v1.8.0

Stable · 2026-07-12 · Previous stable v1.7.0

The big things this release

v1.7.0 was a productionization pass — it made long tasks visible, closed the approval loops, and opened the knowledge base as an API. This release turns the employee outward: it ships Content Studio, the first flagship scene built end-to-end on MateClaw's own primitives, and it teaches the browser agent to see and act by reference instead of guessing at pixels.

In one line: v1.8.0 is where MateClaw stops being a toolbox and becomes a doer of a whole job — from a one-sentence brief to a WeChat Official Account article sitting in your draft box, or a Xiaohongshu (RED) note packaged as ready-to-post vertical cards.

The big things:

• Content Studio — one sentence to a publishable post. A seeded "Content Studio" employee runs the full pipeline: pick a topic → research → draft → illustrate → de-AI → lay out → deliver. Two platforms ship first-class: WeChat Official Account (公众号) image-text articles and Xiaohongshu (小红书) image-first notes.
• De-AI-ification you can measure. A heuristic AI-trace score (no LLM, deterministic) flags the tells — uniform sentence length, template connectors, filler phrases, list abuse, vagueness — and the employee rewrites against them in a detect → rewrite → re-check loop, capped at 3 rounds so it never spins.
• A publish chain hardened for real operation. Body images are auto-uploaded into WeChat so nothing links out and breaks; API secrets are AES-GCM encrypted at rest; the WeChat service instance and access token are reused and persisted (no more token-limit collisions); the chain retries transient failures and translates known WeChat error codes into actionable Chinese hints; a fallback cover guarantees a draft is never cover-less.
• A content calendar that dedups and remembers. Every delivery is scanned for compliance and recorded automatically — no reliance on the model remembering to. A topic fingerprint stops the daily cron re-picking the same subject, and a read-only Content Calendar page shows what's drafted, packaged, published, or failed.
• The browser agent sees by reference. A new accessibility-tree ref snapshot lets the agent read a page as stable ref handles and interact by ref — click/type the element, not a screenshot coordinate. Real-browser use gains privacy guardrails, with a controlled CDP escape hatch for the cases that need it.
• Sharper attention, tighter loops. Employees get attention anchoring & environment awareness — MCP tool provenance, pinned skill constraints, and event notifications — plus a tool-call loop guard and a post-mutation verify reminder so a stuck agent gets caught and a change gets checked.

Plus: a first-token-and-bundle fast-load pass (initial load down ~78%), a chat context-occupancy panel with per-source breakdown, cross-KB wikilinks and raw-material batch operations in the Wiki, MCP progress notifications for long-running tools, a new Volcano Engine Agent Plan provider, a configurable pip index for skill Python scripts, and the public Docker stack on PostgreSQL 16.

That's it.

---

1. Content Studio — one sentence to a publishable post

MateClaw already had every atom of content creation: web search, page fetch, image generation, HTML-to-image rendering, structured memory, cron, and the skill runtime. What was missing wasn't a tool — it was an orchestrated pipeline that turns "write me something about X" into a finished, on-platform artifact. That pipeline is Content Studio.

A seeded Content Studio employee (内容工作室) ships bound to the right skills and tools, with a system prompt that fixes the seven-stage workflow:

① Topic → ② Research → ③ Draft → ④ Illustrate → ⑤ De-AI → ⑥ Layout → ⑦ Deliver

• ① Topic comes from your long-term interests in structured memory, plus fresh web search — or from a daily "topic radar" cron.
• ② Research fetches reference articles and summarizes the angles, so you differentiate rather than rehash. WeChat article URLs go through a dedicated wechat_article_extract tool that cleans mp.weixin.qq.com pages into structured {title, author, time, body, images}.
• ③ Draft follows platform-native structure and honors your persona and style memory — so from the second post on, you never re-explain your voice.
• ④ Illustrate generates a cover and section images.
• ⑤ De-AI runs the measurable rewrite loop (see §2).
• ⑥ Layout produces the platform artifact.
• ⑦ Deliver stops at the outward, irreversible step for your confirmation before anything leaves the machine.

Two platforms ship first-class:

Platform	Skill	What you get
WeChat Official Account (公众号)	gzh_article	An inline-styled HTML article (the editor doesn't honor <style> blocks, so every style is inline), a cover sized for the header, section images, a compliance self-check — deliverable to paste, or pushed straight to your draft box via gzh_publish.
Xiaohongshu (小红书 / RED)	xhs_note	An image-first package: a four-part title, short-sentence body with topic tags, and at least 3 vertical 3:4 cards (cover + content + closing) rendered from HTML templates with an online preview. xhs_package hard-validates the ≥3-image rule.

Because layout is just HTML, the AI can create and refine templates by conversation — render a preview, look at the PNG, refine, and persist reusable custom templates into your own editable skill (built-in skills stay immutable).

_{Content Studio producing a 小红书 note from one brief — the measurable de-AI score, the auto-recorded content-calendar item, and the generated vertical cards in the Run Overview rail. See Content Studio for the 公众号 flow and the calendar.}

See Content Studio and Skills.

---

2. De-AI-ification you can measure

The differentiator of the whole scene is that "de-AI" isn't a vibe — it's a measurable loop.

A heuristic script (ai_trace_score, pure Python, no LLM, deterministic and regressible) scores text 0–100 and returns the specific signals and spans:

Signal	What it catches
Burstiness	Sentence-length variance too low → uniform = machine
Connector density	"首先/其次/然后/综上所述/值得注意的是…" template cadence
Filler phrases	"在…的今天/让我们/随着…的发展/赋能…" boilerplate
List / dash abuse	Over-structured, generated-looking layout
Paragraph evenness	Mechanically equal paragraph lengths
Concreteness gap	Too few numbers, names, first-person, time/place = vague

The employee then rewrites against the signals — colloquial, first-person, concrete detail, varied sentence length, filler cut, tone tuned per platform (公众号 measured, 小红书 lively) — and re-scores, looping until it clears the bar or hits max_rounds = 3 (then it keeps the best version and tells you the score, instead of burning tokens forever).

This is a heuristic quality boost, not a guarantee of bypassing any AI detector — the skill and the output both say so.

See Content Studio.

---

3. A publish chain hardened for real operation

Getting a draft out once is easy; running it every day for three months is where the real problems live. This release audits the publish chain line by line and closes them.

• Body images no longer break. WeChat doesn't fetch external images in article bodies, so a draft full of /api/v1/files/generated/… links used to publish with every inline image broken. The chain now parses the HTML, uploads each body image into WeChat as an article image, and rewrites the src — a failed upload keeps its original src and is reported rather than blocking the whole article.
• Secrets are encrypted at rest. weixinoa.app_secret and other sensitive settings are stored AES-GCM encrypted (key from MATECLAW_SETTING_KEY, with a machine-derived fallback), ciphertext carries an enc:v1: prefix, and legacy plaintext is read transparently and upgraded on next write.
• One WeChat service, one token. WeChat allows a single valid access token per appId and rate-limits token fetches. The service instance is now cached per appId with a persisted token, so repeated calls and multi-instance deployments stop stepping on each other; changing the secret invalidates the cache.
• Transient failures retry; known errors speak plainly. The chain retries retryable WeChat error codes with backoff, and translates known ones into actionable Chinese hints — e.g. "add the server's public IP to the Official Account whitelist" for an IP-whitelist error.
• A draft always has a cover. If the cover can't be resolved, a built-in placeholder cover is rendered so the draft still lands, and the response tells you a placeholder was used.

Publishing stays draft-box-first: mass-send and publish are outward, irreversible, and rate-limited, so MateClaw drafts and you hit "publish" in the Official Account backstage. The optional publish action is gated through the approval flow.

See Content Studio and Channels.

---

4. A content calendar that dedups and remembers

The weak spot in any "the model should also log this" design is that the model forgets. This release welds compliance and bookkeeping into the delivery tools themselves.

• Deliver = scan + record. gzh_package and xhs_package now run a server-side compliance scan (extreme-claim / inducement / guaranteed-return terms) and auto-record the item to the content calendar on successful delivery — no separate tool call the model can skip. High-risk hits are surfaced in the response, and a high-risk publish is blocked by default.
• A topic fingerprint stops repeats. Each item carries a normalized topic fingerprint; content_item check_recent looks back N days over packaged/published items (ignoring draft/failed, and excluding the just-recorded item to avoid self-collision) so the daily cron doesn't re-pick a subject you already covered.
• Personal banned words merge in. The compliance scanner takes your structured-memory banned_words as an extra category alongside the built-in lexicon.
• A read-only Content Calendar page. A new page lists every item — platform, title, status, topic, preview link, created/published time — with status-count cards up top. IDs are handled as strings end-to-end (snowflake-precision convention).

See Content Studio.

---

5. The browser agent sees by reference

Driving a real browser by screenshot coordinates is brittle: the page reflows, the click misses. This release gives the browser agent a structural way to see and act.

• Accessibility-tree ref snapshot. The agent reads the page as a compact accessibility tree where every interactive element gets a stable ref handle.
• Interact by ref. Click, type, and select target the element by its ref, not a pixel — so an action survives a reflow and is far more reliable than coordinate hunting.
• Privacy guardrails for the real browser. Using the user's actual browser session carries real risk, so real-browser use is fenced with privacy guardrails, and a controlled CDP (Chrome DevTools Protocol) escape hatch covers the cases the safe path can't reach — explicitly, not by default.

See Tools.

---

6. Sharper attention, tighter loops

A batch of agent-runtime work to keep long, tool-heavy runs on the rails:

• Attention anchoring & environment awareness — each tool now carries provenance (which MCP server or skill it came from), skill constraints are pinned so they don't drift out of the model's attention over a long run, and the employee receives event notifications about its own environment. The agent stops losing track of where a capability came from and what rule it agreed to.
• Tool-call loop guard — a run that calls the same tool with the same args in a tight cycle is detected and broken, instead of silently burning the iteration budget.
• Post-mutation verify reminder — after a change that mutates state (writes a file, edits code), the agent is reminded to verify it rather than declaring success blind, with warning chips surfacing the nudge in the UI.

See Agents.

---

7. Faster, lighter, steadier

• Fast-load pass — on-demand Element Plus with tree-shaking of unused components, plus a lazy-loaded 3D model-viewer and a fixed preload leak, cut the initial-load bundle by ~78% and bring the first token forward. Chat history also stops snapping to the bottom while a reply streams, so you can read back without being yanked around.
• Chat context-occupancy panel — a per-source breakdown of what's filling the context window (memory / Wiki / identity / tools / history), so you can see why a window is full.
• Wiki cross-KB wikilinks + raw-material batch operations — [[wikilinks]] can now resolve across knowledge bases, and raw materials support batch operations.
• MCP progress notifications — long-running MCP tools stream progress instead of going dark until they finish.
• New model provider — Volcano Engine Agent Plan joins the provider roster; OpenAI-compatible endpoints get a fix for stale-connection resets.
• Configurable pip index for skills — skill Python scripts can point at a mirror or a private LAN package source, for offline and intranet installs.
• PostgreSQL 16 & Spring Boot 3.5.16 — the public Docker stack rides PostgreSQL 16, and the backend is on Spring Boot 3.5.16.
• Fixes — conversationId is sanitized as a filesystem path segment; tool-guard boundary checks are hardened (workspace-relative path resolution, sed-empty-replacement and chat-upload fallbacks, filesystem-root skip); and a menu/workspace switch that could leak data across users is fixed.

---

Upgrade path

Config is fully compatible. Your agents / skills / Wiki / channels / cron jobs / workflows / triggers / goals all carry over unchanged. One new table (mate_content_item) is added by Flyway across all three dialects (H2 / MySQL / KingbaseES-PostgreSQL) and auto-baselines on existing databases.

If you're already running v1.7.0 in production:

• Content Studio is opt-in by use. The seeded "Content Studio" employee and its skills (gzh_article, xhs_note, deai_humanize) appear after upgrade; nothing runs until you talk to it.
• To publish to WeChat, configure the Official Account app_id / app_secret in settings — the secret is now encrypted at rest. Set MATECLAW_SETTING_KEY to a stable secret and back it up: it decrypts existing ciphertext, and losing it means re-entering secrets. Add your server's public IP to the Official Account whitelist; the chain will tell you if it's missing.
• Publishing is draft-box-first by default — MateClaw writes to your draft box and you press "publish" in the backstage; the optional publish action is approval-gated.
• Xiaohongshu has no official publish API — Content Studio produces a ready-to-post card package (default), with browser-assisted upload as an optional, approval-gated enhancement. It does not bypass any risk control or human verification.
• De-AI-ification is a heuristic quality boost, not a guarantee of passing any AI detector.
• The browser ref interaction and real-browser guardrails are the new default for browser tooling; the CDP escape hatch is opt-in per use.

---

What this release means for you

If you run a content account — one sentence gets you a 公众号 article in your draft box or a 小红书 card package ready to post, in your own voice, de-AI'd against a measurable score, scanned for compliance, and logged so you never repeat a topic.

If you automate publishing — the chain survives real operation: body images don't break, secrets are encrypted, tokens are reused, transient failures retry, and a draft always has a cover.

If you drive a browser — the agent acts on elements by reference, not pixels, so automation survives a reflow, and real-browser use is fenced with privacy guardrails.

If you run long, tool-heavy tasks — attention anchoring keeps capabilities and constraints in view, a loop guard breaks a stuck cycle, and a verify reminder catches an unchecked change.

If you just want it faster — initial load is down ~78%, chat doesn't yank you to the bottom mid-stream, and you can see exactly what's filling the context window.

---

One last thing.

A toolbox waits to be picked up. A doer finishes the job.

This release is the first time MateClaw does a whole job end-to-end — topic to draft box — on its own primitives, with the outward step gated for your confirmation and every delivery scanned and logged. And it's the release where the browser agent stops guessing at pixels and starts acting on what's actually there.

From "it has the tools" to "it did the thing."