ZeroClaw Release Notes

ZeroClaw v0.8.3

ZeroClaw v0.8.3 is the biggest release since the v0.8.0 rewrite: 379 commits from 56 contributors, and two genuinely new subsystems — a Standard Operating Procedure engine and a WebAssembly plugin host — alongside a Git forge channel, the desktop app's return, and a broad security wave.

The SOP engine, end to end

Standard Operating Procedures graduate from design to a running subsystem. A daemon maintenance tick drives live procedures with typed step contracts, enforcing step scope, mode, routing, and schemas at the engine boundary. Cron, filesystem, and calendar no-show triggers wire into the tick. The out-of-band approval plane fails closed on timeout, and deterministic capability steps run through a registry that fails closed on driverless steps — automation you can supervise, resume, and audit rather than fire and forget.

There's also an experimental procedural-memory workshop with web visual authoring, channel fan-in, and a selectable agent.

A WebAssembly plugin host

A wasmtime component-model host now backs tool, channel, and memory plugins — with wasi:http channel bindings, an inbound queue, and a config jail. Plugins get per-call execution limits, honor the configured signature policy at load, and can be found and installed by name through registry search. Extension without trusting arbitrary native code.

A channel for your forge

A new Git forge channel ships with GitHub and Gitea/Forgejo providers, a unified git_forge tool, and SOP ingress — the agent can live where your code reviews happen. Operators can also bind identities without the /bind code round-trip, tool approvals can route to a distinct approver channel, and WhatsApp picks up native location pins.

The desktop returns

The kernel now ships as a Tauri sidecar, bringing back a self-contained desktop app built around Quickstart — the companion experience for people who don't live in a terminal.

Runtime, cost, and security

• Cost and usage accounting gains a task-attributed usage ledger, an offline pricing catalog, and by-period and org-billed views in zerocode.
• Memory gets unified context injection keyed on ingress provenance, plus a durable store seam with supersede/dedup/budget handling and automatic vector migration.
• Observability lands process RAM/CPU sampling on macOS, Windows, and FreeBSD, and a model-context-window bar in the TUI, gateway chat, and CLI.
• Security hardening across the board — multiple SSRF gaps closed, constant-time token comparison, signing-key leak prevention, path-traversal fixes, and dependency bumps clearing several RUSTSEC advisories.

Full details in the release notes.

ZeroClaw v0.8.2 opens two new front doors. A2A agent discovery lets agents describe and discover one another over the gateway — the first agent-to-agent interop path. And the skills story gets richer: user-configured extra skill registries via registry:<name>/<skill>, and typed slash-command options declared in SKILL.md frontmatter. Installation also now adds zeroclaw to PATH automatically, with a --no-modify-path opt-out.

The release spans 152 commits from 31 contributors — and most of them are the quieter half of the story.

The posture release

v0.8.2 treats every inbound payload as untrusted and tightens the seams an attacker would reach for:

• Universal ingress policy layer — every inbound turn passes one SOP-backed policy layer before a model sees it, on every transport, including mid-turn steering injections.
• SOP trigger-payload framing — MQTT and webhook trigger topics and payloads are capped, sanitized, and framed in untrusted-content markers, so an injected event cannot forge instructions into the step context.
• Plugin SSRF guard and config isolation — zc_http_request blocks SSRF including DNS-rebinding and redirect bypasses; plugin config is scoped per-alias and raw environment access is removed.
• HMAC tool receipts wired through the ACP, gateway WebSocket, and CLI turn paths.
• Secret redaction — the Telegram bot token routes through the canonical global leak detector instead of channel-local regexes.
• MCP tool scoping per agent, with the denylist enforced across all connect sites.

Most of this is invisible at the surface. It shows up as fewer leaks, fewer duplicate launches, and turns that behave the same on every transport.

Also in this release

A durable run/task control plane backs SOP run-state, live run metrics, and delegate supervision in SQLite. Discord picks up interaction components — buttons, selects, modals, autocomplete, buttoned approval — and rich outbound embeds. Slack gains attachments, WhatsApp gains group allowlists, and the gateway adds xAI OAuth login and email-login for OAuth2 email channels.

Full details in the release notes.

ZeroClaw v0.8.1 is the first patch release on the v0.8.x line, and it goes where v0.8.0 upgraders were hurting: channel routing, cron delivery, provider replay, and config save round-trips. Of its 207 commits from 45 contributors, 123 are bug fixes — this is the release that picks up the rough edges of the multi-agent rewrite.

Highlights

• Cascading config edits — delete_with_cascade and rename_with_cascade ripple through agents, providers, channels, model providers, and skill bundles instead of leaving dangling references, built on a find_all_references / plan_delete foundation.
• Discord slash commands from skills — installed skills generate dynamic slash commands with typed options, chunked interaction followups, and archive sync on edit and delete. Discord joins the default-channels bundle.
• Operator Console redesign — the gateway web UI ships a schema-driven config editor, multi-agent chat, and a read-only skills browser.
• Cached-input pricing — cost tracking captures cached_input_tokens for any OpenAI-compatible provider that reports them, including OpenRouter system-prompt caching.
• Agent eval harness, Phase 0 — deterministic replay-driven evaluation lands as the foundation of the eval story.

Elsewhere in the release

Email channels gain XOAUTH2 auth, observer mode, and read-only IMAP tools. Slack backfills thread context on first encounter. A voice-pipeline facade lands for channels that want audio I/O. NEAR AI Cloud joins the provider list, Azure OpenAI gets a dedicated reasoning_effort wire-up, any OpenAI-compatible provider accepts extra_body, and MCP auto-reconnects on stale sessions. The three legacy agent turn engines consolidate onto a single run_tool_call_loop path.

If you upgraded to v0.8.0 and hit rough edges — this is the one to take. Full details in the release notes.

ZeroClaw v0.8.0 makes ZeroClaw multi-agent. One daemon now runs many named agents, each with its own workspace, memory, model provider, security policy, channels, and personality, coordinated by a rewritten configuration schema that migrates your existing setup automatically. Run a coding agent with full shell access, a locked-down family assistant on Telegram, and a research agent on a cheaper model — all from the same daemon, each a first-class identity through the entire stack.

Driving all of those agents is zerocode, a new full terminal UI that ships with this release, alongside a unified logging and attribution pipeline and a hardened security posture across channels, tools, and the gateway. It all adds up to 439 commits (not counting squashes) from over 100 contributors since v0.7.5.

Highlights

• Multi-agent runtime: run any number of named agents from one daemon, each with isolated workspace, memory, skills, model provider, and risk profile. Channels, cron jobs, webhooks, and ACP sessions all dispatch to a specific agent.
• Schema V3 with automatic migration: existing configs migrate in place on first load. Provider entries support multiple named aliases per provider, and a single malformed entry no longer wipes its neighbors.
• zerocode: a new terminal UI with dedicated Chat, Code, Dashboard, Config, Quickstart, and Logs panes. One daemon, many zerocode TUIs: attach from as many terminals as you want, each with its own identity and sessions. The Code pane speaks ACP with no configuration required.
• Security hardening: per-agent tool allowlists enforced at every dispatch path, bearer-token revocation on device rotation and deletion, secret redaction extended to nested config shapes, private-host allowlists for outbound HTTP tools, and a fix for a Canvas iframe token-theft advisory (GHSA-f385-f6h2-3gqj).
• Observability rework: a unified structured logging pipeline carries agent, model, and session attribution through every span, streaming to a new Logs page in the dashboard and a gateway logs endpoint.
• Lean default channel bundle: prebuilt binaries now ship the core channels by default with the rest available as opt-in build features. Check the docs if a channel you use is missing after upgrade.

Multi-agent (the star of the show)

You can now run a whole team of agents from a single daemon: a coding agent with full shell access in one workspace, a locked-down family assistant on Telegram in another, a research agent with its own memory and a cheaper model in a third. Each agent is a first-class identity through the entire stack.

Per-agent everything — workspace directories, memory stores with per-agent isolation across the SQLite, Postgres, and Qdrant backends, skill bundles, persona files, and per-agent model-provider resolution in every chat path.

Channels — each channel binds to an owning agent, with per-agent runtime contexts, structured session routing, identity injection so an agent knows who it is on each channel, and media uploads routed into the owning agent's workspace.

Security policy per agent — each agent's policy can allow or exclude individual tools, enforced at the dispatch site. Every risk-profile setting now propagates into the live policy. SubAgents are depth-capped and gated by the parent agent's risk profile.

Cron — scheduled jobs are bound to a specific agent with delivery-channel scoping, and the old implicit default-agent fallback is gone.

ACP — sessions select an agent explicitly, auto-select when only one is configured, respect configurable session limits, and the bridge accepts a custom config location.

Dashboard — a multi-agent rework with per-agent status and memory views, RAM and CPU widgets, a Memories tab, and a sandboxed per-agent workspace file explorer.

Cost tracking — rates are organized per provider and model, cached-input tokens are captured, and the dashboard shows per-agent and per-model cost splits with an editable rate sheet.

zerocode: a new terminal UI

v0.8.0 ships zerocode, a full terminal UI for ZeroClaw. It talks to the daemon over a new RPC transport with persistent sessions and rides out daemon restarts by reconnecting in place.

Local socket or remote WSS. Locally, zerocode connects over a Unix domain socket (a named pipe on Windows) with no setup at all. For a daemon on another machine, a TLS WebSocket transport connects your workstation to a Raspberry Pi, home server, or VPS with a self-signed certificate and a token. One daemon serves many zerocode instances at once: each connecting TUI gets its own signed identity and environment snapshot in the daemon's registry. Sessions are tmux-style persistent — close your laptop, reconnect an hour later from a different network, find your session intact.

Shell environment pass-through. A daemon started as a service has a stripped-down environment; your terminal has the real one. On a local socket connection, zerocode forwards its full shell environment to the daemon at handshake, and every shell subprocess your agents spawn gets it overlaid on top of the daemon's safe baseline, with zerocode's values winning on conflict. Your PATH, SSH agent socket, and credential helpers just work, no configuration required.

Themes. Named color themes with per-agent overrides in the Code and Chat panes, inline palette previews before you apply, automatic adaptation to your terminal's color depth, and a terminal theme that inherits your shell's own colors.

Keybindings. Four built-in presets (default, vim, emacs, arrows-only) plus per-action rebinding through an in-app capture modal. Changes apply live, no restart. Press ? on any pane for context-aware help.

Chat. Conversational sessions with any of your agents: full memory, skills, channel-style context, live model and provider switching mid-conversation, and an outbound message queue so you can keep typing while a turn is in flight.

Code. A coding workspace built on ACP, the same protocol that powers editor integrations, with zero configuration required: open the pane and it just works. Code sessions are tuned for the job: memory tools are excluded server-side so your coding agent stays focused on the tree in front of it, sessions persist and survive kills cleanly, and the working directory, branch, and commit are always visible.

Dashboard. Live per-agent status with RAM and CPU for the daemon process, distinguishing loading, error, and live states at a glance.

Config. The entire configuration in a split-pane editor with built-in, registry-driven help for every field. Edit agents, providers, channels, and policies without touching a text editor.

Quickstart. Guided agent creation end to end: pick a provider, paste a key, choose a model from the live catalog, set a personality, and land directly in Chat with your new agent.

Logs. The daemon's structured log stream, filterable and attribution-aware, in the same terminal you work in.

Providers

• New providers: Kilo AI Gateway, GitHub Models, Morph, Manifest, atomic-chat, a dedicated llama.cpp provider, seven more OpenAI-compatible providers, and MiniMax split into Global and China entries.
• Native extended thinking for Anthropic and Bedrock, prompt caching for OpenRouter, native Responses-protocol tool calls for Codex, automatic fallback to a secondary provider on failure, and the Responses wire protocol honored across custom, OpenAI-compatible, and llama.cpp providers.

Channels

• New channels: Twitch chat, WeCom AI Bot, AMQP with mutual TLS, and multi-tenant Linq with per-agent routing.
• Per-recipient reply pacing across nine channels, a configurable in-flight message budget, webhook retry with exponential backoff, a reply-intent precheck that can route to a cheaper per-agent classifier model, and selective channel builds behind the new lean default bundle.

Tools and plugins

• New tools for downloading remote files into the workspace, uploading single files and bundles over HTTP, sending messages to channels directly from the agent loop, reading and writing binary files, and authenticated outbound HTTP requests.
• Jina AI joins as a web-search backend.
• WASM plugin interfaces are now formally defined for tools, channels, and memory, with new plugins for Office document extraction, LanguageTool grammar checking, and self-hosted Stable Diffusion image generation.

Memory

A pluggable memory strategy now routes agent-turn, gateway, and channel consolidation through one path. Time-windowed recall works correctly for markdown-backed memories. Postgres backend initialization is fixed.

Voice, desktop, hardware, docs

• Voice notes transcode to OGG/Opus for Telegram and WhatsApp.
• Desktop onboarding wizards for macOS, Linux, and Windows permissions.
• Smart-room named-device tools and ESP32 simulator harnesses.
• Versioned documentation with a version selector, a full book rework that derives provider and config reference pages from source, a FreeBSD setup guide with service files, Podman guidance, a NixOS module, and a fully static container build pipeline.

Security

• Canvas token theft (GHSA-f385-f6h2-3gqj): the dashboard Canvas iframe sandbox is tightened so injected content can no longer exfiltrate the pairing token.
• Bearer-token revocation: rotating or deleting a paired device now actually invalidates its token at the gateway.
• Secret handling: redaction now covers every credential-shaped config surface, including nested shapes, and the channel orchestrator no longer falls back to another provider's credentials.
• Outbound request guards: private-host allowlists for the HTTP request tool and for fetches whose DNS resolves to private addresses.
• Tool gating: per-agent tool allowlists are enforced when channels start and on every message; scheduled agent jobs can no longer modify the scheduler itself by default; internal telemetry is blocked from the chat WebSocket by default.
• Sandboxing: tighter library binds in the Linux sandbox, and interactive subprocesses can no longer hijack the controlling terminal.
• Dependency advisories: mail library updated for RUSTSEC-2026-0141, the web frontend router bumped to clear five advisories, and Groq API keys added to the leak scanner.
• A partially invalid config can no longer silently default security-critical settings during daemon startup.

Breaking changes

• Schema V3: configs migrate automatically on first load. Profile settings are split between runtime behavior and risk policy, cost rates are reorganized per provider, and scheduled jobs must name the agent they run as.
• Lean default channel bundle: prebuilt binaries ship a core channel set; social channels move to opt-in build features.
• Logging: the legacy trace-event path is retired in favor of the unified structured logging pipeline; third-party logging macros are banned workspace-wide.

Since v0.8.0-beta-2

For those tracking the beta line, the 184 commits since beta-2 concentrate on stabilization.

Config correctness — the unbounded and yolo quickstart presets actually allow what they advertise, incremental saves no longer leave a stale schema-version label, the webhook channel gets a sensible default port, one malformed provider entry no longer wipes the rest of your providers on load, config browsing no longer leaks similarly named sibling agents, and a crash on multi-byte characters in CLI flags is fixed.

Channel delivery — only the final assistant turn reaches channels, internal tool-result markup is stripped from replies, truncated tool-call fragments are dropped at delivery, webp images are normalized for vision models, Telegram preserves code fences across message splits and restores forwarded-message attribution, WhatsApp delivery and reply-mentions work for the new ID format, and Matrix keeps separate session state per configured account while repairing key backups.

Cron — disabling startup catch-up actually skips overdue jobs, one-shot reminders can be scheduled relative to now, schedules set in the past get a clear diagnostic, and DingTalk is available as a delivery channel.

Runtime — history trimming can no longer empty the conversation entirely, parallel SubAgents and delegates return reliably, writing files into a container with no mounted workspace fails loudly instead of silently, and the gateway survives transient connection-accept errors instead of crashing.

Join in

Over 100 people landed work in this release, most of them for the first time. If ZeroClaw does something almost right for you, that gap is a great first PR: a fix, a doc correction, a channel quirk, a provider you wish existed. Start with the contributing guide, open an issue if you want a sanity check first, and we'll review it. The review queue moves daily.

Thank you

439 commits from over 100 contributors. This is the release that turns ZeroClaw from a single-purpose agent runtime into a multi-agent host you can actually trust to run a hardened public bot and a wide-open dev box on the same hardware. Thank you to everyone who showed up.

Release: https://github.com/zeroclaw-labs/zeroclaw/releases/tag/v0.8.0

Full diff: https://github.com/zeroclaw-labs/zeroclaw/compare/v0.7.5...v0.8.0

Zero overhead. Zero compromise. 100% Rust.

— JordanTheJet
CEO, ZeroClaw Labs

Onboarding, in the browser

v0.7.5 is a substantial follow-on to v0.7.4 — about 71 commits from 24 contributors — and unlike v0.7.4 it has a clear tentpole: first-run onboarding moves to the browser. The schema-driven /onboard flow walks new users through workspace, providers, channels, memory, hardware, tunnel, and personality without ever opening config.toml. Underneath it, the gateway grew a real per-property config CRUD surface, a personality editor that works from CLI, TUI, or the web, and live drift detection that catches hand-edits to config.toml as they happen. Here's what we think is worth your attention.

The new /onboard route renders the entire first-run flow in the browser — Workspace, Providers, Channels, Memory, Hardware, Tunnel, Personality — driven by a schema served from the gateway, not by hand-written forms. Fields are rendered from the property's declared kind, type_hint, and enum_variants; no value-sniffing, no per-property special-casing. Fresh installs auto-redirect from / to /onboard until at least one provider model is configured.

Importantly, the daemon now boots without a configured model — it has to, or you couldn't reach the onboarding flow on a fresh install. Chat dispatch refuses with a structured needs_onboarding marker until a model is set, POST /webhook returns 503 with that marker, and channel handlers (WhatsApp, Linq, WATI, Nextcloud Talk) send a Fluent-localized "agent isn't fully set up yet" reply instead of the generic LLM-error fallback. The supervisor exits cleanly instead of restart-looping.

Config gets a real API surface

Per-property CRUD under /api/config/ * — GET, PUT, DELETE, PATCH, OPTIONS — is now the canonical way to read or mutate configuration. The CLI calls into the same Config::set_prop core, so everything you can do in the browser you can do from the terminal, and vice versa.

A few specifics worth calling out:

• The runtime emits an OpenAPI 3.1 spec at /api/openapi.json, with a Scalar explorer at /api/docs.
• The dashboard's TypeScript client is generated from that spec via openapi-typescript, wired into npm run build, and tsc fails when the generated shape stops matching consumers.
• Drift detection compares in-memory state to on-disk config.toml via server-side SHA-256 hashing (secrets never leave the server). If you hand-edit config.toml, the dashboard surfaces a banner with per-row in-memory vs on-disk diffs and a one-click "Restart daemon to apply." A 409 config_changed_externally blocks writes against a drifted path; explicit X-ZeroClaw-Override-Drift: true overrides.
• PATCH/PUT are validator-gated with snapshot revert on failure. Errors come back as a structured ConfigApiError with stable codes for invalid range, enum variant, format, dangling reference, and required-field-empty.
• CLI parity: zeroclaw config patch (JSON Patch over the same core), config docs, config schema --path , set --comment, and --json envelopes on get/set/init/migrate matching the HTTP shapes.

Personality, edited from anywhere

ZeroClaw has had seven runtime markdown files driving its system prompt for a while — SOUL.md, IDENTITY.md, USER.md, AGENTS.md, TOOLS.md, HEARTBEAT.md, MEMORY.md. Editing them used to mean opening a text editor and trusting yourself.

v0.7.5 ships a three-surface editor for those files. CLI uses $EDITOR. TUI suspends and hands off to $EDITOR. The web UI ships a CodeMirror 6 editor (one-dark theme + markdown grammar) with Edit/Preview toggle, per-tab Insert / Replace template buttons, a char counter, and a 409 personality_disk_drift resolution UX (take theirs / keep mine). The backend enforces a 7-file allowlist; BOOTSTRAP.md is intentionally excluded as a first-run scaffold.

ACP cancellation and a tool-approval back-channel

ACP picks up real cancellation in v0.7.5: session/cancel aborts an in-flight turn, and concurrent session/prompt requests are rejected with a clear error instead of racing. Tool approvals now flow over a dedicated WsApprovalChannel on the gateway WebSocket — they don't fight the main message stream anymore. ACP protocol v1 also gained tool-call permission and a back-channel for structured prompts.

Hot model switching with context preserved

Pick a different model from the chat dropdown without losing the conversation. There's a real stop button while a turn is in flight, with chat-input lock and a running indicator next to it. OpenRouter free models are flagged in the default-model dropdown so you don't have to memorize which ones don't bill. tool_call / tool_result rendering defaults to off with a toolbar toggle to opt back in. Open the agent chat directly from a memory row when a session_id is present. Trigger any cron job manually from the web UI. And the theme/session/CSS-token consistency fixes finally unify the visual surface across pages.

Per-provider pricing, finally

ModelProviderConfig now carries pricing per provider profile. Every gateway turn records cost and token usage. Missing pricing logs a single WARN per (provider, model) pair instead of spamming the log on every turn. If you've been running a fleet and trying to do post-hoc cost analysis from logs, this is the release that makes that tractable.

HMAC tool receipts go live

The receipt-signing wiring stripped out of #5168 is now active. With the feature enabled, each tool result carries a verifiable HMAC trail end-to-end. Pair this with the existing receipt audit surfaces and you have a real chain of custody for what tools the agent ran and what they returned.

Installer overhaul

zeroclaw install learns preset and gateway flags, a TTY-driven feature picker, web/dist building, and an onboarding gate. The TTY feature picker writes its prompts to stderr so command substitution doesn't capture them and freeze the terminal — a subtle bug that bit several users. Linux MUSL static binaries are back in the release artifacts. The web dashboard installs to platform-correct data directories on macOS and Windows. The prebuilt path correctly extracts the dashboard again.

Provider quality pass

• Anthropic: base_url is honored for the default provider.
• Bedrock: credential_process support enables enterprise-friendly auth flows.
• Groq: per-profile native_tools override on ModelProviderConfig.
• StepFun: new stepfun-intl endpoint.
• xAI: model listing restored.
• OpenAI-compatible: tool_call extra_content is preserved so Gemini's thoughtSignature survives round-tripping. Model id normalization now has test coverage.

Channels, the long tail

• Matrix: attachments are uploaded when finalizing partial drafts; device identity is derived from the whoami response when an access token is used directly, and access-token sessions now require an explicit device identity.
• WhatsApp: fromMe replies are scoped to self-chat or trigger prefixes (no more accidental loops); LID→phone resolution failures are logged so debugging session drops is possible.
• Discord: inbound image attachments are preserved through the provider pipeline.
• Jira: API v2 server mode is supported alongside cloud.

Tools and runtime

• zeroclaw memory reindex CLI for rebuilding the embedding index in place.
• Tavily search backend for tools/web_search, with bearer-header authentication and encrypted-key support.
• tool_timeout_secs is honoured for HTTP SSE tool calls and used to derive the HTTP client timeout.
• allow_scripts is plumbed through ReadSkillTool to the skill loader so declared scripts can actually run.
• DockerSandbox gains workspace bind-mount support.
• Conversation memories excluded from build_context recall to keep prior conversation chunks from leaking into recall results, with autosaved conversation memories recalled on subsequent turns instead.
• reasoning_content captured from streaming responses; image markers stripped from non-vision context-compression payloads; bare-wildcard recall treated as a recent-memory query.
• The session backend is unified behind one factory across runtime and channels; the daemon canvas store is shared across gateway, channels, and daemon.

Security

• HMAC tool receipts activated end-to-end (#6214).
• git -C vs git -c distinction in the security policy — case-preserved argument lists prevent legitimate git -C invocations from being blocked as -c config overrides.

Docs and i18n

A Raspberry Pi setup guide. Hardware page revisions including a justified Podman memory budget and a fixed macOS cross-compile recipe. Custom OpenAI-compatible provider syntax clarified. YOLO config examples updated. Translations synced for fr, ja, es, with new zh-CN coverage and Chinese WeChat CLI strings.

Thank you

71 commits from 24 contributors. If you've been waiting for a moment where ZeroClaw "feels like a normal app" instead of an exercise in TOML editing, this is that release. The browser onboarding flow and the schema-driven config surface are both excellent on-ramps for new contributors.

Release: https://github.com/zeroclaw-labs/zeroclaw/releases/tag/v0.7.5

Full diff: git log v0.7.4..v0.7.5 --oneline

Zero overhead. Zero compromise. 100% Rust.

— JordanTheJet
CEO, ZeroClaw Labs

v0.7.4

v0.7.4 is the first patch release on top of the v0.7.x workspace foundation we shipped a few weeks ago. It's not a flashy release — there's no single tentpole feature — but it's one of the most substantive patch releases in ZeroClaw's history. Around 110 commits from 36 contributors, touching channels, providers, the web dashboard, security, and a lot of developer-experience seams that were quietly slowing us down.
Here's what we think is worth your attention.

A real i18n story for the docs

The docs are now driven by a Mozilla Fluent-based pipeline, with a multi-locale mdBook layered on top. Alongside the i18n plumbing, the entire docs tree got a comprehensive overhaul — restructured, deduplicated, and tightened up. Header links now point at the upstream repo instead of the deploy preview, and the CNAME is preserved on every Pages deploy so the custom domain doesn't drop on rebuilds.
If you've been holding off on contributing translations, this is the release that unblocks that.

Onboarding, rewritten

zeroclaw onboard was the single most-touched-and-most-complained-about surface in v0.6. So we threw it out and started over.
The new flow is schema-driven, idempotent, and DRY. Run it twice, run it after a partial setup, run it on a machine where someone hand-edited the config — it converges to a sane state instead of accreting cruft. For unknown providers, it now falls back to a generic OpenAI-compatible /v1/models probe, so the wizard works against essentially any OpenAI-shaped endpoint without us having to ship a per-provider adapter. For local AI providers running in Docker, URLs are now container-aware so you don't get the "works on host, fails in container" surprise.
Windows users: setup.bat is fixed, and cargo test is unbroken.

Matrix, from the ground up

The Matrix channel had become a long-running patch pile against an older matrix-rust-sdk. Rather than continue carrying that, we did a clean-room reimplementation on matrix-rust-sdk 0.16. E2EE auto-verification of allowed_users is preserved, the moving parts are dramatically simpler, and the channel is markedly easier to operate.
If you're on the previous Matrix integration, the migration is drop-in — same config surface, same trust model.

WeChat iLink Bot is back

A while ago, a bulk revert took out the WeChat iLink Bot integration along with some other code. v0.7.4 brings it back, ported cleanly to the current trait surfaces. As part of that work, request_approval() is now implemented across Discord, Slack, Signal, Matrix, and WhatsApp — which means approval-gated tool flows work uniformly across every supported chat platform, not just the originals.

Session management as first-class agent capability

The agent can now manage its own sessions. New SessionResetTool, SessionDeleteTool, and SessionsCurrentTool give it explicit, scoped control. On the gateway side, there's a new session-abort endpoint with incremental streaming persistence — so cancelled or interrupted sessions don't leave you reconstructing partial state from logs.
Under the hood, prune_history Phase 1 now treats mixed-protection tool groups as atomic (no more partial pruning leaving the conversation in an invalid shape), and the runtime self-heals orphaned tool_result blocks both on session load and during compaction.

Voice: the foundation lands

A new Vad trait and VoiceEvent protocol are in, behind the gateway-voice-duplex feature flag. This is the substrate for live voice channels — not the channels themselves, but the shape they'll plug into.

PostgreSQL memory backend

Memory can now be persisted to PostgreSQL via the new memory-postgres backend. If you've been running ZeroClaw in environments where SQLite isn't a great fit — multi-instance deployments, managed Postgres you're already paying for — this is for you.

Provider quality pass

A lot of small, painful provider issues got resolved this cycle:

• OpenRouter: extra_body passthrough lets you forward arbitrary upstream params; the upstream stream task now aborts cleanly when the consumer drops.
• MiniMax: native tool calling is now enabled.
• Bedrock: temperature is omitted for Opus 4.7, matching the model's actual API contract.
• Gemini / OpenRouter: tool-call compatibility fixes plus a clearer google_workspace schema.
• Groq: native tool calling is disabled where it was misbehaving (we'll re-enable when upstream catches up).
• strip_native_tool_messages now coalesces adjacent assistant turns instead of leaving fragmented runs.

Channels, the long tail

Beyond Matrix and WeChat, the channel layer got a lot of attention:

• Slack: strict_mention_in_thread lets you require an @-mention even in threads where the agent has already replied.
• IRC: mention_only config option.
• Telegram: request_approval forwards message_thread_id; auto-injected topic-root reply context is skipped in forum topics; bot command list updated.
• IMAP: polling fallback for servers that don't support IDLE.
• ACP: defaultModel resolves from config and is null when unconfigured; tool output formatting fixed; INFO logs suppressed and the missing protocol method implemented.
• Feishu: mention_only is wired through.

Web dashboard

Chat message deletion, clear-all, and a compact mode. A cron job configuration UI. The pack bin now embeds the web build directly. A bug-fix bundle covering an Overview crash, model save, editor caret, and chat CPU usage. Array-returning API helpers now guard against non-array responses, and the WebSocket session ID persists in localStorage across page reloads.

Architecture & workspace

• gateway and tui-onboarding are decoupled from agent-runtime, so each compiles without dragging in the full agent loop.
• SessionBackend gained clear_messages() for O(1) session reset and get_session_metadata(key) for typed metadata access.
• The hardware crate's wizard UI moved from main.rs into zeroclaw_hardware::wizard so it's reusable outside the binary.
• The web router was refactored for clearer route ownership.

Distribution

• OpenShift / Kubernetes deployment manifests.
• Docker images now ship the web dashboard (release image and Dockerfile.debian local-dev image).
• The install script prompts for pre-built vs source, defaulting to pre-built on curl | bash.
• Self-update target triples added; Windows cargo test unbroken.

Security

cargo update and deny.toml audit on 2026-04-27. rustls-webpki updated to v0.103.13 (with the unfixable v0.102.8 copy ignored). rand patches applied, picomatch ReDoS fixed, wasmtime and glib ignores documented. A daily advisory scan workflow now runs in CI. rand bumped 0.10.0 → 0.10.1; postcss bumped 8.5.6 → 8.5.10 in /web.

Tauri desktop

Two fixes worth calling out individually: rustls crypto provider is now installed at startup (preventing a desktop crash), and the PNG-as-ICO that was blocking Win11 builds is replaced with a real Windows ICO.

Thank you

This release is the work of 36 contributors. A few of them are stepping up consistently across multiple cycles — you know who you are, and we're grateful. If you've been thinking about contributing, the i18n pipeline and the new onboarding schema are both excellent on-ramps.
Release: https://github.com/zeroclaw-labs/zeroclaw/releases/tag/v0.7.4
Full diff: git log v0.7.3..v0.7.4 --oneline
Zero overhead. Zero compromise. 100% Rust.
— JordanTheJet
CEO, ZeroClaw Labs

Hey everyone,

A few weeks ago we published an RFC laying out why ZeroClaw couldn't stay a monolith. Today we're shipping v0.7.3, and that roadmap is done.

This is the largest structural overhaul in the project's history. If you've been following along, you know how much of it happened out in the open — in issues, PRs, and the Thursday roadmap reviews. Thank you for showing up.

The microkernel, shipped

ZeroClaw is now a proper Cargo workspace of multiple focused crates:

• zeroclaw-api
• zeroclaw-runtime
• zeroclaw-gateway
• zeroclaw-channels
• zeroclaw-tools
• zeroclaw-memory
• zeroclaw-providers
• zeroclaw-infra
• zeroclaw-config
• zeroclaw-tui
• zeroclaw-plugins
• zeroclaw-hardware

Every subsystem lives in its own crate with explicit dependency boundaries enforced by the compiler. Stability tiers are wired in at the workspace level: zeroclaw-api is the stable extension point, everything else is Beta or Experimental and labeled as such. If you're building against ZeroClaw, you now have a real contract to build against.

The agent-runtime feature flag gates the full agent loop, which means you can compile a kernel binary without it — useful if you're embedding the runtime or carving out your own topology on top.

Foundation binary: 6.6 MB

With --no-default-features, the foundation binary now builds clean at 6.6 MB. We got there honestly:

• TLS switched from aws-lc-rs to ring
• .eh_frame sections stripped
• schemars moved behind an optional schema-export feature flag — no longer a mandatory compile dependency
• 28 per-channel feature flags with forwarding chains — unused channels cost zero compile time and zero bytes
• Workspace-wide [workspace.dependencies] and [workspace.package] inheritance killed version duplication across every Cargo.toml

Pay for what you use. That's always been the promise — it now ships.

Also in this release

A lot landed on top of the structural work:

• OpenRouter streaming. Token-by-token responses, matching the experience of native providers.
• Web dashboard decoupled from the binary. Built separately, embedded at release time, bundled with cargo install, AUR, and Homebrew. New voice mode and plugins management page.
• LINE channel. LINE Messaging API is now a first-class channel.
• GitHub Copilot as a provider. Selectable in the onboarding wizard and zeroclaw config flow.
• Authenticated OTLP exporters. New otel_headers config key for Grafana Cloud, Honeycomb, and anywhere else you need bearer tokens.
• Matrix upgrades. Mention-only filtering, encrypted media download restored, outbound attachments, onboarding wizard settings preserved across restarts.
• Telegram inline keyboards for tool approval requests — interactive approve/deny buttons instead of plain text.
• Kubernetes and OpenShift sample manifests with hardened security context (non-root, read-only root FS, dropped caps, seccomp runtime default).
• Tighter command security. Dangerous interpreter flags (-e, --eval, -c) are now blocked by the command policy.

Full changelog is on the release page.

Thank you to the 26 contributors who made v0.7.3 happen

abhijeet117, aliasliao, ArgenisDLR, Audacity88, c98, DaBlitzStein, freeekanayaka, guitaripod, ilteoood, JordanTheJet, kunalk16, markuman, micookie, nayrosk, niedbalski, ninenox, pavelanni, singlerider, theonlyhennygod, titulus, tompro, UtopiaX, vernonstinebaker, WareWolf-MoonWall, wlh320, zavertiaev.

A release of this size doesn't happen without community. Some of you have been here since the first hundred stars. Some of you opened your first-ever open-source PR against ZeroClaw this cycle. Both matter equally. Thank you.

We need more of you

The microkernel split wasn't just an architectural exercise — it was about lowering the cost of contributing. You no longer need to understand the whole runtime to ship a useful PR. Pick a crate, own an area, go deep.

Places we'd genuinely love help right now:

• New channels. Discord, Bluesky, IRC, XMPP — if you live somewhere we don't, build the bridge.
• Providers. Local models, inference gateways, regional providers. The provider trait is stable enough that adding one is a weekend project.
• Plugins. zeroclaw-api is the stable extension point — it exists specifically so you can build on top of us without waiting for us to merge your idea upstream.
• Documentation. If you got tripped up onboarding, write down what you wished you'd known.
• Good first issues. Tagged on the issue tracker. We keep a running list.

Come hang out in Discord — that's where the weekly roadmap review happens (Thursdays, 8 PM EST) and where most of the real design conversations live. Introduce yourself, tell us what you're building, and we'll help you find somewhere useful to plug in.

ZeroClaw works because people outside Anthropic, outside our team, outside any one company, keep showing up and building. That's the project. Help us keep going.

— JordanTheJet

CEO, ZeroClaw Labs