OpenClaw 4.1 Beta: Voice Wake, SearXNG Search, and the Exec Approval Fixes Operators Actually Needed

Release

OpenClaw v2026.4.1-beta.1 Released: Voice Wake, SearXNG, and Exec Approval Overhaul

The 4.1 beta drops macOS Voice Wake for hands-free Talk Mode, a bundled SearXNG provider plugin for self-hosted web search, and Amazon Bedrock Guardrails support. The exec approval fixes are the real headline: allow-always now persists as durable trust, Slack and Discord native approvals are realigned, and cron jobs get per-job tool allowlists.

Security

Exec Approval Trust Model Rewritten in 4.1: allow-always, Cron Dead-Ends, and Windows Fallback Fixed

Four separate exec approval bugs got patched in one release: allow-always was behaving like allow-once, static allowlist entries were silently bypassing ask:always, cron jobs were hitting no-route dead-ends, and Windows could not build an allowlist plan. If exec approvals have been unreliable for you, this is the update to test.

Plugin Install Bouncer and ClawHub Malware Context: Why the Scan Gate Matters

The blog post puts the new install-time dangerous-code scan in context: Cisco found a top community skill was silently exfiltrating data, and a ClawHub analysis identified 824+ confirmed malicious entries. The --dangerously-force-unsafe-install flag is a deliberate friction point, not an accident.

Bug Fix

Task Registry Gateway Hang Fixed: SQLite Pressure Was Stalling Startups

Upgraded gateways were hanging about a minute after startup due to the task registry maintenance sweep blocking the event loop under synchronous SQLite pressure. The fix re-checks task records before marking runs lost and keeps the sweep from stalling the gateway. Worth knowing if you upgraded to 3.31 and noticed sluggish startup.

Analysis

Obfuscation Detection Overrides ask:off and Requires a Source Patch to Fix

Solomon Neas documents a real production problem: the new detectCommandObfuscation() function in 3.31 unconditionally forces exec approval regardless of your ask:off config, blocking normal agent operations like long shell commands, heredocs, and base64 payloads. There is no config knob to disable it, and the fix currently requires patching three locations in the distributed JavaScript.

Features

Agents Default Params, Failover Rate-Limit Cap, and Compaction Model Override Land in 4.1

Three agent-level config improvements ship together: agents.defaults.params for global provider parameter defaults, a cap on same-provider auth-profile retries before cross-provider fallback, and consistent resolution of agents.defaults.compaction.model across all compaction paths. Small surface area, meaningful for operators running multi-model setups.

before_agent_reply Hook Lets Plugins Short-Circuit the LLM Entirely

The new before_agent_reply plugin hook lets you intercept messages and return a synthetic reply without touching the LLM, opening up FAQ bots, deterministic command handlers, and rate-limit guards that cost zero tokens. For high-traffic channel operators, this is the most cost-relevant API addition in recent releases.