v0.2.0

0.2.0 (2026-04-01)

Feature

• mcp: hybrid search mode — keep first 40 tools inline, defer rest (f623ef9)
• kg: expand entity types and improve extraction prompt (c49952a)
• providers: add tool schema normalization for MCP tools (09a7823)
• kg: enlarge entity detail dialog with table/graph tabs (3705891)
• kg: bidirectional multi-hop traversal (b99f119)
• workspace: leader dual workspace with auto-copy to team on delegate (36b43ed)
• telegram: /subagents commands + functional options refactor (nextlevelbuilder#600) (63878b1)
• subagent: token tracking, edition limits, waitAll, auto-retry, producer-consumer announce (nextlevelbuilder#600) (2c1ef25)
• store: persist subagent tasks to PostgreSQL (nextlevelbuilder#600) (d8fc97e)
• structured compaction summary with identifier preservation (0f6cebc)
• cap tool output at source + improve context pruning pipeline (ab5bad1)
• add capability-aware reasoning effort controls (nextlevelbuilder#593) (3ca3bb2)
• ui: enhance knowledge graph with depth visualization and performance fixes (nextlevelbuilder#572) (540fc5e)
• cron: add stateless mode + promote payload fields to columns (3a6c639)
• merge pipeline, per-user credentials, unified picker, group contacts (21b6c45)
• standalone Import & Export page with Teams, Agents, Skills & MCP (db7a34e)
• providers: add provider-level Codex pool activity monitor (nextlevelbuilder#539) (a524b45)
• kg: add tsvector FTS, entity deduplication, and embedding fixes (2e869f4)
• providers: add Novita AI as new LLM provider (nextlevelbuilder#444) (bd14110)
• web: add KG extraction settings to system settings modal and tighten code block spacing (db03bf9)
• cancel: add run.cancelled event and fix stop across web UI, desktop, and channels (8b75e09)
• mcp: add reconnect button to evict stale MCP connections (243656a)
• web: pre-fill "system" user ID on login form with hint note (0cfe580)
• desktop: add DB reset in About tab + complete onboarding i18n (407b2a3)
• desktop: add language switcher to onboarding setup screen (8beb720)
• team: share leader memory with team members (read-only) (ee9f5b8)
• desktop: add channel management, paired devices, and multiple fixes (6ea9b4d)
• desktop: add Storage management tab in Settings (3c1baec)
• desktop: show version + check update button in sidebar header (1efec43)
• desktop: team settings modal, task detail attachments, shared icons (5e936eb)
• telegram: lazy-resolve media from pending history on mention (ffb6786)
• desktop: packaging, auto-update, CI/CD, and install scripts (b9c1731)
• providers: support Codex OAuth pools with inherited routing defaults (30708ae)
• SQLite desktop edition — full desktop app with team tasks (nextlevelbuilder#505) (e183b45)
• telegram: add yield mention mode for multi-bot group support (nextlevelbuilder#471) (0dab087)
• agent: exclude MCP bridge tools from read-only streak detector (nextlevelbuilder#400) (6959ea7)
• ui: add stop button for running traces (nextlevelbuilder#481) (709d86c)
• ui: conversation-wide image gallery, layout fix, and session state restore (f94fc15)
• teams: restore active tasks on session switch via teams.tasks.active-by-session RPC (f793bba)
• ui: blob-cached media URLs and proper download links (1355e4e)
• files: add download=true query param for Content-Disposition attachment header (bb74120)
• memory: add chunk overlap support and clean up per-agent config (258e378)
• embedding: data-driven dimension config with multi-provider support (28a17c4)
• browser: add timeout, idle auto-close, and max-pages safety mechanisms (ee4d34a)
• tools: semantic media filenames with LLM-provided hints (5b614da)
• chat: add realtime comment/attachment counters with toggleable task panel (7ad15a3)
• skills: add per-tenant skill config HTTP endpoints (nextlevelbuilder#428) (c516425)
• ui: drag-and-drop file/folder move in Storage and Workspace (ae18f24)
• storage: bump upload limit to 50MB and expand protected dirs (19eef35)
• ui: add file upload to Team Workspace and Storage pages (9ee82be)
• config: add system_configs DB table with per-tenant isolation and System Settings modal (651072a)
• teams: smart post-turn task decision, stale detection, and notification guardrails (aadc4d6)
• ui: add About GoClaw dialog to user menu (nextlevelbuilder#387) (a550a13)
• mcp: allow admin to set user credentials on behalf of any user (83c79d1)
• gateway: add version update checker (nextlevelbuilder#374) (4868f6c)
• ui: show server version in sidebar connection status (cb37383)
• teams: blocker escalation, audit events, review workflow + docs (ae6615d)
• teams: task hints for weak models + force v2 (8d3eb5b)
• login: add theme toggle to login page (nextlevelbuilder#354) (2ac5eb6)
• multi-tenant isolation — complete implementation (nextlevelbuilder#359) (cd02269)
• channels: extract media from replied-to messages across all channels (f8571de)

Bug Fixes

• agent: use DB provider_type for SOUL echo and strict mode detection (2092c50)
• agent: SOUL echo in recency zone for OpenAI/Codex providers (2a94009)
• mcp: require 3 consecutive ping failures before marking server disconnected (ff4d370)
• mcp: prevent LLM hallucination of optional tool parameters (e48ba1d)
• cmd: sanitize followup reminder UTF-8 truncation (nextlevelbuilder#609) (06de8b4)
• ui: summoning modal mode, dialog widths, and MCP refresh animation (aaa56ff)
• kg: merge recursive CTE branches and widen detail dialog (ef0de0d)
• agent: use forward-scan replaceFirstMediaTag for correct multi-ref ordering (1d39626)
• kg: raise extraction temperature from 0.0 to 0.2 (49f51da)
• discord: preserve attachment source URL in media tags (nextlevelbuilder#606) (9ad4a87)
• providers: xAI generation models bypass chat verification (8372298)
• preserve FinishReason on truncated tool calls + ParseError propagation (nextlevelbuilder#605) (a565ad8)
• contacts: consistent sender_id format and show contact_type in UI (4e9ce0e)
• agent: smart delegation prompt + compaction pending state + block team tools in subagents (7d35ee5)
• claude-cli: preserve CLAUDE_CODE_OAUTH_TOKEN in env filter (fe163ec)
• discord: stop typing after successful delivery (nextlevelbuilder#589) (dbc93aa)
• cap tool call IDs to 40 chars via hash-based uniquification (nextlevelbuilder#590) (343b530)
• telegram: add human-like writing instructions for group chats (1dee22a)
• providers: use developer role for native OpenAI endpoints (GPT-4o+) (a47d7f9)
• telegram: retry 429 rate limit errors and preserve stream messages (7fd31c3)
• use agent_key instead of UUID for session tool authorization (nextlevelbuilder#573) (33f975e)
• ui: restore provider-owned Codex pool inherit state (nextlevelbuilder#585) (287946b)
• auto-install deps on skill upload before archiving (nextlevelbuilder#559) (3fe0633)
• clarify container-scoped runtime warnings for minimal images (nextlevelbuilder#395) (4c60dd0)
• memory: guard provider embedding dimensions to 1536 schema (nextlevelbuilder#563) (65d0d62)
• channels: include display name in [From:] annotation for Telegram and WhatsApp (53932cf)
• tools: delivered media tracker prevents duplicate file delivery (nextlevelbuilder#579) (b38a078)
• agents: sync IDENTITY.md Name field on agent rename (nextlevelbuilder#582) (88a5793)
• cron+providers: Run Now stuck fix, type safety, and claude-cli image format (nextlevelbuilder#577, nextlevelbuilder#568) (nextlevelbuilder#580) (0e2db21)
• ui: reduce KG graph INP from 808ms to <100ms (nextlevelbuilder#581) (0ef30ad)
• ui: KG graph review fixes — edge colors, fetch limit, double fitView (989e4f3)
• ui: KG graph perf + theme support + entity limit (88f4fa2)
• agent: group session unresponsive during team task execution (nextlevelbuilder#266) (014f74e)
• agent: add panic recovery to prevent zombie state after agent loop crash (nextlevelbuilder#39) (d102362)
• store: provider CreateProvider uses UPSERT to handle orphaned duplicates (nextlevelbuilder#295) (4ac6115)
• config: MCP env: resolution, channel field filter, orphan provider event, workspace fallback (nextlevelbuilder#348, nextlevelbuilder#297, nextlevelbuilder#295, nextlevelbuilder#431) (bdfc0fa)
• store: session Save() UPSERT fallback, memory index-all user_id header (nextlevelbuilder#379, nextlevelbuilder#517) (8eb4ce6)
• agent: unblock stuck agent on /stop, auto-complete nil-result tasks, graceful shutdown (nextlevelbuilder#527, nextlevelbuilder#504, nextlevelbuilder#39) (ec060ad)
• providers: prevent crash on cancel, capture thinking signature, nil guard (nextlevelbuilder#287, nextlevelbuilder#188, nextlevelbuilder#566, nextlevelbuilder#335) (e1c52cb)
• security: harden env file permissions and block NUL byte injection (nextlevelbuilder#306, nextlevelbuilder#44) (011f5f1)
• config: add GOCLAW_ALLOWED_ORIGINS env var for CORS config (nextlevelbuilder#543) (533ca44)
• add missing MigrateUserDataOnMerge to test stubs (e27c2cc)
• cron: resolve default agent from DB and fix update payload (nextlevelbuilder#549) (nextlevelbuilder#562) (82e86bc)
• Telegram @mention linking + conditional media read prompts (216b8ab)
• dep_scanner false positive — JS import inside Python f-string (nextlevelbuilder#564) (e7afa83)
• propagate TenantID in team task dispatch InboundMessage (7f897fe)
• propagate TenantID in channel InboundMessage for tenant-scoped MCP resolution (nextlevelbuilder#561) (7b066b7)
• secutiry: include tenant ID header in skill upload requests (nextlevelbuilder#558) (4ac9e01)
• ui: combobox viewport flip, multi-user picker, merge data migration (23c227e)
• filter channel team task events from web UI chat (63ed4e9)
• default noisy team notifications to off (4cb6991)
• desktop: use 127.0.0.1 instead of localhost and suppress lite startup logs (nextlevelbuilder#546) (7b42ab0)
• deps: upgrade major packages across web and desktop UIs (b59a623)
• ui: correct context pruning default toggle state (d803539)
• deps: upgrade Vite 6→8, plugin-react 4→6, and patch/minor updates (c5cd1ad)
• security: SSRF validation, path hardening, and dependency CVE fixes (nextlevelbuilder#525) (db41e58)
• cron: harden toggle and scheduler state (nextlevelbuilder#540) (789c961)
• channels: add display_name to session metadata for Feishu, Zalo, Slack (nextlevelbuilder#536) (97f4942)
• i18n: update maxHistoryShare tooltip from 0.75 to 0.85 default (a506b29)
• security: elevate management HTTP routes from Operator to Admin role (028ea8a)
• agent: prevent premature compaction by separating overhead from history tokens (635870a)
• mcp: strip placeholder values from optional tool args and guide LLMs on optional params (f8278cf)
• heartbeat: log provider override and include in trace tags (985d2fa)
• heartbeat: apply provider override from heartbeat config (5c8e0b7)
• cache: heartbeat/cron used UUID in session keys causing stale cache after agent update (175e052)
• build: filter git describe to exclude desktop lite-v* tags (3d84e72)
• tools: harden session tools — phantom sessions, JSON injection, fail-closed checks (c70e50c)
• bus,cron: panic recovery + deadlock fix + unit tests for 9 packages (90b7396)
• web: streaming broken on first chat send due to expectingRunRef race (a780060)
• tools: block message tool self-send to prevent duplicate media delivery (2d344e4)
• agent: broken cache invalidation + WS handler parity gaps (4b6ed8c)
• desktop: allow scrolling long text in chat input (040ced0)
• agent: uniqueness-aware loop detector + auto-fail killed team tasks (nextlevelbuilder#506) (40e32cf)
• web: sign media_refs paths in session history delivery (nextlevelbuilder#519) (nextlevelbuilder#520) (8b5a05a)
• docker: restore base capabilities in sandbox overlay (nextlevelbuilder#523) (6bfad07)
• kg: add 3-tier fallback for traversal + cap output limits (06ee648)
• desktop: fix media chain settings not editable on reopen + add drag-drop (ea60397)
• sqlite: bootstrap not running on first chat due to per-connection PRAGMA gap (b088144)
• desktop: fetch up to 100 releases to find lite-v* tags (b373561)
• desktop: keep PowerShell window open on install errors (e1b8217)
• security: harden MCP bridge tenant_id propagation (d9087fd)
• propagate tenant_id through MCP bridge for memory indexing (nextlevelbuilder#512) (6551c2d)
• desktop: increase media thumbnail height from 160px to 288px (f4f050b)
• agent: raise default compaction threshold from 75% to 85% (0b8366b)
• ui: show env var input section for manual CLI credentials (nextlevelbuilder#514) (c0dfea3)
• zalo: update API version, batch group fetch, fix WS decrypt (nextlevelbuilder#516) (be9044c)
• agent: channel-aware tool filtering, group chat title in system prompt (7f796b0)
• address code review findings (critical + high + medium) (8b08dec)
• telegram: inject tenant_id into command handler context (5f5b0c4)
• desktop: fix pairing time scan, i18n keys, convert advanced to tab (0b3be86)
• pairing: broadcast pairing events for SQLite stores, not just PG (2ba883a)
• telegram: prevent duplicate messages in groups when streaming disabled (2bc0f5f)
• bootstrap: ensure per-user context files are seeded for all agent types (23c4325)
• ui: remove USER_PREDEFINED from summoning, refine canvas dots, require team members (343ad0c)
• teams: update post-turn comment to match simplified auto-complete logic (39ffe6e)
• teams: simplify post-turn task action fallback to auto-complete (5ed86b8)
• desktop: move version into Lite badge, remove check update button (22dc87a)
• vision: restore context fallback for read_image in file-ref mode (2f31db4)
• bootstrap: predefined agents now reliably complete USER.md onboarding (7eea004)
• docker: remove manual network creation causing Compose label mismatch (nextlevelbuilder#513) (30bf66d)
• vision: file-ref mode + media pipeline fixes for image visibility (nextlevelbuilder#511) (231bc96)
• ui: stop logout on method-level UNAUTHORIZED, align TTS route guard (nextlevelbuilder#502) (4dafd70)
• feishu reply context truncation + task events NULL data crash (nextlevelbuilder#508) (9e74974)
• desktop: image rendering for Windows paths and MEDIA: prefix (2c94e80)
• desktop: make update banner action buttons easier to click (0292440)
• desktop: default theme to light mode for fresh installs (622e405)
• scripts: auto-launch app after install on macOS and Windows (4102d4f)
• teams: persist leader media as DB attachments on task creation (07f43ca)
• team: improve leader task decomposition guidance for weaker models (865f724)
• gateway: resolve tenant switch mismatch for non-owner users (1c2dd4f)
• sqlitestore: add ListCodexPoolSpans stub for TracingStore interface (9d2aeb7)
• ci: use macos-14 for both arch builds (macos-13 deprecated) (1fdc4d3)
• desktop: improve Windows install script error handling (c2cb37a)
• desktop: install script pipefail on missing release (e5175a0)
• providers: post-merge fixes for Codex OAuth pools (nextlevelbuilder#450) (74dc086)
• teams: gracefully handle task status races in progress/complete (731a982)
• zalo: panic on sync.Map.CompareAndDelete with uncomparable CancelFunc (nextlevelbuilder#491) (17a7359)
• skills: enforce tenant isolation in skill upload, versioning, and grants (9168e4b)
• channels: inject tenant scope in resolveAgentUUID for Telegram and Discord (b178f84)
• providers: handle 127.0.0.1 in Docker rewrite and add Ollama host fallback (6a1e1b9)
• providers: register Ollama in-memory on HTTP create, Docker localhost rewrite (nextlevelbuilder#483) (19498bf)
• http: add missing fields to update allowlists (nextlevelbuilder#479) (2445192)
• ui: add loading state to trace stop button and reorder hooks (f31b9eb)
• workspace: fix file move bugs, migrate DnD to @dnd-kit (4d31fe0)
• skills: per-tenant skill toggle for non-master tenants (31c41da)
• media: save browser screenshots and TTS audio to workspace instead of /tmp (da98a54)
• docs: correct license badge and text to match CC BY-NC 4.0 (fabec18)
• ui: strip query params from file block name for display and extension detection (afbecd3)
• chat: isolate WS chat events by channel and session key (f0b5b61)
• message: strip embedded MEDIA: paths and add cross-tenant channel validation (cfb587e)
• files: heal bare workspace paths and deduplicate media gallery vs markdown (4c987af)
• ui: use deduped content in RichContent fast path (2086927)
• files: heal legacy media URLs and deduplicate file references (4a692d5)
• files: strip stale ft= tokens from legacy session data before re-signing (02f024b)
• gateway: prevent double /v1/files/ prefix in media URLs (5f1658c)
• gateway: add nil guard in handler registration loop (0609b0c)
• agents: let owners inherit tenant_id from auth context on create (bc958f6)
• security: add tenant membership check to tenant-config endpoints (a9aedc8)
• store: use (v, ok) pattern for bool context accessors with RunContext fallback (db0f622)
• gateway: sign file URLs in run.completed events for real-time display (d3a4398)
• pkg-helper: restore group ownership on apk-packages persist file (nextlevelbuilder#456) (18824f8)
• ui: session detail missing tool calls, memory dialog toast errors (nextlevelbuilder#458) (95ce420)
• docker: harden credential sync and move CLI mount to overlay (1f72f0d)
• store: restore alias validation guard in WhereClauseAlias (2ce975a)
• agent: restore iteration key in slog, event payloads, and LLM prompts (ebef195)
• docker: auto-sync host Claude CLI credentials and show Docker-aware login instructions (nextlevelbuilder#398) (d63a7d4)
• ui: capture active folder for storage upload target (0a57678)
• store: add missing WithAgentKey context function (b221ed2)
• http: inject tenant context in ServeHTTP handlers for multi-tenant isolation (781ed2a)
• slack: prevent app_mention from blocking message handler dedup key (68406f4)
• slack: enable thread-based session isolation for DMs (AI Panel support) (nextlevelbuilder#449) (6bfbfe0)
• agent: set TenantID on streaming events in runLoop emitRun (nextlevelbuilder#445) (00db30c)
• add panic recovery to tool, cron, and summarization goroutines (nextlevelbuilder#420) (af3fe2f)
• clear cron session in DB when not cached (cold-cache after restart) (nextlevelbuilder#424) (ebc82d3)
• ui: scope API key create dialog to current tenant only (4276c04)
• ui: isolate contact search cache key (nextlevelbuilder#434) (7143dcf)
• http: propagate cross-tenant context in HTTP auth middleware (nextlevelbuilder#427) (39b7c68)
• check errors in cron store Scan and Unmarshal to prevent data corruption (nextlevelbuilder#422) (eab3766)
• agent: strip internal routing tags from outbound delivery (nextlevelbuilder#416) (7fa2d20)
• security: harden MCP bridge auth and add startup security warnings (nextlevelbuilder#306) (c43a8f1)
• telegram: clear draft after materializing DM stream (6a2949d)
• ui: correct license to CC BY-NC 4.0 and move About to header (fe26f2d)
• address 4 bugs from issue nextlevelbuilder#294 — context propagation, cron reliability, crash safety (a7c34a6)
• ui: sync topbar nav item font sizes to text-sm (e2dbd30)
• test: align TestResolveMediaPath with effectiveRestrict hardening (nextlevelbuilder#381) (0755df4)
• vision: fix Lark inline image parsing and MCP bridge read_image (nextlevelbuilder#396) (7db55c6)
• ui: reduce combobox focus ring to match Input component (462727e)
• teams: prevent leader self-assignment causing dual-session loop (5b749fa)
• skills: unblock agent read_file on skill paths and fix web UI file browser (6e80a1a)
• ui: scope setup skip state by tenant (nextlevelbuilder#372) (eaa0aec)
• channels: propagate tenant_id to pending history for compaction/sweep (6b29ea0)
• ui: replace bare crypto.randomUUID with uniqueId fallback and show WS disconnect error (59a52f1)
• channels: extract and download images from Lark post messages (072d98a)
• channels: add periodic sweep for pending message compaction (9aaec59)
• ui: use UTC timestamps and timezone-aware message display (ed840dd)
• ui: use server timestamps for chat messages (nextlevelbuilder#332) (nextlevelbuilder#367) (19d7d86)
• ui: fix cron page crash + redesign detail with markdown (f9b8ae1)
• skills: add missing tenant_id to UpsertSystemSkill INSERT (e156e47)
• address 7 bugs from codebase review (4a03670)
• gateway: prevent panic on send to closed WebSocket client channel (57f249a)
• telegram: resolve getUpdates long-poll timeout race (nextlevelbuilder#361) (2739984)
• security: close shell deny gaps for halt, su, doas, pkexec, runuser (94f6bf2)
• ui: resolve nested button error and stale agentId in chat (0973b84)
• summoning: prevent identity markdown from corrupting display names (nextlevelbuilder#356) (40b01d9)
• zalo: allow QR session restart with race-safe cancel (nextlevelbuilder#346) (a9a40a3)
• vision: prevent image base64 leak to DB and load historical images for read_image tool (7301ad5)

Performance Improvements

• ui: optimize KG graph view for large graphs (1cb7d3c)

Documentation

• update architecture and changelog for subagent enhancement (nextlevelbuilder#600) (8193d10)
• update agent teams Section 7 to match task dispatch flow (f9f63f1)
• add wails dev command to CLAUDE.md (65e7eb8)
• add desktop edition notes to CLAUDE.md (c43cd0f)
• store: restore inline doc comments on interface methods (9a24995)
• use make up in Docker quick start, add optional service flags (nextlevelbuilder#404) (0881d7f)
• add multi-tenant architecture image to README (461397d)
• translate model steering system doc to English (2d9d8ad)

Code Refactoring

• cron: normalize payload columns into dedicated DB fields (nextlevelbuilder#33) (24717b0)
• providers: extract Novita defaults into constants and add to desktop UI (3695353)
• compaction: remove minMessages guard, use token-only threshold (0c6cd02)
• decompose consumer, agent loop, team tools, and MCP manager (78253f1)
• tools: extract TeamToolBackend interface for team task testability (e934253)
• http: standardize error responses with writeError helper (0a8ca13)
• bootstrap: separate profile and seeding callbacks, consolidate per-user state (d3bf16d)
• workspace: extract layered resolver pipeline for workspace path computation (4b780bb)
• gateway: consolidate 27 handler fields into routeRegistrar slice (b4a0997)
• store: introduce typed RunContext for consolidated context injection (3bb524c)
• gateway: split teams_tasks method file into queries and mutations (382ec9a)
• store: split knowledge_graph.go into entity and relation files (f011b8c)
• store: split AgentStore and SessionStore into focused sub-interfaces (25a123f)
• pkg-helper: extract hardcoded GID to constant and log chown errors (7382ace)
• docker: rename network "shared" to "goclaw-net" (nextlevelbuilder#405) (424f3a9)
• store: remove deprecated tenantClauseN/tenantClauseNAlias (a080446)
• store: migrate all tenantClauseN callers to scopeClause (e81318a)
• store: add QueryScope abstraction for composable multi-level isolation (deb8210)
• agent: extract post-loop finalization to loop_finalize.go (379da91)
• agent: extract tool result processing to loop_tools.go (c1377de)
• agent: introduce runState struct to encapsulate loop mutable state (cd74264)
• store: split TeamStore into focused sub-interfaces (96fbc79)
• agent: extract context injection to loop_context.go (96bf0dd)
• store: fix goroutine safety issues across cron, sessions, skills, and gateway (81c8414)
• security: remove cross-tenant bypass, enforce strict tenant isolation (7aa47d1)
• ui: move About button back to user menu dropdown (0bce640)
• http: move gateway token to package-level auth state (e1cb5c4)
• ui: replace API Docs sidebar item with Documents header link and remove notification bell (b9d8754)
• ui: simplify setup-skip storage logic (dc7f91b)

Styles

• chat: improve task card layout — full text, progress bar above step message (101c4c4)

Chores

• add pkg-helper binary to .gitignore (066ba4d)

Build

• update frontend asset references in index.html and add it to .gitignore. (6de054d)

CI

• release: add pnpm/node cache to desktop release workflow (e297fb6)