# Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [Unreleased]

### Added

### Changed

### Deprecated

### Removed

### Fixed

### Security

## [1.0.0] - 2026-04-10

### Added

- **PAT (Personal Access Token) Support**: Dual token authentication with bot token for reads and PAT for writes
- **Message Editing**: Edit bot messages with permission controls via `editMessage()` action
- **Message Deletion**: Delete bot messages with safety checks via `deleteMessage()` action
- **File Download**: Secure file download with MIME type validation, executable blocking, and size limits
- **Interactive Directives**: Support for `[[mattermost_buttons: ...]]` and `[[mattermost_select: ...]]` syntax
- **Security Audit**: Automated security configuration scanning with `collectMattermostSecurityAuditFindings()`
- **Structured Error Handling**: Comprehensive error classes with context, retry logic, and user-friendly messages
- **Automatic Retry Logic**: Exponential backoff with jitter for transient failures
- **Rate Limit Handling**: Full support for Mattermost rate limiting with `Retry-After` header parsing
- **SSRF Protection**: Guarded outbound requests with `fetchWithSsrFGuard`
- **Multi-Account Support**: Configure multiple Mattermost accounts with `accounts` and `defaultAccount`
- **Advanced Slash Commands**: Native and skill-based commands with callback configuration
- **DM Channel Retry**: Configurable retry logic for DM channel creation
- **Error Boundary**: Global error handling with `globalErrorBoundary`
- **Group-Specific Settings**: Per-channel configuration via `groups` object

### Security

- HTTPS enforcement warnings for insecure configurations
- IP allowlisting for interaction callbacks
- Private network access controls
- Hardcoded token detection in security audit
- Mutable allowlist entry detection
- Executable file blocking in downloads
- Input validation for all user-provided parameters

### Changed

- Improved error messages with context and remediation hints
- Enhanced configuration validation with Zod schemas
- Better separation of concerns in client architecture
- More comprehensive logging without exposing secrets

## [0.1.0] - 2026-04-10

### Added

- Initial release of open-source
- TypeScript support
- Basic filtering functionality for OpenCode
- Mattermost integration support
- Development tooling (Vitest, TypeScript)

[Unreleased]: https://github.com/karti-ai/openclaw-extentions-mattermost/compare/v1.0.0...HEAD
[1.0.0]: https://github.com/karti-ai/openclaw-extentions-mattermost/releases/tag/v1.0.0
[0.1.0]: https://github.com/karti-ai/openclaw-extentions-mattermost/releases/tag/v0.1.0