OpenClaw 3.31 and 4.1: Unified Task Ledger, Exec Obfuscation Gotchas, and the Operator Upgrade Checklist

Release

OpenClaw 3.31 Ships Unified SQLite Task Ledger and openclaw flows CLI

All background work — ACP, subagents, cron, CLI — now routes through one SQLite-backed control plane with list, show, and cancel commands. For anyone running multi-agent orchestration, this is the operational visibility that was missing before.

OpenClaw 4.1 Beta Fixes Tasks Gateway Hang and Exec Approval Dead-Ends

The 4.1 beta patches a critical bug where the task registry maintenance sweep was stalling the gateway event loop under SQLite pressure, causing gateways to hang about a minute after startup. Exec approval dead-ends for cron and isolated no-route cases also get resolved here.

Analysis

3.31 Obfuscation Detection Overrides ask:off and Blocks Legitimate Agent Commands

The new detectCommandObfuscation() function forces approval even when ask is set to off, hitting normal agent patterns like heredocs, base64 payloads, and long one-liners. If your agent is getting blocked on shell commands after upgrading, this is why — and the fix requires patching three locations in the distributed JavaScript.

3.31 Breaking Changes Ranked by Operator Impact: Auth, Installs, and Node Trust

Good prioritization of the six breaking changes with the most upgrade risk: trusted-proxy auth rejecting mixed configs, dangerous install findings failing closed, and node commands requiring explicit approval post-pairing. Worth reading before you touch production.

Guide

Production Upgrade Checklist for OpenClaw 3.31: Nodes, Flows, and Plugin Scanner

Concrete post-upgrade steps: verify node pairings are approved not just paired, run openclaw flows list to confirm task visibility, and audit custom plugins against the new fail-closed install scanner. Short and practical.