OpenClaw 2026.5.28 adds safer runtime recovery and stricter inputs

OpenClaw 2026.5.28, released on 30 May, centers on stability, delivery safety, and broader platform support. The project said the update improves agent and Codex runtime recovery, tightens channel handling, and adds more validation across browser, CLI, and provider paths.

One of the largest changes is in agent and Codex runtime behavior. According to the release notes, subagents now keep their working directories and workspaces separated more reliably, hook context stays local to the prompt, and session locks are released more cleanly when a timeout is aborted. The release also avoids stale restart continuations and prevents Codex app-server or helper failures from tearing down shared runtime state.

The update also hardens channel delivery and session identity across a wide set of integrations. OpenClaw said it made outbound plugin hooks, Matrix room IDs, iMessage reactions and approvals, Slack final replies, Discord recovered tool warnings, WhatsApp profile auth roots, Telegram polling, and Microsoft Teams service URL checks safer. In practice, that means the system is less likely to mix up the context attached to messages or continue using untrusted values after a change in session state.

OpenClaw also refreshed mobile and chat surfaces. The release notes point to updates in the iOS Pro UI, hosted push relay defaults, realtime Talk playback, Gateway chat transport, onboarding, Talk permissions, WebChat reconnect delivery, and session picker behavior. The company said these areas now preserve more state across reconnects and empty searches, which should reduce the chance of users losing context while switching screens or reconnecting.

Input handling is stricter too. Browser tool timeouts, viewport and tab indices, Gateway ports, cron retry handling, Discord component IDs, schema array references, Telegram callback pages, and channel progress callbacks now reject malformed values earlier, according to the release notes. OpenClaw also said this helps preserve the intended delivery context instead of letting bad values flow deeper into runtime paths.

Provider coverage expanded as part of the release. The notes list support for Claude Opus 4.8, Fal Krea image schemas, NVIDIA featured model catalogs, MiniMax streaming music responses, encrypted PDF extraction, voice model catalogs, GitHub Copilot agent runtime support, and a Codex Supervisor plugin path for delegated Codex workflows. OpenClaw also said it externalized GitHub Copilot and Tokenjuice as install-on-demand plugins with npm and ClawHub publish metadata.

The release includes several changes aimed at making failures clearer. CLI, auth, doctor, and provider paths now reject malformed numeric and version options earlier, ignore workspace dotenv provider credentials, and bound heartbeat, OAuth, token, and local service startup requests. The project also said legacy api_key auth profiles are migrated to canonical form and restart guidance in doctor is more actionable.

OpenClaw’s release notes also highlight work on plugins, Gateway performance, QA, and release verification. The company said repeated work was trimmed in hot paths, caches were kept correct for session and plugin metadata, and log and artifact waits were bounded so failing test lanes produce evidence instead of hanging or false-greening.

On the product side, the release adds status output for active subagents, refreshes the iOS dev app, improves ClawHub plugin display names and trust surfaces, and expands PDF and tool handling. The company also updated documentation for Codex setup, token authentication, macOS gateway sleep troubleshooting, and several deployment and browser setup flows.

Release verification links published with the update include npm package artifacts, GitHub Actions validation runs, and macOS signing and notarization checks. The release is available as openclaw 2026.5.28 on npm and in macOS download packages, according to the project’s release page.