OpenClaw v2026.5.26

OpenClaw v2026.5.26

Highlights

  • Faster Gateway and replies: startup avoids repeated plugin, channel, session, usage-cost, warning, scheduled-service, and filesystem scans; visible replies separate user-facing sends from slower follow-up work; Gateway runtime/session caches churn less under load.
  • Transcripts are core: transcript-backed meeting summaries, source-provider chunks, cleaned user turns, media provenance, Codex mirrors, WebChat replies, and CLI/TUI replay now use one more reliable transcript path.
  • More channels are production-ready: Telegram keeps typing/progress context and forum topics, iMessage handles attachment roots, remote media staging, and duplicate local Messages sources, WhatsApp restores group/media behavior, Discord improves voice playback and model picking, and Signal/iMessage/WhatsApp get reaction approvals.
  • Better voice and Talk: realtime Talk runs can be inspected, steered, cancelled, or followed up from Web UI and Discord voice; wake-name handling is more tolerant without letting ambient speech trigger agents.
  • Safer content boundaries: Browser snapshot reads honor SSRF policy, system-event text cannot spoof nested prompt markers, fetched file text is wrapped as external content, ClickClack inbound sender allowlists run before agent dispatch, stale device tokens are rejected, and serialized tool-call text is scrubbed from replies.
  • Providers, Codex, and local models are steadier: named auth profiles, OpenAI sampling params, Codex app-server resume/timeout/usage-limit recovery, dynamic tool-schema guards, xAI usage-limit surfacing, Ollama top-p normalization, and local approval resolution reduce provider-specific dead ends.
  • More reliable install/update/release paths: Alpine installs, trusted runtime fallback roots, stable update channels, Docker/package timeouts, Windows Scheduled Tasks, Windows/macOS proof lanes, Testbox/Crabbox delegation, plugin publish checks, and macOS runner bootstraps all got hardened.
  • Better observability: Activity tab, gateway secret-prep traces, tool/model stream progress, explicit fast-mode status, systemd Gateway hygiene, OpenTelemetry LLM spans, release performance evidence, and richer telemetry signals make failures easier to inspect.

Key Changes

  • Auth: add named model login profiles and supported credential migration for Hermes, OpenCode, and Codex auth profiles.
  • Channels: add Signal reaction approvals, iMessage thumb approval reactions, and WhatsApp thumb approval reaction support.
  • Diagnostics: trace gateway secret preparation, surface model stream progress, add OpenTelemetry LLM content spans.
  • Performance: cache plugin metadata snapshots, package realpaths, stable gateway metadata, model cost indexes, channel resolution, and usage-cost indexes.
  • Media: replace the Sharp image backend with Rastermill for metadata, resizing, EXIF orientation, and PNG alpha-preserving optimization.
  • Codex: update the bundled Codex CLI to 0.134.0 and keep native compaction disabled for budget-triggered app-server turns.
  • Cron: default cron.maxConcurrentRuns to 8 so scheduled automations can make progress in parallel.
  • Android/iOS: add the Android pair-new-gateway action and improve mobile Talk mode surfaces.

Key Fixes

  • Memory/security: reject prompt-like text submitted through the explicit memory_store tool before embedding or storage.
  • Gateway/security: enable the default auth rate limiter for remote non-browser and HTTP gateway auth failures.
  • Telegram: preserve inbound text entities, overlapping DM replies, account topic cache sidecars, outbound reply context, and forum topic names.
  • iMessage: read image attachments from local Messages attachment roots, dedupe duplicate local Messages-source accounts.
  • WhatsApp: restore ack identity and group-drop warnings.
  • Discord: improve voice playback, bucket large model picker menus, merge media captions into one message.
  • Codex: preserve native web-search metadata, keep oversized native thread reuse, recover context-window prompt errors.
  • Memory: prevent semantic vector indexes from silently degrading, run local GGUF embeddings in isolated worker sidecar.
  • Gateway: clear runtime config snapshot before SIGUSR1 in-process restarts, emit plugin session_end/session_start hooks on session rotation.
  • Telegram: treat /command@TargetBot bot-command entities as explicit mentions for the addressed bot.

Links

  • npm: https://www.npmjs.com/package/openclaw/v/2026.5.26
  • GitHub: https://github.com/openclaw/openclaw/releases/tag/v2026.5.26