agent-comm-hub-app 1.6.0

Desktop GUI 1.6.0, companion to hub 0.10.0.

Fixed

• A foreign access token could attach its SSE stream to another user's session and receive that user's pushes (including message content) while locking the real owner out.
• A second SSE stream on the same session id no longer goes silent when the first closes.
• Read-state persistence: the vestigial unread.count column is dropped (schema v4 migration); the watermark survives restarts unchanged.

Added

• SSE event names are matched as named constants (source of truth: hub src/protocol.ts).
• Thread/channel chips in the message list.

Removed

• The unreachable lint script (eslint was never installed); tsc --noEmit remains the TS gate.

Installers

• Windows NSIS: agent-comm-hub-app_1.6.0_x64-setup.exe
• Windows MSI: agent-comm-hub-app_1.6.0_x64_en-US.msi

v0.10.0

v0.10.0 — 2026-10-11

• Session lifecycle: an unused session (no live SSE stream) is forgotten after
  --session-ttl-ms (default 30 min; 0 = off). Clients get 404 and
  re-initialize per the MCP spec; the hub re-registers them under the same peer id
  with the mailbox intact.
• Per-peer mailbox rate limit: --rate-per-min caps how fast one peer's
  mailbox accepts mail (0 = unlimited, the default). Excess is counted as
  droppedRate in the roster and bridge_metrics; a waiting peer is never
  throttled.
• Message priority: bridge_chat / bridge_notice / bridge_task
  accept priority (0|1|2, default 0). A mailbox delivers high priority first;
  overflow drops the LEAST important queued message (oldest within a priority —
  unchanged from "oldest dropped" when no priority is set).
• Parked-mailbox expiry reconciles the task ledger: a task whose mailbox was
  destroyed by --parked-ttl-ms now fails with a system event naming the peer,
  instead of staying pending forever.
• --parked-ttl-ms works with the idle GC disabled: turning
  --peer-idle-timeout-ms to 0 no longer disables mailbox expiry; a dedicated
  reaper keeps the two settings independent.
• bridge_metrics: per-peer (sent/received/acked/queued/
  inFlight/deadLettered/drops) and global (messagesTotal, waiters,
  tasksByStatus) operational counters.
• bridge_events: the hub's own operational event stream
  (peer_joined/peer_left/peer_parked/mailbox_dropped/
  task_transition/runner_started/runner_finished) with a monotonic
  since cursor.
• Remote auth hardening: an SSE stream now requires the SAME session's token.
  A foreign token could previously attach to another user's session and receive
  their pushes (including message content) while locking the real owner out.
• SSE response headers: every response (401/403/405 and 200) names the
  protocol version, and Mcp-Protocol-Version no longer echoes a client-supplied
  unsupported value.
• Validation order unified: POST and GET/SSE both check auth → protocol
  version → session, so the same request gets the same status code either way.
• Six more agents: zed, amp, continue, cline, roo-code, amazon-q. Filename
  globs (cli-agents/*.json) are supported in the registry.
• setup idempotency fixes: the JSON merge compares the whole entry (Gemini's
  httpUrl entry is no longer rewritten on every run, which used to leave a
  fresh .bak- file behind each time), and a TOML url change is actually
  written instead of being reported as unchanged.
• app: the unreachable lint script is removed (eslint was never installed);
  NFR-6/7 updated to match; the vestigial unread.count column is dropped
  (schema v4) with a migration.

Commits: v0.9.1...v0.10.0 · Contributors: @JochenYang · CHANGELOG

agent-comm-hub-app v1.5.0

Desktop GUI 1.5.0 — pairs with hub 0.9.x (task ledger, ACK status tools, threads).

Added

• Reply chains and A2A threads are carried end to end: ref / threadId are
  passed through bridge_chat and bridge_task, kept in the stored message
  body, and to: "all" now counts as involving this peer. The local history
  default rises to 500 rows.
• The hub host field accepts a full URL (https://hub.example.com/mcp); the
  scheme, port and path inside that URL take precedence over the separate
  fields.

Fixed

• Local history keeps channel / thread_id (schema v3, migrated in place
  with PRAGMA table_info + ALTER TABLE), so group unread counts and thread
  grouping survive a restart instead of silently resetting.

Installers attached: macOS (aarch64 dmg), Windows (NSIS x64 + MSI x64),
Linux (AppImage + deb).

v0.9.1

v0.9.1 — tag v0.9.1

Tagger: JochenYang 297390763@qq.com

agent-comm-hub 0.9.1
2026-09-22

• Task delivery time is recorded: the ledger row is now written before the
  task is dispatched, so the per-assignee deliveredMs (first handoff or queue
  drain) is actually filled in instead of staying empty.
• Long SLAs are honoured: a timeoutMs beyond ~24.8 days used to be
  truncated by the timer limit and fire immediately. The deadline is re-armed
  in segments, so any positive duration behaves as written — cold restarts
  included.
• hop survives a restart: the reply-chain depth is persisted with the
  message, so a restart can no longer let a chain slip past the MAX_HOP cap.
  Older state files load unchanged (a missing depth counts as chain start).
• bridge_task_status is readable by the assignee: the assignee of a group
  task — and any member of its group — can read the task they were handed;
  every other peer still needs manager rights.
• CLI: --help reports the real --manager-peers default
  (agent-hub-cli,hub-admin).

Commits: v0.9.0...v0.9.1 · Contributors: @JochenYang · CHANGELOG

v0.9.0

v0.9.0 — tag v0.9.0

Tagger: JochenYang 297390763@qq.com

agent-comm-hub 0.9.0
2026-09-22

• Task ledger state machine: bridge_ack gains a non-terminal working
  status plus an optional progress (0-100), so a long-running task reports
  intermediate beats instead of one terminal jump. The four original statuses
  keep working; illegal transitions and any ack after a terminal status are
  still recorded on the timeline with applied: false and never reopen the
  task. bridge_task_status / bridge_tasks show the new working state,
  the progress of each ack, and a per-assignee row (status, first-delivery
  time, its own ack slice) for broadcast and group tasks.
• Soft task SLA (timeoutMs): bridge_task accepts an optional
  timeoutMs. When it expires without a terminal ack the hub moves a
  still-open task to the new timeout status and appends a hub-synthesized
  timeline event (system: true); terminal tasks are left alone. SLA timers
  are re-armed when the ledger is restored, so a restart does not silently
  drop a running deadline.
• Threads and hop-limited reply chains: messages now carry an optional
  threadId — settable on bridge_chat (which also accepts a ref for
  replies) and bridge_task, and filterable in bridge_wait({ threadId }) —
  so a multi-turn A2A dialog no longer has to share one mailbox slot with
  unrelated traffic. ref chains are capped at MAX_HOP (5) hops: the 6th
  send is rejected at send time with a hop limit exceeded error instead of
  letting two agents ping-pong forever.
• Ack routing survives history eviction: bridge_ack resolves its target
  from the task ledger first and only falls back to the history ring, so a
  late ack or progress beat still reaches the original sender after a busy
  hub has evicted the task message. bridge_chat may also address a group id
  directly.
• Duplicate history / relay fix: broadcast and group fan-out used to call
  the history append once per recipient, so one broadcast produced N history
  rows with the same id and fired N SSE relay pushes. A message is now
  recorded exactly once, at send time — group messages enter history and the
  relay view like any other, and the desktop relay shows a message when it is
  sent rather than when a recipient finally drains its waiter.
• Reliable state persistence: a message, an offline mailbox change, or a
  task-ledger transition (new task, ack, SLA timeout, first delivery) now
  schedules a state save through the same 500 ms debounce. Previously only
  roster and group events did, so a crash between two such events could lose
  the ledger the admin board reads back. Remote mode also persists the ledger
  to SQLite (new tasks table plus thread_id columns, migrated in place),
  restoring it — and any pending SLA — on boot.
• Admin console rewritten: /admin is now a single self-contained React
  page (Tailwind + beui components, built by npm run build:admin into
  assets/admin.html) in place of the old hand-written HTML. It shows the
  roster with client name/version, source IP and a walk-in marker for
  unclaimed anonymous identities; a members-and-tokens panel that issues,
  revokes, and toggles plaintext tokens (the same table as the CLI auth
  commands, manager token only); a copyable MCP configuration snippet
  (generic HTTP + opencode + curl probe) generated right after issuing a
  token; a task ledger board; groups; and a read-only message trace. Tables
  size themselves to their contents up to a cap and only scroll internally
  beyond it.
• Compatibility: every field and status added here is optional or additive, so
  agents running an already-installed 0.8.x SKILL.md keep working unchanged.
  Test suite grows to 282 checks (156 smoke + 37 setup + 11 ops + 35 herdr +
  23 discovery + 20 e2e).

Commits: v0.8.1...v0.9.0 · Contributors: @JochenYang · CHANGELOG

v0.8.0

agent-comm-hub 0.8.0

Highlights

• Task ledger & ACK status: bridge_task_status / bridge_tasks; status flow pending → accepted → done|failed (or rejected) with full ack timeline
• bridge_wait({ ref }): wait specifically for one task's ack
• P0 fix: bridge_wait no longer drains the whole mailbox (multi-message bursts stay intact)
• Web admin: identity onboarding + MCP config snippet, full endpoint URL, in-page dialogs, offline peer remove, hub-admin as default manager

Skill refresh after update

agent-comm-hub update replaces the npm package (including packaged agents/SKILL.md), but skill files already copied into ~/.agents/skills and per-agent dirs are not rewritten automatically. After update:

agent-comm-hub update
agent-comm-hub setup   # re-copies SKILL.md into agent skill dirs

Install / Upgrade

npm i -g agent-comm-hub@0.8.0
# or from an existing install
agent-comm-hub update && agent-comm-hub setup

Verified: pnpm test 271/271 (146 smoke + 36 setup + 11 ops + 35 herdr + 23 discovery + 20 e2e)

agent-comm-hub-app 1.4.0

Desktop GUI 1.4.0 — pairs with hub 0.8.0 (task ledger / ACK status tools via the hub).

• Offline peers can be removed from the roster
• Default managerPeers includes hub-admin (web console) + agent-hub-cli (this app)

Windows installers attached (NSIS + MSI, x64).

v0.7.1

v0.7.1 — 2026-09-01

• Fix a misleading desktop warning: the SQLite "state open" line was logged
  at warn (stderr), which the desktop GUI surfaced as an [err] entry on
  every start even though the hub was running fine. It is now info
  (stdout), so the app shows it as a normal startup log. No behavior change.

Commits: v0.7.0...v0.7.1 · Contributors: @JochenYang · CHANGELOG

v0.7.0

v0.7.0 — 2026-09-01

• Remote mode (server deployment): --auth-tokens <file> turns on bearer
  authentication — every MCP request must carry Authorization: Bearer <token>, and each token maps to a fixed peer id + role (agent |
  manager). Identity comes from the token, not the client-reported name, so
  a team where everyone runs "kimi-code" gets one peer per person instead of
  one shared mailbox (which leaked messages across users — verified in a
  two-machine experiment). Managers may also be authorized via token role.
  Loopback desktop usage is unchanged: without the flag nothing is required
  and nothing changes.
• New server/ directory: token-table template, deployment recipes for
  内网 (LAN/VPN) and 公网 VPS (Caddy TLS reverse proxy with SSE pass-through),
  and agent-side MCP config examples with the Authorization header.
• --allow-join (LAN/VPN onboarding): agents without a token may join;
  each walk-in gets a SESSION-UNIQUE temporary peer id (join-<name>-<hex>,
  never mergeable with another walk-in — the same-name shared-mailbox leak
  cannot recur) plus its source IP, shown in the roster. The admin renames
  (认领) them or issues a token to 转正. Keep OFF on the public internet.
• Token management in the web admin: /admin/api/tokens (manager-gated)
  lets the operator issue/revoke/mask tokens from the page — no SSH needed;
  freshly issued tokens authenticate immediately (in-process reload, no
  2s watcher wait). agent-comm-hub auth remains the CLI equivalent.
• Group membership is now dynamic: bridge_group_add_member /
  bridge_group_remove_member let the group creator or a manager pull peers
  in and kick them out after a channel exists (creator cannot be removed);
  membership edits persist to SQLite and survive restarts.
• Test suite grows to 240 checks (135 smoke + 36 setup + 11 ops +
  35 herdr control + 23 discovery).

Commits: v0.6.0...v0.7.0 · Contributors: @JochenYang · CHANGELOG

agent-comm-hub-app v1.2.0

chore(app): bump version to 1.2.0

- Release the zh/en i18n and realtime relay stream features

- Keep Cargo.toml/Cargo.lock/tauri.conf.json in sync

Verified: pnpm typecheck