v0.5.3

• Fixed approved GitHub issue and pull request comments to publish ordinary final responses instead of requiring agent_system_github_reply. #62
• Fixed queued GitHub comments to publish up to two approved replies serially per polling reconciliation. #62
• Fixed unsafe GitHub comment responses to publish a deterministic safe notice instead of being silently withheld. #62

v0.5.2

New Features

• Added agent-system-github-update for publishing missing material progress from an issue's private session. #58
• Added guided mode to prepare assignments and wait for explicit direction before implementation. #58
• Added provider-verified agent-system-github retirement that archives inactive sessions and removes only clean managed worktrees. #53 #56
• Added pull-request-opened handoffs that keep delivery pull requests in the issue-owned session and route replies to their exact source. #57
• Added work mode delivery from assignment through planning, implementation, validation, push, and pull-request creation. #48
• Updated agent-system-github replies with attributed cards, GitHub-flavored Markdown, and provider-verified commenter mentions. #46

Bug Fixes

• Fixed agent-system-github worktree recovery after verified GitHub repository renames. #51 big-test-bucket#316
• Fixed pull-request-opened retries to preserve stable provider identity and completed handoffs. #57
• Fixed work continuation to use trusted lifecycle state instead of model-authored headings. #48

v0.4.0

New Features

• Added direct GitHub pull-request assignment intake with verified head metadata and logical retirement. #34
• Added lifecycle-owned GitHub assignment intake with issue worktree preparation and neutral prepared checkpoints. #17 #37 #42
• Added redacted notifications status and semantic notifications wait commands for durable intake inspection. #42
• Added trusted issue-comment conversations with private session responses and reauthorized GitHub replies. #37 #42
• Bound registered command-launcher descendants, including git and gh, to active OpenClaw and Codex agents with fail-closed admission. #23

Bug Fixes

• Fixed GitHub notification baselines, inbound status, and retirement without deleting managed worktrees. #17 #19 #21
• Fixed managed Codex config to set allow_login_shell = false and warn when user-managed config omits it. #25
• Fixed managed command launchers to preserve bounded redirected standard input. #29
• Fixed notification CLI and lifecycle logging so one-shot JSON commands terminate with clean stdout. #28 #42
• Fixed the Node 26 development baseline to compile against matching Node 26 type definitions. #42

Notes

• Consolidated Leia setup and diagnostics under examples/.bin and focused installed coverage on the issue lifecycle. #42
• Reorganized GitHub channel source around lifecycle, intake, conversation, publication, provider, routing, state, and runtime owners. #42
• Reorganized root source around agent, api, core, credentials, environment, manifest, and paths owners. #42
• Split GitHub target design, presentation components, and shipped behavior across focused channel documentation. #42
• Updated notification state to schema 4, separating intake state from conversation and publication receipts. #37 #42

v0.3.0

New Features

• Added the agent-system-github channel for OpenClaw. #7

v0.2.3

New Features

• Added default-deny github.policy.releases protection for GitHub CLI and REST release mutations. #13
• Narrowed Git policy to deny force pushes and remote-ref deletion by default while allowing other recognized operations. #13

Notes

• Removed broad Git and GitHub risk categories in favor of controls for specific provider-authorization gaps. #13

v0.2.2

New Features

• Allowed clean managed-worktree removal without enabling destructive Git deletion policy. #12

Bug Fixes

• Allowed trusted operator Git commands to run in manifest-declared local repositories while preserving native-tool containment. #10
• Fixed manifest-derived tool access across both per-agent allowlists and blocked installs on explicit deny conflicts. #9
• Updated policy denials to identify the controlling field and required operator change. #12

Notes

• Removed transport-dependent ask policy decisions in favor of explicit allow and deny settings with migration diagnostics. #12

v0.2.1

New Features

• Added agent-command guardrails and doctor diagnostics for cross-agent identity and operator-surface exposure. #6
• Updated managed worktrees to use one deterministic branch and path for each repository and work id. #6

Bug Fixes

• Fixed managed repositories to refresh remotes only when creating a worktree while leaving configured local repositories untouched. #6

Notes

• Added dedicated Leia scenarios for managed worktrees and agent-command security boundaries. #6
• Refactored plugin startup into capability-owned Git and GitHub composition with focused unit tests. #6

v0.2.0

New Features

• Added direct 1Password secret references for named environment values. #5
• Added the Agent System-managed git tool. #5

Bug Fixes

• Fixed Git private-key path containment, packaged shim resolution, managed-worktree manifest discovery, and policy handling for hazardous commands and raw worktree mutations. #5

Notes

• Added a reusable packaged launcher for Agent System command shims. #5

v0.1.1

• Initial release delivery

v0.1.0

• Initial payload delivery