pawbot v0.3.8

pawbot 0.3.8 release notes

This patch release hardens replay isolation, gateway authentication, and the
OpenAI-compatible API while improving diagnostics for provider-hosted tools.

Fixed

• Record & Replay now blocks a tool call when its recorded observation is
  missing instead of falling through to the real tool implementation.
• Wildcard WebSocket listeners require an actual authentication path; trusted
  proxy connections must carry a valid proxy assertion, including when
  requesting a short-lived token.
• Streaming API failures now produce a structured SSE error followed by
  [DONE], so clients do not receive an empty successful stream.
• Docker Compose installs the API extra and accepts PAWBOT_API_KEY without
  changing the mounted configuration file.
• Relative restricted-workspace execution paths resolve against the workspace,
  and API session locks no longer retain arbitrary session IDs indefinitely.
• Replay uses the live turn budget and tool-capability policy; hosted provider
  tool events are retained as separate diagnostic records; configured model
  aliases remain selectable when a provider omits them from /models.

Upgrade

uv tool install --force --upgrade pawbot-ai

Existing configuration, sessions, and recordings remain in the user's Pawbot
data directory.