realvco Docs

v2026.4.29 — Steering On By Default + People Wiki + Provider Expansion

Released: April 29, 2026 Theme: Messaging flow + memory + provider — three lines evolving in parallel Breaking Changes: Restrictive profiles (messaging, minimal) tools.exec/tools.fs no longer widen implicitly (requires explicit alsoAllow)

Core Highlights

1. Active-Run Steering On By Default

Mid-run course-correction without waiting:

  • steer mode is now the default: drain all pending Pi steering messages at the next model boundary
  • Old “one-at-a-time” logic becomes queue mode
  • New 500ms followup fallback debounce
  • New steering queue docs page

2. Visible Reply Enforcement

New global messages.visibleReplies setting:

  • Force visible output through message(action=send) for any source chat
  • messages.groupChat.visibleReplies remains as group / channel override

3. Subagent Routing Metadata

Gateway events expose spawnedBy on subagent chat and agent broadcast payloads:

  • Clients can route child session events without an extra session lookup

4. Heartbeat Follow-Up Commitments

New opt-in inferred follow-up commitments:

  • Hidden batched extraction
  • Per-agent / per-channel scoping
  • Heartbeat delivery
  • CLI management
  • Simple commitments.enabled / commitments.maxPerDay config
  • Heartbeat-interval due-time clamping (no immediate echo)

5. People-Aware Memory Wiki

Memory grows into a people-aware wiki:

  • Agent-facing person wiki metadata
  • Canonical aliases
  • Person cards
  • Relationship graphs
  • Privacy / provenance reports
  • Evidence-kind drilldown
  • Search modes: person lookup, question routing, source evidence, raw claims

6. Active Memory Evolution

  • Optional per-conversation allowedChatIds / deniedChatIds filters (enable recall only on selected chats)
  • Bounded partial recall summary returned when sub-agent times out (includes default temporary-transcript path)
  • New read-only doctor.memory.remHarness RPC — operators can preview bounded REM dreaming output

7. NVIDIA Provider

New NVIDIA provider:

  • API-key onboarding
  • Setup docs
  • Static catalog metadata
  • Literal model-ref picker support (preserves provider prefix)

8. Bedrock Opus 4.7 Thinking Parity

Bedrock model refs expose the full Claude Opus 4.7 thinking profile (xhigh, adaptive, max):

  • Opus / Sonnet 4.6 stay on adaptive-by-default
  • /think menus and validation match Anthropic transport behavior

9. Slack Block Kit Big Fix Batch

Multiple Slack boundary handling:

  • Interactive buttons / selects stay within Slack Block Kit value / count limits
  • Overlong button URLs dropped while preserving valid callback values
  • Native approval metadata context and update fallback text capped
  • Message-tool presentation and interactive blocks merged on Slack sends
  • Block Kit fallback text capped on send and edit

10. Cross-Channel Stability Batch

  • Telegram: streaming previews use durable message edits (no more flicker); low long-polling timeouts auto-clamped
  • Discord: read-only allowlist / default-target accessors don’t resolve SecretRef
  • WhatsApp: requires Baileys outbound message ID before marking auto-reply delivered (failed group replies no longer falsely report sent)
  • Microsoft Teams: edge cases fixed
  • Matrix: edge cases fixed
  • Feishu: empty-text messages (e.g., {"text":""} with no media) skipped — downstream LLMs no longer reject
  • Signal: group allowlist matches inbound group ID and sender ID; installer downloads have timeout / size check / partial cleanup
  • Voice Call: pre-auth webhook in-flight limiting stays active when socket remote address metadata missing

11. Gateway / Startup / Update Reliability

  • Sysexits 78: systemd detects lock / EADDRINUSE conflicts and exits 78 (stops Restart=always plugin reload loops)
  • Startup skips credential-free tools.web.fetch web-fetch provider discovery (Docker / K8s gateways bind even with fetch limits present)
  • Gateway/models serves last successful model catalog; stale reloads refresh in background
  • Install pipeline: OPENCLAW_SKIP_ONBOARDING lets automated Docker installs skip interactive onboarding
  • Plugins runtime-deps: cross-version container upgrades no longer crash-loop on read-only image-layer paths
  • CLI/update: packaged Node compile caches scoped by OpenClaw version + install metadata (global installs no longer reuse stale chunks)

12. Security Hardening

  • Tools security: tools.exec / tools.fs no longer implicitly widen restrictive profiles (messaging, minimal) — requires alsoAllow
  • OpenGrep scanning: precise OpenGrep rulepack, source-rule compiler, provenance metadata check, PR / full scan workflow uploading SARIF to GitHub Code Scanning
  • GHSA triage policy: media / base64 decode + format conversion overhead after configured acceptance limits classified as performance-only (unless demonstrating bypass, crash, exhaustion, data exposure)
  • Outbound HTML sanitize: plain-text sanitization strips re-formed HTML tags — nested tag fragments can’t leave CodeQL-detected <script> sequences
  • Secrets: credential bytes compared with padded timing-safe buffers (no more hashing candidate passwords)
  • QQBot: debug log args sanitized before console.* writes — gateway payloads can’t forge log lines
  • OAuth/secrets: root-level Google OAuth client_secret_*.json downloads ignored — local client-secret files don’t appear as commit candidates

13. Control UI / i18n

Locale registry adds 6 new languages:

  • Persian (fa)
  • Dutch (nl)
  • Vietnamese (vi)
  • Italian (it)
  • Arabic (ar)
  • Thai (th)

Plus fa, nl, vi, zh-TW docs glossary support.

Upgrade Recommendations

  • Customers focused on mid-conversation correction: steering default-on is worth trying
  • Customer-service style / explicit-reply group setups: messages.visibleReplies enforces it
  • Mental-model “people + relationships” memory users: People Wiki is a major upgrade
  • NVIDIA model users: upgrade and use
  • Bedrock Opus 4.7 thinking users: full profile available on upgrade
  • Slack heavy-interactive / button users: boundary handling fixes help
  • Telegram / Signal / WhatsApp group users: large stability gains
  • Restrictive-profile users: note tools.exec / tools.fs behavior change — requires alsoAllow

This is currently the latest OpenClaw release.

← v2026.4.27 · Back to list