openclaw 2026.6.9

2026.6.9

Highlights

• Richer Telegram delivery: Telegram now sends rich HTML, preserves rich markdown and sticker paths, renders progress drafts and command output more faithfully, normalizes HTML tables safely, and keeps mentions and spooled handlers on the right delivery path. (#93286, #93164, #93124, #93364, #93130, #93088, #93281, #94891, #94856) Thanks @obviyus, @vincentkoc, @goutamadwant, @kesslerio, @NianJiuZst, @SweetSophia, @Marvinthebored, @aaajiao, @zhangqueping, and @jairrab.
• More dependable agent recovery: retries, terminal outcomes, usage after compaction, session history repair, and reply reconciliation now keep more interrupted or partial turns moving toward a visible final result. (#92191, #93073, #93228, #93084, #93469, #93291, #90943) Thanks @ai-hpc, @lml2468, @fuller-stack-dev, @Hollychou924, @leno23, @de1tydev, @425072024, @wuwahe3, @drvoss, @yetval, @sandieman2, and @vincentkoc.
• A stronger Codex integration: Codex gains automatic plugin approvals, GPT-5.3 Spark OAuth routing, remote-node exec as a dynamic tool, and more reliable app-server teardown and terminal outcomes. (#92625, #89133, #93654, #91767, #93287) Thanks @kevinslin, @VACInc, @vincentkoc, @JPKay-AI, and @aliahnaf2013-max.
• Standalone official provider plugins: external provider packages are now first-class npm releases, externally installed channel plugins load at Gateway startup, and StepFun is available from npm and ClawHub. (#93470) Thanks @sunlit-deng, @cxdnicole, and @vincentkoc.
• More capable web and native clients: the Control UI adds a session workspace rail and extension health, iOS adds Watch controls, and Android shows chat context. (#92856, #91952, #93387, #92837) Thanks @Solvely-Colin, @jalehman, @joshavant, and @Tosko4.
• More useful search and skills: Codex Hosted Search is available, key-free search providers remain deliberate opt-ins, and ClawHub skill installs retain verified source provenance. (#93446, #93616, #93283, #93506) Thanks @fuller-stack-dev, @davemorin, @momothemage, @nmccready-tars, and @vincentkoc.

Changes

• Providers and auth: add Codex Hosted Search, improve Gemini CLI OAuth behind proxies, and keep external provider onboarding on current choices and package metadata. (#93446, #92815) Thanks @fuller-stack-dev, @yetval, @EvetteYoung, and @vincentkoc.
• Plugins and installs: externalized official providers publish as independent npm packages, Gateway discovers installed channel plugins at startup, and StepFun installs from npm or ClawHub. (#93470) Thanks @sunlit-deng, @cxdnicole, and @vincentkoc.
• Dashboard and mobile: add a session workspace rail, plugin health in status, compact cron lists, and iOS Watch controls. (#92856, #91952, #93395, #93387) Thanks @Solvely-Colin, @jalehman, @yu-xin-c, @centralpc, @joshavant, and @vincentkoc.
• Codex, observability, and skills: add automatic plugin approvals and SecretRefs, preserve ClawHub skill provenance, add OpenTelemetry log export, and expose remote-node execution to Codex when a node is connected. (#92625, #94324, #93283, #94561, #93654) Thanks @kevinslin, @kevinlin-openai, @momothemage, @nmccready-tars, @jesse-merhi, @vincentkoc, and @JPKay-AI.
• QA and release engineering: QA scenarios now use YAML, with broader profile evidence and release coverage for the plugin and channel matrix. Thanks @vincentkoc.

Fixes

• Security and privacy: redact secrets from debug/config output, block internal HTTP session overrides, audit open-DM tool exposure, and retain plugin write ownership checks. (#93333, #88496, #93443, #92883, #93353) Thanks @Alix-007, @jason-allen-oneal, @coygeek, @RichardCao, @yu-xin-c, @cjg20ss, @eleqtrizit, and @vincentkoc.
• Agent and session runtime: retry thinking-only and empty post-tool turns, prevent duplicate hook execution, preserve pending subagent delivery, preserve fresh usage through compaction, and repair partial JSON/history artifacts. (#92191, #93073, #93009, #93084, #93469, #94349, #92383, #94257) Thanks @ai-hpc, @lml2468, @fuller-stack-dev, @zenglingbiao, @dertbv, @Hollychou924, @leno23, @de1tydev, @425072024, @wuwahe3, @drvoss, @vincentkoc, @sallyom, @oiGaDio, @Hidetsugu55, and @Nas01010101.
• Channels and replies: fix Telegram rich delivery, table rendering, action-error handling, and ingress recovery; preserve command progress detail across channel adapters; retain WhatsApp opening text after a media failure; keep Mattermost thread replies intact; and harden Discord action handling. (#93286, #93364, #93281, #93076, #93334, #93424, #93488, #94868, #94891, #94856, #94810, #93823) Thanks @obviyus, @NianJiuZst, @mcaxtr, @rushindrasinha, @amknight, @lzyyzznl, @darealgege, @vincentkoc, @zhangqueping, @jairrab, @ZOOWH, @parveshsaini, and @yetval.
• Storage and migrations: avoid SQLite WAL on network filesystems, clean reindex artifacts, keep setup state out of workspace dot-directories, and import default-agent auth profiles into SQLite. (#93454, #92891, #93182, #93295, #93520, #93156) Thanks @vincentkoc, @ZengWen-DT, @Zeng-wen, @potterdigital, @Alix-007, @Pick-cat, @sallyom, @1qh, and @Tazio7.
• Provider and model behavior: fix Gemini CLI proxy OAuth, restore Codex Spark OAuth routing, correct Bedrock embedding model IDs, and preserve configured defaults in embedded runs. (#92815, #89133, #93452, #93428) Thanks @yetval, @EvetteYoung, @VACInc, @LiuwqGit, @aleck31, @zenglingbiao, @danielgerlag, and @vincentkoc.
• CLI, TUI, and apps: accept global flags after subcommands, keep terminal output and activity indicators visible, preserve CJK IME composition, and refresh stale UI state. (#93455, #93460, #93006, #93427, #93498, #93606) Thanks @ooiuuii, @Alix-007, @ZengWen-DT, @Zeng-wen, @AlethiaQuizForge, @Zhaoqj2016, @liuhao1024, @BrianClaw1955, @vincentkoc, and @NicoBoom13.
• Operations and updates: harden official plugin recovery, restart managed Gateways after failed update handoff, keep safe cron delivery defaults, avoid Node-specific npm prefixes, and keep package validation paths reliable. (#93325, #92111, #93650, #94453, #91685) Thanks @vincentkoc, @yetval, @ofan, @yaanfpv, @jincheng-xydt, @sallyom, @davectr, and @nxmxbbd.

Complete contribution record

This audited record covers the complete v2026.6.8..HEAD history: 422 merged PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact.

Pull requests

• PR #90463 refactor: add session accessor seam with gateway consumer. Thanks @jalehman.
• PR #88656 Drop reasoning-only length turns from replay. Thanks @abel-zer0.
• PR #92856 feat(webui): add session workspace rail. Thanks @Solvely-Colin.
• PR #92845 docs(browser-control): document OPENCLAW_EAGER_BROWSER_CONTROL_SERVER requirement. Related #92841. Thanks @liuhao1024 and @jeugregg.
• PR #82366 fix: use passive periodic sqlite wal checkpoints. Related #81715. Thanks @honor2030 and @KrasimirKralev.
• PR #92815 fix(google): route Gemini CLI OAuth through the env proxy (#46184). Thanks @yetval and @EvetteYoung.
• PR #91331 fix(mattermost): merge progress preview lines by identity. Related #89761. Thanks @iloveleon19 and @leonthe8th and @vincentkoc.
• PR #92909 fix(tui): keep spinner active when toggling tools. Related #49763. Thanks @ZengWen-DT and @Zeng-wen and @vincentkoc and @CrimsonDump.
• PR #92904 fix(elevenlabs): use current TTS model ids. Thanks @vortexopenclaw and @vincentkoc.
• PR #92642 fix #86872: Subagent run reports success but fails to write output file. Thanks @zhangguiping-xydt and @vincentkoc and @zapper35.
• PR #89122 refactor: route command session reads through seam. Thanks @jalehman.
• PR #90943 fix(reply): deliver final reply when queued follow-up claims session; scope dedupe to routed thread. Thanks @sandieman2 and @vincentkoc.
• PR #92894 fix(skills): keep managed prompt paths readable. Related #92875. Thanks @kesslerio and @sallyom.
• PR #39617 fix: reload config in slash command routing so dmScope is respected. Related #39605. Thanks @Ciward.
• PR #92191 fix(agents): retry thinking-only errored turns. Related #91953. Thanks @ai-hpc and @lml2468.
• PR #92891 fix(memory): clean stale reindex temp files. Related #92874. Thanks @ZengWen-DT and @Zeng-wen and @vincentkoc and @potterdigital.
• PR #93005 Add OpenRouter Fusion guidance and prompt context. Related #92984. Thanks @sallyom.
• PR #88792 fix(state): harden sqlite path caching. Thanks @vincentkoc.
• PR #93022 fix(gateway): repair usage cost aggregation across agents. Thanks @luke-skywalker-open-claw and @stablegenius49.
• PR #93020 fix(telegram): cool down transient sendChatAction failures. Related #56096. Thanks @Boulea7 and @sumaiazaman and @Pick-cat and @cal-rufus.
• PR #89160 fix(agents): detect truncated API responses to prevent silent session hang. Related #89051. Thanks @joelnishanth and @ArthurusDent.
• PR #93009 fix(agents): make wrapToolWithBeforeToolCallHook idempotent to prevent double hook execution (fixes #92973). Thanks @zenglingbiao and @dertbv.
• PR #92991 fix(agents): tolerate missing attribution baseUrl. Related #92974. Thanks @samrusani and @Haderach-Ram.
• PR #92913 fix(opencode-go): register model catalog to fix context window detection. Related #92912. Thanks @kumaxs.
• PR #89129 refactor: route bundled plugin session callers through seam. Thanks @jalehman.
• PR #93084 fix(agents): preserve fresh usage after compaction. Related #50795. Thanks @Hollychou924 and @leno23 and @de1tydev and @425072024 and @vincentkoc and @wuwahe3.
• PR #92869 fix #90333: [Bug]: Discord image build aborts at step 66 - openclaw-build-messaging-plugins.py exits 1. Thanks @zhangguiping-xydt and @vincentkoc and @chriskosys.
• PR #93011 fix(gateway): accept file-only input on /v1/responses (parity with image-only). Thanks @yetval and @vincentkoc.
• PR #92915 Convert QA scenarios to YAML files. Thanks @RomneyDa.
• PR #91767 Fix one-shot Codex app-server teardown. Thanks @aliahnaf2013-max.
• PR #92625 feat(codex): add auto plugin approvals. Thanks @kevinslin.
• PR #91587 test(qa): add qa run --qa-profile and unified output summary/evidence. Thanks @RomneyDa.
• PR #93104 test(reply): seed channel fixtures for dedupe tests. Thanks @RomneyDa.
• PR #93107 test(reply): preserve telegram dedupe fallback. Thanks @RomneyDa.
• PR #92954 fix(memory): accept local default model path migration. Thanks @mushuiyu886 and @vincentkoc.
• PR #90936 fix(agents): do not misclassify client-disconnect abort as run timeout. Related #90764. Thanks @openperf and @reginaldomarcilon.
• PR #90812 fix(voice-call): preserve live Twilio streams in stale reaper. Related #79121. Thanks @Takhoffman and @sahibzada-allahyar and @donkeykong91.
• PR #93094 fix(whatsapp): bound socket operations. Thanks @mcaxtr.
• PR #91629 fix(scripts): add database-first legacy store guard. Related #91628. Thanks @galiniliev.
• PR #93124 fix(telegram): render progress drafts as rich previews. Thanks @Marvinthebored.
• PR #93109 test(qa): embed profile scorecard evidence. Thanks @RomneyDa.
• PR #87298 test: add temp directory helper guidance. Thanks @hxy91819.
• PR #92318 fix(cron): require explicit message target proof. Thanks @hxy91819.
• PR #93137 fix(imessage): honor disabled reply actions. Related #92142. Thanks @omarshahine and @dprev.
• PR #93134 fix(feishu): pass card_msg_content_type to get full card content (fixes #78289). Thanks @liuhao1024 and @vincentkoc and @longdoubled7.
• PR #93138 fix(agents): preserve literal current session resolution. Thanks @liuhao1024 and @vincentkoc.
• PR #91225 fix #83830: [Bug]: Dreaming diary repeats "first day" narrative every sweep - same early memories dominate snippets. Thanks @mushuiyu886 and @YinLiuLiu66.
• PR #93153 simplify QA evidence profile and mappings/coverage shape. Thanks @RomneyDa.
• PR #93164 fix(telegram): preserve rich markdown line breaks. Thanks @vincentkoc.
• PR #93119 fix: accept mixed source/dist bundled roots. Related #87730. Thanks @arkyu2077 and @vincentkoc and @jasonftl.
• PR #93130 fix(telegram): preserve sticker media paths. Related #83748. Thanks @goutamadwant and @vincentkoc and @aaajiao.
• PR #93073 fix(agents): retry empty post-tool final turns. Thanks @fuller-stack-dev.
• PR #91784 fix(voice-call): require realtime websocket path boundary. Thanks @jason-allen-oneal.
• PR #89133 Restore GPT-5.3 Codex Spark OAuth routing. Thanks @VACInc.
• PR #91996 refactor: prune unused iOS code. Thanks @zats.
• PR #90231 fix #69443: [Bug] Subagent RPC callback to WeChat session key routed to main session instead. Thanks @zhangguiping-xydt and @sliverp and @chen11221.
• PR #89920 fix(matrix): replace recovered command progress lines. Thanks @bdjben and @jesse-merhi.
• PR #93159 fix(tui): keep parent stdin paused after exit. Thanks @fuller-stack-dev.
• PR #93201 fix(auto-reply): clear pending-final state before honoring post-send abort (#89115). Thanks @amknight and @danashburn.
• PR #93228 fix(agents): replace prose terminal classifiers. Thanks @fuller-stack-dev.
• PR #93231 fix(status): correct pinned model clear hint. Thanks @hxy91819.
• PR #92428 fix(qqbot): keep markdown table chunks valid. Thanks @sliverp.
• PR #93220 fix(status): avoid stale session context windows. Thanks @hxy91819.
• PR #91957 perf(sessions): share one enumeration across archive retention sweeps. Thanks @amknight.
• PR #93281 fix(telegram): recover pid-reused ingress claims. Thanks @obviyus.
• PR #93287 fix(codex): preserve terminal outcome ordering.
• PR #93182 fix(memory): clean rollback-journal reindex temp sidecar on NFS stores. Thanks @Alix-007.
• PR #93283 Persist ClawHub skill install provenance. Related #92077. Thanks @momothemage and @nmccready-tars.
• PR #88872 fix: attribute spawned task runs to child agent. Related #66670. Thanks @Alix-007 and @Neomail2.