ZeroClaw 0.8.6: WASM Plugins and Upgrade Requirements

ZeroClaw 0.8.6, released on October 18, brings WebAssembly plugins to seven standard 64-bit CLI downloads. Developers can install compatible plugins without building the runtime from source, but existing deployments need to check authentication changes, explicit browser permissions and compatibility with older channel packages before upgrading.

The release announcement also introduces OIDC-backed identity and daemon-owned configuration. The immediate operational question is which capabilities are present in the package you download, which remain disabled, and what your existing configuration will do when the new binary starts.

Which downloads can run plugins?

The tagged plugin protocol documentation describes the supported CLI archives: GNU and musl Linux builds for x86_64 and ARM64, both macOS architectures, and x86_64 Windows. These carry the WASM host and Cranelift compiler needed for the registry's portable components.

The two ARM32 archives and experimental Android archive lack that host. Desktop application bundles are also outside the CLI archive smoke-test coverage. A successful check on a downloaded command-line package should therefore not be treated as evidence that every ZeroClaw package has been tested in the same way.

Shipping the host does not enable plugins automatically. Operators still control activation, discovery and grants. This makes it possible to upgrade the runtime before deciding whether a particular integration should become available to an agent.

Plugin installation and service readiness are separate checks

The registry offers 13 packages built for this release. Discord passed end-to-end acceptance checks on Linux, Windows and macOS. The release notes explicitly say ten other channel packages have not been exercised against their live services with real accounts.

That boundary matters when choosing a first integration. Loading a component proves it can run inside the host; it does not establish that authentication, delivery and replies work with a real service account. A trial should include an actual message exchange and a check of the channel's health reporting.

The plugin guide covers installation and configuration. Registry channel packages installed before 0.8.6 need replacement with compatible versions, with settings restored under the new instance key. Keep the old configuration available while following the package-specific migration instructions.

Review authentication and browser permissions

Pairing codes now default to longer, case-sensitive values, and retrieving or creating them requires administrative access. Remote secure WebSocket connections also require authentication. The authentication documentation is worth checking if a script or client assumes the older pairing flow.

Browser automation has a separate setting. Enabling ordinary browser access no longer enables the tool that clicks, types and reads pages. The browser guide documents the explicit automation opt-in and warns that an older configuration can retain browser entries in its automatic-approval list.

Review both settings together. Otherwise, an operator could deliberately re-enable browser automation and unintentionally retain an older approval choice. For workflows involving signed-in accounts, the meaningful test is whether the agent asks before the actions that the operator expects to review.

Minimal tools remain an explicit choice

The tool-selection reference keeps the full tool catalog as the default. Setting optional = [] under [tools] selects eleven built-ins in Chat or eight in Code/ACP, with named extras available when needed.

This reduces the selected catalog, but does not shrink the downloaded binary or replace permission checks. It also cannot install a missing browser, supply credentials or activate an integration. Teams trying to narrow an agent's responsibilities should treat tool selection and authorization as two parts of the same configuration review.

Before rollout, check the release's known issues. They include refusal of some group-writable data directories, plugin connection timeouts and a delayed dist container image. Confirm the version in the exact archive or image you deploy, then test the workflows that depend on changed defaults.

I'm Paras. I work at the intersection of AI, engineering and distribution.

I help developer-tool founders turn architecture changes, migration requirements and technical launches into clear writing that helps users adopt the product.

Book a 30-minute call.