v2.4.3

Core

• fix: run plugin runtimes from packaged binaries (@EricSanchezok)

v2.4.2

Core

• fix: stabilize browser and desktop CI contracts (@EricSanchezok)
• style: format pending frontend and plugin changes (@EricSanchezok)
• fix: align plugin permissions with synergy capabilities (@EricSanchezok)
• feat: sync Holos agent profiles from remote (@EricSanchezok)
• Refine plugin marketplace experience (@EricSanchezok)
• Add configurable Blueprint audit agents (@EricSanchezok)
• Add superplan runtime foundations (@EricSanchezok)
• Stabilize desktop release packaging (@EricSanchezok)
• Avoid cross-platform bun install in release build (@EricSanchezok)
• Harden desktop release packaging (@EricSanchezok)

App

• polish: standardize settings controls (@EricSanchezok)
• polish: refine library settings panels (@EricSanchezok)
• polish: tighten Holos account controls (@EricSanchezok)
• polish: refine Holos account settings (@EricSanchezok)
• Use plugin marketplace status dots (@EricSanchezok)
• Clarify plugin marketplace install status (@EricSanchezok)
• Refine workbench surface palette (@EricSanchezok)
• Refine settings usage layout (@EricSanchezok)
• Keep recommended providers visible (@EricSanchezok)
• Refine provider recommendations and detail flow (@EricSanchezok)
• Polish providers settings panel (@EricSanchezok)
• Inline model manager in settings (@EricSanchezok)

v2.4.1

Core

• Add Windows ARM64 parcel watcher dependency (@EricSanchezok)
• Add marketplace plugin icon pipeline (@EricSanchezok)
• Upgrade models settings panel (@EricSanchezok)
• feat: add provider recommendation metadata (@EricSanchezok)
• refactor(browser): collapse workspace to single page (@EricSanchezok)
• fix(browser): keep session reads tabless (@EricSanchezok)
• refactor(browser): mainline workspace presentation modes (@EricSanchezok)
• fix(browser): gate webrtc ready and align input coordinates (@EricSanchezok)
• fix(browser): stabilize webrtc stream negotiation (@EricSanchezok)
• fix(browser): normalize host navigation urls (@EricSanchezok)
• docs: describe current system state directly (@EricSanchezok)
• style(browser): format host readiness changes (@EricSanchezok)
• chore(dev): add source dev orchestrator (@EricSanchezok)
• fix(browser): harden host readiness and csp (@EricSanchezok)
• feat(desktop): productionize electron app (@EricSanchezok)
• Register bash child listeners before tracing (@EricSanchezok)
• Fix bash child exit race (@EricSanchezok)
• Stabilize CI-sensitive tests (@EricSanchezok)
• Stabilize synergy tests after PR merges (@EricSanchezok)
• Normalize tool call inputs before persisting (@EricSanchezok)
• Format files for pre-push hook (@EricSanchezok)
• Restrict Blueprint note writes to Plan Mode (@EricSanchezok)
• Fix Blueprint worktree binding and icon (@EricSanchezok)
• Separate general and coding Blueprint prompts (@EricSanchezok)
• Upgrade note editing anchors (@EricSanchezok)
• Tighten Plan Mode blueprint finalization prompts (@EricSanchezok)
• Wrap plan mode user requests (@EricSanchezok)
• Bridge browser host CDP commands (@EricSanchezok)
• Refine plan mode tool diagnostics (@EricSanchezok)
• Resolve browser tools through attached hosts (@EricSanchezok)
• Autostart remote browser hosts by default (@EricSanchezok)
• Route WebRTC browser hosts per tab (@EricSanchezok)
• Stabilize browser host tab lifecycle (@EricSanchezok)
• Route native browser views through host control (@EricSanchezok)
• Remove legacy browser frame stream (@EricSanchezok)
• Add Electron WebRTC browser host mode (@EricSanchezok)
• Route remote browser presentation through WebRTC signaling (@EricSanchezok)
• Split browser events from desktop control transport (@EricSanchezok)
• Remove direct runtime usage from browser tools (@EricSanchezok)
• Route browser eval and inspect through host control (@EricSanchezok)
• Route browser read fallbacks through host control (@EricSanchezok)
• Route browser interaction tools through host control (@EricSanchezok)
• Route browser tools through host control facade (@EricSanchezok)
• Implement workspace file service platform (@EricSanchezok)
• Split browser control and signaling routes (@EricSanchezok)
• Add browser presentation protocol negotiation (@EricSanchezok)

App

• Align prompt menus with toolbar selector (@EricSanchezok)
• Polish library layout and sync controls (@EricSanchezok)
• Move start mode into prompt toolbar (@EricSanchezok)
• Improve settings toast controls (@EricSanchezok)
• Add new session start options (@EricSanchezok)
• Align agenda and library workbench rhythm (@EricSanchezok)
• Widen session message measure (@EricSanchezok)
• Balance session gutters and workspace width (@EricSanchezok)
• Add confirmation state for skill deletion (@EricSanchezok)
• Polish plugin marketplace responsiveness (@EricSanchezok)
• Keep session measure with workspace open (@EricSanchezok)
• Polish plugin detail view (@EricSanchezok)
• Polish library and settings surfaces (@EricSanchezok)
• Make prompt controls compactable (@EricSanchezok)
• Refine prompt composer chrome (@EricSanchezok)
• Refine library workbench layout (@EricSanchezok)
• Polish library workbench panel (@EricSanchezok)
• fix(browser): support remote IME text input (@EricSanchezok)
• fix(app): keep browser keyboard focus out of prompt (@EricSanchezok)
• Polish question prompt surface (@EricSanchezok)
• Polish agenda calendar surfaces (@EricSanchezok)
• Align Blueprint ready submit button size (@EricSanchezok)
• Fix stale inbox and cortex sync (@EricSanchezok)
• Recreate failed WebRTC browser peers (@EricSanchezok)
• Stabilize WebRTC browser negotiation (@EricSanchezok)
• Sync native browser navigation to host control (@EricSanchezok)
• Attach native browser surface in desktop mode (@EricSanchezok)
• Add Electron desktop browser shell scaffold (@EricSanchezok)

v2.4.0

Core

• fix: avoid cortex category config cycle (@EricSanchezok)
• feat: add structured Cortex task output for plugins (@EricSanchezok)

App

• Format workbench surface tests (@EricSanchezok)
• Stop running sessions when cancelling blueprint runs (@EricSanchezok)
• Harden frontend surface materials (@EricSanchezok)
• Align workbench surface polarity (@EricSanchezok)
• Align workbench utility surfaces (@EricSanchezok)
• Tighten workbench surface polarity (@EricSanchezok)
• Refine agenda surface polarity (@EricSanchezok)
• Normalize theme surface polarity (@EricSanchezok)
• Normalize workbench surface polarity (@EricSanchezok)
• Align frontend surface polarity (@EricSanchezok)
• Tighten agenda surface polarity (@EricSanchezok)
• Ground workbench surface polarity (@EricSanchezok)
• Tune agenda surface polarity (@EricSanchezok)
• Extend workbench surface polarity fallbacks (@EricSanchezok)
• Polish workbench surface polarity (@EricSanchezok)
• Align agenda surface polarity (@EricSanchezok)
• Polish app panel canvas surfaces (@EricSanchezok)
• Polish agenda surfaces and pickers (@EricSanchezok)
• Refine agenda creation UI (@EricSanchezok)
• Polish agenda panel UX (@EricSanchezok)
• Refine app shell settings and sidebar UX (@EricSanchezok)

v2.3.0

Core

• feat(plugin): add media generation display (@EricSanchezok)
• Upgrade account provider usage settings UX (@EricSanchezok)
• Refresh session state between model steps (@EricSanchezok)
• Compress deferred tool outputs (@EricSanchezok)
• Complete provider framework v2 (@EricSanchezok)
• Implement provider framework v2 (@EricSanchezok)
• Redesign settings around config domains (@EricSanchezok)
• Add OpenAI Codex provider (@EricSanchezok)
• Add project instruction file discovery (@EricSanchezok)
• Add dynamic tool expansion (@EricSanchezok)
• Unify tool timeout metadata (@EricSanchezok)
• fix browser tool navigation visibility (@EricSanchezok)
• Retry transient provider connection errors (@EricSanchezok)
• feat: add session inbox guidance queue (@EricSanchezok)
• fix session summary title metadata race (@EricSanchezok)

App

• fit browser viewport to panel (@EricSanchezok)
• quiet browser debug logging (@EricSanchezok)
• fix browser websocket for home scope (@EricSanchezok)
• make browser debug logs visible (@EricSanchezok)
• add browser panel debug logs (@EricSanchezok)
• Render special synthetic user messages (@EricSanchezok)
• fix queued browser commands while connecting (@EricSanchezok)
• Fix sidebar home session running state (@EricSanchezok)
• fix browser address navigation without active tab (@EricSanchezok)
• Unify resource opening for attachments (@EricSanchezok)
• fix(ui): polish session inbox interactions (@EricSanchezok)

SDK

• Add artifact-only plugin tool results (@EricSanchezok)

v2.2.2

Core

• feat(plugin): close official marketplace publishing loop (@EricSanchezok)
• Fix blueprint loop continuation messaging (@EricSanchezok)
• fix(bash): clean up spawn failures (@EricSanchezok)
• feat(session): continue blueprint loops after idle (@EricSanchezok)
• Rename engram subsystem to library (@EricSanchezok)
• Add local observability diagnostics (@EricSanchezok)
• feat(session): split rollback from file restore (@EricSanchezok)

v2.2.1

Core

• Fix plugin kit packaging and CLI startup (@EricSanchezok)
• Refactor auto classifier into smart allow (@EricSanchezok)
• Serve assets without scope context (@EricSanchezok)
• Harden artifact image rendering (@EricSanchezok)
• Render promoted artifacts in conversation flow (@EricSanchezok)
• Add standalone synergy plugin kit (@EricSanchezok)

App

• Format note panel for release hook (@EricSanchezok)
• Refine blueprint and plan mode UI (@EricSanchezok)

v2.2.0

Core

• Delay local embedding runtime loading (@EricSanchezok)
• Externalize optional release bundling imports (@EricSanchezok)
• Fix release binary dependency bundling (@EricSanchezok)
• Add GitHub-backed plugin marketplace (@EricSanchezok)
• Complete plugin platform overhaul (@EricSanchezok)
• Render richer note card previews (@EricSanchezok)
• Expand note card preview metadata (@EricSanchezok)
• Refactor home scope runtime boundaries (@EricSanchezok)
• Refactor synergy global server runtime (@EricSanchezok)
• Fix startup scope label outside instance context (@EricSanchezok)
• Improve Synergy startup terminal output (@EricSanchezok)
• Stabilize worktree snapshot revert test (@EricSanchezok)
• Fix rollback audit status test isolation (@EricSanchezok)
• Harden config compatibility after PR stack (@EricSanchezok)
• Refactor config into domain fragments (@EricSanchezok)
• Fix browser workspace CI checks (@EricSanchezok)
• Tidy orphaned note scope display (@EricSanchezok)
• Implement Playwright browser workspace (@EricSanchezok)
• Improve note card previews (@EricSanchezok)
• Unify blueprint document tools into notes (@EricSanchezok)
• Fix stale blueprint loop state (@EricSanchezok)
• Remove blueprint document status (@EricSanchezok)
• Optimize prompt cache boundary handling (@EricSanchezok)
• Move note origin metadata to footer (@EricSanchezok)
• fix(blueprint): slot/plan-mode/submit/restart/terminal cleanup (@EricSanchezok)
• feat: Blueprint / Plan Mode / Loop Engineering — full frontend + backend (@EricSanchezok)
• refactor(agent): extract agent-table and types from synergy builder (@EricSanchezok)
• fix(blueprint): add auto-generated agent table to supervisor prompt (@EricSanchezok)
• fix(blueprint): harden supervisor audit prompt with structured evidence requirements (@EricSanchezok)
• fix(blueprint): tighten loop tool visibility and audit prompts (@EricSanchezok)
• fix(blueprint): implement auditing→supervisor auto-spawn in blueprint_loop_finish (@EricSanchezok)
• feat: add Blueprint/Plan Mode/Loop Engineering backend (@EricSanchezok)
• fix(browser): make snapshot best-effort in browser_navigate (@EricSanchezok)
• fix(server): allow blob: images in Content-Security-Policy (@EricSanchezok)
• fix(browser): route blocked URLs through permission gate and sync agent tools to frontend (@EricSanchezok)
• test(tool): validate all tool parameter schemas are JSON-Serializable (@EricSanchezok)
• refactor(session): resolve controlProfile by parent-chain walk instead of BFS cascade (@EricSanchezok)
• refactor(browser): replace custom CDP runtime with Playwright driver (@EricSanchezok)
• refactor(plugin-runtime): explicit registry and functional bridge handlers (@EricSanchezok)
• fix(profile): add network_read to CAPABILITY_PERMISSIONS enumeration (@EricSanchezok)
• fix(typecheck): resolve test type errors in browser actions and locator tests (@EricSanchezok)
• fix(test): update workspace enforcement test for file_external_write deny in autonomous (@EricSanchezok)
• fix: browser-route.ts use BrowserWS interface to bypass WSContext type mismatch (@EricSanchezok)
• fix(v2): close remaining design gaps with RED tests (@EricSanchezok)
• fix(plugin): v4.1 audit fixes — route, policy, circular dep, naming, tests (@EricSanchezok)
• feat(plugin): v4.1 runtime modules, auto-policy, logs, marketplace UX, dev dashboard, docs (@EricSanchezok)
• feat(v2): complete design spec — registration, frontend panels, final integration (@EricSanchezok)
• feat(v2): complete v2 agent tools — 9 new built-in browser tools (@EricSanchezok)
• feat(v2): complete Browser Automation API foundation (@EricSanchezok)
• feat(v2): Phase 2-6 modules — actions, downloads, assets, clipboard, eval, browser_read, browser_viewport (@EricSanchezok)
• feat(v2): Phase 1 — Browser Automation API foundation (TDD) (@EricSanchezok)
• feat(plugin): v4 gap closure — enforcement, limits, consent, UI, marketplace (@EricSanchezok)
• feat: complete design spec compliance — 9 remaining gaps (@EricSanchezok)
• fix(batch3-4): structural cleanup + protocol/UX consistency (@EricSanchezok)
• fix(batch1-2): frontend store wiring, protocol, CDP resource safety (@EricSanchezok)
• feat(plugin): v4 runtime isolation, consent engine, toolchain marketplace (@EricSanchezok)
• refactor: BrowserOwner unified identity layer (@EricSanchezok)
• feat(plugin): v3 final — dead code purge, naming fixes, trust tier unification, design gap closure (@EricSanchezok)
• fix: P2 cleanup — remove setSessionFactory + BrowserRuntime.session() dead code (@EricSanchezok)
• fix: post-audit cleanup — 17 fixes from 4-way audit (@EricSanchezok)
• feat(plugin): Platform v3 - security, loader refactor, routes, frontend host, trusted import, sandbox (@EricSanchezok)
• feat: Phase 3 — browser WebSocket server route (@EricSanchezok)
• feat: Phase 2+7 — 13 agent browser tools + agent-browser skill removal (@EricSanchezok)
• feat: Phase 1 — core browser runtime subsystem (@EricSanchezok)
• refactor: replace all agent-visible .toISOString() with local time format (@EricSanchezok)
• feat(plugin): Phase 0-1 security baseline — plugin IDs, capability decomposition, manifest v3, CSP, plaintext auth (@EricSanchezok)
• refactor(agenda): unify prompt to <agenda-context> for all session modes (@EricSanchezok)
• refactor(enforcement): reclassify internal coordination and read-only network tools as low risk (@EricSanchezok)
• feat(agenda): inject signal context (timestamp + run count) into persistent session prompts; align anima permissions with primary agent pattern (@EricSanchezok)
• fix: resolve 14 test failures across packages, fix cross-platform bugs (@EricSanchezok)
• fix(sandbox): update Windows sandbox helper Rust code for windows-sys 0.59 compat (@EricSanchezok)
• fix(enforcement): fix at token in UNSAFE_SHELL_TOKENS causing false positive (@EricSanchezok)
• feat(enforcement): bash external paths use classifyBashRisk to select file_external_read vs _write (@EricSanchezok)
• revise_file: align hashline reliability with oh-my-pi (#120) (@EricSanchezok)
• feat(enforcement): split file_external capability into file_external_read and file_external_write (@EricSanchezok)
• feat(plugin): complete Plugin Platform v2 with tests, docs, and security (@EricSanchezok)
• fix(security): resolve all 5 remaining audit findings (@EricSanchezok)
• fix(security): resolve 3 blockers and 1 high from security audit (@EricSanchezok)
• refactor(ui): Phase 2b — CSS sync, import wiring, dead file cleanup (@EricSanchezok)
• feat(plugin): add sandbox iframe shell and postMessage bridge (@EricSanchezok)
• feat(plugin): mount PluginRoute in server.ts before SPA catch-all (@EricSanchezok)
• feat(plugin): add server plugin routes for Plugin Platform v2 (@EricSanchezok)
• fix(permission): merge dev diagnostic reasons into gate classify() (@yzxoi)
• fix(plugin): enforce plugin tool classification with prefix (@EricSanchezok)
• feat(csp): add baseline Content-Security-Policy header to SPA (@EricSanchezok)
• fix(plugin): remove false encryption claim from auth store (@EricSanchezok)
• refactor(permission): wire circuit breaker, remove dead code, add regression tests (@yzxoi)
• fix(ui): surface diagnostic refusal reason in frontend audit tooltip (@EricSanchezok)
• fix(permission): classifier must never bypass profile deny (@yzxoi)
• fix: stop routing bug tasks to code-cartographer first (@EricSanchezok)
• fix(enforcement): surface diagnostic reasons for all destructive shell commands (@EricSanchezok)
• feat(enforcement): diagnostic transparency — agents see why commands are blocked (@EricSanchezok)
• feat: grant note_write/note_edit to all subagents via common base permissions (@EricSanchezok)
• fix(sandbox): cross-platform path normalization for Windows (@EricSanchezok)
• fix(permission): read auto_classifier from top-level config, not permission sub-object (@yzxoi)
• fix(classifier): don't feed capability labels to the LLM (@yzxoi)
• fix(permission): move classifier BEFORE profile decision so Auto Mode works under autonomous (@yzxoi)
• fix(test): stabilize flaky scope/index sort test with explicit touch (@yzxoi)
• test(permission): add tests for rule engine and classifier (Stage 3+4) (@yzxoi)
• feat(ui): add 'Always allow' button that persists user permission rules (@yzxoi)
• feat(permission): wire user rules + classifier into applyGateApproval (@yzxoi)
• feat(permission): add LLM risk classifier with circuit breaker (Stage 4) (@yzxoi)
• feat(permission): add persistent user rule store (Stage 3) (@yzxoi)
• test(permission): add tests for destructive analyzer, protected paths, and session memory (@yzxoi)
• feat(permission): add Protected Paths hard boundary + resilient destructive detection (@yzxoi)
• feat(permission): add Provenance layer for agenda-triggered sessions (@yzxoi)
• feat(permission): add session memory + ask timeout to permission runtime (@yzxoi)
• fix: forward attachments from plugin tool results to runtime bridge (@EricSanchezok)
• fix(test): add non-null assertions for strict typecheck compliance (@EricSanchezok)
• fix(test): convert require() to await import() in enforcement tests (@EricSanchezok)
• feat(prepare): compile sandbox helper in bun dev prepare (@EricSanchezok)
• feat(sandbox): source-deploy + pre-release sandbox usability (@EricSanchezok)
• refactor(sandbox): deep maintainability cleanup — naming, logic, redundancy (@EricSanchezok)
• feat(sandbox): complete CI/bundling/elevated-backend distribution pipeline (@EricSanchezok)
• fix(test): convert require() to await import() in enforcement tests, fix glob test directory conflict (@EricSanchezok)
• fix(test): update autonomous test assertions for deny shell_destructive + allow file_external (@EricSanchezok)
• fix(profile): autonomous denies shell_destructive, update tests for new behavior (@EricSanchezok)
• fix(test): add async/await to all EnforcementGate.create() calls across gate/mcp-plugin/workspace tests (@EricSanchezok)
• fix(test): add async to mcp-plugin test func...

v2.1.3

Core

• fix(agent): show full agent description in table — remove sentence truncation (@EricSanchezok)
• chore(skill): remove built-in frontend-design skill (@EricSanchezok)

v2.1.2

Core

• fix(agent): fix agent table truncation and rebalance subagent selection in synergy-max prompt (@EricSanchezok)
• fix(agent): rebalance synergy-max research discipline — add academic literature pipeline alongside docs-researcher (@EricSanchezok)
• feat(config): Phase 2 — remote config graceful fallback + TimeoutConfig hot-reload fix + dead code removal (@EricSanchezok)
• feat(config): add startup fault tolerance — sectional Zod fallback, plugin skip, markdown forgiveness (@EricSanchezok)