Release notes

v2026.11.3

AI agents and tools can read these release notes as plain Markdown.

Security release: This release fixes certificate verification for worker transfers with blank fingerprints, keeps required-sandbox image previews within allowed folders and reduces credential exposure. Update OpenClaw to receive these fixes.

This is a patch release with no new features. It fixes problems that could leave the Gateway stopped after an update, block backups on slow storage, or expose private information, alongside smaller reliability fixes.

Release scale: 56 pull requests, 44 direct commits, and 36 contributors. The pull request count includes backported source work, while direct commits count separately retained release-line changes.

Updates and Maintenance

Fixes a running Windows Gateway losing its lock when system boot information disagrees. On Linux, fixes startup failing to recover a stale lock when its old process ID has been reused by a worker thread.

More details

#175118. Thanks to @xiaopan-xydt, @steipete, @belbix.
Fixes nonnative package updates stopping at an initial presence-check timeout when the existing installation identity can still be captured. If an update from 2026.9.3 or 2026.9.4 is blocked by this timeout, follow the update recovery guidance. Selecting a newer version does not fix the installed updater.

More details

Released change, adapting #181906. Thanks to @steipete, @node-sketch and @RomneyDa.
Fixes a managed macOS Gateway restarting during update maintenance when its LaunchAgent background service remains loaded. Stopping the service no longer by itself causes SQLite migration to reject the captured database as changed.

More details

#187104. Thanks to @RomneyDa, @steipete.
Fixes large backups timing out because all files shared one SQLite discovery deadline.

More details

#187197. Thanks to @wr-web, @obviyus, @etzelm.
Fixes some interrupted package updates reporting success instead of preserving cancellation and the recovery path.

More details

#187998. Thanks to @vincentkoc.
Fixes interrupted managed updates and repairs leaving the Gateway stopped when recovery checks permit a restart. If completed maintenance cannot start or verify the Gateway, repair gives manual start and status guidance. A recovered Gateway does not itself mean the update completed. See update recovery.

More details

#193884. Thanks to @steipete, @RomneyDa.
Fixes misleading backup discovery errors when a SQLite check times out and points affected operators to recovery guidance.

More details

#193970. Thanks to @steipete and @karam2022.
Fixes backups and update discovery failing on slow storage when a large SQLite check times out by retrying smaller batches. A file that still times out on its own continues to block the backup. If an update from 2026.10.10 or 2026.11.1 is blocked by this timeout, follow the update recovery guidance. The installed updater cannot acquire this fix by selecting a newer version.

More details

#194239. Thanks to @steipete.
Fixes resumed chat-initiated updates failing an authorization check for an otherwise authorized profile before plugin work. Revoked requesters remain blocked.

More details

Released change, adapting #177792. Thanks to @GrahamMcBain, @steipete.
Fixes update repair being blocked by database changes before or during the Doctor handoff. Doctor cannot automatically restore the database when it cannot verify who made those writes.

More details

Released change. Thanks to @RomneyDa.
Reduces the memory pressure that could cause large session transcript search index repairs to run out of memory.

More details

Released change, adapting #194099. Thanks to @vincentkoc.

Messaging

Fixes malformed Matrix room messages that mention the bot and contain repeated unfinished links stalling the Gateway during mention checks.

More details

#184432. Thanks to @LeizhenZhang, @obviyus.
Fixes long punctuation-heavy messages stalling the Gateway during abort checks.

More details

#184433. Thanks to @LeizhenZhang, @obviyus.
Fixes Tlon owner decisions applying to the wrong request when several approvals are pending. Include the request ID when choosing among multiple requests.

More details

Released change, adapting #186243. Thanks to @mmaps.
Fixes Mattermost directory discovery skipping distinct servers or network policies when accounts share a token.

More details

Released change, adapting #178444. Thanks to @steipete.
Fixes Teams bots reusing another bot’s cached parent-message context.

More details

Released change, adapting #177974. Thanks to @steipete.

Memory

Fixes memory compaction deleting a handwritten comment and its section when the comment follows a promotion marker on the same line.

More details

#164089. Thanks to @GoldArowana, @obviyus.
Fixes tool-heavy compaction crowding decisions and pending work out of the generated summary. Preserved tool results are shorter and older context may be dropped.

More details

#195028. Thanks to @obviyus.
Fixes memory embedding credentials being inherited by a different provider without the shared endpoint.

More details

Released change, adapting #184966. Thanks to @eleqtrizit.
Preserves affected agents’ memory provider settings when a shared provider change is saved.

More details

Released change, adapting #184966. Thanks to @eleqtrizit.
Fixes mixed-case memory provider none and auto, and fallback none, being interpreted inconsistently.

More details

Released change, adapting #186310. Thanks to @steipete, @sagealice2002-dotcom.

Skills

Fixes plugin skills being missed during delayed Gateway startup when their roots are known to the current plugin metadata, and removes obsolete skill links when a replacement metadata snapshot is supplied.

More details

Released change. Thanks to @RomneyDa.

Models and Providers

Reduces truncated replies and tool calls on affected models with unknown output limits by raising the fallback within the available context window. Doctor identifies qualifying older saved caps without changing them. If a provider rejects the larger request, configure its actual maxTokens.

More details

#193899. Thanks to @VACInc, @vincentkoc.
Fixes model sign-in hiding OAuth refresh or unavailable secret access errors, and rejects explicitly selected credentials belonging to a different provider.

More details

Released change, adapting #173970, #181597. Thanks to @steipete, @vincentkoc.
Fixes embedded agent runs waiting past their deadline on stalled credential lookup or provider authentication, and prevents late authentication results from installing credentials after cancellation or timeout.

More details

Released change, adapting #189144. Thanks to @amittell, @RomneyDa.
Fixes unnecessary retries of an Anthropic model when its API usage limits have been exhausted, allowing a configured fallback model to be tried.

More details

Released change, adapting #176186. Thanks to @sunlit-deng, @blue-dot-1.
Fixes published AI package TypeScript declarations flattening OpenAI namespace aliases, preserving their original type identities.

More details

Released change. Thanks to @RomneyDa.
Fixes guided Ollama setup choosing the wrong response limit for cloud aliases and preserves saved limits.

More details

Released change. Thanks to @RomneyDa.

Automations and Scheduling

Fixes recurring automation history being deleted after converting an On exit automation with Delete after run enabled to an Interval or Cron schedule when the update omits a cleanup choice.

More details

#168985. Thanks to @steipete.
Fixes missing warnings when a queued cron run cannot start after scheduling resumes. The request stays queued and the Gateway logs the error.

More details

Released change, adapting #175678. Thanks to @yxshee, @wangmiao0668000666, @obviyus.

Plugins and Integrations

Fixes Firecrawl searches reusing cached results from a different API key.

More details

Released change, adapting #178444. Thanks to @steipete.
Prevents Exa search and Tavily search and extract from reusing cached results across API credentials.

More details

Released change, adapting #177974. Thanks to @steipete.
Fixes ACP reply runs reporting completion too early when clients retry a message or wait for a result.

More details

Released change. Thanks to @RomneyDa.

Security and Privacy

Fixes blank node TLS fingerprint flags suppressing the saved certificate pin for the same Gateway endpoint.

More details

#125646. Thanks to @wanyongstar, @steipete.
Prevents a known Twitch IRC parsing error from copying incoming message content into error logs while retaining a parsing-failure notice.

More details

#174552. Thanks to @steipete.
Fixes conversation image previews reading outside allowed folders in required-sandbox sessions, including in Full Access mode. An administrator can still allow a specific outside image.

More details

#176203. Thanks to @shakkernerd.
Limits the environment inherited by managed Signal daemons to reduce exposure of unrelated credentials. Proxy, trust-store and custom wrapper variables are no longer inherited and may need to be supplied through Java properties, the wrapper or an external daemon. See the Signal guide.

More details

#179198. Thanks to @VACInc.
Requires normal authorization for dynamic shell test and [ predicates under the Gateway allowlist, closing an automatic-approval gap. Some quoted literal filenames containing metacharacters also require authorization and may be denied when approvals are off. The command renderer also catches unquoted globs after escaped ANSI-C quotes or PID-prefixed quote sequences. See exec approvals.

More details

#187884. Thanks to @art22s.
Fixes blank worker transfer TLS fingerprints disabling certificate verification for workspace uploads and downloads. Blank pins use normal CA verification, while malformed nonblank HTTPS pins are rejected.

More details

#190002. Thanks to @avelev99 and @aniruddhaadak80.
Fixes config reads exposing inline values in env.vars and suppresses raw config output when it cannot be safely redacted.

More details

Released change, adapting #190618. Thanks to @yetval.
Fixes private completion text reaching session-message subscribers and private activity appearing in the Control UI during session preparation.

More details

Released change, adapting #188490. Thanks to @fuller-stack-dev.
Prevents another provider plugin from redirecting a provider connection to a different origin or supplying a destination when none was set, reducing the risk of sending credentials to the wrong endpoint.

More details

Released change, adapting #189423. Thanks to @obviyus.
Limits the environment inherited by bundled language servers so Gateway credentials are not passed to them by default. Servers that relied on other inherited settings may need an allowed entry in their bundle configuration or a wrapper. See plugin bundle guidance.

More details

Released change, adapting #179415. Thanks to @VACInc.
Fixes Firecrawl search and scrape mixing credentials with another connection’s endpoint. Configurations that depended on mixing scoped values may need adjustment.

More details

Released change, adapting #190706. Thanks to @zhangguiping-xydt.
Redacts the active Exa API key when it is echoed in an error.

More details

Released change, adapting #178745. Thanks to @steipete.
Fixes authorized dashboard members being unable to send chat messages because their session access is rejected prematurely.

More details

Released change. Thanks to @RomneyDa.

Quality-of-Life Improvements

Reduces file loading during Gateway startup, including for installations without legacy session data.

More details

#192217. Thanks to @karkarl, @RomneyDa.
Fixes reply preparation losing whether an answer should be sent automatically or through the messaging tool.

More details

Released change. Thanks to @RomneyDa.
Fixes session turns being refused as “policy changed” when an unrelated update changes only session metadata.

More details

Released change, adapting #174988. Thanks to @steipete.
Reduces startup work for memory indexing and session-memory preparation.

More details

Released change. Thanks to @RomneyDa.
Fixes session lists showing stale token usage after a restored session completes a turn.

More details

Released change. Thanks to @RomneyDa.

Other Bug Fixes

Fixes /reset soft in the Gateway-connected TUI removing conversation history and dropping an optional trailing message. Local embedded mode reports that soft reset is unavailable.

More details

#172431. Thanks to @yetval, @obviyus.
Fixes worktree preparation continuing after a Git fetch repair leaves process cleanup uncertain, and reports the uncertainty instead.

More details

#176006. Thanks to @steipete.
Fixes a yielded parent failing to resume after cancelled subagents are replaced and the surviving child finishes.

More details

#178893. Thanks to @brianmcguire, @steipete, @letsc4.
Fixes unanswered runs being reported as successful when a tool is denied and only a blocked-tool warning was produced.

More details

#182458. Thanks to @steipete, @rdleclerc.
Fixes a source of worker memory exhaustion in sessions with large histories of consumed inputs, while retaining their records for replay checks.

More details

#196277. Thanks to @RomneyDa.
Fixes checks of unchanged conversation permissions, tool settings and memory access failing during queued-reply or steering activity updates.

More details

Released change. Thanks to @RomneyDa.
Fixes retries of already consumed collected chat inputs returning UNAVAILABLE after the Gateway goes idle.

More details

Released change. Thanks to @RomneyDa.
Prevents unrelated session history work from holding up acknowledgement of an idle chat send.

More details

Released change. Thanks to @RomneyDa.
Fixes session history reads failing when database validation is renewed while they wait behind a write.

More details

Released change, adapting #188055. Thanks to @jalehman, @vincentkoc.

Was this useful?