v0.1.16

What's Changed

• docs(site): the install options are cards, not notes hanging under the headline by @Gergilcan in #33
• fix(skills): the catalog list stops waiting on GitHub — pinned repositories are served in seconds by @Gergilcan in #34
• fix(runners): stopping a process stops its whole tree, so the exit is reported when it happens by @Gergilcan in #35

Full Changelog: v0.1.15...v0.1.16

v0.1.15

What's new in 0.1.15

Runners

Concentus has been one backend that is both the control plane and the place flows execute — the claude CLI on the machine the window is on, against the login already there. It still is. What is new is the other shape: a hub somebody deployed (java -jar, or the Docker image), and runners connected to it.

• A runner is the execution half on its own. A process on a machine you operate — a laptop that stays on, a NAS, a container on your own cluster — connects out to the hub, registers with a token minted there, and runs the CLI turns the hub hands it. The hub keeps the flows, runs, approvals, credentials, groups, policies and the interface; the runner keeps the login, the folders, the clones and the processes. The same shape as a GitLab runner.
• The login stays where its owner runs the process. Anthropic's terms do not allow a subscription's credentials to be routed through a third party, so the hub never holds a Claude login or a setup-token. A runner carries its own — the CLI's login on that machine, CLAUDE_CODE_OAUTH_TOKEN from claude setup-token, or ANTHROPIC_API_KEY — and the hub only ever learns which kind. Hosted execution stays API-key only, as before.
• Three scopes. Whoever registers a runner chooses who may run flows on it: the whole organization, one group (Enterprise), or only me — somebody's machine and somebody's login, so not even an admin, and never a schedule or a webhook.
• Resources → Runners. A roster with a status dot, the runner's host, version and CLI auth, and how busy it is. + New asks a name and a scope and shows the token once, with the three ways to start it and the hub's URL filled in: java -jar concentus-backend.jar runner --url … --token crn_…, docker run …, or the desktop app's tray → Set up… → Server.
• The desktop app can be a runner too. Server, the optional last step of the first-run wizard (and reachable from the tray later), keeps the token in the OS keyring and restarts the backend with its agent connected. Everything local keeps working; this is also, not instead. The tray says whether it is connected and opens the hub's interface in a window of its own.
• Runs on, in a flow's Settings: This server (here when the CLI is logged in, otherwise a runner you may use, otherwise today's answer), Any runner (the least busy one online), or a runner by name. Only Claude CLI flows go to runners; a self-hosted model stays on the hub. A run that went to a runner says so in its first line and carries a chip with the runner's name; the review of its checkouts is re-read through the runner while it is connected.
• runner mode of the jar never starts Spring — no database, no port, a few hundred milliseconds to connect — and reconnects on its own when the hub goes away. A revoked token makes it stop for good, with exit code 3.
• Docker. ghcr.io/gergilcan/concentus-hub and ghcr.io/gergilcan/concentus-runner, built on every stable release from now on, and a compose file under packaging/docker that brings up a hub and a runner in the order the token requires.

Not in this release. A turn does not survive the runner disconnecting: after 45 s without a heartbeat the hub ends it as disconnected, and what the runner was running finishes on its side with its output lost. Finished workspaces are not cleaned up on the runner. Self-hosted models do not run on runners. There is no queue for a runner that is not online — a launch with none fails at once, and a schedule simply fires again.

How it was tested. A real hub and a real agent over the real socket with a fake claude that prints what the real one prints (backend suite, Playwright); the two Docker images with compose on one machine — a hub, a runner with the real CLI (which answered Not logged in, relayed to the run), a runner with the fake one (a completed run), and a revoked token (the container exited 3). Not yet: a runner across a real network with a real login.

Tests

• The runners end to end, against the real application: the jar in runner mode registered, connected, executing a flow and revoked, with a fake claude that prints what the real one prints. In CI with the rest.

Docs

• Runners in the docs (English, Spanish, Catalan) and the README; the Docker images and compose under packaging/docker.

Full Changelog: v0.1.14...v0.1.15

v0.1.14

What's new in 0.1.14

The Marketplace

A view of its own, beside Studio, where the things a flow is built from are shared and installed — MCP servers, library agents, facades, skills, plugins, API definitions and flow templates.

• Publish to your organization (no approval needed) or globally — a global item goes in front of every organization once a curator approves it. Curators are the administrators of the organization named by marketplace.curator-organization; by default the oldest one.
• Install with one click: the resource appears in your organization, with its credential slot empty and named. Credentials never travel — publishing from a resource strips them and says so.
• Search, filter by kind, scope, state and tag; sort by installs, newest or name. Cards say one line; the tooltip says the rest.
• Seeded on day one: the MCP catalogue (Linear, GitHub, Google, Microsoft, …), the four library agents and the eight starter flows, as built-in items.
• Publish to Marketplace from the MCP servers, Agents, Facades and Skills panels and from a flow card; Use from Marketplace… in the API block.
• Every publish, approval, install and uninstall lands in the audit trail.

Groups inside an organization (Enterprise)

Split an organization into groups under Resources → Groups. A resource — a flow, an MCP server, an agent, a facade, a knowledge base, a credential — can be visible to one group instead of the whole organization (Visible to on the resource or the flow card). A group carries its own policy and its own per-run settings, layered over the organization's for the flows it holds. Managers run their group; administrators create them. The Marketplace publishes to a group and installs into one. The tenth Enterprise feature.

Studio

• Tidy now lays out the blocks inside a group and sizes the frame to fit, then places groups as blocks of the outer layout. Before, anything inside a group was left where it was.
• The runs list in the executions area can be resized by dragging (or with ← → on the handle); the width is remembered per browser.
• The "+ on error" chip no longer sits on top of the "on rejected" output of a Verifier, so the wire can be dragged from it.
• A second output turned on with its chip ("+ on error") can be wired at once; before, the wire went nowhere until the flow was reopened.
• Deleting a block from its own dialog closes the dialog instead of leaving it armed for the next click.
• The dashboard search reads tags as well as names, so clicking a tag chip narrows to the tagged flows.
• The managed / local combo is gone from the toolbar: the backend has decided where each agent runs, by its model and credential, for a long time. Flows saved with the old field still load.

Resources

• The Service accounts page reads like Members: a roster with role chips and quiet actions, "+ New", the token shown once — and explanations in tooltips instead of paragraphs.

Tests

• UI tests, against the real application, for every node kind (palette, every inspector field, wiring rules, second outputs, persistence), every bundled flow and the flow lifecycle (save, rename, duplicate, export/import, versions, triggers, runs without a model), and every setting and administration panel. They run in CI with the rest.

Docs

• The Marketplace in the docs (English, Spanish, Catalan) and the README.

Full Changelog: v0.1.13...v0.1.14

v0.1.13

What's new in 0.1.13

A documentation release: the site, the docs and the README read against the app as it ships today. No code changed since 0.1.12.

The site

• Sixteen kinds of node, with cards for the trigger, Send mail and notes; the mock inspector no longer shows the Role dropdown that 0.1.8 removed.
• The changelog page carries 0.1.9 to 0.1.12.

The docs — in English, Spanish and Catalan

• Blocks: Coordinator is its own row; Send mail, Note and Group are documented.
• Teams and sign-in: service accounts, several organizations, organization policies, and the audit trail with its retention rules — each with the tier that has it.
• Licensing: what Team includes and the nine things that are Enterprise-only, with the Team price (25 € per seat per month, 20 € billed annually) beside them; isolated and offline installs. The Spanish and Catalan copies were a release behind and now match.
• Headless CLI: CONCENTUS_TOKEN — a service account instead of a sign-in.
• HTTP API: the audit, retention, organization, service-account, policy, public-run and license endpoints.

The README

• macOS in the download line; the managed-MCP authentication note says how it actually works.

Full Changelog: v0.1.12...v0.1.13

v0.1.12

What's new in 0.1.12

A maintenance release: the whole codebase simplified and cleaned up with no change in what it does — and one real bug the cleanup's own test gate caught.

Fixed

• A slow Save no longer closes the block you just opened. When the server took its time answering a Save and you had meanwhile double-clicked a block — even after leaving for the dashboard and reopening the same flow — the inspector vanished the moment the Save came back. Your selection now survives a reload of the flow it points into.

Under the hood

• About 570 fewer lines across backend, Studio, desktop shell and website: duplicated logic written once (how a run fails, the MCP JSON-RPC dispatch, the OAuth callback page, the browser sign-in sequence, the admin panels' first fetch), code with no caller removed, and comments that had stopped being true corrected.
• The Studio's lint is clean for the first time (17 errors → 0), and the site's translation check now runs with its tests.
• Nothing user-visible changed: no endpoint, setting key, message or layout moved.

Full Changelog: v0.1.11...v0.1.12

v0.1.11

What's new in 0.1.11

Team pricing

25 € per seat per month, or 20 € per seat per month when the year is paid at once. Up to ten seats, bought by card on the site; the license lands in your inbox minutes after checkout.

The Enterprise line

Team keeps everything a team needs to work together. Enterprise adds scale and governance — nine things, each named the same way on the site, in the License panel and in the refusal you see when a Team license does not cover it:

• Custom identity providers (any OpenID Connect issuer) — Team has the Google and Microsoft presets.
• Automatic accounts for an email domain — Team invites people.
• OpenTelemetry export to your collector.
• Organization policies — a default facade for workers, a permission ceiling, an organization-wide budget, approval before a published endpoint answers.
• Audit trail export — every tier reads the trail on screen; Enterprise exports it as CSV or JSON.
• Unlimited retention — Team keeps ninety days of runs and versions (golden runs and current versions always stay).
• Several organizations on one deployment, each with its own flows, credentials, runs and settings, and a switch in the account menu.
• Unlimited service accounts — Team gets two. Tokens for machines: a CI job, a cron entry, another system; CONCENTUS_TOKEN in the CLI.
• Published endpoints without a rate limit — Team: 60 requests a minute per token.

Also

• An audit trail for every tier: who did what and when, from runs to license installs, under Resources → Audit.
• Service accounts under Resources, for administrators.
• Isolated and offline installs documented: the license verifies offline, and a server deployment makes no outside call of its own.

Full Changelog: v0.1.10...v0.1.11

v0.1.10

What's new in 0.1.10

Credentials are encrypted at rest

Stored credentials are sealed with a key the desktop shell keeps in your OS keyring. If an installation ever finds rows it cannot open — a reinstall, a second machine on a shared database without the key — they show as locked — enter the value again; the app runs, the flow doctor names them, and re-entering seals them under this installation's key. Nothing is deleted and no flow needs rewiring. Backups include secrets only when you ask.

A Team tier, and a trial

• Team: up to ten seats, bought by card on the site, the license in your inbox minutes later. The same features as Enterprise — the shared database, members and roles, SSO. (Being switched on: until pricing is configured the card says "to be announced".)
• Trial: fourteen days of the team features, no card, one per email; the License panel shows the days left.

The site

• Windows, macOS and Linux, everywhere it used to say two.
• A changelog page — these notes, for every release, at concentus-ai.com/changelog.
• The site in Spanish and Catalan.

Quality

• 116 tests for the desktop shell (the part that finds claude, sets the PATH and updates the app) and an Electron smoke test.
• The Studio's inspectors, palette, toolbar and console under test; a fix for the model picker, which opened a saved local model as "Custom…".

Full Changelog: v0.1.9...v0.1.10

v0.1.9

What's new in 0.1.9

The first twenty-four items of the improvements report.

Your subscription's allowance

• A meter for the weekly allowance. Anthropic meters non-interactive Claude Code use — the way Concentus runs the CLI — in its own allowance. Set your plan's figure under Settings → Usage and the Usage page shows how far this machine's runs are from it; a run that starts past 80% says so in its first line.
• A fallback when it is spent. On the Coordinator: run on the API key, or run every agent on a local model. Applied at start when the meter says spent, and mid-run when the CLI refuses for the allowance — the run ends as a failure and continues as a new run on the fallback, which says where it came from.
• A hard ceiling. The monthly budget now stops a billed run that reaches it mid-run, not only the next one.

Fan-out

• Items that wait for others. A plan item may list dependsOn; it starts when those items finished and gets their reports in its prompt. Loops and unknown ids are refused; ordered items may share a file.
• Repositories inside the workers. A repository wired to a worker is cloned into that worker's own workspace; its changes reach the merge step as patches, and the merge — the one process with a shell — applies, verifies, commits and opens the pull request.
• ask_worker. A worker can put a question to a named sibling; it is answered from that sibling's workspace and report by a short read-only process, without interrupting it. Five per worker.
• Retries per block, and a block's on error / on rejected fires the moment the block settles instead of after the merge.

Runs

• Resume. Start again keeping every worker that passed; only the rest runs. Runs the backend lost in flight say so, with Resume as the way back.
• Telegram approvals and questions: a bot set up once under Settings → Approvals posts every request with ✅ / ❌ buttons and every question as a message you reply to. The app polls the bot, so the answer comes back with no public URL.
• Changes tab. The diffs of what the agents did to the repositories, per block and per run, persisted with the run.
• Evaluations. Datasets per flow — cases with contains, regex, exact or an LLM judge — and results per flow version.

Blocks and triggers

• Send mail node: wire it to a block's output and the run mails what that output carries — the error and its log, the verification report, the final answer.
• Folder watch trigger, and provider presets (GitHub, GitLab, Linear) for the webhook form.
• Publish a flow as an endpoint: POST /api/public/flows/{id}/run with a bearer token, a synchronous answer or 202 + polling, and a minimal chat page.
• Notes and groups on the canvas, "Go to block" in Ctrl+K, a minimap.
• Library agents as live references: link a block to a library agent, versioned; the doctor warns when the library moved on.

Knowledge

• OCR for scanned PDFs and images through the Tesseract program when it is installed (nothing bundled; the message says how to get it).
• The retrieval budget is in tokens (estimated); characters stay as the fallback.
• pgvector does ship in the desktop app — the message that said otherwise is gone, and tool search ranks with the built-in embedder.

Managed sessions

• A remote MCP server's credential reaches the managed session as authorization_token — declared, not yet verified against a live session; the run log says per server when a credential left the machine.

Not exercised against the real world in this release

SMTP send, the Telegram bot, Tesseract, the managed-session MCP token and the LLM judge were tested through fakes only. If one of them misbehaves for you, the run log says so — open an issue with that line.

Full Changelog: v0.1.8...v0.1.9

v0.1.8

What's new in 0.1.8

The verifier can say why

• on rejected, a new output on the Verifier. Wire a flow to it and, when the verifier's final word on any worker was a rejection, that flow receives one verification report: every worker, rejected first and accepted after, with the verdict, the reason, its output and its own console log — then the verifier's log. Put a Condition after it to react to one worker only ("contains Ads"). Mail it, file it, retry it: the rejection is something you can act on instead of something you find on a box afterwards.

on error means this block

• The error output of a block now fires when that block failed — including a worker that crashed while the others carried the run to completion — and hands the branch the failure plus the block's console log. A failure nobody pinned on a block ("every worker failed") fires the coordinator's. The first line of the payload is unchanged, so conditions drawn on it keep matching. A failed run whose error or rejected branch fired is still reported completed; one where nothing fired now names the block nothing was wired to.

Second outputs stay out of the way

• on error is no longer drawn on every block. Hover a block and click the + on error chip to turn it on (the label puts it away again); a wire keeps it drawn for as long as the wire exists. Saved flows do not change.

Coordinator and Agent are two blocks

• The palette has ★ Coordinator and ◆ Agent. No Role dropdown: a flow takes one coordinator, the button says so once it has one, and duplicating the coordinator gives you an agent. Stored flows, the MCP flow tools, the generator and the headless CLI keep the same file format.
• "Independent workers" drops its (experimental) tag.

Full Changelog: v0.1.7...v0.1.8

v0.1.7

Full Changelog: v0.1.6...v0.1.7