chore(deps-dev): bump openclaw from 2026.7.1-2 to 2026.8.2 in the npm-minor-patch group

[dependabot]

Bumps the npm-minor-patch group with 1 update: openclaw.

Updates openclaw from 2026.7.1-2 to 2026.8.2

Release notes

Sourced from openclaw's releases.

openclaw 2026.8.2

2026.8.2

Highlights

• Your Home agent, beside your work: open Home in a right or bottom dock with Cmd/Ctrl+Shift+H, keep your current page in view, and preview or remove its work-context snapshot or attach selected text to your message. Related #133632. (#133676)
• A desktop companion for Linux: install the .deb or AppImage on x86-64 Linux, connect to a local or remote Gateway, and open Quick Chat from the system tray or an X11 keyboard shortcut. AppImage updates are signature-verified; .deb installs remain under your package manager. See the Linux guide.
• Start work without switching pages: create and run a background session from New Session, keep its selected local, cloud, or paired-device placement, and open it from the completion notice. Related #128037. (#128050) Thanks @​Takhoffman.
• Safer upgrades: preserve newer configuration, stop incomplete session migrations before claiming success, and recover a stopped Gateway after a failed update when the installed package or rollback is verified safe. Related #118244, #90551, #134206. (#134025, #134228, #119516) Thanks @​obviyus, @​stuart-minion-ai, @​shakkernerd, @​zyw02, @​Issue-Hunter, @​cursoragent, and @​sercada.
• Replies that finish the job: return a final answer after settled tool work and surface failures after an accepted turn, fixing conversations that stopped at tool output or an initial acknowledgement. Related #133960. (#133520, #133979) Thanks @​fuller-stack-dev.
• More dependable voice: keep internal reasoning out of speech, preserve tool-generated audio through delivery, and keep later browser Talk turns working after call setup. Related #90364, #83636, #134081. (#133615, #133324, #134170, #134138) Thanks @​camball-strategies, @​obviyus, @​TurboTheTurtle, @​clawSean, @​Conan-Scott, and @​mastertyko.
• Browser control without a running Gateway: let supported macOS and Linux Chrome extension builds wake their paired local relay for authenticated CDP clients; this needs the updated native host and an extension build with relay wake-up support. (#128379)
• Four new looks: personalize the Control UI with CRT, Manuscript, Rosé, or Miami, with theme choices preserved offline and applied without flashing the wrong theme during reload. Related #133416, #132785. (#133495, #133593, #133417, #132789) Thanks @​vyctorbrzezowski.

Changes

• Recovery cleanup: preview retained migration originals with openclaw update cleanup --dry-run, then explicitly remove eligible originals while the selected Gateway is stopped; cleanup preserves current SQLite history but permanently gives up rollback to removed originals. Related #133805. (#133864)

• Session visibility default: let unsandboxed sessions work with other sessions of the same agent by default, including retained cron sessions; shared-agent operators should set tools.sessions.visibility to tree or self when they need narrower access, while sandbox and cross-agent restrictions remain enforced. Related #133456. (#133469)

• Cross-session conversations: render forwarded messages as distinct speech bubbles with source-session links and sending-agent identity, preserving attribution when messages steer an active conversation. (#132054, #133439)

• Session organization: group session actions into clearer menus, copy transcripts as Markdown, open sessions in tabs, windows, or splits, edit icons and colors together, and optionally hide empty session groups. Related #133480, #133629. (#133490, #133638)

• Home without switching pages: dock the selected agent’s existing Home conversation beside your work, retain its draft and attachments when opening it full page, and inspect or remove the “Working on” context before sending. Related #133632. (#133676)

• Prepared cloud projects: reuse prepared project snapshots and validated workspace hashes before starting a cloud session, and preserve the required stop, snapshot, and restart cycle for Daytona-backed projects. Related #133436, #133450. (#133447, #134026, #134043)

• Readable Beam links: share transcripts through readable /beam/ URLs named after their sessions, with existing access checks and contextual navigation preserved. Related #125752. (#125755, #133463)

• Chrome relay wake-up: support standalone local relays that start on demand, share their paired browser with the Gateway, and remain available to other CDP clients when the Gateway disconnects; see the Chrome extension guide for supported builds and setup. (#128379)

• Plugin SDK types: type Telegram botToken as SecretInput (string | SecretRef), matching existing secret-reference support; plugin authors should use the resolved account token and read finalization-context messages only when source === "openclaw-transcript". (#133988, #134238)

• Background sessions: start work from New Session without leaving the page with Cmd/Ctrl+Enter, retain the selected local, cloud, or paired-device placement, and open the session from its completion notice; use Cmd/Ctrl+Shift+Enter when Modifier+Enter is already your normal send shortcut, while explicit Draft visibility still creates a draft. Related #128037. (#128050) Thanks @​Takhoffman.

• iOS composer: bring inline model, thinking, permission, attachment, and context controls closer to the web experience, keeping queued sends bound to the session settings that authorized them. (#132683) Thanks @​Solvely-Colin.

• Plugin approval verification: let plugins describe an external verification choice in approval presentations while OpenClaw retains approval identity, authorization, timeouts, and the final decision. (#113517) Thanks @​Guardiola31337.

Fixes

• Optional image decoding: update the release’s managed Sharp dependency to 0.35.4 with libheif 1.23.2, fixing vulnerabilities in image decoding while preserving optional installation. See the plugin dependency caveat under Known issues.
• Workspace permissions: apply permission changes to active runs and preserve session tool policies on cloud workers, so changing where work runs does not widen what it may do. Related #131947, #131661. (#132407, #131669) Thanks @​jalehman, @​anyech, and @​sallyom.
• Private diagnostics: redact values explicitly marked private in macOS app logs, keep credential values and prefixes out of routine Clawdock diagnostics, and preserve safe redaction of long secrets. Related #133736, #133535. (#133739, #133547, #134168)
• MCP response limits: reject oversized HTTP responses and SSE events before parsing while preserving healthy long-lived streams and keepalives. Related #101554. (#123194) Thanks @​SebTardif, @​obviyus, and @​aniruddhaadak80.
• Source-file fidelity: preserve UTF-8 BOMs, line endings, fuzzy-match context bytes, and end-of-file state when applying patches, including formatting-only edits. Related #124390, #133319. (#124418, #133320) Thanks @​synthalorian, @​obviyus, and @​yetval.
• Migration safety: coordinate automatic agent-database maintenance with its current owner, check migration readiness before accepting workspace work, and preserve existing voice-call settings and disabled shared heartbeat owners during Doctor repair. Related #133478, #133951, #127596, #133389. (#133563, #133982, #134018, #133444) Thanks @​omarshahine, @​PollyBot13, and @​obviyus.
• Safe session recovery: preserve independently created files and symlinks during archive restore, repair supported legacy v17 agent databases, and fail updates clearly when session migration still blocks startup. Related #134163, #134206. (#133921, #134208, #134228) Thanks @​EthDing, @​obviyus, @​abacha, and @​shakkernerd.
• Keep newer configuration: migrate a readable active configuration before considering last-known-good recovery, preserving newer valid settings rather than replacing them with an older copy. Related #90551. (#134025) Thanks @​obviyus and @​stuart-minion-ai.
• Update capability consent: block a requested Gateway restart and return an actionable failure when a plugin update needs capability review; retain the previous plugin and finish with openclaw update repair after review. Related #134156. (#134183) Thanks @​obviyus and @​BrunoCerberus.
• Hardened npm updates: complete OpenClaw’s verified package lifecycle on hosts using npm ignore-scripts=true without enabling scripts for unrelated packages or rolling a valid update back. Related #134177. (#134193) Thanks @​obviyus and @​botatdovly.
• Update progress and recovery: show reliable progress and final outcomes, preserve offline diagnostics, refuse unsafe restarts when service state is unknown, and distinguish Gateway service setup from installing the CLI. (#133622, #133842, #132853, #133530) Thanks @​jason-allen-oneal, @​obviyus, and @​RomneyDa.
• Failed-update recovery: restart the managed Gateway through the selected installed CLI after a failed update when the replacement or restored installation is verified usable; retain backups and leave the Gateway stopped when rollback or package readiness remains uncertain. Related #118244. (#119516) Thanks @​zyw02, @​Issue-Hunter, @​cursoragent, and @​sercada.
• Scheduled jobs: preserve and recover valid migrated cron jobs, avoid needless schedule-repair writes, and emit complete JSON when cron output is piped; heartbeat jobs now report the actual completed, skipped, or failed outcome after the heartbeat settles. Related #133347, #133442, #134327. (#133858, #133552, #133661, #134464) Thanks @​fuller-stack-dev, @​ejc3, @​vincentkoc, @​josephbergvinson, and @​goslingmanagment.
• Approval migration: import historical execution approvals and usage metadata, and identify malformed legacy fields without exposing their values so operators can repair the preserved source. Related #118242. (#118282, #133952) Thanks @​obviyus and @​sercada.
• Plugin SDK compatibility: preserve the published conversation-binding inspection API and existing command definitions when upgrading from 2026.8.1; legacy docks categories remain visible under Tools without restoring retired docking features.
• Plugin loading and updates: load packaged TypeScript plugins consistently, normalize file URLs for native loading, preserve bundled provider compatibility, and keep official plugins aligned with targeted beta updates. Related #133306, #123297, #97680. (#117199, #133337, #123416, #124415) Thanks @​sunlit-deng, @​easyteacher, @​lonexreb, @​obviyus, @​bradenmcleish, @​synthalorian, and @​chac4l.
• Plugin discovery: keep bundled plugins bundled when selected through load paths and prune stale path-install records that otherwise shadow the active source. Related #133935. (#133584, #133991) Thanks @​ZengWen-DT, @​obviyus, @​lsr911, @​chelsealong, @​SebTardif, and @​JeffSteinbok.
• Bun Gateway compatibility: restore authenticated Gateway connections under Bun 1.4 while preserving payload limits and request scheduling. (#134282)

... (truncated)

Commits

• 0965053 docs(release): finalize 2026.8.2 changelog
• e01f53c fix(release): align Vercel tooling lock integrity
• b3c92c4 fix(release): patch optional image dependencies and reconcile advisories
• 71901c9 docs(release): finalize 2026.8.2 changelog
• 5a40f47 chore(release): finalize 2026.8.2 app versions and locales
• 59512b4 fix(release): repair Docker inputs and command catalog projection
• d405013 fix(plugin-sdk): retain published inspection and command contracts
• 47c295c chore(release): prepare 2026.8.2 candidate
• 999239d test(memory): remove duplicate nested batch error case (#134624)
• 08fb946 refactor(migrate-hermes): consolidate provider and config plumbing (#134640)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions