Guide

OpenClaw v2026.5.4-beta.1: Plugins/file-transfer, provider notes

May 4, 20265 min readUpdated September 11, 2026By OpenClawBlog Team

v2026.5.4-beta.1 changes how an agent selects, calls, or remembers a provider. The official record describes a provider, model, voice, or context change; the useful test is a small request with the provider boundary recorded.

Because this is a pre-release, use a disposable Gateway first and leave the stable version available for comparison. The release body cannot certify every local combination of provider, channel, platform, and account; use the bounded test below for the path you actually run.

Channel
Pre-Release

Primary signals
Plugins/file-transfer; Google Meet/Voice Call; Control UI/header

Publication date
2026-05-04

Provider and model consequences

Plugins/file-transfer

Evidence from the release. add bundled file-transfer plugin with file_fetch, dir_list, dir_fetch, and file_write agent tools for binary file ops on paired nodes; default-deny per-node path policy under plugins.entries.file-transfer.config.nodes with operator approval, symlink traversal refused by default (opt-in followSymlinks), and a 16 MB byte ceiling per round-trip.

Operator reading. Treat Plugins/file-transfer as a boundary change. Exercise one permitted request and one refused request with a test identity, then keep both decisions in the log.

Google Meet/Voice Call

Evidence from the release. make Twilio dial-in joins speak through the realtime Gemini voice bridge with paced audio streaming, backpressure-aware buffering, barge-in queue clearing, and no TwiML fallback during realtime speech, giving Meet participants a much snappier OpenClaw voice agent.

Operator reading. The safe reading of Google Meet/Voice Call is operational: prove the model can answer the intended task, then force a bounded failure and verify that no side effect is repeated.

Control UI/header

Evidence from the release. show the active agent name in dashboard breadcrumbs without adding the current session key, keeping non-chat views oriented without crowding the topbar.

Operator reading. The visible promise in Control UI/header needs a continuity check. Use non-sensitive data, refresh midway, and confirm that the same work remains attached to the right session.

Control UI/cron

Evidence from the release. make the New Job sidebar collapsible so the jobs list can reclaim space while keeping the form one click away.

Operator reading. For Control UI/cron, inspect state rather than only the new control. Repeat the flow after reload and reconnect, and note the session, pending action, URL, and visible error.

What changes outside the chat box

Gateway/startup

keep model-catalog test helpers, run-session lookup code, QR pairing helpers, and TypeBox memory-tool schema construction out of hot startup import paths, reducing default gateway benchmark plugin-load and memory pressure.

Check Gateway/startup with a known prompt and a disposable account. Save the selected route, reasoning setting, latency, and refusal or fallback result so another operator can reproduce it.

Release fix

harden backend message action gateway routing [AI].

For Release fix, delivery is only proven when identity survives an interruption. Keep a disposable channel, send one request, and check for a single reply in the intended thread.

Gate QQBot streaming command auth [AI]

The release records a focused fix in gate qqbot streaming command auth [ai].

Before widening access for Gate QQBot streaming command auth [AI], replay a narrow allow and deny case. A readable denial and a revoked test credential are part of the acceptance record.

A bounded check for this version

Start with a disposable checkpoint: record the version, host, provider, and workspace tied to Plugins/file-transfer.
Check the release's migration notes and make a restorable backup before changing persistent state.
Use a disposable conversation for one send, one reconnect, and one retry; keep the destination identifiers with the result.
Leave the channel disabled after the test if its credentials or pairing were created only for this rehearsal.
If the result differs from the release body, stop the rollout and attach the log, screenshot, or transcript to the version record.

openclaw --version
openclaw gateway status
openclaw security audit

Close the loop with evidence

A useful maintenance record names the changed behavior, the behavior that stayed stable, the identity that approved the test, and the step that would undo it. Preserve that record beside the release tag.

Edge cases in this tag

Release fix. harden backend message action gateway routing [AI]. Record the failure that this correction addresses before declaring the upgrade complete.

Gate QQBot streaming command auth [AI]. The release records a focused fix in gate qqbot streaming command auth [ai]. This is the edge case to include in a regression check, especially when the release is pre-release.

The authoritative record is the v2026.5.4-beta.1 GitHub release. The release index gives the surrounding sequence, while the model provider reference supplies the operational background.