v0.4.2 - Architecture cleanup patch release

Highlights

• Continued the large architecture cleanup that splits oversized modules into focused helpers while preserving public APIs and runtime behavior.
• Reduced coupling across daemon, session, command bridge, room, background task, scheduler, Teams, Telegram, config, agent, structured pipeline, and provider quota code paths.
• Kept generated/versioned release surfaces in sync for 0.4.2, including Coq extraction, wasm identity/version strings, and docs package metadata.
• Preserved the release pipeline behavior where GitHub binary assets can publish even if npm credentials are absent.

Validation

Local release preflight:

• make sync-version-check
• make extract-check
• make fmt-check
• ./scripts/gen_agent_builtins.sh --check
• npm run build in docs/
• make test after the version bump: 5847 tests
• make test-all before the version bump: 5856 tests on the Docker-backed full gate, with Xiaomi/MiMo live tests skipped because that token plan is no longer available

Assets

The release workflow builds and uploads:

• clawq-0.4.2-linux-x86_64-speed
• clawq-0.4.2-linux-x86_64-size

The npm package publish step is expected to skip gracefully if NPM_TOKEN is not configured.

Full Changelog

• 38c785d update backlog
• 8de43df Refactor config loader basic section parsing
• 1037939 Refactor daemon logging setup
• 3fa7164 Extract agents command bridge module
• 6123b30 Extract durable inbound replay module
• a5c27b5 Extract setup room wizard rerun modules
• 144dffd Extract main background command modules
• 8c779db Extract session queue helpers
• 90bd4ef Extract session context persistence helpers
• 5af88e0 Extract rooms command bridge module
• 8125697 Extract daemon question registration
• 7ff6830 Extract daemon resume helpers
• 62f23c0 Extract session postmortem gatekeeper
• 3617eaa Extract session agent invocation helpers
• 0ba0ed7 Extract room routine command helpers
• dc9e9df Extract Discord protocol helpers
• ad992f9 Extract config provider parsing
• 9f61f79 Extract config access parsing
• bbcfa7e Extract config room profile parsing
• ee8994c Extract daemon config reload handling
• e26a16b Extract session activity helpers
• d0ae5d1 Extract Telegram API state helpers
• 0b7de22 Extract background task context helpers
• dd163c6 Extract runtime config model helpers
• c1c54df Extract task tree template helpers
• f21afd6 Extract task tree agent helpers
• 7336e94 Extract runtime config JSON section serializers
• 9a43dd0 Split generated agent template builtins
• e14591e Extract room wizard plan helpers
• 5b5dd17 Extract Slack API helpers
• e4b22e7 Extract daemon startup helpers
• 3c64156 Extract daemon heartbeat loop
• 28078a5 Split Teams webhook facade
• 3ed669b Extract daemon background loops
• 45f2049 Extract daemon runtime loops
• 72ffcab Extract daemon config watcher
• b040fac Extract daemon channel fanout
• 805e859 Extract background task workflow triggers
• cd35e57 Extract background task room launches
• 460aaac Extract session management helpers
• d04736a Extract session CLI commands
• f24c6d7 Extract models CLI commands
• 2a67e36 Extract plan CLI commands
• 1618b3e Extract audit CLI commands
• c0f0d22 Extract cron command bridge
• 9c1cc3e Extract room ledger command bridge
• c97c70f Extract Telegram update helpers
• 54682a9 Extract Teams webhook helpers
• 7d1a94b Extract Teams command presentation helpers
• c497f46 Extract agent turn helper modules
• 01b3955 Extract agent compaction support
• 996b0ec Extract scheduler helper modules
• 6ff3008 Extract runtime config defaults
• 4a722f0 Extract structured pipeline helpers
• 01c1551 Extract session postmortem launcher
• e636bda Extract agent memory context
• 809eed6 Extract provider quota state
• be55a63 Bump version to 0.4.2

v0.4.1 — Help, safer egress, and smoother agents

Highlights

• Added the built-in clawq_help tool with topic-based help and onboarding guidance.
• Improved the bash tool with background=true, cwd guidance for cd <dir> && ..., and live running-output previews in consolidated status messages.
• Smoothed subagent UX with better model guidance, automatic parent-session completion notifications, prompt previews, and less brittle timeout behavior.
• Added top-level egress strictness/default allowlist support, clearer egress-denial hints, and policy wiring across HTTP tools and MCP paths.
• Updated release automation for CI parity: version sync, generated-agent checks, regenerated extraction output, and graceful npm-publish skipping when NPM_TOKEN is not configured.

Assets

• clawq-0.4.1-linux-x86_64-speed
• clawq-0.4.1-linux-x86_64-size

Notes

The GitHub release binaries were built by the release workflow. npm publishing is configured to run when the repository has NPM_TOKEN; this release skipped npm publish because that secret is not currently visible to Actions.

Full Changelog: v0.4.0...v0.4.1

Full commit changelog

• add project name to claude md (7309b1d)
• fix: repair legacy room profile schema on startup (9138196)
• fix: keep update progress output with completed step (dcdabb0)
• bl bug B724: subagent_result: adaptive blocking with cache-timeout awareness and steering-message interruption (826da9a)
• bl bug B725: Archive forgotten memories to persistent per-session workspace storage (64bf34c)
• bl bug B726: React with salute emoji on interrupt message processing (d1b91d8)
• bl bug B727: Telegram xiaomi Anthropic stream emits tool calls with empty arguments (3303885)
• bl bug B728: Add default cache timeout per provider to available models table (36f11f5)
• fix: log raw tool-call data on failures (ad14af1)
• fix: locate repo root in scoped memory test (50e230a)
• bl claim B724: subagent_result: adaptive blocking with cache-timeout awareness and steering-message interruption (6d7f4fd)
• bl claim B725: Archive forgotten memories to persistent per-session workspace storage (567abf4)
• bl claim B726: React with salute emoji on interrupt message processing (2193278)
• bl claim B727: Telegram xiaomi Anthropic stream emits tool calls with empty arguments (0ec9124)
• update B728 (1b5e691)
• bl claim B728: Add default cache timeout per provider to available models table (9de7aee)
• fix: preserve Anthropic stream tool arguments (e81e836)
• fix: salute acknowledged interrupts (cf47533)
• B728: add provider prompt cache TTL metadata (829a64c)
• Archive forgotten memories per session (084c414)
• bl claim B714: Add to /help response: document '!' as a way to interrupt current processing. this task May interact with followups if we use a char prefix for those too. (709982d)
• subagent_result: add cache-aware adaptive wait (17ebcfc)
• B714: document bang interrupt in help (9bd9192)
• docs: plan tool-calling audit fixes (79a57da)
• fix: harden codex tool-call streaming (b8b2001)
• fix: preserve openai chat raw tool calls (7cd4dc2)
• fix: validate and classify tool-call failures (861634a)
• fix: normalize anthropic tool-call replay (c2b26db)
• fix: preserve and redact raw tool payloads (cb0d27d)
• fix: address tool-call audit review findings (8da1c81)
• fix: close streamed raw tool-call gaps (97471b0)
• fix: filter mixed streamed raw orphan payloads (3158d5c)
• bl bug B729: move the prefix-bang paragraph in /help response to top of help so that it's the most visible thing. Move skills under '/help skills' and move agents under '/help agents'. Both should be referenced at the end of the main help command. (5261f45)
• bl claim B729: move the prefix-bang paragraph in /help response to top of help so that it's the most visible thing. Move skills under '/help skills' and move agents under '/help agents'. Both should be referenced at the end of the main help command. (567ecb8)
• fix: reorganize slash help visibility (bc88a2a)
• plan: ingest Claude Tag parity next phases (52b395c)
• workflow: claim P14 access bundle implementation (bb83cca)
• bl bug B730: Quickstart and other docs (site and llms.txt etc) might be outdated or have outdated install instructions. The npm package is now the easiest way to install clawq. We should update all the docs and make sure that all of the install/getting started stuff is up to date! (Important!) (30f93cb)
• bl claim B730: Quickstart and other docs (site and llms.txt etc) might be outdated or have outdated install instructions. The npm package is now the easiest way to install clawq. We should update all the docs and make sure that all of the install/getting started stuff is up to date! (Important!) (5090377)
• Add access bundle config model (4120426)
• Fail closed on malformed access bundle fields (c980aac)
• Fail closed on invalid access policy loads (df18d45)
• bl done P14.M1.E1.T001: Add access bundle config and storage types (16028c6)
• bl claim P14.M1.E2.T001: Implement deterministic scope inheritance resolver (aac0e7d)
• workflow: claim P14 scope resolver implementation (424a995)
• wip: p14-m1-e2-scope-resolver implementation (39ee5d1)
• fix: harden scope resolver validation (e32d254)
• fix: close scope resolver review gaps (572f4c6)
• fix: fail closed scope resolver bypasses (52cd239)
• fix: normalize scope workspace selectors (aa95046)
• bl done P14.M1.E2.T001: Implement deterministic scope inheritance resolver (34dba22)
• bl claim P14.M1.E2.T002: Add resolver conflict and precedence tests (248f3f9)
• workflow: claim P14 resolver conflict tests (d5dac5a)
• workflow: fix P14 conflict test worktree lane (2dda67c)
• test: cover scope resolver conflicts (8dd714e)
• bl done P14.M1.E2.T002: Add resolver conflict and precedence tests (f1307b3)
• bl claim P14.M1.E2.T003: Refresh derived policy on config reload (38b365b)
• workflow: claim P14 config reload policy lane (d2a1887)
• Refresh access policy on config reload (8d4fcd2)
• Refresh docs for npm-first install path (3dacdb1)
• Fix config reload: refresh all config-bound tools + rollback on failure (f5fc632)
• Fix config reload runtime tool rollback (df34c6d)
• bl done P14.M1.E2.T003: Refresh derived policy on config reload (8690487)
• bl undone P14.M1.E2.T003: Refresh derived policy on config reload (d5ebf8f)
• bl claim P14.M1.E2.T003: Refresh derived policy on config reload (c91d336)
• workflow: claim P14 reload loader-boundary fix (c5587a4)
• fix: daemon reload preserves last valid config on malformed config.json (603b423)
• workflow: add direct pi resume handoff (5f06c23)
• workflow: record P14 T003 verification (b4fd58b)
• bl done P14.M1.E2.T003: Refresh derived policy on config reload (c927dc2)
• bl set P14.M1.E1.T003: Fail closed on invalid bundle references (dcd2c22)
• bl set P14.M1.E2.T003: Refresh derived policy on config reload (ad19ba4)
• bl set P14.M2.E1.T003: Add room-facing what-can-you-access command path (0b3a198)
• bl set P15.M1.E1.T003: Record delivery attempts in room activity ledger (9f037a3)
• fix: correct P14-P18 dependency graph for parallelization (fbcafb4)
• bl claim P14.M1.E3.T001: Persist effective-access snapshots for executable work (f8baeaf)
• docs: P18.M1.E1.T001 — inventory all credential-bearing callsites (f8fc0aa)
• docs: P18.M1.E1.T001 — inventory all credential-bearing callsites (0ca6725)
• bl done P15.M1.E1.T001: Define shared room delivery target and result types (1990be4)
• feat: add GitHub App config and installation schema (53b1691)
• docs: P18.M1.E1.T001 — inventory all credential-bearing callsites (v2) (b170180)
• bl done P18.M1.E1.T001: Inventory credential-bearing callsites (943ffb0)
• bl claim P16.M1.E1.T002: Implement GitHub App JWT and installation-token cache (6b78e25)
• Merge T001: GitHub App config types (0790a4d)
• feat: implement GitHub App JWT and installation-token cache (44e8cda)
• fix: address reviewer findings for GitHub App JWT (57e73de)
• fix: rewrite ISO 8601 UTC parser without Unix.mktime (bc0f114)
• feat: persist effective-access snapshots for executable work (P14.M1.E3.T001) (aa19af7)
• bl done P14.M1.E3.T001: Persist effective-access snapshots for executable work (dfb5596)
• bl done P16.M1.E1.T002: Implement GitHub App JWT and installation-token cache (206e208)
• bl done P16.M1.E1.T001: Add GitHub App config and installation schema (aed483c)
• bl claim P14.M1.E3.T002: Attach snapshots to session task and ledger metadata (7e37406)
• feat: dispatch room progress through connector capabilities (a522762)
• bl claim P15.M1.E1.T002: Dispatch room progress through connector capabilities (2b970fb)
• bl done P15.M1.E1.T002: Dispatch room progress through connector capabilities (c1b32ed)
• feat: attach access_snapshot_id to background tasks and ledger metadata (9f082bf)
• P18.M1.E1.T002: Add credential handle and provider types (bba1a23)
• fix: pass access_snapshot_id through delegate_enqueue path in launch_room_bg_task (c1a54a8)
• bl done P18.M1.E1.T002: Add credential handle and provider types (4c3075f)
• feat: add rooms memory list/show/save commands (P17.M1.E1.T001) (523aee0)
• P16.M1.E1.T003: Route GitHub API auth through App/PAT abstraction (0a7d5d8)
• feat: capture snapshot in trigger_job when config is available (8811950)
• fix: add pat_headers helper, remove duplicate auth_headers (2d8be20)
• bl done P16.M1.E1.T003: Route GitHub API auth through App/PAT abstraction (3e4abf6)
• bl done P14.M1.E3.T002: Attach snapshots to session task and ledger metadata (154d880)
• bl done P17.M1.E1.T001: Add rooms memory list show save commands (64970cd)
• test: add snapshot immutability regression tests (09490cc)
• test: strengthen immutability tests with v2 snapshot assertions (916f629)
• bl done P14.M1.E3.T003: Add snapshot immutability regression tests (b7b9a37)
• bl claim P14.M2.E1.T001: Build redacted effective-access explan...

v0.4.0 — Room Agents

What's Changed Since 0.3.0

New Features

Major: Room Agents Campaign

This release introduces the room-agents system: shared, policy-controlled agent sessions for rooms across Slack, Discord, Telegram, and Teams.

• Room profile config + DB binding model — deterministic config-to-DB reconciliation; per-room profile bindings with validation and repair.
• Per-room persistent workspaces — deterministic slug+hash paths under ~/.clawq/; lifecycle management (create, rebind, rename, delete) with config/DB contract.
• Scoped memory — per-profile memory isolation (create, import, export, search); grant resolution and enforcement; budget tracking with DB ledger.
• Room privacy guard — limits what room participants can send to the agent; request classifier with deterministic tests.
• Room lifecycle — admin stubs for room management; child thread sessions with session keys.
• Progress states — sparse room progress tracking; delivery of progress updates to Slack/Discord.
• Guest policy — enforcement for room async requests.
• Background task launch — room-launched background tasks under profile policy.
• Completion/failure messages — final room completion and failure delivery.
• Concurrent room messages — verification and restart replay.
• Scheduler cron — cron metadata, cron-as-room-sessions, manual trigger path.
• Room routines — create/list/show/edit/remove/enable/disable/trigger commands with admin audit.
• Connector capabilities — Telegram capabilities, Teams commands, consent cards.
• Ambient watcher — policy engine, stale query engine, watcher decisions, material-change gate, safe delivery pipeline.
• Ambient inspection — admin inspection surface for ambient watcher state.
• Documentation — comprehensive room-agents docs in docs/room-agents.mdx.

CLI, Cron, Update, and Release Tooling

• Added package-manager-aware self-update routing.
• Added npm package scaffolding and OIDC trusted publishing workflow.
• Added RELEASE.md with npm release process docs.
• Added cron enable/disable CLI subcommands.
• Improved /feature progress directives.
• Expanded tool descriptions with cross-references and usage constraints.

Website and Packaging

• Added Open Graph/social metadata and browser-rendered preview card assets.
• Updated README/package metadata for clawq.org and the scoped npm package.

Bug Fixes

Provider and Model Compatibility

• Fixed MiniMax tool-call/result ordering, streaming empty-argument handling, transient 500 retry behavior, intermittent 404 surfacing, and oversized error logging.
• Fixed Z.ai session resume failures by enforcing tool-group integrity and resume-message shape.
• Fixed Kimi/OpenAI-compatible resume failures from orphan tool-call IDs and missing reasoning_content.
• Fixed provider timeout behavior, including stream idle timeout and dead 30s timeout paths.
• Fixed Ollama usage handling, Cohere Done handling, maxOutputTokens, quota double-store behavior, and an API-key leak.
• Fixed model discovery refresh failures and silent fallback logging.

Connectors and Messaging

• Fixed Discord REST route mutexing so one rate-limited route does not block others.
• Fixed Mattermost DM/group channel-type detection.
• Fixed Teams send failure visibility, empty Teams payload handling, cron delivery reporting, and status reset on mid-turn injection.
• Fixed Telegram stale tool status and outbound mutex race handling.
• Fixed forced message splitting and connector dispatch edge behavior across Teams, Telegram, and WhatsApp.

Daemon, Sessions, and Background Work

• Fixed admin stop handling during active and queued turns.
• Fixed duplicate resume prompt persistence and Z.ai resume prompt failures.
• Fixed session model preservation across update restarts.
• Added watchdog/circuit-breaker behavior for stuck sessions, repeated invalid tool calls, repeated identical parameter-validation errors.
• Fixed session mutex deadlock and restart-resume history sanitization issues.

Cron, Search, and Briefings

• Fixed Brave/DDG/web-search fallback behavior and startup health checks.
• Fixed briefing cron rate-limit behavior by avoiding unbounded parallel searches.
• Fixed fragile briefing prompts by routing through deterministic skills and persistent sessions.

Security, Safety, and Reliability

• Fixed ACP security/correctness issues and converted blocking Sys.command usage to Lwt_process.
• Fixed unsafe pkill -f cleanup by using process-group-scoped cleanup.
• Fixed multiple resource leaks around files, SQLite statements, process handles, IRC/IMAP/SMTP connections.
• Improved tool execution safety, sandbox PATH exposure, config parse logging.

Memory, Task Tree, Pipeline, and Tests

• Fixed memory FTS5 colon escaping and empty-string channel handling.
• Fixed task-tree dependency cycle and task-not-found guidance.
• Improved restart, provider, migration, replay, and connector test stability.

Breaking Changes

No explicit breaking changes. Potential upgrade note:

• Legacy default_provider config is now migrated into agent_defaults.primary_model. Existing configs should continue to load, but users may see deprecation warnings until the old field is removed.

Documentation

• Added room-agent documentation and updated llms-full.
• Added npm release documentation in RELEASE.md.
• Updated README/package metadata for the public website.
• Added a Dune memory-usage warning to repo instructions.