MetallicClaw v0.4.1

MetallicClaw v0.4.1

Patch release from a post-release C quality review. This fixes security and correctness bugs in the v0.4.0 memory/tool/search/Telegram work.

Fixes

• Dangerous tools now fail closed when tool_policy contains an unknown value instead of silently allowing execution.
• web_search now parses SearXNG result objects with } characters inside JSON strings.
• Telegram photo messages without captions now reach the agent with the default image prompt instead of being skipped.
• Telegram debounce follow-up polling no longer skips unrelated updates that arrive before a later same-chat follow-up.
• web_search response bodies are capped to avoid unbounded memory growth from a malicious or broken SearXNG backend.
• Memory state allocation failure now returns a tool error instead of risking a null dereference.

Verification

• make test
• make clean && make CFLAGS='-std=c11 -O1 -g -fsanitize=address,undefined -fno-omit-frame-pointer' test
• make clean && make
• ./build/metallicclaw bench --runs 50
• macOS archive extraction and checksum verification

Benchmark sample

• Binary size: 154688 bytes
• Startup average: 4.737 ms
• Skill scan average: 0.314 ms
• Session append average: 0.045 ms
• Read file tool average: 0.010 ms

MetallicClaw v0.4.0

MetallicClaw v0.4.0

This release makes the Telegram agent feel much less like a support script and adds the next set of local-agent primitives: personality, memory, web search, and session control.

Highlights

• Added editable SOUL.md profile personality with a sharper default voice.
• Added bounded MEMORY.md and USER.md memory tool for durable preferences and compact project facts.
• Added web_search through a configured SearXNG JSON endpoint.
• Added Telegram command menu publishing plus /new, /skill, /yolo, and /godmode.
• Added session skill state, session history clearing, and sessions clear.
• Added generated docs/COMMAND_GUIDE.md with a pre-commit drift check.
• Changed Telegram debounce default to 0; fast replies by default, batching is opt-in with --debounce-ms.

Security notes

• /godmode and /yolo do not bypass provider/model safety, deny_dangerous, or runtime rules.
• Web search blocks public plain HTTP SearXNG URLs. Loopback HTTP stays allowed for local SearXNG and tests.
• Memory docs warn against storing secrets.

Verification

• make test
• make clean && make CFLAGS='-std=c11 -O1 -g -fsanitize=address,undefined -fno-omit-frame-pointer' test
• make clean && make
• ./build/metallicclaw bench --runs 50
• macOS archive extraction and checksum verification

Benchmark sample

• Binary size: 154688 bytes
• Startup average: 6.088 ms
• Skill scan average: 0.379 ms
• Session append average: 0.043 ms
• Read file tool average: 0.027 ms

MetallicClaw v0.3.0

Highlights

• Added metallicclaw doctor and gateway GET /version for install and service diagnostics.
• Added Telegram bridge setup, saved connections, allowed chats, commands, reply threading, message batching, response chunking, and config reload.
• Added basic image input through agent --image-url, gateway image_url, and Telegram photos for vision-capable OpenAI-compatible models.
• Fixed release-version rebuilds by making VERSION a Makefile dependency.

Security

• Telegram docs emphasize allowed chats, loopback gateway use, and image data flowing to the configured provider.
• Non-local plain HTTP Bot API URLs remain blocked unless explicitly allowed for local testing.

Verification

• make test
• make clean && make CFLAGS='-std=c11 -O1 -g -fsanitize=address,undefined -fno-omit-frame-pointer' test\n- make clean && make\n- ./build/metallicclaw bench --runs 50\n- bash scripts/package_release.sh darwin-arm64\n- local SHA-256 verification for darwin arm64 release archives\n\n## Benchmark Sample\n\n- macOS arm64 binary size: 135,968 bytes before release stripping\n- startup average: 3.210 ms over 50 runs\n- skill scan average: 0.162 ms over 50 runs\n- read_file tool average: 0.010 ms over 50 runs\n\nLinux x86_64 GNU assets are built and uploaded by the release workflow after publication.

MetallicClaw v0.2.1

MetallicClaw 0.2.1

Patch release focused on making installed binaries easy to keep current.

Added

• metallicclaw update for in-place updates through the existing release installer.
• Update options for --version, --install-dir, --target, and --repo.
• Regression coverage for update command installer handoff.

Changed

• Install, getting started, and CLI docs now show metallicclaw update as the normal upgrade path.

Verification

• git diff --check
• make test
• make clean && make CFLAGS='-std=c11 -O1 -g -fsanitize=address,undefined -fno-omit-frame-pointer' test
• make clean && make
• ./build/metallicclaw bench --runs 50

Benchmark Sample

• binary size: 97,904 bytes
• self startup avg: 2.278 ms over 50 runs
• read_file tool avg: 0.013 ms over 50 runs
• search_files tool avg: 0.862 ms over 50 runs

MetallicClaw v0.2.0

Second release focused on distribution, benchmark credibility, and public repo cleanup.

Highlights:

• One-line installer for GitHub release archives.
• Stable release archive aliases for installer downloads.
• Homebrew tap formula template.
• Hardened benchmark output validation and regression tests.
• Benchmark fixtures now use a temporary scratch profile.
• Public-facing docs cleaned up for open-source launch.

Verification run locally:

• make test
• make clean && make CFLAGS='-std=c11 -O1 -g -fsanitize=address,undefined -fno-omit-frame-pointer' test
• bash scripts/package_release.sh darwin-arm64
• checksum verification for darwin-arm64 archives
• local installer test from generated darwin-arm64 alias archive

Linux x86_64 GNU assets should be uploaded by the release workflow after publication.

MetallicClaw v0.1.0

Initial private binary release