Changelog¶

Every agentctl release, newest first.

v4.5.195 — 14 October 2026¶

Schedule a carrier bounce at the job's reply, not N seconds after the decision (#1471)
Build-tag cron_run_output.go's Linux-only syscalls (#1470)
Auto-pull a deferred attachment before the turn opens (#1466)
A venv in a skill broke a claude→pi flip, and the fallback dropped the agent's channel
Add admin-gated usercron artifact reads (#1467)
The runtime ladder must not be decided by a stray state dir (Go + python cost producer) (#1464)
A deferred attachment >~10MB silently hung forever and got dropped (#1465)
Add per-run usercron output diagnostics
Wait out a prior job's pending carrier restart before starting

v4.5.194 — 13 October 2026¶

Dedupe risk-rule generation across a retired/canonical id pair
Migrate retired IDs before apply planning
Canonicalize MCP aliases for risk checks

v4.5.193 — 13 October 2026¶

Rename catalog item to atlassian, add risk gating, flatten tool list
Migrate to Atlassian's v2 MCP endpoint and scopes

v4.5.192 — 12 October 2026¶

Defer the host-dial/webview-gateway restart that severs its own job's reply (#1459)

v4.5.191 — 12 October 2026¶

Single-host fleet never registers its own host_keys: entry (#1457)

v4.5.190 — 12 October 2026¶

Fleet upgrade help text overclaimed — it does not reconcile (#1456)

v4.5.189 — 12 October 2026¶

Split stderr from the delivered card in script crons too; pin #1438's fix

v4.5.188 — 12 October 2026¶

Accept raw and encoded PAT credentials
Component=shim — record_write, stdin_write, ack_total (claude TXT mode)
Component=upload — tus_patch, attachment_stage
Component=shim — record_write, ack_total (pi webview lane)
Component=gateway — conn_resolve, write_wait, ack_wait

v4.5.187 — 11 October 2026¶

Make agentAdminTargetHandler/agentAdminTargetAcks race-safe
Delete the spacer dead code (#1225 wave 2, item 6)
Seed-empty rows reach the height observer; the history primer re-arms (#1225)
One (Ts, Ord) boundary for the unread line, at the mark itself
Emit seed_complete from the local transcript branch too (#1225)
Stop ckSettleBottom's settle loop defeating itself
Settle the bottom on a live burst and a chip-row resize (#1225)
Settle the bottom when the conversation tab comes back (#1225)

v4.5.186 — 10 October 2026¶

Route the audit read through agentd, read-only (#1442)
Make test-swappable deadline/client vars race-safe
Settle the bottom on the two paths that skip ckSeedReveal (#1225)
Route TIMING instrumentation to stderr, not stdout (#1438)
Pay a prepended page's real height into scrollTop (#1225)
A backgrounded transcript tab comes back at the bottom (#1225)
Place the unread divider by (Ts, Ord), not by arrival order

v4.5.185 — 10 October 2026¶

Bound the upload-delivery legs and log a failed delivery
The attachment pull origin is the gateway, not the dial lane
Allow browser evaluate_script on CLI
Decided vs undecided — a deny stands, a non-answer doesn't
Thread the real permission outcome to the gate, not a boolean
A non-approval no longer tells the model never to retry
Fix /terminal/ cross-host: locality is converge's env file, not a home dir (#1431)
Set HOME for host-job workers (#1430)
A path containing &, < or > no longer double-escapes in a chat link (#1429)
Link paths written in backticks, and stop ckAbs mangling a tilde path (#1428)
Retire self-converge: fixtures, illustrative comments and docs
Resolve required_env secrets through agentd when non-root (#1425)
Retire self-converge: the CLI path and the ledger fields it fed
Retire self-converge: packaging + host converge role

v4.5.184 — 09 October 2026¶

Remove the host-job-cutover planning docs — the work is done and merged
The host-job catalog count sweep and one dead function from the retirement
Record a record as sent BEFORE emitting it (#1420)
Phase 5d — retire the host-operation protocol's target half (#1422)
Add host hostjob-ready — the host-job-era readiness probe (#1418 follow-up) (#1423)
The agent-scope managed block, and the docs re-checked against Phase 5c (#1417)
Phase 5b — retire the agentctl-hostop@ worker template, and install the one that replaced it (#1418)
The keyed-lock dispatcher scan admits the host-job worker, and five lint/harness defects (#1416)
Phase 5c — the activity-protocol collector onto host-job, and the transient relay retired (#1415)
Skill-catalog audit pass 2 — calibrate the floor, unblock what is safe (#1414)
Phase 6 docs — host jobs, agent administration, and a skill-consistency audit (#1413)
Phase 5a — retire the host-operation coordinator (2 of 7 brief items blocked, reported not forced) (#1412)
Phase 4.5.5 — the retirement audit: all three deletion targets are live, nothing is cut (#1411)
Phase 4.6 — agentctl fleet apply / fleet upgrade: one host job per host, live per-host status (#1410)
Phase 4.5.6 — cross-host cron listing: cron list <agent> (#1409)
Phase 4.5.4 — source CLI: agent administration actually crosses a host (#1408)
Auto-resolve the host for a verb that already names an agent (#1407)
Phase 4.5.3.5 — chunked body transfer for agent administration (#1406)
Phase 4.5.3 — agent-admin wire and gateway extension (#1405)
Phase 4.5.2 — target-side agent-privilege-drop execution (#1401)
Irreversible-action-gate — retrying a gated call is not evasion (#1404)
Phase 4.5.1: the agent-administration policy catalog and the AgentGrant credential (#1400)
AwaitDrain waited for an empty queue, not a finished write (#1396)
Source CLI, resolver, grant hop and secure input — plus the read-grant seam that made 3 of 4 actions impossible (#1395)
Widen a too-tight deadline causing a measured 25% flake
Move HostJobTarget out of internal/daemon, fixing a layering violation I introduced
Wire the host-job target seam to a real daemon.HostJobTarget
Phase 3: host-job wire protocol, the /host-job gateway relay, and the fleet-wide notify relay (#1393)
Phase 2: target-local job authority — store, dispatch, worker, unit (#1394)
Phase 1: host-job wire contract, 62-verb policy catalog, and the job grant (#1392)

v4.5.183 — 08 October 2026¶

Slim the irreversible-action-gate down to an actual floor (#1403)
Move every destructive google-workspace/ms365 tool from ask to block (#1399)
Install the native package BEFORE rendering the Caddyfile, so a blank gateway host can bootstrap at all (#1398)
Dearmor the gcloud/azure-cli apt keys, so apt-get update works on a fresh host (#1397)
Perf+cleanup(cockpit): resume the subagent fold (1.2s → 0.1s), and delete the unreachable --host/SSH transport (#1391)
Decline to replace a context array the pass did not change (#1390)
Flag a unit that is active but not enabled (#1389)
One timing line per hop of the chat path, so latency can be attributed (#1387)
Report the daemon-reload step AFTER the reload, not before (#1386)
One cheap read per workspace remote, so a converged apply forks git ZERO times (#1385)

v4.5.182 — 06 October 2026¶

One batched read per apply, so a converged fleet takes ZERO cron enable forks (#1384)

v4.5.181 — 06 October 2026¶

Teach the wrapped-tool prune a known atlassian→atlassian-rovo rename (#1383)
Batch the tier bounce, one try-restart fork for the whole fleet (#1381)
Oc installer archive path + port-guard host-scope filtering (#1382)
Batch the host-cron systemctl calls, one fork per phase not one per label (#1380)

v4.5.180 — 06 October 2026¶

Batch the cron systemctl calls, one fork per agent not one per job (#1379)
Add websearch, a default skill, for research via the browser MCP (#1378)

v4.5.179 — 06 October 2026¶

Instrument the per-agent cron loop to split systemctl time from ledger-write time (#1377)
Prune dangling tool launchers by target shape, on both runtimes (#1376)
Identity map is case-sensitive, not just whitespace-insensitive (#1375)

v4.5.178 — 06 October 2026¶

Replace deprecated parser.ParseDir in the shadow-mode AST test (#1374)
Shadow-mode content-hash payload digest — measure the cutover before taking it (#1373)
Tell pi agents explicitly to chain codemode scripts, not one-shot them (#1372)
Render ordered markdown lists and frontmatter (#1371)
Point every pi agent's codemode guidance at the SDK's own docs (#1370)
Render apply's progress bar where the terminal actually is (#1369)
Wire converge's OnStep hook + a live progress bar as the human default (#1368)
MergeInProgress checks MERGE_HEAD as a file, not a directory (#1367)
One fleet push per run + parallel converge pre-pass and restart tail (#1366)
Batch the systemd state reads + add an OnStep progress hook (#1365)
Add a StepStart event to the progress emitter (#1364)
Convert the last two single-file chownTree sites to chownLink (#1363)
Update idempotency test for the native provisioning guards (#1362)
Native in-process guards for the pi provisioning path's four unconditional forks (#1361)
The codemode persona section is a managed block, not scaffold-once (#1360)
Native in-process guards for the claude provisioning, MCP-wiring and hook-merge forks (#1358)
Gofmt internal/cli/emit.go (#1359)
Browser-eval also covers the REPL's raw HTTP endpoint and repl.ts directly (#1357)
Commit the exempt verb's own shard, not the whole dirty tree (#1356)
Self-healing prune of dangling retired-CLI launcher symlinks (#1355)
Bundle gcloud, az, and oc CLIs on every host (#1354)
Browser-eval rule now matches browser-harness-js's real invocation (#1352)
Retire the stale "CLI tools, not MCPs" section from existing agents' AGENTS.md (#1351)
Timestamp every progress event + fix silent user-cron reconcile (#1348)
The dashboard's pi MCP servers panel reads real registrations now (#1349)
Distinguish routine Git from destructive actions (#1347)

v4.5.177 — 06 October 2026¶

Drain the host-level defaults.yaml clitools: leg too (#1345)
Wire the host proxy into native MCP units (#1343)

v4.5.176 — 06 October 2026¶

Move exa's credential from url query param to x-api-key header (#1340)

v4.5.175 — 05 October 2026¶

Post-#1279 gate fallout (stale test expectations, subsession hang) (#1338)
--dry-run previews the clitools: → tools: ledger migration (#1279) (#1337)
Prune the retired mcptools wrapper tool dirs, gated on the native MCP being live (#1279) (#1335)
Rebind a rolled-over subsession to its live transcript (#1279) (#1332)
Allowlist the three channel MCP items in the delivery gate (#1279) (#1331)
Decommission the vendored telegram plugin (#1279) (Phase 7) (#1330)
Materialize real sockets for pi agents, one mechanism for both runtimes (#1279) (#1329)
Count a pi agent's natively-wired MCPs as providers (#1279) (Phase 3b) (#1328)
Re-key the pi-ai Fast-tier patch to 1.0.3 so PI_SERVICE_TIER applies again (#1319)
Retire every folded entry on settle, not just the head (#1317)
Native MCP + codemode in the bridge, with the exposure carve-out (#1279) (Phase 2a) (#1318)
Surface a codemode script's nested tool calls (#1279) (Phase 2b) (#1316)
Slack, teams and telegram catalog items (#1279) (#1315)
TXT-mode Telegram attachments + duplicate-reply dedup (#1314)
Prune a pi agent's stale clitools against disk, not the ledger (#1279) (#1313)
Promote the ynab catalog item into the shipped deb (#1312)
Bump the pi SDK to 1.0.3 and raise the Node pin to its real floor (#1279) (#1311)
Configure Fast tier and reasoning effort (#1310)
Let root reach an agent's webview-ws port for ws write --pull (#1309)
Count a pi agent's subsessions in the history badge (#1308)
Three defects found wiring native MCP + codemode (#1279) (#1307)

v4.5.174 — 01 October 2026¶

The generated man page lost its whole command surface (#1305)
The three pre-existing internal/cli failures in a clean container (#1306)
A customer's own entity list for --local-js (#1304)
No cockpit redaction bar for the turn-review pass (#1303)
Repair cached model permissions (#1302)
Fail the local-js load when the NER window planner cannot be sized (#1301)
Make the typing indicator one derived rule, and close its three open edges (#1300)
Retire the redaction bar on the lane that OPENED it (#1299)
Strip node_modules with the privilege that created it (#1298)

v4.5.173 — 01 October 2026¶

Load local-js weights from offline cache (#1297)

v4.5.172 — 01 October 2026¶

Skip unwritable workspace indexes (#1295)
One side-log record per string per session, and scope the cockpit's read to the lane (#1296)
Clickable workspace paths in message text (#1294)
Pre-wrap every catalog MCP as a pi CLI tool, generated at build time (#1293)
Reference a workspace file as a chip, not a pasted path (#1292)

v4.5.171 — 30 September 2026¶

Stop awk's early exit from SIGPIPEing tar in build-pii-weights.sh (#1288)
Read a pi cron's deliverable at message_end, not off the delta stream (#1287)

v4.5.170 — 30 September 2026¶

Exit(0) explicitly after the build-time weights fetch (#1286)

v4.5.169 — 30 September 2026¶

Bundle the local-js ONNX weights in the package instead of fetching them at apply time (#1284)
Stop passing --omit=optional to the bridge bun install (#1283)

v4.5.168 — 30 September 2026¶

Resolve the local-js detector by absolute path, not a static relative import (#1281)

v4.5.167 — 30 September 2026¶

Dashboard_unread_test.sh tracks ckPlaceRow, not a stale pane.appendChild (#1280)
Pii-filter: add --local-js, an in-process JS/TS detector mode (#1276)
Resolve 5 pre-existing tsc --noEmit errors in pi/bridge (#1278)
Binary-safe Frame.DataB64 — stop U+FFFD-corrupting cross-agent binary reads (#1277)
Resolve a ~/… --file path instead of joining it onto the workspace root (#1274)
Ship ado pre-wrapped as a pi CLI tool in the deb (#1275)

v4.5.166 — 29 September 2026¶

Restart host-level units still running the pre-upgrade binary (#1273)
A transcript row lands at its own clock, not at its arrival (#1272)

v4.5.165 — 29 September 2026¶

Drop raw backticks from a comment inside an unquoted heredoc (#1271)
A host reports its own health over the root host-dial carrier (#1266)
The docs changelog page HTML-escapes its bullets (#1265)
A split-view tile draws its own subagent chips (#1264)
The tunnel pairing normalizes the hostname it compares (#1262)
Raise the detector ceiling to 60 s (server deadline 59 s)
Key a tool result's verdict by (toolCallId, text), not by text
The admission cap follows the host's roster, an un-vettable string never takes a slot, and the no-retry memory persists with its reason (#1260)

v4.5.164 — 29 September 2026¶

Report the settled height shellcheck flagged as unused (#1261)
Log redaction duration alongside the existing timestamp (#1258)
Secret set re-wraps shards to the full fleet before reporting success (#1257)
The far end's diagnosis reaches the operator, and the dial back is bounded (#1256)
An already-wired clitool is a no-op, not a re-wire on every apply (#1255)
Preserve leading cockpit-context marker position in pi injects (#1253)

v4.5.163 — 29 September 2026¶

A fleet-message handoff to a pi agent renders ONE bubble, not two (#1252)
Sync the host proxy before a standalone agents add provisions (#1251)
An out-of-band mine can finally stamp the marker it consumed (#1250)
Let one long string use the pool, without coupling or starving its neighbours (#1246)
One systemctl show for every sub, not one per sidecar (#1248)
Seed reveal lands at the true bottom; main-lane seed stops resolving every cron session one at a time (#1247)

v4.5.162 — 28 September 2026¶

Thread reply_to from the bridge to the cockpit's live frame (#1231)
11 transcript scroll/render defects + the regression suite that had none (#1230)
Resolve every optimistic bubble, not just the newest (#1229)
Settle every message a steered turn answered; make SocketChannel notices visible (#1228)
Refuse a positional argument on status and clear (#1227)

v4.5.161 — 28 September 2026¶

4 cores as the local detector's stated requirement (2x2, CPUQuota=400%) (#1224)
Steer mid-turn owner messages into the live run, with an ack (#1223)
A session pool for the detector, and the measurement that keeps it off (#1222)
Per-session cadence counter in memory-nudge; verify a cron's skill exists before prompting (#1221)
Batch concurrent detector requests into one forward pass (#1219)
Key the cadence counter per session, not per agent (#1220)

v4.5.160 — 28 September 2026¶

Promote the reading trio to default skills — document-intake, doc-to-markdown, pdf-extract (#1218)
Show a live "redacting…" bar while the PII detector holds a turn (#1217)
Ship anydoc as a host-global, default-everywhere document reader (#1216)
Bound the forward pass, not the allocator underneath it (#1215)
Scope the local detector to hosts that run pi agents (#1214)

v4.5.159 — 27 September 2026¶

Cap glibc's own arena and trim after every inference (#1213)
Stamp the PII reveal on the sender's own optimistic bubble (#1212)

v4.5.158 — 27 September 2026¶

Give tool-call chips the PII reveal, and stop the typing bubble lagging the seed (#1211)
Bound the local detector's memory arena and its request queue (#1210)

v4.5.157 — 27 September 2026¶

Push a live fs_event when the PII reveal side-log grows

v4.5.156 — 27 September 2026¶

Fix the PII guidance pair crashing every turn, and give sessions real identity (#1208)

v4.5.155 — 26 September 2026¶

Log a side-log record for the model's own reply too (#1207)

v4.5.154 — 26 September 2026¶

PII reveal toggle ignores the cockpit-context prefix mismatch (#1206)
Bound the detector fetch with a timeout so a hang can't outlive fail-closed (#1205)
Force HOME to $STAGE instead of falling back to it (#1204)
Stop the stale telegram-transport unit on claude→pi flip (#1203)

v4.5.153 — 26 September 2026¶

Count a flipped agent's migrated history in the dashboard badge (#1202)

v4.5.152 — 26 September 2026¶

Price gpt-6-luna, surface migrated flip history, resync the pi bridge on apply (#1201)
Converge agentctl-host-dial.service on every full apply, not only on a re-provision (#1200)

v4.5.151 — 26 September 2026¶

Scoped secret set compares against the literal per-agent value (#1199)
Migrate session transcripts across a runtime flip (#1198)
Two load-shaped gate flakes found on a clean origin/main run (#1197)
Close four gaps found flipping a live agent claude→pi (#1196)

v4.5.150 — 26 September 2026¶

Migrate persona + local skills across a runtime flip (#1195)

v4.5.149 — 26 September 2026¶

Also stop the claude-only watcher trio on a runtime flip (#1194)

v4.5.148 — 25 September 2026¶

Seed the local transcript stream from a suffix, not from byte zero (#1193)

v4.5.147 — 25 September 2026¶

Draw hosts from a live host-dial connection, surface its status (#1192)
Host-level dial-in: reach a fleet host that has no agents on it (#1190)
Sync host_proxy: onto the process before shelling out (#1189)
Symlinked skills invisible to introspection + new fleet defaults never self-heal onto existing agents (#1187)
Confirm the recipient recorded it before reporting "delivered" (#1188)
Respect host_proxy: when reconciling apt/dnf repo config (#1186)

v4.5.146 — 21 September 2026¶

Replace hand-rolled DOM recycling with content-visibility (fixes iOS Safari blank-pane bug) (#1185)
Pull out unrelated transcript-window/CSS changes accidentally merged via #1183 (#1184)
Ship verify-claimed-work in the payload, fix dream-cycle's unrunnable aging command (#1183)
A blank line between list items no longer restarts numbering (#1182)

v4.5.145 — 21 September 2026¶

Pii-filter: persist the detector verdict cache across session resume (#1180)

v4.5.144 — 19 September 2026¶

Never install the local detector on an agentless gateway host (#1179)
Isolate the suite from real agent-host state (#1178)

v4.5.143 — 19 September 2026¶

Make the OAuth login a first-class provider (#1177)
Bound --timeout so the inner timeout is always the one that fires (#1176)
Update fleet-map dot count from five to six
Show the self-hosted PII filter as a sixth host service (#1174)
Self-hosted local detector (openai/privacy-filter on ONNX) (#1171)
Use shared secret for delegated token exchange
Ship cron-design as a default skill (#1173)
Repair the two real gate failures the full-gate run found (#1172)
Skill-existence check + bundled-script hardening (#1170)
Per-unit OnFailure alert cooldown + user-cron shadow-overlay detection (#1169)
Per-unit resource ceiling + workspace-script apply-time re-validation (#1168)
Wrap --script crons for PATH/TMPDIR/timeout/log parity (#1167)
Sync cron add's registered Usage string with its flags (#1166)
Validate --script content before installing an unattended timer (#1165)
Sweep an agent's own ad-hoc crons on agents remove (#1164)
Diagnose attachment pull upstreams

v4.5.142 — 17 September 2026¶

Harden the unparseable-2xx sign-out branch; clear wv_refresh_ref on passkey login (#1161)
Four host timers read "not installed" on every host (#1159)
Gofmt connections.go/connections_test.go/top_web.go (#1158)
Size the silent relogin popup so it opens as a popup, not a tab (#1157)
Validate EnvironmentFile rendering
Confirm agent-message handoffs
Support managed provider status checks (#1154)

v4.5.141 — 17 September 2026¶

Validate EnvironmentFile key names (#1153)
Reject multiline agent environment secrets (#1152)
Preserve attachment pull errors (#1151)

v4.5.140 — 17 September 2026¶

A same-origin 401 is only a sign-out if it reached webview-login (#1148)
Project declared runtime into agent.env fallback, tighten isPiAgent (#1149)

v4.5.139 — 16 September 2026¶

Normalize empty MCP client handshake

v4.5.138 — 16 September 2026¶

Silent inline refresh-token session renewal (#1146)
Retry the user-apps round-trip once, surface a persistent failure (#1145)
Support service principals and discovery
Local skill/subagent supersedes a colliding overlay entry (#1143)
Flatten the Agents tab + rank Usage/Hours for 500 agents (#1142)

v4.5.137 — 16 September 2026¶

A session expiring mid-chunk no longer reports a corrupt upload as done (#1141)
A session expiring mid-upload no longer discards the upload (#1140)
CkSend's own auth-gone detection now coordinates with silent recovery (#1139)

v4.5.136 — 15 September 2026¶

Try a silent Entra prompt=none round trip before the visible relogin popup (#1138)

v4.5.135 — 15 September 2026¶

Avoid Basic challenge for expired cockpit data (#1135)
Cost_cap_test.sh's TXT-mode injection pattern was stale (#1137)
Add a Changelog page to docs.agentctl.ch, generated from git (#1136)

v4.5.134 — 14 September 2026¶

Read-only task-list checkboxes, close-all-tabs, collapse-all-folders (#1134)
Attach-via-picker silently dropped every file (v4.5.133 regression) (#1133)

v4.5.133 — 14 September 2026¶

Unify SSE/fetch transport around one 401 reading, add pre-flight auth check (#1132)
Bundle side-effect JS imports and Python relative/package imports (#1126)
TestUnitReadsAreProxiedByTarget skips as root, like its four siblings (#1131)
Stop the bun gate reporting install failures as missing packages (#1130)
Preload the two node shims and declare the risk it inherits (#1129)
Pull #1079's copy button and #1120's relogin popup into two dashboard sandboxes (#1128)
Pull PR #1120's auth-expiry seam into the split/bell sandboxes (#1127)
Powerbi_mcp_test.sh conforms to the shared check.sh harness (#1125)
Bundle local script dependencies (#1122)
"Show tool calls" toggle in a new right-panel settings section (#1123)
File-type icons in the workspace tree (#1121)

v4.5.132 — 14 September 2026¶

Oidc session expiry floods the stream console instead of surfacing cleanly (#1120)
Regenerate a wrapped tool's tool.yaml on catalog env drift (#1119)

v4.5.131 — 14 September 2026¶

Honor OpenAI-compatible base URLs (#1118)

v4.5.130 — 08 September 2026¶

Real per-message delivery receipts + a dropped onReady regression (#1116)
Stop lost-entry debris from piling up across restarts (#1115)

v4.5.129 — 08 September 2026¶

Close the three gaps PR #1109 left open in pending-turn rehydration (#1114)
Detect and recover a connection that died without saying so (#1113)
Cap and back off the ungoverned rate-limit retry loop (#1112)
Report bridge initialization accurately (#1111)
Load shared env for cross-agent pi MCP reads
Confirm an injected turn reached the agent before telling the browser it did (#1109)
Grant agents access to deployed MCP bridges (#1108)

v4.5.128 — 08 September 2026¶

One gate for mcp read and mcp call, self and cross-agent alike (#1107)
Remove the read-only restriction on the mini-app mcpRead plane (#1106)

v4.5.127 — 07 September 2026¶

600 s unit bound + the dependency-tree convention (#1105)
Session-to-session notify, drained on pi's context event (#1104)
Support confidential OAuth clients
Tree row for a recursively-removed directory no longer goes stale (#1102)
Add remote Fabric MCP connector

v4.5.126 — 06 September 2026¶

Pin the restart button to the far right, drop it from mobile (#1098)
Agent/path coherence for ws requests + serialize office staging (#1099)
--resume-own-work, so an agent can recover its own stalled subsession (#1096)
A discarded frame callback wedged the reveal ticker (#1095)
Skill_consolidation is blind to already-shared skills (#1097)
Don't stamp a session as reviewed when the model call fails

v4.5.125 — 04 September 2026¶

Incremental window scan, turn-review leak, brand-safe color (#1094)
Surface the provider's terminal error message instead of a generic fallback (#1092)

v4.5.124 — 04 September 2026¶

One pill vocabulary in the agent panel, and a real delete on skills (#1091)
Neutral volume bars + close the sticky-tab sliver (#1090)
Activity-protocol: the cron exclusion never matched a pi transcript (#1089)

v4.5.123 — 03 September 2026¶

Activity-protocol: two-stage goal/value taxonomy + redesigned dashboard (#1088)

v4.5.122 — 03 September 2026¶

Hostop_root_read: fix base64-encoded stdout frames being appended raw (#1087)

v4.5.121 — 03 September 2026¶

Root-only local read relay for connector-less hosts (pure gateway boxes) (#1086)

v4.5.120 — 03 September 2026¶

Real Source identity for root on host operation run + incremental daily narration (#1085)

v4.5.119 — 03 September 2026¶

Copy-to-clipboard button beside Reply on every card (#1079)
Activity-protocol: fixed signing label fallback for zero-agent gateway hosts (#1083)
Activity-protocol: stagger the gateway's cron 15m after every other host (#1082)
Activity-protocol: cache already-classified windows, stop re-billing the model hourly (#1081)

v4.5.118 — 03 September 2026¶

Collect_fleet.py: decouple the credential fallback's base_url and key checks
Collect.py: fix pi session-file discovery - single-level glob missed nested layouts

v4.5.117 — 03 September 2026¶

Notification bell's dismiss (×) actually removes the row (#1077)
Activity-protocol: replace SSH cross-host pull with a new admin-scoped host-op verb
Collect_fleet.py: run proposals/narrative only on the gateway, not every host
Activity-protocol: fall back to a local pi agent's own OpenAI-compatible config
Activity Protocol: richer classifier input, supervisor grant command, green gates
Activity Protocol: supervisor-gated fleet read connector + cross-host consolidation
Activity-protocol: per-agent achievements, derived and carried across runs
Activity-protocol: package the collector as a host cron, config from the ledger
Embed the fleet-activity dashboard, gated on the supervisor role
Install the Activity Protocol host cron from the ledger, both ways
Add Supervisor role field, mirroring Admin

v4.5.116 — 03 September 2026¶

Make the right agent panel drag-to-resize (#1076)
Unify passkey rows with the secrets/connections pill+icon pattern (#1075)

v4.5.115 — 02 September 2026¶

Offer the passkey option under the oidc driver too (#1074)

v4.5.114 — 02 September 2026¶

Grant each agent read on its own secret shard's key names (#1073)
Add read-only workspace app seam (#1072)
Shorten the Claude connection card's display name

v4.5.113 — 02 September 2026¶

Redesign the secrets panel row layout (#1071)
Hide the Claude card for agents on a direct credential (#1070)

v4.5.112 — 02 September 2026¶

Secrets panel — set/delete only, never read (#1068)
Add a Claude card to the Connections panel (#1066)
Replace every native alert/confirm/prompt with a styled modal (#1063)
Pausing a session no longer stops for a confirm() first (#1054)
Fleet map canvas stops short of the pane, capped at 640px (#1053)
Refuse symlink swaps in an agent's own home during reconcile (#1050)
The bell preview cut its second line through the glyphs (#1051)
The connector's stdin payload reaches agentctl again (#1049)
Recognize a device that already has a passkey (#1048)
Upload-file-content could blow ARG_MAX well under Graph's 4MB limit (#1047)

v4.5.111 — 01 September 2026¶

Notification bell — Clear/See/Hand-to-agent, one footer per card (#1046)
Make turn-review's model call bill against a durable session (#1045)

v4.5.110 — 01 September 2026¶

Skip Claude pin hook for Pi usercrons (#1044)
Scope pi rate-limit detection to errorMessage, not the whole line (#1043)

v4.5.109 — 01 September 2026¶

Drop the non-Rovo local REST MCP (#1042)
Resolve two pre-existing red-main issues (test regression + lint) (#1041)

v4.5.108 — 31 August 2026¶

Don't treat a null window.open() as a confirmed dead login (#1040)

v4.5.107 — 31 August 2026¶

Add Disconnect to the Connections panel (#1039)

v4.5.106 — 31 August 2026¶

Wire MS365_MCP_ALLOWED_SCOPES through the server + BOTH login paths (#1038)

v4.5.105 — 31 August 2026¶

Forward org mode into the broker PKCE helper (#1037)
Route status read through the op-relay too (#1036)

v4.5.104 — 31 August 2026¶

Enumerate claude transcripts, not just pi (#1035)

v4.5.103 — 31 August 2026¶

Wire MS365_MCP_ORG_MODE + gate its Teams/SharePoint tools (#1034)
Enumerate claude transcripts, not just pi (#1033)
Convert M365 event times from the mailbox's zone, not the browser's (#1032)
Connections panel — an agent can hand its owner an OAuth link (#1031)
Ws write verifies its stdin payload arrived complete (#1030)

v4.5.102 — 31 August 2026¶

Migrate pre-4.5.101 credential schema, add passkey from panel (#1029)

v4.5.101 — 31 August 2026¶

Platform-attachment device binding + per-device nudge (#1027)
Unhide the terminal mini-app and make its marker unconditional (#1026)

v4.5.100 — 31 August 2026¶

Face ID / Touch ID passkeys, supplementing basic/oidc (#1025)

v4.5.99 — 31 August 2026¶

Thread --channel webview --user-email through add/reconcile retry (#1024)

v4.5.98 — 31 August 2026¶

Audio MCP to per_user scope — send_voice_note always fails as shared (#1023)

v4.5.97 — 30 August 2026¶

Admit read-only Rovo tools to the mcpRead allowlist (#1022)

v4.5.96 — 29 August 2026¶

IPhone-style mobile app drawer (#1021)

v4.5.95 — 29 August 2026¶

Identify the Rovo MCP bridge at Cloudflare edge (#1020)

v4.5.94 — 29 August 2026¶

Retain provider-narrowed OAuth grants

v4.5.93 — 28 August 2026¶

Detect both patch markers, surface a stuck patch in doctor (#1018)
Decouple local REST OAuth from Rovo resource (#1017)

v4.5.92 — 28 August 2026¶

Refresh wrapped MCP guidance
Guide MCP authentication consistently
Advertise brokered Atlassian OAuth

v4.5.91 — 28 August 2026¶

Require explicit loopback OAuth opt-in

v4.5.90 — 27 August 2026¶

Make browser JavaScript ungated by default
Prevent autonomous tool-guide overrides

v4.5.89 — 27 August 2026¶

Repair three independent breaks in the blocking gate (#1011)
Serialize shared wrapped MCP runtime installs (#1009)
Grant ordinary agents read access to overlay skills

v4.5.88 — 27 August 2026¶

Stray backticks broke tool_wrapmcp.go's raw string (#1008)
Add local Jira and Confluence REST MCP
Pin the atlassian scope list by parity, not by a fifth hand-written copy (#1006)
Report MCP authorization status safely
Preserve wrapped MCP failure diagnostics

v4.5.87 — 27 August 2026¶

Include callback in PAR authorization URL

v4.5.86 — 27 August 2026¶

Push authorization requests via PAR, request offline_access (#1000)
HELD FOR REVIEW — authz: a missing X-User-Email is a refusal, not the "unscoped operator" (#993)
Validate DCR callback metadata
Default to runtime=pi, channel=webview (#994)
Request shared MCP platform scopes
Gate the FIRST wrap of an MCP to operator scope (#987)

v4.5.85 — 27 August 2026¶

Omit unavailable Rovo search scope

v4.5.84 — 27 August 2026¶

Add Rovo cross-product search scope
Use documented Rovo OAuth scopes
HELD FOR REVIEW — authz: gate the ungated mutating cockpit routes, and make the login rate limit real (#983)
Request approved Rovo scope set (#982)
Known-issues Phase 1+2: nine mechanical fixes (no authz code) (#981)

v4.5.83 — 27 August 2026¶

PII filter: the cockpit tape-over reveal, and the detector's egress measured (not live-verified) (#980)
PII redaction at the model-call seam — the provider never sees raw PII (#979)
Onboarding skill: deepen the goal to "produces an expert user" (#978)
Request only hosted MCP search scope
Anchor the picker card to where its trigger WAS, not to a detached node (#976)

v4.5.82 — 26 August 2026¶

Allow German, English, French and Italian hints

v4.5.81 — 26 August 2026¶

Gen-manpage's pitch-line anchor survived the README losing its H1 (#974)

v4.5.80 — 26 August 2026¶

Grant ordinary agents access to overlay tools
Save a video of ANY size through the OS share sheet (#953)
Add catalog add — the write sibling of browse/remove (#952)

v4.5.79 — 26 August 2026¶

Identify OAuth helper at Cloudflare edge (#951)

v4.5.78 — 26 August 2026¶

Add broker OAuth MCP (#950)
A carrier that cannot read a gateway env must not report it uninstalled (#949)
A gateway-only host's refusal names the real cause (#947)
host operation run's target refusal names the remedy (#948)

v4.5.77 — 26 August 2026¶

The host-op capability key becomes root-only, and neither signing key is readable through secret get (#946)

v4.5.76 — 26 August 2026¶

A host-op capability cannot mint a root shell — the three host shell verbs leave its vocabulary (#945)
The motion + LOD polish pass — the map opens, moves and answers like a place (#944)
The cross-host tunnel is gated on the signed grant, and comes off the fleet converge lock (#943)
The LOCAL case connects through agentd, so a non-root operator gets a shell (#942)

v4.5.75 — 26 August 2026¶

A finishing background subagent no longer deletes the next queued turn (#941)
A background subagent no longer splits one reply into N bubbles (#940)
A cockpit send renders once on every transport, not only the one that carries its id back (#939)
A gateway-only host serves its own maintenance shell (#938)
A host with two agents stops flipping in and out of its family (#937)
A reconnect self-heals a dead backend, without a page reload (#936)
Admit verified LeanIX inventory reads
Phase 7 batch 2 — 32 ledger + host-service verbs go durable (17 → 49) (#933)

v4.5.74 — 26 August 2026¶

The cross-host grant is minted by root, so a non-root operator can open a shell (#934)
The audit row is written by root, so a non-root caller can open a shell (#932)
The fleet map draws one fleet as one picture, and stops flapping (#931)
A shape-mismatched coordinator database is set aside, not refused (#930)
Dial the socket instead of stat when checking readiness (#929)
Cron_lock_test.sh goes red whenever the gate crosses midnight (#928)
agents trigger launches the cron unit, it does not await it (#927)

v4.5.73 — 25 August 2026¶

Two gate failures found by the first full run after today's merges
Status relayed read, cancel-vs-interrupted reconciliation, tombstone sweep (#926)
The notifications bell is a drawer, and it is the ONLY place system cards render (#925)
Fleet map: a three-host fleet is three hosts, and a tap reaches the moon (#924)
Two live failures on the operator maintenance shell (#923)
Operator-initiated cancellation end to end (#922)
The script-not-truncated invariant anchors on the LAST <script>, not the first (#921)

v4.5.72 — 25 August 2026¶

The scoped login boots again — openCockpit no longer reads ckBell from its dead zone (#919)
Exclude the cockpit's SSE routes from the new site-wide encode directive
Cover the first paint of a scoped login, and make hidden mean hidden on the header buttons (#918)
The session card's stop/rename/remove trio collapses to a kebab on touch (#917)

v4.5.71 — 25 August 2026¶

Host shell client's raw-mode/winsize use golang.org/x/term, not Linux-only ioctls
Operator maintenance shell: agentctl host shell <host> (root shell, admin-gated, off by default) (#916)
The keyed per-agent lock, and §4.5's fifteen verbs onto the durable path (#915)
Fleet app: the map opens the app as "Overview"; the table stays as a tab (#914)
host op becomes host operation run, and the old grammar refuses (#913)
Three-fact coordinator health, and a per-check target readiness report (#912)
Fleet app: a solar-system map of the fleet, and a real restart from it (#910)
The durable executor runs the child as the target, not as nobody (#907)
Surface the per-agent always-on channel tier in Agent (#906)
Surface the hostop coordinator in HostHealth (#905)
Refuse an empty stdin read instead of blanking the key (#904)
Surface the web-view gateway in HostHealth (#903)
The gateway host becomes an ordinary durable target — its connector lives in the coordinator (Phase 4, item 7) (#902)
The CLI becomes a thin follower — submit, print the id, follow (Phase 4, items 1-3) (#900)
Re-read the schema version under the write lock, on a DSN that takes it at BEGIN, so two openers of a fresh coordinator database cannot both bootstrap it (#899)
Retry the WAL conversion, and set busy_timeout before it, so two openers of a fresh coordinator database both survive (#898)
The cutover — the gateway's real frame relay, and apply leaves the transient path (Phase 4, item 5) (#897)
Retry the WAL conversion two openers of a fresh database race for (#896)
The dispatch-grant key provisions itself, root-only, on every host (#894)
A real executor — apply and host upgrade run for real, into the journal (Phase 4, item 4) (#895)
Expose native workspace workflows
The durable read surface — status, logs, and a follower that survives its own death (Phase 3, item 3) (#891)
Option B's retention window — compress, expire, prune, evict (Phase 3, item 4) (#890)
The follow protocol — replay from a cursor, and a hole that refuses to be stepped over (Phase 3, item 2) (#889)
The output journal — the file takes the bytes, SQLite takes the cursor (Phase 3, item 1) (#888)
The target's reconnect advertisement, and the acknowledgement that makes it stop (Phase 2, dark) (#886)
Agentd startup reconciliation — what a stranded receipt means, and what it must not be allowed to mean (Phase 2 item 5) (#885)
The daemon-import counterexample check was scoped to the whole package
The round-trip worker needs the same lock-path redirect every other test uses
The GO_SCOPE canary greps the alternation form, not the pre-#876 literal
The reconcile lock becomes an flock(2), not an in-process mutex (#884)
The coordinator-signed dispatch grant, its verifier, and the first full round trip (Phase 2, dark) (#878)
A durable pending-turn queue, so a message to a busy agent survives a refresh (#883)
Move LeanIX app to IX overlay and remove duplicate base guidance (#882)
Replace custom LeanIX wrapper with native remote MCP bridge (#881)
Injectable clock for ckstream/videojobs, plus two flakes found along the way (#880)
Feat/leanix mcp (#879)
Scope the coverage step to the Go tier under --changed (#877)
Name audio/server.py in GO_SCOPE, declare disk-stage tests' free space (#876)
A notifications bell, independent of the session on screen (#875)
Update ci.yml
The cockpit transcript harness runs under bun, not node --test (#874)
Durable target worker unit, runner and spawn seam (Phase 2, dark) (#871)
One python interpreter per video suite, not one per assertion (#873)
Durable target-local receipt store, exactly-once acceptance (Phase 2, dark) (#870)
Repoint at docs/cli-reference.md + docs/architecture.md
A ghost #cktiles told 14 JS suites the cockpit was in split view (#865)
Durable target connection epochs + delivery bookkeeping (Phase 1, dark) (#866)
The shell tier sizes itself off nproc inside a subsession (#862)
A real modal for naming and renaming a subsession (#860)
Four keyboard chords — sidebar, agent panel, new session, composer (#859)
Durable submission protocol + idempotency (Phase 1, dark) (#857)
The node cap must not keep a row just because nobody stamped it (#854)
A sign-out control, and the logout route OIDC never had (#858)
A streaming reply is not a row to recycle (#856)
The file tree reconnects on a measurement, not on principle (#855)
An answered permission card settles instead of vanishing (#853)
Cap the live SSE streams a cockpit can open (#852)
Serve the webfonts as files instead of 135 KB of base64 in <head> (#851)
Three hot paths that did their work once per event (#850)
The node cap must bind on a tool-heavy session (#849)
Durable host-operation coordinator service + SQLite store (#845)
Closing the cockpit closes every stream it opened (#848)
A sent photo's object URL is freed when its bubble dies (#847)
The primary pane's stream closes for the life of the split (#844)
Compress every response the fleet's Caddy serves (#846)
Identify Pi runtime from its rendered config
The main-lane tile streams the main lane, not the lane being read (#843)

v4.5.70 — 23 August 2026¶

Sixteen admin-nameable reads reach the peer they may name (#841)
Nine ledger/converge writers reach the reconcile lock, and a lint stops waiting behind it (#840)
agentctl logs <agent> reaches root instead of answering from the wrong journal (#839)
The admin agent's own identity reaches nine more management ops (#838)
Rename a subsession from the CLI and the cockpit (#837)
A main-lane reply carries a real session id, not "" (#835)
Finish a foreground subagent on its own tool_result (#834)
Dream-cycle Pass 5 — entity index with temporal resolution
One reading of --agent across the daemon gate and the CLI parsers (#832)

v4.5.69 — 22 August 2026¶

Preserve dream and review evidence in cron runs (#831)
A brand-new agent's empty rollup is not a failure (#830)

v4.5.68 — 21 August 2026¶

Serve a real favicon — was missing entirely

v4.5.67 — 21 August 2026¶

Don't nest the theme <style> inside the base one (#829)
Host caddy apply/recreate now check for native Caddy first (#828)
One commit per agent, not one per changed item (#827)

v4.5.66 — 21 August 2026¶

Support Azure deployment transcription endpoints (#826)

v4.5.65 — 21 August 2026¶

Support configurable OpenAI-compatible base URL (#825)
Distinguish loading Pi capability snapshots (#824)

v4.5.64 — 21 August 2026¶

Import office-pack — 35 skills, properly wired for this fleet (#822)
Discriminate runtime on $PI_CODING_AGENT_DIR, not a stray dir (#823)
Gate raw API calls that bypass the wrapped MCP tools (#821)
Lower the memory-nudge interval to 6 turns — more frequent, not less
Skillify — the meta-skill, default-on, and the dream-cycle points at it (#818)
Live in-session nudge to write memory/knowledge-base proactively
Verify the architecture-review HTML report in-browser before sending
Adapt the vendored architecture-review skills to this platform
Vendor mattpocock/skills' architecture-review skill set
A streamed reply's grace-window sweep no longer blanks it (#817)
A deferred attachment survives a gateway restart (#815)
Edge-swipe/back gesture opens the drawer when nothing is open
Don't bounce webview-dial out from under a live terminal/browser tunnel
Office file preview iframe now fills its pane (#813)
Make cache patch idempotent
Unify broker and MCP token cache format
Extend reply/quote to every card, not just chat turns (#811)
Patch pi shared runtime during staging

v4.5.63 — 20 August 2026¶

Widen HostOpAllowed to every PrivilegedRead; add agents status
Auto-reconnect + durable log for apply/host upgrade
Make apply logs reachable through host op, correctly authorized
Merge package and overlay extensions
Patch existing staged clients during resync
Host_op relay timeout resets per frame instead of firing once (#804)

v4.5.62 — 20 August 2026¶

Cron-note cache actually caches for pi agents (#803)
Stop reporting a pi agent's claude login as "absent" (#802)
Subagent-timeline lookup resolves a pi session's own transcript (#801)
Grep works for pi agents (pi-runtime parity) (#796)
Reply/quote a past message with session-aware context (#800)
Staging index lives under the agent's own runtime state dir (#799)
User-authored cockpit mini-apps work for pi agents (#798)
Agentctl mem is pi-runtime aware, like its skills sibling (#797)
Close two authz gaps found auditing authz.go for #794 (#795)
Detect the real "session limit" wording, and stop failing the unit on it (#793)
Wire live skill reload instead of requiring a full restart (#790)
Unify pi agents' attachment inbox to ~/.pi/agent/inbox (#788)
Runtime-aware ws mkdir and ws inbox path resolution (#786)
Recognize self-authored (non-symlinked) pi skills in the dashboard (#785)
Upgrade runtime and isolate model sessions
Runtime-aware skills verb, prune, and persona/zk-config rendering (#787)
Converge staged extensions before fingerprint skip
Treat the main lane's own compaction rollover as live, not as a subagent (#784)
Revert "feat(ms365): package email composition guidance" (#782)
Stop must not blank a live preview before its durable copy lands (#783)
Package email composition guidance
Safely load multiline environment files

v4.5.61 — 19 August 2026¶

Declare a gateway host's public domain; route /api/messages to the teams gateway (#779)
Green the three red gates on main (gofmt, round-trip test, errcheck) (#778)
The client secret is optional, not required (#777)

v4.5.60 — 19 August 2026¶

Patch confidential client after install
Render client secret for MCP runtime

v4.5.59 — 19 August 2026¶

Preserve JSON params in generated wrappers

v4.5.58 — 19 August 2026¶

Repair missing Pi clitool launchers

v4.5.57 — 19 August 2026¶

Correct sessinspect.go's internal/paths import path (#776)

v4.5.56 — 19 August 2026¶

Dark-mode palette + toggle for the scoped cockpit (#775)
Enumerate Pi subsessions and cron runs

v4.5.55 — 19 August 2026¶

Persist per-agent cache paths and wrapper defaults

v4.5.54 — 19 August 2026¶

Support confidential client secret in PKCE flow

v4.5.53 — 19 August 2026¶

Avoid duplicate code JSON field

v4.5.52 — 19 August 2026¶

Auto-configure the Cloudsmith apt/dnf repo before install (#774)
Trace decoded dial frames
Auto-migrate gateway hosts from Docker Caddy to native, via apply (#773)

v4.5.51 — 19 August 2026¶

Trace websocket callback delivery

v4.5.50 — 19 August 2026¶

Trace PKCE code lengths across relay
Hide auto-approved permission audit cards

v4.5.49 — 19 August 2026¶

Add redacted PKCE exchange diagnostics
Hide settled permissions during transcript replay

v4.5.48 — 19 August 2026¶

Honor host proxy settings during PKCE exchange

v4.5.47 — 19 August 2026¶

Relay OAuth callbacks across webview gateway

v4.5.46 — 19 August 2026¶

Deny an unprovisioned principal with a real 403, not an empty shell (#770)
HostChangeset.Empty() excludes the always-on tmpfiles repair (#768)
Render Pi session waterfalls
Ms365: auth-code+PKCE broker login for Conditional Access hosts (inventx) (#767)

v4.5.45 — 19 August 2026¶

Stop pi permission-journal test from writing the real journal (#766)
Configure persistent Chrome proxy from host_proxy

v4.5.44 — 19 August 2026¶

Route primary webview through local dial

v4.5.43 — 19 August 2026¶

Remove duplicate terminal tunnel error argument
Trace webview tunnel delivery and dial-back
Avoid logging tunnel token prefixes
Add tunnel lifecycle diagnostics
Allow time for remote shell startup
Honor custom provider endpoints
Add explicit Caddy recreation for log persistence
Recreate volatile agentctl runtime locks

v4.5.42 — 19 August 2026¶

Recreate volatile agentctl runtime locks

v4.5.41 — 19 August 2026¶

The claude credential broker must not run for pi agents (#760)

v4.5.40 — 19 August 2026¶

Declare + enable agentctl-webview-dial@ for pi agents (#759)

v4.5.39 — 18 August 2026¶

Terminal status / browser status — read-only /terminal/enter, /browser/enter diagnostics (#758)
Live SSE/WS connection-lifecycle counters + host stream-stats (#757)
Propagate X-Request-Id across the proxy hop (#756)
Host caddy apply bootstraps a fresh Caddy on a gateway host with none running (#755)

v4.5.38 — 18 August 2026¶

Host caddy apply — structured JSON access logs + request-ID propagation (#754)
Gateway diagnostics — http-probe, sockets, gateway-snapshot (#753)

v4.5.37 — 18 August 2026¶

Authorize host op gateway by uid, not by a name that can't exist (#752)

v4.5.36 — 18 August 2026¶

Defer the agentd postinst restart off the process tree it runs inside

v4.5.35 — 18 August 2026¶

Retry bun install from clean node_modules on EEXIST (#751)

v4.5.34 — 18 August 2026¶

Check the package repository before invoking the package manager on the opportunistic self-upgrade path
Gofmt internal/ledger/ledger.go

v4.5.33 — 18 August 2026¶

Recover uncommitted desired-version writeback
Retry fleet writeback on self-converge
Keep desired-version rollout independent of self-upgrade switch
Add ledger switch for unattended package upgrades

v4.5.32 — 18 August 2026¶

Restart gateway caddy after package upgrades
Restart agent transport bridges after upgrades

v4.5.31 — 18 August 2026¶

Restart webview services after package upgrades
Stop reporting subagents whose own transcript went quiet (#746)
Exempt more self-scoped verbs from the fleet FIFO lock (#745)
Restart agentd after package upgrades
Exempt attachment fetch from the fleet FIFO lock (#743)

v4.5.30 — 18 August 2026¶

Isolate pi subsession ingress sockets (#742)
Stop cross-host reads and docker from riding the FIFO converge lock (#741)

v4.5.29 — 18 August 2026¶

Allow admin agents to set a target host's outbound proxy (#740)
A 1-pixel outline is a hairline, not the whole frame height (#739)

v4.5.28 — 18 August 2026¶

Surface provider errors during login
Agent-message ENGAGE reads the card cross-host, over the op-relay (#736)
Add cross-host fleet admin host operations (#737)
Pause icon/label on subsession stop action (#735)
A work/ subdirectory is created group-unwritable (#734)
Pin PI_EVENTS_SOCK so a pi sub owns its ingress (#inventx) (#733)
A retired stream preview must not come back from the dead (#732)
Cap agents.slice memory — it was the one slice with none (#731)

v4.5.27 — 18 August 2026¶

Resolve shared placeholders in wrapped MCP commands (#730)
Skip the overlay ACL grant for an admin with no account on this host (#729)

v4.5.26 — 18 August 2026¶

Apply the host proxy before the hourly desired-version step shells out (#728)
Check the discarded Write return in the PWA-bypass test upstream (#727)
Apply the host proxy before host upgrade shells out; self-heal secret env ownership (#726)

v4.5.25 — 18 August 2026¶

Serve PWA manifest/icons unauthenticated (#725)
Agent-to-agent messaging, cross-host — and close the attachment owner-scoping hole (#724)

v4.5.24 — 17 August 2026¶

Three stale-assertion/lint failures that redden ci-local on main (#722)
OIDC state cookie carries SameSite=Lax like every sibling cookie (#723)
Read the video job doc when agentctl-video-ingest@ fails (#721)
Self-heal bun installs, force dnf metadata refresh, drop the self-update stub (#720)

v4.5.23 — 17 August 2026¶

Force-refresh the default PWA icon via a path change, not just ?v= (#719)
Give a precise reason for 0 MCP sockets on a pi-only host (#718)
Stop false-flagging pi agents as unhealthy (#717)
Imap_catalog_test asserts the pre-#708 exec line (#716)

v4.5.22 — 17 August 2026¶

Admin-agent incident response, package rollout, docker access (#715)
The mini-app action plane reads the risk catalog, not a third list (#714)
Per-tool risk declared in mcp.yaml, generating pi + claude policy (#713)

v4.5.21 — 17 August 2026¶

Login helper respects the proxy and finds a pi agent's shared install (#712)

v4.5.20 — 17 August 2026¶

Wrapped MCP {dir} resolves to the shared staged install, not the raw catalog dir (#711)
A stream frame with no text must not render an empty bubble (#710)

v4.5.19 — 17 August 2026¶

Wrapped MCP cli.sh re-derives MCP_CMD from the current catalog (#709)

v4.5.18 — 17 August 2026¶

Make every node/bun MCP's outbound fetch honor HTTP_PROXY/NO_PROXY (#708)

v4.5.17 — 17 August 2026¶

Render this host's proxy config into every agent's own env (#707)

v4.5.16 — 17 August 2026¶

Apply fresh proxy env before bootstrapping the bridge, not after (#706)

v4.5.15 — 17 August 2026¶

Force a C locale for every setfacl the overlay grant spawns (#705)

v4.5.14 — 17 August 2026¶

Sync process proxy env before any provisioning subprocess runs (#704)
Correct REPO_ROOT depth for installed payload layout (#703)

v4.5.13 — 17 August 2026¶

Make cron runs respect PI_BASE_URL (#702)

v4.5.12 — 17 August 2026¶

Auto-provision a SOCKS5->HTTP bridge when host_proxy needs one (#701)

v4.5.11 — 17 August 2026¶

Declarative NO_PROXY exclusions on top of host_proxy (host_no_proxy:) (#700)
Don't reap agents.slice-supervised processes as orphans (#699)

v4.5.10 — 14 August 2026¶

Outbound-proxy support for locked-down hosts (forwarding + declarative host_proxy:) (#698)

v4.5.9 — 14 August 2026¶

--git must adopt origin, not silently no-op a missing remote (#697)

v4.5.8 — 14 August 2026¶

Zero declared agents is not a failure, it's an idempotent no-op (#696)

v4.5.7 — 14 August 2026¶

--git must register the joining host, not defer it to apply (#695)
Self-register the host BEFORE the no-agents guard (#694)
A large file's save could still write 0 bytes, and the save that did it hung forever (#693)
A folder drop leaves a stuck outline and collapses the tree (#692)

v4.5.6 — 13 August 2026¶

Release.yml never builds the kasmvnc/openbox rpms before the yum repo step
Agents set channel/runtime now reconciles immediately (#688)
Agentctl-webview-dial@ never worked for pi-runtime agents (#687)
Fully automatic provisioning — EPEL, Chrome, kasmvnc + openbox
Full GitHub/GitLab/ADO breadth + a tracked-repos list (#689)
CostCapUSD blank in the cockpit for an agent that declares one (#686)
Give dnf clients a way to authenticate to the rpm repo (#685)

v4.5.5 — 13 August 2026¶

Ship a signed .rpm + yum/dnf repo for RHEL 10
Git-explorer Local tab showed 0 branches/commits/worktrees (#683)
Stop ws publish workspace walk from burning CPU on teams/webview agents (#682)

v4.5.4 — 13 August 2026¶

Terminal — the cross-host path #678 deferred
Host set + self-hosted brand font (webview_font_data)
Terminal — an on-demand admin shell, framed in the cockpit
Unread dot on the session list + a "new" divider in the transcript (#677)
Git-explorer — one cockpit surface over the four forge MCPs (#676)
Route attachment fetch through agentd like inject/notify (#675)
Ship git/github/gitlab/ado catalog + action-plane allowlist (#674)

v4.5.3 — 13 August 2026¶

Catch synchronous throw on a dead websocket send (#672)
Stop the informative soft-cap close from double-posting the real final (#673)

v4.5.2 — 13 August 2026¶

Ship real HAR-capture scripts, adapted to one always-on Chrome (#671)
Notify the owner directly when subsession start/resume is refused (#670)
Reset the spend cap at local midnight, not the full rollup window (#669)

v4.5.1 — 13 August 2026¶

Surface cost_cap_usd in the Agents + Usage tabs (#668)
Resolve the parent's channel env from EnvironmentFile= too, not only Environment=
A re-add wired the collapsed clitools DELTA, dropping every channel default (browser, zk) (#666)
Pi native clitools excluded from cockpit app activation (#665)
Root steering file is AGENTS.md on pi, not always CLAUDE.md
Scaffold the workspace and make housekeeper/dream-cycle runtime-aware

v4.5.0 — 13 August 2026¶

Footnote GPT-5.6 Sol's long-context surcharge (#663)
Bill GPT-5.6's long-context tier past 272K prompt tokens (#662)
Recover from renames and atomic saves via op:"relist" (#661)
Sweep the fleet for a bare admin usage, and read the target behind a leading flag (#660)
Resolve a finished subagent's chip without a reload (#659)
Count and classify pi cron spend (#658)
Skip stray subdirectories when resolving host cron descriptors (#655)
Split connectors into self-serve login vs needs-an-administrator
Count pi subsession spend in both cost scanners (#652)
Surface a permission-denied transcript read, and route usage through agentd for admin scope (#651)
Drop pi's synthetic tool-status lines from the stream preview (#650)
Handle a missing connector live, mid-task, not just as a taught stage
Full rework — an evolution arc, real vocabulary earned not given (#649)
Price the fleet's non-Anthropic models instead of guessing opus (#648)
Optional per-agent cost_cap_usd at all three choke points (#647)
Per-agent custom endpoint for the pi runtime (#646)
Resolve a pi agent's wired MCPs at the agent's own uid
Per-agent custom Anthropic endpoint (generic gateway + Azure Foundry) (#644)
Count subagent sidecars + pi agents in the cost rollup (#643)
Recognize the runtime's reworded SendMessage revival text
The view switcher listed ended/stopped subsessions too (#641)
Drop vestigial pending.call field in transcriptCalls
The view switcher's main-session dot was always grey (#639)
Wire Artifactory package mirrors (apt/npm/pip/Go) as Reconcile step 0
Add a + New subsession button to the sidebar sessions header (#637)

v4.4.0 — 12 August 2026¶

Make grammy optional for a non-telegram pi agent (#633)
Ship the session inspector as an embedded app (#636)
The file editor could save an open file to 0 bytes (#635)
Session inspector — session list + per-session tool-call waterfall (#634)
Auth-broker: generalize the callback to any OAuth provider (#632)
Make ci-local.sh green on main again — four independent gate defects (#631)
Make catalog list table scan the repo overlay (#630)
Provision a webview-only pi agent (agents add --channel webview) (#629)

v4.3.16 — 12 August 2026¶

Close four claude/pi runtime-parity gaps (deferred attachments, attachment_fetch, telegram media, app activation) (#625)
Restart your own agent from the web-view (#627)
Hold a screen wake lock while a voice note is recording (#626)
Stop the send button blocking every session during an upload (#624)

v4.3.15 — 11 August 2026¶

Self-host Geist/Geist Mono/Inter instead of live Google Fonts (#623)
Record voice notes with tap-to-start/tap-to-stop, not a hold gesture (#620)
Mcp wired / agents status lie about cross-agent MCP state
Find a transcript in whatever project bucket it relocated to (#618)
Emit attachment_file_id on the TXT-mode channel header (#619)
Download files directly on desktop instead of opening a share sheet (#615)
Fleet app: add Artificial Analysis Intelligence Index to model comparison (#614)
Admin-scope cross-agent ws ls / ws cat via the read proxy (#613)
Stop workspace uploads landing under a doubled root (#612)
View switcher, split-active-only, resume-drop-in, refresh button (#611)

v4.3.14 — 11 August 2026¶

Cap how long any one browser-tool call can hang the shared mutex (#610)
Pin the session pill's chevron to its own trailing edge (#609)
Actually stub agentctl in cron_lock_test.sh — the #606 fix never ran (#608)
Widen the long-pass timeout to absorb residual host contention (#607)
Stop cron_lock_test.sh's notify leak, and widen video_audio_bed_test.sh's dB tolerance (#606)

v4.3.13 — 10 August 2026¶

Chown mkdir's ancestor dirs, add recursive folder delete (#604)

v4.3.12 — 10 August 2026¶

A TXT-mode agent can now complete a deferred attachment pull (#603)
Sessions in the picker and sidebar now order by last used (#602)
A recut moves the stated camera spans that were pinned to the boundary it moved (#601)
The full cut covers every take when the cameras never rolled together (#598)
The app-context chip gets its own row on the thumb band (#599)
An overlay sequence that flips pixel format encodes on the GPU, and a render keeps its own hwaccel (#597)
Video-editing skill: two-tier sampling for placing cut boundaries on fast motion (#596)
A cut range may play at a multiple of real time (#595)
HTML document previews grew a second (outer) scrollbar (#593)
Resuming a session now has a loading state (#594)

v4.3.11 — 10 August 2026¶

The browser window follows the framebuffer again after a resize_page (#592)
Drop the superseded "back to chat" tab from the strip (#589)
The Usage pane shows the rate that decides the cost, and drops the table that did not (#588)
A score is laid into the cut, not seeked at every shot boundary (#590)
A short cut's members that share a range start no longer swap cameras (#587)
A resumed stream preview that is only a TAIL now retires with its durable copy (#591)
App-context chip sits left of the sheet toggles on the thumb band (#585)
A runtime switch stops the OTHER runtime's unit and removes its drop-in (#586)
The sidebar session row's ⋯ opens a small menu, not the composer picker (#584)

v4.3.10 — 10 August 2026¶

A file over the share cap saves through a new tab, not a dead anchor (#583)

v4.3.9 — 10 August 2026¶

GPU hw_frames_ctx crash + short-cut camera-plan inheritance (#582)
Tolerate text-keyed caption words, don't crash on ingest/capture/merge (#581)
Cost transparency — real rates, model comparison, fix stale pricing (#580)
The workspace tree re-syncs on foreground return (#579)
Exempt systemd --user managers from the orphan rule (#578)
Add first-party IMAP/SMTP MCP + wire mail mini-app (#577)

v4.3.8 — 08 August 2026¶

The thumb band's right-align had two bugs, and neither showed up in the CSS (#575)

v4.3.7 — 08 August 2026¶

A comment without its // took every agent on agentvm down (#574)

v4.3.6 — 08 August 2026¶

A fresh session could not reach its own history (#573)
The Sonnet default never reached the runtime, and the test I wrote proved nothing (#572)

v4.3.5 — 08 August 2026¶

Sonnet is the default, and two Opus lanes are what make that safe (#571)

v4.3.4 — 08 August 2026¶

The conversation is the floor — a way back to it, and a destination on the composer (#570)

v4.3.3 — 08 August 2026¶

An agent-less host is not a fleet-usage failure (#566)
The window measured recurrence against the sessions that recur by definition (#569)
The main lane's dot in the session picker was grey whatever the agent did (#568)
The SessionStart continuity block named a six-day-old session, then vouched for it (#567)

v4.3.2 — 08 August 2026¶

One session control in the header, file-only tab strip (#564)
Serialise the long nightly passes, cap their memory, protect the alerter (#565)

v4.3.1 — 07 August 2026¶

Fade the leading edge of a streaming reply in (#563)
Give the phone back two bands of chrome above and below a mini-app (#562)

v4.3.0 — 07 August 2026¶

Clear the two audit violations every mini-app carried in its error state (#561)
The pinned strip is not a phone control — the drawer is (#560)
Filter either data tab to one agent, and stop the cache lying on reload (#559)

v4.2.0 — 07 August 2026¶

The usage rollup ships as a default host cron, on every host (#558)
Active hours are the hours a HUMAN drove, against an 8.4h day (#555)
A guided walk-through skill, and composer prompts with breadth (#557)
One control per file-tree row, and a folder can be deleted (#550)
The cockpit's absolute path spelling resolved a symlink as a broken link (#552)
The phone app strip gets its daylight, its touch targets and its scroll (#551)
Bound the payload long-pass units above their inner cap (#549)

v4.1.0 — 07 August 2026¶

A redirect is not message text, and an unexpanded path is not an attachment (#548)
Make the slice memory cap proportional, not a constant (#547)
Pinned mini-apps, a strip that exists on a phone, and cmd+k (#546)
Guard the stdin shim against a re-executing launcher (#545)
The fleet app grows tabs, inspect, and a table you can read down a column (#544)
Warn when a stored margin_top means something different than it did (#543)
Give the long passes a 1800s cap; keep the unit bound above it (#542)
render cancel marks the project's job record, not only the spool (#541)

v4.0.1 — 07 August 2026¶

The fleet app mounts — it was calling a renderView contract that does not exist (#540)

v4.0.0 — 06 August 2026¶

The fleet app replaces the root grid, and carries the controls (#539)
The fleet is a mini-app, auto-activated for admins (#537)
The fleet snapshot refresher runs only while somebody is watching (#536)
A symlinked directory lists as a directory, not an 18-byte file (#535)
An admin's cockpit is scoped to the host, not to one agent (#534)
Add-to-chat REFERENCES a workspace file instead of re-uploading it (#533)
TXT mode is the default transport; the plugin path is the opt-out (#532)
Every agent has its own display; retire private_display and xvfb (#531)
Admin is a role, and any number of agents may hold it (#529)
A mix row, and a picture row that includes what is not a camera (#530)
A verb an MCP calls no longer blocks on the activation socket (#528)

v3.2.4 — 06 August 2026¶

A non-zero gain is on the lane, not behind a hover (#527)
A source the cut pulls in gets its own lane (#525)
An unbounded component does not grow with the cut (#524)
The degraded-path badge names the stream and claims no codec (#523)
The VAAPI decode probe asserts a hardware surface (#522)
The read seam serves a shared project the workspace declares (#521)
A sub of a TXT-mode agent came up on the transport its org blocks (#520)

v3.2.3 — 06 August 2026¶

Resolve the shared-library import from the file's real path (#519)

v3.2.2 — 06 August 2026¶

A still image is a first-class source, and the preview can draw one (#518)
An outro can reach a short cut, and an edit can no longer delete one (#517)

v3.2.1 — 06 August 2026¶

Classify the full-cut verb, and retire two assertions the product outgrew (#516)
A cut range may name its own source, so footage that was never rolling can be placed (#515)
Teach scaffold_full_composition, and stop the outro-on-a-video-lane trap (#514)
The full episode cut is repairable on a project that already exists (#512)
A word on a segment boundary was claimed by BOTH segments (#513)
Watch every component rung an agent can write, not just the one it must not (#511)

v3.2.0 — 06 August 2026¶

Video app: record what the desktop measurement said about the burn preview
Stall-handler: a parent waiting on working subagents is not wedged
Video app: six defects found cutting episode 15
Video harness: the episode-15 shape, and the write-side probes for it
Six pieces of documented hand-work become product verbs
Podcast-clips skill: a project can be several agents' project, and this skill never said so (#507)
A component library the SHARED PROJECTS own, so one project renders one way
Video-clip-assembly skill: this skill is full of hand edits, and a hand edit takes no lock
Video-clip-assembly ships, instead of existing on exactly one host (#505)
Video-editing skill: document the two-writer loss on clips.json and what the lock does not give you (#504)
Edit_layers derived the whole transcript onto every payload, and threw it away
The pinned speaker pass never reached work/captions.json
The reveal is paced to the producer, and no tail snaps (#502)
Clip_pad_s reached into the neighbouring sentence (#503)
Every delivered file carried SAR 404:405 instead of square pixels (#501)
Render_project is the batch render — named set, async, in-flight guarded (#496)
Edit_timeline(op='frames') writes a whole shot map in one call (#495)
The full episode cut is an outcome of ingest, not a claim (#494)
A shared pointer makes one project several agents' project (#500)
Two writers on one clips.json lost one writer's rows entirely (#499)
The atomic write left every project document at 0600 (#498)
An unreadable clips.json read as a project with no clips (#497)

v3.1.2 — 05 August 2026¶

The a/v sync tolerance was narrower than its own two quantisers (#493)
The node harness had no ctx.filePick, so the video ingest row threw (#492)
Resolve a relative --file instead of refusing it (#491)
An unreadable attachment is a 404, not a 0 KB download (#490)
Stage outbound attachments by direction, not by inject's cap (#489)
Four derived-data defects found cutting a real episode (#488)
Share sheet on mobile downloads, and one canonical control per file direction (#487)
The transcript is one ascending timeline, and a reply is one bubble (#486)

v3.1.1 — 05 August 2026¶

A read must not be able to starve the fleet (#485)
Ship TitleCard, with its lengths on the right axis (#484)
The preview draws the shape the cut is at, and the media url survives being appended to (#482)
A failed write is visible, and the phone gets its screen back (#481)
The read seam serves the system font directory (#480)
A stale lane resumes, an unreadable registry fails, a concluded session says so (#479)
The preview draws the render's font, and the shot map replaces an empty lane (#478)
The preview reads the halves the MCP names, and full survives a re-proposal (#477)
The shots tile the cut, so the picture meets the bed (#476)
Punctuation rides the word it follows (#475)
A silent encode death reports its exit status (#474)
The backlog is one total order, and it says what it left out (#472)
Classify detect_shots on the reachability plane (#473)
One bubble per reply, revealed at a rate the reader sets (#471)
A file send must not hold the fleet-wide converge lock (#470)
Detect_shots can run detached, so it reaches a real episode (#469)

v3.1.0 — 04 August 2026¶

Stable caption chunks, so the subtitles read on mute (#465)
Per-SHOT framing for an already-edited source, derived then corrected (#468)
The speaker pass chunks, and the identities are pinned (#467)
A clip's boundaries can move without losing its tuning (#466)
A chat video plays where it sits, and its download writes a file (#464)
Back up an agent's own mini-apps, like its local skills (#463)
Skip the telegram plugin pin under AGENTCTL_TXT_MODE (#462)

v3.0.0 — 03 August 2026¶

A mini-app may declare no providers and read no MCP (#460)
TXT mode — the shim drives claude, no plugin, no MCP tools (#459)

v2.9.0 — 03 August 2026¶

Ms365 login runs the installed server, not a fresh npx download (#457)
Let an agent drive its own subsessions (#456)
Video app: name every block, one secondary action, no scrollbars on the lanes (#453)
A render a test asked for must not notify the owner (#454)

v2.8.9 — 02 August 2026¶

Start the fs watchers after the handshake, not after connect() (#451)

v2.8.8 — 02 August 2026¶

Unbreak main — errcheck on the one-uploader test, and give the harness the real ctx.pick (#450)
Warn when two clips are near-duplicates, and reconcile ep-1's labels (#449)
Frame a clip or a cut-away from the timeline, and file the rect on the leaf (#448)
Framing gets its own surface, the row loses its reframe button, and the proxy is picture-only (#447)
One picker primitive (ctx.pick), and a mobile gate that can see a scrolling header (#445)
Lift sourceRange with sourceToCut, main is red without it (#446)
One uploader for the workspace, the video app and the composer (#444)
Make a download actually download (#443)
The merge control says "merge clips", and a span that leaves the cut stops at its range (#442)
Frame-exact cuts, and a join that measures itself (#441)
The MCP handshake no longer waits on a filesystem walk (#429) (#438)
Add apps active, the launcher set, beside the narrow apps list (#440)
Restore the deploy key with its trailing newline (#439)

v2.8.7 — 01 August 2026¶

Caption canvas, chip liveness, and a launch that lied about failing (#437)

v2.8.6 — 31 July 2026¶

The render that could never start, and four lane/key defects found on real footage (#436)

v2.8.5 — 31 July 2026¶

The retained halves, the preview audio bed, and the cockpit lanes + job queue (#435)
Video MCP: list_jobs — every job on a project, of every kind, reattachable
C4: space toggles play/pause again — reproduced and fixed in real Chrome
Video MCP: an automatic centre rect never outranks a declared one
The pool is a LIST, and every cut carries the same lanes
Video mini-app: the pool is the pool, and a cut-away says where the sound is
Video MCP: a project is usable at ingest, and no caption edit writes a blank
Video mini-app: a short cut is its own lane, and every clip is visible
Video MCP: resolve inherited clips, regenerate payloads, validate switches by shape

v2.8.4 — 31 July 2026¶

The cockpit as the owner accepted it
The crop precedence is five rungs, not four
Key the LANE's crop by aspect too, mirroring the stream rung
The clip's variant IS the shape — the composition and the render read it
Merge_clips — a SHORT CUT is an ordered list of clip references
The session bar earns its place, and the selected lane wears the theme's accent

v2.8.3 — 30 July 2026¶

Build_camera_plan says whether the tuning survived the call
Validate_project — the data model, checked, without a second rulebook
The data model, so an agent can work the files directly
The B-roll gestures state their outcome after the re-read, and report the snapshot
A sliver joins a neighbour instead of being dropped
The export cuts a B-roll reference, and one number bounds a shot
_harness/README: the rotation gate, and the rule it puts on new streams
Assert BOTH sides of the gate in one run
Harness fixture: model probe_for_geometry's rotation gate, and derive it
State the span's outcome after the re-read, with the replaced count and the snapshot's fate
The B-roll tool schema said the opposite of what the code does
Harness fixture: every manifest probe carries rotation
A B-roll leaf plays from its start, and the old shift was incoherent
B-roll is a clip reference resolved live (WIP — recovery commit)
Two cameras share one frame, stated as a span from the timeline (#419)
One camera plan, read by the preview and by the export (#418)
A layer edit writes clips.json, and the fixture refuses what production refuses (#417)
The agent drawer starts closed, opens on subagents, and speaks English (#415)
Make domshim's textContent obey the DOM spec, and test the shim itself (#414)
Video cockpit: the two-level crop window, overlapping clips in rows, and the keys made visible (#413)
Reconcile a file tab against disk on activation, and give the pane a Refresh button (#411)
One clip one composition, inheritance from full, the stack as data, and a return that matches what it wrote (#412)
The variant is a rect too — nothing is baked but the source and the proxy (#410)
The process that watched the file now says what changed (#407)
Fix "Add to chat" on every workspace-tree file (#406)
The live follow resumes at a byte offset, so an unchanged lane parses nothing (#405)
Remotion applies the crop rect, and the two renderers are held to one rectangle (#402)
The crop is a rectangle you drag, not a fifty-minute encode (#403)
The crop is data — one resolver, five readers, and the stack applies it (#404)
Per-agent uid isolation for local agent ports (#279)
The title's style resolves in the MCP and is set in the blade (#399)
The tab strip and the subsessions panel are operable with a finger (#398)
The send-scroll on mobile, at the root (#395)
Per-span clip drag, a spoken promotion failure, the single-speaker panel, and three names that meant two things (#392)
Fix duplicate/misattributed agent-message cards + the vanishing compaction chip (#393)
Show that a new subsession is starting (#391)
Scope the compaction card to the lane that compacted (#390)
A Title component, and a drift check on the caption style's two declarations (#389)
Add cut, delete a part, merge clips — and one word for one thing (#387)
A burnt caption is the same fraction of the frame at every shape (#388)
Size the worker pool from the cgroup quota, not from nproc (#386)
The render joins the job registry, and its encoder readout stops being blank (#385)
The settings pane becomes a blade that follows the selection (#383)
One list_projects, and an argument the verb does not declare is an error (#382)
A fixed sleep is a bet on machine speed, not a wait for the app (#384)
Make boot_stagger load-independent, and enforce ci-local before a push (#381)
A backtick in a check description is a command, not markup (#380)
Capture a clip while watching, ship one cut at both shapes (#379)
Scope the run to the change set, fan out the shell tier, and fix the speaker→camera mirror (#378)
A clips lane you capture into, and one cut that ships both formats (#377)
The SessionStart suite owns its environment, so the gate says the same thing to everyone (#376)
One job pattern, and every long encode is a job you can watch (#374)
The material column — actions live on the thing they act on (#373)
The selected session is a thing you can see, on every tab (#372)
Lanes first, a playhead you can read, and weight that follows the state (#367)
The composer follows the session you selected, on every tab (#371)
Registered is not reachable — a shim watchdog, an honest boot check, and a cheaper cold start (#368)
The panel that never left, a player pointed at a render that never existed, and speaker merges (#366)

v2.8.2 — 28 July 2026¶

The transcript crash, the invisible diarizer pass, and the duplicate master (#353 follow-up) (#365)
The three the audit left on the table — a queued turn shows dots, a lane is a lane over SSH too, and the main lane has one stream (#364)
Derive status from systemd, stop storing it (#362)
The split view is a real chat — it says who is working, and each pane is its own lane (#363)
Let a crashed subsession actually restart (#360)
Channel-correct persona + installs that actually restart (#361)

v2.8.1 — 28 July 2026¶

Spool guard on capacity, drop highlight that clears, gate timings (#359)
Converge the private display for pi-runtime agents (#358)
One jsdom search, and a durable place to install it (#357)

v2.8.0 — 28 July 2026¶

A word carries a speaker control, so the review queue can be worked (#356)
One subsession status, one dot colour, on both surfaces (#355)
Diarization is a producer, not a rung — and the UI stops contradicting it (#353)
Agent scratch belongs on the data volume, not on / (#354)
The diarizer rung is not attribution, and must stop claiming to be (#352)
The cockpit says which rig this is, and which rung is acting (#351)
Who is speaking — naming, derived where possible, never asked blind (#346)
Mini-app-designer becomes a default skill; agentctl skill and README rewritten cockpit-first
Prepare speaker cuts — the automatic camera plan, in the lane it writes (#342)
Sync says which offsets it trusts, and refuses the ones it does not (#350)
An ISO channel never overwrites a camera, and a container is never the mix (#348)
A failed detached job exits non-zero, and an empty probe is not remembered (#349)
Which rig is this — a shape test over the sources, and it says so (#345)
A subsession's interruption is not the owner's turn (#344)
The app.js harness extracts by NAME, and main goes green again (#347)
One unnamed ISO channel is not a programme mix (#343)
A multitrack recording is a container, its channels are sources (#341)
Some sound is content, the rest is only evidence (#340)
Inject a resume turn after a restart, on an INTERRUPTED verdict only (#339)
A kind glyph at the head of every timeline lane (#338)
A detached transcribe has the key, and a cached probe cannot lie about it (#337)

v2.7.4 — 27 July 2026¶

First-run screen painted into a detached node — plus + project, so creating isn't first-run only (#336)

v2.7.3 — 27 July 2026¶

A subagent transcript names the parent and the sub, not "You" and the parent (#335)
The timeline editor is the app — the happy-path shell (#329)
Relative markdown links open the file; office docs default to the live view (#334)
Auto-inject context for file, skill, cron, hook, session and subagent tabs (#331)
Reconcile the typing indicator from the transcript's own turn-end record (#330)
Stop the agent-card .nm style leaking into the sidebar tree and definitions list (#328)
A skipped suite is a gate failure, not a pass (#327)
The SessionStart continuity verdict fails closed when it has no verdict (#326)
A video is not silent, and an empty transcription is not a success (#325)

v2.7.2 — 27 July 2026¶

The read-only half of the browser MCP stops asking (#324)

v2.7.1 — 27 July 2026¶

The file chip opens a tab, and the tree stops shouting (#323)
Google-workspace actually starts — bun takes its flags after run (#322)

v2.7.0 — 27 July 2026¶

A private-display agent is actually off the shared xvfb tier (#321)
A dropped clip is named something the MCP accepts, and a failed ingest says so (#320)
Leaving a mini app withdraws its context, and the block stops shouting (#319)

v2.6.0 — 26 July 2026¶

A portrait source is planned as the shape it actually is (#318)
An app drawer, because a row of anonymous glyphs does not scale (#316)
The turnless read plane can reach a query-/retrieve-shaped MCP (#317)
Component layers reach the pixels, and a release can reach the library (#306)
An agent killed mid-turn picks its work back up (#314)
Every claude that starts reasserts the telegram plugin pin (#312)
The browser status line is a tab picker, so the agent reads the tab you mean (#311)
The browser toolbar clears the touch floor in both dimensions (#310)
An agent-to-agent message renders on the receiving side too (#309)
Drop the page into chat — its text and its screenshot (#308)
A subagent chip belongs to the agent, and a finished one leaves on its own (#307)
The mini-app context reaches the agent on the dial-in transport (#304)
An MCP manifest change reaches the units it renders (#303)
Footage lands where a verb can see it — inbox in, adopt in place (#305)

v2.5.6 — 26 July 2026¶

The browser mini-app renders correctly at any devicePixelRatio (#302)
Zero-argument tools are callable again, and a tool error stops looking like data (#300)
The browser mini-app renders at device resolution (#301)
The context chip sits in the composer, and says the app once (#299)
Restart browser@ when the font rendering config moves (#298)
Copy/paste in the browser mini-app (#296)
A background mini-app can no longer write context onto the chat tab (#297)

v2.5.5 — 26 July 2026¶

The private display comes up ready, and the tab list is not empty (#295)

v2.5.4 — 26 July 2026¶

The transcript stops scrolling itself (#294)
/browser/ reaches an agent on another host, without ever naming one (#293)
Give the typing indicator breathing room and a bit more height (#291)

v2.5.3 — 26 July 2026¶

The mini-app reads the file KASM_PORT is actually in, and apply bounces Chrome (#290)
The browser window follows the framebuffer, and the race gate actually runs (#289)
Browser mini-app — the agent's real Chrome, framed and authenticated (#288)
Videos play in the bubble — an inline tile, not a file card (#283)
Per-agent private X display (KasmVNC + openbox), opt-in and inert (#286)
Adopt chrome-devtools-mcp as the browser MCP, defaulted fleet-wide (#282)
GPU decode by chain shape, one generation for multi-shot masters, live job ids (#287)
The inbox path can seek too — Range on /api/inbox (#284)
Window in O(viewport), teardown contract, coalesced fs-event re-derive (#285)
Every mini-app contributes view context to the composer (#278)
Explicit membership only, source-shaped layers, dot-free frames path (#280)
Custom video preview — player, per-track timeline, membership, ingest + picker (#276)
Explicit composition membership, declared stream roles, inbox listing + append-safe ingest (#277)
Split both halves by default, quality-targeted rate control on both backends (#275)
A resumed subagent is running again — re-START on SendMessage revival (#274)
Three chip colour families — activity coloured, state semantic, context neutral (#273)
Pay back late media growth above the viewport + render-progress chips (#270)
Reframe to a derived source, frame sampling for crop choice, lossless track split (#271)
Collapse show/episode into ONE level of projects, with one cut-mapping primitive (#269)
Typing indicator out of flow + scroll-back stops fighting the finger (#268)

v2.5.2 — 25 July 2026¶

Land at the true bottom when returning to the chat (#267)

v2.5.1 — 25 July 2026¶

Stop the typing indicator from shoving the transcript (#266)
Clear a unit's latched failure when apply rewrites its file (#265)

v2.5.0 — 25 July 2026¶

Generate the changelog block + release-note bullets in the scripts (#263)
Self-converge after an unattended upgrade, and stop lying about it (#264)
Converge enable-state, and four ways studio broke silently (#262)

v2.4.0 — 25 July 2026¶

A first-run flow, and the two blockers behind it (#261)
Tolerate an absent spool instead of failing 226/NAMESPACE (#260)

v2.3.0 — 25 July 2026¶

Cross-compile the reaper for darwin (Homebrew build)
Agent-driven video editing: MCP, cockpit editor, Studio, detached renders, resumable uploads (#257)
apps validate — surface why a mini-app silently doesn't appear
Keep the local gate's Go cache off the root filesystem (#259)
User-authored local mini-apps (deb/overlay/local layering)
Render HTML email bodies via on-demand MIME (no fleet env flip)
Block remote sub-resources in the email HTML viewer CSP
Hold a loader through the seed, reveal the composed state at once
Refresh the sub-agent chip when a finished sub is re-ignited
O(1) live-transcript selection — early-return + persistent classify
WS heartbeat + non-blocking SSE fan-out
Atomic shard writes + serialize the read-modify-write
Reserved-name + existing-user guards on agents add
Collect-and-continue on a per-agent failure, don't abandon the fleet
Kill the O(N^2) sops-decrypt storm in fingerprinting
Bound the windowed-row set — free detached rows, gap-free
Send scrolls fresh bubble into view; re-sync sub chips on focus
Clamp seed/delta cards to the visible window (timeline interleave)
Coalesce live windowing; drop dead ckfade; guard Back re-arm
Trap browser Back inside the PWA; scroll the app launcher
Calendar week grid — framed grid, today badge, accent chips
Http mini-app reads, pane isolation, media share/close, seed scroll

v2.2.12 — 24 July 2026¶

File-tab images open in the lightbox (zoomable) (#256)
Persistent composer — type to the agent from inside a mini-app (#255)
Workspace upload modal — real progress and the server's own error (#253)
MS365 calendar search via OData contains() + confirm the mail search seam (#252)
Require actual silence, not just a stale backlog (#251)
Converge regenerates stale wrapped-MCP cli.sh + prewarm remote MCP cold start + smoke test (#249)
Office viewer tab (docx/xlsx/pptx) via Microsoft's engine (#248)
Full per-release provenance changelog + generator (#250)
Inline image on reload (J2) + fresh/loading session state (K1) (#247)
Inject newline parity (J1) + agent-sent SVG served safely (J3) (#246)
Transcript virtualization — JS test harness + windowing (#244)
Cross-app search — generic search slot + Mail/Calendar search adapters (#245)
Threaded (conversation) view for Mail — Gmail + MS365 (#243)
Gmail read-view reads headers from the nested headers object (#242)
Mail read-view + real calendar week grid with event details (#241)
Unified attach-to-chat — entities become attached files, multi-select, one affordance (#240)
Resumed subsession connects to its lane instead of erroring not-connected (#239)
Cron output renders as a CRON card, not a SENT self chat card (#238)
Running-subagents chip actually surfaces at runtime (#237)
Robust table rendering + agent-sent attachments open in-tab (#236)
Autoscroll on send/typing + stable image-attachment dedup (#235)

v2.2.11 — 23 July 2026¶

Pin script forced the fused telegram plugin onto webview agents (+ lane-dial regression coverage) (#234)

v2.2.10 — 23 July 2026¶

Expose agents set <name> channel <value> to reroute an existing agent
Bounce stale always-on tier on a version upgrade (#233)

v2.2.9 — 23 July 2026¶

Render the self-login roundtrip in the cockpit (#232)

v2.2.8 — 23 July 2026¶

Mobile PWA reconnect churn — tail re-add, notif storm, scroll-back, status dot (#231)

v2.2.7 — 23 July 2026¶

Server-side stale-click guard for permission replies (#230)
Pi token streaming into the live chat (10) (#229)
Workspace uploads stream via spool+pull (agent writes the pulled bytes) (#228)
Virtualize the transcript + batch seed appends + scope/motion render fixes (#227)
Close authenticated-stranger arbitrary file read to the HMAC key (F1) (#226)
Stream large uploads to disk + pull-then-cleanup (cap → 2 GB) (#225)
A permission card reflects its status (04) (#224)
Keep a failed cron's transcript for forensics, discard a successful one (13) (#223)
A pi agent gets a scroll-back — runtime-agnostic session discovery (01) (#219)
One cursor shape over the live stream — (session, seq) (19) (#221)
Robust typing reconcile (post-Stop write + hookless agent) (#222)
Reject oversize saveUpload + widen spawned-scan window (review follow-ups) (#220)
An audio attachment plays in the web-view (23), and scroll-back dedupes (05f) (#218)
Agent web-view design pass — line-icon set, unified buttons, consistent cards (behavior-frozen) (#215)
Memoize spawned-session classification (hot main-lane path) (#217)
Reconcile owner_id from the live pairing, and report the divergence (#216)
Dedupe messages by identity, not by their text (05f) (#214)
Read session kind from the events lane — item 18's missing consumer (36) (#213)
A deferred attachment is pulled, not pushed on the control socket (31) (#211)
Voice notes on every channel, as an attachment kind (23) (#212)
The always-on tier must not be PartOf=agent@ (login broker died with the agent) (#210)
Record permission asks and their resolutions (04) (#209)
Every recorded send has been dropped by the renderer since #183 (#206)
Gofmt top_web_upload_test.go — main was red (#208)
Incremental workspace-tree fs_event update (no whole-tree re-render) (#207)
Render the agent's own lifecycle as a card kind (22) (#205)
On touch devices, Enter inserts a newline (send via the button) (#204)
Reject oversize workspace uploads instead of silently truncating them (#203)
CHANNEL_SOURCE=webview as a first-class value (11) (#201)
A fan-out policy — stop reading every reply twice (11) (#200)
Make the login principal a real owner identity — nonces are not sessions (11) (#197)
Event-driven typing bubble (start on prompt-submit, stop only on Stop, on-load reconcile) (#196)
Record the outcome of the deliberately-silent cron paths (27) (#199)
Raise the upload cap above the lazy-fetch threshold, split from the memory budget (#198)
Give the web-view the lazy attachment path it never had (17) (#193)
Record the agent's own lifecycle instead of reading systemctl (22) (#192)
Running-subagents chip row + live read-only subagent session viewer (#194)
Run the inbound seam on EVERY inbound, not only when the shim is down (#190)
The owner allowlist must fail CLOSED, and say so out loud (#191)
Exclude spawned-subagent transcripts from the main lane + render inter-agent messages as cards (#187)
Filter the subsession read surfaces on kind; drop the phantom ansible gate (#188)
Record the session lifecycle instead of inferring it (18) (#186)
Render recorded sends on the timeline; retire the cron inference (06) (#184)
Record an owner-facing send as an event (06, 12, 15) (#183)
Give the web-view an always-on tier (09) (#185)
One definition of MCP liveness; stop revealing non-path tabs (24) (#182)
A blocking gate that cannot run is a failure, not a skip (25.3) (#179)
Escape the NUL in agentKey so git can merge dashboard.html (#178)
Reload the open file when it changes on disk (05c) (#177)
One canonical path space for openable files (05e) (#166)
Pin host-service ExecStart to the packaged binary, never selfBin() (#176)
Reconcile the login proxy from apply + fleet sync (#167)
One stream coalescer for telegram + slack; Teams cannot join (#16) (#174)
Stamp + brief the lane a turn arrived on, not the primary (#05d) (#173)
Finish the delivery unification (#14) — 2 silent drops + a gate (#172)
Seek into transcripts instead of parsing them from zero (audit 21) (#175)
Cockpit mini-apps: action bridge + read data-plane + app framework + Mail/Calendar (#164)
Make wvFrame typed-only an invariant, delete the dead raw relay seam (#165)
Restore typing indicator on PWA resume when the lane is still working (#168)
Cockpit+subsession: scope cron/channel cards + per-lane typing + subsession rm (#160)
Render agentctl notify self as a message, both runtimes (#157)
Modern composer capsule (rounded, circular icon send) (#156)

v2.2.6 — 23 July 2026¶

Webview-login: username field (not email) + no mobile zoom-on-focus (#155)

v2.2.5 — 23 July 2026¶

Webview-login: form-based login for the basic driver (PWA-compatible) (#154)
Mcptools --params must precede the call subcommand in wrapped cli.sh (#153)

v2.2.4 — 22 July 2026¶

Retire send-telegram.sh (use agentctl notify) + surface reject in shim (#150)
Route ws fs-mutations + webview host-service verbs through the daemon (#151)
Make plain apply self-reconciling AND self-bouncing (#148)
Build peerCred cross-platform via build tags (#149)

v2.2.3 — 22 July 2026¶

Fully event-driven cockpit — workspace + session live push (zero polls, pi + claude) (#142)
Auto-wrap declared MCPs into clitools during provisioning (#144)
Deliver pi streamed replies with no live turn ctx (web-view/inject → Teams) (#143)
Make fresh-agent add fully Go-native; ansible add play behind --legacy (#141)

v2.2.2 — 22 July 2026¶

Port browser-harness system symlink into the Go native path (#140)

v2.2.1 — 22 July 2026¶

Tier-A cockpit gaps — typing clear, tool-noise, outbound attachments, distinct image names (#139)
Resolve harness via package-managed system symlink, drop stale shim
Surface cron cards only once the run has concluded

v2.2.0 — 22 July 2026¶

Md italic/strike/task-lists + reliable PWA resume & typing-bubble clear
Render GFM pipe-tables in the cockpit markdown renderer
Relay ops + permissions to pi agents so the cockpit stops hanging (#138)
Allocate a PTY so claude doesn't fall into --print (crash-loop fix)
Absolute datetime stamp on every message + card (no "ago")
Only print "(prerelease)" when the version actually is one

v2.1.0 — 22 July 2026¶

Stage inbound attachments so pi teams/slack/webview agents don't drop owner files (#137)
Harden agentctl rollout (recursive channel staging, --force restart, fleet-upgrade.sh, release runbook) (#136)
Total-order the web-view message stream (sub-second, stable merge, monotonic cursor, restart stitch) (#135)
WhatsApp-quality voice recorder + header/composer polish
Dual-connect pi bridge to the web-view gateway (#134)
Fix composer input floating ~4px above the buttons (inline-textarea baseline gap)

v2.0.1 — 22 July 2026¶

Stage channel/shared into transport/shim/connector run dirs
Suppress the injected SKILL.md body as a user turn (SKILL card covers it)

v2.0.0 — 22 July 2026¶

Follow the compaction rollover in a sub's live view + reaper/tail
Keep the history scroll-back from mixing in subsessions
Ephemeral 'cleaning up context' card on compaction (PreCompact hook)
Fold consecutive tool calls into one expandable Tools card
Subsessions management panel — run any 3 of N (owner's ask)
Composer alignment + accent-themed rings, optimistic dedup, voice notes, entry motion
Pi spawn — webview-mode bridge + bound session (mirrors the main pi interface)
Drag-to-move workspace files (ws mv)
Guard pi agents from the claude-only spawn path
SessionStart hook marks rolled-over sessions (compaction spill fix)
Resume from the UI + cap-check on resume (manage the active 3)
Cmd/Ctrl+W closes the focused pane/tab + focus indicator (P4 polish)
Proper drag-to-split editor + per-tile close + composer fix (P4 polish)
Tiled/split session view — N live panes side by side (P4)
Subsession chat tabs + start/close controls (P4 frontend, switch-view v1)
Subsession start/clear control endpoints + route mutating verbs (P4 backend)
Session-address /api/inject too (P4 backend, completes the seam)
Session-addressed transcript + permission + sessions endpoints (P4 backend)
Idle auto-stop reaper (Phase 3)
Spawn/lifecycle verbs + templated unit + launch (P2 core)
Channel/shim: webview-only lane mode for subsessions (P2b enabler)
Channel+cli: per-session ingress socket (subsessions P2a)
subsession list verb — the registry read surface (subsessions P0)
Generalize narrate + stall exclusion to the session registry (subsessions P0)
Session registry keystone + generalize LiveTranscript exclusion (subsessions P0)
Internal/cli: isolate the shipped catalog root in tests (AGENTCTL_SHARE_DIR)
Internal/cli: webview permission parity — render + Allow/Deny in the cockpit chat
Runtime/teams: render + capture permission replies (close the "teams drops it" hole)
Runtime/slack: capture permission replies (close the "renders, can't capture" hole)
Runtime/channel: shared permission-reply parse contract + telegram onto it
Runtime/channel: key the teams + slack gateways by (agent, session)
Fold the last off-protocol escape into the typed union
Internal/cli: key the webview gateway by (agent, session)
Runtime/channel: shims declare + stamp their session lane (claude + pi)
Runtime/channel: add session as a first-class routed field (protocol)
Authenticate register frame against agent owner
Runtime/channel: extract shared bounded-download primitive for inbound attachments
Runtime/channel: port channel impls to shared mime/presence/stream
Runtime/channel: add shared mime/presence/stream helpers

v1.9.26 — 22 July 2026¶

Composer no-drift (plain textarea in normal mode) + workspace write actions

v1.9.25 — 22 July 2026¶

Composer scrollbar — hide until content exceeds cap; shorter mobile-safe placeholders

v1.9.24 — 22 July 2026¶

Cancel op-relay on client abort (canceled download no longer wedges the cockpit)

v1.9.23 — 22 July 2026¶

Stop-hook-driven typing indicator + SKILL card for skill loads

v1.9.22 — 22 July 2026¶

Infinite scroll-back across all sessions+crons; composer scrollbar fix

v1.9.21 — 22 July 2026¶

Interleave cron notify-cards into the seed by timestamp (not clustered at the end)

v1.9.20 — 22 July 2026¶

Cron runs as notification cards in the cockpit (disk-canonical) + icon cache-bust

v1.9.19 — 22 July 2026¶

Render agent-SENT attachments in the cockpit (reply/send tool files)

v1.9.18 — 22 July 2026¶

Right panel redesign — collapsible capped-scroll sections, crons-first, uniform provenance

v1.9.17 — 22 July 2026¶

Make the slash-command popup scroll (taller max-height, touch scroll, contained)

v1.9.16 — 22 July 2026¶

Slash-command popup shows all skills (drop 8-item cap), prefix-matches first

v1.9.15 — 22 July 2026¶

Dedupe a message sent while the agent is working (queue-op + processed copy)

v1.9.14 — 22 July 2026¶

Rotating placeholder prompts, skill slash-commands, clearer cron display

v1.9.13 — 22 July 2026¶

Unify cockpit stream onto one socket feed (live tools + seamless reconnect)

v1.9.12 — 22 July 2026¶

Typing bubble tracks real activity, not the 5s Live flag

v1.9.11 — 22 July 2026¶

Browse skill FOLDERS (not just SKILL.md); fix stuck typing bubble

v1.9.10 — 22 July 2026¶

PWA branding is overlay-driven, not baked into the binary
Re-render WEBVIEW_LEDGER on user_email set; stream SSE through proxies (#132)

v1.9.9 — 21 July 2026¶

Right-panel items open in tabs (editable defs + read-only session chat); composer polish

v1.9.8 — 21 July 2026¶

Slack-style code box in composer (type ``` to open); normal-height centered input; live open-fence highlight

v1.9.7 — 21 July 2026¶

Installable PWA (manifest + service worker + L1D icons) for desktop Edge/Chrome + Android

v1.9.6 — 21 July 2026¶

Slack-style live code highlighting in composer + bigger field; render remote-sent image attachments live (upgrade dup bubble); suppress notification storm on history replay

v1.9.5 — 21 July 2026¶

Clickable repos/tmp paths (home-scoped read) + robust notifications + iOS zoom fix

v1.9.4 — 21 July 2026¶

Dedupe queued+processed message copies (was rendering twice)
On-demand TG attachment download for thumbnails + notif permission on send
Inbox image thumbnails+gallery, HTML code-view highlight+edit, tab title/favicon/activity, browser notifications
Group the You label on optimistic send too (not just on refresh)
Deliver composer attachments to the agent (gateway mode)
Render queued (arrived-while-working) messages
Follow live session rotation in the transcript stream
Right-hand agent panel (skills/memories/subagents/crons/sessions)
HTML file preview/code toggle + task-chip subject/status
Reply-as-message, clickable paths, tab→tree reveal, polish
Cockpit polish — message grouping, wrapping, themed surfaces
Full surface/text/border/mono themeability
Add webview_logo scalar + cockpit cleanup (Pass 1)
Host-scoped theming for the scoped single-agent web-view

v1.9.3 — 21 July 2026¶

Clock silent-turn wedge from oldest pending message, not last assistant output
Order agent@ After telegram-transport@ to prevent getUpdates 409 deadlock (#126)

v1.9.2 — 21 July 2026¶

Stage channel/ subdirs so shim/ resolves at runtime

v1.9.1 — 21 July 2026¶

Inbound attachment delivery (all file types) for Teams + Slack gateways (#125)

v1.9.0 — 21 July 2026¶

Typing tied to reply arrival + agents set user_email + host-scalar read
File editing (ws write over the socket) + explicit op chunking
Raise dial-in WS read limit (large file dropped the whole connection)
Fix cockpit status lookup (host-key mismatch) + duplicate user bubble
Capture conv ref from any activity + buffer no-ref proactive sends (#124)
Fix live push (opStream never returned) + real self-scoped status
Real card stats + unbounded streamed download + drop local host
Real session transcript over the socket + full-screen scoped cockpit
Bound the tool-in-flight guard (catch hung tools) (#123)
--web no longer swallows a following flag; gateway ExecStart drops --web
Silent stalled-turn watchdog (claude daemon + pi in-process) (#122)
top --web --gateway --login — one command for local dev
Per-user cockpit scoping + capped reconnect backoff
Make it an additive channel via shim fan-out, never primary
Docker image (gateway + login proxy), unified dev/prod
Generic login proxy (basic + OIDC drivers) fronting the cockpit
Fold dialed-in agents into the fleet snapshot (cross-host)
Op-relay for handleWsRaw (bytes) + handleLogs (streaming)
Op-relay wiring — workspace browse + def over dial-in
Wire cockpit view+inject to the dial-in registry (gateway mode)
Op-relay — protocol op/op_result frames + connector handler
Gateway = top --web --gateway (Go WS dial-in), drop Bun hub
P1 (runtime) — gateway relay + browser SSE/inject bridge
P1 (infra) — webview-gateway host service + runtime scaffolding
P0 — ledger user_email + webview channel converge plumbing

v1.8.4 — 21 July 2026¶

Proactively finalize informative stream before Teams' 2min cap (#PR)

v1.8.3 — 20 July 2026¶

Maintenance release; no feature-level changes since the previous release.

v1.8.2 — 20 July 2026¶

Wire shared-scope MCPs by config membership, not socket unit (#116)
Drop file-consent re-request allowlist (Linux perms are the boundary)
Notify admin + retire agent/admin-notify.sh + Teams file-consent TTL/re-request
Host-monitoring skill: make host-agnostic and detection-based

v1.8.1 — 20 July 2026¶

Unify cron delivery through agentctl notify (#113)

v1.8.0 — 20 July 2026¶

Channel-agnostic owner-facing delivery verb (#112)

v1.7.0 — 20 July 2026¶

Native Go reconcile + cross-host channel connector (#107)

v1.6.7 — 17 July 2026¶

Stop re-stream flood on Teams stream expiry (#111)
Adopt the remote's default branch, not hard-coded main (#109)

v1.6.6 — 16 July 2026¶

Markdown newlines, live-session attach, apply logs, typing indicator (1.6.6) (#106)

v1.6.5 — 16 July 2026¶

Raise shared MCP socket MaxConnections 10 -> 64
Agentctl inject verb + operator cockpit in top --web (#105)

v1.6.4 — 14 July 2026¶

Pull the fleet repo from origin before reconciling (#104)

v1.6.3 — 13 July 2026¶

Add self-scope chrome restart to recover a stuck browser (#103)

v1.6.2 — 13 July 2026¶

Keep typing indicator until turn end, not first narration block (#102)

v1.6.1 — 11 July 2026¶

Don't collapse a streamed turn into a one-shot when the final lands fast (#101)

v1.6.0 — 11 July 2026¶

Re-vendor drifted self-MCP payloads without a full agent restart (#100)
Extract all inbound media kinds, not just photo/document (#99)
OAuth broker + hands-free google self-login (supersedes #97); remove pi login (#98)
Drain resolved turn-review candidates into a deletable archive

v1.5.10 — 09 July 2026¶

Unwire catalog-deleted MCPs via name-only teardown

v1.5.9 — 09 July 2026¶

Remove defillama from deb (l1d-only, moves to l1d overlay)
Unify claude tools (MCPs) into the layered defaults model + catalog cleanup
Host-defaults editor for the catalog-defaults overlay

v1.5.8 — 09 July 2026¶

Unified layered defaults across all per-agent catalog categories
Turn-review: bias the proposer toward recall, not restraint

v1.5.7 — 09 July 2026¶

Union shipped defaults into an agent's recorded hook list
Port sendRichMessage rich-text path into telegram transport

v1.5.6 — 08 July 2026¶

Make introspect fileTimes compile on darwin
Don't let a late-closing old socket clobber the live registration

v1.5.5 — 08 July 2026¶

Provider-agnostic review-model override (pi PI_SKILL_MODEL + pi cron PI_CRON_MODEL)
Candidates verb + agents-set skill_model + README/agentctl-skill docs
Idea+pointer candidates, compose-dream-cycle, curator lifecycle, pi parity
Turn-review Stop hook — cheap async skill/memory candidate extraction
Agentd read-proxy for cross-agent introspection reads
Live read-only introspection verbs (mem, sessions, skills, ws changes/search)

v1.5.4 — 08 July 2026¶

Ship apt pubkey in the deb + restart watchers on upgrade

v1.5.3 — 08 July 2026¶

Per-agent transport port — no cross-owner leakage on shared hosts

v1.5.2 — 08 July 2026¶

Retire obsolete host crons on reconcile + build-repo picks the right deb

v1.5.1 — 08 July 2026¶

Restart agent on override change (no 409) + presence owner id

v1.5.0 — 08 July 2026¶

Teams/slack claude agents show paired (not red) — gateway-routed
Backstop commit for mutating verbs (forgotten-commit safety net)
Correct channel chip for slack + all claude agents (TUI + web)
Remove dangling FORMATTING reference that crash-looped the shim
Commit + push the full agent block on add (cross-host routing)
Per-agent tool socket ($HOME) — two pi agents per host no longer collide
Render + conditionally restart the agent on a per-agent secret set
Reconcile gateways on fleet sync + gateway-only apply
Cross-host register URL from ledger + channel-aware greeting
Pi teams/slack add requires the app token only when the gateway is LOCAL
Zk wrapper recursed into itself (PATH shadow) → hung the agent
Deterministic Markdown→mrkdwn converter (+ seed guidance as nudge)
Tell the model each channel's text syntax (per-channel formatting)
Progressive block delivery — flush each completed paragraph as it lands
Activity-indicator placeholder + slack media tool (pi) + slack default
Agent card channel chip slack-aware (was tg for slack) [#55 in-branch part]
Block delivery — buffer the stream, post ONE message on final (no cascade)
Proactive DM resolution for presence/notices (users.lookupByEmail + conversations.open)
Slack owner_email recording + gateway never crashes on a bad outbound
URL-encode names in generated _files.md links
Consolidate ALL presence into the runtime (drop agent-notify lifecycle)
Shim online-on-hello only for gateway channels (no telegram double-ping)
Offline presence on WS close (teams + slack), debounced
Shim-owned online presence + slack attachments (files.uploadV2)
No dangling '...' bubble, presence for teams/slack claude, secret write-on-change
Narration on teams/slack (route by owner) + static informative
Multi-bubble narration + teams tool-surface guidance for claude
Claude first-class on teams/slack — block outbound, attachments, add-path
Non-streaming replies, idempotent finalize, empty-final guard, Teams stream-restart
Apply-all-hosts — parallel fleet reconcile with a live per-host bar modal
Blank-line-separate streamed status lines (were running together)
Stage bridge + channel mirroring runtime/ so cross-tree imports resolve
Typing indicator while the agent thinks (parity with main)
Unified claude narration + hook ingress over the shim (all channels)
Port the Claude self-login (PKCE) dance into the shim — channel-generic
Ship runtime/channel + runtime/slack in the .deb (were missing → 203/EXEC)
Full teams-parity for the web add-agent flow + CLI status/uninstall
Slack gateway status badge (TUI + web host bars) — teams parity
Make Slack first-class for pi + fix gateway port clash + layout tests
Retire telegram-watchdog + make slack_gateway first-class + fix teams owner UI
Gate apt repo + GHCR container on non-prerelease
Force fused .mcp.json on direct hosts (no transport)
Code the 4 deploy items — extra-vars, transport enable, shim, teams-claude
1.4 telegram-transport@ unit + CHANNEL env + 3.5 seed audit
Owner_email end-to-end — ledger round-trip, apply, webui, handler
3.1 thread + persist --owner-email through agents add
2.4 agentctl slack-gateway install verb + apply reconcile
2.3 generic pi SocketChannel (Slack now, Teams later)
3.1 recognize slack as a channel (validate + agents add)
2.1 gateway core + streaming + 2.2 manifest (mock-tested)
1.2 the shim — claude/channel MCP server, pure socket client
1.1 shim<->transport socket protocol + streaming + tests

v1.4.0 — 07 July 2026¶

Force fused .mcp.json on direct hosts (no transport)
Cron form spans the fleet — pick any agent on any member host
Catalog 'tool' form renders + agent dropdown populates
Channel-aware delivery — teams admin via bridge, telegram via bot
Resolve admin agent from agents.d/ shards, not agents.yaml

v1.3.29 — 07 July 2026¶

Fleet-health bar replaces always-on host lines
Collapse host-cron rows behind a per-host toggle
Declutter agent drawer vitals (no double-counted capability cells)
Unify provenance vocabulary across drawer + catalog
Catalog wizard detail pass — subtitle, blue active segment, MCP dot
Join-fleet 3-step indicator + intro
Add-agent wiring collapses to a default-activations summary
Fleet-aware catalog host selector (joined hosts → one shared-overlay target)
Catalog wizard polish — agentd unification, script hooks, progressive forms
Don't re-wire http-transport MCPs every apply
Web catalog browser (browse/read/remove) + agent self-activation
Agents can secret get any secret visible to them at runtime (#83)

v1.3.28 — 06 July 2026¶

Fix: exclude the sops config .sops.yaml from the secret-shard glob
Fix e2e: host-only agents.yaml keeps an empty agents: {} marker
Fix CI: remove orphaned indentLevel + seed shards in daemon authz test
Drop legacy single-file ledger/secret support — sharded is the only layout

v1.3.27 — 06 July 2026¶

Build-window finds pi's nested sessions (was running blind)
Sync before migrate so hosts don't independently re-migrate
Stage 2 — shard the sops store into secrets.d/<owner>.sops.yaml
Sharding switch is a repo marker file, not an env var
Shard dir is agents.d/ not agents/ (collision) + e2e sharding section
Stage 3 — conclude or abort a merge, never strand MERGE_HEAD
Stage 1 — shard agents.yaml into agents/<name>.yaml (gated, validated)

v1.3.26 — 05 July 2026¶

Reconcile re-renders the gateway UNIT so unit changes propagate on apply

v1.3.25 — 05 July 2026¶

Make AGENT_RUNTIME write idempotent (fix e2e non-idempotency)
Make the cron runtime declaration-driven (agent.env), not FS-probed
Stage all gateway .ts (fix crash) + run bun tests in CI
Persist conversation refs so proactive sends survive a gateway restart
Deliver pi teams agents' cron digests to Teams, not (silently) Telegram
Resolve pi-vs-claude from the declaration, not the filesystem

v1.3.24 — 05 July 2026¶

Ineffassign in extractZipStdinToDir (top := f.Name overwritten)
Shellcheck warnings in wipe-agentctl.sh (SC2038 find-exec, SC2115 rm ${u:?})
Tool ZIP upload, host-scope (root) crons, agent dropdown
Tell pi agents their capabilities are CLI tools, not MCPs
Runtime-aware unit for logs + status (pi journal was empty)
Document how a teams/telegram agent reaches its owner (the teams tool)
Auto-scroll to the progress bar when add/gateway/join starts
Channel-aware agent persona (teams agents no longer claim "reachable over Telegram")
AllAgentNames delegates to fleet.AgentNames (pi has no .service.d)
Runtime-aware skill/subagent def + collector subagent path (pi agents)
AllAgentNames includes pi agents (cron/skill/hook on pi were "unknown agent")
Surface on-host sudo hint + gate gateway status on env (not unit file)
On-host mutations (no --host needed) + teams-tool default + rate-limit FP + gateway status
Binary-safe stdin over the socket (--zip-stdin via daemon-routed verbs)
Complete #33 — full option coverage + Geist wizard redesign
Don't trip the browser@ StartLimit on a transient cold-start
Channel-aware card label + retry browser@ start (transient race)
Retry push on non-ff rejection (multi-writer convergence)
Merge (not rebase) to sync — the true fix for the secret-set race
Pass bot token straight to agents add (no store round-trip race)
Wizard iteration — http-transport MCP authoring + skill ZIP upload
5 add-agent/list findings from the bench run
Recover from detached HEAD so pusher mutations reach the remote
Remove browser-use MCP — native browser (CDP) is the one browser
Sops merge driver for secrets.sops.yaml + defaults + join UX
Unified add progress bar, collapsed logs, host-shared key, zk default
MCPs selectable as pi tools — materialize + wrap on activation
Join age-recipient handoff + add/join/gateway UX
Teams-gateway install --json + web relays it
Gateway-install UI + standalone Catalog modal + UX pass
Allow removing a dangling ref to an unknown job
Join hosts into a shared gitops family (web wizard + ctl verbs)
Tool catalog add + web mcp/cron/tool forms + uvx /var materialization
Converge runtime MCP catalog into the overlay
Mcp catalog add lands in the overlay; cron add --agent
Author skills/subagents/hooks into the overlay (CLI + web)
Reuse an existing shared secret as the API key
Add agents validate — lint recorded agents against add-time invariants
Filter dotfiles from catalog listers
Add-agent button — capabilities + streaming add endpoints + modal
Surface per-agent secret NAMES through collector + TUI
--json across list commands, add/apply progress, add guards

v1.3.23 — 03 July 2026¶

Chroma-highlighted workspace preview — shared renderer with the bundle

v1.3.22 — 03 July 2026¶

In-modal bundle-style workspace tree with download links

v1.3.21 — 03 July 2026¶

Geist-grade workspace bundle, markdown autolinks, compact-view hover-peek

v1.3.20 — 03 July 2026¶

Compact status-grid view toggle in the web dashboard
Compact highlighter — Chroma lexer, minimal spans, no size cap
Fold a format-version into the hash so rendering changes re-publish
Cap syntax highlighting at 24K to shrink the bundle
Per-type rendering — Chroma highlighting, CSV/JSONL tables
/workspace command — move the pin to a fresh message
Telegram deep-link fetch, task lists, strip HTML comments
Relative-link anchors, Geist folder icons, copy chips
Render markdown tables + drop HTML comments
Pure static HTML, no JS — works in Telegram's in-app viewer
Surface per-agent secret key names (no values) in TUI + WebUI (#77)
Fold template into content hash so UI changes re-publish
Mobile-friendly explorer — breadcrumb drill-down, not Miller columns
Pinned Telegram workspace explorer, refreshed on Stop
Space the Explore workspace button off the metrics grid

v1.3.19 — 03 July 2026¶

Color = status only — brand + runtime π to monochrome
Redesign TUI + web dashboard in the Geist design language

v1.3.18 — 02 July 2026¶

Don't render the workspace deploy key into agent-<user>.env
Audio-mcp: add transcribe_audio_diarized (speaker diarization) path

v1.3.17 — 02 July 2026¶

Workspace explorer — TUI cd-navigator + web Miller-columns file browser (#72)

v1.3.16 — 02 July 2026¶

Sessions as a first-class def section (readable transcript) (#71)

v1.3.15 — 02 July 2026¶

Host crons in TUI (picker + multi-host header); web list polish (#70)

v1.3.14 — 02 July 2026¶

Memories section, compact-list detail view, host-cron clickable, binary guard (#69)
Pass 4 does class-level memory consolidation

v1.3.13 — 02 July 2026¶

Keep def view open across ticks; gofmt remote.go (CI red) (#68)

v1.3.12 — 02 July 2026¶

TUI def resolves remote hosts; pretty-print skill frontmatter (#67)

v1.3.11 — 02 July 2026¶

Scroll def list in TUI, quote SSH args, markdown viewer + pull scripts (#66)
Bypass classifier for self-improvement crons

v1.3.10 — 02 July 2026¶

Click/select skills·subagents·crons·hooks to read their definitions (#65)
V2 — phased passes (orient → memory/skill extract → consolidate)

v1.3.9 — 02 July 2026¶

Grant the admin agent write access to the /opt/agentctl overlay (#64)

v1.3.8 — 02 July 2026¶

Bun symlink — also skip when the host-global source is absent

v1.3.7 — 02 July 2026¶

Don't fail reconcile when an agent has a real bun binary

v1.3.6 — 02 July 2026¶

Idempotent reconcile + hoist/parallelize/fingerprint plan (#62)
Admin alerts silently dropped — nested owner_id + usercron OnFailure (#63)

v1.3.5 — 01 July 2026¶

Include session transcripts in the per-agent backup (append-only, both runtimes) (#61)

v1.3.4 — 01 July 2026¶

Use git ls-files -z so special-char filenames untrack correctly

v1.3.3 — 01 July 2026¶

Case-insensitive video/audio patterns; back up images
Agents manage their own secrets (secret set/get/remove --agent self) (#59)

v1.3.2 — 01 July 2026¶

Push -u origin HEAD so first push on a fresh remote sets upstream

v1.3.1 — 01 July 2026¶

Wire declared-but-unwired MCPs + reconcile by default (#58)
Pin cron claude runs to standard context (disable 1M) (#57)

v1.3.0 — 01 July 2026¶

Git remote + deploy-key CLI for per-agent + fleet backup repos (#56)
Stability + clean-code pass: single ledger reader, cron levels, secret subtree, add-path dedup, README landscape (#51)
Default .gitignore + prune helper (prereq for per-agent repos) (#55)

v1.2.15 — 01 July 2026¶

Auto-writeback to origin on every commit, not just apply (#54)

v1.2.14 — 01 July 2026¶

Drawer logs beside the info on wide screens (#53)
Auto-insert blank line before markdown tables so they render (#52)

v1.2.13 — 30 June 2026¶

Unify the multi-host web view into one grid with per-card host tags

v1.2.12 — 30 June 2026¶

Wrapped watch lines kept their color on continuation lines

v1.2.11 — 30 June 2026¶

Populate the detail drawer immediately on open

v1.2.10 — 30 June 2026¶

--host watch broke when the web dashboard wraps the collector + drawer auto-close

v1.2.9 — 30 June 2026¶

Web dashboard works under --host — proxy logs/watch to the owning host

v1.2.8 — 30 June 2026¶

Show full per-agent skill/subagent/hook/cron lists in the drawer

v1.2.7 — 30 June 2026¶

Stream the live session transcript in the detail drawer
In-place dashboard updates, compact host bar, agent detail + live logs

v1.2.6 — 30 June 2026¶

Single-binary local web dashboard over SSE (#50)
Reject a --skill host cron (root has no agent/LLM context)

v1.2.5 — 30 June 2026¶

Guard runs on auth failures (stop logged-out agent spam) (#48)

v1.2.4 — 30 June 2026¶

Omit host.provisioned when false; skip an empty host: block
Drop the systemd journal tail from failure messages

v1.2.3 — 29 June 2026¶

Ship build-window.sh + wire cron prep (was always 0 sessions)
Per-user REPL port + log so agents don't collide (#45)

v1.2.2 — 29 June 2026¶

Hook provenance — bare vendored commands (e.g. rtk) are deb, not loc

v1.2.1 — 29 June 2026¶

List hooks (name + event + provenance) in the agent detail pane

v1.2.0 — 29 June 2026¶

Teams/pi: checksum-compare the bridge stage so only real byte changes restart
Teams/pi: restart the bridge when apply re-stages changed bridge code
Render the tool/status line on its own line (not inline)
Teams gateway: show animated working indicator from turn dispatch
Conflict-marker commit/push guards + host rename + multi-host docs
RecordAgent inserts into agents: block, not EOF (agent-b-in-hosts bug)
Fix sops updatekeys config discovery (global --config flag)
Pin host on agent add + ensure age key on apply (multi-host join fixes)
Drop committed host.name; host identity is always os.Hostname()
Correct + churn-free sops re-wrap ordering (multi-writer)
Queue mid-turn messages silently (drop the 'queued' ack)
Synchronous tool-socket reply + manifest supportsFiles:true
Tool-reply delivery, inbound HTML noise, mid-turn message queuing
Rich messaging — agent sends images/files (attachments both directions)
Private-bind cross-host register + init --git join + apply writeback
Restart/stop-self/logs are runtime-aware (pi-agent@ vs agent@)
ASCII ellipsis in push echo (macOS bash 3.2 multibyte $var bug)
Add manifest icons (L1D logo) — color 192x192 + outline 32x32
Prerelease-from-branch — ship a real .deb without touching prod channels
Teams+sops: reconstruct teams agents from the ledger + auto-commit re-wrap
Containerize the gateway + GHCR image workflow
Updatekeys re-wrap via .sops.yaml rule, not a --age flag
Per-agent cross-host register URL (wss://<gateway>/register)
Run-scope host filter + multi-recipient sops re-wrap
Multi-host: per-agent host: field + host.name/hosts ledger helpers
Real botbuilder auth boundary (inbound JWT + outbound Entra token)
Apply reconciles the teams-bridge ledger (CI-ready)
Render per-agent env unconditionally in the claude path
Gateway binds loopback + TEAMS_AGENTS=[] not null + teams-run HOME guard; sink handles plain messages
Reset cred via systemd drop-in instead of a placeholder secret
Agentctl provisioning — agents add --channel teams + teams-bridge (phase 5)
BridgeChannel + gateway + sink, no-Azure e2e green (phases 2-3)
Scaffold templated Teams app manifest

v1.1.27 — 29 June 2026¶

Timer must not pull its service on enable (off-schedule catch-up)

v1.1.26 — 28 June 2026¶

Chat_id forward reconcile in apply (declared → agent.env)
Agents set verb, apply --prune, migrate hooks/usercron carry
Back-fill owner_id + chat_id into agents.yaml on apply

v1.1.25 — 28 June 2026¶

Secret get --agent resolves per-agent secrets

v1.1.24 — 28 June 2026¶

Admin agent can name other agents for local read-only verbs
Make per-user custom crons declarative (record + reconcile)

v1.1.23 — 28 June 2026¶

Stop browser@ crash-loop disk bleed (xvfb recovery + StartLimit) (#37)

v1.1.21 — 26 June 2026¶

Cap host tag at 8 cols + π runtime glyph; stop card wrap (#35)

v1.1.20 — 26 June 2026¶

Cut-release.sh — bump + tag + push to trigger the release workflow
Claude --api-key → ANTHROPIC_API_KEY (zero-touch, no OAuth)
Read canonical /opt/agentctl/agents.yaml, not legacy fleet.yaml
Buttery live-typing via sendRichMessageDraft (the Hermes approach)
Paced draft reveal for smoother live-typing

v1.1.19 — 26 June 2026¶

Finalize via native sendRichMessage only — drop HTML + chunking
Always render rich Telegram output; fix telegram tool HTML send
Truncate host tag to fit the card so a long hostname never wraps
Ship tools/ catalog through packaging/payload
Template ~/AGENTS.md so the agent's name is seeded (not 'a_user')
Add default 'recall' skill — how to read previous sessions + memory
SKILL.md invokes the tool by its PATH command name, not ./cli.sh
Never write through a same-named skill symlink (catalog corruption)
Wrap-mcp: never overwrite or shadow a tool with a converted MCP
Mcp add: runtime-aware — wrap+wire MCPs as tools for pi agents
Tool wrap-mcp: manifest-driven, support http MCPs via mcp-remote bridge
Make pi clitools, owner_id, admin + host watchdog declarative & reconciled
Auto-transcode voice notes to OGG/OPUS via ffmpeg
Add pi telegram tool for proactive media sends
Make provider/model declarative in agents.yaml, reconciled by apply
Simplify the no-reply message, drop Groq-specific wording

v1.1.13 — 26 June 2026¶

Tolerate rotated host keys in --host SSH (read-only viewer)
Runtime-aware migrate (pi support)

v1.1.12 — 26 June 2026¶

--model pins PI_PROVIDER/PI_MODEL for a pi agent (1.1.12)
Preview host-cron seed/prune in the plan (parity with -cron)
Watch (log view) works over --host via SSH event stream
Pi liveness glob (cwd-subdir sessions) + show tool file path + no host wrap
Version-gated re-provision + cron-removal delta (1.1.11)

v1.1.10 — 26 June 2026¶

Drop Requires= from timer units — THE catch-up root cause (1.1.10)

v1.1.9 — 26 June 2026¶

Pi-runtime: vendor mcptools so wrap-mcp tools actually work (1.1.9)
Pi-runtime: follow-ups — top badges pi-aware + scaffold AGENTS.md (1.1.7)
Pi-runtime: fix cron-runner — export model override + surface real errors
Pi-runtime: Chunk 7 — docs + CLI-help alignment for pi
Pi-runtime: browser — tool + skill rename (cdp→browser) + browser@ for pi
Pi-runtime: Chunk 5.6 — GitOps overlay parity + catalog/→tools/ rename
Pi-runtime: Chunk 5.5 — pi parity: crons + zk + memory
Pi-runtime: Chunk 6 — OAuth subscription login (login pi)
Pi-runtime: bridge — rich (HTML) finalize, plain stream
Pi-runtime: Chunk 5 — surviving hooks as pi extensions + irreversible floor
Pi-runtime: finding #8 — make apply + skill-link runtime-aware
Pi-runtime: bridge — serialize draft pushes + 429 backoff (fix flood)
Pi-runtime: bridge streams via native Telegram drafts (sendMessageDraft)
Pi-runtime: Chunk 5 (part) — runtime-aware skills wiring for pi agents
Pi-runtime: fix 6 droplet-test findings + VALIDATE Chunk 4 schema
Pi-runtime: Chunk 4 — observability adapters (top/usage read pi sessions)
Pi-runtime: fix nfpm pi-run.sh content collision
Pi-runtime: Chunk 3 — the tool verb + pi CLI tool catalog (MCP replacement)
Pi-runtime: Chunk 2 — host-side provisioning for pi agents
Runtime spine — telegram↔pi-SDK bridge + agent unit (Chunk 1)
Ynab as a native CLI (pi tool) — direct YNAB API, no MCP

v1.1.8 — 26 June 2026¶

--host is remotes-only + surface remote stderr (1.1.8)

v1.1.7 — 26 June 2026¶

Pi-runtime: follow-ups — top badges pi-aware + scaffold AGENTS.md (1.1.7)
Pi-runtime: fix cron-runner — export model override + surface real errors
Pi-runtime: Chunk 7 — docs + CLI-help alignment for pi
Pi-runtime: browser — tool + skill rename (cdp→browser) + browser@ for pi
Pi-runtime: Chunk 5.6 — GitOps overlay parity + catalog/→tools/ rename
Pi-runtime: Chunk 5.5 — pi parity: crons + zk + memory
Pi-runtime: Chunk 6 — OAuth subscription login (login pi)
Pi-runtime: bridge — rich (HTML) finalize, plain stream
Pi-runtime: Chunk 5 — surviving hooks as pi extensions + irreversible floor
Pi-runtime: finding #8 — make apply + skill-link runtime-aware
Pi-runtime: bridge — serialize draft pushes + 429 backoff (fix flood)
Pi-runtime: bridge streams via native Telegram drafts (sendMessageDraft)
Pi-runtime: Chunk 5 (part) — runtime-aware skills wiring for pi agents
Pi-runtime: fix 6 droplet-test findings + VALIDATE Chunk 4 schema
Pi-runtime: Chunk 4 — observability adapters (top/usage read pi sessions)
Pi-runtime: fix nfpm pi-run.sh content collision
Pi-runtime: Chunk 3 — the tool verb + pi CLI tool catalog (MCP replacement)
Pi-runtime: Chunk 2 — host-side provisioning for pi agents
Runtime spine — telegram↔pi-SDK bridge + agent unit (Chunk 1)
Ynab as a native CLI (pi tool) — direct YNAB API, no MCP

v1.1.6 — 26 June 2026¶

Self-heal managed-unit drop-ins + cron-template ordering (1.1.6)

v1.1.5 — 26 June 2026¶

Sign apt repo + deb in CI (import AGENTCTL_GPG key)

v1.1.4 — 25 June 2026¶

Containerized apt + brew repo server, built by CI, served on srv
Converge shipped cron unit templates (propagate timer/unit changes)

v1.1.2 — 25 June 2026¶

Host crons: seed into ledgers with no host: block + stop digest catch-up (#16)

v1.1.1 — 25 June 2026¶

Default host crons: seed into host.cron + reconcile like skills (#14)

v1.1.0 — 25 June 2026¶

Multi-host fleet view over SSH

v1.0.4 — 25 June 2026¶

Cron add --host: point ExecStart at the durable overlay copy (#13)

v1.0.3 — 25 June 2026¶

Declarative host crons: ledger-recorded + apply-reconciled (like skills) (#12)

v1.0.2 — 25 June 2026¶

Host crons: source shared secret env + document the pattern in the agentctl skill (#11)

v1.0.1 — 25 June 2026¶

Deterministic token-usage digest, opt-in cron, and top cron-count (#10)

v1.0.0 — 25 June 2026¶

Admin agent can snapshot the full fleet via agentd (rc27)
Show hooks count (hk) on the card next to mcp/sk/cr (rc26)
CLI fleet gates honor agentd's authorization (rc25)
Size snapshot dynamically to agent count + trim to content (rc24)
Non-interactive --once / --snapshot; retire commander (rc23)
RATE-LIMITED badge on the card (rc22)
Deliver via events.sock + robust recent-tail detection
Responsive cards that fill the row + stretched activity strip
Never permanently give up on 409 (port from main b6b37ad)
Pulse mcp/sk/cr + host crons when in use (rc19)
Blink grace window + wider card so height stays uniform (rc18)
Extend agentExists gate to login, secret set, agents restart (rc17)
Reject 'mcp add' to a non-agent target (rc16)
Compact no-creds marker so cards never wrap (rc15)
Self-authored ynab MCP with transfers + approve + bulk (rc14)
Create the repo dir on a fresh host (rc13)
Force color profile under sudo + activity-strip/glyph clarity (rc12)
Activity-first redesign + grid scrolling + http-mcp & watch fixes (rc11)
Live full-screen fleet dashboard (agentctl top)
Self-serve cron add — schedule any skill/script as a timer (m96, rc9)
Honor the repo overlay for skills/subagents (m92, rc6)
Chown entire dest home to the new agent
Exclude legacy .zk/templates symlink + non-fatal workspace/transcripts (m91, rc4)
Git tag sanitizes ~ -> - (m90)
Config+audit check uses gitDir() not /etc (m89, rc3)
Ynab is per_user so its API token scopes to one agent (m88, rc2)
New-agent: add l1d ms365 send-gating step (sessions f5aaaade, 5df4eb1a)
New-agent skill: ms365 L1D client-id/tenant, login-shell helpers, fresh-agent plugin-pin restart
Examples/agents.l1d: add danielp (Daniel Perroud) agent
Decommission opencode/openai agent (drop block; services stopped+disabled, user removed)
New-agent skill: document self-serve Telegram /login as preferred Claude sign-in
Macos/start-agent: ASCII-safe poller-clear echo (bash 3.2 syntax fix)
Telegram-plugin: never permanently give up on 409 (poll-loop death fix)