ironclaw/CHANGELOG.md

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[1.4.0-rc.1] - 2026-08-26

First release candidate for 1.4.0, covering the 81 commits since ironclaw-v1.3.0.

Added

• Durable notification inbox: runs publish authoritative outcomes and actionable gates to a per-user inbox, surfaced by the WebUI notification center, so approvals and auth prompts survive a missed session.
• Background subagents: a parent turn can spawn children that run and deliver on their own, with per-child delivery, activation provenance, a derived cap on autonomous wakes, and healing sweeps for orphaned children.
• Persistent per-user sandbox containers on the local-Docker profile, reached over Docker Exec so container-local installs and state survive between commands. The Railway preview profile still runs an ephemeral worker per command and keeps only its checkpointed workspace.
• Managed per-user sandbox egress proxy, with manifest-declared direct-exec credential bindings that stay behind it so secrets are never handed to sandboxed code.
• Run-now for automations, plus exact run capability facts.
• Durable backend suggestions generated over the user's own no-approval, read-only tools and gated on connected extensions.
• Google Docs semantic editing tools; run timing evidence in downloadable conversation artifacts.
• Opt-in in-worker SSH in the runtime image (see Operators below).

Fixed

• Structured finalization stalls are bounded, and OpenAI-compatible reasoning-only responses are preserved.
• Provider failures and auth diagnostics reach the model as readable context instead of opaque errors.
• libSQL write-lane starvation no longer cascades through the resource governor as unrelated tool failures.
• Telegram separates workspace-bot pairing from personal device linking, and keeps paired channels ready while collapsing streaming reply drafts.
• Slack delivers the unlinked-user connect nudge privately with a one-click connect link.
• Installation state written by 1.2.x is accepted and preserved, so a deployment that skipped 1.3 upgrades directly.
• Incremental compaction summary context is preserved.

Operators

• The runtime image can start an in-worker SSH listener. It is off unless IRONCLAW_REBORN_SSH_PUBLIC_KEY is set to an OpenSSH public key, which enables public-key-only login as user agent on container port 2222; that port must be published to be reachable. agent shares uid 1000 with the ironclaw runtime user, so an SSH session holds the full runtime identity -- treat the private key like shell access to the service.
• IRONCLAW_REBORN_WORKSPACE_ROOT is honored on both CLI boot paths. Neither it nor IRONCLAW_REBORN_HOME may be set to the filesystem root.
• New sandbox knobs: IRONCLAW_REBORN_SANDBOX_PROXY_IMAGE and IRONCLAW_SANDBOX_EXTRA_ALLOWED_DOMAINS.

Upgrading

No migration steps from 1.3.0.

[1.3.0] - 2026-08-19

Stable promotion of 1.3.0-rc.2, including the upgrade and container fixes validated in RC2 and the complete RC1 scope below.

Fixed in 1.3.0-rc.2

• Upgrades from 1.2 now accept and preserve the released extension activation_state field instead of crash-looping during startup.
• The canonical Reborn runtime image again supports opt-in, public-key-only worker SSH on port 2222 while running IronClaw as an unprivileged user.

Added

• Per-user model preferences. Each user picks their own model from WebUI settings, the CLI, or chat commands, and the choice follows them through channel turns and inbound replay. Admins bound what is selectable with a tenant-scoped model selection policy.
• Structured automations. A scheduled trigger now carries a validated execution contract — prompt spec, execution policy, required skills — checked by a fail-closed preflight at creation instead of a free-form prompt string, and unattended runs get their own protocol. A deterministic no-result sentinel lets a run that has nothing to report finish silently instead of delivering filler.
• Document editing. Structural edits to .docx, .xlsx, and .pptx files, and PDF rendering from HTML.
• Telegram linked devices. Pair a personal Telegram account with the bot channel so the agent can read your conversations and act as you through the standard messaging operations. Reads are live against Telegram's own servers — there is no local mirror, retention policy, or search index of the account — while message content a run actually reads is retained in that run's transcript like any other tool result.
• The full Slack messaging vocabulary. Eight more standard operations — edit message, delete message, add reaction, remove reaction, open DM, get message, resolve user, list members — complete the core surface.
• Ranked memory recall. Retrieval ranks by relevance instead of requiring every term of the question to appear in the saved fact, so a differently worded question still finds it, and broken memory is visibly different from empty memory. Memory-save guidance ships with an always-on MEMORY.md prompt lane.
• Opt-in parallel tool batches in the agent loop.
• Explicit Anthropic cache_control prompt-cache breakpoints on both transports.
• A shared WebUI search field, and per-field help text on admin extension configuration forms alongside a rewritten channel setup guide.

Changed

• Substantially fewer database writes per turn. Capability invocation state persists at gate and terminal edges only; runtime milestone events, thread index touches, message lookup indexes, trigger and outbound state, and process heartbeats all coalesce or fold into existing rows.
• Turn execution runs on prepared-context ("unbound") turns behind one accept door, replacing the kernel binding-ref path.
• Channel ingress is normalized once, with reply split from delivery.
• The public documentation site deploys from a docs-live branch that stable releases move, so published docs describe the released binary rather than unreleased main.

Fixed

• Context-window eviction compacts instead of discarding: the accepted task and any steering survive the eviction.
• Lease expiry recovers safe runs instead of failing them, and the journal heartbeat pool is isolated.
• An unavailable capability call is repaired instead of aborting the run, and repeated-call detection is advisory rather than fatal.
• Model-bound secrets are redacted without rejecting the turn.
• Telegram sticker and voice attachments no longer brick the channel, and the 2FA gate on migrated data centers is recognized and says where the login code arrives.
• Extension cards and install results report what actually happened; bundled MCP state refreshes after auth; hosted MCP OAuth supports origin-scoped servers.
• WebUI: SSE reconnect storms are bounded, long conversation titles reveal on hover, exposed-route copy is localized, and a failed tool call reads as a subtle badge instead of a loud summary.
• The resource governor keeps retrying through a full libSQL writer attempt instead of surfacing the contention as a failure, and libSQL write-lane starvation no longer cascades through it: the delta journal gets its own bounded write lane, congestion is distinguished from storage damage so a contended write replays instead of invalidating the authority, and stale reservations are swept rather than leaking as permanent Active holds.

Removed

• Retired WebUI surfaces: the standalone missions page, the routines surface, admin analytics placeholders, and project mission placeholders.
• Retired IronLoop network settings.

[1.2.0] - 2026-08-13

Stable promotion of 1.2.0-rc.3, including the fixes validated in RC2 and RC3 and the complete RC1 feature set below.

Fixed in 1.2.0-rc.3

• The runtime container image now installs curl, so in-container HTTP healthchecks can execute. Orchestrators probe the worker with curl -fsS http://localhost:3000/; the image shipped no HTTP client, so the probe could never run, the container was never marked healthy, and the deploy timed out into error while the listener served 200s throughout.

Fixed in 1.2.0-rc.2

• Windows first-start filesystem publication now uses native atomic rename semantics instead of hard links and tolerates unsupported directory syncs.
• Release smoke runs preserve the Windows account identity required to secure the standalone secrets key, isolate workspace state, and keep icacls status output from contaminating machine-readable CLI JSON.

Added

• Slack channel context. Pinging the bot at the top level of a channel gives the run recent channel history as context (last 30 messages); pinging inside a thread gives it that whole thread (up to 100 replies). Context is fetched host-side with the bot token (channels:history scope; missing scopes degrade to no context), and is framed to the model as untrusted quoted channel content, never as instructions. Telegram has no equivalent — the Bot API cannot read history — so Telegram context is the conversation the bot has itself processed.
• can_reply_in_threads channel presentation flag declaring each channel's reply placement: Slack (true) replies in a thread rooted on the pinged message; Telegram (false) replies as an anchored quote of it.

Changed

• Add the bot to a channel and it just works. Shared-conversation admission is presence-based: any Slack channel or Telegram group the bot has been added to is served, with no allowlist and nothing to configure (the slack_allowed_channels / telegram_allowed_channels settings are gone). Channels whose actor identity is not per-user still never serve shared conversations.
• Shared conversations are genuinely shared — and every run still acts as its invoker. A Slack thread (each top-level ping roots its own) or a Telegram group/topic is ONE continuous conversation that every paired participant shares: anyone can follow up on what someone else started. Each message still runs as the person who sent it — their identity, memory, settings, and approval gates — never as a configured subject or the operator (that mechanism is retired). Pre-existing shared threads simply resume. Shared channels are no longer offered as per-user notification delivery targets (DM targets are unchanged), and previously stored shared-channel notification preferences fail closed at resolution.
• Unpaired users get pointed the right way, in place. An unpaired user who pings the bot in a shared conversation gets the connect notice as a reply anchored on their own message (threaded in Slack, quoted in Telegram), throttled per conversation — instead of silence or running as someone else. DMs keep their existing connect prompt.
• Every parked gate is announced, on both delivery lanes. Gate prompts are keyed by their gate ref in the live conversation lane and the background automation lane alike, so a run that parks on several approval/auth gates announces each one instead of collapsing into the first prompt's delivery identity. One deploy-boundary note: a gate prompt delivered but not yet acknowledged when this version deploys re-announces once (its durable delivery identity changed shape).

Removed

• All shared-channel admin-configuration fields: the slack_shared_subject_user_id and slack_subject_routes subject fields AND the slack_allowed_channels / telegram_allowed_channels allowlists. Shared-channel admission is now presence-based — there is nothing to configure, and adding the bot to a channel is what admits it (see "Changed" above). Saved values for any of these retired handles are inert, and new saves fail closed as unknown fields.

[1.1.0-rc.1] - 2026-08-03

First release candidate since 1.0.0. The headline work is extension reach — registering arbitrary hosted MCP servers, installing from IronHub deep links, durable file attachments that cross channels, and Slack /ironclaw slash commands — plus a broad pass on making failures legible: to the model, which now gets told what to do next instead of an opaque stop, and to the user, who gets localized, actionable errors instead of silent dead ends.

Upgrading from 1.0.0. No migration steps. Extension lifecycle state moved to a normalized on-disk shape; rows written by 1.0.0 keep deserializing. The one behavioral removal is the /webhooks/slack/events compatibility alias (see Removed).

Added

• Custom MCP servers. Register a hosted MCP server from the WebUI and use its tools like any other extension: discovery accepts bounded OpenAPI-derived tool catalogs within the manifest's declared tool budget, auth is resolved during registration, and the registered tools are exposed to the model.
• IronHub install flow. Install extensions from an IronHub deep link, including private manifest sources, through a register/install gateway.
• Attachments. Durable cross-channel file flows: a file sent on one channel stays retrievable from the others and from the WebUI.
• Slack slash commands. Native /ironclaw commands in Slack, backed by a role-filtered command palette in the WebUI and role gating on admin command actions.
• Memory as an extension. The memory provider is modeled as a userland extension with a host-managed lifecycle and a contract built around declared capabilities, so a provider advertises what it can actually do instead of being assumed uniform.
• Sandbox lane (opt-in, partly unwired). A RuntimeKind::Sandbox runtime lane with credential reuse, leaf-scoped mount containment, per-user sandbox identity primitives, and a credential placeholder registry. Docker-connect retry, the egress allowlist, and shell limits ship unwired in this release.
• Trigger poller on production-shaped runtimes (opt-in), and the SSO/admin identity resolver wired into those runtimes.
• QA run artifacts. Caller-scoped run and full-thread artifact export, gated off by default, plus a regression promotion loop for the test suite.
• BENCHMARKING_MODE. An opt-in system-prompt addendum for unattended evaluation runs.

Changed

• Extension persistence: normalize filesystem-backed extension lifecycle state into typed installation (with the embedded, hash-pinned manifest definition), user-membership, and credential-binding records with bounded CAS updates, a CAS-protected mutation lease for membership and removal transitions, removed_at soft-removal tombstones, legacy aggregate compatibility views, and restart repair. Retires the per-installation diagnostic health snapshot: it was always healthy, never read, and never surfaced, while the host's activation record already owns extension failure state. Rows written by the previous release keep deserializing.
• Model failures now carry a next step. Every termination path — no progress, iteration limit, disabled capability, denied call, provider error — tells the model what would unlock the call instead of stopping opaquely.
• WebUI performance: route-level code splitting, deferred Markdown and syntax highlighting during chat streaming, optimized embedded static-asset delivery, and pagination for the sidebar thread list, admin users list, and older logs.
• Shared WebUI controls: a common settings Switch, a shared ConfirmDialog replacing native browser confirmations, and normalized control typography.

Fixed

• libSQL prefix queries scanned the whole table: record reads, subtree deletes, and FTS backfill matched descendants with path LIKE ? ESCAPE '!', which cannot use the primary key, so every one of them scanned all of root_filesystem_entries. Their cost therefore grew with the total size of the database — threads, turns, memory, events — rather than with what the caller asked for. They now use the same path >= ? AND path < ? bounds the Postgres backend and libSQL's own list_dir already used, so each seeks the path index. Measured end-to-end on a 200k-row database: /api/webchat/v2/extensions 260ms -> 28ms and .../extensions/registry 380ms -> 20ms. This is what made the hosted Extensions page take seconds and left removed extensions on screen until a manual refresh: the page's post-removal refetch was aborted before the server answered.

• Extension list issued a query per installation: normalizing the aggregate into child rows made list_installations read each installation's membership and credential-binding rows separately, costing 1 + 2N round trips. Both child collections are now read once and joined in memory (3 queries regardless of installation count).

• Agent-loop termination recovery: tell the model when no-progress or the iteration limit would otherwise stop a run, preserve that one-shot warning across checkpoints, and allow one normal capability-enabled recovery turn before taking the existing typed failure path.

• Recoverable capability errors: carry the complete producer-scrubbed cause through the bounded model diagnostic channel, including path-shaped context, and emit an explicit fallback when a runtime supplies no usable detail.

• Skill selection: instruct the model to review visible skills before answering and clarify that skill_activate loads full instructions for relevant skills selected by exact listed name.

• Model recovery: preserve typed, sanitized context-overflow, content-filter, and invalid-output recovery controls across checkpoints so a restarted turn can still ask the model to recover without exposing provider diagnostics or granting an unbounded retry budget.

• Generic channel pairing: accept command-wrapped proof codes only through bounded manifest-declared prefixes; Telegram now declares /start, while undeclared commands remain ordinary inbound messages.

• Extension OAuth authorization: resolve provider, account label, and scopes from the installed extension's manifest requirement instead of accepting browser-selected credential authority; after OAuth, retry only internal caller-scoped readiness until the extension is active, without a second provider exchange or public activation step.

• Hosted MCP discovery: accept bounded OpenAPI-derived tool catalogs within the manifest's declared tool budget, reject malformed catalogs atomically, and never publish bundled static declarations as a fallback for failed live discovery.

• Channel delivery: consume durable turn-lifecycle events through the generic, source-route-revalidating coordinator so OAuth-delayed final replies return to Slack, Telegram, and future channels without a polling watcher.

• Automation delivery: honor each trigger's creator-selected outbound target at fire time instead of silently falling back to the user-wide default.

• Telegram automation delivery: expose paired Telegram DMs through the generic outbound-target registry so creator-selected routine results resolve and deliver through the shipping Telegram channel.

• Channel removal: revoke caller-owned OAuth or proof-code pairing state through the shared lifecycle before deleting any channel installation, so removing Telegram, Slack, or a future channel unpairs it on every surface.

• One authorization per vendor account: authorizing a vendor now covers every installed extension sharing that account, instead of re-prompting per extension. Token response scopes are trusted over the OAuth redirect echo.

• Extension package roots are persisted rather than fabricated on load, so a stale or partial catalog entry no longer takes down startup.

• Tool disclosure is narrowed by the caller's allow-set, closing three paths that leaked tool definitions the caller was not granted.

• Provider errors are classified correctly: rate limits are no longer read as auth failures, a missing model is not retried, adapters report the provider's real finish reason, and the runner stops silently retrying model-stage failures that cannot succeed.

• Context overflow and compaction: secret matches are redacted during compaction and a run recovers from context overflow instead of terminating.

• libSQL durability: writers are serialized, cancelled transactions and interrupted history migrations recover, and transient writer contention no longer surfaces as a failed run.

• Panic and cancellation safety on the run path, plus bounded deterministic gateway failures so a wedged model stage cannot hang a turn.

• WebUI streaming and navigation: smooth streaming with preserved model phases, route state and workspace-tree state preserved across SPA navigation, viewport preserved while loading older messages, message actions kept visible, and active run state preserved when cancellation fails.

• WebUI correctness and a11y: localized chat/extension/OAuth failure messages, surfaced admin user-management failures, recovery from transient session checks, focus trapping in the extension configuration modal, no crash on admin configuration paste, pairing prompts rendered without a text input, tool-permission selection retained while saving, always-allow reset when the approval gate changes, and authenticated previews for workspace file links.

• Automations inherit the implicit source channel target, and the outbound delivery-target registry is caller-scoped structurally rather than by convention.

• Skills: the model is told to review the available skills before answering.

• ironclaw service: the generated systemd unit no longer quotes WorkingDirectory=.

• Projects show only API-backed data instead of placeholder rows.

Performance

• Hosted Postgres API capacity regressed by the row-native process journal is recovered.
• Durable turn-event reads are served by an indexed scope+cursor query instead of a scan.

Removed

• Slack compatibility route: retire the one-release /webhooks/slack/events forwarding alias. Slack Event Subscriptions must use /webhooks/extensions/slack/events; generic product-auth OAuth callbacks are unchanged.

[1.0.0] - 2026-07-27

First stable release of a rearchitected IronClaw. This is not an increment on the 0.29.x line — it is a ground-up rebuild of the agent runtime, storage, extension host, and web UI.

The ironclaw binary is the rearchitected CLI. The v1 monolith builds as the ironclaw-legacy binary and is not published; 1.0.0 publishes the new ironclaw binary only.

This is not an in-place upgrade from 0.29.x

There is no migration for v1 config, databases, settings, or secrets, and installing 1.0.0 does not touch your existing v1 data. Treat it as a fresh install: point IRONCLAW_REBORN_HOME at a new directory, run ironclaw onboard, and reconnect your providers and channels. Do not point it at a v1 data directory.

What ships

• Platforms. Seven targets — macOS (Apple Silicon, Intel), Linux (x86_64/aarch64, gnu and static musl), and Windows (x86_64), with shell, PowerShell, and MSI installers.
• Guided setup. ironclaw onboard provisions the config, the encrypted credential store, an LLM provider (interactive key entry with a live probe), a WebUI login token, and — on macOS and Linux — the background service. The credential store's master key is provisioned in the OS keychain when one is available, falling back to a locally cached key file otherwise.
• Model providers. 26 providers in the built-in catalog, including NEAR AI, OpenAI, Anthropic, Gemini, Bedrock, Ollama, OpenRouter, Groq, DeepSeek, and any OpenAI-compatible endpoint. Manage routes with ironclaw models.
• Web UI. ironclaw serve starts the WebChat v2 interface with the frontend embedded in the binary — no separate asset deploy. Chat, extensions, automations, settings, and admin surfaces are served from root-level routes.
• Extensions. Twelve first-party extensions ship embedded and install without a network fetch: GitHub, Gmail, Google Calendar, Docs, Drive, Sheets, Slides, Notion, NEAR AI MCP, Slack, Telegram, and web access. Manage them with ironclaw extension or the WebUI registry.
• Channels. Slack and Telegram, both configured from the WebUI; Slack connects per user through OAuth, Telegram through a per-user pairing code.
• Runtime. Skills, scheduled and triggered automations, subagents, workspace memory, and trace capture.
• Storage. File-backed libSQL by default, so a stock install needs no external database; PostgreSQL is opt-in via [storage].
• Service management. ironclaw service install|start|stop|restart|status|uninstall runs the binary as a launchd user agent (macOS) or systemd user unit (Linux).

Known limitations

• ironclaw channels list, hooks list, and logs appear in --help but return an explicit "not implemented yet" error.
• mcp, memory, pairing, import, and login subcommands from v1 have no equivalent in this release; MCP servers and memory are reached through extensions and the WebUI instead.
• onboard --import-history parses but does nothing.
• skills is list-only from the CLI.
• extension and skills work out of the box: ironclaw onboard defaults to the local-dev profile, where both are fully supported (as under local-dev-yolo, hosted-single-tenant, and hosted-single-tenant-volume). Only operators who explicitly choose production or migration-dry-run hit a clear error instead.

Please report problems at https://github.com/nearai/ironclaw/issues — include ironclaw status --json output.

The itemized changes since 1.0.0-rc.1 follow; see the 1.0.0-rc.1 entry below for everything that landed between 0.29.1 and the release candidate.

Fixed

• (webui) restore SSE streams across navigation, so chat keeps streaming when the user moves between WebUI routes mid-turn (#6425).
• (webui) stop the WebChat "Disconnected" lockout caused by rate-limit budget exhaustion and navigation-race SSE thrash (#6592).

CI / Release

• (release) update the Reborn Dockerfile and make the Reborn Docker image buildable (#6612).
• (ci) run the full Reborn test and E2E gates on release-fix-* pull-request branches (#6537).

[1.0.0-rc.1] - 2026-07-20

First release candidate of a rearchitected IronClaw. This is not an increment on the 0.29.x line — it is a ground-up rebuild of the agent runtime, storage, extension host, and web UI.

The ironclaw binary is now the rearchitected CLI. The v1 monolith now builds as the ironclaw-legacy binary and is no longer published; 1.0.0-rc.1 publishes the new ironclaw binary only.

This is not an in-place upgrade from 0.29.x

There is no migration for v1 config, databases, settings, or secrets, and installing 1.0.0-rc.1 does not touch your existing v1 data. Treat it as a fresh install: point IRONCLAW_REBORN_HOME at a new directory, run ironclaw onboard, and reconnect your providers and channels. Do not point it at a v1 data directory.

What ships

• Platforms. Seven targets — macOS (Apple Silicon, Intel), Linux (x86_64/aarch64, gnu and static musl), and Windows (x86_64), with shell, PowerShell, and MSI installers.
• Guided setup. ironclaw onboard provisions the config, the encrypted credential store, an LLM provider (interactive key entry with a live probe), a WebUI login token, and — on macOS and Linux — the background service. The credential store's master key is provisioned in the OS keychain when one is available, falling back to a locally cached key file otherwise.
• Model providers. 26 providers in the built-in catalog, including NEAR AI, OpenAI, Anthropic, Gemini, Bedrock, Ollama, OpenRouter, Groq, DeepSeek, and any OpenAI-compatible endpoint. Manage routes with ironclaw models.
• Web UI. ironclaw serve starts the WebChat v2 interface with the frontend embedded in the binary — no separate asset deploy. Chat, extensions, automations, settings, and admin surfaces are served from root-level routes.
• Extensions. Twelve first-party extensions ship embedded and install without a network fetch: GitHub, Gmail, Google Calendar, Docs, Drive, Sheets, Slides, Notion, NEAR AI MCP, Slack, Telegram, and web access. Manage them with ironclaw extension or the WebUI registry.
• Channels. Slack and Telegram, both configured from the WebUI; Slack connects per user through OAuth, Telegram through a per-user pairing code.
• Runtime. Skills, scheduled and triggered automations, subagents, workspace memory, and trace capture.
• Storage. File-backed libSQL by default, so a stock install needs no external database; PostgreSQL is opt-in via [storage].
• Service management. ironclaw service install|start|stop|restart|status|uninstall runs the binary as a launchd user agent (macOS) or systemd user unit (Linux).

Known limitations

• ironclaw channels list, hooks list, and logs appear in --help but return an explicit "not implemented yet" error.
• mcp, memory, pairing, import, and login subcommands from v1 have no equivalent in this release; MCP servers and memory are reached through extensions and the WebUI instead.
• onboard --import-history parses but does nothing.
• skills is list-only from the CLI.
• extension and skills work out of the box: ironclaw onboard defaults to the local-dev profile, where both are fully supported (as under local-dev-yolo, hosted-single-tenant, and hosted-single-tenant-volume). Only operators who explicitly choose production or migration-dry-run hit a clear error instead.

Please report problems at https://github.com/nearai/ironclaw/issues — include ironclaw status --json output.

The itemized changes since 0.29.1 follow.

Added

• (reborn) automations and trigger_list now surface why a scheduled trigger is currently held (approval/auth/in-progress) and how many scheduled occurrences elapsed while held (#5886).
• (reborn) ironclaw service install/start/stop/restart/status/uninstall manage the standalone Reborn binary as an OS-native service (launchd user agent on macOS, systemd user unit on Linux), with a webui-token-file fallback for serve and atomic install with rollback on failure.

Fixed

• (reborn) OAuth setup flows survive service restarts and replica hand-offs: the setup-lane PKCE verifier is stored durably per flow (secret store, flow-scoped TTL) instead of only process-locally, terminal callback outcomes discard it, and lifecycle cleanup drops verifiers for canceled flows eagerly.
• (reborn) ironclaw serve rejects populated legacy [slack] setup fields at startup with a pointer to the WebUI extensions page instead of silently ignoring them ([slack].enabled alone stays tolerated).
• (reborn) route Rig-backed model calls through provider streaming for WebUI v2 runs, cover delayed/broken/cancelled/transient mock LLM behavior in served E2E tests, and verify failed runs can retry after a transient checkpoint-state outage, including failures before the first checkpoint.
• (reborn) activating an extension whose OAuth provider was never configured on the instance now fails immediately with the exact ironclaw config set commands and restart step, instead of parking an unresolvable auth gate (#6335).
• (reborn) host-authored remediation text reaches the model intact again instead of degrading to "capability summary unavailable" (#6335).
• (webui-v2) report settings imports with no supported entries as failures instead of showing a false success message (#6179).
• (filesystem) make libSQL descendant listings seek through the path index instead of scanning the full root-filesystem table, preventing extension-readiness fan-out from stalling unrelated WebUI requests.
• (webui-v2) expose per-user secret provisioning in Admin user details with write-only values, handle-only listings, and confirmed deletion (#6118).
• (webui-v2) render the Extensions Registry as soon as catalog data arrives instead of holding the skeleton screen for slower installed-extension enrichment (#6052).
• (webui-v2) submit the latest composer value when Enter follows input before React rerenders, avoiding intermittently dropped follow-up messages (#6044).
• (reborn) recover the filesystem resource governor after transient libSQL writer contention without bypassing durable accounting, reject stale authority writes during recovery, and distinguish accounting outages from provider budget failures.
• (reborn) builtin.result_read input errors now carry structured, model-visible input-error detail (field path, issue code, expected/received) with model-controlled echoes secret-redacted, and truncated previews of top-level JSON-array results report the array's item_count — persisted end-to-end through the observation validator (#6059).
• (reborn) ride out transient model-provider outages with cancellation-aware availability retries, fail fast when no provider is configured, and preserve actionable shell/coding failure reasons for the model (#5959).
• (slack) resolve known DM conversation IDs through an exact Slack lookup before encoding mentions, avoiding wrong-target posts when conversation lists are long or display names are ambiguous.
• (reborn) add an explicit tenant extension-ownership migration that assigns every installed extension to every existing user, and clean up the departing user's external connection and personal credentials without tearing down the package for remaining users.
• (reborn) make extension-scoped OAuth and explicit extension removal restart-safe and fenced: malformed callbacks now terminate durable flows, status reads are observational with an explicit reconciliation command, multi-credential activation waits without revoking completed credentials, Slack cleanup fences ingress before fallible identity deletion, and uninstall cleanup obligations survive catalog/package loss.
• (reborn) allow builtin.time parse, convert, format, and diff operations to consume JSON numbers or numeric strings containing Unix seconds, integral Unix milliseconds, and fractional Slack timestamps in addition to ISO 8601 strings.

Changed

• (reborn-extensions) every first-party integration (GitHub, Gmail, Google Calendar/Docs/Drive/Sheets/Slides, Notion, Slack, Telegram, Web Access) now ships as a self-contained module under ironclaw_first_party_extensions::packages, carrying its manifest/WASM embeds, onboarding copy, OAuth-setup credential, and host trust effects as opaque bundle data. Composition builds them via bundled_packages() and the built-in trust policy iterates the inventory generically — generic host code no longer names a concrete extension for package machinery (P7b, DEL-8 lane A).
• (reborn) move product-neutral channel delivery into its own crate and make the Telegram host own its concrete state, setup-revision workflow, and trigger-delivery behavior while composition remains mount/registration-only (#6159).
• (webui-v2) serve the Reborn WebUI from root-level browser routes, with temporary /v2 compatibility redirects that preserve deep links and login query parameters; /api/webchat/v2/* remains unchanged (#6142).
• (reborn) raise the default agent-loop runaway backstop from 256 to 1,024 iterations and the subagent ceiling from 16 to 256 (#5959).
• (reborn-cli) document the standalone config init atomic-write dependency on tempfile and call out the default runner cadence change to 5s heartbeats / 200ms polling (down from 10s / 2s).
• (reborn) expose runtime poll settings and document the standalone turn-runner cadence change for callers using TurnRunnerSettings::default().
• (channels) v1 Slack DM policy now defaults to allowlist (previously pairing); existing installs still configured with dm_policy=pairing fall through to allowlist as Slack relay pairing is retired (#5604).
• (reborn-cli) Breaking: ironclaw serve now rejects the legacy [slack] config fields (installation_id, team_id, api_app_id, slack_user_id, user_id, shared_subject_user_id, signing_secret_env, bot_token_env, channel_routes). Slack bot credentials and routing are configured from the WebUI channel setup page; per-user identity comes only from Slack OAuth. [slack].enabled / IRONCLAW_REBORN_SLACK_ENABLED still gate whether the channel mounts (#5604).
• (reborn-extensions) the credential-authority type is now VendorId end-to-end (renamed from ProviderId / RuntimeCredentialAccountProviderId); stored vendor id strings are unchanged and the persisted wire field stays provider. Extension manifests adopt schema reborn.extension_manifest.v3 (explicit [channel] and [auth.<vendor>] sections); the v2 reader still parses and normalizes old manifests into the same resolved model (P1, MAN-11/MAN-2).
• (reborn) outbound delivery is unified behind a single host-owned delivery coordinator — the sole delivery-state writer; channel adapters render and send through ChannelAdapter::deliver with no store access, and there is no direct product send path (P5, OUT-1/OUT-4).

CI / Release

• (release) publish the canonical Reborn ironclaw package from ironclaw-v* tags with cargo-dist across seven OS/CPU targets, including archives, checksums, shell and PowerShell installers, and MSI, while excluding legacy v1, WASM, Docker, npm publishing, and the old registry-update/announcement path (#6160).

Removed

• (reborn) retire the ProductAdapter trait and its ironclaw_wasm_product_adapters host-runtime crate as a consolidation; the live external-protocol contract is ChannelAdapter, onto which ProductAdapter's conformance and outbound-delivery suites were ported unweakened (P7b, DEL-5). The *_v2 adapter crates were renamed to *_extension (DEL-2).
• (channels) remove the v1 pairing_approve builtin tool and the generic channel_connection_resume machinery as part of retiring Slack relay pairing; existing Slack pairing users reconnect via OAuth (Telegram/WASM self-service pairing via the pairing endpoints is unaffected) (#5604).
• (reborn-auth) delete the per-vendor auth machinery — the provider-string multiplexor, HostOAuthProviderSpec and the per-vendor provider specs, the per-vendor gate providers/registries, and the Slack/Google serve branches — in favor of one recipe-driven ironclaw_auth::AuthEngine (oauth2_code + api_key). All five current vendors (Slack, Google, Notion, GitHub, NEAR AI) are expressed as manifest recipes with no per-vendor code path in the engine and no auth trait in the extension ABI (P3, AUTH-1/AUTH-16).

0.29.1 - 2026-06-04

Added

• (web) plumb temperature through Responses API (#3641)

Fixed

• (engine) scope v1 history for channel conversations (#4320)

CI / Release

• (release) add WeCom release artifact (#4107)
• (ci) track nearai/benchmarks at main instead of pinning (#4217)
• (ci) grant id-token: write to unblock nearai-bench reusable workflow (#4220)
• (ci) scope id-token: write to the nearai-bench job (#4221)

0.29.0 - 2026-05-26

Added

• (channels) add WeCom channel (#2394)
• (web) support externally-provided tools in Responses API (#3122)
• (gateway) add logs download button (#3588)
• (tui) add Ctrl-S log download from the Logs tab (#3658)
• (engine) add IRONCLAW_DISABLE_CODEACT flag for disabling v2 CodeAct (#3665)

Fixed

• (markdown) avoid converting emphasis inside generated Slack angle links (#3532)
• (web) restore NEAR AI API Key and Fetch Models in configure UI (#3742)

Changed

• (embeddings) extract embeddings into ironclaw_embeddings crate (#3739)
• (deps) bump dependencies to address security advisories (#3719)
• (deps) update Wasmtime to clear cargo-deny advisory (#4028)

CI / Release

• (canary) improve live canary counts, chat-install probe, and strict xfails (#3682)
• (ci) add /benchmark slash-command dispatcher (#3808)
• (ci) grant pull-requests: write for /benchmark reactions endpoint (#3835)
• (ci) post benchmark "started" comment with dispatcher run link (#3836)

Documentation

• (api) document the Responses API end-to-end (#3709)

0.28.2 - 2026-05-14

Fixed

• (extensions) restore chat-driven tool_install + fix double-invoke + auto-approve footgun (#3559)

Changed

• (llm) hide provider-specific auth, model fetch, and embeddings config behind facades (#3416)

Tests

• (e2e) unxfail two auth-matrix tests now that contracts match (#3589)
• (e2e) make Skills lifecycle deterministic (#3309)

0.28.1 - 2026-05-11

Added

• (channels) add pairing_approve tool for Slack binding via chat (#3396)
• (channels) add WeChat registry artifact metadata (#3386)
• (common) describe paths and platform helpers in crate description (#3498)

Fixed

• (web) bug bash — restart modal recovery, approval clarity, http defaults (#3364)
• (bridge) bypass agent-loop mpsc for inline-await Approval gates (#3365)
• (missions) auto-resume paused missions after gate resolution (#3366)
• (workspace) multi-tenant memory isolation (#3374)
• (auth) tighten Telegram pairing UX and OAuth-failure recovery (#3381)
• (web) isolate cross-tenant SSE/WS status events and thread access (#3390)
• (channels) activate WASM channels on headless servers (#3233)

Changed

• (llm) extract multi-provider integration into ironclaw_llm crate (#3387)

CI / Release

• (canary) seed github_token_scopes companion in auth-live-seeded (#3384)

Tests

• (e2e) restore auth and approval coverage (#3430)
• (e2e) avoid REPL auth retry race (#3437)

0.28.0 - 2026-05-07

Added

• (reborn) land the reborn-integration substrate on main, introducing host foundation crates, capability host, runtime dispatcher, process lifecycle, filesystem, secrets, network, and extension manifest registry boundaries
• (reborn) add WIT-compatible WASM tool runtime (#3097)
• (reborn) add host runtime contract facade and services graph (#3095, #3126)
• (reborn) add memory document storage boundary and search/plugin seams (#3078, #3079)
• (reborn) add prompt write safety policy (#3167)
• (reborn) route WASM and MCP HTTP through shared egress (#3123, #3142)
• (reborn) add host-controlled trust-class policy engine (#3043)
• (channels) add WeChat channel (#1666)
• (channels) add multi-tenant relay channel with per-user identity resolution (#3253)
• (llm) enable thinking for Ollama via default additional params (#2372)

Fixed

• (llm) route DeepSeek, Gemini, and OpenRouter through dedicated rig-core clients (#3326)
• (config) keep startup LLM fallback in-memory only (#3324)
• (engine) inline gate await for Tier 0 and Tier 1 Approval gates (#3157)
• (engine,web) suppress restart-recovery noise on Projects tab; retry empty hydration on SSE open (#3328)
• (bridge) coerce engine action params per schema (#3197)
• (bridge) mission_* tools accept name; resolves #2583 (#3155)
• (libsql) parse scientific notation cost aggregates (#3297)
• (reborn) harden capability approval lifecycle (#3111)
• (reborn) harden edge-case contracts and runtime network policy handoff (#3165)

Changed

• (common) clarify crate-level doc wording and align package description (#3370, #3372)

CI / Release

• cut over workflows for main merge queue (#3104)
• build ironclaw docker image with staging tag from main branch (#3301)
• (release) bump cargo-dist to 0.31.0 to fix installer (#3172)
• add deterministic nightly deep checks and full browser suite nightly (#3261, #3262)
• add nightly failure issue alerts (#3293)

Docs

• refresh feature parity against OpenClaw 2026.3.11–2026.4.30 (#3310)
• promote database and configuration pages from drafts to live; fix wrong defaults; expand variable reference

Tests

• (reborn) add phase 1 integration coverage, host runtime vertical gates, and CapabilityHost integration coverage
• (e2e) add dedicated reborn e2e gate and stabilize coverage suite

0.27.0 - 2026-04-29

Added

• (engine-v2) add canonical capability status vocabulary for the v2 runtime contract (#2825)
• (engine-v2) centralize action-vs-capability surface policy across the prompt, runtime, bridge projection, and tool surface (#2827)
• (bridge) project 3 previously dropped engine events into AppEvents for gateway/runtime consumers (#2797)
• (bridge) project 7 additional engine events into AppEvents, expanding runtime event visibility (#2844)
• (debug-panel) expand Activity tab coverage for CodeAct execution, warnings, and richer event display (#2850)
• (missions) redesign the Missions overview surface with richer mission dossiers and project/thread context (#2894)
• (credentials) add path-based credential matching for per-endpoint auth and route the credential scope through WASM tools, HTTP tools, and sandbox proxy policy (#2168)
• (engine) add short-title support for v2 threads so sidebars and thread lists can display concise labels (#2776)
• (tooling) add fork support to the GitHub tool (#2139)
• (canary) add canary reporting for live workflow coverage (#2874)

Fixed

• (auth) prevent OAuth URL parameter truncation in callback and launch flows (#2746)
• (auth) harden error boundaries, TEE secrets, pairing, auth rehydration, and related bug-bash failures (#2753)
• (bridge) surface latent WASM provider actions to the LLM instead of hiding available provider affordances (#2891)
• (bridge) fix restart approval floor handling so restart requests keep the correct permission baseline (#2978)
• (engine) recover flattened tool calls in the v2 adapter path (#2757)
• (engine) stop failed missions from respawning after terminal failure (#2760)
• (engine) enforce real tool use for stop, pause, and cancel commands (#2814)
• (engine) make mission threads_today reset with timezone-aware boundaries (#2989)
• (engine) centralize tool permission defaults to avoid drift between projection and execution paths (#3041)
• (gateway) serve Responses API routes under the /api/v1/ prefix (#2748)
• (gateway) use conversation-only chat sidebar state and remove non-conversation entries from chat history navigation (#2867)
• (gateway) resolve empty "Fetch available models" results for NEAR AI in settings (#2890)
• (gateway) drop plan_update and approval_needed SSE events that do not carry a thread id (#2986)
• (gateway) keep the Routines tab visible after engine v1 to v2 upgrades (#2992)
• (gateway) surface the NEAR AI session token to the configure UI (#3014)
• (llm) shape tool schemas correctly for NEAR AI provider compatibility (#2951)
• (llm/config) harden model provider configuration across web and CLI paths (#2572)
• (tools) fix v2 tool_info action inventory lookup (#2994)
• (tools) make available actions callable-only for providers blocked from executing unavailable tools (#2868)
• (wasm) remove the stale 10M fuel limit from settings databases and align libSQL migrations (#2851)
• (cli) fix -m handling so it does not quit unexpectedly (#2150)
• (release) correct the staged ironclaw version after a bad release metadata state (#2981)

Security

• (document-extraction) prevent zip-bomb denial of service while extracting uploaded documents (#2093)
• (orchestrator) scope orchestrator credentials to the job creator so sandboxed jobs cannot reuse another user's credentials (#2698)
• (safety) add projection-exempt linting for gateway event sources to keep event projection coverage explicit and auditable (#2840)
• (auth/live-canary) tighten auth flows and unify live canary coverage for auth-sensitive runtime paths (#2367)

Changed

• (engine) bump Monty to v0.0.16 and update CodeAct orchestration docs and prompts to match the runtime (#2784)
• (registry) update WASM artifact SHA256 checksums for Feishu, Slack, Telegram, GitHub, and Portfolio artifacts (#2775)
• (registry) bump GitHub tool and Slack channel registry versions after artifact/source updates (#3057)
• (rust) update the documented minimum Rust version to 1.92 (#2931)

CI / Release

• (docker) release versioned Docker images from the release process (#2795)
• (live-canary) consolidate Live Canary scheduling into one daily 02:00 UTC slot (#2831)
• (release) stop tracking ignored live trace .log diagnostics so release-plz can create clean release PRs (#3058)

Docs

• (architecture) update the engine v2 architecture plan to match verified runtime behavior (#2801)
• (reborn) add the contract-freeze review packet for filesystem, runtime, host API, auth, tool, and storage contracts (#2983)

Tests

• (tests) close the staging test backlog and bring the full suite back to green (#2744)
• (e2e) stabilize multi-tenant widget isolation and portfolio nudge recovery (#2790)
• (test-harness) add Phase 2 replay and gateway coverage (#2896)
• (e2e) update approval E2E expectations for the latest approval and gate flows (#3054)

0.26.0 - 2026-04-21

Added

• (engine-v2) add per-project sandbox with mission lifecycle and cost tracking (#2211) (#2660)
• (llm) hot-reload provider chain from settings (#2673)
• (bridge) add workspace-backed project registration and mission result retrieval (#2533) (#2549)
• (engine) require a tool attempt for explicit user commands and add code execution failure categorization (#2539) (#2483)
• (gate) persist "always approve" decisions in the v2 engine path (#2428)
• (memory) add configurable insights interval, session summaries, and reasoning-augmented recall (#2336)
• (gateway) add attachment flows, document uploads, rich history tool cards, debug inspector, and admin tooling UI (#2385) (#2332) (#2477) (#1873) (#1963)
• (tui) support multiline drafting and input handling improvements (#2449) (#2462)
• (skills) add new-project/template resolution, setup-marker lifecycle, working-directory source discovery, and activation feedback pipeline (#2353) (#2268) (#2396) (#2530)
• (portfolio) complete the portfolio tool, widget, and share-gains flow (#2368)
• (cli) add logs --grep, profile list, user-facing temperature setting, and local-profile onboarding prompts (#1533) (#2288) (#2275) (#2389)
• (runtime) default CLI_MODE to TUI and show the commit hash in non-tagged gateway builds (#2329) (#2486)

Fixed

• (gateway) repair web login, onboarding, pairing, and v2 extension auth resume flows; the web API now uses unified onboarding state events instead of the older auth/pairing event split (#2592) (#2594) (#2515) (#2622)
• (gateway) fix disappearing messages, stale in-progress state, assistant-thread routing, approval scoping, reconnect history reloads, browser crashers, and chat refresh issues (#2498) (#2517) (#2444) (#2267) (#2415) (#2441) (#2330)
• (gateway) fix slash autocomplete, attachment rendering, missions navigation, settings search/auth state, active-work pills, tool output timing, and historical/live tool call correlation (#2763) (#2745) (#2518) (#2709) (#2671) (#2555) (#2182)
• (engine) harden the v2 orchestrator, improve action failure handling, preserve paused auth leases, avoid orphaned approval gates, and prevent runaway or no-op mission execution paths (#1958) (#2326) (#2338) (#2458) (#2531) (#2570) (#2631) (#2347) (#2328) (#2460)
• (llm) fix image generation and image-detail handling, normalize NEAR AI tool schemas, surface 413s as context-length errors, and remove duplicate reasoning_content fields (#1819) (#2380) (#1940) (#2463) (#2339) (#2493)
• (security) add inbound secret scanning, redact HTTP credentials in recordings, fail closed on WASM scope fallback, harden approval thread safety, and scan pre-injection channel headers for leaks (#2494) (#2529) (#2465) (#2366) (#1377)
• (channels) fix active WASM channel restore/status tracking plus Slack, Telegram, and Feishu auth/routing edge cases (#2563) (#2562) (#2420) (#2471) (#2512) (#1540) (#2513) (#1943) (#2652) (#2349) (#2443) (#2454)
• (cli/setup) improve auth UX, avoid UTF-8 panics, suppress non-CLI listeners under --cli-only, validate strict MCP server names, install the NEAR AI MCP server from env config, and run migrations during onboarding when DATABASE_URL is preset (#2315) (#2008) (#1869) (#2400) (#2181) (#2309)
• (sandbox/docker) improve Docker and deployment behavior by preferring the Docker socket when available and restoring the staging runtime target for Railway builds (#2467) (#2244)

Other

• (gateway) continue the web gateway slice extraction and boundary cleanup across platform, chat, oauth, settings, jobs, and routines modules (#2628) (#2643) (#2644) (#2645) (#2665) (#2680) (#2683) (#2687) (#2704) (#2706) (#2712) (#2647)
• (types) adopt typed mission, external-thread, event-status, onboarding, and ownership models across the runtime (#2681) (#2685) (#2678) (#2607) (#2677) (#2611) (#2617)
• (ci) add replay snapshot gating, speed up feedback loops, improve cache reuse, validate release versions in Docker workflows, and stabilize staging promotion checks (#2621) (#2566) (#2609) (#2610) (#2742) (#2576) (#2661) (#2773)
• (docker/ops) add hourly image builds, release-process image builds, and historical image rebuild workflows (#2519) (#2507) (#2509) (#2321)
• (docs) expand MCP, hosting, Responses API, setup, contributor-review, and architecture documentation (#1138) (#2262) (#2440) (#2427) (#2714) (#2365)

0.25.0 - 2026-04-11

Added

• (tools) production-grade coding tools, file history, and skills (#2025)
• add extensible deployment profiles (IRONCLAW_PROFILE) (#2203)
• (skills) commitments system — active intake for personal AI assistant (#1736)
• add native Composio tool for third-party app integrations (#920)
• (gateway) extract gateway frontend into ironclaw_gateway crate with widget system (#1725)
• (railway) build staging target with pre-bundled WASM extensions (#2219)
• (docker) pre-bundle WASM extensions in staging image (#2210)
• (tui) ship TUI in default binary (#2195)
• (admin) admin tool policy to disable tools for users (#2154)
• (web) add scroll-to-bottom arrow in gateway chat (#2202)
• unified tool dispatch + schema-validated workspace (#2049)
• (workspace) admin system prompt shared with all users (#2109)
• (engine) restage skill repair learning loop on staging (#1962)
• (tui) port full-featured Ratatui terminal UI onto staging (#1973)
• (slack) implement on_broadcast and fix message tool hints (#2113)
• (i18n) add Korean translation, fix zh-CN drift, and prevent future drift via pre-commit hook (#2065)
• NEAR AI MCP server (#2009)
• (test) dual-mode live/replay test harness with LLM judge (#2039)
• add AWS Bedrock embeddings provider (#1568)
• (ownership) centralized ownership model with typed identities, DB-backed pairing, and OwnershipCache (#1898)
• (tools) persistent per-user tool permission system (#1911)
• (engine) Unified Thread-Capability-CodeAct execution engine (v2 architecture) (#1557)
• (auth) direct OAuth/social login with Google, GitHub, Apple, and NEAR wallet (#1798)
• Add ACP (Agent Client Protocol) job mode for delegating to any compatible coding agent (#1600)
• (workspace) metadata-driven indexing/hygiene, document versioning, and patch (#1723)
• (jobs) per-job MCP server filtering and max_iterations cap (#1243)
• (config) unify all settings to DB > env > default priority (#1722)
• (telegram) add sendVoice support for audio/ogg attachments (#1314)
• (setup) build ironclaw-worker Docker image in setup wizard (#1757)

Fixed

• (ci) bump 5 channel versions + fix lifetime desync in panics check (#2300)
• (test) case-insensitive hint matching in TraceLlm step_matches (#2292)
• (v2) tool naming, auth gates, schema flatten, WASM traps, workspace race (#2209)
• (ci) resolve 4 staging test failures (#2273)
• (docker) copy profiles/ into build stages (#2289)
• (engine) mission cron scheduling + timezone propagation (#1944) (#1957)
• (oauth) use localhost for redirect URI when bound to 0.0.0.0 (#2247)
• (bridge) sanitize auth_url on engine v2 path (#2206) (#2215)
• (docs) explain in more details activation block & installation steps for skills (#2216)
• (docker) consume CACHE_BUST arg so BuildKit invalidates cache
• (gateway) suppress duplicate text response during auth flow and unify extension config modal (#2172)
• (agent) stop intercepting bare yes/no/always as approval when nothing pending (#2178)
• (ci) resolve 3 staging test failures (#2207)
• (wasm) upgrade Wasmtime to 43.0.1 and restore CI (#2224)
• fix(auth) first-pass Gmail OAuth auth prompt in chat (#2038)
• (db) repair V6 migration checksum and guard against re-modification (#1328) (#2101)
• (ci) target wasm32-wasip2 in WASM build script (#2175)
• (test) use canonical extension name in setup submit test (#2158)
• fix (skills) installs for invalid catalog names (#2040)
• universal engine-version tool visibility filtering (#2132)
• (ownership) remove silent cross-tenant credential fallback (#2099)
• (e2e) canonicalize extension names + fix remaining test failures (#2129)
• (ownership) unify ownership checks via Owned trait and fix mission visibility bug (#2126)
• (web) intercept approval text input in chat (#2124)
• (staging) repair 4 categories of CI test failures (#2091)
• (web) emit Done after response — SSE ordering fix (#2079) (#2104)
• (tools) gate claude_code and acp modes behind enabled flags (#2003)
• (acp) propagate follow-up prompt failures as job errors (#1981)
• color for tools use (#2096)
• (registry) use canonical underscore names in manifests to fix WASM install (#2029)
• (safety) add credential patterns and sensitive path blocklist (#1675)
• (channels) allow telegram wasm channel name (#2051)
• (staging) repair broken test build and macOS-incompatible SSRF tests (#2064)
• honor auto-approve tools in engine v2 (#2013)
• (bridge) sanitize orphaned tool results in v2 adapter (#1975)
• (docker) ensure ironclaw runtime home exists (#1918)
• (agent) prevent self-repair notification spam for stuck jobs (#1867)
• (self-repair) skip built-in tools in broken tool detection and repair (#1991)
• unblock bootstrap ownership on dynamic_tools (#2005)
• (llm) invert reasoning default — unknown models skip think/final tags (#1952)
• (llm) add sanitize_tool_messages to OpenAiCodexProvider (#1971)
• update CLI help snapshots for --auto-approve and acp command (#1966)
• (docker) switch to glibc to fix libSQL segfault on DB reopen (#1930)
• (db) swap V16/V17 to match production PG (document_versions before user_identities) (#1931)
• (db) keep V15=conversation_source_channel to match production PG (#1928)
• (db) resolve V15 migration numbering conflict (#1923)
• (routines) add bounded retry for transient lightweight failures (#1471)
• (relay) thread responses under original message in Slack channels (#1848)
• (worker) Improve command execution parameter validation (#1692)
• (telegram) auto-generate webhook secret during setup (#1536)
• (builder) accept inline-table and object-map dependency formats from LLM (#1748)
• (gemini) preserve and echo thoughtSignature for Gemini 3.x function calls (#1752)
• (relay) route async Slack messages to correct channel instead of DMs (#1845)
• (security) block cross-channel approval thread hijacking (#1590)
• (builder) add approval context propagation for sub-tool execution (#1125)

Other

• trigger ironclaw-dind image build (#2190)
• add amazon tutorial (#2261)
• Create QA Bug Report issue template (#2228)
• [codex] Stabilize auth readiness and gate flows (#2050)
• Add mintlify docs (#2189)
• [codex] allow private local llm endpoints (#1955)
• (ci) add Dependabot and pin GitHub Actions by SHA (#2043)
• Fix routine Telegram notification summaries (#2033)
• (channels) add Slack E2E tests, integration tests, and smoke runner (#2042)
• (engine) rename ENGINE_V2_TRACE to IRONCLAW_RECORD_TRACE (#2114)
• fix multi-tenant inference latency (per-conversation locking + workspace indexing) (#2127)
• Improve channel onboarding and Telegram pairing flow (#2103)
• (e2e) expand SSE resilience coverage (#1897)
• add Telegram E2E tests and Rust integration tests (#2037)
• (fix) WASM channel HTTP SSRF protections (#1976)
• Ignore default model override and empty WASM polls (#1914)
• (workspace) add direct regression tests for scoped_to_user rebinding (#1652) (#1875)
• Fix turn cost footer and per-turn usage accounting (#1951)
• Publish ironclaw-worker image from Dockerfile.worker (#1979)
• [codex] Move safety benches into ironclaw_safety crate (#1954)
• Fix bootstrap paths and webhook defaults
• Only tag :latest/:version on release, allow :staging via manual dispatch [skip-regression-check] (#1925)
• Add Docker Hub workflow and optimize Dockerfile for size (#1886)
• (e2e) add agent loop recovery coverage (#1854)
• disable cooldown in gateway webhook workflow test (#1889)
• Expand GitHub WASM tool surface (#1884)
• (e2e) cover chat approval parity across channels (#1858)
• add routine coverage for issue 1781 (#1856)

0.24.0 - 2026-03-31

Added

• (gateway) OIDC JWT authentication for reverse-proxy deployments (#1463)
• support custom LLM provider configuration via web UI (#1340)
• (skills) recursive bundle directory scanning for skill discovery (#1667)
• (discord) add gateway channel flow in wasm (#944)
• DB-backed user management, admin secrets provisioning, and multi-tenant isolation (#1626)
• (gateway) add OpenAI Responses API endpoints (#1656)

Fixed

• (routines) clone Arc before await in web handler event cache refresh (#1756)
• (slack) respond to thread replies without requiring @mention (#1405)
• resolve 11 test failures from multi-tenant bootstrap and sandbox gate regressions (#1746)
• (auth) make shared Google tool status scope-aware (#1532)
• (wasm) inject Content-Length: 0 for bodyless mutating HTTP requests (#1529)
• (bedrock) strip tool blocks from messages when toolConfig is absent (#1630)
• prevent UTF-8 panics in byte-index string truncation (#1688)
• (gemini) preserve thought signatures on all tool calls (#1565)
• pin staging ci jobs to a single tested sha (#1628)
• (routines) complete full_job execution reliability overhaul (#1650)
• (worker) treat empty LLM response after text output as completion (#1677)
• (worker) replace script -qfc with pty-process for injection-safe PTY (#1678)
• (web) redact database error details from API responses (#1711)
• (oauth) tighten legacy state validation and fallback handling (#1701)
• (db) add tracing warn for naive timestamp fallback and improve parse_timestamp tests (#1700)
• (wasm) use typed WASM schema as advertised schema when available (#1699)
• sanitize tool error results before llm injection (#1639)
• require Feishu webhook authentication (#1638)
• (llm) prevent UTF-8 panic in line_bounds() (fixes #1669) (#1679)
• downgrade excessive debug logging in hot path (closes #1686) (#1694)

Other

• Stabilize MCP refresh regression tests (#1772)
• Fix hosted MCP OAuth refresh flow (#1767)
• Track routine verification state across updates (#1716)
• (e2e) align WASM reinstall expectation with uninstall cleanup (#1762)
• Handle empty tool completions in autonomous jobs (#1720)
• Clarify message tool vs channel setup guidance (#1715)
• tighten contribution and PR guidance (#1704)
• Clean up extension credentials on uninstall (#1718)

0.23.0 - 2026-03-27

Added

• complete multi-tenant isolation — phases 2–4 (#1614)

Fixed

• (routines) recover delete name after failed update fallback (#1108)
• (mcp) handle 202 Accepted and wire session manager for Streamable HTTP (#1437)
• (extensions) channel-relay auth dead-end, observability, and URL override (#1681)
• (agent) discard truncated tool calls when finish_reason == Length (#1631) (#1632)
• (llm) filter XML tool-call recovery by context (#1641)

Other

• Support direct hosted OAuth callbacks with proxy auth token (#1684)

0.22.0 - 2026-03-25

Added

• (agent) thread per-tool reasoning through provider, session, and all surfaces (#1513)
• (cli) show credential auth status in tool info (#1572)
• multi-tenant auth with per-user workspace isolation (#1118)
• (cli) add ironclaw models subcommands (list/status/set/set-provider) (#1043)
• (workspace) multi-scope workspace reads (#1117)
• (ux) complete UX overhaul — design system, onboarding, web polish (#1277)
• (gemini_oauth) full Gemini CLI OAuth integration with Cloud Code API (#1356)
• (shell) add Low/Medium/High risk levels for graduated command approval (closes #172) (#368)
• (agent) queue and merge messages during active turns (#1412)
• (cli) add ironclaw hooks list subcommand (#1023)
• (extensions) support text setup fields in web configure modal (#496)
• (llm) add GitHub Copilot as LLM provider (#1512)
• (workspace) layered memory with sensitivity-based privacy redirect (#1112)
• (webhooks) add public webhook trigger endpoint for routines (#736)
• (llm) Add OpenAI Codex (ChatGPT subscription) as LLM provider (#1461)
• (web) add light theme with dark/light/system toggle (#1457)
• (agent) activate stuck_threshold for time-based stuck job detection (#1234)
• chat onboarding and routine advisor (#927)

Fixed

• ensure LLM calls always end with user message (closes #763) (#1259)
• restore owner-scoped gateway startup (#1625)
• remove stale stream_token gate from channel-relay activation (#1623)
• (agent) case-insensitive channel match and user_id filter for event triggers (#1211)
• (routines) normalize status display across web and CLI (#1469)
• (tunnel) managed tunnels target wrong port and die from SIGPIPE (#1093)
• (agent) persist /model selection to .env, TOML, and DB (#1581)
• post-merge review sweep — 8 fixes across security, perf, and correctness (#1550)
• generate Mistral-compatible 9-char alphanumeric tool call IDs (#1242)
• (mcp) handle empty 202 notification acknowledgements (#1539)
• (tests) eliminate env mutex poison cascade (#1558)
• (safety) escape tool output XML content and remove misleading sanitized attr (#1067)
• (oauth) reject malformed ic2.* states in decode_hosted_oauth_state (#1441) (#1454)
• parameter coercion and validation for oneOf/anyOf/allOf schemas (#1397)
• persist startup-loaded MCP clients in ExtensionManager (#1509)
• (deps) patch rustls-webpki vulnerability (RUSTSEC-2026-0049)
• (routines) add missing extension_manager field in trigger_manual EngineContext
• (ci) serialize env-mutating OAuth wildcard tests with ENV_MUTEX (#1280) (#1468)
• (setup) remove redundant LLM config and API keys from bootstrap .env (#1448)
• resolve wasm broadcast merge conflicts with staging (#395) (#1460)
• skip credential validation for Bedrock backend (#1011)
• register sandbox jobs in ContextManager for query tool visibility (#1426)
• prefer execution-local message routing metadata (#1449)
• (security) validate embedding base URLs to prevent SSRF (#1221)
• f32→f64 precision artifact in temperature causes provider 400 errors (#1450)
• (routines) surface errors when sandbox unavailable for full_job routines (#769)
• restore libSQL vector search with dynamic dimensions (#1393)
• staging CI triage — consolidate retry parsing, fix flaky tests, add docs (#1427)

Other

• Merge branch 'main' into staging-promote/455f543b-23329172268
• Merge pull request #1655 from nearai/codex/fix-staging-promotion-1451-version-bumps
• Merge pull request #1499 from nearai/staging-promote/9603fefd-23364438978
• Fix libsql prompt scope regressions (#1651)
• Normalize cron schedules on routine create (#1648)
• Fix MCP lifecycle trace user scope (#1646)
• Fix REPL single-message hang and cap CI test duration (#1643)
• extract AppEvent to crates/ironclaw_common (#1615)
• Fix hosted OAuth refresh via proxy (#1602)
• (agent) optimize approval thread resolution (UUID parsing + lock contention) (#1592)
• (tools) auto-compact WASM tool schemas, add descriptions, improve credential prompts (#1525)
• Default new lightweight routines to tools-enabled (#1573)
• Google OAuth URL broken when initiated from Telegram channel (#1165)
• add gitcgr code graph badge (#1563)
• Fix owner-scoped message routing fallbacks (#1574)
• (tools) remove unconditional params clone in shared execution (fix #893) (#926)
• (llm) move transcription module into src/llm/ (#1559)
• (agent) avoid preview allocations for non-truncated strings (fix #894) (#924)
• Expand AGENTS.md with coding agents guidance (#1392)
• Fix CI approval flows and stale fixtures (#1478)
• Use live owner tool scope for autonomous routines and jobs (#1453)
• use Arc in embedding cache to avoid clones on miss path (#1438)
• Add owner-scoped permissions for full-job routines (#1440)

0.21.0 - 2026-03-20

Added

• structured fallback deliverables for failed/stuck jobs (#236)
• LRU embedding cache for workspace search (#1423)
• receive relay events via webhook callbacks (#1254)

Fixed

• bump Feishu channel version for promotion
• (approval) make "always" auto-approve work for credentialed HTTP requests (#1257)
• skip NEAR AI session check when backend is not nearai (#1413)

Other

• Make hosted OAuth and MCP auth generic (#1375)

0.20.0 - 2026-03-19

Added

• (self-repair) wire stuck_threshold, store, and builder (#712)
• (testing) add FaultInjector framework for StubLlm (#1233)
• (gateway) unified settings page with subtabs (#1191)
• upgrade MiniMax default model to M2.7 (#1357)

Fixed

• navigate telegram E2E tests to channels subtab (#1408)
• add missing builder field and update E2E extensions tab navigation (#1400)
• remove debug_assert guards that panic on valid error paths (#1385)
• address valid review comments from PR #1359 (#1380)
• full_job routine runs stay running until linked job completion (#1374)
• full_job routine concurrency tracks linked job lifetime (#1372)
• remove -x from coverage pytest to prevent suite-blocking failures (#1360)
• add debug_assert invariant guards to critical code paths (#1312)
• (mcp) retry after missing session id errors (#1355)
• (telegram) preserve polling after secret-blocked updates (#1353)
• (llm) cap retry-after delays (#1351)
• (setup) remove nonexistent webhook secret command hint (#1349)
• Rate limiter returns retry after None instead of a duration (#1269)

Other

• bump telegram channel version to 0.2.5 (#1410)
• (ci) enforce test requirement for state machine and resilience changes (#1230) (#1304)
• Fix duplicate LLM responses for matched event routines (#1275)
• add Japanese README (#1306)
• (ci) add coverage gates via codecov.yml (#1228) (#1291)
• Redesign routine create requests for LLMs (#1147)

0.19.0 - 2026-03-17

Added

• verify telegram owner during hot activation (#1157)
• (config) unify config resolution with Settings fallback (Phase 2, #1119) (#1203)
• (sandbox) add retry logic for transient container failures (#1232)
• (heartbeat) fire_at time-of-day scheduling with IANA timezone (#1029)
• Reuse Codex CLI OAuth tokens for ChatGPT backend LLM calls (#693)
• add pre-push git hook with delta lint mode (#833)
• (cli) add logs command for gateway log access (#1105)
• add Feishu/Lark WASM channel plugin (#1110)
• add Criterion benchmarks for safety layer hot paths (#836)
• (routines) human-readable cron schedule summaries in web UI (#1154)
• (web) add follow-up suggestion chips and ghost text (#1156)
• (ci) include commit history in staging promotion PRs (#952)
• (tools) add reusable sensitive JSON redaction helper (#457)
• configurable hybrid search fusion strategy (#234)
• (cli) add cron subcommand for managing scheduled routines (#1017)
• adds context-llm tool support (#616)
• (web-chat) add hover copy button for user/assistant messages (#948)
• add Slack approval buttons for tool execution in DMs (#796)
• enhance HTTP tool parameter parsing (#911)
• (routines) enable tool access in lightweight routine execution (#257) (#730)
• add MiniMax as a built-in LLM provider (#940)
• (cli) add ironclaw channels list subcommand (#933)
• (cli) add ironclaw skills list/search/info subcommands (#918)
• add cargo-deny for supply chain safety (#834)
• (setup) display ASCII art banner during onboarding (#851)
• (extensions) unify auth and configure into single entrypoint (#677)
• (i18n) Add internationalization support with Chinese and English translations (#929)
• Import OpenClaw memory, history and settings (#903)

Fixed

• jobs limit (#1274)
• misleading UI message (#1265)
• bump channel registry versions for promotion (#1264)
• cover staging CI all-features and routine batch regressions (#1256)
• resolve merge conflict fallout and missing config fields
• web/CLI routine mutations do not refresh live event trigger cache (#1255)
• (jobs) make completed->completed transition idempotent to prevent race errors (#1068)
• (llm) persist refreshed Anthropic OAuth token after Keychain re-read (#1213)
• (worker) prevent orphaned tool_results and fix parallel merging (#1069)
• Telegram bot token validation fails intermittently (HTTP 404) (#1166)
• (security) prevent metadata spoofing of internal job monitor flag (#1195)
• (security) default webhook server to loopback when tunnel is configured (#1194)
• (auth) avoid false success and block chat during pending auth (#1111)
• (config) unify ChannelsConfig resolution to env > settings > default (#1124)
• (web-chat) normalize chat copy to plain text (#1114)
• (skill) treat empty url param as absent when installing skills (#1128)
• preserve AuthError type in oauth_http_client cache (#1152)
• (web) prevent Safari IME composition Enter from sending message (#1140)
• (mcp) handle 400 auth errors, clear auth mode after OAuth, trim tokens (#1158)
• eliminate panic paths in production code (#1184)
• N+1 query pattern in event trigger loop (routine_engine) (#1163)
• (llm) add stop_sequences parity for tool completions (#1170)
• (channels) use live owner binding during wasm hot activation (#1171)
• Non-transactional multi-step context updates between metadata/to… (#1161)
• (webhook) avoid lock-held awaits in server lifecycle paths (#1168)
• Google Sheets returns 403 PERMISSION_DENIED after completing OAuth (#1164)
• HTTP webhook secret transmitted in request body rather than via header, docs inconsistency and security concern (#1162)
• (ci) exclude ironclaw_safety from release automation (#1146)
• (registry) bump versions for github, web-search, and discord extensions (#1106)
• (mcp) address 14 audit findings across MCP module (#1094)
• (http) replace .expect() with match in webhook handler (#1133)
• (time) treat empty timezone string as absent (#1127)
• 5 critical/high-priority bugs (auth bypass, relay failures, unbounded recursion, context growth) (#1083)
• (ci) checkout promotion PR head for metadata refresh (#1097)
• (ci) add missing attachments field and crates/ dir to Dockerfiles (#1100)
• (registry) bump telegram channel version for capabilities change (#1064)
• (ci) repair staging promotion workflow behavior (#1091)
• (wasm) address #1086 review followups -- description hint and coercion safety (#1092)
• (ci) repair staging-ci workflow parsing (#1090)
• (extensions) fix lifecycle bugs + comprehensive E2E tests (#1070)
• add tool_info schema discovery for WASM tools (#1086)
• resolve bug_bash UX/logging issues (#1054 #1055 #1058) (#1072)
• (http) fail closed when webhook secret is missing at runtime (#1075)
• (service) set CLI_ENABLED=false in macOS launchd plist (#1079)
• relax approval requirements for low-risk tools (#922)
• (web) make approval requests appear without page reload (#996) (#1073)
• (routines) run cron checks immediately on ticker startup (#1066)
• (web) recompute cron next_fire_at when re-enabling routines (#1080)
• (memory) reject absolute filesystem paths with corrective routing (#934)
• remove all inline event handlers for CSP script-src compliance (#1063)
• (mcp) include OAuth state parameter in authorization URLs (#1049)
• (mcp) open MCP OAuth in same browser as gateway (#951)
• (deploy) harden production container and bootstrap security (#1014)
• release lock guards before awaiting channel send (#869) (#1003)
• (registry) use versioned artifact URLs and checksums for all WASM manifests (#1007)
• (setup) preserve model selection on provider re-run (#679) (#987)
• (mcp) attach session manager for non-OAuth HTTP clients (#793) (#986)
• (security) migrate webhook auth to HMAC-SHA256 signature header (#970)
• (security) make unsafe env::set_var calls safe with explicit invariants (#968)
• (security) require explicit SANDBOX_ALLOW_FULL_ACCESS to enable FullAccess policy (#967)
• (security) add Content-Security-Policy header to web gateway (#966)
• (test) stabilize openai compat oversized-body regression (#839)
• (ci) disambiguate WASM bundle filenames to prevent tool/channel collision (#964)
• (setup) validate channel credentials during setup (#684)
• drain tunnel pipes to prevent zombie process (#735)
• (mcp) header safety validation and Authorization conflict bug from #704 (#752)
• (agent) block thread_id-based context pollution across users (#760)
• (mcp) stdio/unix transports skip initialize handshake (#890) (#935)
• (setup) drain residual events and filter key kind in onboard prompts (#937) (#949)
• (security) load WASM tool description and schema from capabilities.json (#520)
• (security) resolve DNS once and reuse for SSRF validation to prevent rebinding (#518)
• (security) replace regex HTML sanitizer with DOMPurify to prevent XSS (#510)
• (ci) improve Claude Code review reliability (#955)
• (ci) run gated test jobs during staging CI (#956)
• (ci) prevent staging-ci tag failure and chained PR auto-close (#900)
• (ci) WASM WIT compat sqlite3 duplicate symbol conflict (#953)
• resolve deferred review items from PRs #883, #848, #788 (#915)
• (web) improve UX readability and accessibility in chat UI (#910)

Other

• Fix Telegram auto-verify flow and routing (#1273)
• (e2e) fix approval waiting regression coverage (#1270)
• isolate heavy integration tests (#1266)
• Merge branch 'main' into fix/resolve-conflicts
• Refactor owner scope across channels and fix default routing fallback (#1151)
• (extensions) document relay manager init order (#928)
• (setup) extract init logic from wizard into owning modules (#1210)
• mention MiniMax as built-in provider in all READMEs (#1209)
• Fix schema-guided tool parameter coercion (#1143)
• Make no-panics CI check test-aware (#1160)
• (mcp) avoid reallocating SSE buffer on each chunk (#1153)
• (routines) avoid full message history clone each tool iteration (#1172)
• (registry) align manifest versions with published artifacts (#1169)
• remove pycache from repo and add to .gitignore (#1177)
• (registry) move MCP servers from code to JSON manifests (#1144)
• improve routine schema guidance (#1089)
• add event-trigger routine e2e coverage (#1088)
• enforce no .unwrap(), .expect(), or assert!() in production code (#1087)
• periodic sync main into staging (resolved conflicts) (#1098)
• fix formatting in cli/mod.rs and mcp/auth.rs (#1071)
• Expose the shared agent session manager via AppComponents (#532)
• (agent) remove unnecessary Worker re-export (#923)
• Fix UTF-8 unsafe truncation in WASM emit_message (#1015)
• extract safety module into ironclaw_safety crate (#1024)
• Add Z.AI provider support for GLM-5 (#938)
• (html_to_markdown) refresh golden files after renderer bump (#1016)
• Migrate GitHub webhook normalization into github tool (#758)
• Fix systemctl unit (#472)
• add Russian localization (README.ru.md) (#850)
• Add generic host-verified /webhook/tools/{tool} ingress (#757)

0.18.0 - 2026-03-11

Other

• Merge pull request #907 from nearai/staging-promote/b0214fef-22930316561
• promote staging to main (2026-03-10 15:19 UTC) (#865)
• Merge pull request #830 from nearai/staging-promote/3a2989d0-22888378864
• update WASM artifact SHA256 checksums [skip ci] (#876)

0.17.0 - 2026-03-10

Added

• (llm) per-provider unsupported parameter filtering (#749, #728) (#809)
• persist user_id in save_job and expose job_id on routine runs (#709)
• (ci) chained promotion PRs with multi-agent Claude review (#776)
• add background sandbox reaper for orphaned Docker containers (#634)
• (wasm) lazy schema injection on WASM tool errors (#638)
• add AWS Bedrock LLM provider via native Converse API (#713)
• full image support across all channels (#725)
• (skills) exclude_keywords veto in skill activation scoring (#688)
• (mcp) transport abstraction, stdio/UDS transports, and OAuth fixes (#721)
• add PID-based gateway lock to prevent multiple instances (#717)
• configurable LLM request timeout via LLM_REQUEST_TIMEOUT_SECS (#615) (#630)
• (timezone) add timezone-aware session context (#671)
• (setup) Anthropic OAuth onboarding with setup-token support (#384)
• (llm) add Google Gemini, AWS Bedrock, io.net, Mistral, Yandex, and Cloudflare WS AI providers (#676)
• unified thread model for web gateway (#607)
• WASM channel attachments with LLM pipeline integration (#596)
• enable Anthropic prompt caching via automatic cache_control injection (#660)
• (routines) approval context for autonomous job execution (#577)
• (llm) declarative provider registry (#618)
• (gateway) show IronClaw version in status popover [skip-regression-check] (#636)
• Wire memory hygiene retention policy into heartbeat loop (#629)

Fixed

• (ci) run fmt + clippy on staging PRs, skip Windows clippy [skip-regression-check] (#802)
• (ci) clean up staging pipeline — remove hacks, skip redundant checks [skip-regression-check] (#794)
• (ci) secrets can't be used in step if conditions [skip-regression-check] (#787)
• prevent irreversible context loss when compaction archive write fails (#754)
• button styles (#637)
• (mcp) JSON-RPC spec compliance — flexible id, correct notification format (#685)
• preserve tool-call history across thread hydration (#568) (#670)
• CLI commands ignore runtime DATABASE_BACKEND when both features compiled (#740)
• (web) prevent fetch error when hostname is an IP address in TEE check (#672)
• add timezone conversion support to time tool (#687)
• standardize libSQL timestamps as RFC 3339 UTC (#683)
• (docker) bind postgres to localhost only (#686)
• (repl) skip /quit on EOF when stdin is not a TTY (#724)
• (web) prevent Enter key from sending message during IME composition (#715)
• (config) init_secrets no longer overwrites entire config (#726)
• (cli) status command ignores config.toml and settings.json (#354) (#734)
• (setup) preserve model name when re-running onboarding with same provider (#600) (#694)
• (setup) initialize secrets crypto for env-var security option (#666) (#706)
• persist /model selection across restarts (#707)
• (routines) resolve message tool channel/target from per-job metadata (#708)
• sanitize HTML error bodies from MCP servers to prevent web UI white screen (#263) (#656)
• prevent Instant duration overflow on Windows (#657) (#664)
• enable libsql remote + tls features for Turso cloud sync (#587)
• (tests) replace hardcoded /tmp paths with tempdir + add 300 unit tests (#659)
• (llm) nudge LLM when it expresses tool intent without calling tools (#653)
• (llm) report zero cost for OpenRouter free-tier models (#463) (#613)
• reliable network tests and improved tool error messages (#626)
• (wasm) use per-engine cache dirs on Windows to avoid file lock error (#624)
• (libsql) support flexible embedding dimensions (#534)

Other

• Restructure CLAUDE.md into modular rules + add pr-shepherd command (#750)
• make src/llm/ self-contained for crate extraction (#767)
• add simplified Chinese (zh-CN) README translation (#488)
• (job) cover job tool validation and state transitions (#681)
• (agent) wire TestRig job tools through the scheduler (#716)
• Fix single-message mode to exit after one turn when background channels are enabled (#719)
• remove dead code (#648) (#703)
• add reviewer-feedback guardrails (CLAUDE.md, pre-commit hook, skill) (#665)
• update WASM artifact SHA256 checksums [skip ci] (#631)
• add explanatory comments to coverage workflow (#610)
• build system prompt once per turn, skip tools on force-text (#583)
• add comprehensive subdirectory CLAUDE.md files and update root (#589)
• Improve test infrastructure: StubChannel, gateway helpers, security tests, search edge cases (#623)
• (workspace) regression test for document_path in search results (#509)

Added

• AWS Bedrock LLM provider via native Converse API with IAM and SSO auth support (feature-gated: --features bedrock)

0.16.1 - 2026-03-06

Fixed

• revert WASM artifact SHA256 checksums to null (#627)

0.16.0 - 2026-03-06

Added

• (e2e) extensions tab tests, CI parallelization, and 3 production bug fixes (#584)
• WASM extension versioning with WIT compat checks (#592)
• Add HMAC-SHA256 webhook signature validation for Slack (#588)
• restart (#531)
• merge http/web_fetch tools, add tool output stash for large responses (#578)
• integrate 13-dimension complexity scorer into smart routing (#529)

Fixed

• (llm) fix reasoning model response parsing bugs (#564) (#580)
• (ci) fix three coverage workflow failures (#597)
• Telegram channel accepts group messages from all users if owner_… (#590)
• (ci) anchor coverage/ gitignore rule to repo root (#591)
• (security) use OsRng for all security-critical key and token generation (#519)
• prevent concurrent memory hygiene passes and Windows file lock errors (#535)
• sort tool_definitions() for deterministic LLM tool ordering (#582)
• (ci) persist all cargo-llvm-cov env vars for E2E coverage (#559)

Other

• (llm) complete response cache — set_model invalidation, stats logging, sync mutex (#290)
• add 29 E2E trace tests for issues #571-575 (#593)
• add 26 tests for multi-thread safety, db CRUD, concurrency, errors (#442)
• update WASM artifact SHA256 checksums [skip ci] (#560)
• add WIT compatibility tests for WASM extensions (#586)
• Trajectory benchmarks and e2e trace test rig (#553)

0.15.0 - 2026-03-04

Added

• (oauth) route callbacks through web gateway for hosted instances (#555)
• (web) show error details for failed tool calls (#490)
• (extensions) improve auth UX and add load-time validation (#536)
• add local-test skill and Dockerfile.test for web gateway testing (#524)

Fixed

• (security) restrict query-token auth to SSE endpoints only (#528)
• (ci) flush profraw coverage data in E2E teardown (#550)
• (wasm) coerce string parameters to schema-declared types (#498)
• (agent) strip leaked [Called tool ...] text from responses (#497)
• (web) reset job list UI on restart failure (#499)
• (security) replace .unwrap() panics in pairing store with proper error handling (#515)

Other

• Fix UTF-8 unsafe truncation in sandbox log capture (#359)
• enhance coverage with feature matrix, postgres, and E2E (#523)

0.14.0 - 2026-03-04

Added

• remove the okta tool (#506)
• add OAuth support for WASM tools in web gateway (#489)
• (web) fix jobs UI parity for non-sandbox mode (#491)
• (workspace) add TOOLS.md, BOOTSTRAP.md, and disk-to-DB import (#477)

Fixed

• (web) mobile browser bar obscures chat input (#508)
• (web) assign unique thread_id to manual routine triggers (#500)
• (web) refresh routine UI after Run Now trigger (#501)
• (skills) use slug for skill download URL from ClawHub (#502)
• (workspace) thread document path through search results (#503)
• (workspace) import custom templates before seeding defaults (#505)
• use std::sync::RwLock in MessageTool to avoid runtime panic (#411)
• wire secrets store into all WASM runtime activation paths (#479)

Other

• enforce regression tests for fix commits (#517)
• add code coverage with cargo-llvm-cov and Codecov (#511)
• Remove restart infrastructure, generalize WASM channel setup (#493)

0.13.1 - 2026-03-02

Added

• add Brave Web Search WASM tool (#474)

Fixed

• (web) auto-scroll and Enter key completion for slash command autocomplete (#475)
• correct download URLs for telegram-mtproto and slack-tool extensions (#470)

0.13.0 - 2026-03-02

Added

• (cli) add tool setup command + GitHub setup schema (#438)
• add web_fetch built-in tool (#435)
• (web) DB-backed Jobs tab + scheduler-dispatched local jobs (#436)
• (extensions) add OAuth setup UI for WASM tools + display name labels (#437)
• (bootstrap) auto-detect libsql when ironclaw.db exists (#399)
• (web) slash command autocomplete + /status /list + fix chat input locking (#404)
• (routines) deliver notifications to all installed channels (#398)
• (web) persist tool calls, restore approvals on thread switch, and UI fixes (#382)
• add IRONCLAW_BASE_DIR env var with LazyLock caching (#397)
• feat(signal) attachment upload + message tool (#375)

Fixed

• (channels) add host-based credential injection to WASM channel wrapper (#421)
• pre-validate Cloudflare tunnel token by spawning cloudflared (#446)
• batch of quick fixes (#417, #338, #330, #358, #419, #344) (#428)
• persist channel activation state across restarts (#432)
• init WASM runtime eagerly regardless of tools directory existence (#401)
• add TLS support for PostgreSQL connections (#363) (#427)
• scan inbound messages for leaked secrets (#433)
• use tailscale funnel --bg for proper tunnel setup (#430)
• normalize secret names to lowercase for case-insensitive matching (#413) (#431)
• persist model name to .env so dotted names survive restart (#426)
• (setup) check cloudflared binary and validate tunnel token (#424)
• (setup) validate PostgreSQL version and pgvector availability before migrations (#423)
• guard zsh compdef call to prevent error before compinit (#422)
• (telegram) remove restart button, validate token on setup (#434)
• web UI routines tab shows all routines regardless of creating channel (#391)
• Discord Ed25519 signature verification and capabilities header alias (#148) (#372)
• prevent duplicate WASM channel activation on startup (#390)

Other

• rename WasmBuildable::repo_url to source_dir (#445)
• Improve --help: add detailed about/examples/color, snapshot test (clo… (#371)
• Add automated QA: schema validator, CI matrix, Docker build, and P1 test coverage (#353)

0.12.0 - 2026-02-26

Added

• (web) improve WASM channel setup flow (#380)
• (web) inline tool activity cards with auto-collapsing (#376)
• (web) display logs newest-first in web gateway UI (#369)
• (signal) tool approval workflow and status updates (#350)
• add OpenRouter preset to setup wizard (#270)
• (channels) add native Signal channel via signal-cli HTTP daemon (#271)

Fixed

• correct MCP registry URLs and remove non-existent Google endpoints (#370)
• resolve_thread adopts existing session threads by UUID (#377)
• resolve telegram/slack name collision between tool and channel registries (#346)
• make onboarding installs prefer release artifacts with source fallback (#323)
• copy missing files in Dockerfile to fix build (#322)
• fall back to build-from-source when extension download fails (#312)

Other

• Add --version flag with clap built-in support and test (#342)
• Update FEATURE_PARITY.md (#337)
• add brew install ironclaw instructions (#310)
• Fix skills system: enable by default, fix registry and install (#300)

0.11.1 - 2026-02-23

Other

• Ignore out-of-date generated CI so custom release.yml jobs are allowed

0.11.0 - 2026-02-23

Fixed

• auto-compact and retry on ContextLengthExceeded (#315)

Other

• (README) Adding badges to readme (#316)
• Feat/completion (#240)

0.10.0 - 2026-02-22

Added

• update dashboard favicon (#309)
• add web UI test skill for Chrome extension (#302)
• implement FullJob routine mode with scheduler dispatch (#288)
• hot-activate WASM channels, channel-first prompts, unified artifact resolution (#297)
• add pairing/permission system to all WASM channels and fix extension registry (#286)
• group chat privacy, channel-aware prompts, and safety hardening (#285)
• embedded registry catalog and WASM bundle install pipeline (#283)
• show token usage and cost tracker in gateway status popover (#284)
• support custom HTTP headers for OpenAI-compatible provider (#269)
• add smart routing provider for cost-optimized model selection (#281)

Fixed

• persist user message at turn start before agentic loop (#305)
• block send until thread is selected (#306)
• reload chat history on SSE reconnect (#307)
• map Esc to interrupt and Ctrl+C to graceful quit (#267)

Other

• Fix tool schema OpenAI compatibility (#301)
• simplify config resolution and consolidate main.rs init (#287)
• Update image source in README.md
• Add files via upload
• remove ExtensionSource::Bundled, use download-only install for WASM channels (#293)
• allow OAuth callback to work on remote servers (fixes #186) (#212)
• add rate limiting for built-in tools (closes #171) (#276)
• add LLM providers guide (OpenRouter, Together AI, Fireworks, Ollama, vLLM) (#193)
• Feat/html to markdown #106 (#115)
• adopt agent-market design language for web UI (#282)
• speed up startup from ~15s to ~2s (#280)
• consolidate tool approval into single param-aware method (#274)

0.9.0 - 2026-02-21

Added

• add TEE attestation shield to web gateway UI (#275)
• configurable tool iterations, auto-approve, and policy fix (#251)

Fixed

• add X-Accel-Buffering header to SSE endpoints (#277)

0.8.0 - 2026-02-20

Added

• extension registry with metadata catalog and onboarding integration (#238)
• (models) add GPT-5.3 Codex, full GPT-5.x family, Claude 4.x series, o4-mini (#197)
• wire memory hygiene into the heartbeat loop (#195)

Fixed

• persist WASM channel workspace writes across callbacks (#264)
• consolidate per-module ENV_MUTEX into crate-wide test lock (#246)
• remove auto-proceed fake user message injection from agent loop (#255)
• onboarding errors reset flow and remote server auth (#185, #186) (#248)
• parallelize tool call execution via JoinSet (#219) (#252)
• prevent pipe deadlock in shell command execution (#140)
• persist turns after approval and add agent-level tests (#250)

Other

• add automated PR labeling system (#253)
• update CLAUDE.md for recently merged features (#183)

0.7.0 - 2026-02-19

Added

• extend lifecycle hooks with declarative bundles (#176)
• support per-request model override in /v1/chat/completions (#103)

Fixed

• harden openai-compatible provider, approval replay, and embeddings defaults (#237)
• Network Security Findings (#201)

Added

• Refactored OpenAI-compatible chat completion routing to use the rig adapter and RetryProvider composition for custom base URL usage.
• Added Ollama embeddings provider support (EMBEDDING_PROVIDER=ollama, OLLAMA_BASE_URL) in workspace embeddings.
• Added migration V9__flexible_embedding_dimension.sql for flexible embedding vector dimensions.

Changed

• Changed default sandbox image to ironclaw-worker:latest in config/settings/sandbox defaults.
• Improved tool-message sanitization and provider compatibility handling across NEAR AI, rig adapter, and shared LLM provider code.

Fixed

• Fixed approval-input aliases (a, /approve, /always, /deny, etc.) in submission parsing.
• Fixed multi-tool approval resume flow by preserving and replaying deferred tool calls so all prior tool_use IDs receive matching tool_result messages.
• Fixed REPL quit/exit handling to route shutdown through the agent loop for graceful termination.

0.6.0 - 2026-02-19

Added

• add issue triage skill (#200)
• add PR triage dashboard skill (#196)
• add OpenRouter usage examples (#189)
• add Tinfoil private inference provider (#62)
• shell env scrubbing and command injection detection (#164)
• Add PR review tools, job monitor, and channel injection for E2E sandbox workflows (#57)
• Secure prompt-based skills system (Phases 1-4) (#51)
• Add benchmarking harness with spot suite (#10)
• 10 infrastructure improvements from zeroclaw (#126)

Fixed

• (rig) prevent OpenAI Responses API panic on tool call IDs (#182)
• (docs) correct settings storage path in README (#194)
• OpenAI tool calling — schema normalization, missing types, and Responses API panic (#132)
• (security) prevent path traversal bypass in WASM HTTP allowlist (#137)
• persist OpenAI-compatible provider and respect embeddings disable (#177)
• remove .expect() calls in FailoverProvider::try_providers (#156)
• sentinel value collision in FailoverProvider cooldown (#125) (#154)
• skills module audit cleanup (#173)

Other

• Fix division by zero panic in ValueEstimator::is_profitable (#139)
• audit feature parity matrix against codebase and recent commits (#202)
• architecture improvements for contributor velocity (#198)
• fix rustfmt formatting from PR #137
• add .env.example examples for Ollama and OpenAI-compatible (#110)

0.5.0 - 2026-02-17

Added

• add cooldown management to FailoverProvider (#114)

0.4.0 - 2026-02-17

Added

• move per-invocation approval check into Tool trait (#119)
• add polished boot screen on CLI startup (#118)
• Add lifecycle hooks system with 6 interception points (#18)

Other

• remove accidentally committed .sidecar and .todos directories (#123)

0.3.0 - 2026-02-17

Added

• direct api key and cheap model (#116)

0.2.0 - 2026-02-16

Added

• mark Ollama + OpenAI-compatible as implemented (#102)
• multi-provider inference + libSQL onboarding selection (#92)
• add multi-provider LLM failover with retry backoff (#28)
• add libSQL/Turso embedded database backend (#47)
• Move debug log truncation from agent loop to REPL channel (#65)

Fixed

• shell destructive-command check bypassed by Value::Object arguments (#72)
• propagate real tool_call_id instead of hardcoded placeholder (#73)
• Fix wasm tool schemas and runtime (#42)
• flatten tool messages for NEAR AI cloud-api compatibility (#41)
• security hardening across all layers (#35)

Other

• Explicitly enable cargo-dist caching for binary artifacts building
• Skip building binary artifacts on every PR
• add module specification rules to CLAUDE.md
• add setup/onboarding specification (src/setup/README.md)
• deduplicate tool code and remove dead stubs (#98)
• Reformat architecture diagram in README (#64)
• Add review discipline guidelines to CLAUDE.md (#68)
• Bump MSRV to 1.92, add GCP deployment files (#40)
• Add OpenAI-compatible HTTP API (/v1/chat/completions, /v1/models) (#31)

0.1.3 - 2026-02-12

Other

• Enabled builds caching during CI/CD
• Disabled npm publishing as the name is already taken

0.1.2 - 2026-02-12

Other

• Added Installation instructions for the pre-built binaries
• Disabled Windows ARM64 builds as auto-updater [provided by cargo-dist] does not support this platform yet and it is not a common platform for us to support

0.1.1 - 2026-02-12

Other

• Renamed the secrets in release-plz.yml to match the configuration
• Make sure that the binaries release CD it kicking in after release-plz

0.1.0 - 2026-02-12

Added

• Add multi-provider LLM support via rig-core adapter (#36)
• Sandbox jobs (#4)
• Add Google Suite & Telegram WASM tools (#9)
• Improve CLI (#5)

Fixed

• resolve runtime panic in Linux keychain integration (#32)

Other

• Skip release-plz on forks
• Upgraded release-plz CD pipeline
• Added CI/CD and release pipelines (#45)
• DM pairing + Telegram channel improvements (#17)
• Fixes build, adds missing sse event and correct command (#11)
• Codex/feature parity pr hook (#6)
• Add WebSocket gateway and control plane (#8)
• select bundled Telegram channel and auto-install (#3)
• Adding skills for reusable work
• Fix MCP tool calls, approval loop, shutdown, and improve web UI
• Add auth mode, fix MCP token handling, and parallelize startup loading
• Merge remote-tracking branch 'origin/main' into ui
• Adding web UI
• Rename setup CLI command to onboard for compatibility
• Add in-chat extension discovery, auth, and activation system
• Add Telegram typing indicator via WIT on-status callback
• Add proactivity features: memory CLI, session pruning, self-repair notifications, slash commands, status diagnostics, context warnings
• Add hosted MCP server support with OAuth 2.1 and token refresh
• Add interactive setup wizard and persistent settings
• Rebrand to IronClaw with security-first mission
• Fix build_software tool stuck in planning mode loop
• Enable sandbox by default
• Fix Telegram Markdown formatting and clarify tool/memory distinctions
• Simplify Telegram channel config with host-injected tunnel/webhook settings
• Apply Telegram channel learnings to WhatsApp implementation
• Merge remote-tracking branch 'origin/main'
• Docker file for sandbox
• Replace hardcoded intent patterns with job tools
• Fix router test to match intentional job creation patterns
• Add Docker execution sandbox for secure shell command isolation
• Move setup wizard credentials to database storage
• Add interactive setup wizard for first-run configuration
• Add Telegram Bot API channel as WASM module
• Add OpenClaw feature parity tracking matrix
• Add Chat Completions API support and expand REPL debugging
• Implementing channels to be handled in wasm
• Support non interactive mode and model selection
• Implement tool approval, fix tool definition refresh, and wire embeddings
• Tool use
• Wiring more
• Add heartbeat integration, planning phase, and auto-repair
• Login flow
• Extend support for session management
• Adding builder capability
• Load tools at launch
• Fix multiline message rendering in TUI
• Parse NEAR AI alternative response format with output field
• Handle NEAR AI plain text responses
• Disable mouse capture to allow text selection in TUI
• Add verbose logging to debug empty NEAR AI responses
• Improve NEAR AI response parsing for varying response formats
• Show status/thinking messages in chat window, debug empty responses
• Add timeout and logging to NEAR AI provider
• Add status updates to show agent thinking/processing state
• Add CLI subcommands for WASM tool management
• Fix TUI shutdown: send /shutdown message and handle in agent loop
• Remove SimpleCliChannel, add Ctrl+D twice quit, redirect logs to TUI
• Fix TuiChannel integration and enable in main.rs
• Integrate Codex patterns: task scheduler, TUI, sessions, compaction
• Adding LICENSE
• Add README with IronClaw branding
• Add WASM sandbox secure API extension
• Wire database Store into agent loop
• Implementing WASM runtime
• Add workspace integration tests
• Compact memory_tree output format
• Replace memory_list with memory_tree tool
• Simplify workspace to path-based storage, remove legacy code
• Add NEAR AI chat-api as default LLM provider
• Add CLAUDE.md project documentation
• Add workspace and memory system (OpenClaw-inspired)
• Initial implementation of the agent framework