Agent Autoloop 1.4.1

一次全方位清理，没有新功能。

• 内核从约 1800 行降到约 1650 行：删掉索引改造后留下的重复判断，只读的状态汇总挪到外壳。内核行数现在有上限，由测试守着。
• 外壳、协议和接单程序也不再认识具体插件，同样由测试守着。
• 接单程序和中台的行为没有变。唯一的例外：规则里 use: "acp" 没写 command 时，以前载入规则就报错，现在规则能载入，跑的时候这一轮算没跑成，原因里写着缺什么。
• 文档改正：变异数量、合并后跑什么检查，去掉重复的段落。

升级不用重建投影，重启即可。

---

A thorough cleanup, with no new features.

• The kernel goes from about 1,800 lines to about 1,650: duplicate checks left over from the move to indexed reads are gone, and the read-only status summary moved out to the host. The kernel's size now has a limit, enforced by a test.
• The host, the protocol and the worker no longer know any plugin by name, also enforced by a test.
• Worker and hub behavior is unchanged, with one exception: a rule whose agent has use: "acp" and no command used to fail when the rules loaded. Now the rules load and that run fails, saying what's missing.
• Documentation fixes: the number of mutations, which checks run after a merge, and repeated passages removed.

Upgrading needs no projection rebuild; a restart is enough.

Agent Autoloop 1.4.0

这一版只做减法。我们回头看了上一版前后加的一批防护：它们防的问题没有真实用户碰到过，有的还带来过回归。这次把它们去掉，代码和测试少了约 500 行（#125）。

接单程序

• Agent 崩溃或进程没了之后，直接交结果，不再去停同一进程组里留下的进程。这一步是 1.3.0 才加的，而真实的 Codex、Claude Code 让工具另开进程组，本来就够不着。你主动取消和超时的停止方式没变。
• 用量累计文件不再 90 天后清理，隔很久再续接的会话也能算出这次用了多少。

中台

• 规则文件每次定时检查都读一遍，不再看修改时间。内容没变不会多写记录。
• 不再专门拒绝 1.0.0 之前的旧数据库。

协议

• MCP 服务不再要求先完成握手，也不再检查 initialize 的参数。规范只要求客户端不要提前发请求。标准客户端不受影响。
• 回执里 ask、notice、later 的 key 不再拒绝半个 Unicode 字符。事件的 id 照旧拒绝。

安装

• 已经装过时再指定另一个来源，不再报错停下，这份安装继续跟着原来的来源走。要换来源，先运行 agent-autoloop uninstall 再装。

交付插件

• 审查期间 PR 被别人合并时，还是接着跟踪发布，审查发现的问题不再写进回执。
• 审查快照不再把二进制文件按文字展开，只显示它有变化。带大的二进制文件的 PR 现在也能审。
• 文字差异超过 32MB 时，这一轮按失败处理，不再报一条“改动太大”的问题。
• 三个及以上父提交的章鱼合并照旧直接报问题。

---

This release only takes things away. We went back over a set of guards added around the last release: none of the problems they guard against has been hit by a real user, and some brought regressions of their own. Removing them takes about 500 lines out of the code and tests (#125).

Worker

• When an agent crashes or its process disappears, its result goes in right away, without stopping what's left in its process group. That step only arrived in 1.3.0, and it could never reach the tools of the real Codex and Claude Code, which run them in process groups of their own. Stopping a run by cancelling it or by timeout works as before.
• Session usage totals are no longer cleared after 90 days, so a session resumed after a long gap can still work out what that launch used.

Hub

• The rules file is read at every timed check instead of going by its modified time. Unchanged content writes nothing to the log.
• Databases from before 1.0.0 are no longer specifically refused.

Protocol

• The MCP server no longer insists on the handshake coming first or checks the parameters of initialize. The spec only asks clients not to send requests early. Standard clients aren't affected.
• The key of ask, notice and later in a receipt no longer refuses half a Unicode character. An event's id still does.

Install

• Giving another source over an existing install no longer stops with an error: the install keeps following where it came from. To change source, run agent-autoloop uninstall first.

Delivery plugin

• A PR someone merges during review still has its release followed, and what the review found no longer goes into the receipt.
• The review snapshot no longer spells out binary files as text; it shows that they changed. A PR carrying a large binary can now be reviewed.
• A text diff over 32MB now fails the round, rather than coming back as a "too big" finding.
• An octopus merge of three or more parents is still reported as a finding.

Agent Autoloop 1.3.0

这一版加了几项能力，修了交付插件、ACP 和 MCP 的一批缺陷，并把文档和代码逐条对齐了。

新能力

• 规则可以写 "resume": true：同一事项的新事件接着上一轮的会话，默认还是开新会话。用真实的 Codex 和 Claude Code 跑通过（#114，需求来自 gityangge 的 #102）。
• 回执里的通知可以标成 "fyi": true：只是告诉一声，不带按钮，发完就结案（#103，aieverything2005）。
• 内置 DeepSeek Harness 插件，use: "dsh"：能续接原会话、上报 Token，要 DSH 0.2.2 或更新。我们没有真实跑过，xiaojian94xiaojian 在 WSL2 上实测跑通了问答、用量和 resume，安装参数和凭据的注意事项写在插件说明（#105，Zsx154855）。
• 一条命令让新电脑接活：curl … install.sh | sh -s -- join <地址> --worker <名字> --key <密钥>（#112）。

修复

• 所有命令都拒绝不认识的参数（resolve 后面是说明文字，只检查第一个词），--help 只说用法，不再顺手执行（#106，1152405245hwc-coder；#108）。
• 一个会话里还有别的轮次没结束，或者没了音信、可能还在跑时，要接它的一轮开新会话，不再让两个进程开同一个会话（#114）。
• 被你停掉的一轮不再过几分钟自己回来，说“还会重试”的卡片也一起收掉；规则去掉 parallel 之后，回答和到期复查仍回到原来的事项（#111）。
• 容器里或断电重启后进程号撞到自己，中台不再报“已经在跑了”起不来（#107）。
• 已经装过时指定另一个来源，会明确说要先卸载，不再装回旧来源还说“更新好了”（#107）。
• 有会话的 Agent 插件都能重写写错的回执，不再要求它实现打开会话的链接（#112）。
• 事件的 id、回执里 ask、notice、later 的 key 带半个 Unicode 字符会被拒绝，之前存进去之后再也对不上（#112）。
• 备份目录一定是私有的，目录已存在时也会收紧权限（#112）。
• 仅告知的卡片带上结案时间，看 /v1/state 的客户端不会再把它当成未处理（#118）。

交付插件（#113，这批没有在真实 GitHub 上走过一遍）

• 审查发现问题后，同一个提交再来一条事件不再审第二次：之前第二次没报同样的问题就合并了。误报也要推新提交才重审。
• 三个及以上父提交的章鱼合并直接报问题：之前它带来的改动审查看不到。
• 问题文字里的三个反引号不再截断回执，也不会被当成回执。
• 没打 deliver 标签的已合并 PR 不再被跟踪发布，完成的交付不会被后来的发布改成失败。
• 改动大到审查读不下（多半是大的二进制文件）时交回一条看得懂的问题，不再反复报错。
• 其他：含 NUL 字节的文件能审到内容；健康接口报短提交号也能比较；转 ready 后不拿草稿期的检查放行；等检查期间改了目标分支不合并；中文路径能匹配设置；矩阵检查（check (ubuntu-latest)）能认出来。

ACP、MCP 和接单程序（#115，用官方 Codex ACP 适配器和真实 MCP 客户端跑过）

• ACP 重派时不再把业务重做一遍：接着旧会话时，开工前的失败也留在原会话，只有 Agent 明确拒绝加载才开新的。会话被别的客户端占着时等一会儿再试，也不开新的。
• ACP Agent 只声明 sessionCapabilities.resume 也能接着旧会话，之前要有 loadSession。
• ACP 的 edit 档不再放行通过悬空链接写到工作目录外。
• ACP 只带编号的权限请求能认出是什么操作，read、edit 档不再全部拒绝。
• ACP 失败的一轮不再占位到超时，并且交回真实原因。最后一条消息也不再和前面的话拼在一起被算成做完。
• Agent 崩溃时，留在它进程组里的工具先清干净再交结果。Codex、Claude Code 的命令行让工具另开进程组，这种管不到。
• U+2028、U+2029 不再切断 ACP、MCP 和飞书的消息。
• MCP 慢调用不再挡住其他请求，回复可能不按请求顺序到，按 id 对应。

文档

• 文档和代码逐条核对过，改了 20 多处说得不对或没说清的地方。
• 英文 README 里的示例输出改成了英文（#117，M1racleShih）。
• Hermes 的接法加上 -Q（hermes chat -Q -q {prompt}），只打印最后一条消息。
• 补上 WSL2 的注意事项：systemd、loginctl enable-linger、桌面通知、用量和内存（来自 xiaojian94xiaojian 在 #17 的反馈）。

升级要注意

• 中台和接单程序分开部署时先升中台：旧中台不认识 fyi 字段，会拒绝带它的回执。
• 规则用到的 ACP Agent 必须写 command，没写的规则现在校验不通过（这样的规则本来也跑不起来）。
• 不要把 agent-autoloop mcp 配进接单程序启动的 CLI 的用户级配置：MCP 都按本人记录，一轮就能自己回答自己的卡片。
• 交付插件的检查工作流要带 ready_for_review，否则草稿转 ready 后要多等半小时。
• 自己写的 Agent 插件如果返回 session，就要能按 turn.resume 接回这个会话，没跑成的重派和写错回执的重写都靠它；接不回去的 CLI 不要返回 session。

用 agent-autoloop update 更新。

---

This release adds a few abilities, fixes a set of defects in the delivery plugin, ACP and MCP, and brings the docs in line with the code.

New

• A rule can say "resume": true: a new event on the same thread goes on in the last round's session. By default it still starts a new one. Run for real with Codex and Claude Code (#114, the need came from gityangge in #102).
• A notice in a receipt can be marked "fyi": true: it only tells you something, has no button, and is settled as it's sent (#103, aieverything2005).
• A built-in DeepSeek Harness plugin, use: "dsh": it goes on in its session and reports tokens, and needs DSH 0.2.2 or newer. We haven't run it for real; xiaojian94xiaojian ran questions, usage and resume on WSL2, and what to know about installing it and its credentials is in the plugin notes (#105, Zsx154855).
• One command puts a new computer to work: curl … install.sh | sh -s -- join <address> --worker <name> --key <key> (#112).

Fixes

• Every command refuses flags it doesn't know (resolve is followed by your words, so it only checks the first), and --help only prints usage instead of going ahead (#106, 1152405245hwc-coder; #108).
• A round that would go on in a session where another round hasn't ended, or may still be running, starts a new one, so two processes never open the same session (#114).
• A round you stopped no longer comes back by itself minutes later, and the card saying it would try again closes with it. After a rule drops parallel, answers and due checks still go back to their own thread (#111).
• In a container, or after a power cut, a process number that matches the hub's own no longer stops it starting with "already running" (#107).
• Installing from another source over an existing install now says to uninstall first, instead of installing the old source again and saying it updated (#107).
• Any agent plugin with a session can rewrite a bad receipt, whether or not it can link to the session (#112).
• An event's id, or a key in a receipt's ask, notice or later, with half a Unicode character in it is refused; stored, it could never be matched again (#112).
• A backup folder is always private, even if it already existed (#112).
• A card that only tells you something now has its close time, so a client reading /v1/state won't take it for still waiting (#118).

Delivery plugin (#113; this batch hasn't been through real GitHub end to end)

• After a review finds problems, another event on the same commit no longer reviews it again: the second pass, not repeating the problem, used to merge it. A false alarm now needs a new commit too.
• An octopus merge is reported as a problem: what it brought in used to be invisible to the review.
• Three backticks in a finding no longer cut the receipt short, or get read as a receipt.
• A merged PR without the deliver label isn't followed to release any more, so a later failed release can't mark a finished delivery as failed.
• Changes too big for the review to read (usually a large binary) come back as a finding you can read, not a repeating error.
• Also: files with a NUL byte show their text to the review; a short commit from the health check can be compared; a check from draft days doesn't pass a PR that's gone ready; a PR retargeted during checks isn't merged; Chinese paths match settings; matrix checks like check (ubuntu-latest) are recognised.

ACP, MCP and the worker (#115; run with the official Codex ACP adapter and real MCP clients)

• An ACP retry no longer redoes the work: going on in an old session, a failure before the work starts stays in that session, and only the agent refusing to load it starts a new one. A session another client has open is tried again later, not replaced.
• An ACP agent that only declares sessionCapabilities.resume can now go on in an old session; it used to need loadSession.
• ACP's edit level no longer lets a write through a dangling link out of the working folder.
• An ACP permission request carrying only an id is matched to its tool call, so read and edit no longer refuse everything.
• A failed ACP round no longer holds its place until the timeout, and hands back the real reason. The last message no longer runs together with what came before and counts as done.
• When an agent crashes, tools left in its process group are cleared before the result is handed in. The Codex and Claude Code CLIs run tools in a group of their own, which this doesn't reach.
• U+2028 and U+2029 no longer cut ACP, MCP and Feishu messages.
• A slow MCP call no longer holds up others; replies may come out of order, matched by id.

Docs

• The docs were checked against the code line by line, correcting more than twenty things that were wrong or unclear.
• The English README's sample output is now in English (#117, M1racleShih).
• The Hermes command now has -Q (hermes chat -Q -q {prompt}), so it prints only the last message.
• WSL2 notes: systemd, loginctl enable-linger, desktop notifications, usage and memory (from xiaojian94xiaojian's report in #17).

Before you upgrade

• If the hub and workers are deployed separately, upgrade the hub first: an older hub doesn't know fyi and refuses a receipt with it.
• A rule whose ACP agent has no command now fails the check (such a rule could never run anyway).
• Don't put agent-autoloop mcp in the user-level config of a CLI the worker starts: MCP records everything as you, so a round could answer its own card.
• The delivery plugin's check workflow needs ready_for_review, or a draft gone ready waits half an hour more.
• An agent plugin of your own that returns session must be able to go on in it through turn.resume: a retry and a bad receipt's rewrite both rely on it. A CLI that can't shouldn't return session.

Update with agent-autoloop update.

Agent Autoloop 1.2.0

这一版加了几个命令，修了飞书卡片和交付插件的问题，版本号也有了写明的规则。

新命令

• agent-autoloop status --json：输出 /v1/state 的原样结构，给脚本和看板用（#93，chenjie1129）。
• agent-autoloop rules explain 和 agent-autoloop emit <类型> --dry-run：不连中台，看规则生效的样子，预演一条事件会派给谁（#94，chenjie1129）。
• agent-autoloop backup [目录] 和 agent-autoloop restore <目录>：中台运行时也能做一致性备份，恢复要先停中台（#92，chenjie1129）。备份里有密钥，要和密钥一样保管。

修复

• 飞书不让机器人改别的身份发的消息时，已经结束的卡片另发一条，不再停在回答之前的样子（#95，wuleiyuan）。
• 交付插件遇到 PR 落后 main 时，在这一轮内同步并接着走，不再结束这一轮等中台重试（#88，jasoncodevault）。

版本号

• 版本号现在只写在 tag 上。agent-autoloop --version 显示 v1.2.0，比最新发布新的代码显示“未发布”。MCP 和 ACP 上报的版本也对了，之前一直是 1.0.0。
• 版本号怎么加、承诺不破坏什么，写在协议里。

用 agent-autoloop update 更新。

---

This release adds a few commands, fixes Feishu cards and the delivery plugin, and writes down the rules for version numbers.

New commands

• agent-autoloop status --json prints /v1/state as it is, for scripts and dashboards (#93, chenjie1129).
• agent-autoloop rules explain and agent-autoloop emit <type> --dry-run show the rules in effect and preview who an event would go to, without contacting the hub (#94, chenjie1129).
• agent-autoloop backup [folder] and agent-autoloop restore <folder> take a consistent backup even while the hub runs; restoring needs it stopped (#92, chenjie1129). A backup holds your keys, so keep it as safe as they are.

Fixes

• When Feishu won't let the bot change a message sent under another identity, a finished card is sent again instead of staying as it looked before the answer (#95, wuleiyuan).
• The delivery plugin syncs a PR that's behind main within the same run and carries on, instead of ending the run and waiting for the hub to retry (#88, jasoncodevault).

Version numbers

• The version number now lives only on the tag. agent-autoloop --version says v1.2.0, and code newer than the latest release says it's unreleased. MCP and ACP report the right version too; they had said 1.0.0 all along.
• How the number moves and what it promises not to break is in the protocol.

Update with agent-autoloop update.

Agent Autoloop 1.1.1

v1.1.0 的两处修复（#91）。

• 插件读不懂一轮结尾的输出时，交回运行中已经读到的会话，不再交回启动时预生成的编号。之前重派时接不上那个编号，会开新会话把业务重做一遍。
• 每小时清理旧输出放进了 tick()，自己写循环驱动接单程序的也会执行。

用 agent-autoloop update 更新。

---

Two fixes to v1.1.0 (#91).

• When a plugin can't read the end of a run's output, the session it read while the run went is handed in, not the one made up at launch. A retry couldn't go on in that one, opened a new session and did the work again.
• Clearing old output every hour now happens in tick(), so a loop of your own that drives the worker gets it too.

Update with agent-autoloop update.

Agent Autoloop 1.1.0

v1.0.0 之后的第一批修复和改进。

从这个版本开始，安装和 agent-autoloop update 都装最新的 Release，不再跟 main。 已经装了的运行两次 agent-autoloop update：第一次拉到 main 最新，第二次落到 Release 上。

第一次启动会从日志重建一次投影，历史多时要等一会儿。

更稳

• 插件出错不再拖垮中台：读不懂输出只算这一轮没跑成，通道或接单程序停了 30 秒后重启，没接住的错误只记日志（#79）。
• rules.json 被删、读不到或写错时继续用旧规则，只说一次；中台停着时写坏的也会说（#51、#80）。
• 别的进程占着数据库时，这次到期 5 秒后再试；命令行和中台可以同时写（#53、#79）。
• 连续失败 10 次后停止自动重试，发卡片交给人（#50）。
• 接着旧会话跑时干到一半断了，不再开新会话把业务重做一遍（#60）。
• 查进程失败时不再判定进程已死（#63）。
• 规则删掉或改名后，排着的这一轮停下并发卡片（#54）。
• “接单程序没连上”的卡片关掉后不再马上重发，之后新来的活照常提醒（#80）。
• 飞书监听启动不了时只记日志（#26）。

修复

• 登录 shell 是 fish 时 Agent 启动不了（#22）。
• Claude 把结果输出成一整行数组时读不到（#18）。
• 桌面应用目录里有文件时，找内置 Claude Code 报错（#78）。
• 续接会话时用量重复计入（#56）；没跑成的一轮丢掉回执的用量和会话（#67）。
• join 覆盖已有配置（#19）；init --help 直接执行安装（#75）；key remove 在名字带大写、下划线或点时吊销不了（#39）；try 把上一次的失败当成这一次的（#23）。
• hub.listen 解析出错时监听所有网卡或启动崩溃（#41）；systemd unit 的值没加引号（#38）；doctor 不认系统级服务（#74）；卸载在 Node 25.1 上报错（#61）。

安全

• 卡片链接过期后不再显示内容（#81）。
• master.key 为空或残缺时拒绝启动，不再拿它签链接（#52）。
• 声明超过 8 MB 的请求不读内容（#57）；卡片回答和通道回报的长度上限由内核执行（#40）。
• doctor 提醒没写 answerers 的通道，这种通道里谁都能回答卡片（#84）。

新增

• GitLab 事件插件（#29）。
• 通告卡片可以顺带写一句处理说明（#48）。

性能

• 心跳最多一分钟记一条事实（#62）；排队 5000 件时，心跳从 325 ms 降到 0.2 ms 左右（#70、#73）。
• 接单程序运行中也按时清理旧输出（#82）。
• 只有决定存储内容的文件变了才重建投影（#83）。

感谢

这一版有这些贡献者的 PR：1yu2、abduallahJamal、chenjie1129、KaranocaVe、liuyaanng、Minggnim-jpg、shaojian0514、wsqyouth、wuleiyuan、xiaojian94xiaojian、xiaokekehaha、xiaozefeng、zhangbp7474。

---

The first batch of fixes and improvements since v1.0.0.

From this version on, the installer and agent-autoloop update install the newest release instead of following main. If you've already installed, run agent-autoloop update twice: the first run pulls the latest main, the second settles on the release.

The first start rebuilds the projection from the log once, which takes a while with a lot of history.

Steadier

• A plugin's trouble no longer takes the hub down: output it can't read fails only that run, a channel or worker that stops is restarted after 30 seconds, and stray errors are only logged (#79).
• With rules.json deleted, unreadable or wrong, the old rules keep running and you're told once, even if it broke while the hub was down (#51, #80).
• With the database held by another process, what's due is tried again in 5 seconds, and the CLI and the hub can write at the same time (#53, #79).
• After 10 failures in a row, automatic retries stop and a card goes to you (#50).
• A resumed run that breaks halfway is no longer redone in a new session (#60).
• Failing to check on a process no longer counts as the process being dead (#63).
• A queued run whose rule was removed or renamed stops and sends a card (#54).
• Closing the "worker not connected" card no longer brings it straight back, and work that comes later is still told (#80).
• A Feishu listener that can't start is only logged (#26).

Fixes

• Agents couldn't start when the login shell was fish (#22).
• Claude's result was missed when printed as a one-line array (#18).
• Finding the Claude Code inside the desktop app failed when that folder held files (#78).
• Usage was counted twice on resumed sessions (#56), and a run that didn't finish lost its receipt's usage and session (#67).
• join overwrote existing configuration (#19); init --help ran the install (#75); key remove couldn't revoke names with capitals, underscores or dots (#39); try took the last failure for this one (#23).
• hub.listen could bind every interface or crash at startup (#41); systemd unit values weren't quoted (#38); doctor didn't recognize a system-level service (#74); uninstalling failed on Node 25.1 (#61).

Security

• An expired card link no longer shows the card (#81).
• An empty or cut-short master.key refuses to start instead of signing links with it (#52).
• Requests declaring over 8 MB aren't read (#57), and length limits on answers and channel reports are enforced in the kernel (#40).
• doctor points out channels without answerers, where anyone can answer a card (#84).

New

• A GitLab event source (#29).
• Notice cards can take a line about how they were handled (#48).

Performance

• A heartbeat writes at most one fact a minute (#62), and with 5,000 queued a heartbeat went from 325 ms to about 0.2 ms (#70, #73).
• The worker clears old output while running, not only at startup (#82).
• The projection is rebuilt only when the files that decide what's stored change (#83).

Thanks

This release has pull requests from 1yu2, abduallahJamal, chenjie1129, KaranocaVe, liuyaanng, Minggnim-jpg, shaojian0514, wsqyouth, wuleiyuan, xiaojian94xiaojian, xiaokekehaha, xiaozefeng and zhangbp7474.

Agent Autoloop 1.0.0

Agent Autoloop 的第一个正式版本：让命令行 Agent 在后台自己接活、自己跟进到底，遇到拿不准的事才发卡片找你拍板。

里面有什么

• 内核： 约 1650 行、零运行时依赖。挂起零消耗、事件溯源、指令数据分离、跳数熔断。
• Agent 插件： Claude Code、Codex、ACP，以及接任意命令行的通用命令。
• 事件插件： GitHub Webhook、HTTP 接口、定时规则、Issue 轮询脚本。
• 通道插件： 桌面通知、飞书、钉钉、企微、Slack、Discord。
• 交付插件： 给 PR 打 deliver 标签，审查、等 CI、合并、等发布并核对线上版本。
• 场景模板： 早报、GitHub Issue、线上告警、用户反馈、网站巡检、飞书周报、浏览器交接。

安装

支持 macOS 和 Linux，需要 Node 24、Git、curl 和一个已登录的命令行 Agent。

curl -fsSL https://raw.githubusercontent.com/KKKKhazix/agent-autoloop/main/install.sh | sh
agent-autoloop try

安装命令跟随 main。

---

The first stable release of Agent Autoloop: command-line agents pick up work and follow it through in the background, and send you a card only when a decision is yours to make. See the README. CLI output and default notifications are currently in Chinese.