- Slack: require bot-authored room messages with `allowBots=true` to come from an explicitly channel-allowlisted bot or from a room where an explicit Slack owner is present, so broad bot relays cannot run unattended. Fixes #59284. Thanks @andrewhong-translucent.

- CLI/progress: suppress nested progress spinners and line clears while TUI input owns raw stdin, so Crestodian `/status` no longer disturbs the active input row. (#75003) Thanks @velvet-shark.

- Models/OpenAI Codex: restore `openai-codex/gpt-5.4-mini` for ChatGPT/Codex OAuth PI runs after live OAuth proof, and align the manifest, forward-compat metadata, docs, and regression tests so stale cron and heartbeat configs resolve again. Fixes #74451. Thanks @0xCyda, @hclsys, and @Marvae.

- Plugins/runtime-deps: always write a dependency map in generated runtime-deps install manifests, so npm does not crash or prune staged bundled-plugin packages when the plan is empty. Fixes #74949. Thanks @hclsys.

- Telegram: use durable message edits for streaming previews instead of native draft state, so generated replies no longer flicker through draft-to-message transitions that look like duplicates. (#75073) Thanks @obviyus.

## 2026.4.29

return {

name: "openclaw-runtime-deps-install",

private: true,

...(Object.keys(sortedDependencies).length > 0 ? { dependencies: sortedDependencies } : {}),

dependencies: sortedDependencies,

};

}

getActiveBundledRuntimeDepsInstallCount,

waitForBundledRuntimeDepsInstallIdle,

} from "./bundled-runtime-deps-activity.js";

import { assertBundledRuntimeDepsInstalled } from "./bundled-runtime-deps-materialization.js";

import {

assertBundledRuntimeDepsInstalled,

ensureNpmInstallExecutionManifest,

} from "./bundled-runtime-deps-materialization.js";

import {

__testing as bundledRuntimeDepsTesting,

createBundledRuntimeDependencyAliasMap,

);

});

it("always includes a dependencies field in the install manifest, even when specs are empty", () => {

const installRoot = makeTempDir();

ensureNpmInstallExecutionManifest(installRoot, []);

const written = JSON.parse(fs.readFileSync(path.join(installRoot, "package.json"), "utf8")) as {

dependencies?: unknown;

};

expect(written).toHaveProperty("dependencies");

expect(written.dependencies).toEqual({});

});

it("repairs external install roots from the complete generated dependency plan", async () => {

const installRoot = makeTempDir();

writeInstalledPackage(installRoot, "alpha-runtime", "1.0.0");