[Release] openclaw/openclaw v2026.6.6: openclaw 2026.6.6

OpenClaw v2026.6.6 is a security and stability-focused release that substantially tightens security boundaries across transcripts, sandboxing, and multiple integrations while improving Telegram delivery reliability, iMessage recovery, and browser/MCP connectivity. The release also enhances Control UI performance through cached metadata and lazy loading, expands provider support with OpenRouter OAuth and Claude Fable 5, and includes numerous fixes for agent recovery, channel delivery, and authentication. Key improvements span security hardening, messaging platform reliability, performance optimization, and provider compatibility.

Key Points

• •Security boundaries significantly tightened across transcripts, sandbox binds, host environment inheritance, MCP stdio, Codex HTTP access, and elevated sender checks; exec approvals now fail closed on timeout
• •Telegram delivery improved with account-scoped topic routing, streamed text preservation through tool calls, safer callback handling, and unauthorized DM text exclusion from cache and prompt context
• •iMessage recovery and delivery enhanced with always-on inbound restart support, durable echo markers, block streaming, and hardened outbound transport with actionable diagnostics
• •Browser and MCP connectivity gains include existing-session CDP support, WebSocket validation discovery, safer output boundaries, and corrected OAuth/SSE authorization handling
• •Control UI startup and first-reply latency reduced through cached model metadata, removal of startup catalog wait, lazy slash-command loading, and first-event tracing with diagnostics
• •Provider support expanded with OpenRouter OAuth onboarding, Claude Fable 5 adaptive thinking, Gemma 4 reasoning replay preservation, and local model guardian review bypass
• •Agent/session recovery improvements include stale approval cleanup, drained reply-queue recovery, Codex context-engine compaction ownership preservation, and lowered default compaction timeout to 180 seconds
• •Channel delivery fixes across WhatsApp, Feishu, Mattermost, LINE, Discord, and OpenAI Realtime WebRTC with proper reply attachment, thread preservation, and transcript display
• •Performance optimizations include TUI runtime plugin prewarming, plugin auto-enable deduplication, `/models` rescan storm prevention, and prepared startup model metadata reuse
• •Plugin and memory improvements with local llama.cpp runtime moved to provider plugin, batch embeddings across files, agent model catalog cache persistence, and QMD JSON search optimization

Workflow Diagram

Concepts