[Release] openclaw/openclaw v2026.8.1-beta.2: OpenClaw 2026.8.1-beta.2

OpenClaw v2026.8.1-beta.2 introduces critical security enhancements with secret egress host binding, expands AI model support (GPT-5.6 Ultra with Sol/Terra/Luna runtimes), and improves plugin lifecycle management through shared SDK monitors. Key additions include SQLite backup/restore capabilities, macOS app profile isolation, and enhanced Control UI reliability with better update recovery. The release strengthens security posture through plugin provenance warnings and trusted-source restrictions while improving user experience across channels, authentication, and workspace management.

Key Points

• •Secret egress host binding prevents plaintext credential leakage by binding shared-store secrets to exact HTTPS destination hosts across CLI, Gateway RPC, and Control UI with fail-closed unbound sentinel substitution
• •GPT-5.6 Ultra support with atomic model/runtime/thinking selection across Sol, Terra, and Luna runtimes in both OpenClaw and Codex engines with live matrix coverage
• •Unified channel plugin ingress monitor SDK for durable admission, polling, pruning, claim validation, and adoption handoff—migrated IRC, Synology Chat, and Google Chat to shared lifecycle
• •SQLite snapshot backup/restore with `openclaw backup sqlite create|list|verify|restore` for compact, verified global and per-agent database artifacts with fresh-target-only restore
• •macOS app profile isolation for named instances across state, preferences, Keychain, and Gateway services while preserving host-global login and node services
• •Plugin install provenance warnings requiring explicit `--force` for arbitrary executable sources; trusted ClawHub, bundled, and official-catalog flows remain frictionless
• •Control UI update recovery: Reload button now waits for gateway restart completion and reloads automatically instead of silently failing and requiring manual hard reload
• •Enhanced user identity and presence: attributed messages show real avatars, sender labels drop opaque UUIDs, and new who's-online roster with scrollable contact list
• •Trusted-proxy browser pairing with optional auto-approval for allowlisted proxy identities and non-admin scope caps for new Control UI/WebChat devices
• •External gateway supervision mode (`OPENCLAW_SUPERVISOR_MODE=external`) for lifecycle owners like OCM with verified restart behavior without exposing native service authority

Workflow Diagram

Concepts

Artifacts (4)

openclaw backup sqlite create|list|verify|restore

OPENCLAW_SUPERVISOR_MODE=external

openclaw browser extension cdp

openclaw plugin install <source> --force