Know exactly what this site describes.

The attention-and-access release. Two themes: One place for everything waiting on you. The inbox stops being a message list and becomes the single attention surface — a goal loop that needs a decision, a proposed skill, and a tool approval you walked away from all land there as items you can answer in place, instead of a toast that scrolls past while the work stays stalled. Delivery becomes a choice per kind of notification (notify / badge / digest / never) rather than one global severity floor, with a daily digest for the noisy kinds. Reach your own assistant from anywhere. Sessions now survive a restart (they didn't — every restart logged you out, and away from home that meant locked out), and an optional password sign-in with 2FA and device pairing lets a browser anywhere get in. It is off by default and purely additive: the local token link keeps working and remains the way back in, so a login you misconfigure cannot lock you out of your own box. Plus: artifacts get a real library, knowledge gets shelves and a proper tag taxonomy, the agent navigates code by symbol instead of grepping blind, backups run and verify themselves, and 👍/👎 on AI judgments starts actually teaching. > Note (0.x clean break): model bindings in active_models.json now carry > ordered fallback-chain semantics. Old stores read cleanly (a single binding is a > one-entry chain); consider personalclaw snapshot before upgrading, per the > pre-1.0 banner. > > Note (0.x clean break): true rewind adds a rewound field to persisted chat > messages (the retained discarded tail). Old sessions read cleanly (missing field = > today's behavior — no migration); consider personalclaw snapshot before upgrading. > > Note (0.x clean break): knowledge-item tags move from a JSON column into their own > tables, and the old column is dropped. Opening your library migrates it in place — the > upgrade is verified against duplicates, blanks, non-ASCII and malformed values, and > refuses to drop the column if any tag would be lost. Consider personalclaw snapshot > before upgrading, per the pre-1.0 banner. > > Note (0.x clean break): the unread badge now counts unresolved inbox items instead > of unacknowledged notifications, so it resets once on upgrade — any old unacked toasts > stop contributing to it. Nothing is lost: the notification list keeps its full history and > becomes a delivery audit. The badge is more honest afterwards (dismissing a toast no longer > hides work that is still outstanding, and handling something in the inbox actually clears > it). Your inbox alert keywords move to notification rules automatically. Consider > personalclaw snapshot before upgrading, per the pre-1.0 banner.

• Sign in from outside your home network. Reaching your own dashboard while away used to mean being at the machine — the only way in was a token link you had to mint locally. You can now set a password (personalclaw auth set-password) and turn on a sign-in page, so a browser anywhere can log in for a session. It is off by default and it is additive: the token link and the loopback paths keep working exactly as before, and they stay the way back in if you ever forget the password — a login you misconfigure cannot lock you out of your own box. Optional 2FA (personalclaw auth totp setup) adds a time-based code. Failed attempts are rate limited with a lockout, and every attempt is recorded in the audit log.
• Pair a phone without typing your password into it. personalclaw auth enroll prints a short code you enter once on the other device. It works exactly once, expires in five minutes, and is stored only as a hash — so the worst case for a code you lose on a screen is that you run the command again.
• Sessions survive a restart. Previously every gateway restart invalidated every token: on a local box you re-ran personalclaw token, and away from home you were simply locked out, because minting a URL required being at the machine. The signing key and the session records are now persisted (both 0600). personalclaw auth revoke --all ends every session, and that survives a restart too.
• Hardening for an internet-exposed instance. Set dashboard.public_url when you reach the dashboard through a TLS-terminating tunnel and the session cookie gains Secure, the WebSocket policy allows wss:// to that host, and proxy headers (X-Forwarded-For / X-Real-IP) are honored only from an address you list in dashboard.trusted_proxies. That last one closes a real hole: those headers used to be trusted based on the shape of the peer address, and on an exposed box any container neighbour sits on a private address and could have moved a session's bound address. A local install is unaffected — nothing changes until you declare a public URL. The new remote-access guide walks the whole setup and is explicit about what it does not protect you from.
• One place for everything waiting on you. The inbox is no longer just messages: a goal loop that needs a decision, a proposed skill, and a tool approval you walked away from all land there as items you can answer in place — instead of a toast that scrolls past while the loop stays stalled. Filter chips show what kind of attention each thing wants, and a row deep-links to the loop or chat it came from.
• Per-notification-kind delivery rules. Settings → Notifications now has a row per kind of notification with four choices: notify, badge (keep it in the list without interrupting), digest (batch it into a daily summary), or never. Previously the only control was a global severity floor, so quietening one noisy kind meant raising the bar for everything. Keyword and name-mention alerts became per-kind conditions, which means they now work for loop requests and proposals too — not just channel messages.