[Release] openclaw/openclaw v2026.5.20-beta.2: openclaw 2026.5.20-beta.2

OpenClaw v2026.5.20-beta.2 introduces significant improvements to Discord voice sessions with context-aware profile integration, adds device-code OAuth for xAI provider authentication, implements a bundled Policy plugin for workspace conformance checks, and includes numerous bug fixes across CLI tasks, Codex app-server, provider integrations, and agent message handling. The release enhances security by removing legacy skill-file compatibility paths and warning about plaintext secrets in configuration, while improving stability through better error handling, timeout management, and diagnostic reporting.

Key Points

• •Removed legacy `cat SKILL.md` allowlist compatibility path—skill files must now be loaded with the read tool and only the real skill executable is auto-allowed for improved security
• •Discord voice sessions now follow configured users into voice channels with allowed-channel checks, multi-user handoff, and bounded reconciliation while preserving DAVE recovery
• •Voice session instructions now include bounded IDENTITY.md, USER.md, and SOUL.md profile context by default (configurable via `voice.realtime.bootstrapContextFiles`)
• •Added bundled Policy plugin for policy-backed channel conformance checks, doctor lint findings, and opt-in workspace repair
• •Implemented device-code OAuth login for xAI provider to support remote and headless setups without localhost browser callbacks
• •Allow per-agent lean local-model mode via `agents.list[].experimental.localModelLean` instead of requiring global configuration
• •OpenRouter now honors provider-level `params.provider` routing policy with model and agent params overriding defaults
• •Doctor now warns when plaintext secret-bearing config fields (API keys, sensitive headers) are stored in openclaw.json
• •Fixed stale task maintenance decisions visibility in `openclaw tasks maintenance --json` with backing-session and cron state explanations
• •Improved diagnostic reporting by filtering silent heartbeat artifacts from embedded context snapshots and reducing duplicate tool-schema downgrade logs

Workflow Diagram

Concepts

Artifacts (6)

voice:
  realtime:
    bootstrapContextFiles: []  # Set to empty array to disable IDENTITY.md, USER.md, SOUL.md context injection

agents:
  list:
    - name: "agent-name"
      experimental:
        localModelLean: true  # Enable lean local-model mode for this agent only

models:
  providers:
    openrouter:
      params:
        provider: "preferred-provider"  # Provider-level routing policy
      models:
        - name: "model-name"
          params:
            provider: "override-provider"  # Model-level override

openclaw tasks maintenance --json

openclaw doctor --fix  # Removes unrecognized compat.thinkingFormat values and validates config

# Bundled Policy plugin for:
# - Policy-backed channel conformance checks
# - Doctor lint findings
# - Opt-in workspace repair
plugins:
  policy:
    enabled: true