Skip to content

Pad v0.14.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Aug 21:18
· 249 commits to main since this release
v0.14.0
94441b4

Highlights

Talk to your running agents. pad push dispatches user-authored instructions to connected agent sessions (IDEA-2544), backed by a session-presence registry with GET /api/v1/sessions and session identity announced on the event stream (PLAN-2558). The web UI grew a push-to-agent composer in the item view and quick actions that push to a connected session, with per-session targeting and delivery tracking.

Behavior change: assignment no longer notifies. Assigning an item is bookkeeping (who owns this); a push is dispatch (where attention goes now). Assignment events are dropped from the addressed-to-you watch stream entirely — no opt-in flag — so a triage session assigning N items no longer sprays N notifications into every open session of the assignee. push is now the only addressed kind. (TASK-2551)

A sharper MCP surface (ToolSurfaceVersion 0.20). Every tool now carries explicit annotations from the catalog's write-shape knowledge, the HTTP transport returns the same summary-shaped item lists as stdio, and assignments are fully agent-operable: clear_assigned_user / clear_agent_role and clear_parent make un-setting as discoverable as setting. (BUG-2302, BUG-2305, IDEA-2584, BUG-2078)

Auth hardening. The cloud-secret bypass in RequireAuth is now gated on a validated session (BUG-1944), OAuth protected-resource metadata is served RFC 9728 path-aware (BUG-2266), and the CLI auth poll loop got its own wall-clock timeout (BUG-2572). Release binaries build with go1.26.6, clearing all reachable stdlib advisories (BUG-2565).

A CLI that behaves headless. Prompts are consistently gated on an interactive terminal — pad init's login step, bootstrap prompting, pad agent install's (Y/n) — and non-interactive workspace init fails fast and quiet. Markdown output landed on the remaining list surfaces. (BUG-2592, BUG-2597, BUG-2593, BUG-2538, BUG-2577)

Release-channel isolation. RC tags no longer touch the Homebrew tap or the Docker :latest tag — prereleases publish only their own versioned artifacts (BUG-2524). This release's rc.1 was the live exercise of that guard.

Install

brew install PerpetualSoftware/tap/pad

or nix run github:PerpetualSoftware/pad/release, or docker pull ghcr.io/perpetualsoftware/pad:0.14.0.

Verifying

All artifacts ship with SLSA provenance, SBOMs, and Sigstore signatures:

cosign verify-blob \
  --certificate-identity-regexp "^https://github.com/PerpetualSoftware/pad/.github/workflows/release.yml@.*" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --bundle ./checksums.txt.sigstore.json ./checksums.txt

Changelog

Features

  • b9381bf: feat(cli): markdown output on the remaining list surfaces; broaden ANSI stripping (#1080) (@b4rk13)
  • ef903f0: feat(cli,mcp): --clear-parent / clear_parent to detach an item's parent (BUG-2078) (#1113) (@xarmian)
  • d7da237: feat(mcp,cli): clear_assigned_user / clear_agent_role — a discoverable unassign (IDEA-2584) (#1107) (@xarmian)
  • da6ce64: feat(push): pad push — user-authored instruction dispatch to agent sessions (IDEA-2544 Phase 1) (#1090) (@xarmian)
  • 00a91df: feat(push): session targeting — target_session_id + delivered_sessions (TASK-2588) (#1108) (@xarmian)
  • c84cf74: feat(sessions): announce session identity on the event stream (PLAN-2558 S2, TASK-2560) (#1094) (@xarmian)
  • 21001bc: feat(sessions): session-presence registry + GET /api/v1/sessions (PLAN-2558 S1) (#1091) (@xarmian)
  • 599fdbd: feat(watch): drop assignment from the addressed-to-you stream (IDEA-2544 Phase 2, TASK-2551) (#1092) (@xarmian)
  • e03ba45: feat(web): push-to-agent composer in the item view (TASK-2561) (#1099) (@xarmian)
  • bfa9082: feat(web): quick actions push to a connected agent session (TASK-2562) (#1103) (@xarmian)

Bug fixes

  • 8af62d1: fix(ci): build with go1.26.6 to clear the govulncheck gate (BUG-2565) (#1093) (@xarmian)
  • ac05d8a: fix(cli): fail fast and quiet on non-interactive workspace init (BUG-2538, BUG-2577) (#1111) (@xarmian)
  • 2580c2c: fix(cli): gate pad init's Step-4 login on canPromptForConfig() (BUG-2592) (#1115) (@xarmian)
  • 9c155ac: fix(cli): gate promptAndBootstrap on canPromptForConfig() (BUG-2597) (#1119) (@xarmian)
  • 7d5d3bd: fix(cli): give the CLI auth poll loop its own wall-clock timeout (BUG-2572) (#1109) (@xarmian)
  • 847ee73: fix(cli): lift assigned_user_id / agent_role_id onto their columns (BUG-2583) (#1106) (@xarmian)
  • 4a2c4c1: fix(cli): suppress pad agent install's dangling (Y/n) prompt in non-interactive contexts (BUG-2593) (#1116) (@xarmian)
  • 212d59e: fix(cli,server): make agent attribution actually happen (BUG-2542) (#1088) (@xarmian)
  • 727cd80: fix(mcp): explicit tool annotations from catalog write-shape knowledge (BUG-2302) (#1121) (@xarmian)
  • ee05c58: fix(mcp): let an agent clear an item assignment (TASK-2571) (#1104) (@xarmian)
  • 900b0c4: fix(mcp): summary-shaped item list on the HTTP transport (BUG-2305) (#1122) (@xarmian)
  • 3027405: fix(release): keep RC tags off brew and docker :latest (BUG-2524) (#1110) (@xarmian)
  • d895418: fix(server): gate RequireAuth's cloud-secret bypass on validated session (BUG-1944) (#1112) (@xarmian)
  • aa33dc4: fix(server): serve RFC 9728 PRM at path-aware well-known (BUG-2266) (#1120) (@xarmian)
  • 7943234: fix(store): treat empty assignment IDs as clear-to-NULL (BUG-2566) (#1098) (@xarmian)
  • 2c5803a: fix(web): arm the connect-time sync on FIRST connect, not only on leader promotion (BUG-2540) (#1101) (@xarmian)
  • cada877: fix(web): full-page pane host gets its own navigate-away handling (BUG-2178) (#1123) (@xarmian)
  • 3098a1f: fix(web): search Enter go-to accepts full refs like TASK-1345 (BUG-2128) (#1117) (@xarmian)

Other changes

  • a8989a0: chore(ci)(deps): bump actions/attest-build-provenance (#1071) (@dependabot[bot])
  • f1bd144: chore(ci)(deps): bump actions/checkout from 6.0.2 to 7.0.1 (#1073) (@dependabot[bot])
  • 8ba08c7: chore(deps)(deps): bump the npm-minor-and-patch group (#1072) (@dependabot[bot])
  • a7b70c2: chore(deps)(deps-dev): bump @testing-library/jest-dom in /web (#1044) (@dependabot[bot])
  • 312f28d: chore(deps)(deps-dev): bump vitest from 3.2.6 to 4.1.10 in /web (#1045) (@dependabot[bot])
  • ad1e919: chore(deps): bump otel exporters to v1.45.0, clearing GO-2026-4985 from the Nix baseline (#1097) (@xarmian)
  • ff20193: chore(deps): bump x/image to v0.45.0, clearing GO-2026-6222 from the Nix baseline (#1096) (@xarmian)
  • 94441b4: chore(nix): bump package version to 0.14.0 ahead of the release tag (@xarmian)
  • cfad8d9: ci(nix): gate the Nix-built binary with govulncheck (BUG-2567) (#1095) (@xarmian)
  • 1882206: docs(plugin): push-targeting etiquette + assignment-is-watch-only wording; plugin 0.2.0 (TASK-2591) (#1114) (@xarmian)
  • 403a6de: docs(skill): structured bootstrap-failure branch + onboarding precondition in the embed source (BUG-2541) (#1100) (@xarmian)
  • 79b3220: test(server): drive the reval-fault test off the fault seam instead of a sleep (BUG-2570) (#1102) (@xarmian)
  • b887b0b: test(web): capture pristine DOM probes at module load in mockOpenModals helpers (#1105) (@xarmian)

Contributors

b4rk13, xarmian, and dependabot
Assets 16
Loading