ShibaClaw AI Agent Releases v1.0.1 with Security Enhancements

What changed

ShibaClaw has released version 1.0.1, a security-focused update that also marks its milestone 1.0.0 as a production-ready agent framework. The release addresses a high-severity vulnerability (GHSA-rgj7-g3m4-5g8c) in the WhatsApp bridge plugin by upgrading the sharp dependency to 0.35.4, which resolves an issue in the upstream libheif library. This update also includes a comprehensive upgrade of the RAG stack to LangChain 1.4+ and related libraries (langchain-core>=1.6.2, langchain-openai>=1.6.0, langchain-text-splitters>=1.1.2), resolving known security advisories and ensuring compatibility with modern AI development practices.

Key new features in this release include an interactive memory manager accessible via a new WebUI panel and REST endpoints (/api/memory). This allows for live inspection and editing of long-term knowledge (MEMORY.md), user preferences (USER.md), session history (HISTORY.md), and dream diary entries (DREAM_DIARY.md), complete with token budgeting and a safe quarantine redaction feature. The human-in-the-loop interaction has been enhanced with structured ask_user multi-choice prompts, secure request_credential vault isolation, durable update_progress visual cards, faster session_search, and dynamic per-session sandbox permissions (full, workspace, readonly).

Security has been further hardened with per-execution ContextVar tool scoping to prevent cross-session concurrency leaks, and incognito sessions now strictly purge JSONL logs from disk and bypass memory consolidation. Automated fail-closed profile model allowlists are implemented to prevent unauthorized model fallbacks. The framework now features modular packaging with optional extras ([desktop], [audit], [rag], [server], [full]), enabling sub-second startup times through lazy plugin and channel discovery. A new shibaclaw doctor [--fix] diagnostic tool is also included.

Why it matters for builders

This release significantly bolsters the security posture of ShibaClaw, a critical factor for self-hosted AI agents handling sensitive data. The upgrade to LangChain 1.4+ ensures developers are working with a stable and secure foundation, while the prompt-injection wrapping and SSRF protection built into the core engine provide immediate security benefits. The enhanced memory management system offers builders more granular control over agent knowledge and state, crucial for developing reliable and predictable AI applications. Furthermore, the improved human-in-the-loop capabilities provide safer and more structured ways for agents to interact with users and sensitive information.

Practical impact

Developers can now leverage a more secure and stable version of ShibaClaw for their AI agent projects. The immediate next step is to upgrade to v1.0.1 to benefit from the security fixes, particularly the vulnerability patched in the WhatsApp bridge. Builders working with sensitive data should explore the new memory management features, including the interactive WebUI panel and REST endpoints, to better manage and secure agent knowledge. The enhanced human-in-the-loop interactions, such as masked credential requests and structured prompts, offer safer ways to integrate user input and sensitive information into agent workflows. The modular packaging also allows for leaner deployments, potentially improving startup times and resource usage.

Caveats and source limits

The source provides detailed release notes for version 1.0.1, including specific security fixes and new features. However, it does not include independent benchmark results for the performance improvements or security enhancements. Information regarding pricing, specific hardware requirements beyond Python 3.12+ and Docker, or detailed comparisons with other AI agent frameworks is not present. The release notes mention a fresh release status, but specific adoption metrics or community feedback are not detailed in the provided excerpts.