Skip to content

v0.1.12

Choose a tag to compare

View all tags
@github-actions github-actions released this 27 Jul 07:30
v0.1.12
ac40745
This commit was signed with the committer’s verified signature.
steipete Peter Steinberger
SSH Key Fingerprint: buNEi6/r+uo+ILUkRvDkyyOc+SQ8kjWzo0lh99ci8NM
Verified
Learn about vigilant mode.

Changelog

Provider fidelity

  • Harden provider-native authentication, ingress, identity, thread, pagination, retry, error, and shutdown semantics across Discord, Feishu, Google Chat, iMessage, Matrix, Mattermost, Microsoft Teams, Signal, Slack, Telegram, WhatsApp, and Zalo.
  • Bring Matrix sync and event state, Mattermost REST and WebSocket posts, Signal JSON-RPC and SSE, Slack Events API and rich-text retries, and Zalo polling and webhook delivery closer to their public protocols.
  • Tighten Telegram bot readiness, webhook authentication, numeric and username identities, topics, entities, multipart media, message IDs, and Bot API response semantics.
  • Make WhatsApp Cloud and Baileys lifecycle, JID mapping, acknowledgement and retry handling, and group delivery failure-safe; randomize XEdDSA signatures and harden handshakes, cryptography, and binary-node resource limits.
  • Bound shared HTTP and webhook bodies, response streams, DNS resolution, media types, backpressure, disconnections, and shutdown without exposing credential-bearing diagnostics.

Runtime and storage

  • Make recorder writes durable and replacement-safe across concurrent processes, hardlinks, symlinks, rotation, cursors, and post-commit cleanup failures on Unix and Windows.
  • Secure private files, lock roots, ready files, and recorder publication with no-follow identity checks, owner-only ACLs, stale-owner recovery, process fencing, and replacement-safe cleanup.
  • Make provider cleanup, lazy adapters, script process trees, watches, timers, retries, and cancellation failure-atomic and bounded.
  • Validate callback and JWT timing, keys, cache refreshes, credentials, and registered claims before I/O while preserving infrastructure failures and provider-native status semantics.

OpenClaw integration

  • Version and validate artifact generations, readiness manifests, capability reports, recorder evidence, atomic pointers, legacy migration, and smoke-lock recovery.
  • Preserve native provider, target, thread, sender, direct-recipient, and accepted-send identities through OpenClaw bridge normalization without conflating local mock proof with OpenClaw execution.

CLI, documentation, and delivery

  • Reject credentials on argv, add bounded stdin and inherited-fd ingress for serve, harden config paths, JSON reporting, nonce and regex matching, fixture modes, and shutdown under output backpressure.
  • Keep channel setup guidance, provider target examples, the built-in and script-bridge matrix, and the shipped runnable fixture aligned with schema and runtime behavior.
  • Strengthen CI, autoreview, dependency review, immutable action and image pins, npm provenance, tag revalidation, package integrity, and release idempotency.
  • Refresh runtime, toolchain, and GitHub Actions dependencies, pin patched PostCSS, and move from broken pnpm 11.13.0 to 11.17.0.

Contributors

  • Thanks @vincentkoc for 99 merged provider, runtime, recorder, OpenClaw, and release improvements, and @hannesrudolph for improving the pull-request workflow in #152.

Verification

Full Changelog: v0.1.11...v0.1.12

Contributors

vincentkoc and hannesrudolph
Assets 2
Loading