Starstruk Logo MarkStarstruk

v2026.4.17

AIEraDev/Clyprav2026.4.17Apr 17, 2026by github-actions[bot]

AI Summary

This release focuses on migrating the project to Zig 0.16 and implementing significant security hardening measures, including stricter sandbox validation and pairing token expiration. New features include Weixin QR authentication and admin CLI tools, alongside numerous stability fixes for agents and providers.

Key Highlights

  • Migrated project to Zig 0.16
  • Added Weixin QR authentication flow and channel support
  • Added admin-oriented config and models CLI
  • Hardened web security by tightening provider/browser boundaries
  • Fixed security issues regarding Docker sandbox initialization and auto-detection

Breaking Changes

  • Migrate project to Zig 0.16
  • require runnable linux sandboxes in auto-detect

New Features

  • Support http_proxy/https_proxy environment variables in std.http.Client
  • Add Weixin QR auth flow and channel support
  • Dispatch agent on heartbeat when HEARTBEAT.md has tasks
  • Add admin-oriented config and models CLI
  • Add SysVinit fallback for nullclaw service install

Full Release Notes

## What's Changed
* v2026.4.9 by @DonPrus in https://github.com/nullclaw/nullclaw/pull/795
* Migrate project to Zig 0.16 by @DonPrus in https://github.com/nullclaw/nullclaw/pull/823
* fix(security): initialize docker sandbox mount args via factory | 修复(安全): 通过工厂初始化 Docker 沙箱挂载参数 by @manelsen in https://github.com/nullclaw/nullclaw/pull/801
* fix(agent): persist cli turns into sqlite session history | 修复(agent): 将 CLI 对话持久化到 SQLite 会话历史 by @manelsen in https://github.com/nullclaw/nullclaw/pull/802
* fix(providers): Responses API tool schema and null error handling by @fakhriaunur in https://github.com/nullclaw/nullclaw/pull/790
* fix(agent): keep unbound sessions on the main agent | 修复(agent): 让未绑定会话始终落到主代理 main by @manelsen in https://github.com/nullclaw/nullclaw/pull/804
* fix(config): allow local container hostnames for otel http | 修复(config): 允许 OTEL 使用本地容器主机名作为 HTTP endpoint by @manelsen in https://github.com/nullclaw/nullclaw/pull/803
* fix(provider): fall back to responses on chat endpoint 404 | 修复(provider): chat 端点返回 404 时回退到 responses by @manelsen in https://github.com/nullclaw/nullclaw/pull/806
* hardening(web): expire pairing tokens and tighten provider/browser boundaries | 加固(web): 为配对令牌添加过期并收紧 provider/browser 边界 by @manelsen in https://github.com/nullclaw/nullclaw/pull/807
* service: add SysVinit fallback for nullclaw service install by @mark-os in https://github.com/nullclaw/nullclaw/pull/810
* fix(compaction): fix UTF-8 truncation in history compaction by @wanderingmeow in https://github.com/nullclaw/nullclaw/pull/824
* fix(security): require runnable linux sandboxes in auto-detect | 修复(安全): Linux 自动检测仅接受可实际运行的沙箱后端 by @manelsen in https://github.com/nullclaw/nullclaw/pull/805
* fix(web_search): add setup guidance for missing providers | 修复(web_search): 为缺失搜索提供方补充设置指引 by @manelsen in https://github.com/nullclaw/nullclaw/pull/815
* fix(doctor): clarify CLI-only channel status diagnostics | 修复(doctor): 澄清仅 CLI 场景下的 channel 状态诊断 by @manelsen in https://github.com/nullclaw/nullclaw/pull/828
* fix(onboard): raise models refresh output budget | 修复(onboard): 提高模型目录刷新输出预算 by @manelsen in https://github.com/nullclaw/nullclaw/pull/813
* fix(agent): stabilize named-agent provider lifetimes | 修复(agent): 稳定命名子代理提供方生命周期 by @manelsen in https://github.com/nullclaw/nullclaw/pull/814
* feat(test): utility additions by @fakhriaunur in https://github.com/nullclaw/nullclaw/pull/787
* feat: support http_proxy/https_proxy env vars in std.http.Client by @juvenn in https://github.com/nullclaw/nullclaw/pull/755
* Add admin-oriented config and models CLI by @DonPrus in https://github.com/nullclaw/nullclaw/pull/829
* Add Weixin QR auth flow and channel support by @DDGRCF in https://github.com/nullclaw/nullclaw/pull/818
* ci: pin CI workflow actions and set permissions by @grtninja in https://github.com/nullclaw/nullclaw/pull/798
* feat(telegram): add interactive skill menus and harden topic/codex handling by @vedmalex in https://github.com/nullclaw/nullclaw/pull/782
* feat: dispatch agent on heartbeat when HEARTBEAT.md has tasks by @quinlanjager in https://github.com/nullclaw/nullclaw/pull/757
* refactor(providers): consolidate error text predicates (EN | ZH) by @manelsen in https://github.com/nullclaw/nullclaw/pull/754
* feat(test): Add tests for version, verbose, and web search providers by @fakhriaunur in https://github.com/nullclaw/nullclaw/pull/786

## New Contributors
* @mark-os made their first contribution in https://github.com/nullclaw/nullclaw/pull/810
* @DDGRCF made their first contribution in https://github.com/nullclaw/nullclaw/pull/818
* @grtninja made their first contribution in https://github.com/nullclaw/nullclaw/pull/798
* @quinlanjager made their first contribution in https://github.com/nullclaw/nullclaw/pull/757

**Full Changelog**: https://github.com/nullclaw/nullclaw/compare/v2026.4.9...v2026.4.17