OpenClaw 2026.10.10 Ships Stable With Chat Details and an Opt-In Advisor as Main Unsticks Updates Off the New Release
OpenClaw 2026.10.10 is tagged, on npm as latest and announced, bringing Chat Details, an experimental Advisor, split speech for browser Talk, remote folders and MCP Relay. Hours later, main fixed updates off 2026.10.10 that stopped on a locked database. Also: a 2026.11.5 beta train, MCP tools for tools.invoke, safer Git backups and the healthcheck skill.
2026.10.10 Is Finally Stable, Five Betas and Nearly Three Weeks After the First
The release we've been tracking since mid-October has shipped. The OpenClaw 2026.10.10 release on GitHub is marked stable, not a prerelease, and the signed v2026.10.10 tag was created by maintainer Dallin Romney at 5:32 PM Pacific on Monday, November 2. It points at release commit 7dc3350. The package went to npm next. The npm registry metadata for the openclaw package records version 2026.10.10 at 6:26 PM Pacific, and both the latest and beta tags now point to it. extended-stable stays on 2026.9.36. The GitHub release page itself went public at 7:22 PM Pacific.
The project announced it on X the next morning. The official @openclaw announcement of v2026.10.10 went out at 5:02 AM Pacific on Tuesday and was last edited at 5:12 AM. It leads with three things: Chat Details beside wide chats, an Advisor that suggests course corrections, and split speech for browser Talk. It also cites 3,028 source PRs from 454 contributors. The GitHub release counts 4,825 commits in total, while the OpenClaw v2026.10.10 release notes on docs.openclaw.ai give 1,064 direct commits. The docs page returned 200 when we checked this morning. The release's verification section notes that the Android APK was skipped, because the app's version file still reads 2026.8.2.
That ends a long wait. Beta.1 reached npm on October 15, beta.5 on October 29, and our recent runs saw the release branch swap out its first stable candidate and keep taking fixes through the weekend. The notes are huge. The plain-Markdown 2026.10.10 changelog for agents and tools runs to roughly 800 KB, so no summary will cover it all.
For most teams this is the upgrade to plan this week, but not necessarily today. A release built from more than three thousand pull requests will have rough edges, and the first one has already turned up (below). If you're on 2026.10.9, give it a few days, then upgrade one Gateway first, with a fresh backup. If you're on extended-stable 2026.9.36, nothing has changed for you yet. Android users shouldn't expect a matching app build from this release.
What Ships: Details, Advisor, Split Talk and Remote Folders
The release notes open with the Chat Details panel. It gathers session information and task progress into one place and moves the old progress and pull-request bars out of the space above the message box. On wide chat panes, Details opens beside the conversation without covering it. If it opened automatically, it hides again as the pane narrows, and the Details button toggles it by hand.
Advisor is the feature to read most carefully. According to the notes, it "can check an agent's ongoing work and suggest a correction if it finds a clear wrong turn, such as repeating an unsuccessful approach or drifting from your request." It's experimental and off by default. You turn it on in Settings, System, Labs, and set its review intervals in Configure. The notes are frank about its limits. It "uses extra model calls when it reviews a task and can miss a problem or suggest an unnecessary change," and its advice "does not run tools, approve actions or guarantee that the agent's work is correct."
Split speech is a new browser Talk mode. It sends spoken requests to the same model that answers your typed messages, and uses separately configured services for transcription and speech output. You need to configure both before using it and allow microphone access in a secure browser context. It has no realtime voice switching or camera input, and leaving it unset keeps the existing realtime Talk.
Three more headline items widen what a Gateway can reach. An agent can now work directly in a folder on another paired computer, controlled by that machine's nodeHost.workerRuns.folders setting, where an empty list turns the feature off. An optional MCP Relay plugin, off by default, lets ChatGPT or Claude connect to OpenClaw conversations without an internet-facing Gateway port. The notes warn that "the relay can read content passing through it" and that full role access can include administration and approvals. Event-triggered automations can start when a connected MCP server reports a supported event. They need a public HTTPS callback, and the notes say to forward only /plugins/mcp-events/callback/ to the Gateway. Under installation fixes, supported Node versions are accepted again, with warnings for versions missing required security patches.
Advisor is a cost decision as much as a quality one. Every review is another model call, so try it on one agent and one kind of long task, and compare your token spend before and after. Treat MCP Relay, remote folders and event callbacks as new doors into the Gateway. Leave each one off until someone owns it, scope remote folders to named roots, and give relay apps the narrowest role that works. Full role access through a third-party relay is close to handing over the admin console.
The First Post-Release Fix: Updates From 2026.10.10 Hit a Locked Database
Hours after the tag, maintainers found a problem with updating off the new release. Issue #191728, on updates from 2026.10.10 failing with "database is locked", was opened at 10:51 PM Pacific on Monday. It reports that updating from [email protected] to a build of current main stopped at the update-candidate step with runtime-verification-failed, after Doctor's legacy exec approvals migration hit "database is locked" and blocked the mcp-oauth, workspace-state, web-push and node-host migrations behind it. The same test lane passed from 2026.10.9.
Pull request #191825, which lets updates from 2026.10.10 finish the exec approvals migration, merged at 3:20 AM Pacific on Tuesday. The PR traces the lock to Doctor's own process: warm shared-state worker connections left open by plugin Doctor detection blocked the exclusive lock the migration needed. The fix drains them first. The PR says the bug affects profiles that still have a legacy exec-approvals.json, and that the fix is "candidate-side only": it changes the Doctor that the installed updater hands off to, so 2026.10.10's own updater doesn't need patching. With the fix, the 2026.10.10-to-candidate upgrade lane passed all 49 phases.
This doesn't block installing 2026.10.10. It affects leaving it, and it's already fixed on main. Still, it's a good reason to keep a rollback path. If you upgrade, don't delete old state files by hand to tidy up, and test the next update on a staging Gateway before rolling it to production. If an update stops at update-candidate with a locked-database message, check that the target build includes #191825 before retrying or forcing a repair.
Release Trains Shift: 2026.11.1 Rebases and 2026.11.5 Takes Shape
The branch picture changed overnight too. As of our Monday check, the release/2026.11.1 branch carried a 2026.11.1-beta.1 version stamp. This morning its package version reads 2026.10.10, and the GitHub compare API shows it exactly two commits ahead of the v2026.10.10 tag. One is a cherry-picked commit defining ledger-first hotfix routing for releases, landed at 6:53 PM Pacific on Monday. The other is a backport of retrospective release repairs through batch 9, landed at 10:17 PM. Both are release tooling, and neither says what the branch is for now.
A newer train has appeared. The release/2026.11.5 branch is stamped 2026.11.5-beta.1, and between 3:35 PM and 11:08 PM Pacific on Monday it took a run of seal, verify and repair commits, ending with a "seal 2026.11.5 beta candidate" commit on the release branch. On main, pull request #191904, a cron test fix it calls a release blocker for 2026.11.5-beta.1, merged at 5:08 AM Pacific. It's a test-only change with no user-visible effect. No v2026.11.* tag exists yet, and npm lists no 2026.11 version.
Main Opens MCP Tools to Gateway Callers and Tightens Browser Redirects
GitHub counts 457 pull requests merged on main since our last check. Two stand out, one that widens access and one that narrows it. Pull request #187699, which lets tools.invoke run configured MCP tools, merged at 6:03 AM Pacific. Before, configured MCP tools showed up in tools.effective, but tools.invoke and HTTP /tools/invoke returned not_found for them. Now plugins and operator clients can call them by server__tool name. The PR flags the risk itself: "operator.write callers of tools.invoke and /tools/invoke can now reach configured MCP tools." Each call still goes through the full Gateway tool policy, the session's MCP overrides and a live authority recheck.
Redirects matter here. MCP transports have leaked credentials through redirects before. The GitHub advisory GHSA-rjxq-qqhf-8hwh for CVE-2026-53840, rated high, covers streamable HTTP MCP servers that forwarded operator-configured custom headers on cross-origin redirects before 2026.5.12. The GitHub advisory GHSA-pwc7-4jwg-rqg5 for CVE-2026-62208, rated medium, covers Authorization headers forwarded during MCP SSE redirects before 2026.6.5. Both are old and fixed, but a third-party X post resurfaced them overnight, and they're a reminder to keep any Gateway older than 2026.6.5 off untrusted MCP servers.
On the browser side, pull request #191271, which enforces the strict redirect policy for Chrome MCP navigation, merged at 6:20 AM Pacific. When browser.ssrfPolicy.dangerouslyAllowPrivateNetwork is explicitly false, existing-session Chrome MCP profiles now refuse HTTP and HTTPS navigation and new tabs, because that transport can't inspect redirect hops. The PR says to use a profile with the openclaw driver for strict navigation. And pull request #187734, which keeps macOS app secrets when a Gateway config save fails, fixes a bug where a timed-out save from the Mac app wrote redaction placeholders over channel tokens and the Gateway auth token in openclaw.json.
Security Tip: Keep Credentials Out of Your Git Backup History
OpenClaw can back its databases up into a Git repository, and that history lasts. Anything committed and pushed stays there. The OpenClaw backups guide on docs.openclaw.ai says pushed schedules "redact credential-bearing tables and secret-prefixed machine-state rows by default," because an unattended push "would otherwise retain credentials durably in remote Git history." It offers --exclude-secrets for a redacted Git history and --include-secrets to opt into full-fidelity remote backups, and it warns that restores from redacted history need devices re-paired and providers re-authenticated.
The 2026.10.10 notes widen what gets redacted. Pull request #186953, which redacts bundled plugin credentials from Git exports, says bundled plugin account credentials, identity keys, callback signing secrets and Discord Activity token stores "previously reached Git history even with --exclude-secrets." The release notes add that exclusions cover "identified bundled-plugin credentials, not every possible secret or anything already in Git history."
- After upgrading, pass
--exclude-secretsexplicitly for any Git backup that leaves the machine. Don't rely on a default: the 2026.10.10 notes call secret exclusions opt-in, while the current guide says pushed schedules redact by default. - Use
--include-secretsonly for a private remote you would trust with your provider keys. - If you pushed backups from an older version, assume plugin tokens may already be in that remote's history. Rotate them. A new redacted backup won't remove old commits.
- Keep the backup repository private and limit who can clone it.
Skill Card: healthcheck, for Checking a Host Before You Upgrade It
With a big release landing on self-hosted machines, this week's skill is the bundled healthcheck. The bundled healthcheck SKILL.md in the OpenClaw repository describes it as a way to "audit/harden OpenClaw hosts: SSH, firewall, updates, exposure, backups, disk encryption, gateway security." Its stated goal is to "assess host risk, run read-only checks, then propose staged hardening without breaking access."
- Read-only first. The agent asks once for permission, then runs
openclaw security audit --deep,openclaw gateway status --deepandopenclaw doctor --lint, plus OS checks for macOS, Linux or Windows, such as listening ports, firewall state and disk encryption. - Guardrails. Its rules include "Ask before state-changing actions," "Do not change SSH/firewall/remote access until access path is confirmed," and "Never print secrets." It also tells the agent never to claim OpenClaw manages the OS firewall, SSH or updates.
- A Doctor caveat. The skill notes that ordinary
doctoranddoctor --non-interactivecan migrate state without--fix, so it saves repairs for explicit approval. - A clear report. It asks you to choose a posture (convenience, balanced or strict), then reports findings with severity and evidence, a staged and reversible plan, and the gaps it couldn't check. Backup verification is on its hardening menu.
Run healthcheck on each Gateway host before taking 2026.10.10, and keep the report. It gives you a baseline of open ports, Gateway binding, backup status and disk encryption, so you can tell afterwards whether the upgrade or one of the new opt-in features, like MCP Relay or event callbacks, changed your exposure. Heed the skill's own warning about Doctor: plain doctor can migrate state, so on upgrade day stick to its read-only commands, such as doctor --lint, until you're ready to change things.
What to Watch Next
First, the first 2026.10.10 patch release, and whether the update fix from #191825 ships in it. Second, a v2026.11.5-beta.1 tag now that the cron release blocker is fixed, and what becomes of the rebased 2026.11.1 branch. Third, whether extended-stable moves off 2026.9.36. We'll recheck the tags and npm on our next run.
Planning the 2026.10.10 upgrade?
SEN-X helps teams stage OpenClaw upgrades, review new features like Advisor and MCP Relay before turning them on, and keep Gateway backups free of credentials.
Contact SEN-X →