Changelog — August 10, 2026

Your own machines can now host cloud sessions. claude self-hosted-runner turns a machine or container you control into a place Claude Code web, mobile and desktop sessions can run, on Team and Enterprise plans. This is the most consequential item in the release and the one with the widest blast radius: it means the "run it in the cloud" surface no longer implies Anthropic-managed compute, which changes the data-residency and network-egress conversation for anyone who had ruled out cloud sessions on those grounds. Note the guardrail added one release later — a runner whose --base-dir can't be created or written now exits at startup with a clear error instead of registering successfully and then failing every single session.

Sessions can message each other, across machines. Cross-session SendMessage lets Claude Code sessions talk to one another with ListAgents for discovery — macOS and Linux only. Two settings govern the inbound side: crossSessionInbound and dialogExpiry. The default is the right one: a message sent to a session running with bypassed permissions is held for your approval, while messages to ordinary sessions auto-deliver. Read that carefully before you enable anything broader — a session running with permissions bypassed is exactly the one you don't want another process able to instruct unattended. Also fixed here: SendMessage reported "Message sent" when the write to a teammate's inbox had actually failed, so a delivery you believed happened may not have.

Plugins from a zip, with pinning. A new archive plugin source installs plugins from a zip over HTTPS without git or npm, with optional SHA-256 pinning. The pinning is what makes this worth using rather than merely convenient — an unpinned HTTPS zip is a mutable dependency wearing a URL. If you adopt this source, pin.

Sandbox credential masking got structural. Building on the mode: "mask" that landed in v2.1.221: extract and onExtractNoMatch handle structured env values, decode: "jwt" with maskClaims masks individual JWT claims, and awsPairs/sigv4 re-sign AWS SigV4 requests at the proxy. All of it requires network.tlsTerminate and is honored only from user, managed, or --settings settings — a repo can't turn masking on for itself, which is the correct direction for that particular knob.

Two fixes that quietly mattered. Project paths longer than 200 characters resolved into another project's session directory under a shared sanitized prefix — meaning session list, rename, fork, delete and /resume could cross project boundaries. If you work in deeply nested paths and have ever seen a session that "shouldn't be there", that was this. And sandbox filesystem deny entries written with a trailing slash (denyRead: "~/.aws/") were being silently ignored on Linux and macOS. A deny rule that silently does nothing is worse than no rule; check your sandbox config for trailing slashes.

Smaller items. ANTHROPIC_BEDROCK_REGION_PREFIX lets Bedrock users prefer a specific cross-region inference profile over the AWS_REGION-derived one. Sandbox violation details now appear in Bash tool results instead of being invisible. MCP tools connecting mid-turn are no longer deferred without announcement. Installing multiple plugins no longer silently corrupts plugin records. The subagent cap was removed — concurrency and depth limits still apply. Fullscreen mode keeps full pre-compaction history in scrollback.

Release notes → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/security/, /claude-cowork/, /security/

A command could hide part of itself from the permission check. The headline fix is a Bash permission bypass where a crafted command could conceal parts of itself from the checks that decide whether to prompt you. Related and separately fixed: commands padded with tabs or invisible Unicode could hide text from the approval dialog itself — so the prompt showed you one command while a longer one was queued to run. These are the same class of defect from two directions: the check not seeing everything, and you not seeing everything. Both are fixed here.

Workflow scripts could escape their sandbox. A workflow script could use dynamic import() to run code outside the workflow sandbox. If you run workflows authored by anyone other than yourself, that boundary was not holding.

An org policy that agents could ignore. An agent definition specifying bypassPermissions mode ignored the organization's bypass-permissions disable policy. For a managed deployment this is the meaningful one: the org control existed, and a checked-in agent file overrode it.

Marketplace controls got org-wide wildcards. strictKnownMarketplaces and blockedMarketplaces now accept owner wildcards ("owner/*"), so you can allow or block every marketplace repo under a GitHub org in one entry rather than enumerating repos as they appear.

Context-window enforcement changed behavior — read this if you set it. CLAUDE_CODE_DISABLE_1M_CONTEXT now holds every Claude model with a native 1M window to 200K via auto-compaction, rather than a hardcoded list that new models fell off. A startup warning appears when auto-compaction isn't actually holding the session to 200K. Separately, auto-compact now keeps sessions on unrecognized model IDs inside the assumed context window instead of letting them grow past it; CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1 restores the old behavior. Both changes make the setting mean what its name says, which may be a behavior change for you if you were relying on the gap.

/review is now an alias of /code-review. The consolidated command reviews the current diff or a PR (/code-review <level> <pr#>), and /code-review ultra runs a deep cloud review. With no effort level given it reuses the level you typed last — type a level to change it. Worth knowing before you assume a bare /code-review is running at the default.

Model routing and settings fixes. Gateway model discovery was hiding Claude models registered under provider-prefixed IDs such as vertex_ai/claude-* or bedrock/anthropic.claude-*. modelOverrides keys that aren't Anthropic model IDs were being treated as the session's canonical model ID; unknown keys are now ignored as documented. And server-delivered managed settings no longer disable the env block of a machine-local managed-settings.json or MDM profile — admin env now merges per key.

Session-reliability fixes. Resuming after a mid-session /cd came back empty. Sandboxed commands failed to start on Linux when sandbox.filesystem.denyWrite covered the working directory. Forked background agents got stuck "already resuming" for the rest of the session when rebuilding the fork's parent prompt failed. A resumed session whose history held a malformed diagnostics attachment failed every turn. Also: a /teleport hint now appears in cloud sessions showing how to continue locally, and a warning fires when a subagent's requested model is restricted and the parent model runs instead.

Release notes → Affects: /openclaw/, /openclaw/security/, /openclaw/configuration/, /openclaw/skills-guide/, /security/

Gateway spend limits now surface in the client. Claude Code's usage warning understands gateway spend limits: the limit-reached message names the cap, its reset time, and the operator's message. It requires the gateway to also be on 2.1.225 — an older gateway won't supply those fields. If you run a team behind a gateway, this is the release that turns "requests are failing" into "you hit the cap, here's when it resets."

Two authentication fixes worth checking for. A transient 401 could replace a long-lived CLAUDE_CODE_OAUTH_TOKEN with a stored login's short-lived token, breaking headless sessions until restart — the classic "it worked this morning" CI failure. And MCP OAuth servers on macOS intermittently failed with a burst of 401s as if never authenticated, after a keychain read timed out.

Cross-session messaging matured fast. One release after shipping, SendMessage can now start a conversation with your Remote Control sessions on other machines by name — ListAgents shows them as name [ref] — rather than only replying after they message you first. And a confirmed Remote Control recipient is never swapped for a same-named local session when the local list can't be checked, which is the right failure mode for a feature that routes instructions between machines. Cross-session messages also no longer stay parked without a notice or expiry in headless sessions.

Auto mode stops fighting its own safety filter. Auto mode was counting a safety-filter refusal of its own permission check toward the consecutive-block limit. The action is still denied, but the model is now told to move on instead of retrying into the wall.

Elsewhere. claude agents gained a workspace trust prompt for untrusted directories, matching plain claude. Conversation history broke on Remote Control resume after very large conversations were compacted. Claude Code on the web sessions were misreported as stuck and re-sent a growing event backlog on every reconnect. Hovering a session from another project in the agents list changed the directory the next agent started in. Remote Control now shows Claude photos attached from the Claude app directly instead of reading them from disk with a separate tool call. In VS Code, Focus view no longer folds away the latest to-do list, a pending question's context, or settled answers. v2.1.226, released the same day, is bug fixes and reliability improvements only — no listed behavior changes.

Release notes → Affects: /openclaw/, /openclaw/configuration/, /openclaw/cost-optimisation/, /openclaw/troubleshooting/

The RC we covered five days ago is now the stable release. 1.1.0 promotes 1.1.0-rc.1 plus a short fix list, and our version data now moves off 1.0.0. Everything in the RC writeup holds: custom hosted MCP servers registered from the WebUI, IronHub deep-link installs including private manifest sources, durable cross-channel attachments, native /ironclaw Slack slash commands, and memory modeled as a userland extension with declared capabilities.

Fixed since the RC. Three items, all upgrade-path integrity: 1.0.0 state is preserved across the 1.1 startup migration (the release-pair migration keeps existing rc.1 workspace, extension and Railway artifacts intact); the hosted MCP egress target is preserved for registered MCP servers; and readable text logs stay writable, because write_file's read-before-edit backstop now uses the same lenient binary classification as read_file.

Changed. Extension persistence normalizes filesystem-backed lifecycle state into typed installation, user-membership and credential-binding records. Model failures now carry a next step — every termination path (no progress, iteration limit, disabled capability, denied call, provider error) tells the model what would unlock the call, instead of stopping opaquely. The WebUI gained route-level code splitting and pagination for sidebar thread lists, plus shared controls: a common settings Switch, a shared ConfirmDialog, and normalized control typography.

Upgrade notes. No migration steps from 1.0.0. The one behavioral removal is the Slack /webhooks/slack/events compatibility alias, retired after its one-release window — use /webhooks/extensions/slack/events. If that path is hard-coded in a Slack app configuration, change it before you upgrade.

Release notes → Affects: /ironclaw/, /ironclaw/setup/, /ironclaw/configuration/, /ironclaw/security/, /ironclaw/skill-allowlisting/, /ironclaw/vs-openclaw/

Four days after 1.1.0 went stable, an urgent patch candidate. It is a prerelease — 1.1.0 remains the current stable version in our version data — but the speed and the framing ("urgent patch candidate for the 1.1 line") are the signal. It concentrates on channel delivery and pairing, IronHub and custom-MCP compatibility, WebUI streaming stability, durable retrieval, and safe upgrades from both supported stable predecessors.

What's fixed. Channels: provisioned Slack personal-DM delivery targets are retained, and Telegram accepts /pair as a pairing-code alias. Channel upgrade safety: malformed legacy Slack/Telegram state is skipped by default without deleting its source rows, with an explicit opt-in path for verified import. IronHub and custom MCP: signed IronHub prompt assets install using the 1.1 extension asset contract, and the chat "connect account" dead end for already-connected extensions is gone. WebUI: SSE reload retry storms stop, and active-run bookkeeping is scoped to the thread that owns the run. Retrieval: no more repeated libSQL FTS backfills, natural-language FTS queries are made safe, and pageable result_read continuation references are preserved. Runtime credentials: WASM secret_exists can see credentials staged during extension setup.

Upgrading from 1.1.0 is cheap; from 1.0.0 it is not. From 1.1.0: no offline data transform — stop writers, snapshot the database/volume, start 1.1.1 against the same durable state. From 1.0.0: stop all writers and take a database-native snapshot first; container deployments must also copy the old shared /workspace to durable storage and point IRONCLAW_REBORN_LEGACY_WORKSPACE_SNAPSHOT at it. Startup then applies the additive migrations, imports workspace files create-only, verifies, and retains the old authorities for rollback.

The upgrade gotcha to read twice. Slack and Telegram state is skipped by default on the 1.0.0 path and must be reconfigured — set IRONCLAW_REBORN_SKIP_RC1_CHANNEL_STATE_MIGRATION=false to opt into its verified import instead. And for containers, keep both IRONCLAW_REBORN_HOME and IRONCLAW_REBORN_WORKSPACE_ROOT on durable storage: a database alone does not retain project files, generated artifacts, materialized extension packages, or filesystem-backed skills when a container is replaced.

Release notes → Affects: /ironclaw/, /ironclaw/setup/, /ironclaw/configuration/, /ironclaw/security/

Session budgets are a hard cap, not a warning. You can now set a budget on a Claude Managed Agents session — a cap on the session's spend, priced at public list rates. A session that reaches it pauses with a budget_reached stop reason instead of starting new model requests; changing or removing the budget resumes it. Deployments accept the same budget and apply it to each session they start. For anyone who has been reluctant to hand a long-running agent an open-ended credit line, this is the missing control.

A session can now consult an advisor mid-turn. Add a {"type": "advisor"} entry to the agent's multiagent roster naming a model, and the session's primary thread can consult it mid-turn for strategic guidance. The advisor must be at least as capable as the agent's own model — so this is a cheap-worker/expensive-supervisor pattern made first-class, rather than something you hand-roll with subagents.

Inference geo is now a per-agent setting. Set inference_geo inside the model object when creating an agent, or override it for a single session. Available geos and their pricing are in the data-residency docs. Combined with Claude Code's new self-hosted runners above, the same week gave two independent answers to "where does this actually run?"

Skills load straight from a mounted repo. When a Managed Agents session mounts a GitHub repository, any skills in its root .claude/skills directory are discovered automatically at session start and available for that session. No upload step, no separate registry — the repo is the source of truth.

Release notes → Affects: /claude-cowork/, /claude-cowork/vs-api/, /claude-cowork/pricing/, /tools/cost-calculator/

Inference hooks put an organization's own server in the request path. In beta for Claude Enterprise: point Claude at your organization's AI security server, and each governed prompt across claude.ai, Cowork and Claude Code is held for that server's allow-or-deny verdict before inference proceeds. Requests are signed, failure handling is configurable, and every denial is recorded in the compliance Activity Feed. The configurable failure handling is the part to think through before enabling — a hook that fails open and a hook that fails closed are two very different controls.

Claude Opus 4.1 is retired. claude-opus-4-1-20250805 now returns an error on every request. The recommended upgrade is Claude Opus 5. Researchers can request ongoing access through the External Researcher Access Program. If you have that model ID pinned in a config, a script, or a gateway route, it is already broken — this is a hard cutoff, not a deprecation warning. It is deliberately absent from our cost calculator for the same reason.

Release notes → Affects: /claude-cowork/, /claude-cowork/vs-api/, /claude-cowork/pricing/, /tools/cost-calculator/, /security/

Enterprise plans can now turn on automatic scanning of third-party skills and plugins. When someone uploads or edits a skill or plugin, it is checked for malicious content. This is the organizational counterpart to the advice we give on every skills page — read a skill before you install it, or better, write it yourself — and it is the first platform-side control that doesn't depend on every individual doing that reading. Beta, and Enterprise-only for now.

Why it matters for how you evaluate a skill. Scanning is a filter, not a proof. A skill that passes is one that didn't trip a detector; it is not a skill that has been reviewed for what it does with the access you grant it. Treat a green result the way you'd treat a clean antivirus scan on a downloaded binary — necessary, not sufficient. Our skills guide and OpenClaw skills guide still lead with reading the source.

Release notes → Affects: /claude-cowork/, /claude-cowork/skills-guide/, /claude-cowork/skills-database/, /security/

Fast mode now accepts prompts over 272K tokens on GPT-5.6 Sol, Terra and Luna — previously the tier's ceiling excluded exactly the requests where latency hurts most. OpenAI quotes up to 2.5× the Standard tier's speed. If you had been splitting long-context work across calls to stay inside Fast mode, that workaround is retired.

Cost attribution by API key (Aug 4). The Usage and Costs dashboards can now filter and group by API key, and the Usage and Costs APIs expose the same dimension for programmatic reporting. For anyone running several agents against one org account, this is the difference between a single monthly number and knowing which agent is expensive.

Changelog → Affects: /chatgpt/, /chatgpt/pricing/, /chatgpt/api-vs-chat/, /chatgpt/tips/

Fresh sandboxes were racing their own creation. Live onboarding now waits for the OpenShell create client to release ownership before applying restart-safe Docker recreation. The active onboarding path had been bypassing the existing ownership barrier, so recreation could race the still-running create process and leave a fresh sandbox permanently unready (#8729). The companion change makes registry-only rebuild remove exactly one labeled Docker orphan before creating the replacement and stop on ambiguous ownership rather than guess (#8722). If you have hit a sandbox that created "successfully" and then never came up, this pair is the fix.

Stopped sandboxes recover instead of failing. Ordinary stopped-sandbox startup now waits through an exact transient SUPERVISOR_NOT_RUNNING result and then repeats the complete startup recovery before readiness and forward verification — while definitive or unclassified failures stay terminal (#8728). Relatedly, startSandbox stopped discarding the shared managed-recovery result: OpenClaw and Hermes startup now succeeds only after authenticated managed recovery, OpenShell readiness and host-side port-forward verification, and a failure preserves the existing sandbox and returns specific redacted guidance (#8683).

A long rebuild could race Shields back into lockdown. A rebuild that outlives an inherited Shields auto-restore timer used to let lockdown race the first post-rebuild tool call. NemoClaw now settles an expired deferred timer through the fenced Shields-up path before reporting rebuild success (#8713). A separate fix keeps the Hermes MCP runtime active after a rebuild (#8703).

Local-GPU diagnostics got specific. Managed llama.cpp onboarding now distinguishes an OpenShell Docker bridge connection failure from a healthy internal runtime, and — critically — it stops without changing your UFW rules, reporting the validated bridge network, subnet, gateway IP, fixed port and one narrow operator command instead (#8716). An installer that silently edits a host firewall to fix its own probe is a worse outcome than a clear error; this is the right call. Separately, local Ollama onboarding retries an HTTP 200 that omits a structured tool call while the selected model becomes tool-call responsive, extending the existing 5/15/30-second backoff only for Local Ollama, and reporting the missing tool call without dumping provider response content when retries are exhausted (#8719).

Upgrade and teardown paths. Two legacy OpenShell gateway upgrade failures are repaired: installer-driven recovery now reuses the validated pre-upgrade backup for stale Ready or Running sandboxes instead of attempting a second backup from the already-replaced runtime (#8735). And scoped gateway shutdown is isolated during uninstall so tearing down one gateway doesn't reach others (#8677). Managed-image builds also gained named, fail-closed diagnostics for MCP discovery, with contract mismatches reporting bounded, credential-redacted actual fields beside the expected contract (#8742).

Commits → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/local-gpu/, /troubleshooting/