Get started

v2026.8.1: Security and Privacy

Sensitive work now carries more of its authority with it. Approvals stay attached to the exact request, command, session, and person that received them, removing or pairing a device again retires its old access, and protected credentials can reach supported destinations without entering model-visible text. Sandboxes, network requests, browser actions, and plugin installs also recheck the workspace, destination, document, publisher, version, or artifact they depend on, so stale or mismatched authority stops or asks again instead of being reused.

Approvals and permissions

An approval request now has one durable record shared by authorized browser and supported mobile surfaces. The first valid answer settles it, reconnecting cannot revive a completed request, abandoned requests are cancelled, and aborting a run clears the approvals it left pending. Operators can also opt in to installed Control UI PWA approval alerts that open the authenticated request, with the subscribed device, person, current role and scopes, preferences, and request visibility checked again before delivery. Resolved or expired requests replace stale actionable alerts, while optional agent and task alerts remain off by default.

Recurring automations can now show their standing grants in the approvals page and CLI, including the owning automation, exact command, use count, and current state. Revoking an active grant takes effect at the next spawn boundary so the next occurrence asks again, and managed deployments can set the default lifetime used for future grants. Reusable command permission can still bind to exact arguments and a working directory, while script-backed commands recheck the bytes that were reviewed before they run. The binding covers the reviewed command and script bytes, while interpreters and changing dependencies can introduce separate behavior; opaque wrappers and commands that can launch something else may ask again.

Each session can choose read-only, guarded, workspace, or full access and override MCP servers, skills, or web search where the client exposes those controls, with full access reserved for administrators. Per-turn exec restrictions can tighten that session policy but cannot loosen it, and Doctor provides a migration path for the older persistent exec fields. Scheduled and delegated work retains its originating policy, and an uncertain result from another machine is reported as unknown instead of being retried on a guess.

Per-session controls are nonretroactive, so existing sessions without a permission mode keep the previous global posture. Opt-in roles limit collaboration inside one trusted OpenClaw installation rather than creating isolation between hostile tenants.

Sources and complete change list

Improvements

Persist one canonical operator approval lifecycle #103579
Open approvals from a secure standalone link #103698
Add metadata-only message lifecycle audit history #103903
Make approvals durable across sessions and mobile clients #104837
Review durable exec approvals from Android, iPhone, and Apple Watch #104913
Show plugin approvals as native iPhone notifications #108709
List and resolve pending approvals from the CLI #111060
Manage channel DM access requests in the Control UI #112401
Show full plugin approval details in the Control UI #113027
Let prompt hooks narrow the tool surface for one turn #114151
Make node control enablement durable #114892
Add per-session controls for MCP, skills, and web search #115785
Inspect the identity behind an exact agent execution #117034
Inspect durable run identity in Control UI #119810
Explain operator approval outcomes in audit inspection #119815
Bind agent and worker authority to each admitted run #120534
Explain outbound message delivery in audit inspection #123709
Add per-session permission modes and worktree containment #124909
Let team operators use administrator-provisioned cloud runners #125787
Audit exact-bound owner-native lifecycle receipts #126082
feat(gateway): generic operator roles for non-maintainer access #128548
feat(audit): record session action decisions #129093
feat: add secure PWA approval notifications and preferences #129348
feat(approvals): scoped standing grants make recurring cron automations approvable once #129526
feat(approvals): typed approval scope summaries on channel cards #130116
feat(security): warn on inert mutable allowFrom entries #131129
feat(approvals): standing-grant ledger, revocation, and configurable terms #131602
Send plugin approval notifications to paired iOS devices #108505
Add authored routing checks to Policy #111087
Add bold labels to approval prompts across messaging channels #113193
Reuse session-store lookups during mutation authorization #114736
Allow write-scoped creation of contained worktrees #125598
feat(audit): explain plugin and remote actions #126027
feat(audit): record admitted model routing decisions #129092
feat(audit): record generic tool action decisions #130358
feat(ui): label the configured default in the session permissions picker #132989
Make approval request ownership explicit and backward-compatible #125084
improve(ui): add permission docs link to picker #131152

Bug fixes

Bind worker permissions to exact lifecycle claims a0278af
Preserve tool restrictions across agent lifecycle transitions b5809f5
Require Doctor approval before importing state across directories #103247
Prevent automated Doctor runs from moving approval state #103353
Bind exec auto-review to exact commands and approvals #103430
Prevent exec approval revocation races #103515
Add typed cross-surface approval actions #103679
Reject delayed Mac executions after approval policy changes #103968
Keep cron trigger scripts within creator tool permissions #104430
fix: keep command cron jobs operator-scoped [AI] #106057
Require explicit owner authority for privileged commands #107403
Keep Gateway-owned recovery and approvals in process #108423
Keep approval policies isolated by state directory #108742
Separate Discord voice admission from owner authority #108813
Scope ACP session listings to the current sender #110745
Cancel pending approvals when a run is aborted #110993
Make missing-permission errors consistent across Gateway clients #111013
Stop silently rerunning failed Gateway turns locally #112074
Unblock approvals after the first successful notification #114022
Move exec approvals from lock files to shared SQLite #114063
Require approval for startup-capable shell wrappers #114519
Require human approval for opaque shell commands #114558
Require confirmation for ambiguous automatic command reviews #114681
Reconfirm voice actions after policy or hook rewrites #114721
Defer failed command auto-reviews to human approval #114802
Prevent Codex approval promotion from blocking unattended runs #116117
Prevent automatic retries after ambiguous node commands #117276
Align Control UI session actions with operator permissions #117920
Keep delayed Control UI commands on their originating Gateway #118019
Bound pending approvals and preserve notification order #118252
Require explicit owners for Reef management #118578
Enforce configured Microsoft Teams approval owners #118967
Make sub-agent hard-denied tools non-overridable #120025
Enforce Telegram direct-message tool restrictions #120992
Keep approval requests on their owning channel account #121673
Enforce exec restrictions in Claude live sessions #121678
Fence cron execution with durable run receipts #122948
Let trusted local devices widen scopes without approval dead ends #124589
Bind command approvals to reviewed script bytes #124858
Preserve caller tool authority when updating cron jobs #125180
Keep voice-only Talk consults read-only #125392
Enforce session participation through lifecycle commits #125889
Restrict owner-only tools on inbound voice calls #125953
feat(ui): explain decision receipts in Activity #126007
Make Full access sessions run without OpenClaw approval prompts #126210
Preserve AGENTS.md in tool-restricted Codex turns #126891
Revalidate scoped cron ownership before locked mutations #127042
fix(exec): align Guardian approvals for bound compound plans #128279
fix(codex): unify conversation permission policy #128464
fix(agents): enforce session permissions for shared terminal input #129604
fix(exec): scope reusable approvals to their working directory #129636
fix(file-transfer): keep remembered approvals exact #129762
fix(agents): preserve compaction prompt tool policy #130337
fix(agents): release cancelled runs during credential refresh #130856
fix(ui): show Codex node approvals in the controlling chat #131829
fix(agents): preserve tightening exec overrides on moded sessions; unify permission reverse map #132675
fix(agents): enforce native MCP tool policy #133089
Keep delegated channel actions inside allowed conversations #99905
Bind Copilot active runs to host tool authority 0fa3548
Bind steering authority to the active model route 129c06d
bind active Codex steering to tool authority 1bb20fb
Keep pending replies safe across agent route changes 42b74b2
Preserve replies to pending agent questions after authority changes 54cf346
Keep restricted Codex capabilities disabled in isolated sessions d183d06
Route concurrent ACP exec approvals to the matching prompt #101037
Apply configured group scope to the QQBot channel API #101765
Keep approved subagent exec follow-ups alive through cleanup #101830
Keep failed plugin binding approvals out of trusted memory #101906
Restore execution approvals for Mac App nodes #102688
Require heartbeat messages to name a recipient #103711
Restore owner-only tools for local CLI agent runs #103922
Report actual Mac node exec-approval defaults #103945
Reject delayed exec approvals after persisted policy changes #103950
Enforce Slack sender policy in group DMs #104007
Close expired macOS execution approvals #104302
Require admin approval for browser-proxy nodes #104491
fix(gateway): allowlist default-model config edits and explain protected-path refusals #106071
Keep queued chat settings on their original Gateway connection #106901
Use native Clack prompt and cancellation contracts #107286
Root-run Claude live sessions use a supported permission mode #107606
Prevent stale rescue approvals from applying older changes #108147
Show configuration changes in migration previews #108556
Block external WebChat checkpoint branching #108678
Deny undeliverable exec approvals without the long wait #108935
Preserve native binary approvals after short reads #109485
Standardize channel access checks and preserve media fallbacks #109548
Prevent unrelated admin actions from sharing one rate limit #109557
Preserve sender-scoped tools across delegation #110345
Clarify CLI timeouts and prevent unsafe transient retries #110369
Refresh Discord member roles after join or leave #110414
Add structured missing-scope authorization errors #110925
Authorize WebChat session changes by operator scope #110931
Reject unsafe explicit Gateway approval IDs #111055
Preserve explicit approval IDs for validation #111388
Require admin scope for keyed session model changes #111651
Keep exec approvals scoped to carried commands #111652
Enforce restricted cron tools for Claude CLI #112457
Bind reusable exec approvals to exact arguments #112946
Require approval for commands behind opaque wrappers #112953
Require approval for hidden commands in additional shell wrappers #112955
Keep more inline interpreter approvals one-shot #112956
Complete approved TUI operator-scope upgrades #113644
Honor deny fallback for shell-expanded exec commands #113892
fix(agents): apply session access changes without restart #114027
Block unmodeled command-wrapper executables #114132
Require approval for escaped-newline shell words #114134
Require transparent Windows cmd startup for auto-review #114652
Stop cancelled command reviews and harden PR automation #114745
Make Cron browse-only for read-only operators #115091
Stop cancelled remote-node commands before or during dispatch #115176
Make schema and approvals recovery errors actionable #115232
Stop cancelled node commands before execution #115373
Enforce a consistent Code Mode tool surface for OpenAI requests #115460
Stop repeated macOS exec-approval migration retries #115502
Require spoken confirmation and restore steering for GPT-Live Talk #115562
Deny scheduled tools after the creator account is removed #115932
Require approval for abbreviated inline-eval flags #116529
Keep owner-only tools out of non-owner skill commands #116532
Make Logbook honor the screen-capture deny control #117803
Block unauthorized Telegram command media before download #117821
Enforce canonical authorization for session resets #118580
Keep conversation compaction free of hosted tools #118618
Block unauthorized Discord and Telegram binding access #118704
Match Control UI actions to Gateway permissions #119286
Apply the exact approved system-agent operation #119389
Apply Slack channel policies after session ID normalization #119408
Require scoped routes for delegated Microsoft Teams channel reads #119632
Align Gateway hello scopes with active RPC access #120888
Fail closed on denied Teams group access #121086
Deliver exec approval-unavailable notices durably #121179
Restore local exec and plugin approval prompts for older pairings #121529
Restrict Matrix verification actions to owners #121532
Align DM security diagnostics with effective routing #121741
Keep unrelated Codex tools available under channel denies #122282
Exclude inherited data from execution-identity audits #122418
Confirm before permanently removing Automations #122505
Keep exec approval prompts in their source channel #122517
Publish timer-expired approvals to reviewer surfaces #123950
Keep routine Codex YOLO commands approval-free #124069
Publish approval expiry after lookup or reconnect replay #124087
Prevent cancelled approvals from replaying #124381
Keep Codex delegation when image generation is denied #124598
Restrict tool events to subscribed sessions #124732
Restore worker dispatch with session permission containment #125326
Keep the privileged macOS elevation host CUA-free #125408
Keep node-hosted agent tools on policy-filtered surfaces #125434
fix(system-agent): reject a second staged proposal instead of overwriting the first #125672
Show effective exec approval policy in Devices #125756
Alert operators when widget access decisions fail #125934
fix(policy): scan keyed agents.entries in sandbox, tool, and workspace evidence #126935
fix(claws): remove exec approvals when a Claw agent is removed #127365
fix(gateway): keep rootless sessions usable after permission changes #128149
fix(gateway): enforce control-plane limits on cron mutations #128287
fix(tui): keep action prompts scoped to their session owner #129044
fix(whatsapp): keep QR login owner-scoped #129381
fix(gateway): stop fabricating scope-upgrade requests on trusted-proxy reconnects #129563
fix(gateway): tools.invoke must carry the caller's host-minted role authority #129725
fix: stop widget approval prompts outside Guarded mode #129970
fix(gateway): permission modes work on rootless sessions via workspace default root #129994
fix(agents): add denial guidance to plugin approval rejections #130009
fix: dashboard tools target the wrong Gateway after admission #130112
fix: dashboard changes succeed after Gateway authority is retired #130131
fix: board tickets remain valid across Gateway replacement #130171
fix(codex): Fix codex apps disappear when plugin is in read-only or prompt mode #130394
fix: filter watched-session presence by recipient visibility #130764
fix(gateway): approval card never appears for Codex node execution started from a single Control UI window #130967
fix(configure): preserve unrelated gateway auth policy across reconfiguration #131035
fix(gateway): admin-only roles reject valid scope upgrades #131410
fix: expired Talk voice confirmations accumulate and slow every confirmation check #131474
fix(exec): automation exec-approval denials no longer point at the TUI #132237
fix(acp): replay approval decisions made during a gateway disconnect #132261
refactor(exec): retire legacy session execSecurity/execAsk; doctor migrates to permission modes #132740
Fail closed on stale plugin approval waits #88203
Auto-approve read-only flags for default safe bins #88953
Restore allowed shell tools in restricted Codex turns #92294
Require consent before exposing xAI-billed tools to non-xAI models #97629
fix(system-agent): tell messaging users a delegated approval can't be applied from chat (#116519) (#117432) 23a681e
Preserve 1Password authorization across execution handoffs 30738a3
Show unavailable Apple Watch approval state without a pending count ae3008c
Correlate prefixed outbound audit conversations #104816
Reject malformed attach grant TTL values #105103
Preserve pending 1Password tool authorization #107275
fix(gateway): reject altered approval history cursors #111251
Preserve target-agent tools with alsoAllow-only policies #114530
Back off macOS approval-socket retries #116125
Prevent stale sharing updates after switching connections #116837
Let write-scoped operators delete archived sessions #117468
Keep embedded TUI plugin approvals working when a listener fails #117479
Enforce Feishu cross-context limits for message mutations #119845
Hide Wear model controls without administrator access #120016
Centralize interactive plugin dispatch and binding authorization #120062
Let write-scoped operators change the current session model #120875
Fence exec approvals with the agent deletion journal #121273
Make Gateway tool denies apply across aliases #123847
Keep approvals JSON failures parseable #124585
fix(policy): derive exec posture from mode #124797 #125457
Report approvals writes truthfully #125960
Preserve profiles and containers in policy recovery guidance #126710
fix: keep Code Mode restricted after an unrelated failed wait #128098
fix(gateway): revalidate node command policy at the transport handoff #128576
fix(agents): prevent invalid session filters from listing every session #129198
fix(gateway): point admin auto-approve warnings at identityScopes #129538
fix(windows): ACP workers hang forever on permission prompts when the Gateway runs as a hidden-console service #129637
fix(ui): serialize remote session permissions before sending #129674
fix(command-explainer): bound walk recursion depth to prevent stack overflow #129891
fix(audit): report denied exec approvals only once #130560
fix(ios): restore approval settings navigation and remove duplicate shell state #130651
fix: worktree tasks inherit configured permission defaults #131547
fix(gateway): allow write-scoped plugin Talk actions #131576
fix(gateway): honor native Stop run ownership #132892
Clarify why “Allow Always” is unavailable #97740

Documentation

docs: clarify IMAP recovery and reader tool policy #131039
Document 1Password authorization and failure codes 13c7cf4
Clarify computer.act authorization and operator scopes 5b20013
Clarify dynamic Gateway operator scopes #122931
Warn when exec policy reports omit session overrides #94999

People, devices, and pairing

Pairing authority now lives on the device record. Removing or pairing a device again retires its old connection and worker access, non-admin device tokens can manage only their own pairing, macOS and Android can review pairing state, and administrators can create a short-lived one-paste command for joining a machine.

Automatic browser enrollment behind a trusted proxy remains off until enabled and stays within configured role and access limits. Verified proxy or Tailscale identity applies only to the current connection instead of rewriting durable pairing. The separate SSH identity check for private-network machines is on by default and follows normal OpenSSH HostName rules, so operators who want manual-only pairing must disable it and leave CIDR auto-approval unset.

Participant, session, agent, and requester identity now travels with more of the work for attribution without widening access. Managed GitHub identities apply to local command-line and API work and author metadata, while Git transport, sandboxes, remote machines, and cloud workers continue to use their own identity paths.

Sources and complete change list

Improvements

Unify macOS pairing requests in one approval panel #102601
Auto-approve node pairing with SSH identity verification #104180
Make Mac pairing approvals native and instant #106091
Manage device pairings from the Android app #111014
Auto-approve trusted-proxy browser device pairing #111189
Use durable profiles for shared-gateway identity #111311
Manage model-provider credentials per agent #111796
Add controls for local pairing and failed loopback authentication #115959
Persist per-origin device credentials for remote Gateways #120533
Isolate named macOS app profiles #121136
Grant operator scopes by verified identity #121531
Connect new machines from the Where picker #122635
Bind channel participant identity to admitted executions #122863
feat(channels): grade sender identifier authentication in the ingress kernel #123782
feat(plugin-sdk): publish identifier authentication contract #123793
Connect node hosts through Cloudflare Access #125193
Configure system and per-agent GitHub CLI identities #125199
Credit linked session participants as Git co-authors #125827
Authorize system and per-agent GitHub identities from Settings #126474
Add durable human-friendly names for paired devices #94517
Add bulk pairing decisions to the Mac app #104011
Group session providers in macOS pairing prompts #109320
Carry authenticated user identity into Gateway presence #111179
Add durable user profiles for shared gateways #111224
Allow explicit full-admin auto-approval for trusted shared gateways #111509
Record durable parent-child lineage for spawned subagents #122015
Attribute authenticated users in Gateway run audits #122484
Make shared auth store ownership explicit without moving credentials #123298
Retire the legacy Control UI device-auth migration window #124667
Preserve requester identity for delegated agent creation #124963
Make the per-agent GitHub identity panel easier to understand and use #125472
feat(control-ui): show client IP and time zone on the activity identity card #128438
feat(profile): enable Git co-author credit by default #131964

Bug fixes

Consolidate node capability approvals into device pairing records #103120
fix(agents): reject forged plugin owner authority #104872
Restrict node pairing management to the caller's device #104989
Retire stale node authority after re-pairing #109647
Retire deleted agents transactionally #111678
Auto-approve trusted-proxy scope upgrades for the same browser key #111916
Require an owner-issued ticket for Telegram dashboard launches #112292
Preserve Control UI access during device-auth upgrades #112558
Prevent silent agent roster loss during config writes #114054
Make multi-agent ownership explicit #114388
Restore Gateway service commands for named profiles #116314
Allow device authentication with skewed client clocks #116679
Distinguish session ownership lookup failures from policy denials #117305
Keep Discord transcript capture on the authorized bot account #118579
Complete the mobile pairing code lifecycle #120933
Preserve operator ownership of Codex input requests #121171
Scope Slack Enterprise policies by workspace #122346
Preserve selected-agent ownership for background work #123257
Honor explicit agent ownership across system surfaces #123339
Keep Codex available on explicit multi-agent Gateways #124172
Preserve context-engine session ownership across agent lifecycle paths #124376
Reject invalid agent IDs instead of targeting main #124670
Replace stale service selectors on profile switches #124790
Restore per-agent configuration across plugin-backed runs #124978
Verify GitHub identity automatically from authenticated sign-in #126114
Preserve agent ownership for live Gateway events #126608
Clean agent approvals and references during deletion #127037
Adopt accepted Reef friend requests safely 6315dd8
Keep foreground node pairing alive until approval #105038
Stop known-node alerts replaying after Gateway restarts #110391
Classify system agents so clients do not offer them for selection #111920
Identify iOS apps running on Macs correctly #112744
Preserve verified owner access for OpenAI-compatible HTTP calls #113638
Enforce one authenticated client owner per Gateway socket #114196
Preserve agent and session identity in tool-result middleware #115821
Keep each agent's cron and model state separate #116771
Preserve session attribution across node runs #116792
Keep execution audit attribution exact across lifecycle generations #116796
Isolate OpenResponses history by verified proxy user #118607
Adopt Tailscale names and avatars into user profiles #119479
Keep hook-triggered heartbeat work with its target agent #119817
Scope hook-triggered heartbeats to the intended agent #119819
Require explicit identity in agent audit events #120325
Harden ACPX generated-wrapper leases and restart cleanup #121016
Show the outcome of cross-device token rotation #121361
Preserve authenticated speaker identity in Codex turns #121511
Reject nonexistent explicit session targets #122564
Refresh GitHub results after credential changes #122613
Preserve system-agent ownership in Gateway background work #122987
Keep targetless Gateway events with the configured system agent #123317
Preserve explicit ownership during Codex migration #123331
Revoke device workers when pairing authority is removed #123696
Audit only the workspaces owned by explicit agent fleets #123878
Fully clean up nodes when their token is revoked #124117
Keep auth-none local Gateway clients connected after pairing #124545
Make agent exec use the configured system-agent owner #124697
Restore Control UI device pairing on plain HTTP #124724
Show agent creation hierarchy in the Control UI #125032
Preserve audit identity across repeated Gateway restarts #125052
Reuse authoritative state and protect rotated device credentials #125145
Restore system-agent ownership for unscoped operator reads #125318
Keep Matrix authorization identities case-sensitive #125432
Load dashboard icons with paired-device credentials #126200
Preserve caller identity for nested session tools #126221
Honor the configured system agent for unscoped work #126504
Reject unknown agent IDs across operator CLI selectors #126983
Clean up cron jobs during offline agent deletion #127075
fix(dashboard): refresh custom HTML widgets by owner #128489
fix(workers): reject conflicting placement identity #128670
fix(gateway): keep patch-created sessions visible to their creator #128774
fix(codex): restore GitHub tools in Codex sessions #128807
fix(gateway): keep verified GitHub users online during outages #128833
fix: restore GitHub tools in managed Codex sessions #128937
fix(webhooks): keep TaskFlow child actions within the owning session #129633
Add informed loopback consent to trusted-proxy setup #131132
fix(gateway): retain rejecting resolver ownership across dispatch #132090
fix(sessions): keep creator rights tied to qualified profiles #132300
fix(worker): reject malformed protocol records #133123
Keep the macOS app paired after OS version updates #89702
Accept shared macOS platform pins for local nodes #105311
Reject unknown session agents without provisioning stores #111178
Keep mixed-role trusted-proxy pairings pending #111394
Bind system-agent chats to their authenticated callers #111565
Restore explicitly authorized agent deletion #114099
Show copyable device IDs in the devices list #114370
Show outcomes for user-profile CLI actions #117466
Preserve renamed node labels during reapproval #117608
Prevent random 404s on device-pairing links #123182
Reject unbound legacy session keys for agent authority #123222
Preserve hook ownership during early Gateway failures #123323
Explain Reef pairing version mismatches #123498
Remove stale database registry rows when deleting agents #124347
fix(agents): persist sender identity for direct-message turns #124548
Refresh device labels after rename #126432
fix: usage dashboard fails on legacy global sessions #129011
fix(tui): prevent stale picker selections from changing the wrong agent #129032
fix(nodes): approve silent initial node surfaces and name the pending surface approval #129795
fix(config): reject agents.entries keys that collide after id normalization #131083
fix(security): recognize loopback trusted proxy authentication #131196
fix: show GitHub public names for online people #131579
fix(gateway): reject stale node work before enqueue #132909

Documentation

Remove obsolete node pairing token references #103140
Correct the pairing setup-code expiry contract #103943
Correct headless node identity and pairing guidance #103964
Document proxy scope caps on auto-approved devices #111228
Clarify loopback Control UI authentication and recovery #112746
Remove retired Control UI auth references from Policy #114014
Explain Control UI pairing in private browser profiles #114111
Correct the documented node pairing storage model #124571
Recommend Cloudflare Access service tokens for nodes #126536

Secrets and private data

The new team-scoped local Secret Store separates Protected values from Agent-readable environment values. Supported masked requests, Vault or 1Password references, and destination-bound substitution can keep a protected credential out of plaintext configuration and model-visible text while placing it into an approved Gateway-hosted HTTPS request. Masked credential requests on the web, iOS, and Android now preserve the exact entered value and operator-edited destination, refresh affected providers after the value is saved, and close the request and its protected connection with the run that owns them. Agent-readable values are a separate grant for Gateway-hosted commands and can still be printed or transmitted by the command that receives them.

Changing a Control UI Gateway URL to a different credential scope now clears the previous endpoint's password and bootstrap credentials before connecting, while credentials explicitly supplied for the destination still take precedence. A query-only scope change can retain the origin-scoped token but requires the password to be entered again.

Secret Store values are not encrypted at rest and depend on the filesystem permissions of OpenClaw's state directory. Destination-bound substitution applies only to Gateway-hosted HTTPS commands whose subprocess honors its proxy settings. Raw sockets, containers, remote nodes, provider-native harnesses, plain HTTP, and WebSockets stay outside that path.

Common credential and signed-parameter patterns are now redacted across covered logs, diagnostics, agent errors, and Control UI failures, while chat history removes inline media bytes, local paths, private shell rows, copied prompt context, and failed-delivery payloads on the covered paths. Extra feature statistics, Android installed-app details, and iOS Health summaries require explicit choices, with Health behind two disabled-by-default gates. Update checks remain on unless disabled, while approximate Activity location is enabled by default for routable addresses and may download its local city database on first use.

Sources and complete change list

Improvements

Add managed 1Password SecretRef setup and resolution #102293
Add opt-in, privacy-bounded HealthKit summaries #105616
Add an approval-gated 1Password secrets broker #106133
Show native macOS notification controls in Settings #110646
Add a local SQLite secret store #121559
Manage team secrets from Control UI #121724
Expose stored team environment values to agent commands #121773
Add destination-bound secret egress for agent commands #123216
Add explicit protected and agent-readable Secret Store access #126088
feat(telemetry): opt-in anonymous usage stats on a daily update ping #128476
feat(geolocation): resolve client addresses to a coarse city via a bundled plugin #128546
feat(secrets): agent-requested credentials the model never sees #129670
feat(secrets): opt-in traffic allowlist for the secret egress proxy #129880
Add bundled HashiCorp Vault SecretRef support #89255
Add iOS notification controls to Privacy #102733
Ask for notification permission on the first eligible chat send #122446
Add a dedicated Gateway credential for Control UI GitHub access #125158

Bug fixes

Keep Gateway startup alive when optional secrets are missing #101265
Prevent credential retention in sentinels and debug capture #102420
Protect credentials returned by provider auth exchanges #104547
Let Gateway safe mode start when a channel secret is unavailable #106826
Prevent channel URL credentials from appearing in status output #107754
Redact structured authentication headers #107999
Isolate broken SSH sandbox secrets to the affected agent #110081
Keep healthy secret owners live during reload failures #110779
Require explicit consent for macOS privacy-sensitive access #112321
Prevent reasoning tags from leaking or hiding replies #113205
Stop macOS Keychain prompt storms during reconnects #114956
fix(reply): prevent private prompt context leaking into delivered replies #115745
Redact malformed Anthropic stream payloads from errors #116938
Redact signed and x-prefixed auth parameters consistently #116957
Sanitize private context across iMessage delivery #117501
Align Control UI redaction with core security rules #117817
Keep configuration secrets with their owning rows #118149
Keep referenced provider secrets out of plaintext #118702
Keep exact NO_REPLY silent after internal escalation #119463
Redact Discord bot credentials from API errors #119536
Redact bearer credentials from remote memory errors #119666
Simplify iOS permission requests and keep actions readable #120338
Keep credentials out of assistant transcripts #120728
Keep private shell output out of model context and compaction #121147
Protect secrets consistently in memory and ACP errors #121335
Unify media privacy across chat history #121490
Centralize and bound provider diagnostic redaction #121599
Keep runtime details out of ordinary chat notifications #121600
Move iOS Share relay credentials into Keychain storage #121900
Bound sensitive failed-delivery retention and add safe recovery tools #123410
Prevent editable secret-redaction placeholders in sensitive fields #123493
Prevent secret-egress crashes and unusable sandbox sentinels #123527
Keep failed delivery records payload-free #123642
Redact CLI errors and hide internal class names #123929
Redact secrets from Control UI failure messages #124552
Stop exposing reusable Gateway tokens in onboarding output #124687
Redact provider credentials reflected in error messages #125499
Protect secrets and config edits in the CLI #125753
Redact channel logs and validate filters #125939
Make Gateway config revisions opaque #126464
Keep generated Gateway tokens out of config in reference mode #126877
Preserve incognito session privacy across Gateway entry points #126897
Keep Gateway credentials out of plaintext in reference mode #126928
Redact secrets from non-interactive onboarding health failures #127071
fix(cli): stop approvals --json printing the exec-approvals socket token #127610
fix(secrets): fail closed for configured references #127669
fix: preserve source code in tool results #127697
fix(gateway): isolate portal cookies across lifetimes #129503
fix(sandbox): stop exposing environment values in process listings #129781
fix: prevent private prompt leaks in streamed ACP replies #130125
fix(codex): repair auth ownership across private turns, custom commands, and shared clients #131187
fix(control-ui): re-scope credentials when editing Gateway URLs #131788
fix: secret requests preserve native answers and live requester authority #132122
fix(anthropic): keep private CLI context out of chat history #132466
Require consent before Android shares installed app details #97888
Make Apple Health summaries clearly identifiable in iOS settings 1c16005
fix(agents): redact reflected credentials from provider error detail and reason phrase (#120200) 213804d
Add the required iOS Health update-purpose declaration cac32bb
Redact schema-sensitive fields from diagnostics exports #102426
Close the remaining OpenAI OAuth refresh race #102438
Recover Android permission prompts after timeouts #103011
Consolidate iOS location privacy controls #103096
Ignore inherited QQBot account credentials #103371
Redact sensitive details from Chutes OAuth failures #103569
Prevent transcript redaction from corrupting signed reasoning #103628
Redact Telegram tokens across large-text boundaries #103861
Return JSON config errors and cover split dotenv roots #104340
Restore SecretRef targets for installed provider plugins #104347
Resolve Ollama web-search SecretRefs safely #104829
Preserve pagination cursors in resumed transcripts #105039
Restrict exec secret-provider diagnostics to safe codes #105082
Redact secrets from ClickClack REST errors #106635
Stop inactive web secrets from blocking agent turns #108485
Skip unreadable system-prompt files instead of injecting their paths #108546
Keep internal control metadata out of chat transcripts #109056
Prevent 1Password broker calls from opening desktop prompts #109157
Isolate unavailable webhook route secrets at startup #109715
Isolate failed channel credentials by account #109766
Show redacted SecretRef degradation in logs and doctor #109792
Keep healthy channel actions when one account secret is unavailable #110329
Isolate channel accounts with unavailable credential files #110360
Collapse repeated Vault outage diagnostics #110908
Encrypt Android device identity storage #110939
Preserve the legacy ClawHub telemetry opt-out behind a blank primary setting #111078
fix(agents): keep reasoning out of generated session titles #111829
Keep development gateways from using ambient channel credentials #112011
Allow generic agent turns when optional web credentials are unavailable #112522
Preserve SecretRefs through Gateway channel shutdown #112717
Redact AWS secret access keys from logs and diagnostics #112947
Redact secrets in common config assignments #112952
Redact more GitLab credential formats #112954
fix(vault): prevent insecure secrets plan writes #113707
Keep configured local Gateway credentials authoritative #114462
Localize macOS privacy permission prompts #115013
Allow the first iOS Motion & Fitness permission prompt #115523
Keep internal runtime context out of channel replies #115561
Redact credentials from standalone debug-proxy captures #116133
Finish iOS Calendar and Reminders grants immediately #116504
Hide cached optional plugin tools after authentication is removed #116625
Redact credentials from Discord REST failures #116805
fix(secrets): preflight exec provider command paths before config acceptance #117128
Keep plugin configuration out of loader diagnostics #117237
Consolidate Doctor legacy migration ownership and sanitize diagnostics #117796
Authenticate remote Gateway setup and health probes correctly #118134
Bound large owner allowlists in model prompts #118206
Redact invalid OTEL endpoints and suppress disabled exporters #118635
Redact Reef credentials from relay errors #119603
Redact reflected Google Chat credentials #119965
Redact gateway credentials from status and log diagnostics #120024
Isolate stored device credentials during remote Gateway probes #120707
Fence OpenAI Responses replay metadata #120777
Redact private audio data from chat history #121109
Preserve rotated device tokens in WebViews #121315
Redact Windows home paths regardless of casing #121455
Reject empty secrets and classify oversized input consistently #121947
Report copied agent auth profiles accurately #122162
Keep background macOS hosts out of GUI Keychain state #123500
fix(clawhub): read Windows auth config from AppData #124658
fix(audit): inherit supervisor markers in audit worker database options #124776
Honor blocked SearXNG SecretRefs and bound extension helpers #126214
fix(feishu): prevent disallowed env credentials from authenticating requests #127682
fix(secrets): preserve authored env shorthand provenance #127685
fix(secrets): preserve canonical configuration path identity #128318
fix(lmstudio): redact reflected model-load credentials #128561
fix(tui): clear private session state before switching agents #129059
fix(ollama): recognize mapped IPv6 loopback endpoints #129522
fix(compaction): exclude private reasoning from summaries #129567
fix(plugins): scope runtime catalog discovery by provider #129624
fix(crabbox): keep cloud worker credentials out of process arguments #129665
fix(tui): prevent stale sessions from leaking private goals and history #129810
fix(android): remove private camera clips after canceled recordings #129948
fix(doctor): canonicalize standalone auth-state rotation ids with credentials #130763
fix(secrets): validate import values before writing #131055
fix(tavily): resolve tavily_search and tavily_extract keys from any secret provider #131082
fix(auth): keep explicit-root operations isolated through activation and rollback #131519
fix(doctor): keep auth repair in the selected installation #131589
fix(channels): accept env SecretRefs with shared default aliases #132578
Strip echoed inbound metadata before channel delivery #50520
Normalize provider keys during model config merging #95722
fix(sms): redact reflected Twilio credentials (#119963) 1bfcb71
Reject inherited exec secret response IDs #101739
Harden Workboard claim-token comparisons #104259
Stop logging raw Feishu callback tokens #104498
Preserve partial Gateway SecretRef assignments #105160
Redact credential-shaped text from migration terminal output #106806
Harden Zalo hosted-media token comparison #108512
Reject oversized 1Password service-account token files #108596
Reject oversized Vault credential files before authentication #108761
Preserve oversized 1Password token diagnostics #108964
Ignore blank Web Push VAPID overrides #109609
Explain malformed secrets plan JSON clearly #109721
Strip current exec and bash failure traces from replies #111877
Keep raw command output out of progress narration prompts #112553
Restore 1Password secret references under Bun #114346
Require explicit credentials for Gateway probe URL overrides #118614
Retire invalid SecretRef builder flags #118926
fix(nextcloud-talk): redact upstream error body text in send and bot-preflight #119976
Keep public GitHub previews working when optional auth is stale #121454
Resolve secret default aliases by source #121630
Keep internal model reflections out of replies #123196
fix(doctor): surface the resume failure cause for interrupted auth-profile archives #123459
Redact provider environment values from CLI errors and audits #124714
fix(ui): stop empty protected secrets before Gateway save #127740
fix(matrix): hint at --json when --include-recovery-key is a text-mode dead end #128051
fix(logging): preserve UUID token fragments #128258
fix(ui): reject secret deletion after Gateway client replacement #129488
fix: keep store-backed credentials and tools discoverable #132696
Bound direct OpenAI Realtime startup authentication errors #87273

Documentation

Document the groupScope main-session trust boundary #125006
docs: qualify Why OpenClaw security and comparison claims #130947
Add a dedicated 1Password Gateway guide #106109
Clarify SecretRef cold and stale degradation behavior #111021
Stop Policy Doctor from advertising a retired redaction fix #113961
Remove retired logging redaction guidance #113963
Retire the unreachable redaction policy check #113993
Clarify secret-store environment injection boundaries #122405
docs(telemetry): lead with what is on by default and thank opt-in users #128491
docs(secrets): make the credential-request tool discoverable and warn about empty hosts #130299

Sandbox and file access

Contributor-controlled code is now prepared inside the designated untrusted-code sandbox, and managed worktrees suppress repository Git hooks unless an administrator deliberately runs the separate setup script. Repositories that relied on implicit hooks will need to move that setup into the explicit path.

Sandbox identity now includes the workspace that owns the run. Newly created guest sessions that require a sandbox receive a separate identity for each authenticated guest and can share a workspace only read-only, while worker sessions on another machine can opt into per-session containers. Direct execution remains the default, and the same per-guest boundary is not established for child sessions they create.

File checks catch more attempts to escape through the named root, denied directories, oversized reads, and POSIX symlink parents. Symlink containment is checked before the filesystem operation rather than atomically beneath the approved root, leaving a remaining window for a path to change between the check and use.

Sources and complete change list

Improvements

feat(nodes): opt-in container isolation for node-hosted worker sessions #128447
feat(gateway): identity-conditional forced sandboxing for operator roles #129926
Clarify oversized config mutation file errors #110593

Bug fixes

Require approval for ACP searches outside the workspace #102416
Enforce sandbox tool policy for gateway loopback tools #103074
Bind CLI MCP tool access to the Gateway-selected sandbox context #103822
Keep Workboard dispatch inside caller workspace authority #107087
Deny listing protected directory roots #109233
Adopt hardened fs-safe 0.5 filesystem primitives #113705
Preserve shared Kubernetes namespaces during teardown #114953
Isolate sandbox runtimes by workspace #115766
Keep copied installs from modifying the host Gateway service #115922
fix(sandbox): isolate role-required sandboxes per guest, not per agent #130229
fix(sessions): stamp creator isolation across creation paths #131156
fix(openshell): prevent workspace races and unblock remote commands #131315
fix(openshell): prevent mirror data loss through workspace aliases #131917
Bound workspace ignore parsing to prevent scan exhaustion #101429
Bound gateway BOOT.md reads #101776
Confine include-file permission fixes to trusted roots #103267
Bind trusted session rewrites to the verified snapshot #103848
Atomically secure the macOS exec-approvals state directory #104028
Restrict session exports to owners and workspace files #104708
Tighten node filesystem authorization #106004
Secure coding-agent worktree preparation and preserve target branches #106121
Prevent Docker setup chown from following symlinks #107847
Bound external plugin catalog reads to 16 MiB #108200
Reject remote hardlinks under localized shells #108879
Bound credential-file reads across remaining integrations #109260
Bound config input and trajectory pointer reads #110516
Bound config reads during diagnostic export #110591
Bound plugin bundle command file reads #110594
Reject corrupt session-state notice context keys #111152
Resolve shell snapshots from a trusted home directory #113103
Reject POSIX symlink-parent workspace escapes #113405
Keep Zalo QR temp files private while consolidating safe file access #113596
Keep named CLI profiles isolated from inherited service state #114446
Reject unsafe SSH sandbox settings #115036
Stop sandbox setup failures from exhausting model fallbacks #115481
Keep long sandbox container prefixes scope-unique #115571
Restore safe iMessage workspace attachments #117779
Make untrusted filenames portable across Windows and SharePoint #119363
Keep QQ Bot voice staging inside managed storage #120188
Protect local agent state from concurrent Gateway writes #120896
Clean up Discord voice files after failed sends #120904
Guard embedded CLI state writers #121282
Keep named-profile workspaces inside profile state roots #122733
Prevent Windows Doctor audit-migration fsync failures #123376
Remove recreated agent-state files during deletion #124461
Normalize ACP file URLs before cwd-scoped approval #124530
Standardize safe filesystem path containment #124870
Prevent destructive cleanup and deletion from replaying after Gateway errors #126743
fix(agents): keep Unicode filename reads inside workspace #128873
fix(agents): remove external databases during offline delete #129017
fix(agents): preserve survivor-owned databases offline #129085
fix(sandbox): resolve bare upload handles to staged inbound media #129269
fix: keep session catalog mirroring within isolated profiles #129638
fix(worktrees): never execute repository git hooks during provisioning #129968
fix(gateway): pin git config for session-diff and worker workspace paths #130124
fix(agents): preserve workspace ownership across path aliases #130372
fix(sandbox): stop retaining built-in backends across module reloads #130518
fix(sessions): preserve required creation stamps in storage #131147
fix(openshell): retain FIFOs and sockets after sandbox commands #131360
fix(sandbox): stage inbound media up to 50 MiB #131384
fix(agents): guarded macOS file tools reject trusted workspace aliases #131434
fix(openshell): preserve overlapping mirror workspaces during exec #131556
fix(sandbox): recreate OpenShell runtimes after backend switches #131828
fix: native fs-safe opt-in fails in bundled installs #131939
fix(exec): inherit configured host for per-call auto #132100
Prevent false takeover aborts after unchanged transcript rewrites #91797
Prevent sandbox bind conflicts with protected skill mounts #93985
fix(agents): keep embedded prompts isolated from ambient files (#110776) e3c78c3
Cap agent message-file reads before dispatch #101442
Bound identity-file reads to prevent memory exhaustion #101447
Bound hook metadata reads during installation #101469
Bound workspace hook metadata reads #101472
Record verified directory archive size in file-transfer audits #104536
Reject oversized inline file writes before dispatch #104556
Bound Nextcloud Talk API password file reads #108321
Bound and recover debug-proxy CA generation #109106
Bound state and startup .env reads to 1 MiB #109487
Bound secrets plan files to 16 MiB #109652
Bound plugin manifest metadata reads #110036
fix(oc-path): bound config file reads with size cap #110714
Bound exec approvals file reads to 1 MiB #110755
Surface sandbox probe failures instead of false empty results #124881
fix(sandbox): read tool rejects declared binds with workspace-only enabled #130540
fix(pdf): read workspace-relative PDF references against the agent workspace #130609
fix: accept canonical workspace paths for sandboxed sessions #132265

Documentation

Document multiple host folders for one sandboxed agent #109530
Document a restricted Gmail reader setup #116041
docs(exec): correct host=auto per-call override semantics #120331

Network Access and Untrusted Content

Network policy now blocks unspecified and local-use NAT64 targets by default, validates guarded redirects and no-auth browser origins, and stops telemetry when its configured proxy is invalid instead of bypassing it. Private automation webhook destinations require an exact-host exception or a broader private-network switch, with the broader setting widening trust across every configured cron webhook.

Text returned by search, fetch, MCP, plugins, Browser, and other network-backed tools is bounded, normalized, and marked as untrusted external content before the model sees it. This makes the source and boundary explicit, while the model can still be influenced by hostile material it reads.

Terminal and CSV output neutralize covered control-sequence and formula injection forms, configuration rejects prototype-polluting paths, and browser references, executable waits, navigation, and MCP App grants are rechecked against the document and live authority that produced them. Browser navigation enforcement covers selected-page document traffic during managed actions and a bounded grace period, leaving popups, Service Workers, background requests, some redirects, and remote backends outside that boundary.

Sources and complete change list

Improvements

Normalize and secure web search results #110308
Allow trusted private targets for automation webhooks #118286
Add All tabs and Selected tabs Chrome access modes #120995
Use plain marked labels for inbound context #112000

Bug fixes

Block prototype-polluting configuration paths #102840
Block disallowed browser origins in no-auth HTTP mode #102881
Block workspace Cloud SDK controls during Gmail setup #103918
Block policy-denied navigation during browser interactions #104254
Keep MCP Apps aligned with runtime tool policy #105075
Authenticate external plugin tabs without exposing Gateway tokens #107323
Block prototype-polluting keys during JSON Schema default hydration #107978
Harden external-content markers and web search output #110417
Block widget-authored host commands #110808
Harden authority for pinned MCP Apps #111679
Enforce macOS Gateway TLS pins across operator traffic #112353
Block incomplete Mistral streamed tool calls #117137
Bound DeepSeek DSML recovery memory #117175
Wrap page-controlled Browser action results #118691
Sanitize forged content boundaries after JSON encoding #118698
Isolate network-backed dynamic tool output #118729
Preserve private Bedrock embedding endpoints #118744
Enforce exact Feishu webhook request boundaries #118758
Harden network tool output against hostile external content #118984
Block terminal-control injection across TUI rendering #118998
Bind authenticated Apple web pages to the trusted Gateway #119906
Secure Synology attachments and System Agent config commands #119941
Harden Gateway proxy and managed Tailscale ingress #119950
Sanitize approval text and display paths at creation #123742
Sanitize stored text across CLI output #123797
Reject malformed native Codex tool arguments before execution #124649
Keep node MCP calls within the published catalog #124652
Apply Codex search domain policy to managed web fetch #125574
Repair browser session lifecycle ownership #125933
Preserve MCP catalog and result integrity #126083
Stop revoked MCP App actions after delayed catalog work #126415
fix(mcp): stop resource access after app grant revocation #129550
fix(gateway-client): verify TLS pin before websocket upgrade #131435
Render assistant-authored transcript headers as inert text #99404
Bind direct hook delivery before scheduling #100486
Prevent unbounded hosted plugin catalog reads #101000
Keep browser wait predicates inside approved documents #101852
Apply request policy to Qwen and Alibaba video generation #102094
Keep mapped webhook provenance scoped to trusted routing #102418
Limit inbound realtime-transcription WebSocket messages #102443
Reject malformed managed image data URLs without stalling replies #102825
Block unspecified DNS targets for trusted network fetches #103075
Block workspace dotenv endpoint overrides #103914
Reject stale Browser refs after navigation #104308
Guard ClawRouter usage redirects against SSRF #104592
Apply xAI request policy across video generation #104836
Prevent malformed language-server output from exhausting gateway memory #105460
Harden Control UI previews and media download headers #106545
Stop Vault SecretRef resolution from hanging on stalled bodies #108970
Prevent terminal-control injection from stored transcripts #110060
Restrict LiteLLM loopback trust to real IP addresses #110693
Filter prototype-sensitive Feishu webhook fields #111729
Fence external hook job names in isolated-agent prompts #112501
Block C preprocessor selection in host execution environments #112560
Block unsafe workspace dotenv runtime controls #114133
Classify loopback hosts consistently across plugins #114832
Harden Android math and generated-report boundaries #115055
Keep Browser Copilot locked to the shared tab #116778
Reject malformed tool calls and surface approval delivery failures #116831
Show task failure reasons and protect terminal output #117568
Refuse direct telemetry export when a configured proxy is invalid #118612
Fail closed on invalid OpenTelemetry TLS files #118648
Preserve plugin result provenance after cache hits #118874
Fence remote Feishu tool content and retain its provenance #118877
Keep whitespace-prefixed bang input in TUI chat #119245
Bound nested Browser batch actions during validation #120274
Unify attachment byte classification #122168
fix(msteams): require dot boundary for shared-link host suffix match #123046
fix(discord): label audio transcripts as untrusted #123098
Harden local-use NAT64 provider and Gateway trust #123241
Reject invalid CLI filter values #124520
Bound stalled Telegram Mini App request bodies #124944
Normalize TLS certificate pins across gateway and worker paths #125276
Restore trusted external Tailscale routes without weakening Gateway auth #125412
fix(onboard): probe remote gateways with saved TLS pins and validate trusted proxies #131475
Accept exact custom browser origins in the Gateway allowlist #38290
Reject credential-bearing cron webhook URLs #51822
Preserve trusted generated HTML through outbound staging #90579
Allow Comfy private service hostnames safely #99065
Keep debug proxy response capture memory-bounded #101268
Reject inherited object properties as QR delivery channels #101652
Reject unsafe QQBot mention patterns #102976
Reject impossible dates in audit time filters #103433
Sanitize oversized plugin command arguments safely #104015
Block browser hooks on disallowed current pages #104095
Bound Ed25519 base64url decode inputs #104921
Bound Reef guard provider response reads #106439
Validate 1Password audit limits strictly #106926
Align proxy bypass matching across OpenClaw and Telegram #107711
Cap piped model-auth input at 1 MiB #109800
Accept padded audit-list cursors #110551
Trim pasted identifiers in Gateway audit filters #110847
Keep guarded redirects working when cleanup fails #111156
Reject malformed Microsoft Teams OAuth token envelopes #111638
Prevent spreadsheet formulas in Usage CSV labels #111653
Reject malformed UTF-8 from browser-control endpoints #111898
Explain missing sandbox origins for proxied widgets #111909
Block CXXCPP host environment overrides #112684
Restore release validation and preserve browser CDP authority #112740
Reject malformed browser-proxy file data before saving #115045
Reject malformed UTF-8 from agent-bundle language servers #117271
Consolidate channel discovery and reject unsafe catalog defaults #117541
Sanitize and bound unknown CLI commands #120380
Restore numeric cursors for audit decision inspection #122619
Prevent stored approval values from running terminal escapes #123671
Show valid values for rejected audit filters #124336
Reject impossible audit filter combinations #124513
Preserve Diffs remote-viewer lockouts under load #126484
fix(cli): prevent node commands from controlling terminal output #127856
Bound GitHub release metadata reads for agent tools #98480
Keep Thread Ownership conflicts bounded and authoritative #98941

Documentation

Expand Gateway rate-limiting documentation 3fee3cc
Harden Gmail hook security guidance 6551786
Clarify requester-scoped tool controls and untrusted prompt context #113400

Plugin Permissions and Installation Checks

Managed external plugin installs now show one capability review bound to the artifact being installed and ask again when an update requests more authority. Skill security verdicts stay attached to the exact publisher and version, ClawHub GitHub installs require a full commit SHA instead of a mutable branch or tag, and managed Homebrew or NodeSource installers stop when a response fails, is empty, redirects, or lacks a shebang.

The capability prompt applies to managed external installs. Bundled plugins skip it, already-enabled legacy plugins keep their existing access, and bundled execution retains named compatibility exceptions. The review shows what a plugin is asking to do, while authenticity and code safety continue to depend on artifact integrity, registry identity, and code review. A full commit SHA pins the downloaded archive bytes while source metadata still depends on the resolver, and the installer response check only confirms that the download looks like a script.

Sources and complete change list

Improvements

Review and approve plugin install warnings in Control UI #120900
feat(plugins): one consent screen for plugin capabilities, bound to the reviewed artifact #130168
Move plugin package-name restrictions to operator policy #101813
Show safe removal commands for malicious skills #118969

Bug fixes

Enforce plugin deny rules regardless of ID case #109237
Enforce isolation and approval integrity for plugin hooks #115701
Withhold plugin routes until node capability approval #115980
Prevent scoped plugin loads from replacing the root registry #117587
Enforce bundled-plugin execution policy #118701
Keep installed skill security verdicts tied to the publisher #119672
Freeze installed Claw tool authority #121327
Harden Docker images and reduce fixable vulnerability findings #123282
Preserve plugin trust policy after update failures #108661
Stop meme-maker from recommending unsafe package installs #109612
Upgrade protobufjs to fix proto-parser denial of service #112184
Update vulnerable dependencies and native string inventory #112406
Validate downloaded installer scripts before execution #113307
Prevent blocked plugin enables from changing configuration #114490
Patch archive and MCP server dependencies #115029
Accept safe Node options during Codex setup #115541
Detect aliased child-process execution in source scans #116304
Prevent plugin uninstall from choosing the wrong target #117406
Reject external plugin public-artifact hardlinks #118689
Revoke plugin capability links when nodes are removed #119848
Update NanoID past a denial-of-service advisory #120368
Stop loading retired inline hook modules #120851
Update macOS Peekaboo for fail-closed background keyboard targeting #125364
fix(plugins): record consent for enabled plugins #132805
Require immutable GitHub commits for ClawHub skill installs #97157
Preserve approval routes for plugin node commands #98561
Limit marketplace manifest reads to 16 MiB #101774
Update Axios past a proxy advisory #111984
Pin brace-expansion 5.0.8 to remediate a high-severity advisory #113428
Remove retired install-policy bypass guidance #120011

Was this useful?