OpenClaw v2026.3.22: Web tools/search provider lists, delivery notes

v2026.3.22 is a channel and session story. The official source describes a skills, plugin, marketplace, or SDK change, and the important question is what survives the handoff between a Gateway, a conversation, and a reconnect.

The tag is stable, but the direct notes still define its migrations, corrections, and package-specific limits. Support still depends on the provider, channel, platform, and account behind the installation, so check those boundaries before extrapolating from the tag.

Follow the message path

01 / ClawHub/install

Source signal. add native openclaw skills search|install|update flows plus openclaw plugins install clawhub:<package> with tracked update metadata, gateway skill-install/update support for ClawHub-backed requests, and regression coverage/docs for the new source path.

Keep ClawHub/install inside a test workspace until you can inspect its ledger, next run, failure state, and cancellation behavior from the operator surface.

02 / Plugins/marketplaces

Source signal. add Claude marketplace registry resolution, plugin@marketplace installs, marketplace listing, and update support, plus Docker E2E coverage for local and official marketplace flows.

For Plugins/marketplaces, write down the owner and retry boundary before running anything. Repeat the trigger and check that recovery does not create a second message, job, or file.

03 / Commands/plugins

Source signal. add owner-gated /plugins and /plugin chat commands for plugin list/show and enable/disable flows, alongside explicit commands.plugins config gating.

For Commands/plugins, write down the owner and retry boundary before running anything. Repeat the trigger and check that recovery does not create a second message, job, or file.

04 / Web tools/search provider lists

Source signal. keep onboarding, configure, and docs provider lists alphabetical while preserving the separate runtime auto-detect precedence used for credential-based provider selection.

Before widening access for Web tools/search provider lists, replay a narrow allow and deny case. A readable denial and a revoked test credential are part of the acceptance record.

The less visible details

Media/Windows security

block remote-host file:// media URLs and UNC/network paths before local filesystem resolution in core media loading and adjacent prompt/sandbox attachment seams, so the next release no longer allows structured local-media inputs to trigger outbound SMB credential handshakes on Windows.

The useful evidence for Media/Windows security is the refusal path as well as the success path. Use synthetic credentials and record the policy that made each decision.

Test this release without widening the boundary

1. Note the current version, host, provider, and workspace before exercising ClawHub/install.
2. Keep a tested backup beside the release record if the update can touch configuration, sessions, or a database.
3. Run a read-only prompt with a known answer and save provider, model, reasoning, and latency details.
4. Change only the candidate route, then confirm that a failed request returns a readable error and leaves the session intact.
5. Stop if the observed behavior falls outside the official note, and link the log or screenshot to the version record.

openclaw --version
openclaw gateway status
openclaw security audit

Record what the release actually changed

Keep the version, source URL, test identity, and rollback decision together. If this tag is pre-release, leave it isolated; if it is stable, record the migration and rollback result before reconnecting every channel.

Corrections worth replaying

Web tools/search provider lists. keep onboarding, configure, and docs provider lists alphabetical while preserving the separate runtime auto-detect precedence used for credential-based provider selection. Keep the reproduction and the post-fix result together in the acceptance record.

Media/Windows security. block remote-host file:// media URLs and UNC/network paths before local filesystem resolution in core media loading and adjacent prompt/sandbox attachment seams, so the next release no longer allows structured local-media inputs to trigger outbound SMB credential handshakes on Windows. Record the failure that this correction addresses before declaring the upgrade complete.

Use the complete OpenClaw v2026.3.22 release notes for the exact change list, then cross-check the official release index and the skills documentation before acting.