What's Changed

✨ Added

PawApp Platform

• PawApp SDK & Kanban App: A new mini-app platform that lets plugins build rich interactive UIs on top of QwenPaw. Ships with a built-in Kanban task board app for project management (#6150)

Custom Agent Modes

• User-editable Agent Mode: Create and edit custom agent loop modes directly from the console — define iteration limits, stop conditions, and approval gates without touching code (#6270)
• Oh-My-Paw Plugin: Five ready-to-use Agent Loops (UltraQA, Ralph, Ultrawork, Autopilot, Team) for multi-agent collaboration and long-running tasks (#5882)

Memory & Observability

• ReMe Light index maintenance: Explicit index rebuild via console button or API, improved startup self-repair, and optimized Markdown chunking for large documents (#6235)
• ReMe reliability improvements: Runtime memory stats inspection, CJK embedding safety, and background summarizer graceful shutdown (#6098)
• ReMe indexing safeguards: Enhanced configuration validation and indexing stability (#6153)
• Langfuse trace enrichment: Traces now carry user ID, session ID, and package version for better filtering and analysis (#5922)
• History retention config: Scroll context retention days now configurable from the console (#6214)

Console & Desktop

• Chat archiving: Archive old conversations to keep the session list clean (#6078)
• Drag-and-drop file upload: Drop files directly into the chat input area in the desktop app (#6327)
• Plugin market sorting: Sort plugins by downloads, update time, or favorites (#6349)
• One-click agent config copy: Duplicate an agent configuration with a single click (#6262)
• Configurable log rotation: Set log file rotation limits from the configuration (#6183)

Security & Governance

• Windows restricted-token sandbox: Code execution isolated via Windows restricted tokens for an additional sandbox option (#5931)
• Governance rules: New governance rule definitions for finer-grained access control (#6215)
• Sensitive file detection: More file types detected as sensitive; global file reads now allowed by default for non-sensitive paths (#6067)

Runtime & Multi-Agent

• Multi-agent startup control: Bounded startup concurrency with partial-readiness indicator in the console (#6198)
• Silent cron delivery: Scheduled tasks can deliver results silently without notifications (#6080)
• Event metadata preservation: Plugin and extension metadata is now carried through real-time output envelopes (#6224)
• Readiness probe: New /api/healthz endpoint for health-check and container orchestration (#6028)
• Trusted proxy auth: Verify trusted proxies and resolve real client IPs for deployments behind load balancers (#6030)

CLI

• gh CLI allowed in governance: GitHub CLI commands are now permitted by the governance policy (#6031)

🔄 Changed

• The default ReAct loop is now modeled as a first-class DefaultMode, giving each mode explicit ownership of its lifecycle and gates (#6210)
• ACP slash commands decoupled from core, safety checks extracted into a standalone module, and bootstrap flow unified (#5796)
• Channel tool-call and tool-result display now have separate toggle controls (#6233)
• ToolGuard detection rules are now bridged into the governance policy engine for unified evaluation (#6390)
• DEFAULT_USER_RULES auto-sync no longer requires a manual whitelist (#6025)
• Tool approval button now uses toolSource instead of executionLevel for the "Always Allow" control (#6095)
• Agent reasoning optimized to reduce redundant thinking loops and duplicate tool invocations (v2.0.0.post4)

🐛 Fixed

Desktop

• Desktop app now gracefully shuts down the backend before exit, preventing lost memory and incomplete cleanup (#6225)
• Markdown links in desktop now open in the system browser instead of navigating the app window (#6300)
• Monaco editor loads from a local bundle for offline coding preview (#6291)
• WKWebView no longer pins a stale console frontend version (#6107)
• Tauri updates restricted to OSS builds only (#6071)

Runtime & Agents

• Reasoning content now correctly rotates on new reasoning blocks during streaming (#6310)
• Tool call arguments are streamed incrementally instead of buffering the complete response (#6343)
• Sub-agent approvals now route and resolve from the root session correctly (#6295)
• Fixed input validation failures that blocked Oh-My-Paw parallel workflows (#6395)
• Stopped tasks now wait for proper cleanup before signaling completion (#6347)
• Background chats are properly registered; legacy runner removed (#6272)
• Reasoning output and tool segments are now correctly aligned (#6280)
• Per-request model override now properly honored (#5731)
• Malformed tool-call input is surfaced to the model for self-correction (#5761)
• Doom loop thresholds fine-tuned to reduce false positives (#6184)
• Use max_completion_tokens for reasoning models (#6015)
• Whitespace in streaming thinking/text deltas preserved correctly (#6166)
• Images no longer stripped for multimodal models when model info lookup fails (#6154, #6217)

Console & UI

• Tool output copy works in all browser contexts including non-HTTPS (#6275)
• Skills list refreshes automatically after installing from the market (#6296)
• One-time tool approval is now prioritized over session-level settings (#6357)
• Inbox badge shows count for all pending approvals, not just high/critical ones (#6391)
• Stale media preview errors are cleared; relative-path images handled correctly (#6385)
• Dark mode text contrast improved for loop templates and chat history (#5975)
• Browser autofill no longer triggers on provider search input (#6011)
• Chat message queue clears correctly when a session is deleted (#6045)
• Skills page scroll loading no longer stops after the first batch (#5968)

Governance & Security

• Disabled audit logging is now properly honored (#6369)
• Plugin tools are unregistered on unload; ToolGuard safety checks shared correctly across contexts (#6311)
• Oh-My-Paw workflow mode isolation hardened with per-workspace instances and fork/deny-all gate fixes (#6317)
• Plugin tool defaults refresh on registration; tool type validation added (#6313)
• Tools auto-register via @tool_descriptor and PluginApi (#6190)
• Stale OFF-mode sandbox state properly cleared (#6122)
• Frontend tool-guard rules now bridge into policy deep scan (#6063)
• Sandbox preserves venv PATH in shell execution (#6081)
• sandbox_enabled switch honored in OFF-mode sandbox path (#6109)
• Sudo commands now properly ask user for permission (#6079)

Memory

• Automatic memory restricted to external user queries only (#6120)
• auto_memory_interval can be set to 0 to disable auto memory (#6135)
• Dream schedule toggle added (#6171)
• Memory summary task history properly bounded (#6206)
• Windows-safe session ID encoding for ReMe file storage (#6022)

MCP

• ${VAR} headers migrated to env credential refs during driver migration (#6091)
• Legacy MCP migration made one-shot via schema watermark (#6133)
• MCP access policy updates apply immediately (#5949)
• Workspace startup no longer blocked by MCP connection timeout (#6174)
• Fallback namespace in MCP tool name sanitized for OpenAI compliance (#6209)

CLI & Channels

• cron update now preserves untouched runtime and request fields (#6236)
• SIP, Matrix, and Slack channel state properly bounded to prevent memory leaks (#6207)
• Telegram polling no longer enters 409 conflict loop (#6005)
• Bounded channel state and fire-and-forget task tracking to prevent memory leaks (#6168)
• TUI crash fixed when clicking streaming output (#6069)

Observability

• Langfuse trace IDs now use valid hex format (#6277)

Other

• Model slot override passes correctly through the console channel to the model factory (#6304)
• Local model GGUF check adapted to ModelScope SDK key change (#6290)
• Tauri entry point uses absolute imports (#6234)
• File reference check no longer crashes on OSError (#6247)
• Stale session cleaned up after goal completion (#6086)
• Stop gates reset on /new and /clear commands (#6094)
• Context limits hardened with recoverable tool-result compaction (#6123)
• GBK encoding compatibility in command execution on Windows (#6140)
• Multi-layer orphan tool-result message defense (#5989)
• Regex shorthands in tool schema patterns expanded for GBNF compatibility (#6216)
• Browser use now has a maximum wait time to prevent indefinite hangs (#6170)
• Token usage cache no longer persisted when unseeded (#6220)
• Skill-hub related memory leakage fixed (#6208)
• Redundant nvidia-smi probe removed from VRAM detection (#6204)
• Windows VBS headless launchers stay windowless with conditional UAC elevation (#6127)
• file:// URIs in DataBlock resolved to local paths before formatting (#6191)
• Gzip-encoded JSON responses handled in download catalog (#6106)

⚡ Performance

• Tool call argument fragments are joined once instead of per-token reassembly (#6346)
• Synchronous I/O operations no longer block the async event loop (#6378)
• Session history migration writes batched for faster startup (#6021)

🧪 Testing

• E2E: tool-approval level cases added (#6334)
• E2E: agent cases adapted to the actions redesign (#6333)
• E2E: selectors adapted for v2.0.0 UI redesigns (#6185)
• Integration: access-control, fork, coding-mode, and agent-status coverage (#6213)
• Runtime/security/install regression tests (#5813)
• Console vitest with coverage in nightly full sweep (#6194)

🏗️ Infrastructure

• Unified release orchestrator: web release now gates on desktop build completion (#6329)
• Desktop workflows hardened with legacy dead code removed (#6110)
• CodeQL 2-shard security scan and Dependabot added (#6027)

New Contributors

• @alvinlee518 made their first contribution in #5922
• @Gmgge made their first contribution in #6296
• @patrick-andstar made their first contribution in #6357
• @splash-li made their first contribution in #6277
• @liu6yi1 made their first contribution in #6140
• @AaronZ345 made their first contribution in #6080
• @Yigtwxx made their first contribution in #6204
• @Marlin-Phone made their first contribution in #5975
• @feng183043996 made their first contribution in #5968
• @tadebao made their first contribution in #5989

Full Changelog: v2.0.0...v2.0.1