ZeroClaw v0.8.6

ZeroClaw v0.8.6 is a plugin, identity, and runtime-ownership release spanning 573 commits from 74 contributors. The seven 64-bit CLI release archives now carry the WebAssembly plugin host, and the plugin registry offers channel and tool packages built for this release. It also adds authenticated principals with OIDC across RPC and the gateway, moves live configuration, events, and agent lifecycle under the daemon, and adds an opt-in minimal built-in tool set while full stays the default. Several security tightenings change defaults; review Breaking Changes before upgrading gateway pairing integrations, remote ZeroCode connections, browser automation, private-network downloads, or plugins built against an earlier WIT, and read Known issues before relying on a plugin channel.

In brief

Plugins now run in the release CLI: install Discord, Telegram, Matrix and ten more by name.

Plus groundwork for OIDC sign-in, multi-session ZeroCode, daemon-owned live config, and new providers and web search.

Highlights

• Plugins work from a stock CLI download: install a channel or tool plugin by name, with no Rust toolchain.
  The seven 64-bit CLI archives for Linux, macOS and Windows carry the WebAssembly plugin host, and
  each one is smoke-tested with a real plugin before publication. The registry offers 13 packages built for
  this release: the Discord, Matrix, Telegram, Bluesky, Gitea, Mattermost, Mochat, Notion, Reddit,
  X (Twitter), WeChat and WeCom channels, and the redact-text tool. Discord passed an end-to-end
  acceptance run from release-candidate CLI archives on Linux, Windows and macOS. Installs grant egress
  up front, check that the plugin loads, bind channel instances, and recover after an interruption;
  updates are verified and staged (#11347, #10999, #11262, #11261, #11236, #11309, #11302, #11098, #10746).
• Tool selection: Full stays the default; minimal is an opt-in [tools] setting.
  Set optional = [] for minimal: eleven built-ins in Chat and eight in Code/ACP,
  or name extras to add to it. Setup and config generation write optional = ["*"],
  and configs without [tools] or optional load full. Existing explicit
  selections are preserved. Prerequisites, permissions, approvals and Code/ACP
  memory exclusions still apply.
• Authenticated principals reach every entry point: RPC, sessions, tools, and memory resolve to canonical principals.
  oidc.<alias> verifies tokens with device, client-credentials, and browser enrollment;
  pairing codes are stronger by default, and reading or minting them needs an owner-only
  admin token (#11082, #10248, #10259, #10263, #10265, #10255, #10307, #11177).
• The daemon owns live state: atomic live config revisions, one event firehose, and coordinated agent lifecycle.
  Configuration publishes atomic revisions with batch writes and reports whether each running
  target applied a change; the observer event firehose and a bounded, replayable subscription hub
  live in the daemon; and agent lifecycle, background delegates, and cost ceilings are coordinated
  in one place (#10911, #10823, #11466, #11131, #11167, #10621, #11292, #10804).
• Chat surfaces and providers expand: multi-session ZeroCode, new channel delivery modes, two providers, three web search backends.
  ZeroCode gains multi-session panes, a combined Sessions/Queue/Plan dock, and standard composer
  editing; Telegram, Matrix, WhatsApp Web, Mattermost, Slack, and QQ gain new delivery modes;
  Crusoe and Hailo-Ollama become providers; and Serply, AnySearch, and Keenable join web search
  (#9739, #10879, #11175, #8561, #10489, #10984, #10358, #10622, #10799, #9338, #9109, #10402, #10356, #10679).

What's New

Plugins

• Ship the WASM plugin host with Cranelift in the seven 64-bit CLI release archives for Linux, macOS and Windows, gate publication on a per-archive plugin smoke test, and raise the release binary size cap from 64 MiB to 80 MiB; the ARM32 and Android archives carry no plugin host. On these archives zeroclaw plugin is a command, and zeroclaw status, /api/plugins and the dashboard report the plugin host as available; plugins stay disabled until the operator enables them. The smoke test does not cover the desktop app bundles (#11347).
• The plugin registry lists 15 versions of 13 packages built for this release's plugin contract. Published versions that do not install on v0.8.6 were withdrawn, so the registry no longer offers a package that fails the install-time load check.
• Add zeroclaw plugin update with verified, staged replacement of an installed package, and recover incomplete installs through plugin remove (#11262, #11261, #11236).
• Install and activate tool plugins from zeroclaw quickstart, bind channel instances and seed their grants at install, and grant egress at install with a report of whether the plugin loads (#11309, #11302, #11098).
• Load-verify a plugin at install, add plugin install --no-verify, and give egress denials a ready-to-run fix (#10746, #11107).
• Add host-mediated sockets, WebSocket, named TLS profiles, and durable plugin state, and harden TLS profile materialization (#11081, #11228).
• Sign a manifest document in one step, admit exact component payload bytes, and open admitted payloads from the retained package root (#11310, #9134, #11232).
• Add the gateway and dashboard capability catalog, the package catalog in plugin list, typed event routing, and a durable scheduler outbox (#8909, #8908, #9138, #9139).
• Add governed plugin webhook ingress with typed challenge replies, admit channel mirrors declared by manifest provides, govern channel plugin egress, and report a plugin channel's own health in /health (#8862, #8949, #11178, #10750, #11348).
• Refuse plugin tool names in the MCP <server>__<tool> namespace, bound registry requests, read the machine trust store for plugin HTTPS, and replace a channel plugin's instance after a trap (#11785, #11581, #10491, #11356).

Security and Identity

• Land the OIDC principal stack: canonical principals and shared grant resolution, authenticated principals on RPC with native and peer-credential providers, principal tool selectors in agent sessions, principal-owned sessions, private principal memory, and the oidc.<alias> token-verification provider with device, client-credentials, and browser PKCE enrollment (#11082, #10248, #10259, #10263, #10265, #10255).
• Retire the unwired Nevis integration and remove a leftover [security.nevis] table on the next incremental save (#11191).
• Require an owner-only admin token to read or mint pairing codes, use one shared pairing-code policy with a stronger default, and share one inbound-auth state between the gateway and RPC (#11177, #10307, #11202).
• Bind RPC sessions to the canonical authorized workspace, keep session environments immutable, revalidate forwarded environments on reuse, and fence remote session resumes and session/configure on the authorized incarnation (#11112, #11222, #11133, #10246, #11330).
• Gate file_download against SSRF with an explicit private-host opt-in, confine filesystem mutations to the workspace, and honor allowed roots for Git operations and in Seatbelt (#10070, #9977, #10337, #10556).
• Make full browser automation a separate opt-in from browser_open, keep always_ask in force under Full autonomy, enforce bounded child tool approvals, and apply the caller's tool-name filter to background bounded delegation (#9830, #9724, #10937, #11797).
• Require sender authorization for LINE groups, Bluesky, and Reddit (#9427, #9428).
• Harden Git shell policy arguments and the risk classifier, resolve host launchers before the workspace cwd, and stop presenting command execution as audited (#9678, #9635, #11029, #10381, #9410).
• Patch Wasmtime, Rustls, quinn-proto, and negentropy advisories, remove vulnerable ruzstd through probe-rs 0.32, and make the Docker sandbox image configurable (#11755, #11475, #11253, #11795, #11678, #11715, #10745).

Runtime, RPC, and Daemon

• Publish atomic live configuration revisions, add config/set-many for atomic batch writes, and report each running target's application result for a changed path (#10911, #10823, #11466).
• Own the observer event firehose, the pricing refresher, and the gateway-start hook in the daemon, and serve subscriptions from a bounded, replayable hub (#11131, #11164, #11167).
• Bound the local RPC transport, add chunked uploads, and reach turn parity over RPC for steering, totals, and session operations (#11171, #11132).
• Deliver mid-turn steering at the next step instead of after the final answer, and keep each steering message's own source facts for auto-save and the transcript (#11725, #11181).
• Coordinate agent lifecycle mutations, persist peer-agent inbox turns, report live progress for background delegates, and route independent child approvals to the target operator (#10621, #11045, #11292, #11462).
• Enforce execution-tree iteration budgets, scope cost tracking into delegated sub-loops with per-agent ceilings, and price cache writes at the configured write premium (#10351, #10804, #10716).
• Add opt-in single-tool provider rounds with runtime_profiles.<profile>.single_tool_rounds (#11467).
• Add opt-in effort-aware routing with runtime_profiles.<profile>.effort_routing: simple and ambiguous turns stay on the configured local route, a complex turn uses the cloud route only with cloud_escalation = "auto", and every provider attempt for the turn, including fallback and vision routing, stays within the chosen route (#11516).
• Anchor context compaction to the model window ratio, trim history to a low-water target, enforce a compact local prompt budget, and estimate context usage when a provider omits token counts (#9535, #10696, #10465, #9453).
• Separate cron run outcomes behind an internal-principal envelope, and add a typed stop taxonomy for turn-path aborts (#10425, #10504).
• Detect the platform default shell and shell output encoding, initialize PowerShell output as UTF-8, and expose the shell profile in status (#10956, #10955, #10954, #10354).
• Add entry-count log rotation with multi-segment queries, and stamp daemon and relay binaries with their build commit (#10214, #11196).
• Fingerprint the system and tools prompt prefix on llm_request events, expose token accounting on history-trim events, and attribute cost ledger records to the chat conversation (#10990, #9713, #10718).

Tools, Skills, and Memory

• Select built-in tools with [tools].optional: full (["*"]) stays the default and is what setup and config generation write; optional = [] selects minimal, eleven built-ins in Chat and eight in Code/ACP; named entries add extras to minimal (#11221).
• Native tool names take precedence over conflicting plugin tools in executable and captured tool views (#11221).
• Add a typed built-in tool inventory with tier ratchets, and defer built-in schemas through tool_search (#11308, #11473).
• Give tools a cooperative cancellation context through Tool::execute_with_context; existing execute implementations keep working (#11465).
• Add the Serply, AnySearch, and Keenable web search providers (#10402, #10356, #10679).
• Install skills from pinned well-known discovery indexes (#10944).
• Export an agent to a portable bundle with zeroclaw agents export (#9986).
• Add an outbound A2A client with a shared wire model and tools, and category-scoped cross-agent memory grants (#9324, #10252).
• Stamp recalled memory entries with their storage date ([from YYYY-MM-DD]); set memory.recall_date_stamp = false for the previous format (#10567).
• Decompress gzip, brotli, and deflate web_fetch responses, prefer attachments for large generated artifacts, and declare tool attachments explicitly (#9283, #11509, #10938).
• Materialize MCP image tool results into the multimodal pipeline and render one summary line per tool in the deferred MCP index (#10566, #10845).

Providers

• Add Crusoe Managed Inference as an OpenAI-compatible provider family and native Hailo-Ollama support (#9338, #9109).
• Pass Anthropic extended thinking and prompt-cache markers through OpenAI-compatible gateways, add a configurable Anthropic cache_ttl, and forward reasoning_effort through an opt-in passthrough (#10605, #10623, #10724, #10916).
• Handle Anthropic refusals with fallback notices, carry live provider identity on usage events, and resolve the context window from the serving provider (#9272, #8966).
• Default multimodal.max_image_size_mb to the 20 MiB ceiling (#10589).

ZeroCode, Dashboard, and Web

• Add multi-session panes with an agent sidebar and sidebar-launched Quickstart, combine Sessions, Queue, and Plan in one dock, and drag session rows or switch sessions by number (#9739, #10879, #11573).
• Add standard composer editing, add selected text to chat, make transcript URLs clickable, and expand tool transcript cards (#11175, #10553, #10386, #10295).
• Show whether a Config change was saved and whether each running target applied it, and rename provider aliases in Config (#11506, #11460).
• Inspect foreground subagent tasks, make session roots explicit, and report turn state to the terminal over OSC title and progress (#11446, #11044, #9876).
• Edit secret key/value maps in ZeroCode and the dashboard, add the Oxocarbon dark theme, and add /upload to open the image picker (#11419, #11719, #10578).
• Paginate persisted ACP transcripts and select a standalone default ACP agent (#10596, #9638).
• Surface Code session-history versus persistent-memory isolation, and localize runtime integration info, ZeroCode config metadata, daemon readiness diagnostics, status fragments, and chat setup guidance (#9341, #10472, #10378, #10848, #8546, #11496, #11028).

Channels and Gateway

• Add Telegram multi_message streaming, a secure model picker, a per_user_session toggle for shared group chats, and passive group context (#8561, #9997, #9772, #10640).
• Deliver Matrix voice replies as MSC3245 voice notes and answer a mirror peer's voice message with a voice note (#10489, #11007).
• Post native WhatsApp Web polls, attach PDF and image previews, and render outbound Markdown in WhatsApp's dialect (#10984, #10980, #10982, #10475).
• Add Mattermost approval prompts and inject the channel purpose, accept Slack bot and workflow messages on request, and deliver one-off sends and cron output to QQ (#10358, #10946, #10622, #10799).
• Expose opt-in model fallback notices, stamp external ingress provenance, and show tool-call batch position on approval cards (#11464, #10907, #10004).
• Stream webhook chat turns over Server-Sent Events, and keep the agent turn running when the chat WebSocket disconnects (#10450, #10538).

SOP

• Choose conditional steps with the decision model, and gate triggers and execution mode with selectable decision models (#11134, #11085).
• Add interoperable run logs and trigger deduplication, return full step results from sops/run-detail, and rename a SOP atomically from the web editor (#10155, #9930, #10233, #10527).
• Drive headless SOP runs and webhook-started SOP agent steps to completion (#9841, #10813, #11083).

ZeroRelay

• Add self-serve enrollment with relay claim and a relay-terminated browser enrollment front door that prefills from ?node=&code= links (#10592, #10525, #11089).

Installation, Documentation, and Release Engineering

• Standard dist builds add the plugin host and Cranelift on the seven native 64-bit targets. Native compatibility adapters stay compiled in, plugin activation, trust and grants remain explicit, and the ten-target archive matrix and names are unchanged; Android remains experimental (#11347, #11221).
• Verify crates before the GitHub Release, block version bumps whose crates cannot publish, recover crates.io publishes with current tooling, and fail closed during version preparation (#11091, #11095, #11105, #10817).
• Compose the X and Discord announcements from the release notes, and measure release binary bytes per footprint profile (#10727, #11306, #10372).
• Add a canonical release target registry, build the web UI as a Nix package, and restore the nix run installation path (#10590, #11041, #10936).
• Gate WebSocket, email, IRC TLS, and tool dependencies behind the channel features that need them, so builds without those channels compile less; share one config snapshot across the tool registry build; and update matrix-sdk 0.19, rusqlite 0.40, and OpenTelemetry 0.33 (#10467, #10493, #11032, #10771, #11065).
• Generate llms.txt and llms-full.txt in the docs build and promote stable docs metadata without rebuilding (#10840, #10818, #11109).
• Document the WeCom channel, local model selection with llmfit, Astra API and Codex setup, and Parallel Search configuration (#10639, #11008, #10945, #10631).
• Document Build Remote Agent phone pairing, reload-refusal recovery by platform, experimental WIT version skew, the webhook-ingress capability flag, tool tiers, and the supported release line; move the multi-agent guide under Agents; correct plugin name-conflict and lean-build guidance, restore the private memory plane section, define the webhook audit argument byte limit, and show how ZeroClaw identifies itself to Parallel (#10283, #10847, #10507, #10839, #11305, #10765, #11114, #11284, #11190, #10806, #10917).

Bug Fixes

Breaking Changes

• Pairing codes are longer and admin-gated. Codes default to 32 case-sensitive alphanumeric characters instead of six digits; treat them as opaque, variable-width strings, or set [gateway.pairing_code] length = 6, charset = "numeric" for the old shape (#10307). The dashboard no longer pre-fills the first-run code: read it from the startup banner or run zeroclaw gateway get-paircode on the gateway host as the gateway's user, and send x-zeroclaw-admin-token from <data_dir>/gateway-admin.token when calling /admin/paircode directly (#11177).
• Remote WSS requires authentication. A remote ZeroCode connection must present auth_token (or ZEROCLAW_AUTH_TOKEN, or auth_token_file); pair with the gateway to obtain one. [security.nevis] is ignored and removed on the next incremental save; move to [oidc.<alias>] and [permission_profiles] (#11082, #11121, #11191).
• Browser automation is a separate opt-in. [browser] enabled = true no longer implies the browser automation tool; set browser.automation_enabled = true. browser_open is unchanged (#9830).
• file_download refuses private-network hosts. Add internal endpoints to [file_download] allowed_private_hosts; cloud metadata hosts stay blocked, and proxy-only egress needs a direct path (#10070).
• Filesystem and Git tools stay inside allowed roots. Writes outside the workspace and to special files such as /dev/null are rejected, and Git operations that escape an allowed root are refused (#9977, #10337).
• Approvals tighten. Full autonomy no longer overrides always_ask (#9724). A distinct approval route that sets approver_channel must also set approver_recipient, and an Always approval no longer carries into later turns (#10241). Bounded delegate children need retained tools in the target profile's auto_approve, and a background bounded delegate gets only the tools its caller may use (#10937, #11797).
• The shell follows the platform default. ZeroClaw now detects the platform's default shell; set runtime.shell = "sh" to keep a prior Unix choice or runtime.shell = "cmd" to keep Windows cmd behavior (#10956).
• Sandboxes fail closed. A Seatbelt initialization failure now stops the command instead of running it unsandboxed (#10556, #11499). Firejail and Bubblewrap shell-identity preservation needs a validated GNU env helper on the host PATH, and manifest-installed hardware plugins no longer inherit arbitrary environment variables (#10381, #10093).
• Unsafe SQLite files are refused. On Unix, memory, response-cache, and audit databases (and their -wal/-shm files) that are symlinks, hardlinked, foreign-owned, or group/world-accessible are rejected; stop ZeroClaw, make each file a private regular file owned by the service user, then restart (#10835).
• Windows service installs need a one-time reinstall for bounded logs. Disable the task (schtasks /Change /TN "ZeroClaw Daemon" /Disable), reboot, then run zeroclaw service install again (#10931).
• Upgrade ZeroCode together with the daemon. An older ZeroCode cannot read config/list once it contains secret-map entries (#11419).
• Peer-agent sends need a writable data directory. Sends now register a durable task before dispatch and fail closed without one (#11045).
• Grok resolves from an absolute path. Configure an absolute path to the Grok executable, or keep it in an absolute PATH directory (#10829).
• Matrix answers voice with voice. Set output_modality = "text" on a group to keep text-only replies (#11007).
• LINE groups, Bluesky, and Reddit require sender authorization. Add allowed senders to a [peer_groups.<name>] entry for that channel (#9427, #9428).
• max_history_messages counts whole turns. Review values that were set as raw-row caps; raising max_tool_iterations no longer raises the derived history cap (#9368).
• Plugins built for v0.8.5 may need a rebuild. Channel components must be rebuilt against this release's experimental wit/v0 (#8862, #8949); precompiled .cwasm artifacts must be recompiled for Wasmtime 48 (#11475); plugin install refuses a component that does not instantiate unless --no-verify is passed (#10746); strict-mode manifests require wasm_sha256 (#9134); and plugin info exits non-zero for an unknown plugin or one that does not load (#11098). The experimental /api/plugins response now returns package rows (#8909).
• Registry channel packages installed before v0.8.6 do not load on it. Those versions were withdrawn from the registry. Remove each one, install the current version by name with --channel-alias, and set its values again under the instance key: the new versions no longer read [channels.<name>.*], and credentials go through the masked zeroclaw config set prompt. Each package's README has the exact commands.
• Inbound A2A uses the v1 method. The legacy message/send method is renamed to SendMessage with the v1 payload shape (#9324).
• Gateway config PATCH needs real secret values. Send the actual secret for add or replace, and a remove operation to clear one (#10455).
• ZeroCode's Primary+A and Control+A select all composer text. Use /attach or a custom chord for the file browser (#11175).
• Dormant DORA telemetry is retired. Remove queries for the five retired Prometheus metric families; Rust consumers must drop DoraCollector and DoraSnapshot (#9451).
• Rust API changes in published crates. cargo-semver-checks against crates.io 0.8.5 finds public-API breaks in 15 of the 24 published crates. Notable ones: zeroclaw-api drops Principal's user_id, roles, scopes and allowed_aliases fields and its builder methods, drops the AuthOutcome::Authenticated/Trusted variants and the DORA observer variants, and makes DenyReason and TurnEvent #[non_exhaustive] (#10248, #9451, #8966). zeroclaw-config removes NevisConfig and changes the PairingGuard constructor and code-generation signatures (#11082, #10307). zeroclaw-runtime, zeroclaw-gateway and zeroclaw-channels remove or re-sign internal-facing modules and functions, and RpcTransport gains a required kind method. The zerocode library now exports only its keymap (#10120). Many public structs and exhaustive enums gained fields or variants, so downstream struct literals and exhaustive matches must update. Direct zeroclaw-config dependents that need WebSocket transport must enable ws-transport (#10467).

Known issues

These issues ship in v0.8.6 and are tracked for the next release. None of them weakens a security check; where behaviour is affected, it fails closed.

• The daemon can refuse a group-writable data directory. Under umask 0002, which many Linux distributions set for user-private groups, ZeroClaw creates its data directory as 0775 and the daemon then refuses it with "config lifecycle directory is writable by other users (mode 775)". A data directory left 0775 by v0.8.5 is refused the same way. Remove group and other write access from the directory the message names, then start again: chmod go-w ~/.zeroclaw/data for the default location, or chmod go-w <path> with the path from the message. A fix is in review (#11803).
• A silent first address can stall a plugin's connection. The plugin host tries a destination's resolved addresses one at a time, so when the first one never answers, typically an IPv6 route that drops packets, the connection waits out its timeout and the other addresses, including IPv4, are never tried. Requests then fail as call timeouts while other programs reach the service. Fix or disable the broken route on the host (#11813).
• The host does not record refused WebSocket and socket connections. A plugin's WebSocket or socket connection to a destination its instance has not been granted is refused, but only HTTP refusals write a plugin_egress_denied record with the host and a remedy. For the other two transports only the plugin's own log shows the refusal; Discord logs gateway connect failed {error: destination-denied, ...}. The host record follows in v0.8.7 (#11304).
• A plugin channel that never reaches its service can stay quiet. A channel package such as telegram that cannot reach its server, or whose credential is refused, logs nothing about it at the default level. /health reports its component (channel:plugin.<alias>) as starting with last_ok: null for as long as no exchange has succeeded, so treat a component that stays starting as unreachable or misconfigured, and check its egress grant and credential.
• Ten registry channel packages have not run against their live services. bluesky, gitea, mattermost, mochat, notion, reddit, telegram, twitter, wechat and wecom were ported to this release's plugin contract and checked to install, load, bind, and validate their configuration on a release-candidate build; telegram also ran in a daemon against a local test server. None has run against its live service with a real account yet. Discord has (#10999).
• config set masks every plugin setting. zeroclaw config set plugins.entries.<key>.config.<name> treats every plugin setting as a secret, so it ignores a value given on the command line and opens a masked prompt, and fails without a terminal. Pass --no-interactive with the value for non-secret settings such as guild_ids; keep the masked prompt for credentials.
• plugin remove can delete the wrong directory for a renamed package. Removing a loaded plugin deletes <plugins_dir>/<name>, not the directory the package loaded from. This only matters when a package's directory name differs from its manifest name, and it is unchanged since v0.8.5. plugin update replaces the loaded directory itself and is not affected (#11357).
• Plugin package lock files follow the process umask. The lock and lease files used by install, update and remove can be readable by another local account that can read the plugins directory. Such an account can hold the lock and make those commands fail after 60 seconds. This affects availability only; owner-only (0600) lock files follow in a later release (#11360).
• Discovery that overlaps plugin update can briefly pair old and new files. Discovery reads a package's manifest and component separately, so a discovery during an update can pair the old manifest with the new component until the next discovery. Packages whose manifest declares wasm_sha256 are protected, because admission checks the digest in every signature mode (#11562).
• plugin info and plugin list --verify check only the WIT contract. A plugin whose retained config entry holds values while its manifest declares no config_schema is reported as [loads], but the runtime refuses to load it. plugin update already re-validates retained entries against the new manifest (#11336).
• Install seeds tool egress grants only for http_client. A tool package that requests only websocket_client or socket_client gets no seeded grant and is denied, and plugin list diagnoses gaps only for http_client. No registry tool package is affected (#11552).
• Installing over an installed package is refused. plugin install of a package that is already installed refuses and prints the matching plugin update command. Re-seeding an installed package in place is not available in this release (#10162).
• Registry packages have no versioned WIT compatibility check yet. The registry lists only versions built for this release, and the install-time load check refuses an incompatible package, but a package does not yet declare which host versions it supports (#9624).
• Tool names that register after plugins are not yet checked against plugin names. Plugin tool names in the MCP <server>__<tool> namespace are refused (#11785), and native tool names take precedence over conflicting plugin tools (#11221), but peripheral and skill-defined tools that register after plugins are not yet covered (#11327).
• Slack no longer shows "is thinking…" in ordinary channel threads. Since v0.8.5, an agent mentioned in a channel thread shows only the 👀 acknowledgement reaction until it replies; the status line now appears only in Slack's AI-assistant pane. With stream_drafts = true, progress appears as a draft message that the final answer replaces. The fix is deferred to the next release (#11416).
• The v0.8.6 dist container image follows later. Its arm64 build runs out of memory on the release runners, so this release is not expected to publish dist-v0.8.6, and the floating dist tag stays on v0.8.5 until the image is rebuilt. The v0.8.6, latest, v0.8.6-debian and debian images, for amd64 and arm64, carry the same features, repackaged from the release archives; use one of them in the meantime (#11828).

Binary size

Release binary bytes per target, as printed by each build job's binary size check. v0.8.5 comes from its release run; v0.8.6 from a dist Cross-Platform Build of a release candidate (run 39001999557, 61a2c951d1). The seven 64-bit targets gain the WebAssembly plugin host with Cranelift; the ARM32 and Android binaries carry no plugin host. The release size cap rises from 64 MiB to 80 MiB (#11347); the largest binary, x86_64 Linux musl, is 76,241,040 bytes, 7.29 MiB under it.

target                               v0.8.5      v0.8.6       delta  delta %  plugin host
x86_64-unknown-linux-gnu         61,537,880  76,200,840 +14,662,960   +23.8%  yes
x86_64-unknown-linux-musl        61,572,272  76,241,040 +14,668,768   +23.8%  yes
aarch64-unknown-linux-gnu        44,667,752  55,584,592 +10,916,840   +24.4%  yes
aarch64-unknown-linux-musl       41,238,784  51,438,816 +10,200,032   +24.7%  yes
x86_64-apple-darwin              51,919,432  63,993,384 +12,073,952   +23.3%  yes
aarch64-apple-darwin             34,434,096  42,561,168  +8,127,072   +23.6%  yes
x86_64-pc-windows-msvc           51,867,648  64,100,352 +12,232,704   +23.6%  yes
armv7-unknown-linux-gnueabihf    47,397,720  52,747,620  +5,349,900   +11.3%  no
arm-unknown-linux-gnueabihf      47,741,784  53,087,588  +5,345,804   +11.2%  no
aarch64-linux-android            41,166,488  45,264,216  +4,097,728   +10.0%  no

Contributors

@Aarlington
@abhinavmathur-atlan
@alucryd
@AngryPacifist
@aprint2008-sys
@ATECHPCS
@atirna
@Audacity88
@be-student
@chekolyn
@ConYel
@cryptoduke01
@drbparadise
@egorchenkov
@eugeneb50
@Franklin-Qi
@georgeatparallel
@ggettert
@googio
@grrowl
@h03-xydt
@iceHub82
@IftekharUddin
@ilya-bogin-keenable
@joalvaradon
@JordanTheJet
@joshuavetos
@jstar0
@jxxralf
@kckylechen1
@kingstar001
@kizito917
@kouhe3
@Leon-SK668
@LinespottingPrivate
@linhongyu510
@LiuwqGit
@lucaszhuang1210
@ludflu
@Lusitaniae
@MannXo
@metalmon
@minato32
@morningstarnasser
@mov-xound-glitch
@NiuBlibing
@pederbe
@perlowja
@Project516
@realadme
@rifuki
@rtimush
@RustLangLatam
@sbenedetto
@sebkraemer
@SheaHawkins
@singlerider
@Stalesamy
@sunlit-deng
@thorstenweber83
@tidux
@tmielika
@tmigone
@tunglambk
@ump45nose
@vikng-dev
@VladimirLewisII
@volodkindv
@vrurg
@wangmiao0668000666
@wromansky
@Xixiartemis
@Xscaperrr
@ZiBibro

Full Changelog

The 573-commit range contains 132 feature, 283 fix, 14 refactor, 12 performance, 56 documentation, 19 CI, 44 test, and 13 chore commits. Internal maintenance entries are grouped above when user-visible and remain available individually in the full comparison.

Full diff: Compare v0.8.5...v0.8.6

Verify SLSA Provenance

Release payloads have GitHub-hosted SLSA v1.0 Build Level 2 provenance attestations.
Provenance proves build origin and instructions, not human review or immunity from
maintainer-account, runner, dependency, or GitHub control-plane compromise.

Online

gh attestation verify <artifact> \
  --repo zeroclaw-labs/zeroclaw \
  --signer-workflow zeroclaw-labs/zeroclaw/.github/workflows/release-stable-manual.yml \
  --source-digest c473221313341a853e04122f93bb9bd26b5e6c47

Offline
In a connected staging environment, download <artifact>, SHA256SUMS, and
zeroclaw-v0.8.6-verification.tar.gz. Verify the archive and checksums online:

gh attestation verify zeroclaw-v0.8.6-verification.tar.gz \
  --repo zeroclaw-labs/zeroclaw \
  --signer-workflow zeroclaw-labs/zeroclaw/.github/workflows/release-stable-manual.yml \
  --source-digest c473221313341a853e04122f93bb9bd26b5e6c47
gh attestation verify SHA256SUMS \
  --repo zeroclaw-labs/zeroclaw \
  --signer-workflow zeroclaw-labs/zeroclaw/.github/workflows/release-stable-manual.yml \
  --source-digest c473221313341a853e04122f93bb9bd26b5e6c47
awk -v file="zeroclaw-v0.8.6-verification.tar.gz" '$2 == file { print }' SHA256SUMS | sha256sum -c -
mkdir verification
tar -xzf zeroclaw-v0.8.6-verification.tar.gz -C verification

Move those files into the offline environment, then run:

gh attestation verify <artifact> \
  --repo zeroclaw-labs/zeroclaw \
  --signer-workflow zeroclaw-labs/zeroclaw/.github/workflows/release-stable-manual.yml \
  --source-digest c473221313341a853e04122f93bb9bd26b5e6c47 \
  --bundle verification/<artifact>.attestation.jsonl \
  --custom-trusted-root verification/trusted_root.jsonl

Install gh: https://cli.github.com/