v0.1.13

What's Changed

• fix(telegram): keep Markdown parsing responsive on malformed links by @vincentkoc in #249
• refactor: remove legacy provider-server aliases by @RomneyDa in #250
• feat: add Discord local provider server by @RomneyDa in #252
• chore(release): prepare Crabline 0.1.13 by @RomneyDa in #253

Full Changelog: v0.1.12...v0.1.13

v0.1.12

Changelog

Provider fidelity

• Harden provider-native authentication, ingress, identity, thread, pagination, retry, error, and shutdown semantics across Discord, Feishu, Google Chat, iMessage, Matrix, Mattermost, Microsoft Teams, Signal, Slack, Telegram, WhatsApp, and Zalo.
• Bring Matrix sync and event state, Mattermost REST and WebSocket posts, Signal JSON-RPC and SSE, Slack Events API and rich-text retries, and Zalo polling and webhook delivery closer to their public protocols.
• Tighten Telegram bot readiness, webhook authentication, numeric and username identities, topics, entities, multipart media, message IDs, and Bot API response semantics.
• Make WhatsApp Cloud and Baileys lifecycle, JID mapping, acknowledgement and retry handling, and group delivery failure-safe; randomize XEdDSA signatures and harden handshakes, cryptography, and binary-node resource limits.
• Bound shared HTTP and webhook bodies, response streams, DNS resolution, media types, backpressure, disconnections, and shutdown without exposing credential-bearing diagnostics.

Runtime and storage

• Make recorder writes durable and replacement-safe across concurrent processes, hardlinks, symlinks, rotation, cursors, and post-commit cleanup failures on Unix and Windows.
• Secure private files, lock roots, ready files, and recorder publication with no-follow identity checks, owner-only ACLs, stale-owner recovery, process fencing, and replacement-safe cleanup.
• Make provider cleanup, lazy adapters, script process trees, watches, timers, retries, and cancellation failure-atomic and bounded.
• Validate callback and JWT timing, keys, cache refreshes, credentials, and registered claims before I/O while preserving infrastructure failures and provider-native status semantics.

OpenClaw integration

• Version and validate artifact generations, readiness manifests, capability reports, recorder evidence, atomic pointers, legacy migration, and smoke-lock recovery.
• Preserve native provider, target, thread, sender, direct-recipient, and accepted-send identities through OpenClaw bridge normalization without conflating local mock proof with OpenClaw execution.

CLI, documentation, and delivery

• Reject credentials on argv, add bounded stdin and inherited-fd ingress for serve, harden config paths, JSON reporting, nonce and regex matching, fixture modes, and shutdown under output backpressure.
• Keep channel setup guidance, provider target examples, the built-in and script-bridge matrix, and the shipped runnable fixture aligned with schema and runtime behavior.
• Strengthen CI, autoreview, dependency review, immutable action and image pins, npm provenance, tag revalidation, package integrity, and release idempotency.
• Refresh runtime, toolchain, and GitHub Actions dependencies, pin patched PostCSS, and move from broken pnpm 11.13.0 to 11.17.0.

Contributors

• Thanks @vincentkoc for 99 merged provider, runtime, recorder, OpenClaw, and release improvements, and @hannesrudolph for improving the pull-request workflow in #152.

Verification

• npm package
• registry tarball
• Integrity: sha512-JIvSgivOsgGrQ0TGDkq1ZmUXOjDW2wh93DEUGVqIFdIEFoU3RnWY/46LH7ZpeMmlQH3L9aeP1bG/486TkLEbzQ==
• release CI

Full Changelog: v0.1.11...v0.1.12

v0.1.11

Changelog

• Contain Telegram response delivery failures when clients disconnect during request handling.
• Recover interrupted artifact and recorder writes, publish immutable readiness evidence, and harden private-directory and smoke-lock durability.

What's Changed

• fix(openclaw): harden artifact persistence by @vincentkoc in #99
• fix(telegram): contain disconnected response writes by @steipete in #107

Verification

• npm package
• registry tarball
• Integrity: sha512-A7KH6gi7tXfJmdyeCzhZ65cSrLk4lALbto3lNBOHp1C6uIirAgM4tcF9I7/LhNDX/dq/T+q2QytpVPhhsfwgQQ==
• release CI

Full Changelog: v0.1.10...v0.1.11

v0.1.10

Release proof

• Changelog: https://github.com/openclaw/crabline/blob/v0.1.10/CHANGELOG.md#0110---2026-07-13
• npm: https://www.npmjs.com/package/@openclaw/crabline/v/0.1.10
• Registry tarball: https://registry.npmjs.org/@openclaw/crabline/-/crabline-0.1.10.tgz
• Integrity: sha512-j9IwibClUZs1vcw/v4tF9VP57OPuZxr1RqeLPvxUcz6Ldvw1ukVf7O7FLAfaRMOZxCMSxpjpx3wg+VnvmiATvQ==
• Release CI: https://github.com/openclaw/crabline/actions/runs/29220006169

What's Changed

• fix(core): harden release and CLI lifecycle by @vincentkoc in #42
• fix(providers): harden runtime and normalization by @vincentkoc in #43
• fix(servers): harden provider protocol fidelity by @vincentkoc in #44
• fix(openclaw): harden provider bridge validation by @vincentkoc in #45
• fix(core): harden release and package contracts by @vincentkoc in #46
• fix(whatsapp): bound wire decoding by @vincentkoc in #47
• fix(providers): serialize local runtime lifecycle by @vincentkoc in #49
• fix(providers): preserve native inbound fidelity by @vincentkoc in #48
• fix(openclaw): validate targets and bound probes by @vincentkoc in #50
• fix(servers): harden provider request ingress by @vincentkoc in #51
• fix(whatsapp): harden Noise frame processing by @vincentkoc in #52
• fix(persistence): serialize shared artifact writes by @vincentkoc in #53
• fix(cli): preserve failure and packaging contracts by @vincentkoc in #54
• fix(providers): harden wire-level fidelity by @vincentkoc in #55
• fix(ci): harden release and package verification by @vincentkoc in #56
• fix(servers): enforce provider-native contracts by @vincentkoc in #57
• fix(runtime): preserve recorder and nonce correctness by @vincentkoc in #58
• fix(providers): enforce lifecycle and config contracts by @vincentkoc in #59
• chore(autoreview): sync canonical review skill by @vincentkoc in #60
• fix(openclaw): secure smoke artifacts and targets by @vincentkoc in #61
• fix(servers): enforce protocol safety contracts by @vincentkoc in #62
• fix(runtime): enforce provider lifecycle deadlines by @vincentkoc in #63
• fix(openclaw): harden artifact publication safety by @vincentkoc in #64
• fix(cli): secure serve and release contracts by @vincentkoc in #65
• fix(cli): harden ready-file lifecycle by @vincentkoc in #67
• fix(core): harden lifecycle and smoke locking by @vincentkoc in #69
• fix(providers): authenticate and scope inbound delivery by @vincentkoc in #66
• fix(servers): harden protocol and release boundaries by @vincentkoc in #68
• fix(whatsapp): harden protocol edge cases by @vincentkoc in #70
• fix(providers): enforce webhook and cursor bounds by @vincentkoc in #71
• fix(servers): bound delivery and release state by @vincentkoc in #72
• fix(core): harden config and artifact boundaries by @vincentkoc in #73
• fix(lifecycle): preserve failures and validate startup inputs by @vincentkoc in #74
• fix(whatsapp): bound wire state and preserve delivery order by @vincentkoc in #75
• fix(providers): enforce native webhook and inbound boundaries by @vincentkoc in #76
• fix(servers): preserve native delivery state and bounds by @vincentkoc in #77
• test(servers): use explicit credential placeholders by @vincentkoc in #78
• fix(core): preserve lifecycle and publication contracts by @vincentkoc in #79
• fix(providers): preserve native authentication and delivery state by @vincentkoc in #80
• fix(servers): preserve native delivery and lifecycle contracts by @vincentkoc in #81
• fix(whatsapp): bound native transport and validation by @vincentkoc in #82
• fix(auth): harden signed provider ingress by @vincentkoc in #87
• fix(runtime): harden provider event handling by @vincentkoc in #88
• fix(providers): preserve Matrix and Signal delivery by @vincentkoc in #83
• fix(providers): enforce native chat server contracts by @vincentkoc in #86
• fix(providers): preserve WhatsApp and Zalo delivery by @vincentkoc in #85
• fix(runtime): harden execution and release paths by @vincentkoc in #89
• fix(openclaw): make provider readiness contracts truthful by @vincentkoc in #84
• fix(providers): harden secondary adapters by @vincentkoc in #93
• fix(providers): harden provider core behavior by @vincentkoc in #94
• fix(automation): harden release and review launchers by @vincentkoc in #92
• fix(providers): harden external webhook authentication by @vincentkoc in #91
• fix(servers): enforce native delivery contracts by @vincentkoc in #90
• fix(openclaw): harden final bridge contracts by @vincentkoc in #97
• fix(runtime): bound CLI and fixture execution by @vincentkoc in #95
• fix(servers): harden final transport semantics by @vincentkoc in #96
• fix(runtime): harden final audit boundaries by @vincentkoc in #98
• fix(providers): complete final protocol remediation by @vincentkoc in #101
• fix(servers): tighten provider protocol fidelity by @vincentkoc in #102
• fix(openclaw): harden final bridge delivery by @vincentkoc in #100
• fix(openclaw): emit nested streaming config by @steipete in #104
• chore: prepare Crabline 0.1.10 by @steipete in #105

Full Changelog: v0.1.9...v0.1.10

v0.1.9

What's Changed

• Add in-process server event observers by @RomneyDa in #38
• Prepare Crabline 0.1.9 by @RomneyDa in #39

Full Changelog: v0.1.8...v0.1.9

v0.1.8

What's Changed

• Add Zalo provider server by @RomneyDa in #36
• Prepare Crabline 0.1.8 by @RomneyDa in #37

Full Changelog: v0.1.7...v0.1.8

v0.1.7

What's Changed

• [codex] Harden CI permissions and update test dependencies by @steipete in #30
• Add signal-cli HTTP daemon mock by @RomneyDa in #31
• Document provider server fidelity rules by @RomneyDa in #33
• Add Mattermost provider server by @RomneyDa in #32
• Add Matrix provider server by @RomneyDa in #34
• feat: support Telegram native command ingress by @RomneyDa in #35

New Contributors

• @steipete made their first contribution in #30

Full Changelog: v0.1.6...v0.1.7

v0.1.6

What's Changed

• fix(telegram): support fake media sends by @vincentkoc in #29

Full Changelog: v0.1.5...v0.1.6

v0.1.5

What's Changed

• build(deps-dev): bump @types/node from 25.9.2 to 26.0.1 by @dependabot[bot] in #28
• build(deps-dev): bump @typescript/native-preview from 7.0.0-dev.20260503.1 to 7.0.0-dev.20260629.1 by @dependabot[bot] in #27
• build(deps): bump commander from 14.0.3 to 15.0.0 by @dependabot[bot] in #26
• build(deps-dev): bump the development-minor-and-patch group with 5 updates by @dependabot[bot] in #25
• Rename provider server internals and APIs by @RomneyDa in #24

Full Changelog: v0.1.4...v0.1.5

v0.1.4

What's Changed

• Add Baileys WebSocket WhatsApp fake server by @RomneyDa in #23

Full Changelog: v0.1.3...v0.1.4