@hybridaione/hybridclaw 0.12.5 → 0.12.6

package/AGENTS.md

@@ -21,7 +21,7 @@ HybridClaw is a personal AI assistant bot for Discord, powered by HybridAI.
 Enterprise-grade Node.js 22 application with gateway service, TUI client, and
 Docker-sandboxed container runtime.
 
-**Version:** 0.9.7  |  **Package:** `@hybridaione/hybridclaw`
+**Version:** 0.12.6  |  **Package:** `@hybridaione/hybridclaw`
  |  **License:** see `LICENSE`
 
 Architecture: gateway (core runtime, SQLite persistence, REST API, Discord
@@ -45,8 +45,9 @@ src/
   agent/                Agent execution: conversation loop, tool executor, prompt hooks, delegation
   audit/                Append-only audit trail, approval tracking, hash-chain integrity
   auth/                 HybridAI and OpenAI Codex authentication flows
-  channels/discord/     Discord integration and delivery logic
+  channels/             Channel transports (discord, slack, telegram, email, whatsapp, msteams, voice, imessage)
   config/               CLI flag parsing, runtime config management
+  doctor/               Doctor checks and resource hygiene maintenance
   gateway/              Core gateway service: HTTP APIs, health, session mgmt, approvals
   infra/                Container setup, IPC (file-based), worker signatures, runners
   memory/               SQLite database, semantic memory, compaction, consolidation, chunking

package/CHANGELOG.md

@@ -1,6 +1,79 @@
 # Changelog
 
-## [Coming up]
+## [0.12.6](https://github.com/HybridAIOne/hybridclaw/tree/v0.12.6)
+
+### Added
+
+- **Twilio voice channel**: Added a built-in Twilio ConversationRelay phone
+  channel with inbound webhook handling, outbound `hybridclaw gateway voice
+  call <number>` support, admin-console setup, and a dedicated setup and
+  troubleshooting guide.
+- **Salesforce skill**: New bundled skill for enterprise CRM integration with
+  OAuth token binding, a dedicated `secret` CLI surface for credential
+  management, and hardened field-level configuration.
+- **Local skill import**: `skill import` now accepts local filesystem
+  directories and `.zip` archives as sources, with persistent import-source
+  markers so locally-imported skills retain personal trust across restarts.
+- **Admin approvals policy console**: New `/admin/approvals` interface for
+  viewing and managing approval policies from the browser.
+- **Console chat UI**: Migrated the legacy standalone chat UI into the console
+  React app with unified channels selection and improved upstream error
+  handling.
+- **Doctor resource hygiene**: `hybridclaw doctor` now includes a resource
+  hygiene maintenance pass that detects and cleans stale gateway artifacts,
+  with cached DB snapshots and disk-state diffing for efficient checks.
+- **Fetch Email-Config button**: The admin email channel editor includes a
+  one-click button to fetch and validate HybridAI mailbox credentials.
+- **XLSX skill creation script**: Bundled creation script prevents silent
+  generation failures when the xlsx skill produces spreadsheet output.
+- **ToggleGroup component**: New `ToggleGroup` / `ToggleGroupItem` UI
+  primitive used across the admin console for binary-toggle controls.
+- **Provider health panel**: Inline login action and inactive-provider
+  collapse in the admin console for quicker provider triage.
+
+### Changed
+
+- **Per-channel instructions in `/admin/channels`**: The admin console now
+  lets operators edit transport-specific prompt guidance, and runtime config
+  exposes the same values under `channelInstructions.*` so channels such as
+  voice can enforce spoken-output rules without editing prompt files directly.
+- **OAuth token domain binding**: Bearer tokens are now bound to their OAuth
+  issuer domain to prevent cross-domain exfiltration, and the gateway proxy
+  auto-captures tokens using config constants instead of raw environment
+  variables.
+- **Secret CLI simplification**: Removed the `[--raw]` option from
+  `secret show` and `secret set`, streamlining the operator-facing surface.
+- **CI pipeline split**: Unit tests now run as parallel lint and test jobs
+  with a shared `setup-node-workspace` composite action and PR-level
+  concurrency groups that cancel stale runs.
+- **Security scanner hints**: Block messages now include actionable override
+  hints so operators understand how to respond to policy violations.
+- **DRY provider utilities**: Refactored model-matching and `agentId`
+  normalization into shared provider utilities with prefix-aware matching.
+
+### Fixed
+
+- **Voice approval and relay handling**: Spoken approval replies normalize more
+  reliably, voice turns skip the usual yellow implicit wait, and the Twilio
+  relay path handles disconnect, interrupt, and runtime-unavailable cases more
+  cleanly instead of dropping into noisier failure states.
+- **Memory-flush pool slot leak**: Host processes spawned during memory-flush
+  no longer leak worker pool slots, and empty sessions are cleaned up
+  automatically.
+- **Stream terminated retry**: Terminated stream errors are now retried
+  correctly, preserving PDF creation workflows across transport retries.
+- **Skill scanning and promotion**: Runtime-created skills in agent workspace
+  directories now appear in `/skill list` and are promoted to the managed
+  directory on save.
+- **Teams webhook resilience**: Missing Teams credentials on incoming webhook
+  requests are handled gracefully instead of crashing the handler.
+- **AuthProvider callback stability**: Stabilized React `AuthProvider`
+  callbacks with memoized context values to prevent unnecessary re-renders.
+- **Upstream error mapping**: Nested HybridAI error payloads are unwrapped
+  and mapped to `502` responses to avoid gateway auth confusion, with
+  `no-store` cache headers on error responses.
+- **Skip-skill-scan persistence**: The `--skip-skill-scan` CLI decision is
+  now persisted so the runtime guard honors it across restarts.
 
 ## [0.12.5](https://github.com/HybridAIOne/hybridclaw/tree/v0.12.5)
 

package/README.md

@@ -19,9 +19,9 @@ security, and operational visibility. It combines sandboxed execution, secure
 credentials, approvals, persistent memory, and admin surfaces behind a single
 gateway.
 
-Connect it to Discord, Slack, WhatsApp, Telegram, Microsoft Teams, email, or the web. Run it
-locally, deploy it for business workflows, and keep your agents, secrets, and
-data under your control.
+Connect it to Discord, Slack, WhatsApp, Telegram, Microsoft Teams, email,
+Twilio voice, or the web. Run it locally, deploy it for business workflows,
+and keep your agents, secrets, and data under your control.
 
 [Quick Start](https://www.hybridclaw.io/docs/getting-started/quickstart) ·
 [Installation](https://www.hybridclaw.io/docs/getting-started/installation) ·
@@ -78,7 +78,7 @@ Open locally:
 
 - Chat UI: `http://127.0.0.1:9090/chat`
 - Admin UI: `http://127.0.0.1:9090/admin` for channels, versioned agent files,
-  scheduler, audit, and config
+  scheduler, audit, config, and channel-specific instructions
 - Agents UI: `http://127.0.0.1:9090/agents`
 - OpenAI-compatible API: `http://127.0.0.1:9090/v1/models` and `http://127.0.0.1:9090/v1/chat/completions`
 
@@ -94,7 +94,7 @@ Once the gateway is running, open HybridClaw locally:
 
 - Web Chat: `http://127.0.0.1:9090/chat`
 - Admin Console: `http://127.0.0.1:9090/admin` for channels, versioned agent files,
-  scheduler, audit, and config
+  scheduler, audit, config, and channel-specific instructions
 - Agent Dashboard: `http://127.0.0.1:9090/agents`
 - or connect Slack, WhatsApp, Telegram, Discord, Microsoft Teams, Email
 
@@ -103,11 +103,19 @@ Once the gateway is running, open HybridClaw locally:
 - `/admin/agents` edits allowlisted bootstrap markdown files such as
   `AGENTS.md`, keeps saved revisions, and restores earlier versions from the
   browser.
+- `/admin/channels` edits transport config, encrypted channel credentials,
+  Twilio voice settings, and per-channel instructions that are injected into
+  prompts at runtime.
+- `/admin/approvals` manages approval policies from the browser.
 - `hybridclaw tui` includes a keyboard-driven approval picker and prints a
   ready-to-run `hybridclaw tui --resume <sessionId>` command on exit.
+- `hybridclaw doctor` checks runtime health including resource hygiene
+  maintenance for stale gateway artifacts.
 - `hybridclaw onboarding` and related local setup flows can restore the last
   known-good saved config snapshot or roll back to a tracked revision when
   `config.json` becomes invalid.
+- `hybridclaw skill import` supports community sources, local directories,
+  and `.zip` archives.
 - Channel delivery stays predictable: email seeds its first mailbox cursor from
   the current head instead of replaying old inbox mail, retry-aware transports
   honor server `Retry-After` backoff, and WhatsApp startup avoids intermittent
@@ -161,7 +169,7 @@ Once the gateway is running, open HybridClaw locally:
 
 ## Architecture
 
-- **Gateway service** (Node.js) — shared message/command handlers, SQLite persistence (KV + semantic + knowledge graph + canonical sessions + usage events), scheduler, heartbeat, web/API, loopback OpenAI-compatible API, and channel integrations for Discord, Slack, Microsoft Teams, Telegram, iMessage, WhatsApp, and email
+- **Gateway service** (Node.js) — shared message/command handlers, SQLite persistence (KV + semantic + knowledge graph + canonical sessions + usage events), scheduler, heartbeat, web/API, loopback OpenAI-compatible API, and channel integrations for Discord, Slack, Microsoft Teams, Telegram, iMessage, WhatsApp, Twilio voice, and email
 - **TUI client** — thin client over HTTP (`/api/chat`, `/api/command`) with
   a structured startup banner that surfaces model, sandbox, gateway, and
   chatbot context before the first prompt, an interactive approval picker for
@@ -191,6 +199,7 @@ Browse the full manual at
 - Channels:
   [Connect Your First Channel](https://www.hybridclaw.io/docs/getting-started/first-channel),
   [Overview](https://www.hybridclaw.io/docs/channels/overview),
+  [Twilio Voice](https://www.hybridclaw.io/docs/guides/twilio-voice),
   [Discord](https://www.hybridclaw.io/docs/channels/discord),
   [Slack](https://www.hybridclaw.io/docs/channels/slack),
   [Telegram](https://www.hybridclaw.io/docs/channels/telegram),

package/config.example.json

@@ -14,6 +14,7 @@
       "msteams": [],
       "slack": [],
       "telegram": [],
+      "voice": [],
       "whatsapp": [],
       "email": []
     }
@@ -21,6 +22,16 @@
   "tools": {
     "disabled": []
   },
+  "channelInstructions": {
+    "discord": "",
+    "msteams": "",
+    "slack": "",
+    "telegram": "",
+    "voice": "This is a live phone call. Produce plain spoken text only.\nKeep each reply short and conversational, usually one or two short sentences.\nAbsolutely no markdown, bullets, numbered lists, headings, code fences, tables, JSON, or decorative formatting.\nDo not narrate internal reasoning, planning, tool usage, or stage directions. Say only what the caller should hear.\nDo not spell punctuation, formatting marks, or raw URLs unless the caller explicitly asks for exact characters.",
+    "whatsapp": "",
+    "email": "",
+    "imessage": ""
+  },
   "adaptiveSkills": {
     "enabled": false,
     "observationEnabled": true,
@@ -157,6 +168,25 @@
     "ackReaction": "👀",
     "mediaMaxMb": 20
   },
+  "voice": {
+    "enabled": false,
+    "provider": "twilio",
+    "twilio": {
+      "accountSid": "",
+      "authToken": "",
+      "fromNumber": ""
+    },
+    "relay": {
+      "ttsProvider": "default",
+      "voice": "",
+      "transcriptionProvider": "default",
+      "language": "en-US",
+      "interruptible": true,
+      "welcomeGreeting": "Hello! How can I help you today?"
+    },
+    "webhookPath": "/voice",
+    "maxConcurrentCalls": 8
+  },
   "imessage": {
     "enabled": false,
     "backend": "local",
@@ -459,6 +489,29 @@
   },
   "scheduler": {
     "jobs": [
+      {
+        "id": "resource-hygiene",
+        "name": "Resource Hygiene",
+        "description": "Runs conservative doctor-based resource hygiene twice daily and auto-applies only safe cleanup.",
+        "schedule": {
+          "kind": "every",
+          "at": null,
+          "everyMs": 43200000,
+          "expr": null,
+          "tz": "UTC"
+        },
+        "action": {
+          "kind": "system_event",
+          "message": "resource_hygiene_maintenance"
+        },
+        "delivery": {
+          "kind": "last-channel",
+          "channel": "",
+          "to": "",
+          "webhookUrl": ""
+        },
+        "enabled": true
+      },
       {
         "id": "morning-standup",
         "name": "Daily Standup Report",