### Fixes

- Control UI: allow deployments to configure grouped chat message max-width with a validated `gateway.controlUi.chatMessageMaxWidth` setting instead of patching bundled CSS after upgrades. Fixes #67935. Thanks @xiew4589-lang.

- Control UI/sessions: bound the default Sessions tab query to recent activity and fewer rows, avoiding expensive full-history loads while keeping filters editable. Fixes #76050. (#76051) Thanks @Neomail2.

- Plugins/doctor: repair missing configured provider and channel plugins from ClawHub before npm fallback, preserving ClawPack metadata in the install record. Thanks @vincentkoc.

- Gateway/channels: cap startup fanout at four channel/account handoffs and recover from Bonjour ciao self-probe races, reducing Windows startup stalls with many Telegram accounts. Fixes #75687.

f3a0cf57605c6c25ce162080d2631c0256018c2ec128383d521153f65e69a699 config-baseline.json

711b933e8748fe220d4be1bcc7df74503ab9c5973e967839302b8c5c773ecebf config-baseline.core.json

cf956c5e58ec0e36cf47708b0cd42fa34b1f39d0da951de343be0ba6e5b28168 config-baseline.json

057e444dfc78472bac172d9d8a7bd9c9a40f9ca4755268307cfcbd7e87a4d932 config-baseline.core.json

a2a949a99f5cc5960d4d7ae0159b6b48c4d6b1f813be67cda196457ab2f88034 config-baseline.channel.json

fffe0e74eab92a88c3c57952a70bc932438ce3a7f5f9982688437f2cdaee0bcb config-baseline.plugin.json

// root: "dist/control-ui",

// embedSandbox: "scripts", // strict | scripts | trusted

// allowExternalEmbedUrls: false, // dangerous: allow absolute external http(s) embed URLs

// chatMessageMaxWidth: "min(1280px, 82%)", // optional grouped chat message max-width

// allowedOrigins: ["https://control.example.com"], // required for non-loopback Control UI

// dangerouslyAllowHostHeaderOriginFallback: false, // dangerous Host-header origin fallback mode

// allowInsecureAuth: false,

lock out a different origin.

- `tailscale.mode`: `serve` (tailnet only, loopback bind) or `funnel` (public, requires auth).

- `controlUi.allowedOrigins`: explicit browser-origin allowlist for Gateway WebSocket connects. Required when browser clients are expected from non-loopback origins.

- `controlUi.chatMessageMaxWidth`: optional max-width for grouped Control UI chat messages. Accepts constrained CSS width values such as `960px`, `82%`, `min(1280px, 82%)`, and `calc(100% - 2rem)`.

- `controlUi.dangerouslyAllowHostHeaderOriginFallback`: dangerous mode that enables Host-header origin fallback for deployments that intentionally rely on Host-header origin policy.

- `remote.transport`: `ssh` (default) or `direct` (ws/wss). For `direct`, `remote.url` must be `ws://` or `wss://`.

- `OPENCLAW_ALLOW_INSECURE_PRIVATE_WS=1`: client-side process-environment

Absolute external `http(s)` embed URLs stay blocked by default. If you intentionally want `[embed url="https://..."]` to load third-party pages, set `gateway.controlUi.allowExternalEmbedUrls: true`.

## Chat message width

Grouped chat messages use a readable default max-width. Wide-monitor deployments can override it without patching bundled CSS by setting `gateway.controlUi.chatMessageMaxWidth`:

```json5

{

gateway: {

controlUi: {

chatMessageMaxWidth: "min(1280px, 82%)",

},

},

}

```

The value is validated before it reaches the browser. Supported values include plain lengths and percentages such as `960px` or `82%`, plus constrained `min(...)`, `max(...)`, `clamp(...)`, `calc(...)`, and `fit-content(...)` width expressions.

## Tailnet access (recommended)

<Tabs>

});

});

describe("gateway.controlUi.chatMessageMaxWidth", () => {

it("accepts constrained CSS width values", () => {

for (const value of ["960px", "82%", "min(1280px, 82%)", "calc(100% - 2rem)"]) {

const result = OpenClawSchema.safeParse({

gateway: {

controlUi: {

chatMessageMaxWidth: value,

},

},

});

expect(result.success).toBe(true);

if (result.success) {

expect(result.data.gateway?.controlUi?.chatMessageMaxWidth).toBe(value);

}

}

});

it("normalizes whitespace around the width value", () => {

const result = OpenClawSchema.safeParse({

gateway: {

controlUi: {

chatMessageMaxWidth: " min(1280px, 82%) ",

},

},

});

expect(result.success).toBe(true);

if (result.success) {

expect(result.data.gateway?.controlUi?.chatMessageMaxWidth).toBe("min(1280px, 82%)");

}

});

it("rejects arbitrary CSS injection", () => {

for (const value of ["url(https://example.com/x)", "960px; color: red", "var(--x)"]) {

const result = OpenClawSchema.safeParse({

gateway: {

controlUi: {

chatMessageMaxWidth: value,

},

},

});

expect(result.success).toBe(false);

}

});

});

describe("plugins.entries.*.hooks", () => {

it.each([true, false])("accepts allowConversationAccess=%s", (allowConversationAccess) => {

const result = OpenClawSchema.safeParse({

const CSS_WIDTH_KEYWORDS = new Set(["none", "min-content", "max-content"]);

const CSS_WIDTH_FUNCTIONS = new Set(["calc", "clamp", "fit-content", "max", "min"]);

const CSS_WIDTH_UNITS = new Set(["ch", "em", "rem", "vh", "vmax", "vmin", "vw", "px"]);

const CSS_WIDTH_ALLOWED_CHARS = /^[0-9A-Za-z.%+\-*/(),\s]+$/;

const CSS_WIDTH_IDENTIFIER_RE = /[A-Za-z][A-Za-z0-9-]*/g;

const CSS_WIDTH_SIMPLE_RE = /^(?:\d+(?:\.\d+)?|\.\d+)(?:px|rem|em|ch|vw|vh|vmin|vmax|%)$/i;

const CSS_WIDTH_MAX_LENGTH = 96;

function hasBalancedParentheses(value: string): boolean {

let depth = 0;

for (const char of value) {

if (char === "(") {

depth++;

} else if (char === ")") {

depth--;

if (depth < 0) {

return false;

}

}

}

return depth === 0;

}

function hasAllowedIdentifiers(value: string): boolean {

for (const match of value.matchAll(CSS_WIDTH_IDENTIFIER_RE)) {

const identifier = match[0].toLowerCase();

if (

!CSS_WIDTH_FUNCTIONS.has(identifier) &&

!CSS_WIDTH_KEYWORDS.has(identifier) &&

!CSS_WIDTH_UNITS.has(identifier)

) {

return false;

}

}

return true;

}

export function normalizeControlUiChatMessageMaxWidth(value: string): string {

return value.trim().replace(/\s+/g, " ");

}

export function isValidControlUiChatMessageMaxWidth(value: string): boolean {

const normalized = normalizeControlUiChatMessageMaxWidth(value);

if (normalized.length === 0 || normalized.length > CSS_WIDTH_MAX_LENGTH) {

return false;

}

if (CSS_WIDTH_KEYWORDS.has(normalized.toLowerCase())) {

return true;

}

if (CSS_WIDTH_SIMPLE_RE.test(normalized)) {

return true;

}

if (!CSS_WIDTH_ALLOWED_CHARS.test(normalized)) {

return false;

}

if (!hasBalancedParentheses(normalized) || !hasAllowedIdentifiers(normalized)) {

return false;

}

return /^(?:calc|clamp|fit-content|max|min)\(.+\)$/i.test(normalized);

}

description:

"DANGEROUS toggle that allows hosted embeds to load absolute external http(s) URLs. Keep this off unless your Control UI intentionally embeds trusted third-party pages; hosted /__openclaw__/canvas and /__openclaw__/a2ui documents do not need it.",

},

chatMessageMaxWidth: {

title: "Control UI Chat Message Max Width",

description:

'Optional CSS max-width for grouped Control UI chat messages, for example "960px", "82%", or "min(1280px, 82%)". Values are validated against a constrained width grammar before reaching the browser.',

},

allowedOrigins: {

type: "array",

items: {

help: "DANGEROUS toggle that allows hosted embeds to load absolute external http(s) URLs. Keep this off unless your Control UI intentionally embeds trusted third-party pages; hosted /__openclaw__/canvas and /__openclaw__/a2ui documents do not need it.",

tags: ["security", "access", "network", "advanced"],

},

"gateway.controlUi.chatMessageMaxWidth": {

label: "Control UI Chat Message Max Width",

help: 'Optional CSS max-width for grouped Control UI chat messages, for example "960px", "82%", or "min(1280px, 82%)". Values are validated against a constrained width grammar before reaching the browser.',

tags: ["advanced"],

},

"gateway.controlUi.allowedOrigins": {

label: "Control UI Allowed Origins",

help: 'Allowed browser origins for Control UI/WebChat websocket connections (full origins only, e.g. https://control.example.com). Required for non-loopback Control UI deployments unless dangerous Host-header fallback is explicitly enabled. Setting ["*"] means allow any browser origin and should be avoided outside tightly controlled local testing.',

'Iframe sandbox policy for hosted Control UI embeds. "strict" disables scripts, "scripts" allows interactive embeds while keeping origin isolation (default), and "trusted" adds `allow-same-origin` for same-site documents that intentionally need stronger privileges.',

"gateway.controlUi.allowExternalEmbedUrls":

"DANGEROUS toggle that allows hosted embeds to load absolute external http(s) URLs. Keep this off unless your Control UI intentionally embeds trusted third-party pages; hosted /__openclaw__/canvas and /__openclaw__/a2ui documents do not need it.",

"gateway.controlUi.chatMessageMaxWidth":

'Optional CSS max-width for grouped Control UI chat messages, for example "960px", "82%", or "min(1280px, 82%)". Values are validated against a constrained width grammar before reaching the browser.',

"gateway.controlUi.allowedOrigins":

'Allowed browser origins for Control UI/WebChat websocket connections (full origins only, e.g. https://control.example.com). Required for non-loopback Control UI deployments unless dangerous Host-header fallback is explicitly enabled. Setting ["*"] means allow any browser origin and should be avoided outside tightly controlled local testing.',

"gateway.controlUi.dangerouslyAllowHostHeaderOriginFallback":

"gateway.controlUi.root": "Control UI Assets Root",

"gateway.controlUi.embedSandbox": "Control UI Embed Sandbox Mode",

"gateway.controlUi.allowExternalEmbedUrls": "Allow External Control UI Embed URLs",

"gateway.controlUi.chatMessageMaxWidth": "Control UI Chat Message Max Width",

"gateway.controlUi.allowedOrigins": "Control UI Allowed Origins",

"gateway.controlUi.dangerouslyAllowHostHeaderOriginFallback":

"Dangerously Allow Host-Header Origin Fallback",

"gateway.push.apns.relay.baseUrl": ["network", "advanced"],

"gateway.controlUi.embedSandbox": ["security", "access", "advanced"],

"gateway.controlUi.allowExternalEmbedUrls": ["security", "access", "network", "advanced"],

"gateway.controlUi.chatMessageMaxWidth": ["advanced"],

"gateway.controlUi.dangerouslyAllowHostHeaderOriginFallback": [

"security",

"access",