ClawAI Release: Workspace Automation Governance, Desktop Agent Marketplace & TypeScript 6 Platform Foundation

[ihabkhaled]

ClawAI Release: Workspace Automation Governance, Desktop Agent Marketplace & TypeScript 6 Platform Foundation

Release Range:
caba27e7dd8247698de1d17ae6cb7d2107139306 → 3e8d0455d473b26d63ad849e9a5a37dc12c61135

Release Type:
Platform, Workspace Automation, Desktop Agent, Admin Operations, Security, Infrastructure, TypeScript Upgrade

---

Executive Summary

This release moves ClawAI from a powerful AI workspace into a more mature, governable, and enterprise-ready automation platform.

The main focus of this release is controlled automation. ClawAI now has stronger runtime gates, webhook limits, suggestion budgets, approval controls, agent recipe workflows, marketplace installation flows, local activity memory, capability visibility, organization-scoped policies, and stronger sandbox protection.

From a product point of view, this release makes ClawAI easier to trust, operate, and explain to business users.

From a technical point of view, this release adds important foundations for scalable automation, admin observability, secure agent execution, marketplace-driven workflows, and long-term TypeScript compatibility.

---

Major Highlights

• Added governed runtime gates for workspace automation.
• Added webhook rate limits per connector.
• Added suggestion factory rate limits.
• Added per-rule suggestion budgets.
• Added inbox reply auto-suggestion automation.
• Added daily approval budget caps.
• Added provider-level kill switches.
• Added machine-readable rejection reasons.
• Added admin webhook deliveries page.
• Added webhook replay support.
• Added agent recipes page.
• Added recipe run details page.
• Added marketplace browsing page.
• Added marketplace recipe installation flow.
• Added local agent activity memory page.
• Added capability invocation visibility inside approvals.
• Added organization-scoped capability policies.
• Hardened sandbox static analysis.
• Hardened recipe expression resolution.
• Improved denied recipe-step handling.
• Added operational runbooks.
• Added UAT close-out documentation.
• Upgraded the monorepo to TypeScript 6 beta.

---

Product & Business Features

1. Governed Workspace Automation Runtime

Business Value

ClawAI now provides stronger control over automated workspace actions.

This is a major step for enterprise readiness. AI automation cannot run without limits in real business environments. Teams need to control how often automations run, which providers are allowed, how much budget is consumed, and why actions are rejected.

This release makes automation safer, clearer, and easier to operate.

What Users Get

• Safer workspace automation.
• Reduced risk of automation spam.
• Better protection from excessive webhook activity.
• Controlled suggestion generation.
• Clear rejection reasons when actions are blocked.
• More predictable AI behavior.
• Better readiness for enterprise usage.

Feature Details

ClawAI now supports runtime gates for workspace automation, including:

• Per-connector webhook rate limiting.
• Suggestion factory rate limiting.
• Per-rule automation budgets.
• Daily approval budget caps.
• Provider-level enable/disable controls.
• Machine-readable rejection reasons.
• Oversized payload protection.
• Inbox reply auto-suggestion scheduling.

Technical Details

New runtime controls include:

WORKSPACE_SUGGESTION_FACTORY_RATE_PER_HOUR
WEBHOOK_CONNECTOR_REQUESTS_PER_MINUTE
AUTO_SUGGEST_INBOX_REPLY_CRON
AUTO_SUGGEST_INBOX_REPLY_LOOKBACK_HOURS

The approval manager now supports stronger rejection handling with clear reasons such as:

• USER_DISABLED
• PROVIDER_DISABLED
• BUDGET_EXCEEDED

Large JSON payloads are now mapped to HTTP 413 Payload Too Large, making failure behavior clearer and easier to debug.

---

2. Admin Webhook Deliveries Console

Business Value

Webhook integrations are critical for automation platforms. When a webhook fails, admins need visibility and control.

This release adds a dedicated admin experience for webhook deliveries, helping operators inspect delivery state and replay failed or selected webhook events.

This reduces the need for manual backend debugging and improves supportability.

What Users Get

• Admin visibility into webhook deliveries.
• Ability to filter webhook deliveries.
• Ability to replay webhook delivery attempts.
• Easier debugging for integration failures.
• Better operational control.

Feature Details

A new admin page was added:

/admin/webhook-deliveries

The page supports:

• Provider filtering.
• Connector filtering.
• Delivery inspection.
• Replay action per delivery row.

Technical Details

The frontend now includes a webhook deliveries administration page.

Replay is handled through:

POST /workspace/webhooks/deliveries/:id/replay

This creates a cleaner operational loop for failed webhook events and integration troubleshooting.

---

3. Agent Recipes and Recipe Run Details

Business Value

ClawAI now supports a more productized agent workflow experience.

Instead of treating agents as hidden background logic, users can now browse recipes, inspect recipe runs, and understand how each automation step behaves.

This makes ClawAI easier to explain as a workflow-based AI automation platform.

What Users Get

• Recipe library page.
• Recipe execution visibility.
• Step-by-step run details.
• Recipe status tracking.
• Better debugging when a recipe fails.
• More transparent agent behavior.

Feature Details

New frontend routes were added:

/agent/recipes
/agent/recipe-runs/[runId]

The recipe run detail page includes step-level status visibility, helping users understand what happened during an agent workflow.

Technical Details

The frontend now includes:

• Recipe repositories.
• Recipe hooks.
• Recipe query keys.
• Recipe-related types.
• Recipe-related enums.
• Sidebar integration.
• Step-status UI badges.

This creates the frontend foundation for reusable agent automation flows.

---

4. Agent Marketplace

Business Value

ClawAI now has a marketplace experience for agent recipes.

This is a major product direction. It allows ClawAI to move toward reusable, installable AI automation templates that users can browse and activate.

This improves product scalability because users do not need to create every workflow from scratch.

What Users Get

• Marketplace browsing page.
• Recipe listing discovery.
• Sandbox-status filtering.
• Installable automation recipes.
• Better self-service workflow adoption.

Feature Details

A new frontend route was added:

/agent/marketplace

The marketplace allows users to browse available agent listings and filter them by sandbox status.

Technical Details

Marketplace installation now materializes listing DSL into an actual recipe record.

This means marketplace installation is no longer only a metadata action. It now creates a real recipe artifact in the user’s library.

Install records are also linked to the generated recipeId, improving traceability between marketplace listings and installed recipes.

---

5. Local Agent Activity Memory

Business Value

AI agent platforms need transparency.

This release adds a dedicated activity memory page so users can inspect local agent activity context. This helps users understand what the local agent has observed or stored.

It improves trust, debugging, and explainability.

What Users Get

• Local activity memory visibility.
• Cross-OS activity inspection.
• Better understanding of local agent context.
• More transparent desktop agent behavior.

Feature Details

A new frontend route was added:

/agent/activity-memory

This page provides visibility into local agent activity memory powered by the agent CLI local store.

Technical Details

The activity memory page is part of the new desktop/local agent experience and is integrated into the frontend route and sidebar structure.

---

6. Capability Invocation Visibility

Business Value

Users and admins need to understand what capabilities an agent invoked.

This release adds capability invocation visibility directly inside the approvals experience. This makes the approval flow more informative and helps users connect approval decisions with real agent actions.

What Users Get

• Better visibility into agent capability usage.
• Clearer connection between approvals and executed actions.
• Better auditability.
• Easier troubleshooting.
• Stronger trust in automated workflows.

Feature Details

The workspace approvals page now includes a capability invocations section.

/workspace/approvals

This improves approval review by showing more operational context.

Technical Details

The frontend now embeds capability invocation data into the approvals experience, connecting approval workflows with capability execution visibility.

---

7. Organization-Scoped Capability Policies

Business Value

Different organizations need different automation rules.

This release makes capability policies organization-aware, which is important for multi-tenant and enterprise usage.

A user in one organization may be allowed to run certain capabilities, while another organization may restrict them. ClawAI now has a stronger foundation for this type of governance.

What Users Get

• More accurate policy enforcement.
• Organization-aware capability rules.
• Safer multi-tenant automation.
• Better enterprise permission modeling.

Feature Details

Capability policies can now be evaluated based on the user’s organization membership.

Technical Details

The agent service now resolves user organization memberships and scopes active capability policies to:

• Global policies.
• Policies belonging to the user’s organizations.

This improves the capability risk flow and avoids treating policy lookup as globally flat.

---

8. Stronger Sandbox and Recipe Security

Business Value

AI agents can interact with sensitive systems, local files, browser sessions, clipboard data, and external tools.

This release improves sandbox and recipe execution safety to reduce the risk of unsafe access, bypass tricks, or malicious marketplace content.

What Users Get

• Safer recipe execution.
• Better protection against unsafe path access.
• Stronger blocked-pattern detection.
• Safer marketplace recipe handling.
• Better failure behavior for denied actions.

Feature Details

Security improvements include:

• Recursive sandbox payload inspection.
• Stronger path-pattern matching.
• Protection against escaped path bypasses.
• Blocked prototype-chain traversal.
• Safer recipe expression resolution.
• Better handling for denied recipe steps.

Technical Details

The sandbox static analyzer now recursively walks targets and payloads, checking raw string leaves against banned patterns.

This helps detect bypass attempts such as:

C:\\sensitive\\path

The recipe expression resolver now blocks dangerous property traversal such as:

__proto__
constructor
prototype

The recipe runner also handles synchronous DENIED outcomes and routes failures through on_error.

---

9. Inbox Reply Auto-Suggestions

Business Value

ClawAI can now support automated draft reply suggestions for inbox workflows.

This is useful for productivity, customer support, personal assistants, and workspace automation use cases.

Instead of only reacting manually, ClawAI can now detect messages that need replies and generate draft suggestions within configured limits.

What Users Get

• Automated inbox reply suggestions.
• Better email productivity support.
• Controlled suggestion generation.
• Configurable lookback window.
• Configurable cron schedule.

Technical Details

The inbox reply suggestion flow is controlled by:

AUTO_SUGGEST_INBOX_REPLY_CRON
AUTO_SUGGEST_INBOX_REPLY_LOOKBACK_HOURS

This allows operators to control how frequently ClawAI checks for messages needing replies and how far back it should look.

---

10. Operational Runbooks and UAT Documentation

Business Value

This release adds important operational documentation, making the product easier to deploy, support, and validate.

This is important for real production usage because operators need clear guidance for capability areas, UAT status, and runtime behavior.

What Users Get

• Better deployment guidance.
• Better support documentation.
• Clearer UAT closure tracking.
• Better confidence in production readiness.
• More complete operational handoff.

Feature Details

Runbooks were added for several capability areas, including:

• Activity memory.
• Application.
• Audio.
• Browser.
• Clipboard notification.
• Fleet.
• Marketplace.
• Screen.

Technical Details

Documentation updates include:

• Runtime gate environment configuration.
• CI environment updates.
• Capability runbooks.
• UAT close-out documentation.
• Soak tracking.

The UAT documentation records that deferred scenarios were moved to pass and that a 7-day soak window started on 2026-05-02.

---

11. TypeScript 6 Beta Platform Upgrade

Business Value

This release upgrades the monorepo to TypeScript 6 beta.

This is a platform foundation improvement. It keeps ClawAI aligned with the future TypeScript ecosystem and reduces future migration risk.

For a large multi-service product, this kind of upgrade helps prevent technical debt from accumulating.

What Users Get

• Better long-term maintainability.
• Stronger platform foundation.
• Reduced future migration risk.
• More consistent TypeScript behavior.
• Cleaner compatibility path for future tooling.

Technical Details

The monorepo now pins:

typescript@6.0.0-beta

Additional TypeScript updates include:

• Updated ignoreDeprecations from 5.0 to 6.0.
• Added explicit typeRoots.
• Added backend ambient type configuration.
• Added explicit Jest and Node types.
• Fixed TypeScript 6 strictness issue in sandbox runner error handling.
• Treated caught errors as unknown.

Validation status from the final commit:

• Typecheck: passed.
• Lint: zero errors.
• Tests: 415/415 passing.
• Build: passed.

---

Technical Changelog

Frontend

Added

• /admin/webhook-deliveries
• /agent/recipes
• /agent/recipe-runs/[runId]
• /agent/marketplace
• /agent/activity-memory
• Capability invocations section inside workspace approvals.
• Sidebar entries for new admin and agent pages.
• Query keys for new agent and admin pages.
• Frontend repositories for new API interactions.
• Hooks for recipes, marketplace, activity memory, and webhook deliveries.
• Types and enums for new frontend workflows.

Improved

• Admin observability.
• Agent recipe visibility.
• Marketplace discovery.
• Recipe run inspection.
• Workspace approval context.
• Desktop/local agent transparency.

---

Workspace Service

Added

• Webhook connector rate limiting.
• Suggestion factory rate limiting.
• Per-rule suggestion budget.
• Inbox reply auto-suggestion cron flow.
• Approval daily budget caps.
• Provider-level kill switches.
• Machine-readable rejection reasons.
• Admin replay support for webhook deliveries.
• Improved payload-size handling.

Improved

• Automation safety.
• Runtime governance.
• Webhook reliability.
• Suggestion control.
• Approval behavior.
• Policy matching.
• Operational clarity.

---

Agent Service

Added

• Organization-scoped capability policies.
• Marketplace recipe materialization.
• Recipe installation linkage to recipeId.
• Safer sandbox static analysis.
• Safer recipe expression resolver.
• Better DENIED handling in recipe execution.
• Better on_error routing.

Improved

• Multi-tenant governance.
• Recipe execution safety.
• Marketplace install behavior.
• Capability policy accuracy.
• Agent workflow reliability.

---

Infrastructure

Added

• Runtime gate environment variables.
• CI configuration for automation limits.
• Updated .env.example.
• Updated CLAUDE.md.
• Capability runbooks.
• UAT close-out documentation.
• Soak tracking documentation.

Improved

• Deployment readiness.
• QA handoff.
• Production supportability.
• Operator guidance.
• Runtime configuration clarity.

---

Platform

Added / Updated

• TypeScript 6 beta across the monorepo.
• Updated TypeScript config deprecation handling.
• Explicit backend typeRoots.
• Explicit ambient test and runtime types.
• TypeScript 6-compatible error handling.

Validation

• Typecheck passed.
• Lint passed with zero errors.
• Tests passed: 415/415.
• Build passed.

---

Environment Variables Added or Updated

WORKSPACE_SUGGESTION_FACTORY_RATE_PER_HOUR=100
WEBHOOK_CONNECTOR_REQUESTS_PER_MINUTE=60
AUTO_SUGGEST_INBOX_REPLY_CRON=0 */15 * * * *
AUTO_SUGGEST_INBOX_REPLY_LOOKBACK_HOURS=48

Variable Purpose

WORKSPACE_SUGGESTION_FACTORY_RATE_PER_HOUR

Controls how many workspace suggestions can be generated per hour.

WEBHOOK_CONNECTOR_REQUESTS_PER_MINUTE

Controls how many webhook requests are allowed per connector per minute.

AUTO_SUGGEST_INBOX_REPLY_CRON

Controls how frequently inbox reply auto-suggestions run.

AUTO_SUGGEST_INBOX_REPLY_LOOKBACK_HOURS

Controls how far back the inbox reply suggestion job should look for messages.

---

Database / Migration Notes

Workspace Service

A Prisma migration adds:

SuggestionTriggerRule.perRuleBudgetPerHour

This allows each suggestion trigger rule to have its own hourly budget.

Deployment Requirement

Run the workspace-service migration before relying on per-rule suggestion budgets.

---

New Routes

Admin Routes

/admin/webhook-deliveries

Agent Routes

/agent/recipes
/agent/recipe-runs/[runId]
/agent/marketplace
/agent/activity-memory

Workspace Routes Improved

/workspace/approvals

---

Release Impact

Impact for Business Users

This release makes ClawAI easier to understand as a real automation platform.

ClawAI is no longer only about chatting with models. It now supports governed automation, recipe-based agent workflows, marketplace-installed automations, admin replay tooling, local activity visibility, and enterprise-style policy controls.

Business Positioning

ClawAI can now be positioned as:

A governed AI workspace automation platform that allows users to run local and cloud-connected AI agents with controlled permissions, visible actions, reusable recipes, and admin-grade operational controls.

---

Impact for Product Teams

Product teams can now explain ClawAI through clearer product capabilities:

• Users can install recipes from the marketplace.
• Users can inspect recipe runs.
• Admins can replay webhook deliveries.
• Users can review local activity memory.
• Approvals show more execution context.
• Automations are governed by budgets and runtime gates.
• Capability access can be scoped by organization.

This improves product storytelling and makes ClawAI easier to sell, demo, and onboard.

---

Impact for Engineering Teams

Engineering teams now have stronger foundations for:

• Automation governance.
• Agent marketplace flows.
• Recipe execution.
• Policy enforcement.
• Capability auditing.
• Webhook operations.
• Local agent observability.
• TypeScript 6 readiness.

This release also improves long-term maintainability by upgrading TypeScript and tightening runtime safety.

---

Impact for Admins and Operators

Admins now have better tools to inspect and control automation behavior.

They can:

• View webhook deliveries.
• Filter deliveries by provider or connector.
• Replay webhook events.
• Understand rejection reasons.
• Review capability invocations.
• Operate with documented runtime limits.
• Use runbooks for capability-specific operations.

---

Impact for End Users

End users get a safer and more transparent agent experience.

They can:

• Browse agent recipes.
• Install marketplace recipes.
• Inspect recipe execution.
• View local agent activity memory.
• Trust that automations are controlled by limits and policies.
• Better understand what the agent is doing.

---

Breaking Changes

No explicit breaking user-facing behavior was identified from the analyzed release range.

However, deployment teams should pay attention to:

• TypeScript 6 beta upgrade.
• New environment variables.
• Workspace-service migration.
• Runtime gate configuration.
• CI configuration changes.

---

Upgrade Notes

1. Pull Latest Changes

git pull origin main

2. Install Dependencies

pnpm install

3. Apply Database Migrations

Run the workspace-service Prisma migration before deploying the workspace automation runtime changes.

pnpm prisma migrate deploy

Use the project-specific command if the workspace service has its own migration script.

4. Configure Runtime Environment Variables

Add the following values to the target environment:

WORKSPACE_SUGGESTION_FACTORY_RATE_PER_HOUR=100
WEBHOOK_CONNECTOR_REQUESTS_PER_MINUTE=60
AUTO_SUGGEST_INBOX_REPLY_CRON=0 */15 * * * *
AUTO_SUGGEST_INBOX_REPLY_LOOKBACK_HOURS=48

5. Validate Frontend Routes

Confirm the following pages are accessible:

/admin/webhook-deliveries
/agent/recipes
/agent/recipe-runs/[runId]
/agent/marketplace
/agent/activity-memory
/workspace/approvals

6. Run Validation

pnpm typecheck
pnpm lint
pnpm test
pnpm build

Expected validation status from this release:

Typecheck: passed
Lint: zero errors
Tests: 415/415 passing
Build: passed

---

Suggested GitHub Release Description

ClawAI Release: Workspace Automation Governance, Desktop Agent Marketplace & TypeScript 6 Platform Foundation

This release introduces a major platform upgrade for ClawAI, focused on governed workspace automation, desktop agent visibility, recipe marketplace workflows, admin operations, security hardening, and TypeScript 6 readiness.

Highlights

• Added runtime gates for webhook and suggestion automation.
• Added admin webhook deliveries page with replay support.
• Added agent recipe library and recipe-run detail pages.
• Added agent marketplace page.
• Added marketplace install flow that creates real user recipes.
• Added local activity memory page for agent transparency.
• Added capability invocation visibility inside workspace approvals.
• Added organization-scoped capability policies.
• Hardened sandbox path analysis.
• Hardened recipe expression resolution.
• Added inbox reply auto-suggestion scheduler.
• Added machine-readable automation rejection reasons.
• Added operational runbooks and UAT close-out documentation.
• Upgraded the full monorepo to TypeScript 6 beta.

Why It Matters

ClawAI is now safer, more observable, and more operationally ready.

Automation is no longer just executable. It is now rate-limited, policy-aware, budget-aware, auditable, and easier to administer.

This release strengthens the product foundation for enterprise-grade AI workspace automation.

---

Final Release Summary

This release is a major step forward for ClawAI.

It introduces the governance, observability, marketplace, recipe, policy, and platform foundations needed to support a serious AI automation product.

The most important improvement is that ClawAI now treats automation as a controlled product capability, not just a background technical feature.

With this release, ClawAI becomes:

• More secure.
• More transparent.
• More governable.
• More admin-friendly.
• More enterprise-ready.
• More scalable as an AI automation platform.

---

This discussion was created from the release ClawAI Release: Workspace Automation Governance, Desktop Agent Marketplace & TypeScript 6 Platform Foundation.