Shkarko ClawWork 0.0.13

🔥 Highlights
- 📱 ClawWork on your phone — Brand-new PWA mobile companion with a native chat experience, swipe gestures, and seamless QR pairing that keeps your desktop connected.
- 🐧 Linux support — First-class Linux builds ship starting this release — AppImage and deb for x64.
- ✨ Visual refresh — Glass panels, glow accents, and ambient gradients give the entire app a polished new look while respecting reduced-motion preferences.
- 🔒 Security hardening — Four fixes close a private key leak, an SSRF bypass, a TOCTOU race, and a path traversal vector in the artifact handler.
✨ What's New
- 📱 PWA mobile companion — Brand-new mobile web app with native iOS chat experience: OLED dark theme, edge-swipe gestures, drag-to-dismiss bottom sheets, settings panel with 8-language selector, and QR pairing with independent device identity — your desktop stays connected when a phone joins. by @samzong in #183
- 🎨 Premium design system — Glass surfaces, 3-layer glow effects, ambient gradient orbs, display typography (Instrument Serif), extended motion presets, and CI enforcement rules. All with dark + light theme coverage, prefers-reduced-motion respect, and @supports fallbacks. by @samzong in #200 #201
- 🐧 Linux desktop builds — AppImage (portable) and deb (Ubuntu/Debian) packages for x64, fully integrated into the CI/CD release pipeline. by @samzong in #174
🔒 Security
- Removed private key exposure and raw IPC backdoor from the renderer preload bridge — neither surface had any renderer consumers by @samzong in #184
- Production-grade SSRF guard with numeric IPv4/IPv6 range checks and DNS pre-resolution, replacing the string-prefix check that missed all RFC 1918 ranges by @samzong in #189
- Eliminated TOCTOU race in context file path validation by merging validate + read into a single fd-centric atomic operation by @samzong in #185
- Fixed path traversal vector in artifact handler — replaced naive url.replace('file://', '') with fileURLToPath() by @samzong in #194
🐛 Bug Fixes
- Fixed macOS crash on dock re-open — IPC handlers registered inside createWindow() threw on second invocation; centralized window lifecycle via window-manager module by @samzong in #195
- Fixed PWA status bar color not updating when switching between dark and light themes by @samzong in #192
- Fixed invisible text in Gateway debug log caused by undefined --text-tertiary CSS variable by @samzong in #193
- Fixed per-token forced reflow during streaming — replaced scrollToBottom on every token with ResizeObserver; fixed Virtuoso dual scroll context by @samzong in #196
- Fixed PWA client version stuck at hardcoded 0.1.0 — now injected from package.json at build time by @samzong in #191
- Fixed PWA i18n gaps — en.json is now the authoritative superset, all defaultValue anti-patterns eliminated, Gateway debug log fully translated across 8 languages by @samzong in #199
🔧 Engineering
- Extracted @clawwork/core package with port-based dependency injection — stores, session sync, gateway dispatching, and protocol parsing are now platform-agnostic, enabling future PWA code sharing by @samzong in #178
- Extracted chat composer service into @clawwork/core — split the 1655-line ChatInput.tsx god component into 9 focused modules by @samzong in #180
- Added knip for dead code detection, removed 52 dead code items, added Renovate for automated dependency updates and vitest coverage by @samzong in #176
- Extracted BottomSheet primitive from 3 PWA components, fixing 3 accessibility bugs and adding body scroll lock by @samzong in #186
- Extracted useOverlay hook — unified portal rendering, ref-counted scroll lock, inert support, and prefers-reduced-motion for all overlays by @samzong in #198
- Extracted useFocusTrap hook from DrawerLayout and AgentSelector by @samzong in #190
- Extracted client registry and eliminated composerBridge monkey-patching hack by @samzong in #188
- Replaced manual base64 encode/decode with ES2025 Uint8Array.toBase64() platform API by @samzong in #197
- PWA polish: removed type lies (! non-null assertions), dead tsconfig paths, added IndexedDB migration guard, reduced edge-swipe dead zone by @samzong in #187
📖 Docs
- Keynote: full 8-language translations and dark/light theme toggle by @samzong in #182
- Keynote slide polish and toolchain integration focus by @samzong in #179
- Fixed SPA fallback for GitHub Pages keynote routes by @samzong in #175