OpenClaw 2026.11.2 Becomes the Stable Default as Main Stops Guests From Reaching Private Repositories

2026.11.2 Reaches npm Before Its Release Page

The stable channel moved overnight. The npm registry dist-tags for the openclaw package now point latest at 2026.11.2, while beta stays on 2026.11.5-beta.1 and extended-stable stays on 2026.9.36. The registry records the 2026.11.2 publish at 1:48 AM Pacific on Sunday. The OpenClaw release channels documentation defines stable as npm dist-tag latest and labels it "Recommended for most users," so any Gateway that follows the default channel will see 2026.11.2 on its next update check.

The git side is in place too. A signed, annotated v2026.11.2 tag was created by maintainer RomneyDa at 5:51 PM Pacific on Saturday, pointing at a commit dated 2:02 AM Pacific on Saturday. What did not exist when we checked at about 6:20 AM Pacific was a GitHub release page for the tag; the releases API still listed 2026.11.1 as the newest full release, and the documentation's release-notes index had no 2026.11.2 entry. The notes do exist in the repository: the OpenClaw 2026.11.2 changelog at the signed tag describes an audited contribution record covering 115 unique pull requests after 2026.11.1. So the package and the notes are both real; only the release page is missing.

What 2026.11.2 Changes

This is a repair release with no headline feature. The changelog groups its highlights under six themes: privacy and trust boundaries, account-safe delivery, Gateway availability, safer recovery and updates, native client recovery, and installation and state correctness. A few entries show what those themes mean in practice.

• Secrets out of audit history. Pull request #191318 redacts config set secrets when options precede values. Before it, openclaw config set could write a new secret into local audit history when --expect-current-json appeared before or between the path and the value. The fix does not rewrite existing SQLite audit rows.
• Language-server output stays out of logs. Pull request #174998 stops logging LSP server stderr content, because bundled language servers could copy private file or tool content into debug logs. The pipe is still drained; the text is simply no longer kept.
• Sandboxed search honors provider trust. Pull request #191748 makes sandboxed web search honor provider trust. Sandboxed agents can now use only bundled or verified official search providers, matching web fetch. Sandboxed setups that pointed at a third-party provider will see an error that explains how to choose an eligible one.
• Retries keep their sender. Pull request #191819 keeps durable message retries on their original sender. Before it, a queued message could be retried from a different account if the channel default changed after a failed send. Old records that never saved an account cannot be recovered retroactively.
• Telemetry stops stalling the Gateway. Pull request #186666 fixes Gateway stalls when OpenTelemetry content capture is on in large sessions. Inline images over 128 KiB are now omitted from captured content, with the image part and MIME type kept. This is the one item the changelog lists under Changes rather than Fixes, noting that it reduces diagnostic payload fidelity but "does not limit prompts or conversation history."
• Pinned executables survive updates. Pull request #191693 keeps configured executables working after updates, so Gateway cleanup no longer deletes a retired plugin generation that a configuration still points to. The PR says it does not restore generations that were already deleted.

The fix lists cover a wide range: model routing that respects disabled reasoning and aliases, Codex and Claude sign-ins that survive imports and proxy restarts, bounded memory recall, WhatsApp identity recovery, Teams routing that survives reloads, Discord, Matrix and Telegram channel repairs, iOS reconnect and Android chat startup, and Ubuntu browser-extension installs. For Gateways still on 2026.11.1, all of it arrives in one stable step.

Main Limits Restricted Roles to Public Repositories

The overnight change on main that matters most for team Gateways is pull request #194830, limiting restricted roles to public repositories, which merged at 5:20 PM Pacific on Saturday. The PR says roles without operator.write, meaning a team Gateway's guest holding operator.sessions.write or a contributor, could discover and obtain the source of private organization repositories that an administrator had registered. Every path read the shared project registry without checking who was asking. Those paths were the New session picker, sessions.create with a project ID, hidden background agent spawns, child sessions inheriting a parent's checkout, and pasting a repository URL, which refreshed the registry row using the Gateway's own GitHub token. Contributors could also see project skills and worktrees.list, which exposes every session's paths, repository roots and branches.

The fix adds one access check. A caller without operator.write can use a project only if it is an agent-workspace pseudo-project, or if its origin is owner/repo on the configured GitHub host and GitHub reports the repository as public. Private, Enterprise internal, non-GitHub and credential-bearing origins are all denied, as are lookup errors and rate limits. Clone-by-URL, remote project search and worktrees.list now require operator.write. The PR lists accepted edge cases: existing checkouts are kept, and a repository that turns private can stay in the picker for up to ten minutes, although handoffs are blocked immediately. This merged after the 2026.11.2 release branch was cut and is not in its contribution record.

Overnight on Main: Compaction, Restarts and Who Pays

Three overnight merges change how long sessions behave. Pull request #195028 keeps the model's own decisions in compaction summaries when recent tool output is large. Previously, once the verbatim tool output from the turns just before the cut grew large, the model-written summary got only half of the 16,000-character budget, so decisions, TODOs and IDs from the summarized span were pushed out. The PR replayed 16 production compactions and found the model-written summary was always 6.9k to 12.7k characters, small enough to fit on its own. Preserved tool results now keep a 160-character excerpt plus a count of omitted characters, and the overall size is unchanged. Separately, pull request #194813 lets compaction fall back to a configured provider after a quota 429 that a wrapper's prefixed error text had been hiding.

Pull request #195164 preserves streamed replies across Gateway restarts, from Peter Steinberger, merged at 3:13 AM Pacific. During a graceful restart, the provider's final partial reply now gets one fixed grace period, normally two seconds, to arrive before cancellation completes. Chunks and heartbeats cannot extend that window. The PR is explicit about scope: a provider that ignores both cancellation and iterator cleanup can still delay shutdown.

The billing fix of the night is pull request #195171, which stops /compact on Claude CLI sessions from billing the stored API key. It merged at 5:38 AM Pacific. Manual compaction was the only entry point that passed the raw session auth pin to the CLI child, skipping the account selector that replies and commands use. That allowed a subscription-only Claude CLI session to spend an automatically selected anthropic:default API key. Now compaction runs on the session's own account, and if an explicitly selected account is gone, it refuses rather than substituting another.

New on Main: Image Models, Research Panel and Selection Sessions

Not everything overnight was a repair. Pull request #194723 adds GPT Image 2.6 Sunburst and Flare to OpenClaw's OpenAI image provider. The PR says OpenAI released both models on November 4, and explicit requests already reached OpenAI, but OpenClaw dropped xhigh and max quality and snapped custom sizes such as 1536x864 to fixed sizes. image_generate and openclaw infer image now list both models, with the same options as GPT Image 2.5. The default stays openai/gpt-image-2, and the PR notes that ChatGPT or Codex sign-ins may not behave as listed.

In the Control UI, pull request #194780 moves deep research into the side panel under New tab, then Explore panels, removing the header button and transcript card after a Discord report of duplicate controls. The agent's deep_research tool remains, and its start and resume results now stay under 24 KB. Pull request #194721 adds a New session button to the transcript selection toolbar, sending the highlighted passage as quoted text ahead of your prompt in a fresh session. And with stable moving, pull request #194812 makes official plugins with saved beta selectors follow the stable channel, so a core move from beta to stable no longer downgrades a matching plugin to an older beta.

Skill Card: skill-creator, After a Night of Validator Fixes

What to Watch Next

First, whether a GitHub release page and a docs release-notes entry for 2026.11.2 appear, so operators who track releases on GitHub see the stable move that npm already made. Second, which tag first carries #194830's repository access check, the compaction-summary repair and the Claude CLI billing fix. Third, whether 2026.11.5-beta.2 follows now that the stable train has moved. We checked X for an official announcement and found none in the window; a non-official German-language recap of 2026.11.2 circulated, but we have sourced this report to the tag, the changelog and npm. We will recheck tags, dist-tags and the release page on the next run.