OpenClaw Main Lets Headless Nodes Join Through OpenClaw ID With Owner Approval as 2026.11.2 Gets Official Patch Notes
OpenClaw main now has a Labs preview that lets a headless computer join a claw through OpenClaw ID, with no Gateway token. The owner approves it after comparing a six-digit code and reviewing the node's signed command list. Stable 2026.11.2 also got its GitHub release page, official patch notes and an @openclaw announcement on Sunday, and the release page shows that ClawHub plugin publishing and the Android build were deferred.
OpenClaw spent Sunday building a new way for computers to join a claw. A five-PR stack from maintainer jalehman, finished at 5:08 AM Pacific on Monday, lets a headless machine enroll as a node through OpenClaw ID without a Gateway token, an account or Tailscale. The owner approves it on the Access page after comparing a six-digit code. The feature is a Labs preview on main, not a release. Meanwhile 2026.11.2, which became npm latest early Sunday, finally got its GitHub release page, its people-friendly patch notes and an announcement from the official OpenClaw account. The release page also shows that ClawHub plugin publishing and the Android build did not ship with it.
Headless Nodes Get an Owner-Approved Way In
Nodes are the machines a Gateway can run commands on, such as a Mac, a phone or a server. Until now a node needed some way to reach the Gateway directly, like a LAN, Tailscale, SSH or a Gateway bearer token. The new stack sends that traffic through the OpenClaw ID relay and tunnel instead. It landed in order. Pull request #193980 defines accountless node enrollment (8:46 AM Pacific Sunday). Nodes get "a separate W-only key class, never owner or member privileges," and an owner-signed invite produces a pending redemption that "admits nothing" until it is approved.
Half an hour later, pull request #194001 lets Labs-enabled claws admit owner-approved nodes over the tunnel. The owner compares a six-digit code and reviews the node's signed, self-reported list of commands and capabilities. The first pairing approves only that list, once per key. Node principals get "no operator scopes, operator HTTP access, or plugin cookies." Pull request #193982 connects the node host over the OpenClaw ID tunnel. The node's key stays in a 0600 private state file, not in config, logs or worker descriptors. Pull request #194007 adds node approval to the Access page, with a ten-minute, single-use join command. Sensitive commands are highlighted, and a pending node is never approved automatically.
The last piece is pull request #193993, which adds openclaw node join for owner-approved OpenClaw ID invitations. The node shows a six-digit code and its signed command list, then waits for the owner's approval before it connects in the foreground, or installs a user service with --service. To change a node's commands, the owner removes it and sends a new link, because node join now refuses a node that is still admitted. While testing it live, the team also found and fixed a re-approval bug. Pull request #195507 allows one automatic node pairing per approved listing, so a node removed on Access and approved again no longer needs a second manual approval under Devices. The limits are clear: Unix hosts and native-process workers only, Node as the qualified runtime, and Bun streaming still not qualified. There is also no production default for the Discovery origin, which you set with --discovery-url.
This is the most interesting access change on main in weeks, because it removes the shared Gateway token that remote nodes usually carry around. Approval only covers the command list the owner reviewed, and a key that is removed from the listing is disconnected on its next request. Wait for it to leave Labs and appear in a tagged release. When it does, read the declared command list before you approve, not just the six-digit code.
2026.11.2 Gets Its Release Page, Patch Notes and Official Announcement
Yesterday we reported that npm had moved latest to 2026.11.2 before any release page existed. That gap is now closed. The openclaw 2026.11.2 GitHub release was published at 11:31 AM Pacific Sunday and counts "166 commits · 113 pull requests · 64 contributors". At 5:33 PM, pull request #194288 added the 2026.11.2 release notes to the docs. The official v2026.11.2 release notes call it "a patch release with no new features" that "fixes problems that could stop updates, leave scheduled reminders missing, or cause chat widgets to appear twice." At 8:53 PM, the official @openclaw announcement on X led with the same three fixes.
Our Sunday story covered the privacy and delivery fixes from the changelog. The three items the project chose to headline are new to us:
- Missing reminders. Pull request #129650 keeps reminders that mention heartbeat polls or wakes. A substring filter treated reminders like "investigate heartbeat wake failures" as internal wake noise and dropped them silently. A leading-prefix classifier now replaces it.
- Duplicate widgets. Pull request #175544 avoids duplicate widgets when chat replies finish. The final event repeated a Canvas widget the saved reply already contained. The live widget and its state now survive the reconciliation.
- Update repair. Pull request #193431 stops update repair from fencing itself out. Repair could refuse its own executor when current and legacy paths reached the same SQLite store through different aliases.
The release page's verification list also records what did not ship. "Plugin ClawHub publish" was "deferred to independent recovery; not published or verified by this run," and the ClawHub bootstrap was deferred, so the "full release remains incomplete." The Android APK was skipped because apps/android/version.json still reads 2026.8.2. The deferral came from pull request #195350, which lets an already-published core release defer ClawHub during recovery. That PR says re-dispatching ClawHub "is not safe recovery for immutable artifacts already partially published," and readback reports complete: false rather than an empty success. An independent bisque.today recap of 2026.11.2 flagged the same two gaps.
If you use reminders that mention heartbeats, or update repair has stalled on a Mac with symlinked state paths, 2026.11.2 is worth installing now. Android users stay on the August app build, though, and official plugins updated through ClawHub may lag npm until the deferred publication is recovered. Check plugin versions after upgrading instead of assuming core and plugins moved together.
Security Tip: Don't Let a Cloned Workspace Pick Your Tools
One 2026.11.2 fix that got little attention closes a quiet supply-chain path. Pull request #191102 prevents workspace environment roots from adding local tools to PATH. Before it, CLI startup could add tools from the current workspace to the child-process PATH when mise or XDG executable roots pointed into that workspace. A repository an agent cloned could then place its own binaries where your tools should be. Workspace .env files can no longer set MISE_DATA_DIR or XDG_BIN_HOME, and the CLI rejects relative and workspace-contained package-manager roots.
The OpenClaw secrets and storage security guide lists the full set of keys blocked from workspace .env files: PATH, PNPM_HOME, NPM_CONFIG_PREFIX, MISE_DATA_DIR, XDG_BIN_HOME, provider credentials, endpoint-routing settings and anything starting with OPENCLAW_. After you upgrade, move any workspace-local mise or XDG tool installs outside the workspace, because the PR says those setups must move. Also check your service's inherited PATH yourself. The guide notes that inherited entries "remain operator-controlled, including relative and workspace-local entries," so this fix does not clean up a PATH you already set badly.
Templates Can Now Come Straight From ClawHub
On the agent side, pull request #195707 adds agents directly from ClawHub Template packages (9:10 PM Pacific Sunday). Before it, openclaw templates add @openclaw/api-integration-engineer treated the package name as a local path and failed. It now resolves an exact published version, verifies the package identity and SHA-256, and extracts it into a temporary source. You can preview the result with --dry-run. The OpenClaw templates CLI reference says Add is one-way: it creates an ordinary agent, there are no Template update or remove commands, and "A warned Template release requires --acknowledge-clawhub-risk." Templates must be enabled in Settings, Labs. An hour later, pull request #195755 preserves bootstrap instructions when an Add is retried. A failed Add had left a seed marker behind, so the retry treated the missing BOOTSTRAP.md as already used and finished without the first-run instructions.
Skill Card: create-template, the Other End of the Pipeline
If Templates can now be pulled from ClawHub, someone has to write them. The bundled create-template SKILL.md on OpenClaw main is a manual skill (disable-model-invocation: true) that will "Turn this agent into a shareable Template for a person to review." The Control UI runs it in the agent's existing main conversation, and it edits only one request-specific draft file. It works in four steps:
- Capture the reusable agent. Describe its role through four scope fields (input, job, output and authority), and ask which responsibility to share if they don't fit together.
- Inventory only relevant material. List skills and enabled plugins with the skill's own
scripts/cli.mjs, and declare a dependency only when it can be tied to "a current ClawHub package reference and exact version." - Author the proposal. Leave out raw conversations, memories,
USER.md, credentials, secret values, private URLs, local paths and personal facts, and "Never copy the source workspace tree." - Hand off for review. Do not "generate a review link, upload, or publish." The person reviews the exact built archive and publishes it from the Control UI.
The create-template skill is careful about privacy, but its output is only as clean as the agent you start from. Before you turn a working agent into a Template, move personal facts and client names out of its durable instructions, then read the draft's file list during review. On the install side, use --dry-run --json first and treat any ClawHub risk acknowledgment as a reason to stop and read.
Also on Main: Talk Mute and Steadier Updates
Talk users on both phones get a mute button. Pull request #192648 adds a Talk microphone mute button on iOS in the Talk activity strip. It works across native speech recognition, Gateway relay and WebRTC. Pull request #187722 lets Android mute the Talk microphone without ending the conversation, and reply audio keeps playing. Android's microphone indicator may stay visible because realtime mute sends silence. Early Monday, pull request #195829 preserves final push-to-talk words when muting on Android. Before it, a test expecting "book tomorrow" received only "book".
Update work continued overnight. Pull request #195656 lets updates survive interrupted heartbeat runs; before, post-install Doctor failed when a Gateway shutdown left a legacy heartbeat run marker behind. Pull request #195406 restores the macOS LaunchAgent after repair contention, so openclaw update repair no longer leaves the job unloaded when it finds a Gateway listener running outside launchd. That PR says the reporter's exact incident is "still unproven," so treat it as a bounded repair.
What to Watch Next
First, whether the deferred ClawHub plugin publication for 2026.11.2 is recovered and verified, and whether the Android version pin is fixed before the next tag. Second, whether the OpenClaw ID node stack gets docs and a beta, and whether Bun streaming is qualified for it. Third, which tag first carries Template Add from ClawHub. On X, a maintainer previewed ESP32 node firmware, but the repository it named was not publicly reachable when we checked, so we have left it out. We also left out the Garry Tan harness-eval cost figures until we can read them in the primary repository. We will recheck tags, dist-tags and the release page on the next run.
Planning remote nodes or shared Templates?
SEN-X helps teams roll out 2026.11.2, review node and Access approvals, and check workspaces and Templates for leaked tools, credentials or personal context.
Contact SEN-X →