OpenClaw 3.28 Release Breakdown: xAI Responses API, Plugin Approval Hooks, and the Background Task Foundation

Release Notes

OpenClaw 2026.3.28 Full Release Notes: xAI Responses API and Plugin Approval Hooks

The 3.28 release moves the bundled xAI provider to the Responses API and adds first-class x_search, meaning Grok-backed web search now works without manual plugin toggles. The new async requireApproval hook in beforetoolcall is the bigger story for plugin authors since it lets plugins pause any tool call and route approval through Telegram buttons, Discord interactions, or the /approve command.

OpenClaw v2026.3.31-beta.1 Official Release: Six Breaking Changes and the Full Changelog

The official changelog is dense but essential reading before upgrading, particularly the gateway auth tightening that removes implicit same-host trust and the node command gating that requires explicit pairing approval beyond just device pairing. The security fix volume in this release also signals that an external audit has been active, which is worth knowing if you run an internet-exposed instance.

Tools

ACP Channel Binds for Discord, BlueBubbles, and iMessage Land in 3.28

The new current-conversation ACP binds let you run openclaw acp spawn codex --bind here and turn your current chat into a Codex-backed workspace without spawning a child thread. This is a meaningful quality-of-life change for operators who want session context to stay in one place rather than fragmenting across threads.

Post-Upgrade Checklist for OpenClaw 3.31: Nodes, Flows, and Plugin Scanner

The five-step upgrade checklist here covers the practical verification steps that matter after pulling 3.31, specifically checking node pairing approval status and testing notification-triggered flows that may have lost tool access under the reduced node trust surface. Short and actionable.

Analysis

Background Task Lifecycle Records Introduced in 3.28 as Foundation for 3.31 Ledger

OpenClaw 3.28 adds durable lifecycle records for ACP and subagent spawned work and starts routing completion and failure updates through the real requester chat path. This is the scaffold that the full SQLite-backed task control plane in 3.31 builds on, so understanding 3.28 makes the 3.31 upgrade path clearer.

OpenClaw 3.31 Operator Guide: Task Flows, QQ Bot, and Fail-Closed Installs Explained

This overview covers the three themes of 3.31 that matter most in production: the unified background task ledger, the QQ Bot bundled channel, and the new fail-closed install scanner that will break existing plugin workflows without an explicit override flag. Useful framing before you pull the update.

Exec Obfuscation Detection in 3.31 Overrides ask:off and Will Block Your Agent

Solomon Neas documents exactly how the new detectCommandObfuscation function unconditionally forces approval even when ask is set to off, and which command patterns trigger it including heredocs, base64 payloads, and commands over 10k characters. His patch script targeting three locations in the distributed JavaScript is the fastest fix for self-hosted operators until upstream adds a config override.