v2026.3.22 — ClawHub Ecosystem + Legacy Cleanup

Released: March 23, 2026 Theme: Architectural refactor + legacy cleanup + ecosystem expansion Breaking Changes: 9+ (most in recent memory)

Overview

v2026.3.22 is the most disruptive release in March — over 200 fixes, 9+ Breaking Changes, and major legacy-path removals. Three directions: establish the ClawHub native install ecosystem, land a full Plugin SDK refactor, and introduce pluggable sandbox backends. Historical baggage like CLAWDBOT_*/MOLTBOT_* environment variables, the .moltbot state directory, and the legacy Chrome extension also go away.

Core Highlights

1. ClawHub Native Install Ecosystem

openclaw skills search "weather"
openclaw skills install weather
openclaw plugins install clawhub:my-plugin

Bare plugins install now checks ClawHub before npm
Resolves the Claude marketplace registry
plugin@marketplace install syntax
Docker E2E test coverage

2. Plugin SDK Full Refactor

Breaking Change: public SDK paths move from openclaw/extension-api to openclaw/plugin-sdk/* subpaths. Compat shims are removed. All bundled plugins must use injected runtime.

A new openclaw/plugin-sdk/testing public test surface ships for plugin authors.

3. Pluggable Sandbox Backends

Sandbox is no longer Docker-only:

Backend	Mode	Notes
Docker/Podman	Default	Existing behavior unchanged
OpenShell	`mirror` / `remote`	Supports remote workspaces
SSH	Secret-backed	Keys, certificates, known_hosts

sandbox list/recreate/prune operations are now backend-aware.

4. New Providers and Search Tools

Exa: professional search plugin
Tavily: tavily_search + tavily_extract
Firecrawl: search/scrape tools
fal: image generation
Anthropic Vertex AI: Claude via Google Vertex AI
Chutes: bundled provider with OAuth

5. GPT-5.4 as Default

Default OpenAI model moves from GPT-5.3 to GPT-5.4. Default agent timeout jumps from 600 s to 48 h.

Breaking Changes

Change	Impact
Plugin SDK paths	`openclaw/extension-api` → `openclaw/plugin-sdk/*`
Chrome browser	Legacy extension relay, `driver: "extension"` removed
Image generation	`nano-banana-pro` removed; use `imageGenerationModel`
Plugin message discovery	Must use `describeMessageTool(...)`
Environment variables	`CLAWDBOT_` / `MOLTBOT_` compat names removed
State directory	`.moltbot` auto-detect/migration removed
Exec sandbox	Blocks JVM / glibc / .NET build-tool env injection
Matrix plugin	New `matrix-js-sdk` implementation — migration required
Plugin install	Bare install prefers ClawHub over npm

Technical Direction

Legacy Cleanup and Namespace Unification

Fully advances the OPENCLAW_* namespace and removes every CLAWDBOT_*/MOLTBOT_* compat path. Big technical-debt paydown.

Startup Optimization

Loading bundled channel plugins from compiled dist/extensions — cold start drops from tens of seconds to a few seconds. CLI startup, channel add, and model catalog all move to lazy loading.

Defense-in-Depth

Blocks Windows file:// UNC paths (prevents SMB auth leakage), blocks JVM / glibc / .NET env injection, hardens exec approval (Hangul filler invisible characters, timing-safe HMAC).

Notable Fixes

Gateway cold start: WhatsApp-scale cold start drops from tens of seconds to a few
Compaction multi-fix: orphan tool_result crash, large-session freeze (added timeout interrupt)
Windows SMB leak: file:// UNC paths blocked to prevent auth handshake
OpenAI tool call id collisions: compatibility fix for 400 rejections
Agent timeout: default bumped from 600 s to 48 h to avoid long-task surprises