Starstruk Logo MarkStarstruk

v0.13.0

modelcontextprotocol/registryv0.13.0Jul 17, 2026by steipete

AI Summary

This update introduces a quiet mode for long-running sync sessions to prevent notification spam, preserves quoted message context in replies, and implements significant security hardening for Windows path handling and build pipelines.

Key Highlights

  • Sync 'quiet' mode to maintain normal notification behavior during long sessions
  • Preserved quoted-message context for text replies
  • Fixed Windows SQLite URI errors for drive-letter and UNC paths
  • Upgraded to signed, notarized, and provenance-bound release artifacts

New Features

  • Opt-in `--presence-mode quiet` flag
  • Windows path normalization for auth
  • Signed/notarized macOS binaries
  • Go 1.25.12 requirement with govulncheck gating

Full Release Notes

## Changelog

### Highlights

- Sync can now stay quiet during long-running mirror sessions so the primary phone keeps normal notification behavior. (#298 - thanks @GodsBoy)
- Text replies now carry complete quoted-message context through direct and delegated sends. (#302 - thanks @odilorg)
- Windows auth and store access now handle drive-letter and UNC paths without invalid SQLite URI errors. (#304 - thanks @goutamadwant)
- Official release artifacts now use a signed, notarized, provenance-bound draft-first pipeline with protected verification and Homebrew handoff.

### Added

- Sync: add opt-in `--presence-mode quiet` to suppress available-presence updates during long-running sync sessions while retaining safe unavailable cleanup. (#298 - thanks @GodsBoy)

### Fixed

- Messages: preserve quoted content, stanza IDs, and participants when replying to stored incoming or outgoing text messages, including through sync IPC delegation. (#302 - thanks @odilorg)
- Windows: normalize drive-letter and UNC paths before constructing SQLite file URIs so auth and read-only store opens no longer fail with invalid URI authority. (#304 - thanks @goutamadwant)
- WhatsApp compatibility: update `whatsmeow` for current protobufs, LID direct-message sends, pairing, and user lookup behavior. (#306)

### Security

- Build: require Go 1.25.12 and gate source plus release binaries with `govulncheck` so reachable GO-2026-5856 standard-library paths are excluded.
- Release: sign all official macOS thin and universal binaries with the exact OpenClaw Foundation Developer ID metadata and designated requirement, hardened runtime, timestamp, and Apple notarization before draft upload; require naturally quarantined clean-VM execution as the standalone CLI Gatekeeper proof.
- Release: bind cross-build provenance and publication freshness to the current protected head, reject wrong linker/runtime versions and lookalike signing authorities, revalidate the exact draft and fresh published release by ID, and verify protected Homebrew handoff, formula stanzas, plus the installed binary's hash, architecture, signing identity, runtime, and notarization constraint.
- Release: move official publication to a local draft-first flow with authenticated cross-build provenance, separate protected-main native verification, a signed annotated exact tag, verified public-release and Homebrew manifests, and credential-free CI builds.

### Changed

- Dependencies: update `go-sqlite3`, the Go networking stack, and `whatsmeow` with its required transitive modules. (#305, #306)
- Tooling: require Node.js 24 or newer and enforce a 48-hour minimum release age for pnpm packages. (thanks @vincentkoc)