AI Agent Changelog

v2.1.265 broke two entire classes of setup. A regex in the Artifact tool's input schema that third-party Anthropic-compatible endpoints reject made every turn fail with HTTP 400 for anyone using ANTHROPIC_BASE_URL — for three days, until v2.1.268. And the undocumented CLAUDE_CODE_USE_GATEWAY, previously inert on its own, began forcing gateway sign-in, breaking setups that had it sitting beside an API key (fixed in v2.1.266). Also: three managed allowlists changed from admitting everything to admitting nothing when unreadable, a new maxEffortLevel cap that holds across Bedrock/Vertex/Foundry, a 300-second WebFetch deadline, and two more backslash path-containment bypasses on macOS and Linux.

Full entry → Affects: /openclaw/, /openclaw/configuration/, /openclaw/security/, /openclaw/cost-optimisation/, /security/

Managed Agents gained a server-side three-way decision: the new auto permission policy evaluates each agent or MCP tool call and runs it, denies it, or pauses for approval — with the reasoning exposed in an evaluation field, so you can reconstruct why a call was allowed. ant beta:sessions connect attaches a terminal to a live session to follow it, message it, and allow or deny tool calls. Smart reports (Enterprise beta) analyse team usage, cost and friction — and flag which repeated patterns are worth packaging as shared skills, which is the third vendor this month to ship agents mining their own history for reusable procedures.

Full entry → Affects: /claude-cowork/, /claude-cowork/vs-api/, /tools/cost-calculator/

Three launches in three days. The Agents API (public beta) brings managed sessions, durable work across turns, and custom tool/MCP integration — the same shape as Anthropic's Managed Agents, meaning both major vendors now offer to run the harness for you. GPT-Live 1 does full-duplex voice at $0.05 per minute, not per token; we are deliberately keeping it out of the cost calculator rather than printing a per-minute figure in a per-MTok column. Also GPT Image 2.5 Sunburst and Flare, Prompt Cache Diagnostics reaching GA, and API key expiration dates with org-level maximum lifetimes.

Full entry → Affects: /chatgpt/, /chatgpt/pricing/, /chatgpt/agent-mode/

The cycle that has been assembling for three weeks is complete: CI fails, the failure goes to the agent from the PR panel, the agent fixes it, and it can now commit and push so the pull request updates without a follow-up prompt — with permission prompts still confirming each write and an off switch in settings. Also notable: an opt-in one-time import of global Claude Code instructions, simple skills and disabled MCP definitions, the first cross-harness migration path we have seen shipped as a feature. Plus /caffeinate, an @ model picker for subagent instructions, and the Kilo Swarm shared agent board behind a flag.

Full entry → Affects: /kilocode/, /kilocode/orchestrator/, /kilocode/setup/

A patch tag containing more change than most projects ship in a year: 5,139 non-merge commits across 4,364 files (+601,014 / −768,419) and 632 merged PRs, eleven days after v0.21.0. The release explicitly declines to enumerate what is in it, listing only areas — modularization, startup performance, MCP authorization, cron scheduling, delegation reliability — with curated notes deferred to v0.22.0. We are flagging that rather than repeating it neutrally: it is the same deferral pattern that ran through August, and it means anyone deciding whether to update is choosing between an unknown and staying behind.

Full entry → Affects: /hermes/, /hermes/setup/, /hermes/tasks/

Discord channel setup now rejects a token placeholder (#11404) instead of accepting it — a small change with a large diagnostic payoff, since accepting a placeholder means the config validates, the gateway starts, and the failure surfaces somewhere unrelated. Also: providerless component onboarding, reused Hermes dashboard and API forwards, a raised Gemini probe budget if onboarding was timing out for you, offline image rebuilds now consuming verified audits, and a Tavily credential repair. v0.0.123 documentation is staged and the OpenShell 0.0.116 cutover completed.

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/switching-providers/

Edit/Write/Read rules whose path contains parentheses were dropped as invalid — the rule sat in your settings, the interface showed it, and it did nothing, leaving folders you believed read-only writable. Paths like Program Files (x86) are not exotic; verify after upgrading. Also fixed: zsh commands hiding a command substitution in a REPORTTIME assignment auto-approved, and Read() deny rules missing option-value paths, git diff operands and cd DIR && cat FILE compounds. New: --permission-prompts none, managedMcpServers, a /diff panel, and /skill-doctor to show what unused skills cost you in context.

Full entry → Affects: /openclaw/, /openclaw/configuration/, /openclaw/security/, /openclaw/skills-guide/, /security/

The orchestrating agent can now choose a model, provider and reasoning effort per subagent task (experimental) — the largest single lever on what a multi-agent run costs, arriving the same week the tier spread widened to 13×. Agent Manager gained PR discussion comments and review submissions with send-to-agent actions, /update-from-base that updates a worktree without stashing uncommitted work, and local application preview with embedded devtools and element-level feedback. v7.5.14 cut CPU use in large repositories by pausing hidden-panel polling. v7.5.15 reports no notable changes.

Full entry → Affects: /kilocode/, /kilocode/orchestrator/, /kilocode/models/, /kilocode/setup/

Windows Ollama DNS rebinding is fixed (#10889) — the attack where a web page you visit resolves a hostname to 127.0.0.1 after earning origin trust and then talks to your local model server. Local-first inference is this platform's whole premise, so a local endpoint reachable from a browser tab is the exposure that matters most here. Also: the Model Router pool was updated (what a request without an explicit model gets), preset memory failures now surface instead of failing quietly, a pinned vLLM retry loop in onboarding was stopped, and v0.0.120 docs are staged.

Full entry → Affects: /nemoclaw/, /nemoclaw/local-gpu/, /nemoclaw/setup/, /nemoclaw/switching-providers/

GPT-6 Astra (gpt-6-astra): $10 input, $1 cached input, $50 output per million tokens, a 1,050,000-token context window and 128k max output. That is the same headline price as Claude Fable 5.1, launched two days earlier — so the differentiator moves to the cache rate, where Astra's $1/MTok is 4× Fable 5.1's $0.25. Also shipped: async tool calling and mid-turn steering on the Responses API, and a 429 slow_down / 503 server_is_overloaded split that your retry logic should treat differently. The Assistants API and four transcription models shut down February 26, 2027.

Full entry → Affects: /chatgpt/, /chatgpt/pricing/, /chatgpt/api-vs-chat/, /tools/cost-calculator/

Gemini 3.8 Flash: $0.75/$3.75 with a 1M context — but that rate doubles to $1.50/$7.50 on January 1, 2027. Anyone modelling 2027 costs on today's number is modelling half of it. xAI joins the calculator: Grok 4.6 is $2/$6 with a 500K context, and at 200K tokens the whole request rebills at $4/$12 — a cliff, not a gradient, so an agent with a growing context doubles its own bill without a signal. It powers Grok Bot, xAI's always-on agent (beta since August 11, via SuperGrok Heavy or Cursor). DeepSeek V4 Flash lands at $0.44/$1.32 peak with a 1M context and an MIT licence. Google had not been re-verified since July 18; it is now current.

Full entry → Affects: /tools/cost-calculator/, /compare/, /benchmarks/, /openclaw/cost-optimisation/

Fable 5.1 (claude-fable-5-1) and Mythos 5.1 both ship at $10/$50 — the same price as Fable 5 — with a 1M-token default context, 128k max output, and cache reads at $0.25/MTok, which is 2.5% of the input rate and makes the cache the entire cost story for long-context agents. Before you change a model string: tool_choice types any and tool now return a 400 (use strict_tool_use or structured_outputs), thinking blocks survive only into the same or newer models, and neither model offers zero data retention — a compliance blocker, not a preference. Mythos 5.1 is Project Glasswing only.

Full entry → Affects: /claude-cowork/, /claude-cowork/vs-api/, /claude-cowork/pricing/, /tools/cost-calculator/

File tools followed a symlink swapped inside the working directory after the permission check, so reads and writes could land outside the approved location. Two siblings: Grep and Glob ignored Read() deny rules through a symlinked search path, and plugin commands could point outside their plugin directory. The rule was right; the path resolution was not. New: --restricted, which strips command- and code-running tools plus WebFetch and ignores settings files entirely — so a cloned repo cannot un-restrict your session. Auto mode gained a Containment Escape rule covering cloud metadata-credential fetches and egress evasion.

Full entry → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/security/, /security/

The curated notes deferred since early August are here, covering v0.20.1–v0.20.6 — ~5,800 commits, 2,475 PRs, 2,100 issues closed. Bot Mode is now bundled and default-on: every agent profile gets a name, an avatar and a place in a roster, with Discord-style group chats where multiple bots and you talk in one room. The more consequential change is quieter — cron jobs gained memory and continuity, so scheduled agents learn between runs instead of re-deriving context every fire. Also: subagents steerable live mid-flight, and the agent can drive the desktop's own browser.

Full entry → Affects: /hermes/, /hermes/tasks/, /hermes/memory/, /hermes/mcp-tools/, /hermes/discord-gateway/

81 commits since 1.3.0, and the theme is survival. A durable notification inbox means approvals and auth prompts outlive the session that raised them — the difference between an agent that runs long and one you can leave running overnight. Background subagents arrive with per-child delivery, activation provenance, a cap on autonomous wakes, and healing sweeps for orphans. Sandboxes on the local-Docker profile are now persistent per user, so installs survive between commands, behind a managed egress proxy whose credential bindings never reach sandboxed code.

Full entry → Affects: /ironclaw/, /ironclaw/setup/, /ironclaw/configuration/, /ironclaw/security/

GPT-5.6 Sol now costs $4 per million input tokens and $20 per million output, down from $5/$30 — 20% off input, 33% off output. That is exactly what GPT-5.5 has cost since April, so GPT-5.5 is now strictly dominated: same price, older model. Our cost calculator is updated. Also: API customers can now select regional processing per request via a prefixed domain, with a key from a Global-geography project. Ultrafast tier pricing is still unpublished, nine days on.

Full entry → Affects: /chatgpt/, /chatgpt/pricing/, /chatgpt/api-vs-chat/, /tools/cost-calculator/

Python SDK v1.0 breaks on purpose. The HTTP layer moves from httpx to the httpx2 fork — build custom http_client, Timeout and transport objects from httpx2, and call httpx2.alias_httpx() if your tracing or mocking patches httpx, or those patches will silently miss every request. Requires Python 3.10+ and removes Text Completions, temperature/top_p/top_k on Messages, and the tool runner's compaction_control. AnthropicBedrock now raises instead of defaulting to us-east-1. Claude Code's new /claude-api upgrade automates the migration.

Full entry → Affects: /claude-cowork/, /claude-cowork/vs-api/, /claude-cowork/pricing/

Bedrock streaming behind proxies that strip the response Content-Type header silently doubled billed API calls by re-running every turn non-streaming — no error, no warning, just a bill twice the size your token counts imply. Fixed. Also: masked password-style fields let their text be pasted back with Ctrl+Y or saved to prompt history on double-Esc; WebFetch cached expired pages for the whole session instead of 15 minutes; /cost now includes the 1.1× data-residency premium it was omitting; Windows gets cross-session messaging. v2.1.240 shipped with no itemized notes.

Full entry → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/security/, /openclaw/cost-optimisation/, /security/

GHSA-r292-9mhp-454m is remediated with tar@7.5.21 across the reviewed OpenClaw archive, the committed runtime, the plugin production graph and the npm-private image trees — without an audit exception. The user-facing bug: the plugin copy of withLocalNoProxy normalized NO_PROXY and no_proxy separately, so a host setting only lowercase no_proxy lost every operator exclusion. Also: macOS Homebrew repair-guidance loop fixed, Express install no longer aborts on a busy DGX Station peer, and v0.0.114 docs are staged.

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/policy/, /nemoclaw/local-gpu/, /nemoclaw/switching-providers/

Four beta headers stop being required in one window: files-api-2025-04-14, skills-2025-10-02, ce-user-management-2026-07-13, and the computer use tool's. Requests that keep sending them work unchanged, but the Files API's GA response format differs from its beta one — dropping the header gets you expires_in_seconds file expiration and page/next_page pagination with an ids[] filter, so removing it is a behavior change, not a no-op. Agent Skills and /v1/skills are now GA, including Messages API requests that load Skills through container. Computer use returns as the computer_toolset_20260801 toolset with batch actions, zoom on by default and per-member configs — with a documented migration from computer_20251124. The genuinely new capability is the browser use tool (browser_toolset_20260801): a client toolset driving a browser your application hosts, reading the page's own accessibility tree, elements, forms and tabs rather than inferring structure from pixels. Managed Agents also gain allowed_domains/blocked_domains on web_search and web_fetch — the best available lever against injection through fetched content — plus memory stores on self-hosted sandboxes and a redesigned Console session viewer. No new models, no pricing changes, no deprecations.

Full entry → Affects: /claude-cowork/, /claude-cowork/vs-api/, /claude-cowork/skills-guide/, /claude-cowork/skills-database/, /openclaw/skills-guide/, /security/

Unbounded memory growth in long interactive sessions is fixed — subagent tool results are now released once they leave the recent display window, so the cost scaled with how many subagents you ran rather than how much context was live. Plugin marketplaces gain headersHelper, a command that mints HTTP headers for catalog and archive fetches, and it ships with all three guardrails you would want: the command is shown before it runs behind a [y/N] prompt, project-scoped helpers and inline MCP servers require the folder trust dialog (including under claude -p), and project, plugin and agent-file helpers run without inherited credential environment variables. On macOS, sandbox wildcard read-deny rules now take precedence inside allowed read regions, cover directory contents, and survive a rename — each clause was previously a hole, so audit what your **/.env rules actually blocked. Also: ANTHROPIC_DEFAULT_MODEL sets what new sessions start on while /model still overrides; keybindingFlavor: "readline" makes Ctrl+W delete to whitespace; prompt caching is fixed for gateway and custom-base-URL sessions (real money); a built-in Concise output style arrives and custom styles stop drifting back to the default mid-session; cross-session sends that are refused or dropped now say so instead of reporting success; notify_when_idle lands on SendMessage; nine Remote Control fixes; MCP stdio servers stop being probed before initialize; and the double-press Ctrl+L /clear shortcut was removed. No reverts.

Full entry → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/security/, /openclaw/skills-guide/, /openclaw/cost-optimisation/, /claude-cowork/, /security/

1.3.0 is now current stable, and it removes five things: the standalone missions page, the routines surface, admin analytics placeholders, project mission placeholders, and IronLoop network settings. That is the second consecutive IronClaw minor with breaking removals after 1.2.0 dropped the channel allowlists — read the Removed section of every 1.x release before upgrading. The feature to read carefully is Telegram linked devices: pair a personal Telegram account so the agent can read your conversations and act as you, with the upstream notes stating plainly that there is no local mirror or index — but message content a run actually reads is retained in that run's transcript like any other tool result. Also added: per-user model preferences bounded by a tenant-scoped selection policy; structured automations, where a scheduled trigger carries a validated prompt spec, execution policy and required-skills contract checked by a fail-closed preflight at creation, with a no-result sentinel so a run with nothing to report finishes silently instead of delivering filler; .docx/.xlsx/.pptx structural editing and HTML-to-PDF; the full Slack messaging vocabulary; ranked memory recall; and opt-in parallel tool batches. Substantially fewer database writes per turn, and published docs now deploy from a docs-live branch that stable releases move, so they describe the released binary rather than unreleased main.

Full entry → Affects: /ironclaw/, /ironclaw/setup/, /ironclaw/configuration/, /ironclaw/security/, /ironclaw/skill-allowlisting/, /ironclaw/vs-openclaw/

nemoclaw <sandbox> destroy --yes terminated a live SSH session without printing any notice, because the confirmation helper probed for active sessions and then returned early on --yes/--force — the probe result was discarded and the warning branch was unreachable. --yes and --force now waive the prompt only; the warning prints on the pre-confirmed path and lists the detected PIDs. The upstream PR notes the rebuild path has the same shape and was left out of scope. Experimental Hermes Google Chat support arrives with the right credential handling: OpenShell keeps the service-account private key outside the sandbox and substitutes the in-sandbox placeholder only at the approved request boundary. A failed in-sandbox openclaw command now names openclaw devices list/approve when a scope upgrade is pending — and deliberately declines to guess the request id. Local inference took the bulk of the work: managed vLLM validates a running server against the requested profile before reuse and resumes interrupted installs, the Ollama installer validates downloads before execution, connect-time recovery renders backend-specific guidance for bind refusals, Gemini onboarding defaults to gemini-3.6-flash, and the retired DeepSeek V4 Pro menu entry is gone. Fail-closed additions: policy changes preserve the authoritative OpenShell exit status, and the Hermes gateway broker refuses a healthy listener unless the live process is actually the NemoClaw broker.

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/local-gpu/, /nemoclaw/switching-providers/, /troubleshooting/

The Agent Manager PR panel was reworked — resolved threads collapse into one-line rows in a Resolved group, each thread shows its replies, every card gets Send to agent / Resolve / Copy / Open file / Open on GitHub, and one button sends all unresolved comments at once. The detail that matters: comments arrive as structured review comments instead of pasted text, preserving the file and line each one attached to. The fix worth flagging: when a permission prompt contained a large diff or a long command, the Allow and Deny buttons were pushed out of view — so the riskier the action, the less reachable the approval controls; the prompt now scrolls its own content. The separate trust action was removed from multi-project repositories (VS Code workspace trust still gates setup and run scripts), and two experimental features were removed outright: the agent requirements check, and task-aware tool-output pruning along with its settings — plan for higher context usage on tool-heavy sessions. Default speech-to-text is now NVIDIA Parakeet TDT 0.6B v3. Plus: @terminal captures the focused Agent Manager terminal; Ask → Code keeps the selected agent; diff totals use the remote's current default branch when local metadata points at a retired trunk; delegated subagent sessions open in inspector tabs; and slash commands stop wiping text you already typed.

Full entry → Affects: /kilocode/, /kilocode/setup/, /kilocode/models/, /kilocode/orchestrator/, /kilocode/vs-claude-code/

The fourth consecutive tag with no itemized changes. v0.20.5 rolls up roughly 323 merged PRs — about 746 commits across ~1,250 files — since v0.20.4 the day before, and names areas rather than changes: Bot Mode group-room threads, PDF and file attachments with drag & drop, a CLI polish wave, execution-discipline and runtime stall guards from the Composio eval findings, hermes worktree list/prune, and desktop performance work. Two items are actionable even without notes: the keyless web tier — a five-vendor free rotation with ring failover giving web search on fresh installs with zero API keys — and cron jobs gaining persistent memory and per-job reasoning effort, which changes what a scheduled Hermes job can do. Curated notes covering everything from v0.20.0 onward are still promised with v0.21.0, now seven days out. We will cover the substance when it lands rather than write specifics we cannot verify.

Full entry → Affects: /hermes/, /hermes/setup/, /hermes/tasks/, /hermes/free-models/

A Prompt Caching dashboard landed on the OpenAI API platform, tracking cache hit rate over time, cache reads per write, and the breakdown of cache-read, cache-write and uncached tokens, filterable by model and service tier. Caching is the largest single lever on agent running costs and the hardest to verify — you restructure a prompt to be cache-friendly and then have no direct confirmation it worked. Cache reads per write is the metric your prompt structure actually controls. Separately, transparent backgrounds are in preview for image generation: set background to transparent with png or webp output (jpeg cannot). Still no published pricing for the Ultrafast tier announced August 13 — a week on, our cost calculator cannot model it and we will not estimate.

Full entry → Affects: /chatgpt/, /chatgpt/pricing/, /chatgpt/api-vs-chat/

Shift+Tab inside the permission prompt's comment field approved the edit and granted session-wide edit permission instead of closing the field — the key you pressed to leave an annotation was the key that granted the broadest available answer. The companion change is a policy: permission dialogs now guarantee display text and "don't ask again" match what a grant would cover, and "don't ask again" is withheld when contents cannot be fully displayed. That is the third consecutive release closing the gap between what an approval dialog says and what approving it does. Also: notebook delete/replace dialogs stop silently omitting cell content they could not read, whole-prompt-cache invalidation on language-server reconnect is fixed (a real recurring cost), the embedded grep fails fast on pathological patterns and prints correct context for -m N with -A/-C, background cloud sessions stop re-rendering their event streams on every update, and an opt-in spellcheck setting arrives. No reverts this release.

Full entry → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/security/, /openclaw/cost-optimisation/, /claude-cowork/, /security/

The headline fix is the second half of yesterday's bug. The OpenClaw rebuild hash refresh treated a root-owned config directory as success without validating the persisted .config-hash — rebuild exited zero after openclaw doctor --fix returned 255, with the final probe reporting hashChanged: true and hashValid: false. It now verifies that pair and fails after relocking Shields when integrity is unverified (#9532). Separately, the dashboard port release callback read its call receiver instead of the original reservation scope, so the host port stayed bound after teardown (#9569); Hermes GPU fallback rollback could leave both managed containers running and now fails closed on identity drift (#9512); the Windows-host Ollama probe stops accepting null, primitive and nested-array model entries (#9518); an OpenClaw-only OTEL variable stops blaming a missing Dockerfile ARG for an agent-scope mistake (#9507); and the contributor doctor accepts all seven Git spellings of true for commit.gpgsign (#9491).

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/local-gpu/, /nemoclaw/switching-providers/, /troubleshooting/

rc.2 has the release notes rc.1 lacked, and they retroactively explain the rc.1 tag. Upgrades from 1.2 now accept and preserve the released extension activation_state field instead of crash-looping during startup — the worst-shaped failure a release candidate can have, since the install completes and then no process survives to say why. The canonical Reborn runtime image again supports opt-in, public-key-only worker SSH on port 2222 under an unprivileged user, with all three qualifiers intact across the restoration. 1.2.0 remains the current stable release and remains what our guides target; our version data records the rc separately, so no page here points readers at a prerelease.

Full entry → Affects: /ironclaw/, /ironclaw/setup/, /ironclaw/configuration/, /ironclaw/security/

A rename with substance behind it. The Claude Console's Workbench is now Playground, which supports every Messages API parameter, ships templates demonstrating code execution and web search, and — the part worth knowing — shows the full SDK request alongside the API response for each run. A console that shows you the exact request it sent teaches the API surface far better than parameter docs, and narrows the gap between "works in the console" and "works in my code." Update any links you keep pointing at Workbench. No new models, no pricing changes, no deprecations this window.

Full entry → Affects: /claude-cowork/, /claude-cowork/vs-api/, /claude-cowork/pricing/

Three security fixes that share a theme: a protective mechanism was working, and showing the wrong thing to the wrong person. MCP diagnostics were printing resolved secrets — scope-conflict warnings now show the configured ${VAR} form, and connection-failure details show only the server origin. Sharper still: credential masking on relayed permission previews could hide commands, paths, or destinations from the approver, which is a redactor defeating the point of the approval it was attached to. And strictKnownMarketplaces accepted SCP-style git sources whose host differs from the one git actually connects to. The Windows NT-namespace (\??\) hardening widened to remote file reads, session restore, CLAUDE.md includes, workflow scripts and file uploads. Feature side: sessions now continue automatically when a claude.ai usage limit resets (opt out in /config), a GitLab MR badge lands in the footer and statusline, /permissions and /add-dir open mid-turn, and the built-in claude-api skill's context cost fell from 200k+ tokens to ~25k.

Full entry → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/security/, /openclaw/cost-optimisation/, /claude-cowork/, /security/

Two of the permission changes shipped in v2.1.232 were reverted here. The Windows Cygwin-style symlink check and the Bash input redirection (< file) check are both out, with upstream saying a narrower version returns later — and a companion fix addresses a v2.1.232 regression where auto mode on Windows kept stopping for approval on ordinary cd <dir> && <cmd> > file commands. We reported both as shipped on August 14 and are carrying the correction. Still hardened: the NT \??\ device prefix that bypassed UNC path validation, and skill/command argument substitution so argument values are no longer re-expanded as template markers — a template-injection fix for anyone writing skills that take user input. Behavior change to note: todo and task-tracking tools are gone on Opus 4.8, Sonnet 5, Fable 5, Mythos 5 and newer models (CLAUDE_CODE_ENABLE_TODO_TOOLS=1 restores them). Also new: forward_user_identity for per-user gateway spend attribution, and CLAUDE_CODE_TOOL_MEMORY_LIMIT memory cgroups for Bash on Linux.

Full entry → Affects: /openclaw/, /openclaw/setup/, /openclaw/skills-guide/, /openclaw/security/, /claude-cowork/, /security/

The Bedrock and OpenRouter runtime adapters bind 0.0.0.0, and their GET /health handlers answered before any authentication. Any peer that could route to the host port — another local user, or a host on the LAN — could read the adapter's endpoint URL, region, upstream config hash and credential hash. Both routes now answer loopback peers only. Second: isCredentialAvailable() matched an unqualified messaging input id, and botToken is the secret input of Telegram, Discord, Slack and WeChat alike — so one channel's token marked another channel's secret available, and an onboard run with only TELEGRAM_BOT_TOKEN present planned WeChat as configured and skipped its host-QR pairing hook with no WeChat token in existence. Third: a state restore joined its steps with ; and ended on a || true chmod, so a failed config swap reported a restored file and nemoclaw rebuild printed a restored-state count while openclaw.json kept its old contents.

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/local-gpu/, /security/, /troubleshooting/

Three stable tags in three days, none with curated notes. Together they cover roughly 1,363 commits across about 596 merged PRs, and Nous repeats on all three that full notes for everything since v0.20.0 will ship with v0.21.0. That is now four consecutive tags deferring their notes. The blurbs do name three things worth knowing before you upgrade: the MCP 2.x SDK migration with 2026-07-28 stateless protocol support, a bundled Bot Mode (hermes-bots) plugin carrying the core teammate protocol, and NVIDIA SkillEvaluator Tier 1 advisory scanning on skill installs running license and security checks. Also named: subprocess Python runtime ownership hardening, cron scheduler self-heal, SessionDB contention fixes and session handoff data-loss fixes. The Node 26 requirement still applies.

Full entry → Affects: /hermes/, /hermes/setup/, /hermes/vps-install/, /hermes/mcp-tools/, /hermes/skills-guide/

The 1.3.0 line opened four days after 1.2.0 went stable, and the release body contains nothing but install instructions and a download table. No changelog section, no summary, no list of what changed. We are reporting the tag because a 1.3.0 line opening this soon is itself information, but we have nothing substantive to tell you about it. 1.2.0 remains the current stable release and remains what our guides target; our version data records the rc separately, so nothing on the site points at a prerelease.

Full entry → Affects: /ironclaw/, /ironclaw/setup/, /ironclaw/configuration/, /ironclaw/security/

A feature release that behaves like a security release. Three permission bypasses fixed, and they share a shape: a check that looked at the right thing and was told the wrong answer. On PowerShell, variable-writing parameters could silently overwrite $PSDefaultParameterValues and redirect where later commands read and wrote files. On Windows, Git Bash followed Cygwin-style symlinks that path validation saw as regular files. And nested git repositories inherited trust from a parent directory — each now requires its own confirmation. Separately, Remote Control sessions hosted by a bridge inside a cloud session were inheriting that session's transcript or credentials. The /tmp cross-session socket directory now refuses a pre-planted symlink, the Linux sandbox lost a protected-path bypass, and sandbox.ripgrep can no longer be overridden from project settings. Feature side: subagent forking is on by default — a fork inherits the full conversation and prompt cache, which makes it cheaper than a fresh spawn — and typing @ now mentions another Claude session by name. GitLab arrives in two places: token-family secret redaction, and gitlab.com plugin marketplaces. Correction (Aug 18): the Cygwin-symlink and input-redirection checks were reverted in v2.1.233 and are not in effect on current builds.

Full entry → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/security/, /openclaw/cost-optimisation/, /claude-cowork/, /security/

1.2.0 is stable, and it deletes the channel allowlists. slack_allowed_channels, telegram_allowed_channels, slack_shared_subject_user_id and slack_subject_routes are gone. Shared-conversation admission is now presence-based: any channel or group the bot has been added to is served, with nothing to configure. If you used an allowlist to keep the bot quiet in channels it was invited to but shouldn't answer in, upgrading removes that boundary and the key that expressed it — channel membership is now the whole policy, so audit it first. The headline feature is Slack channel context: a top-level ping supplies the last 30 messages, a thread ping supplies up to 100 replies, fetched host-side under channels:history — and framed to the model as untrusted quoted content, never as instructions, which is the correct design and worth copying. Shared conversations are now genuinely shared while each run still acts as its invoker, unpaired users get an anchored connect notice in place, and every parked gate is announced on both delivery lanes.

Full entry → Affects: /ironclaw/, /ironclaw/configuration/, /ironclaw/security/, /ironclaw/setup/, /ironclaw/skill-allowlisting/, /security/

File references in agent responses are now clickable, and validated before they're linked: inline code spans are checked against the filesystem, so spans matching real files become links that open at the referenced line while non-existent paths stay plain code. That restraint matters — a UI that links every code-shaped string teaches you to distrust its links. The built-in experimental Morph WarpGrep codebase search was removed and its retired config flag is now ignored. Agent Manager gained PR comment actions (resolve/unresolve review threads, jump to comments, scroll-to-top in the diff view). One fix worth naming: subagent permission errors that cited phantom deny rules — and blocked commands the subagent's own config explicitly allowed — are fixed. Also: structured AWS access keys and Google Cloud service-account JSON for Bedrock and Vertex AI in VS Code, selectable default reasoning variants, and an opencode bump to v1.18.13.

Full entry → Affects: /kilocode/, /kilocode/setup/, /kilocode/models/, /kilocode/orchestrator/, /kilocode/security/

A tag, not a story — but a big tag. v0.20.1 rolls everything merged since v0.20.0 "Herald" into a stable release downstream consumers can pin: 1,444 commits across roughly 656 merged PRs, touching 2,172 files and closing about 481 issues, spanning the desktop app, gateway platforms, installers, the tool system and provider catalogs. Nous ships no curated notes with it, stating that full notes for the whole window — highlights, feature areas, contributor credits — will arrive with v0.21.0 and that nothing is skipped. Practically: upgrade with hermes update for the accumulated fixes, but expect to learn what changed later. The Node 26 requirement from v0.20.0 still applies.

Full entry → Affects: /hermes/, /hermes/setup/, /hermes/vps-install/

A third speed tier, announced but not generally available. Ultrafast mode is a new API service tier for GPT-5.6 Sol running up to 14× faster than Standard processing, in limited preview to select customers. Note the ladder: Standard, then Fast mode (which gained long-context support past 272K tokens at up to 2.5× on August 5), now Ultrafast at up to 14×. No pricing was published — and that is the number that decides whether this matters, so treat the multiplier as a headline rather than a plan. It's most relevant to agent loops where latency compounds across many small turns, least relevant to single long generations.

Full entry → Affects: /chatgpt/, /chatgpt/pricing/, /chatgpt/api-vs-chat/

A GPU sandbox could report Ready with its agent not running. Native Docker GPU onboarding marked a Hermes sandbox ready after the create process had already ended the startup command — true about the container, false about the thing you wanted in it (#9147). The mirror-image case: OpenShell could report Ready before startup produced output, leaving a sandbox at sleep infinity (#9117). Separately, Hermes MCP port discovery was reading a process environment OpenShell forbids it, so managed MCP mutations couldn't recover the API port at all; it now resolves from the exact socat relay, treating missing topology as transient and ambiguous topology as fail-closed (#9122). Also: the Hermes image now seeds pip during the root build layer so the Hindsight lazy installer works, and five sandbox write probes were fixed that had been testing shell parsing rather than filesystem permissions. And a dormant Podman GPU + local inference batch landed for Ollama, NIM and vLLM behind one inference.local contract — explicitly not production-registered yet.

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/local-gpu/, /hermes/, /troubleshooting/

Four releases in three days, and the theme is an agent that can be talked into less. Skills synced from claude.ai were hardened: they no longer shadow local commands or MCP prompts, descriptions are sanitized and labeled, and on your machine their bodies don't run ! commands or expand @ files. Separately, /commit-push-pr stopped auto-approving git and gh commands carrying --force, --amend or --no-verify — "don't ask about git" and "don't ask about git push --force" were never the same permission. New: plugin marketplace command sources, where a local command prints the plugin directory and it's re-resolved each session without a restart. SSE keepalive pings stop idle-timeout disconnects on Vertex and Bedrock during long thinking pauses, and workflow fan-outs now stagger same-prefix siblings so they read the cached prompt prefix instead of re-paying for it. Two to check: session cleanup was deleting contents inside a project's memory folder, and the Write tool now lets newer models overwrite a file they haven't read this session. Self-hosted runner Windows startup now requires an explicit --base-dir.

Full entry → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/security/, /openclaw/skills-guide/, /openclaw/cost-optimisation/, /security/

A session running on your own laptop is now a record your organization can pull. Three new Compliance API endpoints, in beta for Claude Enterprise orgs, list Cowork and Claude Code sessions across the organization and return their transcripts — including sessions that never touched managed infrastructure. They use the Compliance Access Key an org already has, with the read:compliance_user_data scope. This is a capability most organizations genuinely need, not an incident; what changes is the intuition that local means private. On an Enterprise account, treat an agent session like work email, not a scratch file. Also: Claude Sonnet 5's introductory $2 / $10 per MTok is now the standard price and the September 1 increase to $3 / $15 will not happen — if you modeled a step-up, delete it. And the API now returns an anthropic-workspace-id header naming the workspace a key actually resolved to.

Full entry → Affects: /claude-cowork/, /claude-cowork/pricing/, /claude-cowork/vs-api/, /openclaw/cost-optimisation/, /security/

A prompt nobody could answer left a lock only a human could clear. Channel and policy mutations judged interactivity by an environment variable rather than by whether a terminal was attached, so a headless run reached a confirmation prompt, hit stdin EOF, and exited from inside the sandbox mutation-lock callback. The abandoned generation escalated to durable containment and blocked snapshot, recover and rebuild until an operator cleared the lock by hand — and --dry-run was blocked too, because the lock was taken before the preview check. Second headline: a failed provider validation could leave a credential-bearing gateway running that neither stop nor gateway remove could kill, while stop printed a confident All services stopped. Also: each Hermes sandbox now gets its own OpenAI-compatible API port (8642–8652) instead of a host-wide 8642, so a snapshot clone is no longer left with an unrepairable missing forward; the Hermes forward watcher stopped killing forwards it didn't own; macOS Homebrew 6.x no longer halts onboarding before preflight; onboard --resume --name stopped silently ignoring the name; and a python3.11 allowlist path the image never shipped is gone.

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/policy/, /nemoclaw/skills/, /hermes/, /troubleshooting/, /security/

Three release candidates in two days; 1.2.0 is not stable yet and 1.1.0 remains the version to run. rc.3 fixes a deployment failure with an instructive shape: the runtime container image shipped no HTTP client. Orchestrators probe the worker with curl -fsS http://localhost:3000/, curl wasn't installed, so the probe could never run, the container was never marked healthy, and the deploy timed out into error while the listener served 200s the entire time. rc.3 also gave PR test planning and the root-partition runner one shared test inventory, because they disagreed on partition assignment and a scheduled root test could be reported green without having run. rc.2 is Windows work — native atomic rename instead of hard links on first-start publication, and icacls status output no longer contaminating machine-readable CLI JSON. rc.1 enabled the Railway shell for the hosted volume profile.

Full entry → Affects: /ironclaw/, /ironclaw/setup/, /ironclaw/configuration/, /troubleshooting/

An error message printed the password you passed it. nemoclaw <sandbox> mcp add --url printed the raw operator value in its parse-failure diagnostic, so a malformed credential-bearing URL echoed its embedded username and password to the terminal and to anything capturing that output. The same function already refused to echo in every other branch — only the one that runs before parsing escaped the rule. The value is now dropped rather than redacted, because the redactor on the real print path leaves several malformed forms verbatim. Second headline: rebuild --yes destroyed the sandbox during preflight and then failed to recreate it, exiting 1 on a Brave Search credential error — the credential-reuse branch required a session-scoped staged receipt that a rebuild structurally cannot produce, making it unreachable on every rebuild. Also: the managed vLLM installer now checks its serving port before it changes any state; WSL2 with a Windows-host Ollama daemon no longer applies a Linux systemd override and dies before creating the sandbox; Hermes skills activate in a fresh session without a gateway restart, and the dashboard and gateway finally agree on one WhatsApp session path; channels status gained --wait/--timeout; list --json and global status --json stopped reporting agent: null; and NVIDIA driver detection accepts a two-part version like 595.84.

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/local-gpu/, /nemoclaw/skills/, /security/, /troubleshooting/

Seven minor features, all pointed at making Agent Manager a place you can live. Terminals get a real keyboard layer — Cmd+/ focuses a visible embedded terminal before hiding it, Cmd+Shift+T creates a side terminal only while that area has focus, Cmd+Shift+[/] switch tabs, Cmd+Shift+M focuses the prompt instead of opening VS Code Problems, and Cmd+W hides the last side terminal instead of stopping its shell. Multi-project mode lets you choose the repository when creating or importing a worktree, and worktree prompts accept model, agent, variant and sandbox slash commands. Model search is now provider-aware with usage suggestions, and you can browse an instance's model catalog before starting a session. Tool approval reason indicators moved after the tool output with a setting to hide them, and /review gained staged, unpushed and quick modes. Roughly fifty patch fixes underneath — the notable ones: reasoning effort survives a model switch, sandbox settings apply to existing sessions, negative pricing entries are handled, and bundled OpenCode moves v1.17.9 → v1.17.13.

Full entry → Affects: /kilocode/, /kilocode/setup/, /kilocode/models/, /kilocode/orchestrator/, /kilocode/vs-claude-code/

Nothing new to configure, which after last week is a welcome shape. The most consequential fix is billing-adjacent: feature flags were evaluated without the user's subscription tier when a session started with an expired login token, which could wrongly prompt Max plan users to enable usage credits for Fable — you were being asked to pay for something your plan already covered. Two breakage fixes: every Bash command failed under claude-code-action with allowed_non_write_users on GitHub-hosted runners (a total outage of the tool in that CI configuration, not a degradation), and /tui could bring back a conversation rewound to before its first message. The slash-command menu is more legible: blue marks only the selected row, matched characters are bolded rather than recolored, and emoji or accented command names keep their glyphs. Plus fewer event-loop stalls on file-not-found suggestions and at-mention size checks.

Full entry → Affects: /openclaw/, /openclaw/troubleshooting/, /openclaw/cost-optimisation/

Two access tiers, for approved defenders only. OpenAI's Daybreak security program now offers Daybreak Blue — general-purpose models such as GPT-5.6 Sol, for defensive work — and Daybreak Red, with purpose-trained models including gpt-5.6-cyber, for explicitly authorized offensive engagements: exploit validation, penetration testing, red teaming. Both are on v1/responses, and OpenAI's guidance is to start with Blue for most defensive tasks. This is access-gated rather than a general availability change, but it sharpens a question our security center already asks: an agent authorized to validate an exploit is an agent authorized to run one. Separately, the chat-latest snapshot was repointed at the current ChatGPT model for Plus and Pro; GPT-5.6 Sol is still the recommendation for production, because chat-latest moves under you.

Full entry → Affects: /chatgpt/, /chatgpt/pricing/, /chatgpt/api-vs-chat/, /security/

claude self-hosted-runner turns your own machines or containers into a place Claude Code web, mobile and desktop sessions can run (Team and Enterprise) — the cloud-session surface no longer implies Anthropic-managed compute. The other headline is cross-session SendMessage: sessions on any of your machines can message each other, with ListAgents for discovery, macOS and Linux only. Two settings govern the inbound side — crossSessionInbound and dialogExpiry — and the default holds a message sent to a bypassed-permissions session for your approval. A new archive plugin source installs from a zip over HTTPS with optional SHA-256 pinning; pin it. Sandbox credential masking gained extract, decode: "jwt" with maskClaims, and AWS SigV4 re-signing (all need network.tlsTerminate). Two quiet but serious fixes: project paths over 200 characters resolved into another project's session directory, and denyRead/denyWrite entries with a trailing slash were silently ignored on Linux and macOS.

Full entry → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/security/, /claude-cowork/, /security/

Three separate ways a command could get past a permission check are fixed. A crafted Bash command could hide parts of itself from permission checks; commands padded with tabs or invisible Unicode could hide text from the approval dialog you actually read; and workflow scripts could use dynamic import() to run code outside the workflow sandbox. A fourth: an agent definition's bypassPermissions mode ignored the org bypass-permissions disable policy. Marketplace managed settings now take owner wildcards ("owner/*"). Behavior change worth knowing: CLAUDE_CODE_DISABLE_1M_CONTEXT now holds every Claude model with a native 1M window to 200K rather than a fixed list, and auto-compact keeps unrecognized model IDs inside the assumed window. /review is now an alias of /code-review, which reuses the last effort level you typed. Also fixed: gateway model discovery hiding vertex_ai/claude-* and bedrock/anthropic.claude-* IDs, and server-delivered managed settings disabling a local MDM profile's env block.

Full entry → Affects: /openclaw/, /openclaw/security/, /openclaw/configuration/, /openclaw/skills-guide/, /security/

Gateway spend limits now surface in the client: the limit-reached message names the cap, its reset time and the operator's message — requires the gateway to also be on 2.1.225. Two auth fixes to check for if you run headless: a transient 401 could replace a long-lived CLAUDE_CODE_OAUTH_TOKEN with a stored login's short-lived token, breaking sessions until restart, and MCP OAuth servers on macOS threw a burst of 401s as if never authenticated after a keychain read timed out. One release after shipping, SendMessage can now start a conversation with Remote Control sessions on other machines by name, and a confirmed remote recipient is never swapped for a same-named local session when the local list can't be checked. Auto mode also stopped counting a safety-filter refusal of its own permission check toward the consecutive-block limit. v2.1.226 is fixes and reliability only.

Full entry → Affects: /openclaw/, /openclaw/configuration/, /openclaw/cost-optimisation/, /openclaw/troubleshooting/

The RC is now stable, and our version data moves off 1.0.0. Everything from 1.1.0-rc.1 holds: hosted custom MCP servers registered from the WebUI, IronHub deep-link installs including private manifest sources, durable cross-channel attachments, native /ironclaw Slack slash commands, and memory as a userland extension with declared capabilities. Fixed since the RC, all upgrade-path integrity: 1.0.0 state survives the 1.1 startup migration, the hosted MCP egress target is preserved for registered servers, and readable text logs stay writable because write_file's read-before-edit backstop now uses read_file's lenient binary classification. Changed: extension persistence normalizes lifecycle state into typed records, and every model-failure termination path now tells the model what would unlock the call instead of stopping opaquely. No migration steps from 1.0.0 — but the Slack /webhooks/slack/events alias is retired, so update any hard-coded Slack app config before upgrading.

Full entry → Affects: /ironclaw/, /ironclaw/setup/, /ironclaw/configuration/, /ironclaw/security/, /ironclaw/skill-allowlisting/, /ironclaw/vs-openclaw/

Four days after 1.1.0 went stable, an "urgent patch candidate" for the 1.1 line. It's a prerelease — 1.1.0 stays current — but the speed is the signal. Fixes cluster around channel delivery and pairing (provisioned Slack personal-DM targets are retained; Telegram accepts /pair as a pairing-code alias), upgrade safety (malformed legacy Slack/Telegram state is skipped by default without deleting its source rows), IronHub and custom MCP (signed prompt assets install under the 1.1 asset contract; the "connect account" dead end for already-connected extensions is gone), WebUI streaming (SSE reload retry storms stop), and retrieval (no more repeated libSQL FTS backfills). Upgrading from 1.1.0 needs no offline transform. From 1.0.0 it does — database-native snapshot first, containers must also retain /workspace via IRONCLAW_REBORN_LEGACY_WORKSPACE_SNAPSHOT, and Slack/Telegram state is skipped by default and must be reconfigured.

Full entry → Affects: /ironclaw/, /ironclaw/setup/, /ironclaw/configuration/, /ironclaw/security/

Session budgets are a hard cap, not a warning. A Claude Managed Agents session can now carry a spend cap priced at public list rates; on reaching it the session pauses with a budget_reached stop reason instead of starting new model requests, and changing or removing the budget resumes it. Deployments apply the same budget to each session they start. A session can also be given an advisor — a model at least as capable as the agent's own, declared as a {"type": "advisor"} entry in the multiagent roster, that the primary thread consults mid-turn. inference_geo now controls where inference runs, per agent or per session. And a session that mounts a GitHub repository discovers skills in its root .claude/skills automatically at session start — no upload step, the repo is the source of truth.

Full entry → Affects: /claude-cowork/, /claude-cowork/vs-api/, /claude-cowork/pricing/, /tools/cost-calculator/

Claude Opus 4.1 (claude-opus-4-1-20250805) now returns an error on every request. A hard cutoff, not a deprecation warning — if that ID is pinned in a config, script or gateway route, it is already broken. Claude Opus 5 is the recommended upgrade; researchers can request ongoing access through the External Researcher Access Program. Separately, inference hooks entered beta for Claude Enterprise: point Claude at your organization's AI security server and each governed prompt across claude.ai, Cowork and Claude Code is held for that server's allow-or-deny verdict before inference proceeds. Requests are signed, denials land in the compliance Activity Feed, and failure handling is configurable — decide fail-open versus fail-closed deliberately before you enable it.

Full entry → Affects: /claude-cowork/, /claude-cowork/vs-api/, /claude-cowork/pricing/, /tools/cost-calculator/, /security/

Enterprise plans can now automatically scan third-party skills and plugins for malicious content when someone uploads or edits them. It's the first platform-side control that doesn't depend on every individual reading the source — but treat it as a filter, not a proof: a skill that passes is one that didn't trip a detector, not one reviewed for what it does with the access you grant. Our Cowork and OpenClaw skills guides still lead with reading it yourself.

Full entry → Affects: /claude-cowork/, /claude-cowork/skills-guide/, /claude-cowork/skills-database/, /security/

Fast mode now accepts prompts over 272K tokens on GPT-5.6 Sol, Terra and Luna — previously the tier excluded exactly the requests where latency hurts most. OpenAI quotes up to 2.5× the Standard tier's speed. If you were splitting long-context work across calls to stay inside Fast mode, that workaround is retired. A day earlier, the Usage and Costs dashboards gained API-key filtering and grouping, with the same dimension exposed in the Usage and Costs APIs — for anyone running several agents against one org account, that's the difference between a monthly total and knowing which agent is expensive.

Full entry → Affects: /chatgpt/, /chatgpt/pricing/, /chatgpt/api-vs-chat/, /chatgpt/tips/

Fresh sandboxes were racing their own creation. Live onboarding now waits for the OpenShell create client to release ownership before restart-safe Docker recreation — the active path had bypassed the existing barrier, so recreation could race the still-running create process and leave a new sandbox permanently unready (#8729, #8722). Stopped-sandbox startup now waits through an exact transient SUPERVISOR_NOT_RUNNING and repeats full recovery (#8728), and startSandbox stopped discarding the managed-recovery result (#8683). A long rebuild could let Shields lockdown race the first post-rebuild tool call; the expired timer now settles first (#8713). For local GPU: a blocked llama.cpp bridge is now diagnosed with the exact network, subnet, gateway IP and port — and NemoClaw stops rather than editing your UFW rules (#8716).

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/local-gpu/, /troubleshooting/

Two isolation boundaries that weren't actually holding are now fixed: worktree-isolated sessions and their subagents could run destructive git commands against the main checkout, and PreToolUse auto-allow hooks bypassed tool restrictions inside background agent tasks. Worktree isolation now covers file edits and Bash in every session type — previously a git reset --hard or branch deletion could reach past the throwaway tree the isolation exists to protect. The hook bypass affected summaries, compaction and renames, so a narrowed tool surface wasn't holding where you could least see it. Two more permission-surface changes: SendMessage to another agent session is now run through the permission classifier before dispatch, and Remote Control auto-start can no longer be enabled by repo-local settings — those can still disable it, but enabling is user-scope only via /config. The ultraplan feature was removed. Also fixed: startup connectivity checks hanging behind an HTTPS proxy, /usage overattributing consumption to MCP servers, org-restricted model family aliases dropping to the parent model, and stream idle timeouts on custom ANTHROPIC_BASE_URL gateways.

Full entry → Affects: /openclaw/, /openclaw/security/, /openclaw/configuration/, /claude-cowork/, /security/

A release candidate, not a stable release — 1.0.0 remains current — but the first real look at where the post-rewrite platform is going, and the theme is extension reach. You can now register an arbitrary hosted MCP server from the WebUI and use its tools like any other extension, with discovery bounded by the manifest's declared tool budget. IronHub deep-link installs cover private manifest sources; attachments are durable across channels, so a file sent in Slack stays retrievable from the WebUI; native /ironclaw Slack slash commands land with a role-filtered palette. Architecturally the notable one: memory is now a userland extension with declared capabilities, so a provider advertises what it can actually do. Sandbox and trigger-poller lanes ship opt-in and partially unwired. No migration steps from 1.0.0, but the Slack /webhooks/slack/events alias is retired — use /webhooks/extensions/slack/events.

Full entry → Affects: /ironclaw/, /ironclaw/setup/, /ironclaw/configuration/, /ironclaw/security/, /ironclaw/skill-allowlisting/

The CLI and plugin SSRF validators now share one expanded denylist — reserved and special-purpose IPv4/IPv6 including cloud metadata ranges — and blueprint runs reject endpoint URLs carrying embedded credentials before DNS resolution (#8321). Two validators enforcing different denylists is the classic way an SSRF filter gets bypassed. Bigger for operators: shields status was lying. On a sandbox with a startup-sealed policy, shields down couldn't apply the permissive policy — but status still reported the sandbox as DOWN/permissive even though nothing had been unlocked. It now rolls back, or reports the still-restrictive UP posture, or errors — never a state that wasn't achieved (#8198). For local GPU: managed vLLM installs now check minimum compute capability before downloading instead of crash-looping for 30 minutes (#8314), and MTP speculative decoding is off for the Spark Qwen profile. Also worth knowing: ~/USER.md and ~/SOUL.md are not in your snapshots — they resolve outside the managed workspace (#8245).

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/local-gpu/, /troubleshooting/, /security/

The largest Hermes release to date — ~3,650 commits and ~1,400 merged PRs since v0.19.0, closing ~1,200 issues. Voice became conversational: Hermes speaks clause-by-clause as the response streams, you can interrupt it mid-sentence just by talking, and on-device open-vocabulary wake words never send audio off the machine. A bundled Agent-to-Agent (A2A) v1.0 plugin lets Hermes discover, talk to and be driven by other A2A agents (#514), and signed outbound webhooks push HMAC-authenticated lifecycle events to any endpoint instead of making you poll. Also: a grounded-citations skill that matches quotes against real page text, a desktop plugin SDK with sandboxed live-preview artifacts, CLI power commands (!, /init, /diff, /context, /focus), mid-turn redirects, self-recovering tools with the iteration limit raised 90 → 500, and CLI startup cut from ~14s to ~1.8s. Upgrade carefully: Node 26 is required and the Brew and PyPI wheel channels are retired — shell installer, Docker and Nix remain.

Full entry → Affects: /hermes/, /hermes/setup/, /hermes/vps-install/, /hermes/tasks/, /hermes/mcp-tools/, /hermes/dashboard/

A permission-check bypass in the Bash tool is fixed: zsh could execute hidden commands inside [[ ]] regex conditionals without the approval prompt ever showing them. On Windows, PowerShell permission checks mishandled paths containing quote characters; those now prompt too. New mode: "mask" for sandbox credential files on Linux and WSL — sandboxed commands read a sentinel copy (whole file, or just the spans an extract regex captures) while the proxy substitutes the real value on egress; macOS falls back to deny, so don't assume parity. Elsewhere: background sessions now commit and push to preserve work and follow your CLAUDE.md git instructions, /fork creates its own worktree, auto-mode permission checks reuse the cached prefix to cut prompt-cache cost, and the Stats panel finally counts cache tokens.

Full entry → Affects: /openclaw/, /openclaw/security/, /openclaw/configuration/, /claude-cowork/, /security/

You can now set a model and reasoning variant per workflow from Agent Behaviour settings (#12729) — a cheap workflow and an expensive one can coexist without manual switching. Speech-to-text models are discovered from the Kilo Gateway with offline fallback and organization model restrictions preserved (#12841). The rest is Agent Manager repair: New Worktree mode shortcuts keep mode and model in sync (#12796), sections and worktree drag-and-drop work again across multiple projects (#12803), the first terminal prompt paints sooner (#12842), and multi-file patch results gained aggregate line counts (#12725).

Full entry → Affects: /kilocode/, /kilocode/models/, /kilocode/orchestrator/

Two dependency advisories were patched across the managed OpenClaw, Hermes and Deep Agents Code images, so rebuild them. The npm-private ip-address package went to the integrity-pinned 10.3.1 for GHSA-mwp4-54f8-5fhr (#8196), and the Python images moved to aiohttp 3.14.3 and cryptography 50.0.0 (#8203). A new Experimental Express profile detects a qualified two-system DGX Spark cluster and selects its managed-vLLM profile from a YAML catalog (#8129). And a long-standing WSL bug is fixed: express install aborted when Ollama was already running on the Windows host under mirrored networking — it now reuses that daemon and pulls over HTTP (#8190). Two crashes became clean, actionable errors.

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/local-gpu/, /troubleshooting/, /security/

The Dreams research preview now supports Claude Opus 5. Opus 5 launched July 24 with a 1M-token context window and 128k max output at $5/$25 per MTok — identical pricing to Opus 4.8 — so the managed-agent preview catching up removes the last reason to select the older model there.

Full entry → Affects: /claude-cowork/, /claude-cowork/vs-api/, /tools/cost-calculator/

The snapshot helper's Base64 validator no longer overflows the stack. A regex that handled small malformed input correctly could crash on a maximum-size valid payload; length, alphabet and terminal padding are now checked by an iterative scan before decoding, the 16 MiB per-file limit is shared between the Python helper and the TypeScript decoder, and everything that failed closed still does (#8081). Separately, five explicitly dormant commits define a provider-neutral bootstrap, transaction and clone-handoff boundary — the layer that would let NemoClaw run on a runtime other than Docker, with no production caller and nothing selectable yet (epic #7744). And onboarding resume got stricter: a sandbox name is reused only when recovery state or the checkpoint proves that exact identity, with agent-scoped checkpoint state invalidated after an agent change (#7715).

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/local-gpu/, /security/

Migration and rebuild backups now fail closed. Host-to-sandbox and rebuild snapshots share one filter for credential fields, token shapes, auth headers and CLI arguments, recursively sanitizing every copied JSON, YAML and .env artifact; if sanitization or cleanup fails the backup is rejected and its staging directory removed rather than retaining a raw configuration, and the docs now say plainly that these snapshots are filtered restore points, not byte-for-byte copies (#7847). shields up works on Deep Agents sandboxes again — the lock writes an absent .config-hash record before applying locked permissions, and fails the lock rather than redirect a privileged write when it finds a symlink or an out-of-directory config path (#7995). And nemoclaw status stops lying: its Connected: field only ever counted local SSH sessions, so a healthy gateway with no shell open read as offline — it's now SSH sessions:, and the connected boolean is gone from nemoclaw list --json (#7820). Plus Google Chat as an experimental OpenClaw channel whose service-account key never enters the sandbox (#7317).

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/policy/, /security/

Agent Manager diff review finally has scopes — the side panel and full-screen review switch between Branch, Staged, Unstaged and Session for the selected worktree, with the Branch scope's base branch overridable from an adjacent picker that applies immediately. Branch stays the default, so nothing changes unless you want it to; Session is the one to notice, because reviewing exactly what one agent run touched previously meant reconstructing it by hand (#12681, #12709). Security-relevant: skill shell commands now appear in permission prompts with individual Allow/Reject instead of one wholesale approval (#12606). And an experimental multi-project Agent Manager lands behind a Settings → Experimental toggle, giving each registered repository its own immutable context, pollers and private tabs while single-project behavior stays unchanged (#12566). Also: Persian/RTL UI, MCP enable/disable surviving reloads, and a write-aware cache hit rate in the usage bar.

Full entry → Affects: /kilocode/, /kilocode/orchestrator/, /kilocode/security/

GPT-5.6 Luna costs 80% less and GPT-5.6 Terra costs 20% less on v1/responses and v1/chat/completions. Luna is the small model in the family, so the cut lands hardest on exactly what agents generate most of — classification, routing, extraction, summarization — and an 80% drop is large enough to invert a routing decision, not just shave a bill. Separately, Fast mode replaces Priority Processing: up to 2.5× standard speed at twice the price, with priority-tagged requests still honored so nothing breaks on deploy. If you sized a model choice on July rates, re-run the numbers before your next invoice does it for you.

Full entry → Affects: /chatgpt/, /chatgpt/pricing/, /chatgpt/api-vs-chat/

A tag, not a feature release — and Nous says so outright. v0.19.1 exists to give Docker images, hosted deployments and fresh installs a stable point to pin, rolling up ~2,789 commits across ~4,748 files (+442k/−392k) merged since v0.19.0 "Quicksilver" ten days earlier. The window is dominated by bug-fix and salvage waves across the gateway, voice subsystem, desktop app and installer, plus Buzz/Nostr, FLUX3 video, and Telegram media reliability work. Curated per-feature notes for the whole window ship with v0.20.0 — we're flagging that rather than reverse-engineering a feature list from a 4,700-file diff, which is precisely where a guessed changelog goes wrong. Update with hermes update.

Full entry → Affects: /hermes/, /hermes/setup/, /hermes/vps-install/

OpenAI Platform org structure is now infrastructure-as-code. The official Terraform provider manages projects, users, groups, roles and service accounts. The practical use is agent-fleet governance: provisioning a scoped project and service account per agent has been dashboard clicks or bespoke scripts, with no reviewable diff and no drift detection. Paired with the spend limits added July 22, you can now declare "this agent gets this project, this role, this ceiling" — and catch it in code review when someone widens it.

Full entry → Affects: /chatgpt/, /chatgpt/teams/, /chatgpt/api-vs-chat/

The v0.0.97 release entry landed, rolling up 43 PRs since v0.0.96. The headline is a two-part provider-switching fix: nemoclaw inference set now creates and verifies a missing compatible provider before the first route attempt instead of failing, and commits an update to an existing one only after route selection so a failure restores the prior state (#7746) — with a follow-up that refuses an endpoint replacement it couldn't roll back, since OpenShell redacts the previous endpoint (#7763). Managed MCP tool discovery now accepts case-variant SSE media types like Text/Event-Stream; Charset=UTF-8 (#7760), and Jetson GPU onboarding passes the DRI render-device group non-root CUDA needs — though physical IGX Orin validation is still pending (#7762).

Full entry → Affects: /nemoclaw/, /nemoclaw/switching-providers/, /nemoclaw/local-gpu/

A prompt navigator rail now indexes the chat transcript — a thin rail of ticks showing one tick per prompt you sent, expanding on hover into a card with answer previews, and clicking jumps to that turn. It's in the sidebar, editor tabs, sub-agent viewer, and Agent Manager, and never changes the chat's readable width (#12632). Agent Manager terminals can open in the VS Code terminal or an embedded side panel, with multiple terminals behind a reorderable tab strip that picks up live titles from OSC escape codes (#12598, #12633). For headless users the fix that matters: kilo console now prints basic-auth credentials in its URLs, so you can open the Console from another machine (#12333).

Full entry → Affects: /kilocode/, /kilocode/setup/, /kilocode/orchestrator/

A security batch across the managed sandbox base images. libssh2 is rebuilt at 1.11.1 with reviewed upstream fixes for four memory-safety CVEs (CVE-2026-66032/66033/66034/66035), and the reviewed CPython 3.13 fix for CVE-2026-15308 (HTMLParser complexity) is packaged as a hash-bound replacement for html/parser.py — both verified in base and completed images so a stale base can't reintroduce them (#7679). Separately, the bundled claude-code policy preset never allowed platform.claude.com, so Claude Code's browser login failed with Socket is closed; the preset now permits GET/POST on /v1/oauth/** for that host only (#7680). Also: a --reasoning-effort input for compatible endpoints, a read-only nemoclaw host probe, and journaled resumed sandbox recreation.

Full entry → Affects: /nemoclaw/, /nemoclaw/policy/, /security/

Two new transcription models. gpt-transcribe handles accurate file transcription and the final transcripts of committed Realtime turns; gpt-live-transcribe does low-latency streaming transcription. They land on v1/audio/transcriptions and v1/realtime, and both support free-form transcription context, keyword hints, and multiple input languages. The pairing is the point — the live model for the interactive stream, the file model for the durable record of the same turn.

Full entry → Affects: /chatgpt/, /chatgpt/api-vs-chat/

The rearchitected IronClaw is stable. 1.0.0 is a ground-up rebuild of the agent runtime, storage, extension host, and web UI — not an increment on 0.29.x. The ironclaw binary is now the new CLI; the v1 monolith builds as ironclaw-legacy and isn't published. There is no migration for config, databases, settings, or secrets: point IRONCLAW_REBORN_HOME at a new directory and run ironclaw onboard. Ships seven platform targets, 26 model providers, an embedded WebChat v2 UI, 12 first-party extensions, libSQL storage with optional PostgreSQL, and launchd/systemd service management. Still unimplemented: mcp, memory, pairing, import, login, logs, and channel/hook listing — so existing 0.29.x users should evaluate in parallel rather than upgrade.

Full entry → Affects: /ironclaw/, /ironclaw/setup/, /ironclaw/configuration/, /ironclaw/vs-openclaw/

v2.1.219 makes claude-opus-5 the default Opus model, with fast mode at $10/$50 per MTok; /fast no longer applies to Opus 4.7, which lost fast mode entirely. New in the same release: sandbox.network.strictAllowlist, which denies non-allowlisted hosts for sandboxed commands without prompting — the first setting that makes the allowlist a boundary rather than advice; a DirectoryAdded hook firing after /add-dir or SDK register_repo_root; mcp_server_errors in the headless stream-json init event so silently-skipped MCP configs are visible; the workflowSizeGuideline settings key; and nested subagents to depth 3 by default (was 1). Fixes include claude -p dropping an already-produced answer on a mid-stream API error, and a permission approved during a runner restart being lost on resume. v2.1.220 is bug fixes only.

Full entry → Affects: /openclaw/, /openclaw/configuration/, /openclaw/security/, /openclaw/cost-optimisation/

Claude Opus 5 (claude-opus-5) launched — a 1M token context window as both the default and the maximum, 128k max output tokens, and thinking on by default, at $5 / $25 per MTok — the same price as Opus 4.8. Available on the Claude API, Amazon Bedrock, Google Cloud, and Microsoft Foundry. One breaking change: disabling thinking is allowed only at effort high or below, so thinking: {"type": "disabled"} with xhigh or max now returns a 400. Effort is the primary steering control across the full low–max ladder. Also: fast mode was removed from Opus 4.7 with no fallback to standard speed (unlike the 4.6 deprecation); mid-conversation tool changes entered beta with prompt-cache preservation; and the fallbacks parameter gained a "default" mode.

Full entry → Affects: /claude-cowork/, /claude-cowork/pricing/, /claude-cowork/vs-api/, /tools/cost-calculator/

Reference past chats inline with @ (#12456) — typing @ surfaces a searchable picker of previous sessions scoped to the current workspace/worktree, and selecting one attaches that session's transcript as context. Works in both the CLI TUI and the VS Code extension. Auto-approved tool calls now say which rule permitted them (#12494), which is the difference between trusting an allowlist and auditing one. Also: queued chat messages can be deleted before they run, session queue state is emitted to remote clients, a searchable open-tabs switcher lands in the sidebar, /sessions history is filtered to the current worktree, and provider errors now surface the request and Gateway generation IDs.

Full entry → Affects: /kilocode/, /kilocode/orchestrator/, /kilocode/security/

A recovery-and-lifecycle release — mostly fixes for ways a sandbox could get stuck. The headline is a data-loss fix: shields up/shields down no longer destroys a sandbox's openclaw.json when its .config-hash is missing, which previously left the sandbox unrecoverable without rebuild --yes (#7467). Also fixed: the OpenClaw Discord bot can deploy its own slash commands again (a policy_denied 403 that stalled startup, #7303), stop tears down the dashboard port-forward it opened (#7228), and a cross-sandbox snapshot restore re-pairs the gateway (#7437).

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/policy/

A broad fix-and-polish release. /code-review now runs as a background subagent, so review work no longer fills your conversation while it keeps stacked slash commands as its review target. A nasty Windows bug is fixed: paths with a \u-prefixed segment (like C:\Users\unicorn) were being corrupted into CJK characters in tool inputs, making those files inaccessible. The left arrow key no longer silently discards your conversation — it asks to confirm after an edit, and Esc returns from the agent view. Also: claude mcp list and /mcp now show HTTP status and error text on a failed connection, /ultrareview accepts descriptive arguments, /code-review ultra launches the cloud review in non-interactive sessions, multi-line paste stops collapsing in Ctrl+J terminals, and gateway spend metering prices config-mapped Bedrock model IDs at the right rates.

Full entry → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /claude-cowork/

A documentation and CI day — the security substance shipped yesterday. The v0.0.92 changelog is now written (#7390), rolling up the ten PRs after v0.0.91 including the OpenClaw 2026.7.1 + Node 22.23.1 update covered in yesterday's entry. The change most likely to affect you: remote deployment is consolidated onto one provider-neutral headless Linux server guide over SSH (#7346), covering OpenClaw, Hermes, and Deep Agents Code — the Brev deployment and web-UI pages are retired with redirects to the shared guide.

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/switching-providers/

Claude's Managed Agents API gained four things. Model configuration takes an effort level; new lifecycle webhooks cover four environment.* and three memory_store.* event types so you can react without polling; session seeding lets POST /v1/sessions take up to 50 initial_events and start the agent loop in the same call; and the version field is now optional on agent update (supply it for optimistic-concurrency 409s, or omit to apply unconditionally). On the apps side, HIPAA configuration is now self-serve for org admins (July 14).

Full entry → Affects: /claude-cowork/, /claude-cowork/vs-api/, /claude-cowork/pricing/

OpenAI added hard spend limits for organizations and projects on the API platform. Set a monthly cap and affected requests return HTTP 429 once tracked spend reaches it — a real ceiling, not just a notification. Spend alerts stay available to warn you before traffic is interrupted, so the recommended setup is an alert below the hard cap. The failure mode is real: at the cap, requests fail, so size the limit with headroom.

Full entry → Affects: /chatgpt/, /chatgpt/pricing/, /chatgpt/api-vs-chat/

Twenty-one commits on main, and two of them are the whole story — both dependency remediations that make the image build fail closed. The reviewed OpenClaw distribution moves 2026.6.10 → 2026.7.1 with the sandbox Node image at 22.23.1 (#7280), carrying a compatibility patch so the upgrade doesn't quietly bypass the scope-upgrade pairing gate. And node-tar CVE-2026-59873 / GHSA-23hp-3jrh-7fpw is scrubbed from every Node sandbox image targeted for v0.0.91 — builds now fail on an empty inventory or any copy below tar@7.5.19 (#7332). Elsewhere: DGX Station moved off Deferred to "Tested with limitations" for single-Station configurations (#7327), and the Hermes API_SERVER_KEY lifecycle is finally documented — retrieval is gateway-token --quiet, not reading .hermes/.env, which the headless quickstart wrongly advised (#7212).

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/local-gpu/, /nemoclaw/policy/

A stable release, not a pre-release — 7.4.12 through 7.4.14 shipped as pre-releases only, so this is where the 7.4.13 Agent Manager work actually reaches the stable channel. New here: project memory settings are simplified — direct editing is replaced by folder inspection, nested memory gets slash-command completion and status views, and legacy memory audit logs are removed (#12422). A reload blocked by a running session now says so instead of returning a generic "Reload failed" (#12454), diff scroll position resets when switching files (#11928), and Linux sandbox setup survives a writable directory containing an unreadable subdirectory (#12414).

Full entry → Affects: /kilocode/, /kilocode/setup/, /kilocode/orchestrator/, /kilocode/security/

A fix release with one small addition. Three are worth upgrading for: a memory leak where truncated MCP tool outputs kept the full untruncated result in memory for the rest of the session; Windows auto-update failures that could leave claude.exe missing, now recovered by restoring the preserved executable; and background session isolation not canonicalizing symlinked working directories, which could let a session escape its workspace folder. Also: emoji shortcode autocomplete (:heart:, toggled by emojiCompletionEnabled), warnings when transcript writes fail instead of silent loss, auto-compact working again for Opus 4.8 on Bedrock, corporate mTLS/proxy settings applying in Claude Desktop sessions, and managed OTEL_EXPORTER_OTLP_ENDPOINT settings actually governing all signals.

Full entry → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/security/, /claude-cowork/

Not an increment on the 0.29.x line — a ground-up rebuild of the agent runtime, storage, extension host, and web UI. The ironclaw binary is now the rearchitected CLI; the v1 monolith becomes ironclaw-legacy and is no longer published. There is no migration for v1 config, databases, settings, or secrets — point IRONCLAW_REBORN_HOME at a new directory and run ironclaw onboard. Ships seven platform targets, 26 model providers, an embedded WebChat v2 UI, 12 first-party extensions, and libSQL storage. Missing so far: mcp, memory, pairing, import, and login have no CLI equivalent, skills are list-only, history import is non-functional, and Slack DM policy now defaults to allowlist instead of pairing. If you run 0.29.x in production, stay there for now.

Full entry → Affects: /ironclaw/, /ironclaw/setup/, /ironclaw/configuration/, /ironclaw/security/, /ironclaw/skill-allowlisting/

~2,245 commits and 1,065 merged PRs since v0.18.0, rolling up the v0.18.1 and v0.18.2 patch tags. The theme is latency: cold-start first-token time fell from ~4.3s to ~0.9s across CLI, gateway, TUI, desktop, and cron; reasoning models now stream their thinking live by default; the desktop app got a ~20-PR overhaul with 14× faster streaming markdown and virtualized diffs. Around that: smart approvals are on by default (an LLM reviews flagged commands), Bitwarden and 1Password plug in via a new SecretSource interface, subagent transcripts stream live, a durable delivery ledger keeps a finished response alive through a gateway crash, one gateway can route Discord servers to isolated profiles, and /subscription and /topup manage billing from the terminal. No documented breaking changes.

Full entry → Affects: /hermes/, /hermes/setup/, /hermes/security/, /hermes/tasks/, /hermes/discord-gateway/

One new setting and a long fix list. sandbox.filesystem.disabled skips filesystem isolation while keeping network egress control. Message normalization was growing quadratically with turn count, causing multi-second stalls and slow resumes in long sessions — fixed. Auto mode no longer denies commands with "HTTP 401" classifier errors after an OAuth token rotates mid-session. A real hardening: worktree-isolated subagents could redirect git into the shared checkout via git -C, --git-dir, or GIT_DIR/GIT_WORK_TREE. Also fixed: claude daemon stop --any killing an unrelated process via a stale lockfile, Bash permission checking for compound statements with redirects, and resumed background agents reverting to the default agent.

Full entry → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/security/, /claude-cowork/

A pre-release aimed at the Agent Manager and codebase indexing. Reasoning effort is now selectable per model in the Compare Models picker (#12401), so compared worktrees can run the same prompt at different effort levels with the choice shown next to the model name. Agents can stop and remove a targeted Agent Manager session (#12271), codebase indexing accepts a custom file-extension allowlist to limit scans or add text formats (#12306), and JetBrains gains compaction and file-watcher ignore settings (#12292).

Full entry → Affects: /kilocode/, /kilocode/orchestrator/, /kilocode/models/

Sixteen commits on main, including the release changelogs for both v0.0.89 and v0.0.90 — the v0.0.90 entry was written ahead of its tag, so treat it as documented-but-not-shipped. The change to act on: the managed inference route selector was renamed from NEMOCLAW_PROVIDER_KEY to NEMOCLAW_INFERENCE_PROVIDER_ID (#7189) because the secret-shaped name tripped BuildKit's SecretsUsedInArgOrEnv check on a value that is only a route identifier. Custom Dockerfiles keep working through v0.0.90 via a dual-read window and break in v0.0.91. Also: provider-reset recovery from wrapped attachment errors (#7232), WhatsApp channels status reporting the paired in-process bridge, status recommending start for crashed-sandbox recovery (#7222), and more DGX Station installer hardening. Station support remains Deferred.

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/local-gpu/, /nemoclaw/switching-providers/

Eight commits landed on main since v0.0.87 — no new tag yet. Two touch behavior you might see: managed vLLM containers now launch with Docker's --init so a docker restart cleanly reaps child processes and forwards signals (#7221), and the status --json regression from #7113 is fixed — OpenShell's ANSI gateway-selection banner no longer contaminates machine-readable stdout, so Deep Agents target discovery parses the response again (#7218). The rest is DGX Station GB300 installer hardening (OTA-upgraded DGX OS recognition, forced-prep device-id and unit tolerance, recovery-receipt port preservation, package-state validation) and e2e reliability. Station support is still Deferred.

Full entry → Affects: /nemoclaw/, /nemoclaw/local-gpu/, /nemoclaw/setup/

A one-line release after yesterday's hardening batch: Claude no longer runs the /verify and /code-review skills on its own initiative — invoke them explicitly with /verify or /code-review when you want them. Both can spawn a meaningful amount of work (and billed cloud agents in the case of /code-review ultra), so an unrequested run was both a surprise and a cost. If you had come to expect Claude Code to self-check its work before handing it back, it won't anymore.

Full entry → Affects: /openclaw/, /openclaw/setup/, /openclaw/skills-guide/, /openclaw/configuration/

Twenty commits landed on main since v0.0.87 — no new tag yet. The standout: every path that applies a messaging-preset policy now discloses the full effective egress — host, port, protocol/TLS/access mode, per-rule methods and paths, and binaries — parsed from the exact YAML, before any mutation (#7187). channels add/start, onboarding widening, and rebuild reconciliation all previously short-circuited past the host-only preview, so the WhatsApp preset silently opened a raw.githubusercontent.com fetch its description never named. Also: nemohermes uninstall now stops the detached port-8642 forward watcher it left alive — which was failing the next Station install's quiescence preflight (#7184) — plus control-character sanitization in inference get (#7165) and shadowed-require hardening in the trusted policy scanners (#7159).

Full entry → Affects: /nemoclaw/, /nemoclaw/policy/, /nemoclaw/setup/, /nemoclaw/switching-providers/

Claude Code shipped four releases since v2.1.209, led by a large Bash/permission-check hardening pass. v2.1.214 closes a permission-check bypass in Windows PowerShell 5.1 sessions, stops single-segment dir/** rules (like Edit(src/**)) auto-approving nested directories anywhere in the tree, and makes checks fail closed on file-descriptor redirects, commands over 10,000 characters, and tricky [[ ]]/help/man forms — plus it adds the EndConversation tool. v2.1.212 makes /fork spawn a background session (the old in-session subagent is now /subtask), adds per-session WebSearch and subagent caps, and fixes plan mode auto-running file-modifying Bash without a prompt. v2.1.211 neutralizes bidi-override/zero-width characters in chat-relayed permission previews; v2.1.210 fixes worktree subagents mutating the main checkout.

Full entry → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/security/, /claude-cowork/

Kilo Code shipped three releases since v7.4.7, centered on project-memory visibility in VS Code. v7.4.11 adds a task-header menu with quick actions and optional verbose details, shows recalled memory snippets in conversation markers when verbose project-memory is on, and gives context, project memory, and code indexing distinct icons. v7.4.9 lets you toggle chat search from the Command Palette, auto-expanding the block holding the current match. v7.4.8 adds task-timeline hover highlighting and the prompt enhancer in the New Worktree dialog. Fixes: sessions no longer freeze after answering a question, and file @mentions with spaces or non-ASCII characters resolve instead of failing.

Full entry → Affects: /kilocode/, /kilocode/setup/, /kilocode/orchestrator/

v0.0.87 is now tagged (#7131), packaging what landed since v0.0.82. A Hermes plugin fix unbreaks Google Gemini sandboxes: the plugin's double-wrapped tool schemas made Gemini's strict OpenAI-compatible endpoint reject every request with HTTP 400 — now it passes bare function objects (#7068). rebuild now clears a stale pinned session model so the first connect after nemoclaw inference set shows the new model (#7102); sandbox backups now stream to a temporary archive, removing the 256 MiB ceiling (#6947); and DGX Station Express adds exact factory-image profiles (#7126).

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/switching-providers/, /nemoclaw/local-gpu/

Claude Code shipped v2.1.208 and a v2.1.209 follow-up patch. v2.1.208 adds an opt-in screen-reader mode (claude --ax-screen-reader, CLAUDE_AX_SCREEN_READER=1, or "axScreenReader": true), a vimInsertModeRemaps setting mapping two-key insert-mode sequences like jj to Esc, a CLAUDE_CODE_PROCESS_WRAPPER that routes every self-spawn through a required corporate launcher, and mouse clicks in fullscreen multi-select menus. Reliability fixes center on background agents: failed replies are saved and re-delivered on restart, attach no longer breaks after an update swaps the binary, and a false "100% context used" after auto-update is fixed — plus fixes for fast-mode restore, GOAWAY crashes, truncated claude -p output, and large markdown tables. v2.1.209 restores /model and other dialogs a too-broad guard had blocked in claude agents background sessions.

Full entry → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/security/, /claude-cowork/, /claude-cowork/setup/

v0.0.82 is now tagged (#6824), packaging what landed since v0.0.81. Snapshot clones from snapshot restore --to now get their own destination-owned dashboard port, so the clone's dashboard-url no longer points at the source and clone rebuilds stop being rejected (#6749); onboarding an agent that needs OpenAI Chat Completions against an Anthropic-only endpoint now prints actionable next steps instead of a bare failure (#6769); and the onboard untracked-forward fallback recognizes OpenShell 0.0.72's ssh diagnostics so a ControlMaster mux-delegated forward no longer destroys a healthy sandbox after a false timeout (#6833).

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/switching-providers/, /nemoclaw/local-gpu/

v0.0.81 is now tagged (#6712), packaging what landed since v0.0.80. GPU onboarding now prefers native OpenShell CDI injection on eligible Linux Docker hosts, retrying once through the compatibility path only after safe failure classification (#6333); the direct Blueprint runner's apply now fails closed when openshell provider create or inference set errors, instead of reporting a sandbox that can't run inference as ready (#6703/#6704); managed Deep Code sessions are reaped on completion (#6721); and the Node.js minimum rises to 22.19 (#6729).

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/local-gpu/, /nemoclaw/switching-providers/, /nemoclaw/policy/, /nemoclaw/skills/

Kilo Code shipped v7.4.7 (promoting the v7.4.6 pre-release plus a focus-prompt patch), a batch of VS Code extension features: in-chat search finds text across the current conversation from the session header with match-case, whole-word, and regex options (#12155); multiple same-repo sessions can open as tabs from the sidebar and editor-tab chats (#10466); sandboxed tools can be granted a configurable network-destination allowlist while egress is otherwise restricted (#12075); and the @ mention dropdown gains a Browse-files native picker (#12028).

Full entry → Affects: /kilocode/, /kilocode/setup/, /kilocode/security/, /kilocode/orchestrator/

Auto mode goes GA on the enterprise providers, the default model shifts to Opus 4.8, and a plugin shell-injection path is closed. Auto mode no longer needs the CLAUDE_CODE_ENABLE_AUTO_MODE flag on Bedrock, Vertex AI, and Foundry (disable via disableAutoMode), and those providers now default to Claude Opus 4.8. Plugins can no longer use ${user_config.*} in shell-form hook/monitor/headersHelper commands (use exec form or $CLAUDE_PLUGIN_OPTION_<KEY>). Fixes: streaming terminal freezes on very long content, an agent-teams crash loop from a malformed mailbox message, non-interactive runs recorded as consented without the security dialog, and an indefinite Windows hang on stalled AWS credential resolution.

Full entry → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/security/, /claude-cowork/

Claude added a Monthly Recap. A new beta feature at Settings › Reflect surfaces the topics you spent time on, your most active day, and your peak hour of the month. Available on Free, Pro, and Max across web and Claude Desktop, and requires memory enabled. Follows the July 7 rollout that brought Cowork to web and mobile with sessions syncing across devices.

Full entry → Affects: /claude-cowork/, /claude-cowork/projects/, /claude-cowork/skills-guide/

v0.0.80 is now formally tagged (#6668), packaging the Hermes v0.18 + OpenRouter work from yesterday. New since then: WhatsApp pairing now works on a stock install (a private-IP origin was stripping operator scopes and blocking channels.start, #6645); a security fix redacts token-shaped URL query values in diagnostics even under benign param names (#6650); local compatible-endpoint inference now routes through the gateway (#6649); and provider-validation probes reuse connections to speed onboarding (#6661).

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/switching-providers/, /nemoclaw/policy/, /nemoclaw/skills/

OpenAI released the GPT-5.6 model family — a three-tier lineup for different capability/cost points. Sol is the frontier tier (the bare gpt-5.6 alias routes to gpt-5.6-sol), Terra balances intelligence and cost, and Luna targets efficient high-volume workloads. GPT-5.6 also adds Programmatic Tool Calling, explicit prompt-caching controls, persisted reasoning with a new max reasoning effort and Pro mode, and original-dimension image input. All three are available on v1/responses, v1/chat/completions, and v1/batch.

Full entry → Affects: /chatgpt/, /chatgpt/pricing/, /chatgpt/api-vs-chat/, /chatgpt/tips/

Quality-of-life additions plus a run of MCP and background-agent fixes. New: /cd path suggestions, a /doctor check that proposes trimming derivable content from checked-in CLAUDE.md files, /commit-push-pr auto-allowing git push to the configured push remote, an EnterWorktree confirmation for worktrees outside .claude/worktrees/, and background agents upgrading in the background after an update. Fixes: per-server MCP request_timeout_ms was being ignored (60s default timeouts), CLAUDE_CODE_EXTRA_BODY dropped by --bg workers, OAuth MCP re-auth after a single failed token refresh, and claude --resume/--continue not accepting keyboard input on startup.

Full entry → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/security/, /claude-cowork/

A feature-and-hardening day on main. The pinned Hermes release moves to v0.18 with Slack Block Kit and native table rendering enabled (#6507). OpenRouter runtime traffic now routes through a host-local NemoClaw adapter that injects attribution headers (#6584), and DCode OpenRouter routes use Deep Agents' native openrouter provider (#6616). Operator-supplied corporate proxy CAs are now imported into sandbox trust without replacing the OpenShell CA (#6210), base images are release-matched before :latest, and a credential-rotation guide lands.

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/switching-providers/, /nemoclaw/policy/, /nemoclaw/skills/

The Claude API added expiring API keys. You can now set an expiration when creating an API key or Admin API key in the Claude Console — a preset, a custom duration, or Never. Keys with a lifetime of at least 7 days trigger an email to the creator before expiry, and the Admin API reports each key's expiration in an expires_at field; existing keys are unaffected. Separately, the Access Transparency docs expanded coverage of cmek_preserve events (July 10).

Full entry → Affects: /claude-cowork/, /claude-cowork/vs-api/, /claude-cowork/pricing/

A maintenance release — "No notable changes" per the published notes, following the feature-heavy v7.4.4 (AI image generation, VS Code project memory, first-class sandboxing) a day earlier. Recorded for version tracking; nothing to act on.

Full entry → Affects: /kilocode/

Three releases in two days — a login-expiry warning, a Manual-mode footer badge, and MCP roots/list, on top of a deep reliability sweep. The new bits: Claude Code now warns before your login expires so background sessions aren't interrupted, shows a grey ⏸ badge in the footer when in Manual permission mode, and exposes the session's additional working directories to MCP servers via roots/list. The fixes are extensive — background-agent list/state recovery, a Windows worktree-removal bug that could delete files outside the worktree via an NTFS junction or symlink, --json-schema no longer silently unstructured on an invalid schema, a message at the --max-turns limit no longer lost, dropped ANTHROPIC_BASE_URL and stale PATH on background agents, and worktree-isolation correctness.

Full entry → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/security/, /claude-cowork/

A feature-packed pair: experimental AI image generation, VS Code project memory, and first-class sandbox settings. v7.4.3 adds a text-to-image and image-editing tool (enabled via experimental.image_generation, through the Kilo Gateway or a BYO OpenRouter key), inline image rendering when the agent reads an image file, and project memory integrated into the VS Code extension with a /memory command and Context-settings controls. v7.4.4 adds first-class sandbox settings on a dedicated Sandboxing page for macOS and Linux, disabled by default.

Full entry → Affects: /kilocode/, /kilocode/setup/, /kilocode/models/, /kilocode/security/

Two infrastructure patch tags rolling up ~667 commits since v0.18.0 into stable Docker/PyPI checkpoints. v0.18.1 (2026.7.7) bundles installer/updater self-healing on Windows, dashboard and gateway fixes, WhatsApp dashboard pairing, and MCP/provider fixes; v0.18.2 unpins the WhatsApp Baileys dependency to the published 7.0.0-rc13 so tagged-release Docker builds install reliably. Curated, contributor-credited notes for the whole window ship with v0.19.0.

Full entry → Affects: /hermes/, /hermes/setup/, /hermes/vps-install/, /hermes/mcp-tools/

A feature-and-security day on main: first-class OpenRouter onboarding, shell completion, structured logging, and network-policy hardening. OpenRouter is now a selectable provider for OpenClaw, Hermes, and Deep Agents Code (#6461); a nemoclaw completion command covers bash/zsh/fish (#6271); and leveled --debug/NEMOCLAW_LOG_LEVEL logging lands (#6272). Policy hardening: the brew preset no longer implicitly grants git egress to GitHub (#6541), plus a least-privilege Gmail preset and POSIX-compatible proxy-env trust anchors.

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/policy/, /nemoclaw/switching-providers/

A mostly-fixes release with a Dynamic workflow size setting. Claude Code v2.1.202 adds a Dynamic workflow size control in /config (small/medium/large agent counts, advisory) plus workflow.run_id/workflow.name OpenTelemetry attributes, alongside a stack of Remote Control and workflow parser fixes and background-session /rename and mTLS reliability fixes.

Full entry → Affects: /openclaw/, /openclaw/configuration/, /claude-cowork/

An onboarding and local-inference reliability sweep on main. The headline fix pins --enable-auto-tool-choice --tool-call-parser qwen3_coder for the generic-Linux managed-vLLM Nemotron default, so agent requests using tool_choice: "auto" no longer fail with HTTP 400; onboarding failures now point at nemoclaw onboard --resume, and a spurious qqbot plugin warning was removed.

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/local-gpu/

OpenAI released GPT-Realtime-2.1 and a lower-cost mini for the realtime API. The updated realtime reasoning model brings improved alphanumeric recognition, better silence and noise handling, and improved interruption behavior; the mini is a faster, cheaper distilled variant for latency- or cost-sensitive realtime apps. This is an API-model update, so it doesn't change the ChatGPT app experience.

Full entry → Affects: /chatgpt/, /chatgpt/pricing/, /chatgpt/api-vs-chat/

A reliability follow-up to the July 4 managed-MCP feature. If you use NemoClaw's new mcp add|list|status|restart|remove servers, #6261 makes that state much harder to corrupt: an exact, uncached openshell --version gate now runs before every MCP provider/credential change and fails closed on a missing, failed, malformed, or mismatched probe; MCP config is persisted as canonical intended/applied state committed only after a healthy gateway reload, with rollback restoring both config and integrity snapshots; and startup, restart, resume, rebuild, status, and recovery all reconcile against the persisted managed intent — including removal tombstones. Generic config writes can no longer touch mcp_servers, closing the config-drift gap from #6257. The rest of NemoClaw's week on main was internal test-performance and CI work.

Full entry → Affects: /nemoclaw/, /nemoclaw/skills/, /nemoclaw/setup/, /nemoclaw/switching-providers/

A defaults change on top of more background-agent hardening. The "default" permission mode is renamed to "Manual" across the CLI, --help, VS Code, and JetBrains — same approve-each-action behavior, clearer name, and the old default / --permission-mode spellings still work. AskUserQuestion dialogs no longer auto-continue unless you opt into an idle timeout via /config, and a non-array disabledMcpServers/enabledMcpServers no longer crashes at startup. The rest is background-agent reliability: sessions survive sleep/wake, daemon handover is judged by build timestamp so an older reinstalled build can't seize it, roster corruption no longer disables orphan cleanup, and a rate-limited subagent returns cleanly. 2.1.201 stops Claude Sonnet 5 harness reminders using the mid-conversation system role.

Full entry → Affects: /openclaw/, /openclaw/configuration/, /openclaw/security/, /claude-cowork/

A small patch, but one fix matters if you use sandboxed file operations. The kilo-sandbox-mutation-worker.js module was missing from the VS Code extension bundle, so every sandboxed file operation failed with "Module not found" — it's back in the bundle (#11926). Also: the prompt input now supports bidirectional (RTL/mixed) text (#11918), and selecting a reasoning variant or mode in the New Worktree dialog now actually applies it — the modal overlay had been swallowing the click (#11924).

Full entry → Affects: /kilocode/, /kilocode/setup/, /kilocode/security/

The v0.0.74 train landed on main with two genuine new features. OpenShell-managed MCP servers add a native mcp add|list|status|restart|remove lifecycle for OpenClaw, Hermes, and Deep Agents Code — authenticated HTTPS endpoints only, with raw credentials kept out of sandbox files and registry state (#5876). Progressive tool disclosure is now the default for new sandboxes (tools surfaced on demand via a bounded search_tools step); --tool-disclosure direct or NEMOCLAW_TOOL_DISCLOSURE=direct restores the full catalog (#6251). Plus an upgrade to openclaw 2026.6.10 (#5595) and a Windows-ARM N1X iGPU fix that stops onboarding auto-selecting an unusable 30B/35B model (#6234). Also on main: hardened DCode rebuild handoff, validated base-image reuse for faster warm starts, and a one-command contributor onboarding path.

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/skills/, /nemoclaw/local-gpu/

An all-bugfix release that stops delegated work from failing silently. A subagent cut off by a rate limit or server error now returns its partial work to the parent, and a subagent that hit an API error is reported as an error instead of a successful result. Mid-stream API errors keep the partial response with an incomplete-response notice; stacked slash-skill invocations (/skill-a /skill-b) load all leading skills (up to 5); SSL certificate errors fail immediately with a fix hint instead of burning retries; and the Linux background-agent daemon no longer self-kills every ~50s after an unclean shutdown. Plus fixes for macOS SSH cold-start, claude stop racing a respawn, and the idle-subagent panel.

Full entry → Affects: /openclaw/, /openclaw/skills-guide/, /claude-cowork/

Agent Manager branches now get task-focused names automatically once the conversation establishes a clear workstream (optional prefixes, with a setting to disable automatic naming) — so parallel agent branches stop being a wall of generic names. The patch fixes are about session state: webview memory is freed for deleted VS Code sessions (unsent prompt text, review comments, pending image attachments); an in-flight failed draft is restored into the live prompt after a session is deleted mid-send (but never into a prompt you explicitly cleared); and switching Agent Manager sessions stays in sync with the conversation even when the backend is briefly unavailable.

Full entry → Affects: /kilocode/, /kilocode/orchestrator/, /kilocode/setup/

Two fixes worth upgrading for. nemoclaw tunnel start now registers the cloudflared tunnel origin in the gateway allowlist, so the Web UI works through a tunnel with no manual config — before, every WebSocket through the tunnel was rejected with "origin not allowed" (#6235). And a rebuild that shared a messaging credential with another sandbox used to abort after destroying the original (permanent loss); the conflict check moved into rebuild preflight so it now aborts before any destructive step (#5954). Also: every enabled channel's policy preset now persists after onboard (#5967), destroy --force cleans up when the gateway is down (#6046), and update --fresh reinstalls even when already current (#5960).

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/policy/

Claude in Chrome is now generally available. The claude agents background workflow also gained real teeth: sessions fire the Notification hook (agent_needs_input / agent_completed) when they stall or finish, and background agents now commit, push, and open a draft PR when they complete worktree code work instead of stopping to ask. New /dataviz skill (chart/dashboard guidance + a runnable color-palette validator); the built-in Explore agent now inherits the session model (capped at Opus) rather than Haiku; and anthropicAws was added as a gateway upstream provider with proper failover on model-not-found.

Full entry → Affects: /openclaw/, /openclaw/skills-guide/, /claude-cowork/

Every open P0 and P1 in the repo is closed. Hermes v0.18.0 (calendar tag v2026.7.1) ships ~1,720 commits since v0.17.0 and clears 100% of open P0/P1 issues and PRs — ~700 top-priority items, part of ~1,950 total resolved this window. Beyond the cleanup: Mixture-of-Agents is now a first-class model you pick like any other, with reference-model reasoning shown and the aggregator's answer streamed live; the agent now verifies its own work against evidence; /goal gained completion contracts; /learn + /journey make self-improvement steerable; and the gateway added scale-to-zero + drain coordination for production deploys.

Full entry → Affects: /hermes/, /hermes/setup/, /hermes/tasks/, /hermes/memory/

A security-heavy day tagged v0.0.72. DNS-backed HTTPS endpoints now fail closed before NemoClaw hands them to OpenShell (#6139, closing an HTTPS DNS-rebinding gap); the user-supplied Hermes inference endpointUrl is now SSRF-validated and user presets can no longer declare allowed_ips (#6087); curl probe credentials moved to a 0600 --config file so API keys never reach process argv (#5975); and EC2 metadata discovery is disabled across OpenClaw builds (#6096). On the feature side, a new channels status config summary (#6044) and exec now rejects multi-line args with recovery guidance (#5980).

Full entry → Affects: /nemoclaw/, /nemoclaw/policy/, /security/

Enterprise plan admins can now control which models their users can access and what effort-level settings they can use — handy for standardizing a managed org on a specific model/effort tier for Claude Cowork projects. Access to Claude Fable 5 and Claude Mythos 5 was also restored after a suspension.

Full entry → Affects: /claude-cowork/, /claude-cowork/pricing/, /claude-cowork/system-prompts/

NemoClaw added a nemoclaw credentials add <PROVIDER> --type <TYPE> subcommand that wraps openshell provider create, so you can register an OpenShell provider credential from NemoClaw without dropping to the OpenShell CLI (#5969). It takes repeatable --credential KEY[=VALUE] / --config K=V or --from-existing, rejects messaging-bridge names, and points at credentials reset on conflict. A bundled Tavily Search profile means --type tavily works out of the box, with TAVILY_API_KEY added to the known credential env keys. The rest of the day was internal CI/E2E workflow maintenance.

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/switching-providers/

Claude Sonnet 5 becomes the default in Claude Code (v2.1.197): native 1M-token context and promotional $2/$10 per Mtok through Aug 31. The prior day's v2.1.196 added organization-default models (set in the org console, shown as "Org default" in /model) and a security fix so claude mcp list/get no longer spawn .mcp.json servers a repo self-approved via a committed .claude/settings.json — untrusted workspaces show ⏸ Pending approval. Plus readable session names, Cmd/Ctrl-click file attachments, and background-job + rate-limit telemetry fixes.

Full entry → Affects: /openclaw/, /openclaw/configuration/, /openclaw/security/, /openclaw/cost-optimisation/, /claude-cowork/

The Claude apps and Claude API release notes both refreshed on June 30, coinciding with the Claude Sonnet 5 launch that also reached Claude Code. These are change-detected hosted pages, so we flag the update — see the Claude Code entry for the model change most Cowork users will feel.

Full entry → Affects: /claude-cowork/, /claude-cowork/pricing/, /claude-cowork/vs-api/

A pre-release focused on local model serving and Agent Manager: connect to a local Anaconda Desktop text-generation server from CLI or VS Code (#11714); NVIDIA Parakeet TDT 0.6B v3 speech-to-text input (#11693); Agent Manager model/reasoning-variant discovery by name with automatic provider resolution (prefers the provider behind your default, falls back to the Kilo Gateway) (#11786); and a per-worktree sandbox toggle in the New Worktree modal (#11689).

Full entry → Affects: /kilocode/, /kilocode/models/, /kilocode/orchestrator/, /kilocode/security/

NemoClaw published v0.0.70 and v0.0.71 release docs and shipped several reader-facing changes: a host-mediated gateway restart command (#5874); an uninstall --destroy-user-data flag to purge otherwise-preserved state (#5784); policy-list preset provenance annotation with the default Balanced tier no longer granting weather egress (#5797); a shields auto-relock recovery warning (#5951); preserved warm sandbox build cache for faster rebuilds (#6034); and an OpenShell support bump 0.0.44 → 0.0.71 (#5596). Plus new docs on local compatible endpoints, model task-fit, and a capability audit matrix.

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/policy/, /nemoclaw/switching-providers/

Four usability changes on main (no new tag that day — still v0.0.67): a new first-class nemoclaw use <name> command to set the default sandbox without hand-editing sandboxes.json (#5930); fuzzy "Did you mean?" hints when you mistype a sandbox name (#5964); opt-in reasoning-mode validation for custom OpenAI-compatible endpoints via NEMOCLAW_REASONING (#5948); and a hardened Windows WSL bootstrap that verifies the runtime before installing Ubuntu and prints manual-install guidance when blocked (#5950).

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/switching-providers/, /nemoclaw/policy/

Three reader-facing changes on main (no new tag — still v0.0.67): the DGX Station managed-vLLM profile now defaults to DeepSeek V4 Flash (with a serve-recipe fix for an observed accuracy issue); non-interactive onboarding now exits non-zero when endpoint validation rejects a provider — the invalid-NVIDIA-key HTTP 403 path used to print the error but leak exit code 0 to scripts; and onboarding finishes its oclif flag migration (typed flags, native alias-aware deprecation, the legacy parser deleted). The rest of the day was a large internal E2E release-gate and CI source-coverage hardening wave.

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/local-gpu/, /nemoclaw/switching-providers/

The one item to act on: hook matchers with hyphenated identifiers (e.g. code-reviewer, mcp__brave-search) were accidentally substring-matching and now exact-match — check your hook configs, and use mcp__brave-search__.* to match every tool from a hyphenated MCP server. Also: a new CLAUDE_CODE_DISABLE_MOUSE_CLICKS setting (disable click/drag/hover in fullscreen, keep wheel scroll), voice-dictation fixes (macOS silence capture, auto-submit for spaceless languages), tighter install consent for external plugins enabled via a project's .claude/settings.json, and a batch of background-agent reliability fixes.

Full entry → Affects: /openclaw/, /openclaw/configuration/, /openclaw/skills-guide/, /claude-cowork/

User-facing changes on main (no new tag — still v0.0.67): new Deep Agents CLI aliases (a nemo-deepagents bin and --agent dcode/deepagents/langchain forms for langchain-deepagents-code); destroy now wipes per-sandbox persistent volume state so re-onboarding with the same name gives a clean workspace (no resurrected USER.md/SOUL.md); shields status is now host-authoritative rather than reporting from plugin-local state; and an Ollama --non-interactive/--yes fix. The rest of the day was E2E/CI hosted-inference test stabilization.

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/policy/, /nemoclaw/switching-providers/

A new autoMode.classifyAllShell setting routes every Bash/PowerShell command through the auto-mode classifier (not just arbitrary-code patterns), and auto-mode denial reasons now show up in the transcript, the denial toast, and /permissions. A new claude_code.assistant_response OpenTelemetry event carries the model's response text — it's redacted by default, but when OTEL_LOG_ASSISTANT_RESPONSES is unset it inherits OTEL_LOG_USER_PROMPTS, so telemetry deployments that already log prompts will start logging responses on upgrade unless you set OTEL_LOG_ASSISTANT_RESPONSES=0. Also: idle background-shell memory reaping, an MCP-auth startup notice, bash-mode path autocomplete, and several background-agent fixes.

Full entry → Affects: /openclaw/, /openclaw/configuration/, /openclaw/security/, /claude-cowork/

Two Team/Enterprise-plan additions to the Claude apps: admins can now mandate device verification before members access or control a remote Claude Code session (June 25), and members can tag Claude directly in a Slack conversation to delegate a task and keep working while it runs (June 23).

Full entry → Affects: /claude-cowork/, /claude-cowork/setup/

A heavy day on main making LangChain Deep Agents Code (dcode) a first-class terminal runtime (no new version tag — still v0.0.67). A new opt-in Tavily web-search policy preset (nemoclaw <name> policy-add tavily) opens egress to api.tavily.com only; nemoclaw <name> agent now dispatches dcode correctly instead of falling into OpenClaw-only help handling; secret-shaped env values are rejected before dcode starts; status/dashboard-url tell the truth about terminal sandboxes; and a macOS onboarding hang is fixed. Plus manifest-derived (fail-closed) messaging and sturdier list/connect/rebuild.

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/policy/, /nemoclaw/skills/

/rewind can now restore conversation state from before a /clear was run, and hooks configured with a comma-separated matcher like "Bash,PowerShell" — which had been silently never firing — work again. Stopping a background agent from the tasks panel is now permanent (no more resurrecting), and hosts you allow with "Yes" in the sandbox network dialog are remembered for the session. Also improves MCP capability-discovery reliability, plus Windows Terminal /login URL wrap, Ghostty Cmd+click, and managed-settings MDM-refresh fixes. (v2.1.190 was bug-fixes only.)

Full entry → Affects: /openclaw/, /openclaw/configuration/, /openclaw/security/, /claude-cowork/

v0.0.67 switches the DGX Spark express install to configure managed local vLLM by default instead of Ollama, and hardens onboarding recovery: an install interrupted before the sandbox was created now starts fresh instead of dead-ending on a forced --resume. LangChain Deep Agents Code is branded as its own product (no longer printing the OpenClaw name during onboarding), channels add is rejected up front on agents that declare no messaging support (before any destructive rebuild), and a doubled nvidia/nvidia/ model-namespace bug is fixed.

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/local-gpu/

OpenAI updated the chat-latest snapshot, which points to the latest Instant model currently used in ChatGPT, so API callers can test the newest chat-side improvements. OpenAI still recommends GPT-5.5 for production API usage — chat-latest is a moving target for experimentation, not a pin. Minor, but worth noting if you pin model snapshots.

Full entry → Affects: /chatgpt/, /chatgpt/pricing/, /chatgpt/api-vs-chat/

Adds a sandbox.credentials setting that blocks sandboxed commands from reading credential files and secret environment variables, and surfaces org-configured model restrictions across the model picker, --model, /model, and ANTHROPIC_MODEL. Remote MCP tool calls that used to hang for 5 minutes now abort with an error (CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT). Fixes structured output (--json-schema / workflow agent({schema})) so the model can't re-call StructuredOutput indefinitely, plus pasted CJK mojibake, stuck background jobs, and dropped channel connections.

Full entry → Affects: /openclaw/, /openclaw/security/, /openclaw/configuration/, /claude-cowork/

v0.0.66 retires the generated docs-to-skills pipeline and the per-topic nemoclaw-user-* skill trees in favor of a single compact nemoclaw-user-guide skill that routes AI agents to canonical docs via the docs MCP server, llms.txt, and variant Markdown pages (the old llms-full.txt path is deprecated). Also fixes the Discord per-account proxy (drops a non-loopback proxy OpenClaw rejects, falling back to the managed proxy so the gateway reaches READY) and adds an integration: dcode routing label for LangChain Deep Code work.

Full entry → Affects: /nemoclaw/, /nemoclaw/skills/, /nemoclaw/policy/

Adds claude mcp login <name> / claude mcp logout <name> to authenticate MCP servers from the CLI (with a --no-browser stdin path for completing over SSH). Behavior change: ! bash commands now make Claude respond to the output automatically — set "respondToBashCommands": false to keep the old context-only behavior. Also: status filtering (f) in /workflows, a Skills section in /plugin, and teammateMode: "iterm2". Fixes post-sleep "Content block not found" streaming errors and enforces Agent() deny rules for named subagent spawns.

Full entry → Affects: /openclaw/, /openclaw/configuration/, /openclaw/skills-guide/, /claude-cowork/

v7.3.53 restores bounded text-file reads and stops zero-limit pagination and Unicode truncation from producing unusable tool output — reading files behaves correctly again after a recent regression. v7.3.54 has no notable changes. (The larger opencode v1.15.13 upstream sync landed in v7.3.52, covered on the 22nd.)

Full entry → Affects: /kilocode/, /kilocode/setup/

No new release, but an experimental LangChain "Deep Agents Code" harness (#5197) — a terminal-oriented agent NemoClaw can onboard, status-check, log, and snapshot without an in-sandbox gateway. Also: a realigned DGX Spark Qwen3.6 vLLM recipe (#5612) and a sandbox gateway serving watchdog. The rest of the day was a large internal sweep migrating shell E2E tests to live Vitest coverage.

Full entry → Affects: /nemoclaw/, /nemoclaw/local-gpu/, /nemoclaw/skills/

A new monorepo package, ironclaw_skill_learning, gets its first 0.1.0 tag — an initial skill-learning module within the IronClaw repo. The core ironclaw CLI stays at v0.29.1. Release notes are minimal; worth watching as the capability matures, nothing to act on yet.

Full entry → Affects: /ironclaw/, /ironclaw/skill-allowlisting/

A large opencode upstream sync (v1.15.9 → v1.15.13). Adds a configurable provider headerTimeout (10s default for stock OpenAI), poll-free background agents, partial modalities config, and upward config loading so directory-specific settings apply more predictably in nested projects. Sessions can now store custom metadata via the API/SDK, plus opt-in WebSocket transport for OpenAI responses. Bugfixes: dynamically-added MCP servers disconnect cleanly when removed; DigitalOcean inference uses your OAuth token directly. (v7.3.51 had no notable changes.)

Full entry → Affects: /kilocode/, /kilocode/models/, /kilocode/orchestrator/, /kilocode/setup/

No new release, but a worthwhile onboarding fix: nemoclaw onboard now shows a numbered agent-selection picker (OpenClaw default, then Hermes, etc.) instead of silently configuring OpenClaw (#5469). Onboarding also auto-detects resume from an interrupted session (#5487), and exec --workdir now validates the directory exists with a friendly error (#5499). Rest of the day was internal: advisor tooling, an inventory refactor, and more Vitest E2E migrations.

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/switching-providers/

A one-line UX fix: when a response is slow to start streaming, Claude Code now shows "Waiting for API response · will retry in …" instead of the alarming "No response from API · Retrying in …", and only after 20 seconds of silence rather than 10. Fewer false-alarm "retrying" flashes on a healthy connection; no config or behavior change beyond the wording and timing.

Full entry → Affects: /openclaw/, /openclaw/troubleshooting/, /claude-cowork/

No new release (still v0.0.65). The last 24h on main were internal-only: more live end-to-end tests migrated from shell to typed Vitest (Kimi, Hermes inference switch, Brave search, device-auth health, stale-sandbox upgrade), CI that auto-retries flaky live E2E runs (#5549), and ongoing onboarding/registry nullability cleanup. The PR Review Advisor now labels findings by urgency (#5567). No user-visible change.

Full entry → Affects: /nemoclaw/

Hermes extends its reach: a new iMessage channel via Photon's managed line pool (no Mac relay, no BlueBubbles bridge — the explicit BlueBubbles successor), the Raft agent network, background subagents, image editing, and Cursor's Composer model via an xAI Grok subscription. The web dashboard gained a profile builder and secure login, the Skills Hub browser was rehauled, the memory tool got a major upgrade, and the curator stopped burning aux-model budget on every routine run. ~1,475 commits and 300+ issues closed since v0.16.0, plus a security round.

Full entry → Affects: /hermes/, /hermes/setup/, /hermes/telegram/, /hermes/dashboard/, /hermes/memory/, /hermes/free-models/

Kilo Gateway models that can run on an enabled personal or organization provider key now show a BYOK badge. Custom providers are described independently of their selected API protocol, reverted provider errors are hidden so Redo controls stay visible after rewinding a session, diff highlighting keeps changed identifiers intact, and completion sounds are limited to parent agent sessions. A polish release atop the v7.3.48–49 custom-provider work.

Full entry → Affects: /kilocode/, /kilocode/models/, /kilocode/orchestrator/

Claude Fable 5 launched June 9 (a Mythos-class model made safe for general use). On June 12, access to Fable 5 and Mythos 5 was temporarily suspended with restoration underway; both are selectable again now. If a Cowork or Claude Code workflow pinned Fable 5 during that window and hit model-unavailable errors, that's the cause — no action needed for anyone on default models.

Full entry → Affects: /claude-cowork/, /claude-cowork/system-prompts/

No new release (still v0.0.65). The last 24h on main were internal-only: onboarding flow-context refactors, live-scenario test migrations to Vitest, a CI guardrail blocking net-new if branching in changed test files, and CLI test-timeout fixes. One contributor-facing note: NemoClaw moved its release workflow from PR-based to tag-based (#5545). No user-visible change.

Full entry → Affects: /nemoclaw/

Auto mode now blocks destructive commands you didn't ask for: git reset --hard, git checkout -- ., git clean -fd, git stash drop, an unowned git commit --amend, and terraform/pulumi/cdk destroy unless you named the stack. Scheduled-task and webhook deliveries can no longer approve a pending action (they're now task notifications, not keyboard input), and MCP auth-stub tools no longer leak to the model in headless/SDK mode. Adds attribution.sessionUrl and /config --help; fixes WebSearch in subagents and Windows Terminal TUI corruption.

Full entry → Affects: /openclaw/, /openclaw/security/, /openclaw/configuration/, /openclaw/setup/

The Claude API retired claude-sonnet-4-20250514 and claude-opus-4-20250514 — requests to either now return an error instead of routing elsewhere. Anything pinning those -20250514 snapshots (SOUL.md, agent frontmatter, SDK calls, CI) breaks until migrated; Anthropic recommends upgrading to Claude Sonnet 4.6 and Claude Opus 4.8. Cowork/Claude Code users on the latest defaults are unaffected.

Full entry → Affects: /claude-cowork/, /claude-cowork/vs-api/, /claude-cowork/pricing/

A documentation-only commit adds nemoclaw-contributor-onboard-messaging-channel — a guided workflow for adding a new messaging channel through NemoClaw's manifest-first messaging architecture — plus a src/lib/messaging/AGENTS.md documenting package boundaries and channel extension points. Contributor-facing only, no user-visible change. Still on v0.0.65.

Full entry → Affects: /nemoclaw/skills/

You can now set any setting straight from the prompt with /config key=value (e.g. /config thinking=false) in interactive, -p, and Remote Control modes. A new CLAUDE_CLIENT_PRESENCE_FILE mutes mobile push while you're at the machine; the bundled Bun runtime moves to 1.4; long paragraphs stream line-by-line; and fixes land for prompt caching on custom base URLs/Foundry and 0-byte writes on network/cloud-synced drives.

Full entry → Affects: /openclaw/, /openclaw/configuration/, /openclaw/cost-optimisation/, /openclaw/setup/

A one-click "Import Sessions from Roo Code" button migrates an existing Roo Code installation's conversation history. Custom providers gain much richer support — multiple provider APIs, adaptive thinking, split reasoning, and output-effort variants. Plus opt-in attention sounds when sessions finish/error/need input, Agent Manager tab management, and an open-PR shortcut (Cmd/Ctrl+Shift+R). Both pre-release.

Full entry → Affects: /kilocode/, /kilocode/setup/, /kilocode/models/, /kilocode/orchestrator/

A new OpenClaw-only TELEGRAM_GROUP_POLICY (open/allowlist/disabled, default open) controls group-chat access, with declarable messaging-config defaults; Hermes has no equivalent. The Hermes env-file secret boundary is now enforced on the recover probe path (an injected TELEGRAM_BOT_TOKEN no longer survives recovery). Three bug fixes: non-interactive build-credential reuse, Local Ollama first-turn compaction budget, and host-path resolution for sandbox download/upload. Still on v0.0.65.

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/switching-providers/

v2.1.178 adds Tool(param:value) permission rules that match a tool's input parameters (e.g. Agent(model:opus) to block Opus subagents), loads skills from nested .claude/skills directories, and runs auto-mode subagent spawns through the classifier before launch. v2.1.176 hardens availableModels enforcement so ANTHROPIC_DEFAULT_*_MODEL env vars and /fast can't escape the allowlist, and generates session titles in your conversation's language. v2.1.179 preserves partial responses on mid-stream drops and fixes WSL2 mouse-wheel scrolling.

Full entry → Affects: /openclaw/, /openclaw/security/, /openclaw/configuration/, /openclaw/skills-guide/

Semantic-search indexing now uses an embedded LanceDB vector store by default, so it works without a separate Qdrant server (Qdrant still selectable via indexing.vectorStore). VS Code onboarding gains an agent-autonomy preset and Kilo Gateway catalog-model deep links; task subagents support model-specific reasoning overrides; and reverted sessions restore on the first Redo click.

Full entry → Affects: /kilocode/, /kilocode/setup/, /kilocode/models/, /kilocode/orchestrator/

v0.0.65 release notes published. Beneath the usual test-migration and complexity-refactor churn, three user-facing changes: insecure temporary-file creation is hardened (private mkdtemp dirs + atomic rename for SSH config and /tmp writes); contributor PRs now require a PR-body DCO declaration and GitHub-verified commit signatures before creation; and a new enterprise-readiness reference plus clarified sub-agent setup prerequisites land in the docs.

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/skills/

Anthropic's Claude apps and API release-notes pages both changed. The monitor detected the updates; the pages render entries client-side and expose no machine-readable content, so check the apps and API pages directly.

Full entry → Affects: /claude-cowork/, /claude-cowork/pricing/

v2.1.175 adds the enforceAvailableModels managed setting: the availableModels allowlist now also constrains the Default model (a disallowed Default falls back to the first allowed model), and user/project settings can no longer widen a managed list. v2.1.174 lands a broad fix batch — the /model picker now shows the family Default resolves to, background sessions no longer inherit another session's ANTHROPIC_* provider env, Bedrock GovCloud (us-gov-*) inference profiles resolve correctly, skill hot-reload re-announces only changed skills, and VSCode /usage gains a usage-attribution breakdown.

Full entry → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/security/, /claude-cowork/

github dropped from the Hermes policy baseline — Hermes sandboxes no longer get unscoped github.com / api.github.com access by default; it now ships only via an opt-in preset (a least-privilege tightening, matching OpenClaw). Also: the Hermes WhatsApp bridge deps are preinstalled so hermes whatsapp starts cleanly, Docker Desktop WSL GPU onboarding errors are classified with actionable recovery hints, stale Hermes Discord rebuild plans are refreshed, and the managed-vLLM model catalog is updated. The rest of the batch is test migrations and onboard.ts refactors with no user-facing change.

Full entry → Affects: /nemoclaw/, /nemoclaw/policy/, /nemoclaw/local-gpu/, /nemoclaw/skills/, /hermes/

Anthropic's Claude apps release notes page changed again. The monitor detected the update; the page exposes no machine-readable entries, so check the official page for specifics.

Full entry → Affects: /claude-cowork/, /claude-cowork/projects/

v2.1.172 ships recursive sub-agent spawning up to 5 levels deep, auto-compaction for stuck 1M-context sessions, Amazon Bedrock region auto-detection from ~/.aws/config, a plugin-marketplace search bar, and a slate of background-agent and model-picker fixes. v2.1.173 normalizes Fable 5 model names (strips the redundant [1m] suffix) and suppresses a spurious Windows sandbox warning.

Full entry → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/cost-optimisation/, /claude-cowork/

OpenClaw scope-upgrade approval recovery: same-device replacement requests that include operator.admin are now handled correctly instead of failing. Gateway healthcheck fix: Docker-driver containers no longer show (unhealthy) on fresh onboard. Plus WSL/macOS CLI dispatch stability and a security-docs correction (four → five protection layers). Remaining commits are internal refactors.

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/policy/, /nemoclaw/local-gpu/

Adds a Fork Session button on completed Agent Manager sessions. Task timelines now stay pinned while reviewing history and resume auto-scroll at the bottom. JetBrains reasoning blocks stream live, auto-collapse when done, hide when empty, and merge adjacent blocks. Chat auto-scroll pauses when the user scrolls up through nested tool output.

Full entry → Affects: /kilocode/, /kilocode/setup/, /kilocode/models/, /kilocode/orchestrator/

Sandbox auto-recovery post-reboot: nemoclaw status now walks Docker labels to restart stopped containers (or rename backup containers) and returns a live sandbox without manual intervention. CDI GPU fix: On Ubuntu 24.04+/26.04 hosts with NVIDIA CDI, onboarding now correctly prefers --device nvidia.com/gpu=all over --gpus all, preventing the supervisor reconnect failure that caused onboard to abort on those hosts. Remaining commits are internal test-infrastructure refactors with no user-facing changes.

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/local-gpu/

v2.1.170 ships Claude Fable 5 — a Mythos-class model Anthropic describes as the most capable they have ever made generally available. Update via npm update -g @anthropic-ai/claude-code to unlock it. Also fixes transcript saving for sessions launched from the VS Code integrated terminal (those sessions were silently missing from --resume).

v2.1.169 adds three operator/developer features: --safe-mode flag (CLAUDE_CODE_SAFE_MODE) disables all customizations for clean troubleshooting; /cd command changes working directory mid-session without breaking the prompt cache; disableBundledSkills setting hides all built-in slash commands and skills for locked-down deployments. Bug fixes include: multi-line Up/Down arrow navigation, enterprise MCP policy enforcement on reconnect, 30–50ms macOS startup stall, Windows claude -p slowness, Remote Control OAuth reconnect, Windows Git Credential Manager popup, custom statusline footer hints, stale remote session prompts, and claude agents --json omissions.

Full entry → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/security/, /claude-cowork/

Shows Terminal Bench completion scores and per-attempt costs in supported model details. Restores cloud session filesystem changes from synced session diffs when importing forked sessions. Patch: fixes agent-manager model sync on config change; adds pointer cursor for clickable Kilo webview controls.

Full entry → Affects: /kilocode/, /kilocode/models/

New nemoclaw <name> agents list CLI command completes the host-side agent lifecycle surface (add/delete shipped earlier). Major reliability fixes: Ollama onboarding now works on Windows and minimal Linux distros lacking nc (netcat); WhatsApp pairing QR now renders compact and scannable; CUDA properly initializes on Jetson Tegra via device-node group grant; tmux PTY allocation fixed inside OpenClaw sandbox; GPU local inference routing corrected for host-network setups. Security: dashboard port 8642 (reserved for Hermes API) now rejected host-side before sandbox creation. Config permissions restored after raw openclaw doctor --fix. Hermes config.yaml now shows upstream provider and model.

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/local-gpu/, /nemoclaw/switching-providers/

No new user-facing CLI features today. NemoClaw's June 7–8 batch fixes broken session resume snapshots (#4938): completed onboarding sessions reopened for rebuild now have machine state repaired before the record-only replay, and messaging provider verification no longer emits a misleading "missing provider" warning. The onboarding FSM was also refactored to support returning result sequences from handlers — enabling multi-step provider/inference retry flows without stale context. Triage policy taxonomy docs were tightened for integration routing (Hermes, OpenClaw, Windows ARM). CI Docker Hub auth now retries transient timeouts and falls back to anonymous pulls.

Full entry → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/policy/

v2.1.166 adds a fallbackModel setting (up to three fallback models tried in order when the primary is overloaded) and an auto-retry behavior for unexpected non-retryable API errors. Security hardening: SendMessage relays from other Claude sessions no longer carry user authority, closing a privilege-escalation path in multi-agent setups. Glob patterns now work in deny rule tool-name positions; MAX_THINKING_TOKENS=0 reliably disables thinking on models that think by default. Bug fixes: unprocessable-image token inflation fixed, JetBrains terminal flicker fixed, Kitty keyboard protocol Shift+non-ASCII input fixed, Windows PowerShell validation hang fixed. v2.1.167 and v2.1.168 are reliability follow-ons.

Full entry →  ·  v2.1.166 → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/security/, /claude-cowork/

Hermes v0.16.0 is the project's largest release: a native desktop app for macOS, Windows, and Linux (no browser required); a full web-based admin panel at localhost:9119; Quick Setup for first-run configuration; and an /undo command for reversing the last agent action. The desktop app bundles the Hermes daemon so installation is a single download.

Full entry → Release notes → Affects: /hermes/, /hermes/setup/, /hermes/dashboard/

v7.3.40 ships three chat auto-scroll stability fixes addressing cases where the conversation view would drift or jump during active streaming. v7.3.39 was an internal build iteration.

Full entry → Release notes → Affects: /kilocode/

The ENOTCACHED error blocking "Add MCP" and skill installers when NPM_CONFIG_OFFLINE=true is fixed. The vLLM inference container now launches with --restart unless-stopped so it survives host reboots without re-running onboard. macOS + Colima users with an HTTP_PROXY set no longer see streaming completions stall for up to 120 s. nemoclaw doctor can now verify a local openshell-gateway process when Docker inspection is unavailable.

Full entry → Commit log → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/local-gpu/

Org admins can now pin Claude Code to an approved version range via requiredMinimumVersion and requiredMaximumVersion managed settings — Claude Code refuses to start outside the range and directs users to an approved build. New /plugin list command shows installed plugins with --enabled/--disabled filters. The /btw panel gains a "c to copy" shortcut for raw-markdown clipboard export.

Hooks gain power: Stop and SubagentStop hooks can return hookSpecificOutput.additionalContext to feed Claude feedback without triggering a hook error state. Skills pick up a \$ escape for literal dollar signs before digits in command bodies. stdio MCP servers now receive CLAUDE_CODE_SESSION_ID on --resume. Bug fixes: claude -p no longer hangs after its final result; Bedrock/Vertex/Foundry CI no longer fails with "ANTHROPIC_API_KEY required"; the v2.1.154 $TMPDIR regression that broke bazel/EDR Go workflows is fixed; Windows OneDrive/read-only session-env path errors resolved; org-managed permission rules now apply for the full session from startup. v2.1.165 follows with additional reliability fixes.

v2.1.163 →  ·  v2.1.165 → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/security/, /openclaw/cost-optimisation/, /openclaw/skills-guide/, /claude-cowork/, /claude-cowork/setup/

Fixes a macOS Apple Silicon startup crash caused by malformed bundled exports in the CLI. Users on M-series Macs who found the CLI failing to launch should update immediately. Versions v7.3.30–v7.3.32 were internal build-process iterations with no user-facing changes.

Release notes → Affects: /kilocode/, /kilocode/setup/

v0.0.59 release notes published. Two new egress presets ship: weather (public geocoding/weather APIs) joins the balanced tier by default; public-reference joins the open tier. Nemotron 3 Ultra 550B-A55B (550B total / 55B active, 1M context) is now selectable as a second curated NVIDIA Endpoints model.

Runtime fix: NemoClaw's internal <nemoclaw-runtime> sandbox policy block no longer leaks into the visible chat UI on the third turn — now correctly injected into the system prompt. Inference routing fixed: nemoclaw inference set now correctly resolves Anthropic Messages API routes after provider switch, preventing the 403 connection not allowed by policy regression. GPU patch hardening: Docker GPU reconnect window extended from ~10 s to ~30 s; automatic rollback to backup container on reconnect failure. DGX Spark now uses stable NGC vLLM 26.05.post1 instead of upstream nightly.

Commit log → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/policy/, /nemoclaw/local-gpu/, /nemoclaw/switching-providers/

omni-moderation-latest now returns moderation scores directly in Responses API and Chat Completions API responses. Pass a moderation object in a generation request to receive input and output moderation results in a single call, eliminating the need for a separate moderation API round-trip.

Platform changelog → Affects: /chatgpt/, /chatgpt/tips/

claude agents --json now includes a waitingFor field showing exactly what a waiting session is blocked on (e.g. a pending permission prompt), making multi-agent pipelines easier to monitor and script. Slash-command autocomplete changes: clicking a command now fills it into your prompt instead of running it immediately — press Enter to confirm. /effort now confirms when your chosen level persists as the default for new sessions. Remote Control moves from a startup banner to a persistent footer pill with a direct session link.

Two IDE fixes: explicitly listing Grep/Glob in --tools now correctly activates the dedicated search tools on native builds (previously silently ignored); Windsurf is renamed to Devin Desktop in /ide, /terminal-setup, and /scroll-speed. Key bug fixes: startup no longer hangs when the config dir is read-only — Claude Code falls back to in-memory config and surfaces the error; WebFetch explicit deny/ask/allow rules now take precedence over the preapproved-host auto-allow; Windows path permission rules now match backslash-spelled and case-variant paths; Esc at the start of a turn is no longer silently dropped in stream-json/SDK sessions; MCP per-server timeouts below 1000 ms are no longer floored to a 1-second watchdog.

Release notes → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/security/, /openclaw/cost-optimisation/, /claude-cowork/, /claude-cowork/setup/

Temperature is now plumbed through the Responses API on the IronClaw web interface. A bug where v1 conversation history was not correctly scoped for channel conversations is fixed — this could previously cause context bleeding between channels. WeCom is added as a new release distribution target.

Release notes → Affects: /ironclaw/, /ironclaw/setup/, /ironclaw/configuration/

v7.3.28: free models that may use prompts for training are now marked with a brain-circuit icon in the model picker. Marketplace skill installation is resilient to missing project directories and concurrent installs. Post-compaction tool calls appear in the correct order in CLI and VS Code. Cloud Agent session transcripts are restored in VS Code previews and stalled cloud session loading no longer hangs.

v7.3.29 (JetBrains focus): hidden session UIs are disposed after a configurable timeout to reduce memory use; session stability improved by keeping subscription state on the UI thread; markdown code blocks now render as full-height multiline boxed editors; streaming performance improved by retaining existing views while responses stream. JetBrains rc.6 ensures the model picker highlights training-eligible models.

Release notes → Affects: /kilocode/, /kilocode/setup/, /kilocode/models/, /kilocode/security/

v0.0.58 release documentation is now published. Hermes chat completions broken by an incorrect method-binding patch are fixed — the messaging response normalizer was converting an instance method to a staticmethod, causing a missing content argument error on Bedrock-compatible backends. HTTP_PROXY, HTTPS_PROXY, and NO_PROXY are now forwarded into the sandbox during nemoclaw onboard. WSL2 + Docker Desktop GPU support on ARM (N1X) is improved with the correct aarch64 CUDA proof image; nemoclaw status now reports actual CUDA proof results instead of treating any configured GPU as healthy. Hermes startup clears stale Tirith download_failed markers before command dispatch; Docker-unreachable errors now produce immediate platform-specific recovery guidance instead of waiting several minutes.

Commit log → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/local-gpu/, /nemoclaw/policy/

OpenAI announced the deprecation of reusable prompt objects, the Evals platform, and Agent Builder. Shutdown timelines and migration guidance are on the OpenAI deprecations page. Teams using the Evals platform for evaluation pipelines or Agent Builder for automations should review migration paths before shutdown.

Release notes → Affects: /chatgpt/, /chatgpt/pricing/, /chatgpt/custom-gpts/, /chatgpt/tips/

Critical enterprise fix: forceLoginOrgUUID and forceLoginMethod managed-settings policies were incorrectly blocking third-party provider sessions (Bedrock, Vertex, Foundry, Mantle) when used alongside an org pin — a regression introduced in v2.1.146. Enterprises on those providers should update immediately. Beyond the fix, v2.1.161 adds OTEL dimension slicing: OTEL_RESOURCE_ATTRIBUTES values are now included as labels on metric datapoints so teams can slice usage metrics by custom dimensions like team or repo. The claude agents view shows done/total progress when work is fanned out, and /mcp collapses claude.ai connectors you've never signed in to behind a "Show unused connectors" row. Parallel tool calls are more resilient: a failed Bash command no longer cancels other calls in the same batch. Linux fullscreen clipboard now uses wl-copy/xclip/xsel and copies to both clipboard and PRIMARY selection for middle-click paste. Additional fixes: /effort dialog and animations now honor "Reduce motion"; claude -p stdout no longer corrupted by background subagent output; /autofix-pr handles git worktrees correctly; Windows bash hooks no longer fail with "command not found."

Release notes → Affects: /openclaw/, /openclaw/setup/, /openclaw/skills-guide/, /openclaw/configuration/, /openclaw/security/, /openclaw/cost-optimisation/, /claude-cowork/, /claude-cowork/setup/

The v0.0.57 release notes are now fully published, covering host-side sessions and agents commands, managed vLLM progress, DGX Spark model defaults, UFW auto-remediation, Slack channel validation, and installer tag pinning. Inference improvements: vLLM local sandboxes now auto-detect the real context window from /v1/models.max_model_len during onboard, so generated OpenClaw config reflects the actual server limit. DeepSeek V4 Pro and Kimi K2.6 now work with fetch-based OpenAI-compatible requests, fixing broken Discord and WeChat channel traffic. A long-standing silent behavior is fixed: nemoclaw connect used to silently revert model-route changes; it now prints a loud warning naming the mismatch even in --probe-only mode. Installer docs corrected: NEMOCLAW_INSTALL_TAG must precede curl, not bash; missing refs now fail with a clear error instead of silently falling back to lkg. Managed vLLM downloads now stream native Hugging Face progress output.

Commit log → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/policy/, /nemoclaw/local-gpu/, /nemoclaw/switching-providers/, /nemoclaw/skills/

Starting June 2, 2026, OpenAI container sessions are billed per-minute with a 5-minute minimum, replacing the previous flat 20-minute session rate. The underlying per-minute rate is unchanged — this is a billing granularity improvement. Short-lived container tasks now cost proportionally less: a 6-minute session that previously billed as 20 minutes now bills for 6. No changes to the API, SDKs, or non-container workloads.

Release notes → Affects: /chatgpt/, /chatgpt/pricing/, /chatgpt/tips/

Security-focused patch with multiple hardening improvements. Claude Code now prompts before writing to shell startup files (.zshenv, .zlogin, .bash_login, ~/.config/git/) — changes that could otherwise execute silently in every new shell session. In acceptEdits mode, build-tool config files that grant code execution (.npmrc, .yarnrc*, bunfig.toml, .bazelrc, .pre-commit-config.yaml, .devcontainer/) also require a prompt before write. Workflow improvement: single-file grep/egrep/fgrep output now satisfies the read-before-edit check, removing a redundant Read step. Several background-session bugs fixed: sessions no longer drop chat history on resume from claude agents, claude --bg no longer fails with "socket missing" on cold-start under load, and keyboard unresponsiveness on Windows during heavy CPU load is resolved. Windows clipboard copy-on-select now uses PowerShell interop instead of OSC 52, fixing the issue in MobaXterm and similar terminals.

Release notes → Affects: /openclaw/, /openclaw/setup/, /openclaw/security/, /openclaw/configuration/, /claude-cowork/, /claude-cowork/setup/

Major batch of sandbox lifecycle fixes and features. NEMOCLAW_EXTRA_AGENTS_JSON lets operators bake secondary agents (with explicit tool-allow/deny policies and spawn limits) into the sandbox at onboard time — the primary main agent always remains first and cannot be displaced as default. A new nemoclaw <name> sessions / agents subcommand group adds CLI-level session and agent management (list, reset, delete; add, delete) without editing state files directly. Key bug fixes: Slack credentials now normalize from their openshell:resolve:env:* placeholder form before OpenClaw starts, preventing token-shape rejection at boot; policy preset selections now survive re-onboard and recreate without silently reverting to Balanced tier defaults; cancelling nemoclaw onboard at the policy preset step no longer leaves an orphaned registered-but-unconfigured sandbox. Docker-driver nemoclaw doctor no longer reports a false Gateway failure for the legacy k3s container. Per-agent documentation variants (OpenClaw and Hermes) are now live on the NemoClaw docs site, and the hidden internal:* command family is now documented in the CLI reference.

Commit log → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/policy/, /nemoclaw/local-gpu/, /nemoclaw/switching-providers/, /nemoclaw/skills/

Stable release with incremental improvements from the v7.3.20 pre-release. An experimental kilo console command now opens the Kilo Console UI directly from the local daemon — no manual browser navigation required. Background-process port discovery is now limited to TUI startup, stopping unnecessary Bun subprocess polling mid-session. The VS Code extension now shows a retryable connection error (with unsent prompts preserved) when the background CLI process exits unexpectedly. The Changes review pane scroll position is preserved while agents are writing files.

Release notes → Affects: /kilocode/, /kilocode/setup/, /kilocode/orchestrator/

OpenAI's GPT-5.4 and GPT-5.5 models are now available in Amazon Bedrock via an OpenAI-compatible Responses API endpoint. AWS teams can call these models without a separate OpenAI API key or SDK — standard Bedrock credentials work. Supported models and feature coverage vary by AWS Region, so check the Bedrock docs for your region before building. No changes to existing OpenAI API consumers.

Release notes → Affects: /chatgpt/, /chatgpt/pricing/, /chatgpt/custom-gpts/

Two infrastructure fixes land in NemoClaw. Plugin version pinning is now enforced for messaging plugins: NemoClaw passes exact npm specs (npm:@openclaw/whatsapp@${OPENCLAW_VERSION}) plus the --pin flag at build time, preventing a known edge case where a newer plugin could be installed into an older OpenClaw runtime and silently fail peer-dependency checks — most relevant if you run pinned sandbox images. The second fix resolves a device-scope approval deadlock in the sandbox proxy: the openclaw devices approve subshell previously unset only OPENCLAW_GATEWAY_URL, leaving OPENCLAW_GATEWAY_PORT and OPENCLAW_GATEWAY_TOKEN in the environment; OpenClaw then fell back to the port-based gateway and errored with GatewayClientRequestError: scope upgrade pending approval. Both env vars are now cleared alongside the URL. No user-facing config changes required for either fix.

Commit log → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/policy/, /nemoclaw/local-gpu/, /nemoclaw/switching-providers/, /nemoclaw/skills/

NemoClaw graduates from Alpha to Active development — the alpha banner and status badge are removed from all docs and the README. New nemoclaw <sandbox> skill remove <skill> command cleanly uninstalls skills from a running sandbox. Discord bridge now auto-enables when Discord is configured during nemoclaw onboard — previously required manually setting plugins.entries.discord.enabled. sandbox connect now validates NEMOCLAW_VLLM_MODEL up front and exits with a clear, actionable error for unknown slugs or gated models missing HF_TOKEN, instead of silently failing. Additional fixes: non-interactive curl | bash installer now self-re-execs via sg(1) to complete Docker group activation in one pass; bare inference set redirects gracefully to openshell instead of throwing an oclif error; nemoclaw debug --sandbox <unknown> exits non-zero and leaves no partial tarball; loopback gateway targets stay local and off the managed proxy.

Commit log → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/policy/, /nemoclaw/local-gpu/, /nemoclaw/skills/

Internal infrastructure improvements only — no user-facing changes. Safe to update; no configuration or workflow changes required.

Release notes → Affects: /openclaw/, /openclaw/setup/, /claude-cowork/

Auto mode — which lets Claude dynamically choose its own thinking level — is now available on Bedrock, Vertex, and Foundry for Opus 4.7 and Opus 4.8. Enable it by setting CLAUDE_CODE_ENABLE_AUTO_MODE=1; no code changes required. Enterprise users on these three cloud providers now get the same performance envelope as direct-API users.

Release notes → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /claude-cowork/, /claude-cowork/setup/

Major plugin and agent release. Plugins in .claude/skills now auto-load without a marketplace listing — claude plugin init <name> scaffolds a local plugin instantly. claude agents honors the agent field in settings.json, autocompletes skill names, and EnterWorktree can now switch between Claude-managed worktrees mid-session. Several bug fixes including background sessions losing the correct date after sleep/wake and orphaned worktrees after job retention sweeps.

Release notes → Affects: /openclaw/, /openclaw/setup/, /openclaw/skills-guide/, /openclaw/configuration/, /openclaw/security/, /claude-cowork/, /claude-cowork/skills-guide/

Minor pre-release patch: DeepSeek replaces GitHub Copilot in the Popular Providers list, and chat error styling gets a visual polish in the VS Code extension. No behavior or API changes — safe to install if you want the updated provider list.

Release notes → Affects: /kilocode/, /kilocode/setup/, /kilocode/models/

Big security and reliability patch wave. shields up now seals locked files with SHA-256 and shields status detects content tampering; the OpenClaw gateway auth token rotates on every rebuild — both are security fixes with no config change required. nemoclaw uninstall now preserves rebuild-backups and sandboxes.json by default (full purge still available via NEMOCLAW_UNINSTALL_DESTROY_USER_DATA=1). New nemoclaw <sandbox> channels status command surfaces WhatsApp QR/session state and connection health; Telegram DM allowlist aliases (TELEGRAM_AUTHORIZED_CHAT_IDS, TELEGRAM_CHAT_ID) now work correctly alongside the canonical TELEGRAM_ALLOWED_IDS. Hermes is officially no longer labeled experimental in NemoClaw docs — both OpenClaw and Hermes are now first-class agents.

Commit log → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/policy/, /nemoclaw/local-gpu/

Extended prompt caching is now on by default for most API users. For organizations without Zero Data Retention (ZDR) enabled, prompt_cache_retention now defaults to 24h instead of in_memory across v1/responses, v1/chat/completions, and v1/batch. No code change required — existing calls automatically benefit from longer cache windows and lower latency on repeated prompts.

Release notes → Affects: /chatgpt/, /chatgpt/pricing/, /chatgpt/tips/

OpenAI updated chat-latest to point to the latest Instant model currently used in ChatGPT. For production API usage, GPT-5.5 remains the recommended model; chat-latest is intended for testing the latest chat improvements. The underlying snapshot will be regularly updated.

Release notes → Affects: /chatgpt/, /chatgpt/pricing/, /chatgpt/tips/

Hotfix for Opus 4.8 users: Claude Code was corrupting thinking blocks during responses, causing API errors. Anyone hitting cryptic API errors after upgrading to Opus 4.8 should update immediately. No other changes.

Release notes → Affects: /openclaw/, /openclaw/setup/, /claude-cowork/

Two same-day hotfixes for v0.15.0. The critical fix is the dashboard infinite-reload loop in loopback/Docker mode — v0.15.0 treated every 401 from the identity probe as a stale session token and full-page-reloaded forever (Firefox: "Navigated to /sessions" storm; Chrome: React re-render storm). v0.15.2 fixes packaging: bundled plugin.yaml manifests are now shipped in wheel and sdist, so pip installs get complete plugin metadata.

Release notes → Affects: /hermes/, /hermes/setup/, /hermes/tasks/

Cosmetic/UX patch: DeepSeek replaces GitHub Copilot in the Popular Providers list, and chat error styling gets a visual polish in the VS Code extension. No behavior changes or breaking API updates — safe to install if you want the cleaner error display.

Release notes → Affects: /kilocode/, /kilocode/setup/, /kilocode/models/

Opus 4.8 launches as the new default high-effort model — /effort xhigh selects it and it defaults to high effort. Dynamic workflows let Claude orchestrate tens to hundreds of background agents; run /workflows to view active runs. Fast mode on Opus 4.8 now costs 2× standard rate for 2.5× speed (dramatically cheaper than before). The lean system prompt is now the default for all models except Haiku, Sonnet, and Opus 4.7 and earlier. /simplify is reworked as a cleanup-only pass (reuse, simplification, efficiency) that applies fixes directly. claude agents gains ! <command> to run shell commands as detachable background sessions. Plugins can now declare defaultEnabled: false in their manifest.

Release notes → Affects: /openclaw/, /openclaw/setup/, /openclaw/skills-guide/, /openclaw/configuration/, /openclaw/cost-optimisation/, /claude-cowork/, /claude-cowork/setup/, /claude-cowork/system-prompts/, /claude-cowork/pricing/

GitHub/git plugin gains a skipLfs option to skip Git LFS downloads during clone and update — useful for repos with large binary assets you don't need. Claude now shows a one-time notice when the npm global install can't auto-update, with /doctor listing fixes. claude agents dispatch autocomplete now suggests native slash commands and bundled skills alongside project skills. Fixed: stateful MCP servers reconnect-looping on tools/list (regression from v2.1.147), Windows PowerShell installer falsely reporting success on failure, custom API gateway receiving the user's OAuth credential instead of the gateway token.

Release notes → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/security/, /claude-cowork/, /claude-cowork/setup/

The biggest Hermes release yet. run_agent.py — the 16,083-line agent conversation loop — is now 3,821 lines (-76%), split across 14 cohesive modules. Kanban grew into a real multi-agent platform over 104 PRs: orchestrator auto-decomposition, swarm topology, scheduled tasks, worktree-per-task, and per-task model overrides. Session search is 4,500× faster and now free. Promptware defense lands against Brainworm-class prompt injection attacks. Bitwarden Secrets Manager replaces per-provider API keys with one bootstrap token. Two new image_gen providers (Krea 2 Medium/Large, FAL ported to plugin). ntfy as the 23rd messaging platform. Deep xAI integration: Web Search plugin, xAI-OAuth proxy, retired-model detection + hermes migrate xai, and Grok execution guidance. 15 P0 + 65 P1 issues closed; 321 contributors.

Release notes → Affects: /hermes/, /hermes/setup/, /hermes/tasks/, /hermes/memory/, /hermes/mcp-tools/

DeepSeek now appears in the Popular Providers list instead of GitHub Copilot, reflecting actual user preference signals. Chat error messages in the VS Code extension get improved styling for readability.

Release notes → Affects: /kilocode/, /kilocode/setup/, /kilocode/models/

Mercury Next Edit ships as an opt-in autocomplete mode: predicts multi-line edits beyond the cursor (including off-cursor and pure-insertion edits) with Tab-to-jump / Tab-to-apply affordance. Available via Inception API key or via Kilo Gateway with no separate key required. Autocomplete model picker also gets a "Not set (use server default)" option that auto-tracks the recommended default — users previously pinned to the default are migrated automatically.

Release notes → Affects: /kilocode/, /kilocode/setup/, /kilocode/models/

An optional Hermes web dashboard is now exposed on port 9119 (separate from the API on port 8642) — enable with NEMOCLAW_HERMES_DASHBOARD=true. OpenClaw scope-upgrade approvals no longer route through the gateway proxy, fixing the stuck-approval bug (#4462). The /nemoclaw slash command now correctly registers at startup (regression with newer lazy-activation behavior). Telegram and Discord channels are now baked into generated openclaw.json at install time, fixing silent "no bridge" failures since OpenClaw 2026.5.22. Windows-host Ollama in WSL fails fast with an actionable message instead of a confusing install failure when Docker Desktop WSL integration isn't present. Five skills signing batches landed, publishing the NemoClaw official skills catalog with comprehensive docs and eval datasets.

Commit log → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/policy/, /nemoclaw/local-gpu/, /nemoclaw/skills/, /nemoclaw/switching-providers/

/code-review --fix now applies review findings to your working tree after the review — reuse, simplification, and efficiency suggestions applied in one step. Skills and slash commands can now set disallowed-tools in frontmatter to block specific tools while the skill is active. New /reload-skills command rescans skill directories without restarting. SessionStart hooks can now set the session title via hookSpecificOutput.sessionTitle and return reloadSkills: true. A new MessageDisplay hook lets plugins transform or hide assistant message text as it displays. Auto mode no longer requires opt-in consent. Vim mode: / in NORMAL mode now opens reverse history search.

Release notes → Affects: /openclaw/, /openclaw/setup/, /openclaw/skills-guide/, /openclaw/configuration/, /openclaw/security/, /claude-cowork/, /claude-cowork/skills-guide/, /claude-cowork/system-prompts/

Adds WeCom (WeChat Work) as a new messaging channel. The Responses API now supports externally-provided tools. A logs download button lands in the gateway web UI, and Ctrl-S log download is available in the TUI Logs tab. A new IRONCLAW_DISABLE_CODEACT environment variable lets you revert to the classic CodeAct v1 engine if v2 causes issues. Fixed: Slack angle-link markdown emphasis rendering, NEAR AI API Key and model fetch in the configure UI.

Release notes → Affects: /ironclaw/, /ironclaw/setup/, /ironclaw/configuration/, /ironclaw/security/, /ironclaw/skill-allowlisting/

Per-agent model and variant overrides are now selectable from dropdowns in the orchestrator. Voice transcription auto-activates for Kilo provider users. Configure a default task subagent model and reasoning effort that safely inherits the parent model when the override is unavailable. Inline subagent streaming stays responsive during tool-heavy sessions. Explicit Mistral and Inception autocomplete options added. From v7.3.9 (pre-release): tracked background processes let agents start long-running dev servers with full lifecycle management, status, and logs across session changes — detected ports shown in the TUI sidebar.

Release notes → Affects: /kilocode/, /kilocode/setup/, /kilocode/models/, /kilocode/orchestrator/

/usage now shows a per-category breakdown of what's driving your limits — skills, subagents, plugins, and per-MCP-server cost. /diff detail view is now keyboard-scrollable (arrows, j/k, PgUp/PgDn, Home/End). GFM task list checkboxes (- [ ] / - [x]) now render as real checkboxes instead of bullets. Security fix: PowerShell built-in cd variants (cd.., cd~, drive letters) could silently change the working directory outside the approved workspace — now blocked. Also in v2.1.148: hotfix for the Bash tool returning exit code 127 on every command for some users (regression from v2.1.147).

Release notes → Affects: /openclaw/, /openclaw/setup/, /openclaw/security/, /openclaw/cost-optimisation/, /openclaw/configuration/, /claude-cowork/, /claude-cowork/setup/

Pinned background sessions (Ctrl+T in claude agents) now stay alive when idle and are restarted in-place for updates — shed under memory pressure only after non-pinned sessions. /simplify is renamed to /code-review with configurable effort levels (e.g. /code-review high); pass --comment to post findings as inline GitHub PR comments. Auto-updater gains retry logic for transient network failures and better OS-level error reporting. Prompt history no longer records consecutive duplicates.

Release notes → Affects: /openclaw/, /openclaw/setup/, /openclaw/skills-guide/, /openclaw/configuration/, /claude-cowork/, /claude-cowork/setup/

/simplify is renamed to /code-review with an optional effort level (e.g. /code-review high). The Windows PowerShell "command line is invalid" regression from v2.1.124 is fixed. MCP servers no longer drop paginated resources past page 1 on resources/list, resources/templates/list, and prompts/list. Background sessions stop re-prompting for tool permissions you already granted with "don't ask again," and CLAUDE_CODE_SUBAGENT_MODEL is now forwarded to child processes in multi-agent sessions. Windows Terminal full-screen strobing in attached background sessions is also resolved.

Release notes → Affects: /openclaw/, /openclaw/setup/, /openclaw/skills-guide/, /openclaw/configuration/, /openclaw/security/, /claude-cowork/, /claude-cowork/setup/, /claude-cowork/skills-guide/

Five pre-release patches shipped today (v7.3.2–v7.3.6). The headline: file @-mentions now render as styled chips with click-to-open in both the chat input and sent messages — atomic backspace removal and arrow-key skipping included. Session history search auto-focuses when the panel opens. VS Code local CLI reconnect flapping while the event stream is unavailable is fixed, and Agent Manager diff previews stuck on "Loading…" are resolved. Tree-sitter WASM resources are now resolved correctly in packaged CLI and VS Code builds.

Release notes → Affects: /kilocode/, /kilocode/setup/, /kilocode/models/, /kilocode/orchestrator/

Homebrew is now pre-installed in the sandbox base image — the brew policy preset finally works end-to-end without any manual bootstrap step (#3913). python now resolves to python3 in the sandbox, fixing bare python agent tool calls. Discord traffic is routed through a loopback proxy for correct Gateway/WebSocket handling. A new dashboard-url command prints the authenticated dashboard URL on demand. Managed vLLM is now shown by default on DGX Spark and DGX Station hardware. Hermes rc rewrites after capability drop are fixed.

Commit log → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/local-gpu/, /nemoclaw/policy/, /nemoclaw/skills/

claude agents --json now lists all live sessions as JSON, making it scriptable for tmux-resurrect, status bars, and session pickers. The /plugin Discover and Browse screens show a plugin's full manifest — commands, agents, skills, hooks, MCP/LSP servers — before you install. Security fix: bare variable assignments to non-allowlisted env vars in Bash commands were being auto-approved; that bypass is now closed. Also fixed: spinner/timer freezing after terminal resize, cross-project resume hint on Windows PowerShell 5.1, voice push-to-talk in agent view, and task lists rendering in random order.

Release notes → Affects: /openclaw/, /openclaw/setup/, /openclaw/security/, /openclaw/configuration/, /claude-cowork/, /claude-cowork/setup/, /claude-cowork/skills-guide/

/resume now includes background sessions started via claude --bg or agent view, shown with a bg label. /model now applies to the current session only — press d in the picker to set a default for new sessions. Startup hang of up to 75s when api.anthropic.com is unreachable (captive portal, firewall, VPN) is fixed — side-channel API calls now time out after 15s. "Extra usage" has been renamed to "usage credits" everywhere; /usage-credits replaces /extra-usage (old slash command still works). The /plugin browse pane now shows when a plugin was last updated.

Release notes → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/cost-optimisation/, /claude-cowork/, /claude-cowork/setup/, /claude-cowork/pricing/

Model picker sections (Favorites, Recommended, and per-provider groups like Kilo Gateway) are now collapsible — click any section header to hide its models; state resets each time the picker opens. Speech-to-text voice input is now supported in Agent Manager inline review comments. You can now export full VS Code session transcripts as Markdown files via the new export action.

Release notes → Affects: /kilocode/, /kilocode/setup/, /kilocode/models/

Windows WSL express install now supported: the installer routes WSL users to Windows-host Ollama setup, matching the guided non-interactive path on DGX platforms. AWS Bedrock Runtime custom endpoints are now auto-detected through the existing "Anthropic-compatible endpoint" flow — no new provider selection needed. Network policy docs clarified: TUI approvals are session-only and do not persist across sandbox restarts; persistent policy guidance is now linked prominently. A new PR Review Advisor workflow was added for NemoClaw-aware code review signals.

Commit log → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/local-gpu/, /nemoclaw/switching-providers/, /nemoclaw/policy/

The Foundation Release. pip install hermes-agent now works from PyPI — Hermes installs and runs anywhere. xAI Grok lands as a SuperGrok OAuth provider with grok-4.3 at a 1M context window. A new OpenAI-compatible local proxy lets Codex, Aider, Cline, and Continue hit any OAuth-authed Hermes provider (Claude Pro, ChatGPT Pro, SuperGrok) without API keys. X (Twitter) search is now a first-class tool. Microsoft Teams is wired end-to-end. Cold start cut by ~19 seconds; browser CDP calls are 180× faster. LINE and SimpleX Chat bring the total messaging platform count to 22. Cross-session 1-hour Claude prompt caching and native Windows beta also ship in this release.

Release notes → Affects: /hermes/, /hermes/setup/, /hermes/tasks/, /hermes/memory/, /hermes/mcp-tools/

A collapsible sidebar lands in Agent Manager — the toggle button sits left of the tab title, collapsed state persists across reloads, and starting a new session automatically reopens it. Auto-compaction threshold is now configurable as a percentage so long sessions compact before the context window fills. Shell command output now gets syntax highlighting via Shiki, with labeled Command/Output sections, per-section copy buttons, and "Open in Editor" for full untruncated output. Experimental speech-to-text voice input in VS Code prompt fields via Kilo Gateway also ships.

Release notes → Affects: /kilocode/, /kilocode/setup/, /kilocode/orchestrator/

Fixes a regression where chat-driven tool_install was double-invoking with an auto-approve footgun — the extension install flow is now restored to correct behavior. Provider-specific auth, model fetch, and embeddings config are now hidden behind clean facades, reducing surface area for misconfiguration. Two auth-matrix E2E tests are unxfailed now that the contract matches.

Release notes → Affects: /ironclaw/, /ironclaw/skill-allowlisting/, /ironclaw/configuration/

The Tenacity Release. Multi-agent Kanban ships: spin up a durable board, drop tasks on it, and let multiple Hermes workers pick them up with heartbeats, reclaim, zombie detection, retry budgets, and a hallucination gate. /goal keeps the agent locked on a target across turns (Ralph loop). Security wave closes 8 P0s: redaction is now ON by default, Discord role-allowlists are guild-scoped, WhatsApp rejects strangers by default, and TOCTOU windows close across auth.json and MCP OAuth. Google Chat becomes the 20th supported messaging platform. Seven i18n locales ship.

Release notes → Affects: /hermes/, /hermes/setup/, /hermes/tasks/, /hermes/memory/

The Reborn integration substrate lands on main — a major architectural overhaul introducing host foundation crates, a capability host, runtime dispatcher, process lifecycle management, and structured boundaries for filesystem, secrets, network, and extension manifest registry. A WIT-compatible WASM tool runtime is added. Host-controlled trust-class policy engine introduced. All extension and skill interactions now route through structured capability contracts, significantly hardening the security model.

Release notes → Affects: /ironclaw/, /ironclaw/setup/, /ironclaw/security/, /ironclaw/skill-allowlisting/, /ironclaw/vs-openclaw/

Plugin dependency enforcement gets smarter: claude plugin disable refuses if another enabled plugin depends on the target and shows a copy-pasteable disable-chain hint; claude plugin enable now auto-enables transitive dependencies. The /plugin marketplace browse pane adds projected context cost (per-turn and per-invocation token estimates). New worktree.bgIsolation: "none" setting lets background sessions edit the working copy directly without creating a worktree. PowerShell now passes -ExecutionPolicy Bypass by default — opt out with CLAUDE_CODE_POWERSHELL_RESPECT_EXECUTION_POLICY=1. Key fixes: stop hooks that blocked repeatedly no longer loop forever (capped at 8 blocks with a warning); right-click paste in claude agents on Windows Terminal and WSL restored; agent view no longer spawns repeated PowerShell processes on Windows; /goal evaluator no longer fires while background shells or subagents are still running.

Release notes → Affects: /claude-cowork/, /claude-cowork/setup/, /claude-cowork/skills-guide/, /claude-cowork/system-prompts/, /claude-cowork/pricing/

claude agents gains 8 new flags (--add-dir, --settings, --mcp-config, --plugin-dir, --permission-mode, --model, --effort, --dangerously-skip-permissions) so you can fully configure dispatched background sessions from the command line. Fast mode now defaults to Opus 4.7 (previously 4.6); set CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE=1 to pin back. Key fixes: MCP_TOOL_TIMEOUT now correctly raises the per-request fetch timeout (was hard-capped at 60 s regardless of config); background sessions can find pre-existing git worktrees again; daemon no longer crash-loops after macOS sleep/wake or after a binary upgrade.

Release notes → Affects: /claude-cowork/, /claude-cowork/setup/, /claude-cowork/skills-guide/, /claude-cowork/system-prompts/, /claude-cowork/pricing/

Hooks gain a new terminalSequence field to emit desktop notifications, window titles, and bells even without a controlling terminal. CLAUDE_CODE_PLUGIN_PREFER_HTTPS env var added for HTTPS plugin cloning in environments without a GitHub SSH key. The Rewind menu adds "Summarize up to here" to compress earlier context while keeping recent turns. Background agents launched via /bg or ←← now preserve the current permission mode instead of reverting to default. /feedback can now include sessions from the last 24 h or 7 days for cross-session issues.

Release notes → Affects: /claude-cowork/, /claude-cowork/setup/, /claude-cowork/skills-guide/, /claude-cowork/system-prompts/, /claude-cowork/pricing/

Agent tool subagent_type matching is now case- and separator-insensitive — "Code Reviewer" resolves to code-reviewer automatically. /goal no longer silently hangs when hooks are restricted; it now shows a clear message instead of an unresolvable indicator. Fixes: symlinked settings files no longer cause spurious ConfigChange hooks; claude --bg no longer fails with "connection dropped mid-request" when the background service was about to idle-exit; Windows event-loop stall from missing executables (e.g. gh) resolved.

Release notes → Affects: /claude-cowork/, /claude-cowork/setup/, /claude-cowork/skills-guide/, /claude-cowork/system-prompts/, /claude-cowork/pricing/

Adds Agent View (claude agents) — a unified list of every Claude Code session across running, blocked, and done states. Introduces /goal for autonomous multi-turn execution until a condition is met, hook continueOnBlock so PostToolUse rejections feed back to the model instead of halting, and exec-form args: string[] for path-safe hook spawning without a shell. MCP stdio servers now receive CLAUDE_PROJECT_DIR matching hooks; /mcp Reconnect picks up .mcp.json edits without a restart.

Release notes → Affects: /claude-cowork/, /claude-cowork/setup/, /claude-cowork/skills-guide/, /claude-cowork/system-prompts/, /claude-cowork/pricing/

Internal fixes only — no user-facing changes. Safe to upgrade; nothing to review or reconfigure.

Release notes → Affects: /claude-cowork/

Hotfix — resolves the VS Code extension failing to activate on Windows. Upgrade immediately if you are on Windows and the extension stopped loading.

Release notes → Affects: /claude-cowork/, /claude-cowork/setup/

Large stability release with 15+ fixes. MCP servers no longer silently disappear after /clear in VS Code, JetBrains, and the Agent SDK. Concurrent OAuth token refresh is now race-safe, ending the daily re-authentication loop for users with multiple remote MCP servers. WSL2 users can now paste images from the Windows clipboard via a PowerShell fallback. New settings.autoMode.hard_deny lets admins set unconditional classifier blocks regardless of user intent, and CLAUDE_CODE_ENABLE_FEEDBACK_SURVEY_FOR_OTEL re-enables session quality surveys for enterprise OpenTelemetry setups.

Release notes → Affects: /claude-cowork/, /claude-cowork/setup/, /claude-cowork/skills-guide/, /claude-cowork/system-prompts/, /claude-cowork/pricing/

Adds worktree.baseRef (fresh | head) to control whether new worktrees branch from origin/<default> or local HEAD. Note: the default fresh reverts EnterWorktree behavior introduced in 2.1.128 — set worktree.baseRef: "head" to keep unpushed commits in new worktrees. Hooks now receive the active effort level via effort.level JSON and $CLAUDE_EFFORT. The new parentSettingsBehavior admin key (first-wins | merge) lets admins opt managed settings into the policy merge. Multiple credential race conditions and MCP proxy fixes included.

Release notes → Affects: /claude-cowork/, /claude-cowork/setup/, /claude-cowork/skills-guide/, /claude-cowork/system-prompts/

Adds CLAUDE_CODE_SESSION_ID to Bash tool subprocess environments (now matches the session_id passed to hooks) and CLAUDE_CODE_DISABLE_ALTERNATE_SCREEN=1 to opt out of the fullscreen renderer and keep output in the terminal's native scrollback. External SIGINT (IDE stop button, kill -INT) now triggers graceful shutdown — terminal modes are restored and --resume is printed instead of an abrupt exit. Fixes --permission-mode being ignored on -p --resume, blank fullscreen after sleep/wake, and --resume crashing on sessions containing split emoji.

Release notes → Affects: /claude-cowork/, /claude-cowork/setup/, /claude-cowork/skills-guide/

Hotfix — resolves two regressions: VS Code extension failing to activate on Windows (hardcoded createRequire polyfill path in the bundled SDK), and Mantle endpoint authentication failing with a missing x-api-key header. Upgrade immediately if either issue affects you.

Release notes → Affects: /claude-cowork/, /claude-cowork/setup/

Adds --plugin-url <url> to fetch a plugin .zip archive from a URL for the current session. The Ctrl+R history picker returns to pre-2.1.124 behavior: searches all projects by default, with Ctrl+S to narrow to the current project. Gateway /v1/models discovery is now opt-in via CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1. The skillOverrides setting is now active — off, user-invocable-only, and name-only modes work as documented. Third-party deployments (Bedrock, Vertex, Foundry) no longer see Anthropic-only spinner tips.

Release notes → Affects: /claude-cowork/, /claude-cowork/setup/, /claude-cowork/skills-guide/, /claude-cowork/system-prompts/

Bare /color now picks a random session color; /mcp shows per-server tool counts and flags servers that connected with 0 tools. --plugin-dir now accepts .zip archives. Breaking: workspace is now a reserved MCP server name — rename any existing server that uses it. EnterWorktree is fixed to branch from local HEAD as documented (unpushed commits no longer dropped). OTEL_* env vars no longer leak into Bash, hook, MCP, or LSP subprocesses.

Release notes → Affects: /claude-cowork/, /claude-cowork/setup/, /claude-cowork/skills-guide/, /claude-cowork/system-prompts/, /claude-cowork/pricing/

Substantial release with major Windows and auth improvements. /model picker now lists models from a gateway's /v1/models endpoint when using ANTHROPIC_BASE_URL. New claude project purge [path] deletes all project state (transcripts, tasks, file history) with --dry-run, -y, and --all flags. claude auth login now accepts an OAuth code pasted directly in the terminal — key fix for WSL2, SSH, and container environments. Windows: PowerShell 7 is now detected from MS Store, MSI, and .NET tool installs, and is treated as the primary shell when the PowerShell tool is enabled. Auto mode spinner turns red when a permission check stalls. Security: allowManagedDomainsOnly bypass fixed.

Release notes → Affects: /claude-cowork/, /claude-cowork/setup/, /claude-cowork/skills-guide/, /claude-cowork/system-prompts/, /claude-cowork/pricing/

Hotfix — resolves OAuth authentication failing with a 401 retry loop when CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS=1 is set. Patch-only; safe to upgrade immediately.

Release notes → Affects: /claude-cowork/, /claude-cowork/setup/

Bedrock users gain a new ANTHROPIC_BEDROCK_SERVICE_TIER env var (default, flex, or priority) to control service tier. /resume now finds the session that created a PR when you paste a GitHub, GitLab, or Bitbucket PR URL into the search box. /mcp surfaces claude.ai connectors previously hidden by a manually-added server with the same URL. Key bug fixes: /branch fork failures from rewound timelines, /model Effort option missing for Bedrock ARNs, Vertex AI 400 errors on count_tokens behind proxy gateways, and ToolSearch missing MCP tools that connected after session start.

Release notes → Affects: /claude-cowork/, /claude-cowork/setup/, /claude-cowork/skills-guide/, /claude-cowork/system-prompts/

New alwaysLoad option on MCP server config bypasses tool-search deferral so all tools from that server are always available without a ToolSearch call. claude plugin prune removes orphaned auto-installed plugin dependencies. /skills gains a type-to-filter search box. PostToolUse hooks can now replace tool output for any tool (previously MCP-only). Fullscreen scroll no longer jumps to the bottom when typing after scrolling up; overflow dialogs are now keyboard-scrollable. MCP servers that error on startup auto-retry up to 3 times. /terminal-setup now enables iTerm2 clipboard access so /copy works from tmux.

Release notes → Affects: /claude-cowork/, /claude-cowork/setup/, /claude-cowork/skills-guide/, /claude-cowork/system-prompts/

Maintenance patch — changelog housekeeping only, no user-facing changes. Safe to upgrade; no action required.

Release notes → Affects: /claude-cowork/

Major release. /config settings (theme, editor mode, verbose, etc.) now persist to ~/.claude/settings.json and participate in project/local/policy override precedence — a behavioral shift for anyone relying on ephemeral config. --from-pr now accepts GitLab MRs, Bitbucket PRs, and GitHub Enterprise URLs. PostToolUse hooks now include duration_ms, PowerShell commands can be auto-approved like Bash, and --print mode now honors agent frontmatter tools:/disallowedTools:. Slash command UI improved: descriptions wrap instead of truncating, matched characters highlight.

Release notes → Affects: /claude-cowork/, /claude-cowork/setup/, /claude-cowork/skills-guide/, /claude-cowork/system-prompts/, /claude-cowork/pricing/

Vim visual mode (v/V) lands with full selection, operators, and visual feedback. /cost and /stats are merged into /usage (both still work as shortcuts). Custom themes are now editable JSON files in ~/.claude/themes/, createable via /theme; plugins can ship themes too. Hooks gain the ability to invoke MCP tools directly via type: "mcp_tool". New DISABLE_UPDATES env var blocks all update paths — stricter than the existing DISABLE_AUTOUPDATER. WSL users can inherit Windows-side managed settings via wslInheritsWindowsSettings.

Release notes → Affects: /claude-cowork/, /claude-cowork/setup/, /claude-cowork/skills-guide/, /claude-cowork/system-prompts/

/resume now offers to summarize large stale sessions before reloading — saves context on bloated histories. Concurrent MCP server connect is now the default (was opt-in). Plugin installs now auto-resolve missing dependencies from configured marketplaces, and managed-settings blockedMarketplaces/strictKnownMarketplaces are enforced across install, update, refresh, and autoupdate. Agent frontmatter mcpServers now loads for main-thread --agent sessions.

Release notes → Affects: /claude-cowork/, /claude-cowork/setup/, /claude-cowork/skills-guide/, /claude-cowork/system-prompts/

Large session /resume is up to 67% faster on 40 MB+ histories. MCP startup time reduced — resources/templates/list is now deferred to the first @-mention. /terminal-setup now configures scroll sensitivity for VS Code, Cursor, and Windsurf for smoother fullscreen scrolling. The thinking spinner shows inline progress ("still thinking", "thinking more", "almost done"). Security fix: sandbox auto-allow no longer bypasses dangerous-path checks for rm/rmdir targeting /, $HOME, or other critical system directories.

Release notes → Affects: /claude-cowork/, /claude-cowork/setup/, /claude-cowork/skills-guide/, /claude-cowork/system-prompts/, /claude-cowork/pricing/

Patch release targeting multi-agent team setups. Fixes a crash in the permission dialog triggered when a teammate agent requested tool permission — affects anyone running agent teams with shared tool grants. Safe to upgrade immediately.

Release notes → Affects: /claude-cowork/, /claude-cowork/setup/

Substantial release. The CLI now launches a native per-platform binary instead of bundled JavaScript, improving startup performance. Security hardening: new sandbox.network.deniedDomains setting blocks specific domains even under wildcard allowlists; macOS /private/{etc,var,tmp,home} paths are now protected from wildcard rm rules; bash deny rules now catch commands wrapped in env/sudo/watch. Also: /loop Esc cancels pending wakeups, /extra-usage and @-file autocomplete now work from Remote Control clients, and subagents that stall mid-stream timeout cleanly after 10 minutes.

Release notes → Affects: /claude-cowork/, /claude-cowork/setup/, /claude-cowork/skills-guide/, /claude-cowork/system-prompts/, /claude-cowork/pricing/

Hotfix — resolves the "claude-opus-4-7 is temporarily unavailable" error that blocked auto-mode users on Opus 4.7. Patch-only release, no behavioral changes.

Release notes → Affects: /claude-cowork/

Feature-heavy release. Opus 4.7 gains an xhigh effort level (between high and max), and /effort now opens an interactive slider instead of requiring arguments. Auto mode is available to Max subscribers on Opus 4.7 without any flag. New /ultrareview command runs parallel multi-agent code review in the cloud — invoke with no args for the current branch or /ultrareview <PR#> for a specific PR. New /less-permission-prompts skill audits transcripts and proposes settings.json allowlist entries. Windows users get a progressive PowerShell tool rollout. Read-only bash commands and cd <project-dir> && prefixes no longer trigger permission prompts.

Release notes → Affects: /claude-cowork/, /claude-cowork/setup/, /claude-cowork/skills-guide/, /claude-cowork/system-prompts/, /claude-cowork/pricing/

Claude Code v2.1.110 ships a new /tui command for flicker-free fullscreen rendering and splits the Ctrl+O keybinding — focus view is now a separate /focus command. A push notification tool is added for Remote Control users, letting Claude send mobile alerts when configured. Quality-of-life improvements include better plugin management sorting, MCP multi-scope conflict detection in /doctor, and --resume/--continue now resurrecting unexpired scheduled tasks.

Release notes → Affects: /claude-cowork/, /claude-cowork/setup/, /claude-cowork/skills-guide/, /claude-cowork/system-prompts/, /claude-cowork/pricing/

Claude Code v2.1.109 introduces updates to the Claude Code CLI for AI agent development workflows. Review the official release notes for specific feature additions, bug fixes, and breaking changes. Developers using Claude Code should check compatibility requirements for their current projects before upgrading.

Release notes → Affects: /claude-cowork/

Claude Code 2.1.108 ships with improved hook reliability, faster skill loading, and a fix for long-running background tasks. Incremental release — safe upgrade.

Release notes → Affects: /claude-cowork/, /setup/, /skills-guide/

GPT-5.1 lands in the ChatGPT platform with expanded context window, tool-use improvements, and a new Structured Outputs mode. Pricing unchanged.

Changelog → Affects: /chatgpt/, /pricing/, /custom-gpts/

OpenClaw 2.3 introduces native MCP tool passthrough, an overhauled skill sandboxing model, and first-class Windows support without WSL. Major release — review setup and security guides.

Release notes → Affects: /openclaw/, /setup/, /skills-guide/, /security/, /configuration/

Hermes 1.2 adds persistent memory backends (SQLite, Postgres, Redis) and a revamped task scheduler. Existing memory migrations are handled automatically on first start.

Release notes → Affects: /hermes/, /memory/, /tasks/

IronClaw 0.9 lands the Rust-based TEE runtime in beta and tightens the skill allowlist model. Breaking config change for anyone on 0.8 — see migration notes.

Release notes → Affects: /ironclaw/, /setup/, /security/, /skill-allowlisting/

NemoClaw 1.8 adds one-click provider switching, improved local GPU detection, and an expanded policy DSL. Breaking change to the policy file schema — upgrade guide linked below.

Release notes → Affects: /nemoclaw/, /policy/, /switching-providers/, /local-gpu/