By devasher · Edited by Nominiclaw
This release introduces significant security hardening for sandbox and device pairing, enhances Telegram and Codex runtime stability, and adds new capabilities for cron job inspection and session lineage.
OpenClaw has implemented several critical security updates to protect host environments and restrict unauthorized access:
nominiclawUSERPROFILE roots to prevent credential-bearing binds (such as .ssh or .codex) from being accessed even when the HOME environment variable is redirected.-ec (encoded command) aliases are now recognized as inline payloads, forcing them through the stricter inline-payload approval path.getUpdates calls, which previously led to lost messages.acp.fallbacks to allow ACP turns to try backup runtime backends when the primary is unavailable.openclaw cron get <id> and a corresponding Gateway RPC, allowing users and agents to inspect a single stored cron job without fetching the entire list.parentSessionId, spawnDepth), enabling the rendering of parent-child session graphs in ACP clients./context map command, which generates a WinDirStat-style treemap image of current session context contributors.tools.toolsBySender, allowing operators to define different tool capability tiers based on the sender's identity (e.g., restricting destructive tools for guests).doctor --fix during version upgrades could strip user-authored config fields. A pre-update persistent snapshot is now created to prevent data loss.agents.defaults.subagents.model was ignored in favor of the target agent's primary model, which previously caused subagents to bypass the claude-cli runtime.items are now normalized to include items: {}, preventing rejection by OpenAI-compatible providers.This release significantly reduces the risk of privilege escalation through device pairing and sandbox escapes on Windows. For users of the Codex harness and ACP, the improved thread rotation and failover mechanisms provide a more reliable experience for long-running sessions. Telegram users will see improved reliability under high system load due to the isolated polling worker. Operators can now implement more granular security policies using the new per-sender tool capabilities.
allowFrom configurations to use sender handles.gateway.trustedProxies will no longer authenticate direct requests from that address. These should be moved to a distinct proxy peer address or the loopback path.pnpm-workspace.yaml.