realvco Docs

v2026.3.8 — CLI Backup System + ACP Provenance

Released: March 9, 2026 Theme: Feature additions + resilience hardening Breaking Changes: None

Overview

A stability release following v2026.3.7 with about 60 changes. Highlights include the new CLI backup feature (openclaw backup), ACP provenance tracking for multi-agent traceability, and Talk Mode silence timeout settings. Substantial macOS, Android, Telegram, Browser CDP, and Gateway stability and security fixes.

Core Highlights

1. CLI Backup

New openclaw backup command provides local state archiving:

openclaw backup create                # full backup
openclaw backup create --only-config  # config-only backup
openclaw backup verify                # verify archive integrity
  • Manifest/payload validation
  • Prompts you to take a backup before destructive operations
  • Archive naming improved for date-sorted listing

2. ACP Provenance Tracking

New optional ACP entry-point metadata provides full traceability in multi-agent collaboration:

openclaw acp --provenance off|meta|meta+receipt
  • Visible receipt injection
  • Preserves and reports ACP source context and session trace ID
  • Essential for debugging complex multi-agent workflows

3. Talk Mode Silence Timeout

New top-level talk.silenceTimeoutMs:

  • Talk Mode waits for the configured silent period before sending the transcription
  • When unset, per-platform defaults apply
  • Closes long-running issue #17147

4. Brave Web Search LLM Context

New opt-in tools.web.search.brave.mode: "llm-context". web_search can call Brave’s LLM Context endpoint and receive grounded snippets with source metadata.

5. macOS Remote Gateway Token

The macOS app adds a gateway token field for remote mode. Non-plaintext token values are preserved until explicitly replaced; a warning surfaces when load-time format is incompatible.

Technical Direction

Resilience

Many fixes concentrate on long-running-service edge cases: Gateway restart timeout recovery, launchd respawn detection, cron missed-run catch-up throttling, Telegram poll restart cleanup. Comprehensive daemon/service stability.

Browser Tooling Hardening

Several browser/CDP fixes: loopback WebSocket URL normalization, wildcard debugger URL rewriting (Browserless containers), Chrome relay bind host (WSL2), SSRF blocking.

Continued Security Depth

system.run script snapshot binding (blocks post-approval tampering), Skills download path pinning (blocks re-binding attacks), browser SSRF redirect blocking.

Notable Fixes

  • Telegram DM route dedup: a single DM resolved at two session keys caused duplicate replies
  • GPT-5.4 parameters: correct 1,050,000 token context window (not the legacy Codex limit)
  • Podman SELinux: auto-detect enforcing/permissive modes, bind mounts gain :Z relabel
  • macOS LaunchAgent restart: services disabled after update could not restart
  • Context Engine registry: bundled builds could not resolve duplicate modules against each other