v1.0.3

Fixed

• A directive leaked to a customer on follow-up turns. OpenClaw delivers
  replies after a conversation's first turn through a second send hook that
  bypassed directive parsing, HTML rendering, tags, notes and escalation
  entirely. Both paths now share one pipeline, with a defensive strip of any
  [[...]]-shaped text as a last resort. (#21)
• Escalating now actually stops the bot. Team-escalated conversations kept
  matching Intercom's admin-only "unassigned" search and were re-answered on
  every poll. A persistent escalated-set makes a conversation inert to poll,
  webhook and claim once handed to a human, and replies already queued in the
  agent runtime are dropped at delivery. (#22, #24)
• A message backlog no longer causes a reply storm. All pending customer
  messages in one cycle coalesce into a single agent turn with full context,
  instead of one reply per stale message. (#24)
• The bot can see customer images. Messenger-style uploads and Instagram's
  inline <img> bodies are extracted, downloaded from the CDN and described
  through the runtime's image understanding; image-only messages (empty body)
  are no longer dropped. Webhook payloads are treated as notifications and the
  canonical conversation is fetched, since the payload flattens image tags
  away. (#25, #26, #27, #28)

Changed

• Escalation returns a conversation to its original inbox. A persistent
  write-once record captures where each conversation lived before the bot
  touched it, and escalation always hands back there. Named-queue routing
  (escalationTargets) remains as the fallback when no origin is known.
  (#23)

Added

• CI: tests and typecheck run on every PR; pushing a v* tag publishes to
  ClawHub after verifying the tag matches package.json and extracting the
  changelog section for the release.