Changelog

All notable changes to CoWork OS will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

Added

• Android phone control: select a connected Android phone or emulator in Settings, install its pinned phone-harness runtime, and approve screenshots and individual input actions. Durable device locks and receipts support recovery without replaying uncertain input. Stop cancels pending approvals and discovery; unreadable security data blocks input, busy screens retain screenshot access, and stale visual targets require a fresh observation. Human approval waits run outside the adapter execution deadline. See Android phone control.

• Private browser login, 2FA, and checkout autofill: private dialogs support saved or one-use logins, 1Password/Bitwarden CLI unlock, verification codes, addresses, and local payment cards. Saved codes require native approval; every card fill requires native confirmation and agent fills also require fresh approval. CVCs are never saved, and filling never authorizes an order. Agent capture and native control pause around private input and filled documents. Available in the local Browser Workbench; see setup, safeguards, and validation limits.

• macOS terminal installer: curl -fsSL https://raw.githubusercontent.com/CoWork-OS/CoWork-OS/main/scripts/install-macos.sh | bash installs the released app without the Gatekeeper "Apple could not verify" dialog that the DMG triggers on first launch. Browsers attach the quarantine attribute that drives that dialog for the ad hoc signed build; curl does not. The installer verifies the ZIP's size and SHA-512 against the published updater metadata and the app bundle's code signature before copying it into Applications, re-runs as an updater, and refuses Intel Macs and older macOS versions with a pointer to npm. The macOS release smoke test now installs each build's ZIP through it. See macOS Installation.

• Today on the Calm home: Home shows what needs you as one card per decision, most pressing first, then what was handled. Approvals open their own review dialog in place, questions with plain options are answered on the card, paused sessions say why they stopped, commitments can be marked done, and suggestions can be started (the exact prompt is shown first), edited, dismissed or kept as a commitment. Commitments memory closed because they looked done are listed with Undo.

• Needs-you queue: one ranked list of approvals, questions, paused sessions, waiting flow steps, due commitments and suggestions. Today, the bell, the session panel's Needs you badge, the Bots page and Mission Control's Brief all count it, and paired browsers read it too.

• Work and Team views (Calm): Work lists every session by project with filters, collapsed repeated runs and the next decision for each. Team shows agents, bots, scheduled tasks, automations and devices as teammates, with what each waits on you for.

• Calendar cards: with Google Workspace connected, Today shows conflicts (decline the later event when you were invited to it), private focus holds before commitments are due, and meeting prep. Every change re-reads the calendar first. A suggestion about making time can hold a free stretch.

• Reply drafts on Today (opt-in): up to three drafted replies a day to mail that needs one, with Send through the outbox (undoable until it goes out), inline Edit, Discard, and Retrying or Not sent states when a send fails. See Inbox Agent.

• Agent access limits: May do alone in Team gives an agent an access-profile limit that only narrows what its sessions, their child tasks and the schedules they create may do. Sessions stop instead of running unlimited when the limit's profile is unavailable. See Access Profiles.

• Background app control (native_app): CoWork can operate an installed macOS app's windows in the background, without taking focus and without moving your pointer or touching the clipboard. It launches apps without activating them, observes one exact window, acts through accessibility actions or input sent only to that app, and pauses if you are using the app. Every action is journaled and never resent automatically, and success is judged from a fresh observation. See Working with apps in the background.

• Remote MCP servers with OAuth sign-in: Settings > MCP Servers > + Add Server > Remote (OAuth) connects OAuth 2.1 MCP servers such as Workday Agent-Ready Tools, signing in as a person (PKCE through an http or https loopback redirect) or with an agent key (JWT bearer) for headless use. Tokens renew on their own, servers with more than 25 tools load them on demand through tool_search, and tool names shared by several servers are namespaced. Edit changes a saved server without removing it, and Cancel stops a sign-in that is waiting on the browser. See Remote MCP OAuth.

• Workday agent setup in the app: Agent setup on a Workday server row signs in with a Workday admin API client and registers or updates the external agent CoWork signs in as, from the tenant's tool catalog. See In-app Workday agent setup.

Changed

• MCP approvals show the call: the approval card for a remote MCP tool names the server and shows the call's arguments exactly as they will be sent, instead of "access the requested resource".
• Mission Control: the header's agents link opens Team in the Calm theme and the Bots page otherwise; the Agents tab and agent detail view are removed. Brief's need you count and Needs You section read the needs-you queue, and Mission Control's own flags are listed under Flagged.
• Calm session panel: keeps pinned items, projects and the five most recent sessions; All work opens Work. Devices moved into Team in the Calm theme.
• Outbox: undoing a send (from Today, a compose card or the Inbox) returns the draft to editing instead of discarding it, and is refused once the outbox has picked the send up. A draft that is already queued or being sent can't be sent again, a send cancelled after the outbox picked it up no longer goes out, and discarding cancels a queued send first.

Removed

• Everyday Agent: discontinued the Everyday page, Settings tab, Home card, Mission Control focus, everydayAgent admin-policy section, everydayAgent.* Control Plane and browser-host methods, IPC channels and shared types. Its compiled policy was never read by the task runtime. Upgrading drops the everyday_agent_* tables. See the decision record.
• R&D Council: discontinued the Settings > Automations > R&D Council sub-tab, the Council owner and runs in the Automation Studio Library and Activity views, the council:* IPC channels, the councilMode task fields, the Council synthesis prompt and the Council cron bridge. Upgrading drops the council_* tables; a scheduled task a Council created is turned off until its prompt is rewritten. See the decision record.
• Twitch channel: discontinued the Twitch IRC adapter, its settings page, the addTwitchChannel paths and the Twitch channel guide. Upgrading deletes a leftover Twitch channel with its stored OAuth token, pairings and channel message log; tasks it created stay in task history, and scheduled tasks that delivered to it keep running with delivery turned off. Revoke the bot's access on twitch.tv under Settings > Connections. The gateway now supports 18 channels. See the decision record.
• Infrastructure tools: discontinued the native E2B cloud sandbox, Namecheap domain, USDC wallet, x402 payment and Coinbase signer tools, the Settings > Integrations > Infrastructure sub-tab, the sidebar wallet badge, the infra:* IPC channels and the e2b and ethers dependencies. Upgrading deletes the Infrastructure settings row but keeps the encrypted wallet key; move funds out before upgrading. The MCP x402_fetch spend guard stays. See the decision record.
• X integration: discontinued the X mention bridge, the x gateway channel, the x_action tool and its browser scripts, the X settings page and the x:* IPC channels. Upgrading deletes the stored X cookies and mention-trigger settings and a leftover x channel with its stored credentials, pairings and channel message log; tasks it created stay in task history, and scheduled tasks that delivered to it keep running with delivery turned off. Revoke the app's keys and tokens in the X developer portal. The read-only x_search tool and the bird and twitter skills stay. The gateway now supports 17 channels. See the decision record.
• First-task beta: discontinued the flag-gated first-run screen, the bundled release-brief-v1 sample mission and its packaged checker, the real-work feedback prompt, the firstTask:* IPC channels, the internal release_brief_sample access profile and the sample task source. Upgrading drops the first_task_* tables. See the decision record.
• Discord supervisor mode: discontinued the worker/supervisor protocol service and exchange store, the supervisor section of the Discord settings page, the supervisor channel config, the supervisorExchange:* IPC channels, the supervisor_exchange activity type, bot-message forwarding in the Discord adapter and the SUPERVISOR.md workspace kit file. Upgrading drops the supervisor_exchange* tables. See the decision record.
• Supermemory: discontinued the external memory provider: the service and remote-copy store, the prompt-time profile section, the external recall lane and tool scope, the external write target and external_only approval mode of the memory write gate, the Mission Control recall source, the Memory Hub Connections card and Sources row, the supermemory:* IPC channels and the guide. Upgrading deletes the stored API key and settings and drops the supermemory_remote_refs table; mirrored copies stay in your Supermemory account. See the decision record.
• Chief-of-staff engine, standup reports and performance reviews: discontinued the chief-of-staff engine (world model, action policies, pending interventions, the Heartbeat autonomy pulse phase, the chief-of-staff items of the daily briefing, the Proactive switches and details in Settings > Memory, the autonomy:* IPC channels), Mission Control's Standup and Reviews header buttons with their viewers, the report services and the standup:* and review:* IPC channels. Upgrading deletes the stored chief-of-staff state and drops the standup_reports and agent_performance_reviews tables. Awareness signals and beliefs, Heartbeat, Dreaming, Review and Suggestions are unchanged. See the decision record.
• Comparison mode, Multi-LLM judge mode and Workflow Pipeline: discontinued Agent Comparison sessions (service, store, comparison:* IPC channels, task field and sidebar badge, Worktree settings section), Multi-LLM judge mode (the composer and Devices toggles and model panel, the multiLlmMode/multiLlmConfig task options, the judge lanes and synthesis in the team orchestrator, the multi_llm_mode run flag) and the Workflow Pipeline (the useWorkflowPipeline option, the per-phase child-task branch, the workflow_phase_*/pipeline_* events). Upgrading drops the comparison_sessions table and its triggers. Collaborative mode, /multitask, agent teams, Mixture of Agents and the Workflow Decomposer's sequential guidance are unchanged. See the decision record.
• Advanced execution overrides: discontinued the composer's Advanced… menu and the Execute, Analyze, Debug and Verified pins; Plan is now the third work choice next to Ask and Do, the pinned override type and its validation accept only plan, and the mode suggestion bar proposes only Plan or a collaborative run. The runtime still chooses analysis, verification and debugging strategies under Do. Saved sessions with a folded pin display as Do; no data changes. See the decision record.

Fixed

• Android workflow continuity: pending operation IDs/status and the latest approved observation now remain available across task steps. Loop wrap-up guidance distinguishes planned input from executed work and keeps unknown-effect reconciliation explicit.

• Restored Android sessions: a generated title containing “Search” no longer hides an explicitly requested Android workflow behind the read-only review heuristic. Host desktop tools and explicit tool restrictions retain their existing limits.

• Android completion after long workflows: completed input readbacks remain verified historical observations instead of expiring after 60 seconds while later steps run. The final screen still requires fresh evidence; other application routes keep their expiry rules.

• Android stale-input recovery: a proven stale no-dispatch attempt can be explicitly superseded by the same action and criteria using a fresh observation and approval. Failed attempts remain auditable without leaving successful replacements marked as partial success; uncertain or dispatched effects cannot be superseded this way.

• Android search workflow: approved observations identify the focused native editor so typing can avoid redundant stale coordinate taps. Post-action criteria explain delegated Android packages, and Settings search no longer triggers an unrelated web-research evidence requirement.

• Android screenshot deliverables: approved phone screenshots now return linkable task-workspace PNGs and verified file evidence, so the model can include them in its answer and artifact checks can find them. Private captures retain their separate cleanup policy; screenshot existence does not certify an Android business outcome.

• Finished sessions were listed as waiting for you when their last approval had timed out.

• Paused session cards said only "Paused"; they now say why the session stopped.

• Reading the needs-you queue counted suggestions as shown, skewing suggestion ranking.

• Mission Control's Work board flagged completed and cancelled tasks as needing attention ("Needs owner", "Waiting on you", "Overdue") and counted them as overdue in the Done column and the summary. They now show their due date plainly. Failed and interrupted runs are still flagged.

• Mission Control's Work board showed New task and Link existing under each column, but they only opened an empty detail panel. They are gone: every task in the workspace is already on the board, and new work started from the composer appears on it by itself.

Security

• Reassigning a session to another agent requires permission to manage that session and is recorded in the session audit with the access-limit change it makes.

0.5.60 - 2026-10-07

See Release Notes 0.5.60 for the upgrade notes and a summary. Versions 0.5.55 to 0.5.59 were skipped.

Added

• Interactive answer components: replies can include native, interactive components between the prose: photo collages, menu rows, tiles, label/value lists, metrics, tables, charts, checklists, and steppers, sliders, selects and toggles that drive live calculations. Values you change are saved per task and given to the model in your next message. Photos are looked up by description (a configured SearXNG first, then Openverse and Wikimedia Commons; a paid search provider only as a last resort), through the network policy, and cached on disk. Channels, the CLI, notifications, search, Copy and Speak get a plain-text version. On by default; set COWORK_ANSWER_SURFACES=0 to turn it off.

• New sidebar: an icon rail (Home, Inbox, Agents, Automations, Library, and More, whose items can be pinned) with Cmd/Ctrl+number shortcuts and reordering by drag or Alt+Up/Down, plus a session panel with always-visible search (Cmd/Ctrl+K), Running and Needs you filters, collapsible day groups and a separate section for automated sessions. Settings opens inside the app shell, and the open session's title and breadcrumb appear in the navbar with back/forward history.

• Sandboxed web previews: HTML artifacts are served from an isolated cowork-preview:// origin with a strict content security policy, and every dependency is checked against the access profile. The new preview_web_page tool renders a workspace page offline, runs clicks and typing, and returns a screenshot, visible text and console errors. The Build view adds attachments, a persistent draft, recent builds, an auto-opening live preview and a per-file changes panel.

• Redesigned task feed: steps stay visible during and after a run, grouped by turn, with one-line activity rows, file rows with created/edited line counts and the agent's progress commentary next to tool calls. Selecting text in a message opens a reply popover, and a model source picker replaces the advanced model list. API, daemon and CLI tasks get generated session titles; a title you set is never overwritten.

• Calm visual theme (opt-in): a third visual style under Settings > Appearance > Visual style with a cool-neutral palette, a Home screen with an Ask / Do switch, and simplified sidebar, Library and Build views. Modern stays the default.

• Automation Library and Add Tools: Automations has a Library that lists routines, flows, schedules, triggers, webhook rules and Councils once each, and Settings > Add Tools browses connectors, MCP servers, plugins and skills in one place.

• Per-task cost panel: the task panel's Cost section shows spend so far, the cap that applies and token counts, and becomes the receipt when the task finishes; before any usage it shows the typical cost on the selected model. Usage Insights counts unpriced calls separately. Model prices and context limits come from a bundled models.dev snapshot; models with no known price are reported as unknown instead of free.

• New models and providers: GPT-6 Sol, GPT-6 Luna and GPT-6.1 Sol on OpenAI and Azure OpenAI (Responses API, with reasoning effort including "none"); OpenAI's official Sign in with ChatGPT, billed to your ChatGPT plan, with plan detection and a model recommendation (the older Codex sign-in stays as a fallback marked unofficial; image generation is not available with it); the oMLX local provider; and context sizing for the Opus 4.7+ tokenizer and 1M-token windows.

• Prompt caching on more routes: ChatGPT subscriptions, OpenRouter (including Qwen and DeepSeek), Bedrock Claude and Pi-backed routes, with cache reads and writes recorded for usage and cost.

• More ACP runtime agents: Gemini CLI, OpenCode, Qwen Code, Kimi CLI, Cursor, Copilot, Droid and Pi alongside Codex and Claude Code.

• WhatsApp Business and Twilio SMS channels: WhatsApp Business (Cloud API) with signed webhooks, a durable inbound queue with retries, delivery receipts and a template fallback outside the 24-hour window; Twilio SMS/MMS with signed webhooks and delivery receipts, where carrier keywords such as STOP and HELP are recorded and not sent to the agent.

• Teams meeting transcripts, Home Assistant and Google tools: Teams transcripts can be saved as local meeting artifacts the agent can read; a Home Assistant connector calls services only for allowlisted domains and entities; optional read-only Google Contacts and Google Meet tools and a maps timezone tool.

• Codex computer use: an installed Codex/ChatGPT Computer Use plugin can be connected as a local MCP server for native GUI tasks, with per-task consent. MCP servers can ask for a yes/no decision during a tool call; requests that collect data or open URLs are refused.

• Project instructions in every workspace: a repo-root AGENTS.md (or CLAUDE.md if there is none) is added to the agent's context even without a .cowork kit, with its own 20,000-character budget; the workspace rules budget rises from 16,000 to 24,000 characters.

• MCP 2025-06-18 results: embedded resources, resource links and structuredContent in MCP tool results now reach the model.

• Opt-in shared browser preview: browser clients can use the desktop interface through an opt-in web preview scoped to a workspace, while provider credentials and execution stay on the desktop host. It is a preview without full desktop parity.

• CSV arithmetic checks: reports built from CSV data have totals checked with exact decimal arithmetic against the source rows. The spreadsheet skill accepts a headers list plus rows, and new motion-film and motion-editor skills are included.

• Categorized import from other AI assistants: Settings > Memory > Import > From another assistant gives you a prompt to paste into ChatGPT or another assistant, then reads its answer by category (Instructions, Identity, Career, Projects, Preferences) and saves each entry as the matching kind of memory, private by default. When the other assistant says there is more, the dialog offers Import the rest.

• Keychain cleanup: npm run keychain:cleanup removes CoWork-only Keychain items that no longer decrypt any stored setting (dry run by default).

• Bot work and responsibilities: every bot has a Work view (Needs you, Working, Scheduled, Results) that also covers delegated work. Give a bot a responsibility with a selected trigger, sources, mode (Observe, Propose, Act within granted scope), review boundary and budget; it saves paused, previews its next run and runs only when activated. Unchanged sources stay quiet and call no model. Stop a turn, stop a bot's active work, or pause and resume its future runs with durable receipts. Results show recorded outputs rechecked against the current files. Opt-in inbox/desktop notifications with quiet hours and digests, and Slack/Teams decision cards for the owner's private requests. See Bots and conversations.

• Bots page and characters: the Agents view opens on a Bots page with what your bots need from you, what is running and what is scheduled, each bot's status and next run, and templates that start a new bot. Every bot is drawn as an illustrated character whose eyes follow its state. A bot chat asks for approvals inline ("Allow for this chat" for read-only web lookups) instead of failing closed.

• Shared notes for agents working on one goal: when a task hands work to sub-agents or a team of agents, they now share a notes folder in your memory folder (swarms/…). Each agent can record what it measured or ruled out (with sources), ask the others a question and answer one, and every agent on the goal sees the latest notes before each step, so work is not repeated. Verifiers can read the notes but not write them. The notes are kept separate from what CoWork knows about you (they are not shown in What CoWork knows and Dreaming ignores them), are screened for secrets like every memory write, and are removed when you delete the task that started the work. Needs the memory folder. See Memory Repo Phase 5.

• Import notes into the memory folder: Import notes from a folder… in the Memory folder card brings over notes from another agent's memory folder (same Agent Memory Repo format) or any folder of markdown notes. The folder is only read; its notes land in the unreviewed inbox, screened for secrets and deduplicated against what your memory already holds. In What CoWork knows, Keep an imported note as yours (about you, a lesson, or this workspace), Pin it, or Delete it; Dreaming leaves imported notes for you to decide. See Memory Repo Phase 5.

• Memory folder sync and team memory: in the Memory folder card, add the URL of a private git repository you own and confirm it is private and yours to keep the same memory on each of your machines. CoWork pulls on start and every 10 minutes and pushes after changes (or when you press Sync now), using your own git credentials (credential helper or SSH agent); it stores none, and dream review branches stay local. A conflict pauses sync until you resolve it. Under Team memory, add up to three memory folders your team shares (for example one you cloned): CoWork reads them next to your own memory, optionally only in one workspace, and never writes them; folders with a remote are updated when they have no local edits. Health shows both. See Memory Repo Phase 4.

• The memory folder is now where CoWork keeps what it knows about you: it is turned on for everyone (once; you can turn it off in the Memory folder card), existing facts are copied in, and the old copies are retired with an encrypted backup in backups/. What CoWork knows in Settings > Memory now shows the folder's notes by file, with Edit, Delete, Pin and Open file; commitments and notes about other people stay where they were. Onboarding, the Memory Hub, imports and "Promote to memory" all write to the folder. See Memory Repo Phase 3.

• Dreaming for the memory folder: about once a day (or when you press Dream now in the Memory folder card), an AI pass reads your memory folder and recent tasks, merges duplicates, removes stale notes, moves notes to better files and saves what you told CoWork that it had not saved yet. Changes to notes the agent wrote are applied as one commit you can Undo; anything that touches your own notes, MEMORY.md or the untrusted inbox waits in Settings > Memory > Review as a diff you accept or reject. It uses your model provider and costs tokens (up to 50,000 a day by default); turn it off in the Memory folder card. See Memory Repo Phase 2.

• Memory folder: CoWork keeps what CoWork learns about you and your workspaces as plain markdown notes in a local git repo (~/CoWork Memory by default), in the open Agent Memory Repo format. The agent reads the folder and saves to it as it works (each change is a commit you can inspect); you can open and edit the notes in any editor. What the agent saves after reading web pages, email or other untrusted content goes to an unreviewed inbox.md that is never put in prompts. Compact history removes old versions so deleted memories are really gone. See Memory Repo design.

• Use-case gallery: "See how people use CoWork OS" shows ready-to-run prompts in Tasks, Build, and Bots tabs, centered over the composer with a blurred backdrop. Open it from the welcome screen, Build, or the new sidebar notice. It covers every former Ideas workflow.

• Sidebar notices: one dismissable notification area in the left sidebar, above Automated sessions, with a first-show animation. See Sidebar Notices.

• Memory Hub Sources and Health tabs: Sources shows where CoWork's memory comes from (you, the agent, Dreaming, imports, other people, Chronicle, Supermemory, the knowledge graph) and opens the matching facts; Health runs the memory health checks with PASS/WARN results and a Refresh button.

• AI memory compression is on by default: long memories get a one-line summary from your configured model and related ones are grouped into digests. It costs tokens: up to 20,000 a day across all workspaces (adjustable in Settings > Memory). Turn it off per workspace with AI memory compression. Private memories are never sent.

• Wider Mission Control recall: recall also searches your memory items and, when connected and network access is on, Supermemory; older tasks and activity are found too.

• One memory store and the Memory Hub: facts about you and your workspaces live in one local store, managed in Settings > Memory > What CoWork knows (where each fact came from, add, edit, pin, delete, clear global memories). A Review tab lists Dreaming's proposals and recent changes with Undo, and each chat reply can show the memories it used (Memory used). See Memory Engine.

• Memory health and evals: npm run qa:memory-evals (also run by qa:harness) checks recall quality, write hygiene, injection and privacy leaks; npm run qa:memory-health prints read-only aggregate counts for a profile. See Harness Eval Battery.

• Your account on a channel: each channel's settings has Your Account on This Channel. Messages from other senders no longer shape your profile, response style or stated facts. See Channels.

• Background processes: run_command can start dev servers and watchers in the background, with process_output and stop_process to read and stop them; processes stop when their task is cancelled, deleted or idle.

• Anthropic extended thinking: adaptive or budgeted thinking and effort per model, with thinking blocks replayed unchanged across tool calls to the same model.

• Local model tool calls: tool calls that local models write as text are run as real tool calls, with a text-protocol fallback for servers that reject native tools.

Changed

• Chat and Smart are now Ask and Do: the work choices are renamed in every composer; what they do and the stored values (chat, smart) are unchanged.

• Database work moved off the main thread: SQLite runs in worker threads in the desktop app, daemon and CLI, so long queries no longer freeze the window. It is on by default; set COWORK_DB_WORKER=0 to return to the previous path. 0.5.54 can still open an upgraded profile. See Troubleshooting.

• Agent defaults: Docker sandboxes use node:24-bookworm with 4 GB of memory (was node:20-alpine with 512 MB); shell commands always run sandboxed when shell networking is off; tasks are capped at $10 by default (subscription-billed routes skip the global cap, and a task's own budget can only lower it); rarely used tools are deferred and found with tool_search.

• Scheduler and updates: Routines and Scheduled Tasks show where a schedule runs (desktop or daemon), its state, time zone and next wake, and validate cron expressions on save. Update results say whether they are live or cached, and a source checkout is compared with origin/main within 15 seconds.

• Pulse consent after the first task: CoWork asks once, after your first successful real task, instead of during setup; the anonymous update check no longer depends on the answer. Turning Pulse off keeps a retryable deletion request until the collector acknowledges it.

• Researcher tasks: researcher child tasks are limited to local inspection and can no longer use external services or the browser.

• Full access confirmation: switching to a Full access profile or the bypass-permissions mode shows a confirmation dialog.

• Mermaid 12: diagrams use ELK layout and a new default look, so existing flowchart, state and class diagrams may render differently.

• Memory settings are short and clear: Settings > Memory > Settings now has five short sections, each saying whether it applies to this workspace or all workspaces: This workspace (Use memory, Learn from chats, Strict privacy, Keep history for, Clear), Memory folder (folder, Dreaming, Sync, Team memory), Import, Connections (Supermemory, and a link to Chronicle, now only in Settings > Tools) and Proactive. Everything else, including AI memory compression and its budget, is under a collapsed Advanced. The privacy mode "Disabled" is now the Use memory switch. The imported-memories and Chronicle-observations lists moved to the Sources tab. Removed: the empty Pending memory writes card, the Memory inspector switch (the inspector is always in Advanced) and duplicate controls.

• Memory reviews notify you: when a dream leaves changes for you to accept or reject, CoWork shows a notification ("Memory: 1 change to review"); clicking it opens Settings > Memory > Review. Notes a dream learns for a workspace now always land in that workspace's file (a file it created without the workspace link is repaired on the next save).

• Bots are user configuration only: CoWork no longer installs a named bot roster, rewrites bot instructions at startup, or attaches bots to a default team. Existing bots, teams, membership and history are kept as they are.

• Feedback reasons are saved to your memory folder: when you reject or edit a reply and say why, the reason is saved as a correction in the workspace's memory folder file (a repeat updates the same note) instead of the generated section of .cowork/MISTAKES.md, which is removed once (your own text stays). Only your own feedback counts, not feedback from others in a channel. With the memory folder off, MISTAKES.md is updated as before. The automatic per-task milestone list in .cowork/LORE.md is retired and removed once; milestones the agent records with update_lore are kept as plain lines.

• Retired: the CoWork-generated sections in workspace .cowork/USER.md and .cowork/MEMORY.md (removed once, with a .history snapshot; your own text stays), topic packs, daily summaries, the old rule-based memory curator and its "Run Dreaming now" (the memory folder's dreaming replaces them; finished commitments are still closed automatically), and the automatic fact pipelines from awareness beliefs and the core-memory distiller. Your name and response style now live in Personality settings; a style you choose is never overridden by adaptive style.

• The agent saves what it learns as it works: memory_remember is available in every plan step (it used to be offered only in steps planned for it, so the agent almost never saved anything), and its guidance says when to save: preferences, corrections, decisions, project facts and hard-won lessons you would otherwise repeat. Facts the agent saves on its own are recalled when relevant but not added to every prompt, and it cannot pin them; pin or edit them in Settings > Memory > What CoWork knows to keep them in every prompt.

• Kit files and memory stay in step: hand edits to .cowork/USER.md and MEMORY.md sync back into memory shortly after you save. The desktop app and the node daemon no longer both rewrite workspace kit files (CROSS_SIGNALS.md, MISTAKES.md, LORE.md): one process owns them and the desktop app takes over when it starts.

• Memory housekeeping: old superseded memory revisions are pruned after 180 days (the newest five per fact and anything still undoable are kept); shutdown waits briefly for memory work in progress; startup quiet mode no longer starts memory cleanup or kit writers.

• Four memory tools: memory_recall, memory_remember, memory_forget and context_recall replace the 16 earlier memory tools (search_memories, memory_save, memory_curate, supermemory_*, context_grep and others), which are removed; skills or prompts that name them must switch. memory_forget asks before deleting a memory.

• Every memory source follows the same rules: ChatGPT and pasted imports, core memory candidates, Chronicle and Supermemory writes pass the same redaction, <no-memory>, privacy-mode and duplicate checks; re-importing adds nothing, and screen text never becomes a fact about you.

• Legacy memory data retired: after the one-time migration, the old curated, profile and relationship stores are exported to an encrypted backup (backups/legacy-memory-*.json.enc in the app data folder, OS keychain) and removed.

• Smaller, faster memory storage: raw tool telemetry is no longer archived; a one-time cleanup removes telemetry and duplicate rows, leftover secrets and orphaned embeddings; settled memory-write approvals are pruned after 30 days; excluded markdown index rows are purged. Foreign-key child indexes make task and temporary-workspace deletes fast, so startup no longer stalls on the temp-workspace prune.

• Prompt caching on OpenAI and ChatGPT routes: when a route rejects optional cache fields, CoWork steps down one caching tier instead of turning caching off, remembers the rejection per route and model for the session, and logs cached-token usage.

• Defaults that limited the agent: shell networking and per-command unsandboxed approval are on by default; policy asks show the inline Deny / Allow once card in interactive tasks instead of being denied (unattended runs still deny, and cards time out after 5 minutes); new workspaces can delete inside the workspace; the token budget is 2M per user turn, the iteration limit 500 with auto-continuation, web search 25 per task; run_command accepts timeouts up to 30 minutes and execute_code up to 300 s; Docker sandboxes use a fuller image with more memory; sub-agents inherit the parent's model; Gemini receives images; high-risk code and operations tasks get automatic review; stale default models are updated.

• macOS sandbox: git, /dev/null, toolchain caches and installs, TLS and proxy settings work inside the sandbox, and files and folders can be removed or renamed in the workspace, while credential stores, .git and policy files stay protected.

Fixed

• Collaborative team runs: the synthesis step of a collaborative team run is dispatched again (runs had been closing with "Synthesis timed out" after their lanes finished), and read-only research lanes no longer loop on steps that seemed to require writing.
• Markdown rendering: numbered and bulleted lists in replies are no longer split at a number or bullet at the end of a line, and list, heading, bold and # normalization no longer changes text inside fenced code blocks.
• Cancelling web fetches: cancelling an unread response body no longer throws an uncaught "Controller is already closed" error; a connection dropped mid-body is reported as such instead of as a timeout.
• Lost edits: two concurrent edit_file calls could silently lose one edit; exact replacements are now rebased, conflicts are reported, and before/after copies are kept for failed or interrupted writes.
• Task outcomes: edit steps on explicitly named files no longer fail by requiring write_file; a completed task no longer marks outcomes satisfied when a declared output is missing; a crash during graph dispatch can no longer dispatch a child twice; a follow-up sent as a turn ends is processed instead of waiting for a restart.
• Bot delivery: bot replies and handoffs wait for durable delivery, keep their order, survive restarts and are no longer timed out while queued; creating a bot with a previously used name gives it a numbered handle; opening a bot from a temporary workspace no longer creates empty conversations.
• Scheduled runs: persisted runs are reconciled on startup and periodically, so runs are not duplicated and finished tasks deliver their outcome.
• Temporary workspace pruning: pruning follows database references, so temp workspaces are removed again instead of failing on every startup.
• Blank window: parallel group feeds and returning from a full-screen artifact or browser no longer blank the window; the Integrations page no longer crashes.
• Settings that can't be decrypted: they are backed up as ciphertext and replaced on the next save instead of blocking it, and settings encrypted under older macOS Keychain identities are migrated (macOS may show a Keychain prompt once).
• Duplicate macOS notification icon, the sidebar crowding narrow windows, CSV saves changing line endings, and direct CLI runs ending when the app window is hidden are fixed.
• macOS sandbox under /private/tmp: sandbox rules work for workspaces under synthetic mounts.
• Memory summaries and search: summaries, search results and the Inspector no longer show the same first line for screen-context, compaction and imported memories; existing memories are re-indexed once in the background, and the storage cap now counts search data and metadata. Searches in any language (Cyrillic, Greek, Turkish, CJK) match notes, mail and YouTube transcripts.
• Everyday Agent "Delete local data": clears only the memory candidates the panel shows, in that workspace, and keeps the distill history.
• Knowledge graph quality: technology extraction no longer turns words like "go", "rest" or "react" in prose into entities; names are case-insensitive (Go/go merged); free-mail and relay domains are no longer organizations; organizations are named after their registrable domain; automated senders are no longer people; manual and agent edits outrank automatic ones; automatic writes respect workspace memory settings and <no-memory>. A one-time cleanup removes the existing noise. See Knowledge Graph.
• Memory search and ranking: memory searches treat % and _ as literal characters instead of wildcards; matches imported from other workspaces rank below this workspace's own; one- and two-word searches score on the same scale as longer ones; updated observations no longer leave stale entries in the memory search index (rebuilt once on upgrade).
• Memory review modes and shutdown: with a memory-write review mode set (COWORK_MEMORY_WRITE_APPROVAL_MODE), facts learned from core memory candidates wait for review like other background writes; memory compression retries and the daemon's cross-signal and feedback writers stop cleanly at shutdown.
• Composer draft on quit: quitting saves the open composer draft before storage closes instead of failing with "The database connection is not open" and losing the latest draft text.
• Dev app Ctrl-C: stopping npm run dev with Ctrl-C quits the app cleanly instead of killing it mid-shutdown, so the next start no longer reports an unclean shutdown and the shutdown output is kept; press Ctrl-C again to force quit.
• Heartbeat history pruning: pruning no longer fails with FOREIGN KEY constraint failed on databases whose tasks.heartbeat_run_id link predates ON DELETE SET NULL; links to pruned runs are cleared first, so old run history is trimmed again.
• Browser reliability: visible-browser selector and ref actions verify they landed and fail clearly on stale or covered targets; the headless browser tracks popups and tabs, saves downloads into the workspace, reports dialogs, supports uploads and captures console and network logs.
• Blocked-command patterns: match dangerous commands and targets instead of substrings, so curl … | grep and rm -rf ./dist are no longer blocked.
• Agent tool feedback: failed shell commands now give the model their exit code and the tail of stderr/stdout instead of only exit code 1; run_command honors the executor's 120 s / 5 min budgets (approval time no longer counts), runs non-interactively, keeps the end of long output, and no longer re-runs a command after a persistent-shell timeout. Local commands that merely mention fetch, axios or a loopback URL are no longer blocked as shell networking.
• Reading and editing files: truncated read_file/read_files results report what was delivered and where to continue; repeat-read caching serves only the identical window; distinct edits and test re-runs are no longer blocked as loops; edit_file tolerates CRLF and numbered-view prefixes, points misses at the closest lines, and refuses to re-encode non-UTF-8 files; grep keeps partial matches, honors .gitignore, and glob matches Windows paths; web_fetch extracts PDF text, decodes declared charsets, and pages long results.
• Routing and step contracts: work follow-ups ("do it", "why is the test still failing?") keep tool access; questions about the user's project read the workspace first; refinements no longer wipe conversation history; coding and non-English requests route to execution; scoped prohibitions ("don't edit vendor/") no longer make tasks read-only or plan-only; equivalent tools satisfy step contracts; inspect-then-fix and fix-and-verify steps are not failed for doing the fix; test runs are required only on run intent and after the last edit.
• Loop control and completion: progress-aware stop nudges and follow-up locks, recovery after transient tool failures, nudges for steps that only describe an action, turn-limit warnings, a non-preemptive soft deadline, and a passing re-run required to clear a failed test. Completion checks count evidence from observed tools rather than wording, reject fabricated test reports and missing requested files, explain partial results, and no longer fail tasks when an independent verifier times out. A test command that failed and never passed again is named in the completion notes when the task only passed a different test command, and a task that asked for tests then ends as a partial success.
• Context and prompts: pinned memory/profile blocks no longer duplicate every turn; planner rules and the JSON contract survive the prompt budget; step context no longer claims earlier file contents are present; compaction keeps the newest work; overflow recovery stops retrying unchanged requests. Execution prompts add a coding workflow, drop contradictory persona/format rules and irrelevant routing text, state the platform and shell, and keep the cached prefix stable.
• Model providers: transient errors (Anthropic 529/500, connection resets, Bedrock throttling) are retried or failed over while quota errors fail fast; no assistant-prefill requests; reasoning headroom for small text budgets; tool calls are never reported as end_turn; Ollama gets an explicit num_ctx; refusals and content filters end cleanly; max_tokens truncation and output-cap 400s recover; LLM deadlines scale with the output budget; usage is counted consistently across providers.
• Browser, delegation and documents: headless navigation no longer auto-clicks arbitrary "OK/Continue" elements; missing selectors fail in about 15 s with candidate elements; page text is read from the rendered page with pagination; orchestrate_agents queues tasks beyond the active child limit; sub-agent extraction mode no longer triggers on words like "domain". Spreadsheets store numbers and formulas as real cells; presentations keep all content and never invent chart data; DOCX/PDF keep tables, lists and non-Latin text.
• Browser preview desktop isolation: restrict the preview approval notice and associated composer/sidebar behavior to browser clients, restoring native desktop presentation without changing approval settings. Full shared-runtime desktop compatibility remains unverified.

Security

• Signal channel command injection: signal-cli and ngrok commands no longer run through a shell, so message text and other arguments can't be interpreted as shell commands. On Windows, the signal-cli.bat launcher runs with quoted arguments and the message is passed on stdin; arguments cmd.exe could interpret are rejected. Reported by Tal de Vries (@tal2k9dev-star). Advisory: GHSA-ggwv-w8g3-mc75.
• Remote ACP agent credentials: credentials of remote ACP agents (authorizationHeader, bearerToken) are kept in encrypted secure settings instead of the agent card, and agent cards returned or broadcast over the Control Plane no longer include them. Registration fails instead of storing a credential in plain text. Existing agents are migrated the first time CoWork loads them (with the Control Plane on, or when a task uses remote agents); if a credential can't be stored, that agent is not called until it can. Without an OS keychain, the desktop app and coworkd encrypt them with an app-level key kept in the profile; the Node-only daemon does not run ACP.
• Remote ACP dispatch admission: work sent to a remote ACP agent now passes the tool policy, workspace and profile network policy and approval like local work; a denied or unapproved send fails with a visible reason before anything leaves the machine, prompts are redacted for secrets, and requests are DNS-pinned without following redirects.
• Connector blocklist enforced: the connectors.blocked admin policy was editable but not applied. Blocked MCP connectors are no longer started, tested, enabled, installed or called (including connections opened before the block, and requests waiting for approval), their tools are hidden from the agent, and changing the policy disconnects or reconnects servers immediately.
• PDF worker memory limit holds under heap flags: --max-old-space-size (in NODE_OPTIONS, on the command line or in Electron's --js-flags) is process-wide and overrode the PDF workers' memory limit, letting a hostile PDF use gigabytes before failing. The app now also watches each PDF worker's heap and stops it at its limit whatever flags the process runs with.
• ACP agents on Windows: npm .cmd shims are resolved to node.exe and run without a shell, so prompt text is not re-parsed.
• Researcher authority: researcher child tasks can no longer inherit bypass, shell or ACP authority from a parent, a caller override, a saved task or a recovered queued message.
• Keychain identity and credentials: a known value is checked against the OS keychain key at startup, and secure settings are not saved under a different identity; protected-credential requests without a task ID are accepted only from the local owner.
• Channel approvals and admin policy: legacy and webhook channel approvals can no longer unlock exact reviews; policy updates that weaken safety settings need confirmation in a native dialog; the acpx fallback is pinned to a reviewed version.
• Memory privacy hardening: private, suppressed and redacted memories never reach prompts or recall tools; group channels and sub-agents get no memory by default; secrets are redacted at every memory write; deleting local memory also forgets its Supermemory copy, and Disconnect & purge removes every recorded copy; session checkpoints are signed; background memory writers follow the workspace access profile. See Memory Engine.
• Browser connection enforcement: install visible-browser guards before first navigation, resolve task permissions during registration, and pin Chromium connections through a policy-enforcing local proxy, including redirects. WebSockets and external CDP attachment are refused; shared cookie partitions require every active task to permit the destination.
• Subprocess and tunnel authority: apply administrator network restrictions to code execution and unsandboxed shell fallback; serialize live tunnel updates, revoke replaced relay clients, and contain malformed client messages while retaining audit and heartbeat traffic.
• Document and webhook limits: cap Office/OpenDocument archive input, entry count, actual expanded bytes, and PPTX table dimensions; authenticate cron webhooks before incrementally reading their 1 MiB body limit.
• Git and updater hardening: disable repository fsmonitor hooks in browser Git operations and disable updater installation on ordinary application exit.
• See the October 2 browser and runtime fix record for these nine findings and two hardening items, source and test mappings, compatibility changes, and local verification limits.
• PDF parsing and local sockets: every main-process PDF parse runs in bounded workers (time, memory, text and concurrency limits); network-enabled sandboxed commands can no longer reach other programs' local sockets such as the Docker daemon.
• Agent harness hardening: the prompt-injection filter annotates tool results instead of rewriting them and catches phrases split across lines; grep's .gitignore lookup is confined to repositories inside the workspace; fetched PDFs parse in a worker with memory, time and text limits; generic cookie dialogs are auto-dismissed only when they overlay the page and only with reject choices; queued orchestration tasks count against the child-agent limit.
• Process sandbox policy: enforce read-only subtrees, recursive Git/policy protections, and separate delete authority across macOS process backends; reject Docker mount configurations that cannot enforce those boundaries. Host directory moves/removals require guarded file tools on macOS.
• Code execution permission: require shell capability and shell approval handling for Python, JavaScript, and shell execute_code calls.
• Saved provider credentials: bind credential reuse to the configured endpoint during model discovery, connection tests, and settings saves; changed destinations require replacement credentials.
• Relay and plugin download availability: contain malformed WebSocket upgrade URL errors, and cap plugin manifests at 1 MiB with an active 15-second download deadline.
• HTTP redirect credentials: replace caller headers with public defaults on origin changes and reject cross-origin redirects that preserve a request body.
• Grep execution limits: move regex and glob matching into a terminable worker with a 500 ms per-job deadline, and cap pattern size and brace expansion.
• Pulse request limits: enforce the 16 KiB body cap while streaming, canceling oversized input before complete buffering.
• Read-only MCP tunnels: deny all tool calls in read-only mode, including allowlisted and ambiguously named tools; discovery and resource reads remain available.
• Git skill import boundaries: reject checkout symlinks before discovery or manifest reads and reject symlink bundle roots during staging.
• See the October 2 security fix record for these five findings, compatibility changes, regression coverage, and verification limits.
• Canvas task boundaries: isolated Canvas windows and interactive previews now enforce the owning task's live network policy, origin approval, and session ownership. HTTP(S) connections use validated DNS addresses; WebSocket and other remote schemes are blocked.
• HTTP connection and response limits: pinned DNS validation to the actual socket, bounded decoded responses to 5 MiB, and kept request deadlines active through body consumption.
• Channel webhook limits: LINE, Teams, Google Chat, Feishu, and WeCom reject request bodies over 1 MiB with HTTP 413 before provider processing.
• Secure MCP tunnel lifecycle: added an explicit client-method allowlist, blocking host shutdown and malformed tool calls regardless of read-only mode.
• Imported skill archive limits: bounded downloads and incremental ZIP inflation before complete allocation, enforcing per-file and cumulative expanded budgets.
• See the security fix record for all six findings, compatibility changes, regression coverage, and recorded validation.

Removed

• Digital Twins, Companies and Symphony: removed with their persona templates and twin-* skills.
• Stealth fetcher and sign-in routes: the stealth scraping fetcher and the Google Antigravity and Gemini CLI sign-in routes are removed; saved stealth settings fall back to Playwright and those sign-ins move to another configured provider.
• Ideas panel: removed the Ideas page and its sidebar destination. All of its workflows, including their skill prompts, now live in the use-case gallery. A pinned Ideas shortcut is dropped when the app loads.
• Personal Health: discontinued the Health dashboard, source imports, macOS Apple Health/HealthKit bridge, and related build and packaging paths to focus engineering effort on core agent workflows, integrations, and reliability. Upgrading deletes the retired Health data in the active CoWork profile; older settings backups cannot restore it. See the decision record.
• Mobile Companions: discontinued the iOS/Android companion apps, the Mobile Companions settings tab, the companion token, and the Control Plane node role and node.* methods to focus engineering effort on core agent workflows, integrations, and reliability. Upgrading deletes the stored companion token; older companion apps are refused with a discontinued error. See the decision record.

0.5.54 - 2026-09-20

Changed

• Release publication: registry bundles now retain exact package bytes across retries, resolve draft GitHub releases through the release list fallback, and keep scoped GitHub Packages access at the registry default.
• Public adoption reporting: refreshed generated README signals, detailed snapshot data, and append-only history from the public GitHub/npm sources.

Fixed

• Release integrity: package checksums are validated before archive parsing, and recovery workflow paths work on GitHub-hosted runners without unsupported job-level runner contexts.
• Release notes: see Release Notes 0.5.54.

0.5.53 - 2026-09-20

Added

• Release notes for 0.5.53: see Release Notes 0.5.53.
• MLX-LM local inference: added a first-class Apple Silicon mlx provider with native-platform and Python-runtime checks, quantized-model quick picks, local mlx_lm.server lifecycle controls, OpenAI-compatible /v1 routing, legacy endpoint normalization, and a complete MLX-LM Local Inference guide.
• Atomic Chat and local execution profile: added an opt-in Atomic Chat /v1 adapter with exact model discovery, typed connection failures, and CoWork-owned task/permission boundaries, plus the versioned local-balanced-v1 profile for bounded local output budgets, capability evidence, and single-generation admission. See Atomic Chat inference and local-model execution.
• Access profiles: added Codex-style Ask for approval, Approve for me, Full access, and Custom profiles combining sandbox, approvals, reviewer behavior, network, filesystem, and domain policy across desktop, CLI, remote, managed, automation, channel, and child-task surfaces.
• Access profile documentation: added the canonical Access Profiles guide covering selection, defaults, custom profile fields, inheritance, fail-closed behavior, migration, compatibility, and verification.
• Approval-boundary validation: added the migration plan, validation record, real SQLite smoke harness, and regression specification for routine in-scope work, scoped exceptions, grant invalidation, sandbox enforcement, and bounded ACP behavior.
• Jev Decision Support and Active harness: added the Jev Decision Support and Harness guide and JEV harness validation record covering typed provider routing, bounded model/strategy/team/tool decisions, separate Jev usage accounting, and headless execution behavior.
• Durable WorkSessions: added canonical lifecycle contracts, activity leases, projections, operational metrics, replay evaluation, rollout controls, turn guards, and control-plane/daemon integration. See WorkSession model.
• Bots and collaboration: added persistent bot profiles and conversations, team messaging, agent rosters, session dashboards, and improved collaborative execution status. See Bots and Conversations.
• Box Brain and CoWork Pulse: added Box-backed memory/search integration and an explicitly opt-in, content-free Pulse collector with consent, deletion, update-check separation, D1 schema, and validation coverage. See Box Brain and CoWork Pulse.
• Local preview and task-surface state: added governed local preview processes, session-aware preview cards, composer draft/attachment fencing, task-event scheduling, and task selection restoration.
• Skills and connectors: expanded bundled and registry-managed guidance, including Box and TypeSafe AI entries, architecture-design workflows, and stronger skill/import validation.

Changed

• Profile-first command access: removed the new-task shell enable/disable control. Command tools now derive from the selected profile; legacy shell fields and permission modes remain only at compatibility boundaries.
• Routine work no longer interrupts for approval: named profiles authorize in-scope reads, writes, edits, artifacts, and available sandboxed commands without creating approval rows or lifecycle events. External paths, explicit consent, sensitive exports, and hard boundaries remain governed separately; approval: "never" denies missing authority without waiting.
• No-popup tool-policy decisions: the default runtime keeps the legacy tool-approval popup queue disabled. Allowed operations run silently; unresolved asks become an assistant message and durable inline Deny / Allow once card, including network, credential, export, MCP/external-side-effect, and eligible outside-workspace requests. Legacy popup approvals are opt-in diagnostics via COWORK_APPROVAL_PROMPTS=on, and pending approval state fails closed on restart. Private browser input and native credential confirmations remain separate.
• Memory write default: durable memory writes auto-commit in the no-prompt runtime. The review queue is an explicit compatibility mode, and stale queued writes are rejected without replay during migration.
• Governed cross-surface execution: documented that browser, computer-use, connector, MCP tunnel, memory, skill, channel, automation, terminal, remote, and managed-agent surfaces inherit the effective profile and cannot widen it.
• Fail-closed policy documentation: documented unavailable or backend-incompatible profiles, finite filesystem/domain boundaries, protected paths, and the separation between logical profiles, sandbox backends, approval behavior, and execution modes.
• Active JEV routing documentation: documented the eligibility gates, decision purposes, deterministic authority boundaries, CLI/runtime build split, telemetry inspection, and repeated benchmark methodology for standard-versus-JEV comparisons.
• Task and artifact surfaces: improved composer drafts/attachments, timeline projection, task selection, disclosure, session progress, artifact previews, and large-session rendering/replay stability.
• Provider and release tooling: added MuAPI transcription recovery, OpenRouter onboarding recovery, Vite 8/Vitest migration coverage, documentation-version validation, registry-publication recovery, bundle/smoke helpers, and detached updater-signature verification.

Security

Full-codebase security review; see the Security Hardening Record for the defect, fix, and enforcement point of each item.

• Workspace policy files are no longer agent-writable: .cowork/policy/** (permission mirror and tool-policy script) and .git/** are protected mutation boundaries, denied with reason protected_path, which no approval or rule can satisfy. Previously an agent could grant itself run_command by writing one JSON file, or plant a git hook that runs outside the tool sandbox. .git/info/exclude is carved out.
• Checked-in permission manifests treated as untrusted input: allow rules in .cowork/policy/permissions.json apply only when mirrored by a rule approved on this machine; deny and ask still apply immediately.
• Inverted TLS certificate pinning fixed: checkServerIdentity returned booleans where Node expects Error/undefined, so a mismatched certificate was accepted and the correct one rejected — enabling pinning removed hostname verification instead of adding to it, and the control-plane token was sent to whatever endpoint answered.
• config.get no longer returns the admin token: the payload is redacted, so a read-scope companion node token can no longer be exchanged for admin scope. Also keeps the token out of cowork doctor --json output.
• Remote MCP registry entries cannot silently supply a spawn command: bundled connectors now take precedence over same-named remote entries, provenance is stamped rather than inferred, and installing a remote entry requires confirmation showing the exact command, arguments, and environment keys. Fails closed with no confirmation route. Gates the marketplace and the agent's integration_setup alike.
• Inbound webhooks fail closed: Feishu, WeCom, Telegram webhook mode, and the cron webhook no longer skip signature/secret verification when the credential is unset. See the breaking-change table in the hardening record.
• /approve requester check applies in every context: it previously applied only to group chats, so a 1:1 message could satisfy someone else's pending tool approval.
• Hooks server authenticates before side effects: the request event reaches the trigger engine and can create a task, and was emitted before the token check — reachable from any web page via a bare <img> tag.
• Agent fetches cannot reach internal addresses: cloud instance metadata, private ranges, link-local, and *.internal are blocked before any allow rule, including via DNS resolution and on every redirect hop. Loopback stays reachable for local development servers.
• Single scheme allowlist for shell.openExternal: new-window and will-navigate paths previously accepted any scheme, reachable from unsanitized document hyperlinks. App-origin checks now compare parsed origins instead of string prefixes.
• Detached release signatures: update artifacts can be verified with an embedded Ed25519 public key before installing, requiring no code-signing certificate. Inert until a key is generated — see Release Signing.
• Salesforce connector pagination cursors confined to the instance origin: a model-supplied cursor previously received the live OAuth bearer token for any URL.
• App-level settings encryption reworked (app2:): PBKDF2 arguments were inverted so a constant shared by all installations acted as the password; the predictable path-derived fallback is removed and now fails closed; the checksum no longer digests the plaintext. Legacy records are re-encrypted in place on next load.
• SSH tunnel argument injection fixed: username/host are charset-validated so a leading - cannot become an OpenSSH option such as -oProxyCommand=, and the connection test validates its config at all.
• Plugin packs: https:// only, no clone redirects or credential helper, and the manifest entry point is confined to the pack root.
• Renderer HTML preview sandbox: removed allow-same-origin from the file-viewer .html preview iframe, which had given arbitrary workspace HTML access to the privileged renderer API.
• Tray quick input escapes agent-authored text and the window carries its own CSP.
• File-viewer IPC resolves the workspace root from the database instead of trusting a renderer-supplied path that it then checked containment against.
• compile_latex passes -norc and -no-shell-escape, so neither a workspace .latexmkrc nor \write18 can execute commands.
• Command injection in batch_image_process fixed: the ImageMagick 7 fallback built a shell string with JSON.stringify-quoted paths, which does not escape $ or backticks.
• Pulse collector rejects an unset admin token instead of accepting Bearer undefined.

Fixed

• Write-tool classification unified: several tools declared in TOOL_GROUPS["group:write"] classified as read-only, so they were auto-allowed in default mode and permitted in Plan mode despite its non-mutating guarantee. Classification now derives from the canonical taxonomy, with a regression test over every group member.
• Trusted command patterns no longer span shell operators: the shipped default echo * matched echo ok && curl … | sh. Compound command lines are ineligible for pattern trust, and trusted commands are subject to the same auto-approval safety check as other auto-approved commands.
• Approval reuse no longer spans different programs: batch reuse is retained, but command lines that chain/pipe or invoke an interpreter are keyed verbatim, so approving sh -c "npm test" no longer covers sh -c "curl …|sh".
• copy_file no longer inherits the source's executable bit.
• Electron build errors surfaced by tsconfig.electron.json: fixed a ws checkServerIdentity type mismatch, an unknown settings type, and a missing logger that npm run type-check did not catch.
• Deployment-posture evaluation reads unredacted settings, so redacting the config.get response does not affect posture checks.
• Headless Active JEV tool review: concerning Jev observations no longer create a second approval request when a headless task already has explicit non-interactive authority; the observation remains in the policy trace while hard policy, permissions, security, and OS consent stay authoritative.
• Jev telemetry migration isolation: a repairable legacy LLM source-id index failure no longer prevents creation of the independent jev_call_events table and indexes.
• Runtime lifecycle isolation: preserved terminal outcomes, normalized tool results, isolated report projections by database, guarded stale session messages, improved graceful shutdown, and repaired legacy migration edge cases.
• Provider and mailbox resilience: improved provider onboarding/routing, transcription responses, mailbox retries, automation recovery, and local-model admission failures.

0.5.52 - 2026-08-27

Added

• OpenRouter image generation: added dedicated image API routing for all OpenRouter image models, including meta/muse-image, live image-model discovery, endpoint capability negotiation, provider pinning, multi-image output, supported advanced options, and safe local/remote reference-image inputs.
• OpenCode Zen and Go: added curated model catalogs, transport-aware Responses API and Anthropic Messages routing, custom Responses-compatible endpoints, and OpenCode image-capability metadata.
• SearXNG and Web Search Plus: added a guarded private-search provider with explicit provider routing, locale and safe-search controls, endpoint policy forwarding, settings validation, and the Web Search Plus workflow pack.
• Atlas Cloud transcription: added the Atlas Cloud transcription provider and success-state handling for completed transcription jobs.
• Provider and model-picker UX: refreshed the main model picker for richer metadata, responsive layouts, custom model IDs, and clearer model browsing.

Changed

• Release notes for 0.5.52: see Release Notes 0.5.52.
• Upgraded the desktop runtime to Electron 44.0.0 and raised the minimum supported Mac to macOS 13 Ventura.
• Added a shared platform policy for the app bundle, updater metadata, npm launcher, documentation, and artifact smoke tests. 0.5.51 remains the final Monterey-compatible release.
• Made Browser Use Cloud V4 the default cloud browser backend and refreshed product/provider documentation for the open-source multi-provider AI super app positioning.
• Added bounded Browser Use Cloud retries with Retry-After handling and structured retryable errors, plus Scrapling request throttling, timeout/proxy forwarding, and response classification.
• Added bundled skill distribution metadata and corrected public npm adoption coverage/reporting.

Fixed

• Blocked incompatible npm, Git, and packaged updates before mutation and added explicit rollback guidance.
• Added in-app fallback when native notification delivery fails asynchronously.
• Derived native SQLite repair versions from the active package manifest.
• Hardened security evaluation, managed MCP metadata validation, legacy database migrations, task/state persistence, mailbox fallbacks, and custom CLI provider credential recognition.
• Fixed clean CI and release test preparation for the Node native PTY dependency and pinned Numbat fixture.
• Fixed Windows Numbat archive extraction to retain native drive paths during release packaging.

0.5.51 - 2026-08-17

Added

• Release notes for 0.5.51: see Release Notes 0.5.51.
• Agent security with Numbat: added a disabled-by-default, checksum-verified Numbat runtime with monitor/enforce modes, bounded tool-call projections, rule provenance, findings and decisions, scheduled scans, incident case bundles, retention controls, CLI operations, and optional external hooks. Numbat can add restrictions but cannot grant permissions or suppress ordinary approvals.
• Bounded long-document analysis: added deterministic read-only review for named .docx, .pdf, .md, and .txt sources, including safe workspace discovery, extraction, overlapping analysis windows, complete coverage accounting, evidence reduction, split retry, cancellation, and partial-success reporting when final synthesis times out.
• Native System Voice TTS: added capability detection and local text-to-speech adapters for macOS say, Windows PowerShell/SAPI, and Linux espeak. System speech recognition remains explicitly reported as unavailable so users can select OpenAI or Azure Whisper when transcription is needed.

Changed

• WSL native window frame: WSL/WSLg sessions now retain the operating system window frame and render the in-app toolbar as a non-draggable row. This remains a best-effort compatibility path pending visual validation on representative WSL hosts.
• Sidebar update action: moved the update action into the sidebar footer so it remains available without occupying the main task header.
• Long-session timeline performance: added bounded timeline pages, cursor-based history loading, replay-tail transport, detail hydration, payload byte budgets, truncation metadata, renderer caches, and large-session profiling fixtures to keep task switching and replay predictable.
• Runtime and dependency maintenance: refreshed the Electron, SQLite, provider, messaging, charting, and packaging dependency set; expanded native/runtime compatibility checks; and refactored the main application architecture and CLI/daemon boundaries without changing the local-first product model.
• Persistent UI density: power density selection now persists across restarts and is applied during early renderer bootstrap to reduce visual layout changes during startup.

Fixed

• Linked source-checkout dependency repair: the cowork-os launcher and native SQLite recovery now preserve lockfile-defined versions and development dependencies when a global command is linked to a Git checkout, preventing runtime self-healing from upgrading Electron or removing Vite, Vitest, TypeScript, and other local development tools. Packaged npm installs continue to repair runtime dependencies without installing the development toolchain.
• Timeline completion ordering: preserve the final task completion event, suppress stage chatter emitted after completion, retain relevant tool output, and sanitize namespaced tool tags before rendering.
• Planning and document-analysis reliability: hardened document source discovery and extraction, chunk retries, evidence reduction, local Ollama budget selection, and recovery from incomplete planner output.
• Timeline final-response coalescing: prevent duplicate final responses and preserve the intended completion/tool-output ordering during replay and live rendering.
• Browser navigation and renderer recovery: restricted Browser Workbench navigation to approved web schemes and added renderer-crash handling so invalid destinations and renderer failures surface controlled recovery behavior.

0.5.50 - 2026-07-20

Added

• Release notes for 0.5.50: see Release Notes 0.5.50.
• Main-screen Automation Studio: added Discover, Library, Builder, and Activity views under the main sidebar Automations destination, with conservative prompt-to-draft generation, eight built-in templates, a searchable action catalog, typed variables, explicit Yes/No branch authoring, dry-run and Google-scope review, immutable activation versions, manual runs, turn-off controls, per-step approvals, cancellation, and backing-task links. Added the complete Automation Studio guide.
• Deterministic workflow runtime: added versioned structured definitions, graph validation, bounded conditions/filters/for-each execution, a durable deduplicated event inbox, Google Workspace polling starters with cursor pagination, action adapters, signed outbound webhooks, secure secret references, connector allowlist/schema checks, run/step/event/sample persistence, retry policy, retention cleanup, and additive legacy Routine compatibility.
• ChatGPT subscription GPT-5.6 controls: added gpt-5.6-sol, gpt-5.6-terra, and gpt-5.6-luna to the ChatGPT OAuth model catalog; added model-specific Low/Medium/High/Extra High/Max/Ultra effort choices matching Codex (Ultra on Sol and Terra only); and forwarded reasoning effort plus response verbosity through the ChatGPT Codex Responses transport. See LLM Providers & Costs.
• Bundled unbroker skill: added a global consent-gated privacy cleanup workflow for authorized data-broker and people-search opt-outs, with a local PII ledger, deterministic pdd.py action queue, human-task digest, recurring recheck support, and related docs. Added Unbroker Skill.
• Session archive and retention controls: added non-destructive session archive behavior, previewable filtered prune operations, automatic daemon retention settings, sidebar archived-session filtering, and CLI/runtime coverage.
• Mixture of Agents provider: added advisor/aggregator orchestration, slot-specific provider routing and failover, usage aggregation, reference caching, recursion protection, Settings integration, and corporate TLS/Zscaler guidance. Added Mixture of Agents.
• Browser Workbench annotations: added persistent browser-target annotations, live element pins, an annotation composer, send-to-agent context, lifecycle events, and repository/renderer coverage.
• Inline mail compose frames: assistant email drafts can render inline for review before sending, with richer recipient/body inputs, draft retrieval over IPC, send-status polling, and in-place event updates.
• Video attachment analysis: uploaded .mp4, .mov, and .webm files are copied into the workspace, sampled into representative frames, passed to image-capable models, and shown as contact-sheet/full-frame image artifacts in the task timeline. Added Video Attachments documentation.
• Google Calendar MCP tools: added Calendar coverage to the Google Workspace MCP connector, including calendar listing, event list/read/batch read, availability/freeBusy lookup, and confirmed event create/update/delete. Composer mentions now merge these google-workspace.calendar_* tools with native calendar_action under one Google Calendar chip.
• Memory Write Governance docs: documented approval modes for durable archive, curated, background, and external memory writes; clarified the pending approval queue lifecycle; documented sensitive external-memory blocking before queue persistence; and corrected storage docs to distinguish encrypted settings/fields from the normal SQLite database file.
• Architecture design orchestration: added bundled Rhino, Blender, and ComfyUI MCP connectors plus the architecture-design skill for concept architecture workflows. The connectors are local-only, enforce project-root file boundaries, expose registry/capability metadata, and document setup, safety, and artifact expectations across the connector and skill docs.
• Cross-platform desktop location: get_current_location now works on macOS (Core Location), Windows (Windows.Devices.Geolocation via PowerShell), and Linux (GeoClue2 via gdbus). Each platform uses a bundled helper script that outputs a standard JSON envelope; the DesktopLocationService tries the first available provider. The macOS helper now includes the com.apple.security.personal-information.location entitlement required for Core Location authorization. Location access requires explicit one-time user permission on each platform and cannot be auto-approved or persisted.
• xAI Grok OAuth / SuperGrok provider docs: documented the new xai-oauth provider option, SuperGrok browser sign-in flow, grok-4.3 default model, token-refresh behavior, xAI API-key alternative, and related provider-count updates across README, getting started, provider, migration, status, feature, and positioning docs.
• Durable Runtime Context docs: documented opt-in active-task durable recall, context_grep / context_describe, summary DAG parent links, clear-memory behavior, enable/disable expectations, diagnostics, edge cases, validation commands, and manual test prompts.

Changed

• Automation product placement: structured flow authoring now lives in the main Automations tab instead of Settings. Settings > Automations remains the advanced surface for prompt-based Routines, Task Queue, Workflow Intelligence, Scheduled Tasks, Webhooks, Event Triggers, and Daily Briefing.
• Workflow safety and lifecycle: external writes and data exports require approval under safe/default policies, external automatic retries are capped at one, active versions are isolated from saved drafts, and re-enabling validates the active version's current account scopes and secret references.
• Browser and computer-use approvals: background/headless execution is preferred unless visible Browser Workbench or native computer control is requested or approved; visible fallback choices can be governed by permission rules.
• Provider ordering: moved OpenRouter, OpenAI, Mixture of Agents, Claude, Gemini, and DeepSeek to the front of the built-in provider list while preserving the relative order of remaining providers.
• Replay controls: hid replay controls behind an explicit toggle to keep the default task surface focused.
• First-run onboarding docs and UX: documented the staged first-run setup flow, ChatGPT subscription sign-in path, local Ollama detection, free-option provider badges for OpenRouter/Gemini/Groq, and the fixed-frame onboarding recap with a scrollable review body.

Fixed

• Automation Studio startup and database upgrades: registered the complete routine:workflow* IPC surface, ordered compatibility-column migrations before dependent indexes, and made the dev launcher detect an already-running source Electron instance before macOS bundle rebranding. Missing-handler, legacy workflow_run_id, silent single-instance exit, and same-bundle SIGABRT failures now surface actionable diagnostics without destructive database recovery.
• Automation Studio layout and scrolling: made the main Automations page the vertical scroll owner, removed task-view width constraints, bounded internal panes, wrapped long card content, and added responsive collapse plus placement/layout regression coverage.
• Workflow recovery and cancellation: requeue processing events after restart, recover runs before draining new events, move interrupted steps to explicit outcome verification, propagate cancellation into agent/Google/webhook work, continue Gmail/Drive pagination without skipping capped backlogs, and redact/prune durable payload data.
• ChatGPT OAuth token exchange: added an Electron network fallback for the OpenAI token endpoint, preserved Node fallback behavior, and surfaced useful refresh errors instead of collapsing them into generic failures.
• Build-health evidence checks: kept package.json inspection read-only, required concrete command/API evidence, and tightened completion-report parsing.
• Mail draft sending state: poll draft status during send so compose frames accurately reflect delivery progress.
• Memory FTS performance on Electron main thread: eliminated synchronous SQLite FTS blocking (1.5s spikes → no slow FTS on task path) via a dedicated prompt-recall fast path that skips imported-global search, hybrid semantic scoring, and double getFullDetails round-trips; batched tier-tracking UPDATEs; LRU cache for prompt-recall results; background marker-based lookups switched from FTS to direct LIKE queries; composite (workspace_id, created_at DESC) index; and richer slow-FTS instrumentation with token count, row count, limit, and workspace context. See Memory FTS Performance.
• Google Workspace settings-save burst during mailbox sync: added in-memory token cache in the OAuth refresh path so sequential gmailRequest calls within a sync loop reuse the refreshed token instead of re-refreshing and re-saving settings on every API call (22 redundant DB writes → 1).
• OutputFilter YAML capabilities false positive: tightened capabilities:\n - and constraints:\n - prompt-leakage patterns to require surrounding system-prompt-like context (system_role:, agent_config:, etc.) before triggering, and lowered their standalone weight from 3 to 1 to prevent false positives on legitimate feature-comparison output.
• Multitask resource stability: comprehensive performance fixes addressing renderer memory growth (7.4 GB → <2 GB target), MCP server process leaks (27 leaked → ref-counted lifecycle), synthesis prompt bloat (244k → 100k char budget), React infinite render loops, SQLite lock contention (WAL mode + busy timeout), and executor cache pressure. See Performance & Stability.
• Collaborative team run phase tracking: added execute phase to AgentTeamRunPhase so the UI shows "Agents are executing..." during active child task work instead of "Thinking...".
• Blocked task progress status: preserved the blocked state in task-progress summaries instead of classifying every blocked task as waiting for approval.
• Read-only review safety: review tasks automatically snapshot git state at start and restrict system interaction tools (screenshots, clicks, mouse) to prevent accidental workspace modifications.
• Workspace verification deduplication: identical verification commands in the same workspace are deduplicated at the daemon level, preventing concurrent tsc --noEmit or build processes.

0.5.49 - 2026-06-08

Added

• Release notes for 0.5.49: see Release Notes 0.5.49.
• CLI local runner: added the cowork npm binary, CLI source/build coverage, local Control Plane discovery, terminal UI helpers, direct-run support, and package inclusion for tsconfig.cli.json.
• Browser Use Cloud stealth backend: Browser V2 can explicitly route browser_navigate through Browser Use Cloud with browser_provider: "browser-use-cloud", using BROWSER_USE_API_KEY or encrypted browser-use settings, Browser Use API v3 session creation, CDP attach, optional proxy/profile/timeout/recording/screen controls, stale-session retry, and remote-session stop handling.
• Codex Security workflows: added repository, diff, and deep security scan workflows, workspace-local scan artifact orchestration, report validation/render helpers, and the bundled Codex Security plugin pack with skills, references, scripts, and assets.
• Automation outcomes: scheduled/automated runs can now record actionable, informational, low-value, and failed outcomes, with Mission Control surfacing outcome summaries and recent run details.
• Usage Insights token heatmap: added a 12-month token activity overview with daily, weekly, and cumulative heatmap modes.
• Prompt composer link chips: pasted standalone web URLs are converted to compact Markdown links and rendered as favicon chips in the composer.
• Public adoption stats: added public GitHub/npm adoption stat collection, README rendering, history snapshots, and generated adoption reports.
• Namespaced skill slash commands: slash command resolution now supports namespaced skill routes.

Changed

• Browser V2 docs and safety model: documented Browser Use Cloud configuration, explicit opt-in behavior, private/local target blocking, redacted Browser Use errors/URLs, and retryable pending-stop results across Browser Workbench, Browser V2 architecture, getting started, troubleshooting, development, feature, and architecture docs.
• Startup and Control Plane behavior: reduced sluggish desktop startup paths, tuned deferred startup work, and added an opt-in desktop Control Plane auto-enable path.
• Renderer shell polish: improved task-list load-more state, reduced static Control Plane polling, isolated Settings sidebar search into a memoized component, and de-duplicated adjacent timeline failures in summary mode.
• Timeline event display: improved browser action classification, timeline labels, event projection, and parallel group rendering for clearer task progress.
• Tool prompting: contextual prompt guidance now wins over generic tool guidance when both apply.
• Documentation refresh: refreshed README and docs for CLI usage, security scans, Browser Use Cloud, setup, troubleshooting, security, plugin packs, project status, and public adoption signals.

Fixed

• Security and auth hardening: hardened webhook and MCP host auth, authenticated CoWork host tunnel forwarding, blocked cross-host Scrapling redirects, restricted open_url to web schemes, and tightened web fetch/scraping guardrails.
• Executor completion guardrails: strengthened completion contract handling, file mutation verification, command requirements, and frontend browser-preview guidance.
• Automation permissions: automated tasks now default to dont_ask permission behavior.
• Database migrations: repaired pinned activity schema migration behavior and added legacy/schema migration coverage.
• Provider routing: fixed retired Anthropic model handling and OpenCode Go Qwen 3.7 Max routing.
• Payments policy: fixed x402 payment approval enforcement.
• Everyday Agent settings: fixed the Everyday Agent read-only toggle.
• Development codesigning: hardened the Electron development codesign helper.

0.5.48 - 2026-05-28

Added

• Release notes for 0.5.48: see Release Notes 0.5.48.
• Side Chat: /side [question] opens a right-side read-only side conversation for the selected running task, with hidden parent context, live parent-status snapshots for progress questions, and tools denied.
• Secure MCP Tunnels: added self-hosted outbound-only private MCP access with a relay, local tunnel client, separate client/caller tokens, policy enforcement, audit logs, Settings UI, and relay smoke coverage.
• YouTube video intelligence: added YouTube transcript ingestion, segment storage/search, video Q&A, Browser Workbench YouTube ask UI, and native YouTube tools.
• Timeline/sidebar paging: added sidebar summary loading, cursor-based sidebar pagination, task timeline page/detail IPC APIs, timeline payload sanitization, and performance QA scripts.

Changed

• Mission Control semantics: clarified Mission Control docs and UI language around Heartbeat agents, the global runtime queue, and workspace-scoped Mission Board work so enabled background roles are not mistaken for currently running tasks.
• Scheduler reliability: cron jobs now persist run leases before task creation, tag scheduled tasks with scheduledJobId, detect active scheduled work after restart, and avoid duplicate runs.
• Routine reconciliation: routine runs now dedupe duplicate backing-task dispatches, preserve distinct thread follow-ups, and repair stale timeout rows when backing tasks later finish.
• Completion contract handling: text-only briefs with file paths no longer require file artifacts, and recovery steps no longer overwrite stronger final deliverables with narrow operational status.

Fixed

• Tool policy read-only enforcement: an explicit empty task allowlist now denies all tools, while an omitted allowlist remains unrestricted.
• Glob and file-path safeguards: glob scans skip generated/dependency folders case-insensitively, reject generated search roots, cap scan duration, and file tools expand ~ paths before resolution.
• macOS sandbox path aliases: sandbox profiles now include /var and /private/var aliases for workspace, temp, and allowed paths.
• Browser/webview URL policy: Browser Workbench now applies explicit webview URL policy and short-lived allowlisting for local HTML previews.

0.5.45 - 2026-05-14

Added

• Release notes for 0.5.45: see Release Notes 0.5.45.
• Claude-for-Legal workflow docs: documented bundled legal plugin-pack slash commands, editable picker selection, main-view demand/generic legal intake cards, management-command exclusions, safety behavior, and focused validation in the new Claude-for-Legal workflow guide.
• Finance and legal plugin packs: added legal practice packs, finance-core packs, fund administration, KYC operations, and expanded equity research, financial analysis, investment banking, private equity, and wealth management packs.
• Agent Builder and finance templates: added plan-based managed-agent creation, finance-oriented managed-agent templates, starter prompts, missing-connection reporting, and managed-session panel routing.
• Channel specialization: added per-channel/chat/thread specializations with workspace and agent-role overrides, system guidance, tool restrictions, shared-memory opt-in, settings UI, and gateway routing.
• Mailbox compose and queue upgrades: added draft attachments, send queue/retry support, Microsoft Graph send paths, mailbox navigation metadata, transient sync backoff, and mailbox client settings.
• Runtime policy controls: added admin runtime policy fields for sandbox types, permission modes, shell network egress, network domain evaluation, integration-auth notifications, and task-event telemetry export.
• Browser Workbench responsive QA docs: documented visible browser_emulate viewport control, desktop/tablet/mobile workbench presets, screenshot expectations, IPC/architecture changes, troubleshooting guidance, and verification steps for responsive browser testing.
• Multitask command docs: documented /multitask [N] <task> as a bounded collaborative lane fan-out command, including syntax, lane planning, queue behavior, worktree safety, implementation landmarks, and focused validation.
• Google Workspace Tasks and Slides: added first-class Google Workspace MCP coverage for Google Tasks task-list/task CRUD, completion, move, delete, clear-completed flows, plus Google Slides create/get, slide creation/deletion, text boxes, replace-all-text, and raw batchUpdate for advanced edits.
• OpenRouter Pareto Code docs: documented openrouter/pareto-code, openrouter/pareto-code:nitro, the optional 0..1 Pareto minimum coding score, Nitro behavior, routed-model usage reporting, and the documented 200,000 context fallback in provider/setup docs.
• Control Plane Pareto configuration: llm.configure now accepts OpenRouter settings.paretoMinCodingScore for headless/VPS installs and rejects percent-style values outside 0..1.
• Dreaming documentation: documented Dreaming as the Workflow Intelligence memory-curation phase, including trigger sources, evidence sources, dreaming_runs / dreaming_candidates, review-first behavior, and its relationship to Memory, Heartbeat, Reflection, and Suggestions.
• Managed deployment hardening docs: documented fail-closed Control Plane posture checks, reverse-proxy allowed origins, trusted proxy guidance, and hardened Docker/systemd defaults for headless/VPS deployments.

Changed

• Message-box shortcut docs: clarified that skill-backed slash picker selections insert the command token for user context before launch, and added Claude-for-Legal intake-card implementation landmarks and tests.
• Google Workspace OAuth and mentions: expanded the shared Google Workspace OAuth defaults for Tasks, Presentations, Docs, Sheets, and Chat; status checks now report missing scopes so older connections can reconnect. Composer/docs now describe Google Workspace as service-specific options for Gmail, Drive, Calendar, Docs, Sheets, Slides, Tasks, and Chat, with Google Calendar able to merge native and MCP-backed tools.
• Managed Agents concept docs: refreshed Managed Agents, Agents Hub, Mission Control, architecture, getting started, docs home, README, and status documentation so the current model is explicit: clicked-agent detail is a single-pane configuration surface, and test/preview/starter prompt actions open normal main-window tasks rather than running in a private sidebar chat.
• macOS unsigned DMG distribution: release builds continue to publish unsigned macOS DMG/ZIP artifacts without requiring a personal Developer ID certificate. macOS smoke tests explicitly allow the unsigned fallback, and user-facing docs now explain the System Settings > Privacy & Security > Open Anyway flow required by Gatekeeper on first launch.
• Renderer task-surface performance: documented the lazy MainContent / RightPanel boundaries, task-view skeleton, surface-specific CSS ownership, lazy markdown/code rendering, renderer perf startup marks, and npm run qa:renderer-perf validation path.

Fixed

• Google Workspace destructive safeguards: documented and enforced explicit confirmation for destructive or broad Tasks/Slides MCP tools, including task-list deletion, task deletion, clear completed, slide deletion, replace-all-text, and raw Slides batchUpdate.
• Task surface restart styling: kept critical welcome/composer control chrome in startup CSS and heavier task-surface styles in main-content.css so the center task view does not restart with unstyled native controls while lazy chunks are still unloaded.
• Shell sandbox policy behavior: persistent shell commands keep their session lifecycle when sandboxing is not required, requireSandboxForShell controls no-sandbox fallback, and macOS sandbox profiles honor each command's network decision.
• Mailbox resilience: transient Gmail sync failures back off cleanly, provider action failures include connection context, draft attachment paths are workspace-scoped, and queued send retry behavior is surfaced.
• WhatsApp TLS failures: non-retryable certificate trust failures now pause reconnect attempts and surface an actionable status instead of repeatedly reconnecting.

0.5.44 - 2026-05-05

Added

• Release notes for 0.5.44: see Release Notes 0.5.44.
• Browser V2 documentation: added the canonical Browser V2 architecture guide covering the visible Browser Workbench default, BrowserSessionManager, Electron-workbench / Playwright-local / external-CDP backends, accessibility snapshot refs, diagnostics, downloads/uploads, real-browser consent, safety invariants, and verification flow. Refreshed README, Features, Architecture, Development, Getting Started, Troubleshooting, Use Cases, Web Page Artifacts, Showcase, Status, and docs home to reflect Browser V2 as the new browser concept. See Browser V2 Architecture and Browser Workbench.
• Gateway usage docs: documented remote command routing, active-task behavior, /new and /new temp sessions, /stop cancellation, skill slash invocation, shared channel delivery, editable WhatsApp progress, scheduled channel output delivery, per-channel feature guides, dedicated per-channel user guide pages, and end-user best practices for using CoWork from messaging channels. See Channel User Guides, Dedicated Channel Guides, Gateway User Guide, and Gateway Message Lifecycle.
• Browser Use approval and routing controls: added tool-prefix permission scopes, browser-domain approval context, Browser Use domain approval prompts, the Browser Use composer mention option, sidebar approval wiring, markdown-link routing into the browser sidebar, and tests covering permission-rule behavior.
• Expanded gateway runtime: added shared gateway types, channel delivery services, remote command normalization and registry support, WhatsApp command utilities, temporary workspace routing, voice event routing, tray channel activity, plugin/persona IPC update hooks, and daemon startup wiring for gateway services.
• Provider coverage: added DeepSeek and NanoGPT as named provider options, including NanoGPT onboarding/settings support and Anthropic-compatible request handling that avoids CoWork-managed caching where the upstream provider does not support it.
• Persistent goal slash command: added a slash-command path for keeping an explicit persistent goal in the active task context.
• Imagegen frontend web skill: bundled and registered imagegen-frontend-web guidance for higher-quality frontend image direction and generated visual references.

Changed

• Browser Workbench experience: refined Browser Workbench navigation, styling, sidebar approvals, mention text/icons, browser tool prompting, runtime browser tool definitions, storage-secret redaction, and tool-scheduler behavior so live browser work is more visible and controlled.
• Agent and gateway routing: tightened gateway/skill command routing, parallel batch execution coverage, temporary workspace handling, ambient monitoring updates, and shared channel-message behavior across Slack, Discord, email, Telegram, WhatsApp, and the channel registry.
• Release packaging and smoke coverage: refined the Electron builder runner, mac packaging environment loading, desktop artifact smoke checks, unsigned mac entitlements, release artifact-name verification, and the mac unsigned release smoke path used by CI.
• Documentation refresh: updated README, docs home, feature overview, capabilities, architecture, getting started, troubleshooting, web artifact, Linux VPS, self-hosting, status, showcase, development, and message-box guidance to reflect Browser V2, channel guides, gateway behavior, and current release packaging.
• Branding assets: refreshed app/logo assets and related docs for the current CoWork OS branding set.

Fixed

• Agents Hub Heartbeat agents: Mission Control Heartbeat-enabled agents now appear in Agents Hub counts and panel state instead of being hidden from the hub summary.
• Task metadata persistence: restored persisted TaskRepository.findAll fields for assigned agent role, board metadata, and awaiting-user-input reason codes.
• Provider retry handling: overloaded provider failures are classified as transient/retryable, enabling existing fallback and retry handling instead of failing immediately.
• HTTP tool failure details: http_request failures preserve clearer failure reason and status metadata instead of collapsing into a generic unknown-error path.
• OpenCode Go/Kimi compatibility: improved OpenAI-compatible tool-call handling for Kimi/OpenCode Go style responses and tightened workspace status labels in the renderer.
• Anthropic-compatible custom model selection: fixed overlapping custom-model matching so the intended Anthropic-compatible gateway model is selected.
• NanoGPT request reliability: fixed NanoGPT Anthropic-compatible request handling and auth/cache behavior for routes that should bypass CoWork-managed prompt caching.
• Task archive cleanup: fixed archive deletion and SQLite cleanup paths so archived tasks and dependent rows are removed without foreign-key leftovers.
• Workspace switching: fixed active-chat workspace switching so task context follows the selected workspace correctly.
• PPTX preview path validation: tightened workspace path validation for presentation previews.
• Security hardening: hardened MCP registry package verification, command/path containment, control-plane auth, and workspace file access.
• Email channel timeouts: reset IMAP timeout state after failures so one timeout does not cascade into later mailbox operations.
• Dev-log diagnostics: reduced false-positive error classification in development log utilities.

0.5.43 - 2026-05-02

Added

• Linux server release package: GitHub Releases can now publish cowork-os-server-linux-x64-v<version>.tar.gz plus a .sha256 checksum for production VPS/systemd deployments. The package includes built daemon assets, full resources, connector runtimes, runtime dependencies, systemd templates, and a Linux smoke test that boots coworkd-node and checks /health. See Linux VPS.
• Task-sourced scheduled automations: task view now has ... > Add automation..., which opens a Codex-style modal prefilled from the current task and creates a real cron scheduled task through the existing scheduler API. The saved job keeps the source task title, task ID, and cowork://tasks/<taskId> deeplink for traceability. See Task Automations.
• Composer @ mentions for integrations: added a grouped autocomplete above the message box with Agents, configured Integrations, and Files. Integration mentions render as icon+name chips in prompts and user message bubbles, restore from task/session history, and submit integrationMentions as soft runtime guidance. See Composer Mentions.
• @Inbox main-composer routing: @Inbox / @inbox ... now opens Inbox Agent and runs the remaining query through the Ask Inbox module instead of starting a normal task run.
• Message box slash shortcuts: added one / picker for deterministic app commands and skill-backed workflow shortcuts. App commands include /schedule, /clear, /plan, /cost, /compact, /doctor, and /undo; plugin-pack aliases resolve to target skills through the skills runtime. See Message Box Shortcuts.
• CoWork Shortcuts pack: added a bundled shortcuts pack with workflow aliases such as /strategy, /review, /memory, /batch-rename, /smart-deduplication, /folder-structure, /gmail-summary-drive, /calendar-prep-brief, /multi-source-report, /weekly-newsletter, /daily-inbox-zero, /monday-planning-brief, and /end-of-day-log.
• Ask Inbox sidebar chat: Inbox Agent now has right-sidebar tabs for Agent Rail and Ask Inbox. Ask Inbox shows the user question, live mailbox-agent steps, final answer, and matched email evidence, with a pinned composer for follow-up questions. See Ask Inbox Architecture.
• Hybrid mailbox retrieval for Ask Inbox: Ask Inbox now plans broad mailbox searches across local FTS, semantic mailbox embeddings, provider-native search, and attachment text, then shortlists and reads evidence before answering.
• Bundled react-best-practices skill: added React and Next.js implementation guidance for feature work, enhancements, refactors, reviews, data fetching, bundle-size checks, and rendering-performance fixes. See React Best Practices Skill.
• Desktop artifact smoke tests: release packaging now runs shared macOS DMG and Windows installer smoke checks, while the release workflow continues to build and smoke-test the Linux server tarball before publishing artifacts.

Changed

• Right sidebar polish: refined the task right sidebar with keyboard-accessible section headers, cleaner compact spacing, stable row grids, clearer in-progress/checklist states, tighter truncation, a four-row scroll cap for Tools used, and lighter feedback/file/context surfaces.
• Files panel type icons: the right-sidebar Files section now shows format-aware Lucide icons beside created/modified/deleted file rows, distinguishing markdown/text, code, JSON, spreadsheets, images, presentations, media, archives, folders, and generic files while preserving the existing action color states.
• Automation docs and concept model: README, Features, Core Automation, docs home, and Development now describe task automations as a shortcut into Scheduled Tasks, not a new Workflow Intelligence owner or separate routine system.
• Integration mention resolver: Google Workspace now appears as Gmail, Google Drive, and Google Calendar in the composer; gateway channels and MCP connectors appear only when locally connected/configured; multi-service MCP connectors can split by service tool groups.
• Message-box shortcut docs and behavior: plugin alias precedence now matches picker display, optional-input skill shortcuts insert the slash token for user context, /clear preserves workspace context, and /schedule keeps deterministic handler precedence from the composer.
• Bundled-skill docs: README, Features, Skill Store, development guidance, docs home, and status docs now reflect the react-best-practices addition and the built-in skill count increase to 147.
• Inbox Agent docs: Inbox Agent, Features, Composer Mentions, troubleshooting, use cases, showcase, and implementation docs now describe Ask Inbox as a sidebar mailbox-agent chat with transient progress events and hybrid evidence retrieval.

Fixed

• Rich composer mention editing: fixed duplicate @ rendering and the React removeChild crash when deleting a raw mention or integration chip.
• Google Workspace reconnect recovery: stale Google Workspace refresh tokens are cleared after refresh bad-request failures, and changing Google OAuth client credentials or scopes clears old tokens before reconnect.
• Azure OpenAI tool-result replay: normalized long Responses fallback tool-call ids so Azure OpenAI does not reject integration-heavy turns with a call_id length error.

0.5.42 - 2026-04-30

Fixed

• Windows installer architecture: rebuilt the Windows installer as an x64 app package so standard Windows PCs install CoWork OS.exe correctly. The 0.5.41 GitHub release asset was built with an ARM64 Windows payload and GitHub immutable releases prevented replacing that asset in place.

0.5.41 - 2026-04-29

Added

• Smart PDF attachment reading: uploaded PDFs now carry compact attachment metadata, a safe excerpt, page/extraction/OCR status, and workspace-relative path guidance. Deeper PDF summaries, Q&A, extraction, comparison, and transformation use parse_document on demand instead of inlining the whole PDF; explicit chat PDF turns can auto-promote to read-only analysis for that document read.
• Release notes for 0.5.41: see Release Notes 0.5.41.
• Everything Workbench positioning docs: added the canonical Everything Workbench page and refreshed product copy around CoWork OS as a GUI-first local AI super app and everything app for coding, email, web design, research, generated docs, sheets, decks, web pages, PDFs, previews, agents, tasks, channels, devices, and automations.
• Document artifact workbench: Word-style document artifact cards now recognize DOCX, DOCM, DOTX, DOTM, DOC, RTF, ODT, OTT, and Pages outputs. DOCX opens directly into an editable sidebar/fullscreen document surface with Google Docs-style controls, save/copy actions, external app actions, functional follow-up composer controls, and automatic preview refresh after follow-up edits. See Document Artifacts.
• Spreadsheet artifact format support: spreadsheet artifact cards now recognize Excel workbooks, CSV/TSV, Numbers, Google Sheets shortcut files, ODS, and XLSB. Editable in-app mode supports workbook and delimited formats; native/app-owned formats keep the same artifact card and external-app/folder actions. See Spreadsheet Artifacts.
• Presentation artifact workbench: PPTX outputs now render as compact artifact cards and open by default in a resizable sidebar/fullscreen presentation viewer with thumbnails, navigation, zoom, speaker notes, fast text-first loading, cached rendered slide images, external actions, and functional follow-up composer controls. Legacy PowerPoint formats are recognized with external-app/folder actions. See Presentation Artifacts and PPTX Preview.
• Web page artifact workbench: generated .html / .htm files and built React output entrypoints now render as compact artifact cards and open by default in a resizable sidebar/fullscreen sandboxed iframe preview with browser/folder/copy actions and functional follow-up composer controls. React-style projects without build output show a build-output-needed state instead of auto-starting a dev server. See Web Page Artifacts.
• Browser Workbench: interactive browser-use tasks now open a visible right-sidebar/fullscreen browser by default, with a persistent workspace browser profile, functional navigation controls, screenshots, screenshot annotation, follow-up handoff, and visible cursor movement during agent actions. See Browser Workbench.
• Structured Memory Observations docs: documented the new local-first observation metadata sidecar, progressive recall tools, Memory Hub Inspector actions, deterministic rebuild/backfill model, workspace-scoped mutation boundary, soft-delete suppression, inline privacy controls, Supermemory mirroring exclusions, and mock-level test expectations. See Structured Memory Observations.
• Structured dev logging: Developer logging now writes redacted human-readable logs and structured JSONL logs for each captured npm run dev run, mirrors the latest run to logs/dev-latest.log / logs/dev-latest.jsonl, and records retained-run metadata in logs/dev-runs.json.
• Format-aware in-app file preview popup: the file preview modal that opens when a file link is clicked in chat is now format-aware. Each format has its own modal width/height profile (compact for text/code, wider for HTML/PDF/image/video, narrow for audio, presentation-sized for .pptx). The header shows a format-specific subtitle (e.g. PNG · 1920×1080 · 240 KB, PDF · 12 pages · 1.4 MB, CSV · 412 rows · 24 KB, Audio · 3:42 · 5.1 MB) and a unified action bar with Copy path, Show in Finder, Open externally, and Close on every format. New first-class branches: collapsible JSON tree view for .json/.jsonl/.geojson (with raw/tree toggle and parse-error fallback), CSV/TSV table rendering with an RFC-4180 quoted-field parser, an audio player for .mp3/.wav/.ogg/.m4a/.flac/.aac with duration metadata, and highlight.js-driven syntax highlighting for code and LaTeX. Image previews add a fit/actual-size toggle, dimension readout, and an alpha checkerboard for PNG/SVG/WebP/GIF/ICO. The hardcoded modal background and PDF summary colors were replaced with theme tokens, so light theme renders correctly across all formats.

Changed

• PDF attachment safety model: PDF excerpts are documented and emitted as untrusted document data, scanned/image-heavy PDFs no longer present as native text when no native pages were found, and read_pdf_visual remains scoped to visual/layout/page-appearance analysis.
• Product positioning: README, docs home, Features, Getting Started, Showcase, Use Cases, GTM, best-fit workflows, artifact docs, architecture, development, troubleshooting, and status docs now frame document, spreadsheet, presentation, web page, PDF, and preview surfaces as one unified artifact workbench inside the broader GUI-first AI super app and everything app positioning. The workbench makes CoWork the default place for everyday generated knowledge work while preserving external-open paths for advanced native workflows.
• Document output concept: README, Features, Architecture, Development, Getting Started, Troubleshooting, Project Status, and the docs index now describe Word-style outputs as first-class document artifacts with sidebar/fullscreen editing for DOCX and preview/external handling for other document formats.
• Spreadsheet output concept: README, Features, Architecture, Development, Getting Started, Troubleshooting, Project Status, and the docs index now describe Excel outputs as first-class spreadsheet artifacts with sidebar/fullscreen workbench behavior rather than only generic XLSX file previews.
• Presentation output concept: README, Features, Architecture, Development, Getting Started, Troubleshooting, Project Status, Use Cases, and the docs index now describe PowerPoint outputs as first-class presentation artifacts with fast text-first preview, cached rendered slides, sidebar/fullscreen review, and deferred refresh after follow-up completion.
• Web output concept: README, Features, Architecture, Development, Getting Started, Troubleshooting, Project Status, Use Cases, Live Canvas, and the docs index now describe generated web pages as first-class artifacts with sandboxed sidebar/fullscreen preview, built React output handling, no automatic dev-server startup, and deferred refresh after follow-up completion.
• Browser-use concept: README, Features, Architecture, Development, Getting Started, Troubleshooting, Use Cases, Web Page Artifacts, and the docs index now distinguish generated web artifacts from live Browser Workbench sessions, with visible sidebar browser automation as the default for normal-user website testing.
• Memory docs refresh: README, Getting Started, Features, Workspace Memory Flow, Supermemory, and the docs index now describe structured archive observations as the inspectable control plane over local memory rather than a replacement for CoWork's authoritative memories table.
• Renderer startup bundle split: secondary renderer views now lazy-load from the app shell, Mermaid loads only when rendering Mermaid code blocks, and syntax highlighting uses highlight.js/lib/core with a bounded language set instead of the package root. The production renderer entry chunk dropped from about 4,842 kB minified (1,267 kB gzip) to about 1,259 kB minified (364 kB gzip); see Development Guide.
• Dev log retention and ingestion: Dev log capture now redacts common secrets before writing files, keeps the last 14 days plus at least the newest 20 runs, caps retained run logs at 100 MB by default, supports COWORK_DEV_LOG_RETENTION_DAYS, COWORK_DEV_LOG_MIN_RUNS, and COWORK_DEV_LOG_MAX_MB, and self-improvement diagnostics prefer dev-latest.jsonl before falling back to dev-latest.log.
• File preview type detection: getFileType (in src/electron/ipc/handlers.ts) and the FileViewerResult.fileType union now recognize audio, json, and csv as first-class types instead of routing them through code/text. JSON moved out of the generic code list, CSV/TSV moved out of the plain-text list, and a new MAX_AUDIO_SIZE (200 MB) caps audio previews. Audio reuses the existing video playbackUrl data-URL/streaming flow, so no new IPC channel was added.

0.5.40 - 2026-04-26

Added

• Release notes for 0.5.40: see Release Notes 0.5.40.
• Workflow Intelligence docs: added the canonical Workflow Intelligence architecture guide and kept the former Subconscious page as a compatibility redirect.
• Chronicle (Desktop Research Preview) docs: added and refreshed Chronicle documentation across the README and docs set, including Memory Hub-first setup, consent/pause controls, dedicated built-in tool category, per-task toggles, observation management, linked screen_context memory generation, and updated troubleshooting/security guidance.
• Routines reset docs and product copy: documented the new routines-first automation model, including expanded routine definitions, execution targets, outputs, trigger coverage, routine runs, and the role of Scheduled Tasks/Webhooks/Event Triggers as lower-level engines or compiled backends.
• AgentMail and expanded Inbox Agent workflows: added AgentMail configuration/realtime support and documented Inbox Agent Classic/Today modes, Mailbox Ask, attachment search, manual reply/reply-all/forward, editable AI drafts, sender cleanup, commitments, and Gmail forwarding automations.
• Managed Agents Hub improvements: managed agents now include templates, role/profile conversion, runtime tool catalogs, routines, governance, insights, audit history, Slack health, workpapers, and image-generation profiles.
• Multi-provider image generation: image settings now cover OpenAI, OpenAI Codex/OAuth, Azure, OpenRouter, and Gemini providers with default/backup routing, model selection, timeouts, and provider-attempt progress.
• LaTeX/PDF artifact workflow docs: documented the new compile_latex source-first workflow across README, feature, use-case, architecture, runtime, troubleshooting, development, showcase, status, ideas, changelog, and docs index surfaces.
• Bundled kami skill: added a new editorial-document workflow for resumes, one-pagers, white papers, letters, portfolios, diagrams, and slide decks, with workspace-local scaffolding, PDF/PPTX render helpers, and related docs.
• Bundled taste-skill frontend workflow: CoWork OS now ships taste-skill as a global bundled skill for high-agency frontend design with stricter anti-slop layout, typography, motion, dependency, and responsive-implementation rules.
• Rich PPTX artifact previews: PowerPoint outputs now open in an in-app presentation viewer with slide thumbnails, navigation, zoom, extracted slide text, and speaker notes. Visual slide images are cached when local soffice + pdftoppm are available and fall back to text-only previews otherwise.

Changed

• Workflow Intelligence concept refresh: updated README, feature, getting-started, Mission Control, Heartbeat, core automation, digital twin, company-ops, troubleshooting, and status docs to describe Memory as source of truth, Heartbeat as scheduler, Reflection as internal evaluation, and Suggestions as the reviewable user-facing output.
• Bundled-skill docs: README, features, skill-store, and related status/comparison docs now reflect the bundled taste-skill addition and the built-in skill count increase to 140.
• Computer use runtime and docs: macOS computer use now documents helper-targeted permissions, normalized tool names, screenshot-relative coordinates, fresh captureId validation, single-session sequential execution, Esc abort, and clearer Chronicle-vs-GUI-control boundaries.
• Artifact and settings surfaces: task outputs, Files, timeline details, AI model settings, Automations, Memory Hub, Tools, and integration settings were updated for presentation previews, LaTeX/PDF pairs, image providers, routines, Chronicle, and AgentMail.
• Developer and packaging guidance: documented focused build commands, Oxfmt/Oxlint/type-check commands, staged skills-check strictness, Kami validation, PPTX preview dependencies, LaTeX troubleshooting, dev-start Electron repair, skill assets, computer-use resources, and refreshed app icons.

Fixed

• Mailbox autosync: autosync is scoped to the singleton IPC service instead of starting from every MailboxService instance.
• Mailbox search and attachments: upgraded mailboxes now backfill FTS before trusting search results, and attachment-content filters search decrypted extracted text.
• Suggestion feedback: welcome suggestions are recorded as acted-on only after prompt submission.
• Image generation dedupe: duplicate protection blocks identical repeated image requests without blocking distinct prompts in the same task.
• Image OAuth and managed routines: fixed derived Codex API key usage for OAuth image generation and synchronized managed routine lifecycle through the routines service.
• Runtime reliability: tightened workflow-intelligence evidence gating, restart/catch-up behavior, hook token scoping, private workspace path exclusions, Azure streaming/tool-call parsing, sidebar/session loading, task replay state, and task pause messaging.

0.5.35 - 2026-04-12

Added

• Release notes for 0.5.35: see Release Notes 0.5.35.
• Managed Agents and Managed Sessions: CoWork now includes versioned managed-agent definitions, durable managed-session runtime plumbing, and Mission Control/control-plane surfaces for operating longer-lived reusable agents.
• Optional Supermemory integration: Supermemory can now act as an external memory lane with setup flows, tool exposure, runtime metadata, Memory Hub controls, and prompt-time profile context injection.
• Task Trace Debugger: a new debugger surface exposes trace requests, projections, formatting helpers, and renderer tabs for inspecting task execution traces directly in the app.
• Bundled novelist skill and CoWork School guide: the shipped skill set now includes a novelist workflow, and the docs now include a beginner-oriented cowork-school guide.

Changed

• Explicit-only turn budgets: main interactive tasks no longer receive implicit strategy-derived maxTurns windows. maxTurns and windowTurnCap are now explicit-only caps, while uncapped tasks rely on lifetime limits, emergency fuses, and existing recovery safeguards.
• Runtime telemetry and docs: turn-budget events, runtime docs, and session/runtime ownership docs now distinguish explicit capped runs from default-unbounded main-task execution more clearly.
• Renderer task-event playback: renderer event handling now batches, throttles, and derives UI state more aggressively so larger task histories replay more smoothly.
• Mission Control, Memory Hub, and provider settings: the UI now surfaces Supermemory controls, trace-debugger controls, provider-specific failover chains, updated lane actions, and more consistent board-card/task summaries.
• Daily briefings and context quality: briefing generation now favors higher-signal context and filters low-signal background automation noise more aggressively.
• Release and packaging guidance: docs and packaging scripts now better enforce artifact-name consistency and local release validation.

Fixed

• Release smoke installs: restored the Electron runtime as an installed dependency so npm run release:smoke no longer falls back into dependency bootstrap on clean consumer installs.
• Chat MCP discovery: fixed MCP tool discovery inside chat sessions.
• Workspace path recovery: stale absolute file paths can now be remapped into the active workspace more reliably during file reads.
• Executor/runtime edge cases: completion evidence checks, pending skill-parameter handling, iCloud execution routing, and extra JSON Schema keys in tool definitions are handled more safely.
• Remote/task data cleanup: remote shadow-task pruning now deletes only rows covered by the fetched remote window.

0.5.34 - 2026-04-08

Added

• Release notes for 0.5.34: see Release Notes 0.5.34.
• Core automation profiles: automation profiles now own the always-on runtime surface, replacing the older heartbeat-centric ownership path.
• Core automation pipelines: the runtime now persists traces, failures, failure clusters, eval cases, harness experiments, learnings, memory candidates, regression gates, and memory-distill runs as first-class data.
• Memory distillation: core memory distillation now has a dedicated service layer, scoped memory resolution, and supporting repositories.
• Research vaults (LLM Wiki): workspace-local research vaults inspired by Andrej Karpathy's LLM Wiki concept now support deterministic source capture, vault search, graph reporting, and filed-back outputs.
• Programmatic video skill (manim-video): a bundled skill now plans and scaffolds Manim CE explainers, equation walkthroughs, algorithm visualizations, and animated architecture/data stories.
• Curated memory and recall: new curated-memory, quote-recall, and session-recall services expand durable context handling.
• PDF text and workspace healing: PDF text extraction and workspace-path healing are now handled by dedicated utility layers.
• File provenance tracking: imported and exported files can now carry trust/provenance metadata through a dedicated registry.

Changed

• Mission Control and onboarding: the UI now surfaces automation profiles, distillation controls, core failures, learnings, companion inbox state, and shared onboarding data more clearly.
• Renderer and completion UX: task completion, disclosure handling, memory hub settings, permission settings, Slack settings, and onboarding screens were updated to fit the new runtime model.
• Gateway and messaging routing: WhatsApp command handling, channel routing, and email/report delivery were updated to match the richer runtime and task-state model.
• Tooling and skill execution: explicit skill invocation matching, runtime tool metadata, tool exposure, and tool-policy inference were refined across the executor and loader layers.
• Provider behavior: OpenRouter and provider-factory behavior were tightened with better catalog loading, logging, and model-selection handling.
• Security and approval flows: approval controls, workspace rule handling, control-plane sanitization, and export-permission context handling were strengthened.
• Documentation and tests: release notes, changelog surfaces, architecture docs, feature docs, security docs, and onboarding guidance were refreshed alongside broader test coverage.

Fixed

• Legacy task migration: fixed legacy task-event migration paths so older task data upgrades cleanly into the newer runtime model.
• Heartbeat compatibility: preserved compatibility while routing dispatch state through automation profiles and handling deferred heartbeat state more carefully.
• Completion evidence: fixed report-task contract inference and completion evidence handling so task finalization is more reliable.
• OpenRouter noise: reduced noisy provider catalog loading and made structured logging more predictable.
• Tool-call sanitization: tightened tool-call and task-message sanitization so malformed payloads are less likely to leak into runtime state.
• Workspace boundaries: edits to workspace ignore files now respect workspace boundaries more strictly.
• Approval and runtime edge cases: updated approval handling, tool exposure, and runtime policy decisions so guarded actions fail more predictably.
• Release artifacts: release artifact naming and packaging logic were aligned with updater metadata so published assets stay consistent.

0.5.23 - 2026-04-05

Added

• Release notes for 0.5.23: see Release Notes 0.5.23.
• Subconscious reflective loop: CoWork now includes a new reflective automation subsystem with persisted targets, backlog items, hypotheses, critiques, dispatch records, artifact storage, migration support, and a dedicated settings surface under Automations.
• Provider-aware prompt caching: stable prompt sections can now be cached across Anthropic, OpenRouter Claude, Azure OpenAI, and OpenAI-family routes, with shared cache metadata persisted in SessionRuntime.
• Adaptive output token policy: request-kind-aware output budgeting now classifies truncation modes, adjusts output-token limits by provider family, and guides retry or continuation behavior when a response hits output ceilings.
• Prompt-aware tool descriptions: built-in tools now carry prompt metadata so the runtime can render concise execution-facing descriptions and compact planning text from one shared definition.
• Imported capability security: managed skills and plugin packs now stage through a shared security gate with persisted reports, quarantine handling, retry/remove actions, and explicit file-import approval tracking.
• Usage Insights projector: usage metrics now support incremental backfill/projection, richer provider breakdowns, retry metrics, normalized provider names, and new renderer helpers for periods and formatting.

Changed

• Execution runtime: prompt assembly now uses cache-aware session- and turn-scoped sections, shared prompt-section hashing, adaptive output-budget state, prompt-aware tool text, and normalized delegation-role inference.
• Provider routing and failover: fallback settings now preserve cached model metadata, respect a configurable retry-to-primary cooldown, keep active failover routes stable, and expose the new behavior in settings and provider docs.
• Anthropic, OpenAI, Azure, and OpenRouter integrations: provider implementations now handle scoped system blocks, prompt-cache metadata, richer usage accounting, safer credential handling, and normalized display names more consistently.
• Import and extension loading: imported skills and plugin packs now carry persisted security reports through loader, installer, registry, IPC, and renderer surfaces instead of surfacing ad hoc warnings.
• Automations terminology and docs: product copy, settings labels, comparisons, and troubleshooting guides now consistently use Subconscious or subconscious loop in place of the older self-improvement language where appropriate.
• Usage Insights UI: the LLM section and charts now use normalized provider names, richer charting, one-day and shared period presets, and extracted formatting helpers.
• Approval and task-detail UX: approval dialogs now render safer command previews, and task detail surfaces were refreshed.
• Gateway, daemon, and worktree plumbing: workspace bootstrap, channel gateway startup, secure worktree persistence, and health snapshots now carry richer routing and provider state.

Fixed

• OpenRouter attribution: request headers now use a single normalized attribution category set across OpenRouter calls.
• Fallback routing stability: retryable provider failures now move through fallback routes more reliably without immediately snapping back to the primary route.
• LLM settings persistence: saving provider settings now preserves fallback chains, retry cooldowns, and cached model metadata more reliably.
• Tool-result reminder payloads: JSON envelopes remain valid when model reminders are attached to tool results.
• Approval command previews: long or multiline commands now render as truncated previews instead of overflowing approval dialogs.
• Managed import integrity: imported skills and packs are rechecked and can be quarantined consistently when their stored bundle no longer matches the expected digest or security outcome.
• Task cleanup bookkeeping: deleting task rows now clears subconscious task references so reflective automation state does not retain stale task pointers.
• Empty follow-up end turns: follow-up loops now retry empty end_turn responses instead of silently finalizing with no text, and repeated empty follow-up responses are surfaced as provider errors.

0.5.19 - 2026-03-30

Added

• App profiles: isolated userData per profile with export/import bundles for migration and multi-environment use (Settings → Profiles).
• Feishu/Lark and WeCom channels: enterprise messaging adapters, settings UI, and gateway registration with webhook and encrypted event handling.
• Gateway channel instances: per-channelId adapter routing so multiple Slack workspaces, distinct channel configs, and correct reply routing coexist in one profile.
• Slack multi-workspace: add more than one Slack channel entry; each workspace is a separate gateway instance.
• Telegram group controls: routing modes and optional allowed group chat IDs.
• Discord guild allowlist: ignore traffic from guilds not in the configured list.
• Signal and email policy alignment: DM/group policies and exact sender or domain allowlists for email ingress.
• Exa web search: new search provider in Settings with ordered fallback integration alongside Tavily, Brave, SerpAPI, Google, and DuckDuckGo.
• Ordered LLM fallback chain: configure up to five ordered fallback providers/models for runtime failover.
• External skill directories: optional read-only absolute skill folders with precedence bundled < external < managed < workspace; Settings UI and secure settings persistence.
• ACP task persistence: acp_tasks SQLite table and handler persistence for restart-safe ACP task state.
• ACP remote invoker: remote HTTP calls with endpoint validation, timeouts, HTTPS preference, loopback-only http, private IP rejection, and remote task cancel.
• ACP scoped access: control-plane scope gates and stricter task/inbox visibility for non-operator clients.
• RuntimeVisibilityService: consolidates runtime learning/recall visibility wiring (replaces legacy internal parity helper).
• Computer use (macOS): session manager, permissions/risk helpers, settings and approval UI; see Computer use (macOS).
• Usage Insights LLM section: model/provider-oriented usage reporting with shared helpers where applicable.
• MCP host: CoWorkHostProvider and host server improvements; tests for MCP host behavior.
• Heartbeat policy repository: persisted heartbeat policy hooks integrated with pulse/heartbeat services.
• Connector-backed Event Triggers: MCP connector notifications and resource updates as trigger inputs with subscription sync (see docs).
• Per-phase workflow model routing: workflow pipeline phases with LLM overrides or capability-based auto-selection.
• Federated ACP orchestration: persisted remote agents and A2A-style invocation with orchestration targeting acp_agent_id.
• Usage Insights quality metrics: persona breakdowns, retry metrics, and feedback quality signals.
• Release notes for 0.5.19: see Release Notes 0.5.19.

Changed

• Gateway router and IPC: refactored for channel-instance maps, pending task metadata, and adapter lifecycle consistency.
• Video tools: validate reference media paths before provider calls.
• Secure settings categories: skills and acp categories for new persistence.
• Documentation: README, docs home, getting started, features, channels, providers, architecture, ACP, enterprise connectors, security, skill store, showcase, GTM, and related pages updated for 17 channels, profiles, Exa, fallback chains, and ACP hardening.
• Automated tests: suite now 4,583+ passing tests across 331+ test files (npm run test; 68 tests skipped in default run).

Fixed

• ACP Vitest stability: handler tests use an in-memory DB fake to avoid better-sqlite3 native ABI mismatches in Node test runners.
• Gateway edge cases: router/channel fixes (e.g. channelId on pending maps, stricter typing and allowlist behavior) and related adapter tests.

Removed

• Legacy parity helper: removed in favor of RuntimeVisibilityService and updated tests.

0.5.18 - 2026-03-30

Fixed

• macOS CI release pipeline: explicitly install Electron binary after npm ci to prevent silent postinstall failures that blocked the macOS release job.
• Shell session manager test portability: resolve temp directory symlinks at creation time to avoid /var vs /private/var mismatches on macOS.
• Completion hardening: verified evidence and entropy sweeps wired into execution, step intent alignment scoring, and LLM fallback for oversized workflow steps.

0.5.17 - 2026-03-30

Added

• Release notes for 0.5.17: added a detailed summary page covering runtime visibility, Discord supervisor mode, Microsoft email OAuth, mailbox hardening, external skill imports, the related Devices/Inbox UX updates, and the release reliability fixes. See Release Notes 0.5.17.
• Operator runtime visibility: task completion now surfaces learning progression, unified recall spans tasks/messages/files/workspace notes/memory/knowledge graph, persistent shell sessions preserve task state, and live provider routing/fallback status is visible in task detail and settings.
• Discord supervisor mode: Discord channels can now run a strict worker/supervisor protocol with persisted exchanges, escalation workflows, Mission Control feed integration, resolve actions, and workspace SUPERVISOR.md guidance.
• Skill Store and external skills: the desktop app can now browse curated skills, search ClawHub, and import external skills from Git repositories, ClawHub pages, raw manifests, or raw SKILL.md URLs into the managed skills directory.
• Microsoft email OAuth: Outlook.com, Hotmail, Live, and MSN personal accounts now support Microsoft OAuth with PKCE, token refresh, connector auth wiring, and Outlook-focused email setup presets.

Changed

• Mailbox and email workflows: mailbox sync, thread actions, and settings now support per-account filtering, no-reply sender handling, Loom recent-message fetches, and OAuth-backed IMAP/SMTP connections with stronger provider validation.
• Mission Control and operator UI: Mission Control now supports an all-workspaces view with workspace badges across board/feed/agent/detail surfaces, task detail shows learning and recall context, and temporary workspaces no longer expose unsupported reporting actions.
• Devices and dispatch surfaces: Dispatch onboarding now lives inside the Devices panel, the standalone Dispatch panel/sidebar entry were removed, Home Dashboard workspace naming now resolves from visible workspaces, and Inbox Agent filter/pulse controls were compacted.
• Security hardening: channel configs are encrypted at rest when available, mailbox bodies/summaries/excerpts are encrypted locally, database/user-data permissions are restricted during setup, mailbox IPC is limited to the main app window, and OAuth secrets are sanitized from renderer-visible channel configs.
• Documentation and positioning: README, features, channels, mission control, architecture, project status, and new comparison/reference pages were refreshed to reflect runtime visibility, supervisor mode, and external skill support.
• Renderer performance: in the CoWork-OS/CoWork-OS repo, sidebar rows now flatten before virtualization, timeline cards use @chenglou/pretext estimates with ResizeObserver reconciliation, and the main transcript cap stays conservative until the transcript surface is virtualized.

Fixed

• Release hardening gate: deterministic eval runs against fresh CI/release databases can now be explicitly configured to allow an empty regression corpus instead of failing every tag-triggered release before packaging starts.
• Release validation on macOS: shell command unit tests no longer pull the full Electron daemon/runtime graph into Vitest, approval mocks are reset between cases, tool-group risk metadata now matches the security invariants, and the shell-session integration test has a CI-safe timeout budget.
• Unsupported Outlook manual setup: manual password-based IMAP/SMTP setup is now rejected for Outlook.com-family consumer accounts, steering users to Microsoft OAuth instead of failing later in the transport stack.
• Outlook MIME handling: Outlook-style multipart emails are parsed more reliably without leaking MIME boundary artifacts into visible message bodies.
• Supervisor and mailbox edge cases: supervisor configs now validate required routing fields up front, escalated exchanges can be resolved from the activity feed, and mailbox cleanup/no-reply handling is less likely to generate bad follow-up actions.

0.5.14 - 2026-03-29

Added

• Release notes for 0.5.14: detailed summary page covering inbox identity, Mission Control handoff, mailbox automation, Google Workspace helpers, and the related UI and branding refresh. See Release Notes 0.5.14.
• Inbox identity and handoff: Inbox Agent now links contact identities across email and messaging, can reply through the active channel, and can hand threads off to Mission Control.
• Mailbox automation: rules, reminder cadences, and patrol schedules are now modeled as first-class inbox automation flows.

Changed

• Workspace surfaces: inbox, settings, and Mission Control views now reflect the new cross-channel inbox workflow.
• Documentation counts: docs home and feature references were synchronized to the current product counts.

0.5.11 - 2026-03-20

Added

• Release notes for 0.5.11: added a detailed summary page covering mission control, QA, native health, connectors, and runtime routing changes included in this release. See Release Notes 0.5.11.
• aurl skill: Optional skill for aurl — register OpenAPI/GraphQL APIs by name, explore endpoints, make validated requests. Opt-in: skill appears only when aurl is installed. See aurl skill docs.
• 14 new MCP connectors (44 total): Tavily (web search), tldraw (diagrams), Amplitude (analytics), Clerk (auth), Mem (notes), Grafana (monitoring), Mailtrap (email), Socket (dependency security), Metabase (analytics), Shadcn UI (components), GrowthBook (feature flags), Drafts (macOS notes), Fantastical (macOS calendar), Tomba (email finder/verifier). All npm-installable from Settings > Connectors.

Changed

• Mission Control and health surfaces: new Mission Control tabs, a dedicated Health panel, Dispatch panel, and connector profile view now extend the primary operator surface.
• Runtime and agent routing: chat-mode and context-mode detection, proactive suggestions, managed output paths, tool-policy changes, and executor/provider refreshes tightened task routing.
• Operator intelligence: autonomy/awareness services, heartbeat orchestration, briefing updates, strategic planner changes, mode-suggestion detection, automated-task detection, connector profiles, and health primitives were refreshed.
• Renderer refresh: sidebar, settings, home dashboard, notification, and personality surfaces were broadly updated for the new release layout.
• Shared release assets: bundled skills, document generators, and type/provider formatting updates were added to support the expanded runtime.

0.5.1 - 2026-03-18

Added

• Chrome DevTools attach mode: browser_attach tool for connecting to existing Chrome via CDP. See Browser Automation.
• Batched browser actions: browser_act_batch for sequential click, fill, type, press, wait, scroll with optional delays.
• Browser profile presets: user, chrome-relay, workspace presets. Use browser_attach for existing signed-in sessions.
• Docker timezone: COWORK_TZ env var for IANA timezone in Docker and systemd. Invalid values fall back to UTC.
• Gateway exec approval fallback: Per-agent policy and allowlist honored for channel-originated run_command; trusted commands auto-approved when approval UI unavailable.
• Managed devices docs refresh: documented the Devices tab, saved remote devices, remote task launching, per-device summaries, and remote file selection workflows.
• Automation control center docs refresh: documented the consolidated Automations settings group and the relationship between Task Queue, Scheduled Tasks, Webhooks, Event Triggers, Daily Briefing, and the reflective automation surface available at the time.
• Zero-human-company docs refresh: documented the Settings > Companies workflow, persisted company-linked digital twins, and company-aware handoff between Companies, Digital Twins, and Mission Control.
• HuggingFace Local AI provider: added hf-agents + llama.cpp local-model support with installation checks, model selection, and local server lifecycle management from Settings.
• Research channels: Telegram and WhatsApp chats can now be designated as link-research channels that automatically turn posted URLs into a structured findings report.
• Tool catalog versioning: tool discovery now emits a stable SHA-1 catalog hash that covers native tools and MCP state, with immediate snapshot rebuilds after MCP status or tools_changed updates.

Changed

• Dashboard chat UI: Batched tool events (400ms flush) to avoid UI freeze; flush on subscription cleanup.
• README and feature documentation: updated product-facing docs to reflect managed devices, automation navigation, bounded reflective automation for git-backed workflows, remote session inspection, and the current companies workflow.
• Self-improvement documentation: added detailed architecture and troubleshooting coverage for staged autonomous campaigns, startup ordering, worktree requirements, candidate parking/cooldowns, notification flow, and logs/dev-latest.log verification steps.
• IPC contract documentation: clarified that kit:openFile, kit:resetAdaptiveStyle, and kit:submitMessageFeedback live in the shared IPC_CHANNELS registry used by preload, renderer, and Electron handlers.
• Connector surface consolidation: the shipped MCP allowlist is now Salesforce, Jira, HubSpot, Zendesk, ServiceNow, Linear, Asana, Okta, Resend, Discord, and Google Workspace. Google services are consolidated under google-workspace; DocuSign, Outreach, and Slack were removed from the shipped Tier-1 connector surface.
• Native-first GitHub and Notion routing: GitHub and Notion workflows now prefer CoWork's direct API paths and fall back to MCP only when needed.
• Collaborative task UI: sidebar/task views now use inline agent headers, Lucide role icons, markdown normalization for collaborative output, and explicit sub-task back-navigation.
• Notifications: task notifications now use cleaner titles, humanized statuses, and direct view actions.

Fixed

• Browser profile=user errors: Clearer messages when Chrome not installed or profile locked.
• Invalid COWORK_TZ: Validation with UTC fallback.
• Event batch loss: Flush pending events on subscription cleanup.
• Autonomous improvement startup race: ImprovementLoopService now starts after MemoryService initialization, skips non-worktree-capable workspaces when isolated git execution is required, and suppresses misleading legacy ERR_UNHANDLED_ERROR log noise from unhandled "error" alias emission during startup failures.
• Improvement loop candidate persistence: fixed the improvement_candidates repository insert mismatch that could fail startup with SqliteError: 27 values for 28 columns and prevent ImprovementLoopService initialization.
• Workspace Kit / behavior-adaptation IPC constants: restored the shared IPC_CHANNELS entries for KIT_OPEN_FILE, KIT_RESET_ADAPTIVE_STYLE, and KIT_SUBMIT_MESSAGE_FEEDBACK so preload, renderer, and handler code stay aligned.
• Executor tool cache invalidation: executor-side tool snapshots are now invalidated consistently when the shared catalog version changes.
• Sidebar task navigation polish: sessions header layout, filter affordance, and sub-task navigation behavior were tightened for collaborative runs.

0.4.13 - 2026-03-05

Added

• Universal workflow slash skills: /simplify and /batch now work across desktop and gateway channels, including inline chaining (then run /simplify) and shared parsing/normalization.
• Zero-config web search fallback: DuckDuckGo now acts as a built-in last-resort search provider, so web_search works even without paid API keys.
• Structured input requests: plan-mode tasks can use request_user_input to pause for persisted multiple-choice decisions, with submission from the desktop UI or Control Plane dashboard.
• Tier-1 integration orchestration: new integration_setup flow supports list, inspect, and configure for Resend, Slack, the Google family, Jira, Linear, and HubSpot with expected_plan_hash stale-plan protection.
• Approval-gated skill expansion: new skill_proposal lifecycle lets agents draft, list, approve, and reject workspace-local skill proposals instead of mutating skills directly.
• Workspace bootstrap lifecycle: .cowork/BOOTSTRAP.md, .cowork/VIBES.md, .cowork/LORE.md, and .cowork/workspace-state.json now track onboarding/bootstrap state and heartbeat-ready context.
• Workspace agent policy: optional agent-policy.toml can require tool families, filter tools, tune loop thresholds, and attach pre-tool / stop-attempt hooks per workspace.
• New bundled skills: added Polymarket, Humanizer, YouTube video intelligence, Stock analysis, Calendly scheduling, Moltbook, and Marketing Strategist skills.
• Developer logging capture: npm run dev can mirror timestamped output to logs/dev-latest.log, with npm run dev:log forcing capture regardless of the Settings toggle.

Changed

• Adaptive executor defaults: execution-oriented tasks now default to adaptive turn-window recovery, follow-up safety stops, and bounded context-overflow retries instead of treating window exhaustion as an immediate hard failure.
• Path reliability policies: the executor and file tools can normalize /workspace/... aliases and rewrite drifted relative paths back under a pinned task root, with strict_fail policies available when hard enforcement is desired.
• Timeline rendering: parallel read-only tool bursts are projected into grouped lane cards, task completion is inferred more reliably from timeline payloads, and input-request / recovery events now map cleanly across shared status and timeline models.
• Completion and insights UX: usage insights now surface token/runtime/top-tool metrics and reliability outcomes, while renderer timelines and output surfaces continue the filename-first, output-ready workflow.
• Pi provider compatibility: OpenAI ChatGPT OAuth and Pi-backed model discovery now load @mariozechner/pi-ai 0.56.1 through lazy ESM loaders so Electron/CommonJS bundles keep working.
• Remote and headless operations: the Control Plane dashboard now handles pending structured input requests in addition to tasks, approvals, workspaces, and channels.

Fixed

• Shell protocol violations: run_command now rejects direct or wrapped apply_patch invocations and tells the agent to use the dedicated patch tool.
• Task-root rewrites: pinned-root recovery no longer skips rewrites just because an unpinned root-level path already exists, preventing drifted writes from mutating the wrong files.
• Legacy read-only resumes: tasks resumed without executionModeSource now keep user-selected non-execute modes instead of being auto-promoted to mutation-capable execution.
• Electron-optional OAuth imports: connector and Google Workspace OAuth helpers now resolve shell.openExternal lazily so plain Node test/release environments can import them without a packaged Electron runtime.
• Task execution heuristics: write-intent detection, duplicate-mutation bypass, follow-up tool locking, and browser-session verification heuristics were tightened to reduce false stalls and false completions.
• Canvas URL validation: canvas browsing now rejects non-HTTP(S) schemes explicitly.
• Documentation alignment: README, architecture, remote-access, development, and getting-started docs now reflect structured input, recovery policies, and Control Plane input-request handling.

0.4.12 - 2026-02-28

Added

• Agentic Work Unit (AWU) metric: Usage Insights now tracks agent efficiency via AWU — successfully completed tasks measured against tokens and cost consumed. Shows AWU count, tokens/AWU, cost/AWU, AWUs per dollar, and period-over-period trend comparison.
• All Workspaces aggregation: Usage Insights defaults to "All Workspaces" view, aggregating metrics across every workspace. Individual workspace filtering remains available via dropdown.
• Completion output summary payload: task_completed events now support an optional outputSummary contract with normalized output metadata (created, modifiedFallback, primaryOutputPath, outputCount, folders). This keeps completion UX accurate even when renderer event history is capped.
• Completion output UX actions: completion toasts now show output-aware copy (including filename/count) and include direct actions for Open file, Show in Finder, and View in Files.
• Shared renderer completion UX utilities: added reusable helpers for completion toast construction, output badge behavior, panel auto-open decisions, and output/event visibility rules.
• Artifact visibility parity across bridges: artifact_created is now included in collaborative child-file merging and in the control-plane task event bridge allowlist, so artifact-only tasks are visible consistently in all surfaces.

Changed

• Usage Insights UI redesign: Replaced single-column layout with compact hero stats row (completed, success rate with color-coded progress bar, failed, avg time) and two-column grid for detailed sections (Cost & AWU side-by-side, Activity Day & Hour side-by-side, Skills & Packs side-by-side).
• Output detection rule: completion output detection now prefers newly created outputs (file_created, artifact_created) and only falls back to modified outputs when no created outputs exist.
• Right panel file-output emphasis: Files section now highlights primary output, shows an output count badge, and adds a separate location context line while keeping filename-only rows.
• Completion timeline details: task_completed now renders an explicit "Output ready" details card (with actions) when outputs exist; artifact_created is treated as important and expandable in summary/technical timelines.
• Status-map coherence for artifact events: artifact_created now maps to executing in shared task event status mapping for consistent in-progress state display.

Fixed

• Database startup migration ordering: moved task evaluation/index-related index creation from bootstrap table creation to post-migration execution so databases created pre-risk_level and eval_* columns no longer fail on startup (no such column: risk_level).
• Hidden extensionless outputs in files list: output files without a dot in the filename are no longer filtered out from the right-panel files section.

0.3.90 - 2026-02-23

Added

• Git Worktree Isolation: Tasks can run in isolated git worktrees with automatic branch creation (cowork/<task-slug>), auto-commit, merge back to base branch, conflict detection, and worktree cleanup after completion.
• Collaborative Mode: Auto-create ephemeral multi-agent teams for a task. Multiple agents work in parallel, sharing their analysis and reasoning in real-time via the Collaborative Thoughts Panel, with a leader agent synthesizing the final result.
• Multi-LLM Mode: Send the same task to multiple LLM providers/models simultaneously. A judge agent synthesizes the best result from all participants. Configure participants and judge via the Multi-LLM Selection Panel.
• Agent Comparison Mode: Run the same task across different agents or models side by side using the ComparisonService. View results in a dedicated comparison UI with diff viewer.
• Task Pinning: Pin/unpin tasks in the sidebar for quick access. Pinned tasks always appear at the top regardless of sort order. Toggle via context menu or keyboard shortcut.
• Wrap-Up Task: Gracefully wrap up running tasks instead of hard-cancelling. The agent finishes its current thought and produces a summary before stopping. Available for both individual tasks and team runs.
• Git Tools: New agent tools for git operations — git_commit, git_diff, and git_branch — with worktree-aware execution for isolated task environments.
• Capability Matcher: Auto-select the best agents for a task based on capability matching against agent role skills and the task requirements.
• Collaborative Thoughts Panel: Real-time UI component showing agent thinking, analysis, and synthesis during collaborative and multi-LLM mode runs. Includes phase indicators and streaming thought bubbles.
• Scroll-to-bottom button: Floating button in task view for quick navigation to the latest events.
• VPS uninstall documentation: Added uninstall/removal instructions for VPS deployments covering both partial (keep data) and full (irreversible) paths for Docker and systemd setups.
• New skill packs: Crypto Trading, Crypto Execution, Trading Foundation, and Email Marketing Bible skill definitions with scripts and tests.
• XLSX file support: Excel spreadsheets (.xlsx/.xls) can now be read and extracted as tab-separated text in the file viewer, with formula result, rich text, and date support.
• Attachment chips in chat bubbles: user message bubbles render compact file-attachment chips instead of raw file-path listings.
• Varied failure loop detection: executor detects when a tool fails 5+ times with different inputs and nudges the agent to switch strategy.

Changed

• Executor modular refactoring: TaskExecutor split into dedicated utility modules — completion logic, canvas rendering, prompt heuristics, tool execution, loop management, LLM turn handling, assistant output processing, and workspace preflight checks. New ExecutorEventEmitter and LifecycleMutex for cleaner concurrency control.
• Task event bridge contract: Inline event type allowlist extracted from control-plane handlers into a shared task-event-bridge-contract module, making it reusable and testable.
• Task event status map: Inline status mapping extracted to a shared task-event-status-map module used by both renderer and control plane.
• Agent team orchestrator: Extended with collaborative mode phases, thought capture, wrap-up support, multi-LLM synthesis, and run phase tracking.
• Database schema: Added is_pinned column to tasks, agent_team_thoughts table, phase/collaborative_mode/multi_llm_mode columns to agent_team_runs, worktree and comparison_session tables.
• Document creation defaults: Markdown (.md) is now the preferred output format; create_document (DOCX/PDF) only triggers on explicit user request.
• Hooks auto-token: enabled hooks server auto-generates a missing authentication token instead of silently disabling.
• Reduced startup log noise: zero-count messages for plugins, canvas sessions, and legacy settings are suppressed; MCP stderr demoted to debug.
• Slack Socket Mode timeouts: relaxed ping/pong timeouts (15s/60s) to reduce reconnection churn on unstable networks.

Fixed

• Stuck 'executing' status: tasks can no longer remain in executing state after follow-ups — safety nets ensure completed or restored status.
• User identity leakage: personality prompt now explicitly instructs the LLM to ignore names from file paths, filenames, and OS metadata when a preferred name is stored.
• WhatsApp connection flap detection: rapid disconnect/reconnect cycles are detected and throttled with enforced backoff.
• Artifact false positives: attachment filenames (e.g. "26targets.xlsx") no longer falsely trigger document-creation mode; read-only steps skip artifact output requirement.
• Collapsible user bubble toggle: shows both "Show more" and "Show less" (previously button disappeared after expanding).
• Daemon shutdown task persistence: active tasks are marked cancelled in DB before executor cancellation to prevent orphaned-task detection on restart.

[0.3.86] - 2026-02-14

Added

• ACP and Canvas control-plane endpoints: introduced ACP task-delegation handlers and new canvas APIs (canvas.list/get/snapshot/content/push/eval/checkpoint.*) with corresponding protocol constants and IPC wiring.
• Canvas checkpoint tooling: added canvas_checkpoint, canvas_restore, and canvas_checkpoints tools, plus in-memory checkpoint history and restore flows in CanvasManager.
• Renderer i18n support: added language resources and UI selection for English, Japanese, and Simplified Chinese, with persisted language preference.
• Talk Mode UX: introduced continuous voice talk-mode hook and UI controls for conversational voice interaction in main task view.

Changed

• Agent execution flow hardening: executor now emits long-running tool heartbeats, tracks recovered failures more precisely, and preflights shell-permission requirements when command execution is required.
• Shell approvals and safety: run_command now supports single-approval bundle mode for safe command sequences and normalizes signatures more robustly for duplicate detection.
• Gateway routing extensibility: router now supports channel-level defaultAgentRoleId, defaultWorkspaceId, and allowedAgentRoleIds, plus new set_agent router-rule action.
• Skill registry backend: default registry now points to GitHub static catalog mode with client-side cached search and static skill fetch/install paths.
• Plugin discovery behavior: plugin registry initializes at startup and supports incremental discovery of newly-added plugins without full re-init.

Fixed

• Sensitive shell output leakage: command output now redacts seed phrases and private-key material before logging/model context.
• Isolated macOS install keychain prompt safety: added COWORK_DISABLE_OS_KEYCHAIN=1 path to bypass OS keychain integration in disposable test environments.
• Task activity signaling in UI: task “working” indicators now consider tool calls/results and tool-execution progress heartbeats, reducing false idle states.
• Install reliability carry-forward: retains prior setup retry behavior and low-memory setup defaults while validating clean first-install flow.

[0.3.85] - 2026-02-14

Fixed

• Hoisted Electron detection in setup: npm run setup now treats ../electron as valid in npm-hoisted installs, so first-time setup no longer triggers unnecessary full dependency bootstrap.
• Native setup install scope: missing better-sqlite3 recovery and rebuild now run from the actual install root (not inside node_modules/cowork-os), reducing first-run reify pressure that caused frequent macOS SIGKILL.
• Release publish gating: npm/GitHub package publish jobs now depend on the release validation job, and smoke tests fail if setup unexpectedly falls back to dependency bootstrap.
• Install docs hardening: README now includes a direct native retry-wrapper fallback when npm run --prefix node_modules/cowork-os setup is terminated by zsh: killed, and recommends local bin launch over npx for first run.

0.3.84 - 2026-02-14

Fixed

• Release smoke-test module resolution: installability validation now runs Electron with cwd set to the installed cowork-os package directory so require('better-sqlite3') resolves correctly after setup.
• Release continuity: keeps the 0.3.82 npm SIGKILL regression fix while restoring end-to-end GitHub release packaging path after CI validation.

0.3.83 - 2026-02-14

Fixed

• Release workflow syntax fix: corrected the installability smoke-test shell step so the release pipeline no longer exits with syntax error: unexpected end of file before desktop packaging.
• Release continuity: preserves the 0.3.82 npm SIGKILL fix while restoring full GitHub release asset publishing (DMG/ZIP).

0.3.82 - 2026-02-14

Fixed

• SIGKILL regression fix for npm installs: setup_native no longer uses npm install --ignore-scripts=false when recovering missing better-sqlite3, preventing electron-winstaller lifecycle scripts from being executed during first-time setup.
• Recovery install hardening: missing runtime dependency repair now uses --omit=dev and --package-lock=false to avoid reifying packaging/dev dependency trees in user runtime installs.

0.3.81 - 2026-02-14

Fixed

• README install path hardening: npm run setup now skips a full dependency reinstall when the Electron dependency is already present, so fresh /tmp installs avoid avoidable reinstall-driven SIGKILL pressure.
• Native setup reliability: restores the 0.3.71-style flow with retryable native setup and keeps better-sqlite3 installation script-safe, then rebuilds it explicitly against Electron ABI.

0.3.80 - 2026-02-14

Fixed

• macOS install reliability hardening: setup now skips optional dependency reinstall during npm run setup, avoids propagating child SIGKILL events from native setup back to the shell, and documents a first-install flow that avoids macOS-terminating paths.
• Release validation hardening: CI now resolves release metadata before install validation and validates installability from either published npm tarball (if already published) or local npm pack fallback, preventing release regressions for first-release tags.

0.3.79 - 2026-02-14

Fixed

• macOS install reliability carry-forward: retained the 0.3.71 SIGKILL workaround for first-time users by documenting and reinforcing the npm install --ignore-scripts + npm run --prefix node_modules/cowork-os setup flow.
• Release workflow hardening: ensured the macOS release job always creates or reopens the GitHub release as a draft before packaging so electron-builder can attach DMG/zip assets without immutable-release failures.
• Version alignment: published metadata now identifies this release as 0.3.79 with the same installability and packaging reliability changes.

0.3.78 - 2026-02-14

Fixed

• Release build hardening: restored the missing src/electron/agent/executor-helpers.ts source file so builds can resolve executor.ts imports after packaging from a fresh clone.
• TypeScript strictness fixes: fixed implicit any errors in executor.ts that could break release builds on CI.
• TLS fingerprint callback typing fix: aligned remote-client.ts callback signature/type usage with current ws client typings to satisfy strict build checks.

0.3.77 - 2026-02-14

Fixed

• Setup script safety: npm run setup in a fresh install now runs dependency reinstall with --ignore-scripts so optional postinstall hooks like electron-winstaller cannot SIGKILL the process during first-run recovery on macOS.
• Install reliability carry-forward: this patch keeps the documented /tmp first-install sequence intact while ensuring setup stays stable across npm install layouts.
• Version alignment: published metadata is now aligned on 0.3.77 so the installability fix is included in both npm and GitHub release tracks.

0.3.76 - 2026-02-14

Fixed

• Installability restoration: pinned electron to 40.2.1 so first-time installs from npm pull the known-good Electron patch and avoid SIGKILL during node_modules/electron/install.js on affected macOS environments.
• README alignment: clarified the first-time CLI install path to reflect the exact commands users should run from a fresh temporary folder.

0.3.75 - 2026-02-14

Fixed

• Installability fix from 0.3.71: restored Electron lockfile behavior by keeping electron at 40.2.1 during publish-time installs, matching the working 0.3.71 state and avoiding default SIGKILL during node_modules/electron/install.js on affected installs.

[0.3.74] - 2026-02-14

Fixed

• Release pipeline reliability: updated the GitHub release publish step to find and publish the tag created by electron-builder instead of assuming the trigger ref matches exactly.
• Release docs/notes alignment: updated release notes and README "What’s new" section for 0.3.74 to reflect install and CI reliability fixes.
• Release artifact consistency: ensured workflow publishes desktop artifacts and release notes from the same release tag path used by electron packaging.

0.3.73 - 2026-02-14

Fixed

• Release pipeline fix: included daemon TypeScript sources in shared ESLint targets so npm run lint runs instead of failing with parse errors before build/publish steps.
• Workspace/task validation fix: enforced PersonalityId validation for task agent configs to prevent runtime/inference mismatches during task creation.
• CLI and release install tests alignment: updated control-plane and skill validation tests to match current runtime behaviors and skill metadata output.
• Workspace preflight reliability: stabilized ambiguous temp-task auto-switch behavior when project-signals are present and tests now validate that behavior.

0.3.72 - 2026-02-14

Added

• Session workspace isolation and cleanup: temp tasks now get session-scoped workspace IDs, dedicated temp directories, and automatic pruning by age + usage caps.
• Autonomous task mode in execution flow and control-plane/web-UI paths, with optional bypass of interactive approval prompts where explicitly enabled.
• Companion-mode handling for short conversational prompts to return concise check-in responses without running task pipeline when appropriate.
• Search execution ordering now prefers Brave when available and can safely fallback through configured providers automatically.
• PDF parsing compatibility wrapper with runtime-safe handling for both legacy and v2 parser module shapes.

Changed

• Task completion validation tightened with final-response contracts (required direct answers, artifact checks, verification evidence).
• Stricter tool failure handling for hard/unavailable/disallowed outcomes to prevent false completion without real progress.
• Temporary workspace handling now uses explicit session-aware IDs and filters temp workspaces from user-visible lists consistently.
• Search and file tools now enforce more bounded scanning behavior and clearer fallback behavior under high-load conditions.

Fixed

• Watch/skip recommendation tasks now block artifact tools and require direct recommendation output.
• Intermittent approval/partial-task updates reduced by normalizing auto-approved events in UI and task-stream handling.
• Temp workspace lifecycle reliability improved through scheduled pruning and safer restore/create paths.

[0.3.69] - 2026-02-11

Fixed

• npm install -g cowork-os could fail on macOS with fsevents (binding.gyp not found) due an npm 11 rebuild edge case triggered by playwright.
• Switched runtime browser dependency to playwright-core via npm alias (playwright package name preserved in code) to avoid the failing fsevents install path.
• Added launcher self-heal: on first run, cowork-os now verifies direct runtime dependencies and repairs missing packages with a script-free npm install pass before boot.
• Moved @types/jszip to devDependencies and excluded @types/* from runtime dependency checks to avoid unnecessary first-run repair installs.
• Moved @electron/rebuild to runtime dependencies so native fallback rebuild works in npm-installed environments.
• Fixed native setup fallback to locate @electron/rebuild via package exports (instead of resolving blocked subpaths), so fallback rebuild actually runs when needed.
• cowork-os first run now uses the shell retry wrapper for native setup, reducing one-shot startup failures when macOS kills a setup attempt under memory pressure.

[0.3.68] - 2026-02-11

Fixed

• cowork-os CLI startup could still fail with better-sqlite3 ABI mismatch on first launch.
• Launcher now validates better-sqlite3 by opening an in-memory database (not just requiring the module) and runs native setup when needed.
• Native setup script now resolves hoisted dependencies correctly (Electron and better-sqlite3) so it works in npm-installed layouts.

[0.3.67] - 2026-02-11

Added

• Added npm CLI command support: cowork-os, coworkctl, coworkd, and coworkd-node.

Fixed

• Fixed launcher script to resolve the Electron binary correctly (require('electron') instead of require.resolve).
• Included dist/ in published npm files so the cowork-os command can start without requiring a local build step.
• Moved electron to runtime dependencies so CLI launch works after normal npm install.

[0.3.66] - 2026-02-11

Fixed

• npm ci could hang indefinitely in CI due an overrides.undici resolution loop on npm 11.
• Removed the undici override so release and publish jobs can complete.

[0.3.65] - 2026-02-11

Fixed

• npm publishing no longer waits for the macOS packaging job in release.yml.
• This prevents npm release delays when GitHub macOS runners are stalled while still allowing desktop packaging to run independently.

[0.3.64] - 2026-02-11

Fixed

• Release workflow could stall for a long time at Install dependencies when git-based dependencies attempted SSH transport on GitHub runners.
• CI now forces GitHub git dependencies to HTTPS before npm ci in all release/publish jobs.
• Added explicit workflow timeouts and npm ci --no-audit --no-fund to reduce long-running hangs during release.

[0.3.63] - 2026-02-11

Fixed

• npm installs could still fail with SIGKILL in transitive protobufjs postinstall hooks under macOS memory pressure.
• Bundled @mariozechner/pi-ai and @whiskeysockets/baileys in the published npm tarball so their transitive install scripts are not executed on end-user npm install.
• Restricted published package contents via files in package.json to remove large non-runtime artifacts and reduce install-time memory pressure.

[0.3.62] - 2026-02-11

Fixed

• npm installs could still fail when the package postinstall script itself was SIGKILL'd by macOS memory pressure.
• Removed postinstall from the published npm package so npm install cowork-os@latest no longer depends on any CoWork lifecycle hook.

[0.3.61] - 2026-02-11

Fixed

• npm installs could fail with sh: electron-rebuild: command not found because postinstall depended on a tool not available in all install contexts.
• postinstall now uses a best-effort native setup driver and never fails the overall npm install.
• better-sqlite3 is now an optional dependency so transient native build failures no longer abort npm install; npm run setup now ensures it is installed before rebuild.

[0.3.60] - 2026-02-11

Fixed

• npm installs could fail on macOS with Killed: 9 during dependency lifecycle scripts due to floating dependency upgrades.
• Pinned @whiskeysockets/baileys to 6.7.16 and better-sqlite3 to 12.6.2 to avoid pulling newer variants that increased install-time instability.

[0.3.59] - 2026-02-10

Fixed

• Increased default native setup outer retry attempts on macOS so npm run setup is more resilient to repeated transient Killed: 9 SIGKILLs on the first run after install.

[0.3.58] - 2026-02-10

Fixed

• macOS npm run setup could still fail with Killed: 9 if the native setup retry wrapper itself was SIGKILL’d immediately after install; setup now performs outer retries (with backoff) around native setup so a transient SIGKILL doesn’t require manual re-runs.

[0.3.57] - 2026-02-10

Fixed

• macOS npm run setup could still fail with Killed: 9 if the nested npm run setup:native process was SIGKILL’d; setup now runs the native setup retry wrapper directly (no nested npm process) and propagates SIGKILL as exit code 137 so retries reliably trigger.

[0.3.56] - 2026-02-10

Fixed

• macOS npm run setup could still fail with Killed: 9 if macOS SIGKILL’d Node before in-process retries could run; native setup now uses a POSIX shell retry wrapper with exponential backoff so users don’t need to re-run commands manually.

[0.3.55] - 2026-02-10

Fixed

• macOS npm run setup could still fail with Killed: 9 before the retry driver could start; setup now retries native setup at the shell level (multiple attempts) so users don’t need to re-run commands manually.

[0.3.54] - 2026-02-10

Fixed

• macOS npm run setup could still fail with Killed: 9 on the first run under memory pressure; native setup now runs via a retrying driver and setup disables npm audit/fund to reduce peak memory usage.

[0.3.53] - 2026-02-10

Fixed

• macOS npm run setup could still fail with Killed: 9; native setup now prefers an Electron-targeted better-sqlite3 rebuild via npm rebuild (often uses prebuilds) and only falls back to electron-rebuild when necessary.

[0.3.52] - 2026-02-10

Fixed

• macOS npm run setup could fail with Killed: 9 during native module rebuild; native setup now defaults to low parallelism for reliability.

0.3.29 - 2025-02-08

Added

• Vision Tool - Analyze workspace images (screenshots, photos, diagrams) via analyze_image
  • Supports OpenAI, Anthropic, and Google Gemini vision providers
  • Workspace-safe file resolution with MIME type detection
  • Handles images up to 20 MB
• Email IMAP Tool - Direct IMAP mailbox access via email_imap_unread
  • Check unread emails without requiring Google Workspace integration
  • Uses existing Email channel IMAP/SMTP configuration
• Chat Commands - New slash commands available across all gateway channels
  • /schedule <prompt> - Schedule recurring agent tasks with results delivered back to the chat
  • /digest [lookback] - Generate on-demand digest of recent chat messages
  • /followups [lookback] - Extract follow-ups and commitments from recent chat messages
  • /brief [today|tomorrow|week] - Generate brief summaries (DM only)
  • /brief schedule|list|unschedule - Manage recurring brief schedules
• Inbound Attachment Persistence - Channel messages with attachments are saved to workspace
  • Files persisted under .cowork/inbox/attachments/<date>/<channel>/<chat>/<message>/
  • Attachment extraction added to Discord, Slack, Teams, Telegram, Google Chat, and iMessage adapters
  • Saved paths appended to task prompts so agents can inspect files (and images via analyze_image)
• Cron Template Variables - Dynamic variables in scheduled task prompts
  • Date variables: {{today}}, {{tomorrow}}, {{week_end}}, {{now}}
  • Chat context variables: {{chat_messages}}, {{chat_since}}, {{chat_until}}, {{chat_message_count}}, {{chat_truncated}}
  • Conditional delivery: deliverOnlyIfResult skips posting when the task produces no output
• Chat Transcript Formatter - New formatChatTranscriptForPrompt() utility for injecting chat history into agent prompts
• Tool Restrictions Tests - New test suite for agent tool restriction enforcement
• Image Generation (Multi-Provider) - Generate images via generate_image tool with provider auto-selection
  • Supports Gemini (gemini-image-fast, gemini-image-pro), OpenAI (gpt-image-1, gpt-image-1.5, DALL-E 3/2), and Azure OpenAI (deployment-based)
  • Model alias resolution (e.g. "gpt-1.5" → gpt-image-1.5, "dalle-3" → dall-e-3)
  • Provider auto-selection picks the best configured provider when not specified
  • Azure deployment detection for image-capable deployments
  • 180-second tool timeout for remote image generation
• Visual Annotation Tools - Agentic generate → annotate → refine → repeat workflow
  • visual_open_annotator - Open Live Canvas with an image for visual annotation
  • visual_update_annotator - Update the annotator with a new iteration image
  • Structured feedback via canvas interactions (visual_feedback, visual_regenerate, visual_approve)
• Agentic Image Loop Skill - New built-in skill for iterative image refinement
  • Generate an image, open the Visual Annotator, collect user markup, refine prompt, regenerate
  • Loops until user approves the result
• Inline Image Preview - Generated images display directly in the task event timeline
  • Auto-expands for file_created/file_modified events with image files
  • Click to open in the full image viewer
• Local Embeddings for Memory - Lightweight local vector embeddings without external API calls
  • Token-based hashing for 256-dimensional vectors
  • MemoryEmbeddingRepository for persisting embeddings in memory_embeddings table
• Global Imported Memory Search - Cross-workspace search for ChatGPT imported memories
  • searchImportedGlobal enables sessions in any workspace to retrieve imported history
  • FTS with relaxed fallback and LIKE-based backup query

Changed

• Task Export - Moved from telemetry/ to reports/ to better reflect purpose (structured task summaries, not telemetry)
• Skill Metadata - Added requires.bins and invocation.disableModelInvocation to gog and himalaya skills
• Local Websearch Skill - Updated branding (moltbot → cowork) and paths to Application Support/cowork-os
• Agent Executor - Improved email fallback logic: prefers email_imap_unread when Google Workspace tools are unavailable
• Agent Executor - Fixed missing tool_result entries on pause/cancel to keep API message history valid
• Channel Tools - Added channel status and warning metadata to channel_list_chats and channel_history results
• Cron Delivery - When a task has a non-empty result, delivery messages now include the result text directly instead of a generic status line
• Email Client TLS - Load macOS system keychain CAs for IMAP/SMTP connections (fixes corporate proxy/antivirus TLS inspection)
• Email Client IMAP - Improved response buffering and greeting handling reliability
• Image Generation - Replaced single-provider "nano-banana" model system with multi-provider architecture; removed deprecated model aliases from pricing
• Gemini Provider - Removed banana filter from model discovery exclusion list
• Verification Steps - Verification steps are now internal; agent responds with "OK" on success instead of verbose summaries
• Task Timeline UI - Verification step events (step_started, step_completed, verification_started/passed) are filtered from the timeline
• Plan Display - Verification steps hidden from displayed plan step lists (still shown on failure)

Added (UI)

• step_failed Event - New event type rendered with error styling in task timeline, right panel, and task timeline views

Fixed

• Gateway Message Logging - Outgoing message persistence is now best-effort (never fails delivery)
• Security Docs - Corrected userData paths, documented platform-specific locations
• Architecture Docs - Added vision tool, chat commands, attachment handling, and cron template variable documentation

0.3.25 - 2025-02-05

Added

• Google Workspace Integration - Unified access to Gmail, Google Calendar, and Google Drive
  • Shared OAuth Authentication: Single sign-in for all Google services
  • Gmail Tools: gmail_action for sending emails, reading messages, creating drafts, searching
  • Calendar Tools: calendar_action for native event management, with google-workspace.calendar_* MCP tools available for Calendar list/read/availability/event CRUD when the Google Workspace MCP connector is configured
  • Drive Tools: Enhanced google_drive_action with improved error handling
  • Settings UI: Google Workspace is accessible as a card in Settings > Integrations
• Gateway Channel Enhancements - Improved channel implementations
  • Gateway Cleanup: Proper cleanup on disconnect for all channels
  • Matrix Direct Rooms: Support for direct message rooms in Matrix
  • Slack Group Handling: Proper is_group detection for Slack channels
  • WhatsApp Config: Enhanced configuration options for WhatsApp
  • Security Pending State: Better handling of pending security approvals
• Agent Transient Error Retry - Automatic retry for transient failures
  • Daemon Retry: Transient errors in daemon scheduling trigger automatic retry with exponential backoff
  • Executor Retry: Step processing failures are retried before failing the task
  • Graceful Degradation: Non-critical errors don't abort entire task execution
• Document Tool Parameter Inference - Smart parameter handling for document creation
  • Filename Inference: Automatically infer filename from path or name parameters
  • Format Detection: Detect document format (docx/pdf) from file extension
  • Content Fallback: Use assistant output as content when not explicitly provided
  • Validation Errors: Return helpful error messages for missing required fields
• Channel User Repository - Track user-channel mappings in database
• Encrypted Settings Storage (SecureSettingsRepository) - settings now store encrypted values/categories inside the local SQLite database
  • OS Keychain Integration: Settings encrypted using native OS keychain (macOS Keychain, Windows DPAPI, Linux libsecret)
  • Fallback Encryption: App-level AES-256 encryption when OS keychain unavailable
  • Stable Machine ID: Persistent machine identifier survives hostname changes and system updates
  • Data Integrity: SHA-256 checksums detect corruption or tampering
  • Backup & Recovery: Create encrypted backups of all settings, restore with optional overwrite
  • Health Checks: loadWithStatus() and checkHealth() APIs for debugging encryption issues
  • Settings Categories: voice, llm, search, appearance, personality, guardrails, hooks, mcp, controlplane, channels, builtintools, tailscale, claude-auth, queue, tray
  • Safe Migration: Legacy JSON settings automatically migrated with backups preserved on failure
• Mobile Companions - Connect iOS/Android devices as mobile nodes for device-specific actions
  • Node Architecture: Mobile devices connect as "nodes" via WebSocket with role-based authentication
  • Device Capabilities: Camera capture, location access, screen recording, SMS (Android only)
  • Standard Commands:
    • camera.snap - Take a photo with front/back camera
    • camera.clip - Record video clip
    • location.get - Get current GPS location (coarse or precise)
    • screen.record - Record device screen
    • sms.send - Send SMS message (Android only)
  • AI Agent Tools: 6 new tools for agent interaction with mobile devices
    • node_list - List connected mobile companions
    • node_describe - Get detailed info about a specific node
    • node_camera_snap - Take a photo using a mobile node's camera
    • node_location - Get current location from a mobile node
    • node_screen_record - Record screen on a mobile node
    • node_sms_send - Send SMS via an Android node
  • Settings UI: New "Mobile Companions" tab in Settings
    • View connected devices with status and capabilities
    • Test commands directly from the UI
    • Connection instructions and troubleshooting
  • Foreground Detection: Commands like camera/screen require the app to be in foreground
  • Permission Tracking: Monitor granted permissions per capability
  • Event Broadcasting: Operators receive real-time node connect/disconnect events
• Live Canvas Interactive Mode - Full browser-like interaction directly in the preview
  • Interactive mode (default): Embedded webview for clicking, scrolling, and interacting with canvas content
  • Snapshot mode: Static screenshot with auto-refresh for monitoring
  • Toggle between modes with I key or pointer button
  • Resizable preview by dragging the bottom edge
  • Export options: Download HTML, open in browser, show in Finder
  • Snapshot history panel to browse previous states
  • Console viewer for canvas logs
• Scheduled Tasks (Cron Jobs) - Automate recurring tasks with cron expressions
  • Schedule tasks using standard cron syntax (minute, hour, day, month, weekday)
  • Visual schedule builder for users unfamiliar with cron syntax
  • Workspace binding - each scheduled task runs in a specific workspace
  • Channel delivery - optionally send task results to Telegram, Discord, Slack, WhatsApp, or iMessage
  • Run history - view execution history with status, duration, and error details
  • Enable/disable jobs without deleting them
  • Manual trigger to run any scheduled task on-demand
  • Configurable concurrent run limits (default: 3)
  • Desktop notifications when scheduled tasks complete or fail
• In-App Notification Center - Centralized notification management
  • Bell icon in the top-right corner with unread badge count
  • Dropdown notification panel accessible from the title bar
  • Click-to-navigate - click any notification to jump to the related task
  • Mark as read - individual or bulk "mark all as read" actions
  • Delete notifications - remove individual or clear all
  • Real-time updates - new notifications appear instantly without refresh
  • macOS native desktop notifications for scheduled task completions
  • Notification types: task_completed, task_failed, scheduled_task, info, warning, error
  • Persistent storage - notifications survive app restarts
• WhatsApp Bot Integration - Run tasks via WhatsApp with the Baileys library
  • QR code pairing for WhatsApp Web connection
  • Self-Chat Mode for users using their personal WhatsApp number
    • Bot only responds in "Message Yourself" chat when enabled
    • Configurable response prefix (e.g., "🤖") to distinguish bot messages
  • Standard security modes: Pairing, Allowlist, Open
  • Full command support: /start, /help, /workspaces, /workspace, /newtask, /status, /cancel, /pair
  • Markdown to WhatsApp formatting conversion (**bold** → *bold*, headers, strikethrough, links)
  • Automatic cleanup of expired pairing codes
  • Logout and re-pairing support
• AppleScript Execution - New run_applescript system tool for macOS automation
  • Execute AppleScript code to control applications and automate system tasks
  • Control apps like Safari, Finder, Mail, and more
  • Manage windows, click UI elements, send keystrokes
  • Get/set system preferences and interact with files
  • 30-second timeout with 1MB output buffer
  • macOS only (graceful error on other platforms)
• Configurable Guardrails - User-configurable safety limits in Settings > Guardrails
  • Token Budget: Limit total tokens per task (default: 100,000, range: 1K-10M)
  • Cost Budget: Limit estimated cost per task (default: $1.00, disabled by default)
  • Iteration Limit: Limit LLM calls per task to prevent infinite loops (default: 50)
  • Dangerous Command Blocking: Block shell commands matching dangerous patterns (enabled by default)
    • Built-in patterns: sudo, rm -rf /, mkfs, dd if=, fork bombs, curl|bash, etc.
    • Support for custom regex patterns
  • File Size Limit: Limit file write size (default: 50MB)
  • Domain Allowlist: Restrict browser automation to approved domains (disabled by default)
• Model pricing table for cost estimation (Anthropic, Bedrock, Gemini, OpenRouter models)
• New IPC handlers and preload APIs for guardrail settings

Changed

• Task executor now tracks token usage, cost, and iterations across LLM calls
• Shell commands are blocked by guardrails before reaching approval dialog
• File writes check size limits before writing
• Browser navigation checks domain allowlist when enabled

[0.1.7] - 2025-01-26

Added

• Shell Command Execution - AI can now execute shell commands with user approval
  • run_command tool for running terminal commands (npm, git, brew, etc.)
  • Each command requires explicit user approval before execution
  • Configurable timeout (default 60s, max 5 minutes)
  • Output truncation for large command outputs (100KB max)
  • New shell permission in workspace settings (disabled by default)
• /shell command for Discord/Telegram to enable/disable shell execution
  • /shell - Show current status
  • /shell on - Enable shell commands for workspace
  • /shell off - Disable shell commands
• Safety & Data Loss Warning in README
  • Prominent warning section at top of documentation
  • Guidelines for safe usage (separate environment, non-critical folders, backups)
  • Clear disclaimer of maintainer responsibility

Changed

• Workspace permissions now include shell: boolean field
• Updated help text in Discord/Telegram bots to include shell command info
• Permission model documentation updated in README

0.1.6 - 2025-01-25

Added

• Discord Bot Integration - Full Discord support with slash commands and DMs
  • /start - Start the bot and get help
  • /help - Show available commands
  • /workspaces - List available workspaces
  • /workspace - Select or show current workspace
  • /addworkspace - Add a new workspace by path
  • /newtask - Start a fresh task/conversation
  • /provider - Change or show current LLM provider
  • /models - List available AI models
  • /model - Change or show current model
  • /status - Check bot status
  • /cancel - Cancel current task
  • /task - Run a task directly
• Direct message support for conversational interactions
• Mention-based task creation in server channels
• Automatic message chunking for Discord's 2000 character limit
• Guild-specific or global slash command registration

Changed

• Channel gateway now supports both Telegram and Discord adapters
• Added discord.js dependency for Discord API integration

0.1.5 - 2025-01-25

Added

• Browser Automation - Full browser control using Playwright
  • browser_navigate - Navigate to any URL
  • browser_screenshot - Capture page or full-page screenshots
  • browser_get_content - Extract text, links, and forms from pages
  • browser_click - Click on elements using CSS selectors
  • browser_fill - Fill form fields
  • browser_type - Type text character by character (for autocomplete)
  • browser_press - Press keyboard keys (Enter, Tab, etc.)
  • browser_wait - Wait for elements to appear
  • browser_scroll - Scroll pages up/down/top/bottom
  • browser_select - Select dropdown options
  • browser_get_text - Get element text content
  • browser_evaluate - Execute JavaScript in browser context
  • browser_back/forward - Navigate browser history
  • browser_reload - Reload current page
  • browser_save_pdf - Save pages as PDF
  • browser_close - Close the browser
• Automatic browser cleanup when tasks complete or fail
• Headless Chrome browser (Chromium) via Playwright

Changed

• Tool registry now includes 17 browser automation tools
• Executor now handles resource cleanup in finally block

0.1.4 - 2025-01-25

Added

• Real Office Format Support - Documents now create actual Office files instead of text placeholders
  • Excel (.xlsx) files with exceljs - multiple sheets, auto-fit columns, header formatting, filters, frozen rows
  • Word (.docx) files with docx - headings, paragraphs, lists, tables, code blocks with proper styling
  • PDF files with pdfkit - professional document generation with custom fonts and margins
  • PowerPoint (.pptx) files with pptxgenjs - multiple slide layouts (title, content, two-column, image), speaker notes, themes
• Spreadsheet read capability for existing Excel files
• Fallback to CSV/Markdown when those extensions are explicitly requested

Changed

• SpreadsheetBuilder now creates real Excel workbooks with formatting
• DocumentBuilder supports Word, PDF, and Markdown output formats
• PresentationBuilder creates professional PowerPoint presentations with layouts

0.1.3 - 2025-01-25

Added

• CLI/ASCII terminal-style UI throughout the application
• Model selection dropdown (Opus 4.5, Sonnet 4.5, Haiku 4.5)
• AWS Bedrock support as alternative to Anthropic API
• Telegram bot integration with full command support
• Web search integration (Tavily, Brave, SerpAPI, Google)
• Ollama support for local LLM inference

Changed

• Updated branding to CoWork OS
• Improved workspace selector with terminal aesthetic

0.1.0 - 2025-01-24

Added

Core Features

• Task-based workflow with multi-step execution
• Plan-execute-observe loop for agent orchestration
• Real-time task timeline with live activity feed
• Workspace management with folder selection

Agent Capabilities

• File operation tools (read, write, list, rename, delete)
• Built-in skills:
  • Spreadsheet creation (Excel format)
  • Document creation (Word/PDF)
  • Presentation creation (PowerPoint)
  • Folder organization

Security & Permissions

• Sandboxed file operations within selected workspace
• Permission system for destructive operations
• Approval dialogs for file deletion and bulk operations
• Path traversal protection

LLM Integration

• Anthropic Claude API support
• AWS Bedrock support
• Multiple model selection (Opus, Sonnet, Haiku)
• Settings UI for API configuration

User Interface

• Electron desktop application for macOS
• React-based UI with dark theme
• CLI/ASCII terminal aesthetic
• Task list with status indicators
• System monitor panel (progress, files, context)

Data Management

• SQLite local database
• Task and event persistence
• Workspace history
• Artifact tracking

Technical

• Electron 40 with React 19
• TypeScript throughout
• Vite for fast development
• electron-builder for packaging

0.0.1 - 2025-01-20

Added

• Initial project setup
• Basic Electron app shell
• Database schema design
• IPC communication layer

---

Version History Summary