OpenClaw v2026.6.6-beta.1: Tighter security boundaries, for maintainers

For maintainers reading v2026.6.6-beta.1, the source is a map of contracts. It describes a channel, client, interface, or browser change, then lists implementation changes and fixes that can affect plugins, providers, or downstream tooling.

This candidate is still pre-release. Treat provider, channel, and migration behavior as unconfirmed until your own bounded test passes. Treat the version as one input to the decision. Local credentials, enabled plugins, channels, and host support still need their own evidence.

Compatibility for maintainers

Tighter security boundaries

What changed. transcript, sandbox, MCP, browser, channel, and exec-approval paths now fail closed around unsafe access, timed-out approvals, and malformed boundary input.

Check it with. Before widening access for Tighter security boundaries, replay a narrow allow and deny case. A readable denial and a revoked test credential are part of the acceptance record.

Reliable Telegram delivery

What changed. account-scoped topics route to the correct agent, streamed text survives tool calls, callbacks and draft chunks stay coherent, and unauthorized DM text does not enter cache or prompt context.

Check it with. Before widening access for Reliable Telegram delivery, replay a narrow allow and deny case. A readable denial and a revoked test credential are part of the acceptance record.

iMessage stays connected

What changed. always-on inbound recovery, durable echo markers, block streaming, idle approval discovery, and outbound transport now survive restarts and idle periods.

Check it with. The useful evidence for iMessage stays connected is the refusal path as well as the success path. Use synthetic credentials and record the policy that made each decision.

Better browser and MCP connectivity

What changed. existing browser sessions, CDP/WebSocket discovery, default-profile URLs, OAuth/SSE transport, and tool schemas now connect through clearer, safer paths.

Check it with. Before widening access for Better browser and MCP connectivity, replay a narrow allow and deny case. A readable denial and a revoked test credential are part of the acceptance record.

API, package, and test clues

Faster first replies

Control UI startup no longer waits on broad model loading, while cached metadata, lazy slash-command work, and first-event tracing make slow initial responses visible.

Check Faster first replies with a known prompt and a disposable account. Save the selected route, reasoning setting, latency, and refusal or fallback result so another operator can reproduce it.

CLI progress

emit Claude CLI commentary progress events and bridge inter-tool commentary into channel progress without exposing internal protocol scaffolding.

Use CLI progress as a routing test: capture the destination before the send, interrupt the transport, and verify that retry logic did not duplicate or redirect the response.

Observability

allow trusted diagnostics channels to capture tool input/output content, add first-assistant-event traces, and warn on slow initial replies.

Read Observability as an authorization checkpoint: prove who may act, what the action can reach, and how the rejected attempt is surfaced to the operator.

Run the smallest useful rehearsal

1. Write down the baseline for Tighter security boundaries, including the installed version, host, provider, and workspace.
2. Confirm what can be restored, then take a verified backup before applying the candidate package.
3. Exercise the affected channel with synthetic text and note the thread, sender, reaction, or attachment id that comes back.
4. Restart or reconnect the Gateway, then check for one intended reply rather than a duplicate, missing, or misrouted message.
5. Keep the experiment bounded; an unexpected result belongs in the release record before any wider rollout.

openclaw --version
openclaw gateway status
openclaw security audit

Leave a usable maintenance note

Save the command, output, source link, and environment used for this check. Future operators should be able to tell whether a difference belongs to the release or to local provider, channel, or platform state.

Fix details to carry forward

Agent/session recovery. drop stale approval follow-ups after session rebind, remove drained reply-queue items by identity, recover stale main and visible replies, preserve Codex context-engine compaction ownership, lower the default compaction timeout to 180 seconds while respecting explicit configuration, and keep provider-failure terminal lifecycle state correct. This is the edge case to include in a regression check, especially when the release is pre-release.

User-visible content boundaries. suppress Codex/Harmony protocol artifacts, neutralize browser and LanceDB memory media directives, redact transcript images, and preserve native /compact replies through source suppression. Treat the fix as a boundary condition and retain the source wording beside your local result.

Keep the full v2026.6.6-beta.1 notes with your test result. Read the official release index for neighboring versions and the channel routing guide for configuration limits.