Cloud Harness 2.0.0-beta.6

Cloud Harness has a new look on GitHub. The README, the product images and the screenshot tour now show, at a glance, what it is for: coding agents on your own server that you can watch and approve from any screen.

What is new

• A demo you can read. Claude Code fixes a checkout rounding bug in a fictional shop project. It reads, searches, edits with a diff, runs the tests and explains the cause. The Git panel shows the real diff, and a phone shows the next change waiting for approval.
• One idea per image. There are cards for approvals, visible changes, agents and models, side-by-side reviews, shared memory, running work and self-hosting, in English and Chinese.
• A new README and screenshot tour (中文).
• One command regenerates every image: node scripts/showcase/build.mjs.

The pictures are real product screens with fictional data. The agent replies are scripted for the demo; they are not live model output or tests on physical devices.

There are no changes to the server or the web client in this release. It includes the security fixes from 2.0.0-beta.5.

Package

The release workflow builds the installable assets and attaches them with SHA-256 checksums and GitHub build provenance. Existing agent-studio commands and AGENT_STUDIO_* settings remain compatible.

Full changes: PR #24 · Changelog

Cloud Harness 2.0.0-beta.5

This beta closes an approval gap for API tokens. It also adds a visual product tour and a guided entry for your own domain.

Security

• API tokens can no longer loosen permission modes. Before, a token could choose Accept edits or Auto when it created a conversation, sent or scheduled a message, created or changed an automation, started a multi-agent task or handed off. Only changing an existing conversation's mode was checked. In a project with Auto mode on, a write-scoped token could therefore start runs that needed no human approval. All seven entry points now share one check: tokens may choose Plan or Ask, and the looser modes need a signed-in browser.
• Mail is browser-only. Every mailbox route now refuses API tokens. Before, a read-scoped token could read every connected mailbox and its attachments.
• No pooled connections across network policies. Outbound requests to configured endpoints now open a fresh connection each time. A kept-alive connection opened under a policy that allows private addresses can no longer carry a later request whose policy does not.
• Installer and Codex. The installer refuses redirects to plain http and now requires curl. Codex refuses extra CLOUD_HARNESS_ environment variables, as it already did with AGENT_STUDIO_ ones.

These were found in a review of 2.0.0-beta.4. The same review found no credentials or personal data in the repository history, pull requests, releases or the beta.4 package. Details are in PR #23.

Explore the workspace

• English screenshot tour · 中文截图导览
• The screenshots come from the real application running as a disposable demo installation. Projects, mail and notes are fictional, and agent responses are scripted. Device frames show browser viewports, not tests on physical devices.

Connect your own address

Owners can open Settings → Domain & access (设置 → 域名与访问). The page checks the hostname and port you enter, gives copyable Caddy or Cloudflare Tunnel details, and lists the addresses the server currently accepts. Follow the domain setup guide to apply DNS, proxy, TLS and service settings on your own infrastructure. The page does not change DNS. It also does not claim that an address has passed an outside reachability check.

Package

The release workflow builds the installable assets and attaches them with SHA-256 checksums and GitHub build provenance. Existing agent-studio commands and AGENT_STUDIO_* settings remain compatible.

Full changes: PR #22, PR #23 · Changelog

Cloud Harness 2.0.0-beta.4

Agent Cloud Studio is now Cloud Harness: a self-hosted workspace for AI coding agents, projects, tools and automation across phone, tablet and desktop.

This beta adds conversation groups and branches, CLI account profiles and imports, file checkpoints, voice and image annotation, live task status, native Anthropic support, a tool library, mail, reminders, notification channels, static project apps, an isolated Chromium browser, a Windows companion and an optional Electron wrapper. All integrations start with empty local configuration.

This release also fixes concurrent reuse of a passkey challenge: successful login and registration responses now consume the challenge atomically after verification and recheck its expiry.

The cloud-harness command is available alongside the compatible agent-studio command. Existing configuration and data-directory names are retained. Attached server packages are built and tested by GitHub Actions with build provenance; this release does not distribute native desktop binaries.

The independent implementation process, AI-assisted security review, verification scope and remaining limits are documented in the publication review, build status and guides.

Physical Windows/macOS/Electron operations and live mail/provider calls remain unverified. Usage gates are based on reported usage and are not exact spending caps. Existing public history is preserved; no private history or personal deployment data is imported.

Post-merge independent review classified CodeQL alert #34 in read-aloud formatting as an HTML-injection false positive: its output is used only for speech and never reaches an HTML/DOM execution sink. Read-aloud uses the browser's default voice, which may be local or a remote speech service; see the Web Speech specification.

Agent Cloud Studio 2.0.0-beta.3

Install or upgrade with one line on Linux, WSL or macOS:

curl -fsSL https://raw.githubusercontent.com/Jineggegg/agent-studio/main/packaging/install.sh | bash

This release is mainly a security update; upgrading is recommended. Before its first schema change the server now copies your database to ~/.agent-studio/backups.

Security

• Git hooks and filters an agent writes into a repository can no longer run outside the sandbox when you use the Git panel: changing .git/, .gitattributes or program-valued git config needs the owner's approval, and the panel's commits, switches, pulls and pushes run in the agents' sandbox.
• The installer's settings (which may hold the master key) and the TLS private key are hidden from agents.
• API tokens can no longer create allow rules, loosen a session's permission mode, switch auto mode or hand agents the owner's credentials — that takes a signed-in browser. Tokens can still tighten. If you automated any of these with a token, do them in the browser instead.
• Server logs redact secrets in error stacks, causes and messages; provider, agent and plugin error text is redacted before it is shortened.
• Plugin ids that would replace the host's own files are refused; a plugin update whose files changed waits for the owner's approval (as ADR 0008 says).
• The installer stops when the GitHub CLI cannot verify the package's provenance (--skip-provenance overrides), accepts only x.y.z versions, keeps the settings file at 0600 and runs nothing if its download is cut short.
• The server refuses to start on a database a newer version has already upgraded.

Added

• The conversation list beside the chat can be resized by dragging its edge.
• The web client's third-party licence notices ship with it (/third-party-licenses.md).

Known open items are listed in docs/STATUS.md. Still a beta.

🤖 Generated with Claude Code

Agent Cloud Studio 2.0.0-beta.2

Install with one line on Linux, WSL or macOS:

curl -fsSL https://raw.githubusercontent.com/Jineggegg/agent-studio/main/packaging/install.sh | bash

The installer downloads this release and a private Node.js, checks both against their published SHA-256 sums, starts the Studio as a background service for your user (systemd or launchd), and prints the address and a one-time setup token. It never needs root, except — if you agree — to install the bubblewrap sandbox. Manage it with agent-studio service status|restart|logs.

Added

• One-line installer, agent-studio command and user service (systemd / launchd).
• Release packages with GitHub build provenance; CI installs them on Ubuntu (x64, ARM64), Debian, Fedora and macOS.

Fixed (since 2.0.0-beta.1)

• API-model file tools open files through checked descriptors, so a racing command cannot redirect them outside the project (found by CodeQL).
• Attachments uploaded together keep their order; stopping the server no longer waits on a stalled upload; a terminal that ended just as a device connected now shows why.

Still a beta: see docs/STATUS.md for what is and is not verified. Remote access set-up (Tailscale first) comes next.

🤖 Generated with Claude Code

Agent Cloud Studio 2.0.0-beta.1

First public version of Agent Cloud Studio: a self-hosted workbench for AI coding agents (Claude Code, Codex and OpenAI-compatible model APIs) that you can drive from a phone, a tablet or a desktop browser. It is a beta — docs/STATUS.md says exactly what is finished, how it was verified, and what is not built.

Highlights

Agents — Claude Code through its official CLI (stream-json) and Codex through its CLI's app-server protocol, each with the user's own sign-in; any OpenAI-compatible API (DeepSeek, OpenAI, a self-hosted model server) as a full agent with sandboxed project tools. Server-owned runs with live streaming, replay after a reconnect, queueing, steering, stop and recovery after a restart. One permission engine for every agent, with durable approvals answerable from any device. Handoff between agents, multi-agent tasks, usage reports and budgets.

Projects — files and an editor with conflict detection; Git (status, diff, commit, branches, sync, history, worktrees); GitHub through the host's gh sign-in (pull requests, checks, guarded merge); a persistent terminal; terminals on operator-configured SSH hosts.

Memory, automation, notifications — shared Markdown memory with full-text search (Chinese included) and scope isolation; schedules and deferred messages with exactly-once execution; a task inbox; Web Push.

Platform — a touch-first PWA (phone, tablet, desktop; light and dark; English and Simplified Chinese); accounts with an owner and members, passkeys, scoped API tokens, lockout and an audit log; sandboxed plugins with granted capabilities and isolated panels; a small security kernel (declared route access, same-origin and anti-forgery checks, Host allow-list, strict CSP, path confinement, guarded outbound HTTP, encrypted secrets, allow-listed child environments, bubblewrap sandbox profiles).

Verification

Every CI job is green on GitHub-hosted runners for this release: typecheck, lint, unit and integration tests on Node 22 and 24, build and smoke test, 434 black-box acceptance tests, browser tests in Chromium (phone, tablet, desktop) and WebKit (phone), dependency audit and licence check, a secret scan of the full history, and CodeQL with no open alerts.

An AI-assisted security review found no critical, high or medium issues (two low findings fixed). CodeQL's first analysis then found a real gap the review had missed — the file tools of API models checked a path and used it a moment later, so a command racing a tool could swap a directory for a link out of the project — fixed before this release by opening through checked descriptors. There has been no independent professional audit.

Known limits

• Not verified on physical iPhone, iPad or Android devices (emulated only).
• GitHub writes, real model providers and delivery through a real Web Push service have never been exercised against the real services.
• Sandboxing needs Linux with bubblewrap; macOS is untested and has no sandbox.
• See docs/STATUS.md for the full list, including what is not built.

Install

Node.js 22.13 or newer and git:

git clone https://github.com/Jineggegg/agent-studio.git
cd agent-studio
npm ci
npm run build
npm start

Then open http://127.0.0.1:7420, enter the one-time setup token the server prints, and create the owner account. For access from a phone see docs/deployment/remote-access.md.

Provenance

Written with heavy AI assistance, from behavioural requirement documents derived from a private predecessor built on CloudCLI UI (AGPL). It shares no code with it — a mechanical comparison found no three consecutive matching significant lines — but it is not claimed to be a strict clean-room implementation; docs/clean-room/PROCESS.md explains why. MIT licensed. Not affiliated with Anthropic, OpenAI, DeepSeek, GitHub or CloudCLI.