zeroclaw-labs/zeroclaw v0.1.8-alpha.1 on GitHub

What's Changed

fix(security): allow explicit executable paths in allowed_commands by @chumyin in #1379
fix(slack): prevent replaying old messages after restart by @chumyin in #1378
fix(config): enforce 0600 on every config save by @chumyin in #1376
fix(channels): show WhatsApp Web QR during onboarding channel launch by @chumyin in #1371
fix(minimax): stop converting merged system [IMAGE:] examples into image parts by @chumyin in #1382
fix(discord): send attachment markers as files/urls by @chumyin in #1383
fix(cron): set delete_after_run for one-shot shell jobs by @reidliu41 in #1328
改进中文文档表达并更新最后对齐时间 by @liangzhang-keepmoving in #1399
fix: include reasoning_content for Kimi Code tool history by @chumyin in #1411
fix(providers): disable Responses API fallback for NVIDIA NIM by @ceeray in #1316
fix(channels): use valid Feishu emoji_type for lark ack by @zhzy0077 in #1412
fix: route heartbeat outputs to configured channels by @chumyin in #1423
fix(skills): allow cross-skill references in open-skills audit by @theonlyhennygod in #1400
docs(readme): remove Telegram CN/RU channels and add Facebook group by @chumyin in #1425
Fix/composio tool slug by @bash-develop in #1403
fix(composio): stabilize Gmail tool slug execution and v3 routing by @chumyin in #1426
fix(telegram): startup probe + 409 backoff to eliminate polling conflict on restart by @bitscrafts in #1401
feat(config): warn on unknown config keys to prevent silent misconfig by @theonlyhennygod in #1410
fix(provider): fallback native tools on parser-style 5xx by @chumyin in #1430
fix(agent): parse tool <name> markdown fence format by @theonlyhennygod in #1438
fix(provider): disable native tool calling for MiniMax by @theonlyhennygod in #1454
docs(macOS): add update and uninstall instructions by @theonlyhennygod in #1449
sync(dev): bring in missing commits from dev-temp by @theonlyhennygod in #1461
fix(provider): disable native tool calling for MiniMax by @theonlyhennygod in #1448
feat(models): add list, set, and status subcommands by @reidliu41 in #1451
fix(telegram): send image attachments when finalizing draft messages by @NanFengCheong in #1245
fix(provider): normalize image paths to data URIs in OpenAI Codex by @zverozabr in #1269
fix(tool): treat max_response_size = 0 as unlimited by @Robert-McGinley in #1320
fix(channel): use only standard Telegram reaction emojis by @razrinn in #1419
fix(gemini): derive OAuth refresh client id from Gemini CLI token by @theonlyhennygod in #1434
fix(scheduler): include failure reason in job failure warning by @bowans in #1465
fix(gateway): skip pairing dialog in web UI when require_pairing is f… by @reidliu41 in #1467
fix(ci): restore rustfmt compliance for openai codex vision e2e test by @chumyin in #1470
fix: isolate gemini oauth env vars in tests by @chumyin in #1471
Add hardware feature conditional compile for hardware mods by @InuDial in #1270
fix(providers): use /openai/v1 for Groq base URL by @amitkot in #1440
feat(channels): add /new command to clear conversation history by @ecschoye in #1417
feat(tools): Use system default browser instead of hard-coded Brave Browser by @b4iterdev in #1453
feat(agent): inject current datetime into every user message by @ecschoye in #1350
test(agent_e2e): tolerate per-turn datetime prefix on empty memory context by @chumyin in #1481
fix(security): harden per-client lockout eviction and sweep (supersedes #670) by @chumyin in #1482
fix(pairing): clear strict clippy delta failures on dev by @chumyin in #1484
fix(tools): recover rust-native browser session on stale webdriver (supersedes #1359) by @chumyin in #1483
[supersede #1295] fix(channel): normalize WhatsApp allowlist matching for LID senders by @chumyin in #1488
[supersede #1305] feat(lark): support mention-only groups via bot open_id auto-discovery by @chumyin in #1485
[supersede #1262] feat(tool): Add web_fetch tool for HTML-to-text web content extraction by @chumyin in #1486
[supersede #1336 v2] fix(onboard): set new config file permissions to 0600 on Unix by @chumyin in #1492
[supersede #1416] fix(providers): strip unsupported tool definition fields for MiniMax (#1387) by @chumyin in #1494
[supersede #1354 v2] feat(composio): fix v3 compatibility with parameter discovery, NLP text execution, and error enrichment by @chumyin in #1493
fix(channel): replace invalid Telegram ACK reaction emojis by @madamak in #1477
[supersede #1491] [supersede #1388] fix(provider): disable native tool calling for MiniMax by @chumyin in #1495
fix: always emit toolResult blocks for tool_use responses by @bzivic in #1476
sync: merge main into dev — consolidate all upstream releases by @theonlyhennygod in #1517
docs: fix OAuth wording, binary size format, E.164 phone prefix, and … by @codewithfourtix in #1296
fix(cron): enable delivery for crons created from external channels by @NorbertBodziony in #1513
fix(onboard): use provider-aware env var hint in quick setup next steps by @izm1chael in #1509
fix(channels,memory): Docker workspace path remapping, vision support… by @dmnkhorvath in #1300
feat: stabilize codex oauth and add provider model connectivity workflow by @chumyin in #1540
fix(providers): use native_tool_calling field in supports_native_tools by @theonlyhennygod in #1547
fix(ci): align codex tests with provider runtime API by @chumyin in #1552
fix: security, config, and provider hardening by @AllenHyang in #1392
fix(test): unblock dev by aligning file_read policy expectation by @chumyin in #1566
fix(gateway): prevent masked config TOML corruption and restore dashboard saves by @theonlyhennygod in #1480
chore(fmt): fix rustfmt drift after dashboard-save merge by @chumyin in #1572
fix(telegram): populate thread_ts for per-topic session isolation by @Preventnetworkhacking in #1548
fix: handle quoted shell expansions and message_send tool-call variants by @chumyin in #1505
chore(fmt): fix loop_ formatting drift after #1505 by @chumyin in #1576
use std::hint::black_box instead of deprecated criterion::black_box by @InuDial in #1360
ci: enforce PR gate parity with push checks by @chumyin in #1569
fix(browser): harden rust_native interactability for click/fill/type by @chumyin in #1570
fix(gateway): enable tool execution in web chat agent by @Preventnetworkhacking in #1574
fix(test): stabilize openai codex env-dependent unit tests by @chumyin in #1586
ci: add provider connectivity probes matrix and runbook by @chumyin in #1588
fix(qq): passive reply msg_id/msg_seq + image media send support by @chumyin in #1589
feat(provider): add Responses websocket-mode with HTTP fallback by @chumyin in #1534
chore(codeowners): rebalance review ownership and remove @willsarg by @chumyin in #1516
feat: replay 1502/1503/1504 (route max_tokens + custom responses mode + lark image inbound) by @chumyin in #1593
ci(release): pin setup-ndk action to sha for pub-release by @chumyin in #1600
feat(ci,security): deep-complete CI/CD + security audit governance lanes by @chumyin in #1598
fix: resolve RMN-25 and RMN-33; verify RMN-7 and RMN-32 on dev by @chumyin in #1603
ci(release): fix armv7 Android compiler detection in pub-release by @chumyin in #1602
feat(agent): add CLI parameters to agent for runtime config overrides by @reidliu41 in #1606
fix(unsafe-debt): remove core unsafe UID usage and add reproducible audit lane by @chumyin in #1612
fix(gateway): accept masked single-string reliability api_keys in dashboard config save by @chumyin in #1613
fix(channels): include matrix+lark in default builds by @chumyin in #1616
feat(qq): support webhook receive mode with QQ challenge validation by @chumyin in #1625
feat(unsafe-debt): enforce crate-root unsafe guard policy by @chumyin in #1623
fix(anthropic): implement capabilities() to enable vision support by @guitaripod in #1628
fix(anthropic): send image content as proper API vision blocks by @guitaripod in #1629
feat(unsafe-debt): deep integrate policy-driven audit coverage by @chumyin in #1635
fix(telegram): route image-extension Documents through vision pipeline by @guitaripod in #1631
feat(tool): add session-scoped task_plan tool for multi-step work tra… by @reidliu41 in #1357
chore(unsafe-debt): strict full crate coverage by default by @chumyin in #1636
feat(providers): auto-refresh expired Gemini OAuth tokens in warmup by @zverozabr in #1264
chore(deps): bump actions/upload-artifact from 4.6.2 to 6.0.0 by @dependabot[bot] in #1326
[supersede #1247] feat(memory): add TLS support for PostgreSQL backend by @chumyin in #1640
docs: make contributors badge dynamic across README locales by @chumyin in #1644
ci: enforce unsafe debt audit and policy governance by @chumyin in #1645
feat(tool): add background process management tool (spawn/list/output/kill) by @reidliu41 in #1405
feat(gateway): add experimental node-control scaffold endpoint by @chumyin in #1630
supersede: replay #1460 openai-compat + bedrock streaming on latest dev by @chumyin in #1649
[supersede #1409] feat(web): add zh-CN locale support for portal by @chumyin in #1624
fix(telegram): handle brackets in attachment filenames by @guitaripod in #1632
feat(logging): use local timezone for log timestamps by @AllenHyang in #1397
fix(reliable): remap model fallbacks when providers switch by @chumyin in #1652
[supersede #1317] feat(onboard): add interactive tool enablement prompts and wildcard allowlists by @chumyin in #1637
feat(agent): inject allowed_commands policy into system prompt by @chumyin in #1655
Greek Translation by @athanasiosem in #1634
feat(matrix): add mention_only gate for group triggers by @chumyin in #1653
fix(telegram): avoid silent voice transcription skips on extension-less files by @chumyin in #1657
fix(telegram): add debug logging for voice transcription skip reasons by @theonlyhennygod in #1659
fix(shell): recover command args from malformed tool payloads by @chumyin in #1660
[supersede #1648] feat(tools): add inter-process communication tools by @chumyin in #1668
docs(readme): add ZeroClaw Views ecosystem entry by @chumyin in #1672
refactor(agent): split loop_.rs into parsing/execution/context/history modules by @chumyin in #1675
feat(tools): unify web_fetch providers and shared URL validation by @chumyin in #1682
fix(matrix): handle non-exhaustive Relation enum in reply_target_event_id by @theonlyhennygod in #1702
[supersede #1648] feat(tools): add inter-process communication tools by @chumyin in #1666
docs: add Docker setup guide by @theonlyhennygod in #1690
fix(agent): add channel media markers to system prompt by @guitaripod in #1697
chore(deps): bump the rust-all group across 1 directory with 4 updates by @dependabot[bot] in #1689
[supersede #1413] docs: add Linux release installer script and README quick start by @chumyin in #1665
[supersede #1267] feat: WhatsApp media attachments + Anthropic vision capability by @chumyin in #1641
[supersede #1342] feat(config): add model_support_vision override for per-model vision … by @chumyin in #1638
[supersede #1622] [supersede #1408] feat(provider): add first-class Hunyuan (Tencent) provider by @chumyin in #1658
[supersede #1639] [supersede #1617] [supersede #1263] feat(agent): add research phase for proactive information gathering by @chumyin in #1716
chore(ci): lock workflow ownership and use blacksmith runners by @theonlyhennygod in #1720
[supersede #1595] docs(i18n): remove duplicate docs/vi/ folder by @chumyin in #1728
[supersede #1545] feat(providers): implement Qwen OAuth quota tracking by @chumyin in #1746
[supersede #1661] fix(providers): use Groq OpenAI v1 base by @chumyin in #1737
[supersede #1664] fix(channels/telegram): fixed the telegram bot always wrongly replying to all non-text messages in group by @chumyin in #1738
[supersede #1536] fix(channels): support /clear + /new history reset across channels by @chumyin in #1739
[supersede #1669] fix(build): add explicit [[bin]] configuration to prevent target inference conflicts by @chumyin in #1747
[supersede #1678] feat(ci): add MUSL static binaries for Alpine Linux support by @chumyin in #1748
[supersede #1656] fix: resolve all clippy warnings across codebase by @chumyin in #1750
[supersede #1674] feat(provider): add reasoning level override by @chumyin in #1751
feat(ci): harden CI/CD with canary, prerelease, nightly, and audit governance by @chumyin in #1763
feat(channels): add query classification routing with logging for channels by @theonlyhennygod in #1685
fix(tests): align Groq test fixtures with /openai/v1 base URL by @theonlyhennygod in #1688
hardening: enforce channel boundaries, gateway auth, and secret safeguards by @chumyin in #1765
feat(ci): auto-dispatch rollback guard on canary abort by @chumyin in #1772
fix(ci): repair CodeRabbit config and align auto-review base branch by @chumyin in #1773
hardening: resolve CodeQL cleartext logging alerts in config debug paths by @chumyin in #1774
docs(i18n): remove duplicate docs/vi/ folder by @Preventnetworkhacking in #1595
chore: add Asia/Shanghai to wizard timezone setup by @haodongnj in #1643
hardening(deps): govern matrix indexeddb derivative advisory by @chumyin in #1775
feat(ci): harden prerelease stage matrix and transition audit trail by @chumyin in #1777
docs(channels): improve Lark config placeholder values by @Preventnetworkhacking in #1596
Fix tool-call artifact leakage across gateway and channel outputs by @chumyin in #1780
feat(ci): enforce release trigger authorization and provenance guard by @chumyin in #1785
hardening(logging): sanitize channel API error bodies by @chumyin in #1786
feat(ci): enforce release artifact contract guard (RMN-102) by @chumyin in #1788
feat(release): automate notes provenance+SBOM references (RMN-107) by @chumyin in #1793
hardening(security): sanitize upstream error surfaces across channels by @chumyin in #1791
feat(security): add and harden syscall anomaly detection by @chumyin in #1790
fix(config): add runtime.reasoning_level compatibility alias with provider precedence by @chumyin in #1795
feat(ci): enforce GHCR publish tag contract and rollback mapping by @chumyin in #1796
docs(security): standardize private vuln workflow and SLA templates by @chumyin in #1802
feat(ci): add GHCR vulnerability gate policy and audit traceability by @chumyin in #1801
docs(i18n): consolidate localized readmes under docs/i18n by @chumyin in #1803
feat(runtime): configurable WASM security runtime and module tooling by @chumyin in #1799
feat(ci): enforce docs deploy promotion and rollback contract by @chumyin in #1804
docs: add Linux release installer script and README quick start by @0xshitcode in #1413
feat(integrations): add list and search subcommands by @reidliu41 in #1422
Change base branch from 'develop' to 'dev' by @theonlyhennygod in #1510
[supersede #1427] ci: remove Homebrew core publishing flow by @chumyin in #1807
feat(ci): close matrix/nightly governance gaps and canary cohort policy by @chumyin in #1812
fix(providers): use Groq OpenAI v1 base by @theonlyhennygod in #1661
docs(config): add [agents_ipc] section to config-reference by @Mike-7777777 in #1680
feat(wasm): configurable module integrity and symlink hardening by @chumyin in #1813
feat(ci): activate nightly profile with retries and trend snapshot reporting by @chumyin in #1827
feat(coordination): deep-complete protocol/message bus with hardening by @chumyin in #1817
[supersede #1686] feat(tools): add user_agent config and setup_web_tools wizard step by @chumyin in #1823
feat: configurable group-reply policy for group chat channels by @chumyin in #1834
Hide internal tool execution details by default in channels by @chumyin in #1838
[supersede #1508] feat: channel improvements (Lark rich-text, WhatsApp QR, draft config) by @chumyin in #1809
fix(tests): restore Channel::update_draft trait compatibility by @chumyin in #1840
[supersede #1511] feat: goals engine, heartbeat delivery, daemon improvements, and cron consolidation by @chumyin in #1815
[supersede #1514] feat(integrations): enhance integrations settings UX and provider metadata by @chumyin in #1816
[supersede #1515] feat(tools): add sub-agent orchestration (spawn, list, manage) by @chumyin in #1818
feat: harden non-CLI approval governance and runtime policy sync by @chumyin in #1833
fix(release): restore GNU Linux GLIBC compatibility baseline by @theonlyhennygod in #1858
fix(linq): support current v3 webhook payload format by @theonlyhennygod in #1859
fix(agent): improve iteration-limit recovery and continuity by @theonlyhennygod in #1860
chore(main): replay dev-only commits onto main by @chumyin in #1898
ci: remove blacksmith dependencies from workflows by @chumyin in #1900
ci: fix self-hosted codeql build toolchain by @chumyin in #1902
feat(site): launch responsive docs hub with pages deploy by @chumyin in #1907
fix(site): set page title to ZeroClaw by @chumyin in #1909
feat(site): rebuild design language and docs readability by @chumyin in #1910
feat(site): refine to Vercel-style engineering design by @chumyin in #1911
RMN-169: feat(site): ship full docs reader on Pages by @chumyin in #1918
RMN-169: feat(site): ship taxonomy-first docs reading UX by @chumyin in #1920
[supersede #1895] [supersede #1681] feat(tool): add session-scoped task_plan tool for multi-step work tracking by @chumyin in #1926
fix: enable native-tls for system certificate support by @Preventnetworkhacking in #1921
COM-123 release: promote dev to main by @chumyin in #1938
ci: stabilize main checks after PR #1938 by @chumyin in #1951
fix(security): allow configured shell env expansions by @theonlyhennygod in #1861
fix(web/gateway): backport empty tool-call response fix to main by @theonlyhennygod in #1936
fix(gateway): acknowledge WebSocket subprotocol to unblock agent chat by @reidliu41 in #1954
docs: add quick-reference, workspace, feature flags, and architecture… by @Yihen-Liu in #1940
fix(discord): recover text attachments when content type is missing by @theonlyhennygod in #1871
fix(bootstrap): initialize container arrays under set -u by @theonlyhennygod in #1998
feat(skills): seed bundled zeroclaw skill on startup by @theonlyhennygod in #1999
fix(agent): stop converting plain URLs into shell calls by @theonlyhennygod in #2000
fix(config): default compact_context to true by @theonlyhennygod in #1996
fix(model-routing): detect env-backed provider credentials by @theonlyhennygod in #1997
chore: promote dev snapshot to main (2026-02-27, v2) by @theonlyhennygod in #2004
feat(security): add multi-user role policy foundations (phase 1) by @theonlyhennygod in #1877
fix(security): apply LeakDetector in outbound channel sanitization by @theonlyhennygod in #2007
feat(skills): allow script files via opt-in config by @theonlyhennygod in #2008
fix(agent): expose browser automation tool in prompt inventory by @theonlyhennygod in #2009
fix(web): add collapsible mobile sidebar and responsive offset by @theonlyhennygod in #2010
fix(web): improve web access diagnostics and operator guidance by @theonlyhennygod in #2011
fix(gateway): align webchat system prompt with tool protocol by @theonlyhennygod in #2012
fix(onboard): align memory scaffolding with selected backend by @theonlyhennygod in #2014
feat(plugins): add plugin system MVP on main by @theonlyhennygod in #2015
feat(security): unify URL validation with configurable CIDR/domain allowlist by @theonlyhennygod in #2018
feat(skills): add WASM skill engine with secure registry install by @theonlyhennygod in #2019
feat(security): add aho-corasick and entropy leak heuristics by @theonlyhennygod in #2020
fix(telegram): suppress bind prompt noise for non-mentioned group messages by @theonlyhennygod in #2021
feat(mcp): add external MCP server support on main by @theonlyhennygod in #2013
feat(security): enable TOTP by default with quick setup opt-out by @theonlyhennygod in #1875
feat(provider): add qwen-coding-plan endpoint alias by @theonlyhennygod in #2023
feat(onboard): support identity backend selection beyond openclaw by @theonlyhennygod in #2024
fix(multimodal): optimize image markers for prompt budget by @theonlyhennygod in #2027
fix(approvals): clear non-cli exclusions when approving tools by @theonlyhennygod in #1879
feat(discord): forward inbound image attachments as markers by @theonlyhennygod in #1872
feat(cron): add lark and feishu delivery targets by @theonlyhennygod in #2025
fix(qq): add sandbox mode and passive msg id fallback by @theonlyhennygod in #2026
docs(structure): make docs navigation explicit by function by @theonlyhennygod in #2028
fix(slack): honor Retry-After for conversations.history rate limits by @theonlyhennygod in #1873
feat(security): add opt-in perplexity adversarial suffix filter by @theonlyhennygod in #2029
docs(security): publish official anti-fraud channels statement by @theonlyhennygod in #2030
fix(gateway): return explicit webhook method and empty-message errors by @theonlyhennygod in #2031
[supersede #1875] feat(security): enable TOTP by default with quick setup opt-out by @chumyin in #1971
fix(windows): resolve compile failure on current main by @theonlyhennygod in #2034
[supersede #1872] feat(discord): forward inbound image attachments as markers by @chumyin in #1980
feat(android): Native Android client with UniFFI bridge by @Preventnetworkhacking in #2040
fix(config): remove duplicate default_otp_enabled function by @reidliu41 in #2037
fix(lark): handle object-shaped Feishu websocket message content by @theonlyhennygod in #2051
feat(tools): add Tavily provider support and round-robin API key load balancing by @theonlyhennygod in #2067
fix(docker): unblock feature builds and include templates by @theonlyhennygod in #2073
feat(agent): add slash command tab completion and hints by @theonlyhennygod in #2074
feat(tools): add docx_read tool for DOCX text extraction by @reidliu41 in #2082
fix(ci): restore Debian/Ubuntu compatibility for prerelease binary by @theonlyhennygod in #2086
fix(agent): parse direct XML tool tags in web chat by @theonlyhennygod in #2088
chore: add .idea to .gitignore by @killf in #2016
fix(channels): avoid UTF-8 panic in approval prompt truncation by @theonlyhennygod in #2090
feat(slack): add Socket Mode fallback for Slack by @theonlyhennygod in #2092
fix(telegram): redact bot token and reduce transient poll noise by @theonlyhennygod in #2094
feat(gateway): add streaming mode for webhook responses by @theonlyhennygod in #2097
fix(telegram): restore poll token redaction after main rollback by @theonlyhennygod in #2109
feat(security): add role-policy and OTP challenge foundations by @theonlyhennygod in #2104
feat: support config-level api_key for transcription by @theonlyhennygod in #2112
fix: avoid anthropic vision detection false negatives by @theonlyhennygod in #2114
feat(identity): support extra_files in openclaw format by @theonlyhennygod in #2113
fix(agent): continue after deferred-action replies without tool calls by @theonlyhennygod in #2117
feat(whatsapp): support whatsapp_web heartbeat and cron delivery by @theonlyhennygod in #2116
feat(memory): add sqlite_qdrant_hybrid backend by @theonlyhennygod in #2115
ci: remove blacksmith deps and restore self-hosted cache stack by @chumyin in #2118
ci: shed non-blocking workflow load safely by @chumyin in #2119
ops(ci): add runner health and cleanup remediation scripts by @chumyin in #2120
ci: cautious phase-2 trigger dedupe and e2e path gating by @chumyin in #2123
ci: reduce feature-matrix fan-out and add queue hygiene automation by @chumyin in #2125
docs: streamline README by consolidating detailed sections by @theonlyhennygod in #2140
docs: update hardware references from "" to "any hardware" by @theonlyhennygod in #2143
feat(onboard): add GitHub Copilot to interactive CLI onboarding wizard by @theonlyhennygod in #2145
fix(agent): recover deferred tool follow-through in CJK contexts by @theonlyhennygod in #2146
RMN-2131 Codex transport selection: websocket-first auto mode by @chumyin in #2139
RMN-209: test: add DingTalk onboarding regression coverage by @chumyin in #2151
feat(agent): add result-aware loop detection for tool-call loop by @reidliu41 in #2153
Test self-hosted runner by @theonlyhennygod in #1867
ci: remove dev->main promotion gate and allow direct main flow by @chumyin in #2142
fix(cron): filter NO_REPLY sentinel in delivery paths by @theonlyhennygod in #2162
[supersede #1853] feat(tools): add Feishu document operation tool with 13 actions by @chumyin in #1968
[supersede #1879] fix(approvals): clear non-cli exclusions when approving tools by @chumyin in #1973
ci: require explicit @chumyin approval for CI/CD changes by @chumyin in #2127
RMN-2157: integrate Volcengine ARK and SiliconFlow providers by @chumyin in #2157
feat(economic): ZeroClaw Economic Agents - Phase 1 Foundation [CDV-20] by @Preventnetworkhacking in #2134
docs: add cron/scheduling reference documentation [COM-2] by @Preventnetworkhacking in #2103
feat(android): Phase 3 - WorkManager, Quick Settings, battery optimization [CDV-21] by @Preventnetworkhacking in #2042
feat(cost): wire provider token usage to cost tracking [CDV-24] by @Preventnetworkhacking in #2167
fix(ci): stabilize post-2142 local quality gates (COM-2142) by @gh-xj in #2171
feat(tools): add Chrome/Firefox/Edge support to browser_open tool by @killf in #2133
fix(security): patch wasmtime advisories in wasm-tools deps by @chumyin in #2159
ci: increase supply-chain provenance timeout to 60m by @chumyin in #2188
ci: move lightweight PR/workflow checks to github-hosted by @chumyin in #2190
fix(telegram): prevent duplicate messages in finalize_draft fallback by @cyberpapiii in #1694
feat(telegram): register bot commands with setMyCommands on startup by @cyberpapiii in #1695
CI: move ci-run fast-path jobs to hosted runners by @chumyin in #2199
CI: move maintenance workflows to hosted runners by @chumyin in #2201
fix(delivery): filter NO_REPLY and HEARTBEAT_OK sentinels [CDV-23] by @theonlyhennygod in #2170
CI: deduplicate workflow checks on feature pushes by @chumyin in #2203
CI: automate queue hygiene for lightweight workflows by @chumyin in #2207
feat(whatsapp-web): supersede #1992 transcription flow [RMN-205] by @chumyin in #2192
feat(http_request): add env-backed credential profiles and onboarding policy presets by @theonlyhennygod in #2148
fix(android): stabilize Termux source build and self-check diagnostics (RMN-2154) by @chumyin in #2209
fix(build): restore missing runtime approval and docx symbols by @chumyin in #2197
fix(qq): keep sender-level history context by @chumyin in #2194
fix(gateway): accept ws query-token fallback by @chumyin in #2193
supersede: replay #2172 onto main by @chumyin in #2191
security: harden sensitive I/O and outbound leak controls by @chumyin in #2185
fix(gateway): allow ws query fallback without subprotocol header by @theonlyhennygod in #2213
fix(channels/telegram): Unauthorized users in Telegram groups are wrongly prompted with "bind-telegram" when mention_only=true by @creke in #1961
feat(security): add periodic safety heartbeat re-injection to agent loop by @theonlyhennygod in #2217
fix: resolve 3 compilation errors by @theonlyhennygod in #2215
RMN-214: Docs (hardware): add Raspberry Pi Zero W build guide by @ake117 in #2155
fix(channels): import ApprovalResponse in runtime command handler by @chumyin in #2218
feat(security): add periodic safety heartbeat re-injection to agent loop by @chumyin in #2219
fix: resolve compilation errors in channels, tools, and gateway modules by @theonlyhennygod in #2221
RMN-2135: fix(browser): add return before snapshot IIFE in rust_native backend by @TimStewartJ in #2135
RMN-2138: Revert b27b448 with conflict-safe resolution by @chumyin in #2138
RMN-214: fix(ci) all-target check regression and cfg warnings by @chumyin in #2231
feat(providers): implement quota monitoring system with CLI and agent tools by @zverozabr in #1904
RMN-214: chore(fmt) normalize rustfmt drift for quality gate by @chumyin in #2238
fix(channel:discord): handle inbound image attachments as robust [IMAGE] markers by @loydccc in #1923
feat(memory): add sqlite_journal_mode config for shared filesystem su… by @weykon in #1922
RMN-218: feat(channels): add matrix integration for sovereign communication by @peitschie in #2064
fix(channel:discord): robust inbound image marker detection by @theonlyhennygod in #2241
fix(channel:discord): robust inbound image marker detection by @theonlyhennygod in #2237
build(deps): bump debian from f6e2cfa to 1d3c811 by @theonlyhennygod in #2242
chore(deps): bump zip from 0.6.6 to 8.1.0 by @dependabot[bot] in #2164
feat(channel): add napcat support for qq protocol by @theonlyhennygod in #2247
feat(email): add IMAP ID extension support for NetEase mailboxes by @theonlyhennygod in #2240
feat(skills): support front-matter metadata and always-inject skills by @theonlyhennygod in #2248
[RFC] AWW: Agent Wide Web — A World Wide Web for AI Agent Experiences by @killf in #2189
fix(copilot): merge tool_calls from all response choices by @TimStewartJ in #2136
feat(tools): add pptx_read tool for PowerPoint text extraction by @reidliu41 in #2130
feat(memory): add observation memory tool by @theonlyhennygod in #2251
feat(gateway): add paired devices API and dashboard tab by @theonlyhennygod in #2252
feat: add cursor headless cli support by @langhuihui in #2195
feat(config): add config show/get/set runtime commands by @theonlyhennygod in #2255
feat(channel): accept onebot aliases for napcat config by @theonlyhennygod in #2256
feat(channel): add GitHub native channel MVP by @theonlyhennygod in #2257
fix(agent): avoid orphan tool messages after compaction by @theonlyhennygod in #2261
fix(memory): scope runtime memory by session across channels and gateway by @theonlyhennygod in #2254
fix(web-fetch): remove dead feature gates and add noise stripping by @maxtongwang in #2262
fix(fmt): correct rustfmt violations on main by @gh-xj in #2280
fix(build): resolve compile errors, clippy violations, and fmt on main by @gh-xj in #2282
feat(routing): support hint default_model during startup by @theonlyhennygod in #2266
fix(lark): dedupe websocket and webhook event retries by @theonlyhennygod in #2265
fix(gateway): persist ws chat history across reconnects by @theonlyhennygod in #2244
fix(slack): resolve sender display names with cached users.info by @theonlyhennygod in #2245
feat(project): deliver M4-5 workspace RFI baseline and benchmark harness by @theonlyhennygod in #2284
fix(model): provider-aware fallback model IDs for non-Anthropic providers (RMN-253) by @theonlyhennygod in #2281
fix(utf8): prevent panic on CJK text truncation [CDV-27] by @Preventnetworkhacking in #2278
docs(readme): restore Quick Start section [CDV-26] by @Preventnetworkhacking in #2277
fix(config): use provider-agnostic model ID for fallback [CDV-25] by @Preventnetworkhacking in #2272
docs: update description from "AI assistant infrastructure" to "Operating System" by @theonlyhennygod in #2287
fix(memory): auto-save assistant responses alongside user messages by @theonlyhennygod in #2249
feat(memory): add optional cortex-mem backend profile and bridge by @theonlyhennygod in #2250
fix(cron): require explicit opt-in for recurring agent jobs by @theonlyhennygod in #2253
feat(web): add data-driven config form editor with category navigation by @boengai in #2059
feat(channels): add comprehensive ACP channel tests and fix implementation bugs by @feishiheng in #2124
chore(deps): bump lycheeverse/lychee-action from 2.7.0 to 2.8.0 in the actions-all group by @dependabot[bot] in #1768
docs(readme): simplify README and add web deployment by @theonlyhennygod in #2098
chore(deps): bump tokio-postgres-rustls from 0.12.0 to 0.13.0 by @dependabot[bot] in #1767
feat(session): Add channel session persistence support by @VirtualHotBar in #2093
feat(slack): support listening on multiple channel IDs by @theonlyhennygod in #2289
fix(bedrock): auto-refresh AWS credentials before STS token expiry by @theonlyhennygod in #2225
feat(tools): add bg_run — async background tool execution with auto-injection by @dwillitzer in #1847
fix(build): restore Catalina (macOS 10.15) compatibility by @imthedronelord in #2057
Add /mnt to default forbidden paths for security by @mvxpsd in #2085
fix(agent): remove stale loop session imports (RMN-262) by @theonlyhennygod in #2293
feat(agent): expose hooks parameter in public run() entry point by @theonlyhennygod in #2292
feat(security): allow read-only git config operations by @theonlyhennygod in #1707
feat(auth): improve OAuth UX for server environments (RMN-265) by @theonlyhennygod in #2295
fix(deps): align wasmtime + wasmtime-wasi to 36.0.6 by @theonlyhennygod in #2294
feat(skills): add native tool handler for SKILL.toml-based skills (RMN-266) by @theonlyhennygod in #2296
feat(channel): use DingTalk Open API for sending messages by @theonlyhennygod in #2297
chore(scripts): add REST-first PR verifier (RMN-267) by @theonlyhennygod in #2298
fix(channels): accept richer dingtalk callback text payloads by @androidshu in #2147
feat(channel): add BlueBubbles iMessage channel by @maxtongwang in #2271
fix(config): prevent generic API_KEY env var from overriding configured key by @Ygnas in #1848
feat: merge-first OpenClaw migration for onboarding and agents (RMN-205) by @chumyin in #2212
fix(providers): harden circuit breaker cooldown semantics and validation by @theonlyhennygod in #2302
feat(channels): configurable ACK emoji policies + channel_ack_config tool by @chumyin in #2198
fix(telegram): deduplicate attachment markers in single reply by @theonlyhennygod in #2303
fix(observability): propagate metric registration errors in prometheus::new (RMN-1849) by @dwillitzer in #1849
fix(quality): reduce unwrap and clone-in-loop violations (sop, skillforge, irc) (RMN-1850) by @dwillitzer in #1850
feat(plugins): add wasm plugin foundation and hook scaffolding (part 1/2) (RMN-270) by @gh-xj in #1363
[supersede #1968] [supersede #1853] feat(tools): add Feishu document operation tool with 13 actions by @chumyin in #1986
docs(rfi): define F1-3 lifecycle and Q0-3 continuation state machines by @theonlyhennygod in #2316
feat(memory): add reindex command to rebuild embeddings [CDV-28] by @Preventnetworkhacking in #2290
feat(config): add ProgressMode enum for streaming channel draft updates by @cyberpapiii in #1696
feat(hardware): replay device registry + serial transport core [RMN-1837] by @theonlyhennygod in #2307
docs: update description from "Operating System" to "Framework" by @theonlyhennygod in #2320
feat(agent): add ProgressTracker for in-place tool progress updates by @theonlyhennygod in #2321
fix(bootstrap): handle unreadable /dev/stdin in guided installer by @theonlyhennygod in #2326
feat(onboard): add hybrid sqlite+qdrant option to interactive memory setup by @theonlyhennygod in #2331
feat(update): add human-friendly install-aware update guidance by @theonlyhennygod in #2334
fix(ci): reduce Actions queue saturation on self-hosted lanes by @theonlyhennygod in #2330
fix(docs): correct first-run gateway commands by @theonlyhennygod in #2328
feat(tools): add xlsx_read tool for spreadsheet extraction by @theonlyhennygod in #2338
fix(channels): prompt non-CLI always_ask approvals by @theonlyhennygod in #2337
fix(docs): reference canonical install docs from README/docs by @theonlyhennygod in #2335
feat(skills): add trusted symlink roots for workspace skills by @theonlyhennygod in #2329
fix(mcp): stdio transport reads server notifications as tool responses, registering 0 tools [CDV-2327] by @Preventnetworkhacking in #2332
feat(cost): add preflight budget enforcement policy by @theonlyhennygod in #2333
[supersede #1664] fix(channels/telegram): fixed the telegram bot always wrongly replying to all non-text messages in group by @chumyin in #1985
feat(config): session scope + channel command policy + tool profiles by @chumyin in #2158
chore(build): align rust-version metadata to 1.88 (RMN-2175) by @chumyin in #2239
chore(deps): bump zip to 8.1 and adapt zip writers by @chumyin in #2406
feat(agent): add end-to-end team orchestration bundle by @chumyin in #2394
fix: fallback native tools on HTTP 516 schema rejection by @chumyin in #2389
chore: replay mistaken dev commits onto main by @chumyin in #2392
feat(provider): stepfun integration with onboarding/docs parity (RMN-305) by @chumyin in #2397
fix: RMN-903001993 restore security/stability gates and binary size compliance by @chumyin in #2398
fix(security): harden non-local gateway auth boundaries by @chumyin in #2407
ci: harden Build (Smoke) for transient runner termination by @chumyin in #2410
ci: fix queue hygiene apply-mode authentication by @chumyin in #2413
ci: avoid false-red test-runner on no-docker self-hosted nodes by @chumyin in #2415
fix(web): rebuild dashboard dist for ws auth/session parity by @theonlyhennygod in #2343
fix: resolve compilation errors and warnings by @killf in #2177
docs: fix web_fetch provider list to include tavily by @killf in #2178
Feature/multitenant deployment enhancements by @myhkstar in #2380
fix(gateway): rebuild web/dist assets to fix dashboard WebSocket auth by @vernonstinebaker in #2169
feat(cli): build-time short SHA in version output (issue #2347) by @theonlyhennygod in #2418
feat(file_edit): whitespace-flexible fallback matching (issue #2348) by @theonlyhennygod in #2416
fix(feishu): legacy config compatibility + startup guidance (supersedes #2350) by @theonlyhennygod in #2422
test(gateway): fix AppState BlueBubbles fixture fields by @theonlyhennygod in #2424
fix(telegram): keep always_ask HITL approvals one-shot for inline buttons by @theonlyhennygod in #2423
revert: rollback PR #2380 (docs/sh-only) by @chumyin in #2425
feat(providers): fallback to chat completions in responses mode by @theonlyhennygod in #2417
fix(anthropic): ignore empty/whitespace text blocks in parse_text_response by @theonlyhennygod in #2428
fix(compatible): enforce native tool-call sequencing for NVIDIA NIM by @theonlyhennygod in #2429
fix(mcp): support streamable HTTP headers and SSE responses by @theonlyhennygod in #2438
feat(agent): expose tool_specs and public run_tool_call_loop by @theonlyhennygod in #2439
feat(memory): add time-decay scoring with Core evergreen exemption by @reidliu41 in #2387
feat(gemini): support multimodal inlineData in user messages by @theonlyhennygod in #2435
feat(autonomy): exclude process by default for non-cli channels by @theonlyhennygod in #2436
feat(web): add line numbers and TOML syntax highlighting to config editor by @theonlyhennygod in #2437
feat(memory): pre-compaction durable fact flush by @theonlyhennygod in #2444
feat(memory): boost Core memories in context retrieval by @theonlyhennygod in #2445
feat(channels): hot-reload startup-bound runtime defaults by @theonlyhennygod in #2446
fix(agent): refresh system prompt datetime across long-lived turns by @theonlyhennygod in #2447
feat(channel): add native Discord approval buttons and interactions by @theonlyhennygod in #2448
feat(autonomy): expand practical defaults for real-world workflows by @theonlyhennygod in #2449
feat(plugins): add wasm runtime execution bridge, limits, and docs (part 2/2) (RMN-271) by @gh-xj in #1365
fix(plugins): align manifest tests with optional metadata (RMN-270) by @gh-xj in #2383
refactor(workspace): scaffold M4-5 PR-1 crate shells and CI lanes [RMN-248] by @theonlyhennygod in #2341
fix(web-fetch): wire html2md feature dependency (RMN-310) by @gh-xj in #2464
fix(plugins): harden approval provenance and dedupe crash path (RMN-270) by @gh-xj in https://github.com/zeroclaw-labs/zeroclaw/pull/2469
refactor(plugins): add validation profiles with strict runtime defaults by @gh-xj in https://github.com/zeroclaw-labs/zeroclaw/pull/2468
ci(runners): unblock main and add runner incident diagnostics by @gh-xj in https://github.com/zeroclaw-labs/zeroclaw/pull/2479
fix(deps): bump rollup 4.57.1 → 4.59.0 (CVE-2026-27606) by @gh-xj in https://github.com/zeroclaw-labs/zeroclaw/pull/2492
fix(ci): stabilize rust/security workflows on merge path by @theonlyhennygod in https://github.com/zeroclaw-labs/zeroclaw/pull/2485
fix(lark): fetch image messages via resource endpoint by @theonlyhennygod in https://github.com/zeroclaw-labs/zeroclaw/pull/2489
docs(codex): add oauth quickstart and gpt-5.3 model by @theonlyhennygod in https://github.com/zeroclaw-labs/zeroclaw/pull/2490
fix(security): avoid unstable windows link-count API by @theonlyhennygod in https://github.com/zeroclaw-labs/zeroclaw/pull/2491
feat(agent): add provider-agnostic max-token continuation policy by @gh-xj in https://github.com/zeroclaw-labs/zeroclaw/pull/2373
fix: harden tool follow-through and workspace path resolution by @chumyin in https://github.com/zeroclaw-labs/zeroclaw/pull/2504
ci: use release profile in reproducible build check by @gh-xj in https://github.com/zeroclaw-labs/zeroclaw/pull/2505
fix(runtime): robust Windows shell fallback and doctor diagnostics by @chumyin in https://github.com/zeroclaw-labs/zeroclaw/pull/2509
feat(agent): smarter team/subagent orchestration with hot runtime config by @chumyin in https://github.com/zeroclaw-labs/zeroclaw/pull/2420
fix(ci): avoid rollback guard false-fail on scheduled runs by @chumyin in https://github.com/zeroclaw-labs/zeroclaw/pull/2521
fix(ci): prevent scheduled canary dry-run false failures by @chumyin in https://github.com/zeroclaw-labs/zeroclaw/pull/2524
fix(ci): keep scheduled rollback audits non-blocking by @chumyin in https://github.com/zeroclaw-labs/zeroclaw/pull/2526
fix(gateway): require WATI webhook auth (RMN-323) by @gh-xj in https://github.com/zeroclaw-labs/zeroclaw/pull/2463
fix(channels): robust qq/feishu image delivery and multimodal proxy fetch routing by @chumyin in https://github.com/zeroclaw-labs/zeroclaw/pull/2508
ci: route workflows to hetzner self-hosted runner pool by @chumyin in https://github.com/zeroclaw-labs/zeroclaw/pull/2523
docs+tests: finalize agent orchestration runtime config coverage by @chumyin in https://github.com/zeroclaw-labs/zeroclaw/pull/2528
ci: offload lightweight workflows from hetzner lane by @chumyin in https://github.com/zeroclaw-labs/zeroclaw/pull/2547
ci: route lightweight workflows to aws-india cpu40 lane by @chumyin in https://github.com/zeroclaw-labs/zeroclaw/pull/2552
ci: rebalance lightweight gates to aws-india lane by @chumyin in https://github.com/zeroclaw-labs/zeroclaw/pull/2554
ci: bind sec codeql to dedicated hetzner lane by @chumyin in https://github.com/zeroclaw-labs/zeroclaw/pull/2557
ci: prioritize release branch across all CI lanes by @chumyin in https://github.com/zeroclaw-labs/zeroclaw/pull/2558
release: v0.2.0 by @gh-xj in https://github.com/zeroclaw-labs/zeroclaw/pull/2533
ci(release): add automated release safety gates by @gh-xj in https://github.com/zeroclaw-labs/zeroclaw/pull/2604
ci: ensure cargo component before cache and e2e tests by @gh-xj in https://github.com/zeroclaw-labs/zeroclaw/pull/2610
fix(ci): restore GitHub-hosted runner labels for macOS/Windows release builds by @gh-xj in https://github.com/zeroclaw-labs/zeroclaw/pull/2613
fix(ci): unblock release builds — binary size limit + cross-compile headers by @gh-xj in https://github.com/zeroclaw-labs/zeroclaw/pull/2614
fix(ci): install gh CLI for release trigger guard on self-hosted runners by @gh-xj in https://github.com/zeroclaw-labs/zeroclaw/pull/2615
fix(ci): propagate checkout auth to release trigger guard by @gh-xj in https://github.com/zeroclaw-labs/zeroclaw/pull/2616
fix(ci): pass GH_TOKEN to release trigger guard step by @gh-xj in https://github.com/zeroclaw-labs/zeroclaw/pull/2618
fix(ci): bump macOS binary size limit to 22MB by @gh-xj in https://github.com/zeroclaw-labs/zeroclaw/pull/2622
fix(windows): increase stack size to resolve runtime overflow by @killf in https://github.com/zeroclaw-labs/zeroclaw/pull/2621
fix(cron): support feishu announcement fallback to lark config by @killf in https://github.com/zeroclaw-labs/zeroclaw/pull/2538
chore: add .claude to .gitignore by @killf in https://github.com/zeroclaw-labs/zeroclaw/pull/2306
fix(release): isolate rust toolchain homes in pub-release matrix by @gh-xj in https://github.com/zeroclaw-labs/zeroclaw/pull/2624
fix(release): harden apt lock handling in pub-release by @gh-xj in https://github.com/zeroclaw-labs/zeroclaw/pull/2625
fix(release): allow manual GHCR publish for existing tags by @gh-xj in https://github.com/zeroclaw-labs/zeroclaw/pull/2626
fix(ci): auto-detect Docker API version for Buildx by @gh-xj in https://github.com/zeroclaw-labs/zeroclaw/pull/2627
fix(agent): track tool execution success status correctly by @killf in https://github.com/zeroclaw-labs/zeroclaw/pull/2632
refactor(update): remove unused ErrorKind import by @killf in https://github.com/zeroclaw-labs/zeroclaw/pull/2636
.github/workflows: Migrate workflows to Blacksmith runners by @blacksmith-sh[bot] in https://github.com/zeroclaw-labs/zeroclaw/pull/2639
ci: add Blacksmith production release build workflow by @theonlyhennygod in https://github.com/zeroclaw-labs/zeroclaw/pull/2640
style: fix rustfmt drift blocking production release build by @theonlyhennygod in https://github.com/zeroclaw-labs/zeroclaw/pull/2643
ci: ensure rustfmt/clippy components in production release build by @theonlyhennygod in https://github.com/zeroclaw-labs/zeroclaw/pull/2644
ci: activate toolchain PATH for release-build cargo fmt/clippy by @theonlyhennygod in https://github.com/zeroclaw-labs/zeroclaw/pull/2645
ci: align release quality gate with repo baseline by @theonlyhennygod in https://github.com/zeroclaw-labs/zeroclaw/pull/2647

New Contributors

@liangzhang-keepmoving made their first contribution in #1399
@ceeray made their first contribution in #1316
@zhzy0077 made their first contribution in #1412
@bash-develop made their first contribution in #1403
@bitscrafts made their first contribution in #1401
@NanFengCheong made their first contribution in #1245
@Robert-McGinley made their first contribution in #1320
@razrinn made their first contribution in #1419
@amitkot made their first contribution in #1440
@madamak made their first contribution in #1477
@bzivic made their first contribution in #1476
@codewithfourtix made their first contribution in #1296
@izm1chael made their first contribution in #1509
@dmnkhorvath made their first contribution in #1300
@guitaripod made their first contribution in #1628
@athanasiosem made their first contribution in #1634
@haodongnj made their first contribution in #1643
@0xshitcode made their first contribution in #1413
@Mike-7777777 made their first contribution in #1680
@Yihen-Liu made their first contribution in #1940
@cyberpapiii made their first contribution in #1694
@creke made their first contribution in #1961
@ake117 made their first contribution in #2155
@TimStewartJ made their first contribution in #2135
@loydccc made their first contribution in #1923
@weykon made their first contribution in #1922
@peitschie made their first contribution in #2064
@langhuihui made their first contribution in #2195
@maxtongwang made their first contribution in #2262
@boengai made their first contribution in #2059
@feishiheng made their first contribution in #2124
@VirtualHotBar made their first contribution in #2093
@imthedronelord made their first contribution in #2057
@mvxpsd made their first contribution in #2085
@androidshu made their first contribution in #2147
@Ygnas made their first contribution in #1848
@myhkstar made their first contribution in #2380

Full Changelog: v0.1.7...v0.1.8-alpha.1