OpenClaw

In stable 2026.10.7, Workshop edits learned procedures immediately instead of staging proposals for approval. Versioned Undo lets the owner reverse an edit; it does not put review back before a procedure can guide a new session.

OpenClaw’s self-hosted Gateway connects chats to agents and their tools.

Where it stands, 2026-10-24

Upgrade priorities: check the service’s Node runtime, review Workshop’s switch to immediate edits, and select API-backed models for sandboxed scheduled or delegated work. Legacy Workshop proposal and curator integrations need migration; provider compaction settings need explicit review.

Channel snapshot. Install stable 2026.10.7 with npm i -g openclaw@2026.10.7. Check the service’s Node runtime against >=24.22.1 <25 || >=26.12.1, not just the shell’s runtime. At 10:38 UTC on 24 October 2026, npm’s beta selected 2026.10.10-beta.3 and extended-stable selected 2026.9.33. The exec and placement limits below still matter after updating.

Release boundaries: Slack room-ID binding and Discord room-ID binding repairs are beta-only. Predicate exec repairs, host-CLI placement guards, cloud-worker exec review, guest welcome sessions, and the Windows restore-startup timeout repair remain only on main, the development branch. X guest admission and automatic work-session publication are off by default; Anthropic server compaction and manual OpenAI endpoint compaction require opt-in.

Restrict shell execution: some Bash tests can run commands without approval. Stable 2026.10.7 still treats argument-blind predicates as safe builtins: command substitution inside a quoted test -v operand can run without its allowlist match or on-miss approval. The repair is main-only; beta 2026.10.10-beta.3 and extended 2026.9.33 retain the gap. Exclude those forms from admitted work and restrict exec or host exposure. Asking adversarial input to behave is not enforcement.

Select API-backed models for sandboxed delegated work. The documented spawn restrictions remain available at 2026.10.7. For sandboxed scheduled or delegated work, explicitly select an embedded/API-backed model. Check inherited subagent models, fallbacks, and runtime overrides. Main adds guards against routing that work to a host-executed CLI; stable 2026.10.7 and beta 2026.10.10-beta.3 do not contain those guards. A sandbox classification or sandbox: require is not proof that these CLI paths run inside the container.

Check agents.entries.<id>.subagents.model, agents.defaults.subagents.model, and scheduled payload models, not just the parent’s primary model. Main rejects the incompatible placement rather than containerizing the CLI.

Choose immediate learning or manual initiation. Background learning defaults to auto, and Workshop retains ten versions per skill.

Set skills.workshop.autonomous.mode: "off" when learning must be initiated manually. Otherwise, review the change feed, test Undo, and keep backups beyond its bounded history. Learned skills bypass ordinary per-agent skill allowlists; Undo does not decide which procedures deserve to stay.

Migrate the old Workshop review machinery. Legacy propose becomes off, approval settings disappear, and old auto plus pending approval is not silently disabled. Update integrations: proposal/curator methods return errors, proposal hooks are removed, and exported pending drafts are not loaded automatically. Copy needed content from old collection backups manually.

Use stable to bind approval to final plugin arguments. Stable 2026.10.7 requires renewed approval when a plugin changes already-approved parameters, or blocks the call; extended 2026.9.33 carries the same repair. Test transforming plugins with their final arguments before continuing to use them.

Test headless policy separately. Stable now initializes blocking plugin hooks under openclaw agent exec, where they could previously be skipped. Try a harmless denied operation through that command; a passing Gateway test does not check standalone dispatch.

Key privileged chat policy by stable IDs. Stable still matches Slack room names and Discord room names. Slack room-ID binding and Discord room-ID binding are repaired in beta 2026.10.10-beta.3. Use channel IDs now. Separately, replace name:/username: sender overrides with id: keys: a renamed sender can select another person’s policy, and main only adds a warning. Use stable sender IDs on beta too.

Grant specialist handoffs without opening every transcript. Use agents.entries.<agentId>.tools.agentToAgent.send for selected request-and-reply destinations while session visibility stays agent, tree, or self. Set collaboration permissions deliberately: stable defaults to cross-agent access and all-session visibility, and extended 2026.9.33 has the same broad defaults. Set tools.agentToAgent.enabled: false to block ordinary cross-agent access; owned native/ACP child sessions remain reachable under tree or all visibility. A privileged recipient can still act or disclose information; keep unrelated operators on separate Gateways and OS boundaries.

Try a scoped follow-up instead of another reminder. A new scheduled agent turn in its authenticated creator’s exact conversation retains that authority and revalidates it on each occurrence. An at continuation can call next_check to rearm itself; old jobs, guests, scripts, and other conversations gain no inferred authority. Before replacing the reminder loop, verify the target and revocation. Use the API-backed placement above.

Review Telegram recovery before reissuing work. Stable rejects legacy imports older than 24 hours as stale-legacy-import, including genuinely unprocessed old instructions. Decide which old instructions still deserve to run. Inspect migration warnings and pending work: already-imported rows are not cleaned up.

Configure provider-side conversation compaction explicitly after upgrading. Anthropic server compaction requires params.anthropicServerCompaction: true, direct API routing, and non-OAuth authentication. Manual OpenAI endpoint compaction requires params.responsesCompactEndpoint: true; budget-triggered use of that endpoint remains the default on public OpenAI Responses routes.

Update the external runtime plugin alongside the core. OpenClaw refuses known-incompatible versions of its external @openclaw/codex runtime, whose OpenClaw plugin compatibility floor is 2026.9.7. Use openclaw update repair or openclaw plugins update codex, then restart the Gateway.

Retest manual CLI session-reset workarounds. In 2026.10.7, a changed tool-name fingerprint invalidates the native CLI binding instead of resuming its stale catalog. Test the actual restart and tool-change sequence before keeping a workaround that discards useful continuity.

Record where the Windows update failed. Stable repairs Windows junction recovery and scratch retirement, and 2026.10.7 adds activation and recovery repairs. Record the installed updater’s version and the failed step. The restore-startup timeout repair is still main-only; transient database inspection contention calls for retry guidance, not repeated restoration.

Upgrade before browser pairing on shared hosts. Stable passes a private file path to the browser opener instead of a pairing URL another local OS user could read from process arguments. Keep credential-bearing URLs out of shared logs too.

Choose desktop downloads separately from the Gateway package. Linux has 2026.10.7 AppImage and DEB downloads, and its updater pointer selected that version at 10:40 UTC on 24 October 2026. At that read, 2026.10.7 had no macOS DMG or ZIP; 2026.10.6 has macOS downloads.

Decide what becomes public before enabling X replies. Stable supports admitted X mentions and public replies, with guest admission and automatic work-session publication off by default. Inspect admission and API cost limits. Published thread links expose later user messages and final answers to signed-out readers; redaction is best effort, and saved copies cannot be recalled. Check the transcript before publishing it.

Pin model choices when reproducibility matters. OpenClaw can discover supported Claude and ChatGPT models without another core release. Its Google API provider now defaults to Gemini 4 Argon. Evaluate the selected route and model before inheriting that default.

Set shared-chat bot admission yourself. Discord admits bot messages by default under normal access and mention rules; false disables bot-triggered turns and mentions requires a mention. Slack additionally requires the bot in the room’s allowlist or an explicit owner ID as a current member.

What is unresolved

• A published version with the exec and host-CLI guards, followed by recorded refusals on the affected predicate, scheduled, and child-run paths, would resolve those release questions. Stable room binding needs a released tag containing the beta repairs above, with rename/thread tests against the installed adapters.
• Gateway-owned cloud-worker exec review remains on main. Require a release and a recorded approve/deny/revoke sequence on the intended worker before relying on it. Keep a working placement; do not relax exec policy to force dispatch.
• Invitation-bound guest welcome sessions are main-only. A release and a fresh signed-in invitation trial covering role text, expiry, and retry would settle whether the whole flow works. For general onboarding, Quick start auto-acknowledges a short warning while Custom retains fuller confirmation; record both fresh-machine flows through their later screens.
• Workspace-scoped read/write/edit tools use root-bound operations. Complete workspace containment still needs the residual raw-path audit and race tests beyond those tools.
• To learn whether direct Workshop learning saves owner attention, repeat real tasks. Record completed outcomes, bad procedures, restoration success, and time spent reviewing and correcting them.

Review date and evidence method

Source policy: what Frontier watches and accepts as evidence

Edited and maintained by Bitter Frontier.

View source on GitHub