# Changelog

## 0.5.40 - Unreleased

- Make CLI help, version, and argument errors side-effect-free; reject ambiguous Connector/peer
  options before reading credentials or opening a relay, and redact legacy argv keys from the
  externally visible long-running process title.
- Verify saved PIDs against the actual Agentto process before status, reuse, or termination; reject
  unsafe PID values and keep account-bearing daemon state private before sensitive bytes are written.
- Serialize daemon reuse, replacement, and stale-lock recovery across competing CLI processes; reuse
  arbitrarily slow same-key startups and never spawn a replacement while the prior daemon is alive.
- Clear stale persisted credentials after a terminal authentication rejection, while preserving
  credentials for retryable relay failures.
- Time out silent Connector hello handshakes, ignore duplicate hello acknowledgements, coalesce
  concurrent local gateway probes, and cancel stalled native-runtime diagnostics.
- Shut down Agent tasks, native runtimes, terminal and SSH children, session persistence, control
  sockets, and Direct Peer listeners on process signals with a bounded fallback exit.
- Keep the local console within narrow terminal widths, count emoji graphemes correctly, and avoid
  appending a full banner on every Agent-selection keypress.

## 0.5.39 - 2026-07-27

- Attach image paths mentioned by Agent replies only after an all-component no-symlink open,
  descriptor-bound root validation, nonblocking regular-file checks, bounded reads, and matching
  image signatures; rejected or unsupported paths remain visible as ordinary reply text.
- Bound Hermes JSON and message-MCP HTTP requests with cancellation-aware timeouts so session
  list, history, deletion, and message tools cannot wait forever after a channel closes.
- Roll CLI session-map mutations back when their atomic file replacement fails, and propagate those
  persistence failures through Codex and Claude Code runners instead of reporting a false success.
- Document secret-safe account linking and the published Codex / Claude message-MCP commands without
  placing the account key in process arguments.
- Strip Agentto account and message credentials from every Agent CLI, model probe, detector,
  schedule, and native-config child environment while preserving provider API keys.
- Cancel channel-bound native list/history operations on disconnect without interrupting durable
  Hermes/OpenClaw turns that are allowed to finish across a relay reconnect.

## 0.5.38 - 2026-07-26

- Hide internal Agent-to-Agent native sessions from dashboard history while continuing bounded,
  paginated scans for ordinary conversations, and return explicit list/history error frames so
  clients can show retryable loading states instead of silently replacing current history.
- Add the packaged `agentto-message-mcp` stdio integration for Codex CLI and Claude Code, locally
  configured for one Agent route and authenticated with the Connector's owner-wide linked account.
- Block new Agent-routed custom event consumption while the same Agent has an active Connector and
  revoke an existing stream on activation; in-flight producer fencing remains a future route-lease
  feature so scheduled Connector deliveries stay compatible.
- Move custom event streams from client timestamps/random IDs to a migrated SQLite
  `AUTOINCREMENT` insertion sequence, preserving the strict legacy `since` boundary only for the
  connection's initial history window.
- Mirror an attachment-only user turn into Home as one stable filename summary with the original
  message ID, while text-plus-attachment turns remain a single original-text event.
- Reject Web send promises when no encrypted route accepted the turn (including zero successful
  mentions and group entry failures), while resolving partial mention success so composers can
  clear drafts only after a real delivery.
- Persist per-session Agent ownership and acknowledge Web append/delete operations only after a
  synchronous session-store commit, rolling memory back when persistence fails.
- Advertise session-mutation acknowledgements as an explicit Connector capability so Web clients
  keep best-effort compatibility with older Connectors instead of waiting for an ACK they cannot send.
- Keep the unreleased message MCP install commands disabled in Web until the package is manually
  published, and document that its account key is owner-wide rather than an Agent-scoped credential.
- Make host terminal access explicit opt-in (`AGENTTO_TERMINAL_ENABLED=1`) and advertise only
  workspace roots and host capabilities that the Connector actually resolved.
- Treat stable device IDs only as client-reported routing, grouping and pairing metadata. A
  password-confirmed dashboard safety action now rotates the account key, disconnects every
  Connector and custom-message stream for the account, and invalidates claimed pairing payloads;
  the old key remains rejected even if a client changes its device ID. Legacy device-revocation
  rows remain compatibility hints, not an authorization boundary.
- Migrate `~/.agentto-sessions.json` to a private, atomic v2 store with bounded histories, session
  count and total bytes; bind session read/append/delete operations to their owning Agent channel.
- Enforce a 256 KiB transport frame budget and a 180 KiB E2E plaintext budget across relay,
  direct-peer, browser and Connector paths. Return stable oversize errors, reduce file preview and
  terminal replay limits to fit one encrypted frame, and leave large Artifact chunking explicitly
  unsupported.
- Require an authenticated peer connection to represent an active Agent on its own device before it
  can open an Agent-to-Agent ticket or relay channel.

## 0.5.37 - 2026-07-23

- Send correlated `approval:decision:ack` results only after a pending approval actually accepts
  the decision, while treating an identical delivery retry as idempotent and rejecting stale or
  conflicting decisions.
- Atomically persist applied approval decisions in the private
  `~/.agentto-approval-journal.json` before acknowledging them or resuming risky execution; fail
  closed when the journal cannot be written and retain retry decisions for five minutes.
- Return `execution_interrupted_unknown` after a Connector restart when a durable task's outcome
  cannot be proven, without automatically re-running work that may already have produced side
  effects.
- Attach stable confirmation IDs and the reply words requested by the Agent to conversational
  confirmation pushes so iOS can arbitrate one response across multiple installations and wait for
  the Connector's existing `task:accepted` acknowledgement before resolving the action.
- Bound and redact approval/confirmation lock-screen previews before they leave the Connector,
  keeping APNs payloads small and masking common bearer tokens, API keys, passwords, and secrets.

- Map Agentto conversations to persisted Codex and Claude Code sessions, resume the native CLI
  context across messages and Connector restarts, and serialize turns within each conversation.
- Parse Codex JSONL and Claude Code JSON output for stable session and reply handling, recover from
  stale native session IDs, and remove native mappings when an Agentto conversation is deleted.

## 0.5.36 - 2026-07-16

- Upgrade the shared host terminal to ordered Base64 byte chunks with `terminal.snapshot(fromSeq)`
  replay, a 512 KB scrollback window, bounded session retention, and legacy cursor fallback.
- Let Web and iOS recover the same PTY after channel loss; iOS now uses a native SwiftTerm surface
  with raw keyboard/control input, resize propagation, background output batching, and Metal rendering.
- Synchronize read-only workspace changes and one shared per-Agent host CLI session across Web,
  iOS, and Connector; clients resume from terminal cursors after channel or socket reconnects.
- Add native iOS P-256/AES-GCM relay channels and streamed `rpc:event` handling so file contents,
  terminal input, and terminal output never fall back to plaintext or UI polling.
- Add authenticated dialogue-box `@Agent` delegation for Web and iOS: the current Agent is bound
  from its activated channel, then reaches the target over same-device, LAN, or relay A2A routing.
- Treat a missing lazy Hermes default session as empty history instead of sending a false
  "native sync failed" Agent message during dashboard startup.
- Use OpenClaw's canonical Agent-scoped default session key for history and message requests so
  the Gateway no longer rejects `main` with an Agent/session mismatch.

## 0.5.35 - 2026-07-15

- Automatically expose the Connector's launch directory as the read-only file workspace and enable
  the host CLI by default; `AGENTTO_HOST_ROOTS` remains an override and
  `AGENTTO_TERMINAL_ENABLED=0` explicitly disables terminal access.
- Give every Agent reply its own Agent-named push and stable APNs notification thread so concurrent
  Agents remain separate in Notification Center without collapsing individual messages.
- Keep notifications from other sessions visible while viewing one conversation from the same Agent.

## 0.5.34 - 2026-07-14

- Add capability-routed `agentto_handoff` and autonomous `agentto_run_chain` MCP tools. Agents ask
  for capabilities instead of choosing identities; Agentto selects an online, unvisited peer and
  keeps each hop authenticated as the previous Agent.
- Carry bounded chain context (`traceId`, objective, requirements, hop/maxHops, visited Agents,
  allowed runtimes, and a shared deadline) through the encrypted peer channel, with cycle and
  depth protection.
- Advertise concrete runtime and capability labels for routing, including optional `skills` on
  custom adapters, while retaining same-device, private-LAN, then central-relay transport fallback.

## 0.5.33 - 2026-07-14

- Name Hermes Agent-to-Agent sessions from the authenticated caller/target roles and a redacted
  summary of the delegated task, with a stable per-session suffix that satisfies Hermes title
  uniqueness without exposing credentials, paths, addresses, links, or email addresses.
- Preserve useful structured Hermes API error messages instead of collapsing nested errors to
  `[object Object]`.

## 0.5.32 - 2026-07-13

- Move Agent task execution into a Connector-process data plane, so a central WebSocket restart only
  closes relay-owned channels and no longer cancels in-flight same-device or LAN Agent tasks.
- Add durable `task:accepted`, `task:status`, `task:status:result`, and `result:ack` frames. Explicitly
  idempotent tasks are atomically journaled in a private local file and terminal results survive a
  Connector process restart for safe replay.
- Terminalize tasks whose outcome becomes unknown during a process restart instead of re-running
  potentially completed side effects, retry transient transport failures with the same task
  identity, and expose `agentto_get_task_status` to Hermes through MCP.
- Serialize inbound channel frames through close, preserving final result acknowledgements without
  weakening the existing authenticated E2E direct and central-relay transports.

## 0.5.31 - 2026-07-13

- Add correlated Agent tasks with structured success/failure/cancellation states, absolute deadlines,
  idempotent retry protection, and cancellation propagation into CLI processes, Hermes SSE, and
  OpenClaw `chat.abort`.
- Bind caller/target roles to server-authenticated channel metadata. Direct routes now require a
  short-lived, single-use server-signed identity ticket, mutual account authentication, and ordered
  HMAC-protected transport frames around the E2E handshake.
- Run MCP requests concurrently, add bounded multi-Agent fan-out with progress and cancellation,
  bind the MCP caller identity outside model arguments, and limit concurrency both per MCP target and
  per target Connector Agent.
- Discover Hermes API credentials from both `.env` and `config.yaml`, expose structured route/timing
  diagnostics, and preserve automatic same-device, private-LAN, then central-relay fallback.

## 0.5.30 - 2026-07-13

- Route Agent-to-Agent calls through the fastest available encrypted data path: same-device loopback
  first, authenticated private-LAN WebSocket second, and the existing central relay as an automatic
  fallback.
- Give each Connector a stable client-reported routing ID and advertise only RFC1918/link-local IPv4
  candidates to other Agents managed by the same account.
- Authenticate direct peers with a connection-scoped HMAC challenge derived from the account key;
  the key itself is never sent over the LAN, and task frames remain protected by the existing ECDH +
  AES-GCM end-to-end channel.
- Report the selected transport (`same-device`, `lan`, or `relay`) in Agent-to-Agent tool results so
  the calling Agent can perceive which Agent communication path was used.

## 0.5.29 - 2026-07-10

- Add timestamp-cursor history pagination for `session:request` / `session:state`, including bounded
  page limits and `hasMore`, `oldestTs`, and `total` metadata. Existing full-history requests remain
  compatible when no cursor or limit is supplied.
- Keep session list, history, append, and permanent-delete routing behind one tested session-frame
  service, and track session channels in a dedicated registry so cross-device fanout cannot retain
  stale channel membership.
- Preserve the newer active CLI child when overlapping runs finish out of order, so an older process
  can no longer clear cancellation/control state for the current run.
- Classify auto-detected Claude Code adapters with the same attachment capability semantics as the
  built-in Claude adapter. TypeScript and Connector capability matrices now run as a parity test.
- Split the Connector runtime into dependency-injected internal modules for adapter/catalog discovery,
  CLI probes and runners, status/pairing UI, local REPL, daemon control, delivery/outbox, native
  schedules, session storage/routing, channel registry, remote replies/turns, and WebSocket lifecycle.
  `index.mjs` now performs configuration, composition, and startup only.
- Expand Connector tests across all extracted boundaries and verify the package on Node 18 and Node
  22. This release intentionally keeps existing CLI arguments, output and exit-code behavior, daemon
  files, key transport, package binary name, and wire protocol version 1 unchanged.

## 0.5.28 - 2026-07-09

- Treat `EPERM` from process liveness checks as "still running", so `agentto status` and daemon reuse do not misread a permission-protected background process as stopped.

## 0.5.27 - 2026-06-22

- Support `session:delete`: deleting a conversation thread in the app/web now permanently removes it from the connector's store, so it disappears everywhere instead of just being hidden on one client.

## 0.5.26 - 2026-06-21

- Conversational confirmations are now approval-class: a reply that asks the user to confirm ("请确认?" / "(y/n)" …) is pushed as a Live Activity (Dynamic Island), not a plain banner — matching the risky-command approval gate.

## 0.5.25 - 2026-06-21

- Push notifications: the connector now asks the server to push every agent reply to your iOS app, and to start a Live Activity (Dynamic Island) for approval requests — so you get notified even after you leave a chat.
- Risky-command approval gate: commands like `sudo` / `rm -rf` now wait for your 本次允许 / 总是允许 / 不允许 in the app before running.
- Added `agentto restart` — stops and restarts the background connector with the latest code, recovering your account key from the running process (no need to re-paste it).

## 0.5.24 - 2026-06-12

- Shortened the original dashboard pairing flow because the connector always uses `link.agentto.net`.
  This legacy argv-based setup is superseded by the current `/link` QR flow and hidden-input
  environment fallback; account keys should never be placed in command arguments.
- Removed public custom-server instructions and ignored legacy `--server` overrides.
- Hid dashboard account keys behind an explicit "显示密钥" reveal action.

## 0.5.23 - 2026-06-12

- Added `/unlink` in the TUI to解除本机与 Agent to Dashboard 的绑定并清理本地连接状态。
- Made the TUI and `agentto status` explicitly show the bound dashboard account.

## 0.5.22 - 2026-06-12

- Added the original web-side device-row disconnect entry under **我的**. Current releases protect
  this action with password confirmation and account-key rotation because client-reported device
  IDs cannot provide secure single-device revocation.
- Updated the Connector to stop its background connection when the dashboard sends a disconnect command.

## 0.5.21 - 2026-06-12

- Added QR-code pairing from the TUI: run `agentto`, type `/link`, scan the code on mobile, and confirm to bind.
- Kept legacy direct-key parsing for compatibility. Current releases instead guide users through
  `/link` QR pairing or the documented hidden-input environment fallback.

## 0.5.20 - 2026-06-12

- Added Tab-based agent switching in the connector TUI. Press Tab to focus the agent list, then use Up/Down to switch agents.
- Switched local TUI context to a shared thread so the newly selected agent can take over the current conversation.
- Removed `/数字` agent switching from the TUI command bar.
- Polished the TUI layout: command controls stay boxed while the agent list is unboxed.
- Show real model names in the TUI Model column by probing installed agents in parallel.
- Kept TUI startup responsive by skipping command capability probing during interactive startup.
- Added connector version/update status in the TUI header.