Skip to content

wacli v0.13.0

Choose a tag to compare

View all tags
@steipete steipete released this 17 Jul 18:46
v0.13.0
This tag was signed with the committer’s verified signature.
steipete Peter Steinberger
SSH Key Fingerprint: buNEi6/r+uo+ILUkRvDkyyOc+SQ8kjWzo0lh99ci8NM
Verified
Learn about vigilant mode.
1e15f64
This commit was signed with the committer’s verified signature.
steipete Peter Steinberger
SSH Key Fingerprint: buNEi6/r+uo+ILUkRvDkyyOc+SQ8kjWzo0lh99ci8NM
Verified
Learn about vigilant mode.

Changelog

Highlights

  • Sync can now stay quiet during long-running mirror sessions so the primary phone keeps normal notification behavior. (#298 - thanks @GodsBoy)
  • Text replies now carry complete quoted-message context through direct and delegated sends. (#302 - thanks @odilorg)
  • Windows auth and store access now handle drive-letter and UNC paths without invalid SQLite URI errors. (#304 - thanks @goutamadwant)
  • Official release artifacts now use a signed, notarized, provenance-bound draft-first pipeline with protected verification and Homebrew handoff.

Added

  • Sync: add opt-in --presence-mode quiet to suppress available-presence updates during long-running sync sessions while retaining safe unavailable cleanup. (#298 - thanks @GodsBoy)

Fixed

  • Messages: preserve quoted content, stanza IDs, and participants when replying to stored incoming or outgoing text messages, including through sync IPC delegation. (#302 - thanks @odilorg)
  • Windows: normalize drive-letter and UNC paths before constructing SQLite file URIs so auth and read-only store opens no longer fail with invalid URI authority. (#304 - thanks @goutamadwant)
  • WhatsApp compatibility: update whatsmeow for current protobufs, LID direct-message sends, pairing, and user lookup behavior. (#306)

Security

  • Build: require Go 1.25.12 and gate source plus release binaries with govulncheck so reachable GO-2026-5856 standard-library paths are excluded.
  • Release: sign all official macOS thin and universal binaries with the exact OpenClaw Foundation Developer ID metadata and designated requirement, hardened runtime, timestamp, and Apple notarization before draft upload; require naturally quarantined clean-VM execution as the standalone CLI Gatekeeper proof.
  • Release: bind cross-build provenance and publication freshness to the current protected head, reject wrong linker/runtime versions and lookalike signing authorities, revalidate the exact draft and fresh published release by ID, and verify protected Homebrew handoff, formula stanzas, plus the installed binary's hash, architecture, signing identity, runtime, and notarization constraint.
  • Release: move official publication to a local draft-first flow with authenticated cross-build provenance, separate protected-main native verification, a signed annotated exact tag, verified public-release and Homebrew manifests, and credential-free CI builds.

Changed

  • Dependencies: update go-sqlite3, the Go networking stack, and whatsmeow with its required transitive modules. (#305, #306)
  • Tooling: require Node.js 24 or newer and enforce a 48-hour minimum release age for pnpm packages. (thanks @vincentkoc)

Contributors

vincentkoc, GodsBoy, and 2 other contributors
Assets 9
Loading