CHANGELOG.md
Rama main · réplica de lectura del repositorio original.
# Changelog — ChannelGate
ChannelGate was formerly *Claude Gateway for Slack*; entries below the rename keep their original
wording. All notable changes to the gateway, newest first. Dates are when the work landed.
This project brings Claude Code (and optionally OpenAI Codex) into Slack as a self-hosted,
per-channel-sandboxed agent. See `FEATURES.md` for the living catalog and `docs/WHY.md` for the
product overview.
> **Publication dates.** Every public release entry below carries the date the Licensor published
> it. Entries for work that never left the private repository are not publications. No version is
> relicensed automatically (license v1.2 removed the former Change Date before first publication).
>
> | License version | Effective | Published |
> | --- | --- | --- |
> | Makeitfuture Sustainable Use License 1.2 | 2026-08-25 | 2026-09-06 (with ChannelGate 0.5.0) |
> | Makeitfuture Sustainable Use License 1.1 | 2026-08-20 | never published |
> | Makeitfuture Sustainable Use License 1.0 | 2026-08-06 | never published |
## Unreleased
- **Company email auto-approval.** Admins can configure exact email domains in Users, preview
existing Slack users and approve matching provider identities automatically. Manual revocations
prevent automatic reapproval; no administrator privileges are granted.
- **Email accounts.** Connect an ordinary mailbox — IMAP for reading, SMTP for sending — to a
conversation or to yourself by entering its server settings once on one form: in the admin UI
(the conversation's Connections, or a person under Users), in Slack's ⚙️ Settings (MCP page for
the conversation's, You page for your own), in Teams' Settings → MCPs, or through Google Chat's
private settings form. Both logins are tested before the account is saved, passwords are
write-only everywhere, and the mail clients run in the gateway, so a channel container never
holds a mailbox password. The agent reads, searches, files, downloads attachments from and
sends with the account through new `gateway` tools (`list_email_accounts`, `email_search`,
`email_read`, `email_download_attachment`, `email_move`, `email_set_flag`, `email_send`);
personal accounts exist only in their owner's turns. Gmail, Outlook and other Composio apps stay
on Composio. Adds the `nodemailer` and `imapflow` dependencies.
- Price GPT-6.1 Sol at its September 29 Standard rates, including per-request long-context
multipliers. Preserve pre-July 30 GPT-5.6 Terra/Luna rates during historical previews and
refreshes. Defer this pricing basis's automatic historical refresh until an audited,
explicitly authorized manual apply; forward estimates use the corrected defaults.
- Cap Registered/non-Enterprise installations at 20 registered channels and 20 registered users.
Existing records are preserved; excess new registrations receive an explicit limit notice.
- Add Enterprise-only per-channel Approved harnesses in the admin editor and Slack Settings.
Enforce the policy for thread pins, saved sessions, API/automation and automatic fallback;
preserve restrictions after a license downgrade. Fix: an admin's Slack Settings on an
Enterprise install failed to open ("An API error occurred: invalid_arguments — unsupported
element: multiselect") because the harness picker sat in an actions block, where Slack allows
no multi-select; it is now a section accessory, an empty approved list no longer sends empty
initial options, and a regression test renders every Settings page against Slack's Block Kit
rules. Slack's own validation detail now rides along in the Settings error notice.
- Scheduled Slack tasks can ask their creator questions using cards and forms. Submitted answers
resume the correct scheduled session, including silent and retired one-time tasks.
- Add explicit admin-only sudo task schedules through MCP and the Automations editor. Each fire
rechecks the creator's admin role before running on the gateway host with permission bypass;
ordinary schedules continue in their channel container.
- Change Google Chat settings by typing `/settings <option> <value>` (mode, Auto, Lean, network,
access, managers, VPN, and the thread or channel engine/model/effort). Typed changes use the same
permission checks as the card buttons and work on a Pub/Sub-connected app, which cannot receive
button clicks. The `/settings` card now lists the commands, and the daemon log records every card
click it receives and every Google Chat event it ignores, by delivery path and key names only.
- Fix Google Chat card buttons (Settings Apply, tabs, Files) answering "unable to process your
request" on a Workspace add-on Chat app: every card action now names the HTTP endpoint URL,
which is how an add-on dispatches a click; the action's own name still travels as a parameter.
- Fix the agent directory returning an empty list on a connected Slack deployment: register
the live Slack client for discovery and follow disconnect/reconnect. Preserve native Slack
automation delivery, including image uploads, menus and reminder permalinks.
- Update Claude Code to 2.1.306 and offer Sonnet 5.5 in the model picker, with its
native 1M context window and verified external-usage cache rates. Existing saved models remain valid.
- Find specialist channel agents with a live directory of purposes, examples and shared skills.
Managers can describe/hide their channel's agent. Metadata refreshes at startup and nightly;
recommendations respect the requester and reply audience and never transfer work automatically.
- Show connected Composio apps and accounts directly in Slack Settings → You and the channel MCP
page, with automatic loading, refresh and account pagination.
- Show connected Composio apps and accounts on admin user pages and channel Connections pages,
with account statuses, shared connection source, refresh controls and explicit provider limitations.
- Supply each attempt's resolved admin permission bypass decision to the assistant, so it can
distinguish its actual launch permissions from the channel's Admin label and writable tools.
Permission policies and container boundaries are unchanged.
- Preserve existing unavailable Cloud MCP selections when saving unrelated admin settings.
Removing a selection refreshes the channel picker and prevents later saves from restoring it.
- Show enabled optional providers in the admin channel Runtime picker and preserve their saved
engine/model selection when changing unrelated channel settings.
- Clear typed tokens when Slack Settings reopens a form after an asynchronous save refusal,
including a custom MCP address rejected by DNS validation. Non-secret fields remain filled;
leaving an existing connection's token blank still keeps its saved token.
- Keep cancelled Slack turns from restoring the loading indicator while their engine shuts down.
Stop and cold-engine steering close progress immediately and ignore late output; cancellation
during preflight cannot start a new indicator.
- Fix open SSH sessions retaining stale channel secrets after additions, rotations or removals.
Refreshes now recheck the developer’s access and close sessions when access is revoked or
their mounted workspace/runtime changes.
- Show the active model in Slack's native Stop control using a per-session display name.
Existing apps need `chat:write.customize` and reinstallation; missing customization permission
preserves the native Stop button with its usual name.
- Fix Slack Settings rejecting the MCP, Skills and You pages with `invalid_arguments` when
their multi-select pickers contain options.
- Require a human approval card before managed Composio joins, invites or creates Slack channels,
including in Auto/Admin mode and through batched actions, both identities and host runtimes.
Refuse opaque connector code/API executors that could bypass membership approval; use
structured actions instead. A request to share or post does not authorize adding the bot.
- **Slack Settings redesign.** ⚙️ Settings now has seven pages behind one dropdown: Agent,
Access, MCP, Variables, Skills, Schedules and You.
- **Edit in place:** engine/model/effort and the mode are one row of dropdowns. Tokens, URLs and
variables open their fields on the page instead of in a second window, and the footer's Save
stores them.
- **Variables** have a ⋯ menu: Replace value, Allowed servers, Make readable/secret, Remove.
- **Access** lists every member with a Use tick; unticking an approved member removes them from
this channel only.
- **Composio, Make toolbox, Toolbox and custom MCP servers** each have their own section, on MCP
for the channel and on **You** for yourself.
- **Skills and Cloud MCP** are one picker each.
- The long explainers are gone.
- Clarify Composio file-staging identity arguments in every engine's per-run instructions:
use `"user"` for `composio-user` and `"agent"` for `composio-agent`.
- Update the pinned Claude Code and Codex CLIs to 2.1.300 and 0.162.1.
- Update the gateway dependencies to Composio SDK 0.22.0, Express 5.3.0 and Acorn 8.19.0.
Download filenames retain their names and required escaping; Express now omits optional quotes
around simple attachment filenames. Regression checks cover the installed SDK's session
creation/resume contract and public downloads with spaces, quotes and Unicode names.
- Google Chat card buttons now work: a Chat app connected through a Pub/Sub topic never receives
button clicks (Google delivers them only to an HTTP endpoint connection), so Files / Variables /
Settings and every other card button failed with "unable to process your request". ChannelGate
now serves `POST /api/googlechat/events` on its HTTPS listener, verifying each request's Google
ID token (issuer, audience = the endpoint URL, verified sender = the configured Chat app service
account) before feeding the same transport path Pub/Sub uses, and acknowledges within Google's
30-second window. Settings → Google Chat shows the endpoint URL and takes the app's service
account (and, for standalone apps, the project number). The Pub/Sub subscription stays in place
for Workspace Events reactions. Setup: `docs/PLATFORMS.md`, Google Chat step 9.
- Add Google Chat reaction controls. Chat apps receive no event for a reaction, so ChannelGate now
maintains a Google Workspace Events subscription per space (app authentication with the
admin-approved `chat.app.messages.readonly` scope, renewed about hourly) when Settings → Google
Chat → **Reaction events topic** is set. The configured start emoji (🤖) runs a message as the
reactor, 🛑 stops a running or queued turn (author or admin) and ✅ closes a tracked reminder.
Reactions are deduplicated, freshness-bounded and withdrawn on removal; messaging is unaffected
when reaction events are not configured or not approved.
- Google Chat `/help` looks tidier: emoji section headers, icon rows with each command in bold
above its description, a highlighted mention hint, and no redundant "Google Chat help" bubble.
- Google Chat gains expandable help, requester-only settings/model and file controls, private
browser credential entry, native approvals and the Files/Variables/Settings reply menu.
Control commands remain responsive during agent work. These adapt the Teams improvements to
Cards v2 and Pub/Sub; live Google Chat acceptance remains pending.
- Fix Google Chat audit findings: registered slash commands (`/help`, `/stop`, `/model …`) are
read from Google's command annotation instead of the arguments-only `argumentText`, so they no
longer arrive empty or as a bare prompt; long turns show a ticking "still connected" heartbeat in
the working line again; a working line left by a failed edit is removed; approval refusals and
control errors tell the clicker why, privately, without host paths or API bodies; Deny no longer
submits the comment box; a refused browser-settings save explains the rule and keeps the
session; a quoted top-level `/stop`/`/status`/`/clear` reaches the quoted turn in group chats and
unthreaded spaces; a restart-interrupted button click is reported only to its clicker.
- Fix Teams 🛑 Stop and ✅ Tick reactions being ignored in group chats and channels. Microsoft Graph
now returns those messages without reaction history, and the earlier fallback accepted only
activation emojis. A present Stop/Tick created after its own saved cutoff and within the last
ten minutes now acts as its reactor; removal history and deduplication still apply.
- Teams answers now end with the same reply menu as Slack: 📂 Files, 🔑 Variables, ⚙️ Settings
and a 📄 button for each workspace file the answer named. The buttons open the existing private
Teams windows, work on older replies and after restarts, and only for the person who asked.
- Teams file window: Word `.docx` files now show a read-only plain-text preview of the document
body (formatting, images and layout are not shown; Download returns the original). **Edit
file** now appears for text and Markdown files up to the browser editor's 250,000-character
limit; it was wrongly hidden for any file over 3,000 characters.
- Keep Teams Open files/Open file buttons working when Teams accepts a channel-thread card
without returning its activity id. The gateway used to treat that as a failed post, deleting
the button's reference while the card stayed visible, so every click showed "This file button
is no longer available" and the thread also showed "Teams returned no message identity".
- Preserve Teams Open files/Open file references across gateway restarts and Teams reconnects
for their original 15-minute lifetime, with current access checks on every opening. Distinguish
missing references, expired buttons and unknown buttons instead of attributing every lookup
failure to a restart. Private file windows still require reopening after a restart.
- Keep Teams file callbacks responsive by removing duplicate membership requests, cancelling
stalled read-only callbacks within 3.5 seconds, and showing a dialog error for unavailable or
expired file controls. Settings and approval mutations retain their completion semantics.
- Add literal text previews to Teams file windows and a `share_file` agent tool that delivers
**Open file** in the source conversation. Remove Slack-only tools from Teams and Google Chat
sessions, preventing file sharing from calling Slack with a foreign conversation ID.
- Show a simple “Agent is working…” status in Teams and refresh the native typing indicator while
a turn runs. Stop typing before the answer replaces the temporary status.
- Simplify Teams replies to the answer, requester tag and small statistics footer. Hide detailed
tool/runtime progress and remove the old working message after successful failed-edit fallback.
- Keep Teams action flows in their source conversation: Files and Send file launch native windows
from thread buttons; personal connection tokens are managed in Settings → MCPs → My connections;
approval cards no longer send supplemental decision-link DMs. File/settings dialog contents stay
out of shared chat, and public model cards reject forged settings actions.
- Extend the bundled `channelgate` skill with supported OpenVPN setup and task-specific VPN/SSH
access instructions, including Secret handling, identity verification, isolation, layered
checks and cleanup. Customers receive the reference with gateway updates.
- Allow project-local `.claude/` skills and settings in browser folder uploads, including uploads
into existing project subfolders. The channel-root `.claude/` policy remains protected.
- Continue browser file and folder uploads after individual failures. Skipped files are listed
with their reasons and retained for retry, while successful files are removed from the selection.
An oversized file no longer disables uploading the rest of the batch.
- Route ongoing requests by scope before saving: memory for facts, existing skills for reusable
procedures, existing schedules for job instructions, and channel instructions for behavior
across tasks. The guide, managed block, tool descriptions and memory reviewer agree. Agents
report saved versus pending changes without duplicating procedures into channel rules/memory.
- Allow schedule creators and gateway admins to read a task's full prompt and edit its prompt or
title in place, preserving identity, timing, delivery and history. Stale content edits are
refused instead of overwriting another edit; no delete/recreate workaround is needed.
- Allow `CLAUDE.md` in browser file and folder uploads. The new *Overwrite existing files*
checkbox lets the uploader replace files at their original names; leaving it unchecked keeps
numbered copies. Replacements are atomic and never write through destination symlinks.
- The `channelgate` skill now answers "what server should we host this on?": a hosting reference
gives the recommended configuration (4 dedicated vCPU, 16 GB RAM, 150 GB NVMe, Ubuntu 24.04 LTS,
static IPv4) and four recommended EU hosts with estimated monthly prices — Hetzner CCX23 (≈ €25),
netcup VPS 2000 G12 (≈ €16), RoLeaf in Romania (≈ €32) and Google Cloud `n4-standard-4` (≈ €139).
- **Custom MCP servers from Slack.** ⚙️ Settings → MCPs now lists the conversation's custom MCP
servers and your own, and lets you add, update or remove them in place. A conversation's servers
are editable by its managers and admins; your own are yours to manage. Tokens stay write-only.
Repeated edits reuse the Settings window; slow address/access checks acknowledge promptly,
time out safely and recheck current authority before saving.
- Teams channel and group-chat answers now end with a native mention of the requester, matching
Slack. Long answers tag them on the final chunk before the statistics footer; DMs skip the tag.
- Make Teams reply statistics smaller and add a gap above them, including replies that replace
the working placeholder and background/scheduled results.
- Remove container image references from reply statistics in Slack, Teams and Google Chat.
- Fix Google Drive sync channels getting stuck after an interrupted pass. Passes now use rclone's
self-recovery flags (rclone 1.66+), never start beside a pass container left over from before a
restart (an orphan is removed after the maximum pass time), and a channel whose sync state rclone
can no longer use is reported as needing a resync, with a daily admin DM and a **Resync** button
on the channel page instead of failing silently on every sweep.
- Add Teams Graph callback diagnostics to the operational audit: receipt, validation, authenticated
target acceptance and bounded rejection reasons, without logging callback credentials or payloads.
Subscription retry warnings retain their numeric provider status in service logs.
- Fix Teams activation reactions being ignored when Microsoft Graph returns current reactions
without message history. Fresh provider-timestamped additions retain reactor authorization and
share deduplication with later history; a saved upgrade cutoff excludes older snapshots.
Stop/Tick continue requiring explicit history, and removal history remains authoritative.
Resolve the authorized reactor from Teams rosters using either `aadObjectId` or the legacy
`objectId` field returned by some tenants.
- Fix Teams text model choices bypassing a dedicated channel Codex login, and resolve inherited
model/effort defaults against the selected engine. Bound Bot Framework authentication and
outbound requests, support placeholder cancellation, and preserve authenticated regional
reply routes across reconnects and private file/card delivery.
- Persist ordinary Teams webhook intake before acknowledgement, recover queued work without
replaying uncertain running turns, and keep Stop/status reachable behind occupied dispatch
slots. Cancel durable queued turns under the existing author checks and protect text/native
model selection against queued work and concurrent runtime changes.
- Make Teams `/help` easier to scan with a quick start, highlighted common commands and six
expandable topics. Shorter descriptions and readable reaction names replace the long initial
guide; the full text remains available when native card delivery fails.
- Show all six section buttons in one centered row in the Teams settings popup and open
`/settings` on General with its form already displayed.
- Teams `/settings` now posts a compact **Open settings** button that opens a private popup
inside Teams. All six settings pages, saves and confirmations stay in the popup instead of
expanding the chat card. `/secrets` opens its Variables page. Every opening preserves the
original conversation/session, rechecks current access and has separate expiring form state.
- Slack's native **Stop** button: the app manifest now subscribes to `agent_session_stopped` (and
`agent_session_title_changed`) and every turn drives the thread's Agent Session natively
(`agents.sessions.setStatus` / `rename`, legacy `assistant.threads.*` as the bridge fallback), so
Slack renders its own Stop control on a running thread; pressing it cancels that thread like a
`stop` message. Paste the updated `slack-app-manifest.json` and reinstall the app to enable it.
The manifest also registers the `/model` slash command the gateway already handled.
- Richer native data tables: `slack_post_table` accepts link, formatted, mention and row-button
cells (lightweight Markdown in strings or explicit cell objects) and Slack's current limits of
200 rows / 20,000 characters.
- Composed replies: the new `slack_compose_reply` control tool attaches charts, tables, cards,
link rows and collapsible details panels to the final streamed answer, so one message carries
the takeaway and its visuals; a rejected block set is retried without it so the answer and its
footer always land.
- Native 👍/👎 answer feedback on every reply footer, recorded as `reply_feedback` events; a 👎
privately invites the correction in the thread.
- Fix completed Codex turns being reported as failures after recovered reconnect notices; retain terminal failure and unsafe-replay safeguards.
- Restore bounded Claude watchdog continuation for cold and warm silence-budget failures using typed error details; retain Stop and ambiguous-kill exclusions.
- Add observed pending-tool context to Claude and Codex hard-kill diagnostics without attributing the cause, suppressing diagnosis or replaying ambiguous work.
- Refuse runtime selections for enabled optional providers whose own credential or endpoint is
missing, preserving existing pins and reporting the Settings repair. A complete provider
configuration and its default selection can be saved together without account fallback.
- Processed Slack originals stay removed on ordinary thread replies after a successful download.
Explicit attachment downloads remain available, and failed downloads can still retry.
- The bundled gateway guide now explains Composio discovery, independent tool batches and Python
workbench scripts for bulk operations, including account selection, remote result files and safe
file staging. It applies on every chat surface without overwriting operator guide overrides.
- Claude Cloud MCP discovery now marks connected servers without an admissible transport as
unavailable, suppresses unsafe CLI targets, and rejects new selections against fresh host
definitions. Existing invalid picks remain removable and are still dropped safely at run time.
Teams Settings applies the same fresh admission check after cached discovery and hides Activate
for unavailable definitions while retaining Deactivate for existing grants.
- An unlinked channel's Drive status reports gateway readiness without claiming that the channel
will sync on the next sweep. It explicitly asks for a folder link before channel sync can start.
- Public automation documentation now covers run history, task outcomes, quiet execution and
existing-thread delivery, with the exact `get_schedule_runs` and `update_schedule` controls.
The documentation build again accounts for every registered control.
- Far fewer approval cards. A gateway tool that changes channel or gateway state is now automatic
for the admin or channel manager who asked for it (modes, network, folders, MCP servers,
secrets, tokens, skill settings, gateway update and restart, the license key, instruction
replacement), and refused outright for anyone else. Only eight cards remain, for changes that
would silently reach other channels or leak a secret: Admin mode, the gateway guide, admitting a
skill source, granting skills organization-wide, adding to a template, approving a skill
proposal, approving a server for a hidden secret, and making a secret readable. Every remaining
card is durable: it never expires, survives restarts, and the click applies the exact saved call.
A secret's card is approved by its tier (admin for the organization's, anyone working in the
conversation for its own, the owner for a personal one). "Approve forever" is a channel manager's
call, and new channels let approved members manage their own settings by default.
- Slack and Teams help now cover current settings, variable scopes and secret approvals, custom
MCP connections, skill authoring, automation controls, dedicated Codex sign-in and self-service
SSH. Slack help uses the current mode names and explains file sharing and finite loops.
- **Automation health and quiet delivery.** Run history now distinguishes an agent finishing from
its task succeeding, retains connection checks and safe logs, and shows per-automation health,
timing, tokens, cost and delivery failures. Tasks can run silently and send only useful results,
keep failure alerts independently configurable, and deliver repeated fresh runs into a chosen
thread or a daily thread. Healthy empty checks remain recorded without routine messages. Missing
outcome reports remain unreported; deleted/one-time tasks retain their history.
- **Custom MCP servers.** An admin can add a remote MCP server by URL and Bearer token to a
conversation (Connections → *Custom MCP servers*, reached as `custom-<name>`) or to one person
(*Personal MCP servers*, reached as `my-<name>` in that person's runs only). Claude and Codex
both receive them. The gateway connects on the agent's behalf, so the token never enters the
container. URLs must be HTTPS and public, checked at save and on every connection. Tokens are
write-only. Servers that need OAuth still go through Composio.
- Admin settings now offer independent message-activation emoji lists for Slack, Teams and Google
Chat. Slack keeps its existing selection; Teams applies its list to native and Graph reactions
and shows it in help. Teams configuration changes exclude older queued/history activations.
Google Chat's selection is saved, with an explicit note that its current transport does not
receive reaction events.
- Settings can connect a Perplexity subscription for research delegation from Claude and Codex.
Agents receive quick/deep research, model discovery and quota tools with citation results;
the real login stays in the gateway and containers receive a protected relay placeholder.
The optional unofficial client requires network access and is omitted in Lean mode.
- Teams `/model` now works like Settings → General: choose the engine and press **Load models**,
and the Model and Effort lists show only that engine's choices; Apply saves. Previously one card
listed every engine's models together. Apply after changing Engine without Load models loads
that engine's models instead of saving.
- Teams settings now show only models for the selected engine in each channel/session list.
After changing Engine, Load models refreshes the choices without saving; Apply saves the
complete selection for that scope.
- Teams `/model` now opens an engine, model and effort picker with an Apply button for the
current session, alongside its current selection. Typed changes remain available.
- Teams Graph reaction intake now recognizes Heart eyes robot when Graph encodes it as 😍
with the exact provider name and no custom artwork. Ordinary Heart eyes and missing metadata
remain inactive; a saved cutoff prevents older reactions replaying after the upgrade.
- Teams can activate a request with 👽 Alien (`:alien:`), its bare ID, Unicode form, or documented
`1f47d_extraterrestrialalien` ID. Help recommends Alien; robot and Like remain supported.
A separate saved cutoff prevents older Alien reactions replaying after the upgrade.
- Missing personal skill grants or dependencies no longer prevent unrelated requests from
running. Available skills load normally, and streamed/final replies warn about omissions,
including after engine fallback. Ownership and confinement checks remain enforced.
- Teams reaction activation now accepts the exact Heart eyes robot picker shortcut
`:hearteyesrobot:` as well as its bare event ID. 👍 Like is an alternative activation reaction. Native `like` and Graph Unicode
thumbs-up values, including skin-tone variants, use the existing authorized reaction path.
Teams help shows the Heart eyes robot shortcut and Like alternative; legacy robot IDs remain
recognized. A persisted cutoff prevents newly recognized aliases from replaying older reactions.
- Teams help now shows Teams reaction IDs and picker names instead of Slack shortcodes.
Heart eyes robot no longer displays the mismatched plain robot glyph, and the guide explains
that reaction codes must be selected through the picker rather than sent as text.
- Teams Stop sign reactions now cancel the selected session’s active and queued requests with
author/admin checks. Tick button reactions acknowledge tracked reminders, including escalation
notices. Native and Graph intake recognize their Teams IDs; help describes the supported actions.
- Teams `/help` now uses a native card with separate headings, spaced paragraphs, emoji rows
and commands, avoiding the run-on layout caused by Markdown soft line breaks. Card delivery
falls back to the complete spaced guide, and quoted group help cards keep their session.
- Teams help identifies Heart eyes robot, Stop sign and Tick button by their emoji names.
Robot activation now recognizes the documented Teams `hearteyesrobot` and `smilerobot` IDs.
- Teams `/help` now includes the practical usage guide for files, settings, skills, memory,
schedules and background work, with Teams-specific session controls and command examples.
- Teams and Google Chat now show the model and current app/tool call while a turn runs, and the
same model, duration, token, optional cost, context and image footer as Slack on its final reply.
Live status updates coalesce within the surface edit budget and never show tool payloads.
- Container turns now prepare a protected Claude login even when Codex, Qwen or Qwen EU is the
selected engine. Explicit nested `claude -p` commands authenticate through the host's existing
relay; Qwen's main process retains its own provider settings. No additional interactive login
or thread switch is needed when the host already has Claude authentication.
- Teams `/settings` now offers the same six sections as Slack, including channel defaults and
session overrides, variables, MCP connections, skills, automations and session resume. The
console opens in the original channel/thread or chat, uses explicit Apply buttons and confirms removals without revealing
stored credentials. `/secrets` opens Variables directly.
Buttons update the same requester-bound card. Shared cards omit personal/organization
credential metadata, ungranted private connection catalogs and administrator session commands.
`/settings` initially shows only the section menu; selecting an option opens its settings below.
General runtime settings now use one Apply to channel or Apply to thread button to save engine,
model and effort together. Stale and incompatible forms cannot partially change the runtime.
- Users already allowed in a channel, including named guests, can enable their own SSH access
without manager or admin approval. Registering/removing personal keys and revoking one’s
own SSH grant are also self-service. Changes for other people remain manager controlled.
- Background shell jobs (`run_in_background`) inside a channel's container now start directly in
Auto mode, with no "Run it" card: the container is the boundary and Auto mode already
auto-approves every foreground command there, so the former admin-only click only stalled
non-admin authors. A job on the daemon account itself (the `/sudo` host lane) still needs an
admin's exact-command approval. Every agent-type approval card now says on the card who can
approve it ("Only a gateway *admin* can approve this; anyone eligible may Deny or Comment").
- Gateway Settings now lets admins map short names to an engine and model. In Slack, select the bot mention and type `:astra` after Slack's inserted space (`@agent :astra`) to pin that model to a thread, with an optional task after the name. Mappings can be updated as models change.
- Admin channels now keep non-admin members and guests in a separate project container with
Worker permissions and the selected Auto/Lean options. Only current organization admins
receive the optional host-home mount. HOME, scratch files, artifacts and engine histories
are separated, and switching author lanes starts fresh history.
- Conversations can filter by Google Chat, Slack or Teams alongside search and Channels / DMs.
Teams channel names now use `#team-channel`, resolving missing names through the bot directory
on incoming messages while preserving conversation IDs, work folders and settings.
- Update runs the host Bash entry point, repairs exact dependencies and provisioning even when code
is current, checks image executables without provider sign-in, and uses a bounded graceful restart
with a longer startup readiness window. Provider authentication no longer blocks gateway repairs.
- Codex now continues a partially completed turn in the same session after a model-capacity
refusal. It avoids rerunning completed tool actions and tries another model unless the thread's
model was explicitly pinned.
- Update smoke now binds and marks its disposable channel live for the duration of the probe,
allowing the Codex login relay through the egress proxy and releasing it on cleanup.
- Scheduled checks can run every fixed number of days and DM their creator only when the result
begins with a configured match prefix. Routine checks make no Slack posts.
- Add `@agent /fork <new message>` for Claude and Codex sessions in Slack. It starts a separate
engine branch in a linked new thread and runs the supplied message there.
- Allow `@agent /fork :model-shortcut <new message>` to select the fork's model on the source
engine, preserving the original thread's settings. Invalid or unauthorized shortcuts are
rejected before creating a thread.
- A `/fork` model shortcut for another engine now creates a linked fresh session and carries
the source Slack conversation into it, like switching an existing thread's engine. Same-engine
shortcuts retain native session forking; clean threads continue without history replay.
- Fix a history-transfer deadlock when `/sudo` crosses a container whose mounts need recreation.
Transfer preparation now excludes its own lease, reports waits, handles Stop, and times out
into transcript recovery instead of hanging indefinitely.
- Google Chat now reports a fatal Pub/Sub receiver error as a failed connection, stops intake,
and gives an actionable Subscriber-role hint for permission errors. Reconnect restores status
without allowing an old connection's late error to overwrite it.
## 0.6.3 — 2026-10-11
- Refresh the locked MCP SDK, URI and IP parsing dependencies to patched compatible releases.
- Add optional `conversationKey` to the HTTP run API: keep related external events in one
persistent Slack thread, preserve agent context through the existing run queue, and expose
thread timestamps, reuse flags and permalinks. Replace deleted roots safely and report Slack
access failures without silently starting a separate headless conversation.
## 0.6.1 — 2026-10-06
- Channel Runtime now shows only engine and model controls for the shared login. Dedicated Codex
sign-in uses a method dropdown: choosing ChatGPT starts the device flow and clicking its code
copies it; the API key field appears only for that method. The shared sign-in moved to Settings.
Slack Settings names the dedicated login and its channel defaults. Codex Cloud MCP discovery
and launch now use that channel account when selected.
- ChatGPT sign-in displays the device link and complete code from current Codex CLI output;
proxied hosts pass the public TLS CA bundle to the login process.
- A channel using its own Codex login now stays on Codex across settings, `/model`, and existing
threads. The settings page hides the redundant engine picker and
explains login storage without showing the internal path.
- **The agent can send any file into the thread.** New gateway tool `slack_share_file` posts a file
from the channel's working folder — PDF, Word, Excel, PowerPoint, ZIP, images, HTML — into the
current thread as the bot, up to 25 MB, exactly like the file explorer's Share button. "Trimite
fișierul" no longer ends in a "which Slack account?" question card: a Composio upload is only for
other channels or DMs now. Files outside the channel folder (including the mounted operator home)
and symlinks out of it are refused.
- Completed nested background reports stranded by the earlier `invalid_thread_ts` error get one
bounded recovery attempt from their saved output after restart. Their work is not rerun.
- Channel Runtime settings now ask for the Codex login source first. Shared gateway Codex sign-in
is available from the admin Settings page.
- **Nested background agent reports reach their Slack thread.** Delivery now turns an agent's
synthetic session key into the launching thread timestamp before posting the report and menu.
Scheduled reports with synthetic keys post at channel level. This prevents `invalid_thread_ts`
from stranding a completed report.
- Admin channel settings now start ChatGPT device code sign-in or accept an OpenAI API key for a
dedicated Codex login, show its status, and select it after success.
- Channels can select a separate host-side Codex login for ChatGPT subscription access or an
OpenAI API key. Proxy-mode containers receive only channel-bound credential placeholders.
- **Automatic engine switches now stay with the conversation.** When Claude reaches its limit and
Codex answers, the next message resumes that Codex session instead of retrying Claude. The same
holds when Codex switches to Claude. Existing threads with a successful fallback session adopt
it on their next message; a manual thread engine or model choice still takes precedence.
- Overview now draws separate stacked columns for each time bucket, shows model totals when a
source, channel or user bar is hovered or focused, and arranges usage sources beside the three
time charts above Models, Channels, Users and Skills.
- **The folder-generator test no longer scatters projects across the operator's home.** Its custom-workdir fixtures now live under one `ChannelGate Testing` folder, are removed when the test process exits, and stale runs are swept before the next test suite.
- **A provider usage limit no longer blocks an update.** Before and after updating, the updater sends each engine a tiny test prompt inside a throwaway container. A reply like "You've hit your weekly limit" used to refuse the update, even though it proves the engine starts, logs in and reaches its provider. It now counts as reachable. A broken login or engine still stops the update.
## 0.6.0 — 2026-09-28
- **Claude model choices now show exact versions.** The `/model` picker and admin selectors list
Opus 5.5, Fable 5.1, Sonnet 5, and Haiku 4.5. Duplicate moving aliases and special modes no
longer crowd the normal list. Existing alias settings keep working and stay visible when selected.
- **Codex no longer sends usage metrics to OpenAI.** Claude Code's telemetry was already off, but Codex still sent OpenAI its anonymous usage and health metrics by default. Every Codex process the gateway starts now runs with `analytics.enabled=false`: chat turns, background work, the memory reviewer, SSH and VS Code sessions, and the gateway's own checks.
- **A channel's database can be read page by page, and counted.** `query_channel_database` used to return at most 100 rows with no way to ask for the next ones. Ordered by a table's primary key, a read now also returns `nextCursor`; passing it back as `after` gets the next page, until it comes back empty. The new `count_rows` returns how many rows match, so an agent can show that nothing was missed. The extractor image has to be rebuilt (`npm run vpn -- build --channel ID`, then VPN off and on); until then the running one keeps working and a paged or counted request says it needs the rebuild.
- **A connector outage at the provider no longer looks like a gateway bug.** When Composio or a toolbox answered a connection attempt with an error, a container run just lost the connector and the daemon logged only `remote MCP unavailable`. A brief 502/503/504 or network blip is now retried once after a second, so it no longer drops the connector for the whole turn. A lasting failure is logged with the server and the upstream status, for example `remote MCP unavailable (composio-user: upstream HTTP 502)`. The container still sees only the fixed sentence.
- **Slack Settings has an Automations page, and the tabs are reordered.** The tabs now read General
· Variables · MCPs · Skills · Automations · Resume. **Automations** lists the conversation's
scheduled tasks, reminders and `/loop` wake-ups with their next run time, and lets anyone allowed
to use the agent there pause or resume a recurring schedule and delete any of them. Creating one
is still done by asking the agent.
- **Every AI reply ends with the same menu: 📂 Files · 🔑 Variables · ⚙️ Settings.** Replies used to show the menu inconsistently. Errors had none, "🛑 Stopped." still showed the removed 💻 Resume button, and API-run, scheduled, background and restart-recovery answers had no menu or lacked Settings. Replies also showed bare icons, while `/menu` spelled out the labels and still offered Resume. Now every answer, error and stop in Slack ends with all three labelled buttons, after a model switch, an API request or anything else. A long answer carries the menu on its last message instead of the first. `/menu` shows the same three buttons. The resume command stays in Settings → Resume Session and `/resume`. A menu under an automated post (no Slack requester) opens for whoever clicks it, with that person's own permissions.
- **Allowed domains is back as an option** on the add-variable form and the admin page. Filling it in restricts a secret to exactly those domains: no approval cards, and the value is never sent anywhere else. It also now works for tokens sent in headers other than Authorization, such as `x-api-key`. Leave it empty to approve servers on first use instead.
- **The admin page lists variables in a table:** name, masked value, type (🔒 Secret or 👁 Readable, with the reason on hover), the servers a secret may be sent to, who set it (shown as a person's name, not a Slack id) and when.
- **Adding a variable asks one question: is it a secret?** The Visibility choice and the domains field are gone from the add-variable form and the admin page. One **Secret** checkbox remains, ticked by default. The gateway handles the rest: where the variable may be sent is learned through admin approvals, and an email or database password stays usable even when marked secret. Untick it for plain configuration such as an id, a region or a URL.
- **"Secrets" are now "Variables", and you choose how each one is shared.** The Slack menu, the message footer, the Settings tab and the admin page now say *Variables*. Adding one offers **Visibility** (Auto, Hidden or Readable) and an optional **Used on domains**. A variable given domains stays hidden and works only on those domains, with no approval card. A variable that looks like an SMTP, database or signing login stays readable even when Hidden is chosen, because it cannot work as a placeholder, and the list says so. Leaving the fields empty on an update keeps the current settings.
- **Every secret is hidden by default, and an admin approves where it may go.** A secret the gateway had no rule for used to reach containers as its raw value. Now, unless it looks like a password, connection string, signing key or configuration value (those stay readable), containers get a placeholder. The first time a program sends it to a new server, the proxy refuses that one request and posts an approval card in the thread: *Use secret VERCEL_PAY_MAKEITFUTURE on api.vercel.com?* After an admin approves, that server keeps working for every run, schedule and SSH session. A secret is never sent to the model APIs. New tools: `set_secret_mode` (hidden / readable / auto) and `allow_secret_host` (admin; approve a server without waiting for a card). Existing secrets without a rule switch to this on the next run, so each asks once per server.
- **Templates are the team skill sets, and admins curate them from chat.** An admin can now add skills to a template (Development, Sales, …) or remove them straight from chat with `update_skill_template`. Anyone else can ask for a skill to be added to a template, and an admin approves the request. There is no separate "team" scope for skills.
- **Skills no longer ask for approval you already gave.** Creating, updating or deactivating a personal or channel skill used to post an Approve card every time, admins included, and the agent often asked where a new skill should go. Now a skill the user asks for is created as a **channel skill** of the conversation (a personal skill in a DM) with no card and no question. Any member of the channel can edit or deactivate the channel's skills. The agent mentions every change in its reply. Admins moderate only the **organization** library: an admin's organization skill is created at once, while anyone else's request becomes a channel skill plus a proposal for an admin. A member's edit to an organization skill becomes a change proposal, and deleting a skill from the whole catalog is an admin's call. Skills synced from the gateway's own publish repository can now be edited and are pushed back; skills from sources the gateway cannot write to are extended with a companion skill instead. `set_skill_scope` is now admin-only.
- **Codex's read-only sandbox also works in whole-home Admin channels.** Codex keeps its app-server socket in a fixed `/tmp/codex-daemon-<uid>` and requires that folder to be its own mount, owned by the user with mode 0700. In a channel that mounts the operator's home, even the `/tmp` volume lives under that home, so member turns there (held read-only by the home guard) still could not run commands. Every container now gets a 1 MB tmpfs on exactly that folder. Existing containers are recreated once.
- **Codex Read-mode commands now actually start.** Each channel's `/tmp` and `/var/tmp` were folders inside the channel's artifact folder, which is also mounted at its own path, so the same files were visible twice inside the container. Codex's sandbox refuses that ("app-server socket directory has an unsupported host mount … remove the bind-mount alias"), so Read-mode Codex still ran no command after the capability fix. `/tmp` and `/var/tmp` are now per-channel podman volumes (`<container>-tmp`, `<container>-vtmp`), kept across stops and recreates like the home volume. Existing containers are recreated once; files an agent left in the old `/tmp` stay on the host under `~/ChannelGate/.runtime/<platform>/<slug>/tmp` but no longer appear in `/tmp`.
- **Members can no longer write to the operator's home through a whole-home Admin channel.** With *Admin channels can access the host home* on, the home is mounted read-write for the whole channel container, and a non-admin author's turn in that Admin channel still received the shell and file-writing tools, so it could change any file in the home without a prompt (CTR-30, 2026-09-27). Every run there that is not an admin author's is now read-only: Claude's shell and write tools are denied outright, Codex runs in its read-only sandbox, and plugin command servers are refused. Admin authors are unaffected.
- **Codex Read-mode channels can run commands again.** Codex 0.156.1 enforces its read-only sandbox with bubblewrap only, and bubblewrap will not start while the process holds the container's added capabilities ("bwrap: Unexpected capabilities but not setuid"), so every command failed even with bubblewrap installed. A sandboxed Codex run in a container now starts without those capabilities: reads work, writes are refused. The ignored `features.use_legacy_landlock` switch is gone (EN-01 on Codex, 2026-09-27).
- The egress proxy now presents its CA after the per-host leaf, so the in-container browser's CA pin matches and agent-browser loads HTTPS pages without `--ignore-https-errors` (EGR-03, 2026-09-27). Codex failure messages no longer lead with the CLI's "Reading additional input from stdin..." notice (EN-09).
- Channel image spec 1.6.1: the image now ships `bubblewrap`. Codex 0.156.1 refuses to run any command in a read-only sandbox without it ("filesystem-restricted execution requires bubblewrap"), so Read-mode Codex channels could not execute a probe since the 0.156.1 pin (found by the 2026-09-27 live campaign, EN-01/CTR-06/MD-02 on Codex). Rebuild with `npm run build:image`.
- **The browser works behind the egress proxy.** Chromium's proxy and certificate flags were joined
with a space, which agent-browser does not split, so every page failed with
`ERR_INTERNET_DISCONNECTED` in a proxy-mode channel. They are now comma-separated.
- **Leftover credential files are cleaned out of channel containers.** A crashed or interrupted run
could leave its MCP config or Codex secret bundle in the channel's artifact folder, where later
turns could read it (files from before the MCP relay held real Composio and toolbox tokens). The
gateway now deletes such files older than six hours before a channel container is created or
started, and at boot for containers already running.
- **Idle channels no longer flood the audit log.** An idle warm Claude process's telemetry, refused
because nothing is running in the channel, is counted in the egress status instead of written as
an audit row for every attempt. Every other refusal is still logged.
- **Codex status and error text no longer shows Node's proxy warning.** The
`[UNDICI-EHPA] Warning: EnvHttpProxyAgent is experimental` line is silenced in proxy-mode Codex
runs and filtered out of the status row and failure messages.
- **Claude sends no telemetry from proxy-mode channels.** Claude runs behind the egress proxy now
set `DISABLE_TELEMETRY=1`, so an idle warm engine stops sending telemetry the proxy would refuse.
Feature flags, the version check and claude.ai plugin downloads are unaffected. A channel secret
named `DISABLE_TELEMETRY` is now refused as reserved.
- **Organization secrets are named as organization secrets.** When a run's only secrets were
organization-wide, the credential list never said so, and an engine could call them channel
credentials. The scope is now stated whenever any secret is organization-wide or personal.
- **Codex's sign-in no longer sits in every channel container.** Until now each channel container
had the gateway host's real Codex login file, refresh token included, mounted read-write, so one
channel could read it and every channel shared it. Behind the egress proxy a container now gets
its own access-only sign-in: a stand-in token the proxy swaps for the real one on OpenAI's and
ChatGPT's servers, and no refresh token at all. The gateway keeps the real login fresh with a
cheap Codex turn on the host when it is two days from expiring. Keep the host signed in with
`codex login` as before. Each channel container is recreated once on its next turn. The legacy
open-network mode and an API-key Codex login still mount the real file. Rebuild the image
(`npm run build:image`, still spec 1.6.0): `cg-init` now also removes an old copied Codex login
from a channel's home.
- **Secrets without an egress rule are withheld by default on new installs.** On a fresh install
*Withhold unprotected secrets* starts on: a secret with no built-in rule and no *Used on hosts* is
not given to channel containers. Existing installs keep their current behavior; turn it on in
Settings → Container runtime. `list_secrets` now ends with a **Finding** that names every secret
without a rule and says how to protect it.
- **A check keeps secrets out of the files channel containers can read.** `npm run check:static`
now fails when code writes a token, a relay's token or a resolved run environment into a
channel's artifact folder. The unused `remote-secret-bridge` helper is removed.
- **SSH and VS Code sessions hold placeholders, not secrets.** A developer's SSH session into a
channel container now gets the same `cgph_…` placeholders a turn gets, and Claude's login in the
session (and the editor's token file) is the channel's login placeholder. Nothing a session
writes holds a real protected value. Tools such as `gh` and `vercel` work as before through the
gateway's egress proxy. The proxy settings reach every SSH shell, VS Code terminal and your own
`agent-browser`. The editor token file is now also removed when the channel's last session ends.
- **Your personal secrets pause while someone else is attached.** While another person has an SSH
session open in a channel, your personal secrets stop working there. Everyone else's stop working
while you are attached. The agent's credential note says they are paused rather than failing
with an unexplained 403.
- **Outbound SSH from a session goes through the egress proxy.** The image ships
`/opt/channelgate/bin/cg-egress-connect`, an SSH `ProxyCommand` through the egress proxy. A
session's `GIT_SSH_COMMAND` already uses it (github.com only, with *Allow network* on). For your
own `ssh`, add `-o ProxyCommand='/opt/channelgate/bin/cg-egress-connect %h %p'`. The proxy
cannot supply an SSH key. `ssh -L` forwards to hosts outside the container no longer work;
forwards to the container's own ports and `-R` are unchanged. Rebuild the image
(`npm run build:image`, still spec 1.6.0) to get the helper.
- **Channel containers now reach the internet only through the gateway's egress proxy.** Every
channel container runs with no network of its own. A small forwarder inside it hands each
connection to the gateway, which enforces the channel's *Allow network* switch on every request
(off: only the AI engines and the channel's selected connectors; on: public hosts, never private,
loopback or cloud-metadata addresses) and logs every refused or blocked destination. The switch
is no longer advisory, and `/mode`, `/status` and the run record say so. A flip applies to the
next request without recreating anything.
- **Secrets become placeholders the container cannot use elsewhere.** A GitHub, Vercel, Supabase,
Make or Composio token, and any secret an admin marks with **Used on hosts**, reaches the
container as a `cgph_…` placeholder. The gateway swaps in the real value only on that secret's
hosts and only while the channel has work running; a personal secret only while its owner is the
one working, and never while another person's turn, background job or SSH session is active
there. The relayed Claude
login is a placeholder too. Rotation takes effect on the next request; removing a secret kills
its placeholder. Secrets without a rule are still injected as before and are marked
**unprotected** in `list_secrets`, the admin UI and the agent's own credential note. The new
*Withhold unprotected secrets* setting keeps them out of containers entirely.
- **New container settings.** Settings → Container runtime gains *Legacy open network (no egress
proxy)* — off by default; on restores the old open bridge network and raw secrets — and
*Withhold unprotected secrets*. The admin API accepts `rawNetwork` (a channel that needs raw
sockets beside the proxy) and `egressRawHosts` (hosts whose SSH/Postgres ports are tunnelled).
If the proxy cannot start, container runs stop with the reason instead of running unprotected.
After a restart, containers that kept running get their network back immediately. Avoid
multi-tenant host suffixes such as `*.vercel.app` in *Used on hosts*. A Qwen provider key and a
daemon `CODEX_API_KEY` are still given to containers as real values, and a self-hosted Qwen
endpoint on a private address cannot be reached in proxy mode.
TLS clients in the container trust the gateway's own CA through the usual CA variables; a tool
that reads none of them needs `/run/channelgate/egress-ca.pem`. After updating, run
`npm run build:image` (image spec 1.6.0 now also ships the forwarder; the updater does this for
you).
- **Fix: Codex in Composio SDK mode works in containers.** A Codex run in a channel container with
Enterprise SDK-mode Composio started its Composio connection without the run's grant, so the
gateway refused it and Codex had no Composio tools. It now connects like the other relayed
servers.
- **Composio and toolbox tokens no longer enter a channel container.** In a container, the
`composio-user`, `composio-agent`, MakeItFuture toolbox and Make toolbox connections are now
reached through the gateway itself: the engine holds only its signed run grant, and the daemon
dials the service with the real token and relays the tools. Before, the token sat in a file in
the channel's run folder that any process in the container could read. This applies to Claude
and Codex turns and to SSH sessions. Direct-host `/sudo` threads are unchanged. A rotated token
still restarts the warm Claude process. After updating, run `npm run build:image` (image spec
1.6.0; the updater does this for you).
- **Agents can now explain how to set up a channel's VPN.** The chat operating manual has a
channel VPN page. It covers who may turn the VPN on or off, read its status or query the
database. It also has the host-operator runbook for another channel, with the exact
`npm run vpn` steps, the profile and Secrets requirements, what each failure means and who fixes
it, and how to rotate or retire the service. It says plainly that provisioning cannot run inside
a channel container. It never tells anyone to paste a profile or password into chat.
- Dependency refresh: the Composio SDK moves to 0.19.0 (the session API the Enterprise SDK mode
uses is unchanged), `mcp-remote` to 0.14.3 in both the daemon and the channel image, and `zod`
to 4.6.5. `hono`, pulled in by the MCP SDK, moves to 4.13.9 for its moderate advisories. After
updating, run `npm run build:image` (the updater does this for you) so channel containers get the
new `mcp-remote`.
## 0.5.7 — 2026-09-25
- **An HTTP API run now works like an admin's message in its channel.** The run API key is an
admin credential. An API run gets the channel's mode as an admin would, including Auto and, in an
Admin channel, the permission bypass. It also gets memory (search, read and save, plus the
post-reply memory review), skills, connectors, the admin gateway tools, and the same tool
approvals. It acts as one fixed `api` principal, never as the `author` it names. So it uses the
channel's shared agent Composio account and gets nobody's personal tokens, secrets, skills or SSH
keys. Background work and schedules it starts are owned by `api` too. Per-user API keys are
planned.
- An API run joins its thread's queue. A Slack reply in a channel-backed API thread gets the usual
Steer / Queue / Cancel choice instead of running at the same time, and a Slack stop or steer in
that thread stops the API run.
- A per-run API `mode` no longer rebuilds the channel's container. On an Admin channel with the
host-home switch on, a `read`/`worker`/`auto`/`lean` run used to drop the home mount, wait for
every run inside, and recreate the container (killing detached jobs). The next ordinary turn then
recreated it back. The mode now narrows tools only.
- The `resumeCommand` an API run returns now opens the session inside the channel's container, like
the Slack Resume control. The old host command answered "No conversation found".
## 0.5.6 — 2026-09-25
- Codex over SSH now gets what a chat turn's Codex gets: the gateway tools, your own and the
channel's Composio accounts, the channel's MCP servers and your channel secrets, starting in
the channel folder. `with-secrets <command>` runs any other command with those secrets.
- Slack **⚙️ Settings** pages are tabs again: one row — General · Resume · MCP · Skills · Secrets —
with the open page highlighted, instead of the *Page* dropdown.
- Google Drive sync now syncs the channel's whole folder instead of a `Drive/` subfolder. Agent
instructions and skills, channel memory, secrets, `.git` and dependency trees never sync, a
`.driveignore` file adds a channel's own exclusions, and symlinks are never followed. rclone now
runs in a throwaway container that sees only the channel folder, so a planted link can never
write onto the host (this also closes that hole in the old subfolder sync). A folder that
contains the home or the gateway's data is refused.
- VS Code over SSH now starts in the channel's folder: File → Open Folder in a Remote-SSH window
opens at the channel folder (or its custom folder) instead of the container's home.
- Handing a generated file to Drive, Gmail or another Composio tool now goes through the gateway's
staging on every engine: the rule rides each run's Composio identity notice, so Codex no longer
falls back to pushing the file through Composio's workbench as base64.
- Google Drive sync no longer stalls on a folder that was empty when it was linked. The first sync
of two empty sides succeeded, but every later sync then failed (rclone: "Empty prior Path1
listing"), so files never moved. A sync record that holds no files now triggers a fresh resync.
- Slack **⚙️ Settings** no longer claims a channel pinned to Claude inherits the Codex default
model (or the reverse): an unset model or effort now names what the channel's own harness would
actually use. The web admin's VPN status also stops saying "not configured" twice.
- Sending a generated file to Drive, Gmail and other Composio tools works again — or rather, works
for the first time on a gateway using personal Composio tokens. `stage_file_for_composio` sent the
stored token to Composio's REST upload, which only accepts project API keys; the tokens stored
here are consumer (MCP) keys, so every stage failed with "Invalid API key" and the model told the
user their key was broken. With a consumer key the gateway now stages through the hosted MCP's own
workbench, daemon-side and in chunks, so the file still never passes through the conversation
(limit 25 MB there, 100 MB with a project key). A real problem now reads `Staging failed:`;
`Staging refused:` is kept for files that are not the conversation's own (outside its folder, a
symlink, not a regular file).
- Security: staging a file for Composio now reads the exact file whose location it checked. It
used to check the file, close it and open it again by name, and the conversation's container can
write its own folder — so in that gap the name could be swapped for a link to a file elsewhere on
the host, which the gateway would then have read and uploaded. Found by review during the
2026-09-25 QA campaign. The tool first shipped in 0.5.3, and on a gateway using consumer keys (the
default) no stage could complete before this release, so the gap could not have been used there.
- The assistant no longer suggests a blanket container prune when asked about disk space. The
rule against `podman system prune`/`reset`, `podman image prune -a`, `podman volume prune` and
`docker system prune` lived only in the operating guide, and a run that answered without opening
the guide recommended two of them — on this host they can delete channel homes or the runtime
image. The rule now sits among the few hard rules every run of every engine reads, pointing at
`npm run runtime:storage` (removal only with `-- --apply` when an admin asks).
## 0.5.5 — 2026-09-24
- The runtime image no longer carries SSH host private keys. Installing `openssh-server` generated
`/etc/ssh/ssh_host_*_key`; nothing used them (each channel's `cg-sshd` makes its own key), but
every channel container on a host held the same three private keys, and the signed release
would have published them in the image archive. They are now deleted in the step that installs
sshd. That, plus four reviewed look-alikes — prefix constants in Codex 0.156.1 and in the Copilot
runtime bundled with the VS Code server, each pinned to its official archive — is what failed the
`v0.5.3` release evidence scan. Rebuild the image (`npm run build:image`) to drop the keys.
## 0.5.4 — 2026-09-24
- Claude Opus 5.5 and GPT-6 Sol / GPT-6 Luna reach the gateway. The image pins move to Claude Code
`2.1.281` (2.1.280 added `claude-opus-5-5` and made it the default Opus) and Codex CLI `0.156.1`
(its hotfix added GPT-6 Sol and Luna to the model catalog). Claude's picker is alias-based, so
`opus` / `opus[1m]` resolve to Opus 5.5 with no picker change; Codex discovers its catalog live,
and the bundled fallback list now matches what 0.156.1 serves — GPT-6 Sol and Luna in, the
withdrawn `gpt-5.3-codex-spark` out. The Codex cost estimate prices `gpt-6-sol` at $2/$0.20/$10
and `gpt-6-luna` at $0.10/$0.01/$0.50 per 1M tokens, both with the usual 2x/1.5x uplift above
272K input tokens. Opus 5.5's $4/$20 rates were already in the Claude table. Existing prices are
unchanged, so no historical repricing runs.
## 0.5.3 — 2026-09-24
- Slack ⚙️ Settings: the VPN moved out of its own **Network & VPN** section and onto the row right
under the Auto/Lean/**Network** switches it belongs to — `VPN — On / Off / Not configured` plus
its controls, with the explanatory paragraphs dropped. The separate "Network use" read-out is
gone for anyone who can already see the network checkbox; members and DMs, who cannot, keep a
one-line version. A failure or an unavailable service still says why.
- One tool per verb for secrets. `list_secrets` replaces `list_my_secrets` and `list_org_secrets`
and shows every scope a run receives — organization, personal, this conversation — in one live
call (names, provider, masked tail, who set them; never a value), filterable with `scope`.
`set_secret` and `remove_secret` replace the four `*_my_*` / `*_org_*` writers; the scope is an
argument and the approval card's tier follows it. In an SSH session, `CG_SESSION_ENV` names the
session's current env file, and the assistant is told to source it in the same command when it
needs a credential added after its `claude` started — no restart, no reconnect.
- Slack ⚙️ Settings → Skills: the skill template is now a dropdown on the page instead of a
**Change Template** button that opened a second modal containing that same dropdown. Picking a
template saves immediately and repaints the page, like the Engine & model selects already did.
With no templates defined the row stays a read-out pointing at the admin UI. A Settings view
opened before this change repaints onto the new control, and a template modal that was already
open still saves.
- Make `claude` over SSH the same Claude a Slack turn runs. A session had no MCP servers, no
channel secrets and a login labelled "Claude API" with no usage shown, while a turn in the same
channel had all of it. Now, before your shell starts, the gateway prepares the session like a
turn: the channel's tool policy and MCP allowlist, the gateway tools, `composio-user` for your
own connected accounts, `composio-agent` for the channel's, the channel's selected MCP servers
and its secrets by name — and nothing else, so the operator's own claude.ai connectors never
load. Claude reads the gateway's login from an access-only file (no refresh token, removed when
the channel's last session ends) and shows it as the account it is: "Claude Max account", the
organization, the usage windows and the plan's default model. Everything is refreshed every 20
minutes while a session is open — and re-prepared within a second when a secret or MCP
selection is added to the channel, an organization secret changes, or your own secrets or
Composio token change, so the next `claude` you start in the session has it (a running one
keeps what it started with, like any process); "show SSH access" says what a session gets.
- Stop Claude Code updating itself inside a channel. Its interactive updater had installed a
newer copy into the channel's `~/.npm-global/bin`, which is first on the image PATH — so that
copy silently replaced the pinned CLI for every turn in the channel and hid the gateway's login
wrapper (the real reason one channel's `claude` still asked to log in after the onboarding
fix). Every container now runs with `DISABLE_AUTOUPDATER=1`.
- The "reset all channels to gateway defaults" button now asks for the scope. Clearing a channel's
engine/model only decides what a NEW thread inherits, so every thread that had been pinned by
hand (`/model` → *just this thread*, or a `claude`/`codex` directive) kept answering on its old
harness and model and the reset looked like it had done nothing. The confirmation now offers
**Channels only** (the previous behaviour) or **Channels + threads**, which also deletes those
per-thread engine, model and effort pins and reports how many it cleared. Per-thread `/clean`
and `/sudo` postures, DMs and DM threads are untouched either way. The reset also clears each
channel's reasoning **effort** now: the `/model` wizard picks engine, model and effort in one
pass, so keeping effort behind left channels on the gateway's default model with a hand-chosen
effort they were never meant to keep.
- Say why a VPN would not turn on. When the helper refused, the web toggle, Slack Settings and
the agent all answered "Could not change VPN state", so a VPN image left over from before an
update looked like an unexplained failure and invited repeated retries. The toggle now gives
the same fixed diagnostic as the status row, for example that the image needs rebuilding.
Only a known failure class is passed on; helper text and provider output never are.
- Open interactive Claude signed in over SSH and VS Code. Connecting to a channel's container
worked and `claude -p` answered, but plain `claude` opened the first-run theme picker and a
login screen, so it looked signed out. Headless engine turns never finish Claude's onboarding,
and the flag lives in the channel's `$CLAUDE_CONFIG_DIR/.claude.json`, not `~/.claude.json`.
A second cause: sshd starts every session with a clean environment, so an SSH shell, a remote
command and VS Code's server never saw the container's own variables (`CLAUDE_CONFIG_DIR`,
`CODEX_HOME`, `PATH`, `TZ`, …) and Claude read the wrong settings file. SSH sessions now get
the same environment `podman exec` gives, every SSH or VS Code attach marks onboarding done
(merging, never overwriting other settings or a theme you picked), and the gateway's `claude`
wrapper pins its settings folder. Claude still asks once per folder whether to trust it.
- Start SSH sessions in the channel's folder. An interactive `ssh` login now opens in the
channel's work folder instead of `/home/agent` (image spec 1.5.1; rebuild with
`npm run build:image`), and "show SSH access" prints a `code --remote ssh-remote+…` command
that opens VS Code straight on that folder.
- Show the gateway's own notices in streamed Slack answers. When a turn failed over to the other
engine, the "Codex hit its usage limit — using Claude" line, the license allowance warning and
the "Skipped MCP connection" notice were attached only to the finished reply, but Slack writes a
streamed answer from the live stream — so none of them were ever shown and people could not tell
which engine had answered. They now lead the answer, and each appears exactly once however the
reply is delivered.
- Stop the assistant recommending a cleanup command that deletes channel data. Asked whether the
gateway was running out of disk, it correctly said it could not measure containers from inside
one — and then suggested `podman system prune -a --volumes`, which removes every stopped
channel's home volume along with its sessions and logins. The operating guide now forbids
running or suggesting `podman system prune`, `podman volume prune` and `podman image prune -a`
by name, and points at `npm run runtime:storage` instead.
- Add `npm run runtime:storage`, a report of what container storage could be reclaimed. It lists
every channel container, runtime image and volume as keep or remove with the reason, and counts
the space layer by layer so layers shared between images are not counted twice. It changes
nothing unless run with `-- --apply`, and it never removes a running container, a channel's home
volume, the current or previous runtime image, or anything belonging to another gateway install
whose folders still exist — only leftovers whose folders are gone, such as finished test runs.
Nothing runs it automatically; run it by hand or schedule the report.
- Share one VS Code server between every channel instead of storing one per channel. Opening VS Code
on a channel — attach or Remote-SSH — used to download about 650 MB into that channel's home
volume, per editor version, and nothing ever reclaimed it. The channel image (spec 1.5.0) now
carries the servers for VS Code 1.139.0 and 1.138.0 once, read-only, and every container start
links them into the channel, so attaching costs a few kilobytes. Other editor versions still work
and download their own as before. The build checks each download against VS Code's published
SHA-256. Rebuild the image (`npm run build:image`) and restart.
- Make rerunning the SSH access installer safe. Without `CG_SSH_HOST`/`CG_SSH_PORT` it used to fall
back to this machine's hostname and port 22 every time, so a plain rerun — the documented fix
for several problems — silently replaced a corrected endpoint with the gateway's web hostname
and put developers back to connections that hang. An unset value now keeps what the previous run
recorded (and says so); the hostname and port 22 apply only to a first install.
- Stop a second gateway on the same host from silently switching SSH access off. The attach
socket lives in one directory per host, so a gateway under another runtime directory — a second
install, or a test daemon started from a worktree — reaches the same path. The daemon used to
delete whatever was there before binding, and to delete the path again on shutdown even when it
had never bound it; either way the daemon that owned the socket kept listening on a file that no
longer existed, so every developer's connection failed while it still looked healthy. It now
checks the path first and leaves a socket another process is serving alone, replaces only a
file nobody listens on, takes over within a minute if the other process goes away, and no
longer removes anything on shutdown except its own socket.
- Stop a hardened host from silently locking every developer out of SSH access. sshd checks
`AllowUsers`/`AllowGroups`/`DenyUsers`/`DenyGroups` before it looks at any key, and a refusal
there reads `Permission denied (publickey)` — the same as a wrong key, with nothing in the gateway
log. A host whose hardening names its real people in `AllowUsers` therefore refused the login
account for everyone. The installer now asks sshd for the lists it would actually enforce and,
when an allow-list excludes the account, appends it inside ChannelGate's own `channelgate.conf`
(the lists accumulate; your file is not edited). It adds nothing on a host with no allow-list,
where the same line would restrict every login to that account, and it stops with the file to
edit when a deny list names the account. Rerun `sudo bash scripts/install-ssh-access.sh`.
- **Channel access is edited on the Settings page itself.** Mode, Auto/Lean/Network, who may use
the channel, who may manage it, named guests and named managers were behind a *Change access
settings* button that pushed a second modal you had to fill in and submit — five clicks to flip
one switch. They are now six controls on **General Settings**, each saving the moment it is
changed, exactly like the engine and model rows above them. Nothing was relaxed: the controls
render only for admins and channel managers, one change describes one field (the rest of the
policy is read back from the record, so a repainted control can never resubmit a stale value),
and every save still takes the membership lock, validates named users against live channel
membership, re-checks management at the write boundary and audits the change. A rejected pick
writes nothing. An access form left open from before this shipped says where its controls went
instead of saving.
- **Slack Settings is five pages behind one dropdown, and the first one is General Settings.**
Engine & model, Access and Network/VPN were three separate tabs; they are now three sections of
**General Settings**, in that order, because "what is this channel allowed to do?" was never
answerable from one of them alone. The row of tab buttons — which wrapped onto a second line as
pages were added — is now a single *Page* dropdown listing General Settings, Resume Session, MCP,
Skills and Secrets. Nothing changed about who may do what: the access summary and its editor
still render only for admins and channel managers, the VPN on/off controls are still theirs, and
every other control stays open to any authorized user. A Settings view opened before this shipped
keeps working — its old page ids resolve to the page that now owns those controls. The VPN row
also stopped costing a subprocess on every open: a conversation with no provisioned service says
*Not configured* straight away, and only a provisioned one waits for a status read.
- **One worktree per task is now stated as a prohibition, in every place a run reads it.** The rule
already existed in three files and was still skipped: `references/git-repos.md` opened by handing
the whole question to the project's own instruction file, and this project's file mentioned
worktrees only as a clause inside a paragraph about pull requests — so a run that read both
concluded the protocol did not apply and edited the shared checkout directly. Six unrelated
features were built that way and left uncommitted, interleaved across the same files, past the
point where they could be separated into the six commits they should have been. The reference now
gives a project authority over WHICH branch to base on and land on — naming `beta`/`develop` vs
release-only `main`, since landing development on `main` is its own incident — while stating that
the isolation itself is never waived, that a passing mention still requires it, and that "small"
is not an exemption. The always-on rule says *never edit the shared checkout* rather than
"isolate edits". This repo's `AGENTS.md` gains the hard rule beside the other invariants and a
`One worktree per task` section with the actual `origin/beta` commands, the landing gate and the
cleanup that does not leave a `prunable` entry behind.
- Admin UI → Skills: a search box can be typed into again. The catalog, per-source and usage
searches filtered on every keystroke, and filtering re-rendered the whole panel — the rebuilt
input came back focused at its start, so "beta" was typed as "ateb". Searching is now something
you ask for: type freely, then press Enter, click the new **Search** button beside the box (it is
highlighted while a typed query has not been searched yet), or clear the box with Escape or the
browser's own ×. Typing itself only records a draft, which also survives a re-render for an
unrelated reason, and any render under a focused field now restores the caret where it was.
- Environment secrets now have three scopes instead of one (`src/config/scoped-env.js`).
**Organization** secrets are injected into every conversation's runs — one `GH_TOKEN` the whole
deployment shares instead of a copy in every channel — and live in `settings.json` (`orgEnv`,
0600), outside the `ENV_MAP` that can reach the daemon's own environment. **Personal** secrets
belong to a person and are injected only into runs THEY authored, in any conversation, never into
someone else's turn in the same room; they live on the user record beside the personal Composio
and Toolbox tokens. Precedence is organization → personal → channel, most specific last, so a
conversation's own account is never displaced by a personal token. The run preamble names each
variable's scope, the warm-pool fingerprint covers the merged set (a process started for one
author is never reused for another's turn), an unauthenticated run-API caller gets no personal
scope, and clean mode still injects nothing. New: `set_org_secret` / `remove_org_secret` /
`list_org_secrets` (admins) and `set_my_secret` / `remove_my_secret` / `list_my_secrets`; Slack's
`/secrets` and Settings → Secrets now render all three scopes in one modal (the organization's
Add button is absent for non-admins, and a row's authority is re-derived from its `action_id`
rather than trusted from the clicked value); the admin UI's *Organization secrets* card and
*Personal secrets* in the Users drawer; and `/api/org-secrets` + `/api/users/:id/env`.
Write-only everywhere, with no reveal path in any scope. One editor implementation now serves
all three (`public/admin-secrets.js`) and carries its own styling, so a secret box matches the
canonical admin-UI input wherever it is mounted instead of inheriting whatever its host gave it;
in the user drawer it stacks full-width like the token fields directly above. `.desc` is now
small everywhere rather than only inside a `.setcard`.
- Admin UI: the "owner — whose account?" note beside every Composio/Toolbox token field
(`.tok-label`) now styles itself instead of relying on an ancestor. It was only ever styled where
it happened to sit inside a `.field` — in Settings — so the same input rendered as a small grey
browser-default box in the conversation card and the user drawer. It now matches the token field
it labels in all three. `test/admin-ui-controls.test.js` asserts this class of control carries its
own box styling, since the bug shipped twice.
- **Overview charts are stacked by model, and there is a chart for the models themselves.** The
cost, runs and tokens charts now draw one band per model instead of a single line, so a rising
cost reads as "we moved onto a pricier model" or "we ran more" rather than leaving it ambiguous.
Attribution is per component, not per run: a Codex turn whose subagent used a different model
contributes to both, while the run is still counted once — and a run whose components are only
partly priced contributes no dollars at all, exactly as the headline figure treats it, so the
bands always add up to the total beside them. A new **Models** card lists every model in the
window with its token cost, share of spend, runs and tokens. Each chart has a legend and a
crosshair tooltip that breaks the hovered bucket down per model (pointer or keyboard); colours
come from a palette validated for the admin surface and are keyed on the model, so changing the
range, harness or source never repaints the series that survived the filter.
- **Usage that never went through chat is counted too.** The same engines, on the same machine and
billing account, are also driven by hand — a terminal `claude`/`codex` in a channel's work
folder, the VS Code extension, the desktop apps, and SSH or VS Code sessions inside a channel
container. An hourly read-only scan of what both CLIs already write (Claude Code's per-session
transcripts, Codex's rollouts) now feeds the Overview: an **Outside the gateway** KPI, a **Where
usage came from** breakdown (chat gateway / terminal CLI / VS Code / desktop app / headless), the
same per-model stacking, and a **source** filter that partitions the totals into chat-driven runs
and everything else. Outside work inside a channel's folder is charged to that channel; work
elsewhere stays in the totals rather than being charged to a conversation that never ran it.
Nothing is double-counted: every run now records the engine session it spent tokens in, and a
session the gateway launched — or a Codex subagent whose parent it launched — is skipped before
its file is opened. Sessions from before that recording started are recognised by WHERE they ran:
inside a channel container, or in a channel's own work folder, nothing but the gateway runs an
engine headlessly. That is what lets the scan cover a machine's **entire** engine history instead
of only what happened after this release, and every pass reports how many sessions it recognised
as the gateway's own so the outside figure can be checked rather than taken on trust. A container
is only read when it is already running, through the runtime's existing read-only inspection — a
usage scan never starts one or makes a turn wait behind it. `npm run usage:external` reprocesses
on demand (dry run by default, `--rescan` to re-read everything).
- **Fixed: one Claude API response was being charged several times.** Claude Code writes one record
per content block of a response — same request id, same usage — so summing the records billed a
single request two or three times. Usage is now counted per request. Checked against the sessions
where Claude Code recorded its own final cost, the figure this produces now matches Claude Code's
exactly; before the fix it was 21% high in aggregate and up to 3x on a single session. This only
ever affected the new outside-the-gateway figures — costs for runs made through chat come from
the CLI itself and were never computed this way.
- **Updating a gateway now restates its own history.** The outside-usage scan never re-reads a
transcript it has already seen, which is what keeps it cheap — and what would have left a gateway
stuck with numbers from an older build for good. Each pass now checks a fingerprint of the scanner
and of the rate tables against the last completed one; on a mismatch (including rows written
before this check existed) it forgets its bookmarks once and re-reads everything over the next few
passes. So deploying an update, or editing a rate table, reprocesses the past by itself — no
command to run. The per-model breakdown never needed reprocessing: it is computed from the
existing ledger when the page is drawn.
- **The bar lists are stacked by model too.** Runs per user, Channels and Where usage came from now
split each bar into the models that produced it, in the same colours and order as the charts — so
a colour means one model across the whole Overview, and a channel's runs bar and cost bar can be
compared directly. Also fixed: the ledger and the transcript scan disagreed on how to name a
dated model snapshot, which showed up as two identically-labelled "Haiku 4.5" rows.
- **Runs with no recorded model are no longer a "model unknown" band.** The gateway only started
resolving which model answered partway through its life, so older runs carry none — on this
deployment 387 runs worth $990. They are now charted under a per-engine fallback (Opus for
Claude, Sol for Codex, both editable in Settings → Agent defaults, blank to keep them unknown).
Only the model is assumed: the cost is whatever was already recorded, the per-model figures still
add up to the headline exactly, and the Models card says how many runs in a band were filled in
rather than measured.
- **Per-model Claude rates** (Settings → Agent defaults). A transcript records tokens, not dollars,
so outside Claude usage is valued from an editable $/1M table — input, both cache-write TTLs,
cache read and output, defaults verified against Anthropic's published pricing. Every token class
is priced separately, because an agent session is mostly cache reads. These rates never touch a
gateway run: Claude Code reports a real cost for those and it is used as-is.
- Teach the assistant to check container disk usage without acting on it. The gateway never
reclaims container storage on its own — each image build keeps the previous ~2-4 GB image, and
the idle reaper stops a channel's container without removing it, so the container keeps its
image alive. The operating guide now explains how to read free space and per-image container
counts from an admin `/sudo` thread, how to tell a leftover from a live container (they are
named by runtime-root hash, and test runs mint their own), and the two traps that make a naive
cleanup wrong: container tags follow `:latest` so only image IDs identify what is pinned, and a
removed container leaves its named HOME volume dangling, so a blanket volume prune destroys a
channel's engine sessions and CLI logins. Deletion stays a manual or scheduled admin action —
the assistant reports and asks.
- Fix `scripts/install-ssh-access.sh` dying silently under `sudo` when Node is a per-user install:
root's `secure_path` hid it, and a failing command substitution inside an assignment under
`set -e` exited before the "node is required" line could print. The installer now looks in the
invoking user's and the service account's `~/.local`, nvm, volta and fnm trees and the system
locations (`CG_NODE_BIN` overrides), keeps a root-owned copy of the binary beside the attach
wrapper so the no-home login account can execute it, proves that before touching sshd, and
reports the failing line on any abort. It also probes `CG_SSH_HOST:CG_SSH_PORT` and compares the
answering host key with this machine's: a different key aborts (that address is another server),
no answer warns that a web hostname behind an HTTP proxy such as Cloudflare never carries SSH.
- **The 💻 button is gone from reply footers; the resume command moved into Settings.** Slack
replies now end with 📂 Files, 🔑 Secrets, ⚙️ Settings (and any 📄 review-file buttons) — the
resume control no longer rides under every answer. Channel Settings gained a **Resume Session**
tab that shows the same copyable `cd "…" && claude --resume <id>` line (the container `exec`
form for a containerized channel), plus the session id and the folder it belongs to. It is
resolved from the live session when the tab is rendered, so a Settings view left open cannot
hand out a cleared session's id, and it names the harness that MINTED the session rather than
the channel default. `/resume`, `/menu`'s 💻 Resume button and the 💻 control on "🛑 Stopped."
messages are unchanged.
- **"Just send me the file" now sends the file.** Asking for a file in the thread — "share it here",
"attach it", "send me the report" — makes the assistant upload it with `slack_upload_snippet`
under its real name instead of only printing the path and a 📄 button. Any UTF-8 text file
qualifies: `.md`, `.txt`, `.json`, `.html`, `.yaml`, `.csv`, source, logs. Images keep their
automatic `` upload, `.html` is flagged as downloadable-but-previewed-as-source,
binaries (PDF, PPTX, XLSX, ZIP) still go through the file explorer, and a file over roughly 1 MB
is offered rather than pushed through the model's context. The `gateway-usage` skill and the tool
description both carry the rule, so an engine that never opens the skill still routes correctly.
- **A usage limit is no longer treated as a bug.** Self-diagnosis skips failures that are provider
account state rather than a defect in this source — usage/spend limits, missing or expired
sign-ins, billing, a model the account cannot serve, provider outages and dropped connections, as
well as a user's own stop. Hitting the Claude session limit no longer opens a 🩺 root-cause thread
in the diagnosis channel (which spent the exhausted quota to conclude "wait for the reset"), and
no longer burns the 30-minute cooldown a real crash needs. Crashes, stalls and malformed requests
are diagnosed exactly as before.
- Slack **⚙️ Settings → Engine & model** now edits the runtime in place instead of opening a second
modal, and covers both scopes: the channel default AND, when Settings was opened from a reply
inside a thread, that thread's own engine/model/effort pins. Six dropdowns save the moment they
are picked; an unset field preselects the label of what it inherits (gateway default, org DM
template, or "Follow channel (…)"), each scope's model and effort lists follow the harness that
scope resolves to, and a pinned thread gets a **Follow channel default** button that clears all
three. An unpinned thread whose live session belongs to the other harness is named rather than
moved silently. The old "Change engine & model" form is gone; a Settings view left open from
before the change repaints to the new tab instead of pushing it.
- `/model` → **This channel** now changes the thread it was run in, not just threads opened later.
The pick drops that thread's own engine/model/effort overrides so the new channel values apply
immediately, and when the thread's live session belongs to the other harness it also pins the
thread to the chosen one — otherwise the thread stayed on its session's engine and the newly
chosen model was dropped as foreign to it. The done card says when a thread moves, since the
move restarts it on the new harness with its earlier messages replayed as context. A thread
already on the chosen harness (or without a session) is left unpinned and keeps following the
channel and its cross-engine failover.
- Developers can SSH into a channel's container instead of the gateway host (`docs/SSH-ACCESS.md`).
A person registers one public key once from chat, a channel manager grants them access per
channel, and `show_channel_ssh` hands out an `~/.ssh/config` block; the connection reaches a
dedicated no-shell login account on the host whose forced command hands it to the daemon, which
authorizes the key, the user and the grant and runs an unprivileged inetd-mode sshd inside the
container on that stream — pty, VS Code Remote-SSH, sftp and port forwards all land in the box,
nothing listens on a port anywhere, and a container with a live session is never idle-stopped.
New: `scripts/install-ssh-access.sh` (root, once), image spec 1.4.0 (`openssh-server`,
`cg-sshd`; rebuild with `npm run build:image`), migration 27 (`ssh_keys`, `ssh_sessions`), the
`sshUsers` channel policy key, and six gateway tools (`add_my_ssh_key`, `list_my_ssh_keys`,
`remove_my_ssh_key`, `grant_channel_ssh`, `revoke_channel_ssh`, `show_channel_ssh`).
- Add a second Anthropic-compatible provider harness, **Qwen EU (Claude Code)**: Alibaba Cloud
Model Studio's EU (Frankfurt) region, driven through the same Claude Code CLI as the existing
Qwen harness. It keeps everything the CLI owns — streamed progress, the tool loop, approval
cards, connectors, `CLAUDE.md`, skills and resume — and serves that region's own catalog, which
includes the Kimi, GLM and DeepSeek families alongside Qwen. Like the first one it is off until
you switch it on, never an automatic failover target, and its turns are recorded with tokens
only.
The two harnesses are now generated from one provider table, so each has its own settings card,
its own write-only API key, its own endpoint, its own default model and its own live model list;
saving one never touches the other. The EU endpoint is per-workspace, so no default is shipped —
the harness names both missing halves and fails closed until you paste your own endpoint and key.
- Fix two defects the second harness exposed. Naming a harness in a thread matched engine ids in
registration order, so `qwen-eu` would have selected `qwen` and left `eu` at the front of the
prompt; ids are now matched longest-first. And the confirmation posted after such a switch called
every harness either "Claude" or "Codex" — it now names the harness actually selected.
- Let a conversation hand a file it generated to something outside Slack. Until now a run that
produced a PDF or an export had no way to deliver it anywhere: Composio's file-taking tools
(Drive upload, Gmail attachments, Slack uploads) accept only bytes already staged in Composio's
own storage, and nothing in the gateway could put them there — so the file stayed in the
channel's container while the agent explained why it could not be moved. `stage_file_for_composio`
now performs Composio's documented upload flow from the daemon and hands the model the exact
object those tools expect. You name which identity will run the upload, and that identity's key
is the one spent; a key never enters the container and nothing is published.
- Added temporary public file links for the cases a URL is the only way in — an API that ingests by
URL, or a person who just wants a download link. `create_public_file_link` serves one file from
the channel's own working folder at a short, unguessable URL. A machine-facing link lives five
minutes and allows five fetches; a person-facing one lives exactly as long as you say, up to a
hard 48-hour ceiling, and needs an Approve click naming the file and the duration. Links are
listable and revocable, every fetch is audited, and the whole capability is off until an admin
turns it on in Settings → Public file links — where turning it back off kills every outstanding
link at once. A link can never reach outside the channel's working folder, including on an Admin
channel that mounts the operator home.
## 0.5.2 — 2026-09-22
- Give a conversation its tools back when one engine runs out of quota. A channel whose engine had
hit its usage limit was answered by the other harness, as designed — but when the fallback was
Claude it started with no MCP servers at all: no gateway tools (channel memory, schedules,
Slack history, approval prompts), no Composio, no Cloud MCP selections, and no channel
permission lockdown. Tool requests were denied with no approval card instead of asking. The turn
still replied, so the only visible symptom was the agent reporting that Composio and its own
gateway tools were missing. Every fallback turn now spawns with the same MCP payload, lockdown
and approval route a normal turn gets. Clean mode still injects nothing.
- Stop the channel VPN's health check from getting the database address blocked. Every 30 seconds
it opened a MySQL connection and dropped it before logging in; MySQL counts that as a failed
connection and, after about 100 of them, refused the tunnel outright (error 1129, "host
blocked"), so database reads failed within an hour. The check now verifies only the tunnel and
its route. Rebuild the VPN image (`npm run vpn -- build --channel ID`) and turn the VPN off and
on; a database that already blocked the address still needs `FLUSH HOSTS` once.
- Sync Google Drive on demand. A channel's admin page has **Sync now** beside **Test**, Settings →
Google Drive sync has **Sync all now**, and asking the agent to sync Drive runs the channel's
linked folder immediately through the new `sync_channel_drive` tool. Each shows when the pass
finished or why it failed, and `get_channel_drive_folder` now reports the last sync. Manual
syncs obey the same enable switch and never double a pass already running.
## 0.5.1 — 2026-09-21
- Fix two release-smoke defects. A Qwen run with no model configured now asks QwenCloud for a
Qwen model instead of the CLI's Anthropic default (which failed every such turn with "Model not
exist"). A tool request from an HTTP run-API turn is now refused with a readable reason instead
of Claude Code's "invalid permission result" error; the request stays denied either way.
- Stop an unusable Cloud MCP selection from failing a conversation. A selected optional MCP server
that is missing from the host configuration, needs a host credential, or no longer matches the
transport it was selected with is now dropped from that run — for Claude, Qwen and Codex, on the
primary and the failover engine alike — instead of ending the turn. The answer is prefixed with
which connections were skipped and why, and the drop is recorded as an event for admins. Host
credentials are still never relayed into a channel container, and a corrupt operator
configuration no longer blocks every channel that selected anything.
- Add an optional **Qwen (Claude Code)** harness: the same Claude Code CLI driven against
QwenCloud's Anthropic-compatible endpoint, with its own gateway-level API key and base URL, and
a model list read live from the account. It is off until an admin turns it on, after which it
appears in the admin engine selectors, the Slack channel settings modal and `/model`. No
Anthropic credential ever reaches a Qwen run, it is outside the automatic failover in both
directions, and its turns are recorded with real tokens and no invented dollar cost.
- Run prepared channel VPNs with OpenVPN 3 Linux and refresh their protected supervisors on ON.
Add channel-scoped, bounded read-only database operations for Claude and Codex, without granting
ordinary agent containers VPN privileges or exposing database credentials.
- Provision the host-side `rclone` dependency during fresh deployments and repair it during an
update even when the checkout is already current. User services install it in `~/.local/bin`,
downloads are checksum-verified, and Google Drive connection tests retry an earlier missing-tool
result without requiring a daemon restart.
- Control a prepared channel VPN through the agent, the web channel Network controls, and Slack
Settings → Network. Managers/admins can turn it on/off; status distinguishes connecting from
connected and reports safe certificate/authentication errors. Stopping also cleans up manual starts.
- Move quiet-thread reminders from conversation settings to a personal user preference. Each
reminder now follows and mentions the requester across channels and DMs; users can turn it on or
off in Slack App Home, while admins can manage individual or organization-default choices.
- Add an optional operator-managed OpenVPN/MySQL service per channel, with dedicated tunnel
privileges, database-only routing/firewall, protected channel-secret references, a persistent
user service and read-only verification. Ordinary chat containers retain their existing rights.
- Fix Codex capacity refusals delivered as plain-text `turn.failed` events. They are now classified
as transient provider failures, retried in place, and automatically handed to the other enabled
harness when capacity remains unavailable.
- Add an organization-admin-only `/sudo` posture for individual Slack threads. While enabled,
admin messages and their background work execute directly on the gateway host as the daemon OS
user; non-admin messages are rejected as sudo-thread traffic before work starts. `/sudo off`
restores the normal per-conversation container, with Claude/Codex session state carried across
the boundary when possible. The host runtime cannot be selected through channel metadata or the
run API, and every turn rechecks current admin authority.
- Render up to five public images referenced in an agent's Slack answer as native Block Kit image
previews, while preserving clickable Markdown fallbacks and completed text delivery when Slack
rejects a preview. Images referenced from the channel workspace are now uploaded into the thread
as native Slack files instead, so they get the same inline thumbnail, download control and full
preview as a human attachment.
- Highlight every conversation that shares its resolved working folder with another conversation
in red in the Admin UI, and warn in red while browsing a folder that is already assigned elsewhere.
- Remove gateway-downloaded audio after a successful local or Slack-fallback transcript, while
retaining failed inputs for retry and refusing symlinks or paths outside managed uploads. Teach
the built-in video-understanding workflow to remove only successfully processed uploaded source
videos after all required re-sampling, never project files or failed inputs.
- Correct Codex history repricing to honor OpenAI's effective date for GPT-5.6 Sol: retain the
original $5 / $0.50 cached / $30 rate before 2026-08-21 and apply $4 / $0.40 / $20 from that
date onward. Upgraded instances rerun the backup-first correction under a new pricing basis.
- Refresh Codex Standard API-equivalent pricing from official OpenAI documentation: add
GPT-6 Astra at $10 / $1 cached / $50 per million tokens and reduce GPT-5.6 Sol (plus its
`gpt-5.6` alias) to $4 / $0.40 / $20. Keep the fallback picker aligned with the current Codex
CLI catalog, leave CLI-only Spark explicitly unpriced until an official rate exists, and
automatically back up and reprice component/request history since 2026-07-13 once on upgrade.
- Fix Slack question-card posting by encoding channel membership checks as GET query parameters.
- Let agents ask clarification questions with Slack cards and paged forms: custom option buttons,
Yes/No, multiple selections, and written answers. Save drafts until submission, retain pending
questions across restarts, and continue the requester's thread after they submit.
- Keep sidebar update messages inside the rail, wrapping long details and showing a short commit
revision with the full hash on hover.
- Add System health to the admin UI with real CPU/RAM/load and storage metrics, historical
charts and peaks, storage warnings and capacity estimates, and refreshed hardware inventory.
- Fix MCP configuration selection when a plugin package supplies both engine manifests. Each
engine uses its own inline declarations or referenced files, avoiding wrong endpoints and
duplicate server errors.
- Reply in Slack when conflicting shared-folder skill or memory settings prevent a request
from starting, with admin repair instructions instead of silently logging the error.
- Put Remove and Add/update directly on Slack Settings → Secrets. Refresh the same page after
deletion, and return saved entry forms to their parent without duplicate lists or modal stack growth.
- Remove the `/files` slash command and typed file-browser entry. The reply folder button and
Browse channel files shortcut remain available; legacy typed requests explain the replacement.
- Explain in the All Shared Skills hint that its summary updates automatically when its source
groups are configured, matching the other combined skill summary.
- Include the current advisory network policy in every engine attempt, including resumed and
Clean turns, so a changed switch supersedes stale context and cached request results.
- Preserve existing channel guest grants when an unrelated Admin UI setting is saved, even if
the current member roster omits a saved guest. Explicit guest edits retain membership validation.
- Include received human approval in completed control-plane tool results while preserving the
operation outcome; clarify that approval cards can be outside the model transcript and that
the receipt records an explicit human decision, not an approval supplied by channel Auto mode.
- Keep subsequent turns working after an author deletes a personal skill, while retaining its
grant and revision history for restoration and refusing foreign personal skill access.
- Correct skill-creation approval descriptions to show personal versus shared ownership,
optional channel grants and automatic personal/channel-scope activation accurately.
- Keep text-only gateway commands on their control path after thread file sharing, while
preserving canonical current attachments and ordinary agent attachment recovery.
- Reject incomplete engine turns even when partial text exists; preserve failure diagnostics and
usage. Reserve restart recovery before Slack reconnects, show each recovering thread promptly,
and retry pending recoveries on reconnection without requiring another daemon restart.
- Fix one-time automation edits shifting by the browser/daemon timezone difference and potentially firing future tasks immediately.
- Manage plugin packages through existing skill sources, review, templates and channel grants.
Compile native Claude hooks as an inline event map so SessionStart hooks execute correctly;
keep executable hooks restricted to authorized live admin turns.
- Fix repeated native file creation and inline editing exhausting Slack’s modal stack. Successful
forms return to the existing browser/preview; Cancel and validation retain their prior behavior.
- Fix the first browser editor/upload opening from Slack: narrowly scoped SameSite=Lax session
cookies survive the cross-site GET redirect while preserving CSRF, authorization and cookie
confidentiality protections.
- Correct the bundled skill-authoring workflow: updates and change proposals accept only changed
files while retaining omitted files; complete packages are required for initial creation.
- Correct Composio guidance that assumed the agent identity always belonged to other people or
was shared across every channel. Preserve account selection and no-substitution rules, including
when personal and agent connections reach the same underlying service owner.
- Fix missing run identities in flat chats. Group-chat messages start separate sessions; quoting
user or bot messages resumes the original session, including after restart. Teams quotes support
both current entities and legacy Reply markup; personal chats remain continuous.
- Make skill assignment rows compact, reveal descriptions and metadata on click, and give Active
skills and Add skills matching fixed heights with preserved scroll position when managing skills.
- Make existing channel API/CLI credentials discoverable through a current names-only inventory
on non-Clean attempts, including resumed turns. Teach the operating guide to check credentials
alongside skills, CLI logins and selected-account MCPs before requesting another connection;
clarify runtime environment use without exposing values or silently changing accounts.
- Improve conversation and template skill selection with a shared Active skills / Add skills
editor, name and source filters, locked inherited groups, and preserved explicit selections.
- Clarify the Slack Skills categories and where each is configured. Org Skills explicitly
states that only admins can add or remove organization skills; combined lists are labelled
as automatic summaries.
- Save instruction-update approvals with no deadline. The exact rule remains actionable across
restarts and is applied once on approval; changed instructions, destinations or permissions
require a fresh request. Other live engine permission/plan approvals retain their timeout.
Next release version selected by the owner. Development continues on `beta`; full testing and
explicit approval of the exact candidate are required before promotion to `main`. Earlier
0.6.0 candidate tags and evidence below are retained as historical snapshots, not published releases.
- Give selected optional Codex MCPs the existing 120-second remote startup budget and raise
Claude's default initialize timeout to the same ceiling. Preserve explicit operator overrides,
tool-call deadlines, grant boundaries and quiet-run liveness behavior.
- Persist Codex's native thread ID as soon as the CLI announces it, so stopping a first turn
offers a valid resume control. Late announcements cannot restore a cleared session.
- Correct channel-control MCP descriptions and confirmations to reflect container confinement,
advisory networking and the separate optional operator-home mount. Preserve all permissions,
setting mutations and approval checks.
- Show only supported scopes for explicit agent and durable approvals. Reject unsupported
thread/forever decisions before consuming the request or persisting ineffective grants;
native tool permissions retain all three scopes.
- Retire completed warm Claude pacing sessions so native timers cannot duplicate daemon-owned
loop ticks; queued messages resume safely and ordinary turns retain warm reuse.
- Inject explicitly selected Claude MCP transport definitions into isolated runs without enabling
ambient settings. Fresh configuration reads and warm fingerprints apply additions, changes and
revocations to resumed threads; unavailable or credential-dependent definitions fail closed.
- Resolve optional Codex MCP launch definitions from effective configuration when native tool
status omits them, while rejecting credential-bearing transports and retaining fail-closed
selection when no safe definition is available.
- Keep existence/access-only requests within their requested scope: both engines receive
per-attempt guidance to use non-mutating metadata, avoid content reads and temporary write
probes, and leave unverified write access explicit.
- Report failed reads of explicitly configured skill source folders as sync failures while
retaining the last approved revision; a recovered source clears the error on successful sync.
- Explain deliberately omitted connectors, skills and memory from each attempt's resolved Clean
mode. Distinguish the host gateway runtime store from container-local engine files and mount
scaffolding using actual mount coverage, without disclosing unmounted host paths.
- Include recorded user/channel attribution and an exact time window in chat skill-usage
reports, with one usage total and honest inferred-read provenance.
- Show current and projected context costs alongside the soft-cap warning when granting
channel skills through chat or the admin UI/API, while keeping activation advisory.
- Deliver resolved home-access facts directly on every engine attempt, including resumed threads
that retain stale isolation claims. The guide and prompt share one note; injected environment
credentials are described as usable with masked listings and redacted output.
- Correct the operating guide's unconditional denial of host access in Full-access channels.
Generated guidance now reports the resolved operator-home grant and global switch, while
preserving the default container boundary, channel-wide read scope and admin-author tool bypass.
- Supply the running assistant with its current engine, configured model/effort and session
state on every attempt, so model-identity answers can use the same configured selection as
the footer. Recompute after retries, recovery and fallback; never infer a provider model
from an alias or an unexposed harness default.
## 0.6.0-rc.2 — 2026-09-08 (superseded draft)
Follow-up candidate for the installer findings from disposable Linux acceptance. Full live QA
remains deferred; stable promotion is not approved.
- Provision rootless images with a clean service-account environment and from the installed
application directory, so operator storage settings and an inaccessible invocation folder
cannot break a dedicated-account installation.
- Export the release image with pipeline failure propagation and verify gzip integrity before
generating its checksums and attestations.
- Recognize exact reviewed public vendor fixtures during release-artifact scanning, including
complete self-test/development keys and compiler-adjacent constants. Unknown values still fail,
and repository files and Git history receive no exceptions.
- Add disposable Linux installation, encrypted backup/restore, real updater rollback and actual
OS reboot checks; authenticated engine and chat acceptance remains a separate live gate.
## 0.6.0-rc.1 — 2026-09-08 (superseded draft)
Candidate source and build evidence for review. The GitHub Release remains a draft; the planned
full live QA campaign is pending. This is not approval for stable-release promotion.
- Add a manager/admin-only Access page to Slack channel settings for base mode (including Admin), Auto, Lean,
network, use/manage policy, and named guest/manager lists. Recheck live membership and current
roles on save; immediately acknowledge submissions while validation runs. Admin-author-only
engine bypass and existing ordinary-tab access remain unchanged.
- Channels: use Read-only, Worker, and Admin as the three base modes, with independent Auto and
Lean side toggles in channel, DM, and template editors. Slack Settings can now select Admin
for authorized admins. Admin gives other members Worker plus their selected options; Auto
approves tools for both roles, while Lean applies only to non-admins in an Admin channel.
Existing Full access records now get the promised Worker fallback.
- Repository cleanup: remove unused Gemini/Hermes instruction aliases and the superseded working
audit. Keep canonical agent instructions, project records and active release acceptance gates.
- Settings: replace the Testing with AI checkbox list with a compact searchable user selector,
removable selection chips, keyboard navigation and a bounded results list that fits narrow screens.
- Settings: add **Testing with AI**, an opt-in Slack user list for supplemental approval and
busy-thread browser links. Empty by default; both auto and always link modes respect the list,
including for admins. Native buttons and non-native approval surfaces keep their behavior.
- Users: show enabled personal skill counts in the table and widen the editor to 640px,
with taller skill lists and a stacked layout on smaller screens.
- Skills: restore Source and Category catalog filters alongside governance filters. Sources now
use clickable cards opening a searchable skill list with persistent Enabled, organization-wide
Discoverable and Mandatory switches, including disabled skills. Source configuration is grouped
in collapsible settings.
- Dependency compatibility: update mcp-remote to 0.8.3 in both daemon and image, Slack Bolt to
5.1.0 and Zod to 4.5.4. Keep Composio 0.14.0 for the supported Node 22.13 floor. Nightly
pinned engine probes now read the actual image manifest, preventing version drift.
- Public project policy: license v1.4 uses Cluj-Napoca venue; trademark registration is deferred;
direct requests use contact@makeitfuture.com and contracted support requires an active
Makeitfuture or approved-partner agreement. Existing published releases retain their terms.
- Scheduler restart recovery checks due work immediately and persists its cursor and cron-minute
claims. A restart spanning the due minute now catches up within a five-minute window without
replaying claimed work, backfilling before creation/re-enable/cron edits, or rerunning uncertain
engine effects. Queued tasks resume, saved results redeliver, short transport outages defer
unclaimed recurring work, and scheduled failure notifications show a sentence instead of JSON.
Reminder claims remain at-most-once across an ambiguous remote-post crash boundary.
- Keep mount rebuild waits visible and cancellable until active occupants finish, then continue
automatically; retain preparatory leases through rebuilds and avoid concurrent waiter deadlocks.
- Recover the narrow unsupported Codex list-turns resume response, prevent automatic continuation
after ambiguous Claude hard kills, and retain structured exit/signal/runtime diagnostics.
- Recognize natural-language loop Stop, cancel loops before Slack delivery waits, record per-turn
Stop outcomes, and release stream cleanup after a bounded grace while preserving partial text.
- Render numeric progress counts in replaceable titles and normalize secondary provider failures.
- Codex now receives usable personal skill instructions through a per-turn catalog alongside
native shared skills. Ephemeral files include references, remain outside shared project skills,
and are cleaned up after the run. Auth/session homes stay unchanged; missing selected personal
grants fail visibly. Personal catalog delivery does not register native slash commands.
- Codex reads child identities and token accounting inside the channel runtime, including resumed
turn baselines. Rootless HOME volumes no longer need to be readable by the daemon. Named child
rows and elapsed/token totals use the same reducer without new mounts or an image rebuild;
inspection failures are visible instead of silently reporting an empty child list.
- A thread whose first message died before its engine ever started no longer stays stuck on
that engine. The session row is minted, with its harness stamp, the moment a new thread is
resolved; a turn that then failed closed on a pre-spawn gate (a missing Claude login, a runtime
that could not come up) left the stamp behind, so every later message in that thread "continued
on" a harness that never produced a session — and failed the same way even after the channel had
moved to Codex (live, 2026-09-05, a fresh gateway with only a Codex sign-in). A row minted by the
failed turn itself is now dropped (deleted, not tombstoned — the next message is a true first turn
again, resolved from the channel default); an existing thread's session is never touched, and a
per-thread harness pin is a separate store and still wins.
- Admin UI: Automations rows use fixed timing and last-run columns so the titles line up down a
card.
- Admin UI: the Pending approvals rows wrap the command being approved (monospace, a few lines)
instead of running it underneath the Approve/Deny buttons; the Automations search box uses the
same styled search component as the Users page, with a clear button and Escape to clear.
- A model the provider refuses no longer answers as a different model in silence, and never
answers in JSON. Two halves of the same live failure (a channel whose model id did not exist):
the gateway did substitute its default and logged the substitution, but the ⚠️ note was only
prepended to the finished reply text — and a natively streamed Slack answer is written from the
live stream, so the thread never mentioned that a different model had answered. The note is now
announced to the delivery layer before the retry spawns, so it leads the streamed answer, on both
the channel's own harness and a cross-engine fallback whose own model is refused; it is still
carried on the reply text for surfaces that have no stream, and delivered exactly once either
way. On the Codex side the same misconfiguration dead-ended instead: that CLI reports some
provider refusals by handing back the whole HTTP response body as its error message, which the
classifier — reading status and error type from the event, not from the document inside it — saw
as an unclassifiable failure, so the turn failed after minutes with the raw JSON posted in the
thread. The runner now unwraps that body before classifying (same fallback, same visible note),
and any failure that still reaches the thread is rendered as a sentence — the provider's own
words, never a document — with a model rejection naming the model and the remedy (`/model`, or
the admin UI).
- Loop guidance: the schedule tool's minimum-interval refusal now points at the thread's native
loop pacing for short repeats, the loops reference says a sub-floor repeat is never a background
agent or an in-turn sleep, and a loop's stop reply must state the iterations run and the pending
tick dropped.
- Full-access channels have their shell back. The admin-run settings file is the one an admin
author's escalated turn actually loads, and it was derived by copying the shared file and
removing a single key — so it inherited read mode's "every Bash command asks for approval" rule
while the same turn spawned with the permission bypass and therefore had nowhere to send an
approval to. Claude Code still evaluated the rule: a bare `pwd` came back denied, a command with
a variable in it was refused outright, and the turn announced that the shell was not actually
granted and continued read-only. Because the Full-access preset turns on admin mode alone (it
never sets "allow shell"), that hit every channel using the preset as shipped. The admin variant
now grants the shell tools outright and carries no ask rule, and it is generated by the same
function as every other variant instead of being patched after the fact. Nothing widens: the file
is only ever handed to an admin author in an admin-mode channel, whose turn already bypasses
permission prompts. The shared file of the same channel is untouched, so a non-admin author there
still gets an approval card for every command.
- `create_schedule` now tells the model that `notify` and `delivery` are opt-in: a plain "remind
me" keeps the defaults (@channel ping, result threaded under the Running announcement). One
engine had been choosing `delivery:'channel'` + `notify:'none'` unprompted, so the scheduled
result landed top-level with no thread and no ping.
- A finished answer is never held back by Slack's temporary status line. The assistant-status
writes used to queue without bound on one serial chain, and because each write sleeps its own
retry-after while the workspace is rate-limited, the terminal clear ended up behind a backlog
thousands of calls deep — and finalize waited for it BEFORE posting the reply, so turns that had
finished were delivered tens of minutes later or not at all. The status queue now keeps one write
in flight and one pending slot holding the LATEST phase (a superseded phrase is dropped, never
sent late), and delivery waits at most a few seconds for the clear before going ahead; the clear
still runs afterwards.
- A Slack-ended answer stream no longer costs the rest of the reply. When Slack completes a
message's stream server-side (a window blown by rate limiting, or its undocumented age cap), the
first refused append used to abandon the answer: every later delta was dropped and the reply was
left ending mid-word, with no footer, under a red "Something went wrong". The answer now gets the
same republish the progress card already had — a fresh stream carrying the complete compiled
answer, the footer on the surviving message, and the stranded copy removed only once the
replacement is durable. A failed finalization still ends with exactly one complete, footered
answer.
- Every run that injects Composio now says WHICH identities it received, in the prompt itself: one
line naming `composio-user` and/or `composio-agent`, prepended beside the fresh-session memory
catalog and the caller's provenance note. With both present it restates the ask-first stop ("which
account?"); with only the shared one it says a request phrased for the requester cannot be served
there. The rule already lived in the managed instructions block, but the block is a shared file
and could not name a per-author fact — one harness answered a bare "check the calendar" from the
shared identity and posted someone else's week into the channel. A channel with no Composio gets
no line, and forging the line in replayed thread text is defanged like the other framing markers.
- Codex subagents get their own progress-card rows again. `codex exec --json` never puts a child's
identity on stdout — a turn that spawned two subagents sent one anonymous coordination item and
nothing else — so the card showed a single generic `wait_agent` row where Claude showed a row per
child. The Codex runner now reads each child's own session record for its name, opens a row while
the children work, and closes each row with the child's elapsed time and token spend.
- The "🛑 Stopped." card's resume command now names the harness the stopped thread was actually
running on, resolved per thread (per-thread override, then the engine that started the thread's
session, then the channel's engine, then the gateway default). A session belongs to one harness,
so a thread running the non-default one used to be handed a resume line the other CLI rejects.
`/resume` and the `/compact` passthrough check use the same shared resolver.
- Addressed the release audit: isolated runtime credentials and daemon metadata, tightened SDK/API
authorization and admin reauthentication, serialized memory saves, and separated interrupted
execution from result-delivery recovery. Google Chat intake is durable and bounded; non-Slack
automation no longer requires Slack connectivity.
- Composio SDK is now **Enterprise-only, Beta**. Google Chat and Microsoft Teams are **Beta**.
- Runtime hardening: editor leases live in daemon-owned state, container bind sources reject
symlinked path components, shell background jobs no longer inherit engine service credentials,
and service credentials are redacted from replies and job output. The Claude login relay and
the shared Codex sign-in mount are unchanged.
- License 1.3 clarifies no-key/free-key use of unchanged bundled EE enforcement and authorized
redistribution. Provider agreements and legal review remain separate release requirements.
- Patched transitive qs, corrected fresh-service provisioning, and expanded release history scans,
built-image inventory/model hashes and signed artifact evidence. Public instructions no longer
require private contributor accounts; unused generic skill/UI scaffolding was removed.
- Automations are searchable by conversation/person or automation content, resolve DM display
names, and describe common schedules in plain language. The enlarged editor now updates timing,
title, notifications, delivery, state, and prompt atomically, including a new direct-to-channel
task delivery alongside per-run and per-day threads.
- A progress card whose Slack stream Slack itself ends — an append delayed past its window by
rate limiting, or an age cap the local rollover clock did not beat — is republished into a fresh
stream instead of being abandoned. Slack renders an abandoned stream as a bare "Something went
wrong", so a turn that recovered from a failed tool call and answered correctly was left with a
red error banner sitting above its answer for the life of the thread. The replacement carries the
whole toolbox (warning rows included), is made durable before the stranded copy is deleted, and
the terminal seal recovers the same way. A failed tool row is still only a row label; `error`
remains reserved for a stage the agent itself declares failed.
## [0.5.0] — first public release (2026-09-06)
> **Versioning.** 0.5.0 is the first published version of ChannelGate; the repository became public
> on 2026-09-06. The internal iteration labels used below the first public entry (the container
> runtime work labelled "v0.8", and the June 2026 "v1.0.0 (foundation)" milestone) were names for
> private milestones, never publications — the public version series starts here. Everything under
> this heading is what 0.5.0 contains, accumulated since the foundation.
### Highlights
- Container-per-channel runtime (rootless Podman, Linux + systemd only) as the sole confinement
boundary, with a per-channel HOME volume, image-shipped toolchain and durable channel state.
- Claude Code and OpenAI Codex as interchangeable harnesses with per-thread choice, transient
failover, warm sessions and the operator's own login relayed into every run.
- Slack in full (threads, streaming progress, approvals as buttons and as links, native charts,
Lists, file explorer and editor, attachments to 500 MB), with Microsoft Teams and Google Chat
transports behind the same capability-declared platform layer.
- Skills platform: local catalog, channel and personal tiers, templates followed live, Git and
folder sources with review, publishing, a catalog MCP endpoint and peer-gateway sync.
- Uncapped channel memory with on-demand retrieval, schedules, background jobs, follow-ups,
video understanding, VS Code attach, and an admin UI for all of it.
- Licensing: free tier with limits, license keys issued by the platform at channelgate.dev,
Ed25519-signed entitlements with a 14-day offline grace, and privacy-bounded usage reports.
### Added
- **Approvals as links, so every chat surface can answer one.** Native buttons are Slack's
primitive: Teams and Google Chat have none the gateway drives, and automation cannot click
anything at all. Every approval card (permission, control-plane, durable background-shell) and
every busy-thread card is now ALSO minted as short-lived, single-use, HMAC-signed URLs — one per
action the recipient may actually take — and delivered **privately to the person who raised the
request**: a Slack ephemeral in the same thread, a DM on a surface with no ephemeral primitive,
never the shared thread (a link is a bearer credential). `GET /approve/<token>` renders a
confirmation page and changes nothing, because Slack, Teams and corporate proxies prefetch and
unfurl links; `POST` — the page's single Confirm button — resolves the request through the same
`applyApprovalDecision` / `applyBusyThreadChoice` the buttons and the admin API use, so scope
semantics, the durable compare-and-swap, the waiting MCP call and the card update in the thread
are identical to a click. The waiting agent reads `decided_by: "link"`. The signature covers id +
action + scope + expiry (a *Deny* link cannot be edited into an *Approve forever* one), the nonce
is spent by one atomic UPDATE (a link works exactly once), deciding a card retires its other
links, and the requester's own authority is re-checked on every POST — so an admin-tier sign-off
is handed a Deny link and no Approve link. Unknown/used/expired answer 404/410 with a page that
reveals nothing about any other request, bad tokens get per-IP backoff, and every response is
`no-store` + `noindex`. New setting Settings → Connection → **Approval links**: `auto` (default —
where there are no native buttons, plus Slack once a public URL is set), `always`, `off`. Every
link decision logs `approval_resolved_by_link` (ids, decision, scope — never a value). Slack's
buttons are unchanged.
- **Approvals can be resolved from the admin UI and over HTTP, not only by a chat click.** A
pending approval used to be answerable only by clicking its card in a real Slack client, which
blocked every automated and QA path that has to get past a permission prompt, a control-plane
sign-off or a durable background-shell request. `GET /api/approvals` now lists what is waiting
(conversation, requester, tool, a clipped command/plan preview, age, expiry — no values),
`POST /api/approvals/:id` takes `{ decision: "approve" | "deny", scope?: "once" | "thread" |
"forever" }`, and `POST /api/approvals/thread-choice/:id` takes `{ choice: "steer" | "queue" |
"cancel" }` for a busy-thread card. The decision half of the button handler was factored into one
shared applier both callers use, so scope semantics, the durable compare-and-swap, the waiting MCP
call, the requester binding and the in-thread card update are identical either way. Unknown or
expired is 404, already decided is 409, and every resolution logs
`approval_resolved_by_admin` with the principal and decision (never the command). Overview shows
the same queue with Approve/Deny buttons. Admin session only — the run-API key cannot reach it.
- **Full-access channels can see the whole gateway home.** A new gateway-wide switch in Settings →
Container runtime (`containerFullAccessHome`, off by default). While it is on, every channel in
Full access gets the gateway user's whole home directory bind-mounted read-write at its identical
path inside its container — every channel's work folder and memory, every repository under that
home, the gateway root with its logs, metadata and credential stores — with only the container
engine's own storage masked out (a write into a running container's layers would corrupt it;
the mask is a `notmpcopyup` tmpfs — podman's default would copy the whole store into it).
That is an overseer channel: one agent that can see every other agent and every repo, without
leaving the container. Until 2026-09-02 admin channels ran on the host, "honestly unconfined";
containers-only (2026-09-03) confined them to their own work folder; this restores "admin sees
everything" as an explicit operator choice. It is a boolean, never a path; it is part of the
container's create-time fingerprint (recreate at the next turn, HOME volume intact); no MCP tool
can flip it; and it is per channel — every admitted author can read the home through the file
tools, only an admin author's turn writes with the bypass tools. Claude's admin-run settings
variant lists the home in `permissions.additionalDirectories`, derived from the resolved mount so
the file can never name a path the container does not have; Codex admin turns already bypass
their sandbox. Other Linux users' homes stay unreadable (no `sudo` in the image) and system
directories are the image's own.
- **Deterministic personal/shared Composio discovery.** Both bundled skills now define
`composio-user` as the active requester's identity and `composio-agent` as the shared agent
identity, select them by pronoun or connection alias, ask when an app is connected to both,
recognize underscore-normalized MCP tool prefixes, and verify connection status before reporting
an app unavailable—without silent fallback or initiating a connection during inventory.
- **Source-specific Skills Git credentials.** GitHub catalog sources now use their own optional
write-only token, while publishing has a separate write-only token and follows `main`. The Add
source dialog offers only GitHub or Other ChannelGate, reveals type-specific fields, and takes a
`/tree/main/<path>` URL instead of separate branch/subfolder controls.
- **Usage-led skill governance.** Skills now opens on the top 20 skills used in the last 30 days,
Templates is second, usage displays one harness-neutral total, and Catalog defaults to usage
order with category/source filters plus source-aware description search. Per-skill Enabled,
Discoverable, and Mandatory controls govern source imports; mandatory skills load everywhere.
Templates contain explicit skills only, agents can search by source and admins can change the
governance flags through `set_skill_governance`, and Overview charts the top ten skills.
- **Skill repository sections.** The skills repository is one shared library plus one folder per
channel (`channels/<channel id>/`); a skill in a channel's section is granted to that channel
automatically. New skills go to the library by default; `create_skill` takes `scope: "channel"`
for customer-specific ones (the agent asks first), and `set_skill_scope`, the Skills view's
*Section* control or the admin API move a skill either way — files move in the repository, and a
promoted skill stays with its former channel as an explicit grant. `.` as the publish folder
means the repository root.
- **The bundled ChannelGate skill now matches the product.** Its small entrypoint routes to focused
references for containers/security, write-only secrets and durable CLI/device logins,
Claude/Codex credentials, MCP identities and the local skill platform, catalog-first channel
memory, conversation operations, and manual folder/headless configuration. Package validation
guards frontmatter and progressive-disclosure links. Memory search/read registration also keeps
the gateway text-response adapter in scope, fixing the live `text is not defined` failure.
- **Video understanding is part of the main gateway skill.** `gateway-usage` now ships the complete
synchronized visual/audio workflow, sampling and dependency guidance, and local analyzer script
to every conversation. The former standalone catalog skill is excluded and removed from durable
grants at boot, while stale gateway-managed copies are pruned on the channel's next turn.
- **Live Slack progress no longer splits the answer.** Native task/tool/thinking rows stream in a
dedicated first message, while the Markdown answer streams contiguously in a separate message
beneath it. Both streams retain their independent long-run rollover and terminal/fallback
handling; text-only turns still remain a single answer message.
- **Uncapped channel memory with on-demand local recall.** Markdown remains canonical, fresh
sessions receive only a compact catalog, and new channel-scoped search/read tools use a derived
SQLite FTS5 index. The former 8,000-character write ceiling and prompt-body injection are gone.
- **Conversation Settings now follows the operator workflow.** Access emphasizes the three normal
modes and separates Full access/Lean; Tools has Connections, MCP servers, Environment tokens,
and Skills categories; inherited guest access is visible; enabled skills sort first.
- **The Skills admin workflow is organized around the operator's task.** Sources use an Add source
modal; synchronization/publishing and MCP access have separate tabs; templates have a searchable
selection editor; and Usage has searchable By skill / By channel views, compact bars, detection
provenance, and plain-language context-warning explanations.
- **Organization-wide local video analysis.** The shared conversation-container image now includes
`ffmpeg`/`ffprobe`, pinned OpenCV and faster-whisper, plus a pre-cached Whisper `small` model, so
the built-in `gateway-usage` video workflow works without per-channel installs or first-use downloads (image
spec 1.2.0).
- **`slack_download_file` — an agent can fetch a file shared earlier in this channel.** The pre-run
downloader only ever delivered the files on the triggering message, so a recording posted on a
thread's first message was unreachable from a later "try again" reply and the bot could only ask
for a re-upload. The new gateway tool fetches a file by id (from `slack_channel_history` /
`slack_thread_replies` metadata or a pasted Slack link) with the bot token into the current
thread's `uploads/` folder and returns the local path — fail-closed to files Slack reports as
shared in THIS channel, the same 500 MB cap and streaming writer, a file already in the folder
reused. Alongside it, a thread ROOT's attachment is carried into a later reply automatically and
downloaded while its bytes are still missing from the folder (never re-attempted when its
declared size is over the cap — that refusal was already reported at the root).
- **Inbound attachments up to 500 MB, streamed to disk.** A Slack, Google Chat, Teams or Run API
(`fileUrl`) attachment may now be up to 500 MB (was 30 MB, or 25 MB for the Run API); the one
shared cap lives in `src/util/bounded-bytes.js`. The bytes no longer pass through the daemon's
memory: every sink streams the body straight into the channel's `uploads/` folder through an
exclusive no-follow temp file with the running total checked per chunk, and renames it into
place only when complete. A refusal names the actual size against the limit (`263.4 MB exceeds
the 500 MB attachment limit`) instead of `too large`; a large Slack download announces itself
in the assistant status before the run starts.
- **The installer builds the channel image.** `npm run setup` now runs `npm run build:image` after
the dependencies and the Whisper step, so a fresh gateway has the whole shared toolchain
(engine CLIs, `ffmpeg`, OpenCV, `faster-whisper` + model) before its first message instead of
failing the first run closed. `--skip-image` / `CG_BUILD_IMAGE=no` defers it; a failed build is
reported with the manual remedy and never aborts the install.
- **Skill templates are followed live, and edited in Settings.** A conversation is assigned a
template (Conversations → Tools → *Skill template*, the Skills view, `set_channel_skill_template`,
or a DM template) and gets the template's current skills plus whatever is added to the
conversation itself; editing the template under Settings → Access Templates → *Skill templates*
(a catalog checklist plus categories) reaches every conversation that follows it. Replaces the
one-time copy of the day before.
- **Skills platform, round two: Skills Manager migrated in, Git publishing, an MCP endpoint of its
own, peer gateways.** Skills authored or approved in chat are pushed to a configured GitHub
repository (one commit per file) and adopted by the matching source; a GitHub push webhook
triggers a debounced sync; `POST /mcp/skills` serves the catalog to laptop Claude Code, Codex and
any MCP client with scoped, revocable access tokens (the `library_*` tool names kept); a source
of kind `gateway` lets a second gateway follow another's library; personal (author-only) skills,
self-service personal grants (`add_my_skills`), feedback proposals, `delete_skill`, organization-
tier and source administration from chat, compatibility notes, and
`scripts/migrate-skills-manager.mjs`, which moves a deployment's Skills Manager repositories,
favorites, team favorites, exclusions and personal skills into the catalog.
- **Skills platform (Core): the gateway owns its skill library.** A local catalog in the gateway
database stores every skill a conversation can be granted as immutable, content-hashed revisions
of the exact bytes of every file (`SKILL.md` included), with explicit ownership per slug
(bundled / host folder / git source / local), tombstones instead of deletes, pins for rollback,
and a review queue. Conversations get token-free skill profiles: the existing organization →
conversation → user grants resolve against the catalog with `requires:` dependencies, a context
cost estimate, and real files materialized write-on-change (Claude via its plugin, Codex via
`.agents/skills`) — the Skills Manager stub and its mid-turn fetch are no longer needed for
catalog skills. **GitHub sources** (Skills Manager's tarball sync ported and hardened: branch
names with `/` resolve correctly, review vs auto mode, commit pins, last-good state on failure)
and host folders feed the catalog; **templates** (Development / Sales / Marketing / Management,
editable) apply a snapshot of skills to a conversation; **chat verbs** cover listing, granting,
templates, `create_skill`, `update_skill`, proposals with admin approval (an approved change to a
source-owned skill becomes a pinned local override), usage reports and source sync; **usage
telemetry** records exact (Claude `Skill` tool) and inferred (Codex `SKILL.md` read) signals and
lists never-used grants; the admin UI gains a **Skills** view (catalog, review, sources,
templates, usage). `src/gateway/skills/`, `src/mcp/tools/skills.js`, `src/web/routes/skills.js`,
`public/admin-skills.js`, migration 14, `docs/SKILLS.md`, `gateway-usage` → `references/skills.md`.
### Removed
- **The Skills Manager runtime integration.** Skills now come from the gateway's own catalog as
files, so the `makeitfuture-skills` MCP injection, the organization/channel/user Skills Manager
tokens (with their tools, routes, admin UI fields and secret readers), the favorites stubs and
the App Home favorites fetch are gone. Stub folders left in older channel folders are pruned on
the next message. Skills Manager itself remains a standalone product; Toolbox is unchanged.
### Changed
- **Skill exclusions stick.** A skill an admin removes from the catalog (the Skills view,
`set_skill_excluded`, a Skills Manager exclusion carried over by the migration) now stays out when
its source delivers it again; before, the next sync silently restored it. Only a skill its source
dropped still comes back on its own. Restore brings an excluded skill back on its newest revision.
- **Production license verification is live by default.** The gateway now ships the Ed25519 public
key published by the ChannelGate licensing platform and uses `https://channelgate.dev` as
its default platform URL. Fresh installs can verify platform-issued keys without an environment
override; `CHANNELGATE_LICENSE_PUBLIC_KEY` remains available for staging and coordinated rotation.
- **Small text files now offer both editing surfaces.** When a Public URL is configured, eligible
files up to 3,000 characters retain the native Slack *Edit* popup alongside *Edit in browser*;
larger eligible files remain browser-only. Slack does not expose a modal-size setting, so the
browser editor remains the larger workspace.
### Security
- **The approval-link and admin-login backoffs count the real client, not the tunnel in front of
it.** The daemon binds `127.0.0.1` and is reached from outside through cloudflared or a reverse
proxy on the same host, so every public caller arrives on a LOOPBACK socket — and both per-IP
backoffs keyed on that address, which made them one bucket for the entire internet. A handful of
bad approval tokens from anywhere put every legitimate approval link into 429 (verified live: a
429 raised through the public URL also refused a link opened from the machine itself), and the
same shape let one stranger's failed password guesses lock the admin out of the login form —
exactly the outcome the backoff exists to prevent. Both limiters now key on the FORWARDED client
through one shared helper: `CF-Connecting-IP` (which the tunnel overwrites, so it cannot be
prepended to), then the first hop of `X-Forwarded-For`, honoured **only when the socket itself is
loopback** — from a non-loopback socket those headers are whatever the client typed and are
ignored, unless the operator declares a trusted proxy elsewhere on the network with
`CG_TRUST_PROXY` — and only when the value parses as an address, so a header can neither pick a
bucket for someone else nor fill the limiter's map. Express's app-wide `trust proxy` was
deliberately not used: it would also re-point `req.secure` / `req.protocol` / `req.hostname` at
client-supplied headers, which the DNS-rebinding Host/Origin guard and the session cookie's
`Secure` flag read for themselves on purpose, and it knows nothing about `CF-Connecting-IP`. New
runbook section in `docs/OPERATIONS.md` → *Reverse proxies and tunnels*.
- **"My inbox" is never answered from the shared Composio identity.** A requester with no
personal Composio token asked, in their own words, for their own mailbox. The run had only the
shared agent identity (`composio-agent`) — which holds OTHER people's connected accounts — used it
without saying so, and reported a third person's email address and recent subject lines as the
requester's. Ambiguity was already a hard stop; substitution was not, because the rule against it
lived only in the `gateway-usage` skill body, which one harness never opened (the other refused
correctly). The always-injected managed block now carries it as a hard rule: a request phrased for
the person asking ("my inbox", "my calendar", their own name) is served ONLY by `composio-user`;
when `composio-user` is absent from the run or has no connection for that app, the answer is to
say so and stop — never a read of the shared identity, "not even to check" — and the mirror holds
too ("your X" never touches the requester's identity). The block stays inside its 4 KB budget.
- **Channel policy changes are audited, and a refused secret reveal leaves a trace.** Two gaps in
the audit trail, both confirmed live. (1) A channel's meta record IS its security posture, and
changing it wrote nothing: turning *Allow network* off, repointing the working folder and
switching a conversation to Full access through `PUT /api/channels/:channelId/meta` all persisted
with zero rows in `events` — only the per-channel environment secrets were audited — and the chat
twins (`set_channel_admin_mode`, `set_channel_network`, `set_channel_bash`, `set_channel_auto_mode`,
`set_channel_workdir`, `set_channel_drive_folder`, the MCP allowlist tools, the typed `/mode`
command and the `/model` runtime picker) wrote nothing either. Every one of them now emits a
single `channel_meta_changed` event naming the conversation, the principal (`admin-ui` for the
admin UI's one shared password, the chat author's own id for anything typed or clicked in Slack)
and the POLICY keys that actually moved, with their before/after values. The diff is one helper
(`src/config/channel-audit.js` → `policyDiff`) shared by every surface, over a curated allowlist —
so a token, a per-channel environment value or any other non-policy field can never reach an audit
row, an unchanged key writes nothing, and a save that touches no policy key (a nudge toggle, a
re-submitted form, a token rotation) writes no event at all. Skill grants made from chat now write
the same `skill_granted` / `skill_revoked` / `skill_template_assigned` rows the admin UI already
did. (2) `POST /api/secrets/reveal` answered 400 for any field off the reveal allowlist BEFORE it
logged anything, so someone holding a stolen session could sweep the endpoint for revealable field
names — probing `adminPassword`, `__proto__`, every config key they could think of — and leave the
audit completely empty; only a wrong password logged (`secret_reveal_denied`). A refusal now logs
`secret_reveal_rejected` with the requested scope/field/id NAMES (clipped, never a value) before
the 400. All three outcomes of that endpoint — granted, wrong password, refused field — now also
name the admin principal (`admin-ui`, the same spelling the skills audit has always written; the
UI's sessions carry no personal identity); they used to be written with an empty author, so an
audit row read as if nobody had asked for the secret. The revealed value is still never logged.
- **The admin UI shows the events trail.** `GET /api/audit/events` existed but nothing rendered it,
so every audit row above was invisible to an operator. **Activity** now carries an *Admin &
security events* table under the run history — time, event, conversation, who, and what changed
(for a policy change: `key: before → after`) — defaulting to the admin/security kinds with a
toggle for the full feed and 25-row pagination. An unrecognized kind still renders, with its raw
name opened up, so a newly added event is readable the day it ships.
- **A retired integration's token is no longer served in cleartext by the admin API.**
`GET /api/channels` masked the Composio, Toolbox and Make toolbox secrets by name and then spread
the rest of each channel's stored record into the response. `skillsToken` — the Skills Manager MCP
token, dead since the local skills catalog replaced that integration — was in neither set: no code
read it, so no masker named it, and every channel whose stored meta still carried one handed the
full value to anyone who could reach the admin API. **Operators should rotate any Skills Manager
token that was ever stored on this deployment**, in the issuing system; the gateway itself no
longer uses it, so nothing needs re-entering afterwards. Three changes, because masking alone was
what failed: every channel read (the channel list, the DM list and the save response) now goes
through the ONE masker instead of three drifted copies of it — which also closes the DM listing's
unmasked Make toolbox key; the dead field is stripped from every record on the way into the store
and on the legacy JSON import; and a schema migration deletes it from the channel and user records
that already hold one, so the value stops existing rather than merely stopping being displayed.
The users listing was never affected — it is built from an explicit allowlist, which is now the
documented reason it is written that way. Retiring an integration means adding its field to
`src/config/dead-fields.js` in the same change.
### Fixed
- **A busy-thread approval link names the conversation, in the page and in the audit row.** An
approval card is minted with its conversation slug, but a busy-thread card is built from a raw
chat event and carries only a channel id — so the *Conversation* row on its confirmation page
read `C0123456789`, a string the person deciding has never seen, and every
`approval_resolved_by_link` row for a steer/queue/cancel decision was written with an empty
`slug`, which is the field the other approval events are queryable by. The slug is now resolved
from the channels index (the same place the admin approvals list reads it) once per request, in
the shared resolution both verbs use, so the page and the audit row always agree.
- **A shell turn that reads two skills in one command now records both.** Codex has no Skill tool:
a skill is "used" when the run reads its `SKILL.md`, and the whole shell line arrives as one tool
event. The matcher stopped at the FIRST `…/skills/<slug>/SKILL.md` in that line, so the routine
shape `sed -n '1,240p' …/gateway-usage/SKILL.md && sed -n '1,320p' …/<granted>/SKILL.md` recorded
the always-on guide and silently dropped the granted skill the turn was about — two identical
runs of the same skill, one row. Every match in the text is now recorded (deduped per run), and
the path pattern accepts a read through either skills directory (`.claude/skills`, the
`.agents/skills` symlink Codex follows), absolute or relative, quoted, `~`-relative, or anywhere
inside a compound command, while still refusing look-alikes such as `myskills/…`.
- **The Usage panel explains how it counts.** The report has always carried the notes that make its
numbers readable — exact (Claude's Skill tool fired) versus inferred (a shell read of `SKILL.md`,
best effort), and that capture is not retroactive — and the admin UI dropped them on the floor, so
a total with no context looked like a measurement rather than a lower bound. They now render as a
help line under the Usage header. One total per skill is unchanged.
- **An over-the-cap warning reaches the person who caused it.** Granting a skill resolves the
conversation's whole always-on profile, warnings included ("always-on skill descriptions cost
about N tokens per turn (soft cap M)", a skill still awaiting review, a missing dependency) — and
both grant paths computed them and threw them away. Whoever pushed a conversation over the cap was
the one person who never heard about it; the warning surfaced only later, in the admin Usage
panel, to somebody else. `POST /api/skills/profile/:channel/grant` now answers with `warnings` and
`contextTokens` (resolved over the conversation's whole durable tier: organization + template +
its own grants) and the admin UI appends them to the grant confirmation; `add_channel_skills`
appends them to its chat reply and reports the same durable-tier cost it warns against.
- **The Container runtime card describes the runtime the gateway actually has.** Its copy still
offered containers as an alternative to "the daemon's host sandbox" and promised that "admin-mode
channels always stay on the host" — both untrue since the containers-only change: there is no host
sandbox, and an admin-mode channel runs in its own container with the permission bypass applied
inside it.
- **The template skill search filters again, and the Add-source dialog shows one kind of field.**
Both hide elements by setting the `hidden` property, and the admin stylesheet was quietly
overriding it: an author `display` declaration beats the user-agent sheet's
`[hidden] { display: none }` whatever its specificity, so `.skills-picker-row { display: flex }`
and `.field { display: block }` kept every row and every field on screen. Typing in Skills →
Templates' skill search filtered nothing at all, and choosing GitHub or Other ChannelGate in the
Add source dialog left both kinds' fields visible at once. Both classes now carry a `[hidden]`
companion rule.
- **A skill pinned to an older revision describes THAT revision.** The `skills` row's frontmatter
columns (name, description, category, tags, requires, version) are a derived index rebuilt from
the newest ACTIVATED revision, so a rollback — or the pinned override an approved proposal writes
— kept advertising the newest revision's name and description beside the pinned revision's files,
in the catalog table, the skill detail, the chat listings and the peer-sync manifest. Every
catalog read now overlays the pinned revision's own `SKILL.md` frontmatter, exactly as the file
list already followed the pin; an unpinned skill is returned untouched.
- **A template preview says what the conversation will actually pay in context.** The always-on
estimate counted only the template's own skills and their dependencies, while the organization
tier loads in EVERY conversation whatever the template says — with a few dozen mandatory skills
configured, the number an admin sizes a template against was short by most of the real cost.
`preview_skill_template`, `set_channel_skill_template` and `GET /api/skills/templates/:slug/preview`
now report labelled numbers instead of one: what this tier adds, what the organization tier costs,
and the effective union (dependencies included, a skill in both tiers counted once), measured
against the configured context soft cap.
- **Saving a channel environment secret no longer claims the conversation card has unsaved edits.**
The card marks itself dirty on any input or change inside it, and the Environment tokens pane is
inside that card — so typing a variable name or value, and storing it with its own request, left
an "Unsaved changes" bar hanging over a card with nothing to save. Controls that save through
their OWN request (a write-only value must never round-trip through the card's Save) are now
exempt in all three dirty-trackers: the conversation card, the DM/template card and the Settings
page. Nothing else about the bar changed.
- **A container whose workspace moved is rebuilt before the next turn, never reused.** A channel's
work folder was pointed at a subfolder, used for a few turns, then restored and the subfolder
deleted. The warm container had been created with that subfolder bind-mounted as its workspace;
the create-time fingerprint mismatched, but the rebuild was DEFERRED as "runs are active" and
three more turns were exec'd into the container anyway — each dying on `Append system prompt file
not found: …/CLAUDE.md`, because the directory it was bound to no longer existed. Two things were
wrong. Containers now carry a second label, `cg.mounts`, covering only the create-time inputs that
decide what the container can SEE (work dir, clean workspace, artifact dir, HOME volume, every
bind and mask): when that half of the fingerprint moves, the turn never runs against the old
mounts — it waits, bounded and announced in the thread, for the runs still inside to finish and
then rebuilds, or fails with a message naming the pending rebuild. A mismatch that is only about
behaviour (a rebuilt image, a limit, the network mode) is still deferred to the next idle moment
exactly as before. And the deferral no longer fires spuriously: the asking turn takes its own
container lease before the environment is brought up, and that lease was being counted as "a run
is active inside", so every turn looked busy to itself — a caller now passes its own lease handle
and the backend asks whether anyone ELSE is inside.
- **Saving Settings no longer reverts what someone else changed.** The Settings page's single Save
re-submitted the WHOLE form from the snapshot the page had loaded with, so any value written
after that load — by a second admin, by the skills sync, by a license write, by the first-boot
password upgrade — was silently reverted by an unrelated save minutes later (a restored
`channelTemplate.effort` lost to a save of `scheduleMaxPerChannel` is what surfaced it). Save now
sends only the fields that actually differ from what the page was painted from, and the server
merges them exactly as it always did — a field nobody touched is not in the request and cannot
revert anything. On top of that, `/api/settings` carries a `settingsVersion` that a save may echo
back: if anything wrote settings in between, the save is refused with 409 and NOTHING is written
(the check runs inside the same lock as the merge, so it cannot be raced), and the refusal
carries the current settings — the page repaints from them and names the keys that moved, so the
admin re-applies their change on top instead of over. A caller that sends no version (an older
UI, a script) is merged in exactly as before. A repaint also clears anything left pending — an
armed *clear* toggle, a typed password or service-account key — because a pending action captured
as "already saved" would silently never run.
- **A channel environment variable typed in lower case is the variable you meant.** The admin card
sent the name exactly as typed and the store rejected anything but `A–Z0–9_`, so `supabase_token`
was a validation error instead of `SUPABASE_TOKEN`. The name is now upper-cased visibly as it is
typed (and on blur, and before it is sent), and the store folds case itself, so the Slack modal
and any API client get the same canonical name — an update of an existing variable rather than a
refusal or a duplicate. Nothing else is forgiven: a dash, a space or a leading digit is still
refused (quoting what was typed), and the reserved-name check runs on the folded name, so `path`
cannot smuggle `PATH` past it.
- **A pre-SQLite upgrade no longer loses every channel's lockdown record and thread→session map.**
The one-time JSON→SQLite import listed the legacy channel slugs from `channels/`, then read each
one's `meta.json` / `sessions.json` through the path helpers — which moved with the per-platform
folder rename and now resolve to `channels/<platform>/<slug>/`. On an authentic legacy tree those
files are at `channels/<slug>/`, so the import found none of them: it logged `meta=0 sessions=0`
and completed successfully, and the upgraded install came up with every channel's capability
settings and every thread's engine session gone. Nothing failed; the data was simply not there.
It cannot be avoided by migrating the folders first, either — the boot migration reads its channel
records from the store, which opens the database and runs this import, before it moves anything.
The legacy paths are now spelled out, with the current layout accepted as a fallback for a
half-migrated tree; the import stays one-time and still leaves every source file byte-identical.
- **An expired licence stops granting its tier.** A licence whose `expiresAt` had passed was routed
into the "platform unreachable" grace lane, which keeps the last verified tier for 14 days from
the last successful check. For an OFFLINE (air-gapped) payload that check is stamped at read time,
so it always looked freshly verified and the 14-day window never closed: an expired enterprise
payload kept reporting tier `enterprise` with unlimited conversations indefinitely, and the run
gate admitted accordingly. Expiry is now resolved before the unreachable lane, as its own `expired`
state: the no-key limits apply from the moment the licence runs out, no tier is reported, and the
admin card says on which date it expired. An expiry date is not a network condition — unlike a
platform outage it is known in advance — so it gets neither the 14-day window nor the month-boundary
courtesy, exactly like `invalid`/`revoked`. The genuine case those courtesies exist for is
unchanged: a still-in-date licence that could not be re-checked keeps its tier for 14 days and then
until the next UTC month boundary. A licence with no end date, or an unreadable one, never expires.
- **A daily-thread schedule starts a fresh session on every fire again.** A scheduled run's session
key was built from the message its result is threaded under, which is a different message per
fire only for `standard` delivery. `delivery:"daily-thread"` reuses one anchor for the whole
server-local day, so the day's second and later fires landed on the same key and RESUMED the
previous fire's engine session — carrying context between runs the schedule contract explicitly
promises are independent. The session key is now derived per fire and never from the delivery
thread; the anchor still groups the day's results exactly as before. Known limitation, unchanged
and now documented in the code: the scheduler starts only after restart recovery finishes and its
first tick lands a minute later, so a cron matching a minute that passed during boot is skipped
until its next match — firing that minute would need a durable per-minute fire record, because
the in-memory one cannot tell it apart from a minute that already fired before the restart.
- **A Claude run's skill uses now land on the skill they name.** Claude names a plugin-provided
skill as `<plugin>:<slug>` in its `Skill` tool call, and the usage recorder looked that whole
string up in the catalog — it matched nothing, so every exact signal Claude produced was stored
as an off-catalog name with no skill or revision id, and the usage report marked the skill it had
just fired as not in the catalog. The recorder now strips a leading `<plugin>:` prefix before the
lookup, so a plugin-qualified use attributes to the catalog skill (and its effective revision)
exactly like a bare one; a plugin skill the catalog does not know is still recorded, under its
bare slug so repeats aggregate together.
- **The audit feed's attachment count is what the turn actually received.** `run_start` logged the
number of files on the Slack event, not the filtered set that reaches the engine, so a reply whose
only attachment was carried in from the thread root and is already on disk logged `files: 1` while
nothing was downloaded. It now logs the filtered count and, when the event carried root files at
all, a `carried` count beside it, so the difference is visible instead of misreported.
- **The guide no longer promises a bare `stop` works in a channel.** `/help`, the `/stop` reply, the
README/INSTALL notes and the guide's loop and table references all said to "type `stop` in that
thread"; in a channel the mention gate drops an un-mentioned message before the stop word is ever
read, so only `@bot stop` (or a 🛑 reaction) stops a channel thread — a bare `stop` works in a DM.
Every one of those sentences now says which is which. The gate itself is unchanged.
- **A bounded repeat-check is a schedule, not an in-turn poll loop.** The managed block's
"only the gateway can report back" rule named the durable tools but left "check every 10 minutes,
6 times" ambiguous, so a run could read an in-turn sleep loop as compliant while the turn is held
open. The rule now says a finite repeat-check is `create_schedule` (or `run_agent_in_background`
for a self-contained watcher) and never an in-turn sleep/poll loop, a `Monitor`-style wait, or a
harness background task — even when the loop would finish inside the turn.
- **The rules a run must never get wrong are now in the context every run receives.** Guidance that
lived only in the `gateway-usage` skill reached one engine and not the other: the skill body is
read when the model chooses to open it, and across a retest wave of failing transcripts the string
`gateway-usage` appeared only in the skills catalog listing while none of the rule text appeared at
all — the other engine, reading the identical text through the `AGENTS.md` symlink, followed it and
passed. The cost was not stylistic: a personal calendar read into a shared channel without asking
whose it was, an "inventory" call that quietly raised a fresh authorization request, remote
execution run against the requester's own identity unasked, and follow-ups promised on background
processes that die with the turn and never report. The gateway-managed block at the top of every
conversation's instruction file — appended to the system prompt of every run, in every mode, clean
mode included — now carries a compact **Hard rules** section beside this conversation's switches:
the two Composio identities and the stop that makes an unnamed request a question rather than a
tool call, that `COMPOSIO_MANAGE_CONNECTIONS` initiates connections for any action (`list`
included) rather than listing them, and that only the gateway's `run_in_background`,
`run_agent_in_background` and `create_schedule` can report back after a turn ends. It is
engine-neutral, applies wherever the named tools exist, and the gateway-owned part of the block
stays under 4 KB so the always-on prompt weight is read rather than skimmed; the full reasoning,
tool shapes and examples stay in the skill.
- **A Codex thread keeps its Composio tools on every turn, not just the first.** The second message
in a Codex thread came back without `composio-user` or `composio-agent` at all — the registry
showed only the `gateway` family, so Workbench and every connected app vanished mid-conversation
while the cold turn had them. Neither the argv nor the CLI was at fault: `codex exec resume`
carries and honours the same `-c mcp_servers.*` overrides a fresh `codex exec` does. Codex simply
does not BLOCK a turn on MCP startup — it takes whichever servers have finished by the time it
builds the first request, and `startup_timeout_sec` only caps the handshake instead of extending
that wait. A fresh run assembles instructions, skills and workspace state first and leaves
roughly two to five seconds of room; a resumed run reaches the request in about two. The two
Composio servers were bridged to stdio through `mcp-remote`, which needed ~2.4s to answer
`tools/list` (two Node bootstraps, an OAuth-discovery round trip that a static-header server
never needs, then a duplicated initialize) — inside the cold window, outside every warm one,
while the local gateway server always made both. Header-bearing remote MCP servers (both Composio
identities and both toolboxes) are now dialled by Codex itself over its native streamable-HTTP
transport, which answers in about 1.2s, and their credential is produced by a per-run
`http_headers_helper` script that reads the run's existing 0600 secret bundle — so the token is
still absent from Codex's argv and environment, and never reaches the shell snapshots Codex
writes into the channel's home volume.
- **Read-only conversations no longer run shell commands without asking.** A read-mode channel said
"no shell" only by leaving `Bash` out of the lockdown file's `permissions.allow`, and that is not
what Claude Code enforces: for a simple command whose argv head is on the CLI's own built-in
read-only list (`id`, `cat`, `head`, `tail`, `wc`, `stat`, `strings`, `readlink`, `uname`, `df`,
`diff`, …) it answers "allowed" before it ever consults `--permission-prompt-tool`. So a cold
read-mode turn executed `id -un` inside the conversation's container in a tenth of a second — no
approval card, no approval record — and could read any file that container user can read,
sidestepping the folder scoping the Read tool applies. Every conversation that does not grant the
shell (read, lean, and the shared file an admin conversation's non-admin authors run under) now
names `Bash` in `permissions.ask`, which is evaluated ahead of that layer: every command, simple
or compound, routes to the approval card, which is what Read mode always promised. Conversations
that DO grant the shell are untouched (an `ask` rule outranks `allow`, so listing it there would
card every command they exist to run), the narrow `MEMORY.md` write grant is untouched, and an
admin author's escalated turn still bypasses prompts through its own settings variant.
- **Codex subagent work is visible on the task card again.** The mapping built child rows only from
a collab tool call's `agents_states`, and Codex's multi-agent v2 mode reports children somewhere
else entirely: the spawn arrives as a `collaboration` function call, the child's start and finish
as `SubAgentActivity` items, and the only collab tool call it emits — the wait — carries no
receivers and no states at all. A turn where two children really ran therefore showed nothing.
Every shape is now read: `agents_states`, `receiver_agents` and `receiver_thread_ids`; the
`SubAgentActivity` lifecycle, keyed on the child's THREAD id so its start (the spawning call id)
and its finish (a synthetic completion id) merge into one row; and the spawn call itself, whose
requested task name titles the row while its encrypted message never can. Item types match in
both spellings the CLI uses (`collab_tool_call` in the exec stream, `CollabAgentToolCall` in the
session stream), and a collab call that names no child now renders the coordination step itself
instead of nothing. Note the remaining CLI limit: under multi-agent v2 (CLI 0.152/0.153)
`codex exec --json` forwards no per-child lifecycle at all, so such a turn shows its wait step;
per-child rows appear wherever the CLI reports child identity.
- **Codex answers no longer run their segments together.** Codex reports each assistant message as
its own completed item — a stage narration, then the answer — and the native Slack stream shows
exactly what the runner streamed, so the last word of one segment was glued to the first word of
the next ("…isolates conversations.ChannelGate isolates each…"). A new message item now opens a
new paragraph; deltas inside one streamed item are still concatenated untouched (the break marks
a boundary, it does not reformat prose), and the authoritative final message read from Codex's
`-o` file is unchanged.
- **A skill's dependencies are no longer stored as grants of their own.** Granting a skill through
the chat verbs, the admin API or a newly authored skill wrote the RESOLVED `requires:` closure
into the tier's stored grant list, so the dependency reported as a direct channel (or personal,
or organization) grant instead of *required by* its parent, showed up checked in the
conversation's skill list, and stayed behind as an orphan grant when the parent was revoked. A
grant list now holds only what was explicitly granted; dependencies keep being resolved at every
materialization and in every effective profile, so nothing that used to load stops loading, the
skills and usage views attribute them to the skill that requires them, and revoking a parent
takes its dependencies with it. Granting a dependency by name is still an ordinary grant that
outlives its parent. The grant surfaces now report the dependencies a grant pulls in, and a
revoke of something that is only a dependency says which skill keeps it active instead of
claiming a removal that changed nothing.
- **The Allow-network switch is now a two-state fact everywhere, and honest about being advisory.**
The mode label appended a network suffix only when the switch was ON, so "off" and "nobody ever
configured it" rendered identically — in `/mode`, in the channel list, everywhere. `/status`
carried no network state at all, and the engines were told nothing either way: asked whether it
was allowed on the network, a run could truthfully answer that neither its system context nor its
channel instructions nor its session config mentioned it. The label now states the switch in both
directions (`Bash · network off` / `Bash · network on`), `/mode` and `/status` add the caveat
(`network off (advisory — not enforced by the container yet)`), and the gateway-managed block at
the top of every conversation's instruction file — the file both harnesses read — states the mode
and the network switch to the engine itself. The honesty matters: under the container runtime the
switch is advisory (every container is on the bridge network and no egress is policed per
channel), so a run told "you have no network" would call the switch broken the first time a
request succeeded. The stale header in `src/engines/network-policy.js` claiming "off" ran the
container with no network at all is gone, and every `run_config` event now records
`networkEnforced: false` beside `networkPolicy` so an operator reading it after an incident
cannot mistake `"off"` for "this turn could not reach the internet".
- **The agent no longer promises follow-ups nothing will deliver.** Claude Code's own
`Bash(run_in_background: true)` is reachable inside a gateway turn and was being used to say
"I'll report back when it finishes"; Codex faked a watch loop with sequential sleeps. Both die
with the headless turn, so the report never came. The bundled `gateway-usage` guide now names the
harness's own backgrounding (`run_in_background: true`, `nohup`, `at`, `screen`/`tmux`) and
in-turn sleep loops as dead ends, states that only `run_in_background`, `run_agent_in_background`
and `create_schedule`/loops survive the turn, and requires the agent to say plainly that it
cannot follow up when the channel's mode allows none of them.
- **The skills docs no longer promise an auto-mode bypass that does not exist.** `docs/SKILLS.md`
and the guide's skills reference said the skill chat verbs show an approval card "unless the
conversation is in auto mode". Auto-approval covers tool permission prompts only: control-plane
changes (`add_channel_skills`, `set_channel_skill_template`, …) always post a card and block for
a click, which is the product contract. Both now say so, and the reads
(`list_skill_templates`, `preview_skill_template`, `show_channel_skills`) are correctly
described as open.
- **Stopping a turn now stops everything the turn started.** A container run was signalled by
process GROUP, and Claude Code's Bash tool puts its shell in a session and a process group of its
own — so `kill -- -<leader>` reported success, the tool's shell survived, and a loop it was
running went on to completion minutes after the turn was reported stopped. `cg-signal` now walks
`/proc` once before it signals anything and takes down every process in the run's session plus
the leader's whole descendant tree (deduped by process group, then by pid), keeping its "0 when
something was delivered" status; `cg-sweep` signals through the same helper so a boot sweep and a
stop can never drift apart. Nothing outside the run can be in either set: the leader is its own
session leader and a detached background job is a separate leader with its own session. Image
spec 1.2.1 — `npm run build:image` (an update rebuilds it).
- **Connection inventory no longer starts connections, and an ambiguous account is no longer
guessed.** Both bundled skills told the agent to confirm a toolkit through
`COMPOSIO_MANAGE_CONNECTIONS` with `action: "list"`. That call is not side-effect-free: on a
toolkit with no connection on the selected identity it CREATES a pending authorization request
and answers "All connections have been initiated and are pending completion"
(`status: "initiated"`), so a plain "what is connected?" question left pending auth requests
behind on both identities. The side-effect-free existence check is now the identity's own
`COMPOSIO_SEARCH_TOOLS` — `toolkit_connection_statuses[].has_active_connection` plus the entry's
`accounts[]` aliases — and `COMPOSIO_MANAGE_CONNECTIONS` is reserved for a toolkit already known
to be connected there or for a connection the user asked for. In the same pass, the ambiguous
identity rule became a MUST with its reason stated: when neither a pronoun nor a single
connection settles the account, the first response is the question and never a tool call, because
reading a calendar, inbox, chat or CRM on a guess exposes the requester's or a third party's
private data to the whole conversation — a bare "check the calendar" had gone straight to a
personal calendar read.
- **A stopped run stops answering.** "🛑 Stopped." is now the last thing the thread receives.
The live answer message is created lazily by the first append that Slack accepts, so answer text
still queued behind the rate limiter was created and posted by the stop path's own drain — the
full reply landed underneath the stop card, unmarked, on both engines. Queued text is now dropped
once a run is stopped, and the stop flag is re-read immediately before every delivery call (the
streamed finalize and the chunked fallback) instead of being sampled once several awaits earlier.
Text that had already reached Slack stays, closed with a `🛑 _Stopped — partial answer._` marker so a
cut-off stream is never mistaken for a finished answer.
- **Codex Read mode works inside a container again.** Codex's default sandbox mechanism is
bubblewrap, which cannot start under the container's `--cap-drop ALL` + no-new-privileges
(`bwrap: Unexpected capabilities but not setuid`) and failed EVERY command — so a Read-mode
channel could not even read. Runs that state a sandbox mode now also state
`features.use_legacy_landlock=true`, the mechanism that does work under those caps: reads
succeed, writes get "Permission denied". The admin bypass, which has no sandbox, is unchanged.
The flag is deprecated-but-functional in the pinned CLI (`containers/versions.json`) and is
re-checked on every Codex bump.
- **`/context` and reply footers report the real window for 1M models.** The `[1m]` suffix names a
configured variant the CLI does not echo back (an `opus[1m]` run reports plain `claude-opus-5`),
and the window was read off the runtime id alone — so a 1M run was measured against 200,000, five
times too small, inflating every context percentage by the same factor. The suffix is now read
from the configured model as well as the runtime one, and ahead of any runtime-reported window.
- **`/resume <command or id>` can adopt a session again.** Under the container runtime a thread's
engine transcripts live in the channel's own HOME volume, but the lookup behind `/resume` only
ever searched the daemon's own state dirs — so pasting back the very command `/resume` had just
printed was answered with "I can't find … on the gateway machine", and no channel had ever
adopted a session. The lookup is now runtime-aware: it walks the stores this channel can actually
reach, cheapest first — the daemon's engine dirs (a legacy, pre-container session), the HOME
volume read straight off the host where that is traversable, and otherwise the container itself
through a new read-only runtime method, `inspectState` (one `sh -c` that globs the engine's
layout and returns each match's mtime and capped opening lines; nothing is copied out, and the
volume is never mounted). Rootless Podman is why the last step exists: it owns the volume's own
directory as the mapped sub-uid with mode 0700, so the daemon cannot traverse into it even though
the transcripts inside belong to its uid. The same-channel rule is unchanged and still decides on
the cwd the transcript itself recorded. A refusal now also names the harness the PASTED command
named rather than the thread's (a `claude --resume` line pasted into a Codex thread was reported
as a missing "Codex session") and says where the gateway looked.
- **Schedules are stated in a named time zone, and containers run on the gateway's clock.** The
daemon matches cron schedules against its own local time while a channel container was built on
`Etc/UTC`, and nothing carried the daemon's zone across that boundary — so an agent asked what
`15 9 * * 1-5` means read its own clock and answered "9:15 UTC" for a schedule that fires 09:15
local. The container runtime now exports the daemon's IANA zone as `TZ` into every container and
every exec (`process.env.TZ` first, otherwise the platform's resolved zone), so `date` and both
engines see the same wall clock as the scheduler. `create_schedule` and `list_schedules` also
NAME the zone rather than trusting any clock: a one-time schedule reports
"2026-09-08 09:15 Europe/Bucharest (06:15 UTC)", a recurring one adds the resolved next fire
time, and the bundled reminder guidance tells the agent to quote that zone back instead of
converting it.
- **A reminder no longer stutters its own label.** A reminder whose text already began
"Reminder: …" rendered as "⏰ *Reminder:* Reminder: review the QA results". One leading label is
now stripped before the renderer adds its own — in the posted message, the unacknowledged 2nd
notice and the creator's DM alike; a deliberate double, or a sentence that merely mentions the
word, is left alone.
- **API runs report what a Codex run cost instead of "free".** `GET /api/runs/:id`, the
`api_run_done` event and the completion webhook published `costUSD: null` whenever the engine
reported no dollar amount — which Codex never does — while the usage ledger was independently
storing a priced estimate for the very same run. The run now publishes the figure the ledger
settled on (the canonical component rollup where a run reported one, so the API and the Audit
view cannot quote two different costs), marked with a new `costEstimated` flag, and keeps `null`
only when nothing anywhere knows. A stopped-mid-flight run is billed the same way.
- **A sentence before the first tool call no longer costs the turn its toolbox.** The live progress
card is its own message posted above the answer, so once answer text starts a card that does not
exist yet can only be created underneath it. The guard that protected that ordering latched the
whole card OFF for the rest of the turn, and a model that wrote one preamble line before its
first tool call therefore lost every tool, subagent and failed-tool row — the same run with
tools first showed the full toolbox. Only the content-free liveness pulse is suppressed now: a
tool, subagent, notice or progress-report row still opens (or keeps) the card at any point in the
turn, while a text-only answer still stays a single message.
- **A progress stage no longer repeats its output two or three times.** Slack replaces a task row's
title and status on every chunk but APPENDS its rich `details`/`output`, so a stage that carried
its output when it was published, again when it flipped to complete, and once more in the
snapshot that seals the card rendered the same paragraph three times over. Each row now remembers
what it has already delivered to the current message and sends a rich field only when it actually
changed — just the added tail when the value grew (an interrupted step's note), nothing at all
when it is unchanged. A stream rollover reseeds its successor in full, since that message has
rendered nothing yet.
- **A rate-limited stream finalization leaves one reply, not four.** When Slack rejected
`chat.stopStream`, the classic recovery posted the complete answer as a new message while the
partial streamed one stayed in the thread (truncated mid-sentence, no footer) and the run-stats
footer arrived as yet another message — four bot replies for one turn. The recovery now deletes
that partial copy first and attaches the footer and its controls to the answer it posts, so a
failed finalization ends with the progress card and exactly one complete answer.
- **Fresh installs get their first-boot admin password again.** `npm run setup` answers the
voice-transcription question before the daemon has ever booted and saves it through the settings
writer, so a brand-new install already had a `settings.json` at first boot — and the first-boot
check, keyed on that file's existence, treated it as a configured install and never minted the
password. Every fresh install came up with `WARNING: no admin password` and the whole privileged
API refused. The decision now keys on what the file holds: the installer's own keys
(`whisperEnabled`) do not count as configuration; any operator-written key still does, so an
existing install is never handed a password behind its operator's back. Found while installing a
third gateway on the development host.
- **The daemon boots on the documented Node floor again.** Migration 17 created the channel-memory
search index as an FTS5 virtual table; Node 22.13's bundled SQLite has no FTS5, so the migration
threw and the whole database refused to open. The index is now optional per engine build
(`src/db/fts.js` probes once per handle), the migration skips it with a warning, every open
re-attempts the creation so a later Node upgrade gains the index without a new migration, and
`search_channel_memory` answers from a plain scan (same AND semantics, diacritic folding and
bracketed excerpts) until then.
- **CI's settings-generator coverage floor is met again.** The skills catalog reshaped the grant
and listing paths in `src/gateway/folders.js`; `test/folders-generator-paths.test.js` now reaches
work-folder containment, instruction updates, the host-folder grant fallback and the legacy
managed-skill rename, and is part of the security-coverage gate.
- **Resumed Codex replies show the current message's cost, not the whole session's.** On a cold
runtime probe the daemon learned Podman's host-side HOME-volume path only after run artifacts
were materialized. Codex accounting then had no rollout baseline and treated its cumulative
terminal counter as one reply. The settled read path is now refreshed immediately after the
container starts, before the resumed turn snapshots usage; Claude's provider-reported per-turn
cost and the canonical descendant-aware ledger are unchanged.
- **Composio (and every other injected remote MCP server) is back for Claude in channels that pick
a global MCP server.** The channel lockdown lists a picked server by URL, and Claude Code then
matches every REMOTE server by URL: a `serverName` entry no longer admits it, so `composio-user`,
`composio-agent`, Skills Manager, Toolbox and the Make toolbox were dropped as "blocked by
enterprise policy" — silently, before any connection attempt, which is why the run config still
showed both Composio identities resolved while the model reported no Composio tools. Codex was
never affected (it has no such allowlist). The lockdown now carries each injected remote server's
URL beside its name (`injectedRemoteAllowMatches`, `src/gateway/mcp-catalog.js`); SDK-mode
Composio admits its `*.composio.dev` tool-router hosts. Takes effect on the next turn after a
restart — the per-run settings artifact is keyed by content.
- **A Claude thread inside a Codex-default channel no longer starts "Not logged in".** The
relayed Claude login was resolved for the CHANNEL's harness before the thread's own harness was
settled, so a thread that had started on Claude while its channel later moved to Codex spawned
Claude with no `CLAUDE_CODE_OAUTH_TOKEN` — inside a container that is Claude Code's own
"Not logged in · Please run /login", two seconds in, every time (`src/gateway/run.js`). The
credential is now resolved after the thread-engine decision; the stub engine reports whether it
received a login so the E2E can prove the spawn was authenticated.
- **The nightly engine canary installs Claude Code the way the product documents.** Its Claude
jobs had failed on both runners since the npm package moved to a native binary fetched by its
postinstall — `npm install --ignore-scripts` left a shim with nothing to run ("executable format
is invalid" on macOS). The pinned and the drift-probe jobs now use the official installer
(`2.1.258` / `latest`), and the Codex target moves to `0.152.0`, the first release whose network
proxy keeps approved tunnels on Linux (`.github/workflows/nightly-canary.yml`,
`docs/COMPATIBILITY.md`).
- **CI is green on macOS again, and the security-coverage gate no longer depends on the runner's
toolchain.** Thirteen tests failed only on macOS because `os.tmpdir()` there is a symlink
(`/var/folders/…` → `/private/var/…`) and the code under test resolves REAL paths — credential
files, toolchain binaries, custom work dirs — so a fixture built from the symlinked form never
string-matched what the code reported. The shared test scratch root is now canonical
(`test/helpers.js`); Linux reproduces the old failure with a symlinked `TMPDIR`. The access-grants
coverage area gained tests for the stable toolchain launcher dir (with an explicit fixture
toolchain instead of whatever `~/.local/node` the runner happens to have), the isolated-target
refusal, an unreadable `.claude/agents` directory, every post-signature refusal of a gateway
capability, and `userOnlySkillGrants`.
- **`/update` rebuilds the channel image when this revision needs a new one.** The updater pulled,
installed dependencies and restarted; the container image was built only by a manual
`npm run build:image`. So an update that changed `containers/` or bumped `imageSpecVersion` left
every container channel running the previous toolchain until an operator noticed the boot warning.
With the container runtime on, the update now runs the build itself — after dependencies, before
the restart — whenever the candidate touched `containers/`, moved the spec version, or no image is
built at all. The decision is a pure `needsImageBuild()` in `src/runtimes/container/image.js`
(unit-tested), the built version comes from the image's own `cg.image.version` label, and the
expected version is read out of the CANDIDATE's `containers/versions.json` rather than a constant
the runner imported before the checkout moved under it. A failed build never blocks the update:
it reports `channel image build failed — run \`npm run build:image\`` and continues to the
restart, because the image already on disk still runs every container channel.
- **The approval card no longer calls a container channel's job "unsandboxed".** The card for a
background shell job in an AUTO channel told the admin it "Runs OUTSIDE the engine sandbox as the
daemon user" — true on the host, and false in a container channel, where the job runs inside that
channel's own container on the image's toolchain with only the channel's mounts. The card now
reads the run's target and says `Runs inside this channel's container (<image>)` for an isolated
runtime, keeping today's wording for the host. Driven by `runtimeSupports(target, "isolated")`,
never a backend id, and it is still an admin-tier click either way.
- **The test suite cleans up after itself.** Every test process created a scratch gateway root and a
sibling TMPDIR and removed neither — roughly three hundred directories per `npm test`. On a host
whose `/tmp` is a tmpfs with a fixed inode budget, the accumulation eventually exhausted the
inodes and unrelated work started failing with "unable to open database file". `test/helpers.js`
now tracks every scratch directory it hands out and removes them on process exit (`node --test`
gives each file its own process, so that is complete), every `mkdtempSync` in the suite goes
through that helper, and a new `pretest` step (`scripts/test-scratch-sweep.mjs`) sweeps anything
older than two hours that an earlier crash left behind, skipping what it cannot remove.
- **Claude now runs on the operator's own login, host and container.** The gateway used to symlink
`~/.claude/.credentials.json` into its synthetic engine home. Claude Code writes that file by
RENAME, so the first refresh a gateway run performed replaced the link with an independent copy of
the operator's session — which then aged out on its own while the operator's real login stayed
valid, and every Claude turn on the affected gateway silently failed over to Codex. Nothing plants
that link any more. `src/gateway/claude-login.js` is one resolver for "which Claude login does the
gateway use" — a configured `claude setup-token`, else the host user's own `~/.claude`, else a
login signed in to the engine home, else `ANTHROPIC_API_KEY`, else a named remedy — and the relay
reads and refreshes THAT source, in that login's own config dir. Every run now receives its current
ACCESS token in `CLAUDE_CODE_OAUTH_TOKEN`, host runs included (previously containers only), so a
host child never depends on a credentials file the gateway no longer maintains. Fail-closed stays
container-only; a host turn with no login logs the remedy once an hour and lets the engine speak.
Boot, `/api/health` and `/status` name the login source and the date its session dies, and warn
three days ahead. No setup-token is required for anything any more.
### Removed
- **Settings → Network → "CLI integrations".** The switch, its `cliIntegrations` setting, the
live "installed" badges and the read-only linking of the daemon's shared host login
(`~/.supabase`, `~/.vercel`) into runs are gone. ChannelGate now targets Linux with the container
runtime only: a container has no domain allow-list and its image ships `vercel` and `supabase`,
so the switch had no effect there, and a channel's own provider login is a `/secrets` variable —
never the daemon's host-wide file, which is the identity mix-up the switch invited. `/secrets`
now suggests every catalog name; a stored `cliIntegrations` value is inert. First slice of
retiring the host sandbox runtime and macOS.
- **The host sandbox runtime and the network allow-list.** Claude Code `sandbox.*` settings
generation, the Codex host permission profiles and `network_proxy` compilation, the toolchain
launcher grants, the host credential links, the `SENSITIVE_HOME` deny lists, the AppArmor/userns
fix, the per-domain egress allow-list (`networkDomains`, per-channel `extraNetworkDomains`, the
`request_network_domain` tool and its card), the container kill switch and the per-channel
runtime pin are gone. The container is the boundary: every turn — admin channels included — runs
in the channel's own rootless Podman container with a per-channel HOME volume and only the work
folder, clean workspace and artifact dir mounted, and the daemon refuses to boot without a
container CLI. Modes stay as tool-permission presets; `.claude/settings.json` keeps permissions,
the MCP allowlist, memory-off and the Stop hook, with no `sandbox` block. *Allow network* stays as
a per-channel switch the engines are told about — it filters nothing and does not yet cut a
container's egress (every container is on the bridge network); the egress proxy is a later slice.
- **macOS support.** ChannelGate runs on Linux only — systemd for the service, rootless Podman for
every channel. Gone: the launchd installers (`scripts/install-launchd.sh`,
`scripts/uninstall-launchd.sh`, the `service:*:boot` npm scripts), the darwin branches of the
self-updater (launchd probe, `kickstart` restart, `bootout` + `bootstrap` reload), the
migration's plist rewrite, the admin Stop route's `launchctl bootout`, the shutdown exit-code
rule for `KeepAlive`, the Homebrew/CMake Whisper source build, the extra macOS disk requirement,
and the macOS legs of the CI and nightly matrices. `npm run service:install` /
`service:uninstall` now wrap `scripts/install-systemd.sh` and the new
`scripts/uninstall-systemd.sh` (system AND user units, current and pre-rename names, never the
runtime root); `npm run setup` and `src/start.js` refuse any other platform with one plain line
("ChannelGate runs on Linux only (systemd + rootless Podman); this host is <platform>."), and the
documentation describes one platform.
### Changed
- **The repository is `makeitfutureDev/channelgate`.** Development, the served `main` and the
landing lock (`refs/channelgate/landing-lock`, renamed from `refs/claude-gateway/…`) live in the
new repository, whose history starts from one fresh-start commit of the scrubbed tree; the
previous repository is a read-only archive of the full history. An existing checkout is repointed
with the three commands in `INSTALL.md` → *Upgrading* — a plain `git pull` cannot fast-forward
across unrelated histories, and the updater refuses a diverged checkout by design.
### Added
- **Failover after the in-place retries, with a choice of who decides.** A provider that stays
unavailable through the transient retries now fails over to the other harness (five-minute
cooldown for the channel), and Settings gained *How a failover happens*: `auto` (the silent switch)
or `ask` — a card in the Slack thread with *Switch to <other>* / *Try <failed> again* buttons; the
click re-runs the original message on the chosen harness (*Switch* pins the thread there). When
both harnesses fail the error names both in one sentence and a watched thread gets the same card.
The retry pause hands the run slot and container lease back for its length. The same-engine
gateway-default-model retry now covers Claude (`model_not_found`) as well as Codex
(`src/gateway/run.js`, `src/slack/engine-switch-choice.js`, `src/engines/stream.js`).
- **Transient provider failures are retried in place.** A 5xx, an "overloaded", a connection
reset/timeout, or an unexplained 404 from the Codex backend (the 2026-09-03 ChatGPT Codex outage
failed every turn on both gateways with "404 Not Found: Unknown error" for a few minutes) no
longer ends the turn with a red error on the first try: the gateway re-runs the same turn on the
same engine up to two more times, ten seconds apart (`CG_TRANSIENT_RETRY_ATTEMPTS`,
`CG_TRANSIENT_RETRY_DELAY_MS`), only while no tool has run, and never for authentication,
usage-limit or model-rejection failures, which keep their own failover / model-retry paths. Every
attempt is a `run_transient_retry` event and a status-line notice ("retrying in 10s (1/2)"); a
reply that needed more than one attempt says so in one line, an exhausted error says how often it
was retried, and a cancel ends the pause early (`src/gateway/run.js`, `src/engines/codex.js`).
Review fixes on the same change: a retried FRESH Claude session runs under a new session id (the
CLI refuses to create one twice — "Session ID … is already in use"); the warm Claude process, which
stays alive after a provider failure, now rejects that turn with the classified error instead of
posting "API Error: …" as the reply (`src/engines/persistent-session.js`); a turn that already
streamed text is never replayed (Claude's replay-safety now matches Codex's); Claude's catch-all
`provider` kind and the bare "API Error:" prefix no longer count as an outage (a rejected model or
an unknown 4xx fails once); Codex's stderr never decides a replay (a wedge or an unexplained exit
keeps its honest message, and a recovered "unexpected status 429" line no longer becomes a
usage-limit cooldown), the underscore error codes it actually emits (`internal_server_error`,
`response_stream_disconnected`, …) do qualify, a 404 whose body names the model is a model
rejection, and the stderr excerpt in a classified failure is redacted; the retry knobs are read
per turn (so `.env` values count) and the kinds each engine may replay are an adapter fact
(`transientKinds`). Known cost, inherent to a replay: on a RESUMED session the failed attempt's
prompt (and the provider's error line) stay in the transcript before the retried one.
- **`--repath --from <old> --to <new>` for a folder moved by hand.** The rename migration's rules
only know the roots the product renamed; a folder the operator moved — the daemon's own checkout,
a channel's custom `workDir` — was invisible to them, so its channel record, Claude project
directory and transcripts, engine `.claude.json`, Codex `config.toml`, memory prose and service
definition kept naming the old place, and thread resume in that channel broke. The pair
(repeatable) is now one more rewrite rule for every pass, `--verify` handed the same pair counts
what is still stale, and a malformed or misplaced pair is refused with usage before anything is
read (`scripts/migrate-channelgate.mjs`, `docs/OPERATIONS.md`).
- **The Claude login expiry now reaches an admin in Slack, without a restart.** The three-day
warning was evaluated only at boot and in `/status`, so a daemon that had been up for weeks never
raised it — the first symptom was Claude turns silently failing over to Codex. A new hourly watch
(`src/gateway/login-watch.js`, started next to the nudge sweep and stopped with the other runtime
services) re-resolves the login and DMs every admin once per UTC day: from three days before the
session expires, and daily while there is no usable login at all. The DM names the login kind and
config dir, the expiry in UTC and in the gateway's local timezone, and the remedy — never any
token material. The "already told them today" marker lives in the `_meta` table, so a restart
cannot re-spam; a class change (expiring → missing) still notifies the same day, and a login that
goes healthy clears the class. One unreachable admin does not stop the others, and a tick that
reached nobody stays due for the next hour.
- **Container Claude runs accept the daemon's API key.** A Linux service install authenticates
with `ANTHROPIC_API_KEY` (docs/OPERATIONS.md) and has no login to relay; container turns used to
fail closed with "no Claude login to relay" on exactly that install. The key is now the third
credential mode (setup-token → relay of a login → API key), gated from the live environment.
- **Image spec 1.1.1 — the image PATH now reaches Codex's login shells.** Codex runs commands
through `bash -lc`, and Debian's `/etc/profile` reset PATH to the distro default, so a Codex
shell in a container never saw `~/.npm-global/bin` (npm -g installs) or `/opt/channelgate/bin`.
`/etc/profile.d/channelgate-path.sh` re-asserts the image PATH after that reset; a durability
test pins it. Also fixes the opt-in live durability test's marker parsing.
- **A channel can run its engines inside its own long-lived Linux container.** Roughly a hundred
commits of sandbox repair were all fights with a *subtractive* boundary — start from the whole
host, enumerate the denies. A container is *additive*: the channel gets only what the image and
the mounts provide, and the whole bug class becomes inexpressible. v0.8 P1 lands the runtime
seam and the container backend; it **deletes nothing** — the `host` backend stays fully working,
admin channels stay on it, and a gateway-wide kill switch returns every channel to it at once.
- **`src/runtimes/` — a runtime backend registry** (`contract.js`, `registry.js`, `resolve.js`,
`host.js`, `container/`), to WHERE an engine runs what `src/engines/` is to WHICH engine runs.
A backend that omits a method or a declared capability does not load; an unknown capability key
throws. `resolveRuntime()` decides once per turn and hands the target to the folder generator,
the MCP builder, the runners, the artifact paths and the session stamp — nothing downstream
compares a backend id to a literal.
- **Precedence**: `containerRuntimeEnabled:false` → host · admin mode → host · `meta.runtime` →
that · else `containerDefaultBackend`. A per-run override can only reduce capability, so it can
never move a turn between backends.
- **The container**: rootless Podman preferred (`auto` = podman, then docker), `--userns=keep-id`
(or a pinned `--user`), identical-path bind mounts of the channel workdir, the clean workspace
and a per-channel artifact dir under `~/ChannelGate/.runtime/`, a per-channel HOME **volume** at
`/home/agent`, the control socket read-only at `/run/channelgate`, a `/run` tmpfs (with `/tmp`
and `/var/tmp` persistent — see the durability entry below), `--cap-drop ALL`,
`no-new-privileges`, and pids/memory/cpu caps that degrade with a warning where cgroups are not
delegated. The gateway root, `config/`, `gateway.db`, the channel metadata folder, the daemon
checkout and the operator's `~/.claude`/`~/.codex` are never mounted. Run environment travels in
a 0600 `--env-file`, never on argv.
- **Lifecycle**: created on first use, restarted in under a second when exited, recreated only
when the create-time fingerprint changes (and only when no lease is held), stopped — not
removed — after `containerIdleMinutes` (default 10) with runs, background jobs and memory-review
runs each holding a lease, and bounded by `containerMaxRunning` with LRU stop and an honest wait
rather than killing someone's job. A boot reconcile sweeps the previous daemon's foreground and
warm process groups and leaves detached background jobs running.
- **Engine logins**: Claude prefers a `claude setup-token` value injected as
`CLAUDE_CODE_OAUTH_TOKEN` (no mount, no shared refresh chain) and otherwise seeds one copy of
the gateway's credentials into the channel's HOME; Codex gets a shared read-write file mount of
the real `auth.json` because it refreshes in place, with a per-channel `CODEX_HOME` so sessions
and history stay per channel. No login at all fails the turn closed with the exact remedy
instead of failing over to an engine that would also fail.
- **Inside the container each engine's own sandbox is off** — the OS boundary the daemon owns is
the confinement. `permissions.allow`, the mode mapping, the memory-off flags, the MCP allowlist
and the admin-only bypass are unchanged, and the Stop hook and MCP helpers come from the image's
`/opt/channelgate` bundle rather than this checkout.
- **The gateway control MCP is served by the daemon over a unix socket** (`run/mcp.sock`, 0600 in
a 0700 directory, mounted read-only) instead of a stdio child that would need the database,
the config directory and the daemon port mounted into every channel. One hello line, then MCP;
identity is the signed run capability alone, with `toolset` and `progressReport` as SIGNED
claims; `CG_APPROVAL_SECRET` and `CG_PORT` never enter a container. Minting and verification now
happen in one process, retiring the aud/secret-skew class permanently. Composio SDK mode rides
the same socket as a second service.
- **The stall watchdog learned a third answer.** A container child's pid names the exec client,
not the engine, so liveness is an async backend probe of the run's process group — and a probe
that throws, times out or is inconclusive reports *unknown* and the turn keeps waiting. Only a
definite "gone" ends a turn; a quiet turn is still reported, never killed.
- **Background jobs and memory review** resolve their own backend at their own spawn, hold a
lease, and run detached inside the container; job output is tailed from a log at an identical
path on both sides and the real exit code comes back through a `[cg-exit:N]` marker. A recovered
job is probed and signalled by its run id, never by a stale client pid.
- **Where a run happened is recorded and shown**: an additive `sessions.runtime` column
(migration 13, `''` default, so older code still boots on the new schema), a `/status` Runtime
line, a ` · container` heartbeat suffix, the image ref on the reply footer, and a `/resume`
command in the container's own form (`podman exec -it -w <cwd> <name> …`).
- **Admin surface**: a Settings → Container runtime card (kill switch, default backend, CLI,
image, idle minutes, max running, pids/memory/cpu caps, and the write-only Claude token), a
per-channel/DM **Runtime** select that shows the effective decision beside the stored pin, the
`set_channel_runtime` chat tool, and `containerRuntime` in `/api/health`. Every value that would
reach the container CLI's argv is refused with a 400 rather than sanitized.
- **`npm run build:image`** builds `containers/Containerfile` with the daemon user's uid/gid baked
in, the CLI versions pinned in `containers/versions.json`, and an in-image bundle resolved as
the import closure of the three helpers an engine spawns — the checkout is never mounted and
never copied. Because a tag is a moving pointer, the container fingerprint uses the resolved
image ID, so a rebuild retires containers on their next run.
- **Cross-platform**: a host with no container CLI boots exactly as before and reports why in
`/api/health`; the channel image and its helper scripts are Linux-only by design, and macOS
stays a supported daemon and development host on the `host` backend.
- **A thread's engine history follows it when its channel changes runtime backend.** Stop, start and
recreate already lost nothing (the HOME volume and the workdir bind outlive a container). The one
remaining loss was a thread whose channel MOVED — host → container when it is containerized,
container → host when it is set to admin mode, pinned back, or caught by the kill switch: the
engine's state dir moved with it, the resume found no session, and the turn was healed instead,
which keeps the conversation readable but throws away the compactions, tool results and subagent
transcripts the chat transcript never held. The session's files are now carried across before the
first resume attempt — lazily, per thread, in both directions, overwriting the older copy and
deleting nothing on either side.
- **`sessionState`, a new per-engine fact** (`src/engines/adapters.js`): where a harness keeps a
session, as paths relative to its state dir. Claude: `projects/<cwd-key>/<id>.jsonl` plus the
`<id>/` subagent directory, keyed off the RUN's cwd so clean mode keys the directory it ran in.
Codex: `sessions/YYYY/MM/DD/rollout-*-<id>.jsonl` — a pattern, because the filename carries a
timestamp nobody can recompute, and the date tree survives the copy because that is what
`codex exec resume` walks. An engine that declares none is skipped, never guessed at.
- **`copyIn`/`copyOut`, two optional runtime-backend methods** (`src/runtimes/contract.js`): host
is a plain `node:fs` copy; the container stages through the bind-mounted artifact dir and runs
ONE `sh -c` inside, because the daemon cannot reach a HOME volume. A staged file naming a path
outside the requested state dirs is refused rather than written. Optional is still fail-closed:
a backend that hangs a non-function on one of these names does not load.
- The session row is **re-stamped the moment a carry succeeds**, so it always names the side
holding the newest copy — without it the next turn would carry the stale copy back over
everything this one added. `run_config` records `sessionCarried` when it happened, and every
failure is one log line plus the heal that was already there.
- The idle reaper now starts even with the gateway kill switch OFF: flipping that switch is the
container → host transition, and a carry may bring one container up to read its HOME volume, so
something has to stop it again. It only ever acts on containers this process started.
- **Nothing a container channel accumulates is lost any more — including `/tmp` (image spec 1.1.0).**
A channel container is stopped as a matter of routine (the ten-minute idle sweep, the
max-running cap) and recreated whenever its create-time fingerprint changes, so durability is a
question about an ordinary Tuesday, not about a rollback. The HOME volume and the workdir bind
already survived all of it; `/tmp` and `/var/tmp` did not, because they were tmpfs — every idle
stop silently emptied them, a regression against the host backend where Claude Code's
`/tmp/claude-<uid>/…` scratchpad survives between turns.
- `/tmp` and `/var/tmp` are now rw bind mounts of `~/ChannelGate/.runtime/<platform>/<slug>/tmp`
and `…/var-tmp` — per channel, never shared, never deleted by the daemon, and visible on the
host so an operator can see what an agent parked there. `/run` stays the only tmpfs (pid files
and the read-only socket mount, which must be fresh at every start). The tmpfs size caps are
gone with the tmpfs: both trees grow against the disk, exactly like the work directory. The
mount list is part of the container fingerprint, so every existing container is recreated once
on its next run — with its HOME volume, which is the proof that a recreate keeps everything.
- **Image spec 1.1.0** widens the PATH to every place a channel can install into, ahead of the
pinned toolchain: `~/.npm-global/bin`, `~/.local/bin`, `~/bin`, `/opt/channelgate/bin`, the
distro dirs, then `~/.cargo/bin`, `~/.bun/bin`, `~/.deno/bin`, `~/go/bin`. All of them are
inside the per-channel HOME volume, so an installed CLI stays installed across a stop, a restart
and a recreate. It also adds `python3-pip`, `python3-venv` and `pipx` with `PIP_USER=1` +
`PIP_BREAK_SYSTEM_PACKAGES=1` and `PIPX_BIN_DIR=~/.local/bin`, so a plain `pip install <cli>`
lands in the volume instead of failing on Debian's externally-managed-environment marker.
`apt`/`sudo` remain deliberately unavailable — the toolchain is root-owned so a channel can
never replace its own engines. Rebuild with `npm run build:image`; the daemon compares the built
image's spec label against the one the checkout expects and names that command at boot when they
differ.
- Pinned by `test/container-durability.test.js` (the mount and tmpfs contract, the idle sweep and
the boot reconcile issuing no destructive verb, a recreate reusing the same HOME volume, a
source scan proving no production caller passes `destroy(…, { volumes: true })`, and the
Containerfile/PATH facts) plus an opt-in live proof against a real podman,
`npm run test:live-container`.
## [Unreleased] — One /model wizard replaces /engine + /effort (2026-07-16)
### Added
- **Google Chat and Microsoft Teams transports (preview).** Both surfaces can now receive and
answer messages. Google Chat runs outbound-only on a Cloud Pub/Sub PULL subscription (no inbound
endpoint, no tunnel — the same posture as Slack's Socket Mode); Teams runs on the documented Bot
Framework endpoint `/api/teams/messages`, which authenticates every request against the Bot
Framework JWKS before anything else happens. Credentials, live connect/disconnect, and per-platform
health are in the admin Settings page; setup for both is in `docs/PLATFORMS.md`. A turn on either
surface goes through the same gate, authorization, confinement, and usage accounting as a Slack
turn — and neither is escalatable to full access, because escalation needs an interactive
permission prompt neither surface has yet. Written against `node:crypto` and `fetch`: no new
dependency for either platform.
- **License keys, tiers, and usage limits (`src/ee/`).** A deployment without a key serves one
conversation per UTC month with 500 AI messages in it; a free key unlocks every conversation and
keeps the 500-message monthly cap per conversation; an enterprise key removes both. Limits are
server-defined and ride a signed payload, so the Licensor can change what a key is worth without
a release. `src/ee/` is **proprietary, source-visible** code owned by MAKEITFUTURE S.R.L. and is
not under the Sustainable Use License — see `src/ee/LICENSE-EE.md` and `LICENSE.md` §3.2/§4.5.
- **Verification** (`src/ee/license.js`): the key comes from Settings (listings return
`hasLicenseKey` + the last four characters only; the value is revealable one at a time through
`POST /api/secrets/reveal`) or from `CHANNELGATE_LICENSE_KEY` as a bootstrap. The daemon checks
`POST {platform}/v1/license/verify` at boot and every 24 h, verifies the response's Ed25519
signature locally, and caches it. Verification is **never awaited on the boot path** — Slack
connects while it is in flight, and the run gate reads the cached state.
- **States**: `no_key · valid · invalid · revoked · grace · expired_grace`. Unreachable keeps the
last verified tier for 14 days; past that it is still kept until the **next UTC month
boundary** and only then falls back to the no-key limits — never mid-month, never silently.
`invalid`/`revoked` drop immediately. Every non-quiet state raises a banner in the admin UI.
A response whose signature does not verify changes nothing in either direction.
- **Enforcement** (`src/ee/limits.js`, called from `licenseAdmission()` in
`src/gateway/run.js`): conversation admission (the first N distinct conversations of the UTC
month are the allowed set, persisted in the new `license_usage` table — schema migration 12)
and the per-conversation monthly cap, counted **at spawn** for every origin except the
deployment's own memory-review runs, with a one-time 80 % warning. A refused turn is a short,
platform-degraded reply carrying the sign-up link — never an error, never silence, and no run
starts. Nothing here can crash or kill a run.
- **Admin UI**: a License card under Settings — state banner, tier, key last four, last/next
verification, expiry, installation id, *Verify now*, key set/clear (with the existing reveal),
the platform URL, and this month's per-conversation usage bars against the limit line.
- **Gateway MCP tools**: `get_license_status` (any allowed user, never shows the key) and
`set_license_key` / `clear_license_key` (admins only, behind the control-plane approval click).
- **Data leaving the install** is exactly two payloads — the verify request (key, installation
id, version) and the daily/at-shutdown usage report (installation id, key hash, version, UTC
month, per-conversation **hashes** and counts). Never message content, user ids, channel names,
or credentials. Documented in `docs/PRIVACY-AND-DATA-FLOW.md` and `docs/LICENSE-KEYS.md`.
- **Air-gapped deployments** can run on `CHANNELGATE_LICENSE_PAYLOAD`, a signed license verified
locally against the same public key; such an install makes no outbound request at all.
- The Ed25519 verification key shipped in `src/ee/license-public-key.js` is a clearly labelled
**placeholder**; the production key is swapped in at deploy time, and
`CHANNELGATE_LICENSE_PUBLIC_KEY` overrides it for staging and tests.
### Changed
- **Admin Settings loads with the multi-platform registry enabled.** Platform UI manifests now
contain data only: runtime adapter functions (including optional helpers such as `normalizeName`)
are removed generically before cloning, preventing `/api/settings` from failing with a
`DataCloneError` when Google Chat and Teams are registered.
- **README rewritten as a hero landing page, plus GitHub repository metadata**: above the fold the
README now opens with the H1, the tagline the site's meta description repeats verbatim, a badge
row (Sustainable Use License 1.2, CI, Node ≥ 22.13, the three chat platforms, the three engines),
a three-sentence what-it-is, a placeholder for a 45-second demo GIF, a seven-step "Running in 10
minutes" quick start, a ten-row feature grid, the architecture flow, a ✅/➖/❌ comparison table
footnoted as a generalisation about categories, security in five bullets, the Free / Partner /
Reseller-white-label-enterprise licensing lanes, one UTM-tagged Makeitfuture CTA, and a
documentation index. Every operational section (Slack app setup, install, updating, admin UI,
engines, configuration, security model, environment variables, admin password) is preserved
below it. New: `.github/REPO-METADATA.md` (About text, website, the ten repository topics and the
`gh repo edit` command to apply them at launch) and `docs/assets/README.md` (specs for the demo
GIF and the 1280 × 640 social preview — neither binary is committed). `test/readme.test.js`
guards the shape: one H1, one "formerly" attribution, never "open source", the CTA and UTM links,
every relative link resolving, well-formed badge URLs, and the licensing facts.
- **Renamed to ChannelGate, with new folders and a boot migration** (formerly
*Claude Gateway for Slack*): the display name, the npm package (`channelgate`), the Slack app
manifest, the launchd label (`com.makeitfuture.channelgate`), the systemd unit
(`channelgate.service`), and the bundled lockdown skill (`.claude/skills/channelgate`) all
follow the product name. The hidden runtime root moves from `~/.claude-gateway/` to
`~/.channelgate/` (env `CHANNELGATE_DIR` / `CHANNELGATE_DB`, with `CLAUDE_GATEWAY_DIR` /
`CLAUDE_GATEWAY_DB` still honoured for one major behind a one-time deprecation warning), and
the visible workspace root moves from `~/Slack Agent/<slug>/` to
`~/ChannelGate/<platform>/<slug>/` — `slack/`, `teams/`, `google-chat/`, taken from the
platform registry so a new surface adds a folder by adding an adapter. Per-channel metadata
(`<root>/channels/<platform>/<slug>/`) and clean-mode workspaces move the same way; a custom
per-channel `workDir` is never touched. `scripts/migrate-channelgate.mjs` runs once at boot
(before the database opens and before Slack connects) and on the post-update step: it refuses
while the old daemon holds its singleton/update lock, prints a dry-run plan, moves the runtime
root, moves each channel's folders by its stored platform, rewrites stored absolute paths,
regenerates every channel's `.claude/settings.json`, drops warm sessions, and leaves a
`MOVED.md` breadcrumb. A failure never fails the boot — the daemon continues on the old paths.
`node scripts/migrate-channelgate.mjs --dry-run` prints the plan without changing anything.
- Repository restructure for the public release: product docs merged into `docs/WHY.md`,
engine capabilities moved to `docs/`, marketing site moved to its own repository,
internal names scrubbed.
### Licensing
- **Makeitfuture Sustainable Use License 1.2 (2026-08-25)**: the Software is renamed ChannelGate;
new §3.2 adds license keys and usage limits (no key: one conversation; free key: unlimited
conversations at 500 AI messages/conversation/month; enterprise: unlimited) with end-user keys
only, and §4.5 makes circumventing them a violation; §3.1 states that any number of separate
single-customer deployments are permitted service work on the customer's key; §4 names the
Reseller, White-Label, Enterprise, and optional Partner agreements; the former §7 Change Date is
removed — no automatic relicensing; new §11 sets Romanian law and Bucharest courts. New
`docs/LICENSE-KEYS.md`, `TRADEMARK.md`, `AUTHORS.md`; `CLA.md` 1.1; FAQ and decision record
amended. Docs only — the key enforcement itself is the `src/ee/` slice.
- **Makeitfuture Sustainable Use License 1.1 (2026-08-20)**: new §3.1 permits operating a
dedicated deployment for a single customer as paid service work and states its four conditions;
§4.2/§4.4 make multi-tenant operation and white-labeling explicit restrictions; new §6 plus
`CLA.md` set inbound contribution terms with a `Signed-off-by` sign-off; new §7 adds an
irrevocable Apache-2.0 Change Date four years after each version's publication. Worked examples
in `docs/LICENSING-FAQ.md`; rationale and the enterprise-tier boundary policy in
`docs/LICENSING-DECISION.md`. No code or feature changes.
### Changed
- **Community and contribution files added**: `CONTRIBUTING.md`, `CODE_OF_CONDUCT.md`
(Contributor Covenant 2.1), `SUPPORT.md`, `.github/CODEOWNERS`, issue forms (bug, feature,
partner inquiry) with blank issues disabled, a pull-request template, and a dependency-free
`scripts/check-dco.mjs` (`npm run check:dco`) that fails any commit without a `Signed-off-by`
trailer — enforced in CI on every pull request.
- **File-explorer uploads are browser-only**: the native Slack `file_input` modal and private Slack
file download path are removed. One *Upload files / folder* button sends multi-file and folder
selections directly into the confined gateway directory, so the ingest never uses Slack storage.
- **`/model` is now the single runtime command**, a four-step wizard in one self-updating message:
scope (*This channel* or *Just this thread*, buttons) → harness (*Claude* / *Codex* buttons, plus
*Use defaults* to clear the scope's overrides) → model dropdown → effort dropdown. Every step
persists the moment it's clicked. Admin-only in channels, open to approved users in DMs. Typed
`@bot /model` is the command — no Slack-manifest slash command is registered (a Bolt handler
answers anyway, thread-aware, if one is ever added to the app).
- **Reply footers show the governing model**: the model in the run-stats footer follows the
configured cascade — thread override → channel/DM model → gateway default — and only when
nothing is configured anywhere, the CLI-reported model (the engine's own default). Context-window
% and Codex cost estimates still key on the CLI-reported runtime model.
- **Admin-UI model fields are dropdowns** (were free-text "e.g. opus" inputs): Settings' two
per-engine defaults plus the channel Runtime card and channel/DM config editors all pick from
the same curated options as the `/model` wizard, following the selected/inherited engine. A
hand-edited non-curated id survives as an extra option (Save round-trips it); switching engine
drops the other engine's pick.
- **`/engine` and `/effort` are retired** — typed or slash-command invocations answer with a pointer
to `/model`, and old `/engine` dropdown messages in history reply with the pointer instead of erroring.
### Added
- **Create files and edit general UTF-8 text from `/files`**: writable views now show *New file*
beside the existing upload/folder controls. The Slack modal creates one confined file with
optional initial text using exclusive, non-overwriting semantics and records
`channel_file_created`. Editing is content-based instead of limited to `.txt`/`.md`, so `.env*`,
JSON/YAML/TOML, configs, scripts, and extensionless UTF-8 files use the existing Worker/Auto
permission boundary; Full remains admin-only. Managed, credential/token/secret, key, binary,
invalid-UTF-8, oversized, traversal, and conflicting paths remain protected.
- **Multi-file and folder upload**: the browser-only *Upload files / folder* flow preserves
directory structure for up to 200 files / 250 MB total using a one-time user/channel/folder grant,
HttpOnly SameSite session,
CSRF, repeated authorization/membership/mode checks, per-file confinement and 25 MB limits,
collision-safe writes, and `channel_file_uploaded_in_browser` audits. Empty directories are not
represented by browser folder pickers.
- **Create folders from the native file explorer**: writable channel modes now show *New folder*
beside *Upload files / folder*. The modal creates one directory inside the folder currently on screen,
repeats authorization/membership/mode checks, rejects protected names, separators, traversal, and
collisions, and records `channel_folder_created`. Read-only hides the control; Full remains
admin-only.
- **Native channel file explorer**: `/files` opens a Block Kit modal over the current channel's
effective working folder; a message shortcut and typed `@bot /files` cover thread-scoped use.
Navigation is AI-free, authorization/membership is rechecked, realpaths and symlinks stay confined,
gateway internals and likely secrets are hidden, previews are bounded, and a confirmed selected
file (≤25 MB) is uploaded only to the originating channel/thread with an audit event. Preview now
states that truncation is display-only; *Send to me* delivers the complete file privately through
the bot's Slack DM. Worker/Auto modes now open eligible UTF-8 `.txt`/`.md` files in a full browser
editor (250,000 characters / 1 MB) through the configured public gateway URL, including a live
Markdown split preview. One-use file grants exchange for HttpOnly editor sessions, with CSP,
no-store, CSRF, revalidated authorization/membership/mode, an open-time hash conflict check,
atomic replace, and audit logging; Full mode remains admin-only. The 3,000-character Slack editor
stays as the no-public-URL fallback.
- **Per-thread model + effort overrides** (`thread-models.json` / `thread-efforts.json`, next to the
existing per-thread engine override): the wizard's thread scope pins harness/model/effort for one
thread only. Run-time precedence: per-run API override → thread → channel/DM → gateway default.
A harness switch (wizard or `claude`/`codex` directive) drops thread model/effort that don't
belong to the new engine.
- **Engine-switch context replay is now detection-based**: the thread's session row remembers which
harness minted it, so ANY switch (wizard thread/channel scope, admin UI, flipped gateway default —
not just the typed directive) makes the next turn replay the Slack thread into the fresh session.
### Fixed
- **The rename migration's `--verify` over-counted, and there was no way to re-run its repath.** The
audit counted every string that CONTAINED a pre-rename path, so a finished production migration
still reported ~56 600 "occurrences" — all of them a path quoted in a message, a tool result or a
Codex `world_state` snapshot, plus two channel folders with a custom `workDir` that were
deliberately never moved. It now counts STATE only: per JSON key path (Claude `cwd`; Codex
`payload.cwd` + `payload.workspace_roots[]` — `world_state` is a per-turn snapshot Codex re-derives
on resume, so it is content), and per existence (after the move, a recorded path that still
resolves on disk names a directory that did not move). A project directory is stale when its name
is no longer the encoding of its own cwd, or that cwd is gone — not when the name merely spells an
old root. Everything else is reported in a "historical content — left by design" bucket next to
the `events` log and never reaches the exit code, and the same key allowlist now bounds the
REWRITE too, so a past turn's `file_path` is never edited. New `--repath` (with `--dry-run`) re-runs
every rewrite pass against the current roots — database blobs and typed columns, config JSON,
Claude projects + engine home, Codex index/rollouts/`config.toml`, work-folder text, service files,
lockdown regeneration — moving nothing, idempotently, and ends with its own audit; it refuses while
the daemon runs, exactly as the migration does. Production `--verify` now reports 0.
- **Codex fallback no longer inherits a Claude channel model**: a channel pinned to e.g. `opus`
passed `-m opus` to the Codex fallback turn, which Codex rejects; the fallback now only honors
Codex-family channel models and otherwise uses the gateway's Codex default.
- **/model picks in template-managed DMs were silent no-ops**: DMs default to the "User" org
template, and `effectiveMeta` unconditionally replaced the DM's own engine/model/effort with the
template's — so a DM `/model` pick persisted but never affected a run. A runtime pick made in the
DM now overrides the template (empty still inherits; template model/effort don't carry over
across a harness flip).
## [Unreleased] — `/delete` can remove user messages via an admin user token (2026-07-16)
### Added
- **Settings → Slack credentials → Admin User Token (xoxp, optional)**: when set, `/delete` also
removes messages posted by humans and other apps — `chat.delete` is called with a per-message
token override (a workspace admin's user token may delete others' messages where workspace
preferences allow). Write-only (masked on read), validated to be a user token (`xoxp-…`), used
ONLY by the org-admin-gated `/delete` — never passed to runs or MCP configs. Without it,
`/delete` keeps its bot-messages-only behavior and the summary explains how to enable full
deletion; with it, anything Slack still refuses is counted and reported.
## [Unreleased] — `/delete` in-thread command (2026-07-16)
### Added
- **`/delete`** (typed in a thread, org-admin only): deletes every message the bot posted in THAT
thread — replies first, parent last — hard-scoped to the triggering channel + thread. Messages by
humans or other apps can't be deleted with a bot token; they're counted and reported in an
ephemeral summary instead of attempted. Refuses non-admin authors, mid-run threads (stop first),
and top-level use; deleting a bot-owned thread root also drops the thread's session state like
`/clear`. Covered by `test/thread-delete.test.js`.
## [Unreleased] — Admin UI redesign: #makeitfuture. brand + UX overhaul (2026-07-04)
### Changed
- **Full admin UI redesign** (`public/` only — zero API/server changes). New #makeitfuture. design
system: self-hosted Poppins (`public/fonts/`, no CDN), orange `#fe3a02` + dark-teal token palette,
wordmark shell, inline-SVG icons replacing every emoji in the chrome, branded login page.
- **IA restructure**: Dashboard → **Overview** (4 KPIs, orange hero cost chart with gridlines +
dated peak); Audit → **Activity** (filterable search/channel/user/engine + paginated runs table;
duplicate summary cards dropped for a one-line all-time strip); Channels + DMs + org templates
merged into one **Conversations** section (grouped list with capability color dots, segmented
All/Channels/DMs filter, fail-soft 30-day cost badges); Schedules → **Automations**.
- **Channel detail rebuilt** as Access / Tools / Runtime / Instructions / Memory: capability
radio-cards (Full access red-treated + admin-tagged, Custom reveals raw flags), live access help,
network switch row, filterable MCP/skills checklists with enabled counts, CLAUDE.md / MEMORY.md as
mono editor cards. The three-save-buttons-with-a-footnote model is now ONE sticky dirty-state save
bar (file editors keep their own Save, visibly editors); PUT payloads unchanged.
- **Users** is a table (role chips, C/S/T token state, Slack identity) with a right-side edit
drawer; **Settings** gets a vertical section nav (Connection / Agent defaults / Integrations /
Access & security / System) over the same single-Save contract presented as a sticky save bar with
dirty tracking, chip editors for trusted apps + network domains, a red danger zone, and branded
confirm/info dialogs replacing native `confirm()`/`alert()`.
### Fixed
- **Dashboard bar charts rendered empty**: `.bar-fill` was an inline `<span>` so its width/height
were silently ignored — every "bar" was a blank track. Fills are now `display:block` and visible.
## [Unreleased] — Channel memory v2, the save loop (2026-07-04)
### Changed
- **Channel memory is now skill-packaged — nothing memory-related in `CLAUDE.md`.** `MEMORY.md`
becomes a short budgeted index (default 3,000 chars) with `memory/<topic>.md` files for depth,
linked as `[[topic]]` (an Obsidian-style graph inside the sandbox). The protocol (recall at task
start, concrete save triggers, end-of-task checkpoint, consolidation) lives in a
gateway-maintained `channel-memory` skill in each folder — refreshed write-on-change, pruned
when memory is off. Modeled on Hermes Agent + Claude Code auto-memory; plan in
the memory-improvement design note (internal repo). (Restored 2026-07-04 after a merge resolution dropped the
Slice 11 code.)
### Added
- **`update_channel_memory` gateway MCP tool** — `add`/`replace`/`remove` on the index +
`write_topic` for topic files. Daemon-side write, so saving works in every mode (read channels
can't write files in-sandbox). Budget is enforced Hermes-style: an over-budget add fails with
"consolidate first"; responses show a usage meter. The tool description restates the save
triggers every turn — the always-on lever that makes the agent actually save.
- **Admin UI Memory tab** shows the budget meter and `memory/` topic files; an over-budget manual
save is allowed but flagged.
## [Unreleased] — Durable channel instructions (2026-07-03)
### Changed
- **Channel `CLAUDE.md` is now the channel's own persistent instructions** — no longer regenerated
every turn. The gateway upserts exactly one managed block at the top
(`<!-- GATEWAY-INSTRUCTIONS -->`: global instructions + Slack-format guide + memory note;
refreshed only when its content changes, self-repairing markers); everything below the end
marker is user/agent-owned and survives new sessions, `/clear`, and settings changes on BOTH
engines (AGENTS.md symlink). Legacy generated files migrate once — boilerplate collapses into
the block, genuine channel text is preserved. Custom (real-project) folders are never
block-managed. (`src/gateway/folders.js`, design in the instruction-injection note (internal repo).)
### Added
- **`update_channel_instructions` gateway MCP tool** — "add a rule that X" in Slack appends a
standing instruction to the channel section in any mode (daemon-side write, outside the
sandbox); `mode:"replace"` is admin-only.
- **Admin UI Instructions tab edits the real file** — the managed block renders grayed-out with an
"edit in Settings → Behavior" link; the textarea edits only the channel section; saves are
hash-guarded (409 on a concurrent change, e.g. the agent adding a rule) instead of clobbering.
## [Unreleased] — Claude Tag parity (2026-06-25)
A milestone informed by Anthropic's "Claude Tag" (`comparison-claude-tag.md`): adopt what fits a
confined local daemon — observability, memory, scheduling, light ambient — while deliberately NOT
copying cross-channel auto-memory.
### Added
- **Scope self-check on boot** — the daemon compares the installed app's live bot scopes (read from
Slack's `x-oauth-scopes` response header on `auth.test`) against `slack-app-manifest.json`. When a
required scope is missing it logs a warning and DMs every admin the exact "add these + reinstall"
list, throttled to once per change in the gap. Because it runs on every boot it also fires right
after `update_gateway`, so an upgrade that needs a new scope announces itself instead of silently
half-working. (`src/slack/scope-check.js`.)
- **Usage ledger** — one normalized record per run (`usage-YYYY-MM.jsonl`) across interactive,
scheduled, and background runs: engine, model, tokens, cost, duration. Daemon-side only
(unreadable from a gated folder). Codex cost is estimated when an admin sets a `$/1M-token` rate.
- **Audit admin tab** — monthly totals, per-channel rollups, and a recent-runs feed over the ledger
+ run logs (`GET /api/audit`, `GET /api/audit/events`). Visibility only — no spend cap.
- **Background-job durability** — jobs persist to `config/bg-jobs.json`; on restart a live job is
watched to completion and a job that exited while the daemon was down gets an "interrupted by
restart" continuation, so a thread never silently stalls. (Closes the Slice 7 known gap.)
- **Live TODO checklist** — the agent's own TodoWrite plan renders as a ✓/◐/○ checklist, edited in
place and left in the thread as a record (previously discarded).
- **Folder-scoped agent memory** — an opt-out `MEMORY.md` per channel folder that the agent reads
and updates across that channel's threads. Single-folder (no cross-channel bleed); Claude's global
auto-memory stays off. Non-bash channels get only a narrow `Write(MEMORY.md)` permission.
- **One-time ("run at") schedules** — `create_schedule` accepts `in_minutes`/`run_at` to fire once
and auto-delete (e.g. "remind this channel in 2h").
- **Scheduler guardrails** — minimum recurring interval (admin setting, default 60 min) rejects
runaway crons; per-channel enabled-schedule cap + a tick concurrency ceiling.
- **Provenance preamble** — each turn tells the agent who requested it and where (metadata, not an
instruction), so it can address people correctly.
- **`@bot status` / `/status`** — a compact report of a channel's live background jobs, scheduled
work, and warm/in-flight sessions.
- **Per-channel org-default token opt-out** (`meta.noDefaultTokens`) — a sensitive channel refuses
the broad gateway-wide tokens; channel/user tokens still apply.
- **Dynamic assistant suggested prompts** — derived from the bound channel's MCP servers + skills
(and refreshed on context change) instead of two hardcoded lines.
- **Opt-in no-response nudge** (`meta.nudges`) — one gentle reminder in a thread that has gone quiet
past a window (default 24h). Strictly single-thread; never scans other channels.
- **App Home tab** — a read-only orientation dashboard (your access level, channels the bot works
in, admin-UI link). No secrets.
### Changed
- The in-progress **activity log collapses** to a one-line summary on completion instead of being
deleted, leaving a compact record above the answer.
- Slack app manifest: `home_tab_enabled`, `app_home_opened`, and the `/status` slash command.
## 2026-06-23
- Embedded **Toolbox MCP** with user / channel / org-default tokens.
- **Org-default** Composio / Skills tokens as the final fallback (channel → user → org).
- **Per-channel clean mode**: run bare for the lowest token cost (no MCP servers, skills, or
favorites block) — closest to the model's base prompt.
- Background-jobs **auto-continue** shipped (Slice 7): the daemon owns long shell work and re-injects
a continuation turn into the same thread when it finishes.
- **Multi-agent hygiene**: the 🤖 mention-reaction only auto-engages this agent in threads it owns.
- Settings split into 5 sub-tabs; clarified channel-access wording.
## 2026-06-22
- **Trusted bot apps** allowlist — let integrations (e.g. Make.com) trigger runs despite carrying a
`bot_id`, still requiring a real @mention from an approved user.
## 2026-06-18 – 2026-06-19
- **Interactive permission approvals** in Slack (approve once / for this thread / forever / deny).
- **Per-channel modes**: Allow Bash (sandboxed shell + file edits), Allow Network (sandbox egress
for `git push`/`gh`), Auto mode (autonomous, prompts auto-approved, still sandboxed); `/mode`
command + mode badge.
- **Codex** engine integration matured: sandbox mirrors the channel mode; auto-fallback to Codex
when Claude hits its usage/session limit; per-channel + per-thread engine selection via a
`claude`/`codex` message directive.
- **Replies as plain Slack mrkdwn** (tables → code blocks, `##` → bold) — fewer "Show more" folds.
- **Mention-by-reaction** (react 🤖 to treat a message as a mention; configurable emoji).
- Admin UI redesign: left sidebar + master-detail Channels/DMs; channel detail sub-tabs.
- Cron schedules gained per-schedule notify targets + a "Running: <title>" announcement with the
result threaded under it.
- Resume footer shows a copyable `cd … && claude --resume` command.
## 2026-06-17 — v1.0.0 (foundation)
- **Core gateway**: Slack Socket Mode (@slack/bolt) across DM / group DM / public / private channels;
DM needs no mention, elsewhere requires an explicit @bot mention; spawns headless `claude -p` in a
per-conversation **gated folder** (filesystem sandbox, MCP allowlist, persistent memory off).
- **Thread-scoped sessions** (new thread = new session; replies resume) + a **warm session pool**.
- **Per-user Composio token** injected per message author at spawn (`x-consumer-api-key`) — never
shared, persisted to channel settings, or logged.
- **Approval-based authorization**: admins + approved (MakeItFuture-list) users; unknown users denied
everywhere unless granted per-channel.
- **Admin web UI + REST API**: per-channel allowedUsers / allowedMcps / skills / mode; per-user
tokens (write-only, masked); Settings page for Slack tokens, keepalive, MCP URLs — applied live
with no restart.
- **Channel cron schedules** via a scheduler MCP tool; **admin MCP tools** to manage a channel's
allowed servers, working folder, and modes from chat.
- **Image/file attachments** downloaded into the gated folder for Claude's Read tool; native Slack
**Assistant status** shimmer; **stop**/`/stop`/stop-reaction to interrupt a run.
- Per-channel **Agent instructions** (`CLAUDE.md` + `AGENTS.md` symlink); Skills Manager favorites
injected into `CLAUDE.md`; visible working folders under `~/Slack Agent/<channel>`.
- Optional **admin-UI password**; one-command installer; encrypted config **backup/restore**;
**launchd** service with `npm run update`.