$ the-wire · showcase
OpenClaw 2026.8.1-beta.2 tightens secret egress and model runtime switching
By RepoJournal · Filed · About OpenClaw
OpenClaw's latest beta binds shared-store secrets to exact HTTPS hosts and adds GPT-5.6 Ultra support across Sol, Terra, and Luna runtimes.
OpenClaw 2026.8.1-beta.2 ships two headline changes [1]. Shared-store secrets are now bound to exact HTTPS destination hosts across CLI, Gateway RPC, and Control UI, so unbound sentinel substitution fails closed before plaintext egress. The release also supports GPT-5.6 Ultra and runtime switching across Sol, Terra, and Luna on both OpenClaw and Codex engines, keeping model, runtime, and thinking selection atomic through `/model` and fallback.
The Gateway now reports plugin HTTP dispatch failures as a bounded 500 response instead of falling through as an unclaimed 404 route [2]. Discord voice playback no longer lingers after a leave: TTS that settles after the session stops is discarded, queued streams are released, and file-backed playback artifacts are removed [3]. A new lint guard rejects widen-then-assert type laundering, closing nested-chain and const-alias bypasses [4].
Across crabbox, provider control calls no longer hang when no runtime HTTP client is injected, keeping bounded fallback clients for Azure ARM, CubeSandbox, and others [5]. The coordinator now binds release, heartbeat, and runtime-adapter mutations to the CLI-selected provider, enforcing `expectedProvider` atomically and preventing identity mismatches from reaching blind stop/release paths [6]. CLI routing preserves authoritative recorded-run and lease-context provider routes, while doctor output stays provider-neutral until intent exists [7].
Action items
- → Review OpenClaw 2026.8.1-beta.2 release notes and test secret egress binding in your environment openclaw/openclaw [immediate]
- → Update your plugin dispatch error handling to expect 500 responses openclaw/openclaw [plan]
- → Monitor Discord voice sessions for stale playback after updating openclaw/openclaw [monitor]
References
- [1] OpenClaw 2026.8.1-beta.2 ↗ openclaw/openclaw
- [2] fix(gateway): report plugin HTTP dispatch failures as 500 (#124033) ↗ openclaw/openclaw
- [3] fix(discord): stop stale voice playback after leave (#124030) ↗ openclaw/openclaw
- [4] feat(lint): reject widen-then-assert type laundering (#124003) ↗ openclaw/openclaw
- [5] fix(http): bound finite provider control calls ↗ openclaw/crabbox
- [6] fix(coordinator): bind lease mutations to provider ↗ openclaw/crabbox
- [7] fix(cli): preserve authoritative provider routing ↗ openclaw/crabbox