v5.0.0

Warning

EIDON_BASE_URL is now required in production — the container will not start without it. Set it to the externally reachable address of your instance, for example https://eidon.example.com, in your .env, Docker Compose file or docker run command. In production parseEnv throws before the server binds:

Environment variable EIDON_BASE_URL must be set to an http(s) URL in production;
it is used for share links, notification deep links, and OAuth redirect URLs

An existing install that upgrades to v5.0.0 without setting this variable will fail to boot. This is the breaking change that makes v5.0.0 a major release; it came in with the external push-notification work in #364, which uses the value for run deep links, MCP OAuth registration and the default GitHub Copilot callback. See docs/configuration.md for the full variable reference.

Highlights

• Bots run in a sandbox you approve: shell commands and MCP tools execute in isolated workspaces with a scrubbed environment, and runs pause for your approval before anything privileged happens — including when a bot needs a password typed in for it (#339, #340, #344, #361, #362).
• Watch and take over your bot's browser: one persistent browser per user with a pinned tab per bot, streamed live into the conversation as a floating tile you can hand control in and out of, budgeted against the container's memory limit (#358, #359, #360, #389, #377, #378).
• One shared skill library per team: skills move from per-bot copies to a curated team library you reference with /, and you can reference bots with @ in the composer (#374, #355).
• Review before it sends: the assistant leaves email and Slack drafts you edit and send yourself, so nothing goes out by surprise (#354).
• Notifications for runs and replies: automation runs can reach you through ntfy (self-hostable), Pushover, a raw webhook POST for Slack, Discord or Matrix, or desktop web push on every browser you subscribe. A browser notification also tells you when a reply is ready while the tab is hidden. Notifications are title-only by default unless a channel opts into the run summary, and with EIDON_BASE_URL set every payload carries a deep link straight to the transcript of that run. Webhook URLs and their header values are stored encrypted and are never shown again (#364, #380, #383).
• Bug fixes across the board: eleven of these PRs are fixes rather than features. Bots stop losing delegation loops, stranding shell timeouts and failing skill saves (#345); routine runs bind to the right bot and provider and record their results (#347); interrupted work resumes after a server restart (#350); streaming keeps separate text segments and puts the caret in the right place (#363, #395); unsaved bot edits are guarded and save failures surface instead of vanishing (#384); and the MCP connection test no longer leaks through SSRF (#338).

Detailed list

• Enable password login by default so auth fails closed by @Quack6765 in #337
• Sandbox shell commands into isolated workspaces with scrubbed env by @Quack6765 in #339
• Harden MCP connection tests against SSRF and info leaks by @Quack6765 in #338
• Add Command Code provider presets by @Quack6765 in #341
• Add user approval gate for shell and MCP tool execution by @Quack6765 in #340
• Add bot instruction tools with self-edit and 64k limit by @Quack6765 in #342
• Add pan/pinch zoom and fullscreen to Mermaid diagrams by @Quack6765 in #343
• Pause bot runs for interactive tool approvals by @Quack6765 in #344
• Honor chief bot's own name and instructions in its prompt by @Quack6765 in #346
• Fix routine runs: bot binding, provider, and result tracking by @Quack6765 in #347
• Make the chief of staff home conversation undeletable by @Quack6765 in #348
• Block deletion of bot home conversations by @Quack6765 in #349
• Resume interrupted work after a server restart by @Quack6765 in #350
• Fix bot delegation loops, shell timeouts, and skill saves by @Quack6765 in #345
• Let bots deliver files, revise them in place, and share a team workspace by @Quack6765 in #351
• Rewind or fork a conversation from any message by @Quack6765 in #352
• Bot attention and control: Unread, per-bot runs with stop, and mid-run redirects by @Quack6765 in #353
• Let the assistant leave message drafts you edit and send in chat by @Quack6765 in #354
• Reference bots with @ and skills with / in the composer by @Quack6765 in #355
• Rename waiting_approval to waiting_user and broadcast resolved cards to every viewer by @Quack6765 in #356
• Run on Node 24 with a pinned agent-browser 0.38.1 by @Quack6765 in #357
• Share one persistent browser per user with a pinned tab per bot by @Quack6765 in #358
• Watch the bot's browser live in the conversation by @Quack6765 in #359
• Take over the bot's browser, and let bots hand it to you by @Quack6765 in #360
• Sandbox bots' commands and browser, and filter their web traffic by @Quack6765 in #361
• Let bots ask for a password that Eidon types in for them, and save logins by @Quack6765 in #362
• Preserve separate text segments and fix streaming caret target by @Quack6765 in #363
• Add external push notifications for automation runs by @Quack6765 in #364
• Add GPT Image 2.5 models with extended quality tiers by @Quack6765 in #365
• Fix image generation follow-ups and harden image uploads by @Quack6765 in #366
• Collapse Runs section by default in bot detail view by @Quack6765 in #367
• Redirect /agents to the chief bot conversation by @Quack6765 in #369
• Left-align expanded delegate result output by @Quack6765 in #368
• Stop memory proposals that duplicate the bot's system instructions by @Quack6765 in #370
• Generate images only when the user explicitly asks by @Quack6765 in #371
• Let the model decide when to generate images by @Quack6765 in #372
• refs/heads/Quack6765/sandbox-command-allows by @Quack6765 in #373
• Composite reference images onto canvases with role-aware placement by @Quack6765 in #375
• Replace per-bot skills with a shared team library and curator by @Quack6765 in #374
• Raise default context limit to 1M and refresh provider presets by @Quack6765 in #376
• Keep containerized Chromium off the tiny default /dev/shm and document container setup by @Quack6765 in #377
• Budget bot browsers against the container memory limit by @Quack6765 in #378
• Remove CLAUDE.md project instructions by @Quack6765 in #379
• Render notification summaries per channel markup capability by @Quack6765 in #380
• Show the message sent to and received from a bot under the delegation lines by @Quack6765 in #382
• Add reset-to-defaults for chief bot and shared default prompts by @Quack6765 in #381
• Add one-time automations that run once and self-delete by @Quack6765 in #383
• Guard unsaved bot edits and surface bot save failures clearly by @Quack6765 in #384
• Animate bot avatars with voxel-bot art while running by @Quack6765 in #385
• Add v5.0.0 release notes by @Quack6765 in #386
• Stop fabricating image generation actions on message start by @Quack6765 in #387
• Add Prime Directives and a harness rule that the model owns tool decisions by @Quack6765 in #388
• Float the live browser view as a tile when it scrolls away by @Quack6765 in #389
• Let follow-up messages refine the research plan before starting by @Quack6765 in #390
• Standardize release notes on headline-plus-you format by @Quack6765 in #391
• Sync mobile v1 contract with the mounted route surface by @Quack6765 in #392
• Remove login page banner and switch icon source to warrior image by @Quack6765 in #393
• Update readme by @Quack6765 in #394
• Keep intermediate narration separate when adopting a running turn by @Quack6765 in #395
• v5.0.0 Release by @Quack6765 in #396

Full Changelog: v4.1.0...v5.0.0