OpenClaw 4.2 Operator Briefing: Plugin Config Migration, Task Flow Durability, and Android Assistant

Release Notes

OpenClaw 4.2 Official Release Notes: Breaking Plugin Config Moves and Task Flow Substrate

Two major plugin config paths move from core to plugin-owned namespaces in 4.2: xAI search and Firecrawl web fetch both require migration via openclaw doctor --fix. If you use either, this is not optional and skipping it will break your tools silently.

OpenClaw 3.31 Beta Source: Six Breaking Changes, Unified Task Ledger, and the Full Changelog

The canonical GitHub release for 3.31 beta is the reference point for every changelog item that 4.2 builds on, including the background task control plane, node trust tightening, and legacy plugin SDK deprecations. Worth bookmarking if you need to diff your config against a known-good baseline.

Tools

Task Flow Substrate Restored in 4.2: Managed vs Mirrored Sync, Durable State, and openclaw tasks flow Inspection

The core Task Flow substrate is back with managed vs mirrored sync modes and durable state tracking, giving background orchestration a real persistence layer separate from plugin authoring. The new openclaw tasks flow inspection and recovery primitives make this operationally visible for the first time.

beforeagentreply Hook Lands in 4.2: Plugins Can Now Short-Circuit the LLM Entirely

The new beforeagentreply hook lets plugins intercept the agent reply pipeline after inline actions and return a synthetic response without ever hitting the model. This is a meaningful leverage point for latency-sensitive or cost-sensitive flows where you already know what the reply should be.

News

Google Assistant App Actions on Android: OpenClaw Now Launches From the Voice Trigger

Android gets assistant-role entrypoints and Google Assistant App Actions metadata in 4.2, so users can launch OpenClaw and hand prompts directly from the assistant trigger into the chat composer. Auto-send kicks in once chat is healthy and idle, which makes this practical rather than just decorative.

Security

Sandbox Credential Path Bypass Fixed: Canonical Home Aliases Could Mount Secret Stores

A sandbox security fix in 4.2 blocks credential-path binds even when the sandbox home path resolves through a canonical alias, closing a vector where agent containers could mount user secret stores through alternate home-directory paths. If you run sandboxed agents on any multi-user or shared host, this is the fix you did not know you needed.

Analysis

OpenClaw 3.31 Operator Guide: Task Ledger, QQ Bot, and What to Validate Before Upgrading

Good practical walkthrough of the 3.31 changes that still matter heading into 4.2, particularly the SQLite-backed task ledger unification and the fail-closed plugin install scanning. The upgrade validation checklist at the end is worth keeping handy if you are catching up from an older build.