ironclaw binary; release
candidates are not listed. For full commit-level notes, see the
GitHub releases page. This site
always documents the latest stable release — docs for earlier releases
live in their git tags, such as
ironclaw-v1.0.0.
v1.4.0
Notifications, background subagents, and a sandbox that holds still.
- A durable notification inbox — runs publish authoritative outcomes and actionable gates to a per-user inbox instead of vanishing into a transcript, and the WebUI notification center reads from it. Approvals and auth prompts you missed are still there when you come back.
- Background subagents — a parent turn can spawn children that run and deliver on their own, with per-child delivery, activation provenance, and a derived cap on autonomous wakes. Healing sweeps recover children whose parent went away.
- Persistent per-user sandbox containers on the local-Docker profile — a user sandbox is a durable container reached over Docker Exec rather than a fresh process per call, so container-local installs and state survive between commands. The Railway preview profile still runs an ephemeral worker per command and keeps only its checkpointed workspace. On both, sandbox egress is routed through a managed per-user proxy, and extensions can declare direct-exec credential bindings that stay behind it, so secrets are never handed to sandboxed code.
- Run-now for automations, plus exact run capability facts, so a scheduled automation can be exercised and inspected without waiting for its schedule.
- Suggestions you can act on — generated over your own no-approval, read-only tools, gated on extensions you have actually connected, and surfaced in onboarding with refresh and connect entries.
- Google Docs semantic editing, and conversation artifacts now carry run timing evidence.
- Fewer stalls and fewer surprises — structured finalization is bounded, OpenAI-compatible reasoning-only responses survive, provider failures and auth diagnostics reach the model as readable context instead of opaque errors, and libSQL write-lane starvation no longer cascades through the resource governor as unrelated tool failures.
- Telegram separates workspace-bot pairing from personal device linking, and Slack delivers the unlinked-user connect nudge privately with a one-click link.
IRONCLAW_REBORN_SSH_PUBLIC_KEY to an
OpenSSH public key enables public-key-only login as user agent on container
port 2222, which must be published to be reachable. Note that agent shares
uid 1000 with the ironclaw runtime user, so an SSH session holds the full
runtime identity — treat the private key like shell access to the service.
IRONCLAW_REBORN_WORKSPACE_ROOT is honored on both CLI boot paths; neither it
nor IRONCLAW_REBORN_HOME may be set to the filesystem root. New sandbox knobs:
IRONCLAW_REBORN_SANDBOX_PROXY_IMAGE and
IRONCLAW_SANDBOX_EXTRA_ALLOWED_DOMAINS.v1.3.0
Your model, your automations, fewer writes.
- Per-user model preferences — pick your model in Settings, the CLI, or a chat command, and it follows you across chat and channels. Admins bound the selectable set with a tenant-scoped model policy.
- Automations you can trust to stay quiet — scheduled runs carry a validated execution contract instead of a free-form prompt, and a run with nothing to report finishes silently rather than delivering filler.
- Document editing — structural edits to
.docx,.xlsx, and.pptx, plus PDF rendering from HTML. - Telegram linked devices — pair your personal Telegram account with the bot so the agent can read your conversations and act as you. Reads are live and IronClaw keeps no mirror of your Telegram history; what the agent reads in a run is retained in that conversation’s transcript, like any other tool result.
- The complete Slack messaging vocabulary — edit and delete messages, add and remove reactions, open DMs, read a message, resolve a user, list members.
- Memory that actually recalls — retrieval ranks by relevance instead of demanding every word of your question appear in the saved fact, and broken memory no longer looks like empty memory.
- Faster, quieter runs — opt-in parallel tool batches, Anthropic prompt cache breakpoints, and a large reduction in per-turn database writes.
- Context-window eviction now compacts instead of dropping your task, an unavailable tool call is repaired instead of ending the run, and secrets bound for the model are redacted without rejecting the turn.
- Under sustained write load on libSQL, database contention no longer surfaces as unrelated tool calls failing with a resource error.
reactions:read, reactions:write, and im:write. There is no scope-upgrade
flow, so an account connected before this release answers those three tools
with a permission denial until you disconnect and reconnect Slack; the other
13 operations are unaffected. Removed: the standalone missions, routines,
and admin analytics placeholder pages in the WebUI, and the retired IronLoop
network settings.v1.2.0
Shared channels that just work.
- Presence-based admission — add the bot to a Slack channel or Telegram
group and it is served, with nothing to configure: the
slack_allowed_channels/telegram_allowed_channelsallowlists and the shared-subject settings are gone. - Genuinely shared conversations — a Slack thread or Telegram group/topic is one continuous conversation every paired participant shares, and each message still runs as the person who sent it: their identity, memory, settings, and approval gates.
- Slack channel context — pinging the bot at the top level of a channel gives the run recent channel history; pinging inside a thread gives it that thread. Context is fetched host-side and framed as untrusted quoted content, never as instructions.
- Unpaired users who ping the bot in a shared conversation get a connect notice as a reply on their own message instead of silence.
- Every parked approval or auth gate is announced individually, in the live conversation and the background automation lane alike.
- The runtime container image now ships
curl, so orchestrator HTTP healthchecks pass; Windows first-start filesystem publication and release smoke runs are fixed.
slack_allowed_channels, telegram_allowed_channels,
slack_shared_subject_user_id, slack_subject_routes) are removed —
admission is presence-based. Previously stored shared-channel notification
preferences fail closed; DM delivery targets are unchanged. A gate prompt
delivered but not yet acknowledged when this version deploys re-announces
once.v1.1.0
Extension reach and legible failures.
- Custom MCP servers — register a hosted MCP server from the WebUI and use its tools like any other extension, with bounded tool discovery and auth resolved during registration.
- IronHub install flow — install extensions from an IronHub deep link, including private packages.
- Durable file attachments that cross channels.
- Slack
/ironclawslash commands. - A broad pass on making failures legible: the model is told what to do next instead of hitting an opaque stop, and users get localized, actionable errors instead of silent dead ends.
/webhooks/slack/events compatibility alias.Full release notesv1.0.0
First stable release of the rearchitected IronClaw — a ground-up rebuild
of the agent runtime, storage, extension host, and web UI, shipping as the
ironclaw binary on seven platform targets.Not an in-place upgrade from 0.29.x: there is no migration for v1 config,
databases, settings, or secrets. Treat it as a fresh install — point
IRONCLAW_REBORN_HOME at a new directory, run ironclaw onboard, and
reconnect your providers and channels.Full release notes