v0.2.4

## Changelog
* 14a28ae93e08ab7f08c577af30e61e1cc218f3c5   docs: note that workspace config files are hot-reloaded (#1747)
* 2fec249be1c3de5828d314f14aa09733310f4b9a  refactor(agent): improve SubTurn error handling and logging
* 329322075df3f077a39530b9cd780fc2dd2b8396 Add configurable logger
* 92b7687068dddf804985c6673de90eae2961095c Add configurable logger
* 647071d342e09f1ae76898871fc0b413d1b4f0ad Add default value for config
* f35516c5c9efe3019f31b96d021a5531250d484c Add default value for config
* f79469c19dff69650c3ba8f6129f9b357596eff9 Add model-native search (prefer_native) for OpenAI/Codex (#1618)
* b24c577e38e96624a936eaceca9d648785236e15 Add security config to ExtraBody round-trip test
* be6bf9f6c6405ecccef8ce7d72205d321cdabb4b Add virtual model support for multi-key expansion
* e05d2620e128e83d9fd599a0d425773ee76fff92 Added tests to verify SubTurn context cancellation behavior when parent finishes early - identified need for Critical+heartbeat+timeout mechanism.
* 9d761b7f5b282dd0f46c43ba4193cca215fadbfd Delete .claude/settings.json
* 009a8d702bcf58b2b1f78ac0fb8b20f0c44a0da2 Feat/feishu card parsing (#1534)
* 899558bbfaf89414696070d240b6718628c93c52 Feat/issue 1218 agent md context structure (#1705)
* b23a6b3f54e3ed0f38ab1d4ee563b938251c82f8 Feat/move weixin login to auth and update docs (#1945)
* 828971d549a51d29b694f74ea7d51100689b1e82 Feat/qq local file upload (#1722)
* 75d86721a3cffabd1721537134740c0e2a3402db Feat/wecom aibot processing message config (#1785)
* dd8279425548d862ccf2657b57a2dd06011c389a Feat/weixin openclaw port (#1873)
* 75270c47770ddc121ba79e9bcd6a12fa9b658dc4 Fix 1886 media cleanup policy (#1887)
* d4e56bc3d5c673acf05cd7c39a02734e40136169 Fix lint
* 6bd8fec87a39ee8710d0d05c39b2fce64da1ebbf Fix security config precedence during migration (#1984)
* 073ae4864ffd2f3f5bea4e44fb4851c5c0bea7ee Fix spelling
* e3cc5b10009e2d950924807bdf73e281d39151cb Fix the limitation on the number of tables in cards caused by Feishu (#1736)
* 8b6cbd99090908e2ccbd56e18ca06cf9a9283ee5 Fix: Prevent security.yml from being overwritten during config migration (#1966)
* 9a25fad20a600988573f6fdabe21b0c8146704da Implement the latest long-connection mode for the WeCom AI Bot. (#1295)
* 0459deca03a31ed08f778bffa78a17c5ae3a0491 Initial plan
* 4c8526d9176820a702bb1595241597294fe30244 Merge branch 'feat-configurable-logger' of https://github.com/kunalk16/picoclaw into feat-configurable-logger
* 7767feb7247f094ae52b654b9140c6ec9656be87 Merge branch 'feat/provider-extra-body-config' of github.com:uiYzzi/picoclaw into feat/provider-extra-body-config
* 02393b308754ee034bd950b10339e1623b6a284d Merge branch 'feat/provider-extra-body-config' of github.com:uiYzzi/picoclaw into feat/provider-extra-body-config
* 3791f06faf514fbf8bd4c7c78ec32182d03e1ff9 Merge branch 'main' into feat/markdown-output-format-web-fetch
* 13d4801601a2ebe7d9334c0b90a7dd4e6e6f1e94 Merge branch 'main' into feat/markdown-output-format-web-fetch
* 9835e821d7588f6daff12e2dc6252a371c444912 Merge branch 'main' into feat/markdown-output-format-web-fetch
* 6a5a4a5617d7f1fe5f70bab3bc8cb082b985e3b5 Merge branch 'main' into feat/provider-extra-body-config
* d3ba40090bc1c2ce682562d8f50bf8b5312ded39 Merge branch 'main' into feat/skill-channel-commands
* 583c586db6751003429197c521c83a75897a2ccb Merge branch 'main' into feat/subturn-poc
* 4f646ef2b83e7e56c4909260beb75ad37a87c71c Merge branch 'main' into feat/subturn-poc
* 4398e3e070883194e629f003c4a25a3f1b8be30b Merge branch 'main' into fix-doc
* 317c70a7b2775c04de4f077646071f86d9d0fb8e Merge branch 'main' into fix/1323-telegram-endless-typing
* fddfd56b50f0bdd52e874d965433331ab0637894 Merge branch 'main' into fix/binary-tool-output-handling
* 14a4983af3c0cba78386a6b1694193566afba184 Merge branch 'main' into fix/binary-tool-output-handling
* 5a8aab8143822867952f172ce3e998be38f66e0c Merge branch 'main' into version
* cfd3a1b441bc5205e5b0b86a8399a4bd1154977e Merge branch 'main' into version
* 36f9d20de1ed8bbf6754291b15828321cd88ab12 Merge branch 'main' into version
* 7c854fe6d73993aa590f9f90ed58a9d8f0669fcf Merge branch 'main' into version
* 94fcb25039b3a2f0313dc9c35c48e32f093ed199 Merge branch 'main' into version
* 284ced1f5cecd716e4a3b0ef0aba4dbea8175ec0 Merge branch 'main' into version
* 927958e6b31d578196682e03b13eadff36d1bf84 Merge branch 'main' into version
* 7bf4831059742d368b169ba2210169e837556f25 Merge branch 'main' into version
* 650827103dfc9abcbb96145e72a693083501760b Merge branch 'main' of https://github.com/sipeed/picoclaw into feat-configurable-logger
* 849008464080774571abf27b209c09f9a259d249 Merge branch 'main' of https://github.com/sipeed/picoclaw into feat-configurable-logger
* 7ba8682ac5e0b3a82abcadad6699990131485fee Merge branch 'refactor/agent' into feat/subturn-poc
* c732e6365099aeeb701dd8690f25853bdcc161db Merge branch 'upstream-main' into feat/subturn-poc
* 532ea4b56cda4102e17ab70a871d041603b0f08f Merge branch 'upstream-main' into feat/subturn-poc
* 1bd144ac139642b3944d3e902f295f46a7b5df7e Merge branch 'upstream-main' into feat/subturn-poc
* 54889f21a785e57f30c08fc3e64e73f5df6ae723 Merge branch 'upstream-main' into feat/subturn-poc
* c18d8a2ecc1aae0f653d839cc23bb53023de7439 Merge branch 'upstream-main' into feat/subturn-poc
* 24d6cb5272d933631d3093f2109e12a59d024630 Merge branch 'upstream-main' into feat/subturn-poc
* 431a53cbb178e133ee48a9c8d10550eb2f623def Merge branch 'upstream-main' into feat/subturn-poc
* e801ccb6740834a8ec8f05b48fab2bfd836ec1ad Merge branch 'upstream-main' into feat/subturn-poc
* cff906508405c620052a3177db7f4560d9950d86 Merge pull request #1352 from cytown/version
* bd4317f1f4df451dc99e085b82be153121ae6862 Merge pull request #1390 from kiannidev/fix/1323-telegram-endless-typing
* 74f2a1513eee8bc6bca9f42d90e93540f857b82e Merge pull request #1479 from securityguy/fix/claude-cli-error-surfacing
* 5e92a38236e0b1cdf055eaed65ad990aaa5bfb62 Merge pull request #1490 from is-Xiaoen/refactor/context-boundary
* 79b0568d75c7e9f24a1dfd4b1598aa1d96bfc830 Merge pull request #1536 from alexhoshina/fix/allow-picoclaw-media-tempdir
* dfafdf7c532a8bd91c093eee24cad0627940ce5a Merge pull request #1570 from alexhoshina/fix/cron-deliver-default-false
* c0bb8d6df9ea9e85e4f3e6f1640a8cf183e0e8a1 Merge pull request #1617 from yzxlr/codex/fix-1561-heartbeat-template-idle
* cefa140bd2c692149c1b987f066252e2911ecc0c Merge pull request #1622 from afjcjsbx/feat/markdown-output-format-web-fetch
* 729a878f730df58f9380b85f510a6222e3697ca2 Merge pull request #1636 from lppp04808/feat/subturn-poc
* f901218b4376e8c82da689570ae6fb2c86abbae7 Merge pull request #1640 from argobell/main
* 2f61440269d9f8139fa91c99157c43a90238222b Merge pull request #1645 from dimonb/fix/mask-bot-tokens-in-logger
* 8a8cc35645e324916721f066371cf6d01e02b9f4 Merge pull request #1663 from hyperwd/fix/glm-nil-input
* 11a7ee508006acb4798e9c366d0e03bdc09acb4c Merge pull request #1690 from Alix-007/docs/issue-529-exec-guard-limitations
* 513537d23053d092d52816d3b576aebd7c3bbe14 Merge pull request #1702 from Alix-007/fix/issue-1153-model-round-robin-cleanbase
* 7bf12c3d5f56d60643aedd88747472f45ea0130a Merge pull request #1710 from liuy/fix/cron-test-subscribe-outbound
* 8a188cf7fcdf2653ff1446621758ae1e2bda25db Merge pull request #1759 from afjcjsbx/docs/add-italian-language
* 7a47d7a55c3f026b0f6a17f0cb73b651eb2f9db9 Merge pull request #1782 from biisal/chore/docker-data-in-gitignore
* 71ce21963ba7b2a23c0a922a62945a870c2cbf72 Merge pull request #1798 from sipeed/dependabot/github_actions/goreleaser/goreleaser-action-7
* ffe0289f774e869ef119f386dfec6fe4a3cd4216 Merge pull request #1799 from sipeed/dependabot/github_actions/docker/setup-qemu-action-4
* 100720bb74bbc40e8564dff196b8eae54cd19267 Merge pull request #1818 from Alix-007/fix/issue-1815-empty-response-message
* 54de9ade7d54240a30c1f5dee72b5b48d73e28f7 Merge pull request #1822 from alexhoshina/feat/agent-eventbus
* 73a683fd161d729728bd497b7d88ff0054739035 Merge pull request #1827 from alexhoshina/refactor/agent-loop
* 75cfee46de1720b429574771b7a17bd4276bc47e Merge pull request #1832 from taorye/main
* 04def0f10b252a0b16c95d4646f232cd9e8143a6 Merge pull request #1844 from afjcjsbx/fix/scope-steering
* 931eee92a04c12ac0615081a7a711e9f95fc6ed3 Merge pull request #1853 from kunalk16/feat-configurable-logger
* e6ea9c4ff341b822d5fec081ae04b59d1276d21a Merge pull request #1855 from badgerbees/fix/telegram-group-id-validation
* 9107740781540eb3778d3bfd3d25409caa254c36 Merge pull request #1857 from lc6464/main
* 5286464bfc94a8372c1bd11f9c7af6a2df3ca1b3 Merge pull request #1861 from amirmamaghani/feat/agent-browser-skill-heavy-dockerfile
* 0432facffc15c2ce1af24b1a2bf0a9095d98b744 Merge pull request #1863 from alexhoshina/feat/hook-manager
* 3cd674e3b85a7a6ca6720c595c34c11b09db1caa Merge pull request #1865 from sipeed/revert-1752-feat/exec-tool-enhancement
* 3a618923131a11c6d0f70d6790e1d380e157d796 Merge pull request #1875 from BeaconCat/docs/readme-restructure-v2
* e7ee80ff32861c0704a26de731be7bff6015aff4 Merge pull request #1878 from uiYzzi/feat/provider-extra-body-config
* 2f6f25dc58aa61ccb4d1e290889bbe496a9a4185 Merge pull request #1882 from lc6464/frontend-fix
* 809aef87d7718d594bf5dea0f7adb3856173740f Merge pull request #1885 from alexhoshina/fix-1884-qq-long-audio-file-fallback
* 2a0efb6e527cd44f465688ecbe17a9eb901b45d3 Merge pull request #1889 from afjcjsbx/fix/binary-tool-output-handling
* 3500080abbf9937b31dd7e7401d41451a608e9f4 Merge pull request #1891 from RussellLuo/audio-transcription
* 054b55fdfc80910777108d2f85ba6b27b9c24883 Merge pull request #1893 from afjcjsbx/feat/skill-channel-commands
* 4d84bd90cdf3456943e0087e833ee023c50366ce Merge pull request #1894 from sipeed/refactor/agent
* 2c48cd346136faddbf28864bda28048df5fe5020 Merge pull request #1907 from xiwuqi/wuxi/fix-reasoning-channel-content
* c3285625b01d173de974d30bc455221c81963235 Merge pull request #1918 from cytown/panic
* 96e312680df4c86a81440ecd8f35f6f74884da57 Merge pull request #1926 from cytown/fix
* 40571996b1ce51a02ee07794f510c87b08619bce Merge pull request #1930 from uiYzzi/feat/filter-sensitive-data-from-tool-results
* 69cf9342e1c3875b440340e537de03401bfa733c Merge pull request #1938 from huaaudio/fix/weixin-load
* 3d20976803a5ea08f0a4ed14504c74260028b66a Merge pull request #1948 from cytown/fix-doc
* 1b9445b806dd92fd215e5b8fd0a41c61163561b2 Merge pull request #1955 from alexhoshina/refactor/wecom
* ff50ffa12310096896d948da477aeb01b4eeb895 Merge pull request #1962 from wj-xiao/fix/configure-pico-channel
* 8da0638ee3331b5177ffc80ff6a0123fe3442402 Merge pull request #1976 from alexhoshina/refactor/wecom
* eee74f3d97374dce990a1a5a650d7e90fcefdf79 Merge pull request #1977 from uiYzzi/fix/virtual-models-bug
* aa9bd69f6e43b4bafae1bd60a23a6249fbda676d Merge pull request #1985 from wj-xiao/refactor/split-systray
* 5f50ae5e76296b65e7c0a23f2c7248745a5b8fa7 Merge pull request #1997 from wj-xiao/fix/freebsd-build
* 440bc2687e943dd5dd4cc0f7b8b153a6a33b1794 Merge remote branch fix/1323-telegram-endless-typing
* e00a3d9017165c4f90e339682a992e78cd6a09f6 Merge upstream/main into feat/subturn-poc
* 310358d3da9fa69d87d2ee9239633752acd8a4d2 Merge upstream/main into fix/1323-telegram-endless-typing
* 608ec6d329291f301b08a10b003f4cbc99d387c1 Move minimax reasoning_split injection to provider factory
* 53c6dd3812408444f4561463611495665e5bc514 Move minimax reasoning_split injection to provider factory
* de0364c8ec7bd829be81d27db9a1acda97324484 Move minimax reasoning_split injection to provider factory
* 998b456b6529cd30ed584ec18614b029f454a2e4 Remove UI components and gateway management for picoclaw-launcher-tui
* 12c01327dd77ffcd4a7409bf9a0174a7169058d8 Remove redundant Darwin tray stub (#1694)
* ebcd5645f1e0cebace2ec48f9ad3aa7b348c4970 Revert "feat(tools): add exec tool enhancement with background execution and …"
* cf80ec8382be709e9737441de02adfcc3fa290f6 Update config_test.go
* b6c5f587c93c3d3507c8ca9b328c8b8ab0725a0e Update qrcode of wechat group (#1744)
* d1d2155edbe63d8569f394966e01220d1db04b27 Use ModelName instead of Model in test config structs
* 79df9386964651e4a711aae318dee3abfa28b1f2 Use getter/setter methods for API key access in ModelConfig
* 2d9517c6550297428044286c1a6f954e16edb01a Use getter/setter methods for API key access in ModelConfig
* fa5ab720226e5c76e3ee553087c196dcb1302b1a WeChat Web QR Code Integration (#1961)
* e41423483e46aa8fb506bbe1c9b4bf735ff39c4d add systray ui for all platform (#1649)
* 7359b2c86c27108377b74bff5be960d54370f85f add testcase for migrate from v0 to v1
* d921bbb66727519d769df707f67817b6b3579c43 bug fix for security initial cause can't save model in launcher (#1952)
* afe22c5adf882238f371c60f6d07c48889579433 bug fix: gateway should not start when gateway server is not running (#1562)
* 0499cdab72ea13f74100b9bcf57d9cf88a4ba1d4 build: use WEB_GO for web targets and preserve backend dist directory (#1671)
* 40279c8dde65757973aa9ae9472c9c28986e94a2 chore(config): move loglevel settings under gateway (#1912)
* 77d0c67e58c44c26ef44cbf9e0756eb9d52e606d chore(deps): bump @tabler/icons-react in /web/frontend (#1803)
* 4178b2cec5028ab0b86cc0bdd5c0ff0c2ffbca9f chore(deps): bump @tanstack/react-router in /web/frontend (#1609)
* 68d182a26ee09819a0ed690a67a1823c3862381d chore(deps): bump Go toolchain to 1.25.8 for stdlib security fixes (#1821)
* f247c3bc00cb8bba874712535ce07de8c6b1b613 chore(deps): bump actions/setup-go from 5 to 6 (#1600)
* 44ac304e5b122bac7fbc9c9b6699ff335f0da0e2 chore(deps): bump actions/setup-node from 4 to 6 (#1597)
* 99304d1f8e779294439660a443d5d45e5832cd9a chore(deps): bump dayjs from 1.11.19 to 1.11.20 in /web/frontend (#1608)
* b7b8d1eeca7a750f3c42820727135dca8f080ced chore(deps): bump docker/build-push-action from 6 to 7 (#1602)
* 0c94e6f7b3d2a19d4e0f85bb1b5647dda14355e0 chore(deps): bump docker/login-action from 3 to 4 (#1604)
* 4d4243b919accb4969f2cfe71011e4a9989b80d5 chore(deps): bump docker/setup-buildx-action from 3 to 4 (#1595)
* 876898fec6d930afd824c1af0f848b680093942a chore(deps): bump docker/setup-qemu-action from 3 to 4
* 2f40a8c165810a88442630b231d25fbd17937ea3 chore(deps): bump github.com/anthropics/anthropic-sdk-go (#1601)
* e9d240d760bab164ceabf13f58f33d2909a45f37 chore(deps): bump github.com/caarlos0/env/v11 from 11.3.1 to 11.4.0 (#1599)
* 80d9a90c5217b80661915689f4e8a1775bd2551d chore(deps): bump github.com/ergochat/irc-go from 0.5.0 to 0.6.0 (#1800)
* 43eb6fe20c5670fa15ce261174e0c1a2ac1f3c80 chore(deps): bump github.com/github/copilot-sdk/go from 0.1.23 to 0.1.32 (#1603)
* dd936302d1223613693c7942364eb4d4d8597b4f chore(deps): bump github.com/mymmrac/telego from 1.6.0 to 1.7.0 (#1598)
* 45c01f4d91bd2f1ec7d0945fbca09372571850b9 chore(deps): bump golang.org/x/oauth2 from 0.35.0 to 0.36.0 (#1596)
* 5ada0dfed35c6c67bd9da7d2050da9cb5629fd11 chore(deps): bump goreleaser/goreleaser-action from 6 to 7
* b8dfd0befc44233c2193f599797aa0c0a781c687 chore(deps): bump jotai from 2.18.0 to 2.18.1 in /web/frontend (#1605)
* c9ac19c0ccb589746c597ad1b3cc52952ea4f431 chore(deps): bump maunium.net/go/mautrix from 0.26.3 to 0.26.4 (#1805)
* 3bf8a27570112488d1a0f0bdec892e80dee23fb3 chore(deps): bump react-i18next from 16.5.4 to 16.5.8 in /web/frontend (#1607)
* 1fd6dd1ffbca5c79da0fb7680b5147a29f914c84 chore(deps): bump shadcn from 4.0.5 to 4.0.8 in /web/frontend (#1808)
* cff85cfe5cb818099b9cbe2d1362c2f668952760 chore(deps): bump tailwindcss from 4.2.1 to 4.2.2 in /web/frontend (#1809)
* bda18f5ee4d269dca524a5e3541223896514818a chore(deps): upgrade eslint dependency chain to resolve flatted vulnerability (#1820)
* fe87376d6a6f95c2a3028d963f87cfc45748d30d chore(deps): upgrade modelcontextprotocol go-sdk to v1.4.1 for security fixes (#1823)
* 736baf2217b2b71d30a7bfd15d5cd1200d5ae52b chore(deps-dev): bump @types/node in /web/frontend (#1806)
* a93bd0132933b6a6251395ca4fa8c6fcf67ab3aa chore(deps-dev): bump @vitejs/plugin-react in /web/frontend (#1606)
* 8a488eeeedf948ab6665f4ff1d4903dad31d198e chore(deps-dev): bump typescript-eslint in /web/frontend (#1807)
* ee03d1247d7b5c2e50c793ca53985e060e1a09f5 chore(tui): add build target for picoclaw-launcher TUI and create README for TUI launcher (#1995)
* c8065989b0f04336d94ed8aa815a5280778c7462 chore(web): upgrade eslint deps to resolve flatted vulnerability (#1629)
* 41ebe1e1c7ae64ce31bd35e8bbe81b4c392520b6 chore: Ignore the `docker/data` directory.
* 77d4716a82c9ae9dea8d07ecf83661db0c246b9c config: add baidu_search example to config.example.json (#1990)
* 08259d7e9a1bf7675e52c0344f8570faad628d0d docs(agent-refactor): add context.md for Track 6 boundary clarification
* da1fddc4f0ce0fe97a0b2c6c0e07f4032a805248 docs(exec): document build tool guard limitation
* 6148ccc52937fb12c1f943bc28a865dcca982dc1 docs(feishu): note that Feishu channel does not support 32-bit devices (#1851)
* 9978c9550bc03f70e17dbbac5256263cc7fd1fed docs(hooks): inline and translate hook examples
* 5790d3e9ddbd72855fab2dd882887f3514c30ec8 docs(it): add model command to CLI Reference
* 7f163658c9496c4c8f343c6f0be81709935dedc5 docs(matrix): Update docs
* 92678d1700c11738d4cd42c532a81a1e560aaa67 docs(voice): Update docs for audio-transcription
* 94fe54b9f6a6434afa1857b71dc45090826309b3 docs(wecom): align docs with unified channel
* b0bcf1d3c9258507decb92a3eec1551d9a92faa4 docs(wecom): update examples and docs
* 1236dd9e6db3edf29f28465017362b69eaaf5914 feat(agent): add concurrency semaphore and hard abort for SubTurn
* 337e43e5a5a2f0a12598a3ac982419bacdde0b15 feat(agent): add configurable hook mounting
* af61d0bca720340030fdc2afe2d858e57ff9a583 feat(agent): add event bus foundation
* cf68c91ecaa15c3518686e7cfa9c637fabfcbead feat(agent): add hook manager foundation
* acd436acfe66dc153443d77abd00673940229ad7 feat(agent): add session state rollback on hard abort
* 0e075f7300014e4d305c346f3555742e34cb8174 feat(agent): centralize turn lifecycle and continue queued steering
* 57cde73b36cc27da4f7979b5526eabaad0f0bfed feat(agent): expand event bus coverage
* 777230dcd134d59a36a7200b8004e7742792b822 feat(agent): implement /subagents command and fix sub-turn observability
* f8defe3ae1f19193843ab3fbefe667322ebf50e0 feat(agent): implement graceful finish vs hard abort for SubTurn lifecycle
* c639e2c21677aaff50796d2b68af3183d6d61fb5 feat(agent): include current sender in dynamic context (#1696)
* 50cc7100cee14247690bfb2690bf6fbea5be4e37 feat(agent): make event logs show event kind clearly
* ae23193295cd267856bc14de508baf86c11d736b feat(agent): port subturn PoC to refactor/agent branch
* 021aa7d6d534f18572c94671c019a62e4ec1ceb0 feat(agent): steering (#1517)
* ceeae15d8ad670b3f03ca430ef2811d98760f2b9 feat(agent): wire SubTurn into AgentLoop and Spawn Tool
* e760cb737c9d8d0a00faf5cb75c352fdba914a73 feat(auth): add wecom cli qr login
* adf1a5749df20704ca5de971f08e403683950c7e feat(config): add command pattern detection tool in exec settings (#1971)
* 7b9fdaec3229422fa9d81d3100eaea0ec8878acb feat(config): add exec controls and gate cron commands on exec settings (#1685)
* e35906bb1447b60b4836587d824b488698e12b14 feat(config): expose context_window in example config and web UI
* e73d9d959e823e7263f0474bd9c7abef46b565e7 feat(config): support multiple API keys for failover (#1707)
* 2f10b47f59f01a34ef989fd919d84c6212b5f0ad feat(credential): part1 add AES-GCM encryption, SecureStore, and onboard ke… (#1521)
* f776611e291b71785132ffba9fb34556eaff6a96 feat(cron): refactor scheduler to event-driven model and add unit tests (#1313)
* 9381da29bf488ccee95f1817fc4aab549b97364f feat(matrix): support encrypted messages with E2EE
* fab9603547a8a34f4316c0e7cd5f72dae924d84c feat(matrix): support encrypted messages with E2EE
* a4b5a9eec13077908d8dfe7d7b1a02f59056ea99 feat(mcp): per server deferred mode (#1654)
* 3b3062abe83f622601ddf048d1348197e8a3418a feat(models): add extra_body config field in model add/edit UI (#1969)
* 544940807f4eee0dc8dd136a79a85aa2eef23e87 feat(pico): add pico_client outbound WebSocket channel (#1198)
* 9a3ca8e54d4a224a2a782c6d4855c42bfe90a353 feat(provider): add Alibaba Coding Plan and regional Qwen endpoints (#1748)
* b787131c82d34f907c5664f4e84df92cec936282 feat(providers): add AWS Bedrock provider (#1903)
* a005e5bb7082b6e61fa6a2baeb6e1cac9f1e5ece feat(providers): add extra_body config to inject custom fields into request body
* 8a046e951a4ae0e2b1373b03de6bdca64414fa2f feat(providers): add extra_body config to inject custom fields into request body
* c7544f7cb99cbd0e474c5a38c456de9b05deffe3 feat(providers): add extra_body config to inject custom fields into request body
* f2985b8bee02e01034ee6a4670645323b7e507da feat(providers): add extra_body config to inject custom fields into request body
* 60a7098fd35b12a6893858b705405fcdd251bee9 feat(search): add Baidu Qianfan AI Search provider with i18n docs
* 16d23d8cdc7ce4ddfcbb8919c5a5d4ff3c9c7bb8 feat(security): add sensitive data filtering for tool results sent to LLM
* d7d2bf69bfc697e61bffc62e3dd61dd195d81e04 feat(skills): add channel commands to list and force installed skills
* ce311be70b86f45550db7c6bc2d5df741cc4c614 feat(subturn): add configurable runtime parameters under agents.defaults
* 99b189d3fb9090ef4dc031cdefd5f54ef7b07bba feat(subturn): implement token budget tracking for SubTurns
* 53404f18ca73d986c98c210df9cc9c71ca071608 feat(subturn): support stateful iteration for evaluator-optimizer pattern
* 71134babb9bd19a668bf5d60f1b3d2b5e95b07c1 feat(telegram): stream LLM responses via sendMessageDraft (#1101)
* ff975abec27314622139c7b1dec30b7342a458ff feat(tool): anti cloudflare challenge in web_fetch (#1762)
* 7673b626b3d23025e820e87ea7630e2fad5b7237 feat(tool): debug tool usage via channels (#1332)
* d5c2bc538a60dbaaccc5a644757575caa644677c feat(tool): markdown format in output web_fetch tool
* e931756feef9cf22353759e969e9171aac8eb4a6 feat(tool): overwrite flag in write_file (#1761)
* b402888bfacd559852d2c245d33b578d4d8e2e5a feat(tools): add SpawnStatusTool for reporting subagent statuses (#1540)
* f901af8cbc2d331fb500d24bf8b68a746538c4d9 feat(tools): add exec tool enhancement with background execution and PTY support (#1752)
* fcc20ec72ccc2f9c413aa46239c6ab21ac976e28 feat(tools): add tool argument schema validation before execution (#1877)
* 8ad4b9b497adca6ca150ab858975df8ce1d402b8 feat(voice): add audio-model transcription support
* aa3300c1bdb4756b85c9c095b6558ac2acb707d8 feat(web): Tool feedback on UI (#1933)
* eb307e942b828ed49176e0555178367b963c87b4 feat(web): add WeCom QR binding flow to channel settings (#1994)
* fcb69860c4807bbe1da4ef9144fc38fbcaf49fd9 feat(web): add configurable cron command execution settings (#1647)
* e6ebeaed13b544626c8bda1c7693689ff535813d feat(web): implement macOS app feature and file logger (#1723)
* 4d7a629b7996145ff16a662832261c3e8b7954ed feat(web): improve Weixin channel binding flow (#1968)
* b4468313e4510c4b68abb61e75be74d284e730ab feat(web): whitelist private fetch targets (#1688)
* 3b498d2e4b2b991c4c33cbc55e04d01cec307bbb feat(wecom): add channel-side streaming support
* c3631d84ba5ab68c7cb008681e317f32c728fba7 feat(wecom): send media via temp uploads
* 578f90855e031c2b45a3edaaac058612caf96b9b feat: Add Novita provider support (#1677)
* 2a6ade0fe46d3f2617d1e28742080cfd23361c67 feat: add /reload to gateway api and command (#1725)
* dd9adf8a044b6a2a3f06051792340459bf3ae842 feat: add ElevenLabs Scribe STT transcriber and Telegram SendVoice support (#1905)
* 08f305d7129c51d04e7b86359f7a439d00d63a85 feat: add IsLark field to FeishuConfig to switch between Feishu and Lark domains (#1753)
* 520391643b7062f62cd58e987433d79a81ea0f3b feat: add agent-browser skill and Dockerfile.heavy with full runtime
* 7b4d5d4513bc8669710df808995dcf92a5832c19 feat: add channels management page and integrate into home menu
* 8c44597c3dda8bda660b9a21e05f464813935a4b feat: add chat functionality to home page for interactive AI sessions
* 02da117199934a15bd5f152c4a063a997a055700 feat: add gateway management page to TUI and integrate into home menu
* 545b7afe41ecff8df64ed9464f48e95d93df1d4b feat: add model selection synchronization to main config in TUI
* ed47d5f7c301d2b76c98e8a11f0ac7f659debf3a feat: add onboarding command execution for non-existent config directory
* 8a44410e378b8a4e7789e2b3941001f4bddd5ad3 feat: add web gateway hot reload and polling state sync (#1684)
* 5a199ec9937bcc1d0e5172b1b9f4869de328a5ce feat: implement TUI configuration and user management for picoclaw-launcher-tui
* 8e3e517135e8278c5128688189209899448bd0f4 feat: render mixed Markdown+HTML in assistant messages and skills (#1900)
* 12f402961043692eadc27ac89c484c45b6604edd feat: telegram use parse mode ModeMarkdownV2 instead of ModeHTML (#1018)
* f735b0551cc80a21e2843f93ddad41fef5b882af fix
* 1e98f86fa9e203af3f7b3f7710e36e23d5a9da8f fix Ooutboundmedia
* 5d5536a1a64686ac53358d40b66bc5e3e8c238d7 fix delivery and steering
* 930dd028f16742f52f33f7d8cc5ee780aa022ff2 fix err and placeholder
* d77375721a78fec1a52ed94ba3c4e74da84641e4 fix for ci/cd
* affd77f989f7a8ec0f4092a5bdfc7539bb45747d fix for feat(web): implement macOS app feature and file logger (#1735)
* cf9e0496f7ec303c638f78b84dc03b59f3af5ecc fix launcher can't save model api_key issue (#1928)
* 388505d7e07388826dc9dc5f3cc5d360bbfc3c6c fix lint
* 827449aff35a3f517f6a4c80e58442a1f4c2af69 fix lint
* de68688c75dfb5d1cf50ad011bfbc1554b8b9d34 fix lint
* 8f460726cc8be61f14097b65314986117ea6e9e3 fix lint + error check
* 9e344594a2045faae5ce416f7af7f4879dbbf69f fix logic
* 6ea9636861059ea2addb5d8145c1142edbecf130 fix weixin config
* 1c6586681d9d5f1b6dc3708edd91fa55ca70554f fix(agent) scope steering
* 844a4eefc7ae1c26bb12490495c736d5bf3b8550 fix(agent): avoid process exit on exec init failure and add regression test (#1784)
* 8034ee7be13f891dd1e578390cad9bf09dbfa5e2 fix(agent): correct media token arithmetic and tool call double-counting
* 12a8590adab73ca9ea61d7a309d972f59f17dc30 fix(agent): enhance SubTurn robustness and fix race conditions
* edbdc3bcf106a60540348f01baa45d39a6627e00 fix(agent): findSafeBoundary returns 0 for single-Turn history
* 7868c5811aeb11f55638e17eb4b94d949a1812cb fix(agent): fix subturn panic result, hard abort rollback, and drain bus exit
* 9c65d78b07ca82b556dac227b57c76a58013527d fix(agent): forceCompression must not assume history[0] is system prompt
* c63c6449b4a3a9fbe15fb2a269eddddc8817084f fix(agent): forceCompression recovers from single oversized Turn
* 3611034795eb705b5d3ed8c5923ad436efade69c fix(agent): implement Critical flag, complete tools.SubTurnConfig, remove redundant subTurnResults
* d5fdd5ebd2644408d45a5525ead50b16938a5012 fix(agent): include ReasoningContent and Media in token estimation
* efd403242e8633dfbdf6b3a2c02840adfae338d1 fix(agent): preallocate messages slice in budget test
* 672d11c7d4939976e0741575069cd7cabf5e73f9 fix(agent): prevent double result delivery and panic bypass in SubTurn
* c7ea018a73dae733017ab71a0389c86c6e17725b fix(agent): prevent duplicate history during subturn context recoveries
* 276a0cb92cfaa886ac0332b533659365262472ae fix(agent): rebind provider after /switch model to (#1769)
* 6b5d7e3fd7f8fee8e6eb422fb1c0d7e07effe753 fix(agent): resolve critical race conditions and resource leaks in SubTurn
* 3c2d373a5cd2d70e67d6429357fbc8733905bc16 fix(agent): resolve race conditions and resource leaks in SubTurn
* e20ff43f8b178cdcc7ec55faafe9b5a9d0a65c0d fix(agent): resolve subturn deadlocks, panics and context retry state
* 336d5d4c0739b2c61f54fe0f06636385141339d6 fix(agent): route reasoning_content to reasoning channel
* 82d574eb7b85c16d97a1697b3224505d72a7c49d fix(agent): separate empty-response and tool-limit fallbacks
* 85dfb341a8aac4bea9dd851ec979554680001684 fix(agent): suppress heartbeat tool feedback (#1937)
* 1961aab85015d9f31a576ecd1b7556f59f0f7688 fix(agent): use ModelName in loop tests
* 4e3769e989108a22091d4f5ab9d96e2b53a5b7ac fix(agent): use ModelName in loop tests (#1923)
* 54654d279403018fdb0e1c6c41519fa8714f3e75 fix(anthropic): skip tool calls with empty names to prevent API errors (#1739)
* d014f3e989f82f292419edacaee622ddf189d1b0 fix(api): include auth header in local model probe (#1896)
* 3e33d1053c222dcb0400c39657aba776cadf086b fix(backend): add no-cgo tray fallback for darwin and freebsd (#1691)
* 51f8285f93fbc96aaa81b1fd9fc39ba0bcbc4820 fix(build): disable Matrix gateway import on freebsd/arm
* 2ccac1819cce45acadbd63c77df1f73e6bb6c944 fix(build): exclude matrix on unsupported mipsle and netbsd targets (#1975)
* ce1619051d1e043ae71786e01e752d4aa0263658 fix(chat): avoid full secret exposure for 7-char secrets (#1942)
* 7eaadfd273ebfb8db7bdeff253356f9da7aec0c5 fix(chat): preserve blank lines and add input hint
* 74a9dcaa5c8a5854e37c8c0e664380145db410e3 fix(ci): Make CI happy
* 56fb0dc4e3bbe0801490503e40992cc8cbd0c770 fix(claude_cli): surface stdout in error when CLI exits non-zero
* 38e1fe435a1a0431bd44452c50c22bd3f85b1c09 fix(config): model_list inherits api_key/api_base from providers (#1786)
* d23c24ce72977f3c87072813bde412ee7e8b9821 fix(config): normalize empty security config before save/load (#1956)
* 9fb01bc7f8d71e737d128c6b952e4434ccdc1c6f fix(config): persist disabled placeholder settings (#1902)
* cd48c3bde89ffcc66a1898657b9cd60dc805b274 fix(config): remove stale wecom security merge fields
* fcf406bf2e1a5039c0ce7b69af395aa0c8627733 fix(config): start model round robin from the first match
* f71eaaf7f8d8189319453314c157d3ab969798a4 fix(cron): default scheduled jobs to agent execution
* 61a899cfbce25ed07eac7f0e652069b5c550e3f3 fix(cron): update test to use OutboundChan instead of removed SubscribeOutbound
* 3e9b7ce9c130e0a1c5ebf880da3e728cb1b9fa3a fix(feishu): invalidate cached token on auth error to enable retry recovery (#1318)
* 5660b8f24b0bad7085b718e1c36868a534ca143c fix(heartbeat): ignore untouched default template
* bc0be17e88706299f5ec4b6bbe010aeb24df9cf4 fix(identity): support negative integers in isNumeric for Telegram group IDs
* fca01583bf7f8c31e7cdb37a653ae49007dca535 fix(lint): align VoiceConfig env tags
* b150d7d52329e14a7242e66d1481bea7a3717a0b fix(lint): fix gci import formatting in config.go
* 30db9939938b23e0d84231dfddfe9a41eb9432b1 fix(lint): fix golines line length in WebToolsConfig struct
* c786f35b3274d3af0de44479aac8593a2407549f fix(lint): fix golines/gci formatting in WebToolsConfig
* 95204dbf17451fbaf52551b87cc06530fc7d243a fix(lint): remove CGO_ENABLED=0 for lint and fix (#1989)
* 4bc64497e30939d77da0f77750c8dd9de7d08635 fix(lint): run golangci-lint fmt to fix golines/gci struct tag formatting
* 11b6b10d5947478e70c80acfc6c0841f8142bcca fix(linter): fix ci lint err
* 8fc36a4f9bdd4ea1c9784d2570102a5a1d16dd57 fix(logger): mask bot tokens in 3rd-party logger output
* 64ceb5ab760703b0b27e933f1a022f7b64de64aa fix(logger): show first/last 4 chars of bot token for identification
* 6aff5b7ccdb8c4c7541ffb825726c44c7c07f9c8 fix(pico): use O(1) session indexing and harden websocket concurrency handling (#1970)
* f81b44bf194927e28f2a87a0b2f091bdb8d78a4c fix(provider): deduplicate tool results and merge consecutive tool_result blocks for Anthropic API (#1793)
* 05c65d2fe70c16c9671194606d939c5fdd621519 fix(provider): skip empty anthropic tool names (#1772)
* 8d97896a0dfc485b6a8400d80b2859f852421aa3 fix(providers): handle nil input in GLM series tool_use blocks
* f06173a5e001b1d5815c0f4933feae20febd8b96 fix(qq): preserve filenames in file uploads (#1913)
* 2c317444c5ca423f7be1cc8f256e1f045f8e6110 fix(qq): send long audio as file
* a1e8ee56f0f199c786a2873408df4fde8c106e1f fix(telegram): improve HTML chunking and preserve word boundaries (#1651)
* dc037f0d79389d52f81c54a2c5177e0b24700251 fix(telegram): stop typing indicator when LLM fails or hangs
* 1984bb5bbdf784b7215f788da999636209368da3 fix(test): mock gateway health check in status tests
* e71ef3764d993fb7c571772b2ce809589f6f9166 fix(test): reduce blank identifiers to comply with dogsled linter
* df4f322f09239595bb9ddf163c885f936efff045 fix(tool): route binary outputs through the media pipeline.
* 1bc05e83927ad0f914e96d6546a016f6fb9fbc6f fix(tools): allow sandbox access to temp media files
* bb1a4145274c78e1b8267af89a1816cd7b0107f5 fix(tools): harden whitelist path resolution
* cef0f28881169fa52d9eadd8414e0cc3f2f18607 fix(tools): normalize whitelist path checks for symlinked allowed roots (#1660)
* 29a161e757e21122bf379b983eb31a65e6cf9bc6 fix(tools): prevent nil pointer dereference in spawn tools
* eb86e10e5c350f4b287dba56c0e942b8226573ac fix(tools): propagate tool registry to subagents (#1711)
* dea99da7d92ab9be6babc67b3bd83e59c9a62cad fix(web): auto-configure Pico channel on launcher startup
* 6e31f15467647b8880d6a696acbdfc01c292023e fix(web): ensure at least 40% of the characters are hidden for api key
* f1ac1a107263cfc1addab7b15bbf07a38c7bf0a6 fix(web): ensure at least 40% of the characters are masked for api key
* ffbcbea4dcd8be86716da2ef2c616a4217435293 fix(web): persist api_key when adding models (#1958)
* c513ad22d73a579bb3fb30efc5b012b07c71a32c fix(web): refactor pico chat flow and fix proxied websocket URLs (#1639)
* f93d2b453325f8529805c75f83717dbdd318b4be fix: Avoid failure of the main agent process due to tool call failures  (#1023)
* 9c31b0ca958e94cdf081cd30ee61be1806c51013 fix: Fixed the bug where the bus was closed and consumers had unfinished messages. (#1179)
* 71e2b636d66c9d30250f027085d142d93d4246be fix: Use secure defaults for Pico channel setup and stop leaking the token in the URL (#1563)
* 0fe058254cce304c5cacf2bf8ab2efc2dcc2b91c fix: add fallback DNS resolver for Android with multi-DNS support (#1835)
* 08fa9bb64b597c7e99f5c2466683d582dbb226e4 fix: agent triggered on empty message in telegram (#1927)
* 1f9d390a6414e5dd3fad662c094c8207e058000d fix: apply security credentials before config validation in web handlers
* b17cbe5234e7f8dc417a2bb351e9f2b2622a5e83 fix: apply security credentials before config validation in web handlers
* 2b3c95b1f19357c289419b06eba7528926200823 fix: lint err
* a65e0e95d618bc7437d80acb529a9568cce7b44c fix: lint err
* 11207186c8d99e4286ad8fb8a6e3c7dee0974c05 fix: proxy WebSocket through web server port (#1665)
* 724cc1bd33da83440bd78b815e6351fcea801a6e fix: resolve merge conflict markers in README files
* 48cba906cd46da1c118270d16abad23959c9c451 fix: restore missing assets and address Copilot review comments
* f12c09b767bb0a3bdd3ec546332a4018631a4a74 fix: retry on dimension failure for tg media upload (#1409)
* 1ace296b9128e6e8bc383d1db4670d95611b2189 fix: use fileEvent instead of event when appending fields for file logger
* df17684dd4bedb89a54b01a0dcd430670207ea54 implement panic log for gateway and launcher
* 3dfe484f664727ccdad5f0882c4d2a8d8a0dd979 make yaml indent with 2
* 88d754b172c3ed20a3f84f13ab5b236eb6e13ab6 merge main
* 24a382bc0a20146b8f155e6714d32317f611d41b merge main
* f7f27e237a88d7f7a1107926540b8216a507332e merge: resolve conflicts between refactor/agent and main
* c48954d32d78ae25551e63aca0479e2c25ddbda3 merge: sync main into refactor/agent
* a26a7db7d2fea1abb2e333c787f7ab2a7d3bcdc8 moved turnState and related code from subturn.go to a new turn_state.go file
* 1c123e016223d2a9e67c1427a08fd884c1e581bc refactor Config to add Version and migratable
* be4a33cc150c6ea0f41b3bd939b15dc526f84603 refactor gateway/helpers and add server.pid to health (#1646)
* 9c82b0baa224d419cb63ba986bdbb27e3c115785 refactor(agent): context boundary detection, proactive budget check, and safe compression
* 639739cb8512e7b3610015265f30197dbe421096 refactor(agent): use Turn as the atomic unit for compression cut-off
* 174fbba14c10cafe64010df36d2fc6f2d4375bab refactor(backend): add darwin no-cgo tray fallback (#1689)
* b9aaad95cd1770deeb7a78d9d137fc807c12a365 refactor(media): centralize temp media dir path
* 01c2f8d608a87c418b9d0a81a33094b35c1d8762 refactor(subturn): remove redundant system prompt handling in runTurn function
* 345452fba840d1839e82bab58f9e8894c4844abe refactor(tools): remove unused validatePath wrapper
* 4d2b24452232f438cd9d3cb320223d85fdbb42d1 refactor(voice): share audio format support and restrict transcriber selection
* a10036a7f1400b2ef29e4fa9a110b533580e56f8 refactor(web): clean up systray platform build files
* a1f95f02bce27788da2a6f2e2da1a8c8a5250f46 refactor(wecom): rebuild ai bot channel
* c07f5c948f6a849d6af38d0e389434904ed74943 refactor: centralize environment variable key constants (#1730)
* 119cc2e8e156454fa0cc0658ad9b8e3d112e6be1 refactor: enhance TUI configuration and user management with improved UI elements and concurrency
* 087e8519c5a3ba239a86dab8fd7e02f14f071c9f refactor: improve code readability and consistency across multiple files
* 670b433f1af38125e2257e63fde7a5185b7e173c refactor: replace interface{} with any for improved type clarity
* e455eb5e670e3d2a6e71df2800f45cc8458c40e0 refactor: seperate security.yml for store keys
* 955d6e70f19daed49245a12c21a1516692d180ce refactor: update interface types to use 'any' and improve code formatting
* a8ce9924290d3fe603cb01680c8d2fa255d51827 refactor[gateway]: just reload the changed channels on reload occurred (#1773)
* 482c88cd15a6b79e839e50c1ca69c997b4a779f8 remove merge conflict markers from .gitignore
* 4e876ebeee046463b073128538a836040bb36c5e remove useless logs output
* 310f788f5f675fecbea5b2de427efc02a8d5a4d0 rename security.yml to .security.yml
* be59133ce910fd380dd46fcc72f0069c728fe6ba resolve conflicts
* b90c5007f69b13fa633b47b7b9aeb9ddd2b73cc9 resolve conflicts
* 8ed171dbe62c8f6da56863a33a4ddd7a95505908 resolved conflicts
* 7c1a1c2c1a8554d29c11903103d231962ffdac4f style(agent): fix gci comment alignment in test
* 74a145c29114820a72bb94f56de6f2873334dc1c style: apply cyberpunk theme to TUI components for enhanced visual appeal
* b7f1c2b5fc39604bffaf5da688149460025ffbd4 test(agent): add realistic session-shaped tests for context budget
* f2f6987f00c57950b7cf2f1a2298f154e176051f test(agent): allow mock custom tool args (#1965)
* b768dab822bee2affa417d7318e68b8e9eec31b3 test(agent): use realistic session data in context retry test
* 1ef2b6903dbaeb07d026aa0170e398293aa7f83c test(web): add percentage checking of characters displaying in APIKey
* 66d2efc9d126d25c1ca7fd5926600b574158268e test(web): add test for maskAPIKey
* de11f95b6596ade5054b5d0348cab4d5d53511f2 update security migration documents


---
Released by [GoReleaser](https://github.com/goreleaser/goreleaser).