feat(kiloclaw): bump openclaw to version 2026.3.28

[kilo-code-bot]

Summary

Bumps openclaw in kiloclaw/Dockerfile from 2026.3.13 to 2026.3.28.

Verification

• Verified current Dockerfile version (2026.3.13) is older than the target (2026.3.28), so the bump is valid.
• Change is a single-line version pin update; no other modifications needed.

Visual Changes

N/A

Reviewer Notes

Potentially breaking changes in v2026.3.28 worth reviewing

Breaking: qwen-portal-auth OAuth integration removed
The deprecated qwen-portal-auth OAuth integration for portal.qwen.ai has been dropped. If any KiloClaw users are configured with Qwen via the old portal OAuth path, their provider will stop working after this upgrade. They must migrate to Model Studio with an API key via openclaw onboard --auth-choice modelstudio-api-key. This is unlikely to affect our deployment directly, but worth noting for any users on Qwen.

Breaking: Config/Doctor drops automatic config migrations older than two months
Very old legacy config keys now fail validation instead of being silently rewritten. If any of our machines have configs that haven't been touched in 2+ months and contain legacy keys, they may fail startup. The controller's openclaw doctor call at bootstrap could surface errors for affected users.

ACP/ACPX agent registry change
Unknown ACP agent IDs no longer fall through to raw --agent command execution on the MCP-proxy path. This closes a potential security surface but could break any custom ACP agent integrations relying on that fallback.

Plugins/startup: auto-load behavior change
Bundled provider and CLI-backend plugins are now auto-loaded from explicit config refs. This is additive but changes startup plugin resolution order; any config with explicit plugins.allow entries for bundled CLI backends (Claude CLI, Codex CLI, Gemini CLI) should still work, but unexpected plugin loads at startup are possible if config has partial entries.

[kilo-code-bot]

WARNING: This version bump can break dormant KiloClaw instances on restart

kiloclaw unconditionally runs openclaw doctor --fix --non-interactive against any existing /root/.openclaw/openclaw.json during bootstrap (kiloclaw/controller/src/bootstrap.ts:387). The 2026.3.28 release drops automatic rewrites for legacy configs older than two months, so users who have not restarted recently can fail startup as soon as this image rolls out unless we add an explicit migration/compat check for their persisted configs.

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
kiloclaw/Dockerfile	45	Bumping to openclaw@2026.3.28 can strand dormant KiloClaw instances because bootstrap always runs openclaw doctor --fix on persisted configs, and this upstream version removes automatic rewrites for older legacy configs.

Fix these issues in Kilo Cloud

Other Observations (not in diff)

No additional observations outside the diff.

Files Reviewed (1 files)

• kiloclaw/Dockerfile - 1 issue

---

_{Reviewed by gpt-5.4-20260305 · 1,038,358 tokens}