d796cf131d
feat(desktop): add consent-aware repository discovery
2026-09-06 11:32:14 +01:00
d74e85883d
feat: add plugin-backed canvases ( #3111 )
2026-09-05 18:44:43 +00:00
ddbf381a84
fix(mcp): prevent silent internal bridge request loss ( #3364 ) ( #3367 )
2026-09-04 12:18:03 +00:00
d4742089fc
feat(web): add manual file upload and download to the Files panel ( #3292 )
...
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com >
Co-authored-by: Carlos Florencio <carlosmflorencio@gmail.com >
2026-09-03 08:07:13 +00:00
2d8b3a0c1e
feat(backend): support dual-era MCP protocol ( #3164 )
2026-09-02 19:48:19 +00:00
1dc06e8298
fix(agentctl): accept the automation MCP mode at the instance API ( #3193 )
...
Co-authored-by: Carlos Florencio <carlosmflorencio@gmail.com >
2026-09-01 00:39:24 +00:00
4b420f4950
fix(agentctl): keep comparison target Git non-interactive ( #3185 )
2026-08-31 12:28:13 +00:00
43a1ce71e4
fix: improve startup and lifecycle diagnostics ( #3058 )
2026-08-26 13:12:59 +00:00
cc169a7ff9
docs(agentctl): correct comments that describe adapters and protocols that don't exist ( #3012 )
...
Co-authored-by: nova28 <17953305+nova28@users.noreply.github.com >
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com >
2026-08-25 07:13:37 +00:00
29e4c98fff
fix(agents): recover executor-local npm runtime caches ( #2986 )
2026-08-24 21:05:02 +00:00
55bbc9ce8c
chore(agentctl): add per-instance diagnostic performance metrics ( #2947 )
...
Co-authored-by: nova28 <17953305+nova28@users.noreply.github.com >
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com >
Co-authored-by: Carlos Florencio <carlosmflorencio@gmail.com >
2026-08-24 09:06:28 +00:00
94fd9dcd44
fix: classify expected runtime errors correctly ( #2950 )
2026-08-23 15:11:44 +00:00
26982408fa
fix(git): support local-only merge and rebase ( #2925 )
2026-08-22 17:51:54 +00:00
c82668c789
feat(mcp): expose agent clarification questions and permission requests externally ( #2875 )
...
Co-authored-by: Vojtěch Biberle <vojtech.biberle@gmail.com >
Co-authored-by: nova28 <17953305+nova28@users.noreply.github.com >
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com >
Co-authored-by: Carlos Florencio <carlosmflorencio@gmail.com >
2026-08-22 15:39:40 +00:00
cf391bab8b
feat(git): use repository-qualified PR comparison targets ( #2828 )
2026-08-21 22:04:44 +01:00
7c96621de1
feat: add executor parity safeguards ( #2704 )
2026-08-16 21:13:41 +00:00
15788438b4
feat: route managed Improve Kandev contributions to bound forks ( #2569 )
2026-08-15 23:51:39 +01:00
4257307063
feat: expose plugin agent tools through task MCP ( #2552 )
...
Co-authored-by: Kandev Agent <agent@kandev.dev >
2026-08-12 20:25:13 +01:00
8ca01e0f7e
feat(git): add local-first contribution resolution ( #2560 )
2026-08-12 19:12:35 +01:00
c4b4791de6
fix(git): contain rewritten contribution histories ( #2509 )
2026-08-12 08:12:53 +01:00
58b18bcb70
fix(agentctl): serialize workspace stream websocket writes ( #2502 )
...
Co-authored-by: Kandev Agent <agent@kandev.dev >
2026-08-10 21:21:54 +01:00
f25a2bee62
fix(agentctl): allow git pull --rebase past the flag allowlist ( #2501 )
...
Co-authored-by: Kandev Agent <agent@kandev.dev >
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com >
2026-08-10 20:03:33 +01:00
e9d3cb02cb
test(agentctl): cover the agentctl HTTP API handlers ( #2499 )
...
Co-authored-by: Kandev Agent <agent@kandev.dev >
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com >
2026-08-10 19:44:44 +01:00
9e503c5e6b
feat: surface allowlisted OpenCode remediation links in recovery surfaces ( #2396 )
2026-08-07 21:27:43 +01:00
c97e85448b
fix: restore browser inspect annotation submission ( #2374 ) ( #2381 )
2026-08-07 18:11:37 +01:00
a5d6649f69
feat(review): support nested submodule review ( #2295 )
2026-08-06 15:04:19 +01:00
6eaab90d9f
feat: add mid-turn steering for Claude ACP sessions ( #2241 )
...
Co-authored-by: Carlos Florencio <carlosmflorencio@gmail.com >
2026-08-06 11:28:18 +01:00
80e4d77bb1
feat(secrets): add scoped repository secret environments ( #2237 )
2026-08-05 23:05:54 +01:00
84fe8132a1
feat: support remote contribution tasks ( #2265 )
2026-08-05 19:25:58 +01:00
ae31fa85a9
feat(gitlab): add task MR lifecycle notifications ( #2125 )
...
Co-authored-by: Carlos Florencio <carlosmflorencio@gmail.com >
2026-08-05 18:22:31 +01:00
58f0f6214e
feat(lsp): run language servers on task hosts ( #1863 )
2026-08-05 10:57:24 +01:00
3c9bf8295f
feat: support 100 MiB prompt attachments ( #2261 )
2026-08-04 22:11:13 +01:00
3f46da6645
fix(backend): harden office-disabled cron, title limits, and dead-runtime cleanup ( #2206 )
2026-08-03 15:11:58 +01:00
431e5d40fe
fix: enforce classified Git admission paths ( #2150 ) ( #2181 )
2026-08-03 11:04:34 +01:00
b5631da7ee
feat: surface OpenCode provider limit errors ( #2167 )
2026-08-02 21:48:14 +01:00
62d4522e0f
feat: add file-backed diagnostic log bundles ( #2087 )
2026-08-02 20:14:53 +01:00
3b00a22589
feat: add optional agent-generated task titles ( #2104 )
2026-08-02 15:53:46 +01:00
1a59ae23b5
perf(agentctl): parallelise the multi-repo git fan-outs ( #2138 )
2026-08-02 15:37:31 +01:00
ea5173c922
fix: re-anchor stale git base for commits panel and cumulative diff ( #2062 )
2026-07-31 14:53:36 +01:00
167ab6b778
feat(mcp): add session attachment diagnostics ( #2061 )
2026-07-30 20:49:07 +01:00
7ec82dcaec
feat(search): add task workspace search palette ( #2006 )
2026-07-29 09:50:29 +01:00
488d76edf4
fix: extend ACP session creation timeout ( #1949 )
2026-07-26 10:40:49 +01:00
bc218dfbbe
feat: add workspace sources from files panel ( #1900 )
...
* feat: add workspace sources from files panel
* fix: preserve worktree identity during recovery
* feat: unify workspace source actions
* fix: validate recovered workspace repositories
* fix: harden workspace source filesystem boundaries
* test: split workspace repository chip coverage
* fix: restrict repository rescan recovery paths
* fix: stabilize workspace source CI checks
* test: canonicalize workspace source paths
* test: align workspace source container paths
* fix: populate direct workspace repository names
* test: preserve git fixture rewrites across restarts
* test: isolate backend git fixture config
* fix: resume remote workspace executions before creation
* fix: preserve ssh agent identity during resume
* fix: preserve SSH workspace across backend restart
* fix: simplify workspace actions trigger
* fix: refine add workspace repositories UX
* docs: narrow workspace source UX updates
* fix: avoid phantom turn on session resume
* test(web): normalize workspace source request headers
* feat(web): streamline workspace source picker
* docs: remove trailing spaces from workspace source plan
* fix: prevent resume status from creating phantom turns
* fix(web): stabilize workspace source attachment
* refactor(web): extract workspace source store contract
* fix: avoid phantom turns on idle agent resume
* fix: address backend static analysis findings
* fix: preserve agentctl readiness status value
* fix: preserve resume messages without active turns
* fix: resume agents from promoted workspace root
* chore: merge origin/main into feature/add-new-repo-folder-d97
* feat(web): explain workspace source consequences
* test(websocket): count session activity subscription
2026-07-25 21:29:53 +01:00
2f6be0c777
fix(agents): harden ACP launcher configuration ( #1917 )
2026-07-24 16:36:44 +01:00
8c010ebeca
fix: inherit service temporary environment ( #1894 )
2026-07-23 17:24:54 +01:00
d475cdf597
fix: scope Office agent tools and task mutations ( #1867 )
2026-07-23 16:31:37 +01:00
24f2fba183
fix: restore line expansion for multi-repo diffs ( #1856 )
...
* fix: restore line expansion for multi-repo diffs
* test: clarify review file grouping
* fix: require repository scope for ref reads
2026-07-22 09:10:54 +01:00
4d1787f484
fix: harden agentctl bind, git clone args, and powershell sound escaping ( #1811 )
...
* fix: harden agentctl bind, git clone args, and powershell sound escaping
Three LOW-severity defense-in-depth hardening fixes with PoC + regression tests:
- notifications: escapePowerShell now neutralizes backtick and `$` in addition
to `"`, defusing `$(...)` sub-expression and `$var` injection through an
operator-supplied SoundFile path interpolated into the powershell `-c` script.
- office/skills: git clone for git-sourced skills now passes a `--`
end-of-options separator before the source locator (matching configloader),
so a `-`-prefixed locator can never be parsed as a git flag.
- agentctl: new Config.ListenHost() binds the control server and per-instance
listeners to loopback only when no AuthToken is configured (auth disabled),
so the unauthenticated command/shell/process routes are never reachable
beyond localhost. The normal nonce-handshake flow (incl. Docker) always has
a token and keeps binding all interfaces.
* test: make PoC tests flip and drop indexOf coupling
Address review feedback on the security-hardening PoCs:
- system_provider PoC now demonstrates the PowerShell sub-expression injection
against a legacyEscapePowerShell copy of the unfixed function and asserts the
current escaper defuses it, so the PoC genuinely flips instead of passing
trivially against fixed code (a substring match on `$(` matched the escaped
form too).
- materialization PoC + regression test use stdlib slices.Index instead of a
custom indexOf defined in the PoC file, removing the coupling where deleting
the PoC file would break the regression test.
---------
Co-authored-by: Kandev Agent <agent@kandev.dev >
2026-07-20 11:32:43 +01:00
f212258907
perf: scale workspace git status for large worktrees ( #1814 )
2026-07-20 11:04:59 +01:00
1dc96a92c6
fix: restore multi-repo review diffs ( #1795 )
2026-07-19 12:25:36 +01:00
Carlos Florêncio