Changelog — July 21, 2026

The first release candidate of a rearchitected IronClaw. The release notes are blunt about what this is: not an increment on the 0.29.x line, but a ground-up rebuild of the agent runtime, storage, extension host, and web UI. The ironclaw binary is the new CLI now — the v1 monolith builds as ironclaw-legacy and is no longer published, so 1.0.0-rc.1 ships the rearchitected binary only.

There is no migration. No path for v1 config, databases, settings, or secrets. Installing the rc does not touch your existing v1 data, but you get nothing from it either. The documented procedure is to treat it as a fresh install: point IRONCLAW_REBORN_HOME at a new directory, run ironclaw onboard, and reconnect your providers and channels. The notes explicitly warn against pointing it at a v1 data directory.

What ships:

• Seven platform targets — macOS (Apple Silicon and Intel), Linux (x86_64/aarch64, both gnu and static musl), and Windows (x86_64), with shell, PowerShell, and MSI installers.
• Guided setup. ironclaw onboard provisions config, an encrypted credential store, an LLM provider with interactive key entry and a live probe, a WebUI login token, and — on macOS and Linux — the background service. The credential store's master key goes into the OS keychain when one is available, falling back to a locally cached key file.
• 26 model providers in the built-in catalog, including NEAR AI, OpenAI, Anthropic, Gemini, Bedrock, Ollama, OpenRouter, Groq, DeepSeek, and any OpenAI-compatible endpoint. Routes are managed with ironclaw models.
• Embedded web UI. ironclaw serve starts WebChat v2 with the frontend compiled into the binary — no separate asset deployment.
• 12 first-party extensions built in, including GitHub, Gmail, Google Calendar, Notion, Slack, and Telegram.
• Storage and services. File-backed libSQL by default with PostgreSQL as an option; native service management through launchd on macOS and systemd on Linux.

What is not there yet — this is the part to read before you plan a migration:

• No CLI equivalents for the v1 mcp, memory, pairing, import, and login subcommands — those roles move to extensions and the WebUI.
• Skills are list-only from the CLI. If you drive skills from scripts today, that workflow does not exist yet.
• Channel and hook listing plus logging commands return "not implemented yet" errors.
• History import is non-functional, and production deployment profiles explicitly error when skills or extensions are in use.
• Slack DM policy defaults changed from pairing to allowlist, and legacy Slack config fields are now rejected — channel setup moves to the WebUI.

Who should care: everyone running IronClaw, but not everyone should act. If you are on 0.29.x in production, the honest read is stay put — the CLI surface you rely on is partly missing, there's no data migration, and this is an rc. If you're evaluating IronClaw fresh, start here instead of on v1: the rearchitected binary is what 1.0 will be. Our IronClaw guides currently document the 0.29.x CLI and are being reviewed against this release; treat /ironclaw/setup/, /ironclaw/configuration/, and /ironclaw/skill-allowlisting/ as v1 documentation until we say otherwise.

IronClaw 1.0.0-rc.1 release notes → Affects: /ironclaw/, /ironclaw/setup/, /ironclaw/configuration/, /ironclaw/security/, /ironclaw/skill-allowlisting/, /ironclaw/vs-openclaw/

A very large release — roughly 2,245 commits and 1,065 merged PRs since v0.18.0, with about 3,300 issues closed and 450+ community contributors. It also rolls up the v0.18.1 and v0.18.2 infrastructure patch tags, so those windows are documented here rather than separately. The theme is latency:

• First-token time down ~80%. Cold-start "Initializing agent..." used to burn ~4.3 seconds before your first turn reached the model; it's now ~0.9s, and the cut applies to the CLI, gateway, TUI, desktop app, and cron alike. Reasoning models now stream their thinking live by default instead of leaving you on a spinner, and the response box paints per token rather than per line.
• Desktop app speed overhaul — a ~20-PR wave: 14× faster streaming markdown rendering, virtualized diffs, and faster session switching. The TUI also renders markdown incrementally now.
• Smart approvals are on by default. An independent LLM review judges flagged commands instead of routing every one to you, and there are new user-defined deny rules. This is a behavior change worth a look if you deliberately kept a tight manual approval loop — see /hermes/security/.
• Password-manager secret sources. Bitwarden and 1Password now plug straight into Hermes through a new SecretSource interface, so credentials don't have to live in a plaintext env file.
• Live subagent transcripts + durable delivery. You can watch background task workers as they work, and a durable delivery ledger means a finished response survives a gateway crash instead of vanishing.
• Profile-based message routing. A single gateway can now route different Discord servers to isolated profiles with separate configs and skills — previously that meant running separate gateways.
• Billing from the terminal. New /subscription and /topup commands manage a Nous plan from the CLI or TUI without opening a browser.
• New models and providers — GPT-5.6 (Sol, Terra, and Luna variants), Fireworks AI, DeepInfra, plus the latest Claude, grok, and kimi models.

Who should care: every Hermes operator. There are no documented breaking changes, so this is a straightforward upgrade — the speed work alone changes how the tool feels. The two things to check after upgrading are smart approvals (now judging commands you previously approved by hand) and whether you want to move secrets out of env files into a password-manager source.

Hermes v0.19.0 release notes → Affects: /hermes/, /hermes/setup/, /hermes/tasks/, /hermes/memory/, /hermes/discord-gateway/, /hermes/security/, /hermes/vps-install/

One new setting and a long list of fixes, several of which are worth knowing about:

• New sandbox.filesystem.disabled setting — skip filesystem isolation while keeping network egress control. Useful when filesystem sandboxing fights your toolchain but you still want outbound traffic constrained. Note the tradeoff: you are turning off one of the two walls.
• Long sessions are fast again. Message normalization cost was growing quadratically with turn count, producing multi-second stalls and slow resumes in long sessions. Fixed.
• Auto mode no longer breaks on token rotation. Commands were being denied with "HTTP 401" classifier errors after the OAuth token expired or rotated mid-session.
• Worktree-isolated subagents can't escape any more. A subagent could redirect git into the shared checkout via git -C, --git-dir, or the GIT_DIR/GIT_WORK_TREE environment variables — defeating the point of worktree isolation. Also fixed: worktree sessions landing in another project's leftover worktree when the working directory didn't match the selected project, and background sessions with no git repo in their worktree being undeletable.
• claude daemon stop --any could kill an unrelated process via a stale legacy daemon lockfile. Fixed.
• Bash permission checking now handles compound statements with redirects inside && lists or negations — previously a gap in how commands were classified for approval.
• AskUserQuestion behaves. It was telling Claude to continue even when your answer asked it to wait or explain first; free-text answers now get neutral wording. Claude Code on the web also stops re-asking the same question and dropping your answer after an idle gap.
• Assorted fixes: @-mentions silently attaching nothing after file-modifying hooks; vim dot-repeat of c-operators and paste; statusline running twice on resume; resume-picker hangs on failure; resumed background agent sessions reverting to the default agent instead of restoring the agent's prompt and tool restrictions; Esc-Esc at an idle prompt not opening the rewind picker in long sessions with background tasks; and Ctrl+X twice in the agent list failing to delete a session.

Who should care: if you run long sessions, upgrade for the normalization fix alone. If you use worktree isolation as a safety boundary for subagents, the git-redirect fix is a genuine hardening — worth upgrading promptly rather than at leisure.

Claude Code v2.1.216 release notes → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/security/, /claude-cowork/, /claude-cowork/setup/

A pre-release focused on the Agent Manager and codebase indexing:

• Per-model reasoning effort in Compare Models (#12401) — compared worktrees can now run the same prompt at different effort levels, with the selected effort shown next to the model name in the collapsed selector. That makes "is xhigh actually worth it here?" a thing you can answer empirically instead of by feel.
• Agents can stop and remove a targeted Agent Manager session (#12271) — cleanup no longer has to be manual.
• Custom file-extension allowlist for codebase indexing (#12306) — limit scans to relevant project files, or add text formats the default set misses. Worth configuring on large repos where indexing cost is real.
• JetBrains context settings (#12292) — compaction and file-watcher ignore patterns are now configurable.

Who should care: Agent Manager users, and anyone indexing a large or polyglot repo. This is a pre-release — if you're on the stable channel it'll reach you later.

Kilo Code v7.4.13 release notes → Affects: /kilocode/, /kilocode/orchestrator/, /kilocode/models/

Sixteen commits on main, including the release changelogs for both v0.0.89 and v0.0.90. The v0.0.90 entry (#7269) was written ahead of its tag, so treat v0.0.90 as documented-but-not-yet-shipped. Its themes are managed-image routing, provider-reset recovery, WhatsApp health reporting, and DGX Station guidance.

The change to act on:

• Managed inference route selector renamed (#7189): the managed Hermes and Deep Agents images declared the route selector as ARG/ENV NEMOCLAW_PROVIDER_KEY. The name looks like a secret, so Docker BuildKit --check reported SecretsUsedInArgOrEnv — a false positive, since the baked value is a non-secret route identifier (inference, openai, custom) and no credential ever enters a layer. It's now NEMOCLAW_INFERENCE_PROVIDER_ID. Pre-existing custom images keep working for one release through a dual-read migration window (NEMOCLAW_INFERENCE_PROVIDER_ID || NEMOCLAW_PROVIDER_KEY || default), and the build-argument allowlists accept both names for now. If you maintain a custom Dockerfile, rename it before v0.0.91. Note that the identically-named legacy host credential bridge keeps the old name deliberately — that one is a real ambient credential and must stay out of image layers.

The rest, in brief:

• Credential recovery from wrapped attachment errors (#7232) — provider-reset recovery for wrapped OpenShell attachment diagnostics.
• WhatsApp channels status reports the paired in-process bridge (commit) instead of showing nothing paired.
• status recommends start for crashed-sandbox recovery (#7222) — the previous suggestion sent people down the wrong path.
• Onboard endpoint provenance preserved (#7242) and stale agent primary model refreshed on config restore during rebuild.
• DGX Station installer work continues — the qualified Station DKMS revision is retained (#7214), an idle PackageKit no longer blocks install (#7241), and host preparation now requires hardware evidence in CI. Station support is still Deferred.

Who should care: anyone who builds a custom managed image — you have one release to rename the build arg. WhatsApp channel users get accurate status output. Everything else is recovery-path polish and Station groundwork.

NemoClaw commits → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/local-gpu/, /nemoclaw/switching-providers/