v0.12.0 — Grok Build, Needs You, iOS UX

v0.12.0 — Grok Build, Needs You, transcript streaming, iOS UX

Grok Build — first-class backend

• Full xAI OAuth flow (device-auth), ~/.grok/auth.json mirrored per mission workspace, container-aware --cwd translation, grok-build default model exposed via /api/providers.
• /goal <objective> for Grok. Grok ships no native goal mode, so sandboxed.sh drives the loop: a sentinel protocol (<goal_complete/> / <goal_continue/> / <goal_aborted reason="…"/>) is injected into the first-turn prompt, then an AgentFinished automation re-fires a short continuation prompt every turn until the model declares done, the iteration budget (25) is hit, or two consecutive sentinel-missing turns trigger an auto-abort. Iteration / status events use the same SSE shape as codex so the dashboard's iter-N pill and the Automations panel light up without UI changes. Cancellation cleanly tears the loop down (aborted:cancelled).
• Pre-existing Grok bugs fixed. Grok no longer inherits the global DEFAULT_MODEL (was anthropic/claude-opus-4-6, which the CLI rejected). Continuations use -s/--session-id (upsert semantics) instead of --resume so orphan sessions from a failed first turn self-heal.

"Needs You" mission lifecycle

• New MissionStatus::AwaitingUser / Acknowledged variants. Turn-complete-with-no-follow-up parks the mission in AwaitingUser instead of Completed. Opening the mission stamps first_viewed_at; a 1 h grace timer promotes the mission to Acknowledged. Any new user message wakes it back to Active.
• Dashboard column rewired: Needs You = awaiting_user; Finished = completed / acknowledged / failed / interrupted / blocked / not_feasible with green/red tone via finishedTone(status). New POST /api/control/missions/:id/opened broadcasts the state change so other open clients re-tint without a refresh.
• New GET /api/control/missions/:id/{transcript,trace} endpoints split the mission view: chat paints from transcript (small, fast) and tool/thinking activity hydrates from trace after first paint. Storage backends (sqlite/memory/file) updated with first_viewed_at + idempotent migration.

iOS UX responsiveness pass

• Mission switch is cache-first — opening a recent mission renders instantly instead of behind a spinner.
• Parallelized RTTs — loadMission / switchToMission fan out metadata + events via async let; BackendAgentService walks per-backend configs and agents via two withTaskGroups instead of N sequential awaits.
• Synchronous-optimistic gestures everywhere: queue swipe-to-delete + clear, mission delete, automation toggle / delete, mission status menu, mission cancel chip, send-message bubble (isPending), FIDO approve/deny — all mutate local state on the same frame as the gesture, then fire the network call.
• Files browser: per-path LRU cache with stale-while-revalidate so navigation doesn't blank.
• Skeleton scaffolds on History, Files, Workspaces initial loads (replaces full-screen LoadingView).
• Cosmetic latency deleted: SetupSheet 500 ms post-success sleep, Terminal 500 ms "fake connect" timer, 300 ms workspace-switch reconnect delay. Terminal now promotes to .connected on first message with a 3 s safety fallback for silent shells.

Transcript performance & correctness

• Mission history streams newest-first; cache hydrates instantly on reopen.
• "Load older messages" pinning bug fixed on web + iOS: metaTotal is now computed from the loadable subset of event_counts only.
• Deferred trace merge deduplicates by sequence (web Map, iOS [Int64: StoredEvent]).

Cleanup & fixes

• Amp/ampcode backend removed.
• Local dashboard API-base inference; config naming aligned.
• xAI add-provider modal now selects ["opencode", "grok"] for both OAuth-method and direct-provider paths.
• Thinking panel default reverted to closed (auto-show on thinking-start remains).
• Trace API limit/offset use !== undefined so offset: 0 survives.
• Favicon dot colors aligned with STATUS_DOT_COLORS palette.
• Clippy clean against Rust 1.95.

Files: ~30 sources across src/api/, src/backend/, dashboard/src/, ios_dashboard/SandboxedDashboard/. Version bump 0.11.5 → 0.12.0 in Cargo.toml, Cargo.lock, dashboard/package.json. PR #433.

v0.11.5 - Native Harness Loops & iOS Network Resilience

Bundles PR #432 — clean reimplementation of the still-unique work from the abandoned #430 (Codex goal mode + iOS network resilience WIP).

Features

Native harness loops as Automation rows

Claudecode and codex /goal continuation loops now materialize as first-class rows in the Automations panel, with iteration badges and a per-row stop button — alongside OA-scheduled automations.

• New NativeLoopAdapter trait + registry in src/backend/native_loops.rs
• Broadcast subscriber src/api/native_loop_observer.rs translates GoalIteration / GoalStatus events into Automation + AutomationExecution rows
• mission_store gains a CommandSource::NativeLoop { harness, command, args } variant and an AutomationDriver { Scheduler, HarnessLoop } enum (defaults to Scheduler for back-compat)
• Idempotent SQL migration adds a driver column to automations
• The harness CLI still drives iteration; OA only observes

iOS network resilience

• Dedicated JSON URLSession with bounded 15s request / 60s resource timeouts (was unbounded behind URLSession.shared defaults)
• Retry/backoff on transient failures, SSE parser hardening
• Filesystem-backed mission cache; the old multi-MB UserDefaults blob is drained once via SandboxedDashboardApp.init
• New NetworkResilienceTests target pinning the behaviours

Claude Code built-in ScheduleWakeup bridge

• mission_runner watches for Claude Code's built-in ScheduleWakeup tool call, captures (delaySeconds, prompt, reason), and on a successful tool result POSTs an interval automation that fires the prompt back into the mission after the requested delay (clamped to [60, 3600])
• New 300s heartbeat (env-tunable via SANDBOXED_SH_CLAUDECODE_HEARTBEAT_INTERVAL_SECS) keeps the actor-level stuck-mission watchdog quiet during extended thinking, where the CLI emits only scaffolding stream events for minutes

Bugbot follow-ups (within the release window)

• sqlite: drop a duplicate driver column from get_mission_automations SELECT
• native_loop_observer: evict the mission cache entry on terminal status, and skip inactive rows when matching — so a new /goal on the same mission creates a fresh automation row instead of appending to the hidden inactive one
• ControlView: restore the 15s timeout on image fetches that the resilience pass had dropped
• APIService: drop unused error structs (StreamInactivityError, StreamOversizeError)

Upgrade notes

Existing rows automatically default to driver = scheduler via the migration; no manual data fix required.

Full Changelog: v0.11.4...v0.11.5

v0.11.1 - Mission Workbench BugBot Fixes

v0.11.1 highlights

Patch release for the Mission Workbench and Needs You inbox rollout.

Changes

• Aligns Mission Workbench running-state rendering with the header's effective running-state logic instead of treating any RunningMissionInfo object as running.
• Keeps running missions indigo in the workbench, while stale/finished running records fall back to the stored mission status.
• Preserves the Needs You inbox total-count fix from v0.11.0 and the workbench running-color fix from PR #404.
• Bumps backend and dashboard package versions to 0.11.1.

Verification

• cargo check
• dashboard: bun run build
• dashboard: bunx playwright test tests/control.spec.ts --reporter=line --workers=1
• dashboard: bunx playwright test tests/overview.spec.ts:95 --reporter=line --workers=1
• dashboard: bun run test:unit -- src/lib/mission-status.test.ts
• Targeted ESLint passed with existing warnings only.

Full changelog: v0.11.0...v0.11.1

v0.11.0 - Mission Workbench & Goal Mode

v0.11.0 highlights (since v0.10.0)

This release brings the dashboard mission-management workflow forward and includes the latest backend/runtime reliability work.

Most important changes

• Added the Mission Workbench side panel on the control page with mission metadata, role/workspace context, quick lifecycle actions, status controls, and worker mission links.
• Added the Needs You inbox for blocked/interrupted missions that are waiting on user input, with regression coverage for running/resumed missions and large inbox counts.
• Added Codex goal-mode support through the app-server protocol.
• Included the follow-up BugBot fixes for workbench running-state colors and Needs You total badge counts.
• Kept CI green across format, clippy, tests, dashboard unit tests, harness contract tests, capability matrix checks, and Vercel previews for the merged PR.

Verification used for this release

• cargo check
• dashboard: bun run build
• dashboard: bun run test:unit -- src/lib/mission-status.test.ts
• dashboard: bunx playwright test tests/overview.spec.ts:95 --reporter=line --workers=1
• dashboard: bunx playwright test tests/control.spec.ts --reporter=line --workers=1
• PR #404 CI checks passed on GitHub before merge.

Full changelog: v0.10.0...v0.11.0

v0.10.0

v0.10.0 highlights (since v0.9.1)

This release focused on mission reliability, automation control, and cross-client parity.

Most important changes

• Hardened OpenCode/Codex execution paths: workspace-specific CLI/binary resolution, outdated CLI guarding, improved non-zero exit handling, and better session propagation.
• Improved automation behavior and observability: stronger stop-policy handling, last-run visibility fixes, deferred proxy queue mode for rate-limited routing, and better command prefill UX.
• Expanded cost telemetry accuracy: normalized cost metadata at storage boundaries, malformed/negative cost clamping, and improved source-aware aggregation.
• Added cost-source clarity in product surfaces: analytics/dashboard breakdown for actual vs estimated vs unknown costs, plus iOS parity updates.
• Shipped major iOS mission UX improvements: agent selection/default-agent flows, mission-title updates, and more robust backend-agent loading/cache handling.
• Added LLM settings in the dashboard, including live Cerebras model catalog loading for current model IDs.
• Added global mission concurrency control in Settings (Max Parallel Missions) and clarified it as backend-agnostic.
• Strengthened quality gates: harness-contract CI checks, capability-matrix parity checks, and expanded regression test coverage.

Additional notable updates

• Google OAuth routing/proxy hardening and model-routing improvements.
• RTK and settings UX/persistence fixes.
• Mission debug bundle script + runbook for faster diagnostics.
• Multiple backend hardening passes for panic avoidance and error-surface quality.

Full changelog: v0.9.1...8ea8377

v0.9.1 - Mission Reliability & RTK Integration

What's Changed

Major reliability and feature release addressing provider concurrency hangs, mission execution stability, and adding RTK output compression support.

Provider Concurrency Fix

• Fix provider slot held forever when LLM API hangs — heartbeats no longer count as activity; provider permits are released during tool execution so other missions can use the LLM slot
• Fix premature 30s timeout on OpenCode missions with unresponsive LLMs — unknown-role messages no longer falsely trigger the text idle timeout

Mission Execution Reliability

• Fix "Unknown error" on Claude Code session resume after restart — now properly extracts errors from the errors[] array and auto-retries with a fresh session
• Fix OpenCode missions marked success with no assistant output (#147, #151) — banner-only output is now correctly detected as a failure
• Surface OpenCode provider error details in mission events (#146) — errors from stderr are now emitted as real-time events
• Fix JSON error extraction fallback and parallel cancel status (#149) — restructured extraction chain and fixed cancel → interrupted status
• Prevent targeted messages from being silently sent to wrong mission
• Fix complete_mission targeting wrong mission and cancelled status
• Fix mission stuck Active on task panic and resume stall detection
• Fix three latent race conditions in OpenCode mission execution
• Separate stderr error capture from SSE error signal to prevent false-positive recovery blocking
• Accumulate SSE text deltas as fallback for truncated assistant output
• Detect tool-call-only output and surface error instead of raw JSON
• Fix session corruption retry, history contamination, and idle runner polling
• Fix SSE session.idle not reset on reconnect causing premature kill
• Fix inactivity timeout firing during SSE reconnect and cancel teardown race
• Tighten banner line filters to prevent false-positive model text drops

RTK Integration (Recursive Token Kit)

• Add RTK integration for CLI output compression via Claude Code PreToolUse hooks — achieves 50-65% token savings on command output
• Container support: automatically copies RTK binary into nspawn containers with proper path translation
• Proper RTK subcommand mapping with -- separator to prevent flag conflicts
• RTK Token Savings card on the model routing dashboard page

Dashboard Improvements

• Improve model routing UI: native selects, chain defaults, copy feedback, and chain options in model override
• Fix duplicate thinking blocks and add model info to debug dropdown

Other

• Fix Codex using wrong default model and update model catalog with latest OpenAI models
• Add codex-* prefix support for OpenAI model validation

Full Changelog: v0.9.0...v0.9.1

v0.9.0 - OpenCode Integration & Session Reliability

OpenCode Integration Fixes

Model Override & Provider Injection

• GLM-5 and non-catalog model support: OpenCode agents now correctly handle models not in the built-in catalog (glm-5, cerebras models, xai models) by injecting custom provider definitions into opencode.json
• Provider auth detection: Added ZHIPU_API_KEY (Z.AI) and CEREBRAS_API_KEY (Cerebras) to provider authentication detection
• Provider model injection fix: Fixed provider injection when the models object is missing from opencode.json
• ZAI base URL: Corrected Z.AI provider injection to use api.z.ai base URL
• ZAI coding subscription endpoint: Updated to use the correct ZAI coding subscription API endpoint

Output & Streaming Fixes

• Output fallback improvements: opencode_output_needs_fallback() now recognizes [run] prefix lines, "event stream did not close" messages, and "continuing shutdown" patterns as banner text, triggering proper recovery from session storage
• JSONC config parsing: Oh-my-opencode .jsonc config files are now correctly parsed by stripping comments before JSON parsing
• Provider injection ordering: Provider definitions are now injected before oh-my-opencode config processing to ensure correct resolution

OAuth & Auth

• OAuth refresh race condition fix: New refresh_oauth_token_with_lock() uses file-based locking to prevent race conditions with rotating refresh tokens across concurrent missions

Session Reliability

• Session corruption handling: Graceful recovery from response.incomplete and tool_use_id mismatch errors (#134)
• Thinking block deduplication: Fixed thinking blocks being merged into a single thought (#136)

Automations & UI

• Automations auto-populate: Variables are now auto-populated from command params and inline prompts (#133)
• Automation command selector: Fixed command selector and auto-detect variables (#135)
• Rename Extensions → Inspect: Consolidated observability hub (#132)

Installation

curl -sSL https://install.sandboxed.sh | bash

v0.8.1 - Model Overrides & Provider Health Check

Bug Fixes

Model Override Fixes

• Model override persistence: Model overrides now persist correctly when reopening the New Mission dialog with initialValues
• Stale override on backend switch: Overrides incompatible with the new backend are cleared; amp backend always clears overrides since it doesn't support them
• Validation for uncataloged providers: validate_model_override no longer rejects valid overrides for providers without a fetched model catalog (e.g. Deep Infra)
• Parallel mission runner: Model override is now correctly applied in the parallel execution path
• Duplicate thinking events: Fixed the JSON output path not marking sse_done_sent after emitting a thinking completion event, which could cause duplicate done events

Provider Fixes

• Missing providers in model selection: Z.AI and Cerebras now appear in the model override dropdown (all non-default ProviderType variants are included)
• Health check key aliases: Provider health check now uses opencode_auth_keys() to check all credential aliases (e.g. OpenAI credentials stored under "codex")
• Health check apiKey field: The camelCase apiKey field is now correctly extracted from auth entries
• User input leak: Fixed OpenCode echoing user input through stderr fallback instead of model output
• Subtask progress overflow: Fixed progress counter overflow in subtask tracking

New Features

Provider Health Check

• New POST /api/ai/providers/:id/health endpoint to validate provider credentials and connectivity
• Supports API key validation, OAuth status check, and custom provider URL verification
• Works with both UUID-based custom providers and type-based standard providers

Dynamic Model Catalog

• Models are now fetched from provider APIs (OpenAI, Anthropic, xAI, Cerebras, Z.AI) at startup
• Fetched models are merged with hardcoded defaults for a comprehensive model list
• Updated default model lists (Grok 3/4, latest GLM models)

UI Improvements

• Sidebar rename: "Configs" renamed to "Profiles" for clarity
• Model display names: Intelligent model ID to display name conversion with acronym detection

Technical Details

• Version bump: 0.8.0 → 0.8.1
• Replaced non-existent claude-sonnet-4-6 with claude-sonnet-4-5-20250929
• Config editor height overflow fix in dashboard pages

Installation

curl -sSL https://install.sandboxed.sh | bash

v0.8.0 - Alternative AI Provider Support (Cerebras & Z.AI)

🚀 New Features

Alternative AI Provider Support

• Cerebras Integration: Full support for Cerebras AI models via OpenCode backend
  • llama-3.3-70b for deep reasoning tasks
  • llama-3.1-8b for quick operations
• Z.AI Integration: Support for ZhipuAI (智谱AI) GLM models
  • glm-5 for complex tasks
  • glm-4-flash for rapid responses
• Example Configurations: Added oh-my-opencode profile examples in examples/oh-my-opencode/

OAuth Stability Improvements

• Invalid Grant Detection: Automatically detect expired/revoked OAuth refresh tokens
• NeedsReauth Status: New provider status to prompt users for re-authentication
• Error Classification: Distinguish between invalid_grant errors and other OAuth failures
• Provider Status Management: Added set_status method to AIProviderStore for dynamic status updates

Code Quality

• Fixed all clippy warnings across the codebase
• Improved error handling and logging for OAuth token refresh flows

📚 Documentation

• New PROVIDERS.md guide for configuring AI providers
• OAuth refresh analysis documentation
• Persistent sessions design documentation

🔧 Technical Details

• OAuthRefreshError enum for better error handling
• Enhanced token refresh loop with proper error categorization
• Improved provider status tracking

🧪 Testing

Both Cerebras and Z.AI providers have been tested end-to-end successfully with real API keys.

📦 Installation

curl -sSL https://install.sandboxed.sh | bash

Or pull the latest Docker image:

docker pull ghcr.io/th0rgal/sandboxed-sh:latest

---

Full Changelog: v0.7.9...v0.8.0

v0.7.9 - iOS Mobile Experience Improvements

iOS Mobile Experience Improvements

This release significantly improves the sandboxed.sh iOS mobile app experience.

🎯 Key Improvements

Historical Conversations

• ✅ Historical conversations now load correctly when reopening the app
• ✅ UserDefaults caching for instant display of previously viewed conversations
• ✅ App lifecycle monitoring to catch missed SSE events when returning to foreground

User Interface

• ✅ Conversations appear instantly at the bottom (no more jarring scroll animation)
• ✅ Immediate scroll positioning for historical loads
• ✅ Smooth, animated scroll only for new messages during active sessions

Thoughts Panel

• ✅ Thoughts panel now displays thinking events (matching web dashboard behavior)
• ✅ Added "thinking" event type to API requests

Bug Fixes

• 🐛 Fixed defer timing issue with isLoadingHistory flag
• 🐛 Fixed race conditions in reloadMissionFromServer
• 🐛 Fixed cached data visibility issue
• 🐛 Fixed animated scroll conflicts during history load

📦 Version Updates

• iOS app: 1.0 → 1.1
• Backend: 0.7.8 → 0.7.9

🔧 Technical Changes

• Implemented UserDefaults caching with `cacheMissionHistory()` and `loadCachedMissionHistory()`
• Added `scenePhase` monitoring for app lifecycle events
• Created `reloadMissionFromServer()` function for background-to-foreground transitions
• Added proper race condition guards checking `viewingMissionId` after async operations
• Replaced synchronous `defer` with async Task delay for state flag management

📝 Pull Request

Full details: #107

All changes reviewed and approved by Cursor Bugbot with all review threads resolved.