ZeroClaw v0.8.5 — Relay, Router, and Harder Boundaries

ZeroClaw v0.8.5 is a security, connectivity, and operator-experience release — 454 commits from 73 contributors — that gives the runtime two new ways to reach the world and a much harder shell around everything it already does. ZeroRelay and ZeroRouter ship together, chat grows up, provider support widens, and the plugin, skill, sandbox, and webhook boundaries all close by default.

Highlights

• ZeroRelay and ZeroRouter — ZeroRelay is a secure transport with blind forwarding, native mTLS enrollment, bounded admission, and per-node routing: the relay never sees what it carries. ZeroRouter becomes a first-class provider preset with a public model catalog, and new defaults point at the hosted beta.
• Chat and dashboard — several independent conversations per agent, the same agent open in multiple tabs, image upload with attach-or-drop through a bounded gateway endpoint, queued-message recovery, transcript copy, and read-only SOP status and run views with authenticated cancellation.
• Providers — Anthropic gains opt-in live thinking display (signed reasoning is kept only for replay), Grok Build ACP and Atlas Cloud become first-class providers, OpenRouter attribution and streaming metadata survive the round trip, compatible providers get a tool-result image policy, and replay-safe empty streams are retried once instead of surfacing as errors.
• Channels, SOP, and MCP — progress drafts for Matrix and Telegram, visible lifecycle progress for Slack, WhatsApp Web ported to the registry-backed stack with approval requests and fail-closed group allowlists, Telegram reply threads preserved in history, structured SOP failure causes, and MCP resource blobs materialized under an aggregate budget with per-server CA trust.
• Plugins and skills — typed instance configuration is now required, tool secrets are scoped, egress policy on wasi:http is owned by the host, plugin exports are bounded by wall-clock time, skills inject compact prompts by default, and skill HTTP execution fails closed.
• Security and supply chain — plugin wasm_path traversal is rejected before discovery (GHSA-93f6-34w8-5g98), the Wasmtime sandbox escape is patched, Landlock allowed_roots tiers and forbidden_paths are enforced, webhook ingress requires authentication with verified WhatsApp Cloud and Linq requests, and secrets are redacted from logs, audit exports, and URL queries.
• Release engineering — routine builders move to Rust 1.98 while the source floor stays at 1.96, release tools use pinned binaries, MUSL and multi-architecture Alpine coverage expands, and the 23-crate workspace publishes to crates.io through a protected, resumable job.

The project also moved house: the site now lives at zeroclaw.com and the docs at docs.zeroclaw.com, with the old domain redirecting.

Upgrade notes

This release removes or narrows several deprecated surfaces: typed plugin configuration is mandatory, skill HTTP requests are fail-closed, the legacy [node_transport] section is retired, TodoWrite display settings move to ZeroCode's config, the WATI channel is gone (move to WhatsApp Cloud or WhatsApp Web), the Aardvark transport and legacy robot-kit crates have left the workspace, and contributor scripts must use -p zeroclaw instead of -p zeroclawlabs. Read the breaking-changes section of the release notes before upgrading plugins, skills, node integrations, or WATI deployments.

Everything else: zeroclaw update and you're done.