OpenClaw 2026.10.5 blocks plugin hooks from changing tool calls after approval

OpenClaw, the open-source agent that runs tools on the user's own machine, shipped version 2026.10.5 on October 18, 2026. The release changes how tool calls are approved. Until this version, an ordinary plugin hook could rewrite a call's arguments after a trusted policy had approved them, and the call then ran on the strength of that first approval. Now the rewritten call is blocked unless the hook requests a separate approval.

What changes for plugin hooks

Plugins inspect a tool call before it runs through a hook named before_tool_call. A hook can block the call, ask the user to approve it, or rewrite its parameters. A plugin can also register a trusted policy, a higher tier meant for host-level gates such as workspace rules or budget limits, and trusted policies run before the ordinary hooks.

The gap was in that order. When a trusted policy approved a call inline, an ordinary hook running afterward could still return new parameters, and the call went ahead with them although nobody had approved the replacement. In 2026.10.5 ordinary hooks receive an isolated copy of the approved parameters. A call with unchanged parameters still runs, while a changed one is stopped with the error Tool call parameters changed after trusted approval.

The project calls this an intentional compatibility change. A plugin that relies on trusted approval and also rewrites parameters in an ordinary hook now has to return requireApproval together with its final parameters, so the user approves the replacement on its own. The migration steps are in the project's tool policy documentation. The release also fixes three narrower security problems:

• Browser pairing credentials are no longer passed as arguments to the process that opens the browser.
• Network results that reach the agent through Tool Search and Code Mode now mark the turn as carrying network content, exactly as a direct network tool call does.
• Credentials are now redacted from API error bodies in the Discord PluralKit, LINE, and Tlon channels.

Gemini 4 Argon becomes the Google default

OpenClaw now supports Gemini 4 Argon. A new setup with a Gemini API key defaults to google/gemini-4-argon, and running setup again moves an existing default to the same model. The built-in aliases point to newer models as well: gemini to Gemini 4 Argon, gemini-flash to Gemini 3.8 Flash, and gemini-flash-lite to Gemini 3.5 Flash-Lite.

The defaults for Gemini CLI, media understanding, and web search stay as they were. The /think command maps its low, medium, and high levels to the levels Gemini 4 supports. The minimal and off settings fall back to low, because the Gemini API rejects the minimal level and thinking cannot be fully disabled on this model.

Any script or configuration that names the gemini alias will send its requests to a different model after the update. The release notes do not mention price. This suggests that anyone relying on the alias should check Google's price list before the next bill arrives.

Updates and restarts

According to the project, openclaw update now finishes across devices, file systems, Windows elevation, and macOS login shells instead of leaving a half-finished install. Interrupted turns, subagent work, and deferred tasks resume after a restart of the Gateway, the long-running process that hosts the agent's sessions. The project also says the Gateway's startup memory is back in the range of version 2026.10.4.