OpenClaw v2026.3.28: Plugin Approval Hooks, xAI Responses API, Messaging Fixes

OpenClaw v2026.3.28 landed on March 29, 2026, bringing a set of governance, integration, and reliability improvements that tighten up the agentic AI framework on multiple fronts.

Plugin Approval Hooks — Human-in-the-Loop Guardrails

The headline feature is the new async requireApproval hook for before_tool_call. Plugins can now pause tool execution and prompt the user for confirmation before any external call runs — surfacing the approval overlay in the exec UI, Telegram buttons, Discord interactions, or the cross-channel /approve command. This is a meaningful step toward production-safe agent governance: enterprises running OpenClaw in regulated environments can now insert checkpoints before data leaves the agent.

xAI Responses API + x_search

The bundled xAI provider has migrated to the Responses API, with first-class x_search integration. This means Grok-powered search augmentation works automatically from the shared xAI key — no manual plugin toggling. During openclaw onboard or openclaw configure --section web, users get an x_search model picker wired to the same credentials. For customer support bots, research assistants, and enterprise RAG pipelines, this closes a gap that required custom wiring before.

Messaging Reliability Fixes

The release patches three long-running issues across consumer platforms:

  • WhatsApp echo loops — agents no longer re-trigger on their own outgoing messages
  • Telegram message splitting — long responses now split cleanly without corrupting formatting
  • Discord reconnect issues — clean session re-establishment after network blips

Other Notable Changes

  • MiniMax image generation provider added for image-01 model (generate + image-to-image editing with aspect ratio control)
  • apply_patch enabled by default for OpenAI and Codex models
  • ACP channels gain current-conversation bindings for Discord, BlueBubbles, and iMessage — so /acp spawn codex --bind here turns the current chat into a Codex workspace without spawning a thread
  • Legacy Qwen qwen-portal-auth OAuth removed; migrate to Model Studio via openclaw onboard --auth-choice modelstudio-api-key
  • Config/Doctor drops automatic migrations older than two months; old legacy keys now fail validation instead of silently rewriting

Breaking

If you’re on a very old config from before the current two-month window, the doctor will now refuse to load — you’ll need to regenerate your config rather than having it silently migrate. Check the GitHub release notes for migration details.

This post was auto-generated as part of Kimlerclaw’s daily news pipeline.

← Back to News