v1.6.0

What's Changed

• feat(i18n): migrate OIDC bind flow to ResponseErrorL (Part of #170) by @an9xyz in #223
• feat(i18n): externalize email templates + lang-aware send chain (#221) by @an9xyz in #224
• fix(message): apply group revoke permission to community topics (#222) by @an9xyz in #226
• fix(oidc): invalidate current token on logout by @an9xyz in #225
• docs: add rate-limiting guidance to CLAUDE.md by @an9xyz in #228
• feat(octo-server): RichText=14 server adapt — plain gen + push alert + search index (Phase 1) by @yujiawei in #232
• fix: use shared UID limiter for app bot apply by @an9xyz in #234
• feat(robot/bot_api): bot 群级免@偏好——建表 + owner 写/读/列群 + adapter 读端点 by @yujiawei in #238
• feat(incomingwebhook): Discord-style group incoming webhooks by @an9xyz in #31
• feat(robot): mention_pref 写后推 mention_pref_updated 事件 by @yujiawei in #243
• fix(incomingwebhook): address #246 post-merge follow-ups by @an9xyz in #249
• fix(message): RichText=14 plain consistency on edit paths (Phase 1) by @yujiawei in #235
• feat(botfather): UserAPIKeyService + Bot occupancy (bind/unbind) for Octo-link by @an9xyz in #239
• fix(botfather): make #239 migrations idempotent to stop CrashLoopBackOff by @an9xyz in #253
• fix(group): rollback MySQL records when IM channel creation fails during CreateGroup by @pkuWMH in #248
• fix(incomingwebhook): resolve iwh_ sender identity for channel/user/avatar APIs by @an9xyz in #250
• ci: add -shuffle=on to go test for order-dependency detection by @lml2468 in #260
• ci: add timeout-minutes to all CI jobs by @lml2468 in #259
• feat(group): 群级「允许免at」总开关 + bot_api 两轴AND mention_pref by @yujiawei in #263
• feat(incomingwebhook): soft-delete webhooks so deleted webhooks' historical messages still render by @an9xyz in #258
• fix(group): expose allow_no_mention in channel serialization + silent toggle by @yujiawei in #264
• docs: add i18n / error-localization conventions to CLAUDE.md by @an9xyz in #231
• feat: add OIDC integration exchange by @an9xyz in #256
• fix(ci): provision WuKongIM for integration tests by @an9xyz in #270
• docs: add agents guide by @an9xyz in #257
• feat(i18n): migrate robot module to ResponseErrorL (#267) by @an9xyz in #268
• feat(i18n): migrate space module to ResponseErrorL (#269) by @an9xyz in #271
• feat(i18n): migrate small utility modules to ResponseErrorL by @an9xyz in #273
• feat(i18n): propagate language over gRPC by @an9xyz in #275
• feat(i18n): migrate bot_api module to ResponseErrorL (#276) by @an9xyz in #277
• feat(avatar): version avatar object keys for CDN-safe cache busting by @an9xyz in #282
• test: isolate common login config tests by @an9xyz in #283
• ci: add Docker lint workflow (hadolint + shellcheck) by @lml2468 in #262
• ci: add OSV-Scanner vulnerability scanning by @lml2468 in #261
• feat(i18n): migrate botfather module to ResponseErrorL (#278) by @an9xyz in #279
• feat(incomingwebhook): layered push rate limiting (local floor + per-IP failure budget) by @an9xyz in #285
• ci: add history check (reject orphan-branch PRs) by @lml2468 in #286
• feat(incomingwebhook): make local push floor IP-aware to avoid cross-IP starvation by @an9xyz in #288
• feat(sidebar): make recent-tab activity filter configurable per channel type by @an9xyz in #291
• feat(incomingwebhook): runtime master toggle + tunable thresholds via system_setting by @an9xyz in #292
• feat(incomingwebhook): cache the push hot-path lookups (#284 item 2) by @an9xyz in #293
• feat(conversation): opt-in recent activity-window filter on /v1/conversation/sync (#294) by @an9xyz in #295

New Contributors

• @pkuWMH made their first contribution in #248

Full Changelog: v1.5.1...v1.6.0

1.5.1

What's Changed

• feat(oidc): RP-Initiated Logout — backend issues end_session URL on logout @an9xyz (#217)
• feat(i18n): migrate modules/category to ResponseErrorL @an9xyz (#214)
• feat(i18n): migrate modules/workplace to ResponseErrorL @an9xyz (#213)
• feat(i18n): migrate modules/message to ResponseErrorL (Phase 2.1) @an9xyz (#203)
• fix(ci): add ready_for_review to check-sprint trigger types @lml2468 (#212)
• docs: add CLAUDE.md for AI agent coding guidance @yujiawei (#211)
• fix(robot): bot 事件 mention 归一化（strip 裸 mention.all=1） @yujiawei (#210)
• fix(ci): finalize PR notification design (remove octo-pr-feed + fix result-notify) @lml2468 (#209)
• chore(ci): add octo-pr-feed workflow to activate global pr-feed channel @lml2468 (#202)

Full Changelog: v1.5.0...v1.5.1

v1.5.0

What's Changed

• feat(space): extend manager member search to username/email/phone @an9xyz (#200)
• feat(i18n): migrate modules/group to ResponseErrorL (Phase 2.1) @an9xyz (#198)
• chore(botfather): update CLI package name to create-openclaw-octo @caster-Q (#196)
• feat(i18n): complete modules/user migration to ResponseErrorL (manager + friend + login + …) @an9xyz (#197)
• test+ci(i18n): close Phase 0 verification gaps and wire 0.10 migration gates @an9xyz (#193)
• fix(category): allow external-group follow into current-space category @an9xyz (#192)
• feat(i18n): migrate modules/user/api.go to ResponseErrorL (Phase 2.1) @an9xyz (#188)
• fix: restrict review-feed to ready_for_review and review_requested @lml2468 (#190)
• feat(appconfig): admin-tunable disable_user_create_space toggle @an9xyz (#189)
• feat: add pr-review-feed and pr-result-notify caller workflows @lml2468 (#187)
• feat(i18n): AST extractor + marker pipeline @an9xyz (#186)
• feat(voice): add POST /local-config/reset proxy + fix 404 handling @ploy-elison (#184)
• chore(ci): add edited trigger to check-sprint and auto-add workflows @lml2468 (#177)
• feat(user): expose language preference via /v1/user/* API @an9xyz (#182)
• feat(i18n): user language resolver + hot cache + late-stage merge @an9xyz (#181)
• feat(auth): versioned token cache codec + user.language column @an9xyz (#179)
• feat(voice_adapter): local ASR proxy + security hardening @ploy-elison (#180)
• feat: migrate thread errors to localized envelope @an9xyz (#176)
• feat: use OCTO trusted header envs @an9xyz (#178)
• feat: default i18n language to zh-CN @an9xyz (#175)
• feat: add i18n request-side utilities @an9xyz (#172)
• fix: move permissions to workflow top level for pr-contributor-welcome @lml2468 (#169)
• fix(message): add space_memberships sideband on /v1/conversation/sync @an9xyz (#159)
• feat: per-space voice feedback settings API @ploy-elison (#168)
• fix(space): close banned-status TOCTOU on user-side PUT /v1/space/:space_id @an9xyz (#165)
• feat(space): align user-side PUT /v1/space/:space_id with manager endpoint (#163) @an9xyz (#164)
• feat(manager): add PUT /spaces/:space_id to update space profile @an9xyz (#158)
• fix(obo): DM fan-out honors global_enabled without scope rows @yujiawei (#162)
• fix: align issue template labels with repo label naming convention @lml2468 (#156)
• feat: add check-sprint-on-merge workflow @lml2468 (#152)

CI and Infrastructure

• feat: add wkhttp i18n error flow @an9xyz (#174)
• feat(i18n): add codes registry + go-i18n bundle foundation @an9xyz (#171)
• feat(file): add awsS3 backend for AWS S3 and S3-compatible storage @an9xyz (#147)

Full Changelog: v1.4.1...v1.5.0

1.4.1

What's Changed

Bug Fixes

• fix(follow): materialize ext rows for default-followed groups (#151) @an9xyz
• fix(message): backfill resolved space_id in sync conversation/sidebar responses (#153) @yujiawei (#154)

Full Changelog: v1.4.0...v1.4.1

v1.4.0

v1.4.0

Cumulative minor release since v1.3.0. Contains breaking changes — please review the Upgrade notes before deploying.

Highlights

• Persona Clone / OBO v2 — feat(bot_api) v0 backend (#82) → v2 fan-out narrowing, persona_prompt, typing indicators, grant mutex (#109); implicit scope + Gate 4 (#121); adapter-side GET /v1/bot/obo-grant (#136); active toggle on grants (#131).
• OIDC self-service — bind flow for autolink failures (#73); account creation from SSO claims via /bind/create (#93); bind redirect carries provider + Referrer-Policy: no-referrer (#80).
• Auth — new login.local_off system_setting to disable local-account login when full OIDC is configured (#104).
• Voice → octo-speech adapter — modules/voice retired, replaced by modules/voice_adapter calling the external octo-speech service (#113). feedback_url in voice config API (#90), request_id in /transcribe response (#67), per-space voice feedback settings API (#130).
• conv_ext cascade follow — channel → threads cascade with fan-out on new threads (#123).
• Redis TLS — RedisTLS config propagated to all direct go-redis.NewClient call sites (#134).
• Business-error metric — new Prometheus counter dmwork_http_business_error_total via response-body sniffing (#141).
• Mention ingress regularisation — mention.ais=1 is expanded to mention.uids at ingress; bot reminders filtered accordingly (#144). all → ais rewrite removed from mentionrewrite (#143). @所有AI legacy-adapter compat in AIS broadcast fan-out (#138).

⚠️ Upgrade notes (breaking)

• Voice module retired. Deploy octo-speech and set SPEECH_SERVICE_URL / SPEECH_API_KEY (plus optional SPEECH_TIMEOUT, SPEECH_MAX_BODY_SIZE, SPEECH_MAX_CONTEXT_LENGTH, SPEECH_MAX_FILE_SIZE, VOICE_FEEDBACK_PRIVACY_URL). Remove the now-unused VOICE_* / ASR_LOG_* env vars. VOICE_MAX_VOICE_CONTEXT_LENGTH is still read as a fallback for SPEECH_MAX_CONTEXT_LENGTH.
• docker/octo/ and docker/tsdd/ retired. Deployment source-of-truth moves out of this repo — use the dedicated deployment repo / Helm chart instead.
• Schema: user.phone and user.zone restored to NOT NULL (fixes #54). The migration backfills existing NULL rows to '' first, then ALTER MODIFY — no manual action required; ALTER is INSTANT/INPLACE on MySQL 8 InnoDB.
• Toolchain: build image bumped from golang:1.20 to golang:1.25-alpine. Rebuild downstream images.
• OIDC env vars renamed. Use DM_OIDC_PROVIDER_* (issuer / client_id / client_secret / redirect_uri / scopes / require_email_verified / require_pkce / auto_link_by_email / auto_link_by_phone / allow_new_user / clock_skew / http_timeout / sync_interval / sync_concurrency). The legacy DM_OIDC_AEGIS_* aliases are still accepted as fallback. DM_OIDC_RT_ENC_KEY (base64, decodes to 32 bytes) is now required when OIDC is enabled.

What's Changed

• fix(oidc): always serialize masked_email/masked_phone in /bind/info @an9xyz (#149)
• fix(mention): expand mention.ais=1 into mention.uids at ingress chokepoint @yujiawei (#144 / #145)
• feat(metrics): add dmwork_http_business_error_total via response body sniffing @an9xyz (#141)
• refactor(mentionrewrite): remove all→ais rewrite (GH#142) @yujiawei (#143)
• fix(robot): @所有AI 兼容旧 adapter — 在 ais 广播 fan-out 中给每个 bot 的 payload 副本追加 uid 到 mention.uids @yujiawei (#138)
• feat(obo): add GET /v1/bot/obo-grant for adapter-side persona pull @yujiawei (#136)
• fix(obo): add active field to oboUpdateGrantReq — persona toggle switch (#129) @yujiawei (#131)
• feat(user): add per-space voice feedback settings API @ploy-elison (#130)
• chore: add @Mininglamp-OSS/server-maintainers to CODEOWNERS @lml2468 (#128)
• fix(obo_fanout): decodeMentionGate honors mention.humans (Plan X @所有人) (#125) @yujiawei (#126)
• feat(conv_ext): cascade follow channel → threads with fanout on new threads @an9xyz (#123)
• feat(obo): implicit scope + persona_prompt + fan-out Gate 4 @yujiawei (#121)
• fix: add 'dependencies' label to release-drafter config @lml2468 (#120)
• fix: pr-contributor-welcome permission pull-requests:write → issues:write @lml2468 (#119)
• chore: add dependabot config for automated dependency updates @lml2468 (#118)
• fix(obo): fan-out findActiveGrantsForChannel honors global_enabled for groups @yujiawei (#114)
• feat(voice): replace voice module with octo-speech adapter @Jerry-Xin (#113)
• feat(ci): add PR contributor welcome caller @lml2468 (#110)
• feat(obo): v2 fan-out narrowing + persona_prompt + typing + grant mutex @yujiawei (#109)
• fix(ci): use _ for unused loop counter to clear shellcheck SC2034 @lml2468 (#107)
• feat(bot_api): Persona Clone OBO backend v0 (PR-A) @yujiawei (#82)
• fix(ci): use pull_request_target in octo-pr-feed to fix fork PR notifications @lml2468 (#106)
• feat(auth): add login.local_off switch to disable local-account login @an9xyz (#104)
• fix(category): close TOCTOU window in moveGroupToCategory + FollowDM @tongjichao (#79)
• chore(ci): standardize reusable workflow refs to @main @lml2468 (#100)
• feat(oidc): self-service account creation from SSO claims via /bind/create @an9xyz (#93)
• chore(ci): pin octo-issue-feed caller to @v2 @lml2468 (#92)
• feat(ci): simplify octo-issue-feed to new/reopen only @lml2468 (#91)
• feat(ci): add release drafter and gated release publish @lml2468 (#89)
• feat(ci): add CodeQL security scan and Workflow Sanity check @lml2468 (#88)
• feat(voice): add feedback_url to voice config API @ploy-elison (#90)
• fix(ci): replace negation filter with positive-pattern filter @lml2468 (#85)
• fix(pr-feed): use pull_request trigger, pin SHA, add feed_group_id @lml2468 (#59)
• feat(ci): refine CI + add stale and PR labeler @lml2468 (#84)
• fix(oidc): bind redirect carries provider + Referrer-Policy no-referrer @an9xyz (#80)
• feat(oidc): self-service binding for OIDC autolink failures @an9xyz (#73)
• feat(voice): return request_id in transcribe API response @ploy-elison (#67)

CI / Infrastructure

• feat(redis): wire RedisTLS config into direct go-redis NewClient sites @an9xyz (#134)

Full Changelog: v1.3.0...v1.4.0

v1.3.0

What's Changed

Features

• feat(common): allow DB overrides for YAML settings by @an9xyz in #76

Fixes

• fix(user): restore NOT NULL on user.phone / user.zone (issue #54) in #71
• fix(category): unfollow conversations when a category is deleted in #74
• fix(common): rich multipart envelope for /test_email to bypass anti-spam silent drops in #78

Full Changelog: v1.2.0...v1.3.0