Skip to content

0.0.13

Choose a tag to compare

View all tags
@github-actions github-actions released this 27 Mar 13:56
· 242 commits to main since this release
v0.0.13
165872e
This commit was signed with the committer’s verified signature.
samzong
GPG key ID: 207ED79A41A78FA6
Verified
Learn about vigilant mode.

🔥 Highlights

  • 📱 ClawWork on your phone — Brand-new PWA mobile companion with a native chat experience, swipe gestures, and seamless QR pairing that keeps your desktop connected.
  • 🐧 Linux support — First-class Linux builds ship starting this release — AppImage and deb for x64.
  • ✨ Visual refresh — Glass panels, glow accents, and ambient gradients give the entire app a polished new look while respecting reduced-motion preferences.
  • 🔒 Security hardening — Four fixes close a private key leak, an SSRF bypass, a TOCTOU race, and a path traversal vector in the artifact handler.

✨ What's New

  • 📱 PWA mobile companion — Brand-new mobile web app with native iOS chat experience: OLED dark theme, edge-swipe gestures, drag-to-dismiss bottom sheets, settings panel with 8-language selector, and QR pairing with independent device identity — your desktop stays connected when a phone joins. by @samzong in #183

  • 🎨 Premium design system — Glass surfaces, 3-layer glow effects, ambient gradient orbs, display typography (Instrument Serif), extended motion presets, and CI enforcement rules. All with dark + light theme coverage, prefers-reduced-motion respect, and @supports fallbacks. by @samzong in #200 #201

  • 🐧 Linux desktop builds — AppImage (portable) and deb (Ubuntu/Debian) packages for x64, fully integrated into the CI/CD release pipeline. by @samzong in #174

🔒 Security

  • Removed private key exposure and raw IPC backdoor from the renderer preload bridge — neither surface had any renderer consumers by @samzong in #184
  • Production-grade SSRF guard with numeric IPv4/IPv6 range checks and DNS pre-resolution, replacing the string-prefix check that missed all RFC 1918 ranges by @samzong in #189
  • Eliminated TOCTOU race in context file path validation by merging validate + read into a single fd-centric atomic operation by @samzong in #185
  • Fixed path traversal vector in artifact handler — replaced naive url.replace('file://', '') with fileURLToPath() by @samzong in #194

🐛 Bug Fixes

  • Fixed macOS crash on dock re-open — IPC handlers registered inside createWindow() threw on second invocation; centralized window lifecycle via window-manager module by @samzong in #195
  • Fixed PWA status bar color not updating when switching between dark and light themes by @samzong in #192
  • Fixed invisible text in Gateway debug log caused by undefined --text-tertiary CSS variable by @samzong in #193
  • Fixed per-token forced reflow during streaming — replaced scrollToBottom on every token with ResizeObserver; fixed Virtuoso dual scroll context by @samzong in #196
  • Fixed PWA client version stuck at hardcoded 0.1.0 — now injected from package.json at build time by @samzong in #191
  • Fixed PWA i18n gaps — en.json is now the authoritative superset, all defaultValue anti-patterns eliminated, Gateway debug log fully translated across 8 languages by @samzong in #199

🔧 Engineering

  • Extracted @clawwork/core package with port-based dependency injection — stores, session sync, gateway dispatching, and protocol parsing are now platform-agnostic, enabling future PWA code sharing by @samzong in #178
  • Extracted chat composer service into @clawwork/core — split the 1655-line ChatInput.tsx god component into 9 focused modules by @samzong in #180
  • Added knip for dead code detection, removed 52 dead code items, added Renovate for automated dependency updates and vitest coverage by @samzong in #176
  • Extracted BottomSheet primitive from 3 PWA components, fixing 3 accessibility bugs and adding body scroll lock by @samzong in #186
  • Extracted useOverlay hook — unified portal rendering, ref-counted scroll lock, inert support, and prefers-reduced-motion for all overlays by @samzong in #198
  • Extracted useFocusTrap hook from DrawerLayout and AgentSelector by @samzong in #190
  • Extracted client registry and eliminated composerBridge monkey-patching hack by @samzong in #188
  • Replaced manual base64 encode/decode with ES2025 Uint8Array.toBase64() platform API by @samzong in #197
  • PWA polish: removed type lies (! non-null assertions), dead tsconfig paths, added IndexedDB migration guard, reduced edge-swipe dead zone by @samzong in #187

📖 Docs

  • Keynote: full 8-language translations and dark/light theme toggle by @samzong in #182
  • Keynote slide polish and toolchain integration focus by @samzong in #179
  • Fixed SPA fallback for GitHub Pages keynote routes by @samzong in #175

📥 Download

Platform File
🍎 macOS Apple Silicon ClawWork-0.0.13-mac-arm64.dmg
🍎 macOS Intel ClawWork-0.0.13-mac-x64.dmg
🪟 Windows x64 ClawWork-0.0.13-win-x64.exe
🐧 Linux x64 (AppImage) ClawWork-0.0.13-linux-x86_64.AppImage
🐧 Linux x64 (deb) ClawWork-0.0.13-linux-amd64.deb

macOS: App is signed and notarized — opens normally on first launch.

Windows: If SmartScreen warns "unrecognized app", click More info → Run anyway.

Linux: AppImage requires chmod +x before first run. deb installs via sudo dpkg -i.

🙏 Contributors

We welcome more contributors — come help make ClawWork better → Contributing Guide

Full Changelog: v0.0.12...v0.0.13

Contributors

samzong
Assets 18
Loading