v1.4.0

A hardening and bug-fix release. No new features — but two changes you will notice.

Behaviour changes

• Packaged builds no longer read $OPENCLAW_CONFIG_PATH. It names the file your gateway token
  and its origin are read from, which is the same power as the OPENCLAW_TOKEN a packaged build
  already refuses, so it is now development-only. Auto-detection in a shipped build always reads
  ~/.openclaw/openclaw.json. If your config lives elsewhere, enter the gateway URL and token once
  in the in-app setup screen.
• Replies are no longer capped at 1000 tokens. The ceiling is now 4000, so a long answer stops
  being cut off mid-sentence. How long the character actually replies is still the character
  prompt's job.

Hardening

• Every IPC channel now authenticates its caller as this app's own renderer. Previously only the two
  channels that hand out a credential did, while chat (which reaches an operator-grade gateway) and
  settings (which decides which gateway) did not.
• The main process refuses any navigation away from the renderer entry. The preload bridge belongs to
  whatever document the window holds, so this closes the condition the per-channel checks defend
  against.
• Both ways a URL can leave the app now share one scheme rule. A middle-clicked link reached the
  window-open handler without the renderer's own validation, since auxclick fires no click handler.
• The packaged config path resolves from your OS account rather than $HOME, and fails closed —
  falling back would have handed the redirection straight back to the environment.
• The macOS bundle no longer declares camera, Documents or Downloads usage. The app asks for none of
  them; the microphone description stays and now says what it is for.

Fixes

• The chat transcript no longer rebuilds itself on every turn. A key derived from the message count
  remounted the whole list, which reset scrolling to a jump and re-parsed every message's markdown
  each turn.
• The settings panel is exposed as a modal dialog, so assistive tech can announce it.

Internal

• Removed the unused electron-updater dependency and its placeholder publish config, a dead
  autoFade prop and its animation, and a leftover ping IPC handler.
• Release pages now carry generated notes.

Verified on the packaged macOS bundle: every IPC channel resolves inside the asar bundle, the
navigation guard refuses a foreign origin, and a decoy OPENCLAW_CONFIG_PATH is ignored.

Full Changelog: v1.3.0...v1.4.0