OpenClaw 2026.6.33: security hardening across gateway auth, MCP authority, and channel delivery

A 169-PR release dominated by security and reliability repair. Gateway HTTP now rejects disallowed browser origins before unauthenticated handling, external MCP loopback clients get short-lived session-bound grants instead of inheriting mutable child-process authority, Codex app-server commands require a real human or plugin approval, and secrets are redacted from MCP status output and Telegram-adjacent logs. Operators running exposed gateways should treat this as an upgrade release.

Tool: openclaw · Version: v2026.6.33 · Significance: 4/5 · security, fix, feature