v0.7.0 — Security hardening & agent-loop upgrades

⚠️ Security release — please upgrade

This release fixes several security issues found in an internal audit. If you run PythonClaw with ClawHub skills or the web dashboard, upgrade as soon as possible:

pip install -U pythonclaw

Security fixes

• Zip-slip arbitrary file write in ClawHub skill installs — a crafted skill ZIP could write files outside the skill directory (escalating to code execution). Extraction now rejects absolute paths and .. traversal in both sync and async installers.
• TLS verification was disabled on async hub downloads — combined with the above, a network attacker could deliver a malicious archive. Certificate verification is now on.
• Web dashboard bound to 0.0.0.0 with no auth — anyone who could reach port 7788 could drive the agent (including run_command). It now binds to 127.0.0.1 by default and warns loudly if you opt into a public bind.
• Path traversal guards for memory_get (sibling-prefix bypass) and skill resource lookups.
• Cross-session file delivery race — with multiple channels active, send_file could deliver a file to the wrong chat. The send callback is now per-agent.

Agent-loop upgrades (context engineering)

• Tool-output truncation with spill-over files — oversized outputs keep head+tail in context and save the full text to a file; read_file gains offset/limit for paging, run_command gains a timeout argument.
• Turn-integrity pruning — the current turn's user message can no longer slide out of the context window during a long tool loop.
• Loop breaker — identical tool calls repeated 3+ times in one turn are short-circuited.
• Non-blocking tool timeouts — a hung tool no longer freezes the whole session.
• Pair-safe compaction — compaction never splits a tool call from its result; old summaries roll off instead of accumulating; token estimation now counts tool-call arguments and flat-rates images (one photo no longer trips auto-compaction every turn).
• multi_search — parallel web-search fan-out, with partial results on timeout.

Reliability fixes

• Gemini tool use was completely broken (referenced SDK symbols that don't exist) — rewritten on google.generativeai.protos, with parallel tool results batched into one turn.
• Streamed conversations were never persisted — Telegram/web sessions now survive restarts.
• Anthropic: honor tool_choice="none", never emit or replay truncated tool JSON, claude setup-token OAuth support, copy-on-merge (no history aliasing).
• OpenAI-compatible streaming: tool calls keep the model's intended order.
• Session store: atomic writes, multimodal messages no longer crash persistence, ###/--- content lines survive round-trips, private _ts metadata is stripped from API payloads.
• Memory store: atomic writes, values containing ## headings no longer corrupt on reload.
• Cron: Unix weekday numbers remapped for APScheduler — 0 9 * * 1-5 now fires Mon–Fri (was Tue–Sat).
• Config: string-safe JSON5 stripping (,} inside values no longer mutated), malformed config no longer bricks pythonclaw stop.
• Telegram: timeouts no longer release the session lock mid-run, edited messages don't crash handlers, UTF-16 mention offsets, flood-control-aware delivery.
• WhatsApp: webhook acks immediately (agent work off Meta's retry path), thread-safe locks.
• Discord: channel allowlist enforced for mentions, startup failures surfaced.
• STT: one failing fallback language no longer aborts voice transcription.

Tests

+23 regression tests covering the fixes above (174 total, all passing).

Full Changelog: 7787bb4...v0.7.0