[Release] openclaw/openclaw v2026.2.26: openclaw 2026.2.26

OpenClaw v2026.2.26 introduces major features including External Secrets Management with a complete workflow, ACP/Thread-bound agents as first-class runtimes, new agent routing CLI commands for account-scoped management, and Android device capabilities. The release also includes numerous fixes for Telegram DM allowlist inheritance, delivery queue recovery, typing indicators across channels, and various platform-specific lifecycle and authentication improvements.

Key Points

• •External Secrets Management: Implement full `openclaw secrets` workflow with audit, configure, apply, and reload commands, plus runtime snapshot activation and strict target-path validation for safer secret migrations
• •ACP/Thread-bound Agents: Enable ACP agents as first-class runtimes for thread sessions with spawn/send dispatch integration, lifecycle controls, and coalesced thread replies
• •Agents Routing CLI: Use `openclaw agents bindings`, `bind`, and `unbind` commands for account-scoped route management with role-aware identity handling and optional account-binding prompts
• •Codex WebSocket Transport: Switch to WebSocket-first transport by default with SSE fallback, while maintaining per-model/runtime transport overrides
• •Channel Plugin Onboarding: Allow plugins to own interactive onboarding flows via optional `configureInteractive` and `configureWhenConfigured` hooks
• •Android Device Capabilities: Add Android `device` capability with `device.status` and `device.info` node commands, plus `notifications.list` support for listing active notifications
• •DM Allowlist Runtime Inheritance: Enforce `dmPolicy: 'allowlist'` requirements across all account-capable channels (Telegram, Discord, Slack, Signal, iMessage, IRC, BlueBubbles, WhatsApp) with aligned `openclaw doctor` checks
• •Delivery Queue Recovery: Persist `lastAttemptAt` on failed sends and defer recovery retries until backoff window eligibility to prevent retry starvation
• •Typing Indicator Reliability: Add max-duration guardrails and circuit breaker handling to prevent stuck typing indicators across channel routes and dispatcher completion paths
• •Telegram Webhook & Auth: Support ephemeral listener binding with `webhookPort: 0`, add bounded exponential backoff for 401 errors, and clarify webhook configuration guidance

Workflow Diagram

Concepts