[Release] openclaw/openclaw v2026.3.22-beta.1: openclaw 2026.3.22-beta.1

OpenClaw v2026.3.22-beta.1 introduces significant breaking changes including plugin SDK restructuring, removal of legacy Chrome extension relay, standardized image generation tools, and enhanced security measures. The release modernizes package management with ClawHub integration, adds marketplace support for Claude and Codex bundles, and implements new sandbox backends (OpenShell and SSH). Multiple security improvements address environment variable injection, webhook authentication, and contact search vulnerabilities.

Key Points

• •Plugin SDK surface migrated to `openclaw/plugin-sdk/*` with removal of `openclaw/extension-api`; bundled plugins must use injected runtime for host-side operations
• •ClawHub now preferred over npm for package installation; `openclaw plugins install <package>` falls back to npm only when ClawHub lacks the package/version
• •Chrome MCP legacy extension relay removed; run `openclaw doctor --fix` to migrate host-local browser config to `existing-session`/`user` modes
• •Image generation standardized on core `image_generate` tool; `nano-banana-pro` skill wrapper removed in favor of `agents.defaults.imageGenerationModel` configuration
• •New pluggable sandbox backends introduced: OpenShell (with `mirror` and `remote` modes) and SSH backend with secret-backed key/certificate management
• •Message tool discovery requires `ChannelMessageActionAdapter.describeMessageTool(...)`; legacy `listActions`, `getCapabilities`, `getToolSchema` methods removed
• •Security hardening: blocked JVM/glibc/dotnet environment variable injection in exec sandbox; webhook pre-auth body limited to 64KB/5s with per-IP rate limiting
• •New Matrix plugin backed by official `matrix-js-sdk` with deduplication across gateway restarts and mention-gated room handling improvements
• •Legacy environment variables (`CLAWDBOT_*`, `MOLTBOT_*`) and state directories (`~/.moltbot`) removed; migrate to `OPENCLAW_*` and `~/.openclaw`
• •Added Claude/Codex/Cursor bundle discovery with skill mapping; new `/btw` command for side questions without session context changes

Workflow Diagram

Concepts

Artifacts (6)

# Migrate legacy environment variables
# Old names (remove):
# CLAWDBOT_*
# MOLTBOT_*

# New names (use):
# OPENCLAW_*

# Example migration:
# export CLAWDBOT_TOKEN=xxx  → export OPENCLAW_TOKEN=xxx
# export MOLTBOT_STATE_DIR=~/.moltbot → export OPENCLAW_STATE_DIR=~/.openclaw

# Migrate Chrome MCP configuration
# Run the doctor command to auto-migrate:
oclaw doctor --fix

# This converts legacy Chrome extension relay config to:
# - existing-session mode (for host-local browser)
# - user mode (for user-managed sessions)
# Docker, headless, sandbox, and remote flows use raw CDP

# Old configuration (deprecated):
# - nano-banana-pro skill wrapper
# - sample-skill config copies

# New configuration (use one of):

# Option 1: Built-in image generation
agents:
  defaults:
    imageGenerationModel:
      primary: "google/gemini-3-pro-image-preview"

# Option 2: Third-party skill
# Install separate skill explicitly and configure accordingly

# New ClawHub-preferred installation flow:
oclaw plugins install <package>
# Prefers ClawHub before npm for npm-safe names
# Falls back to npm only if ClawHub lacks package/version

# Explicit ClawHub installation:
oclaw plugins install clawhub:<package>

# Skills installation:
oclaw skills search <query>
oclaw skills install <package>
oclaw skills update <package>

# Migrate legacy state directory
# Old location (deprecated):
# ~/.moltbot
# moltbot.json

# New location:
# ~/.openclaw

# Manual migration:
mv ~/.moltbot ~/.openclaw

# Or set explicit paths:
export OPENCLAW_STATE_DIR=~/.openclaw
export OPENCLAW_CONFIG_PATH=<custom-path>

// Old SDK import (removed):
// import { ... } from 'openclaw/extension-api';

// New SDK imports (use narrow subpaths):
import { ... } from 'openclaw/plugin-sdk/core';
import { ... } from 'openclaw/plugin-sdk/types';

// For host-side operations, use injected runtime:
// Example: api.runtime.agent.runEmbeddedPiAgent()

// Bundled plugins must use injected runtime instead of direct imports