OpenClaw Prepares the 2026.10.7 Patch as a New Fix Stops Trusted-Proxy Gateways From Writing Unrequested Passwords
A release branch for 2026.10.7 now carries config, backup and Linux pairing repairs, including a fix for restores that turned exec approvals into deny-all. Plus: main stops trusted-proxy Gateways from minting a local login on first browser use, narrow-only subagent profiles, DeepSeek V4.1 Flash 1017 and what Skill Workshop's background review costs.
OpenClaw Starts Preparing the 2026.10.7 Patch One Day After 10.6
The next patch is already on a branch. A commit titled "chore(release): prepare 2026.10.7" landed on the project's release/2026.10.7 branch at 4:48 PM Pacific on Thursday, and the draft 2026.10.7 changelog on the release branch already lists 32 pull requests on top of 2026.10.6. There is no 2026.10.7 tag or GitHub release yet, and as of this morning npm's latest tag still points at 2026.10.6, so treat everything below as a preview, not a shipped build.
Some draft highlights repeat work already in 10.6; the new items are durability fixes. In the draft, config observation keeps the last-known-good snapshot when openclaw.json looks truncated (#152565), so a half-written file can no longer replace the healthy recovery copy. Memory Wiki re-imports of OKF bundles keep a marked block of human-written notes instead of silently deleting it (#175707). And a Gateway whose temporary log directory was removed by a cleanup job no longer locks up at full CPU at the daily log rollover and ignores shutdown signals (#160433).
The branch kept moving overnight. At 12:48 AM Pacific on Friday, RomneyDa merged pull request #181465 backporting backup, Linux, database and macOS repairs to 2026.10.7. It adds a backup fix for exec-approval rules, Linux companion storage so saved Gateway dashboards stop asking for pairing approval after every restart (#158908), and a macOS fix from @shanselman (#181389) that shows the real Gateway version and keeps Update/Repair visible during unfinished recovery. They landed after the draft changelog's audited range.
A second patch within days is the release train working as intended, not a sign that 10.6 is broken. The Node floor in 10.6 is the urgent part. If you have not rolled it out yet, do not wait for 10.7. If you have, plan a quieter follow-up for the config and backup fixes once the tag is actually published.
Backups Were Restoring Exec Approvals as Deny-All
The backup fix deserves its own section because the failure was silent. According to pull request #164297 keeping older exec approval policies in backup snapshots, merged to main at 10:09 PM Pacific on Thursday, restoring a backup that still held an older but supported exec approval policy replaced it with a deny-all policy and dropped its allowlist. The archive reported success with no warnings.
Deny-all fails closed, so nothing dangerous was allowed, but agents that used to run approved commands would start refusing them. After the fix, a restore returns the saved rules with the same conversion Doctor would apply. The same fix is in the pull request #181466 backporting backup, Linux and macOS repairs to extended-stable 2026.9.33, and a separate pull request #181341 patching extended-stable dependency advisories updates flagged production dependencies on that line. Neither change has shipped in a tagged extended-stable build yet.
If you restored a backup in the last few weeks and agents have been refusing commands they used to run, check your exec approval policy before you start editing prompts. Restore drills should compare the policy that comes back, because a green restore can still hand you different security rules.
Main Stops Trusted-Proxy Gateways From Writing an Unrequested Password
The most security-relevant change of the day landed on main at 6:06 AM Pacific on Friday. Pull request #181620 fixing first browser use on trusted-proxy Gateways describes what happened before: on a Gateway that uses trusted-proxy auth, the first browser request wrote a randomly generated gateway.auth.password into the config file. That config change forced a Gateway restart in the middle of active work, and the generated password stayed behind as a working local-direct Gateway login the operator had never set up.
The author, fuller-stack-dev, reproduced it on stable [email protected], where the generated password then logged in over a direct local connection. With the fix, config stays byte-identical, no restart happens, and listeners that need a credential get one that lives only in the Gateway process. One behavior changes for operators: under trusted-proxy auth, an outside process that calls the opt-in standalone loopback browser API directly now needs an explicit gateway.auth.password.
Trusted-proxy setups are usually chosen so that identity lives at the proxy, which makes a silently created local password exactly the sort of credential nobody inventories. The fix is on main only, so current stable installs still behave the old way. Check your config files now.
Plugins Get Narrow-Only Subagent Profiles
Pull request #181292 enforcing narrow-only native subagent profiles, merged at 9:36 PM Pacific on Thursday, starts from a simple problem: telling a child agent "do not edit" does not remove its write tools. Plugins can now register package-owned subagent profiles that only ever narrow the tools a child inherits from its requester. Profiles cannot grant model, credential or sandbox overrides. Tool hooks cannot forge or remove a profile, and undeclared plugins are unchanged. Separately, pull request #181363 keeping continuation authority after restart recovery stops recovery-relaunched subagents from failing with "Restart recovery operator run is no longer active."
DeepSeek V4.1 Flash 1017 Reaches OpenClaw Through the Existing Flash Model
On Thursday at 4:36 PM Pacific, the project posted in its official OpenClaw announcement on X that DeepSeek V4.1 Flash is available. No OpenClaw release is involved. The DeepSeek-V4.1-Flash-1017 release note from DeepSeek, dated October 17, promises stronger benchmarks, faster task completion and shorter outputs, and DeepSeek's API docs say the deepseek-flash model name is now served by V4.1-Flash-1017 with the calling method unchanged.
On the OpenClaw side, the OpenClaw DeepSeek provider documentation lists deepseek/deepseek-flash as DeepSeek V4.1 Flash with text and image input, a 1,000,000-token context window and 384,000 output tokens. Legacy deepseek-v4-flash names are still accepted and routed to V4.1 Flash at Flash rates. openclaw models set deepseek/deepseek-flash switches an agent over. DeepSeek's note also says Search and Fetch calls made through server-side tools in DeepSeek Harness, Claude Code and Codex are free for now, with billing starting October 31 at 9:00 AM Pacific. OpenClaw is not on that list.
Also on the calendar: the official OpenClaw post announcing its Open Source Friday appearance says @hrudolph joins @crazy4pi314 today, October 23, at 10 AM Pacific for a live OpenClaw demo and community Q&A on GitHub's Open Source Friday stream on Twitch.
Security Practice: Look for a gateway.auth.password You Never Set
Trusted-proxy Gateways on 2026.10.6 may already hold a generated local login
The OpenClaw trusted-proxy authentication guide says internal callers that bypass the proxy may authenticate with gateway.auth.password, and asks you to firewall the Gateway port when that password exists. The OpenClaw browser control security page, updated with the fix, confirms that under trusted-proxy auth this password "is also a local Gateway login."
- If you run
gateway.auth.mode: "trusted-proxy"and have used the browser tool, open your config and look for agateway.auth.passwordthat nobody on your team configured. - Until the fix reaches a release, remember that stable builds still contain the code path that wrote it, and keep the Gateway port reachable only from the proxy and localhost.
- If something outside the Gateway calls the standalone loopback browser API directly, set an explicit password or SecretRef you control. After the fix, that is the only supported way.
Skill Card: Skill Workshop's Background Review, and What It Costs
Self-learning is on by default, and it spends tokens after your chat looks finished
Users on X this week traced agents that kept processing after a finished reply to Skill Workshop. The OpenClaw self-learning documentation confirms the mechanism: learning is on by default with skills.workshop.autonomous.mode: "auto". After 10 model iterations in a session, a background review is queued and usually starts after 30 seconds of quiet. It reuses the foreground provider, model and auth profile, targets a 16,384-token context and caps output at 2,048 tokens. The docs warn these "are not a hard total-token limit."
The Skill Workshop configuration reference lists only two modes. openclaw config set skills.workshop.autonomous.mode off disables both the background review and the 30-day unused-skill cleanup, while /learn and Learn from history keep working on request.
For a personal agent, automatic learning is worth a small token overhead. For a team paying per token on a premium model, the review runs on that same model, so it is a real cost line. Measure it for a week in usage reports, then choose: leave it on, switch it off and use /learn deliberately, or move busy agents to a cheaper default model.
Running OpenClaw behind a trusted proxy?
SEN-X helps teams audit Gateway credentials, rehearse backup restores against their exec approval policies, stage patch releases and keep agent token budgets in check.
Contact SEN-X →