v2026.3.23
发布于 2026-03-23 · 翻译于
🎯 一句话总结：本版本重点新增通义千问按量付费支持，优化 UI 无障碍体验，并修复多处认证与插件安装关键问题。
📋 更新要点（中文翻译）
1新增通义千问按量付费接口，支持全球及中国区密钥配置。
2优化 UI 主题配色与对比度，增强无障碍访问及图标识别。
3修复全局安装时缺失插件运行时文件导致安装失败的问题。
4优化 CLI 渠道登录流程，自动选择配置渠道并增强安全性。
5修复 OpenAI 令牌保存后失效问题，确保证书持久化正确。
6修复操作员会话因权限范围缺失导致页面读取失败的问题。
7修复 ClawHub 插件安装因版本兼容性检查过时而失败的问题。
8优化 macOS Chrome 附加流程，减少超时及重复授权确认。
▶查看英文原文（Release Notes）
### Breaking
### Changes
- ModelStudio/Qwen: add standard (pay-as-you-go) DashScope endpoints for China and global Qwen API keys alongside the existing Coding Plan endpoints, and relabel the provider group to `Qwen (Alibaba Cloud Model Studio)`. (#43878)
- UI/clarity: consolidate button primitives (`btn--icon`, `btn--ghost`, `btn--xs`), refine the Knot theme to a black-and-red palette with WCAG 2.1 AA contrast, add config icons for Diagnostics/CLI/Secrets/ACP/MCP sections, replace the roundness slider with discrete stops, and improve accessibility with aria-labels across usage filters. (#53272) Thanks @BunsDev.
- CSP/Control UI: compute SHA-256 hashes for inline `<script>` blocks in the served `index.html` and include them in the `script-src` CSP directive, keeping inline scripts blocked by default while allowing explicitly hashed bootstrap code. (#53307) Thanks @BunsDev.
### Fixes
- Plugins/bundled runtimes: ship bundled plugin runtime sidecars like WhatsApp `light-runtime-api.js`, Matrix `runtime-api.js`, and other plugin runtime entry files in the npm package again, so global installs stop failing on missing bundled plugin runtime surfaces.
- CLI/channel auth: auto-select the single configured login-capable channel for `channels login`/`logout`, harden channel ids against prototype-chain and control-character abuse, and fall back cleanly to catalog-backed channel installs, so channel auth works again for single-channel setups and on-demand channel installs. (#53254) Thanks @BunsDev.
- Auth/OpenAI tokens: stop live gateway auth-profile writes from reverting freshly saved credentials back to stale in-memory values, and make `models auth paste-token` write to the resolved agent store, so Configure, Onboard, and token-paste flows stop snapping back to expired OpenAI tokens. Fixes #53207. Related to #45516.
- Control UI/auth: preserve operator scopes through the device-auth bypass path, ignore cached under-scoped operator tokens, and show a clear `operator.read` f