🚀 OpenClaw Insider

已更新至 2026.04.04 · 深度总结官方更新与 AI 趋势

💡 核心更新情报

⚠️ 行动建议:执行 openclaw doctor --fix 修复浏览器环境。

Breaking Highlights

Breaking

Plugins/xAI: move `x_search` settings from the legacy core `tools.web.x_search.*...

Plugins/xAI: move `x_search` settings from the legacy core `tools.web.x_search.*` path to the plugin-owned `plugins.entries.xai.config.xSearch.*` path, standardize `x_search` auth on `plugins.entries.xai.config.webSearch.apiKey` / `XAI_API_KEY`, and migrate legacy config with `openclaw doctor --fix`. (#59674) Thanks @vincentkoc.

Release: v2026.4.2
🔎 查看详情
Breaking

Plugins/web fetch: move Firecrawl `web_fetch` config from the legacy core `tools...

Plugins/web fetch: move Firecrawl `web_fetch` config from the legacy core `tools.web.fetch.firecrawl.*` path to the plugin-owned `plugins.entries.firecrawl.config.webFetch.*` path, route `web_fetch` fallback through the new fetch-provider boundary instead of a Firecrawl-only core branch, and migrate legacy config with `openclaw doctor --fix`. (#59465) Thanks @vincentkoc.

Release: v2026.4.2
🔎 查看详情

Security Highlights

Security

Providers/transport policy: centralize request auth, proxy, TLS, and header shap...

Providers/transport policy: centralize request auth, proxy, TLS, and header shaping across shared HTTP, stream, and websocket paths, block insecure TLS/runtime transport overrides, and keep proxy-hop TLS separate from target mTLS settings. (#59682) Thanks @vincentkoc.

Release: v2026.4.2
🔎 查看详情
Security

Providers/Copilot: classify native GitHub Copilot API hosts in the shared provid...

Providers/Copilot: classify native GitHub Copilot API hosts in the shared provider endpoint resolver and harden token-derived proxy endpoint parsing so Copilot base URL routing stays centralized and fails closed on malformed hints. (#59644) Thanks @vincentkoc.

Release: v2026.4.2
🔎 查看详情
Security

Providers/streaming headers: centralize default and attribution header merging a...

Providers/streaming headers: centralize default and attribution header merging across OpenAI websocket, embedded-runner, and proxy stream paths so provider-specific headers stay consistent and caller overrides only win where intended. (#59542) Thanks @vincentkoc.

Release: v2026.4.2
🔎 查看详情
Security

Providers/media HTTP: centralize base URL normalization, default auth/header inj...

Providers/media HTTP: centralize base URL normalization, default auth/header injection, and explicit header override handling across shared OpenAI-compatible audio, Deepgram audio, Gemini media/image, and Moonshot video request paths. (#59469) Thanks @vincentkoc.

Release: v2026.4.2
🔎 查看详情
Security

Providers/OpenAI-compatible routing: centralize native-vs-proxy request policy s...

Providers/OpenAI-compatible routing: centralize native-vs-proxy request policy so hidden attribution and related OpenAI-family defaults only apply on verified native endpoints across stream, websocket, and shared audio HTTP paths. (#59433) Thanks @vincentkoc.

Release: v2026.4.2
🔎 查看详情
Security

Providers/Anthropic routing: centralize native-vs-proxy endpoint classification ...

Providers/Anthropic routing: centralize native-vs-proxy endpoint classification for direct Anthropic `service_tier` handling so spoofed or proxied hosts do not inherit native Anthropic defaults. (#59608) Thanks @vincentkoc.

Release: v2026.4.2
🔎 查看详情

Feature Highlights

Feature

Tasks/Task Flow: restore the core Task Flow substrate with managed-vs-mirrored s...

Tasks/Task Flow: restore the core Task Flow substrate with managed-vs-mirrored sync modes, durable flow state/revision tracking, and `openclaw flows` inspection/recovery primitives so background orchestration can persist and be operated separately from plugin authoring layers. (#58930) Thanks @mbelinky.

Release: v2026.4.2
🔎 查看详情
Feature

Tasks/Task Flow: add managed child task spawning plus sticky cancel intent, so e...

Tasks/Task Flow: add managed child task spawning plus sticky cancel intent, so external orchestrators can stop scheduling immediately and let parent Task Flows settle to `cancelled` once active child tasks finish. (#59610) Thanks @mbelinky.

Release: v2026.4.2
🔎 查看详情
Feature

Plugins/Task Flow: add a bound `api.runtime.taskFlow` seam so plugins and truste...

Plugins/Task Flow: add a bound `api.runtime.taskFlow` seam so plugins and trusted authoring layers can create and drive managed Task Flows from host-resolved OpenClaw context without passing owner identifiers on each call. (#59622) Thanks @mbelinky.

Release: v2026.4.2
🔎 查看详情
Feature

Android/assistant: add assistant-role entrypoints plus Google Assistant App Acti...

Android/assistant: add assistant-role entrypoints plus Google Assistant App Actions metadata so Android can launch OpenClaw from the assistant trigger and hand prompts into the chat composer. (#59596) Thanks @obviyus.

Release: v2026.4.2
🔎 查看详情
Feature

Exec defaults: make gateway/node host exec default to YOLO mode by requesting `s...

Exec defaults: make gateway/node host exec default to YOLO mode by requesting `security=full` with `ask=off`, and align host approval-file fallbacks plus docs/doctor reporting with that no-prompt default.

Release: v2026.4.2
🔎 查看详情
Feature

Providers/runtime: add provider-owned replay hook surfaces for transcript policy...

Providers/runtime: add provider-owned replay hook surfaces for transcript policy, replay cleanup, and reasoning-mode dispatch. (#59143) Thanks @jalehman.

Release: v2026.4.2
🔎 查看详情