OpenClaw v2026.6.33: Safer credential recovery, operator field notes

The source record for v2026.6.33 names a health, liveness, or runtime-observability change. This is an operator's reading of that record, with the exact source facts kept next to a bounded experiment rather than a generic feature list.

Treat this as a stable maintenance checkpoint and keep the release record beside the backup and rollback evidence. A release tag describes the project change. Your Gateway's provider, channel, platform, and account support should be recorded separately.

A small field test

01 / Safer network and secret boundaries

Source signal. provider streams, Discord REST responses, browser fetches, OAuth paths, and logs now cap hostile response sizes and keep Telegram credentials out of diagnostics.

Read Safer network and secret boundaries as an authorization checkpoint: prove who may act, what the action can reach, and how the rejected attempt is surfaced to the operator.

02 / More reliable long-running agents

Source signal. run release, liveness checks, and watchdog semantics now distinguish genuine stalls from active long model calls and wedged backends.

The safe reading of More reliable long-running agents is operational: prove the model can answer the intended task, then force a bounded failure and verify that no side effect is repeated.

03 / Stronger channel delivery

Source signal. Discord reconnects no longer silently drop queued messages or repeat ambiguous non-idempotent sends, while Telegram bot-to-bot and reply-fence handling preserve the intended thread and authorization result.

Before widening access for Stronger channel delivery, replay a narrow allow and deny case. A readable denial and a revoked test credential are part of the acceptance record.

04 / Safer credential recovery

Source signal. service restarts preserve SecretRef-backed Telegram credentials, and OAuth repair no longer overwrites an already-valid destination profile.

Treat Safer credential recovery as a boundary change. Exercise one permitted request and one refused request with a test identity, then keep both decisions in the log.

The details that affect a runbook

Extended-stable updates

package installations can select, update from, and receive availability notices for the extended-stable channel without silently falling back to another release line.

Extended-stable updates lives at the handoff between the Gateway and a conversation. Send one harmless message, reconnect once, and compare the account, thread, sender, and final transcript.

Approval and tool authority

Codex app-server commands now require an actual human/plugin approval, exec auto-review stays bound to the exact resolved command, and narrow tool allowlists remain owned by the factory that constructs them.

Treat Approval and tool authority as a boundary change. Exercise one permitted request and one refused request with a test identity, then keep both decisions in the log.

Scoped external tooling

external MCP loopback clients use short-lived session-bound attach grants instead of inheriting mutable child-process authority, and Gateway message actions retain trusted requester provenance and reject untrusted callers.

Before widening access for Scoped external tooling, replay a narrow allow and deny case. A readable denial and a revoked test credential are part of the acceptance record.

Operator checklist before rollout

1. Before touching persistent state, capture the version, host, provider, and workspace for Safer network and secret boundaries.
2. Read the linked release record and verify a backup whenever the change can alter configuration or session data.
3. Interrupt one delivery after admission, reconnect the transport, and compare the final reply with the original conversation.
4. Force a short transport interruption and verify that retry or recovery preserves the original thread and sender.
5. Close the test with the evidence attached, and do not widen the rollout while a behavior remains unexplained.

openclaw --version
openclaw gateway status
openclaw security audit

Keep the source trail attached

Close the loop with an explicit next action: keep the candidate isolated, proceed with the staged upgrade, or stop and investigate. Do not treat a green install as proof that the runtime path is correct.

Regression cases from the source

Authorization and disclosure. Gateway HTTP rejects disallowed browser origins before unauthenticated handling, permission repair stays confined to its intended include, MCP status output redacts secrets, and Gateway action bridges reject untrusted requesters. Treat the fix as a boundary condition and retain the source wording beside your local result.

Gateway and process stability. agent-run caches are bounded, lock probes stop leaking file descriptors, close reasons preserve valid UTF-8, and heartbeat reads survive transient filesystem races. Keep the reproduction and the post-fix result together in the acceptance record.

This page is a practical reading of the v2026.6.33 source record; the release index and Gateway health guide remain the references to use for migrations and support boundaries.