OpenClaw 2026.4.1 — What's New (And the Exec Default You Need to Know)

OpenClaw 2026.4.1 shipped this morning. Most updates are incremental, but there's one exec behavior change in this release that will surprise you on upgrade if you don't read carefully — and one genuinely exciting new capability for Android users.

⚠️ The Exec Default Change — Read This First

This is the one that will catch people off guard. From the release notes:

"Exec defaults: make gateway/node host exec default to YOLO mode by requesting security=full with ask=off, and align host approval-file fallbacks plus docs/doctor reporting with that no-prompt default."

In plain English: if you run exec commands through a gateway or remote node connection, OpenClaw no longer prompts for approval by default.

Previously, commands routed through a gateway would respect whatever approval policy you had configured — often prompting before running. Now the default is security=full, ask=off, meaning commands run immediately without asking.

What to do: After upgrading, run openclaw doctor to review your exec policy. If you want to keep prompts for specific command types, set your policy explicitly in your config rather than relying on defaults. The old behavior is still available — it's just no longer the default for gateway/node hosts.

If you're a ClawReady customer and you're unsure about your current exec policy, reply to your setup email and we'll check your config.

📱 Android Google Assistant Integration

This is a big quality-of-life upgrade for Android users. Instead of opening the OpenClaw app and navigating to a chat, you can now say "Hey Google, ask OpenClaw [your question]" and it routes directly to your agent.

It also means OpenClaw can now act as an assistant-role entrypoint — useful for users building voice-triggered workflows on Android devices. This requires updating the Android app alongside the server.

🔄 Task Flow Substrate Restored

Task Flows allow OpenClaw to run long-running background jobs that persist across sessions. This is primarily relevant for advanced users and plugin developers building multi-step orchestration — things like "research this topic for an hour and report back" without requiring an active session to stay open.

The new additions include managed child task spawning and sticky cancel intent, so you can stop scheduling immediately and let parent flows settle cleanly when cancelled.

🔌 New Plugin Hook: before_agent_reply

For plugin developers, this opens up patterns like: run a tool action, and if the result is deterministic, return a canned response immediately instead of passing to the model. Useful for performance optimization and cost reduction in high-frequency automation flows.

Breaking: Plugin Config Paths Changed

Both can be auto-migrated. Run openclaw doctor --fix after upgrading and it will move the config for you.

Fixes Worth Knowing

• Pairing-required errors fixed — Gateway/exec loopback now has proper fallbacks for empty paired-device token maps, so local exec and node clients stop failing with "pairing required" after the 2026.3.31 changes.
• sessions_spawn on loopback fixed — Sub-agent gateway calls now pin to the correct admin scope, fixing close(1008) "pairing required" errors.
• Malformed exec-approvals.json handled — Invalid security/ask values in your approvals file are now stripped and fall back to documented defaults instead of corrupting runtime policy.
• Plugin SDK deprecation warnings — Legacy provider compat subpaths now emit migration warnings. These will be removed in a future major release.
• Context window reporting fixed — /status now correctly shows the 1.0M context window for fresh Anthropic 4.6 model overrides instead of reporting an undercount.

How to Upgrade

npm update -g openclaw
openclaw doctor --fix

The --fix flag handles the xAI and Firecrawl config migrations automatically. After upgrading, check your exec policy if you use remote gateway or node connections (see the exec default section above).