Thanks @johan-eilertsen.
• PR #182438 Related #84486. Thanks @felirami and @kentuscn.
• PR #164843 Thanks @PollyBot13.
• PR #183145 Related #183088. Thanks @LiuwqGit and @ryandle.
• PR #182823 Related #182798. Thanks @ericcaiwx-star and @treez-admin.
• PR #182901
• PR #182706 Thanks @wangmiao0668000666 and @555aaditya.
• PR #182416 Related #89430. Thanks @jailbirt.
• PR #182437 Related #108216. Thanks @rayvader.
• PR #182593 Related #127569. Thanks @anmol0b.
• PR #182767 Related #182638. Thanks @xiaopan-xydt and @dawidkulpa.
• PR #183064 Thanks @shakkernerd.
• PR #183841
• PR #182919 Related #134798. Thanks @anmol0b and @StatsR4Losers.
• PR #183618 Related #179369. Thanks @555aaditya and @rodricksz4h5.
• PR #183263 Related #183262. Thanks @nxmxbbd.
• PR #183461 Thanks @nxmxbbd.
• PR #183282 Related #183273. Thanks @pstarkgit.
• PR #183571 Related #183562. Thanks @lonexreb and @Valkster70.
• PR #183148 Related #183056. Thanks @xiaopan-xydt and @2991495215.
• PR #183390 Related #127968. Thanks @masatohoshino and @yetval.
• PR #183438 Thanks @LeizhenZhang.
• PR #183252 Thanks @LeizhenZhang.
• PR #184021 Related #128416. Thanks @jailbirt.
• PR #184062 Related #181385. Thanks @aatreya.
• PR #183884
• PR #182104 Thanks @jjjhenriksen and @RomneyDa.
• PR #172843
• PR #177577 Thanks @linancn.
• PR #183286 Thanks @Marvinthebored.
• PR #183059 Related #182649, #182711. Thanks @Marvinthebored and @scarabone and @atomsmasher81.
• PR #181779 Thanks @sukhdeepjohar.
• PR #183077
• PR #182666 Thanks @MSNexploder.
• PR #183232 Related #180719. Thanks @ermaxinc.
• PR #176567 Thanks @MertBasar0.
• PR #183383 Thanks @sukhdeepjohar.
• PR #184069
• PR #184041
• PR #154230 Related #154228. Thanks @Solvely-Colin.
• PR #181923 Thanks @obviyus.
• PR #181140 Related #180903. Thanks @rybing7.
• PR #181618 Related #181611. Thanks @samueltardieu.
• PR #181804 Related #181765. Thanks @4140leal-cw.
• PR #180414
• PR #180853 Related #180802. Thanks @Cloud-Ocean.
• PR #179057 Related #178180. Thanks @Oldrich333.
• PR #181554
• PR #178596 Related #178548. Thanks @bguliano.
• PR #168596 Related #168540. Thanks @PollyBot13.
• PR #180280 Thanks @fuller-stack-dev.

Release verification

• npm package: https://www.npmjs.com/package/openclaw/v/2026.10.8
• registry tarball: https://registry.npmjs.org/openclaw/-/openclaw-2026.10.8.tgz
• integrity: sha512-fWOIOOyddIBqeuPz82DBCdY5kNl1yD51qebAHnxlTN7SmVoH5/WSIudR/N1zDhcIIksgJXe6ZgGy5ngSRxZOrQ==
• release SHA: dc2523e5a5c7a309517fd7fa834add938231d526
• full release CI report: https://github.com/openclaw/releases/blob/main/evidence/2026.10.8/release-evidence.md
• release publish: https://github.com/openclaw/openclaw/actions/runs/40496801542
• npm preflight: https://github.com/openclaw/openclaw/actions/runs/40454683479
• full release validation: https://github.com/openclaw/openclaw/actions/runs/40454025021
• plugin npm publish: https://github.com/openclaw/openclaw/actions/runs/40498130762
• plugin ClawHub submission: https://github.com/openclaw/openclaw/actions/runs/40498135406; public finalization and exact artifact verification follow terminal release-parent completion
• plugin ClawHub bootstrap: not needed
• OpenClaw npm publish: https://github.com/openclaw/openclaw/actions/runs/40491275202/attempts/1
• npm Telegram beta E2E: not supplied
• Android APK: skipped — apps/android/version.json is 2026.8.2, release train is 2026.10.8; run pnpm android:version:pin -- --from-gateway before the next tag.