Changelog — August 5, 2026

Worktree isolation didn't cover git. Worktree-isolated sessions — and the subagents they spawn — could run destructive git commands against the main checkout, which is the exact thing the isolation exists to prevent. The point of an isolated session is that a bad tool call is contained to a throwaway tree; a git checkout --, git reset --hard or branch deletion reaching past that boundary makes the guarantee hollow. Isolation now applies to file edits and Bash in every session type, not just some of them. This is the item to update for.

Auto-allow hooks leaked into background tasks. PreToolUse hooks that auto-allow a tool were bypassing tool restrictions in background agent tasks — summaries, compaction, renames. Those are the tasks you never watch, which is what makes it worth calling out: if you had narrowed an agent's tool surface and also had an auto-allow hook, the narrowing wasn't holding where you could least see it.

Two more permission-surface changes in the same release. Messages sent to other agent sessions via SendMessage are now evaluated by the permission classifier before dispatch in auto mode — previously an agent could instruct another session without that check. And Remote Control auto-start can no longer be switched on by repo-local settings (.claude/settings.json or .claude/settings.local.json); those files can still turn it off, but enabling it is now user-scope only, via /config. That asymmetry is deliberate and correct: a repository you cloned should not be able to open a remote channel into your machine.

Removed: the ultraplan feature. No deprecation window in the notes — it's gone in this release. If you had it in a workflow or a script, that workflow needs revisiting.

Connectivity and reporting fixes. The startup connectivity check hung and then failed behind an HTTPS proxy; it now uses the same proxy-aware transport as API requests and times out with a clear message. "Connection closed mid-response" errors were being reported on responses that had actually completed. Stream idle timeouts fired on custom ANTHROPIC_BASE_URL gateways even though server keep-alive pings were arriving on the wire — relevant if you route through a gateway. And claude.ai connectors were falsely flagged as needing authorization when the session token was simply invalid; they now show a /login hint.

Usage accounting got honest. /usage was overattributing consumption to MCP servers: a server was charged for every turn after any call to it, rather than only the requests that actually consumed its tool results. If you have been using that panel to decide which MCP servers are worth their cost, your previous readings were inflated. Separately, /usage-credits on Team and Enterprise told members whose earlier request had been dismissed that they'd "already sent a usage credit request", blocking a new one.

Model routing. Org-restricted model: opus-style subagent and teammate family aliases dropped to the parent model instead of stepping down to the newest org-allowed model in that family — so a restricted org silently got the wrong tier. Also fixed: host model-selection keys not taking precedence over a stale on-disk managed-settings.json when CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST is set.

Smaller fixes. Sessions didn't link to pull requests created after the branch was pushed (including via the GitHub REST API); tool errors weren't displayed for tools no longer available locally, e.g. after an MCP server is removed; SendMessage rejected a long summary outright instead of truncating; a subagent's transcript spinner showed the session's effort label rather than the subagent's own effort: setting; rare crashes on filesystem errors during file-watcher teardown. In --ax-screen-reader mode, screen readers re-read the whole input line on every backspace — end-of-line deletions now echo just the deleted characters. Claude's refusal when a skill is marked disable-model-invocation now tells you to run the skill yourself rather than replicating its workflow. And /diff, the Remote Control workspace diff, and web-session file-edit diffs now read raw git blob content, ignoring workspace-configured diff drivers and textconv.

Release notes → Affects: /openclaw/, /openclaw/security/, /openclaw/configuration/, /openclaw/cost-optimisation/, /claude-cowork/, /security/

This is a release candidate, not a stable release — we track it because an RC after a ground-up rewrite tells you where the platform is heading, but our version data still lists 1.0.0 as current. The headline is extension reach: after 1.0.0 shipped a new runtime with a thin extension surface, 1.1.0 is about making that surface actually reach things.

Custom MCP servers, registered from the WebUI. You can now register an arbitrary hosted MCP server and use its tools like any other extension. Discovery accepts bounded OpenAPI-derived tool catalogs within the manifest's declared tool budget, auth is resolved at registration time, and the registered tools are exposed to the model. That "declared tool budget" phrasing matters — it's a cap, not a suggestion, which is how IronClaw keeps a third-party server from flooding the context window.

IronHub deep-link installs. Extensions install from an IronHub deep link through a register/install gateway, including private manifest sources. Combined with the MCP registration above, this is the first version of IronClaw where extending the agent doesn't mean editing config by hand.

Attachments that survive the channel. Durable cross-channel file flows: a file sent on one channel stays retrievable from the others and from the WebUI. If you have been running IronClaw across Slack and the WebUI and losing track of which surface a file arrived on, this is the fix.

Native Slack slash commands. /ironclaw commands in Slack, backed by a role-filtered command palette in the WebUI, with role gating on admin command actions.

Memory is now an extension. The memory provider is modeled as a userland extension with a host-managed lifecycle, built around declared capabilities — so a provider advertises what it can actually do instead of being assumed uniform. Architecturally this is the most interesting item in the release: it means a third-party memory backend is a first-class option rather than a fork.

Partially wired, opt-in. A sandbox lane (RuntimeKind::Sandbox, credential reuse, scoped containment) and a trigger poller with SSO/admin identity resolution both land opt-in and, in the release's own words, partially unwired. Also opt-in: BENCHMARKING_MODE, a system-prompt addendum for unattended evaluation runs, and caller-scoped QA run artifacts with a regression promotion loop. Treat all of these as previews.

Legibility work. A broad pass on making failures readable — to the model, which now gets told what to do next instead of hitting an opaque stop, and to the user, who gets localized, actionable errors instead of silent dead ends. On the performance side, a libSQL prefix-query fix took an observed 260ms down to 28ms, and listing extensions went from 1+2N queries to 3.

Upgrade notes. No migration steps from 1.0.0. Extension lifecycle state moved to a normalized on-disk shape, and rows written by 1.0.0 keep deserializing. The one behavioral removal: the Slack /webhooks/slack/events compatibility alias is retired — use /webhooks/extensions/slack/events. If you have that path hard-coded in a Slack app configuration, change it before upgrading.

Release notes → Affects: /ironclaw/, /ironclaw/setup/, /ironclaw/configuration/, /ironclaw/security/, /ironclaw/skill-allowlisting/, /ironclaw/vs-openclaw/

Security: SSRF denylists aligned, credential-bearing URLs rejected. The CLI and plugin SSRF validators now apply the same expanded special-purpose address protections — reserved and special-purpose IPv4 and IPv6 destinations, including cloud metadata and benchmarking ranges. Direct blueprint runs also reject endpoint URLs with embedded userinfo credentials before DNS resolution, so a credential-bearing URL never reaches the resolver (#8321). Two validators enforcing different denylists is the classic way an SSRF filter gets bypassed; this closes that gap.

Shields told you it was down when it wasn't. On a sandbox whose OpenShell policy is sealed at startup — langchain-deepagents-code under Landlock, for example — nemoclaw <sandbox> shields down cannot apply the permissive policy, because OpenShell rejects a live Landlock change. The command exited, but shields status then falsely reported the sandbox as DOWN / permissive even though nothing had been unlocked. The cause: shieldsDown deliberately persists the down state before weakening the sandbox (so a crash mid-transition is honestly recorded), but the permissive policy set ran with no rollback and killed the process after that state was already written. Status now rolls back, or persists a policy_rejected transition so it derives the still-restrictive UP posture, or reports an incomplete-transition error — never a state that was not achieved (#8198). This is the fix to care about: a security control that misreports its own state is worse than one that's simply off.

USER.md and SOUL.md may not be in your snapshots. OpenClaw's managed shell uses /sandbox as its home, but durable workspace files live under /sandbox/.openclaw/workspace — so ~/USER.md and ~/SOUL.md resolve outside the managed workspace and are not captured by snapshots. NemoClaw now warns about this explicitly and directs you to $OPENCLAW_WORKSPACE_DIR/USER.md and $OPENCLAW_WORKSPACE_DIR/SOUL.md instead (#8245). The snapshot scope stays manifest-defined; arbitrary files under /sandbox are still not backed up. Check where your persona files actually live before you rely on a restore.

Snapshot reliability, two fixes. A snapshot create that couldn't capture a state directory or file reported the failure and exited non-zero but left the incomplete snapshot on disk and listed by snapshot list as a normal versioned entry — so a later restore could select a capture that never completed. The command now removes it, and names the path if removal itself fails (#8211). Separately, cross-sandbox restore could finish restoring filesystem state, print its completion marker, and then exit 1 while reconciling policy presets — before restored gateway pairing ran. Post-restore policy reconciliation is documented as best-effort but a failed policy mutation was terminating the process; it now warns and continues (#8210).

Local-GPU: a preflight that saves you 30 minutes. A quantized checkpoint the host GPU couldn't serve used to download in full and then crash-loop the nemoclaw-vllm container until a 30-minute load timeout expired, with no actionable message. Managed installs now compare each model's minimum GPU compute capability against the host before the image pull and the model download, and the readiness poller stops a container after three restarts and prints its log tail instead of waiting out the timeout (#8314). Recorded minimums: both FP8 checkpoints need 8.9; deepseek-v4-flash and the Ultra NVFP4 recipe need 10.0; the Spark NVFP4 recipe needs 12.1. The bf16 DeepSeek-R1 distill has none. Profiles launch with --gpus all, so the check judges a host by its weakest GPU.

MTP off for the Spark Qwen profile. Multi-token-prediction speculative decoding is disabled in the managed single-node DGX Spark profile for nvidia/Qwen3.6-35B-A3B-NVFP4 (#8248). Controlled A/B results isolate MTP as the stronger contributor to cold-start memory pressure and long-context instability: with MTP off, host headroom under load went from ~41 GiB to ~62 GiB and a high-context replay that had been timing out completed in 320 seconds. Everything else in the profile is preserved — async scheduling, 0.4 GPU-memory utilization, the 262K context limit, FP8 KV cache, chunked prefill, prefix caching. The commit is careful to say it does not claim to fix the original fatal host freeze, which wasn't reproduced.

Installer re-runs stopped destroying the checkout. The installer's own npm install normalizes the committed lockfile while building, so ~/.nemoclaw/source was dirty by the time the reuse check ran — meaning every installer re-run failed that check and took the destructive branch, removing the checkout and re-cloning and rebuilding from scratch. A re-run at the installed revision now reuses the checkout as intended (#8316). nemoclaw update --fresh still forces a clean re-clone when you want one.

Hermes-on-NemoClaw fixes. Hermes cron restoration now fails closed across sandbox rebuilds and gateway restarts: script-backed jobs stay undispatchable until restored cron state and scripts validate against the same gateway identity, so a rebuild can't fire a job against stale or missing scripts (#7871). And Hermes Web Dashboard state moved to the canonical ~/.hermes/profiles/dashboard-home profile location, migrating existing installs only when the destination is absent or empty, and refusing to merge two populated profiles or follow a legacy symlink (#7892).

Three smaller ones. nemohermes uninstall --yes no longer fails when teardown revalidates a default managed gateway after the packaged gateway service has already been removed — uninstall opts into that packaged-service → standalone resolution while other teardown callers stay fail-closed (#8239). Sandbox destruction now returns a structured, redacted failure when MCP bridge preparation or finalization fails, instead of an uncaught stack trace (#8103). And the MCP troubleshooting docs told readers to run logs --audit, a flag the logs command rejects outright — corrected to logs --tail 200, which already reads both OpenClaw gateway output and OpenShell audit events, with a new test that runs every documented invocation through the real CLI (#8334).

Commits → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/local-gpu/, /troubleshooting/, /security/