ironclaw: baixar versions anteriors

Release Notes
Stable promotion of 1.4.1-rc.2, carrying its Google OAuth activation fix
and a Wasmtime security update.
Fixed
- Google extensions (Gmail, Google Calendar) can now be activated on a
deployment whose operator supplies the Google OAuth client through the
Web UI rather than environment variables. Authorization completed and then
activation failed, and the terminal failure revoked the credential that had
just been issued, so every retry re-consented and failed again. Two sources
answered "is this vendor's OAuth client configured": the auth engine
resolved client material live from administrator configuration, while the
extension activation gate and the first-party tool-dispatch backstop read a
map captured at process start from environment variables alone, which the
Web UI cannot write. Readiness is now resolved per activation and per
dispatch through the same credential chain the auth engine uses, and it
requires a composed OAuth engine, so a vendor whose flow cannot be started
is never reported ready.
Within that chain, administrator configuration now takes precedence over
deployment (environment / config.toml) client material. Deployments that
bake client credentials and never open the administrator form are
unaffected — they resolve through the same path as before.
- The WASM runtime now uses Wasmtime and WASI 48.0.3, fixing recent guest fuel
accounting vulnerabilities and a WASI filesystem timestamp panic.

Release Notes
Stable promotion of 1.4.0-rc.1, covering the 81 commits since
ironclaw-v1.3.0 and the complete release-candidate scope below.
Added
- Durable notification inbox: runs publish authoritative outcomes and
actionable gates to a per-user inbox, surfaced by the WebUI notification
center, so approvals and auth prompts survive a missed session.
- Background subagents: a parent turn can spawn children that run and deliver
on their own, with per-child delivery, activation provenance, a derived cap
on autonomous wakes, and healing sweeps for orphaned children.
- Persistent per-user sandbox containers on the local-Docker profile, reached
over Docker Exec so container-local installs and state survive between
commands. The Railway preview profile still runs an ephemeral worker per
command and keeps only its checkpointed workspace.
- Managed per-user sandbox egress proxy, with manifest-declared direct-exec
credential bindings that stay behind it so secrets are never handed to
sandboxed code.
- Run-now for automations, plus exact run capability facts.
- Durable backend suggestions generated over the user's own no-approval,
read-only tools and gated on connected extensions.
- Google Docs semantic editing tools; run timing evidence in downloadable
conversation artifacts.
- Opt-in in-worker SSH in the runtime image (see Operators below).
Fixed
- Structured finalization stalls are bounded, and OpenAI-compatible
reasoning-only responses are preserved.
- Provider failures and auth diagnostics reach the model as readable context
instead of opaque errors.
- libSQL write-lane starvation no longer cascades through the resource
governor as unrelated tool failures.
- Telegram separates workspace-bot pairing from personal device linking, and
keeps paired channels ready while collapsing streaming reply drafts.
- Slack delivers the unlinked-user connect nudge privately with a one-click
connect link.
- Installation state written by 1.2.x is accepted and preserved, so a
deployment that skipped 1.3 upgrades directly.
- Incremental compaction summary context is preserved.
Operators
- The runtime image can start an in-worker SSH listener. It is off unless
IRONCLAW_REBORN_SSH_PUBLIC_KEY is set to an OpenSSH public key, which
enables public-key-only login as user agent on container port 2222; that
port must be published to be reachable. agent shares uid 1000 with the
ironclaw runtime user, so an SSH session holds the full runtime identity --
treat the private key like shell access to the service.
- IRONCLAW_REBORN_WORKSPACE_ROOT is honored on both CLI boot paths. Neither
it nor IRONCLAW_REBORN_HOME may be set to the filesystem root.
- New sandbox knobs: IRONCLAW_REBORN_SANDBOX_PROXY_IMAGE and
IRONCLAW_SANDBOX_EXTRA_ALLOWED_DOMAINS.
Upgrading
No migration steps from 1.3.0.

Release Notes
Stable promotion of 1.3.0-rc.2, including the upgrade and container fixes
validated in RC2 and the complete RC1 scope below.
Fixed in 1.3.0-rc.2
- Upgrades from 1.2 now accept and preserve the released extension
activation_state field instead of crash-looping during startup.
- The canonical Reborn runtime image again supports opt-in, public-key-only
worker SSH on port 2222 while running IronClaw as an unprivileged user.
Added
- Per-user model preferences. Each user picks their own model from WebUI
settings, the CLI, or chat commands, and the choice follows them through
channel turns and inbound replay. Admins bound what is selectable with a
tenant-scoped model selection policy.
- Structured automations. A scheduled trigger now carries a validated
execution contract — prompt spec, execution policy, required skills — checked
by a fail-closed preflight at creation instead of a free-form prompt string,
and unattended runs get their own protocol. A deterministic no-result
sentinel lets a run that has nothing to report finish silently instead of
delivering filler.
- Document editing. Structural edits to .docx, .xlsx, and .pptx
files, and PDF rendering from HTML.
- Telegram linked devices. Pair a personal Telegram account with the bot
channel so the agent can read your conversations and act as you through the
standard messaging operations. Reads are live against Telegram's own servers
— there is no local mirror, retention policy, or search index of the account
— while message content a run actually reads is retained in that run's
transcript like any other tool result.
- The full Slack messaging vocabulary. Eight more standard operations —
edit message, delete message, add reaction, remove reaction, open DM, get
message, resolve user, list members — complete the core surface.
- Ranked memory recall. Retrieval ranks by relevance instead of requiring
every term of the question to appear in the saved fact, so a differently
worded question still finds it, and broken memory is visibly different from
empty memory. Memory-save guidance ships with an always-on MEMORY.md prompt
lane.
- Opt-in parallel tool batches in the agent loop.
- Explicit Anthropic cache_control prompt-cache breakpoints on both
transports.
- A shared WebUI search field, and per-field help text on admin extension
configuration forms alongside a rewritten channel setup guide.
Changed
- Substantially fewer database writes per turn. Capability invocation state
persists at gate and terminal edges only; runtime milestone events, thread
index touches, message lookup indexes, trigger and outbound state, and
process heartbeats all coalesce or fold into existing rows.
- Turn execution runs on prepared-context ("unbound") turns behind one accept
door, replacing the kernel binding-ref path.
- Channel ingress is normalized once, with reply split from delivery.
- The public documentation site deploys from a docs-live branch that stable
releases move, so published docs describe the released binary rather than
unreleased main.
Fixed
- Context-window eviction compacts instead of discarding: the accepted task and
any steering survive the eviction.
- Lease expiry recovers safe runs instead of failing them, and the journal
heartbeat pool is isolated.
- An unavailable capability call is repaired instead of aborting the run, and
repeated-call detection is advisory rather than fatal.
- Model-bound secrets are redacted without rejecting the turn.
- Telegram sticker and voice attachments no longer brick the channel, and the
2FA gate on migrated data centers is recognized and says where the login code
arrives.
- Extension cards and install results report what actually happened; bundled
MCP state refreshes after auth; hosted MCP OAuth supports origin-scoped
servers.
- WebUI: SSE reconnect storms are bounded, long conversation titles reveal on
hover, exposed-route copy is localized, and a failed tool call reads as a
subtle badge instead of a loud summary.
- The resource governor keeps 

Release Notes
Stable promotion of 1.2.0-rc.3, including the fixes validated in RC2 and
RC3 and the complete RC1 feature set below.
Fixed in 1.2.0-rc.3
- The runtime container image now installs curl, so in-container HTTP
healthchecks can execute. Orchestrators probe the worker with
curl -fsS http://localhost:3000/; the image shipped no HTTP client, so the
probe could never run, the container was never marked healthy, and the deploy
timed out into error while the listener served 200s throughout.
Changed in 1.2.0-rc.3
- Reborn PR test planning and the root-partition runner now share one test
inventory covering every tests/*.rs target, and container image inputs
select the root test that asserts them. Previously the two sides disagreed on
partition assignment, so a scheduled root test could be reported green
without having run.
Fixed in 1.2.0-rc.2
- Windows first-start filesystem publication now uses native atomic rename
semantics instead of hard links and tolerates unsupported directory syncs.
- Release smoke runs preserve the Windows account identity required to secure
the standalone secrets key, isolate workspace state, and keep icacls
status output from contaminating machine-readable CLI JSON.
Added
- Slack channel context. Pinging the bot at the top level of a channel
gives the run recent channel history as context (last 30 messages); pinging
inside a thread gives it that whole thread (up to 100 replies). Context is
fetched host-side with the bot token (channels:history scope; missing
scopes degrade to no context), and is framed to the model as untrusted
quoted channel content, never as instructions. Telegram has no equivalent —
the Bot API cannot read history — so Telegram context is the conversation
the bot has itself processed.
- can_reply_in_threads channel presentation flag declaring each channel's
reply placement: Slack (true) replies in a thread rooted on the pinged
message; Telegram (false) replies as an anchored quote of it.
Changed
- Add the bot to a channel and it just works. Shared-conversation
admission is presence-based: any Slack channel or Telegram group the bot
has been added to is served, with no allowlist and nothing to configure
(the slack_allowed_channels / telegram_allowed_channels settings are
gone). Channels whose actor identity is not per-user still never serve
shared conversations.
- Shared conversations are genuinely shared — and every run still acts as
its invoker. A Slack thread (each top-level ping roots its own) or a
Telegram group/topic is ONE continuous conversation that every paired
participant shares: anyone can follow up on what someone else started.
Each message still runs as the person who sent it — their identity,
memory, settings, and approval gates — never as a configured subject or
the operator (that mechanism is retired). Pre-existing shared threads
simply resume. Shared channels are no longer offered as per-user
notification delivery targets (DM targets are unchanged), and previously
stored shared-channel notification preferences fail closed at resolution.
- Unpaired users get pointed the right way, in place. An unpaired user
who pings the bot in a shared conversation gets the connect notice as a
reply anchored on their own message (threaded in Slack, quoted in
Telegram), throttled per conversation — instead of silence or running as
someone else. DMs keep their existing connect prompt.
- Every parked gate is announced, on both delivery lanes. Gate prompts are
keyed by their gate ref in the live conversation lane and the background
automation lane alike, so a run that parks on several approval/auth gates
announces each one instead of collapsing into the first prompt's delivery
identity. One deploy-boundary note: a gate prompt delivered but not yet
acknowledged when this version deploys re-announces once (its durable
delivery identity changed shape).
Removed
- All shared-channel admin-configuration fields: the slack_shared_subject_user_id
and slack_subject_routes subject fields AND t

Release Notes
First stable release of a rearchitected IronClaw. This is not an increment on
the 0.29.x line — it is a ground-up rebuild of the agent runtime, storage,
extension host, and web UI.
The ironclaw binary is the rearchitected CLI. The v1 monolith builds as
the ironclaw-legacy binary and is not published; 1.0.0 publishes the new
ironclaw binary only.
This is not an in-place upgrade from 0.29.x
There is no migration for v1 config, databases, settings, or secrets, and
installing 1.0.0 does not touch your existing v1 data. Treat it as a fresh
install: point IRONCLAW_REBORN_HOME at a new directory, run
ironclaw onboard, and reconnect your providers and channels. Do not point it
at a v1 data directory.
What ships
- Platforms. Seven targets — macOS (Apple Silicon, Intel), Linux
(x86_64/aarch64, gnu and static musl), and Windows (x86_64), with shell,
PowerShell, and MSI installers.
- Guided setup. ironclaw onboard provisions the config, the encrypted
credential store, an LLM provider (interactive key entry with a live probe),
a WebUI login token, and — on macOS and Linux — the background service. The
credential store's master key is provisioned in the OS keychain when one is
available, falling back to a locally cached key file otherwise.
- Model providers. 26 providers in the built-in catalog, including NEAR AI,
OpenAI, Anthropic, Gemini, Bedrock, Ollama, OpenRouter, Groq, DeepSeek, and
any OpenAI-compatible endpoint. Manage routes with ironclaw models.
- Web UI. ironclaw serve starts the WebChat v2 interface with the frontend
embedded in the binary — no separate asset deploy. Chat, extensions,
automations, settings, and admin surfaces are served from root-level routes.
- Extensions. Twelve first-party extensions ship embedded and install
without a network fetch: GitHub, Gmail, Google Calendar, Docs, Drive, Sheets,
Slides, Notion, NEAR AI MCP, Slack, Telegram, and web access. Manage them with
ironclaw extension or the WebUI registry.
- Channels. Slack and Telegram, both configured from the WebUI; Slack
connects per user through OAuth, Telegram through a per-user pairing code.
- Runtime. Skills, scheduled and triggered automations, subagents, workspace
memory, and trace capture.
- Storage. File-backed libSQL by default, so a stock install needs no
external database; PostgreSQL is opt-in via [storage].
- Service management. ironclaw service install|start|stop|restart|status|uninstall
runs the binary as a launchd user agent (macOS) or systemd user unit (Linux).
Known limitations
- ironclaw channels list, hooks list, and logs appear in --help but
return an explicit "not implemented yet" error.
- mcp, memory, pairing, import, and login subcommands from v1 have no
equivalent in this release; MCP servers and memory are reached through
extensions and the WebUI instead.
- onboard --import-history parses but does nothing.
- skills is list-only from the CLI.
- extension and skills work out of the box: ironclaw onboard defaults to
the local-dev profile, where both are fully supported (as under
local-dev-yolo, hosted-single-tenant, and hosted-single-tenant-volume).
Only operators who explicitly choose production or migration-dry-run
hit a clear error instead.
Please report problems at https://github.com/nearai/ironclaw/issues — include
ironclaw status --json output.
The itemized changes since 1.0.0-rc.1 follow; see the 1.0.0-rc.1 entry below for
everything that landed between 0.29.1 and the release candidate.
Fixed
- (webui) restore SSE streams across navigation, so chat keeps streaming when
the user moves between WebUI routes mid-turn (#6425).
- (webui) stop the WebChat "Disconnected" lockout caused by rate-limit budget
exhaustion and navigation-race SSE thrash (#6592).
CI / Release
- (release) update the Reborn Dockerfile and make the Reborn Docker image
buildable (#6612).
- (ci) run the full Reborn test and E2E gates on release-fix-* pull-request
branches (#6537).

Release Notes
First release candidate of a rearchitected IronClaw. This is not an increment
on the 0.29.x line — it is a ground-up rebuild of the agent runtime, storage,
extension host, and web UI.
The ironclaw binary is now the rearchitected CLI. The v1 monolith now
builds as the ironclaw-legacy binary and is no longer published; 1.0.0-rc.1
publishes the new ironclaw binary only.
This is not an in-place upgrade from 0.29.x
There is no migration for v1 config, databases, settings, or secrets, and
installing 1.0.0-rc.1 does not touch your existing v1 data. Treat it as a
fresh install: point IRONCLAW_REBORN_HOME at a new directory, run
ironclaw onboard, and reconnect your providers and channels. Do not point
it at a v1 data directory.
What ships
- Platforms. Seven targets — macOS (Apple Silicon, Intel), Linux
(x86_64/aarch64, gnu and static musl), and Windows (x86_64), with shell,
PowerShell, and MSI installers.
- Guided setup. ironclaw onboard provisions the config, the encrypted
credential store, an LLM provider (interactive key entry with a live probe),
a WebUI login token, and — on macOS and Linux — the background service. The
credential store's master key is provisioned in the OS keychain when one is
available, falling back to a locally cached key file otherwise.
- Model providers. 26 providers in the built-in catalog, including NEAR AI,
OpenAI, Anthropic, Gemini, Bedrock, Ollama, OpenRouter, Groq, DeepSeek, and
any OpenAI-compatible endpoint. Manage routes with ironclaw models.
- Web UI. ironclaw serve starts the WebChat v2 interface with the frontend
embedded in the binary — no separate asset deploy. Chat, extensions,
automations, settings, and admin surfaces are served from root-level routes.
- Extensions. Twelve first-party extensions ship embedded and install
without a network fetch: GitHub, Gmail, Google Calendar, Docs, Drive, Sheets,
Slides, Notion, NEAR AI MCP, Slack, Telegram, and web access. Manage them with
ironclaw extension or the WebUI registry.
- Channels. Slack and Telegram, both configured from the WebUI; Slack
connects per user through OAuth, Telegram through a per-user pairing code.
- Runtime. Skills, scheduled and triggered automations, subagents, workspace
memory, and trace capture.
- Storage. File-backed libSQL by default, so a stock install needs no
external database; PostgreSQL is opt-in via [storage].
- Service management. ironclaw service install|start|stop|restart|status|uninstall
runs the binary as a launchd user agent (macOS) or systemd user unit (Linux).
Known limitations
- ironclaw channels list, hooks list, and logs appear in --help but
return an explicit "not implemented yet" error.
- mcp, memory, pairing, import, and login subcommands from v1 have no
equivalent in this release; MCP servers and memory are reached through
extensions and the WebUI instead.
- onboard --import-history parses but does nothing.
- skills is list-only from the CLI.
- extension and skills work out of the box: ironclaw onboard defaults to
the local-dev profile, where both are fully supported (as under
local-dev-yolo, hosted-single-tenant, and hosted-single-tenant-volume).
Only operators who explicitly choose production or migration-dry-run
hit a clear error instead.
Please report problems at https://github.com/nearai/ironclaw/issues — include
ironclaw status --json output.
The itemized changes since 0.29.1 follow.
Added
- (reborn) automations and trigger_list now surface why a scheduled trigger is currently held (approval/auth/in-progress) and how many scheduled occurrences elapsed while held (#5886).
- (reborn) ironclaw service install/start/stop/restart/status/uninstall manage the standalone Reborn binary as an OS-native service (launchd user agent on macOS, systemd user unit on Linux), with a webui-token-file fallback for serve and atomic install with rollback on failure.
Fixed
- (reborn) activating an extension whose OAuth provider was never configured on the instance now fails immediately with the exact ironclaw 

Release Notes
Added
- (web) plumb temperature through Responses API (#3641)
Fixed
- (engine) scope v1 history for channel conversations (#4320)
CI / Release
- (release) add WeCom release artifact (#4107)
- (ci) track nearai/benchmarks at main instead of pinning (#4217)
- (ci) grant id-token: write to unblock nearai-bench reusable workflow (#4220)
- (ci) scope id-token: write to the nearai-bench job (#4221)

Release Notes
Added
- (channels) add WeCom channel (#2394)
- (web) support externally-provided tools in Responses API (#3122)
- (gateway) add logs download button (#3588)
- (tui) add Ctrl-S log download from the Logs tab (#3658)
- (engine) add IRONCLAW_DISABLE_CODEACT flag for disabling v2 CodeAct (#3665)
Fixed
- (markdown) avoid converting emphasis inside generated Slack angle links (#3532)
- (web) restore NEAR AI API Key and Fetch Models in configure UI (#3742)
Changed
- (embeddings) extract embeddings into ironclaw_embeddings crate (#3739)
- (deps) bump dependencies to address security advisories (#3719)
- (deps) update Wasmtime to clear cargo-deny advisory (#4028)
CI / Release
- (canary) improve live canary counts, chat-install probe, and strict xfails (#3682)
- (ci) add /benchmark slash-command dispatcher (#3808)
- (ci) grant pull-requests: write for /benchmark reactions endpoint (#3835)
- (ci) post benchmark "started" comment with dispatcher run link (#3836)
Documentation
- (api) document the Responses API end-to-end (#3709)

Release Notes
Fixed
- (extensions) restore chat-driven tool_install + fix double-invoke + auto-approve footgun (#3559)
Changed
- (llm) hide provider-specific auth, model fetch, and embeddings config behind facades (#3416)
Tests
- (e2e) unxfail two auth-matrix tests now that contracts match (#3589)
- (e2e) make Skills lifecycle deterministic (#3309)

Release Notes
Added
- (channels) add pairing_approve tool for Slack binding via chat (#3396)
- (channels) add WeChat registry artifact metadata (#3386)
- (common) describe paths and platform helpers in crate description (#3498)
Fixed
- (web) bug bash — restart modal recovery, approval clarity, http defaults (#3364)
- (bridge) bypass agent-loop mpsc for inline-await Approval gates (#3365)
- (missions) auto-resume paused missions after gate resolution (#3366)
- (workspace) multi-tenant memory isolation (#3374)
- (auth) tighten Telegram pairing UX and OAuth-failure recovery (#3381)
- (web) isolate cross-tenant SSE/WS status events and thread access (#3390)
- (channels) activate WASM channels on headless servers (#3233)
Changed
- (llm) extract multi-provider integration into ironclaw_llm crate (#3387)
CI / Release
- (canary) seed github_token_scopes companion in auth-live-seeded (#3384)
Tests
- (e2e) restore auth and approval coverage (#3430)
- (e2e) avoid REPL auth retry race (#3437)

Release Notes
Added
- (reborn) land the reborn-integration substrate on main, introducing host foundation crates, capability host, runtime dispatcher, process lifecycle, filesystem, secrets, network, and extension manifest registry boundaries
- (reborn) add WIT-compatible WASM tool runtime (#3097)
- (reborn) add host runtime contract facade and services graph (#3095, #3126)
- (reborn) add memory document storage boundary and search/plugin seams (#3078, #3079)
- (reborn) add prompt write safety policy (#3167)
- (reborn) route WASM and MCP HTTP through shared egress (#3123, #3142)
- (reborn) add host-controlled trust-class policy engine (#3043)
- (channels) add WeChat channel (#1666)
- (channels) add multi-tenant relay channel with per-user identity resolution (#3253)
- (llm) enable thinking for Ollama via default additional params (#2372)
Fixed
- (llm) route DeepSeek, Gemini, and OpenRouter through dedicated rig-core clients (#3326)
- (config) keep startup LLM fallback in-memory only (#3324)
- (engine) inline gate await for Tier 0 and Tier 1 Approval gates (#3157)
- (engine,web) suppress restart-recovery noise on Projects tab; retry empty hydration on SSE open (#3328)
- (bridge) coerce engine action params per schema (#3197)
- (bridge) mission_* tools accept name; resolves #2583 (#3155)
- (libsql) parse scientific notation cost aggregates (#3297)
- (reborn) harden capability approval lifecycle (#3111)
- (reborn) harden edge-case contracts and runtime network policy handoff (#3165)
Changed
- (common) clarify crate-level doc wording and align package description (#3370, #3372)
CI / Release
- cut over workflows for main merge queue (#3104)
- build ironclaw docker image with staging tag from main branch (#3301)
- (release) bump cargo-dist to 0.31.0 to fix installer (#3172)
- add deterministic nightly deep checks and full browser suite nightly (#3261, #3262)
- add nightly failure issue alerts (#3293)
Docs
- refresh feature parity against OpenClaw 2026.3.11–2026.4.30 (#3310)
- promote database and configuration pages from drafts to live; fix wrong defaults; expand variable reference
Tests
- (reborn) add phase 1 integration coverage, host runtime vertical gates, and CapabilityHost integration coverage
- (e2e) add dedicated reborn e2e gate and stabilize coverage suite

Release Notes
Added
- (engine-v2) add canonical capability status vocabulary for the v2 runtime contract (#2825)
- (engine-v2) centralize action-vs-capability surface policy across the prompt, runtime, bridge projection, and tool surface (#2827)
- (bridge) project 3 previously dropped engine events into AppEvents for gateway/runtime consumers (#2797)
- (bridge) project 7 additional engine events into AppEvents, expanding runtime event visibility (#2844)
- (debug-panel) expand Activity tab coverage for CodeAct execution, warnings, and richer event display (#2850)
- (missions) redesign the Missions overview surface with richer mission dossiers and project/thread context (#2894)
- (credentials) add path-based credential matching for per-endpoint auth and route the credential scope through WASM tools, HTTP tools, and sandbox proxy policy (#2168)
- (engine) add short-title support for v2 threads so sidebars and thread lists can display concise labels (#2776)
- (tooling) add fork support to the GitHub tool (#2139)
- (canary) add canary reporting for live workflow coverage (#2874)
Fixed
- (auth) prevent OAuth URL parameter truncation in callback and launch flows (#2746)
- (auth) harden error boundaries, TEE secrets, pairing, auth rehydration, and related bug-bash failures (#2753)
- (bridge) surface latent WASM provider actions to the LLM instead of hiding available provider affordances (#2891)
- (bridge) fix restart approval floor handling so restart requests keep the correct permission baseline (#2978)
- (engine) recover flattened tool calls in the v2 adapter path (#2757)
- (engine) stop failed missions from respawning after terminal failure (#2760)
- (engine) enforce real tool use for stop, pause, and cancel commands (#2814)
- (engine) make mission threads_today reset with timezone-aware boundaries (#2989)
- (engine) centralize tool permission defaults to avoid drift between projection and execution paths (#3041)
- (gateway) serve Responses API routes under the /api/v1/ prefix (#2748)
- (gateway) use conversation-only chat sidebar state and remove non-conversation entries from chat history navigation (#2867)
- (gateway) resolve empty "Fetch available models" results for NEAR AI in settings (#2890)
- (gateway) drop plan_update and approval_needed SSE events that do not carry a thread id (#2986)
- (gateway) keep the Routines tab visible after engine v1 to v2 upgrades (#2992)
- (gateway) surface the NEAR AI session token to the configure UI (#3014)
- (llm) shape tool schemas correctly for NEAR AI provider compatibility (#2951)
- (llm/config) harden model provider configuration across web and CLI paths (#2572)
- (tools) fix v2 tool_info action inventory lookup (#2994)
- (tools) make available actions callable-only for providers blocked from executing unavailable tools (#2868)
- (wasm) remove the stale 10M fuel limit from settings databases and align libSQL migrations (#2851)
- (cli) fix -m handling so it does not quit unexpectedly (#2150)
- (release) correct the staged ironclaw version after a bad release metadata state (#2981)
Security
- (document-extraction) prevent zip-bomb denial of service while extracting uploaded documents (#2093)
- (orchestrator) scope orchestrator credentials to the job creator so sandboxed jobs cannot reuse another user's credentials (#2698)
- (safety) add projection-exempt linting for gateway event sources to keep event projection coverage explicit and auditable (#2840)
- (auth/live-canary) tighten auth flows and unify live canary coverage for auth-sensitive runtime paths (#2367)
Changed
- (engine) bump Monty to v0.0.16 and update CodeAct orchestration docs and prompts to match the runtime (#2784)
- (registry) update WASM artifact SHA256 checksums for Feishu, Slack, Telegram, GitHub, and Portfolio artifacts (#2775)
- (registry) bump GitHub tool and Slack channel registry versions after artifact/source updates (#3057)
- (rust) update the documented minimum Rust version to 1.92 (#2931)
CI / Release
- (docker) 

Release Notes
Added
- (engine-v2) add per-project sandbox with mission lifecycle and cost tracking (#2211) (#2660)
- (llm) hot-reload provider chain from settings (#2673)
- (bridge) add workspace-backed project registration and mission result retrieval (#2533) (#2549)
- (engine) require a tool attempt for explicit user commands and add code execution failure categorization (#2539) (#2483)
- (gate) persist "always approve" decisions in the v2 engine path (#2428)
- (memory) add configurable insights interval, session summaries, and reasoning-augmented recall (#2336)
- (gateway) add attachment flows, document uploads, rich history tool cards, debug inspector, and admin tooling UI (#2385) (#2332) (#2477) (#1873) (#1963)
- (tui) support multiline drafting and input handling improvements (#2449) (#2462)
- (skills) add new-project/template resolution, setup-marker lifecycle, working-directory source discovery, and activation feedback pipeline (#2353) (#2268) (#2396) (#2530)
- (portfolio) complete the portfolio tool, widget, and share-gains flow (#2368)
- (cli) add logs --grep, profile list, user-facing temperature setting, and local-profile onboarding prompts (#1533) (#2288) (#2275) (#2389)
- (runtime) default CLI_MODE to TUI and show the commit hash in non-tagged gateway builds (#2329) (#2486)
Fixed
- (gateway) repair web login, onboarding, pairing, and v2 extension auth resume flows; the web API now uses unified onboarding state events instead of the older auth/pairing event split (#2592) (#2594) (#2515) (#2622)
- (gateway) fix disappearing messages, stale in-progress state, assistant-thread routing, approval scoping, reconnect history reloads, browser crashers, and chat refresh issues (#2498) (#2517) (#2444) (#2267) (#2415) (#2441) (#2330)
- (gateway) fix slash autocomplete, attachment rendering, missions navigation, settings search/auth state, active-work pills, tool output timing, and historical/live tool call correlation (#2763) (#2745) (#2518) (#2709) (#2671) (#2555) (#2182)
- (engine) harden the v2 orchestrator, improve action failure handling, preserve paused auth leases, avoid orphaned approval gates, and prevent runaway or no-op mission execution paths (#1958) (#2326) (#2338) (#2458) (#2531) (#2570) (#2631) (#2347) (#2328) (#2460)
- (llm) fix image generation and image-detail handling, normalize NEAR AI tool schemas, surface 413s as context-length errors, and remove duplicate reasoning_content fields (#1819) (#2380) (#1940) (#2463) (#2339) (#2493)
- (security) add inbound secret scanning, redact HTTP credentials in recordings, fail closed on WASM scope fallback, harden approval thread safety, and scan pre-injection channel headers for leaks (#2494) (#2529) (#2465) (#2366) (#1377)
- (channels) fix active WASM channel restore/status tracking plus Slack, Telegram, and Feishu auth/routing edge cases (#2563) (#2562) (#2420) (#2471) (#2512) (#1540) (#2513) (#1943) (#2652) (#2349) (#2443) (#2454)
- (cli/setup) improve auth UX, avoid UTF-8 panics, suppress non-CLI listeners under --cli-only, validate strict MCP server names, install the NEAR AI MCP server from env config, and run migrations during onboarding when DATABASE_URL is preset (#2315) (#2008) (#1869) (#2400) (#2181) (#2309)
- (sandbox/docker) improve Docker and deployment behavior by preferring the Docker socket when available and restoring the staging runtime target for Railway builds (#2467) (#2244)
Other
- (gateway) continue the web gateway slice extraction and boundary cleanup across platform, chat, oauth, settings, jobs, and routines modules (#2628) (#2643) (#2644) (#2645) (#2665) (#2680) (#2683) (#2687) (#2704) (#2706) (#2712) (#2647)
- (types) adopt typed mission, external-thread, event-status, onboarding, and ownership models across the runtime (#2681) (#2685) (#2678) (#2607) (#2677) (#2611) (#2617)
- (ci) add replay snapshot gating, speed up feedback loops, improve cache reuse, validate release versions in Docker workflows, and stabilize staging promotion checks 

Release Notes
Added
- (tools) production-grade coding tools, file history, and skills (#2025)
- add extensible deployment profiles (IRONCLAW_PROFILE) (#2203)
- (skills) commitments system — active intake for personal AI assistant (#1736)
- add native Composio tool for third-party app integrations (#920)
- (gateway) extract gateway frontend into ironclaw_gateway crate with widget system (#1725)
- (railway) build staging target with pre-bundled WASM extensions (#2219)
- (docker) pre-bundle WASM extensions in staging image (#2210)
- (tui) ship TUI in default binary (#2195)
- (admin) admin tool policy to disable tools for users (#2154)
- (web) add scroll-to-bottom arrow in gateway chat (#2202)
- unified tool dispatch + schema-validated workspace (#2049)
- (workspace) admin system prompt shared with all users (#2109)
- (engine) restage skill repair learning loop on staging (#1962)
- (tui) port full-featured Ratatui terminal UI onto staging (#1973)
- (slack) implement on_broadcast and fix message tool hints (#2113)
- (i18n) add Korean translation, fix zh-CN drift, and prevent future drift via pre-commit hook (#2065)
- NEAR AI MCP server (#2009)
- (test) dual-mode live/replay test harness with LLM judge (#2039)
- add AWS Bedrock embeddings provider (#1568)
- (ownership) centralized ownership model with typed identities, DB-backed pairing, and OwnershipCache (#1898)
- (tools) persistent per-user tool permission system (#1911)
- (engine) Unified Thread-Capability-CodeAct execution engine (v2 architecture) (#1557)
- (auth) direct OAuth/social login with Google, GitHub, Apple, and NEAR wallet (#1798)
- Add ACP (Agent Client Protocol) job mode for delegating to any compatible coding agent (#1600)
- (workspace) metadata-driven indexing/hygiene, document versioning, and patch (#1723)
- (jobs) per-job MCP server filtering and max_iterations cap (#1243)
- (config) unify all settings to DB > env > default priority (#1722)
- (telegram) add sendVoice support for audio/ogg attachments (#1314)
- (setup) build ironclaw-worker Docker image in setup wizard (#1757)
Fixed
- (ci) bump 5 channel versions + fix lifetime desync in panics check (#2300)
- (test) case-insensitive hint matching in TraceLlm step_matches (#2292)
- (v2) tool naming, auth gates, schema flatten, WASM traps, workspace race (#2209)
- (ci) resolve 4 staging test failures (#2273)
- (docker) copy profiles/ into build stages (#2289)
- (engine) mission cron scheduling + timezone propagation (#1944) (#1957)
- (oauth) use localhost for redirect URI when bound to 0.0.0.0 (#2247)
- (bridge) sanitize auth_url on engine v2 path (#2206) (#2215)
- (docs) explain in more details activation block & installation steps for skills (#2216)
- (docker) consume CACHE_BUST arg so BuildKit invalidates cache
- (gateway) suppress duplicate text response during auth flow and unify extension config modal (#2172)
- (agent) stop intercepting bare yes/no/always as approval when nothing pending (#2178)
- (ci) resolve 3 staging test failures (#2207)
- (wasm) upgrade Wasmtime to 43.0.1 and restore CI (#2224)
- fix(auth) first-pass Gmail OAuth auth prompt in chat (#2038)
- (db) repair V6 migration checksum and guard against re-modification (#1328) (#2101)
- (ci) target wasm32-wasip2 in WASM build script (#2175)
- (test) use canonical extension name in setup submit test (#2158)
- fix (skills) installs for invalid catalog names (#2040)
- universal engine-version tool visibility filtering (#2132)
- (ownership) remove silent cross-tenant credential fallback (#2099)
- (e2e) canonicalize extension names + fix remaining test failures (#2129)
- (ownership) unify ownership checks via Owned trait and fix mission visibility bug (#2126)
- (web) intercept approval text input in chat (#2124)
- (staging) repair 4 categories of CI test failures (#2091)
- (web) emit Done after response — SSE ordering fix (#2079) (#2104)
- (tools) gate claude_code and acp modes behind enabled flags (#2003)
- (acp) propagate follow-up prompt failures as

Release Notes
Added
- (gateway) OIDC JWT authentication for reverse-proxy deployments (#1463)
- support custom LLM provider configuration via web UI (#1340)
- (skills) recursive bundle directory scanning for skill discovery (#1667)
- (discord) add gateway channel flow in wasm (#944)
- DB-backed user management, admin secrets provisioning, and multi-tenant isolation (#1626)
- (gateway) add OpenAI Responses API endpoints (#1656)
Fixed
- (routines) clone Arc before await in web handler event cache refresh (#1756)
- (slack) respond to thread replies without requiring @mention (#1405)
- resolve 11 test failures from multi-tenant bootstrap and sandbox gate regressions (#1746)
- (auth) make shared Google tool status scope-aware (#1532)
- (wasm) inject Content-Length: 0 for bodyless mutating HTTP requests (#1529)
- (bedrock) strip tool blocks from messages when toolConfig is absent (#1630)
- prevent UTF-8 panics in byte-index string truncation (#1688)
- (gemini) preserve thought signatures on all tool calls (#1565)
- pin staging ci jobs to a single tested sha (#1628)
- (routines) complete full_job execution reliability overhaul (#1650)
- (worker) treat empty LLM response after text output as completion (#1677)
- (worker) replace script -qfc with pty-process for injection-safe PTY (#1678)
- (web) redact database error details from API responses (#1711)
- (oauth) tighten legacy state validation and fallback handling (#1701)
- (db) add tracing warn for naive timestamp fallback and improve parse_timestamp tests (#1700)
- (wasm) use typed WASM schema as advertised schema when available (#1699)
- sanitize tool error results before llm injection (#1639)
- require Feishu webhook authentication (#1638)
- (llm) prevent UTF-8 panic in line_bounds() (fixes #1669) (#1679)
- downgrade excessive debug logging in hot path (closes #1686) (#1694)
Other
- Stabilize MCP refresh regression tests (#1772)
- Fix hosted MCP OAuth refresh flow (#1767)
- Track routine verification state across updates (#1716)
- (e2e) align WASM reinstall expectation with uninstall cleanup (#1762)
- Handle empty tool completions in autonomous jobs (#1720)
- Clarify message tool vs channel setup guidance (#1715)
- tighten contribution and PR guidance (#1704)
- Clean up extension credentials on uninstall (#1718)

Release Notes
Added
- complete multi-tenant isolation — phases 2–4 (#1614)
Fixed
- (routines) recover delete name after failed update fallback (#1108)
- (mcp) handle 202 Accepted and wire session manager for Streamable HTTP (#1437)
- (extensions) channel-relay auth dead-end, observability, and URL override (#1681)
- (agent) discard truncated tool calls when finish_reason == Length (#1631) (#1632)
- (llm) filter XML tool-call recovery by context (#1641)
Other
- Support direct hosted OAuth callbacks with proxy auth token (#1684)

Release Notes
Added
- (agent) thread per-tool reasoning through provider, session, and all surfaces (#1513)
- (cli) show credential auth status in tool info (#1572)
- multi-tenant auth with per-user workspace isolation (#1118)
- (cli) add ironclaw models subcommands (list/status/set/set-provider) (#1043)
- (workspace) multi-scope workspace reads (#1117)
- (ux) complete UX overhaul — design system, onboarding, web polish (#1277)
- (gemini_oauth) full Gemini CLI OAuth integration with Cloud Code API (#1356)
- (shell) add Low/Medium/High risk levels for graduated command approval (closes #172) (#368)
- (agent) queue and merge messages during active turns (#1412)
- (cli) add ironclaw hooks list subcommand (#1023)
- (extensions) support text setup fields in web configure modal (#496)
- (llm) add GitHub Copilot as LLM provider (#1512)
- (workspace) layered memory with sensitivity-based privacy redirect (#1112)
- (webhooks) add public webhook trigger endpoint for routines (#736)
- (llm) Add OpenAI Codex (ChatGPT subscription) as LLM provider (#1461)
- (web) add light theme with dark/light/system toggle (#1457)
- (agent) activate stuck_threshold for time-based stuck job detection (#1234)
- chat onboarding and routine advisor (#927)
Fixed
- ensure LLM calls always end with user message (closes #763) (#1259)
- restore owner-scoped gateway startup (#1625)
- remove stale stream_token gate from channel-relay activation (#1623)
- (agent) case-insensitive channel match and user_id filter for event triggers (#1211)
- (routines) normalize status display across web and CLI (#1469)
- (tunnel) managed tunnels target wrong port and die from SIGPIPE (#1093)
- (agent) persist /model selection to .env, TOML, and DB (#1581)
- post-merge review sweep — 8 fixes across security, perf, and correctness (#1550)
- generate Mistral-compatible 9-char alphanumeric tool call IDs (#1242)
- (mcp) handle empty 202 notification acknowledgements (#1539)
- (tests) eliminate env mutex poison cascade (#1558)
- (safety) escape tool output XML content and remove misleading sanitized attr (#1067)
- (oauth) reject malformed ic2.* states in decode_hosted_oauth_state (#1441) (#1454)
- parameter coercion and validation for oneOf/anyOf/allOf schemas (#1397)
- persist startup-loaded MCP clients in ExtensionManager (#1509)
- (deps) patch rustls-webpki vulnerability (RUSTSEC-2026-0049)
- (routines) add missing extension_manager field in trigger_manual EngineContext
- (ci) serialize env-mutating OAuth wildcard tests with ENV_MUTEX (#1280) (#1468)
- (setup) remove redundant LLM config and API keys from bootstrap .env (#1448)
- resolve wasm broadcast merge conflicts with staging (#395) (#1460)
- skip credential validation for Bedrock backend (#1011)
- register sandbox jobs in ContextManager for query tool visibility (#1426)
- prefer execution-local message routing metadata (#1449)
- (security) validate embedding base URLs to prevent SSRF (#1221)
- f32→f64 precision artifact in temperature causes provider 400 errors (#1450)
- (routines) surface errors when sandbox unavailable for full_job routines (#769)
- restore libSQL vector search with dynamic dimensions (#1393)
- staging CI triage — consolidate retry parsing, fix flaky tests, add docs (#1427)
Other
- Merge branch 'main' into staging-promote/455f543b-23329172268
- Merge pull request #1655 from nearai/codex/fix-staging-promotion-1451-version-bumps
- Merge pull request #1499 from nearai/staging-promote/9603fefd-23364438978
- Fix libsql prompt scope regressions (#1651)
- Normalize cron schedules on routine create (#1648)
- Fix MCP lifecycle trace user scope (#1646)
- Fix REPL single-message hang and cap CI test duration (#1643)
- extract AppEvent to crates/ironclaw_common (#1615)
- Fix hosted OAuth refresh via proxy (#1602)
- (agent) optimize approval thread resolution (UUID parsing + lock contention) (#1592)
- (tools) auto-compact WASM tool schemas, add descriptions, improve credential prompts (#1525)
- Default new lightweight routi

Release Notes
Added
- structured fallback deliverables for failed/stuck jobs (#236)
- LRU embedding cache for workspace search (#1423)
- receive relay events via webhook callbacks (#1254)
Fixed
- bump Feishu channel version for promotion
- (approval) make "always" auto-approve work for credentialed HTTP requests (#1257)
- skip NEAR AI session check when backend is not nearai (#1413)
Other
- Make hosted OAuth and MCP auth generic (#1375)

Release Notes
Added
- (self-repair) wire stuck_threshold, store, and builder (#712)
- (testing) add FaultInjector framework for StubLlm (#1233)
- (gateway) unified settings page with subtabs (#1191)
- upgrade MiniMax default model to M2.7 (#1357)
Fixed
- navigate telegram E2E tests to channels subtab (#1408)
- add missing builder field and update E2E extensions tab navigation (#1400)
- remove debug_assert guards that panic on valid error paths (#1385)
- address valid review comments from PR #1359 (#1380)
- full_job routine runs stay running until linked job completion (#1374)
- full_job routine concurrency tracks linked job lifetime (#1372)
- remove -x from coverage pytest to prevent suite-blocking failures (#1360)
- add debug_assert invariant guards to critical code paths (#1312)
- (mcp) retry after missing session id errors (#1355)
- (telegram) preserve polling after secret-blocked updates (#1353)
- (llm) cap retry-after delays (#1351)
- (setup) remove nonexistent webhook secret command hint (#1349)
- Rate limiter returns retry after None instead of a duration (#1269)
Other
- bump telegram channel version to 0.2.5 (#1410)
- (ci) enforce test requirement for state machine and resilience changes (#1230) (#1304)
- Fix duplicate LLM responses for matched event routines (#1275)
- add Japanese README (#1306)
- (ci) add coverage gates via codecov.yml (#1228) (#1291)
- Redesign routine create requests for LLMs (#1147)

Release Notes
Added
- verify telegram owner during hot activation (#1157)
- (config) unify config resolution with Settings fallback (Phase 2, #1119) (#1203)
- (sandbox) add retry logic for transient container failures (#1232)
- (heartbeat) fire_at time-of-day scheduling with IANA timezone (#1029)
- Reuse Codex CLI OAuth tokens for ChatGPT backend LLM calls (#693)
- add pre-push git hook with delta lint mode (#833)
- (cli) add logs command for gateway log access (#1105)
- add Feishu/Lark WASM channel plugin (#1110)
- add Criterion benchmarks for safety layer hot paths (#836)
- (routines) human-readable cron schedule summaries in web UI (#1154)
- (web) add follow-up suggestion chips and ghost text (#1156)
- (ci) include commit history in staging promotion PRs (#952)
- (tools) add reusable sensitive JSON redaction helper (#457)
- configurable hybrid search fusion strategy (#234)
- (cli) add cron subcommand for managing scheduled routines (#1017)
- adds context-llm tool support (#616)
- (web-chat) add hover copy button for user/assistant messages (#948)
- add Slack approval buttons for tool execution in DMs (#796)
- enhance HTTP tool parameter parsing (#911)
- (routines) enable tool access in lightweight routine execution (#257) (#730)
- add MiniMax as a built-in LLM provider (#940)
- (cli) add ironclaw channels list subcommand (#933)
- (cli) add ironclaw skills list/search/info subcommands (#918)
- add cargo-deny for supply chain safety (#834)
- (setup) display ASCII art banner during onboarding (#851)
- (extensions) unify auth and configure into single entrypoint (#677)
- (i18n) Add internationalization support with Chinese and English translations (#929)
- Import OpenClaw memory, history and settings (#903)
Fixed
- jobs limit (#1274)
- misleading UI message (#1265)
- bump channel registry versions for promotion (#1264)
- cover staging CI all-features and routine batch regressions (#1256)
- resolve merge conflict fallout and missing config fields
- web/CLI routine mutations do not refresh live event trigger cache (#1255)
- (jobs) make completed->completed transition idempotent to prevent race errors (#1068)
- (llm) persist refreshed Anthropic OAuth token after Keychain re-read (#1213)
- (worker) prevent orphaned tool_results and fix parallel merging (#1069)
- Telegram bot token validation fails intermittently (HTTP 404) (#1166)
- (security) prevent metadata spoofing of internal job monitor flag (#1195)
- (security) default webhook server to loopback when tunnel is configured (#1194)
- (auth) avoid false success and block chat during pending auth (#1111)
- (config) unify ChannelsConfig resolution to env > settings > default (#1124)
- (web-chat) normalize chat copy to plain text (#1114)
- (skill) treat empty url param as absent when installing skills (#1128)
- preserve AuthError type in oauth_http_client cache (#1152)
- (web) prevent Safari IME composition Enter from sending message (#1140)
- (mcp) handle 400 auth errors, clear auth mode after OAuth, trim tokens (#1158)
- eliminate panic paths in production code (#1184)
- N+1 query pattern in event trigger loop (routine_engine) (#1163)
- (llm) add stop_sequences parity for tool completions (#1170)
- (channels) use live owner binding during wasm hot activation (#1171)
- Non-transactional multi-step context updates between metadata/to… (#1161)
- (webhook) avoid lock-held awaits in server lifecycle paths (#1168)
- Google Sheets returns 403 PERMISSION_DENIED after completing OAuth (#1164)
- HTTP webhook secret transmitted in request body rather than via header, docs inconsistency and security concern (#1162)
- (ci) exclude ironclaw_safety from release automation (#1146)
- (registry) bump versions for github, web-search, and discord extensions (#1106)
- (mcp) address 14 audit findings across MCP module (#1094)
- (http) replace .expect() with match in webhook handler (#1133)
- (time) treat empty timezone string as absent (#1127)
- 5 critical/high-priority bugs (auth bypass, relay failur

Release Notes
Other
- Merge pull request #907 from nearai/staging-promote/b0214fef-22930316561
- promote staging to main (2026-03-10 15:19 UTC) (#865)
- Merge pull request #830 from nearai/staging-promote/3a2989d0-22888378864
- update WASM artifact SHA256 checksums [skip ci] (#876)

Release Notes
Added
- (llm) per-provider unsupported parameter filtering (#749, #728) (#809)
- persist user_id in save_job and expose job_id on routine runs (#709)
- (ci) chained promotion PRs with multi-agent Claude review (#776)
- add background sandbox reaper for orphaned Docker containers (#634)
- (wasm) lazy schema injection on WASM tool errors (#638)
- add AWS Bedrock LLM provider via native Converse API (#713)
- full image support across all channels (#725)
- (skills) exclude_keywords veto in skill activation scoring (#688)
- (mcp) transport abstraction, stdio/UDS transports, and OAuth fixes (#721)
- add PID-based gateway lock to prevent multiple instances (#717)
- configurable LLM request timeout via LLM_REQUEST_TIMEOUT_SECS (#615) (#630)
- (timezone) add timezone-aware session context (#671)
- (setup) Anthropic OAuth onboarding with setup-token support (#384)
- (llm) add Google Gemini, AWS Bedrock, io.net, Mistral, Yandex, and Cloudflare WS AI providers (#676)
- unified thread model for web gateway (#607)
- WASM channel attachments with LLM pipeline integration (#596)
- enable Anthropic prompt caching via automatic cache_control injection (#660)
- (routines) approval context for autonomous job execution (#577)
- (llm) declarative provider registry (#618)
- (gateway) show IronClaw version in status popover [skip-regression-check] (#636)
- Wire memory hygiene retention policy into heartbeat loop (#629)
Fixed
- (ci) run fmt + clippy on staging PRs, skip Windows clippy [skip-regression-check] (#802)
- (ci) clean up staging pipeline — remove hacks, skip redundant checks [skip-regression-check] (#794)
- (ci) secrets can't be used in step if conditions [skip-regression-check] (#787)
- prevent irreversible context loss when compaction archive write fails (#754)
- button styles (#637)
- (mcp) JSON-RPC spec compliance — flexible id, correct notification format (#685)
- preserve tool-call history across thread hydration (#568) (#670)
- CLI commands ignore runtime DATABASE_BACKEND when both features compiled (#740)
- (web) prevent fetch error when hostname is an IP address in TEE check (#672)
- add timezone conversion support to time tool (#687)
- standardize libSQL timestamps as RFC 3339 UTC (#683)
- (docker) bind postgres to localhost only (#686)
- (repl) skip /quit on EOF when stdin is not a TTY (#724)
- (web) prevent Enter key from sending message during IME composition (#715)
- (config) init_secrets no longer overwrites entire config (#726)
- (cli) status command ignores config.toml and settings.json (#354) (#734)
- (setup) preserve model name when re-running onboarding with same provider (#600) (#694)
- (setup) initialize secrets crypto for env-var security option (#666) (#706)
- persist /model selection across restarts (#707)
- (routines) resolve message tool channel/target from per-job metadata (#708)
- sanitize HTML error bodies from MCP servers to prevent web UI white screen (#263) (#656)
- prevent Instant duration overflow on Windows (#657) (#664)
- enable libsql remote + tls features for Turso cloud sync (#587)
- (tests) replace hardcoded /tmp paths with tempdir + add 300 unit tests (#659)
- (llm) nudge LLM when it expresses tool intent without calling tools (#653)
- (llm) report zero cost for OpenRouter free-tier models (#463) (#613)
- reliable network tests and improved tool error messages (#626)
- (wasm) use per-engine cache dirs on Windows to avoid file lock error (#624)
- (libsql) support flexible embedding dimensions (#534)
Other
- Restructure CLAUDE.md into modular rules + add pr-shepherd command (#750)
- make src/llm/ self-contained for crate extraction (#767)
- add simplified Chinese (zh-CN) README translation (#488)
- (job) cover job tool validation and state transitions (#681)
- (agent) wire TestRig job tools through the scheduler (#716)
- Fix single-message mode to exit after one turn when background channels are enabled (#719)
- remove dead code (#648) (#703)
- add reviewer-feedback guardrails (CLAUDE.md,

Release Notes
Fixed
- revert WASM artifact SHA256 checksums to null (#627)

Release Notes
Added
- (e2e) extensions tab tests, CI parallelization, and 3 production bug fixes (#584)
- WASM extension versioning with WIT compat checks (#592)
- Add HMAC-SHA256 webhook signature validation for Slack (#588)
- restart (#531)
- merge http/web_fetch tools, add tool output stash for large responses (#578)
- integrate 13-dimension complexity scorer into smart routing (#529)
Fixed
- (llm) fix reasoning model response parsing bugs (#564) (#580)
- (ci) fix three coverage workflow failures (#597)
- Telegram channel accepts group messages from all users if owner_… (#590)
- (ci) anchor coverage/ gitignore rule to repo root (#591)
- (security) use OsRng for all security-critical key and token generation (#519)
- prevent concurrent memory hygiene passes and Windows file lock errors (#535)
- sort tool_definitions() for deterministic LLM tool ordering (#582)
- (ci) persist all cargo-llvm-cov env vars for E2E coverage (#559)
Other
- (llm) complete response cache — set_model invalidation, stats logging, sync mutex (#290)
- add 29 E2E trace tests for issues #571-575 (#593)
- add 26 tests for multi-thread safety, db CRUD, concurrency, errors (#442)
- update WASM artifact SHA256 checksums [skip ci] (#560)
- add WIT compatibility tests for WASM extensions (#586)
- Trajectory benchmarks and e2e trace test rig (#553)

Release Notes
Added
- (oauth) route callbacks through web gateway for hosted instances (#555)
- (web) show error details for failed tool calls (#490)
- (extensions) improve auth UX and add load-time validation (#536)
- add local-test skill and Dockerfile.test for web gateway testing (#524)
Fixed
- (security) restrict query-token auth to SSE endpoints only (#528)
- (ci) flush profraw coverage data in E2E teardown (#550)
- (wasm) coerce string parameters to schema-declared types (#498)
- (agent) strip leaked [Called tool ...] text from responses (#497)
- (web) reset job list UI on restart failure (#499)
- (security) replace .unwrap() panics in pairing store with proper error handling (#515)
Other
- Fix UTF-8 unsafe truncation in sandbox log capture (#359)
- enhance coverage with feature matrix, postgres, and E2E (#523)

Release Notes
Added
- add Brave Web Search WASM tool (#474)
Fixed
- (web) auto-scroll and Enter key completion for slash command autocomplete (#475)
- correct download URLs for telegram-mtproto and slack-tool extensions (#470)

Release Notes
Added
- (cli) add tool setup command + GitHub setup schema (#438)
- add web_fetch built-in tool (#435)
- (web) DB-backed Jobs tab + scheduler-dispatched local jobs (#436)
- (extensions) add OAuth setup UI for WASM tools + display name labels (#437)
- (bootstrap) auto-detect libsql when ironclaw.db exists (#399)
- (web) slash command autocomplete + /status /list + fix chat input locking (#404)
- (routines) deliver notifications to all installed channels (#398)
- (web) persist tool calls, restore approvals on thread switch, and UI fixes (#382)
- add IRONCLAW_BASE_DIR env var with LazyLock caching (#397)
- feat(signal) attachment upload + message tool (#375)
Fixed
- (channels) add host-based credential injection to WASM channel wrapper (#421)
- pre-validate Cloudflare tunnel token by spawning cloudflared (#446)
- batch of quick fixes (#417, #338, #330, #358, #419, #344) (#428)
- persist channel activation state across restarts (#432)
- init WASM runtime eagerly regardless of tools directory existence (#401)
- add TLS support for PostgreSQL connections (#363) (#427)
- scan inbound messages for leaked secrets (#433)
- use tailscale funnel --bg for proper tunnel setup (#430)
- normalize secret names to lowercase for case-insensitive matching (#413) (#431)
- persist model name to .env so dotted names survive restart (#426)
- (setup) check cloudflared binary and validate tunnel token (#424)
- (setup) validate PostgreSQL version and pgvector availability before migrations (#423)
- guard zsh compdef call to prevent error before compinit (#422)
- (telegram) remove restart button, validate token on setup (#434)
- web UI routines tab shows all routines regardless of creating channel (#391)
- Discord Ed25519 signature verification and capabilities header alias (#148) (#372)
- prevent duplicate WASM channel activation on startup (#390)
Other
- rename WasmBuildable::repo_url to source_dir (#445)
- Improve --help: add detailed about/examples/color, snapshot test (clo… (#371)
- Add automated QA: schema validator, CI matrix, Docker build, and P1 test coverage (#353)

Added
- (web) improve WASM channel setup flow (#380)
- (web) inline tool activity cards with auto-collapsing (#376)
- (web) display logs newest-first in web gateway UI (#369)
- (signal) tool approval workflow and status updates (#350)
- add OpenRouter preset to setup wizard (#270)
- (channels) add native Signal channel via signal-cli HTTP daemon (#271)
Fixed
- correct MCP registry URLs and remove non-existent Google endpoints (#370)
- resolve_thread adopts existing session threads by UUID (#377)
- resolve telegram/slack name collision between tool and channel registries (#346)
- make onboarding installs prefer release artifacts with source fallback (#323)
- copy missing files in Dockerfile to fix build (#322)
- fall back to build-from-source when extension download fails (#312)
Other
- Add --version flag with clap built-in support and test (#342)
- Update FEATURE_PARITY.md (#337)
- add brew install ironclaw instructions (#310)
- Fix skills system: enable by default, fix registry and install (#300)