OpenClaw v2026.5.3: Plugins/install, delivery notes

v2026.5.3 is a channel and session story. The official source describes a skills, plugin, marketplace, or SDK change, and the important question is what survives the handoff between a Gateway, a conversation, and a reconnect.

Treat this as a stable maintenance checkpoint and keep the release record beside the backup and rollback evidence. A release tag describes the project change. Your Gateway's provider, channel, platform, and account support should be recorded separately.

Follow the message path

01 / Plugins/file-transfer

Source signal. add bundled file-transfer plugin with file_fetch, dir_list, dir_fetch, and file_write agent tools for binary file ops on paired nodes; default-deny per-node path policy under plugins.entries.file-transfer.config.nodes with operator approval, symlink traversal refused by default (opt-in followSymlinks), and a 16 MB byte ceiling per round-trip.

Treat Plugins/file-transfer as a boundary change. Exercise one permitted request and one refused request with a test identity, then keep both decisions in the log.

02 / Plugins/install

Source signal. harden official plugin install, uninstall, update, onboarding, ClawHub fallback, npm dependency-state reporting, and beta-channel update paths so externalized plugins behave like first-class package installs.

Use Plugins/install as a routing test: capture the destination before the send, interrupt the transport, and verify that retry logic did not duplicate or redirect the response.

03 / Gateway/performance

Source signal. trim startup and Control UI hot paths by lazy-loading plugin/runtime discovery, cron, schema, shutdown, sessions, and model metadata work only when needed.

Check Gateway/performance with a known prompt and a disposable account. Save the selected route, reasoning setting, latency, and refusal or fallback result so another operator can reproduce it.

04 / Channels/replies

Source signal. improve Discord status reactions and degraded transport reporting, add WhatsApp Channel/Newsletter targets, and tighten Telegram, Feishu, Matrix, Microsoft Teams, and Slack delivery/recovery behavior.

For Channels/replies, delivery is only proven when identity survives an interruption. Keep a disposable channel, send one request, and check for a single reply in the intended thread.

The less visible details

Install/update

recover broken macOS LaunchAgent upgrades, reject source-only plugin packages before runtime load, and repair stale Gateway/plugin state during updates and doctor runs.

A successful click does not establish Install/update. Compare the state before and after a reload, then verify that a user can tell what happened without reading internal logs.

Channels/streaming

add unified streaming.mode: "progress" drafts with auto single-word status labels and shared progress configuration across Discord, Telegram, Matrix, Slack, and Microsoft Teams.

For Channels/streaming, delivery is only proven when identity survives an interruption. Keep a disposable channel, send one request, and check for a single reply in the intended thread.

Agents/commands

add /steer <message> for queue-independent steering of the active current-session run without starting a new turn when the session is idle.

For Agents/commands, delivery is only proven when identity survives an interruption. Keep a disposable channel, send one request, and check for a single reply in the intended thread.

Operator checklist before rollout

1. Before touching persistent state, capture the version, host, provider, and workspace for Plugins/file-transfer.
2. Read the linked release record and verify a backup whenever the change can alter configuration or session data.
3. Interrupt one delivery after admission, reconnect the transport, and compare the final reply with the original conversation.
4. Force a short transport interruption and verify that retry or recovery preserves the original thread and sender.
5. Close the test with the evidence attached, and do not widen the rollout while a behavior remains unexplained.

openclaw --version
openclaw gateway status
openclaw security audit

Keep the source trail attached

Close the loop with an explicit next action: keep the candidate isolated, proceed with the staged upgrade, or stop and investigate. Do not treat a green install as proof that the runtime path is correct.

Regression cases from the source

Channels/WhatsApp. allow @whiskeysockets/libsignal-node in onlyBuiltDependencies so pnpm v9+ blockExoticSubdeps no longer rejects the baileys git-tarball subdep and silences all inbound agent replies. Fixes #76539. Treat the fix as a boundary condition and retain the source wording beside your local result.

Gateway/systemd. preserve operator-added secrets in the Gateway env file across re-stage while clearing OpenClaw-managed keys (such as OPENCLAW_GATEWAY_TOKEN) so a fresh staging value is never shadowed by a stale env-file copy; operator secrets are also retained when the state-dir .env is empty. Fixes #76860. Keep the reproduction and the post-fix result together in the acceptance record.

This page is a practical reading of the v2026.5.3 source record; the release index and skills documentation remain the references to use for migrations and support boundaries.