OpenClaw 2026.3.31: Task Flows, Fail‑Closed Installs and Node Security

OpenClaw 2026.3.31 Brings Task Flows, Fail‑Closed Installs, and Tighter Node Security for Production Agents

OpenClaw 2026.3.31 adds task flows, fail-closed plugin installs, stricter node security, and Matrix plus channel upgrades to improve production agent control.

A control-first release: why OpenClaw 2026.3.31 matters

OpenClaw’s 2026.3.31 release shifts the project’s focus from adding features to asserting control over agent behavior — most notably by introducing task flows as a unified tracking system. For operators running agents in production, these changes are intended to reduce silent failures, tighten what connected devices can do, and make plugin installs safer by default. The headline element is task flows, and it sits alongside several security and channel improvements designed to make long-running, multi-agent deployments more observable and more predictable.

Task flows: a single ledger for background work

The central new capability in this release is the consolidation of background tasks into a single tracking system. Previously, OpenClaw tracked sub-agents, cron jobs, ACP sessions, and CLI background runs in separate places with different lifecycle handling — a setup that could allow runs to be lost, duplicated, or silently fail. In 2026.3.31, background work is recorded in one SQLite-backed ledger so operators can view and manage everything from a single control plane.

The release adds CLI primitives to interact with this ledger — openclaw flows list, openclaw flows show, and openclaw flows cancel — which expose currently running flows, detailed run information, and the ability to terminate work centrally. Lost runs receive automatic recovery attempts, and orphaned tasks surface “doctor” hints to help diagnose why they were disconnected. Sub-agent results are routed back through their parent session so outputs no longer evaporate into the void.

A persistence mechanism for blocked states is part of the task flows story: when a flow encounters an authorization error or write blocker it now marks itself as blocked with a reason, enabling clean retries instead of spawning fragmented duplicate attempts. For continuous-agent operators who spawn many short-lived sub-agents (for code fixes, deploys, or scheduled tasks), the unified visibility and blocked-state semantics aim to make long-running automation reliable and debuggable.

Fail‑closed plugin installs and the new override flag

This release changes the default behavior of OpenClaw’s plugin installation path: when the built‑in code scanner finds critical security findings during a plugin or skill install, the installer now fails closed instead of warning and proceeding. Previously, critical findings were surfaced but installation could continue; 2026.3.31 stops the install when dangerous code is detected.

For operators who understand and accept the risk, the release provides an explicit override: --dangerously-force-unsafe-install. The flag’s name is intentionally cautionary — it must be supplied explicitly to bypass the scanner’s block and proceed with an install that the scanner flagged. The maintainers framed this as a trade-off that protects casual users while still allowing power users to override the safeguard when necessary.

Node and gateway security: don’t trust devices until approved

OpenClaw tightens the device trust model across three breaking changes aimed at reducing implicit trust for connected devices:

Node commands are disabled by default until pairing is explicitly approved. The older behavior exposed a device’s declared commands immediately on pairing; the new two-step process requires an approval step after pairing before commands become usable.
Node-originated runs now operate with a reduced trusted surface. Notification-driven or node-triggered flows no longer have automatic access to every host or session tool they could previously reach, narrowing what a device-initiated automation can do.
Gateway authentication no longer implicitly trusts same-host callers when a configured token is in use. The implicit same-host trust that previously could allow local callers to act without the token has been removed to strengthen gateway auth semantics.

If you have phones, Raspberry Pis, or other devices connected to OpenClaw, these changes mean you should verify pairings and adjust flows that relied on the older implicit trust model. The release notes recommend operators inspect node pairings and validate tool access for node-triggered automation after updating.

Matrix integration: parity with other channels

Matrix receives multiple improvements designed to close the gap with Slack and Discord:

Streaming replies that update in place instead of posting a new message for each response chunk. Rather than spamming a room with incremental messages, the agent edits the same message as content streams.
Room history context for group triggers, allowing group-triggered automations to access relevant historical context.
HTTP proxy support to accommodate network topologies that route Matrix traffic through proxies.
Per-DM thread isolation overrides to control how direct-message threads are isolated or shared.

Taken together, these enhancements make Matrix behave more like the other first-class channel integrations and improve the user experience for Matrix-based deployments, especially where streaming output and contextual triggers are important.

Channel platform upgrades: WhatsApp, QQ, and LINE

The release also ships targeted channel improvements:

WhatsApp agents can now react to messages with emoji. This allows agents to acknowledge or respond to incoming content with lightweight reactions (for example, a heart emoji on a photo) instead of always sending a text reply.
QQ Bot is included as a bundled channel plugin with support for slash commands and media, bringing QQ parity with other channel plugins for command-based interactions and media handling.
LINE gains proper outbound media support for video and audio messages, enabling richer outbound content from agents on that platform.

These updates emphasize subtle usability improvements (like reactions) alongside expanded media capabilities for regional messaging platforms.

Exec approvals routed through Slack

For teams that use Slack as their primary interface, exec approval prompts now run natively inside Slack and respect approver authorization. Instead of sending approver prompts to a web UI or terminal and forcing context switches, the approval flow remains in Slack where approvers can grant permission directly. This keeps the authorization surface co-located with the chat interface and streamlines decisioning when agents require elevated actions.

Practical checklist: what to do after updating

The release includes a practical set of post-update steps intended to help operators verify a safe rollout:

Run openclaw update run to pull the latest release artifacts.
Check node pairings to ensure devices are not only paired but explicitly approved; run openclaw nodes status to review device state.
Inspect task flows with openclaw flows list to confirm cron jobs, sub-agents, and background runs are visible in the new ledger.
Review custom plugins and local installs; the stricter scanner may flag code that previously installed without a block.
Test node-triggered automations to confirm they have the tool access they need under the tightened trust model.

The release author also points readers to a documented playbook for operating multi-agent setups — titled The OpenClaw Playbook — as a resource for architecture patterns and operational practices referenced throughout the release commentary.

Operational impact for continuous-agent deployments

From an operator’s perspective, the changes in 2026.3.31 are squarely aimed at production reliability. The unified task flows ledger addresses a common pain point for long-running agent environments: lack of end-to-end visibility for background work. Auto-recovery of lost runs, doctor hints for orphaned tasks, and explicit blocked-state semantics reduce the incidence of “silent failures” where a sub-agent fails and the system gives no obvious trace that anything went wrong.

Fail‑closed plugin installs change the risk calculus for ecosystems where community-contributed skills and plugins circulate freely. By making the secure path the default and requiring an explicit, strongly labeled override to bypass warnings, the release reduces the chance that casual users will accidentally install unsafe code, while still allowing intentional installs by informed operators.

The node and gateway changes represent a shift toward a least-privilege posture for device-originated actions. Two-step pairing and narrower tool access for node-triggered flows make it harder for a compromised or misconfigured device to perform unintended operations inside an OpenClaw deployment. Removing implicit same-host trust when a token is configured closes a local privilege-escalation vector that operators may have relied on unconsciously.

Context within the agent and automation landscape

These changes align OpenClaw with a broader trend among agent frameworks and automation platforms toward operational maturity: observability for background processes, stricter defaults for third-party code, and clearer device trust boundaries. Teams building multi-agent architectures, CI/CD automations, or conversational interfaces now expect richer operational tooling and safer defaults; OpenClaw’s updates address those expectations directly.

The Matrix improvements and channel-specific enhancements show a continued emphasis on parity across messaging ecosystems. Streaming edits, reaction support, and richer media capabilities reduce friction for operators who rely on natural conversational patterns and multimedia interactions rather than purely text-based workflows.

Who benefits and who should plan changes

Production operators and teams running persistent agents are the primary beneficiaries: the task flows ledger and the security changes reduce operational risk and increase observability. Administrators with heterogeneous device fleets (phones, Raspberry Pis, IoT endpoints) will need to audit pairings and possibly adapt flows that relied on the old implicit permissions model. Developers publishing plugins or skills should expect the stricter scanner to intercept more potentially dangerous installs, and may need to address scanner findings or document the rationale for using the explicit override flag when appropriate.

For new adopters, the release is positioned as a reasonable on-ramp: starting with 2026.3.31 gives teams the “locked-down foundation” the author describes, rather than having to retrofit security and control later.

Author perspective and recommended posture

The release writer frames 2026.3.31 as a “maturity” milestone: rather than adding flashy capabilities, the project is investing in operational controls that real-world deployments require. For operators who spawn many short-lived sub-agents and rely on background automation for deploys, reviews, and support workflows, the task flows ledger and the blocked-state handling are the most practical improvements. For teams that prioritize security posture, the fail‑closed installs and node trust changes materially reduce attack surface and accidental exposure.

The release notes are prescriptive about updating if you run OpenClaw in production; they also recommend the version as a strong starting point for newcomers who prefer a secure baseline.

Looking forward, these changes set expectations for how agent platforms mature: operators will expect unified observability for asynchronous work, safer defaults around third‑party code, and clearer device trust controls. The industry trend is toward treating conversational agents and automation tools as first-class infrastructure that require the same operational rigor as other backend services. OpenClaw’s 2026.3.31 release is an example of that shift in practice.

As deployments evolve, expect follow-up work that iterates on the task flows UX, extends the scanner’s rule set, and refines the node approval workflow to balance convenience with safety — all aimed at making long-running agent fleets easier to run, monitor, and secure without sacrificing the extensibility that powers complex automation.