04-16 00:00 · 开源,AI Agent,性能优化,版本更新,开发工具
OpenClaw发布2026.3.23版本，新增多项AI Agent功能和性能优化
2026.3.23
Breaking
Changes
- ModelStudio/Qwen: add standard (pay-as-you-go) DashScope endpoints for China and global Qwen API keys alongside the existing Coding Plan endpoints, and relabel the provider group to
Qwen (Alibaba Cloud Model Studio)
. (#43878) - UI/clarity: consolidate button primitives (
btn--icon
,btn--ghost
,btn--xs
), refine the Knot theme to a black-and-red palette with WCAG 2.1 AA contrast, add config icons for Diagnostics/CLI/Secrets/ACP/MCP sections, replace the roundness slider with discrete stops, and improve accessibility with aria-labels across usage filters. (#53272) Thanks @BunsDev. - CSP/Control UI: compute SHA-256 hashes for inline
<script>
blocks in the servedindex.html
and include them in thescript-src
CSP directive, keeping inline scripts blocked by default while allowing explicitly hashed bootstrap code. (#53307) Thanks @BunsDev.
Fixes
- Plugins/bundled runtimes: ship bundled plugin runtime sidecars like WhatsApp
light-runtime-api.js
, Matrixruntime-api.js
, and other plugin runtime entry files in the npm package again, so global installs stop failing on missing bundled plugin runtime surfaces. - CLI/channel auth: auto-select the single configured login-capable channel for
channels login
/logout
, harden channel ids against prototype-chain and control-character abuse, and fall back cleanly to catalog-backed channel installs, so channel auth works again for single-channel setups and on-demand channel installs. (#53254) Thanks @BunsDev. - Auth/OpenAI tokens: stop live gateway auth-profile writes from reverting freshly saved credentials back to stale in-memory values, and make
models auth paste-token
write to the resolved agent store, so Configure, Onboard, and token-paste flows stop snapping back to expired OpenAI tokens. Fixes #53207. Related to #45516. - Control UI/auth: preserve operator scopes through the device-auth bypass path, ignore cached under-scoped operator tokens, and show a clear
operator.read
fallback message when a connection really lacks read scope, so operator sessions stop failing or blanking on read-backed pages. (#53110) Thanks @BunsDev. - Plugins/ClawHub: resolve plugin API compatibility against the active runtime version at install time, and add regression coverage for current
>=2026.3.22
ClawHub package checks so installs no longer fail behind the stale1.2.0
constant. (#53157) Thanks @futhgar. - Plugins/uninstall: accept installed
clawhub:
specs and versionless ClawHub package names as uninstall targets, soopenclaw plugins uninstall clawhub:<package>
works again even when the recorded install was pinned to a version. - Browser/Chrome MCP: wait for existing-session browser tabs to become usable after attach instead of treating the initial Chrome MCP handshake as ready, which reduces user-profile timeouts and repeated consent churn on macOS Chrome attach flows. Fixes #52930. Thanks @vincentkoc.
- Browser/CDP: reuse an already-running loopback browser after a short initial reachability miss instead of immediately falling back to relaunch detection, which fixes second-run browser start/open regressions on slower headless Linux setups. Fixes #53004. Thanks @vincentkoc.
- Agents/web_search: use the active runtime
web_search
provider instead of stale/default selection, so agent turns keep hitting the provider you actually configured. Fixes #53020. Thanks @jzakirov. - Mistral/models: lower bundled Mistral max-token defaults to safe output budgets and teach
openclaw doctor --fix
to repair old persisted Mistral provider configs that still carry context-sized output limits, avoiding deterministic Mistral 422 rejects on fresh and existing setups. Fixes #52599. Thanks @vincentkoc. - ClawHub/macOS auth: honor macOS auth config and XDG auth paths for saved ClawHub credentials, so
openclaw skills ...
and gateway skill browsing keep using the signed-in auth state instead of silently falling back to unauthenticated mode. Fixes #53034. - ClawHub/macOS: read the local ClawHub login from the macOS Application Support path and still honor XDG config on macOS, so skill browsing uses the logged-in token on both default and XDG-style setups. Fixes #52949. Thanks @scoootscooob.
- ClawHub/skills: resolve the local ClawHub auth token for gateway skill browsing and switch browse-all requests to search so ClawControl stops falling into unauthenticated 429s and empty authenticated skill lists. Fixes #52949. Thanks @vincentkoc.
- Config/warnings: suppress the confusing “newer OpenClaw” warning when a config written by a same-base correction release like
2026.3.23-2
is read by2026.3.23
, while still warning for truly newer or incompatible versions. - CLI/cron: make
openclaw cron add|edit --at ... --tz <iana>
honor the requested local wall-clock time for offset-less one-shot datetimes, including DST boundaries, and keep--tz
rejected for--every
. (#53224) Thanks @RolfHegr. - Commands/auth: stop slash-command authorization from crashing or dropping valid allowlists when channel
allowFrom
r
▸ 展开全文
03-28 00:01 · OpenClaw,更新,开源,开源
OpenClaw发布2026.3.23版本，新增多项AI Agent功能和性能优化
2026.3.23
Breaking
Changes
- ModelStudio/Qwen: add standard (pay-as-you-go) DashScope endpoints for China and global Qwen API keys alongside the existing Coding Plan endpoints, and relabel the provider group to
Qwen (Alibaba Cloud Model Studio)
. (#43878) - UI/clarity: consolidate button primitives (
btn--icon
,btn--ghost
,btn--xs
), refine the Knot theme to a black-and-red palette with WCAG 2.1 AA contrast, add config icons for Diagnostics/CLI/Secrets/ACP/MCP sections, replace the roundness slider with discrete stops, and improve accessibility with aria-labels across usage filters. (#53272) Thanks @BunsDev. - CSP/Control UI: compute SHA-256 hashes for inline
<script>
blocks in the servedindex.html
and include them in thescript-src
CSP directive, keeping inline scripts blocked by default while allowing explicitly hashed bootstrap code. (#53307) Thanks @BunsDev.
Fixes
- Plugins/bundled runtimes: ship bundled plugin runtime sidecars like WhatsApp
light-runtime-api.js
, Matrixruntime-api.js
, and other plugin runtime entry files in the npm package again, so global installs stop failing on missing bundled plugin runtime surfaces. - CLI/channel auth: auto-select the single configured login-capable channel for
channels login
/logout
, harden channel ids against prototype-chain and control-character abuse, and fall back cleanly to catalog-backed channel installs, so channel auth works again for single-channel setups and on-demand channel installs. (#53254) Thanks @BunsDev. - Auth/OpenAI tokens: stop live gateway auth-profile writes from reverting freshly saved credentials back to stale in-memory values, and make
models auth paste-token
write to the resolved agent store, so Configure, Onboard, and token-paste flows stop snapping back to expired OpenAI tokens. Fixes #53207. Related to #45516. - Control UI/auth: preserve operator scopes through the device-auth bypass path, ignore cached under-scoped operator tokens, and show a clear
operator.read
fallback message when a connection really lacks read scope, so operator sessions stop failing or blanking on read-backed pages. (#53110) Thanks @BunsDev. - Plugins/ClawHub: resolve plugin API compatibility against the active runtime version at install time, and add regression coverage for current
>=2026.3.22
ClawHub package checks so installs no longer fail behind the stale1.2.0
constant. (#53157) Thanks @futhgar. - Plugins/uninstall: accept installed
clawhub:
specs and versionless ClawHub package names as uninstall targets, soopenclaw plugins uninstall clawhub:<package>
works again even when the recorded install was pinned to a version. - Browser/Chrome MCP: wait for existing-session browser tabs to become usable after attach instead of treating the initial Chrome MCP handshake as ready, which reduces user-profile timeouts and repeated consent churn on macOS Chrome attach flows. Fixes #52930. Thanks @vincentkoc.
- Browser/CDP: reuse an already-running loopback browser after a short initial reachability miss instead of immediately falling back to relaunch detection, which fixes second-run browser start/open regressions on slower headless Linux setups. Fixes #53004. Thanks @vincentkoc.
- Agents/web_search: use the active runtime
web_search
provider instead of stale/default selection, so agent turns keep hitting the provider you actually configured. Fixes #53020. Thanks @jzakirov. - Mistral/models: lower bundled Mistral max-token defaults to safe output budgets and teach
openclaw doctor --fix
to repair old persisted Mistral provider configs that still carry context-sized output limits, avoiding deterministic Mistral 422 rejects on fresh and existing setups. Fixes #52599. Thanks @vincentkoc. - ClawHub/macOS auth: honor macOS auth config and XDG auth paths for saved ClawHub credentials, so
openclaw skills ...
and gateway skill browsing keep using the signed-in auth state instead of silently falling back to unauthenticated mode. Fixes #53034. - ClawHub/macOS: read the local ClawHub login from the macOS Application Support path and still honor XDG config on macOS, so skill browsing uses the logged-in token on both default and XDG-style setups. Fixes #52949. Thanks @scoootscooob.
- ClawHub/skills: resolve the local ClawHub auth token for gateway skill browsing and switch browse-all requests to search so ClawControl stops falling into unauthenticated 429s and empty authenticated skill lists. Fixes #52949. Thanks @vincentkoc.
- Config/warnings: suppress the confusing “newer OpenClaw” warning when a config written by a same-base correction release like
2026.3.23-2
is read by2026.3.23
, while still warning for truly newer or incompatible versions. - CLI/cron: make
openclaw cron add|edit --at ... --tz <iana>
honor the requested local wall-clock time for offset-less one-shot datetimes, including DST boundaries, and keep--tz
rejected for--every
. (#53224) Thanks @RolfHegr. - Commands/auth: stop slash-command authorization from crashing or dropping valid allowlists when channel
allowFrom
r
▸ 展开全文