Changelog — August 18, 2026

The three security fixes here share a theme: a protective mechanism was working, and was showing the wrong thing to the wrong person. First, MCP diagnostics were printing resolved secrets — scope-conflict warnings now show the configured ${VAR} form instead of its expanded value, and connection-failure details now show only the server origin. Diagnostics are exactly where secrets end up pasted into an issue tracker, so this is worth more than its one-line changelog entry suggests. Second, and sharper: credential masking on relayed permission previews could hide commands, paths, or destinations from the approver. That is a masking feature defeating the point of the approval it was decorating — you were being asked to approve an action whose destination the redactor had blanked out. Oversized private-key blocks now redact under full-strength redaction, and provider API tokens mask even when directly followed by shell delimiters.

Third, the marketplace allowlist was checking a host that git would not actually connect to. strictKnownMarketplaces accepted SCP-style git sources (host:path form) whose host differs from the one git resolves — the same class of bug as last week's permission bypasses, where the check reads one thing and the runtime does another. Alongside it, permission previews now relay only to channel servers admitted by the inbound trust gate, and a server's explicit permission-capability opt-out is honored.

The Windows NT-namespace hardening got wider. Remote file reads, session restore, CLAUDE.md includes, workflow scripts and file uploads now reject NT-namespace (\??\) paths, which the release notes describe as covering the remaining pre-approval file accesses against the NTLM credential-leak vector. v2.1.232 closed the first door on this and v2.1.233 closed another; this closes the set. If you run Claude Code on Windows, this is the line in the window that matters most to you.

The feature people will notice first is that sessions resume themselves. Claude Code now continues your session automatically when a claude.ai usage limit resets, with an opt-out in /config ("Continue automatically at usage limit"). That is a real change in what an unattended run means — a session that stopped at a limit overnight will pick itself back up rather than waiting for you — so if you have long-running or scheduled work, decide deliberately whether you want that on. Related: Claude is now instructed to use your account email only to identify you, and not to send it to unrelated services unless you ask.

GitLab support advanced again. A merge request badge now appears in the footer and statusline: repos with a GitLab remote and an authenticated glab CLI show MR !N with draft/pending/green states, matching what GitHub repos already showed. Combined with v2.1.233's MR support in --worktree and the claude agents view, GitLab has gone from unsupported to roughly at parity across two releases.

One quiet line is a genuine cost lever. The built-in claude-api skill's context cost dropped from over 200,000 tokens to roughly 25,000 by loading its reference docs on demand. If you use that skill, that is an eight-fold reduction in what it costs you to have it available — and it is a useful pattern to copy in your own skills: a large reference bundle that loads only when a specific question needs it, rather than sitting in context on the chance it might.

Dialogs are no longer blocked by the turn. /permissions can now be opened while Claude is working, and rule changes apply to the rest of the current turn. /add-dir <path> works mid-work too, and /add-dir, /autocompact, /theme, /help, /config and /advisor all open mid-turn in the fullscreen TUI. /goal got two fixes worth naming: it clears itself with a notice when a turn dies on an unrecoverable error (revoked auth, exhausted credit balance, context overflow) instead of staying silently armed, and when background tasks keep a goal waiting 30+ minutes it now checks in on them rather than waiting indefinitely (CLAUDE_CODE_GOAL_CHECKIN_MINUTES=0 opts out).

Two restart bugs were losing your flags. Accepting the "Try the new fullscreen renderer?" prompt restarted the session without its permission mode, tool allow/deny rules, model or effort flags — and losing deny rules on a restart is the direction that matters. /tui had the same shape, dropping launch --allowed-tools/--disallowed-tools rules; it now declines to switch, with the reason, when the session has restrictions a restart cannot carry over. Also fixed: session-scoped permission answers, including denies, were dropped when answering background subagent permission prompts, an IDE diff tab closing during a permission re-prompt could answer the new prompt with the previous input, and trust prompts omitted the repository-wide scope warning when the directory was first seen before the repository existed there.

Everything else, briefly. Auto mode in very long sessions stopped repeatedly re-checking and denying sandboxed commands' network access after compaction. A crash on the non-streaming fallback path (typically third-party gateways) when a thinking or text block arrived missing its field. Markdown rendering that went extremely slow on unusual Unicode sequences. SendMessage rejecting a recipient copied from ListAgents when the session name is at the 200-character cap or emoji-heavy, and both tools now say when your account's session list was too long to check completely instead of treating unseen sessions as absent. Repository detection mis-reading the host of git remotes with unusual userinfo. Your own prompts now render markdown in the transcript. Auto-generated session titles now read as short names ("Login button bug") rather than restated sentences. New: the optional CLAUDE_CODE_PROJECT_DIR_NAME environment variable for hosts that give each session its own config directory, and a selection:clear keybinding action. Removed: the "Allowed by auto mode classifier" line under every Agent tool call, and the "Default teammate model" setting — agent-team teammates now use the leader's model unless the spawn names one.

Full changelog → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/security/, /openclaw/cost-optimisation/, /claude-cowork/, /security/

The reverts are covered in the correction above; here is what else this release did about permissions. It closed a Windows NT \??\ device-prefix path that bypassed UNC path validation, an NTLM credential-leak vector — the same family v2.1.234 then extended. And it fixed skill and command argument substitution so argument values are no longer re-expanded as template markers. That one is quiet but real: if an argument value could contain template syntax that got expanded on a second pass, a caller who controls an argument controls more than an argument. Anyone writing skills that take user-supplied input should read that as a template-injection fix, not a formatting nicety.

One change will alter how sessions behave and it is easy to miss. Todo and task-tracking tools — TaskCreate, TaskGet, TaskUpdate, TaskList and TodoWrite — are no longer available on Opus 4.8, Sonnet 5, Fable 5, Mythos 5 and newer models. Set CLAUDE_CODE_ENABLE_TODO_TOOLS=1 to bring them back. If you have skills, prompts or automation that assume a todo list exists, they will now be quietly working without one on current models. (Note in passing: "Mythos 5" appears in this list and is not a model we currently track on our cost calculator. We have no pricing or context figures for it and are not going to invent any — we are flagging the name and will add it when there is a published source.)

Two additions are aimed at people running Claude Code inside something else. An opt-in forward_user_identity apps gateway setting on Anthropic upstreams sends the signed-in user's identity as headers, so a proxy behind the gateway can attribute spend per user — the missing piece for anyone who has tried to bill an internal team through a shared gateway. And opt-in memory cgroup support for Bash tool commands on Linux (CLAUDE_CODE_TOOL_MEMORY_LIMIT) means a runaway build can no longer stall the session. Also new: CLAUDE_CODE_WEBFETCH_CACHE_TTL_MS to tune the WebFetch session URL cache (default unchanged at 15 minutes).

The fixes lean toward long-running and hosted sessions. Cloud sessions were occasionally marked as lost when the environment shut down while Claude was waiting on a permission prompt. MCP v2 connections endlessly reopened the subscriptions/listen stream against servers that terminate long-held streams on a fixed timeout — serverless hosts, mostly. Notification hooks were not firing for permission prompts under Claude Desktop or VS Code, which is the exact situation where you most need the notification. Idle sessions on Linux sometimes held a CPU core at 100% with sandboxing enabled. And bundled skill aliases like /checkup and /review reported "Unknown command" in -p mode, or with plugins/MCP loaded, when a user or project skill shadowed the bundled skill.

Smaller items. claude self-hosted-runner starts faster — the session branch is created without rewriting the working tree, and two server round trips no longer block launch. Apps gateway 400/413 errors from Vertex, Foundry and Claude Platform on AWS now carry the upstream's own message, which also fixes an auto-compact bug on the gateway. claude plugin validate now checks a bare .claude/skills directory and reports SKILL.md files whose frontmatter fails to parse. Print mode writes a [claude-code:unrecognized_model] line to stderr when a request goes out for an unrecognized model ID — map it with modelOverrides to silence. Screen reader mode got a numbered-list /effort selector and unclipped hint text. And the GitHub app setup tip no longer appears in repositories whose origin is on gitlab.com or bitbucket.org.

Full changelog → Affects: /openclaw/, /openclaw/setup/, /openclaw/skills-guide/, /openclaw/configuration/, /openclaw/security/, /claude-cowork/, /security/

Start with the health endpoint, because it is the one with a blast radius outside your machine. The Bedrock and OpenRouter runtime adapters bind 0.0.0.0 so the sandbox can reach the completions route — but their GET /health handlers answered before any authentication. Any peer that could route to the host port, meaning another local user or a host on the LAN, could read the adapter's endpoint URL, region, upstream config hash, and credential hash. Both routes now answer only loopback peers and return 404 otherwise (#9428). The implementation detail worth borrowing: the new isLoopbackRemoteAddress() helper normalizes the IPv4-mapped IPv6 form (::ffff:127.0.0.1) that dual-stack listeners report before matching — a loopback check that skips that step passes in testing and fails in production. If you run NemoClaw on a shared or office network, this is today's upgrade reason.

The second fix is a textbook namespace collision with a security outcome. isCredentialAvailable() matched an unqualified messaging input id — and input ids repeat across channels: botToken is the secret input of Telegram, Discord, Slack and WeChat alike. So one channel's token marked another channel's secret available. Concretely: an onboard run with Telegram and WeChat selected and only TELEGRAM_BOT_TOKEN present planned WeChat as active: true, configured: true and skipped the wechat.ilinkLogin host-QR pairing hook — with no WeChat token in existence. Availability keys are now channel-qualified input ids and environment keys only, so WeChat stays inactive and its pairing hook runs (#9430). Note the fix is a net deletion — eight lines removed against three added — which is usually the sign of a bug that was structural rather than incidental.

Third: a restore that failed and said it succeeded. buildStateFileRestoreCommand joins its copy-strategy steps with ;, so the script NemoClaw runs over SSH reports only the exit status of its last step — and on the OpenClaw config path that last step is chmod 660 "$hash_file" 2>/dev/null || true, which always succeeds. A failed config swap or a failed .config-hash write therefore reported a restored file: restoreStateFile returned true, restoreSandboxState reported success, and nemoclaw rebuild printed a restored-state count while openclaw.json kept its previous contents. The script now starts with set -e (#9420). The commit explicitly records why && is not a substitute — && and || have equal precedence and associate left to right, so an earlier failure would fall into the next step's || { …; exit N; } guard and report an unrelated exit code. If you have run a rebuild recently and something looked untouched afterward, this is the explanation.

Installer and onboarding fixes. The installer's reserved-port guard listed every reserved inference and runtime-adapter default except the HTTPS Pin Runtime adapter's 11438, so setting NEMOCLAW_GATEWAY_PORT=11438 was accepted, host state was written under ~/.nemoclaw/gateways/11438, onboarding continued — and then every nemoclaw command failed at module load. It is now rejected before host state is written (#9415). Also landed: "back" is honored at the NVIDIA API key prompt (#9427), the Hermes GPU proof is bound to its replacement during onboarding (#9450), recovery waits after a legacy container handoff (#9423), portable onboarding waits for a settled Podman stop (#9441), sandbox status reports an unregistered sandbox correctly (#9426), the CLI reports Linux CPU models when Node cannot (#9443), and the agent build now supplies the corporate CA build argument to the Pi base image — the fix that matters if you build behind a corporate TLS-inspecting proxy.

Version note: the dated changelog in the NemoClaw repo now heads at v0.0.110 (2026-08-17), up from the v0.0.106 we had recorded. We have bumped our tracked version accordingly. NemoClaw ships from a commit feed with no version tags, so this number comes from the repo's own changelog files rather than a release tag.

Commits → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/local-gpu/, /security/, /troubleshooting/

Hermes tagged three stable releases in three days and wrote curated notes for none of them. Each tag exists to give downstream consumers — Docker images, hosted deployments, fresh installs — something stable to pin. Together the three windows cover roughly 1,363 commits across about 596 merged PRs: v0.20.2 was the largest at ~967 commits / ~397 PRs / +128,522 lines, v0.20.3 ~250 commits / ~125 PRs, and v0.20.4 ~146 commits / ~74 PRs. Nous repeats on all three that full curated notes for everything from v0.20.0 onward will ship with v0.21.0 and that nothing in the window is skipped. This is now four consecutive tags deferring their notes, dating back to v0.20.1 on August 13. We are still taking that at face value rather than reverse-engineering 596 PRs into a summary neither of us could check — but the deferral has stopped being a one-off.

The one-line "About this release" blurbs do name feature areas, and three of them are worth knowing about now. v0.20.3 landed the MCP 2.x SDK migration with 2026-07-28 stateless protocol support — a protocol-level move that anyone running custom MCP servers against Hermes should be aware of before upgrading — plus a bundled Bot Mode (hermes-bots) plugin carrying the core teammate protocol, and subprocess Python runtime ownership hardening via PYTHONHOME/PYTHONPATH isolation. v0.20.4 added NVIDIA SkillEvaluator Tier 1 advisory scanning on skill installs, running license and security checks at install time — the same direction as Kilo Code's and Claude Code's plugin-scanning work, and a meaningful change to what installing a third-party skill does. v0.20.3 also ported plugin install security scanning from its ecosystem scout slate.

The rest, as named by the blurbs. Desktop: multi-gateway Connections registry, profile-scoped refreshes, MCP health checks and deep links, remote-gateway headers and connection self-healing, and a glass/translucency surface pass (matte glass, frost picker, macOS pre-select) with a tabbed SESSIONS|BOTS sidebar and per-bot hide/unhide. Reliability: cron scheduler self-heal (EMFILE recovery, stale-claim reconciliation, wedged-job re-arm), cron media-send hardening with configurable timeout and missed-fire surfacing, SessionDB event-loop-thread and contention fixes, and session handoff data-loss fixes. Bot Mode group chat got long-running member turns, Markdown rendering and cross-machine routing fixes. Also: Cua Driver 0.20 runtime contracts for computer use, a CommandCode provider plugin, prompt caching for LiteLLM Claude on the OpenAI wire, hermes update parked-branch honesty, kanban worktree/dispatch fixes and native OS notifications, and ported /worktree, /rollback hand-edit preservation, UTF-16 file reads and Gemini 3 tool-call ID preservation.

Our advice is unchanged from last week: hermes update if you want the accumulated fixes and can tolerate learning what changed later; the Node 26 requirement from v0.20.0 still applies. With MCP 2.x and skill-install scanning now in the pile, test a non-production instance first if you depend on custom MCP servers or on skills installing without an advisory gate.

Full diff → Affects: /hermes/, /hermes/setup/, /hermes/vps-install/, /hermes/mcp-tools/, /hermes/skills-guide/, /hermes/tasks/

IronClaw tagged 1.3.0-rc.1 four days after 1.2.0 went stable, and the release body contains nothing but install instructions and a download table. There is no changelog section, no summary, and no list of what changed since 1.2.0. We are reporting the tag because a 1.3.0 line opening this soon after 1.2.0 is itself information — but we have nothing substantive to tell you about it, and we would rather say that than pad the entry with the binary-download table.

What this means for you right now: nothing, unless you deliberately install release candidates. 1.2.0 remains the current stable release and remains what our guides target. Our version data records the rc separately from the stable version, so nothing on the site will start pointing at a release candidate. When 1.3.0 notes appear — either on the rc train, as they did for the 1.2.0 RCs, or at stable — we will cover the substance then. The item from 1.2.0 that still needs your attention is the removal of slack_allowed_channels and telegram_allowed_channels, which made shared-channel admission presence-based.

Releases → Affects: /ironclaw/, /ironclaw/setup/, /ironclaw/configuration/, /ironclaw/security/