zeroclaw

ZeroClaw v0.8.6

ZeroClaw v0.8.6 is a plugin, identity, and runtime-ownership release spanning 573 commits from 74 contributors. The seven 64-bit CLI release archives now carry the WebAssembly plugin host, and the plugin registry offers channel and tool packages built for this release. It also adds authenticated principals with OIDC across RPC and the gateway, moves live configuration, events, and agent lifecycle under the daemon, and adds an opt-in minimal built-in tool set while full stays the default. Several security tightenings change defaults; review Breaking Changes before upgrading gateway pairing integrations, remote ZeroCode connections, browser automation, private-network downloads, or plugins built against an earlier WIT, and read Known issues before relying on a plugin channel.

In brief

Plugins now run in the release CLI: install Discord, Telegram, Matrix and ten more by name.

Plus groundwork for OIDC sign-in, multi-session ZeroCode, daemon-owned live config, and new providers and web search.

Highlights

• Plugins work from a stock CLI download: install a channel or tool plugin by name, with no Rust toolchain. The seven 64-bit CLI archives for Linux, macOS and Windows carry the WebAssembly plugin host, and each one is smoke-tested with a real plugin before publication. The registry offers 13 packages built for this release: the Discord, Matrix, Telegram, Bluesky, Gitea, Mattermost, Mochat, Notion, Reddit, X (Twitter), WeChat and WeCom channels, and the redact-text tool. Discord passed an end-to-end acceptance run from release-candidate CLI archives on Linux, Windows and macOS. Installs grant egress up front, check that the plugin loads, bind channel instances, and recover after an interruption; updates are verified and staged (#11347, #10999, #11262, #11261, #11236, #11309, #11302, #11098, #10746).
• Tool selection: Full stays the default; minimal is an opt-in [tools] setting. Set optional = [] for minimal: eleven built-ins in Chat and eight in Code/ACP, or name extras to add to it. Setup and config generation write optional = ["*"], and configs without [tools] or optional load full. Existing explicit selections are preserved. Prerequisites, permissions, approvals and Code/ACP memory exclusions still apply.
• Authenticated principals reach every entry point: RPC, sessions, tools, and memory resolve to canonical principals. oidc.<alias> verifies tokens with device, client-credentials, and browser enrollment; pairing codes are stronger by default, and reading or minting them needs an owner-only admin token (#11082, #10248, #10259, #10263, #10265, #10255, #10307, #11177).
• The daemon owns live state: atomic live config revisions, one event firehose, and coordinated agent lifecycle. Configuration publishes atomic revisions with batch writes and reports whether each running target applied a change; the observer event firehose and a bounded, replayable subscription hub live in the daemon; and agent lifecycle, background delegates, and cost ceilings are coordinated in one place (#10911, #10823, #11466, #11131, #11167, #10621, #11292, #10804).
• Chat surfaces and providers expand: multi-session ZeroCode, new channel delivery modes, two providers, three web search backends. ZeroCode gains multi-session panes, a combined Sessions/Queue/Plan dock, and standard composer editing; Telegram, Matrix, WhatsApp Web, Mattermost, Slack, and QQ gain new delivery modes; Crusoe and Hailo-Ollama become providers; and Serply, AnySearch, and Keenable join web search (#9739, #10879, #11175, #8561, #10489, #10984, #10358, #10622, #10799, #9338, #9109, #10402, #10356, #10679).

What's New

Plugins

• Ship the WASM plugin host with Cranelift in the seven 64-bit CLI release archives for Linux, macOS and Windows, gate publication on a per-archive plugin smoke test, and raise the release binary size cap f

ZeroClaw v0.8.5

ZeroClaw v0.8.5 is a security, connectivity, and operator-experience release spanning 454 commits from 73 contributors. It introduces ZeroRelay and ZeroRouter, expands live chat and provider capabilities, hardens plugin, sandbox, webhook, credential, and file boundaries, and makes cross-platform builds and coordinated crate publication more reproducible. This release also removes or narrows several deprecated surfaces; review Breaking Changes before upgrading plugins, skills, legacy node integrations, WATI deployments, TodoWrite configuration, or contributor tooling.

Highlights

• ZeroRelay and ZeroRouter arrive together: ZeroRelay provides blind forwarding with native mTLS enrollment, while ZeroRouter adds a first-class hosted routing preset and public model catalog (#10142, #9645, #10453).
• Chat becomes more capable: the dashboard can keep several conversations open per agent, open the same agent in multiple tabs, and attach or drop images through the new upload path (#9353, #9355, #10544).
• Provider support expands: Anthropic gains opt-in live thinking display, Grok Build ACP and Atlas Cloud become first-class providers, and compatible providers gain stronger response, attribution, image, proxy, and retry handling (#10542, #9104, #9200, #9404, #9974, #10448).
• Plugin and skill boundaries get substantially tighter: typed instance configuration, scoped secrets, host-owned egress, bounded exports, path-traversal protection, and fail-closed skill HTTP execution now cover the main package and network trust boundaries (#9126, #9128, #9137, #9403, #9582, #10369, GHSA-93f6-34w8-5g98).
• Operator feedback improves across surfaces: Matrix, Telegram, Slack, WhatsApp Web, SOP, MCP, logs, queued messages, and clipboard flows expose clearer progress and recovery behavior (#8443, #9822, #8985, #9385, #9476, #9196, #10057, #10096).
• Release portability improves: routine builders move to Rust 1.98 while source compatibility remains at Rust 1.96, release tools use pinned binaries, MUSL and Alpine coverage expands, and the coordinated 23-crate workspace gains protected crates.io publication (#9527, #10122, #10174, #9286, #9514, #10158).

What's New

ZeroRelay, Routing, and Providers

• Add ZeroRelay secure transport with blind forwarding, native mTLS enrollment, bounded admission, and per-node routing (#10142).
• Add the ZeroRouter provider preset and public catalog, then point new defaults at the hosted beta deployment (#9645, #10453).
• Add Anthropic thinking.display support so eligible models can stream readable thinking updates while retaining signed reasoning only for replay (#10542).
• Add Grok Build ACP and Atlas Cloud providers, accept data-wrapped compatible responses, and centralize provider endpoint metadata (#9104, #9200, #9404, #9747).
• Preserve OpenRouter attribution and streaming metadata, model context during Gemini requests, compatible tool-result image policy, and accurate served-model and lifecycle accounting (#9974, #9782, #10435, #10448, #10027, #10144).
• Improve terminal provider errors, model-list bounds, OAuth refresh behavior, proxy handling, and reasoning-tool fallback classification; retry replay-safe empty streams once and evict compatible-provider images individually (#10234, #10314, #10012, #9606, #9400, #10211, #10602, #10564).

Dashboard, ZeroCode, and RPC

• Hold several independent conversations per agent, allow the same agent to remain open in multiple chat tabs, and add session-local Todo close control (#9353, #9355, #10584).
• Add image upload plus dashboard attach/drop UI through a bounded gateway endpoint (#10544).
• Add queued-message recovery, transcript copy actions, selectable log text, text-editor cursor navigation, and Option-Backspace word deletion (#10057, #9994, #10096, #9287, #10078).
• Add read-only SOP status and run views with live icons, authenticated cancellation, and responsive background refres

ZeroClaw v0.8.4

ZeroClaw v0.8.4 is a maintenance and hardening release spanning 262 commits from 49 contributors. It expands the memory and SOP control planes, improves provider and channel reliability, strengthens sandbox and credential boundaries, and makes the desktop and release pipeline more dependable. This release also includes upgrade-sensitive changes for skill sources, Nextcloud Talk, and generic webhook authentication; review Breaking Changes before upgrading those integrations.

Highlights

• Memory controls add opt-in retrieval caching, reranking, typed-fact extraction, migration-aware configuration checks, content scanning, and auditable recall paths.
• SOP execution gains per-SOP admission policies, quorum-based approval brokering, checkpoint editing, centralized fan-in adapters, and stronger deterministic gate handling.
• Operator surfaces add dashboard-driven upgrades, channel relinking, agent renaming, runtime-context display, searchable keybinding help, and a more reliable terminal experience.
• Channels and ACP gain Mattermost WebSocket listening, Telegram debounce, interactive reply events, signed Nextcloud Talk replies, agent-selectable ACP sessions, and cited blob delivery.
• Provider and runtime reliability improves OpenAI Responses setup, model context-window metadata, fallback visibility, streamed retries, multimodal fallback, lifecycle preservation, and whole-turn history trimming.
• Release integrity adds a self-contained notarized macOS desktop path, repaired Scoop and AUR publication workflows, consolidated attestations, required SBOMs, checksums, and an offline verification archive.

What's New

Memory and Retrieval

• Add opt-in retrieval caching, a gated rerank stage, typed memory classification and fact extraction, configuration validation, migration reindex hooks, and content scanning at write and recall boundaries (#8897, #8895, #8900, #8899, #8984).
• Add gated memory audit trails and restore semantic recall of durable global memories across sessions (#8893, #8898).
• Improve Lucid process control with configurable timeouts and more reliable ARM startup handling (#9105).

SOP and Automation

• Add per-SOP admission policy, release execution slots while awaiting human approval, and broker approvals through group membership and quorum (#8848, #8880).
• Add checkpoint editing and revision for deterministic gate prompts, then centralize fan-in ingress adapters (#8979, #9205).
• Improve conditional steps, AMQP ingress, nested policy handling, structured output, and deterministic approval routing (#8771, #9183, #9027, #9030, #9375, #8903).
• Add raw stdout delivery for cron shell jobs through shell_output_format (#8438).

Dashboard, Desktop, and CLI

• Add in-app upgrades with automatic restart, channel-owned relinking, agent renaming, active runtime context, skill-to-editor navigation, searchable keybinding help, and a unified risk-profile permission grid (#8173, #8734, #7954, #9011, #8558, #9356, #8879).
• Improve terminal chat, code-block copy, picker and overlay sizing, help behavior, and reasoning-only turns (#8920, #8767, #9173, #9008, #9169, #9279, #9292, #9234).
• Embed the dashboard in the universal macOS desktop sidecar and prepare the final DMG for notarization, stapling, and offline validation when Apple credentials are configured (#9032, #9014).
• Reduce the desktop webview's IPC authority by removing shell and store plugin permissions from gateway-served content (#9033).

Channels, Gateway, and ACP

• Add Telegram inbound debounce, poll and interactive-reply events, structured QR-login lifecycle events, and channel-owned readiness probes (#8440, #6297, #8622, #8732).
• Add Mattermost WebSocket listener mode and LAN peer-discovery hints (#9141, #8325).
• Improve QQ and Matrix behavior, restore single-provider voice transcription, persist WhatsApp Web linked identities, and strengthen channel media and ali

ZeroClaw v0.8.3

This release is a large consolidation cycle spanning 379 commits from 56 contributors, focused on the new Standard Operating Procedure (SOP) engine, a WebAssembly plugin host, a Git forge channel, and a broad round of runtime, provider, and security hardening. If you run ZeroClaw agents in production, the headline changes are the procedural-memory/SOP substrate, tighter context-budget accounting, and a wave of SSRF and secret-leak fixes. Desktop and quickstart flows also get meaningful polish.

Highlights

• SOP (Standard Operating Procedure) engine lands end to end — a daemon maintenance tick, typed step contracts, live step execution, cron/filesystem/calendar triggers, and an out-of-band approval plane.
• WebAssembly plugin host (wasmtime component model) for tools, channels, and memory, with per-call execution limits, signature-policy enforcement, and registry search/install by name.
• Git forge channel with GitHub and Gitea/Forgejo providers, plus a unified git_forge tool and SOP ingress.
• Self-contained desktop app returns — the kernel now ships as a Tauri sidecar for a Quickstart-first companion experience.
• Cost & usage accounting gains a task-attributed usage ledger, offline pricing catalog, and by-period / org-billed views in ZeroCode.
• Security hardening across the board: multiple SSRF gaps closed, constant-time token comparison, signing-key leak prevention, path-traversal fixes, and dependency bumps clearing several RUSTSEC advisories.

What's New

SOP & Procedural Memory

• A daemon SOP maintenance tick now drives live procedures, executing real steps, enforcing step scope/mode/routing/schemas at the engine boundary, and consuming CAS run claims (#8391, #8399, #8416, #8420, #8430, #8493, #8502, #8506).
• Cron, filesystem, and calendar no-show triggers wire into the maintenance tick (#8400, #8461, #8419).
• An out-of-band approval plane fails closed on timeout, with a priority-based gate fix, and deterministic capability steps now run through a registry that fails closed on driverless steps (#8304, #8724).
• A procedural memory workshop and web visual authoring (experimental) with channel fan-in and a selectable agent were added (#8509, #8590).

Plugins

• A wasmtime component-model host now backs tool, channel, and memory plugins, with channel host bindings (wasi:http, inbound queue, config jail) and a registration API (#8368, #8551).
• Plugins gain per-call execution limits and an FND-001 backend taxonomy, honor the configured signature policy when loading tools, and support registry search plus install-by-name (#8491, #8172, #8264).

Channels & Git Forge

• New Git forge channel with a GitHub provider and SOP ingress, plus a Gitea/Forgejo provider (#8609, #8611).
• Operators can now bind identities without the /bind code round-trip (#8707).
• WhatsApp gains native location-pin support on both backends and passive group context; LINE gets a loading indicator, icon/nickname switching, and bind reply feedback (#8427, #8389, #7768).
• Tool approvals can be routed to a distinct approver channel (#8231).

Runtime & Memory

• Unified memory-context injection is now keyed on TurnOrigin ingress provenance, and a durable memory store seam adds supersede/dedup/budget/policy-gate handling with embedding-identity persistence and automatic vector migration on change (#8619, #8570, #8623).
• Metered provider seams (ResolvedModelAccess::run_model_query) now cover the model-query path and the max-iteration graceful summary (#8806, #8821).
• Process RAM/CPU sampling landed on macOS, Windows, and FreeBSD via sysinfo, and a model-context-window bar was added to the ZeroCode TUI, gateway agent chat, and interactive CLI (#8802, #7946).
• Goal task storage foundation and a configurable native runtime shell were added (#8685, #8311).

ZeroCode (Desktop / TUI)

• A TodoWrite tracker (RPC + ACP + durable persistence) and cron run history/trigger were ad