v0.8.4

ZeroClaw v0.8.4

ZeroClaw v0.8.4 is a maintenance and hardening release spanning 262 commits from 49 contributors. It expands the memory and SOP control planes, improves provider and channel reliability, strengthens sandbox and credential boundaries, and makes the desktop and release pipeline more dependable. This release also includes upgrade-sensitive changes for skill sources, Nextcloud Talk, and generic webhook authentication; review Breaking Changes before upgrading those integrations.

Highlights

• Memory controls add opt-in retrieval caching, reranking, typed-fact extraction, migration-aware configuration checks, content scanning, and auditable recall paths.
• SOP execution gains per-SOP admission policies, quorum-based approval brokering, checkpoint editing, centralized fan-in adapters, and stronger deterministic gate handling.
• Operator surfaces add dashboard-driven upgrades, channel relinking, agent renaming, runtime-context display, searchable keybinding help, and a more reliable terminal experience.
• Channels and ACP gain Mattermost WebSocket listening, Telegram debounce, interactive reply events, signed Nextcloud Talk replies, agent-selectable ACP sessions, and cited blob delivery.
• Provider and runtime reliability improves OpenAI Responses setup, model context-window metadata, fallback visibility, streamed retries, multimodal fallback, lifecycle preservation, and whole-turn history trimming.
• Release integrity adds a self-contained notarized macOS desktop path, repaired Scoop and AUR publication workflows, consolidated attestations, required SBOMs, checksums, and an offline verification archive.

What's New

Memory and Retrieval

• Add opt-in retrieval caching, a gated rerank stage, typed memory classification and fact extraction, configuration validation, migration reindex hooks, and content scanning at write and recall boundaries (#8897, #8895, #8900, #8899, #8984).
• Add gated memory audit trails and restore semantic recall of durable global memories across sessions (#8893, #8898).
• Improve Lucid process control with configurable timeouts and more reliable ARM startup handling (#9105).

SOP and Automation

• Add per-SOP admission policy, release execution slots while awaiting human approval, and broker approvals through group membership and quorum (#8848, #8880).
• Add checkpoint editing and revision for deterministic gate prompts, then centralize fan-in ingress adapters (#8979, #9205).
• Improve conditional steps, AMQP ingress, nested policy handling, structured output, and deterministic approval routing (#8771, #9183, #9027, #9030, #9375, #8903).
• Add raw stdout delivery for cron shell jobs through shell_output_format (#8438).

Dashboard, Desktop, and CLI

• Add in-app upgrades with automatic restart, channel-owned relinking, agent renaming, active runtime context, skill-to-editor navigation, searchable keybinding help, and a unified risk-profile permission grid (#8173, #8734, #7954, #9011, #8558, #9356, #8879).
• Improve terminal chat, code-block copy, picker and overlay sizing, help behavior, and reasoning-only turns (#8920, #8767, #9173, #9008, #9169, #9279, #9292, #9234).
• Embed the dashboard in the universal macOS desktop sidecar and prepare the final DMG for notarization, stapling, and offline validation when Apple credentials are configured (#9032, #9014).
• Reduce the desktop webview's IPC authority by removing shell and store plugin permissions from gateway-served content (#9033).

Channels, Gateway, and ACP

• Add Telegram inbound debounce, poll and interactive-reply events, structured QR-login lifecycle events, and channel-owned readiness probes (#8440, #6297, #8622, #8732).
• Add Mattermost WebSocket listener mode and LAN peer-discovery hints (#9141, #8325).
• Improve QQ and Matrix behavior, restore single-provider voice transcription, persist WhatsApp Web linked identities, and strengthen channel media and alias handling (#9180, #9153, #8735, #9145, #9495).
• Let ACP sessions select an agent with ?agent= and accept blob resources with cited file delivery (#9026, #9195).
• Validate required credentials for enabled Signal and Voice Call aliases while continuing to allow incomplete disabled aliases (#9524).

Providers and Runtime

• Default newly created persisted OpenAI model slots to the Responses API with native tool calling, without changing existing persisted entries or bare provider references (#9021).
• Propagate OpenAI Responses usage and carry model context-window metadata from the models.dev catalog (#9360, #9347).
• Add configurable model vision capabilities and improve provider timeouts, streamed retries, tool-call argument handling, multimodal fallback, and Gemini thought-signature preservation (#9099, #8947, #9113, #9372, #8931, #9102, #8935).
• Surface direct-turn fallback notices and isolate model and provider changes correctly across live sessions and turns (#8684, #8845, #9232).
• Nest memory and RAG spans under the turn trace, and classify web-search provider HTTP failures with precise search_status values (#8752, #8890).
• Preserve complete lifecycle events, trim history by whole turns, and prevent duplicate streamed narration (#9490, #9007, #8951).
• Recommend the capability-bounded local_small runtime profile for newly configured local model providers while leaving existing agent configurations unchanged (#8987).

Configuration, Logging, and Tools

• Preserve partial configuration during salvage and improve dotted-map keys, nested values, dirty-path resolution, and patch error handling (#8836, #9309, #9297, #9243, #9310, #9296).
• Serialize configuration writes and reject unsafe or invalid inputs without panics (#9312, #9059, #9441).
• Align the inert context_compression.enabled schema default with actual runtime behavior and warn when obsolete compression fields are authored (#9299).
• Preserve JSONL rows during automatic schema migration, including mixed-schema files, malformed rows, unterminated tails, reloads, and concurrent accepted writes (#9449).
• Prevent ask_user hangs, improve MCP multiplexing, and normalize Windows paths passed to external search tools (#9452, #9418, #9497).

Security and Supply Chain

• Apply feature-gated Linux Landlock restrictions in the spawned child rather than restricting the ZeroClaw daemon, with scoped workspace and system access and fail-closed required paths (#9233, #9114).
• Stop OAuth delegate targets from inheriting a coordinator's global credential, and reject constrained fulfillments that omit their merchant or payee subject (#8571, #9327).
• Fix Nostr denial-of-service handling for malformed NIP-04 IVs and relay verification-cache poisoning (RUSTSEC-2026-0219 and RUSTSEC-2026-0224) (#9531, #9622).
• Prevent shell injection through the release workflow's workflow_dispatch tag input (#9165).
• Consolidate release provenance around GitHub attestations, required SPDX and CycloneDX SBOMs, final checksums, and one offline verification archive (#9211).
• Repair Scoop and AUR publication paths and rely on Homebrew Core's external autobump service instead of a project-owned Homebrew publisher (#9295).
• Known advisory posture: RUSTSEC-2026-0222 remains waived for Wasmtime 45.0.3 because ZeroClaw uses one process-wide engine and does not expose the advisory's cross-engine store precondition. The dependency upgrade remains tracked separately (#9586, #8519).

Bug Fixes

Area	Fix
Runtime	Preserve complete native tool-call/result turns during retries, retain lifecycle events, trim history at complete-turn boundaries, and avoid duplicate streamed narration (#9372, #9490, #9007, #8951)
Providers	Improve timeout propagation, streamed retry handling, multimodal fallback, Gemini thought signatures, and direct-turn fallback reporting (#8947, #9113, #8931, #9102, #8935, #8684)
Configuration	Preserve partial aliases during salvage, support dotted map keys, serialize writes, surface dirty-path failures, and avoid panics on invalid input (#9309, #9297, #9312, #9243, #9441)
Channels	Send Nextcloud Talk replies through the signed bot API; restore voice transcription; improve QQ, Matrix, WhatsApp Web, media, and alias behavior (#9181, #9153, #9180, #8735, #9145, #9495)
Security	Correct Landlock ownership, credential fallback, fulfillment constraints, desktop IPC permissions, and Nostr advisory handling (#9233, #9114, #8571, #9327, #9033, #9531, #9622)
Logging	Preserve all accepted JSONL rows through automatic schema migration and propagate explicit flush failures (#9449, #9500)
Tools	Prevent interactive prompt hangs, improve MCP routing, and strip Windows verbatim prefixes before invoking external search tools (#9452, #9418, #9497)
Hardware	Resynchronize serial frames and bound robot audio subprocess waits (#9157, #9087)
Install and release	Repair package publication, embed the macOS dashboard sidecar, and prepare notarized and stapled DMG output (#9295, #9032, #9014)

Breaking Changes

• ClawHub skill sources were removed. The built-in clawhub:<slug> source and clawhub.ai URLs are no longer accepted. Existing installed skills are not deleted. Install new skills from a local path, registry name, ordinary Git URL, or use <git-url> --skill <name> to select a skill from a catalog repository (#8638).
• Nextcloud Talk now requires the signed Talk Bot API. Deployments need Nextcloud 27.1 or later with Talk 17.1 or later and must configure the installed bot's shared secret as webhook_secret. bot_token remains a deprecated alias for the same value; app_token is accepted for parsing but is unused. Missing or conflicting secrets reject inbound webhooks with 401 and suppress outbound sends. Draft streaming settings remain parse-compatible but replies are final-only (#9181).
• Generic webhook channels require a secret. An enabled `[chann...

v0.8.3

ZeroClaw v0.8.3

This release is a large consolidation cycle spanning 379 commits from 56 contributors, focused on the new Standard Operating Procedure (SOP) engine, a WebAssembly plugin host, a Git forge channel, and a broad round of runtime, provider, and security hardening. If you run ZeroClaw agents in production, the headline changes are the procedural-memory/SOP substrate, tighter context-budget accounting, and a wave of SSRF and secret-leak fixes. Desktop and quickstart flows also get meaningful polish.

Highlights

• SOP (Standard Operating Procedure) engine lands end to end — a daemon maintenance tick, typed step contracts, live step execution, cron/filesystem/calendar triggers, and an out-of-band approval plane.
• WebAssembly plugin host (wasmtime component model) for tools, channels, and memory, with per-call execution limits, signature-policy enforcement, and registry search/install by name.
• Git forge channel with GitHub and Gitea/Forgejo providers, plus a unified git_forge tool and SOP ingress.
• Self-contained desktop app returns — the kernel now ships as a Tauri sidecar for a Quickstart-first companion experience.
• Cost & usage accounting gains a task-attributed usage ledger, offline pricing catalog, and by-period / org-billed views in ZeroCode.
• Security hardening across the board: multiple SSRF gaps closed, constant-time token comparison, signing-key leak prevention, path-traversal fixes, and dependency bumps clearing several RUSTSEC advisories.

What's New

SOP & Procedural Memory

• A daemon SOP maintenance tick now drives live procedures, executing real steps, enforcing step scope/mode/routing/schemas at the engine boundary, and consuming CAS run claims (#8391, #8399, #8416, #8420, #8430, #8493, #8502, #8506).
• Cron, filesystem, and calendar no-show triggers wire into the maintenance tick (#8400, #8461, #8419).
• An out-of-band approval plane fails closed on timeout, with a priority-based gate fix, and deterministic capability steps now run through a registry that fails closed on driverless steps (#8304, #8724).
• A procedural memory workshop and web visual authoring (experimental) with channel fan-in and a selectable agent were added (#8509, #8590).

Plugins

• A wasmtime component-model host now backs tool, channel, and memory plugins, with channel host bindings (wasi:http, inbound queue, config jail) and a registration API (#8368, #8551).
• Plugins gain per-call execution limits and an FND-001 backend taxonomy, honor the configured signature policy when loading tools, and support registry search plus install-by-name (#8491, #8172, #8264).

Channels & Git Forge

• New Git forge channel with a GitHub provider and SOP ingress, plus a Gitea/Forgejo provider (#8609, #8611).
• Operators can now bind identities without the /bind code round-trip (#8707).
• WhatsApp gains native location-pin support on both backends and passive group context; LINE gets a loading indicator, icon/nickname switching, and bind reply feedback (#8427, #8389, #7768).
• Tool approvals can be routed to a distinct approver channel (#8231).

Runtime & Memory

• Unified memory-context injection is now keyed on TurnOrigin ingress provenance, and a durable memory store seam adds supersede/dedup/budget/policy-gate handling with embedding-identity persistence and automatic vector migration on change (#8619, #8570, #8623).
• Metered provider seams (ResolvedModelAccess::run_model_query) now cover the model-query path and the max-iteration graceful summary (#8806, #8821).
• Process RAM/CPU sampling landed on macOS, Windows, and FreeBSD via sysinfo, and a model-context-window bar was added to the ZeroCode TUI, gateway agent chat, and interactive CLI (#8802, #7946).
• Goal task storage foundation and a configurable native runtime shell were added (#8685, #8311).

ZeroCode (Desktop / TUI)

• A TodoWrite tracker (RPC + ACP + durable persistence) and cron run history/trigger were added, along with a Cost tab with by-period and org-billed views (#8639, #7905, #8483).
• ACP multiple-choice elicitation now uses elicitation/create when the client advertises form support, with single- and multi-select prompts rendered in the ZeroCode Code tab (#8338).
• You can now choose a saved Code session on entry, switch agents in active sessions, and use ctrl-w word delete (#8922, #8477, #8774).
• The self-contained desktop app is reintroduced as a Quickstart-first companion with a bundled kernel sidecar (#8565, #8708).
• Quickstart supports subscription authentication modes and inline CLI subscription auth, while release workflows publish self-contained desktop installers for macOS, Linux, and Windows (#8980, #8981, #8709).

Providers, Tools & Cost

• Provider requests now thread provider_timeout_secs and extra_headers through the responses path (#8229).
• A Bocha AI web-search provider was added, and browser_open now allows http:// URLs and allowed_private_hosts opt-in (#8737, #8136, #8171).
• Cost tracking gains a task-attributed usage ledger, offline pricing catalog, live-gateway price backfill for unpriced models, and cost/org snapshot plus windowed cost/query RPCs (#8686, #8380, #8233, #8482).
• MCP gains resources-as-context, pinning, named-prompt rendering, and a policy-gated resource/prompt client surface (#8508, #8403).

Gateway, Config & Skills

• The gateway adds default HTTP security response headers and agent-aware /api/tools listing with an agent-scoped tool picker (#8829, #8331).
• Config adds independent delegate targets, a local_small runtime preset, and x-required-by-transport metadata for MCP servers (#8239, #8531, #8349).
• Skills install/list/remove are now bundle-aware, surface security-audit-skipped skills, and support an opt-in bounded SKILL.md reflection for skill creation (#8335, #8699, #8261).
• Observability adds a runtime OpenTelemetry content policy for LLM/tool I/O and a rotating log-persistence mode (#8567, #8307).
• Per-turn output routing via send_via with voice-delivery fixes landed (#7361).

Install, Release & Supply Chain

• Standard prebuilts remain on the lean supported channel set, correcting an unreleased broadening introduced after v0.8.2; target-specific Android and ARM exclusions are now resolved centrally, and install.sh --full remains available for the broader source-build surface (#9051, #8566).
• Release automation adds CycloneDX SBOM generation, cosign signing, SLSA provenance, and self-contained desktop installers (#8158, #8404, #8277, #8709).
• Release verification Markdown is escaped before it reaches GitHub workflow output (#9031).

Improvements

• Tool assembly across the runtime (agent creation, independent delegates, process_message, and loop_::run) was routed through a single ScopedToolRegistry seam (#8711, #8744, #8701, #8700).
• MCP prompt-section composition is now owned at the ScopedAssembled boundary, and the orchestrator turn routes back through ResolvedAgentExecution::resolve (#8812, #8629).
• Performance: JSONL fsync moved off the async hot path, the web-search tag-strip regex is cached in a LazyLock, and the orchestrator notify channel is bounded with capped path/URL bodies (#8439, #8350, #8460).
• Windows builds now statically link the MSVC CRT, and prebuilt Docker image variants were consolidated with an added arm64 target (#8604, #8485, #5187).

Documentation

• SOP fan-in usage docs, an autolinked ACP elicitation RFD, and repaired SOP fan-in snippet links were added (#8521, #8498, #8595).

Bug Fixes

Area	Fix
Runtime	Enforce context budget against provider-reported tokens; enforce leading user-turn invariant before dispatch; strip orphaned tool_use on max-iterations exit (#8840, #8696, #7865)
Runtime	Arc-share tool schemas to stop per-iteration clone churn; hot-reload log-persistence config; thread agent_alias into agent_turn's ToolLoop (#8817, #8816, #8921)
Providers	Guard SSE parsers against EOF-as-success truncation; omit tool_choice/empty tool-call content for empty tool lists; clean Anthropic tool schemas before native serialization (#8663, #8667, #8524, #7961)
Providers	Distinguish missing vs expired OpenAI Codex credentials; prefer chatgpt_account_id claim in Codex JWT extraction; cool down rate-limited fallback entries (#8029, #8002, #8317)
Security	Close SSRF gaps in Matrix marker URLs, text_browser, and skill_http userinfo; harden WeChat attachment path against traversal (#8657, #8635, #8658, #8628)
Security	Constant-time nodes.auth_token comparison; reject empty bearer token; prevent signing-key leak via VarError; scan link/image destinations for credential patterns (#8824, #8727, #8591, #8906)
Config	Protect runtime state files and real config.toml from agent self-modification; auto-materialize new map aliases in config patch (#8660, #8606, #8842)
Channels	Localize channel runtime replies; use resolved agent config for strict_tool_parsing/parallel_tools; serialize per-sender session persistence to prevent races (#8769, #7836, #7847)
ZeroCode	Fix intermittent ask_user failures under ACP elicitation; use runtime-profile max_context_tokens for context meter; strip markdown fences from code-block copy (#8773, #8872, #8777)
Memory	Refresh embedder on config change; resolve dotted embedding provider refs; make SqliteMemory: Clone valid by sharing one embedder lock (#8625, #8152, #8868)
Gateway	Propagate pairing DB errors instead of panic; advertise A2A cards on the runtime port; exclude env-overridden secrets from reload drift (#8466, #8538, #8704)
Cost	Atomic ledger appends with concatenated-record recovery; observability CLI one-shot no longer loses telemetry/token totals on exit (#8412, #8146)
Deps	Bump crossbeam-epoch (RUSTSEC-2026-0204), anyhow (RUSTSEC-2026-0190), and remove rag-pdf/ttf-parser (RUSTSEC-2026-0192) (#8783, #8500, #...

v0.8.2

ZeroClaw v0.8.2

ZeroClaw v0.8.2 opens up two new front doors: A2A agent discovery for agent-to-agent interop and a richer skills story (user-configured extra registries, typed slash-command options). Underneath, the release sharpens ZeroClaw's security posture across plugins, channels, and the SOP runtime, lands a durable run/task control plane, and broadens channel surfaces (Discord interaction components, Slack attachments, WhatsApp group allowlists). It spans 152 commits from 31 contributors. Much of this is invisible at the surface and shows up as fewer leaks, fewer duplicate launches, and turns that behave the same on every transport.

Highlights

• A2A agent discovery (#7763): agents can describe and discover one another over the gateway, opening up agent-to-agent interop.
• Richer skills story: user-configured extra skill registries via registry:<name>/<skill> (#7827) and typed slash-command options in SKILL.md frontmatter (#8021).
• Installation now adds zeroclaw to PATH automatically with a --no-modify-path opt-out (#8038).
• Untrusted inbound content is now framed and sanitized before a model ever sees it, both through the new universal ingress policy layer and SOP trigger-payload framing.
• A new durable run/task control plane backs SOP run-state, live run metrics, and delegate/subagent supervision in SQLite.
• Plugins gained an SSRF guard on zc_http_request, per-alias config scoping, and removal of raw environment access.
• Discord channels picked up interaction components (buttons, selects, modals, autocomplete, buttoned approval) and rich outbound embeds.
• The Telegram bot token and similar secrets are now redacted through the canonical global leak detector instead of channel-local regexes.

Security

ZeroClaw treats every inbound payload as untrusted and tightens the seams an attacker would reach for.

• Universal ingress policy layer (#7997): every inbound turn passes one SOP-backed policy layer before a model sees it, on every transport including mid-turn steering injections. Always on, default disposition is Loop, behavior identical until a Gate is configured.
• SOP trigger-payload framing (#8215): MQTT and webhook trigger topics and payloads are capped, sanitized, and framed in untrusted-content markers behind a security notice, so an injected event cannot forge instructions into the step context.
• Plugin SSRF guard (#8128): zc_http_request now blocks SSRF, including DNS-rebinding and redirect bypasses, with the host classifier moved to infra.
• Plugin config isolation (#8137): plugin config is scoped per-alias, raw env access is removed, and caller-supplied __config is stripped before injection.
• Telegram token redaction (#8127): every Telegram error site routes through the canonical leak detector, which gained a /bot<id>:<token> pattern, closing token leaks via reqwest error Display.
• MCP tool scoping (#8120): MCP tools are scoped per-agent and the denylist is enforced across all connect sites, including the gateway.
• Principal type and AuthProvider seam (#8063): the shared authenticated-subject contract and pluggable inbound-auth seam from RFC #7141 land with no production call sites yet, so runtime behavior is unchanged.
• HMAC tool receipts (#8009): HMAC tool receipts are wired through the ACP, gateway WS, and CLI turn paths.
• WhatsApp MAC storage (#7912): app-state mutation MACs are stored raw rather than JSON-wrapped, fixing a verification regression.
• Authenticated self-test probe (#7732): the websocket handshake probe now authenticates instead of relying on an unauthenticated path.
• A2A task auth (#8274): A2A task invocation now requires auth while discovery cards stay public.
• Delegate sub-tool gating (#8284): delegate sub-tools run under the parent's SecurityPolicy.

Gateway

• A2A agent discovery surface (#7763).
• xAI OAuth login support (#7945).
• Email-login subcommand for OAuth2 email channel auth (#8008).
• Device registration on legacy /pair with backfill of orphaned paired tokens (#7993).
• Agent rename is persisted before owned state is moved (#7940).
• The gateway drains before RPC reload (#8104).
• Dashboard Skills page reflects an agent's effective skills (#7963).
• Provider and channel alias deletes cascade through referencing surfaces (#8074).
• The reserved default agent cannot be created across operator surfaces (#8098).
• Option-backed tunnel providers surface in the picker (#8026).
• enabled is accepted on CronPatchBody for pause and resume, with the agent check scoped to shell-command patches (#7666).

Skills

• User-configured extra skill registries via registry:<name>/<skill> (#7827).
• Typed slash-command options in SKILL.md frontmatter (#8021).
• ZEROCLAW_SESSION_ID exposed to skill shell tools (#8035).
• Plugin-bundled and bundled skills load via read_skill (#7245).
• truncate_output guards against UTF-8 char boundaries (#7962).

Install and Update

• zeroclaw is added to PATH automatically, with a --no-modify-path opt-out (#8038).
• Windows self-update repaired and the update pipeline hardened (#7853).
• Intel versus Apple Silicon detection for the prebuilt target triple (#8096).

Runtime and Engine

• Durable run/task control plane with delegate and subagent supervision (#8217).
• ResolvedAgentExecution::resolve routes the production turn paths (#8179), with per-agent ToolLoop fields bundled into it (#8156) and the loop args bundled into a ToolLoop struct (#7969).
• History pruning and compression were removed in favor of a single whole-turn trim with a visible RPC event (#8196).
• Self-contained context-compression summary provider (#7973).
• System prompt refreshes on tool dispatcher swap (#8126).
• Native and MCP tools are presented to reasoning models in the system prompt (#8053).
• Streamed narration no longer duplicates before native tool calls (#8014).
• Missing-skill suggestions are based on the effective tool set in the process_message path (#7819).
• Cached extra registry skills are now suggested (#8185).
• Agent-loop log events are categorized and verb-tagged (#8067).
• Path-listing tool results are gated from vision routing (#7345); the no-vision capability error is scoped to the latest user image (#8180).
• Config alias renames cascade safely across referencing surfaces (#8109).
• Channel, agent_alias and turn_id propagate to agent lifecycle observer events (#7771).
• Repeated shell approval loops are bounded (#7901).
• Auto-approved tools are allowed on channels at non-Full autonomy (#7959).

SOP

• Durable SQLite run-state store with live run metrics (#8206).
• SopRunStore trait plus an in-memory backend as EPIC B scaffolding (#8001).

Plugins

• Plugin docs aligned with the WIT target (#8061), alongside the SSRF guard and per-alias config scoping covered under Security.

Channels

• Discord: interaction components including buttons, selects, modals, buttoned approval, and autocomplete (#7965); rich outbound embeds from [EMBED:{...}] markers (#7833); slash command localizations and guild scope (#7922).
• Slack: outbound attachment uploads (#7170).
• WhatsApp: per-JID allowed_groups group allowlist for Web mode (#7720).
• Lark: restored outbound media markers (#8113).
• Scope-selectable /model overrides (user or agent) for chat channels (#7998).
• Tool-result content is preserved when proactively trimming channel history (#8050).
• Bound channels are suppressed when their owning agent is disabled (#8051).
• Voice channels no longer cache config-derived static_voice_peers on the channel handle (#7982).
• Matrix: restored room management tool (#8068).
• Per-sender /thinking overrides restored (#8011).
• Re-loadable media refs preserved in cached history (#8153).
• refreshed_new_session_system_prompt loads bundled skills (#8203).

Web and Dashboard

• Themed click-to-open config pickers via a Select primitive (#8086).
• Component-health fix-in-place modal (#8087).
• Config-alias rename plus delete cascade preview (#7919).
• Config drift conflict surfaced on the enable and disable toggle (#8042).

ZeroCode and TUI

• Aliases and Costs tabs on the provider alias list (#8006).
• Registry-driven pane help, themed code-fence syntax highlighting, per-fence copy, and unified split-pane config navigation (#8282).
• Daemon version mismatch detection (#8192).
• MCP initialized for Chat TUI sessions (#8199).
• Active config directory surfaced in the Config header (#7999).
• Approval overlay background filled (#7823).
• Queue-paused hint skipped when the backlog is empty (#7857).
• Chat surface refresh: mode bar and code-block chrome, browse-mode badge, and mouse click-to-copy (#8000).
• Selected field is visually distinguished from the editable input (#7995).
• Queue pauses when a turn is cancelled (#8214).
• Browse mode enter/exit moved to alt+shift+up/down (#8166).

Cost and Budget

• Budget config is reloadable instead of frozen at boot (#8004).
• Model cost captured for RPC, zerocode TUI, and standalone ACP turns (#7953).
• Agent turn costs are persisted (#7957).
• Logs correlate by trace_id with per-call cost_usd recorded (#8065).
• Opt-in LLM request payload capture, default off (#8066).

Knowledge and Memory

• Client relationship graph actions restored (#8182).
• Embedding key decoupled from the chat provider, surviving embed failures (#7942).
• SQLite sessions are kept out of hygiene archives (#8318).

Presets

• Balanced redefined as the trusted-local daily driver (#8133).
• The yolo preset is fully unrestricted (#8281).

Bug Fixes

Area	Fix
config	Gate Android shell import on non-Windows (#8189)
tools	Normalize Windows workspace-prefixed paths (#8114)
tools	Resolve external coding tool working_directory from project root (#7967)
tools/image	Expose stable attachment paths in image-generation output (#7985...

v0.8.1

ZeroClaw v0.8.1

ZeroClaw v0.8.1 is the first patch release on the v0.8.x line, focused on stabilizing the multi-agent runtime, channels, and provider stack that landed in v0.8.0. It spans 207 commits from 45 contributors since v0.8.0 — heavy on bug fixes (123), with substantial new features (46) including a delete/rename-with-cascade configuration story, Discord slash commands derived from installed skills, an OpenAI-compatible cached-input pricing path, and a Phase 0 agent eval harness.

If you upgraded to v0.8.0 and hit rough edges with channel routing, cron delivery, provider replay, or config save round-trips, this is the release that picks those up.

Highlights

• Cascading config edits: delete_with_cascade and rename_with_cascade now ripple through agents, providers, channels, model providers, and skill bundles instead of leaving dangling references (#7837, #7838, #7839, #7830, #7840, #7841, #7842, #7785).
• Discord skill-driven slash commands: dynamic slash commands generated from installed skills, with typed options, chunked interaction followups, edit/delete/bulk-delete archive sync, and configurable reaction recording (#7490, #7489, #7525, #7526, #7844).
• Operator Console redesign: the gateway web UI ships a schema-driven config editor, multi-agent chat, read-only skills browser, and a long list of ported fixes (#7665, #6700).
• Cached-input pricing for OpenAI-compatible providers: cost tracking now captures cached_input_tokens for any provider that reports them, including OpenRouter system-prompt caching (#7492, #7634).
• Phase 0 agent eval harness: deterministic replay-driven evaluation lands as the foundation for the eval story going forward (#7067).
• Workflow hardening for releases and docs: a canonical install spec drives every generated installer surface (#7558), gh-pages becomes ephemeral with bounded clone size (#7676), and rustdoc is published once and deduped per locale (#7754).

What's New

Multi-agent and config

• Typed delete_with_cascade and rename_with_cascade for aliased entries thread through agents, channels, model providers, and skill bundles, with a find_all_references / plan_delete foundation under the hood (#7785, #7837, #7838, #7839, #7830, #7840, #7841, #7842).
• Per-agent delegate roster with cross-profile reach (#7590).
• Type-driven alias-ref pickers and self-declaring config enums in the Config menu, plus declarative section grouping (#7556, #7594).
• Agent eval harness — Phase 0 with deterministic replay (#7067).

Channels

• Discord: dynamic slash commands derived from installed skills, dispatched over the existing Gateway WebSocket, with typed options and chunked interaction followups (#7489, #7490, #7844). Inbound reactions are recorded behind a scope config (#7526). Archive syncs on message edit, delete, and bulk delete (#7525). Gateway intents are derived from config instead of hardcoded (#7524). The internals were split into a module tree behind a structured outgoing payload (#7832), and Discord is now part of the default-channels bundle (#7825).
• Slack: backfills thread context on first agent encounter (#6428).
• Email: XOAUTH2 auth, observer mode, and read-only IMAP tools (#7021).
• WhatsApp: Web media markers are sent natively (#7811).
• Voice pipeline facade for channels that want to plug into audio I/O (#7394).

Providers and runtime

• Cached input token pricing surfaces for OpenAI-compatible providers (#7492); OpenRouter system prompts are cached (#7634).
• NEAR AI Cloud provider added (#6842); Azure OpenAI gains a dedicated reasoning_effort wire-up (#7350); extra_body is supported on any OpenAI-compatible provider (#7163); custom inference providers can specify tls_ca_cert_path (#5797).
• Provider Manifest is re-added under the schema v3 provider system (#7791).
• MCP auto-reconnects on stale session or dropped stream (#7351).
• The three legacy agent turn engines consolidate onto a single run_tool_call_loop path (#7540).

Gateway, web, and CLI

• Inbound webhooks route per channel alias (#7367).
• Web chat input supports slash commands (#7223).
• Agents/providers/channels CRUD lands in the CLI with skill-bundle cascade (#7842).
• Gateway: agent owned-state rename/delete cascade and wiring (#7838, #7841).

zerocode and security

• New doctor pane in zerocode (#7802); session controls and provider diagnostics improvements (#7515).
• models list/doctor lists configured models, adds --check, and collapses probe rows (#7450).
• Agent posture status command (#7321).
• Shell tools see the current session id via the ZEROCLAW_SESSION_ID environment variable (#7813).

Skills, plugins, and memory

• Background review fork plus the skill_manage tool (agentskills.io SKILL.md) (#6667).
• Frontmatter tags surface in the skill editor with a slash-command toggle (#7734).
• Skill-directory loads are cached, content-validated, and audit-correct (#7786).
• Wasmtime dependency and feature flags land for the plugin host (#7429).
• Memory hygiene extends to pruning daily and core DB rows (#7081).
• Runtime memory ops are instrumented with OTel GenAI spans (#7570).

Build, install, and docs infrastructure

• Canonical install spec + cargo generate installers drives setup.bat, AUR PKGBUILD, Scoop manifest, flake.nix, Dockerfile/Containerfile feature sets, and dev/ci/docker-tags.toml, with an Installer Drift CI gate (#7558).
• gh-pages becomes ephemeral with bounded clone size (#7676); rustdoc is published once and deduped per locale, with print pages dropped (#7754).
• macOS and Windows build legs in CI run as cargo check to keep the matrix fast (#7669).

Improvements (refactor)

• Extract duplicate domain/URL validation into shared helpers in zeroclaw-tools (#7340).
• before_llm_call now takes mutable borrows, simplifying provider implementations (#7667).

Documentation

• First-party extension architecture guide for contributors (#7788).
• Fluent strings and mdbook translation catalogs refreshed for v0.8.1 (#7939).
• Discussions stewardship and issue intake forms for governance (#7654, #7652).
• API events stream semantics for the gateway (#7474); ACP wire shape pinned to v1 spec (#7595); MCP tool control boundaries clarified (#7473).
• Rootless Debian compose example for the container (#7475); Linux uninstall script in setup docs (#7715); OpenAI Codex over a ChatGPT subscription documented for providers (#7116).
• README installer options synced (#7708) and the providers routing link fixed (#7185).

Performance

• Rustdoc published once with per-locale asset dedup (#7754).
• WeChat markdown regex compilations cached via LazyLock (#7494).
• Skill-directory loads cached with content validation (#7786).

Bug Fixes

Area	Fix
runtime	Route stdout diagnostics through logs (#7934); replay ACP session history in session/messages (#7903); credential redaction moved to the rendering layer (#7826); skip response-cache for [IMAGE:] multimodal markers (#7779); honor profile tool iteration limits (#7583); forward trimming budgets through the agent_turn wrapper (#7780); auto-include discovered MCP tools in risk_profile.allowed_tools (#7547); thread shared CanvasStore into WS chat and ACP sessions (#7678); resolve runtime profiles for direct turns (#7792); restore native sandbox hardening (#7683); detect no-progress loops across interleaved tool calls (#7681); redact unquoted base64 credentials (#7660); recover poisoned activated-tool lock reads (#7755); keep pruned tool markers out of live context (#7775); condition anti-narration on show_tool_calls (#7722); return no heartbeat runs for zero limit (#7721); route native tool narration to stderr (#7773); unify SopEngine construction (#7546); honor empty delegate allowed-tools (#7574); expose deferred MCP tools to delegates (#7608); route service commands to named instances (#7579); suppress skill suggestions for installed tools (#7406); clarify peer send targets (#6993); preserve delegate memory namespace (#7465); inherit ACP session cwd into spawn_subagent and delegate (#7517).
zerocode	Refresh agent picker on Code/Chat tab re-entry (#7834); enforce RPC-only boundary by dropping zeroclaw-providers (#7850); grapheme-cluster cursor movement and backspace (#7765); localize config status messages (#7713); avoid hardcoded vi editor fallback (#7476); theme markdown body text (#7482); keep Cmd-C separate from quit on macOS (#7477).
providers	Normalize Azure OpenAI credentials (#7703); retry email OAuth refresh failures (#7745); stop reasoning_content from leaking into response text (#7725); preserve structured Bedrock tool results (#7712); redact reliable error endpoints consistently (#7682); preserve compatible reasoning field name on multi-turn replay (#7423); cache OpenRouter system prompts (#7634); fail loudly for unusable fallback providers (#7419); resolve Gemini OAuth project from object and current-project shapes (#7560); remove dead pre-normalization image trim (#7782); honor configured OpenAI timeout_secs (#7504); trace native tool delivery decisions (#7933).
channels	Dedupe QQ voice redeliveries (#7648); add per-channel ack_reactions override for Lark/Feishu (#7495); make Slack bot_token optional and resolve from env (#7726); persist Matrix thread history after first reply (#7705); require IRC mention boundaries (#7710); add clear-session command (#7671); Telegram base URL validation (#7697); stabilize missing email message ids (#7767); make Slack empty-peer-set rejections self-diagnose (#7567); skip reply-intent classifier on direct messages (#7564); WhatsApp as a cron delivery channel (#7562); select WhatsApp Web backend from personal/pairing config (#7565); WhatsApp Web forward quoted media attachments (#7536); telegram delivery prompt no longer discoura...

v0.8.0

ZeroClaw v0.8.0

ZeroClaw v0.8.0 is the big one. One daemon now runs many named agents, each with its own workspace, memory, model provider, security policy, channels, and personality, coordinated by a rewritten configuration schema that migrates your existing setup automatically. The release spans 439 commits (not including the squashes) from over 100 contributors since v0.7.5, and also introduces the zerocode terminal UI, a unified logging and attribution pipeline, and a hardened security posture across channels, tools, and the gateway.

With the big sweeping code changes behind us, expect the v0.8.x series to ship at a more regular pace from here.

Highlights

• Multi-agent runtime: run any number of named agents from one daemon, each with isolated workspace, memory, skills, model provider, and risk profile. Channels, cron jobs, webhooks, and ACP sessions all dispatch to a specific agent.
• Schema V3 with automatic migration: existing configs migrate in place on first load. Provider entries support multiple named aliases per provider, and a single malformed entry no longer wipes its neighbors.
• zerocode: a new terminal UI with dedicated Chat, Code, Dashboard, Config, Quickstart, and Logs panes. One daemon, many zerocode TUIs: attach from as many terminals as you want, each with its own identity and sessions. The Code pane speaks ACP with no configuration required.
• Security hardening: per-agent tool allowlists enforced at every dispatch path, bearer-token revocation on device rotation and deletion, secret redaction extended to nested config shapes, private-host allowlists for outbound HTTP tools, and a fix for a Canvas iframe token-theft advisory (GHSA-f385-f6h2-3gqj).
• Observability rework: a unified structured logging pipeline carries agent, model, and session attribution through every span, streaming to a new Logs page in the dashboard and a gateway logs endpoint.
• Lean default channel bundle: prebuilt binaries now ship the core channels by default with the rest available as opt-in build features. Check the docs if a channel you use is missing after upgrade.

Since v0.7.5

Multi-agent (the star of the show)

You can now run a whole team of agents from a single daemon (#6398): a coding agent with full shell access in one workspace, a locked-down family assistant on Telegram in another, a research agent with its own memory and a cheaper model in a third. Each agent is a first-class identity through the entire stack:

• Per-agent everything: workspace directories, memory stores with per-agent isolation across the SQLite, Postgres, and Qdrant backends, skill bundles, persona files, and per-agent model-provider resolution in every chat path.
• Channels: each channel binds to an owning agent, with per-agent runtime contexts, structured session routing, identity injection so an agent knows who it is on each channel, and media uploads routed into the owning agent's workspace.
• Security policy per agent: each agent's policy can allow or exclude individual tools, enforced at the dispatch site; every risk-profile setting now propagates into the live policy; SubAgents are depth-capped and gated by the parent agent's risk profile.
• Cron: scheduled jobs are bound to a specific agent with delivery-channel scoping, and the old implicit default-agent fallback is gone.
• ACP: sessions select an agent explicitly, auto-select when only one is configured, respect configurable session limits, and the bridge accepts a custom config location.
• Dashboard: a multi-agent rework with per-agent status and memory views, RAM and CPU widgets, a Memories tab, and a sandboxed per-agent workspace file explorer.
• Cost tracking: rates are organized per provider and model, cached-input tokens are captured, and the dashboard shows per-agent and per-model cost splits with an editable rate sheet.

zerocode terminal UI

v0.8.0 ships zerocode, a full terminal UI for ZeroClaw (#6848). It talks to the daemon over a new RPC transport with persistent sessions (#7182) and rides out daemon restarts by reconnecting in place (#7158).

Connection: local socket or remote WSS

Locally, zerocode connects over a Unix domain socket (a named pipe on Windows) with no setup at all. For a daemon on another machine, a TLS WebSocket transport connects your workstation to a Raspberry Pi, home server, or VPS with a self-signed certificate and a token. One daemon serves many zerocode instances at once: each connecting TUI gets its own signed identity and environment snapshot in the daemon's registry, sessions are tmux-style persistent (#7182) so closing your laptop and reconnecting an hour later from a different network finds your session intact.

Shell environment pass-through

A daemon started as a service has a stripped-down environment; your terminal has the real one. On a local socket connection, zerocode forwards its full shell environment to the daemon at handshake, and every shell subprocess your agents spawn gets it overlaid on top of the daemon's safe baseline, with zerocode's values winning on conflict. Your PATH, SSH agent socket, and credential helpers just work, no configuration required.

Themes

Named color themes with per-agent overrides in the Code and Chat panes, inline palette previews before you apply, automatic adaptation to your terminal's color depth, and a terminal theme that inherits your shell's own colors (#7249).

Keybindings

Four built-in presets (default, vim, emacs, arrows-only) plus per-action rebinding through an in-app capture modal. Changes apply live, no restart. Press ? on any pane for context-aware help showing the bindings that apply right where you are.

Chat

Conversational sessions with any of your agents: full memory, skills, channel-style context, live model and provider switching mid-conversation (#7209), and an outbound message queue so you can keep typing while a turn is in flight (#7190).

Code

A coding workspace built on ACP, the same protocol that powers editor integrations, with zero configuration required: open the pane and it just works. Code sessions are tuned for the job: memory tools are excluded server-side (#7177) so your coding agent stays focused on the tree in front of it instead of consolidating chatter, sessions persist and survive kills cleanly (#7258), and the working directory, branch, and commit are always visible (#7159).

Dashboard

Live per-agent status with RAM and CPU for the daemon process, distinguishing loading, error, and live states at a glance.

Config

The entire configuration in a split-pane editor with built-in, registry-driven help for every field. Edit agents, providers, channels, and policies without touching a text editor.

Quickstart

Guided agent creation end to end: pick a provider, paste a key, choose a model from the live catalog, set a personality, and land directly in Chat with your new agent.

Logs

The daemon's structured log stream, filterable and attribution-aware, in the same terminal you work in.

Providers

• New providers: Kilo AI Gateway, GitHub Models (#6445), Morph (#6440), Manifest (#6268), atomic-chat (#6513), a dedicated llama.cpp provider (#6417), seven more OpenAI-compatible providers (#7260), and MiniMax split into Global and China entries (#6758).
• Native extended thinking for Anthropic and Bedrock (#5652), prompt caching for OpenRouter (#6008), native Responses-protocol tool calls for Codex (#6117), automatic fallback to a secondary provider on failure (#7178), and the Responses wire protocol honored across custom, OpenAI-compatible, and llama.cpp providers (#7180, #7172, #7418).

Channels

• New channels: Twitch chat (#7275), WeCom AI Bot (#6680), AMQP with mutual TLS (#7369), and multi-tenant Linq with per-agent routing (#7041).
• Per-recipient reply pacing across nine channels (#6389), a configurable in-flight message budget (#7391), webhook retry with exponential backoff (#5838), a reply-intent precheck that can route to a cheaper per-agent classifier model (#6068, #6945), and selective channel builds behind the new lean default bundle (#6866, #6904).

Tools and plugins

• New tools for downloading remote files into the workspace (#6957), uploading single files and bundles over HTTP (#6773), sending messages to channels directly from the agent loop (#6665), reading and writing binary files (#7004), and authenticated outbound H...

v0.8.0-beta-2

ZeroClaw v0.8.0-beta-2

This is the second beta of the v0.8.0 line, and the largest release since v0.7.5. Its headline is zerocode — a brand-new, full-featured terminal UI for running and operating your agents without leaving the terminal. Around it, this release ships the multi-agent runtime and schema V3, a rebuilt Quickstart onboarding flow that works identically across the CLI, zerocode, and the web dashboard, and a deny-with-edit approval mode that lets you rewrite a tool result inline. Hundreds of fixes harden the credential boundary, token accounting, sandboxing, and channel delivery.

Because this beta consolidates two milestones, the What's New section is framed twice: everything since v0.7.5 (the last stable release) and the subset that is new since v0.8.0-beta-1. Contributor credits below cover the v0.8.0-beta-1 → beta-2 window.

Meet zerocode

zerocode is a complete terminal interface for ZeroClaw — a standalone binary that connects to a daemon and gives you a five-pane workspace for everything from chatting with an agent to editing config to reading live logs. It speaks to the daemon over a filesystem-permission-gated local socket (Unix domain socket or Windows named pipe) or a remote WSS connection, and it can spin up its own ephemeral daemon if one isn't already running.

What you can do in zerocode:

• Chat with any configured agent — streaming responses, an agent picker, an inline approval overlay for supervised tool calls, and a /toggle-thinking command to show or hide the model's reasoning.
• Code in an ACP (agent-coding) session against any working directory you pick, with syntax-highlighted file_edit / file_write diffs (tree-sitter via inkjet), absolute line numbers, and a deny-with-edit flow that lets you rewrite a proposed change before it's applied.
• Configure the whole daemon from a live config manager: nested navigation, kind-aware editors (enum selects, list editors, masked secret fields), $EDITOR integration for long values, fuzzy filtering, and composite editors generated from the wire-level schema — no hardcoded forms.
• Watch structured, alias-attributed logs with stacking filters, attribute search, a follow toggle, and a resizable detail view.
• Operate from a Dashboard with per-agent status, a one-keystroke daemon reload, connection status with reconnect, and a roster of connected TUIs.

It's built to feel native: full mouse support (selection, scrollbar drag, multi-select, pane cycling), a reusable input bar with soft-wrap and clipboard paste, per-OS key dispatch, locally-configurable themes and keybindings (with presets and chord serialization), and an HMAC-signed session identity that survives reconnects. Strings route through an independent Fluent catalogue, so zerocode is localizable from day one.

One daemon, as many TUIs as you want

The daemon is the single source of truth; zerocode is just a client. Open as many zerocode windows as you like against one daemon — every connected TUI shares the same agents, sessions, and config, and each appears in the others' "Connected TUIs" roster. Those clients can be a mix of local (Unix socket / named pipe) and remote (WSS) connections to the same daemon, so you can drive a long-lived daemon on a server from several terminals at once.

If you launch zerocode and no daemon is running, it spins up its own ephemeral daemon automatically (--ephemeral). That daemon's lifetime follows its clients: it stays up as long as at least one TUI is connected, and when the last one disconnects it waits a short grace period (so a quick reconnect doesn't kill it) and then shuts down on its own — no orphaned background process. A daemon you start yourself (zeroclaw daemon) is the opposite: it persists until you stop it, and TUIs come and go against it freely.

Your settings stay local

zerocode keeps its own client config in <config_dir>/zerocode-config.toml — your theme, keybindings, and locale — completely independent of the daemon's config.toml. It's read locally regardless of what you connect to, so the same preferences apply whether you're driving a local socket session or a remote daemon over WSS. Settings layer defaults → file → ZEROCODE_* env, so you can override any of them per-invocation without editing the file.

How the local socket works

Local connections use a platform-native, permission-gated endpoint — no TCP port, no token:

• Unix-like (Linux/macOS): a Unix domain socket at <data_dir>/daemon.sock, created with 0600 permissions so only the owning user can connect. On Linux the daemon reads the peer's PID/UID via SO_PEERCRED for the connection label.
• Windows: a named pipe at \\.\pipe\zeroclaw-<hash>, where <hash> is derived from the data directory so each install gets its own pipe in the kernel object namespace.

The endpoint is auto-derived from the daemon's data_dir (override with $ZEROCLAW_SOCKET), and the same JSON-RPC line protocol runs over the local socket and over WSS — remote access is the same surface, just tunneled over TLS.

Your shell environment comes with you

When zerocode connects over the local socket, it captures your real shell environment and sends it in the handshake. The daemon then overlays that environment onto any shell subprocess it runs on your behalf (your PATH, SSH_AUTH_SOCK, GPG_TTY, and the like take precedence over whatever the daemon process inherited). The practical payoff: hardware-backed credentials just work — if your ssh-agent is fronting a YubiKey (or any FIDO/PIV token), an agent that runs git push or an SSH command authenticates through your key exactly as if you'd typed the command yourself, with no key material ever stored in the daemon. Because the forwarded variables come straight from your terminal session, vars like SSH_AUTH_SOCK reach the subprocess even though they aren't on the daemon's default safe-env list — that's deliberate, and it's why the integration is seamless.

Highlights

• zerocode — a new terminal UI for ZeroClaw. A standalone binary with a five-pane workspace (Chat, Code, Config, Logs, Dashboard) that connects to a local or remote daemon and lets you run agents, edit config, approve tool calls, and read live logs without leaving the terminal. Open as many windows as you want against one daemon — local or over WSS — and if none is running, zerocode spins up an ephemeral one that cleans itself up when you're done. See Meet zerocode above.
• Multi-agent runtime + schema V3: run several named agents from one daemon, each with its own model provider, risk profile, runtime profile, channels, and memory namespace.
• Quickstart, a rebuilt onboarding flow that replaces onboard: one backend-authored field shape drives CLI, TUI, and web with no duplicated picker rows, live model catalog, personality-file templates, and an atomic apply.
• Deny-with-edit approvals: when a tool call needs approval, you can edit the proposed result inline and hand the edited value back to the agent as the tool result, with the substitution recorded in the audit trail.
• Filesystem-permission-gated RPC socket replaces pairing-token auth for local IPC — the socket path is the trust boundary.
• Internationalization: CLI and TUI user-facing strings now route through Fluent, with on-disk catalogue loading and per-user locale selection.

What's New since v0.7.5

Agent & Runtime

• Multi-agent runtime and schema V3: multiple named agents per daemon, each with independent provider/profile/channel/memory configuration (#6398).
• New rpc/ dispatch layer with a shared turn executor and a single Method enum as the source of truth (#6837).
• --ephemeral daemon mode for TUI auto-spawned daemons (#6818).
• Streaming turns are bounded by an idle-timeout freeze guard so a stalled stream can't wedge a session.
• Per-agent classifier_provider routes the reply-intent precheck to a cheaper model (#6945); per-agent memory-recall limit is configurable via the runtime profile.
• MemoryStrategy trait with a DefaultMemoryStrategy for pluggable context loading (#6907).
• Delegation is gated on a shared risk profile and the caller's delegation_policy; the advertised roster is filtered to same-profile peers.

zerocode & the RPC layer

zerocode is covered in depth in Meet zerocode above; the daemon-side groundwork that makes it possible:

• A new rpc/ dispatch layer with a shared turn executor and a single Method enum as the source of truth — every RPC method is compiler-checked, no string-literal dispatch (#6837, #6817).
• Filesystem-permission-gated local IPC over a Unix domain socket, with Windows feature parity via named pipes; pairing-token auth removed in favour of the socket as the trust boundary (#6837).
• An --ephemeral daemon mode so zerocode can auto-spawn a daemon when none is running (#6818); WSS transport for remote connections; an file/attach RPC method with base64 + path modes for inline attachments.
• Shared API types so the gateway, RPC dispatch, and zerocode all read one definition; config-introspection methods that drive the live config manager (#6825).

Quickstart & Onboarding

• Quickstart lands end-to-end and retires the legacy onboard surface — a single shared field-shape API consumed by CLI, TUI, and web with no hardcoded labels.
• Atomic apply for agents, peer-groups, personality files, and skills FTUE; live model picker across all three surfaces; explicit template/scratch/skip choice per personality file.
• CLI rebuilt as a step-by-step checklist; provider/channel picker rows driven from canonical registries; humane failure messages.

Channels

• New WeCom AI Bot WebSocket channel (#6680); Lark/Feishu approval requests (#6852) and Lark as a cron delivery channel (#6851).
• Selective channel builds — compile only the channels you need and filter the channel list by compiled features (...

v0.8.0-beta-1

Changelog: v0.7.5 → v0.8.0-beta-1

v0.8.0 turns ZeroClaw from a single-agent daemon into a true multi-agent host. One install now runs many named agents side by side, each with its own identity, workspace, memory, model provider, channels, and security profile, and they can talk to each other through peer groups or spawn scoped sub-agents. Delivering that meant a ground-up config rewrite (schema V3) plus a new on-disk layout, so this is a large, breaking release. Upgrades migrate automatically on first boot; read the Breaking Changes section before upgrading a production install, especially if you run Postgres or Qdrant memory.

Highlights

• Multi-agent, for real. Declare any number of agents under [agents.<alias>]. Each gets its own identity files, its own agents/<alias>/workspace/ (which is also its security boundary), its own memory scope, model provider, channels, and risk/runtime profiles. Old single-agent installs migrate into one default agent on first boot.
• Per-agent memory isolation. Every memory backend (SQLite, Postgres, Qdrant, markdown) is wrapped so an agent only sees its own rows by default. Controlled sharing is opt-in via read_memory_from. Memory is keyed by (agent, key), so two agents can use the same key without collision.
• Peer groups + sub-agents. Agents bound to the same channel type can message each other in-process through a [peer_groups.<alias>] membership list; non-members are rejected with a reason. Agents can spawn depth-limited sub-agents (spawn_subagent) that can never escalate beyond the parent's risk profile, and cron jobs now run as agent-scoped sub-agents.
• Agents know their own identity in shared channels. Each bot's platform-native mention (Discord <@id>, Slack <@id>, Telegram @user) is injected into its system prompt, and the lookup is fixed for aliased channels. Co-resident agents that share a channel no longer mistake another agent's @-mention for their own or reply with the wrong user ID.
• System prompt calibrated against over-refusal. Agents previously erred toward silence and would decline a request because the answer was "already in memory." The prompt now skews toward replying and treats memory as supplementary context, not a gate on whether to respond; ACP sessions always produce a reply.
• Schema V3 with automatic migration. A typed V1→V2→V3 migration chain rewrites your config in memory on every load and writes a .backup when you commit it with zeroclaw config migrate. The install tree is split into data/ (shared databases), shared/ (host-wide skills), and agents/<alias>/workspace/, with timestamped backups.
• Rebuilt observability. A new zeroclaw-log crate and unified record! macro carry alias-bound, structured attribution through every log and trace. New /api/logs endpoint and a Web Logs page surface it live.
• Reworked web dashboard. A multi-agent dashboard with per-agent status/memory/cost/sessions, an in-browser agent workspace explorer, a tool-approval UI for supervised mode, skill-bundle editing, and a cross-section draft store with an unsaved-changes banner.
• More providers and channels. GitHub Models, Morph, Manifest, and atomic-chat join the provider lineup; ~36 providers gained typed-family config with OAuth refresh. ACP sessions now persist; Mattermost gained multi-channel polling and DM auto-discovery.
• Provider fallback is gone. No more fallback-provider chains. Each agent names one provider, retries handle transient failures, and routing is explicit. If your config carries reliability.fallback_providers or reliability.model_fallbacks, drop those keys before upgrading (see Breaking Changes).

What's New

Multi-Agent & Runtime

The multi-agent epic (#6272) is the spine of this release:

• Agent aliasing: agents are explicit, named map entries ([agents.<alias>]) with their own model_provider, risk_profile, runtime_profile, channels, and identity. The schema, migration, orchestrator, and onboarding all speak aliases end to end.
• Per-agent identity & workspace: each agent loads its own IDENTITY.md/SOUL.md and runs against agents/<alias>/workspace/, which doubles as its security boundary via path-subset enforcement (SecurityPolicy::for_agent).
• Per-agent memory: the Memory trait gained an agent-aware surface on every backend; AgentScopedMemory<M> enforces the cross-agent boundary on every method, and AgentScopedMarkdownMemory does the same for the markdown backend. Alias deletes purge the agent's rows.
• Peer groups: a peer-group resolver and ResolvedPeers type let agents on a shared channel type reach each other; external peers are matched case- and @-insensitively. Delivery between co-resident agents is in-process by design (the channel's bot identity is shared).
• Sub-agents: spawn_subagent agent-loop tool with a depth-1 cap and a risk_profile gate; SecurityPolicy::ensure_no_escalation_beyond enforces parent-subset authorization. Cron JobType::Agent dispatch now routes through the sub-agent spawn path; cron stays depth-0.
• Lifecycle & CLI: a per-agent lifecycle module + session registry, DeleteReport that surfaces active sessions and warns on force-delete, and new zeroclaw agents create / delete / list commands.
• Tool authorization: Tool : Attributable supertrait with per-tool role and alias; a policy-driven tool filter at the dispatch site; SecurityPolicy.allowed_tools / excluded_tools with is_tool_allowed.

Configuration & Schema (V3)

• Typed migration chain rebuilt as partial lenses (V1Config, V2Config) covering every nested V1→V2 and V2→V3 transform, wired into runtime, CLI, and end-to-end tests.
• zeroclaw config generate <version> and zeroclaw migrate generate <version> produce a canonical config at any schema version from a comprehensive V1 fixture.
• RFC #5890 model-provider aliasing: nested [providers.models.<type>.<alias>], with ~36 typed provider families and a for_each_model_provider_slot! macro driving factory dispatch and validation.
• TTS and transcription gained the same typed-family split ([providers.tts.<type>.<alias>], [providers.transcription.<type>.<alias>]) with per-agent tts_provider / transcription_provider fields and cross-validation.
• Per-category typed alias-ref newtypes (ModelProviderRef, TtsProviderRef, TranscriptionProviderRef, ChannelRef) make dotted <type>.<alias> references first-class.
• New [acp] config section; risk/runtime/bundle profile synthesis on migration; #[secret]-driven MaskSecrets; pricing moved onto provider config as a [costs.providers.models] rate sheet.
• Defaulted fields are pruned from the saved config.toml; schema defaults render as ghost text in the TUI and the dashboard.

Web Dashboard

• Multi-agent reframe: per-agent status, memory counts, cost, and session routing; RAM/CPU widgets for the ZeroClaw process.
• Cost moved into a Dashboard tab with time-range filters, daily-scoped rollups, per-agent/per-model token splits, cached-input tokens, and a schema-driven rate-sheet editor.
• Agent workspace explorer with jailed read/delete/move and mkdir/rmdir; lazy file browser for shared/.
• Tool-approval UI for supervised-mode execution; Memories tab; Skills drill-in with SKILL.md editor inside skill bundles.
• Cross-section draft store, unsaved-changes banner, tombstone unset, URL-driven alias routing (no modals), and alias pickers replacing window.prompt.
• Live Logs page over the new /api/logs endpoint; global reload banner driven by a pending_reload signal; version shown in the sidebar footer.

Providers

• New providers: GitHub Models (#6445), Morph (#6440), Manifest open-source LLM router (#6268), atomic-chat local provider (#6513).
• MiniMax split into Global and China picker entries (#6758); llama.cpp promoted to a dedicated provider kind (#6417).
• OpenRouter prompt caching (#6008); Codex native Responses tool calls (#6117); Ollama num_ctx/num_predict/temperature tuning (#6178).
• Trait-driven provider dispatch with OAuth refresh on the per-alias schema; Azure rewired to typed config (and AZURE_OPENAI_* env vars retired); models.dev keys pre-populate the model picker.

Channels

• Mattermost multi-channel polling, DM auto-discovery, and mention_only bypass; Nextcloud Talk draft-update streaming (#6048).
• Bot self-mention injected into the per-channel system prompt (self_addressed_mention() in each channel's platform syntax), with the lookup fixed to resolve composite <type>.<alias> keys so aliased and multi-agent channels actually receive it; closure-resolver peer auth unified across all 24 channels; per-channel self_handle overrides; standardized inbound/outbound channel log shape.
• Reply-calibration nudge added to both the per-channel prompt and the base system prompt (so direct CLI chat gets it too): agents had been erring toward silence and treating memory as a reason not to answer, so the prompt now skews toward replying and frames memory as supplementary context rather than a gate on whether to respond.

ACP (Agent Client Protocol)

ACP mode (the zeroclaw acp subprocess and the zeroclaw-acp-bridge editor bridge) got a substantial pass this release:

• Sessions persist across restarts (#6649). A SQLite-backed AcpSessionStore records each session on session/new and appends every successful prompt turn; on reconnect the agent's conversation history is restored full-fidelity, so a daemon restart no longer drops in-flight ACP conversations.
• New [acp] config section. max_sessions (default 10) and session_timeout_secs (default 3600) cap concurrent sessions and idle lifetime; default_agent names the agent to use when a client omits agentAlias. These wire into both the zeroclaw acp subprocess and the gateway WebSocket path; CLI flags still override the config for...

v0.7.5

Changelog — v0.7.4 → v0.7.5

v0.7.5 is a substantial follow-on to v0.7.4. The headline is in-browser
onboarding and configuration: a schema-driven /onboard flow, a per-property
gateway CRUD surface backed by an OpenAPI 3.1 spec and a typed CLI, a
three-surface personality editor (CLI / TUI / web), and live drift detection
for hand-edited config files. ACP picks up real cancellation and a
tool-approval back-channel, per-provider pricing finally makes cost tracking
accurate, the installer ships presets and a TTY feature picker, and the web
dashboard learns hot model switching plus a stop button. Around 71 commits
from 24 contributors.

---

Highlights

• Web onboarding, per-property config CRUD, and a personality editor — all
  schema-driven. A new /onboard route renders the full first-run flow in
  the browser (Workspace, Providers, Channels, Memory, Hardware, Tunnel,
  Personality), driven by per-property OPTIONS/GET/PUT/DELETE/PATCH
  endpoints under /api/config/* that share their core (Config::set_prop)
  with the CLI and any third-party tool. The runtime emits an OpenAPI 3.1 spec
  at /api/openapi.json (Scalar explorer at /api/docs), the dashboard
  TypeScript client is generated from it via openapi-typescript, and the CLI
  picks up matching config patch, config docs, config schema --path, and
  --json envelopes on the existing get/set/init/migrate commands. A
  drift banner surfaces hand-edits to config.toml with per-row in-memory vs
  on-disk diffs and a one-click reload, and a personality system lets each of
  the seven runtime markdown files (SOUL.md, IDENTITY.md, USER.md,
  AGENTS.md, TOOLS.md, HEARTBEAT.md, MEMORY.md) be edited from CLI
  ($EDITOR), TUI, or the web UI's CodeMirror editor (#6179).

• ACP gets cancellation, a tool-approval back-channel, and concurrency
  safety. ACP protocol v1 now exposes session/cancel to abort an in-flight
  turn (#6374), the gateway WebSocket carries tool approvals over a dedicated
  back-channel (#6387), and concurrent session/prompt requests are rejected
  with a clear error instead of racing (#6408).

• Live model switching and a real stop button in the web dashboard. Pick a
  different model from the chat dropdown without losing context (#6101), open
  the agent chat directly from a memory row (#6217), trigger any cron job from
  the UI (#6164), and use the new chat-input lock plus running indicator and
  stop button while a turn is in flight (#6220). OpenRouter free models are
  flagged in the dropdown (#6218) and themes/sessions/CSS tokens behave
  consistently across pages (#5207).

• Per-provider pricing makes cost tracking real. ModelProviderConfig now
  carries pricing per provider profile (#6357), the gateway records cost and
  token usage on every turn (#6159), and missing pricing logs a single WARN per
  (provider, model) pair instead of spamming the log (#6356).

• Installer overhaul. zeroclaw install learns preset and gateway flags, a
  TTY-driven feature picker, web/dist building, and an onboarding gate (#6385);
  Linux MUSL static binaries are back in the release artifacts (#6411); the web
  dashboard installs to platform-correct data directories on macOS and Windows
  (78d2cd6); and the prebuilt path correctly extracts the dashboard again
  (821fbfc, a2c1e2b).

• HMAC tool receipts wired up end-to-end. The receipt-signing path stripped
  out of #5168 is now active (#6214), giving each tool result a verifiable HMAC
  trail when the feature is enabled.

---

What's New

Channels

• ACP (Agent Client Protocol): session/cancel aborts in-flight turns
  (#6374); concurrent session/prompt requests are rejected rather than
  raced (#6408); ACP protocol v1 picks up tool-call permission and a back-channel
  for structured prompts (#6167).
• Matrix: attachments are uploaded when finalizing partial drafts (#6200);
  device identity is derived from the whoami response when an access token is
  used directly (242ef24), and access-token sessions now require an explicit
  device identity (21d0c5d).
• WhatsApp: fromMe replies are scoped to self-chat or trigger prefixes
  (#6353); LID→phone resolution failures are logged so debugging session
  drops is possible (#6354).
• Discord: inbound image attachments are preserved through the provider
  pipeline (#6184).
• Jira: API v2 server mode is supported alongside cloud (#6116).

Web Dashboard

• Schema-driven /onboard flow — first-run users complete provider auth,
  channels, memory, hardware, tunnel, and personality entirely in the browser,
  with forms rendered from GET /api/config/list's kind / type_hint /
  enum_variants (no value-sniffing). Fresh installs auto-redirect from /
  to /onboard (#6179).
• Schema-driven config editor at /config with per-section forms, drift
  banner, and per-row drift diff (in-memory vs on-disk; secrets surface only
  the fact of drift). One-click "Restart daemon to apply" reloads via the
  in-process watch channel (#6179).
• Live model switching with chat context preserved on navigation (#6101).
• Chat input lock, running indicator, and stop button while a turn is
  active (#6220), with tool_call/tool_result rendering off by default and a
  toolbar toggle to opt back in (#6388).
• Open agent chat directly from a memory row when session_id is present
  (#6217).
• OpenRouter free models marked in the default-model dropdown (#6218).
• Manual cron trigger from the web UI (#6164).
• Theme switching, session crash, and CSS token consistency fixes unify the
  visual surface across pages (#5207).
• Agent tool button height matches sibling controls (#6369).

Providers

• Anthropic: base_url is honored for the default provider (#6314).
• Bedrock: credential_process support enables enterprise-friendly auth
  flows (#6168).
• Groq: per-profile native_tools override on ModelProviderConfig
  (#6380).
• StepFun: new stepfun-intl endpoint (#6310).
• xAI: model listing is restored (9bd95a0).
• OpenAI-compatible: tool_call extra_content is preserved so Gemini's
  thoughtSignature survives round-tripping (#6264); model id normalization
  has test coverage (cc8f0e7).

Configuration

• Per-property gateway CRUD under /api/config/* (GET/PUT/DELETE/
  PATCH/OPTIONS/list/init/migrate/drift). Comment-preserving PATCH
  attaches a per-op comment field to the on-disk TOML key; PATCH/PUT are
  validator-gated with snapshot revert on failure; structured ConfigApiError
  surfaces stable codes for invalid range, enum variant, format, dangling
  reference, and required-field-empty (#6179).
• Drift detection compares in-memory state to on-disk config.toml via
  server-side SHA-256 hashing (secrets never leave the server). 409
  config_changed_externally blocks a write against a drifted path; explicit
  X-ZeroClaw-Override-Drift: true overrides (#6179).
• OpenAPI 3.1 spec at /api/openapi.json, Scalar explorer at /api/docs,
  committed snapshot at crates/zeroclaw-gateway/openapi.json regenerated by
  cargo xtask gen-openapi and CI-checked for staleness (#6179).
• TypeScript client codegen for the dashboard via openapi-typescript
  (npm run gen-api, wired into npm run build); tsc fails when the generated
  shape stops matching consumers (#6179).
• CLI parity: zeroclaw config patch (JSON Patch over the same core),
  config docs, config schema --path <prop>, set --comment, --json
  envelopes on get/set/init/migrate matching HTTP shapes (#6179).
• Per-provider pricing on ModelProviderConfig (#6357).
• Dotted provider map keys preserved across config round-trips (#6317).
• Encrypted-secret mismatch surfaced clearly when .secret_key doesn't
  match the encrypted blob (#6379).

Agent & Runtime

• Cost and token usage recorded on every gateway turn (#6159).
• Cost-pricing WARN once per (provider, model) instead of per-turn
  (#6356).
• Conversation memories excluded from build_context recall to keep prior
  conversation chunks from leaking into recall results (#6316, follow-up to
  #5415).
• Autosaved conversation memories recalled on subsequent turns (#6363).
• Reasoning content captured from streaming responses (#6107).
• Image markers stripped from non-vision context-compression payloads
  (#6189).
• Wildcard memory recall is treated as a recent-memory query (#6296).
• Daemon canvas store shared across subsystems (gateway, channels, daemon)
  (#6221).
• Cancel-tokens evicted when sessions are deleted mid-turn to prevent stale
  approval state (#6216).
• Session backend unified behind one factory across runtime and channels
  (#6384).

Tools

• zeroclaw memory reindex CLI for rebuilding the embedding index in place
  (#6046).
• Tavily search backend for tools/web_search, with bearer-header
  authentication and encrypted-key support (3205f0a, 46cb451, 3014e35).
• tool_timeout_secs honoured for HTTP SSE tool calls (#5945) and used to
  derive the HTTP client timeout (#6397).
• allow_scripts plumbed through ReadSkillTool to the skill loader so
  declared scripts can actually run (#5981, closes #5697).
• DockerSandbox bind-mount support for workspace mounts (#5905, closes
  #5720).

Personality

• Three-surface personality editor for the seven runtime markdown files
  (SOUL.md, IDENTITY.md, USER.md, AGENTS.md, TOOLS.md, HEARTBEAT.md,
  MEMORY.md) the runtime injects into the system prompt. CLI uses $EDITOR,
  TUI suspends and hands off to $EDITOR, web UI ships a CodeMirror 6 editor
  (one-dark theme + markdown grammar) with Edit/Preview toggle, per-tab Insert
  / Replace template buttons, char counter, and 409 personality_disk_drift
  resolution U...

v0.7.4

Changelog — v0.7.3 → v0.7.4

The first patch release on top of the v0.7.x workspace foundation. v0.7.4 lands a
clean-room Matrix rewrite, a Mozilla Fluent i18n pipeline with multi-locale docs, a
ground-up rewrite of the CLI/TUI onboarding flow, recovers the WeChat iLink Bot channel. Around 110 commits from 36 contributors covering
channels, providers, web dashboard, security, and developer experience.

---

Highlights

• Multi-locale docs and i18n pipeline — A Mozilla Fluent-based i18n pipeline now
  drives a multi-locale mdBook, alongside a comprehensive docs overhaul (#5788). Header
  links point at the upstream repo (#6124) and the CNAME is preserved on every Pages
  deploy (#6142).

• Onboarding clean-slate rewrite — zeroclaw onboard is now schema-driven,
  idempotent, and DRY (#5960). It picks up a generic OpenAI-compatible /v1/models
  fallback for unknown providers (#6056) and uses container-aware URLs for local AI
  providers running in Docker (#5552).

• Session management surface — New SessionResetTool, SessionDeleteTool, and
  SessionsCurrentTool give the agent first-class control over its own sessions
  (#5696, #6033). The gateway gained a session abort endpoint with incremental streaming
  persistence (#5705).

• WeChat iLink Bot channel recovered — The previously reverted iLink Bot
  integration is back, ported to current trait surfaces (#6130). request_approval()
  is now implemented across Discord, Slack, Signal, Matrix, and WhatsApp.

• Voice foundation — A new Vad trait and VoiceEvent protocol land behind a
  gateway-voice-duplex feature flag, paving the way for live voice channels (#5942).

• PostgreSQL memory backend — Memory can now be persisted to PostgreSQL via a new
  memory-postgres backend.

• Matrix channel rewritten — A clean-room reimplementation on matrix-rust-sdk 0.16
  replaces the long-running patch pile. E2EE auto-verification of allowed_users is
  preserved, and the channel is markedly simpler to operate (#6112).

---

What's New

Architecture & Workspace

• Decoupled gateway and tui-onboarding from agent-runtime, so each can be
  compiled without dragging in the full agent loop (#5735).
• SessionBackend trait gained clear_messages() for O(1) session reset (#5900) and
  get_session_metadata(key) for typed metadata access (#6043).
• Hardware crate: wizard UI moved from main.rs into zeroclaw_hardware::wizard for
  reuse outside the binary (#6041).
• Web router refactor for clearer route ownership (#6176).
• Tools: rate-limiting delegated to wrappers for glob_search and content_search
  (#5772); session validation now uses typed errors (#6135).

Agent & Runtime

• prune_history Phase 1 now treats mixed-protection tool groups as atomic, preventing
  partial pruning that left the conversation in an invalid state (#5828).
• Self-heals orphaned tool_result blocks on session load and on compaction (#5853).
• Sandbox auto-detection now respects runtime.kind = "native" (#5904).
• runtime.kind is detected for memcg availability at daemon startup (#5906).

Providers

• OpenRouter: extra_body passthrough for arbitrary request params (#5623); the
  upstream stream task is now aborted when the consumer drops the stream (#5830).
• MiniMax native tool calling is now enabled (#6027).
• Bedrock omits temperature for Opus 4.7, matching the model's API contract
  (#6144).
• Gemini / OpenRouter tool-call compatibility fixes plus clearer
  google_workspace schema (#5975).
• Groq: native tool calling is now disabled where it was misbehaving (#5848).
• strip_native_tool_messages now coalesces adjacent assistant turns (#5829).

Channels

• Matrix: clean-room rewrite on matrix-rust-sdk 0.16 replacing the prior
  long-running patch series (#6112).
• WeChat iLink Bot: channel recovered from the bulk revert in PR #4221 (#6130).
• Slack: strict_mention_in_thread option lets you require an @-mention even in
  threads where the agent has previously replied (#5992).
• IRC: mention_only config option for IRC channels (#5998).
• Telegram: bot command list updated (#5691); request_approval now forwards the
  message_thread_id (#5970); auto-injected topic-root reply context is skipped in
  forum topics (#5969).
• IMAP: polling fallback for servers that don't support IDLE (#5712).
• ACP: defaultModel resolves from config and is null when unconfigured (#6013);
  tool output formatting corrected (#6035); INFO logs suppressed and missing ACP spec
  protocol implemented (#5c81d4e).
• Discord, Slack, Signal, Matrix, WhatsApp: request_approval() implemented across
  the channel set, unblocking approval-gated tool flows on every supported chat
  platform.
• Feishu: mention_only config wired through (#5848).

Tools & Skills

• SessionResetTool and SessionDeleteTool for in-agent session management (#5696).
• SessionsCurrentTool exposes the active session identity (#6033).

Plugins

• Extism WASM execution bridge wired up (Phase 2 D2 plumbing) (#5913).
• image-gen-fal WASM plugin added as the fal.ai Flux reference plugin (#5921).
• Markdown-only plugin bundles can now declare a skill capability (#6141).

Voice

• New Vad trait and VoiceEvent protocol behind the gateway-voice-duplex feature
  flag (#5942).

Memory

• PostgreSQL backend re-introduced as memory-postgres.
• is_user_autosave_key detector identifies per-turn user message keys (#5631), and
  these keys are now skipped in every memory context path (#5632).

Web Dashboard

• Chat message deletion, clear-all, and a compact mode (#6083).
• Cron job configuration UI (#5936).
• Embedded web build for the pack bin (#6181).
• Bug-fix bundle: Overview crash, model save, editor caret, chat CPU usage (#6161).
• Array-returning API helpers now guard against non-array responses (#6162).
• WebSocket session ID persists in localStorage across page reloads (#5641).

Configuration

• Vec<String> fields are now exposed via zeroclaw config get/set/list (#5950),
  including JSON-array syntax in config set (#0e9b9c2).
• User-supplied providers.fallback is preserved through load/save (#6099) and
  mirrored under the canonical fallback key (#321e96f).
• WebSocket buffer is preserved in the non-proxy ws_connect_with_proxy path (#5794).
• [skill] TOML sections may now contain prompts (#5972).

Onboarding

• Clean-slate rewrite: schema-driven, idempotent, DRY (#5960).
• Generic OpenAI-compatible /v1/models fallback for unknown providers (#6056).
• Container-aware URLs for local AI providers (#5552).
• Windows: setup.bat issues fixed (#6137).

Gateway & Runtime

• Session abort endpoint plus incremental streaming persistence (#5705).
• Tool support enabled in the webhook endpoint (#6080).
• Token usage emitted from the webhook handler (#5793).
• Missing /api/channels route added (#6069).

Cron

• Memory snowball accumulation in agent jobs prevented (#5817).
• deliver_announcement returns Err when no delivery handler is registered (#5827).
• Closing tag added to the memory context block in cron and daemon paths (#3b24f81).

Documentation

• Mozilla Fluent i18n pipeline + multi-locale mdBook + full docs overhaul (#5788).
• ZeroClaw Maturity Framework ratified and committed (#5911).
• Manual release runbook (#5920).
• AGENTS code-style rules clarified (#6163).

Installation & Distribution

• OpenShift / Kubernetes deployment manifests (#5880).
• Docker images now include the web dashboard (release image #5996, debian local-dev
  image #6025).
• Install script prompts for pre-built vs source, defaulting to pre-built on
  curl | bash (#5968).
• Windows cargo test unbroken; self-update target triples added (#6050).

Improvements

• Refactor: web router (#6176); rate-limiting wrappers for filesystem tools (#5772);
  typed session validation errors (#6135); hardware wizard relocation (#6041).

Security & Dependencies

• cargo update and deny.toml audit (2026-04-27) (#6152).
• rustls-webpki updated to v0.103.13; unfixable v0.102.8 copy ignored (#6011).
• Patches applied for rand; picomatch ReDoS fixed; wasmtime and glib ignores
  documented (#5971).
• Daily advisory scan workflow added (#5928).
• rand bumped from 0.10.0 to 0.10.1 (#5713).
• postcss bumped from 8.5.6 to 8.5.10 in /web (#6084).

---

Bug Fixes

Area	Fix
Tauri desktop	Install rustls crypto provider to prevent crash (#5997); replace PNG-as-ICO with a real Windows ICO to unblock Win11 builds (#5966)
Telegram	Forward message_thread_id in request_approval (#5970); skip auto-injected topic-root reply context in forum topics (#5969)
Skills (config)	Allow prompts inside [skill] TOML section (#5972)
Providers	Gemini/OpenRouter tool-call compatibility + google_workspace schema clarity (#5975); MiniMax native tool calling enabled (#6027); Bedrock omits temperature for Opus 4.7 (#6144); Groq native tools disabled where misbehaving (#5848); coalesce adjacent assistant turns in strip_native_tool_messages (#5829); abort OpenRouter stream task when consumer drops (#5830)
CI	nextest now runs across all workspace crates (#6197); CNAME persisted on every Pages deploy (#6142)
Bulk revert recovery	Recover 4 small fixes lost in bulk revert c3ff635 (#6169)
Runtime	Align tool-call text preservation test (#6204); detect memcg availability at daemon startup (#5906); self-heal orphaned tool_result blocks on load + compact (#5853); register skill tools and apply excluded filter in gateway path (#5774); drop redundant narration push before AssistantToolCalls (#6093); unbreak pre-existing test failures on master (#6108); respect runtime.kind = "native" in sandbox auto-detection (#5904)
Infrastructure	SQLite FTS UPDATE trigger for sessions_fts (#5985)
xtask	Resolve re...

v0.7.3

Changelog — v0.6.9 → v0.7.3

Changes since the v0.6.9 stable release. This release represents the largest
structural overhaul in ZeroClaw's history: the entire codebase has been split into a
proper Cargo workspace of focused crates, a new config schema has shipped with a live
migration path, and a wave of channel, provider, and security improvements have landed
on top of that foundation.

---

Highlights

• Workspace split complete — ZeroClaw is now a multi-crate Cargo workspace. The
  monolithic source tree has been decomposed into 12+ focused crates
  (zeroclaw-api, zeroclaw-runtime, zeroclaw-gateway, zeroclaw-channels,
  zeroclaw-tools, zeroclaw-memory, zeroclaw-providers, zeroclaw-infra,
  zeroclaw-config, zeroclaw-tui, zeroclaw-plugins, zeroclaw-hardware).
  The foundation binary now builds at 6.6 MB with --no-default-features.

• Config V2 schema with automatic migration — Provider config has moved to a cleaner
  layout. Running zeroclaw config migrate upgrades your existing config in-place,
  preserving comments. The old props subcommand still works but is now deprecated in
  favour of zeroclaw config.

• OpenRouter streaming — OpenRouterProvider now streams responses token-by-token
  instead of waiting for the full response, matching the experience of native providers.

• Web dashboard decoupled from the binary — The dashboard is now built separately
  and embedded at release time. cargo install and AUR/Homebrew packages include it.
  A new voice mode and plugins page have been added to the dashboard.

• LINE channel — LINE Messaging API is now a supported channel.

• Matrix improvements — Mention-only filtering (the agent only responds when
  mentioned), encrypted media download restored, outbound attachment support added, and
  onboarding wizard preservation.

• GitHub Copilot onboarding — GitHub Copilot is now selectable as a provider
  through the onboarding wizard and zeroclaw config flow (#5321).

• Authenticated OTLP exporters — New otel_headers config key lets you pass
  custom headers (e.g. Authorization: Bearer …) to protected OTLP endpoints (#5700).

---

What's New

Architecture & Workspace

• Extracted 12 workspace crates from the monolith, implementing the microkernel RFC
  roadmap (RFC D1–D5). Every subsystem — providers, channels, tools, memory, infra,
  config, gateway, TUI, plugins, hardware — now lives in its own crate with explicit
  dependency boundaries enforced by the compiler.
• Foundation binary (--no-default-features) compiles clean at 6.6 MB.
• agent-runtime feature flag gates the full agent loop; the kernel binary builds
  without it.
• Switched TLS from aws-lc-rs to ring and stripped .eh_frame sections, reducing
  binary size further.
• schemars is now optional behind a schema-export feature flag — no longer a
  mandatory compile dependency.
• 28 per-channel feature flags with forwarding chains so unused channels add zero
  compile time.
• Workspace-wide [workspace.dependencies] and [workspace.package] inheritance
  eliminates version duplication across Cargo.toml files.
• RFC Rev 2 compliance: stability tiers, versioning policy, and release profile are now
  wired into the workspace.

Providers

• OpenRouterProvider now supports streaming (#5717). Responses appear token-by-token
  instead of arriving all at once.
• GitHub Copilot is now available as a selectable provider in the onboarding wizard
  and zeroclaw config interactive flow (#5321).
• Fixed: native tool-call messages are now stripped before sending to providers that
  have native_tool_calling = false, preventing provider errors (#5762).
• Fixed: tool_stream events are no longer forwarded to non-Z.AI providers in the
  streaming path, preventing unexpected provider errors (#5806).
• Fixed: DeepSeek V3.2 system prompt escaping and token estimation corrected (#5454).

Channels

• LINE Messaging API channel added (#5642).
• Matrix: mention-only filtering — the agent can be configured to respond only when
  directly mentioned. Encrypted media download restored. Outbound attachment support
  added. Onboarding wizard settings now preserved across restarts (#5166, #5727).
• Telegram: tool approval requests now include inline_keyboard markup, giving
  users interactive approve/deny buttons instead of plain text (#5790).
• Sender user ID is now propagated into the channel system prompt, giving the agent
  context about who it is talking to (#5526).
• Email and VoiceCall channels now have an enabled field and are correctly wired into
  the orchestrator (#5659).
• <think> tags are stripped from streaming draft updates before they reach the client
  (#5505).
• Fixed: missing channels in build_channel_by_id caused sessions_send to silently
  fail for some channel types (#5506).
• Telegram and Matrix implementations moved out of the orchestrator into their own
  modules (#5639).

Configuration

• Config V2 schema with a new provider layout (providers.models,
  providers.fallback, model_routes, embedding_routes).
• zeroclaw config migrate upgrades a V1 config to V2 in-place, preserving comments
  and formatting.
• zeroclaw config replaces zeroclaw props. The old props subcommand is deprecated
  but still functional.
• Onboarding wizard updated to write V2 provider format directly.
• Fixed: false "Unknown config key" warnings for Option<T> fields and config aliases
  (#5510).
• Fixed: providers.fallback now emits a warning if it references a key that does not
  exist in providers.models.
• Fixed: temperature validation restored in the providers.models loop.
• Slack config: channel_id deprecated in favour of channel_ids (plural) for V2.
• Nostr, WhatsApp Web, and hardware wizard sections wired into the onboarding flow
  (#5640).

Observability

• otel_headers — new config key for passing arbitrary HTTP headers to OTLP
  endpoints. Enables authenticated exporters (e.g. Grafana Cloud, Honeycomb) without
  environment variable workarounds (#5700).

Web Dashboard

• Voice mode added to the dashboard.
• Plugins management page added.
• Theme mode switch fixed — light/dark selection now applies correctly on load (#5724).
• Visual preview swatches added to the theme mode selector (#5767).
• Dashboard is now decoupled from the main binary — built separately and embedded at
  release time. Included in binary releases, AUR, Homebrew, and cargo install
  (#5675, #5665).
• Web build logic moved into the gateway crate; no-op recompiles (previously ~1 minute)
  eliminated.

Agent & Runtime

• CLI channel factory now registered for interactive mode — zeroclaw interactive
  sessions work again after the workspace split (#5802).
• Duplicate ToolCall events in turn_streamed deduplicated; clients no longer see the
  same tool call reported twice (#5746).
• Empty successful tool output is now normalised before being returned to the provider,
  preventing downstream parse errors on blank responses (#5565).
• Session integrity improvements: streaming refactor and history pruning for long
  conversations (#5167).
• Cron agent jobs no longer trigger auto_save, preventing runaway memory consolidation
  on scheduled tasks (#5664).
• Fixed: cron_run tool output was not being delivered to configured channels.
• Windows: the shell console window is now hidden when running as a background process
  (#5563).

Skills (Claude Code)

• github-issue-triage skill added — automates structured triage of GitHub issues using
  Claude Code (#5780).
• squash-merge skill added — preserves clean commit history when merging upstream
  changes (#5782).

Security

• Dangerous interpreter arguments (e.g. -e, --eval, -c on interpreters) are now
  blocked by the command security policy (#5702).
• Heredocs and safe shell redirects (<<EOF, >, >>) are explicitly allowed (#5160).

Installation & Distribution

• install.sh rewritten from scratch for the workspace split — correctly handles the
  new crate layout and binary paths (#5666).
• AUR package migrated from zeroclaw to zeroclawlabs (#5544).
• Daemon supervisor and onboarding launch checks now include the webhook channel (#5799).

Dependencies & Security Advisories

• rustls-webpki and rumqttc bumped to resolve RUSTSEC-2026-0098 and
  RUSTSEC-2026-0099 (#5786).

Deployment

• Sample Kubernetes and OpenShift deployment manifests added in deploy-k8s/ with
  hardened security context (runAsNonRoot, readOnlyRootFilesystem, drop ALL caps,
  seccompProfile: RuntimeDefault) and pairing auth enabled by default (#5880).

---

Bug Fixes (summary)

Area	Fix
Provider	Strip native tool messages for non-native-tool-calling providers
Provider	tool_stream events forwarded to non-Z.AI providers in streaming path
Provider	DeepSeek V3.2 system prompt escaping and token estimation
Agent	CLI channel factory missing in interactive mode
Agent	Duplicate ToolCall events in streaming turns
Agent	Normalize empty successful tool output
Matrix	Encrypted media download; outbound attachments
Channels	Missing Arc Provider forwarding methods
Channels	<think> tag leaking into streaming draft updates
Telegram	inline_keyboard missing from tool approval requests
Cron	cron_run tool output not delivered to configured channels
Config	False "Unknown config key" warnings on Option fields
Config	Temperature validation missing from providers loop
Config	Fallback key references nonexistent provider — now warns
Session	Integrity, streaming refactor, history pruning...