Changelog — August 14, 2026

Start with the three bypasses, because they share a shape worth understanding. Each one is a case where a permission check looked at the right thing and was told the wrong answer. On PowerShell, variable-writing parameters could silently overwrite $PSDefaultParameterValues — the shell's table of implicit per-cmdlet defaults — and thereby redirect where later commands read and wrote files. Nothing in the later command's text would show it; the redirection lives in shell state the check never re-read. On Windows, Git Bash followed Cygwin-style symlinks that path validation saw as regular files, so a write "to a file" landed wherever the link pointed. Writes through them now require permission approval. And nested git repositories inherited trust from a parent directory; each repository now requires its own trust confirmation. If you have ever cloned something into a subdirectory of a trusted project, that third one was already covering you when you didn't intend it to.

A fourth fix is arguably the sharpest. Remote Control sessions hosted by a bridge inside a cloud session were inheriting that cloud session's transcript or credentials. That is a cross-boundary leak between two sessions that a user would reasonably assume are separate, and it is fixed here. In the same vein, the auto-generated cross-session messaging socket directory on shared /tmp is now hardened — a pre-planted symlink or another user's directory is refused instead of used, the classic multi-user /tmp hijack. The Linux filesystem sandbox got a protected-path bypass closed, Bash input redirections (< file) are now permission-checked like their argument spellings on all platforms, and sandbox.ripgrep is now honored only from user, managed, and --settings settings — project settings can no longer swap the sandbox's ripgrep binary, which is exactly the kind of thing a hostile repository would like to be able to do.

The headline feature is that subagent forking is now on by default. A subagent_type: "fork" subagent inherits the full conversation and prompt cache, and non-teammate agent spawns in interactive sessions now run in the background by default. The cache inheritance is the part with a bill attached: a forked subagent doesn't re-pay for the context it inherits, which makes forking meaningfully cheaper than spawning a fresh agent and re-establishing state. The background-by-default change alters what an interactive session feels like — spawns no longer block you.

Sessions can now talk to each other by name. Type @ in the prompt to mention another Claude session, and Claude uses SendMessage to reach it directly; SendMessage now delivers to a bare name that exactly matches one live session instead of demanding a ref first. To keep that unambiguous, interactive sessions on one machine now enforce unique names — start or rename a session to a name already in use and you get a name-word-word variant plus a notice. Two new /config rows expose the controls: "Dialog expiry" and "Messages from your other sessions" (cross-session inbound accept/hold/refuse). If you run several sessions at once, that last row is the one to look at first.

GitLab is now a first-class citizen in two places. Secret redaction covers the GitLab token families (glrt-, gloas-, glptt-, glagent-, glimt-, glsoat-, glcbt-, glft-, glffct-), with full redaction of routable glpat-/gldt- tokens, and the glab CLI config store gets the same sandbox and credential-path protection gh already had. Plugin marketplaces now accept bare gitlab.com repo URLs, including nested subgroups, cloning them the way github.com URLs already clone. Settings gained friendlier aliases too: additionalMarketplaces and allowedMarketplaces now work in place of extraKnownMarketplaces and strictKnownMarketplaces.

Two enterprise gateway changes fail loudly where they used to fail silently — the better trade. The desktop: overlay now accepts every released Desktop setting (it was 11 hand-listed keys), validated at boot against Desktop's own schema, and unknown or invalid keys fail boot. More consequentially: empty managed.policies[].match.groups / admin.admin_groups entries and malformed email_domain values — empty, or containing @, whitespace, or commas — now fail at boot instead of silently matching no one or granting admin access. Read that twice if you maintain a managed policy file: a typo in an email domain could previously widen admin access rather than narrow it. A url-typed blockedMarketplaces entry for a bare repo URL also keeps blocking when the CLI classifies that URL as a git clone.

Remote Control got a substantial reliability pass. It now keeps reconnecting for about 30 minutes after a network blip and no longer drops after a few blips spread across an hour; sessions started from Claude Desktop or an IDE reattach to the existing claude.ai session instead of creating a new one on every resume; idle sessions no longer look unreachable to newly attached clients; and bridge sessions restore conversation history when the session worker restarts. Resuming a conversation whose session was deleted from claude.ai now starts a replacement rather than failing with a misleading message about your login (a regression from v2.1.227). Resuming also no longer silently steals Remote Control from another Claude Code on the same machine — run /remote-control there to move it deliberately — and the terminal now distinguishes "taken over by another device" from "ended from another app" from "deleted", instead of suggesting a reconnect that would undo what just happened.

Model and provider notes. Fable 5 is offered as an advisor in /advisor again for organizations with Fable access, with usage-credits consent set up through /model fable — and the consent message for interactive --advisor fable launches was fixed, since it previously told you to run a command in a session that had just exited. On the provider side: mTLS client certificate rotation no longer requires a restart (the rotated cert and key reload automatically on connection errors), malformed AWS or Vertex region values now fall back to the default region instead of being used to build request URLs, and stream idle timeout errors now recover rather than failing the request on Bedrock, Vertex and gateway deployments.

Smaller things you may actually notice day to day. /code-review at high, xhigh and max effort now runs in a background agent like the other levels. /plugin install plugin@marketplace refreshes the marketplace first, so a newly published plugin installs without a manual update. /feedback and /bug open immediately instead of waiting for the current turn to finish. /update and /tui no longer refuse to restart while work that survives the relaunch is running. Fullscreen streaming stays responsive in long sessions because the conversation is no longer re-normalized on every update, and pasted images are read without blocking the event loop. Also fixed: MCP connections hanging the full 30-second connect timeout when a server sends a malformed protocol-version reply, a startup race that could silently unregister a plugin marketplace, and Cowork sessions inlining external @-imports from user-scope memory files. The startup tip suggesting you create custom subagents was removed.

Full changelog → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/security/, /openclaw/cost-optimisation/, /claude-cowork/, /security/

1.2.0 is stable, promoting the rc.3 we covered yesterday, and the RC notes undersold what shipped with it. The headline is Slack channel context: pinging the bot at the top level of a channel now gives the run the last 30 messages as context, and pinging inside a thread gives it that whole thread, up to 100 replies. Context is fetched host-side with the bot token (channels:history scope; missing scopes degrade to no context rather than erroring), and — the detail that matters most — it is framed to the model as untrusted quoted channel content, never as instructions. That is the correct design for a feature that pipes arbitrary text written by other people into an agent's context, and it is worth naming because plenty of implementations get it wrong. Telegram has no equivalent: the Bot API cannot read history, so Telegram context is limited to conversations the bot itself processed.

The change to be careful about is admission. Shared-conversation access is now presence-based — any Slack channel or Telegram group the bot has been added to is served, with no allowlist and nothing to configure. Four settings were removed outright: slack_allowed_channels, telegram_allowed_channels, slack_shared_subject_user_id and slack_subject_routes. The upside is real — adding the bot to a channel just works, and the class of "why isn't it responding" support questions caused by a forgotten allowlist entry disappears. The cost is equally real: the only remaining scoping control is channel membership. If your bot is a member of channels you never allowlisted, it now answers in them.

Shared conversations are now genuinely shared, and each run still acts as its invoker. A Slack thread — each top-level ping roots its own — or a Telegram group/topic is one continuous conversation that every paired participant shares, while each message runs as the person who sent it. Those two properties together are the interesting bit: shared context, individual authority. Shared channels are no longer offered as per-user notification delivery targets, which follows directly. An unpaired user who pings the bot in a shared conversation now gets the connect notice as a reply anchored on their own message rather than nothing or a DM they may not see. A new can_reply_in_threads presentation flag declares each channel's reply placement — Slack (true) replies in a thread, Telegram (false) replies as an anchored quote — and every parked gate is now announced on both delivery lanes, keyed by gate ref, so a run parking on multiple approval or auth gates announces each one instead of silently waiting on some.

The RC-train fixes carried into stable are the ones we detailed yesterday: rc.3's container image that shipped no curl, so orchestrator healthchecks could never run and deploys timed out into error while the listener served 200s throughout; rc.3's shared test inventory between PR test planning and the root-partition runner, which had disagreed on partition assignment such that a scheduled root test could be reported green without having run; and rc.2's Windows work — native atomic rename instead of hard links for first-start filesystem publication, and release smoke runs preserving the Windows account identity needed to secure the standalone secrets key.

Releases → Affects: /ironclaw/, /ironclaw/configuration/, /ironclaw/security/, /ironclaw/setup/, /ironclaw/skill-allowlisting/, /security/

File references in agent responses are now clickable, and the implementation is more careful than it needed to be: inline code spans are validated against the filesystem, so spans matching real files in the workspace become links that open the file at the referenced line, while non-existent paths stay plain code. There's a fallback workspace search and a "File not found" warning when a dead link is clicked. Validating before linking is the right call — a UI that turns every code-shaped string into a link teaches you to distrust the links.

A tool was removed: the built-in experimental Morph WarpGrep codebase search is gone, and its retired configuration flag is now ignored rather than erroring. If you had it enabled, expect search to fall back to the standard path. Alongside that, Agent Manager gained PR comment actions — resolve/unresolve review threads, jump to the comments section, and scroll-to-top in the PR diff view.

The patch changes include one fix worth calling out. Subagent permission errors that referenced phantom deny rules — and blocked commands the subagent's own config explicitly allowed — are fixed. An error citing a rule that doesn't exist is a bad failure mode, because the obvious debugging step (go find that rule) leads nowhere. Also landed: structured AWS access keys and Google Cloud service-account JSON are now accepted when connecting Bedrock and Vertex AI in VS Code, the model's default reasoning variant is shown and selectable in chat and Agent Manager, the Changes chip and Git changes stay visible across tab switches in multi-repository workspaces, and workspace restoration outcomes are preserved when reverting fresh VS Code sessions. The release also folds in upstream opencode v1.17.13 → v1.18.13 across MCP tools, model support, reasoning and the TUI.

Release notes → Affects: /kilocode/, /kilocode/setup/, /kilocode/models/, /kilocode/orchestrator/, /kilocode/security/

This is a tag, not a story — but it's a big tag. v0.20.1 exists to roll up everything merged since v0.20.0 "Herald" on August 3 into a stable release that downstream consumers can pin: Docker images, hosted deployments, and anyone installing from the latest tag. The window covers 1,444 commits across roughly 656 merged PRs, touching 2,172 files (+233,872 / −75,244) and closing about 481 issues, spanning the desktop app, gateway platforms, installers, the tool system and provider catalogs.

The release deliberately ships no curated notes. Nous states that full notes for this entire window — highlights, feature areas, contributor credits, everything from v0.20.0 onward — will ship with v0.21.0, and that nothing in the window is skipped. We're taking that at face value rather than reverse-engineering 656 PRs into a summary that would be wrong in ways neither of us could check. What that means practically: upgrade with hermes update if you want the accumulated fixes, but expect to learn what changed later. The Node 26 requirement from v0.20.0 still applies, and it remains the upgrade to plan rather than fire off. We'll cover the substance when v0.21.0's notes land.

Full diff → Affects: /hermes/, /hermes/setup/, /hermes/vps-install/

A third speed tier, announced but not generally available. OpenAI announced Ultrafast mode, an API service tier for GPT-5.6 Sol that runs up to 14× faster than Standard processing, in limited preview to select customers with a signup form for updates. Note the ladder this creates: Standard, then Fast mode — which on August 5 gained long-context support past 272K tokens at up to 2.5× Standard — and now Ultrafast at up to 14×. No pricing was published, which is the number that decides whether this is interesting, so treat the multiplier as a headline and not a plan. It matters most for agent loops where latency compounds across many small turns rather than for single long generations.

Changelog → Affects: /chatgpt/, /chatgpt/pricing/, /chatgpt/api-vs-chat/

A GPU sandbox could report Ready with its agent not running. Native Docker GPU onboarding could mark a Hermes sandbox Ready after the create process had already ended the selected startup command — so the status was true about the container and false about the thing you wanted in it. Native non-terminal startup commands now use the existing restart-safe post-create cutover, while terminal agents stay on the create lifecycle (#9147). A companion fix addresses the same class from the other end: OpenShell can report a non-terminal Docker sandbox Ready before the agent startup process produces any output, which left a native Hermes sandbox sitting at sleep infinity. Unmanaged creates now wait for the startup message before stopping the host create client (#9117).

Hermes MCP port discovery stopped reading the gateway's process environment — because it was never allowed to. OpenShell denies the Hermes sandbox user access to the gateway process environment, so managed MCP mutations could not recover the allocated API port at all. The transaction helper now resolves that port from the service manager's exact socat API relay, accepting only one same-owner relay with the expected parent, executable, listen range and internal API target, and revalidating ownership, parentage, arguments and start identities before use (#9122). The distinction it draws is the right one: missing or changing topology is treated as transient, while malformed, unreadable or ambiguous topology fails closed. A follow-up fixed concurrent mutations rejecting a valid operation when relay discovery read a short-lived unrelated service-manager child — it now checks each child's process name before inspecting its command line (#9148).

Two Hermes image fixes with a shared root. The Hindsight lazy installer runs as the sandbox user and installs into /sandbox/.hermes/lazy-packages, but the uv-created virtual environment shipped without pip, so the installer tried to create it in the read-only root environment and failed. The image now seeds pip from Python's bundled ensurepip payload during the root build layer with no network request, and the build fails unless the virtual-environment tree and its exact link targets stay root-owned and non-writable (#9094). The follow-up added the certifi certificate-bundle link to the approved inventory so validation stops rejecting it, and corrected five sandbox write probes that were passing a malformed format string — they had been testing shell parsing rather than filesystem permissions (#9097). A permission check that silently tests the wrong thing is worse than no check, and it is the kind of bug only a contract test catches.

Onboarding got two fixes and a documentation catch-up. Dashboard-forward startup now gives OpenShell's exact sandbox is not ready handoff up to one minute (12 retries at 5 seconds) instead of the ordinary three-retry allowance, which multiple onboarding lanes were exhausting while the sandbox was still transitioning; authentication, ownership, port-conflict and ordinary listener failures keep their existing behavior (#9089). Portable onboarding resume now reconstructs its rootless Podman authority from a versioned checkpoint rather than inheriting process-local runtime selectors, requalifying the socket and configuration under the onboarding lock and failing closed on legacy, tampered, unsafe or drifting authority — note the release marks this PARTIAL PASS, blocked downstream, so it is landed but not fully proven end to end (#9074). Separately, the operational guides were aligned with behavior merged after v0.0.108: incomplete onboarding exits with status 1 and preserves a resumable session at the last checkpoint, and the deprecated global stop command's gateway cleanup and explicit port scoping are now documented (#9102).

And one feature landed dormant. A consolidated Podman GPU and host-local inference batch gives Ollama, NVIDIA NIM and vLLM shared operation authority, secret-free lifecycle receipts, and provider-neutral inference.local startup integration for OpenClaw, Hermes and LangChain Deep Agents Code — all three agents routed through the same https://inference.local/v1 contract (#8061). The command translator rejects Docker-named helper execution, raw mounts, host IPC, --rm, ambiguous GPU requests, mutable images and secret-bearing argv. Read the last line of the summary before you go looking for it: Podman remains absent from production registration and support claims. This is groundwork, not a shipped path — but it is the clearest signal yet that a non-Docker local-inference runtime is coming.

Commits → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/local-gpu/, /hermes/, /troubleshooting/